@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/classified-marker-BWOFVYAC.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/via/classified/config-drift.ts"],"sourcesContent":["/**\n * C-A / R10 config-drift marker I/O — the store side of the guard, kept OUT of\n * the kernel `Collection` so the always-on kernel surface stays lean. The\n * kernel holds only the per-handle memoization; these helpers do the actual\n * persisted-schema read/write (via the persisted-schemas storage seam, lazily\n * imported so the classified spine tree-shakes).\n *\n * Marker semantics: a collection declaring classified digest-only fields writes\n * an `x-classified` marker into its `_schemas/<collection>` record on the first\n * classified write. A handle later opened WITHOUT `classifiedFields` (a naive\n * handle) reads it back and refuses to write — see RecordCodec.encryptRecord's\n * R10 guard.\n *\n * `dek` is typed as the bare `CryptoKey` global rather than `EnclaveKey`\n * (`kernel/enclave/crypto.ts`'s alias for the same type) — this file lives\n * under `via/classified/`, which the `via-enclave-isolation`\n * architecture guard (#629) forbids from importing `kernel/enclave/` at\n * all, even type-only.\n *\n * @module\n */\nimport type { NoydbStore, VdigFieldPolicy, ClassifiedMarker } from '../../kernel/types.js'\n\n/**\n * Build the marker for a handle's digest-only field map, or null when it\n * declares none. `epoch` (#597) is stamped fresh on every call, but only\n * ever lands in storage on a genuine first-write or a real reconfiguration —\n * `persistClassifiedMarker`'s equality check (register.ts) ignores epoch, so\n * an identical re-declare's freshly-stamped value is discarded as a no-op\n * and the already-persisted epoch is left untouched (stable per lifetime).\n */\nfunction markerForFields(vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null): ClassifiedMarker | null {\n  if (vdigFields === null || vdigFields.size === 0) return null\n  const digestOnly = [...vdigFields.keys()]\n  return {\n    digestOnly, equatable: digestOnly.filter((f) => vdigFields.get(f)?.equatable === true),\n    epoch: new Date().toISOString(),\n  }\n}\n\n/**\n * Persist the classified marker for a handle's digest-only fields. No-op when\n * the handle declares none. Idempotent (delegates to `persistClassifiedMarker`).\n */\nexport async function persistClassifiedMarkerForFields(\n  store: NoydbStore,\n  vault: string,\n  collectionName: string,\n  vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null,\n  dek: CryptoKey,\n): Promise<void> {\n  const marker = markerForFields(vdigFields)\n  if (marker === null) return\n  const { persistClassifiedMarker } = await import('../../with-shape/persisted-schemas/register.js')\n  await persistClassifiedMarker({ store, vault, collectionName, dek, marker })\n}\n\n/**\n * Read a collection's persisted classified marker's declared digest-only field\n * set (empty when the collection carries no marker). Cross-session drift signal:\n * the R10 superset guard refuses a handle whose declared classified set does not\n * cover every field in this set.\n */\nexport async function readClassifiedMarkerDigestOnly(\n  store: NoydbStore,\n  vault: string,\n  collectionName: string,\n  dek: CryptoKey,\n): Promise<readonly string[]> {\n  const { loadPersistedSchema } = await import('../../with-shape/persisted-schemas/storage.js')\n  const persisted = await loadPersistedSchema(store, vault, collectionName, dek)\n  return persisted?.classified?.digestOnly ?? []\n}\n"],"mappings":";AA+BA,SAAS,gBAAgB,YAAkF;AACzG,MAAI,eAAe,QAAQ,WAAW,SAAS,EAAG,QAAO;AACzD,QAAM,aAAa,CAAC,GAAG,WAAW,KAAK,CAAC;AACxC,SAAO;AAAA,IACL;AAAA,IAAY,WAAW,WAAW,OAAO,CAAC,MAAM,WAAW,IAAI,CAAC,GAAG,cAAc,IAAI;AAAA,IACrF,QAAO,oBAAI,KAAK,GAAE,YAAY;AAAA,EAChC;AACF;AAMA,eAAsB,iCACpB,OACA,OACA,gBACA,YACA,KACe;AACf,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,WAAW,KAAM;AACrB,QAAM,EAAE,wBAAwB,IAAI,MAAM,OAAO,wBAAgD;AACjG,QAAM,wBAAwB,EAAE,OAAO,OAAO,gBAAgB,KAAK,OAAO,CAAC;AAC7E;AAQA,eAAsB,+BACpB,OACA,OACA,gBACA,KAC4B;AAC5B,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAA+C;AAC5F,QAAM,YAAY,MAAM,oBAAoB,OAAO,OAAO,gBAAgB,GAAG;AAC7E,SAAO,WAAW,YAAY,cAAc,CAAC;AAC/C;","names":[]}

package/dist/collection-facade-JSJYIKS4.js

@@ -1,45 +0,0 @@
-import {
-  buildPersistedIndexCallbacks,
-  buildRetrievalDocs,
-  embedOnWrite,
-  flushIndex,
-  hasIndexedBlobFields,
-  rebuildEmbeddings,
-  retrieve,
-  search,
-  similarTo,
-  syncTierSearch,
-  warmIndex
-} from "./chunk-UP4BECPY.js";
-import "./chunk-RTBJ5IOO.js";
-import "./chunk-LH5A3ZPG.js";
-import "./chunk-AURFOK3D.js";
-import "./chunk-MVMXZYXT.js";
-import "./chunk-Q2MPFCQ7.js";
-import "./chunk-TRGTKX5E.js";
-import "./chunk-UXVWEX5L.js";
-import "./chunk-QPQUVOZ2.js";
-import "./chunk-JMGDHKQF.js";
-import "./chunk-4ZS56W5S.js";
-import "./chunk-SZJ3DLZA.js";
-import "./chunk-BRLKZUBT.js";
-import "./chunk-BTDR2PXY.js";
-import "./chunk-CHQCZZWC.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-HPVZCW43.js";
-import "./chunk-7MG7SJT7.js";
-import "./chunk-7O3Y4PPD.js";
-export {
-  buildPersistedIndexCallbacks,
-  buildRetrievalDocs,
-  embedOnWrite,
-  flushIndex,
-  hasIndexedBlobFields,
-  rebuildEmbeddings,
-  retrieve,
-  search,
-  similarTo,
-  syncTierSearch,
-  warmIndex
-};
-//# sourceMappingURL=collection-facade-JSJYIKS4.js.map

package/dist/dead-filter-PKQDLOT4.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/satellites/dead-filter.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { liveBaseIdSet } from './existence.js'\n\n/**\n * Build a live-base id set for every satellite collection detectable from\n * its persisted `_schemas/<name>` pairing marker (#591 Task 10).\n *\n * The bundle-export path (`with-pod/bundle.ts`) has no reachable\n * `SatelliteRegistry` — that registry is private to `Vault` and adding an\n * accessor would grow a kernel file past its line-ceiling ratchet. The\n * marker persisted by `ensureSatelliteMarker` (`_schemas/<satellite>`,\n * decrypted with the satellite collection's own DEK — see\n * `with-shape/persisted-schemas/storage.ts`) is the fallback pairing-info\n * source that's always reachable from just a raw store + a per-collection\n * DEK accessor, so export uses that instead of the in-memory registry.\n *\n * Returns a `Map` from satellite collection name to its base's live id set\n * (existence.ts rule 1: absent or tombstoned base ⇒ not live). Only\n * satellite collections are present as keys — callers should treat a\n * missing key as \"not a satellite, don't filter.\"\n */\nexport async function liveBaseIdSetsForBundle(\n  store: NoydbStore,\n  vaultName: string,\n  collectionNames: readonly string[],\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n): Promise<Map<string, Set<string>>> {\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const out = new Map<string, Set<string>>()\n  for (const name of collectionNames) {\n    if (name.startsWith('_')) continue\n    // SILENT-DEGRADE surface (deliberate asymmetry): on ANY marker-read\n    // failure the collection is treated as non-satellite and exported\n    // UNFILTERED. That covers, precisely:\n    //   (a) `getDEK(name)` throwing for any reason (caught below);\n    //   (b) the persisted `_schemas/<name>` record failing to decrypt or\n    //       parse — corruption, wrong DEK, transient store error —\n    //       `loadPersistedSchema` catches internally and returns\n    //       `undefined` (storage.ts), which reads here as \"no marker\";\n    //   (c) the marker not yet persisted — `declareSatellite`'s\n    //       `postRegister` is fire-and-forget, so an export racing a\n    //       fresh declaration can miss it.\n    // Leak-on-error is chosen over exclude-on-error because this is a\n    // BACKUP path: exporting stale dead-satellite ciphertext is\n    // recoverable; silently dropping live records from a backup is the\n    // strictly worse failure. Pinned by the \"leak-on-error posture\" tests\n    // in satellites-bundle-filter.test.ts.\n    let dek: EnclaveKey\n    try {\n      dek = await getDEK(name)\n    } catch {\n      continue // (a) no DEK reachable — can't read the marker, export unfiltered\n    }\n    const persisted = await loadPersistedSchema(store, vaultName, name, dek)\n    const marker = persisted?.satellite\n    if (!marker) continue // (b)/(c) — undecryptable/absent/markerless schema record, export unfiltered\n    out.set(name, await liveBaseIdSet(store, vaultName, marker.base))\n  }\n  return out\n}\n"],"mappings":";;;;;AAsBA,eAAsB,wBACpB,OACA,WACA,iBACA,QACmC;AACnC,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,MAAM,oBAAI,IAAyB;AACzC,aAAW,QAAQ,iBAAiB;AAClC,QAAI,KAAK,WAAW,GAAG,EAAG;AAiB1B,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,OAAO,IAAI;AAAA,IACzB,QAAQ;AACN;AAAA,IACF;AACA,UAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,MAAM,GAAG;AACvE,UAAM,SAAS,WAAW;AAC1B,QAAI,CAAC,OAAQ;AACb,QAAI,IAAI,MAAM,MAAM,cAAc,OAAO,WAAW,OAAO,IAAI,CAAC;AAAA,EAClE;AACA,SAAO;AACT;","names":[]}

package/dist/delegation-DS5NRILW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-party/team/delegation.ts"],"sourcesContent":["/**\n * Time-boxed cross-tier delegation tokens.\n *\n * A higher-tier user can issue a delegation that grants another user\n * temporary access to records at a specified tier. The delegation is\n * persisted as an encrypted envelope in the reserved `_delegations`\n * collection. The target user's runtime scans this collection on every\n * open and, while `until` is still in the future, merges the\n * unwrapped tier DEKs into their in-memory DEK map.\n *\n * ## Token shape\n *\n * ```\n * {\n *   id,             // ULID, also the _delegations record id\n *   toUser,         // grantee user id\n *   fromUser,       // grantor user id (owner/admin/higher-tier principal)\n *   tier,           // tier being delegated\n *   collection,     // collection name OR null for \"every collection\"\n *   record,         // optional specific record id\n *   until,          // ISO timestamp — token expires at this instant\n *   wrappedDek,     // base64 AES-KW-wrapped tier DEK, wrapped under target KEK\n *   createdAt,      // ISO timestamp\n * }\n * ```\n *\n * The ciphertext is stored as a normal noy-db envelope — the\n * `_delegations` collection has its own DEK shared across all vault\n * users, so an operator can enumerate active delegations for audit\n * without being able to *use* them (the `wrappedDek` inside is still\n * keyed to the target user's KEK).\n *\n * ## Revocation\n *\n * Delete the `_delegations/<id>` envelope. The target user's runtime\n * reloads the delegation list at each open and at periodic intervals\n * (tracked by the caller — this module is pure logic).\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, wrapKey, unwrapKey, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { dekKey } from './tiers.js'\nimport { DelegationTargetMissingError } from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\n\nexport const DELEGATIONS_COLLECTION = '_delegations'\n\n/**\n * Durable payload of a delegation token. Encrypted under the vault's\n * `_delegations` DEK; the `wrappedDek` inside is additionally wrapped\n * under the target user's KEK.\n */\nexport interface DelegationToken {\n  readonly id: string\n  readonly toUser: string\n  readonly fromUser: string\n  readonly tier: number\n  /** Collection name or `null` for all collections. */\n  readonly collection: string | null\n  /** Optional specific record id scope. */\n  readonly record?: string\n  readonly until: string\n  readonly wrappedDek: string\n  readonly createdAt: string\n}\n\nexport interface IssueDelegationOptions {\n  readonly toUser: string\n  readonly tier: number\n  readonly collection?: string\n  readonly record?: string\n  readonly until: Date | string\n}\n\n/**\n * Build and persist a delegation token. The caller must hold a tier-N\n * DEK and must have already located the target user's keyring file\n * (so the `wrappedDek` can be re-wrapped against their KEK).\n */\nexport async function issueDelegation(\n  store: NoydbStore,\n  vault: string,\n  grantor: UnlockedKeyring,\n  targetKek: EnclaveKey | null,\n  delegationsDek: EnclaveKey,\n  opts: IssueDelegationOptions,\n): Promise<DelegationToken> {\n  if (!targetKek) {\n    throw new DelegationTargetMissingError(opts.toUser)\n  }\n  const tier = opts.tier\n  const collectionName = opts.collection ?? null\n  const dekLookupCollection = collectionName ?? ''\n  // Tier DEK to delegate — fetched from the grantor's own keyring.\n  const sourceDek = collectionName\n    ? grantor.deks.get(dekKey(collectionName, tier))\n    : undefined\n  if (!sourceDek) {\n    throw new DelegationTargetMissingError(\n      `grantor cannot find tier ${tier} DEK for ${dekLookupCollection || '(any)'}`,\n    )\n  }\n  const wrappedDek = await wrapKey(sourceDek, targetKek)\n\n  const until = typeof opts.until === 'string' ? opts.until : opts.until.toISOString()\n  const token: DelegationToken = {\n    id: generateULID(),\n    toUser: opts.toUser,\n    fromUser: grantor.userId,\n    tier,\n    collection: collectionName,\n    ...(opts.record && { record: opts.record }),\n    until,\n    wrappedDek,\n    createdAt: new Date().toISOString(),\n  }\n\n  const plaintext = JSON.stringify(token)\n  const identity = { collection: DELEGATIONS_COLLECTION, id: token.id, by: grantor.userId, version: 1 }\n  const { iv, data } = await encrypt(plaintext, delegationsDek, buildRecordAad(identity))\n  const envelope = buildRecordEnvelope(\n    identity,\n    { ts: token.createdAt, iv, data},\n  )\n  await store.put(vault, DELEGATIONS_COLLECTION, token.id, envelope)\n  return token\n}\n\n/**\n * Enumerate every live (non-expired) delegation addressed to `toUser`\n * and merge the unwrapped tier DEKs into their keyring. Returns the\n * list of merged delegations so the caller can register per-access\n * audit context.\n */\nexport async function loadActiveDelegations(\n  store: NoydbStore,\n  vault: string,\n  user: UnlockedKeyring,\n  delegationsDek: EnclaveKey,\n  now: Date = new Date(),\n): Promise<DelegationToken[]> {\n  const ids = await store.list(vault, DELEGATIONS_COLLECTION)\n  const merged: DelegationToken[] = []\n  const nowIso = now.toISOString()\n  for (const id of ids) {\n    const env = await store.get(vault, DELEGATIONS_COLLECTION, id)\n    if (!env) continue\n    let token: DelegationToken\n    try {\n      const plaintext = await openEnvelopeJson({ collection: DELEGATIONS_COLLECTION, id }, env, delegationsDek)\n      token = JSON.parse(plaintext) as DelegationToken\n    } catch {\n      continue\n    }\n    if (token.toUser !== user.userId) continue\n    if (token.until <= nowIso) continue\n\n    // A user without a KEK in memory (tier-3 PIN resume, wrap-DEKs\n    // tier-2 unlock, session restore) cannot unwrap delegation tokens\n    // — those were wrapped under the user's KEK at issue time. Skip\n    // this token; the consumer reaches it again at tier-1 unlock.\n    if (!user.kek) continue\n    let dek: EnclaveKey\n    try {\n      dek = await unwrapKey(token.wrappedDek, user.kek)\n    } catch {\n      continue\n    }\n    const k = token.collection\n      ? dekKey(token.collection, token.tier)\n      : `__any#${token.tier}`\n    user.deks.set(k, dek)\n    merged.push(token)\n  }\n  return merged\n}\n\n/**\n * Revoke a delegation by id — the caller resolves the envelope and\n * issues a `delete`. Provided as a stable helper so the naming is\n * symmetric to `issueDelegation`.\n */\nexport async function revokeDelegation(\n  store: NoydbStore,\n  vault: string,\n  id: string,\n): Promise<void> {\n  await store.delete(vault, DELEGATIONS_COLLECTION, id)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDO,IAAM,yBAAyB;AAkCtC,eAAsB,gBACpB,OACA,OACA,SACA,WACA,gBACA,MAC0B;AAC1B,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,6BAA6B,KAAK,MAAM;AAAA,EACpD;AACA,QAAM,OAAO,KAAK;AAClB,QAAM,iBAAiB,KAAK,cAAc;AAC1C,QAAM,sBAAsB,kBAAkB;AAE9C,QAAM,YAAY,iBACd,QAAQ,KAAK,IAAI,OAAO,gBAAgB,IAAI,CAAC,IAC7C;AACJ,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,4BAA4B,IAAI,YAAY,uBAAuB,OAAO;AAAA,IAC5E;AAAA,EACF;AACA,QAAM,aAAa,MAAM,QAAQ,WAAW,SAAS;AAErD,QAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAK,MAAM,YAAY;AACnF,QAAM,QAAyB;AAAA,IAC7B,IAAI,aAAa;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,YAAY;AAAA,IACZ,GAAI,KAAK,UAAU,EAAE,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,IACA;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AAEA,QAAM,YAAY,KAAK,UAAU,KAAK;AACtC,QAAM,WAAW,EAAE,YAAY,wBAAwB,IAAI,MAAM,IAAI,IAAI,QAAQ,QAAQ,SAAS,EAAE;AACpG,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,gBAAgB,eAAe,QAAQ,CAAC;AACtF,QAAM,WAAW;AAAA,IACf;AAAA,IACA,EAAE,IAAI,MAAM,WAAW,IAAI,KAAI;AAAA,EACjC;AACA,QAAM,MAAM,IAAI,OAAO,wBAAwB,MAAM,IAAI,QAAQ;AACjE,SAAO;AACT;AAQA,eAAsB,sBACpB,OACA,OACA,MACA,gBACA,MAAY,oBAAI,KAAK,GACO;AAC5B,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,sBAAsB;AAC1D,QAAM,SAA4B,CAAC;AACnC,QAAM,SAAS,IAAI,YAAY;AAC/B,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,wBAAwB,EAAE;AAC7D,QAAI,CAAC,IAAK;AACV,QAAI;AACJ,QAAI;AACF,YAAM,YAAY,MAAM,iBAAiB,EAAE,YAAY,wBAAwB,GAAG,GAAG,KAAK,cAAc;AACxG,cAAQ,KAAK,MAAM,SAAS;AAAA,IAC9B,QAAQ;AACN;AAAA,IACF;AACA,QAAI,MAAM,WAAW,KAAK,OAAQ;AAClC,QAAI,MAAM,SAAS,OAAQ;AAM3B,QAAI,CAAC,KAAK,IAAK;AACf,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,UAAU,MAAM,YAAY,KAAK,GAAG;AAAA,IAClD,QAAQ;AACN;AAAA,IACF;AACA,UAAM,IAAI,MAAM,aACZ,OAAO,MAAM,YAAY,MAAM,IAAI,IACnC,SAAS,MAAM,IAAI;AACvB,SAAK,KAAK,IAAI,GAAG,GAAG;AACpB,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,SAAO;AACT;AAOA,eAAsB,iBACpB,OACA,OACA,IACe;AACf,QAAM,MAAM,OAAO,OAAO,wBAAwB,EAAE;AACtD;","names":[]}

package/dist/derive-E642AOUB.js

@@ -1,21 +0,0 @@
-import {
-  derivePersistedSchema,
-  isZod4Schema,
-  isZodSchema
-} from "./chunk-ACAQ2DSG.js";
-import "./chunk-Y2NBBT6K.js";
-import "./chunk-4ZS56W5S.js";
-import "./chunk-SZJ3DLZA.js";
-import "./chunk-BRLKZUBT.js";
-import "./chunk-BTDR2PXY.js";
-import "./chunk-CHQCZZWC.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-HPVZCW43.js";
-import "./chunk-7MG7SJT7.js";
-import "./chunk-7O3Y4PPD.js";
-export {
-  derivePersistedSchema,
-  isZod4Schema,
-  isZodSchema
-};
-//# sourceMappingURL=derive-E642AOUB.js.map

package/dist/dispatch-Q6MWLOJY.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-formula/derivations/dispatch.ts"],"sourcesContent":["/**\n * Derivation dispatch, lifted out of the kernel spine (#842 part b).\n *\n * `Collection` carried ~380 lines of dispatch logic that belongs to the\n * derivation service, not to the always-on kernel. These are free functions\n * taking an explicit context so the spine keeps only a thin delegator.\n *\n * ## How the spine reaches this module\n *\n * By dynamic `import()`, never a static one. `check-architecture.mjs`'s\n * `port-layering` check forbids the spine from statically importing a\n * `with-*` service; `collection.ts` is grandfathered for ten\n * `with-formula/*` specifiers, but that list is frozen per file and a new\n * one is a violation. A dynamic import is the sanctioned S4 gate recipe, and\n * it keeps this chunk out of the floor bundle for consumers who never fire a\n * derivation.\n *\n * The `Collection` type reference below points back at the spine. That is\n * inward (service → kernel) and so allowed, and it is TYPE-ONLY — erased at\n * build, so no runtime cycle exists.\n *\n * @internal\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { DerivationRegistry } from './registry.js'\nimport type { ReadOnlyVaultFacade } from '../../with-audit/guards/types.js'\nimport type { Collection } from '../../kernel/collection.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport type { ledgerAuditHook, WaveContext } from '../../kernel/via/dispatch.js'\nimport { putDerivedOutput, selfWriteFieldEqual } from '../../kernel/via/dispatch.js'\nimport { DerivationCapExceededError } from '../../kernel/errors.js'\nimport { sameTuple, resolveTuple, tupleFromIntermediate, hopCollections } from './trigger-match.js'\nimport { markStale } from './stale.js'\nimport type { DerivationExecutor } from './executor.js'\n\n/** The per-write dispatch context threaded into `putDerivedOutput`. */\ninterface DispatchCtx {\n  emit: (e: string, p: unknown) => void\n  source: { readonly collection: string; readonly id: string }\n  audit: ReturnType<typeof ledgerAuditHook>\n}\n\n/**\n * What the dispatchers need from the collection that owns them. Passing this\n * explicitly is what lets the logic live outside the class.\n */\nexport interface DerivationDeleteCtx {\n  readonly derivationSource: {\n    registry(): DerivationRegistry\n    getCollection(name: string): Collection<Record<string, unknown>>\n    getActiveTxContext(): TxContext | null\n    getReadOnlyFacade(): ReadOnlyVaultFacade\n  }\n  /** The collection the delete happened in. */\n  readonly collectionName: string\n  readonly adapter: NoydbStore\n  readonly vault: string\n  readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  readonly storeCiphertext: boolean\n}\n\n/**\n * Erase the derived rows a deleted source record fanned out to, and drop the\n * fan-out sidecars that recorded them.\n *\n * @param eraseRecordShapeToo also erase same-id `shape: 'record'` outputs.\n *   Restricted to a source-triggered strategy writing into a DIFFERENT\n *   collection — the self-denorm case would re-delete the record just\n *   tombstoned, and triggerBy/sibling strategies derive under a different id.\n * @returns rows ACTUALLY deleted, not edges visited (#622).\n */\nexport async function dispatchArrayDerivationsOnDelete(\n  ctx: DerivationDeleteCtx,\n  id: string,\n  eraseRecordShapeToo = false,\n): Promise<number> {\n  const { derivationSource, collectionName, adapter, vault, getDEK, storeCiphertext } = ctx\n\n  const strategies = derivationSource.registry().strategiesForSource(collectionName)\n  if (strategies.length === 0) return 0\n\n  const { loadFanoutSidecar, deleteFanoutSidecar } = await import('./fanout-sidecar.js')\n  const txCtx = derivationSource.getActiveTxContext()\n  let erased = 0\n\n  for (const { spec } of strategies) {\n    for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {\n      if (outSpec.shape === 'record') {\n        if (eraseRecordShapeToo && spec.source === collectionName && outSpec.collection !== collectionName) {\n          if (await derivationSource.getCollection(outSpec.collection)._internalDelete(id, txCtx)) erased += 1\n        }\n        continue\n      }\n\n      const sidecar = await loadFanoutSidecar(adapter, vault, spec.source, id, outputKey, getDEK, storeCiphertext)\n      if (!sidecar) continue\n\n      const outputCollection = derivationSource.getCollection(outSpec.collection)\n      for (const derivedId of sidecar.keys) {\n        if (await outputCollection._internalDelete(derivedId, txCtx)) erased += 1\n      }\n      await deleteFanoutSidecar(adapter, vault, spec.source, id, outputKey)\n    }\n  }\n\n  return erased\n}\n\n/** Adds what the on-write derivation dispatch needs beyond the delete path. */\nexport interface DerivationDispatchCtx extends DerivationDeleteCtx {\n  /** Via pipeline, for decoding the stored form back to canonical money shape. */\n  readonly via: { canonicalizeStored(r: Record<string, unknown>): Record<string, unknown> } | undefined\n  /** Recompute a rollup aggregate onto a parent. Stays on the spine — it walks collections. */\n  readonly recomputeRollup: (\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    spec: any,\n    parentId: string,\n    source: { readonly collection: string; readonly id: string },\n    wave?: WaveContext,\n  ) => Promise<unknown>\n  /** Builds the per-write dispatch context threaded into `putDerivedOutput`. */\n  readonly dispatchCtx: (source: { readonly collection: string; readonly id: string }) => DispatchCtx\n  /** Registers a write on the active transaction for rollback. */\n  readonly trackPut: (txCtx: TxContext, collectionName: string, id: string, priorEnvelope: EncryptedEnvelope | null) => void\n}\n\n/**\n * Fire registered derivation strategies for this source collection.\n *\n * Eager mode runs `derive` inline and writes each output; lazy mode records a\n * stale mark for cold-session recompute. Rollups are handled here rather than\n * by the executor — a write to the child recomputes the parent aggregate, and\n * a write to the parent recomputes its own.\n */\nexport async function dispatchDerivations(\n  ctx: DerivationDispatchCtx,\n  id: string,\n  record: Record<string, unknown>,\n  version: number,\n  wave?: WaveContext,\n  /** The pre-write record at `id` in THIS collection (undefined = not\n   *  captured — no field-match trigger, or a sync-applied wave; null =\n   *  captured and absent, i.e. a create). Only a `Record` re-fires the OLD\n   *  matched set alongside the new one (spec §7). */\n  prior?: Record<string, unknown> | null,\n): Promise<void> {\n  const { derivationSource, collectionName, via, recomputeRollup } = ctx\n\n  // `record` is the stored form here (post-quantize) — decode so\n  // derive(source, ctx) sees the canonical money shape.\n  const incoming = (via ? via.canonicalizeStored(record) : record)\n  if (incoming && typeof incoming === 'object' && '_derivedFrom' in incoming) return\n  // `prior` is the raw stored pre-write record — canonicalize it the same\n  // way as `incoming` before it feeds `resolveTuple` below, or a\n  // via-shaped match field (e.g. a money field) compares canonical against\n  // raw and never matches the old tuple (Min 5).\n  const canonicalPrior = prior != null ? (via ? via.canonicalizeStored(prior) : prior) : prior\n  const registry = derivationSource.registry()\n  const strategies = registry.strategiesForSource(collectionName)\n  if (strategies.length === 0) return\n  // Dynamic-import the executor only on the first eager-mode\n  // dispatch. Lazy-mode dispatches use `markStale` (a pure helper)\n  // which doesn't reach into the executor at all. Keeps the\n  // derivation executor chunk out of the floor bundle for any\n  // consumer that doesn't fire an eager derivation.\n  let executorClass: typeof DerivationExecutor | null = null\n  for (const { spec, strategyHash, triggers } of strategies) {\n    const mode = typeof spec.lifecycle === 'string' ? spec.lifecycle : spec.lifecycle.mode\n\n    // Rollup: a write to the child `from` recomputes the\n    // parent at id child[key]; a write to the parent (source = into)\n    // recomputes its own aggregate. Handled here (the executor is not run).\n    if (spec.rollup) {\n      if (mode !== 'eager') continue\n      const asParentId = (v: unknown): string | null =>\n        (typeof v === 'string' || typeof v === 'number') ? String(v) : null\n      let parentId: string | null\n      // #1257 — a child that RE-PARENTS strands the old parent's aggregate\n      // unless the old key is recomputed too. Reads the prior stored record\n      // (canonicalized alongside `incoming`, so a via-shaped key compares like\n      // for like). `undefined` prior — a sync-applied wave write or a tiers\n      // restore, which do not thread it — degrades to new-parent-only, the\n      // pre-#1257 behaviour, rather than guessing.\n      let oldParentId: string | null = null\n      if (collectionName === spec.rollup.from) {\n        parentId = asParentId(incoming[spec.rollup.key])\n        const priorKey = canonicalPrior != null ? asParentId(canonicalPrior[spec.rollup.key]) : null\n        if (priorKey !== null && priorKey !== parentId) oldParentId = priorKey\n      } else {\n        parentId = id // a write to the parent recomputes its own aggregate\n      }\n      if (parentId !== null) await recomputeRollup(spec, parentId, { collection: collectionName, id }, wave)\n      // The old parent is recomputed AFTER the new one so a `maxFanout`-style\n      // failure on the new parent surfaces before extra work is spent.\n      if (oldParentId !== null) await recomputeRollup(spec, oldParentId, { collection: collectionName, id }, wave)\n      continue\n    }\n\n    // Determine how `collectionName` triggers this strategy, and build the list\n    // of source records to (re-)derive:\n    //   • source     — re-derive the written record itself (same-id).\n    //   • sources[]  — re-derive the PRIMARY source at the same id.\n    //   • triggerBy  — FK fan-out: re-derive every source record\n    //                  whose `on` field equals the written parent's id.\n    // `input` is passed to derive(); `base` is the raw stored source record\n    // used as the patch base for a self-write reverse-denorm output.\n    const isSource = spec.source === collectionName\n    const isSibling = !isSource && (spec.sources?.includes(collectionName) ?? false)\n    const triggerEntries = !isSource && !isSibling\n      ? triggers.filter((t) => t.collection === collectionName)\n      : []\n    // #1277 option 2 — a write to an INTERMEDIATE collection fires the trigger\n    // too. Without this, re-pointing the intermediate strands every source it\n    // used to address: nothing is written to the trigger or source collection,\n    // so no other path can notice. Kept separate from `triggerEntries` because\n    // the tuple is derived differently (the intermediate IS the written record,\n    // so no lookup is needed).\n    const hopEntries = !isSource && !isSibling\n      ? triggers.filter((t) => hopCollections(t.match).includes(collectionName))\n      : []\n\n    const runs: Array<{\n      input: Record<string, unknown> & { id: string }\n      base: Record<string, unknown>\n      runId: string\n      version: number\n    }> = []\n\n    if (isSource) {\n      runs.push({ input: { ...incoming, id }, base: incoming, runId: id, version })\n    } else if (isSibling) {\n      const p = await derivationSource.getCollection(spec.source).get(id)\n      if (p !== null && p !== undefined) {\n        // Raw base for a (rare) sibling self-write; falls back to the\n        // resolved primary if the raw read misses.\n        const raw = await derivationSource.getCollection(spec.source)._getStoredRecord(id)\n        runs.push({ input: { ...p, id }, base: raw ?? p, runId: id, version: 0 })\n      }\n    } else if (triggerEntries.length > 0 || hopEntries.length > 0) {\n      const srcColl = derivationSource.getCollection(spec.source)\n      const matched = new Set<string>()\n      // One lookup per hop per written record — `take: 'id'` is a direct get,\n      // anything else is a single field match on the intermediate. Never per\n      // candidate row (#1266's bound).\n      const lookup = async (coll: string, field: string, value: string): Promise<Record<string, unknown> | null> => {\n        const c = derivationSource.getCollection(coll)\n        if (field === 'id') return c._getStoredRecord(value)\n        const ids = await c._findMatchingCompositeIds([{ field, value }])\n        const first = ids[0]\n        return first === undefined ? null : c._getStoredRecord(first)\n      }\n      // A write to an intermediate collection: fan out on its old ∪ new value.\n      // The prior record is the intermediate's own, so #1249's capture already\n      // supplies it — the same mechanism, pointed at a third collection.\n      for (const trigger of hopEntries) {\n        const tuples = [tupleFromIntermediate(trigger.match, collectionName, incoming)]\n        if (canonicalPrior != null) {\n          const old = tupleFromIntermediate(trigger.match, collectionName, canonicalPrior)\n          if (!sameTuple(old, tuples[0]!)) tuples.push(old)\n        }\n        const ids = new Set<string>()\n        for (const tuple of tuples) {\n          if (tuple === null) continue\n          for (const sid of await srcColl._findMatchingCompositeIds(tuple)) ids.add(sid)\n        }\n        if (trigger.maxFanout !== undefined && ids.size > trigger.maxFanout) {\n          throw new DerivationCapExceededError(\n            `triggerBy hop ${collectionName}→${spec.source} [${trigger.match.map(p => p.to).join(',')}]`,\n            ids.size, trigger.maxFanout)\n        }\n        for (const sid of ids) matched.add(sid)\n      }\n      for (const trigger of triggerEntries) {\n        // Union fan-out (spec §7): an update changing any matched component\n        // must re-fire BOTH the old and the new matched set, or the old\n        // set's derived output goes stale (never re-derived once it no\n        // longer matches). `prior` is only ever a `Record` here — a wave\n        // dispatch and a create both skip the old tuple outright.\n        const tuples = [await resolveTuple(trigger.match, id, incoming, lookup)]\n        if (canonicalPrior != null && trigger.match.some((p) => p.from !== 'id')) {\n          const old = await resolveTuple(trigger.match, id, canonicalPrior, lookup)\n          if (!sameTuple(old, tuples[0]!)) tuples.push(old)\n        }\n        const ids = new Set<string>()\n        for (const tuple of tuples) {\n          if (tuple === null) continue   // a from-value is absent/non-scalar: matches nothing\n          for (const sid of await srcColl._findMatchingCompositeIds(tuple)) ids.add(sid)\n        }\n        if (trigger.maxFanout !== undefined && ids.size > trigger.maxFanout) {\n          throw new DerivationCapExceededError(\n            `triggerBy ${collectionName}→${spec.source} [${trigger.match.map(p => p.to).join(',')}]`,\n            ids.size, trigger.maxFanout)\n        }\n        for (const sid of ids) matched.add(sid)\n      }\n      for (const sid of matched) {\n        const raw = await srcColl._getStoredRecord(sid)\n        if (raw === null) continue\n        runs.push({ input: { ...raw, id: sid }, base: raw, runId: sid, version: 0 })\n      }\n    }\n\n    if (runs.length === 0) continue\n\n    if (mode !== 'eager') {\n      for (const run of runs) await markStale(registry, spec, run.runId)\n      continue\n    }\n\n    if (executorClass === null) {\n      ;({ DerivationExecutor: executorClass } = await import('./executor.js'))\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    for (const run of runs) await runOne(ctx, spec as any, strategyHash, executorClass, run)\n  }\n}\n\n/**\n * Run the executor for one (spec, run) pair and write its outputs. Shared by\n * `dispatchDerivations`' eager loop and `dispatchTriggerDerivationsOnDelete`\n * (#1249) — the write-out logic (array diff, record self-write reverse-denorm,\n * normal record output) is identical for a live write and a delete-triggered\n * re-derive; only how `runs` gets built differs.\n */\nasync function runOne(\n  ctx: DerivationDispatchCtx,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  spec: any,\n  strategyHash: string,\n  executorClass: typeof DerivationExecutor,\n  run: { input: Record<string, unknown> & { id: string }; base: Record<string, unknown>; runId: string; version: number },\n): Promise<void> {\n  const { derivationSource, adapter, vault, getDEK, storeCiphertext, dispatchCtx, trackPut } = ctx\n  const execCtx = { vault: derivationSource.getReadOnlyFacade() }\n  const outCtx = dispatchCtx({ collection: spec.source, id: run.runId })\n  const result = await executorClass.run(spec, run.input, run.version, strategyHash, execCtx)\n  for (const key of Object.keys(spec.outputs)) {\n    const out = result.outputs[key]\n    if (!out) continue\n    if (out.kind === 'failed') {\n      const err = out.error\n      if (spec.strict) throw err\n      console.warn(`[derivation] output \"${key}\" for source \"${spec.source}\" id=\"${run.runId}\" failed:`, err)\n      continue\n    }\n    const outSpec = spec.outputs[key]\n    if (!outSpec) continue\n    const outputCollection = derivationSource.getCollection(outSpec.collection)\n    // If we're inside a multi-record transaction, register\n    // derived writes as side-effect ops on the active ctx\n    // BEFORE they fire. `revertExecuted` walks `_executed` in\n    // reverse on rollback, so capturing the pre-write envelope\n    // here lets a later mid-batch failure restore this output's\n    // prior state alongside the source op. Outside a transaction\n    // the context is null and tracking is skipped.\n    const txCtx = derivationSource.getActiveTxContext()\n\n    // ── Array-shape branch ─────────────────────────────────\n    if (out.kind === 'array') {\n      // Load the prior key set from the fanout sidecar.\n      const { loadFanoutSidecar, saveFanoutSidecar } = await import('./fanout-sidecar.js')\n      const prior = await loadFanoutSidecar(adapter, vault, spec.source, run.runId, key, getDEK, storeCiphertext)\n      const prevKeys = new Set<string>(prior?.keys ?? [])\n      const newKeysList = out.entries.map((e: { key: string }) => e.key)\n      const newKeysSet = new Set<string>(newKeysList)\n\n      // Diff — delete keys that were in prev but not in new.\n      for (const k of prevKeys) {\n        if (newKeysSet.has(k)) continue\n        await outputCollection._internalDelete(k, txCtx)\n      }\n\n      // Upsert every entry in the new set. (Slice 1: no\n      // identity-skip optimisation; write every row, idempotent\n      // at the (collection, id) level.)\n      for (const entry of out.entries) {\n        if (txCtx !== null) {\n          trackPut(txCtx, outSpec.collection, entry.key, await adapter.get(vault, outSpec.collection, entry.key))\n        }\n        await putDerivedOutput(outputCollection, entry.key, entry.value, outCtx, { source: 'derived' })\n      }\n\n      // Persist the new key set last, for failure-mode symmetry.\n      await saveFanoutSidecar(adapter, vault, {\n        source: spec.source,\n        sourceId: run.runId,\n        outputKey: key,\n        outputCollection: outSpec.collection,\n        keys: newKeysList,\n      }, getDEK, storeCiphertext)\n      continue\n    }\n\n    // ── Record-shape branch ────────────────────────────────\n    if (out.skipped === true) {\n      // Optional output returned null. Delete the\n      // previously-emitted output at this id, if any. Routed\n      // through `_internalDelete` so a user-registered\n      // `onDelete` on the output collection does NOT\n      // fire — this is a system-internal tombstone, not a\n      // user-initiated delete. The txCtx hookup captures the\n      // prior envelope inside `_internalDelete` for rollback\n      // symmetry; delete-of-absent is a silent no-op.\n      await outputCollection._internalDelete(run.runId, txCtx)\n      continue\n    }\n\n    // ── Self-write reverse-denorm ───────────────────────────\n    // An output back to its own source: patch ONLY the declared\n    // `denorm` fields onto the raw stored record, never the whole\n    // value (which would clobber user fields / i18n maps and carries\n    // the executor's `_derivedFrom` tag). If the patch changes\n    // nothing, skip the write — that value-equality is the cycle\n    // guard: the self-write re-fires the source-path derivation,\n    // which recomputes identical fields and terminates here.\n    if (outSpec.shape === 'record' && outSpec.denorm !== undefined && outSpec.collection === spec.source) {\n      const value = out.value\n      const patched: Record<string, unknown> = { ...run.base }\n      let changed = false\n      for (const f of outSpec.denorm) {\n        if (!selfWriteFieldEqual(run.base[f], value[f])) {\n          patched[f] = value[f]\n          changed = true\n        }\n      }\n      if (!changed) continue // cycle guard — nothing to write\n      if (txCtx !== null) {\n        trackPut(txCtx, outSpec.collection, run.runId, await adapter.get(vault, outSpec.collection, run.runId))\n      }\n      await putDerivedOutput(outputCollection, run.runId, patched, outCtx, { source: 'derived' })\n      continue\n    }\n\n    // ── Normal record output (separate output collection) ──\n    if (txCtx !== null) {\n      trackPut(txCtx, outSpec.collection, run.runId, await adapter.get(vault, outSpec.collection, run.runId))\n    }\n    await putDerivedOutput(outputCollection, run.runId, out.value, outCtx, { source: 'derived' })\n  }\n}\n\n/**\n * Trigger fan-out for a DELETED parent record (#1249, spec §8). Distinct from\n * the \"record-shape derivations not dispatched on delete\" rule — that is\n * about deleting a SOURCE record; this fires when a TRIGGER collection's\n * record is deleted, re-deriving source records that still exist. Pairs\n * evaluate against the tombstoned record's values; matched sources re-derive\n * through the normal executor (their derive() reads the now-absent parent\n * and decides what that means — the engine never cascades deletes).\n */\nexport async function dispatchTriggerDerivationsOnDelete(\n  ctx: DerivationDispatchCtx, id: string, deleted: Record<string, unknown>,\n): Promise<void> {\n  const { derivationSource, collectionName } = ctx\n  const registry = derivationSource.registry()\n  const strategies = registry.strategiesForSource(collectionName)\n  if (strategies.length === 0) return\n  let executorClass: typeof DerivationExecutor | null = null\n  for (const { spec, strategyHash, triggers } of strategies) {\n    if (spec.rollup) continue                                    // rollup-on-delete already exists\n    if (spec.source === collectionName) continue                 // source delete: existing rule, untouched\n    if (spec.sources?.includes(collectionName)) continue          // declared sibling source: same exclusion as the write path's isSibling check\n    const entries = triggers.filter((t) => t.collection === collectionName)\n    // #1294 — deleting an INTERMEDIATE strands every source it addressed, for\n    // the same reason re-pointing one does: nothing is written to the trigger\n    // or source collection. The write path handles this; the delete path did\n    // not, which made the hop's correctness argument hold for puts only.\n    const hopEntries = triggers.filter((t) => hopCollections(t.match).includes(collectionName))\n    if (entries.length === 0 && hopEntries.length === 0) continue\n    const mode = typeof spec.lifecycle === 'string' ? spec.lifecycle : spec.lifecycle.mode\n    const srcColl = derivationSource.getCollection(spec.source)\n    const matched = new Set<string>()\n    const lookup = async (coll: string, field: string, value: string): Promise<Record<string, unknown> | null> => {\n      const c = derivationSource.getCollection(coll)\n      if (field === 'id') return c._getStoredRecord(value)\n      const found = await c._findMatchingCompositeIds([{ field, value }])\n      const first = found[0]\n      return first === undefined ? null : c._getStoredRecord(first)\n    }\n    const cap = (trigger: { maxFanout?: number; match: ReadonlyArray<{ to: string }> }, n: number, label: string): void => {\n      if (trigger.maxFanout !== undefined && n > trigger.maxFanout) {\n        throw new DerivationCapExceededError(\n          `triggerBy ${label} ${collectionName}→${spec.source} [${trigger.match.map(p => p.to).join(',')}] (delete)`,\n          n, trigger.maxFanout)\n      }\n    }\n    for (const trigger of entries) {\n      // #1294 — resolve the hop here too. The old sync builder compared the raw\n      // `from` value against `source[to]`, which for a mapped pair is the\n      // wrong side of the relationship: it matched nothing, silently, so a\n      // delete through a hop fanned out to no one while a delete through a\n      // plain pair worked.\n      const tuple = await resolveTuple(trigger.match, id, deleted, lookup)\n      if (tuple === null) continue\n      const ids = await srcColl._findMatchingCompositeIds(tuple)\n      cap(trigger, ids.length, '')\n      for (const sid of ids) matched.add(sid)\n    }\n    for (const trigger of hopEntries) {\n      const tuple = tupleFromIntermediate(trigger.match, collectionName, deleted)\n      if (tuple === null) continue\n      const ids = await srcColl._findMatchingCompositeIds(tuple)\n      cap(trigger, ids.length, 'hop')\n      for (const sid of ids) matched.add(sid)\n    }\n    if (matched.size === 0) continue\n    if (mode !== 'eager') { for (const sid of matched) await markStale(registry, spec, sid); continue }\n    if (executorClass === null) ({ DerivationExecutor: executorClass } = await import('./executor.js'))\n    for (const sid of matched) {\n      const raw = await srcColl._getStoredRecord(sid)\n      if (raw === null) continue\n      await runOne(ctx, spec, strategyHash, executorClass, { input: { ...raw, id: sid }, base: raw, runId: sid, version: 0 })\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0EA,eAAsB,iCACpB,KACA,IACA,sBAAsB,OACL;AACjB,QAAM,EAAE,kBAAkB,gBAAgB,SAAS,OAAO,QAAQ,gBAAgB,IAAI;AAEtF,QAAM,aAAa,iBAAiB,SAAS,EAAE,oBAAoB,cAAc;AACjF,MAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,QAAM,EAAE,mBAAmB,oBAAoB,IAAI,MAAM,OAAO,8BAAqB;AACrF,QAAM,QAAQ,iBAAiB,mBAAmB;AAClD,MAAI,SAAS;AAEb,aAAW,EAAE,KAAK,KAAK,YAAY;AACjC,eAAW,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAC/D,UAAI,QAAQ,UAAU,UAAU;AAC9B,YAAI,uBAAuB,KAAK,WAAW,kBAAkB,QAAQ,eAAe,gBAAgB;AAClG,cAAI,MAAM,iBAAiB,cAAc,QAAQ,UAAU,EAAE,gBAAgB,IAAI,KAAK,EAAG,WAAU;AAAA,QACrG;AACA;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,kBAAkB,SAAS,OAAO,KAAK,QAAQ,IAAI,WAAW,QAAQ,eAAe;AAC3G,UAAI,CAAC,QAAS;AAEd,YAAM,mBAAmB,iBAAiB,cAAc,QAAQ,UAAU;AAC1E,iBAAW,aAAa,QAAQ,MAAM;AACpC,YAAI,MAAM,iBAAiB,gBAAgB,WAAW,KAAK,EAAG,WAAU;AAAA,MAC1E;AACA,YAAM,oBAAoB,SAAS,OAAO,KAAK,QAAQ,IAAI,SAAS;AAAA,IACtE;AAAA,EACF;AAEA,SAAO;AACT;AA4BA,eAAsB,oBACpB,KACA,IACA,QACA,SACA,MAKA,OACe;AACf,QAAM,EAAE,kBAAkB,gBAAgB,KAAK,gBAAgB,IAAI;AAInE,QAAM,WAAY,MAAM,IAAI,mBAAmB,MAAM,IAAI;AACzD,MAAI,YAAY,OAAO,aAAa,YAAY,kBAAkB,SAAU;AAK5E,QAAM,iBAAiB,SAAS,OAAQ,MAAM,IAAI,mBAAmB,KAAK,IAAI,QAAS;AACvF,QAAM,WAAW,iBAAiB,SAAS;AAC3C,QAAM,aAAa,SAAS,oBAAoB,cAAc;AAC9D,MAAI,WAAW,WAAW,EAAG;AAM7B,MAAI,gBAAkD;AACtD,aAAW,EAAE,MAAM,cAAc,SAAS,KAAK,YAAY;AACzD,UAAM,OAAO,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAK,UAAU;AAKlF,QAAI,KAAK,QAAQ;AACf,UAAI,SAAS,QAAS;AACtB,YAAM,aAAa,CAAC,MACjB,OAAO,MAAM,YAAY,OAAO,MAAM,WAAY,OAAO,CAAC,IAAI;AACjE,UAAI;AAOJ,UAAI,cAA6B;AACjC,UAAI,mBAAmB,KAAK,OAAO,MAAM;AACvC,mBAAW,WAAW,SAAS,KAAK,OAAO,GAAG,CAAC;AAC/C,cAAM,WAAW,kBAAkB,OAAO,WAAW,eAAe,KAAK,OAAO,GAAG,CAAC,IAAI;AACxF,YAAI,aAAa,QAAQ,aAAa,SAAU,eAAc;AAAA,MAChE,OAAO;AACL,mBAAW;AAAA,MACb;AACA,UAAI,aAAa,KAAM,OAAM,gBAAgB,MAAM,UAAU,EAAE,YAAY,gBAAgB,GAAG,GAAG,IAAI;AAGrG,UAAI,gBAAgB,KAAM,OAAM,gBAAgB,MAAM,aAAa,EAAE,YAAY,gBAAgB,GAAG,GAAG,IAAI;AAC3G;AAAA,IACF;AAUA,UAAM,WAAW,KAAK,WAAW;AACjC,UAAM,YAAY,CAAC,aAAa,KAAK,SAAS,SAAS,cAAc,KAAK;AAC1E,UAAM,iBAAiB,CAAC,YAAY,CAAC,YACjC,SAAS,OAAO,CAAC,MAAM,EAAE,eAAe,cAAc,IACtD,CAAC;AAOL,UAAM,aAAa,CAAC,YAAY,CAAC,YAC7B,SAAS,OAAO,CAAC,MAAM,eAAe,EAAE,KAAK,EAAE,SAAS,cAAc,CAAC,IACvE,CAAC;AAEL,UAAM,OAKD,CAAC;AAEN,QAAI,UAAU;AACZ,WAAK,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,GAAG,GAAG,MAAM,UAAU,OAAO,IAAI,QAAQ,CAAC;AAAA,IAC9E,WAAW,WAAW;AACpB,YAAM,IAAI,MAAM,iBAAiB,cAAc,KAAK,MAAM,EAAE,IAAI,EAAE;AAClE,UAAI,MAAM,QAAQ,MAAM,QAAW;AAGjC,cAAM,MAAM,MAAM,iBAAiB,cAAc,KAAK,MAAM,EAAE,iBAAiB,EAAE;AACjF,aAAK,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,GAAG,GAAG,MAAM,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;AAAA,MAC1E;AAAA,IACF,WAAW,eAAe,SAAS,KAAK,WAAW,SAAS,GAAG;AAC7D,YAAM,UAAU,iBAAiB,cAAc,KAAK,MAAM;AAC1D,YAAM,UAAU,oBAAI,IAAY;AAIhC,YAAM,SAAS,OAAO,MAAc,OAAe,UAA2D;AAC5G,cAAM,IAAI,iBAAiB,cAAc,IAAI;AAC7C,YAAI,UAAU,KAAM,QAAO,EAAE,iBAAiB,KAAK;AACnD,cAAM,MAAM,MAAM,EAAE,0BAA0B,CAAC,EAAE,OAAO,MAAM,CAAC,CAAC;AAChE,cAAM,QAAQ,IAAI,CAAC;AACnB,eAAO,UAAU,SAAY,OAAO,EAAE,iBAAiB,KAAK;AAAA,MAC9D;AAIA,iBAAW,WAAW,YAAY;AAChC,cAAM,SAAS,CAAC,sBAAsB,QAAQ,OAAO,gBAAgB,QAAQ,CAAC;AAC9E,YAAI,kBAAkB,MAAM;AAC1B,gBAAM,MAAM,sBAAsB,QAAQ,OAAO,gBAAgB,cAAc;AAC/E,cAAI,CAAC,UAAU,KAAK,OAAO,CAAC,CAAE,EAAG,QAAO,KAAK,GAAG;AAAA,QAClD;AACA,cAAM,MAAM,oBAAI,IAAY;AAC5B,mBAAW,SAAS,QAAQ;AAC1B,cAAI,UAAU,KAAM;AACpB,qBAAW,OAAO,MAAM,QAAQ,0BAA0B,KAAK,EAAG,KAAI,IAAI,GAAG;AAAA,QAC/E;AACA,YAAI,QAAQ,cAAc,UAAa,IAAI,OAAO,QAAQ,WAAW;AACnE,gBAAM,IAAI;AAAA,YACR,iBAAiB,cAAc,SAAI,KAAK,MAAM,KAAK,QAAQ,MAAM,IAAI,OAAK,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,YACzF,IAAI;AAAA,YAAM,QAAQ;AAAA,UAAS;AAAA,QAC/B;AACA,mBAAW,OAAO,IAAK,SAAQ,IAAI,GAAG;AAAA,MACxC;AACA,iBAAW,WAAW,gBAAgB;AAMpC,cAAM,SAAS,CAAC,MAAM,aAAa,QAAQ,OAAO,IAAI,UAAU,MAAM,CAAC;AACvE,YAAI,kBAAkB,QAAQ,QAAQ,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,GAAG;AACxE,gBAAM,MAAM,MAAM,aAAa,QAAQ,OAAO,IAAI,gBAAgB,MAAM;AACxE,cAAI,CAAC,UAAU,KAAK,OAAO,CAAC,CAAE,EAAG,QAAO,KAAK,GAAG;AAAA,QAClD;AACA,cAAM,MAAM,oBAAI,IAAY;AAC5B,mBAAW,SAAS,QAAQ;AAC1B,cAAI,UAAU,KAAM;AACpB,qBAAW,OAAO,MAAM,QAAQ,0BAA0B,KAAK,EAAG,KAAI,IAAI,GAAG;AAAA,QAC/E;AACA,YAAI,QAAQ,cAAc,UAAa,IAAI,OAAO,QAAQ,WAAW;AACnE,gBAAM,IAAI;AAAA,YACR,aAAa,cAAc,SAAI,KAAK,MAAM,KAAK,QAAQ,MAAM,IAAI,OAAK,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,YACrF,IAAI;AAAA,YAAM,QAAQ;AAAA,UAAS;AAAA,QAC/B;AACA,mBAAW,OAAO,IAAK,SAAQ,IAAI,GAAG;AAAA,MACxC;AACA,iBAAW,OAAO,SAAS;AACzB,cAAM,MAAM,MAAM,QAAQ,iBAAiB,GAAG;AAC9C,YAAI,QAAQ,KAAM;AAClB,aAAK,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,IAAI,GAAG,MAAM,KAAK,OAAO,KAAK,SAAS,EAAE,CAAC;AAAA,MAC7E;AAAA,IACF;AAEA,QAAI,KAAK,WAAW,EAAG;AAEvB,QAAI,SAAS,SAAS;AACpB,iBAAW,OAAO,KAAM,OAAM,UAAU,UAAU,MAAM,IAAI,KAAK;AACjE;AAAA,IACF;AAEA,QAAI,kBAAkB,MAAM;AAC1B;AAAC,OAAC,EAAE,oBAAoB,cAAc,IAAI,MAAM,OAAO,wBAAe;AAAA,IACxE;AAGA,eAAW,OAAO,KAAM,OAAM,OAAO,KAAK,MAAa,cAAc,eAAe,GAAG;AAAA,EACzF;AACF;AASA,eAAe,OACb,KAEA,MACA,cACA,eACA,KACe;AACf,QAAM,EAAE,kBAAkB,SAAS,OAAO,QAAQ,iBAAiB,aAAa,SAAS,IAAI;AAC7F,QAAM,UAAU,EAAE,OAAO,iBAAiB,kBAAkB,EAAE;AAC9D,QAAM,SAAS,YAAY,EAAE,YAAY,KAAK,QAAQ,IAAI,IAAI,MAAM,CAAC;AACrE,QAAM,SAAS,MAAM,cAAc,IAAI,MAAM,IAAI,OAAO,IAAI,SAAS,cAAc,OAAO;AAC1F,aAAW,OAAO,OAAO,KAAK,KAAK,OAAO,GAAG;AAC3C,UAAM,MAAM,OAAO,QAAQ,GAAG;AAC9B,QAAI,CAAC,IAAK;AACV,QAAI,IAAI,SAAS,UAAU;AACzB,YAAM,MAAM,IAAI;AAChB,UAAI,KAAK,OAAQ,OAAM;AACvB,cAAQ,KAAK,wBAAwB,GAAG,iBAAiB,KAAK,MAAM,SAAS,IAAI,KAAK,aAAa,GAAG;AACtG;AAAA,IACF;AACA,UAAM,UAAU,KAAK,QAAQ,GAAG;AAChC,QAAI,CAAC,QAAS;AACd,UAAM,mBAAmB,iBAAiB,cAAc,QAAQ,UAAU;AAQ1E,UAAM,QAAQ,iBAAiB,mBAAmB;AAGlD,QAAI,IAAI,SAAS,SAAS;AAExB,YAAM,EAAE,mBAAmB,kBAAkB,IAAI,MAAM,OAAO,8BAAqB;AACnF,YAAM,QAAQ,MAAM,kBAAkB,SAAS,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,eAAe;AAC1G,YAAM,WAAW,IAAI,IAAY,OAAO,QAAQ,CAAC,CAAC;AAClD,YAAM,cAAc,IAAI,QAAQ,IAAI,CAAC,MAAuB,EAAE,GAAG;AACjE,YAAM,aAAa,IAAI,IAAY,WAAW;AAG9C,iBAAW,KAAK,UAAU;AACxB,YAAI,WAAW,IAAI,CAAC,EAAG;AACvB,cAAM,iBAAiB,gBAAgB,GAAG,KAAK;AAAA,MACjD;AAKA,iBAAW,SAAS,IAAI,SAAS;AAC/B,YAAI,UAAU,MAAM;AAClB,mBAAS,OAAO,QAAQ,YAAY,MAAM,KAAK,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,MAAM,GAAG,CAAC;AAAA,QACxG;AACA,cAAM,iBAAiB,kBAAkB,MAAM,KAAK,MAAM,OAAO,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAAA,MAChG;AAGA,YAAM,kBAAkB,SAAS,OAAO;AAAA,QACtC,QAAQ,KAAK;AAAA,QACb,UAAU,IAAI;AAAA,QACd,WAAW;AAAA,QACX,kBAAkB,QAAQ;AAAA,QAC1B,MAAM;AAAA,MACR,GAAG,QAAQ,eAAe;AAC1B;AAAA,IACF;AAGA,QAAI,IAAI,YAAY,MAAM;AASxB,YAAM,iBAAiB,gBAAgB,IAAI,OAAO,KAAK;AACvD;AAAA,IACF;AAUA,QAAI,QAAQ,UAAU,YAAY,QAAQ,WAAW,UAAa,QAAQ,eAAe,KAAK,QAAQ;AACpG,YAAM,QAAQ,IAAI;AAClB,YAAM,UAAmC,EAAE,GAAG,IAAI,KAAK;AACvD,UAAI,UAAU;AACd,iBAAW,KAAK,QAAQ,QAAQ;AAC9B,YAAI,CAAC,oBAAoB,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG;AAC/C,kBAAQ,CAAC,IAAI,MAAM,CAAC;AACpB,oBAAU;AAAA,QACZ;AAAA,MACF;AACA,UAAI,CAAC,QAAS;AACd,UAAI,UAAU,MAAM;AAClB,iBAAS,OAAO,QAAQ,YAAY,IAAI,OAAO,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,CAAC;AAAA,MACxG;AACA,YAAM,iBAAiB,kBAAkB,IAAI,OAAO,SAAS,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAC1F;AAAA,IACF;AAGA,QAAI,UAAU,MAAM;AAClB,eAAS,OAAO,QAAQ,YAAY,IAAI,OAAO,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,CAAC;AAAA,IACxG;AACA,UAAM,iBAAiB,kBAAkB,IAAI,OAAO,IAAI,OAAO,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAAA,EAC9F;AACF;AAWA,eAAsB,mCACpB,KAA4B,IAAY,SACzB;AACf,QAAM,EAAE,kBAAkB,eAAe,IAAI;AAC7C,QAAM,WAAW,iBAAiB,SAAS;AAC3C,QAAM,aAAa,SAAS,oBAAoB,cAAc;AAC9D,MAAI,WAAW,WAAW,EAAG;AAC7B,MAAI,gBAAkD;AACtD,aAAW,EAAE,MAAM,cAAc,SAAS,KAAK,YAAY;AACzD,QAAI,KAAK,OAAQ;AACjB,QAAI,KAAK,WAAW,eAAgB;AACpC,QAAI,KAAK,SAAS,SAAS,cAAc,EAAG;AAC5C,UAAM,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,eAAe,cAAc;AAKtE,UAAM,aAAa,SAAS,OAAO,CAAC,MAAM,eAAe,EAAE,KAAK,EAAE,SAAS,cAAc,CAAC;AAC1F,QAAI,QAAQ,WAAW,KAAK,WAAW,WAAW,EAAG;AACrD,UAAM,OAAO,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAK,UAAU;AAClF,UAAM,UAAU,iBAAiB,cAAc,KAAK,MAAM;AAC1D,UAAM,UAAU,oBAAI,IAAY;AAChC,UAAM,SAAS,OAAO,MAAc,OAAe,UAA2D;AAC5G,YAAM,IAAI,iBAAiB,cAAc,IAAI;AAC7C,UAAI,UAAU,KAAM,QAAO,EAAE,iBAAiB,KAAK;AACnD,YAAM,QAAQ,MAAM,EAAE,0BAA0B,CAAC,EAAE,OAAO,MAAM,CAAC,CAAC;AAClE,YAAM,QAAQ,MAAM,CAAC;AACrB,aAAO,UAAU,SAAY,OAAO,EAAE,iBAAiB,KAAK;AAAA,IAC9D;AACA,UAAM,MAAM,CAAC,SAAuE,GAAW,UAAwB;AACrH,UAAI,QAAQ,cAAc,UAAa,IAAI,QAAQ,WAAW;AAC5D,cAAM,IAAI;AAAA,UACR,aAAa,KAAK,IAAI,cAAc,SAAI,KAAK,MAAM,KAAK,QAAQ,MAAM,IAAI,OAAK,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,UAC9F;AAAA,UAAG,QAAQ;AAAA,QAAS;AAAA,MACxB;AAAA,IACF;AACA,eAAW,WAAW,SAAS;AAM7B,YAAM,QAAQ,MAAM,aAAa,QAAQ,OAAO,IAAI,SAAS,MAAM;AACnE,UAAI,UAAU,KAAM;AACpB,YAAM,MAAM,MAAM,QAAQ,0BAA0B,KAAK;AACzD,UAAI,SAAS,IAAI,QAAQ,EAAE;AAC3B,iBAAW,OAAO,IAAK,SAAQ,IAAI,GAAG;AAAA,IACxC;AACA,eAAW,WAAW,YAAY;AAChC,YAAM,QAAQ,sBAAsB,QAAQ,OAAO,gBAAgB,OAAO;AAC1E,UAAI,UAAU,KAAM;AACpB,YAAM,MAAM,MAAM,QAAQ,0BAA0B,KAAK;AACzD,UAAI,SAAS,IAAI,QAAQ,KAAK;AAC9B,iBAAW,OAAO,IAAK,SAAQ,IAAI,GAAG;AAAA,IACxC;AACA,QAAI,QAAQ,SAAS,EAAG;AACxB,QAAI,SAAS,SAAS;AAAE,iBAAW,OAAO,QAAS,OAAM,UAAU,UAAU,MAAM,GAAG;AAAG;AAAA,IAAS;AAClG,QAAI,kBAAkB,KAAM,EAAC,EAAE,oBAAoB,cAAc,IAAI,MAAM,OAAO,wBAAe;AACjG,eAAW,OAAO,SAAS;AACzB,YAAM,MAAM,MAAM,QAAQ,iBAAiB,GAAG;AAC9C,UAAI,QAAQ,KAAM;AAClB,YAAM,OAAO,KAAK,MAAM,cAAc,eAAe,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,IAAI,GAAG,MAAM,KAAK,OAAO,KAAK,SAAS,EAAE,CAAC;AAAA,IACxH;AAAA,EACF;AACF;","names":[]}

package/dist/executor-5NIMLSKZ.js

@@ -1,8 +0,0 @@
-import {
-  DerivationExecutor
-} from "./chunk-TFR7DSOV.js";
-import "./chunk-7O3Y4PPD.js";
-export {
-  DerivationExecutor
-};
-//# sourceMappingURL=executor-5NIMLSKZ.js.map

package/dist/executor-7UQ3BZ4F.js

@@ -1,29 +0,0 @@
-import {
-  MaterializedViewExecutor
-} from "./chunk-KKEESNPE.js";
-import "./chunk-PPTHY5QO.js";
-import "./chunk-VXANTWBJ.js";
-import "./chunk-3BZZJJMQ.js";
-import "./chunk-R7BX2NB3.js";
-import "./chunk-ZORTV6NH.js";
-import "./chunk-ZN4FD4PE.js";
-import "./chunk-XZHEOSQ2.js";
-import "./chunk-ATL3ZVXT.js";
-import "./chunk-NSITFOCJ.js";
-import "./chunk-Q2MPFCQ7.js";
-import "./chunk-TRGTKX5E.js";
-import "./chunk-UXVWEX5L.js";
-import "./chunk-QPQUVOZ2.js";
-import "./chunk-4ZS56W5S.js";
-import "./chunk-SZJ3DLZA.js";
-import "./chunk-BRLKZUBT.js";
-import "./chunk-BTDR2PXY.js";
-import "./chunk-CHQCZZWC.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-HPVZCW43.js";
-import "./chunk-7MG7SJT7.js";
-import "./chunk-7O3Y4PPD.js";
-export {
-  MaterializedViewExecutor
-};
-//# sourceMappingURL=executor-7UQ3BZ4F.js.map

package/dist/executor-AQVXV5GZ.js

@@ -1,8 +0,0 @@
-import {
-  GuardExecutor
-} from "./chunk-4OZNXTO4.js";
-import "./chunk-7O3Y4PPD.js";
-export {
-  GuardExecutor
-};
-//# sourceMappingURL=executor-AQVXV5GZ.js.map

package/dist/export-accessible-ORMKLA3E.js

@@ -1,22 +0,0 @@
-import {
-  buildAccessibleBundle,
-  exportAccessibleData,
-  resolveAccessibleCollections
-} from "./chunk-JVIBCBC7.js";
-import "./chunk-BVN6KXL2.js";
-import "./chunk-EQEYOJBM.js";
-import "./chunk-4ZS56W5S.js";
-import "./chunk-SZJ3DLZA.js";
-import "./chunk-BRLKZUBT.js";
-import "./chunk-BTDR2PXY.js";
-import "./chunk-CHQCZZWC.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-HPVZCW43.js";
-import "./chunk-7MG7SJT7.js";
-import "./chunk-7O3Y4PPD.js";
-export {
-  buildAccessibleBundle,
-  exportAccessibleData,
-  resolveAccessibleCollections
-};
-//# sourceMappingURL=export-accessible-ORMKLA3E.js.map

package/dist/extract-partition-NKYO3WNG.js

@@ -1,37 +0,0 @@
-import {
-  extractPartition,
-  extractPartitionCore,
-  reKeyBlobs,
-  reKeyClosure,
-  reKeyLedger,
-  reKeySchemas,
-  sealDeks
-} from "./chunk-3PGS7TYR.js";
-import "./chunk-SGZAIJCV.js";
-import "./chunk-BVN6KXL2.js";
-import "./chunk-EQEYOJBM.js";
-import "./chunk-HIWCKBEY.js";
-import "./chunk-UGTBXF5U.js";
-import "./chunk-4AOERLTV.js";
-import "./chunk-I7FD46FF.js";
-import "./chunk-QPQUVOZ2.js";
-import "./chunk-JMGDHKQF.js";
-import "./chunk-4ZS56W5S.js";
-import "./chunk-SZJ3DLZA.js";
-import "./chunk-BRLKZUBT.js";
-import "./chunk-BTDR2PXY.js";
-import "./chunk-CHQCZZWC.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-HPVZCW43.js";
-import "./chunk-7MG7SJT7.js";
-import "./chunk-7O3Y4PPD.js";
-export {
-  extractPartition,
-  extractPartitionCore,
-  reKeyBlobs,
-  reKeyClosure,
-  reKeyLedger,
-  reKeySchemas,
-  sealDeks
-};
-//# sourceMappingURL=extract-partition-NKYO3WNG.js.map

package/dist/fanout-sidecar-S3QL53YX.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-formula/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations.\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * The body is encrypted (AES-GCM under the `_meta` collection DEK) when\n * the vault is encrypted — the `keys[]` are derived-row ids produced by a\n * user-supplied key extractor and can be content-bearing (SKU, tag, email),\n * so a ciphertext-only store must not read them, the derivation graph, or\n * `emittedAt`. Back-compat: sidecars written before this fix are plaintext\n * (`_iv === ''`); `loadFanoutSidecar` dual-reads them.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** The `_meta` collection name whose DEK encrypts the sidecar body. */\nconst FANOUT_DEK_COLLECTION = '_meta'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/**\n * Read the sidecar; returns `undefined` only when it's legitimately absent\n * (no envelope at that id) — the correct signal for callers to skip\n * orphan-row reconciliation because there's nothing to reconcile against.\n *\n * A PRESENT envelope that fails to decrypt or parse is a data-integrity\n * problem, not an absence, and is deliberately NOT caught here: swallowing\n * it to `undefined` would look identical to \"no sidecar\" and make callers\n * (the array-derivation dispatch in `vault.ts`/`collection.ts`) silently\n * skip deleting stale derived rows on a shrink. Let `openEnvelopeJson`'s\n * `DecryptionError`/`TamperedError` and `JSON.parse` failures propagate,\n * matching the no-catch convention of sibling decrypt call-sites (e.g.\n * `with-audit/consent/consent.ts`'s `decryptEntry`).\n *\n * Dual-reads for back-compat: an envelope with `_iv === ''` is a legacy\n * plaintext sidecar (parse `_data` directly); otherwise the body was\n * encrypted under the `_meta` DEK and is decrypted first.\n */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  // Legacy plaintext (`_iv === ''`) reads directly; encrypted bodies decrypt.\n  const json = (!encrypted || envelope._iv === '')\n    ? envelope._data\n    : await openEnvelopeJson({ collection: '_meta', id: recordId(source, sourceId, outputKey) }, envelope, await getDEK(FANOUT_DEK_COLLECTION))\n  const parsed = JSON.parse(json) as FanoutSidecar\n  if (parsed._noydb_fanout !== 1) return undefined\n  if (!Array.isArray(parsed.keys)) return undefined\n  return parsed\n}\n\n/**\n * Persist (insert/replace) the sidecar with a fresh key set. The body is\n * encrypted under the `_meta` DEK when the vault is encrypted (the `keys[]`\n * can be content-bearing); plaintext only in debug/unencrypted vaults.\n */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const json = JSON.stringify(doc)\n  const version = (prior?._v ?? 0) + 1\n  const identity = { collection: '_meta', id, version }\n  let envelope: EncryptedEnvelope\n  if (!encrypted) {\n    envelope = buildRecordEnvelope(identity, { iv: '', data: json })\n  } else {\n    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION), buildRecordAad(identity))\n    envelope = buildRecordEnvelope(identity, { iv, data })\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA4BA,IAAM,wBAAwB;AA2B9B,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AAoBA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACA,QACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,OAAQ,CAAC,aAAa,SAAS,QAAQ,KACzC,SAAS,QACT,MAAM,iBAAiB,EAAE,YAAY,SAAS,IAAI,SAAS,QAAQ,UAAU,SAAS,EAAE,GAAG,UAAU,MAAM,OAAO,qBAAqB,CAAC;AAC5I,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,MAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,SAAO;AACT;AAOA,eAAsB,kBACpB,OACA,OACA,SAOA,QACA,WACe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,QAAM,WAAW,OAAO,MAAM,KAAK;AACnC,QAAM,WAAW,EAAE,YAAY,SAAS,IAAI,QAAQ;AACpD,MAAI;AACJ,MAAI,CAAC,WAAW;AACd,eAAW,oBAAoB,UAAU,EAAE,IAAI,IAAI,MAAM,KAAK,CAAC;AAAA,EACjE,OAAO;AACL,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,OAAO,qBAAqB,GAAG,eAAe,QAAQ,CAAC;AACtG,eAAW,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAAA,EACvD;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}

package/dist/find-NOGJ25VX.js

@@ -1,10 +0,0 @@
-import {
-  computeBidxTarget
-} from "./chunk-CHQCZZWC.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-HPVZCW43.js";
-import "./chunk-7O3Y4PPD.js";
-export {
-  computeBidxTarget
-};
-//# sourceMappingURL=find-NOGJ25VX.js.map

package/dist/issue-3DTQ7VJJ.js

@@ -1,18 +0,0 @@
-import {
-  issueAttestationCore
-} from "./chunk-UDHWDSRL.js";
-import "./chunk-G73UVHCA.js";
-import "./chunk-4AOERLTV.js";
-import "./chunk-4ZS56W5S.js";
-import "./chunk-SZJ3DLZA.js";
-import "./chunk-BRLKZUBT.js";
-import "./chunk-BTDR2PXY.js";
-import "./chunk-CHQCZZWC.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-HPVZCW43.js";
-import "./chunk-7MG7SJT7.js";
-import "./chunk-7O3Y4PPD.js";
-export {
-  issueAttestationCore
-};
-//# sourceMappingURL=issue-3DTQ7VJJ.js.map

package/dist/json-schema-V3M5MUCM.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/introspection/json-schema.ts"],"sourcesContent":["/**\n * `buildJsonSchema` — pure overlay that merges describe() metadata onto a\n * base JSON Schema (from derivePersistedSchema) as `x-` extension keys.\n *\n * When no base JSON Schema is available (non-zod / unknown validator),\n * builds a minimal `{ type:'object', properties }` from describe()'s field\n * type tags. No static `import 'zod'` — validator derivation stays lazy.\n *\n * @module\n */\n\nimport type { CollectionDescription } from './describe.js'\n\n/** Map a DescribedField's type tag to a JSON-Schema `type`. */\nfunction jsonType(t: string): string {\n  switch (t) {\n    case 'number': return 'number'\n    case 'boolean': return 'boolean'\n    case 'array': return 'array'\n    case 'object': return 'object'\n    default: return 'string'\n  }\n}\n\n/** Overlay describe() metadata onto a base JSON Schema (or build a minimal one). */\nexport function buildJsonSchema(desc: CollectionDescription, base?: Record<string, unknown> | null): object {\n  const baseProps = (base?.['properties'] as Record<string, Record<string, unknown>> | undefined) ?? {}\n  const properties: Record<string, Record<string, unknown>> = {}\n  for (const f of desc.fields) {\n    const prop: Record<string, unknown> = { ...(baseProps[f.key] ?? { type: jsonType(f.type) }) }\n    prop['x-label'] = f.label\n    if (f.unit !== undefined) prop['x-unit'] = f.unit\n    if (f.semanticType !== undefined) prop['x-semanticType'] = f.semanticType\n    if (f.sensitivity !== undefined) prop['x-sensitivity'] = f.sensitivity\n    if (f.widget !== undefined) prop['x-widget'] = f.widget\n    if (f.editable === false) prop['x-readonly'] = true\n    if (f.money !== undefined) prop['x-money'] = f.money\n    if (f.ref !== undefined) prop['x-ref'] = f.ref.target\n    if (f.dict?.values) {\n      const labels: Record<string, string> = {}\n      for (const v of f.dict.values) if (v.label !== undefined) labels[v.value] = v.label\n      if (Object.keys(labels).length) prop['x-enumLabels'] = labels\n    }\n    // `x-classified` carries the whole classified block, incl. `equatable` when\n    // set — emitted ungated (boundary note on DescribedField.classified): a\n    // deployment wanting it gated can gate this behind its value-bearing door.\n    if (f.classified !== undefined) prop['x-classified'] = f.classified\n    properties[f.key] = prop\n  }\n  return base != null && typeof base === 'object'\n    ? { ...base, properties }\n    : { type: 'object', properties }\n}\n"],"mappings":";AAcA,SAAS,SAAS,GAAmB;AACnC,UAAQ,GAAG;AAAA,IACT,KAAK;AAAU,aAAO;AAAA,IACtB,KAAK;AAAW,aAAO;AAAA,IACvB,KAAK;AAAS,aAAO;AAAA,IACrB,KAAK;AAAU,aAAO;AAAA,IACtB;AAAS,aAAO;AAAA,EAClB;AACF;AAGO,SAAS,gBAAgB,MAA6B,MAA+C;AAC1G,QAAM,YAAa,OAAO,YAAY,KAA6D,CAAC;AACpG,QAAM,aAAsD,CAAC;AAC7D,aAAW,KAAK,KAAK,QAAQ;AAC3B,UAAM,OAAgC,EAAE,GAAI,UAAU,EAAE,GAAG,KAAK,EAAE,MAAM,SAAS,EAAE,IAAI,EAAE,EAAG;AAC5F,SAAK,SAAS,IAAI,EAAE;AACpB,QAAI,EAAE,SAAS,OAAW,MAAK,QAAQ,IAAI,EAAE;AAC7C,QAAI,EAAE,iBAAiB,OAAW,MAAK,gBAAgB,IAAI,EAAE;AAC7D,QAAI,EAAE,gBAAgB,OAAW,MAAK,eAAe,IAAI,EAAE;AAC3D,QAAI,EAAE,WAAW,OAAW,MAAK,UAAU,IAAI,EAAE;AACjD,QAAI,EAAE,aAAa,MAAO,MAAK,YAAY,IAAI;AAC/C,QAAI,EAAE,UAAU,OAAW,MAAK,SAAS,IAAI,EAAE;AAC/C,QAAI,EAAE,QAAQ,OAAW,MAAK,OAAO,IAAI,EAAE,IAAI;AAC/C,QAAI,EAAE,MAAM,QAAQ;AAClB,YAAM,SAAiC,CAAC;AACxC,iBAAW,KAAK,EAAE,KAAK,OAAQ,KAAI,EAAE,UAAU,OAAW,QAAO,EAAE,KAAK,IAAI,EAAE;AAC9E,UAAI,OAAO,KAAK,MAAM,EAAE,OAAQ,MAAK,cAAc,IAAI;AAAA,IACzD;AAIA,QAAI,EAAE,eAAe,OAAW,MAAK,cAAc,IAAI,EAAE;AACzD,eAAW,EAAE,GAAG,IAAI;AAAA,EACtB;AACA,SAAO,QAAQ,QAAQ,OAAO,SAAS,WACnC,EAAE,GAAG,MAAM,WAAW,IACtB,EAAE,MAAM,UAAU,WAAW;AACnC;","names":[]}

package/dist/kernel/enclave/classify/compare.d.ts

@@ -1,10 +0,0 @@
-/** Compare exactly-32-byte tags. XOR-accumulate over all 32 bytes, no early exit. */
-export declare function ctEqualTags(a: Uint8Array, b: Uint8Array): boolean;
-/**
- * Blinded equality of arbitrary-length byte strings: fresh K_e per
- * comparison (never stored, never reused), HMAC both sides to 32-byte
- * tags, then ctEqualTags. On the digest path the inputs are already
- * 32-byte PBKDF2 outputs but still route through this reduction so
- * there is exactly ONE comparison construction (spec §3 rule 2).
- */
-export declare function blindedEqual(a: Uint8Array, b: Uint8Array): Promise<boolean>;

package/dist/kernel/enclave/index.d.ts

@@ -1,87 +0,0 @@
-/**
- * **kernel/enclave** — the hub's crypto interior, behind one door.
- *
- * This barrel is **the fork-swap contract**: a sister project that wants a
- * different crypto engine (a different KDF, a hardware-backed keystore, a
- * post-quantum wrap algorithm, …) replaces the entire `kernel/enclave/`
- * folder wholesale and only has to honor the exports below. Nothing outside
- * `kernel/enclave/**` may deep-import `crypto.js` or `record-keys/*` directly
- * — `scripts/check-architecture.mjs`'s `enclave-barrel-only` check enforces
- * that mechanically. Import sites inside `kernel/enclave/**` keep their
- * existing relative imports; this door is for everyone else.
- *
- * The export list is the OBSERVED contract — exactly the symbols consumed
- * from outside this folder today — grouped by the module that defines them:
- *
- *   - key type       — `crypto.ts`: `EnclaveKey`, the opaque key type every
- *                       barrel-facing signature traffics in (`= CryptoKey` in
- *                       noy-db's reference enclave; a fork redefines it to its
- *                       own key representation — see the type's own doc for
- *                       the fork contract).
- *   - crypto ops     — `crypto.ts`: AES-256-GCM encrypt/decrypt (+ bytes, AAD,
- *                       deterministic variants), SHA-256 / HMAC-SHA-256 hashing.
- *   - key lifecycle  — `crypto.ts` + `record-keys/lifecycle.ts`: KEK/DEK
- *                       derivation, AES-KW wrap/unwrap, per-record CEK
- *                       wrap/unwrap/import + resolution/re-wrap, HKDF-derived
- *                       presence/sealed-field keys, base64 helpers.
- *   - record codec   — `record-keys/record-codec.ts`: the per-record
- *                       encode/decode engine.
- *   - sealing        — `record-keys/sealing.ts`: the sealed-record grantor
- *                       primitives (seal/revoke/rotate to an `at-*` host).
- *   - deterministic  — `record-keys/deterministic.ts`: blind-equality lookup
- *                       over deterministically-encrypted fields.
- *   - tombstone      — `record-keys/tombstone.ts`: the erased-record residue.
- *   - envelope body  — `record-keys/envelope-body.ts`: the C1 protected-body
- *                       access contract (`openEnvelopeJson`,
- *                       `writeEnvelopeBody`, `hasPerRecordKey`,
- *                       `hasSealedBody`, `envelopeBodyForHash`) — the
- *                       sanctioned door onto
- *                       `_iv`/`_data`/`_cek`/`_sealed` for everyone outside
- *                       this folder.
- *   - reserved envelopes — `record-keys/sealed-slots.ts`: `makeReservedEnvelopes`,
- *                       the whole-envelope encrypt/decrypt door scoped to a
- *                       declared collection-name prefix (e.g. `_dict_`) —
- *                       `kernel/vault.ts` binds it for `DictionaryHandle`
- *                       (#629 Task 4).
- *
- * Additive changes only — removing or renaming an export here is breaking
- * for any fork. Frozen by `__tests__/enclave-surface-golden.test.ts`.
- *
- * **Refusal contract:** the barrel above is frozen — every symbol must
- * exist in any fork — but the optional groups (sealing, deterministic,
- * per-record-key lifecycle) MAY throw `EnclaveNotSupportedError` instead
- * of implementing the reference behavior. The core groups (crypto ops,
- * record codec, tombstone) MUST NOT throw it — they are load-bearing for
- * every consumer regardless of which enclave is wired in. noy-db's own
- * enclave supports every group, so it never throws this error.
- */
-export type { EnclaveKey, EncryptResult } from './crypto.js';
-export { encrypt, decrypt, encryptBytes, decryptBytes, encryptBytesWithAAD, decryptBytesWithAAD, encryptDeterministic, decryptDeterministic, sha256Hex, hmacSha256Hex, deriveBlobAddressKey, } from './crypto.js';
-export { deriveKey, deriveSecretKey, generateDEK, exportDekSet, importDekSet, generateSalt, generateRecoverySecret, generateIV, wrapKey, unwrapKey, bufferToBase64, base64ToBuffer, derivePresenceKey, deriveDeterministicKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, wrapCek, unwrapCek, importCek, encodeEchoParts, deriveEchoKey, } from './crypto.js';
-export type { SecretKeyUsage } from './crypto.js';
-export type { EchoSecretParts } from './crypto.js';
-export { resolveStableCek, rewrapBodyToDek, rewrapEnvelope, applyRewrappedBody, isRewrappedUnder } from './record-keys/lifecycle.js';
-export type { RewrappedBody } from './record-keys/lifecycle.js';
-export { rekeyEnvelopeToDek, rekeyEnvelopeIfNeeded, envelopeOpensUnderAny } from './record-keys/rekey.js';
-export { rekeyBlobSet } from './record-keys/rekey-blob.js';
-export { buildRecordEnvelope, buildSealedRecordEnvelope } from './record-envelope.js';
-export type { RecordEnvelopeBody } from './record-envelope.js';
-export { buildRecordAad, recordAadFor } from './record-aad.js';
-export type { RecordIdentity, RecordRef } from './record-aad.js';
-export { RecordCodec } from './record-keys/record-codec.js';
-export type { SealedShredSlot } from './record-keys/record-codec.js';
-export { SEALED_CEK_NS, sealRecordToHost, revokeSealedRecord, rotateRecordCek } from './record-keys/sealing.js';
-export type { SealingContext } from './record-keys/sealing.js';
-export { findByDet, queryByDet } from './record-keys/deterministic.js';
-export type { DeterministicContext } from './record-keys/deterministic.js';
-export { isTombstone, isTombstoneShape, buildTombstone, isDeleteMarker, buildDeleteMarker } from './record-keys/tombstone.js';
-export { openEnvelopeJson, writeEnvelopeBody, hasPerRecordKey, hasSealedBody, envelopeBodyForHash, envelopeBodySize, verifyRecordIdentity } from './record-keys/envelope-body.js';
-export { makeReservedEnvelopes } from './record-keys/sealed-slots.js';
-export { deriveVdigSlotKey } from './classify/vdig.js';
-export { pbkdf2VerifyDigest } from './classify/digest.js';
-export { ctEqualTags } from './classify/compare.js';
-export { evaluateKofN } from './classify/kofn.js';
-export { deriveClassifyIndexKey, deriveClassifyIndexSalt, mintBidxTag } from './classify/bidx.js';
-export { computeBidxTarget } from './classify/find.js';
-export { deriveBrokerProofBits, deriveBrokerProofKey, computeBrokerProof, issueChallenge, verifyBrokerProof, } from './broker/proof.js';
-export type { BrokerProofCanonicalParts, VerifyBrokerProofArgs, IssuedChallenge } from './broker/proof.js';

package/dist/kernel/enclave/record-keys/lifecycle.d.ts

@@ -1,124 +0,0 @@
-/**
- * Per-record CEK lifecycle helpers for the WRITE path.
- *
- * These are the collection-coupled CEK operations, lifted off `Collection`
- * behind narrow deps so the kernel file delegates instead of carrying the
- * crypto inline:
- *
- *   - {@link resolveStableCek} — the stable-CEK rule: an update or history
- *     snapshot reuses the record's existing CEK so a single CEK delete kills
- *     the whole version chain; a genuine insert (or legacy record being
- *     migrated) mints a fresh one.
- *   - {@link rewrapBodyToDek} — move a record body's wrapping from one DEK to
- *     another (tier elevate/demote, bundle re-key) WITHOUT changing the body
- *     key: unwrap the CEK under the source DEK, re-encrypt the body under the
- *     same CEK, re-wrap the CEK under the destination DEK. History-chain
- *     identity is preserved because the body key never changes.
- *
- * Both are pure functions over their deps — the `cekCache` ownership stays on
- * the collection (its lifetime is tied to `load()`), so callers cache the
- * returned key themselves.
- */
-import { type EnclaveKey } from '../crypto.js';
-import type { EncryptedEnvelope } from '../../types.js';
-import { type RecordIdentity } from '../record-aad.js';
-import type { Lru } from '../../cache/index.js';
-/** Dependencies {@link resolveStableCek} needs from its collection. */
-export interface StableCekDeps {
-    /** The collection's per-record CEK cache (`null` → no caching). */
-    readonly cache: Lru<string, EnclaveKey> | null;
-    /** Read the record's live envelope (to recover an existing `_cek`). */
-    getLive(id: string): Promise<EncryptedEnvelope | null>;
-    /** The DEK the CEK is wrapped under (the collection DEK on the normal path). */
-    getDEK(): Promise<EnclaveKey>;
-}
-/**
- * Resolve the stable CEK for a record on the write path. Caches the resolved
- * key under `id` so an update + its history snapshot share one CEK.
- */
-export declare function resolveStableCek(deps: StableCekDeps, id: string): Promise<EnclaveKey>;
-/** Re-wrapped body bytes + the (optional) CEK to cache. */
-export interface RewrappedBody {
-    readonly _iv: string;
-    readonly _data: string;
-    /** Present iff the source envelope carried a CEK (per-record-key record). */
-    readonly _cek?: string;
-    /** The body key when one exists, so the caller can cache it; `null` for a legacy record. */
-    readonly cek: EnclaveKey | null;
-}
-/**
- * Move a record body from `fromDek`/`from` to `toDek`/`to`.
- *
- * - Per-record-key record (`_cek` present): unwrap the CEK under `fromDek`,
- *   re-encrypt the body under the SAME CEK, re-wrap the CEK under `toDek`. The
- *   body key is unchanged → history-chain identity preserved.
- * - Legacy record (no `_cek`): decrypt under `fromDek`, re-encrypt under `toDek`
- *   directly.
- *
- * ## Why it takes TWO identities (#1041)
- *
- * A rewrap is the one operation where the identity genuinely **changes**. A
- * tier move rewrites `_tier`; a history snapshot lands at a different
- * `(collection, id)` entirely. Since AAD binds both, the body must be opened
- * under the identity it currently has and re-sealed under the one it is moving
- * to. A single identity would be wrong for one end or the other.
- *
- * ⚠️ **This retires an optimisation, deliberately.** Callers used to compute
- * ONE rewrap and reuse the bytes for both a tier move's live write and its
- * `_history` snapshot (#728). Those now have different destination identities,
- * so they need different AAD and therefore different ciphertext — the same
- * bytes cannot satisfy both. Reusing one rewrap for two destinations is now a
- * silent corruption, not a saving: it produces a record that opens at one
- * address and not the other.
- */
-export declare function rewrapBodyToDek(from: RecordIdentity, to: RecordIdentity, envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek' | '_tier' | '_by'>, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<RewrappedBody>;
-/**
- * Merge an ALREADY-rewrapped {@link RewrappedBody} into `envelope`, keeping
- * every field but the re-keyed body (`_iv`/`_data`/`_cek`) unchanged.
- *
- * Body-field access (`_iv`/`_data`/`_cek`) is sanctioned inside the enclave;
- * this lets callers outside it get back a ready-to-store envelope without
- * reading those fields themselves. Takes a body the caller has ALREADY
- * computed (vs. {@link rewrapEnvelope}, which also runs `rewrapBodyToDek`)
- * so a caller building a SECOND envelope from the same rewrap — a tier
- * move's live write AND its pre-move `_history` snapshot, #728 — pays the
- * unwrap/decrypt/encrypt/wrap crypto once, not twice.
- */
-export declare function applyRewrappedBody(envelope: EncryptedEnvelope, body: RewrappedBody): EncryptedEnvelope;
-/**
- * Move a FULL stored envelope from `fromDek` to `toDek`, preserving every
- * field other than the re-keyed body (`_iv`/`_data`/`_cek`) unchanged.
- * Mirrors the spread-merge idiom `with-audit/tiers/index.ts`'s
- * `elevate()`/`demote()` use to apply `rewrapBodyToDek`'s result to the live
- * envelope, generalized to any envelope shape (history callers don't bump
- * `_v`/`_ts`/`_tier` the way a tier move does).
- */
-export declare function rewrapEnvelope(identity: RecordIdentity, envelope: EncryptedEnvelope, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<EncryptedEnvelope>;
-/**
- * Is `envelope` ALREADY wrapped under `dek` (a per-record CEK wrapped under
- * `dek`, or — legacy, no `_cek` — the body itself decryptable under `dek`)?
- *
- * A toDek-first idempotency check for retry-safe rewrap loops (#712 crash
- * atomicity, `with-commit/history/history.ts`'s `rewrapHistory`): a crash
- * mid-rewrap can strand some entries already moved to `toDek` while others
- * remain under `fromDek`. Calling this with `toDek` before attempting the
- * `fromDek` rewrap lets the caller skip an already-migrated entry instead of
- * re-wrapping it (a re-wrap would be a correctness no-op but doubles as an
- * unnecessary write) — and, more importantly, tells a retry loop that this
- * entry needs no `fromDek` unwrap attempt at all, so a crash that landed some
- * entries under `toDek` doesn't wedge on those already-moved entries.
- *
- * AES-KW (CEK unwrap) and AES-GCM (direct decrypt) are both authenticated —
- * unwrap/decrypt under the wrong key throws, never silently returns garbage
- * — so a caught error here reliably means "not wrapped under `dek`", not a
- * corrupt envelope (a genuinely corrupt envelope also throws under the
- * correct key, but callers that reach this helper only do so as a
- * best-effort probe before their own decisive fromDek attempt, which still
- * surfaces real corruption).
- *
- * Body-field access (`_iv`/`_data`/`_cek`) is sanctioned inside the enclave —
- * this is the sanctioned door so callers outside it (history.ts) never read
- * those fields themselves, preserving the check-architecture body-access
- * ratchet.
- */
-export declare function isRewrappedUnder(identity: RecordIdentity, envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>, dek: EnclaveKey): Promise<boolean>;