@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.20

package/dist/chunk-JHO6FGZX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/directory/storage.ts","../src/with-party/directory/visibility.ts","../src/with-party/directory/user-envelope/storage.ts"],"sourcesContent":["/**\n * Persistence helpers for the vault-level user-directory toggle\n * (`_meta/directory`). Mirrors the bypass-AES pattern used by\n * `_meta/policy` — the directory document is plain JSON, the\n * envelope's `_iv` field is left empty.\n *\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/plaintext-bypass.md — every `_iv: ''` write site\n *\n * @module\n */\nimport { buildRecordEnvelope } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { DirectoryConfig } from './types.js'\n\n/** Reserved collection name for vault-level metadata documents. */\nexport const META_COLLECTION = '_meta'\n/** Reserved id for the vault-level directory document. */\nexport const DIRECTORY_RECORD_ID = 'directory'\n\n/**\n * Read the directory toggle from `_meta/directory`. Returns `undefined`\n * when no document has been persisted — callers treat that as the\n * default-on case (`{ enabled: true }`).\n *\n * Tolerates corrupted documents the same way `_meta/policy` does: a\n * JSON parse failure surfaces as `undefined`, not a thrown error, so a\n * bad write never permanently breaks team enumeration.\n */\nexport async function readDirectoryConfig(\n  store: NoydbStore,\n  vault: string,\n): Promise<DirectoryConfig | undefined> {\n  const envelope = await store.get(vault, META_COLLECTION, DIRECTORY_RECORD_ID)\n  if (!envelope) return undefined\n  try {\n    const parsed = JSON.parse(envelope._data) as unknown\n    if (!isDirectoryConfig(parsed)) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Persist the directory toggle at `_meta/directory`. Idempotent — call\n * on every `db.setDirectoryEnabled()` invocation. Owner-only at the\n * caller site; this primitive does not check roles.\n */\nexport async function persistDirectoryConfig(\n  store: NoydbStore,\n  vault: string,\n  config: DirectoryConfig,\n): Promise<void> {\n  const envelope = buildRecordEnvelope(\n    { collection: META_COLLECTION, id: DIRECTORY_RECORD_ID, version: 1 },\n    { iv: '', data: JSON.stringify({ enabled: config.enabled }) },\n  )\n  await store.put(vault, META_COLLECTION, DIRECTORY_RECORD_ID, envelope)\n}\n\nfunction isDirectoryConfig(x: unknown): x is DirectoryConfig {\n  if (x === null || typeof x !== 'object') return false\n  if (!('enabled' in x)) return false\n  return typeof (x as { enabled: unknown }).enabled === 'boolean'\n}\n","/**\n * Persistence helpers for the per-user visibility flag\n * (`_meta/visibility/<keyringId>`). Mirrors the bypass-AES pattern used\n * by `_meta/policy` — the visibility document is plain JSON, the\n * envelope's `_iv` field is left empty.\n *\n * Stored alongside the keyring file rather than inside the encrypted\n * user envelope (`_users/<keyringId>`) because:\n *\n *  - `UserEnvelope<T>.data` is opaque-to-hub by contract — hub does not\n *    introspect or reserve any keys inside it. Adding `hidden` there\n *    would violate that contract.\n *  - `listUsersWithEnvelopes` filters by the flag, and the filter must\n *    work even when decryption fails (legacy keyrings predating the\n *    envelope feature, or a corrupted envelope).\n *\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility\n * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/plaintext-bypass.md — every `_iv: ''` write site\n *\n * @module\n */\nimport { buildRecordEnvelope } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { UserVisibility } from './types.js'\nimport { META_COLLECTION } from './storage.js'\n\n/** Prefix for per-user visibility records inside `_meta`. */\nexport const VISIBILITY_RECORD_PREFIX = 'visibility/'\n\n/** Compose the `_meta` record id for a keyring's visibility doc. */\nexport function visibilityRecordId(keyringId: string): string {\n  return VISIBILITY_RECORD_PREFIX + keyringId\n}\n\n/**\n * Read the visibility flag for `keyringId`. Returns `undefined` when no\n * document has been persisted — callers treat that as the default-visible\n * case (`{ hidden: false }`).\n */\nexport async function readUserVisibility(\n  store: NoydbStore,\n  vault: string,\n  keyringId: string,\n): Promise<UserVisibility | undefined> {\n  const envelope = await store.get(vault, META_COLLECTION, visibilityRecordId(keyringId))\n  if (!envelope) return undefined\n  try {\n    const parsed = JSON.parse(envelope._data) as unknown\n    if (!isUserVisibility(parsed)) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Persist the visibility flag for `keyringId` at\n * `_meta/visibility/<keyringId>`. Idempotent — call on every\n * `vault.user.setMyVisibility()` invocation. Own-only at the caller\n * site; this primitive does not enforce keyring ownership.\n */\nexport async function persistUserVisibility(\n  store: NoydbStore,\n  vault: string,\n  keyringId: string,\n  visibility: UserVisibility,\n): Promise<void> {\n  const recordId = visibilityRecordId(keyringId)\n  const envelope = buildRecordEnvelope(\n    { collection: META_COLLECTION, id: recordId, version: 1 },\n    { iv: '', data: JSON.stringify({ hidden: visibility.hidden }) },\n  )\n  await store.put(vault, META_COLLECTION, recordId, envelope)\n}\n\n/**\n * Delete the visibility flag for `keyringId`. Called from `revoke()`\n * alongside `deleteUserEnvelope` so the sidecar does not leak to a\n * re-granted principal with the same `userId`. Idempotent — the store's\n * `delete()` is already a no-op when the record is absent.\n */\nexport async function deleteUserVisibility(\n  store: NoydbStore,\n  vault: string,\n  keyringId: string,\n): Promise<void> {\n  await store.delete(vault, META_COLLECTION, visibilityRecordId(keyringId))\n}\n\nfunction isUserVisibility(x: unknown): x is UserVisibility {\n  if (x === null || typeof x !== 'object') return false\n  if (!('hidden' in x)) return false\n  return typeof (x as { hidden: unknown }).hidden === 'boolean'\n}\n","/**\n * Persistence helpers for per-principal user envelopes stored at\n * `_users/<keyringId>` (logically: `_meta/user/<keyringId>`).\n *\n * Unlike `_meta/policy` and `_meta/handle` which are plaintext, user\n * envelopes carry user data and are encrypted with a dedicated\n * {@link USER_ENVELOPE_COLLECTION} DEK (provisioned at vault open and\n * propagated to every keyring via the system-collection DEK path in\n * `team/keyring.ts`).\n *\n * This module is the **storage primitive** layer. The public API\n * (`vault.user.*`) sits on top of this; permission gates, own-only\n * write enforcement, and presence-channel propagation live there.\n *\n * @see design-history/2026-05-05-user-envelope-design.md\n *\n * @module\n */\nimport type { NoydbStore, UserEnvelope } from '../../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../../kernel/enclave/index.js'\nimport { ConflictError, UserEnvelopeOversizedError } from '../../../kernel/errors.js'\nimport {\n  USER_ENVELOPE_COLLECTION,\n  USER_ENVELOPE_MAX_BYTES,\n} from '../../../kernel/constants.js'\n\n/**\n * Read and decrypt the user envelope for `keyringId`. Returns `null`\n * when no envelope has been persisted (either the principal has never\n * called `updateMe`, or the keyring predates this feature).\n *\n * Decryption errors propagate — a tampered or wrong-keyed envelope\n * surfaces as the underlying crypto error rather than masquerading as\n * \"not found\".\n */\nexport async function loadUserEnvelope<T = unknown>(\n  store: NoydbStore,\n  vault: string,\n  keyringId: string,\n  dek: EnclaveKey,\n): Promise<UserEnvelope<T> | null> {\n  const envelope = await store.get(vault, USER_ENVELOPE_COLLECTION, keyringId)\n  if (!envelope) return null\n  const plaintext = await openEnvelopeJson({ collection: USER_ENVELOPE_COLLECTION, id: keyringId }, envelope, dek)\n  const data = JSON.parse(plaintext) as T\n  return {\n    keyringId,\n    data,\n    _v: envelope._v,\n    _ts: envelope._ts,\n  }\n}\n\n/**\n * Encrypt and persist the user envelope for `keyringId`. The new\n * version is `(prior._v ?? 0) + 1`. Pass `expectedVersion` to enable\n * optimistic-concurrency checks: a mismatch with the stored version\n * throws {@link ConflictError} with the actual stored version.\n *\n * `expectedVersion: 0` means \"expect no prior envelope\"; the write\n * succeeds only if no envelope exists yet.\n *\n * Soft-caps the JSON-serialized payload at {@link USER_ENVELOPE_MAX_BYTES};\n * larger payloads throw {@link UserEnvelopeOversizedError}.\n */\nexport async function saveUserEnvelope<T>(\n  store: NoydbStore,\n  vault: string,\n  keyringId: string,\n  payload: T,\n  dek: EnclaveKey,\n  expectedVersion?: number,\n): Promise<UserEnvelope<T>> {\n  const json = JSON.stringify(payload)\n  // TextEncoder counts bytes correctly for multi-byte UTF-8 (Thai text,\n  // emoji, etc.) — JSON.stringify().length would undercount.\n  const bytes = new TextEncoder().encode(json).byteLength\n  if (bytes > USER_ENVELOPE_MAX_BYTES) {\n    throw new UserEnvelopeOversizedError(bytes)\n  }\n\n  const prior = await store.get(vault, USER_ENVELOPE_COLLECTION, keyringId)\n  if (expectedVersion !== undefined) {\n    const priorVersion = prior?._v ?? 0\n    if (priorVersion !== expectedVersion) {\n      throw new ConflictError(\n        priorVersion,\n        `User envelope for \"${keyringId}\" expected version ${expectedVersion}, ` +\n          `actual ${priorVersion}`,\n      )\n    }\n  }\n\n  const nextVersion = (prior?._v ?? 0) + 1\n  const ts = new Date().toISOString()\n  const identity = { collection: USER_ENVELOPE_COLLECTION, id: keyringId, version: nextVersion }\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n\n  const envelope = buildRecordEnvelope(\n    identity,\n    { ts, iv, data },\n  )\n  await store.put(vault, USER_ENVELOPE_COLLECTION, keyringId, envelope)\n\n  return {\n    keyringId,\n    data: payload,\n    _v: nextVersion,\n    _ts: ts,\n  }\n}\n\n/**\n * Delete the user envelope for `keyringId`. Idempotent — no error if\n * the envelope is already absent. Called from the keyring revoke path\n * (cascade-delete) and is a no-op for keyrings that never wrote.\n */\nexport async function deleteUserEnvelope(\n  store: NoydbStore,\n  vault: string,\n  keyringId: string,\n): Promise<void> {\n  await store.delete(vault, USER_ENVELOPE_COLLECTION, keyringId)\n}\n\n/**\n * List the keyring ids that have a user envelope persisted in `vault`.\n * Order is store-defined — callers that need a stable order should sort.\n */\nexport async function listUserEnvelopeIds(\n  store: NoydbStore,\n  vault: string,\n): Promise<string[]> {\n  return store.list(vault, USER_ENVELOPE_COLLECTION)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAgBO,IAAM,kBAAkB;AAExB,IAAM,sBAAsB;AAWnC,eAAsB,oBACpB,OACA,OACsC;AACtC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,iBAAiB,mBAAmB;AAC5E,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,QAAI,CAAC,kBAAkB,MAAM,EAAG,QAAO;AACvC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,eAAsB,uBACpB,OACA,OACA,QACe;AACf,QAAM,WAAW;AAAA,IACf,EAAE,YAAY,iBAAiB,IAAI,qBAAqB,SAAS,EAAE;AAAA,IACnE,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,QAAQ,CAAC,EAAE;AAAA,EAC9D;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,qBAAqB,QAAQ;AACvE;AAEA,SAAS,kBAAkB,GAAkC;AAC3D,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,MAAI,EAAE,aAAa,GAAI,QAAO;AAC9B,SAAO,OAAQ,EAA2B,YAAY;AACxD;;;ACtCO,IAAM,2BAA2B;AAGjC,SAAS,mBAAmB,WAA2B;AAC5D,SAAO,2BAA2B;AACpC;AAOA,eAAsB,mBACpB,OACA,OACA,WACqC;AACrC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,iBAAiB,mBAAmB,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,QAAI,CAAC,iBAAiB,MAAM,EAAG,QAAO;AACtC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,eAAsB,sBACpB,OACA,OACA,WACA,YACe;AACf,QAAM,WAAW,mBAAmB,SAAS;AAC7C,QAAM,WAAW;AAAA,IACf,EAAE,YAAY,iBAAiB,IAAI,UAAU,SAAS,EAAE;AAAA,IACxD,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,EAAE,QAAQ,WAAW,OAAO,CAAC,EAAE;AAAA,EAChE;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,UAAU,QAAQ;AAC5D;AAQA,eAAsB,qBACpB,OACA,OACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,iBAAiB,mBAAmB,SAAS,CAAC;AAC1E;AAEA,SAAS,iBAAiB,GAAiC;AACzD,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,MAAI,EAAE,YAAY,GAAI,QAAO;AAC7B,SAAO,OAAQ,EAA0B,WAAW;AACtD;;;AC1DA,eAAsB,iBACpB,OACA,OACA,WACA,KACiC;AACjC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,0BAA0B,SAAS;AAC3E,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,YAAY,MAAM,iBAAiB,EAAE,YAAY,0BAA0B,IAAI,UAAU,GAAG,UAAU,GAAG;AAC/G,QAAM,OAAO,KAAK,MAAM,SAAS;AACjC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,IAAI,SAAS;AAAA,IACb,KAAK,SAAS;AAAA,EAChB;AACF;AAcA,eAAsB,iBACpB,OACA,OACA,WACA,SACA,KACA,iBAC0B;AAC1B,QAAM,OAAO,KAAK,UAAU,OAAO;AAGnC,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE;AAC7C,MAAI,QAAQ,yBAAyB;AACnC,UAAM,IAAI,2BAA2B,KAAK;AAAA,EAC5C;AAEA,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,0BAA0B,SAAS;AACxE,MAAI,oBAAoB,QAAW;AACjC,UAAM,eAAe,OAAO,MAAM;AAClC,QAAI,iBAAiB,iBAAiB;AACpC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,sBAAsB,SAAS,sBAAsB,eAAe,YACxD,YAAY;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AAEA,QAAM,eAAe,OAAO,MAAM,KAAK;AACvC,QAAM,MAAK,oBAAI,KAAK,GAAE,YAAY;AAClC,QAAM,WAAW,EAAE,YAAY,0BAA0B,IAAI,WAAW,SAAS,YAAY;AAC7F,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AAEtE,QAAM,WAAW;AAAA,IACf;AAAA,IACA,EAAE,IAAI,IAAI,KAAK;AAAA,EACjB;AACA,QAAM,MAAM,IAAI,OAAO,0BAA0B,WAAW,QAAQ;AAEpE,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,IAAI;AAAA,IACJ,KAAK;AAAA,EACP;AACF;AAOA,eAAsB,mBACpB,OACA,OACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,0BAA0B,SAAS;AAC/D;AAMA,eAAsB,oBACpB,OACA,OACmB;AACnB,SAAO,MAAM,KAAK,OAAO,wBAAwB;AACnD;","names":[]}

package/dist/{chunk-YAWK6AWF.js → chunk-JIF3IBRK.js}

@@ -1,7 +1,7 @@
 import {
   DerivationCapExceededError,
   DerivationOutputShapeError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-formula/derivations/executor.ts
 var DerivationExecutor = {
@@ -121,4 +121,4 @@ var DerivationExecutor = {
 export {
   DerivationExecutor
 };
-//# sourceMappingURL=chunk-YAWK6AWF.js.map
+//# sourceMappingURL=chunk-JIF3IBRK.js.map

package/dist/{chunk-HNHCQ556.js → chunk-KBOPY6W2.js}

@@ -1,7 +1,7 @@
 import {
   NoydbError,
   ValidationError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-shape/links/names.ts
 var LINK_COLLECTION_PREFIX = "_links_";
@@ -60,4 +60,4 @@ export {
   linkRowKey,
   LinkIntegrityError
 };
-//# sourceMappingURL=chunk-HNHCQ556.js.map
+//# sourceMappingURL=chunk-KBOPY6W2.js.map

package/dist/{chunk-UHXCLPGC.js → chunk-KDX6VEYV.js}

@@ -1,6 +1,6 @@
 import {
   NoydbError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/kernel/via/index.ts
 var binders = /* @__PURE__ */ new Map();
@@ -26,4 +26,4 @@ export {
   isViaInstalled,
   viaBinder
 };
-//# sourceMappingURL=chunk-UHXCLPGC.js.map
+//# sourceMappingURL=chunk-KDX6VEYV.js.map

package/dist/chunk-KDX6VEYV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/via/index.ts"],"sourcesContent":["// kernel/via/index.ts — the ONLY kernel-resident via surface.\nimport { NoydbError } from '../errors.js'\nimport type { EncryptedEnvelope } from '../types.js'\n\n/** Awaitable type for potentially async results. */\ntype Awaitable<T> = T | Promise<T>\n\n/** Declared security posture — a property the kernel enforces (enforcement activates in phases B/C). */\nexport interface ViaPosture {\n  readonly encryptedAtRest: 'envelope' | 'sealed'\n  readonly queryable: 'none' | 'det-exact' | 'ordered' | 'full'\n  readonly exportable: boolean\n  readonly forgettable: boolean\n}\n\n/** Opaque marker every feature descriptor extends; the kernel never sees concrete descriptor types. */\nexport interface ViaDescriptor { readonly _viaBrand: string }\n\n/** Per-call write context (A: minimal; B/C extend). */\nexport interface ViaWriteCtx {\n  readonly id: string\n  /** Owning vault name (event payload identity — e.g. i18n:script-violation). */\n  readonly vault: string\n  /** Prior stored record (decoded), lazily resolved. Null when creating. */\n  readonly prior: () => Promise<Record<string, unknown> | null>\n  /** Typed event emission (e.g. i18n:script-violation). */\n  readonly emit: (event: string, payload: unknown) => void\n}\n\n/** Per-call read context — mirrors LocaleReadOptions loosely; features narrow. */\nexport interface ViaReadCtx {\n  readonly locale?: unknown\n  readonly fallback?: unknown\n  readonly layer: string\n}\n\n/** One sealed slot's ciphertext — matches the existing `iv:data` sealed map entries (seam map §2 step 2). */\nexport interface SealedSlotRef { readonly iv: string; readonly data: string }\n\n/**\n * A scoped crypto capability handed to a `via` feature's `encodeAtRest`/\n * `decodeAtRest`/`erase` hooks — never the keyring, never the enclave.\n * `sealedSlots` is pre-bound to one `(collection, recordId)`; `reservedEnvelopes`\n * is a whole-envelope encrypt/decrypt door scoped to collection names under a\n * declared prefix (e.g. `_dict_`).\n */\nexport interface ViaCryptoCtx {\n  readonly sealedSlots: {\n    seal(field: string, plaintext: unknown): Promise<SealedSlotRef>\n    unseal(field: string, ref: SealedSlotRef): Promise<unknown>\n    delete(field: string): Promise<void>\n  }\n  reservedEnvelopes(prefix: string): {\n    /**\n     * `id` is the record id the envelope will be stored under. Required\n     * (#1051) because this function holds the DEK, so it is where record-identity\n     * AAD is applied — a caller that cannot name the id cannot be bound.\n     */\n    encrypt(\n      identity: { readonly collection: string; readonly id: string; readonly by?: string },\n      json: string,\n      v: number,\n    ): Promise<EncryptedEnvelope>\n    decrypt(collection: string, id: string, env: EncryptedEnvelope): Promise<string>\n  }\n}\n\n/** Per-call erase context — `forget()`'s per-ref participation door (phase C). */\nexport interface ViaEraseCtx { readonly id: string; readonly vault: string; readonly live: unknown /* EncryptedEnvelope */; readonly crypto: ViaCryptoCtx }\n/**\n * What an `erase` hook reports back to `forget()`'s summary ledger entry.\n * `retainedShared` is additive (#629 Task 10) — content NOT erased because\n * still referenced by another live record (blob's shared-chunk dual\n * accounting, `shredAllForRecord()`'s `retainedShared` count). Absent/0 for\n * bindings with no such concept (a sealed field is never \"shared\").\n */\nexport interface ViaEraseReport { readonly shredded: number; readonly residue: readonly unknown[]; readonly retainedShared?: number }\n\n/**\n * A feature bound to one collection's declared config. Record-grain hooks —\n * every hook receives the whole record (matches the real engine signatures,\n * e.g. quantizeMoneyFields(record, moneyFields)). All hooks optional;\n * absent = passthrough. Query-participation hooks are SYNC (#553).\n */\nexport interface ViaBinding {\n  readonly brand: string\n  readonly posture: ViaPosture\n  /** Declared dependencies (field paths / cross-record specs). MANDATORY for any future\n   *  derive-bearing binding — phase C validates well-formedness (strings, non-empty,\n   *  reference declared fields) and graph-registers a derived edge for each covered\n   *  field at declare time, right after `compileViaBindings` builds the bindings\n   *  (unknown source field throws `ValidationError`). See\n   *  `kernel/collection-config.ts`'s `resolveViaBindingDepsEdges`. */\n  readonly deps?: readonly string[]\n  /** Collection-name prefixes this binding's `reservedEnvelopes` capability may address (e.g. `_dict_`). */\n  readonly reservedPrefixes?: readonly string[]\n  /**\n   * Does this binding own `field`? Backs `ViaPipeline.postureFor` (#629 Task\n   * 8's posture consumer) — a passive coverage check, independent of\n   * `buildClause`/`compareForOrder` (which some bindings, e.g. classified and\n   * blob, never define). SYNC, no side effects.\n   *\n   * Contract (documentation only — not enforced at runtime, future work):\n   * any binding declaring a non-default posture value — `queryable: 'none'`\n   * (#629 Task 8) or `exportable: false` (#629 Task 9's `redactForExport`)\n   * — MUST implement `covers()`. `postureFor`'s consumers only engage for\n   * fields a binding actively claims via `covers()`; a binding that omits\n   * it would silently fall through to the generic (unrefused/unredacted)\n   * path instead.\n   */\n  covers?(field: string): boolean\n  // NOTE: phase C adds a `derive` hook ADDITIVELY — do not stub it now.\n  // ── write pipeline ──\n  /** Refuse a write before crypto runs (classified step-3 slot: storage:'never' rejection + validators). Throws to refuse. */\n  enforceWrite?(record: Record<string, unknown>, ctx: ViaWriteCtx): void | Promise<void>\n  /** First pipeline stage (money canonicalizeIncomingMoney). SYNC. */\n  ingest?(record: Record<string, unknown>): Record<string, unknown>\n  /** Decode STORED form to canonical for internal boundaries (gates, derivations, patch bases). SYNC. */\n  canonicalizeStored?(record: Record<string, unknown>): Record<string, unknown>\n  /** Post-validation write encoding (money quantize; i18n translate→script→validate→densify). May be async. */\n  encodeWrite?(record: Record<string, unknown>, ctx: ViaWriteCtx): Awaitable<Record<string, unknown>>\n  /** Final write-pipeline stage: seal/encrypt declared fields via `crypto` before the envelope body is built (classified step-2 slot). */\n  encodeAtRest?(record: Record<string, unknown>, crypto: ViaCryptoCtx): Promise<{ record: Record<string, unknown>; sealed?: Record<string, SealedSlotRef> }>\n  // ── read pipeline ──\n  /** First read-pipeline stage: unseal/decrypt declared fields via `crypto` before `present` runs (classified sealed-handle slot). */\n  decodeAtRest?(record: Record<string, unknown>, sealed: Record<string, SealedSlotRef>, crypto: ViaCryptoCtx, opts: { asHandles: boolean }): Promise<Record<string, unknown>>\n  /** Read-time presentation (money decode+virtuals; i18n locale/labels/strip). May be async. */\n  present?(record: Record<string, unknown>, ctx: ViaReadCtx): Awaitable<Record<string, unknown>>\n  /**\n   * Late read-time presentation (#669) — runs AFTER every binding's `present()` in the\n   * money+computed present-order segment (`ViaPipeline`'s `_presentOrder`, `kernel/via/\n   * pipeline.ts`), BEFORE the \"everything else\" segment (i18n/lookup dressing, taint\n   * redaction) runs. Exists for a binding that needs to react to a virtual computed\n   * field's fresh OWN-field output before anything dresses it (money's MAJOR-UNITS\n   * quantize-and-present for a field that is BOTH money AND `mode:'virtual'` computed) —\n   * `present()` alone can't express \"run after computed for THESE fields only, before\n   * computed for all others\", since it's a per-BINDING fold, not per-field. Folded over\n   * `bindings` in declaration order (mirrors every other per-binding fold), so lookup/\n   * i18n dressing and taint/redaction (both in the \"everything else\" segment) still see\n   * the already-dressed value.\n   */\n  presentLate?(record: Record<string, unknown>, ctx: ViaReadCtx): Awaitable<Record<string, unknown>>\n  // ── query participation (ALL SYNC — #553) ──\n  /** Returns an opaque clause payload when this binding covers `field`, else undefined. */\n  // eslint-disable-next-line @typescript-eslint/no-redundant-type-constituents\n  buildClause?(field: string, op: string, value: unknown): unknown | undefined\n  /** Evaluate a payload produced by buildClause against a raw stored value. */\n  evaluateClause?(actual: unknown, op: string, payload: unknown): boolean\n  /**\n   * Optional: the STORED-form operand for a direct secondary-index probe\n   * against a payload produced by `buildClause` (#625) — lets\n   * `candidateRecords()` (`query/builder.ts`) hit `CollectionIndexes.\n   * lookupEqual`/`lookupIn` for `==`/`in` clauses instead of falling back\n   * to a linear scan + per-record `evaluateClause`. Returning `undefined`\n   * means \"no sound probe for this op/payload\" (e.g. a comparison whose\n   * stored form isn't a single index-bucketable value, or an op the index\n   * can't serve) — the caller falls back to the scan. A binding that\n   * never implements this hook always falls back, unchanged from before\n   * this hook existed.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-redundant-type-constituents\n  indexProbe?(op: string, payload: unknown): unknown | undefined\n  /**\n   * Optional: canonicalize a raw STORED field value into the bucket key an\n   * eager index should use (#672) — lets `CollectionIndexes` group a\n   * pre-declaration / non-canonical stored value (e.g. a money field's\n   * leftover `'0100'` written before its `money()` declaration) under the\n   * SAME key a canonical write produces (`'100'`), so the index-probe fast\n   * path (`indexProbe` above) and the fallback scan (`evaluateClause`)\n   * agree on which records match. `undefined` means \"not mine / can't\n   * canonicalize this value\" — the caller buckets the raw stringified\n   * value, unchanged from before this hook existed. MUST agree with what\n   * this binding's own `evaluateClause`/`indexProbe` treat as equal, or\n   * the fast path and the scan will disagree.\n   */\n  canonicalizeIndexKey?(field: string, rawValue: unknown): string | undefined\n  /** Decode a raw stored record for query/scan results and callback views ('raw' — no virtuals). */\n  decodeResults?(record: unknown): unknown\n  /** Exact ordering for a covered field; undefined when the field is not covered. */\n  compareForOrder?(field: string, a: unknown, b: unknown): number | undefined\n  /**\n   * Per-key, PER-CALL-locale label resolution for `orderBy(field, dir,\n   * { by: 'label' })` (#650 Task 7) — the sibling `compareForOrder` above\n   * structurally cannot serve, since it carries no locale parameter.\n   * `locale` is the query's per-call locale (`undefined` for a locale-less\n   * query — a binding may fall back to its own descriptor-level default,\n   * mirroring `present`'s displayLocale hinge). `undefined` return = this\n   * binding doesn't resolve a label for `key` at `field` — caller falls\n   * back to the raw stored value, same graceful-degrade discipline every\n   * other via query hook uses. SYNC (#553 — query participation).\n   */\n  resolveOrderLabel?(field: string, key: string, locale: string | undefined): string | undefined\n  /** Rewrite an aggregate spec (money exact reducers). */\n  wrapReducers?(spec: unknown): unknown\n  // ── forget participation ──\n  /** `forget()`'s per-ref erasure door — shred/report this binding's residue for one record (classified/blob forget participation). */\n  erase?(ctx: ViaEraseCtx): Promise<ViaEraseReport>\n  // ── introspection ──\n  describeFragment?(): Record<string, unknown>\n}\n\n/** Binder: constructs a binding from a collection's declared config. Installed by the feature's declaration factory. */\nexport type ViaBinder = (config: unknown) => ViaBinding\n\nconst binders = new Map<string, ViaBinder>()\n\n/** @internal — called (idempotently, first-wins) by a feature's declaration factory, e.g. money(). */\nexport function installViaBinder(brand: string, binder: ViaBinder): void {\n  if (!binders.has(brand)) binders.set(brand, binder)\n}\n\n/** @internal — registry presence check. Used by tests (mirrors isMoneyEngineInstalled) and by vault's i18n validator delegators as a no-i18n-ever-declared fast path. */\nexport function isViaInstalled(brand: string): boolean {\n  return binders.has(brand)\n}\n\n/** @internal — resolve a binder; throws when the declaration factory never ran (hand-rolled descriptors). */\nexport function viaBinder(brand: string): ViaBinder {\n  const b = binders.get(brand)\n  if (!b) {\n    throw new NoydbError(\n      'VIA_NOT_LINKED',\n      `via feature \"${brand}\" requires descriptors created via its declaration factory from @noy-db/hub`,\n    )\n  }\n  return b\n}\n"],"mappings":";;;;;AA4MA,IAAM,UAAU,oBAAI,IAAuB;AAGpC,SAAS,iBAAiB,OAAe,QAAyB;AACvE,MAAI,CAAC,QAAQ,IAAI,KAAK,EAAG,SAAQ,IAAI,OAAO,MAAM;AACpD;AAGO,SAAS,eAAe,OAAwB;AACrD,SAAO,QAAQ,IAAI,KAAK;AAC1B;AAGO,SAAS,UAAU,OAA0B;AAClD,QAAM,IAAI,QAAQ,IAAI,KAAK;AAC3B,MAAI,CAAC,GAAG;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA,gBAAgB,KAAK;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-W3TVWF6N.js → chunk-KM6YR5XF.js}

@@ -1,6 +1,6 @@
 import {
   BrokerNotEnabledError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/port/with/broker-strategy.ts
 var NO_BROKER = {
@@ -27,4 +27,4 @@ export {
   NO_BROKER,
   buildCredentialBrokerHandle
 };
-//# sourceMappingURL=chunk-W3TVWF6N.js.map
+//# sourceMappingURL=chunk-KM6YR5XF.js.map

package/dist/{chunk-3737A6EA.js → chunk-KUXTWVAR.js}

@@ -1,6 +1,7 @@
 import {
-  applyJoins
-} from "./chunk-E6427JU2.js";
+  applyJoins,
+  splitAroundJoins
+} from "./chunk-L6FSZFG7.js";
 import {
   NO_REDUCE
 } from "./chunk-YMUFFJCO.js";
@@ -17,7 +18,7 @@ import {
   CrossJoinTooLargeError,
   DanglingReferenceError,
   FieldNotQueryableError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/kernel/query/live.ts
 function buildLiveQuery(recompute, upstreams) {
@@ -99,6 +100,17 @@ var EMPTY_PLAN = {
   joins: []
 };
 var DEFAULT_CROSS_JOIN_MAX_ROWS = 5e4;
+function assertNoJoinAliasField(fields, joins, terminal) {
+  if (joins.length === 0) return;
+  const aliases = new Set(joins.map((leg) => leg.as));
+  for (const field of fields) {
+    const head = field.split(".")[0];
+    if (!aliases.has(head)) continue;
+    throw new Error(
+      `Query.${terminal}(): field "${field}" addresses the join alias "${head}", but ${terminal}() does not apply join legs \u2014 it would silently group every row under undefined. Joined aggregation is not supported. Either aggregate over the left collection's own fields, or use .crossJoin("${head}", { as: \u2026 }), whose expansion IS visible to ${terminal}().`
+    );
+  }
+}
 var Query = class _Query {
   source;
   plan;
@@ -532,14 +544,37 @@ var Query = class _Query {
    * (Left/base i18n fields are resolved by `get`/`list`, not here.)
    */
   toArray(opts) {
-    const base = this.decodeVia(executePlanWithSource(this.source, this.plan, this.joinContext, opts?.locale));
-    if (this.plan.joins.length === 0) return base;
+    const { preJoin, postJoin } = splitAroundJoins(this.plan.clauses, this.plan.joins);
+    if (postJoin.length === 0) {
+      const base = this.decodeVia(executePlanWithSource(this.source, this.plan, this.joinContext, opts?.locale));
+      if (this.plan.joins.length === 0) return base;
+      return applyJoins(base, this.plan.joins, this.requireJoinContext("toArray"), opts?.locale);
+    }
+    const joinContext = this.requireJoinContext("toArray");
+    const narrowed = this.decodeVia(
+      executePlanWithSource(
+        this.source,
+        { ...this.plan, clauses: preJoin, orderBy: [], limit: void 0, offset: 0 },
+        joinContext,
+        opts?.locale
+      )
+    );
+    const joined = applyJoins(narrowed, this.plan.joins, joinContext, opts?.locale);
+    const filtered = filterRecords(joined, postJoin, fnViewDecoder(this.source));
+    return applyOrderAndPage(filtered, this.plan, this.source, joinContext, opts?.locale);
+  }
+  /**
+   * Joins need a `JoinContext`. Unreachable in practice — `.join()` throws
+   * when one is missing — but belt-and-braces for a plan built through the
+   * raw `Query` constructor with joins pre-populated.
+   */
+  requireJoinContext(terminal) {
     if (!this.joinContext) {
       throw new Error(
-        `Query.toArray(): plan carries ${this.plan.joins.length} join leg(s) but no JoinContext is attached. This usually means the Query was constructed via the raw Query constructor with a plan that had joins pre-populated. Use collection.query().join(...) instead.`
+        `Query.${terminal}(): plan carries ${this.plan.joins.length} join leg(s) but no JoinContext is attached. This usually means the Query was constructed via the raw Query constructor with a plan that had joins pre-populated. Use collection.query().join(...) instead.`
       );
     }
-    return applyJoins(base, this.plan.joins, this.joinContext, opts?.locale);
+    return this.joinContext;
   }
   /**
    * Decode this source's Via-covered fields on read (e.g. money: stored
@@ -567,12 +602,19 @@ var Query = class _Query {
   }
   /**
    * Return the number of matching records (after where/filter,
-   * before limit). **Joins are NOT applied** — count() reports the
-   * left-side cardinality, because joins in are projection-only
+   * before limit). **Joins are normally NOT applied** — count() reports the
+   * left-side cardinality, because joins are projection-only
    * (they attach an aliased field; they never filter). Running joins
    * here just to discard the aliases would be wasteful, and in strict
    * mode it could throw `DanglingReferenceError` for a call whose
    * intent is purely to count.
+   *
+   * The exception (#1030) is a `where` clause addressing a join alias. Then
+   * the legs must run, because the predicate is part of what is being
+   * counted — skipping them would report the unfiltered left cardinality.
+   * A strict-mode `DanglingReferenceError` becomes reachable from `count()`
+   * in exactly that case, which is acceptable: the caller asked to filter on
+   * the joined side, so they asked for the join.
    */
   count() {
     if (this.plan.clauses.some((c) => c.type === "crossJoin")) {
@@ -583,12 +625,20 @@ var Query = class _Query {
       }
       return executeClausePipeline(this.source, this.plan.clauses, this.joinContext).length;
     }
-    const { candidates, remainingClauses } = candidateRecords(this.source, this.plan.clauses);
-    if (remainingClauses.length === 0) return candidates.length;
-    return filterRecords(candidates, remainingClauses, fnViewDecoder(this.source)).length;
+    const { preJoin, postJoin } = splitAroundJoins(this.plan.clauses, this.plan.joins);
+    const { candidates, remainingClauses } = candidateRecords(this.source, preJoin);
+    const narrowed = remainingClauses.length === 0 ? candidates : filterRecords(candidates, remainingClauses, fnViewDecoder(this.source));
+    if (postJoin.length === 0) return narrowed.length;
+    const joined = applyJoins(narrowed, this.plan.joins, this.requireJoinContext("count"));
+    return filterRecords(joined, postJoin, fnViewDecoder(this.source)).length;
   }
   aggregate(specOrBuild) {
     let spec = typeof specOrBuild === "function" ? specOrBuild(reducerBuilder) : specOrBuild;
+    assertNoJoinAliasField(
+      Object.values(spec).map((r) => r.field).filter((f) => typeof f === "string"),
+      this.plan.joins,
+      "aggregate"
+    );
     spec = this.source.via?.wrapReducers(spec) ?? spec;
     const source = this.source;
     const clauses = this.plan.clauses;
@@ -613,6 +663,7 @@ var Query = class _Query {
     if (fields.length === 0) {
       throw new Error(".groupBy() requires at least one field");
     }
+    assertNoJoinAliasField(fields, this.plan.joins, "groupBy");
     const source = this.source;
     const clauses = this.plan.clauses;
     const joinCtx = this.joinContext;
@@ -777,6 +828,10 @@ function executePlanWithSource(source, plan, joinContext, locale) {
     const { candidates, remainingClauses } = candidateRecords(source, plan.clauses);
     result = remainingClauses.length === 0 ? [...candidates] : filterRecords(candidates, remainingClauses, fnViewDecoder(source));
   }
+  return applyOrderAndPage(result, plan, source, joinContext, locale);
+}
+function applyOrderAndPage(rows, plan, source, joinContext, locale) {
+  let result = rows;
   if (plan.orderBy.length > 0) {
     const labelMaps = buildOrderLabelMaps(plan.orderBy, joinContext, locale, source.via);
     result = sortRecords(result, plan.orderBy, source.via, labelMaps);
@@ -1336,10 +1391,11 @@ var ScanBuilder = class _ScanBuilder {
    */
   async *[Symbol.asyncIterator]() {
     const joinResolvers = this.joins.length === 0 ? null : this.buildJoinResolvers();
+    const { preJoin, postJoin } = splitAroundJoins(this.clauses, this.joins);
     let page = await this.pageProvider.listPage({ limit: this.pageSize });
     while (true) {
       for (const record of page.items) {
-        if (!this.recordMatches(record)) continue;
+        if (!this.recordMatches(record, preJoin)) continue;
         const decoded = this.decodeVia(record);
         if (joinResolvers === null) {
           yield decoded;
@@ -1348,6 +1404,7 @@ var ScanBuilder = class _ScanBuilder {
           for (const resolver of joinResolvers) {
             attached = this.applyOneJoinStreaming(attached, resolver);
           }
+          if (postJoin.length > 0 && !this.recordMatches(attached, postJoin)) continue;
           yield attached;
         }
       }
@@ -1494,10 +1551,10 @@ var ScanBuilder = class _ScanBuilder {
    * path, because the stream sources records from the adapter
    * paginator, not from the in-memory cache where indexes live.
    */
-  recordMatches(record) {
-    if (this.clauses.length === 0) return true;
-    const fnView = this.via?.hasResultDecode && hasFnClause(this.clauses) ? this.decodeVia(record) : void 0;
-    for (const clause of this.clauses) {
+  recordMatches(record, clauses = this.clauses) {
+    if (clauses.length === 0) return true;
+    const fnView = this.via?.hasResultDecode && hasFnClause(clauses) ? this.decodeVia(record) : void 0;
+    for (const clause of clauses) {
       if (!evaluateClause(record, clause, fnView)) return false;
     }
     return true;
@@ -1517,4 +1574,4 @@ export {
   executePlan,
   ScanBuilder
 };
-//# sourceMappingURL=chunk-3737A6EA.js.map
+//# sourceMappingURL=chunk-KUXTWVAR.js.map