@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/{chunk-453F654R.js → chunk-VAORSCSU.js}

@@ -1,6 +1,6 @@
 import {
   buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
+} from "./chunk-EZGV6F47.js";
 
 // src/with-shape/schema-update/fence.ts
 var FENCE_RECORD_ID = "schema-fence";
@@ -10,7 +10,7 @@ async function loadFence(store, vault) {
   const envelope = await store.get(vault, META_COLLECTION, FENCE_RECORD_ID);
   if (!envelope) return DEFAULT_FENCE;
   try {
-    const parsed = JSON.parse(envelope._data);
+    const parsed = JSON.parse(envelope._data ?? "");
     if (!isFenceDoc(parsed)) return DEFAULT_FENCE;
     return parsed;
   } catch {
@@ -36,4 +36,4 @@ export {
   loadFence,
   saveFence
 };
-//# sourceMappingURL=chunk-453F654R.js.map
+//# sourceMappingURL=chunk-VAORSCSU.js.map

package/dist/chunk-VAORSCSU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/schema-update/fence.ts"],"sourcesContent":["/**\n * Schema-fence document. Vault-level generation counter + drain\n * state, stored at `_meta/schema-fence` using the plaintext-envelope\n * pattern of `_meta/policy` (no PII — a counter + a state enum).\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { buildRecordEnvelope } from '../../capsule/index.js'\n\nexport type FenceState = 'normal' | 'draining' | 'migrating' | 'complete'\n\nexport interface FenceDoc {\n  readonly currentSchemaVersion: number\n  readonly fenceState: FenceState\n  /**\n   * Content hash (`PersistedSchemaEnvelope.hash`) of the schema most\n   * recently persisted while the vault sat at `currentSchemaVersion` —\n   * binds \"generation N\" to a concrete schema-content hash (#946), so\n   * \"which schema is generation N\" is answerable from `schemaFenceState()`\n   * alone. Optional: absent on a fresh vault (generation 0, nothing\n   * persisted yet) and on a fence document written before #946.\n   */\n  readonly schemaHash?: string\n}\n\nexport const FENCE_RECORD_ID = 'schema-fence'\nconst META_COLLECTION = '_meta'\n\nexport const DEFAULT_FENCE: FenceDoc = { currentSchemaVersion: 0, fenceState: 'normal' }\n\nexport async function loadFence(store: NoydbStore, vault: string): Promise<FenceDoc> {\n  const envelope = await store.get(vault, META_COLLECTION, FENCE_RECORD_ID)\n  if (!envelope) return DEFAULT_FENCE\n  try {\n    const parsed = JSON.parse(envelope._data ?? '') as unknown\n    if (!isFenceDoc(parsed)) return DEFAULT_FENCE\n    return parsed\n  } catch {\n    return DEFAULT_FENCE\n  }\n}\n\nexport async function saveFence(store: NoydbStore, vault: string, fence: FenceDoc): Promise<void> {\n  const envelope = buildRecordEnvelope(\n    { collection: META_COLLECTION, id: FENCE_RECORD_ID, version: 1 },\n    { iv: '', data: JSON.stringify(fence) },\n  )\n  await store.put(vault, META_COLLECTION, FENCE_RECORD_ID, envelope)\n}\n\nfunction isFenceDoc(x: unknown): x is FenceDoc {\n  if (x === null || typeof x !== 'object') return false\n  const o = x as Record<string, unknown>\n  if (typeof o['currentSchemaVersion'] !== 'number') return false\n  if (o['fenceState'] !== 'normal' && o['fenceState'] !== 'draining'\n    && o['fenceState'] !== 'migrating' && o['fenceState'] !== 'complete') return false\n  // schemaHash is optional (#946) — a legacy fence doc without it is still valid.\n  return o['schemaHash'] === undefined || typeof o['schemaHash'] === 'string'\n}\n"],"mappings":";;;;;AAwBO,IAAM,kBAAkB;AAC/B,IAAM,kBAAkB;AAEjB,IAAM,gBAA0B,EAAE,sBAAsB,GAAG,YAAY,SAAS;AAEvF,eAAsB,UAAU,OAAmB,OAAkC;AACnF,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,iBAAiB,eAAe;AACxE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,SAAS,EAAE;AAC9C,QAAI,CAAC,WAAW,MAAM,EAAG,QAAO;AAChC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,UAAU,OAAmB,OAAe,OAAgC;AAChG,QAAM,WAAW;AAAA,IACf,EAAE,YAAY,iBAAiB,IAAI,iBAAiB,SAAS,EAAE;AAAA,IAC/D,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,KAAK,EAAE;AAAA,EACxC;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,iBAAiB,QAAQ;AACnE;AAEA,SAAS,WAAW,GAA2B;AAC7C,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,sBAAsB,MAAM,SAAU,QAAO;AAC1D,MAAI,EAAE,YAAY,MAAM,YAAY,EAAE,YAAY,MAAM,cACnD,EAAE,YAAY,MAAM,eAAe,EAAE,YAAY,MAAM,WAAY,QAAO;AAE/E,SAAO,EAAE,YAAY,MAAM,UAAa,OAAO,EAAE,YAAY,MAAM;AACrE;","names":[]}

package/dist/{chunk-GPNTB4Y7.js → chunk-VFHCKG5M.js}

@@ -1,20 +1,16 @@
 import {
   buildRecordAad,
+  buildRecordEnvelope,
+  encrypt,
   openEnvelopeJson
-} from "./chunk-4ZS56W5S.js";
-import {
-  buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
-import {
-  encrypt
-} from "./chunk-HPVZCW43.js";
+} from "./chunk-EZGV6F47.js";
 import {
   SequenceContentionError,
   SequenceNotEnabledError,
   SequenceOfflineError,
   ValidationError,
   isConflictError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-commit/sequence/active.ts
 function withSequence() {
@@ -128,7 +124,7 @@ var SequenceStore = class {
   async read(name) {
     const env = await this.adapter.get(this.vault, SEQUENCE_COLLECTION, name);
     if (!env) return { env: null, value: 0 };
-    const json = this.encrypted ? await openEnvelopeJson({ collection: SEQUENCE_COLLECTION, id: name }, env, await this.dek()) : env._data;
+    const json = this.encrypted ? await openEnvelopeJson({ collection: SEQUENCE_COLLECTION, id: name }, env, await this.dek()) : env._data ?? "";
     const state = JSON.parse(json);
     return { env, value: state.value };
   }
@@ -201,4 +197,4 @@ export {
   resolveSequenceKey,
   SequenceStore
 };
-//# sourceMappingURL=chunk-GPNTB4Y7.js.map
+//# sourceMappingURL=chunk-VFHCKG5M.js.map

package/dist/chunk-VFHCKG5M.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/sequence/active.ts","../src/with-commit/sequence/strategy.ts","../src/with-commit/sequence/index.ts"],"sourcesContent":["/**\n * Enable the atomic-sequence capability.\n * Pass to `createNoydb({ sequenceStrategy: withSequence() })` to make\n * `vault.sequence('name').next()` / `.peek()` / `.seedTo()` live. The\n * {@link SequenceStore} CAS engine is statically imported here, so it is pulled\n * into the bundle only when `withSequence()` is referenced (the floor never\n * imports it).\n */\nimport type { SequenceStrategy } from './strategy.js'\nimport { SequenceStore } from './index.js'\n\nexport function withSequence(): SequenceStrategy {\n  return {\n    createStore(opts) {\n      return new SequenceStore(opts)\n    },\n  }\n}\n","/**\n * Sequence capability strategy — the single on-demand factory the vault routes\n * `vault.sequence()` through to build its atomic-CAS {@link SequenceStore}. The\n * active engine ({@link withSequence}) constructs the real store (kept out of\n * the floor bundle — the store class is reached only via the opt-in\n * `active.ts` chunk); {@link NO_SEQUENCE} throws. The vault always assembles the\n * per-call {@link SequenceStoreOptions} and delegates here, so an un-opted-in\n * caller hits `NO_SEQUENCE`'s throw at `vault.sequence()`.\n *\n * Note: `vault.sequence()` is synchronous, so the factory is a plain (sync)\n * constructor — the engine is tree-shaken by reachability (only `withSequence()`\n * pulls `active.ts`, which statically imports the store), not by a dynamic\n * import. Deferred-numbering series (`withDeferredNumbering`) are a distinct\n * capability and are NOT routed through this strategy.\n * @internal\n */\nimport type { SequenceStore, SequenceStoreOptions } from './index.js'\nimport { SequenceNotEnabledError } from '../../kernel/errors.js'\n\nexport interface SequenceStrategy {\n  createStore(opts: SequenceStoreOptions): SequenceStore\n}\n\n/**\n * No-op stub — the floor default. The capability factory throws\n * {@link SequenceNotEnabledError}; opt in with `sequenceStrategy: withSequence()`\n * in createNoydb. @internal\n */\nexport const NO_SEQUENCE: SequenceStrategy = {\n  createStore(): SequenceStore {\n    throw new SequenceNotEnabledError()\n  },\n}\n","/**\n * Atomic sequence primitive — online-coordinated gap-free numbering.\n *\n * `vault.sequence('invoice-2026').next()` returns 1, 2, 3, … with no\n * gaps and no duplicates, even under concurrent callers. Each named\n * sequence is an independent counter record at `_sequences/<name>`,\n * incremented with an optimistic compare-and-swap retry loop — the same\n * proven pattern as the ledger head (`history/ledger/store.ts`).\n *\n * **Explicitly online-only.** Gap-free numbering requires single-authority\n * serialization, which an offline / non-CAS store cannot provide. `next()`\n * throws {@link SequenceOfflineError} unless the backing store advertises\n * `capabilities.casAtomic`. This is a deliberate, honest wall — an offline\n * writer cannot safely allocate a global sequence number.\n *\n * Note on \"gap-free\": the *sequence* is gap-free (each `next()` yields a\n * unique, +1 value). If a caller discards a value without using it, that\n * is a gap in *usage*, not in the sequence — assign each `next()` result\n * to its record in the same operation.\n */\n\nimport { buildRecordAad, buildRecordEnvelope } from '../../capsule/index.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../capsule/index.js'\nimport type { ConflictError} from '../../kernel/errors.js';\nimport { isConflictError, SequenceContentionError, SequenceOfflineError, ValidationError } from '../../kernel/errors.js'\n\n// Capability opt-in seam (S4): `vault.sequence()` builds its CAS store through\n// the sequenceStrategy, so it throws SequenceNotEnabledError unless opted in.\nexport { withSequence } from './active.js'\nexport { NO_SEQUENCE, type SequenceStrategy } from './strategy.js'\nexport { SequenceNotEnabledError } from '../../kernel/errors.js'\n\nexport const SEQUENCE_COLLECTION = '_sequences'\n// A sequence is a single hot CAS row — higher contention than a ledger\n// append. A larger budget + jittered backoff absorbs moderate concurrency;\n// a genuine burst beyond this surfaces SequenceContentionError so the\n// caller can retry / queue (the honest online-only contract).\nconst MAX_NEXT_ATTEMPTS = 16\n\ninterface SequenceState {\n  value: number\n}\n\n/** Options for `SequenceHandle.next`. Deferred-numbering series use `for`; the CAS counter ignores all of these. */\nexport interface NextOptions {\n  /** Deferred mode: the record id to number. Ignored by the CAS counter. */\n  readonly for?: string\n  /** Deferred mode: reject after this many ms if still unsealed (reserved; not yet enforced in this slice). */\n  readonly timeoutMs?: number\n}\n\n/**\n * Partitioning for a CAS sequence. A partitioned sequence is an\n * independent counter scoped to one tuple of values — e.g.\n * `sequence('invoice', { partition: [2026, 'EU'] })` numbers EU-2026 invoices\n * separately from `[2026, 'US']` and from the bare `invoice` series.\n *\n * Partition components are URI-encoded (so `/`, null bytes and other\n * separators in a value can never collide with the structural separators) and\n * `'/'`-joined, then appended to the series with a null-byte (`\\x00`)\n * separator. The null byte is illegal in a plain series name, which guarantees\n * a partitioned key is always disjoint from any unpartitioned series.\n */\nexport interface SequenceOptions {\n  /** Partition tuple. Each component is URI-encoded and `'/'`-joined. */\n  readonly partition?: readonly (string | number)[]\n  /**\n   * Render template for the serial string. When set, `vault.sequence`\n   * returns a {@link FormattedSequenceHandle} whose `next()` resolves to\n   * `{ serial, formatted }`. Tokens:\n   * - `{seq}` — the allocated integer\n   * - `{seq:0N}` — zero-padded to width N (e.g. `{seq:04}` → `0001`)\n   * - `{partition.i}` — the i-th `partition` component (original value)\n   *\n   * Any other token, or a `{partition.i}` index beyond the supplied\n   * `partition`, throws `ValidationError` at `vault.sequence()` construction.\n   * Per-partition reset is inherent: a new partition tuple starts at 1.\n   */\n  readonly format?: string\n}\n\n/**\n * A formatted sequence handle. Identical to {@link SequenceHandle}\n * except `next()` also returns the rendered `formatted` string. `peek()` /\n * `seedTo()` operate on the underlying integer counter, unchanged.\n */\nexport interface FormattedSequenceHandle {\n  /** Allocate the next value and return it with its rendered serial string. */\n  next(opts?: NextOptions): Promise<{ serial: number; formatted: string }>\n  /** Read the current integer value without allocating. Returns 0 if never used. */\n  peek(): Promise<number>\n  /** Set-if-greater on the underlying integer counter. See {@link SequenceHandle.seedTo}. */\n  seedTo(n: number): Promise<void>\n}\n\n// Matches a single `{...}` token with no nested braces.\nconst SEQ_FORMAT_TOKEN = /\\{([^{}]*)\\}/g\nconst SEQ_PAD_TOKEN = /^seq:0(\\d+)$/\nconst SEQ_PARTITION_TOKEN = /^partition\\.(\\d+)$/\n\n/**\n * Validate a sequence `format` against the supplied partition and return a\n * pure `(serial) => string` renderer. Eager validation: every token is\n * checked now, so a bad pattern throws `ValidationError` at construction —\n * never at `next()` time.\n */\nexport function compileSequenceFormat(\n  format: string,\n  series: string,\n  partition: readonly (string | number)[] | undefined,\n): (serial: number) => string {\n  const parts = partition ?? []\n  for (const m of format.matchAll(SEQ_FORMAT_TOKEN)) {\n    const token = m[1] ?? ''\n    if (token === 'seq') continue\n    if (SEQ_PAD_TOKEN.test(token)) continue\n    const partMatch = SEQ_PARTITION_TOKEN.exec(token)\n    if (partMatch) {\n      const idx = Number(partMatch[1])\n      if (idx >= parts.length) {\n        throw new ValidationError(\n          `sequence(\"${series}\"): format token \"{${token}}\" references partition index ${idx}, ` +\n            `but only ${parts.length} partition component(s) were supplied.`,\n        )\n      }\n      continue\n    }\n    throw new ValidationError(\n      `sequence(\"${series}\"): format contains unknown token \"{${token}}\". ` +\n        `Accepted tokens: {seq}, {seq:0N}, {partition.i}.`,\n    )\n  }\n  return (serial: number): string =>\n    format.replace(SEQ_FORMAT_TOKEN, (full, token: string) => {\n      if (token === 'seq') return String(serial)\n      const padMatch = SEQ_PAD_TOKEN.exec(token)\n      if (padMatch) return String(serial).padStart(Number(padMatch[1]), '0')\n      const partMatch = SEQ_PARTITION_TOKEN.exec(token)\n      if (partMatch) return String(parts[Number(partMatch[1])])\n      return full // unreachable — validated above\n    })\n}\n\n/**\n * Resolve the CAS storage key for a (series, partition) pair.\n *\n * With no partition the key is `series` verbatim. With a partition the key is\n * `${series}\\x00${parts}` where `parts` is each component passed through\n * `encodeURIComponent(String(part))` and `'/'`-joined. The null-byte separator\n * is illegal in a plain series name, so partitioned keys never collide with\n * unpartitioned ones; URI-encoding keeps any component containing `/` distinct\n * from a multi-component partition.\n *\n * @throws {ValidationError} if any partition component is empty after `String()`\n *   or is a non-finite number (`NaN`, `±Infinity`).\n */\nexport function resolveSequenceKey(series: string, opts?: SequenceOptions): string {\n  const partition = opts?.partition\n  if (!partition || partition.length === 0) return series\n  const parts = partition.map((p) => {\n    if (typeof p === 'number' && !Number.isFinite(p)) {\n      throw new ValidationError(`sequence partition component must be a finite number, got ${p}`)\n    }\n    const s = String(p)\n    if (s === '') {\n      throw new ValidationError('sequence partition component must not be empty')\n    }\n    return encodeURIComponent(s)\n  })\n  return `${series}\\x00${parts.join('/')}`\n}\n\nexport interface SequenceHandle {\n  /** Atomically allocate and return the next value (1, 2, 3, …). Deferred series resolve at the next pass. */\n  next(opts?: NextOptions): Promise<number>\n  /** Read the current value without allocating. Returns 0 if never used. */\n  peek(): Promise<number>\n  /**\n   * Set-if-greater: advance the counter to at least `n`. A no-op if the\n   * current value is already `>= n` (so it never rewinds), and `seedTo(0)` is\n   * a no-op. Idempotent and CAS-safe under concurrent `next()` / `seedTo()`.\n   *\n   * Use after a bundle / CSV import to fast-forward the counter past the\n   * highest imported serial, so subsequent `next()` calls cannot re-use a\n   * number that is already on a record.\n   *\n   * Online-only: throws {@link SequenceOfflineError} on a non-CAS store.\n   */\n  seedTo(n: number): Promise<void>\n}\n\nasync function sleepBackoff(attempt: number): Promise<void> {\n  // Exponential backoff with full jitter to break the thundering herd\n  // when many writers contend on the same counter row.\n  const ceil = Math.min(2 ** attempt, 32)\n  const ms = Math.floor(Math.random() * ceil)\n  await new Promise((r) => setTimeout(r, ms))\n}\n\n/** Per-call context the vault assembles to build a {@link SequenceStore}. */\nexport interface SequenceStoreOptions {\n  adapter: NoydbStore\n  vault: string\n  encrypted: boolean\n  getDEK: (collectionName: string) => Promise<EnclaveKey>\n  actor: string\n}\n\nexport class SequenceStore {\n  private readonly adapter: NoydbStore\n  private readonly vault: string\n  private readonly encrypted: boolean\n  private readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  private readonly actor: string\n  /**\n   * Memoized DEK promise. The `_sequences` collection DEK is created on\n   * first access; without sharing one promise, a burst of concurrent\n   * `next()` calls would each trigger DEK creation and diverge (one\n   * writer's ciphertext unreadable by another). One shared promise → one\n   * DEK.\n   */\n  private dekPromise: Promise<EnclaveKey> | null = null\n\n  constructor(opts: SequenceStoreOptions) {\n    this.adapter = opts.adapter\n    this.vault = opts.vault\n    this.encrypted = opts.encrypted\n    this.getDEK = opts.getDEK\n    this.actor = opts.actor\n  }\n\n  /** A handle bound to one sequence name. */\n  handle(name: string): SequenceHandle {\n    return {\n      next: () => this.next(name),\n      peek: () => this.peek(name),\n      seedTo: (n) => this.seedTo(name, n),\n    }\n  }\n\n  private assertOnline(): void {\n    if (this.adapter.capabilities?.casAtomic !== true) {\n      throw new SequenceOfflineError()\n    }\n  }\n\n  private dek(): Promise<EnclaveKey> {\n    if (!this.dekPromise) this.dekPromise = this.getDEK(SEQUENCE_COLLECTION)\n    return this.dekPromise\n  }\n\n  private async read(name: string): Promise<{ env: EncryptedEnvelope | null; value: number }> {\n    const env = await this.adapter.get(this.vault, SEQUENCE_COLLECTION, name)\n    if (!env) return { env: null, value: 0 }\n    const json = this.encrypted ? await openEnvelopeJson({ collection: SEQUENCE_COLLECTION, id: name }, env, await this.dek()) : (env._data ?? '')\n    const state = JSON.parse(json) as SequenceState\n    return { env, value: state.value }\n  }\n\n  private async encryptState(name: string, state: SequenceState, version: number): Promise<EncryptedEnvelope> {\n    const json = JSON.stringify(state)\n    if (!this.encrypted) {\n      return buildRecordEnvelope({ collection: SEQUENCE_COLLECTION, id: name, version }, { iv: '', data: json})\n    }\n    const identity = { collection: SEQUENCE_COLLECTION, id: name, version }\n    const { iv, data } = await encrypt(json, await this.dek(), buildRecordAad(identity))\n    return buildRecordEnvelope(identity, { iv, data})\n  }\n\n  async peek(name: string): Promise<number> {\n    return (await this.read(name)).value\n  }\n\n  async next(name: string): Promise<number> {\n    this.assertOnline()\n    let lastConflict: ConflictError | undefined\n    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {\n      const { env, value } = await this.read(name)\n      const nextValue = value + 1\n      const expectedVersion = env?._v ?? 0 // 0 ≡ \"must not yet exist\" (create)\n      const envelope = await this.encryptState(name, { value: nextValue }, expectedVersion + 1)\n      try {\n        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion)\n        return nextValue\n      } catch (err) {\n        if (isConflictError(err)) {\n          lastConflict = err\n          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt)\n          continue\n        }\n        throw err\n      }\n    }\n    void lastConflict\n    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS)\n  }\n\n  async seedTo(name: string, n: number): Promise<void> {\n    this.assertOnline()\n    if (n <= 0) return // set-if-greater: 0 (and any non-positive seed) is a no-op\n    let lastConflict: ConflictError | undefined\n    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {\n      const { env, value } = await this.read(name)\n      if (value >= n) return // already at or past the floor — no write, idempotent\n      const expectedVersion = env?._v ?? 0 // 0 ≡ \"must not yet exist\" (create)\n      const envelope = await this.encryptState(name, { value: n }, expectedVersion + 1)\n      try {\n        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion)\n        return\n      } catch (err) {\n        if (isConflictError(err)) {\n          lastConflict = err\n          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt)\n          continue\n        }\n        throw err\n      }\n    }\n    void lastConflict\n    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAWO,SAAS,eAAiC;AAC/C,SAAO;AAAA,IACL,YAAY,MAAM;AAChB,aAAO,IAAI,cAAc,IAAI;AAAA,IAC/B;AAAA,EACF;AACF;;;ACWO,IAAM,cAAgC;AAAA,EAC3C,cAA6B;AAC3B,UAAM,IAAI,wBAAwB;AAAA,EACpC;AACF;;;ACCO,IAAM,sBAAsB;AAKnC,IAAM,oBAAoB;AA2D1B,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AACtB,IAAM,sBAAsB;AAQrB,SAAS,sBACd,QACA,QACA,WAC4B;AAC5B,QAAM,QAAQ,aAAa,CAAC;AAC5B,aAAW,KAAK,OAAO,SAAS,gBAAgB,GAAG;AACjD,UAAM,QAAQ,EAAE,CAAC,KAAK;AACtB,QAAI,UAAU,MAAO;AACrB,QAAI,cAAc,KAAK,KAAK,EAAG;AAC/B,UAAM,YAAY,oBAAoB,KAAK,KAAK;AAChD,QAAI,WAAW;AACb,YAAM,MAAM,OAAO,UAAU,CAAC,CAAC;AAC/B,UAAI,OAAO,MAAM,QAAQ;AACvB,cAAM,IAAI;AAAA,UACR,aAAa,MAAM,sBAAsB,KAAK,iCAAiC,GAAG,cACpE,MAAM,MAAM;AAAA,QAC5B;AAAA,MACF;AACA;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,aAAa,MAAM,uCAAuC,KAAK;AAAA,IAEjE;AAAA,EACF;AACA,SAAO,CAAC,WACN,OAAO,QAAQ,kBAAkB,CAAC,MAAM,UAAkB;AACxD,QAAI,UAAU,MAAO,QAAO,OAAO,MAAM;AACzC,UAAM,WAAW,cAAc,KAAK,KAAK;AACzC,QAAI,SAAU,QAAO,OAAO,MAAM,EAAE,SAAS,OAAO,SAAS,CAAC,CAAC,GAAG,GAAG;AACrE,UAAM,YAAY,oBAAoB,KAAK,KAAK;AAChD,QAAI,UAAW,QAAO,OAAO,MAAM,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;AACxD,WAAO;AAAA,EACT,CAAC;AACL;AAeO,SAAS,mBAAmB,QAAgB,MAAgC;AACjF,QAAM,YAAY,MAAM;AACxB,MAAI,CAAC,aAAa,UAAU,WAAW,EAAG,QAAO;AACjD,QAAM,QAAQ,UAAU,IAAI,CAAC,MAAM;AACjC,QAAI,OAAO,MAAM,YAAY,CAAC,OAAO,SAAS,CAAC,GAAG;AAChD,YAAM,IAAI,gBAAgB,6DAA6D,CAAC,EAAE;AAAA,IAC5F;AACA,UAAM,IAAI,OAAO,CAAC;AAClB,QAAI,MAAM,IAAI;AACZ,YAAM,IAAI,gBAAgB,gDAAgD;AAAA,IAC5E;AACA,WAAO,mBAAmB,CAAC;AAAA,EAC7B,CAAC;AACD,SAAO,GAAG,MAAM,KAAO,MAAM,KAAK,GAAG,CAAC;AACxC;AAqBA,eAAe,aAAa,SAAgC;AAG1D,QAAM,OAAO,KAAK,IAAI,KAAK,SAAS,EAAE;AACtC,QAAM,KAAK,KAAK,MAAM,KAAK,OAAO,IAAI,IAAI;AAC1C,QAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC5C;AAWO,IAAM,gBAAN,MAAoB;AAAA,EACR;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQT,aAAyC;AAAA,EAEjD,YAAY,MAA4B;AACtC,SAAK,UAAU,KAAK;AACpB,SAAK,QAAQ,KAAK;AAClB,SAAK,YAAY,KAAK;AACtB,SAAK,SAAS,KAAK;AACnB,SAAK,QAAQ,KAAK;AAAA,EACpB;AAAA;AAAA,EAGA,OAAO,MAA8B;AACnC,WAAO;AAAA,MACL,MAAM,MAAM,KAAK,KAAK,IAAI;AAAA,MAC1B,MAAM,MAAM,KAAK,KAAK,IAAI;AAAA,MAC1B,QAAQ,CAAC,MAAM,KAAK,OAAO,MAAM,CAAC;AAAA,IACpC;AAAA,EACF;AAAA,EAEQ,eAAqB;AAC3B,QAAI,KAAK,QAAQ,cAAc,cAAc,MAAM;AACjD,YAAM,IAAI,qBAAqB;AAAA,IACjC;AAAA,EACF;AAAA,EAEQ,MAA2B;AACjC,QAAI,CAAC,KAAK,WAAY,MAAK,aAAa,KAAK,OAAO,mBAAmB;AACvE,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,KAAK,MAAyE;AAC1F,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,IAAI;AACxE,QAAI,CAAC,IAAK,QAAO,EAAE,KAAK,MAAM,OAAO,EAAE;AACvC,UAAM,OAAO,KAAK,YAAY,MAAM,iBAAiB,EAAE,YAAY,qBAAqB,IAAI,KAAK,GAAG,KAAK,MAAM,KAAK,IAAI,CAAC,IAAK,IAAI,SAAS;AAC3I,UAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,WAAO,EAAE,KAAK,OAAO,MAAM,MAAM;AAAA,EACnC;AAAA,EAEA,MAAc,aAAa,MAAc,OAAsB,SAA6C;AAC1G,UAAM,OAAO,KAAK,UAAU,KAAK;AACjC,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO,oBAAoB,EAAE,YAAY,qBAAqB,IAAI,MAAM,QAAQ,GAAG,EAAE,IAAI,IAAI,MAAM,KAAI,CAAC;AAAA,IAC1G;AACA,UAAM,WAAW,EAAE,YAAY,qBAAqB,IAAI,MAAM,QAAQ;AACtE,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,KAAK,IAAI,GAAG,eAAe,QAAQ,CAAC;AACnF,WAAO,oBAAoB,UAAU,EAAE,IAAI,KAAI,CAAC;AAAA,EAClD;AAAA,EAEA,MAAM,KAAK,MAA+B;AACxC,YAAQ,MAAM,KAAK,KAAK,IAAI,GAAG;AAAA,EACjC;AAAA,EAEA,MAAM,KAAK,MAA+B;AACxC,SAAK,aAAa;AAClB,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,YAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI;AAC3C,YAAM,YAAY,QAAQ;AAC1B,YAAM,kBAAkB,KAAK,MAAM;AACnC,YAAM,WAAW,MAAM,KAAK,aAAa,MAAM,EAAE,OAAO,UAAU,GAAG,kBAAkB,CAAC;AACxF,UAAI;AACF,cAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,MAAM,UAAU,eAAe;AACvF,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,YAAI,gBAAgB,GAAG,GAAG;AACxB,yBAAe;AACf,cAAI,UAAU,oBAAoB,EAAG,OAAM,aAAa,OAAO;AAC/D;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,SAAK;AACL,UAAM,IAAI,wBAAwB,MAAM,iBAAiB;AAAA,EAC3D;AAAA,EAEA,MAAM,OAAO,MAAc,GAA0B;AACnD,SAAK,aAAa;AAClB,QAAI,KAAK,EAAG;AACZ,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,YAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI;AAC3C,UAAI,SAAS,EAAG;AAChB,YAAM,kBAAkB,KAAK,MAAM;AACnC,YAAM,WAAW,MAAM,KAAK,aAAa,MAAM,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC;AAChF,UAAI;AACF,cAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,MAAM,UAAU,eAAe;AACvF;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,gBAAgB,GAAG,GAAG;AACxB,yBAAe;AACf,cAAI,UAAU,oBAAoB,EAAG,OAAM,aAAa,OAAO;AAC/D;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,SAAK;AACL,UAAM,IAAI,wBAAwB,MAAM,iBAAiB;AAAA,EAC3D;AACF;","names":[]}

package/dist/{chunk-2577DKXB.js → chunk-VHBKYN2J.js}

@@ -1,6 +1,6 @@
 import {
   buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
+} from "./chunk-EZGV6F47.js";
 
 // src/with-party/policy/storage.ts
 var META_COLLECTION = "_meta";
@@ -9,7 +9,7 @@ async function loadVaultPolicy(store, vault) {
   const envelope = await store.get(vault, META_COLLECTION, POLICY_RECORD_ID);
   if (!envelope) return void 0;
   try {
-    const parsed = JSON.parse(envelope._data);
+    const parsed = JSON.parse(envelope._data ?? "");
     if (!isVaultPolicy(parsed)) return void 0;
     return parsed;
   } catch {
@@ -36,4 +36,4 @@ export {
   loadVaultPolicy,
   saveVaultPolicy
 };
-//# sourceMappingURL=chunk-2577DKXB.js.map
+//# sourceMappingURL=chunk-VHBKYN2J.js.map

package/dist/chunk-VHBKYN2J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/policy/storage.ts"],"sourcesContent":["/**\n * Persistence helpers for the vault-level policy document\n * (`_meta/policy`). Mirrors the bypass-AES pattern used by\n * `_meta/handle` — the policy document is plain JSON, the envelope's\n * `_iv` field is left empty.\n *\n * @see https://github.com/noy-db/docs/blob/main/content/docs/services/session-tiers.md → Storage location\n *\n * @module\n */\nimport { buildRecordEnvelope } from '../../capsule/index.js'\nimport type { NoydbStore, VaultPolicy } from '../../kernel/types.js'\n\n/** Reserved collection name for vault-level metadata documents. */\nexport const META_COLLECTION = '_meta'\n/** Reserved id for the vault-level policy document. */\nexport const POLICY_RECORD_ID = 'policy'\n\n/**\n * Read the vault-level policy from `_meta/policy`. Returns `undefined`\n * when no policy has been persisted (fresh vault, or a vault written\n * before the policy module landed). The caller falls back to the\n * default preset.\n *\n * Tolerates corrupted documents the same way `_meta/handle` does: a\n * JSON parse failure surfaces as `undefined`, not a thrown error, so\n * a bad write never permanently locks a vault.\n */\nexport async function loadVaultPolicy(\n  store: NoydbStore,\n  vault: string,\n): Promise<VaultPolicy | undefined> {\n  const envelope = await store.get(vault, META_COLLECTION, POLICY_RECORD_ID)\n  if (!envelope) return undefined\n  try {\n    const parsed = JSON.parse(envelope._data ?? '') as unknown\n    if (!isVaultPolicy(parsed)) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Persist the vault-level policy at `_meta/policy`. Idempotent — call\n * once at vault creation and again on `db.updatePolicy()` invocations.\n */\nexport async function saveVaultPolicy(\n  store: NoydbStore,\n  vault: string,\n  policy: VaultPolicy,\n): Promise<void> {\n  const envelope = buildRecordEnvelope(\n    { collection: META_COLLECTION, id: POLICY_RECORD_ID, version: 1 },\n    { iv: '', data: JSON.stringify(policy) },\n  )\n  await store.put(vault, META_COLLECTION, POLICY_RECORD_ID, envelope)\n}\n\nfunction isVaultPolicy(x: unknown): x is VaultPolicy {\n  if (x === null || typeof x !== 'object') return false\n  if (!('gates' in x)) return false\n  const gates = (x as { gates: unknown }).gates\n  return gates !== null && typeof gates === 'object'\n}\n"],"mappings":";;;;;AAcO,IAAM,kBAAkB;AAExB,IAAM,mBAAmB;AAYhC,eAAsB,gBACpB,OACA,OACkC;AAClC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,iBAAiB,gBAAgB;AACzE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,SAAS,EAAE;AAC9C,QAAI,CAAC,cAAc,MAAM,EAAG,QAAO;AACnC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAsB,gBACpB,OACA,OACA,QACe;AACf,QAAM,WAAW;AAAA,IACf,EAAE,YAAY,iBAAiB,IAAI,kBAAkB,SAAS,EAAE;AAAA,IAChE,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,MAAM,EAAE;AAAA,EACzC;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,kBAAkB,QAAQ;AACpE;AAEA,SAAS,cAAc,GAA8B;AACnD,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,MAAI,EAAE,WAAW,GAAI,QAAO;AAC5B,QAAM,QAAS,EAAyB;AACxC,SAAO,UAAU,QAAQ,OAAO,UAAU;AAC5C;","names":[]}

package/dist/chunk-VHM7HCKB.js

@@ -0,0 +1,220 @@
+// src/kernel/query/live/incremental.ts
+var EMPTY_KEY = [];
+var REBUILT = { kind: "rebuilt" };
+function canMaintainIncrementally(plan, indexes) {
+  if (plan.joins.length > 0) return false;
+  if (plan.orderBy.some((o) => o.by === "label")) return false;
+  if (!clausesMaintainable(plan.clauses)) return false;
+  if (isIndexDriven(plan.clauses, indexes)) return false;
+  if (servedByOrderedIndex(plan, indexes)) return false;
+  return true;
+}
+function servedByOrderedIndex(plan, indexes) {
+  if (!indexes) return false;
+  if (plan.limit === void 0) return false;
+  if (plan.clauses.length > 0 || plan.orderBy.length !== 1) return false;
+  const order = plan.orderBy[0];
+  return order.by !== "label" && indexes.sorted(order.field);
+}
+function clausesMaintainable(clauses) {
+  for (const clause of clauses) {
+    if (clause.type === "crossJoin" || clause.type === "filter") return false;
+    if (clause.type === "group" && !clausesMaintainable(clause.clauses)) return false;
+  }
+  return true;
+}
+function isIndexDriven(clauses, indexes) {
+  if (!indexes) return false;
+  for (const clause of clauses) {
+    if (clause.type !== "field") continue;
+    if (!indexes.covers(clause.field) && !indexes.sorted(clause.field)) continue;
+    if (clause.via === void 0 && RANGE_OPS.has(clause.op)) return indexes.sorted(clause.field);
+    if (clause.via && clause.via.indexValue === void 0) continue;
+    const probe = clause.via ? clause.via.indexValue : clause.value;
+    if (clause.op === "==") return true;
+    if (clause.op === "in" && Array.isArray(probe)) return true;
+  }
+  return false;
+}
+var RANGE_OPS = /* @__PURE__ */ new Set(["<", "<=", ">", ">=", "between", "startsWith"]);
+var LiveMaintainer = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+  }
+  cfg;
+  entries = [];
+  memberById = /* @__PURE__ */ new Map();
+  seqById = /* @__PURE__ */ new Map();
+  maxSeq = -1;
+  /** Maintained state is stale — the next `rows()` rebuilds from the snapshot. */
+  stale = true;
+  /** True once a subscription is driving `apply()`. */
+  attached = false;
+  /**
+   * Start accepting deltas. Every read before this rebuilds from the snapshot,
+   * so a detached maintainer is just an eager executor.
+   *
+   * ⚠️ Call this in the SAME synchronous turn as a read — either immediately
+   * before the first `rows()` (the `.live()` path) or immediately after the
+   * initial one (the `.aggregate().live()` path, where the reduction computes
+   * before it subscribes). Attaching in a turn of its own would let a mutation
+   * slip past unrecorded: it arrives with no subscription to `apply()` it, and
+   * the maintained state would then be trusted while already behind.
+   */
+  attach() {
+    this.attached = true;
+  }
+  /**
+   * Stop accepting deltas — the subscription feeding them has gone. Every
+   * later read rebuilds, because nothing is keeping the state current any
+   * more. Without this, a `Reduction` whose `.live()` was stopped would keep
+   * serving its last maintained value from `.run()`.
+   */
+  detach() {
+    this.attached = false;
+  }
+  /** Force the next read to rebuild — the caller saw something it can't patch. */
+  invalidate() {
+    this.stale = true;
+  }
+  /**
+   * Fold one upstream change into the maintained set. A change with no
+   * payload (the source could not say which record moved) invalidates
+   * instead — the next read pays for a full rebuild.
+   */
+  apply(change) {
+    if (!this.attached || this.stale) return REBUILT;
+    if (!change) {
+      this.stale = true;
+      return REBUILT;
+    }
+    try {
+      return this.patch(change);
+    } catch (err) {
+      this.stale = true;
+      throw err;
+    }
+  }
+  /** The current result window — a fresh array on every call. */
+  rows() {
+    if (!this.attached || this.stale) this.rebuild();
+    const { offset, limit } = this.cfg;
+    const end = limit === void 0 ? this.entries.length : offset + limit;
+    const window = [];
+    for (let i = offset; i < end && i < this.entries.length; i++) {
+      window.push(this.entries[i].record);
+    }
+    return this.cfg.decode ? this.cfg.decode(window) : window;
+  }
+  /**
+   * The whole maintained set — every matching record, in maintained order,
+   * paired with its id and snapshot sequence. Ignores `offset`/`limit`/
+   * `decode` on purpose: this is the input a DERIVED maintainer rebuilds from,
+   * and grouped aggregation reduces the full match set, never a window.
+   *
+   * Rebuilds first when detached or stale, exactly as `rows()` does, so a
+   * caller can read it at any time.
+   */
+  maintainedEntries() {
+    if (!this.attached || this.stale) this.rebuild();
+    return this.entries;
+  }
+  /**
+   * Full recompute from the source snapshot. Equivalent to the eager path by
+   * construction: filter in snapshot order, then sort with snapshot sequence
+   * as the tiebreak — which is what a stable sort of the same input does.
+   */
+  rebuild() {
+    const snapshot = this.cfg.snapshotEntries();
+    this.entries = [];
+    this.memberById.clear();
+    this.seqById = /* @__PURE__ */ new Map();
+    for (let i = 0; i < snapshot.length; i++) {
+      const { id, record } = snapshot[i];
+      this.seqById.set(id, i);
+      if (this.cfg.matches(record)) {
+        const entry = { id, seq: i, record, key: this.keyOf(record) };
+        this.entries.push(entry);
+        this.memberById.set(id, entry);
+      }
+    }
+    this.maxSeq = snapshot.length - 1;
+    this.entries.sort((a, b) => this.compareEntries(a, b));
+    this.stale = false;
+  }
+  patch(change) {
+    const { id } = change;
+    const previous = this.memberById.get(id);
+    const record = change.action === "delete" ? void 0 : this.cfg.lookupById(id);
+    if (record === void 0) {
+      this.seqById.delete(id);
+      if (previous) this.removeEntry(previous);
+      return previous ? { kind: "patched", id, removed: { seq: previous.seq, record: previous.record } } : { kind: "patched", id };
+    }
+    let seq = this.seqById.get(id);
+    if (seq === void 0) {
+      seq = ++this.maxSeq;
+      this.seqById.set(id, seq);
+    }
+    const matches = this.cfg.matches(record);
+    if (previous) this.removeEntry(previous);
+    const removed = previous ? { seq: previous.seq, record: previous.record } : void 0;
+    if (!matches) {
+      return removed ? { kind: "patched", id, removed } : { kind: "patched", id };
+    }
+    const entry = { id, seq, record, key: this.keyOf(record) };
+    this.entries.splice(this.lowerBound(entry), 0, entry);
+    this.memberById.set(id, entry);
+    const inserted = { seq, record };
+    return removed ? { kind: "patched", id, removed, inserted } : { kind: "patched", id, inserted };
+  }
+  removeEntry(entry) {
+    const at = this.lowerBound(entry);
+    const index = this.entries[at] === entry ? at : this.entries.indexOf(entry);
+    if (index >= 0) this.entries.splice(index, 1);
+    this.memberById.delete(entry.id);
+  }
+  /** First index whose entry does not sort before `probe`. */
+  lowerBound(probe) {
+    let lo = 0;
+    let hi = this.entries.length;
+    while (lo < hi) {
+      const mid = lo + hi >>> 1;
+      if (this.compareEntries(this.entries[mid], probe) < 0) lo = mid + 1;
+      else hi = mid;
+    }
+    return lo;
+  }
+  keyOf(record) {
+    return this.cfg.order ? this.cfg.order.keyOf(record) : EMPTY_KEY;
+  }
+  /**
+   * The eager path's ordering, made total.
+   *
+   * `order.compare` is the query's own `compareOrderKeys`, the identical
+   * function `sortRecords` sorts with, so sort keys cannot be read or ranked
+   * differently here. It returns 0 for equal keys — it can do nothing else,
+   * having been handed the keys rather than the records — and the eager sort
+   * then leaves those in the order they arrived, which is candidate order,
+   * which is snapshot order given `canMaintainIncrementally` has refused every
+   * plan whose candidates arrive in index order. The sequence number below is
+   * that same resolution, made explicit so a binary search has an exact
+   * position to find. ⚠️ If the eager path ever grows a tiebreak of its own
+   * (an id, say), this stops agreeing with it — which is what
+   * `__tests__/query-incremental.test.ts`'s "inherits an order key plan that
+   * leaves equal keys to the tiebreak" is there to catch.
+   */
+  compareEntries(a, b) {
+    if (this.cfg.order) {
+      const cmp = this.cfg.order.compare(a.key, b.key);
+      if (cmp !== 0) return cmp;
+    }
+    return a.seq - b.seq;
+  }
+};
+
+export {
+  canMaintainIncrementally,
+  LiveMaintainer
+};
+//# sourceMappingURL=chunk-VHM7HCKB.js.map

package/dist/chunk-VHM7HCKB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/query/live/incremental.ts"],"sourcesContent":["/**\n * Incremental (delta) maintenance for `.live()` — #1341.\n *\n * A live query used to re-run its whole plan on every change event: scan\n * every record in the collection, re-evaluate every clause, re-sort, re-slice.\n * That is O(N log N) per keystroke-sized mutation and is what makes a reactive\n * list unusable at 10k+ rows.\n *\n * This module maintains the match set instead. Given a change event\n * `{ id, action }` it re-evaluates the predicate for **that record only** and\n * splices it into (or out of) a sorted array, so the per-change cost is\n * O(log k) comparisons + one array splice, where k is the number of MATCHING\n * records rather than N.\n *\n * ## The correctness contract\n *\n * The maintained array must be **identical** — same records, same order — to\n * what a full re-run would produce, at every step. Two things buy that:\n *\n *   1. **Membership is delegated.** The caller passes the very `matches()`\n *      closure the full pipeline uses (`filterRecords` over the plan's\n *      clauses), so a maintained membership decision cannot drift from an\n *      eagerly-computed one. This module never re-implements a predicate.\n *\n *   2. **The ordering is delegated too, and then made total.** The sort keys\n *      are read and ranked by the query's own order key plan — the same\n *      `buildOrderKeyPlan`/`orderKeyOf`/`compareOrderKeys` trio `sortRecords`\n *      sorts with and the keyset cursor compares against (#1346), so there is\n *      one definition of \"what order is this query in\" rather than two that\n *      drift. What that trio does NOT decide is equal keys: `compareOrderKeys`\n *      is handed two KEY TUPLES, not two records, so with equal keys its\n *      inputs are indistinguishable and 0 is the only answer it can give —\n *      structurally, not by convention. (#1346 breaks its own ties one level\n *      up, at the `page()` call site, never inside the comparator.) The eager\n *      path lets its stable sort resolve those, leaving them in candidate =\n *      snapshot order; we append each record's snapshot position as a final\n *      key, which is the same resolution stated explicitly — and being\n *      explicit is what lets a binary search land on an exact index.\n *\n *      ⚠️ That rests on one property of the backing cache: **snapshot order is\n *      `Map` insertion order.** `Map.set` on an existing key keeps its slot\n *      (so an update never moves a record), a new key appends (so a new record\n *      sorts last among ties), and `delete` removes without reordering the\n *      rest. `Collection`'s eager cache is a `Map`, so this holds. A source\n *      whose snapshot order is not insertion-stable must not be maintained —\n *      it would produce a correct SET in a wrong ORDER among ties.\n *\n * Anything not provably patchable falls back to a full rebuild: an unknown\n * (payload-less) change event, an error thrown mid-patch, or a plan shape\n * `canMaintainIncrementally()` refuses. **The fallback is the default** —\n * `canMaintainIncrementally` is a whitelist, not a blacklist.\n *\n * ## Stacking on top of it\n *\n * `apply()` reports what it did as a `PatchOutcome`, and `maintainedEntries()`\n * exposes the set with its snapshot sequence numbers. Together those let a\n * DERIVED maintainer mirror this one without forking its membership logic —\n * which is exactly what per-group maintenance for\n * `groupBy().aggregate().live()` does (`with-lookup/reduce/incremental-group.ts`).\n * A layer built that way inherits the whitelist and the fallback rather than\n * re-deciding them, so there is one answer to \"can this plan be maintained\"\n * rather than two that drift.\n */\n\nimport type { Clause } from '../predicate.js'\nimport type { OrderBy } from '../builder.js'\n\n/**\n * The delta a source hands to its `subscribe` callback: which record changed\n * and whether it was written or removed. Deliberately the same shape as the\n * hub-level `ChangeEvent` minus the vault/collection routing fields, which\n * the source has already filtered on.\n *\n * A source that cannot say WHICH record changed simply calls its callback with\n * no argument — every consumer treats that as \"rebuild from scratch\", which is\n * exactly the pre-#1341 behaviour.\n */\nexport interface SourceChange {\n  readonly id: string\n  readonly action: 'put' | 'delete'\n}\n\n/**\n * One side of a patch: a record that entered or left the maintained set, with\n * the snapshot sequence number it occupies. `seq` is what makes a patch\n * composable — a layer built ON TOP of the match set (grouped aggregation,\n * #1341's second half) can place the record in its own ordering without\n * re-deriving snapshot position, and sequence numbers are stable across an\n * update because `Map.set` on an existing key keeps its slot.\n */\nexport interface PatchDelta {\n  readonly seq: number\n  readonly record: unknown\n}\n\n/**\n * What `apply()` did, so a layer stacked on the maintained set can mirror it.\n *\n * `'rebuilt'` is the honest answer for everything that is NOT a clean patch —\n * a payload-less event, a detached maintainer, an already-stale one. A\n * consumer reading it must invalidate its own derived state; it must never\n * read `'rebuilt'` as \"nothing happened\".\n *\n * A `'patched'` outcome with neither `removed` nor `inserted` DID happen: a\n * non-member changed and stayed a non-member. That is a no-op for every\n * derived layer, which is exactly why it is reported as a patch rather than a\n * rebuild.\n */\nexport type PatchOutcome =\n  | { readonly kind: 'rebuilt' }\n  | {\n      readonly kind: 'patched'\n      readonly id: string\n      readonly removed?: PatchDelta\n      readonly inserted?: PatchDelta\n    }\n\n/** An id-paired member of the maintained set, in maintained order. */\nexport interface MaintainedEntry {\n  readonly id: string\n  readonly seq: number\n  readonly record: unknown\n}\n\n/**\n * The subset of a query source a DERIVED maintainer needs (#1341, grouped\n * half). Deliberately a kernel type even though its only consumer today is\n * the reduce service: everything in it is a kernel concept, and declaring it\n * here is what lets `kernel/query/builder.ts` hand one to the service without\n * a new spine to service import specifier.\n */\nexport interface GroupMaintenanceSource {\n  /**\n   * Id-paired snapshot, in snapshot (Map insertion) order.\n   *\n   * ⚠️ Declared as function-typed PROPERTIES, not methods: every member here\n   * is a standalone closure the query builder binds before handing it over,\n   * and property syntax says so — a method declaration would invite a `this`\n   * these closures do not have.\n   */\n  readonly snapshotEntries: () => readonly { id: string; record: unknown }[]\n  /** O(1) current-state lookup for the AFTER state of a change. */\n  readonly lookupById: (id: string) => unknown\n  /** The plan's membership test — the same one the eager path runs. */\n  readonly matches: (record: unknown) => boolean\n  /**\n   * Per-record projection the eager grouping pipeline applies AFTER filtering\n   * and before bucketing — today only `projectDateTruncKeys` (#1350). Applied\n   * per record here because the eager path applies it per record too; a\n   * projection that read across records could not be maintained and must not\n   * be plumbed through this hook.\n   */\n  readonly project?: (record: unknown) => unknown\n}\n\n/** Everything the maintainer needs, supplied by the query builder. */\nexport interface MaintainerConfig {\n  /** Id-paired snapshot, in snapshot (Map insertion) order. */\n  snapshotEntries(): readonly { id: string; record: unknown }[]\n  /** O(1) current-state lookup, used to read the AFTER state of a change. */\n  lookupById(id: string): unknown\n  /** The plan's membership test — the same one the eager path runs. */\n  matches(record: unknown): boolean\n  /**\n   * The plan's ordering, in the same key-plan shape `sortRecords` and the\n   * keyset cursor use (#1346): read a record's sort-key tuple, and compare two\n   * of those tuples. `undefined` when the plan has no `orderBy` — result order\n   * is then snapshot order alone.\n   *\n   * `compare` need not be a total order: it returns 0 for equal sort keys,\n   * exactly as it does for the eager sort, and the maintainer resolves those\n   * ties by snapshot sequence.\n   */\n  order?: {\n    keyOf(record: unknown): unknown[]\n    compare(a: readonly unknown[], b: readonly unknown[]): number\n  }\n  /** Plan offset (0 when unset). */\n  offset: number\n  /** Plan limit, or undefined for \"all matching rows\". */\n  limit: number | undefined\n  /**\n   * Post-slice projection the eager path applies to the emitted window (Via\n   * result decoding). Applied to the window, never to the maintained records,\n   * mirroring `toArray()` which decodes AFTER filter/sort/slice.\n   */\n  decode?: (rows: readonly unknown[]) => unknown[]\n}\n\nconst EMPTY_KEY: readonly unknown[] = []\n\n/** Shared 'you cannot patch from this' answer — allocation-free on the hot path. */\nconst REBUILT: PatchOutcome = { kind: 'rebuilt' }\n\ninterface Entry {\n  readonly id: string\n  readonly seq: number\n  readonly record: unknown\n  /**\n   * The record's sort-key tuple, computed once when the entry is built. Every\n   * write to a record re-enters it, so a cached key is never stale — and the\n   * binary search then compares tuples instead of re-reading fields at every\n   * probe.\n   */\n  readonly key: readonly unknown[]\n}\n\n/**\n * Reject any plan whose result set cannot be provably patched from a single\n * record's delta. Everything this refuses still works — it just re-runs in\n * full, as it did before #1341.\n *\n * Refused, and why:\n *   - **joins / crossJoin** — a row's membership depends on other collections'\n *     records, so a left-side delta does not determine the new result.\n *   - **`.filter(fn)`** — an arbitrary consumer closure with no determinism\n *     guarantee. `r => r.due < Date.now()` changes its verdict for records that\n *     never changed, which a full re-run observes and a patch cannot.\n *     (`.wherePredicate()` is admitted: it is DECLARED deterministic and\n *     carries a body hash saying so.)\n *   - **`orderBy(..., { by: 'label' })`** — the label maps are built eagerly\n *     from a dictionary collection's snapshot, so the comparator would be\n *     captured at subscribe time and go stale when that dictionary changes.\n *   - **an index-driven plan** — the rows then reach the pipeline in INDEX\n *     order rather than snapshot order, so snapshot sequence is the wrong\n *     tiebreak among equal sort keys. Three shapes qualify, and all three are\n *     refused: an `==`/`in` clause on any indexed field, a range clause on a\n *     SORTED-indexed field, and #1344's `orderedIndexRows()` page, which\n *     serves `orderBy(f).limit(n)` straight off a sorted index with no\n *     predicate at all. Little is lost: each of those re-runs is already\n *     proportional to the page or the match set, not to the collection.\n */\nexport function canMaintainIncrementally(\n  plan: {\n    readonly clauses: readonly Clause[]\n    readonly orderBy: readonly OrderBy[]\n    readonly limit?: number | undefined\n    readonly joins: readonly unknown[]\n  },\n  indexes: IndexProbe | null,\n): boolean {\n  if (plan.joins.length > 0) return false\n  if (plan.orderBy.some(o => o.by === 'label')) return false\n  if (!clausesMaintainable(plan.clauses)) return false\n  if (isIndexDriven(plan.clauses, indexes)) return false\n  if (servedByOrderedIndex(plan, indexes)) return false\n  return true\n}\n\n/**\n * What the maintainer needs to know about the source's indexes: which fields\n * carry ANY index, and which carry a SORTED one. Both matter — the sorted\n * index feeds two paths (#1344) the hash index does not.\n */\nexport interface IndexProbe {\n  covers(field: string): boolean\n  sorted(field: string): boolean\n}\n\n/**\n * Would #1344's `orderedIndexRows()` serve this plan off a sorted index?\n *\n * Mirrors the cheap half of its preconditions and deliberately stops there:\n * the remaining ones (full index coverage of the snapshot, no Via ordering)\n * cost a snapshot walk to check, and answering \"maybe\" here only ever costs a\n * fallback. The page it would serve is in stored-key order, and among records\n * with EQUAL keys that order is the index's, not the cache's — which is\n * precisely the tie resolution the maintainer would get wrong.\n */\nfunction servedByOrderedIndex(\n  plan: {\n    readonly clauses: readonly Clause[]\n    readonly orderBy: readonly OrderBy[]\n    readonly limit?: number | undefined\n  },\n  indexes: IndexProbe | null,\n): boolean {\n  if (!indexes) return false\n  if (plan.limit === undefined) return false\n  if (plan.clauses.length > 0 || plan.orderBy.length !== 1) return false\n  const order = plan.orderBy[0]!\n  return order.by !== 'label' && indexes.sorted(order.field)\n}\n\nfunction clausesMaintainable(clauses: readonly Clause[]): boolean {\n  for (const clause of clauses) {\n    if (clause.type === 'crossJoin' || clause.type === 'filter') return false\n    if (clause.type === 'group' && !clausesMaintainable(clause.clauses)) return false\n  }\n  return true\n}\n\n/**\n * Would `candidateRecords()` take the index fast path for this plan?\n *\n * Deliberately more eager to say \"yes\" than `candidateRecords` itself (which\n * additionally requires the index probe to return a hit set) — erring that way\n * costs a fallback, never a wrong answer.\n */\nfunction isIndexDriven(clauses: readonly Clause[], indexes: IndexProbe | null): boolean {\n  if (!indexes) return false\n  for (const clause of clauses) {\n    if (clause.type !== 'field') continue\n    if (!indexes.covers(clause.field) && !indexes.sorted(clause.field)) continue\n    // #1344: a range probe reads the SORTED index, and only for a clause the\n    // Via layer has not claimed — mirroring `candidateRecords`'s own branch.\n    // On a hash-only field `lookupRange` returns null and the plan scans, so\n    // that case is left maintainable.\n    if (clause.via === undefined && RANGE_OPS.has(clause.op)) return indexes.sorted(clause.field)\n    if (clause.via && clause.via.indexValue === undefined) continue\n    const probe = clause.via ? clause.via.indexValue : clause.value\n    if (clause.op === '==') return true\n    if (clause.op === 'in' && Array.isArray(probe)) return true\n  }\n  return false\n}\n\n/** The operators #1344's `lookupRange` serves off a sorted index. */\nconst RANGE_OPS: ReadonlySet<string> = new Set(['<', '<=', '>', '>=', 'between', 'startsWith'])\n\n/**\n * The maintained result set behind one live query.\n *\n * Lifecycle: `attach()` when a subscription opens, `apply(change)` per upstream\n * event, `rows()` to read the current window. Before `attach()` (and after any\n * fallback) `rows()` recomputes from the snapshot, so a detached maintainer is\n * simply an eager executor and is safe to read at any time.\n */\nexport class LiveMaintainer {\n  private entries: Entry[] = []\n  private readonly memberById = new Map<string, Entry>()\n  private seqById = new Map<string, number>()\n  private maxSeq = -1\n  /** Maintained state is stale — the next `rows()` rebuilds from the snapshot. */\n  private stale = true\n  /** True once a subscription is driving `apply()`. */\n  private attached = false\n\n  constructor(private readonly cfg: MaintainerConfig) {}\n\n  /**\n   * Start accepting deltas. Every read before this rebuilds from the snapshot,\n   * so a detached maintainer is just an eager executor.\n   *\n   * ⚠️ Call this in the SAME synchronous turn as a read — either immediately\n   * before the first `rows()` (the `.live()` path) or immediately after the\n   * initial one (the `.aggregate().live()` path, where the reduction computes\n   * before it subscribes). Attaching in a turn of its own would let a mutation\n   * slip past unrecorded: it arrives with no subscription to `apply()` it, and\n   * the maintained state would then be trusted while already behind.\n   */\n  attach(): void {\n    this.attached = true\n  }\n\n  /**\n   * Stop accepting deltas — the subscription feeding them has gone. Every\n   * later read rebuilds, because nothing is keeping the state current any\n   * more. Without this, a `Reduction` whose `.live()` was stopped would keep\n   * serving its last maintained value from `.run()`.\n   */\n  detach(): void {\n    this.attached = false\n  }\n\n  /** Force the next read to rebuild — the caller saw something it can't patch. */\n  invalidate(): void {\n    this.stale = true\n  }\n\n  /**\n   * Fold one upstream change into the maintained set. A change with no\n   * payload (the source could not say which record moved) invalidates\n   * instead — the next read pays for a full rebuild.\n   */\n  apply(change: SourceChange | undefined): PatchOutcome {\n    if (!this.attached || this.stale) return REBUILT\n    if (!change) {\n      this.stale = true\n      return REBUILT\n    }\n    try {\n      return this.patch(change)\n    } catch (err) {\n      // A predicate threw mid-patch: the maintained set may be half-updated,\n      // so drop it rather than serve a set we can no longer vouch for. The\n      // error still reaches the consumer — the rebuild on the next read runs\n      // the same predicate and throws the same way.\n      this.stale = true\n      throw err\n    }\n  }\n\n  /** The current result window — a fresh array on every call. */\n  rows(): unknown[] {\n    if (!this.attached || this.stale) this.rebuild()\n    const { offset, limit } = this.cfg\n    const end = limit === undefined ? this.entries.length : offset + limit\n    const window: unknown[] = []\n    for (let i = offset; i < end && i < this.entries.length; i++) {\n      window.push(this.entries[i]!.record)\n    }\n    return this.cfg.decode ? this.cfg.decode(window) : window\n  }\n\n  /**\n   * The whole maintained set — every matching record, in maintained order,\n   * paired with its id and snapshot sequence. Ignores `offset`/`limit`/\n   * `decode` on purpose: this is the input a DERIVED maintainer rebuilds from,\n   * and grouped aggregation reduces the full match set, never a window.\n   *\n   * Rebuilds first when detached or stale, exactly as `rows()` does, so a\n   * caller can read it at any time.\n   */\n  maintainedEntries(): readonly MaintainedEntry[] {\n    if (!this.attached || this.stale) this.rebuild()\n    return this.entries\n  }\n\n  /**\n   * Full recompute from the source snapshot. Equivalent to the eager path by\n   * construction: filter in snapshot order, then sort with snapshot sequence\n   * as the tiebreak — which is what a stable sort of the same input does.\n   */\n  private rebuild(): void {\n    const snapshot = this.cfg.snapshotEntries()\n    this.entries = []\n    this.memberById.clear()\n    this.seqById = new Map()\n    for (let i = 0; i < snapshot.length; i++) {\n      const { id, record } = snapshot[i]!\n      this.seqById.set(id, i)\n      if (this.cfg.matches(record)) {\n        const entry: Entry = { id, seq: i, record, key: this.keyOf(record) }\n        this.entries.push(entry)\n        this.memberById.set(id, entry)\n      }\n    }\n    this.maxSeq = snapshot.length - 1\n    this.entries.sort((a, b) => this.compareEntries(a, b))\n    this.stale = false\n  }\n\n  private patch(change: SourceChange): PatchOutcome {\n    const { id } = change\n    const previous = this.memberById.get(id)\n    const record = change.action === 'delete' ? undefined : this.cfg.lookupById(id)\n\n    if (record === undefined) {\n      // Gone. Its snapshot slot is released too: a later re-add of the same id\n      // appends to the cache's Map, so it must earn a fresh sequence number.\n      this.seqById.delete(id)\n      if (previous) this.removeEntry(previous)\n      return previous\n        ? { kind: 'patched', id, removed: { seq: previous.seq, record: previous.record } }\n        : { kind: 'patched', id }\n    }\n\n    let seq = this.seqById.get(id)\n    if (seq === undefined) {\n      // A key the snapshot did not carry — `Map.set` appended it, so it sorts\n      // after every record we have seen.\n      seq = ++this.maxSeq\n      this.seqById.set(id, seq)\n    }\n\n    const matches = this.cfg.matches(record)\n    if (previous) this.removeEntry(previous)\n    const removed = previous ? { seq: previous.seq, record: previous.record } : undefined\n    if (!matches) {\n      return removed ? { kind: 'patched', id, removed } : { kind: 'patched', id }\n    }\n\n    const entry: Entry = { id, seq, record, key: this.keyOf(record) }\n    this.entries.splice(this.lowerBound(entry), 0, entry)\n    this.memberById.set(id, entry)\n    const inserted = { seq, record }\n    return removed ? { kind: 'patched', id, removed, inserted } : { kind: 'patched', id, inserted }\n  }\n\n  private removeEntry(entry: Entry): void {\n    // The comparator is a total order (sequence numbers are unique), so the\n    // binary search lands exactly on the entry. The linear scan is a belt-and-\n    // braces fallback for a source that broke the ordering assumption.\n    const at = this.lowerBound(entry)\n    const index = this.entries[at] === entry ? at : this.entries.indexOf(entry)\n    if (index >= 0) this.entries.splice(index, 1)\n    this.memberById.delete(entry.id)\n  }\n\n  /** First index whose entry does not sort before `probe`. */\n  private lowerBound(probe: Entry): number {\n    let lo = 0\n    let hi = this.entries.length\n    while (lo < hi) {\n      const mid = (lo + hi) >>> 1\n      if (this.compareEntries(this.entries[mid]!, probe) < 0) lo = mid + 1\n      else hi = mid\n    }\n    return lo\n  }\n\n  private keyOf(record: unknown): readonly unknown[] {\n    return this.cfg.order ? this.cfg.order.keyOf(record) : EMPTY_KEY\n  }\n\n  /**\n   * The eager path's ordering, made total.\n   *\n   * `order.compare` is the query's own `compareOrderKeys`, the identical\n   * function `sortRecords` sorts with, so sort keys cannot be read or ranked\n   * differently here. It returns 0 for equal keys — it can do nothing else,\n   * having been handed the keys rather than the records — and the eager sort\n   * then leaves those in the order they arrived, which is candidate order,\n   * which is snapshot order given `canMaintainIncrementally` has refused every\n   * plan whose candidates arrive in index order. The sequence number below is\n   * that same resolution, made explicit so a binary search has an exact\n   * position to find. ⚠️ If the eager path ever grows a tiebreak of its own\n   * (an id, say), this stops agreeing with it — which is what\n   * `__tests__/query-incremental.test.ts`'s \"inherits an order key plan that\n   * leaves equal keys to the tiebreak\" is there to catch.\n   */\n  private compareEntries(a: Entry, b: Entry): number {\n    if (this.cfg.order) {\n      const cmp = this.cfg.order.compare(a.key, b.key)\n      if (cmp !== 0) return cmp\n    }\n    return a.seq - b.seq\n  }\n}\n"],"mappings":";AA6LA,IAAM,YAAgC,CAAC;AAGvC,IAAM,UAAwB,EAAE,MAAM,UAAU;AAwCzC,SAAS,yBACd,MAMA,SACS;AACT,MAAI,KAAK,MAAM,SAAS,EAAG,QAAO;AAClC,MAAI,KAAK,QAAQ,KAAK,OAAK,EAAE,OAAO,OAAO,EAAG,QAAO;AACrD,MAAI,CAAC,oBAAoB,KAAK,OAAO,EAAG,QAAO;AAC/C,MAAI,cAAc,KAAK,SAAS,OAAO,EAAG,QAAO;AACjD,MAAI,qBAAqB,MAAM,OAAO,EAAG,QAAO;AAChD,SAAO;AACT;AAsBA,SAAS,qBACP,MAKA,SACS;AACT,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,KAAK,UAAU,OAAW,QAAO;AACrC,MAAI,KAAK,QAAQ,SAAS,KAAK,KAAK,QAAQ,WAAW,EAAG,QAAO;AACjE,QAAM,QAAQ,KAAK,QAAQ,CAAC;AAC5B,SAAO,MAAM,OAAO,WAAW,QAAQ,OAAO,MAAM,KAAK;AAC3D;AAEA,SAAS,oBAAoB,SAAqC;AAChE,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,SAAS,eAAe,OAAO,SAAS,SAAU,QAAO;AACpE,QAAI,OAAO,SAAS,WAAW,CAAC,oBAAoB,OAAO,OAAO,EAAG,QAAO;AAAA,EAC9E;AACA,SAAO;AACT;AASA,SAAS,cAAc,SAA4B,SAAqC;AACtF,MAAI,CAAC,QAAS,QAAO;AACrB,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,SAAS,QAAS;AAC7B,QAAI,CAAC,QAAQ,OAAO,OAAO,KAAK,KAAK,CAAC,QAAQ,OAAO,OAAO,KAAK,EAAG;AAKpE,QAAI,OAAO,QAAQ,UAAa,UAAU,IAAI,OAAO,EAAE,EAAG,QAAO,QAAQ,OAAO,OAAO,KAAK;AAC5F,QAAI,OAAO,OAAO,OAAO,IAAI,eAAe,OAAW;AACvD,UAAM,QAAQ,OAAO,MAAM,OAAO,IAAI,aAAa,OAAO;AAC1D,QAAI,OAAO,OAAO,KAAM,QAAO;AAC/B,QAAI,OAAO,OAAO,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAAA,EACzD;AACA,SAAO;AACT;AAGA,IAAM,YAAiC,oBAAI,IAAI,CAAC,KAAK,MAAM,KAAK,MAAM,WAAW,YAAY,CAAC;AAUvF,IAAM,iBAAN,MAAqB;AAAA,EAU1B,YAA6B,KAAuB;AAAvB;AAAA,EAAwB;AAAA,EAAxB;AAAA,EATrB,UAAmB,CAAC;AAAA,EACX,aAAa,oBAAI,IAAmB;AAAA,EAC7C,UAAU,oBAAI,IAAoB;AAAA,EAClC,SAAS;AAAA;AAAA,EAET,QAAQ;AAAA;AAAA,EAER,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAenB,SAAe;AACb,SAAK,WAAW;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAe;AACb,SAAK,WAAW;AAAA,EAClB;AAAA;AAAA,EAGA,aAAmB;AACjB,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,QAAgD;AACpD,QAAI,CAAC,KAAK,YAAY,KAAK,MAAO,QAAO;AACzC,QAAI,CAAC,QAAQ;AACX,WAAK,QAAQ;AACb,aAAO;AAAA,IACT;AACA,QAAI;AACF,aAAO,KAAK,MAAM,MAAM;AAAA,IAC1B,SAAS,KAAK;AAKZ,WAAK,QAAQ;AACb,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,OAAkB;AAChB,QAAI,CAAC,KAAK,YAAY,KAAK,MAAO,MAAK,QAAQ;AAC/C,UAAM,EAAE,QAAQ,MAAM,IAAI,KAAK;AAC/B,UAAM,MAAM,UAAU,SAAY,KAAK,QAAQ,SAAS,SAAS;AACjE,UAAM,SAAoB,CAAC;AAC3B,aAAS,IAAI,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,QAAQ,KAAK;AAC5D,aAAO,KAAK,KAAK,QAAQ,CAAC,EAAG,MAAM;AAAA,IACrC;AACA,WAAO,KAAK,IAAI,SAAS,KAAK,IAAI,OAAO,MAAM,IAAI;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,oBAAgD;AAC9C,QAAI,CAAC,KAAK,YAAY,KAAK,MAAO,MAAK,QAAQ;AAC/C,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,UAAgB;AACtB,UAAM,WAAW,KAAK,IAAI,gBAAgB;AAC1C,SAAK,UAAU,CAAC;AAChB,SAAK,WAAW,MAAM;AACtB,SAAK,UAAU,oBAAI,IAAI;AACvB,aAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,YAAM,EAAE,IAAI,OAAO,IAAI,SAAS,CAAC;AACjC,WAAK,QAAQ,IAAI,IAAI,CAAC;AACtB,UAAI,KAAK,IAAI,QAAQ,MAAM,GAAG;AAC5B,cAAM,QAAe,EAAE,IAAI,KAAK,GAAG,QAAQ,KAAK,KAAK,MAAM,MAAM,EAAE;AACnE,aAAK,QAAQ,KAAK,KAAK;AACvB,aAAK,WAAW,IAAI,IAAI,KAAK;AAAA,MAC/B;AAAA,IACF;AACA,SAAK,SAAS,SAAS,SAAS;AAChC,SAAK,QAAQ,KAAK,CAAC,GAAG,MAAM,KAAK,eAAe,GAAG,CAAC,CAAC;AACrD,SAAK,QAAQ;AAAA,EACf;AAAA,EAEQ,MAAM,QAAoC;AAChD,UAAM,EAAE,GAAG,IAAI;AACf,UAAM,WAAW,KAAK,WAAW,IAAI,EAAE;AACvC,UAAM,SAAS,OAAO,WAAW,WAAW,SAAY,KAAK,IAAI,WAAW,EAAE;AAE9E,QAAI,WAAW,QAAW;AAGxB,WAAK,QAAQ,OAAO,EAAE;AACtB,UAAI,SAAU,MAAK,YAAY,QAAQ;AACvC,aAAO,WACH,EAAE,MAAM,WAAW,IAAI,SAAS,EAAE,KAAK,SAAS,KAAK,QAAQ,SAAS,OAAO,EAAE,IAC/E,EAAE,MAAM,WAAW,GAAG;AAAA,IAC5B;AAEA,QAAI,MAAM,KAAK,QAAQ,IAAI,EAAE;AAC7B,QAAI,QAAQ,QAAW;AAGrB,YAAM,EAAE,KAAK;AACb,WAAK,QAAQ,IAAI,IAAI,GAAG;AAAA,IAC1B;AAEA,UAAM,UAAU,KAAK,IAAI,QAAQ,MAAM;AACvC,QAAI,SAAU,MAAK,YAAY,QAAQ;AACvC,UAAM,UAAU,WAAW,EAAE,KAAK,SAAS,KAAK,QAAQ,SAAS,OAAO,IAAI;AAC5E,QAAI,CAAC,SAAS;AACZ,aAAO,UAAU,EAAE,MAAM,WAAW,IAAI,QAAQ,IAAI,EAAE,MAAM,WAAW,GAAG;AAAA,IAC5E;AAEA,UAAM,QAAe,EAAE,IAAI,KAAK,QAAQ,KAAK,KAAK,MAAM,MAAM,EAAE;AAChE,SAAK,QAAQ,OAAO,KAAK,WAAW,KAAK,GAAG,GAAG,KAAK;AACpD,SAAK,WAAW,IAAI,IAAI,KAAK;AAC7B,UAAM,WAAW,EAAE,KAAK,OAAO;AAC/B,WAAO,UAAU,EAAE,MAAM,WAAW,IAAI,SAAS,SAAS,IAAI,EAAE,MAAM,WAAW,IAAI,SAAS;AAAA,EAChG;AAAA,EAEQ,YAAY,OAAoB;AAItC,UAAM,KAAK,KAAK,WAAW,KAAK;AAChC,UAAM,QAAQ,KAAK,QAAQ,EAAE,MAAM,QAAQ,KAAK,KAAK,QAAQ,QAAQ,KAAK;AAC1E,QAAI,SAAS,EAAG,MAAK,QAAQ,OAAO,OAAO,CAAC;AAC5C,SAAK,WAAW,OAAO,MAAM,EAAE;AAAA,EACjC;AAAA;AAAA,EAGQ,WAAW,OAAsB;AACvC,QAAI,KAAK;AACT,QAAI,KAAK,KAAK,QAAQ;AACtB,WAAO,KAAK,IAAI;AACd,YAAM,MAAO,KAAK,OAAQ;AAC1B,UAAI,KAAK,eAAe,KAAK,QAAQ,GAAG,GAAI,KAAK,IAAI,EAAG,MAAK,MAAM;AAAA,UAC9D,MAAK;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,MAAM,QAAqC;AACjD,WAAO,KAAK,IAAI,QAAQ,KAAK,IAAI,MAAM,MAAM,MAAM,IAAI;AAAA,EACzD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBQ,eAAe,GAAU,GAAkB;AACjD,QAAI,KAAK,IAAI,OAAO;AAClB,YAAM,MAAM,KAAK,IAAI,MAAM,QAAQ,EAAE,KAAK,EAAE,GAAG;AAC/C,UAAI,QAAQ,EAAG,QAAO;AAAA,IACxB;AACA,WAAO,EAAE,MAAM,EAAE;AAAA,EACnB;AACF;","names":[]}

package/dist/{chunk-ZHKOPKE3.js → chunk-VKI2EB3N.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-5D2ALSM5.js";
 import {
   RecordCodec
-} from "./chunk-4ZS56W5S.js";
+} from "./chunk-EZGV6F47.js";
 
 // src/with-formula/materialized-views/stale.ts
-var loadMVExecutor = lazy(() => import("./executor-7UQ3BZ4F.js"));
+var loadMVExecutor = lazy(() => import("./executor-FMPVN6DT.js"));
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 function markMVStale(registry, mvName) {
   let set = _staleByRegistry.get(registry);
@@ -134,4 +134,4 @@ export {
   clearMVStale,
   clearMVStaleFully
 };
-//# sourceMappingURL=chunk-ZHKOPKE3.js.map
+//# sourceMappingURL=chunk-VKI2EB3N.js.map

package/dist/chunk-VKI2EB3N.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/materialized-views/stale.ts"],"sourcesContent":["import type { Collection } from '../../kernel/collection.js'\nimport type { MaterializedViewExecutor as MVExecutorType } from './executor.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { PutDerivedOutputCtx } from '../../kernel/via/dispatch.js'\nimport type { MaterializedViewRegistry, RegisteredMV } from './registry.js'\n// Type-only — runtime class loaded via dynamic import in\n// `resolveStaleMVOnRead` only when a stale flag actually fires.\n// Keeps the executor chunk out of the floor bundle (mirrors v1 floor-bundle isolation).\nimport type { MVQueryContext } from './types.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { RecordCodec } from '../../capsule/index.js'\n\nimport { lazy } from '../../kernel/lazy.js'\n\n/** #846c — one memoized binding instead of a cast at the call site. */\nconst loadMVExecutor = lazy(() => import('./executor.js'))\n\n/**\n * Accessor shape passed in from the owning Vault. Provides the\n * registry (used as a stable WeakMap key + to look up MVs by output\n * collection) and the runtime context the lazy refresh needs.\n * Mirrors v1's `DerivationStaleAccessor`.\n */\nexport interface MVStaleAccessor {\n  registry(): MaterializedViewRegistry\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  getCollection(name: string): Collection<any>\n  getActiveTxContext(): TxContext | null\n  getQueryContext(): MVQueryContext\n}\n\n/**\n * In-memory stale map keyed by `MaterializedViewRegistry` instance\n * (stable per vault). Each registry maps to a set of MV names that\n * have at least one pending source-change requiring a re-materialize.\n *\n * Persistence across vault close is NOT implemented in this iteration\n * (concern flagged in the v2 spec, mirrors v1 derivation behavior).\n * On vault re-open, the unset stale flag is interpreted as \"fresh\" —\n * `vault.refreshView(name)` is the explicit recompute escape hatch.\n *\n * @internal\n */\nconst _staleByRegistry = new WeakMap<MaterializedViewRegistry, Set<string>>()\n\n/**\n * Mark an MV as stale. Called from `Collection.dispatchMaterializedViews`\n * when a source-write fires for a `refresh: 'lazy'` MV.\n *\n * @internal\n */\nexport function markMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  let set = _staleByRegistry.get(registry)\n  if (!set) {\n    set = new Set()\n    _staleByRegistry.set(registry, set)\n  }\n  set.add(mvName)\n}\n\n/**\n * Test-only: check whether a given MV name is currently flagged stale\n * against a registry. Exported so the regression suite can pin the\n * stale-bit lifecycle without touching the internal `WeakMap`.\n *\n * @internal\n */\nexport function isMVStale(registry: MaterializedViewRegistry, mvName: string): boolean {\n  return _staleByRegistry.get(registry)?.has(mvName) ?? false\n}\n\n/**\n * Reserved collection holding CONTENT-FREE lazy-stale markers (record id =\n * MV name, plaintext `_iv: ''` envelope, no payload) — mirrors the\n * `_meta`/schema-fence marker envelope shape. Written only from the\n * delete/forget/elevate dispatcher (#736); ordinary source writes stay\n * in-memory-only (the cheap path). Read via the adapter directly, never\n * through `vault.collection()` — same reserved-collection convention as\n * `_subject_index`/`_meta`.\n */\nexport const MV_STALE_COLLECTION = '_mv_stale'\n\n/**\n * Once-per-registry hydrate guard for `resolveStaleMVOnRead`'s persisted-marker fold-in.\n * Stores the in-flight/settled PROMISE (not a boolean) — a concurrent cold first read that\n * arrives while the hydrate is still awaiting `adapter.list` must await the SAME promise\n * rather than observing \"already hydrating\" and reading an empty pending set (#736\n * whole-branch review).\n */\nconst _hydratedByRegistry = new WeakMap<MaterializedViewRegistry, Promise<void>>()\n\n/** The adapter + vault name backing any collection in this vault (all collections share both). */\nfunction storeOf(accessor: MVStaleAccessor, collectionName: string): { adapter: NoydbStore; vault: string } {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const c = accessor.getCollection(collectionName) as any\n  return { adapter: c.adapter as NoydbStore, vault: c.vault as string }\n}\n\nasync function writeMVStaleMarker(adapter: NoydbStore, vault: string, mvName: string): Promise<void> {\n  // Content-free — the marker's only payload is its key (the MV name).\n  const env = RecordCodec.buildPlaintextEnvelope({ collection: MV_STALE_COLLECTION, id: mvName, version: 1 }, { data: '{}' })\n  await adapter.put(vault, MV_STALE_COLLECTION, mvName, env)\n}\n\nasync function deleteMVStaleMarker(adapter: NoydbStore, vault: string, mvName: string): Promise<void> {\n  await adapter.delete(vault, MV_STALE_COLLECTION, mvName)\n}\n\n/**\n * On first `resolveStaleMVOnRead` call for a (cold-reopened) registry, fold every\n * persisted `_mv_stale` marker into the in-memory pending set — otherwise a cold\n * session's empty `WeakMap` entry reads as \"fresh\" and serves the emptied output\n * collection forever.\n */\nasync function hydratePersistedStaleMarkers(accessor: MVStaleAccessor, registry: MaterializedViewRegistry): Promise<void> {\n  const mvs = registry.all()\n  if (mvs.length === 0) return\n  const { adapter, vault } = storeOf(accessor, mvs[0]!.outputCollection)\n  // No try/catch: a genuine store failure here must surface, not be read as\n  // \"nothing pending\" — silently treating it as fresh is the exact leak class\n  // this module closes (mirrors `subject-index.ts`'s bare `adapter.list` reads).\n  for (const name of await adapter.list(vault, MV_STALE_COLLECTION)) markMVStale(registry, name)\n}\n\n/**\n * Invalidate an MV from the delete/forget/elevate dispatcher (#736) — the ordinary\n * source-write path (`dispatchMaterializedViews`) never calls this. Deletes EVERY\n * persisted row in `reg.outputCollection` via `_internalDelete` (the at-rest law: a\n * stale mark alone leaves the elevated/forgotten source's plaintext sitting in the\n * output row) using the adapter directly so the read-path's `resolveStaleMVOnRead`\n * isn't triggered mid-invalidation. `mode: 'lazy'` also persists the stale mark so a\n * cold session recomputes on next read; `'manual'` gets the purge only — the MV\n * serves empty until an explicit `vault.refreshView()` (erasure wins). Deletion is\n * stamp-scoped (`_materializedFrom.mvName === reg.spec.name` — see the loop below),\n * so another registered MV sharing this output collection keeps its own rows intact:\n * no cross-MV re-marking is needed here, only `reg` itself is marked stale.\n *\n * Returns the count of rows actually `_internalDelete`d (#761 item 1) — folded by the\n * caller into `dispatchMaterializedViewsOnDelete`'s `deleted` so `ForgetResult.derivedRecordsErased`\n * counts lazy/manual purges too, not just the eager executor's tombstone leg — plus\n * `residueUndecodable`, the bare ids whose ownership stamp could NOT be decoded (#776): a\n * candidate row that fails to decode under the collection's default DEK (e.g. elevated above\n * tier 0 on a tiered output collection) has UNKNOWN ownership — it might be this MV's own\n * output, or (same-collection shape) a plain user record — so it is never erased, but it must\n * be SURFACED rather than silently skipped (the #724 posture), since it may still hold the\n * forgotten/pre-elevation contribution, decryptable by tier-holders — and `residueDeclined`\n * (#785), the bare ids that DID decode and stamp-match but whose `_internalDelete` declined\n * (ownership CONFIRMED, erasure declined).\n *\n * @internal\n */\nexport async function invalidateMVAtRest(\n  accessor: MVStaleAccessor,\n  reg: RegisteredMV,\n  mode: 'lazy' | 'manual',\n): Promise<{ deleted: number; residueUndecodable: string[]; residueDeclined: string[] }> {\n  const outputColl = accessor.getCollection(reg.outputCollection)\n  const txCtx = accessor.getActiveTxContext()\n  const { adapter, vault } = storeOf(accessor, reg.outputCollection)\n  let deleted = 0\n  const residueUndecodable: string[] = []\n  const residueDeclined: string[] = []\n  for (const id of await adapter.list(vault, reg.outputCollection)) {\n    // A same-collection partition MV (`output: { collection: <source>, partition }`,\n    // the DERIV-PP30-001 shape) writes INTO its own source collection — `adapter.list`\n    // over `reg.outputCollection` then also returns untouched user source records.\n    // Decode each candidate row (the invalidation path is rare; this cost is fine\n    // here) and only erase rows THIS MV stamped via `_materializedFrom.mvName` —\n    // an unstamped row, or one stamped by a different MV, is never this MV's to\n    // delete (#736 whole-branch review, Critical).\n    const envelope = await adapter.get(vault, reg.outputCollection, id)\n    if (envelope === null) continue\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const decoded = await (outputColl as any)._decodeEnvelope(envelope, id)\n    if (decoded === null) { residueUndecodable.push(id); continue } // #776 — ownership unknown, surfaced not skipped\n    const stampedBy = (decoded as Record<string, unknown>)._materializedFrom as { mvName?: string } | undefined\n    if (stampedBy?.mvName !== reg.spec.name) continue\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    if (await (outputColl as any)._internalDelete(id, txCtx)) {\n      deleted++\n    } else {\n      // #782 part b — decoded AND stamp-owned, but erasure declined (#718 tier-elevation\n      // gate). Ownership IS confirmed — a real silent survival, not a legit stamp-mismatch\n      // skip. Surface it too, in its own channel (#785 — distinct from the decode-null case).\n      residueDeclined.push(id)\n    }\n  }\n\n  // `mode: 'manual'` gets the purge only (erasure wins, no auto-recompute promise);\n  // `'lazy'` also marks + persists ITS OWN stale bit for cold-session recompute. No\n  // sibling MV on the same output collection is touched here — the stamp-scoped\n  // deletion above never erased sibling rows in the first place (#736 re-review).\n  if (mode === 'lazy') {\n    const registry = accessor.registry()\n    markMVStale(registry, reg.spec.name)\n    await writeMVStaleMarker(adapter, vault, reg.spec.name)\n  }\n  return { deleted, residueUndecodable, residueDeclined }\n}\n\n/**\n * Called from `Collection.get` (and any reader that materializes the\n * MV's output collection). If any MV producing `outputCollection` is\n * flagged stale, runs the executor against the live source state\n * before returning. No-op when there is no pending work — keeps the\n * read fast path negligible.\n *\n * `dispatchCtx` (#641): threaded from the calling `Collection`'s\n * `#dispatchCtx({ collection: outputCollection, id: 'resolve-on-read' })` — a read has no\n * real \"reacting write\" record, so `'resolve-on-read'` is the sentinel id, mirroring\n * `Vault.refreshView()`'s `'refreshView'` sentinel for the same reason. Passed straight\n * through to the executor so a stale row whose output lands in a closed period follows the\n * frozen-output rule (skip + `derivation:skipped-frozen`, #637) instead of throwing\n * `PeriodClosedError` out of a read.\n *\n * Dynamic-imports the executor only when a stale flag actually fires\n * (the floor-bundle isolation pattern v1 derivations established in\n * floor-bundle isolation pattern).\n */\nexport async function resolveStaleMVOnRead(\n  accessor: MVStaleAccessor,\n  outputCollection: string,\n  dispatchCtx?: PutDerivedOutputCtx,\n): Promise<void> {\n  const registry = accessor.registry()\n  // Cold session: the in-memory WeakMap has no entry for this (freshly\n  // constructed) registry yet — fold any persisted `_mv_stale` markers in\n  // before reading the pending set, once per registry (#736). Memoize the\n  // PROMISE, not a boolean: a concurrent first read arriving while the\n  // hydrate is still awaiting `adapter.list` must await the SAME promise —\n  // otherwise it observes \"already hydrating\", skips straight to an empty\n  // pending set, and serves the purged/stale view as fresh (#736\n  // whole-branch review, hydrate-once race). On rejection, evict the entry\n  // BEFORE rethrowing — a cached rejected promise would otherwise poison the\n  // MV read surface for the rest of the session (every later read re-awaits\n  // the same rejection instead of retrying the store call) (#736 re-review).\n  let hydrate = _hydratedByRegistry.get(registry)\n  if (!hydrate) {\n    hydrate = hydratePersistedStaleMarkers(accessor, registry).catch((err: unknown) => {\n      _hydratedByRegistry.delete(registry)\n      throw err\n    })\n    _hydratedByRegistry.set(registry, hydrate)\n  }\n  await hydrate\n  const pending = _staleByRegistry.get(registry)\n  if (!pending || pending.size === 0) return\n\n  const { adapter, vault } = storeOf(accessor, outputCollection)\n\n  // Clean up persisted markers for MV names no longer registered (renamed or\n  // removed since the marker was written). Without this sweep an orphaned name\n  // can never become a `candidate` below — `candidates` is built from\n  // `registry.all()`, which no longer lists it — so both the in-memory pending\n  // entry and the persisted `_mv_stale` row would linger forever, re-hydrating\n  // on every cold session (#736 whole-branch review).\n  for (const name of pending) {\n    if (registry.byName(name)) continue\n    pending.delete(name)\n    await deleteMVStaleMarker(adapter, vault, name)\n  }\n  if (pending.size === 0) return\n\n  // Find every MV that writes to this output collection AND is\n  // currently flagged stale. Multiple MVs CAN share an output\n  // collection in theory; in practice the registration validation +\n  // cycle detection make this unusual.\n  const candidates: string[] = []\n  for (const mv of registry.all()) {\n    if (mv.outputCollection !== outputCollection) continue\n    if (!pending.has(mv.spec.name)) continue\n    candidates.push(mv.spec.name)\n  }\n  if (candidates.length === 0) return\n\n  let executor: typeof MVExecutorType | null = null\n  for (const name of candidates) {\n    const reg = registry.byName(name)\n    if (!reg) {\n      // Unreachable in practice — `candidates` is drawn from `registry.all()`,\n      // and the orphan sweep above already cleared any name absent from it.\n      // Kept as a defensive fallback; also clears the persisted marker so it\n      // can't linger if this ever does fire.\n      pending.delete(name)\n      await deleteMVStaleMarker(adapter, vault, name)\n      continue\n    }\n    executor ??= (await loadMVExecutor()).MaterializedViewExecutor\n    // A cold-hydrated stale flag (unlike an in-session one) can fire with\n    // NONE of the MV's dependency collections touched yet this session —\n    // the sync `Query.toArray()` `spec.query()` runs reads straight off\n    // `Collection`'s in-memory cache, populated only by a prior async\n    // touch (`ensureHydrated()`, called from `get`/`list`/`put`, never\n    // from `query()` itself). Warm every dependency first so the recompute\n    // sees the live persisted state instead of an empty cache (#736).\n    for (const dep of reg.dependencies) {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      await (accessor.getCollection(dep) as any).ensureHydrated()\n    }\n    await executor.refresh(reg, {\n      getCollection: (n) => accessor.getCollection(n),\n      getActiveTxContext: () => accessor.getActiveTxContext(),\n      getQueryContext: () => accessor.getQueryContext(),\n      ...(dispatchCtx !== undefined ? { dispatchCtx } : {}),\n    })\n    pending.delete(name)\n    // Runs even when no marker was ever persisted for this name (an in-session-only\n    // stale bit — e.g. the cheap ordinary-write path never writes one, see the\n    // \"cheap-path guarantee\" test). `adapter.delete` on an absent key is a harmless\n    // void — keeping this unconditional avoids branching on marker origin here.\n    await deleteMVStaleMarker(adapter, vault, name)\n  }\n}\n\n/**\n * Drop every stale flag for a registry. Used after a manual\n * `vault.refreshView(name)` runs the executor explicitly — the\n * post-refresh state matches the registered strategies, so\n * lingering stale bits would force a redundant refresh on the next\n * read.\n *\n * @internal\n */\nexport function clearMVStale(registry: MaterializedViewRegistry, mvName: string): void {\n  _staleByRegistry.get(registry)?.delete(mvName)\n}\n\n/**\n * `clearMVStale` plus the persisted marker (#736) — `Vault.refreshView()`'s\n * completion path. A lingering persisted marker after a manual refresh would\n * make the NEXT cold session recompute redundantly.\n *\n * @internal\n */\nexport async function clearMVStaleFully(\n  adapter: NoydbStore,\n  vault: string,\n  registry: MaterializedViewRegistry,\n  mvName: string,\n): Promise<void> {\n  clearMVStale(registry, mvName)\n  await deleteMVStaleMarker(adapter, vault, mvName)\n}\n"],"mappings":";;;;;;;;AAeA,IAAM,iBAAiB,KAAK,MAAM,OAAO,wBAAe,CAAC;AA4BzD,IAAM,mBAAmB,oBAAI,QAA+C;AAQrE,SAAS,YAAY,UAAoC,QAAsB;AACpF,MAAI,MAAM,iBAAiB,IAAI,QAAQ;AACvC,MAAI,CAAC,KAAK;AACR,UAAM,oBAAI,IAAI;AACd,qBAAiB,IAAI,UAAU,GAAG;AAAA,EACpC;AACA,MAAI,IAAI,MAAM;AAChB;AASO,SAAS,UAAU,UAAoC,QAAyB;AACrF,SAAO,iBAAiB,IAAI,QAAQ,GAAG,IAAI,MAAM,KAAK;AACxD;AAWO,IAAM,sBAAsB;AASnC,IAAM,sBAAsB,oBAAI,QAAiD;AAGjF,SAAS,QAAQ,UAA2B,gBAAgE;AAE1G,QAAM,IAAI,SAAS,cAAc,cAAc;AAC/C,SAAO,EAAE,SAAS,EAAE,SAAuB,OAAO,EAAE,MAAgB;AACtE;AAEA,eAAe,mBAAmB,SAAqB,OAAe,QAA+B;AAEnG,QAAM,MAAM,YAAY,uBAAuB,EAAE,YAAY,qBAAqB,IAAI,QAAQ,SAAS,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC1H,QAAM,QAAQ,IAAI,OAAO,qBAAqB,QAAQ,GAAG;AAC3D;AAEA,eAAe,oBAAoB,SAAqB,OAAe,QAA+B;AACpG,QAAM,QAAQ,OAAO,OAAO,qBAAqB,MAAM;AACzD;AAQA,eAAe,6BAA6B,UAA2B,UAAmD;AACxH,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,IAAI,WAAW,EAAG;AACtB,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,IAAI,CAAC,EAAG,gBAAgB;AAIrE,aAAW,QAAQ,MAAM,QAAQ,KAAK,OAAO,mBAAmB,EAAG,aAAY,UAAU,IAAI;AAC/F;AA6BA,eAAsB,mBACpB,UACA,KACA,MACuF;AACvF,QAAM,aAAa,SAAS,cAAc,IAAI,gBAAgB;AAC9D,QAAM,QAAQ,SAAS,mBAAmB;AAC1C,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,IAAI,gBAAgB;AACjE,MAAI,UAAU;AACd,QAAM,qBAA+B,CAAC;AACtC,QAAM,kBAA4B,CAAC;AACnC,aAAW,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI,gBAAgB,GAAG;AAQhE,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,IAAI,kBAAkB,EAAE;AAClE,QAAI,aAAa,KAAM;AAEvB,UAAM,UAAU,MAAO,WAAmB,gBAAgB,UAAU,EAAE;AACtE,QAAI,YAAY,MAAM;AAAE,yBAAmB,KAAK,EAAE;AAAG;AAAA,IAAS;AAC9D,UAAM,YAAa,QAAoC;AACvD,QAAI,WAAW,WAAW,IAAI,KAAK,KAAM;AAEzC,QAAI,MAAO,WAAmB,gBAAgB,IAAI,KAAK,GAAG;AACxD;AAAA,IACF,OAAO;AAIL,sBAAgB,KAAK,EAAE;AAAA,IACzB;AAAA,EACF;AAMA,MAAI,SAAS,QAAQ;AACnB,UAAM,WAAW,SAAS,SAAS;AACnC,gBAAY,UAAU,IAAI,KAAK,IAAI;AACnC,UAAM,mBAAmB,SAAS,OAAO,IAAI,KAAK,IAAI;AAAA,EACxD;AACA,SAAO,EAAE,SAAS,oBAAoB,gBAAgB;AACxD;AAqBA,eAAsB,qBACpB,UACA,kBACA,aACe;AACf,QAAM,WAAW,SAAS,SAAS;AAYnC,MAAI,UAAU,oBAAoB,IAAI,QAAQ;AAC9C,MAAI,CAAC,SAAS;AACZ,cAAU,6BAA6B,UAAU,QAAQ,EAAE,MAAM,CAAC,QAAiB;AACjF,0BAAoB,OAAO,QAAQ;AACnC,YAAM;AAAA,IACR,CAAC;AACD,wBAAoB,IAAI,UAAU,OAAO;AAAA,EAC3C;AACA,QAAM;AACN,QAAM,UAAU,iBAAiB,IAAI,QAAQ;AAC7C,MAAI,CAAC,WAAW,QAAQ,SAAS,EAAG;AAEpC,QAAM,EAAE,SAAS,MAAM,IAAI,QAAQ,UAAU,gBAAgB;AAQ7D,aAAW,QAAQ,SAAS;AAC1B,QAAI,SAAS,OAAO,IAAI,EAAG;AAC3B,YAAQ,OAAO,IAAI;AACnB,UAAM,oBAAoB,SAAS,OAAO,IAAI;AAAA,EAChD;AACA,MAAI,QAAQ,SAAS,EAAG;AAMxB,QAAM,aAAuB,CAAC;AAC9B,aAAW,MAAM,SAAS,IAAI,GAAG;AAC/B,QAAI,GAAG,qBAAqB,iBAAkB;AAC9C,QAAI,CAAC,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAG;AAChC,eAAW,KAAK,GAAG,KAAK,IAAI;AAAA,EAC9B;AACA,MAAI,WAAW,WAAW,EAAG;AAE7B,MAAI,WAAyC;AAC7C,aAAW,QAAQ,YAAY;AAC7B,UAAM,MAAM,SAAS,OAAO,IAAI;AAChC,QAAI,CAAC,KAAK;AAKR,cAAQ,OAAO,IAAI;AACnB,YAAM,oBAAoB,SAAS,OAAO,IAAI;AAC9C;AAAA,IACF;AACA,kBAAc,MAAM,eAAe,GAAG;AAQtC,eAAW,OAAO,IAAI,cAAc;AAElC,YAAO,SAAS,cAAc,GAAG,EAAU,eAAe;AAAA,IAC5D;AACA,UAAM,SAAS,QAAQ,KAAK;AAAA,MAC1B,eAAe,CAAC,MAAM,SAAS,cAAc,CAAC;AAAA,MAC9C,oBAAoB,MAAM,SAAS,mBAAmB;AAAA,MACtD,iBAAiB,MAAM,SAAS,gBAAgB;AAAA,MAChD,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACrD,CAAC;AACD,YAAQ,OAAO,IAAI;AAKnB,UAAM,oBAAoB,SAAS,OAAO,IAAI;AAAA,EAChD;AACF;AAWO,SAAS,aAAa,UAAoC,QAAsB;AACrF,mBAAiB,IAAI,QAAQ,GAAG,OAAO,MAAM;AAC/C;AASA,eAAsB,kBACpB,SACA,OACA,UACA,QACe;AACf,eAAa,UAAU,MAAM;AAC7B,QAAM,oBAAoB,SAAS,OAAO,MAAM;AAClD;","names":[]}

package/dist/{chunk-UDHWDSRL.js → chunk-VMV5SBE4.js}

@@ -1,30 +1,29 @@
+import {
+  ENCLAVE_SCHEME
+} from "./chunk-JWWYRR4Q.js";
 import {
   ATTESTATIONS_COLLECTION,
   loadOrCreateSigner
-} from "./chunk-G73UVHCA.js";
+} from "./chunk-DLD5LGDS.js";
+import {
+  bytesToB64url,
+  computeFieldHashes,
+  encodeQr,
+  signPayloadCore
+} from "./chunk-GMKGGY7V.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
 import {
-  buildRecordAad
-} from "./chunk-4ZS56W5S.js";
-import {
-  buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
-import {
+  buildRecordAad,
+  buildRecordEnvelope,
   encrypt
-} from "./chunk-HPVZCW43.js";
+} from "./chunk-EZGV6F47.js";
 import {
   AttestationError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-audit/attestation/issue.ts
-import {
-  computeFieldHashes,
-  signPayloadCore,
-  encodeQr,
-  bytesToB64url
-} from "@noy-db/attestation";
 async function issueAttestationCore(ctx, args) {
   if (ctx.role !== "owner") {
     throw new AttestationError(`issueAttestation requires the 'owner' role; caller is '${ctx.role}'. Issuing a signed attestation is the firm's identity operation.`);
@@ -41,7 +40,7 @@ async function issueAttestationCore(ctx, args) {
     throw new AttestationError(`issueAttestation: ${e.message}`);
   }
   const docId = generateULID();
-  const sig = await signPayloadCore({ v: 1, docId, salt: saltB64, keyId: signer.keyId, fieldHashes }, signer.privateKeyPkcs8B64);
+  const sig = await signPayloadCore({ v: 1, docId, salt: saltB64, keyId: signer.keyId, fieldHashes }, signer.privateKeyPkcs8B64, ENCLAVE_SCHEME);
   const payload = { v: 1, docId, salt: saltB64, alg: "ed25519", keyId: signer.keyId, fieldHashes, sig };
   const index = {
     docId,
@@ -63,4 +62,4 @@ async function issueAttestationCore(ctx, args) {
 export {
   issueAttestationCore
 };
-//# sourceMappingURL=chunk-UDHWDSRL.js.map
+//# sourceMappingURL=chunk-VMV5SBE4.js.map

package/dist/chunk-VMV5SBE4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/attestation/issue.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, type EnclaveKey } from '../../capsule/index.js'\nimport { AttestationError } from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\nimport { loadOrCreateSigner, ATTESTATIONS_COLLECTION } from './signer.js'\nimport { ENCLAVE_SCHEME } from './scheme.js'\nimport { computeFieldHashes, signPayloadCore, encodeQr, bytesToB64url } from '@noy-db/attestation'\nimport type { AttestationFieldSchema, QrPayload } from './types.js'\n\n/** Everything issueAttestationCore needs from the Vault, injected for testability. */\nexport interface IssueContext {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly role: string\n  /** The _attestations collection DEK (AES-KW-wrapped under KEK by the keyring). */\n  getDEK(): Promise<EnclaveKey>\n  /** Decrypted source record + its envelope version, or null if absent. */\n  readRecord(collection: string, id: string): Promise<{ record: Record<string, unknown>; version: number } | null>\n}\n\nexport interface IssueArgs {\n  readonly collection: string\n  readonly id: string\n  readonly fieldSchema: AttestationFieldSchema\n}\nexport interface IssueResult {\n  readonly docId: string\n  readonly qr: string\n  readonly payload: QrPayload\n  readonly keyId: string\n  readonly publicKeyB64: string\n}\n\nexport async function issueAttestationCore(ctx: IssueContext, args: IssueArgs): Promise<IssueResult> {\n  if (ctx.role !== 'owner') {\n    throw new AttestationError(`issueAttestation requires the 'owner' role; caller is '${ctx.role}'. Issuing a signed attestation is the firm's identity operation.`)\n  }\n  const src = await ctx.readRecord(args.collection, args.id)\n  if (!src) throw new AttestationError(`issueAttestation: source record '${args.collection}/${args.id}' not found.`)\n\n  const dek = await ctx.getDEK()\n  // ONE signer implementation, from signer.ts. Lazily minted + persisted.\n  const signer = await loadOrCreateSigner(ctx.store, ctx.vault, () => Promise.resolve(dek))\n\n  const saltB64 = bytesToB64url(crypto.getRandomValues(new Uint8Array(16)))\n  let fieldHashes: string[]\n  try {\n    fieldHashes = await computeFieldHashes(saltB64, args.fieldSchema, src.record)\n  } catch (e) {\n    throw new AttestationError(`issueAttestation: ${(e as Error).message}`)\n  }\n  const docId = generateULID()\n\n  const sig = await signPayloadCore({ v: 1, docId, salt: saltB64, keyId: signer.keyId, fieldHashes }, signer.privateKeyPkcs8B64, ENCLAVE_SCHEME)\n  const payload: QrPayload = { v: 1, docId, salt: saltB64, alg: 'ed25519', keyId: signer.keyId, fieldHashes, sig }\n\n  const index = {\n    docId, issuedAt: new Date().toISOString(), keyId: signer.keyId,\n    fieldPaths: args.fieldSchema.fields.map((f) => f.path),\n    sourceRefs: [{ collection: args.collection, id: args.id, version: src.version }],\n  }\n  const identity = { collection: ATTESTATIONS_COLLECTION, id: docId, version: 1 }\n  const { iv, data } = await encrypt(JSON.stringify(index), dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(\n    identity,\n    { ts: index.issuedAt, iv, data },\n  )\n  await ctx.store.put(ctx.vault, ATTESTATIONS_COLLECTION, docId, env)\n\n  return { docId, qr: encodeQr(payload), payload, keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,eAAsB,qBAAqB,KAAmB,MAAuC;AACnG,MAAI,IAAI,SAAS,SAAS;AACxB,UAAM,IAAI,iBAAiB,0DAA0D,IAAI,IAAI,mEAAmE;AAAA,EAClK;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,KAAK,YAAY,KAAK,EAAE;AACzD,MAAI,CAAC,IAAK,OAAM,IAAI,iBAAiB,oCAAoC,KAAK,UAAU,IAAI,KAAK,EAAE,cAAc;AAEjH,QAAM,MAAM,MAAM,IAAI,OAAO;AAE7B,QAAM,SAAS,MAAM,mBAAmB,IAAI,OAAO,IAAI,OAAO,MAAM,QAAQ,QAAQ,GAAG,CAAC;AAExF,QAAM,UAAU,cAAc,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;AACxE,MAAI;AACJ,MAAI;AACF,kBAAc,MAAM,mBAAmB,SAAS,KAAK,aAAa,IAAI,MAAM;AAAA,EAC9E,SAAS,GAAG;AACV,UAAM,IAAI,iBAAiB,qBAAsB,EAAY,OAAO,EAAE;AAAA,EACxE;AACA,QAAM,QAAQ,aAAa;AAE3B,QAAM,MAAM,MAAM,gBAAgB,EAAE,GAAG,GAAG,OAAO,MAAM,SAAS,OAAO,OAAO,OAAO,YAAY,GAAG,OAAO,oBAAoB,cAAc;AAC7I,QAAM,UAAqB,EAAE,GAAG,GAAG,OAAO,MAAM,SAAS,KAAK,WAAW,OAAO,OAAO,OAAO,aAAa,IAAI;AAE/G,QAAM,QAAQ;AAAA,IACZ;AAAA,IAAO,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,IAAG,OAAO,OAAO;AAAA,IACzD,YAAY,KAAK,YAAY,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IACrD,YAAY,CAAC,EAAE,YAAY,KAAK,YAAY,IAAI,KAAK,IAAI,SAAS,IAAI,QAAQ,CAAC;AAAA,EACjF;AACA,QAAM,WAAW,EAAE,YAAY,yBAAyB,IAAI,OAAO,SAAS,EAAE;AAC9E,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,KAAK,GAAG,KAAK,eAAe,QAAQ,CAAC;AACvF,QAAM,MAAM;AAAA,IACV;AAAA,IACA,EAAE,IAAI,MAAM,UAAU,IAAI,KAAK;AAAA,EACjC;AACA,QAAM,IAAI,MAAM,IAAI,IAAI,OAAO,yBAAyB,OAAO,GAAG;AAElE,SAAO,EAAE,OAAO,IAAI,SAAS,OAAO,GAAG,SAAS,OAAO,OAAO,OAAO,cAAc,OAAO,aAAa;AACzG;","names":[]}

package/dist/{chunk-SPYWXKJN.js → chunk-VQDZYB2B.js}

@@ -1,11 +1,11 @@
 import {
   loadVaultPolicy,
   saveVaultPolicy
-} from "./chunk-2577DKXB.js";
+} from "./chunk-VHBKYN2J.js";
 import {
   PolicyDeniedError,
   ValidationError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-party/policy/presets.ts
 var PERSONAL_POLICY = Object.freeze({
@@ -364,4 +364,4 @@ export {
   describeGate,
   createNoydbPolicy
 };
-//# sourceMappingURL=chunk-SPYWXKJN.js.map
+//# sourceMappingURL=chunk-VQDZYB2B.js.map