@noy-db/hub 0.4.0-pre.5 → 0.4.0-pre.7

package/dist/chunk-IF6WNGAK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/via/blob/binding.ts","../src/port/with/blob-strategy.ts","../src/with-shape/blobs/export-blobs.ts","../src/with-shape/blobs/blob-compaction.ts"],"sourcesContent":["/**\n * The blob `ViaBinding` (#629 Task 7) — wires the `blobFields` declaration\n * into the kernel's generic Via port as a deliberately THIN binding:\n * declaration + posture + `describeFragment` + `erase` glue, and nothing\n * else. Blob content is fully out-of-band (`collection.blob(id)` →\n * `BlobSet` writing `_blob_*` side-collections; it never touches\n * `_putInternal` or the record codec), so this binding declares **no\n * write/read pipeline hooks** — in particular no `encodeAtRest`/\n * `decodeAtRest`: a blobFields collection must not flip the pipeline's\n * `hasAtRestHooks`, or the codec would abandon its inline seal path for a\n * feature that never seals record fields. The routing/compaction/TTL/\n * legal-hold/exportBlobs machinery stays service-side in\n * `with-shape/blobs/` (the i18n-dictionary precedent — that machinery\n * does real chunk AEAD + key-lifecycle work `via-enclave-isolation`\n * forbids under `via/*`).\n *\n * Like classified (see `port/with/classified-strategy.ts`), the link is\n * EAGER — `port/with/blob-strategy.ts` calls {@link linkBlobVia} at module\n * load. `blobFields` policies are plain object literals (there is no\n * `blob.*()` declaration factory to hang a lazy link on), so the binder\n * must be installed before `compileViaBindings` ever sees one.\n *\n * There is no `declare`-time validation: `blobFields` has never had a\n * construction-time refusal matrix (policies are consulted lazily by\n * `vault.compact()` and `BlobSet.put`), and inventing one here would\n * break the behavior lock.\n *\n * `covers` (#629 Task 8) is a passive coverage predicate, not a pipeline\n * hook — it lets `ViaPipeline.postureFor` recognize a `blobFields` slot so\n * `.where()`/`.orderBy()`/`.aggregate()` can refuse it (posture\n * `queryable: 'none'`); it does not participate in clause building or\n * evaluation.\n */\nimport type { ViaBinding, ViaEraseCtx, ViaEraseReport } from '../../kernel/via/index.js'\nimport { installViaBinder } from '../../kernel/via/index.js'\nimport type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js'\n\n/**\n * Config a blob collection's `blobFields` declaration resolves to — the\n * binding's construction input. `purgeBlobsForRecord` is an OPTIONAL\n * vault/service-provided closure for the `erase` hook, mapping\n * `collection.blob(id).shredAllForRecord()`'s `{shredded, retainedShared,\n * residue}: string[]` accounting onto `ViaEraseReport` — `shredded`/\n * `retainedShared` become counts, each residue eTag becomes a tagged\n * `{kind: 'blob-residue', eTag}` entry.\n *\n * DELIBERATELY left unwired by `compileViaBindings` (#629 Task 10, resolved\n * within parity-first — see task-10-report.md \"blob purge\" section):\n * `per-blob-cek.test.ts`/`forget.test.ts` prove blob-shred-on-forget is\n * gated SOLELY on the vault's `blobsStrategy` being configured, never on a\n * given collection's OWN `blobFields` declaration (`.blob(id)` is callable,\n * and IS exercised by those tests, on collections with no `blobFields` at\n * all). Routing it exclusively through this binding would silently stop\n * blob crypto-shredding for every such collection; `vault.forget()` keeps\n * calling `collection.blob(id).shredAllForRecord()` directly for that\n * reason. The hook stays real/tested (see `blob-binding.test.ts`) for a\n * future caller that wants it.\n */\nexport interface BlobViaConfig {\n  readonly fields: BlobFieldsConfig\n  readonly collectionName: string\n  /** Purge one record's blob slots (crypto-shred participation). Returns the erase report for `forget()`'s summary. */\n  readonly purgeBlobsForRecord?: (id: string) => Promise<ViaEraseReport>\n}\n\n/**\n * `forget()`'s per-ref blob-purge participation: delegate to the wired\n * closure, or report a clean zero-shredded, zero-residue no-op — the\n * default in production too (#629 Task 10 deliberately leaves this unwired;\n * see `BlobViaConfig`'s doc comment).\n */\nasync function eraseBlobs(ctx: ViaEraseCtx, cfg: BlobViaConfig): Promise<ViaEraseReport> {\n  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id)\n  return { shredded: 0, residue: [] }\n}\n\n/**\n * One field's blob knobs as they appear on `describeFragment()`'s payload\n * (#657 — the second real `ViaBinding.describeFragment` consumer after\n * `lookup`'s; see `with-shape/introspection/describe.ts`'s `buildDescription`).\n * Declarative scalars (`retainDays`/`external`/`public`/`backlink`) verbatim;\n * predicate knobs (`evictWhen`/`legalHold`/`retainUntil` — functions over the\n * decrypted record) as presence flags, since a predicate has no serializable\n * form — mirrors `buildBlobDescribeFragment`'s per-field shape below.\n */\nexport interface BlobDescribeFragmentEntry {\n  readonly retainDays?: number\n  readonly evictWhen?: true\n  readonly legalHold?: true\n  readonly retainUntil?: true\n  readonly external?: true\n  readonly public?: true\n  readonly backlink?: string\n}\n\n/** The `'blob'` binding's `describeFragment()` payload shape. */\nexport interface BlobDescribeFragment {\n  readonly blobFields: Record<string, BlobDescribeFragmentEntry>\n}\n\n/**\n * `{ blobFields: { <field>: <knobs> } }` — declarative scalars\n * (`retainDays`/`external`/`public`/`backlink`) verbatim; predicate knobs\n * (`evictWhen`/`legalHold`/`retainUntil` — functions over the decrypted\n * record) as presence flags, since a predicate has no serializable form.\n */\nfunction buildBlobDescribeFragment(fields: BlobFieldsConfig): Record<string, unknown> {\n  return {\n    blobFields: Object.fromEntries(\n      Object.entries(fields).map(([field, p]) => [field, {\n        ...(p.retainDays !== undefined ? { retainDays: p.retainDays } : {}),\n        ...(p.evictWhen !== undefined ? { evictWhen: true } : {}),\n        ...(p.legalHold !== undefined ? { legalHold: true } : {}),\n        ...(p.retainUntil !== undefined ? { retainUntil: true } : {}),\n        ...(p.external === true ? { external: true } : {}),\n        ...(p.public === true ? { public: true } : {}),\n        ...(p.backlink !== undefined ? { backlink: p.backlink } : {}),\n      }]),\n    ),\n  }\n}\n\nexport function blobBinding(cfg: BlobViaConfig): ViaBinding {\n  return {\n    brand: 'blob',\n    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes\n    // in `_blob_chunks` (service-side), not sealed record fields; queryable:\n    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()\n    // is a first-class door; forgettable — shredAllForRecord participates in\n    // vault.forget().\n    posture: { encryptedAtRest: 'envelope', queryable: 'none', exportable: true, forgettable: true },\n    covers: (field) => field in cfg.fields,\n    erase: (ctx) => eraseBlobs(ctx, cfg),\n    describeFragment: () => buildBlobDescribeFragment(cfg.fields),\n  }\n}\n\nexport function linkBlobVia(): void {\n  installViaBinder('blob', (c) => blobBinding(c as BlobViaConfig))\n}\n","/**\n * Strategy seam between core Collection and the optional blob service\n * (#629 Task 7 — moved out of `with-shape/blobs/strategy.ts`, precedent:\n * `port/with/classified-strategy.ts`/`i18n-strategy.ts`). Lives on the\n * `/with` port (the one seam the kernel spine may import statically) so\n * `Collection`/`Vault` can hold the `NO_BLOBS` default without a\n * spine→service static import.\n *\n * Core imports `BlobsStrategy` as a TYPE-ONLY symbol and `NO_BLOBS` as a\n * minimal runtime stub. Neither pulls in the heavy `BlobSet` / chunk /\n * MIME machinery — those only arrive when the consumer explicitly\n * imports `@noy-db/hub/blobs` (see `via/blob/index.ts` →\n * `withBlobs()` factory).\n *\n * This file is intentionally tiny so the bundler keeps it in the graph\n * without dragging everything else in.\n *\n * @internal\n */\n\nimport type { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { ObjectProjection } from '../../with-shape/blobs/object-projection.js'\nimport type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { BlobCacheStats } from '../../with-shape/blobs/blob-pinning.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { linkBlobVia } from '../../via/blob/binding.js'\n\n// Install the blob Via binder EAGERLY (#629 Task 7) — `blobFields` policies\n// are plain object literals (there is no `blob.*()` declaration factory to\n// hang a lazy money/i18n-style link on), so the binder must be installed\n// before `compileViaBindings` ever compiles one. This port module is\n// already unconditionally imported by the kernel spine (for the `NO_BLOBS`\n// strategy default below), so linking here guarantees it — same rationale\n// as `port/with/classified-strategy.ts`'s eager `linkClassifiedVia()`. The\n// binding module is hook-free glue (declare/describe/erase) and imports no\n// machinery, so the eager cost is a few hundred bytes, not `BlobSet`.\nlinkBlobVia()\n\n/**\n * Args forwarded by `Collection.blob(id)` to the active strategy's\n * `openSlot`. The strategy is responsible for returning a live\n * `BlobSet` bound to the given record.\n *\n * @internal\n */\nexport interface BlobsStrategyOpenArgs {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collection: string\n  readonly recordId: string\n  readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  readonly encrypted: boolean\n  readonly userId: string\n  /**\n   * Collection opts into per-record keys (`perRecordKeys`), so its blobs are\n   * erasable: new uploads mint a per-blob content CEK (crypto-shreddable at\n   * `refCount → 0`). Off → legacy shared-`_blob`-DEK chunks. See the per-blob\n   * CEK design spec.\n   */\n  readonly erasableBlobs?: boolean\n  /**\n   * Collection has `tiers` active (#724 I1 completion). Combined with\n   * `erasableBlobs` false, a content write is refused —\n   * `UnsupportedTierCompositionError` — since a legacy blob has no\n   * per-blob `_cek` and can never be tier-isolated on elevate/demote.\n   */\n  readonly tiersActive?: boolean\n  /**\n   * Vault is in debug-plaintext mode (`encrypt: false` + `debugPlaintext: true`).\n   * Blobs are then written as a single un-gzipped object (one base64 chunk) so\n   * the stored object is directly recoverable with native tools (`base64 -d`),\n   * matching the directly-inspectable record layout. Dev-only — see the\n   * plaintext/debug-store-mode design.\n   */\n  readonly debugPlaintext?: boolean\n  /**\n   * Object projection for `external` blob fields (`createNoydb({ objectStore })`).\n   * When present, fields declared `external` in `blobFields` route their raw\n   * bytes here instead of the encrypted-chunk path.\n   */\n  readonly objectStore?: ObjectProjection\n  /** Per-collection blob field policies — used to resolve `external` / `public`. */\n  readonly blobFields?: BlobFieldsConfig\n  /**\n   * The caller's unlocked keyring (#749). Threaded through so `BlobSet.atTier()`\n   * can run `assertTierAccess` — the SAME clearance gate `putAtTier`/`elevate`/\n   * `demote` run before any tier `getDEK` call — rather than relying on a bare\n   * `getDEK`, which auto-mints a DEK for ANY role and never throws (verified: it\n   * is not itself a gate). Omitted only by a construction path that never calls\n   * `atTier()`.\n   */\n  readonly keyring?: UnlockedKeyring\n}\n\n/**\n * The seam interface. `@internal` — do not build public APIs on this\n * shape; it can evolve freely until blobs are extracted into their\n * own package, at which point it will be promoted to public.\n *\n * @internal\n */\nexport interface BlobsStrategy {\n  openSlot(args: BlobsStrategyOpenArgs): BlobSet\n  /**\n   * Snapshot of this device's blob-cache KPI counters: local-read hits,\n   * network misses, and total bytes downloaded from the object store (#808).\n   *\n   * Lives on the seam rather than on the `withBlobs()` return type so the\n   * service has exactly one name (#844b) — `NO_BLOBS` answers with zeros,\n   * which is the truthful reading of \"blobs were never enabled\".\n   */\n  cacheStats(): BlobCacheStats\n}\n\n/**\n * Default strategy for collections that did not opt into blob storage.\n * Every operation surfaces an actionable error that points the caller\n * at the opt-in path.\n *\n * @internal\n */\nexport const NO_BLOBS: BlobsStrategy = {\n  openSlot() {\n    throw new Error(\n      'Blob storage is not enabled on this Noydb instance. ' +\n      'Import `{ withBlobs }` from \"@noy-db/hub/blobs\" and pass `withBlobs()` to `createNoydb({ blobsStrategy: withBlobs() })`.',\n    )\n  },\n  cacheStats() {\n    return { hits: 0, misses: 0, bytesDownloaded: 0 }\n  },\n}\n","/**\n * `vault.exportBlobs()` — bulk blob extraction primitive.\n *\n * Async-iterable handle over every blob attached to records in a\n * vault, optionally filtered by collection allowlist and per-record\n * predicate. Emits tuples of `{ blobId, recordRef, bytes, meta }` so\n * the consumer can pipe into any sink (zip stream, S3 multipart, USB\n * copy, cold-storage tape) without pulling the whole export into\n * memory.\n *\n * ## Auth + audit\n *\n * - Capability check runs **once** at handle creation via\n *   `Vault.assertCanExport('plaintext', 'blob')`. An operator whose\n *   keyring lacks that bit fails before a single byte of ciphertext\n *   is decrypted.\n * - Audit entry lands in `_export_audit` at handle creation: the\n *   actor, start timestamp, target collections, predicate presence,\n *   and batch mechanism. **No content hashes** — per the spec\n *   non-correlation invariant.\n *\n * ## Abort + resume\n *\n * - `handle.abort()` flips the internal signal; the next iteration\n *   boundary throws `AbortError`. Consumers already in `for await`\n *   can catch and exit cleanly.\n * - Restart after a partial failure with `{ afterBlobId }` — the\n *   iterator skips tuples up to (and including) that blob id before\n *   yielding again. Combined with a blob-count ceiling it supports\n *   idempotent batch re-runs.\n *\n * @module\n */\n\nimport type { Collection } from '../../kernel/collection.js'\nimport type { SlotInfo } from '../../kernel/types.js'\n\n// ─── Types ──────────────────────────────────────────────────────────────\n\nexport interface ExportBlobsOptions {\n  /**\n   * Collection allowlist. Omit to export blobs from every collection\n   * the caller has read access to.\n   */\n  readonly collections?: readonly string[]\n  /**\n   * Per-record predicate. Called on the decrypted record BEFORE any\n   * blob bytes are read for that record — returning false skips the\n   * record and all its slots without touching their chunks.\n   */\n  readonly where?: (record: unknown, context: { collection: string; id: string }) => boolean\n  /**\n   * Resume after a specific blob id. The iterator skips tuples up to\n   * and including this id, then yields. Format of the id is the same\n   * as `ExportedBlob.blobId` (the HMAC-keyed eTag).\n   */\n  readonly afterBlobId?: string\n  /**\n   * External abort signal. When fired, the next iterator tick throws\n   * `ExportBlobsAbortedError`. Honored alongside `handle.abort()`.\n   */\n  readonly signal?: AbortSignal\n}\n\nexport interface ExportedBlob {\n  /** Opaque blob identifier — HMAC-keyed eTag, stable across vaults. */\n  readonly blobId: string\n  /** Where this blob came from in the vault. */\n  readonly recordRef: {\n    readonly collection: string\n    readonly id: string\n    readonly slot: string\n  }\n  /** Decrypted plaintext bytes. */\n  readonly bytes: Uint8Array\n  /** Best-effort metadata (from the blob slot record). */\n  readonly meta: {\n    readonly size: number\n    /**\n     * User-visible filename stored on the slot. Often equal to the\n     * slot name; differs when the caller supplied an explicit\n     * `filename` to `BlobSet.put()`.\n     */\n    readonly filename: string\n    readonly mimeType?: string\n    readonly createdAt?: string\n  }\n}\n\nexport interface ExportBlobsHandle extends AsyncIterable<ExportedBlob> {\n  /** Abort the export. Safe to call multiple times. */\n  abort(): void\n  /** True once `abort()` has fired or the external signal aborted. */\n  readonly aborted: boolean\n}\n\nexport class ExportBlobsAbortedError extends Error {\n  constructor(reason: string) {\n    super(`exportBlobs aborted: ${reason}`)\n    this.name = 'ExportBlobsAbortedError'\n  }\n}\n\n// ─── Audit ──────────────────────────────────────────────────────────────\n\nexport const EXPORT_AUDIT_COLLECTION = '_export_audit'\n\nexport interface ExportBlobsAuditEntry {\n  readonly id: string\n  readonly mechanism: 'exportBlobs'\n  readonly actor: string\n  readonly startedAt: string\n  readonly collections: readonly string[] | null\n  readonly predicate: boolean\n  readonly afterBlobId: string | null\n}\n\n// ─── Implementation ─────────────────────────────────────────────────────\n\n/**\n * Build the handle. Factored out of `Vault.exportBlobs` so the\n * implementation can be unit-tested without going through the\n * compartment lifecycle.\n */\nexport function createExportBlobsHandle(\n  actor: string,\n  listAccessibleCollections: () => Promise<string[]>,\n  getCollection: <T>(name: string) => Collection<T>,\n  writeAudit: (entry: ExportBlobsAuditEntry) => Promise<void>,\n  options: ExportBlobsOptions,\n): ExportBlobsHandle {\n  let aborted = false\n\n  const abort = (): void => {\n    aborted = true\n  }\n\n  if (options.signal) {\n    if (options.signal.aborted) aborted = true\n    options.signal.addEventListener('abort', () => { aborted = true })\n  }\n\n  function assertLive(): void {\n    if (aborted) throw new ExportBlobsAbortedError('aborted by caller')\n  }\n\n  const allowlist = options.collections ? new Set(options.collections) : null\n\n  // Write the audit entry BEFORE the first yield so a blocked\n  // iteration still leaves an audit trail that the export started.\n  let auditPromise: Promise<void> | null = null\n  function writeAuditOnce(): Promise<void> {\n    if (!auditPromise) {\n      auditPromise = writeAudit({\n        id: generateBatchId(),\n        mechanism: 'exportBlobs',\n        actor,\n        startedAt: new Date().toISOString(),\n        collections: options.collections ?? null,\n        predicate: Boolean(options.where),\n        afterBlobId: options.afterBlobId ?? null,\n      })\n    }\n    return auditPromise\n  }\n\n  async function* generate(): AsyncGenerator<ExportedBlob> {\n    await writeAuditOnce()\n    assertLive()\n\n    // Resolve target collections lazily — also keeps the call async.\n    const allCollections = await listAccessibleCollections()\n    const targets = allCollections.filter(name => {\n      if (name.startsWith('_')) return false\n      if (allowlist && !allowlist.has(name)) return false\n      return true\n    })\n\n    let resumeCursorHit = options.afterBlobId === undefined\n\n    for (const collectionName of targets) {\n      if (aborted) return\n\n      const coll = getCollection<Record<string, unknown>>(collectionName)\n      const records = await coll.list().catch(() => [])\n      for (const record of records) {\n        if (aborted) return\n        assertLive()\n\n        const idField = (record as { id?: unknown }).id\n        if (typeof idField !== 'string') continue\n\n        if (options.where && !options.where(record, { collection: collectionName, id: idField })) continue\n\n        const blobSet = coll.blob(idField)\n        const slots = await blobSet.list().catch(() => [] as SlotInfo[])\n        for (const slot of slots) {\n          if (aborted) return\n\n          if (!resumeCursorHit) {\n            if (slot.eTag === options.afterBlobId) {\n              resumeCursorHit = true\n            }\n            continue\n          }\n\n          const bytes = await blobSet.get(slot.name)\n          if (!bytes) continue\n\n          const item: ExportedBlob = {\n            blobId: slot.eTag,\n            recordRef: { collection: collectionName, id: idField, slot: slot.name },\n            bytes,\n            meta: {\n              size: slot.size,\n              filename: slot.filename,\n              ...(slot.mimeType !== undefined && { mimeType: slot.mimeType }),\n              ...(slot.uploadedAt !== undefined && { createdAt: slot.uploadedAt }),\n            },\n          }\n          yield item\n        }\n      }\n    }\n  }\n\n  const handle: ExportBlobsHandle = {\n    abort,\n    get aborted() { return aborted },\n    [Symbol.asyncIterator]: () => generate(),\n  }\n  return handle\n}\n\n// ─── Helpers ────────────────────────────────────────────────────────────\n\nfunction generateBatchId(): string {\n  // 16 bytes of crypto randomness, URL-safe base64, no padding.\n  const raw = globalThis.crypto.getRandomValues(new Uint8Array(16))\n  let s = ''\n  for (const b of raw) s += b.toString(16).padStart(2, '0')\n  return `batch-${Date.now().toString(36)}-${s.slice(0, 12)}`\n}\n","/**\n * Blob retention + compaction.\n *\n * Declarative per-collection / per-slot eviction policy. Two\n * triggers:\n *\n *   - **`retainDays`** — age-based TTL. A slot uploaded more than N\n *     days ago is evicted.\n *   - **`evictWhen(record)`** — predicate over the **decrypted**\n *     record. Lets consumers express \"the image is safe to drop once\n *     the structured invoice has been reviewed and confirmed.\"\n *\n * Either trigger (or both) causes the slot to evict. Eviction removes\n * the slot entry from `_blob_slots_{collection}`, decrements the\n * blob's refCount (so unreferenced chunks can be GC'd by the next\n * sweep), and writes one entry to the `_blob_eviction_audit`\n * collection for tamper-evident record-keeping.\n *\n * The audit entry carries the eTag of the evicted blob (opaque HMAC\n * of plaintext under the vault's `_blob` DEK) — no plaintext leakage,\n * per the SPEC non-correlation invariant. Consumers reconstructing\n * \"what used to be attached\" can look up the audit entry by record\n * id.\n *\n * Compaction is **consumer-scheduled** — noy-db never runs a\n * background daemon. Call `vault.compact()` whenever your workflow\n * allows (cron, manual \"tidy\" button, cold-storage export prep, …).\n *\n * @module\n */\n\nimport type { NoydbStore, EncryptedEnvelope, SlotInfo } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { ValidationError } from '../../kernel/errors.js'\nimport { encrypt, type EnclaveKey } from '../../kernel/enclave/index.js'\n\n// ─── Config types ───────────────────────────────────────────────────────\n\nexport interface BlobFieldPolicy<T = unknown> {\n  /**\n   * Via port brand marker — lets a `BlobFieldPolicy` satisfy the kernel's\n   * opaque `ViaDescriptor` (#629 Task 7). Optional (the\n   * `ClassifiedFieldSpec._viaBrand` precedent): `blobFields` policies are\n   * plain object literals with no declaration factory to stamp it, so a\n   * mandatory field would break every existing declaration.\n   */\n  readonly _viaBrand?: 'blob'\n  /**\n   * Age-based TTL in days. A slot whose `uploadedAt` is older than\n   * `now - retainDays × 86400s` evicts on the next `vault.compact()`.\n   * Omit to disable age-based eviction.\n   */\n  readonly retainDays?: number\n  /**\n   * Predicate evaluated against the decrypted record. When it returns\n   * `true`, every matching slot on that record evicts. Omit to\n   * disable predicate-based eviction.\n   */\n  readonly evictWhen?: (record: T) => boolean\n  /**\n   * **Legal hold.** When this predicate returns `true`, the slot is\n   * never evicted — `retainDays`/`evictWhen` are overridden. Use for a\n   * litigation / audit hold on a fiscal document: the blob stays until\n   * the predicate returns `false` (the hold is released). Fail-closed:\n   * if the predicate throws, the slot is treated as held.\n   */\n  readonly legalHold?: (record: T) => boolean\n  /**\n   * **Period-bound retention.** Returns the date (Date / ISO string /\n   * epoch ms) until which the slot must be retained — typically derived\n   * from the record's fiscal period (e.g. period end + 10 years). While\n   * `now < retainUntil`, the slot is never evicted, regardless of\n   * `retainDays`. Return `null`/`undefined` to impose no floor.\n   * Fail-closed: a throwing function holds the slot.\n   */\n  readonly retainUntil?: (record: T) => Date | string | number | null | undefined\n  /**\n   * **External projection.** When `true`, this field's bytes are stored in the\n   * vault's `ObjectProjection` (`createNoydb({ objectStore })`) as a single raw,\n   * **unencrypted** object — servable directly from S3/CDN and processable by\n   * native tooling — instead of the encrypted-chunk path. The encrypted slot\n   * record remains the catalog (anchoring invariant). Requires an `objectStore`;\n   * **outside the zero-knowledge guarantee** — use only for assets meant to\n   * leave the vault. See the as-aws-s3 design spec.\n   */\n  readonly external?: boolean\n  /**\n   * For an `external` field: make the object world-readable (CDN origin) rather\n   * than presigned-only. Default `false` (presigned). Ignored unless `external`.\n   */\n  readonly public?: boolean\n  /**\n   * For an `external` field: how to stamp a **backlink** (this record's\n   * vault/collection/id/field) onto the object's metadata — the self-describing\n   * \"secondary store\" that powers reconcile / DR / import re-pairing.\n   * - `'opaque-token'` (default): a random id; preserves the opaque-bucket\n   *   property (no names leak); the token is also recorded on the slot.\n   * - `'encrypted'`: the reference encrypted under the blob DEK (ZK-preserving;\n   *   falls back to `'opaque-token'` on a plaintext vault).\n   * - `'plain'`: the reference in cleartext metadata — **leaks structure** to\n   *   bucket readers; only for non-sensitive deployments.\n   * - `'none'`: no backlink.\n   */\n  readonly backlink?: 'opaque-token' | 'encrypted' | 'plain' | 'none'\n}\n\nexport type BlobFieldsConfig<T = unknown> = Record<string, BlobFieldPolicy<T>>\n\n// ─── Audit collection ──────────────────────────────────────────────────\n\nexport const BLOB_EVICTION_AUDIT_COLLECTION = '_blob_eviction_audit'\n\nexport interface BlobEvictionEntry {\n  readonly id: string\n  readonly collection: string\n  readonly recordId: string\n  readonly slotName: string\n  readonly blobHash: string\n  /** `'budget'` — evicted by the #808 cache-budget LRU pass, not a policy. */\n  readonly reason: 'ttl' | 'predicate' | 'both' | 'budget'\n  readonly evictedAt: string\n  readonly actor: string\n}\n\n// ─── Compaction result ──────────────────────────────────────────────────\n\nexport interface CompactionResult {\n  /** Number of blob slots evicted by the policy pass across all collections. */\n  readonly evicted: number\n  /** Number of records touched (iterated + policy checked). */\n  readonly records: number\n  /** Number of collections with `blobFields` configured. */\n  readonly collections: number\n  /**\n   * Number of audit entries written — one per policy eviction plus one per\n   * budget SLOT eviction (dropping a device-local cache copy writes none).\n   */\n  readonly auditEntries: number\n  /**\n   * Number of slots that would have evicted (TTL/predicate triggered)\n   * but were retained by a `legalHold` or `retainUntil` floor.\n   */\n  readonly held: number\n  /**\n   * #808: number of slots whose due policy eviction was skipped because they\n   * are pinned for offline on THIS device (pin state is device-local).\n   */\n  readonly pinned: number\n  /**\n   * #808: number of evictions performed by the `cacheBudget` LRU pass —\n   * internal slots evicted through the standard eviction writer plus\n   * device-local external cache copies dropped. 0 when no budget was given.\n   */\n  readonly budgetEvicted: number\n  /** #808: plaintext bytes freed by the `cacheBudget` LRU pass. */\n  readonly budgetBytesFreed: number\n  /** Per-collection breakdown for diagnostics. */\n  readonly byCollection: Record<string, { records: number; evicted: number }>\n}\n\n// ─── Core ──────────────────────────────────────────────────────────────\n\nexport interface CompactRunOptions {\n  /** Override \"now\" for deterministic testing. */\n  readonly now?: Date\n  /**\n   * Stop after this many evictions. Useful for capped batches / cron\n   * jobs that need to fit in a time window. `undefined` = unbounded.\n   */\n  readonly maxEvictions?: number\n  /**\n   * Dry-run — evaluate policies and return the counts, but do NOT\n   * delete slots or write audit entries. Lets a consumer preview\n   * what would happen.\n   */\n  readonly dryRun?: boolean\n  /**\n   * #808 mobile cache budget: cap the locally-cached UNPINNED blob bytes.\n   * After the policy pass, a dedicated LRU pass walks every collection's\n   * slots (pinned slots and `legalHold`/`retainUntil`-held slots are exempt\n   * and uncounted) and evicts oldest-access-first — internal slots through\n   * the standard eviction writer (`deleteSlot` + a `'budget'` audit entry),\n   * external slots by dropping their device-local encrypted cache copy only\n   * (the object-store copy is authoritative and untouched) — until the\n   * remaining unpinned bytes fit `maxBytes`. Internal slots count their\n   * uncompressed `size`; external slots count `cachedBytes` (0 = nothing\n   * local, nothing to evict). LRU order comes from the device-local\n   * `lastAccessAt` stamp, falling back to `uploadedAt`.\n   */\n  readonly cacheBudget?: { readonly maxBytes: number }\n}\n\nexport interface CompactionContext {\n  readonly adapter: NoydbStore\n  readonly vault: string\n  readonly actor: string\n  readonly encrypted: boolean\n  readonly getDEK: (collection: string) => Promise<EnclaveKey>\n  /**\n   * Resolve a collection's declared `blobFields` config. Returns an\n   * empty map for collections without the config — the walk skips\n   * those.\n   */\n  readonly getBlobFields: <T>(collection: string) => BlobFieldsConfig<T> | null\n  /** List collection names in the vault. */\n  readonly listCollections: () => Promise<string[]>\n  /** List record ids in a collection. */\n  readonly listRecords: (collection: string) => Promise<string[]>\n  /** Decrypt and return the record. Null when absent. */\n  readonly getRecord: <T>(collection: string, id: string) => Promise<T | null>\n  /** Return the BlobSet-like handle for a record's slots. */\n  readonly listSlots: (collection: string, id: string) => Promise<SlotInfo[]>\n  /** Delete a slot and decrement its blob's refCount. */\n  readonly deleteSlot: (collection: string, id: string, slotName: string) => Promise<void>\n  /**\n   * #808: drop a slot's DEVICE-LOCAL cached copy (the encrypted external\n   * side-cache) without touching the slot or the object store. Returns the\n   * plaintext bytes freed. Optional — absent (or a 0 return) means external\n   * cache entries simply cannot be budget-evicted through this context.\n   */\n  readonly dropLocalCache?: (collection: string, id: string, slotName: string) => Promise<number>\n}\n\nexport async function runCompaction(\n  ctx: CompactionContext,\n  options: CompactRunOptions = {},\n): Promise<CompactionResult> {\n  const now = options.now ?? new Date()\n  const maxEvictions = options.maxEvictions ?? Infinity\n  const dryRun = options.dryRun === true\n  if (options.cacheBudget !== undefined\n    && (!Number.isFinite(options.cacheBudget.maxBytes) || options.cacheBudget.maxBytes < 0)) {\n    throw new ValidationError('compact(): cacheBudget.maxBytes must be a non-negative finite number (#808)')\n  }\n\n  const allCollections = await ctx.listCollections()\n  const byCollection: Record<string, { records: number; evicted: number }> = {}\n  let evicted = 0\n  let records = 0\n  let auditEntries = 0\n  let held = 0\n  let pinned = 0\n  let collectionsWithPolicy = 0\n\n  outer: for (const collectionName of allCollections) {\n    if (collectionName.startsWith('_')) continue\n    const config = ctx.getBlobFields(collectionName)\n    if (!config) continue\n    const configuredSlots = Object.keys(config)\n    if (configuredSlots.length === 0) continue\n    collectionsWithPolicy += 1\n    byCollection[collectionName] = { records: 0, evicted: 0 }\n\n    const ids = await ctx.listRecords(collectionName)\n    for (const recordId of ids) {\n      if (evicted >= maxEvictions) break outer\n\n      const record = await ctx.getRecord(collectionName, recordId).catch(() => null)\n      if (record === null) continue\n      records += 1\n      byCollection[collectionName].records += 1\n\n      const slots = await ctx.listSlots(collectionName, recordId).catch(() => [])\n      for (const slot of slots) {\n        if (evicted >= maxEvictions) break outer\n        const policy = config[slot.name]\n        if (!policy) continue\n\n        const reason = evaluatePolicy(policy, record, slot, now)\n        if (!reason) continue\n\n        // #808: device-local offline pin — an exemption inside this existing\n        // pass, exactly like a hold: counted, never evicted. `slot.pinned` is\n        // the device-local annotation `BlobSet.list()` stamps from the\n        // withBlobs() pin registry (never synced state).\n        if (slot.pinned === true) {\n          pinned += 1\n          continue\n        }\n\n        // Retention floor: a legal hold or period-bound retainUntil\n        // blocks an otherwise-due eviction. Counted, never evicted.\n        if (isHeld(policy, record, now)) {\n          held += 1\n          continue\n        }\n\n        if (!dryRun) {\n          await ctx.deleteSlot(collectionName, recordId, slot.name)\n          await writeAuditEntry(ctx, {\n            id: generateEvictionId(collectionName, recordId, slot.name),\n            collection: collectionName,\n            recordId,\n            slotName: slot.name,\n            blobHash: slot.eTag,\n            reason,\n            evictedAt: now.toISOString(),\n            actor: ctx.actor,\n          })\n          auditEntries += 1\n        }\n        evicted += 1\n        byCollection[collectionName].evicted += 1\n      }\n    }\n  }\n\n  // #808: cache-budget LRU pass — runs AFTER the policy pass so a slot that\n  // just evicted no longer counts toward the budget. Reuses this module's own\n  // eviction writer (deleteSlot + audit), never a parallel one.\n  let budgetEvicted = 0\n  let budgetBytesFreed = 0\n  if (options.cacheBudget !== undefined) {\n    const pass = await runBudgetPass(ctx, options.cacheBudget.maxBytes, {\n      now, dryRun, remainingEvictions: maxEvictions - evicted,\n    })\n    budgetEvicted = pass.evicted\n    budgetBytesFreed = pass.bytesFreed\n    auditEntries += pass.auditEntries\n  }\n\n  return {\n    evicted,\n    records,\n    collections: collectionsWithPolicy,\n    auditEntries,\n    held,\n    pinned,\n    budgetEvicted,\n    budgetBytesFreed,\n    byCollection,\n  }\n}\n\n// ─── #808: cache-budget LRU pass ───────────────────────────────────────\n\ninterface BudgetCandidate {\n  readonly collection: string\n  readonly recordId: string\n  readonly slotName: string\n  readonly eTag: string\n  readonly bytes: number\n  /** `'slot'` — internal blob, evicted via `deleteSlot`; `'cache'` — external device-local copy, dropped via `dropLocalCache`. */\n  readonly kind: 'slot' | 'cache'\n  readonly lastAccessMs: number\n}\n\n/**\n * Enforce `cacheBudget.maxBytes` over the locally-cached UNPINNED blob bytes\n * (see {@link CompactRunOptions.cacheBudget} for the full contract). Walks\n * EVERY collection — unlike the policy pass, the budget is not gated on a\n * declared `blobFields` config — but still honors a declared policy's\n * `legalHold`/`retainUntil` floor where one exists.\n */\nasync function runBudgetPass(\n  ctx: CompactionContext,\n  maxBytes: number,\n  opts: { now: Date; dryRun: boolean; remainingEvictions: number },\n): Promise<{ evicted: number; bytesFreed: number; auditEntries: number }> {\n  const candidates: BudgetCandidate[] = []\n  let total = 0\n\n  for (const collectionName of await ctx.listCollections()) {\n    if (collectionName.startsWith('_')) continue\n    const config = ctx.getBlobFields(collectionName)\n    for (const recordId of await ctx.listRecords(collectionName)) {\n      const slots = await ctx.listSlots(collectionName, recordId).catch(() => [])\n      if (slots.length === 0) continue\n      // The record is only needed to evaluate a declared policy's retention\n      // floor — skip the decrypt entirely for policy-less collections.\n      const record = config\n        ? await ctx.getRecord<unknown>(collectionName, recordId).catch(() => null)\n        : null\n      for (const slot of slots) {\n        if (slot.pinned === true) continue // pinned: exempt AND uncounted (#808)\n        const policy = config?.[slot.name]\n        if (policy && record !== null && isHeld(policy, record, opts.now)) continue // floor blocks budget too\n        const lastAccessMs = Date.parse(slot.lastAccessAt ?? slot.uploadedAt) || 0\n        const isExternal = slot.external !== undefined\n        const bytes = isExternal ? slot.cachedBytes ?? 0 : slot.size\n        if (bytes <= 0) continue // external with no local copy: nothing cached to evict\n        total += bytes\n        candidates.push({\n          collection: collectionName, recordId, slotName: slot.name, eTag: slot.eTag,\n          bytes, kind: isExternal ? 'cache' : 'slot', lastAccessMs,\n        })\n      }\n    }\n  }\n\n  // Oldest access first; deterministic tiebreak so equal timestamps (common\n  // within one ms) never make the eviction order flap between runs.\n  candidates.sort((a, b) =>\n    a.lastAccessMs - b.lastAccessMs\n    || a.collection.localeCompare(b.collection)\n    || a.recordId.localeCompare(b.recordId)\n    || a.slotName.localeCompare(b.slotName))\n\n  let evicted = 0\n  let bytesFreed = 0\n  let auditEntries = 0\n  for (const c of candidates) {\n    if (total <= maxBytes || evicted >= opts.remainingEvictions) break\n    if (!opts.dryRun) {\n      if (c.kind === 'slot') {\n        await ctx.deleteSlot(c.collection, c.recordId, c.slotName)\n        await writeAuditEntry(ctx, {\n          id: generateEvictionId(c.collection, c.recordId, c.slotName),\n          collection: c.collection,\n          recordId: c.recordId,\n          slotName: c.slotName,\n          blobHash: c.eTag,\n          reason: 'budget',\n          evictedAt: opts.now.toISOString(),\n          actor: ctx.actor,\n        })\n        auditEntries += 1\n      } else {\n        // Device-local cache drop only — the slot (catalog) and the\n        // object-store copy are untouched, so no eviction audit entry.\n        await ctx.dropLocalCache?.(c.collection, c.recordId, c.slotName)\n      }\n    }\n    evicted += 1\n    bytesFreed += c.bytes\n    total -= c.bytes\n  }\n\n  return { evicted, bytesFreed, auditEntries }\n}\n\n/**\n * Whether a retention floor (legal hold or period-bound `retainUntil`)\n * currently blocks eviction of this record's slots. Fail-closed: a\n * throwing predicate holds the slot.\n */\nfunction isHeld<T>(policy: BlobFieldPolicy<T>, record: T, now: Date): boolean {\n  if (policy.legalHold) {\n    try {\n      if (policy.legalHold(record)) return true\n    } catch {\n      return true\n    }\n  }\n  if (policy.retainUntil) {\n    try {\n      const until = policy.retainUntil(record)\n      if (until !== null && until !== undefined) {\n        const t = until instanceof Date ? until.getTime() : typeof until === 'number' ? until : Date.parse(String(until))\n        if (!Number.isFinite(t)) return true   // fail-closed: unparseable retainUntil holds the slot\n        if (t > now.getTime()) return true\n      }\n    } catch {\n      return true\n    }\n  }\n  return false\n}\n\nfunction evaluatePolicy<T>(\n  policy: BlobFieldPolicy<T>,\n  record: T,\n  slot: SlotInfo,\n  now: Date,\n): 'ttl' | 'predicate' | 'both' | null {\n  let ttlTriggered = false\n  let predicateTriggered = false\n\n  if (policy.retainDays !== undefined && policy.retainDays > 0) {\n    const uploadedAt = Date.parse(slot.uploadedAt)\n    if (Number.isFinite(uploadedAt)) {\n      const ageMs = now.getTime() - uploadedAt\n      const limitMs = policy.retainDays * 86_400_000\n      if (ageMs > limitMs) ttlTriggered = true\n    }\n  }\n\n  if (policy.evictWhen) {\n    try {\n      if (policy.evictWhen(record)) predicateTriggered = true\n    } catch {\n      // Predicate error → do NOT evict. Fail closed.\n    }\n  }\n\n  if (ttlTriggered && predicateTriggered) return 'both'\n  if (ttlTriggered) return 'ttl'\n  if (predicateTriggered) return 'predicate'\n  return null\n}\n\nfunction generateEvictionId(collection: string, recordId: string, slotName: string): string {\n  const rand = globalThis.crypto.getRandomValues(new Uint8Array(8))\n  let suffix = ''\n  for (const b of rand) suffix += b.toString(16).padStart(2, '0')\n  return `${collection}__${recordId}__${slotName}__${suffix}`\n}\n\nasync function writeAuditEntry(ctx: CompactionContext, entry: BlobEvictionEntry): Promise<void> {\n  const json = JSON.stringify(entry)\n  let envelope: EncryptedEnvelope\n  if (ctx.encrypted) {\n    const dek = await ctx.getDEK(BLOB_EVICTION_AUDIT_COLLECTION)\n    const { iv, data } = await encrypt(json, dek)\n    envelope = {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: 1,\n      _ts: entry.evictedAt,\n      _iv: iv,\n      _data: data,\n      _by: entry.actor,\n    }\n  } else {\n    envelope = {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: 1,\n      _ts: entry.evictedAt,\n      _iv: '',\n      _data: json,\n      _by: entry.actor,\n    }\n  }\n  await ctx.adapter.put(ctx.vault, BLOB_EVICTION_AUDIT_COLLECTION, entry.id, envelope)\n}\n"],"mappings":";;;;;;;;;;;;;;AAuEA,eAAe,WAAW,KAAkB,KAA6C;AACvF,MAAI,IAAI,oBAAqB,QAAO,IAAI,oBAAoB,IAAI,EAAE;AAClE,SAAO,EAAE,UAAU,GAAG,SAAS,CAAC,EAAE;AACpC;AAgCA,SAAS,0BAA0B,QAAmD;AACpF,SAAO;AAAA,IACL,YAAY,OAAO;AAAA,MACjB,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;AAAA,QACjD,GAAI,EAAE,eAAe,SAAY,EAAE,YAAY,EAAE,WAAW,IAAI,CAAC;AAAA,QACjE,GAAI,EAAE,cAAc,SAAY,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,QACvD,GAAI,EAAE,cAAc,SAAY,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,QACvD,GAAI,EAAE,gBAAgB,SAAY,EAAE,aAAa,KAAK,IAAI,CAAC;AAAA,QAC3D,GAAI,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;AAAA,QAChD,GAAI,EAAE,WAAW,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;AAAA,QAC5C,GAAI,EAAE,aAAa,SAAY,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7D,CAAC,CAAC;AAAA,IACJ;AAAA,EACF;AACF;AAEO,SAAS,YAAY,KAAgC;AAC1D,SAAO;AAAA,IACL,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMP,SAAS,EAAE,iBAAiB,YAAY,WAAW,QAAQ,YAAY,MAAM,aAAa,KAAK;AAAA,IAC/F,QAAQ,CAAC,UAAU,SAAS,IAAI;AAAA,IAChC,OAAO,CAAC,QAAQ,WAAW,KAAK,GAAG;AAAA,IACnC,kBAAkB,MAAM,0BAA0B,IAAI,MAAM;AAAA,EAC9D;AACF;AAEO,SAAS,cAAoB;AAClC,mBAAiB,QAAQ,CAAC,MAAM,YAAY,CAAkB,CAAC;AACjE;;;ACrGA,YAAY;AAqFL,IAAM,WAA0B;AAAA,EACrC,WAAW;AACT,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAAA,EACA,aAAa;AACX,WAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,iBAAiB,EAAE;AAAA,EAClD;AACF;;;ACrCO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,QAAgB;AAC1B,UAAM,wBAAwB,MAAM,EAAE;AACtC,SAAK,OAAO;AAAA,EACd;AACF;AAIO,IAAM,0BAA0B;AAmBhC,SAAS,wBACd,OACA,2BACA,eACA,YACA,SACmB;AACnB,MAAI,UAAU;AAEd,QAAM,QAAQ,MAAY;AACxB,cAAU;AAAA,EACZ;AAEA,MAAI,QAAQ,QAAQ;AAClB,QAAI,QAAQ,OAAO,QAAS,WAAU;AACtC,YAAQ,OAAO,iBAAiB,SAAS,MAAM;AAAE,gBAAU;AAAA,IAAK,CAAC;AAAA,EACnE;AAEA,WAAS,aAAmB;AAC1B,QAAI,QAAS,OAAM,IAAI,wBAAwB,mBAAmB;AAAA,EACpE;AAEA,QAAM,YAAY,QAAQ,cAAc,IAAI,IAAI,QAAQ,WAAW,IAAI;AAIvE,MAAI,eAAqC;AACzC,WAAS,iBAAgC;AACvC,QAAI,CAAC,cAAc;AACjB,qBAAe,WAAW;AAAA,QACxB,IAAI,gBAAgB;AAAA,QACpB,WAAW;AAAA,QACX;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,aAAa,QAAQ,eAAe;AAAA,QACpC,WAAW,QAAQ,QAAQ,KAAK;AAAA,QAChC,aAAa,QAAQ,eAAe;AAAA,MACtC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,kBAAgB,WAAyC;AACvD,UAAM,eAAe;AACrB,eAAW;AAGX,UAAM,iBAAiB,MAAM,0BAA0B;AACvD,UAAM,UAAU,eAAe,OAAO,UAAQ;AAC5C,UAAI,KAAK,WAAW,GAAG,EAAG,QAAO;AACjC,UAAI,aAAa,CAAC,UAAU,IAAI,IAAI,EAAG,QAAO;AAC9C,aAAO;AAAA,IACT,CAAC;AAED,QAAI,kBAAkB,QAAQ,gBAAgB;AAE9C,eAAW,kBAAkB,SAAS;AACpC,UAAI,QAAS;AAEb,YAAM,OAAO,cAAuC,cAAc;AAClE,YAAM,UAAU,MAAM,KAAK,KAAK,EAAE,MAAM,MAAM,CAAC,CAAC;AAChD,iBAAW,UAAU,SAAS;AAC5B,YAAI,QAAS;AACb,mBAAW;AAEX,cAAM,UAAW,OAA4B;AAC7C,YAAI,OAAO,YAAY,SAAU;AAEjC,YAAI,QAAQ,SAAS,CAAC,QAAQ,MAAM,QAAQ,EAAE,YAAY,gBAAgB,IAAI,QAAQ,CAAC,EAAG;AAE1F,cAAM,UAAU,KAAK,KAAK,OAAO;AACjC,cAAM,QAAQ,MAAM,QAAQ,KAAK,EAAE,MAAM,MAAM,CAAC,CAAe;AAC/D,mBAAW,QAAQ,OAAO;AACxB,cAAI,QAAS;AAEb,cAAI,CAAC,iBAAiB;AACpB,gBAAI,KAAK,SAAS,QAAQ,aAAa;AACrC,gCAAkB;AAAA,YACpB;AACA;AAAA,UACF;AAEA,gBAAM,QAAQ,MAAM,QAAQ,IAAI,KAAK,IAAI;AACzC,cAAI,CAAC,MAAO;AAEZ,gBAAM,OAAqB;AAAA,YACzB,QAAQ,KAAK;AAAA,YACb,WAAW,EAAE,YAAY,gBAAgB,IAAI,SAAS,MAAM,KAAK,KAAK;AAAA,YACtE;AAAA,YACA,MAAM;AAAA,cACJ,MAAM,KAAK;AAAA,cACX,UAAU,KAAK;AAAA,cACf,GAAI,KAAK,aAAa,UAAa,EAAE,UAAU,KAAK,SAAS;AAAA,cAC7D,GAAI,KAAK,eAAe,UAAa,EAAE,WAAW,KAAK,WAAW;AAAA,YACpE;AAAA,UACF;AACA,gBAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAA4B;AAAA,IAChC;AAAA,IACA,IAAI,UAAU;AAAE,aAAO;AAAA,IAAQ;AAAA,IAC/B,CAAC,OAAO,aAAa,GAAG,MAAM,SAAS;AAAA,EACzC;AACA,SAAO;AACT;AAIA,SAAS,kBAA0B;AAEjC,QAAM,MAAM,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAChE,MAAI,IAAI;AACR,aAAW,KAAK,IAAK,MAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACxD,SAAO,SAAS,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC;AAC3D;;;ACpIO,IAAM,iCAAiC;AAiH9C,eAAsB,cACpB,KACA,UAA6B,CAAC,GACH;AAC3B,QAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,SAAS,QAAQ,WAAW;AAClC,MAAI,QAAQ,gBAAgB,WACtB,CAAC,OAAO,SAAS,QAAQ,YAAY,QAAQ,KAAK,QAAQ,YAAY,WAAW,IAAI;AACzF,UAAM,IAAI,gBAAgB,6EAA6E;AAAA,EACzG;AAEA,QAAM,iBAAiB,MAAM,IAAI,gBAAgB;AACjD,QAAM,eAAqE,CAAC;AAC5E,MAAI,UAAU;AACd,MAAI,UAAU;AACd,MAAI,eAAe;AACnB,MAAI,OAAO;AACX,MAAI,SAAS;AACb,MAAI,wBAAwB;AAE5B,QAAO,YAAW,kBAAkB,gBAAgB;AAClD,QAAI,eAAe,WAAW,GAAG,EAAG;AACpC,UAAM,SAAS,IAAI,cAAc,cAAc;AAC/C,QAAI,CAAC,OAAQ;AACb,UAAM,kBAAkB,OAAO,KAAK,MAAM;AAC1C,QAAI,gBAAgB,WAAW,EAAG;AAClC,6BAAyB;AACzB,iBAAa,cAAc,IAAI,EAAE,SAAS,GAAG,SAAS,EAAE;AAExD,UAAM,MAAM,MAAM,IAAI,YAAY,cAAc;AAChD,eAAW,YAAY,KAAK;AAC1B,UAAI,WAAW,aAAc,OAAM;AAEnC,YAAM,SAAS,MAAM,IAAI,UAAU,gBAAgB,QAAQ,EAAE,MAAM,MAAM,IAAI;AAC7E,UAAI,WAAW,KAAM;AACrB,iBAAW;AACX,mBAAa,cAAc,EAAE,WAAW;AAExC,YAAM,QAAQ,MAAM,IAAI,UAAU,gBAAgB,QAAQ,EAAE,MAAM,MAAM,CAAC,CAAC;AAC1E,iBAAW,QAAQ,OAAO;AACxB,YAAI,WAAW,aAAc,OAAM;AACnC,cAAM,SAAS,OAAO,KAAK,IAAI;AAC/B,YAAI,CAAC,OAAQ;AAEb,cAAM,SAAS,eAAe,QAAQ,QAAQ,MAAM,GAAG;AACvD,YAAI,CAAC,OAAQ;AAMb,YAAI,KAAK,WAAW,MAAM;AACxB,oBAAU;AACV;AAAA,QACF;AAIA,YAAI,OAAO,QAAQ,QAAQ,GAAG,GAAG;AAC/B,kBAAQ;AACR;AAAA,QACF;AAEA,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI,WAAW,gBAAgB,UAAU,KAAK,IAAI;AACxD,gBAAM,gBAAgB,KAAK;AAAA,YACzB,IAAI,mBAAmB,gBAAgB,UAAU,KAAK,IAAI;AAAA,YAC1D,YAAY;AAAA,YACZ;AAAA,YACA,UAAU,KAAK;AAAA,YACf,UAAU,KAAK;AAAA,YACf;AAAA,YACA,WAAW,IAAI,YAAY;AAAA,YAC3B,OAAO,IAAI;AAAA,UACb,CAAC;AACD,0BAAgB;AAAA,QAClB;AACA,mBAAW;AACX,qBAAa,cAAc,EAAE,WAAW;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AAKA,MAAI,gBAAgB;AACpB,MAAI,mBAAmB;AACvB,MAAI,QAAQ,gBAAgB,QAAW;AACrC,UAAM,OAAO,MAAM,cAAc,KAAK,QAAQ,YAAY,UAAU;AAAA,MAClE;AAAA,MAAK;AAAA,MAAQ,oBAAoB,eAAe;AAAA,IAClD,CAAC;AACD,oBAAgB,KAAK;AACrB,uBAAmB,KAAK;AACxB,oBAAgB,KAAK;AAAA,EACvB;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAsBA,eAAe,cACb,KACA,UACA,MACwE;AACxE,QAAM,aAAgC,CAAC;AACvC,MAAI,QAAQ;AAEZ,aAAW,kBAAkB,MAAM,IAAI,gBAAgB,GAAG;AACxD,QAAI,eAAe,WAAW,GAAG,EAAG;AACpC,UAAM,SAAS,IAAI,cAAc,cAAc;AAC/C,eAAW,YAAY,MAAM,IAAI,YAAY,cAAc,GAAG;AAC5D,YAAM,QAAQ,MAAM,IAAI,UAAU,gBAAgB,QAAQ,EAAE,MAAM,MAAM,CAAC,CAAC;AAC1E,UAAI,MAAM,WAAW,EAAG;AAGxB,YAAM,SAAS,SACX,MAAM,IAAI,UAAmB,gBAAgB,QAAQ,EAAE,MAAM,MAAM,IAAI,IACvE;AACJ,iBAAW,QAAQ,OAAO;AACxB,YAAI,KAAK,WAAW,KAAM;AAC1B,cAAM,SAAS,SAAS,KAAK,IAAI;AACjC,YAAI,UAAU,WAAW,QAAQ,OAAO,QAAQ,QAAQ,KAAK,GAAG,EAAG;AACnE,cAAM,eAAe,KAAK,MAAM,KAAK,gBAAgB,KAAK,UAAU,KAAK;AACzE,cAAM,aAAa,KAAK,aAAa;AACrC,cAAM,QAAQ,aAAa,KAAK,eAAe,IAAI,KAAK;AACxD,YAAI,SAAS,EAAG;AAChB,iBAAS;AACT,mBAAW,KAAK;AAAA,UACd,YAAY;AAAA,UAAgB;AAAA,UAAU,UAAU,KAAK;AAAA,UAAM,MAAM,KAAK;AAAA,UACtE;AAAA,UAAO,MAAM,aAAa,UAAU;AAAA,UAAQ;AAAA,QAC9C,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAIA,aAAW,KAAK,CAAC,GAAG,MAClB,EAAE,eAAe,EAAE,gBAChB,EAAE,WAAW,cAAc,EAAE,UAAU,KACvC,EAAE,SAAS,cAAc,EAAE,QAAQ,KACnC,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AAEzC,MAAI,UAAU;AACd,MAAI,aAAa;AACjB,MAAI,eAAe;AACnB,aAAW,KAAK,YAAY;AAC1B,QAAI,SAAS,YAAY,WAAW,KAAK,mBAAoB;AAC7D,QAAI,CAAC,KAAK,QAAQ;AAChB,UAAI,EAAE,SAAS,QAAQ;AACrB,cAAM,IAAI,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AACzD,cAAM,gBAAgB,KAAK;AAAA,UACzB,IAAI,mBAAmB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AAAA,UAC3D,YAAY,EAAE;AAAA,UACd,UAAU,EAAE;AAAA,UACZ,UAAU,EAAE;AAAA,UACZ,UAAU,EAAE;AAAA,UACZ,QAAQ;AAAA,UACR,WAAW,KAAK,IAAI,YAAY;AAAA,UAChC,OAAO,IAAI;AAAA,QACb,CAAC;AACD,wBAAgB;AAAA,MAClB,OAAO;AAGL,cAAM,IAAI,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AAAA,MACjE;AAAA,IACF;AACA,eAAW;AACX,kBAAc,EAAE;AAChB,aAAS,EAAE;AAAA,EACb;AAEA,SAAO,EAAE,SAAS,YAAY,aAAa;AAC7C;AAOA,SAAS,OAAU,QAA4B,QAAW,KAAoB;AAC5E,MAAI,OAAO,WAAW;AACpB,QAAI;AACF,UAAI,OAAO,UAAU,MAAM,EAAG,QAAO;AAAA,IACvC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,OAAO,aAAa;AACtB,QAAI;AACF,YAAM,QAAQ,OAAO,YAAY,MAAM;AACvC,UAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,cAAM,IAAI,iBAAiB,OAAO,MAAM,QAAQ,IAAI,OAAO,UAAU,WAAW,QAAQ,KAAK,MAAM,OAAO,KAAK,CAAC;AAChH,YAAI,CAAC,OAAO,SAAS,CAAC,EAAG,QAAO;AAChC,YAAI,IAAI,IAAI,QAAQ,EAAG,QAAO;AAAA,MAChC;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eACP,QACA,QACA,MACA,KACqC;AACrC,MAAI,eAAe;AACnB,MAAI,qBAAqB;AAEzB,MAAI,OAAO,eAAe,UAAa,OAAO,aAAa,GAAG;AAC5D,UAAM,aAAa,KAAK,MAAM,KAAK,UAAU;AAC7C,QAAI,OAAO,SAAS,UAAU,GAAG;AAC/B,YAAM,QAAQ,IAAI,QAAQ,IAAI;AAC9B,YAAM,UAAU,OAAO,aAAa;AACpC,UAAI,QAAQ,QAAS,gBAAe;AAAA,IACtC;AAAA,EACF;AAEA,MAAI,OAAO,WAAW;AACpB,QAAI;AACF,UAAI,OAAO,UAAU,MAAM,EAAG,sBAAqB;AAAA,IACrD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,gBAAgB,mBAAoB,QAAO;AAC/C,MAAI,aAAc,QAAO;AACzB,MAAI,mBAAoB,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,mBAAmB,YAAoB,UAAkB,UAA0B;AAC1F,QAAM,OAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,CAAC,CAAC;AAChE,MAAI,SAAS;AACb,aAAW,KAAK,KAAM,WAAU,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC9D,SAAO,GAAG,UAAU,KAAK,QAAQ,KAAK,QAAQ,KAAK,MAAM;AAC3D;AAEA,eAAe,gBAAgB,KAAwB,OAAyC;AAC9F,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI;AACJ,MAAI,IAAI,WAAW;AACjB,UAAM,MAAM,MAAM,IAAI,OAAO,8BAA8B;AAC3D,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,eAAW;AAAA,MACT,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,KAAK,MAAM;AAAA,MACX,KAAK;AAAA,MACL,OAAO;AAAA,MACP,KAAK,MAAM;AAAA,IACb;AAAA,EACF,OAAO;AACL,eAAW;AAAA,MACT,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,KAAK,MAAM;AAAA,MACX,KAAK;AAAA,MACL,OAAO;AAAA,MACP,KAAK,MAAM;AAAA,IACb;AAAA,EACF;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,gCAAgC,MAAM,IAAI,QAAQ;AACrF;","names":[]}

package/dist/{chunk-ZX5FNWH7.js → chunk-IG6KUWBX.js}

@@ -2,7 +2,7 @@ import {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,
   OverlayNameCollisionError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/with-formula/overlay-views/registry.ts
 var OverlayedViewRegistry = class {
@@ -68,4 +68,4 @@ var OverlayedViewRegistry = class {
 export {
   OverlayedViewRegistry
 };
-//# sourceMappingURL=chunk-ZX5FNWH7.js.map
+//# sourceMappingURL=chunk-IG6KUWBX.js.map

package/dist/chunk-IG6KUWBX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/overlay-views/registry.ts"],"sourcesContent":["import {\n  OverlayBaseIsVirtualError,\n  OverlayCollectionUnavailableError,\n  OverlayNameCollisionError,\n} from '../../kernel/errors.js'\nimport type { MaterializedViewRegistry } from '../materialized-views/registry.js'\nimport type { OverlayedViewSpec } from './types.js'\n\n/**\n * Vault-internal registry of overlay strategies. Resolves the base\n * MV's `rowKey` lazily so virtual-collection writes can derive ids\n * from the row.\n *\n * @internal\n */\nexport class OverlayedViewRegistry {\n  private readonly _byName = new Map<string, OverlayedViewSpec>()\n\n  /**\n   * Register an overlay. Validates name uniqueness, base concreteness,\n   * and overlay availability AGAINST the MV registry — overlays\n   * declared without the MV registry context skip cross-registry\n   * checks but still validate self-consistency.\n   */\n  register(\n    spec: OverlayedViewSpec,\n    options: {\n      isOverlayName?: (name: string) => boolean\n      isMVOutput?: (name: string) => boolean\n      isKnownCollection?: (name: string) => boolean\n    },\n  ): void {\n    const { isOverlayName, isMVOutput, isKnownCollection } = options\n\n    // 1. Virtual name must not collide with an MV output or a concrete\n    //    source collection. Concrete-source detection is best-effort:\n    //    if `isKnownCollection` is supplied, a hit there + no MV match\n    //    is treated as a collision.\n    if (isMVOutput?.(spec.name) || isOverlayName?.(spec.name)) {\n      throw new OverlayNameCollisionError(spec.name)\n    }\n    // (We don't check isKnownCollection for `name` collision because\n    // virtual names are typically NOT pre-existing — they're created\n    // by the overlay declaration itself. Future versions may tighten.)\n\n    // 2. base must be concrete: NOT another overlay's virtual name.\n    if (isOverlayName?.(spec.base)) {\n      throw new OverlayBaseIsVirtualError(spec.name, spec.base)\n    }\n\n    // 3. overlay must be available: a real, vault-known collection\n    //    that is NOT an MV output (since MVs own their outputs).\n    if (isMVOutput?.(spec.overlay)) {\n      throw new OverlayCollectionUnavailableError(spec.name, spec.overlay)\n    }\n    // Best-effort known-collection check — when the vault can answer\n    // it. Unknown collections aren't a hard failure (the overlay may\n    // be implicitly created on first write), so we only throw on the\n    // MV-output case above.\n    void isKnownCollection\n\n    this._byName.set(spec.name, spec)\n  }\n\n  byName(name: string): OverlayedViewSpec | undefined {\n    return this._byName.get(name)\n  }\n\n  /** All overlay virtual names. */\n  names(): ReadonlySet<string> {\n    return new Set(this._byName.keys())\n  }\n\n  isOverlay(name: string): boolean {\n    return this._byName.has(name)\n  }\n\n  /**\n   * All registered overlay strategies as a flat array.\n   * Each strategy carries `name`, `base`, and `overlay` fields that\n   * `describeOverlays()` in the introspection walker reads directly.\n   *\n   * Used by `dumpSchema()` to populate the `overlayViews` map.\n   */\n  all(): ReadonlyArray<OverlayedViewSpec> {\n    return [...this._byName.values()]\n  }\n\n  /**\n   * Resolve the `rowKey` function for an overlay's base MV. Returns\n   * `undefined` if the base isn't an MV (raw source collection) or\n   * if the MV registry isn't supplied. Used by the virtual-collection\n   * proxy to derive ids from `put(record)` calls.\n   */\n  resolveBaseRowKey(\n    name: string,\n    mvRegistry: MaterializedViewRegistry | null,\n  ): ((row: Record<string, unknown>) => string) | undefined {\n    const spec = this._byName.get(name)\n    if (!spec || !mvRegistry) return undefined\n    // The base might be an MV's `output.collection` OR the MV's `name`\n    // (when no output.collection is declared). Search by both.\n    for (const reg of mvRegistry.all()) {\n      if (reg.outputCollection === spec.base || reg.spec.name === spec.base) {\n        return (row) => reg.spec.rowKey(row)\n      }\n    }\n    return undefined\n  }\n}\n"],"mappings":";;;;;;;AAeO,IAAM,wBAAN,MAA4B;AAAA,EAChB,UAAU,oBAAI,IAA+B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ9D,SACE,MACA,SAKM;AACN,UAAM,EAAE,eAAe,YAAY,kBAAkB,IAAI;AAMzD,QAAI,aAAa,KAAK,IAAI,KAAK,gBAAgB,KAAK,IAAI,GAAG;AACzD,YAAM,IAAI,0BAA0B,KAAK,IAAI;AAAA,IAC/C;AAMA,QAAI,gBAAgB,KAAK,IAAI,GAAG;AAC9B,YAAM,IAAI,0BAA0B,KAAK,MAAM,KAAK,IAAI;AAAA,IAC1D;AAIA,QAAI,aAAa,KAAK,OAAO,GAAG;AAC9B,YAAM,IAAI,kCAAkC,KAAK,MAAM,KAAK,OAAO;AAAA,IACrE;AAKA,SAAK;AAEL,SAAK,QAAQ,IAAI,KAAK,MAAM,IAAI;AAAA,EAClC;AAAA,EAEA,OAAO,MAA6C;AAClD,WAAO,KAAK,QAAQ,IAAI,IAAI;AAAA,EAC9B;AAAA;AAAA,EAGA,QAA6B;AAC3B,WAAO,IAAI,IAAI,KAAK,QAAQ,KAAK,CAAC;AAAA,EACpC;AAAA,EAEA,UAAU,MAAuB;AAC/B,WAAO,KAAK,QAAQ,IAAI,IAAI;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAwC;AACtC,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,kBACE,MACA,YACwD;AACxD,UAAM,OAAO,KAAK,QAAQ,IAAI,IAAI;AAClC,QAAI,CAAC,QAAQ,CAAC,WAAY,QAAO;AAGjC,eAAW,OAAO,WAAW,IAAI,GAAG;AAClC,UAAI,IAAI,qBAAqB,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,MAAM;AACrE,eAAO,CAAC,QAAQ,IAAI,KAAK,OAAO,GAAG;AAAA,MACrC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-CKUYQO2P.js → chunk-IMRB2C4O.js}

@@ -1,8 +1,12 @@
+import {
+  lazy
+} from "./chunk-5D2ALSM5.js";
 import {
   RecordCodec
-} from "./chunk-GEEJPID6.js";
+} from "./chunk-RZPOZPZU.js";
 
 // src/with-formula/materialized-views/stale.ts
+var loadMVExecutor = lazy(() => import("./executor-XZYM4KHT.js"));
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 function markMVStale(registry, mvName) {
   let set = _staleByRegistry.get(registry);
@@ -99,9 +103,7 @@ async function resolveStaleMVOnRead(accessor, outputCollection, dispatchCtx) {
       await deleteMVStaleMarker(adapter, vault, name);
       continue;
     }
-    if (executor === null) {
-      ({ MaterializedViewExecutor: executor } = await import("./executor-SHYLIBOM.js"));
-    }
+    executor ??= (await loadMVExecutor()).MaterializedViewExecutor;
     for (const dep of reg.dependencies) {
       await accessor.getCollection(dep).ensureHydrated();
     }
@@ -132,4 +134,4 @@ export {
   clearMVStale,
   clearMVStaleFully
 };
-//# sourceMappingURL=chunk-CKUYQO2P.js.map
+//# sourceMappingURL=chunk-IMRB2C4O.js.map

package/dist/chunk-IMRB2C4O.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/materialized-views/stale.ts"],"sourcesContent":["import type { Collection } from '../../kernel/collection.js'\nimport type { MaterializedViewExecutor as MVExecutorType } from './executor.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { PutDerivedOutputCtx } from '../../kernel/via/dispatch.js'\nimport type { MaterializedViewRegistry, RegisteredMV } from './registry.js'\n// Type-only — runtime class loaded via dynamic import in\n// `resolveStaleMVOnRead` only when a stale flag actually fires.\n// Keeps the executor chunk out of the floor bundle (mirrors v1 floor-bundle isolation).\nimport type { MVQueryContext } from './types.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { RecordCodec } from '../../kernel/enclave/index.js'\n\nimport { lazy } from '../../kernel/lazy.js'\n\n/** #846c — one memoized binding instead of a cast at the call site. */\nconst loadMVExecutor = lazy(() => import('./executor.js'))\n\n/**\n * Accessor shape passed in from the owning Vault. Provides the\n * registry (used as a stable WeakMap key + to look up MVs by output\n * collection) and the runtime context the lazy refresh needs.\n * Mirrors v1's `DerivationStaleAccessor`.\n */\nexport interface MVStaleAccessor {\n  registry(): MaterializedViewRegistry\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  getCollection(name: string): Collection<any>\n  getActiveTxContext(): TxContext | null\n  getQueryContext(): MVQueryContext\n}\n\n/**\n * In-memory stale map keyed by `MaterializedViewRegistry` instance\n * (stable per vault). Each registry maps to a set of MV names that\n * have at least one pending source-change requiring a re-materialize.\n *\n * Persistence across vault close is NOT implemented in this iteration\n * (concern flagged in the v2 spec, mirrors v1 derivation behavior).\n * On vault re-open, the unset stale flag is interpreted as \"fresh\" —\n * `vault.refreshView(name)` is the explicit recompute escape hatch.\n *\n * @internal\n */\nconst _staleByRegistry = new WeakMap<MaterializedViewRegistry, Set<string>>()\n\n/**\n * Mark an MV as stale. Called from `Collection.dispatchMaterializedViews`\n * when a source-write fires for a `refresh: 'lazy'` MV.\n *\n * @internal\n */\nexport function markMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  let set = _staleByRegistry.get(registry)\n  if (!set) {\n    set = new Set()\n    _staleByRegistry.set(registry, set)\n  }\n  set.add(mvName)\n}\n\n/**\n * Test-only: check whether a given MV name is currently flagged stale\n * against a registry. Exported so the regression suite can pin the\n * stale-bit lifecycle without touching the internal `WeakMap`.\n *\n * @internal\n */\nexport function isMVStale(registry: MaterializedViewRegistry, mvName: string): boolean {\n  return _staleByRegistry.get(registry)?.has(mvName) ?? false\n}\n\n/**\n * Reserved collection holding CONTENT-FREE lazy-stale markers (record id =\n * MV name, plaintext `_iv: ''` envelope, no payload) — mirrors the\n * `_meta`/schema-fence marker envelope shape. Written only from the\n * delete/forget/elevate dispatcher (#736); ordinary source writes stay\n * in-memory-only (the cheap path). Read via the adapter directly, never\n * through `vault.collection()` — same reserved-collection convention as\n * `_subject_index`/`_meta`.\n */\nexport const MV_STALE_COLLECTION = '_mv_stale'\n\n/**\n * Once-per-registry hydrate guard for `resolveStaleMVOnRead`'s persisted-marker fold-in.\n * Stores the in-flight/settled PROMISE (not a boolean) — a concurrent cold first read that\n * arrives while the hydrate is still awaiting `adapter.list` must await the SAME promise\n * rather than observing \"already hydrating\" and reading an empty pending set (#736\n * whole-branch review).\n */\nconst _hydratedByRegistry = new WeakMap<MaterializedViewRegistry, Promise<void>>()\n\n/** The adapter + vault name backing any collection in this vault (all collections share both). */\nfunction storeOf(accessor: MVStaleAccessor, collectionName: string): { adapter: NoydbStore; vault: string } {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const c = accessor.getCollection(collectionName) as any\n  return { adapter: c.adapter as NoydbStore, vault: c.vault as string }\n}\n\nasync function writeMVStaleMarker(adapter: NoydbStore, vault: string, mvName: string): Promise<void> {\n  // Content-free — the marker's only payload is its key (the MV name).\n  const env = RecordCodec.buildPlaintextEnvelope({ version: 1, data: '{}' })\n  await adapter.put(vault, MV_STALE_COLLECTION, mvName, env)\n}\n\nasync function deleteMVStaleMarker(adapter: NoydbStore, vault: string, mvName: string): Promise<void> {\n  await adapter.delete(vault, MV_STALE_COLLECTION, mvName)\n}\n\n/**\n * On first `resolveStaleMVOnRead` call for a (cold-reopened) registry, fold every\n * persisted `_mv_stale` marker into the in-memory pending set — otherwise a cold\n * session's empty `WeakMap` entry reads as \"fresh\" and serves the emptied output\n * collection forever.\n */\nasync function hydratePersistedStaleMarkers(accessor: MVStaleAccessor, registry: MaterializedViewRegistry): Promise<void> {\n  const mvs = registry.all()\n  if (mvs.length === 0) return\n  const { adapter, vault } = storeOf(accessor, mvs[0]!.outputCollection)\n  // No try/catch: a genuine store failure here must surface, not be read as\n  // \"nothing pending\" — silently treating it as fresh is the exact leak class\n  // this module closes (mirrors `subject-index.ts`'s bare `adapter.list` reads).\n  for (const name of await adapter.list(vault, MV_STALE_COLLECTION)) markMVStale(registry, name)\n}\n\n/**\n * Invalidate an MV from the delete/forget/elevate dispatcher (#736) — the ordinary\n * source-write path (`dispatchMaterializedViews`) never calls this. Deletes EVERY\n * persisted row in `reg.outputCollection` via `_internalDelete` (the at-rest law: a\n * stale mark alone leaves the elevated/forgotten source's plaintext sitting in the\n * output row) using the adapter directly so the read-path's `resolveStaleMVOnRead`\n * isn't triggered mid-invalidation. `mode: 'lazy'` also persists the stale mark so a\n * cold session recomputes on next read; `'manual'` gets the purge only — the MV\n * serves empty until an explicit `vault.refreshView()` (erasure wins). Deletion is\n * stamp-scoped (`_materializedFrom.mvName === reg.spec.name` — see the loop below),\n * so another registered MV sharing this output collection keeps its own rows intact:\n * no cross-MV re-marking is needed here, only `reg` itself is marked stale.\n *\n * Returns the count of rows actually `_internalDelete`d (#761 item 1) — folded by the\n * caller into `dispatchMaterializedViewsOnDelete`'s `deleted` so `ForgetResult.derivedRecordsErased`\n * counts lazy/manual purges too, not just the eager executor's tombstone leg — plus\n * `residueUndecodable`, the bare ids whose ownership stamp could NOT be decoded (#776): a\n * candidate row that fails to decode under the collection's default DEK (e.g. elevated above\n * tier 0 on a tiered output collection) has UNKNOWN ownership — it might be this MV's own\n * output, or (same-collection shape) a plain user record — so it is never erased, but it must\n * be SURFACED rather than silently skipped (the #724 posture), since it may still hold the\n * forgotten/pre-elevation contribution, decryptable by tier-holders — and `residueDeclined`\n * (#785), the bare ids that DID decode and stamp-match but whose `_internalDelete` declined\n * (ownership CONFIRMED, erasure declined).\n *\n * @internal\n */\nexport async function invalidateMVAtRest(\n  accessor: MVStaleAccessor,\n  reg: RegisteredMV,\n  mode: 'lazy' | 'manual',\n): Promise<{ deleted: number; residueUndecodable: string[]; residueDeclined: string[] }> {\n  const outputColl = accessor.getCollection(reg.outputCollection)\n  const txCtx = accessor.getActiveTxContext()\n  const { adapter, vault } = storeOf(accessor, reg.outputCollection)\n  let deleted = 0\n  const residueUndecodable: string[] = []\n  const residueDeclined: string[] = []\n  for (const id of await adapter.list(vault, reg.outputCollection)) {\n    // A same-collection partition MV (`output: { collection: <source>, partition }`,\n    // the DERIV-PP30-001 shape) writes INTO its own source collection — `adapter.list`\n    // over `reg.outputCollection` then also returns untouched user source records.\n    // Decode each candidate row (the invalidation path is rare; this cost is fine\n    // here) and only erase rows THIS MV stamped via `_materializedFrom.mvName` —\n    // an unstamped row, or one stamped by a different MV, is never this MV's to\n    // delete (#736 whole-branch review, Critical).\n    const envelope = await adapter.get(vault, reg.outputCollection, id)\n    if (envelope === null) continue\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const decoded = await (outputColl as any)._decodeEnvelope(envelope, id)\n    if (decoded === null) { residueUndecodable.push(id); continue } // #776 — ownership unknown, surfaced not skipped\n    const stampedBy = (decoded as Record<string, unknown>)._materializedFrom as { mvName?: string } | undefined\n    if (stampedBy?.mvName !== reg.spec.name) continue\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    if (await (outputColl as any)._internalDelete(id, txCtx)) {\n      deleted++\n    } else {\n      // #782 part b — decoded AND stamp-owned, but erasure declined (#718 tier-elevation\n      // gate). Ownership IS confirmed — a real silent survival, not a legit stamp-mismatch\n      // skip. Surface it too, in its own channel (#785 — distinct from the decode-null case).\n      residueDeclined.push(id)\n    }\n  }\n\n  // `mode: 'manual'` gets the purge only (erasure wins, no auto-recompute promise);\n  // `'lazy'` also marks + persists ITS OWN stale bit for cold-session recompute. No\n  // sibling MV on the same output collection is touched here — the stamp-scoped\n  // deletion above never erased sibling rows in the first place (#736 re-review).\n  if (mode === 'lazy') {\n    const registry = accessor.registry()\n    markMVStale(registry, reg.spec.name)\n    await writeMVStaleMarker(adapter, vault, reg.spec.name)\n  }\n  return { deleted, residueUndecodable, residueDeclined }\n}\n\n/**\n * Called from `Collection.get` (and any reader that materializes the\n * MV's output collection). If any MV producing `outputCollection` is\n * flagged stale, runs the executor against the live source state\n * before returning. No-op when there is no pending work — keeps the\n * read fast path negligible.\n *\n * `dispatchCtx` (#641): threaded from the calling `Collection`'s\n * `#dispatchCtx({ collection: outputCollection, id: 'resolve-on-read' })` — a read has no\n * real \"reacting write\" record, so `'resolve-on-read'` is the sentinel id, mirroring\n * `Vault.refreshView()`'s `'refreshView'` sentinel for the same reason. Passed straight\n * through to the executor so a stale row whose output lands in a closed period follows the\n * frozen-output rule (skip + `derivation:skipped-frozen`, #637) instead of throwing\n * `PeriodClosedError` out of a read.\n *\n * Dynamic-imports the executor only when a stale flag actually fires\n * (the floor-bundle isolation pattern v1 derivations established in\n * floor-bundle isolation pattern).\n */\nexport async function resolveStaleMVOnRead(\n  accessor: MVStaleAccessor,\n  outputCollection: string,\n  dispatchCtx?: PutDerivedOutputCtx,\n): Promise<void> {\n  const registry = accessor.registry()\n  // Cold session: the in-memory WeakMap has no entry for this (freshly\n  // constructed) registry yet — fold any persisted `_mv_stale` markers in\n  // before reading the pending set, once per registry (#736). Memoize the\n  // PROMISE, not a boolean: a concurrent first read arriving while the\n  // hydrate is still awaiting `adapter.list` must await the SAME promise —\n  // otherwise it observes \"already hydrating\", skips straight to an empty\n  // pending set, and serves the purged/stale view as fresh (#736\n  // whole-branch review, hydrate-once race). On rejection, evict the entry\n  // BEFORE rethrowing — a cached rejected promise would otherwise poison the\n  // MV read surface for the rest of the session (every later read re-awaits\n  // the same rejection instead of retrying the store call) (#736 re-review).\n  let hydrate = _hydratedByRegistry.get(registry)\n  if (!hydrate) {\n    hydrate = hydratePersistedStaleMarkers(accessor, registry).catch((err: unknown) => {\n      _hydratedByRegistry.delete(registry)\n      throw err\n    })\n    _hydratedByRegistry.set(registry, hydrate)\n  }\n  await hydrate\n  const pending = _staleByRegistry.get(registry)\n  if (!pending || pending.size === 0) return\n\n  const { adapter, vault } = storeOf(accessor, outputCollection)\n\n  // Clean up persisted markers for MV names no longer registered (renamed or\n  // removed since the marker was written). Without this sweep an orphaned name\n  // can never become a `candidate` below — `candidates` is built from\n  // `registry.all()`, which no longer lists it — so both the in-memory pending\n  // entry and the persisted `_mv_stale` row would linger forever, re-hydrating\n  // on every cold session (#736 whole-branch review).\n  for (const name of pending) {\n    if (registry.byName(name)) continue\n    pending.delete(name)\n    await deleteMVStaleMarker(adapter, vault, name)\n  }\n  if (pending.size === 0) return\n\n  // Find every MV that writes to this output collection AND is\n  // currently flagged stale. Multiple MVs CAN share an output\n  // collection in theory; in practice the registration validation +\n  // cycle detection make this unusual.\n  const candidates: string[] = []\n  for (const mv of registry.all()) {\n    if (mv.outputCollection !== outputCollection) continue\n    if (!pending.has(mv.spec.name)) continue\n    candidates.push(mv.spec.name)\n  }\n  if (candidates.length === 0) return\n\n  let executor: typeof MVExecutorType | null = null\n  for (const name of candidates) {\n    const reg = registry.byName(name)\n    if (!reg) {\n      // Unreachable in practice — `candidates` is drawn from `registry.all()`,\n      // and the orphan sweep above already cleared any name absent from it.\n      // Kept as a defensive fallback; also clears the persisted marker so it\n      // can't linger if this ever does fire.\n      pending.delete(name)\n      await deleteMVStaleMarker(adapter, vault, name)\n      continue\n    }\n    executor ??= (await loadMVExecutor()).MaterializedViewExecutor\n    // A cold-hydrated stale flag (unlike an in-session one) can fire with\n    // NONE of the MV's dependency collections touched yet this session —\n    // the sync `Query.toArray()` `spec.query()` runs reads straight off\n    // `Collection`'s in-memory cache, populated only by a prior async\n    // touch (`ensureHydrated()`, called from `get`/`list`/`put`, never\n    // from `query()` itself). Warm every dependency first so the recompute\n    // sees the live persisted state instead of an empty cache (#736).\n    for (const dep of reg.dependencies) {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      await (accessor.getCollection(dep) as any).ensureHydrated()\n    }\n    await executor.refresh(reg, {\n      getCollection: (n) => accessor.getCollection(n),\n      getActiveTxContext: () => accessor.getActiveTxContext(),\n      getQueryContext: () => accessor.getQueryContext(),\n      ...(dispatchCtx !== undefined ? { dispatchCtx } : {}),\n    })\n    pending.delete(name)\n    // Runs even when no marker was ever persisted for this name (an in-session-only\n    // stale bit — e.g. the cheap ordinary-write path never writes one, see the\n    // \"cheap-path guarantee\" test). `adapter.delete` on an absent key is a harmless\n    // void — keeping this unconditional avoids branching on marker origin here.\n    await deleteMVStaleMarker(adapter, vault, name)\n  }\n}\n\n/**\n * Drop every stale flag for a registry. Used after a manual\n * `vault.refreshView(name)` runs the executor explicitly — the\n * post-refresh state matches the registered strategies, so\n * lingering stale bits would force a redundant refresh on the next\n * read.\n *\n * @internal\n */\nexport function clearMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  _staleByRegistry.get(registry)?.delete(mvName)\n}\n\n/**\n * `clearMVStale` plus the persisted marker (#736) — `Vault.refreshView()`'s\n * completion path. A lingering persisted marker after a manual refresh would\n * make the NEXT cold session recompute redundantly.\n *\n * @internal\n */\nexport async function clearMVStaleFully(\n  adapter: NoydbStore,\n  vault: string,\n  registry: MaterializedViewRegistry,\n  mvName: string,\n): Promise<void> {\n  clearMVStale(registry, mvName)\n  await deleteMVStaleMarker(adapter, vault, mvName)\n}\n"],"mappings":";;;;;;;;AAeA,IAAM,iBAAiB,KAAK,MAAM,OAAO,wBAAe,CAAC;AA4BzD,IAAM,mBAAmB,oBAAI,QAA+C;AAQrE,SAAS,YAAY,UAAoC,QAAsB;AACpF,MAAI,MAAM,iBAAiB,IAAI,QAAQ;AACvC,MAAI,CAAC,KAAK;AACR,UAAM,oBAAI,IAAI;AACd,qBAAiB,IAAI,UAAU,GAAG;AAAA,EACpC;AACA,MAAI,IAAI,MAAM;AAChB;AASO,SAAS,UAAU,UAAoC,QAAyB;AACrF,SAAO,iBAAiB,IAAI,QAAQ,GAAG,IAAI,MAAM,KAAK;AACxD;AAWO,IAAM,sBAAsB;AASnC,IAAM,sBAAsB,oBAAI,QAAiD;AAGjF,SAAS,QAAQ,UAA2B,gBAAgE;AAE1G,QAAM,IAAI,SAAS,cAAc,cAAc;AAC/C,SAAO,EAAE,SAAS,EAAE,SAAuB,OAAO,EAAE,MAAgB;AACtE;AAEA,eAAe,mBAAmB,SAAqB,OAAe,QAA+B;AAEnG,QAAM,MAAM,YAAY,uBAAuB,EAAE,SAAS,GAAG,MAAM,KAAK,CAAC;AACzE,QAAM,QAAQ,IAAI,OAAO,qBAAqB,QAAQ,GAAG;AAC3D;AAEA,eAAe,oBAAoB,SAAqB,OAAe,QAA+B;AACpG,QAAM,QAAQ,OAAO,OAAO,qBAAqB,MAAM;AACzD;AAQA,eAAe,6BAA6B,UAA2B,UAAmD;AACxH,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,IAAI,WAAW,EAAG;AACtB,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,IAAI,CAAC,EAAG,gBAAgB;AAIrE,aAAW,QAAQ,MAAM,QAAQ,KAAK,OAAO,mBAAmB,EAAG,aAAY,UAAU,IAAI;AAC/F;AA6BA,eAAsB,mBACpB,UACA,KACA,MACuF;AACvF,QAAM,aAAa,SAAS,cAAc,IAAI,gBAAgB;AAC9D,QAAM,QAAQ,SAAS,mBAAmB;AAC1C,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,IAAI,gBAAgB;AACjE,MAAI,UAAU;AACd,QAAM,qBAA+B,CAAC;AACtC,QAAM,kBAA4B,CAAC;AACnC,aAAW,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI,gBAAgB,GAAG;AAQhE,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,IAAI,kBAAkB,EAAE;AAClE,QAAI,aAAa,KAAM;AAEvB,UAAM,UAAU,MAAO,WAAmB,gBAAgB,UAAU,EAAE;AACtE,QAAI,YAAY,MAAM;AAAE,yBAAmB,KAAK,EAAE;AAAG;AAAA,IAAS;AAC9D,UAAM,YAAa,QAAoC;AACvD,QAAI,WAAW,WAAW,IAAI,KAAK,KAAM;AAEzC,QAAI,MAAO,WAAmB,gBAAgB,IAAI,KAAK,GAAG;AACxD;AAAA,IACF,OAAO;AAIL,sBAAgB,KAAK,EAAE;AAAA,IACzB;AAAA,EACF;AAMA,MAAI,SAAS,QAAQ;AACnB,UAAM,WAAW,SAAS,SAAS;AACnC,gBAAY,UAAU,IAAI,KAAK,IAAI;AACnC,UAAM,mBAAmB,SAAS,OAAO,IAAI,KAAK,IAAI;AAAA,EACxD;AACA,SAAO,EAAE,SAAS,oBAAoB,gBAAgB;AACxD;AAqBA,eAAsB,qBACpB,UACA,kBACA,aACe;AACf,QAAM,WAAW,SAAS,SAAS;AAYnC,MAAI,UAAU,oBAAoB,IAAI,QAAQ;AAC9C,MAAI,CAAC,SAAS;AACZ,cAAU,6BAA6B,UAAU,QAAQ,EAAE,MAAM,CAAC,QAAiB;AACjF,0BAAoB,OAAO,QAAQ;AACnC,YAAM;AAAA,IACR,CAAC;AACD,wBAAoB,IAAI,UAAU,OAAO;AAAA,EAC3C;AACA,QAAM;AACN,QAAM,UAAU,iBAAiB,IAAI,QAAQ;AAC7C,MAAI,CAAC,WAAW,QAAQ,SAAS,EAAG;AAEpC,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,gBAAgB;AAQ7D,aAAW,QAAQ,SAAS;AAC1B,QAAI,SAAS,OAAO,IAAI,EAAG;AAC3B,YAAQ,OAAO,IAAI;AACnB,UAAM,oBAAoB,SAAS,OAAO,IAAI;AAAA,EAChD;AACA,MAAI,QAAQ,SAAS,EAAG;AAMxB,QAAM,aAAuB,CAAC;AAC9B,aAAW,MAAM,SAAS,IAAI,GAAG;AAC/B,QAAI,GAAG,qBAAqB,iBAAkB;AAC9C,QAAI,CAAC,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAG;AAChC,eAAW,KAAK,GAAG,KAAK,IAAI;AAAA,EAC9B;AACA,MAAI,WAAW,WAAW,EAAG;AAE7B,MAAI,WAAyC;AAC7C,aAAW,QAAQ,YAAY;AAC7B,UAAM,MAAM,SAAS,OAAO,IAAI;AAChC,QAAI,CAAC,KAAK;AAKR,cAAQ,OAAO,IAAI;AACnB,YAAM,oBAAoB,SAAS,OAAO,IAAI;AAC9C;AAAA,IACF;AACA,kBAAc,MAAM,eAAe,GAAG;AAQtC,eAAW,OAAO,IAAI,cAAc;AAElC,YAAO,SAAS,cAAc,GAAG,EAAU,eAAe;AAAA,IAC5D;AACA,UAAM,SAAS,QAAQ,KAAK;AAAA,MAC1B,eAAe,CAAC,MAAM,SAAS,cAAc,CAAC;AAAA,MAC9C,oBAAoB,MAAM,SAAS,mBAAmB;AAAA,MACtD,iBAAiB,MAAM,SAAS,gBAAgB;AAAA,MAChD,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACrD,CAAC;AACD,YAAQ,OAAO,IAAI;AAKnB,UAAM,oBAAoB,SAAS,OAAO,IAAI;AAAA,EAChD;AACF;AAWO,SAAS,aAAa,UAAoC,QAAsB;AACrF,mBAAiB,IAAI,QAAQ,GAAG,OAAO,MAAM;AAC/C;AASA,eAAsB,kBACpB,SACA,OACA,UACA,QACe;AACf,eAAa,UAAU,MAAM;AAC7B,QAAM,oBAAoB,SAAS,OAAO,MAAM;AAClD;","names":[]}

package/dist/{chunk-RWW3I3PO.js → chunk-ISRKW4YN.js}

@@ -1,9 +1,9 @@
 import {
   envelopeBodyForHash
-} from "./chunk-GEEJPID6.js";
+} from "./chunk-RZPOZPZU.js";
 import {
   sha256Hex
-} from "./chunk-7U6AB7DZ.js";
+} from "./chunk-AKKRXT23.js";
 
 // src/with-commit/history/ledger/entry.ts
 function canonicalJson(value) {
@@ -67,4 +67,4 @@ export {
   parseIndex,
   envelopePayloadHash
 };
-//# sourceMappingURL=chunk-RWW3I3PO.js.map
+//# sourceMappingURL=chunk-ISRKW4YN.js.map

package/dist/{chunk-P4NUJVWL.js → chunk-IXNCZTWA.js}

@@ -1,6 +1,6 @@
 import {
   BrokerNotEnabledError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/port/with/broker-strategy.ts
 var NO_BROKER = {
@@ -27,4 +27,4 @@ export {
   NO_BROKER,
   buildCredentialBrokerHandle
 };
-//# sourceMappingURL=chunk-P4NUJVWL.js.map
+//# sourceMappingURL=chunk-IXNCZTWA.js.map

package/dist/{chunk-YFFEF6HR.js → chunk-JIDLU57U.js}

@@ -1,9 +1,9 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-YTW6ZIPD.js";
+} from "./chunk-GZACYEOB.js";
 import {
   ValidationError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/with-party/directory/cover/custom.ts
 var CUSTOM_KEY_PATTERN = /^[a-z0-9]+([.-][a-z0-9]+)+$/i;
@@ -233,4 +233,4 @@ export {
   resolveLocale,
   pickLocale
 };
-//# sourceMappingURL=chunk-YFFEF6HR.js.map
+//# sourceMappingURL=chunk-JIDLU57U.js.map

package/dist/{chunk-PTT2NB46.js → chunk-JYJFGD2H.js}

@@ -1,6 +1,6 @@
 import {
   TierWriteRefusedError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/kernel/tier-visibility.ts
 async function peekLiveTier(adapter, vault, name, id) {
@@ -34,4 +34,4 @@ export {
   assertTierWritable,
   assertCutoverTierSafe
 };
-//# sourceMappingURL=chunk-PTT2NB46.js.map
+//# sourceMappingURL=chunk-JYJFGD2H.js.map

package/dist/{chunk-3OWYOECI.js → chunk-JYV4JJV2.js}

@@ -1,17 +1,17 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-K4BWPNJO.js";
+} from "./chunk-TE6LH6J2.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-OMSKGLYA.js";
+} from "./chunk-WO4T4OD5.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-YTW6ZIPD.js";
+} from "./chunk-GZACYEOB.js";
 import {
   NoydbError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/with-audit/portability/request-withdrawal.ts
 var WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
@@ -161,4 +161,4 @@ export {
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-3OWYOECI.js.map
+//# sourceMappingURL=chunk-JYV4JJV2.js.map

package/dist/{chunk-OGVE4IJW.js → chunk-KBPU5M2E.js}

@@ -7,28 +7,28 @@ import {
   PERIOD_FREEZES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-TMR64XPL.js";
+} from "./chunk-EZNTORXE.js";
 import {
   envelopeBodySize
-} from "./chunk-GEEJPID6.js";
+} from "./chunk-RZPOZPZU.js";
 import {
   isDeleteMarker,
   isTombstoneShape
-} from "./chunk-SC4JLMZI.js";
+} from "./chunk-VH6SOCXH.js";
 import {
   bufferToBase64,
   decrypt,
   derivePresenceKey,
   encrypt,
   generateIV
-} from "./chunk-7U6AB7DZ.js";
+} from "./chunk-AKKRXT23.js";
 import {
   NOYDB_SYNC_VERSION
-} from "./chunk-YTW6ZIPD.js";
+} from "./chunk-GZACYEOB.js";
 import {
   ConflictError,
   ValidationError
-} from "./chunk-6SYOHUHM.js";
+} from "./chunk-QZWTRENR.js";
 
 // src/with-party/team/presence.ts
 var PresenceHandle = class {
@@ -1073,4 +1073,4 @@ export {
   SyncEngine,
   SyncTransaction
 };
-//# sourceMappingURL=chunk-OGVE4IJW.js.map
+//# sourceMappingURL=chunk-KBPU5M2E.js.map

package/dist/{chunk-I2XEBEEF.js → chunk-KFRPNHWR.js}

@@ -1,14 +1,14 @@
 import {
   openEnvelopeJson
-} from "./chunk-GEEJPID6.js";
+} from "./chunk-RZPOZPZU.js";
 import {
   encrypt,
   hmacSha256Hex,
   sha256Hex
-} from "./chunk-7U6AB7DZ.js";
+} from "./chunk-AKKRXT23.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-YTW6ZIPD.js";
+} from "./chunk-GZACYEOB.js";
 
 // src/with-audit/forget/strategy.ts
 var NO_FORGET = { subjects: {} };
@@ -147,4 +147,4 @@ export {
   coerceSubjectId,
   readDottedPath
 };
-//# sourceMappingURL=chunk-I2XEBEEF.js.map
+//# sourceMappingURL=chunk-KFRPNHWR.js.map

package/dist/chunk-KFRPNHWR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/forget/strategy.ts","../src/with-audit/forget/subject-index.ts"],"sourcesContent":["/**\n * `withForget` — declaration surface for GDPR right-to-erasure via\n * per-record CEK crypto-shred.\n *\n * This file holds only the *declaration* shape and the disabled sentinel.\n * The actual erasure machinery lives in:\n *   - `subject-index.ts` — the encrypted `_subject_index` reserved collection\n *   - `vault.ts` `forget()` — the per-record tombstone + ledger flow\n *   - `collection.ts` `_writeTombstone` — the envelope rewrite\n *\n * A `ForgetStrategy` declares which collections carry erasable subject data\n * and the (dotted-path) field on each record that names the data subject.\n * Declaring a collection here ALSO forces `perRecordKeys: true` for it (a\n * shred can only erase a record whose body is keyed off a per-record CEK),\n * so adopters opt into the CEK foundation transitively.\n *\n * @module\n */\nimport type { LedgerEntry } from '../../with-commit/history/ledger/entry.js'\n\n/**\n * User-supplied declaration passed to {@link withForget}. Maps a\n * collection name to the record field (dotted path supported, e.g.\n * `'billing.buyerId'`) that identifies the data subject for erasure.\n *\n * ```ts\n * withForget({ subjects: { invoices: 'buyerId', contacts: 'id' } })\n * ```\n */\nexport interface SubjectDeclaration {\n  readonly subjects: Record<string, string>\n  /**\n   * #633 — opt-in: gate the vault-level `_sealed_cek` and blob purges on\n   * per-collection via declarations instead of running them unconditionally\n   * for every forgotten ref. Default `false`/absent = today's unconditional\n   * behavior (byte-identical). See `purge-scope.ts` for the partition logic\n   * and the `scopedPurgeResidue` skip-reporting this enables.\n   *\n   * **Footgun:** a bare `sensitive: [...]` collection — no `classifiedFields`\n   * (no classified via binder compiled in) — counts as UNDECLARED for the\n   * sealed-CEK arm. Under `scopedPurge: true`, its `_sealed_cek` host-delivery\n   * envelopes are SKIPPED, not purged (reported via `scopedPurgeResidue`,\n   * reason `'skipped-undeclared-sealed-cek'`) even if that collection called\n   * `sealRecordToHost()` — the sealed CEK stays recoverable by that granted\n   * host until purged. Add a `classifiedFields` binding to close the gap, or\n   * leave `scopedPurge` off/false for the unconditional (always-purged) default.\n   * The declaration signal is session-local: a declared collection never opened\n   * (with its config) before `forget()` in this session counts as UNDECLARED —\n   * open it first, or its entries are skipped-and-reported.\n   */\n  readonly scopedPurge?: boolean\n}\n\n/**\n * Resolved forget strategy threaded through Noydb → every Vault. Carries\n * the same `subjects` map the user declared. `NO_FORGET` (empty map) is the\n * off-by-default sentinel; `vault.forget()` throws\n * `ForgetStrategyNotConfiguredError` when the map is empty.\n */\nexport interface ForgetStrategy {\n  /** Collection → subject-field (dotted path). Empty under `NO_FORGET`. */\n  readonly subjects: Readonly<Record<string, string>>\n  /** #633 — see {@link SubjectDeclaration.scopedPurge}. */\n  readonly scopedPurge?: boolean\n}\n\n/**\n * Disabled sentinel — no collections declare a subject field. `vault.forget()`\n * refuses with `ForgetStrategyNotConfiguredError`; no write hooks register; no\n * collection is forced into `perRecordKeys`. Non-adopters pay nothing.\n */\nexport const NO_FORGET: ForgetStrategy = { subjects: {} }\n\n// The `withForget` factory lives in `active.ts` (canonical\n// strategy.ts/active.ts/index.ts split); this file holds only the\n// declaration shape + disabled sentinel.\n\n/**\n * The outcome of a `vault.forget(subjectId)` call.\n *\n * `unmigratedRecords` lists `collection:id` pairs that were tombstoned but\n * whose body had NOT been migrated to a per-record CEK at shred time (legacy\n * body still under the shared collection DEK). Those records are tombstoned\n * (live envelope + history stripped) but their pre-shred ciphertext, if it\n * leaked into a backup before migration, remains decryptable under the\n * collection DEK — so erasure-completeness is NOT guaranteed for them. Run\n * the per-record-CEK migration pass, then re-forget, to close the gap.\n *\n * Blob attachments: a shredded record's **erasable** blobs (on a\n * `perRecordKeys` collection) are crypto-shredded inline — `blobsShredded`\n * counts those taken to refCount 0 (BlobObject deleted → chunks permanently\n * undecryptable), `blobsRetainedShared` counts those still referenced by\n * another record (shared content legitimately persists for its other owner).\n * `blobResidueCollections` now lists only collections with blobs that could\n * NOT be crypto-shredded: **legacy** blobs (no per-blob `_cek`, chunks under\n * the shared `_blob` DEK — migrate them), or a session without the blob\n * service loaded. An all-erasable subject yields an empty residue list.\n */\nexport interface ForgetResult {\n  /** The subject id passed to `forget()`. Echoed for caller convenience. */\n  readonly subject: string\n  /** Count of live records rewritten to a tombstone. */\n  readonly recordsShredded: number\n  /** Count of `_history` envelopes tombstoned across all shredded records. */\n  readonly historyVersionsShredded: number\n  /** Distinct collections that had at least one record shredded. */\n  readonly collections: readonly string[]\n  /** `collection:id` pairs shredded while still un-migrated (see type docs). */\n  readonly unmigratedRecords: readonly string[]\n  /** Count of erasable blobs crypto-shredded (refCount → 0, BlobObject deleted). */\n  readonly blobsShredded: number\n  /** Count of erasable blobs retained because still referenced elsewhere (shared). */\n  readonly blobsRetainedShared: number\n  /** Collections with blobs that could NOT be crypto-shredded — legacy (no `_cek`) or blobs disabled (see type docs). */\n  readonly blobResidueCollections: readonly string[]\n  /**\n   * Count of persisted `_idx/<field>/<recordId>` index side-cars hard-deleted\n   * across the shredded records. These live under the retained\n   * collection DEK, so crypto-shred alone would leave the indexed field VALUES\n   * readable — `forget()` must delete them.\n   */\n  readonly indexPostingsPurged: number\n  /**\n   * `collection:id:field` entries whose persisted `_idx` side-car could NOT be\n   * deleted — index residue that still leaks the indexed value under the\n   * retained collection DEK. Non-empty means erasure is INCOMPLETE: retry, or\n   * purge the side-car out of band.\n   */\n  readonly indexResidue: readonly string[]\n  /**\n   * Count of `_sealed[field]` slots dropped from the live store across the\n   * shredded records. For slots written under `sensitive` +\n   * `perRecordKeys` (the current path), the key derives off the per-record CEK,\n   * so tombstoning the record — which drops `_cek` and `_sealed` — also\n   * crypto-shreds the value. A legacy slot (written before per-record CEKs) keys\n   * off the collection DEK instead, so dropping it removes it from the live store but a\n   * pre-forget backup remains recoverable by a DEK holder (same caveat `_data`\n   * carries); migrate by re-`put`ting before forgetting for full crypto-shred.\n   */\n  readonly sealedFieldsShredded: number\n  /** Count of `_sealed_cek` host-delivery envelopes deleted (#H-1). A record sealed to an\n   * at-* host via sealRecordToHost persists its raw CEK there; forget() must destroy them. */\n  readonly sealedCekEnvelopesPurged: number\n  /** `collection:id` whose `_sealed_cek` purge failed (residue — the host-recoverable CEK may survive). */\n  readonly sealedCekResidue: readonly string[]\n  /** `collection:id:field` sealed slots that were DEK-derived (legacy, written before per-record CEKs) and thus NOT crypto-shredded\n   * by dropping `_cek` — the collection DEK is retained, so synced/backup copies stay decryptable (#M-1). */\n  readonly sealedResidue: readonly string[]\n  /** Count of `_ledger_deltas` rows hard-deleted across the shredded records (#734) — the\n   * erasure twin of #729's elevate-side purge. Entry metadata (that the record was mutated,\n   * at which version/timestamp/actor) is retained; only the plaintext delta content is removed. */\n  readonly ledgerDeltasPurged: number\n  /** `collection:id` refs whose `_ledger_deltas` purge failed — plaintext delta residue still\n   * readable under the retained ledger DEK. Non-empty means erasure is INCOMPLETE. */\n  readonly ledgerDeltaResidue: readonly string[]\n  /** The single `op:'forget'` ledger entry appended for this erasure. */\n  readonly ledgerEntry: LedgerEntry\n  /** #622 — record-grain derived artifacts (MV rows, per-record derived copies) erased\n   *  because their source subject was forgotten. Overlay outputs are intentionally out of\n   *  scope here — an overlay is always sourced from an MV, never directly from a subject\n   *  collection, so the personal-data-bearing MV rows it reads are already erased above. */\n  readonly derivedRecordsErased: number\n  /** #622 — aggregate-grain targets (rollups) recomputed without the forgotten contribution. */\n  readonly derivedAggregatesRecomputed: number\n  /** #622 — `collection:id` derived writes SKIPPED because the target period is frozen\n   *  (recompute deferred; the aggregate retains the forgotten contribution — audited). */\n  readonly derivedResidueFrozen: readonly string[]\n  /** #650 Task 5 (#648) — referencing records tombstoned via a `'ref'` edge's `cascade` policy. */\n  readonly lookupReferencesCascaded: number\n  /** #650 Task 5 (#648) — referencing fields cleared via a `'ref'` edge's `nullify` policy. */\n  readonly lookupReferencesNullified: number\n  /** #650 Task 5 review (Important fix) — `'ref'` edges whose compare-key could NOT be resolved,\n   *  even from the LIVE pre-shred backing row — cascade/nullify propagation was SKIPPED for these.\n   *  Always empty in the ordinary case; non-empty means the skip is reported, never silent. */\n  readonly lookupReferencesResidue: readonly string[]\n  /** #633 — scoped-purge skip notices (opt-in `scopedPurge`, see {@link SubjectDeclaration}).\n   *  Always empty under the unconditional default. Non-empty means a `_sealed_cek` entry or a\n   *  blob scan was skipped for an undeclared collection — reported, never a silent skip. */\n  readonly scopedPurgeResidue: readonly ScopedPurgeResidueNotice[]\n  /** #776/#782/#785 — `collection:id` MV-output rows that survived erasure invalidation (eager\n   *  tombstone leg AND lazy/manual `invalidateMVAtRest`) despite belonging to the forgotten\n   *  subject, because the `_materializedFrom` ownership stamp could NOT be decoded (undecodable\n   *  under the collection's default DEK — e.g. elevated above tier 0 on a tiered output\n   *  collection; ownership unconfirmed — could be a plain user record on a same-collection\n   *  partition MV). Never erased, but surfaced here rather than silently skipped (the #724\n   *  posture). Non-empty means the row may still hold the forgotten/pre-elevation contribution,\n   *  decryptable by tier-holders. */\n  readonly derivedResidueUndecodable: readonly string[]\n  /** #782/#785 — `collection:id` MV-output rows that DID decode and stamp-match via\n   *  `_materializedFrom`, but whose erasure was declined by the #718 tier-elevation gate\n   *  (`_internalDelete` returned false). Ownership CONFIRMED here — a real silent survival,\n   *  not a stamp-mismatch skip — surfaced rather than dropped. Non-empty means a live,\n   *  tier-holder-decryptable copy of the forgotten contribution was deliberately retained. */\n  readonly derivedResidueDeclined: readonly string[]\n}\n\n/** #633 — the two `scopedPurgeResidue` skip reasons. Single source of truth: `purge-scope.ts`\n *  (the port-internal partition helpers) imports this rather than redeclaring it. */\nexport type ScopedPurgeResidueReason = 'skipped-undeclared-sealed-cek' | 'skipped-undeclared-blob-scan'\n\n/** #633 — one `ForgetResult.scopedPurgeResidue` entry: an undeclared collection's sealed-CEK\n *  entries left unpurged, or its blob scan skipped entirely, under `scopedPurge`. `count` is the\n *  number of `_sealed_cek` entries left in place (sealed-cek reason) or the number of refs whose\n *  blob scan was skipped (blob-scan reason) — aggregated per collection across the whole call. */\nexport interface ScopedPurgeResidueNotice {\n  readonly reason: ScopedPurgeResidueReason\n  readonly collection: string\n  readonly count: number\n}\n","/**\n * The encrypted subject index.\n *\n * GDPR crypto-shred needs to answer \"which records belong to data subject\n * X?\" portably (the index must travel with the vault/bundle) WITHOUT leaking\n * subject-equivalence to the store. The rejected alternative — an unencrypted\n * subject tag in envelope metadata — would let anyone with store access see\n * which records share a subject. Instead we keep a reserved `_subject_index`\n * collection, encrypted under its OWN DEK (`getDEK('_subject_index')`):\n *\n *   - record id  = `HMAC-SHA256(indexDEK, subjectId)` (M-2). A bare\n *     `sha256Hex(subjectId)` would be offline-computable: an attacker with\n *     store access and a candidate list (emails / customer ids are low-entropy)\n *     could dictionary the hash to confirm \"subject X is present here.\" Keying\n *     the id with the vault-only index DEK removes that capability — without the\n *     DEK the id cannot be derived. (Legacy entries written before M-2 used the\n *     bare sha256 id; the read/remove paths dual-look-up both forms.)\n *   - record body = AES-GCM(JSON `{ r: [{ collection, id }], p }`) under the\n *     index DEK, where `p` pads the plaintext to a bucketed length so the\n *     ciphertext `_data` length does not leak the approximate record count.\n *     Legacy bodies were a bare `[{ collection, id }]` array; reads accept both.\n *\n * ## Concurrency (RISK #3 — known v1 limitation)\n *\n * `addSubjectRef` / `removeSubjectRef` are read-modify-write with no CAS. The\n * design assumes a SINGLE WRITER (the noy-db single-process write model). Two\n * concurrent writers racing on the SAME subject can lose an entry (last-write\n * wins on the ref list). This is documented, not fixed in v1:\n * `rebuildSubjectIndex` performs a full scan to recover a correct index from\n * the canonical records, so a lost ref is recoverable. A CAS-backed index is\n * deferred to a later slice.\n *\n * @module\n */\nimport { encrypt, openEnvelopeJson, hmacSha256Hex, sha256Hex, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\n\n/** Reserved collection holding the encrypted subject → records index. */\nexport const SUBJECT_INDEX_COLLECTION = '_subject_index'\n\n/**\n * Bucket (bytes) the encrypted ref-list plaintext is padded up to, so the\n * ciphertext `_data` length leaks only `count` rounded up to a bucket — not the\n * exact record count. 256 keeps small subjects (the common case) indistinguishable.\n */\nconst REF_LIST_BUCKET = 256\n\n/** A single record reference held in a subject's index entry. */\nexport interface SubjectRef {\n  readonly collection: string\n  readonly id: string\n}\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** SHA-256 hex of a UTF-8 string. The LEGACY (pre-M-2) subject-index key. */\nasync function sha256HexString(input: string): Promise<string> {\n  return sha256Hex(new TextEncoder().encode(input))\n}\n\n/**\n * The subject-index record id(s) to consult for a subject, most-current first.\n *\n * - Encrypted vault: the PRIMARY id is `HMAC-SHA256(indexDEK, subjectId)` (M-2)\n *   — not offline-computable. The LEGACY `sha256Hex(subjectId)` id is also\n *   returned so reads/removes still find entries written before M-2 (dual-lookup).\n * - Plaintext/debug vault: no DEK to key with, so the only id is the legacy\n *   sha256 form (unchanged behaviour — plaintext mode is not zero-knowledge anyway).\n */\nasync function subjectKeys(getDEK: GetDEK, encrypted: boolean, subjectId: string): Promise<string[]> {\n  const legacy = await sha256HexString(subjectId)\n  if (!encrypted) return [legacy]\n  const dek = await getDEK(SUBJECT_INDEX_COLLECTION)\n  const keyed = await hmacSha256Hex(dek, new TextEncoder().encode(subjectId))\n  return keyed === legacy ? [keyed] : [keyed, legacy]\n}\n\n/** The id new writes land under (keyed when encrypted, else legacy sha256). */\nasync function primarySubjectKey(getDEK: GetDEK, encrypted: boolean, subjectId: string): Promise<string> {\n  return (await subjectKeys(getDEK, encrypted, subjectId))[0]!\n}\n\n/** Parse a stored ref-list body: new padded `{ r, p }` wrapper OR legacy bare array. */\nfunction parseRefs(json: string): SubjectRef[] {\n  const parsed = JSON.parse(json) as SubjectRef[] | { r: SubjectRef[] }\n  return Array.isArray(parsed) ? parsed : parsed.r\n}\n\n/** Serialize + pad the ref list to a bucket boundary (encrypted vaults only). */\nfunction serializeRefs(refs: SubjectRef[]): string {\n  const base = JSON.stringify({ r: refs, p: '' })\n  const pad = Math.ceil(base.length / REF_LIST_BUCKET) * REF_LIST_BUCKET - base.length\n  return JSON.stringify({ r: refs, p: ' '.repeat(pad) })\n}\n\n/** Read + decrypt the ref list at a SINGLE index key. Returns `[]` when absent. */\nasync function readRefs(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  key: string,\n): Promise<SubjectRef[]> {\n  const env = await adapter.get(vault, SUBJECT_INDEX_COLLECTION, key)\n  if (!env || !env._data) return []\n  if (!encrypted) return parseRefs(env._data)\n  const dek = await getDEK(SUBJECT_INDEX_COLLECTION)\n  const json = await openEnvelopeJson(env, dek)\n  return parseRefs(json)\n}\n\n/** Encrypt + write a ref list for a subject under its derived key. */\nasync function writeRefs(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  key: string,\n  refs: SubjectRef[],\n): Promise<void> {\n  let env: EncryptedEnvelope\n  if (!encrypted) {\n    // Plaintext/debug vault: keep the legacy bare-array form (no padding needed).\n    env = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: new Date().toISOString(), _iv: '', _data: JSON.stringify(refs) }\n  } else {\n    const dek = await getDEK(SUBJECT_INDEX_COLLECTION)\n    const { iv, data } = await encrypt(serializeRefs(refs), dek)\n    env = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: new Date().toISOString(), _iv: iv, _data: data }\n  }\n  await adapter.put(vault, SUBJECT_INDEX_COLLECTION, key, env)\n}\n\n/**\n * Add a `{ collection, id }` ref to a subject's index entry (idempotent —\n * a duplicate ref is not appended). Read-modify-write; see the concurrency\n * note in the module docstring.\n */\nexport async function addSubjectRef(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjectId: string,\n  ref: SubjectRef,\n): Promise<void> {\n  const key = await primarySubjectKey(getDEK, encrypted, subjectId)\n  const refs = await readRefs(adapter, vault, getDEK, encrypted, key)\n  if (refs.some((r) => r.collection === ref.collection && r.id === ref.id)) return\n  refs.push(ref)\n  await writeRefs(adapter, vault, getDEK, encrypted, key, refs)\n}\n\n/**\n * Remove a `{ collection, id }` ref from a subject's index entry. When the\n * last ref is removed the (now empty) entry is deleted so the store holds no\n * residual key for an erased subject.\n */\nexport async function removeSubjectRef(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjectId: string,\n  ref: SubjectRef,\n): Promise<void> {\n  // Dual-lookup: drop the ref from BOTH the keyed (M-2) and the legacy sha256\n  // entry, so a pre-M-2 subject is still fully erased.\n  for (const key of await subjectKeys(getDEK, encrypted, subjectId)) {\n    const refs = await readRefs(adapter, vault, getDEK, encrypted, key)\n    const next = refs.filter((r) => !(r.collection === ref.collection && r.id === ref.id))\n    if (next.length === refs.length) continue\n    if (next.length === 0) {\n      await adapter.delete(vault, SUBJECT_INDEX_COLLECTION, key)\n    } else {\n      await writeRefs(adapter, vault, getDEK, encrypted, key, next)\n    }\n  }\n}\n\n/**\n * Look up every record ref for a subject. Returns `[]` when none exist. Unions\n * the keyed (M-2) and legacy sha256 entries (dual-lookup), deduplicated, so a\n * subject indexed before M-2 is still fully found.\n */\nexport async function lookupSubject(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjectId: string,\n): Promise<SubjectRef[]> {\n  const keys = await subjectKeys(getDEK, encrypted, subjectId)\n  const seen = new Set<string>()\n  const out: SubjectRef[] = []\n  for (const key of keys) {\n    for (const ref of await readRefs(adapter, vault, getDEK, encrypted, key)) {\n      const dedup = `${ref.collection}\\u0000${ref.id}`\n      if (seen.has(dedup)) continue\n      seen.add(dedup)\n      out.push(ref)\n    }\n  }\n  return out\n}\n\n/**\n * Rebuild the entire subject index from the canonical records (the recovery\n * path for the documented read-modify-write race). Scans each declared\n * collection, reads `record[subjectField]` (dotted path), and rewrites the\n * index from scratch. Tombstoned (already-shredded) records contribute no\n * ref — their body is gone, so they cannot be re-indexed.\n *\n * `decodeRecord` decrypts an envelope to a plain object (or returns null for\n * a tombstone / unreadable record); supplied by the caller so this module\n * stays free of Collection internals.\n */\nexport async function rebuildSubjectIndex(\n  adapter: NoydbStore,\n  vault: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n  subjects: Readonly<Record<string, string>>,\n  decodeRecord: (collection: string, id: string, env: EncryptedEnvelope) => Promise<Record<string, unknown> | null>,\n): Promise<number> {\n  // Drop every existing index entry first so removed refs don't linger.\n  const existing = await adapter.list(vault, SUBJECT_INDEX_COLLECTION)\n  for (const k of existing) {\n    await adapter.delete(vault, SUBJECT_INDEX_COLLECTION, k)\n  }\n\n  // subjectId → refs, accumulated across all declared collections.\n  const bySubject = new Map<string, SubjectRef[]>()\n  for (const [collection, field] of Object.entries(subjects)) {\n    const ids = await adapter.list(vault, collection)\n    for (const id of ids) {\n      if (id.startsWith('_')) continue\n      const env = await adapter.get(vault, collection, id)\n      if (!env || !env._data) continue // missing or tombstone\n      const record = await decodeRecord(collection, id, env)\n      if (record === null) continue\n      const subjectValue = readDottedPath(record, field)\n      if (subjectValue === undefined || subjectValue === null) continue\n      const subjectId = coerceSubjectId(subjectValue)\n      const list = bySubject.get(subjectId) ?? []\n      list.push({ collection, id })\n      bySubject.set(subjectId, list)\n    }\n  }\n\n  let entries = 0\n  for (const [subjectId, refs] of bySubject) {\n    const key = await primarySubjectKey(getDEK, encrypted, subjectId)\n    await writeRefs(adapter, vault, getDEK, encrypted, key, refs)\n    entries++\n  }\n  return entries\n}\n\n/**\n * Coerce a read subject-field value to a stable string id. Primitives use\n * their natural string form; objects/arrays are JSON-stringified so structural\n * subjects still get a deterministic key (avoids the `[object Object]` trap).\n */\nexport function coerceSubjectId(value: unknown): string {\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') {\n    return String(value)\n  }\n  return JSON.stringify(value)\n}\n\n/** Read a (possibly dotted) field path from a plain record. */\nexport function readDottedPath(record: Record<string, unknown>, field: string): unknown {\n  if (!field.includes('.')) return record[field]\n  let cursor: unknown = record\n  for (const segment of field.split('.')) {\n    if (cursor === null || cursor === undefined) return undefined\n    cursor = (cursor as Record<string, unknown>)[segment]\n  }\n  return cursor\n}\n"],"mappings":";;;;;;;;;;;;;AAuEO,IAAM,YAA4B,EAAE,UAAU,CAAC,EAAE;;;AChCjD,IAAM,2BAA2B;AAOxC,IAAM,kBAAkB;AAWxB,eAAe,gBAAgB,OAAgC;AAC7D,SAAO,UAAU,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAClD;AAWA,eAAe,YAAY,QAAgB,WAAoB,WAAsC;AACnG,QAAM,SAAS,MAAM,gBAAgB,SAAS;AAC9C,MAAI,CAAC,UAAW,QAAO,CAAC,MAAM;AAC9B,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,QAAQ,MAAM,cAAc,KAAK,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAC1E,SAAO,UAAU,SAAS,CAAC,KAAK,IAAI,CAAC,OAAO,MAAM;AACpD;AAGA,eAAe,kBAAkB,QAAgB,WAAoB,WAAoC;AACvG,UAAQ,MAAM,YAAY,QAAQ,WAAW,SAAS,GAAG,CAAC;AAC5D;AAGA,SAAS,UAAU,MAA4B;AAC7C,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,SAAO,MAAM,QAAQ,MAAM,IAAI,SAAS,OAAO;AACjD;AAGA,SAAS,cAAc,MAA4B;AACjD,QAAM,OAAO,KAAK,UAAU,EAAE,GAAG,MAAM,GAAG,GAAG,CAAC;AAC9C,QAAM,MAAM,KAAK,KAAK,KAAK,SAAS,eAAe,IAAI,kBAAkB,KAAK;AAC9E,SAAO,KAAK,UAAU,EAAE,GAAG,MAAM,GAAG,IAAI,OAAO,GAAG,EAAE,CAAC;AACvD;AAGA,eAAe,SACb,SACA,OACA,QACA,WACA,KACuB;AACvB,QAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,0BAA0B,GAAG;AAClE,MAAI,CAAC,OAAO,CAAC,IAAI,MAAO,QAAO,CAAC;AAChC,MAAI,CAAC,UAAW,QAAO,UAAU,IAAI,KAAK;AAC1C,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,OAAO,MAAM,iBAAiB,KAAK,GAAG;AAC5C,SAAO,UAAU,IAAI;AACvB;AAGA,eAAe,UACb,SACA,OACA,QACA,WACA,KACA,MACe;AACf,MAAI;AACJ,MAAI,CAAC,WAAW;AAEd,UAAM,EAAE,QAAQ,sBAAsB,IAAI,GAAG,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,KAAK,IAAI,OAAO,KAAK,UAAU,IAAI,EAAE;AAAA,EACnH,OAAO;AACL,UAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,cAAc,IAAI,GAAG,GAAG;AAC3D,UAAM,EAAE,QAAQ,sBAAsB,IAAI,GAAG,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,KAAK,IAAI,OAAO,KAAK;AAAA,EACnG;AACA,QAAM,QAAQ,IAAI,OAAO,0BAA0B,KAAK,GAAG;AAC7D;AAOA,eAAsB,cACpB,SACA,OACA,QACA,WACA,WACA,KACe;AACf,QAAM,MAAM,MAAM,kBAAkB,QAAQ,WAAW,SAAS;AAChE,QAAM,OAAO,MAAM,SAAS,SAAS,OAAO,QAAQ,WAAW,GAAG;AAClE,MAAI,KAAK,KAAK,CAAC,MAAM,EAAE,eAAe,IAAI,cAAc,EAAE,OAAO,IAAI,EAAE,EAAG;AAC1E,OAAK,KAAK,GAAG;AACb,QAAM,UAAU,SAAS,OAAO,QAAQ,WAAW,KAAK,IAAI;AAC9D;AAOA,eAAsB,iBACpB,SACA,OACA,QACA,WACA,WACA,KACe;AAGf,aAAW,OAAO,MAAM,YAAY,QAAQ,WAAW,SAAS,GAAG;AACjE,UAAM,OAAO,MAAM,SAAS,SAAS,OAAO,QAAQ,WAAW,GAAG;AAClE,UAAM,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,eAAe,IAAI,cAAc,EAAE,OAAO,IAAI,GAAG;AACrF,QAAI,KAAK,WAAW,KAAK,OAAQ;AACjC,QAAI,KAAK,WAAW,GAAG;AACrB,YAAM,QAAQ,OAAO,OAAO,0BAA0B,GAAG;AAAA,IAC3D,OAAO;AACL,YAAM,UAAU,SAAS,OAAO,QAAQ,WAAW,KAAK,IAAI;AAAA,IAC9D;AAAA,EACF;AACF;AAOA,eAAsB,cACpB,SACA,OACA,QACA,WACA,WACuB;AACvB,QAAM,OAAO,MAAM,YAAY,QAAQ,WAAW,SAAS;AAC3D,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAoB,CAAC;AAC3B,aAAW,OAAO,MAAM;AACtB,eAAW,OAAO,MAAM,SAAS,SAAS,OAAO,QAAQ,WAAW,GAAG,GAAG;AACxE,YAAM,QAAQ,GAAG,IAAI,UAAU,KAAS,IAAI,EAAE;AAC9C,UAAI,KAAK,IAAI,KAAK,EAAG;AACrB,WAAK,IAAI,KAAK;AACd,UAAI,KAAK,GAAG;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AAaA,eAAsB,oBACpB,SACA,OACA,QACA,WACA,UACA,cACiB;AAEjB,QAAM,WAAW,MAAM,QAAQ,KAAK,OAAO,wBAAwB;AACnE,aAAW,KAAK,UAAU;AACxB,UAAM,QAAQ,OAAO,OAAO,0BAA0B,CAAC;AAAA,EACzD;AAGA,QAAM,YAAY,oBAAI,IAA0B;AAChD,aAAW,CAAC,YAAY,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC1D,UAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,UAAU;AAChD,eAAW,MAAM,KAAK;AACpB,UAAI,GAAG,WAAW,GAAG,EAAG;AACxB,YAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,YAAY,EAAE;AACnD,UAAI,CAAC,OAAO,CAAC,IAAI,MAAO;AACxB,YAAM,SAAS,MAAM,aAAa,YAAY,IAAI,GAAG;AACrD,UAAI,WAAW,KAAM;AACrB,YAAM,eAAe,eAAe,QAAQ,KAAK;AACjD,UAAI,iBAAiB,UAAa,iBAAiB,KAAM;AACzD,YAAM,YAAY,gBAAgB,YAAY;AAC9C,YAAM,OAAO,UAAU,IAAI,SAAS,KAAK,CAAC;AAC1C,WAAK,KAAK,EAAE,YAAY,GAAG,CAAC;AAC5B,gBAAU,IAAI,WAAW,IAAI;AAAA,IAC/B;AAAA,EACF;AAEA,MAAI,UAAU;AACd,aAAW,CAAC,WAAW,IAAI,KAAK,WAAW;AACzC,UAAM,MAAM,MAAM,kBAAkB,QAAQ,WAAW,SAAS;AAChE,UAAM,UAAU,SAAS,OAAO,QAAQ,WAAW,KAAK,IAAI;AAC5D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,gBAAgB,OAAwB;AACtD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AACxF,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,SAAO,KAAK,UAAU,KAAK;AAC7B;AAGO,SAAS,eAAe,QAAiC,OAAwB;AACtF,MAAI,CAAC,MAAM,SAAS,GAAG,EAAG,QAAO,OAAO,KAAK;AAC7C,MAAI,SAAkB;AACtB,aAAW,WAAW,MAAM,MAAM,GAAG,GAAG;AACtC,QAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,aAAU,OAAmC,OAAO;AAAA,EACtD;AACA,SAAO;AACT;","names":[]}