@noy-db/hub 0.7.0-pre.8 → 0.7.0

package/dist/chunk-2C3AQB46.js

@@ -0,0 +1,1652 @@
+import {
+  VectorSet
+} from "./chunk-RTBJ5IOO.js";
+import {
+  guardClassifiedCompat,
+  resolveClassifiedFields
+} from "./chunk-5VCRVKOZ.js";
+import {
+  jsonSchemaToFields
+} from "./chunk-VYYM3MEN.js";
+import {
+  derivePersistedSchema,
+  isZod4Schema
+} from "./chunk-REDOOY2Q.js";
+import {
+  loadPersistedSchema
+} from "./chunk-2Y4IMKA6.js";
+import {
+  buildPresentForJoin,
+  isLookupDescriptor
+} from "./chunk-U4FOQDY4.js";
+import {
+  Lru
+} from "./chunk-V4PXLYWM.js";
+import {
+  isDictKeyDescriptor,
+  isI18nTextDescriptor,
+  isStaticDictDescriptor
+} from "./chunk-TRGTKX5E.js";
+import {
+  viaBinder
+} from "./chunk-UXVWEX5L.js";
+import {
+  ClassifiedConfigError,
+  DerivationCycleError,
+  FieldNotQueryableError,
+  MaterializedViewCycleError,
+  UnsupportedTierCompositionError,
+  ValidationError
+} from "./chunk-7O3Y4PPD.js";
+
+// src/with-shape/introspection/field-meta.ts
+var FieldMetaUnknownFieldError = class extends Error {
+  constructor(collection, key) {
+    super(`fieldMeta for collection "${collection}" references unknown field "${key}". Declare it in the schema/config or remove the fieldMeta entry.`);
+    this.collection = collection;
+    this.key = key;
+    this.name = "FieldMetaUnknownFieldError";
+  }
+  collection;
+  key;
+};
+function validateFieldMetaKeys(collection, fieldMeta, knownFields) {
+  for (const key of Object.keys(fieldMeta)) {
+    if (!knownFields.has(key)) throw new FieldMetaUnknownFieldError(collection, key);
+  }
+}
+function humanizeFieldKey(key) {
+  return key.replace(/[_-]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").trim().split(/\s+/).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+}
+function resolveFieldMeta(key, inputs) {
+  const { channel, zodMeta, inferred } = inputs;
+  const pick = (k) => channel?.[k] ?? zodMeta?.[k] ?? inferred?.[k];
+  const description = pick("description");
+  const semanticType = pick("semanticType");
+  const unit = pick("unit");
+  const sensitivity = pick("sensitivity");
+  const aggregate = pick("aggregate");
+  const aliases = pick("aliases");
+  const displayFor = pick("displayFor");
+  const widget = pick("widget");
+  const group = pick("group");
+  const order = pick("order");
+  return {
+    label: pick("label") ?? humanizeFieldKey(key),
+    ...description !== void 0 ? { description } : {},
+    ...semanticType !== void 0 ? { semanticType } : {},
+    ...unit !== void 0 ? { unit } : {},
+    ...sensitivity !== void 0 ? { sensitivity } : {},
+    ...aggregate !== void 0 ? { aggregate } : {},
+    ...aliases !== void 0 ? { aliases } : {},
+    ...displayFor !== void 0 ? { displayFor } : {},
+    ...widget !== void 0 ? { widget } : {},
+    ...group !== void 0 ? { group } : {},
+    ...order !== void 0 ? { order } : {}
+  };
+}
+function schemaFieldKeys(schema) {
+  let s = schema;
+  for (let depth = 0; depth < 10; depth++) {
+    if (s === null || typeof s !== "object") return void 0;
+    const shape = s.shape;
+    if (shape !== null && typeof shape === "object") {
+      const keys = Object.keys(shape);
+      return keys.length > 0 ? keys : void 0;
+    }
+    const def = s._def;
+    const effect = def?.effect?.type;
+    if (def?.schema !== void 0 && (effect === "refinement" || effect === "preprocess")) {
+      s = def.schema;
+      continue;
+    }
+    if (def?.out !== void 0) {
+      s = def.out;
+      continue;
+    }
+    return void 0;
+  }
+  return void 0;
+}
+function validateFieldMetaAtRegistration(input) {
+  if (input.fieldMeta === void 0) return;
+  const validatorKeys = schemaFieldKeys(input.schema);
+  if (validatorKeys === void 0) return;
+  validateFieldMetaKeys(
+    input.collection,
+    input.fieldMeta,
+    /* @__PURE__ */ new Set([...validatorKeys, ...input.configKeys])
+  );
+}
+
+// src/with-shape/introspection/describe.ts
+var ZOD_META_KEYS = /* @__PURE__ */ new Set([
+  "label",
+  "description",
+  "unit",
+  "semanticType",
+  "sensitivity",
+  "aggregate",
+  "aliases",
+  "displayFor",
+  "group",
+  "order"
+]);
+async function deriveZodFields(schema) {
+  const envelope = await derivePersistedSchema(schema);
+  if (!envelope.jsonSchema) return {};
+  const isZod4 = isZod4Schema(schema);
+  const jsonSchema = envelope.jsonSchema;
+  const fieldDescriptors = jsonSchemaToFields(jsonSchema, "live-validator");
+  const propertiesRaw = jsonSchema["properties"];
+  const result = {};
+  for (const [key, descriptor] of Object.entries(fieldDescriptors)) {
+    let meta;
+    if (isZod4 && propertiesRaw) {
+      const prop = propertiesRaw[key];
+      if (prop) {
+        const extracted = {};
+        let hasAny = false;
+        for (const mk of ZOD_META_KEYS) {
+          if (mk in prop) {
+            extracted[mk] = prop[mk];
+            hasAny = true;
+          }
+        }
+        if (hasAny) meta = extracted;
+      }
+    }
+    result[key] = {
+      type: descriptor.type,
+      optional: descriptor.optional === true,
+      ...descriptor.constraints !== void 0 ? { constraints: descriptor.constraints } : {},
+      ...meta !== void 0 ? { meta } : {}
+    };
+  }
+  return result;
+}
+async function resolveDescribeFieldIds(store, vaultName, collectionName, getDEK) {
+  let dek;
+  try {
+    dek = await getDEK(collectionName);
+  } catch {
+    return {};
+  }
+  const persisted = await loadPersistedSchema(store, vaultName, collectionName, dek);
+  return persisted?.fieldIds !== void 0 ? { fieldIds: persisted.fieldIds } : {};
+}
+function deriveWidget(opts) {
+  if (opts.resolvedWidget !== void 0) return opts.resolvedWidget;
+  switch (opts.semanticType) {
+    case "date":
+    case "datetime":
+      return "date";
+    case "currency":
+      return "money";
+    case "entity":
+      return "ref-select";
+    case "url":
+      return "url";
+    case "email":
+      return "email";
+    case "percent":
+      return "number";
+  }
+  if (opts.dict !== void 0 || opts.lookup !== void 0) return "select";
+  if (opts.blob !== void 0) return "file";
+  if (opts.type === "boolean") return "checkbox";
+  if (opts.type === "number") return "number";
+  return "text";
+}
+function buildDescription(input) {
+  const { collection, fieldMeta, moneyFields, dictKeyFields, lookupFields, computed, refs, zodFields, schema, dictLabels, meta, i18nFields, classified, taint, fieldIds } = input;
+  const lookupFragments = input.viaFragments?.["lookup"]?.lookupFields;
+  const blobFragments = input.viaFragments?.["blob"]?.blobFields;
+  const validatorKeys = zodFields !== void 0 && Object.keys(zodFields).length > 0 ? Object.keys(zodFields) : schemaFieldKeys(schema);
+  const canEnumerateFields = validatorKeys !== void 0;
+  if (canEnumerateFields && fieldMeta !== void 0) {
+    const knownFields = /* @__PURE__ */ new Set([
+      ...Object.keys(moneyFields ?? {}),
+      ...Object.keys(dictKeyFields ?? {}),
+      ...Object.keys(refs),
+      ...Object.keys(computed ?? {}),
+      ...validatorKeys ?? [],
+      ...Object.keys(i18nFields ?? {}),
+      ...Object.keys(lookupFields ?? {}),
+      ...Object.keys(blobFragments ?? {}),
+      ...Object.keys(classified ?? {})
+    ]);
+    validateFieldMetaKeys(collection, fieldMeta, knownFields);
+  }
+  const allKeys = /* @__PURE__ */ new Set([
+    ...Object.keys(moneyFields ?? {}),
+    ...Object.keys(dictKeyFields ?? {}),
+    ...Object.keys(lookupFields ?? {}),
+    ...Object.keys(refs),
+    ...Object.keys(computed ?? {}),
+    ...Object.keys(fieldMeta ?? {}),
+    ...Object.keys(zodFields ?? {}),
+    ...Object.keys(i18nFields ?? {}),
+    ...Object.keys(classified ?? {}),
+    ...Object.keys(blobFragments ?? {})
+  ]);
+  const fields = [];
+  for (const key of [...allKeys].sort()) {
+    const zod = zodFields?.[key];
+    const money = moneyFields?.[key];
+    const dict = dictKeyFields?.[key];
+    const lookupDesc = lookupFields?.[key];
+    const refDesc = refs[key];
+    const isComputed = computed !== void 0 && key in computed;
+    const i18nDesc = i18nFields?.[key];
+    const cls = classified?.[key];
+    const blobFragmentEntry = blobFragments?.[key];
+    const taintPosture = taint?.postures.get(key);
+    let type = zod?.type ?? "unknown";
+    const inferred = {};
+    let moneyBlock;
+    let dictBlock;
+    let refBlock;
+    let lookupBlock;
+    let blobBlock;
+    if (money) {
+      type = "number";
+      inferred.semanticType = "currency";
+      inferred.aggregate = "sum";
+      const currency = money.soleCurrency();
+      const scale = currency !== void 0 ? money.scaleFor(currency) : void 0;
+      moneyBlock = {
+        mode: money.mode,
+        ...currency !== void 0 ? { currency } : {},
+        ...scale !== void 0 ? { scale } : {},
+        ...money.rounding !== void 0 ? { rounding: money.rounding } : {}
+      };
+    } else if (refDesc) {
+      type = refDesc.isArray ? "array" : "string";
+      inferred.semanticType = "entity";
+      refBlock = {
+        target: refDesc.target,
+        mode: refDesc.mode,
+        ...refDesc.isArray ? { isArray: true } : {}
+      };
+    } else if (dict) {
+      type = "enum";
+      if (isStaticDictDescriptor(dict)) {
+        const displayLocale = dict.displayLocale;
+        const values = dict.keys.map((k) => {
+          const localeMap = dict.table[k];
+          const label = displayLocale !== void 0 ? localeMap?.[displayLocale] ?? void 0 : void 0;
+          return label !== void 0 ? { value: k, label } : { value: k };
+        });
+        dictBlock = { name: dict.name, static: true, values };
+      } else {
+        const labelMap = dictLabels?.[dict.name];
+        const labelMapHasEntries = labelMap !== void 0 && Object.keys(labelMap).length > 0;
+        if (labelMapHasEntries) {
+          const values = Object.entries(labelMap).map(([value, label]) => ({ value, label }));
+          dictBlock = { name: dict.name, static: false, values };
+        } else if (dict.keys !== void 0) {
+          const values = dict.keys.map((k) => {
+            const label = dict.labels?.[k];
+            return label !== void 0 ? { value: k, label } : { value: k };
+          });
+          dictBlock = { name: dict.name, static: false, values };
+        } else {
+          dictBlock = { name: dict.name, static: false };
+        }
+      }
+    } else if (lookupDesc) {
+      type = "enum";
+      const lookupLabelMap = dictLabels?.[lookupDesc.dimension];
+      const lookupLabelMapHasEntries = lookupLabelMap !== void 0 && Object.keys(lookupLabelMap).length > 0;
+      if (lookupDesc.table !== void 0) {
+        const displayLocale = lookupDesc.displayLocale;
+        const table = lookupDesc.table;
+        const values = (lookupDesc.keys ?? Object.keys(table)).map((k) => {
+          const localeMap = table[k];
+          const label = displayLocale !== void 0 ? localeMap?.[displayLocale] ?? void 0 : void 0;
+          return label !== void 0 ? { value: k, label } : { value: k };
+        });
+        dictBlock = { name: lookupDesc.dimension, static: true, values };
+      } else if (lookupLabelMapHasEntries) {
+        const values = Object.entries(lookupLabelMap).map(([value, label]) => ({ value, label }));
+        dictBlock = { name: lookupDesc.dimension, static: false, values };
+      } else if (lookupDesc.keys !== void 0) {
+        const values = lookupDesc.keys.map((k) => {
+          const label = lookupDesc.labels?.[k];
+          return label !== void 0 ? { value: k, label } : { value: k };
+        });
+        dictBlock = { name: lookupDesc.dimension, static: false, values };
+      } else {
+        dictBlock = { name: lookupDesc.dimension, static: false };
+      }
+    } else if (i18nDesc) {
+      type = "string";
+    } else if (isComputed) {
+    } else if (blobFragmentEntry !== void 0) {
+      type = "blob";
+      blobBlock = { ...blobFragmentEntry, queryable: "none" };
+    }
+    const lookupFragmentEntry = lookupFragments?.[key];
+    if (lookupFragmentEntry !== void 0) {
+      lookupBlock = {
+        ...lookupFragmentEntry.dimension !== void 0 ? { dimension: lookupFragmentEntry.dimension } : {},
+        backing: lookupFragmentEntry.backing,
+        vocabulary: lookupFragmentEntry.vocabulary,
+        key: lookupFragmentEntry.key,
+        onDelete: lookupFragmentEntry.onDelete,
+        ...lookupFragmentEntry.altKeys !== void 0 ? { altKeys: lookupFragmentEntry.altKeys } : {},
+        ...lookupFragmentEntry.present !== void 0 ? { present: lookupFragmentEntry.present } : {},
+        ...lookupFragmentEntry.sortBy !== void 0 ? { sortBy: lookupFragmentEntry.sortBy } : {},
+        ...lookupFragmentEntry.keys !== void 0 ? { keys: lookupFragmentEntry.keys } : {}
+      };
+    }
+    if (cls !== void 0) inferred.sensitivity = cls.sensitivity;
+    const channelEntry = fieldMeta?.[key];
+    const zodMeta = zod?.meta;
+    const resolved = resolveFieldMeta(key, {
+      ...channelEntry !== void 0 ? { channel: channelEntry } : {},
+      ...zodMeta !== void 0 ? { zodMeta } : {},
+      inferred
+    });
+    let i18nBlock;
+    if (i18nDesc !== void 0) {
+      const locales = i18nDesc.options.languages;
+      const densify = i18nDesc.options.densifyOnWrite;
+      i18nBlock = {
+        ...locales !== void 0 ? { locales } : {},
+        ...densify !== void 0 ? { densify } : {}
+      };
+    }
+    const widget = deriveWidget({
+      type,
+      ...resolved.semanticType !== void 0 ? { semanticType: resolved.semanticType } : {},
+      ...dictBlock !== void 0 ? { dict: dictBlock } : {},
+      ...lookupBlock !== void 0 ? { lookup: lookupBlock } : {},
+      ...blobBlock !== void 0 ? { blob: blobBlock } : {},
+      ...resolved.widget !== void 0 ? { resolvedWidget: resolved.widget } : {}
+    });
+    const editable = !isComputed && key !== "id" && blobBlock === void 0;
+    const field = {
+      key,
+      ...fieldIds?.[key] !== void 0 ? { id: fieldIds[key] } : {},
+      type,
+      optional: zod?.optional ?? false,
+      ...zod?.constraints !== void 0 ? { constraints: zod.constraints } : {},
+      label: resolved.label,
+      ...resolved.description !== void 0 ? { description: resolved.description } : {},
+      ...resolved.group !== void 0 ? { group: resolved.group } : {},
+      ...resolved.order !== void 0 ? { order: resolved.order } : {},
+      ...resolved.semanticType !== void 0 ? { semanticType: resolved.semanticType } : {},
+      ...resolved.unit !== void 0 ? { unit: resolved.unit } : {},
+      ...resolved.sensitivity !== void 0 ? { sensitivity: resolved.sensitivity } : {},
+      ...resolved.aggregate !== void 0 ? { aggregate: resolved.aggregate } : {},
+      ...resolved.aliases !== void 0 ? { aliases: resolved.aliases } : {},
+      ...resolved.displayFor !== void 0 ? { displayFor: resolved.displayFor } : {},
+      ...refBlock !== void 0 ? { ref: refBlock } : {},
+      ...moneyBlock !== void 0 ? { money: moneyBlock } : {},
+      ...dictBlock !== void 0 ? { dict: dictBlock } : {},
+      ...lookupBlock !== void 0 ? { lookup: lookupBlock } : {},
+      ...blobBlock !== void 0 ? { blob: blobBlock } : {},
+      ...isComputed ? { computed: true } : {},
+      ...i18nBlock !== void 0 ? { i18n: i18nBlock } : {},
+      widget,
+      editable,
+      ...cls !== void 0 ? {
+        classified: {
+          preset: cls.preset,
+          storage: cls.storage,
+          list: cls.list.kind === "omit" ? "omit" : cls.list.kind === "mask" ? { mask: cls.list.pattern } : { rider: cls.list.rider },
+          ...cls.equatable === true ? { equatable: true } : {}
+        }
+      } : {},
+      ...taintPosture !== void 0 ? { taint: { posture: taintPosture, forcedBy: taint?.provenance?.get(key) ?? [] } } : {}
+    };
+    fields.push(field);
+  }
+  const collectionMeta = {
+    ...meta,
+    label: meta?.label ?? humanizeFieldKey(collection)
+  };
+  return {
+    collection,
+    fields,
+    meta: collectionMeta
+  };
+}
+
+// src/kernel/via/compose.ts
+function via(...descriptors) {
+  if (descriptors.length === 0) {
+    throw new ValidationError("via(): at least one descriptor is required, e.g. via(money({ currency: 'EUR' }))");
+  }
+  return { _noydbVia: true, descriptors };
+}
+function isViaFieldSpec(x) {
+  return typeof x === "object" && x !== null && x._noydbVia === true;
+}
+function mergeViaFields(sources) {
+  for (const field of Object.keys(sources.dictKeyFields ?? {})) {
+    if (sources.lookupFields && field in sources.lookupFields) {
+      throw new ValidationError(
+        `mergeViaFields(): field "${field}" is declared in both \`dictKeyFields\` and \`lookupFields\` \u2014 declare it in one place only.`
+      );
+    }
+  }
+  if (!sources.viaFields || Object.keys(sources.viaFields).length === 0) {
+    return {
+      moneyFields: sources.moneyFields,
+      i18nFields: sources.i18nFields,
+      dictKeyFields: sources.dictKeyFields,
+      computedFields: void 0,
+      lookupFields: sources.lookupFields
+    };
+  }
+  const sugarFieldNames = /* @__PURE__ */ new Set([
+    ...Object.keys(sources.moneyFields ?? {}),
+    ...Object.keys(sources.i18nFields ?? {}),
+    ...Object.keys(sources.dictKeyFields ?? {}),
+    ...Object.keys(sources.lookupFields ?? {})
+  ]);
+  const viaMoney = {};
+  const viaI18nText = {};
+  const viaDictKey = {};
+  const viaComputed = {};
+  const viaLookup = {};
+  for (const [field, spec] of Object.entries(sources.viaFields)) {
+    if (sugarFieldNames.has(field)) {
+      throw new ValidationError(
+        `via(): field "${field}" is declared via both a sugar key and \`viaFields\` \u2014 declare it in one place only.`
+      );
+    }
+    for (const descriptor of spec.descriptors) {
+      if (descriptor._viaBrand === "money") {
+        viaMoney[field] = descriptor;
+      } else if (descriptor._viaBrand === "i18n") {
+        if (isI18nTextDescriptor(descriptor)) viaI18nText[field] = descriptor;
+        else if (isDictKeyDescriptor(descriptor) || isStaticDictDescriptor(descriptor)) viaDictKey[field] = descriptor;
+      } else if (descriptor._viaBrand === "computed") {
+        viaComputed[field] = descriptor;
+      } else if (descriptor._viaBrand === "lookup" && isLookupDescriptor(descriptor)) {
+        viaLookup[field] = descriptor;
+      } else {
+        throw new ValidationError(`via(): field "${field}" has a descriptor with unrecognized _viaBrand "${descriptor._viaBrand}" \u2014 via() only supports money/i18n/computed/lookup descriptors today.`);
+      }
+    }
+  }
+  return {
+    moneyFields: Object.keys(viaMoney).length > 0 ? { ...sources.moneyFields ?? {}, ...viaMoney } : sources.moneyFields,
+    i18nFields: Object.keys(viaI18nText).length > 0 ? { ...sources.i18nFields ?? {}, ...viaI18nText } : sources.i18nFields,
+    dictKeyFields: Object.keys(viaDictKey).length > 0 ? { ...sources.dictKeyFields ?? {}, ...viaDictKey } : sources.dictKeyFields,
+    computedFields: Object.keys(viaComputed).length > 0 ? viaComputed : void 0,
+    lookupFields: Object.keys(viaLookup).length > 0 ? { ...sources.lookupFields ?? {}, ...viaLookup } : sources.lookupFields
+  };
+}
+var VIA_FIELD_MAP_FAMILY = {
+  moneyFields: "money",
+  i18nFields: "i18n",
+  dictKeyFields: "i18n",
+  lookupFields: "lookup",
+  classifiedFields: "classified",
+  blobFields: "blob",
+  computed: "computed"
+};
+function guardCrossBindingFieldCollisions(fieldMaps, callerPrefix = "compileVias()") {
+  const claimantsByField = /* @__PURE__ */ new Map();
+  for (const [sourceKey, map] of Object.entries(fieldMaps)) {
+    for (const field of Object.keys(map ?? {})) {
+      const claimants = claimantsByField.get(field) ?? /* @__PURE__ */ new Set();
+      claimants.add(sourceKey);
+      claimantsByField.set(field, claimants);
+    }
+  }
+  for (const [field, sourceKeys] of claimantsByField) {
+    const families = new Set([...sourceKeys].map((key) => VIA_FIELD_MAP_FAMILY[key]));
+    if (families.size < 2) continue;
+    if (sourceKeys.size === 2 && families.has("computed")) {
+      const other = [...families].find((f) => f !== "computed");
+      if (other === "money" || other === "i18n" || other === "lookup") continue;
+    }
+    const keys = [...sourceKeys].sort().map((k) => `\`${k}\``);
+    const joined = keys.length === 2 ? keys.join(" and ") : `${keys.slice(0, -1).join(", ")}, and ${keys[keys.length - 1]}`;
+    throw new ValidationError(
+      `${callerPrefix}: field "${field}" is declared in both ${joined} \u2014 a field cannot be claimed by two different via-binding families. Declare it in one place only.`
+    );
+  }
+}
+function guardReconcileCollisions(existingVia, incomingFieldMaps) {
+  guardCrossBindingFieldCollisions(incomingFieldMaps, "guardReconcileCollisions()");
+  if (!existingVia) return;
+  const existingBindings = existingVia.bindings.filter((b) => b.brand !== "taint");
+  for (const [sourceKey, map] of Object.entries(incomingFieldMaps)) {
+    const incomingFamily = VIA_FIELD_MAP_FAMILY[sourceKey];
+    if (incomingFamily === void 0) continue;
+    for (const field of Object.keys(map ?? {})) {
+      const existingFamilies = new Set(
+        existingBindings.filter((b) => b.covers?.(field)).map((b) => b.brand)
+      );
+      for (const existingFamily of existingFamilies) {
+        if (existingFamily === incomingFamily) continue;
+        const isExempt = existingFamily === "computed" && (incomingFamily === "money" || incomingFamily === "i18n" || incomingFamily === "lookup") || incomingFamily === "computed" && (existingFamily === "money" || existingFamily === "i18n" || existingFamily === "lookup");
+        if (isExempt) continue;
+        throw new ValidationError(
+          `vault.collection(): field "${field}" is already bound by the "${existingFamily}" via family on this collection \u2014 an incoming \`${sourceKey}\` declaration cannot claim it for a different family ("${incomingFamily}"). Declare it in one place only.`
+        );
+      }
+    }
+  }
+}
+
+// src/kernel/via/pipeline.ts
+var ViaPipeline = class _ViaPipeline {
+  constructor(bindings, taint) {
+    this.bindings = bindings;
+    this.taint = taint;
+    const moneyVias = bindings.filter((b) => b.brand === "money");
+    const computedVias = bindings.filter((b) => b.brand === "computed");
+    const restBindings = bindings.filter((b) => b.brand !== "money" && b.brand !== "computed");
+    this._presentOrder = [...moneyVias, ...computedVias, ...restBindings];
+    this._presentLateBoundary = moneyVias.length + computedVias.length;
+  }
+  bindings;
+  taint;
+  /**
+   * Present-phase-ONLY order (#665, corrected under #665 review) — a stable
+   * THREE-WAY partition of `bindings` computed once here at construction:
+   * every `'money'`-brand binding first (existing relative order), then
+   * every `'computed'`-brand binding (existing relative order), then
+   * everything else (existing relative order). `present()` folds over this
+   * instead of `bindings` so a `mode: 'virtual'` computed field's value
+   * exists before i18n/lookup's dressing `present()` hooks run on it
+   * (today's `compileVias` order is money→i18n→lookup→classified→
+   * blob→computed, `collection-config.ts:554`, so dressing unconditionally
+   * ran BEFORE the value it dresses existed). This reorder is binding-level,
+   * not conditioned on any particular field composition — it applies to
+   * EVERY collection that compiles a `'computed'` binding at all, not only
+   * ones stacking a dresser on the SAME field as a computed one. EVERY other
+   * phase (`ingest`/`encodeWrite`/`encodeAtRest`/`enforceWrite`/etc.) keeps
+   * folding over `bindings` unchanged — those write/query phases need
+   * money-first (`_applyMoneyFields` PREPENDS money, `_applyClassifiedFields`
+   * APPENDS classified to preserve it, `kernel/collection.ts:1275-1284,1364-
+   * 1368`).
+   *
+   * Money is deliberately carved OUT of the generic "everything else" slice
+   * and kept FIRST — the original two-way `[computed..., rest...]` partition
+   * regressed money's composed-field behavior from a benign missing-dressing
+   * gap into VALUE CORRUPTION: money's `present()` DECODES its input as a
+   * STORED SCALED-INT (and derives `<field>Formatted` from it) — it is not a
+   * pure dressing CONSUMER like i18n/lookup, which only ADD a `<field>Label`
+   * key and never rewrite the field's own value. Running money AFTER
+   * computed on a field composing `computed(virtual)` + `money(...)` on
+   * ITSELF means money's decode sees the virtual field's raw MAJOR-unit
+   * output (e.g. `21`) and misreads it as a scaled-int, producing a
+   * corrupted value (`'0.21'`) instead of the pre-#665 result (the raw `21`
+   * surviving untouched, with no `Formatted` key added — a benign
+   * missing-dressing gap, not a wrong value). Money-first restores money's
+   * exact pre-#665 present position — byte-identical money behavior; the
+   * materialized composition pins from the #631 work and the money suites
+   * all ran under money-first. i18n/lookup are genuine dressing consumers
+   * (they only ADD, never rewrite), so they stay after computed, which is
+   * the fix #665 intended. A `'taint'` binding (appended LAST by
+   * `via/graph-wiring.ts#applyTaintOverlay`) stays last here too (it's
+   * neither money nor computed, so it lands at the tail of the "everything
+   * else" slice), preserving its "runs after computed, redacts tainted
+   * virtual output" contract (`via/taint-binding.ts`'s `taintBinding` doc
+   * comment).
+   *
+   * Money-dressing a virtual computed field's OWN output (the composed
+   * `computed(virtual) + money` case) is NOT resolved by this partition
+   * alone — #669 resolves it with a separate mid-fold hook instead:
+   * `NoydbVia.presentLate` runs after every binding's `present()` in this
+   * money+computed segment, before the "everything else" segment below, so
+   * money can quantize/reinterpret a virtual field's fresh MAJOR-UNITS
+   * output as if it were a stored value, without perturbing this ordering
+   * or the #665 invariant above it (`_presentLateBoundary` below marks
+   * exactly where that mid-fold point sits within `_presentOrder`).
+   */
+  _presentOrder;
+  /** #669 — index into `_presentOrder` where the money+computed segment ends and the
+   *  "everything else" segment begins (`moneyVias.length + computedVias.length`);
+   *  `present()` runs every binding's `presentLate` at exactly this boundary. */
+  _presentLateBoundary;
+  /** undefined when there is nothing to enforce — the zero-via fast path is
+   *  `this.via === undefined` (#553: keeps an all-plain collection sync). A
+   *  `'*'`-defaulted output collection (#642) counts as "something to enforce"
+   *  even with zero field-specific postures and zero bindings. */
+  static build(bindings, taint) {
+    if (bindings.length === 0 && (!taint || taint.postures.size === 0 && taint.defaultPosture === void 0)) return void 0;
+    return new _ViaPipeline(bindings, taint);
+  }
+  /** Refuse a write before crypto runs: awaits each binding's `enforceWrite` in order — first throw wins. */
+  async enforceWrite(record, ctx) {
+    for (const b of this.bindings) if (b.enforceWrite) await b.enforceWrite(record, ctx);
+  }
+  ingest(record) {
+    let r = record;
+    for (const b of this.bindings) if (b.ingest) r = b.ingest(r);
+    return r;
+  }
+  canonicalizeStored(record) {
+    let r = record;
+    for (const b of this.bindings) if (b.canonicalizeStored) r = b.canonicalizeStored(r);
+    return r;
+  }
+  async encodeWrite(record, ctx) {
+    let r = record;
+    for (const b of this.bindings) if (b.encodeWrite) r = await b.encodeWrite(r, ctx);
+    return r;
+  }
+  /**
+   * Final write-pipeline stage: folds each binding's `encodeAtRest` in
+   * order, threading the record and accumulating the sealed-slot map. A
+   * field belongs to exactly one via feature — two bindings sealing the
+   * same field is a brand-keyed collision and throws.
+   */
+  async encodeAtRest(record, crypto) {
+    let r = record;
+    let sealed;
+    const sealedBy = /* @__PURE__ */ new Map();
+    for (const b of this.bindings) {
+      if (!b.encodeAtRest) continue;
+      const result = await b.encodeAtRest(r, crypto);
+      r = result.record;
+      if (!result.sealed) continue;
+      for (const [field, ref] of Object.entries(result.sealed)) {
+        const priorBrand = sealedBy.get(field);
+        if (priorBrand !== void 0) {
+          throw new ValidationError(
+            `via encodeAtRest: field "${field}" sealed by binding "${priorBrand}" is also sealed by binding "${b.brand}"`
+          );
+        }
+        sealedBy.set(field, b.brand);
+        sealed ??= {};
+        sealed[field] = ref;
+      }
+    }
+    return sealed ? { record: r, sealed } : { record: r };
+  }
+  /** First read-pipeline stage: folds each binding's `decodeAtRest` in order. */
+  async decodeAtRest(record, sealed, crypto, opts) {
+    let r = record;
+    for (const b of this.bindings) if (b.decodeAtRest) r = await b.decodeAtRest(r, sealed, crypto, opts);
+    return r;
+  }
+  async present(record, ctx) {
+    let r = record;
+    for (let i = 0; i < this._presentLateBoundary; i++) {
+      const b = this._presentOrder[i];
+      if (b.present) r = await b.present(r, ctx);
+    }
+    for (const b of this.bindings) if (b.presentLate) r = await b.presentLate(r, ctx);
+    for (let i = this._presentLateBoundary; i < this._presentOrder.length; i++) {
+      const b = this._presentOrder[i];
+      if (b.present) r = await b.present(r, ctx);
+    }
+    return r;
+  }
+  buildClause(field, op, value) {
+    for (const b of this.bindings) {
+      const payload = b.buildClause?.(field, op, value);
+      if (payload !== void 0) return { brand: b.brand, payload };
+    }
+    return void 0;
+  }
+  evaluateClause(clause, actual, op) {
+    const b = this.bindings.find((x) => x.brand === clause.brand);
+    return b?.evaluateClause ? b.evaluateClause(actual, op, clause.payload) : false;
+  }
+  /**
+   * Resolve a `buildClause` payload to an index-probe operand (#625) —
+   * mirrors `evaluateClause`'s brand dispatch. `undefined` (a binding
+   * with no `indexProbe`, or one that declines to probe this op/payload)
+   * means the caller (`candidateRecords()`) must fall back to a scan.
+   */
+  // eslint-disable-next-line @typescript-eslint/no-redundant-type-constituents
+  indexProbe(clause, op) {
+    const b = this.bindings.find((x) => x.brand === clause.brand);
+    return b?.indexProbe ? b.indexProbe(op, clause.payload) : void 0;
+  }
+  /**
+   * Resolve a raw STORED field value to its canonical eager-index bucket
+   * key (#672) — folds every binding's `canonicalizeIndexKey`, first
+   * non-undefined wins (same fold discipline as `buildClause`). `undefined`
+   * means no binding claims `field` (or the value can't be canonicalized)
+   * — the caller buckets the raw stringified value, unchanged from before
+   * this hook existed.
+   */
+  canonicalizeIndexKey(field, rawValue) {
+    for (const b of this.bindings) {
+      const key = b.canonicalizeIndexKey?.(field, rawValue);
+      if (key !== void 0) return key;
+    }
+    return void 0;
+  }
+  decodeResults(record) {
+    let r = record;
+    for (const b of this.bindings) if (b.decodeResults) r = b.decodeResults(r);
+    return r;
+  }
+  /** undefined = no binding covers the field → caller falls back to generic compare. */
+  compareForOrder(field, a, b) {
+    for (const bind of this.bindings) {
+      const c = bind.compareForOrder?.(field, a, b);
+      if (c !== void 0) return c;
+    }
+    return void 0;
+  }
+  /** undefined = no binding resolves an order-sort label for `key` at `field`/`locale` (#650 Task 7 —
+   *  the `orderBy(..., {by:'label'})` per-call-locale channel `compareForOrder` above can't serve). */
+  resolveOrderLabel(field, key, locale) {
+    for (const bind of this.bindings) {
+      const label = bind.resolveOrderLabel?.(field, key, locale);
+      if (label !== void 0) return label;
+    }
+    return void 0;
+  }
+  /**
+   * Which posture governs `field`, if any binding covers it — `undefined`
+   * means no binding declares `field` (the generic, non-via query path
+   * applies). #629 Task 8's posture consumer: `.where()`/`.orderBy()`
+   * consult this before building/evaluating a clause, refusing fields whose
+   * posture is `queryable: 'none'` (e.g. blob); every other posture
+   * ('det-exact'/'ordered'/'full') is left to the existing per-binding
+   * buildClause/evaluateClause/compareForOrder machinery, unchanged.
+   *
+   * #638 Task 3: the graph-computed taint overlay is consulted FIRST — a
+   * derived field's assigned (most-restrictive-of-sources) posture wins over
+   * whatever a binding would otherwise report for that field name (no
+   * binding covers a computed/derived field today, so this never actually
+   * shadows one — see `via/taint-binding.ts`'s `taintBinding.covers`, which
+   * only claims the sealed subset for `encodeAtRest`/`decodeAtRest`, not for
+   * this lookup).
+   */
+  postureFor(field) {
+    const t = this.taint?.postures.get(field);
+    if (t) return t;
+    for (const b of this.bindings) {
+      if (b.covers?.(field)) return b.posture;
+    }
+    return this.taint?.defaultPosture;
+  }
+  /**
+   * Refuse any field-based reducer over a `queryable: 'none'` field (blob) —
+   * metadata-only: walks each reducer's `.field` and checks posture, no
+   * rewriting. Reducers with no `.field` (e.g. `count()`) are skipped.
+   *
+   * Shared by `wrapReducers` below (which ALSO applies each binding's
+   * rewrite, e.g. money's exact-BigInt reducer swap) and by
+   * `ScanBuilder.aggregate()` (#629 Task 8 review fix wave 1), which must
+   * call THIS, not `wrapReducers` — wiring full `wrapReducers` into
+   * `ScanBuilder.aggregate()` would newly activate money/i18n reducer
+   * wrapping on a path that has never run it, a parity-breaking behavior
+   * change for existing brands.
+   */
+  refuseUnqueryableReducers(spec) {
+    for (const reducer of Object.values(spec)) {
+      const field = reducer?.field;
+      if (field !== void 0 && this.postureFor(field)?.queryable === "none") {
+        throw new FieldNotQueryableError(field);
+      }
+    }
+  }
+  /**
+   * Rewrite an aggregate spec (money exact reducers), then refuse any
+   * field-based reducer over a `queryable: 'none'` field (blob) — the same
+   * posture gate `.where()`/`.orderBy()` apply, extended to `.aggregate()`
+   * (both the bare-spec and builder forms funnel through here).
+   */
+  wrapReducers(spec) {
+    this.refuseUnqueryableReducers(spec);
+    let s = spec;
+    for (const b of this.bindings) if (b.wrapReducers) s = b.wrapReducers(s);
+    return s;
+  }
+  /**
+   * Deliberate export-layer redaction (#629 Task 9's posture consumer):
+   * for every OWN field the decoded record carries, if the covering
+   * binding's posture declares `exportable: false` (classified today;
+   * money/i18n/blob are all `true`), replace the value with
+   * {@link EXPORT_REDACTION_MARKER} — the same `'[sealed]'` string
+   * `SealedHandle.toJSON()` (`kernel/types.ts`) already emits, so this is
+   * byte-parity with today's accidental redaction, now independent of the
+   * field's runtime shape. `SealedHandle.toJSON()` stays untouched as
+   * defense-in-depth: a record read via `collection.get()` and
+   * JSON.stringify'd outside `exportStream()` still gets the accident's
+   * redaction on its own. Never mutates the input; returns a new object
+   * only when a field was actually redacted.
+   */
+  redactForExport(record) {
+    let out;
+    for (const field of Object.keys(record)) {
+      if (this.postureFor(field)?.exportable === false) {
+        out ??= { ...record };
+        out[field] = EXPORT_REDACTION_MARKER;
+      }
+    }
+    return out ?? record;
+  }
+  /**
+   * Shared fold over a subset of `this.bindings`: runs each binding's
+   * `erase`, concatenating shredded/retainedShared counts and residue.
+   * Consults `posture.forgettable` (#629 Task 10) — a binding declaring
+   * `forgettable: false` is skipped even if it defines `erase` (none does
+   * today; a future non-forgettable binding is supported without a brand check).
+   */
+  async foldErase(ctx, bindings) {
+    let shredded = 0;
+    let retainedShared = 0;
+    const residue = [];
+    for (const b of bindings) {
+      if (!b.erase || b.posture.forgettable === false) continue;
+      const report = await b.erase(ctx);
+      shredded += report.shredded;
+      retainedShared += report.retainedShared ?? 0;
+      residue.push(...report.residue);
+    }
+    return retainedShared > 0 ? { shredded, residue, retainedShared } : { shredded, residue };
+  }
+  /** `forget()`'s per-ref erasure door: folds every binding's `erase`. */
+  async erase(ctx) {
+    return this.foldErase(ctx, this.bindings);
+  }
+  /**
+   * `forget()`'s SEALED-posture-only erase fold (#629 Task 10, `Collection._onViaErase`'s
+   * one caller) — classified today; metadata-filtered on
+   * `posture.encryptedAtRest`, not brand-checked. `undefined` when no
+   * sealed-posture binding is compiled in — `vault.ts` then falls back to
+   * its own bare-`sensitive` classification, which no via binding covers.
+   */
+  async eraseSealed(ctx) {
+    const sealed = this.bindings.filter((b) => b.posture.encryptedAtRest === "sealed");
+    return sealed.length === 0 ? void 0 : this.foldErase(ctx, sealed);
+  }
+  /** True iff any binding implements decodeResults (query fast-path gating). */
+  get hasResultDecode() {
+    return this.bindings.some((b) => b.decodeResults !== void 0);
+  }
+  /**
+   * True iff any binding declares an at-rest hook (`encodeAtRest`/
+   * `decodeAtRest`) — the codec boundary's async-stack gate (#629 Task 3
+   * consults this to choose between the hook path and today's inline
+   * sealed-slot path; a stack with only sync hooks, e.g. money-only, stays
+   * `false`).
+   */
+  get hasAtRestHooks() {
+    return this.bindings.some((b) => b.encodeAtRest !== void 0 || b.decodeAtRest !== void 0);
+  }
+  /**
+   * Fold every binding's `describeFragment()` into one `brand -> fragment`
+   * map (#650 Task 7 — the first-ever consumer; `describeFragment` was
+   * declared at `via/index.ts:136` since #623 with zero callers until this task).
+   * `undefined` when no compiled binding implements it. Consumed by
+   * `Collection.describe()`/`describeAsync()`, threaded to `buildDescription`
+   * as `BuildDescriptionInput.viaFragments`.
+   */
+  describeFragments() {
+    let out;
+    for (const b of this.bindings) {
+      const f = b.describeFragment?.();
+      if (f !== void 0) {
+        out ??= {};
+        out[b.brand] = f;
+      }
+    }
+    return out;
+  }
+};
+var EXPORT_REDACTION_MARKER = "[sealed]";
+function exportRedact(coll, record) {
+  if (record === null || typeof record !== "object") return record;
+  const via2 = coll._via;
+  return via2 ? via2.redactForExport(record) : record;
+}
+
+// src/kernel/collection-config.ts
+function computedEntryParts(entry) {
+  if (typeof entry === "function") return { fn: entry, mode: "materialized" };
+  return { fn: entry.fn, ...entry.deps !== void 0 ? { deps: entry.deps } : {}, mode: entry.mode ?? "materialized" };
+}
+function matchTargetFieldNames(opts) {
+  const declared = [];
+  const virtual = [];
+  for (const [field, entry] of Object.entries(opts.computed ?? {})) {
+    declared.push(field);
+    const parts = computedEntryParts(entry);
+    if (parts.mode === "virtual") virtual.push(field);
+  }
+  for (const [field, spec] of Object.entries(opts.viaFields ?? {})) {
+    declared.push(field);
+    const descriptors = spec.descriptors ?? [];
+    for (const d of descriptors) {
+      if (d._viaBrand === "computed" && d.mode === "virtual") virtual.push(field);
+    }
+  }
+  return { declared, virtual };
+}
+function unifyComputedFields(opts, viaComputedFields) {
+  return { ...opts.computed ?? {}, ...viaComputedFields ?? {} };
+}
+function compileVias(opts, classifiedGuardCtx, eraseCfgOut) {
+  const { moneyFields, i18nFields, dictKeyFields, computedFields, lookupFields } = mergeViaFields(opts);
+  const allComputedFields = unifyComputedFields(opts, computedFields);
+  guardCrossBindingFieldCollisions({
+    moneyFields,
+    i18nFields,
+    dictKeyFields,
+    lookupFields,
+    classifiedFields: opts.classifiedFields !== void 0 ? resolveClassifiedFields(opts.name, opts.classifiedFields).byField : void 0,
+    blobFields: opts.blobFields,
+    computed: allComputedFields
+  });
+  const bindings = [];
+  const virtualFields = /* @__PURE__ */ new Map();
+  for (const [field, entry] of Object.entries(allComputedFields)) {
+    const parts = computedEntryParts(entry);
+    if (parts.mode === "virtual") {
+      virtualFields.set(field, { _viaBrand: "computed", fn: parts.fn, mode: "virtual", ...parts.deps !== void 0 ? { deps: parts.deps } : {} });
+    }
+  }
+  if (moneyFields) {
+    const virtualMoney = resolveVirtualMoneyFields(Object.keys(moneyFields), (f) => virtualFields.has(f));
+    bindings.push(viaBinder("money")({ moneyFields, ...virtualMoney.size > 0 ? { virtualMoneyFields: virtualMoney } : {} }));
+  }
+  if (i18nFields || dictKeyFields) {
+    const densify = i18nFields ? Object.fromEntries(
+      Object.entries(i18nFields).filter(([, d]) => d.options.densifyOnWrite === true)
+    ) : {};
+    const i18nDensifyFields = Object.keys(densify).length > 0 ? densify : void 0;
+    bindings.push(viaBinder("i18n")({
+      ...i18nFields !== void 0 ? { i18nFields } : {},
+      ...dictKeyFields !== void 0 ? { dictKeyFields } : {},
+      ...i18nDensifyFields !== void 0 ? { i18nDensifyFields } : {},
+      strategy: opts.strategies.i18n,
+      ...opts.defaultLocale !== void 0 ? { defaultLocale: opts.defaultLocale } : {},
+      ...opts.autoTranslateHook !== void 0 ? { autoTranslateHook: opts.autoTranslateHook } : {},
+      ...opts.dictLabelResolver !== void 0 ? { dictLabelResolver: opts.dictLabelResolver } : {},
+      ...opts.i18nPutValidator !== void 0 ? { i18nPutValidator: opts.i18nPutValidator } : {},
+      collectionName: opts.name
+    }));
+  }
+  if (lookupFields !== void 0) {
+    bindings.push(viaBinder("lookup")({
+      lookupFields,
+      ...opts.lookupLabelResolver !== void 0 ? { lookupLabelResolver: opts.lookupLabelResolver } : {},
+      ...opts.getLookupBacking !== void 0 ? { getLookupBacking: opts.getLookupBacking } : {},
+      ...opts.membership !== void 0 ? { membership: opts.membership } : {},
+      ...opts.getAltIndex !== void 0 ? { getAltIndex: opts.getAltIndex } : {},
+      ...opts.snapshotFor !== void 0 ? { snapshotFor: opts.snapshotFor } : {},
+      collectionName: opts.name
+    }));
+  }
+  if (opts.classifiedFields !== void 0) {
+    const classifiedCfg = {
+      entries: opts.classifiedFields,
+      collectionName: opts.name,
+      guardCtx: classifiedGuardCtx
+    };
+    if (eraseCfgOut) eraseCfgOut.classified = classifiedCfg;
+    bindings.push(viaBinder("classified")(classifiedCfg));
+  }
+  if (opts.blobFields !== void 0) {
+    bindings.push(viaBinder("blob")({
+      fields: opts.blobFields,
+      collectionName: opts.name
+    }));
+  }
+  if (virtualFields.size > 0) {
+    bindings.push(viaBinder("computed")({ virtualFields }));
+  }
+  return bindings;
+}
+function resolveVirtualMoneyFields(moneyFieldNames, isVirtual) {
+  const out = /* @__PURE__ */ new Set();
+  for (const field of moneyFieldNames) if (isVirtual(field)) out.add(field);
+  return out;
+}
+function collectKnownFieldNames(parts) {
+  return /* @__PURE__ */ new Set([
+    ...Object.keys(parts.moneyFields ?? {}),
+    ...Object.keys(parts.i18nFields ?? {}),
+    ...Object.keys(parts.dictKeyFields ?? {}),
+    ...Object.keys(parts.classifiedFields ?? {}),
+    ...Object.keys(parts.computed ?? {}),
+    ...Object.keys(parts.lookupFields ?? {})
+  ]);
+}
+var EMPTY_KNOWN_FIELDS = /* @__PURE__ */ new Set();
+function resolveComputedEdges(collectionName, computed, hasClassifiedFields, knownFields = EMPTY_KNOWN_FIELDS) {
+  if (!computed) return [];
+  const edges = [];
+  for (const [field, entry] of Object.entries(computed)) {
+    const parts = computedEntryParts(entry);
+    const deps = parts.deps;
+    if (deps === void 0) {
+      if (hasClassifiedFields) {
+        throw new ValidationError(
+          `Collection "${collectionName}": computed field "${field}" has no declared \`deps\` and the collection declares classified fields \u2014 an opaque computed function could silently copy a classified field's plaintext into an ordinary, unredacted field. Declare \`deps\` naming the source fields it reads, e.g. computed: { ${field}: { fn, deps: [...] } } or via(computed(fn, { deps: [...] })).`
+        );
+      }
+      continue;
+    }
+    if (deps.length === 0) {
+      throw new ValidationError(`Collection "${collectionName}": computed field "${field}"'s \`deps\` must be non-empty.`);
+    }
+    for (const dep of deps) {
+      if (typeof dep !== "string" || dep.length === 0) {
+        throw new ValidationError(`Collection "${collectionName}": computed field "${field}"'s \`deps\` entries must be non-empty strings.`);
+      }
+      if (hasClassifiedFields && !knownFields.has(dep)) {
+        throw new ValidationError(
+          `Collection "${collectionName}": computed field "${field}"'s \`deps\` entry "${dep}" does not name a declared field, and the collection declares classified fields \u2014 an opaque computed function could silently copy a classified field's plaintext into an ordinary, unredacted field via a mistyped/unknown dep name. Declare \`deps\` naming only known fields (money/i18n/dictKey/classified/computed) \u2014 check "${dep}" for a typo.`
+        );
+      }
+    }
+    edges.push({
+      target: { collection: collectionName, field },
+      sources: deps.map((d) => ({ collection: collectionName, field: d })),
+      grain: parts.mode === "virtual" ? "virtual" : "record"
+    });
+  }
+  return edges;
+}
+function resolveViaDepsEdges(collectionName, bindings, knownFields) {
+  const edges = [];
+  for (const binding of bindings) {
+    if (!binding.deps || binding.deps.length === 0) continue;
+    for (const dep of binding.deps) {
+      if (!knownFields.has(dep)) {
+        throw new ValidationError(
+          `Collection "${collectionName}": via binding "${binding.brand}" deps references undeclared field "${dep}".`
+        );
+      }
+    }
+    const sources = binding.deps.map((d) => ({ collection: collectionName, field: d }));
+    for (const field of knownFields) {
+      if (binding.covers?.(field)) edges.push({ target: { collection: collectionName, field }, sources });
+    }
+  }
+  return edges;
+}
+function resolveCollectionConfig(opts) {
+  if (opts.embeddings && opts.crdt) {
+    throw new Error(
+      `Collection "${opts.name}": embeddings are not supported on CRDT collections (L2). Use a non-CRDT collection for semantic search.`
+    );
+  }
+  {
+    const virtualFieldNames = matchTargetFieldNames({
+      computed: opts.computed,
+      viaFields: opts.viaFields
+    }).virtual;
+    if (virtualFieldNames.length > 0) {
+      const virtualSet = new Set(virtualFieldNames);
+      for (const reg of opts.materializedViewSource?.registry().mvsForSource(opts.name) ?? []) {
+        const spec = reg.spec;
+        const fields = spec.groupBy === void 0 ? [] : typeof spec.groupBy === "string" ? [spec.groupBy] : spec.groupBy;
+        for (const f of fields) {
+          if (!virtualSet.has(f)) continue;
+          throw new ValidationError(
+            `materialized view "${spec.name ?? reg.outputCollection}": groupBy names "${f}", which "${opts.name}" declares as a VIRTUAL computed field. Virtual fields are evaluated on read and never stored, so every row would bucket under an undefined key and the aggregate would be silently WRONG rather than an error. Declare it as \`mode: 'materialized'\` (stored) or group on a stored field.`
+          );
+        }
+      }
+    }
+  }
+  validateFieldMetaAtRegistration({
+    collection: opts.name,
+    schema: opts.schema,
+    fieldMeta: opts.fieldMeta,
+    configKeys: Object.keys({
+      ...opts.moneyFields,
+      ...opts.dictKeyFields,
+      ...opts.declaredRefs,
+      ...opts.computed,
+      ...opts.i18nFields,
+      ...opts.lookupFields,
+      ...opts.blobFields,
+      ...opts.classifiedFields,
+      ...opts.viaFields
+    })
+  });
+  if (opts.sensitive && opts.sensitive.length > 0 && opts.crdt) {
+    throw new Error(
+      `Collection "${opts.name}": sensitive (structural group-encryption) is not supported on CRDT collections \u2014 the CRDT write path bypasses per-field sealing, so the fields would be stored in the ordinary encrypted body with no \`_sealed\` slot and no per-field key. Use a non-CRDT collection for sealed fields.`
+    );
+  }
+  if (opts.tiers && opts.tiers.length > 0 && opts.blobFields !== void 0 && Object.keys(opts.blobFields).length > 0 && opts.perRecordKeys !== true) {
+    throw new UnsupportedTierCompositionError(
+      "blobs",
+      `Collection "${opts.name}": tiered collections that declare blobFields require \`perRecordKeys: true\` \u2014 legacy (non-perRecordKeys) blobs have no per-blob content CEK and cannot be tier-isolated on elevate/demote.`
+    );
+  }
+  if (opts.tiers && opts.tiers.length > 0 && opts.blobFields !== void 0) {
+    for (const [field, policy] of Object.entries(opts.blobFields)) {
+      if (policy?.external && policy.public === true) {
+        throw new UnsupportedTierCompositionError(
+          "blobs",
+          `Collection "${opts.name}": blob field "${field}" cannot be both \`external: true, public: true\` and declared on a tiered collection \u2014 the object key is deterministic and its bytes are world-readable by design, so tier-invisibility can never be enforced for it once elevated. Use a private/presigned external field (\`public\` omitted or \`false\`) or move this field to a non-tiered collection.`
+        );
+      }
+    }
+  }
+  if (opts.tiers && opts.tiers.length > 0 && opts.encrypted === false) {
+    throw new UnsupportedTierCompositionError(
+      "plaintext",
+      `Collection "${opts.name}": tiers are per-tier ENCRYPTION keys \u2014 a plaintext collection (\`encrypted: false\`) has nothing to re-key, so \`putAtTier\`/\`elevate\` would encrypt/decrypt incoherently. Use an encrypted collection.`
+    );
+  }
+  if (opts.tiers && opts.tiers.length > 0 && opts.crdt !== void 0 && ((opts.derivationSource?.registry().strategiesForSource(opts.name).length ?? 0) > 0 || (opts.materializedViewSource?.registry().mvsForSource(opts.name).length ?? 0) > 0)) {
+    throw new UnsupportedTierCompositionError(
+      "crdt-derivation",
+      `Collection "${opts.name}": tiers + crdt cannot be combined with this collection acting as a derivation/rollup source (#739) \u2014 the tier-aware pre-move decode \`syncDerived\` uses on elevate()/demote() does not resolve CRDT state, so a registered derivation/rollup reads raw CrdtState instead of the record and silently no-ops. Use a non-CRDT collection for a tiered derivation/rollup source, or move the derivation off this collection.`
+    );
+  }
+  const effectiveViaFields = mergeViaFields(opts);
+  const resolvedClassified = opts.classifiedFields !== void 0 ? resolveClassifiedFields(opts.name, opts.classifiedFields) : void 0;
+  const allComputed = unifyComputedFields(opts, effectiveViaFields.computedFields);
+  const materializedComputed = {};
+  for (const [field, entry] of Object.entries(allComputed)) {
+    if (computedEntryParts(entry).mode !== "virtual") materializedComputed[field] = entry;
+  }
+  let mergedComputed = Object.keys(materializedComputed).length > 0 ? materializedComputed : void 0;
+  if (resolvedClassified !== void 0) {
+    for (const key of Object.keys(allComputed)) {
+      if (resolvedClassified.riderComputed[key] !== void 0) {
+        throw new ClassifiedConfigError(opts.name, `computed field "${key}" collides with a rider companion`);
+      }
+    }
+    mergedComputed = { ...resolvedClassified.riderComputed, ...materializedComputed };
+  }
+  let deterministicFields;
+  if (opts.deterministicFields && opts.deterministicFields.length > 0) {
+    if (opts.acknowledgeDeterministicRisk !== true) {
+      throw new Error(
+        `Collection "${opts.name}": deterministicFields requires \`acknowledgeDeterministicRisk: true\`. Deterministic encryption leaks equality between records \u2014 two records with the same field value produce identical ciphertexts visible to anyone with store access. If that trade-off is acceptable for your threat model, set \`acknowledgeDeterministicRisk: true\` to enable.`
+      );
+    }
+    deterministicFields = Object.freeze(new Set(opts.deterministicFields));
+  } else {
+    deterministicFields = null;
+  }
+  const guardIndexedFields = /* @__PURE__ */ new Set();
+  for (const ix of opts.indexes ?? []) {
+    if (typeof ix === "string") guardIndexedFields.add(ix);
+    else if (Array.isArray(ix)) for (const f of ix) guardIndexedFields.add(f);
+    else for (const f of ix.fields) guardIndexedFields.add(f);
+  }
+  const embeddingSources = opts.embeddings === void 0 ? [] : typeof opts.embeddings.source === "string" ? [opts.embeddings.source] : [...opts.embeddings.source];
+  const classifiedGuardCtx = {
+    perRecordKeys: opts.perRecordKeys === true,
+    crdt: opts.crdt !== void 0,
+    hasConflictPolicy: opts.conflictPolicy !== void 0,
+    storeCiphertext: opts.encrypted,
+    deterministicFields,
+    indexedFields: guardIndexedFields,
+    textIndexFields: new Set(opts.textIndexes ?? []),
+    vectorSourceFields: new Set(embeddingSources),
+    subjectKeyField: opts.subjectKeyField,
+    bareSensitiveFields: new Set(opts.sensitive ?? []),
+    acknowledgeEquatableRisk: opts.acknowledgeEquatableRisk === true
+  };
+  if (resolvedClassified !== void 0) {
+    guardClassifiedCompat(opts.name, resolvedClassified.byField, classifiedGuardCtx);
+  }
+  const classifiedSensitive = resolvedClassified === void 0 ? [] : Object.entries(resolvedClassified.byField).filter(([, s]) => s.storage === "recoverable").map(([f]) => f);
+  const sensitiveList = [...opts.sensitive ?? [], ...classifiedSensitive];
+  const sensitiveFields = sensitiveList.length > 0 ? Object.freeze(new Set(sensitiveList)) : Object.freeze(/* @__PURE__ */ new Set());
+  const vdigEntries = resolvedClassified === void 0 ? [] : Object.entries(resolvedClassified.byField).filter(([, s]) => s.storage === "digest-only").map(([f, s]) => [f, {
+    normalize: s.verifyNormalize ?? "password",
+    notLastN: s.notLastN ?? 0,
+    equatable: s.equatable === true,
+    ...s.rotateDays !== void 0 ? { rotateDays: s.rotateDays } : {}
+  }]);
+  const vdigFields = vdigEntries.length > 0 ? new Map(vdigEntries) : null;
+  const perRecordCek = opts.perRecordKeys === true;
+  const cekCache = perRecordCek ? new Lru({ maxRecords: 4096 }) : null;
+  const viaEraseCfgOut = {};
+  const via2 = ViaPipeline.build(compileVias(opts, classifiedGuardCtx, viaEraseCfgOut));
+  const knownFields = collectKnownFieldNames({
+    moneyFields: effectiveViaFields.moneyFields,
+    i18nFields: effectiveViaFields.i18nFields,
+    dictKeyFields: effectiveViaFields.dictKeyFields,
+    classifiedFields: resolvedClassified?.byField,
+    computed: allComputed,
+    lookupFields: effectiveViaFields.lookupFields
+  });
+  const computedEdges = resolveComputedEdges(opts.name, allComputed, resolvedClassified !== void 0, knownFields);
+  const viaDepsEdges = resolveViaDepsEdges(opts.name, via2?.bindings ?? [], knownFields);
+  return {
+    adapter: opts.adapter,
+    vault: opts.vault,
+    name: opts.name,
+    keyring: opts.keyring,
+    storeCiphertext: opts.encrypted,
+    ramCiphertext: opts.ramCiphertext ?? false,
+    emitter: opts.emitter,
+    writeQueue: opts.writeQueue,
+    schemaUpdateGate: opts.schemaUpdateGate,
+    schemaFence: opts.schemaFence,
+    writeHooks: opts.writeHooks,
+    subsystemBus: opts.subsystemBus,
+    activeTxId: opts.activeTxId,
+    strategies: opts.strategies,
+    objectStore: opts.objectStore,
+    blobFields: opts.blobFields,
+    reconcileOnOpen: opts.reconcileOnOpen ?? "off",
+    getDEK: opts.getDEK,
+    onDirty: opts.onDirty,
+    tabCoordinated: opts.tabCoordinated,
+    historyConfig: opts.historyConfig ?? { enabled: true },
+    historyConfigExplicit: opts.historyConfigExplicit ?? false,
+    schema: opts.schema,
+    ledger: opts.ledger,
+    refEnforcer: opts.refEnforcer,
+    joinResolver: opts.joinResolver,
+    i18nFields: effectiveViaFields.i18nFields,
+    textIndexes: opts.textIndexes,
+    embeddings: opts.embeddings,
+    vectorSet: opts.embeddings ? new VectorSet() : void 0,
+    dictKeyFields: effectiveViaFields.dictKeyFields,
+    lookupFields: effectiveViaFields.lookupFields,
+    // #650 Task 6 — the sync join-dressing hook (#626 retirement, spec §5);
+    // `undefined` when this collection declares neither i18nText nor lookup
+    // fields, matching today's `i18nFields`-absent JoinableSource shape.
+    presentForJoin: buildPresentForJoin(effectiveViaFields.i18nFields, effectiveViaFields.lookupFields, opts.snapshotFor),
+    fieldMeta: opts.fieldMeta,
+    meta: opts.meta,
+    _refs: opts.declaredRefs ?? {},
+    via: via2,
+    classifiedEraseCfg: viaEraseCfgOut.classified,
+    moneyFields: effectiveViaFields.moneyFields,
+    classified: resolvedClassified,
+    classifiedGuardCtx,
+    computed: mergedComputed,
+    computedEdges,
+    viaDepsEdges,
+    // #638 Task 7 — every declared computed field name (both modes, both surfaces); the
+    // reconcile path's cross-call depsless-computed leak-guard memory
+    // (`via/graph-wiring.ts#registerCollectionGraphSources`) reads this instead of
+    // `Object.keys(opts.computed ?? {})` alone, so a via(computed(...))-declared field
+    // participates in that guard identically to a sugar-declared one.
+    computedFieldNames: Object.keys(allComputed),
+    dictLabelResolver: opts.dictLabelResolver,
+    getDictionary: opts.getDictionary,
+    i18nPutValidator: opts.i18nPutValidator,
+    autoTranslateHook: opts.autoTranslateHook,
+    defaultLocale: opts.defaultLocale,
+    crdtMode: opts.crdt,
+    syncAdapter: opts.syncAdapter,
+    onAccess: opts.onAccess,
+    derivationSource: opts.derivationSource,
+    materializedViewSource: opts.materializedViewSource,
+    graphDispatch: opts.graphDispatch,
+    tiers: opts.tiers && opts.tiers.length > 0 ? new Set(opts.tiers) : null,
+    tierMode: opts.tierMode ?? "invisibility",
+    blobTierPolicy: opts.blobTierPolicy ?? "isolate",
+    onCrossTierAccess: opts.onCrossTierAccess,
+    addSubjectRef: opts.addSubjectRef,
+    deterministicFields,
+    sensitiveFields,
+    vdigFields,
+    perRecordCek,
+    cekCache,
+    provenance: opts.provenance === true
+  };
+}
+
+// src/kernel/via/graph.ts
+var DEFAULT_POSTURE = { encryptedAtRest: "envelope", queryable: "full", exportable: true, forgettable: false };
+var QUERYABLE_RANK = {
+  none: 0,
+  "det-exact": 1,
+  ordered: 2,
+  full: 3
+};
+function foldPosture(a, b) {
+  return {
+    encryptedAtRest: a.encryptedAtRest === "sealed" || b.encryptedAtRest === "sealed" ? "sealed" : "envelope",
+    queryable: QUERYABLE_RANK[a.queryable] <= QUERYABLE_RANK[b.queryable] ? a.queryable : b.queryable,
+    exportable: a.exportable && b.exportable,
+    forgettable: a.forgettable || b.forgettable
+  };
+}
+function foldWildcardSecurity(base, contributor) {
+  return {
+    encryptedAtRest: base.encryptedAtRest === "sealed" || contributor.encryptedAtRest === "sealed" ? "sealed" : "envelope",
+    queryable: base.queryable,
+    exportable: base.exportable && contributor.exportable,
+    forgettable: base.forgettable || contributor.forgettable
+  };
+}
+var FOLDED_KINDS = /* @__PURE__ */ new Set(["derivation", "rollup", "mv", "overlay"]);
+function isDefaultPosture(p) {
+  return p.encryptedAtRest === DEFAULT_POSTURE.encryptedAtRest && p.queryable === DEFAULT_POSTURE.queryable && p.exportable === DEFAULT_POSTURE.exportable && p.forgettable === DEFAULT_POSTURE.forgettable;
+}
+var SEP = "\0";
+var EMPTY_SET = /* @__PURE__ */ new Set();
+function nodeId(ref) {
+  return `${ref.collection}${SEP}${ref.field}`;
+}
+function displayNodeId(id) {
+  const sep = id.indexOf(SEP);
+  return `${id.slice(0, sep)}.${id.slice(sep + 1)}`;
+}
+var ViaGraph = class {
+  /** Declared source-field postures (registerField), keyed by node id. */
+  _posture = /* @__PURE__ */ new Map();
+  /** Every derived target's registration, keyed by the target's node id. */
+  _in = /* @__PURE__ */ new Map();
+  /** source node id -> derived edges that depend on it (dispatch/erasure), each carrying
+   *  its own registration's `kind` (#678 — see {@link OutEdge}). */
+  _out = /* @__PURE__ */ new Map();
+  /** Memoized effective posture per derived target node id. */
+  _effectiveCache = /* @__PURE__ */ new Map();
+  /** Memoized whole-collection security-axes fold for `'*'` wildcard LEAF nodes (#642),
+   *  keyed by collection name — see {@link _wildcardContribution}. Cleared alongside
+   *  `_effectiveCache` on every `registerField`/`registerDerived` (a later-registered
+   *  field must re-fold on the next read — registration ordering is free). */
+  _wildcardCache = /* @__PURE__ */ new Map();
+  /** Collections with at least one classified field (#638 Task 2 fix wave 2,
+   *  Finding I1 — the reconcile path's combined-state leak guard memory). */
+  _classifiedCollections = /* @__PURE__ */ new Set();
+  /** Computed field names declared with no `deps` entry, per collection
+   *  (Finding I1 — such a field registers no edge when no classified field is
+   *  present yet, so a LATER, separate reconcile call attaching classifiedFields
+   *  still needs to see it regardless of declaration order). */
+  _depslessComputed = /* @__PURE__ */ new Map();
+  /** Declare a source field's posture (money/i18n/classified/plain). Plain fields
+   *  default to `DEFAULT_POSTURE`; a later declaration for the same node wins-first (idempotent). */
+  registerField(collection, field, posture) {
+    const id = nodeId({ collection, field });
+    if (this._posture.has(id)) return;
+    this._posture.set(id, posture);
+    this._effectiveCache.clear();
+    this._wildcardCache.clear();
+  }
+  /** A derived target depends on `sources` (may be cross-collection). `kind`/`grain`
+   *  drive dispatch + erasure semantics; sources drive taint. Re-registering the same
+   *  target replaces `_in` but does not prune stale `_out` edges — callers must
+   *  register each target at most once per graph lifetime. `onDelete`/`keyField` (#650 Task 5)
+   *  are meaningful only for `kind === 'ref'` edges — {@link referencingEdgesOf} reads them back. */
+  registerDerived(target, sources, kind, grain, onDelete, keyField) {
+    const id = nodeId(target);
+    this._in.set(id, {
+      target,
+      sources,
+      kind,
+      grain,
+      ...onDelete !== void 0 ? { onDelete } : {},
+      ...keyField !== void 0 ? { keyField } : {}
+    });
+    for (const source of sources) {
+      const sourceId = nodeId(source);
+      const outEdge = { target, kind };
+      const dependents = this._out.get(sourceId);
+      if (dependents) dependents.push(outEdge);
+      else this._out.set(sourceId, [outEdge]);
+    }
+    this._effectiveCache.clear();
+    this._wildcardCache.clear();
+  }
+  /** Whether `target` already has a registered in-edge — lets a caller skip
+   *  re-registering the same target (#638 Task 2 fix wave 2, Finding I2i:
+   *  `registerDerived`'s at-most-once contract must hold across repeated
+   *  identical `vault.collection()` calls, not just within a single one). */
+  hasDerived(target) {
+    return this._in.has(nodeId(target));
+  }
+  /** Mark/query a collection as having declared at least one classified field. */
+  markClassified(collection) {
+    this._classifiedCollections.add(collection);
+  }
+  isClassified(collection) {
+    return this._classifiedCollections.has(collection);
+  }
+  /** Mark/query a collection's depsless (no declared `deps`) computed
+   *  field names — see `_depslessComputed`'s doc comment above. */
+  markDepslessComputed(collection, field) {
+    let set = this._depslessComputed.get(collection);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      this._depslessComputed.set(collection, set);
+    }
+    set.add(field);
+  }
+  depslessComputedFields(collection) {
+    return this._depslessComputed.get(collection) ?? EMPTY_SET;
+  }
+  /** Every field name the graph already has memory of for `collection` — from an
+   *  EARLIER, separate `vault.collection()` call (registered postures, derived
+   *  targets, depsless-computed names) — regardless of which via feature declared
+   *  it. #645 — `via/graph-wiring.ts`'s reconcile-path `knownFields` universe
+   *  (`collectKnownFieldNames`) is scoped to THIS call's own options only, so a
+   *  computed field attached in a LATER call whose `deps` correctly names a field
+   *  declared in an EARLIER call was spuriously refused as "unknown"; this method
+   *  lets that call site union in the graph's cross-call memory. Excludes the `'*'`
+   *  wildcard target (an overlay/derivation whole-record fold node, never a real
+   *  record field — see {@link registerDerived}'s doc comment). */
+  knownFieldNames(collection) {
+    const out = /* @__PURE__ */ new Set();
+    const prefix = `${collection}${SEP}`;
+    for (const id of this._posture.keys()) {
+      if (id.startsWith(prefix)) out.add(id.slice(prefix.length));
+    }
+    for (const edge of this._in.values()) {
+      if (edge.target.collection === collection && edge.target.field !== "*") out.add(edge.target.field);
+    }
+    const depsless = this._depslessComputed.get(collection);
+    if (depsless) for (const field of depsless) out.add(field);
+    return out;
+  }
+  /** Reject cycles at declare time (vault open). Throws `DerivationCycleError` for a
+   *  derivation/rollup/computed cycle, `MaterializedViewCycleError` for an MV cycle —
+   *  same classes + message shape the registries throw today (behavior lock). */
+  assertAcyclic() {
+    const visited = /* @__PURE__ */ new Set();
+    const stack = [];
+    const notRefEdge = (entry) => entry.kind !== "ref";
+    const neighboursOf = (id) => {
+      const own = (this._out.get(id) ?? []).filter(notRefEdge).map((entry) => entry.target);
+      const sep = id.indexOf(SEP);
+      if (id.slice(sep + 1) === "*") return own;
+      const wildcard = (this._out.get(`${id.slice(0, sep)}${SEP}*`) ?? []).filter(notRefEdge).map((entry) => entry.target);
+      if (wildcard.length === 0) return own;
+      return [...own, ...wildcard];
+    };
+    const visit = (id) => {
+      const idx = stack.indexOf(id);
+      if (idx !== -1) {
+        const cycle = stack.slice(idx).concat(id);
+        const isMv = cycle.some((cycleId) => this._in.get(cycleId)?.kind === "mv");
+        const path = cycle.map(displayNodeId);
+        if (isMv) throw new MaterializedViewCycleError(path);
+        throw new DerivationCycleError(path);
+      }
+      if (visited.has(id)) return;
+      stack.push(id);
+      for (const dependent of neighboursOf(id)) visit(nodeId(dependent));
+      stack.pop();
+      visited.add(id);
+    };
+    for (const id of this._out.keys()) visit(id);
+  }
+  /** A leaf (non-derived) node's own posture contribution: its declared posture,
+   *  or `DEFAULT_POSTURE` if never declared via `registerField`. */
+  _declaredPosture(id) {
+    return this._posture.get(id) ?? DEFAULT_POSTURE;
+  }
+  /** A node's posture contribution when folded into a dependent: recurse if it is itself
+   *  derived; else its declared/default posture — UNLESS it is a `'*'` LEAF node consumed
+   *  by a folded formula kind (#642, `derivation|rollup|mv|overlay`), in which case it
+   *  contributes its collection's whole-record security fold ({@link _wildcardContribution}).
+   *  `kind` is the CONSUMING edge's kind, threaded from {@link _computeEffective}. `'ref'`
+   *  edges (and the provenance-only untyped call, `kind` left `undefined`) keep `'*'` =
+   *  identity — the phase-D lookup reliance (`via/lookup/registry.ts:392-397`) that a
+   *  referencing field must not seal just because its dimension collection has a classified
+   *  column. */
+  _contribution(id, kind) {
+    const edge = this._in.get(id);
+    if (edge) return this._computeEffective(id, edge);
+    if (kind !== void 0 && FOLDED_KINDS.has(kind) && id.endsWith(`${SEP}*`)) {
+      return this._wildcardContribution(id.slice(0, -2));
+    }
+    return this._declaredPosture(id);
+  }
+  /** Lazy fold (#642) of a collection's REGISTERED field postures on the security axes only
+   *  ({@link foldWildcardSecurity} — sealed-wins encryptedAtRest, AND exportable, OR
+   *  forgettable; queryable stays at DEFAULT_POSTURE's 'full', never folded), seeded at
+   *  DEFAULT_POSTURE. This is the collection-level posture a `'*'` LEAF node contributes to a
+   *  folded-kind formula edge (derivation/rollup/mv/overlay) — see {@link _contribution}. A
+   *  plain (unregistered) field contributes nothing (the identity), so the fold is strictly
+   *  more conservative than deps-based taint and never hits the KNOWN-LIMIT wall (it names no
+   *  fields — seam map §1d). Memoized per collection in `_wildcardCache`. */
+  _wildcardContribution(collection) {
+    const cached = this._wildcardCache.get(collection);
+    if (cached) return cached;
+    let result = DEFAULT_POSTURE;
+    const prefix = `${collection}${SEP}`;
+    for (const [id, posture] of this._posture) {
+      if (!id.startsWith(prefix) || id === `${prefix}*`) continue;
+      result = foldWildcardSecurity(result, posture);
+    }
+    this._wildcardCache.set(collection, result);
+    return result;
+  }
+  _computeEffective(id, edge) {
+    const cached = this._effectiveCache.get(id);
+    if (cached) return cached;
+    let result = DEFAULT_POSTURE;
+    for (const source of edge.sources) {
+      result = foldPosture(result, this._contribution(nodeId(source), edge.kind));
+    }
+    if (edge.grain === "virtual" && result.queryable !== "none") {
+      result = { ...result, queryable: "none" };
+    }
+    this._effectiveCache.set(id, result);
+    return result;
+  }
+  /** Strictest source posture on every axis, per §2. `undefined` when `target` has no
+   *  in-edges (not a derived field). Transitive: folds through chained derivations. */
+  effectivePosture(target) {
+    const id = nodeId(target);
+    const edge = this._in.get(id);
+    if (!edge) return void 0;
+    return this._computeEffective(id, edge);
+  }
+  /** Per-collection { field → effectivePosture } overlay the pipeline consumes (Task 3). */
+  taintedPostures(collection) {
+    const out = /* @__PURE__ */ new Map();
+    for (const edge of this._in.values()) {
+      if (edge.target.collection !== collection) continue;
+      out.set(edge.target.field, this._computeEffective(nodeId(edge.target), edge));
+    }
+    return out;
+  }
+  /** Materialized (`grain !== 'virtual'`) derived fields on `collection` whose effective
+   *  encryptedAtRest resolves to 'sealed' — the taint-seal set (Task 3). #638 Task 7
+   *  makes the `grain !== 'virtual'` filter meaningful: a `computed(fn, { mode: 'virtual' })`
+   *  field is never stored (rides the `present` phase, seam map Part 4's money-Formatted/
+   *  i18n-Label precedent), so it is EXCLUDED here even when its effective `encryptedAtRest`
+   *  folds to `'sealed'` — there is no envelope slot to seal. It still surfaces in
+   *  {@link taintedPostures} (query refusal via `postureFor`'s `queryable` clamp above, and
+   *  export refusal via `exportable`) — only the AT-REST SEALING ACTION is skipped. */
+  taintSealedFields(collection) {
+    const out = /* @__PURE__ */ new Set();
+    for (const edge of this._in.values()) {
+      if (edge.target.collection !== collection || edge.grain === "virtual") continue;
+      const posture = this._computeEffective(nodeId(edge.target), edge);
+      if (posture.encryptedAtRest === "sealed") out.add(edge.target.field);
+    }
+    return out;
+  }
+  /** Fields on `collection` whose registered edge is `grain === 'virtual'` (#638 Task 7) —
+   *  `via/graph-wiring.ts#applyTaintOverlay` intersects this with `exportable === false`
+   *  postures to know which virtual fields need PRESENT-TIME (not just export-time)
+   *  redaction, since a virtual field's value is only ever materialized inside `present()`. */
+  virtualFields(collection) {
+    const out = /* @__PURE__ */ new Set();
+    for (const edge of this._in.values()) {
+      if (edge.target.collection === collection && edge.grain === "virtual") out.add(edge.target.field);
+    }
+    return out;
+  }
+  /** Per-collection { field → immediate source field names that forced its
+   *  effective posture away from `DEFAULT_POSTURE` } — `describe()`'s
+   *  provenance (Task 3). Only the DIRECT declared sources are named (not the
+   *  ultimate origin several hops up a transitive chain); a source absent
+   *  from the result contributed nothing restrictive. */
+  taintProvenance(collection) {
+    const out = /* @__PURE__ */ new Map();
+    for (const edge of this._in.values()) {
+      if (edge.target.collection !== collection) continue;
+      const forcedBy = edge.sources.filter((source) => !isDefaultPosture(this._contribution(nodeId(source)))).map((source) => source.field);
+      if (forcedBy.length > 0) out.set(edge.target.field, forcedBy);
+    }
+    return out;
+  }
+  _targetsDependingOn(collection) {
+    const out = [];
+    for (const edge of this._in.values()) {
+      if (edge.sources.some((source) => source.collection === collection)) {
+        out.push({ target: edge.target, kind: edge.kind, grain: edge.grain });
+      }
+    }
+    return out;
+  }
+  /** Dispatch (Task 4): every derived target triggered by a write to `collection`. Excludes
+   *  `'ref'` edges (#650 Task 5 review, folded Minor) — a `'ref'` edge is consulted only by the
+   *  delete/forget-time restrict/cascade/nullify path ({@link referencingEdgesOf}), never by the
+   *  sync/cutover/restore dispatch wave (`runGraphDispatchWave`); counting it here defeated that
+   *  wave's zero-cost early-continue, costing every write to a referenced backing collection an
+   *  unconditional decrypt + two no-op dispatch passes. {@link derivedArtifactsOf} (erasure
+   *  fanout) still includes `'ref'` edges — the forget path genuinely needs them. */
+  dependentsOf(collection) {
+    return this._targetsDependingOn(collection).filter((edge) => edge.kind !== "ref");
+  }
+  /** Erasure (Task 6): derived artifacts of a forgotten record whose source is `collection`. */
+  derivedArtifactsOf(collection) {
+    return this._targetsDependingOn(collection);
+  }
+  /** Referencing edges pointing AT a backing dimension (delete/forget-time restrict/cascade/
+   *  nullify, #650 Task 5) — an O(1) reverse lookup via the existing `_out` map (keyed at the
+   *  dimension's wildcard `field:'*'` node, the same convention every whole-collection source
+   *  already uses), NEVER a scan across collections or records. `backing` is the collection name
+   *  a lookup field's edge was registered against (a reserved dimension's `_dict_<name>`/
+   *  `_lookup_<name>` collection name, or a matrix dimension's own collection name). */
+  referencingEdgesOf(backing) {
+    const targets = this._out.get(nodeId({ collection: backing, field: "*" }));
+    if (!targets) return [];
+    const out = [];
+    for (const entry of targets) {
+      if (entry.kind !== "ref") continue;
+      const edge = this._in.get(nodeId(entry.target));
+      if (edge?.onDelete !== void 0) {
+        out.push({ referencing: entry.target, onDelete: edge.onDelete, keyField: edge.keyField ?? "id" });
+      }
+    }
+    return out;
+  }
+};
+
+export {
+  ViaPipeline,
+  EXPORT_REDACTION_MARKER,
+  exportRedact,
+  schemaFieldKeys,
+  deriveZodFields,
+  resolveDescribeFieldIds,
+  buildDescription,
+  via,
+  isViaFieldSpec,
+  mergeViaFields,
+  guardReconcileCollisions,
+  computedEntryParts,
+  matchTargetFieldNames,
+  resolveVirtualMoneyFields,
+  collectKnownFieldNames,
+  resolveComputedEdges,
+  resolveCollectionConfig,
+  DEFAULT_POSTURE,
+  ViaGraph
+};
+//# sourceMappingURL=chunk-2C3AQB46.js.map