@noy-db/hub 0.4.0-pre.5 → 0.4.0-pre.6

package/dist/as/index.js

@@ -1,30 +0,0 @@
-import "../chunk-2YELV6TV.js";
-import {
-  diffVault
-} from "../chunk-LB7FD65R.js";
-import "../chunk-OWOT7CFC.js";
-import {
-  readPod,
-  readPodHeader,
-  writePod
-} from "../chunk-YCAJDK4O.js";
-import "../chunk-YFFEF6HR.js";
-import "../chunk-ZJADGNYF.js";
-import "../chunk-SVLR4POP.js";
-import "../chunk-GEEJPID6.js";
-import "../chunk-SC4JLMZI.js";
-import "../chunk-5WLDZZ6S.js";
-import "../chunk-5HSSTOOG.js";
-import "../chunk-G4MFQXYX.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-7U6AB7DZ.js";
-import "../chunk-YTW6ZIPD.js";
-import "../chunk-6SYOHUHM.js";
-import "../chunk-PZ5AY32C.js";
-export {
-  diffVault,
-  readPod,
-  readPodHeader,
-  writePod
-};
-//# sourceMappingURL=index.js.map

package/dist/at/index.js

@@ -1 +0,0 @@
-//# sourceMappingURL=index.js.map

package/dist/by/index.js

@@ -1,11 +0,0 @@
-import {
-  isQuorum,
-  runDrainBarrier
-} from "../chunk-AFAPBZAA.js";
-import "../chunk-6SYOHUHM.js";
-import "../chunk-PZ5AY32C.js";
-export {
-  isQuorum,
-  runDrainBarrier
-};
-//# sourceMappingURL=index.js.map

package/dist/chunk-2YELV6TV.js

@@ -1 +0,0 @@
-//# sourceMappingURL=chunk-2YELV6TV.js.map

package/dist/chunk-7ICV4ASA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-audit/periods/periods.ts"],"sourcesContent":["/**\n * Accounting-period closure + opening.\n *\n * A closed period seals every record whose envelope `_ts` is at or\n * before the period's `endDate`: further writes (`put` / `delete`)\n * against such records throw {@link PeriodClosedError}. The period\n * itself is stored as a record in the reserved `_periods` collection\n * and written through the normal ledger-instrumented path, so every\n * closure appends a tamper-evident entry to the vault's hash chain.\n *\n * ## Closure model\n *\n * ```\n * vault.closePeriod({ name: 'FY2026-Q1', endDate: '2026-03-31' })\n *   └─► PeriodRecord written to _periods/<name>\n *         ├─ priorPeriodName / priorPeriodHash — chain to last close\n *         ├─ closedAt / closedBy — provenance\n *         └─ normal ledger append fires (LedgerStore.append)\n * ```\n *\n * Enforcement (`assertTsWritable`) is vault-local: the Vault caches\n * the list of closed periods on first read and consults that cache in\n * the `Collection.put` / `.delete` path via the `periodGuard` hook.\n *\n * ## Opening model\n *\n * ```\n * vault.openPeriod({\n *   name: 'FY2026-Q2',\n *   startDate: '2026-04-01',\n *   fromPeriod: 'FY2026-Q1',\n *   carryForward: async (priorView) => Record<string, Record<string, unknown>>,\n * })\n * ```\n *\n * `carryForward` receives a read-only `VaultInstant` anchored at the\n * prior period's `endDate` (built via `vault.at(endDate)`) so the\n * callback can compute closing aggregates from the sealed state. The\n * returned `{ [collectionName]: { [id]: record } }` map is written\n * before the new `PeriodRecord` lands — opening balances materialise\n * as normal records with fresh timestamps that fall outside every\n * closed period.\n *\n * ## Freeze\n *\n * ```\n * vault.freezePeriod('FY2026-Q1')\n *   └─► physically purges delete markers whose write-time falls inside\n *       the closed period's window (via the #589 `_purgeDeleteMarkers`\n *       seam), then records the fact:\n *         ├─ PeriodFreezeRecord written to _period_freezes/<name>\n *         └─ normal ledger append fires (LedgerStore.append)\n * ```\n *\n * The chained `_periods/<name>` record is never mutated — `frozenAt` /\n * `frozenBy` / `purgedMarkerCount` are merged onto the returned\n * `PeriodRecord` at read time from the companion, so a tamper with the\n * freeze can never break the inter-period hash chain. Freezing is\n * terminal (a closed period, once frozen, stays frozen) and idempotent\n * (a second call is a no-op that returns the same merged record without\n * re-purging or re-appending a ledger entry). Freeze does NOT purge\n * forget-tombstones (GDPR crypto-shred erasure evidence), `_history`\n * versions, or live records — the delete-markers-only seam leaves all\n * three untouched by construction.\n *\n * Freeze purges the LOCAL adapter only. On a synced vault, markers already\n * pushed to sync targets survive there, and a later pull re-imports them\n * (benign — they still read deleted, but the space isn't reclaimed). A\n * re-imported marker keeps its original `_ts` (inside the already-frozen\n * period's window), so — like any late-booked delete — it is reclaimed by\n * the NEXT period's freeze, whose window covers it; freeze stays terminal\n * and does NOT re-purge an already-frozen period (#611). Sweeping the sync\n * targets themselves is a cross-target-purge concern deferred to the\n * cold-archival spec. Purging re-opens the #589 resurrection window for a\n * peer offline since before the cutoff, which is why the closed period is\n * the operator-asserted safe-point that gates the call.\n *\n * A period whose purge window has not fully elapsed cannot be frozen —\n * `freezePeriod` throws rather than purge markers for deletes that may not\n * have converged yet (#610).\n *\n * ## Archive\n *\n * ```\n * vault.archivePeriod('FY2026-Q1')\n *   └─► relocates the closed period's in-window records (those with\n *       `_ts < periodExclusiveUpperBound(endDate)`) from the hot store to\n *       the configured cold tier (routeStore's `cold` route), then records:\n *         ├─ PeriodArchiveRecord written to _period_archives/<name>\n *         └─ a ledger entry attributed to _period_archives\n * ```\n *\n * Archival is NON-DESTRUCTIVE: routeStore reads fall through to the cold\n * tier on a hot miss, so an archived record still reads normally. It is\n * therefore gated only on `closed` (not `frozen`) — it does not re-open the\n * #589 resurrection window and needs no convergence safe-point. Freeze\n * (purge markers) and archive (relocate records) are independent and compose\n * in either order. Like freeze, archival keeps the chained `_periods/<name>`\n * record byte-immutable (state lives in the companion) and is idempotent.\n *\n * Bounds by write-time `_ts`, NOT business date: the store tier sees only\n * encrypted envelopes. A record with an in-period business date but a later\n * `_ts` (late-booked) archives at the NEXT period's archive — the same rule\n * freeze uses for late-booked delete markers. Requires a `routeStore` with a\n * cold route (`age: { cold }`); throws otherwise.\n *\n * Read cost: with `withLazy()` (per-id reads) archived records are truly\n * cold — fetched from cold only on access. In the default hydrated mode,\n * `loadAll` merges the cold store, so archived records still load into RAM\n * on vault open (hot-tier STORAGE is reclaimed; RAM is not). Summaries\n * (`_`-prefixed) always stay hot.\n *\n * ## Target-purge\n *\n * ```\n * vault.purgePeriodTargets('FY2026-Q1')\n *   └─► sweeps delete markers (`_ts < periodExclusiveUpperBound(endDate)`) off\n *       the vault's PUSH-ONLY sync targets (backup/archive roles), then records:\n *         ├─ PeriodTargetPurgeRecord written to _period_target_purges/<name>\n *         └─ a ledger entry attributed to _period_target_purges\n * ```\n *\n * Extends freeze's local marker purge to the vault's own remote sinks.\n * `sync-peer` (bidirectional) targets are SKIPPED: purging a marker there\n * re-opens the #589 resurrection window for a client offline before the\n * cutoff, an assertion no single vault can verify. Backup/archive targets are\n * push-only — never pulled from into convergence — so sweeping their markers\n * is safe. Requires the period be frozen first (closed → frozen →\n * target-purged) so the local safe-point is already established. Idempotent\n * once run; a vault with no push-only targets writes no companion and is\n * re-runnable (so a target added later is still swept). Single-vault only —\n * fleet-wide purge across sovereign vaults is klum's concern over\n * `@noy-db/hub/cargo`.\n *\n * ## Not covered\n *\n * - Partial re-opening of a closed period. If an auditor needs to\n *   make a correction inside a sealed period, the sanctioned path is\n *   a compensating entry in the NEW period, not an unlock of the\n *   old one.\n * - Automatic period rollover. `closePeriod` / `openPeriod` are\n *   deliberately explicit operator calls so the caller decides when\n *   the boundary lands.\n *\n * @module\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { LedgerStore } from '../../with-commit/history/ledger/index.js'\nimport { sha256Hex, canonicalJson } from '../../with-commit/history/ledger/index.js'\nimport { PeriodClosedError, ValidationError } from '../../kernel/errors.js'\n\n// The reserved collection names + `periodExclusiveUpperBound` moved to the\n// dependency-light `window.ts` so the sync engine's period-scoped pull (#807)\n// can import them without this module's ledger imports; re-exported here so\n// every existing import path keeps working.\nexport {\n  PERIODS_COLLECTION,\n  PERIOD_FREEZES_COLLECTION,\n  PERIOD_ARCHIVES_COLLECTION,\n  PERIOD_TARGET_PURGES_COLLECTION,\n  periodExclusiveUpperBound,\n} from './window.js'\nimport { PERIODS_COLLECTION } from './window.js'\n\n/**\n * Companion record recording that a closed period was frozen (its delete\n * markers physically purged). Stored in {@link PERIOD_FREEZES_COLLECTION},\n * keyed by period name — kept OFF the hash-chained `_periods/<name>` record so\n * freeze never alters the inter-period chain.\n */\nexport interface PeriodFreezeRecord {\n  readonly period: string\n  readonly frozenAt: string\n  readonly frozenBy: string\n  readonly purgedMarkerCount: number\n}\n\n/**\n * Companion record noting that a closed period was cold-archived (its\n * in-window records physically relocated hot → cold). Stored in\n * {@link PERIOD_ARCHIVES_COLLECTION}, keyed by period name — kept OFF the\n * hash-chained `_periods/<name>` record so archive never alters the chain.\n */\nexport interface PeriodArchiveRecord {\n  readonly period: string\n  readonly archivedAt: string\n  readonly archivedBy: string\n  readonly archivedRecordCount: number\n}\n\n/** Per-target count of delete markers purged off one push-only sync target (#615). */\nexport interface TargetPurgeCount {\n  readonly label?: string\n  readonly role: 'backup' | 'archive'\n  readonly purgedCount: number\n}\n\n/**\n * Companion record noting that a closed+frozen period's delete markers were\n * swept off the vault's push-only sync targets (#615). Stored in\n * {@link PERIOD_TARGET_PURGES_COLLECTION}, keyed by period name — kept OFF the\n * hash-chained `_periods/<name>` record so target-purge never alters the chain.\n */\nexport interface PeriodTargetPurgeRecord {\n  readonly period: string\n  readonly purgedAt: string\n  readonly purgedBy: string\n  readonly targets: readonly TargetPurgeCount[]\n}\n\n/**\n * Stored record for one closed or opened accounting period. One entry\n * per period, keyed by `name` in the reserved `_periods` collection.\n *\n * The hash chain between periods is computed at read time by\n * `loadPeriods()` — each record carries the name + hash of its\n * predecessor so a tamper with any period's record breaks the chain\n * into the next one, the same way the ledger's `prevHash` works.\n */\nexport interface PeriodRecord {\n  /** Human-readable name (e.g., `'FY2026-Q1'`). Unique per vault. */\n  readonly name: string\n  /**\n   * Role discriminator. A period is `'closed'` from the moment its\n   * `closedAt` is recorded; `'opened'` marks a period whose opening\n   * entries have been carried forward via {@link openPeriod}. Many\n   * workflows will produce one opened period per closed period (the\n   * opened one is the SUCCESSOR — its `startDate` equals the prior\n   * `endDate + 1 day`).\n   */\n  readonly kind: 'closed' | 'opened'\n  /** ISO date — inclusive upper bound for records belonging to this period. */\n  readonly endDate: string\n  /** ISO date — lower bound (present on opened periods only). */\n  readonly startDate?: string\n  /**\n   * Record field carrying the business date (e.g. `'date'` on an\n   * invoice, `'paidAt'` on a payment). The guard compares\n   * `record[dateField]` against `endDate` — NOT the envelope `_ts`.\n   * Accounting entries booked late (business date `2026-01-15`,\n   * write-time `2026-04-22`) still get sealed when Q1 closes at\n   * `2026-03-31` because the comparison uses the business date.\n   *\n   * Optional for backwards compat. When absent, the guard falls back\n   * to envelope `_ts` — that's a write-time seal, appropriate for\n   * content that doesn't carry a logical business date (e.g. system\n   * settings) but almost never right for accounting ledgers.\n   */\n  readonly dateField?: string\n  /** ISO timestamp recorded at `closePeriod()` / `openPeriod()` call time. */\n  readonly closedAt: string\n  /** userId of the keyring that invoked the close/open. */\n  readonly closedBy: string\n  /** Name of the prior period this one chains to, if any. */\n  readonly priorPeriodName?: string\n  /** sha256(canonicalJson(priorPeriod)) — empty for the first period. */\n  readonly priorPeriodHash: string\n  /**\n   * Opened periods only — the names of the collections whose\n   * carry-forward aggregates were written by {@link openPeriod}.\n   * Recorded for auditability so a future `verifyPeriodChain()` can\n   * cross-check the opening balances against the closing snapshot.\n   */\n  readonly openingCollections?: readonly string[]\n  /** #604 return-only — merged from the `_period_freezes/<name>` companion on\n   *  read; NEVER written into the stored `_periods/<name>` record (would break\n   *  the hash chain). Absent = not yet frozen. */\n  readonly frozenAt?: string\n  readonly frozenBy?: string\n  readonly purgedMarkerCount?: number\n  /** #613 return-only — merged from the `_period_archives/<name>` companion on\n   *  read; NEVER written into the stored `_periods/<name>` record. Absent = not\n   *  yet archived. */\n  readonly archivedAt?: string\n  readonly archivedBy?: string\n  readonly archivedRecordCount?: number\n  /** #615 return-only — merged from the `_period_target_purges/<name>` companion\n   *  on read; NEVER written into the stored `_periods/<name>` record. Absent =\n   *  target-purge not yet run (or the vault has no push-only targets). */\n  readonly targetsPurgedAt?: string\n  readonly targetsPurgedBy?: string\n  readonly targetsPurged?: readonly TargetPurgeCount[]\n}\n\n/** Options for `vault.closePeriod()`. */\nexport interface ClosePeriodOptions {\n  /** Human-readable name. Must not collide with an existing period. */\n  readonly name: string\n  /**\n   * Inclusive upper cutoff. A record is sealed when its\n   * `record[dateField]` (or, if absent, the envelope `_ts`) is at or\n   * before this ISO timestamp.\n   */\n  readonly endDate: string\n  /**\n   * Record field carrying the business date used for period\n   * membership. Recommended for accounting workflows — e.g. an\n   * invoice booked late (write-time after close) is still sealed\n   * when its `invoice.date` falls inside the closed period.\n   *\n   * Omit to use envelope `_ts` (write-time seal). This fallback\n   * rarely matches real-world accounting semantics; prefer passing\n   * an explicit `dateField`.\n   */\n  readonly dateField?: string\n}\n\n/** Options for `vault.openPeriod()`. */\nexport interface OpenPeriodOptions<TCollections = Record<string, Record<string, unknown>>> {\n  /** Human-readable name for the new period. Must be unique. */\n  readonly name: string\n  /** ISO lower bound of the new period (usually prior `endDate + 1 day`). */\n  readonly startDate: string\n  /**\n   * Name of the prior CLOSED period this one chains from. The prior\n   * period's record is verified to exist and to be `kind: 'closed'`;\n   * its `endDate` is made available to the `carryForward` callback.\n   */\n  readonly fromPeriod: string\n  /**\n   * Receives a read-only facade over the vault's CURRENT state,\n   * plus the prior period's `endDate`. Accounting semantics: after\n   * a period closes, records with `record[dateField] <= endDate`\n   * are frozen — current state equals closing state, so a caller\n   * can compute closing balances by querying the live collection\n   * with a `where('date', '<=', priorEndDate)` filter.\n   *\n   * Returns opening-balance records keyed by collection name.\n   * Example:\n   *\n   * ```ts\n   * carryForward: async (ctx) => {\n   *   const closing = await ctx.collection<Journal>('journal')\n   *     .query().where('date', '<=', ctx.priorEndDate).toArray()\n   *   const opening: Record<string, Journal> = {}\n   *   for (const entry of closing) {\n   *     opening[`OB-${entry.id}`] = { ...entry, date: '2026-04-01' }\n   *   }\n   *   return { journal: opening }\n   * }\n   * ```\n   */\n  readonly carryForward: (\n    ctx: CarryForwardContext,\n  ) => Promise<TCollections> | TCollections\n}\n\n/**\n * Context passed to `OpenPeriodOptions.carryForward`. Exposes a\n * read-only subset of the live vault (`collection(name).get/list`)\n * plus the prior period's `endDate` so business-date filters can\n * be built by the caller.\n *\n * Writes go via the return value, not via the facade — the\n * `collection()` here is deliberately restricted to reads.\n */\nexport interface CarryForwardContext {\n  /** The prior period's `endDate` — the boundary of the closing snapshot. */\n  readonly priorEndDate: string\n  /** Read-only collection facade over current vault state. */\n  collection<T = unknown>(name: string): ReadOnlyCollection<T>\n}\n\n/** Minimum read surface exposed to `carryForward`. */\nexport interface ReadOnlyCollection<T> {\n  get(id: string): Promise<T | null>\n  list(): Promise<T[]>\n}\n\n/**\n * Load every period record currently stored on the adapter.\n * Decrypting is the caller's responsibility (we return plain records\n * so the vault can use its own `_periods` DEK).\n *\n * @internal — called by Vault methods that need the closed-period\n * cache. Not part of the public API surface.\n */\nexport async function loadPeriods(\n  adapter: NoydbStore,\n  vault: string,\n  decrypt: (envelope: EncryptedEnvelope) => Promise<PeriodRecord>,\n): Promise<PeriodRecord[]> {\n  const ids = await adapter.list(vault, PERIODS_COLLECTION)\n  const records: PeriodRecord[] = []\n  for (const id of ids) {\n    const env = await adapter.get(vault, PERIODS_COLLECTION, id)\n    if (env) records.push(await decrypt(env))\n  }\n  // Stable order by closedAt so chain verification is reproducible.\n  records.sort((a, b) => a.closedAt.localeCompare(b.closedAt))\n  return records\n}\n\n/**\n * Given the current ordered period list, pick the last entry that\n * belongs to the hash chain — used as the `priorPeriodHash` anchor\n * for the next closure/opening.\n *\n * @internal\n */\nexport async function chainAnchor(\n  records: readonly PeriodRecord[],\n): Promise<{ priorPeriodName?: string; priorPeriodHash: string }> {\n  const last = records[records.length - 1]\n  if (!last) return { priorPeriodHash: '' }\n  const hash = await sha256Hex(canonicalJson(last as unknown as Record<string, unknown>))\n  return { priorPeriodName: last.name, priorPeriodHash: hash }\n}\n\n/**\n * Throw `PeriodClosedError` if the record being touched falls within\n * any closed period.\n *\n * Three signals, evaluated per period:\n *\n *  1. If the period declares a `dateField`, the guard reads\n *     `record[dateField]` on BOTH the existing (prior) record AND the\n *     incoming (new) record. Either comparing `<= endDate` triggers\n *     the error — callers cannot slide a record into a closed period\n *     by editing its date field.\n *  2. If the period has no `dateField`, the guard falls back to the\n *     envelope `_ts` of the existing record. Fresh inserts (no\n *     existing envelope) pass.\n *  3. For a delete, only the existing side is checked.\n *\n * @internal\n */\nexport function assertTsWritable(\n  existing: { ts: string | null; record: Record<string, unknown> | null } | null,\n  incomingRecord: Record<string, unknown> | null,\n  closedPeriods: readonly PeriodRecord[],\n): void {\n  for (const p of closedPeriods) {\n    if (p.kind !== 'closed') continue\n    if (p.dateField) {\n      const checkRecord = (label: string, r: Record<string, unknown> | null): void => {\n        if (!r) return\n        const v = r[p.dateField!]\n        if (typeof v === 'string' && v <= p.endDate) {\n          throw new PeriodClosedError(p.name, p.endDate, `${label}[${p.dateField}]=${v}`)\n        }\n      }\n      checkRecord('existing', existing?.record ?? null)\n      checkRecord('incoming', incomingRecord)\n      continue\n    }\n    // Fallback: write-time seal via envelope _ts.\n    const existingTs = existing?.ts ?? null\n    if (existingTs !== null && existingTs <= p.endDate) {\n      throw new PeriodClosedError(p.name, p.endDate, existingTs)\n    }\n  }\n}\n\n/**\n * Sanity-check a proposed period name + endDate against existing\n * records. Shared by closePeriod / openPeriod so the two pathways\n * produce identical diagnostics.\n *\n * @internal\n */\nexport function validatePeriodName(\n  name: string,\n  existing: readonly PeriodRecord[],\n): void {\n  if (name.length === 0) {\n    throw new ValidationError('Period name cannot be empty.')\n  }\n  if (existing.some((p) => p.name === name)) {\n    throw new ValidationError(`Period \"${name}\" already exists.`)\n  }\n}\n\n/**\n * Wire a reserved-collection ledger append for a period record. The\n * period itself is stored via the adapter as an encrypted envelope;\n * the ledger entry is a normal `put` with the period's payloadHash,\n * so period closures inherit the chain's tamper-evidence.\n *\n * @internal\n */\nexport async function appendPeriodLedgerEntry(\n  ledger: LedgerStore | null,\n  actor: string,\n  envelope: EncryptedEnvelope,\n  name: string,\n  collection: string = PERIODS_COLLECTION,\n): Promise<void> {\n  if (!ledger) return\n  const { envelopePayloadHash } = await import('../../with-commit/history/ledger/index.js')\n  await ledger.append({\n    op: 'put',\n    collection,\n    id: name,\n    version: envelope._v,\n    actor,\n    payloadHash: await envelopePayloadHash(envelope),\n  })\n}\n"],"mappings":";;;;;;;;;;;;;AA0XA,eAAsB,YACpB,SACA,OACA,SACyB;AACzB,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AACxD,QAAM,UAA0B,CAAC;AACjC,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAC3D,QAAI,IAAK,SAAQ,KAAK,MAAM,QAAQ,GAAG,CAAC;AAAA,EAC1C;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AAC3D,SAAO;AACT;AASA,eAAsB,YACpB,SACgE;AAChE,QAAM,OAAO,QAAQ,QAAQ,SAAS,CAAC;AACvC,MAAI,CAAC,KAAM,QAAO,EAAE,iBAAiB,GAAG;AACxC,QAAM,OAAO,MAAM,UAAU,cAAc,IAA0C,CAAC;AACtF,SAAO,EAAE,iBAAiB,KAAK,MAAM,iBAAiB,KAAK;AAC7D;AAoBO,SAAS,iBACd,UACA,gBACA,eACM;AACN,aAAW,KAAK,eAAe;AAC7B,QAAI,EAAE,SAAS,SAAU;AACzB,QAAI,EAAE,WAAW;AACf,YAAM,cAAc,CAAC,OAAe,MAA4C;AAC9E,YAAI,CAAC,EAAG;AACR,cAAM,IAAI,EAAE,EAAE,SAAU;AACxB,YAAI,OAAO,MAAM,YAAY,KAAK,EAAE,SAAS;AAC3C,gBAAM,IAAI,kBAAkB,EAAE,MAAM,EAAE,SAAS,GAAG,KAAK,IAAI,EAAE,SAAS,KAAK,CAAC,EAAE;AAAA,QAChF;AAAA,MACF;AACA,kBAAY,YAAY,UAAU,UAAU,IAAI;AAChD,kBAAY,YAAY,cAAc;AACtC;AAAA,IACF;AAEA,UAAM,aAAa,UAAU,MAAM;AACnC,QAAI,eAAe,QAAQ,cAAc,EAAE,SAAS;AAClD,YAAM,IAAI,kBAAkB,EAAE,MAAM,EAAE,SAAS,UAAU;AAAA,IAC3D;AAAA,EACF;AACF;AASO,SAAS,mBACd,MACA,UACM;AACN,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,gBAAgB,8BAA8B;AAAA,EAC1D;AACA,MAAI,SAAS,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,GAAG;AACzC,UAAM,IAAI,gBAAgB,WAAW,IAAI,mBAAmB;AAAA,EAC9D;AACF;AAUA,eAAsB,wBACpB,QACA,OACA,UACA,MACA,aAAqB,oBACN;AACf,MAAI,CAAC,OAAQ;AACb,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,sBAA2C;AACxF,QAAM,OAAO,OAAO;AAAA,IAClB,IAAI;AAAA,IACJ;AAAA,IACA,IAAI;AAAA,IACJ,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,aAAa,MAAM,oBAAoB,QAAQ;AAAA,EACjD,CAAC;AACH;","names":[]}

package/dist/chunk-AFAPBZAA.js

@@ -1,54 +0,0 @@
-import {
-  QuiesceTimeoutError
-} from "./chunk-6SYOHUHM.js";
-
-// src/port/by/types.ts
-function isQuorum(writers, generation, excludeWriterId) {
-  return writers.filter((w) => w.writerId !== excludeWriterId).every((w) => w.quiescedAtVersion === generation);
-}
-async function runDrainBarrier(provider, o, run) {
-  await provider.setFence(o.vault, { currentSchemaVersion: o.generation, fenceState: "draining" });
-  await o.onFlush();
-  const deadline = o.now() + o.quiesceTimeoutMs;
-  const seeded = await provider.reachableWriters(o.vault, { staleMs: o.staleMs, now: o.now() });
-  if (!isQuorum(seeded, o.generation, o.writerId)) {
-    await new Promise((resolve, reject) => {
-      let settled = false;
-      const finish = (fn) => {
-        if (!settled) {
-          settled = true;
-          unsub();
-          fn();
-        }
-      };
-      const unsub = provider.observePresence(o.vault, (writers) => {
-        if (isQuorum(writers, o.generation, o.writerId)) finish(resolve);
-      });
-      const tick = async () => {
-        if (settled) return;
-        if (o.now() >= deadline) {
-          finish(
-            () => reject(
-              new QuiesceTimeoutError(
-                `Cutover of vault "${o.vault}" to generation ${o.generation} timed out after ${o.quiesceTimeoutMs}ms waiting for active writers to quiesce.`
-              )
-            )
-          );
-          return;
-        }
-        if (o.onPoll) await o.onPoll();
-        const w = await provider.reachableWriters(o.vault, { staleMs: o.staleMs, now: o.now() });
-        if (isQuorum(w, o.generation, o.writerId)) finish(resolve);
-        else setTimeout(() => void tick(), 25);
-      };
-      void tick();
-    });
-  }
-  await run();
-}
-
-export {
-  isQuorum,
-  runDrainBarrier
-};
-//# sourceMappingURL=chunk-AFAPBZAA.js.map

package/dist/chunk-AFAPBZAA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/port/by/types.ts"],"sourcesContent":["/**\n * Kernel coordination port — the injected `CoordinationProvider` seam for the\n * schema-fence drain-barrier.\n *\n * The kernel defines this port; `@noy-db/by-tabs` / `@noy-db/by-peer` implement\n * it for real-time quorum, and an external orchestrator (`@klum-db/lobby`)\n * drives it through the `Noydb` handle without ever naming a `by-*` package.\n * The dependency arrow is `by-* → kernel ← klum`, the app at the apex.\n *\n * This module carries only the port TYPES plus two pure-ish helpers:\n * {@link isQuorum} (a pure quorum predicate extracted from the legacy\n * `activeQuiesced`) and {@link runDrainBarrier} (the reusable barrier protocol\n * the migration cutover and klum both call).\n *\n * @module\n */\n\nimport { QuiesceTimeoutError } from '../../kernel/errors.js'\nimport type { Unsubscribe } from '../with/write-hooks.js'\n\n/** Vault fence state (the existing FenceDoc shape). */\nexport interface FenceState {\n  readonly currentSchemaVersion: number\n  readonly fenceState: 'normal' | 'draining' | 'migrating' | 'complete'\n}\n\n/** A writer's presence + ack, tagged with the session that owns it. */\nexport interface WriterPresence {\n  /** = today's clientId (one per tab/peer). */\n  readonly writerId: string\n  /** Groups one user's writers across vaults (consolidation is klum's job). */\n  readonly sessionId: string\n  readonly lastSeen: number\n  readonly quiescedAtVersion: number | null\n}\n\n/** Session-addressable drain-barrier coordination transport. Per-vault ops. */\nexport interface CoordinationProvider {\n  /** orchestrator → all writers */\n  setFence(vault: string, fence: FenceState): Promise<void>\n  /**\n   * Fresh one-shot fence read for the write-path gate (`assertWritable`).\n   * A direct read (not a cached `observeFence` snapshot) avoids a staleness\n   * window and keeps the timing-sensitive cutover gate exact. The store\n   * default reads `_meta/schema-fence`; `by-*` return their last-pushed fence.\n   */\n  readFence(vault: string): Promise<FenceState>\n  /** writer observes fence changes (default: poll-emit; by-*: push) */\n  observeFence(vault: string, onChange: (f: FenceState) => void): Unsubscribe\n  /** writer → orchestrator: presence + ack (heartbeat + quiescedAtVersion) */\n  reportPresence(vault: string, p: WriterPresence): Promise<void>\n  /** orchestrator observes presence changes (default: poll-emit; by-*: push) */\n  observePresence(vault: string, onChange: (writers: readonly WriterPresence[]) => void): Unsubscribe\n  /** orchestrator one-shot snapshot of reachable writers (quorum input) */\n  reachableWriters(vault: string, o: { staleMs: number; now: number }): Promise<readonly WriterPresence[]>\n}\n\n/**\n * Pure quorum predicate: true when every writer (other than `excludeWriterId`)\n * has acked at exactly `generation`. An empty set is trivially a quorum.\n *\n * Extracted from the legacy `activeQuiesced` store-polling check so the\n * migration cutover, the store default provider, and `by-*` real-time\n * providers all share one definition of \"everyone has drained\".\n */\nexport function isQuorum(\n  writers: readonly WriterPresence[],\n  generation: number,\n  excludeWriterId?: string,\n): boolean {\n  return writers.filter((w) => w.writerId !== excludeWriterId).every((w) => w.quiescedAtVersion === generation)\n}\n\n/** Inputs for {@link runDrainBarrier}. */\nexport interface DrainBarrierOptions {\n  readonly vault: string\n  readonly generation: number\n  readonly writerId: string\n  readonly onFlush: () => Promise<void>\n  readonly staleMs: number\n  readonly quiesceTimeoutMs: number\n  readonly now: () => number\n  /** Optional seam (mainly for deterministic tests) run before each poll tick. */\n  readonly onPoll?: () => Promise<void>\n}\n\n/**\n * The reusable drain-barrier protocol shared by the migration cutover and klum:\n *\n *   drain self → setFence(draining) → await quorum (presence push + isQuorum,\n *   polling as a fallback, or timeout) → run() → release-by-caller.\n *\n * Resolves once every reachable writer (excluding `writerId`) has quiesced at\n * `generation`, at which point `run` is invoked exactly once. Rejects with\n * {@link QuiesceTimeoutError} if `quiesceTimeoutMs` elapses first.\n */\nexport async function runDrainBarrier(\n  provider: CoordinationProvider,\n  o: DrainBarrierOptions,\n  run: () => Promise<void>,\n): Promise<void> {\n  await provider.setFence(o.vault, { currentSchemaVersion: o.generation, fenceState: 'draining' })\n  await o.onFlush()\n\n  const deadline = o.now() + o.quiesceTimeoutMs\n  const seeded = await provider.reachableWriters(o.vault, { staleMs: o.staleMs, now: o.now() })\n  if (!isQuorum(seeded, o.generation, o.writerId)) {\n    await new Promise<void>((resolve, reject) => {\n      let settled = false\n      const finish = (fn: () => void) => {\n        if (!settled) {\n          settled = true\n          unsub()\n          fn()\n        }\n      }\n      const unsub = provider.observePresence(o.vault, (writers) => {\n        if (isQuorum(writers, o.generation, o.writerId)) finish(resolve)\n      })\n      const tick = async () => {\n        if (settled) return\n        if (o.now() >= deadline) {\n          finish(() =>\n            reject(\n              new QuiesceTimeoutError(\n                `Cutover of vault \"${o.vault}\" to generation ${o.generation} timed out ` +\n                  `after ${o.quiesceTimeoutMs}ms waiting for active writers to quiesce.`,\n              ),\n            ),\n          )\n          return\n        }\n        if (o.onPoll) await o.onPoll()\n        const w = await provider.reachableWriters(o.vault, { staleMs: o.staleMs, now: o.now() })\n        if (isQuorum(w, o.generation, o.writerId)) finish(resolve)\n        else setTimeout(() => void tick(), 25)\n      }\n      void tick()\n    })\n  }\n  await run()\n}\n"],"mappings":";;;;;AAiEO,SAAS,SACd,SACA,YACA,iBACS;AACT,SAAO,QAAQ,OAAO,CAAC,MAAM,EAAE,aAAa,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,UAAU;AAC9G;AAyBA,eAAsB,gBACpB,UACA,GACA,KACe;AACf,QAAM,SAAS,SAAS,EAAE,OAAO,EAAE,sBAAsB,EAAE,YAAY,YAAY,WAAW,CAAC;AAC/F,QAAM,EAAE,QAAQ;AAEhB,QAAM,WAAW,EAAE,IAAI,IAAI,EAAE;AAC7B,QAAM,SAAS,MAAM,SAAS,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,KAAK,EAAE,IAAI,EAAE,CAAC;AAC5F,MAAI,CAAC,SAAS,QAAQ,EAAE,YAAY,EAAE,QAAQ,GAAG;AAC/C,UAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,UAAI,UAAU;AACd,YAAM,SAAS,CAAC,OAAmB;AACjC,YAAI,CAAC,SAAS;AACZ,oBAAU;AACV,gBAAM;AACN,aAAG;AAAA,QACL;AAAA,MACF;AACA,YAAM,QAAQ,SAAS,gBAAgB,EAAE,OAAO,CAAC,YAAY;AAC3D,YAAI,SAAS,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAG,QAAO,OAAO;AAAA,MACjE,CAAC;AACD,YAAM,OAAO,YAAY;AACvB,YAAI,QAAS;AACb,YAAI,EAAE,IAAI,KAAK,UAAU;AACvB;AAAA,YAAO,MACL;AAAA,cACE,IAAI;AAAA,gBACF,qBAAqB,EAAE,KAAK,mBAAmB,EAAE,UAAU,oBAChD,EAAE,gBAAgB;AAAA,cAC/B;AAAA,YACF;AAAA,UACF;AACA;AAAA,QACF;AACA,YAAI,EAAE,OAAQ,OAAM,EAAE,OAAO;AAC7B,cAAM,IAAI,MAAM,SAAS,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,KAAK,EAAE,IAAI,EAAE,CAAC;AACvF,YAAI,SAAS,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAG,QAAO,OAAO;AAAA,YACpD,YAAW,MAAM,KAAK,KAAK,GAAG,EAAE;AAAA,MACvC;AACA,WAAK,KAAK;AAAA,IACZ,CAAC;AAAA,EACH;AACA,QAAM,IAAI;AACZ;","names":[]}

package/dist/chunk-BY5YBSXA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-lookup/indexing/persisted-indexes.ts","../src/with-lookup/indexing/lazy-builder.ts"],"sourcesContent":["/**\n * Persistent, encrypted secondary indexes for lazy-mode collections.\n *\n * Parallel to the in-memory `CollectionIndexes` used by eager mode (see\n * `packages/hub/src/query/indexes.ts`): same logical surface, but entries\n * are materialised as encrypted side-car records (`_idx/<field>/<recordId>`)\n * and bulk-loaded into an in-memory mirror on first query.\n *\n * This module only owns the id-namespace convention, the in-memory mirror,\n * and the typed errors. Write-path integration (PR 2 / ), query-planner\n * dispatch (PR 3 / , PR 4 / ), and the rebuild/reconcile utilities\n * (PR 5 / ) live in other files.\n *\n * See the design spec for the full architecture + threat model.\n */\n\n/**\n * Reserved id prefix for encrypted index side-car records.\n * Matches the existing `_keyring`, `_ledger_deltas/…`, `_meta/handle`\n * conventions inside a collection's id namespace.\n */\nexport const IDX_PREFIX = '_idx/' as const\n\n/**\n * Encode the side-car record id for a (field, recordId) pair.\n *\n * Format: `_idx/<field>/<recordId>` — no escaping. Field names may contain\n * dots (for dotted-path access consistent with eager-mode `readPath`);\n * record ids may contain slashes. The first two slash-separated segments\n * are `_idx` and the field; everything after the *second* slash is the\n * record id verbatim.\n */\nexport function encodeIdxId(field: string, recordId: string): string {\n  return `${IDX_PREFIX}${field}/${recordId}`\n}\n\n/**\n * Decode a side-car id back into `{ field, recordId }`, or `null` if the\n * input is not a well-formed idx id. A well-formed id is:\n *   - prefixed with `_idx/`\n *   - contains a field segment (non-empty, no slashes)\n *   - contains a record-id segment (non-empty, may contain slashes)\n */\nexport function decodeIdxId(id: string): { field: string; recordId: string } | null {\n  if (!id.startsWith(IDX_PREFIX)) return null\n  const rest = id.slice(IDX_PREFIX.length)\n  const firstSlash = rest.indexOf('/')\n  if (firstSlash <= 0) return null\n  const field = rest.slice(0, firstSlash)\n  const recordId = rest.slice(firstSlash + 1)\n  if (recordId.length === 0) return null\n  return { field, recordId }\n}\n\n/**\n * Fast-path predicate for discriminating side-car ids from regular record\n * ids and other reserved namespaces. Used by the hub to filter `list()`\n * results during bulk-load of the in-memory mirror.\n */\nexport function isIdxId(id: string): boolean {\n  return decodeIdxId(id) !== null\n}\n\n/**\n * Sorted-value entry returned by `orderedBy()`. Mirrors the body shape\n * used by the write path — but `orderedBy` emits them already sorted by\n * `value` in the requested direction. Consumers (PR 4 / ) treat the\n * array as immutable and paginate via a numeric offset.\n *\n * **Note on `value`:** as of, this is the ORIGINAL TYPED\n * value (number, Date, boolean, etc.), not the stringified bucket key.\n * That's what lets range predicates and `orderedBy` compare numerically\n * instead of stumbling into `'10' < '2'` on `String(n)`.\n */\nexport interface OrderedEntry {\n  readonly recordId: string\n  readonly value: unknown\n}\n\n/**\n * Bulk-load row shape accepted by `ingest()`. The `value` field is the\n * decrypted index body's `value` field verbatim.\n */\nexport interface IngestRow {\n  readonly recordId: string\n  readonly value: unknown\n}\n\n/**\n * In-memory mirror of the persisted index side-car records for a single\n * collection. Populated by bulk-loading `_idx/<field>/*` ids on first\n * query and maintained incrementally by `Collection.put()` / `.delete()`\n * via `upsert()` / `remove()`.\n *\n * API surface is deliberately parallel to `CollectionIndexes` (eager mode)\n * so the query planner in PR 3/4 can dispatch to either polymorphically.\n *\n * Lifecycle:\n *  - `declare(field)` — accept the field as indexable (idempotent)\n *  - `ingest(field, rows[])` — bulk-load from decrypted index bodies\n *  - `upsert(recordId, field, newValue, previousValue)` — incremental update\n *  - `remove(recordId, field, value)` — incremental remove\n *  - `lookupEqual(field, value)` / `lookupIn(field, values)` — equality reads\n *  - `orderedBy(field, dir)` — sorted iteration for orderBy\n *  - `clear()` — drop all buckets (invalidation / rotation)\n */\n/**\n * Per-field storage: the equality bucket map AND a parallel table of typed\n * values keyed by recordId. The typed table exists so range predicates\n * and `orderedBy` can compare on the original typed value rather\n * than the stringified bucket key — String(10) < String(2) is the classic\n * landmine `stringifyKey` introduces for numeric fields.\n */\ninterface PersistedFieldState {\n  readonly buckets: Map<string, Set<string>>\n  readonly values: Map<string, unknown>\n}\n\n/**\n * Structured index definition. Single-field indexes carry just a field\n * name; composite indexes carry the ordered list of fields and\n * the synthetic `key` (= fields joined by `COMPOSITE_DELIMITER`) used\n * as the bucket-map key and side-car envelope id segment.\n */\nexport type PersistedIndexDef =\n  | { readonly kind: 'single'; readonly field: string; readonly key: string }\n  | { readonly kind: 'composite'; readonly fields: readonly string[]; readonly key: string }\n\n/**\n * Delimiter used to synthesize a composite-index key from an ordered\n * field list. Intentionally a character that is extremely unusual in\n * JavaScript object keys (`|`) so collision with a literal field name\n * is vanishingly rare in practice. Composite declarations whose field\n * names contain `|` are rejected at declare-time with an explicit\n * error.\n */\nexport const COMPOSITE_DELIMITER = '|'\n\nexport function compositeKey(fields: readonly string[]): string {\n  return fields.join(COMPOSITE_DELIMITER)\n}\n\nexport class PersistedCollectionIndex {\n  private readonly indexes = new Map<string, PersistedFieldState>()\n  private readonly defs = new Map<string, PersistedIndexDef>()\n\n  /**\n   * Per-field bucket-key canonicalizer (#677 — lazy twin of #672's\n   * `CollectionIndexes.setCanonicalizer`), registered ONCE via\n   * {@link setCanonicalizer} when the collection wires indexing up\n   * (money-aware via `ViaPipeline.canonicalizeIndexKey`). Consulted by\n   * EVERY bucket-mutation site — `ingest`/`upsert`/`remove` — so bucket\n   * membership is symmetric: a legacy non-canonical stored value (e.g.\n   * `'0100'`) and a canonical one (`'100'`) land in the SAME bucket,\n   * mirroring `eager-indexes.ts`'s `addToIndex`/`removeFromIndex`.\n   */\n  private canonicalize?: (field: string, value: unknown) => string | undefined\n\n  /**\n   * Register the bucket-key canonicalizer. Called once, where the\n   * collection constructs its indexing state — safe to call again (the\n   * closure is simply replaced) but there is normally only one caller.\n   */\n  setCanonicalizer(fn: (field: string, value: unknown) => string | undefined): void {\n    this.canonicalize = fn\n  }\n\n  /**\n   * Declare a single-field index. Subsequent `upsert` / `ingest` calls\n   * populate the in-memory mirror; calls before `declare` are no-ops\n   * (tolerant bulk-load ordering). Idempotent.\n   */\n  declare(field: string): void {\n    if (this.indexes.has(field)) return\n    this.indexes.set(field, { buckets: new Map(), values: new Map() })\n    this.defs.set(field, { kind: 'single', field, key: field })\n  }\n\n  /**\n   * Declare a composite (multi-field) index. The synthetic\n   * key is `fields.join('|')`; it doubles as the in-memory map key and\n   * the `_idx/<key>/<recordId>` side-car field segment. Callers upsert\n   * and lookup via the same `key` as single-field indexes, just with a\n   * tuple value (JSON-stringified for bucketing).\n   */\n  declareComposite(fields: readonly string[]): void {\n    if (fields.length === 0) {\n      throw new Error('declareComposite: fields array must be non-empty')\n    }\n    for (const f of fields) {\n      if (f.includes(COMPOSITE_DELIMITER)) {\n        throw new Error(\n          `declareComposite: field \"${f}\" contains the composite delimiter ` +\n          `\"${COMPOSITE_DELIMITER}\" — pick a different field name or open an ` +\n          `issue to add hash-based composite keys.`,\n        )\n      }\n    }\n    const key = compositeKey(fields)\n    if (this.indexes.has(key)) return\n    this.indexes.set(key, { buckets: new Map(), values: new Map() })\n    this.defs.set(key, { kind: 'composite', fields: [...fields], key })\n  }\n\n  /**\n   * Every declared index's structured definition. Collection walks this\n   * when materialising side-cars on put/delete so it can extract a\n   * single-field value or a composite tuple appropriately.\n   */\n  definitions(): PersistedIndexDef[] {\n    return [...this.defs.values()]\n  }\n\n  /** True if `field` has been declared as indexable on this mirror. */\n  has(field: string): boolean {\n    return this.indexes.has(field)\n  }\n\n  /** All declared field names, in declaration order. */\n  fields(): string[] {\n    return [...this.indexes.keys()]\n  }\n\n  /**\n   * Bulk-load the mirror from decrypted index bodies. Intended to be\n   * called once per field after reading the collection's `_idx/<field>/*`\n   * side-cars. Safe to call twice with the same rows — bucket Sets\n   * deduplicate recordIds. If `field` is not declared, this is a no-op\n   * (tolerates the case where bulk-load runs before `declare()` lands).\n   */\n  ingest(field: string, rows: readonly IngestRow[]): void {\n    const state = this.indexes.get(field)\n    if (!state) return\n    for (const row of rows) {\n      addToState(state, row.recordId, row.value, field, this.canonicalize)\n    }\n  }\n\n  /**\n   * Incrementally update a record's index entry for one field. Called by\n   * `Collection.put()` after the main write succeeds. If\n   * `previousValue` is non-null, the record is removed from the old\n   * bucket first — this is the update path. Pass `null` for fresh adds.\n   * No-op if the field is not declared.\n   */\n  upsert(recordId: string, field: string, newValue: unknown, previousValue: unknown): void {\n    const state = this.indexes.get(field)\n    if (!state) return\n    if (previousValue !== null && previousValue !== undefined) {\n      removeFromState(state, recordId, previousValue, field, this.canonicalize)\n    }\n    addToState(state, recordId, newValue, field, this.canonicalize)\n  }\n\n  /**\n   * Remove a record from the index for one field. Called by\n   * `Collection.delete()`. No-op if the field is not declared or\n   * the record isn't in the bucket. Empty buckets are dropped to keep\n   * the Map clean.\n   */\n  remove(recordId: string, field: string, value: unknown): void {\n    const state = this.indexes.get(field)\n    if (!state) return\n    removeFromState(state, recordId, value, field, this.canonicalize)\n  }\n\n  /**\n   * Drop all bucket data while preserving field declarations. Called on\n   * invalidation (incoming sync changes, keyring rotation) — the next\n   * query re-populates via `ingest`.\n   */\n  clear(): void {\n    for (const state of this.indexes.values()) {\n      state.buckets.clear()\n      state.values.clear()\n    }\n  }\n\n  /**\n   * Equality lookup — return the set of record ids whose `field` matches\n   * `value`. Returns `null` if the field is not declared (caller falls\n   * back to scan or throws `IndexRequiredError`). Returns a shared empty\n   * set if the field is declared but no record matches — that set MUST\n   * NOT be mutated by the caller.\n   *\n   * `value` is bucketed via the plain {@link stringifyKey} — it is NOT\n   * canonicalized here. Callers on a Via-covered field (money) canonicalize\n   * `value` themselves BEFORE calling (see `lazy-builder.ts`'s\n   * `resolveCandidateIds()`, #677) — the SAME caller-canonicalizes split\n   * `eager-indexes.ts`'s `lookupEqual`/`lookupIn` use (see `kernel/query/\n   * builder.ts`'s `candidateRecords()`), so probing here twice never\n   * double-canonicalizes.\n   */\n  lookupEqual(field: string, value: unknown): ReadonlySet<string> | null {\n    const state = this.indexes.get(field)\n    if (!state) return null\n    const key = stringifyKey(value)\n    return state.buckets.get(key) ?? EMPTY_SET\n  }\n\n  /**\n   * Set lookup — return the union of record ids whose `field` matches any\n   * of `values`. Returns `null` if the field is not declared. Returns a\n   * fresh (non-shared) Set — safe for the caller to mutate. Same\n   * caller-canonicalizes contract as {@link lookupEqual} (#677).\n   */\n  lookupIn(field: string, values: readonly unknown[]): ReadonlySet<string> | null {\n    const state = this.indexes.get(field)\n    if (!state) return null\n    const out = new Set<string>()\n    for (const value of values) {\n      const bucket = state.buckets.get(stringifyKey(value))\n      if (bucket) for (const id of bucket) out.add(id)\n    }\n    return out\n  }\n\n  /**\n   * Range lookup. Return record ids whose indexed value\n   * satisfies the predicate. Comparison happens on the ORIGINAL TYPED\n   * value carried in `state.values` — so numeric `<` sorts numerically,\n   * not lexicographically on `String(n)`. Returns `null` if the field\n   * is not declared.\n   *\n   * Supported ops: `'<'`, `'<='`, `'>'`, `'>='`, `'between'`. For\n   * `'between'`, `value` is `[lo, hi]` and both bounds are inclusive\n   * (matches the eager-mode operator contract in `predicate.ts`).\n   *\n   * NOT canonicalized (#677): this method compares `value` against the\n   * ORIGINAL TYPED `state.values`, not a stringified bucket key, so a\n   * `canonicalizeIndexKey`-shaped (`string | undefined`) result would not\n   * even type-check as a bound here. This does NOT mirror eager mode the\n   * way `lookupEqual`/`lookupIn` do: `moneyIndexProbe` (`via/money/\n   * where.ts`) never emits a range probe, so EAGER mode's `candidateRecords`\n   * never calls an index for a range clause and always scans.\n   *\n   * LAZY mode's `resolveCandidateIds()` (`lazy-builder.ts`) no longer\n   * dispatches a Via-covered (e.g. money) range clause through THIS method\n   * at all (#684) — it enumerates the field's indexed ids via `orderedBy()`\n   * instead and leaves the raw/typed comparison here for the (now\n   * Via-aware) post-filter to redo correctly in scaled-int space. A\n   * NON-via range clause still dispatches through this method exactly as\n   * before — the raw/typed comparison here is correct and sufficient for\n   * fields with no decode-transforming Via binding.\n   */\n  lookupRange(\n    field: string,\n    op: '<' | '<=' | '>' | '>=' | 'between',\n    value: unknown,\n  ): ReadonlySet<string> | null {\n    const state = this.indexes.get(field)\n    if (!state) return null\n    const out = new Set<string>()\n    for (const [recordId, live] of state.values) {\n      if (live === undefined || live === null) continue\n      if (matchesRange(live, op, value)) out.add(recordId)\n    }\n    return out\n  }\n\n  /**\n   * Sorted iteration — return every entry on `field` as an\n   * `OrderedEntry[]`, sorted by the ORIGINAL TYPED value (no more\n   * `'10' < '2'` surprises on numeric fields). Consumers paginate with\n   * a numeric offset. `OrderedEntry.value` is the typed value.\n   */\n  orderedBy(field: string, dir: 'asc' | 'desc'): readonly OrderedEntry[] | null {\n    const state = this.indexes.get(field)\n    if (!state) return null\n    const entries: OrderedEntry[] = []\n    for (const [recordId, value] of state.values) {\n      entries.push({ recordId, value })\n    }\n    entries.sort((a, b) => compareTyped(a.value, b.value))\n    if (dir === 'desc') entries.reverse()\n    return entries\n  }\n}\n\nconst EMPTY_SET: ReadonlySet<string> = new Set()\n\n/**\n * Canonicalize a value into a bucket key. Deliberately identical to the\n * eager-mode `stringifyKey` in `query/indexes.ts` so semantics match. When\n * `query/indexes.ts` changes its coercion rules, update this in lockstep.\n *\n * null / undefined values are NOT indexed — callers who pass them to\n * `upsert` / `remove` short-circuit before reaching this function; the\n * sentinel here exists only to make `lookupEqual(field, null)` return\n * an empty bucket (rather than matching some arbitrary record).\n */\nfunction stringifyKey(value: unknown): string {\n  if (value === null || value === undefined) return '\\0NULL\\0'\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'boolean') return String(value)\n  if (value instanceof Date) return value.toISOString()\n  // composite index values are tuple arrays. JSON.stringify\n  // gives a delimiter-safe, order-preserving canonical form so buckets\n  // for `['c-A', '2026-Q1']` and `['c-A', '2026-Q2']` never collide.\n  if (Array.isArray(value)) {\n    const parts: string[] = []\n    for (const el of value) parts.push(stringifyKey(el))\n    return JSON.stringify(parts)\n  }\n  return '\\0OBJECT\\0'\n}\n\nfunction addToState(\n  state: PersistedFieldState,\n  recordId: string,\n  value: unknown,\n  field: string,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  if (value === null || value === undefined) return\n  const key = canonicalize?.(field, value) ?? stringifyKey(value)\n  let bucket = state.buckets.get(key)\n  if (!bucket) {\n    bucket = new Set()\n    state.buckets.set(key, bucket)\n  }\n  bucket.add(recordId)\n  state.values.set(recordId, value)\n}\n\nfunction removeFromState(\n  state: PersistedFieldState,\n  recordId: string,\n  value: unknown,\n  field: string,\n  canonicalize?: (field: string, value: unknown) => string | undefined,\n): void {\n  if (value === null || value === undefined) return\n  const key = canonicalize?.(field, value) ?? stringifyKey(value)\n  const bucket = state.buckets.get(key)\n  if (bucket) {\n    bucket.delete(recordId)\n    if (bucket.size === 0) state.buckets.delete(key)\n  }\n  state.values.delete(recordId)\n}\n\n/**\n * Range-predicate comparator. Runs on the ORIGINAL TYPED value so numeric\n * fields sort numerically (not lexicographically on `String(n)`). ISO-8601\n * date strings already sort correctly lexicographically; Date instances\n * compare via `getTime()` before the string branch to keep the contract\n * honest regardless of which form survived serialization.\n */\nfunction matchesRange(\n  live: unknown,\n  op: '<' | '<=' | '>' | '>=' | 'between',\n  bound: unknown,\n): boolean {\n  if (op === 'between') {\n    if (!Array.isArray(bound) || bound.length !== 2) return false\n    return compareTyped(live, bound[0]) >= 0 && compareTyped(live, bound[1]) <= 0\n  }\n  const cmp = compareTyped(live, bound)\n  switch (op) {\n    case '<':  return cmp < 0\n    case '<=': return cmp <= 0\n    case '>':  return cmp > 0\n    case '>=': return cmp >= 0\n  }\n}\n\nfunction compareTyped(a: unknown, b: unknown): number {\n  if (a === undefined || a === null) return b === undefined || b === null ? 0 : 1\n  if (b === undefined || b === null) return -1\n  if (typeof a === 'number' && typeof b === 'number') return a - b\n  if (a instanceof Date && b instanceof Date) return a.getTime() - b.getTime()\n  if (typeof a === 'string' && typeof b === 'string') return a < b ? -1 : a > b ? 1 : 0\n  if (typeof a === 'boolean' && typeof b === 'boolean') {\n    return a === b ? 0 : a ? 1 : -1\n  }\n  // Mixed/unsupported types: deliberately treat as equal so sort stays\n  // stable. Matches the eager-mode `compareValues` contract in\n  // builder.ts — we don't silently coerce arbitrary objects to strings\n  // (which would be meaningless) nor throw (which would be hostile).\n  return 0\n}\n","/**\n * Lazy-mode query builder.\n *\n * Companion to `Query<T>` in `builder.ts`, but built for collections in lazy\n * mode where `snapshot()` is unavailable — records live in the adapter and\n * are pulled on demand. Dispatches through `PersistedCollectionIndex` to\n * resolve a candidate record-id set, then decrypts only those records.\n *\n * Scope:\n *   - `.where(field, '==' | 'in', value)` — dispatched through the index\n *   - `.where(field, other-op, value)` — evaluated against the decrypted\n *     candidate set (non-indexed ops still require the field to be indexed\n *     — we need SOMETHING to scope the candidate set)\n *   - `.orderBy(field, dir?)` — dispatched through `orderedBy` when no\n *     `==`/`in` clause is present; otherwise applied as an in-memory sort\n *     over the candidate set\n *   - `.limit(n)` / `.offset(n)` — page slice after filtering\n *   - `.toArray()` / `.first()` / `.count()` — terminals\n *\n * Every field referenced by a where or orderBy clause MUST be indexed;\n * otherwise `toArray()` throws `IndexRequiredError`. This is deliberate:\n * silent scan-fallback would hide the very performance cliff that lazy-mode\n * indexes exist to prevent (see `docs/architecture.md` §indexes).\n */\n\nimport type { Clause, FieldClause, Operator } from '../../kernel/query/predicate.js'\nimport { evaluateClause, readPath } from '../../kernel/query/predicate.js'\nimport type { PersistedCollectionIndex } from './persisted-indexes.js'\nimport { IndexRequiredError, FieldNotQueryableError } from '../../kernel/errors.js'\nimport type { QueryField } from '../../kernel/types.js'\nimport type { ViaPipeline } from '../../kernel/via/pipeline.js'\n\nexport interface LazyOrderBy {\n  readonly field: string\n  readonly direction: 'asc' | 'desc'\n}\n\n/**\n * Source abstraction the LazyQuery runs against. Collection implements it.\n * Kept minimal so the builder stays test-friendly.\n */\nexport interface LazyQuerySource<T> {\n  readonly collectionName: string\n  readonly persistedIndexes: PersistedCollectionIndex\n  /**\n   * Per-field bucket-key canonicalizer (#677 — lazy twin of the eager\n   * `candidateRecords()` probe-resolution in `kernel/query/builder.ts`).\n   * Consulted in `resolveCandidateIds()` for `==`/`in` clause values\n   * BEFORE calling `lookupEqual`/`lookupIn`, so a mixed-era stored value\n   * (money) probes the SAME canonical bucket the write path now\n   * populates. A narrow closure — not the whole `ViaPipeline` — keeps\n   * the with-lookup/kernel seam thin. `undefined` (no via, or no binding\n   * covers the field) is the common case: falls back to the raw value,\n   * unchanged from today.\n   */\n  canonicalizeIndexKey?(field: string, value: unknown): string | undefined\n  /** Ensure `_idx/<field>/*` side-cars have been bulk-loaded into the mirror. */\n  ensurePersistedIndexesLoaded(): Promise<void>\n  /**\n   * Decrypt one record by id in RAW (pre-`present()`, stored-form) shape,\n   * or return null if it's gone (#684 — the raw-fetch seam). Used by the\n   * post-filter (`toArray()`) so a `clause.via.evaluate` (e.g. money) sees\n   * the same operand/actual-value space as eager's `filterRecords` — the\n   * DECODED form (e.g. money's canonical decimal) is only materialized\n   * for survivors, via {@link decodeRecord}.\n   */\n  getRawRecord(id: string): Promise<unknown>\n  /**\n   * Apply this collection's locale/virtual-field decode (`present()`) to a\n   * RAW record already known to match — the output-side twin of\n   * {@link getRawRecord}. Mirrors eager's `Query.decodeVia`.\n   */\n  decodeRecord(record: unknown): Promise<T>\n  /**\n   * This collection's compiled Via pipeline (money, i18n, …), read lazily\n   * (a method, not a captured value) so a late `_setVia` (#666) is honored\n   * — same closure discipline as {@link canonicalizeIndexKey}. `undefined`\n   * when the collection has no Via-covered fields.\n   */\n  via(): ViaPipeline | undefined\n}\n\ninterface LazyPlan {\n  readonly clauses: readonly FieldClause[]\n  readonly orderBy: readonly LazyOrderBy[]\n  readonly limit: number | undefined\n  readonly offset: number\n}\n\nconst EMPTY_PLAN: LazyPlan = {\n  clauses: [],\n  orderBy: [],\n  limit: undefined,\n  offset: 0,\n}\n\nexport class LazyQuery<T, S extends keyof T = never, Q extends keyof T & string = never> {\n  private readonly source: LazyQuerySource<T>\n  private readonly plan: LazyPlan\n\n  constructor(source: LazyQuerySource<T>, plan: LazyPlan = EMPTY_PLAN) {\n    this.source = source\n    this.plan = plan\n  }\n\n  where<V>(field: QueryField<T, S, Q>, op: Operator, value: V): LazyQuery<T, S, Q> {\n    // A Via-covered field (e.g. money) compares in major units, BigInt-exact\n    // in scaled space — same build-time operand rewrite + `clause.via`\n    // attachment as `Query.where()` (`kernel/query/builder.ts`) and\n    // `ScanBuilder.where()` (`kernel/query/scan-builder.ts`). Before #684\n    // this method built a bare clause with no `clause.via` at all, so the\n    // post-filter fell through to the generic (non-Via-aware) comparison —\n    // see `toArray()` below for the raw-record post-filter this feeds.\n    const via = this.source.via()\n    // Consults the Via pipeline's posture BEFORE building a clause — same\n    // gate as `Query.where()` (builder.ts) / `ScanBuilder.where()`\n    // (scan-builder.ts): a field whose posture is `queryable: 'none'`\n    // (e.g. a `blobFields` slot) throws `FieldNotQueryableError` here, at\n    // the call site, instead of building a bare clause that later surfaces\n    // as a deferred `IndexRequiredError` from `toArray()`.\n    if (via?.postureFor(field)?.queryable === 'none') throw new FieldNotQueryableError(field)\n    const viaClause = via?.buildClause(field, op, value)\n    const clause: FieldClause = viaClause\n      ? {\n          type: 'field',\n          field,\n          op,\n          value,\n          via: {\n            brand: viaClause.brand,\n            payload: viaClause.payload,\n            evaluate: (actual: unknown, evalOp: string) => via!.evaluateClause(viaClause, actual, evalOp),\n            indexValue: via!.indexProbe(viaClause, op),\n          },\n        }\n      : { type: 'field', field, op, value }\n    return new LazyQuery<T, S, Q>(this.source, {\n      ...this.plan,\n      clauses: [...this.plan.clauses, clause],\n    })\n  }\n\n  orderBy(field: QueryField<T, S>, direction: 'asc' | 'desc' = 'asc'): LazyQuery<T, S, Q> {\n    return new LazyQuery<T, S, Q>(this.source, {\n      ...this.plan,\n      orderBy: [...this.plan.orderBy, { field, direction }],\n    })\n  }\n\n  limit(n: number): LazyQuery<T, S, Q> {\n    return new LazyQuery<T, S, Q>(this.source, { ...this.plan, limit: n })\n  }\n\n  offset(n: number): LazyQuery<T, S, Q> {\n    return new LazyQuery<T, S, Q>(this.source, { ...this.plan, offset: n })\n  }\n\n  async toArray(): Promise<T[]> {\n    await this.source.ensurePersistedIndexesLoaded()\n\n    const touchedFields = collectTouchedFields(this.plan)\n    const missingFields = touchedFields.filter(f => !isFieldIndexed(f, this.source.persistedIndexes))\n    if (missingFields.length > 0) {\n      throw new IndexRequiredError({\n        collection: this.source.collectionName,\n        touchedFields,\n        missingFields,\n      })\n    }\n\n    const candidateIds = this.resolveCandidateIds()\n    if (candidateIds === null) {\n      // No usable driver — every touched field is indexed but no clause\n      // pins the candidate set. This happens when a query only uses\n      // operators other than `==`/`in` and no `orderBy` clause is\n      // present — we refuse to enumerate the whole index, because that\n      // defeats the purpose of lazy mode.\n      throw new IndexRequiredError({\n        collection: this.source.collectionName,\n        touchedFields,\n        missingFields: touchedFields,\n      })\n    }\n\n    // #684: post-filter the RAW record (mirrors eager's filterRecords on the\n    // raw snapshot) so `clause.via.evaluate` sees the same stored-form\n    // operand/actual-value space `buildClause` quantized into at where()\n    // time. Survivors stay RAW here — #695 sorts them via-aware in that\n    // same stored-form space (mirroring eager's `sortRecords(result, ...,\n    // source.via, ...)` in `kernel/query/builder.ts`) before anything is\n    // decoded (`present()`).\n    const survivors: T[] = []\n    for (const id of candidateIds) {\n      const raw = await this.source.getRawRecord(id)\n      if (raw === null) continue\n      if (!matchesAll(raw, this.plan.clauses)) continue\n      survivors.push(raw as T)\n    }\n\n    // #695: sort the RAW survivors via-aware — a money field's stored form\n    // (scaled-integer string) sorts lexicographically wrong under the\n    // generic comparator ('10.00' < '2.00' once decoded); `via.compareForOrder`\n    // compares in the correct (BigInt-exact scaled) space, same as eager.\n    const sorted = this.plan.orderBy.length > 0\n      ? sortRecords(survivors, this.plan.orderBy, this.source.via())\n      : survivors\n\n    const offset = this.plan.offset > 0 ? this.plan.offset : 0\n    const page = this.plan.limit === undefined\n      ? sorted.slice(offset)\n      : sorted.slice(offset, offset + this.plan.limit)\n\n    // Decode only the final page — fewer decodes than the pre-#695 code,\n    // which decoded every survivor before sorting/slicing.\n    return Promise.all(page.map(r => this.source.decodeRecord(r)))\n  }\n\n  async first(): Promise<T | null> {\n    const out = await this.limit(1).toArray()\n    return out.length > 0 ? out[0]! : null\n  }\n\n  async count(): Promise<number> {\n    const out = await this.toArray()\n    return out.length\n  }\n\n  /**\n   * Resolve the candidate record-id set to decrypt. Returns null when the\n   * query has no usable driver — no `==`/`in` clause and no `orderBy`\n   * clause that can scope the scan. Callers interpret null as\n   * IndexRequiredError (see `toArray`).\n   */\n  private resolveCandidateIds(): readonly string[] | null {\n    const idx = this.source.persistedIndexes\n\n    // prefer a composite index when the query's `==`\n    // clauses cover every field of one declared composite. The\n    // composite mirror lookup is O(matches) vs single-field +\n    // post-filter on the decrypted candidate set.\n    const eqMap = new Map<string, unknown>()\n    const viaFields = new Set<string>()\n    for (const clause of this.plan.clauses) {\n      if (clause.op === '==') {\n        eqMap.set(clause.field, clause.value)\n        // #696: the composite mirror buckets on `stringifyKey(tuple)` built\n        // from the RAW clause values — the per-field money canonicalizer\n        // (`canonicalizeIndexKey`) only ever keys off a single field name,\n        // never the joined composite key, so a Via-covered field's tuple\n        // slot never lands in the same bucket a canonical write produced.\n        // Track which `==` fields are Via-covered so the composite branch\n        // below can skip them and fall through to the single-field\n        // Via-aware path (already correct for money) instead.\n        if (clause.via) viaFields.add(clause.field)\n      }\n    }\n    if (eqMap.size >= 2) {\n      for (const def of idx.definitions()) {\n        if (def.kind !== 'composite') continue\n        if (def.fields.some(f => viaFields.has(f))) continue\n        if (def.fields.every(f => eqMap.has(f))) {\n          const tuple = def.fields.map(f => eqMap.get(f))\n          const ids = idx.lookupEqual(def.key, tuple)\n          if (ids) return [...ids]\n        }\n      }\n    }\n\n    for (const clause of this.plan.clauses) {\n      if (clause.op === '==') {\n        if (clause.via) {\n          // #684: prefer `clause.via.indexValue` — the same STORED-form\n          // probe operand eager's `candidateRecords()` resolves first\n          // (`kernel/query/builder.ts`). `undefined` means the binding\n          // declined to probe this op/payload (e.g. money multi-mode) — no\n          // sound equality bucket exists. Eager's `candidateRecords()`\n          // handles this by skipping the index-eligibility check for the\n          // clause and falling back to a full scan (`builder.ts:1176`); the\n          // lazy equivalent (#684 review-fix 2) is the same move the RANGE branch\n          // below already makes — enumerate the field's full indexed id\n          // set via `orderedBy` and let the (now via-aware) post-filter in\n          // `toArray()` decide, instead of throwing `IndexRequiredError`.\n          if (clause.via.indexValue === undefined) {\n            const entries = idx.orderedBy(clause.field, 'asc')\n            if (entries) return entries.map(e => e.recordId)\n            continue\n          }\n          const ids = idx.lookupEqual(clause.field, clause.via.indexValue)\n          if (ids) return [...ids]\n          continue\n        }\n        // #677: canonicalize the probe value BEFORE the lookup — same\n        // \"resolve before lookupEqual\" shape as eager's `candidateRecords()`,\n        // but through the narrower `canonicalizeIndexKey` seam, used only on\n        // this NON-via path. `undefined` (no via coverage) falls back to the\n        // raw clause value, unchanged from today.\n        const probe = this.source.canonicalizeIndexKey?.(clause.field, clause.value) ?? clause.value\n        const ids = idx.lookupEqual(clause.field, probe)\n        if (ids) return [...ids]\n      } else if (clause.op === 'in' && Array.isArray(clause.value)) {\n        if (clause.via) {\n          // Same #684 review-fix 2 fallback as the `==` branch above — a via\n          // payload that declines to probe (e.g. money multi-mode) still\n          // has a sound candidate superset via `orderedBy`.\n          if (clause.via.indexValue === undefined) {\n            const entries = idx.orderedBy(clause.field, 'asc')\n            if (entries) return entries.map(e => e.recordId)\n            continue\n          }\n          if (!Array.isArray(clause.via.indexValue)) continue\n          const ids = idx.lookupIn(clause.field, clause.via.indexValue)\n          if (ids) return [...ids]\n          continue\n        }\n        const probes = clause.value.map(v => this.source.canonicalizeIndexKey?.(clause.field, v) ?? v)\n        const ids = idx.lookupIn(clause.field, probes)\n        if (ids) return [...ids]\n      } else if (isRangeOp(clause.op)) {\n        if (clause.via) {\n          // #684: a Via-covered range clause (e.g. money) cannot trust\n          // `lookupRange` — it compares the ORIGINAL TYPED stored value,\n          // wrong space for a binding whose stored form isn't directly\n          // orderable that way (money: BigInt-exact scaled-int compare).\n          // No binding emits a range `indexProbe` either (see\n          // `moneyIndexProbe`), so there's no sound bucket lookup at all.\n          // Enumerate the field's full indexed id set via `orderedBy` — the\n          // same superset a scan would consider, just scoped to indexed ids\n          // — and let the (now via-aware) post-filter in `toArray()` apply\n          // the correct scaled-space comparison. Replaces the old\n          // \"always trust lookupRange, no scan fallback\" gap.\n          const entries = idx.orderedBy(clause.field, 'asc')\n          if (entries) return entries.map(e => e.recordId)\n          continue\n        }\n        // range predicates on a NON-via indexed field dispatch through\n        // `lookupRange`, which compares on the original typed value (no\n        // numeric-lexicographic landmines).\n        const ids = idx.lookupRange(clause.field, clause.op, clause.value)\n        if (ids) return [...ids]\n      }\n    }\n\n    // No equality/range driver — try to scope via orderBy.\n    if (this.plan.orderBy.length > 0) {\n      const primary = this.plan.orderBy[0]!\n      const entries = idx.orderedBy(primary.field, primary.direction)\n      if (entries) return entries.map(e => e.recordId)\n    }\n\n    return null\n  }\n}\n\n/**\n * True if the given field name is covered by either a single-field\n * index or appears as a component of a declared composite index.\n * Composite coverage is sufficient for the missing-field check because\n * composite writes also maintain the in-memory mirror — the range /\n * orderBy / single-equality lookup paths fall through to decrypted\n * candidates that still get post-filtered by the composite clause.\n */\nfunction isFieldIndexed(field: string, idx: PersistedCollectionIndex): boolean {\n  if (idx.has(field)) return true\n  for (const def of idx.definitions()) {\n    if (def.kind === 'composite' && def.fields.includes(field)) return true\n  }\n  return false\n}\n\nfunction isRangeOp(op: Operator): op is '<' | '<=' | '>' | '>=' | 'between' {\n  return op === '<' || op === '<=' || op === '>' || op === '>=' || op === 'between'\n}\n\nfunction collectTouchedFields(plan: LazyPlan): string[] {\n  const seen = new Set<string>()\n  for (const c of plan.clauses) seen.add(c.field)\n  for (const o of plan.orderBy) seen.add(o.field)\n  return [...seen]\n}\n\nfunction matchesAll(record: unknown, clauses: readonly Clause[]): boolean {\n  for (const c of clauses) {\n    if (!evaluateClause(record, c)) return false\n  }\n  return true\n}\n\nfunction sortRecords<T>(records: T[], orderBy: readonly LazyOrderBy[], via?: ViaPipeline): T[] {\n  return [...records].sort((a, b) => {\n    for (const { field, direction } of orderBy) {\n      const av = readPath(a, field)\n      const bv = readPath(b, field)\n      // #695: a Via-covered field (e.g. money) may store a representation\n      // the generic comparator would order wrong — ask the pipeline for an\n      // exact ordering first, same as eager's `sortRecords` in\n      // `kernel/query/builder.ts`. `undefined` (no via, or the field isn't\n      // covered) falls back to the generic comparator, unchanged from today.\n      const viaCmp = via?.compareForOrder(field, av, bv)\n      const cmp = viaCmp !== undefined ? viaCmp : compareValues(av, bv)\n      if (cmp !== 0) return direction === 'asc' ? cmp : -cmp\n    }\n    return 0\n  })\n}\n\nfunction compareValues(a: unknown, b: unknown): number {\n  if (a === undefined || a === null) return b === undefined || b === null ? 0 : 1\n  if (b === undefined || b === null) return -1\n  if (typeof a === 'number' && typeof b === 'number') return a - b\n  if (typeof a === 'string' && typeof b === 'string') return a < b ? -1 : a > b ? 1 : 0\n  if (a instanceof Date && b instanceof Date) return a.getTime() - b.getTime()\n  return 0\n}\n"],"mappings":";;;;;;;;;;AAqBO,IAAM,aAAa;AAWnB,SAAS,YAAY,OAAe,UAA0B;AACnE,SAAO,GAAG,UAAU,GAAG,KAAK,IAAI,QAAQ;AAC1C;AASO,SAAS,YAAY,IAAwD;AAClF,MAAI,CAAC,GAAG,WAAW,UAAU,EAAG,QAAO;AACvC,QAAM,OAAO,GAAG,MAAM,WAAW,MAAM;AACvC,QAAM,aAAa,KAAK,QAAQ,GAAG;AACnC,MAAI,cAAc,EAAG,QAAO;AAC5B,QAAM,QAAQ,KAAK,MAAM,GAAG,UAAU;AACtC,QAAM,WAAW,KAAK,MAAM,aAAa,CAAC;AAC1C,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,SAAO,EAAE,OAAO,SAAS;AAC3B;AAOO,SAAS,QAAQ,IAAqB;AAC3C,SAAO,YAAY,EAAE,MAAM;AAC7B;AA2EO,IAAM,sBAAsB;AAE5B,SAAS,aAAa,QAAmC;AAC9D,SAAO,OAAO,KAAK,mBAAmB;AACxC;AAEO,IAAM,2BAAN,MAA+B;AAAA,EACnB,UAAU,oBAAI,IAAiC;AAAA,EAC/C,OAAO,oBAAI,IAA+B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOR,iBAAiB,IAAiE;AAChF,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAQ,OAAqB;AAC3B,QAAI,KAAK,QAAQ,IAAI,KAAK,EAAG;AAC7B,SAAK,QAAQ,IAAI,OAAO,EAAE,SAAS,oBAAI,IAAI,GAAG,QAAQ,oBAAI,IAAI,EAAE,CAAC;AACjE,SAAK,KAAK,IAAI,OAAO,EAAE,MAAM,UAAU,OAAO,KAAK,MAAM,CAAC;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,iBAAiB,QAAiC;AAChD,QAAI,OAAO,WAAW,GAAG;AACvB,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AACA,eAAW,KAAK,QAAQ;AACtB,UAAI,EAAE,SAAS,mBAAmB,GAAG;AACnC,cAAM,IAAI;AAAA,UACR,4BAA4B,CAAC,uCACzB,mBAAmB;AAAA,QAEzB;AAAA,MACF;AAAA,IACF;AACA,UAAM,MAAM,aAAa,MAAM;AAC/B,QAAI,KAAK,QAAQ,IAAI,GAAG,EAAG;AAC3B,SAAK,QAAQ,IAAI,KAAK,EAAE,SAAS,oBAAI,IAAI,GAAG,QAAQ,oBAAI,IAAI,EAAE,CAAC;AAC/D,SAAK,KAAK,IAAI,KAAK,EAAE,MAAM,aAAa,QAAQ,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAmC;AACjC,WAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC;AAAA,EAC/B;AAAA;AAAA,EAGA,IAAI,OAAwB;AAC1B,WAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EAC/B;AAAA;AAAA,EAGA,SAAmB;AACjB,WAAO,CAAC,GAAG,KAAK,QAAQ,KAAK,CAAC;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,OAAe,MAAkC;AACtD,UAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO;AACZ,eAAW,OAAO,MAAM;AACtB,iBAAW,OAAO,IAAI,UAAU,IAAI,OAAO,OAAO,KAAK,YAAY;AAAA,IACrE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,UAAkB,OAAe,UAAmB,eAA8B;AACvF,UAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO;AACZ,QAAI,kBAAkB,QAAQ,kBAAkB,QAAW;AACzD,sBAAgB,OAAO,UAAU,eAAe,OAAO,KAAK,YAAY;AAAA,IAC1E;AACA,eAAW,OAAO,UAAU,UAAU,OAAO,KAAK,YAAY;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,UAAkB,OAAe,OAAsB;AAC5D,UAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO;AACZ,oBAAgB,OAAO,UAAU,OAAO,OAAO,KAAK,YAAY;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAc;AACZ,eAAW,SAAS,KAAK,QAAQ,OAAO,GAAG;AACzC,YAAM,QAAQ,MAAM;AACpB,YAAM,OAAO,MAAM;AAAA,IACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,YAAY,OAAe,OAA4C;AACrE,UAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,MAAM,aAAa,KAAK;AAC9B,WAAO,MAAM,QAAQ,IAAI,GAAG,KAAK;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAS,OAAe,QAAwD;AAC9E,UAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,MAAM,oBAAI,IAAY;AAC5B,eAAW,SAAS,QAAQ;AAC1B,YAAM,SAAS,MAAM,QAAQ,IAAI,aAAa,KAAK,CAAC;AACpD,UAAI,OAAQ,YAAW,MAAM,OAAQ,KAAI,IAAI,EAAE;AAAA,IACjD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA8BA,YACE,OACA,IACA,OAC4B;AAC5B,UAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,MAAM,oBAAI,IAAY;AAC5B,eAAW,CAAC,UAAU,IAAI,KAAK,MAAM,QAAQ;AAC3C,UAAI,SAAS,UAAa,SAAS,KAAM;AACzC,UAAI,aAAa,MAAM,IAAI,KAAK,EAAG,KAAI,IAAI,QAAQ;AAAA,IACrD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,UAAU,OAAe,KAAqD;AAC5E,UAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK;AACpC,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,UAA0B,CAAC;AACjC,eAAW,CAAC,UAAU,KAAK,KAAK,MAAM,QAAQ;AAC5C,cAAQ,KAAK,EAAE,UAAU,MAAM,CAAC;AAAA,IAClC;AACA,YAAQ,KAAK,CAAC,GAAG,MAAM,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC;AACrD,QAAI,QAAQ,OAAQ,SAAQ,QAAQ;AACpC,WAAO;AAAA,EACT;AACF;AAEA,IAAM,YAAiC,oBAAI,IAAI;AAY/C,SAAS,aAAa,OAAwB;AAC5C,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAW,QAAO,OAAO,KAAK;AAChF,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AAIpD,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,QAAkB,CAAC;AACzB,eAAW,MAAM,MAAO,OAAM,KAAK,aAAa,EAAE,CAAC;AACnD,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,SAAO;AACT;AAEA,SAAS,WACP,OACA,UACA,OACA,OACA,cACM;AACN,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,MAAM,eAAe,OAAO,KAAK,KAAK,aAAa,KAAK;AAC9D,MAAI,SAAS,MAAM,QAAQ,IAAI,GAAG;AAClC,MAAI,CAAC,QAAQ;AACX,aAAS,oBAAI,IAAI;AACjB,UAAM,QAAQ,IAAI,KAAK,MAAM;AAAA,EAC/B;AACA,SAAO,IAAI,QAAQ;AACnB,QAAM,OAAO,IAAI,UAAU,KAAK;AAClC;AAEA,SAAS,gBACP,OACA,UACA,OACA,OACA,cACM;AACN,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,MAAM,eAAe,OAAO,KAAK,KAAK,aAAa,KAAK;AAC9D,QAAM,SAAS,MAAM,QAAQ,IAAI,GAAG;AACpC,MAAI,QAAQ;AACV,WAAO,OAAO,QAAQ;AACtB,QAAI,OAAO,SAAS,EAAG,OAAM,QAAQ,OAAO,GAAG;AAAA,EACjD;AACA,QAAM,OAAO,OAAO,QAAQ;AAC9B;AASA,SAAS,aACP,MACA,IACA,OACS;AACT,MAAI,OAAO,WAAW;AACpB,QAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,EAAG,QAAO;AACxD,WAAO,aAAa,MAAM,MAAM,CAAC,CAAC,KAAK,KAAK,aAAa,MAAM,MAAM,CAAC,CAAC,KAAK;AAAA,EAC9E;AACA,QAAM,MAAM,aAAa,MAAM,KAAK;AACpC,UAAQ,IAAI;AAAA,IACV,KAAK;AAAM,aAAO,MAAM;AAAA,IACxB,KAAK;AAAM,aAAO,OAAO;AAAA,IACzB,KAAK;AAAM,aAAO,MAAM;AAAA,IACxB,KAAK;AAAM,aAAO,OAAO;AAAA,EAC3B;AACF;AAEA,SAAS,aAAa,GAAY,GAAoB;AACpD,MAAI,MAAM,UAAa,MAAM,KAAM,QAAO,MAAM,UAAa,MAAM,OAAO,IAAI;AAC9E,MAAI,MAAM,UAAa,MAAM,KAAM,QAAO;AAC1C,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO,IAAI;AAC/D,MAAI,aAAa,QAAQ,aAAa,KAAM,QAAO,EAAE,QAAQ,IAAI,EAAE,QAAQ;AAC3E,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;AACpF,MAAI,OAAO,MAAM,aAAa,OAAO,MAAM,WAAW;AACpD,WAAO,MAAM,IAAI,IAAI,IAAI,IAAI;AAAA,EAC/B;AAKA,SAAO;AACT;;;ACxYA,IAAM,aAAuB;AAAA,EAC3B,SAAS,CAAC;AAAA,EACV,SAAS,CAAC;AAAA,EACV,OAAO;AAAA,EACP,QAAQ;AACV;AAEO,IAAM,YAAN,MAAM,WAA4E;AAAA,EACtE;AAAA,EACA;AAAA,EAEjB,YAAY,QAA4B,OAAiB,YAAY;AACnE,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AAAA,EAEA,MAAS,OAA4B,IAAc,OAA8B;AAQ/E,UAAM,MAAM,KAAK,OAAO,IAAI;AAO5B,QAAI,KAAK,WAAW,KAAK,GAAG,cAAc,OAAQ,OAAM,IAAI,uBAAuB,KAAK;AACxF,UAAM,YAAY,KAAK,YAAY,OAAO,IAAI,KAAK;AACnD,UAAM,SAAsB,YACxB;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,QACH,OAAO,UAAU;AAAA,QACjB,SAAS,UAAU;AAAA,QACnB,UAAU,CAAC,QAAiB,WAAmB,IAAK,eAAe,WAAW,QAAQ,MAAM;AAAA,QAC5F,YAAY,IAAK,WAAW,WAAW,EAAE;AAAA,MAC3C;AAAA,IACF,IACA,EAAE,MAAM,SAAS,OAAO,IAAI,MAAM;AACtC,WAAO,IAAI,WAAmB,KAAK,QAAQ;AAAA,MACzC,GAAG,KAAK;AAAA,MACR,SAAS,CAAC,GAAG,KAAK,KAAK,SAAS,MAAM;AAAA,IACxC,CAAC;AAAA,EACH;AAAA,EAEA,QAAQ,OAAyB,YAA4B,OAA2B;AACtF,WAAO,IAAI,WAAmB,KAAK,QAAQ;AAAA,MACzC,GAAG,KAAK;AAAA,MACR,SAAS,CAAC,GAAG,KAAK,KAAK,SAAS,EAAE,OAAO,UAAU,CAAC;AAAA,IACtD,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,GAA+B;AACnC,WAAO,IAAI,WAAmB,KAAK,QAAQ,EAAE,GAAG,KAAK,MAAM,OAAO,EAAE,CAAC;AAAA,EACvE;AAAA,EAEA,OAAO,GAA+B;AACpC,WAAO,IAAI,WAAmB,KAAK,QAAQ,EAAE,GAAG,KAAK,MAAM,QAAQ,EAAE,CAAC;AAAA,EACxE;AAAA,EAEA,MAAM,UAAwB;AAC5B,UAAM,KAAK,OAAO,6BAA6B;AAE/C,UAAM,gBAAgB,qBAAqB,KAAK,IAAI;AACpD,UAAM,gBAAgB,cAAc,OAAO,OAAK,CAAC,eAAe,GAAG,KAAK,OAAO,gBAAgB,CAAC;AAChG,QAAI,cAAc,SAAS,GAAG;AAC5B,YAAM,IAAI,mBAAmB;AAAA,QAC3B,YAAY,KAAK,OAAO;AAAA,QACxB;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,KAAK,oBAAoB;AAC9C,QAAI,iBAAiB,MAAM;AAMzB,YAAM,IAAI,mBAAmB;AAAA,QAC3B,YAAY,KAAK,OAAO;AAAA,QACxB;AAAA,QACA,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AASA,UAAM,YAAiB,CAAC;AACxB,eAAW,MAAM,cAAc;AAC7B,YAAM,MAAM,MAAM,KAAK,OAAO,aAAa,EAAE;AAC7C,UAAI,QAAQ,KAAM;AAClB,UAAI,CAAC,WAAW,KAAK,KAAK,KAAK,OAAO,EAAG;AACzC,gBAAU,KAAK,GAAQ;AAAA,IACzB;AAMA,UAAM,SAAS,KAAK,KAAK,QAAQ,SAAS,IACtC,YAAY,WAAW,KAAK,KAAK,SAAS,KAAK,OAAO,IAAI,CAAC,IAC3D;AAEJ,UAAM,SAAS,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;AACzD,UAAM,OAAO,KAAK,KAAK,UAAU,SAC7B,OAAO,MAAM,MAAM,IACnB,OAAO,MAAM,QAAQ,SAAS,KAAK,KAAK,KAAK;AAIjD,WAAO,QAAQ,IAAI,KAAK,IAAI,OAAK,KAAK,OAAO,aAAa,CAAC,CAAC,CAAC;AAAA,EAC/D;AAAA,EAEA,MAAM,QAA2B;AAC/B,UAAM,MAAM,MAAM,KAAK,MAAM,CAAC,EAAE,QAAQ;AACxC,WAAO,IAAI,SAAS,IAAI,IAAI,CAAC,IAAK;AAAA,EACpC;AAAA,EAEA,MAAM,QAAyB;AAC7B,UAAM,MAAM,MAAM,KAAK,QAAQ;AAC/B,WAAO,IAAI;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,sBAAgD;AACtD,UAAM,MAAM,KAAK,OAAO;AAMxB,UAAM,QAAQ,oBAAI,IAAqB;AACvC,UAAM,YAAY,oBAAI,IAAY;AAClC,eAAW,UAAU,KAAK,KAAK,SAAS;AACtC,UAAI,OAAO,OAAO,MAAM;AACtB,cAAM,IAAI,OAAO,OAAO,OAAO,KAAK;AASpC,YAAI,OAAO,IAAK,WAAU,IAAI,OAAO,KAAK;AAAA,MAC5C;AAAA,IACF;AACA,QAAI,MAAM,QAAQ,GAAG;AACnB,iBAAW,OAAO,IAAI,YAAY,GAAG;AACnC,YAAI,IAAI,SAAS,YAAa;AAC9B,YAAI,IAAI,OAAO,KAAK,OAAK,UAAU,IAAI,CAAC,CAAC,EAAG;AAC5C,YAAI,IAAI,OAAO,MAAM,OAAK,MAAM,IAAI,CAAC,CAAC,GAAG;AACvC,gBAAM,QAAQ,IAAI,OAAO,IAAI,OAAK,MAAM,IAAI,CAAC,CAAC;AAC9C,gBAAM,MAAM,IAAI,YAAY,IAAI,KAAK,KAAK;AAC1C,cAAI,IAAK,QAAO,CAAC,GAAG,GAAG;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AAEA,eAAW,UAAU,KAAK,KAAK,SAAS;AACtC,UAAI,OAAO,OAAO,MAAM;AACtB,YAAI,OAAO,KAAK;AAYd,cAAI,OAAO,IAAI,eAAe,QAAW;AACvC,kBAAM,UAAU,IAAI,UAAU,OAAO,OAAO,KAAK;AACjD,gBAAI,QAAS,QAAO,QAAQ,IAAI,OAAK,EAAE,QAAQ;AAC/C;AAAA,UACF;AACA,gBAAMA,OAAM,IAAI,YAAY,OAAO,OAAO,OAAO,IAAI,UAAU;AAC/D,cAAIA,KAAK,QAAO,CAAC,GAAGA,IAAG;AACvB;AAAA,QACF;AAMA,cAAM,QAAQ,KAAK,OAAO,uBAAuB,OAAO,OAAO,OAAO,KAAK,KAAK,OAAO;AACvF,cAAM,MAAM,IAAI,YAAY,OAAO,OAAO,KAAK;AAC/C,YAAI,IAAK,QAAO,CAAC,GAAG,GAAG;AAAA,MACzB,WAAW,OAAO,OAAO,QAAQ,MAAM,QAAQ,OAAO,KAAK,GAAG;AAC5D,YAAI,OAAO,KAAK;AAId,cAAI,OAAO,IAAI,eAAe,QAAW;AACvC,kBAAM,UAAU,IAAI,UAAU,OAAO,OAAO,KAAK;AACjD,gBAAI,QAAS,QAAO,QAAQ,IAAI,OAAK,EAAE,QAAQ;AAC/C;AAAA,UACF;AACA,cAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,UAAU,EAAG;AAC3C,gBAAMA,OAAM,IAAI,SAAS,OAAO,OAAO,OAAO,IAAI,UAAU;AAC5D,cAAIA,KAAK,QAAO,CAAC,GAAGA,IAAG;AACvB;AAAA,QACF;AACA,cAAM,SAAS,OAAO,MAAM,IAAI,OAAK,KAAK,OAAO,uBAAuB,OAAO,OAAO,CAAC,KAAK,CAAC;AAC7F,cAAM,MAAM,IAAI,SAAS,OAAO,OAAO,MAAM;AAC7C,YAAI,IAAK,QAAO,CAAC,GAAG,GAAG;AAAA,MACzB,WAAW,UAAU,OAAO,EAAE,GAAG;AAC/B,YAAI,OAAO,KAAK;AAYd,gBAAM,UAAU,IAAI,UAAU,OAAO,OAAO,KAAK;AACjD,cAAI,QAAS,QAAO,QAAQ,IAAI,OAAK,EAAE,QAAQ;AAC/C;AAAA,QACF;AAIA,cAAM,MAAM,IAAI,YAAY,OAAO,OAAO,OAAO,IAAI,OAAO,KAAK;AACjE,YAAI,IAAK,QAAO,CAAC,GAAG,GAAG;AAAA,MACzB;AAAA,IACF;AAGA,QAAI,KAAK,KAAK,QAAQ,SAAS,GAAG;AAChC,YAAM,UAAU,KAAK,KAAK,QAAQ,CAAC;AACnC,YAAM,UAAU,IAAI,UAAU,QAAQ,OAAO,QAAQ,SAAS;AAC9D,UAAI,QAAS,QAAO,QAAQ,IAAI,OAAK,EAAE,QAAQ;AAAA,IACjD;AAEA,WAAO;AAAA,EACT;AACF;AAUA,SAAS,eAAe,OAAe,KAAwC;AAC7E,MAAI,IAAI,IAAI,KAAK,EAAG,QAAO;AAC3B,aAAW,OAAO,IAAI,YAAY,GAAG;AACnC,QAAI,IAAI,SAAS,eAAe,IAAI,OAAO,SAAS,KAAK,EAAG,QAAO;AAAA,EACrE;AACA,SAAO;AACT;AAEA,SAAS,UAAU,IAAyD;AAC1E,SAAO,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,OAAO,QAAQ,OAAO;AAC1E;AAEA,SAAS,qBAAqB,MAA0B;AACtD,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,KAAK,QAAS,MAAK,IAAI,EAAE,KAAK;AAC9C,aAAW,KAAK,KAAK,QAAS,MAAK,IAAI,EAAE,KAAK;AAC9C,SAAO,CAAC,GAAG,IAAI;AACjB;AAEA,SAAS,WAAW,QAAiB,SAAqC;AACxE,aAAW,KAAK,SAAS;AACvB,QAAI,CAAC,eAAe,QAAQ,CAAC,EAAG,QAAO;AAAA,EACzC;AACA,SAAO;AACT;AAEA,SAAS,YAAe,SAAc,SAAiC,KAAwB;AAC7F,SAAO,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM;AACjC,eAAW,EAAE,OAAO,UAAU,KAAK,SAAS;AAC1C,YAAM,KAAK,SAAS,GAAG,KAAK;AAC5B,YAAM,KAAK,SAAS,GAAG,KAAK;AAM5B,YAAM,SAAS,KAAK,gBAAgB,OAAO,IAAI,EAAE;AACjD,YAAM,MAAM,WAAW,SAAY,SAAS,cAAc,IAAI,EAAE;AAChE,UAAI,QAAQ,EAAG,QAAO,cAAc,QAAQ,MAAM,CAAC;AAAA,IACrD;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAEA,SAAS,cAAc,GAAY,GAAoB;AACrD,MAAI,MAAM,UAAa,MAAM,KAAM,QAAO,MAAM,UAAa,MAAM,OAAO,IAAI;AAC9E,MAAI,MAAM,UAAa,MAAM,KAAM,QAAO;AAC1C,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO,IAAI;AAC/D,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI;AACpF,MAAI,aAAa,QAAQ,aAAa,KAAM,QAAO,EAAE,QAAQ,IAAI,EAAE,QAAQ;AAC3E,SAAO;AACT;","names":["ids"]}

package/dist/chunk-CJVEAVYH.js

@@ -1,205 +0,0 @@
-import {
-  deriveSecretKey
-} from "./chunk-7U6AB7DZ.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-YTW6ZIPD.js";
-
-// src/with-party/team/wrapped-deks.ts
-var PBKDF2_ITERATIONS = 6e5;
-var SALT_BYTES = 32;
-var IV_BYTES = 12;
-var subtle = globalThis.crypto.subtle;
-async function mintWrappedDeksBlob(deks, credential) {
-  const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
-  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
-  const wrappingKey = await deriveWrappingKey(credential, salt);
-  const exported = {};
-  for (const [coll, dek] of deks) {
-    const raw = await subtle.exportKey("raw", dek);
-    exported[coll] = bytesToBase64(new Uint8Array(raw));
-  }
-  const plaintext = new TextEncoder().encode(JSON.stringify({ deks: exported }));
-  const ciphertext = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    wrappingKey,
-    plaintext
-  );
-  return {
-    salt: bytesToBase64(salt),
-    iv: bytesToBase64(iv),
-    wrappedDeks: bytesToBase64(new Uint8Array(ciphertext))
-  };
-}
-async function unwrapDeksFromBlob(blob, credential) {
-  const wrappingKey = await deriveWrappingKey(credential, base64ToBytes(blob.salt));
-  const plaintext = await subtle.decrypt(
-    { name: "AES-GCM", iv: base64ToBytes(blob.iv) },
-    wrappingKey,
-    base64ToBytes(blob.wrappedDeks)
-  );
-  const parsed = JSON.parse(new TextDecoder().decode(plaintext));
-  const deks = /* @__PURE__ */ new Map();
-  for (const [coll, b64] of Object.entries(parsed.deks)) {
-    const raw = base64ToBytes(b64);
-    const key = await subtle.importKey(
-      "raw",
-      raw,
-      { name: "AES-GCM", length: 256 },
-      true,
-      ["encrypt", "decrypt"]
-    );
-    deks.set(coll, key);
-  }
-  return deks;
-}
-async function deriveWrappingKey(credential, salt) {
-  return deriveSecretKey(credential, salt, { iterations: PBKDF2_ITERATIONS, keyUsage: "aes-gcm" });
-}
-function bytesToBase64(b) {
-  let s = "";
-  for (const x of b) s += String.fromCharCode(x);
-  return btoa(s);
-}
-function base64ToBytes(b64) {
-  const s = atob(b64);
-  const out = new Uint8Array(s.length);
-  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i);
-  return out;
-}
-
-// src/with-party/team/recovery.ts
-var PAPER_DOC_ID = "recovery-paper";
-async function loadPaperRecoveryEntries(store, vault) {
-  const env = await store.get(vault, "_meta", PAPER_DOC_ID);
-  if (!env) return [];
-  try {
-    const doc = JSON.parse(env._data);
-    if (doc.profile !== "paper" || !Array.isArray(doc.entries)) return [];
-    return doc.entries;
-  } catch {
-    return [];
-  }
-}
-async function savePaperRecoveryEntries(store, vault, entries) {
-  const doc = {
-    _noydb_recovery: 1,
-    profile: "paper",
-    entries
-  };
-  const envelope = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: "",
-    _data: JSON.stringify(doc)
-  };
-  await store.put(vault, "_meta", PAPER_DOC_ID, envelope);
-}
-async function burnPaperRecoveryEntry(store, vault, codeId) {
-  const entries = await loadPaperRecoveryEntries(store, vault);
-  const remaining = entries.filter((e) => e.codeId !== codeId);
-  await savePaperRecoveryEntries(store, vault, remaining);
-}
-async function hasRecoveryEnrolled(store, vault) {
-  const paper = await loadPaperRecoveryEntries(store, vault);
-  if (paper.length > 0) return true;
-  const shamir = await loadShamirRecoveryEntries(store, vault);
-  return shamir.length > 0;
-}
-async function hasStrongRecoveryEnrolled(store, vault) {
-  const shamir = await loadShamirRecoveryEntries(store, vault);
-  return shamir.length > 0;
-}
-var SHAMIR_DOC_ID = "recovery-shamir";
-async function loadShamirRecoveryEntries(store, vault) {
-  const env = await store.get(vault, "_meta", SHAMIR_DOC_ID);
-  if (!env) return [];
-  try {
-    const doc = JSON.parse(env._data);
-    if (doc.profile !== "shamir" || !Array.isArray(doc.entries)) return [];
-    return doc.entries;
-  } catch {
-    return [];
-  }
-}
-async function saveShamirRecoveryEntries(store, vault, entries) {
-  const doc = {
-    _noydb_recovery: 1,
-    profile: "shamir",
-    entries
-  };
-  const envelope = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: "",
-    _data: JSON.stringify(doc)
-  };
-  await store.put(vault, "_meta", SHAMIR_DOC_ID, envelope);
-}
-async function mintShamirRecoveryEntry(provider, deks, entryId, k, n, label) {
-  const recoverySecret = crypto.getRandomValues(new Uint8Array(32));
-  try {
-    const credential = bytesToBase642(recoverySecret);
-    const blob = await mintWrappedDeksBlob(deks, credential);
-    const shareStrings = provider.splitToShares(recoverySecret, k, n);
-    const entry = {
-      ...blob,
-      entryId,
-      k,
-      n,
-      enrolledAt: (/* @__PURE__ */ new Date()).toISOString(),
-      ...label !== void 0 && { label }
-    };
-    return { entry, shareStrings };
-  } finally {
-    recoverySecret.fill(0);
-  }
-}
-async function unwrapDeksFromShamirEntry(provider, entry, shareStrings) {
-  if (shareStrings.length < entry.k) {
-    throw new Error(
-      `Insufficient shares: this Shamir entry needs ${entry.k} of ${entry.n}, but ${shareStrings.length} were provided.`
-    );
-  }
-  const secret = provider.combineShares(shareStrings);
-  try {
-    return await unwrapDeksFromBlob(entry, bytesToBase642(secret));
-  } finally {
-    secret.fill(0);
-  }
-}
-function bytesToBase642(b) {
-  let s = "";
-  for (const x of b) s += String.fromCharCode(x);
-  return btoa(s);
-}
-async function mintPaperRecoveryEntry(deks, code, codeId) {
-  const blob = await mintWrappedDeksBlob(deks, code);
-  return {
-    ...blob,
-    codeId,
-    enrolledAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-async function unwrapDeksFromPaperEntry(entry, code) {
-  return unwrapDeksFromBlob(entry, code);
-}
-
-export {
-  mintWrappedDeksBlob,
-  unwrapDeksFromBlob,
-  loadPaperRecoveryEntries,
-  savePaperRecoveryEntries,
-  burnPaperRecoveryEntry,
-  hasRecoveryEnrolled,
-  hasStrongRecoveryEnrolled,
-  loadShamirRecoveryEntries,
-  saveShamirRecoveryEntries,
-  mintShamirRecoveryEntry,
-  unwrapDeksFromShamirEntry,
-  mintPaperRecoveryEntry,
-  unwrapDeksFromPaperEntry
-};
-//# sourceMappingURL=chunk-CJVEAVYH.js.map

package/dist/chunk-CJVEAVYH.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-party/team/wrapped-deks.ts","../src/with-party/team/recovery.ts"],"sourcesContent":["/**\n * **Wrap-DEKs primitive** — a single canonical shape for the\n * pattern of \"serialize a DEK set, encrypt it under a credential-derived\n * AES-GCM key.\" Used by:\n *\n *   - **tier-0** — paper recovery entries (`_meta/recovery-paper`),\n *     credential = the printed code.\n *   - **tier-2** — password authenticator slots (`KeyringFile.authenticators`,\n *     `wrapKind: 'deks'`), credential = the user's password.\n *\n * **Not** used by `@noy-db/on-pin` — tier-3 wraps the DEK set under\n * the same conceptual pattern but at **100,000 PBKDF2 iterations**\n * (vs the 600,000 here), because the protection window for a PIN\n * slot is short (idle-timeout-bounded, typically 15 min) and 600k\n * iterations would make every PIN-resume noticeably slow. The wire\n * formats are deliberately incompatible. See `@noy-db/on-pin`'s\n * `PIN_PBKDF2_ITERATIONS` and the threat-model rationale in its\n * module docstring.\n *\n * Previously, the same crypto lived in two places: `mintPaperRecoveryEntry`\n * (in `team/recovery.ts`) and `enrollPasswordAuthenticator` (in\n * `@noy-db/on-password`). Both functions did identical work — PBKDF2\n * the credential, AES-GCM-encrypt the JSON-serialized DEK set — but\n * their implementations had drifted apart enough that fixing a bug\n * in one wouldn't fix the other.\n *\n * This module owns the canonical implementation. Consumers compose:\n *\n *   - `mintPaperRecoveryEntry` is now a thin wrapper that calls\n *     `mintWrappedDeksBlob` and adds `{ codeId, enrolledAt }`.\n *   - `enrollPasswordAuthenticator` calls `mintWrappedDeksBlob` and\n *     wraps the result in the slot envelope.\n *\n * @module\n */\n\nimport { deriveSecretKey, type EnclaveKey } from '../../kernel/enclave/index.js'\n\nconst PBKDF2_ITERATIONS = 600_000\nconst SALT_BYTES = 32\nconst IV_BYTES = 12\n\nconst subtle = globalThis.crypto.subtle\n\n// ─── Type ──────────────────────────────────────────────────────────────\n\n/**\n * The wrap-DEKs primitive — a serialized + AES-GCM-encrypted DEK set\n * keyed under a credential-derived key.\n *\n * All three fields are base64-encoded so the blob is JSON-safe and\n * round-trips through `_meta/*` envelopes (which carry plaintext\n * JSON in `_data`).\n *\n * Composition: `PaperRecoveryEntry extends WrappedDeksBlob` plus\n * `{ codeId, enrolledAt }`. `KeyringAuthenticatorWrappingDEKs`\n * carries the same three fields with `salt` stored in `meta` for\n * slot-format back-compat (defers moving it to top-level).\n */\nexport interface WrappedDeksBlob {\n  /** Base64 PBKDF2 salt for the credential-derived wrapping key. */\n  readonly salt: string\n  /** Base64 AES-GCM IV used for the `wrappedDeks` ciphertext. */\n  readonly iv: string\n  /** Base64 AES-GCM ciphertext of `{ deks: { collection: base64rawDek } }`. */\n  readonly wrappedDeks: string\n}\n\n// ─── Mint ──────────────────────────────────────────────────────────────\n\n/**\n * Mint a fresh `WrappedDeksBlob` from a DEK set + a string credential.\n *\n * Generates a random salt + IV, derives a 256-bit AES-GCM key via\n * PBKDF2-SHA256(credential, salt, 600K), serializes the DEK set as\n * `{ deks: { coll: rawBase64 } }`, and AES-GCM-encrypts.\n *\n * The `credential` is the user-typed string (recovery code, password,\n * PIN). Caller normalization rules apply (e.g. paper\n * recovery uppercase-strips the code before reaching this function).\n *\n * @param deks - DEK set to wrap. Each DEK must be exportable via\n *               `subtle.exportKey('raw', dek)` (the hub mints DEKs\n *               this way; consumers feeding non-extractable keys\n *               will get `InvalidAccessError` from WebCrypto).\n * @param credential - String input the consumer minted (paper code,\n *               password, PIN). Treated as opaque bytes by PBKDF2.\n */\nexport async function mintWrappedDeksBlob(\n  deks: Map<string, EnclaveKey>,\n  credential: string,\n): Promise<WrappedDeksBlob> {\n  const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES))\n  const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES))\n  const wrappingKey = await deriveWrappingKey(credential, salt)\n\n  // Serialize the DEK set as JSON `{ deks: { collection: base64 } }`.\n  const exported: Record<string, string> = {}\n  for (const [coll, dek] of deks) {\n    const raw = await subtle.exportKey('raw', dek)\n    exported[coll] = bytesToBase64(new Uint8Array(raw))\n  }\n  const plaintext = new TextEncoder().encode(JSON.stringify({ deks: exported }))\n  const ciphertext = await subtle.encrypt(\n    { name: 'AES-GCM', iv: iv as BufferSource },\n    wrappingKey,\n    plaintext as BufferSource,\n  )\n\n  return {\n    salt: bytesToBase64(salt),\n    iv: bytesToBase64(iv),\n    wrappedDeks: bytesToBase64(new Uint8Array(ciphertext)),\n  }\n}\n\n// ─── Unwrap ────────────────────────────────────────────────────────────\n\n/**\n * Reverse of {@link mintWrappedDeksBlob}. Re-derives the wrapping key\n * from the credential + stored salt, AES-GCM-decrypts the wrapped DEK\n * set, and re-imports each DEK as an extractable AES-GCM CryptoKey.\n *\n * Throws (AES-GCM auth tag failure) when the credential doesn't\n * match the blob. Callers iterating over multiple blobs (e.g. paper\n * recovery's \"try every entry until one matches\") should catch.\n */\nexport async function unwrapDeksFromBlob(\n  blob: WrappedDeksBlob,\n  credential: string,\n): Promise<Map<string, EnclaveKey>> {\n  const wrappingKey = await deriveWrappingKey(credential, base64ToBytes(blob.salt))\n  const plaintext = await subtle.decrypt(\n    { name: 'AES-GCM', iv: base64ToBytes(blob.iv) as BufferSource },\n    wrappingKey,\n    base64ToBytes(blob.wrappedDeks) as BufferSource,\n  )\n  const parsed = JSON.parse(new TextDecoder().decode(plaintext)) as { deks: Record<string, string> }\n  const deks = new Map<string, EnclaveKey>()\n  for (const [coll, b64] of Object.entries(parsed.deks)) {\n    const raw = base64ToBytes(b64)\n    const key = await subtle.importKey(\n      'raw',\n      raw as BufferSource,\n      { name: 'AES-GCM', length: 256 },\n      true,\n      ['encrypt', 'decrypt'],\n    )\n    deks.set(coll, key)\n  }\n  return deks\n}\n\n// ─── Internals ─────────────────────────────────────────────────────────\n\nasync function deriveWrappingKey(credential: string, salt: Uint8Array): Promise<CryptoKey> {\n  return deriveSecretKey(credential, salt, { iterations: PBKDF2_ITERATIONS, keyUsage: 'aes-gcm' })\n}\n\nfunction bytesToBase64(b: Uint8Array): string {\n  let s = ''\n  for (const x of b) s += String.fromCharCode(x)\n  return btoa(s)\n}\n\nfunction base64ToBytes(b64: string): Uint8Array {\n  const s = atob(b64)\n  const out = new Uint8Array(s.length)\n  for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i)\n  return out\n}\n","/**\n * Recovery profile persistence + dispatch.\n *\n * Wires the **paper** profile end-to-end through\n * `@noy-db/on-recovery`. The other three profiles (Shamir,\n * multi-channel, admin-mediated) ship the API surface and throw\n * {@link RecoveryProfileNotImplementedError} during use; per-profile\n * dispatch lands in follow-up issues.\n *\n * Storage layout:\n *\n * ```\n * _meta/recovery-paper       — JSON { entries: RecoveryCodeEntry[] } produced by `on-recovery`.\n * _meta/recovery-shamir      — reserved\n * _meta/recovery-multi       — reserved\n * _meta/recovery-admin       — reserved\n * ```\n *\n * Like `_meta/policy` and `_meta/handle`, the documents are plain JSON\n * with empty `_iv` — the recovery-code wrapping is what protects the\n * KEK; the entries themselves are inert without the user's code.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport {\n  mintWrappedDeksBlob,\n  unwrapDeksFromBlob,\n  type WrappedDeksBlob,\n} from './wrapped-deks.js'\nimport type { ShamirRecoveryProvider } from './shamir-recovery-provider.js'\n\n/**\n * One paper recovery code as persisted in `_meta/recovery-paper`.\n *\n * The hub's KEK is intentionally non-extractable (see `crypto.ts`),\n * so the recovery entry can't AES-KW-wrap the KEK directly. Instead\n * we wrap a serialized DEK set: the entry holds the AES-GCM\n * ciphertext of `{ deks: { collection: rawDekBase64 } }`. Recovery\n * deserializes the DEK set, then mints a fresh KEK from the new\n * secret and rewraps the DEKs under it.\n *\n * This is the same pattern `@noy-db/on-pin` uses for tier-3 quick\n * resume — the cryptographic guarantee is identical (AES-GCM with a\n * PBKDF2-derived key), and it sidesteps the non-extractable-KEK\n * constraint cleanly.\n *\n * Type-level composition: `PaperRecoveryEntry extends\n * WrappedDeksBlob` — the three crypto fields (`salt`, `iv`,\n * `wrappedDeks`) come from the shared primitive; `codeId` and\n * `enrolledAt` are paper-recovery's own metadata. Wire format\n * unchanged.\n */\nexport interface PaperRecoveryEntry extends WrappedDeksBlob {\n  readonly codeId: string\n  readonly enrolledAt: string\n}\n\nexport interface PaperRecoveryDoc {\n  readonly _noydb_recovery: 1\n  readonly profile: 'paper'\n  readonly entries: ReadonlyArray<PaperRecoveryEntry>\n}\n\nconst PAPER_DOC_ID = 'recovery-paper'\n\n/** Read the paper-recovery entries. Returns empty array when absent. */\nexport async function loadPaperRecoveryEntries(\n  store: NoydbStore,\n  vault: string,\n): Promise<ReadonlyArray<PaperRecoveryEntry>> {\n  const env = await store.get(vault, '_meta', PAPER_DOC_ID)\n  if (!env) return []\n  try {\n    const doc = JSON.parse(env._data) as PaperRecoveryDoc\n    if (doc.profile !== 'paper' || !Array.isArray(doc.entries)) return []\n    return doc.entries\n  } catch {\n    return []\n  }\n}\n\n/** Replace the paper-recovery entries (used after burn-on-recovery). */\nexport async function savePaperRecoveryEntries(\n  store: NoydbStore,\n  vault: string,\n  entries: ReadonlyArray<PaperRecoveryEntry>,\n): Promise<void> {\n  const doc: PaperRecoveryDoc = {\n    _noydb_recovery: 1,\n    profile: 'paper',\n    entries,\n  }\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: 1,\n    _ts: new Date().toISOString(),\n    _iv: '',\n    _data: JSON.stringify(doc),\n  }\n  await store.put(vault, '_meta', PAPER_DOC_ID, envelope)\n}\n\n/** Drop a single paper-recovery entry (burn-on-use). */\nexport async function burnPaperRecoveryEntry(\n  store: NoydbStore,\n  vault: string,\n  codeId: string,\n): Promise<void> {\n  const entries = await loadPaperRecoveryEntries(store, vault)\n  const remaining = entries.filter((e) => e.codeId !== codeId)\n  await savePaperRecoveryEntries(store, vault, remaining)\n}\n\n/** Whether at least one recovery profile has any enrolled entries. */\nexport async function hasRecoveryEnrolled(\n  store: NoydbStore,\n  vault: string,\n): Promise<boolean> {\n  const paper = await loadPaperRecoveryEntries(store, vault)\n  if (paper.length > 0) return true\n  const shamir = await loadShamirRecoveryEntries(store, vault)\n  return shamir.length > 0\n}\n\n/**\n * Whether at least one **strong** recovery profile is enrolled.\n *\n * \"Strong\" excludes paper-alone — under managed-secret mode the\n * user has no memorized secret, so a stolen/lost paper sheet\n * would be a single point of total loss. Strong profiles today:\n *\n *   - `shamir` (k-of-n threshold; survives loss of up to n-k shares)\n *   - `multi-channel` (when shipped — follow-up slice)\n *   - `admin-mediated` (when shipped — follow-up slice)\n *\n * Managed mode requires this check to pass before `openVault` returns.\n */\nexport async function hasStrongRecoveryEnrolled(\n  store: NoydbStore,\n  vault: string,\n): Promise<boolean> {\n  const shamir = await loadShamirRecoveryEntries(store, vault)\n  return shamir.length > 0\n  // When multi-channel / admin-mediated land, extend this check.\n}\n\n// ─── Shamir recovery ─────────────────────────────────────────────────────\n\n/**\n * One Shamir-recovery entry as persisted in `_meta/recovery-shamir`.\n *\n * Like {@link PaperRecoveryEntry}, the entry composes\n * {@link WrappedDeksBlob} (DEKs wrapped under a fresh ephemeral\n * recovery secret) with profile-specific metadata. Unlike paper, the\n * \"credential\" was never visible to the user — it was 32 random\n * bytes split into N Shamir shares at enrollment. The shares ARE\n * the credential; the user holds them, the hub never sees them\n * again after `enrollRecovery` returns.\n *\n * The recovery secret is base64-encoded and\n * passed as the `credential` arg to\n * {@link mintWrappedDeksBlob} / {@link unwrapDeksFromBlob}. The\n * PBKDF2 round over high-entropy input is harmless overhead — it\n * keeps the shared primitive unchanged while letting Shamir reuse\n * the same wrapping pipeline as paper.\n */\nexport interface ShamirRecoveryEntry extends WrappedDeksBlob {\n  /** Stable id for this entry. Allows multiple Shamir splits to coexist. */\n  readonly entryId: string\n  /** Threshold — minimum shares to reconstruct. */\n  readonly k: number\n  /** Total shares minted at enrollment. */\n  readonly n: number\n  /** x-coordinates of the n minted shares. Informational. Omitted as of 0.2\n   *  (string-level provider doesn't expose share x-coords); kept optional so\n   *  pre-0.2 entries still read. */\n  readonly xCoords?: ReadonlyArray<number>\n  /** ISO timestamp. */\n  readonly enrolledAt: string\n  /** Optional caller-supplied label (e.g., \"2-of-3 board escrow\"). */\n  readonly label?: string\n}\n\nexport interface ShamirRecoveryDoc {\n  readonly _noydb_recovery: 1\n  readonly profile: 'shamir'\n  readonly entries: ReadonlyArray<ShamirRecoveryEntry>\n}\n\nconst SHAMIR_DOC_ID = 'recovery-shamir'\n\n/** Read the Shamir-recovery entries. Returns empty array when absent. */\nexport async function loadShamirRecoveryEntries(\n  store: NoydbStore,\n  vault: string,\n): Promise<ReadonlyArray<ShamirRecoveryEntry>> {\n  const env = await store.get(vault, '_meta', SHAMIR_DOC_ID)\n  if (!env) return []\n  try {\n    const doc = JSON.parse(env._data) as ShamirRecoveryDoc\n    if (doc.profile !== 'shamir' || !Array.isArray(doc.entries)) return []\n    return doc.entries\n  } catch {\n    return []\n  }\n}\n\n/** Replace the Shamir-recovery entries (used by enrollment and rotation). */\nexport async function saveShamirRecoveryEntries(\n  store: NoydbStore,\n  vault: string,\n  entries: ReadonlyArray<ShamirRecoveryEntry>,\n): Promise<void> {\n  const doc: ShamirRecoveryDoc = {\n    _noydb_recovery: 1,\n    profile: 'shamir',\n    entries,\n  }\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: 1,\n    _ts: new Date().toISOString(),\n    _iv: '',\n    _data: JSON.stringify(doc),\n  }\n  await store.put(vault, '_meta', SHAMIR_DOC_ID, envelope)\n}\n\n/**\n * Mint a fresh Shamir recovery entry from a DEK set.\n *\n * 1. Generates a 32-byte recovery secret.\n * 2. Wraps the DEK set under that secret via\n *    {@link mintWrappedDeksBlob} (the recovery secret is base64-\n *    encoded as the credential string — PBKDF2 over high-entropy\n *    input is harmless overhead).\n * 3. Splits the recovery secret via Shamir into `n` shares with\n *    threshold `k`.\n * 4. Zeros the in-memory recovery secret after wrapping + splitting.\n *\n * Returns:\n *   - `entry` — the {@link ShamirRecoveryEntry} to persist.\n *   - `shareStrings` — the `n` Base32-encoded share strings to\n *     return to the caller. The HUB MUST NOT PERSIST THESE; once\n *     returned they are the user's responsibility.\n *\n * @param deks - DEK set to wrap.\n * @param entryId - Stable id for this entry (caller-supplied or\n *                  hub-generated).\n * @param k - Threshold (>= 2).\n * @param n - Total shares (k <= n <= 255).\n * @param label - Optional caller label.\n */\nexport async function mintShamirRecoveryEntry(\n  provider: ShamirRecoveryProvider,\n  deks: Map<string, EnclaveKey>,\n  entryId: string,\n  k: number,\n  n: number,\n  label?: string,\n): Promise<{ entry: ShamirRecoveryEntry; shareStrings: string[] }> {\n  const recoverySecret = crypto.getRandomValues(new Uint8Array(32))\n  try {\n    const credential = bytesToBase64(recoverySecret)\n    const blob = await mintWrappedDeksBlob(deks, credential)\n    const shareStrings = provider.splitToShares(recoverySecret, k, n)\n    const entry: ShamirRecoveryEntry = {\n      ...blob, entryId, k, n,\n      enrolledAt: new Date().toISOString(),\n      ...(label !== undefined && { label }),\n    }\n    return { entry, shareStrings }\n  } finally {\n    recoverySecret.fill(0)\n  }\n}\n\n/**\n * Decrypt a Shamir recovery entry to recover the raw DEK set.\n *\n * Combines K or more `shares`, reconstructs the recovery secret,\n * unwraps the DEKs via {@link unwrapDeksFromBlob}.\n *\n * Throws (AES-GCM auth-tag mismatch) when the shares don't combine\n * to the secret originally used to mint the entry — typically\n * because they came from a different enrollment or were tampered\n * with. Callers iterating multiple entries should catch.\n */\nexport async function unwrapDeksFromShamirEntry(\n  provider: ShamirRecoveryProvider,\n  entry: ShamirRecoveryEntry,\n  shareStrings: readonly string[],\n): Promise<Map<string, EnclaveKey>> {\n  if (shareStrings.length < entry.k) {\n    throw new Error(\n      `Insufficient shares: this Shamir entry needs ${entry.k} of ${entry.n}, `\n      + `but ${shareStrings.length} were provided.`,\n    )\n  }\n  const secret = provider.combineShares(shareStrings)\n  try {\n    return await unwrapDeksFromBlob(entry, bytesToBase64(secret))\n  } finally {\n    secret.fill(0)\n  }\n}\n\nfunction bytesToBase64(b: Uint8Array): string {\n  let s = ''\n  for (const x of b) s += String.fromCharCode(x)\n  return btoa(s)\n}\n\n/**\n * Generate one paper-recovery entry from an unlocked DEK set.\n *\n * Returns the serializable entry (persisted via\n * {@link savePaperRecoveryEntries}). The recovery flow unwraps the\n * DEK set, then mints a fresh KEK from the user's new secret.\n *\n * Thin wrapper over {@link mintWrappedDeksBlob} — the crypto\n * lives in the shared primitive; this function just adds paper-\n * recovery's own metadata (`codeId`, `enrolledAt`).\n *\n * @param deks      Map of collection-name → DEK (extractable).\n * @param code      The plaintext recovery code (caller-supplied;\n *                  pair this with `@noy-db/on-recovery`'s code\n *                  generator/parser if available).\n * @param codeId    Stable id used by `burnPaperRecoveryEntry`.\n */\nexport async function mintPaperRecoveryEntry(\n  deks: Map<string, EnclaveKey>,\n  code: string,\n  codeId: string,\n): Promise<PaperRecoveryEntry> {\n  const blob = await mintWrappedDeksBlob(deks, code)\n  return {\n    ...blob,\n    codeId,\n    enrolledAt: new Date().toISOString(),\n  }\n}\n\n/**\n * Decrypt a recovery entry to recover the raw DEK set. Used by the\n * `recoverSecret` flow after the user's code has been parsed.\n *\n * Thin wrapper over {@link unwrapDeksFromBlob}.\n *\n * @throws when the code does not match the entry (AES-GCM auth tag fail).\n */\nexport async function unwrapDeksFromPaperEntry(\n  entry: PaperRecoveryEntry,\n  code: string,\n): Promise<Map<string, EnclaveKey>> {\n  return unwrapDeksFromBlob(entry, code)\n}\n\n// The crypto helpers (deriveRecoveryWrappingKey, bytesToBase64,\n// base64ToBytes) live in the canonical wrap-DEKs primitive at\n// `./wrapped-deks.ts` and are reached via\n// `mintWrappedDeksBlob` / `unwrapDeksFromBlob`.\n"],"mappings":";;;;;;;;AAsCA,IAAM,oBAAoB;AAC1B,IAAM,aAAa;AACnB,IAAM,WAAW;AAEjB,IAAM,SAAS,WAAW,OAAO;AA8CjC,eAAsB,oBACpB,MACA,YAC0B;AAC1B,QAAM,OAAO,OAAO,gBAAgB,IAAI,WAAW,UAAU,CAAC;AAC9D,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,QAAQ,CAAC;AAC1D,QAAM,cAAc,MAAM,kBAAkB,YAAY,IAAI;AAG5D,QAAM,WAAmC,CAAC;AAC1C,aAAW,CAAC,MAAM,GAAG,KAAK,MAAM;AAC9B,UAAM,MAAM,MAAM,OAAO,UAAU,OAAO,GAAG;AAC7C,aAAS,IAAI,IAAI,cAAc,IAAI,WAAW,GAAG,CAAC;AAAA,EACpD;AACA,QAAM,YAAY,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC,CAAC;AAC7E,QAAM,aAAa,MAAM,OAAO;AAAA,IAC9B,EAAE,MAAM,WAAW,GAAuB;AAAA,IAC1C;AAAA,IACA;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,cAAc,IAAI;AAAA,IACxB,IAAI,cAAc,EAAE;AAAA,IACpB,aAAa,cAAc,IAAI,WAAW,UAAU,CAAC;AAAA,EACvD;AACF;AAaA,eAAsB,mBACpB,MACA,YACkC;AAClC,QAAM,cAAc,MAAM,kBAAkB,YAAY,cAAc,KAAK,IAAI,CAAC;AAChF,QAAM,YAAY,MAAM,OAAO;AAAA,IAC7B,EAAE,MAAM,WAAW,IAAI,cAAc,KAAK,EAAE,EAAkB;AAAA,IAC9D;AAAA,IACA,cAAc,KAAK,WAAW;AAAA,EAChC;AACA,QAAM,SAAS,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAC7D,QAAM,OAAO,oBAAI,IAAwB;AACzC,aAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,OAAO,IAAI,GAAG;AACrD,UAAM,MAAM,cAAc,GAAG;AAC7B,UAAM,MAAM,MAAM,OAAO;AAAA,MACvB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,WAAW,QAAQ,IAAI;AAAA,MAC/B;AAAA,MACA,CAAC,WAAW,SAAS;AAAA,IACvB;AACA,SAAK,IAAI,MAAM,GAAG;AAAA,EACpB;AACA,SAAO;AACT;AAIA,eAAe,kBAAkB,YAAoB,MAAsC;AACzF,SAAO,gBAAgB,YAAY,MAAM,EAAE,YAAY,mBAAmB,UAAU,UAAU,CAAC;AACjG;AAEA,SAAS,cAAc,GAAuB;AAC5C,MAAI,IAAI;AACR,aAAW,KAAK,EAAG,MAAK,OAAO,aAAa,CAAC;AAC7C,SAAO,KAAK,CAAC;AACf;AAEA,SAAS,cAAc,KAAyB;AAC9C,QAAM,IAAI,KAAK,GAAG;AAClB,QAAM,MAAM,IAAI,WAAW,EAAE,MAAM;AACnC,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,KAAI,CAAC,IAAI,EAAE,WAAW,CAAC;AAC1D,SAAO;AACT;;;ACxGA,IAAM,eAAe;AAGrB,eAAsB,yBACpB,OACA,OAC4C;AAC5C,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,SAAS,YAAY;AACxD,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,IAAI,KAAK;AAChC,QAAI,IAAI,YAAY,WAAW,CAAC,MAAM,QAAQ,IAAI,OAAO,EAAG,QAAO,CAAC;AACpE,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAGA,eAAsB,yBACpB,OACA,OACA,SACe;AACf,QAAM,MAAwB;AAAA,IAC5B,iBAAiB;AAAA,IACjB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO,KAAK,UAAU,GAAG;AAAA,EAC3B;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,cAAc,QAAQ;AACxD;AAGA,eAAsB,uBACpB,OACA,OACA,QACe;AACf,QAAM,UAAU,MAAM,yBAAyB,OAAO,KAAK;AAC3D,QAAM,YAAY,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM;AAC3D,QAAM,yBAAyB,OAAO,OAAO,SAAS;AACxD;AAGA,eAAsB,oBACpB,OACA,OACkB;AAClB,QAAM,QAAQ,MAAM,yBAAyB,OAAO,KAAK;AACzD,MAAI,MAAM,SAAS,EAAG,QAAO;AAC7B,QAAM,SAAS,MAAM,0BAA0B,OAAO,KAAK;AAC3D,SAAO,OAAO,SAAS;AACzB;AAeA,eAAsB,0BACpB,OACA,OACkB;AAClB,QAAM,SAAS,MAAM,0BAA0B,OAAO,KAAK;AAC3D,SAAO,OAAO,SAAS;AAEzB;AA6CA,IAAM,gBAAgB;AAGtB,eAAsB,0BACpB,OACA,OAC6C;AAC7C,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,SAAS,aAAa;AACzD,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,IAAI,KAAK;AAChC,QAAI,IAAI,YAAY,YAAY,CAAC,MAAM,QAAQ,IAAI,OAAO,EAAG,QAAO,CAAC;AACrE,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAGA,eAAsB,0BACpB,OACA,OACA,SACe;AACf,QAAM,MAAyB;AAAA,IAC7B,iBAAiB;AAAA,IACjB,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO,KAAK,UAAU,GAAG;AAAA,EAC3B;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,eAAe,QAAQ;AACzD;AA2BA,eAAsB,wBACpB,UACA,MACA,SACA,GACA,GACA,OACiE;AACjE,QAAM,iBAAiB,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAChE,MAAI;AACF,UAAM,aAAaA,eAAc,cAAc;AAC/C,UAAM,OAAO,MAAM,oBAAoB,MAAM,UAAU;AACvD,UAAM,eAAe,SAAS,cAAc,gBAAgB,GAAG,CAAC;AAChE,UAAM,QAA6B;AAAA,MACjC,GAAG;AAAA,MAAM;AAAA,MAAS;AAAA,MAAG;AAAA,MACrB,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACnC,GAAI,UAAU,UAAa,EAAE,MAAM;AAAA,IACrC;AACA,WAAO,EAAE,OAAO,aAAa;AAAA,EAC/B,UAAE;AACA,mBAAe,KAAK,CAAC;AAAA,EACvB;AACF;AAaA,eAAsB,0BACpB,UACA,OACA,cACkC;AAClC,MAAI,aAAa,SAAS,MAAM,GAAG;AACjC,UAAM,IAAI;AAAA,MACR,gDAAgD,MAAM,CAAC,OAAO,MAAM,CAAC,SAC5D,aAAa,MAAM;AAAA,IAC9B;AAAA,EACF;AACA,QAAM,SAAS,SAAS,cAAc,YAAY;AAClD,MAAI;AACF,WAAO,MAAM,mBAAmB,OAAOA,eAAc,MAAM,CAAC;AAAA,EAC9D,UAAE;AACA,WAAO,KAAK,CAAC;AAAA,EACf;AACF;AAEA,SAASA,eAAc,GAAuB;AAC5C,MAAI,IAAI;AACR,aAAW,KAAK,EAAG,MAAK,OAAO,aAAa,CAAC;AAC7C,SAAO,KAAK,CAAC;AACf;AAmBA,eAAsB,uBACpB,MACA,MACA,QAC6B;AAC7B,QAAM,OAAO,MAAM,oBAAoB,MAAM,IAAI;AACjD,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC;AACF;AAUA,eAAsB,yBACpB,OACA,MACkC;AAClC,SAAO,mBAAmB,OAAO,IAAI;AACvC;","names":["bytesToBase64"]}

package/dist/chunk-CKUYQO2P.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-formula/materialized-views/stale.ts"],"sourcesContent":["import type { Collection } from '../../kernel/collection.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { PutDerivedOutputCtx } from '../../kernel/via/dispatch.js'\nimport type { MaterializedViewRegistry, RegisteredMV } from './registry.js'\n// Type-only — runtime class loaded via dynamic import in\n// `resolveStaleMVOnRead` only when a stale flag actually fires.\n// Keeps the executor chunk out of the floor bundle (mirrors v1 floor-bundle isolation).\nimport type { MaterializedViewExecutor as MVExecutorType } from './executor.js'\nimport type { MVQueryContext } from './types.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { RecordCodec } from '../../kernel/enclave/index.js'\n\n/**\n * Accessor shape passed in from the owning Vault. Provides the\n * registry (used as a stable WeakMap key + to look up MVs by output\n * collection) and the runtime context the lazy refresh needs.\n * Mirrors v1's `DerivationStaleAccessor`.\n */\nexport interface MVStaleAccessor {\n  registry(): MaterializedViewRegistry\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  getCollection(name: string): Collection<any>\n  getActiveTxContext(): TxContext | null\n  getQueryContext(): MVQueryContext\n}\n\n/**\n * In-memory stale map keyed by `MaterializedViewRegistry` instance\n * (stable per vault). Each registry maps to a set of MV names that\n * have at least one pending source-change requiring a re-materialize.\n *\n * Persistence across vault close is NOT implemented in this iteration\n * (concern flagged in the v2 spec, mirrors v1 derivation behavior).\n * On vault re-open, the unset stale flag is interpreted as \"fresh\" —\n * `vault.refreshView(name)` is the explicit recompute escape hatch.\n *\n * @internal\n */\nconst _staleByRegistry = new WeakMap<MaterializedViewRegistry, Set<string>>()\n\n/**\n * Mark an MV as stale. Called from `Collection.dispatchMaterializedViews`\n * when a source-write fires for a `refresh: 'lazy'` MV.\n *\n * @internal\n */\nexport function markMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  let set = _staleByRegistry.get(registry)\n  if (!set) {\n    set = new Set()\n    _staleByRegistry.set(registry, set)\n  }\n  set.add(mvName)\n}\n\n/**\n * Test-only: check whether a given MV name is currently flagged stale\n * against a registry. Exported so the regression suite can pin the\n * stale-bit lifecycle without touching the internal `WeakMap`.\n *\n * @internal\n */\nexport function isMVStale(registry: MaterializedViewRegistry, mvName: string): boolean {\n  return _staleByRegistry.get(registry)?.has(mvName) ?? false\n}\n\n/**\n * Reserved collection holding CONTENT-FREE lazy-stale markers (record id =\n * MV name, plaintext `_iv: ''` envelope, no payload) — mirrors the\n * `_meta`/schema-fence marker envelope shape. Written only from the\n * delete/forget/elevate dispatcher (#736); ordinary source writes stay\n * in-memory-only (the cheap path). Read via the adapter directly, never\n * through `vault.collection()` — same reserved-collection convention as\n * `_subject_index`/`_meta`.\n */\nexport const MV_STALE_COLLECTION = '_mv_stale'\n\n/**\n * Once-per-registry hydrate guard for `resolveStaleMVOnRead`'s persisted-marker fold-in.\n * Stores the in-flight/settled PROMISE (not a boolean) — a concurrent cold first read that\n * arrives while the hydrate is still awaiting `adapter.list` must await the SAME promise\n * rather than observing \"already hydrating\" and reading an empty pending set (#736\n * whole-branch review).\n */\nconst _hydratedByRegistry = new WeakMap<MaterializedViewRegistry, Promise<void>>()\n\n/** The adapter + vault name backing any collection in this vault (all collections share both). */\nfunction storeOf(accessor: MVStaleAccessor, collectionName: string): { adapter: NoydbStore; vault: string } {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const c = accessor.getCollection(collectionName) as any\n  return { adapter: c.adapter as NoydbStore, vault: c.vault as string }\n}\n\nasync function writeMVStaleMarker(adapter: NoydbStore, vault: string, mvName: string): Promise<void> {\n  // Content-free — the marker's only payload is its key (the MV name).\n  const env = RecordCodec.buildPlaintextEnvelope({ version: 1, data: '{}' })\n  await adapter.put(vault, MV_STALE_COLLECTION, mvName, env)\n}\n\nasync function deleteMVStaleMarker(adapter: NoydbStore, vault: string, mvName: string): Promise<void> {\n  await adapter.delete(vault, MV_STALE_COLLECTION, mvName)\n}\n\n/**\n * On first `resolveStaleMVOnRead` call for a (cold-reopened) registry, fold every\n * persisted `_mv_stale` marker into the in-memory pending set — otherwise a cold\n * session's empty `WeakMap` entry reads as \"fresh\" and serves the emptied output\n * collection forever.\n */\nasync function hydratePersistedStaleMarkers(accessor: MVStaleAccessor, registry: MaterializedViewRegistry): Promise<void> {\n  const mvs = registry.all()\n  if (mvs.length === 0) return\n  const { adapter, vault } = storeOf(accessor, mvs[0]!.outputCollection)\n  // No try/catch: a genuine store failure here must surface, not be read as\n  // \"nothing pending\" — silently treating it as fresh is the exact leak class\n  // this module closes (mirrors `subject-index.ts`'s bare `adapter.list` reads).\n  for (const name of await adapter.list(vault, MV_STALE_COLLECTION)) markMVStale(registry, name)\n}\n\n/**\n * Invalidate an MV from the delete/forget/elevate dispatcher (#736) — the ordinary\n * source-write path (`dispatchMaterializedViews`) never calls this. Deletes EVERY\n * persisted row in `reg.outputCollection` via `_internalDelete` (the at-rest law: a\n * stale mark alone leaves the elevated/forgotten source's plaintext sitting in the\n * output row) using the adapter directly so the read-path's `resolveStaleMVOnRead`\n * isn't triggered mid-invalidation. `mode: 'lazy'` also persists the stale mark so a\n * cold session recomputes on next read; `'manual'` gets the purge only — the MV\n * serves empty until an explicit `vault.refreshView()` (erasure wins). Deletion is\n * stamp-scoped (`_materializedFrom.mvName === reg.spec.name` — see the loop below),\n * so another registered MV sharing this output collection keeps its own rows intact:\n * no cross-MV re-marking is needed here, only `reg` itself is marked stale.\n *\n * Returns the count of rows actually `_internalDelete`d (#761 item 1) — folded by the\n * caller into `dispatchMaterializedViewsOnDelete`'s `deleted` so `ForgetResult.derivedRecordsErased`\n * counts lazy/manual purges too, not just the eager executor's tombstone leg — plus\n * `residueUndecodable`, the bare ids whose ownership stamp could NOT be decoded (#776): a\n * candidate row that fails to decode under the collection's default DEK (e.g. elevated above\n * tier 0 on a tiered output collection) has UNKNOWN ownership — it might be this MV's own\n * output, or (same-collection shape) a plain user record — so it is never erased, but it must\n * be SURFACED rather than silently skipped (the #724 posture), since it may still hold the\n * forgotten/pre-elevation contribution, decryptable by tier-holders — and `residueDeclined`\n * (#785), the bare ids that DID decode and stamp-match but whose `_internalDelete` declined\n * (ownership CONFIRMED, erasure declined).\n *\n * @internal\n */\nexport async function invalidateMVAtRest(\n  accessor: MVStaleAccessor,\n  reg: RegisteredMV,\n  mode: 'lazy' | 'manual',\n): Promise<{ deleted: number; residueUndecodable: string[]; residueDeclined: string[] }> {\n  const outputColl = accessor.getCollection(reg.outputCollection)\n  const txCtx = accessor.getActiveTxContext()\n  const { adapter, vault } = storeOf(accessor, reg.outputCollection)\n  let deleted = 0\n  const residueUndecodable: string[] = []\n  const residueDeclined: string[] = []\n  for (const id of await adapter.list(vault, reg.outputCollection)) {\n    // A same-collection partition MV (`output: { collection: <source>, partition }`,\n    // the DERIV-PP30-001 shape) writes INTO its own source collection — `adapter.list`\n    // over `reg.outputCollection` then also returns untouched user source records.\n    // Decode each candidate row (the invalidation path is rare; this cost is fine\n    // here) and only erase rows THIS MV stamped via `_materializedFrom.mvName` —\n    // an unstamped row, or one stamped by a different MV, is never this MV's to\n    // delete (#736 whole-branch review, Critical).\n    const envelope = await adapter.get(vault, reg.outputCollection, id)\n    if (envelope === null) continue\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const decoded = await (outputColl as any)._decodeEnvelope(envelope, id)\n    if (decoded === null) { residueUndecodable.push(id); continue } // #776 — ownership unknown, surfaced not skipped\n    const stampedBy = (decoded as Record<string, unknown>)._materializedFrom as { mvName?: string } | undefined\n    if (stampedBy?.mvName !== reg.spec.name) continue\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    if (await (outputColl as any)._internalDelete(id, txCtx)) {\n      deleted++\n    } else {\n      // #782 part b — decoded AND stamp-owned, but erasure declined (#718 tier-elevation\n      // gate). Ownership IS confirmed — a real silent survival, not a legit stamp-mismatch\n      // skip. Surface it too, in its own channel (#785 — distinct from the decode-null case).\n      residueDeclined.push(id)\n    }\n  }\n\n  // `mode: 'manual'` gets the purge only (erasure wins, no auto-recompute promise);\n  // `'lazy'` also marks + persists ITS OWN stale bit for cold-session recompute. No\n  // sibling MV on the same output collection is touched here — the stamp-scoped\n  // deletion above never erased sibling rows in the first place (#736 re-review).\n  if (mode === 'lazy') {\n    const registry = accessor.registry()\n    markMVStale(registry, reg.spec.name)\n    await writeMVStaleMarker(adapter, vault, reg.spec.name)\n  }\n  return { deleted, residueUndecodable, residueDeclined }\n}\n\n/**\n * Called from `Collection.get` (and any reader that materializes the\n * MV's output collection). If any MV producing `outputCollection` is\n * flagged stale, runs the executor against the live source state\n * before returning. No-op when there is no pending work — keeps the\n * read fast path negligible.\n *\n * `dispatchCtx` (#641): threaded from the calling `Collection`'s\n * `#dispatchCtx({ collection: outputCollection, id: 'resolve-on-read' })` — a read has no\n * real \"reacting write\" record, so `'resolve-on-read'` is the sentinel id, mirroring\n * `Vault.refreshView()`'s `'refreshView'` sentinel for the same reason. Passed straight\n * through to the executor so a stale row whose output lands in a closed period follows the\n * frozen-output rule (skip + `derivation:skipped-frozen`, #637) instead of throwing\n * `PeriodClosedError` out of a read.\n *\n * Dynamic-imports the executor only when a stale flag actually fires\n * (the floor-bundle isolation pattern v1 derivations established in\n * floor-bundle isolation pattern).\n */\nexport async function resolveStaleMVOnRead(\n  accessor: MVStaleAccessor,\n  outputCollection: string,\n  dispatchCtx?: PutDerivedOutputCtx,\n): Promise<void> {\n  const registry = accessor.registry()\n  // Cold session: the in-memory WeakMap has no entry for this (freshly\n  // constructed) registry yet — fold any persisted `_mv_stale` markers in\n  // before reading the pending set, once per registry (#736). Memoize the\n  // PROMISE, not a boolean: a concurrent first read arriving while the\n  // hydrate is still awaiting `adapter.list` must await the SAME promise —\n  // otherwise it observes \"already hydrating\", skips straight to an empty\n  // pending set, and serves the purged/stale view as fresh (#736\n  // whole-branch review, hydrate-once race). On rejection, evict the entry\n  // BEFORE rethrowing — a cached rejected promise would otherwise poison the\n  // MV read surface for the rest of the session (every later read re-awaits\n  // the same rejection instead of retrying the store call) (#736 re-review).\n  let hydrate = _hydratedByRegistry.get(registry)\n  if (!hydrate) {\n    hydrate = hydratePersistedStaleMarkers(accessor, registry).catch((err: unknown) => {\n      _hydratedByRegistry.delete(registry)\n      throw err\n    })\n    _hydratedByRegistry.set(registry, hydrate)\n  }\n  await hydrate\n  const pending = _staleByRegistry.get(registry)\n  if (!pending || pending.size === 0) return\n\n  const { adapter, vault } = storeOf(accessor, outputCollection)\n\n  // Clean up persisted markers for MV names no longer registered (renamed or\n  // removed since the marker was written). Without this sweep an orphaned name\n  // can never become a `candidate` below — `candidates` is built from\n  // `registry.all()`, which no longer lists it — so both the in-memory pending\n  // entry and the persisted `_mv_stale` row would linger forever, re-hydrating\n  // on every cold session (#736 whole-branch review).\n  for (const name of pending) {\n    if (registry.byName(name)) continue\n    pending.delete(name)\n    await deleteMVStaleMarker(adapter, vault, name)\n  }\n  if (pending.size === 0) return\n\n  // Find every MV that writes to this output collection AND is\n  // currently flagged stale. Multiple MVs CAN share an output\n  // collection in theory; in practice the registration validation +\n  // cycle detection make this unusual.\n  const candidates: string[] = []\n  for (const mv of registry.all()) {\n    if (mv.outputCollection !== outputCollection) continue\n    if (!pending.has(mv.spec.name)) continue\n    candidates.push(mv.spec.name)\n  }\n  if (candidates.length === 0) return\n\n  let executor: typeof MVExecutorType | null = null\n  for (const name of candidates) {\n    const reg = registry.byName(name)\n    if (!reg) {\n      // Unreachable in practice — `candidates` is drawn from `registry.all()`,\n      // and the orphan sweep above already cleared any name absent from it.\n      // Kept as a defensive fallback; also clears the persisted marker so it\n      // can't linger if this ever does fire.\n      pending.delete(name)\n      await deleteMVStaleMarker(adapter, vault, name)\n      continue\n    }\n    if (executor === null) {\n      ({ MaterializedViewExecutor: executor } = (await import('./executor.js')) as {\n        MaterializedViewExecutor: typeof MVExecutorType\n      })\n    }\n    // A cold-hydrated stale flag (unlike an in-session one) can fire with\n    // NONE of the MV's dependency collections touched yet this session —\n    // the sync `Query.toArray()` `spec.query()` runs reads straight off\n    // `Collection`'s in-memory cache, populated only by a prior async\n    // touch (`ensureHydrated()`, called from `get`/`list`/`put`, never\n    // from `query()` itself). Warm every dependency first so the recompute\n    // sees the live persisted state instead of an empty cache (#736).\n    for (const dep of reg.dependencies) {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      await (accessor.getCollection(dep) as any).ensureHydrated()\n    }\n    await executor.refresh(reg, {\n      getCollection: (n) => accessor.getCollection(n),\n      getActiveTxContext: () => accessor.getActiveTxContext(),\n      getQueryContext: () => accessor.getQueryContext(),\n      ...(dispatchCtx !== undefined ? { dispatchCtx } : {}),\n    })\n    pending.delete(name)\n    // Runs even when no marker was ever persisted for this name (an in-session-only\n    // stale bit — e.g. the cheap ordinary-write path never writes one, see the\n    // \"cheap-path guarantee\" test). `adapter.delete` on an absent key is a harmless\n    // void — keeping this unconditional avoids branching on marker origin here.\n    await deleteMVStaleMarker(adapter, vault, name)\n  }\n}\n\n/**\n * Drop every stale flag for a registry. Used after a manual\n * `vault.refreshView(name)` runs the executor explicitly — the\n * post-refresh state matches the registered strategies, so\n * lingering stale bits would force a redundant refresh on the next\n * read.\n *\n * @internal\n */\nexport function clearMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  _staleByRegistry.get(registry)?.delete(mvName)\n}\n\n/**\n * `clearMVStale` plus the persisted marker (#736) — `Vault.refreshView()`'s\n * completion path. A lingering persisted marker after a manual refresh would\n * make the NEXT cold session recompute redundantly.\n *\n * @internal\n */\nexport async function clearMVStaleFully(\n  adapter: NoydbStore,\n  vault: string,\n  registry: MaterializedViewRegistry,\n  mvName: string,\n): Promise<void> {\n  clearMVStale(registry, mvName)\n  await deleteMVStaleMarker(adapter, vault, mvName)\n}\n"],"mappings":";;;;;AAsCA,IAAM,mBAAmB,oBAAI,QAA+C;AAQrE,SAAS,YAAY,UAAoC,QAAsB;AACpF,MAAI,MAAM,iBAAiB,IAAI,QAAQ;AACvC,MAAI,CAAC,KAAK;AACR,UAAM,oBAAI,IAAI;AACd,qBAAiB,IAAI,UAAU,GAAG;AAAA,EACpC;AACA,MAAI,IAAI,MAAM;AAChB;AASO,SAAS,UAAU,UAAoC,QAAyB;AACrF,SAAO,iBAAiB,IAAI,QAAQ,GAAG,IAAI,MAAM,KAAK;AACxD;AAWO,IAAM,sBAAsB;AASnC,IAAM,sBAAsB,oBAAI,QAAiD;AAGjF,SAAS,QAAQ,UAA2B,gBAAgE;AAE1G,QAAM,IAAI,SAAS,cAAc,cAAc;AAC/C,SAAO,EAAE,SAAS,EAAE,SAAuB,OAAO,EAAE,MAAgB;AACtE;AAEA,eAAe,mBAAmB,SAAqB,OAAe,QAA+B;AAEnG,QAAM,MAAM,YAAY,uBAAuB,EAAE,SAAS,GAAG,MAAM,KAAK,CAAC;AACzE,QAAM,QAAQ,IAAI,OAAO,qBAAqB,QAAQ,GAAG;AAC3D;AAEA,eAAe,oBAAoB,SAAqB,OAAe,QAA+B;AACpG,QAAM,QAAQ,OAAO,OAAO,qBAAqB,MAAM;AACzD;AAQA,eAAe,6BAA6B,UAA2B,UAAmD;AACxH,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,IAAI,WAAW,EAAG;AACtB,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,IAAI,CAAC,EAAG,gBAAgB;AAIrE,aAAW,QAAQ,MAAM,QAAQ,KAAK,OAAO,mBAAmB,EAAG,aAAY,UAAU,IAAI;AAC/F;AA6BA,eAAsB,mBACpB,UACA,KACA,MACuF;AACvF,QAAM,aAAa,SAAS,cAAc,IAAI,gBAAgB;AAC9D,QAAM,QAAQ,SAAS,mBAAmB;AAC1C,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,IAAI,gBAAgB;AACjE,MAAI,UAAU;AACd,QAAM,qBAA+B,CAAC;AACtC,QAAM,kBAA4B,CAAC;AACnC,aAAW,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI,gBAAgB,GAAG;AAQhE,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,IAAI,kBAAkB,EAAE;AAClE,QAAI,aAAa,KAAM;AAEvB,UAAM,UAAU,MAAO,WAAmB,gBAAgB,UAAU,EAAE;AACtE,QAAI,YAAY,MAAM;AAAE,yBAAmB,KAAK,EAAE;AAAG;AAAA,IAAS;AAC9D,UAAM,YAAa,QAAoC;AACvD,QAAI,WAAW,WAAW,IAAI,KAAK,KAAM;AAEzC,QAAI,MAAO,WAAmB,gBAAgB,IAAI,KAAK,GAAG;AACxD;AAAA,IACF,OAAO;AAIL,sBAAgB,KAAK,EAAE;AAAA,IACzB;AAAA,EACF;AAMA,MAAI,SAAS,QAAQ;AACnB,UAAM,WAAW,SAAS,SAAS;AACnC,gBAAY,UAAU,IAAI,KAAK,IAAI;AACnC,UAAM,mBAAmB,SAAS,OAAO,IAAI,KAAK,IAAI;AAAA,EACxD;AACA,SAAO,EAAE,SAAS,oBAAoB,gBAAgB;AACxD;AAqBA,eAAsB,qBACpB,UACA,kBACA,aACe;AACf,QAAM,WAAW,SAAS,SAAS;AAYnC,MAAI,UAAU,oBAAoB,IAAI,QAAQ;AAC9C,MAAI,CAAC,SAAS;AACZ,cAAU,6BAA6B,UAAU,QAAQ,EAAE,MAAM,CAAC,QAAiB;AACjF,0BAAoB,OAAO,QAAQ;AACnC,YAAM;AAAA,IACR,CAAC;AACD,wBAAoB,IAAI,UAAU,OAAO;AAAA,EAC3C;AACA,QAAM;AACN,QAAM,UAAU,iBAAiB,IAAI,QAAQ;AAC7C,MAAI,CAAC,WAAW,QAAQ,SAAS,EAAG;AAEpC,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,gBAAgB;AAQ7D,aAAW,QAAQ,SAAS;AAC1B,QAAI,SAAS,OAAO,IAAI,EAAG;AAC3B,YAAQ,OAAO,IAAI;AACnB,UAAM,oBAAoB,SAAS,OAAO,IAAI;AAAA,EAChD;AACA,MAAI,QAAQ,SAAS,EAAG;AAMxB,QAAM,aAAuB,CAAC;AAC9B,aAAW,MAAM,SAAS,IAAI,GAAG;AAC/B,QAAI,GAAG,qBAAqB,iBAAkB;AAC9C,QAAI,CAAC,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAG;AAChC,eAAW,KAAK,GAAG,KAAK,IAAI;AAAA,EAC9B;AACA,MAAI,WAAW,WAAW,EAAG;AAE7B,MAAI,WAAyC;AAC7C,aAAW,QAAQ,YAAY;AAC7B,UAAM,MAAM,SAAS,OAAO,IAAI;AAChC,QAAI,CAAC,KAAK;AAKR,cAAQ,OAAO,IAAI;AACnB,YAAM,oBAAoB,SAAS,OAAO,IAAI;AAC9C;AAAA,IACF;AACA,QAAI,aAAa,MAAM;AACrB,OAAC,EAAE,0BAA0B,SAAS,IAAK,MAAM,OAAO,wBAAe;AAAA,IAGzE;AAQA,eAAW,OAAO,IAAI,cAAc;AAElC,YAAO,SAAS,cAAc,GAAG,EAAU,eAAe;AAAA,IAC5D;AACA,UAAM,SAAS,QAAQ,KAAK;AAAA,MAC1B,eAAe,CAAC,MAAM,SAAS,cAAc,CAAC;AAAA,MAC9C,oBAAoB,MAAM,SAAS,mBAAmB;AAAA,MACtD,iBAAiB,MAAM,SAAS,gBAAgB;AAAA,MAChD,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACrD,CAAC;AACD,YAAQ,OAAO,IAAI;AAKnB,UAAM,oBAAoB,SAAS,OAAO,IAAI;AAAA,EAChD;AACF;AAWO,SAAS,aAAa,UAAoC,QAAsB;AACrF,mBAAiB,IAAI,QAAQ,GAAG,OAAO,MAAM;AAC/C;AASA,eAAsB,kBACpB,SACA,OACA,UACA,QACe;AACf,eAAa,UAAU,MAAM;AAC7B,QAAM,oBAAoB,SAAS,OAAO,MAAM;AAClD;","names":[]}