@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/chunk-JQYKPKG6.js

@@ -0,0 +1,193 @@
+import {
+  splitAroundJoins
+} from "./chunk-AL6ML4LA.js";
+import {
+  evaluateClause,
+  hasFnClause,
+  normalizeMatches,
+  normalizeSubqueryOperand
+} from "./chunk-5WWDGFOS.js";
+import {
+  FieldNotQueryableError,
+  QueryExtensionMissingError
+} from "./chunk-37EPTBBR.js";
+
+// src/kernel/query/scan-builder.ts
+var DEFAULT_SCAN_PAGE_SIZE = 100;
+var ScanBuilder = class _ScanBuilder {
+  pageProvider;
+  pageSize;
+  clauses;
+  /**
+   * Zero-or-more join legs to apply per record as the stream flows.
+   * Each leg attaches the resolved right-side record (or null) under
+   * its alias. — streaming joins.
+   *
+   * Joins are evaluated AFTER clauses, so a `where()` filtered-out
+   * record never triggers a right-side lookup. This is the same
+   * ordering as `Query.toArray()` (clauses first, joins after) and
+   * keeps the streaming path from doing wasted work.
+   */
+  joins;
+  /**
+   * Join resolution context. Required for `.join()` to translate a
+   * field name into a target collection + ref mode and to resolve
+   * the right-side `JoinableSource`. Optional because tests
+   * construct ScanBuilder directly with synthetic page providers
+   * that don't know about ref() — calling `.join()` without a
+   * context throws with an actionable error.
+   */
+  joinContext;
+  /**
+   * The backing collection's compiled Via pipeline (money now; more Via
+   * features later). When it declares a result decode, yielded records
+   * are decoded (e.g. money: stored scaled-int → canonical decimal) so
+   * `scan()` agrees with `get()`/`list()`/`query().toArray()`. Decoded
+   * with `'raw'` (canonical decimal, no locale-formatted virtuals) since
+   * the scan stream carries no locale context, mirroring `Query.toArray()`.
+   */
+  via;
+  constructor(pageProvider, pageSize = DEFAULT_SCAN_PAGE_SIZE, clauses = [], joins = [], joinContext, via) {
+    this.pageProvider = pageProvider;
+    this.pageSize = pageSize;
+    this.clauses = clauses;
+    this.joins = joins;
+    this.joinContext = joinContext;
+    this.via = via;
+  }
+  /**
+   * Decode this scan's Via-covered fields on a record (e.g. money: stored
+   * scaled-int → canonical decimal). No-op when the Via pipeline declares
+   * no result decode. See {@link via}.
+   */
+  decodeVia(record) {
+    if (!this.via || !this.via.hasResultDecode) return record;
+    return this.via.decodeResults(record);
+  }
+  /**
+   * Add a field comparison. Runs per record as the scan stream
+   * flows through, so non-matching records are dropped before they
+   * reach `.aggregate()` or the iteration consumer. Multiple
+   * `.where()` calls are AND-combined — same semantics as
+   * `Query.where()`.
+   *
+   * Clauses cannot use the secondary-index fast path here because
+   * the scan sources records from the adapter's paginator, not from
+   * the in-memory cache where indexes live. Index-accelerated scans
+   * are a future optimization — the current implementation
+   * evaluates clauses per record in O(1) per clause.
+   *
+   * Consults the Via pipeline's posture before building a clause (#629
+   * Task 8): a field whose posture is `queryable: 'none'` throws
+   * `FieldNotQueryableError` here, at the call site — same gate as
+   * `Query.where()`.
+   */
+  where(field, op, value) {
+    const via = this.via;
+    if (via?.postureFor(field)?.queryable === "none") throw new FieldNotQueryableError(field);
+    const { op: sop, value: sval, subquery } = normalizeSubqueryOperand(op, value);
+    const { op: mop, value: mval } = normalizeMatches(sop, sval);
+    const viaClause = via?.buildClause(field, mop, mval);
+    const clause = viaClause ? {
+      type: "field",
+      field,
+      op: mop,
+      value: mval,
+      ...subquery ? { subquery } : {},
+      via: {
+        brand: viaClause.brand,
+        payload: viaClause.payload,
+        evaluate: (actual, evalOp) => via.evaluateClause(viaClause, actual, evalOp)
+      }
+    } : { type: "field", field, op: mop, value: mval, ...subquery ? { subquery } : {} };
+    return new _ScanBuilder(
+      this.pageProvider,
+      this.pageSize,
+      [...this.clauses, clause],
+      this.joins,
+      this.joinContext,
+      this.via
+    );
+  }
+  /**
+   * Escape hatch: add an arbitrary predicate function. Same
+   * non-serializable caveat as `Query.filter()` — filter clauses
+   * don't round-trip through `toPlan()`. Prefer `.where()` when
+   * possible.
+   */
+  filter(fn) {
+    const clause = {
+      type: "filter",
+      fn
+    };
+    return new _ScanBuilder(
+      this.pageProvider,
+      this.pageSize,
+      [...this.clauses, clause],
+      this.joins,
+      this.joinContext,
+      this.via
+    );
+  }
+  async *[Symbol.asyncIterator]() {
+    const joinResolvers = this.joins.length === 0 ? null : this.buildJoinResolvers();
+    const { preJoin, postJoin } = splitAroundJoins(this.clauses, this.joins);
+    let page = await this.pageProvider.listPage({ limit: this.pageSize });
+    while (true) {
+      for (const record of page.items) {
+        if (!this.recordMatches(record, preJoin)) continue;
+        const decoded = this.decodeVia(record);
+        if (joinResolvers === null) {
+          yield decoded;
+        } else {
+          let attached = decoded;
+          for (const resolver of joinResolvers) {
+            attached = this.applyOneJoinStreaming(attached, resolver);
+          }
+          if (postJoin.length > 0 && !this.recordMatches(attached, postJoin)) continue;
+          yield attached;
+        }
+      }
+      if (page.nextCursor === null) return;
+      page = await this.pageProvider.listPage({
+        cursor: page.nextCursor,
+        limit: this.pageSize
+      });
+    }
+  }
+  /**
+   * Evaluate the clause list against a single record. Linear in
+   * the clause count; short-circuits on first false. Clauses on a
+   * scan are always re-evaluated per record — no index-accelerated
+   * path, because the stream sources records from the adapter
+   * paginator, not from the in-memory cache where indexes live.
+   */
+  recordMatches(record, clauses = this.clauses) {
+    if (clauses.length === 0) return true;
+    const fnView = this.via?.hasResultDecode && hasFnClause(clauses) ? this.decodeVia(record) : void 0;
+    for (const clause of clauses) {
+      if (!evaluateClause(record, clause, fnView)) return false;
+    }
+    return true;
+  }
+};
+var SCAN_EXTENSION_METHODS = [
+  ["aggregate", "@noy-db/hub/query/reduce"],
+  ["groupBy", "@noy-db/hub/query/reduce"],
+  ["join", "@noy-db/hub/query/relate"]
+];
+for (const [method, subpath] of SCAN_EXTENSION_METHODS) {
+  Object.defineProperty(ScanBuilder.prototype, method, {
+    value: function scanExtensionMissing() {
+      throw new QueryExtensionMissingError(`scan().${method}`, subpath);
+    },
+    writable: true,
+    enumerable: false,
+    configurable: true
+  });
+}
+
+export {
+  ScanBuilder
+};
+//# sourceMappingURL=chunk-JQYKPKG6.js.map

package/dist/chunk-JQYKPKG6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/query/scan-builder.ts"],"sourcesContent":["/**\n * Streaming scan builder with filter + aggregate support.\n *\n * `Collection.scan()` now returns a `ScanBuilder<T>` that\n * implements `AsyncIterable<T>` (for existing `for await … of`\n * consumers) AND exposes chainable `.where()` / `.filter()` clauses\n * plus a `.aggregate(spec)` async terminal that reduces the scan\n * stream through the same reducer protocol as `Query.aggregate()`\n *.\n *\n * **Memory model:** O(reducers), not O(records). The aggregate\n * terminal initializes one state per reducer, iterates through the\n * scan one record at a time via `for await`, applies every reducer's\n * `step` per record, and never collects the stream into an array.\n * This is what makes `scan().aggregate()` suitable for collections\n * that don't fit in memory — the bound is a code-level invariant\n * visible in the function body, not a runtime assertion.\n *\n * **Paginated iteration:** the builder holds a `pageProvider`\n * closure that maps `(cursor, limit) → Promise<page>`, plumbed by\n * `Collection.scan()` to `collection.listPage(...)`. The page\n * iterator walks cursors forward until exhaustion, same as the\n * previous async-generator `scan()` did.\n *\n * **Backward compatibility:** existing `for await (const rec of\n * collection.scan()) { … }` code continues to work because\n * `ScanBuilder` implements `[Symbol.asyncIterator]`. The previous\n * signature returned an `AsyncIterableIterator<T>` (which has both\n * `[Symbol.asyncIterator]` and `.next()`). We verified at grep time\n * that no call sites use `.next()` on the scan result directly, so\n * the narrowed interface is safe.\n *\n * **Immutability:** each `.where()` / `.filter()` call returns a\n * fresh builder sharing the same page provider and page size. This\n * lets a base scan be reused for multiple parallel aggregations:\n *\n * ```ts\n * const scan = invoices.scan()\n * const [open, paid] = await Promise.all([\n *   scan.where('status', '==', 'open').aggregate({ n: count() }),\n *   scan.where('status', '==', 'paid').aggregate({ n: count() }),\n * ])\n * ```\n *\n * Note that each aggregation pays a full scan — there's no shared\n * iteration across the two. When the specs are known together, pass\n * them as an ARRAY (#1340): `.aggregate([specA, specB])` steps every\n * spec's state from the same yielded record, so N specs cost one\n * pass, not N.\n *\n * **Out of scope for (tracked separately):**\n *   - `scan().aggregate().live()` — unbounded scan + change-stream\n *     reconciliation is a design problem, not just a code one, and\n *     #1340 deliberately left it out\n *   - Parallel scan across pages — race-safe page cursor contracts\n *     are not in the adapter API yet\n *   - `scan().join(...)` — tracked under  (streaming join)\n */\n\nimport type { QueryField } from '../types.js'\nimport type { Clause, FieldClause, Operator } from './predicate.js'\nimport { evaluateClause, hasFnClause, normalizeMatches, normalizeSubqueryOperand } from './predicate.js'\nimport type { ReduceSpec, ReduceResult } from '../../with-lookup/reduce/reduction.js'\n// ─── #1458 — Relate is TYPE-ONLY here, same as in `builder.ts` ───────────\n// The streaming iterator has to be able to run a plan that carries legs; it\n// cannot BUILD one. `splitAroundJoins` is the Find-side shim (join-conditional,\n// with the empty answer inline) that `builder.ts` publishes for both builders,\n// so the two cannot drift on what \"pre-join\" means.\nimport type { JoinContext, JoinLeg } from './relate/join.js'\nimport type { ScanJoinResolver } from './relate/scan-methods.js'\nimport { splitAroundJoins } from './builder.js'\nimport { FieldNotQueryableError, QueryExtensionMissingError } from '../errors.js'\nimport type { ViaPipeline } from '../via/pipeline.js'\n\n/**\n * Result of the multi-spec `.aggregate([specA, specB, …])` form (#1340) — a\n * tuple positionally matching the specs, each element the shape that spec's\n * own single-spec `.aggregate()` would have returned.\n */\nexport type MultiReduceResult<Specs extends readonly ReduceSpec[]> = {\n  -readonly [K in keyof Specs]: ReduceResult<Specs[K]>\n}\n\n/**\n * Page provider — the Collection-shaped hook the builder calls to\n * walk cursors forward. Kept as a structural interface so tests can\n * wire up a synthetic provider without pulling in the full\n * Collection class. Collection's `listPage` matches this shape\n * exactly.\n */\nexport interface ScanPageProvider<T> {\n  listPage(opts: {\n    cursor?: string\n    limit?: number\n  }): Promise<{ items: T[]; nextCursor: string | null }>\n}\n\nconst DEFAULT_SCAN_PAGE_SIZE = 100\n\n/**\n * Chainable streaming scan. Implements `AsyncIterable<T>` for\n * drop-in use with `for await … of`; adds `.where()` / `.filter()`\n * chainable clauses and a `.aggregate(spec)` async terminal.\n *\n * The builder is immutable per operation — each chained call\n * returns a fresh `ScanBuilder` sharing the same page provider and\n * page size. The original builder is never mutated, so it's safe\n * to reuse across multiple parallel consumers.\n */\nexport class ScanBuilder<T, S extends keyof T = never, M extends keyof T & string = never> implements AsyncIterable<T> {\n  private readonly pageProvider: ScanPageProvider<T>\n  private readonly pageSize: number\n  private readonly clauses: readonly Clause[]\n  /**\n   * Zero-or-more join legs to apply per record as the stream flows.\n   * Each leg attaches the resolved right-side record (or null) under\n   * its alias. — streaming joins.\n   *\n   * Joins are evaluated AFTER clauses, so a `where()` filtered-out\n   * record never triggers a right-side lookup. This is the same\n   * ordering as `Query.toArray()` (clauses first, joins after) and\n   * keeps the streaming path from doing wasted work.\n   */\n  private readonly joins: readonly JoinLeg[]\n  /**\n   * Join resolution context. Required for `.join()` to translate a\n   * field name into a target collection + ref mode and to resolve\n   * the right-side `JoinableSource`. Optional because tests\n   * construct ScanBuilder directly with synthetic page providers\n   * that don't know about ref() — calling `.join()` without a\n   * context throws with an actionable error.\n   */\n  private readonly joinContext: JoinContext | undefined\n  /**\n   * The backing collection's compiled Via pipeline (money now; more Via\n   * features later). When it declares a result decode, yielded records\n   * are decoded (e.g. money: stored scaled-int → canonical decimal) so\n   * `scan()` agrees with `get()`/`list()`/`query().toArray()`. Decoded\n   * with `'raw'` (canonical decimal, no locale-formatted virtuals) since\n   * the scan stream carries no locale context, mirroring `Query.toArray()`.\n   */\n  private readonly via: ViaPipeline | undefined\n\n  // ─── #1458 — installed by the extension subpaths ────────────────────────\n  //\n  // `ScanBuilder` is split the same way `Query` is: Find here, Reduce and\n  // Relate in `@noy-db/hub/query/{reduce,relate}`. These two are declared\n  // rather than defined because the ITERATOR below calls them, and it stays in\n  // Find — both calls are behind `joins.length === 0`, which only Relate's\n  // `join()` can make false.\n  declare protected buildJoinResolvers: () => ScanJoinResolver[]\n  declare protected applyOneJoinStreaming: (record: unknown, resolver: ScanJoinResolver) => unknown\n\n  constructor(\n    pageProvider: ScanPageProvider<T>,\n    pageSize: number = DEFAULT_SCAN_PAGE_SIZE,\n    clauses: readonly Clause[] = [],\n    joins: readonly JoinLeg[] = [],\n    joinContext?: JoinContext,\n    via?: ViaPipeline,\n  ) {\n    this.pageProvider = pageProvider\n    this.pageSize = pageSize\n    this.clauses = clauses\n    this.joins = joins\n    this.joinContext = joinContext\n    this.via = via\n  }\n\n  /**\n   * Decode this scan's Via-covered fields on a record (e.g. money: stored\n   * scaled-int → canonical decimal). No-op when the Via pipeline declares\n   * no result decode. See {@link via}.\n   */\n  private decodeVia(record: T): T {\n    if (!this.via || !this.via.hasResultDecode) return record\n    return this.via.decodeResults(record) as T\n  }\n\n  /**\n   * Add a field comparison. Runs per record as the scan stream\n   * flows through, so non-matching records are dropped before they\n   * reach `.aggregate()` or the iteration consumer. Multiple\n   * `.where()` calls are AND-combined — same semantics as\n   * `Query.where()`.\n   *\n   * Clauses cannot use the secondary-index fast path here because\n   * the scan sources records from the adapter's paginator, not from\n   * the in-memory cache where indexes live. Index-accelerated scans\n   * are a future optimization — the current implementation\n   * evaluates clauses per record in O(1) per clause.\n   *\n   * Consults the Via pipeline's posture before building a clause (#629\n   * Task 8): a field whose posture is `queryable: 'none'` throws\n   * `FieldNotQueryableError` here, at the call site — same gate as\n   * `Query.where()`.\n   */\n  where(field: QueryField<T, S>, op: Operator, value: unknown): ScanBuilder<T, S, M> {\n    // A Via-covered field (e.g. money) compares in major units, BigInt-exact\n    // in scaled space — same build-time operand rewrite as Query.where().\n    const via = this.via\n    if (via?.postureFor(field as string)?.queryable === 'none') throw new FieldNotQueryableError(field as string)\n    // #1357: a 'matches' operand is refused-or-normalized HERE, at the call\n    // site — an anchored literal prefix lowers to `startsWith` (taking the\n    // sorted index), anything else serializes to `{ source, flags }` so the\n    // pattern folds into an MV's queryHash. Every other operator is identity.\n    // #1351: a SUBQUERY operand of `in`/`!in` resolves to its id array here,\n    // at build time — same normalization order as `Query.where()`, so all\n    // three builders turn the same call into the same clause.\n    const { op: sop, value: sval, subquery } = normalizeSubqueryOperand(op, value)\n    const { op: mop, value: mval } = normalizeMatches(sop, sval)\n    const viaClause = via?.buildClause(field as string, mop, mval)\n    const clause: FieldClause = viaClause\n      ? {\n          type: 'field',\n          field: field as string,\n          op: mop,\n          value: mval,\n          ...(subquery ? { subquery } : {}),\n          via: {\n            brand: viaClause.brand,\n            payload: viaClause.payload,\n            evaluate: (actual: unknown, evalOp: string) => via!.evaluateClause(viaClause, actual, evalOp),\n          },\n        }\n      : { type: 'field', field: field as string, op: mop, value: mval, ...(subquery ? { subquery } : {}) }\n    return new ScanBuilder<T, S, M>(\n      this.pageProvider,\n      this.pageSize,\n      [...this.clauses, clause],\n      this.joins,\n      this.joinContext,\n      this.via,\n    )\n  }\n\n  /**\n   * Escape hatch: add an arbitrary predicate function. Same\n   * non-serializable caveat as `Query.filter()` — filter clauses\n   * don't round-trip through `toPlan()`. Prefer `.where()` when\n   * possible.\n   */\n  filter(fn: (record: T) => boolean): ScanBuilder<T, S, M> {\n    const clause: Clause = {\n      type: 'filter',\n      fn: fn as (record: unknown) => boolean,\n    }\n    return new ScanBuilder<T, S, M>(\n      this.pageProvider,\n      this.pageSize,\n      [...this.clauses, clause],\n      this.joins,\n      this.joinContext,\n      this.via,\n    )\n  }\n\n  async *[Symbol.asyncIterator](): AsyncIterator<T> {\n    // One-time setup: resolve every join leg's right-side source\n    // and pick its strategy (lookupById per row vs hash from\n    // snapshot once). Both are O(left) per record after setup; the\n    // difference is the upfront cost of hashing the right side\n    // when there's no lookupById.\n    //\n    // Hash maps live for the lifetime of the iteration, so memory\n    // for the right side is O(rightRowCount) per leg. Memory for\n    // the left side stays O(pageSize) regardless — that's the\n    // streaming property we're after.\n    const joinResolvers = this.joins.length === 0 ? null : this.buildJoinResolvers()\n    // #1030 — a clause addressing a join alias cannot be evaluated against the\n    // raw record, where the alias does not exist yet. Split once per\n    // iteration, not per record. Streaming pays nothing for this: the\n    // post-join predicate runs on the row already in hand, so the O(pageSize)\n    // memory property is untouched.\n    const { preJoin, postJoin } = splitAroundJoins(this.clauses, this.joins)\n\n    let page = await this.pageProvider.listPage({ limit: this.pageSize })\n    while (true) {\n      for (const record of page.items) {\n        // Filter on the raw stored record (same order as Query.toArray:\n        // clauses first), then decode Via-covered fields (e.g. money, to\n        // the canonical decimal) before yielding so scan() never leaks the\n        // internal stored representation.\n        if (!this.recordMatches(record, preJoin)) continue\n        const decoded = this.decodeVia(record)\n        if (joinResolvers === null) {\n          yield decoded\n        } else {\n          // Apply every join leg in declaration order. Each\n          // leg attaches a field — the result of one leg becomes\n          // the input to the next. Multi-FK chaining is\n          // supported by construction.\n          let attached: unknown = decoded\n          for (const resolver of joinResolvers) {\n            attached = this.applyOneJoinStreaming(attached, resolver)\n          }\n          if (postJoin.length > 0 && !this.recordMatches(attached as T, postJoin)) continue\n          yield attached as T\n        }\n      }\n      if (page.nextCursor === null) return\n      page = await this.pageProvider.listPage({\n        cursor: page.nextCursor,\n        limit: this.pageSize,\n      })\n    }\n  }\n\n  /**\n   * Evaluate the clause list against a single record. Linear in\n   * the clause count; short-circuits on first false. Clauses on a\n   * scan are always re-evaluated per record — no index-accelerated\n   * path, because the stream sources records from the adapter\n   * paginator, not from the in-memory cache where indexes live.\n   */\n  private recordMatches(record: T, clauses: readonly Clause[] = this.clauses): boolean {\n    if (clauses.length === 0) return true\n    // User-callback clauses (filter) see the DECODED view (e.g. money's\n    // canonical decimal); field clauses keep the raw record — their\n    // operands are pre-built into stored space. Decoded at most once per\n    // record, only when a callback clause exists.\n    const fnView =\n      this.via?.hasResultDecode && hasFnClause(clauses)\n        ? this.decodeVia(record)\n        : undefined\n    for (const clause of clauses) {\n      if (!evaluateClause(record, clause, fnView)) return false\n    }\n    return true\n  }\n}\n\n// ─── #1458 — ScanBuilder's extension stubs ────────────────────────────────\n// Same mechanism, and the same reason for not declaring them on the class, as\n// `builder.ts`'s block: the method's TYPE must arrive with its subpath.\nconst SCAN_EXTENSION_METHODS: readonly (readonly [string, string])[] = [\n  ['aggregate', '@noy-db/hub/query/reduce'],\n  ['groupBy', '@noy-db/hub/query/reduce'],\n  ['join', '@noy-db/hub/query/relate'],\n]\n\nfor (const [method, subpath] of SCAN_EXTENSION_METHODS) {\n  Object.defineProperty(ScanBuilder.prototype, method, {\n    value: function scanExtensionMissing(): never {\n      throw new QueryExtensionMissingError(`scan().${method}`, subpath)\n    },\n    writable: true,\n    enumerable: false,\n    configurable: true,\n  })\n}\n\n\n/**\n * ── Grouped streaming reduction over a `scan()` — `#1340` ──────────────────\n *\n * `scan().groupBy(key, { maxGroups }).aggregate(spec)` folds an unbounded,\n * page-by-page scan into one row per group. The distinguishing property\n * against the eager `Query.groupBy()` path is WHAT IS HELD:\n *\n *   - eager (`groupAndReduce` in `with-lookup/reduce/groupby.ts`) partitions\n *     the matched records into `Map<key, records[]>` and reduces each bucket\n *     afterwards — O(matched records) memory;\n *   - this one holds **one reducer state per group and no records at all** —\n *     O(groups × state), with the left side still streaming at O(pageSize).\n *\n * So the two cannot share an implementation, and this deliberately does\n * NOT use `groupAndReduce`: reusing it would mean collecting the stream,\n * which is the exact thing `scan()` exists to avoid. What IS shared is every\n * piece that decides SEMANTICS — the group-key canonicalisation (so `null`\n * and `undefined` bucket apart here exactly as they do there), the reducer\n * protocol, `ViaPipeline.wrapReducers` (money stays BigInt-exact),\n * `bindDistinctReducers` (`countDistinct` dedups on the canonical index key),\n * and `projectDateTruncKeys` (a derived calendar key is stamped onto a\n * shallow copy of the row before bucketing, same as `Query.groupBy()`).\n *\n * ## The memory budget IS the feature\n *\n * `maxGroups` defaults to `GROUPBY_MAX_CARDINALITY` (100_000) — the same\n * ceiling the eager path enforces — and is refused the moment the group that\n * would exceed it is first seen, mid-stream, before its state is allocated.\n * ⛔ It never truncates: a truncated rollup is a WRONG ANSWER that looks like\n * a right one, and the whole point of declaring a budget is to learn that the\n * grouping does not fit. The refusal names the option and the observed count.\n *\n * ⚠️ **Per-group state is NOT constant.** `count`/`sum`/`avg`/`min`/`max` are\n * O(1) per group, but `median`/`percentile` (exact) hold every sampled value\n * — O(n) per group — `mode` holds one entry per distinct value, and\n * `countDistinct` one per distinct value. A grouped scan with an exact\n * `median` is therefore O(matched records) overall no matter what `maxGroups`\n * says, since the values live in the group states. Pair it with\n * `{ approx: true }` (the t-digest, bounded per group) when the scan is\n * genuinely unbounded — that is what makes `maxGroups` a real ceiling rather\n * than an accounting fiction.\n *\n * ## Post-group `having` / `orderBy` / `limit` (#1336) are NOT on this path\n *\n * Those live on `GroupedReduction`, which is built around a SYNCHRONOUS\n * `executeRecords()` closure and the eager pipeline; a scan has neither.\n * Rather than grow a second, subtly different implementation of the same\n * three operations, this terminal returns the row array — bounded by\n * `maxGroups` and already in memory — and the caller filters, sorts and\n * slices it. See the report on #1340; if a consumer wants the chainable\n * shape, the honest fix is to lift the post-group stage out of\n * `GroupedReduction` and share it, not to copy it here.\n *\n * ⚠️ Lives in THIS file rather than its own `scan-groupby.ts` for one\n * mechanical reason: `check-architecture`'s `port-layering` ratchet\n * grandfathers `scan-builder.ts`'s two `with-lookup/reduce/*` imports per\n * specifier, and a NEW kernel file may not statically import a `with-*`\n * service at all. Splitting it out means either a dynamic import on the\n * reducer protocol or a new grandfather entry; neither is worth it for a\n * class that only exists to terminate `ScanBuilder.groupBy()`.\n */\n"],"mappings":";;;;;;;;;;;;;;;AAiGA,IAAM,yBAAyB;AAYxB,IAAM,cAAN,MAAM,aAA0G;AAAA,EACpG;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA,EAYjB,YACE,cACA,WAAmB,wBACnB,UAA6B,CAAC,GAC9B,QAA4B,CAAC,GAC7B,aACA,KACA;AACA,SAAK,eAAe;AACpB,SAAK,WAAW;AAChB,SAAK,UAAU;AACf,SAAK,QAAQ;AACb,SAAK,cAAc;AACnB,SAAK,MAAM;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,UAAU,QAAc;AAC9B,QAAI,CAAC,KAAK,OAAO,CAAC,KAAK,IAAI,gBAAiB,QAAO;AACnD,WAAO,KAAK,IAAI,cAAc,MAAM;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,MAAM,OAAyB,IAAc,OAAsC;AAGjF,UAAM,MAAM,KAAK;AACjB,QAAI,KAAK,WAAW,KAAe,GAAG,cAAc,OAAQ,OAAM,IAAI,uBAAuB,KAAe;AAQ5G,UAAM,EAAE,IAAI,KAAK,OAAO,MAAM,SAAS,IAAI,yBAAyB,IAAI,KAAK;AAC7E,UAAM,EAAE,IAAI,KAAK,OAAO,KAAK,IAAI,iBAAiB,KAAK,IAAI;AAC3D,UAAM,YAAY,KAAK,YAAY,OAAiB,KAAK,IAAI;AAC7D,UAAM,SAAsB,YACxB;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MAC/B,KAAK;AAAA,QACH,OAAO,UAAU;AAAA,QACjB,SAAS,UAAU;AAAA,QACnB,UAAU,CAAC,QAAiB,WAAmB,IAAK,eAAe,WAAW,QAAQ,MAAM;AAAA,MAC9F;AAAA,IACF,IACA,EAAE,MAAM,SAAS,OAAwB,IAAI,KAAK,OAAO,MAAM,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC,EAAG;AACrG,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AAAA,MACL,CAAC,GAAG,KAAK,SAAS,MAAM;AAAA,MACxB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,IAAkD;AACvD,UAAM,SAAiB;AAAA,MACrB,MAAM;AAAA,MACN;AAAA,IACF;AACA,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AAAA,MACL,CAAC,GAAG,KAAK,SAAS,MAAM;AAAA,MACxB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAAA,EACF;AAAA,EAEA,QAAQ,OAAO,aAAa,IAAsB;AAWhD,UAAM,gBAAgB,KAAK,MAAM,WAAW,IAAI,OAAO,KAAK,mBAAmB;AAM/E,UAAM,EAAE,SAAS,SAAS,IAAI,iBAAiB,KAAK,SAAS,KAAK,KAAK;AAEvE,QAAI,OAAO,MAAM,KAAK,aAAa,SAAS,EAAE,OAAO,KAAK,SAAS,CAAC;AACpE,WAAO,MAAM;AACX,iBAAW,UAAU,KAAK,OAAO;AAK/B,YAAI,CAAC,KAAK,cAAc,QAAQ,OAAO,EAAG;AAC1C,cAAM,UAAU,KAAK,UAAU,MAAM;AACrC,YAAI,kBAAkB,MAAM;AAC1B,gBAAM;AAAA,QACR,OAAO;AAKL,cAAI,WAAoB;AACxB,qBAAW,YAAY,eAAe;AACpC,uBAAW,KAAK,sBAAsB,UAAU,QAAQ;AAAA,UAC1D;AACA,cAAI,SAAS,SAAS,KAAK,CAAC,KAAK,cAAc,UAAe,QAAQ,EAAG;AACzE,gBAAM;AAAA,QACR;AAAA,MACF;AACA,UAAI,KAAK,eAAe,KAAM;AAC9B,aAAO,MAAM,KAAK,aAAa,SAAS;AAAA,QACtC,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,cAAc,QAAW,UAA6B,KAAK,SAAkB;AACnF,QAAI,QAAQ,WAAW,EAAG,QAAO;AAKjC,UAAM,SACJ,KAAK,KAAK,mBAAmB,YAAY,OAAO,IAC5C,KAAK,UAAU,MAAM,IACrB;AACN,eAAW,UAAU,SAAS;AAC5B,UAAI,CAAC,eAAe,QAAQ,QAAQ,MAAM,EAAG,QAAO;AAAA,IACtD;AACA,WAAO;AAAA,EACT;AACF;AAKA,IAAM,yBAAiE;AAAA,EACrE,CAAC,aAAa,0BAA0B;AAAA,EACxC,CAAC,WAAW,0BAA0B;AAAA,EACtC,CAAC,QAAQ,0BAA0B;AACrC;AAEA,WAAW,CAAC,QAAQ,OAAO,KAAK,wBAAwB;AACtD,SAAO,eAAe,YAAY,WAAW,QAAQ;AAAA,IACnD,OAAO,SAAS,uBAA8B;AAC5C,YAAM,IAAI,2BAA2B,UAAU,MAAM,IAAI,OAAO;AAAA,IAClE;AAAA,IACA,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,cAAc;AAAA,EAChB,CAAC;AACH;","names":[]}

package/dist/{chunk-7APJ6CO6.js → chunk-JSMTXZR3.js}

@@ -1,22 +1,21 @@
 import {
   BLOB_CHUNKS_COLLECTION,
+  BLOB_COLLECTION,
   BLOB_INDEX_COLLECTION
-} from "./chunk-HIWCKBEY.js";
+} from "./chunk-G2MVBDFP.js";
 import {
   installViaBinder
-} from "./chunk-UXVWEX5L.js";
+} from "./chunk-SYNY3VB5.js";
 import {
-  buildRecordAad
-} from "./chunk-4ZS56W5S.js";
-import {
-  buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
-import {
-  encrypt
-} from "./chunk-HPVZCW43.js";
+  buildRecordAad,
+  buildRecordEnvelope,
+  encrypt,
+  openEnvelopeJson
+} from "./chunk-EZGV6F47.js";
 import {
+  TamperedError,
   ValidationError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/via/blob/binding.ts
 async function eraseBlobs(ctx, cfg) {
@@ -48,6 +47,8 @@ function blobVia(cfg) {
     // vault.forget().
     posture: { encryptedAtRest: "envelope", queryable: "none", exportable: true, forgettable: true },
     covers: (field) => field in cfg.fields,
+    coveredFields: Object.keys(cfg.fields),
+    // #1447
     erase: (ctx) => eraseBlobs(ctx, cfg),
     describeFragment: () => buildBlobDescribeFragment(cfg.fields)
   };
@@ -211,6 +212,35 @@ async function reportOrphanBlobChunks(adapter, vault) {
   };
 }
 
+// src/with-shape/blobs/legacy-sweep.ts
+async function sweepUnreferencedLegacyBlobs(ctx, reclaim) {
+  let blobs = 0, chunks = 0, reclaimed = 0;
+  const eTags = await ctx.adapter.list(ctx.vault, BLOB_INDEX_COLLECTION);
+  const dek = ctx.encrypted ? await ctx.getDEK(BLOB_COLLECTION) : null;
+  for (const eTag of eTags) {
+    const env = await ctx.adapter.get(ctx.vault, BLOB_INDEX_COLLECTION, eTag);
+    if (!env) continue;
+    let blob;
+    try {
+      const json = dek ? await openEnvelopeJson({ collection: BLOB_INDEX_COLLECTION, id: eTag }, env, dek) : env._data ?? "";
+      blob = JSON.parse(json);
+    } catch (err) {
+      if (err instanceof TamperedError) continue;
+      throw err;
+    }
+    if (Object.hasOwn(blob, "_cek") || blob.refCount > 0) continue;
+    blobs += 1;
+    chunks += blob.chunkCount;
+    if (!reclaim) continue;
+    for (let i = 0; i < blob.chunkCount; i++) {
+      await ctx.adapter.delete(ctx.vault, BLOB_CHUNKS_COLLECTION, `${eTag}_${i}`);
+    }
+    await ctx.adapter.delete(ctx.vault, BLOB_INDEX_COLLECTION, eTag);
+    reclaimed += 1;
+  }
+  return { blobs, chunks, reclaimed };
+}
+
 // src/with-shape/blobs/blob-compaction.ts
 var BLOB_EVICTION_AUDIT_COLLECTION = "_blob_eviction_audit";
 async function runCompaction(ctx, options = {}) {
@@ -218,6 +248,7 @@ async function runCompaction(ctx, options = {}) {
   const now = options.now ?? /* @__PURE__ */ new Date();
   const maxEvictions = options.maxEvictions ?? Infinity;
   const dryRun = options.dryRun === true;
+  const unreferencedLegacyBlobs = await sweepUnreferencedLegacyBlobs(ctx, options.reclaimLegacyBlobs === true && !dryRun);
   if (options.cacheBudget !== void 0 && (!Number.isFinite(options.cacheBudget.maxBytes) || options.cacheBudget.maxBytes < 0)) {
     throw new ValidationError("compact(): cacheBudget.maxBytes must be a non-negative finite number (#808)");
   }
@@ -300,7 +331,8 @@ async function runCompaction(ctx, options = {}) {
     budgetEvicted,
     budgetBytesFreed,
     byCollection,
-    orphanBlobChunks
+    orphanBlobChunks,
+    unreferencedLegacyBlobs
   };
 }
 async function runBudgetPass(ctx, maxBytes, opts) {
@@ -438,4 +470,4 @@ export {
   BLOB_EVICTION_AUDIT_COLLECTION,
   runCompaction
 };
-//# sourceMappingURL=chunk-7APJ6CO6.js.map
+//# sourceMappingURL=chunk-JSMTXZR3.js.map

package/dist/chunk-JSMTXZR3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/via/blob/binding.ts","../src/port/with/blob-strategy.ts","../src/with-shape/blobs/export-blobs.ts","../src/with-shape/blobs/orphan-report.ts","../src/with-shape/blobs/legacy-sweep.ts","../src/with-shape/blobs/blob-compaction.ts"],"sourcesContent":["/**\n * The blob `NoydbVia` (#629 Task 7) — wires the `blobFields` declaration\n * into the kernel's generic Via port as a deliberately THIN binding:\n * declaration + posture + `describeFragment` + `erase` glue, and nothing\n * else. Blob content is fully out-of-band (`collection.blob(id)` →\n * `BlobSet` writing `_blob_*` side-collections; it never touches\n * `_putInternal` or the record codec), so this binding declares **no\n * write/read pipeline hooks** — in particular no `encodeAtRest`/\n * `decodeAtRest`: a blobFields collection must not flip the pipeline's\n * `hasAtRestHooks`, or the codec would abandon its inline seal path for a\n * feature that never seals record fields. The routing/compaction/TTL/\n * legal-hold/exportBlobs machinery stays service-side in\n * `with-shape/blobs/` (the i18n-dictionary precedent — that machinery\n * does real chunk AEAD + key-lifecycle work `via-enclave-isolation`\n * forbids under `via/*`).\n *\n * Like classified (see `port/with/classified-strategy.ts`), the link is\n * EAGER — `port/with/blob-strategy.ts` calls {@link linkBlobVia} at module\n * load. `blobFields` policies are plain object literals (there is no\n * `blob.*()` declaration factory to hang a lazy link on), so the binder\n * must be installed before `compileVias` ever sees one.\n *\n * There is no `declare`-time validation: `blobFields` has never had a\n * construction-time refusal matrix (policies are consulted lazily by\n * `vault.compact()` and `BlobSet.put`), and inventing one here would\n * break the behavior lock.\n *\n * `covers` (#629 Task 8) is a passive coverage predicate, not a pipeline\n * hook — it lets `ViaPipeline.postureFor` recognize a `blobFields` slot so\n * `.where()`/`.orderBy()`/`.aggregate()` can refuse it (posture\n * `queryable: 'none'`); it does not participate in clause building or\n * evaluation.\n */\nimport type { NoydbVia, ViaEraseCtx, ViaEraseReport } from '../../kernel/via/index.js'\nimport { installViaBinder } from '../../kernel/via/index.js'\nimport type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js'\n\n/**\n * Config a blob collection's `blobFields` declaration resolves to — the\n * binding's construction input. `purgeBlobsForRecord` is an OPTIONAL\n * vault/service-provided closure for the `erase` hook, mapping\n * `collection.blob(id).shredAllForRecord()`'s `{shredded, retainedShared,\n * residue}: string[]` accounting onto `ViaEraseReport` — `shredded`/\n * `retainedShared` become counts, each residue eTag becomes a tagged\n * `{kind: 'blob-residue', eTag}` entry.\n *\n * DELIBERATELY left unwired by `compileVias` (#629 Task 10, resolved\n * within parity-first — see task-10-report.md \"blob purge\" section):\n * `per-blob-cek.test.ts`/`forget.test.ts` prove blob-shred-on-forget is\n * gated SOLELY on the vault's `blobsStrategy` being configured, never on a\n * given collection's OWN `blobFields` declaration (`.blob(id)` is callable,\n * and IS exercised by those tests, on collections with no `blobFields` at\n * all). Routing it exclusively through this binding would silently stop\n * blob crypto-shredding for every such collection; `vault.forget()` keeps\n * calling `collection.blob(id).shredAllForRecord()` directly for that\n * reason. The hook stays real/tested (see `blob-binding.test.ts`) for a\n * future caller that wants it.\n */\nexport interface BlobViaConfig {\n  readonly fields: BlobFieldsConfig\n  readonly collectionName: string\n  /** Purge one record's blob slots (crypto-shred participation). Returns the erase report for `forget()`'s summary. */\n  readonly purgeBlobsForRecord?: (id: string) => Promise<ViaEraseReport>\n}\n\n/**\n * `forget()`'s per-ref blob-purge participation: delegate to the wired\n * closure, or report a clean zero-shredded, zero-residue no-op — the\n * default in production too (#629 Task 10 deliberately leaves this unwired;\n * see `BlobViaConfig`'s doc comment).\n */\nasync function eraseBlobs(ctx: ViaEraseCtx, cfg: BlobViaConfig): Promise<ViaEraseReport> {\n  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id)\n  return { shredded: 0, residue: [] }\n}\n\n/**\n * One field's blob knobs as they appear on `describeFragment()`'s payload\n * (#657 — the second real `NoydbVia.describeFragment` consumer after\n * `lookup`'s; see `with-shape/introspection/describe.ts`'s `buildDescription`).\n * Declarative scalars (`retainDays`/`external`/`public`/`backlink`) verbatim;\n * predicate knobs (`evictWhen`/`legalHold`/`retainUntil` — functions over the\n * decrypted record) as presence flags, since a predicate has no serializable\n * form — mirrors `buildBlobDescribeFragment`'s per-field shape below.\n */\nexport interface BlobDescribeFragmentEntry {\n  readonly retainDays?: number\n  readonly evictWhen?: true\n  readonly legalHold?: true\n  readonly retainUntil?: true\n  readonly external?: true\n  readonly public?: true\n  readonly backlink?: string\n}\n\n/** The `'blob'` binding's `describeFragment()` payload shape. */\nexport interface BlobDescribeFragment {\n  readonly blobFields: Record<string, BlobDescribeFragmentEntry>\n}\n\n/**\n * `{ blobFields: { <field>: <knobs> } }` — declarative scalars\n * (`retainDays`/`external`/`public`/`backlink`) verbatim; predicate knobs\n * (`evictWhen`/`legalHold`/`retainUntil` — functions over the decrypted\n * record) as presence flags, since a predicate has no serializable form.\n */\nfunction buildBlobDescribeFragment(fields: BlobFieldsConfig): Record<string, unknown> {\n  return {\n    blobFields: Object.fromEntries(\n      Object.entries(fields).map(([field, p]) => [field, {\n        ...(p.retainDays !== undefined ? { retainDays: p.retainDays } : {}),\n        ...(p.evictWhen !== undefined ? { evictWhen: true } : {}),\n        ...(p.legalHold !== undefined ? { legalHold: true } : {}),\n        ...(p.retainUntil !== undefined ? { retainUntil: true } : {}),\n        ...(p.external === true ? { external: true } : {}),\n        ...(p.public === true ? { public: true } : {}),\n        ...(p.backlink !== undefined ? { backlink: p.backlink } : {}),\n      }]),\n    ),\n  }\n}\n\nexport function blobVia(cfg: BlobViaConfig): NoydbVia {\n  return {\n    brand: 'blob',\n    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes\n    // in `_blob_chunks` (service-side), not sealed record fields; queryable:\n    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()\n    // is a first-class door; forgettable — shredAllForRecord participates in\n    // vault.forget().\n    posture: { encryptedAtRest: 'envelope', queryable: 'none', exportable: true, forgettable: true },\n    covers: (field) => field in cfg.fields,\n    coveredFields: Object.keys(cfg.fields), // #1447\n    erase: (ctx) => eraseBlobs(ctx, cfg),\n    describeFragment: () => buildBlobDescribeFragment(cfg.fields),\n  }\n}\n\nexport function linkBlobVia(): void {\n  installViaBinder('blob', (c) => blobVia(c as BlobViaConfig))\n}\n","/**\n * Strategy seam between core Collection and the optional blob service\n * (#629 Task 7 — moved out of `with-shape/blobs/strategy.ts`, precedent:\n * `port/with/classified-strategy.ts`/`i18n-strategy.ts`). Lives on the\n * `/with` port (the one seam the kernel spine may import statically) so\n * `Collection`/`Vault` can hold the `NO_BLOBS` default without a\n * spine→service static import.\n *\n * Core imports `BlobsStrategy` as a TYPE-ONLY symbol and `NO_BLOBS` as a\n * minimal runtime stub. Neither pulls in the heavy `BlobSet` / chunk /\n * MIME machinery — those only arrive when the consumer explicitly\n * imports `@noy-db/hub/blobs` (see `via/blob/index.ts` →\n * `withBlobs()` factory).\n *\n * This file is intentionally tiny so the bundler keeps it in the graph\n * without dragging everything else in.\n *\n * @internal\n */\n\nimport type { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { ObjectProjection } from '../../with-shape/blobs/object-projection.js'\nimport type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport type { BlobCacheStats } from '../../with-shape/blobs/blob-pinning.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { linkBlobVia } from '../../via/blob/binding.js'\n\n// Install the blob Via binder EAGERLY (#629 Task 7) — `blobFields` policies\n// are plain object literals (there is no `blob.*()` declaration factory to\n// hang a lazy money/i18n-style link on), so the binder must be installed\n// before `compileVias` ever compiles one. This port module is\n// already unconditionally imported by the kernel spine (for the `NO_BLOBS`\n// strategy default below), so linking here guarantees it — same rationale\n// as `port/with/classified-strategy.ts`'s eager `linkClassifiedVia()`. The\n// binding module is hook-free glue (declare/describe/erase) and imports no\n// machinery, so the eager cost is a few hundred bytes, not `BlobSet`.\nlinkBlobVia()\n\n/**\n * Args forwarded by `Collection.blob(id)` to the active strategy's\n * `openSlot`. The strategy is responsible for returning a live\n * `BlobSet` bound to the given record.\n *\n * @internal\n */\nexport interface BlobsStrategyOpenArgs {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collection: string\n  readonly recordId: string\n  readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  readonly encrypted: boolean\n  readonly userId: string\n  /**\n   * Collection opts into per-record keys (`perRecordKeys`), so its blobs are\n   * erasable: new uploads mint a per-blob content CEK (crypto-shreddable at\n   * `refCount → 0`). Off → legacy shared-`_blob`-DEK chunks. See the per-blob\n   * CEK design spec.\n   */\n  readonly erasableBlobs?: boolean\n  /**\n   * #1452 — refuse a content-changing blob verb (`put`/`delete`/`publish`/\n   * `deleteVersion`/`adoptExternal`) when the OWNING RECORD is not writable:\n   * the collection runs its `beforePut` gate bus (closed periods, record\n   * guards) with `incoming = existing`, so an attachment change is gated\n   * exactly as an update of the record would be. Absent → ungated (direct\n   * `BlobSet` construction in tests).\n   */\n  readonly assertOwnerWritable?: () => Promise<void>\n  /**\n   * Collection has `tiers` active (#724 I1 completion). Combined with\n   * `erasableBlobs` false, a content write is refused —\n   * `UnsupportedTierCompositionError` — since a legacy blob has no\n   * per-blob `_cek` and can never be tier-isolated on elevate/demote.\n   */\n  readonly tiersActive?: boolean\n  /**\n   * Vault is in debug-plaintext mode (`encrypt: false` + `debugPlaintext: true`).\n   * Blobs are then written as a single un-gzipped object (one base64 chunk) so\n   * the stored object is directly recoverable with native tools (`base64 -d`),\n   * matching the directly-inspectable record layout. Dev-only — see the\n   * plaintext/debug-store-mode design.\n   */\n  readonly debugPlaintext?: boolean\n  /**\n   * Object projection for `external` blob fields (`createNoydb({ objectStore })`).\n   * When present, fields declared `external` in `blobFields` route their raw\n   * bytes here instead of the encrypted-chunk path.\n   */\n  readonly objectStore?: ObjectProjection\n  /** Per-collection blob field policies — used to resolve `external` / `public`. */\n  readonly blobFields?: BlobFieldsConfig\n  /**\n   * The caller's unlocked keyring (#749). Threaded through so `BlobSet.atTier()`\n   * can run `assertTierAccess` — the SAME clearance gate `putAtTier`/`elevate`/\n   * `demote` run before any tier `getDEK` call — rather than relying on a bare\n   * `getDEK`, which auto-mints a DEK for ANY role and never throws (verified: it\n   * is not itself a gate). Omitted only by a construction path that never calls\n   * `atTier()`.\n   */\n  readonly keyring?: UnlockedKeyring\n}\n\n/**\n * The seam interface. `@internal` — do not build public APIs on this\n * shape; it can evolve freely until blobs are extracted into their\n * own package, at which point it will be promoted to public.\n *\n * @internal\n */\nexport interface BlobsStrategy {\n  openSlot(args: BlobsStrategyOpenArgs): BlobSet\n  /**\n   * Snapshot of this device's blob-cache KPI counters: local-read hits,\n   * network misses, and total bytes downloaded from the object store (#808).\n   *\n   * Lives on the seam rather than on the `withBlobs()` return type so the\n   * service has exactly one name (#844b) — `NO_BLOBS` answers with zeros,\n   * which is the truthful reading of \"blobs were never enabled\".\n   */\n  cacheStats(): BlobCacheStats\n}\n\n/**\n * Default strategy for collections that did not opt into blob storage.\n * Every operation surfaces an actionable error that points the caller\n * at the opt-in path.\n *\n * @internal\n */\nexport const NO_BLOBS: BlobsStrategy = {\n  openSlot() {\n    throw new Error(\n      'Blob storage is not enabled on this Noydb instance. ' +\n      'Import `{ withBlobs }` from \"@noy-db/hub/blobs\" and pass `withBlobs()` to `createNoydb({ blobsStrategy: withBlobs() })`.',\n    )\n  },\n  cacheStats() {\n    return { hits: 0, misses: 0, bytesDownloaded: 0 }\n  },\n}\n","/**\n * `vault.exportBlobs()` — bulk blob extraction primitive.\n *\n * Async-iterable handle over every blob attached to records in a\n * vault, optionally filtered by collection allowlist and per-record\n * predicate. Emits tuples of `{ blobId, recordRef, bytes, meta }` so\n * the consumer can pipe into any sink (zip stream, S3 multipart, USB\n * copy, cold-storage tape) without pulling the whole export into\n * memory.\n *\n * ## Auth + audit\n *\n * - Capability check runs **once** at handle creation via\n *   `Vault.assertCanExport('plaintext', 'blob')`. An operator whose\n *   keyring lacks that bit fails before a single byte of ciphertext\n *   is decrypted.\n * - Audit entry lands in `_export_audit` at handle creation: the\n *   actor, start timestamp, target collections, predicate presence,\n *   and batch mechanism. **No content hashes** — per the spec\n *   non-correlation invariant.\n *\n * ## Abort + resume\n *\n * - `handle.abort()` flips the internal signal; the next iteration\n *   boundary throws `AbortError`. Consumers already in `for await`\n *   can catch and exit cleanly.\n * - Restart after a partial failure with `{ afterBlobId }` — the\n *   iterator skips tuples up to (and including) that blob id before\n *   yielding again. Combined with a blob-count ceiling it supports\n *   idempotent batch re-runs.\n *\n * @module\n */\n\nimport type { Collection } from '../../kernel/collection.js'\nimport type { SlotInfo } from '../../kernel/types.js'\n\n// ─── Types ──────────────────────────────────────────────────────────────\n\nexport interface ExportBlobsOptions {\n  /**\n   * Collection allowlist. Omit to export blobs from every collection\n   * the caller has read access to.\n   */\n  readonly collections?: readonly string[]\n  /**\n   * Per-record predicate. Called on the decrypted record BEFORE any\n   * blob bytes are read for that record — returning false skips the\n   * record and all its slots without touching their chunks.\n   */\n  readonly where?: (record: unknown, context: { collection: string; id: string }) => boolean\n  /**\n   * Resume after a specific blob id. The iterator skips tuples up to\n   * and including this id, then yields. Format of the id is the same\n   * as `ExportedBlob.blobId` (the HMAC-keyed eTag).\n   */\n  readonly afterBlobId?: string\n  /**\n   * External abort signal. When fired, the next iterator tick throws\n   * `ExportBlobsAbortedError`. Honored alongside `handle.abort()`.\n   */\n  readonly signal?: AbortSignal\n}\n\nexport interface ExportedBlob {\n  /** Opaque blob identifier — HMAC-keyed eTag, stable across vaults. */\n  readonly blobId: string\n  /** Where this blob came from in the vault. */\n  readonly recordRef: {\n    readonly collection: string\n    readonly id: string\n    readonly slot: string\n  }\n  /** Decrypted plaintext bytes. */\n  readonly bytes: Uint8Array\n  /** Best-effort metadata (from the blob slot record). */\n  readonly meta: {\n    readonly size: number\n    /**\n     * User-visible filename stored on the slot. Often equal to the\n     * slot name; differs when the caller supplied an explicit\n     * `filename` to `BlobSet.put()`.\n     */\n    readonly filename: string\n    readonly mimeType?: string\n    readonly createdAt?: string\n  }\n}\n\nexport interface ExportBlobsHandle extends AsyncIterable<ExportedBlob> {\n  /** Abort the export. Safe to call multiple times. */\n  abort(): void\n  /** True once `abort()` has fired or the external signal aborted. */\n  readonly aborted: boolean\n}\n\nexport class ExportBlobsAbortedError extends Error {\n  constructor(reason: string) {\n    super(`exportBlobs aborted: ${reason}`)\n    this.name = 'ExportBlobsAbortedError'\n  }\n}\n\n// ─── Audit ──────────────────────────────────────────────────────────────\n\nexport const EXPORT_AUDIT_COLLECTION = '_export_audit'\n\nexport interface ExportBlobsAuditEntry {\n  readonly id: string\n  readonly mechanism: 'exportBlobs'\n  readonly actor: string\n  readonly startedAt: string\n  readonly collections: readonly string[] | null\n  readonly predicate: boolean\n  readonly afterBlobId: string | null\n}\n\n// ─── Implementation ─────────────────────────────────────────────────────\n\n/**\n * Build the handle. Factored out of `Vault.exportBlobs` so the\n * implementation can be unit-tested without going through the\n * compartment lifecycle.\n */\nexport function createExportBlobsHandle(\n  actor: string,\n  listAccessibleCollections: () => Promise<string[]>,\n  getCollection: <T>(name: string) => Collection<T>,\n  writeAudit: (entry: ExportBlobsAuditEntry) => Promise<void>,\n  options: ExportBlobsOptions,\n): ExportBlobsHandle {\n  let aborted = false\n\n  const abort = (): void => {\n    aborted = true\n  }\n\n  if (options.signal) {\n    if (options.signal.aborted) aborted = true\n    options.signal.addEventListener('abort', () => { aborted = true })\n  }\n\n  function assertLive(): void {\n    if (aborted) throw new ExportBlobsAbortedError('aborted by caller')\n  }\n\n  const allowlist = options.collections ? new Set(options.collections) : null\n\n  // Write the audit entry BEFORE the first yield so a blocked\n  // iteration still leaves an audit trail that the export started.\n  let auditPromise: Promise<void> | null = null\n  function writeAuditOnce(): Promise<void> {\n    if (!auditPromise) {\n      auditPromise = writeAudit({\n        id: generateBatchId(),\n        mechanism: 'exportBlobs',\n        actor,\n        startedAt: new Date().toISOString(),\n        collections: options.collections ?? null,\n        predicate: Boolean(options.where),\n        afterBlobId: options.afterBlobId ?? null,\n      })\n    }\n    return auditPromise\n  }\n\n  async function* generate(): AsyncGenerator<ExportedBlob> {\n    await writeAuditOnce()\n    assertLive()\n\n    // Resolve target collections lazily — also keeps the call async.\n    const allCollections = await listAccessibleCollections()\n    const targets = allCollections.filter(name => {\n      if (name.startsWith('_')) return false\n      if (allowlist && !allowlist.has(name)) return false\n      return true\n    })\n\n    let resumeCursorHit = options.afterBlobId === undefined\n\n    for (const collectionName of targets) {\n      if (aborted) return\n\n      const coll = getCollection<Record<string, unknown>>(collectionName)\n      const records = await coll.list().catch(() => [])\n      for (const record of records) {\n        if (aborted) return\n        assertLive()\n\n        const idField = (record as { id?: unknown }).id\n        if (typeof idField !== 'string') continue\n\n        if (options.where && !options.where(record, { collection: collectionName, id: idField })) continue\n\n        const blobSet = coll.blob(idField)\n        const slots = await blobSet.list().catch(() => [] as SlotInfo[])\n        for (const slot of slots) {\n          if (aborted) return\n\n          if (!resumeCursorHit) {\n            if (slot.eTag === options.afterBlobId) {\n              resumeCursorHit = true\n            }\n            continue\n          }\n\n          const bytes = await blobSet.get(slot.name)\n          if (!bytes) continue\n\n          const item: ExportedBlob = {\n            blobId: slot.eTag,\n            recordRef: { collection: collectionName, id: idField, slot: slot.name },\n            bytes,\n            meta: {\n              size: slot.size,\n              filename: slot.filename,\n              ...(slot.mimeType !== undefined && { mimeType: slot.mimeType }),\n              ...(slot.uploadedAt !== undefined && { createdAt: slot.uploadedAt }),\n            },\n          }\n          yield item\n        }\n      }\n    }\n  }\n\n  const handle: ExportBlobsHandle = {\n    abort,\n    get aborted() { return aborted },\n    [Symbol.asyncIterator]: () => generate(),\n  }\n  return handle\n}\n\n// ─── Helpers ────────────────────────────────────────────────────────────\n\nfunction generateBatchId(): string {\n  // 16 bytes of crypto randomness, URL-safe base64, no padding.\n  const raw = globalThis.crypto.getRandomValues(new Uint8Array(16))\n  let s = ''\n  for (const b of raw) s += b.toString(16).padStart(2, '0')\n  return `batch-${Date.now().toString(36)}-${s.slice(0, 12)}`\n}\n","/**\n * Orphan blob-chunk REPORT (#1133) — the read-only half of the residue #1127\n * stopped producing.\n *\n * Before #1127, `releaseRef` deleted a blob's index row BEFORE its chunks, so a\n * crash in between stranded chunk bodies nothing can ever reach: `loadBlobObject`\n * returns null so no reader addresses them, and `rekeyBlobSet` derives its chunk\n * ids from each index entry's `chunkCount` so a rotation never visits them. For a\n * LEGACY blob (bytes under the shared `_blob` DEK rather than a per-blob content\n * CEK) those bodies then stay openable under the retired DEK indefinitely.\n *\n * #1127 reversed the order, which removes the class at the source. It does\n * nothing for orphans created before the fix, and this module does not delete\n * them either. It counts them.\n *\n * ## Why this REPORTS and does not RECLAIM\n *\n * Deciding \"orphaned\" requires `store.list(_blob_index)`, and the store is\n * untrusted — that is the premise of the product, not a caveat on it. A store\n * that withholds a single index row makes a LIVE blob's chunks look orphaned. A\n * reclaim pass acting on that would convert **withholding**, which is reversible\n * the moment the store stops lying, into **permanent destruction** — handing an\n * untrusted store a data-loss primitive it does not currently have, in order to\n * tidy up residue.\n *\n * Reporting inverts the risk to something harmless: a lying store can only\n * inflate this count. Nothing is deleted on its word, so the worst outcome is an\n * operator investigating residue that turns out not to exist.\n *\n * Re-keying is not an alternative either: the chunk AAD is\n * `{eTag}:{chunkIndex}:{chunkCount}`, and `chunkCount` lives only in the index\n * row that is already gone — an orphan's AAD is unreconstructable, so it cannot\n * be decrypted-and-re-encrypted at all.\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { BLOB_INDEX_COLLECTION, BLOB_CHUNKS_COLLECTION } from './blob-set.js'\n\n/** How many distinct orphaned eTags to name in the report. */\nconst SAMPLE_LIMIT = 10\n\nexport interface OrphanChunkReport {\n  /** Chunk rows whose eTag has no `_blob_index` entry. */\n  readonly chunks: number\n  /** Distinct eTags those chunks belong to. */\n  readonly eTags: number\n  /**\n   * Up to {@link SAMPLE_LIMIT} of those eTags, so an operator can inspect a real\n   * one rather than only a count. Deterministic (store list order), not random.\n   */\n  readonly sampleETags: readonly string[]\n  /**\n   * Chunk ids that do not match the `{eTag}_{index}` grammar at all. Counted\n   * rather than skipped: an id this module cannot parse is a thing it cannot\n   * classify either way, and reporting zero orphans while silently dropping\n   * such ids would be the reassuring-but-wrong answer.\n   */\n  readonly unparseable: number\n}\n\n/**\n * Split a chunk id into `{eTag, index}`, or `null` if it does not fit the\n * grammar `BlobSet` writes (`${eTag}_${i}`).\n *\n * Splits on the LAST underscore and requires a digits-only suffix. eTags are\n * HMAC-SHA-256 hex today and contain no underscore, so a simpler split would\n * work — but it would break silently if that ever changed, and this rule holds\n * either way.\n */\nfunction parseChunkId(id: string): { eTag: string; index: number } | null {\n  const cut = id.lastIndexOf('_')\n  if (cut <= 0 || cut === id.length - 1) return null\n  const suffix = id.slice(cut + 1)\n  if (!/^\\d+$/.test(suffix)) return null\n  return { eTag: id.slice(0, cut), index: Number(suffix) }\n}\n\n/**\n * Count chunk rows with no surviving index row. Read-only: two `list` calls and\n * no `get`, no `delete`, and no decryption — an orphan cannot be opened anyway.\n *\n * A store that cannot list either collection yields an empty report rather than\n * throwing: this is a diagnostic riding along with a maintenance pass, and it\n * must not be able to fail one.\n */\nexport async function reportOrphanBlobChunks(\n  adapter: NoydbStore,\n  vault: string,\n): Promise<OrphanChunkReport> {\n  const empty: OrphanChunkReport = { chunks: 0, eTags: 0, sampleETags: [], unparseable: 0 }\n  let liveETags: Set<string>\n  let chunkIds: string[]\n  try {\n    liveETags = new Set(await adapter.list(vault, BLOB_INDEX_COLLECTION))\n    chunkIds = await adapter.list(vault, BLOB_CHUNKS_COLLECTION)\n  } catch {\n    return empty\n  }\n\n  let chunks = 0\n  let unparseable = 0\n  const orphanETags = new Set<string>()\n  for (const id of chunkIds) {\n    const parsed = parseChunkId(id)\n    if (parsed === null) { unparseable += 1; continue }\n    if (liveETags.has(parsed.eTag)) continue\n    chunks += 1\n    orphanETags.add(parsed.eTag)\n  }\n\n  return {\n    chunks,\n    eTags: orphanETags.size,\n    sampleETags: [...orphanETags].slice(0, SAMPLE_LIMIT),\n    unparseable,\n  }\n}\n","/**\n * #1453 — count, and optionally reclaim, legacy blobs nothing references.\n *\n * A legacy blob (no per-blob `_cek`) is left at refCount 0 \"for deferred GC\"\n * by `releaseRef`; before this the deferred GC had no verb outside\n * `forget()` (which needs `withForget`), and `orphanBlobChunks` could not see\n * these rows because they keep their index entry — so `vault.compact()`\n * reported clean over a vault whose blob storage grew on every overwrite.\n *\n * Reclaiming here is SAFE where reclaiming orphans is not (see\n * `orphan-report.ts`): the decision reads `refCount` off an AAD-bound index\n * row the hub decrypted itself, never the store's `list()`. A withholding\n * store cannot make a live blob look unreferenced; it can only hide a row from\n * this sweep, which then does nothing to it.\n *\n * Rows sealed at an elevated tier do not open under the flat `_blob` DEK and\n * are skipped, not counted: this is a tier-0 pass.\n */\nimport type { NoydbStore, BlobObject } from '../../kernel/types.js'\nimport { openEnvelopeJson, type EnclaveKey } from '../../capsule/index.js'\nimport { TamperedError } from '../../kernel/errors.js'\nimport { BLOB_COLLECTION, BLOB_INDEX_COLLECTION, BLOB_CHUNKS_COLLECTION } from './blob-set.js'\n\n/** What `vault.compact()` reports (and, on request, reclaims) about legacy blobs. */\nexport interface UnreferencedLegacyBlobReport {\n  /** `_blob_index` rows with no `_cek` (legacy) and `refCount <= 0`. */\n  readonly blobs: number\n  /** Chunk rows those blobs still hold. */\n  readonly chunks: number\n  /** How many of those blobs this run deleted (chunks first, then the index row). */\n  readonly reclaimed: number\n}\n\nexport async function sweepUnreferencedLegacyBlobs(\n  ctx: { adapter: NoydbStore; vault: string; getDEK: (name: string) => Promise<EnclaveKey>; encrypted: boolean },\n  reclaim: boolean,\n): Promise<UnreferencedLegacyBlobReport> {\n  let blobs = 0, chunks = 0, reclaimed = 0\n  const eTags = await ctx.adapter.list(ctx.vault, BLOB_INDEX_COLLECTION)\n  const dek = ctx.encrypted ? await ctx.getDEK(BLOB_COLLECTION) : null\n  for (const eTag of eTags) {\n    const env = await ctx.adapter.get(ctx.vault, BLOB_INDEX_COLLECTION, eTag)\n    if (!env) continue\n    let blob: BlobObject\n    try {\n      // `encrypt: false` stores the body as plaintext JSON; read it as the\n      // opaque string it is (no enclave field is interpreted here).\n      const json = dek ? await openEnvelopeJson({ collection: BLOB_INDEX_COLLECTION, id: eTag }, env, dek) : (env._data ?? '')\n      blob = JSON.parse(json) as BlobObject\n    } catch (err) {\n      if (err instanceof TamperedError) continue // elevated-tier row: not this pass's\n      throw err\n    }\n    // A BlobObject with a wrapped content key is erasable and shreds eagerly at\n    // refCount 0; only the key-less legacy shape ever lingers.\n    if (Object.hasOwn(blob, '_cek') || blob.refCount > 0) continue\n    blobs += 1\n    chunks += blob.chunkCount\n    if (!reclaim) continue\n    // CHUNKS BEFORE INDEX — same ordering rule as `deleteChunksThenIndex` (#1127).\n    for (let i = 0; i < blob.chunkCount; i++) {\n      await ctx.adapter.delete(ctx.vault, BLOB_CHUNKS_COLLECTION, `${eTag}_${i}`)\n    }\n    await ctx.adapter.delete(ctx.vault, BLOB_INDEX_COLLECTION, eTag)\n    reclaimed += 1\n  }\n  return { blobs, chunks, reclaimed }\n}\n","/**\n * Blob retention + compaction.\n *\n * Declarative per-collection / per-slot eviction policy. Two\n * triggers:\n *\n *   - **`retainDays`** — age-based TTL. A slot uploaded more than N\n *     days ago is evicted.\n *   - **`evictWhen(record)`** — predicate over the **decrypted**\n *     record. Lets consumers express \"the image is safe to drop once\n *     the structured invoice has been reviewed and confirmed.\"\n *\n * Either trigger (or both) causes the slot to evict. Eviction removes\n * the slot entry from `_blob_slots_{collection}`, decrements the\n * blob's refCount (so unreferenced chunks can be GC'd by the next\n * sweep), and writes one entry to the `_blob_eviction_audit`\n * collection for tamper-evident record-keeping.\n *\n * The audit entry carries the eTag of the evicted blob (opaque HMAC\n * of plaintext under the vault's `_blob` DEK) — no plaintext leakage,\n * per the SPEC non-correlation invariant. Consumers reconstructing\n * \"what used to be attached\" can look up the audit entry by record\n * id.\n *\n * Compaction is **consumer-scheduled** — noy-db never runs a\n * background daemon. Call `vault.compact()` whenever your workflow\n * allows (cron, manual \"tidy\" button, cold-storage export prep, …).\n *\n * @module\n */\n\nimport type { NoydbStore, EncryptedEnvelope, SlotInfo } from '../../kernel/types.js'\nimport { ValidationError } from '../../kernel/errors.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, type EnclaveKey } from '../../capsule/index.js'\nimport { reportOrphanBlobChunks, type OrphanChunkReport } from './orphan-report.js'\nimport { sweepUnreferencedLegacyBlobs, type UnreferencedLegacyBlobReport } from './legacy-sweep.js'\n\n// ─── Config types ───────────────────────────────────────────────────────\n\nexport interface BlobFieldPolicy<T = unknown> {\n  /**\n   * Via port brand marker — lets a `BlobFieldPolicy` satisfy the kernel's\n   * opaque `ViaDescriptor` (#629 Task 7). Optional (the\n   * `ClassifiedFieldSpec._viaBrand` precedent): `blobFields` policies are\n   * plain object literals with no declaration factory to stamp it, so a\n   * mandatory field would break every existing declaration.\n   */\n  readonly _viaBrand?: 'blob'\n  /**\n   * Age-based TTL in days. A slot whose `uploadedAt` is older than\n   * `now - retainDays × 86400s` evicts on the next `vault.compact()`.\n   * Omit to disable age-based eviction.\n   */\n  readonly retainDays?: number\n  /**\n   * Predicate evaluated against the decrypted record. When it returns\n   * `true`, every matching slot on that record evicts. Omit to\n   * disable predicate-based eviction.\n   */\n  readonly evictWhen?: (record: T) => boolean\n  /**\n   * **Legal hold.** When this predicate returns `true`, the slot is\n   * never evicted — `retainDays`/`evictWhen` are overridden. Use for a\n   * litigation / audit hold on a fiscal document: the blob stays until\n   * the predicate returns `false` (the hold is released). Fail-closed:\n   * if the predicate throws, the slot is treated as held.\n   */\n  readonly legalHold?: (record: T) => boolean\n  /**\n   * **Period-bound retention.** Returns the date (Date / ISO string /\n   * epoch ms) until which the slot must be retained — typically derived\n   * from the record's fiscal period (e.g. period end + 10 years). While\n   * `now < retainUntil`, the slot is never evicted, regardless of\n   * `retainDays`. Return `null`/`undefined` to impose no floor.\n   * Fail-closed: a throwing function holds the slot.\n   */\n  readonly retainUntil?: (record: T) => Date | string | number | null | undefined\n  /**\n   * **External projection.** When `true`, this field's bytes are stored in the\n   * vault's `ObjectProjection` (`createNoydb({ objectStore })`) as a single raw,\n   * **unencrypted** object — servable directly from S3/CDN and processable by\n   * native tooling — instead of the encrypted-chunk path. The encrypted slot\n   * record remains the catalog (anchoring invariant). Requires an `objectStore`;\n   * **outside the zero-knowledge guarantee** — use only for assets meant to\n   * leave the vault. See the as-aws-s3 design spec.\n   */\n  readonly external?: boolean\n  /**\n   * For an `external` field: make the object world-readable (CDN origin) rather\n   * than presigned-only. Default `false` (presigned). Ignored unless `external`.\n   */\n  readonly public?: boolean\n  /**\n   * For an `external` field: how to stamp a **backlink** (this record's\n   * vault/collection/id/field) onto the object's metadata — the self-describing\n   * \"secondary store\" that powers reconcile / DR / import re-pairing.\n   * - `'opaque-token'` (default): a random id; preserves the opaque-bucket\n   *   property (no names leak); the token is also recorded on the slot.\n   * - `'encrypted'`: the reference encrypted under the blob DEK (ZK-preserving;\n   *   falls back to `'opaque-token'` on a plaintext vault).\n   * - `'plain'`: the reference in cleartext metadata — **leaks structure** to\n   *   bucket readers; only for non-sensitive deployments.\n   * - `'none'`: no backlink.\n   */\n  readonly backlink?: 'opaque-token' | 'encrypted' | 'plain' | 'none'\n}\n\nexport type BlobFieldsConfig<T = unknown> = Record<string, BlobFieldPolicy<T>>\n\n// ─── Audit collection ──────────────────────────────────────────────────\n\nexport const BLOB_EVICTION_AUDIT_COLLECTION = '_blob_eviction_audit'\n\nexport interface BlobEvictionEntry {\n  readonly id: string\n  readonly collection: string\n  readonly recordId: string\n  readonly slotName: string\n  readonly blobHash: string\n  /** `'budget'` — evicted by the #808 cache-budget LRU pass, not a policy. */\n  readonly reason: 'ttl' | 'predicate' | 'both' | 'budget'\n  readonly evictedAt: string\n  readonly actor: string\n}\n\n// ─── Compaction result ──────────────────────────────────────────────────\n\nexport interface CompactionResult {\n  /** Number of blob slots evicted by the policy pass across all collections. */\n  readonly evicted: number\n  /** Number of records touched (iterated + policy checked). */\n  readonly records: number\n  /** Number of collections with `blobFields` configured. */\n  readonly collections: number\n  /**\n   * Number of audit entries written — one per policy eviction plus one per\n   * budget SLOT eviction (dropping a device-local cache copy writes none).\n   */\n  readonly auditEntries: number\n  /**\n   * Number of slots that would have evicted (TTL/predicate triggered)\n   * but were retained by a `legalHold` or `retainUntil` floor.\n   */\n  readonly held: number\n  /**\n   * #808: number of slots whose due policy eviction was skipped because they\n   * are pinned for offline on THIS device (pin state is device-local).\n   */\n  readonly pinned: number\n  /**\n   * #808: number of evictions performed by the `cacheBudget` LRU pass —\n   * internal slots evicted through the standard eviction writer plus\n   * device-local external cache copies dropped. 0 when no budget was given.\n   */\n  readonly budgetEvicted: number\n  /** #808: plaintext bytes freed by the `cacheBudget` LRU pass. */\n  readonly budgetBytesFreed: number\n  /** Per-collection breakdown for diagnostics. */\n  readonly byCollection: Record<string, { records: number; evicted: number }>\n  /**\n   * #1133 — chunk rows in `_blob_chunks` with no surviving `_blob_index` entry.\n   * Pre-#1127 residue: unreachable by every reader AND by rotation, so for a\n   * legacy blob the bytes stay openable under a retired `_blob` DEK.\n   *\n   * REPORTED, never reclaimed — deciding \"orphaned\" means trusting the store's\n   * `list`, and a store that withholds one index row would have us destroy a\n   * LIVE blob's chunks. See `orphan-report.ts` for the full argument. A vault\n   * that has run `migrate()` has no legacy chunks to strand, and `chunks: 0`\n   * is the expected reading everywhere else.\n   */\n  readonly orphanBlobChunks: OrphanChunkReport\n  /**\n   * #1453 — legacy (no `_cek`) blobs at `refCount <= 0`: released by every\n   * reference-drop path but never reclaimed, because a legacy chunk has no\n   * eager shred. Counted on every run; deleted only with\n   * `reclaimLegacyBlobs: true`. Not an orphan in the `orphanBlobChunks`\n   * sense — these rows keep their index entry, which is exactly why that\n   * report could not see them.\n   */\n  readonly unreferencedLegacyBlobs: UnreferencedLegacyBlobReport\n}\n\n// ─── Core ──────────────────────────────────────────────────────────────\n\nexport interface CompactRunOptions {\n  /** Override \"now\" for deterministic testing. */\n  readonly now?: Date\n  /**\n   * Stop after this many evictions. Useful for capped batches / cron\n   * jobs that need to fit in a time window. `undefined` = unbounded.\n   */\n  readonly maxEvictions?: number\n  /**\n   * Dry-run — evaluate policies and return the counts, but do NOT\n   * delete slots or write audit entries. Lets a consumer preview\n   * what would happen.\n   */\n  readonly dryRun?: boolean\n  /**\n   * #808 mobile cache budget: cap the locally-cached UNPINNED blob bytes.\n   * After the policy pass, a dedicated LRU pass walks every collection's\n   * slots (pinned slots and `legalHold`/`retainUntil`-held slots are exempt\n   * and uncounted) and evicts oldest-access-first — internal slots through\n   * the standard eviction writer (`deleteSlot` + a `'budget'` audit entry),\n   * external slots by dropping their device-local encrypted cache copy only\n   * (the object-store copy is authoritative and untouched) — until the\n   * remaining unpinned bytes fit `maxBytes`. Internal slots count their\n   * uncompressed `size`; external slots count `cachedBytes` (0 = nothing\n   * local, nothing to evict). LRU order comes from the device-local\n   * `lastAccessAt` stamp, falling back to `uploadedAt`.\n   */\n  readonly cacheBudget?: { readonly maxBytes: number }\n  /**\n   * #1453 — reclaim unreferenced legacy blobs (chunks first, then the index\n   * row). Off by default: reclaiming is irreversible and the default posture\n   * for a maintenance pass is to report. Ignored under `dryRun`.\n   */\n  readonly reclaimLegacyBlobs?: boolean\n}\n\nexport interface CompactionContext {\n  readonly adapter: NoydbStore\n  readonly vault: string\n  readonly actor: string\n  readonly encrypted: boolean\n  readonly getDEK: (collection: string) => Promise<EnclaveKey>\n  /**\n   * Resolve a collection's declared `blobFields` config. Returns an\n   * empty map for collections without the config — the walk skips\n   * those.\n   */\n  readonly getBlobFields: <T>(collection: string) => BlobFieldsConfig<T> | null\n  /** List collection names in the vault. */\n  readonly listCollections: () => Promise<string[]>\n  /** List record ids in a collection. */\n  readonly listRecords: (collection: string) => Promise<string[]>\n  /** Decrypt and return the record. Null when absent. */\n  readonly getRecord: <T>(collection: string, id: string) => Promise<T | null>\n  /** Return the BlobSet-like handle for a record's slots. */\n  readonly listSlots: (collection: string, id: string) => Promise<SlotInfo[]>\n  /** Delete a slot and decrement its blob's refCount. */\n  readonly deleteSlot: (collection: string, id: string, slotName: string) => Promise<void>\n  /**\n   * #808: drop a slot's DEVICE-LOCAL cached copy (the encrypted external\n   * side-cache) without touching the slot or the object store. Returns the\n   * plaintext bytes freed. Optional — absent (or a 0 return) means external\n   * cache entries simply cannot be budget-evicted through this context.\n   */\n  readonly dropLocalCache?: (collection: string, id: string, slotName: string) => Promise<number>\n}\n\nexport async function runCompaction(\n  ctx: CompactionContext,\n  options: CompactRunOptions = {},\n): Promise<CompactionResult> {\n  // #1133 — two `list` calls, no decryption, nothing written. Always on rather\n  // than opt-in: residue an operator has to know to ask about is residue nobody\n  // finds. The cost is negligible beside this pass's own per-record `getRecord`.\n  const orphanBlobChunks = await reportOrphanBlobChunks(ctx.adapter, ctx.vault)\n  const now = options.now ?? new Date()\n  const maxEvictions = options.maxEvictions ?? Infinity\n  const dryRun = options.dryRun === true\n  // #1453 — always counted, reclaimed only on request and never under dryRun.\n  const unreferencedLegacyBlobs = await sweepUnreferencedLegacyBlobs(ctx, options.reclaimLegacyBlobs === true && !dryRun)\n  if (options.cacheBudget !== undefined\n    && (!Number.isFinite(options.cacheBudget.maxBytes) || options.cacheBudget.maxBytes < 0)) {\n    throw new ValidationError('compact(): cacheBudget.maxBytes must be a non-negative finite number (#808)')\n  }\n\n  const allCollections = await ctx.listCollections()\n  const byCollection: Record<string, { records: number; evicted: number }> = {}\n  let evicted = 0\n  let records = 0\n  let auditEntries = 0\n  let held = 0\n  let pinned = 0\n  let collectionsWithPolicy = 0\n\n  outer: for (const collectionName of allCollections) {\n    if (collectionName.startsWith('_')) continue\n    const config = ctx.getBlobFields(collectionName)\n    if (!config) continue\n    const configuredSlots = Object.keys(config)\n    if (configuredSlots.length === 0) continue\n    collectionsWithPolicy += 1\n    byCollection[collectionName] = { records: 0, evicted: 0 }\n\n    const ids = await ctx.listRecords(collectionName)\n    for (const recordId of ids) {\n      if (evicted >= maxEvictions) break outer\n\n      const record = await ctx.getRecord(collectionName, recordId).catch(() => null)\n      if (record === null) continue\n      records += 1\n      byCollection[collectionName].records += 1\n\n      const slots = await ctx.listSlots(collectionName, recordId).catch(() => [])\n      for (const slot of slots) {\n        if (evicted >= maxEvictions) break outer\n        const policy = config[slot.name]\n        if (!policy) continue\n\n        const reason = evaluatePolicy(policy, record, slot, now)\n        if (!reason) continue\n\n        // #808: device-local offline pin — an exemption inside this existing\n        // pass, exactly like a hold: counted, never evicted. `slot.pinned` is\n        // the device-local annotation `BlobSet.list()` stamps from the\n        // withBlobs() pin registry (never synced state).\n        if (slot.pinned === true) {\n          pinned += 1\n          continue\n        }\n\n        // Retention floor: a legal hold or period-bound retainUntil\n        // blocks an otherwise-due eviction. Counted, never evicted.\n        if (isHeld(policy, record, now)) {\n          held += 1\n          continue\n        }\n\n        if (!dryRun) {\n          await ctx.deleteSlot(collectionName, recordId, slot.name)\n          await writeAuditEntry(ctx, {\n            id: generateEvictionId(collectionName, recordId, slot.name),\n            collection: collectionName,\n            recordId,\n            slotName: slot.name,\n            blobHash: slot.eTag,\n            reason,\n            evictedAt: now.toISOString(),\n            actor: ctx.actor,\n          })\n          auditEntries += 1\n        }\n        evicted += 1\n        byCollection[collectionName].evicted += 1\n      }\n    }\n  }\n\n  // #808: cache-budget LRU pass — runs AFTER the policy pass so a slot that\n  // just evicted no longer counts toward the budget. Reuses this module's own\n  // eviction writer (deleteSlot + audit), never a parallel one.\n  let budgetEvicted = 0\n  let budgetBytesFreed = 0\n  if (options.cacheBudget !== undefined) {\n    const pass = await runBudgetPass(ctx, options.cacheBudget.maxBytes, {\n      now, dryRun, remainingEvictions: maxEvictions - evicted,\n    })\n    budgetEvicted = pass.evicted\n    budgetBytesFreed = pass.bytesFreed\n    auditEntries += pass.auditEntries\n  }\n\n  return {\n    evicted,\n    records,\n    collections: collectionsWithPolicy,\n    auditEntries,\n    held,\n    pinned,\n    budgetEvicted,\n    budgetBytesFreed,\n    byCollection,\n    orphanBlobChunks,\n    unreferencedLegacyBlobs,\n  }\n}\n\n// ─── #808: cache-budget LRU pass ───────────────────────────────────────\n\ninterface BudgetCandidate {\n  readonly collection: string\n  readonly recordId: string\n  readonly slotName: string\n  readonly eTag: string\n  readonly bytes: number\n  /** `'slot'` — internal blob, evicted via `deleteSlot`; `'cache'` — external device-local copy, dropped via `dropLocalCache`. */\n  readonly kind: 'slot' | 'cache'\n  readonly lastAccessMs: number\n}\n\n/**\n * Enforce `cacheBudget.maxBytes` over the locally-cached UNPINNED blob bytes\n * (see {@link CompactRunOptions.cacheBudget} for the full contract). Walks\n * EVERY collection — unlike the policy pass, the budget is not gated on a\n * declared `blobFields` config — but still honors a declared policy's\n * `legalHold`/`retainUntil` floor where one exists.\n */\nasync function runBudgetPass(\n  ctx: CompactionContext,\n  maxBytes: number,\n  opts: { now: Date; dryRun: boolean; remainingEvictions: number },\n): Promise<{ evicted: number; bytesFreed: number; auditEntries: number }> {\n  const candidates: BudgetCandidate[] = []\n  let total = 0\n\n  for (const collectionName of await ctx.listCollections()) {\n    if (collectionName.startsWith('_')) continue\n    const config = ctx.getBlobFields(collectionName)\n    for (const recordId of await ctx.listRecords(collectionName)) {\n      const slots = await ctx.listSlots(collectionName, recordId).catch(() => [])\n      if (slots.length === 0) continue\n      // The record is only needed to evaluate a declared policy's retention\n      // floor — skip the decrypt entirely for policy-less collections.\n      const record = config\n        ? await ctx.getRecord<unknown>(collectionName, recordId).catch(() => null)\n        : null\n      for (const slot of slots) {\n        if (slot.pinned === true) continue // pinned: exempt AND uncounted (#808)\n        const policy = config?.[slot.name]\n        if (policy && record !== null && isHeld(policy, record, opts.now)) continue // floor blocks budget too\n        const lastAccessMs = Date.parse(slot.lastAccessAt ?? slot.uploadedAt) || 0\n        const isExternal = slot.external !== undefined\n        const bytes = isExternal ? slot.cachedBytes ?? 0 : slot.size\n        if (bytes <= 0) continue // external with no local copy: nothing cached to evict\n        total += bytes\n        candidates.push({\n          collection: collectionName, recordId, slotName: slot.name, eTag: slot.eTag,\n          bytes, kind: isExternal ? 'cache' : 'slot', lastAccessMs,\n        })\n      }\n    }\n  }\n\n  // Oldest access first; deterministic tiebreak so equal timestamps (common\n  // within one ms) never make the eviction order flap between runs.\n  candidates.sort((a, b) =>\n    a.lastAccessMs - b.lastAccessMs\n    || a.collection.localeCompare(b.collection)\n    || a.recordId.localeCompare(b.recordId)\n    || a.slotName.localeCompare(b.slotName))\n\n  let evicted = 0\n  let bytesFreed = 0\n  let auditEntries = 0\n  for (const c of candidates) {\n    if (total <= maxBytes || evicted >= opts.remainingEvictions) break\n    if (!opts.dryRun) {\n      if (c.kind === 'slot') {\n        await ctx.deleteSlot(c.collection, c.recordId, c.slotName)\n        await writeAuditEntry(ctx, {\n          id: generateEvictionId(c.collection, c.recordId, c.slotName),\n          collection: c.collection,\n          recordId: c.recordId,\n          slotName: c.slotName,\n          blobHash: c.eTag,\n          reason: 'budget',\n          evictedAt: opts.now.toISOString(),\n          actor: ctx.actor,\n        })\n        auditEntries += 1\n      } else {\n        // Device-local cache drop only — the slot (catalog) and the\n        // object-store copy are untouched, so no eviction audit entry.\n        await ctx.dropLocalCache?.(c.collection, c.recordId, c.slotName)\n      }\n    }\n    evicted += 1\n    bytesFreed += c.bytes\n    total -= c.bytes\n  }\n\n  return { evicted, bytesFreed, auditEntries }\n}\n\n/**\n * Whether a retention floor (legal hold or period-bound `retainUntil`)\n * currently blocks eviction of this record's slots. Fail-closed: a\n * throwing predicate holds the slot.\n */\nfunction isHeld<T>(policy: BlobFieldPolicy<T>, record: T, now: Date): boolean {\n  if (policy.legalHold) {\n    try {\n      if (policy.legalHold(record)) return true\n    } catch {\n      return true\n    }\n  }\n  if (policy.retainUntil) {\n    try {\n      const until = policy.retainUntil(record)\n      if (until !== null && until !== undefined) {\n        const t = until instanceof Date ? until.getTime() : typeof until === 'number' ? until : Date.parse(String(until))\n        if (!Number.isFinite(t)) return true   // fail-closed: unparseable retainUntil holds the slot\n        if (t > now.getTime()) return true\n      }\n    } catch {\n      return true\n    }\n  }\n  return false\n}\n\nfunction evaluatePolicy<T>(\n  policy: BlobFieldPolicy<T>,\n  record: T,\n  slot: SlotInfo,\n  now: Date,\n): 'ttl' | 'predicate' | 'both' | null {\n  let ttlTriggered = false\n  let predicateTriggered = false\n\n  if (policy.retainDays !== undefined && policy.retainDays > 0) {\n    const uploadedAt = Date.parse(slot.uploadedAt)\n    if (Number.isFinite(uploadedAt)) {\n      const ageMs = now.getTime() - uploadedAt\n      const limitMs = policy.retainDays * 86_400_000\n      if (ageMs > limitMs) ttlTriggered = true\n    }\n  }\n\n  if (policy.evictWhen) {\n    try {\n      if (policy.evictWhen(record)) predicateTriggered = true\n    } catch {\n      // Predicate error → do NOT evict. Fail closed.\n    }\n  }\n\n  if (ttlTriggered && predicateTriggered) return 'both'\n  if (ttlTriggered) return 'ttl'\n  if (predicateTriggered) return 'predicate'\n  return null\n}\n\nfunction generateEvictionId(collection: string, recordId: string, slotName: string): string {\n  const rand = globalThis.crypto.getRandomValues(new Uint8Array(8))\n  let suffix = ''\n  for (const b of rand) suffix += b.toString(16).padStart(2, '0')\n  return `${collection}__${recordId}__${slotName}__${suffix}`\n}\n\nasync function writeAuditEntry(ctx: CompactionContext, entry: BlobEvictionEntry): Promise<void> {\n  const json = JSON.stringify(entry)\n  const identity = { collection: BLOB_EVICTION_AUDIT_COLLECTION, id: entry.id, by: entry.actor, version: 1 }\n  const body = { ts: entry.evictedAt }\n  let envelope: EncryptedEnvelope\n  if (ctx.encrypted) {\n    const dek = await ctx.getDEK(BLOB_EVICTION_AUDIT_COLLECTION)\n    const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n    envelope = buildRecordEnvelope(identity, { ...body, iv, data })\n  } else {\n    envelope = buildRecordEnvelope(identity, { ...body, iv: '', data: json })\n  }\n  await ctx.adapter.put(ctx.vault, BLOB_EVICTION_AUDIT_COLLECTION, entry.id, envelope)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAuEA,eAAe,WAAW,KAAkB,KAA6C;AACvF,MAAI,IAAI,oBAAqB,QAAO,IAAI,oBAAoB,IAAI,EAAE;AAClE,SAAO,EAAE,UAAU,GAAG,SAAS,CAAC,EAAE;AACpC;AAgCA,SAAS,0BAA0B,QAAmD;AACpF,SAAO;AAAA,IACL,YAAY,OAAO;AAAA,MACjB,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;AAAA,QACjD,GAAI,EAAE,eAAe,SAAY,EAAE,YAAY,EAAE,WAAW,IAAI,CAAC;AAAA,QACjE,GAAI,EAAE,cAAc,SAAY,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,QACvD,GAAI,EAAE,cAAc,SAAY,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,QACvD,GAAI,EAAE,gBAAgB,SAAY,EAAE,aAAa,KAAK,IAAI,CAAC;AAAA,QAC3D,GAAI,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;AAAA,QAChD,GAAI,EAAE,WAAW,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;AAAA,QAC5C,GAAI,EAAE,aAAa,SAAY,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7D,CAAC,CAAC;AAAA,IACJ;AAAA,EACF;AACF;AAEO,SAAS,QAAQ,KAA8B;AACpD,SAAO;AAAA,IACL,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMP,SAAS,EAAE,iBAAiB,YAAY,WAAW,QAAQ,YAAY,MAAM,aAAa,KAAK;AAAA,IAC/F,QAAQ,CAAC,UAAU,SAAS,IAAI;AAAA,IAChC,eAAe,OAAO,KAAK,IAAI,MAAM;AAAA;AAAA,IACrC,OAAO,CAAC,QAAQ,WAAW,KAAK,GAAG;AAAA,IACnC,kBAAkB,MAAM,0BAA0B,IAAI,MAAM;AAAA,EAC9D;AACF;AAEO,SAAS,cAAoB;AAClC,mBAAiB,QAAQ,CAAC,MAAM,QAAQ,CAAkB,CAAC;AAC7D;;;ACtGA,YAAY;AA8FL,IAAM,WAA0B;AAAA,EACrC,WAAW;AACT,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAAA,EACA,aAAa;AACX,WAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,iBAAiB,EAAE;AAAA,EAClD;AACF;;;AC9CO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,QAAgB;AAC1B,UAAM,wBAAwB,MAAM,EAAE;AACtC,SAAK,OAAO;AAAA,EACd;AACF;AAIO,IAAM,0BAA0B;AAmBhC,SAAS,wBACd,OACA,2BACA,eACA,YACA,SACmB;AACnB,MAAI,UAAU;AAEd,QAAM,QAAQ,MAAY;AACxB,cAAU;AAAA,EACZ;AAEA,MAAI,QAAQ,QAAQ;AAClB,QAAI,QAAQ,OAAO,QAAS,WAAU;AACtC,YAAQ,OAAO,iBAAiB,SAAS,MAAM;AAAE,gBAAU;AAAA,IAAK,CAAC;AAAA,EACnE;AAEA,WAAS,aAAmB;AAC1B,QAAI,QAAS,OAAM,IAAI,wBAAwB,mBAAmB;AAAA,EACpE;AAEA,QAAM,YAAY,QAAQ,cAAc,IAAI,IAAI,QAAQ,WAAW,IAAI;AAIvE,MAAI,eAAqC;AACzC,WAAS,iBAAgC;AACvC,QAAI,CAAC,cAAc;AACjB,qBAAe,WAAW;AAAA,QACxB,IAAI,gBAAgB;AAAA,QACpB,WAAW;AAAA,QACX;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,aAAa,QAAQ,eAAe;AAAA,QACpC,WAAW,QAAQ,QAAQ,KAAK;AAAA,QAChC,aAAa,QAAQ,eAAe;AAAA,MACtC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,kBAAgB,WAAyC;AACvD,UAAM,eAAe;AACrB,eAAW;AAGX,UAAM,iBAAiB,MAAM,0BAA0B;AACvD,UAAM,UAAU,eAAe,OAAO,UAAQ;AAC5C,UAAI,KAAK,WAAW,GAAG,EAAG,QAAO;AACjC,UAAI,aAAa,CAAC,UAAU,IAAI,IAAI,EAAG,QAAO;AAC9C,aAAO;AAAA,IACT,CAAC;AAED,QAAI,kBAAkB,QAAQ,gBAAgB;AAE9C,eAAW,kBAAkB,SAAS;AACpC,UAAI,QAAS;AAEb,YAAM,OAAO,cAAuC,cAAc;AAClE,YAAM,UAAU,MAAM,KAAK,KAAK,EAAE,MAAM,MAAM,CAAC,CAAC;AAChD,iBAAW,UAAU,SAAS;AAC5B,YAAI,QAAS;AACb,mBAAW;AAEX,cAAM,UAAW,OAA4B;AAC7C,YAAI,OAAO,YAAY,SAAU;AAEjC,YAAI,QAAQ,SAAS,CAAC,QAAQ,MAAM,QAAQ,EAAE,YAAY,gBAAgB,IAAI,QAAQ,CAAC,EAAG;AAE1F,cAAM,UAAU,KAAK,KAAK,OAAO;AACjC,cAAM,QAAQ,MAAM,QAAQ,KAAK,EAAE,MAAM,MAAM,CAAC,CAAe;AAC/D,mBAAW,QAAQ,OAAO;AACxB,cAAI,QAAS;AAEb,cAAI,CAAC,iBAAiB;AACpB,gBAAI,KAAK,SAAS,QAAQ,aAAa;AACrC,gCAAkB;AAAA,YACpB;AACA;AAAA,UACF;AAEA,gBAAM,QAAQ,MAAM,QAAQ,IAAI,KAAK,IAAI;AACzC,cAAI,CAAC,MAAO;AAEZ,gBAAM,OAAqB;AAAA,YACzB,QAAQ,KAAK;AAAA,YACb,WAAW,EAAE,YAAY,gBAAgB,IAAI,SAAS,MAAM,KAAK,KAAK;AAAA,YACtE;AAAA,YACA,MAAM;AAAA,cACJ,MAAM,KAAK;AAAA,cACX,UAAU,KAAK;AAAA,cACf,GAAI,KAAK,aAAa,UAAa,EAAE,UAAU,KAAK,SAAS;AAAA,cAC7D,GAAI,KAAK,eAAe,UAAa,EAAE,WAAW,KAAK,WAAW;AAAA,YACpE;AAAA,UACF;AACA,gBAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAA4B;AAAA,IAChC;AAAA,IACA,IAAI,UAAU;AAAE,aAAO;AAAA,IAAQ;AAAA,IAC/B,CAAC,OAAO,aAAa,GAAG,MAAM,SAAS;AAAA,EACzC;AACA,SAAO;AACT;AAIA,SAAS,kBAA0B;AAEjC,QAAM,MAAM,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAChE,MAAI,IAAI;AACR,aAAW,KAAK,IAAK,MAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACxD,SAAO,SAAS,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC;AAC3D;;;AC3MA,IAAM,eAAe;AA8BrB,SAAS,aAAa,IAAoD;AACxE,QAAM,MAAM,GAAG,YAAY,GAAG;AAC9B,MAAI,OAAO,KAAK,QAAQ,GAAG,SAAS,EAAG,QAAO;AAC9C,QAAM,SAAS,GAAG,MAAM,MAAM,CAAC;AAC/B,MAAI,CAAC,QAAQ,KAAK,MAAM,EAAG,QAAO;AAClC,SAAO,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,GAAG,OAAO,OAAO,MAAM,EAAE;AACzD;AAUA,eAAsB,uBACpB,SACA,OAC4B;AAC5B,QAAM,QAA2B,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC,GAAG,aAAa,EAAE;AACxF,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,MAAM,QAAQ,KAAK,OAAO,qBAAqB,CAAC;AACpE,eAAW,MAAM,QAAQ,KAAK,OAAO,sBAAsB;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,MAAI,SAAS;AACb,MAAI,cAAc;AAClB,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,MAAM,UAAU;AACzB,UAAM,SAAS,aAAa,EAAE;AAC9B,QAAI,WAAW,MAAM;AAAE,qBAAe;AAAG;AAAA,IAAS;AAClD,QAAI,UAAU,IAAI,OAAO,IAAI,EAAG;AAChC,cAAU;AACV,gBAAY,IAAI,OAAO,IAAI;AAAA,EAC7B;AAEA,SAAO;AAAA,IACL;AAAA,IACA,OAAO,YAAY;AAAA,IACnB,aAAa,CAAC,GAAG,WAAW,EAAE,MAAM,GAAG,YAAY;AAAA,IACnD;AAAA,EACF;AACF;;;ACnFA,eAAsB,6BACpB,KACA,SACuC;AACvC,MAAI,QAAQ,GAAG,SAAS,GAAG,YAAY;AACvC,QAAM,QAAQ,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,qBAAqB;AACrE,QAAM,MAAM,IAAI,YAAY,MAAM,IAAI,OAAO,eAAe,IAAI;AAChE,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,uBAAuB,IAAI;AACxE,QAAI,CAAC,IAAK;AACV,QAAI;AACJ,QAAI;AAGF,YAAM,OAAO,MAAM,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,KAAK,GAAG,KAAK,GAAG,IAAK,IAAI,SAAS;AACrH,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,SAAS,KAAK;AACZ,UAAI,eAAe,cAAe;AAClC,YAAM;AAAA,IACR;AAGA,QAAI,OAAO,OAAO,MAAM,MAAM,KAAK,KAAK,WAAW,EAAG;AACtD,aAAS;AACT,cAAU,KAAK;AACf,QAAI,CAAC,QAAS;AAEd,aAAS,IAAI,GAAG,IAAI,KAAK,YAAY,KAAK;AACxC,YAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,wBAAwB,GAAG,IAAI,IAAI,CAAC,EAAE;AAAA,IAC5E;AACA,UAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,uBAAuB,IAAI;AAC/D,iBAAa;AAAA,EACf;AACA,SAAO,EAAE,OAAO,QAAQ,UAAU;AACpC;;;AC4CO,IAAM,iCAAiC;AA4I9C,eAAsB,cACpB,KACA,UAA6B,CAAC,GACH;AAI3B,QAAM,mBAAmB,MAAM,uBAAuB,IAAI,SAAS,IAAI,KAAK;AAC5E,QAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,SAAS,QAAQ,WAAW;AAElC,QAAM,0BAA0B,MAAM,6BAA6B,KAAK,QAAQ,uBAAuB,QAAQ,CAAC,MAAM;AACtH,MAAI,QAAQ,gBAAgB,WACtB,CAAC,OAAO,SAAS,QAAQ,YAAY,QAAQ,KAAK,QAAQ,YAAY,WAAW,IAAI;AACzF,UAAM,IAAI,gBAAgB,6EAA6E;AAAA,EACzG;AAEA,QAAM,iBAAiB,MAAM,IAAI,gBAAgB;AACjD,QAAM,eAAqE,CAAC;AAC5E,MAAI,UAAU;AACd,MAAI,UAAU;AACd,MAAI,eAAe;AACnB,MAAI,OAAO;AACX,MAAI,SAAS;AACb,MAAI,wBAAwB;AAE5B,QAAO,YAAW,kBAAkB,gBAAgB;AAClD,QAAI,eAAe,WAAW,GAAG,EAAG;AACpC,UAAM,SAAS,IAAI,cAAc,cAAc;AAC/C,QAAI,CAAC,OAAQ;AACb,UAAM,kBAAkB,OAAO,KAAK,MAAM;AAC1C,QAAI,gBAAgB,WAAW,EAAG;AAClC,6BAAyB;AACzB,iBAAa,cAAc,IAAI,EAAE,SAAS,GAAG,SAAS,EAAE;AAExD,UAAM,MAAM,MAAM,IAAI,YAAY,cAAc;AAChD,eAAW,YAAY,KAAK;AAC1B,UAAI,WAAW,aAAc,OAAM;AAEnC,YAAM,SAAS,MAAM,IAAI,UAAU,gBAAgB,QAAQ,EAAE,MAAM,MAAM,IAAI;AAC7E,UAAI,WAAW,KAAM;AACrB,iBAAW;AACX,mBAAa,cAAc,EAAE,WAAW;AAExC,YAAM,QAAQ,MAAM,IAAI,UAAU,gBAAgB,QAAQ,EAAE,MAAM,MAAM,CAAC,CAAC;AAC1E,iBAAW,QAAQ,OAAO;AACxB,YAAI,WAAW,aAAc,OAAM;AACnC,cAAM,SAAS,OAAO,KAAK,IAAI;AAC/B,YAAI,CAAC,OAAQ;AAEb,cAAM,SAAS,eAAe,QAAQ,QAAQ,MAAM,GAAG;AACvD,YAAI,CAAC,OAAQ;AAMb,YAAI,KAAK,WAAW,MAAM;AACxB,oBAAU;AACV;AAAA,QACF;AAIA,YAAI,OAAO,QAAQ,QAAQ,GAAG,GAAG;AAC/B,kBAAQ;AACR;AAAA,QACF;AAEA,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI,WAAW,gBAAgB,UAAU,KAAK,IAAI;AACxD,gBAAM,gBAAgB,KAAK;AAAA,YACzB,IAAI,mBAAmB,gBAAgB,UAAU,KAAK,IAAI;AAAA,YAC1D,YAAY;AAAA,YACZ;AAAA,YACA,UAAU,KAAK;AAAA,YACf,UAAU,KAAK;AAAA,YACf;AAAA,YACA,WAAW,IAAI,YAAY;AAAA,YAC3B,OAAO,IAAI;AAAA,UACb,CAAC;AACD,0BAAgB;AAAA,QAClB;AACA,mBAAW;AACX,qBAAa,cAAc,EAAE,WAAW;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AAKA,MAAI,gBAAgB;AACpB,MAAI,mBAAmB;AACvB,MAAI,QAAQ,gBAAgB,QAAW;AACrC,UAAM,OAAO,MAAM,cAAc,KAAK,QAAQ,YAAY,UAAU;AAAA,MAClE;AAAA,MAAK;AAAA,MAAQ,oBAAoB,eAAe;AAAA,IAClD,CAAC;AACD,oBAAgB,KAAK;AACrB,uBAAmB,KAAK;AACxB,oBAAgB,KAAK;AAAA,EACvB;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAsBA,eAAe,cACb,KACA,UACA,MACwE;AACxE,QAAM,aAAgC,CAAC;AACvC,MAAI,QAAQ;AAEZ,aAAW,kBAAkB,MAAM,IAAI,gBAAgB,GAAG;AACxD,QAAI,eAAe,WAAW,GAAG,EAAG;AACpC,UAAM,SAAS,IAAI,cAAc,cAAc;AAC/C,eAAW,YAAY,MAAM,IAAI,YAAY,cAAc,GAAG;AAC5D,YAAM,QAAQ,MAAM,IAAI,UAAU,gBAAgB,QAAQ,EAAE,MAAM,MAAM,CAAC,CAAC;AAC1E,UAAI,MAAM,WAAW,EAAG;AAGxB,YAAM,SAAS,SACX,MAAM,IAAI,UAAmB,gBAAgB,QAAQ,EAAE,MAAM,MAAM,IAAI,IACvE;AACJ,iBAAW,QAAQ,OAAO;AACxB,YAAI,KAAK,WAAW,KAAM;AAC1B,cAAM,SAAS,SAAS,KAAK,IAAI;AACjC,YAAI,UAAU,WAAW,QAAQ,OAAO,QAAQ,QAAQ,KAAK,GAAG,EAAG;AACnE,cAAM,eAAe,KAAK,MAAM,KAAK,gBAAgB,KAAK,UAAU,KAAK;AACzE,cAAM,aAAa,KAAK,aAAa;AACrC,cAAM,QAAQ,aAAa,KAAK,eAAe,IAAI,KAAK;AACxD,YAAI,SAAS,EAAG;AAChB,iBAAS;AACT,mBAAW,KAAK;AAAA,UACd,YAAY;AAAA,UAAgB;AAAA,UAAU,UAAU,KAAK;AAAA,UAAM,MAAM,KAAK;AAAA,UACtE;AAAA,UAAO,MAAM,aAAa,UAAU;AAAA,UAAQ;AAAA,QAC9C,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAIA,aAAW,KAAK,CAAC,GAAG,MAClB,EAAE,eAAe,EAAE,gBAChB,EAAE,WAAW,cAAc,EAAE,UAAU,KACvC,EAAE,SAAS,cAAc,EAAE,QAAQ,KACnC,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AAEzC,MAAI,UAAU;AACd,MAAI,aAAa;AACjB,MAAI,eAAe;AACnB,aAAW,KAAK,YAAY;AAC1B,QAAI,SAAS,YAAY,WAAW,KAAK,mBAAoB;AAC7D,QAAI,CAAC,KAAK,QAAQ;AAChB,UAAI,EAAE,SAAS,QAAQ;AACrB,cAAM,IAAI,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AACzD,cAAM,gBAAgB,KAAK;AAAA,UACzB,IAAI,mBAAmB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AAAA,UAC3D,YAAY,EAAE;AAAA,UACd,UAAU,EAAE;AAAA,UACZ,UAAU,EAAE;AAAA,UACZ,UAAU,EAAE;AAAA,UACZ,QAAQ;AAAA,UACR,WAAW,KAAK,IAAI,YAAY;AAAA,UAChC,OAAO,IAAI;AAAA,QACb,CAAC;AACD,wBAAgB;AAAA,MAClB,OAAO;AAGL,cAAM,IAAI,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AAAA,MACjE;AAAA,IACF;AACA,eAAW;AACX,kBAAc,EAAE;AAChB,aAAS,EAAE;AAAA,EACb;AAEA,SAAO,EAAE,SAAS,YAAY,aAAa;AAC7C;AAOA,SAAS,OAAU,QAA4B,QAAW,KAAoB;AAC5E,MAAI,OAAO,WAAW;AACpB,QAAI;AACF,UAAI,OAAO,UAAU,MAAM,EAAG,QAAO;AAAA,IACvC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,OAAO,aAAa;AACtB,QAAI;AACF,YAAM,QAAQ,OAAO,YAAY,MAAM;AACvC,UAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,cAAM,IAAI,iBAAiB,OAAO,MAAM,QAAQ,IAAI,OAAO,UAAU,WAAW,QAAQ,KAAK,MAAM,OAAO,KAAK,CAAC;AAChH,YAAI,CAAC,OAAO,SAAS,CAAC,EAAG,QAAO;AAChC,YAAI,IAAI,IAAI,QAAQ,EAAG,QAAO;AAAA,MAChC;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eACP,QACA,QACA,MACA,KACqC;AACrC,MAAI,eAAe;AACnB,MAAI,qBAAqB;AAEzB,MAAI,OAAO,eAAe,UAAa,OAAO,aAAa,GAAG;AAC5D,UAAM,aAAa,KAAK,MAAM,KAAK,UAAU;AAC7C,QAAI,OAAO,SAAS,UAAU,GAAG;AAC/B,YAAM,QAAQ,IAAI,QAAQ,IAAI;AAC9B,YAAM,UAAU,OAAO,aAAa;AACpC,UAAI,QAAQ,QAAS,gBAAe;AAAA,IACtC;AAAA,EACF;AAEA,MAAI,OAAO,WAAW;AACpB,QAAI;AACF,UAAI,OAAO,UAAU,MAAM,EAAG,sBAAqB;AAAA,IACrD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,gBAAgB,mBAAoB,QAAO;AAC/C,MAAI,aAAc,QAAO;AACzB,MAAI,mBAAoB,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,mBAAmB,YAAoB,UAAkB,UAA0B;AAC1F,QAAM,OAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,CAAC,CAAC;AAChE,MAAI,SAAS;AACb,aAAW,KAAK,KAAM,WAAU,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC9D,SAAO,GAAG,UAAU,KAAK,QAAQ,KAAK,QAAQ,KAAK,MAAM;AAC3D;AAEA,eAAe,gBAAgB,KAAwB,OAAyC;AAC9F,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,QAAM,WAAW,EAAE,YAAY,gCAAgC,IAAI,MAAM,IAAI,IAAI,MAAM,OAAO,SAAS,EAAE;AACzG,QAAM,OAAO,EAAE,IAAI,MAAM,UAAU;AACnC,MAAI;AACJ,MAAI,IAAI,WAAW;AACjB,UAAM,MAAM,MAAM,IAAI,OAAO,8BAA8B;AAC3D,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,eAAW,oBAAoB,UAAU,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC;AAAA,EAChE,OAAO;AACL,eAAW,oBAAoB,UAAU,EAAE,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC;AAAA,EAC1E;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,gCAAgC,MAAM,IAAI,QAAQ;AACrF;","names":[]}

package/dist/chunk-JWWYRR4Q.js

@@ -0,0 +1,12 @@
+import {
+  signBytes,
+  verifyBytes
+} from "./chunk-EZGV6F47.js";
+
+// src/with-audit/attestation/scheme.ts
+var ENCLAVE_SCHEME = { sign: signBytes, verify: verifyBytes };
+
+export {
+  ENCLAVE_SCHEME
+};
+//# sourceMappingURL=chunk-JWWYRR4Q.js.map

package/dist/chunk-JWWYRR4Q.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/attestation/scheme.ts"],"sourcesContent":["import { signBytes, verifyBytes } from '../../capsule/index.js'\nimport type { SignatureScheme } from './types.js'\n\n/**\n * Attestation signs and verifies with the ENCLAVE's sign group, not with the\n * attestation package's bundled Ed25519 — so a different enclave (Stage B/C)\n * changes what hub signs with, without touching attestation.\n */\nexport const ENCLAVE_SCHEME: SignatureScheme = { sign: signBytes, verify: verifyBytes }\n"],"mappings":";;;;;;AAQO,IAAM,iBAAkC,EAAE,MAAM,WAAW,QAAQ,YAAY;","names":[]}

package/dist/{chunk-BVN6KXL2.js → chunk-KZXDLBY6.js}

@@ -1,14 +1,20 @@
 import {
   pickLocale
-} from "./chunk-EQEYOJBM.js";
+} from "./chunk-5A4345TG.js";
 import {
-  sha256Hex
-} from "./chunk-HPVZCW43.js";
+  canonicalJson,
+  utf8
+} from "./chunk-GMKGGY7V.js";
+import {
+  sha256Hex,
+  signBytes,
+  verifyBytes
+} from "./chunk-EZGV6F47.js";
 import {
   PodIntegrityError,
   PodSealMismatchError,
   ValidationError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-pod/format.ts
 var NOYDB_POD_MAGIC = new Uint8Array([78, 68, 66, 49]);
@@ -328,16 +334,15 @@ function hasNoydbPodMagic(bytes) {
 }
 
 // src/with-pod/signature.ts
-import { canonicalJson, ed25519Sign, ed25519Verify, utf8 } from "@noy-db/attestation";
 var POD_SIG_ALG = "ed25519";
 function signedBytes(payload) {
   return utf8(canonicalJson(payload));
 }
 async function signRecord(privateKeyPkcs8B64, payload) {
-  return ed25519Sign(privateKeyPkcs8B64, signedBytes(payload));
+  return signBytes(privateKeyPkcs8B64, signedBytes(payload));
 }
 async function verifyRecord(publicKeyB64, sig, payload) {
-  return ed25519Verify(publicKeyB64, sig, signedBytes(payload));
+  return verifyBytes(publicKeyB64, sig, signedBytes(payload));
 }
 
 // src/with-pod/pod.ts
@@ -812,7 +817,7 @@ async function applySatelliteLivenessFilter(vault, dumpJson) {
   if (!backup.collections || typeof backup.collections !== "object") return dumpJson;
   if (typeof vault._introspectState !== "function") return dumpJson;
   const { adapter, name, getDEK } = vault._introspectState();
-  const { liveBaseIdSetsForBundle } = await import("./dead-filter-PKQDLOT4.js");
+  const { liveBaseIdSetsForBundle } = await import("./dead-filter-4F3LWYKH.js");
   const satLive = await liveBaseIdSetsForBundle(adapter, name, Object.keys(backup.collections), getDEK);
   if (satLive.size === 0) return dumpJson;
   const next = {};
@@ -1059,4 +1064,4 @@ export {
   readPodRedirect,
   readPod
 };
-//# sourceMappingURL=chunk-BVN6KXL2.js.map
+//# sourceMappingURL=chunk-KZXDLBY6.js.map