@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/chunk-3EWS67C7.js

@@ -0,0 +1,461 @@
+import {
+  FieldNotQueryableError,
+  ValidationError
+} from "./chunk-37EPTBBR.js";
+
+// src/kernel/via/pipeline.ts
+var ViaPipeline = class _ViaPipeline {
+  constructor(bindings, taint) {
+    this.bindings = bindings;
+    this.taint = taint;
+    const moneyVias = bindings.filter((b) => b.brand === "money");
+    const computedVias = bindings.filter((b) => b.brand === "computed");
+    const restBindings = bindings.filter((b) => b.brand !== "money" && b.brand !== "computed");
+    this._presentOrder = [...moneyVias, ...computedVias, ...restBindings];
+    this._presentLateBoundary = moneyVias.length + computedVias.length;
+  }
+  bindings;
+  taint;
+  /**
+   * Present-phase-ONLY order (#665, corrected under #665 review) — a stable
+   * THREE-WAY partition of `bindings` computed once here at construction:
+   * every `'money'`-brand binding first (existing relative order), then
+   * every `'computed'`-brand binding (existing relative order), then
+   * everything else (existing relative order). `present()` folds over this
+   * instead of `bindings` so a `mode: 'virtual'` computed field's value
+   * exists before i18n/lookup's dressing `present()` hooks run on it
+   * (today's `compileVias` order is money→i18n→lookup→classified→
+   * blob→computed, `collection-config.ts:554`, so dressing unconditionally
+   * ran BEFORE the value it dresses existed). This reorder is binding-level,
+   * not conditioned on any particular field composition — it applies to
+   * EVERY collection that compiles a `'computed'` binding at all, not only
+   * ones stacking a dresser on the SAME field as a computed one. EVERY other
+   * phase (`ingest`/`encodeWrite`/`encodeAtRest`/`enforceWrite`/etc.) keeps
+   * folding over `bindings` unchanged — those write/query phases need
+   * money-first (`_applyMoneyFields` PREPENDS money, `_applyClassifiedFields`
+   * APPENDS classified to preserve it, `kernel/collection.ts:1275-1284,1364-
+   * 1368`).
+   *
+   * Money is deliberately carved OUT of the generic "everything else" slice
+   * and kept FIRST — the original two-way `[computed..., rest...]` partition
+   * regressed money's composed-field behavior from a benign missing-dressing
+   * gap into VALUE CORRUPTION: money's `present()` DECODES its input as a
+   * STORED SCALED-INT (and derives `<field>Formatted` from it) — it is not a
+   * pure dressing CONSUMER like i18n/lookup, which only ADD a `<field>Label`
+   * key and never rewrite the field's own value. Running money AFTER
+   * computed on a field composing `computed(virtual)` + `money(...)` on
+   * ITSELF means money's decode sees the virtual field's raw MAJOR-unit
+   * output (e.g. `21`) and misreads it as a scaled-int, producing a
+   * corrupted value (`'0.21'`) instead of the pre-#665 result (the raw `21`
+   * surviving untouched, with no `Formatted` key added — a benign
+   * missing-dressing gap, not a wrong value). Money-first restores money's
+   * exact pre-#665 present position — byte-identical money behavior; the
+   * materialized composition pins from the #631 work and the money suites
+   * all ran under money-first. i18n/lookup are genuine dressing consumers
+   * (they only ADD, never rewrite), so they stay after computed, which is
+   * the fix #665 intended. A `'taint'` binding (appended LAST by
+   * `via/graph-wiring.ts#applyTaintOverlay`) stays last here too (it's
+   * neither money nor computed, so it lands at the tail of the "everything
+   * else" slice), preserving its "runs after computed, redacts tainted
+   * virtual output" contract (`via/taint-binding.ts`'s `taintBinding` doc
+   * comment).
+   *
+   * Money-dressing a virtual computed field's OWN output (the composed
+   * `computed(virtual) + money` case) is NOT resolved by this partition
+   * alone — #669 resolves it with a separate mid-fold hook instead:
+   * `NoydbVia.presentLate` runs after every binding's `present()` in this
+   * money+computed segment, before the "everything else" segment below, so
+   * money can quantize/reinterpret a virtual field's fresh MAJOR-UNITS
+   * output as if it were a stored value, without perturbing this ordering
+   * or the #665 invariant above it (`_presentLateBoundary` below marks
+   * exactly where that mid-fold point sits within `_presentOrder`).
+   */
+  _presentOrder;
+  /** #669 — index into `_presentOrder` where the money+computed segment ends and the
+   *  "everything else" segment begins (`moneyVias.length + computedVias.length`);
+   *  `present()` runs every binding's `presentLate` at exactly this boundary. */
+  _presentLateBoundary;
+  /** undefined when there is nothing to enforce — the zero-via fast path is
+   *  `this.via === undefined` (#553: keeps an all-plain collection sync). A
+   *  `'*'`-defaulted output collection (#642) counts as "something to enforce"
+   *  even with zero field-specific postures and zero bindings. */
+  static build(bindings, taint) {
+    if (bindings.length === 0 && (!taint || taint.postures.size === 0 && taint.defaultPosture === void 0)) return void 0;
+    return new _ViaPipeline(bindings, taint);
+  }
+  /** Refuse a write before crypto runs: awaits each binding's `enforceWrite` in order — first throw wins. */
+  async enforceWrite(record, ctx) {
+    for (const b of this.bindings) if (b.enforceWrite) await b.enforceWrite(record, ctx);
+  }
+  ingest(record) {
+    let r = record;
+    for (const b of this.bindings) if (b.ingest) r = b.ingest(r);
+    return r;
+  }
+  canonicalizeStored(record) {
+    let r = record;
+    for (const b of this.bindings) if (b.canonicalizeStored) r = b.canonicalizeStored(r);
+    return r;
+  }
+  async encodeWrite(record, ctx) {
+    let r = record;
+    for (const b of this.bindings) if (b.encodeWrite) r = await b.encodeWrite(r, ctx);
+    return r;
+  }
+  /**
+   * Final write-pipeline stage: folds each binding's `encodeAtRest` in
+   * order, threading the record and accumulating the sealed-slot map. A
+   * field belongs to exactly one via feature — two bindings sealing the
+   * same field is a brand-keyed collision and throws.
+   */
+  async encodeAtRest(record, crypto) {
+    let r = record;
+    let sealed;
+    const sealedBy = /* @__PURE__ */ new Map();
+    for (const b of this.bindings) {
+      if (!b.encodeAtRest) continue;
+      const result = await b.encodeAtRest(r, crypto);
+      r = result.record;
+      if (!result.sealed) continue;
+      for (const [field, ref] of Object.entries(result.sealed)) {
+        const priorBrand = sealedBy.get(field);
+        if (priorBrand !== void 0) {
+          throw new ValidationError(
+            `via encodeAtRest: field "${field}" sealed by binding "${priorBrand}" is also sealed by binding "${b.brand}"`
+          );
+        }
+        sealedBy.set(field, b.brand);
+        sealed ??= {};
+        sealed[field] = ref;
+      }
+    }
+    return sealed ? { record: r, sealed } : { record: r };
+  }
+  /** First read-pipeline stage: folds each binding's `decodeAtRest` in order. */
+  async decodeAtRest(record, sealed, crypto, opts) {
+    let r = record;
+    for (const b of this.bindings) if (b.decodeAtRest) r = await b.decodeAtRest(r, sealed, crypto, opts);
+    return r;
+  }
+  async present(record, ctx) {
+    let r = record;
+    for (let i = 0; i < this._presentLateBoundary; i++) {
+      const b = this._presentOrder[i];
+      if (b.present) r = await b.present(r, ctx);
+    }
+    for (const b of this.bindings) if (b.presentLate) r = await b.presentLate(r, ctx);
+    for (let i = this._presentLateBoundary; i < this._presentOrder.length; i++) {
+      const b = this._presentOrder[i];
+      if (b.present) r = await b.present(r, ctx);
+    }
+    return r;
+  }
+  /**
+   * #1416 — the synchronous half of {@link present}, for the query path.
+   *
+   * `query().toArray()` is SYNCHRONOUS (#1413) and so cannot await `present`,
+   * which is why it ran `decodeResults` instead — money's stored→canonical
+   * decode and nothing else. The visible cost was that a
+   * `computed({ mode:'virtual' })` field read `undefined` on a query row while
+   * `get()` and `list()` returned it, so the same record had two shapes
+   * depending on which read verb produced it, and a caller summing that field
+   * over a query result got `NaN` with no error.
+   *
+   * This folds the SAME order as `present`, skipping any binding that has not
+   * declared {@link ViaBinding.presentIsSync}. `money` and `computed` do, which
+   * is the pair that carries values; `i18n` and `lookup` are genuinely async
+   * and are reported in `skipped` rather than silently dropped — the caller can
+   * then say so instead of leaving a hole.
+   *
+   * ⚠️ Ordering is preserved exactly, including the `presentLate` boundary,
+   * because money's `presentLate` exists to react to computed's virtual output
+   * (#669). Reordering here would corrupt a field that is both money and
+   * virtual.
+   */
+  presentSync(record, ctx) {
+    let r = record;
+    const skipped = [];
+    const note = (b) => {
+      if (!skipped.includes(b.brand)) skipped.push(b.brand);
+    };
+    const runnable = (b) => {
+      if (b.presentIsSync === true) return true;
+      if (b.present || b.presentLate) note(b);
+      return false;
+    };
+    for (let i = 0; i < this._presentLateBoundary; i++) {
+      const b = this._presentOrder[i];
+      if (b.present && runnable(b)) r = b.present(r, ctx);
+    }
+    for (const b of this.bindings) {
+      if (b.presentLate && runnable(b)) r = b.presentLate(r, ctx);
+    }
+    for (let i = this._presentLateBoundary; i < this._presentOrder.length; i++) {
+      const b = this._presentOrder[i];
+      if (b.present && runnable(b)) r = b.present(r, ctx);
+    }
+    return { record: r, skipped };
+  }
+  /** True iff some binding's presentation can only run on the async path (#1416). */
+  get hasAsyncPresent() {
+    return this.bindings.some((b) => (b.present !== void 0 || b.presentLate !== void 0) && b.presentIsSync !== true);
+  }
+  /**
+   * #1447 — which bindings cover which fields, for `dumpSchema()`.
+   *
+   * Field name → the brands covering it, sorted. A field can appear under more
+   * than one brand: a money field that is also `computed({ mode:'virtual' })`
+   * is covered by both, and collapsing that to one would misreport what the
+   * datastore does to it.
+   *
+   * ⛔ BRAND AND FIELD ONLY — never a binding's configuration, and the reason
+   * is not payload size. A schema dump travels further than a vault does, and
+   * a report saying "this field is classified, sensitivity pii" is a map of
+   * which columns are worth attacking, in an artefact that by design leaves
+   * the vault. The consumer who asked for this said brand-plus-field is the
+   * whole of their need, so there is no trade being made.
+   *
+   * A binding that declares no {@link NoydbVia.coveredFields} is omitted
+   * rather than reported as covering nothing — absence of a declaration is not
+   * evidence of absence of coverage.
+   */
+  fieldCoverage() {
+    const byField = /* @__PURE__ */ new Map();
+    for (const b of this.bindings) {
+      if (b.coveredFields === void 0) continue;
+      for (const f of b.coveredFields) {
+        let brands = byField.get(f);
+        if (!brands) {
+          brands = /* @__PURE__ */ new Set();
+          byField.set(f, brands);
+        }
+        brands.add(b.brand);
+      }
+    }
+    const out = {};
+    for (const f of [...byField.keys()].sort()) out[f] = [...byField.get(f)].sort();
+    return out;
+  }
+  buildClause(field, op, value) {
+    for (const b of this.bindings) {
+      const payload = b.buildClause?.(field, op, value);
+      if (payload !== void 0) return { brand: b.brand, payload };
+    }
+    return void 0;
+  }
+  evaluateClause(clause, actual, op) {
+    const b = this.bindings.find((x) => x.brand === clause.brand);
+    return b?.evaluateClause ? b.evaluateClause(actual, op, clause.payload) : false;
+  }
+  /**
+   * Resolve a `buildClause` payload to an index-probe operand (#625) —
+   * mirrors `evaluateClause`'s brand dispatch. `undefined` (a binding
+   * with no `indexProbe`, or one that declines to probe this op/payload)
+   * means the caller (`candidateRecords()`) must fall back to a scan.
+   */
+  // eslint-disable-next-line @typescript-eslint/no-redundant-type-constituents
+  indexProbe(clause, op) {
+    const b = this.bindings.find((x) => x.brand === clause.brand);
+    return b?.indexProbe ? b.indexProbe(op, clause.payload) : void 0;
+  }
+  /**
+   * Resolve a raw STORED field value to its canonical eager-index bucket
+   * key (#672) — folds every binding's `canonicalizeIndexKey`, first
+   * non-undefined wins (same fold discipline as `buildClause`). `undefined`
+   * means no binding claims `field` (or the value can't be canonicalized)
+   * — the caller buckets the raw stringified value, unchanged from before
+   * this hook existed.
+   */
+  canonicalizeIndexKey(field, rawValue) {
+    for (const b of this.bindings) {
+      const key = b.canonicalizeIndexKey?.(field, rawValue);
+      if (key !== void 0) return key;
+    }
+    return void 0;
+  }
+  decodeResults(record) {
+    let r = record;
+    for (const b of this.bindings) if (b.decodeResults) r = b.decodeResults(r);
+    return r;
+  }
+  /** undefined = no binding covers the field → caller falls back to generic compare. */
+  compareForOrder(field, a, b) {
+    for (const bind of this.bindings) {
+      const c = bind.compareForOrder?.(field, a, b);
+      if (c !== void 0) return c;
+    }
+    return void 0;
+  }
+  /** undefined = no binding resolves an order-sort label for `key` at `field`/`locale` (#650 Task 7 —
+   *  the `orderBy(..., {by:'label'})` per-call-locale channel `compareForOrder` above can't serve). */
+  resolveOrderLabel(field, key, locale) {
+    for (const bind of this.bindings) {
+      const label = bind.resolveOrderLabel?.(field, key, locale);
+      if (label !== void 0) return label;
+    }
+    return void 0;
+  }
+  /**
+   * Which posture governs `field`, if any binding covers it — `undefined`
+   * means no binding declares `field` (the generic, non-via query path
+   * applies). #629 Task 8's posture consumer: `.where()`/`.orderBy()`
+   * consult this before building/evaluating a clause, refusing fields whose
+   * posture is `queryable: 'none'` (e.g. blob); every other posture
+   * ('det-exact'/'ordered'/'full') is left to the existing per-binding
+   * buildClause/evaluateClause/compareForOrder machinery, unchanged.
+   *
+   * #638 Task 3: the graph-computed taint overlay is consulted FIRST — a
+   * derived field's assigned (most-restrictive-of-sources) posture wins over
+   * whatever a binding would otherwise report for that field name (no
+   * binding covers a computed/derived field today, so this never actually
+   * shadows one — see `via/taint-binding.ts`'s `taintBinding.covers`, which
+   * only claims the sealed subset for `encodeAtRest`/`decodeAtRest`, not for
+   * this lookup).
+   */
+  postureFor(field) {
+    const t = this.taint?.postures.get(field);
+    if (t) return t;
+    for (const b of this.bindings) {
+      if (b.covers?.(field)) return b.posture;
+    }
+    return this.taint?.defaultPosture;
+  }
+  /**
+   * Refuse any field-based reducer over a `queryable: 'none'` field (blob) —
+   * metadata-only: walks each reducer's `.field` and checks posture, no
+   * rewriting. Reducers with no `.field` (e.g. `count()`) are skipped.
+   *
+   * Shared by `wrapReducers` below (which ALSO applies each binding's
+   * rewrite, e.g. money's exact-BigInt reducer swap) and by
+   * `ScanBuilder.aggregate()` (#629 Task 8 review fix wave 1), which must
+   * call THIS, not `wrapReducers` — wiring full `wrapReducers` into
+   * `ScanBuilder.aggregate()` would newly activate money/i18n reducer
+   * wrapping on a path that has never run it, a parity-breaking behavior
+   * change for existing brands.
+   */
+  refuseUnqueryableReducers(spec) {
+    for (const reducer of Object.values(spec)) {
+      const field = reducer?.field;
+      if (field !== void 0 && this.postureFor(field)?.queryable === "none") {
+        throw new FieldNotQueryableError(field);
+      }
+    }
+  }
+  /**
+   * Rewrite an aggregate spec (money exact reducers), then refuse any
+   * field-based reducer over a `queryable: 'none'` field (blob) — the same
+   * posture gate `.where()`/`.orderBy()` apply, extended to `.aggregate()`
+   * (both the bare-spec and builder forms funnel through here).
+   */
+  wrapReducers(spec) {
+    this.refuseUnqueryableReducers(spec);
+    let s = spec;
+    for (const b of this.bindings) if (b.wrapReducers) s = b.wrapReducers(s);
+    return s;
+  }
+  /**
+   * Deliberate export-layer redaction (#629 Task 9's posture consumer):
+   * for every OWN field the decoded record carries, if the covering
+   * binding's posture declares `exportable: false` (classified today;
+   * money/i18n/blob are all `true`), replace the value with
+   * {@link EXPORT_REDACTION_MARKER} — the same `'[sealed]'` string
+   * `SealedHandle.toJSON()` (`kernel/types.ts`) already emits, so this is
+   * byte-parity with today's accidental redaction, now independent of the
+   * field's runtime shape. `SealedHandle.toJSON()` stays untouched as
+   * defense-in-depth: a record read via `collection.get()` and
+   * JSON.stringify'd outside `exportStream()` still gets the accident's
+   * redaction on its own. Never mutates the input; returns a new object
+   * only when a field was actually redacted.
+   */
+  redactForExport(record) {
+    let out;
+    for (const field of Object.keys(record)) {
+      if (this.postureFor(field)?.exportable === false) {
+        out ??= { ...record };
+        out[field] = EXPORT_REDACTION_MARKER;
+      }
+    }
+    return out ?? record;
+  }
+  /**
+   * Shared fold over a subset of `this.bindings`: runs each binding's
+   * `erase`, concatenating shredded/retainedShared counts and residue.
+   * Consults `posture.forgettable` (#629 Task 10) — a binding declaring
+   * `forgettable: false` is skipped even if it defines `erase` (none does
+   * today; a future non-forgettable binding is supported without a brand check).
+   */
+  async foldErase(ctx, bindings) {
+    let shredded = 0;
+    let retainedShared = 0;
+    const residue = [];
+    for (const b of bindings) {
+      if (!b.erase || b.posture.forgettable === false) continue;
+      const report = await b.erase(ctx);
+      shredded += report.shredded;
+      retainedShared += report.retainedShared ?? 0;
+      residue.push(...report.residue);
+    }
+    return retainedShared > 0 ? { shredded, residue, retainedShared } : { shredded, residue };
+  }
+  /** `forget()`'s per-ref erasure door: folds every binding's `erase`. */
+  async erase(ctx) {
+    return this.foldErase(ctx, this.bindings);
+  }
+  /**
+   * `forget()`'s SEALED-posture-only erase fold (#629 Task 10, `Collection._onViaErase`'s
+   * one caller) — classified today; metadata-filtered on
+   * `posture.encryptedAtRest`, not brand-checked. `undefined` when no
+   * sealed-posture binding is compiled in — `vault.ts` then falls back to
+   * its own bare-`sensitive` classification, which no via binding covers.
+   */
+  async eraseSealed(ctx) {
+    const sealed = this.bindings.filter((b) => b.posture.encryptedAtRest === "sealed");
+    return sealed.length === 0 ? void 0 : this.foldErase(ctx, sealed);
+  }
+  /** True iff any binding implements decodeResults (query fast-path gating). */
+  get hasResultDecode() {
+    return this.bindings.some((b) => b.decodeResults !== void 0);
+  }
+  /**
+   * True iff any binding declares an at-rest hook (`encodeAtRest`/
+   * `decodeAtRest`) — the codec boundary's async-stack gate (#629 Task 3
+   * consults this to choose between the hook path and today's inline
+   * sealed-slot path; a stack with only sync hooks, e.g. money-only, stays
+   * `false`).
+   */
+  get hasAtRestHooks() {
+    return this.bindings.some((b) => b.encodeAtRest !== void 0 || b.decodeAtRest !== void 0);
+  }
+  /**
+   * Fold every binding's `describeFragment()` into one `brand -> fragment`
+   * map (#650 Task 7 — the first-ever consumer; `describeFragment` was
+   * declared at `via/index.ts:136` since #623 with zero callers until this task).
+   * `undefined` when no compiled binding implements it. Consumed by
+   * `Collection.describe()`/`describeAsync()`, threaded to `buildDescription`
+   * as `BuildDescriptionInput.viaFragments`.
+   */
+  describeFragments() {
+    let out;
+    for (const b of this.bindings) {
+      const f = b.describeFragment?.();
+      if (f !== void 0) {
+        out ??= {};
+        out[b.brand] = f;
+      }
+    }
+    return out;
+  }
+};
+var EXPORT_REDACTION_MARKER = "[sealed]";
+function exportRedact(coll, record) {
+  if (record === null || typeof record !== "object") return record;
+  const via = coll._via;
+  return via ? via.redactForExport(record) : record;
+}
+
+export {
+  ViaPipeline,
+  EXPORT_REDACTION_MARKER,
+  exportRedact
+};
+//# sourceMappingURL=chunk-3EWS67C7.js.map

package/dist/chunk-3EWS67C7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/via/pipeline.ts"],"sourcesContent":["import type { NoydbVia, ViaPosture, ViaWriteCtx, ViaReadCtx, ViaCryptoCtx, SealedSlotRef, ViaEraseCtx, ViaEraseReport } from './index.js'\nimport { ValidationError, FieldNotQueryableError } from '../errors.js'\n\n/** Opaque per-clause query payload carried on FieldClause (replaces the money-only slot). */\nexport interface ViaClause {\n  readonly brand: string\n  readonly payload: unknown\n}\n\n/**\n * The graph-computed taint overlay (#638 Task 3) — `postureFor`'s\n * assignment→enforcement bridge. `postures`/`sealFields` are the\n * enforcement-facing shapes `via/taint-binding.ts#buildTaintOverlay`\n * produces from `ViaGraph.taintedPostures`/`taintSealedFields`;\n * `provenance` (optional — introspection only, never consulted by\n * `postureFor`) is `ViaGraph.taintProvenance`'s output, surfaced by\n * `describe()`.\n */\nexport interface ViaTaintOverlay {\n  readonly postures: ReadonlyMap<string, ViaPosture>\n  readonly sealFields: ReadonlySet<string>\n  readonly provenance?: ReadonlyMap<string, readonly string[]>\n  /** #642 — the whole-record floor for a derivation/MV/overlay OUTPUT collection (the '*' target's\n   *  folded, clamped effective posture). postureFor falls back to it for ANY field; redactForExport\n   *  picks it up per-field; a sealed default drives taintBinding's sealAllFields mode. O(1) read. */\n  readonly defaultPosture?: ViaPosture\n}\n\nexport class ViaPipeline {\n  /**\n   * Present-phase-ONLY order (#665, corrected under #665 review) — a stable\n   * THREE-WAY partition of `bindings` computed once here at construction:\n   * every `'money'`-brand binding first (existing relative order), then\n   * every `'computed'`-brand binding (existing relative order), then\n   * everything else (existing relative order). `present()` folds over this\n   * instead of `bindings` so a `mode: 'virtual'` computed field's value\n   * exists before i18n/lookup's dressing `present()` hooks run on it\n   * (today's `compileVias` order is money→i18n→lookup→classified→\n   * blob→computed, `collection-config.ts:554`, so dressing unconditionally\n   * ran BEFORE the value it dresses existed). This reorder is binding-level,\n   * not conditioned on any particular field composition — it applies to\n   * EVERY collection that compiles a `'computed'` binding at all, not only\n   * ones stacking a dresser on the SAME field as a computed one. EVERY other\n   * phase (`ingest`/`encodeWrite`/`encodeAtRest`/`enforceWrite`/etc.) keeps\n   * folding over `bindings` unchanged — those write/query phases need\n   * money-first (`_applyMoneyFields` PREPENDS money, `_applyClassifiedFields`\n   * APPENDS classified to preserve it, `kernel/collection.ts:1275-1284,1364-\n   * 1368`).\n   *\n   * Money is deliberately carved OUT of the generic \"everything else\" slice\n   * and kept FIRST — the original two-way `[computed..., rest...]` partition\n   * regressed money's composed-field behavior from a benign missing-dressing\n   * gap into VALUE CORRUPTION: money's `present()` DECODES its input as a\n   * STORED SCALED-INT (and derives `<field>Formatted` from it) — it is not a\n   * pure dressing CONSUMER like i18n/lookup, which only ADD a `<field>Label`\n   * key and never rewrite the field's own value. Running money AFTER\n   * computed on a field composing `computed(virtual)` + `money(...)` on\n   * ITSELF means money's decode sees the virtual field's raw MAJOR-unit\n   * output (e.g. `21`) and misreads it as a scaled-int, producing a\n   * corrupted value (`'0.21'`) instead of the pre-#665 result (the raw `21`\n   * surviving untouched, with no `Formatted` key added — a benign\n   * missing-dressing gap, not a wrong value). Money-first restores money's\n   * exact pre-#665 present position — byte-identical money behavior; the\n   * materialized composition pins from the #631 work and the money suites\n   * all ran under money-first. i18n/lookup are genuine dressing consumers\n   * (they only ADD, never rewrite), so they stay after computed, which is\n   * the fix #665 intended. A `'taint'` binding (appended LAST by\n   * `via/graph-wiring.ts#applyTaintOverlay`) stays last here too (it's\n   * neither money nor computed, so it lands at the tail of the \"everything\n   * else\" slice), preserving its \"runs after computed, redacts tainted\n   * virtual output\" contract (`via/taint-binding.ts`'s `taintBinding` doc\n   * comment).\n   *\n   * Money-dressing a virtual computed field's OWN output (the composed\n   * `computed(virtual) + money` case) is NOT resolved by this partition\n   * alone — #669 resolves it with a separate mid-fold hook instead:\n   * `NoydbVia.presentLate` runs after every binding's `present()` in this\n   * money+computed segment, before the \"everything else\" segment below, so\n   * money can quantize/reinterpret a virtual field's fresh MAJOR-UNITS\n   * output as if it were a stored value, without perturbing this ordering\n   * or the #665 invariant above it (`_presentLateBoundary` below marks\n   * exactly where that mid-fold point sits within `_presentOrder`).\n   */\n  private readonly _presentOrder: readonly NoydbVia[]\n  /** #669 — index into `_presentOrder` where the money+computed segment ends and the\n   *  \"everything else\" segment begins (`moneyVias.length + computedVias.length`);\n   *  `present()` runs every binding's `presentLate` at exactly this boundary. */\n  private readonly _presentLateBoundary: number\n\n  private constructor(readonly bindings: readonly NoydbVia[], readonly taint?: ViaTaintOverlay) {\n    const moneyVias = bindings.filter((b) => b.brand === 'money')\n    const computedVias = bindings.filter((b) => b.brand === 'computed')\n    const restBindings = bindings.filter((b) => b.brand !== 'money' && b.brand !== 'computed')\n    this._presentOrder = [...moneyVias, ...computedVias, ...restBindings]\n    this._presentLateBoundary = moneyVias.length + computedVias.length\n  }\n\n  /** undefined when there is nothing to enforce — the zero-via fast path is\n   *  `this.via === undefined` (#553: keeps an all-plain collection sync). A\n   *  `'*'`-defaulted output collection (#642) counts as \"something to enforce\"\n   *  even with zero field-specific postures and zero bindings. */\n  static build(bindings: readonly NoydbVia[], taint?: ViaTaintOverlay): ViaPipeline | undefined {\n    if (bindings.length === 0 && (!taint || (taint.postures.size === 0 && taint.defaultPosture === undefined))) return undefined\n    return new ViaPipeline(bindings, taint)\n  }\n\n  /** Refuse a write before crypto runs: awaits each binding's `enforceWrite` in order — first throw wins. */\n  async enforceWrite(record: Record<string, unknown>, ctx: ViaWriteCtx): Promise<void> {\n    for (const b of this.bindings) if (b.enforceWrite) await b.enforceWrite(record, ctx)\n  }\n\n  ingest(record: Record<string, unknown>): Record<string, unknown> {\n    let r = record\n    for (const b of this.bindings) if (b.ingest) r = b.ingest(r)\n    return r\n  }\n\n  canonicalizeStored(record: Record<string, unknown>): Record<string, unknown> {\n    let r = record\n    for (const b of this.bindings) if (b.canonicalizeStored) r = b.canonicalizeStored(r)\n    return r\n  }\n\n  async encodeWrite(record: Record<string, unknown>, ctx: ViaWriteCtx): Promise<Record<string, unknown>> {\n    let r = record\n    for (const b of this.bindings) if (b.encodeWrite) r = await b.encodeWrite(r, ctx)\n    return r\n  }\n\n  /**\n   * Final write-pipeline stage: folds each binding's `encodeAtRest` in\n   * order, threading the record and accumulating the sealed-slot map. A\n   * field belongs to exactly one via feature — two bindings sealing the\n   * same field is a brand-keyed collision and throws.\n   */\n  async encodeAtRest(\n    record: Record<string, unknown>,\n    crypto: ViaCryptoCtx,\n  ): Promise<{ record: Record<string, unknown>; sealed?: Record<string, SealedSlotRef> }> {\n    let r = record\n    let sealed: Record<string, SealedSlotRef> | undefined\n    const sealedBy = new Map<string, string>()\n    for (const b of this.bindings) {\n      if (!b.encodeAtRest) continue\n      const result = await b.encodeAtRest(r, crypto)\n      r = result.record\n      if (!result.sealed) continue\n      for (const [field, ref] of Object.entries(result.sealed)) {\n        const priorBrand = sealedBy.get(field)\n        if (priorBrand !== undefined) {\n          throw new ValidationError(\n            `via encodeAtRest: field \"${field}\" sealed by binding \"${priorBrand}\" is also sealed by binding \"${b.brand}\"`,\n          )\n        }\n        sealedBy.set(field, b.brand)\n        sealed ??= {}\n        sealed[field] = ref\n      }\n    }\n    return sealed ? { record: r, sealed } : { record: r }\n  }\n\n  /** First read-pipeline stage: folds each binding's `decodeAtRest` in order. */\n  async decodeAtRest(\n    record: Record<string, unknown>,\n    sealed: Record<string, SealedSlotRef>,\n    crypto: ViaCryptoCtx,\n    opts: { asHandles: boolean },\n  ): Promise<Record<string, unknown>> {\n    let r = record\n    for (const b of this.bindings) if (b.decodeAtRest) r = await b.decodeAtRest(r, sealed, crypto, opts)\n    return r\n  }\n\n  async present(record: Record<string, unknown>, ctx: ViaReadCtx): Promise<Record<string, unknown>> {\n    let r = record\n    for (let i = 0; i < this._presentLateBoundary; i++) {\n      const b = this._presentOrder[i]!\n      if (b.present) r = await b.present(r, ctx)\n    }\n    for (const b of this.bindings) if (b.presentLate) r = await b.presentLate(r, ctx)\n    for (let i = this._presentLateBoundary; i < this._presentOrder.length; i++) {\n      const b = this._presentOrder[i]!\n      if (b.present) r = await b.present(r, ctx)\n    }\n    return r\n  }\n\n  /**\n   * #1416 — the synchronous half of {@link present}, for the query path.\n   *\n   * `query().toArray()` is SYNCHRONOUS (#1413) and so cannot await `present`,\n   * which is why it ran `decodeResults` instead — money's stored→canonical\n   * decode and nothing else. The visible cost was that a\n   * `computed({ mode:'virtual' })` field read `undefined` on a query row while\n   * `get()` and `list()` returned it, so the same record had two shapes\n   * depending on which read verb produced it, and a caller summing that field\n   * over a query result got `NaN` with no error.\n   *\n   * This folds the SAME order as `present`, skipping any binding that has not\n   * declared {@link ViaBinding.presentIsSync}. `money` and `computed` do, which\n   * is the pair that carries values; `i18n` and `lookup` are genuinely async\n   * and are reported in `skipped` rather than silently dropped — the caller can\n   * then say so instead of leaving a hole.\n   *\n   * ⚠️ Ordering is preserved exactly, including the `presentLate` boundary,\n   * because money's `presentLate` exists to react to computed's virtual output\n   * (#669). Reordering here would corrupt a field that is both money and\n   * virtual.\n   */\n  presentSync(\n    record: Record<string, unknown>,\n    ctx: ViaReadCtx,\n  ): { record: Record<string, unknown>; skipped: readonly string[] } {\n    let r = record\n    const skipped: string[] = []\n    const note = (b: NoydbVia): void => { if (!skipped.includes(b.brand)) skipped.push(b.brand) }\n    const runnable = (b: NoydbVia): boolean => {\n      if (b.presentIsSync === true) return true\n      if (b.present || b.presentLate) note(b)\n      return false\n    }\n    for (let i = 0; i < this._presentLateBoundary; i++) {\n      const b = this._presentOrder[i]!\n      if (b.present && runnable(b)) r = b.present(r, ctx) as Record<string, unknown>\n    }\n    for (const b of this.bindings) {\n      if (b.presentLate && runnable(b)) r = b.presentLate(r, ctx) as Record<string, unknown>\n    }\n    for (let i = this._presentLateBoundary; i < this._presentOrder.length; i++) {\n      const b = this._presentOrder[i]!\n      if (b.present && runnable(b)) r = b.present(r, ctx) as Record<string, unknown>\n    }\n    return { record: r, skipped }\n  }\n\n  /** True iff some binding's presentation can only run on the async path (#1416). */\n  get hasAsyncPresent(): boolean {\n    return this.bindings.some((b) => (b.present !== undefined || b.presentLate !== undefined) && b.presentIsSync !== true)\n  }\n\n  /**\n   * #1447 — which bindings cover which fields, for `dumpSchema()`.\n   *\n   * Field name → the brands covering it, sorted. A field can appear under more\n   * than one brand: a money field that is also `computed({ mode:'virtual' })`\n   * is covered by both, and collapsing that to one would misreport what the\n   * datastore does to it.\n   *\n   * ⛔ BRAND AND FIELD ONLY — never a binding's configuration, and the reason\n   * is not payload size. A schema dump travels further than a vault does, and\n   * a report saying \"this field is classified, sensitivity pii\" is a map of\n   * which columns are worth attacking, in an artefact that by design leaves\n   * the vault. The consumer who asked for this said brand-plus-field is the\n   * whole of their need, so there is no trade being made.\n   *\n   * A binding that declares no {@link NoydbVia.coveredFields} is omitted\n   * rather than reported as covering nothing — absence of a declaration is not\n   * evidence of absence of coverage.\n   */\n  fieldCoverage(): Record<string, readonly string[]> {\n    const byField = new Map<string, Set<string>>()\n    for (const b of this.bindings) {\n      if (b.coveredFields === undefined) continue\n      for (const f of b.coveredFields) {\n        let brands = byField.get(f)\n        if (!brands) { brands = new Set(); byField.set(f, brands) }\n        brands.add(b.brand)\n      }\n    }\n    const out: Record<string, readonly string[]> = {}\n    for (const f of [...byField.keys()].sort()) out[f] = [...byField.get(f)!].sort()\n    return out\n  }\n\n  buildClause(field: string, op: string, value: unknown): ViaClause | undefined {\n    for (const b of this.bindings) {\n      const payload = b.buildClause?.(field, op, value)\n      if (payload !== undefined) return { brand: b.brand, payload }\n    }\n    return undefined\n  }\n\n  evaluateClause(clause: ViaClause, actual: unknown, op: string): boolean {\n    const b = this.bindings.find((x) => x.brand === clause.brand)\n    // buildClause and evaluateClause are produced/consumed by the same binding by construction.\n    return b?.evaluateClause ? b.evaluateClause(actual, op, clause.payload) : false\n  }\n\n  /**\n   * Resolve a `buildClause` payload to an index-probe operand (#625) —\n   * mirrors `evaluateClause`'s brand dispatch. `undefined` (a binding\n   * with no `indexProbe`, or one that declines to probe this op/payload)\n   * means the caller (`candidateRecords()`) must fall back to a scan.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-redundant-type-constituents\n  indexProbe(clause: ViaClause, op: string): unknown | undefined {\n    const b = this.bindings.find((x) => x.brand === clause.brand)\n    return b?.indexProbe ? b.indexProbe(op, clause.payload) : undefined\n  }\n\n  /**\n   * Resolve a raw STORED field value to its canonical eager-index bucket\n   * key (#672) — folds every binding's `canonicalizeIndexKey`, first\n   * non-undefined wins (same fold discipline as `buildClause`). `undefined`\n   * means no binding claims `field` (or the value can't be canonicalized)\n   * — the caller buckets the raw stringified value, unchanged from before\n   * this hook existed.\n   */\n  canonicalizeIndexKey(field: string, rawValue: unknown): string | undefined {\n    for (const b of this.bindings) {\n      const key = b.canonicalizeIndexKey?.(field, rawValue)\n      if (key !== undefined) return key\n    }\n    return undefined\n  }\n\n  decodeResults(record: unknown): unknown {\n    let r = record\n    for (const b of this.bindings) if (b.decodeResults) r = b.decodeResults(r)\n    return r\n  }\n\n  /** undefined = no binding covers the field → caller falls back to generic compare. */\n  compareForOrder(field: string, a: unknown, b: unknown): number | undefined {\n    for (const bind of this.bindings) {\n      const c = bind.compareForOrder?.(field, a, b)\n      if (c !== undefined) return c\n    }\n    return undefined\n  }\n\n  /** undefined = no binding resolves an order-sort label for `key` at `field`/`locale` (#650 Task 7 —\n   *  the `orderBy(..., {by:'label'})` per-call-locale channel `compareForOrder` above can't serve). */\n  resolveOrderLabel(field: string, key: string, locale: string | undefined): string | undefined {\n    for (const bind of this.bindings) {\n      const label = bind.resolveOrderLabel?.(field, key, locale)\n      if (label !== undefined) return label\n    }\n    return undefined\n  }\n\n  /**\n   * Which posture governs `field`, if any binding covers it — `undefined`\n   * means no binding declares `field` (the generic, non-via query path\n   * applies). #629 Task 8's posture consumer: `.where()`/`.orderBy()`\n   * consult this before building/evaluating a clause, refusing fields whose\n   * posture is `queryable: 'none'` (e.g. blob); every other posture\n   * ('det-exact'/'ordered'/'full') is left to the existing per-binding\n   * buildClause/evaluateClause/compareForOrder machinery, unchanged.\n   *\n   * #638 Task 3: the graph-computed taint overlay is consulted FIRST — a\n   * derived field's assigned (most-restrictive-of-sources) posture wins over\n   * whatever a binding would otherwise report for that field name (no\n   * binding covers a computed/derived field today, so this never actually\n   * shadows one — see `via/taint-binding.ts`'s `taintBinding.covers`, which\n   * only claims the sealed subset for `encodeAtRest`/`decodeAtRest`, not for\n   * this lookup).\n   */\n  postureFor(field: string): ViaPosture | undefined {\n    const t = this.taint?.postures.get(field)\n    if (t) return t\n    for (const b of this.bindings) {\n      if (b.covers?.(field)) return b.posture\n    }\n    // #642 — a '*'-defaulted output collection's whole-record floor: O(1) read,\n    // no fold (the fold ran once at applyTaintOverlay/reapply time).\n    return this.taint?.defaultPosture\n  }\n\n  /**\n   * Refuse any field-based reducer over a `queryable: 'none'` field (blob) —\n   * metadata-only: walks each reducer's `.field` and checks posture, no\n   * rewriting. Reducers with no `.field` (e.g. `count()`) are skipped.\n   *\n   * Shared by `wrapReducers` below (which ALSO applies each binding's\n   * rewrite, e.g. money's exact-BigInt reducer swap) and by\n   * `ScanBuilder.aggregate()` (#629 Task 8 review fix wave 1), which must\n   * call THIS, not `wrapReducers` — wiring full `wrapReducers` into\n   * `ScanBuilder.aggregate()` would newly activate money/i18n reducer\n   * wrapping on a path that has never run it, a parity-breaking behavior\n   * change for existing brands.\n   */\n  refuseUnqueryableReducers<S>(spec: S): void {\n    for (const reducer of Object.values(spec as unknown as Record<string, { readonly field?: string }>)) {\n      const field = reducer?.field\n      if (field !== undefined && this.postureFor(field)?.queryable === 'none') {\n        throw new FieldNotQueryableError(field)\n      }\n    }\n  }\n\n  /**\n   * Rewrite an aggregate spec (money exact reducers), then refuse any\n   * field-based reducer over a `queryable: 'none'` field (blob) — the same\n   * posture gate `.where()`/`.orderBy()` apply, extended to `.aggregate()`\n   * (both the bare-spec and builder forms funnel through here).\n   */\n  wrapReducers<S>(spec: S): S {\n    this.refuseUnqueryableReducers(spec)\n    let s: unknown = spec\n    for (const b of this.bindings) if (b.wrapReducers) s = b.wrapReducers(s)\n    return s as S\n  }\n\n  /**\n   * Deliberate export-layer redaction (#629 Task 9's posture consumer):\n   * for every OWN field the decoded record carries, if the covering\n   * binding's posture declares `exportable: false` (classified today;\n   * money/i18n/blob are all `true`), replace the value with\n   * {@link EXPORT_REDACTION_MARKER} — the same `'[sealed]'` string\n   * `SealedHandle.toJSON()` (`kernel/types.ts`) already emits, so this is\n   * byte-parity with today's accidental redaction, now independent of the\n   * field's runtime shape. `SealedHandle.toJSON()` stays untouched as\n   * defense-in-depth: a record read via `collection.get()` and\n   * JSON.stringify'd outside `exportStream()` still gets the accident's\n   * redaction on its own. Never mutates the input; returns a new object\n   * only when a field was actually redacted.\n   */\n  redactForExport(record: Record<string, unknown>): Record<string, unknown> {\n    let out: Record<string, unknown> | undefined\n    for (const field of Object.keys(record)) {\n      if (this.postureFor(field)?.exportable === false) {\n        out ??= { ...record }\n        out[field] = EXPORT_REDACTION_MARKER\n      }\n    }\n    return out ?? record\n  }\n\n  /**\n   * Shared fold over a subset of `this.bindings`: runs each binding's\n   * `erase`, concatenating shredded/retainedShared counts and residue.\n   * Consults `posture.forgettable` (#629 Task 10) — a binding declaring\n   * `forgettable: false` is skipped even if it defines `erase` (none does\n   * today; a future non-forgettable binding is supported without a brand check).\n   */\n  private async foldErase(ctx: ViaEraseCtx, bindings: readonly NoydbVia[]): Promise<ViaEraseReport> {\n    let shredded = 0\n    let retainedShared = 0\n    const residue: unknown[] = []\n    for (const b of bindings) {\n      if (!b.erase || b.posture.forgettable === false) continue\n      const report = await b.erase(ctx)\n      shredded += report.shredded\n      retainedShared += report.retainedShared ?? 0\n      residue.push(...report.residue)\n    }\n    return retainedShared > 0 ? { shredded, residue, retainedShared } : { shredded, residue }\n  }\n\n  /** `forget()`'s per-ref erasure door: folds every binding's `erase`. */\n  async erase(ctx: ViaEraseCtx): Promise<ViaEraseReport> {\n    return this.foldErase(ctx, this.bindings)\n  }\n\n  /**\n   * `forget()`'s SEALED-posture-only erase fold (#629 Task 10, `Collection._onViaErase`'s\n   * one caller) — classified today; metadata-filtered on\n   * `posture.encryptedAtRest`, not brand-checked. `undefined` when no\n   * sealed-posture binding is compiled in — `vault.ts` then falls back to\n   * its own bare-`sensitive` classification, which no via binding covers.\n   */\n  async eraseSealed(ctx: ViaEraseCtx): Promise<ViaEraseReport | undefined> {\n    const sealed = this.bindings.filter((b) => b.posture.encryptedAtRest === 'sealed')\n    return sealed.length === 0 ? undefined : this.foldErase(ctx, sealed)\n  }\n\n  /** True iff any binding implements decodeResults (query fast-path gating). */\n  get hasResultDecode(): boolean {\n    return this.bindings.some((b) => b.decodeResults !== undefined)\n  }\n\n  /**\n   * True iff any binding declares an at-rest hook (`encodeAtRest`/\n   * `decodeAtRest`) — the codec boundary's async-stack gate (#629 Task 3\n   * consults this to choose between the hook path and today's inline\n   * sealed-slot path; a stack with only sync hooks, e.g. money-only, stays\n   * `false`).\n   */\n  get hasAtRestHooks(): boolean {\n    return this.bindings.some((b) => b.encodeAtRest !== undefined || b.decodeAtRest !== undefined)\n  }\n\n  /**\n   * Fold every binding's `describeFragment()` into one `brand -> fragment`\n   * map (#650 Task 7 — the first-ever consumer; `describeFragment` was\n   * declared at `via/index.ts:136` since #623 with zero callers until this task).\n   * `undefined` when no compiled binding implements it. Consumed by\n   * `Collection.describe()`/`describeAsync()`, threaded to `buildDescription`\n   * as `BuildDescriptionInput.viaFragments`.\n   */\n  describeFragments(): Record<string, Record<string, unknown>> | undefined {\n    let out: Record<string, Record<string, unknown>> | undefined\n    for (const b of this.bindings) {\n      const f = b.describeFragment?.()\n      if (f !== undefined) { out ??= {}; out[b.brand] = f }\n    }\n    return out\n  }\n}\n\n/**\n * The marker `redactForExport` writes for a non-exportable field —\n * intentionally the same literal `SealedHandle.toJSON()` (`kernel/types.ts`)\n * returns, so the two independent redaction layers (deliberate + accident)\n * produce byte-identical export output. Duplicated, not imported, because\n * `SealedHandle.toJSON()` is untouched by #629 Task 9 (belt-and-braces —\n * `via/export-posture-b.test.ts` asserts both layers agree on this string).\n */\nexport const EXPORT_REDACTION_MARKER = '[sealed]'\n\n/**\n * Structural shape `exportRedact` needs from a collection: just the typed\n * `_via` accessor `Collection` exposes (`kernel/collection.ts`, #634). A\n * named interface rather than the real `Collection` type, because\n * `collection.ts` imports `ViaPipeline` from this module — importing\n * `Collection` back here would be circular.\n */\ninterface HasViaPipeline {\n  readonly _via: ViaPipeline | undefined\n}\n\n/**\n * Widened sibling of {@link HasViaPipeline}: `via/graph-wiring.ts`'s\n * `applyTaintOverlay` (#666) needs to REASSIGN the live pipeline, not just\n * read it — `_setVia` is `Collection`'s typed writer seam (`kernel/\n * collection.ts`, beside `_via`), replacing the earlier untyped `coll as {\n * via; codec: { setVia } }` cast. Exported (unlike `HasViaPipeline`) because\n * its one consumer lives in a different module.\n */\nexport interface HasWritableViaPipeline extends HasViaPipeline {\n  _setVia(pipeline: ViaPipeline | undefined): void\n}\n\n/**\n * `vault.ts`'s `exportStream()` reach-in (#629 Task 9): apply the owning\n * collection's export redaction to one decoded record. Typed via {@link\n * HasViaPipeline} against `Collection`'s `_via` accessor (#634) — replaces\n * the earlier untyped any-cast reach-in.\n */\nexport function exportRedact(coll: HasViaPipeline, record: unknown): unknown {\n  if (record === null || typeof record !== 'object') return record\n  const via = coll._via\n  return via ? via.redactForExport(record as Record<string, unknown>) : record\n}\n"],"mappings":";;;;;;AA4BO,IAAM,cAAN,MAAM,aAAY;AAAA,EA6Df,YAAqB,UAAwC,OAAyB;AAAjE;AAAwC;AACnE,UAAM,YAAY,SAAS,OAAO,CAAC,MAAM,EAAE,UAAU,OAAO;AAC5D,UAAM,eAAe,SAAS,OAAO,CAAC,MAAM,EAAE,UAAU,UAAU;AAClE,UAAM,eAAe,SAAS,OAAO,CAAC,MAAM,EAAE,UAAU,WAAW,EAAE,UAAU,UAAU;AACzF,SAAK,gBAAgB,CAAC,GAAG,WAAW,GAAG,cAAc,GAAG,YAAY;AACpE,SAAK,uBAAuB,UAAU,SAAS,aAAa;AAAA,EAC9D;AAAA,EAN6B;AAAA,EAAwC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EANpD;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcjB,OAAO,MAAM,UAA+B,OAAkD;AAC5F,QAAI,SAAS,WAAW,MAAM,CAAC,SAAU,MAAM,SAAS,SAAS,KAAK,MAAM,mBAAmB,QAAa,QAAO;AACnH,WAAO,IAAI,aAAY,UAAU,KAAK;AAAA,EACxC;AAAA;AAAA,EAGA,MAAM,aAAa,QAAiC,KAAiC;AACnF,eAAW,KAAK,KAAK,SAAU,KAAI,EAAE,aAAc,OAAM,EAAE,aAAa,QAAQ,GAAG;AAAA,EACrF;AAAA,EAEA,OAAO,QAA0D;AAC/D,QAAI,IAAI;AACR,eAAW,KAAK,KAAK,SAAU,KAAI,EAAE,OAAQ,KAAI,EAAE,OAAO,CAAC;AAC3D,WAAO;AAAA,EACT;AAAA,EAEA,mBAAmB,QAA0D;AAC3E,QAAI,IAAI;AACR,eAAW,KAAK,KAAK,SAAU,KAAI,EAAE,mBAAoB,KAAI,EAAE,mBAAmB,CAAC;AACnF,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,QAAiC,KAAoD;AACrG,QAAI,IAAI;AACR,eAAW,KAAK,KAAK,SAAU,KAAI,EAAE,YAAa,KAAI,MAAM,EAAE,YAAY,GAAG,GAAG;AAChF,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,aACJ,QACA,QACsF;AACtF,QAAI,IAAI;AACR,QAAI;AACJ,UAAM,WAAW,oBAAI,IAAoB;AACzC,eAAW,KAAK,KAAK,UAAU;AAC7B,UAAI,CAAC,EAAE,aAAc;AACrB,YAAM,SAAS,MAAM,EAAE,aAAa,GAAG,MAAM;AAC7C,UAAI,OAAO;AACX,UAAI,CAAC,OAAO,OAAQ;AACpB,iBAAW,CAAC,OAAO,GAAG,KAAK,OAAO,QAAQ,OAAO,MAAM,GAAG;AACxD,cAAM,aAAa,SAAS,IAAI,KAAK;AACrC,YAAI,eAAe,QAAW;AAC5B,gBAAM,IAAI;AAAA,YACR,4BAA4B,KAAK,wBAAwB,UAAU,gCAAgC,EAAE,KAAK;AAAA,UAC5G;AAAA,QACF;AACA,iBAAS,IAAI,OAAO,EAAE,KAAK;AAC3B,mBAAW,CAAC;AACZ,eAAO,KAAK,IAAI;AAAA,MAClB;AAAA,IACF;AACA,WAAO,SAAS,EAAE,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,EAAE;AAAA,EACtD;AAAA;AAAA,EAGA,MAAM,aACJ,QACA,QACA,QACA,MACkC;AAClC,QAAI,IAAI;AACR,eAAW,KAAK,KAAK,SAAU,KAAI,EAAE,aAAc,KAAI,MAAM,EAAE,aAAa,GAAG,QAAQ,QAAQ,IAAI;AACnG,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QAAQ,QAAiC,KAAmD;AAChG,QAAI,IAAI;AACR,aAAS,IAAI,GAAG,IAAI,KAAK,sBAAsB,KAAK;AAClD,YAAM,IAAI,KAAK,cAAc,CAAC;AAC9B,UAAI,EAAE,QAAS,KAAI,MAAM,EAAE,QAAQ,GAAG,GAAG;AAAA,IAC3C;AACA,eAAW,KAAK,KAAK,SAAU,KAAI,EAAE,YAAa,KAAI,MAAM,EAAE,YAAY,GAAG,GAAG;AAChF,aAAS,IAAI,KAAK,sBAAsB,IAAI,KAAK,cAAc,QAAQ,KAAK;AAC1E,YAAM,IAAI,KAAK,cAAc,CAAC;AAC9B,UAAI,EAAE,QAAS,KAAI,MAAM,EAAE,QAAQ,GAAG,GAAG;AAAA,IAC3C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAwBA,YACE,QACA,KACiE;AACjE,QAAI,IAAI;AACR,UAAM,UAAoB,CAAC;AAC3B,UAAM,OAAO,CAAC,MAAsB;AAAE,UAAI,CAAC,QAAQ,SAAS,EAAE,KAAK,EAAG,SAAQ,KAAK,EAAE,KAAK;AAAA,IAAE;AAC5F,UAAM,WAAW,CAAC,MAAyB;AACzC,UAAI,EAAE,kBAAkB,KAAM,QAAO;AACrC,UAAI,EAAE,WAAW,EAAE,YAAa,MAAK,CAAC;AACtC,aAAO;AAAA,IACT;AACA,aAAS,IAAI,GAAG,IAAI,KAAK,sBAAsB,KAAK;AAClD,YAAM,IAAI,KAAK,cAAc,CAAC;AAC9B,UAAI,EAAE,WAAW,SAAS,CAAC,EAAG,KAAI,EAAE,QAAQ,GAAG,GAAG;AAAA,IACpD;AACA,eAAW,KAAK,KAAK,UAAU;AAC7B,UAAI,EAAE,eAAe,SAAS,CAAC,EAAG,KAAI,EAAE,YAAY,GAAG,GAAG;AAAA,IAC5D;AACA,aAAS,IAAI,KAAK,sBAAsB,IAAI,KAAK,cAAc,QAAQ,KAAK;AAC1E,YAAM,IAAI,KAAK,cAAc,CAAC;AAC9B,UAAI,EAAE,WAAW,SAAS,CAAC,EAAG,KAAI,EAAE,QAAQ,GAAG,GAAG;AAAA,IACpD;AACA,WAAO,EAAE,QAAQ,GAAG,QAAQ;AAAA,EAC9B;AAAA;AAAA,EAGA,IAAI,kBAA2B;AAC7B,WAAO,KAAK,SAAS,KAAK,CAAC,OAAO,EAAE,YAAY,UAAa,EAAE,gBAAgB,WAAc,EAAE,kBAAkB,IAAI;AAAA,EACvH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,gBAAmD;AACjD,UAAM,UAAU,oBAAI,IAAyB;AAC7C,eAAW,KAAK,KAAK,UAAU;AAC7B,UAAI,EAAE,kBAAkB,OAAW;AACnC,iBAAW,KAAK,EAAE,eAAe;AAC/B,YAAI,SAAS,QAAQ,IAAI,CAAC;AAC1B,YAAI,CAAC,QAAQ;AAAE,mBAAS,oBAAI,IAAI;AAAG,kBAAQ,IAAI,GAAG,MAAM;AAAA,QAAE;AAC1D,eAAO,IAAI,EAAE,KAAK;AAAA,MACpB;AAAA,IACF;AACA,UAAM,MAAyC,CAAC;AAChD,eAAW,KAAK,CAAC,GAAG,QAAQ,KAAK,CAAC,EAAE,KAAK,EAAG,KAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,CAAC,CAAE,EAAE,KAAK;AAC/E,WAAO;AAAA,EACT;AAAA,EAEA,YAAY,OAAe,IAAY,OAAuC;AAC5E,eAAW,KAAK,KAAK,UAAU;AAC7B,YAAM,UAAU,EAAE,cAAc,OAAO,IAAI,KAAK;AAChD,UAAI,YAAY,OAAW,QAAO,EAAE,OAAO,EAAE,OAAO,QAAQ;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AAAA,EAEA,eAAe,QAAmB,QAAiB,IAAqB;AACtE,UAAM,IAAI,KAAK,SAAS,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO,KAAK;AAE5D,WAAO,GAAG,iBAAiB,EAAE,eAAe,QAAQ,IAAI,OAAO,OAAO,IAAI;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,WAAW,QAAmB,IAAiC;AAC7D,UAAM,IAAI,KAAK,SAAS,KAAK,CAAC,MAAM,EAAE,UAAU,OAAO,KAAK;AAC5D,WAAO,GAAG,aAAa,EAAE,WAAW,IAAI,OAAO,OAAO,IAAI;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,qBAAqB,OAAe,UAAuC;AACzE,eAAW,KAAK,KAAK,UAAU;AAC7B,YAAM,MAAM,EAAE,uBAAuB,OAAO,QAAQ;AACpD,UAAI,QAAQ,OAAW,QAAO;AAAA,IAChC;AACA,WAAO;AAAA,EACT;AAAA,EAEA,cAAc,QAA0B;AACtC,QAAI,IAAI;AACR,eAAW,KAAK,KAAK,SAAU,KAAI,EAAE,cAAe,KAAI,EAAE,cAAc,CAAC;AACzE,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,gBAAgB,OAAe,GAAY,GAAgC;AACzE,eAAW,QAAQ,KAAK,UAAU;AAChC,YAAM,IAAI,KAAK,kBAAkB,OAAO,GAAG,CAAC;AAC5C,UAAI,MAAM,OAAW,QAAO;AAAA,IAC9B;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,kBAAkB,OAAe,KAAa,QAAgD;AAC5F,eAAW,QAAQ,KAAK,UAAU;AAChC,YAAM,QAAQ,KAAK,oBAAoB,OAAO,KAAK,MAAM;AACzD,UAAI,UAAU,OAAW,QAAO;AAAA,IAClC;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,WAAW,OAAuC;AAChD,UAAM,IAAI,KAAK,OAAO,SAAS,IAAI,KAAK;AACxC,QAAI,EAAG,QAAO;AACd,eAAW,KAAK,KAAK,UAAU;AAC7B,UAAI,EAAE,SAAS,KAAK,EAAG,QAAO,EAAE;AAAA,IAClC;AAGA,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,0BAA6B,MAAe;AAC1C,eAAW,WAAW,OAAO,OAAO,IAA8D,GAAG;AACnG,YAAM,QAAQ,SAAS;AACvB,UAAI,UAAU,UAAa,KAAK,WAAW,KAAK,GAAG,cAAc,QAAQ;AACvE,cAAM,IAAI,uBAAuB,KAAK;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAAgB,MAAY;AAC1B,SAAK,0BAA0B,IAAI;AACnC,QAAI,IAAa;AACjB,eAAW,KAAK,KAAK,SAAU,KAAI,EAAE,aAAc,KAAI,EAAE,aAAa,CAAC;AACvE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,gBAAgB,QAA0D;AACxE,QAAI;AACJ,eAAW,SAAS,OAAO,KAAK,MAAM,GAAG;AACvC,UAAI,KAAK,WAAW,KAAK,GAAG,eAAe,OAAO;AAChD,gBAAQ,EAAE,GAAG,OAAO;AACpB,YAAI,KAAK,IAAI;AAAA,MACf;AAAA,IACF;AACA,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,UAAU,KAAkB,UAAwD;AAChG,QAAI,WAAW;AACf,QAAI,iBAAiB;AACrB,UAAM,UAAqB,CAAC;AAC5B,eAAW,KAAK,UAAU;AACxB,UAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,gBAAgB,MAAO;AACjD,YAAM,SAAS,MAAM,EAAE,MAAM,GAAG;AAChC,kBAAY,OAAO;AACnB,wBAAkB,OAAO,kBAAkB;AAC3C,cAAQ,KAAK,GAAG,OAAO,OAAO;AAAA,IAChC;AACA,WAAO,iBAAiB,IAAI,EAAE,UAAU,SAAS,eAAe,IAAI,EAAE,UAAU,QAAQ;AAAA,EAC1F;AAAA;AAAA,EAGA,MAAM,MAAM,KAA2C;AACrD,WAAO,KAAK,UAAU,KAAK,KAAK,QAAQ;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,YAAY,KAAuD;AACvE,UAAM,SAAS,KAAK,SAAS,OAAO,CAAC,MAAM,EAAE,QAAQ,oBAAoB,QAAQ;AACjF,WAAO,OAAO,WAAW,IAAI,SAAY,KAAK,UAAU,KAAK,MAAM;AAAA,EACrE;AAAA;AAAA,EAGA,IAAI,kBAA2B;AAC7B,WAAO,KAAK,SAAS,KAAK,CAAC,MAAM,EAAE,kBAAkB,MAAS;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,IAAI,iBAA0B;AAC5B,WAAO,KAAK,SAAS,KAAK,CAAC,MAAM,EAAE,iBAAiB,UAAa,EAAE,iBAAiB,MAAS;AAAA,EAC/F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,oBAAyE;AACvE,QAAI;AACJ,eAAW,KAAK,KAAK,UAAU;AAC7B,YAAM,IAAI,EAAE,mBAAmB;AAC/B,UAAI,MAAM,QAAW;AAAE,gBAAQ,CAAC;AAAG,YAAI,EAAE,KAAK,IAAI;AAAA,MAAE;AAAA,IACtD;AACA,WAAO;AAAA,EACT;AACF;AAUO,IAAM,0BAA0B;AA+BhC,SAAS,aAAa,MAAsB,QAA0B;AAC3E,MAAI,WAAW,QAAQ,OAAO,WAAW,SAAU,QAAO;AAC1D,QAAM,MAAM,KAAK;AACjB,SAAO,MAAM,IAAI,gBAAgB,MAAiC,IAAI;AACxE;","names":[]}

package/dist/{chunk-SGZAIJCV.js → chunk-3L2NBKDR.js}

@@ -1,13 +1,9 @@
 import {
   buildRecordAad,
+  buildRecordEnvelope,
+  encrypt,
   openEnvelopeJson
-} from "./chunk-4ZS56W5S.js";
-import {
-  buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
-import {
-  encrypt
-} from "./chunk-HPVZCW43.js";
+} from "./chunk-EZGV6F47.js";
 
 // src/with-shape/persisted-schemas/storage.ts
 var SCHEMAS_COLLECTION = "_schemas";
@@ -45,4 +41,4 @@ export {
   loadPersistedSchema,
   savePersistedSchema
 };
-//# sourceMappingURL=chunk-SGZAIJCV.js.map
+//# sourceMappingURL=chunk-3L2NBKDR.js.map

package/dist/chunk-3L2NBKDR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/persisted-schemas/storage.ts"],"sourcesContent":["/**\n * Read / write the per-collection persisted-schema envelope. Mirrors the\n * standard noy-db record envelope shape and is **AES-GCM encrypted with\n * the collection's DEK** — the schema body (field names, enum values,\n * constraints) is sensitive metadata, so it gets the same encryption\n * envelope as the records it describes.\n *\n * Storage layout:\n *\n *   <vault>/_schemas/<collection>   →   EncryptedEnvelope\n *\n * The DEK passed to {@link savePersistedSchema} / {@link loadPersistedSchema}\n * is the same key the collection uses for its records.\n *\n * @module\n */\n\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../capsule/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { PersistedSchemaEnvelope } from './types.js'\n\n/** Reserved collection name where persisted schemas live. */\nexport const SCHEMAS_COLLECTION = '_schemas' as const\n\n/**\n * A decrypted persisted-schema read paired with the wrapping envelope's\n * `_v`. The version is the optimistic-concurrency token: pass it back to\n * {@link savePersistedSchema} as `expectedVersion` to make the write a CAS\n * that rejects a stale put (see #583 — the `_schemas` record is shared by\n * the JSON-Schema writer and the classified-marker writer).\n */\nexport interface PersistedSchemaEntry {\n  /** Wrapping envelope `_v` (0 when no record exists yet). */\n  readonly version: number\n  /** Decrypted payload, or `undefined` when absent/corrupt/wrong-DEK. */\n  readonly payload: PersistedSchemaEnvelope | undefined\n}\n\n/**\n * Read the persisted-schema envelope for one collection together with its\n * wrapping `_v`. The version reflects the raw stored envelope even when the\n * payload cannot be decrypted/parsed (so a CAS still guards a corrupt record\n * rather than silently clobbering it).\n */\nexport async function loadPersistedSchemaEntry(\n  store: NoydbStore,\n  vault: string,\n  collection: string,\n  dek: EnclaveKey,\n): Promise<PersistedSchemaEntry> {\n  const envelope = await store.get(vault, SCHEMAS_COLLECTION, collection)\n  if (!envelope) return { version: 0, payload: undefined }\n  const version = envelope._v\n  try {\n    const plaintext = await openEnvelopeJson({ collection: SCHEMAS_COLLECTION, id: collection }, envelope, dek)\n    const parsed = JSON.parse(plaintext) as PersistedSchemaEnvelope\n    if (parsed._noydb_schema !== 1) return { version, payload: undefined }\n    return { version, payload: parsed }\n  } catch {\n    return { version, payload: undefined }\n  }\n}\n\n/**\n * Read and decrypt the persisted-schema envelope for one collection.\n * Returns `undefined` when no envelope has been written or when decryption\n * fails (e.g. wrong DEK passed). Tolerates corrupted records — JSON parse\n * failures surface as `undefined`, mirroring `_meta/handle`'s contract.\n */\nexport async function loadPersistedSchema(\n  store: NoydbStore,\n  vault: string,\n  collection: string,\n  dek: EnclaveKey,\n): Promise<PersistedSchemaEnvelope | undefined> {\n  return (await loadPersistedSchemaEntry(store, vault, collection, dek)).payload\n}\n\n/**\n * Encrypt and persist a schema envelope for one collection. Always\n * overwrites any prior write (callers gate on hash equality before calling\n * to avoid no-op writes).\n *\n * Pass `expectedVersion` — the `version` from {@link loadPersistedSchemaEntry}\n * captured at load time — to make the write an optimistic CAS: on a store with\n * `casAtomic`, `store.put` throws {@link ConflictError} when the record was\n * bumped concurrently, so a lost update on the shared `_schemas` record is\n * rejected instead of silently clobbering the other writer's field (#583).\n * When omitted, keeps the legacy unconditional last-writer-wins behaviour.\n */\nexport async function savePersistedSchema(\n  store: NoydbStore,\n  vault: string,\n  collection: string,\n  dek: EnclaveKey,\n  payload: PersistedSchemaEnvelope,\n  expectedVersion?: number,\n): Promise<void> {\n  const json = JSON.stringify(payload)\n  const baseVersion = expectedVersion ?? (await store.get(vault, SCHEMAS_COLLECTION, collection))?._v ?? 0\n  const identity = { collection: SCHEMAS_COLLECTION, id: collection, version: baseVersion + 1 }\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(\n    identity,\n    { iv, data },\n  )\n  await store.put(vault, SCHEMAS_COLLECTION, collection, env, expectedVersion)\n}\n"],"mappings":";;;;;;;;AAsBO,IAAM,qBAAqB;AAsBlC,eAAsB,yBACpB,OACA,OACA,YACA,KAC+B;AAC/B,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,oBAAoB,UAAU;AACtE,MAAI,CAAC,SAAU,QAAO,EAAE,SAAS,GAAG,SAAS,OAAU;AACvD,QAAM,UAAU,SAAS;AACzB,MAAI;AACF,UAAM,YAAY,MAAM,iBAAiB,EAAE,YAAY,oBAAoB,IAAI,WAAW,GAAG,UAAU,GAAG;AAC1G,UAAM,SAAS,KAAK,MAAM,SAAS;AACnC,QAAI,OAAO,kBAAkB,EAAG,QAAO,EAAE,SAAS,SAAS,OAAU;AACrE,WAAO,EAAE,SAAS,SAAS,OAAO;AAAA,EACpC,QAAQ;AACN,WAAO,EAAE,SAAS,SAAS,OAAU;AAAA,EACvC;AACF;AAQA,eAAsB,oBACpB,OACA,OACA,YACA,KAC8C;AAC9C,UAAQ,MAAM,yBAAyB,OAAO,OAAO,YAAY,GAAG,GAAG;AACzE;AAcA,eAAsB,oBACpB,OACA,OACA,YACA,KACA,SACA,iBACe;AACf,QAAM,OAAO,KAAK,UAAU,OAAO;AACnC,QAAM,cAAc,oBAAoB,MAAM,MAAM,IAAI,OAAO,oBAAoB,UAAU,IAAI,MAAM;AACvG,QAAM,WAAW,EAAE,YAAY,oBAAoB,IAAI,YAAY,SAAS,cAAc,EAAE;AAC5F,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,MAAM;AAAA,IACV;AAAA,IACA,EAAE,IAAI,KAAK;AAAA,EACb;AACA,QAAM,MAAM,IAAI,OAAO,oBAAoB,YAAY,KAAK,eAAe;AAC7E;","names":[]}

package/dist/{chunk-YMUFFJCO.js → chunk-3TDUWVWB.js}

@@ -1,6 +1,6 @@
 // src/with-lookup/reduce/strategy.ts
 var NOT_ENABLED = new Error(
-  'Aggregate / groupBy is not enabled on this Noydb instance. Import `{ withReduce }` from "@noy-db/hub/reduce" and pass it to `createNoydb({ reduceStrategy: withReduce() })`.'
+  'Aggregate / groupBy / window is not enabled on this Noydb instance. Import `{ withReduce }` from "@noy-db/hub/reduce" and pass it to `createNoydb({ reduceStrategy: withReduce() })`.'
 );
 var NO_REDUCE = {
   aggregate() {
@@ -12,6 +12,9 @@ var NO_REDUCE = {
   groupByN() {
     throw NOT_ENABLED;
   },
+  window() {
+    throw NOT_ENABLED;
+  },
   scanAggregate() {
     throw NOT_ENABLED;
   }
@@ -20,4 +23,4 @@ var NO_REDUCE = {
 export {
   NO_REDUCE
 };
-//# sourceMappingURL=chunk-YMUFFJCO.js.map
+//# sourceMappingURL=chunk-3TDUWVWB.js.map

package/dist/chunk-3TDUWVWB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-lookup/reduce/strategy.ts"],"sourcesContent":["/**\n * Strategy seam between the core Query / ScanBuilder chain and the\n * optional aggregate / groupBy service. Core imports\n * `ReduceStrategy` as a TYPE-ONLY symbol and `NO_REDUCE` as a\n * tiny runtime stub.\n *\n * The heavy machinery — `Reduction`, `GroupedQuery`, the\n * reducer-step logic — is only reachable from `withReduce()` in\n * `./active.ts`, which is only exported through the\n * `@noy-db/hub/reduce` subpath. Consumers that don't import the\n * subpath ship none of the ~886 LOC.\n *\n * @internal\n */\n\nimport type {\n  Reduction,\n  ReduceSpec,\n  ReduceResult,\n  ReductionUpstream,\n} from './reduction.js'\nimport type { GroupedQuery, GroupedQueryN } from './groupby.js'\nimport type { GroupMaintenanceSource } from '../../kernel/query/live/incremental.js'\nimport type { WindowFactory, WindowSpec, WindowedQuery } from './window.js'\n/**\n * Re-exported so `kernel/query/builder.ts` can name `.window()`'s spec and\n * return type WITHOUT a second spine→service import specifier: this strategy\n * module is the seam the kernel is allowed to reach (`check-architecture.mjs`\n * → PRE_EXISTING_SPINE_SERVICE_IMPORTS), and adding a new grandfathered path\n * there for a type-only import would loosen the ratchet for no gain.\n */\nexport type { WindowSpec, WindowedQuery } from './window.js'\n\n/**\n * Options for {@link withReduce}. `window` is the {@link WindowFactory}\n * returned by `withWindow()` — omitted, `.window()` throws and the window\n * engine stays out of the bundle entirely (see `window.ts` § \"Opting in\").\n */\nexport interface ReduceOptions {\n  readonly window?: WindowFactory\n}\nimport type { ViaPipeline } from '../../kernel/via/pipeline.js'\nimport type { HydrationGate } from '../../kernel/query/hydration.js'\n\n/**\n * Seam interface. `@internal` — will promote to public only when the\n * aggregate service is extracted into its own package.\n *\n * @internal\n */\nexport interface ReduceStrategy {\n  /**\n   * Build an `Reduction<R>` for `Query.aggregate(spec)`. `executeRecords`\n   * is a closure that produces the matching record set when the\n   * reduction runs. NO_REDUCE throws; the active strategy\n   * constructs a real `Reduction`.\n   */\n  aggregate<Spec extends ReduceSpec>(\n    executeRecords: () => readonly unknown[],\n    spec: Spec,\n    upstreams: readonly ReductionUpstream[],\n    /** #1414 — the source collection's cold gate, when there is one. */\n    gate?: HydrationGate,\n  ): Reduction<ReduceResult<Spec>>\n\n  /**\n   * Build a `GroupedQuery<T, F, S>` for `Query.groupBy(field)`. Same\n   * closure / upstream inputs as `aggregate` plus the group key field.\n   */\n  groupBy<T, F extends string, S extends keyof T = never, M extends keyof T & string = never>(\n    executeRecords: () => readonly unknown[],\n    field: F,\n    upstreams: readonly ReductionUpstream[],\n    dictLabelResolver?: (\n      key: string,\n      locale: string,\n      fallback?: string | readonly string[],\n    ) => Promise<string | undefined>,\n    via?: ViaPipeline,\n    /**\n     * #1341 (grouped half) — the delta-maintenance seam. Supplied by\n     * `Query.groupBy()` only for a plan `canMaintainIncrementally()` admits;\n     * omitted, `.groupBy().aggregate().live()` re-runs in full as before.\n     */\n    maintenance?: GroupMaintenanceSource,\n  ): GroupedQuery<T, F, S, M>\n\n  /**\n   * Variadic-keyed sibling — builds a `GroupedQueryN<T, F, S>` for\n   * `Query.groupBy(...fields)`. No dictLabelResolver — `<field>Label`\n   * projection only applies to single-field groupings, which dispatch\n   * through `groupBy` above.\n   */\n  groupByN<T, F extends readonly string[], S extends keyof T = never, M extends keyof T & string = never>(\n    executeRecords: () => readonly unknown[],\n    fields: F,\n    upstreams: readonly ReductionUpstream[],\n    via?: ViaPipeline,\n    /** #1341 (grouped half) — see `groupBy` above. */\n    maintenance?: GroupMaintenanceSource,\n  ): GroupedQueryN<T, F, S, M>\n\n  /**\n   * Build a `WindowedQuery<T>` for `Query.window(spec)` (#1349). Same closure\n   * / upstream inputs as `groupBy`, plus the window definition. The Via\n   * pipeline is threaded so `.select()` gets the same money/distinct reducer\n   * rewriting `.aggregate()` gets.\n   *\n   * Throws unless the strategy was built as `withReduce({ window: withWindow() })`\n   * — the second opt-in exists so the window engine is not charged to a\n   * consumer who only aggregates. See `window.ts` § \"Opting in\".\n   */\n  window<T>(\n    executeRecords: () => readonly unknown[],\n    spec: WindowSpec,\n    upstreams: readonly ReductionUpstream[],\n    via?: ViaPipeline,\n  ): WindowedQuery<T>\n\n  /**\n   * Terminal streaming aggregator for `ScanBuilder.aggregate(spec)`.\n   * Takes an async iterable of decrypted records + the spec and\n   * returns the reduced result.\n   */\n  scanAggregate<Spec extends ReduceSpec>(\n    iter: AsyncIterable<unknown>,\n    spec: Spec,\n  ): Promise<ReduceResult<Spec>>\n}\n\nconst NOT_ENABLED = new Error(\n  'Aggregate / groupBy / window is not enabled on this Noydb instance. ' +\n  'Import `{ withReduce }` from \"@noy-db/hub/reduce\" and pass it to ' +\n  '`createNoydb({ reduceStrategy: withReduce() })`.',\n)\n\n/**\n * No-aggregate stub. Every `.aggregate()` / `.groupBy()` / streaming\n * `scan().aggregate()` call throws with a pointer at the subpath. The\n * real `Reduction` / `GroupedQuery` classes are never referenced at\n * runtime, so the bundler drops the ~886 LOC.\n *\n * @internal\n */\nexport const NO_REDUCE: ReduceStrategy = {\n  aggregate() { throw NOT_ENABLED },\n  groupBy() { throw NOT_ENABLED },\n  groupByN() { throw NOT_ENABLED },\n  window() { throw NOT_ENABLED },\n  scanAggregate() { throw NOT_ENABLED },\n}\n"],"mappings":";AAkIA,IAAM,cAAc,IAAI;AAAA,EACtB;AAGF;AAUO,IAAM,YAA4B;AAAA,EACvC,YAAY;AAAE,UAAM;AAAA,EAAY;AAAA,EAChC,UAAU;AAAE,UAAM;AAAA,EAAY;AAAA,EAC9B,WAAW;AAAE,UAAM;AAAA,EAAY;AAAA,EAC/B,SAAS;AAAE,UAAM;AAAA,EAAY;AAAA,EAC7B,gBAAgB;AAAE,UAAM;AAAA,EAAY;AACtC;","names":[]}