@noy-db/hub 0.3.0-pre.11 → 0.3.0-pre.13

package/dist/snapshots/index.js

@@ -1,19 +1,19 @@
 import {
   readPod,
   writePod
-} from "../chunk-K62IUKOD.js";
-import "../chunk-5XIPOCQC.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+} from "../chunk-FHS2HQSH.js";
+import "../chunk-X3YYQWOQ.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
 import {
   SnapshotNotFoundError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-fork/snapshots/engine.ts

package/dist/stale-OSQ7J3AA.js

@@ -0,0 +1,29 @@
+import {
+  MV_STALE_COLLECTION,
+  clearMVStale,
+  clearMVStaleFully,
+  invalidateMVAtRest,
+  isMVStale,
+  markMVStale,
+  resolveStaleMVOnRead
+} from "./chunk-HDQIIUPH.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MV_STALE_COLLECTION,
+  clearMVStale,
+  clearMVStaleFully,
+  invalidateMVAtRest,
+  isMVStale,
+  markMVStale,
+  resolveStaleMVOnRead
+};
+//# sourceMappingURL=stale-OSQ7J3AA.js.map

package/dist/storage-MVFCGEQE.js

@@ -0,0 +1,23 @@
+import {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+} from "./chunk-VZRODIM3.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+};
+//# sourceMappingURL=storage-MVFCGEQE.js.map

package/dist/{store-coordination-provider-HPYVFJCV.js → store-coordination-provider-64OEZFGS.js}

@@ -1,10 +1,10 @@
 import {
   loadFence,
   saveFence
-} from "./chunk-Q3XSMOZM.js";
+} from "./chunk-RYCTDFUX.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-CKZW6P5V.js";
+} from "./chunk-JNAI2HN2.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/schema-update/client-registry.ts
@@ -139,4 +139,4 @@ function unref(timer) {
 export {
   StoreCoordinationProvider
 };
-//# sourceMappingURL=store-coordination-provider-HPYVFJCV.js.map
+//# sourceMappingURL=store-coordination-provider-64OEZFGS.js.map

package/dist/sync/index.js

@@ -2,17 +2,17 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-W5D62AQD.js";
+} from "../chunk-HDMEGAQE.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
-import "../chunk-FH542DDY.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
+import "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/team/sync-active.ts

package/dist/team/index.js

@@ -5,7 +5,7 @@ import {
   listCredentials,
   putCredential,
   withTeam
-} from "../chunk-OOLO4LQG.js";
+} from "../chunk-I6GALP6E.js";
 import {
   NO_TEAM,
   deriveMagicLinkContentKey,
@@ -23,7 +23,7 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-IP2QBAGS.js";
+} from "../chunk-AUSTCW2X.js";
 import {
   burnPaperRecoveryEntry,
   loadPaperRecoveryEntries,
@@ -32,14 +32,13 @@ import {
   savePaperRecoveryEntries,
   unwrapDeksFromBlob,
   unwrapDeksFromPaperEntry
-} from "../chunk-6QILBDZU.js";
+} from "../chunk-EVVGJDRQ.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-W5D62AQD.js";
+} from "../chunk-HDMEGAQE.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-4R4Q64W5.js";
 import {
   SYNC_CREDENTIALS_COLLECTION,
   buildRecipientKeyringFile,
@@ -57,19 +56,20 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-5ZOSG3RJ.js";
-import "../chunk-4N5QFSNQ.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+} from "../chunk-J2ZX2XUV.js";
+import "../chunk-4JBYV75E.js";
+import "../chunk-ZICD77GM.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
 import {
   TeamNotEnabledError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TEAM,

package/dist/tiers/index.js

@@ -1,6 +1,7 @@
 import {
   NO_TIERS,
   assertDeclaredTier,
+  assertTierComposition,
   assertTiersEnabled,
   classifySealedShred,
   demote,
@@ -8,25 +9,27 @@ import {
   getAtTier,
   listAtTier,
   putAtTier,
+  syncDerivedOutputs,
   withTiers
-} from "../chunk-H6HM6CVR.js";
-import "../chunk-4R4Q64W5.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+} from "../chunk-CDUQTA3Z.js";
+import "../chunk-ZICD77GM.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
 import {
   TiersNotEnabledError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,
   TiersNotEnabledError,
   assertDeclaredTier,
+  assertTierComposition,
   assertTiersEnabled,
   classifySealedShred,
   demote,
@@ -34,6 +37,7 @@ export {
   getAtTier,
   listAtTier,
   putAtTier,
+  syncDerivedOutputs,
   withTiers
 };
 //# sourceMappingURL=index.js.map

package/dist/to/index.js

@@ -4,7 +4,7 @@ import {
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BundleVersionConflictError,

package/dist/tx/index.js

@@ -3,9 +3,9 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-H44ZE4IE.js";
+} from "../chunk-MEFJPTZ4.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-FH542DDY.js";
+import "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
@@ -44,7 +44,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-GZWMTOXB.js");
+      const { GuardExecutor } = await import("../executor-KGWTNEQD.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/{verify-66RHOW7N.js → verify-ZASTRNPR.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-MSPNM2OM.js";
+} from "./chunk-HB3RFQSC.js";
 import {
   dualReadSealedSlot
-} from "./chunk-SYMS4546.js";
+} from "./chunk-JKJOGPZN.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-HUS3J5WM.js";
+} from "./chunk-CIE2BASH.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-BIOUI4HL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -38,7 +38,7 @@ function refuseSealedResidue(collection, field) {
 }
 async function verifyDigestField(ctx, id, field, candidate, policy) {
   const env = await ctx.getEnvelope(id);
-  if (env === null) return padFalse();
+  if (env === null || (env._tier ?? 0) > 0) return padFalse();
   const blob = env._vdig?.[field];
   if (blob === void 0) {
     if (env._sealed?.[field] !== void 0) refuseSealedResidue(ctx.collection, field);
@@ -65,7 +65,7 @@ async function verifyTextField(ctx, id, field, candidate, normalize) {
   const env = await ctx.getEnvelope(id);
   const blob = env?._sealed?.[field];
   let stored;
-  if (env !== null && blob !== void 0) {
+  if (env !== null && (env._tier ?? 0) === 0 && blob !== void 0) {
     const cek = await ctx.resolveCek(env);
     const dek = await ctx.getDEK();
     try {
@@ -97,7 +97,8 @@ async function matchGroupFields(ctx, id, answers, members, opts) {
     }
     normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer));
   }
-  const env = await ctx.getEnvelope(id);
+  const fetched = await ctx.getEnvelope(id);
+  const env = fetched === null || (fetched._tier ?? 0) > 0 ? null : fetched;
   if (env !== null) {
     for (const m of members) {
       if (env._sealed?.[m.field] !== void 0 && env._vdig?.[m.field] === void 0) {
@@ -136,4 +137,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-66RHOW7N.js.map
+//# sourceMappingURL=verify-ZASTRNPR.js.map

package/dist/verify-ZASTRNPR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/enclave/classify/verify.ts"],"sourcesContent":["/**\n * The enclave verify oracle (spec §3). Verdict-only egress: no path\n * distinguishes \"record missing\" / \"no digest\" / \"AAD-tamper\" / \"mismatch\"\n * beyond { ok: false } — existence oracles are oracles too. Every path that\n * cannot run a real comparison runs ONE dummy PBKDF2 + ONE dummy tag-compare\n * first (C4), so wall-clock cannot enumerate records/fields/answers. The\n * text door (verifyTextField) has no real PBKDF2 of its own, so it pays the\n * pad UNCONDITIONALLY — every outcome, including a real compare, costs the\n * same one PBKDF2 unit (no inverted exists-vs-absent oracle).\n * Elevated records (_tier > 0, with-audit tier moves) are non-comparable\n * through every door and pad-false exactly like missing records (#691) —\n * the tier-aware read surface is getAtTier, never verify.\n * Throws are reserved for caller/config bugs (ClassifiedVerifyError /\n * ClassifiedConfigError) and are exempt from the pad by design (R6 note).\n * @module\n */\nimport { generateSalt, base64ToBuffer, type EnclaveKey } from '../crypto.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\nimport { normalizeForVerify, type VerifyNormalizeMode } from './normalize.js'\nimport { blindedEqual } from './compare.js'\nimport { evaluateKofN } from './kofn.js'\nimport { openVdigPayload, type VdigPayload } from './vdig.js'\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { ClassifiedConfigError, ClassifiedVerifyError } from '../../errors.js'\nimport type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../types.js'\n\nexport interface VerifyEngineCtx {\n  readonly collection: string\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n  readonly now: () => number\n}\n\n/**\n * C4 pad: one full-cost dummy digest + one dummy compare; result discarded.\n * Pad at `iter` when the caller holds an AUTHENTICATED payload.iter, so pad\n * cost tracks the real compare cost across future iteration bumps; the\n * fully-absent paths (no payload to read an iter from) use VDIG_ITERATIONS.\n */\nasync function padOnce(iter: number = VDIG_ITERATIONS): Promise<void> {\n  const dummy = await pbkdf2VerifyDigest('noydb-classify-c4-pad', generateSalt(), iter)\n  await blindedEqual(dummy, dummy)\n}\n\nasync function padFalse(): Promise<ClassifiedVerdict> {\n  await padOnce()\n  return { ok: false }\n}\n\n/** R6 verify-side transition evidence — config bug, fail-loud, pad-exempt. */\nfunction refuseSealedResidue(collection: string, field: string): never {\n  throw new ClassifiedConfigError(collection,\n    `field \"${field}\" carries a recoverable _sealed slot but no _vdig — storage-form ` +\n    `transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`)\n}\n\nexport async function verifyDigestField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  policy: VdigFieldPolicy,\n): Promise<ClassifiedVerdict> {\n  const env = await ctx.getEnvelope(id)\n  // #691: an elevated envelope (_tier > 0) is non-comparable through every\n  // tier-0 door — its key material is tier-DEK-wrapped and must never be\n  // resolved here (the elevating session's warm cekCache would otherwise\n  // leak past the tier audit). Exactly the missing-record pad path, checked\n  // BEFORE the R6 residue probe so tier-0 callers learn nothing.\n  if (env === null || (env._tier ?? 0) > 0) return padFalse()\n  const blob = env._vdig?.[field]\n  if (blob === undefined) {\n    if (env._sealed?.[field] !== undefined) refuseSealedResidue(ctx.collection, field)\n    return padFalse()\n  }\n  const cek = await ctx.resolveCek(env)\n  if (cek === undefined) return padFalse()\n\n  let payload: VdigPayload\n  try {\n    payload = await openVdigPayload(blob, cek, ctx.collection, id, field)\n  } catch {\n    return padFalse() // AAD/tamper (C1) → padded false; no tamper oracle to the caller\n  }\n\n  const normalized = normalizeForVerify(policy.normalize, candidate)\n  const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter)\n  const ok = await blindedEqual(digest, base64ToBuffer(payload.cur.hash))\n  if (!ok) return { ok: false } // I1: bare false — mustRotate never computed here\n\n  if (policy.rotateDays !== undefined\n    && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 86_400_000) {\n    // Disclosing write-age-vs-policy to a SUCCESSFUL verifier is intended (audit F6).\n    return { ok: true, mustRotate: true }\n  }\n  return { ok: true }\n}\n\nexport async function verifyTextField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  normalize: VerifyNormalizeMode,\n): Promise<ClassifiedVerdict> {\n  // C4, single code path: (a) attempt the unseal where a slot exists, then\n  // for EVERY outcome — present-correct, present-wrong, missing record,\n  // missing slot, tampered — (b) run the one constant-cost pad, (c) run one\n  // blindedEqual, (d) return the boolean. Unlike the digest door there is no\n  // real PBKDF2 here (unseal is sub-ms AES-GCM), so skipping the pad on the\n  // real compare would make exists-but-wrong ~100x FASTER than absent — an\n  // inverted existence oracle. No branch below skips the dominant cost.\n  const env = await ctx.getEnvelope(id)\n  const blob = env?._sealed?.[field]\n  let stored: string | undefined\n  if (env !== null && (env._tier ?? 0) === 0 && blob !== undefined) { // #691: elevated ≡ missing\n    const cek = await ctx.resolveCek(env)\n    const dek = await ctx.getDEK()\n    try {\n      // Plaintext exists microseconds inside this function; only the boolean leaves.\n      stored = String(JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek)))\n    } catch {\n      stored = undefined // AAD/tamper (C1) → same padded compare tail as absent\n    }\n  }\n  await padOnce()\n  const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate))\n  const b = stored !== undefined\n    ? new TextEncoder().encode(normalizeForVerify(normalize, stored))\n    : a // no-compare dummy comparand — the verdict is forced false below\n  const eq = await blindedEqual(a, b)\n  return { ok: stored !== undefined && eq }\n}\n\nexport async function matchGroupFields(\n  ctx: VerifyEngineCtx,\n  id: string,\n  answers: Record<string, string>,\n  members: ReadonlyArray<{ readonly field: string; readonly policy: VdigFieldPolicy }>,\n  opts: { readonly min: number },\n): Promise<{ readonly passed: boolean }> {\n  // I2 step 1 — validate EVERYTHING up front, before any PBKDF2, throwing\n  // uniformly at ~0 elapsed (no member-position leak via timing/throw type).\n  if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {\n    throw new ClassifiedVerifyError(ctx.collection, '*',\n      `matchGroup min ${opts.min} out of range 1..${members.length}`)\n  }\n  const normalized = new Map<string, string>()\n  for (const m of members) {\n    const answer = answers[m.field] // non-member answer keys: silently ignored\n    if (answer === undefined) continue\n    if (typeof answer !== 'string') {\n      throw new ClassifiedVerifyError(ctx.collection, m.field, 'candidate must be a string')\n    }\n    normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer))\n  }\n\n  const fetched = await ctx.getEnvelope(id)\n  // #691: elevated ≡ missing — nulling the view here also skips the R6\n  // residue probe (a tier-0 caller must not learn an elevated record's\n  // storage form) and forces the cek-undefined pad path for every member.\n  const env = fetched === null || (fetched._tier ?? 0) > 0 ? null : fetched\n  if (env !== null) {\n    for (const m of members) { // R6 evidence — uniform, before any PBKDF2\n      if (env._sealed?.[m.field] !== undefined && env._vdig?.[m.field] === undefined) {\n        refuseSealedResidue(ctx.collection, m.field)\n      }\n    }\n  }\n  const cek = env !== null ? await ctx.resolveCek(env) : undefined\n\n  // I2 step 2+3 — iterate RESOLVED GROUP MEMBERS (denominator = |members|),\n  // evaluate EVERY member (collect, never break), pad every no-compare slot.\n  const results: boolean[] = []\n  for (const m of members) {\n    const candidate = normalized.get(m.field)\n    const blob = env?._vdig?.[m.field]\n    if (env === null || cek === undefined || blob === undefined) {\n      await padOnce()\n      results.push(false)\n      continue\n    }\n    try {\n      const payload = await openVdigPayload(blob, cek, ctx.collection, id, m.field)\n      if (candidate === undefined) {\n        // Slot present, answer absent: the payload's authenticated iter is in\n        // hand — pad at IT (not the constant) so a future iteration bump\n        // cannot desync this pad's cost from the real compare's cost.\n        await padOnce(payload.iter)\n        results.push(false)\n        continue\n      }\n      const digest = await pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter)\n      results.push(await blindedEqual(digest, base64ToBuffer(payload.cur.hash)))\n    } catch {\n      await padOnce()\n      results.push(false)\n    }\n  }\n  // Per-member results never appear in any return, error, or audit payload.\n  return { passed: evaluateKofN(results, opts.min) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwCA,eAAe,QAAQ,OAAe,iBAAgC;AACpE,QAAM,QAAQ,MAAM,mBAAmB,yBAAyB,aAAa,GAAG,IAAI;AACpF,QAAM,aAAa,OAAO,KAAK;AACjC;AAEA,eAAe,WAAuC;AACpD,QAAM,QAAQ;AACd,SAAO,EAAE,IAAI,MAAM;AACrB;AAGA,SAAS,oBAAoB,YAAoB,OAAsB;AACrE,QAAM,IAAI;AAAA,IAAsB;AAAA,IAC9B,UAAU,KAAK;AAAA,EACgF;AACnG;AAEA,eAAsB,kBACpB,KACA,IACA,OACA,WACA,QAC4B;AAC5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AAMpC,MAAI,QAAQ,SAAS,IAAI,SAAS,KAAK,EAAG,QAAO,SAAS;AAC1D,QAAM,OAAO,IAAI,QAAQ,KAAK;AAC9B,MAAI,SAAS,QAAW;AACtB,QAAI,IAAI,UAAU,KAAK,MAAM,OAAW,qBAAoB,IAAI,YAAY,KAAK;AACjF,WAAO,SAAS;AAAA,EAClB;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,MAAI,QAAQ,OAAW,QAAO,SAAS;AAEvC,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,KAAK;AAAA,EACtE,QAAQ;AACN,WAAO,SAAS;AAAA,EAClB;AAEA,QAAM,aAAa,mBAAmB,OAAO,WAAW,SAAS;AACjE,QAAM,SAAS,MAAM,mBAAmB,YAAY,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AAClG,QAAM,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC;AACtE,MAAI,CAAC,GAAI,QAAO,EAAE,IAAI,MAAM;AAE5B,MAAI,OAAO,eAAe,UACrB,IAAI,IAAI,IAAI,KAAK,MAAM,QAAQ,IAAI,EAAE,IAAI,OAAO,aAAa,OAAY;AAE5E,WAAO,EAAE,IAAI,MAAM,YAAY,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;AAEA,eAAsB,gBACpB,KACA,IACA,OACA,WACA,WAC4B;AAQ5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI;AACJ,MAAI,QAAQ,SAAS,IAAI,SAAS,OAAO,KAAK,SAAS,QAAW;AAChE,UAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,UAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAI;AAEF,eAAS,OAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC,CAAC;AAAA,IAC7F,QAAQ;AACN,eAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,QAAQ;AACd,QAAM,IAAI,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,SAAS,CAAC;AAC3E,QAAM,IAAI,WAAW,SACjB,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,MAAM,CAAC,IAC9D;AACJ,QAAM,KAAK,MAAM,aAAa,GAAG,CAAC;AAClC,SAAO,EAAE,IAAI,WAAW,UAAa,GAAG;AAC1C;AAEA,eAAsB,iBACpB,KACA,IACA,SACA,SACA,MACuC;AAGvC,MAAI,CAAC,OAAO,UAAU,KAAK,GAAG,KAAK,KAAK,MAAM,KAAK,KAAK,MAAM,QAAQ,QAAQ;AAC5E,UAAM,IAAI;AAAA,MAAsB,IAAI;AAAA,MAAY;AAAA,MAC9C,kBAAkB,KAAK,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IAAE;AAAA,EAClE;AACA,QAAM,aAAa,oBAAI,IAAoB;AAC3C,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,QAAQ,EAAE,KAAK;AAC9B,QAAI,WAAW,OAAW;AAC1B,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,sBAAsB,IAAI,YAAY,EAAE,OAAO,4BAA4B;AAAA,IACvF;AACA,eAAW,IAAI,EAAE,OAAO,mBAAmB,EAAE,OAAO,WAAW,MAAM,CAAC;AAAA,EACxE;AAEA,QAAM,UAAU,MAAM,IAAI,YAAY,EAAE;AAIxC,QAAM,MAAM,YAAY,SAAS,QAAQ,SAAS,KAAK,IAAI,OAAO;AAClE,MAAI,QAAQ,MAAM;AAChB,eAAW,KAAK,SAAS;AACvB,UAAI,IAAI,UAAU,EAAE,KAAK,MAAM,UAAa,IAAI,QAAQ,EAAE,KAAK,MAAM,QAAW;AAC9E,4BAAoB,IAAI,YAAY,EAAE,KAAK;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,QAAQ,OAAO,MAAM,IAAI,WAAW,GAAG,IAAI;AAIvD,QAAM,UAAqB,CAAC;AAC5B,aAAW,KAAK,SAAS;AACvB,UAAM,YAAY,WAAW,IAAI,EAAE,KAAK;AACxC,UAAM,OAAO,KAAK,QAAQ,EAAE,KAAK;AACjC,QAAI,QAAQ,QAAQ,QAAQ,UAAa,SAAS,QAAW;AAC3D,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAClB;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,EAAE,KAAK;AAC5E,UAAI,cAAc,QAAW;AAI3B,cAAM,QAAQ,QAAQ,IAAI;AAC1B,gBAAQ,KAAK,KAAK;AAClB;AAAA,MACF;AACA,YAAM,SAAS,MAAM,mBAAmB,WAAW,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AACjG,cAAQ,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC,CAAC;AAAA,IAC3E,QAAQ;AACN,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,SAAS,KAAK,GAAG,EAAE;AACnD;","names":[]}

package/dist/via/lookup/registry.d.ts

@@ -99,6 +99,15 @@ export interface LookupDictCompat {
  * snapshot seam).
  */
 export declare function collectLookupDictCompat(lookupFields: Record<string, LookupDescriptor> | undefined): LookupDictCompat;
+/**
+ * Reserved-dict deps of a set of named collections (#653) — the `_dict_*`
+ * collections partial sync must auto-include alongside a `collections`
+ * filter, mirroring `SyncEngine`'s existing satellite-pair expansion.
+ * One hop is provably complete: `vault.collection()` refuses `_dict_*`
+ * names, so a dict can never itself declare lookup fields — no
+ * dict-of-dict chain to recurse through.
+ */
+export declare function reservedDictDepsOf(names: readonly string[], dictKeyFieldRegistry: ReadonlyMap<string, Record<string, string>>): readonly string[];
 /**
  * A lookup dimension's sync membership/altKey table, materialized from its
  * backing rows (#650 Task 3). `keys` is every canonical key present;

package/dist/via/money/where.d.ts

@@ -86,12 +86,33 @@ export declare function moneyFieldClause(field: string, op: Operator, value: unk
  * canonical write's probe hits directly (no canonicalization needed for the
  * common case); this note covers the pre-declaration tail.
  *
- * Boundary: this guarantee is EAGER-mode only (`CollectionIndexes`, this
- * file's index probe). LAZY mode's `PersistedCollectionIndex`
- * (`with-lookup/indexing/persisted-indexes.ts`) keeps its own raw bucketing
- * and does not consult money canonicalization — a lazy-mode mixed-era record
- * can still diverge between its fast path and a forced scan. Tracked
- * separately, not fixed here.
+ * Boundary — CLOSED for the index layer (#677): LAZY mode's
+ * `PersistedCollectionIndex` (`with-lookup/indexing/persisted-indexes.ts`)
+ * now consults the SAME `ViaPipeline.canonicalizeIndexKey` at every
+ * bucket-mutation site (`ingest`/`upsert`/`remove`) as `CollectionIndexes`
+ * does, and its query path (`with-lookup/indexing/lazy-builder.ts`'s
+ * `resolveCandidateIds()`) canonicalizes the `==`/`in` probe value before
+ * calling `lookupEqual`/`lookupIn` — mirroring `candidateRecords()` above
+ * resolving `indexValue` before its own `lookupEqual`/`lookupIn` call. A
+ * lazy-mode mixed-era record's bucket and a canonicalized probe now agree,
+ * the same as eager mode.
+ *
+ * Residual boundary CLOSED by #684: `LazyQuery.where()` now builds
+ * `clause.via` exactly like `Query.where()`/`ScanBuilder.where()` do, and
+ * `LazyQuery`'s post-filter (`lazy-builder.ts`'s `toArray()`) runs it
+ * against the RAW record (a dedicated raw-fetch seam on `Collection`, split
+ * out of `get()`) instead of the DECODED one — `clause.via.evaluate` (this
+ * file's {@link evaluateMoneyClause}) now sees the same stored-form
+ * operand/actual-value space eager's `filterRecords` does, at any `scale`.
+ * Only survivors are decoded (`present()`) on the way out. Money RANGE
+ * clauses additionally route around `PersistedCollectionIndex.lookupRange`
+ * (raw/typed, wrong space for scaled-int money) — `resolveCandidateIds()`
+ * enumerates the field's indexed ids instead and lets this now-via-aware
+ * post-filter apply the correct BigInt-exact comparison. `lazyQuery().
+ * where()` on a money field now agrees with `scan().where()` /
+ * `query().where()` at every `scale` — for `.where()` results specifically.
+ * `orderBy` ordering is a separate, still-open lazy-vs-eager divergence,
+ * tracked in #695.
  */
 export declare function moneyIndexProbe(op: Operator, payload: MoneyWhereOperand): unknown | undefined;
 /**

package/dist/{walk-2RWEOCAS.js → walk-SVNDIZ62.js}

@@ -3,19 +3,19 @@ import {
 } from "./chunk-VYYM3MEN.js";
 import {
   derivePersistedSchema
-} from "./chunk-QLLKLFE2.js";
+} from "./chunk-W22IKJE2.js";
 import {
   loadPersistedSchema
-} from "./chunk-C7NTK5I3.js";
-import "./chunk-QQJXBZCO.js";
-import "./chunk-FQQF23MC.js";
-import "./chunk-MSPNM2OM.js";
-import "./chunk-SYMS4546.js";
-import "./chunk-X6CMGUAG.js";
+} from "./chunk-VZRODIM3.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-HUS3J5WM.js";
-import "./chunk-CKZW6P5V.js";
-import "./chunk-FH542DDY.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/introspection/walk.ts
@@ -238,4 +238,4 @@ function summariseAggregateOp(value) {
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=walk-2RWEOCAS.js.map
+//# sourceMappingURL=walk-SVNDIZ62.js.map

package/dist/with/index.js

@@ -6,18 +6,18 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "../chunk-JOQ53DMI.js";
-import "../chunk-5ZOSG3RJ.js";
-import "../chunk-4N5QFSNQ.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+} from "../chunk-6QTNZJBS.js";
+import "../chunk-J2ZX2XUV.js";
+import "../chunk-4JBYV75E.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
-import "../chunk-FH542DDY.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
+import "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ServiceBus,

package/dist/with-audit/forget/strategy.d.ts

@@ -138,6 +138,13 @@ export interface ForgetResult {
     /** `collection:id:field` sealed slots that were DEK-derived (legacy, written before per-record CEKs) and thus NOT crypto-shredded
      * by dropping `_cek` — the collection DEK is retained, so synced/backup copies stay decryptable (#M-1). */
     readonly sealedResidue: readonly string[];
+    /** Count of `_ledger_deltas` rows hard-deleted across the shredded records (#734) — the
+     * erasure twin of #729's elevate-side purge. Entry metadata (that the record was mutated,
+     * at which version/timestamp/actor) is retained; only the plaintext delta content is removed. */
+    readonly ledgerDeltasPurged: number;
+    /** `collection:id` refs whose `_ledger_deltas` purge failed — plaintext delta residue still
+     * readable under the retained ledger DEK. Non-empty means erasure is INCOMPLETE. */
+    readonly ledgerDeltaResidue: readonly string[];
     /** The single `op:'forget'` ledger entry appended for this erasure. */
     readonly ledgerEntry: LedgerEntry;
     /** #622 — record-grain derived artifacts (MV rows, per-record derived copies) erased
@@ -162,6 +169,21 @@ export interface ForgetResult {
      *  Always empty under the unconditional default. Non-empty means a `_sealed_cek` entry or a
      *  blob scan was skipped for an undeclared collection — reported, never a silent skip. */
     readonly scopedPurgeResidue: readonly ScopedPurgeResidueNotice[];
+    /** #776/#782/#785 — `collection:id` MV-output rows that survived erasure invalidation (eager
+     *  tombstone leg AND lazy/manual `invalidateMVAtRest`) despite belonging to the forgotten
+     *  subject, because the `_materializedFrom` ownership stamp could NOT be decoded (undecodable
+     *  under the collection's default DEK — e.g. elevated above tier 0 on a tiered output
+     *  collection; ownership unconfirmed — could be a plain user record on a same-collection
+     *  partition MV). Never erased, but surfaced here rather than silently skipped (the #724
+     *  posture). Non-empty means the row may still hold the forgotten/pre-elevation contribution,
+     *  decryptable by tier-holders. */
+    readonly derivedResidueUndecodable: readonly string[];
+    /** #782/#785 — `collection:id` MV-output rows that DID decode and stamp-match via
+     *  `_materializedFrom`, but whose erasure was declined by the #718 tier-elevation gate
+     *  (`_internalDelete` returned false). Ownership CONFIRMED here — a real silent survival,
+     *  not a stamp-mismatch skip — surfaced rather than dropped. Non-empty means a live,
+     *  tier-holder-decryptable copy of the forgotten contribution was deliberately retained. */
+    readonly derivedResidueDeclined: readonly string[];
 }
 /** #633 — the two `scopedPurgeResidue` skip reasons. Single source of truth: `purge-scope.ts`
  *  (the port-internal partition helpers) imports this rather than redeclaring it. */