@noy-db/hub 0.6.0-pre.16 → 0.6.0-pre.18

package/dist/{chunk-AMKCY454.js.map → chunk-7WD2G6K4.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/kernel/tier-visibility.ts"],"sourcesContent":["/**\n * Tier visibility helper (#712/#707): a tier-0 code path treats an elevated\n * (_tier > 0) record as invisible. History reads gate on the LIVE record's\n * tier — history snapshots keep their tier-0-wrapped CEKs and carry no _tier\n * of their own, so an elevated record's prior versions would otherwise stay\n * tier-0-decryptable (the read-gate closes the API surface; #712's at-rest\n * arc rewraps the snapshot keys). Envelope inspection only — no decryption.\n *\n * #715/#716: the write ring. Invisibility on the read side is exactly what\n * makes a tier-0 write path treat an elevated record as absent — a put()\n * believes it's a create (demotion) and a delete() writes a marker with no\n * _tier (erasing the elevation signal). `assertTierWritable` closes that by\n * refusing the write outright. Both helpers share a single envelope peek\n * (`peekLiveTier`) — no duplicated `adapter.get` per write.\n */\nimport type { NoydbStore } from './types.js'\nimport { TierWriteRefusedError } from './errors.js'\n\nasync function peekLiveTier(\n  adapter: NoydbStore, vault: string, name: string, id: string,\n): Promise<number> {\n  const env = await adapter.get(vault, name, id)\n  return env?._tier ?? 0\n}\n\nexport async function liveRecordIsElevated(\n  adapter: NoydbStore, vault: string, name: string, id: string,\n): Promise<boolean> {\n  return (await peekLiveTier(adapter, vault, name, id)) > 0\n}\n\n/**\n * The tier a record's LIVE envelope currently carries (0 if untiered or\n * never moved). #724 Task 4: `BlobSet.loadSlots`/`saveSlots` use this to\n * resolve the per-record slot map's collection DEK at the record's current\n * tier by default, so the slot map's physical location follows the record\n * after `rehomeForTier` re-keys it.\n */\nexport async function liveRecordTier(\n  adapter: NoydbStore, vault: string, name: string, id: string,\n): Promise<number> {\n  return peekLiveTier(adapter, vault, name, id)\n}\n\n/**\n * Refuses a tier-0 `put()`/`delete()` targeting an elevated record.\n * No-op when `tiersEnabled` is false (the cost gate — collections that\n * never declare tiers pay nothing). Throws `TierWriteRefusedError` with\n * the record's ACTUAL live tier when elevated — holders included, since\n * `put()`/`delete()` are the tier-0 APIs and `putAtTier`/`elevate`/`demote`\n * are the sanctioned tier-aware paths.\n */\nexport async function assertTierWritable(\n  adapter: NoydbStore, vault: string, name: string, id: string, tiersEnabled: boolean,\n): Promise<void> {\n  if (!tiersEnabled) return\n  const tier = await peekLiveTier(adapter, vault, name, id)\n  if (tier > 0) throw new TierWriteRefusedError(name, tier)\n}\n\n/**\n * #708: ALL-OR-NOTHING pre-check for a coordinated-cutover bulk-rewrite —\n * scans every id's live tier BEFORE any record is transformed and refuses\n * on the first elevated one found. `_applyCutoverTransform` re-encrypts at\n * tier 0 with no gate of its own; without this, it would silently demote\n * an elevated record. Same cost gate as `assertTierWritable` (no-op, no\n * adapter call, when `tiersEnabled` is false).\n *\n * This pre-check guards against an ordinary `put()`/`delete()` racing the\n * cutover, because those go through the schema fence (`SchemaFenceController`\n * blocks concurrent writes during a coordinated cutover). It does NOT guard\n * against `elevate()`/`demote()`/`putAtTier()` — those tier-move paths bypass\n * the fence, so a tier move landing between this scan and the rewrite it\n * gates is not excluded. Cutover callers are expected to hold the vault\n * quiescent for tier moves on this collection for the duration of the call,\n * the same tier-quiescence assumption the documented CAS-less caller\n * (`with-shape/satellites/migrate-cek.ts`'s \"No-quiesce precondition\") makes\n * explicit for concurrent writes generally.\n */\nexport async function assertCutoverTierSafe(\n  adapter: NoydbStore, vault: string, name: string, tiersEnabled: boolean,\n): Promise<void> {\n  if (!tiersEnabled) return\n  for (const id of await adapter.list(vault, name)) {\n    const tier = await peekLiveTier(adapter, vault, name, id)\n    if (tier > 0) {\n      throw new TierWriteRefusedError(name, tier, `Coordinated cutover on collection \"${name}\" refused — record \"${id}\" is elevated to tier ${tier}. Demote it before a coordinated cutover.`)\n    }\n  }\n}\n"],"mappings":";;;;;AAkBA,eAAe,aACb,SAAqB,OAAe,MAAc,IACjC;AACjB,QAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,MAAM,EAAE;AAC7C,SAAO,KAAK,SAAS;AACvB;AAEA,eAAsB,qBACpB,SAAqB,OAAe,MAAc,IAChC;AAClB,SAAQ,MAAM,aAAa,SAAS,OAAO,MAAM,EAAE,IAAK;AAC1D;AASA,eAAsB,eACpB,SAAqB,OAAe,MAAc,IACjC;AACjB,SAAO,aAAa,SAAS,OAAO,MAAM,EAAE;AAC9C;AAUA,eAAsB,mBACpB,SAAqB,OAAe,MAAc,IAAY,cAC/C;AACf,MAAI,CAAC,aAAc;AACnB,QAAM,OAAO,MAAM,aAAa,SAAS,OAAO,MAAM,EAAE;AACxD,MAAI,OAAO,EAAG,OAAM,IAAI,sBAAsB,MAAM,IAAI;AAC1D;AAqBA,eAAsB,sBACpB,SAAqB,OAAe,MAAc,cACnC;AACf,MAAI,CAAC,aAAc;AACnB,aAAW,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI,GAAG;AAChD,UAAM,OAAO,MAAM,aAAa,SAAS,OAAO,MAAM,EAAE;AACxD,QAAI,OAAO,GAAG;AACZ,YAAM,IAAI,sBAAsB,MAAM,MAAM,sCAAsC,IAAI,4BAAuB,EAAE,yBAAyB,IAAI,2CAA2C;AAAA,IACzL;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/kernel/tier-visibility.ts"],"sourcesContent":["/**\n * Tier visibility helper (#712/#707): a tier-0 code path treats an elevated\n * (_tier > 0) record as invisible. History reads gate on the LIVE record's\n * tier — history snapshots keep their tier-0-wrapped CEKs and carry no _tier\n * of their own, so an elevated record's prior versions would otherwise stay\n * tier-0-decryptable (the read-gate closes the API surface; #712's at-rest\n * arc rewraps the snapshot keys). Envelope inspection only — no decryption.\n *\n * #715/#716: the write ring. Invisibility on the read side is exactly what\n * makes a tier-0 write path treat an elevated record as absent — a put()\n * believes it's a create (demotion) and a delete() writes a marker with no\n * _tier (erasing the elevation signal). `assertTierWritable` closes that by\n * refusing the write outright. Both helpers share a single envelope peek\n * (`peekLiveTier`) — no duplicated `adapter.get` per write.\n */\nimport type { NoydbStore } from './types.js'\nimport { TierWriteRefusedError } from './errors.js'\n\nasync function peekLiveTier(\n  adapter: NoydbStore, vault: string, name: string, id: string,\n): Promise<number> {\n  const env = await adapter.get(vault, name, id)\n  return env?._tier ?? 0\n}\n\nexport async function liveRecordIsElevated(\n  adapter: NoydbStore, vault: string, name: string, id: string,\n): Promise<boolean> {\n  return (await peekLiveTier(adapter, vault, name, id)) > 0\n}\n\n/**\n * The tier a record's LIVE envelope currently carries (0 if untiered or\n * never moved). #724 Task 4: `BlobSet.loadSlots`/`saveSlots` use this to\n * resolve the per-record slot map's collection DEK at the record's current\n * tier by default, so the slot map's physical location follows the record\n * after `rehomeForTier` re-keys it.\n */\nexport async function liveRecordTier(\n  adapter: NoydbStore, vault: string, name: string, id: string,\n): Promise<number> {\n  return peekLiveTier(adapter, vault, name, id)\n}\n\n/**\n * Refuses a tier-0 `put()`/`delete()` targeting an elevated record.\n * No-op when `tiersEnabled` is false (the cost gate — collections that\n * never declare tiers pay nothing). Throws `TierWriteRefusedError` with\n * the record's ACTUAL live tier when elevated — holders included, since\n * `put()`/`delete()` are the tier-0 APIs and `putAtTier`/`elevate`/`demote`\n * are the sanctioned tier-aware paths.\n */\nexport async function assertTierWritable(\n  adapter: NoydbStore, vault: string, name: string, id: string, tiersEnabled: boolean,\n): Promise<void> {\n  if (!tiersEnabled) return\n  const tier = await peekLiveTier(adapter, vault, name, id)\n  if (tier > 0) throw new TierWriteRefusedError(name, tier)\n}\n\n/**\n * #708: ALL-OR-NOTHING pre-check for a coordinated-cutover bulk-rewrite —\n * scans every id's live tier BEFORE any record is transformed and refuses\n * on the first elevated one found. `_applyCutoverTransform` re-encrypts at\n * tier 0 with no gate of its own; without this, it would silently demote\n * an elevated record. Same cost gate as `assertTierWritable` (no-op, no\n * adapter call, when `tiersEnabled` is false).\n *\n * This pre-check guards against an ordinary `put()`/`delete()` racing the\n * cutover, because those go through the schema fence (`SchemaFenceController`\n * blocks concurrent writes during a coordinated cutover). It does NOT guard\n * against `elevate()`/`demote()`/`putAtTier()` — those tier-move paths bypass\n * the fence, so a tier move landing between this scan and the rewrite it\n * gates is not excluded. Cutover callers are expected to hold the vault\n * quiescent for tier moves on this collection for the duration of the call,\n * the same tier-quiescence assumption the documented CAS-less caller\n * (`with-shape/satellites/migrate-cek.ts`'s \"No-quiesce precondition\") makes\n * explicit for concurrent writes generally.\n */\nexport async function assertCutoverTierSafe(\n  adapter: NoydbStore, vault: string, name: string, tiersEnabled: boolean,\n): Promise<void> {\n  if (!tiersEnabled) return\n  for (const id of await adapter.list(vault, name)) {\n    const tier = await peekLiveTier(adapter, vault, name, id)\n    if (tier > 0) {\n      throw new TierWriteRefusedError(name, tier, `Coordinated cutover on collection \"${name}\" refused — record \"${id}\" is elevated to tier ${tier}. Demote it before a coordinated cutover.`)\n    }\n  }\n}\n\n/**\n * The key a collection's DEK is stored under in `UnlockedKeyring.deks` for a\n * given tier: `collection` at tier 0, `collection#N` above it.\n *\n * Lives in the kernel because the `deks` map is a kernel type and the kernel\n * reads it — `noydb.ts` needs this to resolve the right DEK when verifying a\n * pulled envelope (#1042). `with-party/team/tiers.ts` re-exports it, so every\n * existing importer is unchanged; the definition simply moved to the layer that\n * owns the map rather than one that happens to use it.\n *\n * This move was forced by `port-layering`, and rightly: the alternative was the\n * kernel spine statically importing a `with-*` service, or duplicating the\n * naming convention in two places where it could drift.\n */\nexport function dekKey(collection: string, tier: number): string {\n  if (tier <= 0) return collection\n  return `${collection}#${tier}`\n}\n"],"mappings":";;;;;AAkBA,eAAe,aACb,SAAqB,OAAe,MAAc,IACjC;AACjB,QAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,MAAM,EAAE;AAC7C,SAAO,KAAK,SAAS;AACvB;AAEA,eAAsB,qBACpB,SAAqB,OAAe,MAAc,IAChC;AAClB,SAAQ,MAAM,aAAa,SAAS,OAAO,MAAM,EAAE,IAAK;AAC1D;AASA,eAAsB,eACpB,SAAqB,OAAe,MAAc,IACjC;AACjB,SAAO,aAAa,SAAS,OAAO,MAAM,EAAE;AAC9C;AAUA,eAAsB,mBACpB,SAAqB,OAAe,MAAc,IAAY,cAC/C;AACf,MAAI,CAAC,aAAc;AACnB,QAAM,OAAO,MAAM,aAAa,SAAS,OAAO,MAAM,EAAE;AACxD,MAAI,OAAO,EAAG,OAAM,IAAI,sBAAsB,MAAM,IAAI;AAC1D;AAqBA,eAAsB,sBACpB,SAAqB,OAAe,MAAc,cACnC;AACf,MAAI,CAAC,aAAc;AACnB,aAAW,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI,GAAG;AAChD,UAAM,OAAO,MAAM,aAAa,SAAS,OAAO,MAAM,EAAE;AACxD,QAAI,OAAO,GAAG;AACZ,YAAM,IAAI,sBAAsB,MAAM,MAAM,sCAAsC,IAAI,4BAAuB,EAAE,yBAAyB,IAAI,2CAA2C;AAAA,IACzL;AAAA,EACF;AACF;AAgBO,SAAS,OAAO,YAAoB,MAAsB;AAC/D,MAAI,QAAQ,EAAG,QAAO;AACtB,SAAO,GAAG,UAAU,IAAI,IAAI;AAC9B;","names":[]}

package/dist/{chunk-VUUUIKRG.js → chunk-A5QQKWCK.js}

@@ -2,14 +2,15 @@ import {
   generateULID
 } from "./chunk-4AOERLTV.js";
 import {
+  buildRecordAad,
   openEnvelopeJson
-} from "./chunk-LTVETWDH.js";
+} from "./chunk-X3AXSYBL.js";
+import {
+  buildRecordEnvelope
+} from "./chunk-ZVAFJQZB.js";
 import {
   encrypt
 } from "./chunk-QTDAPDDV.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-SFY6NT7D.js";
 
 // src/with-audit/consent/consent.ts
 var CONSENT_AUDIT_COLLECTION = "_consent_audit";
@@ -29,7 +30,7 @@ async function loadConsentEntries(adapter, vault, encrypted, getDEK, filter = {}
   for (const id of ids.sort()) {
     const envelope = await adapter.get(vault, CONSENT_AUDIT_COLLECTION, id);
     if (!envelope) continue;
-    const entry = await decryptEntry(envelope, encrypted, getDEK);
+    const entry = await decryptEntry(id, envelope, encrypted, getDEK);
     if (!matchesFilter(entry, filter)) continue;
     entries.push(entry);
   }
@@ -37,28 +38,18 @@ async function loadConsentEntries(adapter, vault, encrypted, getDEK, filter = {}
 }
 async function buildEnvelope(entry, encrypted, getDEK) {
   const json = JSON.stringify(entry);
+  const identity = { collection: CONSENT_AUDIT_COLLECTION, id: entry.id, version: 1 };
+  const body = { ts: entry.timestamp };
   if (!encrypted) {
-    return {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: 1,
-      _ts: entry.timestamp,
-      _iv: "",
-      _data: json
-    };
+    return buildRecordEnvelope(identity, { ...body, iv: "", data: json });
   }
   const dek = await getDEK(CONSENT_AUDIT_COLLECTION);
-  const { iv, data } = await encrypt(json, dek);
-  return {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: 1,
-    _ts: entry.timestamp,
-    _iv: iv,
-    _data: data
-  };
+  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+  return buildRecordEnvelope(identity, { ...body, iv, data });
 }
-async function decryptEntry(envelope, encrypted, getDEK) {
+async function decryptEntry(id, envelope, encrypted, getDEK) {
   if (!encrypted) return JSON.parse(envelope._data);
-  const json = await openEnvelopeJson(envelope, await getDEK(CONSENT_AUDIT_COLLECTION));
+  const json = await openEnvelopeJson({ collection: CONSENT_AUDIT_COLLECTION, id }, envelope, await getDEK(CONSENT_AUDIT_COLLECTION));
   return JSON.parse(json);
 }
 function matchesFilter(entry, f) {
@@ -75,4 +66,4 @@ export {
   writeConsentEntry,
   loadConsentEntries
 };
-//# sourceMappingURL=chunk-VUUUIKRG.js.map
+//# sourceMappingURL=chunk-A5QQKWCK.js.map

package/dist/chunk-A5QQKWCK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/consent/consent.ts"],"sourcesContent":["/**\n * Consent boundaries — per-access audit log.\n *\n * ```ts\n * const audit = await vault.withConsent(\n *   { purpose: 'quarterly-review', consentHash: '7f3a...' },\n *   async () => {\n *     const invoices = await vault.collection<Invoice>('invoices').list()\n *     return invoices\n *   },\n * )\n *\n * const log = await vault.consentAudit({ since: '2026-01-01T00:00:00Z' })\n * // → entries: { actor, purpose, consentHash, ts, op, collection, id }\n * ```\n *\n * ## Contract\n *\n * Every `get` / `put` / `delete` that happens inside a `withConsent`\n * callback writes one entry to the reserved `_consent_audit`\n * collection. Entries are encrypted with the vault's consent-audit\n * DEK (separate from per-user-collection DEKs so access-log queries\n * don't require unwrapping individual collection keys). Outside a\n * `withConsent` scope, no entries are written — consent is\n * opt-in by design (GDPR Art. 7: *demonstrable*, *specific*\n * consent).\n *\n * ## Why store the hash, not the consent text?\n *\n * The `consentHash` is the sha256 of whatever consent receipt the\n * actor presented (a signed GDPR banner click, a HIPAA authorisation\n * PDF, an API-level `X-Consent-Hash` header). Storing only the hash:\n *\n *   1. Keeps the audit log small and indexable.\n *   2. Preserves zero-knowledge at the adapter — adapters see\n *      ciphertext envelopes of `{ actor, purpose, consentHash, ts,\n *      op, collection, id }`, never the consent record itself.\n *   3. Lets the regulator verify a presented consent doc matches\n *      the logged hash at audit time without the system ever\n *      possessing the doc.\n *\n * ## Concurrency\n *\n * The consent context lives on the {@link Vault} instance. Two\n * concurrent `withConsent` calls on the same Vault would stomp each\n * other — documented limitation; adopters needing per-flight scope\n * should use separate Vault instances or an AsyncLocalStorage shim.\n *\n * @module\n */\nimport type { EncryptedEnvelope, NoydbStore } from '../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\n/** Reserved collection for consent-audit entries. */\nexport const CONSENT_AUDIT_COLLECTION = '_consent_audit'\n\n/**\n * The consent scope active for a block of work. Set via\n * `vault.withConsent()`; observed by the collection's access hooks.\n */\nexport interface ConsentContext {\n  /**\n   * What this access is for. Used by the audit query (`consentAudit\n   * ({ purpose })`) and carried in the stored entry. Free-form; the\n   * regulator or compliance tooling decides the vocabulary.\n   */\n  readonly purpose: string\n  /**\n   * Hex-encoded sha256 of whatever consent artefact the actor\n   * presented. Stored as-is in each entry.\n   */\n  readonly consentHash: string\n}\n\n/**\n * Access operation recorded in an audit entry.\n *\n * Union-widening checklist (I-2) — these three sites widen together or a\n * downstream exhaustive switch breaks at its next in-range minor:\n *   1. `ConsentOp` here (public, re-exported at `index.ts`).\n *   2. `onAccess` op union on `kernel/collection-config.ts`.\n *   3. classified ctx `onAccess` op union on `port/with/classified-strategy.ts`\n *      (the `ClassifiedVerifyCtx` one — the `ClassifiedRevealCtx` one stays `'reveal'`-only).\n */\nexport type ConsentOp = 'get' | 'put' | 'delete' | 'reveal' | 'verify' | 'find'\n\n/** One consent-audit record, as decrypted for the caller. */\nexport interface ConsentAuditEntry {\n  /** ULID — stable insertion-order key. */\n  readonly id: string\n  readonly timestamp: string\n  readonly actor: string\n  readonly purpose: string\n  readonly consentHash: string\n  readonly op: ConsentOp\n  readonly collection: string\n  readonly recordId: string\n}\n\n/** Filter passed to `vault.consentAudit()`. */\nexport interface ConsentAuditFilter {\n  /** Only entries at or after this ISO timestamp. */\n  readonly since?: string\n  /** Only entries at or before this ISO timestamp. */\n  readonly until?: string\n  /** Match entries targeting this collection. */\n  readonly collection?: string\n  /** Match entries written by this actor. */\n  readonly actor?: string\n  /** Match entries with this purpose. */\n  readonly purpose?: string\n}\n\n/**\n * Write one audit entry. Called by Vault's onAccess hook when a\n * consent context is active.\n */\nexport async function writeConsentEntry(\n  adapter: NoydbStore,\n  vault: string,\n  encrypted: boolean,\n  entry: Omit<ConsentAuditEntry, 'id' | 'timestamp'>,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<void> {\n  const id = generateULID()\n  const full: ConsentAuditEntry = {\n    id,\n    timestamp: new Date().toISOString(),\n    ...entry,\n  }\n  const envelope = await buildEnvelope(full, encrypted, getDEK)\n  await adapter.put(vault, CONSENT_AUDIT_COLLECTION, id, envelope)\n}\n\n/** Load + decrypt + filter all entries. */\nexport async function loadConsentEntries(\n  adapter: NoydbStore,\n  vault: string,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  filter: ConsentAuditFilter = {},\n): Promise<ConsentAuditEntry[]> {\n  const ids = await adapter.list(vault, CONSENT_AUDIT_COLLECTION)\n  const entries: ConsentAuditEntry[] = []\n\n  for (const id of ids.sort()) {\n    const envelope = await adapter.get(vault, CONSENT_AUDIT_COLLECTION, id)\n    if (!envelope) continue\n    const entry = await decryptEntry(id, envelope, encrypted, getDEK)\n    if (!matchesFilter(entry, filter)) continue\n    entries.push(entry)\n  }\n  return entries\n}\n\n// ── internals ──────────────────────────────────────────────────────\n\nasync function buildEnvelope(\n  entry: ConsentAuditEntry,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<EncryptedEnvelope> {\n  const json = JSON.stringify(entry)\n  // `entry.id` IS the record id the caller writes under, so identity needs no\n  // threading here (#1051).\n  const identity = { collection: CONSENT_AUDIT_COLLECTION, id: entry.id, version: 1 }\n  const body = { ts: entry.timestamp }\n  if (!encrypted) {\n    return buildRecordEnvelope(identity, { ...body, iv: '', data: json })\n  }\n  const dek = await getDEK(CONSENT_AUDIT_COLLECTION)\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  return buildRecordEnvelope(identity, { ...body, iv, data })\n}\n\nasync function decryptEntry(\n  id: string,\n  envelope: EncryptedEnvelope,\n  encrypted: boolean,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<ConsentAuditEntry> {\n  if (!encrypted) return JSON.parse(envelope._data) as ConsentAuditEntry\n  const json = await openEnvelopeJson({ collection: CONSENT_AUDIT_COLLECTION, id }, envelope, await getDEK(CONSENT_AUDIT_COLLECTION))\n  return JSON.parse(json) as ConsentAuditEntry\n}\n\nfunction matchesFilter(entry: ConsentAuditEntry, f: ConsentAuditFilter): boolean {\n  if (f.since && entry.timestamp < f.since) return false\n  if (f.until && entry.timestamp > f.until) return false\n  if (f.collection && entry.collection !== f.collection) return false\n  if (f.actor && entry.actor !== f.actor) return false\n  if (f.purpose && entry.purpose !== f.purpose) return false\n  return true\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuDO,IAAM,2BAA2B;AA+DxC,eAAsB,kBACpB,SACA,OACA,WACA,OACA,QACe;AACf,QAAM,KAAK,aAAa;AACxB,QAAM,OAA0B;AAAA,IAC9B;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,GAAG;AAAA,EACL;AACA,QAAM,WAAW,MAAM,cAAc,MAAM,WAAW,MAAM;AAC5D,QAAM,QAAQ,IAAI,OAAO,0BAA0B,IAAI,QAAQ;AACjE;AAGA,eAAsB,mBACpB,SACA,OACA,WACA,QACA,SAA6B,CAAC,GACA;AAC9B,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,wBAAwB;AAC9D,QAAM,UAA+B,CAAC;AAEtC,aAAW,MAAM,IAAI,KAAK,GAAG;AAC3B,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,0BAA0B,EAAE;AACtE,QAAI,CAAC,SAAU;AACf,UAAM,QAAQ,MAAM,aAAa,IAAI,UAAU,WAAW,MAAM;AAChE,QAAI,CAAC,cAAc,OAAO,MAAM,EAAG;AACnC,YAAQ,KAAK,KAAK;AAAA,EACpB;AACA,SAAO;AACT;AAIA,eAAe,cACb,OACA,WACA,QAC4B;AAC5B,QAAM,OAAO,KAAK,UAAU,KAAK;AAGjC,QAAM,WAAW,EAAE,YAAY,0BAA0B,IAAI,MAAM,IAAI,SAAS,EAAE;AAClF,QAAM,OAAO,EAAE,IAAI,MAAM,UAAU;AACnC,MAAI,CAAC,WAAW;AACd,WAAO,oBAAoB,UAAU,EAAE,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC;AAAA,EACtE;AACA,QAAM,MAAM,MAAM,OAAO,wBAAwB;AACjD,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,SAAO,oBAAoB,UAAU,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC;AAC5D;AAEA,eAAe,aACb,IACA,UACA,WACA,QAC4B;AAC5B,MAAI,CAAC,UAAW,QAAO,KAAK,MAAM,SAAS,KAAK;AAChD,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,0BAA0B,GAAG,GAAG,UAAU,MAAM,OAAO,wBAAwB,CAAC;AAClI,SAAO,KAAK,MAAM,IAAI;AACxB;AAEA,SAAS,cAAc,OAA0B,GAAgC;AAC/E,MAAI,EAAE,SAAS,MAAM,YAAY,EAAE,MAAO,QAAO;AACjD,MAAI,EAAE,SAAS,MAAM,YAAY,EAAE,MAAO,QAAO;AACjD,MAAI,EAAE,cAAc,MAAM,eAAe,EAAE,WAAY,QAAO;AAC9D,MAAI,EAAE,SAAS,MAAM,UAAU,EAAE,MAAO,QAAO;AAC/C,MAAI,EAAE,WAAW,MAAM,YAAY,EAAE,QAAS,QAAO;AACrD,SAAO;AACT;","names":[]}

package/dist/{chunk-RRMXMJUP.js → chunk-AA2WWTS3.js}

@@ -1,9 +1,10 @@
 import {
+  buildRecordAad,
   openEnvelopeJson
-} from "./chunk-LTVETWDH.js";
+} from "./chunk-X3AXSYBL.js";
 import {
   buildRecordEnvelope
-} from "./chunk-6E2JZRBD.js";
+} from "./chunk-ZVAFJQZB.js";
 import {
   encrypt
 } from "./chunk-QTDAPDDV.js";
@@ -127,17 +128,18 @@ var SequenceStore = class {
   async read(name) {
     const env = await this.adapter.get(this.vault, SEQUENCE_COLLECTION, name);
     if (!env) return { env: null, value: 0 };
-    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek()) : env._data;
+    const json = this.encrypted ? await openEnvelopeJson({ collection: SEQUENCE_COLLECTION, id: name }, env, await this.dek()) : env._data;
     const state = JSON.parse(json);
     return { env, value: state.value };
   }
   async encryptState(name, state, version) {
     const json = JSON.stringify(state);
     if (!this.encrypted) {
-      return buildRecordEnvelope({ collection: SEQUENCE_COLLECTION, id: name }, { version, iv: "", data: json, by: this.actor });
+      return buildRecordEnvelope({ collection: SEQUENCE_COLLECTION, id: name, version }, { iv: "", data: json });
     }
-    const { iv, data } = await encrypt(json, await this.dek());
-    return buildRecordEnvelope({ collection: SEQUENCE_COLLECTION, id: name }, { version, iv, data, by: this.actor });
+    const identity = { collection: SEQUENCE_COLLECTION, id: name, version };
+    const { iv, data } = await encrypt(json, await this.dek(), buildRecordAad(identity));
+    return buildRecordEnvelope(identity, { iv, data });
   }
   async peek(name) {
     return (await this.read(name)).value;
@@ -199,4 +201,4 @@ export {
   resolveSequenceKey,
   SequenceStore
 };
-//# sourceMappingURL=chunk-RRMXMJUP.js.map
+//# sourceMappingURL=chunk-AA2WWTS3.js.map

package/dist/chunk-AA2WWTS3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/sequence/active.ts","../src/with-commit/sequence/strategy.ts","../src/with-commit/sequence/index.ts"],"sourcesContent":["/**\n * Enable the atomic-sequence capability.\n * Pass to `createNoydb({ sequenceStrategy: withSequence() })` to make\n * `vault.sequence('name').next()` / `.peek()` / `.seedTo()` live. The\n * {@link SequenceStore} CAS engine is statically imported here, so it is pulled\n * into the bundle only when `withSequence()` is referenced (the floor never\n * imports it).\n */\nimport type { SequenceStrategy } from './strategy.js'\nimport { SequenceStore } from './index.js'\n\nexport function withSequence(): SequenceStrategy {\n  return {\n    createStore(opts) {\n      return new SequenceStore(opts)\n    },\n  }\n}\n","/**\n * Sequence capability strategy — the single on-demand factory the vault routes\n * `vault.sequence()` through to build its atomic-CAS {@link SequenceStore}. The\n * active engine ({@link withSequence}) constructs the real store (kept out of\n * the floor bundle — the store class is reached only via the opt-in\n * `active.ts` chunk); {@link NO_SEQUENCE} throws. The vault always assembles the\n * per-call {@link SequenceStoreOptions} and delegates here, so an un-opted-in\n * caller hits `NO_SEQUENCE`'s throw at `vault.sequence()`.\n *\n * Note: `vault.sequence()` is synchronous, so the factory is a plain (sync)\n * constructor — the engine is tree-shaken by reachability (only `withSequence()`\n * pulls `active.ts`, which statically imports the store), not by a dynamic\n * import. Deferred-numbering series (`withDeferredNumbering`) are a distinct\n * capability and are NOT routed through this strategy.\n * @internal\n */\nimport type { SequenceStore, SequenceStoreOptions } from './index.js'\nimport { SequenceNotEnabledError } from '../../kernel/errors.js'\n\nexport interface SequenceStrategy {\n  createStore(opts: SequenceStoreOptions): SequenceStore\n}\n\n/**\n * No-op stub — the floor default. The capability factory throws\n * {@link SequenceNotEnabledError}; opt in with `sequenceStrategy: withSequence()`\n * in createNoydb. @internal\n */\nexport const NO_SEQUENCE: SequenceStrategy = {\n  createStore(): SequenceStore {\n    throw new SequenceNotEnabledError()\n  },\n}\n","/**\n * Atomic sequence primitive — online-coordinated gap-free numbering.\n *\n * `vault.sequence('invoice-2026').next()` returns 1, 2, 3, … with no\n * gaps and no duplicates, even under concurrent callers. Each named\n * sequence is an independent counter record at `_sequences/<name>`,\n * incremented with an optimistic compare-and-swap retry loop — the same\n * proven pattern as the ledger head (`history/ledger/store.ts`).\n *\n * **Explicitly online-only.** Gap-free numbering requires single-authority\n * serialization, which an offline / non-CAS store cannot provide. `next()`\n * throws {@link SequenceOfflineError} unless the backing store advertises\n * `capabilities.casAtomic`. This is a deliberate, honest wall — an offline\n * writer cannot safely allocate a global sequence number.\n *\n * Note on \"gap-free\": the *sequence* is gap-free (each `next()` yields a\n * unique, +1 value). If a caller discards a value without using it, that\n * is a gap in *usage*, not in the sequence — assign each `next()` result\n * to its record in the same operation.\n */\n\nimport { buildRecordAad, buildRecordEnvelope } from '../../kernel/enclave/index.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { ConflictError} from '../../kernel/errors.js';\nimport { isConflictError, SequenceContentionError, SequenceOfflineError, ValidationError } from '../../kernel/errors.js'\n\n// Capability opt-in seam (S4): `vault.sequence()` builds its CAS store through\n// the sequenceStrategy, so it throws SequenceNotEnabledError unless opted in.\nexport { withSequence } from './active.js'\nexport { NO_SEQUENCE, type SequenceStrategy } from './strategy.js'\nexport { SequenceNotEnabledError } from '../../kernel/errors.js'\n\nexport const SEQUENCE_COLLECTION = '_sequences'\n// A sequence is a single hot CAS row — higher contention than a ledger\n// append. A larger budget + jittered backoff absorbs moderate concurrency;\n// a genuine burst beyond this surfaces SequenceContentionError so the\n// caller can retry / queue (the honest online-only contract).\nconst MAX_NEXT_ATTEMPTS = 16\n\ninterface SequenceState {\n  value: number\n}\n\n/** Options for `SequenceHandle.next`. Deferred-numbering series use `for`; the CAS counter ignores all of these. */\nexport interface NextOptions {\n  /** Deferred mode: the record id to number. Ignored by the CAS counter. */\n  readonly for?: string\n  /** Deferred mode: reject after this many ms if still unsealed (reserved; not yet enforced in this slice). */\n  readonly timeoutMs?: number\n}\n\n/**\n * Partitioning for a CAS sequence. A partitioned sequence is an\n * independent counter scoped to one tuple of values — e.g.\n * `sequence('invoice', { partition: [2026, 'EU'] })` numbers EU-2026 invoices\n * separately from `[2026, 'US']` and from the bare `invoice` series.\n *\n * Partition components are URI-encoded (so `/`, null bytes and other\n * separators in a value can never collide with the structural separators) and\n * `'/'`-joined, then appended to the series with a null-byte (`\\x00`)\n * separator. The null byte is illegal in a plain series name, which guarantees\n * a partitioned key is always disjoint from any unpartitioned series.\n */\nexport interface SequenceOptions {\n  /** Partition tuple. Each component is URI-encoded and `'/'`-joined. */\n  readonly partition?: readonly (string | number)[]\n  /**\n   * Render template for the serial string. When set, `vault.sequence`\n   * returns a {@link FormattedSequenceHandle} whose `next()` resolves to\n   * `{ serial, formatted }`. Tokens:\n   * - `{seq}` — the allocated integer\n   * - `{seq:0N}` — zero-padded to width N (e.g. `{seq:04}` → `0001`)\n   * - `{partition.i}` — the i-th `partition` component (original value)\n   *\n   * Any other token, or a `{partition.i}` index beyond the supplied\n   * `partition`, throws `ValidationError` at `vault.sequence()` construction.\n   * Per-partition reset is inherent: a new partition tuple starts at 1.\n   */\n  readonly format?: string\n}\n\n/**\n * A formatted sequence handle. Identical to {@link SequenceHandle}\n * except `next()` also returns the rendered `formatted` string. `peek()` /\n * `seedTo()` operate on the underlying integer counter, unchanged.\n */\nexport interface FormattedSequenceHandle {\n  /** Allocate the next value and return it with its rendered serial string. */\n  next(opts?: NextOptions): Promise<{ serial: number; formatted: string }>\n  /** Read the current integer value without allocating. Returns 0 if never used. */\n  peek(): Promise<number>\n  /** Set-if-greater on the underlying integer counter. See {@link SequenceHandle.seedTo}. */\n  seedTo(n: number): Promise<void>\n}\n\n// Matches a single `{...}` token with no nested braces.\nconst SEQ_FORMAT_TOKEN = /\\{([^{}]*)\\}/g\nconst SEQ_PAD_TOKEN = /^seq:0(\\d+)$/\nconst SEQ_PARTITION_TOKEN = /^partition\\.(\\d+)$/\n\n/**\n * Validate a sequence `format` against the supplied partition and return a\n * pure `(serial) => string` renderer. Eager validation: every token is\n * checked now, so a bad pattern throws `ValidationError` at construction —\n * never at `next()` time.\n */\nexport function compileSequenceFormat(\n  format: string,\n  series: string,\n  partition: readonly (string | number)[] | undefined,\n): (serial: number) => string {\n  const parts = partition ?? []\n  for (const m of format.matchAll(SEQ_FORMAT_TOKEN)) {\n    const token = m[1] ?? ''\n    if (token === 'seq') continue\n    if (SEQ_PAD_TOKEN.test(token)) continue\n    const partMatch = SEQ_PARTITION_TOKEN.exec(token)\n    if (partMatch) {\n      const idx = Number(partMatch[1])\n      if (idx >= parts.length) {\n        throw new ValidationError(\n          `sequence(\"${series}\"): format token \"{${token}}\" references partition index ${idx}, ` +\n            `but only ${parts.length} partition component(s) were supplied.`,\n        )\n      }\n      continue\n    }\n    throw new ValidationError(\n      `sequence(\"${series}\"): format contains unknown token \"{${token}}\". ` +\n        `Accepted tokens: {seq}, {seq:0N}, {partition.i}.`,\n    )\n  }\n  return (serial: number): string =>\n    format.replace(SEQ_FORMAT_TOKEN, (full, token: string) => {\n      if (token === 'seq') return String(serial)\n      const padMatch = SEQ_PAD_TOKEN.exec(token)\n      if (padMatch) return String(serial).padStart(Number(padMatch[1]), '0')\n      const partMatch = SEQ_PARTITION_TOKEN.exec(token)\n      if (partMatch) return String(parts[Number(partMatch[1])])\n      return full // unreachable — validated above\n    })\n}\n\n/**\n * Resolve the CAS storage key for a (series, partition) pair.\n *\n * With no partition the key is `series` verbatim. With a partition the key is\n * `${series}\\x00${parts}` where `parts` is each component passed through\n * `encodeURIComponent(String(part))` and `'/'`-joined. The null-byte separator\n * is illegal in a plain series name, so partitioned keys never collide with\n * unpartitioned ones; URI-encoding keeps any component containing `/` distinct\n * from a multi-component partition.\n *\n * @throws {ValidationError} if any partition component is empty after `String()`\n *   or is a non-finite number (`NaN`, `±Infinity`).\n */\nexport function resolveSequenceKey(series: string, opts?: SequenceOptions): string {\n  const partition = opts?.partition\n  if (!partition || partition.length === 0) return series\n  const parts = partition.map((p) => {\n    if (typeof p === 'number' && !Number.isFinite(p)) {\n      throw new ValidationError(`sequence partition component must be a finite number, got ${p}`)\n    }\n    const s = String(p)\n    if (s === '') {\n      throw new ValidationError('sequence partition component must not be empty')\n    }\n    return encodeURIComponent(s)\n  })\n  return `${series}\\x00${parts.join('/')}`\n}\n\nexport interface SequenceHandle {\n  /** Atomically allocate and return the next value (1, 2, 3, …). Deferred series resolve at the next pass. */\n  next(opts?: NextOptions): Promise<number>\n  /** Read the current value without allocating. Returns 0 if never used. */\n  peek(): Promise<number>\n  /**\n   * Set-if-greater: advance the counter to at least `n`. A no-op if the\n   * current value is already `>= n` (so it never rewinds), and `seedTo(0)` is\n   * a no-op. Idempotent and CAS-safe under concurrent `next()` / `seedTo()`.\n   *\n   * Use after a bundle / CSV import to fast-forward the counter past the\n   * highest imported serial, so subsequent `next()` calls cannot re-use a\n   * number that is already on a record.\n   *\n   * Online-only: throws {@link SequenceOfflineError} on a non-CAS store.\n   */\n  seedTo(n: number): Promise<void>\n}\n\nasync function sleepBackoff(attempt: number): Promise<void> {\n  // Exponential backoff with full jitter to break the thundering herd\n  // when many writers contend on the same counter row.\n  const ceil = Math.min(2 ** attempt, 32)\n  const ms = Math.floor(Math.random() * ceil)\n  await new Promise((r) => setTimeout(r, ms))\n}\n\n/** Per-call context the vault assembles to build a {@link SequenceStore}. */\nexport interface SequenceStoreOptions {\n  adapter: NoydbStore\n  vault: string\n  encrypted: boolean\n  getDEK: (collectionName: string) => Promise<EnclaveKey>\n  actor: string\n}\n\nexport class SequenceStore {\n  private readonly adapter: NoydbStore\n  private readonly vault: string\n  private readonly encrypted: boolean\n  private readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  private readonly actor: string\n  /**\n   * Memoized DEK promise. The `_sequences` collection DEK is created on\n   * first access; without sharing one promise, a burst of concurrent\n   * `next()` calls would each trigger DEK creation and diverge (one\n   * writer's ciphertext unreadable by another). One shared promise → one\n   * DEK.\n   */\n  private dekPromise: Promise<EnclaveKey> | null = null\n\n  constructor(opts: SequenceStoreOptions) {\n    this.adapter = opts.adapter\n    this.vault = opts.vault\n    this.encrypted = opts.encrypted\n    this.getDEK = opts.getDEK\n    this.actor = opts.actor\n  }\n\n  /** A handle bound to one sequence name. */\n  handle(name: string): SequenceHandle {\n    return {\n      next: () => this.next(name),\n      peek: () => this.peek(name),\n      seedTo: (n) => this.seedTo(name, n),\n    }\n  }\n\n  private assertOnline(): void {\n    if (this.adapter.capabilities?.casAtomic !== true) {\n      throw new SequenceOfflineError()\n    }\n  }\n\n  private dek(): Promise<EnclaveKey> {\n    if (!this.dekPromise) this.dekPromise = this.getDEK(SEQUENCE_COLLECTION)\n    return this.dekPromise\n  }\n\n  private async read(name: string): Promise<{ env: EncryptedEnvelope | null; value: number }> {\n    const env = await this.adapter.get(this.vault, SEQUENCE_COLLECTION, name)\n    if (!env) return { env: null, value: 0 }\n    const json = this.encrypted ? await openEnvelopeJson({ collection: SEQUENCE_COLLECTION, id: name }, env, await this.dek()) : env._data\n    const state = JSON.parse(json) as SequenceState\n    return { env, value: state.value }\n  }\n\n  private async encryptState(name: string, state: SequenceState, version: number): Promise<EncryptedEnvelope> {\n    const json = JSON.stringify(state)\n    if (!this.encrypted) {\n      return buildRecordEnvelope({ collection: SEQUENCE_COLLECTION, id: name, version }, { iv: '', data: json})\n    }\n    const identity = { collection: SEQUENCE_COLLECTION, id: name, version }\n    const { iv, data } = await encrypt(json, await this.dek(), buildRecordAad(identity))\n    return buildRecordEnvelope(identity, { iv, data})\n  }\n\n  async peek(name: string): Promise<number> {\n    return (await this.read(name)).value\n  }\n\n  async next(name: string): Promise<number> {\n    this.assertOnline()\n    let lastConflict: ConflictError | undefined\n    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {\n      const { env, value } = await this.read(name)\n      const nextValue = value + 1\n      const expectedVersion = env?._v ?? 0 // 0 ≡ \"must not yet exist\" (create)\n      const envelope = await this.encryptState(name, { value: nextValue }, expectedVersion + 1)\n      try {\n        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion)\n        return nextValue\n      } catch (err) {\n        if (isConflictError(err)) {\n          lastConflict = err\n          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt)\n          continue\n        }\n        throw err\n      }\n    }\n    void lastConflict\n    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS)\n  }\n\n  async seedTo(name: string, n: number): Promise<void> {\n    this.assertOnline()\n    if (n <= 0) return // set-if-greater: 0 (and any non-positive seed) is a no-op\n    let lastConflict: ConflictError | undefined\n    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {\n      const { env, value } = await this.read(name)\n      if (value >= n) return // already at or past the floor — no write, idempotent\n      const expectedVersion = env?._v ?? 0 // 0 ≡ \"must not yet exist\" (create)\n      const envelope = await this.encryptState(name, { value: n }, expectedVersion + 1)\n      try {\n        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion)\n        return\n      } catch (err) {\n        if (isConflictError(err)) {\n          lastConflict = err\n          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt)\n          continue\n        }\n        throw err\n      }\n    }\n    void lastConflict\n    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAWO,SAAS,eAAiC;AAC/C,SAAO;AAAA,IACL,YAAY,MAAM;AAChB,aAAO,IAAI,cAAc,IAAI;AAAA,IAC/B;AAAA,EACF;AACF;;;ACWO,IAAM,cAAgC;AAAA,EAC3C,cAA6B;AAC3B,UAAM,IAAI,wBAAwB;AAAA,EACpC;AACF;;;ACCO,IAAM,sBAAsB;AAKnC,IAAM,oBAAoB;AA2D1B,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AACtB,IAAM,sBAAsB;AAQrB,SAAS,sBACd,QACA,QACA,WAC4B;AAC5B,QAAM,QAAQ,aAAa,CAAC;AAC5B,aAAW,KAAK,OAAO,SAAS,gBAAgB,GAAG;AACjD,UAAM,QAAQ,EAAE,CAAC,KAAK;AACtB,QAAI,UAAU,MAAO;AACrB,QAAI,cAAc,KAAK,KAAK,EAAG;AAC/B,UAAM,YAAY,oBAAoB,KAAK,KAAK;AAChD,QAAI,WAAW;AACb,YAAM,MAAM,OAAO,UAAU,CAAC,CAAC;AAC/B,UAAI,OAAO,MAAM,QAAQ;AACvB,cAAM,IAAI;AAAA,UACR,aAAa,MAAM,sBAAsB,KAAK,iCAAiC,GAAG,cACpE,MAAM,MAAM;AAAA,QAC5B;AAAA,MACF;AACA;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,aAAa,MAAM,uCAAuC,KAAK;AAAA,IAEjE;AAAA,EACF;AACA,SAAO,CAAC,WACN,OAAO,QAAQ,kBAAkB,CAAC,MAAM,UAAkB;AACxD,QAAI,UAAU,MAAO,QAAO,OAAO,MAAM;AACzC,UAAM,WAAW,cAAc,KAAK,KAAK;AACzC,QAAI,SAAU,QAAO,OAAO,MAAM,EAAE,SAAS,OAAO,SAAS,CAAC,CAAC,GAAG,GAAG;AACrE,UAAM,YAAY,oBAAoB,KAAK,KAAK;AAChD,QAAI,UAAW,QAAO,OAAO,MAAM,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;AACxD,WAAO;AAAA,EACT,CAAC;AACL;AAeO,SAAS,mBAAmB,QAAgB,MAAgC;AACjF,QAAM,YAAY,MAAM;AACxB,MAAI,CAAC,aAAa,UAAU,WAAW,EAAG,QAAO;AACjD,QAAM,QAAQ,UAAU,IAAI,CAAC,MAAM;AACjC,QAAI,OAAO,MAAM,YAAY,CAAC,OAAO,SAAS,CAAC,GAAG;AAChD,YAAM,IAAI,gBAAgB,6DAA6D,CAAC,EAAE;AAAA,IAC5F;AACA,UAAM,IAAI,OAAO,CAAC;AAClB,QAAI,MAAM,IAAI;AACZ,YAAM,IAAI,gBAAgB,gDAAgD;AAAA,IAC5E;AACA,WAAO,mBAAmB,CAAC;AAAA,EAC7B,CAAC;AACD,SAAO,GAAG,MAAM,KAAO,MAAM,KAAK,GAAG,CAAC;AACxC;AAqBA,eAAe,aAAa,SAAgC;AAG1D,QAAM,OAAO,KAAK,IAAI,KAAK,SAAS,EAAE;AACtC,QAAM,KAAK,KAAK,MAAM,KAAK,OAAO,IAAI,IAAI;AAC1C,QAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC5C;AAWO,IAAM,gBAAN,MAAoB;AAAA,EACR;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQT,aAAyC;AAAA,EAEjD,YAAY,MAA4B;AACtC,SAAK,UAAU,KAAK;AACpB,SAAK,QAAQ,KAAK;AAClB,SAAK,YAAY,KAAK;AACtB,SAAK,SAAS,KAAK;AACnB,SAAK,QAAQ,KAAK;AAAA,EACpB;AAAA;AAAA,EAGA,OAAO,MAA8B;AACnC,WAAO;AAAA,MACL,MAAM,MAAM,KAAK,KAAK,IAAI;AAAA,MAC1B,MAAM,MAAM,KAAK,KAAK,IAAI;AAAA,MAC1B,QAAQ,CAAC,MAAM,KAAK,OAAO,MAAM,CAAC;AAAA,IACpC;AAAA,EACF;AAAA,EAEQ,eAAqB;AAC3B,QAAI,KAAK,QAAQ,cAAc,cAAc,MAAM;AACjD,YAAM,IAAI,qBAAqB;AAAA,IACjC;AAAA,EACF;AAAA,EAEQ,MAA2B;AACjC,QAAI,CAAC,KAAK,WAAY,MAAK,aAAa,KAAK,OAAO,mBAAmB;AACvE,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,KAAK,MAAyE;AAC1F,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,IAAI;AACxE,QAAI,CAAC,IAAK,QAAO,EAAE,KAAK,MAAM,OAAO,EAAE;AACvC,UAAM,OAAO,KAAK,YAAY,MAAM,iBAAiB,EAAE,YAAY,qBAAqB,IAAI,KAAK,GAAG,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI;AACjI,UAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,WAAO,EAAE,KAAK,OAAO,MAAM,MAAM;AAAA,EACnC;AAAA,EAEA,MAAc,aAAa,MAAc,OAAsB,SAA6C;AAC1G,UAAM,OAAO,KAAK,UAAU,KAAK;AACjC,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO,oBAAoB,EAAE,YAAY,qBAAqB,IAAI,MAAM,QAAQ,GAAG,EAAE,IAAI,IAAI,MAAM,KAAI,CAAC;AAAA,IAC1G;AACA,UAAM,WAAW,EAAE,YAAY,qBAAqB,IAAI,MAAM,QAAQ;AACtE,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,KAAK,IAAI,GAAG,eAAe,QAAQ,CAAC;AACnF,WAAO,oBAAoB,UAAU,EAAE,IAAI,KAAI,CAAC;AAAA,EAClD;AAAA,EAEA,MAAM,KAAK,MAA+B;AACxC,YAAQ,MAAM,KAAK,KAAK,IAAI,GAAG;AAAA,EACjC;AAAA,EAEA,MAAM,KAAK,MAA+B;AACxC,SAAK,aAAa;AAClB,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,YAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI;AAC3C,YAAM,YAAY,QAAQ;AAC1B,YAAM,kBAAkB,KAAK,MAAM;AACnC,YAAM,WAAW,MAAM,KAAK,aAAa,MAAM,EAAE,OAAO,UAAU,GAAG,kBAAkB,CAAC;AACxF,UAAI;AACF,cAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,MAAM,UAAU,eAAe;AACvF,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,YAAI,gBAAgB,GAAG,GAAG;AACxB,yBAAe;AACf,cAAI,UAAU,oBAAoB,EAAG,OAAM,aAAa,OAAO;AAC/D;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,SAAK;AACL,UAAM,IAAI,wBAAwB,MAAM,iBAAiB;AAAA,EAC3D;AAAA,EAEA,MAAM,OAAO,MAAc,GAA0B;AACnD,SAAK,aAAa;AAClB,QAAI,KAAK,EAAG;AACZ,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,YAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI;AAC3C,UAAI,SAAS,EAAG;AAChB,YAAM,kBAAkB,KAAK,MAAM;AACnC,YAAM,WAAW,MAAM,KAAK,aAAa,MAAM,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC;AAChF,UAAI;AACF,cAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,MAAM,UAAU,eAAe;AACvF;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,gBAAgB,GAAG,GAAG;AACxB,yBAAe;AACf,cAAI,UAAU,oBAAoB,EAAG,OAAM,aAAa,OAAO;AAC/D;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,SAAK;AACL,UAAM,IAAI,wBAAwB,MAAM,iBAAiB;AAAA,EAC3D;AACF;","names":[]}

package/dist/{chunk-WMUN7ZUD.js → chunk-AA7LM2A3.js}

@@ -1,7 +1,7 @@
 import {
   loadVaultPolicy,
   saveVaultPolicy
-} from "./chunk-JZVXGOJE.js";
+} from "./chunk-DKYEVHZH.js";
 import {
   PolicyDeniedError,
   ValidationError
@@ -364,4 +364,4 @@ export {
   describeGate,
   createNoydbPolicy
 };
-//# sourceMappingURL=chunk-WMUN7ZUD.js.map
+//# sourceMappingURL=chunk-AA7LM2A3.js.map

package/dist/{chunk-PJGMBELR.js → chunk-AIZNLHKN.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-5D2ALSM5.js";
 import {
   RecordCodec
-} from "./chunk-LTVETWDH.js";
+} from "./chunk-X3AXSYBL.js";
 
 // src/with-formula/materialized-views/stale.ts
-var loadMVExecutor = lazy(() => import("./executor-LFHRV6JH.js"));
+var loadMVExecutor = lazy(() => import("./executor-FRUVM36Q.js"));
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 function markMVStale(registry, mvName) {
   let set = _staleByRegistry.get(registry);
@@ -26,7 +26,7 @@ function storeOf(accessor, collectionName) {
   return { adapter: c.adapter, vault: c.vault };
 }
 async function writeMVStaleMarker(adapter, vault, mvName) {
-  const env = RecordCodec.buildPlaintextEnvelope({ version: 1, data: "{}" });
+  const env = RecordCodec.buildPlaintextEnvelope({ collection: MV_STALE_COLLECTION, id: mvName, version: 1 }, { data: "{}" });
   await adapter.put(vault, MV_STALE_COLLECTION, mvName, env);
 }
 async function deleteMVStaleMarker(adapter, vault, mvName) {
@@ -134,4 +134,4 @@ export {
   clearMVStale,
   clearMVStaleFully
 };
-//# sourceMappingURL=chunk-PJGMBELR.js.map
+//# sourceMappingURL=chunk-AIZNLHKN.js.map

package/dist/chunk-AIZNLHKN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/materialized-views/stale.ts"],"sourcesContent":["import type { Collection } from '../../kernel/collection.js'\nimport type { MaterializedViewExecutor as MVExecutorType } from './executor.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { PutDerivedOutputCtx } from '../../kernel/via/dispatch.js'\nimport type { MaterializedViewRegistry, RegisteredMV } from './registry.js'\n// Type-only — runtime class loaded via dynamic import in\n// `resolveStaleMVOnRead` only when a stale flag actually fires.\n// Keeps the executor chunk out of the floor bundle (mirrors v1 floor-bundle isolation).\nimport type { MVQueryContext } from './types.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { RecordCodec } from '../../kernel/enclave/index.js'\n\nimport { lazy } from '../../kernel/lazy.js'\n\n/** #846c — one memoized binding instead of a cast at the call site. */\nconst loadMVExecutor = lazy(() => import('./executor.js'))\n\n/**\n * Accessor shape passed in from the owning Vault. Provides the\n * registry (used as a stable WeakMap key + to look up MVs by output\n * collection) and the runtime context the lazy refresh needs.\n * Mirrors v1's `DerivationStaleAccessor`.\n */\nexport interface MVStaleAccessor {\n  registry(): MaterializedViewRegistry\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  getCollection(name: string): Collection<any>\n  getActiveTxContext(): TxContext | null\n  getQueryContext(): MVQueryContext\n}\n\n/**\n * In-memory stale map keyed by `MaterializedViewRegistry` instance\n * (stable per vault). Each registry maps to a set of MV names that\n * have at least one pending source-change requiring a re-materialize.\n *\n * Persistence across vault close is NOT implemented in this iteration\n * (concern flagged in the v2 spec, mirrors v1 derivation behavior).\n * On vault re-open, the unset stale flag is interpreted as \"fresh\" —\n * `vault.refreshView(name)` is the explicit recompute escape hatch.\n *\n * @internal\n */\nconst _staleByRegistry = new WeakMap<MaterializedViewRegistry, Set<string>>()\n\n/**\n * Mark an MV as stale. Called from `Collection.dispatchMaterializedViews`\n * when a source-write fires for a `refresh: 'lazy'` MV.\n *\n * @internal\n */\nexport function markMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  let set = _staleByRegistry.get(registry)\n  if (!set) {\n    set = new Set()\n    _staleByRegistry.set(registry, set)\n  }\n  set.add(mvName)\n}\n\n/**\n * Test-only: check whether a given MV name is currently flagged stale\n * against a registry. Exported so the regression suite can pin the\n * stale-bit lifecycle without touching the internal `WeakMap`.\n *\n * @internal\n */\nexport function isMVStale(registry: MaterializedViewRegistry, mvName: string): boolean {\n  return _staleByRegistry.get(registry)?.has(mvName) ?? false\n}\n\n/**\n * Reserved collection holding CONTENT-FREE lazy-stale markers (record id =\n * MV name, plaintext `_iv: ''` envelope, no payload) — mirrors the\n * `_meta`/schema-fence marker envelope shape. Written only from the\n * delete/forget/elevate dispatcher (#736); ordinary source writes stay\n * in-memory-only (the cheap path). Read via the adapter directly, never\n * through `vault.collection()` — same reserved-collection convention as\n * `_subject_index`/`_meta`.\n */\nexport const MV_STALE_COLLECTION = '_mv_stale'\n\n/**\n * Once-per-registry hydrate guard for `resolveStaleMVOnRead`'s persisted-marker fold-in.\n * Stores the in-flight/settled PROMISE (not a boolean) — a concurrent cold first read that\n * arrives while the hydrate is still awaiting `adapter.list` must await the SAME promise\n * rather than observing \"already hydrating\" and reading an empty pending set (#736\n * whole-branch review).\n */\nconst _hydratedByRegistry = new WeakMap<MaterializedViewRegistry, Promise<void>>()\n\n/** The adapter + vault name backing any collection in this vault (all collections share both). */\nfunction storeOf(accessor: MVStaleAccessor, collectionName: string): { adapter: NoydbStore; vault: string } {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const c = accessor.getCollection(collectionName) as any\n  return { adapter: c.adapter as NoydbStore, vault: c.vault as string }\n}\n\nasync function writeMVStaleMarker(adapter: NoydbStore, vault: string, mvName: string): Promise<void> {\n  // Content-free — the marker's only payload is its key (the MV name).\n  const env = RecordCodec.buildPlaintextEnvelope({ collection: MV_STALE_COLLECTION, id: mvName, version: 1 }, { data: '{}' })\n  await adapter.put(vault, MV_STALE_COLLECTION, mvName, env)\n}\n\nasync function deleteMVStaleMarker(adapter: NoydbStore, vault: string, mvName: string): Promise<void> {\n  await adapter.delete(vault, MV_STALE_COLLECTION, mvName)\n}\n\n/**\n * On first `resolveStaleMVOnRead` call for a (cold-reopened) registry, fold every\n * persisted `_mv_stale` marker into the in-memory pending set — otherwise a cold\n * session's empty `WeakMap` entry reads as \"fresh\" and serves the emptied output\n * collection forever.\n */\nasync function hydratePersistedStaleMarkers(accessor: MVStaleAccessor, registry: MaterializedViewRegistry): Promise<void> {\n  const mvs = registry.all()\n  if (mvs.length === 0) return\n  const { adapter, vault } = storeOf(accessor, mvs[0]!.outputCollection)\n  // No try/catch: a genuine store failure here must surface, not be read as\n  // \"nothing pending\" — silently treating it as fresh is the exact leak class\n  // this module closes (mirrors `subject-index.ts`'s bare `adapter.list` reads).\n  for (const name of await adapter.list(vault, MV_STALE_COLLECTION)) markMVStale(registry, name)\n}\n\n/**\n * Invalidate an MV from the delete/forget/elevate dispatcher (#736) — the ordinary\n * source-write path (`dispatchMaterializedViews`) never calls this. Deletes EVERY\n * persisted row in `reg.outputCollection` via `_internalDelete` (the at-rest law: a\n * stale mark alone leaves the elevated/forgotten source's plaintext sitting in the\n * output row) using the adapter directly so the read-path's `resolveStaleMVOnRead`\n * isn't triggered mid-invalidation. `mode: 'lazy'` also persists the stale mark so a\n * cold session recomputes on next read; `'manual'` gets the purge only — the MV\n * serves empty until an explicit `vault.refreshView()` (erasure wins). Deletion is\n * stamp-scoped (`_materializedFrom.mvName === reg.spec.name` — see the loop below),\n * so another registered MV sharing this output collection keeps its own rows intact:\n * no cross-MV re-marking is needed here, only `reg` itself is marked stale.\n *\n * Returns the count of rows actually `_internalDelete`d (#761 item 1) — folded by the\n * caller into `dispatchMaterializedViewsOnDelete`'s `deleted` so `ForgetResult.derivedRecordsErased`\n * counts lazy/manual purges too, not just the eager executor's tombstone leg — plus\n * `residueUndecodable`, the bare ids whose ownership stamp could NOT be decoded (#776): a\n * candidate row that fails to decode under the collection's default DEK (e.g. elevated above\n * tier 0 on a tiered output collection) has UNKNOWN ownership — it might be this MV's own\n * output, or (same-collection shape) a plain user record — so it is never erased, but it must\n * be SURFACED rather than silently skipped (the #724 posture), since it may still hold the\n * forgotten/pre-elevation contribution, decryptable by tier-holders — and `residueDeclined`\n * (#785), the bare ids that DID decode and stamp-match but whose `_internalDelete` declined\n * (ownership CONFIRMED, erasure declined).\n *\n * @internal\n */\nexport async function invalidateMVAtRest(\n  accessor: MVStaleAccessor,\n  reg: RegisteredMV,\n  mode: 'lazy' | 'manual',\n): Promise<{ deleted: number; residueUndecodable: string[]; residueDeclined: string[] }> {\n  const outputColl = accessor.getCollection(reg.outputCollection)\n  const txCtx = accessor.getActiveTxContext()\n  const { adapter, vault } = storeOf(accessor, reg.outputCollection)\n  let deleted = 0\n  const residueUndecodable: string[] = []\n  const residueDeclined: string[] = []\n  for (const id of await adapter.list(vault, reg.outputCollection)) {\n    // A same-collection partition MV (`output: { collection: <source>, partition }`,\n    // the DERIV-PP30-001 shape) writes INTO its own source collection — `adapter.list`\n    // over `reg.outputCollection` then also returns untouched user source records.\n    // Decode each candidate row (the invalidation path is rare; this cost is fine\n    // here) and only erase rows THIS MV stamped via `_materializedFrom.mvName` —\n    // an unstamped row, or one stamped by a different MV, is never this MV's to\n    // delete (#736 whole-branch review, Critical).\n    const envelope = await adapter.get(vault, reg.outputCollection, id)\n    if (envelope === null) continue\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const decoded = await (outputColl as any)._decodeEnvelope(envelope, id)\n    if (decoded === null) { residueUndecodable.push(id); continue } // #776 — ownership unknown, surfaced not skipped\n    const stampedBy = (decoded as Record<string, unknown>)._materializedFrom as { mvName?: string } | undefined\n    if (stampedBy?.mvName !== reg.spec.name) continue\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    if (await (outputColl as any)._internalDelete(id, txCtx)) {\n      deleted++\n    } else {\n      // #782 part b — decoded AND stamp-owned, but erasure declined (#718 tier-elevation\n      // gate). Ownership IS confirmed — a real silent survival, not a legit stamp-mismatch\n      // skip. Surface it too, in its own channel (#785 — distinct from the decode-null case).\n      residueDeclined.push(id)\n    }\n  }\n\n  // `mode: 'manual'` gets the purge only (erasure wins, no auto-recompute promise);\n  // `'lazy'` also marks + persists ITS OWN stale bit for cold-session recompute. No\n  // sibling MV on the same output collection is touched here — the stamp-scoped\n  // deletion above never erased sibling rows in the first place (#736 re-review).\n  if (mode === 'lazy') {\n    const registry = accessor.registry()\n    markMVStale(registry, reg.spec.name)\n    await writeMVStaleMarker(adapter, vault, reg.spec.name)\n  }\n  return { deleted, residueUndecodable, residueDeclined }\n}\n\n/**\n * Called from `Collection.get` (and any reader that materializes the\n * MV's output collection). If any MV producing `outputCollection` is\n * flagged stale, runs the executor against the live source state\n * before returning. No-op when there is no pending work — keeps the\n * read fast path negligible.\n *\n * `dispatchCtx` (#641): threaded from the calling `Collection`'s\n * `#dispatchCtx({ collection: outputCollection, id: 'resolve-on-read' })` — a read has no\n * real \"reacting write\" record, so `'resolve-on-read'` is the sentinel id, mirroring\n * `Vault.refreshView()`'s `'refreshView'` sentinel for the same reason. Passed straight\n * through to the executor so a stale row whose output lands in a closed period follows the\n * frozen-output rule (skip + `derivation:skipped-frozen`, #637) instead of throwing\n * `PeriodClosedError` out of a read.\n *\n * Dynamic-imports the executor only when a stale flag actually fires\n * (the floor-bundle isolation pattern v1 derivations established in\n * floor-bundle isolation pattern).\n */\nexport async function resolveStaleMVOnRead(\n  accessor: MVStaleAccessor,\n  outputCollection: string,\n  dispatchCtx?: PutDerivedOutputCtx,\n): Promise<void> {\n  const registry = accessor.registry()\n  // Cold session: the in-memory WeakMap has no entry for this (freshly\n  // constructed) registry yet — fold any persisted `_mv_stale` markers in\n  // before reading the pending set, once per registry (#736). Memoize the\n  // PROMISE, not a boolean: a concurrent first read arriving while the\n  // hydrate is still awaiting `adapter.list` must await the SAME promise —\n  // otherwise it observes \"already hydrating\", skips straight to an empty\n  // pending set, and serves the purged/stale view as fresh (#736\n  // whole-branch review, hydrate-once race). On rejection, evict the entry\n  // BEFORE rethrowing — a cached rejected promise would otherwise poison the\n  // MV read surface for the rest of the session (every later read re-awaits\n  // the same rejection instead of retrying the store call) (#736 re-review).\n  let hydrate = _hydratedByRegistry.get(registry)\n  if (!hydrate) {\n    hydrate = hydratePersistedStaleMarkers(accessor, registry).catch((err: unknown) => {\n      _hydratedByRegistry.delete(registry)\n      throw err\n    })\n    _hydratedByRegistry.set(registry, hydrate)\n  }\n  await hydrate\n  const pending = _staleByRegistry.get(registry)\n  if (!pending || pending.size === 0) return\n\n  const { adapter, vault } = storeOf(accessor, outputCollection)\n\n  // Clean up persisted markers for MV names no longer registered (renamed or\n  // removed since the marker was written). Without this sweep an orphaned name\n  // can never become a `candidate` below — `candidates` is built from\n  // `registry.all()`, which no longer lists it — so both the in-memory pending\n  // entry and the persisted `_mv_stale` row would linger forever, re-hydrating\n  // on every cold session (#736 whole-branch review).\n  for (const name of pending) {\n    if (registry.byName(name)) continue\n    pending.delete(name)\n    await deleteMVStaleMarker(adapter, vault, name)\n  }\n  if (pending.size === 0) return\n\n  // Find every MV that writes to this output collection AND is\n  // currently flagged stale. Multiple MVs CAN share an output\n  // collection in theory; in practice the registration validation +\n  // cycle detection make this unusual.\n  const candidates: string[] = []\n  for (const mv of registry.all()) {\n    if (mv.outputCollection !== outputCollection) continue\n    if (!pending.has(mv.spec.name)) continue\n    candidates.push(mv.spec.name)\n  }\n  if (candidates.length === 0) return\n\n  let executor: typeof MVExecutorType | null = null\n  for (const name of candidates) {\n    const reg = registry.byName(name)\n    if (!reg) {\n      // Unreachable in practice — `candidates` is drawn from `registry.all()`,\n      // and the orphan sweep above already cleared any name absent from it.\n      // Kept as a defensive fallback; also clears the persisted marker so it\n      // can't linger if this ever does fire.\n      pending.delete(name)\n      await deleteMVStaleMarker(adapter, vault, name)\n      continue\n    }\n    executor ??= (await loadMVExecutor()).MaterializedViewExecutor\n    // A cold-hydrated stale flag (unlike an in-session one) can fire with\n    // NONE of the MV's dependency collections touched yet this session —\n    // the sync `Query.toArray()` `spec.query()` runs reads straight off\n    // `Collection`'s in-memory cache, populated only by a prior async\n    // touch (`ensureHydrated()`, called from `get`/`list`/`put`, never\n    // from `query()` itself). Warm every dependency first so the recompute\n    // sees the live persisted state instead of an empty cache (#736).\n    for (const dep of reg.dependencies) {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      await (accessor.getCollection(dep) as any).ensureHydrated()\n    }\n    await executor.refresh(reg, {\n      getCollection: (n) => accessor.getCollection(n),\n      getActiveTxContext: () => accessor.getActiveTxContext(),\n      getQueryContext: () => accessor.getQueryContext(),\n      ...(dispatchCtx !== undefined ? { dispatchCtx } : {}),\n    })\n    pending.delete(name)\n    // Runs even when no marker was ever persisted for this name (an in-session-only\n    // stale bit — e.g. the cheap ordinary-write path never writes one, see the\n    // \"cheap-path guarantee\" test). `adapter.delete` on an absent key is a harmless\n    // void — keeping this unconditional avoids branching on marker origin here.\n    await deleteMVStaleMarker(adapter, vault, name)\n  }\n}\n\n/**\n * Drop every stale flag for a registry. Used after a manual\n * `vault.refreshView(name)` runs the executor explicitly — the\n * post-refresh state matches the registered strategies, so\n * lingering stale bits would force a redundant refresh on the next\n * read.\n *\n * @internal\n */\nexport function clearMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  _staleByRegistry.get(registry)?.delete(mvName)\n}\n\n/**\n * `clearMVStale` plus the persisted marker (#736) — `Vault.refreshView()`'s\n * completion path. A lingering persisted marker after a manual refresh would\n * make the NEXT cold session recompute redundantly.\n *\n * @internal\n */\nexport async function clearMVStaleFully(\n  adapter: NoydbStore,\n  vault: string,\n  registry: MaterializedViewRegistry,\n  mvName: string,\n): Promise<void> {\n  clearMVStale(registry, mvName)\n  await deleteMVStaleMarker(adapter, vault, mvName)\n}\n"],"mappings":";;;;;;;;AAeA,IAAM,iBAAiB,KAAK,MAAM,OAAO,wBAAe,CAAC;AA4BzD,IAAM,mBAAmB,oBAAI,QAA+C;AAQrE,SAAS,YAAY,UAAoC,QAAsB;AACpF,MAAI,MAAM,iBAAiB,IAAI,QAAQ;AACvC,MAAI,CAAC,KAAK;AACR,UAAM,oBAAI,IAAI;AACd,qBAAiB,IAAI,UAAU,GAAG;AAAA,EACpC;AACA,MAAI,IAAI,MAAM;AAChB;AASO,SAAS,UAAU,UAAoC,QAAyB;AACrF,SAAO,iBAAiB,IAAI,QAAQ,GAAG,IAAI,MAAM,KAAK;AACxD;AAWO,IAAM,sBAAsB;AASnC,IAAM,sBAAsB,oBAAI,QAAiD;AAGjF,SAAS,QAAQ,UAA2B,gBAAgE;AAE1G,QAAM,IAAI,SAAS,cAAc,cAAc;AAC/C,SAAO,EAAE,SAAS,EAAE,SAAuB,OAAO,EAAE,MAAgB;AACtE;AAEA,eAAe,mBAAmB,SAAqB,OAAe,QAA+B;AAEnG,QAAM,MAAM,YAAY,uBAAuB,EAAE,YAAY,qBAAqB,IAAI,QAAQ,SAAS,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC1H,QAAM,QAAQ,IAAI,OAAO,qBAAqB,QAAQ,GAAG;AAC3D;AAEA,eAAe,oBAAoB,SAAqB,OAAe,QAA+B;AACpG,QAAM,QAAQ,OAAO,OAAO,qBAAqB,MAAM;AACzD;AAQA,eAAe,6BAA6B,UAA2B,UAAmD;AACxH,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,IAAI,WAAW,EAAG;AACtB,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,IAAI,CAAC,EAAG,gBAAgB;AAIrE,aAAW,QAAQ,MAAM,QAAQ,KAAK,OAAO,mBAAmB,EAAG,aAAY,UAAU,IAAI;AAC/F;AA6BA,eAAsB,mBACpB,UACA,KACA,MACuF;AACvF,QAAM,aAAa,SAAS,cAAc,IAAI,gBAAgB;AAC9D,QAAM,QAAQ,SAAS,mBAAmB;AAC1C,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,IAAI,gBAAgB;AACjE,MAAI,UAAU;AACd,QAAM,qBAA+B,CAAC;AACtC,QAAM,kBAA4B,CAAC;AACnC,aAAW,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI,gBAAgB,GAAG;AAQhE,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,IAAI,kBAAkB,EAAE;AAClE,QAAI,aAAa,KAAM;AAEvB,UAAM,UAAU,MAAO,WAAmB,gBAAgB,UAAU,EAAE;AACtE,QAAI,YAAY,MAAM;AAAE,yBAAmB,KAAK,EAAE;AAAG;AAAA,IAAS;AAC9D,UAAM,YAAa,QAAoC;AACvD,QAAI,WAAW,WAAW,IAAI,KAAK,KAAM;AAEzC,QAAI,MAAO,WAAmB,gBAAgB,IAAI,KAAK,GAAG;AACxD;AAAA,IACF,OAAO;AAIL,sBAAgB,KAAK,EAAE;AAAA,IACzB;AAAA,EACF;AAMA,MAAI,SAAS,QAAQ;AACnB,UAAM,WAAW,SAAS,SAAS;AACnC,gBAAY,UAAU,IAAI,KAAK,IAAI;AACnC,UAAM,mBAAmB,SAAS,OAAO,IAAI,KAAK,IAAI;AAAA,EACxD;AACA,SAAO,EAAE,SAAS,oBAAoB,gBAAgB;AACxD;AAqBA,eAAsB,qBACpB,UACA,kBACA,aACe;AACf,QAAM,WAAW,SAAS,SAAS;AAYnC,MAAI,UAAU,oBAAoB,IAAI,QAAQ;AAC9C,MAAI,CAAC,SAAS;AACZ,cAAU,6BAA6B,UAAU,QAAQ,EAAE,MAAM,CAAC,QAAiB;AACjF,0BAAoB,OAAO,QAAQ;AACnC,YAAM;AAAA,IACR,CAAC;AACD,wBAAoB,IAAI,UAAU,OAAO;AAAA,EAC3C;AACA,QAAM;AACN,QAAM,UAAU,iBAAiB,IAAI,QAAQ;AAC7C,MAAI,CAAC,WAAW,QAAQ,SAAS,EAAG;AAEpC,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,gBAAgB;AAQ7D,aAAW,QAAQ,SAAS;AAC1B,QAAI,SAAS,OAAO,IAAI,EAAG;AAC3B,YAAQ,OAAO,IAAI;AACnB,UAAM,oBAAoB,SAAS,OAAO,IAAI;AAAA,EAChD;AACA,MAAI,QAAQ,SAAS,EAAG;AAMxB,QAAM,aAAuB,CAAC;AAC9B,aAAW,MAAM,SAAS,IAAI,GAAG;AAC/B,QAAI,GAAG,qBAAqB,iBAAkB;AAC9C,QAAI,CAAC,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAG;AAChC,eAAW,KAAK,GAAG,KAAK,IAAI;AAAA,EAC9B;AACA,MAAI,WAAW,WAAW,EAAG;AAE7B,MAAI,WAAyC;AAC7C,aAAW,QAAQ,YAAY;AAC7B,UAAM,MAAM,SAAS,OAAO,IAAI;AAChC,QAAI,CAAC,KAAK;AAKR,cAAQ,OAAO,IAAI;AACnB,YAAM,oBAAoB,SAAS,OAAO,IAAI;AAC9C;AAAA,IACF;AACA,kBAAc,MAAM,eAAe,GAAG;AAQtC,eAAW,OAAO,IAAI,cAAc;AAElC,YAAO,SAAS,cAAc,GAAG,EAAU,eAAe;AAAA,IAC5D;AACA,UAAM,SAAS,QAAQ,KAAK;AAAA,MAC1B,eAAe,CAAC,MAAM,SAAS,cAAc,CAAC;AAAA,MAC9C,oBAAoB,MAAM,SAAS,mBAAmB;AAAA,MACtD,iBAAiB,MAAM,SAAS,gBAAgB;AAAA,MAChD,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACrD,CAAC;AACD,YAAQ,OAAO,IAAI;AAKnB,UAAM,oBAAoB,SAAS,OAAO,IAAI;AAAA,EAChD;AACF;AAWO,SAAS,aAAa,UAAoC,QAAsB;AACrF,mBAAiB,IAAI,QAAQ,GAAG,OAAO,MAAM;AAC/C;AASA,eAAsB,kBACpB,SACA,OACA,UACA,QACe;AACf,eAAa,UAAU,MAAM;AAC7B,QAAM,oBAAoB,SAAS,OAAO,MAAM;AAClD;","names":[]}

package/dist/{chunk-MKSTUVMJ.js → chunk-AMMYIT7F.js}

@@ -1,3 +1,10 @@
+import {
+  SCHEMAS_COLLECTION
+} from "./chunk-IN5EZWYQ.js";
+import {
+  assemblePodContainer,
+  buildExtractedPartitionWrapper
+} from "./chunk-TNOQNU3R.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -5,14 +12,7 @@ import {
   BLOB_INTENT_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-NY6RQBUN.js";
-import {
-  SCHEMAS_COLLECTION
-} from "./chunk-A3WHDOWI.js";
-import {
-  assemblePodContainer,
-  buildExtractedPartitionWrapper
-} from "./chunk-THUITYH7.js";
+} from "./chunk-RAYGDC4A.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
@@ -23,14 +23,16 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-53PWELSC.js";
+} from "./chunk-FY33DKPH.js";
 import {
+  buildRecordAad,
   openEnvelopeJson,
+  recordAadFor,
   writeEnvelopeBody
-} from "./chunk-LTVETWDH.js";
+} from "./chunk-X3AXSYBL.js";
 import {
   buildRecordEnvelope
-} from "./chunk-6E2JZRBD.js";
+} from "./chunk-ZVAFJQZB.js";
 import {
   bufferToBase64,
   decrypt,
@@ -43,7 +45,7 @@ import {
 } from "./chunk-QTDAPDDV.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-3Y4OFWQJ.js";
 import {
   PartitionExtractionError
 } from "./chunk-I64WQSN3.js";
@@ -187,15 +189,16 @@ async function reKeyClosure(vault, closure, fieldProjection) {
         );
       }
       if (env._cek !== void 0) {
+        const aad = recordAadFor({ collection: collectionName, id }, env);
         const cek = await unwrapCek(env._cek, srcDek);
-        const plaintext2 = await decrypt(env._iv, env._data, cek);
-        const { iv: iv2, data: data2 } = await encrypt(project(plaintext2), cek);
+        const plaintext2 = await decrypt(env._iv, env._data, cek, aad);
+        const { iv: iv2, data: data2 } = await encrypt(project(plaintext2), cek, aad);
         const wrapped = await wrapCek(cek, destDek);
         out[id] = { ...env, _iv: iv2, _data: data2, _cek: wrapped };
         continue;
       }
-      const plaintext = await openEnvelopeJson(env, srcDek);
-      const { iv, data } = await encrypt(project(plaintext), destDek);
+      const plaintext = await openEnvelopeJson({ collection: collectionName, id }, env, srcDek);
+      const { iv, data } = await encrypt(project(plaintext), destDek, recordAadFor({ collection: collectionName, id }, env));
       out[id] = { ...env, _iv: iv, _data: data };
     }
     collections[collectionName] = out;
@@ -212,8 +215,8 @@ async function reKeySchemas(vault, closure, destDeks, fieldProjection) {
     const destDek = destDeks.get(collectionName);
     if (!destDek) continue;
     const srcDek = await getDEK(collectionName);
-    const plaintext = await openEnvelopeJson(env, srcDek);
-    const { iv, data } = await encrypt(plaintext, destDek);
+    const plaintext = await openEnvelopeJson({ collection: SCHEMAS_COLLECTION, id: collectionName }, env, srcDek);
+    const { iv, data } = await encrypt(plaintext, destDek, recordAadFor({ collection: SCHEMAS_COLLECTION, id: collectionName }, env));
     out[collectionName] = { ...env, _iv: iv, _data: data };
   }
   return out;
@@ -227,7 +230,7 @@ async function reKeyLedger(vault, closure, reKeyedCollections, ledgerDek) {
   for (const id of ids) {
     const env = await adapter.get(vaultName, LEDGER_COLLECTION, id);
     if (!env) continue;
-    srcEntries.push(JSON.parse(await openEnvelopeJson(env, srcLedgerDek)));
+    srcEntries.push(JSON.parse(await openEnvelopeJson({ collection: LEDGER_COLLECTION, id }, env, srcLedgerDek)));
   }
   const kept = srcEntries.filter(
     (e) => (e.op === "put" || e.op === "delete") && (closure.get(e.collection)?.has(e.id) ?? false)
@@ -260,10 +263,11 @@ async function reKeyLedger(vault, closure, reKeyedCollections, ledgerDek) {
       payloadHash,
       ...src.reason !== void 0 ? { reason: src.reason } : {}
     };
-    const { iv, data } = await encrypt(canonicalJson(entry), ledgerDek);
+    const ledgerIdentity = { collection: LEDGER_COLLECTION, id: paddedIndex(i), version: i + 1 };
+    const { iv, data } = await encrypt(canonicalJson(entry), ledgerDek, buildRecordAad(ledgerIdentity));
     entries[paddedIndex(i)] = buildRecordEnvelope(
-      { collection: LEDGER_COLLECTION, id: paddedIndex(i) },
-      { version: i + 1, ts: entry.ts, iv, data, by: entry.actor }
+      ledgerIdentity,
+      { ts: entry.ts, iv, data }
     );
     prevHash = await hashEntry(entry);
     last = entry;
@@ -303,8 +307,8 @@ async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
       const intentId = `${collectionName}::${id}`;
       const intentEnv = await adapter.get(vaultName, BLOB_INTENT_COLLECTION, intentId);
       if (intentEnv) {
-        const intentPlain = await openEnvelopeJson(intentEnv, srcDek);
-        const intentBody = await writeEnvelopeBody(intentPlain, destDek);
+        const intentPlain = await openEnvelopeJson({ collection: BLOB_INTENT_COLLECTION, id: intentId }, intentEnv, srcDek);
+        const intentBody = await writeEnvelopeBody({ collection: BLOB_INTENT_COLLECTION, id: intentId, version: intentEnv._v }, intentPlain, destDek);
         place(BLOB_INTENT_COLLECTION, intentId, { ...intentEnv, ...intentBody });
       }
       const env = await adapter.get(vaultName, slotsCollection, id);
@@ -314,7 +318,7 @@ async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
           `#748: reKeyBlobs fetched an elevated slot-map envelope (collection="${slotsCollection}" id="${id}" _tier=${env._tier}) \u2014 this is unreachable by construction. Refusing to carry it into a partition.`
         );
       }
-      const slots = JSON.parse(await openEnvelopeJson(env, srcDek));
+      const slots = JSON.parse(await openEnvelopeJson({ collection: slotsCollection, id }, env, srcDek));
       const kept = {};
       for (const [slotName, slot] of Object.entries(slots)) {
         if (proj && !proj.has(slotName)) continue;
@@ -324,7 +328,7 @@ async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
         addRef(slot.eTag);
       }
       if (Object.keys(kept).length === 0) continue;
-      const { iv, data } = await encrypt(JSON.stringify(kept), destDek);
+      const { iv, data } = await encrypt(JSON.stringify(kept), destDek, recordAadFor({ collection: slotsCollection, id }, env));
       place(slotsCollection, id, { ...env, _iv: iv, _data: data });
     }
     const versionsCollection = `${BLOB_VERSIONS_PREFIX}${collectionName}`;
@@ -340,9 +344,9 @@ async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
           `#748: reKeyBlobs fetched an elevated version-record envelope (collection="${versionsCollection}" key="${key}" _tier=${env._tier}) \u2014 this is unreachable by construction. Refusing to carry it into a partition.`
         );
       }
-      const record = JSON.parse(await openEnvelopeJson(env, srcDek));
+      const record = JSON.parse(await openEnvelopeJson({ collection: versionsCollection, id: key }, env, srcDek));
       addRef(record.eTag);
-      const { iv, data } = await encrypt(JSON.stringify(record), destDek);
+      const { iv, data } = await encrypt(JSON.stringify(record), destDek, recordAadFor({ collection: versionsCollection, id: key }, env));
       place(versionsCollection, key, { ...env, _iv: iv, _data: data });
     }
   }
@@ -352,7 +356,7 @@ async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
   for (const [eTag, refCount] of carriedRefs) {
     const idxEnv = await adapter.get(vaultName, BLOB_INDEX_COLLECTION, eTag);
     if (!idxEnv) continue;
-    const blob = JSON.parse(await openEnvelopeJson(idxEnv, srcBlobDek));
+    const blob = JSON.parse(await openEnvelopeJson({ collection: BLOB_INDEX_COLLECTION, id: eTag }, idxEnv, srcBlobDek));
     let contentCek;
     let chunksPassthrough;
     if (blob._cek !== void 0) {
@@ -382,7 +386,7 @@ async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
     const { _cekPending, ...rest } = blob;
     void _cekPending;
     const carried = { ...rest, refCount, _cek: await wrapCek(contentCek, transferBlobDek) };
-    const { iv, data } = await encrypt(JSON.stringify(carried), transferBlobDek);
+    const { iv, data } = await encrypt(JSON.stringify(carried), transferBlobDek, recordAadFor({ collection: BLOB_INDEX_COLLECTION, id: eTag }, idxEnv));
     place(BLOB_INDEX_COLLECTION, eTag, { ...idxEnv, _iv: iv, _data: data });
   }
   return { internal, blobDek: transferBlobDek };
@@ -490,4 +494,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-MKSTUVMJ.js.map
+//# sourceMappingURL=chunk-AMMYIT7F.js.map