@noy-db/hub 0.3.0-pre.12 → 0.3.0-pre.13

package/dist/{chunk-6MA575R5.js → chunk-GTGPO5KW.js}

@@ -1,19 +1,19 @@
 import {
   ATTESTATIONS_COLLECTION,
   loadOrCreateSigner
-} from "./chunk-NT2ZO4KI.js";
+} from "./chunk-EXK7QRWF.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
   encrypt
-} from "./chunk-37WOJQWY.js";
+} from "./chunk-CIE2BASH.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-JC75UBMT.js";
+} from "./chunk-JNAI2HN2.js";
 import {
   AttestationError
-} from "./chunk-FZCGIJEJ.js";
+} from "./chunk-BIOUI4HL.js";
 
 // src/with-audit/attestation/issue.ts
 import {
@@ -56,4 +56,4 @@ async function issueAttestationCore(ctx, args) {
 export {
   issueAttestationCore
 };
-//# sourceMappingURL=chunk-6MA575R5.js.map
+//# sourceMappingURL=chunk-GTGPO5KW.js.map

package/dist/{chunk-XS6DLN67.js → chunk-HB3RFQSC.js}

@@ -2,10 +2,10 @@ import {
   base64ToBuffer,
   decryptBytesWithAAD,
   encryptBytesWithAAD
-} from "./chunk-37WOJQWY.js";
+} from "./chunk-CIE2BASH.js";
 import {
   TamperedError
-} from "./chunk-FZCGIJEJ.js";
+} from "./chunk-BIOUI4HL.js";
 
 // src/kernel/enclave/classify/compare.ts
 var subtle = globalThis.crypto.subtle;
@@ -92,4 +92,4 @@ export {
   openVdigPayload,
   evaluateKofN
 };
-//# sourceMappingURL=chunk-XS6DLN67.js.map
+//# sourceMappingURL=chunk-HB3RFQSC.js.map

package/dist/{chunk-VXZNSPJM.js → chunk-HDMEGAQE.js}

@@ -4,20 +4,20 @@ import {
 import {
   isDeleteMarker,
   isTombstoneShape
-} from "./chunk-J3JIYFYL.js";
+} from "./chunk-7DSTRQIJ.js";
 import {
   bufferToBase64,
   decrypt,
   derivePresenceKey,
   encrypt,
   generateIV
-} from "./chunk-37WOJQWY.js";
+} from "./chunk-CIE2BASH.js";
 import {
   NOYDB_SYNC_VERSION
-} from "./chunk-JC75UBMT.js";
+} from "./chunk-JNAI2HN2.js";
 import {
   ConflictError
-} from "./chunk-FZCGIJEJ.js";
+} from "./chunk-BIOUI4HL.js";
 
 // src/with-party/team/presence.ts
 var PresenceHandle = class {
@@ -954,4 +954,4 @@ export {
   SyncEngine,
   SyncTransaction
 };
-//# sourceMappingURL=chunk-VXZNSPJM.js.map
+//# sourceMappingURL=chunk-HDMEGAQE.js.map

package/dist/chunk-HDQIIUPH.js

@@ -0,0 +1,135 @@
+import {
+  RecordCodec
+} from "./chunk-XDYREZWE.js";
+
+// src/with-formula/materialized-views/stale.ts
+var _staleByRegistry = /* @__PURE__ */ new WeakMap();
+function markMVStale(registry, mvName) {
+  let set = _staleByRegistry.get(registry);
+  if (!set) {
+    set = /* @__PURE__ */ new Set();
+    _staleByRegistry.set(registry, set);
+  }
+  set.add(mvName);
+}
+function isMVStale(registry, mvName) {
+  return _staleByRegistry.get(registry)?.has(mvName) ?? false;
+}
+var MV_STALE_COLLECTION = "_mv_stale";
+var _hydratedByRegistry = /* @__PURE__ */ new WeakMap();
+function storeOf(accessor, collectionName) {
+  const c = accessor.getCollection(collectionName);
+  return { adapter: c.adapter, vault: c.vault };
+}
+async function writeMVStaleMarker(adapter, vault, mvName) {
+  const env = RecordCodec.buildPlaintextEnvelope({ version: 1, data: "{}" });
+  await adapter.put(vault, MV_STALE_COLLECTION, mvName, env);
+}
+async function deleteMVStaleMarker(adapter, vault, mvName) {
+  await adapter.delete(vault, MV_STALE_COLLECTION, mvName);
+}
+async function hydratePersistedStaleMarkers(accessor, registry) {
+  const mvs = registry.all();
+  if (mvs.length === 0) return;
+  const { adapter, vault } = storeOf(accessor, mvs[0].outputCollection);
+  for (const name of await adapter.list(vault, MV_STALE_COLLECTION)) markMVStale(registry, name);
+}
+async function invalidateMVAtRest(accessor, reg, mode) {
+  const outputColl = accessor.getCollection(reg.outputCollection);
+  const txCtx = accessor.getActiveTxContext();
+  const { adapter, vault } = storeOf(accessor, reg.outputCollection);
+  let deleted = 0;
+  const residueUndecodable = [];
+  const residueDeclined = [];
+  for (const id of await adapter.list(vault, reg.outputCollection)) {
+    const envelope = await adapter.get(vault, reg.outputCollection, id);
+    if (envelope === null) continue;
+    const decoded = await outputColl._decodeEnvelope(envelope, id);
+    if (decoded === null) {
+      residueUndecodable.push(id);
+      continue;
+    }
+    const stampedBy = decoded._materializedFrom;
+    if (stampedBy?.mvName !== reg.spec.name) continue;
+    if (await outputColl._internalDelete(id, txCtx)) {
+      deleted++;
+    } else {
+      residueDeclined.push(id);
+    }
+  }
+  if (mode === "lazy") {
+    const registry = accessor.registry();
+    markMVStale(registry, reg.spec.name);
+    await writeMVStaleMarker(adapter, vault, reg.spec.name);
+  }
+  return { deleted, residueUndecodable, residueDeclined };
+}
+async function resolveStaleMVOnRead(accessor, outputCollection, dispatchCtx) {
+  const registry = accessor.registry();
+  let hydrate = _hydratedByRegistry.get(registry);
+  if (!hydrate) {
+    hydrate = hydratePersistedStaleMarkers(accessor, registry).catch((err) => {
+      _hydratedByRegistry.delete(registry);
+      throw err;
+    });
+    _hydratedByRegistry.set(registry, hydrate);
+  }
+  await hydrate;
+  const pending = _staleByRegistry.get(registry);
+  if (!pending || pending.size === 0) return;
+  const { adapter, vault } = storeOf(accessor, outputCollection);
+  for (const name of pending) {
+    if (registry.byName(name)) continue;
+    pending.delete(name);
+    await deleteMVStaleMarker(adapter, vault, name);
+  }
+  if (pending.size === 0) return;
+  const candidates = [];
+  for (const mv of registry.all()) {
+    if (mv.outputCollection !== outputCollection) continue;
+    if (!pending.has(mv.spec.name)) continue;
+    candidates.push(mv.spec.name);
+  }
+  if (candidates.length === 0) return;
+  let executor = null;
+  for (const name of candidates) {
+    const reg = registry.byName(name);
+    if (!reg) {
+      pending.delete(name);
+      await deleteMVStaleMarker(adapter, vault, name);
+      continue;
+    }
+    if (executor === null) {
+      ({ MaterializedViewExecutor: executor } = await import("./executor-UNEH5ZYH.js"));
+    }
+    for (const dep of reg.dependencies) {
+      await accessor.getCollection(dep).ensureHydrated();
+    }
+    await executor.refresh(reg, {
+      getCollection: (n) => accessor.getCollection(n),
+      getActiveTxContext: () => accessor.getActiveTxContext(),
+      getQueryContext: () => accessor.getQueryContext(),
+      ...dispatchCtx !== void 0 ? { dispatchCtx } : {}
+    });
+    pending.delete(name);
+    await deleteMVStaleMarker(adapter, vault, name);
+  }
+}
+function clearMVStale(registry, mvName) {
+  _staleByRegistry.get(registry)?.delete(mvName);
+}
+async function clearMVStaleFully(adapter, vault, registry, mvName) {
+  clearMVStale(registry, mvName);
+  await deleteMVStaleMarker(adapter, vault, mvName);
+}
+
+export {
+  markMVStale,
+  isMVStale,
+  MV_STALE_COLLECTION,
+  invalidateMVAtRest,
+  resolveStaleMVOnRead,
+  clearMVStale,
+  clearMVStaleFully
+};
+//# sourceMappingURL=chunk-HDQIIUPH.js.map

package/dist/chunk-HDQIIUPH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/materialized-views/stale.ts"],"sourcesContent":["import type { Collection } from '../../kernel/collection.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { PutDerivedOutputCtx } from '../../kernel/via/dispatch.js'\nimport type { MaterializedViewRegistry, RegisteredMV } from './registry.js'\n// Type-only — runtime class loaded via dynamic import in\n// `resolveStaleMVOnRead` only when a stale flag actually fires.\n// Keeps the executor chunk out of the floor bundle (mirrors v1 floor-bundle isolation).\nimport type { MaterializedViewExecutor as MVExecutorType } from './executor.js'\nimport type { MVQueryContext } from './types.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { RecordCodec } from '../../kernel/enclave/index.js'\n\n/**\n * Accessor shape passed in from the owning Vault. Provides the\n * registry (used as a stable WeakMap key + to look up MVs by output\n * collection) and the runtime context the lazy refresh needs.\n * Mirrors v1's `DerivationStaleAccessor`.\n */\nexport interface MVStaleAccessor {\n  registry(): MaterializedViewRegistry\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  getCollection(name: string): Collection<any>\n  getActiveTxContext(): TxContext | null\n  getQueryContext(): MVQueryContext\n}\n\n/**\n * In-memory stale map keyed by `MaterializedViewRegistry` instance\n * (stable per vault). Each registry maps to a set of MV names that\n * have at least one pending source-change requiring a re-materialize.\n *\n * Persistence across vault close is NOT implemented in this iteration\n * (concern flagged in the v2 spec, mirrors v1 derivation behavior).\n * On vault re-open, the unset stale flag is interpreted as \"fresh\" —\n * `vault.refreshView(name)` is the explicit recompute escape hatch.\n *\n * @internal\n */\nconst _staleByRegistry = new WeakMap<MaterializedViewRegistry, Set<string>>()\n\n/**\n * Mark an MV as stale. Called from `Collection.dispatchMaterializedViews`\n * when a source-write fires for a `refresh: 'lazy'` MV.\n *\n * @internal\n */\nexport function markMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  let set = _staleByRegistry.get(registry)\n  if (!set) {\n    set = new Set()\n    _staleByRegistry.set(registry, set)\n  }\n  set.add(mvName)\n}\n\n/**\n * Test-only: check whether a given MV name is currently flagged stale\n * against a registry. Exported so the regression suite can pin the\n * stale-bit lifecycle without touching the internal `WeakMap`.\n *\n * @internal\n */\nexport function isMVStale(registry: MaterializedViewRegistry, mvName: string): boolean {\n  return _staleByRegistry.get(registry)?.has(mvName) ?? false\n}\n\n/**\n * Reserved collection holding CONTENT-FREE lazy-stale markers (record id =\n * MV name, plaintext `_iv: ''` envelope, no payload) — mirrors the\n * `_meta`/schema-fence marker envelope shape. Written only from the\n * delete/forget/elevate dispatcher (#736); ordinary source writes stay\n * in-memory-only (the cheap path). Read via the adapter directly, never\n * through `vault.collection()` — same reserved-collection convention as\n * `_subject_index`/`_meta`.\n */\nexport const MV_STALE_COLLECTION = '_mv_stale'\n\n/**\n * Once-per-registry hydrate guard for `resolveStaleMVOnRead`'s persisted-marker fold-in.\n * Stores the in-flight/settled PROMISE (not a boolean) — a concurrent cold first read that\n * arrives while the hydrate is still awaiting `adapter.list` must await the SAME promise\n * rather than observing \"already hydrating\" and reading an empty pending set (#736\n * whole-branch review).\n */\nconst _hydratedByRegistry = new WeakMap<MaterializedViewRegistry, Promise<void>>()\n\n/** The adapter + vault name backing any collection in this vault (all collections share both). */\nfunction storeOf(accessor: MVStaleAccessor, collectionName: string): { adapter: NoydbStore; vault: string } {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const c = accessor.getCollection(collectionName) as any\n  return { adapter: c.adapter as NoydbStore, vault: c.vault as string }\n}\n\nasync function writeMVStaleMarker(adapter: NoydbStore, vault: string, mvName: string): Promise<void> {\n  // Content-free — the marker's only payload is its key (the MV name).\n  const env = RecordCodec.buildPlaintextEnvelope({ version: 1, data: '{}' })\n  await adapter.put(vault, MV_STALE_COLLECTION, mvName, env)\n}\n\nasync function deleteMVStaleMarker(adapter: NoydbStore, vault: string, mvName: string): Promise<void> {\n  await adapter.delete(vault, MV_STALE_COLLECTION, mvName)\n}\n\n/**\n * On first `resolveStaleMVOnRead` call for a (cold-reopened) registry, fold every\n * persisted `_mv_stale` marker into the in-memory pending set — otherwise a cold\n * session's empty `WeakMap` entry reads as \"fresh\" and serves the emptied output\n * collection forever.\n */\nasync function hydratePersistedStaleMarkers(accessor: MVStaleAccessor, registry: MaterializedViewRegistry): Promise<void> {\n  const mvs = registry.all()\n  if (mvs.length === 0) return\n  const { adapter, vault } = storeOf(accessor, mvs[0]!.outputCollection)\n  // No try/catch: a genuine store failure here must surface, not be read as\n  // \"nothing pending\" — silently treating it as fresh is the exact leak class\n  // this module closes (mirrors `subject-index.ts`'s bare `adapter.list` reads).\n  for (const name of await adapter.list(vault, MV_STALE_COLLECTION)) markMVStale(registry, name)\n}\n\n/**\n * Invalidate an MV from the delete/forget/elevate dispatcher (#736) — the ordinary\n * source-write path (`dispatchMaterializedViews`) never calls this. Deletes EVERY\n * persisted row in `reg.outputCollection` via `_internalDelete` (the at-rest law: a\n * stale mark alone leaves the elevated/forgotten source's plaintext sitting in the\n * output row) using the adapter directly so the read-path's `resolveStaleMVOnRead`\n * isn't triggered mid-invalidation. `mode: 'lazy'` also persists the stale mark so a\n * cold session recomputes on next read; `'manual'` gets the purge only — the MV\n * serves empty until an explicit `vault.refreshView()` (erasure wins). Deletion is\n * stamp-scoped (`_materializedFrom.mvName === reg.spec.name` — see the loop below),\n * so another registered MV sharing this output collection keeps its own rows intact:\n * no cross-MV re-marking is needed here, only `reg` itself is marked stale.\n *\n * Returns the count of rows actually `_internalDelete`d (#761 item 1) — folded by the\n * caller into `dispatchMaterializedViewsOnDelete`'s `deleted` so `ForgetResult.derivedRecordsErased`\n * counts lazy/manual purges too, not just the eager executor's tombstone leg — plus\n * `residueUndecodable`, the bare ids whose ownership stamp could NOT be decoded (#776): a\n * candidate row that fails to decode under the collection's default DEK (e.g. elevated above\n * tier 0 on a tiered output collection) has UNKNOWN ownership — it might be this MV's own\n * output, or (same-collection shape) a plain user record — so it is never erased, but it must\n * be SURFACED rather than silently skipped (the #724 posture), since it may still hold the\n * forgotten/pre-elevation contribution, decryptable by tier-holders — and `residueDeclined`\n * (#785), the bare ids that DID decode and stamp-match but whose `_internalDelete` declined\n * (ownership CONFIRMED, erasure declined).\n *\n * @internal\n */\nexport async function invalidateMVAtRest(\n  accessor: MVStaleAccessor,\n  reg: RegisteredMV,\n  mode: 'lazy' | 'manual',\n): Promise<{ deleted: number; residueUndecodable: string[]; residueDeclined: string[] }> {\n  const outputColl = accessor.getCollection(reg.outputCollection)\n  const txCtx = accessor.getActiveTxContext()\n  const { adapter, vault } = storeOf(accessor, reg.outputCollection)\n  let deleted = 0\n  const residueUndecodable: string[] = []\n  const residueDeclined: string[] = []\n  for (const id of await adapter.list(vault, reg.outputCollection)) {\n    // A same-collection partition MV (`output: { collection: <source>, partition }`,\n    // the DERIV-PP30-001 shape) writes INTO its own source collection — `adapter.list`\n    // over `reg.outputCollection` then also returns untouched user source records.\n    // Decode each candidate row (the invalidation path is rare; this cost is fine\n    // here) and only erase rows THIS MV stamped via `_materializedFrom.mvName` —\n    // an unstamped row, or one stamped by a different MV, is never this MV's to\n    // delete (#736 whole-branch review, Critical).\n    const envelope = await adapter.get(vault, reg.outputCollection, id)\n    if (envelope === null) continue\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const decoded = await (outputColl as any)._decodeEnvelope(envelope, id)\n    if (decoded === null) { residueUndecodable.push(id); continue } // #776 — ownership unknown, surfaced not skipped\n    const stampedBy = (decoded as Record<string, unknown>)._materializedFrom as { mvName?: string } | undefined\n    if (stampedBy?.mvName !== reg.spec.name) continue\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    if (await (outputColl as any)._internalDelete(id, txCtx)) {\n      deleted++\n    } else {\n      // #782 part b — decoded AND stamp-owned, but erasure declined (#718 tier-elevation\n      // gate). Ownership IS confirmed — a real silent survival, not a legit stamp-mismatch\n      // skip. Surface it too, in its own channel (#785 — distinct from the decode-null case).\n      residueDeclined.push(id)\n    }\n  }\n\n  // `mode: 'manual'` gets the purge only (erasure wins, no auto-recompute promise);\n  // `'lazy'` also marks + persists ITS OWN stale bit for cold-session recompute. No\n  // sibling MV on the same output collection is touched here — the stamp-scoped\n  // deletion above never erased sibling rows in the first place (#736 re-review).\n  if (mode === 'lazy') {\n    const registry = accessor.registry()\n    markMVStale(registry, reg.spec.name)\n    await writeMVStaleMarker(adapter, vault, reg.spec.name)\n  }\n  return { deleted, residueUndecodable, residueDeclined }\n}\n\n/**\n * Called from `Collection.get` (and any reader that materializes the\n * MV's output collection). If any MV producing `outputCollection` is\n * flagged stale, runs the executor against the live source state\n * before returning. No-op when there is no pending work — keeps the\n * read fast path negligible.\n *\n * `dispatchCtx` (#641): threaded from the calling `Collection`'s\n * `#dispatchCtx({ collection: outputCollection, id: 'resolve-on-read' })` — a read has no\n * real \"reacting write\" record, so `'resolve-on-read'` is the sentinel id, mirroring\n * `Vault.refreshView()`'s `'refreshView'` sentinel for the same reason. Passed straight\n * through to the executor so a stale row whose output lands in a closed period follows the\n * frozen-output rule (skip + `derivation:skipped-frozen`, #637) instead of throwing\n * `PeriodClosedError` out of a read.\n *\n * Dynamic-imports the executor only when a stale flag actually fires\n * (the floor-bundle isolation pattern v1 derivations established in\n * floor-bundle isolation pattern).\n */\nexport async function resolveStaleMVOnRead(\n  accessor: MVStaleAccessor,\n  outputCollection: string,\n  dispatchCtx?: PutDerivedOutputCtx,\n): Promise<void> {\n  const registry = accessor.registry()\n  // Cold session: the in-memory WeakMap has no entry for this (freshly\n  // constructed) registry yet — fold any persisted `_mv_stale` markers in\n  // before reading the pending set, once per registry (#736). Memoize the\n  // PROMISE, not a boolean: a concurrent first read arriving while the\n  // hydrate is still awaiting `adapter.list` must await the SAME promise —\n  // otherwise it observes \"already hydrating\", skips straight to an empty\n  // pending set, and serves the purged/stale view as fresh (#736\n  // whole-branch review, hydrate-once race). On rejection, evict the entry\n  // BEFORE rethrowing — a cached rejected promise would otherwise poison the\n  // MV read surface for the rest of the session (every later read re-awaits\n  // the same rejection instead of retrying the store call) (#736 re-review).\n  let hydrate = _hydratedByRegistry.get(registry)\n  if (!hydrate) {\n    hydrate = hydratePersistedStaleMarkers(accessor, registry).catch((err: unknown) => {\n      _hydratedByRegistry.delete(registry)\n      throw err\n    })\n    _hydratedByRegistry.set(registry, hydrate)\n  }\n  await hydrate\n  const pending = _staleByRegistry.get(registry)\n  if (!pending || pending.size === 0) return\n\n  const { adapter, vault } = storeOf(accessor, outputCollection)\n\n  // Clean up persisted markers for MV names no longer registered (renamed or\n  // removed since the marker was written). Without this sweep an orphaned name\n  // can never become a `candidate` below — `candidates` is built from\n  // `registry.all()`, which no longer lists it — so both the in-memory pending\n  // entry and the persisted `_mv_stale` row would linger forever, re-hydrating\n  // on every cold session (#736 whole-branch review).\n  for (const name of pending) {\n    if (registry.byName(name)) continue\n    pending.delete(name)\n    await deleteMVStaleMarker(adapter, vault, name)\n  }\n  if (pending.size === 0) return\n\n  // Find every MV that writes to this output collection AND is\n  // currently flagged stale. Multiple MVs CAN share an output\n  // collection in theory; in practice the registration validation +\n  // cycle detection make this unusual.\n  const candidates: string[] = []\n  for (const mv of registry.all()) {\n    if (mv.outputCollection !== outputCollection) continue\n    if (!pending.has(mv.spec.name)) continue\n    candidates.push(mv.spec.name)\n  }\n  if (candidates.length === 0) return\n\n  let executor: typeof MVExecutorType | null = null\n  for (const name of candidates) {\n    const reg = registry.byName(name)\n    if (!reg) {\n      // Unreachable in practice — `candidates` is drawn from `registry.all()`,\n      // and the orphan sweep above already cleared any name absent from it.\n      // Kept as a defensive fallback; also clears the persisted marker so it\n      // can't linger if this ever does fire.\n      pending.delete(name)\n      await deleteMVStaleMarker(adapter, vault, name)\n      continue\n    }\n    if (executor === null) {\n      ({ MaterializedViewExecutor: executor } = (await import('./executor.js')) as {\n        MaterializedViewExecutor: typeof MVExecutorType\n      })\n    }\n    // A cold-hydrated stale flag (unlike an in-session one) can fire with\n    // NONE of the MV's dependency collections touched yet this session —\n    // the sync `Query.toArray()` `spec.query()` runs reads straight off\n    // `Collection`'s in-memory cache, populated only by a prior async\n    // touch (`ensureHydrated()`, called from `get`/`list`/`put`, never\n    // from `query()` itself). Warm every dependency first so the recompute\n    // sees the live persisted state instead of an empty cache (#736).\n    for (const dep of reg.dependencies) {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      await (accessor.getCollection(dep) as any).ensureHydrated()\n    }\n    await executor.refresh(reg, {\n      getCollection: (n) => accessor.getCollection(n),\n      getActiveTxContext: () => accessor.getActiveTxContext(),\n      getQueryContext: () => accessor.getQueryContext(),\n      ...(dispatchCtx !== undefined ? { dispatchCtx } : {}),\n    })\n    pending.delete(name)\n    // Runs even when no marker was ever persisted for this name (an in-session-only\n    // stale bit — e.g. the cheap ordinary-write path never writes one, see the\n    // \"cheap-path guarantee\" test). `adapter.delete` on an absent key is a harmless\n    // void — keeping this unconditional avoids branching on marker origin here.\n    await deleteMVStaleMarker(adapter, vault, name)\n  }\n}\n\n/**\n * Drop every stale flag for a registry. Used after a manual\n * `vault.refreshView(name)` runs the executor explicitly — the\n * post-refresh state matches the registered strategies, so\n * lingering stale bits would force a redundant refresh on the next\n * read.\n *\n * @internal\n */\nexport function clearMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  _staleByRegistry.get(registry)?.delete(mvName)\n}\n\n/**\n * `clearMVStale` plus the persisted marker (#736) — `Vault.refreshView()`'s\n * completion path. A lingering persisted marker after a manual refresh would\n * make the NEXT cold session recompute redundantly.\n *\n * @internal\n */\nexport async function clearMVStaleFully(\n  adapter: NoydbStore,\n  vault: string,\n  registry: MaterializedViewRegistry,\n  mvName: string,\n): Promise<void> {\n  clearMVStale(registry, mvName)\n  await deleteMVStaleMarker(adapter, vault, mvName)\n}\n"],"mappings":";;;;;AAsCA,IAAM,mBAAmB,oBAAI,QAA+C;AAQrE,SAAS,YAAY,UAAoC,QAAsB;AACpF,MAAI,MAAM,iBAAiB,IAAI,QAAQ;AACvC,MAAI,CAAC,KAAK;AACR,UAAM,oBAAI,IAAI;AACd,qBAAiB,IAAI,UAAU,GAAG;AAAA,EACpC;AACA,MAAI,IAAI,MAAM;AAChB;AASO,SAAS,UAAU,UAAoC,QAAyB;AACrF,SAAO,iBAAiB,IAAI,QAAQ,GAAG,IAAI,MAAM,KAAK;AACxD;AAWO,IAAM,sBAAsB;AASnC,IAAM,sBAAsB,oBAAI,QAAiD;AAGjF,SAAS,QAAQ,UAA2B,gBAAgE;AAE1G,QAAM,IAAI,SAAS,cAAc,cAAc;AAC/C,SAAO,EAAE,SAAS,EAAE,SAAuB,OAAO,EAAE,MAAgB;AACtE;AAEA,eAAe,mBAAmB,SAAqB,OAAe,QAA+B;AAEnG,QAAM,MAAM,YAAY,uBAAuB,EAAE,SAAS,GAAG,MAAM,KAAK,CAAC;AACzE,QAAM,QAAQ,IAAI,OAAO,qBAAqB,QAAQ,GAAG;AAC3D;AAEA,eAAe,oBAAoB,SAAqB,OAAe,QAA+B;AACpG,QAAM,QAAQ,OAAO,OAAO,qBAAqB,MAAM;AACzD;AAQA,eAAe,6BAA6B,UAA2B,UAAmD;AACxH,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,IAAI,WAAW,EAAG;AACtB,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,IAAI,CAAC,EAAG,gBAAgB;AAIrE,aAAW,QAAQ,MAAM,QAAQ,KAAK,OAAO,mBAAmB,EAAG,aAAY,UAAU,IAAI;AAC/F;AA6BA,eAAsB,mBACpB,UACA,KACA,MACuF;AACvF,QAAM,aAAa,SAAS,cAAc,IAAI,gBAAgB;AAC9D,QAAM,QAAQ,SAAS,mBAAmB;AAC1C,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,IAAI,gBAAgB;AACjE,MAAI,UAAU;AACd,QAAM,qBAA+B,CAAC;AACtC,QAAM,kBAA4B,CAAC;AACnC,aAAW,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI,gBAAgB,GAAG;AAQhE,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,IAAI,kBAAkB,EAAE;AAClE,QAAI,aAAa,KAAM;AAEvB,UAAM,UAAU,MAAO,WAAmB,gBAAgB,UAAU,EAAE;AACtE,QAAI,YAAY,MAAM;AAAE,yBAAmB,KAAK,EAAE;AAAG;AAAA,IAAS;AAC9D,UAAM,YAAa,QAAoC;AACvD,QAAI,WAAW,WAAW,IAAI,KAAK,KAAM;AAEzC,QAAI,MAAO,WAAmB,gBAAgB,IAAI,KAAK,GAAG;AACxD;AAAA,IACF,OAAO;AAIL,sBAAgB,KAAK,EAAE;AAAA,IACzB;AAAA,EACF;AAMA,MAAI,SAAS,QAAQ;AACnB,UAAM,WAAW,SAAS,SAAS;AACnC,gBAAY,UAAU,IAAI,KAAK,IAAI;AACnC,UAAM,mBAAmB,SAAS,OAAO,IAAI,KAAK,IAAI;AAAA,EACxD;AACA,SAAO,EAAE,SAAS,oBAAoB,gBAAgB;AACxD;AAqBA,eAAsB,qBACpB,UACA,kBACA,aACe;AACf,QAAM,WAAW,SAAS,SAAS;AAYnC,MAAI,UAAU,oBAAoB,IAAI,QAAQ;AAC9C,MAAI,CAAC,SAAS;AACZ,cAAU,6BAA6B,UAAU,QAAQ,EAAE,MAAM,CAAC,QAAiB;AACjF,0BAAoB,OAAO,QAAQ;AACnC,YAAM;AAAA,IACR,CAAC;AACD,wBAAoB,IAAI,UAAU,OAAO;AAAA,EAC3C;AACA,QAAM;AACN,QAAM,UAAU,iBAAiB,IAAI,QAAQ;AAC7C,MAAI,CAAC,WAAW,QAAQ,SAAS,EAAG;AAEpC,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,gBAAgB;AAQ7D,aAAW,QAAQ,SAAS;AAC1B,QAAI,SAAS,OAAO,IAAI,EAAG;AAC3B,YAAQ,OAAO,IAAI;AACnB,UAAM,oBAAoB,SAAS,OAAO,IAAI;AAAA,EAChD;AACA,MAAI,QAAQ,SAAS,EAAG;AAMxB,QAAM,aAAuB,CAAC;AAC9B,aAAW,MAAM,SAAS,IAAI,GAAG;AAC/B,QAAI,GAAG,qBAAqB,iBAAkB;AAC9C,QAAI,CAAC,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAG;AAChC,eAAW,KAAK,GAAG,KAAK,IAAI;AAAA,EAC9B;AACA,MAAI,WAAW,WAAW,EAAG;AAE7B,MAAI,WAAyC;AAC7C,aAAW,QAAQ,YAAY;AAC7B,UAAM,MAAM,SAAS,OAAO,IAAI;AAChC,QAAI,CAAC,KAAK;AAKR,cAAQ,OAAO,IAAI;AACnB,YAAM,oBAAoB,SAAS,OAAO,IAAI;AAC9C;AAAA,IACF;AACA,QAAI,aAAa,MAAM;AACrB,OAAC,EAAE,0BAA0B,SAAS,IAAK,MAAM,OAAO,wBAAe;AAAA,IAGzE;AAQA,eAAW,OAAO,IAAI,cAAc;AAElC,YAAO,SAAS,cAAc,GAAG,EAAU,eAAe;AAAA,IAC5D;AACA,UAAM,SAAS,QAAQ,KAAK;AAAA,MAC1B,eAAe,CAAC,MAAM,SAAS,cAAc,CAAC;AAAA,MAC9C,oBAAoB,MAAM,SAAS,mBAAmB;AAAA,MACtD,iBAAiB,MAAM,SAAS,gBAAgB;AAAA,MAChD,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACrD,CAAC;AACD,YAAQ,OAAO,IAAI;AAKnB,UAAM,oBAAoB,SAAS,OAAO,IAAI;AAAA,EAChD;AACF;AAWO,SAAS,aAAa,UAAoC,QAAsB;AACrF,mBAAiB,IAAI,QAAQ,GAAG,OAAO,MAAM;AAC/C;AASA,eAAsB,kBACpB,SACA,OACA,UACA,QACe;AACf,eAAa,UAAU,MAAM;AAC7B,QAAM,oBAAoB,SAAS,OAAO,MAAM;AAClD;","names":[]}

package/dist/{chunk-DJ7MRXNA.js → chunk-HTJQYHZP.js}

@@ -1,7 +1,7 @@
 import {
   DerivationCycleError,
   MaterializedViewCycleError
-} from "./chunk-FZCGIJEJ.js";
+} from "./chunk-BIOUI4HL.js";
 
 // src/kernel/via/graph.ts
 var DEFAULT_POSTURE = { encryptedAtRest: "envelope", queryable: "full", exportable: true, forgettable: false };
@@ -341,4 +341,4 @@ export {
   DEFAULT_POSTURE,
   ViaGraph
 };
-//# sourceMappingURL=chunk-DJ7MRXNA.js.map
+//# sourceMappingURL=chunk-HTJQYHZP.js.map

package/dist/{chunk-NRYNRSGV.js → chunk-I6GALP6E.js}

@@ -4,19 +4,19 @@ import {
   grant,
   revoke,
   rotateKeys
-} from "./chunk-CCIR2OJH.js";
+} from "./chunk-J2ZX2XUV.js";
 import {
   openEnvelopeJson
-} from "./chunk-HA6ZQWA2.js";
+} from "./chunk-XDYREZWE.js";
 import {
   encrypt
-} from "./chunk-37WOJQWY.js";
+} from "./chunk-CIE2BASH.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-JC75UBMT.js";
+} from "./chunk-JNAI2HN2.js";
 import {
   PermissionDeniedError
-} from "./chunk-FZCGIJEJ.js";
+} from "./chunk-BIOUI4HL.js";
 
 // src/with-party/team/active.ts
 function withTeam() {
@@ -96,4 +96,4 @@ export {
   listCredentials,
   credentialStatus
 };
-//# sourceMappingURL=chunk-NRYNRSGV.js.map
+//# sourceMappingURL=chunk-I6GALP6E.js.map

package/dist/{chunk-GL3JV5EV.js → chunk-IL6POWCW.js}

@@ -1,19 +1,19 @@
 import {
   linkCollectionName,
   linkRowKey
-} from "./chunk-TVS6BUUR.js";
+} from "./chunk-JZUV47FZ.js";
 import {
   openEnvelopeJson
-} from "./chunk-HA6ZQWA2.js";
+} from "./chunk-XDYREZWE.js";
 import {
   encrypt
-} from "./chunk-37WOJQWY.js";
+} from "./chunk-CIE2BASH.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-JC75UBMT.js";
+} from "./chunk-JNAI2HN2.js";
 import {
   NoydbError
-} from "./chunk-FZCGIJEJ.js";
+} from "./chunk-BIOUI4HL.js";
 
 // src/with-shape/links/link-set.ts
 var LinkSet = class {
@@ -127,4 +127,4 @@ export {
   LinkSet,
   LinkEndpointError
 };
-//# sourceMappingURL=chunk-GL3JV5EV.js.map
+//# sourceMappingURL=chunk-IL6POWCW.js.map

package/dist/{chunk-NEYKOESM.js → chunk-IU6SNYX6.js}

@@ -1,16 +1,16 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-QF5LGMSV.js";
+} from "./chunk-F64IRYG3.js";
 import {
   sha256Hex
-} from "./chunk-37WOJQWY.js";
+} from "./chunk-CIE2BASH.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-JC75UBMT.js";
+} from "./chunk-JNAI2HN2.js";
 import {
   ReadOnlyError
-} from "./chunk-FZCGIJEJ.js";
+} from "./chunk-BIOUI4HL.js";
 
 // src/with-audit/portability/withdraw-accessible.ts
 var FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
@@ -114,4 +114,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-NEYKOESM.js.map
+//# sourceMappingURL=chunk-IU6SNYX6.js.map

package/dist/{chunk-CCIR2OJH.js → chunk-J2ZX2XUV.js}

@@ -5,7 +5,7 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-JGUZMC3I.js";
+} from "./chunk-4JBYV75E.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -16,11 +16,11 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-37WOJQWY.js";
+} from "./chunk-CIE2BASH.js";
 import {
   NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION
-} from "./chunk-JC75UBMT.js";
+} from "./chunk-JNAI2HN2.js";
 import {
   DirectoryDisabledError,
   InvalidKeyError,
@@ -32,7 +32,7 @@ import {
   PrivilegeEscalationError,
   USER_ENVELOPE_COLLECTION,
   ValidationError
-} from "./chunk-FZCGIJEJ.js";
+} from "./chunk-BIOUI4HL.js";
 
 // src/kernel/validation.ts
 var WeakPassphraseError = class extends NoydbError {
@@ -775,4 +775,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-CCIR2OJH.js.map
+//# sourceMappingURL=chunk-J2ZX2XUV.js.map

package/dist/{chunk-F3LGBRSV.js → chunk-JIF24JPM.js}

@@ -1,17 +1,18 @@
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-HK4XTXO4.js";
+} from "./chunk-VZRODIM3.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
   BLOB_INDEX_COLLECTION,
+  BLOB_INTENT_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-CZMCOFEA.js";
+} from "./chunk-SNZ6URZZ.js";
 import {
   assembleBundleContainer,
   buildExtractedPartitionWrapper
-} from "./chunk-PH7G7ZI7.js";
+} from "./chunk-FHS2HQSH.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
@@ -22,10 +23,11 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-EIZ4YOG2.js";
+} from "./chunk-Q5VNKNE5.js";
 import {
-  openEnvelopeJson
-} from "./chunk-HA6ZQWA2.js";
+  openEnvelopeJson,
+  writeEnvelopeBody
+} from "./chunk-XDYREZWE.js";
 import {
   bufferToBase64,
   decrypt,
@@ -35,14 +37,14 @@ import {
   generateDEK,
   unwrapCek,
   wrapCek
-} from "./chunk-37WOJQWY.js";
+} from "./chunk-CIE2BASH.js";
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION
-} from "./chunk-JC75UBMT.js";
+} from "./chunk-JNAI2HN2.js";
 import {
   PartitionExtractionError
-} from "./chunk-FZCGIJEJ.js";
+} from "./chunk-BIOUI4HL.js";
 
 // src/with-cargo/walk-closure.ts
 async function walkClosure(vault, opts) {
@@ -75,7 +77,7 @@ async function walkClosure(vault, opts) {
       }
     }
   }
-  const { refRegistry } = vault._introspectState();
+  const { refRegistry, adapter, name: vaultName } = vault._introspectState();
   const maxDepth = opts.maxDepth ?? 16;
   let cyclesDetected = false;
   let inboundDepth = 0;
@@ -110,6 +112,7 @@ async function walkClosure(vault, opts) {
   }
   let outboundFrontier = [];
   for (const [c, ids] of closure) for (const id of ids) outboundFrontier.push([c, id]);
+  const danglingRefs = [];
   while (outboundFrontier.length > 0) {
     const next = [];
     for (const [collectionName, id] of outboundFrontier) {
@@ -122,6 +125,21 @@ async function walkClosure(vault, opts) {
         const rawId = record[field];
         if (typeof rawId !== "string" && typeof rawId !== "number") continue;
         const parentId = String(rawId);
+        const parentColl = vault.collection(descriptor.target);
+        const parentRecord = await parentColl.get(parentId);
+        if (!parentRecord) {
+          const rawParentEnv = await adapter.get(vaultName, descriptor.target, parentId);
+          const reason = rawParentEnv && (rawParentEnv._tier ?? 0) > 0 ? "elevated" : "missing";
+          danglingRefs.push({
+            collection: collectionName,
+            id,
+            field,
+            target: descriptor.target,
+            targetId: parentId,
+            reason
+          });
+          continue;
+        }
         if (add(descriptor.target, parentId)) {
           next.push([descriptor.target, parentId]);
         }
@@ -135,7 +153,7 @@ async function walkClosure(vault, opts) {
     outboundFrontier = next;
   }
   const depth = Math.max(inboundDepth, outboundDepth);
-  return { closure, graph: { depth, cyclesDetected } };
+  return { closure, graph: { depth, cyclesDetected }, danglingRefs };
 }
 
 // src/with-cargo/extract-partition.ts
@@ -161,6 +179,11 @@ async function reKeyClosure(vault, closure, fieldProjection) {
     for (const id of ids) {
       const env = await adapter.get(vaultName, collectionName, id);
       if (!env) continue;
+      if ((env._tier ?? 0) > 0) {
+        throw new PartitionExtractionError(
+          `#748: reKeyClosure fetched an elevated envelope (collection="${collectionName}" id="${id}" _tier=${env._tier}) \u2014 this is unreachable by construction (walkClosure only ever adds ids reachable through tier-gated Collection reads). Refusing to carry it into a partition.`
+        );
+      }
       if (env._cek !== void 0) {
         const cek = await unwrapCek(env._cek, srcDek);
         const plaintext2 = await decrypt(env._iv, env._data, cek);
@@ -279,13 +302,27 @@ async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
     const proj = projList ? new Set(projList) : void 0;
     const slotsCollection = `${BLOB_SLOTS_PREFIX}${collectionName}`;
     for (const id of ids) {
+      const intentId = `${collectionName}::${id}`;
+      const intentEnv = await adapter.get(vaultName, BLOB_INTENT_COLLECTION, intentId);
+      if (intentEnv) {
+        const intentPlain = await openEnvelopeJson(intentEnv, srcDek);
+        const intentBody = await writeEnvelopeBody(intentPlain, destDek);
+        place(BLOB_INTENT_COLLECTION, intentId, { ...intentEnv, ...intentBody });
+      }
       const env = await adapter.get(vaultName, slotsCollection, id);
       if (!env) continue;
+      if ((env._tier ?? 0) > 0) {
+        throw new PartitionExtractionError(
+          `#748: reKeyBlobs fetched an elevated slot-map envelope (collection="${slotsCollection}" id="${id}" _tier=${env._tier}) \u2014 this is unreachable by construction. Refusing to carry it into a partition.`
+        );
+      }
       const slots = JSON.parse(await openEnvelopeJson(env, srcDek));
       const kept = {};
       for (const [slotName, slot] of Object.entries(slots)) {
         if (proj && !proj.has(slotName)) continue;
-        kept[slotName] = slot;
+        const { pendingRelease, ...strippedSlot } = slot;
+        void pendingRelease;
+        kept[slotName] = strippedSlot;
         addRef(slot.eTag);
       }
       if (Object.keys(kept).length === 0) continue;
@@ -300,6 +337,11 @@ async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
       if (proj && slotName !== void 0 && !proj.has(slotName)) continue;
       const env = await adapter.get(vaultName, versionsCollection, key);
       if (!env) continue;
+      if ((env._tier ?? 0) > 0) {
+        throw new PartitionExtractionError(
+          `#748: reKeyBlobs fetched an elevated version-record envelope (collection="${versionsCollection}" key="${key}" _tier=${env._tier}) \u2014 this is unreachable by construction. Refusing to carry it into a partition.`
+        );
+      }
       const record = JSON.parse(await openEnvelopeJson(env, srcDek));
       addRef(record.eTag);
       const { iv, data } = await encrypt(JSON.stringify(record), destDek);
@@ -382,7 +424,7 @@ async function extractPartitionCore(vault, opts) {
     );
   }
   if (opts.carrySchemas) await vault._drainPendingSchemaWrites();
-  const { closure } = await walkClosure(vault, opts);
+  const { closure, danglingRefs } = await walkClosure(vault, opts);
   const { collections, deks } = await reKeyClosure(vault, closure, opts.fieldProjection);
   let ledgerHead;
   let ledgerEntries;
@@ -437,7 +479,7 @@ async function extractPartitionCore(vault, opts) {
       // indicator only
     }
   });
-  return { bundleBytes, transferKey, sealId: seal.sealId };
+  return { bundleBytes, transferKey, sealId: seal.sealId, danglingRefs };
 }
 
 export {
@@ -450,4 +492,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-F3LGBRSV.js.map
+//# sourceMappingURL=chunk-JIF24JPM.js.map