@noy-db/hub 0.3.0-pre.11 → 0.3.0-pre.12

package/dist/{chunk-RKRGDAS7.js → chunk-6MA575R5.js}

@@ -1,19 +1,19 @@
 import {
   ATTESTATIONS_COLLECTION,
   loadOrCreateSigner
-} from "./chunk-D3EFFFOL.js";
+} from "./chunk-NT2ZO4KI.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
   encrypt
-} from "./chunk-HUS3J5WM.js";
+} from "./chunk-37WOJQWY.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-CKZW6P5V.js";
+} from "./chunk-JC75UBMT.js";
 import {
   AttestationError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/with-audit/attestation/issue.ts
 import {
@@ -56,4 +56,4 @@ async function issueAttestationCore(ctx, args) {
 export {
   issueAttestationCore
 };
-//# sourceMappingURL=chunk-RKRGDAS7.js.map
+//# sourceMappingURL=chunk-6MA575R5.js.map

package/dist/{chunk-3CNQ7FQ3.js → chunk-6S7ENMRE.js}

@@ -3,8 +3,9 @@ import {
   readPath
 } from "./chunk-IGJCYUT5.js";
 import {
+  FieldNotQueryableError,
   IndexRequiredError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/with-lookup/indexing/persisted-indexes.ts
 var IDX_PREFIX = "_idx/";
@@ -31,6 +32,25 @@ function compositeKey(fields) {
 var PersistedCollectionIndex = class {
   indexes = /* @__PURE__ */ new Map();
   defs = /* @__PURE__ */ new Map();
+  /**
+   * Per-field bucket-key canonicalizer (#677 — lazy twin of #672's
+   * `CollectionIndexes.setCanonicalizer`), registered ONCE via
+   * {@link setCanonicalizer} when the collection wires indexing up
+   * (money-aware via `ViaPipeline.canonicalizeIndexKey`). Consulted by
+   * EVERY bucket-mutation site — `ingest`/`upsert`/`remove` — so bucket
+   * membership is symmetric: a legacy non-canonical stored value (e.g.
+   * `'0100'`) and a canonical one (`'100'`) land in the SAME bucket,
+   * mirroring `eager-indexes.ts`'s `addToIndex`/`removeFromIndex`.
+   */
+  canonicalize;
+  /**
+   * Register the bucket-key canonicalizer. Called once, where the
+   * collection constructs its indexing state — safe to call again (the
+   * closure is simply replaced) but there is normally only one caller.
+   */
+  setCanonicalizer(fn) {
+    this.canonicalize = fn;
+  }
   /**
    * Declare a single-field index. Subsequent `upsert` / `ingest` calls
    * populate the in-memory mirror; calls before `declare` are no-ops
@@ -91,7 +111,7 @@ var PersistedCollectionIndex = class {
     const state = this.indexes.get(field);
     if (!state) return;
     for (const row of rows) {
-      addToState(state, row.recordId, row.value);
+      addToState(state, row.recordId, row.value, field, this.canonicalize);
     }
   }
   /**
@@ -105,9 +125,9 @@ var PersistedCollectionIndex = class {
     const state = this.indexes.get(field);
     if (!state) return;
     if (previousValue !== null && previousValue !== void 0) {
-      removeFromState(state, recordId, previousValue);
+      removeFromState(state, recordId, previousValue, field, this.canonicalize);
     }
-    addToState(state, recordId, newValue);
+    addToState(state, recordId, newValue, field, this.canonicalize);
   }
   /**
    * Remove a record from the index for one field. Called by
@@ -118,7 +138,7 @@ var PersistedCollectionIndex = class {
   remove(recordId, field, value) {
     const state = this.indexes.get(field);
     if (!state) return;
-    removeFromState(state, recordId, value);
+    removeFromState(state, recordId, value, field, this.canonicalize);
   }
   /**
    * Drop all bucket data while preserving field declarations. Called on
@@ -137,6 +157,14 @@ var PersistedCollectionIndex = class {
    * back to scan or throws `IndexRequiredError`). Returns a shared empty
    * set if the field is declared but no record matches — that set MUST
    * NOT be mutated by the caller.
+   *
+   * `value` is bucketed via the plain {@link stringifyKey} — it is NOT
+   * canonicalized here. Callers on a Via-covered field (money) canonicalize
+   * `value` themselves BEFORE calling (see `lazy-builder.ts`'s
+   * `resolveCandidateIds()`, #677) — the SAME caller-canonicalizes split
+   * `eager-indexes.ts`'s `lookupEqual`/`lookupIn` use (see `kernel/query/
+   * builder.ts`'s `candidateRecords()`), so probing here twice never
+   * double-canonicalizes.
    */
   lookupEqual(field, value) {
     const state = this.indexes.get(field);
@@ -147,7 +175,8 @@ var PersistedCollectionIndex = class {
   /**
    * Set lookup — return the union of record ids whose `field` matches any
    * of `values`. Returns `null` if the field is not declared. Returns a
-   * fresh (non-shared) Set — safe for the caller to mutate.
+   * fresh (non-shared) Set — safe for the caller to mutate. Same
+   * caller-canonicalizes contract as {@link lookupEqual} (#677).
    */
   lookupIn(field, values) {
     const state = this.indexes.get(field);
@@ -169,6 +198,23 @@ var PersistedCollectionIndex = class {
    * Supported ops: `'<'`, `'<='`, `'>'`, `'>='`, `'between'`. For
    * `'between'`, `value` is `[lo, hi]` and both bounds are inclusive
    * (matches the eager-mode operator contract in `predicate.ts`).
+   *
+   * NOT canonicalized (#677): this method compares `value` against the
+   * ORIGINAL TYPED `state.values`, not a stringified bucket key, so a
+   * `canonicalizeIndexKey`-shaped (`string | undefined`) result would not
+   * even type-check as a bound here. This does NOT mirror eager mode the
+   * way `lookupEqual`/`lookupIn` do: `moneyIndexProbe` (`via/money/
+   * where.ts`) never emits a range probe, so EAGER mode's `candidateRecords`
+   * never calls an index for a range clause and always scans.
+   *
+   * LAZY mode's `resolveCandidateIds()` (`lazy-builder.ts`) no longer
+   * dispatches a Via-covered (e.g. money) range clause through THIS method
+   * at all (#684) — it enumerates the field's indexed ids via `orderedBy()`
+   * instead and leaves the raw/typed comparison here for the (now
+   * Via-aware) post-filter to redo correctly in scaled-int space. A
+   * NON-via range clause still dispatches through this method exactly as
+   * before — the raw/typed comparison here is correct and sufficient for
+   * fields with no decode-transforming Via binding.
    */
   lookupRange(field, op, value) {
     const state = this.indexes.get(field);
@@ -211,9 +257,9 @@ function stringifyKey(value) {
   }
   return "\0OBJECT\0";
 }
-function addToState(state, recordId, value) {
+function addToState(state, recordId, value, field, canonicalize) {
   if (value === null || value === void 0) return;
-  const key = stringifyKey(value);
+  const key = canonicalize?.(field, value) ?? stringifyKey(value);
   let bucket = state.buckets.get(key);
   if (!bucket) {
     bucket = /* @__PURE__ */ new Set();
@@ -222,9 +268,9 @@ function addToState(state, recordId, value) {
   bucket.add(recordId);
   state.values.set(recordId, value);
 }
-function removeFromState(state, recordId, value) {
+function removeFromState(state, recordId, value, field, canonicalize) {
   if (value === null || value === void 0) return;
-  const key = stringifyKey(value);
+  const key = canonicalize?.(field, value) ?? stringifyKey(value);
   const bucket = state.buckets.get(key);
   if (bucket) {
     bucket.delete(recordId);
@@ -276,7 +322,21 @@ var LazyQuery = class _LazyQuery {
     this.plan = plan;
   }
   where(field, op, value) {
-    const clause = { type: "field", field, op, value };
+    const via = this.source.via();
+    if (via?.postureFor(field)?.queryable === "none") throw new FieldNotQueryableError(field);
+    const viaClause = via?.buildClause(field, op, value);
+    const clause = viaClause ? {
+      type: "field",
+      field,
+      op,
+      value,
+      via: {
+        brand: viaClause.brand,
+        payload: viaClause.payload,
+        evaluate: (actual, evalOp) => via.evaluateClause(viaClause, actual, evalOp),
+        indexValue: via.indexProbe(viaClause, op)
+      }
+    } : { type: "field", field, op, value };
     return new _LazyQuery(this.source, {
       ...this.plan,
       clauses: [...this.plan.clauses, clause]
@@ -313,17 +373,17 @@ var LazyQuery = class _LazyQuery {
         missingFields: touchedFields
       });
     }
-    const records = [];
+    const survivors = [];
     for (const id of candidateIds) {
-      const record = await this.source.getRecord(id);
-      if (record === null) continue;
-      if (!matchesAll(record, this.plan.clauses)) continue;
-      records.push(record);
+      const raw = await this.source.getRawRecord(id);
+      if (raw === null) continue;
+      if (!matchesAll(raw, this.plan.clauses)) continue;
+      survivors.push(raw);
     }
-    const sorted = this.plan.orderBy.length > 0 ? sortRecords(records, this.plan.orderBy) : records;
+    const sorted = this.plan.orderBy.length > 0 ? sortRecords(survivors, this.plan.orderBy, this.source.via()) : survivors;
     const offset = this.plan.offset > 0 ? this.plan.offset : 0;
-    const limited = this.plan.limit === void 0 ? sorted.slice(offset) : sorted.slice(offset, offset + this.plan.limit);
-    return limited;
+    const page = this.plan.limit === void 0 ? sorted.slice(offset) : sorted.slice(offset, offset + this.plan.limit);
+    return Promise.all(page.map((r) => this.source.decodeRecord(r)));
   }
   async first() {
     const out = await this.limit(1).toArray();
@@ -342,12 +402,17 @@ var LazyQuery = class _LazyQuery {
   resolveCandidateIds() {
     const idx = this.source.persistedIndexes;
     const eqMap = /* @__PURE__ */ new Map();
+    const viaFields = /* @__PURE__ */ new Set();
     for (const clause of this.plan.clauses) {
-      if (clause.op === "==") eqMap.set(clause.field, clause.value);
+      if (clause.op === "==") {
+        eqMap.set(clause.field, clause.value);
+        if (clause.via) viaFields.add(clause.field);
+      }
     }
     if (eqMap.size >= 2) {
       for (const def of idx.definitions()) {
         if (def.kind !== "composite") continue;
+        if (def.fields.some((f) => viaFields.has(f))) continue;
         if (def.fields.every((f) => eqMap.has(f))) {
           const tuple = def.fields.map((f) => eqMap.get(f));
           const ids = idx.lookupEqual(def.key, tuple);
@@ -357,12 +422,40 @@ var LazyQuery = class _LazyQuery {
     }
     for (const clause of this.plan.clauses) {
       if (clause.op === "==") {
-        const ids = idx.lookupEqual(clause.field, clause.value);
+        if (clause.via) {
+          if (clause.via.indexValue === void 0) {
+            const entries = idx.orderedBy(clause.field, "asc");
+            if (entries) return entries.map((e) => e.recordId);
+            continue;
+          }
+          const ids2 = idx.lookupEqual(clause.field, clause.via.indexValue);
+          if (ids2) return [...ids2];
+          continue;
+        }
+        const probe = this.source.canonicalizeIndexKey?.(clause.field, clause.value) ?? clause.value;
+        const ids = idx.lookupEqual(clause.field, probe);
         if (ids) return [...ids];
       } else if (clause.op === "in" && Array.isArray(clause.value)) {
-        const ids = idx.lookupIn(clause.field, clause.value);
+        if (clause.via) {
+          if (clause.via.indexValue === void 0) {
+            const entries = idx.orderedBy(clause.field, "asc");
+            if (entries) return entries.map((e) => e.recordId);
+            continue;
+          }
+          if (!Array.isArray(clause.via.indexValue)) continue;
+          const ids2 = idx.lookupIn(clause.field, clause.via.indexValue);
+          if (ids2) return [...ids2];
+          continue;
+        }
+        const probes = clause.value.map((v) => this.source.canonicalizeIndexKey?.(clause.field, v) ?? v);
+        const ids = idx.lookupIn(clause.field, probes);
         if (ids) return [...ids];
       } else if (isRangeOp(clause.op)) {
+        if (clause.via) {
+          const entries = idx.orderedBy(clause.field, "asc");
+          if (entries) return entries.map((e) => e.recordId);
+          continue;
+        }
         const ids = idx.lookupRange(clause.field, clause.op, clause.value);
         if (ids) return [...ids];
       }
@@ -397,12 +490,13 @@ function matchesAll(record, clauses) {
   }
   return true;
 }
-function sortRecords(records, orderBy) {
+function sortRecords(records, orderBy, via) {
   return [...records].sort((a, b) => {
     for (const { field, direction } of orderBy) {
       const av = readPath(a, field);
       const bv = readPath(b, field);
-      const cmp = compareValues(av, bv);
+      const viaCmp = via?.compareForOrder(field, av, bv);
+      const cmp = viaCmp !== void 0 ? viaCmp : compareValues(av, bv);
       if (cmp !== 0) return direction === "asc" ? cmp : -cmp;
     }
     return 0;
@@ -427,4 +521,4 @@ export {
   PersistedCollectionIndex,
   LazyQuery
 };
-//# sourceMappingURL=chunk-3CNQ7FQ3.js.map
+//# sourceMappingURL=chunk-6S7ENMRE.js.map

package/dist/chunk-6S7ENMRE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-lookup/indexing/persisted-indexes.ts","../src/with-lookup/indexing/lazy-builder.ts"],"sourcesContent":["/**\n * Persistent, encrypted secondary indexes for lazy-mode collections.\n *\n * Parallel to the in-memory `CollectionIndexes` used by eager mode (see\n * `packages/hub/src/query/indexes.ts`): same logical surface, but entries\n * are materialised as encrypted side-car records (`_idx/<field>/<recordId>`)\n * and bulk-loaded into an in-memory mirror on first query.\n *\n * This module only owns the id-namespace convention, the in-memory mirror,\n * and the typed errors. Write-path integration (PR 2 / ), query-planner\n * dispatch (PR 3 / , PR 4 / ), and the rebuild/reconcile utilities\n * (PR 5 / ) live in other files.\n *\n * See the design spec for the full architecture + threat model.\n */\n\n/**\n * Reserved id prefix for encrypted index side-car records.\n * Matches the existing `_keyring`, `_ledger_deltas/…`, `_meta/handle`\n * conventions inside a collection's id namespace.\n */\nexport const IDX_PREFIX = '_idx/' as const\n\n/**\n * Encode the side-car record id for a (field, recordId) pair.\n *\n * Format: `_idx/<field>/<recordId>` — no escaping. Field names may contain\n * dots (for dotted-path access consistent with eager-mode `readPath`);\n * record ids may contain slashes. The first two slash-separated segments\n * are `_idx` and the field; everything after the *second* slash is the\n * record id verbatim.\n */\nexport function encodeIdxId(field: string, recordId: string): string {\n  return `${IDX_PREFIX}${field}/${recordId}`\n}\n\n/**\n * Decode a side-car id back into `{ field, recordId }`, or `null` if the\n * input is not a well-formed idx id. A well-formed id is:\n *   - prefixed with `_idx/`\n *   - contains a field segment (non-empty, no slashes)\n *   - contains a record-id segment (non-empty, may contain slashes)\n */\nexport function decodeIdxId(id: string): { field: string; recordId: string } | null {\n  if (!id.startsWith(IDX_PREFIX)) return null\n  const rest = id.slice(IDX_PREFIX.length)\n  const firstSlash = rest.indexOf('/')\n  if (firstSlash <= 0) return null\n  const field = rest.slice(0, firstSlash)\n  const recordId = rest.slice(firstSlash + 1)\n  if (recordId.length === 0) return null\n  return { field, recordId }\n}\n\n/**\n * Fast-path predicate for discriminating side-car ids from regular record\n * ids and other reserved namespaces. Used by the hub to filter `list()`\n * results during bulk-load of the in-memory mirror.\n */\nexport function isIdxId(id: string): boolean {\n  return decodeIdxId(id) !== null\n}\n\n/**\n * Sorted-value entry returned by `orderedBy()`. Mirrors the body shape\n * used by the write path — but `orderedBy` emits them already sorted by\n * `value` in the requested direction. Consumers (PR 4 / ) treat the\n * array as immutable and paginate via a numeric offset.\n *\n * **Note on `value`:** as of, this is the ORIGINAL TYPED\n * value (number, Date, boolean, etc.), not the stringified bucket key.\n * That's what lets range predicates and `orderedBy` compare numerically\n * instead of stumbling into `'10' < '2'` on `String(n)`.\n */\nexport interface OrderedEntry {\n  readonly recordId: string\n  readonly value: unknown\n}\n\n/**\n * Bulk-load row shape accepted by `ingest()`. The `value` field is the\n * decrypted index body's `value` field verbatim.\n */\nexport interface IngestRow {\n  readonly recordId: string\n  readonly value: unknown\n}\n\n/**\n * In-memory mirror of the persisted index side-car records for a single\n * collection. Populated by bulk-loading `_idx/<field>/*` ids on first\n * query and maintained incrementally by `Collection.put()` / `.delete()`\n * via `upsert()` / `remove()`.\n *\n * API surface is deliberately parallel to `CollectionIndexes` (eager mode)\n * so the query planner in PR 3/4 can dispatch to either polymorphically.\n *\n * Lifecycle:\n *  - `declare(field)` — accept the field as indexable (idempotent)\n *  - `ingest(field, rows[])` — bulk-load from decrypted index bodies\n *  - `upsert(recordId, field, newValue, previousValue)` — incremental update\n *  - `remove(recordId, field, value)` — incremental remove\n *  - `lookupEqual(field, value)` / `lookupIn(field, values)` — equality reads\n *  - `orderedBy(field, dir)` — sorted iteration for orderBy\n *  - `clear()` — drop all buckets (invalidation / rotation)\n */\n/**\n * Per-field storage: the equality bucket map AND a parallel table of typed\n * values keyed by recordId. The typed table exists so range predicates\n * and `orderedBy` can compare on the original typed value rather\n * than the stringified bucket key — String(10) < String(2) is the classic\n * landmine `stringifyKey` introduces for numeric fields.\n */\ninterface PersistedFieldState {\n  readonly buckets: Map<string, Set<string>>\n  readonly values: Map<string, unknown>\n}\n\n/**\n * Structured index definition. Single-field indexes carry just a field\n * name; composite indexes carry the ordered list of fields and\n * the synthetic `key` (= fields joined by `COMPOSITE_DELIMITER`) used\n * as the bucket-map key and side-car envelope id segment.\n */\nexport type PersistedIndexDef =\n  | { readonly kind: 'single'; readonly field: string; readonly key: string }\n  | { readonly kind: 'composite'; readonly fields: readonly string[]; readonly key: string }\n\n/**\n * Delimiter used to synthesize a composite-index key from an ordered\n * field list. Intentionally a character that is extremely unusual in\n * JavaScript object keys (`|`) so collision with a literal field name\n * is vanishingly rare in practice. Composite declarations whose field\n * names contain `|` are rejected at declare-time with an explicit\n * error.\n */\nexport const COMPOSITE_DELIMITER = '|'\n\nexport function compositeKey(fields: readonly string[]): string {\n  return fields.join(COMPOSITE_DELIMITER)\n}\n\nexport class PersistedCollectionIndex {\n  private readonly indexes = new Map<string, PersistedFieldState>()\n  private readonly defs = new Map<string, PersistedIndexDef>()\n\n  /**\n   * Per-field bucket-key canonicalizer (#677 — lazy twin of #672's\n   * `CollectionIndexes.setCanonicalizer`), registered ONCE via\n   * {@link setCanonicalizer} when the collection wires indexing up\n   * (money-aware via `ViaPipeline.canonicalizeIndexKey`). Consulted by\n   * EVERY bucket-mutation site — `ingest`/`upsert`/`remove` — so bucket\n   * membership is symmetric: a legacy non-canonical stored value (e.g.\n   * `'0100'`) and a canonical one (`'100'`) land in the SAME bucket,\n   * mirroring `eager-indexes.ts`'s `addToIndex`/`removeFromIndex`.\n   */\n  private canonicalize?: (field: string, value: unknown) => string | undefined\n\n  /**\n   * Register the bucket-key canonicalizer. Called once, where the\n   * collection constructs its indexing state — safe to call again (the\n   * closure is simply replaced) but there is normally only one caller.\n   */\n  setCanonicalizer(fn: (field: string, value: unknown) => string | undefined): void {\n    this.canonicalize = fn\n  }\n\n  /**\n   * Declare a single-field index. Subsequent `upsert` / `ingest` calls\n   * populate the in-memory mirror; calls before `declare` are no-ops\n   * (tolerant bulk-load ordering). Idempotent.\n   */\n  declare(field: string): void {\n    if (this.indexes.has(field)) return\n    this.indexes.set(field, { buckets: new Map(), values: new Map() })\n    this.defs.set(field, { kind: 'single', field, key: field })\n  }\n\n  /**\n   * Declare a composite (multi-field) index. The synthetic\n   * key is `fields.join('|')`; it doubles as the in-memory map key and\n   * the `_idx/<key>/<recordId>` side-car field segment. Callers upsert\n   * and lookup via the same `key` as single-field indexes, just with a\n   * tuple value (JSON-stringified for bucketing).\n   */\n  declareComposite(fields: readonly string[]): void {\n    if (fields.length === 0) {\n      throw new Error('declareComposite: fields array must be non-empty')\n    }\n    for (const f of fields) {\n      if (f.includes(COMPOSITE_DELIMITER)) {\n        throw new Error(\n          `declareComposite: field \"${f}\" contains the composite delimiter ` +\n          `\"${COMPOSITE_DELIMITER}\" — pick a different field name or open an ` +\n          `issue to add hash-based composite keys.`,\n        )\n      }\n    }\n    const key = compositeKey(fields)\n    if (this.indexes.has(key)) return\n    this.indexes.set(key, { buckets: new Map(), values: new Map() })\n    this.defs.set(key, { kind: 'composite', fields: [...fields], key })\n  }\n\n  /**\n   * Every declared index's structured definition. Collection walks this\n   * when materialising side-cars on put/delete so it can extract a\n   * single-field value or a composite tuple appropriately.\n   */\n  definitions(): PersistedIndexDef[] {\n    return [...this.defs.values()]\n  }\n\n  /** True if `field` has been declared as indexable on this mirror. */\n  has(field: string): boolean {\n    return this.indexes.has(field)\n  }\n\n  /** All declared field names, in declaration order. */\n  fields(): string[] {\n    return [...this.indexes.keys()]\n  }\n\n  /**\n   * Bulk-load the mirror from decrypted index bodies. Intended to be\n   * called once per field after reading the collection's `_idx/<field>/*`\n   * side-cars. Safe to call twice with the same rows — bucket Sets\n   * deduplicate recordIds. If `field` is not declared, this is a no-op\n   * (tolerates the case where bulk-load runs before `declare()` lands).\n   */\n  ingest(field: string, rows: readonly IngestRow[]): void {\n    const state = this.indexes.get(field)\n    if (!state) return\n    for (const row of rows) {\n      addToState(state, row.recordId, row.value, field, this.canonicalize)\n    }\n  }\n\n  /**\n   * Incrementally update a record's index entry for one field. Called by\n   * `Collection.put()` after the main write succeeds. If\n   * `previousValue` is non-null, the record is removed from the old\n   * bucket first — this is the update path. Pass `null` for fresh adds.\n   * No-op if the field is not declared.\n   */\n  upsert(recordId: string, field: string, newValue: unknown, previousValue: unknown): void {\n    const state = this.indexes.get(field)\n    if (!state) return\n    if (previousValue !== null && previousValue !== undefined) {\n      removeFromState(state, recordId, previousValue, field, this.canonicalize)\n    }\n    addToState(state, recordId, newValue, field, this.canonicalize)\n  }\n\n  /**\n   * Remove a record from the index for one field. Called by\n   * `Collection.delete()`. No-op if the field is not declared or\n   * the record isn't in the bucket. Empty buckets are dropped to keep\n   * the Map clean.\n   */\n  remove(recordId: string, field: string, value: unknown): void {\n    const state = this.indexes.get(field)\n    if (!state) return\n    removeFromState(state, recordId, value, field, this.canonicalize)\n  }\n\n  /**\n   * Drop all bucket data while preserving field declarations. Called on\n   * invalidation (incoming sync changes, keyring rotation) — the next\n   * query re-populates via `ingest`.\n   */\n  clear(): void {\n    for (const state of this.indexes.values()) {\n      state.buckets.clear()\n      state.values.clear()\n    }\n  }\n\n  /**\n   * Equality lookup — return the set of record ids whose `field` matches\n   * `value`. Returns `null` if the field is not declared (caller falls\n   * back to scan or throws `IndexRequiredError`). Returns a shared empty\n   * set if the field is declared but no record matches — that set MUST\n   * NOT be mutated by the caller.\n   *\n   * `value` is bucketed via the plain {@link stringifyKey} — it is NOT\n   * canonicalized here. Callers on a Via-covered field (money) canonicalize\n   * `value` themselves BEFORE calling (see `lazy-builder.ts`'s\n   * `resolveCandidateIds()`, #677) — the SAME caller-canonicalizes split\n   * `eager-indexes.ts`'s `lookupEqual`/`lookupIn` use (see `kernel/query/\n   * builder.ts`'s `candidateRecords()`), so probing here twice never\n   * double-canonicalizes.\n   */\n  lookupEqual(field: string, value: unknown): ReadonlySet<string> | null {\n    const state = this.indexes.get(field)\n    if (!state) return null\n    const key = stringifyKey(value)\n    return state.buckets.get(key) ?? EMPTY_SET\n  }\n\n  /**\n   * Set lookup — return the union of record ids whose `field` matches any\n   * of `values`. Returns `null` if the field is not declared. Returns a\n   * fresh (non-shared) Set — safe for the caller to mutate. Same\n   * caller-canonicalizes contract as {@link lookupEqual} (#677).\n   */\n  lookupIn(field: string, values: readonly unknown[]): ReadonlySet<string> | null {\n    const state = this.indexes.get(field)\n    if (!state) return null\n    const out = new Set<string>()\n    for (const value of values) {\n      const bucket = state.buckets.get(stringifyKey(value))\n      if (bucket) for (const id of bucket) out.add(id)\n    }\n    return out\n  }\n\n  /**\n   * Range lookup. Return record ids whose indexed value\n   * satisfies the predicate. Comparison happens on the ORIGINAL TYPED\n   * value carried in `state.values` — so numeric `<` sorts numerically,\n   * not lexicographically on `String(n)`. Returns `null` if the field\n   * is not declared.\n   *\n   * Supported ops: `'<'`, `'<='`, `'>'`, `'>='`, `'between'`. For\n   * `'between'`, `value` is `[lo, hi]` and both bounds are inclusive\n   * (matches the eager-mode operator contract in `predicate.ts`).\n   *\n   * NOT canonicalized (#677): this method compares `value` against the\n   * ORIGINAL TYPED `state.values`, not a stringified bucket key, so a\n   * `canonicalizeIndexKey`-shaped (`string | undefined`) result would not\n   * even type-check as a bound here. This does NOT mirror eager mode the\n   * way `lookupEqual`/`lookupIn` do: `moneyIndexProbe` (`via/money/\n   * where.ts`) never emits a range probe, so EAGER mode's `candidateRecords`\n   * never calls an index for a range clause and always scans.\n   *\n   * LAZY mode's `resolveCandidateIds()` (`lazy-builder.ts`) no longer\n   * dispatches a Via-covered (e.g. money) range clause through THIS method\n   * at all (#684) — it enumerates the field's indexed ids via `orderedBy()`\n   * instead and leaves the raw/typed comparison here for the (now\n   * Via-aware) post-filter to redo correctly in scaled-int space. A\n   * NON-via range clause still dispatches through this method exactly as\n   * before — the raw/typed comparison here is correct and sufficient for\n   * fields with no decode-transforming Via binding.\n   */\n  lookupRange(\n    field: string,\n    op: '<' | '<=' | '>' | '>=' | 'between',\n    value: unknown,\n  ): ReadonlySet<string> | null {\n    const state = this.indexes.get(field)\n    if (!state) return null\n    const out = new Set<string>()\n    for (const [recordId, live] of state.values) {\n      if (live === undefined || live === null) continue\n      if (matchesRange(live, op, value)) out.add(recordId)\n    }\n    return out\n  }\n\n  /**\n   * Sorted iteration — return every entry on `field` as an\n   * `OrderedEntry[]`, sorted by the ORIGINAL TYPED value (no more\n   * `'10' < '2'` surprises on numeric fields). Consumers paginate with\n   * a numeric offset. `OrderedEntry.value` is the typed value.\n   */\n  orderedBy(field: string, dir: 'asc' | 'desc'): readonly OrderedEntry[] | null {\n    const state = this.indexes.get(field)\n    if (!state) return null\n    const entries: OrderedEntry[] = []\n    for (const [recordId, value] of state.values) {\n      entries.push({ recordId, value })\n    }\n    entries.sort((a, b) => compareTyped(a.value, b.value))\n    if (dir === 'desc') entries.reverse()\n    return entries\n  }\n}\n\nconst EMPTY_SET: ReadonlySet<string> = new Set()\n\n/**\n * Canonicalize a value into a bucket key. Deliberately identical to the\n * eager-mode `stringifyKey` in `query/indexes.ts` so semantics match. When\n * `query/indexes.ts` changes its coercion rules, update this in lockstep.\n *\n * null / undefined values are NOT indexed — callers who pass them to\n * `upsert` / `remove` short-circuit before reaching this function; the\n * sentinel here exists only to make `lookupEqual(field, null)` return\n * an empty bucket (rather than matching some arbitrary record).\n */\nfunction stringifyKey(value: unknown): string {\n  if (value === null || value === undefined) return '\\0NULL\\0'\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'boolean') return String(value)\n  if (value instanceof Date) return value.toISOString()\n  // composite index values are tuple arrays. JSON.stringify\n  // gives a delimiter-safe, order-preserving canonical form so buckets\n  // for `['c-A', '2026-Q1']` and `['c-A', '2026-Q2']` never collide.\n  if (Array.isArray(value)) {\n    const parts: string[] = []\n    for (const el of value) parts.push(stringifyKey(el))\n    return JSON.stringify(parts)\n  }\n  return '\\0OBJECT\\0'\n}\n\nfunction addToState(\n  state: PersistedFieldState,\n  recordId: string,\n  value: unknown,\n  field: string,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  if (value === null || value === undefined) return\n  const key = canonicalize?.(field, value) ?? stringifyKey(value)\n  let bucket = state.buckets.get(key)\n  if (!bucket) {\n    bucket = new Set()\n    state.buckets.set(key, bucket)\n  }\n  bucket.add(recordId)\n  state.values.set(recordId, value)\n}\n\nfunction removeFromState(\n  state: PersistedFieldState,\n  recordId: string,\n  value: unknown,\n  field: string,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  if (value === null || value === undefined) return\n  const key = canonicalize?.(field, value) ?? stringifyKey(value)\n  const bucket = state.buckets.get(key)\n  if (bucket) {\n    bucket.delete(recordId)\n    if (bucket.size === 0) state.buckets.delete(key)\n  }\n  state.values.delete(recordId)\n}\n\n/**\n * Range-predicate comparator. Runs on the ORIGINAL TYPED value so numeric\n * fields sort numerically (not lexicographically on `String(n)`). ISO-8601\n * date strings already sort correctly lexicographically; Date instances\n * compare via `getTime()` before the string branch to keep the contract\n * honest regardless of which form survived serialization.\n */\nfunction matchesRange(\n  live: unknown,\n  op: '<' | '<=' | '>' | '>=' | 'between',\n  bound: unknown,\n): boolean {\n  if (op === 'between') {\n    if (!Array.isArray(bound) || bound.length !== 2) return false\n    return compareTyped(live, bound[0]) >= 0 && compareTyped(live, bound[1]) <= 0\n  }\n  const cmp = compareTyped(live, bound)\n  switch (op) {\n    case '<':  return cmp < 0\n    case '<=': return cmp <= 0\n    case '>':  return cmp > 0\n    case '>=': return cmp >= 0\n  }\n}\n\nfunction compareTyped(a: unknown, b: unknown): number {\n  if (a === undefined || a === null) return b === undefined || b === null ? 0 : 1\n  if (b === undefined || b === null) return -1\n  if (typeof a === 'number' && typeof b === 'number') return a - b\n  if (a instanceof Date && b instanceof Date) return a.getTime() - b.getTime()\n  if (typeof a === 'string' && typeof b === 'string') return a < b ? -1 : a > b ? 1 : 0\n  if (typeof a === 'boolean' && typeof b === 'boolean') {\n    return a === b ? 0 : a ? 1 : -1\n  }\n  // Mixed/unsupported types: deliberately treat as equal so sort stays\n  // stable. Matches the eager-mode `compareValues` contract in\n  // builder.ts — we don't silently coerce arbitrary objects to strings\n  // (which would be meaningless) nor throw (which would be hostile).\n  return 0\n}\n","/**\n * Lazy-mode query builder.\n *\n * Companion to `Query<T>` in `builder.ts`, but built for collections in lazy\n * mode where `snapshot()` is unavailable — records live in the adapter and\n * are pulled on demand. Dispatches through `PersistedCollectionIndex` to\n * resolve a candidate record-id set, then decrypts only those records.\n *\n * Scope:\n *   - `.where(field, '==' | 'in', value)` — dispatched through the index\n *   - `.where(field, other-op, value)` — evaluated against the decrypted\n *     candidate set (non-indexed ops still require the field to be indexed\n *     — we need SOMETHING to scope the candidate set)\n *   - `.orderBy(field, dir?)` — dispatched through `orderedBy` when no\n *     `==`/`in` clause is present; otherwise applied as an in-memory sort\n *     over the candidate set\n *   - `.limit(n)` / `.offset(n)` — page slice after filtering\n *   - `.toArray()` / `.first()` / `.count()` — terminals\n *\n * Every field referenced by a where or orderBy clause MUST be indexed;\n * otherwise `toArray()` throws `IndexRequiredError`. This is deliberate:\n * silent scan-fallback would hide the very performance cliff that lazy-mode\n * indexes exist to prevent (see `docs/architecture.md` §indexes).\n */\n\nimport type { Clause, FieldClause, Operator } from '../../kernel/query/predicate.js'\nimport { evaluateClause, readPath } from '../../kernel/query/predicate.js'\nimport type { PersistedCollectionIndex } from './persisted-indexes.js'\nimport { IndexRequiredError, FieldNotQueryableError } from '../../kernel/errors.js'\nimport type { QueryField } from '../../kernel/types.js'\nimport type { ViaPipeline } from '../../kernel/via/pipeline.js'\n\nexport interface LazyOrderBy {\n  readonly field: string\n  readonly direction: 'asc' | 'desc'\n}\n\n/**\n * Source abstraction the LazyQuery runs against. Collection implements it.\n * Kept minimal so the builder stays test-friendly.\n */\nexport interface LazyQuerySource<T> {\n  readonly collectionName: string\n  readonly persistedIndexes: PersistedCollectionIndex\n  /**\n   * Per-field bucket-key canonicalizer (#677 — lazy twin of the eager\n   * `candidateRecords()` probe-resolution in `kernel/query/builder.ts`).\n   * Consulted in `resolveCandidateIds()` for `==`/`in` clause values\n   * BEFORE calling `lookupEqual`/`lookupIn`, so a mixed-era stored value\n   * (money) probes the SAME canonical bucket the write path now\n   * populates. A narrow closure — not the whole `ViaPipeline` — keeps\n   * the with-lookup/kernel seam thin. `undefined` (no via, or no binding\n   * covers the field) is the common case: falls back to the raw value,\n   * unchanged from today.\n   */\n  canonicalizeIndexKey?(field: string, value: unknown): string | undefined\n  /** Ensure `_idx/<field>/*` side-cars have been bulk-loaded into the mirror. */\n  ensurePersistedIndexesLoaded(): Promise<void>\n  /**\n   * Decrypt one record by id in RAW (pre-`present()`, stored-form) shape,\n   * or return null if it's gone (#684 — the raw-fetch seam). Used by the\n   * post-filter (`toArray()`) so a `clause.via.evaluate` (e.g. money) sees\n   * the same operand/actual-value space as eager's `filterRecords` — the\n   * DECODED form (e.g. money's canonical decimal) is only materialized\n   * for survivors, via {@link decodeRecord}.\n   */\n  getRawRecord(id: string): Promise<unknown>\n  /**\n   * Apply this collection's locale/virtual-field decode (`present()`) to a\n   * RAW record already known to match — the output-side twin of\n   * {@link getRawRecord}. Mirrors eager's `Query.decodeVia`.\n   */\n  decodeRecord(record: unknown): Promise<T>\n  /**\n   * This collection's compiled Via pipeline (money, i18n, …), read lazily\n   * (a method, not a captured value) so a late `_setVia` (#666) is honored\n   * — same closure discipline as {@link canonicalizeIndexKey}. `undefined`\n   * when the collection has no Via-covered fields.\n   */\n  via(): ViaPipeline | undefined\n}\n\ninterface LazyPlan {\n  readonly clauses: readonly FieldClause[]\n  readonly orderBy: readonly LazyOrderBy[]\n  readonly limit: number | undefined\n  readonly offset: number\n}\n\nconst EMPTY_PLAN: LazyPlan = {\n  clauses: [],\n  orderBy: [],\n  limit: undefined,\n  offset: 0,\n}\n\nexport class LazyQuery<T, S extends keyof T = never, Q extends keyof T & string = never> {\n  private readonly source: LazyQuerySource<T>\n  private readonly plan: LazyPlan\n\n  constructor(source: LazyQuerySource<T>, plan: LazyPlan = EMPTY_PLAN) {\n    this.source = source\n    this.plan = plan\n  }\n\n  where<V>(field: QueryField<T, S, Q>, op: Operator, value: V): LazyQuery<T, S, Q> {\n    // A Via-covered field (e.g. money) compares in major units, BigInt-exact\n    // in scaled space — same build-time operand rewrite + `clause.via`\n    // attachment as `Query.where()` (`kernel/query/builder.ts`) and\n    // `ScanBuilder.where()` (`kernel/query/scan-builder.ts`). Before #684\n    // this method built a bare clause with no `clause.via` at all, so the\n    // post-filter fell through to the generic (non-Via-aware) comparison —\n    // see `toArray()` below for the raw-record post-filter this feeds.\n    const via = this.source.via()\n    // Consults the Via pipeline's posture BEFORE building a clause — same\n    // gate as `Query.where()` (builder.ts) / `ScanBuilder.where()`\n    // (scan-builder.ts): a field whose posture is `queryable: 'none'`\n    // (e.g. a `blobFields` slot) throws `FieldNotQueryableError` here, at\n    // the call site, instead of building a bare clause that later surfaces\n    // as a deferred `IndexRequiredError` from `toArray()`.\n    if (via?.postureFor(field)?.queryable === 'none') throw new FieldNotQueryableError(field)\n    const viaClause = via?.buildClause(field, op, value)\n    const clause: FieldClause = viaClause\n      ? {\n          type: 'field',\n          field,\n          op,\n          value,\n          via: {\n            brand: viaClause.brand,\n            payload: viaClause.payload,\n            evaluate: (actual: unknown, evalOp: string) => via!.evaluateClause(viaClause, actual, evalOp),\n            indexValue: via!.indexProbe(viaClause, op),\n          },\n        }\n      : { type: 'field', field, op, value }\n    return new LazyQuery<T, S, Q>(this.source, {\n      ...this.plan,\n      clauses: [...this.plan.clauses, clause],\n    })\n  }\n\n  orderBy(field: QueryField<T, S>, direction: 'asc' | 'desc' = 'asc'): LazyQuery<T, S, Q> {\n    return new LazyQuery<T, S, Q>(this.source, {\n      ...this.plan,\n      orderBy: [...this.plan.orderBy, { field, direction }],\n    })\n  }\n\n  limit(n: number): LazyQuery<T, S, Q> {\n    return new LazyQuery<T, S, Q>(this.source, { ...this.plan, limit: n })\n  }\n\n  offset(n: number): LazyQuery<T, S, Q> {\n    return new LazyQuery<T, S, Q>(this.source, { ...this.plan, offset: n })\n  }\n\n  async toArray(): Promise<T[]> {\n    await this.source.ensurePersistedIndexesLoaded()\n\n    const touchedFields = collectTouchedFields(this.plan)\n    const missingFields = touchedFields.filter(f => !isFieldIndexed(f, this.source.persistedIndexes))\n    if (missingFields.length > 0) {\n      throw new IndexRequiredError({\n        collection: this.source.collectionName,\n        touchedFields,\n        missingFields,\n      })\n    }\n\n    const candidateIds = this.resolveCandidateIds()\n    if (candidateIds === null) {\n      // No usable driver — every touched field is indexed but no clause\n      // pins the candidate set. This happens when a query only uses\n      // operators other than `==`/`in` and no `orderBy` clause is\n      // present — we refuse to enumerate the whole index, because that\n      // defeats the purpose of lazy mode.\n      throw new IndexRequiredError({\n        collection: this.source.collectionName,\n        touchedFields,\n        missingFields: touchedFields,\n      })\n    }\n\n    // #684: post-filter the RAW record (mirrors eager's filterRecords on the\n    // raw snapshot) so `clause.via.evaluate` sees the same stored-form\n    // operand/actual-value space `buildClause` quantized into at where()\n    // time. Survivors stay RAW here — #695 sorts them via-aware in that\n    // same stored-form space (mirroring eager's `sortRecords(result, ...,\n    // source.via, ...)` in `kernel/query/builder.ts`) before anything is\n    // decoded (`present()`).\n    const survivors: T[] = []\n    for (const id of candidateIds) {\n      const raw = await this.source.getRawRecord(id)\n      if (raw === null) continue\n      if (!matchesAll(raw, this.plan.clauses)) continue\n      survivors.push(raw as T)\n    }\n\n    // #695: sort the RAW survivors via-aware — a money field's stored form\n    // (scaled-integer string) sorts lexicographically wrong under the\n    // generic comparator ('10.00' < '2.00' once decoded); `via.compareForOrder`\n    // compares in the correct (BigInt-exact scaled) space, same as eager.\n    const sorted = this.plan.orderBy.length > 0\n      ? sortRecords(survivors, this.plan.orderBy, this.source.via())\n      : survivors\n\n    const offset = this.plan.offset > 0 ? this.plan.offset : 0\n    const page = this.plan.limit === undefined\n      ? sorted.slice(offset)\n      : sorted.slice(offset, offset + this.plan.limit)\n\n    // Decode only the final page — fewer decodes than the pre-#695 code,\n    // which decoded every survivor before sorting/slicing.\n    return Promise.all(page.map(r => this.source.decodeRecord(r)))\n  }\n\n  async first(): Promise<T | null> {\n    const out = await this.limit(1).toArray()\n    return out.length > 0 ? out[0]! : null\n  }\n\n  async count(): Promise<number> {\n    const out = await this.toArray()\n    return out.length\n  }\n\n  /**\n   * Resolve the candidate record-id set to decrypt. Returns null when the\n   * query has no usable driver — no `==`/`in` clause and no `orderBy`\n   * clause that can scope the scan. Callers interpret null as\n   * IndexRequiredError (see `toArray`).\n   */\n  private resolveCandidateIds(): readonly string[] | null {\n    const idx = this.source.persistedIndexes\n\n    // prefer a composite index when the query's `==`\n    // clauses cover every field of one declared composite. The\n    // composite mirror lookup is O(matches) vs single-field +\n    // post-filter on the decrypted candidate set.\n    const eqMap = new Map<string, unknown>()\n    const viaFields = new Set<string>()\n    for (const clause of this.plan.clauses) {\n      if (clause.op === '==') {\n        eqMap.set(clause.field, clause.value)\n        // #696: the composite mirror buckets on `stringifyKey(tuple)` built\n        // from the RAW clause values — the per-field money canonicalizer\n        // (`canonicalizeIndexKey`) only ever keys off a single field name,\n        // never the joined composite key, so a Via-covered field's tuple\n        // slot never lands in the same bucket a canonical write produced.\n        // Track which `==` fields are Via-covered so the composite branch\n        // below can skip them and fall through to the single-field\n        // Via-aware path (already correct for money) instead.\n        if (clause.via) viaFields.add(clause.field)\n      }\n    }\n    if (eqMap.size >= 2) {\n      for (const def of idx.definitions()) {\n        if (def.kind !== 'composite') continue\n        if (def.fields.some(f => viaFields.has(f))) continue\n        if (def.fields.every(f => eqMap.has(f))) {\n          const tuple = def.fields.map(f => eqMap.get(f))\n          const ids = idx.lookupEqual(def.key, tuple)\n          if (ids) return [...ids]\n        }\n      }\n    }\n\n    for (const clause of this.plan.clauses) {\n      if (clause.op === '==') {\n        if (clause.via) {\n          // #684: prefer `clause.via.indexValue` — the same STORED-form\n          // probe operand eager's `candidateRecords()` resolves first\n          // (`kernel/query/builder.ts`). `undefined` means the binding\n          // declined to probe this op/payload (e.g. money multi-mode) — no\n          // sound equality bucket exists. Eager's `candidateRecords()`\n          // handles this by skipping the index-eligibility check for the\n          // clause and falling back to a full scan (`builder.ts:1176`); the\n          // lazy equivalent (#684 review-fix 2) is the same move the RANGE branch\n          // below already makes — enumerate the field's full indexed id\n          // set via `orderedBy` and let the (now via-aware) post-filter in\n          // `toArray()` decide, instead of throwing `IndexRequiredError`.\n          if (clause.via.indexValue === undefined) {\n            const entries = idx.orderedBy(clause.field, 'asc')\n            if (entries) return entries.map(e => e.recordId)\n            continue\n          }\n          const ids = idx.lookupEqual(clause.field, clause.via.indexValue)\n          if (ids) return [...ids]\n          continue\n        }\n        // #677: canonicalize the probe value BEFORE the lookup — same\n        // \"resolve before lookupEqual\" shape as eager's `candidateRecords()`,\n        // but through the narrower `canonicalizeIndexKey` seam, used only on\n        // this NON-via path. `undefined` (no via coverage) falls back to the\n        // raw clause value, unchanged from today.\n        const probe = this.source.canonicalizeIndexKey?.(clause.field, clause.value) ?? clause.value\n        const ids = idx.lookupEqual(clause.field, probe)\n        if (ids) return [...ids]\n      } else if (clause.op === 'in' && Array.isArray(clause.value)) {\n        if (clause.via) {\n          // Same #684 review-fix 2 fallback as the `==` branch above — a via\n          // payload that declines to probe (e.g. money multi-mode) still\n          // has a sound candidate superset via `orderedBy`.\n          if (clause.via.indexValue === undefined) {\n            const entries = idx.orderedBy(clause.field, 'asc')\n            if (entries) return entries.map(e => e.recordId)\n            continue\n          }\n          if (!Array.isArray(clause.via.indexValue)) continue\n          const ids = idx.lookupIn(clause.field, clause.via.indexValue)\n          if (ids) return [...ids]\n          continue\n        }\n        const probes = clause.value.map(v => this.source.canonicalizeIndexKey?.(clause.field, v) ?? v)\n        const ids = idx.lookupIn(clause.field, probes)\n        if (ids) return [...ids]\n      } else if (isRangeOp(clause.op)) {\n        if (clause.via) {\n          // #684: a Via-covered range clause (e.g. money) cannot trust\n          // `lookupRange` — it compares the ORIGINAL TYPED stored value,\n          // wrong space for a binding whose stored form isn't directly\n          // orderable that way (money: BigInt-exact scaled-int compare).\n          // No binding emits a range `indexProbe` either (see\n          // `moneyIndexProbe`), so there's no sound bucket lookup at all.\n          // Enumerate the field's full indexed id set via `orderedBy` — the\n          // same superset a scan would consider, just scoped to indexed ids\n          // — and let the (now via-aware) post-filter in `toArray()` apply\n          // the correct scaled-space comparison. Replaces the old\n          // \"always trust lookupRange, no scan fallback\" gap.\n          const entries = idx.orderedBy(clause.field, 'asc')\n          if (entries) return entries.map(e => e.recordId)\n          continue\n        }\n        // range predicates on a NON-via indexed field dispatch through\n        // `lookupRange`, which compares on the original typed value (no\n        // numeric-lexicographic landmines).\n        const ids = idx.lookupRange(clause.field, clause.op, clause.value)\n        if (ids) return [...ids]\n      }\n    }\n\n    // No equality/range driver — try to scope via orderBy.\n    if (this.plan.orderBy.length > 0) {\n      const primary = this.plan.orderBy[0]!\n      const entries = idx.orderedBy(primary.field, primary.direction)\n      if (entries) return entries.map(e => e.recordId)\n    }\n\n    return null\n  }\n}\n\n/**\n * True if the given field name is covered by either a single-field\n * index or appears as a component of a declared composite index.\n * Composite coverage is sufficient for the missing-field check because\n * composite writes also maintain the in-memory mirror — the range /\n * orderBy / single-equality lookup paths fall through to decrypted\n * candidates that still get post-filtered by the composite clause.\n */\nfunction isFieldIndexed(field: string, idx: PersistedCollectionIndex): boolean {\n  if (idx.has(field)) return true\n  for (const def of idx.definitions()) {\n    if (def.kind === 'composite' && def.fields.includes(field)) return true\n  }\n  return false\n}\n\nfunction isRangeOp(op: Operator): op is '<' | '<=' | '>' | '>=' | 'between' {\n  return op === '<' || op === '<=' || op === '>' || op === '>=' || op === 'between'\n}\n\nfunction collectTouchedFields(plan: LazyPlan): string[] {\n  const seen = new Set<string>()\n  for (const c of plan.clauses) seen.add(c.field)\n  for (const o of plan.orderBy) seen.add(o.field)\n  return [...seen]\n}\n\nfunction matchesAll(record: unknown, clauses: readonly Clause[]): boolean {\n  for (const c of clauses) {\n    if (!evaluateClause(record, c)) return false\n  }\n  return true\n}\n\nfunction sortRecords<T>(records: T[], orderBy: readonly LazyOrderBy[], via?: ViaPipeline): T[] {\n  return [...records].sort((a, b) => {\n    for (const { field, direction } of orderBy) {\n      const av = readPath(a, field)\n      const bv = readPath(b, field)\n      // #695: a Via-covered field (e.g. money) may store a representation\n      // the generic comparator would order wrong — ask the pipeline for an\n      // exact ordering first, same as eager's `sortRecords` in\n      // `kernel/query/builder.ts`. `undefined` (no via, or the field isn't\n      // covered) falls back to the generic comparator, unchanged from today.\n      const viaCmp = via?.compareForOrder(field, av, bv)\n      const cmp = viaCmp !== undefined ? viaCmp : compareValues(av, bv)\n      if (cmp !== 0) return direction === 'asc' ? cmp : -cmp\n    }\n    return 0\n  })\n}\n\nfunction compareValues(a: unknown, b: unknown): number {\n  if (a === undefined || a === null) return b === undefined || b === null ? 0 : 1\n  if (b === undefined || b === null) return -1\n  if (typeof a === 'number' && typeof b === 'number') return a - b\n  if (typeof a === 'string' && typeof b === 'string') return a < b ? -1 : a > b ? 1 : 0\n  if (a instanceof Date && b instanceof Date) return a.getTime() - b.getTime()\n  return 0\n}\n"],"mappings":";;;;;;;;;;AAqBO,IAAM,aAAa;AAWnB,SAAS,YAAY,OAAe,UAA0B;AACnE,SAAO,GAAG,UAAU,GAAG,KAAK,IAAI,QAAQ;AAC1C;AASO,SAAS,YAAY,IAAwD;AAClF,MAAI,CAAC,GAAG,WAAW,UAAU,EAAG,QAAO;AACvC,QAAM,OAAO,GAAG,MAAM,WAAW,MAAM;AACvC,QAAM,aAAa,KAAK,QAAQ,GAAG;AACnC,MAAI,cAAc,EAAG,QAAO;AAC5B,QAAM,QAAQ,KAAK,MAAM,GAAG,UAAU;AACtC,QAAM,WAAW,KAAK,MAAM,aAAa,CAAC;AAC1C,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,SAAO,EAAE,OAAO,SAAS;AAC3B;AAOO,SAAS,QAAQ,IAAqB;AAC3C,SAAO,YAAY,EAAE,MAAM;AAC7B;AA2EO,IAAM,sBAAsB;AAE5B,SAAS,aAAa,QAAmC;AAC9D,SAAO,OAAO,KAAK,mBAAmB;AACxC;AAEO,IAAM,2BAAN,MAA+B;AAAA,EACnB,UAAU,oBAAI,IAAiC;AAAA,EAC/C,OAAO,oBAAI,IAA+B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOR,iBAAiB,IAAiE;AAChF,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAQ,OAAqB;AAC3B,QAAI,KAAK,QAAQ,IAAI,KAAK,EAAG;AAC7B,SAAK,QAAQ,IAAI,OAAO,EAAE,SAAS,oBAAI,IAAI,GAAG,QAAQ,oBAAI,IAAI,EAAE,CAAC;AACjE,SAAK,KAAK,IAAI,OAAO,EAAE,MAAM,UAAU,OAAO,KAAK,MAAM,CAAC;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,iBAAiB,QAAiC;AAChD,QAAI,OAAO,WAAW,GAAG;AACvB,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AACA,eAAW,KAAK,QAAQ;AACtB,UAAI,EAAE,SAAS,mBAAmB,GAAG;AACnC,cAAM,IAAI;AAAA,UACR,4BAA4B,CAAC,uCACzB,mBAAmB;AAAA,QAEzB;AAAA,MACF;AAAA,IACF;AACA,UAAM,MAAM,aAAa,MAAM;AAC/B,QAAI,KAAK,QAAQ,IAAI,GAAG,EAAG;AAC3B,SAAK,QAAQ,IAAI,KAAK,EAAE,SAAS,oBAAI,IAAI,GAAG,QAAQ,oBAAI,IAAI,EAAE,CAAC;AAC/D,SAAK,KAAK,IAAI,KAAK,EAAE,MAAM,aAAa,QAAQ,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAmC;AACjC,WAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC;AAAA,EAC/B;AAAA;AAAA,EAGA,IAAI,OAAwB;AAC1B,WAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EAC/B;AAAA;AAAA,EAGA,SAAmB;AACjB,WAAO,CAAC,GAAG,KAAK,QAAQ,KAAK,CAAC;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,OAAe,MAAkC;AACtD,UAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO;AACZ,eAAW,OAAO,MAAM;AACtB,iBAAW,OAAO,IAAI,UAAU,IAAI,OAAO,OAAO,KAAK,YAAY;AAAA,IACrE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,UAAkB,OAAe,UAAmB,eAA8B;AACvF,UAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO;AACZ,QAAI,kBAAkB,QAAQ,kBAAkB,QAAW;AACzD,sBAAgB,OAAO,UAAU,eAAe,OAAO,KAAK,YAAY;AAAA,IAC1E;AACA,eAAW,OAAO,UAAU,UAAU,OAAO,KAAK,YAAY;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,UAAkB,OAAe,OAAsB;AAC5D,UAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO;AACZ,oBAAgB,OAAO,UAAU,OAAO,OAAO,KAAK,YAAY;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAc;AACZ,eAAW,SAAS,KAAK,QAAQ,OAAO,GAAG;AACzC,YAAM,QAAQ,MAAM;AACpB,YAAM,OAAO,MAAM;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,YAAY,OAAe,OAA4C;AACrE,UAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,MAAM,aAAa,KAAK;AAC9B,WAAO,MAAM,QAAQ,IAAI,GAAG,KAAK;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAS,OAAe,QAAwD;AAC9E,UAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,MAAM,oBAAI,IAAY;AAC5B,eAAW,SAAS,QAAQ;AAC1B,YAAM,SAAS,MAAM,QAAQ,IAAI,aAAa,KAAK,CAAC;AACpD,UAAI,OAAQ,YAAW,MAAM,OAAQ,KAAI,IAAI,EAAE;AAAA,IACjD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,YACE,OACA,IACA,OAC4B;AAC5B,UAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,MAAM,oBAAI,IAAY;AAC5B,eAAW,CAAC,UAAU,IAAI,KAAK,MAAM,QAAQ;AAC3C,UAAI,SAAS,UAAa,SAAS,KAAM;AACzC,UAAI,aAAa,MAAM,IAAI,KAAK,EAAG,KAAI,IAAI,QAAQ;AAAA,IACrD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,UAAU,OAAe,KAAqD;AAC5E,UAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,UAA0B,CAAC;AACjC,eAAW,CAAC,UAAU,KAAK,KAAK,MAAM,QAAQ;AAC5C,cAAQ,KAAK,EAAE,UAAU,MAAM,CAAC;AAAA,IAClC;AACA,YAAQ,KAAK,CAAC,GAAG,MAAM,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC;AACrD,QAAI,QAAQ,OAAQ,SAAQ,QAAQ;AACpC,WAAO;AAAA,EACT;AACF;AAEA,IAAM,YAAiC,oBAAI,IAAI;AAY/C,SAAS,aAAa,OAAwB;AAC5C,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AAIpD,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,QAAkB,CAAC;AACzB,eAAW,MAAM,MAAO,OAAM,KAAK,aAAa,EAAE,CAAC;AACnD,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,SAAO;AACT;AAEA,SAAS,WACP,OACA,UACA,OACA,OACA,cACM;AACN,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,MAAM,eAAe,OAAO,KAAK,KAAK,aAAa,KAAK;AAC9D,MAAI,SAAS,MAAM,QAAQ,IAAI,GAAG;AAClC,MAAI,CAAC,QAAQ;AACX,aAAS,oBAAI,IAAI;AACjB,UAAM,QAAQ,IAAI,KAAK,MAAM;AAAA,EAC/B;AACA,SAAO,IAAI,QAAQ;AACnB,QAAM,OAAO,IAAI,UAAU,KAAK;AAClC;AAEA,SAAS,gBACP,OACA,UACA,OACA,OACA,cACM;AACN,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,MAAM,eAAe,OAAO,KAAK,KAAK,aAAa,KAAK;AAC9D,QAAM,SAAS,MAAM,QAAQ,IAAI,GAAG;AACpC,MAAI,QAAQ;AACV,WAAO,OAAO,QAAQ;AACtB,QAAI,OAAO,SAAS,EAAG,OAAM,QAAQ,OAAO,GAAG;AAAA,EACjD;AACA,QAAM,OAAO,OAAO,QAAQ;AAC9B;AASA,SAAS,aACP,MACA,IACA,OACS;AACT,MAAI,OAAO,WAAW;AACpB,QAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,EAAG,QAAO;AACxD,WAAO,aAAa,MAAM,MAAM,CAAC,CAAC,KAAK,KAAK,aAAa,MAAM,MAAM,CAAC,CAAC,KAAK;AAAA,EAC9E;AACA,QAAM,MAAM,aAAa,MAAM,KAAK;AACpC,UAAQ,IAAI;AAAA,IACV,KAAK;AAAM,aAAO,MAAM;AAAA,IACxB,KAAK;AAAM,aAAO,OAAO;AAAA,IACzB,KAAK;AAAM,aAAO,MAAM;AAAA,IACxB,KAAK;AAAM,aAAO,OAAO;AAAA,EAC3B;AACF;AAEA,SAAS,aAAa,GAAY,GAAoB;AACpD,MAAI,MAAM,UAAa,MAAM,KAAM,QAAO,MAAM,UAAa,MAAM,OAAO,IAAI;AAC9E,MAAI,MAAM,UAAa,MAAM,KAAM,QAAO;AAC1C,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO,IAAI;AAC/D,MAAI,aAAa,QAAQ,aAAa,KAAM,QAAO,EAAE,QAAQ,IAAI,EAAE,QAAQ;AAC3E,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;AACpF,MAAI,OAAO,MAAM,aAAa,OAAO,MAAM,WAAW;AACpD,WAAO,MAAM,IAAI,IAAI,IAAI,IAAI;AAAA,EAC/B;AAKA,SAAO;AACT;;;ACxYA,IAAM,aAAuB;AAAA,EAC3B,SAAS,CAAC;AAAA,EACV,SAAS,CAAC;AAAA,EACV,OAAO;AAAA,EACP,QAAQ;AACV;AAEO,IAAM,YAAN,MAAM,WAA4E;AAAA,EACtE;AAAA,EACA;AAAA,EAEjB,YAAY,QAA4B,OAAiB,YAAY;AACnE,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AAAA,EAEA,MAAS,OAA4B,IAAc,OAA8B;AAQ/E,UAAM,MAAM,KAAK,OAAO,IAAI;AAO5B,QAAI,KAAK,WAAW,KAAK,GAAG,cAAc,OAAQ,OAAM,IAAI,uBAAuB,KAAK;AACxF,UAAM,YAAY,KAAK,YAAY,OAAO,IAAI,KAAK;AACnD,UAAM,SAAsB,YACxB;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,QACH,OAAO,UAAU;AAAA,QACjB,SAAS,UAAU;AAAA,QACnB,UAAU,CAAC,QAAiB,WAAmB,IAAK,eAAe,WAAW,QAAQ,MAAM;AAAA,QAC5F,YAAY,IAAK,WAAW,WAAW,EAAE;AAAA,MAC3C;AAAA,IACF,IACA,EAAE,MAAM,SAAS,OAAO,IAAI,MAAM;AACtC,WAAO,IAAI,WAAmB,KAAK,QAAQ;AAAA,MACzC,GAAG,KAAK;AAAA,MACR,SAAS,CAAC,GAAG,KAAK,KAAK,SAAS,MAAM;AAAA,IACxC,CAAC;AAAA,EACH;AAAA,EAEA,QAAQ,OAAyB,YAA4B,OAA2B;AACtF,WAAO,IAAI,WAAmB,KAAK,QAAQ;AAAA,MACzC,GAAG,KAAK;AAAA,MACR,SAAS,CAAC,GAAG,KAAK,KAAK,SAAS,EAAE,OAAO,UAAU,CAAC;AAAA,IACtD,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,GAA+B;AACnC,WAAO,IAAI,WAAmB,KAAK,QAAQ,EAAE,GAAG,KAAK,MAAM,OAAO,EAAE,CAAC;AAAA,EACvE;AAAA,EAEA,OAAO,GAA+B;AACpC,WAAO,IAAI,WAAmB,KAAK,QAAQ,EAAE,GAAG,KAAK,MAAM,QAAQ,EAAE,CAAC;AAAA,EACxE;AAAA,EAEA,MAAM,UAAwB;AAC5B,UAAM,KAAK,OAAO,6BAA6B;AAE/C,UAAM,gBAAgB,qBAAqB,KAAK,IAAI;AACpD,UAAM,gBAAgB,cAAc,OAAO,OAAK,CAAC,eAAe,GAAG,KAAK,OAAO,gBAAgB,CAAC;AAChG,QAAI,cAAc,SAAS,GAAG;AAC5B,YAAM,IAAI,mBAAmB;AAAA,QAC3B,YAAY,KAAK,OAAO;AAAA,QACxB;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,KAAK,oBAAoB;AAC9C,QAAI,iBAAiB,MAAM;AAMzB,YAAM,IAAI,mBAAmB;AAAA,QAC3B,YAAY,KAAK,OAAO;AAAA,QACxB;AAAA,QACA,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AASA,UAAM,YAAiB,CAAC;AACxB,eAAW,MAAM,cAAc;AAC7B,YAAM,MAAM,MAAM,KAAK,OAAO,aAAa,EAAE;AAC7C,UAAI,QAAQ,KAAM;AAClB,UAAI,CAAC,WAAW,KAAK,KAAK,KAAK,OAAO,EAAG;AACzC,gBAAU,KAAK,GAAQ;AAAA,IACzB;AAMA,UAAM,SAAS,KAAK,KAAK,QAAQ,SAAS,IACtC,YAAY,WAAW,KAAK,KAAK,SAAS,KAAK,OAAO,IAAI,CAAC,IAC3D;AAEJ,UAAM,SAAS,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;AACzD,UAAM,OAAO,KAAK,KAAK,UAAU,SAC7B,OAAO,MAAM,MAAM,IACnB,OAAO,MAAM,QAAQ,SAAS,KAAK,KAAK,KAAK;AAIjD,WAAO,QAAQ,IAAI,KAAK,IAAI,OAAK,KAAK,OAAO,aAAa,CAAC,CAAC,CAAC;AAAA,EAC/D;AAAA,EAEA,MAAM,QAA2B;AAC/B,UAAM,MAAM,MAAM,KAAK,MAAM,CAAC,EAAE,QAAQ;AACxC,WAAO,IAAI,SAAS,IAAI,IAAI,CAAC,IAAK;AAAA,EACpC;AAAA,EAEA,MAAM,QAAyB;AAC7B,UAAM,MAAM,MAAM,KAAK,QAAQ;AAC/B,WAAO,IAAI;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,sBAAgD;AACtD,UAAM,MAAM,KAAK,OAAO;AAMxB,UAAM,QAAQ,oBAAI,IAAqB;AACvC,UAAM,YAAY,oBAAI,IAAY;AAClC,eAAW,UAAU,KAAK,KAAK,SAAS;AACtC,UAAI,OAAO,OAAO,MAAM;AACtB,cAAM,IAAI,OAAO,OAAO,OAAO,KAAK;AASpC,YAAI,OAAO,IAAK,WAAU,IAAI,OAAO,KAAK;AAAA,MAC5C;AAAA,IACF;AACA,QAAI,MAAM,QAAQ,GAAG;AACnB,iBAAW,OAAO,IAAI,YAAY,GAAG;AACnC,YAAI,IAAI,SAAS,YAAa;AAC9B,YAAI,IAAI,OAAO,KAAK,OAAK,UAAU,IAAI,CAAC,CAAC,EAAG;AAC5C,YAAI,IAAI,OAAO,MAAM,OAAK,MAAM,IAAI,CAAC,CAAC,GAAG;AACvC,gBAAM,QAAQ,IAAI,OAAO,IAAI,OAAK,MAAM,IAAI,CAAC,CAAC;AAC9C,gBAAM,MAAM,IAAI,YAAY,IAAI,KAAK,KAAK;AAC1C,cAAI,IAAK,QAAO,CAAC,GAAG,GAAG;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AAEA,eAAW,UAAU,KAAK,KAAK,SAAS;AACtC,UAAI,OAAO,OAAO,MAAM;AACtB,YAAI,OAAO,KAAK;AAYd,cAAI,OAAO,IAAI,eAAe,QAAW;AACvC,kBAAM,UAAU,IAAI,UAAU,OAAO,OAAO,KAAK;AACjD,gBAAI,QAAS,QAAO,QAAQ,IAAI,OAAK,EAAE,QAAQ;AAC/C;AAAA,UACF;AACA,gBAAMA,OAAM,IAAI,YAAY,OAAO,OAAO,OAAO,IAAI,UAAU;AAC/D,cAAIA,KAAK,QAAO,CAAC,GAAGA,IAAG;AACvB;AAAA,QACF;AAMA,cAAM,QAAQ,KAAK,OAAO,uBAAuB,OAAO,OAAO,OAAO,KAAK,KAAK,OAAO;AACvF,cAAM,MAAM,IAAI,YAAY,OAAO,OAAO,KAAK;AAC/C,YAAI,IAAK,QAAO,CAAC,GAAG,GAAG;AAAA,MACzB,WAAW,OAAO,OAAO,QAAQ,MAAM,QAAQ,OAAO,KAAK,GAAG;AAC5D,YAAI,OAAO,KAAK;AAId,cAAI,OAAO,IAAI,eAAe,QAAW;AACvC,kBAAM,UAAU,IAAI,UAAU,OAAO,OAAO,KAAK;AACjD,gBAAI,QAAS,QAAO,QAAQ,IAAI,OAAK,EAAE,QAAQ;AAC/C;AAAA,UACF;AACA,cAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,UAAU,EAAG;AAC3C,gBAAMA,OAAM,IAAI,SAAS,OAAO,OAAO,OAAO,IAAI,UAAU;AAC5D,cAAIA,KAAK,QAAO,CAAC,GAAGA,IAAG;AACvB;AAAA,QACF;AACA,cAAM,SAAS,OAAO,MAAM,IAAI,OAAK,KAAK,OAAO,uBAAuB,OAAO,OAAO,CAAC,KAAK,CAAC;AAC7F,cAAM,MAAM,IAAI,SAAS,OAAO,OAAO,MAAM;AAC7C,YAAI,IAAK,QAAO,CAAC,GAAG,GAAG;AAAA,MACzB,WAAW,UAAU,OAAO,EAAE,GAAG;AAC/B,YAAI,OAAO,KAAK;AAYd,gBAAM,UAAU,IAAI,UAAU,OAAO,OAAO,KAAK;AACjD,cAAI,QAAS,QAAO,QAAQ,IAAI,OAAK,EAAE,QAAQ;AAC/C;AAAA,QACF;AAIA,cAAM,MAAM,IAAI,YAAY,OAAO,OAAO,OAAO,IAAI,OAAO,KAAK;AACjE,YAAI,IAAK,QAAO,CAAC,GAAG,GAAG;AAAA,MACzB;AAAA,IACF;AAGA,QAAI,KAAK,KAAK,QAAQ,SAAS,GAAG;AAChC,YAAM,UAAU,KAAK,KAAK,QAAQ,CAAC;AACnC,YAAM,UAAU,IAAI,UAAU,QAAQ,OAAO,QAAQ,SAAS;AAC9D,UAAI,QAAS,QAAO,QAAQ,IAAI,OAAK,EAAE,QAAQ;AAAA,IACjD;AAEA,WAAO;AAAA,EACT;AACF;AAUA,SAAS,eAAe,OAAe,KAAwC;AAC7E,MAAI,IAAI,IAAI,KAAK,EAAG,QAAO;AAC3B,aAAW,OAAO,IAAI,YAAY,GAAG;AACnC,QAAI,IAAI,SAAS,eAAe,IAAI,OAAO,SAAS,KAAK,EAAG,QAAO;AAAA,EACrE;AACA,SAAO;AACT;AAEA,SAAS,UAAU,IAAyD;AAC1E,SAAO,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,OAAO,QAAQ,OAAO;AAC1E;AAEA,SAAS,qBAAqB,MAA0B;AACtD,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,KAAK,QAAS,MAAK,IAAI,EAAE,KAAK;AAC9C,aAAW,KAAK,KAAK,QAAS,MAAK,IAAI,EAAE,KAAK;AAC9C,SAAO,CAAC,GAAG,IAAI;AACjB;AAEA,SAAS,WAAW,QAAiB,SAAqC;AACxE,aAAW,KAAK,SAAS;AACvB,QAAI,CAAC,eAAe,QAAQ,CAAC,EAAG,QAAO;AAAA,EACzC;AACA,SAAO;AACT;AAEA,SAAS,YAAe,SAAc,SAAiC,KAAwB;AAC7F,SAAO,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM;AACjC,eAAW,EAAE,OAAO,UAAU,KAAK,SAAS;AAC1C,YAAM,KAAK,SAAS,GAAG,KAAK;AAC5B,YAAM,KAAK,SAAS,GAAG,KAAK;AAM5B,YAAM,SAAS,KAAK,gBAAgB,OAAO,IAAI,EAAE;AACjD,YAAM,MAAM,WAAW,SAAY,SAAS,cAAc,IAAI,EAAE;AAChE,UAAI,QAAQ,EAAG,QAAO,cAAc,QAAQ,MAAM,CAAC;AAAA,IACrD;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAEA,SAAS,cAAc,GAAY,GAAoB;AACrD,MAAI,MAAM,UAAa,MAAM,KAAM,QAAO,MAAM,UAAa,MAAM,OAAO,IAAI;AAC9E,MAAI,MAAM,UAAa,MAAM,KAAM,QAAO;AAC1C,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO,IAAI;AAC/D,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;AACpF,MAAI,aAAa,QAAQ,aAAa,KAAM,QAAO,EAAE,QAAQ,IAAI,EAAE,QAAQ;AAC3E,SAAO;AACT;","names":["ids"]}

package/dist/{chunk-VA4ZWLFY.js → chunk-7GAXFU2O.js}

@@ -2,7 +2,7 @@ import {
   IllegalTransitionError,
   RecordLockedError,
   ValidationError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/with-audit/guards/with-guard.ts
 function withGuard(strategy) {
@@ -120,4 +120,4 @@ export {
   immutableGuard,
   transitionGuard
 };
-//# sourceMappingURL=chunk-VA4ZWLFY.js.map
+//# sourceMappingURL=chunk-7GAXFU2O.js.map

package/dist/{chunk-5JB73NMC.js → chunk-7QLY64AD.js}

@@ -1,19 +1,19 @@
 import {
   openEnvelopeJson
-} from "./chunk-QQJXBZCO.js";
+} from "./chunk-HA6ZQWA2.js";
 import {
   encrypt
-} from "./chunk-HUS3J5WM.js";
+} from "./chunk-37WOJQWY.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-CKZW6P5V.js";
+} from "./chunk-JC75UBMT.js";
 import {
   ConflictError,
   SequenceContentionError,
   SequenceNotEnabledError,
   SequenceOfflineError,
   ValidationError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/with-commit/sequence/strategy.ts
 var NO_SEQUENCE = {
@@ -199,4 +199,4 @@ export {
   resolveSequenceKey,
   SequenceStore
 };
-//# sourceMappingURL=chunk-5JB73NMC.js.map
+//# sourceMappingURL=chunk-7QLY64AD.js.map

package/dist/{chunk-GA2QHD6P.js → chunk-7ZOSHEVS.js}

@@ -1,32 +1,32 @@
 import {
   resolveManagedSecret
-} from "./chunk-KPGX66PM.js";
+} from "./chunk-FF7S3XDW.js";
 import {
   parseExtractedPartitionBody,
   readPod,
   readPodHeader
-} from "./chunk-K62IUKOD.js";
+} from "./chunk-PH7G7ZI7.js";
 import {
   createOwnerKeyring
-} from "./chunk-5ZOSG3RJ.js";
+} from "./chunk-CCIR2OJH.js";
 import {
   LedgerStore
-} from "./chunk-OEAATWH5.js";
+} from "./chunk-HBBZWEC5.js";
 import {
   LEDGER_COLLECTION
 } from "./chunk-I7FD46FF.js";
 import {
   openEnvelopeJson
-} from "./chunk-QQJXBZCO.js";
+} from "./chunk-HA6ZQWA2.js";
 import {
   base64ToBuffer,
   wrapKey
-} from "./chunk-HUS3J5WM.js";
+} from "./chunk-37WOJQWY.js";
 import {
   AdoptionStateError,
   TransferSealError,
   ValidationError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/with-cargo/adopt-partition.ts
 async function unsealDeks(seal, transferKey) {
@@ -179,7 +179,7 @@ async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
     }
   }
   if (isManaged(opts)) {
-    const { createNoydb } = await import("./noydb-6JLBZU4U.js");
+    const { createNoydb } = await import("./noydb-AKH4AMCR.js");
     const db = await createNoydb({
       store,
       user: userId,
@@ -232,4 +232,4 @@ export {
   createOwnerOnAdoptedPartition,
   decryptExtractedPartition
 };
-//# sourceMappingURL=chunk-GA2QHD6P.js.map
+//# sourceMappingURL=chunk-7ZOSHEVS.js.map

package/dist/{chunk-H44ZE4IE.js → chunk-AAIIDAUC.js}

@@ -6,7 +6,22 @@ import {
   ConflictError,
   InvariantError,
   ValidationError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
+
+// src/kernel/best-effort-revert.ts
+async function bestEffortRevert(executed, adapter, compensate) {
+  for (const leg of [...executed].reverse()) {
+    try {
+      if (leg.prior !== null) {
+        await adapter.put(leg.vaultName, leg.collectionName, leg.id, leg.prior);
+      } else {
+        await adapter.delete(leg.vaultName, leg.collectionName, leg.id);
+      }
+      if (compensate) await compensate(leg);
+    } catch {
+    }
+  }
+}
 
 // src/with-commit/tx/transaction.ts
 var TxContext = class {
@@ -216,7 +231,7 @@ async function runTransaction(db, fn, options, txInvariants) {
     db._clearActiveTxContext(ctx);
   }
   if (ctx._amendment) {
-    const { GuardExecutor } = await import("./executor-GZWMTOXB.js");
+    const { GuardExecutor } = await import("./executor-UPSH5O3F.js");
     try {
       for (const [vaultName, v] of ctx._amendmentVaults) {
         const registry = v._getGuardRegistry();
@@ -326,30 +341,31 @@ async function runTransaction(db, fn, options, txInvariants) {
   return bodyResult;
 }
 async function revertExecuted(executed, store, db) {
-  for (const { op, priorEnvelope } of executed.slice().reverse()) {
-    try {
-      if (priorEnvelope) {
-        await store.put(op.vaultName, op.collectionName, op.id, priorEnvelope);
-      } else {
-        await store.delete(op.vaultName, op.collectionName, op.id);
-      }
-      if (db) {
-        const coll = db.vault(op.vaultName).collection(op.collectionName);
-        await coll._invalidateCacheEntry(op.id);
-      }
-    } catch {
-    }
-  }
+  const legs = executed.map(({ op, priorEnvelope }) => ({
+    vaultName: op.vaultName,
+    collectionName: op.collectionName,
+    id: op.id,
+    prior: priorEnvelope
+  }));
+  await bestEffortRevert(
+    legs,
+    store,
+    db ? async (leg) => {
+      const coll = db.vault(leg.vaultName).collection(leg.collectionName);
+      await coll._invalidateCacheEntry(leg.id);
+    } : void 0
+  );
 }
 function keyOf(op) {
   return `${op.vaultName}\0${op.collectionName}\0${op.id}`;
 }
 
 export {
+  bestEffortRevert,
   TxContext,
   TxVault,
   TxCollection,
   runTransaction,
   revertExecuted
 };
-//# sourceMappingURL=chunk-H44ZE4IE.js.map
+//# sourceMappingURL=chunk-AAIIDAUC.js.map