@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/{chunk-CHQCZZWC.js → chunk-EZOAKKTB.js}

@@ -1,14 +1,28 @@
-import {
-  VDIG_ITERATIONS,
-  normalizeForVerify,
-  pbkdf2VerifyDigest
-} from "./chunk-LP7BEXCT.js";
 import {
   bufferToBase64
-} from "./chunk-HPVZCW43.js";
+} from "./chunk-QMWY2FDS.js";
 
-// src/kernel/enclave/classify/bidx.ts
+// src/capsule/enclave-aes/classify/digest.ts
 var subtle = globalThis.crypto.subtle;
+var VDIG_ITERATIONS = 6e5;
+async function pbkdf2VerifyDigest(value, salt, iterations) {
+  const keyMaterial = await subtle.importKey(
+    "raw",
+    new TextEncoder().encode(value),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const bits = await subtle.deriveBits(
+    { name: "PBKDF2", salt, iterations, hash: "SHA-256" },
+    keyMaterial,
+    256
+  );
+  return new Uint8Array(bits);
+}
+
+// src/capsule/enclave-aes/classify/bidx.ts
+var subtle2 = globalThis.crypto.subtle;
 var CLASSIFY_INDEX_KEY_DOMAIN = "noydb-classify-index-v1";
 var CLASSIFY_INDEX_SALT_DOMAIN = "noydb-classify-index-salt-v1";
 var COST_BYTE_V1 = 1;
@@ -18,19 +32,19 @@ function iterationsForCostByte(b) {
   return null;
 }
 async function deriveClassifyIndexKey(dek, collection, field) {
-  const rawDek = await subtle.exportKey("raw", dek);
-  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const rawDek = await subtle2.exportKey("raw", dek);
+  const hkdfKey = await subtle2.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
   const salt = new TextEncoder().encode(CLASSIFY_INDEX_KEY_DOMAIN);
   const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_KEY_DOMAIN, collection, field]));
-  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
-  return subtle.importKey("raw", bits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const bits = await subtle2.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return subtle2.importKey("raw", bits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
 }
 async function deriveClassifyIndexSalt(dek, collection, field) {
-  const rawDek = await subtle.exportKey("raw", dek);
-  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const rawDek = await subtle2.exportKey("raw", dek);
+  const hkdfKey = await subtle2.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
   const salt = new TextEncoder().encode(CLASSIFY_INDEX_SALT_DOMAIN);
   const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_SALT_DOMAIN, collection, field]));
-  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  const bits = await subtle2.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
   return new Uint8Array(bits);
 }
 async function mintAt(normalized, dek, collection, field, costByte) {
@@ -41,7 +55,7 @@ async function mintAt(normalized, dek, collection, field, costByte) {
   const saltCf = await deriveClassifyIndexSalt(dek, collection, field);
   const inner = await pbkdf2VerifyDigest(normalized, saltCf, iterations);
   const kIdx = await deriveClassifyIndexKey(dek, collection, field);
-  const mac = await subtle.sign("HMAC", kIdx, inner);
+  const mac = await subtle2.sign("HMAC", kIdx, inner);
   const tag = new Uint8Array(1 + 32);
   tag[0] = costByte;
   tag.set(new Uint8Array(mac), 1);
@@ -51,19 +65,14 @@ async function mintBidxTag(normalized, dek, collection, field) {
   return mintAt(normalized, dek, collection, field, CURRENT_COST_BYTE);
 }
 
-// src/kernel/enclave/classify/find.ts
-async function computeBidxTarget(candidate, normalize, dek, collection, field, costByte) {
-  const resolvedCostByte = costByte ?? CURRENT_COST_BYTE;
-  const iters = iterationsForCostByte(resolvedCostByte);
-  if (iters === null) return null;
-  const normalized = normalizeForVerify(normalize, candidate);
-  return mintAt(normalized, dek, collection, field, resolvedCostByte);
-}
-
 export {
+  VDIG_ITERATIONS,
+  pbkdf2VerifyDigest,
+  CURRENT_COST_BYTE,
+  iterationsForCostByte,
   deriveClassifyIndexKey,
   deriveClassifyIndexSalt,
-  mintBidxTag,
-  computeBidxTarget
+  mintAt,
+  mintBidxTag
 };
-//# sourceMappingURL=chunk-CHQCZZWC.js.map
+//# sourceMappingURL=chunk-EZOAKKTB.js.map

package/dist/chunk-EZOAKKTB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/capsule/enclave-aes/classify/digest.ts","../src/capsule/enclave-aes/classify/bidx.ts"],"sourcesContent":["/**\n * Verify-digest primitive for classified `digest-only` fields (stage 2).\n * PBKDF2-SHA256 → fixed 32-byte digest. The digest NEVER leaves the enclave\n * in recoverable form — it is sealed into the `_vdig` envelope slot (vdig.ts)\n * or compared in-enclave (verify.ts). @module\n */\nconst subtle = globalThis.crypto.subtle\n\n/** Family KDF constant — matches crypto.ts PBKDF2_ITERATIONS (600K). */\nexport const VDIG_ITERATIONS = 600_000\n\n/**\n * Digest a (pre-normalized) candidate/value to exactly 32 bytes.\n * PBKDF2-SHA256 with a per-record per-write random salt (§2): verify\n * digests are non-equatable by construction.\n */\nexport async function pbkdf2VerifyDigest(\n  value: string,\n  salt: Uint8Array,\n  iterations: number,\n): Promise<Uint8Array> {\n  const keyMaterial = await subtle.importKey(\n    'raw',\n    new TextEncoder().encode(value),\n    'PBKDF2',\n    false,\n    ['deriveBits'],\n  )\n  const bits = await subtle.deriveBits(\n    { name: 'PBKDF2', salt: salt as BufferSource, iterations, hash: 'SHA-256' },\n    keyMaterial,\n    256,\n  )\n  return new Uint8Array(bits)\n}\n","/**\n * Blind-index slow-tag primitive for classified `equatable` fields (stage 2).\n *\n * `mintBidxTag` mints a deterministic, key-and-cost-gated tag —\n * `COST_BYTE ‖ HMAC-SHA256(K_idx, PBKDF2-SHA256(normalized, salt_cf))` — that\n * lets `find.ts` do blind equality lookup over an otherwise-opaque field\n * without ever storing the plaintext or a fast dictionary-crackable digest.\n *\n * Rationale (M-2/I3, spec §4/Crypto #1):\n *  - The outer HMAC is **keyed** by `K_idx`, a DEK-derived key never seen by\n *    the store. A key-less adversary (store access only) cannot mint a\n *    candidate tag to test against the index at all — the HMAC blocks the\n *    classic \"key-less dictionary attack\" a plain digest would invite.\n *  - The inner `pbkdf2VerifyDigest` (stage-2, `digest.ts`) reuses the\n *    existing 600K-iteration cost floor, so even a **DEK holder** who can\n *    compute `K_idx` still pays the PBKDF2 cost per guess — minting is not\n *    free just because you crossed the door.\n *  - Neither control is the real security boundary: the DOOR (who is ever\n *    handed the DEK to begin with) is. These two costs only shape the\n *    economics for whoever is already inside; they do not substitute for\n *    access control.\n *\n * `K_idx` and `salt_cf` are separate HKDF derivations off the same DEK\n * (L-1, #554 precedent: dedicated keys from day one, no shared/legacy form) —\n * sign-key hygiene, not `HMAC(K_idx, const)`. Both derivations are\n * domain-separated per `(collection, field)` so a tag cannot be replayed\n * across fields or collections (join-attack separation).\n *\n * `CURRENT_COST_BYTE` is a 1-byte discriminator prefixed onto every tag so a\n * future iteration-tier bump can mint new tags while old ones still parse:\n * an unknown discriminator is a cheap, immediate non-match instead of a\n * PBKDF2 run at the wrong iteration count.\n *\n * @module\n */\nimport type { EnclaveKey } from '../crypto.js'\nimport { bufferToBase64 } from '../../plumbing/digest.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/** HKDF salt domain for the `K_idx` (blind-index HMAC key) derivation. */\nexport const CLASSIFY_INDEX_KEY_DOMAIN = 'noydb-classify-index-v1'\n\n/** HKDF salt domain for the `salt_cf` (per collection/field PBKDF2 salt) derivation. */\nexport const CLASSIFY_INDEX_SALT_DOMAIN = 'noydb-classify-index-salt-v1'\n\n/** Cost-byte discriminator: version 1, iteration-tier 600K. */\nexport const COST_BYTE_V1 = 0x01\n/** The cost byte new tags are minted at. */\nexport const CURRENT_COST_BYTE = COST_BYTE_V1\n\n/**\n * Map a tag's cost-byte discriminator to its PBKDF2 iteration count.\n * An unrecognized discriminator returns `null` — a mismatched/legacy byte\n * is a cheap non-match, never a PBKDF2 run at the wrong tier.\n */\nexport function iterationsForCostByte(b: number): number | null {\n  if (b === COST_BYTE_V1) return VDIG_ITERATIONS\n  return null\n}\n\n/**\n * Derive the collection+field's dedicated blind-index HMAC key `K_idx` from\n * the DEK via HKDF-SHA256. Non-extractable, `sign`-only — it never leaves\n * this module in usable form.\n */\nexport async function deriveClassifyIndexKey(\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n): Promise<EnclaveKey> {\n  const rawDek = await subtle.exportKey('raw', dek)\n  const hkdfKey = await subtle.importKey('raw', rawDek, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(CLASSIFY_INDEX_KEY_DOMAIN)\n  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_KEY_DOMAIN, collection, field]))\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, 256)\n  return subtle.importKey('raw', bits, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n}\n\n/**\n * Derive the collection+field's dedicated PBKDF2 salt `salt_cf` from the DEK\n * via a SEPARATE HKDF-deriveBits (distinct from {@link deriveClassifyIndexKey}\n * — sign-key hygiene, not `HMAC(K_idx, const)`). 32 raw bytes.\n */\nexport async function deriveClassifyIndexSalt(\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n): Promise<Uint8Array> {\n  const rawDek = await subtle.exportKey('raw', dek)\n  const hkdfKey = await subtle.importKey('raw', rawDek, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(CLASSIFY_INDEX_SALT_DOMAIN)\n  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_SALT_DOMAIN, collection, field]))\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, 256)\n  return new Uint8Array(bits)\n}\n\n/**\n * Mint a blind-index tag at a given cost byte:\n * `tag = base64(COST_BYTE ‖ HMAC(K_idx, PBKDF2(normalized, salt_cf, iterations-for(COST_BYTE))))`.\n * Factored out of {@link mintBidxTag} so `find.ts`'s `computeBidxTarget` can\n * reuse the same crypto at a caller-chosen cost byte (e.g. to evaluate a\n * legacy tier) without duplicating the derivation/digest/MAC pipeline.\n */\nexport async function mintAt(\n  normalized: string,\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n  costByte: number,\n): Promise<string> {\n  const iterations = iterationsForCostByte(costByte)\n  if (iterations == null) {\n    throw new Error(`bidx: unknown cost byte 0x${costByte.toString(16)}`)\n  }\n  const saltCf = await deriveClassifyIndexSalt(dek, collection, field)\n  const inner = await pbkdf2VerifyDigest(normalized, saltCf, iterations)\n  const kIdx = await deriveClassifyIndexKey(dek, collection, field)\n  const mac = await subtle.sign('HMAC', kIdx, inner as BufferSource)\n  const tag = new Uint8Array(1 + 32)\n  tag[0] = costByte\n  tag.set(new Uint8Array(mac), 1)\n  return bufferToBase64(tag)\n}\n\n/**\n * Mint a blind-index tag for an already-normalized value at\n * {@link CURRENT_COST_BYTE}. The caller normalizes once via\n * `normalizeForVerify` (the shared pipeline with `mintVdigSlot`) —\n * `mintBidxTag` never re-normalizes.\n */\nexport async function mintBidxTag(\n  normalized: string,\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n): Promise<string> {\n  return mintAt(normalized, dek, collection, field, CURRENT_COST_BYTE)\n}\n"],"mappings":";;;;;AAMA,IAAM,SAAS,WAAW,OAAO;AAG1B,IAAM,kBAAkB;AAO/B,eAAsB,mBACpB,OACA,MACA,YACqB;AACrB,QAAM,cAAc,MAAM,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,IAC9B;AAAA,IACA;AAAA,IACA,CAAC,YAAY;AAAA,EACf;AACA,QAAM,OAAO,MAAM,OAAO;AAAA,IACxB,EAAE,MAAM,UAAU,MAA4B,YAAY,MAAM,UAAU;AAAA,IAC1E;AAAA,IACA;AAAA,EACF;AACA,SAAO,IAAI,WAAW,IAAI;AAC5B;;;ACKA,IAAMA,UAAS,WAAW,OAAO;AAG1B,IAAM,4BAA4B;AAGlC,IAAM,6BAA6B;AAGnC,IAAM,eAAe;AAErB,IAAM,oBAAoB;AAO1B,SAAS,sBAAsB,GAA0B;AAC9D,MAAI,MAAM,aAAc,QAAO;AAC/B,SAAO;AACT;AAOA,eAAsB,uBACpB,KACA,YACA,OACqB;AACrB,QAAM,SAAS,MAAMA,QAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAMA,QAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,yBAAyB;AAC/D,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,2BAA2B,YAAY,KAAK,CAAC,CAAC;AACpG,QAAM,OAAO,MAAMA,QAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,GAAG;AAChG,SAAOA,QAAO,UAAU,OAAO,MAAM,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AACzF;AAOA,eAAsB,wBACpB,KACA,YACA,OACqB;AACrB,QAAM,SAAS,MAAMA,QAAO,UAAU,OAAO,GAAG;AAChD,QAAM,UAAU,MAAMA,QAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,0BAA0B;AAChE,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,4BAA4B,YAAY,KAAK,CAAC,CAAC;AACrG,QAAM,OAAO,MAAMA,QAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,GAAG;AAChG,SAAO,IAAI,WAAW,IAAI;AAC5B;AASA,eAAsB,OACpB,YACA,KACA,YACA,OACA,UACiB;AACjB,QAAM,aAAa,sBAAsB,QAAQ;AACjD,MAAI,cAAc,MAAM;AACtB,UAAM,IAAI,MAAM,6BAA6B,SAAS,SAAS,EAAE,CAAC,EAAE;AAAA,EACtE;AACA,QAAM,SAAS,MAAM,wBAAwB,KAAK,YAAY,KAAK;AACnE,QAAM,QAAQ,MAAM,mBAAmB,YAAY,QAAQ,UAAU;AACrE,QAAM,OAAO,MAAM,uBAAuB,KAAK,YAAY,KAAK;AAChE,QAAM,MAAM,MAAMA,QAAO,KAAK,QAAQ,MAAM,KAAqB;AACjE,QAAM,MAAM,IAAI,WAAW,IAAI,EAAE;AACjC,MAAI,CAAC,IAAI;AACT,MAAI,IAAI,IAAI,WAAW,GAAG,GAAG,CAAC;AAC9B,SAAO,eAAe,GAAG;AAC3B;AAQA,eAAsB,YACpB,YACA,KACA,YACA,OACiB;AACjB,SAAO,OAAO,YAAY,KAAK,YAAY,OAAO,iBAAiB;AACrE;","names":["subtle"]}

package/dist/chunk-F6NCB7KT.js

@@ -0,0 +1,13 @@
+// src/kernel/query/internal/core.ts
+function installMethods(target, mixin) {
+  for (const name of Object.getOwnPropertyNames(mixin.prototype)) {
+    if (name === "constructor") continue;
+    const desc = Object.getOwnPropertyDescriptor(mixin.prototype, name);
+    if (desc) Object.defineProperty(target, name, desc);
+  }
+}
+
+export {
+  installMethods
+};
+//# sourceMappingURL=chunk-F6NCB7KT.js.map

package/dist/chunk-F6NCB7KT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/query/internal/core.ts"],"sourcesContent":["/**\n * #1458 — how an extension group's methods reach `Query.prototype`.\n *\n * Each group defines its half of the builder as a MIXIN CLASS whose method\n * bodies moved out of `builder.ts` unchanged — `this.plan`, `this.source`,\n * `this.joinContext` and the rest still resolve, because TypeScript's\n * `private` is a compile-time construct and a method installed on the\n * prototype reads them like any other property. The mixin declares those\n * fields with `declare`, which emits nothing.\n *\n * ⭐ **Why a mixin CLASS rather than a file of `Query.prototype.x = function`\n * assignments.** The bodies are the point: several are 100+ lines carrying\n * prose that explains a decision, and a mechanical rewrite into assignment\n * form would have touched every one of them. As class methods they moved\n * byte-for-byte, so the diff shows a relocation rather than a rewrite — and an\n * overload set (`join`, `joinOn`, `aggregate`, `groupBy` all have them)\n * survives, which an assignment form cannot express.\n */\n\n/**\n * Copy a mixin's prototype methods onto a target prototype, replacing the Find\n * stubs.\n *\n * `getOwnPropertyNames` rather than `Object.assign`: class methods are\n * non-enumerable prototype properties, so `assign` copies nothing at all —\n * silently, leaving every stub in place. Descriptors are copied whole so a\n * getter stays a getter.\n */\nexport function installMethods(target: object, mixin: { prototype: object }): void {\n  for (const name of Object.getOwnPropertyNames(mixin.prototype)) {\n    if (name === 'constructor') continue\n    const desc = Object.getOwnPropertyDescriptor(mixin.prototype, name)\n    if (desc) Object.defineProperty(target, name, desc)\n  }\n}\n"],"mappings":";AA4BO,SAAS,eAAe,QAAgB,OAAoC;AACjF,aAAW,QAAQ,OAAO,oBAAoB,MAAM,SAAS,GAAG;AAC9D,QAAI,SAAS,cAAe;AAC5B,UAAM,OAAO,OAAO,yBAAyB,MAAM,WAAW,IAAI;AAClE,QAAI,KAAM,QAAO,eAAe,QAAQ,MAAM,IAAI;AAAA,EACpD;AACF;","names":[]}

package/dist/chunk-FFJFE4T7.js

@@ -0,0 +1,100 @@
+import {
+  LiveMaintainer,
+  canMaintainIncrementally
+} from "./chunk-VHM7HCKB.js";
+import {
+  projectDateTruncKeys
+} from "./chunk-XBKH4FOC.js";
+import {
+  buildOrderKeyPlan,
+  compareOrderKeys,
+  filterRecords,
+  fnViewDecoder,
+  orderKeyOf
+} from "./chunk-AL6ML4LA.js";
+
+// src/kernel/query/internal/maintenance.ts
+var MaintenanceMethods = class {
+  /**
+   * Build the #1341 delta maintainer for this plan, or `undefined` when the
+   * plan shape or the source cannot support one (the query then re-runs in
+   * full, exactly as it did before #1341).
+   *
+   * Everything the maintainer needs is taken from THIS query so the two paths
+   * cannot diverge: `matches` is the same `filterRecords` call the eager
+   * pipeline makes, `compare` is the same comparator `sortRecords` sorts with,
+   * and `decode` is the same Via result decode `toArray()` applies after
+   * slicing.
+   */
+  incrementalMaintainer(mode) {
+    const source = this.source;
+    const snapshotEntries = source.snapshotEntries?.bind(source);
+    const lookupById = source.lookupById?.bind(source);
+    if (!snapshotEntries || !lookupById) return void 0;
+    const orderBy = mode === "rows" ? this.plan.orderBy : [];
+    const limit = mode === "rows" ? this.plan.limit : void 0;
+    const indexes = source.getIndexes?.();
+    const probe = indexes ? { covers: (f) => indexes.has(f), sorted: (f) => indexes.hasSorted(f) } : null;
+    if (!canMaintainIncrementally({ ...this.plan, orderBy, limit }, probe)) return void 0;
+    const clauses = this.plan.clauses;
+    const decodeForFns = fnViewDecoder(source);
+    const via = source.via;
+    const keyPlan = orderBy.length > 0 ? buildOrderKeyPlan(orderBy, via) : void 0;
+    return new LiveMaintainer({
+      snapshotEntries,
+      lookupById,
+      matches: (record) => filterRecords([record], clauses, decodeForFns).length === 1,
+      ...keyPlan ? {
+        order: {
+          keyOf: (record) => orderKeyOf(keyPlan, record),
+          compare: (a, b) => compareOrderKeys(keyPlan, a, b)
+        }
+      } : {},
+      offset: mode === "rows" ? this.plan.offset : 0,
+      limit,
+      ...mode === "rows" && via?.hasResultDecode ? { decode: (rows) => this.decodeVia(rows) } : {}
+    });
+  }
+  /**
+   * Build the #1341 grouped-maintenance seam for this plan, or `undefined`
+   * when the plan shape or the source cannot support one (a grouped live
+   * reduction then re-runs in full, exactly as it did before).
+   *
+   * Same whitelist and the same three inputs `incrementalMaintainer('records')`
+   * uses, for the same reason: `.groupBy()`'s record pipeline IS
+   * `.aggregate()`'s — `candidateRecords` + `filterRecords`, with no sort, no
+   * window and no Via result decode — so `orderBy`/`limit` are stripped before
+   * the whitelist is asked. `matches` is the same `filterRecords` call the
+   * eager pipeline makes, which is what stops the two paths from drifting.
+   *
+   * The one addition is `project`: `.groupBy(dateTrunc(...))` (#1350) stamps a
+   * derived key onto each row AFTER filtering and before bucketing, and the
+   * maintainer has to stamp it too or it would bucket on a field that is not
+   * there. It is a pure per-record map, which is the only kind of projection
+   * this hook may carry.
+   */
+  groupMaintenance(derived) {
+    const source = this.source;
+    const snapshotEntries = source.snapshotEntries?.bind(source);
+    const lookupById = source.lookupById?.bind(source);
+    if (!snapshotEntries || !lookupById) return void 0;
+    const indexes = source.getIndexes?.();
+    const probe = indexes ? { covers: (f) => indexes.has(f), sorted: (f) => indexes.hasSorted(f) } : null;
+    if (!canMaintainIncrementally({ ...this.plan, orderBy: [], limit: void 0 }, probe)) {
+      return void 0;
+    }
+    const clauses = this.plan.clauses;
+    const decodeForFns = fnViewDecoder(source);
+    return {
+      snapshotEntries,
+      lookupById,
+      matches: (record) => filterRecords([record], clauses, decodeForFns).length === 1,
+      ...derived.length > 0 ? { project: (record) => projectDateTruncKeys([record], derived)[0] } : {}
+    };
+  }
+};
+
+export {
+  MaintenanceMethods
+};
+//# sourceMappingURL=chunk-FFJFE4T7.js.map

package/dist/chunk-FFJFE4T7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/query/internal/maintenance.ts"],"sourcesContent":["/**\n * #1458 — the incremental-maintenance methods, shared by Live and Reduce.\n *\n * `incrementalMaintainer` and `groupMaintenance` are Live's machinery, but\n * they are not Live's alone: a live REDUCTION (`aggregate()` /\n * `groupBy()` handed to `withReduce`) maintains its state through exactly the\n * same maintainer, and always has — `Query.aggregate()` called\n * `this.incrementalMaintainer('records')` while both lived in `builder.ts`.\n *\n * ⭐ **So this is a genuine Reduce → Live edge, and it is recorded here rather\n * than hidden.** Both groups' `install()` copy this mixin, so importing\n * `@noy-db/hub/query/reduce` alone still gets a correctly-maintained live\n * reduction — at the cost of `live/incremental.ts` in that bundle. The\n * alternative (a hook that degrades to a full re-run when Live is absent)\n * would make the SAME call site behave differently depending on an unrelated\n * import, which is worse than the bytes.\n */\nimport type { DateTruncKey } from '../reduce/date-trunc.js'\nimport { projectDateTruncKeys } from '../reduce/date-trunc.js'\nimport type { GroupMaintenanceSource } from '../live/incremental.js'\nimport { LiveMaintainer, canMaintainIncrementally } from '../live/incremental.js'\nimport type { DeclaredPredicate, InternalSource, QueryPlan } from '../builder.js'\n// @internal Find helpers — the maintainer re-runs the same predicate and sort\n// the executor does, so it must use the same functions rather than a second\n// implementation that can drift from them.\nimport { buildOrderKeyPlan, compareOrderKeys, filterRecords, fnViewDecoder, orderKeyOf } from '../builder.js'\nimport type { JoinContext } from '../relate/join.js'\nimport type { ReduceStrategy } from '../../../with-lookup/reduce/strategy.js'\n\n/** @internal — copied onto `Query.prototype` by both Live and Reduce. */\nexport class MaintenanceMethods {\n  declare protected readonly source: InternalSource\n  declare protected readonly plan: QueryPlan\n  declare protected readonly joinContext: JoinContext | undefined\n  declare protected readonly reduceStrategy: ReduceStrategy\n  declare protected readonly predicates: ReadonlyMap<string, DeclaredPredicate> | undefined\n  declare protected decodeVia: (records: readonly unknown[], locale?: string) => unknown[]\n\n  /**\n   * Build the #1341 delta maintainer for this plan, or `undefined` when the\n   * plan shape or the source cannot support one (the query then re-runs in\n   * full, exactly as it did before #1341).\n   *\n   * Everything the maintainer needs is taken from THIS query so the two paths\n   * cannot diverge: `matches` is the same `filterRecords` call the eager\n   * pipeline makes, `compare` is the same comparator `sortRecords` sorts with,\n   * and `decode` is the same Via result decode `toArray()` applies after\n   * slicing.\n   */\n  private incrementalMaintainer(mode: 'rows' | 'records'): LiveMaintainer | undefined {\n    const source = this.source\n    const snapshotEntries = source.snapshotEntries?.bind(source)\n    const lookupById = source.lookupById?.bind(source)\n    if (!snapshotEntries || !lookupById) return undefined\n    // `.aggregate()` reduces the whole match set in candidate order — it never\n    // sorts, offsets, limits or decodes — so its maintainer is the same engine\n    // with the ordering/windowing half switched off.\n    const orderBy = mode === 'rows' ? this.plan.orderBy : []\n    const limit = mode === 'rows' ? this.plan.limit : undefined\n    const indexes = source.getIndexes?.()\n    const probe = indexes\n      ? { covers: (f: string) => indexes.has(f), sorted: (f: string) => indexes.hasSorted(f) }\n      : null\n    if (!canMaintainIncrementally({ ...this.plan, orderBy, limit }, probe)) return undefined\n\n    const clauses = this.plan.clauses\n    const decodeForFns = fnViewDecoder(source)\n    const via = source.via\n    // The ordering comes from the SAME key plan `sortRecords` builds and the\n    // keyset cursor compares against (#1346) — one definition of \"what order\n    // is this query in\", so the maintained order cannot drift from a re-run's.\n    // `by: 'label'` is refused above, so no label maps are needed here.\n    const keyPlan = orderBy.length > 0 ? buildOrderKeyPlan(orderBy, via) : undefined\n    return new LiveMaintainer({\n      snapshotEntries,\n      lookupById,\n      matches: record => filterRecords([record], clauses, decodeForFns).length === 1,\n      ...(keyPlan\n        ? {\n            order: {\n              keyOf: (record: unknown) => orderKeyOf(keyPlan, record),\n              compare: (a: readonly unknown[], b: readonly unknown[]) => compareOrderKeys(keyPlan, a, b),\n            },\n          }\n        : {}),\n      offset: mode === 'rows' ? this.plan.offset : 0,\n      limit,\n      ...(mode === 'rows' && via?.hasResultDecode\n        ? { decode: (rows: readonly unknown[]) => this.decodeVia(rows) }\n        : {}),\n    })\n  }\n\n  /**\n   * Build the #1341 grouped-maintenance seam for this plan, or `undefined`\n   * when the plan shape or the source cannot support one (a grouped live\n   * reduction then re-runs in full, exactly as it did before).\n   *\n   * Same whitelist and the same three inputs `incrementalMaintainer('records')`\n   * uses, for the same reason: `.groupBy()`'s record pipeline IS\n   * `.aggregate()`'s — `candidateRecords` + `filterRecords`, with no sort, no\n   * window and no Via result decode — so `orderBy`/`limit` are stripped before\n   * the whitelist is asked. `matches` is the same `filterRecords` call the\n   * eager pipeline makes, which is what stops the two paths from drifting.\n   *\n   * The one addition is `project`: `.groupBy(dateTrunc(...))` (#1350) stamps a\n   * derived key onto each row AFTER filtering and before bucketing, and the\n   * maintainer has to stamp it too or it would bucket on a field that is not\n   * there. It is a pure per-record map, which is the only kind of projection\n   * this hook may carry.\n   */\n  private groupMaintenance(derived: readonly DateTruncKey[]): GroupMaintenanceSource | undefined {\n    const source = this.source\n    const snapshotEntries = source.snapshotEntries?.bind(source)\n    const lookupById = source.lookupById?.bind(source)\n    if (!snapshotEntries || !lookupById) return undefined\n    const indexes = source.getIndexes?.()\n    const probe = indexes\n      ? { covers: (f: string) => indexes.has(f), sorted: (f: string) => indexes.hasSorted(f) }\n      : null\n    if (!canMaintainIncrementally({ ...this.plan, orderBy: [], limit: undefined }, probe)) {\n      return undefined\n    }\n    const clauses = this.plan.clauses\n    const decodeForFns = fnViewDecoder(source)\n    return {\n      snapshotEntries,\n      lookupById,\n      matches: (record: unknown) => filterRecords([record], clauses, decodeForFns).length === 1,\n      ...(derived.length > 0\n        ? { project: (record: unknown) => projectDateTruncKeys([record], derived)[0] }\n        : {}),\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA8BO,IAAM,qBAAN,MAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBtB,sBAAsB,MAAsD;AAClF,UAAM,SAAS,KAAK;AACpB,UAAM,kBAAkB,OAAO,iBAAiB,KAAK,MAAM;AAC3D,UAAM,aAAa,OAAO,YAAY,KAAK,MAAM;AACjD,QAAI,CAAC,mBAAmB,CAAC,WAAY,QAAO;AAI5C,UAAM,UAAU,SAAS,SAAS,KAAK,KAAK,UAAU,CAAC;AACvD,UAAM,QAAQ,SAAS,SAAS,KAAK,KAAK,QAAQ;AAClD,UAAM,UAAU,OAAO,aAAa;AACpC,UAAM,QAAQ,UACV,EAAE,QAAQ,CAAC,MAAc,QAAQ,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAc,QAAQ,UAAU,CAAC,EAAE,IACrF;AACJ,QAAI,CAAC,yBAAyB,EAAE,GAAG,KAAK,MAAM,SAAS,MAAM,GAAG,KAAK,EAAG,QAAO;AAE/E,UAAM,UAAU,KAAK,KAAK;AAC1B,UAAM,eAAe,cAAc,MAAM;AACzC,UAAM,MAAM,OAAO;AAKnB,UAAM,UAAU,QAAQ,SAAS,IAAI,kBAAkB,SAAS,GAAG,IAAI;AACvE,WAAO,IAAI,eAAe;AAAA,MACxB;AAAA,MACA;AAAA,MACA,SAAS,YAAU,cAAc,CAAC,MAAM,GAAG,SAAS,YAAY,EAAE,WAAW;AAAA,MAC7E,GAAI,UACA;AAAA,QACE,OAAO;AAAA,UACL,OAAO,CAAC,WAAoB,WAAW,SAAS,MAAM;AAAA,UACtD,SAAS,CAAC,GAAuB,MAA0B,iBAAiB,SAAS,GAAG,CAAC;AAAA,QAC3F;AAAA,MACF,IACA,CAAC;AAAA,MACL,QAAQ,SAAS,SAAS,KAAK,KAAK,SAAS;AAAA,MAC7C;AAAA,MACA,GAAI,SAAS,UAAU,KAAK,kBACxB,EAAE,QAAQ,CAAC,SAA6B,KAAK,UAAU,IAAI,EAAE,IAC7D,CAAC;AAAA,IACP,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBQ,iBAAiB,SAAsE;AAC7F,UAAM,SAAS,KAAK;AACpB,UAAM,kBAAkB,OAAO,iBAAiB,KAAK,MAAM;AAC3D,UAAM,aAAa,OAAO,YAAY,KAAK,MAAM;AACjD,QAAI,CAAC,mBAAmB,CAAC,WAAY,QAAO;AAC5C,UAAM,UAAU,OAAO,aAAa;AACpC,UAAM,QAAQ,UACV,EAAE,QAAQ,CAAC,MAAc,QAAQ,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAc,QAAQ,UAAU,CAAC,EAAE,IACrF;AACJ,QAAI,CAAC,yBAAyB,EAAE,GAAG,KAAK,MAAM,SAAS,CAAC,GAAG,OAAO,OAAU,GAAG,KAAK,GAAG;AACrF,aAAO;AAAA,IACT;AACA,UAAM,UAAU,KAAK,KAAK;AAC1B,UAAM,eAAe,cAAc,MAAM;AACzC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,SAAS,CAAC,WAAoB,cAAc,CAAC,MAAM,GAAG,SAAS,YAAY,EAAE,WAAW;AAAA,MACxF,GAAI,QAAQ,SAAS,IACjB,EAAE,SAAS,CAAC,WAAoB,qBAAqB,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC,EAAE,IAC3E,CAAC;AAAA,IACP;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-JMGDHKQF.js → chunk-FLPCETP6.js}

@@ -1,6 +1,6 @@
 import {
   TierWriteRefusedError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/kernel/tier-visibility.ts
 async function peekLiveTier(adapter, vault, name, id) {
@@ -49,4 +49,4 @@ export {
   dekKey,
   parseDekKey
 };
-//# sourceMappingURL=chunk-JMGDHKQF.js.map
+//# sourceMappingURL=chunk-FLPCETP6.js.map

package/dist/chunk-FOEDQATO.js

@@ -0,0 +1,53 @@
+import {
+  CollectionNotHydratedError
+} from "./chunk-37EPTBBR.js";
+
+// src/kernel/query/hydration.ts
+var INSPECT = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
+function pendingResult(gate, terminal, compute) {
+  let settled;
+  const settle = () => settled ??= gate.hydrate().then(() => compute());
+  const refuse = () => {
+    throw new CollectionNotHydratedError(gate.collection, terminal, gate.label);
+  };
+  const proxy = new Proxy(
+    // #1462 — the target is `[]`, NOT `{}`, and it is load-bearing: `IsArray`
+    // unwraps a proxy to its target, so this is what makes
+    // `Array.isArray(rows)` answer `true` and send the idiomatic guard into
+    // the throwing path below instead of into a silent `[]`. Every trap still
+    // fires — the target is never read, only classified.
+    [],
+    {
+      get(_target, prop) {
+        if (prop === "then") {
+          return (onOk, onErr) => settle().then(onOk, onErr);
+        }
+        if (prop === "catch") {
+          return (onErr) => settle().catch(onErr);
+        }
+        if (prop === "finally") {
+          return (fn) => settle().finally(fn);
+        }
+        if (prop === Symbol.toStringTag) return "NoydbPendingResult";
+        if (prop === INSPECT) {
+          return () => `[noydb: ${terminal}() on unhydrated collection "${gate.label}" \u2014 await it, or await list()/get() first]`;
+        }
+        return refuse();
+      },
+      has: refuse,
+      ownKeys: refuse,
+      set: refuse,
+      getOwnPropertyDescriptor: refuse
+    }
+  );
+  return proxy;
+}
+function gateTerminal(gate, terminal, compute) {
+  if (gate === void 0 || gate.isHydrated()) return compute();
+  return pendingResult(gate, terminal, compute);
+}
+
+export {
+  gateTerminal
+};
+//# sourceMappingURL=chunk-FOEDQATO.js.map

package/dist/chunk-FOEDQATO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/query/hydration.ts"],"sourcesContent":["import { CollectionNotHydratedError } from '../errors.js'\n\n/**\n * #1414 — the cold-collection gate.\n *\n * An eager collection that has never been read asynchronously holds an EMPTY\n * cache. Before this module every synchronous query terminal answered out of\n * that cache, so a cold collection reported `[]` / `0` / `false` with total\n * confidence, forever, until some `list()`/`get()` hydrated it. Guards inherit\n * the same source through `ReadOnlyVaultFacade`, and both failure directions\n * were measured on shipped stable: a valid write refused because the guard's\n * lookup came back empty, and — worse — a write that a warm instance REFUSES\n * committing on a cold one, because the guard's `await …toArray()` saw nothing.\n *\n * **Empty and unable-to-answer are different facts.** Same posture as #1402\n * (\"an index that cannot answer must say so, not return nothing\") and #1410.\n *\n * The fix has to serve two callers at once, and that is what shapes this\n * module:\n *\n *  - the AWAITED caller (`await q.toArray()`, and therefore every guard, since\n *    `GuardSpec.check` is async) must transparently hydrate and get the rows.\n *    This is the half that closes the bypass.\n *  - the SYNCHRONOUS caller must be told, loudly, that the answer it is about\n *    to trust is not an answer.\n *\n * A terminal cannot both throw and be awaitable, so a cold terminal returns a\n * **pending result**: a thenable that hydrates and re-runs the terminal when\n * awaited, and throws {@link CollectionNotHydratedError} on every use that\n * READS it — indexing, `.length`, iteration, spread, `.map()`, `JSON.stringify`,\n * `String()`, `in`, `Object.keys`, arithmetic, any property read.\n *\n * ⛔ **THE EXACT BOUNDARY, enumerated — because \"any other use\" is what this\n * doc used to say, and it was not true (#1462).** Two operations answer\n * without reaching a proxy trap, and NEITHER CAN BE MADE TO THROW:\n *\n * | use | result | why it cannot throw |\n * |---|---|---|\n * | `typeof rows` | `'object'` | answered from the value's type, no trap |\n * | `if (rows)` / `Boolean(rows)` — truthiness | `true` | `ToBoolean` never calls a trap |\n *\n * Do not try to close either with a `valueOf` returning `false` — that would\n * resurrect the confident-wrong-answer this whole module exists to abolish, in\n * the one shape nobody would ever check.\n *\n * ⭐ **`Array.isArray` used to be a third row, and it was the dangerous one.**\n * `toArray()` is declared `T[]`, so `Array.isArray(rows) ? rows : []` is the\n * ORDINARY defensive shape for the declared type — and it returned `[]` on a\n * cold collection, restoring the silent empty read this module abolishes,\n * behind code that looks like it handles the edge case. It is closed: the\n * proxy's target is `[]`, and `IsArray` unwraps a proxy to its target, so the\n * check answers `true` and the guard falls through to the throwing path. That\n * cost one character of target and no change to the design — the report that\n * found it assumed it needed a real array exotic object.\n *\n * ⚠️ **So the rule for anyone extending this: a use that reaches a trap must\n * throw, and a use that cannot reach one must be IN THE TABLE ABOVE.** The\n * table is pinned by `__tests__/1462-pending-result-surface.test.ts`, which\n * also asserts this comment no longer claims a total guarantee — a probe\n * written against \"any other use\" passes vacuously, because the phrase names\n * no specific use for anything to contradict.\n */\nexport interface HydrationGate {\n  /** `<vault>/<collection>` — names the collection in the error. */\n  readonly label: string\n  /** Collection name alone, for the error's structured field. */\n  readonly collection: string\n  /** False only while the eager cache has never been bulk-loaded. */\n  isHydrated(): boolean\n  /** Bulk-load the collection. Idempotent. */\n  hydrate(): Promise<void>\n}\n\nconst INSPECT = Symbol.for('nodejs.util.inspect.custom')\n\n/**\n * Wrap a terminal's result for an unhydrated collection. `compute` is re-run\n * AFTER hydration — it must be the terminal itself, not a captured value, or\n * the awaited caller would receive the cold answer it came here to avoid.\n */\nfunction pendingResult<V>(gate: HydrationGate, terminal: string, compute: () => V): V {\n  let settled: Promise<V> | undefined\n  const settle = (): Promise<V> => (settled ??= gate.hydrate().then(() => compute()))\n  const refuse = (): never => {\n    throw new CollectionNotHydratedError(gate.collection, terminal, gate.label)\n  }\n  const proxy = new Proxy(\n    // #1462 — the target is `[]`, NOT `{}`, and it is load-bearing: `IsArray`\n    // unwraps a proxy to its target, so this is what makes\n    // `Array.isArray(rows)` answer `true` and send the idiomatic guard into\n    // the throwing path below instead of into a silent `[]`. Every trap still\n    // fires — the target is never read, only classified.\n    [],\n    {\n      get(_target, prop) {\n        if (prop === 'then') {\n          return (onOk?: (v: V) => unknown, onErr?: (e: unknown) => unknown): Promise<unknown> =>\n            settle().then(onOk, onErr)\n        }\n        if (prop === 'catch') {\n          return (onErr?: (e: unknown) => unknown): Promise<unknown> => settle().catch(onErr)\n        }\n        if (prop === 'finally') {\n          return (fn?: () => void): Promise<V> => settle().finally(fn)\n        }\n        if (prop === Symbol.toStringTag) return 'NoydbPendingResult'\n        if (prop === INSPECT) {\n          return () => `[noydb: ${terminal}() on unhydrated collection \"${gate.label}\" — await it, or await list()/get() first]`\n        }\n        return refuse()\n      },\n      has: refuse,\n      ownKeys: refuse,\n      set: refuse,\n      getOwnPropertyDescriptor: refuse,\n    },\n  )\n  return proxy as V\n}\n\n/**\n * Terminal wrapper. Returns `compute()` unchanged whenever the source is\n * hydrated (or carries no gate at all — a plain-object source, a join source,\n * a lazy collection), so the hot path is one property read and a boolean.\n */\nexport function gateTerminal<V>(\n  gate: HydrationGate | undefined,\n  terminal: string,\n  compute: () => V,\n): V {\n  if (gate === undefined || gate.isHydrated()) return compute()\n  return pendingResult(gate, terminal, compute)\n}\n"],"mappings":";;;;;AAyEA,IAAM,UAAU,uBAAO,IAAI,4BAA4B;AAOvD,SAAS,cAAiB,MAAqB,UAAkB,SAAqB;AACpF,MAAI;AACJ,QAAM,SAAS,MAAmB,YAAY,KAAK,QAAQ,EAAE,KAAK,MAAM,QAAQ,CAAC;AACjF,QAAM,SAAS,MAAa;AAC1B,UAAM,IAAI,2BAA2B,KAAK,YAAY,UAAU,KAAK,KAAK;AAAA,EAC5E;AACA,QAAM,QAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMhB,CAAC;AAAA,IACD;AAAA,MACE,IAAI,SAAS,MAAM;AACjB,YAAI,SAAS,QAAQ;AACnB,iBAAO,CAAC,MAA0B,UAChC,OAAO,EAAE,KAAK,MAAM,KAAK;AAAA,QAC7B;AACA,YAAI,SAAS,SAAS;AACpB,iBAAO,CAAC,UAAsD,OAAO,EAAE,MAAM,KAAK;AAAA,QACpF;AACA,YAAI,SAAS,WAAW;AACtB,iBAAO,CAAC,OAAgC,OAAO,EAAE,QAAQ,EAAE;AAAA,QAC7D;AACA,YAAI,SAAS,OAAO,YAAa,QAAO;AACxC,YAAI,SAAS,SAAS;AACpB,iBAAO,MAAM,WAAW,QAAQ,gCAAgC,KAAK,KAAK;AAAA,QAC5E;AACA,eAAO,OAAO;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,MACL,SAAS;AAAA,MACT,KAAK;AAAA,MACL,0BAA0B;AAAA,IAC5B;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,aACd,MACA,UACA,SACG;AACH,MAAI,SAAS,UAAa,KAAK,WAAW,EAAG,QAAO,QAAQ;AAC5D,SAAO,cAAc,MAAM,UAAU,OAAO;AAC9C;","names":[]}

package/dist/{chunk-DGOZ4UZD.js → chunk-FVH5QYY2.js}

@@ -1,6 +1,6 @@
 import {
   DuplicateBehaviorNameError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-audit/guards/registry.ts
 var GuardRegistry = class {
@@ -141,4 +141,4 @@ var GuardRegistry = class {
 export {
   GuardRegistry
 };
-//# sourceMappingURL=chunk-DGOZ4UZD.js.map
+//# sourceMappingURL=chunk-FVH5QYY2.js.map

package/dist/{chunk-HIWCKBEY.js → chunk-G2MVBDFP.js}

@@ -1,33 +1,30 @@
 import {
   assertTierAccess
-} from "./chunk-UGTBXF5U.js";
+} from "./chunk-7XMHMVTS.js";
 import {
   dekKey,
   liveRecordIsElevated,
   liveRecordTier
-} from "./chunk-JMGDHKQF.js";
-import {
-  buildRecordAad,
-  openEnvelopeJson,
-  writeEnvelopeBody
-} from "./chunk-4ZS56W5S.js";
-import {
-  buildRecordEnvelope,
-  buildSealedRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
+} from "./chunk-FLPCETP6.js";
 import {
   base64ToBuffer,
   bufferToBase64,
+  buildRecordAad,
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
   decryptBytesWithAAD,
   deriveBlobAddressKey,
   encrypt,
   encryptBytesWithAAD,
   generateDEK,
   hmacSha256Hex,
+  openEnvelopeJson,
+  sealedBodyArgs,
   sha256Hex,
   unwrapCek,
-  wrapCek
-} from "./chunk-HPVZCW43.js";
+  wrapCek,
+  writeEnvelopeBody
+} from "./chunk-EZGV6F47.js";
 import {
   BLOB_ADDRESS_KEY_ID,
   BlobIntentPendingError,
@@ -39,7 +36,7 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-shape/blobs/blob-pinning.ts
 function memoryBlobPinStore() {
@@ -452,6 +449,8 @@ var BlobSet = class _BlobSet {
    * a cleared view: see `ownerRecordElevated()`/`ownerTier()`.
    */
   clearedTier;
+  /** #1452 — see `BlobsStrategyOpenArgs.assertOwnerWritable`. */
+  assertOwnerWritable;
   constructor(opts) {
     this.store = opts.store;
     this.vault = opts.vault;
@@ -469,6 +468,7 @@ var BlobSet = class _BlobSet {
     this.keyring = opts.keyring;
     this.clearedTier = opts.clearedTier;
     this.pinCache = opts.pinCache;
+    this.assertOwnerWritable = opts.assertOwnerWritable;
   }
   /**
    * #724 I1 completion: a legacy (non-`perRecordKeys`) blob has no per-blob
@@ -671,7 +671,7 @@ var BlobSet = class _BlobSet {
     if (!envelope) return { slots: {}, version: 0 };
     if (!this.encrypted) {
       return {
-        slots: JSON.parse(envelope._data),
+        slots: JSON.parse(envelope._data ?? ""),
         version: envelope._v
       };
     }
@@ -696,7 +696,7 @@ var BlobSet = class _BlobSet {
     const envelope = await this.store.get(this.vault, this.slotsCollection, this.recordId);
     if (!envelope) return { slots: {}, version: 0, atTier: fromTier };
     if (!this.encrypted) {
-      return { slots: JSON.parse(envelope._data), version: envelope._v, atTier: fromTier };
+      return { slots: JSON.parse(envelope._data ?? ""), version: envelope._v, atTier: fromTier };
     }
     const fromDek = await this.getDEK(dekKey(this.collection, fromTier));
     try {
@@ -850,7 +850,7 @@ var BlobSet = class _BlobSet {
     const envelope = await this.store.get(this.vault, BLOB_INDEX_COLLECTION, eTag);
     if (!envelope) return null;
     if (!this.encrypted) {
-      return { blob: JSON.parse(envelope._data), version: envelope._v, atTier: 0 };
+      return { blob: JSON.parse(envelope._data ?? ""), version: envelope._v, atTier: 0 };
     }
     const t = tier ?? await this.ownerTier();
     const fallbackTier = alsoTryTier ?? (t > 0 ? 0 : void 0);
@@ -1109,7 +1109,7 @@ var BlobSet = class _BlobSet {
    *     covered by rotation.
    *
    * This also makes one ordering rule true across the blob subsystem rather
-   * than two opposite ones: `kernel/enclave/record-keys/rekey-blob.ts` already
+   * than two opposite ones: `capsule/plumbing/rekey-blob.ts` already
    * re-encrypts chunks before re-sealing their index entry, and documents that
    * order as its resume property.
    *
@@ -1515,7 +1515,7 @@ var BlobSet = class _BlobSet {
       const envelope = await this.store.get(this.vault, this.versionsCollection, key);
       if (!envelope) continue;
       try {
-        const record = this.encrypted ? JSON.parse(await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek)) : JSON.parse(envelope._data);
+        const record = this.encrypted ? JSON.parse(await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek)) : JSON.parse(envelope._data ?? "");
         holds.set(record.eTag, (holds.get(record.eTag) ?? 0) + 1);
         readable.push(key);
       } catch {
@@ -1795,7 +1795,7 @@ var BlobSet = class _BlobSet {
   async loadVersionRecordAtKeyTolerant(key, fromTier, toTier) {
     const envelope = await this.store.get(this.vault, this.versionsCollection, key);
     if (!envelope) return null;
-    if (!this.encrypted) return { record: JSON.parse(envelope._data), atTier: fromTier };
+    if (!this.encrypted) return { record: JSON.parse(envelope._data ?? ""), atTier: fromTier };
     const fromDek = await this.getDEK(dekKey(this.collection, fromTier));
     try {
       const json2 = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, fromDek);
@@ -1986,9 +1986,9 @@ var BlobSet = class _BlobSet {
     if (!envelope) return null;
     if (dek) {
       const aad = chunkAAD(eTag, index, chunkCount);
-      return await decryptBytesWithAAD(envelope._iv, envelope._data, dek, aad);
+      return await decryptBytesWithAAD(...sealedBodyArgs(envelope, "blobSet"), dek, aad);
     }
-    return base64ToBuffer(envelope._data);
+    return base64ToBuffer(envelope._data ?? "");
   }
   // ─── Version record I/O ───────────────────────────────────────────
   /** #752: '::' is the version-key separator (`versionKey`) — a recordId/slotName/label
@@ -2024,7 +2024,7 @@ var BlobSet = class _BlobSet {
     const envelope = await this.store.get(this.vault, this.versionsCollection, key);
     if (!envelope) return null;
     if (!this.encrypted) {
-      return JSON.parse(envelope._data);
+      return JSON.parse(envelope._data ?? "");
     }
     const dek = await this.getDEK(dekKey(this.collection, tier ?? await this.ownerTier()));
     const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek);
@@ -2155,6 +2155,7 @@ var BlobSet = class _BlobSet {
   async put(slotName, data, opts) {
     this.assertKeyPartSafe(this.recordId, "record id");
     this.assertKeyPartSafe(slotName, "slot name");
+    await this.assertOwnerWritable?.();
     await this.resolvePendingIntent();
     if (this.objectStore && this.blobFields?.[slotName]?.external) {
       const policy = this.blobFields[slotName];
@@ -2503,6 +2504,7 @@ var BlobSet = class _BlobSet {
    * bucket. Writes the external slot record (the catalog entry).
    */
   async adoptExternal(slotName, ref) {
+    await this.assertOwnerWritable?.();
     this.assertKeyPartSafe(this.recordId, "record id");
     this.assertKeyPartSafe(slotName, "slot name");
     this.assertExternalDeclared(slotName);
@@ -2591,10 +2593,32 @@ var BlobSet = class _BlobSet {
     });
   }
   /**
-   * Delete the named slot from this record.
-   * Decrements refCount on the blob. Chunks are GC'd by `vault.blobGC()`.
+   * Delete the named slot from this record and decrement the blob's refCount.
+   * At refCount 0 an erasable blob (`perRecordKeys`) is crypto-shredded on the
+   * spot; a legacy blob keeps its chunks until
+   * `vault.compact({ reclaimLegacyBlobs: true })` reclaims them (#1453), or
+   * `blob(id).migrate()` makes it erasable first.
+   *
+   * Gated on the owning record (#1452): refused where an update of the record
+   * would be refused.
    */
   async delete(slotName) {
+    await this.assertOwnerWritable?.();
+    return this.releaseSlot(slotName);
+  }
+  /**
+   * #1451 — release EVERY slot this record holds. Called by
+   * `Collection.delete()` after the record is gone, so "the record is deleted"
+   * and "its attachments are released" are one operation. Ungated: the record
+   * delete itself already passed the gate bus. Ref-counted like any release —
+   * content another record still holds survives.
+   */
+  async releaseAll() {
+    const { slots } = await this.loadSlots();
+    for (const name of Object.keys(slots)) await this.releaseSlot(name);
+  }
+  /** The body of {@link delete}, minus the owner gate. */
+  async releaseSlot(slotName) {
     await this.resolvePendingIntent();
     let eTagToRelease;
     let externalKeyToDelete;
@@ -2901,6 +2925,7 @@ var BlobSet = class _BlobSet {
    * `rehomeForTier`) — no separate tier-scoping needed for the content side.
    */
   async publish(slotName, label) {
+    await this.assertOwnerWritable?.();
     this.assertKeyPartSafe(this.recordId, "record id");
     this.assertKeyPartSafe(slotName, "slot name");
     this.assertKeyPartSafe(label, "version label");
@@ -2951,7 +2976,7 @@ var BlobSet = class _BlobSet {
       const envelope = await this.store.get(this.vault, this.versionsCollection, key);
       if (!envelope) continue;
       if (!this.encrypted) {
-        versions.push(JSON.parse(envelope._data));
+        versions.push(JSON.parse(envelope._data ?? ""));
       } else {
         const dek = await this.getDEK(this.collection);
         const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek);
@@ -2964,6 +2989,7 @@ var BlobSet = class _BlobSet {
    * Delete a published version. Decrements refCount on its blob.
    */
   async deleteVersion(slotName, label) {
+    await this.assertOwnerWritable?.();
     await this.resolvePendingIntent();
     const record = await this.loadVersionRecord(slotName, label);
     if (!record) return;
@@ -3061,7 +3087,7 @@ var BlobSet = class _BlobSet {
       return this.buildResponse(slot, result.blob, { inline: true });
     }
     const aad = chunkAAD(slot.eTag, 0, result.blob.chunkCount);
-    const decrypted = await decryptBytesWithAAD(envelope._iv, envelope._data, chunkKey, aad);
+    const decrypted = await decryptBytesWithAAD(...sealedBodyArgs(envelope, "blobSet"), chunkKey, aad);
     const plaintext = result.blob.compression === "gzip" ? await decompressBytes(decrypted) : decrypted;
     const recomputed = await hmacSha256Hex(await this.addressKey(await this.ownerTier()), plaintext);
     if (recomputed !== slot.eTag) {
@@ -3137,4 +3163,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-HIWCKBEY.js.map
+//# sourceMappingURL=chunk-G2MVBDFP.js.map