@noy-db/hub 0.3.0-pre.8 → 0.3.0

package/dist/kernel/via/graph.d.ts

@@ -0,0 +1,166 @@
+import type { ViaPosture } from './index.js';
+/** A (collection, field) node. Artifact-grain targets (rollup field, MV row-class,
+ *  overlay output) are modelled as a field node whose `field` is the artifact key. */
+export interface FieldRef {
+    readonly collection: string;
+    readonly field: string;
+}
+export type EdgeKind = 'computed' | 'derivation' | 'rollup' | 'mv' | 'overlay' | 'ref';
+/** `'virtual'` (#638 Task 7) marks a `computed(fn, { mode: 'virtual' })` field's edge —
+ *  never stored (rides the `present` phase), so it can never be sealed at rest
+ *  ({@link ViaGraph.taintSealedFields} excludes it) and is always non-queryable
+ *  regardless of source posture ({@link ViaGraph.effectivePosture} clamps it). */
+export type Grain = 'record' | 'aggregate' | 'virtual';
+/** Delete/forget-time referential policy for a `'ref'` edge (#650 Task 5, spec §4) — duplicated
+ *  (not imported) from `via/lookup/descriptor.ts`'s `OnDelete`: the kernel spine may not
+ *  statically import `via/**` (Check 14, `via-layering`). Keep the two in sync by hand. */
+export type OnDelete = 'restrict' | 'cascade' | 'nullify';
+/** Plain (non-via) field baseline — max-permissive; taint only ever tightens. */
+export declare const DEFAULT_POSTURE: ViaPosture;
+/** The per-axis "most restrictive" fold — pure, exported for direct unit testing. */
+export declare function foldPosture(a: ViaPosture, b: ViaPosture): ViaPosture;
+/** Security-axes-only fold for a wildcard collection node (#642): sealed-wins encryptedAtRest,
+ *  AND exportable, OR forgettable — queryable is NOT folded (stays base.queryable; the sealed
+ *  clamp to 'none' is buildTaintOverlay's job, so inheriting `sealed` never over-restricts a
+ *  blob-adjacent output to unqueryable). Pure; exported for unit testing. Distinct from
+ *  {@link foldPosture} (which folds all four axes) — do NOT reuse foldPosture here. */
+export declare function foldWildcardSecurity(base: ViaPosture, contributor: ViaPosture): ViaPosture;
+/** Metadata-only dependency graph, ONE per vault. Never stores values or key material. */
+export declare class ViaGraph {
+    /** Declared source-field postures (registerField), keyed by node id. */
+    private readonly _posture;
+    /** Every derived target's registration, keyed by the target's node id. */
+    private readonly _in;
+    /** source node id -> derived edges that depend on it (dispatch/erasure), each carrying
+     *  its own registration's `kind` (#678 — see {@link OutEdge}). */
+    private readonly _out;
+    /** Memoized effective posture per derived target node id. */
+    private readonly _effectiveCache;
+    /** Memoized whole-collection security-axes fold for `'*'` wildcard LEAF nodes (#642),
+     *  keyed by collection name — see {@link _wildcardContribution}. Cleared alongside
+     *  `_effectiveCache` on every `registerField`/`registerDerived` (a later-registered
+     *  field must re-fold on the next read — registration ordering is free). */
+    private readonly _wildcardCache;
+    /** Collections with at least one classified field (#638 Task 2 fix wave 2,
+     *  Finding I1 — the reconcile path's combined-state leak guard memory). */
+    private readonly _classifiedCollections;
+    /** Computed field names declared with no `deps` entry, per collection
+     *  (Finding I1 — such a field registers no edge when no classified field is
+     *  present yet, so a LATER, separate reconcile call attaching classifiedFields
+     *  still needs to see it regardless of declaration order). */
+    private readonly _depslessComputed;
+    /** Declare a source field's posture (money/i18n/classified/plain). Plain fields
+     *  default to `DEFAULT_POSTURE`; a later declaration for the same node wins-first (idempotent). */
+    registerField(collection: string, field: string, posture: ViaPosture): void;
+    /** A derived target depends on `sources` (may be cross-collection). `kind`/`grain`
+     *  drive dispatch + erasure semantics; sources drive taint. Re-registering the same
+     *  target replaces `_in` but does not prune stale `_out` edges — callers must
+     *  register each target at most once per graph lifetime. `onDelete`/`keyField` (#650 Task 5)
+     *  are meaningful only for `kind === 'ref'` edges — {@link referencingEdgesOf} reads them back. */
+    registerDerived(target: FieldRef, sources: readonly FieldRef[], kind: EdgeKind, grain: Grain, onDelete?: OnDelete, keyField?: string): void;
+    /** Whether `target` already has a registered in-edge — lets a caller skip
+     *  re-registering the same target (#638 Task 2 fix wave 2, Finding I2i:
+     *  `registerDerived`'s at-most-once contract must hold across repeated
+     *  identical `vault.collection()` calls, not just within a single one). */
+    hasDerived(target: FieldRef): boolean;
+    /** Mark/query a collection as having declared at least one classified field. */
+    markClassified(collection: string): void;
+    isClassified(collection: string): boolean;
+    /** Mark/query a collection's depsless (no declared `deps`) computed
+     *  field names — see `_depslessComputed`'s doc comment above. */
+    markDepslessComputed(collection: string, field: string): void;
+    depslessComputedFields(collection: string): ReadonlySet<string>;
+    /** Every field name the graph already has memory of for `collection` — from an
+     *  EARLIER, separate `vault.collection()` call (registered postures, derived
+     *  targets, depsless-computed names) — regardless of which via feature declared
+     *  it. #645 — `via/graph-wiring.ts`'s reconcile-path `knownFields` universe
+     *  (`collectKnownFieldNames`) is scoped to THIS call's own options only, so a
+     *  computed field attached in a LATER call whose `deps` correctly names a field
+     *  declared in an EARLIER call was spuriously refused as "unknown"; this method
+     *  lets that call site union in the graph's cross-call memory. Excludes the `'*'`
+     *  wildcard target (an overlay/derivation whole-record fold node, never a real
+     *  record field — see {@link registerDerived}'s doc comment). */
+    knownFieldNames(collection: string): ReadonlySet<string>;
+    /** Reject cycles at declare time (vault open). Throws `DerivationCycleError` for a
+     *  derivation/rollup/computed cycle, `MaterializedViewCycleError` for an MV cycle —
+     *  same classes + message shape the registries throw today (behavior lock). */
+    assertAcyclic(): void;
+    /** A leaf (non-derived) node's own posture contribution: its declared posture,
+     *  or `DEFAULT_POSTURE` if never declared via `registerField`. */
+    private _declaredPosture;
+    /** A node's posture contribution when folded into a dependent: recurse if it is itself
+     *  derived; else its declared/default posture — UNLESS it is a `'*'` LEAF node consumed
+     *  by a folded formula kind (#642, `derivation|rollup|mv|overlay`), in which case it
+     *  contributes its collection's whole-record security fold ({@link _wildcardContribution}).
+     *  `kind` is the CONSUMING edge's kind, threaded from {@link _computeEffective}. `'ref'`
+     *  edges (and the provenance-only untyped call, `kind` left `undefined`) keep `'*'` =
+     *  identity — the phase-D lookup reliance (`via/lookup/registry.ts:392-397`) that a
+     *  referencing field must not seal just because its dimension collection has a classified
+     *  column. */
+    private _contribution;
+    /** Lazy fold (#642) of a collection's REGISTERED field postures on the security axes only
+     *  ({@link foldWildcardSecurity} — sealed-wins encryptedAtRest, AND exportable, OR
+     *  forgettable; queryable stays at DEFAULT_POSTURE's 'full', never folded), seeded at
+     *  DEFAULT_POSTURE. This is the collection-level posture a `'*'` LEAF node contributes to a
+     *  folded-kind formula edge (derivation/rollup/mv/overlay) — see {@link _contribution}. A
+     *  plain (unregistered) field contributes nothing (the identity), so the fold is strictly
+     *  more conservative than deps-based taint and never hits the KNOWN-LIMIT wall (it names no
+     *  fields — seam map §1d). Memoized per collection in `_wildcardCache`. */
+    private _wildcardContribution;
+    private _computeEffective;
+    /** Strictest source posture on every axis, per §2. `undefined` when `target` has no
+     *  in-edges (not a derived field). Transitive: folds through chained derivations. */
+    effectivePosture(target: FieldRef): ViaPosture | undefined;
+    /** Per-collection { field → effectivePosture } overlay the pipeline consumes (Task 3). */
+    taintedPostures(collection: string): ReadonlyMap<string, ViaPosture>;
+    /** Materialized (`grain !== 'virtual'`) derived fields on `collection` whose effective
+     *  encryptedAtRest resolves to 'sealed' — the taint-seal set (Task 3). #638 Task 7
+     *  makes the `grain !== 'virtual'` filter meaningful: a `computed(fn, { mode: 'virtual' })`
+     *  field is never stored (rides the `present` phase, seam map Part 4's money-Formatted/
+     *  i18n-Label precedent), so it is EXCLUDED here even when its effective `encryptedAtRest`
+     *  folds to `'sealed'` — there is no envelope slot to seal. It still surfaces in
+     *  {@link taintedPostures} (query refusal via `postureFor`'s `queryable` clamp above, and
+     *  export refusal via `exportable`) — only the AT-REST SEALING ACTION is skipped. */
+    taintSealedFields(collection: string): ReadonlySet<string>;
+    /** Fields on `collection` whose registered edge is `grain === 'virtual'` (#638 Task 7) —
+     *  `via/graph-wiring.ts#applyTaintOverlay` intersects this with `exportable === false`
+     *  postures to know which virtual fields need PRESENT-TIME (not just export-time)
+     *  redaction, since a virtual field's value is only ever materialized inside `present()`. */
+    virtualFields(collection: string): ReadonlySet<string>;
+    /** Per-collection { field → immediate source field names that forced its
+     *  effective posture away from `DEFAULT_POSTURE` } — `describe()`'s
+     *  provenance (Task 3). Only the DIRECT declared sources are named (not the
+     *  ultimate origin several hops up a transitive chain); a source absent
+     *  from the result contributed nothing restrictive. */
+    taintProvenance(collection: string): ReadonlyMap<string, readonly string[]>;
+    private _targetsDependingOn;
+    /** Dispatch (Task 4): every derived target triggered by a write to `collection`. Excludes
+     *  `'ref'` edges (#650 Task 5 review, folded Minor) — a `'ref'` edge is consulted only by the
+     *  delete/forget-time restrict/cascade/nullify path ({@link referencingEdgesOf}), never by the
+     *  sync/cutover/restore dispatch wave (`runGraphDispatchWave`); counting it here defeated that
+     *  wave's zero-cost early-continue, costing every write to a referenced backing collection an
+     *  unconditional decrypt + two no-op dispatch passes. {@link derivedArtifactsOf} (erasure
+     *  fanout) still includes `'ref'` edges — the forget path genuinely needs them. */
+    dependentsOf(collection: string): ReadonlyArray<{
+        readonly target: FieldRef;
+        readonly kind: EdgeKind;
+        readonly grain: Grain;
+    }>;
+    /** Erasure (Task 6): derived artifacts of a forgotten record whose source is `collection`. */
+    derivedArtifactsOf(collection: string): ReadonlyArray<{
+        readonly target: FieldRef;
+        readonly kind: EdgeKind;
+        readonly grain: Grain;
+    }>;
+    /** Referencing edges pointing AT a backing dimension (delete/forget-time restrict/cascade/
+     *  nullify, #650 Task 5) — an O(1) reverse lookup via the existing `_out` map (keyed at the
+     *  dimension's wildcard `field:'*'` node, the same convention every whole-collection source
+     *  already uses), NEVER a scan across collections or records. `backing` is the collection name
+     *  a lookup field's edge was registered against (a reserved dimension's `_dict_<name>`/
+     *  `_lookup_<name>` collection name, or a matrix dimension's own collection name). */
+    referencingEdgesOf(backing: string): ReadonlyArray<{
+        readonly referencing: FieldRef;
+        readonly onDelete: OnDelete;
+        readonly keyField: string;
+    }>;
+}

package/dist/kernel/via/index.d.ts

@@ -0,0 +1,200 @@
+import type { EncryptedEnvelope } from '../types.js';
+/** Awaitable type for potentially async results. */
+type Awaitable<T> = T | Promise<T>;
+/** Declared security posture — a property the kernel enforces (enforcement activates in phases B/C). */
+export interface ViaPosture {
+    readonly encryptedAtRest: 'envelope' | 'sealed';
+    readonly queryable: 'none' | 'det-exact' | 'ordered' | 'full';
+    readonly exportable: boolean;
+    readonly forgettable: boolean;
+}
+/** Opaque marker every feature descriptor extends; the kernel never sees concrete descriptor types. */
+export interface ViaDescriptor {
+    readonly _viaBrand: string;
+}
+/** Per-call write context (A: minimal; B/C extend). */
+export interface ViaWriteCtx {
+    readonly id: string;
+    /** Owning vault name (event payload identity — e.g. i18n:script-violation). */
+    readonly vault: string;
+    /** Prior stored record (decoded), lazily resolved. Null when creating. */
+    readonly prior: () => Promise<Record<string, unknown> | null>;
+    /** Typed event emission (e.g. i18n:script-violation). */
+    readonly emit: (event: string, payload: unknown) => void;
+}
+/** Per-call read context — mirrors LocaleReadOptions loosely; features narrow. */
+export interface ViaReadCtx {
+    readonly locale?: unknown;
+    readonly fallback?: unknown;
+    readonly layer: string;
+}
+/** One sealed slot's ciphertext — matches the existing `iv:data` sealed map entries (seam map §2 step 2). */
+export interface SealedSlotRef {
+    readonly iv: string;
+    readonly data: string;
+}
+/**
+ * A scoped crypto capability handed to a `via` feature's `encodeAtRest`/
+ * `decodeAtRest`/`erase` hooks — never the keyring, never the enclave.
+ * `sealedSlots` is pre-bound to one `(collection, recordId)`; `reservedEnvelopes`
+ * is a whole-envelope encrypt/decrypt door scoped to collection names under a
+ * declared prefix (e.g. `_dict_`).
+ */
+export interface ViaCryptoCtx {
+    readonly sealedSlots: {
+        seal(field: string, plaintext: unknown): Promise<SealedSlotRef>;
+        unseal(field: string, ref: SealedSlotRef): Promise<unknown>;
+        delete(field: string): Promise<void>;
+    };
+    reservedEnvelopes(prefix: string): {
+        encrypt(collection: string, json: string, v: number): Promise<EncryptedEnvelope>;
+        decrypt(collection: string, env: EncryptedEnvelope): Promise<string>;
+    };
+}
+/** Per-call erase context — `forget()`'s per-ref participation door (phase C). */
+export interface ViaEraseCtx {
+    readonly id: string;
+    readonly vault: string;
+    readonly live: unknown;
+    readonly crypto: ViaCryptoCtx;
+}
+/**
+ * What an `erase` hook reports back to `forget()`'s summary ledger entry.
+ * `retainedShared` is additive (#629 Task 10) — content NOT erased because
+ * still referenced by another live record (blob's shared-chunk dual
+ * accounting, `shredAllForRecord()`'s `retainedShared` count). Absent/0 for
+ * bindings with no such concept (a sealed field is never "shared").
+ */
+export interface ViaEraseReport {
+    readonly shredded: number;
+    readonly residue: readonly unknown[];
+    readonly retainedShared?: number;
+}
+/**
+ * A feature bound to one collection's declared config. Record-grain hooks —
+ * every hook receives the whole record (matches the real engine signatures,
+ * e.g. quantizeMoneyFields(record, moneyFields)). All hooks optional;
+ * absent = passthrough. Query-participation hooks are SYNC (#553).
+ */
+export interface ViaBinding {
+    readonly brand: string;
+    readonly posture: ViaPosture;
+    /** Declared dependencies (field paths / cross-record specs). MANDATORY for any future
+     *  derive-bearing binding — phase C validates well-formedness (strings, non-empty,
+     *  reference declared fields) and graph-registers a derived edge for each covered
+     *  field at declare time, right after `compileViaBindings` builds the bindings
+     *  (unknown source field throws `ValidationError`). See
+     *  `kernel/collection-config.ts`'s `resolveViaBindingDepsEdges`. */
+    readonly deps?: readonly string[];
+    /** Collection-name prefixes this binding's `reservedEnvelopes` capability may address (e.g. `_dict_`). */
+    readonly reservedPrefixes?: readonly string[];
+    /**
+     * Does this binding own `field`? Backs `ViaPipeline.postureFor` (#629 Task
+     * 8's posture consumer) — a passive coverage check, independent of
+     * `buildClause`/`compareForOrder` (which some bindings, e.g. classified and
+     * blob, never define). SYNC, no side effects.
+     *
+     * Contract (documentation only — not enforced at runtime, future work):
+     * any binding declaring a non-default posture value — `queryable: 'none'`
+     * (#629 Task 8) or `exportable: false` (#629 Task 9's `redactForExport`)
+     * — MUST implement `covers()`. `postureFor`'s consumers only engage for
+     * fields a binding actively claims via `covers()`; a binding that omits
+     * it would silently fall through to the generic (unrefused/unredacted)
+     * path instead.
+     */
+    covers?(field: string): boolean;
+    /** Refuse a write before crypto runs (classified step-3 slot: storage:'never' rejection + validators). Throws to refuse. */
+    enforceWrite?(record: Record<string, unknown>, ctx: ViaWriteCtx): void | Promise<void>;
+    /** First pipeline stage (money canonicalizeIncomingMoney). SYNC. */
+    ingest?(record: Record<string, unknown>): Record<string, unknown>;
+    /** Decode STORED form to canonical for internal boundaries (gates, derivations, patch bases). SYNC. */
+    canonicalizeStored?(record: Record<string, unknown>): Record<string, unknown>;
+    /** Post-validation write encoding (money quantize; i18n translate→script→validate→densify). May be async. */
+    encodeWrite?(record: Record<string, unknown>, ctx: ViaWriteCtx): Awaitable<Record<string, unknown>>;
+    /** Final write-pipeline stage: seal/encrypt declared fields via `crypto` before the envelope body is built (classified step-2 slot). */
+    encodeAtRest?(record: Record<string, unknown>, crypto: ViaCryptoCtx): Promise<{
+        record: Record<string, unknown>;
+        sealed?: Record<string, SealedSlotRef>;
+    }>;
+    /** First read-pipeline stage: unseal/decrypt declared fields via `crypto` before `present` runs (classified sealed-handle slot). */
+    decodeAtRest?(record: Record<string, unknown>, sealed: Record<string, SealedSlotRef>, crypto: ViaCryptoCtx, opts: {
+        asHandles: boolean;
+    }): Promise<Record<string, unknown>>;
+    /** Read-time presentation (money decode+virtuals; i18n locale/labels/strip). May be async. */
+    present?(record: Record<string, unknown>, ctx: ViaReadCtx): Awaitable<Record<string, unknown>>;
+    /**
+     * Late read-time presentation (#669) — runs AFTER every binding's `present()` in the
+     * money+computed present-order segment (`ViaPipeline`'s `_presentOrder`, `kernel/via/
+     * pipeline.ts`), BEFORE the "everything else" segment (i18n/lookup dressing, taint
+     * redaction) runs. Exists for a binding that needs to react to a virtual computed
+     * field's fresh OWN-field output before anything dresses it (money's MAJOR-UNITS
+     * quantize-and-present for a field that is BOTH money AND `mode:'virtual'` computed) —
+     * `present()` alone can't express "run after computed for THESE fields only, before
+     * computed for all others", since it's a per-BINDING fold, not per-field. Folded over
+     * `bindings` in declaration order (mirrors every other per-binding fold), so lookup/
+     * i18n dressing and taint/redaction (both in the "everything else" segment) still see
+     * the already-dressed value.
+     */
+    presentLate?(record: Record<string, unknown>, ctx: ViaReadCtx): Awaitable<Record<string, unknown>>;
+    /** Returns an opaque clause payload when this binding covers `field`, else undefined. */
+    buildClause?(field: string, op: string, value: unknown): unknown | undefined;
+    /** Evaluate a payload produced by buildClause against a raw stored value. */
+    evaluateClause?(actual: unknown, op: string, payload: unknown): boolean;
+    /**
+     * Optional: the STORED-form operand for a direct secondary-index probe
+     * against a payload produced by `buildClause` (#625) — lets
+     * `candidateRecords()` (`query/builder.ts`) hit `CollectionIndexes.
+     * lookupEqual`/`lookupIn` for `==`/`in` clauses instead of falling back
+     * to a linear scan + per-record `evaluateClause`. Returning `undefined`
+     * means "no sound probe for this op/payload" (e.g. a comparison whose
+     * stored form isn't a single index-bucketable value, or an op the index
+     * can't serve) — the caller falls back to the scan. A binding that
+     * never implements this hook always falls back, unchanged from before
+     * this hook existed.
+     */
+    indexProbe?(op: string, payload: unknown): unknown | undefined;
+    /**
+     * Optional: canonicalize a raw STORED field value into the bucket key an
+     * eager index should use (#672) — lets `CollectionIndexes` group a
+     * pre-declaration / non-canonical stored value (e.g. a money field's
+     * leftover `'0100'` written before its `money()` declaration) under the
+     * SAME key a canonical write produces (`'100'`), so the index-probe fast
+     * path (`indexProbe` above) and the fallback scan (`evaluateClause`)
+     * agree on which records match. `undefined` means "not mine / can't
+     * canonicalize this value" — the caller buckets the raw stringified
+     * value, unchanged from before this hook existed. MUST agree with what
+     * this binding's own `evaluateClause`/`indexProbe` treat as equal, or
+     * the fast path and the scan will disagree.
+     */
+    canonicalizeIndexKey?(field: string, rawValue: unknown): string | undefined;
+    /** Decode a raw stored record for query/scan results and callback views ('raw' — no virtuals). */
+    decodeResults?(record: unknown): unknown;
+    /** Exact ordering for a covered field; undefined when the field is not covered. */
+    compareForOrder?(field: string, a: unknown, b: unknown): number | undefined;
+    /**
+     * Per-key, PER-CALL-locale label resolution for `orderBy(field, dir,
+     * { by: 'label' })` (#650 Task 7) — the sibling `compareForOrder` above
+     * structurally cannot serve, since it carries no locale parameter.
+     * `locale` is the query's per-call locale (`undefined` for a locale-less
+     * query — a binding may fall back to its own descriptor-level default,
+     * mirroring `present`'s displayLocale hinge). `undefined` return = this
+     * binding doesn't resolve a label for `key` at `field` — caller falls
+     * back to the raw stored value, same graceful-degrade discipline every
+     * other via query hook uses. SYNC (#553 — query participation).
+     */
+    resolveOrderLabel?(field: string, key: string, locale: string | undefined): string | undefined;
+    /** Rewrite an aggregate spec (money exact reducers). */
+    wrapReducers?(spec: unknown): unknown;
+    /** `forget()`'s per-ref erasure door — shred/report this binding's residue for one record (classified/blob forget participation). */
+    erase?(ctx: ViaEraseCtx): Promise<ViaEraseReport>;
+    describeFragment?(): Record<string, unknown>;
+}
+/** Binder: constructs a binding from a collection's declared config. Installed by the feature's declaration factory. */
+export type ViaBinder = (config: unknown) => ViaBinding;
+/** @internal — called (idempotently, first-wins) by a feature's declaration factory, e.g. money(). */
+export declare function installViaBinder(brand: string, binder: ViaBinder): void;
+/** @internal — registry presence check. Used by tests (mirrors isMoneyEngineInstalled) and by vault's i18n validator delegators as a no-i18n-ever-declared fast path. */
+export declare function isViaInstalled(brand: string): boolean;
+/** @internal — resolve a binder; throws when the declaration factory never ran (hand-rolled descriptors). */
+export declare function viaBinder(brand: string): ViaBinder;
+export {};

package/dist/kernel/via/pipeline.d.ts

@@ -0,0 +1,266 @@
+import type { ViaBinding, ViaPosture, ViaWriteCtx, ViaReadCtx, ViaCryptoCtx, SealedSlotRef, ViaEraseCtx, ViaEraseReport } from './index.js';
+/** Opaque per-clause query payload carried on FieldClause (replaces the money-only slot). */
+export interface ViaClause {
+    readonly brand: string;
+    readonly payload: unknown;
+}
+/**
+ * The graph-computed taint overlay (#638 Task 3) — `postureFor`'s
+ * assignment→enforcement bridge. `postures`/`sealFields` are the
+ * enforcement-facing shapes `via/taint-binding.ts#buildTaintOverlay`
+ * produces from `ViaGraph.taintedPostures`/`taintSealedFields`;
+ * `provenance` (optional — introspection only, never consulted by
+ * `postureFor`) is `ViaGraph.taintProvenance`'s output, surfaced by
+ * `describe()`.
+ */
+export interface ViaTaintOverlay {
+    readonly postures: ReadonlyMap<string, ViaPosture>;
+    readonly sealFields: ReadonlySet<string>;
+    readonly provenance?: ReadonlyMap<string, readonly string[]>;
+    /** #642 — the whole-record floor for a derivation/MV/overlay OUTPUT collection (the '*' target's
+     *  folded, clamped effective posture). postureFor falls back to it for ANY field; redactForExport
+     *  picks it up per-field; a sealed default drives taintBinding's sealAllFields mode. O(1) read. */
+    readonly defaultPosture?: ViaPosture;
+}
+export declare class ViaPipeline {
+    readonly bindings: readonly ViaBinding[];
+    readonly taint?: ViaTaintOverlay | undefined;
+    /**
+     * Present-phase-ONLY order (#665, corrected under #665 review) — a stable
+     * THREE-WAY partition of `bindings` computed once here at construction:
+     * every `'money'`-brand binding first (existing relative order), then
+     * every `'computed'`-brand binding (existing relative order), then
+     * everything else (existing relative order). `present()` folds over this
+     * instead of `bindings` so a `mode: 'virtual'` computed field's value
+     * exists before i18n/lookup's dressing `present()` hooks run on it
+     * (today's `compileViaBindings` order is money→i18n→lookup→classified→
+     * blob→computed, `collection-config.ts:554`, so dressing unconditionally
+     * ran BEFORE the value it dresses existed). This reorder is binding-level,
+     * not conditioned on any particular field composition — it applies to
+     * EVERY collection that compiles a `'computed'` binding at all, not only
+     * ones stacking a dresser on the SAME field as a computed one. EVERY other
+     * phase (`ingest`/`encodeWrite`/`encodeAtRest`/`enforceWrite`/etc.) keeps
+     * folding over `bindings` unchanged — those write/query phases need
+     * money-first (`_applyMoneyFields` PREPENDS money, `_applyClassifiedFields`
+     * APPENDS classified to preserve it, `kernel/collection.ts:1275-1284,1364-
+     * 1368`).
+     *
+     * Money is deliberately carved OUT of the generic "everything else" slice
+     * and kept FIRST — the original two-way `[computed..., rest...]` partition
+     * regressed money's composed-field behavior from a benign missing-dressing
+     * gap into VALUE CORRUPTION: money's `present()` DECODES its input as a
+     * STORED SCALED-INT (and derives `<field>Formatted` from it) — it is not a
+     * pure dressing CONSUMER like i18n/lookup, which only ADD a `<field>Label`
+     * key and never rewrite the field's own value. Running money AFTER
+     * computed on a field composing `computed(virtual)` + `money(...)` on
+     * ITSELF means money's decode sees the virtual field's raw MAJOR-unit
+     * output (e.g. `21`) and misreads it as a scaled-int, producing a
+     * corrupted value (`'0.21'`) instead of the pre-#665 result (the raw `21`
+     * surviving untouched, with no `Formatted` key added — a benign
+     * missing-dressing gap, not a wrong value). Money-first restores money's
+     * exact pre-#665 present position — byte-identical money behavior; the
+     * materialized composition pins from the #631 work and the money suites
+     * all ran under money-first. i18n/lookup are genuine dressing consumers
+     * (they only ADD, never rewrite), so they stay after computed, which is
+     * the fix #665 intended. A `'taint'` binding (appended LAST by
+     * `via/graph-wiring.ts#applyTaintOverlay`) stays last here too (it's
+     * neither money nor computed, so it lands at the tail of the "everything
+     * else" slice), preserving its "runs after computed, redacts tainted
+     * virtual output" contract (`via/taint-binding.ts`'s `taintBinding` doc
+     * comment).
+     *
+     * Money-dressing a virtual computed field's OWN output (the composed
+     * `computed(virtual) + money` case) is NOT resolved by this partition
+     * alone — #669 resolves it with a separate mid-fold hook instead:
+     * `ViaBinding.presentLate` runs after every binding's `present()` in this
+     * money+computed segment, before the "everything else" segment below, so
+     * money can quantize/reinterpret a virtual field's fresh MAJOR-UNITS
+     * output as if it were a stored value, without perturbing this ordering
+     * or the #665 invariant above it (`_presentLateBoundary` below marks
+     * exactly where that mid-fold point sits within `_presentOrder`).
+     */
+    private readonly _presentOrder;
+    /** #669 — index into `_presentOrder` where the money+computed segment ends and the
+     *  "everything else" segment begins (`moneyBindings.length + computedBindings.length`);
+     *  `present()` runs every binding's `presentLate` at exactly this boundary. */
+    private readonly _presentLateBoundary;
+    private constructor();
+    /** undefined when there is nothing to enforce — the zero-via fast path is
+     *  `this.via === undefined` (#553: keeps an all-plain collection sync). A
+     *  `'*'`-defaulted output collection (#642) counts as "something to enforce"
+     *  even with zero field-specific postures and zero bindings. */
+    static build(bindings: readonly ViaBinding[], taint?: ViaTaintOverlay): ViaPipeline | undefined;
+    /** Refuse a write before crypto runs: awaits each binding's `enforceWrite` in order — first throw wins. */
+    enforceWrite(record: Record<string, unknown>, ctx: ViaWriteCtx): Promise<void>;
+    ingest(record: Record<string, unknown>): Record<string, unknown>;
+    canonicalizeStored(record: Record<string, unknown>): Record<string, unknown>;
+    encodeWrite(record: Record<string, unknown>, ctx: ViaWriteCtx): Promise<Record<string, unknown>>;
+    /**
+     * Final write-pipeline stage: folds each binding's `encodeAtRest` in
+     * order, threading the record and accumulating the sealed-slot map. A
+     * field belongs to exactly one via feature — two bindings sealing the
+     * same field is a brand-keyed collision and throws.
+     */
+    encodeAtRest(record: Record<string, unknown>, crypto: ViaCryptoCtx): Promise<{
+        record: Record<string, unknown>;
+        sealed?: Record<string, SealedSlotRef>;
+    }>;
+    /** First read-pipeline stage: folds each binding's `decodeAtRest` in order. */
+    decodeAtRest(record: Record<string, unknown>, sealed: Record<string, SealedSlotRef>, crypto: ViaCryptoCtx, opts: {
+        asHandles: boolean;
+    }): Promise<Record<string, unknown>>;
+    present(record: Record<string, unknown>, ctx: ViaReadCtx): Promise<Record<string, unknown>>;
+    buildClause(field: string, op: string, value: unknown): ViaClause | undefined;
+    evaluateClause(clause: ViaClause, actual: unknown, op: string): boolean;
+    /**
+     * Resolve a `buildClause` payload to an index-probe operand (#625) —
+     * mirrors `evaluateClause`'s brand dispatch. `undefined` (a binding
+     * with no `indexProbe`, or one that declines to probe this op/payload)
+     * means the caller (`candidateRecords()`) must fall back to a scan.
+     */
+    indexProbe(clause: ViaClause, op: string): unknown | undefined;
+    /**
+     * Resolve a raw STORED field value to its canonical eager-index bucket
+     * key (#672) — folds every binding's `canonicalizeIndexKey`, first
+     * non-undefined wins (same fold discipline as `buildClause`). `undefined`
+     * means no binding claims `field` (or the value can't be canonicalized)
+     * — the caller buckets the raw stringified value, unchanged from before
+     * this hook existed.
+     */
+    canonicalizeIndexKey(field: string, rawValue: unknown): string | undefined;
+    decodeResults(record: unknown): unknown;
+    /** undefined = no binding covers the field → caller falls back to generic compare. */
+    compareForOrder(field: string, a: unknown, b: unknown): number | undefined;
+    /** undefined = no binding resolves an order-sort label for `key` at `field`/`locale` (#650 Task 7 —
+     *  the `orderBy(..., {by:'label'})` per-call-locale channel `compareForOrder` above can't serve). */
+    resolveOrderLabel(field: string, key: string, locale: string | undefined): string | undefined;
+    /**
+     * Which posture governs `field`, if any binding covers it — `undefined`
+     * means no binding declares `field` (the generic, non-via query path
+     * applies). #629 Task 8's posture consumer: `.where()`/`.orderBy()`
+     * consult this before building/evaluating a clause, refusing fields whose
+     * posture is `queryable: 'none'` (e.g. blob); every other posture
+     * ('det-exact'/'ordered'/'full') is left to the existing per-binding
+     * buildClause/evaluateClause/compareForOrder machinery, unchanged.
+     *
+     * #638 Task 3: the graph-computed taint overlay is consulted FIRST — a
+     * derived field's assigned (most-restrictive-of-sources) posture wins over
+     * whatever a binding would otherwise report for that field name (no
+     * binding covers a computed/derived field today, so this never actually
+     * shadows one — see `via/taint-binding.ts`'s `taintBinding.covers`, which
+     * only claims the sealed subset for `encodeAtRest`/`decodeAtRest`, not for
+     * this lookup).
+     */
+    postureFor(field: string): ViaPosture | undefined;
+    /**
+     * Refuse any field-based reducer over a `queryable: 'none'` field (blob) —
+     * metadata-only: walks each reducer's `.field` and checks posture, no
+     * rewriting. Reducers with no `.field` (e.g. `count()`) are skipped.
+     *
+     * Shared by `wrapReducers` below (which ALSO applies each binding's
+     * rewrite, e.g. money's exact-BigInt reducer swap) and by
+     * `ScanBuilder.aggregate()` (#629 Task 8 review fix wave 1), which must
+     * call THIS, not `wrapReducers` — wiring full `wrapReducers` into
+     * `ScanBuilder.aggregate()` would newly activate money/i18n reducer
+     * wrapping on a path that has never run it, a parity-breaking behavior
+     * change for existing brands.
+     */
+    refuseUnqueryableReducers<S>(spec: S): void;
+    /**
+     * Rewrite an aggregate spec (money exact reducers), then refuse any
+     * field-based reducer over a `queryable: 'none'` field (blob) — the same
+     * posture gate `.where()`/`.orderBy()` apply, extended to `.aggregate()`
+     * (both the bare-spec and builder forms funnel through here).
+     */
+    wrapReducers<S>(spec: S): S;
+    /**
+     * Deliberate export-layer redaction (#629 Task 9's posture consumer):
+     * for every OWN field the decoded record carries, if the covering
+     * binding's posture declares `exportable: false` (classified today;
+     * money/i18n/blob are all `true`), replace the value with
+     * {@link EXPORT_REDACTION_MARKER} — the same `'[sealed]'` string
+     * `SealedHandle.toJSON()` (`kernel/types.ts`) already emits, so this is
+     * byte-parity with today's accidental redaction, now independent of the
+     * field's runtime shape. `SealedHandle.toJSON()` stays untouched as
+     * defense-in-depth: a record read via `collection.get()` and
+     * JSON.stringify'd outside `exportStream()` still gets the accident's
+     * redaction on its own. Never mutates the input; returns a new object
+     * only when a field was actually redacted.
+     */
+    redactForExport(record: Record<string, unknown>): Record<string, unknown>;
+    /**
+     * Shared fold over a subset of `this.bindings`: runs each binding's
+     * `erase`, concatenating shredded/retainedShared counts and residue.
+     * Consults `posture.forgettable` (#629 Task 10) — a binding declaring
+     * `forgettable: false` is skipped even if it defines `erase` (none does
+     * today; a future non-forgettable binding is supported without a brand check).
+     */
+    private foldErase;
+    /** `forget()`'s per-ref erasure door: folds every binding's `erase`. */
+    erase(ctx: ViaEraseCtx): Promise<ViaEraseReport>;
+    /**
+     * `forget()`'s SEALED-posture-only erase fold (#629 Task 10, `Collection._onViaErase`'s
+     * one caller) — classified today; metadata-filtered on
+     * `posture.encryptedAtRest`, not brand-checked. `undefined` when no
+     * sealed-posture binding is compiled in — `vault.ts` then falls back to
+     * its own bare-`sensitive` classification, which no via binding covers.
+     */
+    eraseSealed(ctx: ViaEraseCtx): Promise<ViaEraseReport | undefined>;
+    /** True iff any binding implements decodeResults (query fast-path gating). */
+    get hasResultDecode(): boolean;
+    /**
+     * True iff any binding declares an at-rest hook (`encodeAtRest`/
+     * `decodeAtRest`) — the codec boundary's async-stack gate (#629 Task 3
+     * consults this to choose between the hook path and today's inline
+     * sealed-slot path; a stack with only sync hooks, e.g. money-only, stays
+     * `false`).
+     */
+    get hasAtRestHooks(): boolean;
+    /**
+     * Fold every binding's `describeFragment()` into one `brand -> fragment`
+     * map (#650 Task 7 — the first-ever consumer; `describeFragment` was
+     * declared at `via/index.ts:136` since #623 with zero callers until this task).
+     * `undefined` when no compiled binding implements it. Consumed by
+     * `Collection.describe()`/`describeAsync()`, threaded to `buildDescription`
+     * as `BuildDescriptionInput.viaFragments`.
+     */
+    describeFragments(): Record<string, Record<string, unknown>> | undefined;
+}
+/**
+ * The marker `redactForExport` writes for a non-exportable field —
+ * intentionally the same literal `SealedHandle.toJSON()` (`kernel/types.ts`)
+ * returns, so the two independent redaction layers (deliberate + accident)
+ * produce byte-identical export output. Duplicated, not imported, because
+ * `SealedHandle.toJSON()` is untouched by #629 Task 9 (belt-and-braces —
+ * `via/export-posture-b.test.ts` asserts both layers agree on this string).
+ */
+export declare const EXPORT_REDACTION_MARKER = "[sealed]";
+/**
+ * Structural shape `exportRedact` needs from a collection: just the typed
+ * `_via` accessor `Collection` exposes (`kernel/collection.ts`, #634). A
+ * named interface rather than the real `Collection` type, because
+ * `collection.ts` imports `ViaPipeline` from this module — importing
+ * `Collection` back here would be circular.
+ */
+interface HasViaPipeline {
+    readonly _via: ViaPipeline | undefined;
+}
+/**
+ * Widened sibling of {@link HasViaPipeline}: `via/graph-wiring.ts`'s
+ * `applyTaintOverlay` (#666) needs to REASSIGN the live pipeline, not just
+ * read it — `_setVia` is `Collection`'s typed writer seam (`kernel/
+ * collection.ts`, beside `_via`), replacing the earlier untyped `coll as {
+ * via; codec: { setVia } }` cast. Exported (unlike `HasViaPipeline`) because
+ * its one consumer lives in a different module.
+ */
+export interface HasWritableViaPipeline extends HasViaPipeline {
+    _setVia(pipeline: ViaPipeline | undefined): void;
+}
+/**
+ * `vault.ts`'s `exportStream()` reach-in (#629 Task 9): apply the owning
+ * collection's export redaction to one decoded record. Typed via {@link
+ * HasViaPipeline} against `Collection`'s `_via` accessor (#634) — replaces
+ * the earlier untyped any-cast reach-in.
+ */
+export declare function exportRedact(coll: HasViaPipeline, record: unknown): unknown;
+export {};