@noy-db/hub 0.3.0-pre.9 → 0.4.0-pre.0

package/dist/chunk-7IZQTCTR.js

@@ -1,382 +0,0 @@
-import {
-  listUserEnvelopeIds,
-  loadUserEnvelope,
-  persistUserVisibility,
-  readUserVisibility,
-  saveUserEnvelope
-} from "./chunk-E5AHO65E.js";
-import {
-  PolicyDeniedError
-} from "./chunk-CU62BBRB.js";
-
-// src/with-party/directory/user-envelope/api.ts
-var UserApi = class {
-  /** keyringId → set of listeners. Wildcard '*' fires on every change. */
-  listeners = /* @__PURE__ */ new Map();
-  adapter;
-  vaultName;
-  /** The writer's own keyringId. Frozen at construction time. */
-  writerKeyringId;
-  getDek;
-  /**
-   * Policy-gate validator. When omitted, gates are skipped — useful
-   * for low-level tests that exercise the storage layer directly.
-   * Production paths always wire the Noydb-backed implementation.
-   */
-  checkGate;
-  /**
-   * Noydb-backed `exportMyAccessibleData`, injected by the Vault
-   * (which holds the keyring + bundle machinery). Omitted in low-level tests.
-   */
-  exportAccessible;
-  /**
-   * Noydb-backed `unilateralWithdrawal`, injected by the Vault.
-   * Destructive — extract + dispose (delete | freeze). Omitted in low-level tests.
-   */
-  unilateralWithdraw;
-  /**
-   * Noydb-backed two-party withdrawal ceremony, injected by the
-   * Vault. requestWithdraw = requester side; the rest = owner side.
-   */
-  requestWithdraw;
-  listWithdrawals;
-  approveWithdraw;
-  rejectWithdraw;
-  constructor(deps) {
-    this.adapter = deps.adapter;
-    this.vaultName = deps.vaultName;
-    this.writerKeyringId = deps.writerKeyringId;
-    this.getDek = deps.getDek;
-    this.checkGate = deps.checkGate;
-    this.exportAccessible = deps.exportAccessible;
-    this.unilateralWithdraw = deps.unilateralWithdraw;
-    this.requestWithdraw = deps.requestWithdraw;
-    this.listWithdrawals = deps.listWithdrawals;
-    this.approveWithdraw = deps.approveWithdraw;
-    this.rejectWithdraw = deps.rejectWithdraw;
-  }
-  /**
-   * File a two-party withdrawal request for the caller's accessible
-   * scope. Non-destructive (writes a pending request); an owner later approves
-   * or rejects. This is the path for read-only roles (`client`/`viewer`) that
-   * cannot self-serve a destructive `unilateralWithdrawal`. Gated by
-   * `user-request-withdrawal` (enabled by default).
-   */
-  async requestWithdrawal(opts = {}) {
-    if (this.checkGate) await this.checkGate("user-request-withdrawal");
-    if (!this.requestWithdraw) {
-      throw new Error("requestWithdrawal requires a Noydb-backed vault (not a bare UserApi)");
-    }
-    return this.requestWithdraw(opts);
-  }
-  /** Owner side: list filed withdrawal requests (optionally by status). */
-  async listWithdrawalRequests(opts = {}) {
-    if (!this.listWithdrawals) {
-      throw new Error("listWithdrawalRequests requires a Noydb-backed vault (not a bare UserApi)");
-    }
-    return this.listWithdrawals(opts);
-  }
-  /**
-   * Owner side: approve a pending request. Extracts the requester's
-   * recorded scope under firm authority, disposes of the source per the
-   * request's disposition, and returns the re-keyed bundle to hand back. Gated
-   * by `approve-user-withdrawal` (tier-2 default) + owner/admin role.
-   */
-  async approveWithdrawal(requestId, opts = {}) {
-    if (this.checkGate) await this.checkGate("approve-user-withdrawal");
-    if (!this.approveWithdraw) {
-      throw new Error("approveWithdrawal requires a Noydb-backed vault (not a bare UserApi)");
-    }
-    return this.approveWithdraw(requestId, opts);
-  }
-  /** Owner side: reject a pending request (no data is touched). */
-  async rejectWithdrawal(requestId, opts = {}) {
-    if (this.checkGate) await this.checkGate("approve-user-withdrawal");
-    if (!this.rejectWithdraw) {
-      throw new Error("rejectWithdrawal requires a Noydb-backed vault (not a bare UserApi)");
-    }
-    return this.rejectWithdraw(requestId, opts);
-  }
-  /**
-   * Single-party withdrawal: export the caller's accessible scope
-   * (re-keyed) and dispose of the source (`delete` or `freeze`). Gated by the
-   * fail-closed built-in `client-unilateral-withdraw` policy — undefined or
-   * disabled → throws (use `requestWithdrawal`). The firm enables it at vault
-   * creation.
-   */
-  async unilateralWithdrawal(opts) {
-    if (this.checkGate) await this.checkGate("client-unilateral-withdraw");
-    if (!this.unilateralWithdraw) {
-      throw new Error("unilateralWithdrawal requires a Noydb-backed vault (not a bare UserApi)");
-    }
-    return this.unilateralWithdraw(opts);
-  }
-  /**
-   * Export the calling user's accessible scope as a portable, re-keyed
-   * `.noydb` bundle. Non-destructive and **always allowed** (data sovereignty
-   * by construction) but audited. Scope = the caller's DEK access set.
-   */
-  async exportMyAccessibleData(opts = {}) {
-    if (!this.exportAccessible) {
-      throw new Error("exportMyAccessibleData requires a Noydb-backed vault (not a bare UserApi)");
-    }
-    return this.exportAccessible(opts);
-  }
-  // ─── Write-self ──────────────────────────────────────────────────────
-  /** Read the writer's own envelope. Returns null if never written. */
-  async me() {
-    const dek = await this.getDek();
-    return loadUserEnvelope(this.adapter, this.vaultName, this.writerKeyringId, dek);
-  }
-  /**
-   * Deep-merge a partial patch into the writer's own envelope. Creates
-   * the envelope on first call. Optimistic-concurrency safe — a stale
-   * `_v` (parallel writer on another device) throws `ConflictError`.
-   *
-   * Patch semantics:
-   *   - `undefined` (or omitted key) — skip; existing value preserved
-   *   - `null` — delete the field from the merged result
-   *   - any other value — overwrite (deep-merge for plain objects,
-   *     replace for primitives / arrays)
-   *
-   * To clear a field, pass `null` rather than `undefined`. Callers
-   * with shape `T = string | null` where `null` is a meaningful value
-   * should use `setMe` for that specific field instead — `null` here
-   * always means delete.
-   *
-   * Gated by the `edit-own-profile` policy gate (default `minTier: 3`).
-   * Pass `presented` to satisfy tightened policies that require a
-   * factor proof (e.g. STRICT_POLICY's TOTP requirement).
-   */
-  async updateMe(patch, presented) {
-    if (this.checkGate) await this.checkGate("edit-own-profile", presented);
-    const dek = await this.getDek();
-    const current = await loadUserEnvelope(
-      this.adapter,
-      this.vaultName,
-      this.writerKeyringId,
-      dek
-    );
-    const merged = current ? deepMerge(current.data, patch) : patch;
-    const written = await saveUserEnvelope(
-      this.adapter,
-      this.vaultName,
-      this.writerKeyringId,
-      merged,
-      dek,
-      current?._v ?? 0
-    );
-    this.fireChange(this.writerKeyringId, written);
-    return written;
-  }
-  /**
-   * Replace the writer's own envelope with `payload`. Use sparingly —
-   * `updateMe` is the canonical mutation. No `expectedVersion` check;
-   * callers explicitly take last-write-wins semantics.
-   *
-   * Gated by `edit-own-profile`. See `updateMe` for `presented` usage.
-   */
-  async setMe(payload, presented) {
-    if (this.checkGate) await this.checkGate("edit-own-profile", presented);
-    const dek = await this.getDek();
-    const written = await saveUserEnvelope(
-      this.adapter,
-      this.vaultName,
-      this.writerKeyringId,
-      payload,
-      dek
-    );
-    this.fireChange(this.writerKeyringId, written);
-    return written;
-  }
-  // ─── Visibility ──────────────────────────────────────────────────────
-  /**
-   * Read the current user's visibility flag from
-   * `_meta/visibility/<keyringId>`. Returns `{ hidden: false }` when no
-   * document has been persisted (the default-visible case).
-   */
-  async getMyVisibility() {
-    const persisted = await readUserVisibility(this.adapter, this.vaultName, this.writerKeyringId);
-    return persisted ?? { hidden: false };
-  }
-  /**
-   * Update the current user's visibility in the team directory.
-   *
-   * - `hidden: true` — opt out of the default `listUsersWithEnvelopes`
-   *   listing. `owner`/`admin` callers can still see the user by passing
-   *   `{ includeHidden: true }`.
-   * - `hidden: false` — opt back in.
-   *
-   * Own-only by construction: the keyringId argument doesn't exist on
-   * this method, so no caller can hide or unhide another principal.
-   *
-   * Honest caveat: this is a UX flag, not a privacy guarantee. The
-   * envelope ciphertext at `_users/<keyringId>` and the keyring file at
-   * `_keyring/<userId>` are both still observable to anyone with direct
-   * store read access. See `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md` →
-   * "Directory visibility".
-   */
-  async setMyVisibility(visibility) {
-    await persistUserVisibility(
-      this.adapter,
-      this.vaultName,
-      this.writerKeyringId,
-      { hidden: visibility.hidden }
-    );
-  }
-  // ─── Read-anyone ─────────────────────────────────────────────────────
-  /**
-   * Read another principal's envelope by their keyringId. Returns null
-   * if the principal exists but has no envelope yet, or if the
-   * keyringId does not exist at all.
-   *
-   * Gated by `view-team-profiles` (default `minTier: 2`) — but ONLY for
-   * cross-principal reads. Reading your own envelope (`keyringId ===
-   * self`) is never gated; that's just `me()` written long-form.
-   */
-  async get(keyringId, presented) {
-    if (this.checkGate && keyringId !== this.writerKeyringId) {
-      await this.checkGate("view-team-profiles", presented);
-    }
-    const dek = await this.getDek();
-    return loadUserEnvelope(this.adapter, this.vaultName, keyringId, dek);
-  }
-  /**
-   * Read every persisted envelope in the vault. Order is store-defined.
-   *
-   * Gated by `view-team-profiles`. Default policy (`minTier: 2`) lets
-   * any authenticated session read all envelopes. Two privacy-strict
-   * opt-outs:
-   *
-   *  - `view-team-profiles.enabled: false` → list() returns only the
-   *    caller's own envelope (silent self-fallback, no thrown error).
-   *  - `view-team-profiles.minTier: 1` + insufficient tier → throws
-   *    `PolicyDeniedError` with `reason: 'insufficient-tier'`. The
-   *    caller is expected to elevate, not silently degrade.
-   *
-   * The asymmetry is deliberate: `enabled: false` is a deliberate
-   * design choice ("nobody sees teammate profiles in this app");
-   * `insufficient-tier` is "you need to authenticate further". Different
-   * UX prompts for different intents.
-   */
-  async list(presented) {
-    if (this.checkGate) {
-      try {
-        await this.checkGate("view-team-profiles", presented);
-      } catch (err) {
-        if (err instanceof PolicyDeniedError && err.reason === "disabled") {
-          const me = await this.me();
-          return me ? [me] : [];
-        }
-        throw err;
-      }
-    }
-    const dek = await this.getDek();
-    const ids = await listUserEnvelopeIds(this.adapter, this.vaultName);
-    const envelopes = await Promise.all(
-      ids.map((id) => loadUserEnvelope(this.adapter, this.vaultName, id, dek))
-    );
-    return envelopes.filter((e) => e !== null);
-  }
-  // ─── Reactive ────────────────────────────────────────────────────────
-  /**
-   * Listen for changes to a specific keyringId's envelope. The callback
-   * fires synchronously after every successful local `updateMe` /
-   * `setMe` for that principal.
-   *
-   * Cross-instance changes (a teammate edits their profile on their
-   * device, the sync engine pulls the diff onto this device) will fire
-   * subscribers when the sync layer replays the write through this API.
-   * In v1, subscribers do NOT fire on raw store changes — wire your sync
-   * layer to call back through `vault.user.setMe` / `updateMe` if you
-   * need that.
-   *
-   * Pass keyringId `'*'` to fire on every change in the vault.
-   */
-  subscribe(keyringId, cb) {
-    let listeners = this.listeners.get(keyringId);
-    if (!listeners) {
-      listeners = /* @__PURE__ */ new Set();
-      this.listeners.set(keyringId, listeners);
-    }
-    const wrapped = cb;
-    listeners.add(wrapped);
-    return () => {
-      listeners?.delete(wrapped);
-      if (listeners && listeners.size === 0) {
-        this.listeners.delete(keyringId);
-      }
-    };
-  }
-  /**
-   * Reactive handle that caches the current value and re-reads on every
-   * change for the given keyringId. Convenient for framework bindings:
-   *
-   *   const live = vault.user.live<UserShape>(vault.userId)
-   *   live.subscribe(env => render(env?.data))
-   *
-   * Initial value is `null` until the first `current()` call materializes
-   * it via `vault.user.get()`. Call `stop()` when done to release the
-   * subscription.
-   */
-  live(keyringId) {
-    let value = null;
-    let primed = false;
-    const unsubscribe = this.subscribe(keyringId, (env) => {
-      value = env;
-    });
-    return {
-      current() {
-        if (!primed) {
-          primed = true;
-        }
-        return value;
-      },
-      subscribe: (cb) => this.subscribe(keyringId, cb),
-      stop: unsubscribe
-    };
-  }
-  // ─── Internal: change emission ───────────────────────────────────────
-  fireChange(keyringId, env) {
-    const targeted = this.listeners.get(keyringId);
-    if (targeted) for (const l of targeted) l(env);
-    const wildcard = this.listeners.get("*");
-    if (wildcard) for (const l of wildcard) l(env);
-  }
-};
-var createUserApi = (deps) => new UserApi(deps);
-function deepMerge(source, patch) {
-  if (!isPlainObject(source) || !isPlainObject(patch)) {
-    return patch;
-  }
-  const out = { ...source };
-  for (const [key, patchVal] of Object.entries(patch)) {
-    if (patchVal === void 0) {
-      continue;
-    }
-    if (patchVal === null) {
-      delete out[key];
-      continue;
-    }
-    const sourceVal = source[key];
-    if (isPlainObject(patchVal)) {
-      const recurseSource = isPlainObject(sourceVal) ? sourceVal : {};
-      out[key] = deepMerge(recurseSource, patchVal);
-    } else {
-      out[key] = patchVal;
-    }
-  }
-  return out;
-}
-function isPlainObject(x) {
-  if (x === null || typeof x !== "object") return false;
-  if (Array.isArray(x)) return false;
-  const proto = Object.getPrototypeOf(x);
-  return proto === Object.prototype || proto === null;
-}
-
-export {
-  UserApi,
-  createUserApi
-};
-//# sourceMappingURL=chunk-7IZQTCTR.js.map

package/dist/chunk-7ZANJ6JZ.js

@@ -1,265 +0,0 @@
-import {
-  DerivationCycleError,
-  MaterializedViewCycleError
-} from "./chunk-CU62BBRB.js";
-
-// src/kernel/via-graph.ts
-var DEFAULT_POSTURE = { encryptedAtRest: "envelope", queryable: "full", exportable: true, forgettable: false };
-var QUERYABLE_RANK = {
-  none: 0,
-  "det-exact": 1,
-  ordered: 2,
-  full: 3
-};
-function foldPosture(a, b) {
-  return {
-    encryptedAtRest: a.encryptedAtRest === "sealed" || b.encryptedAtRest === "sealed" ? "sealed" : "envelope",
-    queryable: QUERYABLE_RANK[a.queryable] <= QUERYABLE_RANK[b.queryable] ? a.queryable : b.queryable,
-    exportable: a.exportable && b.exportable,
-    forgettable: a.forgettable || b.forgettable
-  };
-}
-function isDefaultPosture(p) {
-  return p.encryptedAtRest === DEFAULT_POSTURE.encryptedAtRest && p.queryable === DEFAULT_POSTURE.queryable && p.exportable === DEFAULT_POSTURE.exportable && p.forgettable === DEFAULT_POSTURE.forgettable;
-}
-var SEP = "\0";
-var EMPTY_SET = /* @__PURE__ */ new Set();
-function nodeId(ref) {
-  return `${ref.collection}${SEP}${ref.field}`;
-}
-function displayNodeId(id) {
-  const sep = id.indexOf(SEP);
-  return `${id.slice(0, sep)}.${id.slice(sep + 1)}`;
-}
-var ViaGraph = class {
-  /** Declared source-field postures (registerField), keyed by node id. */
-  _posture = /* @__PURE__ */ new Map();
-  /** Every derived target's registration, keyed by the target's node id. */
-  _in = /* @__PURE__ */ new Map();
-  /** source node id -> derived targets that depend on it (dispatch/erasure). */
-  _out = /* @__PURE__ */ new Map();
-  /** Memoized effective posture per derived target node id. */
-  _effectiveCache = /* @__PURE__ */ new Map();
-  /** Collections with at least one classified field (#638 Task 2 fix wave 2,
-   *  Finding I1 — the reconcile path's combined-state leak guard memory). */
-  _classifiedCollections = /* @__PURE__ */ new Set();
-  /** Computed field names declared with no `deps` entry, per collection
-   *  (Finding I1 — such a field registers no edge when no classified field is
-   *  present yet, so a LATER, separate reconcile call attaching classifiedFields
-   *  still needs to see it regardless of declaration order). */
-  _depslessComputed = /* @__PURE__ */ new Map();
-  /** Declare a source field's posture (money/i18n/classified/plain). Plain fields
-   *  default to `DEFAULT_POSTURE`; a later declaration for the same node wins-first (idempotent). */
-  registerField(collection, field, posture) {
-    const id = nodeId({ collection, field });
-    if (this._posture.has(id)) return;
-    this._posture.set(id, posture);
-    this._effectiveCache.clear();
-  }
-  /** A derived target depends on `sources` (may be cross-collection). `kind`/`grain`
-   *  drive dispatch + erasure semantics; sources drive taint. Re-registering the same
-   *  target replaces `_in` but does not prune stale `_out` edges — callers must
-   *  register each target at most once per graph lifetime. `onDelete`/`keyField` (#650 Task 5)
-   *  are meaningful only for `kind === 'ref'` edges — {@link referencingEdgesOf} reads them back. */
-  registerDerived(target, sources, kind, grain, onDelete, keyField) {
-    const id = nodeId(target);
-    this._in.set(id, {
-      target,
-      sources,
-      kind,
-      grain,
-      ...onDelete !== void 0 ? { onDelete } : {},
-      ...keyField !== void 0 ? { keyField } : {}
-    });
-    for (const source of sources) {
-      const sourceId = nodeId(source);
-      const dependents = this._out.get(sourceId);
-      if (dependents) dependents.push(target);
-      else this._out.set(sourceId, [target]);
-    }
-    this._effectiveCache.clear();
-  }
-  /** Whether `target` already has a registered in-edge — lets a caller skip
-   *  re-registering the same target (#638 Task 2 fix wave 2, Finding I2i:
-   *  `registerDerived`'s at-most-once contract must hold across repeated
-   *  identical `vault.collection()` calls, not just within a single one). */
-  hasDerived(target) {
-    return this._in.has(nodeId(target));
-  }
-  /** Mark/query a collection as having declared at least one classified field. */
-  markClassified(collection) {
-    this._classifiedCollections.add(collection);
-  }
-  isClassified(collection) {
-    return this._classifiedCollections.has(collection);
-  }
-  /** Mark/query a collection's depsless (no declared `deps`) computed
-   *  field names — see `_depslessComputed`'s doc comment above. */
-  markDepslessComputed(collection, field) {
-    let set = this._depslessComputed.get(collection);
-    if (!set) {
-      set = /* @__PURE__ */ new Set();
-      this._depslessComputed.set(collection, set);
-    }
-    set.add(field);
-  }
-  depslessComputedFields(collection) {
-    return this._depslessComputed.get(collection) ?? EMPTY_SET;
-  }
-  /** Reject cycles at declare time (vault open). Throws `DerivationCycleError` for a
-   *  derivation/rollup/computed cycle, `MaterializedViewCycleError` for an MV cycle —
-   *  same classes + message shape the registries throw today (behavior lock). */
-  assertAcyclic() {
-    const visited = /* @__PURE__ */ new Set();
-    const stack = [];
-    const visit = (id) => {
-      const idx = stack.indexOf(id);
-      if (idx !== -1) {
-        const cycle = stack.slice(idx).concat(id);
-        const isMv = cycle.some((cycleId) => this._in.get(cycleId)?.kind === "mv");
-        const path = cycle.map(displayNodeId);
-        if (isMv) throw new MaterializedViewCycleError(path);
-        throw new DerivationCycleError(path);
-      }
-      if (visited.has(id)) return;
-      stack.push(id);
-      const dependents = this._out.get(id);
-      if (dependents) {
-        for (const dependent of dependents) visit(nodeId(dependent));
-      }
-      stack.pop();
-      visited.add(id);
-    };
-    for (const id of this._out.keys()) visit(id);
-  }
-  /** A leaf (non-derived) node's own posture contribution: its declared posture,
-   *  or `DEFAULT_POSTURE` if never declared via `registerField`. */
-  _declaredPosture(id) {
-    return this._posture.get(id) ?? DEFAULT_POSTURE;
-  }
-  /** A node's posture contribution when folded into a dependent: recurse if it is
-   *  itself derived, else its declared/default posture. */
-  _contribution(id) {
-    const edge = this._in.get(id);
-    return edge ? this._computeEffective(id, edge) : this._declaredPosture(id);
-  }
-  _computeEffective(id, edge) {
-    const cached = this._effectiveCache.get(id);
-    if (cached) return cached;
-    let result = DEFAULT_POSTURE;
-    for (const source of edge.sources) {
-      result = foldPosture(result, this._contribution(nodeId(source)));
-    }
-    if (edge.grain === "virtual" && result.queryable !== "none") {
-      result = { ...result, queryable: "none" };
-    }
-    this._effectiveCache.set(id, result);
-    return result;
-  }
-  /** Strictest source posture on every axis, per §2. `undefined` when `target` has no
-   *  in-edges (not a derived field). Transitive: folds through chained derivations. */
-  effectivePosture(target) {
-    const id = nodeId(target);
-    const edge = this._in.get(id);
-    if (!edge) return void 0;
-    return this._computeEffective(id, edge);
-  }
-  /** Per-collection { field → effectivePosture } overlay the pipeline consumes (Task 3). */
-  taintedPostures(collection) {
-    const out = /* @__PURE__ */ new Map();
-    for (const edge of this._in.values()) {
-      if (edge.target.collection !== collection) continue;
-      out.set(edge.target.field, this._computeEffective(nodeId(edge.target), edge));
-    }
-    return out;
-  }
-  /** Materialized (`grain !== 'virtual'`) derived fields on `collection` whose effective
-   *  encryptedAtRest resolves to 'sealed' — the taint-seal set (Task 3). #638 Task 7
-   *  makes the `grain !== 'virtual'` filter meaningful: a `computed(fn, { mode: 'virtual' })`
-   *  field is never stored (rides the `present` phase, seam map Part 4's money-Formatted/
-   *  i18n-Label precedent), so it is EXCLUDED here even when its effective `encryptedAtRest`
-   *  folds to `'sealed'` — there is no envelope slot to seal. It still surfaces in
-   *  {@link taintedPostures} (query refusal via `postureFor`'s `queryable` clamp above, and
-   *  export refusal via `exportable`) — only the AT-REST SEALING ACTION is skipped. */
-  taintSealedFields(collection) {
-    const out = /* @__PURE__ */ new Set();
-    for (const edge of this._in.values()) {
-      if (edge.target.collection !== collection || edge.grain === "virtual") continue;
-      const posture = this._computeEffective(nodeId(edge.target), edge);
-      if (posture.encryptedAtRest === "sealed") out.add(edge.target.field);
-    }
-    return out;
-  }
-  /** Fields on `collection` whose registered edge is `grain === 'virtual'` (#638 Task 7) —
-   *  `via-graph-wiring.ts#applyTaintOverlay` intersects this with `exportable === false`
-   *  postures to know which virtual fields need PRESENT-TIME (not just export-time)
-   *  redaction, since a virtual field's value is only ever materialized inside `present()`. */
-  virtualFields(collection) {
-    const out = /* @__PURE__ */ new Set();
-    for (const edge of this._in.values()) {
-      if (edge.target.collection === collection && edge.grain === "virtual") out.add(edge.target.field);
-    }
-    return out;
-  }
-  /** Per-collection { field → immediate source field names that forced its
-   *  effective posture away from `DEFAULT_POSTURE` } — `describe()`'s
-   *  provenance (Task 3). Only the DIRECT declared sources are named (not the
-   *  ultimate origin several hops up a transitive chain); a source absent
-   *  from the result contributed nothing restrictive. */
-  taintProvenance(collection) {
-    const out = /* @__PURE__ */ new Map();
-    for (const edge of this._in.values()) {
-      if (edge.target.collection !== collection) continue;
-      const forcedBy = edge.sources.filter((source) => !isDefaultPosture(this._contribution(nodeId(source)))).map((source) => source.field);
-      if (forcedBy.length > 0) out.set(edge.target.field, forcedBy);
-    }
-    return out;
-  }
-  _targetsDependingOn(collection) {
-    const out = [];
-    for (const edge of this._in.values()) {
-      if (edge.sources.some((source) => source.collection === collection)) {
-        out.push({ target: edge.target, kind: edge.kind, grain: edge.grain });
-      }
-    }
-    return out;
-  }
-  /** Dispatch (Task 4): every derived target triggered by a write to `collection`. Excludes
-   *  `'ref'` edges (#650 Task 5 review, folded Minor) — a `'ref'` edge is consulted only by the
-   *  delete/forget-time restrict/cascade/nullify path ({@link referencingEdgesOf}), never by the
-   *  sync/cutover/restore dispatch wave (`runGraphDispatchWave`); counting it here defeated that
-   *  wave's zero-cost early-continue, costing every write to a referenced backing collection an
-   *  unconditional decrypt + two no-op dispatch passes. {@link derivedArtifactsOf} (erasure
-   *  fanout) still includes `'ref'` edges — the forget path genuinely needs them. */
-  dependentsOf(collection) {
-    return this._targetsDependingOn(collection).filter((edge) => edge.kind !== "ref");
-  }
-  /** Erasure (Task 6): derived artifacts of a forgotten record whose source is `collection`. */
-  derivedArtifactsOf(collection) {
-    return this._targetsDependingOn(collection);
-  }
-  /** Referencing edges pointing AT a backing dimension (delete/forget-time restrict/cascade/
-   *  nullify, #650 Task 5) — an O(1) reverse lookup via the existing `_out` map (keyed at the
-   *  dimension's wildcard `field:'*'` node, the same convention every whole-collection source
-   *  already uses), NEVER a scan across collections or records. `backing` is the collection name
-   *  a lookup field's edge was registered against (a reserved dimension's `_dict_<name>`/
-   *  `_lookup_<name>` collection name, or a matrix dimension's own collection name). */
-  referencingEdgesOf(backing) {
-    const targets = this._out.get(nodeId({ collection: backing, field: "*" }));
-    if (!targets) return [];
-    const out = [];
-    for (const target of targets) {
-      const edge = this._in.get(nodeId(target));
-      if (edge?.kind === "ref" && edge.onDelete !== void 0) {
-        out.push({ referencing: target, onDelete: edge.onDelete, keyField: edge.keyField ?? "id" });
-      }
-    }
-    return out;
-  }
-};
-
-export {
-  DEFAULT_POSTURE,
-  ViaGraph
-};
-//# sourceMappingURL=chunk-7ZANJ6JZ.js.map