@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/kernel/enclave/record-keys/rekey-blob.d.ts

@@ -1,88 +0,0 @@
-/**
- * Re-key a vault's blob set from an old `_blob` DEK to a new one (#1122).
- *
- * ## The defect this closes
- *
- * `rotateKeys` re-keys `store.list(vault, <slot>)` plus the derived refs
- * `derivedRefsFor` declares. That assumes a DEK slot named `X` protects data
- * filed under collection `X`. For `_blob` it is false: the slot is `_blob`, but
- * every byte it protects lives in `_blob_index` and `_blob_chunks`. So rotating
- * `_blob` minted a fresh DEK, re-encrypted **nothing**, and made every blob in
- * the vault permanently unreadable — reported to the user as `TamperedError`,
- * i.e. as an attack, when it was self-inflicted. An ordinary `revoke` of a
- * whole-vault grantee reaches it, because such a grantee's DEK map contains
- * `_blob`.
- *
- * ## Why this cannot be done by `rekeyEnvelopeIfNeeded` alone
- *
- * Two of the three surfaces do not have the shape that helper assumes:
- *
- * - a **chunk** envelope is sealed over raw bytes under a bespoke AAD
- *   (`{eTag}:{index}:{count}`), not under the record AAD, so the generic
- *   helper cannot open it;
- * - an **index** envelope's body is JSON that may itself carry a wrapped
- *   per-blob content CEK (`_cek` / `_cekPending`). Re-encrypting the body under
- *   the new DEK without re-wrapping that CEK leaves a blob whose metadata opens
- *   and whose bytes never will.
- *
- * ## Why it lives in the enclave
- *
- * It reads and writes protected body slots and it unwraps/re-wraps keys — the
- * two things `enclave-body-only` reserves to `kernel/enclave/**`, and the same
- * reason `rekeyEnvelopeToDek` moved here in #1074. `with-party` orchestrates
- * the rotation and must not touch a body to do it.
- *
- * The blob layout below is duplicated from its owner rather than imported:
- * `with-shape/blobs/blob-set.ts` already imports `with-party/team/tiers.js`, so
- * a `with-party → with-shape` import would close a cycle, and the kernel may
- * not depend on a service. `BlobObject` itself is a kernel type, so only the
- * three collection/id string layouts are copied, with their owner named.
- *
- * @packageDocumentation
- */
-import { type EnclaveKey } from '../crypto.js';
-import type { NoydbStore } from '../../types.js';
-/**
- * What a rotation did to the blob set.
- *
- * Deliberately NOT on the enclave barrel: no caller outside this module binds
- * it, and that surface is the fork-swap trust boundary, so exporting a type
- * nobody consumes is pure widening.
- *
- * It is a return value rather than a log line because `foreign` and `blobs`
- * are the only way to tell "left alone, correctly" from "left alone, because
- * the caller passed a wrong `otherDeks` set". Both re-key nothing and both
- * return successfully. `rotate-preserves-blobs.test.ts` asserts these counts
- * against a direct call for exactly that reason.
- */
-export interface BlobRekeyReport {
-    /** Index envelopes moved onto the new DEK. */
-    readonly blobs: number;
-    /** Chunk envelopes re-encrypted under the new DEK. */
-    readonly chunks: number;
-    /**
-     * Index envelopes left alone because they open under a DEK the caller holds
-     * for a DIFFERENT slot — an elevated blob, sealed under `_blob#<tier>`. Those
-     * are that slot's rotation to do, not this one's.
-     */
-    readonly foreign: number;
-    /** Index envelopes already under the new DEK — a resumed rotation. */
-    readonly alreadyMoved: number;
-}
-/**
- * Move every blob sealed under `oldDek` onto `newDek`.
- *
- * Chunks are re-encrypted BEFORE their index entry is re-sealed, and that order
- * is the resume property: an index entry still readable under `oldDek` means
- * its chunks may be half-moved (each one is probed individually), and an index
- * entry readable under `newDek` means its chunks are already done. An
- * interrupted rotation is finished by re-running it with the same `newDek`.
- *
- * `otherDeks` is what keeps a tier-elevated blob from being mistaken for a
- * damaged one. Membership in `_blob_index` is by DEK, not by collection name:
- * a record elevated to tier N has its blob metadata sealed under `_blob#N`. An
- * envelope that opens under NONE of the keys the caller holds is genuinely
- * unreadable and throws, exactly as `rekeyEnvelopeIfNeeded` does — silently
- * walking past it would turn a loud failure into permanent quiet loss.
- */
-export declare function rekeyBlobSet(adapter: NoydbStore, vault: string, oldDek: EnclaveKey, newDek: EnclaveKey, otherDeks?: readonly EnclaveKey[]): Promise<BlobRekeyReport>;

package/dist/kernel/enclave/record-keys/rekey.d.ts

@@ -1,91 +0,0 @@
-/**
- * Re-key one envelope from an old collection DEK to a new one (#1074).
- *
- * Lives in the enclave because it is envelope surgery: it reads and writes the
- * protected body slots (`_iv`/`_data`/`_cek`), which `enclave-body-only`
- * reserves to `kernel/enclave/**`. `rotateKeys` previously did this inline in
- * `with-party/team/keyring.ts` and got it wrong in two ways that the guard
- * would have caught had the code lived here.
- *
- * @packageDocumentation
- */
-import { type EnclaveKey } from '../crypto.js';
-import type { EncryptedEnvelope } from '../../types.js';
-/**
- * Produce the envelope `envelope` becomes once its collection's DEK rotates
- * from `oldDek` to `newDek`.
- *
- * **Every slot is carried forward except `_bidx`.** The previous inline version
- * built a fresh literal holding only `_noydb/_v/_ts/_iv/_data`, silently
- * discarding `_by`, `_tier`, `_cek`, `_sealed`, `_vdig` and `_source`. Losing
- * `_tier` was the worst of those: tier-0 reads treat elevated as missing, so an
- * elevated record did not error after a rotation — it simply disappeared.
- *
- * `_bidx` is dropped deliberately. It is a DEK-rooted equality tag, so a tag
- * carried across a DEK rotation can never be re-derived to match a query again
- * while still leaking the old equality partition. Index coverage regrows
- * per-record on the next `put()` under the new DEK.
- *
- * Two shapes, and picking the wrong one is why this needed a helper:
- *
- * - **per-record CEK** (`_cek` present) — the body is sealed under the CEK and
- *   the CEK is wrapped under the collection DEK, so rotation re-wraps the CEK
- *   and leaves the body **untouched**. The old inline code instead ran
- *   `decrypt(body, oldDek)` on these, which throws: rotation could not complete
- *   on a collection containing any CEK record.
- * - **bare** — body sealed directly under the DEK, so decrypt and re-encrypt.
- *
- * Idempotence is the caller's problem, not this function's: it assumes
- * `envelope` is still under `oldDek`. A resumable rotation must know which side
- * of the migration each record is on before calling.
- */
-export declare function rekeyEnvelopeToDek(ref: {
-    readonly collection: string;
-    readonly id: string;
-}, envelope: EncryptedEnvelope, oldDek: EnclaveKey, newDek: EnclaveKey): Promise<EncryptedEnvelope>;
-/**
- * Resumable variant: returns the re-keyed envelope, or `null` when `envelope`
- * is **already** under `newDek` and needs no work (#1074 part 2).
- *
- * A rotation interrupted mid-collection leaves records on both sides of the
- * migration. Resuming means re-running the rotation with the *same* new DEK,
- * which requires distinguishing "not yet moved" from "already moved" without
- * the caller touching protected slots.
- *
- * Detection is by trial decryption under `oldDek`. There is no metadata that
- * says which DEK sealed a record — deliberately, since such a marker would be
- * store-writable and therefore a downgrade lever (the same reasoning that
- * keeps the reader from branching on `_noydb`).
- *
- * A record that opens under *neither* key is genuinely damaged and rethrows,
- * rather than being silently skipped: a rotation that quietly walked past
- * unreadable records would convert a loud failure into permanent silent loss,
- * which is the defect this whole issue is about.
- */
-export declare function rekeyEnvelopeIfNeeded(ref: {
-    readonly collection: string;
-    readonly id: string;
-}, envelope: EncryptedEnvelope, oldDek: EnclaveKey, newDek: EnclaveKey): Promise<EncryptedEnvelope | null>;
-/**
- * Does this envelope open under ANY of `keys`? A read-only probe — decrypts
- * nothing into a caller-visible value and writes nothing.
- *
- * Exists so a rotation can tell *"this envelope belongs to a DIFFERENT DEK slot
- * the caller also holds"* from *"this envelope is damaged"* (#1125). Those two
- * look identical from a failed `rekeyEnvelopeIfNeeded`, and collapsing them
- * either aborts a legitimate rotation or walks past unreadable data.
- *
- * **The question is deliberately asked of the KEY, not of the envelope's claimed
- * `_tier`.** `_tier` is unencrypted — the store writes it — so routing a
- * rotation on it would let a store mark a tier-0 record `_tier: 5` and have the
- * rotation skip it, leaving a revoked member's DEK live on real data. That is
- * #1115's defect wearing a different hat. A key either opens the body or it does
- * not, and a store cannot forge that.
- *
- * Mirrors `rekeyBlobSet`'s `otherDeks` treatment, which asks the same question
- * about the same kind of ambiguity.
- */
-export declare function envelopeOpensUnderAny(ref: {
-    readonly collection: string;
-    readonly id: string;
-}, envelope: EncryptedEnvelope, keys: readonly EnclaveKey[]): Promise<boolean>;

package/dist/kernel/enclave/record-keys/sealed-slot.d.ts

@@ -1,14 +0,0 @@
-/** Parse an `iv:data` sealed slot (split on the FIRST `:`). */
-export declare function parseSealedSlot(blob: string): {
-    iv: string;
-    data: string;
-};
-/**
- * Dual-read: decrypt a sealed slot trying the CEK-derived field key first,
- * falling back to the collection-DEK field key. Legacy records
- * (even ones whose body is CEK-encrypted) are sealed under the collection-DEK
- * key; current writes seal under the per-record CEK. Try the CEK key first; on
- * its AES-GCM auth failure, fall back to the DEK key. Throws only if BOTH fail.
- * Returns the plaintext string (callers `JSON.parse` as needed).
- */
-export declare function dualReadSealedSlot(blob: string, field: string, collection: string, cek: CryptoKey | undefined, dek: CryptoKey): Promise<string>;

package/dist/kernel/enclave/record-keys/sealed-slots.d.ts

@@ -1,123 +0,0 @@
-/**
- * Sealed-slot sub-step — the "seal these declared fields into their own
- * `iv:data` slots" mechanism, extracted byte-parity from `RecordCodec`
- * (#629 Task 1; see `.superpowers/sdd/seam-map-classified-blobs.md` §2).
- *
- * This is the ONE genuinely separable sub-step `RecordCodec.encryptRecord`/
- * `decryptRecord` perform (the digest-only `_vdig`/`_bidx` mechanism is NOT
- * separable the same way — it needs write-history `prev` context, see the
- * seam map's separability verdict). `sealFields`/`unsealFields` are the
- * natural shape of a `via` `encodeAtRest`/`decodeAtRest` hook for a "seal
- * this field" via-feature, and `makeSealedSlotCapability`/
- * `makeReservedEnvelopes` (below) are the `ViaCryptoCtx` capability
- * factories built on top of them.
- *
- * The capability factories live here (rather than a sibling
- * `kernel/via-crypto.ts`) so they can call `deriveSealedFieldKey`/
- * `deriveSealedFieldKeyFromCek`/`encrypt`/`decrypt` directly — this file IS
- * kernel enclave code (C3), so it is exempt from `enclave-barrel-only` the
- * same way `record-codec.ts`/`sealing.ts` are. A file outside
- * `kernel/enclave/**` would have had to go through the enclave barrel
- * (`kernel/enclave/index.ts`), which does not (yet) export these symbols.
- */
-import { type EnclaveKey } from '../crypto.js';
-import { SealedHandle } from '../../types.js';
-import type { ViaCryptoCtx } from '../../via/index.js';
-/**
- * Key material for one collection's sealed-field derivation. `cek`, when
- * supplied, is preferred (record-scoped); `getDEK` is the fallback (and,
- * for legacy/no-CEK collections, the only key) — mirrors the dual-read
- * `RecordCodec` has always done.
- */
-export interface SealKeyMaterial {
-    readonly collection: string;
-    readonly cek?: EnclaveKey;
-    getDEK(): Promise<EnclaveKey>;
-}
-export interface SealFieldsResult {
-    readonly openRecord: Record<string, unknown>;
-    readonly sealed: Record<string, string> | undefined;
-}
-/**
- * Peel declared `sensitiveFields` out of `record` BEFORE building `_data`,
- * sealing each into its own `iv:data` slot. Extracted byte-parity from
- * `RecordCodec.encryptRecord` step 2 (pre-#629 `record-codec.ts:261-288`).
- * Returns `record` untouched (and `sealed: undefined`) when no declared
- * field is present with a defined value — the envelope stays byte-identical
- * to legacy output, exactly as before.
- */
-export declare function sealFields(record: Record<string, unknown>, sensitiveFields: ReadonlySet<string>, keyMaterial: SealKeyMaterial): Promise<SealFieldsResult>;
-/**
- * Unseal one `_sealed[field]` slot to its plaintext value: dual-read (try
- * the CEK-derived key, fall back to the DEK-derived key for legacy
- * records), AES-GCM-decrypt the `iv:data` blob, and JSON-parse the result.
- * Extracted byte-parity from `RecordCodec.unsealField`
- * (pre-#629 `record-codec.ts:485-493`).
- */
-export declare function unsealOneField(field: string, blob: string, keyMaterial: SealKeyMaterial): Promise<unknown>;
-/**
- * Build a non-leaking {@link SealedHandle} producer over sealed key
- * material: each call captures only the ciphertext `blob` and a closure to
- * {@link unsealOneField} — the plaintext is never stored on the handle, and
- * (crucially) the DEK is fetched lazily on `reveal()`, never at handle-
- * construction time. Extracted byte-parity from
- * `RecordCodec.makeSealedHandle` (pre-#629 `record-codec.ts:552-554`).
- */
-export declare function makeHandleProducer(keyMaterial: SealKeyMaterial): (field: string, blob: string) => SealedHandle<unknown>;
-/**
- * Restore every `[field]: blob` entry in `sealed` onto `record` (mutated in
- * place, matching the original's mutate-then-return shape): eagerly unseal
- * to plaintext (`opts.asHandles` falsy) or wrap each in a
- * {@link SealedHandle} (`opts.asHandles: true`) so the plaintext is never
- * materialised. Extracted byte-parity from `RecordCodec.decryptRecord`'s
- * sealed-handle block (pre-#629 `record-codec.ts:615-623`).
- */
-export declare function unsealFields(record: Record<string, unknown>, sealed: Record<string, string>, keyMaterial: SealKeyMaterial, opts?: {
-    asHandles?: boolean;
-}): Promise<Record<string, unknown>>;
-/** What {@link makeSealedSlotCapability} needs — a subset of `RecordCodecContext`. */
-export interface SealedSlotCapabilityCtx {
-    readonly name: string;
-    getDEK(): Promise<EnclaveKey>;
-}
-/**
- * Build a `ViaCryptoCtx.sealedSlots` capability pre-bound to one
- * `(collection, recordId)`. The key material (`cek`/DEK resolver) is closed
- * over and never placed on the returned object — `Object.keys`/
- * `Object.values` of the capability expose only the three methods, never a
- * key (zero-knowledge: capabilities never expose keys).
- *
- * `delete(field)` is **advisory and capability-instance-local, not real
- * erasure** — it has no store to reach and never will by itself: it just
- * adds `field` to a `Set` closed over by THIS ONE capability object, so a
- * later `unseal` call on that SAME object refuses. No I/O happens. A fresh
- * capability for the same record (e.g. `seal()`'d again, or a new
- * `makeSealedSlotCapability(...)` call) has an empty set and sees no
- * deletion at all — `seal()` on a given field also clears any prior mark
- * for it. Do not build production logic on `delete()` persisting anything.
- * The real erasure guarantee for a forgotten record is `vault.forget()`'s
- * unconditional `_writeTombstone` call, which replaces the whole live
- * envelope with a fresh, `_sealed`-free tombstone — `_sealed` disappears
- * from the store regardless of what any capability's `delete()` marked.
- * (#629 Task 10 traced this end-to-end; see task-10-report.md "sealedSlots
- * .delete()" section. Removing/changing this method's shape is a phase-E
- * decision, not implied by this comment.)
- */
-export declare function makeSealedSlotCapability(ctx: SealedSlotCapabilityCtx, recordId: string, cek?: EnclaveKey): ViaCryptoCtx['sealedSlots'];
-/** Resolve the DEK for an arbitrary (possibly synthetic, e.g. `_dict_en`) collection name. */
-export type ReservedEnvelopeDekResolver = (collection: string) => Promise<EnclaveKey>;
-/**
- * Build a `ViaCryptoCtx.reservedEnvelopes` capability: a whole-envelope
- * encrypt/decrypt door scoped to collection names under a declared prefix
- * (e.g. `_dict_`) — the shape `via/i18n/dictionary.ts`'s
- * `DictionaryHandle` needs (seam map Part 3): build JSON → encrypt under a
- * DEK → wrap in an `EncryptedEnvelope`; decrypt → JSON text. No per-record
- * CEK — reserved envelopes are whole-DEK-encrypted, same as the dictionary
- * grandfather.
- *
- * `reservedEnvelopes(prefix)` throws `ValidationError` immediately when
- * `prefix` is not in `declaredPrefixes`; each `encrypt`/`decrypt` call
- * throws `ValidationError` when its `collection` argument does not start
- * with `prefix`.
- */
-export declare function makeReservedEnvelopes(dekResolver: ReservedEnvelopeDekResolver, declaredPrefixes: readonly string[]): ViaCryptoCtx['reservedEnvelopes'];

package/dist/kernel/enclave/record-keys/sealing.d.ts

@@ -1,70 +0,0 @@
-/**
- * Record-scoped CEK sealing — grantor side.
- *
- * The **grantor** holds the collection DEK and seals ONE record's CEK to an
- * `at-*` host so that host — and only that host — can decrypt exactly that
- * record, with no access to the vault DEK and no ability to read any other
- * record. This is the counterpart to the host-side `openSealedRecord`
- * (`@noy-db/hub/sealed-record`), which holds no DEK.
- *
- * These functions are the orchestration behind `vault.sealRecordToHost` /
- * `vault.revokeSealedRecord` / `vault.rotateRecordCek`, lifted off `Vault`
- * behind a narrow {@link SealingContext} so the kernel file delegates. They
- * live in `record-keys/` (the vault-side CEK policy layer), NOT in
- * `sealed-record/`, so the host-side subpath stays DEK-free — the wire
- * *types* they share are spine-owned (`kernel/types.ts`), not imported from
- * `sealed-record/` directly.
- */
-import { type EnclaveKey } from '../crypto.js';
-import { type NoydbStore, type RecipientSealer } from '../../types.js';
-/** The `_sealed_cek` delivery namespace (one envelope per `collection/id/pid`). */
-export declare const SEALED_CEK_NS = "_sealed_cek";
-/** What the grantor functions need from their `Vault`. */
-export interface SealingContext {
-    readonly adapter: NoydbStore;
-    /** Vault id (the adapter's first coordinate). */
-    readonly vault: string;
-    /** Resolve the DEK a record's CEK is wrapped under. */
-    getDEK(collection: string): Promise<EnclaveKey>;
-    /** Actor id stamped on `_by` (empty string → omit). */
-    readonly actor: string;
-    /** Evict the per-record CEK cache + decrypted-record cache after a rotation. */
-    invalidateRecordCaches(collection: string, id: string): Promise<void>;
-}
-/**
- * Seal a record's CEK to a host. See `vault.sealRecordToHost` for the contract.
- * Returns `{ pid, envelopeKey }`.
- */
-export declare function sealRecordToHost(ctx: SealingContext, collection: string, id: string, hostSealer: RecipientSealer, opts: {
-    expiresAt: string;
-}): Promise<{
-    pid: string;
-    envelopeKey: string;
-}>;
-/**
- * Revoke one sealed-CEK grant.
- *
- * **Default (`{ hard: false }`) is SOFT** — it only deletes the delivery
- * envelope from the store. A host that already fetched (or cached the unsealed
- * CEK from) that envelope KEEPS decrypt capability for the record; soft revoke
- * is a "stop new fetches" control, not a cryptographic cutoff.
- *
- * **`{ hard: true }`** additionally rotates the record's CEK (via
- * {@link rotateRecordCek}): the live body is re-encrypted under a fresh CEK and
- * EVERY sealed-CEK delivery envelope for the record (all pids) is deleted, so
- * any previously-sealed CEK fails the AES-GCM auth tag on the rotated body —
- * future opens are cryptographically denied. (PRE-rotation history versions,
- * which keep their old `_cek`, remain openable — same semantics as
- * `rotateRecordCek`.)
- */
-export declare function revokeSealedRecord(ctx: SealingContext, collection: string, id: string, pid: string, opts?: {
-    hard?: boolean;
-}): Promise<void>;
-/**
- * HARD-rotate a record's CEK: re-encrypt the live body under a fresh CEK, evict
- * caches, and delete EVERY sealed-CEK delivery envelope for the record. See
- * `vault.rotateRecordCek` for why this bypasses `Collection.put` (no guards, no
- * history bump — a key rotation must not re-encrypt prior history under the new
- * CEK).
- */
-export declare function rotateRecordCek(ctx: SealingContext, collection: string, id: string): Promise<void>;

package/dist/kernel/query/join.d.ts

@@ -1,232 +0,0 @@
-/**
- * Query DSL `.join()` — eager, single-FK, intra-vault joins.
- *
- * resolves a ref()-declared foreign key into an attached
- * right-side record under an alias, using one of two planner paths
- * selected automatically:
- *
- *   - **nested-loop** — right-side source exposes `lookupById`, so
- *     each left row costs O(1). This is the common path for joins
- *     against a Collection, which backs `lookupById` with a Map
- *     lookup.
- *   - **hash** — right-side has only `snapshot()`. Build a
- *     `Map<id, record>` once, probe per left row. Same asymptotic
- *     cost for our collections, but the path exists as a fallback
- *     for custom QuerySource implementations and as an explicit
- *     test-only override via `{ strategy: 'hash' }`.
- *
- * Scope:
- *
- *   - Equi-joins on declared `ref()` fields only. Joins on
- *     undeclared fields throw at plan time with an actionable error
- *     naming the field and collection.
- *   - Same-vault only. Cross-vault correlation goes
- *     through `queryAcross`; this is an architectural
- *     invariant, not a limitation we plan to lift.
- *   - Hard row ceiling via `JoinTooLargeError` — default 50k per
- *     side, override via `{ maxRows }`. Warns at 80% of the ceiling
- *     on the existing warn channel.
- *   - Three ref-mode behaviors on dangling refs:
- *     strict → `DanglingReferenceError`,
- *     warn → attach `null` with a one-shot warning,
- *     cascade → attach `null` silently (cascade is a delete-time
- *     mode; any dangling refs still present at read time are
- *     mid-flight cascades or orphans from earlier, not a DSL error).
- *
- * Partition-awareness seam:
- *
- * Every `JoinLeg` carries a `partitionScope` field that is always
- * `'all'` in. The executor never reads this field.
- * partition-aware joins will start populating it from `where()`
- * predicates on the partition key without changing the planner's
- * external shape — this is the whole reason it exists now.
- *
- * Joins stay OUT of the ledger: reads don't touch `_ledger/`,
- * including joined reads.
- */
-import type { RefDescriptor, RefMode } from '../refs.js';
-import type { Clause } from './predicate.js';
-/** Planner strategy for a single join leg. Auto-selected unless overridden. */
-export type JoinStrategy = 'hash' | 'nested';
-/** Default per-side row ceiling before `.join()` throws `JoinTooLargeError`. */
-export declare const DEFAULT_JOIN_MAX_ROWS = 50000;
-/**
- * Internal representation of a single join leg in the query plan.
- *
- * This is the primary place where  constraint #1 is honored:
- * every leg carries a `partitionScope` field that is always `'all'`
- * in and is never read by the executor. partition-aware
- * joins will start populating it from `where()` predicates on the
- * partition key without changing the planner's external shape.
- */
-export interface JoinLeg {
-    /** Field on the left-side record holding the foreign key value. */
-    readonly field: string;
-    /** Alias key under which the joined right-side record attaches. */
-    readonly as: string;
-    /** Target collection name, resolved from the `ref()` declaration. */
-    readonly target: string;
-    /** Ref mode controlling behavior on dangling refs at read time. */
-    readonly mode: RefMode;
-    /** Manual planner strategy override. `undefined` → auto-select. */
-    readonly strategy: JoinStrategy | undefined;
-    /** Per-side row ceiling override. `undefined` → DEFAULT_JOIN_MAX_ROWS. */
-    readonly maxRows: number | undefined;
-    /**
-     * Partition scope for future partition-aware joins. Always `'all'`
-     * today — the executor never reads this field. Future versions will
-     * populate it from `where()` predicates without breaking the
-     * planner's external shape. Do not remove even though it looks
-     * unused today — that's the whole point of having it.
-     */
-    readonly partitionScope: 'all' | readonly string[];
-    /**
-     * When `true`, this is a dictionary join. The executor
-     * resolves the left-field value against the dict snapshot and
-     * attaches `{ ...labels, key }` rather than a right-side record.
-     * `target` holds the dictionary name (not a collection name).
-     */
-    readonly isDictJoin?: true;
-}
-/**
- * Minimal shape of a joinable right-side record source.
- *
- * Collections implement this structurally via their `QuerySource`;
- * sources without `lookupById` force the hash-join fallback. Kept as
- * a thin interface so tests can wire up plain-object sources without
- * pulling in the full Collection class.
- *
- * The optional `subscribe` is used by `Query.live()` to merge
- * right-side change streams into the live re-run trigger. Sources
- * that omit `subscribe` still work for live joins — they just
- * don't drive re-fires when their right side mutates. Collection
- * implements `subscribe` by hooking into the existing per-
- * vault event emitter.
- */
-export interface JoinableSource {
-    snapshot(): readonly unknown[];
-    lookupById?(id: string): unknown;
-    /**
-     * Default locale a label-resolving query falls back to when the query
-     * itself is locale-less. Set by a `staticDict()`-backed source from its
-     * `displayLocale` so `{ by: 'label' }` resolves under a locale-less read.
-     * Plain `_dict_*`-backed sources omit it.
-     */
-    readonly displayLocale?: string;
-    /**
-     * Sync present-for-join dressing (#626 retirement, #650 Task 6) — when
-     * present and the query carries a locale, each joined right-side record
-     * is passed through this hook (built by the right-side `Collection` from
-     * its own i18n-text + lookup-label bindings) BEFORE it is attached under
-     * the leg's alias — so a joined `i18nText` field resolves to a string
-     * (not a raw `{ locale }` map) and a joined lookup field gains its
-     * `<field>Label`. Locale-less queries leave joined fields raw
-     * (consistent with a locale-less read). Replaces the old `i18nFields`
-     * data field — the join executor no longer resolves i18n locale itself,
-     * it just calls this hook.
-     */
-    readonly presentForJoin?: (record: unknown, locale: string) => unknown;
-    /**
-     * Subscribe to mutations on this source. The callback fires
-     * AFTER the underlying record set has been updated. Returns an
-     * unsubscribe function. Optional — sources without this method
-     * cannot trigger live-join re-fires from their side.
-     */
-    subscribe?(cb: () => void): () => void;
-}
-/**
- * Join resolution context attached to a `Query` when it's constructed
- * from a `Collection`. Holds everything the `.join()` method needs to
- * translate a field name into a target collection + ref mode, and
- * everything the executor needs to read the right side.
- *
- * Kept as a structural interface so `Vault` can implement it
- * without `Query` needing to import `Vault` (circular-import
- * avoid). The Collection wires this up in its `query()` method using
- * the `joinResolver` back-reference the Vault passes in.
- */
-export interface JoinContext {
-    /** Name of the left-side (owning) collection. */
-    readonly leftCollection: string;
-    /**
-     * The owning collection's default locale. Used to resolve joined
-     * i18n fields at the `join` layer when a terminal call doesn't pass an
-     * explicit locale — so `openVault({ locale })` flows to joins like it does
-     * to `get`/`list`. A per-call `toArray({ locale })` overrides it.
-     */
-    readonly defaultLocale?: string;
-    /** Look up a `RefDescriptor` by field name on the left collection. */
-    resolveRef(field: string): RefDescriptor | null;
-    /** Resolve a right-side source by target collection name. */
-    resolveSource(collectionName: string): JoinableSource | null;
-    /**
-     * Resolve a dictKey join source. Returns a `JoinableSource`
-     * whose snapshot exposes `{ key, ...labels }` records, keyed by the
-     * stable dictionary key. `null` when the field is not a dictKey.
-     *
-     * The source is built from the compartment's in-memory dictionary
-     * snapshot — same data as `DictionaryHandle.list()`, O(1) per lookup.
-     */
-    resolveDictSource?(field: string): JoinableSource | null;
-}
-/**
- * Split a plan's clauses into those evaluable before the join legs run and
- * those that need the joined shape (#1030).
- *
- * Join legs attach after `where` so the left set can be narrowed (and
- * index-driven) first. That is the right default, but it silently broke any
- * predicate addressing a joined alias: the field did not exist yet, so
- * `readPath` returned `undefined`, nothing matched, and the query returned an
- * empty result with no error.
- *
- * The split is deliberately narrow. When no clause addresses an alias — every
- * query written against the previous behaviour — `postJoin` is empty and the
- * caller takes its original path unchanged. The reordered pipeline therefore
- * only ever runs for queries that match nothing today.
- *
- * KNOWN RESIDUAL: `.filter(r => r.client?.name === 'Ann')` cannot be
- * classified (the predicate is a closure), so it still runs pre-join and still
- * sees no alias. Prefer `.where()` for anything addressing a joined field.
- *
- * Shared by the eager `Query` and the streaming `ScanBuilder` so the two
- * cannot drift on which side a clause belongs to.
- */
-export declare function splitAroundJoins(clauses: readonly Clause[], joins: readonly JoinLeg[]): {
-    readonly preJoin: readonly Clause[];
-    readonly postJoin: readonly Clause[];
-};
-/**
- * Apply every join leg in the plan against a base set of left-side
- * rows. Called by the query executor after `where` / `orderBy` /
- * `offset` / `limit` have narrowed the left set.
- *
- * Each leg attaches a `leg.as` field to every row. Returns a new
- * array of plain objects — the original left rows are not mutated
- * (structural sharing is fine for the inner fields, but the
- * top-level object is a fresh clone so consumers can further mutate
- * safely).
- *
- * **Ordering:** joins run AFTER orderBy / limit / offset in v1.
- * This keeps the planner simple and means queries like "top 10
- * invoices with client" sort and paginate the left side first, then
- * join. Sorting *by* a joined field is out of scope for  — users
- * can post-sort the result array in userland or wait for
- * (multi-FK chaining) which can be layered on top.
- *
- * **Multi-FK chaining:** each leg's `maxRows` is enforced
- * against the current left-row count independently. Because
- * joins are equi-joins on the target's primary key (one-to-one or
- * one-to-null), the left row count is constant across legs — no
- * cartesian blowup. The per-leg left-side check is still necessary
- * so that a later leg with a tighter ceiling correctly fires on a
- * query like `.join('a', { maxRows: 100_000 }).join('b', { maxRows: 50 })`,
- * which should throw on the second leg if the left set exceeds 50.
- */
-export declare function applyJoins(rows: readonly unknown[], joins: readonly JoinLeg[], context: JoinContext, locale?: string): unknown[];
-/**
- * Test-only: reset the join warning deduplication state between
- * tests. Production code never calls this — the dedup state is
- * intentionally process-scoped so a noisy query doesn't spam the
- * console once per component render.
- */
-export declare function resetJoinWarnings(): void;

package/dist/liberate-V35QUHJP.js

@@ -1,24 +0,0 @@
-import {
-  liberateVault
-} from "./chunk-2N5ML6HT.js";
-import "./chunk-3BVH633C.js";
-import "./chunk-JVIBCBC7.js";
-import "./chunk-4GVM6QZA.js";
-import "./chunk-BVN6KXL2.js";
-import "./chunk-EQEYOJBM.js";
-import "./chunk-3V4KWFX7.js";
-import "./chunk-XKWGNJ26.js";
-import "./chunk-JMGDHKQF.js";
-import "./chunk-4ZS56W5S.js";
-import "./chunk-SZJ3DLZA.js";
-import "./chunk-BRLKZUBT.js";
-import "./chunk-BTDR2PXY.js";
-import "./chunk-CHQCZZWC.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-HPVZCW43.js";
-import "./chunk-7MG7SJT7.js";
-import "./chunk-7O3Y4PPD.js";
-export {
-  liberateVault
-};
-//# sourceMappingURL=liberate-V35QUHJP.js.map