@noy-db/hub 0.3.0-pre.7 → 0.3.0-pre.9

package/dist/chunk-7ZANJ6JZ.js

@@ -0,0 +1,265 @@
+import {
+  DerivationCycleError,
+  MaterializedViewCycleError
+} from "./chunk-CU62BBRB.js";
+
+// src/kernel/via-graph.ts
+var DEFAULT_POSTURE = { encryptedAtRest: "envelope", queryable: "full", exportable: true, forgettable: false };
+var QUERYABLE_RANK = {
+  none: 0,
+  "det-exact": 1,
+  ordered: 2,
+  full: 3
+};
+function foldPosture(a, b) {
+  return {
+    encryptedAtRest: a.encryptedAtRest === "sealed" || b.encryptedAtRest === "sealed" ? "sealed" : "envelope",
+    queryable: QUERYABLE_RANK[a.queryable] <= QUERYABLE_RANK[b.queryable] ? a.queryable : b.queryable,
+    exportable: a.exportable && b.exportable,
+    forgettable: a.forgettable || b.forgettable
+  };
+}
+function isDefaultPosture(p) {
+  return p.encryptedAtRest === DEFAULT_POSTURE.encryptedAtRest && p.queryable === DEFAULT_POSTURE.queryable && p.exportable === DEFAULT_POSTURE.exportable && p.forgettable === DEFAULT_POSTURE.forgettable;
+}
+var SEP = "\0";
+var EMPTY_SET = /* @__PURE__ */ new Set();
+function nodeId(ref) {
+  return `${ref.collection}${SEP}${ref.field}`;
+}
+function displayNodeId(id) {
+  const sep = id.indexOf(SEP);
+  return `${id.slice(0, sep)}.${id.slice(sep + 1)}`;
+}
+var ViaGraph = class {
+  /** Declared source-field postures (registerField), keyed by node id. */
+  _posture = /* @__PURE__ */ new Map();
+  /** Every derived target's registration, keyed by the target's node id. */
+  _in = /* @__PURE__ */ new Map();
+  /** source node id -> derived targets that depend on it (dispatch/erasure). */
+  _out = /* @__PURE__ */ new Map();
+  /** Memoized effective posture per derived target node id. */
+  _effectiveCache = /* @__PURE__ */ new Map();
+  /** Collections with at least one classified field (#638 Task 2 fix wave 2,
+   *  Finding I1 — the reconcile path's combined-state leak guard memory). */
+  _classifiedCollections = /* @__PURE__ */ new Set();
+  /** Computed field names declared with no `deps` entry, per collection
+   *  (Finding I1 — such a field registers no edge when no classified field is
+   *  present yet, so a LATER, separate reconcile call attaching classifiedFields
+   *  still needs to see it regardless of declaration order). */
+  _depslessComputed = /* @__PURE__ */ new Map();
+  /** Declare a source field's posture (money/i18n/classified/plain). Plain fields
+   *  default to `DEFAULT_POSTURE`; a later declaration for the same node wins-first (idempotent). */
+  registerField(collection, field, posture) {
+    const id = nodeId({ collection, field });
+    if (this._posture.has(id)) return;
+    this._posture.set(id, posture);
+    this._effectiveCache.clear();
+  }
+  /** A derived target depends on `sources` (may be cross-collection). `kind`/`grain`
+   *  drive dispatch + erasure semantics; sources drive taint. Re-registering the same
+   *  target replaces `_in` but does not prune stale `_out` edges — callers must
+   *  register each target at most once per graph lifetime. `onDelete`/`keyField` (#650 Task 5)
+   *  are meaningful only for `kind === 'ref'` edges — {@link referencingEdgesOf} reads them back. */
+  registerDerived(target, sources, kind, grain, onDelete, keyField) {
+    const id = nodeId(target);
+    this._in.set(id, {
+      target,
+      sources,
+      kind,
+      grain,
+      ...onDelete !== void 0 ? { onDelete } : {},
+      ...keyField !== void 0 ? { keyField } : {}
+    });
+    for (const source of sources) {
+      const sourceId = nodeId(source);
+      const dependents = this._out.get(sourceId);
+      if (dependents) dependents.push(target);
+      else this._out.set(sourceId, [target]);
+    }
+    this._effectiveCache.clear();
+  }
+  /** Whether `target` already has a registered in-edge — lets a caller skip
+   *  re-registering the same target (#638 Task 2 fix wave 2, Finding I2i:
+   *  `registerDerived`'s at-most-once contract must hold across repeated
+   *  identical `vault.collection()` calls, not just within a single one). */
+  hasDerived(target) {
+    return this._in.has(nodeId(target));
+  }
+  /** Mark/query a collection as having declared at least one classified field. */
+  markClassified(collection) {
+    this._classifiedCollections.add(collection);
+  }
+  isClassified(collection) {
+    return this._classifiedCollections.has(collection);
+  }
+  /** Mark/query a collection's depsless (no declared `deps`) computed
+   *  field names — see `_depslessComputed`'s doc comment above. */
+  markDepslessComputed(collection, field) {
+    let set = this._depslessComputed.get(collection);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      this._depslessComputed.set(collection, set);
+    }
+    set.add(field);
+  }
+  depslessComputedFields(collection) {
+    return this._depslessComputed.get(collection) ?? EMPTY_SET;
+  }
+  /** Reject cycles at declare time (vault open). Throws `DerivationCycleError` for a
+   *  derivation/rollup/computed cycle, `MaterializedViewCycleError` for an MV cycle —
+   *  same classes + message shape the registries throw today (behavior lock). */
+  assertAcyclic() {
+    const visited = /* @__PURE__ */ new Set();
+    const stack = [];
+    const visit = (id) => {
+      const idx = stack.indexOf(id);
+      if (idx !== -1) {
+        const cycle = stack.slice(idx).concat(id);
+        const isMv = cycle.some((cycleId) => this._in.get(cycleId)?.kind === "mv");
+        const path = cycle.map(displayNodeId);
+        if (isMv) throw new MaterializedViewCycleError(path);
+        throw new DerivationCycleError(path);
+      }
+      if (visited.has(id)) return;
+      stack.push(id);
+      const dependents = this._out.get(id);
+      if (dependents) {
+        for (const dependent of dependents) visit(nodeId(dependent));
+      }
+      stack.pop();
+      visited.add(id);
+    };
+    for (const id of this._out.keys()) visit(id);
+  }
+  /** A leaf (non-derived) node's own posture contribution: its declared posture,
+   *  or `DEFAULT_POSTURE` if never declared via `registerField`. */
+  _declaredPosture(id) {
+    return this._posture.get(id) ?? DEFAULT_POSTURE;
+  }
+  /** A node's posture contribution when folded into a dependent: recurse if it is
+   *  itself derived, else its declared/default posture. */
+  _contribution(id) {
+    const edge = this._in.get(id);
+    return edge ? this._computeEffective(id, edge) : this._declaredPosture(id);
+  }
+  _computeEffective(id, edge) {
+    const cached = this._effectiveCache.get(id);
+    if (cached) return cached;
+    let result = DEFAULT_POSTURE;
+    for (const source of edge.sources) {
+      result = foldPosture(result, this._contribution(nodeId(source)));
+    }
+    if (edge.grain === "virtual" && result.queryable !== "none") {
+      result = { ...result, queryable: "none" };
+    }
+    this._effectiveCache.set(id, result);
+    return result;
+  }
+  /** Strictest source posture on every axis, per §2. `undefined` when `target` has no
+   *  in-edges (not a derived field). Transitive: folds through chained derivations. */
+  effectivePosture(target) {
+    const id = nodeId(target);
+    const edge = this._in.get(id);
+    if (!edge) return void 0;
+    return this._computeEffective(id, edge);
+  }
+  /** Per-collection { field → effectivePosture } overlay the pipeline consumes (Task 3). */
+  taintedPostures(collection) {
+    const out = /* @__PURE__ */ new Map();
+    for (const edge of this._in.values()) {
+      if (edge.target.collection !== collection) continue;
+      out.set(edge.target.field, this._computeEffective(nodeId(edge.target), edge));
+    }
+    return out;
+  }
+  /** Materialized (`grain !== 'virtual'`) derived fields on `collection` whose effective
+   *  encryptedAtRest resolves to 'sealed' — the taint-seal set (Task 3). #638 Task 7
+   *  makes the `grain !== 'virtual'` filter meaningful: a `computed(fn, { mode: 'virtual' })`
+   *  field is never stored (rides the `present` phase, seam map Part 4's money-Formatted/
+   *  i18n-Label precedent), so it is EXCLUDED here even when its effective `encryptedAtRest`
+   *  folds to `'sealed'` — there is no envelope slot to seal. It still surfaces in
+   *  {@link taintedPostures} (query refusal via `postureFor`'s `queryable` clamp above, and
+   *  export refusal via `exportable`) — only the AT-REST SEALING ACTION is skipped. */
+  taintSealedFields(collection) {
+    const out = /* @__PURE__ */ new Set();
+    for (const edge of this._in.values()) {
+      if (edge.target.collection !== collection || edge.grain === "virtual") continue;
+      const posture = this._computeEffective(nodeId(edge.target), edge);
+      if (posture.encryptedAtRest === "sealed") out.add(edge.target.field);
+    }
+    return out;
+  }
+  /** Fields on `collection` whose registered edge is `grain === 'virtual'` (#638 Task 7) —
+   *  `via-graph-wiring.ts#applyTaintOverlay` intersects this with `exportable === false`
+   *  postures to know which virtual fields need PRESENT-TIME (not just export-time)
+   *  redaction, since a virtual field's value is only ever materialized inside `present()`. */
+  virtualFields(collection) {
+    const out = /* @__PURE__ */ new Set();
+    for (const edge of this._in.values()) {
+      if (edge.target.collection === collection && edge.grain === "virtual") out.add(edge.target.field);
+    }
+    return out;
+  }
+  /** Per-collection { field → immediate source field names that forced its
+   *  effective posture away from `DEFAULT_POSTURE` } — `describe()`'s
+   *  provenance (Task 3). Only the DIRECT declared sources are named (not the
+   *  ultimate origin several hops up a transitive chain); a source absent
+   *  from the result contributed nothing restrictive. */
+  taintProvenance(collection) {
+    const out = /* @__PURE__ */ new Map();
+    for (const edge of this._in.values()) {
+      if (edge.target.collection !== collection) continue;
+      const forcedBy = edge.sources.filter((source) => !isDefaultPosture(this._contribution(nodeId(source)))).map((source) => source.field);
+      if (forcedBy.length > 0) out.set(edge.target.field, forcedBy);
+    }
+    return out;
+  }
+  _targetsDependingOn(collection) {
+    const out = [];
+    for (const edge of this._in.values()) {
+      if (edge.sources.some((source) => source.collection === collection)) {
+        out.push({ target: edge.target, kind: edge.kind, grain: edge.grain });
+      }
+    }
+    return out;
+  }
+  /** Dispatch (Task 4): every derived target triggered by a write to `collection`. Excludes
+   *  `'ref'` edges (#650 Task 5 review, folded Minor) — a `'ref'` edge is consulted only by the
+   *  delete/forget-time restrict/cascade/nullify path ({@link referencingEdgesOf}), never by the
+   *  sync/cutover/restore dispatch wave (`runGraphDispatchWave`); counting it here defeated that
+   *  wave's zero-cost early-continue, costing every write to a referenced backing collection an
+   *  unconditional decrypt + two no-op dispatch passes. {@link derivedArtifactsOf} (erasure
+   *  fanout) still includes `'ref'` edges — the forget path genuinely needs them. */
+  dependentsOf(collection) {
+    return this._targetsDependingOn(collection).filter((edge) => edge.kind !== "ref");
+  }
+  /** Erasure (Task 6): derived artifacts of a forgotten record whose source is `collection`. */
+  derivedArtifactsOf(collection) {
+    return this._targetsDependingOn(collection);
+  }
+  /** Referencing edges pointing AT a backing dimension (delete/forget-time restrict/cascade/
+   *  nullify, #650 Task 5) — an O(1) reverse lookup via the existing `_out` map (keyed at the
+   *  dimension's wildcard `field:'*'` node, the same convention every whole-collection source
+   *  already uses), NEVER a scan across collections or records. `backing` is the collection name
+   *  a lookup field's edge was registered against (a reserved dimension's `_dict_<name>`/
+   *  `_lookup_<name>` collection name, or a matrix dimension's own collection name). */
+  referencingEdgesOf(backing) {
+    const targets = this._out.get(nodeId({ collection: backing, field: "*" }));
+    if (!targets) return [];
+    const out = [];
+    for (const target of targets) {
+      const edge = this._in.get(nodeId(target));
+      if (edge?.kind === "ref" && edge.onDelete !== void 0) {
+        out.push({ referencing: target, onDelete: edge.onDelete, keyField: edge.keyField ?? "id" });
+      }
+    }
+    return out;
+  }
+};
+
+export {
+  DEFAULT_POSTURE,
+  ViaGraph
+};
+//# sourceMappingURL=chunk-7ZANJ6JZ.js.map

package/dist/chunk-7ZANJ6JZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/via-graph.ts"],"sourcesContent":["// kernel/via-graph.ts — the per-vault ViaGraph dependency model (Via port phase C, #638).\n//\n// Metadata-only dependency graph over (collection, field) nodes: source-field\n// postures, derived-field edges, and the taint (effective-posture) algebra.\n// NEVER stores record values or key material — see\n// docs/superpowers/specs/2026-07-11-via-phase-c-design.md §1/§2.\n\nimport { DerivationCycleError, MaterializedViewCycleError } from './errors.js'\nimport type { ViaPosture } from './via.js'\n\n/** A (collection, field) node. Artifact-grain targets (rollup field, MV row-class,\n *  overlay output) are modelled as a field node whose `field` is the artifact key. */\nexport interface FieldRef { readonly collection: string; readonly field: string }\n\nexport type EdgeKind = 'computed' | 'derivation' | 'rollup' | 'mv' | 'overlay' | 'ref'\n/** `'virtual'` (#638 Task 7) marks a `computed(fn, { mode: 'virtual' })` field's edge —\n *  never stored (rides the `present` phase), so it can never be sealed at rest\n *  ({@link ViaGraph.taintSealedFields} excludes it) and is always non-queryable\n *  regardless of source posture ({@link ViaGraph.effectivePosture} clamps it). */\nexport type Grain = 'record' | 'aggregate' | 'virtual'\n\n/** Delete/forget-time referential policy for a `'ref'` edge (#650 Task 5, spec §4) — duplicated\n *  (not imported) from `shape/via-lookup/descriptor.ts`'s `OnDelete`: the kernel spine may not\n *  statically import `shape/**` (Check 14, `via-layering`). Keep the two in sync by hand. */\nexport type OnDelete = 'restrict' | 'cascade' | 'nullify'\n\n/** Plain (non-via) field baseline — max-permissive; taint only ever tightens. */\nexport const DEFAULT_POSTURE: ViaPosture =\n  { encryptedAtRest: 'envelope', queryable: 'full', exportable: true, forgettable: false }\n\nconst QUERYABLE_RANK: Record<ViaPosture['queryable'], number> = {\n  none: 0,\n  'det-exact': 1,\n  ordered: 2,\n  full: 3,\n}\n\n/** The per-axis \"most restrictive\" fold — pure, exported for direct unit testing. */\nexport function foldPosture(a: ViaPosture, b: ViaPosture): ViaPosture {\n  return {\n    encryptedAtRest: a.encryptedAtRest === 'sealed' || b.encryptedAtRest === 'sealed' ? 'sealed' : 'envelope',\n    queryable: QUERYABLE_RANK[a.queryable] <= QUERYABLE_RANK[b.queryable] ? a.queryable : b.queryable,\n    exportable: a.exportable && b.exportable,\n    forgettable: a.forgettable || b.forgettable,\n  }\n}\n\n/** Whether `p` is exactly the plain, non-taint baseline (Task 3 — `taintProvenance`). */\nfunction isDefaultPosture(p: ViaPosture): boolean {\n  return p.encryptedAtRest === DEFAULT_POSTURE.encryptedAtRest && p.queryable === DEFAULT_POSTURE.queryable &&\n    p.exportable === DEFAULT_POSTURE.exportable && p.forgettable === DEFAULT_POSTURE.forgettable\n}\n\n/** One registered `registerDerived` call — a target's whole in-edge set. */\ninterface DerivedEdge {\n  readonly target: FieldRef\n  readonly sources: readonly FieldRef[]\n  readonly kind: EdgeKind\n  readonly grain: Grain\n  /** `'ref'` edges only — the referencing field's delete/forget policy (#650 Task 5). */\n  readonly onDelete?: OnDelete\n  /** `'ref'` edges only — the backing dimension's canonical-key FIELD NAME on its own row (matrix\n   *  tier's `lookup(dim, {key})`; always `'id'` for reserved/static tiers). Defaults to `'id'`\n   *  when absent — a referencing field always stores this field's VALUE, never the backing row's\n   *  PUT-id when the two differ (#650 Task 5, mirrors Task 3's membership review fix). */\n  readonly keyField?: string\n}\n\nconst SEP = '\\0'\nconst EMPTY_SET: ReadonlySet<string> = new Set()\n\nfunction nodeId(ref: FieldRef): string {\n  return `${ref.collection}${SEP}${ref.field}`\n}\n\n/** Inverse of `nodeId`, for building a human-readable cycle path. */\nfunction displayNodeId(id: string): string {\n  const sep = id.indexOf(SEP)\n  return `${id.slice(0, sep)}.${id.slice(sep + 1)}`\n}\n\n/** Metadata-only dependency graph, ONE per vault. Never stores values or key material. */\nexport class ViaGraph {\n  /** Declared source-field postures (registerField), keyed by node id. */\n  private readonly _posture = new Map<string, ViaPosture>()\n  /** Every derived target's registration, keyed by the target's node id. */\n  private readonly _in = new Map<string, DerivedEdge>()\n  /** source node id -> derived targets that depend on it (dispatch/erasure). */\n  private readonly _out = new Map<string, FieldRef[]>()\n  /** Memoized effective posture per derived target node id. */\n  private readonly _effectiveCache = new Map<string, ViaPosture>()\n  /** Collections with at least one classified field (#638 Task 2 fix wave 2,\n   *  Finding I1 — the reconcile path's combined-state leak guard memory). */\n  private readonly _classifiedCollections = new Set<string>()\n  /** Computed field names declared with no `deps` entry, per collection\n   *  (Finding I1 — such a field registers no edge when no classified field is\n   *  present yet, so a LATER, separate reconcile call attaching classifiedFields\n   *  still needs to see it regardless of declaration order). */\n  private readonly _depslessComputed = new Map<string, Set<string>>()\n\n  /** Declare a source field's posture (money/i18n/classified/plain). Plain fields\n   *  default to `DEFAULT_POSTURE`; a later declaration for the same node wins-first (idempotent). */\n  registerField(collection: string, field: string, posture: ViaPosture): void {\n    const id = nodeId({ collection, field })\n    if (this._posture.has(id)) return\n    this._posture.set(id, posture)\n    this._effectiveCache.clear()\n  }\n\n  /** A derived target depends on `sources` (may be cross-collection). `kind`/`grain`\n   *  drive dispatch + erasure semantics; sources drive taint. Re-registering the same\n   *  target replaces `_in` but does not prune stale `_out` edges — callers must\n   *  register each target at most once per graph lifetime. `onDelete`/`keyField` (#650 Task 5)\n   *  are meaningful only for `kind === 'ref'` edges — {@link referencingEdgesOf} reads them back. */\n  registerDerived(target: FieldRef, sources: readonly FieldRef[], kind: EdgeKind, grain: Grain, onDelete?: OnDelete, keyField?: string): void {\n    const id = nodeId(target)\n    this._in.set(id, {\n      target, sources, kind, grain,\n      ...(onDelete !== undefined ? { onDelete } : {}),\n      ...(keyField !== undefined ? { keyField } : {}),\n    })\n    for (const source of sources) {\n      const sourceId = nodeId(source)\n      const dependents = this._out.get(sourceId)\n      if (dependents) dependents.push(target)\n      else this._out.set(sourceId, [target])\n    }\n    this._effectiveCache.clear()\n  }\n\n  /** Whether `target` already has a registered in-edge — lets a caller skip\n   *  re-registering the same target (#638 Task 2 fix wave 2, Finding I2i:\n   *  `registerDerived`'s at-most-once contract must hold across repeated\n   *  identical `vault.collection()` calls, not just within a single one). */\n  hasDerived(target: FieldRef): boolean {\n    return this._in.has(nodeId(target))\n  }\n\n  /** Mark/query a collection as having declared at least one classified field. */\n  markClassified(collection: string): void {\n    this._classifiedCollections.add(collection)\n  }\n\n  isClassified(collection: string): boolean {\n    return this._classifiedCollections.has(collection)\n  }\n\n  /** Mark/query a collection's depsless (no declared `deps`) computed\n   *  field names — see `_depslessComputed`'s doc comment above. */\n  markDepslessComputed(collection: string, field: string): void {\n    let set = this._depslessComputed.get(collection)\n    if (!set) { set = new Set(); this._depslessComputed.set(collection, set) }\n    set.add(field)\n  }\n\n  depslessComputedFields(collection: string): ReadonlySet<string> {\n    return this._depslessComputed.get(collection) ?? EMPTY_SET\n  }\n\n  /** Reject cycles at declare time (vault open). Throws `DerivationCycleError` for a\n   *  derivation/rollup/computed cycle, `MaterializedViewCycleError` for an MV cycle —\n   *  same classes + message shape the registries throw today (behavior lock). */\n  assertAcyclic(): void {\n    const visited = new Set<string>()\n    const stack: string[] = []\n\n    const visit = (id: string): void => {\n      const idx = stack.indexOf(id)\n      if (idx !== -1) {\n        const cycle = stack.slice(idx).concat(id)\n        const isMv = cycle.some(cycleId => this._in.get(cycleId)?.kind === 'mv')\n        const path = cycle.map(displayNodeId)\n        if (isMv) throw new MaterializedViewCycleError(path)\n        throw new DerivationCycleError(path)\n      }\n      if (visited.has(id)) return\n      stack.push(id)\n      const dependents = this._out.get(id)\n      if (dependents) {\n        for (const dependent of dependents) visit(nodeId(dependent))\n      }\n      stack.pop()\n      visited.add(id)\n    }\n\n    for (const id of this._out.keys()) visit(id)\n  }\n\n  /** A leaf (non-derived) node's own posture contribution: its declared posture,\n   *  or `DEFAULT_POSTURE` if never declared via `registerField`. */\n  private _declaredPosture(id: string): ViaPosture {\n    return this._posture.get(id) ?? DEFAULT_POSTURE\n  }\n\n  /** A node's posture contribution when folded into a dependent: recurse if it is\n   *  itself derived, else its declared/default posture. */\n  private _contribution(id: string): ViaPosture {\n    const edge = this._in.get(id)\n    return edge ? this._computeEffective(id, edge) : this._declaredPosture(id)\n  }\n\n  private _computeEffective(id: string, edge: DerivedEdge): ViaPosture {\n    const cached = this._effectiveCache.get(id)\n    if (cached) return cached\n    let result = DEFAULT_POSTURE\n    for (const source of edge.sources) {\n      result = foldPosture(result, this._contribution(nodeId(source)))\n    }\n    // #638 Task 7 — a virtual field is computed fresh on every read and never\n    // stored, so it is structurally unqueryable regardless of what its\n    // sources' fold would otherwise permit (e.g. a money-sourced virtual\n    // field must NOT inherit money's 'ordered' queryability — there is no\n    // stored/indexed form to query against). Every OTHER axis (exportable/\n    // forgettable/encryptedAtRest) still folds normally — the taint rule is\n    // identical to a materialized field; only queryability is a fixed,\n    // grain-level property, not a source-derived one.\n    if (edge.grain === 'virtual' && result.queryable !== 'none') {\n      result = { ...result, queryable: 'none' }\n    }\n    this._effectiveCache.set(id, result)\n    return result\n  }\n\n  /** Strictest source posture on every axis, per §2. `undefined` when `target` has no\n   *  in-edges (not a derived field). Transitive: folds through chained derivations. */\n  effectivePosture(target: FieldRef): ViaPosture | undefined {\n    const id = nodeId(target)\n    const edge = this._in.get(id)\n    if (!edge) return undefined\n    return this._computeEffective(id, edge)\n  }\n\n  /** Per-collection { field → effectivePosture } overlay the pipeline consumes (Task 3). */\n  taintedPostures(collection: string): ReadonlyMap<string, ViaPosture> {\n    const out = new Map<string, ViaPosture>()\n    for (const edge of this._in.values()) {\n      if (edge.target.collection !== collection) continue\n      out.set(edge.target.field, this._computeEffective(nodeId(edge.target), edge))\n    }\n    return out\n  }\n\n  /** Materialized (`grain !== 'virtual'`) derived fields on `collection` whose effective\n   *  encryptedAtRest resolves to 'sealed' — the taint-seal set (Task 3). #638 Task 7\n   *  makes the `grain !== 'virtual'` filter meaningful: a `computed(fn, { mode: 'virtual' })`\n   *  field is never stored (rides the `present` phase, seam map Part 4's money-Formatted/\n   *  i18n-Label precedent), so it is EXCLUDED here even when its effective `encryptedAtRest`\n   *  folds to `'sealed'` — there is no envelope slot to seal. It still surfaces in\n   *  {@link taintedPostures} (query refusal via `postureFor`'s `queryable` clamp above, and\n   *  export refusal via `exportable`) — only the AT-REST SEALING ACTION is skipped. */\n  taintSealedFields(collection: string): ReadonlySet<string> {\n    const out = new Set<string>()\n    for (const edge of this._in.values()) {\n      if (edge.target.collection !== collection || edge.grain === 'virtual') continue\n      const posture = this._computeEffective(nodeId(edge.target), edge)\n      if (posture.encryptedAtRest === 'sealed') out.add(edge.target.field)\n    }\n    return out\n  }\n\n  /** Fields on `collection` whose registered edge is `grain === 'virtual'` (#638 Task 7) —\n   *  `via-graph-wiring.ts#applyTaintOverlay` intersects this with `exportable === false`\n   *  postures to know which virtual fields need PRESENT-TIME (not just export-time)\n   *  redaction, since a virtual field's value is only ever materialized inside `present()`. */\n  virtualFields(collection: string): ReadonlySet<string> {\n    const out = new Set<string>()\n    for (const edge of this._in.values()) {\n      if (edge.target.collection === collection && edge.grain === 'virtual') out.add(edge.target.field)\n    }\n    return out\n  }\n\n  /** Per-collection { field → immediate source field names that forced its\n   *  effective posture away from `DEFAULT_POSTURE` } — `describe()`'s\n   *  provenance (Task 3). Only the DIRECT declared sources are named (not the\n   *  ultimate origin several hops up a transitive chain); a source absent\n   *  from the result contributed nothing restrictive. */\n  taintProvenance(collection: string): ReadonlyMap<string, readonly string[]> {\n    const out = new Map<string, readonly string[]>()\n    for (const edge of this._in.values()) {\n      if (edge.target.collection !== collection) continue\n      const forcedBy = edge.sources\n        .filter((source) => !isDefaultPosture(this._contribution(nodeId(source))))\n        .map((source) => source.field)\n      if (forcedBy.length > 0) out.set(edge.target.field, forcedBy)\n    }\n    return out\n  }\n\n  private _targetsDependingOn(collection: string): ReadonlyArray<{ readonly target: FieldRef; readonly kind: EdgeKind; readonly grain: Grain }> {\n    const out: Array<{ target: FieldRef; kind: EdgeKind; grain: Grain }> = []\n    for (const edge of this._in.values()) {\n      if (edge.sources.some(source => source.collection === collection)) {\n        out.push({ target: edge.target, kind: edge.kind, grain: edge.grain })\n      }\n    }\n    return out\n  }\n\n  /** Dispatch (Task 4): every derived target triggered by a write to `collection`. Excludes\n   *  `'ref'` edges (#650 Task 5 review, folded Minor) — a `'ref'` edge is consulted only by the\n   *  delete/forget-time restrict/cascade/nullify path ({@link referencingEdgesOf}), never by the\n   *  sync/cutover/restore dispatch wave (`runGraphDispatchWave`); counting it here defeated that\n   *  wave's zero-cost early-continue, costing every write to a referenced backing collection an\n   *  unconditional decrypt + two no-op dispatch passes. {@link derivedArtifactsOf} (erasure\n   *  fanout) still includes `'ref'` edges — the forget path genuinely needs them. */\n  dependentsOf(collection: string): ReadonlyArray<{ readonly target: FieldRef; readonly kind: EdgeKind; readonly grain: Grain }> {\n    return this._targetsDependingOn(collection).filter((edge) => edge.kind !== 'ref')\n  }\n\n  /** Erasure (Task 6): derived artifacts of a forgotten record whose source is `collection`. */\n  derivedArtifactsOf(collection: string): ReadonlyArray<{ readonly target: FieldRef; readonly kind: EdgeKind; readonly grain: Grain }> {\n    return this._targetsDependingOn(collection)\n  }\n\n  /** Referencing edges pointing AT a backing dimension (delete/forget-time restrict/cascade/\n   *  nullify, #650 Task 5) — an O(1) reverse lookup via the existing `_out` map (keyed at the\n   *  dimension's wildcard `field:'*'` node, the same convention every whole-collection source\n   *  already uses), NEVER a scan across collections or records. `backing` is the collection name\n   *  a lookup field's edge was registered against (a reserved dimension's `_dict_<name>`/\n   *  `_lookup_<name>` collection name, or a matrix dimension's own collection name). */\n  referencingEdgesOf(backing: string): ReadonlyArray<{ readonly referencing: FieldRef; readonly onDelete: OnDelete; readonly keyField: string }> {\n    const targets = this._out.get(nodeId({ collection: backing, field: '*' }))\n    if (!targets) return []\n    const out: Array<{ referencing: FieldRef; onDelete: OnDelete; keyField: string }> = []\n    for (const target of targets) {\n      const edge = this._in.get(nodeId(target))\n      if (edge?.kind === 'ref' && edge.onDelete !== undefined) {\n        out.push({ referencing: target, onDelete: edge.onDelete, keyField: edge.keyField ?? 'id' })\n      }\n    }\n    return out\n  }\n}\n"],"mappings":";;;;;;AA2BO,IAAM,kBACX,EAAE,iBAAiB,YAAY,WAAW,QAAQ,YAAY,MAAM,aAAa,MAAM;AAEzF,IAAM,iBAA0D;AAAA,EAC9D,MAAM;AAAA,EACN,aAAa;AAAA,EACb,SAAS;AAAA,EACT,MAAM;AACR;AAGO,SAAS,YAAY,GAAe,GAA2B;AACpE,SAAO;AAAA,IACL,iBAAiB,EAAE,oBAAoB,YAAY,EAAE,oBAAoB,WAAW,WAAW;AAAA,IAC/F,WAAW,eAAe,EAAE,SAAS,KAAK,eAAe,EAAE,SAAS,IAAI,EAAE,YAAY,EAAE;AAAA,IACxF,YAAY,EAAE,cAAc,EAAE;AAAA,IAC9B,aAAa,EAAE,eAAe,EAAE;AAAA,EAClC;AACF;AAGA,SAAS,iBAAiB,GAAwB;AAChD,SAAO,EAAE,oBAAoB,gBAAgB,mBAAmB,EAAE,cAAc,gBAAgB,aAC9F,EAAE,eAAe,gBAAgB,cAAc,EAAE,gBAAgB,gBAAgB;AACrF;AAiBA,IAAM,MAAM;AACZ,IAAM,YAAiC,oBAAI,IAAI;AAE/C,SAAS,OAAO,KAAuB;AACrC,SAAO,GAAG,IAAI,UAAU,GAAG,GAAG,GAAG,IAAI,KAAK;AAC5C;AAGA,SAAS,cAAc,IAAoB;AACzC,QAAM,MAAM,GAAG,QAAQ,GAAG;AAC1B,SAAO,GAAG,GAAG,MAAM,GAAG,GAAG,CAAC,IAAI,GAAG,MAAM,MAAM,CAAC,CAAC;AACjD;AAGO,IAAM,WAAN,MAAe;AAAA;AAAA,EAEH,WAAW,oBAAI,IAAwB;AAAA;AAAA,EAEvC,MAAM,oBAAI,IAAyB;AAAA;AAAA,EAEnC,OAAO,oBAAI,IAAwB;AAAA;AAAA,EAEnC,kBAAkB,oBAAI,IAAwB;AAAA;AAAA;AAAA,EAG9C,yBAAyB,oBAAI,IAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzC,oBAAoB,oBAAI,IAAyB;AAAA;AAAA;AAAA,EAIlE,cAAc,YAAoB,OAAe,SAA2B;AAC1E,UAAM,KAAK,OAAO,EAAE,YAAY,MAAM,CAAC;AACvC,QAAI,KAAK,SAAS,IAAI,EAAE,EAAG;AAC3B,SAAK,SAAS,IAAI,IAAI,OAAO;AAC7B,SAAK,gBAAgB,MAAM;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB,QAAkB,SAA8B,MAAgB,OAAc,UAAqB,UAAyB;AAC1I,UAAM,KAAK,OAAO,MAAM;AACxB,SAAK,IAAI,IAAI,IAAI;AAAA,MACf;AAAA,MAAQ;AAAA,MAAS;AAAA,MAAM;AAAA,MACvB,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,IAC/C,CAAC;AACD,eAAW,UAAU,SAAS;AAC5B,YAAM,WAAW,OAAO,MAAM;AAC9B,YAAM,aAAa,KAAK,KAAK,IAAI,QAAQ;AACzC,UAAI,WAAY,YAAW,KAAK,MAAM;AAAA,UACjC,MAAK,KAAK,IAAI,UAAU,CAAC,MAAM,CAAC;AAAA,IACvC;AACA,SAAK,gBAAgB,MAAM;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAW,QAA2B;AACpC,WAAO,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC;AAAA,EACpC;AAAA;AAAA,EAGA,eAAe,YAA0B;AACvC,SAAK,uBAAuB,IAAI,UAAU;AAAA,EAC5C;AAAA,EAEA,aAAa,YAA6B;AACxC,WAAO,KAAK,uBAAuB,IAAI,UAAU;AAAA,EACnD;AAAA;AAAA;AAAA,EAIA,qBAAqB,YAAoB,OAAqB;AAC5D,QAAI,MAAM,KAAK,kBAAkB,IAAI,UAAU;AAC/C,QAAI,CAAC,KAAK;AAAE,YAAM,oBAAI,IAAI;AAAG,WAAK,kBAAkB,IAAI,YAAY,GAAG;AAAA,IAAE;AACzE,QAAI,IAAI,KAAK;AAAA,EACf;AAAA,EAEA,uBAAuB,YAAyC;AAC9D,WAAO,KAAK,kBAAkB,IAAI,UAAU,KAAK;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAsB;AACpB,UAAM,UAAU,oBAAI,IAAY;AAChC,UAAM,QAAkB,CAAC;AAEzB,UAAM,QAAQ,CAAC,OAAqB;AAClC,YAAM,MAAM,MAAM,QAAQ,EAAE;AAC5B,UAAI,QAAQ,IAAI;AACd,cAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE;AACxC,cAAM,OAAO,MAAM,KAAK,aAAW,KAAK,IAAI,IAAI,OAAO,GAAG,SAAS,IAAI;AACvE,cAAM,OAAO,MAAM,IAAI,aAAa;AACpC,YAAI,KAAM,OAAM,IAAI,2BAA2B,IAAI;AACnD,cAAM,IAAI,qBAAqB,IAAI;AAAA,MACrC;AACA,UAAI,QAAQ,IAAI,EAAE,EAAG;AACrB,YAAM,KAAK,EAAE;AACb,YAAM,aAAa,KAAK,KAAK,IAAI,EAAE;AACnC,UAAI,YAAY;AACd,mBAAW,aAAa,WAAY,OAAM,OAAO,SAAS,CAAC;AAAA,MAC7D;AACA,YAAM,IAAI;AACV,cAAQ,IAAI,EAAE;AAAA,IAChB;AAEA,eAAW,MAAM,KAAK,KAAK,KAAK,EAAG,OAAM,EAAE;AAAA,EAC7C;AAAA;AAAA;AAAA,EAIQ,iBAAiB,IAAwB;AAC/C,WAAO,KAAK,SAAS,IAAI,EAAE,KAAK;AAAA,EAClC;AAAA;AAAA;AAAA,EAIQ,cAAc,IAAwB;AAC5C,UAAM,OAAO,KAAK,IAAI,IAAI,EAAE;AAC5B,WAAO,OAAO,KAAK,kBAAkB,IAAI,IAAI,IAAI,KAAK,iBAAiB,EAAE;AAAA,EAC3E;AAAA,EAEQ,kBAAkB,IAAY,MAA+B;AACnE,UAAM,SAAS,KAAK,gBAAgB,IAAI,EAAE;AAC1C,QAAI,OAAQ,QAAO;AACnB,QAAI,SAAS;AACb,eAAW,UAAU,KAAK,SAAS;AACjC,eAAS,YAAY,QAAQ,KAAK,cAAc,OAAO,MAAM,CAAC,CAAC;AAAA,IACjE;AASA,QAAI,KAAK,UAAU,aAAa,OAAO,cAAc,QAAQ;AAC3D,eAAS,EAAE,GAAG,QAAQ,WAAW,OAAO;AAAA,IAC1C;AACA,SAAK,gBAAgB,IAAI,IAAI,MAAM;AACnC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,iBAAiB,QAA0C;AACzD,UAAM,KAAK,OAAO,MAAM;AACxB,UAAM,OAAO,KAAK,IAAI,IAAI,EAAE;AAC5B,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO,KAAK,kBAAkB,IAAI,IAAI;AAAA,EACxC;AAAA;AAAA,EAGA,gBAAgB,YAAqD;AACnE,UAAM,MAAM,oBAAI,IAAwB;AACxC,eAAW,QAAQ,KAAK,IAAI,OAAO,GAAG;AACpC,UAAI,KAAK,OAAO,eAAe,WAAY;AAC3C,UAAI,IAAI,KAAK,OAAO,OAAO,KAAK,kBAAkB,OAAO,KAAK,MAAM,GAAG,IAAI,CAAC;AAAA,IAC9E;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,kBAAkB,YAAyC;AACzD,UAAM,MAAM,oBAAI,IAAY;AAC5B,eAAW,QAAQ,KAAK,IAAI,OAAO,GAAG;AACpC,UAAI,KAAK,OAAO,eAAe,cAAc,KAAK,UAAU,UAAW;AACvE,YAAM,UAAU,KAAK,kBAAkB,OAAO,KAAK,MAAM,GAAG,IAAI;AAChE,UAAI,QAAQ,oBAAoB,SAAU,KAAI,IAAI,KAAK,OAAO,KAAK;AAAA,IACrE;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAc,YAAyC;AACrD,UAAM,MAAM,oBAAI,IAAY;AAC5B,eAAW,QAAQ,KAAK,IAAI,OAAO,GAAG;AACpC,UAAI,KAAK,OAAO,eAAe,cAAc,KAAK,UAAU,UAAW,KAAI,IAAI,KAAK,OAAO,KAAK;AAAA,IAClG;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB,YAA4D;AAC1E,UAAM,MAAM,oBAAI,IAA+B;AAC/C,eAAW,QAAQ,KAAK,IAAI,OAAO,GAAG;AACpC,UAAI,KAAK,OAAO,eAAe,WAAY;AAC3C,YAAM,WAAW,KAAK,QACnB,OAAO,CAAC,WAAW,CAAC,iBAAiB,KAAK,cAAc,OAAO,MAAM,CAAC,CAAC,CAAC,EACxE,IAAI,CAAC,WAAW,OAAO,KAAK;AAC/B,UAAI,SAAS,SAAS,EAAG,KAAI,IAAI,KAAK,OAAO,OAAO,QAAQ;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,oBAAoB,YAAkH;AAC5I,UAAM,MAAiE,CAAC;AACxE,eAAW,QAAQ,KAAK,IAAI,OAAO,GAAG;AACpC,UAAI,KAAK,QAAQ,KAAK,YAAU,OAAO,eAAe,UAAU,GAAG;AACjE,YAAI,KAAK,EAAE,QAAQ,KAAK,QAAQ,MAAM,KAAK,MAAM,OAAO,KAAK,MAAM,CAAC;AAAA,MACtE;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAAa,YAAkH;AAC7H,WAAO,KAAK,oBAAoB,UAAU,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS,KAAK;AAAA,EAClF;AAAA;AAAA,EAGA,mBAAmB,YAAkH;AACnI,WAAO,KAAK,oBAAoB,UAAU;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,mBAAmB,SAA4H;AAC7I,UAAM,UAAU,KAAK,KAAK,IAAI,OAAO,EAAE,YAAY,SAAS,OAAO,IAAI,CAAC,CAAC;AACzE,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,UAAM,MAA8E,CAAC;AACrF,eAAW,UAAU,SAAS;AAC5B,YAAM,OAAO,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC;AACxC,UAAI,MAAM,SAAS,SAAS,KAAK,aAAa,QAAW;AACvD,YAAI,KAAK,EAAE,aAAa,QAAQ,UAAU,KAAK,UAAU,UAAU,KAAK,YAAY,KAAK,CAAC;AAAA,MAC5F;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-VMRXI3IF.js → chunk-A2APWS32.js}

@@ -1,14 +1,14 @@
 import {
   openEnvelopeJson
-} from "./chunk-JIW3Q5JN.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-XHD3L3JO.js";
 import {
   encrypt,
   hmacSha256Hex,
   sha256Hex
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-UNJU345Q.js";
 
 // src/with-audit/forget/strategy.ts
 var NO_FORGET = { subjects: {} };
@@ -147,4 +147,4 @@ export {
   coerceSubjectId,
   readDottedPath
 };
-//# sourceMappingURL=chunk-VMRXI3IF.js.map
+//# sourceMappingURL=chunk-A2APWS32.js.map

package/dist/chunk-A2APWS32.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/forget/strategy.ts","../src/with-audit/forget/subject-index.ts"],"sourcesContent":["/**\n * `withForgetCascade` — declaration surface for GDPR right-to-erasure via\n * per-record CEK crypto-shred.\n *\n * This file holds only the *declaration* shape and the disabled sentinel.\n * The actual erasure machinery lives in:\n *   - `subject-index.ts` — the encrypted `_subject_index` reserved collection\n *   - `vault.ts` `forget()` — the per-record tombstone + ledger flow\n *   - `collection.ts` `_writeTombstone` — the envelope rewrite\n *\n * A `ForgetStrategy` declares which collections carry erasable subject data\n * and the (dotted-path) field on each record that names the data subject.\n * Declaring a collection here ALSO forces `perRecordKeys: true` for it (a\n * shred can only erase a record whose body is keyed off a per-record CEK),\n * so adopters opt into the CEK foundation transitively.\n *\n * @module\n */\nimport type { LedgerEntry } from '../../with-commit/history/ledger/entry.js'\n\n/**\n * User-supplied declaration passed to {@link withForgetCascade}. Maps a\n * collection name to the record field (dotted path supported, e.g.\n * `'billing.buyerId'`) that identifies the data subject for erasure.\n *\n * ```ts\n * withForgetCascade({ subjects: { invoices: 'buyerId', contacts: 'id' } })\n * ```\n */\nexport interface SubjectDeclaration {\n  readonly subjects: Record<string, string>\n}\n\n/**\n * Resolved forget strategy threaded through Noydb → every Vault. Carries\n * the same `subjects` map the user declared. `NO_FORGET` (empty map) is the\n * off-by-default sentinel; `vault.forget()` throws\n * `ForgetStrategyNotConfiguredError` when the map is empty.\n */\nexport interface ForgetStrategy {\n  /** Collection → subject-field (dotted path). Empty under `NO_FORGET`. */\n  readonly subjects: Readonly<Record<string, string>>\n}\n\n/**\n * Disabled sentinel — no collections declare a subject field. `vault.forget()`\n * refuses with `ForgetStrategyNotConfiguredError`; no write hooks register; no\n * collection is forced into `perRecordKeys`. Non-adopters pay nothing.\n */\nexport const NO_FORGET: ForgetStrategy = { subjects: {} }\n\n// The `withForgetCascade` factory lives in `active.ts` (canonical\n// strategy.ts/active.ts/index.ts split); this file holds only the\n// declaration shape + disabled sentinel.\n\n/**\n * The outcome of a `vault.forget(subjectId)` call.\n *\n * `unmigratedRecords` lists `collection:id` pairs that were tombstoned but\n * whose body had NOT been migrated to a per-record CEK at shred time (legacy\n * body still under the shared collection DEK). Those records are tombstoned\n * (live envelope + history stripped) but their pre-shred ciphertext, if it\n * leaked into a backup before migration, remains decryptable under the\n * collection DEK — so erasure-completeness is NOT guaranteed for them. Run\n * the per-record-CEK migration pass, then re-forget, to close the gap.\n *\n * Blob attachments: a shredded record's **erasable** blobs (on a\n * `perRecordKeys` collection) are crypto-shredded inline — `blobsShredded`\n * counts those taken to refCount 0 (BlobObject deleted → chunks permanently\n * undecryptable), `blobsRetainedShared` counts those still referenced by\n * another record (shared content legitimately persists for its other owner).\n * `blobResidueCollections` now lists only collections with blobs that could\n * NOT be crypto-shredded: **legacy** blobs (no per-blob `_cek`, chunks under\n * the shared `_blob` DEK — migrate them), or a session without the blob\n * service loaded. An all-erasable subject yields an empty residue list.\n */\nexport interface ForgetResult {\n  /** The subject id passed to `forget()`. Echoed for caller convenience. */\n  readonly subject: string\n  /** Count of live records rewritten to a tombstone. */\n  readonly recordsShredded: number\n  /** Count of `_history` envelopes tombstoned across all shredded records. */\n  readonly historyVersionsShredded: number\n  /** Distinct collections that had at least one record shredded. */\n  readonly collections: readonly string[]\n  /** `collection:id` pairs shredded while still un-migrated (see type docs). */\n  readonly unmigratedRecords: readonly string[]\n  /** Count of erasable blobs crypto-shredded (refCount → 0, BlobObject deleted). */\n  readonly blobsShredded: number\n  /** Count of erasable blobs retained because still referenced elsewhere (shared). */\n  readonly blobsRetainedShared: number\n  /** Collections with blobs that could NOT be crypto-shredded — legacy (no `_cek`) or blobs disabled (see type docs). */\n  readonly blobResidueCollections: readonly string[]\n  /**\n   * Count of persisted `_idx/<field>/<recordId>` index side-cars hard-deleted\n   * across the shredded records. These live under the retained\n   * collection DEK, so crypto-shred alone would leave the indexed field VALUES\n   * readable — `forget()` must delete them.\n   */\n  readonly indexPostingsPurged: number\n  /**\n   * `collection:id:field` entries whose persisted `_idx` side-car could NOT be\n   * deleted — index residue that still leaks the indexed value under the\n   * retained collection DEK. Non-empty means erasure is INCOMPLETE: retry, or\n   * purge the side-car out of band.\n   */\n  readonly indexResidue: readonly string[]\n  /**\n   * Count of `_sealed[field]` slots dropped from the live store across the\n   * shredded records. For slots written under `sensitive` +\n   * `perRecordKeys` (the current path), the key derives off the per-record CEK,\n   * so tombstoning the record — which drops `_cek` and `_sealed` — also\n   * crypto-shreds the value. A legacy slot (written before per-record CEKs) keys\n   * off the collection DEK instead, so dropping it removes it from the live store but a\n   * pre-forget backup remains recoverable by a DEK holder (same caveat `_data`\n   * carries); migrate by re-`put`ting before forgetting for full crypto-shred.\n   */\n  readonly sealedFieldsShredded: number\n  /** Count of `_sealed_cek` host-delivery envelopes deleted (#H-1). A record sealed to an\n   * at-* host via sealRecordToHost persists its raw CEK there; forget() must destroy them. */\n  readonly sealedCekEnvelopesPurged: number\n  /** `collection:id` whose `_sealed_cek` purge failed (residue — the host-recoverable CEK may survive). */\n  readonly sealedCekResidue: readonly string[]\n  /** `collection:id:field` sealed slots that were DEK-derived (legacy, written before per-record CEKs) and thus NOT crypto-shredded\n   * by dropping `_cek` — the collection DEK is retained, so synced/backup copies stay decryptable (#M-1). */\n  readonly sealedResidue: readonly string[]\n  /** The single `op:'forget'` ledger entry appended for this erasure. */\n  readonly ledgerEntry: LedgerEntry\n  /** #622 — record-grain derived artifacts (MV rows, per-record derived copies) erased\n   *  because their source subject was forgotten. Overlay outputs are intentionally out of\n   *  scope here — an overlay is always sourced from an MV, never directly from a subject\n   *  collection, so the personal-data-bearing MV rows it reads are already erased above. */\n  readonly derivedRecordsErased: number\n  /** #622 — aggregate-grain targets (rollups) recomputed without the forgotten contribution. */\n  readonly derivedAggregatesRecomputed: number\n  /** #622 — `collection:id` derived writes SKIPPED because the target period is frozen\n   *  (recompute deferred; the aggregate retains the forgotten contribution — audited). */\n  readonly derivedResidueFrozen: readonly string[]\n  /** #650 Task 5 (#648) — referencing records tombstoned via a `'ref'` edge's `cascade` policy. */\n  readonly lookupReferencesCascaded: number\n  /** #650 Task 5 (#648) — referencing fields cleared via a `'ref'` edge's `nullify` policy. */\n  readonly lookupReferencesNullified: number\n  /** #650 Task 5 review (Important fix) — `'ref'` edges whose compare-key could NOT be resolved,\n   *  even from the LIVE pre-shred backing row — cascade/nullify propagation was SKIPPED for these.\n   *  Always empty in the ordinary case; non-empty means the skip is reported, never silent. */\n  readonly lookupReferencesResidue: readonly string[]\n}\n","/**\n * The encrypted subject index.\n *\n * GDPR crypto-shred needs to answer \"which records belong to data subject\n * X?\" portably (the index must travel with the vault/bundle) WITHOUT leaking\n * subject-equivalence to the store. The rejected alternative — an unencrypted\n * subject tag in envelope metadata — would let anyone with store access see\n * which records share a subject. Instead we keep a reserved `_subject_index`\n * collection, encrypted under its OWN DEK (`getDEK('_subject_index')`):\n *\n *   - record id  = `HMAC-SHA256(indexDEK, subjectId)` (M-2). A bare\n *     `sha256Hex(subjectId)` would be offline-computable: an attacker with\n *     store access and a candidate list (emails / customer ids are low-entropy)\n *     could dictionary the hash to confirm \"subject X is present here.\" Keying\n *     the id with the vault-only index DEK removes that capability — without the\n *     DEK the id cannot be derived. (Legacy entries written before M-2 used the\n *     bare sha256 id; the read/remove paths dual-look-up both forms.)\n *   - record body = AES-GCM(JSON `{ r: [{ collection, id }], p }`) under the\n *     index DEK, where `p` pads the plaintext to a bucketed length so the\n *     ciphertext `_data` length does not leak the approximate record count.\n *     Legacy bodies were a bare `[{ collection, id }]` array; reads accept both.\n *\n * ## Concurrency (RISK #3 — known v1 limitation)\n *\n * `addSubjectRef` / `removeSubjectRef` are read-modify-write with no CAS. The\n * design assumes a SINGLE WRITER (the noy-db single-process write model). Two\n * concurrent writers racing on the SAME subject can lose an entry (last-write\n * wins on the ref list). This is documented, not fixed in v1:\n * `rebuildSubjectIndex` performs a full scan to recover a correct index from\n * the canonical records, so a lost ref is recoverable. A CAS-backed index is\n * deferred to a later slice.\n *\n * @module\n */\nimport { encrypt, openEnvelopeJson, hmacSha256Hex, sha256Hex, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\n\n/** Reserved collection holding the encrypted subject → records index. */\nexport const SUBJECT_INDEX_COLLECTION = '_subject_index'\n\n/**\n * Bucket (bytes) the encrypted ref-list plaintext is padded up to, so the\n * ciphertext `_data` length leaks only `count` rounded up to a bucket — not the\n * exact record count. 256 keeps small subjects (the common case) indistinguishable.\n */\nconst REF_LIST_BUCKET = 256\n\n/** A single record reference held in a subject's index entry. */\nexport interface SubjectRef {\n  readonly collection: string\n  readonly id: string\n}\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** SHA-256 hex of a UTF-8 string. The LEGACY (pre-M-2) subject-index key. */\nasync function sha256HexString(input: string): Promise<string> {\n  return sha256Hex(new TextEncoder().encode(input))\n}\n\n/**\n * The subject-index record id(s) to consult for a subject, most-current first.\n *\n * - Encrypted vault: the PRIMARY id is `HMAC-SHA256(indexDEK, subjectId)` (M-2)\n *   — not offline-computable. The LEGACY `sha256Hex(subjectId)` id is also\n *   returned so reads/removes still find entries written before M-2 (dual-lookup).\n * - Plaintext/debug vault: no DEK to key with, so the only id is the legacy\n *   sha256 form (unchanged behaviour — plaintext mode is not zero-knowledge anyway).\n */\nasync function subjectKeys(getDEK: GetDEK, encrypted: boolean, subjectId: string): Promise<string[]> {\n  const legacy = await sha256HexString(subjectId)\n  if (!encrypted) return [legacy]\n  const dek = await getDEK(SUBJECT_INDEX_COLLECTION)\n  const keyed = await hmacSha256Hex(dek, new TextEncoder().encode(subjectId))\n  return keyed === legacy ? [keyed] : [keyed, legacy]\n}\n\n/** The id new writes land under (keyed when encrypted, else legacy sha256). */\nasync function primarySubjectKey(getDEK: GetDEK, encrypted: boolean, subjectId: string): Promise<string> {\n  return (await subjectKeys(getDEK, encrypted, subjectId))[0]!\n}\n\n/** Parse a stored ref-list body: new padded `{ r, p }` wrapper OR legacy bare array. */\nfunction parseRefs(json: string): SubjectRef[] {\n  const parsed = JSON.parse(json) as SubjectRef[] | { r: SubjectRef[] }\n  return Array.isArray(parsed) ? parsed : parsed.r\n}\n\n/** Serialize + pad the ref list to a bucket boundary (encrypted vaults only). */\nfunction serializeRefs(refs: SubjectRef[]): string {\n  const base = JSON.stringify({ r: refs, p: '' })\n  const pad = Math.ceil(base.length / REF_LIST_BUCKET) * REF_LIST_BUCKET - base.length\n  return JSON.stringify({ r: refs, p: ' '.repeat(pad) })\n}\n\n/** Read + decrypt the ref list at a SINGLE index key. Returns `[]` when absent. */\nasync function readRefs(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  key: string,\n): Promise<SubjectRef[]> {\n  const env = await adapter.get(vault, SUBJECT_INDEX_COLLECTION, key)\n  if (!env || !env._data) return []\n  if (!encrypted) return parseRefs(env._data)\n  const dek = await getDEK(SUBJECT_INDEX_COLLECTION)\n  const json = await openEnvelopeJson(env, dek)\n  return parseRefs(json)\n}\n\n/** Encrypt + write a ref list for a subject under its derived key. */\nasync function writeRefs(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  key: string,\n  refs: SubjectRef[],\n): Promise<void> {\n  let env: EncryptedEnvelope\n  if (!encrypted) {\n    // Plaintext/debug vault: keep the legacy bare-array form (no padding needed).\n    env = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: new Date().toISOString(), _iv: '', _data: JSON.stringify(refs) }\n  } else {\n    const dek = await getDEK(SUBJECT_INDEX_COLLECTION)\n    const { iv, data } = await encrypt(serializeRefs(refs), dek)\n    env = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: new Date().toISOString(), _iv: iv, _data: data }\n  }\n  await adapter.put(vault, SUBJECT_INDEX_COLLECTION, key, env)\n}\n\n/**\n * Add a `{ collection, id }` ref to a subject's index entry (idempotent —\n * a duplicate ref is not appended). Read-modify-write; see the concurrency\n * note in the module docstring.\n */\nexport async function addSubjectRef(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjectId: string,\n  ref: SubjectRef,\n): Promise<void> {\n  const key = await primarySubjectKey(getDEK, encrypted, subjectId)\n  const refs = await readRefs(adapter, vault, getDEK, encrypted, key)\n  if (refs.some((r) => r.collection === ref.collection && r.id === ref.id)) return\n  refs.push(ref)\n  await writeRefs(adapter, vault, getDEK, encrypted, key, refs)\n}\n\n/**\n * Remove a `{ collection, id }` ref from a subject's index entry. When the\n * last ref is removed the (now empty) entry is deleted so the store holds no\n * residual key for an erased subject.\n */\nexport async function removeSubjectRef(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjectId: string,\n  ref: SubjectRef,\n): Promise<void> {\n  // Dual-lookup: drop the ref from BOTH the keyed (M-2) and the legacy sha256\n  // entry, so a pre-M-2 subject is still fully erased.\n  for (const key of await subjectKeys(getDEK, encrypted, subjectId)) {\n    const refs = await readRefs(adapter, vault, getDEK, encrypted, key)\n    const next = refs.filter((r) => !(r.collection === ref.collection && r.id === ref.id))\n    if (next.length === refs.length) continue\n    if (next.length === 0) {\n      await adapter.delete(vault, SUBJECT_INDEX_COLLECTION, key)\n    } else {\n      await writeRefs(adapter, vault, getDEK, encrypted, key, next)\n    }\n  }\n}\n\n/**\n * Look up every record ref for a subject. Returns `[]` when none exist. Unions\n * the keyed (M-2) and legacy sha256 entries (dual-lookup), deduplicated, so a\n * subject indexed before M-2 is still fully found.\n */\nexport async function lookupSubject(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjectId: string,\n): Promise<SubjectRef[]> {\n  const keys = await subjectKeys(getDEK, encrypted, subjectId)\n  const seen = new Set<string>()\n  const out: SubjectRef[] = []\n  for (const key of keys) {\n    for (const ref of await readRefs(adapter, vault, getDEK, encrypted, key)) {\n      const dedup = `${ref.collection}\\u0000${ref.id}`\n      if (seen.has(dedup)) continue\n      seen.add(dedup)\n      out.push(ref)\n    }\n  }\n  return out\n}\n\n/**\n * Rebuild the entire subject index from the canonical records (the recovery\n * path for the documented read-modify-write race). Scans each declared\n * collection, reads `record[subjectField]` (dotted path), and rewrites the\n * index from scratch. Tombstoned (already-shredded) records contribute no\n * ref — their body is gone, so they cannot be re-indexed.\n *\n * `decodeRecord` decrypts an envelope to a plain object (or returns null for\n * a tombstone / unreadable record); supplied by the caller so this module\n * stays free of Collection internals.\n */\nexport async function rebuildSubjectIndex(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjects: Readonly<Record<string, string>>,\n  decodeRecord: (collection: string, id: string, env: EncryptedEnvelope) => Promise<Record<string, unknown> | null>,\n): Promise<number> {\n  // Drop every existing index entry first so removed refs don't linger.\n  const existing = await adapter.list(vault, SUBJECT_INDEX_COLLECTION)\n  for (const k of existing) {\n    await adapter.delete(vault, SUBJECT_INDEX_COLLECTION, k)\n  }\n\n  // subjectId → refs, accumulated across all declared collections.\n  const bySubject = new Map<string, SubjectRef[]>()\n  for (const [collection, field] of Object.entries(subjects)) {\n    const ids = await adapter.list(vault, collection)\n    for (const id of ids) {\n      if (id.startsWith('_')) continue\n      const env = await adapter.get(vault, collection, id)\n      if (!env || !env._data) continue // missing or tombstone\n      const record = await decodeRecord(collection, id, env)\n      if (record === null) continue\n      const subjectValue = readDottedPath(record, field)\n      if (subjectValue === undefined || subjectValue === null) continue\n      const subjectId = coerceSubjectId(subjectValue)\n      const list = bySubject.get(subjectId) ?? []\n      list.push({ collection, id })\n      bySubject.set(subjectId, list)\n    }\n  }\n\n  let entries = 0\n  for (const [subjectId, refs] of bySubject) {\n    const key = await primarySubjectKey(getDEK, encrypted, subjectId)\n    await writeRefs(adapter, vault, getDEK, encrypted, key, refs)\n    entries++\n  }\n  return entries\n}\n\n/**\n * Coerce a read subject-field value to a stable string id. Primitives use\n * their natural string form; objects/arrays are JSON-stringified so structural\n * subjects still get a deterministic key (avoids the `[object Object]` trap).\n */\nexport function coerceSubjectId(value: unknown): string {\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') {\n    return String(value)\n  }\n  return JSON.stringify(value)\n}\n\n/** Read a (possibly dotted) field path from a plain record. */\nexport function readDottedPath(record: Record<string, unknown>, field: string): unknown {\n  if (!field.includes('.')) return record[field]\n  let cursor: unknown = record\n  for (const segment of field.split('.')) {\n    if (cursor === null || cursor === undefined) return undefined\n    cursor = (cursor as Record<string, unknown>)[segment]\n  }\n  return cursor\n}\n"],"mappings":";;;;;;;;;;;;;AAiDO,IAAM,YAA4B,EAAE,UAAU,CAAC,EAAE;;;ACVjD,IAAM,2BAA2B;AAOxC,IAAM,kBAAkB;AAWxB,eAAe,gBAAgB,OAAgC;AAC7D,SAAO,UAAU,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAClD;AAWA,eAAe,YAAY,QAAgB,WAAoB,WAAsC;AACnG,QAAM,SAAS,MAAM,gBAAgB,SAAS;AAC9C,MAAI,CAAC,UAAW,QAAO,CAAC,MAAM;AAC9B,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,QAAQ,MAAM,cAAc,KAAK,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAC1E,SAAO,UAAU,SAAS,CAAC,KAAK,IAAI,CAAC,OAAO,MAAM;AACpD;AAGA,eAAe,kBAAkB,QAAgB,WAAoB,WAAoC;AACvG,UAAQ,MAAM,YAAY,QAAQ,WAAW,SAAS,GAAG,CAAC;AAC5D;AAGA,SAAS,UAAU,MAA4B;AAC7C,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,SAAO,MAAM,QAAQ,MAAM,IAAI,SAAS,OAAO;AACjD;AAGA,SAAS,cAAc,MAA4B;AACjD,QAAM,OAAO,KAAK,UAAU,EAAE,GAAG,MAAM,GAAG,GAAG,CAAC;AAC9C,QAAM,MAAM,KAAK,KAAK,KAAK,SAAS,eAAe,IAAI,kBAAkB,KAAK;AAC9E,SAAO,KAAK,UAAU,EAAE,GAAG,MAAM,GAAG,IAAI,OAAO,GAAG,EAAE,CAAC;AACvD;AAGA,eAAe,SACb,SACA,OACA,QACA,WACA,KACuB;AACvB,QAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,0BAA0B,GAAG;AAClE,MAAI,CAAC,OAAO,CAAC,IAAI,MAAO,QAAO,CAAC;AAChC,MAAI,CAAC,UAAW,QAAO,UAAU,IAAI,KAAK;AAC1C,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,OAAO,MAAM,iBAAiB,KAAK,GAAG;AAC5C,SAAO,UAAU,IAAI;AACvB;AAGA,eAAe,UACb,SACA,OACA,QACA,WACA,KACA,MACe;AACf,MAAI;AACJ,MAAI,CAAC,WAAW;AAEd,UAAM,EAAE,QAAQ,sBAAsB,IAAI,GAAG,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,KAAK,IAAI,OAAO,KAAK,UAAU,IAAI,EAAE;AAAA,EACnH,OAAO;AACL,UAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,cAAc,IAAI,GAAG,GAAG;AAC3D,UAAM,EAAE,QAAQ,sBAAsB,IAAI,GAAG,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,KAAK,IAAI,OAAO,KAAK;AAAA,EACnG;AACA,QAAM,QAAQ,IAAI,OAAO,0BAA0B,KAAK,GAAG;AAC7D;AAOA,eAAsB,cACpB,SACA,OACA,QACA,WACA,WACA,KACe;AACf,QAAM,MAAM,MAAM,kBAAkB,QAAQ,WAAW,SAAS;AAChE,QAAM,OAAO,MAAM,SAAS,SAAS,OAAO,QAAQ,WAAW,GAAG;AAClE,MAAI,KAAK,KAAK,CAAC,MAAM,EAAE,eAAe,IAAI,cAAc,EAAE,OAAO,IAAI,EAAE,EAAG;AAC1E,OAAK,KAAK,GAAG;AACb,QAAM,UAAU,SAAS,OAAO,QAAQ,WAAW,KAAK,IAAI;AAC9D;AAOA,eAAsB,iBACpB,SACA,OACA,QACA,WACA,WACA,KACe;AAGf,aAAW,OAAO,MAAM,YAAY,QAAQ,WAAW,SAAS,GAAG;AACjE,UAAM,OAAO,MAAM,SAAS,SAAS,OAAO,QAAQ,WAAW,GAAG;AAClE,UAAM,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,eAAe,IAAI,cAAc,EAAE,OAAO,IAAI,GAAG;AACrF,QAAI,KAAK,WAAW,KAAK,OAAQ;AACjC,QAAI,KAAK,WAAW,GAAG;AACrB,YAAM,QAAQ,OAAO,OAAO,0BAA0B,GAAG;AAAA,IAC3D,OAAO;AACL,YAAM,UAAU,SAAS,OAAO,QAAQ,WAAW,KAAK,IAAI;AAAA,IAC9D;AAAA,EACF;AACF;AAOA,eAAsB,cACpB,SACA,OACA,QACA,WACA,WACuB;AACvB,QAAM,OAAO,MAAM,YAAY,QAAQ,WAAW,SAAS;AAC3D,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAoB,CAAC;AAC3B,aAAW,OAAO,MAAM;AACtB,eAAW,OAAO,MAAM,SAAS,SAAS,OAAO,QAAQ,WAAW,GAAG,GAAG;AACxE,YAAM,QAAQ,GAAG,IAAI,UAAU,KAAS,IAAI,EAAE;AAC9C,UAAI,KAAK,IAAI,KAAK,EAAG;AACrB,WAAK,IAAI,KAAK;AACd,UAAI,KAAK,GAAG;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AAaA,eAAsB,oBACpB,SACA,OACA,QACA,WACA,UACA,cACiB;AAEjB,QAAM,WAAW,MAAM,QAAQ,KAAK,OAAO,wBAAwB;AACnE,aAAW,KAAK,UAAU;AACxB,UAAM,QAAQ,OAAO,OAAO,0BAA0B,CAAC;AAAA,EACzD;AAGA,QAAM,YAAY,oBAAI,IAA0B;AAChD,aAAW,CAAC,YAAY,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC1D,UAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,UAAU;AAChD,eAAW,MAAM,KAAK;AACpB,UAAI,GAAG,WAAW,GAAG,EAAG;AACxB,YAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,YAAY,EAAE;AACnD,UAAI,CAAC,OAAO,CAAC,IAAI,MAAO;AACxB,YAAM,SAAS,MAAM,aAAa,YAAY,IAAI,GAAG;AACrD,UAAI,WAAW,KAAM;AACrB,YAAM,eAAe,eAAe,QAAQ,KAAK;AACjD,UAAI,iBAAiB,UAAa,iBAAiB,KAAM;AACzD,YAAM,YAAY,gBAAgB,YAAY;AAC9C,YAAM,OAAO,UAAU,IAAI,SAAS,KAAK,CAAC;AAC1C,WAAK,KAAK,EAAE,YAAY,GAAG,CAAC;AAC5B,gBAAU,IAAI,WAAW,IAAI;AAAA,IAC/B;AAAA,EACF;AAEA,MAAI,UAAU;AACd,aAAW,CAAC,WAAW,IAAI,KAAK,WAAW;AACzC,UAAM,MAAM,MAAM,kBAAkB,QAAQ,WAAW,SAAS;AAChE,UAAM,UAAU,SAAS,OAAO,QAAQ,WAAW,KAAK,IAAI;AAC5D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,gBAAgB,OAAwB;AACtD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AACxF,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO,KAAK,UAAU,KAAK;AAC7B;AAGO,SAAS,eAAe,QAAiC,OAAwB;AACtF,MAAI,CAAC,MAAM,SAAS,GAAG,EAAG,QAAO,OAAO,KAAK;AAC7C,MAAI,SAAkB;AACtB,aAAW,WAAW,MAAM,MAAM,GAAG,GAAG;AACtC,QAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,aAAU,OAAmC,OAAO;AAAA,EACtD;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-U5IJHUHZ.js → chunk-A4MAD6PO.js}

@@ -1,20 +1,20 @@
 import {
   dekKey
-} from "./chunk-26FSVNBL.js";
+} from "./chunk-MK2BSS44.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
   openEnvelopeJson
-} from "./chunk-JIW3Q5JN.js";
+} from "./chunk-XHD3L3JO.js";
 import {
   encrypt,
   unwrapKey,
   wrapKey
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
 import {
   DelegationTargetMissingError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/with-party/team/delegation.ts
 var DELEGATIONS_COLLECTION = "_delegations";
@@ -96,4 +96,4 @@ export {
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=chunk-U5IJHUHZ.js.map
+//# sourceMappingURL=chunk-A4MAD6PO.js.map

package/dist/chunk-ANDBBA2P.js

@@ -0,0 +1,36 @@
+import {
+  LookupHandle
+} from "./chunk-IIP5WFVT.js";
+
+// src/shape/via-lookup/active.ts
+function withLookup() {
+  return {
+    buildLookupHandle(opts) {
+      return new LookupHandle(
+        opts.adapter,
+        opts.compartmentName,
+        opts.dimensionName,
+        opts.keyring,
+        opts.reservedEnvelopes,
+        opts.encrypted,
+        opts.ledger,
+        opts.options,
+        opts.findAndUpdateReferences,
+        opts.emitter,
+        opts.buildDeleteMarker,
+        // #647 fix wave 1
+        opts.onDirty,
+        // #650 Task 4
+        opts.onRecordMutated,
+        // #650 Task 4
+        opts.checkReferencesOnDelete
+        // #650 Task 5
+      );
+    }
+  };
+}
+
+export {
+  withLookup
+};
+//# sourceMappingURL=chunk-ANDBBA2P.js.map

package/dist/chunk-ANDBBA2P.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shape/via-lookup/active.ts"],"sourcesContent":["/**\n * Active lookup strategy — `withLookup()` returns the real implementation\n * that constructs `LookupHandle` instances (the `_dict_*` / future\n * `_lookup_*` reserved-collection engine).\n *\n * #650 Task 1 (via-lookup extraction, phase D): this is the new home for\n * the handle-construction logic that used to live inline in\n * `shape/via-i18n/active.ts`'s `withI18n().buildDictionaryHandle`, which\n * now delegates here (same handle, new home — see that file). Splitting\n * the import chain through this file is the same `#553` tree-shake seam\n * `shape/via-i18n/active.ts` already used: the `LookupHandle` engine only\n * ships in a consumer's bundle once something reaches `withLookup()` (today\n * that's transitively via `withI18n()`; later phase-D tasks may call it\n * directly).\n *\n * @public\n */\n\nimport type { LookupStrategy, BuildLookupHandleOptions } from '../../port/with/lookup-strategy.js'\nimport { LookupHandle } from './handle.js'\n\nexport function withLookup(): LookupStrategy {\n  return {\n    buildLookupHandle<Keys extends string = string>(\n      opts: BuildLookupHandleOptions<Keys>,\n    ): LookupHandle<Keys> {\n      return new LookupHandle<Keys>(\n        opts.adapter,\n        opts.compartmentName,\n        opts.dimensionName,\n        opts.keyring,\n        opts.reservedEnvelopes,\n        opts.encrypted,\n        opts.ledger,\n        opts.options,\n        opts.findAndUpdateReferences,\n        opts.emitter,\n        opts.buildDeleteMarker, // #647 fix wave 1\n        opts.onDirty, // #650 Task 4\n        opts.onRecordMutated, // #650 Task 4\n        opts.checkReferencesOnDelete, // #650 Task 5\n      )\n    },\n  }\n}\n"],"mappings":";;;;;AAqBO,SAAS,aAA6B;AAC3C,SAAO;AAAA,IACL,kBACE,MACoB;AACpB,aAAO,IAAI;AAAA,QACT,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA;AAAA,QACL,KAAK;AAAA;AAAA,QACL,KAAK;AAAA;AAAA,QACL,KAAK;AAAA;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-5HZULLHE.js → chunk-AUR7MRHA.js}

@@ -2,7 +2,7 @@ import {
   DecryptionError,
   InvalidKeyError,
   TamperedError
-} from "./chunk-OJ64XMPJ.js";
+} from "./chunk-CU62BBRB.js";
 
 // src/kernel/enclave/crypto.ts
 var PBKDF2_ITERATIONS = 6e5;
@@ -401,4 +401,4 @@ export {
   bufferToBase64,
   base64ToBuffer
 };
-//# sourceMappingURL=chunk-5HZULLHE.js.map
+//# sourceMappingURL=chunk-AUR7MRHA.js.map

package/dist/{chunk-YSJG4L4A.js → chunk-AYGZMQP5.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-ZJADGNYF.js";
 import {
   openEnvelopeJson
-} from "./chunk-JIW3Q5JN.js";
+} from "./chunk-XHD3L3JO.js";
 import {
   encrypt
-} from "./chunk-5HZULLHE.js";
+} from "./chunk-AUR7MRHA.js";
 
 // src/with-audit/consent/consent.ts
 var CONSENT_AUDIT_COLLECTION = "_consent_audit";
@@ -72,4 +72,4 @@ export {
   writeConsentEntry,
   loadConsentEntries
 };
-//# sourceMappingURL=chunk-YSJG4L4A.js.map
+//# sourceMappingURL=chunk-AYGZMQP5.js.map

package/dist/chunk-AYGZMQP5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/consent/consent.ts"],"sourcesContent":["/**\n * Consent boundaries — per-access audit log.\n *\n * ```ts\n * const audit = await vault.withConsent(\n *   { purpose: 'quarterly-review', consentHash: '7f3a...' },\n *   async () => {\n *     const invoices = await vault.collection<Invoice>('invoices').list()\n *     return invoices\n *   },\n * )\n *\n * const log = await vault.consentAudit({ since: '2026-01-01T00:00:00Z' })\n * // → entries: { actor, purpose, consentHash, ts, op, collection, id }\n * ```\n *\n * ## Contract\n *\n * Every `get` / `put` / `delete` that happens inside a `withConsent`\n * callback writes one entry to the reserved `_consent_audit`\n * collection. Entries are encrypted with the vault's consent-audit\n * DEK (separate from per-user-collection DEKs so access-log queries\n * don't require unwrapping individual collection keys). Outside a\n * `withConsent` scope, no entries are written — consent is\n * opt-in by design (GDPR Art. 7: *demonstrable*, *specific*\n * consent).\n *\n * ## Why store the hash, not the consent text?\n *\n * The `consentHash` is the sha256 of whatever consent receipt the\n * actor presented (a signed GDPR banner click, a HIPAA authorisation\n * PDF, an API-level `X-Consent-Hash` header). Storing only the hash:\n *\n *   1. Keeps the audit log small and indexable.\n *   2. Preserves zero-knowledge at the adapter — adapters see\n *      ciphertext envelopes of `{ actor, purpose, consentHash, ts,\n *      op, collection, id }`, never the consent record itself.\n *   3. Lets the regulator verify a presented consent doc matches\n *      the logged hash at audit time without the system ever\n *      possessing the doc.\n *\n * ## Concurrency\n *\n * The consent context lives on the {@link Vault} instance. Two\n * concurrent `withConsent` calls on the same Vault would stomp each\n * other — documented limitation; adopters needing per-flight scope\n * should use separate Vault instances or an AsyncLocalStorage shim.\n *\n * @module\n */\nimport type { EncryptedEnvelope, NoydbStore } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\n/** Reserved collection for consent-audit entries. */\nexport const CONSENT_AUDIT_COLLECTION = '_consent_audit'\n\n/**\n * The consent scope active for a block of work. Set via\n * `vault.withConsent()`; observed by the collection's access hooks.\n */\nexport interface ConsentContext {\n  /**\n   * What this access is for. Used by the audit query (`consentAudit\n   * ({ purpose })`) and carried in the stored entry. Free-form; the\n   * regulator or compliance tooling decides the vocabulary.\n   */\n  readonly purpose: string\n  /**\n   * Hex-encoded sha256 of whatever consent artefact the actor\n   * presented. Stored as-is in each entry.\n   */\n  readonly consentHash: string\n}\n\n/**\n * Access operation recorded in an audit entry.\n *\n * Union-widening checklist (I-2) — these three sites widen together or a\n * downstream exhaustive switch breaks at its next in-range minor:\n *   1. `ConsentOp` here (public, re-exported at `index.ts`).\n *   2. `onAccess` op union on `kernel/collection-config.ts`.\n *   3. classified ctx `onAccess` op union on `port/with/classified-strategy.ts`\n *      (the `ClassifiedVerifyCtx` one — the `ClassifiedRevealCtx` one stays `'reveal'`-only).\n */\nexport type ConsentOp = 'get' | 'put' | 'delete' | 'reveal' | 'verify' | 'find'\n\n/** One consent-audit record, as decrypted for the caller. */\nexport interface ConsentAuditEntry {\n  /** ULID — stable insertion-order key. */\n  readonly id: string\n  readonly timestamp: string\n  readonly actor: string\n  readonly purpose: string\n  readonly consentHash: string\n  readonly op: ConsentOp\n  readonly collection: string\n  readonly recordId: string\n}\n\n/** Filter passed to `vault.consentAudit()`. */\nexport interface ConsentAuditFilter {\n  /** Only entries at or after this ISO timestamp. */\n  readonly since?: string\n  /** Only entries at or before this ISO timestamp. */\n  readonly until?: string\n  /** Match entries targeting this collection. */\n  readonly collection?: string\n  /** Match entries written by this actor. */\n  readonly actor?: string\n  /** Match entries with this purpose. */\n  readonly purpose?: string\n}\n\n/**\n * Write one audit entry. Called by Vault's onAccess hook when a\n * consent context is active.\n */\nexport async function writeConsentEntry(\n  adapter: NoydbStore,\n  vault: string,\n  encrypted: boolean,\n  entry: Omit<ConsentAuditEntry, 'id' | 'timestamp'>,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<void> {\n  const id = generateULID()\n  const full: ConsentAuditEntry = {\n    id,\n    timestamp: new Date().toISOString(),\n    ...entry,\n  }\n  const envelope = await buildEnvelope(full, encrypted, getDEK)\n  await adapter.put(vault, CONSENT_AUDIT_COLLECTION, id, envelope)\n}\n\n/** Load + decrypt + filter all entries. */\nexport async function loadConsentEntries(\n  adapter: NoydbStore,\n  vault: string,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  filter: ConsentAuditFilter = {},\n): Promise<ConsentAuditEntry[]> {\n  const ids = await adapter.list(vault, CONSENT_AUDIT_COLLECTION)\n  const entries: ConsentAuditEntry[] = []\n\n  for (const id of ids.sort()) {\n    const envelope = await adapter.get(vault, CONSENT_AUDIT_COLLECTION, id)\n    if (!envelope) continue\n    const entry = await decryptEntry(envelope, encrypted, getDEK)\n    if (!matchesFilter(entry, filter)) continue\n    entries.push(entry)\n  }\n  return entries\n}\n\n// ── internals ──────────────────────────────────────────────────────\n\nasync function buildEnvelope(\n  entry: ConsentAuditEntry,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<EncryptedEnvelope> {\n  const json = JSON.stringify(entry)\n  if (!encrypted) {\n    return {\n      _noydb: 1,\n      _v: 1,\n      _ts: entry.timestamp,\n      _iv: '',\n      _data: json,\n    }\n  }\n  const dek = await getDEK(CONSENT_AUDIT_COLLECTION)\n  const { iv, data } = await encrypt(json, dek)\n  return {\n    _noydb: 1,\n    _v: 1,\n    _ts: entry.timestamp,\n    _iv: iv,\n    _data: data,\n  }\n}\n\nasync function decryptEntry(\n  envelope: EncryptedEnvelope,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<ConsentAuditEntry> {\n  if (!encrypted) return JSON.parse(envelope._data) as ConsentAuditEntry\n  const json = await openEnvelopeJson(envelope, await getDEK(CONSENT_AUDIT_COLLECTION))\n  return JSON.parse(json) as ConsentAuditEntry\n}\n\nfunction matchesFilter(entry: ConsentAuditEntry, f: ConsentAuditFilter): boolean {\n  if (f.since && entry.timestamp < f.since) return false\n  if (f.until && entry.timestamp > f.until) return false\n  if (f.collection && entry.collection !== f.collection) return false\n  if (f.actor && entry.actor !== f.actor) return false\n  if (f.purpose && entry.purpose !== f.purpose) return false\n  return true\n}\n"],"mappings":";;;;;;;;;;;AAuDO,IAAM,2BAA2B;AA+DxC,eAAsB,kBACpB,SACA,OACA,WACA,OACA,QACe;AACf,QAAM,KAAK,aAAa;AACxB,QAAM,OAA0B;AAAA,IAC9B;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,GAAG;AAAA,EACL;AACA,QAAM,WAAW,MAAM,cAAc,MAAM,WAAW,MAAM;AAC5D,QAAM,QAAQ,IAAI,OAAO,0BAA0B,IAAI,QAAQ;AACjE;AAGA,eAAsB,mBACpB,SACA,OACA,WACA,QACA,SAA6B,CAAC,GACA;AAC9B,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,wBAAwB;AAC9D,QAAM,UAA+B,CAAC;AAEtC,aAAW,MAAM,IAAI,KAAK,GAAG;AAC3B,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,0BAA0B,EAAE;AACtE,QAAI,CAAC,SAAU;AACf,UAAM,QAAQ,MAAM,aAAa,UAAU,WAAW,MAAM;AAC5D,QAAI,CAAC,cAAc,OAAO,MAAM,EAAG;AACnC,YAAQ,KAAK,KAAK;AAAA,EACpB;AACA,SAAO;AACT;AAIA,eAAe,cACb,OACA,WACA,QAC4B;AAC5B,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,KAAK,MAAM;AAAA,MACX,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,KAAK,MAAM;AAAA,IACX,KAAK;AAAA,IACL,OAAO;AAAA,EACT;AACF;AAEA,eAAe,aACb,UACA,WACA,QAC4B;AAC5B,MAAI,CAAC,UAAW,QAAO,KAAK,MAAM,SAAS,KAAK;AAChD,QAAM,OAAO,MAAM,iBAAiB,UAAU,MAAM,OAAO,wBAAwB,CAAC;AACpF,SAAO,KAAK,MAAM,IAAI;AACxB;AAEA,SAAS,cAAc,OAA0B,GAAgC;AAC/E,MAAI,EAAE,SAAS,MAAM,YAAY,EAAE,MAAO,QAAO;AACjD,MAAI,EAAE,SAAS,MAAM,YAAY,EAAE,MAAO,QAAO;AACjD,MAAI,EAAE,cAAc,MAAM,eAAe,EAAE,WAAY,QAAO;AAC9D,MAAI,EAAE,SAAS,MAAM,UAAU,EAAE,MAAO,QAAO;AAC/C,MAAI,EAAE,WAAW,MAAM,YAAY,EAAE,QAAS,QAAO;AACrD,SAAO;AACT;","names":[]}

package/dist/{chunk-H7WQMGXH.js → chunk-CJEMA2Z6.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-UNJU345Q.js";
 
 // src/with-party/team/managed-passphrase.ts
 var MemorySealingKeyProvider = class {
@@ -227,4 +227,4 @@ export {
   loadSealedPassphrase,
   resolveManagedSecret
 };
-//# sourceMappingURL=chunk-H7WQMGXH.js.map
+//# sourceMappingURL=chunk-CJEMA2Z6.js.map

package/dist/{chunk-WRLPV6SI.js → chunk-CTSFKDGA.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-UNJU345Q.js";
 
 // src/with-shape/schema-update/fence.ts
 var FENCE_RECORD_ID = "schema-fence";
@@ -37,4 +37,4 @@ export {
   loadFence,
   saveFence
 };
-//# sourceMappingURL=chunk-WRLPV6SI.js.map
+//# sourceMappingURL=chunk-CTSFKDGA.js.map

package/dist/{chunk-OJ64XMPJ.js → chunk-CU62BBRB.js}

@@ -526,6 +526,17 @@ var IndexWriteFailureError = class extends NoydbError {
     this.cause = args.cause;
   }
 };
+var FieldNotQueryableError = class extends NoydbError {
+  field;
+  constructor(field) {
+    super(
+      "FIELD_NOT_QUERYABLE",
+      `Field "${field}" is not queryable \u2014 its Via feature declares queryable: 'none'.`
+    );
+    this.name = "FieldNotQueryableError";
+    this.field = field;
+  }
+};
 var BundleIntegrityError = class extends NoydbError {
   constructor(message) {
     super("BUNDLE_INTEGRITY", `.noydb bundle integrity check failed: ${message}`);
@@ -678,6 +689,24 @@ var UnknownDictCodeError = class extends NoydbError {
     this.code = code;
   }
 };
+var UnknownLookupKeyError = class extends NoydbError {
+  /** The dimension (dictionary/target collection) name. */
+  dimension;
+  /** The field that carried the unknown key. */
+  field;
+  /** The offending key value. */
+  key;
+  constructor(dimension, field, key) {
+    super(
+      "UNKNOWN_LOOKUP_KEY",
+      `Field "${field}": key "${key}" is not a known member of the "${dimension}" lookup vocabulary (closed). Use a declared/existing key, or declare { vocabulary: 'open' } to allow unknown keys.`
+    );
+    this.name = "UnknownLookupKeyError";
+    this.dimension = dimension;
+    this.field = field;
+    this.key = key;
+  }
+};
 var TranslatorNotConfiguredError = class extends NoydbError {
   /** The field that requested auto-translation. */
   field;
@@ -1359,6 +1388,7 @@ export {
   UniqueConstraintError,
   UnsupportedIndexOptionError,
   IndexWriteFailureError,
+  FieldNotQueryableError,
   BundleIntegrityError,
   BundleSealMismatchError,
   ReservedCollectionNameError,
@@ -1369,6 +1399,7 @@ export {
   ScriptViolationError,
   StaticDictReadonlyError,
   UnknownDictCodeError,
+  UnknownLookupKeyError,
   TranslatorNotConfiguredError,
   BackupLedgerError,
   BackupCorruptedError,
@@ -1431,4 +1462,4 @@ export {
   ClassifiedRotationError,
   SatelliteConfigError
 };
-//# sourceMappingURL=chunk-OJ64XMPJ.js.map
+//# sourceMappingURL=chunk-CU62BBRB.js.map