@noy-db/hub 0.4.0-pre.5 → 0.4.0-pre.7

package/dist/{chunk-ILM6X6CP.js → delegation-ONOZVPIP.js}

@@ -1,20 +1,27 @@
 import {
   dekKey
-} from "./chunk-LC7DSMHR.js";
+} from "./chunk-PTHKZWEH.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
   openEnvelopeJson
-} from "./chunk-GEEJPID6.js";
+} from "./chunk-RZPOZPZU.js";
+import "./chunk-VH6SOCXH.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
+import "./chunk-LP7BEXCT.js";
 import {
   encrypt,
   unwrapKey,
   wrapKey
-} from "./chunk-7U6AB7DZ.js";
+} from "./chunk-AKKRXT23.js";
+import "./chunk-GZACYEOB.js";
 import {
   DelegationTargetMissingError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
+import "./chunk-PZ5AY32C.js";
 
 // src/with-party/team/delegation.ts
 var DELEGATIONS_COLLECTION = "_delegations";
@@ -89,11 +96,10 @@ async function loadActiveDelegations(store, vault, user, delegationsDek, now = /
 async function revokeDelegation(store, vault, id) {
   await store.delete(vault, DELEGATIONS_COLLECTION, id);
 }
-
 export {
   DELEGATIONS_COLLECTION,
   issueDelegation,
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=chunk-ILM6X6CP.js.map
+//# sourceMappingURL=delegation-ONOZVPIP.js.map

package/dist/{chunk-ILM6X6CP.js.map → delegation-ONOZVPIP.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-party/team/delegation.ts"],"sourcesContent":["/**\n * Time-boxed cross-tier delegation tokens.\n *\n * A higher-tier user can issue a delegation that grants another user\n * temporary access to records at a specified tier. The delegation is\n * persisted as an encrypted envelope in the reserved `_delegations`\n * collection. The target user's runtime scans this collection on every\n * open and, while `until` is still in the future, merges the\n * unwrapped tier DEKs into their in-memory DEK map.\n *\n * ## Token shape\n *\n * ```\n * {\n *   id,             // ULID, also the _delegations record id\n *   toUser,         // grantee user id\n *   fromUser,       // grantor user id (owner/admin/higher-tier principal)\n *   tier,           // tier being delegated\n *   collection,     // collection name OR null for \"every collection\"\n *   record,         // optional specific record id\n *   until,          // ISO timestamp — token expires at this instant\n *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, wrapped under target KEK\n *   createdAt,      // ISO timestamp\n * }\n * ```\n *\n * The ciphertext is stored as a normal noy-db envelope — the\n * `_delegations` collection has its own DEK shared across all vault\n * users, so an operator can enumerate active delegations for audit\n * without being able to *use* them (the `wrappedDek` inside is still\n * keyed to the target user's KEK).\n *\n * ## Revocation\n *\n * Delete the `_delegations/<id>` envelope. The target user's runtime\n * reloads the delegation list at each open and at periodic intervals\n * (tracked by the caller — this module is pure logic).\n *\n * @module\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { encrypt, openEnvelopeJson, wrapKey, unwrapKey, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { dekKey } from './tiers.js'\nimport { DelegationTargetMissingError } from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\nexport const DELEGATIONS_COLLECTION = '_delegations'\n\n/**\n * Durable payload of a delegation token. Encrypted under the vault's\n * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped\n * under the target user's KEK.\n */\nexport interface DelegationToken {\n  readonly id: string\n  readonly toUser: string\n  readonly fromUser: string\n  readonly tier: number\n  /** Collection name or `null` for all collections. */\n  readonly collection: string | null\n  /** Optional specific record id scope. */\n  readonly record?: string\n  readonly until: string\n  readonly wrappedDek: string\n  readonly createdAt: string\n}\n\nexport interface IssueDelegationOptions {\n  readonly toUser: string\n  readonly tier: number\n  readonly collection?: string\n  readonly record?: string\n  readonly until: Date | string\n}\n\n/**\n * Build and persist a delegation token. The caller must hold a tier-N\n * DEK and must have already located the target user's keyring file\n * (so the `wrappedDek` can be re-wrapped against their KEK).\n */\nexport async function issueDelegation(\n  store: NoydbStore,\n  vault: string,\n  grantor: UnlockedKeyring,\n  targetKek: EnclaveKey | null,\n  delegationsDek: EnclaveKey,\n  opts: IssueDelegationOptions,\n): Promise<DelegationToken> {\n  if (!targetKek) {\n    throw new DelegationTargetMissingError(opts.toUser)\n  }\n  const tier = opts.tier\n  const collectionName = opts.collection ?? null\n  const dekLookupCollection = collectionName ?? ''\n  // Tier DEK to delegate — fetched from the grantor's own keyring.\n  const sourceDek = collectionName\n    ? grantor.deks.get(dekKey(collectionName, tier))\n    : undefined\n  if (!sourceDek) {\n    throw new DelegationTargetMissingError(\n      `grantor cannot find tier ${tier} DEK for ${dekLookupCollection || '(any)'}`,\n    )\n  }\n  const wrappedDek = await wrapKey(sourceDek, targetKek)\n\n  const until = typeof opts.until === 'string' ? opts.until : opts.until.toISOString()\n  const token: DelegationToken = {\n    id: generateULID(),\n    toUser: opts.toUser,\n    fromUser: grantor.userId,\n    tier,\n    collection: collectionName,\n    ...(opts.record && { record: opts.record }),\n    until,\n    wrappedDek,\n    createdAt: new Date().toISOString(),\n  }\n\n  const plaintext = JSON.stringify(token)\n  const { iv, data } = await encrypt(plaintext, delegationsDek)\n  const envelope: EncryptedEnvelope = {\n    _noydb: 1,\n    _v: 1,\n    _ts: token.createdAt,\n    _iv: iv,\n    _data: data,\n    _by: grantor.userId,\n  }\n  await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope)\n  return token\n}\n\n/**\n * Enumerate every live (non-expired) delegation addressed to `toUser`\n * and merge the unwrapped tier DEKs into their keyring. Returns the\n * list of merged delegations so the caller can register per-access\n * audit context.\n */\nexport async function loadActiveDelegations(\n  store: NoydbStore,\n  vault: string,\n  user: UnlockedKeyring,\n  delegationsDek: EnclaveKey,\n  now: Date = new Date(),\n): Promise<DelegationToken[]> {\n  const ids = await store.list(vault, DELEGATIONS_COLLECTION)\n  const merged: DelegationToken[] = []\n  const nowIso = now.toISOString()\n  for (const id of ids) {\n    const env = await store.get(vault, DELEGATIONS_COLLECTION, id)\n    if (!env) continue\n    let token: DelegationToken\n    try {\n      const plaintext = await openEnvelopeJson(env, delegationsDek)\n      token = JSON.parse(plaintext) as DelegationToken\n    } catch {\n      continue\n    }\n    if (token.toUser !== user.userId) continue\n    if (token.until <= nowIso) continue\n\n    // A user without a KEK in memory (tier-3 PIN resume, wrap-DEKs\n    // tier-2 unlock, session restore) cannot unwrap delegation tokens\n    // — those were wrapped under the user's KEK at issue time. Skip\n    // this token; the consumer reaches it again at tier-1 unlock.\n    if (!user.kek) continue\n    let dek: EnclaveKey\n    try {\n      dek = await unwrapKey(token.wrappedDek, user.kek)\n    } catch {\n      continue\n    }\n    const k = token.collection\n      ? dekKey(token.collection, token.tier)\n      : `__any#${token.tier}`\n    user.deks.set(k, dek)\n    merged.push(token)\n  }\n  return merged\n}\n\n/**\n * Revoke a delegation by id — the caller resolves the envelope and\n * issues a `delete`. Provided as a stable helper so the naming is\n * symmetric to `issueDelegation`.\n */\nexport async function revokeDelegation(\n  store: NoydbStore,\n  vault: string,\n  id: string,\n): Promise<void> {\n  await store.delete(vault, DELEGATIONS_COLLECTION, id)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgDO,IAAM,yBAAyB;AAkCtC,eAAsB,gBACpB,OACA,OACA,SACA,WACA,gBACA,MAC0B;AAC1B,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,6BAA6B,KAAK,MAAM;AAAA,EACpD;AACA,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,KAAK,cAAc;AAC1C,QAAM,sBAAsB,kBAAkB;AAE9C,QAAM,YAAY,iBACd,QAAQ,KAAK,IAAI,OAAO,gBAAgB,IAAI,CAAC,IAC7C;AACJ,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,4BAA4B,IAAI,YAAY,uBAAuB,OAAO;AAAA,IAC5E;AAAA,EACF;AACA,QAAM,aAAa,MAAM,QAAQ,WAAW,SAAS;AAErD,QAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;AACnF,QAAM,QAAyB;AAAA,IAC7B,IAAI,aAAa;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,IACZ,GAAI,KAAK,UAAU,EAAE,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,IACA;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,YAAY,KAAK,UAAU,KAAK;AACtC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,cAAc;AAC5D,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,KAAK,MAAM;AAAA,IACX,KAAK;AAAA,IACL,OAAO;AAAA,IACP,KAAK,QAAQ;AAAA,EACf;AACA,QAAM,MAAM,IAAI,OAAO,wBAAwB,MAAM,IAAI,QAAQ;AACjE,SAAO;AACT;AAQA,eAAsB,sBACpB,OACA,OACA,MACA,gBACA,MAAY,oBAAI,KAAK,GACO;AAC5B,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,sBAAsB;AAC1D,QAAM,SAA4B,CAAC;AACnC,QAAM,SAAS,IAAI,YAAY;AAC/B,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,EAAE;AAC7D,QAAI,CAAC,IAAK;AACV,QAAI;AACJ,QAAI;AACF,YAAM,YAAY,MAAM,iBAAiB,KAAK,cAAc;AAC5D,cAAQ,KAAK,MAAM,SAAS;AAAA,IAC9B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,MAAM,WAAW,KAAK,OAAQ;AAClC,QAAI,MAAM,SAAS,OAAQ;AAM3B,QAAI,CAAC,KAAK,IAAK;AACf,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,UAAU,MAAM,YAAY,KAAK,GAAG;AAAA,IAClD,QAAQ;AACN;AAAA,IACF;AACA,UAAM,IAAI,MAAM,aACZ,OAAO,MAAM,YAAY,MAAM,IAAI,IACnC,SAAS,MAAM,IAAI;AACvB,SAAK,KAAK,IAAI,GAAG,GAAG;AACpB,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,SAAO;AACT;AAOA,eAAsB,iBACpB,OACA,OACA,IACe;AACf,QAAM,MAAM,OAAO,OAAO,wBAAwB,EAAE;AACtD;","names":[]}
+{"version":3,"sources":["../src/with-party/team/delegation.ts"],"sourcesContent":["/**\n * Time-boxed cross-tier delegation tokens.\n *\n * A higher-tier user can issue a delegation that grants another user\n * temporary access to records at a specified tier. The delegation is\n * persisted as an encrypted envelope in the reserved `_delegations`\n * collection. The target user's runtime scans this collection on every\n * open and, while `until` is still in the future, merges the\n * unwrapped tier DEKs into their in-memory DEK map.\n *\n * ## Token shape\n *\n * ```\n * {\n *   id,             // ULID, also the _delegations record id\n *   toUser,         // grantee user id\n *   fromUser,       // grantor user id (owner/admin/higher-tier principal)\n *   tier,           // tier being delegated\n *   collection,     // collection name OR null for \"every collection\"\n *   record,         // optional specific record id\n *   until,          // ISO timestamp — token expires at this instant\n *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, wrapped under target KEK\n *   createdAt,      // ISO timestamp\n * }\n * ```\n *\n * The ciphertext is stored as a normal noy-db envelope — the\n * `_delegations` collection has its own DEK shared across all vault\n * users, so an operator can enumerate active delegations for audit\n * without being able to *use* them (the `wrappedDek` inside is still\n * keyed to the target user's KEK).\n *\n * ## Revocation\n *\n * Delete the `_delegations/<id>` envelope. The target user's runtime\n * reloads the delegation list at each open and at periodic intervals\n * (tracked by the caller — this module is pure logic).\n *\n * @module\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { encrypt, openEnvelopeJson, wrapKey, unwrapKey, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { dekKey } from './tiers.js'\nimport { DelegationTargetMissingError } from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\nexport const DELEGATIONS_COLLECTION = '_delegations'\n\n/**\n * Durable payload of a delegation token. Encrypted under the vault's\n * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped\n * under the target user's KEK.\n */\nexport interface DelegationToken {\n  readonly id: string\n  readonly toUser: string\n  readonly fromUser: string\n  readonly tier: number\n  /** Collection name or `null` for all collections. */\n  readonly collection: string | null\n  /** Optional specific record id scope. */\n  readonly record?: string\n  readonly until: string\n  readonly wrappedDek: string\n  readonly createdAt: string\n}\n\nexport interface IssueDelegationOptions {\n  readonly toUser: string\n  readonly tier: number\n  readonly collection?: string\n  readonly record?: string\n  readonly until: Date | string\n}\n\n/**\n * Build and persist a delegation token. The caller must hold a tier-N\n * DEK and must have already located the target user's keyring file\n * (so the `wrappedDek` can be re-wrapped against their KEK).\n */\nexport async function issueDelegation(\n  store: NoydbStore,\n  vault: string,\n  grantor: UnlockedKeyring,\n  targetKek: EnclaveKey | null,\n  delegationsDek: EnclaveKey,\n  opts: IssueDelegationOptions,\n): Promise<DelegationToken> {\n  if (!targetKek) {\n    throw new DelegationTargetMissingError(opts.toUser)\n  }\n  const tier = opts.tier\n  const collectionName = opts.collection ?? null\n  const dekLookupCollection = collectionName ?? ''\n  // Tier DEK to delegate — fetched from the grantor's own keyring.\n  const sourceDek = collectionName\n    ? grantor.deks.get(dekKey(collectionName, tier))\n    : undefined\n  if (!sourceDek) {\n    throw new DelegationTargetMissingError(\n      `grantor cannot find tier ${tier} DEK for ${dekLookupCollection || '(any)'}`,\n    )\n  }\n  const wrappedDek = await wrapKey(sourceDek, targetKek)\n\n  const until = typeof opts.until === 'string' ? opts.until : opts.until.toISOString()\n  const token: DelegationToken = {\n    id: generateULID(),\n    toUser: opts.toUser,\n    fromUser: grantor.userId,\n    tier,\n    collection: collectionName,\n    ...(opts.record && { record: opts.record }),\n    until,\n    wrappedDek,\n    createdAt: new Date().toISOString(),\n  }\n\n  const plaintext = JSON.stringify(token)\n  const { iv, data } = await encrypt(plaintext, delegationsDek)\n  const envelope: EncryptedEnvelope = {\n    _noydb: 1,\n    _v: 1,\n    _ts: token.createdAt,\n    _iv: iv,\n    _data: data,\n    _by: grantor.userId,\n  }\n  await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope)\n  return token\n}\n\n/**\n * Enumerate every live (non-expired) delegation addressed to `toUser`\n * and merge the unwrapped tier DEKs into their keyring. Returns the\n * list of merged delegations so the caller can register per-access\n * audit context.\n */\nexport async function loadActiveDelegations(\n  store: NoydbStore,\n  vault: string,\n  user: UnlockedKeyring,\n  delegationsDek: EnclaveKey,\n  now: Date = new Date(),\n): Promise<DelegationToken[]> {\n  const ids = await store.list(vault, DELEGATIONS_COLLECTION)\n  const merged: DelegationToken[] = []\n  const nowIso = now.toISOString()\n  for (const id of ids) {\n    const env = await store.get(vault, DELEGATIONS_COLLECTION, id)\n    if (!env) continue\n    let token: DelegationToken\n    try {\n      const plaintext = await openEnvelopeJson(env, delegationsDek)\n      token = JSON.parse(plaintext) as DelegationToken\n    } catch {\n      continue\n    }\n    if (token.toUser !== user.userId) continue\n    if (token.until <= nowIso) continue\n\n    // A user without a KEK in memory (tier-3 PIN resume, wrap-DEKs\n    // tier-2 unlock, session restore) cannot unwrap delegation tokens\n    // — those were wrapped under the user's KEK at issue time. Skip\n    // this token; the consumer reaches it again at tier-1 unlock.\n    if (!user.kek) continue\n    let dek: EnclaveKey\n    try {\n      dek = await unwrapKey(token.wrappedDek, user.kek)\n    } catch {\n      continue\n    }\n    const k = token.collection\n      ? dekKey(token.collection, token.tier)\n      : `__any#${token.tier}`\n    user.deks.set(k, dek)\n    merged.push(token)\n  }\n  return merged\n}\n\n/**\n * Revoke a delegation by id — the caller resolves the envelope and\n * issues a `delete`. Provided as a stable helper so the naming is\n * symmetric to `issueDelegation`.\n */\nexport async function revokeDelegation(\n  store: NoydbStore,\n  vault: string,\n  id: string,\n): Promise<void> {\n  await store.delete(vault, DELEGATIONS_COLLECTION, id)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAgDO,IAAM,yBAAyB;AAkCtC,eAAsB,gBACpB,OACA,OACA,SACA,WACA,gBACA,MAC0B;AAC1B,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,6BAA6B,KAAK,MAAM;AAAA,EACpD;AACA,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,KAAK,cAAc;AAC1C,QAAM,sBAAsB,kBAAkB;AAE9C,QAAM,YAAY,iBACd,QAAQ,KAAK,IAAI,OAAO,gBAAgB,IAAI,CAAC,IAC7C;AACJ,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,4BAA4B,IAAI,YAAY,uBAAuB,OAAO;AAAA,IAC5E;AAAA,EACF;AACA,QAAM,aAAa,MAAM,QAAQ,WAAW,SAAS;AAErD,QAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;AACnF,QAAM,QAAyB;AAAA,IAC7B,IAAI,aAAa;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,IACZ,GAAI,KAAK,UAAU,EAAE,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,IACA;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,YAAY,KAAK,UAAU,KAAK;AACtC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,cAAc;AAC5D,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,KAAK,MAAM;AAAA,IACX,KAAK;AAAA,IACL,OAAO;AAAA,IACP,KAAK,QAAQ;AAAA,EACf;AACA,QAAM,MAAM,IAAI,OAAO,wBAAwB,MAAM,IAAI,QAAQ;AACjE,SAAO;AACT;AAQA,eAAsB,sBACpB,OACA,OACA,MACA,gBACA,MAAY,oBAAI,KAAK,GACO;AAC5B,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,sBAAsB;AAC1D,QAAM,SAA4B,CAAC;AACnC,QAAM,SAAS,IAAI,YAAY;AAC/B,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,EAAE;AAC7D,QAAI,CAAC,IAAK;AACV,QAAI;AACJ,QAAI;AACF,YAAM,YAAY,MAAM,iBAAiB,KAAK,cAAc;AAC5D,cAAQ,KAAK,MAAM,SAAS;AAAA,IAC9B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,MAAM,WAAW,KAAK,OAAQ;AAClC,QAAI,MAAM,SAAS,OAAQ;AAM3B,QAAI,CAAC,KAAK,IAAK;AACf,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,UAAU,MAAM,YAAY,KAAK,GAAG;AAAA,IAClD,QAAQ;AACN;AAAA,IACF;AACA,UAAM,IAAI,MAAM,aACZ,OAAO,MAAM,YAAY,MAAM,IAAI,IACnC,SAAS,MAAM,IAAI;AACvB,SAAK,KAAK,IAAI,GAAG,GAAG;AACpB,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,SAAO;AACT;AAOA,eAAsB,iBACpB,OACA,OACA,IACe;AACf,QAAM,MAAM,OAAO,OAAO,wBAAwB,EAAE;AACtD;","names":[]}

package/dist/derivations/index.js

@@ -1,29 +1,29 @@
 import {
   withDerivation,
   withRollup
-} from "../chunk-GHEMAVTN.js";
+} from "../chunk-NYEFP7DY.js";
 import {
   DerivationRegistry
-} from "../chunk-2PDBYF2O.js";
-import "../chunk-Z4D3YGAB.js";
+} from "../chunk-AT2JJEKJ.js";
+import "../chunk-4ZKNC6A6.js";
 import {
   DerivationExecutor
-} from "../chunk-YJ3TREAC.js";
-import "../chunk-GEEJPID6.js";
-import "../chunk-SC4JLMZI.js";
-import "../chunk-5WLDZZ6S.js";
-import "../chunk-5HSSTOOG.js";
-import "../chunk-G4MFQXYX.js";
+} from "../chunk-MHMLXJ3I.js";
+import "../chunk-RZPOZPZU.js";
+import "../chunk-VH6SOCXH.js";
+import "../chunk-35NMVJ7I.js";
+import "../chunk-NFZGZ4AK.js";
+import "../chunk-QJNCB5SK.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-7U6AB7DZ.js";
-import "../chunk-YTW6ZIPD.js";
+import "../chunk-AKKRXT23.js";
+import "../chunk-GZACYEOB.js";
 import {
   DerivationCapExceededError,
   DerivationCycleError,
   DerivationDepthError,
   DerivationOutputShapeError,
   DerivationOutputUnknownError
-} from "../chunk-6SYOHUHM.js";
+} from "../chunk-QZWTRENR.js";
 import "../chunk-PZ5AY32C.js";
 export {
   DerivationCapExceededError,

package/dist/derive-IGGVSUPH.js

@@ -0,0 +1,22 @@
+import {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+} from "./chunk-6ZNSB3H6.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-RZPOZPZU.js";
+import "./chunk-VH6SOCXH.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AKKRXT23.js";
+import "./chunk-GZACYEOB.js";
+import "./chunk-QZWTRENR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  derivePersistedSchema,
+  isZod4Schema,
+  isZodSchema
+};
+//# sourceMappingURL=derive-IGGVSUPH.js.map

package/dist/directory/index.js

@@ -0,0 +1,46 @@
+import "../chunk-GJW4HX2O.js";
+import {
+  UserApi
+} from "../chunk-3XKESW5E.js";
+import {
+  DIRECTORY_RECORD_ID,
+  META_COLLECTION,
+  VISIBILITY_RECORD_PREFIX,
+  deleteUserEnvelope,
+  deleteUserVisibility,
+  listUserEnvelopeIds,
+  loadUserEnvelope,
+  persistDirectoryConfig,
+  persistUserVisibility,
+  readDirectoryConfig,
+  readUserVisibility,
+  saveUserEnvelope,
+  visibilityRecordId
+} from "../chunk-WZ3NCMK6.js";
+import "../chunk-RZPOZPZU.js";
+import "../chunk-VH6SOCXH.js";
+import "../chunk-35NMVJ7I.js";
+import "../chunk-NFZGZ4AK.js";
+import "../chunk-QJNCB5SK.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-AKKRXT23.js";
+import "../chunk-GZACYEOB.js";
+import "../chunk-QZWTRENR.js";
+import "../chunk-PZ5AY32C.js";
+export {
+  DIRECTORY_RECORD_ID,
+  META_COLLECTION,
+  UserApi,
+  VISIBILITY_RECORD_PREFIX,
+  deleteUserEnvelope,
+  deleteUserVisibility,
+  listUserEnvelopeIds,
+  loadUserEnvelope,
+  persistDirectoryConfig,
+  persistUserVisibility,
+  readDirectoryConfig,
+  readUserVisibility,
+  saveUserEnvelope,
+  visibilityRecordId
+};
+//# sourceMappingURL=index.js.map

package/dist/{dispatch-PKQQFDBT.js → dispatch-7T45NN7C.js}

@@ -1,25 +1,26 @@
 import {
   markStale
-} from "./chunk-XUFAFHQM.js";
+} from "./chunk-NJ4DYYO5.js";
 import {
   putDerivedOutput,
   selfWriteFieldEqual
-} from "./chunk-7BIJS6II.js";
-import "./chunk-K7BADAOS.js";
-import "./chunk-JN3SGXJE.js";
-import "./chunk-ZUDAK436.js";
-import "./chunk-RWW3I3PO.js";
-import "./chunk-GEEJPID6.js";
-import "./chunk-SC4JLMZI.js";
-import "./chunk-5WLDZZ6S.js";
-import "./chunk-5HSSTOOG.js";
-import "./chunk-G4MFQXYX.js";
+} from "./chunk-GP3UWP22.js";
+import "./chunk-5D2ALSM5.js";
+import "./chunk-NEX7JCMO.js";
+import "./chunk-UADPR6F4.js";
+import "./chunk-6UBZ6I5Z.js";
+import "./chunk-ISRKW4YN.js";
+import "./chunk-RZPOZPZU.js";
+import "./chunk-VH6SOCXH.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-7U6AB7DZ.js";
-import "./chunk-YTW6ZIPD.js";
+import "./chunk-AKKRXT23.js";
+import "./chunk-GZACYEOB.js";
 import {
   DerivationCapExceededError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-formula/derivations/dispatch.ts
@@ -27,7 +28,7 @@ async function dispatchArrayDerivationsOnDelete(ctx, id, eraseRecordShapeToo = f
   const { derivationSource, collectionName, adapter, vault, getDEK, storeCiphertext } = ctx;
   const strategies = derivationSource.registry().strategiesForSource(collectionName);
   if (strategies.length === 0) return 0;
-  const { loadFanoutSidecar, deleteFanoutSidecar } = await import("./fanout-sidecar-WWXVHHUH.js");
+  const { loadFanoutSidecar, deleteFanoutSidecar } = await import("./fanout-sidecar-TV7CXAJ6.js");
   const txCtx = derivationSource.getActiveTxContext();
   let erased = 0;
   for (const { spec } of strategies) {
@@ -113,7 +114,7 @@ async function dispatchDerivations(ctx, id, record, version, wave) {
     }
     if (executorClass === null) {
       ;
-      ({ DerivationExecutor: executorClass } = await import("./executor-FCJEH3FU.js"));
+      ({ DerivationExecutor: executorClass } = await import("./executor-IEBLTBCW.js"));
     }
     for (const run of runs) {
       const ctx2 = { vault: derivationSource.getReadOnlyFacade() };
@@ -133,7 +134,7 @@ async function dispatchDerivations(ctx, id, record, version, wave) {
         const outputCollection = derivationSource.getCollection(outSpec.collection);
         const txCtx = derivationSource.getActiveTxContext();
         if (out.kind === "array") {
-          const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-WWXVHHUH.js");
+          const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-TV7CXAJ6.js");
           const prior = await loadFanoutSidecar(adapter, vault, spec.source, run.runId, key, getDEK, storeCiphertext);
           const prevKeys = new Set(prior?.keys ?? []);
           const newKeysList = out.entries.map((e) => e.key);
@@ -190,4 +191,4 @@ export {
   dispatchArrayDerivationsOnDelete,
   dispatchDerivations
 };
-//# sourceMappingURL=dispatch-PKQQFDBT.js.map
+//# sourceMappingURL=dispatch-7T45NN7C.js.map

package/dist/{dispatch-PKQQFDBT.js.map → dispatch-7T45NN7C.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-formula/derivations/dispatch.ts"],"sourcesContent":["/**\n * Derivation dispatch, lifted out of the kernel spine (#842 part b).\n *\n * `Collection` carried ~380 lines of dispatch logic that belongs to the\n * derivation service, not to the always-on kernel. These are free functions\n * taking an explicit context so the spine keeps only a thin delegator.\n *\n * ## How the spine reaches this module\n *\n * By dynamic `import()`, never a static one. `check-architecture.mjs`'s\n * `port-layering` check forbids the spine from statically importing a\n * `with-*` service; `collection.ts` is grandfathered for ten\n * `with-formula/*` specifiers, but that list is frozen per file and a new\n * one is a violation. A dynamic import is the sanctioned S4 gate recipe, and\n * it keeps this chunk out of the floor bundle for consumers who never fire a\n * derivation.\n *\n * The `Collection` type reference below points back at the spine. That is\n * inward (service → kernel) and so allowed, and it is TYPE-ONLY — erased at\n * build, so no runtime cycle exists.\n *\n * @internal\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { DerivationRegistry } from './registry.js'\nimport type { ReadOnlyVaultFacade } from '../../with-audit/guards/types.js'\nimport type { Collection } from '../../kernel/collection.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport type { ledgerAuditHook, WaveContext } from '../../kernel/via/dispatch.js'\nimport { putDerivedOutput, selfWriteFieldEqual } from '../../kernel/via/dispatch.js'\nimport { DerivationCapExceededError } from '../../kernel/errors.js'\nimport { markStale } from './stale.js'\nimport type { DerivationExecutor } from './executor.js'\n\n/** The per-write dispatch context threaded into `putDerivedOutput`. */\ninterface DispatchCtx {\n  emit: (e: string, p: unknown) => void\n  source: { readonly collection: string; readonly id: string }\n  audit: ReturnType<typeof ledgerAuditHook>\n}\n\n/**\n * What the dispatchers need from the collection that owns them. Passing this\n * explicitly is what lets the logic live outside the class.\n */\nexport interface DerivationDeleteCtx {\n  readonly derivationSource: {\n    registry(): DerivationRegistry\n    getCollection(name: string): Collection<Record<string, unknown>>\n    getActiveTxContext(): TxContext | null\n    getReadOnlyFacade(): ReadOnlyVaultFacade\n  }\n  /** The collection the delete happened in. */\n  readonly collectionName: string\n  readonly adapter: NoydbStore\n  readonly vault: string\n  readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  readonly storeCiphertext: boolean\n}\n\n/**\n * Erase the derived rows a deleted source record fanned out to, and drop the\n * fan-out sidecars that recorded them.\n *\n * @param eraseRecordShapeToo also erase same-id `shape: 'record'` outputs.\n *   Restricted to a source-triggered strategy writing into a DIFFERENT\n *   collection — the self-denorm case would re-delete the record just\n *   tombstoned, and triggerBy/sibling strategies derive under a different id.\n * @returns rows ACTUALLY deleted, not edges visited (#622).\n */\nexport async function dispatchArrayDerivationsOnDelete(\n  ctx: DerivationDeleteCtx,\n  id: string,\n  eraseRecordShapeToo = false,\n): Promise<number> {\n  const { derivationSource, collectionName, adapter, vault, getDEK, storeCiphertext } = ctx\n\n  const strategies = derivationSource.registry().strategiesForSource(collectionName)\n  if (strategies.length === 0) return 0\n\n  const { loadFanoutSidecar, deleteFanoutSidecar } = await import('./fanout-sidecar.js')\n  const txCtx = derivationSource.getActiveTxContext()\n  let erased = 0\n\n  for (const { spec } of strategies) {\n    for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {\n      if (outSpec.shape === 'record') {\n        if (eraseRecordShapeToo && spec.source === collectionName && outSpec.collection !== collectionName) {\n          if (await derivationSource.getCollection(outSpec.collection)._internalDelete(id, txCtx)) erased += 1\n        }\n        continue\n      }\n\n      const sidecar = await loadFanoutSidecar(adapter, vault, spec.source, id, outputKey, getDEK, storeCiphertext)\n      if (!sidecar) continue\n\n      const outputCollection = derivationSource.getCollection(outSpec.collection)\n      for (const derivedId of sidecar.keys) {\n        if (await outputCollection._internalDelete(derivedId, txCtx)) erased += 1\n      }\n      await deleteFanoutSidecar(adapter, vault, spec.source, id, outputKey)\n    }\n  }\n\n  return erased\n}\n\n/** Adds what the on-write derivation dispatch needs beyond the delete path. */\nexport interface DerivationDispatchCtx extends DerivationDeleteCtx {\n  /** Via pipeline, for decoding the stored form back to canonical money shape. */\n  readonly via: { canonicalizeStored(r: Record<string, unknown>): Record<string, unknown> } | undefined\n  /** Recompute a rollup aggregate onto a parent. Stays on the spine — it walks collections. */\n  readonly recomputeRollup: (\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    spec: any,\n    parentId: string,\n    source: { readonly collection: string; readonly id: string },\n    wave?: WaveContext,\n  ) => Promise<unknown>\n  /** Builds the per-write dispatch context threaded into `putDerivedOutput`. */\n  readonly dispatchCtx: (source: { readonly collection: string; readonly id: string }) => DispatchCtx\n  /** Registers a write on the active transaction for rollback. */\n  readonly trackPut: (txCtx: TxContext, collectionName: string, id: string, priorEnvelope: EncryptedEnvelope | null) => void\n}\n\n/**\n * Fire registered derivation strategies for this source collection.\n *\n * Eager mode runs `derive` inline and writes each output; lazy mode records a\n * stale mark for cold-session recompute. Rollups are handled here rather than\n * by the executor — a write to the child recomputes the parent aggregate, and\n * a write to the parent recomputes its own.\n */\nexport async function dispatchDerivations(\n  ctx: DerivationDispatchCtx,\n  id: string,\n  record: Record<string, unknown>,\n  version: number,\n  wave?: WaveContext,\n): Promise<void> {\n  const {\n    derivationSource, collectionName, adapter, vault, getDEK, storeCiphertext,\n    via, recomputeRollup, dispatchCtx, trackPut,\n  } = ctx\n\n  // `record` is the stored form here (post-quantize) — decode so\n  // derive(source, ctx) sees the canonical money shape.\n  const incoming = (via ? via.canonicalizeStored(record) : record)\n  if (incoming && typeof incoming === 'object' && '_derivedFrom' in incoming) return\n  const registry = derivationSource.registry()\n  const strategies = registry.strategiesForSource(collectionName)\n  if (strategies.length === 0) return\n  // Dynamic-import the executor only on the first eager-mode\n  // dispatch. Lazy-mode dispatches use `markStale` (a pure helper)\n  // which doesn't reach into the executor at all. Keeps the\n  // derivation executor chunk out of the floor bundle for any\n  // consumer that doesn't fire an eager derivation.\n  let executorClass: typeof DerivationExecutor | null = null\n  for (const { spec, strategyHash } of strategies) {\n    const mode = typeof spec.lifecycle === 'string' ? spec.lifecycle : spec.lifecycle.mode\n\n    // Rollup: a write to the child `from` recomputes the\n    // parent at id child[key]; a write to the parent (source = into)\n    // recomputes its own aggregate. Handled here (the executor is not run).\n    if (spec.rollup) {\n      if (mode !== 'eager') continue\n      let parentId: string | null\n      if (collectionName === spec.rollup.from) {\n        const kv = incoming[spec.rollup.key]\n        parentId = (typeof kv === 'string' || typeof kv === 'number') ? String(kv) : null\n      } else {\n        parentId = id // a write to the parent recomputes its own aggregate\n      }\n      if (parentId !== null) await recomputeRollup(spec, parentId, { collection: collectionName, id }, wave)\n      continue\n    }\n\n    // Determine how `collectionName` triggers this strategy, and build the list\n    // of source records to (re-)derive:\n    //   • source     — re-derive the written record itself (same-id).\n    //   • sources[]  — re-derive the PRIMARY source at the same id.\n    //   • triggerBy  — FK fan-out: re-derive every source record\n    //                  whose `on` field equals the written parent's id.\n    // `input` is passed to derive(); `base` is the raw stored source record\n    // used as the patch base for a self-write reverse-denorm output.\n    const isSource = spec.source === collectionName\n    const isSibling = !isSource && (spec.sources?.includes(collectionName) ?? false)\n    const trigger = !isSource && !isSibling\n      ? spec.triggerBy?.find(t => t.collection === collectionName)\n      : undefined\n\n    const runs: Array<{\n      input: Record<string, unknown> & { id: string }\n      base: Record<string, unknown>\n      runId: string\n      version: number\n    }> = []\n\n    if (isSource) {\n      runs.push({ input: { ...incoming, id }, base: incoming, runId: id, version })\n    } else if (isSibling) {\n      const p = await derivationSource.getCollection(spec.source).get(id)\n      if (p !== null && p !== undefined) {\n        // Raw base for a (rare) sibling self-write; falls back to the\n        // resolved primary if the raw read misses.\n        const raw = await derivationSource.getCollection(spec.source)._getStoredRecord(id)\n        runs.push({ input: { ...p, id }, base: raw ?? p, runId: id, version: 0 })\n      }\n    } else if (trigger) {\n      const srcColl = derivationSource.getCollection(spec.source)\n      const ids = await srcColl._findMatchingIds(trigger.on, id)\n      if (trigger.maxFanout !== undefined && ids.length > trigger.maxFanout) {\n        throw new DerivationCapExceededError(`triggerBy ${collectionName}→${spec.source}`, ids.length, trigger.maxFanout)\n      }\n      for (const sid of ids) {\n        const raw = await srcColl._getStoredRecord(sid)\n        if (raw === null) continue\n        runs.push({ input: { ...raw, id: sid }, base: raw, runId: sid, version: 0 })\n      }\n    }\n\n    if (runs.length === 0) continue\n\n    if (mode !== 'eager') {\n      for (const run of runs) await markStale(registry, spec, run.runId)\n      continue\n    }\n\n    if (executorClass === null) {\n      ;({ DerivationExecutor: executorClass } = await import('./executor.js'))\n    }\n\n    for (const run of runs) {\n      const ctx = { vault: derivationSource.getReadOnlyFacade() }\n      const outCtx = dispatchCtx({ collection: spec.source, id: run.runId })\n      const result = await executorClass.run(spec, run.input, run.version, strategyHash, ctx)\n      for (const key of Object.keys(spec.outputs)) {\n        const out = result.outputs[key]\n        if (!out) continue\n        if (out.kind === 'failed') {\n          const err = out.error\n          if (spec.strict) throw err\n          console.warn(`[derivation] output \"${key}\" for source \"${spec.source}\" id=\"${run.runId}\" failed:`, err)\n          continue\n        }\n        const outSpec = spec.outputs[key]\n        if (!outSpec) continue\n        const outputCollection = derivationSource.getCollection(outSpec.collection)\n        // If we're inside a multi-record transaction, register\n        // derived writes as side-effect ops on the active ctx\n        // BEFORE they fire. `revertExecuted` walks `_executed` in\n        // reverse on rollback, so capturing the pre-write envelope\n        // here lets a later mid-batch failure restore this output's\n        // prior state alongside the source op. Outside a transaction\n        // the context is null and tracking is skipped.\n        const txCtx = derivationSource.getActiveTxContext()\n\n        // ── Array-shape branch ─────────────────────────────────\n        if (out.kind === 'array') {\n          // Load the prior key set from the fanout sidecar.\n          const { loadFanoutSidecar, saveFanoutSidecar } = await import('./fanout-sidecar.js')\n          const prior = await loadFanoutSidecar(adapter, vault, spec.source, run.runId, key, getDEK, storeCiphertext)\n          const prevKeys = new Set<string>(prior?.keys ?? [])\n          const newKeysList = out.entries.map(e => e.key)\n          const newKeysSet = new Set<string>(newKeysList)\n\n          // Diff — delete keys that were in prev but not in new.\n          for (const k of prevKeys) {\n            if (newKeysSet.has(k)) continue\n            await outputCollection._internalDelete(k, txCtx)\n          }\n\n          // Upsert every entry in the new set. (Slice 1: no\n          // identity-skip optimisation; write every row, idempotent\n          // at the (collection, id) level.)\n          for (const entry of out.entries) {\n            if (txCtx !== null) {\n              trackPut(txCtx, outSpec.collection, entry.key, await adapter.get(vault, outSpec.collection, entry.key))\n            }\n            await putDerivedOutput(outputCollection, entry.key, entry.value, outCtx, { source: 'derived' })\n          }\n\n          // Persist the new key set last, for failure-mode symmetry.\n          await saveFanoutSidecar(adapter, vault, {\n            source: spec.source,\n            sourceId: run.runId,\n            outputKey: key,\n            outputCollection: outSpec.collection,\n            keys: newKeysList,\n          }, getDEK, storeCiphertext)\n          continue\n        }\n\n        // ── Record-shape branch ────────────────────────────────\n        if (out.skipped === true) {\n          // Optional output returned null. Delete the\n          // previously-emitted output at this id, if any. Routed\n          // through `_internalDelete` so a user-registered\n          // `onDelete` on the output collection does NOT\n          // fire — this is a system-internal tombstone, not a\n          // user-initiated delete. The txCtx hookup captures the\n          // prior envelope inside `_internalDelete` for rollback\n          // symmetry; delete-of-absent is a silent no-op.\n          await outputCollection._internalDelete(run.runId, txCtx)\n          continue\n        }\n\n        // ── Self-write reverse-denorm ───────────────────────────\n        // An output back to its own source: patch ONLY the declared\n        // `denorm` fields onto the raw stored record, never the whole\n        // value (which would clobber user fields / i18n maps and carries\n        // the executor's `_derivedFrom` tag). If the patch changes\n        // nothing, skip the write — that value-equality is the cycle\n        // guard: the self-write re-fires the source-path derivation,\n        // which recomputes identical fields and terminates here.\n        if (outSpec.shape === 'record' && outSpec.denorm !== undefined && outSpec.collection === spec.source) {\n          const value = out.value\n          const patched: Record<string, unknown> = { ...run.base }\n          let changed = false\n          for (const f of outSpec.denorm) {\n            if (!selfWriteFieldEqual(run.base[f], value[f])) {\n              patched[f] = value[f]\n              changed = true\n            }\n          }\n          if (!changed) continue // cycle guard — nothing to write\n          if (txCtx !== null) {\n            trackPut(txCtx, outSpec.collection, run.runId, await adapter.get(vault, outSpec.collection, run.runId))\n          }\n          await putDerivedOutput(outputCollection, run.runId, patched, outCtx, { source: 'derived' })\n          continue\n        }\n\n        // ── Normal record output (separate output collection) ──\n        if (txCtx !== null) {\n          trackPut(txCtx, outSpec.collection, run.runId, await adapter.get(vault, outSpec.collection, run.runId))\n        }\n        await putDerivedOutput(outputCollection, run.runId, out.value, outCtx, { source: 'derived' })\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyEA,eAAsB,iCACpB,KACA,IACA,sBAAsB,OACL;AACjB,QAAM,EAAE,kBAAkB,gBAAgB,SAAS,OAAO,QAAQ,gBAAgB,IAAI;AAEtF,QAAM,aAAa,iBAAiB,SAAS,EAAE,oBAAoB,cAAc;AACjF,MAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,QAAM,EAAE,mBAAmB,oBAAoB,IAAI,MAAM,OAAO,8BAAqB;AACrF,QAAM,QAAQ,iBAAiB,mBAAmB;AAClD,MAAI,SAAS;AAEb,aAAW,EAAE,KAAK,KAAK,YAAY;AACjC,eAAW,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAC/D,UAAI,QAAQ,UAAU,UAAU;AAC9B,YAAI,uBAAuB,KAAK,WAAW,kBAAkB,QAAQ,eAAe,gBAAgB;AAClG,cAAI,MAAM,iBAAiB,cAAc,QAAQ,UAAU,EAAE,gBAAgB,IAAI,KAAK,EAAG,WAAU;AAAA,QACrG;AACA;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,kBAAkB,SAAS,OAAO,KAAK,QAAQ,IAAI,WAAW,QAAQ,eAAe;AAC3G,UAAI,CAAC,QAAS;AAEd,YAAM,mBAAmB,iBAAiB,cAAc,QAAQ,UAAU;AAC1E,iBAAW,aAAa,QAAQ,MAAM;AACpC,YAAI,MAAM,iBAAiB,gBAAgB,WAAW,KAAK,EAAG,WAAU;AAAA,MAC1E;AACA,YAAM,oBAAoB,SAAS,OAAO,KAAK,QAAQ,IAAI,SAAS;AAAA,IACtE;AAAA,EACF;AAEA,SAAO;AACT;AA4BA,eAAsB,oBACpB,KACA,IACA,QACA,SACA,MACe;AACf,QAAM;AAAA,IACJ;AAAA,IAAkB;AAAA,IAAgB;AAAA,IAAS;AAAA,IAAO;AAAA,IAAQ;AAAA,IAC1D;AAAA,IAAK;AAAA,IAAiB;AAAA,IAAa;AAAA,EACrC,IAAI;AAIJ,QAAM,WAAY,MAAM,IAAI,mBAAmB,MAAM,IAAI;AACzD,MAAI,YAAY,OAAO,aAAa,YAAY,kBAAkB,SAAU;AAC5E,QAAM,WAAW,iBAAiB,SAAS;AAC3C,QAAM,aAAa,SAAS,oBAAoB,cAAc;AAC9D,MAAI,WAAW,WAAW,EAAG;AAM7B,MAAI,gBAAkD;AACtD,aAAW,EAAE,MAAM,aAAa,KAAK,YAAY;AAC/C,UAAM,OAAO,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAK,UAAU;AAKlF,QAAI,KAAK,QAAQ;AACf,UAAI,SAAS,QAAS;AACtB,UAAI;AACJ,UAAI,mBAAmB,KAAK,OAAO,MAAM;AACvC,cAAM,KAAK,SAAS,KAAK,OAAO,GAAG;AACnC,mBAAY,OAAO,OAAO,YAAY,OAAO,OAAO,WAAY,OAAO,EAAE,IAAI;AAAA,MAC/E,OAAO;AACL,mBAAW;AAAA,MACb;AACA,UAAI,aAAa,KAAM,OAAM,gBAAgB,MAAM,UAAU,EAAE,YAAY,gBAAgB,GAAG,GAAG,IAAI;AACrG;AAAA,IACF;AAUA,UAAM,WAAW,KAAK,WAAW;AACjC,UAAM,YAAY,CAAC,aAAa,KAAK,SAAS,SAAS,cAAc,KAAK;AAC1E,UAAM,UAAU,CAAC,YAAY,CAAC,YAC1B,KAAK,WAAW,KAAK,OAAK,EAAE,eAAe,cAAc,IACzD;AAEJ,UAAM,OAKD,CAAC;AAEN,QAAI,UAAU;AACZ,WAAK,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,GAAG,GAAG,MAAM,UAAU,OAAO,IAAI,QAAQ,CAAC;AAAA,IAC9E,WAAW,WAAW;AACpB,YAAM,IAAI,MAAM,iBAAiB,cAAc,KAAK,MAAM,EAAE,IAAI,EAAE;AAClE,UAAI,MAAM,QAAQ,MAAM,QAAW;AAGjC,cAAM,MAAM,MAAM,iBAAiB,cAAc,KAAK,MAAM,EAAE,iBAAiB,EAAE;AACjF,aAAK,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,GAAG,GAAG,MAAM,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;AAAA,MAC1E;AAAA,IACF,WAAW,SAAS;AAClB,YAAM,UAAU,iBAAiB,cAAc,KAAK,MAAM;AAC1D,YAAM,MAAM,MAAM,QAAQ,iBAAiB,QAAQ,IAAI,EAAE;AACzD,UAAI,QAAQ,cAAc,UAAa,IAAI,SAAS,QAAQ,WAAW;AACrE,cAAM,IAAI,2BAA2B,aAAa,cAAc,SAAI,KAAK,MAAM,IAAI,IAAI,QAAQ,QAAQ,SAAS;AAAA,MAClH;AACA,iBAAW,OAAO,KAAK;AACrB,cAAM,MAAM,MAAM,QAAQ,iBAAiB,GAAG;AAC9C,YAAI,QAAQ,KAAM;AAClB,aAAK,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,IAAI,GAAG,MAAM,KAAK,OAAO,KAAK,SAAS,EAAE,CAAC;AAAA,MAC7E;AAAA,IACF;AAEA,QAAI,KAAK,WAAW,EAAG;AAEvB,QAAI,SAAS,SAAS;AACpB,iBAAW,OAAO,KAAM,OAAM,UAAU,UAAU,MAAM,IAAI,KAAK;AACjE;AAAA,IACF;AAEA,QAAI,kBAAkB,MAAM;AAC1B;AAAC,OAAC,EAAE,oBAAoB,cAAc,IAAI,MAAM,OAAO,wBAAe;AAAA,IACxE;AAEA,eAAW,OAAO,MAAM;AACtB,YAAMA,OAAM,EAAE,OAAO,iBAAiB,kBAAkB,EAAE;AAC1D,YAAM,SAAS,YAAY,EAAE,YAAY,KAAK,QAAQ,IAAI,IAAI,MAAM,CAAC;AACrE,YAAM,SAAS,MAAM,cAAc,IAAI,MAAM,IAAI,OAAO,IAAI,SAAS,cAAcA,IAAG;AACtF,iBAAW,OAAO,OAAO,KAAK,KAAK,OAAO,GAAG;AAC3C,cAAM,MAAM,OAAO,QAAQ,GAAG;AAC9B,YAAI,CAAC,IAAK;AACV,YAAI,IAAI,SAAS,UAAU;AACzB,gBAAM,MAAM,IAAI;AAChB,cAAI,KAAK,OAAQ,OAAM;AACvB,kBAAQ,KAAK,wBAAwB,GAAG,iBAAiB,KAAK,MAAM,SAAS,IAAI,KAAK,aAAa,GAAG;AACtG;AAAA,QACF;AACA,cAAM,UAAU,KAAK,QAAQ,GAAG;AAChC,YAAI,CAAC,QAAS;AACd,cAAM,mBAAmB,iBAAiB,cAAc,QAAQ,UAAU;AAQ1E,cAAM,QAAQ,iBAAiB,mBAAmB;AAGlD,YAAI,IAAI,SAAS,SAAS;AAExB,gBAAM,EAAE,mBAAmB,kBAAkB,IAAI,MAAM,OAAO,8BAAqB;AACnF,gBAAM,QAAQ,MAAM,kBAAkB,SAAS,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,eAAe;AAC1G,gBAAM,WAAW,IAAI,IAAY,OAAO,QAAQ,CAAC,CAAC;AAClD,gBAAM,cAAc,IAAI,QAAQ,IAAI,OAAK,EAAE,GAAG;AAC9C,gBAAM,aAAa,IAAI,IAAY,WAAW;AAG9C,qBAAW,KAAK,UAAU;AACxB,gBAAI,WAAW,IAAI,CAAC,EAAG;AACvB,kBAAM,iBAAiB,gBAAgB,GAAG,KAAK;AAAA,UACjD;AAKA,qBAAW,SAAS,IAAI,SAAS;AAC/B,gBAAI,UAAU,MAAM;AAClB,uBAAS,OAAO,QAAQ,YAAY,MAAM,KAAK,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,MAAM,GAAG,CAAC;AAAA,YACxG;AACA,kBAAM,iBAAiB,kBAAkB,MAAM,KAAK,MAAM,OAAO,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAAA,UAChG;AAGA,gBAAM,kBAAkB,SAAS,OAAO;AAAA,YACtC,QAAQ,KAAK;AAAA,YACb,UAAU,IAAI;AAAA,YACd,WAAW;AAAA,YACX,kBAAkB,QAAQ;AAAA,YAC1B,MAAM;AAAA,UACR,GAAG,QAAQ,eAAe;AAC1B;AAAA,QACF;AAGA,YAAI,IAAI,YAAY,MAAM;AASxB,gBAAM,iBAAiB,gBAAgB,IAAI,OAAO,KAAK;AACvD;AAAA,QACF;AAUA,YAAI,QAAQ,UAAU,YAAY,QAAQ,WAAW,UAAa,QAAQ,eAAe,KAAK,QAAQ;AACpG,gBAAM,QAAQ,IAAI;AAClB,gBAAM,UAAmC,EAAE,GAAG,IAAI,KAAK;AACvD,cAAI,UAAU;AACd,qBAAW,KAAK,QAAQ,QAAQ;AAC9B,gBAAI,CAAC,oBAAoB,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG;AAC/C,sBAAQ,CAAC,IAAI,MAAM,CAAC;AACpB,wBAAU;AAAA,YACZ;AAAA,UACF;AACA,cAAI,CAAC,QAAS;AACd,cAAI,UAAU,MAAM;AAClB,qBAAS,OAAO,QAAQ,YAAY,IAAI,OAAO,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,CAAC;AAAA,UACxG;AACA,gBAAM,iBAAiB,kBAAkB,IAAI,OAAO,SAAS,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAC1F;AAAA,QACF;AAGA,YAAI,UAAU,MAAM;AAClB,mBAAS,OAAO,QAAQ,YAAY,IAAI,OAAO,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,CAAC;AAAA,QACxG;AACA,cAAM,iBAAiB,kBAAkB,IAAI,OAAO,IAAI,OAAO,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAAA,MAC9F;AAAA,IACF;AAAA,EACF;AACF;","names":["ctx"]}
+{"version":3,"sources":["../src/with-formula/derivations/dispatch.ts"],"sourcesContent":["/**\n * Derivation dispatch, lifted out of the kernel spine (#842 part b).\n *\n * `Collection` carried ~380 lines of dispatch logic that belongs to the\n * derivation service, not to the always-on kernel. These are free functions\n * taking an explicit context so the spine keeps only a thin delegator.\n *\n * ## How the spine reaches this module\n *\n * By dynamic `import()`, never a static one. `check-architecture.mjs`'s\n * `port-layering` check forbids the spine from statically importing a\n * `with-*` service; `collection.ts` is grandfathered for ten\n * `with-formula/*` specifiers, but that list is frozen per file and a new\n * one is a violation. A dynamic import is the sanctioned S4 gate recipe, and\n * it keeps this chunk out of the floor bundle for consumers who never fire a\n * derivation.\n *\n * The `Collection` type reference below points back at the spine. That is\n * inward (service → kernel) and so allowed, and it is TYPE-ONLY — erased at\n * build, so no runtime cycle exists.\n *\n * @internal\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { DerivationRegistry } from './registry.js'\nimport type { ReadOnlyVaultFacade } from '../../with-audit/guards/types.js'\nimport type { Collection } from '../../kernel/collection.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport type { ledgerAuditHook, WaveContext } from '../../kernel/via/dispatch.js'\nimport { putDerivedOutput, selfWriteFieldEqual } from '../../kernel/via/dispatch.js'\nimport { DerivationCapExceededError } from '../../kernel/errors.js'\nimport { markStale } from './stale.js'\nimport type { DerivationExecutor } from './executor.js'\n\n/** The per-write dispatch context threaded into `putDerivedOutput`. */\ninterface DispatchCtx {\n  emit: (e: string, p: unknown) => void\n  source: { readonly collection: string; readonly id: string }\n  audit: ReturnType<typeof ledgerAuditHook>\n}\n\n/**\n * What the dispatchers need from the collection that owns them. Passing this\n * explicitly is what lets the logic live outside the class.\n */\nexport interface DerivationDeleteCtx {\n  readonly derivationSource: {\n    registry(): DerivationRegistry\n    getCollection(name: string): Collection<Record<string, unknown>>\n    getActiveTxContext(): TxContext | null\n    getReadOnlyFacade(): ReadOnlyVaultFacade\n  }\n  /** The collection the delete happened in. */\n  readonly collectionName: string\n  readonly adapter: NoydbStore\n  readonly vault: string\n  readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  readonly storeCiphertext: boolean\n}\n\n/**\n * Erase the derived rows a deleted source record fanned out to, and drop the\n * fan-out sidecars that recorded them.\n *\n * @param eraseRecordShapeToo also erase same-id `shape: 'record'` outputs.\n *   Restricted to a source-triggered strategy writing into a DIFFERENT\n *   collection — the self-denorm case would re-delete the record just\n *   tombstoned, and triggerBy/sibling strategies derive under a different id.\n * @returns rows ACTUALLY deleted, not edges visited (#622).\n */\nexport async function dispatchArrayDerivationsOnDelete(\n  ctx: DerivationDeleteCtx,\n  id: string,\n  eraseRecordShapeToo = false,\n): Promise<number> {\n  const { derivationSource, collectionName, adapter, vault, getDEK, storeCiphertext } = ctx\n\n  const strategies = derivationSource.registry().strategiesForSource(collectionName)\n  if (strategies.length === 0) return 0\n\n  const { loadFanoutSidecar, deleteFanoutSidecar } = await import('./fanout-sidecar.js')\n  const txCtx = derivationSource.getActiveTxContext()\n  let erased = 0\n\n  for (const { spec } of strategies) {\n    for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {\n      if (outSpec.shape === 'record') {\n        if (eraseRecordShapeToo && spec.source === collectionName && outSpec.collection !== collectionName) {\n          if (await derivationSource.getCollection(outSpec.collection)._internalDelete(id, txCtx)) erased += 1\n        }\n        continue\n      }\n\n      const sidecar = await loadFanoutSidecar(adapter, vault, spec.source, id, outputKey, getDEK, storeCiphertext)\n      if (!sidecar) continue\n\n      const outputCollection = derivationSource.getCollection(outSpec.collection)\n      for (const derivedId of sidecar.keys) {\n        if (await outputCollection._internalDelete(derivedId, txCtx)) erased += 1\n      }\n      await deleteFanoutSidecar(adapter, vault, spec.source, id, outputKey)\n    }\n  }\n\n  return erased\n}\n\n/** Adds what the on-write derivation dispatch needs beyond the delete path. */\nexport interface DerivationDispatchCtx extends DerivationDeleteCtx {\n  /** Via pipeline, for decoding the stored form back to canonical money shape. */\n  readonly via: { canonicalizeStored(r: Record<string, unknown>): Record<string, unknown> } | undefined\n  /** Recompute a rollup aggregate onto a parent. Stays on the spine — it walks collections. */\n  readonly recomputeRollup: (\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    spec: any,\n    parentId: string,\n    source: { readonly collection: string; readonly id: string },\n    wave?: WaveContext,\n  ) => Promise<unknown>\n  /** Builds the per-write dispatch context threaded into `putDerivedOutput`. */\n  readonly dispatchCtx: (source: { readonly collection: string; readonly id: string }) => DispatchCtx\n  /** Registers a write on the active transaction for rollback. */\n  readonly trackPut: (txCtx: TxContext, collectionName: string, id: string, priorEnvelope: EncryptedEnvelope | null) => void\n}\n\n/**\n * Fire registered derivation strategies for this source collection.\n *\n * Eager mode runs `derive` inline and writes each output; lazy mode records a\n * stale mark for cold-session recompute. Rollups are handled here rather than\n * by the executor — a write to the child recomputes the parent aggregate, and\n * a write to the parent recomputes its own.\n */\nexport async function dispatchDerivations(\n  ctx: DerivationDispatchCtx,\n  id: string,\n  record: Record<string, unknown>,\n  version: number,\n  wave?: WaveContext,\n): Promise<void> {\n  const {\n    derivationSource, collectionName, adapter, vault, getDEK, storeCiphertext,\n    via, recomputeRollup, dispatchCtx, trackPut,\n  } = ctx\n\n  // `record` is the stored form here (post-quantize) — decode so\n  // derive(source, ctx) sees the canonical money shape.\n  const incoming = (via ? via.canonicalizeStored(record) : record)\n  if (incoming && typeof incoming === 'object' && '_derivedFrom' in incoming) return\n  const registry = derivationSource.registry()\n  const strategies = registry.strategiesForSource(collectionName)\n  if (strategies.length === 0) return\n  // Dynamic-import the executor only on the first eager-mode\n  // dispatch. Lazy-mode dispatches use `markStale` (a pure helper)\n  // which doesn't reach into the executor at all. Keeps the\n  // derivation executor chunk out of the floor bundle for any\n  // consumer that doesn't fire an eager derivation.\n  let executorClass: typeof DerivationExecutor | null = null\n  for (const { spec, strategyHash } of strategies) {\n    const mode = typeof spec.lifecycle === 'string' ? spec.lifecycle : spec.lifecycle.mode\n\n    // Rollup: a write to the child `from` recomputes the\n    // parent at id child[key]; a write to the parent (source = into)\n    // recomputes its own aggregate. Handled here (the executor is not run).\n    if (spec.rollup) {\n      if (mode !== 'eager') continue\n      let parentId: string | null\n      if (collectionName === spec.rollup.from) {\n        const kv = incoming[spec.rollup.key]\n        parentId = (typeof kv === 'string' || typeof kv === 'number') ? String(kv) : null\n      } else {\n        parentId = id // a write to the parent recomputes its own aggregate\n      }\n      if (parentId !== null) await recomputeRollup(spec, parentId, { collection: collectionName, id }, wave)\n      continue\n    }\n\n    // Determine how `collectionName` triggers this strategy, and build the list\n    // of source records to (re-)derive:\n    //   • source     — re-derive the written record itself (same-id).\n    //   • sources[]  — re-derive the PRIMARY source at the same id.\n    //   • triggerBy  — FK fan-out: re-derive every source record\n    //                  whose `on` field equals the written parent's id.\n    // `input` is passed to derive(); `base` is the raw stored source record\n    // used as the patch base for a self-write reverse-denorm output.\n    const isSource = spec.source === collectionName\n    const isSibling = !isSource && (spec.sources?.includes(collectionName) ?? false)\n    const trigger = !isSource && !isSibling\n      ? spec.triggerBy?.find(t => t.collection === collectionName)\n      : undefined\n\n    const runs: Array<{\n      input: Record<string, unknown> & { id: string }\n      base: Record<string, unknown>\n      runId: string\n      version: number\n    }> = []\n\n    if (isSource) {\n      runs.push({ input: { ...incoming, id }, base: incoming, runId: id, version })\n    } else if (isSibling) {\n      const p = await derivationSource.getCollection(spec.source).get(id)\n      if (p !== null && p !== undefined) {\n        // Raw base for a (rare) sibling self-write; falls back to the\n        // resolved primary if the raw read misses.\n        const raw = await derivationSource.getCollection(spec.source)._getStoredRecord(id)\n        runs.push({ input: { ...p, id }, base: raw ?? p, runId: id, version: 0 })\n      }\n    } else if (trigger) {\n      const srcColl = derivationSource.getCollection(spec.source)\n      const ids = await srcColl._findMatchingIds(trigger.on, id)\n      if (trigger.maxFanout !== undefined && ids.length > trigger.maxFanout) {\n        throw new DerivationCapExceededError(`triggerBy ${collectionName}→${spec.source}`, ids.length, trigger.maxFanout)\n      }\n      for (const sid of ids) {\n        const raw = await srcColl._getStoredRecord(sid)\n        if (raw === null) continue\n        runs.push({ input: { ...raw, id: sid }, base: raw, runId: sid, version: 0 })\n      }\n    }\n\n    if (runs.length === 0) continue\n\n    if (mode !== 'eager') {\n      for (const run of runs) await markStale(registry, spec, run.runId)\n      continue\n    }\n\n    if (executorClass === null) {\n      ;({ DerivationExecutor: executorClass } = await import('./executor.js'))\n    }\n\n    for (const run of runs) {\n      const ctx = { vault: derivationSource.getReadOnlyFacade() }\n      const outCtx = dispatchCtx({ collection: spec.source, id: run.runId })\n      const result = await executorClass.run(spec, run.input, run.version, strategyHash, ctx)\n      for (const key of Object.keys(spec.outputs)) {\n        const out = result.outputs[key]\n        if (!out) continue\n        if (out.kind === 'failed') {\n          const err = out.error\n          if (spec.strict) throw err\n          console.warn(`[derivation] output \"${key}\" for source \"${spec.source}\" id=\"${run.runId}\" failed:`, err)\n          continue\n        }\n        const outSpec = spec.outputs[key]\n        if (!outSpec) continue\n        const outputCollection = derivationSource.getCollection(outSpec.collection)\n        // If we're inside a multi-record transaction, register\n        // derived writes as side-effect ops on the active ctx\n        // BEFORE they fire. `revertExecuted` walks `_executed` in\n        // reverse on rollback, so capturing the pre-write envelope\n        // here lets a later mid-batch failure restore this output's\n        // prior state alongside the source op. Outside a transaction\n        // the context is null and tracking is skipped.\n        const txCtx = derivationSource.getActiveTxContext()\n\n        // ── Array-shape branch ─────────────────────────────────\n        if (out.kind === 'array') {\n          // Load the prior key set from the fanout sidecar.\n          const { loadFanoutSidecar, saveFanoutSidecar } = await import('./fanout-sidecar.js')\n          const prior = await loadFanoutSidecar(adapter, vault, spec.source, run.runId, key, getDEK, storeCiphertext)\n          const prevKeys = new Set<string>(prior?.keys ?? [])\n          const newKeysList = out.entries.map(e => e.key)\n          const newKeysSet = new Set<string>(newKeysList)\n\n          // Diff — delete keys that were in prev but not in new.\n          for (const k of prevKeys) {\n            if (newKeysSet.has(k)) continue\n            await outputCollection._internalDelete(k, txCtx)\n          }\n\n          // Upsert every entry in the new set. (Slice 1: no\n          // identity-skip optimisation; write every row, idempotent\n          // at the (collection, id) level.)\n          for (const entry of out.entries) {\n            if (txCtx !== null) {\n              trackPut(txCtx, outSpec.collection, entry.key, await adapter.get(vault, outSpec.collection, entry.key))\n            }\n            await putDerivedOutput(outputCollection, entry.key, entry.value, outCtx, { source: 'derived' })\n          }\n\n          // Persist the new key set last, for failure-mode symmetry.\n          await saveFanoutSidecar(adapter, vault, {\n            source: spec.source,\n            sourceId: run.runId,\n            outputKey: key,\n            outputCollection: outSpec.collection,\n            keys: newKeysList,\n          }, getDEK, storeCiphertext)\n          continue\n        }\n\n        // ── Record-shape branch ────────────────────────────────\n        if (out.skipped === true) {\n          // Optional output returned null. Delete the\n          // previously-emitted output at this id, if any. Routed\n          // through `_internalDelete` so a user-registered\n          // `onDelete` on the output collection does NOT\n          // fire — this is a system-internal tombstone, not a\n          // user-initiated delete. The txCtx hookup captures the\n          // prior envelope inside `_internalDelete` for rollback\n          // symmetry; delete-of-absent is a silent no-op.\n          await outputCollection._internalDelete(run.runId, txCtx)\n          continue\n        }\n\n        // ── Self-write reverse-denorm ───────────────────────────\n        // An output back to its own source: patch ONLY the declared\n        // `denorm` fields onto the raw stored record, never the whole\n        // value (which would clobber user fields / i18n maps and carries\n        // the executor's `_derivedFrom` tag). If the patch changes\n        // nothing, skip the write — that value-equality is the cycle\n        // guard: the self-write re-fires the source-path derivation,\n        // which recomputes identical fields and terminates here.\n        if (outSpec.shape === 'record' && outSpec.denorm !== undefined && outSpec.collection === spec.source) {\n          const value = out.value\n          const patched: Record<string, unknown> = { ...run.base }\n          let changed = false\n          for (const f of outSpec.denorm) {\n            if (!selfWriteFieldEqual(run.base[f], value[f])) {\n              patched[f] = value[f]\n              changed = true\n            }\n          }\n          if (!changed) continue // cycle guard — nothing to write\n          if (txCtx !== null) {\n            trackPut(txCtx, outSpec.collection, run.runId, await adapter.get(vault, outSpec.collection, run.runId))\n          }\n          await putDerivedOutput(outputCollection, run.runId, patched, outCtx, { source: 'derived' })\n          continue\n        }\n\n        // ── Normal record output (separate output collection) ──\n        if (txCtx !== null) {\n          trackPut(txCtx, outSpec.collection, run.runId, await adapter.get(vault, outSpec.collection, run.runId))\n        }\n        await putDerivedOutput(outputCollection, run.runId, out.value, outCtx, { source: 'derived' })\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAyEA,eAAsB,iCACpB,KACA,IACA,sBAAsB,OACL;AACjB,QAAM,EAAE,kBAAkB,gBAAgB,SAAS,OAAO,QAAQ,gBAAgB,IAAI;AAEtF,QAAM,aAAa,iBAAiB,SAAS,EAAE,oBAAoB,cAAc;AACjF,MAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,QAAM,EAAE,mBAAmB,oBAAoB,IAAI,MAAM,OAAO,8BAAqB;AACrF,QAAM,QAAQ,iBAAiB,mBAAmB;AAClD,MAAI,SAAS;AAEb,aAAW,EAAE,KAAK,KAAK,YAAY;AACjC,eAAW,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAC/D,UAAI,QAAQ,UAAU,UAAU;AAC9B,YAAI,uBAAuB,KAAK,WAAW,kBAAkB,QAAQ,eAAe,gBAAgB;AAClG,cAAI,MAAM,iBAAiB,cAAc,QAAQ,UAAU,EAAE,gBAAgB,IAAI,KAAK,EAAG,WAAU;AAAA,QACrG;AACA;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,kBAAkB,SAAS,OAAO,KAAK,QAAQ,IAAI,WAAW,QAAQ,eAAe;AAC3G,UAAI,CAAC,QAAS;AAEd,YAAM,mBAAmB,iBAAiB,cAAc,QAAQ,UAAU;AAC1E,iBAAW,aAAa,QAAQ,MAAM;AACpC,YAAI,MAAM,iBAAiB,gBAAgB,WAAW,KAAK,EAAG,WAAU;AAAA,MAC1E;AACA,YAAM,oBAAoB,SAAS,OAAO,KAAK,QAAQ,IAAI,SAAS;AAAA,IACtE;AAAA,EACF;AAEA,SAAO;AACT;AA4BA,eAAsB,oBACpB,KACA,IACA,QACA,SACA,MACe;AACf,QAAM;AAAA,IACJ;AAAA,IAAkB;AAAA,IAAgB;AAAA,IAAS;AAAA,IAAO;AAAA,IAAQ;AAAA,IAC1D;AAAA,IAAK;AAAA,IAAiB;AAAA,IAAa;AAAA,EACrC,IAAI;AAIJ,QAAM,WAAY,MAAM,IAAI,mBAAmB,MAAM,IAAI;AACzD,MAAI,YAAY,OAAO,aAAa,YAAY,kBAAkB,SAAU;AAC5E,QAAM,WAAW,iBAAiB,SAAS;AAC3C,QAAM,aAAa,SAAS,oBAAoB,cAAc;AAC9D,MAAI,WAAW,WAAW,EAAG;AAM7B,MAAI,gBAAkD;AACtD,aAAW,EAAE,MAAM,aAAa,KAAK,YAAY;AAC/C,UAAM,OAAO,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAK,UAAU;AAKlF,QAAI,KAAK,QAAQ;AACf,UAAI,SAAS,QAAS;AACtB,UAAI;AACJ,UAAI,mBAAmB,KAAK,OAAO,MAAM;AACvC,cAAM,KAAK,SAAS,KAAK,OAAO,GAAG;AACnC,mBAAY,OAAO,OAAO,YAAY,OAAO,OAAO,WAAY,OAAO,EAAE,IAAI;AAAA,MAC/E,OAAO;AACL,mBAAW;AAAA,MACb;AACA,UAAI,aAAa,KAAM,OAAM,gBAAgB,MAAM,UAAU,EAAE,YAAY,gBAAgB,GAAG,GAAG,IAAI;AACrG;AAAA,IACF;AAUA,UAAM,WAAW,KAAK,WAAW;AACjC,UAAM,YAAY,CAAC,aAAa,KAAK,SAAS,SAAS,cAAc,KAAK;AAC1E,UAAM,UAAU,CAAC,YAAY,CAAC,YAC1B,KAAK,WAAW,KAAK,OAAK,EAAE,eAAe,cAAc,IACzD;AAEJ,UAAM,OAKD,CAAC;AAEN,QAAI,UAAU;AACZ,WAAK,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,GAAG,GAAG,MAAM,UAAU,OAAO,IAAI,QAAQ,CAAC;AAAA,IAC9E,WAAW,WAAW;AACpB,YAAM,IAAI,MAAM,iBAAiB,cAAc,KAAK,MAAM,EAAE,IAAI,EAAE;AAClE,UAAI,MAAM,QAAQ,MAAM,QAAW;AAGjC,cAAM,MAAM,MAAM,iBAAiB,cAAc,KAAK,MAAM,EAAE,iBAAiB,EAAE;AACjF,aAAK,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,GAAG,GAAG,MAAM,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;AAAA,MAC1E;AAAA,IACF,WAAW,SAAS;AAClB,YAAM,UAAU,iBAAiB,cAAc,KAAK,MAAM;AAC1D,YAAM,MAAM,MAAM,QAAQ,iBAAiB,QAAQ,IAAI,EAAE;AACzD,UAAI,QAAQ,cAAc,UAAa,IAAI,SAAS,QAAQ,WAAW;AACrE,cAAM,IAAI,2BAA2B,aAAa,cAAc,SAAI,KAAK,MAAM,IAAI,IAAI,QAAQ,QAAQ,SAAS;AAAA,MAClH;AACA,iBAAW,OAAO,KAAK;AACrB,cAAM,MAAM,MAAM,QAAQ,iBAAiB,GAAG;AAC9C,YAAI,QAAQ,KAAM;AAClB,aAAK,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,IAAI,GAAG,MAAM,KAAK,OAAO,KAAK,SAAS,EAAE,CAAC;AAAA,MAC7E;AAAA,IACF;AAEA,QAAI,KAAK,WAAW,EAAG;AAEvB,QAAI,SAAS,SAAS;AACpB,iBAAW,OAAO,KAAM,OAAM,UAAU,UAAU,MAAM,IAAI,KAAK;AACjE;AAAA,IACF;AAEA,QAAI,kBAAkB,MAAM;AAC1B;AAAC,OAAC,EAAE,oBAAoB,cAAc,IAAI,MAAM,OAAO,wBAAe;AAAA,IACxE;AAEA,eAAW,OAAO,MAAM;AACtB,YAAMA,OAAM,EAAE,OAAO,iBAAiB,kBAAkB,EAAE;AAC1D,YAAM,SAAS,YAAY,EAAE,YAAY,KAAK,QAAQ,IAAI,IAAI,MAAM,CAAC;AACrE,YAAM,SAAS,MAAM,cAAc,IAAI,MAAM,IAAI,OAAO,IAAI,SAAS,cAAcA,IAAG;AACtF,iBAAW,OAAO,OAAO,KAAK,KAAK,OAAO,GAAG;AAC3C,cAAM,MAAM,OAAO,QAAQ,GAAG;AAC9B,YAAI,CAAC,IAAK;AACV,YAAI,IAAI,SAAS,UAAU;AACzB,gBAAM,MAAM,IAAI;AAChB,cAAI,KAAK,OAAQ,OAAM;AACvB,kBAAQ,KAAK,wBAAwB,GAAG,iBAAiB,KAAK,MAAM,SAAS,IAAI,KAAK,aAAa,GAAG;AACtG;AAAA,QACF;AACA,cAAM,UAAU,KAAK,QAAQ,GAAG;AAChC,YAAI,CAAC,QAAS;AACd,cAAM,mBAAmB,iBAAiB,cAAc,QAAQ,UAAU;AAQ1E,cAAM,QAAQ,iBAAiB,mBAAmB;AAGlD,YAAI,IAAI,SAAS,SAAS;AAExB,gBAAM,EAAE,mBAAmB,kBAAkB,IAAI,MAAM,OAAO,8BAAqB;AACnF,gBAAM,QAAQ,MAAM,kBAAkB,SAAS,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,eAAe;AAC1G,gBAAM,WAAW,IAAI,IAAY,OAAO,QAAQ,CAAC,CAAC;AAClD,gBAAM,cAAc,IAAI,QAAQ,IAAI,OAAK,EAAE,GAAG;AAC9C,gBAAM,aAAa,IAAI,IAAY,WAAW;AAG9C,qBAAW,KAAK,UAAU;AACxB,gBAAI,WAAW,IAAI,CAAC,EAAG;AACvB,kBAAM,iBAAiB,gBAAgB,GAAG,KAAK;AAAA,UACjD;AAKA,qBAAW,SAAS,IAAI,SAAS;AAC/B,gBAAI,UAAU,MAAM;AAClB,uBAAS,OAAO,QAAQ,YAAY,MAAM,KAAK,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,MAAM,GAAG,CAAC;AAAA,YACxG;AACA,kBAAM,iBAAiB,kBAAkB,MAAM,KAAK,MAAM,OAAO,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAAA,UAChG;AAGA,gBAAM,kBAAkB,SAAS,OAAO;AAAA,YACtC,QAAQ,KAAK;AAAA,YACb,UAAU,IAAI;AAAA,YACd,WAAW;AAAA,YACX,kBAAkB,QAAQ;AAAA,YAC1B,MAAM;AAAA,UACR,GAAG,QAAQ,eAAe;AAC1B;AAAA,QACF;AAGA,YAAI,IAAI,YAAY,MAAM;AASxB,gBAAM,iBAAiB,gBAAgB,IAAI,OAAO,KAAK;AACvD;AAAA,QACF;AAUA,YAAI,QAAQ,UAAU,YAAY,QAAQ,WAAW,UAAa,QAAQ,eAAe,KAAK,QAAQ;AACpG,gBAAM,QAAQ,IAAI;AAClB,gBAAM,UAAmC,EAAE,GAAG,IAAI,KAAK;AACvD,cAAI,UAAU;AACd,qBAAW,KAAK,QAAQ,QAAQ;AAC9B,gBAAI,CAAC,oBAAoB,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG;AAC/C,sBAAQ,CAAC,IAAI,MAAM,CAAC;AACpB,wBAAU;AAAA,YACZ;AAAA,UACF;AACA,cAAI,CAAC,QAAS;AACd,cAAI,UAAU,MAAM;AAClB,qBAAS,OAAO,QAAQ,YAAY,IAAI,OAAO,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,CAAC;AAAA,UACxG;AACA,gBAAM,iBAAiB,kBAAkB,IAAI,OAAO,SAAS,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAC1F;AAAA,QACF;AAGA,YAAI,UAAU,MAAM;AAClB,mBAAS,OAAO,QAAQ,YAAY,IAAI,OAAO,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,CAAC;AAAA,QACxG;AACA,cAAM,iBAAiB,kBAAkB,IAAI,OAAO,IAAI,OAAO,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAAA,MAC9F;AAAA,IACF;AAAA,EACF;AACF;","names":["ctx"]}

package/dist/{dispatch-SMXUO7W5.js → dispatch-RPTLK7LJ.js}

@@ -15,7 +15,7 @@ async function dispatchMaterializedViews(ctx, id, record, wave) {
       if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
       if (executor === null) {
         ;
-        ({ MaterializedViewExecutor: executor } = await import("./executor-SHYLIBOM.js"));
+        ({ MaterializedViewExecutor: executor } = await import("./executor-XZYM4KHT.js"));
       }
       await executor.refresh(reg, {
         getCollection: (name) => source.getCollection(name),
@@ -24,7 +24,7 @@ async function dispatchMaterializedViews(ctx, id, record, wave) {
         dispatchCtx: dispatchCtx({ collection: collectionName, id })
       });
     } else if (mode === "lazy") {
-      if (staleHelpers === null) staleHelpers = await import("./stale-NBROTA66.js");
+      if (staleHelpers === null) staleHelpers = await import("./stale-JOE7GBAE.js");
       staleHelpers.markMVStale(registry, reg.spec.name);
     }
   }
@@ -44,7 +44,7 @@ async function dispatchMaterializedViewsOnDelete(ctx, id) {
     if (mode === "eager") {
       if (executor === null) {
         ;
-        ({ MaterializedViewExecutor: executor } = await import("./executor-SHYLIBOM.js"));
+        ({ MaterializedViewExecutor: executor } = await import("./executor-XZYM4KHT.js"));
       }
       const rr = await executor.refresh(reg, {
         getCollection: (name) => source.getCollection(name),
@@ -57,7 +57,7 @@ async function dispatchMaterializedViewsOnDelete(ctx, id) {
       residueDeclined.push(...rr.residueDeclined);
       continue;
     }
-    if (staleHelpers === null) staleHelpers = await import("./stale-NBROTA66.js");
+    if (staleHelpers === null) staleHelpers = await import("./stale-JOE7GBAE.js");
     const inv = await staleHelpers.invalidateMVAtRest(source, reg, mode);
     deleted += inv.deleted;
     residueUndecodable.push(...inv.residueUndecodable.map((rid) => `${reg.outputCollection}:${rid}`));
@@ -69,4 +69,4 @@ export {
   dispatchMaterializedViews,
   dispatchMaterializedViewsOnDelete
 };
-//# sourceMappingURL=dispatch-SMXUO7W5.js.map
+//# sourceMappingURL=dispatch-RPTLK7LJ.js.map

package/dist/{enclave-I5H3GINP.js → enclave-CLJVSDFG.js}

@@ -22,26 +22,26 @@ import {
   sealRecordToHost,
   verifyBrokerProof,
   writeEnvelopeBody
-} from "./chunk-GEEJPID6.js";
+} from "./chunk-RZPOZPZU.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone,
   isTombstoneShape
-} from "./chunk-SC4JLMZI.js";
+} from "./chunk-VH6SOCXH.js";
 import {
   ctEqualTags,
   deriveVdigSlotKey,
   evaluateKofN
-} from "./chunk-5WLDZZ6S.js";
-import "./chunk-5HSSTOOG.js";
+} from "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
 import {
   computeBidxTarget,
   deriveClassifyIndexKey,
   deriveClassifyIndexSalt,
   mintBidxTag
-} from "./chunk-G4MFQXYX.js";
+} from "./chunk-QJNCB5SK.js";
 import {
   pbkdf2VerifyDigest
 } from "./chunk-LP7BEXCT.js";
@@ -72,9 +72,9 @@ import {
   unwrapKey,
   wrapCek,
   wrapKey
-} from "./chunk-7U6AB7DZ.js";
-import "./chunk-YTW6ZIPD.js";
-import "./chunk-6SYOHUHM.js";
+} from "./chunk-AKKRXT23.js";
+import "./chunk-GZACYEOB.js";
+import "./chunk-QZWTRENR.js";
 import "./chunk-PZ5AY32C.js";
 export {
   RecordCodec,
@@ -140,4 +140,4 @@ export {
   wrapKey,
   writeEnvelopeBody
 };
-//# sourceMappingURL=enclave-I5H3GINP.js.map
+//# sourceMappingURL=enclave-CLJVSDFG.js.map

package/dist/executor-IEBLTBCW.js

@@ -0,0 +1,9 @@
+import {
+  DerivationExecutor
+} from "./chunk-MHMLXJ3I.js";
+import "./chunk-QZWTRENR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=executor-IEBLTBCW.js.map

package/dist/executor-RM7XWQDU.js

@@ -0,0 +1,9 @@
+import {
+  GuardExecutor
+} from "./chunk-W66AM5IB.js";
+import "./chunk-QZWTRENR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=executor-RM7XWQDU.js.map

package/dist/executor-XZYM4KHT.js

@@ -0,0 +1,28 @@
+import {
+  MaterializedViewExecutor
+} from "./chunk-FRMW23UK.js";
+import "./chunk-GP3UWP22.js";
+import "./chunk-3HUYRN24.js";
+import "./chunk-V6UQZA2H.js";
+import "./chunk-KRCBZYTZ.js";
+import "./chunk-XZHEOSQ2.js";
+import "./chunk-CADUYBQD.js";
+import "./chunk-IGJCYUT5.js";
+import "./chunk-NEX7JCMO.js";
+import "./chunk-UADPR6F4.js";
+import "./chunk-6UBZ6I5Z.js";
+import "./chunk-ISRKW4YN.js";
+import "./chunk-RZPOZPZU.js";
+import "./chunk-VH6SOCXH.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AKKRXT23.js";
+import "./chunk-GZACYEOB.js";
+import "./chunk-QZWTRENR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=executor-XZYM4KHT.js.map

package/dist/export-accessible-24XCCD3A.js

@@ -0,0 +1,23 @@
+import {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+} from "./chunk-WO4T4OD5.js";
+import "./chunk-SGQ4N5FS.js";
+import "./chunk-JIDLU57U.js";
+import "./chunk-RZPOZPZU.js";
+import "./chunk-VH6SOCXH.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AKKRXT23.js";
+import "./chunk-GZACYEOB.js";
+import "./chunk-QZWTRENR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+};
+//# sourceMappingURL=export-accessible-24XCCD3A.js.map

package/dist/extract-partition-H2TPEEOF.js

@@ -0,0 +1,38 @@
+import {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+} from "./chunk-BYFXLDVV.js";
+import "./chunk-OBPVWOSQ.js";
+import "./chunk-NQSO4UAH.js";
+import "./chunk-SGQ4N5FS.js";
+import "./chunk-JIDLU57U.js";
+import "./chunk-PTHKZWEH.js";
+import "./chunk-ZJADGNYF.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-JYJFGD2H.js";
+import "./chunk-ISRKW4YN.js";
+import "./chunk-RZPOZPZU.js";
+import "./chunk-VH6SOCXH.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AKKRXT23.js";
+import "./chunk-GZACYEOB.js";
+import "./chunk-QZWTRENR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+};
+//# sourceMappingURL=extract-partition-H2TPEEOF.js.map

package/dist/{fanout-sidecar-WWXVHHUH.js → fanout-sidecar-TV7CXAJ6.js}

@@ -1,18 +1,18 @@
 import {
   openEnvelopeJson
-} from "./chunk-GEEJPID6.js";
-import "./chunk-SC4JLMZI.js";
-import "./chunk-5WLDZZ6S.js";
-import "./chunk-5HSSTOOG.js";
-import "./chunk-G4MFQXYX.js";
+} from "./chunk-RZPOZPZU.js";
+import "./chunk-VH6SOCXH.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
 import "./chunk-LP7BEXCT.js";
 import {
   encrypt
-} from "./chunk-7U6AB7DZ.js";
+} from "./chunk-AKKRXT23.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-YTW6ZIPD.js";
-import "./chunk-6SYOHUHM.js";
+} from "./chunk-GZACYEOB.js";
+import "./chunk-QZWTRENR.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-formula/derivations/fanout-sidecar.ts
@@ -71,4 +71,4 @@ export {
   loadFanoutSidecar,
   saveFanoutSidecar
 };
-//# sourceMappingURL=fanout-sidecar-WWXVHHUH.js.map
+//# sourceMappingURL=fanout-sidecar-TV7CXAJ6.js.map

package/dist/find-OZMTRIK3.js

@@ -0,0 +1,11 @@
+import {
+  computeBidxTarget
+} from "./chunk-QJNCB5SK.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AKKRXT23.js";
+import "./chunk-QZWTRENR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  computeBidxTarget
+};
+//# sourceMappingURL=find-OZMTRIK3.js.map