@noy-db/hub 0.7.0-pre.9 → 0.7.1-pre.0

package/dist/cargo/index.js

@@ -5,74 +5,74 @@ import {
   describeExtraction,
   unsealDeks,
   withCargo
-} from "../chunk-MQPHKJ74.js";
-import {
-  extractPartition,
-  walkClosure
-} from "../chunk-7XT7KZTN.js";
+} from "../chunk-DFMWUOU5.js";
 import {
   diffVault
 } from "../chunk-LFUID7OW.js";
+import {
+  extractPartition,
+  walkClosure
+} from "../chunk-3PGS7TYR.js";
 import {
   createDeedOwner,
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-HLFLJCDX.js";
-import "../chunk-5EC7X5QA.js";
-import "../chunk-P22XPNFW.js";
+} from "../chunk-2N5ML6HT.js";
+import "../chunk-3BVH633C.js";
+import "../chunk-JVIBCBC7.js";
 import {
   NO_CARGO
-} from "../chunk-FKQCC4C5.js";
-import "../chunk-JUBWUJY5.js";
+} from "../chunk-NQKIUNW5.js";
+import "../chunk-4GVM6QZA.js";
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-GHADG5QZ.js";
-import "../chunk-I5LSKXT6.js";
+} from "../chunk-VTFVLCUH.js";
 import {
   CustodyApi
-} from "../chunk-K432FT7T.js";
-import "../chunk-RCONOOVF.js";
-import "../chunk-NMDMSHBF.js";
+} from "../chunk-UHHPLO3I.js";
+import "../chunk-SGZAIJCV.js";
+import "../chunk-BVN6KXL2.js";
+import "../chunk-EQEYOJBM.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
-import "../chunk-HS3LEVT4.js";
+import "../chunk-HIWCKBEY.js";
 import {
   groupAndReduce,
   reduceRecords
-} from "../chunk-4U52PMEL.js";
+} from "../chunk-ZN4FD4PE.js";
 import "../chunk-XZHEOSQ2.js";
 import "../chunk-ATL3ZVXT.js";
 import {
   readPath
 } from "../chunk-NSITFOCJ.js";
-import "../chunk-DIVY2CJZ.js";
-import "../chunk-YHIAWECL.js";
-import "../chunk-OHGCRKWA.js";
-import "../chunk-MV2OEK3K.js";
-import "../chunk-DZPMKY3J.js";
+import "../chunk-TRGTKX5E.js";
+import "../chunk-UXVWEX5L.js";
+import "../chunk-3V4KWFX7.js";
+import "../chunk-XKWGNJ26.js";
+import "../chunk-UGTBXF5U.js";
 import {
   generateULID
 } from "../chunk-4AOERLTV.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-OKCQNMO6.js";
+import "../chunk-V7ZRRCRJ.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-JRWLUWDM.js";
-import "../chunk-IZTU6RKH.js";
-import "../chunk-DOPZWTMJ.js";
-import "../chunk-4RUFYGWG.js";
-import "../chunk-XGXVPCYW.js";
-import "../chunk-CWFH36SI.js";
-import "../chunk-KZTPL7NL.js";
+import "../chunk-QPQUVOZ2.js";
+import "../chunk-JMGDHKQF.js";
+import "../chunk-4ZS56W5S.js";
+import "../chunk-SZJ3DLZA.js";
+import "../chunk-BRLKZUBT.js";
+import "../chunk-BTDR2PXY.js";
+import "../chunk-CHQCZZWC.js";
 import "../chunk-LP7BEXCT.js";
 import {
   sha256Hex
-} from "../chunk-USKHHOIV.js";
+} from "../chunk-HPVZCW43.js";
 import {
   NOYDB_ENVELOPE_GENERATION
-} from "../chunk-N4CHCXDL.js";
+} from "../chunk-7MG7SJT7.js";
 import {
   AdoptionStateError,
   CargoNotEnabledError,
@@ -87,8 +87,7 @@ import {
   UnknownShardError,
   ValidationError,
   VaultTemplateNotFoundError
-} from "../chunk-SW4TOSJL.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-7O3Y4PPD.js";
 export {
   AdoptionStateError,
   CargoNotEnabledError,

package/dist/{chunk-5UKIZIO3.js → chunk-2577DKXB.js}

@@ -1,6 +1,6 @@
 import {
   buildRecordEnvelope
-} from "./chunk-4RUFYGWG.js";
+} from "./chunk-SZJ3DLZA.js";
 
 // src/with-party/policy/storage.ts
 var META_COLLECTION = "_meta";
@@ -36,4 +36,4 @@ export {
   loadVaultPolicy,
   saveVaultPolicy
 };
-//# sourceMappingURL=chunk-5UKIZIO3.js.map
+//# sourceMappingURL=chunk-2577DKXB.js.map

package/dist/{chunk-SWFIXQF5.js → chunk-2ENE6445.js}

@@ -1,17 +1,17 @@
 import {
   PERIODS_COLLECTION
-} from "./chunk-Q2ZN5DWZ.js";
+} from "./chunk-FAHMLERK.js";
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-JRWLUWDM.js";
+} from "./chunk-QPQUVOZ2.js";
 import {
   isDeleteMarker
-} from "./chunk-4RUFYGWG.js";
+} from "./chunk-SZJ3DLZA.js";
 import {
   PeriodClosedError,
   ValidationError
-} from "./chunk-SW4TOSJL.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-audit/periods/periods.ts
 function resolveReopenState(events) {
@@ -124,7 +124,7 @@ function validatePeriodName(name, existing, partition) {
 }
 async function appendPeriodLedgerEntry(ledger, actor, envelope, name, collection = PERIODS_COLLECTION) {
   if (!ledger) return;
-  const { envelopePayloadHash } = await import("./ledger-ZAFULLAF.js");
+  const { envelopePayloadHash } = await import("./ledger-EDXFFZQL.js");
   await ledger.append({
     op: "put",
     collection,
@@ -198,4 +198,4 @@ export {
   purgeMarkersOn,
   withPeriods
 };
-//# sourceMappingURL=chunk-SWFIXQF5.js.map
+//# sourceMappingURL=chunk-2ENE6445.js.map

package/dist/{chunk-HLFLJCDX.js → chunk-2N5ML6HT.js}

@@ -1,25 +1,25 @@
 import {
   freezeSnapshotOnly
-} from "./chunk-5EC7X5QA.js";
+} from "./chunk-3BVH633C.js";
 import {
   resolveManagedSecret
-} from "./chunk-JUBWUJY5.js";
+} from "./chunk-4GVM6QZA.js";
 import {
   assertRosterTagValid,
   createOwnerKeyring,
   mintRosterTag,
   nextRosterEpoch,
   requireRosterKey
-} from "./chunk-OHGCRKWA.js";
+} from "./chunk-3V4KWFX7.js";
 import {
   buildRecordEnvelope
-} from "./chunk-4RUFYGWG.js";
+} from "./chunk-SZJ3DLZA.js";
 import {
   wrapKey
-} from "./chunk-USKHHOIV.js";
+} from "./chunk-HPVZCW43.js";
 import {
   PermissionDeniedError
-} from "./chunk-SW4TOSJL.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-party/team/deed.ts
 var DEED_RECORD_ID = "deed";
@@ -137,4 +137,4 @@ export {
   isDeedVault,
   liberateVault
 };
-//# sourceMappingURL=chunk-HLFLJCDX.js.map
+//# sourceMappingURL=chunk-2N5ML6HT.js.map

package/dist/{chunk-X6YRP5EC.js → chunk-334WSVOW.js}

@@ -1,16 +1,16 @@
 import {
   getHistory,
   historyIdentity
-} from "./chunk-TAJZ7GXO.js";
+} from "./chunk-AYX7AINO.js";
 import {
   liveRecordIsElevated
-} from "./chunk-IZTU6RKH.js";
+} from "./chunk-JMGDHKQF.js";
 import {
   openEnvelopeJson
-} from "./chunk-DOPZWTMJ.js";
+} from "./chunk-4ZS56W5S.js";
 import {
   ReadOnlyAtInstantError
-} from "./chunk-SW4TOSJL.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-commit/history/time-machine.ts
 var VaultInstant = class {
@@ -208,4 +208,4 @@ export {
   VaultInstant,
   CollectionInstant
 };
-//# sourceMappingURL=chunk-X6YRP5EC.js.map
+//# sourceMappingURL=chunk-334WSVOW.js.map

package/dist/{chunk-5EC7X5QA.js → chunk-3BVH633C.js}

@@ -1,16 +1,16 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-P22XPNFW.js";
+} from "./chunk-JVIBCBC7.js";
 import {
   buildRecordEnvelope
-} from "./chunk-4RUFYGWG.js";
+} from "./chunk-SZJ3DLZA.js";
 import {
   sha256Hex
-} from "./chunk-USKHHOIV.js";
+} from "./chunk-HPVZCW43.js";
 import {
   ReadOnlyError
-} from "./chunk-SW4TOSJL.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-audit/portability/withdraw-accessible.ts
 var FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
@@ -117,4 +117,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-5EC7X5QA.js.map
+//# sourceMappingURL=chunk-3BVH633C.js.map

package/dist/chunk-3BZZJJMQ.js

@@ -0,0 +1,176 @@
+import {
+  matchesReferencingValue
+} from "./chunk-R7BX2NB3.js";
+import {
+  PeriodClosedError
+} from "./chunk-7O3Y4PPD.js";
+
+// src/kernel/via/dispatch.ts
+function touchFor(batch, collection) {
+  let t = batch.get(collection);
+  if (!t) {
+    t = { puts: /* @__PURE__ */ new Set(), deletes: /* @__PURE__ */ new Map() };
+    batch.set(collection, t);
+  }
+  return t;
+}
+function resolveRollupDeleteIntents(registry, collectionName, deleted) {
+  if (!registry) return [];
+  const intents = [];
+  for (const { spec } of registry.strategiesForSource(collectionName)) {
+    if (!spec.rollup || spec.rollup.from !== collectionName) continue;
+    const kv = deleted[spec.rollup.key];
+    if (typeof kv === "string" || typeof kv === "number") intents.push({ into: spec.source, parentId: String(kv), field: spec.rollup.field });
+  }
+  return intents;
+}
+function findRollupSpecForIntent(registry, collectionName, intent) {
+  return registry?.strategiesForSource(collectionName).find((s) => s.spec.source === intent.into && s.spec.rollup?.field === intent.field && s.spec.rollup?.from === collectionName)?.spec;
+}
+var WaveContext = class {
+  _seen = /* @__PURE__ */ new Set();
+  seen(targetKey) {
+    if (this._seen.has(targetKey)) return true;
+    this._seen.add(targetKey);
+    return false;
+  }
+};
+async function runGraphDispatchWave(vault, batch) {
+  const wave = new WaveContext();
+  for (const [collectionName, touch] of batch) {
+    if (vault.graph.dependentsOf(collectionName).length === 0) continue;
+    const coll = vault._getCollection(collectionName);
+    if (!coll) continue;
+    for (const id of touch.puts) {
+      try {
+        const stored = await coll._getStoredRecordForDispatch(id);
+        if (!stored) continue;
+        await coll.dispatchDerivations(id, stored.record, stored.version, wave);
+        await coll.dispatchMaterializedViews(id, stored.record, wave);
+      } catch (err) {
+        console.warn(`[via-dispatch] wave recompute failed for ${collectionName}/${id}:`, err);
+        vault._emit("derivation:wave-error", { collection: collectionName, id, error: err });
+      }
+    }
+    for (const [id, intents] of touch.deletes) {
+      try {
+        await coll._recomputeDeletedRollups(intents, wave);
+        await coll.dispatchMaterializedViewsOnDelete(id);
+        await coll.dispatchArrayDerivationsOnDelete(id);
+      } catch (err) {
+        console.warn(`[via-dispatch] wave delete-recompute failed for ${collectionName}/${id}:`, err);
+        vault._emit("derivation:wave-error", { collection: collectionName, id, error: err });
+      }
+    }
+  }
+}
+async function putDerivedOutput(outColl, id, value, ctx, options) {
+  try {
+    await outColl.put(id, value, options);
+    return "written";
+  } catch (err) {
+    if (!(err instanceof PeriodClosedError)) throw err;
+    const targetCollection = outColl.name;
+    const event = {
+      source: ctx.source,
+      target: { collection: targetCollection, id },
+      period: err.periodName,
+      endDate: err.endDate
+    };
+    ctx.emit("derivation:skipped-frozen", event);
+    if (ctx.audit) await ctx.audit(event);
+    return "skipped-frozen";
+  }
+}
+function ledgerAuditHook(ledger, actor) {
+  if (!ledger) return void 0;
+  return async (e) => {
+    await ledger.append({
+      op: "lifecycle",
+      collection: e.target.collection,
+      id: e.target.id,
+      version: 0,
+      actor,
+      payloadHash: "",
+      reason: JSON.stringify({ event: "derivation-skipped-frozen", ...e })
+    });
+  };
+}
+async function forgetDerivedFanout(vault, ref, envelope, stats, lookupCompareKeys) {
+  const coll = vault._getCollection(ref.collection);
+  if (coll) {
+    const mv = await coll.dispatchMaterializedViewsOnDelete(ref.id);
+    stats.recordsErased += mv.deleted;
+    stats.derivedResidueUndecodable.push(...mv.residueUndecodable);
+    stats.derivedResidueDeclined.push(...mv.residueDeclined);
+  }
+  const edges = vault.graph.derivedArtifactsOf(ref.collection);
+  if (edges.length === 0 || !coll) return;
+  if (edges.some((e) => e.kind === "ref")) {
+    const { cascaded, nullified, residue } = await applyLookupRefsFanout(vault, ref.collection, ref.id, lookupCompareKeys);
+    stats.lookupReferencesCascaded += cascaded;
+    stats.lookupReferencesNullified += nullified;
+    stats.lookupReferencesResidue.push(...residue);
+  }
+  if (edges.some((e) => e.kind === "derivation")) {
+    stats.recordsErased += await coll.dispatchArrayDerivationsOnDelete(ref.id, true);
+  }
+  if (envelope && edges.some((e) => e.kind === "rollup")) {
+    const priorRecord = await coll._decodeEnvelope(envelope, ref.id);
+    if (priorRecord) {
+      for (const r of await coll.dispatchRollupsOnDelete(ref.id, priorRecord)) {
+        if (r.outcome === "written") stats.aggregatesRecomputed += 1;
+        else if (r.outcome === "skipped-frozen") stats.residueFrozen.push(`${r.into}:${r.parentId}`);
+      }
+    }
+  }
+}
+async function applyLookupRefsFanout(vault, backing, key, compareKeys) {
+  let cascaded = 0;
+  let nullified = 0;
+  const residue = [];
+  for (const { referencing, onDelete, keyField } of vault.graph.referencingEdgesOf(backing)) {
+    if (onDelete === "restrict") continue;
+    const compareKey = keyField === "id" ? key : compareKeys.get(keyField);
+    if (compareKey === void 0) {
+      residue.push(`${backing}:${key}:${referencing.collection}.${referencing.field}`);
+      continue;
+    }
+    const coll = vault._getCollection(referencing.collection);
+    if (!coll) continue;
+    const matches = (await coll.list()).filter((rec) => matchesReferencingValue(rec, referencing.field, compareKey));
+    for (const rec of matches) {
+      const id = rec["id"];
+      if (id === void 0) continue;
+      if (onDelete === "cascade") {
+        await coll.delete(id);
+        cascaded++;
+      } else if (onDelete === "nullify") {
+        await coll.put(id, { ...rec, [referencing.field]: null });
+        nullified++;
+      }
+    }
+  }
+  return { cascaded, nullified, residue };
+}
+function selfWriteFieldEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
+  try {
+    return JSON.stringify(a) === JSON.stringify(b);
+  } catch {
+    return false;
+  }
+}
+
+export {
+  touchFor,
+  resolveRollupDeleteIntents,
+  findRollupSpecForIntent,
+  runGraphDispatchWave,
+  putDerivedOutput,
+  ledgerAuditHook,
+  forgetDerivedFanout,
+  selfWriteFieldEqual
+};
+//# sourceMappingURL=chunk-3BZZJJMQ.js.map

package/dist/chunk-3BZZJJMQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/via/dispatch.ts"],"sourcesContent":["// kernel/via/dispatch.ts — the batched, origin-aware sync/cutover/restore dispatch wave\n// (Via port phase C, #638 Task 4, fixes #621).\n//\n// `Collection._onRecordMutated`'s `sync-apply`/`cutover`/`restore` cases feed touched\n// (collection, id) pairs into a per-session `GraphBatch` (owned by `Vault._collectGraphTouch`)\n// instead of dispatching inline — the `local-write` path keeps its own byte-identical inline\n// dispatch (`wave` stays `undefined` there, per the spec's behavior lock). At batch-flush time\n// `runGraphDispatchWave` decrypts each touched record (id threaded into the decrypt, matching\n// the phase-B at-rest contract) and re-runs the SAME `dispatchDerivations`/\n// `dispatchMaterializedViews` the local-write path uses, sharing one `WaveContext` so N touched\n// records feeding the SAME rollup/MV target recompute exactly once (per-target dedup).\n// See design-history/2026-07-11-via-phase-c-design.md §3.\n\nimport type { ViaGraph } from './graph.js'\nimport type { Collection } from '../collection.js'\nimport type { EncryptedEnvelope } from '../types.js'\nimport { PeriodClosedError } from '../errors.js'\nimport { matchesReferencingValue } from '../../port/with/lookup-strategy.js'\n\n/** One deleted child's resolved rollup PARENT intent (#640) — ids + a field name only. A\n *  resolved `parentId` is an id, same class as any touched record id — never a stored value. */\nexport interface RollupDeleteIntent {\n  readonly into: string\n  readonly parentId: string\n  readonly field: string\n}\n\n/** One collection's batched touches this session (#640 widens the #638 `Set<string>` shape):\n *  `puts` — the original semantics, unchanged; `deletes` — a deleted record's id mapped to its\n *  resolved rollup-parent intents, captured PRE-invalidation by `Collection._onRecordMutated`'s\n *  sync-apply delete case (the FK is only readable there — see `kernel/collection.ts\n *  #_rollupDeleteIntents`). */\nexport interface GraphTouch {\n  readonly puts: Set<string>\n  readonly deletes: Map<string, readonly RollupDeleteIntent[]>\n}\n\n/** Per-session touched set — collection → its `GraphTouch`. Metadata only — ids (collection\n *  names, record ids INCLUDING resolved rollup parent ids) and field names; NEVER record payload\n *  or key material. A resolved parentId is an id, same class as the touched ids — not a stored\n *  value. */\nexport type GraphBatch = Map<string, GraphTouch>\n\n/** Get-or-create `batch`'s `GraphTouch` entry for `collection` (#640) — shared by\n *  `Vault._collectGraphTouch`/`_collectGraphDelete` so each stays a one-line call. */\nexport function touchFor(batch: GraphBatch, collection: string): GraphTouch {\n  let t = batch.get(collection)\n  if (!t) {\n    t = { puts: new Set(), deletes: new Map() }\n    batch.set(collection, t)\n  }\n  return t\n}\n\n/** #640 — sync, I/O-free: `deleted`'s resolved rollup PARENT intents (the FK is only readable\n *  NOW, before the record is gone) — a pure function so `Collection._rollupDeleteIntents` stays\n *  a one-line delegator under the kernel-surface ceiling. `registry` is `this.derivationSource\n *  ?.registry()`; `collectionName` is `this.name` (the CHILD/`rollup.from` side). Generic over\n *  the registry's own spec shape so this file never imports a `with-formula` type (port-layering\n *  — via/dispatch.ts must not gain a with-* import). */\nexport function resolveRollupDeleteIntents<S extends { source: string; rollup?: { from: string; key: string; field: string } }>(\n  registry: { strategiesForSource(name: string): ReadonlyArray<{ spec: S }> } | undefined,\n  collectionName: string,\n  deleted: Record<string, unknown>,\n): RollupDeleteIntent[] {\n  if (!registry) return []\n  const intents: RollupDeleteIntent[] = []\n  for (const { spec } of registry.strategiesForSource(collectionName)) {\n    if (!spec.rollup || spec.rollup.from !== collectionName) continue\n    const kv = deleted[spec.rollup.key]\n    if (typeof kv === 'string' || typeof kv === 'number') intents.push({ into: spec.source, parentId: String(kv), field: spec.rollup.field })\n  }\n  return intents\n}\n\n/** #640 — resolve a `RollupDeleteIntent` back to its registry `spec`. The wave's per-intent\n *  driver needs `spec.rollup.compute`, which `GraphBatch`'s metadata-only pin forbids batching —\n *  so it's re-resolved here, post-boundary, instead of carried across it. `undefined` if the\n *  intent's originating strategy was unregistered between collect time and wave time (residual\n *  gap, freshness-only). */\nexport function findRollupSpecForIntent<S extends { source: string; rollup?: { from: string; field: string } }>(\n  registry: { strategiesForSource(name: string): ReadonlyArray<{ spec: S }> } | undefined,\n  collectionName: string,\n  intent: RollupDeleteIntent,\n): S | undefined {\n  return registry?.strategiesForSource(collectionName).find((s) => s.spec.source === intent.into && s.spec.rollup?.field === intent.field && s.spec.rollup?.from === collectionName)?.spec\n}\n\n/** One dedup ledger for a single wave — a target is recomputed at most once (mark-on-check). */\nexport class WaveContext {\n  private readonly _seen = new Set<string>()\n  seen(targetKey: string): boolean {\n    if (this._seen.has(targetKey)) return true\n    this._seen.add(targetKey)\n    return false\n  }\n}\n\n/** The slice of `Vault` the wave needs: the shared graph (the #553 zero-cost skip) and cached-\n *  collection lookup — never constructs, since a touched collection is, by construction,\n *  already open (it just fired `_onRecordMutated`). */\nexport interface VaultLike {\n  readonly graph: ViaGraph\n  _getCollection(name: string): Collection<Record<string, unknown>> | undefined\n  /** #640 (#644 item 3) — structured wave-error surfacing, additive to the existing console.warn. */\n  _emit(event: string, payload: unknown): void\n}\n\n/**\n * Run ONE dispatch wave for a completed batch: for each touched (collection, id), decrypt the\n * applied envelope (id threaded), then run the SAME `dispatchDerivations` +\n * `dispatchMaterializedViews` the local-write path uses — with a shared `WaveContext` so N\n * touched records feeding the SAME target recompute once. #553: a collection with no graph\n * out-edges (e.g. money-only) is skipped before any decrypt/dispatch async work.\n */\nexport async function runGraphDispatchWave(vault: VaultLike, batch: GraphBatch): Promise<void> {\n  const wave = new WaveContext()\n  for (const [collectionName, touch] of batch) {\n    if (vault.graph.dependentsOf(collectionName).length === 0) continue\n    const coll = vault._getCollection(collectionName)\n    if (!coll) continue\n    for (const id of touch.puts) {\n      try {\n        // Decrypt is INSIDE the per-id isolation boundary (whole-branch review Important\n        // finding, #638): an undecryptable synced envelope (`TamperedError`) must not\n        // escape `_getStoredRecordForDispatch` and abort the wave — that would propagate\n        // through `_flushGraphBatch` and reject the surrounding `SyncEngine.pull`/`push`\n        // AFTER records were already applied + meta persisted, starving every other\n        // touched target in the same batch.\n        const stored = await coll._getStoredRecordForDispatch(id)\n        if (!stored) continue\n        await coll.dispatchDerivations(id, stored.record, stored.version, wave)\n        await coll.dispatchMaterializedViews(id, stored.record, wave)\n      } catch (err) {\n        // #638 Task 5 review mandate: one touched record's recompute must not abort the\n        // whole wave (starving co-batched healthy targets) or the pull/push it's nested\n        // inside. `PeriodClosedError` never reaches here — `putDerivedOutput` already\n        // intercepts it at every output-write call site and turns it into a skip+event.\n        // Anything else (a genuine decrypt failure, a derive()/executor bug, a schema\n        // violation on the output, ...) is surfaced — not silently swallowed — via the\n        // SAME console.warn channel `dispatchDerivations`/the MV executor already use for\n        // their own non-strict-mode output failures, then isolated to just this one id.\n        // #644 item 3: ADDITIVELY (never in place of the warn) emit a structured event too,\n        // so a listener doesn't have to scrape console output to react to a wave failure.\n        console.warn(`[via-dispatch] wave recompute failed for ${collectionName}/${id}:`, err)\n        vault._emit('derivation:wave-error', { collection: collectionName, id, error: err })\n      }\n    }\n    // #640 — delete-kind touches: the deleted child's rollup-parent intents, resolved (sync,\n    // pre-invalidation) at collect time by `Collection._rollupDeleteIntents`. Same per-id\n    // isolation as the puts loop above. #658: the wave now ALSO heals MV rows and array-shape\n    // derivation output rows for the deleted child — parity with the local-delete boundary\n    // (`Collection._doDelete`'s `!internal` block, which already calls all three). Still never\n    // routed through `dispatchDerivations` (the mutation-choke-point.test.ts:85-99 pin — sync-\n    // applied deletes never RE-DERIVE); `dispatchMaterializedViewsOnDelete`/\n    // `dispatchArrayDerivationsOnDelete` only need `id` (MV refresh recomputes+diffs; array-\n    // derivation reads its per-source sidecar) and never call `derive()`, so the pin holds.\n    for (const [id, intents] of touch.deletes) {\n      try {\n        await coll._recomputeDeletedRollups(intents, wave)\n        // #658: record-shape same-id outputs are left untouched (eraseRecordShapeToo defaults\n        // false), matching local delete — the user deletes those directly if wanted.\n        // #658: TODO dedup MV refresh per wave — `dispatchMaterializedViewsOnDelete` doesn't\n        // accept a `WaveContext` (unlike the put-path `dispatchMaterializedViews`), so N deleted\n        // children of one eager MV in a batch each trigger a full refresh pass. Threading `wave`\n        // through would touch collection.ts's zero-slack kernel-surface ceiling for a perf-only\n        // win; correctness doesn't depend on it (idempotent per source-id) — left as a follow-up.\n        await coll.dispatchMaterializedViewsOnDelete(id)\n        await coll.dispatchArrayDerivationsOnDelete(id)\n      } catch (err) {\n        console.warn(`[via-dispatch] wave delete-recompute failed for ${collectionName}/${id}:`, err)\n        vault._emit('derivation:wave-error', { collection: collectionName, id, error: err })\n      }\n    }\n  }\n}\n\n/** A record's post-freeze source mutation, for the `'derivation:skipped-frozen'` event\n *  and the optional audit-trail entry. See {@link putDerivedOutput}. */\nexport interface DerivationSkippedFrozen {\n  readonly source: { readonly collection: string; readonly id: string }\n  readonly target: { readonly collection: string; readonly id: string }\n  readonly period: string\n  readonly endDate: string\n}\n\n/** The minimal put-capable shape `putDerivedOutput` needs. Any `Collection<T>` structurally\n *  satisfies this — its real `options` type is a superset of what's declared here. */\nexport interface CollectionLike {\n  put(id: string, value: unknown, options?: { readonly source?: string }): Promise<void>\n}\n\nexport interface PutDerivedOutputCtx {\n  readonly emit: (ev: string, p: unknown) => void\n  readonly source: { readonly collection: string; readonly id: string }\n  readonly audit?: ((e: DerivationSkippedFrozen) => Promise<void>) | undefined\n}\n\n/**\n * Attempt a dispatch-driven output write. On `PeriodClosedError` (the closed-period\n * `beforePut` gate — `freezePeriod`/`archivePeriod` add no separate gate, per seam map\n * Part 7): SKIP (no `_ts` stamped — the gate throws before any write happens), emit\n * `'derivation:skipped-frozen'` on the event bus (ALWAYS), and append an audit-trail entry\n * when the with-history ledger is active. Returns `'written' | 'skipped-frozen'`. Any OTHER\n * error propagates unchanged — this helper narrows exactly one error class. The SOURCE\n * write is never wrapped through this helper — only derived-output writes are (§7).\n */\nexport async function putDerivedOutput(\n  outColl: CollectionLike, id: string, value: unknown,\n  ctx: PutDerivedOutputCtx,\n  options?: { readonly source?: string },\n): Promise<'written' | 'skipped-frozen'> {\n  try {\n    await outColl.put(id, value, options)\n    return 'written'\n  } catch (err) {\n    if (!(err instanceof PeriodClosedError)) throw err\n    // Reach-around for the target collection's private `name` — the SAME pattern\n    // `with-formula/materialized-views/executor.ts`'s `listOutputIds` already uses to\n    // read a `Collection`'s private `adapter`/`vault`/`name` fields from outside the class.\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const targetCollection = (outColl as any).name as string\n    const event: DerivationSkippedFrozen = {\n      source: ctx.source,\n      target: { collection: targetCollection, id },\n      period: err.periodName,\n      endDate: err.endDate,\n    }\n    ctx.emit('derivation:skipped-frozen', event)\n    if (ctx.audit) await ctx.audit(event)\n    return 'skipped-frozen'\n  }\n}\n\n/** Structural (no static import — kernel spine may not statically reach a with-* service,\n *  the S4 gate recipe `check-architecture.mjs`'s port-layering check enforces) shape of the\n *  with-history `LedgerStore.append` seam this helper needs. */\ninterface AuditLedgerLike {\n  append(input: {\n    readonly op: 'lifecycle'\n    readonly collection: string\n    readonly id: string\n    readonly version: number\n    readonly actor: string\n    readonly payloadHash: string\n    readonly reason?: string\n  }): Promise<unknown>\n}\n\n/** @internal — the optional with-history ledger audit hook for `putDerivedOutput`, present\n *  only when the ledger is active (mirrors every other kernel event's `if (this.ledger)`\n *  gate). Encoded as a `'lifecycle'` entry — the existing \"non-data audit event\" op (the\n *  same convention `forget`'s JSON-summary-in-`reason` entry uses; `ledger/entry.ts:88-104`). */\nexport function ledgerAuditHook(\n  ledger: AuditLedgerLike | undefined, actor: string,\n): ((e: DerivationSkippedFrozen) => Promise<void>) | undefined {\n  if (!ledger) return undefined\n  return async (e) => {\n    await ledger.append({\n      op: 'lifecycle', collection: e.target.collection, id: e.target.id, version: 0, actor, payloadHash: '',\n      reason: JSON.stringify({ event: 'derivation-skipped-frozen', ...e }),\n    })\n  }\n}\n\n/** `recomputeRollup`/`dispatchRollupsOnDelete`'s per-target write outcome (#638 Task 6):\n *  `'written'`/`'skipped-frozen'` mirror {@link putDerivedOutput}'s result; `'noop'` covers\n *  no-parent/no-change/deduped-by-wave — nothing to report either way. */\nexport type RollupOutcome = 'written' | 'skipped-frozen' | 'noop'\n\n/** Mutable accumulator `forgetDerivedFanout` writes into, one per `Vault.forget()` call — keeps\n *  the per-ref loop's call site to a single line under vault.ts's tight kernel-surface ceiling.\n *  Maps 1:1 onto `ForgetResult`'s additive fields (`with-audit/forget/strategy.ts`). */\nexport interface ForgetFanoutStats {\n  recordsErased: number\n  aggregatesRecomputed: number\n  readonly residueFrozen: string[]\n  /** #650 Task 5 (#648) — referencing records tombstoned via a `'ref'` edge's `cascade` policy. */\n  lookupReferencesCascaded: number\n  /** #650 Task 5 (#648) — referencing fields cleared via a `'ref'` edge's `nullify` policy. */\n  lookupReferencesNullified: number\n  /** #650 Task 5 review (Important fix) — `'ref'` edges whose compare-key could NOT be resolved,\n   *  even from the LIVE pre-shred row (the backing row itself is unreadable) — propagation was\n   *  skipped for these, reported here so the skip is never silent. `backing:key:collection.field`\n   *  entries, one per un-propagated edge. */\n  readonly lookupReferencesResidue: string[]\n  /** #776/#782/#785 — `outputCollection:id` MV-output rows that survived erasure invalidation\n   *  (eager tombstone leg AND lazy/manual `invalidateMVAtRest`) despite belonging to the\n   *  forgotten subject, because the ownership stamp could not be decoded (undecodable under\n   *  the default DEK — e.g. elevated above tier 0 on a tiered output collection). Ownership\n   *  UNCONFIRMED. Never erased, but surfaced here rather than silently skipped. */\n  readonly derivedResidueUndecodable: string[]\n  /** #782/#785 — `outputCollection:id` MV-output rows that decoded and stamp-matched but whose\n   *  `_internalDelete` declined (the #718 tier-elevation gate). Ownership CONFIRMED, erasure\n   *  declined — a real silent survival, surfaced here rather than silently skipped. */\n  readonly derivedResidueDeclined: string[]\n}\n\n/**\n * #622 — after `_writeTombstone(ref.id, actor)` erases the forgotten subject's own record, fan\n * out to its derived residue via the graph (spec §5): record-grain artifacts (MV rows,\n * array-shape derivation rows, same-id record-shape derivation copies) are ERASED through the\n * SAME `!internal` housekeeping-bypass machinery the ordinary delete path uses (no user\n * `onDelete` re-fires — the shred-is-not-a-domain-delete property `_writeTombstone` protects);\n * aggregate-grain rollups are RECOMPUTED without the forgotten contribution in open periods, or\n * skip+audit (via `putDerivedOutput`, already wired into the rollup/MV output paths) in frozen\n * ones. Mutates `stats` in place. `envelope` is `ref`'s PRE-tombstone envelope, decoded only if\n * a rollup edge is actually present — the #553 zero-cost-skip discipline: no decrypt for the\n * common case of a forgotten record with no aggregate-grain consumer, and no work at all when\n * `ref.collection` has no graph out-edges. `lookupCompareKeys` is the `'ref'` edges' compare-key\n * map, resolved from the LIVE row BEFORE any shred (`VaultLinks.checkLookupRefsRestrict`'s return\n * value — `Vault.forget()`'s pre-shred restrict check doubles as the live-resolve pass) — see\n * {@link applyLookupRefsFanout}.\n */\nexport async function forgetDerivedFanout(\n  vault: VaultLike,\n  ref: { readonly collection: string; readonly id: string },\n  envelope: EncryptedEnvelope | null,\n  stats: ForgetFanoutStats,\n  lookupCompareKeys: ReadonlyMap<string, string | undefined>,\n): Promise<void> {\n  const coll = vault._getCollection(ref.collection)\n\n  // #761 item 4 — drive the MV arm off `dispatchMaterializedViewsOnDelete` UNCONDITIONALLY,\n  // ABOVE the `edges` check below: `registry.edges()` drops the same-collection\n  // partition-disjoint MV edge (registry.ts's `sources.length === 0 → continue`), so a\n  // same-collection MV's source collection never appears in `vault.graph`'s derived-artifact\n  // edges even though the MV IS registered — forget() would otherwise never reach it.\n  // `dispatchMaterializedViewsOnDelete` self-guards O(1) via `mvsForSource` (a no-op when\n  // this collection isn't an MV source), so this is safe to call unconditionally. Safe to\n  // route through the eager executor's tombstone leg ONLY because that leg is now\n  // stamp-scoped (#762) — before that fix this would have opened a NEW forget-time\n  // data-loss path into the unscoped tombstone diff.\n  if (coll) {\n    const mv = await coll.dispatchMaterializedViewsOnDelete(ref.id)\n    stats.recordsErased += mv.deleted\n    stats.derivedResidueUndecodable.push(...mv.residueUndecodable)\n    stats.derivedResidueDeclined.push(...mv.residueDeclined)\n  }\n\n  const edges = vault.graph.derivedArtifactsOf(ref.collection)\n  if (edges.length === 0 || !coll) return\n\n  // #650 Task 5 (#648) — 'ref' cascade/nullify propagate ADDITIVELY, here, AFTER the shred\n  // (restrict already refused BEFORE any shred — the caller's pre-tombstone check, spec §4).\n  // The I/O shell (loop shape, collection accessor) is duplicated, not imported, from\n  // `VaultLinks.applyLookupRefsPropagation`/`checkLookupRefsRestrict` (with-shape/links/\n  // vault-facade.ts) — the kernel spine may not statically import a with-* service\n  // (port-layering, the #638 Task 5 via/dispatch.ts precedent); `vault._getCollection` is\n  // cached-only while `VaultLinks`' accessor constructs. The pure match predicate itself is\n  // shared through the port seam (#651 Task 3 — `matchesReferencingValue`, `port/with/\n  // lookup-strategy.ts`), so only the shell, not the coercion logic, stays duplicated. A\n  // referencing edge whose dimension uses a non-default `key` (matrix tier only) needs the\n  // backing row's OWN value at that field, not its PUT-id — the row is ALREADY tombstoned by\n  // now, so it's read from `lookupCompareKeys`, resolved by the caller from the LIVE row\n  // BEFORE the shred (#650 Task 5 review, Important fix — eliminates the post-shred\n  // envelope-decode dependency this used to have, which silently skipped propagation whenever\n  // that decode failed).\n  if (edges.some((e) => e.kind === 'ref')) {\n    const { cascaded, nullified, residue } = await applyLookupRefsFanout(vault, ref.collection, ref.id, lookupCompareKeys)\n    stats.lookupReferencesCascaded += cascaded\n    stats.lookupReferencesNullified += nullified\n    stats.lookupReferencesResidue.push(...residue)\n  }\n\n  if (edges.some((e) => e.kind === 'derivation')) {\n    // #622 review Finding 1: count REAL erasures (dispatchArrayDerivationsOnDelete's own\n    // `_internalDelete`-backed tally), not the derivation EDGE count — an edge exists whenever\n    // this collection is ANY trigger (source/sources[]/triggerBy), but the same-id record-shape\n    // guard only erases for `spec.source === this.name`, and `derive()` may never have produced\n    // an output row (optional-skip) in the first place. Both cases must contribute 0, not +1.\n    stats.recordsErased += await coll.dispatchArrayDerivationsOnDelete(ref.id, true)\n  }\n\n  if (envelope && edges.some((e) => e.kind === 'rollup')) {\n    const priorRecord = await coll._decodeEnvelope(envelope, ref.id)\n    if (priorRecord) {\n      for (const r of await coll.dispatchRollupsOnDelete(ref.id, priorRecord)) {\n        if (r.outcome === 'written') stats.aggregatesRecomputed += 1\n        else if (r.outcome === 'skipped-frozen') stats.residueFrozen.push(`${r.into}:${r.parentId}`)\n      }\n    }\n  }\n}\n\n/**\n * Apply `cascade`/`nullify` propagation for `backing`'s non-restrict `'ref'` edges — the\n * forget-path counterpart of `VaultLinks.applyLookupRefsPropagation` (I/O shell duplicated, not\n * imported, match predicate shared via the port — see {@link forgetDerivedFanout}'s call site\n * comment). `restrict` edges are skipped here: the\n * forget loop's `checkLookupRefsRestrict`-equivalent call already refused (or the reference no\n * longer existed) BEFORE `_writeTombstone` ran, so by the time this runs only cascade/nullify\n * remain to propagate. `compareKeys` is the non-`'id'`-`keyField` compare-value map, resolved by\n * the caller from the LIVE row BEFORE the shred (#650 Task 5 review, Important fix) — the live row\n * is already shredded by the time THIS function runs, so it can no longer resolve one itself. A\n * `keyField` absent from (or `undefined` in) the map means that live resolve failed too — the edge\n * is reported as residue instead of silently skipped (never a bare `continue` with no trace).\n */\nasync function applyLookupRefsFanout(\n  vault: VaultLike,\n  backing: string,\n  key: string,\n  compareKeys: ReadonlyMap<string, string | undefined>,\n): Promise<{ cascaded: number; nullified: number; residue: string[] }> {\n  let cascaded = 0\n  let nullified = 0\n  const residue: string[] = []\n  for (const { referencing, onDelete, keyField } of vault.graph.referencingEdgesOf(backing)) {\n    if (onDelete === 'restrict') continue\n    const compareKey = keyField === 'id' ? key : compareKeys.get(keyField)\n    if (compareKey === undefined) {\n      residue.push(`${backing}:${key}:${referencing.collection}.${referencing.field}`)\n      continue\n    }\n    const coll = vault._getCollection(referencing.collection)\n    if (!coll) continue\n    const matches = (await coll.list()).filter((rec) => matchesReferencingValue(rec, referencing.field, compareKey))\n    for (const rec of matches) {\n      const id = rec['id'] as string | undefined\n      if (id === undefined) continue\n      if (onDelete === 'cascade') {\n        await coll.delete(id)\n        cascaded++\n      } else if (onDelete === 'nullify') {\n        await coll.put(id, { ...rec, [referencing.field]: null })\n        nullified++\n      }\n    }\n  }\n  return { cascaded, nullified, residue }\n}\n\n/**\n * Value-equality for a single self-write reverse-denorm field. Scalars\n * compare by identity; objects by canonical JSON (denorm values should be\n * deterministically shaped). Used as the cycle guard — when every denorm\n * field already matches, no write is issued and the self-write recursion ends.\n */\nexport function selfWriteFieldEqual(a: unknown, b: unknown): boolean {\n  if (a === b) return true\n  if (a === null || b === null || typeof a !== 'object' || typeof b !== 'object') return false\n  try {\n    return JSON.stringify(a) === JSON.stringify(b)\n  } catch {\n    return false\n  }\n}\n"],"mappings":";;;;;;;;AA6CO,SAAS,SAAS,OAAmB,YAAgC;AAC1E,MAAI,IAAI,MAAM,IAAI,UAAU;AAC5B,MAAI,CAAC,GAAG;AACN,QAAI,EAAE,MAAM,oBAAI,IAAI,GAAG,SAAS,oBAAI,IAAI,EAAE;AAC1C,UAAM,IAAI,YAAY,CAAC;AAAA,EACzB;AACA,SAAO;AACT;AAQO,SAAS,2BACd,UACA,gBACA,SACsB;AACtB,MAAI,CAAC,SAAU,QAAO,CAAC;AACvB,QAAM,UAAgC,CAAC;AACvC,aAAW,EAAE,KAAK,KAAK,SAAS,oBAAoB,cAAc,GAAG;AACnE,QAAI,CAAC,KAAK,UAAU,KAAK,OAAO,SAAS,eAAgB;AACzD,UAAM,KAAK,QAAQ,KAAK,OAAO,GAAG;AAClC,QAAI,OAAO,OAAO,YAAY,OAAO,OAAO,SAAU,SAAQ,KAAK,EAAE,MAAM,KAAK,QAAQ,UAAU,OAAO,EAAE,GAAG,OAAO,KAAK,OAAO,MAAM,CAAC;AAAA,EAC1I;AACA,SAAO;AACT;AAOO,SAAS,wBACd,UACA,gBACA,QACe;AACf,SAAO,UAAU,oBAAoB,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,WAAW,OAAO,QAAQ,EAAE,KAAK,QAAQ,UAAU,OAAO,SAAS,EAAE,KAAK,QAAQ,SAAS,cAAc,GAAG;AACtL;AAGO,IAAM,cAAN,MAAkB;AAAA,EACN,QAAQ,oBAAI,IAAY;AAAA,EACzC,KAAK,WAA4B;AAC/B,QAAI,KAAK,MAAM,IAAI,SAAS,EAAG,QAAO;AACtC,SAAK,MAAM,IAAI,SAAS;AACxB,WAAO;AAAA,EACT;AACF;AAmBA,eAAsB,qBAAqB,OAAkB,OAAkC;AAC7F,QAAM,OAAO,IAAI,YAAY;AAC7B,aAAW,CAAC,gBAAgB,KAAK,KAAK,OAAO;AAC3C,QAAI,MAAM,MAAM,aAAa,cAAc,EAAE,WAAW,EAAG;AAC3D,UAAM,OAAO,MAAM,eAAe,cAAc;AAChD,QAAI,CAAC,KAAM;AACX,eAAW,MAAM,MAAM,MAAM;AAC3B,UAAI;AAOF,cAAM,SAAS,MAAM,KAAK,4BAA4B,EAAE;AACxD,YAAI,CAAC,OAAQ;AACb,cAAM,KAAK,oBAAoB,IAAI,OAAO,QAAQ,OAAO,SAAS,IAAI;AACtE,cAAM,KAAK,0BAA0B,IAAI,OAAO,QAAQ,IAAI;AAAA,MAC9D,SAAS,KAAK;AAWZ,gBAAQ,KAAK,4CAA4C,cAAc,IAAI,EAAE,KAAK,GAAG;AACrF,cAAM,MAAM,yBAAyB,EAAE,YAAY,gBAAgB,IAAI,OAAO,IAAI,CAAC;AAAA,MACrF;AAAA,IACF;AAUA,eAAW,CAAC,IAAI,OAAO,KAAK,MAAM,SAAS;AACzC,UAAI;AACF,cAAM,KAAK,yBAAyB,SAAS,IAAI;AAQjD,cAAM,KAAK,kCAAkC,EAAE;AAC/C,cAAM,KAAK,iCAAiC,EAAE;AAAA,MAChD,SAAS,KAAK;AACZ,gBAAQ,KAAK,mDAAmD,cAAc,IAAI,EAAE,KAAK,GAAG;AAC5F,cAAM,MAAM,yBAAyB,EAAE,YAAY,gBAAgB,IAAI,OAAO,IAAI,CAAC;AAAA,MACrF;AAAA,IACF;AAAA,EACF;AACF;AAgCA,eAAsB,iBACpB,SAAyB,IAAY,OACrC,KACA,SACuC;AACvC,MAAI;AACF,UAAM,QAAQ,IAAI,IAAI,OAAO,OAAO;AACpC,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,EAAE,eAAe,mBAAoB,OAAM;AAK/C,UAAM,mBAAoB,QAAgB;AAC1C,UAAM,QAAiC;AAAA,MACrC,QAAQ,IAAI;AAAA,MACZ,QAAQ,EAAE,YAAY,kBAAkB,GAAG;AAAA,MAC3C,QAAQ,IAAI;AAAA,MACZ,SAAS,IAAI;AAAA,IACf;AACA,QAAI,KAAK,6BAA6B,KAAK;AAC3C,QAAI,IAAI,MAAO,OAAM,IAAI,MAAM,KAAK;AACpC,WAAO;AAAA,EACT;AACF;AAqBO,SAAS,gBACd,QAAqC,OACwB;AAC7D,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,OAAO,MAAM;AAClB,UAAM,OAAO,OAAO;AAAA,MAClB,IAAI;AAAA,MAAa,YAAY,EAAE,OAAO;AAAA,MAAY,IAAI,EAAE,OAAO;AAAA,MAAI,SAAS;AAAA,MAAG;AAAA,MAAO,aAAa;AAAA,MACnG,QAAQ,KAAK,UAAU,EAAE,OAAO,6BAA6B,GAAG,EAAE,CAAC;AAAA,IACrE,CAAC;AAAA,EACH;AACF;AAmDA,eAAsB,oBACpB,OACA,KACA,UACA,OACA,mBACe;AACf,QAAM,OAAO,MAAM,eAAe,IAAI,UAAU;AAYhD,MAAI,MAAM;AACR,UAAM,KAAK,MAAM,KAAK,kCAAkC,IAAI,EAAE;AAC9D,UAAM,iBAAiB,GAAG;AAC1B,UAAM,0BAA0B,KAAK,GAAG,GAAG,kBAAkB;AAC7D,UAAM,uBAAuB,KAAK,GAAG,GAAG,eAAe;AAAA,EACzD;AAEA,QAAM,QAAQ,MAAM,MAAM,mBAAmB,IAAI,UAAU;AAC3D,MAAI,MAAM,WAAW,KAAK,CAAC,KAAM;AAiBjC,MAAI,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,KAAK,GAAG;AACvC,UAAM,EAAE,UAAU,WAAW,QAAQ,IAAI,MAAM,sBAAsB,OAAO,IAAI,YAAY,IAAI,IAAI,iBAAiB;AACrH,UAAM,4BAA4B;AAClC,UAAM,6BAA6B;AACnC,UAAM,wBAAwB,KAAK,GAAG,OAAO;AAAA,EAC/C;AAEA,MAAI,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,YAAY,GAAG;AAM9C,UAAM,iBAAiB,MAAM,KAAK,iCAAiC,IAAI,IAAI,IAAI;AAAA,EACjF;AAEA,MAAI,YAAY,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ,GAAG;AACtD,UAAM,cAAc,MAAM,KAAK,gBAAgB,UAAU,IAAI,EAAE;AAC/D,QAAI,aAAa;AACf,iBAAW,KAAK,MAAM,KAAK,wBAAwB,IAAI,IAAI,WAAW,GAAG;AACvE,YAAI,EAAE,YAAY,UAAW,OAAM,wBAAwB;AAAA,iBAClD,EAAE,YAAY,iBAAkB,OAAM,cAAc,KAAK,GAAG,EAAE,IAAI,IAAI,EAAE,QAAQ,EAAE;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;AAeA,eAAe,sBACb,OACA,SACA,KACA,aACqE;AACrE,MAAI,WAAW;AACf,MAAI,YAAY;AAChB,QAAM,UAAoB,CAAC;AAC3B,aAAW,EAAE,aAAa,UAAU,SAAS,KAAK,MAAM,MAAM,mBAAmB,OAAO,GAAG;AACzF,QAAI,aAAa,WAAY;AAC7B,UAAM,aAAa,aAAa,OAAO,MAAM,YAAY,IAAI,QAAQ;AACrE,QAAI,eAAe,QAAW;AAC5B,cAAQ,KAAK,GAAG,OAAO,IAAI,GAAG,IAAI,YAAY,UAAU,IAAI,YAAY,KAAK,EAAE;AAC/E;AAAA,IACF;AACA,UAAM,OAAO,MAAM,eAAe,YAAY,UAAU;AACxD,QAAI,CAAC,KAAM;AACX,UAAM,WAAW,MAAM,KAAK,KAAK,GAAG,OAAO,CAAC,QAAQ,wBAAwB,KAAK,YAAY,OAAO,UAAU,CAAC;AAC/G,eAAW,OAAO,SAAS;AACzB,YAAM,KAAK,IAAI,IAAI;AACnB,UAAI,OAAO,OAAW;AACtB,UAAI,aAAa,WAAW;AAC1B,cAAM,KAAK,OAAO,EAAE;AACpB;AAAA,MACF,WAAW,aAAa,WAAW;AACjC,cAAM,KAAK,IAAI,IAAI,EAAE,GAAG,KAAK,CAAC,YAAY,KAAK,GAAG,KAAK,CAAC;AACxD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,UAAU,WAAW,QAAQ;AACxC;AAQO,SAAS,oBAAoB,GAAY,GAAqB;AACnE,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,MAAM,QAAQ,MAAM,QAAQ,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AACvF,MAAI;AACF,WAAO,KAAK,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-7XT7KZTN.js → chunk-3PGS7TYR.js}

@@ -1,10 +1,10 @@
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-I5LSKXT6.js";
+} from "./chunk-SGZAIJCV.js";
 import {
   assemblePodContainer,
   buildExtractedPartitionWrapper
-} from "./chunk-RCONOOVF.js";
+} from "./chunk-BVN6KXL2.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -12,7 +12,7 @@ import {
   BLOB_INTENT_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-HS3LEVT4.js";
+} from "./chunk-HIWCKBEY.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
@@ -23,16 +23,16 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-JRWLUWDM.js";
+} from "./chunk-QPQUVOZ2.js";
 import {
   buildRecordAad,
   openEnvelopeJson,
   recordAadFor,
   writeEnvelopeBody
-} from "./chunk-DOPZWTMJ.js";
+} from "./chunk-4ZS56W5S.js";
 import {
   buildRecordEnvelope
-} from "./chunk-4RUFYGWG.js";
+} from "./chunk-SZJ3DLZA.js";
 import {
   bufferToBase64,
   decrypt,
@@ -42,13 +42,13 @@ import {
   generateDEK,
   unwrapCek,
   wrapCek
-} from "./chunk-USKHHOIV.js";
+} from "./chunk-HPVZCW43.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-N4CHCXDL.js";
+} from "./chunk-7MG7SJT7.js";
 import {
   PartitionExtractionError
-} from "./chunk-SW4TOSJL.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-cargo/walk-closure.ts
 async function walkClosure(vault, opts) {
@@ -494,4 +494,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-7XT7KZTN.js.map
+//# sourceMappingURL=chunk-3PGS7TYR.js.map

package/dist/{chunk-OHGCRKWA.js → chunk-3V4KWFX7.js}

@@ -5,18 +5,18 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-MV2OEK3K.js";
+} from "./chunk-XKWGNJ26.js";
 import {
   parseDekKey
-} from "./chunk-IZTU6RKH.js";
+} from "./chunk-JMGDHKQF.js";
 import {
   envelopeOpensUnderAny,
   rekeyBlobSet,
   rekeyEnvelopeIfNeeded
-} from "./chunk-DOPZWTMJ.js";
+} from "./chunk-4ZS56W5S.js";
 import {
   buildRecordEnvelope
-} from "./chunk-4RUFYGWG.js";
+} from "./chunk-SZJ3DLZA.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -31,10 +31,10 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-USKHHOIV.js";
+} from "./chunk-HPVZCW43.js";
 import {
   NOYDB_KEYRING_VERSION
-} from "./chunk-N4CHCXDL.js";
+} from "./chunk-7MG7SJT7.js";
 import {
   BLOB_ADDRESS_KEY_ID,
   DirectoryDisabledError,
@@ -51,9 +51,18 @@ import {
   USER_ENVELOPE_COLLECTION,
   ValidationError,
   WrongPromptError
-} from "./chunk-SW4TOSJL.js";
+} from "./chunk-7O3Y4PPD.js";
 
 // src/with-party/team/roster-epoch.ts
+function assertRosterEpochCurrent(found, expected, userId) {
+  if (expected === void 0) return;
+  if (found === void 0) {
+    throw new KeyringTamperedError({ userId, reason: "roster-epoch-absent" });
+  }
+  if (!Number.isFinite(found) || found < expected) {
+    throw new KeyringTamperedError({ userId, reason: "roster-epoch-rewound" });
+  }
+}
 function nextRosterEpoch(current) {
   return Number.isFinite(current) ? current + 1 : 1;
 }
@@ -1384,6 +1393,7 @@ async function writeKeyringFile(store, vault, userId, keyringFile) {
 }
 
 export {
+  assertRosterEpochCurrent,
   nextRosterEpoch,
   mintRosterTag,
   assertRosterAuthenticated,
@@ -1430,4 +1440,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-OHGCRKWA.js.map
+//# sourceMappingURL=chunk-3V4KWFX7.js.map