@noy-db/hub 0.7.0-pre.13 → 0.7.0-pre.14

package/dist/chunk-EKVNVJVV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/strategy-hash.ts","../src/with-formula/derivations/registry.ts"],"sourcesContent":["/**\n * Deterministic hash of a derivation strategy's \"shape\": source\n * collection, declared sibling sources, output keys, derive function\n * source. Used to detect\n * strategy drift: a record whose `_derivedFrom.strategyHash` doesn't\n * match the current strategy is considered stale.\n *\n * Web Crypto SHA-256 — no extra deps.\n */\nimport { sha256Hex } from '../../kernel/enclave/index.js'\n\nexport async function computeStrategyHash(\n  source: string,\n  outputKeys: readonly string[],\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  derive: (...args: any[]) => any,\n  sources?: ReadonlyArray<string>,\n): Promise<string> {\n  const canonical = JSON.stringify({\n    source,\n    outputs: [...outputKeys].sort(),\n    derive: derive.toString(),\n    // Declared sibling sources — adding/removing a trigger\n    // collection invalidates cached derived records. Omitted when empty\n    // so strategies without siblings keep their existing hash.\n    ...(sources?.length ? { sources: [...sources].sort() } : {}),\n  })\n  const bytes = new TextEncoder().encode(canonical)\n  return sha256Hex(bytes)\n}\n","import { matchTargetFieldNames } from '../../kernel/collection-config.js'\nimport { DerivationCycleError, DuplicateBehaviorNameError, ValidationError } from '../../kernel/errors.js'\nimport { ViaGraph, type FieldRef, type EdgeKind, type Grain } from '../../kernel/via/graph.js'\nimport { schemaFieldKeys } from '../../with-shape/introspection/describe.js'\nimport { computeStrategyHash } from './strategy-hash.js'\nimport { normalizeTriggerBy, type NormalizedTrigger } from './trigger-match.js'\nimport type { DerivationSpec } from './types.js'\n\n/**\n * Whole-record artifact-grain field marker (#638 Task 2). A derivation's\n * `derive()`/a rollup's `compute()` reads the WHOLE source record — there is\n * no single declared field to point at — so a trigger/output collection is\n * modelled as one artifact node per collection (`kernel/via/graph.ts`'s\n * \"Artifact-grain targets... modelled as a field node whose field is the\n * artifact key\" convention). MUST match `materialized-views/registry.ts`'s\n * and `vault.ts`'s overlay-edge marker so cross-registry edges (a derivation\n * feeding into / out of an MV or overlay collection) resolve to the SAME\n * graph node.\n */\nconst WHOLE_RECORD = '*'\n\n/** Strip this registry's `.${WHOLE_RECORD}` artifact suffix off a graph cycle\n *  path entry, recovering the bare collection name — preserves the exact\n *  pre-#638 `DerivationCycleError` message shape (behavior lock) for a pure\n *  record-shape derivation cycle. A rollup's real-field target (not suffixed\n *  `.${WHOLE_RECORD}`) is left untouched. */\nfunction stripArtifactSuffix(displayId: string): string {\n  const suffix = `.${WHOLE_RECORD}`\n  return displayId.endsWith(suffix) ? displayId.slice(0, -suffix.length) : displayId\n}\n\ninterface RegisteredStrategy {\n  // Type-erased to allow the registry to hold heterogeneous strategies.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  spec: DerivationSpec<any, any>\n  strategyHash: string\n  readonly triggers: ReadonlyArray<NormalizedTrigger>\n}\n\n/**\n * Vault-internal registry of derivation strategies. Owned by `Vault`;\n * not exported.\n *\n * @internal\n */\nexport class DerivationRegistry {\n  private readonly _bySource = new Map<string, RegisteredStrategy[]>()\n  private readonly _byOutput = new Map<string, RegisteredStrategy[]>()\n  private readonly _byName = new Map<string, RegisteredStrategy>()\n\n  /**\n   * Register a derivation strategy. If `spec.name` is given and already\n   * registered by another derivation in this vault, throws\n   * {@link DuplicateBehaviorNameError} before indexing.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  async register(spec: DerivationSpec<any, any>): Promise<void> {\n    if (spec.name !== undefined && this._byName.has(spec.name)) {\n      throw new DuplicateBehaviorNameError(spec.name, 'derivation')\n    }\n\n    const outputKeys = Object.keys(spec.outputs)\n    const strategyHash = await computeStrategyHash(spec.source, outputKeys, spec.derive, spec.sources)\n    const triggers = normalizeTriggerBy(spec.triggerBy)\n    const reg: RegisteredStrategy = { spec, strategyHash, triggers }\n\n    if (spec.name !== undefined) this._byName.set(spec.name, reg)\n\n    const fromSource = this._bySource.get(spec.source)\n    if (fromSource) fromSource.push(reg)\n    else this._bySource.set(spec.source, [reg])\n\n    // Declared sibling sources index the SAME `reg` under each\n    // extra collection so `strategiesForSource(extra)` returns it and a\n    // sibling write re-fires the derivation. Sibling keys also enter\n    // `_bySource`, so `validate()`'s cycle DFS walks them automatically.\n    for (const extra of spec.sources ?? []) {\n      const fromExtra = this._bySource.get(extra)\n      if (fromExtra) fromExtra.push(reg)\n      else this._bySource.set(extra, [reg])\n    }\n\n    // FK triggers index the SAME `reg` under each parent collection so\n    // a parent write re-fires the derivation (fanned out to matching source\n    // records in `dispatchDerivations`). Like sources[], these keys enter\n    // `_bySource` so the cycle DFS walks the trigger→output edge.\n    for (const t of triggers) {\n      const fromTrigger = this._bySource.get(t.collection)\n      if (fromTrigger) fromTrigger.push(reg)\n      else this._bySource.set(t.collection, [reg])\n    }\n\n    // Rollup: a write to the child `from` collection recomputes\n    // the parent (= spec.source = into) at id child[key]. Index under `from`\n    // so a child write fires it; spec.source (into) is already indexed above,\n    // so a parent write also recomputes its own aggregate (covers the\n    // parent-created-after-children case). The from→into edge enters the cycle\n    // DFS automatically.\n    if (spec.rollup) {\n      const fromRollup = this._bySource.get(spec.rollup.from)\n      if (fromRollup) fromRollup.push(reg)\n      else this._bySource.set(spec.rollup.from, [reg])\n    }\n\n    for (const key of outputKeys) {\n      const output = spec.outputs[key]\n      if (!output) continue\n      const outputCollection = output.collection\n      const arr = this._byOutput.get(outputCollection)\n      if (arr) arr.push(reg)\n      else this._byOutput.set(outputCollection, [reg])\n    }\n  }\n\n  strategiesForSource(source: string): ReadonlyArray<RegisteredStrategy> {\n    return this._bySource.get(source) ?? []\n  }\n\n  strategiesProducingOutput(collection: string): ReadonlyArray<RegisteredStrategy> {\n    return this._byOutput.get(collection) ?? []\n  }\n\n  /**\n   * The #1253-pattern typo guard for match fields (#1249): a misspelt\n   * `to`/`from` silently matches nothing forever, so validate against the\n   * collection's enumerable field set at the earliest point it exists.\n   * `schemaFieldKeys(schema) === undefined` (TS-generic collection,\n   * unreadable validator) is DELIBERATELY silent — those fields are real\n   * and unenumerable. `configKeys` folds in the collection's other\n   * non-schema field declarations (fieldMeta/moneyFields/dictKeyFields/\n   * refs/computed); `denormExempt` is derived here from this registry's\n   * own strategies rather than taken as a parameter — a field this\n   * collection's own derivations write via `denorm` is never a typo.\n   */\n  validateFieldsFor(\n    collectionName: string,\n    schema: unknown,\n    configKeys: ReadonlyArray<string>,\n    viaSources: {\n      readonly computed?: Readonly<Record<string, unknown>> | undefined\n      readonly viaFields?: Readonly<Record<string, unknown>> | undefined\n    } | undefined = undefined,\n  ): void {\n    const targets = matchTargetFieldNames(viaSources ?? {})\n    const virtual = new Set(targets.virtual)\n    const shapeKeys = schemaFieldKeys(schema)\n    // The two checks have DIFFERENT preconditions, which is why one loop runs\n    // both rather than an early return covering both. The typo check needs a\n    // readable field list and must stay silent without one — a false \"unknown\n    // field\" on a TS-generic collection would be worse than no check. The\n    // virtual check needs nothing but the declaration in hand: \"declared, and\n    // never stored\" is provable from the declaration alone (#1266).\n    if (shapeKeys === undefined && virtual.size === 0) return\n    const keys = shapeKeys === undefined ? undefined\n      : new Set([...shapeKeys, ...configKeys, ...targets.declared])\n    const denormExempt = new Set<string>()\n    const regs = new Set([...this._bySource.values()].flat())\n    for (const reg of regs) {\n      if (reg.spec.source !== collectionName) continue\n      for (const out of Object.values(reg.spec.outputs) as Array<{ collection?: string; denorm?: readonly string[] }>) {\n        if (out.collection === collectionName) for (const d of out.denorm ?? []) denormExempt.add(d)\n      }\n    }\n    const unknown = (f: string): boolean =>\n      keys !== undefined && !keys.has(f) && !denormExempt.has(f)\n    for (const reg of regs) {\n      const name = reg.spec.name ?? reg.spec.source\n      for (const t of reg.triggers) {\n        for (const p of t.match) {\n          // `to` reads the SOURCE record; `from` reads the WRITTEN record.\n          // Both are the stored shape, so both refuse a virtual target.\n          if (reg.spec.source === collectionName) {\n            if (virtual.has(p.to)) throw new ValidationError(this._virtualMatchMessage(name, collectionName, p.to, 'to'))\n            if (unknown(p.to)) {\n              throw new ValidationError(\n                `derivation \"${name}\": triggerBy match names source field \"${p.to}\", which \"${collectionName}\" does not declare — a typo here silently matches nothing forever`)\n            }\n          }\n          if (t.collection === collectionName && p.from !== 'id') {\n            if (virtual.has(p.from)) throw new ValidationError(this._virtualMatchMessage(name, collectionName, p.from, 'from'))\n            if (unknown(p.from)) {\n              throw new ValidationError(\n                `derivation \"${name}\": triggerBy match reads \"${p.from}\" from written \"${collectionName}\" records, which that collection does not declare — a typo here silently matches nothing forever`)\n            }\n          }\n        }\n      }\n    }\n  }\n\n  /** #1266 — one message shape for both match sides; see {@link matchTargetFieldNames}. */\n  private _virtualMatchMessage(name: string, collectionName: string, field: string, side: 'to' | 'from'): string {\n    const where = side === 'to'\n      ? `names source field \"${field}\", which \"${collectionName}\"`\n      : `reads \"${field}\" from written \"${collectionName}\" records, which that collection`\n    return `derivation \"${name}\": triggerBy match ${where} declares as a VIRTUAL computed field — virtual fields are evaluated on read and never stored, so the matcher would read every candidate record and match nothing, forever. Declare it as \\`mode: 'materialized'\\` (stored, indexable) or match on a stored field.`\n  }\n\n  /**\n   * All registered strategies as a flat, deduplicated array.\n   * Each strategy is indexed once per source (not once per output key),\n   * so iterating `_bySource.values()` naturally yields each strategy\n   * exactly once per source — deduplication is handled by flattening\n   * the per-source arrays and collecting into a Set by identity.\n   *\n   * Used by `dumpSchema()` / `describeDerivations()` in the introspection\n   * walker to populate the derivations map.\n   */\n  all(): ReadonlyArray<RegisteredStrategy> {\n    const seen = new Set<RegisteredStrategy>()\n    for (const strategies of this._bySource.values()) {\n      for (const s of strategies) seen.add(s)\n    }\n    return [...seen]\n  }\n\n  /**\n   * Graph edges for #638 Task 2: one `'derivation'`/`'record'` edge per\n   * (non-self-write) output key — target = the output collection (a\n   * `WHOLE_RECORD` artifact node), sources = every collection that can\n   * trigger this strategy (`source`, `sources[]`, `triggerBy[].collection`,\n   * and — for a rollup — `rollup.from`), mirroring EXACTLY the trigger keys\n   * `register()` indexes under `_bySource`. The self-write reverse-denorm\n   * output (`output.collection === source` with `denorm` declared) is\n   * skipped — the SAME condition the old local DFS used; it is not a cycle\n   * (see the comment `validate()` used to carry, now on this skip).\n   * Rollups ADDITIONALLY get a dedicated `'rollup'`/`'aggregate'` edge\n   * targeting the real `rollup.field` on the parent (`source`) — the\n   * self-write output above only covers the cycle-DFS skip, not\n   * dispatch/taint (Tasks 3/4/6), which need the real field.\n   */\n  edges(): ReadonlyArray<{ readonly target: FieldRef; readonly sources: readonly FieldRef[]; readonly kind: EdgeKind; readonly grain: Grain }> {\n    const out: Array<{ target: FieldRef; sources: FieldRef[]; kind: EdgeKind; grain: Grain }> = []\n    for (const reg of this.all()) {\n      const spec = reg.spec\n      const triggerCollections = [\n        spec.source,\n        ...(spec.sources ?? []),\n        ...(spec.triggerBy ?? []).map((t) => t.collection),\n        ...(spec.rollup ? [spec.rollup.from] : []),\n      ]\n      const sources: FieldRef[] = triggerCollections.map((c) => ({ collection: c, field: WHOLE_RECORD }))\n      for (const key of Object.keys(spec.outputs)) {\n        const output = spec.outputs[key]\n        if (!output) continue\n        if (output.shape === 'record' && output.collection === spec.source && output.denorm !== undefined) continue\n        out.push({ target: { collection: output.collection, field: WHOLE_RECORD }, sources, kind: 'derivation', grain: 'record' })\n      }\n      if (spec.rollup) {\n        out.push({\n          target: { collection: spec.source, field: spec.rollup.field },\n          sources: [{ collection: spec.rollup.from, field: WHOLE_RECORD }],\n          kind: 'rollup',\n          grain: 'aggregate',\n        })\n      }\n    }\n    return out\n  }\n\n  /**\n   * Cycle detection, delegated to `ViaGraph.assertAcyclic()` (#638 Task 2 —\n   * retires the local DFS). Call after all `register()` calls complete (i.e.\n   * at vault open). Throws `DerivationCycleError` on the first cycle found —\n   * SAME class/timing as before; the message/path is byte-identical to the\n   * pre-#638 shape for a pure record-shape derivation cycle (the\n   * `WHOLE_RECORD` artifact suffix is stripped back to a bare collection\n   * name before re-throwing).\n   *\n   * `graph` is the caller's shared per-vault graph, ALREADY carrying this\n   * registry's `edges()` (the caller registers them — see `Vault._initDerivations`)\n   * — omit it (e.g. this registry's own unit tests) to validate this\n   * registry's edges in isolation against a throwaway graph.\n   */\n  validate(graph?: ViaGraph): void {\n    const g = graph ?? new ViaGraph()\n    if (!graph) {\n      for (const edge of this.edges()) g.registerDerived(edge.target, edge.sources, edge.kind, edge.grain)\n    }\n    try {\n      g.assertAcyclic()\n    } catch (e) {\n      if (e instanceof DerivationCycleError) throw new DerivationCycleError(e.path.map(stripArtifactSuffix))\n      throw e\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAWA,eAAsB,oBACpB,QACA,YAEA,QACA,SACiB;AACjB,QAAM,YAAY,KAAK,UAAU;AAAA,IAC/B;AAAA,IACA,SAAS,CAAC,GAAG,UAAU,EAAE,KAAK;AAAA,IAC9B,QAAQ,OAAO,SAAS;AAAA;AAAA;AAAA;AAAA,IAIxB,GAAI,SAAS,SAAS,EAAE,SAAS,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,EAC5D,CAAC;AACD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,SAAS;AAChD,SAAO,UAAU,KAAK;AACxB;;;ACVA,IAAM,eAAe;AAOrB,SAAS,oBAAoB,WAA2B;AACtD,QAAM,SAAS,IAAI,YAAY;AAC/B,SAAO,UAAU,SAAS,MAAM,IAAI,UAAU,MAAM,GAAG,CAAC,OAAO,MAAM,IAAI;AAC3E;AAgBO,IAAM,qBAAN,MAAyB;AAAA,EACb,YAAY,oBAAI,IAAkC;AAAA,EAClD,YAAY,oBAAI,IAAkC;AAAA,EAClD,UAAU,oBAAI,IAAgC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ/D,MAAM,SAAS,MAA+C;AAC5D,QAAI,KAAK,SAAS,UAAa,KAAK,QAAQ,IAAI,KAAK,IAAI,GAAG;AAC1D,YAAM,IAAI,2BAA2B,KAAK,MAAM,YAAY;AAAA,IAC9D;AAEA,UAAM,aAAa,OAAO,KAAK,KAAK,OAAO;AAC3C,UAAM,eAAe,MAAM,oBAAoB,KAAK,QAAQ,YAAY,KAAK,QAAQ,KAAK,OAAO;AACjG,UAAM,WAAW,mBAAmB,KAAK,SAAS;AAClD,UAAM,MAA0B,EAAE,MAAM,cAAc,SAAS;AAE/D,QAAI,KAAK,SAAS,OAAW,MAAK,QAAQ,IAAI,KAAK,MAAM,GAAG;AAE5D,UAAM,aAAa,KAAK,UAAU,IAAI,KAAK,MAAM;AACjD,QAAI,WAAY,YAAW,KAAK,GAAG;AAAA,QAC9B,MAAK,UAAU,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC;AAM1C,eAAW,SAAS,KAAK,WAAW,CAAC,GAAG;AACtC,YAAM,YAAY,KAAK,UAAU,IAAI,KAAK;AAC1C,UAAI,UAAW,WAAU,KAAK,GAAG;AAAA,UAC5B,MAAK,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC;AAAA,IACtC;AAMA,eAAW,KAAK,UAAU;AACxB,YAAM,cAAc,KAAK,UAAU,IAAI,EAAE,UAAU;AACnD,UAAI,YAAa,aAAY,KAAK,GAAG;AAAA,UAChC,MAAK,UAAU,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC;AAAA,IAC7C;AAQA,QAAI,KAAK,QAAQ;AACf,YAAM,aAAa,KAAK,UAAU,IAAI,KAAK,OAAO,IAAI;AACtD,UAAI,WAAY,YAAW,KAAK,GAAG;AAAA,UAC9B,MAAK,UAAU,IAAI,KAAK,OAAO,MAAM,CAAC,GAAG,CAAC;AAAA,IACjD;AAEA,eAAW,OAAO,YAAY;AAC5B,YAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,UAAI,CAAC,OAAQ;AACb,YAAM,mBAAmB,OAAO;AAChC,YAAM,MAAM,KAAK,UAAU,IAAI,gBAAgB;AAC/C,UAAI,IAAK,KAAI,KAAK,GAAG;AAAA,UAChB,MAAK,UAAU,IAAI,kBAAkB,CAAC,GAAG,CAAC;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,oBAAoB,QAAmD;AACrE,WAAO,KAAK,UAAU,IAAI,MAAM,KAAK,CAAC;AAAA,EACxC;AAAA,EAEA,0BAA0B,YAAuD;AAC/E,WAAO,KAAK,UAAU,IAAI,UAAU,KAAK,CAAC;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,kBACE,gBACA,QACA,YACA,aAGgB,QACV;AACN,UAAM,UAAU,sBAAsB,cAAc,CAAC,CAAC;AACtD,UAAM,UAAU,IAAI,IAAI,QAAQ,OAAO;AACvC,UAAM,YAAY,gBAAgB,MAAM;AAOxC,QAAI,cAAc,UAAa,QAAQ,SAAS,EAAG;AACnD,UAAM,OAAO,cAAc,SAAY,SACnC,oBAAI,IAAI,CAAC,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,QAAQ,CAAC;AAC9D,UAAM,eAAe,oBAAI,IAAY;AACrC,UAAM,OAAO,IAAI,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,EAAE,KAAK,CAAC;AACxD,eAAW,OAAO,MAAM;AACtB,UAAI,IAAI,KAAK,WAAW,eAAgB;AACxC,iBAAW,OAAO,OAAO,OAAO,IAAI,KAAK,OAAO,GAAiE;AAC/G,YAAI,IAAI,eAAe,eAAgB,YAAW,KAAK,IAAI,UAAU,CAAC,EAAG,cAAa,IAAI,CAAC;AAAA,MAC7F;AAAA,IACF;AACA,UAAM,UAAU,CAAC,MACf,SAAS,UAAa,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC;AAC3D,eAAW,OAAO,MAAM;AACtB,YAAM,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK;AACvC,iBAAW,KAAK,IAAI,UAAU;AAC5B,mBAAW,KAAK,EAAE,OAAO;AAGvB,cAAI,IAAI,KAAK,WAAW,gBAAgB;AACtC,gBAAI,QAAQ,IAAI,EAAE,EAAE,EAAG,OAAM,IAAI,gBAAgB,KAAK,qBAAqB,MAAM,gBAAgB,EAAE,IAAI,IAAI,CAAC;AAC5G,gBAAI,QAAQ,EAAE,EAAE,GAAG;AACjB,oBAAM,IAAI;AAAA,gBACR,eAAe,IAAI,0CAA0C,EAAE,EAAE,aAAa,cAAc;AAAA,cAAmE;AAAA,YACnK;AAAA,UACF;AACA,cAAI,EAAE,eAAe,kBAAkB,EAAE,SAAS,MAAM;AACtD,gBAAI,QAAQ,IAAI,EAAE,IAAI,EAAG,OAAM,IAAI,gBAAgB,KAAK,qBAAqB,MAAM,gBAAgB,EAAE,MAAM,MAAM,CAAC;AAClH,gBAAI,QAAQ,EAAE,IAAI,GAAG;AACnB,oBAAM,IAAI;AAAA,gBACR,eAAe,IAAI,6BAA6B,EAAE,IAAI,mBAAmB,cAAc;AAAA,cAAkG;AAAA,YAC7L;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGQ,qBAAqB,MAAc,gBAAwB,OAAe,MAA6B;AAC7G,UAAM,QAAQ,SAAS,OACnB,uBAAuB,KAAK,aAAa,cAAc,MACvD,UAAU,KAAK,mBAAmB,cAAc;AACpD,WAAO,eAAe,IAAI,sBAAsB,KAAK;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAyC;AACvC,UAAM,OAAO,oBAAI,IAAwB;AACzC,eAAW,cAAc,KAAK,UAAU,OAAO,GAAG;AAChD,iBAAW,KAAK,WAAY,MAAK,IAAI,CAAC;AAAA,IACxC;AACA,WAAO,CAAC,GAAG,IAAI;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,QAA6I;AAC3I,UAAM,MAAsF,CAAC;AAC7F,eAAW,OAAO,KAAK,IAAI,GAAG;AAC5B,YAAM,OAAO,IAAI;AACjB,YAAM,qBAAqB;AAAA,QACzB,KAAK;AAAA,QACL,GAAI,KAAK,WAAW,CAAC;AAAA,QACrB,IAAI,KAAK,aAAa,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU;AAAA,QACjD,GAAI,KAAK,SAAS,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC;AAAA,MAC1C;AACA,YAAM,UAAsB,mBAAmB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,aAAa,EAAE;AAClG,iBAAW,OAAO,OAAO,KAAK,KAAK,OAAO,GAAG;AAC3C,cAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,YAAI,CAAC,OAAQ;AACb,YAAI,OAAO,UAAU,YAAY,OAAO,eAAe,KAAK,UAAU,OAAO,WAAW,OAAW;AACnG,YAAI,KAAK,EAAE,QAAQ,EAAE,YAAY,OAAO,YAAY,OAAO,aAAa,GAAG,SAAS,MAAM,cAAc,OAAO,SAAS,CAAC;AAAA,MAC3H;AACA,UAAI,KAAK,QAAQ;AACf,YAAI,KAAK;AAAA,UACP,QAAQ,EAAE,YAAY,KAAK,QAAQ,OAAO,KAAK,OAAO,MAAM;AAAA,UAC5D,SAAS,CAAC,EAAE,YAAY,KAAK,OAAO,MAAM,OAAO,aAAa,CAAC;AAAA,UAC/D,MAAM;AAAA,UACN,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,SAAS,OAAwB;AAC/B,UAAM,IAAI,SAAS,IAAI,SAAS;AAChC,QAAI,CAAC,OAAO;AACV,iBAAW,QAAQ,KAAK,MAAM,EAAG,GAAE,gBAAgB,KAAK,QAAQ,KAAK,SAAS,KAAK,MAAM,KAAK,KAAK;AAAA,IACrG;AACA,QAAI;AACF,QAAE,cAAc;AAAA,IAClB,SAAS,GAAG;AACV,UAAI,aAAa,qBAAsB,OAAM,IAAI,qBAAqB,EAAE,KAAK,IAAI,mBAAmB,CAAC;AACrG,YAAM;AAAA,IACR;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-ZR2YMODS.js → chunk-EKZ6VZYF.js}

@@ -1,6 +1,6 @@
 import {
   writePod
-} from "./chunk-PKJ43CMD.js";
+} from "./chunk-NLOLF6LD.js";
 
 // src/with-audit/portability/export-accessible.ts
 function resolveAccessibleCollections(keyring, scope, writableOnly = false) {
@@ -42,4 +42,4 @@ export {
   buildAccessibleBundle,
   exportAccessibleData
 };
-//# sourceMappingURL=chunk-ZR2YMODS.js.map
+//# sourceMappingURL=chunk-EKZ6VZYF.js.map

package/dist/{chunk-RTYJRFQO.js → chunk-EWPRPP3M.js}

@@ -435,4 +435,4 @@ export {
   demote,
   classifySealedShred
 };
-//# sourceMappingURL=chunk-RTYJRFQO.js.map
+//# sourceMappingURL=chunk-EWPRPP3M.js.map

package/dist/{chunk-VGICZPVE.js → chunk-FUJSIP4K.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-VYYM3MEN.js";
 import {
   derivePersistedSchema
-} from "./chunk-URHRIAV6.js";
+} from "./chunk-REDOOY2Q.js";
 import {
   loadPersistedSchema
 } from "./chunk-WWNYSV7S.js";
@@ -240,4 +240,4 @@ function summariseAggregateOp(value) {
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=chunk-VGICZPVE.js.map
+//# sourceMappingURL=chunk-FUJSIP4K.js.map

package/dist/{chunk-PKJ43CMD.js → chunk-NLOLF6LD.js}

@@ -812,7 +812,7 @@ async function applySatelliteLivenessFilter(vault, dumpJson) {
   if (!backup.collections || typeof backup.collections !== "object") return dumpJson;
   if (typeof vault._introspectState !== "function") return dumpJson;
   const { adapter, name, getDEK } = vault._introspectState();
-  const { liveBaseIdSetsForBundle } = await import("./dead-filter-M3NZUWBZ.js");
+  const { liveBaseIdSetsForBundle } = await import("./dead-filter-OMMVBAKZ.js");
   const satLive = await liveBaseIdSetsForBundle(adapter, name, Object.keys(backup.collections), getDEK);
   if (satLive.size === 0) return dumpJson;
   const next = {};
@@ -1059,4 +1059,4 @@ export {
   readPodRedirect,
   readPod
 };
-//# sourceMappingURL=chunk-PKJ43CMD.js.map
+//# sourceMappingURL=chunk-NLOLF6LD.js.map

package/dist/{chunk-SXCYYMVS.js → chunk-NOSRK3ZZ.js}

@@ -1,6 +1,6 @@
 import {
   walkClosure
-} from "./chunk-DJ3LNNZQ.js";
+} from "./chunk-3LK2XZCW.js";
 import {
   resolveManagedSecret
 } from "./chunk-JUBWUJY5.js";
@@ -8,7 +8,7 @@ import {
   parseExtractedPartitionBody,
   readPod,
   readPodHeader
-} from "./chunk-PKJ43CMD.js";
+} from "./chunk-NLOLF6LD.js";
 import {
   createOwnerKeyring,
   mintRosterTag,
@@ -41,7 +41,7 @@ import {
 function withCargo() {
   return {
     async extractPartition(vault, opts) {
-      const { extractPartitionCore } = await import("./extract-partition-RYJZIKQZ.js");
+      const { extractPartitionCore } = await import("./extract-partition-AZGSEMIF.js");
       return extractPartitionCore(vault, opts);
     }
   };
@@ -252,7 +252,7 @@ async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
     }
   }
   if (isManaged(opts)) {
-    const { createNoydb } = await import("./noydb-2C6QQJ5S.js");
+    const { createNoydb } = await import("./noydb-Y53CQHZK.js");
     const db = await createNoydb({
       store,
       user: userId,
@@ -307,4 +307,4 @@ export {
   withCargo,
   describeExtraction
 };
-//# sourceMappingURL=chunk-SXCYYMVS.js.map
+//# sourceMappingURL=chunk-NOSRK3ZZ.js.map

package/dist/{chunk-COTPDJR5.js → chunk-OMB2ZKIT.js}

@@ -294,31 +294,31 @@ function buildBlobFieldEntries(filenamesByField) {
 function withSearch() {
   return {
     async search(ctx, field, query, opts) {
-      const { search } = await import("./collection-facade-4ACKIDDY.js");
+      const { search } = await import("./collection-facade-VOWW732S.js");
       return search(ctx, field, query, opts);
     },
     async retrieve(ctx, query, opts) {
-      const { retrieve } = await import("./collection-facade-4ACKIDDY.js");
+      const { retrieve } = await import("./collection-facade-VOWW732S.js");
       return retrieve(ctx, query, opts);
     },
     async similarTo(ctx, vector, opts) {
-      const { similarTo } = await import("./collection-facade-4ACKIDDY.js");
+      const { similarTo } = await import("./collection-facade-VOWW732S.js");
       return similarTo(ctx, vector, opts);
     },
     async warmIndex(ctx) {
-      const { warmIndex } = await import("./collection-facade-4ACKIDDY.js");
+      const { warmIndex } = await import("./collection-facade-VOWW732S.js");
       return warmIndex(ctx);
     },
     async flushIndex(ctx) {
-      const { flushIndex } = await import("./collection-facade-4ACKIDDY.js");
+      const { flushIndex } = await import("./collection-facade-VOWW732S.js");
       return flushIndex(ctx);
     },
     async embedOnWrite(ctx, id, record, version) {
-      const { embedOnWrite } = await import("./collection-facade-4ACKIDDY.js");
+      const { embedOnWrite } = await import("./collection-facade-VOWW732S.js");
       return embedOnWrite(ctx, id, record, version);
     },
     async rebuildEmbeddings(ctx) {
-      const { rebuildEmbeddings } = await import("./collection-facade-4ACKIDDY.js");
+      const { rebuildEmbeddings } = await import("./collection-facade-VOWW732S.js");
       return rebuildEmbeddings(ctx);
     }
   };
@@ -364,4 +364,4 @@ export {
   buildBlobFieldEntries,
   withSearch
 };
-//# sourceMappingURL=chunk-COTPDJR5.js.map
+//# sourceMappingURL=chunk-OMB2ZKIT.js.map

package/dist/{chunk-Y4MJQ2UG.js → chunk-QQ2YMQZU.js}

@@ -16,7 +16,7 @@ function withCustody() {
       return host._revokeCustodianImpl(revoke, vault, options, factors);
     },
     async liberate(vault, opts) {
-      const { liberateVault } = await import("./liberate-4APIV7FR.js");
+      const { liberateVault } = await import("./liberate-AAZSP2BT.js");
       return liberateVault(vault, opts);
     }
   };
@@ -74,4 +74,4 @@ export {
   withCustody,
   CustodyApi
 };
-//# sourceMappingURL=chunk-Y4MJQ2UG.js.map
+//# sourceMappingURL=chunk-QQ2YMQZU.js.map

package/dist/{chunk-URHRIAV6.js → chunk-REDOOY2Q.js}

@@ -37,7 +37,7 @@ async function loadZodToJsonSchemaConverter() {
 }
 async function loadZodV4Converter() {
   try {
-    const mod = await import("./zod-HAJM7LMS.js");
+    const mod = await import("zod");
     if (typeof mod.toJSONSchema !== "function") {
       throw new Error("zod.toJSONSchema not available (zod v4 required)");
     }
@@ -79,4 +79,4 @@ export {
   isZod4Schema,
   derivePersistedSchema
 };
-//# sourceMappingURL=chunk-URHRIAV6.js.map
+//# sourceMappingURL=chunk-REDOOY2Q.js.map

package/dist/chunk-REDOOY2Q.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/persisted-schemas/derive.ts"],"sourcesContent":["/**\n * Derive a {@link PersistedSchemaEnvelope} from a Standard Schema v1\n * validator. Supports zod 3 (via the optional `zod-to-json-schema` peer-dep)\n * and zod 4 (via its native `z.toJSONSchema()`); both are loaded lazily so\n * hub never statically imports zod. Other validator families write a stub\n * envelope flagging the kind.\n *\n * @see design-history/2026-05-22-schema-dump-design.md\n *\n * @module\n */\n\nimport { canonicalize } from './canonicalize.js'\nimport { sha256Hex } from '../../kernel/enclave/index.js'\nimport type { PersistedSchemaEnvelope, PersistedSchemaKind } from './types.js'\n\n/**\n * Heuristic Zod detection — uses the Standard Schema v1 `~standard.vendor`\n * property (present in Zod v3.23+ and Zod v4+). Falls back to the\n * `_def.typeName` heuristic for older Zod v3 builds that predate Standard\n * Schema support.\n */\nexport function isZodSchema(value: unknown): boolean {\n  if (value === null || typeof value !== 'object') return false\n  // Standard Schema v1 vendor tag — most reliable across Zod majors\n  const std = (value as { '~standard'?: { vendor?: unknown } })['~standard']\n  if (std && typeof std === 'object' && (std as { vendor?: unknown }).vendor === 'zod') return true\n  // Zod v3 fallback: _def.typeName starts with 'Zod' (e.g. 'ZodObject')\n  const def = (value as { _def?: { typeName?: unknown } })._def\n  if (!def || typeof def !== 'object') return false\n  return typeof (def as { typeName?: unknown }).typeName === 'string'\n    && ((def as { typeName: string }).typeName).startsWith('Zod')\n}\n\nfunction detectKind(validator: unknown): PersistedSchemaKind {\n  if (isZodSchema(validator)) return 'Zod'\n  return 'Unknown'\n}\n\n/**\n * Returns `true` when the validator was created with the Zod v4 native API\n * (i.e. `import { z } from 'zod'` where zod resolves to v4). Zod v4 native\n * schemas carry a `_zod` property whereas Zod v3 schemas (and the v3-compat\n * shim shipped inside zod@4 at `zod/v3`) use `_def.typeName`.\n *\n * Kept duck-typed so hub never statically imports zod.\n */\nexport function isZod4Schema(value: unknown): boolean {\n  if (value === null || typeof value !== 'object') return false\n  return '_zod' in value\n}\n\n/**\n * Lazy-require `zod-to-json-schema`. Returns the converter, or throws a\n * clear error if the peer-dep isn't installed.\n */\nasync function loadZodToJsonSchemaConverter(): Promise<(s: unknown) => object> {\n  try {\n    const mod = (await import('zod-to-json-schema')) as { zodToJsonSchema?: (s: unknown) => object }\n    if (!mod.zodToJsonSchema) {\n      throw new Error('zod-to-json-schema export missing')\n    }\n    return mod.zodToJsonSchema\n  } catch (err) {\n    throw new Error(\n      'persistJsonSchema requires the optional peer-dep `zod-to-json-schema`. '\n      + 'Install it: `pnpm add zod-to-json-schema` (or npm/yarn equivalent). '\n      + `Original error: ${err instanceof Error ? err.message : String(err)}`,\n    )\n  }\n}\n\n/**\n * Lazy-require Zod v4's built-in `toJSONSchema`. Used when the validator is a\n * Zod v4 native schema and `zod-to-json-schema` is absent or cannot handle it.\n *\n * Dynamic so hub never loads zod unless a caller actually persists a Zod v4\n * schema. ⚠️ Dynamic is NOT what keeps zod out of the tarball — that is\n * `peerDependencies` (#1227). tsup externalises DECLARED dependencies and\n * BUNDLES everything else, static or dynamic alike, so while zod was a\n * devDependency only, this line silently vendored 548 KB of zod@4.4.3 into\n * `dist/` at a build-frozen version. The comment here previously claimed the\n * dynamic import was what prevented that; it never did.\n *\n * Declaring it an OPTIONAL peer is also the correctness fix, not just a size\n * one: `toJSONSchema` reads a schema's internals, and the schema is built by\n * the CONSUMER's zod. A vendored copy meant hub inspected one zod's objects\n * with another zod's version of that reader. Now there is one zod — theirs.\n */\nasync function loadZodV4Converter(): Promise<(s: unknown) => object> {\n  try {\n    const mod = (await import('zod')) as { toJSONSchema?: (s: unknown) => object }\n    if (typeof mod.toJSONSchema !== 'function') {\n      throw new Error('zod.toJSONSchema not available (zod v4 required)')\n    }\n    return mod.toJSONSchema\n  } catch (err) {\n    throw new Error(\n      'persistJsonSchema with a Zod v4 schema requires zod@4 with toJSONSchema. '\n      + `Original error: ${err instanceof Error ? err.message : String(err)}`,\n    )\n  }\n}\n\nexport async function derivePersistedSchema(\n  validator: unknown,\n): Promise<PersistedSchemaEnvelope> {\n  const kind = detectKind(validator)\n  const derivedAt = new Date().toISOString()\n\n  if (kind === 'Zod') {\n    let jsonSchema: object\n\n    if (isZod4Schema(validator)) {\n      // Zod v4 native schemas: use zod's built-in toJSONSchema (available in\n      // zod@4) because zod-to-json-schema@3.x parses _def.typeName which is\n      // absent in native v4 schemas.\n      const convert = await loadZodV4Converter()\n      jsonSchema = convert(validator)\n    } else {\n      // Zod v3 schemas (or v3-compat shim): use the optional peer-dep\n      // zod-to-json-schema for backward compatibility.\n      const convert = await loadZodToJsonSchemaConverter()\n      jsonSchema = convert(validator)\n    }\n\n    const canonical = canonicalize(jsonSchema)\n    const hash = await sha256Hex(new TextEncoder().encode(canonical))\n    return { _noydb_schema: 1, kind, jsonSchema, hash, derivedAt }\n  }\n\n  return {\n    _noydb_schema: 1,\n    kind,\n    jsonSchema: null,\n    hash: null,\n    reason: `derivation not yet supported for kind=${kind} (v0 supports Zod only)`,\n    derivedAt,\n  }\n}\n"],"mappings":";;;;;;;;AAsBO,SAAS,YAAY,OAAyB;AACnD,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AAExD,QAAM,MAAO,MAAiD,WAAW;AACzE,MAAI,OAAO,OAAO,QAAQ,YAAa,IAA6B,WAAW,MAAO,QAAO;AAE7F,QAAM,MAAO,MAA4C;AACzD,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,SAAO,OAAQ,IAA+B,aAAa,YACpD,IAA6B,SAAU,WAAW,KAAK;AAChE;AAEA,SAAS,WAAW,WAAyC;AAC3D,MAAI,YAAY,SAAS,EAAG,QAAO;AACnC,SAAO;AACT;AAUO,SAAS,aAAa,OAAyB;AACpD,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,SAAO,UAAU;AACnB;AAMA,eAAe,+BAAgE;AAC7E,MAAI;AACF,UAAM,MAAO,MAAM,OAAO,oBAAoB;AAC9C,QAAI,CAAC,IAAI,iBAAiB;AACxB,YAAM,IAAI,MAAM,mCAAmC;AAAA,IACrD;AACA,WAAO,IAAI;AAAA,EACb,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,kKAEqB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACvE;AAAA,EACF;AACF;AAmBA,eAAe,qBAAsD;AACnE,MAAI;AACF,UAAM,MAAO,MAAM,OAAO,KAAK;AAC/B,QAAI,OAAO,IAAI,iBAAiB,YAAY;AAC1C,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AACA,WAAO,IAAI;AAAA,EACb,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,4FACqB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACvE;AAAA,EACF;AACF;AAEA,eAAsB,sBACpB,WACkC;AAClC,QAAM,OAAO,WAAW,SAAS;AACjC,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AAEzC,MAAI,SAAS,OAAO;AAClB,QAAI;AAEJ,QAAI,aAAa,SAAS,GAAG;AAI3B,YAAM,UAAU,MAAM,mBAAmB;AACzC,mBAAa,QAAQ,SAAS;AAAA,IAChC,OAAO;AAGL,YAAM,UAAU,MAAM,6BAA6B;AACnD,mBAAa,QAAQ,SAAS;AAAA,IAChC;AAEA,UAAM,YAAY,aAAa,UAAU;AACzC,UAAM,OAAO,MAAM,UAAU,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAChE,WAAO,EAAE,eAAe,GAAG,MAAM,YAAY,MAAM,UAAU;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,eAAe;AAAA,IACf;AAAA,IACA,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,QAAQ,yCAAyC,IAAI;AAAA,IACrD;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-YCXICMOY.js → chunk-RJ7NN2UR.js}

@@ -1,6 +1,6 @@
 import {
   freezeSnapshotOnly
-} from "./chunk-QHW35ZON.js";
+} from "./chunk-TGPST6FK.js";
 import {
   resolveManagedSecret
 } from "./chunk-JUBWUJY5.js";
@@ -137,4 +137,4 @@ export {
   isDeedVault,
   liberateVault
 };
-//# sourceMappingURL=chunk-YCXICMOY.js.map
+//# sourceMappingURL=chunk-RJ7NN2UR.js.map

package/dist/{chunk-PDD75NUZ.js → chunk-SMH6SRX7.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-5D2ALSM5.js";
 
 // src/with-formula/derivations/stale.ts
-var loadDerivationExecutor = lazy(() => import("./executor-TOLPBHOC.js"));
+var loadDerivationExecutor = lazy(() => import("./executor-5NIMLSKZ.js"));
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 var keyFor = (source, sourceId) => `${source}/${sourceId}`;
 async function markStale(registry, strategy, sourceId) {
@@ -84,4 +84,4 @@ export {
   markStale,
   resolveStaleOnRead
 };
-//# sourceMappingURL=chunk-PDD75NUZ.js.map
+//# sourceMappingURL=chunk-SMH6SRX7.js.map

package/dist/{chunk-QHW35ZON.js → chunk-TGPST6FK.js}

@@ -1,7 +1,7 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-ZR2YMODS.js";
+} from "./chunk-EKZ6VZYF.js";
 import {
   buildRecordEnvelope
 } from "./chunk-4RUFYGWG.js";
@@ -117,4 +117,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-QHW35ZON.js.map
+//# sourceMappingURL=chunk-TGPST6FK.js.map

package/dist/{chunk-BMELYFHU.js → chunk-V2PNPF6J.js}

@@ -1,6 +1,6 @@
 import {
   createNoydb
-} from "./chunk-ZVCC36XQ.js";
+} from "./chunk-DRB6IHPS.js";
 import {
   deriveSchemaManifest
 } from "./chunk-BBWVXF57.js";
@@ -13,7 +13,7 @@ import {
   signRecord,
   verifyPodHeader,
   verifyRecord
-} from "./chunk-PKJ43CMD.js";
+} from "./chunk-NLOLF6LD.js";
 import {
   loadKeyring
 } from "./chunk-VNR2SNVJ.js";
@@ -286,4 +286,4 @@ export {
   followRedirects,
   open
 };
-//# sourceMappingURL=chunk-BMELYFHU.js.map
+//# sourceMappingURL=chunk-V2PNPF6J.js.map

package/dist/{chunk-BERJ4AWW.js → chunk-VGXZT72I.js}

@@ -124,7 +124,7 @@ function validatePeriodName(name, existing, partition) {
 }
 async function appendPeriodLedgerEntry(ledger, actor, envelope, name, collection = PERIODS_COLLECTION) {
   if (!ledger) return;
-  const { envelopePayloadHash } = await import("./ledger-HXHIOD36.js");
+  const { envelopePayloadHash } = await import("./ledger-454SU3VE.js");
   await ledger.append({
     op: "put",
     collection,
@@ -198,4 +198,4 @@ export {
   purgeMarkersOn,
   withPeriods
 };
-//# sourceMappingURL=chunk-BERJ4AWW.js.map
+//# sourceMappingURL=chunk-VGXZT72I.js.map

package/dist/{chunk-2Z47NMFK.js → chunk-WZW37ZHL.js}

@@ -17,7 +17,7 @@ import {
 } from "./chunk-GM4IM7TC.js";
 import {
   derivePersistedSchema
-} from "./chunk-URHRIAV6.js";
+} from "./chunk-REDOOY2Q.js";
 import {
   loadPersistedSchemaEntry,
   savePersistedSchema
@@ -257,4 +257,4 @@ export {
   persistClassifiedMarker,
   persistSatelliteMarker
 };
-//# sourceMappingURL=chunk-2Z47NMFK.js.map
+//# sourceMappingURL=chunk-WZW37ZHL.js.map

package/dist/classified/index.js

@@ -2,7 +2,7 @@ import {
   classified,
   luhnCheck,
   withClassified
-} from "../chunk-5FUULQ6F.js";
+} from "../chunk-2HVILGVR.js";
 import {
   ClassifiedNeverStoredError,
   ClassifiedValidationError,
@@ -20,7 +20,6 @@ import {
   ClassifiedRotationError,
   ClassifiedVerifyError
 } from "../chunk-7O3Y4PPD.js";
-import "../chunk-PZ5AY32C.js";
 export {
   ClassifiedConfigError,
   ClassifiedNeverStoredError,

package/dist/{classified-marker-67HBIJMZ.js → classified-marker-OO65UYXN.js}

@@ -1,5 +1,3 @@
-import "./chunk-PZ5AY32C.js";
-
 // src/via/classified/config-drift.ts
 function markerForFields(vdigFields) {
   if (vdigFields === null || vdigFields.size === 0) return null;
@@ -13,11 +11,11 @@ function markerForFields(vdigFields) {
 async function persistClassifiedMarkerForFields(store, vault, collectionName, vdigFields, dek) {
   const marker = markerForFields(vdigFields);
   if (marker === null) return;
-  const { persistClassifiedMarker } = await import("./register-AEOOGKNO.js");
+  const { persistClassifiedMarker } = await import("./register-7OJWAWT5.js");
   await persistClassifiedMarker({ store, vault, collectionName, dek, marker });
 }
 async function readClassifiedMarkerDigestOnly(store, vault, collectionName, dek) {
-  const { loadPersistedSchema } = await import("./storage-WP4M7IFO.js");
+  const { loadPersistedSchema } = await import("./storage-AVJA5BTW.js");
   const persisted = await loadPersistedSchema(store, vault, collectionName, dek);
   return persisted?.classified?.digestOnly ?? [];
 }
@@ -25,4 +23,4 @@ export {
   persistClassifiedMarkerForFields,
   readClassifiedMarkerDigestOnly
 };
-//# sourceMappingURL=classified-marker-67HBIJMZ.js.map
+//# sourceMappingURL=classified-marker-OO65UYXN.js.map

package/dist/{classified-marker-67HBIJMZ.js.map → classified-marker-OO65UYXN.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/via/classified/config-drift.ts"],"sourcesContent":["/**\n * C-A / R10 config-drift marker I/O — the store side of the guard, kept OUT of\n * the kernel `Collection` so the always-on kernel surface stays lean. The\n * kernel holds only the per-handle memoization; these helpers do the actual\n * persisted-schema read/write (via the persisted-schemas storage seam, lazily\n * imported so the classified spine tree-shakes).\n *\n * Marker semantics: a collection declaring classified digest-only fields writes\n * an `x-classified` marker into its `_schemas/<collection>` record on the first\n * classified write. A handle later opened WITHOUT `classifiedFields` (a naive\n * handle) reads it back and refuses to write — see RecordCodec.encryptRecord's\n * R10 guard.\n *\n * `dek` is typed as the bare `CryptoKey` global rather than `EnclaveKey`\n * (`kernel/enclave/crypto.ts`'s alias for the same type) — this file lives\n * under `via/classified/`, which the `via-enclave-isolation`\n * architecture guard (#629) forbids from importing `kernel/enclave/` at\n * all, even type-only.\n *\n * @module\n */\nimport type { NoydbStore, VdigFieldPolicy, ClassifiedMarker } from '../../kernel/types.js'\n\n/**\n * Build the marker for a handle's digest-only field map, or null when it\n * declares none. `epoch` (#597) is stamped fresh on every call, but only\n * ever lands in storage on a genuine first-write or a real reconfiguration —\n * `persistClassifiedMarker`'s equality check (register.ts) ignores epoch, so\n * an identical re-declare's freshly-stamped value is discarded as a no-op\n * and the already-persisted epoch is left untouched (stable per lifetime).\n */\nfunction markerForFields(vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null): ClassifiedMarker | null {\n  if (vdigFields === null || vdigFields.size === 0) return null\n  const digestOnly = [...vdigFields.keys()]\n  return {\n    digestOnly, equatable: digestOnly.filter((f) => vdigFields.get(f)?.equatable === true),\n    epoch: new Date().toISOString(),\n  }\n}\n\n/**\n * Persist the classified marker for a handle's digest-only fields. No-op when\n * the handle declares none. Idempotent (delegates to `persistClassifiedMarker`).\n */\nexport async function persistClassifiedMarkerForFields(\n  store: NoydbStore,\n  vault: string,\n  collectionName: string,\n  vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null,\n  dek: CryptoKey,\n): Promise<void> {\n  const marker = markerForFields(vdigFields)\n  if (marker === null) return\n  const { persistClassifiedMarker } = await import('../../with-shape/persisted-schemas/register.js')\n  await persistClassifiedMarker({ store, vault, collectionName, dek, marker })\n}\n\n/**\n * Read a collection's persisted classified marker's declared digest-only field\n * set (empty when the collection carries no marker). Cross-session drift signal:\n * the R10 superset guard refuses a handle whose declared classified set does not\n * cover every field in this set.\n */\nexport async function readClassifiedMarkerDigestOnly(\n  store: NoydbStore,\n  vault: string,\n  collectionName: string,\n  dek: CryptoKey,\n): Promise<readonly string[]> {\n  const { loadPersistedSchema } = await import('../../with-shape/persisted-schemas/storage.js')\n  const persisted = await loadPersistedSchema(store, vault, collectionName, dek)\n  return persisted?.classified?.digestOnly ?? []\n}\n"],"mappings":";;;AA+BA,SAAS,gBAAgB,YAAkF;AACzG,MAAI,eAAe,QAAQ,WAAW,SAAS,EAAG,QAAO;AACzD,QAAM,aAAa,CAAC,GAAG,WAAW,KAAK,CAAC;AACxC,SAAO;AAAA,IACL;AAAA,IAAY,WAAW,WAAW,OAAO,CAAC,MAAM,WAAW,IAAI,CAAC,GAAG,cAAc,IAAI;AAAA,IACrF,QAAO,oBAAI,KAAK,GAAE,YAAY;AAAA,EAChC;AACF;AAMA,eAAsB,iCACpB,OACA,OACA,gBACA,YACA,KACe;AACf,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,WAAW,KAAM;AACrB,QAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,wBAAgD;AACjG,QAAM,wBAAwB,EAAE,OAAO,OAAO,gBAAgB,KAAK,OAAO,CAAC;AAC7E;AAQA,eAAsB,+BACpB,OACA,OACA,gBACA,KAC4B;AAC5B,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAA+C;AAC5F,QAAM,YAAY,MAAM,oBAAoB,OAAO,OAAO,gBAAgB,GAAG;AAC7E,SAAO,WAAW,YAAY,cAAc,CAAC;AAC/C;","names":[]}
+{"version":3,"sources":["../src/via/classified/config-drift.ts"],"sourcesContent":["/**\n * C-A / R10 config-drift marker I/O — the store side of the guard, kept OUT of\n * the kernel `Collection` so the always-on kernel surface stays lean. The\n * kernel holds only the per-handle memoization; these helpers do the actual\n * persisted-schema read/write (via the persisted-schemas storage seam, lazily\n * imported so the classified spine tree-shakes).\n *\n * Marker semantics: a collection declaring classified digest-only fields writes\n * an `x-classified` marker into its `_schemas/<collection>` record on the first\n * classified write. A handle later opened WITHOUT `classifiedFields` (a naive\n * handle) reads it back and refuses to write — see RecordCodec.encryptRecord's\n * R10 guard.\n *\n * `dek` is typed as the bare `CryptoKey` global rather than `EnclaveKey`\n * (`kernel/enclave/crypto.ts`'s alias for the same type) — this file lives\n * under `via/classified/`, which the `via-enclave-isolation`\n * architecture guard (#629) forbids from importing `kernel/enclave/` at\n * all, even type-only.\n *\n * @module\n */\nimport type { NoydbStore, VdigFieldPolicy, ClassifiedMarker } from '../../kernel/types.js'\n\n/**\n * Build the marker for a handle's digest-only field map, or null when it\n * declares none. `epoch` (#597) is stamped fresh on every call, but only\n * ever lands in storage on a genuine first-write or a real reconfiguration —\n * `persistClassifiedMarker`'s equality check (register.ts) ignores epoch, so\n * an identical re-declare's freshly-stamped value is discarded as a no-op\n * and the already-persisted epoch is left untouched (stable per lifetime).\n */\nfunction markerForFields(vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null): ClassifiedMarker | null {\n  if (vdigFields === null || vdigFields.size === 0) return null\n  const digestOnly = [...vdigFields.keys()]\n  return {\n    digestOnly, equatable: digestOnly.filter((f) => vdigFields.get(f)?.equatable === true),\n    epoch: new Date().toISOString(),\n  }\n}\n\n/**\n * Persist the classified marker for a handle's digest-only fields. No-op when\n * the handle declares none. Idempotent (delegates to `persistClassifiedMarker`).\n */\nexport async function persistClassifiedMarkerForFields(\n  store: NoydbStore,\n  vault: string,\n  collectionName: string,\n  vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null,\n  dek: CryptoKey,\n): Promise<void> {\n  const marker = markerForFields(vdigFields)\n  if (marker === null) return\n  const { persistClassifiedMarker } = await import('../../with-shape/persisted-schemas/register.js')\n  await persistClassifiedMarker({ store, vault, collectionName, dek, marker })\n}\n\n/**\n * Read a collection's persisted classified marker's declared digest-only field\n * set (empty when the collection carries no marker). Cross-session drift signal:\n * the R10 superset guard refuses a handle whose declared classified set does not\n * cover every field in this set.\n */\nexport async function readClassifiedMarkerDigestOnly(\n  store: NoydbStore,\n  vault: string,\n  collectionName: string,\n  dek: CryptoKey,\n): Promise<readonly string[]> {\n  const { loadPersistedSchema } = await import('../../with-shape/persisted-schemas/storage.js')\n  const persisted = await loadPersistedSchema(store, vault, collectionName, dek)\n  return persisted?.classified?.digestOnly ?? []\n}\n"],"mappings":";AA+BA,SAAS,gBAAgB,YAAkF;AACzG,MAAI,eAAe,QAAQ,WAAW,SAAS,EAAG,QAAO;AACzD,QAAM,aAAa,CAAC,GAAG,WAAW,KAAK,CAAC;AACxC,SAAO;AAAA,IACL;AAAA,IAAY,WAAW,WAAW,OAAO,CAAC,MAAM,WAAW,IAAI,CAAC,GAAG,cAAc,IAAI;AAAA,IACrF,QAAO,oBAAI,KAAK,GAAE,YAAY;AAAA,EAChC;AACF;AAMA,eAAsB,iCACpB,OACA,OACA,gBACA,YACA,KACe;AACf,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,WAAW,KAAM;AACrB,QAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,wBAAgD;AACjG,QAAM,wBAAwB,EAAE,OAAO,OAAO,gBAAgB,KAAK,OAAO,CAAC;AAC7E;AAQA,eAAsB,+BACpB,OACA,OACA,gBACA,KAC4B;AAC5B,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAA+C;AAC5F,QAAM,YAAY,MAAM,oBAAoB,OAAO,OAAO,gBAAgB,GAAG;AAC7E,SAAO,WAAW,YAAY,cAAc,CAAC;AAC/C;","names":[]}

package/dist/{collection-facade-4ACKIDDY.js → collection-facade-VOWW732S.js}

@@ -10,9 +10,9 @@ import {
   similarTo,
   syncTierSearch,
   warmIndex
-} from "./chunk-IHFXR2VQ.js";
+} from "./chunk-BOBFL5TW.js";
 import "./chunk-RTBJ5IOO.js";
-import "./chunk-COTPDJR5.js";
+import "./chunk-OMB2ZKIT.js";
 import "./chunk-AURFOK3D.js";
 import "./chunk-MVMXZYXT.js";
 import "./chunk-RDZZHYMV.js";
@@ -29,7 +29,6 @@ import "./chunk-LP7BEXCT.js";
 import "./chunk-SL3JAAKN.js";
 import "./chunk-N4CHCXDL.js";
 import "./chunk-7O3Y4PPD.js";
-import "./chunk-PZ5AY32C.js";
 export {
   buildPersistedIndexCallbacks,
   buildRetrievalDocs,
@@ -43,4 +42,4 @@ export {
   syncTierSearch,
   warmIndex
 };
-//# sourceMappingURL=collection-facade-4ACKIDDY.js.map
+//# sourceMappingURL=collection-facade-VOWW732S.js.map

package/dist/{computed-LSEZYRJS.js → computed-VPOKQK4N.js}

@@ -3,9 +3,8 @@ import {
   evalComputedFields
 } from "./chunk-LWBCUYZW.js";
 import "./chunk-7O3Y4PPD.js";
-import "./chunk-PZ5AY32C.js";
 export {
   ComputedFieldError,
   evalComputedFields
 };
-//# sourceMappingURL=computed-LSEZYRJS.js.map
+//# sourceMappingURL=computed-VPOKQK4N.js.map

package/dist/consent/index.js

@@ -16,7 +16,6 @@ import "../chunk-LP7BEXCT.js";
 import "../chunk-SL3JAAKN.js";
 import "../chunk-N4CHCXDL.js";
 import "../chunk-7O3Y4PPD.js";
-import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/consent/active.ts
 function withConsent() {

package/dist/consent/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/consent/active.ts"],"sourcesContent":["/**\n * Active consent strategy. Calling `withConsent()` returns a\n * `ConsentStrategy` that delegates to the real\n * `writeConsentEntry` / `loadConsentEntries` functions. Only\n * reachable through the `@noy-db/hub/consent` subpath.\n */\n\nimport { writeConsentEntry, loadConsentEntries } from './consent.js'\nimport type { ConsentStrategy } from './strategy.js'\n\n/**\n * Build the default consent strategy. Pass into\n * `createNoydb({ consentStrategy: withConsent() })` to enable\n * per-operation audit writes into the reserved `_consent_audit`\n * collection.\n */\nexport function withConsent(): ConsentStrategy {\n  return {\n    write: writeConsentEntry,\n    read: loadConsentEntries,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAgBO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-audit/consent/active.ts"],"sourcesContent":["/**\n * Active consent strategy. Calling `withConsent()` returns a\n * `ConsentStrategy` that delegates to the real\n * `writeConsentEntry` / `loadConsentEntries` functions. Only\n * reachable through the `@noy-db/hub/consent` subpath.\n */\n\nimport { writeConsentEntry, loadConsentEntries } from './consent.js'\nimport type { ConsentStrategy } from './strategy.js'\n\n/**\n * Build the default consent strategy. Pass into\n * `createNoydb({ consentStrategy: withConsent() })` to enable\n * per-operation audit writes into the reserved `_consent_audit`\n * collection.\n */\nexport function withConsent(): ConsentStrategy {\n  return {\n    write: writeConsentEntry,\n    read: loadConsentEntries,\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgBO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AACF;","names":[]}

package/dist/cover/index.js

@@ -24,7 +24,6 @@ import "../chunk-LP7BEXCT.js";
 import "../chunk-SL3JAAKN.js";
 import "../chunk-N4CHCXDL.js";
 import "../chunk-7O3Y4PPD.js";
-import "../chunk-PZ5AY32C.js";
 export {
   COVER_FIELDS,
   COVER_RECORD_ID,

package/dist/crdt/index.js

@@ -7,7 +7,6 @@ import {
 import {
   NO_CRDT
 } from "../chunk-PVEWA2DU.js";
-import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/crdt/active.ts
 function withCrdt() {

package/dist/crdt/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-commit/crdt/active.ts"],"sourcesContent":["/**\n * Active CRDT strategy factory. Calling `withCrdt()` returns a\n * `CrdtStrategy` whose methods delegate to the real LWW-Map / RGA /\n * merge / snapshot helpers in `./crdt.ts`. Only reachable through\n * the `@noy-db/hub/crdt` subpath.\n */\n\nimport {\n  buildLwwMapState,\n  buildRgaState,\n  mergeCrdtStates,\n  resolveCrdtSnapshot,\n} from './crdt.js'\nimport type { CrdtStrategy } from './strategy.js'\n\n/**\n * Build the default CRDT strategy. Pass into\n * `createNoydb({ crdtStrategy: withCrdt() })` to enable collections\n * declared with `crdt: 'lww-map' | 'rga' | 'yjs'`.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withCrdt } from '@noy-db/hub/crdt'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   crdtStrategy: withCrdt(),\n * })\n * const notes = vault.collection('notes', { crdt: 'lww-map' })\n * ```\n */\nexport function withCrdt(): CrdtStrategy {\n  return {\n    buildLwwMapState,\n    buildRgaState,\n    mergeCrdtStates,\n    resolveCrdtSnapshot,\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAgCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-commit/crdt/active.ts"],"sourcesContent":["/**\n * Active CRDT strategy factory. Calling `withCrdt()` returns a\n * `CrdtStrategy` whose methods delegate to the real LWW-Map / RGA /\n * merge / snapshot helpers in `./crdt.ts`. Only reachable through\n * the `@noy-db/hub/crdt` subpath.\n */\n\nimport {\n  buildLwwMapState,\n  buildRgaState,\n  mergeCrdtStates,\n  resolveCrdtSnapshot,\n} from './crdt.js'\nimport type { CrdtStrategy } from './strategy.js'\n\n/**\n * Build the default CRDT strategy. Pass into\n * `createNoydb({ crdtStrategy: withCrdt() })` to enable collections\n * declared with `crdt: 'lww-map' | 'rga' | 'yjs'`.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withCrdt } from '@noy-db/hub/crdt'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   crdtStrategy: withCrdt(),\n * })\n * const notes = vault.collection('notes', { crdt: 'lww-map' })\n * ```\n */\nexport function withCrdt(): CrdtStrategy {\n  return {\n    buildLwwMapState,\n    buildRgaState,\n    mergeCrdtStates,\n    resolveCrdtSnapshot,\n  }\n}\n"],"mappings":";;;;;;;;;;;AAgCO,SAAS,WAAyB;AACvC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/custody/index.js

@@ -2,7 +2,7 @@ import {
   CustodyApi,
   NO_CUSTODY,
   withCustody
-} from "../chunk-Y4MJQ2UG.js";
+} from "../chunk-QQ2YMQZU.js";
 import "../chunk-VNR2SNVJ.js";
 import "../chunk-YQWBEJCS.js";
 import "../chunk-JMGDHKQF.js";
@@ -17,7 +17,6 @@ import "../chunk-N4CHCXDL.js";
 import {
   CustodyNotEnabledError
 } from "../chunk-7O3Y4PPD.js";
-import "../chunk-PZ5AY32C.js";
 export {
   CustodyApi,
   CustodyNotEnabledError,

package/dist/{dead-filter-M3NZUWBZ.js → dead-filter-OMMVBAKZ.js}

@@ -1,11 +1,10 @@
 import {
   liveBaseIdSet
 } from "./chunk-GYGLAVCX.js";
-import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/satellites/dead-filter.ts
 async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK) {
-  const { loadPersistedSchema } = await import("./storage-WP4M7IFO.js");
+  const { loadPersistedSchema } = await import("./storage-AVJA5BTW.js");
   const out = /* @__PURE__ */ new Map();
   for (const name of collectionNames) {
     if (name.startsWith("_")) continue;
@@ -25,4 +24,4 @@ async function liveBaseIdSetsForBundle(store, vaultName, collectionNames, getDEK
 export {
   liveBaseIdSetsForBundle
 };
-//# sourceMappingURL=dead-filter-M3NZUWBZ.js.map
+//# sourceMappingURL=dead-filter-OMMVBAKZ.js.map

package/dist/{dead-filter-M3NZUWBZ.js.map → dead-filter-OMMVBAKZ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-shape/satellites/dead-filter.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { liveBaseIdSet } from './existence.js'\n\n/**\n * Build a live-base id set for every satellite collection detectable from\n * its persisted `_schemas/<name>` pairing marker (#591 Task 10).\n *\n * The bundle-export path (`with-pod/bundle.ts`) has no reachable\n * `SatelliteRegistry` — that registry is private to `Vault` and adding an\n * accessor would grow a kernel file past its line-ceiling ratchet. The\n * marker persisted by `ensureSatelliteMarker` (`_schemas/<satellite>`,\n * decrypted with the satellite collection's own DEK — see\n * `with-shape/persisted-schemas/storage.ts`) is the fallback pairing-info\n * source that's always reachable from just a raw store + a per-collection\n * DEK accessor, so export uses that instead of the in-memory registry.\n *\n * Returns a `Map` from satellite collection name to its base's live id set\n * (existence.ts rule 1: absent or tombstoned base ⇒ not live). Only\n * satellite collections are present as keys — callers should treat a\n * missing key as \"not a satellite, don't filter.\"\n */\nexport async function liveBaseIdSetsForBundle(\n  store: NoydbStore,\n  vaultName: string,\n  collectionNames: readonly string[],\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n): Promise<Map<string, Set<string>>> {\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const out = new Map<string, Set<string>>()\n  for (const name of collectionNames) {\n    if (name.startsWith('_')) continue\n    // SILENT-DEGRADE surface (deliberate asymmetry): on ANY marker-read\n    // failure the collection is treated as non-satellite and exported\n    // UNFILTERED. That covers, precisely:\n    //   (a) `getDEK(name)` throwing for any reason (caught below);\n    //   (b) the persisted `_schemas/<name>` record failing to decrypt or\n    //       parse — corruption, wrong DEK, transient store error —\n    //       `loadPersistedSchema` catches internally and returns\n    //       `undefined` (storage.ts), which reads here as \"no marker\";\n    //   (c) the marker not yet persisted — `declareSatellite`'s\n    //       `postRegister` is fire-and-forget, so an export racing a\n    //       fresh declaration can miss it.\n    // Leak-on-error is chosen over exclude-on-error because this is a\n    // BACKUP path: exporting stale dead-satellite ciphertext is\n    // recoverable; silently dropping live records from a backup is the\n    // strictly worse failure. Pinned by the \"leak-on-error posture\" tests\n    // in satellites-bundle-filter.test.ts.\n    let dek: EnclaveKey\n    try {\n      dek = await getDEK(name)\n    } catch {\n      continue // (a) no DEK reachable — can't read the marker, export unfiltered\n    }\n    const persisted = await loadPersistedSchema(store, vaultName, name, dek)\n    const marker = persisted?.satellite\n    if (!marker) continue // (b)/(c) — undecryptable/absent/markerless schema record, export unfiltered\n    out.set(name, await liveBaseIdSet(store, vaultName, marker.base))\n  }\n  return out\n}\n"],"mappings":";;;;;;AAsBA,eAAsB,wBACpB,OACA,WACA,iBACA,QACmC;AACnC,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,MAAM,oBAAI,IAAyB;AACzC,aAAW,QAAQ,iBAAiB;AAClC,QAAI,KAAK,WAAW,GAAG,EAAG;AAiB1B,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,OAAO,IAAI;AAAA,IACzB,QAAQ;AACN;AAAA,IACF;AACA,UAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,MAAM,GAAG;AACvE,UAAM,SAAS,WAAW;AAC1B,QAAI,CAAC,OAAQ;AACb,QAAI,IAAI,MAAM,MAAM,cAAc,OAAO,WAAW,OAAO,IAAI,CAAC;AAAA,EAClE;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/with-shape/satellites/dead-filter.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { liveBaseIdSet } from './existence.js'\n\n/**\n * Build a live-base id set for every satellite collection detectable from\n * its persisted `_schemas/<name>` pairing marker (#591 Task 10).\n *\n * The bundle-export path (`with-pod/bundle.ts`) has no reachable\n * `SatelliteRegistry` — that registry is private to `Vault` and adding an\n * accessor would grow a kernel file past its line-ceiling ratchet. The\n * marker persisted by `ensureSatelliteMarker` (`_schemas/<satellite>`,\n * decrypted with the satellite collection's own DEK — see\n * `with-shape/persisted-schemas/storage.ts`) is the fallback pairing-info\n * source that's always reachable from just a raw store + a per-collection\n * DEK accessor, so export uses that instead of the in-memory registry.\n *\n * Returns a `Map` from satellite collection name to its base's live id set\n * (existence.ts rule 1: absent or tombstoned base ⇒ not live). Only\n * satellite collections are present as keys — callers should treat a\n * missing key as \"not a satellite, don't filter.\"\n */\nexport async function liveBaseIdSetsForBundle(\n  store: NoydbStore,\n  vaultName: string,\n  collectionNames: readonly string[],\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n): Promise<Map<string, Set<string>>> {\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const out = new Map<string, Set<string>>()\n  for (const name of collectionNames) {\n    if (name.startsWith('_')) continue\n    // SILENT-DEGRADE surface (deliberate asymmetry): on ANY marker-read\n    // failure the collection is treated as non-satellite and exported\n    // UNFILTERED. That covers, precisely:\n    //   (a) `getDEK(name)` throwing for any reason (caught below);\n    //   (b) the persisted `_schemas/<name>` record failing to decrypt or\n    //       parse — corruption, wrong DEK, transient store error —\n    //       `loadPersistedSchema` catches internally and returns\n    //       `undefined` (storage.ts), which reads here as \"no marker\";\n    //   (c) the marker not yet persisted — `declareSatellite`'s\n    //       `postRegister` is fire-and-forget, so an export racing a\n    //       fresh declaration can miss it.\n    // Leak-on-error is chosen over exclude-on-error because this is a\n    // BACKUP path: exporting stale dead-satellite ciphertext is\n    // recoverable; silently dropping live records from a backup is the\n    // strictly worse failure. Pinned by the \"leak-on-error posture\" tests\n    // in satellites-bundle-filter.test.ts.\n    let dek: EnclaveKey\n    try {\n      dek = await getDEK(name)\n    } catch {\n      continue // (a) no DEK reachable — can't read the marker, export unfiltered\n    }\n    const persisted = await loadPersistedSchema(store, vaultName, name, dek)\n    const marker = persisted?.satellite\n    if (!marker) continue // (b)/(c) — undecryptable/absent/markerless schema record, export unfiltered\n    out.set(name, await liveBaseIdSet(store, vaultName, marker.base))\n  }\n  return out\n}\n"],"mappings":";;;;;AAsBA,eAAsB,wBACpB,OACA,WACA,iBACA,QACmC;AACnC,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,MAAM,oBAAI,IAAyB;AACzC,aAAW,QAAQ,iBAAiB;AAClC,QAAI,KAAK,WAAW,GAAG,EAAG;AAiB1B,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,OAAO,IAAI;AAAA,IACzB,QAAQ;AACN;AAAA,IACF;AACA,UAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,MAAM,GAAG;AACvE,UAAM,SAAS,WAAW;AAC1B,QAAI,CAAC,OAAQ;AACb,QAAI,IAAI,MAAM,MAAM,cAAc,OAAO,WAAW,OAAO,IAAI,CAAC;AAAA,EAClE;AACA,SAAO;AACT;","names":[]}

package/dist/debug/index.js

@@ -2,7 +2,6 @@ import {
   DebugPlaintextError,
   DebugReservedFieldError
 } from "../chunk-7O3Y4PPD.js";
-import "../chunk-PZ5AY32C.js";
 
 // src/kernel/debug.ts
 function readPlaintextRecord(envelope) {

package/dist/debug/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/kernel/debug.ts"],"sourcesContent":["/**\n * Helpers for reading records out of a *plaintext* store (`encrypt: false`)\n * with native tooling — the programmatic core of a `noydb cat`-style unwrap.\n * See the plaintext/debug-store-mode design.\n */\nimport type { EncryptedEnvelope } from './types.js'\n\n/**\n * The option's two failure modes, re-exported here so a consumer can `catch`\n * them by identity (#914). Both are thrown from the kernel — `createNoydb`\n * raises `DebugPlaintextError` when `debugPlaintext` is combined with\n * encryption, and the record codec raises `DebugReservedFieldError` for a\n * field colliding with the `_`-prefixed metadata. This entry is the only one\n * that publishes them.\n */\nexport { DebugPlaintextError, DebugReservedFieldError } from './errors.js'\n\n/** Re-exported so `readPlaintextRecord`'s parameter is nameable from this entry. */\nexport type { EncryptedEnvelope } from './types.js'\n\n/**\n * Extract the record from a plaintext stored envelope, handling both layouts:\n *\n *   - **classic plaintext** (`encrypt: false`): the record is JSON in `_data`.\n *   - **debugPlaintext**: the record's fields are inlined beside the\n *     `_`-prefixed metadata (marked by `_debug`).\n *\n * Returns `null` for an empty/absent body. Throws if handed an **encrypted**\n * envelope (non-empty `_iv`) — there is no key here; decrypt through the vault\n * instead. Intended for record envelopes, not blob chunks.\n *\n * @example\n * ```ts\n * // node script over a to-file store, no vault needed:\n * const env = JSON.parse(readFileSync('data/acme/invoices/inv-1.json', 'utf8'))\n * console.log(readPlaintextRecord(env)) // → { id: 'inv-1', total: '120.00', … }\n * ```\n */\nexport function readPlaintextRecord<T = Record<string, unknown>>(\n  envelope: EncryptedEnvelope,\n): T | null {\n  if (envelope._iv !== '') {\n    throw new Error(\n      'readPlaintextRecord: envelope is encrypted (non-empty _iv) — decrypt via the vault, not this helper',\n    )\n  }\n  if (envelope._debug !== undefined) {\n    const record: Record<string, unknown> = {}\n    for (const [key, value] of Object.entries(envelope)) {\n      if (!key.startsWith('_')) record[key] = value\n    }\n    return record as T\n  }\n  if (!envelope._data) return null\n  return JSON.parse(envelope._data) as T\n}\n"],"mappings":";;;;;;;AAsCO,SAAS,oBACd,UACU;AACV,MAAI,SAAS,QAAQ,IAAI;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,WAAW,QAAW;AACjC,UAAM,SAAkC,CAAC;AACzC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,UAAI,CAAC,IAAI,WAAW,GAAG,EAAG,QAAO,GAAG,IAAI;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,MAAO,QAAO;AAC5B,SAAO,KAAK,MAAM,SAAS,KAAK;AAClC;","names":[]}
+{"version":3,"sources":["../../src/kernel/debug.ts"],"sourcesContent":["/**\n * Helpers for reading records out of a *plaintext* store (`encrypt: false`)\n * with native tooling — the programmatic core of a `noydb cat`-style unwrap.\n * See the plaintext/debug-store-mode design.\n */\nimport type { EncryptedEnvelope } from './types.js'\n\n/**\n * The option's two failure modes, re-exported here so a consumer can `catch`\n * them by identity (#914). Both are thrown from the kernel — `createNoydb`\n * raises `DebugPlaintextError` when `debugPlaintext` is combined with\n * encryption, and the record codec raises `DebugReservedFieldError` for a\n * field colliding with the `_`-prefixed metadata. This entry is the only one\n * that publishes them.\n */\nexport { DebugPlaintextError, DebugReservedFieldError } from './errors.js'\n\n/** Re-exported so `readPlaintextRecord`'s parameter is nameable from this entry. */\nexport type { EncryptedEnvelope } from './types.js'\n\n/**\n * Extract the record from a plaintext stored envelope, handling both layouts:\n *\n *   - **classic plaintext** (`encrypt: false`): the record is JSON in `_data`.\n *   - **debugPlaintext**: the record's fields are inlined beside the\n *     `_`-prefixed metadata (marked by `_debug`).\n *\n * Returns `null` for an empty/absent body. Throws if handed an **encrypted**\n * envelope (non-empty `_iv`) — there is no key here; decrypt through the vault\n * instead. Intended for record envelopes, not blob chunks.\n *\n * @example\n * ```ts\n * // node script over a to-file store, no vault needed:\n * const env = JSON.parse(readFileSync('data/acme/invoices/inv-1.json', 'utf8'))\n * console.log(readPlaintextRecord(env)) // → { id: 'inv-1', total: '120.00', … }\n * ```\n */\nexport function readPlaintextRecord<T = Record<string, unknown>>(\n  envelope: EncryptedEnvelope,\n): T | null {\n  if (envelope._iv !== '') {\n    throw new Error(\n      'readPlaintextRecord: envelope is encrypted (non-empty _iv) — decrypt via the vault, not this helper',\n    )\n  }\n  if (envelope._debug !== undefined) {\n    const record: Record<string, unknown> = {}\n    for (const [key, value] of Object.entries(envelope)) {\n      if (!key.startsWith('_')) record[key] = value\n    }\n    return record as T\n  }\n  if (!envelope._data) return null\n  return JSON.parse(envelope._data) as T\n}\n"],"mappings":";;;;;;AAsCO,SAAS,oBACd,UACU;AACV,MAAI,SAAS,QAAQ,IAAI;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,WAAW,QAAW;AACjC,UAAM,SAAkC,CAAC;AACzC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,UAAI,CAAC,IAAI,WAAW,GAAG,EAAG,QAAO,GAAG,IAAI;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,MAAO,QAAO;AAC5B,SAAO,KAAK,MAAM,SAAS,KAAK;AAClC;","names":[]}

package/dist/{delegation-OLJUWTVA.js → delegation-VRYMQRCF.js}

@@ -25,7 +25,6 @@ import "./chunk-N4CHCXDL.js";
 import {
   DelegationTargetMissingError
 } from "./chunk-7O3Y4PPD.js";
-import "./chunk-PZ5AY32C.js";
 
 // src/with-party/team/delegation.ts
 var DELEGATIONS_COLLECTION = "_delegations";
@@ -103,4 +102,4 @@ export {
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=delegation-OLJUWTVA.js.map
+//# sourceMappingURL=delegation-VRYMQRCF.js.map