@noy-db/hub 0.3.0-pre.8 → 0.3.0

package/dist/chunk-FM3G3NOY.js

@@ -0,0 +1,206 @@
+import {
+  putDerivedOutput
+} from "./chunk-4CTHCN4J.js";
+import {
+  wrapDbWithPredicates
+} from "./chunk-KSKBRKGJ.js";
+import {
+  canonicalGroupKey,
+  groupAndReduce
+} from "./chunk-LXEXBTKL.js";
+import {
+  applyI18nLocale
+} from "./chunk-6JTIAGHD.js";
+import {
+  LocaleNotSpecifiedError,
+  MaterializedViewTooLargeError
+} from "./chunk-BIOUI4HL.js";
+
+// src/with-formula/materialized-views/executor.ts
+var DEFAULT_MAX_ROWS = 1e5;
+async function materializeQueryResult(q, mvName, i18nLocale, i18nFields) {
+  if (typeof q?.toArray === "function") {
+    return await q.toArray();
+  }
+  if (typeof q?.run === "function") {
+    const runOpts = i18nLocale !== void 0 ? { locale: i18nLocale, i18nFields } : void 0;
+    const result = await Promise.resolve(q.run(runOpts));
+    if (Array.isArray(result)) {
+      return result;
+    }
+    return [result];
+  }
+  throw new Error(
+    `MV "${mvName}": query() must return a Query<T>, Aggregation, or GroupedAggregation. Got something without a .toArray() or .run() terminal.`
+  );
+}
+async function materializeUnionResult(spec, db) {
+  const unified = [];
+  for (const arm of spec.unionSources) {
+    const coll = db.collection(arm.collection);
+    let q = coll.query();
+    if (arm.join?.length) {
+      for (const leg of arm.join) {
+        q = q.join(leg.field, { as: leg.as, maxRows: leg.maxRows, strategy: leg.strategy });
+      }
+    }
+    const sourceRows = q.toArray();
+    for (const r of sourceRows) {
+      const mapped = arm.map(r);
+      if (mapped == null) continue;
+      unified.push(mapped);
+    }
+  }
+  if (!spec.groupBy) return unified;
+  const groupFields = typeof spec.groupBy === "string" ? [spec.groupBy] : spec.groupBy;
+  if (spec.i18nLocale !== void 0 && spec.i18nFields !== void 0) {
+    const groupI18n = {};
+    for (const f of groupFields) {
+      const d = spec.i18nFields[f];
+      if (d !== void 0) groupI18n[f] = d;
+    }
+    if (Object.keys(groupI18n).length > 0) {
+      for (let i = 0; i < unified.length; i++) {
+        unified[i] = applyI18nLocale(unified[i], groupI18n, spec.i18nLocale, void 0, "mv");
+      }
+    }
+  }
+  for (const f of groupFields) {
+    for (const row of unified) {
+      const v = row[f];
+      if (v !== null && typeof v === "object") {
+        throw new LocaleNotSpecifiedError(
+          f,
+          `Materialized view "${spec.name}" groups by "${f}", whose value is a raw i18n locale map \u2014 an unstable object group key. Declare { i18nLocale, i18nFields } on the MV to resolve it at the 'mv' layer, or group by a dictKey/staticDict code (the stable key) and resolve the label at read time.`
+        );
+      }
+    }
+  }
+  if (!spec.aggregate) {
+    const seen = /* @__PURE__ */ new Map();
+    for (const row of unified) {
+      const k = canonicalGroupKey(groupFields, row);
+      if (!seen.has(k)) seen.set(k, row);
+    }
+    return [...seen.values()];
+  }
+  return groupAndReduce(unified, groupFields, spec.aggregate, spec.moneyFields);
+}
+var MaterializedViewExecutor = {
+  async refresh(reg, accessor) {
+    const spec = reg.spec;
+    const outputColl = accessor.getCollection(reg.outputCollection);
+    const maxRows = spec.maxRows ?? DEFAULT_MAX_ROWS;
+    const onEmpty = spec.onEmpty ?? "delete";
+    const strict = spec.strict ?? false;
+    const baseCtx = accessor.getQueryContext();
+    const ctxForQuery = spec.predicates ? wrapDbWithPredicates(baseCtx, spec.predicates) : baseCtx;
+    let rows;
+    if (spec.unionSources) {
+      rows = await materializeUnionResult(spec, ctxForQuery);
+    } else {
+      const q = spec.query(ctxForQuery);
+      rows = await materializeQueryResult(q, spec.name, spec.i18nLocale, spec.i18nFields);
+    }
+    rows = rows.filter((row) => {
+      const stamp = row._materializedFrom;
+      return stamp?.mvName !== spec.name;
+    });
+    if (rows.length > maxRows) {
+      throw new MaterializedViewTooLargeError(spec.name, rows.length, maxRows);
+    }
+    const txCtx = accessor.getActiveTxContext();
+    const adapter = outputColl.adapter;
+    const vaultName = outputColl.vault;
+    const newIds = /* @__PURE__ */ new Set();
+    const enrichedRows = [];
+    for (const row of rows) {
+      const id = spec.rowKey(row);
+      newIds.add(id);
+      const meta = {
+        mvName: spec.name,
+        queryHash: reg.queryHash,
+        sourceVersions: {},
+        materializedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      enrichedRows.push({ id, record: { ...row, _materializedFrom: meta } });
+    }
+    let written = 0;
+    let failed = 0;
+    for (const { id, record } of enrichedRows) {
+      try {
+        if (txCtx !== null) {
+          const prior = await adapter.get(vaultName, reg.outputCollection, id);
+          txCtx._executed.push({
+            op: { type: "put", vaultName, collectionName: reg.outputCollection, id },
+            priorEnvelope: prior
+          });
+        }
+        if (accessor.dispatchCtx) {
+          if (await putDerivedOutput(outputColl, id, record, accessor.dispatchCtx) === "written") written++;
+        } else {
+          await outputColl.put(id, record);
+          written++;
+        }
+      } catch (err) {
+        failed++;
+        if (strict) throw err;
+        console.warn(`[mv] "${spec.name}" row write failed:`, err);
+      }
+    }
+    let deleted = 0;
+    const residueUndecodable = [];
+    const residueDeclined = [];
+    if (onEmpty === "delete") {
+      const priorIds = await listOutputIds(outputColl);
+      for (const priorId of priorIds) {
+        if (newIds.has(priorId)) continue;
+        const priorEnvelope = await adapter.get(vaultName, reg.outputCollection, priorId);
+        if (priorEnvelope === null) continue;
+        const priorDecoded = await outputColl._decodeEnvelope(priorEnvelope, priorId);
+        if (priorDecoded === null) {
+          residueUndecodable.push(`${reg.outputCollection}:${priorId}`);
+          continue;
+        }
+        const priorStampedBy = typeof priorDecoded === "object" ? priorDecoded._materializedFrom : void 0;
+        if (priorStampedBy?.mvName !== spec.name) continue;
+        try {
+          const outAny = outputColl;
+          if (typeof outAny._internalDelete === "function") {
+            if (await outAny._internalDelete(priorId, txCtx)) {
+              deleted++;
+            } else {
+              residueDeclined.push(`${reg.outputCollection}:${priorId}`);
+            }
+          } else {
+            await outputColl.delete(priorId);
+            deleted++;
+          }
+        } catch (err) {
+          failed++;
+          if (strict) throw err;
+          console.warn(`[mv] "${spec.name}" tombstone failed for id="${priorId}":`, err);
+        }
+      }
+    }
+    return { written, deleted, failed, residueUndecodable, residueDeclined };
+  }
+};
+async function listOutputIds(outputColl) {
+  const cAny = outputColl;
+  const adapter = cAny.adapter;
+  const vault = cAny.vault;
+  const name = cAny.name;
+  if (typeof adapter?.list !== "function") return [];
+  try {
+    const ids = await adapter.list(vault, name);
+    return [...ids];
+  } catch {
+    return [];
+  }
+}
+
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=chunk-FM3G3NOY.js.map

package/dist/chunk-FM3G3NOY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/materialized-views/executor.ts"],"sourcesContent":["import type { Collection } from '../../kernel/collection.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport { MaterializedViewTooLargeError, LocaleNotSpecifiedError } from '../../kernel/errors.js'\nimport type { MaterializedFromMeta, MVQueryContext, MaterializedViewStrategy } from './types.js'\nimport type { RegisteredMV } from './registry.js'\nimport { wrapDbWithPredicates } from './registry.js'\nimport { groupAndReduce } from '../../with-lookup/aggregate/groupby.js'\nimport { canonicalGroupKey } from '../../with-lookup/aggregate/canonical-key.js'\nimport { applyI18nLocale, type I18nTextDescriptor } from '../../via/i18n/core.js'\nimport { putDerivedOutput, type PutDerivedOutputCtx } from '../../kernel/via/dispatch.js'\n\n/**\n * Accessor shape passed in from the owning Vault. Mirrors v1's\n * `DerivationStaleAccessor` — provides the per-collection resolver\n * and the active TxContext so refresh writes/tombstones register on\n * `_executed` for rollback symmetry.\n */\nexport interface MVExecutorAccessor {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  getCollection(name: string): Collection<any>\n  getActiveTxContext(): TxContext | null\n  /**\n   * Vault-shaped accessor passed to the MV's `query()` callback at\n   * each refresh. Same instance the registry used at registration\n   * time; threading through the executor lets the refresh path\n   * re-evaluate the closure against the live vault state.\n   */\n  getQueryContext(): MVQueryContext\n  /**\n   * #638 Task 5 — ctx for `putDerivedOutput`'s frozen-period skip+audit. #641: the lazy\n   * resolve-on-read caller (`stale.ts#resolveStaleMVOnRead`) now supplies one too — built at\n   * the `Collection.get()`/`list()` entry point with a `'resolve-on-read'` sentinel id (no\n   * real \"reacting write\" for a read-triggered materialize, mirroring `refreshView()`'s\n   * `'refreshView'` sentinel). Still declared optional here since `MVExecutorAccessor` is a\n   * general shape and a future caller could reasonably omit it.\n   */\n  dispatchCtx?: PutDerivedOutputCtx\n}\n\nexport interface RefreshResult {\n  /** Rows newly written / overwritten. */\n  written: number\n  /** Rows tombstoned via `_internalDelete` (only when `onEmpty: 'delete'`). */\n  deleted: number\n  /** Failed row writes (non-strict mode). */\n  failed: number\n  /** #782/#785 — `outputCollection:id` entries from the tombstone pass whose ownership stamp\n   *  couldn't be decoded under the collection's default DEK (undecodable, mirroring\n   *  `invalidateMVAtRest`'s #776 posture) — ownership UNCONFIRMED. Only populated when\n   *  `onEmpty: 'delete'`. */\n  residueUndecodable: string[]\n  /** #782/#785 — `outputCollection:id` entries that decoded, stamp-matched this MV, but\n   *  `_internalDelete` declined (the #718 tier-elevation gate) — ownership CONFIRMED, a real\n   *  silent survival, surfaced rather than dropped. Only populated when `onEmpty: 'delete'`. */\n  residueDeclined: string[]\n}\n\n/** Default cost ceiling — overridable per-MV via `spec.maxRows`. */\nconst DEFAULT_MAX_ROWS = 100_000\n\n/**\n * Materialize a query terminal that may be a `Query<T>` (call\n * `.toArray()`), an `Aggregation<R>` (call `.run()` returning a\n * single object — wrap as a one-row array), or a `GroupedAggregation<R>`\n * (call `.run()` returning an array of grouped rows). Branches on\n * available terminal at runtime — no type-discrimination at registration.\n */\nasync function materializeQueryResult(\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  q: any,\n  mvName: string,\n  i18nLocale?: string,\n  i18nFields?: Record<string, I18nTextDescriptor>,\n): Promise<ReadonlyArray<Record<string, unknown>>> {\n  if (typeof q?.toArray === 'function') {\n    // Query<T> — non-aggregate path. `.toArray()` returns Promise<T[]>.\n    return await q.toArray()\n  }\n  if (typeof q?.run === 'function') {\n    // Aggregation<R> or GroupedAggregation<R>. `.run()` is synchronous\n    // and returns either a single object (Aggregation) or an array of\n    // rows (GroupedAggregation). Promise.resolve() normalizes both\n    // sync and async (future) variants.\n    // Query-form MV grouping: when the MV declares i18nLocale, pass it +\n    // i18nFields so a GroupedAggregation resolves i18n group keys before\n    // bucketing (the Aggregation path ignores the extra arg).\n    const runOpts = i18nLocale !== undefined ? { locale: i18nLocale, i18nFields } : undefined\n    const result: unknown = await Promise.resolve(q.run(runOpts))\n    if (Array.isArray(result)) {\n      return result as ReadonlyArray<Record<string, unknown>>\n    }\n    // Single-aggregate result — wrap as one-row array. The consumer's\n    // `rowKey()` should return a stable identity (often a literal\n    // constant like `'total'`) since there's only one row.\n    return [result as Record<string, unknown>]\n  }\n  throw new Error(\n    `MV \"${mvName}\": query() must return a Query<T>, Aggregation, or GroupedAggregation. ` +\n      `Got something without a .toArray() or .run() terminal.`,\n  )\n}\n\n/**\n * Materialize a UNION-form MV: read every arm's source\n * collection, apply each arm's `map` to project rows into the unified\n * MV row shape, concatenate the mapped streams, then optionally run\n * `groupBy` + `aggregate` over the result.\n *\n * Modes (driven by `spec.groupBy` / `spec.aggregate`):\n *\n *   - No `groupBy` → return the concatenated mapped rows unchanged.\n *   - `groupBy` without `aggregate` → dedupe by composite group key,\n *     keep the first row seen per key (later arms don't overwrite\n *     earlier arms — Map insertion order rules).\n *   - `groupBy` + `aggregate` → delegate to the shared `groupAndReduce`\n *     pipeline used by `Query.groupBy().aggregate()`.\n *\n * Per-arm `map` is the schema-unification boundary; the strategy's\n * `TRow` type parameter enforces that every arm projects into the\n * same shape at compile time.\n *\n * @internal\n */\nasync function materializeUnionResult<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewStrategy<TRow>,\n  db: MVQueryContext,\n): Promise<ReadonlyArray<Record<string, unknown>>> {\n  const unified: TRow[] = []\n  for (const arm of spec.unionSources!) {\n    const coll = db.collection<Record<string, unknown>>(arm.collection)\n    // Optional per-arm FK joins: chain `.join(field, { as, ... })` for\n    // each declared leg before terminating. The aliased right-side\n    // record lands at `sourceRow[leg.as]`, where the arm's `map` reads\n    // it. Cast to `any` because the chained join widens the row type but\n    // the executor treats every row as `Record<string, unknown>` — same\n    // pattern the query-form join path uses.\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    let q: any = coll.query()\n    if (arm.join?.length) {\n      for (const leg of arm.join) {\n        q = q.join(leg.field, { as: leg.as, maxRows: leg.maxRows, strategy: leg.strategy })\n      }\n    }\n    const sourceRows = q.toArray() as ReadonlyArray<Record<string, unknown>>\n    for (const r of sourceRows) {\n      const mapped = arm.map(r)\n      // null / undefined means \"omit this source row\" — skip without\n      // pushing so groupBy/aggregate never see a null entry.\n      if (mapped == null) continue\n      unified.push(mapped)\n    }\n  }\n\n  if (!spec.groupBy) return unified\n\n  const groupFields: readonly string[] =\n    typeof spec.groupBy === 'string' ? [spec.groupBy] : spec.groupBy\n\n  // i18n-aware group keys. An `i18nText` group field carries a raw\n  // `{ locale: string }` map, an unstable object key. When `i18nLocale` is\n  // declared (with `i18nFields` describing those fields), resolve the declared\n  // group-key i18n fields to it at the `mv` layer FIRST — the same unified-rows\n  // boundary where money is threaded — so buckets are stable strings and the\n  // `mv`-layer `onMissing` policy fires here.\n  if (spec.i18nLocale !== undefined && spec.i18nFields !== undefined) {\n    const groupI18n: Record<string, I18nTextDescriptor> = {}\n    for (const f of groupFields) {\n      const d = spec.i18nFields[f]\n      if (d !== undefined) groupI18n[f] = d\n    }\n    if (Object.keys(groupI18n).length > 0) {\n      for (let i = 0; i < unified.length; i++) {\n        unified[i] = applyI18nLocale(unified[i] as Record<string, unknown>, groupI18n, spec.i18nLocale, undefined, 'mv') as TRow\n      }\n    }\n  }\n  // Guard (always): a remaining object-valued group key — an undeclared i18n\n  // field or a locale-less MV — would bucket on a map. Refuse, don't bucket wrong.\n  for (const f of groupFields) {\n    for (const row of unified) {\n      const v = (row as Record<string, unknown>)[f]\n      if (v !== null && typeof v === 'object') {\n        throw new LocaleNotSpecifiedError(\n          f,\n          `Materialized view \"${spec.name}\" groups by \"${f}\", whose value is a raw i18n locale map — ` +\n            `an unstable object group key. Declare { i18nLocale, i18nFields } on the MV to resolve it at ` +\n            `the 'mv' layer, or group by a dictKey/staticDict code (the stable key) and resolve the label at read time.`,\n        )\n      }\n    }\n  }\n\n  // groupBy without aggregate — dedupe by composite key, keep first\n  // seen row per key. Useful for cross-arm uniqueness (e.g. unify two\n  // sibling collections, keeping one row per natural key).\n  if (!spec.aggregate) {\n    const seen = new Map<string, TRow>()\n    for (const row of unified) {\n      const k = canonicalGroupKey(groupFields, row as Record<string, unknown>)\n      if (!seen.has(k)) seen.set(k, row)\n    }\n    return [...seen.values()]\n  }\n\n  // groupBy + aggregate — delegate to the shared pipeline used by\n  // `Query.groupBy().aggregate()`. Result rows carry each grouped\n  // field in declaration order followed by the spec's reducer outputs.\n  return groupAndReduce<Record<string, unknown>>(unified, groupFields, spec.aggregate, spec.moneyFields)\n}\n\n/**\n * Run an MV's `query()` and write the result rows to the output\n * collection. Same-DEK encryption: routes through the standard\n * `Collection.put` pipeline, so the output collection's DEK is what\n * gets used (matches the v2 spec's \"same DEK as the left-most source\"\n * invariant — `Collection.put` looks up the DEK by collection name,\n * and the output collection IS the MV's owned collection).\n *\n * Stamps `_materializedFrom` onto every emitted row.\n *\n * **Tombstoning:** when `spec.onEmpty: 'delete'` (default), rows\n * that existed in a prior refresh but no longer appear in the new\n * materialized result are deleted via `Collection._internalDelete` —\n * the housekeeping bypass primitive prevents user\n * `onDelete` guards on the output collection from firing on these\n * system-internal deletes. `onEmpty: 'keep'` opts out (rows from\n * prior refreshes linger even when the new result lacks them).\n *\n * **Cost ceiling:** if the materialized row count exceeds\n * `spec.maxRows` (default 100k), throws `MaterializedViewTooLargeError`\n * before any writes hit the store — so strict-mode rollback is\n * clean.\n *\n * **Strict mode:** `spec.strict === true` re-throws on any\n * row-write failure; the active TxContext registration means the\n * source-write rolls back atomically via `revertExecuted`.\n *\n * @internal\n */\nexport const MaterializedViewExecutor = {\n  async refresh(\n    reg: RegisteredMV,\n    accessor: MVExecutorAccessor,\n  ): Promise<RefreshResult> {\n    const spec = reg.spec\n    const outputColl = accessor.getCollection(reg.outputCollection)\n    const maxRows = spec.maxRows ?? DEFAULT_MAX_ROWS\n    const onEmpty = spec.onEmpty ?? 'delete'\n    const strict = spec.strict ?? false\n\n    // 1. Materialize the query (branches on terminal shape). If the\n    //    MV declared predicates, wrap the query context the same way\n    //    the registry did at registration time so `.wherePredicate()`\n    //    calls resolve to the registered functions.\n    const baseCtx = accessor.getQueryContext()\n    const ctxForQuery: MVQueryContext = spec.predicates\n      ? wrapDbWithPredicates(baseCtx, spec.predicates)\n      : baseCtx\n    // UNION-form strategies: read every arm, map to the unified\n    // row shape, concatenate, then optionally groupBy + aggregate. The\n    // single-source `query()` path is untouched.\n    let rows: ReadonlyArray<Record<string, unknown>>\n    if (spec.unionSources) {\n      rows = await materializeUnionResult(spec, ctxForQuery)\n    } else {\n      const q = spec.query!(ctxForQuery)\n      rows = await materializeQueryResult(q, spec.name, spec.i18nLocale, spec.i18nFields)\n    }\n\n    // #777 — exclude this MV's OWN previously-stamped output rows from the\n    // input scan. A same-collection Query-form MV copies the whole source row\n    // verbatim into its output, so a stale output row can itself satisfy the\n    // MV's own input filter (when the filter is on a field disjoint from the\n    // partition field) and get re-selected as if it were live source — the\n    // row self-perpetuates after its true source is gone. Prior output is\n    // never this MV's own source.\n    rows = rows.filter((row) => {\n      const stamp = row._materializedFrom as { mvName?: string } | undefined\n      return stamp?.mvName !== spec.name\n    })\n\n    // 2. Cost ceiling check BEFORE any writes — keeps the rollback\n    //    clean if the source-write is wrapped in a transaction.\n    if (rows.length > maxRows) {\n      throw new MaterializedViewTooLargeError(spec.name, rows.length, maxRows)\n    }\n\n    const txCtx = accessor.getActiveTxContext()\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const adapter = (outputColl as any).adapter as {\n      get(v: string, c: string, i: string): Promise<EncryptedEnvelope | null>\n    }\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const vaultName = (outputColl as any).vault as string\n\n    // 3. Compute the post-refresh id set so we can diff against the\n    //    prior-emitted id set for tombstoning (when onEmpty === 'delete').\n    const newIds = new Set<string>()\n    const enrichedRows: Array<{ id: string; record: Record<string, unknown> }> = []\n    for (const row of rows) {\n      const id = spec.rowKey(row)\n      newIds.add(id)\n      const meta: MaterializedFromMeta = {\n        mvName: spec.name,\n        queryHash: reg.queryHash,\n        sourceVersions: {},\n        materializedAt: new Date().toISOString(),\n      }\n      enrichedRows.push({ id, record: { ...row, _materializedFrom: meta } })\n    }\n\n    // 4. Write the new rows.\n    let written = 0\n    let failed = 0\n    for (const { id, record } of enrichedRows) {\n      try {\n        if (txCtx !== null) {\n          const prior = await adapter.get(vaultName, reg.outputCollection, id)\n          txCtx._executed.push({\n            op: { type: 'put', vaultName, collectionName: reg.outputCollection, id },\n            priorEnvelope: prior,\n          })\n        }\n        if (accessor.dispatchCtx) {\n          if (await putDerivedOutput(outputColl, id, record, accessor.dispatchCtx) === 'written') written++\n        } else {\n          await outputColl.put(id, record)\n          written++\n        }\n      } catch (err) {\n        failed++\n        if (strict) throw err\n         \n        console.warn(`[mv] \"${spec.name}\" row write failed:`, err)\n      }\n    }\n\n    // 5. Tombstone rows that existed before but don't appear now.\n    //    `onEmpty: 'keep'` skips this pass entirely. Uses\n    //    `_internalDelete` so a user-registered `onDelete` on the\n    //    output collection does NOT fire on housekeeping (composition fix).\n    let deleted = 0\n    const residueUndecodable: string[] = []\n    const residueDeclined: string[] = []\n    if (onEmpty === 'delete') {\n      const priorIds = await listOutputIds(outputColl)\n      for (const priorId of priorIds) {\n        if (newIds.has(priorId)) continue\n        // #762 — a same-collection partition MV (`output: { collection: <source>, partition }`,\n        // the DERIV-PP30-001 shape) writes INTO its own source collection, so `listOutputIds`\n        // also returns untouched USER source rows here. Decode each candidate and only\n        // tombstone rows THIS MV stamped via `_materializedFrom.mvName` — the exact discipline\n        // `invalidateMVAtRest` uses (stale.ts:151-162). An unstamped row, or one stamped by a\n        // different MV, is never this MV's to delete.\n        const priorEnvelope = await adapter.get(vaultName, reg.outputCollection, priorId)\n        if (priorEnvelope === null) continue\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        const priorDecoded = await (outputColl as any)._decodeEnvelope(priorEnvelope, priorId)\n        if (priorDecoded === null) {\n          // #782 part a — ownership unknown (undecodable, e.g. elevated above tier 0 on a\n          // tiered output collection): can't rule out this being THIS MV's own stamped row.\n          // Surface it rather than silently skip (mirrors invalidateMVAtRest's #776 posture —\n          // previously this leg had NO residue channel at all).\n          residueUndecodable.push(`${reg.outputCollection}:${priorId}`)\n          continue\n        }\n        const priorStampedBy =\n          typeof priorDecoded === 'object'\n            ? (priorDecoded as Record<string, unknown>)._materializedFrom as { mvName?: string } | undefined\n            : undefined\n        if (priorStampedBy?.mvName !== spec.name) continue\n        try {\n          // eslint-disable-next-line @typescript-eslint/no-explicit-any\n          const outAny = outputColl as any\n          if (typeof outAny._internalDelete === 'function') {\n            // #776 part b — gate on the boolean, matching invalidateMVAtRest's discipline\n            // (stale.ts): `_internalDelete` returns `false` for a #718 elevated-skip (no\n            // erasure happened), and that must not inflate the tombstone count.\n            if (await outAny._internalDelete(priorId, txCtx)) {\n              deleted++\n            } else {\n              // #782 part b — decoded AND stamp-owned, but erasure was declined (#718\n              // tier-elevation gate). Ownership IS confirmed here — a real silent survival,\n              // not a legit stamp-mismatch skip. Surface it too.\n              residueDeclined.push(`${reg.outputCollection}:${priorId}`)\n            }\n          } else {\n            // Defensive fallback — should never hit in real flow since\n            // every Collection has `_internalDelete`.\n            await outputColl.delete(priorId)\n            deleted++\n          }\n        } catch (err) {\n          failed++\n          if (strict) throw err\n\n          console.warn(`[mv] \"${spec.name}\" tombstone failed for id=\"${priorId}\":`, err)\n        }\n      }\n    }\n\n    return { written, deleted, failed, residueUndecodable, residueDeclined }\n  },\n}\n\n/**\n * List ids currently present in the MV's output collection via the\n * adapter directly (avoids triggering the lazy resolve-on-read path\n * we're INSIDE). Returns an empty array if the collection doesn't\n * exist or the adapter doesn't surface a list method.\n *\n * @internal\n */\nasync function listOutputIds(\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  outputColl: Collection<any>,\n): Promise<string[]> {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const cAny = outputColl as any\n  const adapter = cAny.adapter as { list?: (v: string, c: string) => Promise<readonly string[]> }\n  const vault = cAny.vault as string\n  const name = cAny.name as string\n  if (typeof adapter?.list !== 'function') return []\n  try {\n    const ids = await adapter.list(vault, name)\n    return [...ids]\n  } catch {\n    return []\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA2DA,IAAM,mBAAmB;AASzB,eAAe,uBAEb,GACA,QACA,YACA,YACiD;AACjD,MAAI,OAAO,GAAG,YAAY,YAAY;AAEpC,WAAO,MAAM,EAAE,QAAQ;AAAA,EACzB;AACA,MAAI,OAAO,GAAG,QAAQ,YAAY;AAQhC,UAAM,UAAU,eAAe,SAAY,EAAE,QAAQ,YAAY,WAAW,IAAI;AAChF,UAAM,SAAkB,MAAM,QAAQ,QAAQ,EAAE,IAAI,OAAO,CAAC;AAC5D,QAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,aAAO;AAAA,IACT;AAIA,WAAO,CAAC,MAAiC;AAAA,EAC3C;AACA,QAAM,IAAI;AAAA,IACR,OAAO,MAAM;AAAA,EAEf;AACF;AAuBA,eAAe,uBACb,MACA,IACiD;AACjD,QAAM,UAAkB,CAAC;AACzB,aAAW,OAAO,KAAK,cAAe;AACpC,UAAM,OAAO,GAAG,WAAoC,IAAI,UAAU;AAQlE,QAAI,IAAS,KAAK,MAAM;AACxB,QAAI,IAAI,MAAM,QAAQ;AACpB,iBAAW,OAAO,IAAI,MAAM;AAC1B,YAAI,EAAE,KAAK,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,SAAS,IAAI,SAAS,UAAU,IAAI,SAAS,CAAC;AAAA,MACpF;AAAA,IACF;AACA,UAAM,aAAa,EAAE,QAAQ;AAC7B,eAAW,KAAK,YAAY;AAC1B,YAAM,SAAS,IAAI,IAAI,CAAC;AAGxB,UAAI,UAAU,KAAM;AACpB,cAAQ,KAAK,MAAM;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,CAAC,KAAK,QAAS,QAAO;AAE1B,QAAM,cACJ,OAAO,KAAK,YAAY,WAAW,CAAC,KAAK,OAAO,IAAI,KAAK;AAQ3D,MAAI,KAAK,eAAe,UAAa,KAAK,eAAe,QAAW;AAClE,UAAM,YAAgD,CAAC;AACvD,eAAW,KAAK,aAAa;AAC3B,YAAM,IAAI,KAAK,WAAW,CAAC;AAC3B,UAAI,MAAM,OAAW,WAAU,CAAC,IAAI;AAAA,IACtC;AACA,QAAI,OAAO,KAAK,SAAS,EAAE,SAAS,GAAG;AACrC,eAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,gBAAQ,CAAC,IAAI,gBAAgB,QAAQ,CAAC,GAA8B,WAAW,KAAK,YAAY,QAAW,IAAI;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AAGA,aAAW,KAAK,aAAa;AAC3B,eAAW,OAAO,SAAS;AACzB,YAAM,IAAK,IAAgC,CAAC;AAC5C,UAAI,MAAM,QAAQ,OAAO,MAAM,UAAU;AACvC,cAAM,IAAI;AAAA,UACR;AAAA,UACA,sBAAsB,KAAK,IAAI,gBAAgB,CAAC;AAAA,QAGlD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAKA,MAAI,CAAC,KAAK,WAAW;AACnB,UAAM,OAAO,oBAAI,IAAkB;AACnC,eAAW,OAAO,SAAS;AACzB,YAAM,IAAI,kBAAkB,aAAa,GAA8B;AACvE,UAAI,CAAC,KAAK,IAAI,CAAC,EAAG,MAAK,IAAI,GAAG,GAAG;AAAA,IACnC;AACA,WAAO,CAAC,GAAG,KAAK,OAAO,CAAC;AAAA,EAC1B;AAKA,SAAO,eAAwC,SAAS,aAAa,KAAK,WAAW,KAAK,WAAW;AACvG;AA+BO,IAAM,2BAA2B;AAAA,EACtC,MAAM,QACJ,KACA,UACwB;AACxB,UAAM,OAAO,IAAI;AACjB,UAAM,aAAa,SAAS,cAAc,IAAI,gBAAgB;AAC9D,UAAM,UAAU,KAAK,WAAW;AAChC,UAAM,UAAU,KAAK,WAAW;AAChC,UAAM,SAAS,KAAK,UAAU;AAM9B,UAAM,UAAU,SAAS,gBAAgB;AACzC,UAAM,cAA8B,KAAK,aACrC,qBAAqB,SAAS,KAAK,UAAU,IAC7C;AAIJ,QAAI;AACJ,QAAI,KAAK,cAAc;AACrB,aAAO,MAAM,uBAAuB,MAAM,WAAW;AAAA,IACvD,OAAO;AACL,YAAM,IAAI,KAAK,MAAO,WAAW;AACjC,aAAO,MAAM,uBAAuB,GAAG,KAAK,MAAM,KAAK,YAAY,KAAK,UAAU;AAAA,IACpF;AASA,WAAO,KAAK,OAAO,CAAC,QAAQ;AAC1B,YAAM,QAAQ,IAAI;AAClB,aAAO,OAAO,WAAW,KAAK;AAAA,IAChC,CAAC;AAID,QAAI,KAAK,SAAS,SAAS;AACzB,YAAM,IAAI,8BAA8B,KAAK,MAAM,KAAK,QAAQ,OAAO;AAAA,IACzE;AAEA,UAAM,QAAQ,SAAS,mBAAmB;AAE1C,UAAM,UAAW,WAAmB;AAIpC,UAAM,YAAa,WAAmB;AAItC,UAAM,SAAS,oBAAI,IAAY;AAC/B,UAAM,eAAuE,CAAC;AAC9E,eAAW,OAAO,MAAM;AACtB,YAAM,KAAK,KAAK,OAAO,GAAG;AAC1B,aAAO,IAAI,EAAE;AACb,YAAM,OAA6B;AAAA,QACjC,QAAQ,KAAK;AAAA,QACb,WAAW,IAAI;AAAA,QACf,gBAAgB,CAAC;AAAA,QACjB,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAAA,MACzC;AACA,mBAAa,KAAK,EAAE,IAAI,QAAQ,EAAE,GAAG,KAAK,mBAAmB,KAAK,EAAE,CAAC;AAAA,IACvE;AAGA,QAAI,UAAU;AACd,QAAI,SAAS;AACb,eAAW,EAAE,IAAI,OAAO,KAAK,cAAc;AACzC,UAAI;AACF,YAAI,UAAU,MAAM;AAClB,gBAAM,QAAQ,MAAM,QAAQ,IAAI,WAAW,IAAI,kBAAkB,EAAE;AACnE,gBAAM,UAAU,KAAK;AAAA,YACnB,IAAI,EAAE,MAAM,OAAO,WAAW,gBAAgB,IAAI,kBAAkB,GAAG;AAAA,YACvE,eAAe;AAAA,UACjB,CAAC;AAAA,QACH;AACA,YAAI,SAAS,aAAa;AACxB,cAAI,MAAM,iBAAiB,YAAY,IAAI,QAAQ,SAAS,WAAW,MAAM,UAAW;AAAA,QAC1F,OAAO;AACL,gBAAM,WAAW,IAAI,IAAI,MAAM;AAC/B;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ;AACA,YAAI,OAAQ,OAAM;AAElB,gBAAQ,KAAK,SAAS,KAAK,IAAI,uBAAuB,GAAG;AAAA,MAC3D;AAAA,IACF;AAMA,QAAI,UAAU;AACd,UAAM,qBAA+B,CAAC;AACtC,UAAM,kBAA4B,CAAC;AACnC,QAAI,YAAY,UAAU;AACxB,YAAM,WAAW,MAAM,cAAc,UAAU;AAC/C,iBAAW,WAAW,UAAU;AAC9B,YAAI,OAAO,IAAI,OAAO,EAAG;AAOzB,cAAM,gBAAgB,MAAM,QAAQ,IAAI,WAAW,IAAI,kBAAkB,OAAO;AAChF,YAAI,kBAAkB,KAAM;AAE5B,cAAM,eAAe,MAAO,WAAmB,gBAAgB,eAAe,OAAO;AACrF,YAAI,iBAAiB,MAAM;AAKzB,6BAAmB,KAAK,GAAG,IAAI,gBAAgB,IAAI,OAAO,EAAE;AAC5D;AAAA,QACF;AACA,cAAM,iBACJ,OAAO,iBAAiB,WACnB,aAAyC,oBAC1C;AACN,YAAI,gBAAgB,WAAW,KAAK,KAAM;AAC1C,YAAI;AAEF,gBAAM,SAAS;AACf,cAAI,OAAO,OAAO,oBAAoB,YAAY;AAIhD,gBAAI,MAAM,OAAO,gBAAgB,SAAS,KAAK,GAAG;AAChD;AAAA,YACF,OAAO;AAIL,8BAAgB,KAAK,GAAG,IAAI,gBAAgB,IAAI,OAAO,EAAE;AAAA,YAC3D;AAAA,UACF,OAAO;AAGL,kBAAM,WAAW,OAAO,OAAO;AAC/B;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AACZ;AACA,cAAI,OAAQ,OAAM;AAElB,kBAAQ,KAAK,SAAS,KAAK,IAAI,8BAA8B,OAAO,MAAM,GAAG;AAAA,QAC/E;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,SAAS,SAAS,QAAQ,oBAAoB,gBAAgB;AAAA,EACzE;AACF;AAUA,eAAe,cAEb,YACmB;AAEnB,QAAM,OAAO;AACb,QAAM,UAAU,KAAK;AACrB,QAAM,QAAQ,KAAK;AACnB,QAAM,OAAO,KAAK;AAClB,MAAI,OAAO,SAAS,SAAS,WAAY,QAAO,CAAC;AACjD,MAAI;AACF,UAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI;AAC1C,WAAO,CAAC,GAAG,GAAG;AAAA,EAChB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;","names":[]}

package/dist/chunk-FUG4SFN3.js

@@ -0,0 +1,36 @@
+import {
+  LookupHandle
+} from "./chunk-NJ4EOKMB.js";
+
+// src/via/lookup/active.ts
+function withLookup() {
+  return {
+    buildLookupHandle(opts) {
+      return new LookupHandle(
+        opts.adapter,
+        opts.compartmentName,
+        opts.dimensionName,
+        opts.keyring,
+        opts.reservedEnvelopes,
+        opts.encrypted,
+        opts.ledger,
+        opts.options,
+        opts.findAndUpdateReferences,
+        opts.emitter,
+        opts.buildDeleteMarker,
+        // #647 fix wave 1
+        opts.onDirty,
+        // #650 Task 4
+        opts.onRecordMutated,
+        // #650 Task 4
+        opts.checkReferencesOnDelete
+        // #650 Task 5
+      );
+    }
+  };
+}
+
+export {
+  withLookup
+};
+//# sourceMappingURL=chunk-FUG4SFN3.js.map

package/dist/chunk-FUG4SFN3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/via/lookup/active.ts"],"sourcesContent":["/**\n * Active lookup strategy — `withLookup()` returns the real implementation\n * that constructs `LookupHandle` instances (the `_dict_*` / future\n * `_lookup_*` reserved-collection engine).\n *\n * #650 Task 1 (via-lookup extraction, phase D): this is the new home for\n * the handle-construction logic that used to live inline in\n * `via/i18n/active.ts`'s `withI18n().buildDictionaryHandle`, which\n * now delegates here (same handle, new home — see that file). Splitting\n * the import chain through this file is the same `#553` tree-shake seam\n * `via/i18n/active.ts` already used: the `LookupHandle` engine only\n * ships in a consumer's bundle once something reaches `withLookup()` (today\n * that's transitively via `withI18n()`; later phase-D tasks may call it\n * directly).\n *\n * @public\n */\n\nimport type { LookupStrategy, BuildLookupHandleOptions } from '../../port/with/lookup-strategy.js'\nimport { LookupHandle } from './handle.js'\n\nexport function withLookup(): LookupStrategy {\n  return {\n    buildLookupHandle<Keys extends string = string>(\n      opts: BuildLookupHandleOptions<Keys>,\n    ): LookupHandle<Keys> {\n      return new LookupHandle<Keys>(\n        opts.adapter,\n        opts.compartmentName,\n        opts.dimensionName,\n        opts.keyring,\n        opts.reservedEnvelopes,\n        opts.encrypted,\n        opts.ledger,\n        opts.options,\n        opts.findAndUpdateReferences,\n        opts.emitter,\n        opts.buildDeleteMarker, // #647 fix wave 1\n        opts.onDirty, // #650 Task 4\n        opts.onRecordMutated, // #650 Task 4\n        opts.checkReferencesOnDelete, // #650 Task 5\n      )\n    },\n  }\n}\n"],"mappings":";;;;;AAqBO,SAAS,aAA6B;AAC3C,SAAO;AAAA,IACL,kBACE,MACoB;AACpB,aAAO,IAAI;AAAA,QACT,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA;AAAA,QACL,KAAK;AAAA;AAAA,QACL,KAAK;AAAA;AAAA,QACL,KAAK;AAAA;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-GKEWXIV5.js

@@ -0,0 +1,80 @@
+import {
+  FieldFrozenError,
+  InvariantError
+} from "./chunk-BIOUI4HL.js";
+
+// src/with-audit/guards/executor.ts
+var GuardExecutor = {
+  /**
+   * Compare existing vs incoming for each `frozenFields.fields` entry
+   * when `frozenFields.when(existing)` is true. Throws
+   * `FieldFrozenError` listing every changed frozen field.
+   *
+   * @param skipFields — field names that are schema-owned computed fields.
+   *   These are excluded from the comparison because `incoming` carries the
+   *   raw user input (computed fields not yet evaluated), so comparing
+   *   `existing[field]` vs `incoming[field]` would always look like a
+   *   change even when the computed result is unchanged.
+   */
+  async checkFrozenFields(guard, id, existing, incoming, skipFields) {
+    const ff = guard.frozenFields;
+    if (!ff) return;
+    if (existing === null) return;
+    if (!ff.when(existing)) return;
+    const changed = [];
+    for (const f of ff.fields) {
+      if (skipFields?.has(String(f))) continue;
+      if (existing[f] !== incoming[f]) {
+        if (!deepEqual(existing[f], incoming[f])) changed.push(String(f));
+      }
+    }
+    if (changed.length > 0) {
+      throw new FieldFrozenError(guard.collection, id, changed);
+    }
+  },
+  /**
+   * Run a single guard's invariant over its slice of the change-set.
+   * Any throw is converted to `InvariantError` unless it already is one.
+   */
+  async runInvariant(guard, changes, ctx) {
+    const amendment = guard.amendment;
+    if (!amendment) return;
+    try {
+      await amendment.invariant(changes, ctx);
+    } catch (err) {
+      if (err instanceof InvariantError) throw err;
+      throw new InvariantError(
+        err instanceof Error ? err.message : `invariant violated: ${String(err)}`
+      );
+    }
+  }
+};
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null) return a === b;
+  if (typeof a !== typeof b) return false;
+  if (typeof a !== "object") return a === b;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  if (Array.isArray(a)) {
+    const aa = a;
+    const bb = b;
+    if (aa.length !== bb.length) return false;
+    for (let i = 0; i < aa.length; i++) if (!deepEqual(aa[i], bb[i])) return false;
+    return true;
+  }
+  const ao = a;
+  const bo = b;
+  const ak = Object.keys(ao);
+  const bk = Object.keys(bo);
+  if (ak.length !== bk.length) return false;
+  for (const k of ak) {
+    if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
+    if (!deepEqual(ao[k], bo[k])) return false;
+  }
+  return true;
+}
+
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=chunk-GKEWXIV5.js.map

package/dist/chunk-GTGPO5KW.js

@@ -0,0 +1,59 @@
+import {
+  ATTESTATIONS_COLLECTION,
+  loadOrCreateSigner
+} from "./chunk-EXK7QRWF.js";
+import {
+  generateULID
+} from "./chunk-ZJADGNYF.js";
+import {
+  encrypt
+} from "./chunk-CIE2BASH.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-JNAI2HN2.js";
+import {
+  AttestationError
+} from "./chunk-BIOUI4HL.js";
+
+// src/with-audit/attestation/issue.ts
+import {
+  computeFieldHashes,
+  signPayloadCore,
+  encodeQr,
+  bytesToB64url
+} from "@noy-db/attestation";
+async function issueAttestationCore(ctx, args) {
+  if (ctx.role !== "owner") {
+    throw new AttestationError(`issueAttestation requires the 'owner' role; caller is '${ctx.role}'. Issuing a signed attestation is the firm's identity operation.`);
+  }
+  const src = await ctx.readRecord(args.collection, args.id);
+  if (!src) throw new AttestationError(`issueAttestation: source record '${args.collection}/${args.id}' not found.`);
+  const dek = await ctx.getDEK();
+  const signer = await loadOrCreateSigner(ctx.store, ctx.vault, () => Promise.resolve(dek));
+  const saltB64 = bytesToB64url(crypto.getRandomValues(new Uint8Array(16)));
+  let fieldHashes;
+  try {
+    fieldHashes = await computeFieldHashes(saltB64, args.fieldSchema, src.record);
+  } catch (e) {
+    throw new AttestationError(`issueAttestation: ${e.message}`);
+  }
+  const docId = generateULID();
+  const sig = await signPayloadCore({ v: 1, docId, salt: saltB64, keyId: signer.keyId, fieldHashes }, signer.privateKeyPkcs8B64);
+  const payload = { v: 1, docId, salt: saltB64, alg: "ed25519", keyId: signer.keyId, fieldHashes, sig };
+  const index = {
+    docId,
+    issuedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    keyId: signer.keyId,
+    fieldPaths: args.fieldSchema.fields.map((f) => f.path),
+    sourceRefs: [{ collection: args.collection, id: args.id, version: src.version }]
+  };
+  const { iv, data } = await encrypt(JSON.stringify(index), dek);
+  const env = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: index.issuedAt, _iv: iv, _data: data };
+  await ctx.store.put(ctx.vault, ATTESTATIONS_COLLECTION, docId, env);
+  return { docId, qr: encodeQr(payload), payload, keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
+}
+
+export {
+  issueAttestationCore
+};
+//# sourceMappingURL=chunk-GTGPO5KW.js.map

package/dist/chunk-HB3RFQSC.js

@@ -0,0 +1,95 @@
+import {
+  base64ToBuffer,
+  decryptBytesWithAAD,
+  encryptBytesWithAAD
+} from "./chunk-CIE2BASH.js";
+import {
+  TamperedError
+} from "./chunk-BIOUI4HL.js";
+
+// src/kernel/enclave/classify/compare.ts
+var subtle = globalThis.crypto.subtle;
+function ctEqualTags(a, b) {
+  if (a.length !== 32 || b.length !== 32) {
+    throw new Error(
+      `ctEqualTags: tags must be exactly 32 bytes (got ${a.length}/${b.length}) \u2014 caller bug; reduce comparands with blindedEqual first`
+    );
+  }
+  let diff = 0;
+  for (let i = 0; i < 32; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+async function blindedEqual(a, b) {
+  const ke = await subtle.generateKey({ name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const tagA = new Uint8Array(await subtle.sign("HMAC", ke, a));
+  const tagB = new Uint8Array(await subtle.sign("HMAC", ke, b));
+  return ctEqualTags(tagA, tagB);
+}
+
+// src/kernel/enclave/classify/vdig.ts
+var subtle2 = globalThis.crypto.subtle;
+var VDIG_SALT_DOMAIN = "noydb-classify-vdig";
+function buildVdigAad(collection, recordId, field) {
+  return new TextEncoder().encode(JSON.stringify([VDIG_SALT_DOMAIN, collection, recordId, field]));
+}
+async function deriveVdigSlotKey(cek, collection, field) {
+  const raw = await subtle2.exportKey("raw", cek);
+  const hkdf = await subtle2.importKey("raw", raw, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(VDIG_SALT_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([VDIG_SALT_DOMAIN, collection, field]));
+  const bits = await subtle2.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdf, 256);
+  return subtle2.importKey("raw", bits, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+async function sealVdigPayload(payload, cek, collection, recordId, field) {
+  const key = await deriveVdigSlotKey(cek, collection, field);
+  const { iv, data } = await encryptBytesWithAAD(
+    new TextEncoder().encode(JSON.stringify(payload)),
+    key,
+    buildVdigAad(collection, recordId, field)
+  );
+  return `${iv}:${data}`;
+}
+async function openVdigPayload(blob, cek, collection, recordId, field) {
+  const sep = blob.indexOf(":");
+  if (sep === -1) throw new TamperedError();
+  const ivPart = blob.slice(0, sep);
+  const dataPart = blob.slice(sep + 1);
+  try {
+    base64ToBuffer(ivPart);
+    base64ToBuffer(dataPart);
+  } catch {
+    throw new TamperedError();
+  }
+  const key = await deriveVdigSlotKey(cek, collection, field);
+  const bytes = await decryptBytesWithAAD(
+    ivPart,
+    dataPart,
+    key,
+    buildVdigAad(collection, recordId, field)
+  );
+  return JSON.parse(new TextDecoder().decode(bytes));
+}
+
+// src/kernel/enclave/classify/kofn.ts
+function evaluateKofN(results, min) {
+  if (!Number.isInteger(min) || min < 1 || min > results.length) {
+    throw new Error(
+      `evaluateKofN: min ${min} out of range 1..${results.length} \u2014 caller bug (matchGroup validates bounds up front, before any PBKDF2)`
+    );
+  }
+  let count = 0;
+  for (const r of results) {
+    if (r) count += 1;
+  }
+  return count >= min;
+}
+
+export {
+  ctEqualTags,
+  blindedEqual,
+  deriveVdigSlotKey,
+  sealVdigPayload,
+  openVdigPayload,
+  evaluateKofN
+};
+//# sourceMappingURL=chunk-HB3RFQSC.js.map