@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/directory/index.js

@@ -1,7 +1,7 @@
 import "../chunk-GJW4HX2O.js";
 import {
   UserApi
-} from "../chunk-A66I4JOA.js";
+} from "../chunk-AEQGFRU4.js";
 import {
   DIRECTORY_RECORD_ID,
   META_COLLECTION,
@@ -16,16 +16,15 @@ import {
   readUserVisibility,
   saveUserEnvelope,
   visibilityRecordId
-} from "../chunk-XKWGNJ26.js";
-import "../chunk-4ZS56W5S.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BRLKZUBT.js";
-import "../chunk-BTDR2PXY.js";
-import "../chunk-CHQCZZWC.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-HPVZCW43.js";
-import "../chunk-7MG7SJT7.js";
-import "../chunk-7O3Y4PPD.js";
+} from "../chunk-LIOVX5TJ.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
+import "../chunk-37EPTBBR.js";
 export {
   DIRECTORY_RECORD_ID,
   META_COLLECTION,

package/dist/{dispatch-IEPAVQUM.js → dispatch-H4HV32AM.js}

@@ -14,7 +14,7 @@ async function dispatchMaterializedViews(ctx, id, record, wave) {
       if (wave?.seen(`mv\0${reg.spec.name}`)) continue;
       if (executor === null) {
         ;
-        ({ MaterializedViewExecutor: executor } = await import("./executor-7UQ3BZ4F.js"));
+        ({ MaterializedViewExecutor: executor } = await import("./executor-FMPVN6DT.js"));
       }
       await executor.refresh(reg, {
         getCollection: (name) => source.getCollection(name),
@@ -23,7 +23,7 @@ async function dispatchMaterializedViews(ctx, id, record, wave) {
         dispatchCtx: dispatchCtx({ collection: collectionName, id })
       });
     } else if (mode === "lazy") {
-      if (staleHelpers === null) staleHelpers = await import("./stale-BZS6H2RY.js");
+      if (staleHelpers === null) staleHelpers = await import("./stale-6GCFMOOR.js");
       staleHelpers.markMVStale(registry, reg.spec.name);
     }
   }
@@ -45,7 +45,7 @@ async function dispatchMaterializedViewsOnDelete(ctx, id) {
     if (mode === "eager") {
       if (executor === null) {
         ;
-        ({ MaterializedViewExecutor: executor } = await import("./executor-7UQ3BZ4F.js"));
+        ({ MaterializedViewExecutor: executor } = await import("./executor-FMPVN6DT.js"));
       }
       const rr = await executor.refresh(reg, {
         getCollection: (name) => source.getCollection(name),
@@ -58,7 +58,7 @@ async function dispatchMaterializedViewsOnDelete(ctx, id) {
       residueDeclined.push(...rr.residueDeclined);
       continue;
     }
-    if (staleHelpers === null) staleHelpers = await import("./stale-BZS6H2RY.js");
+    if (staleHelpers === null) staleHelpers = await import("./stale-6GCFMOOR.js");
     const inv = await staleHelpers.invalidateMVAtRest(source, reg, mode);
     deleted += inv.deleted;
     residueUndecodable.push(...inv.residueUndecodable.map((rid) => `${reg.outputCollection}:${rid}`));
@@ -70,4 +70,4 @@ export {
   dispatchMaterializedViews,
   dispatchMaterializedViewsOnDelete
 };
-//# sourceMappingURL=dispatch-IEPAVQUM.js.map
+//# sourceMappingURL=dispatch-H4HV32AM.js.map

package/dist/{dispatch-Q6MWLOJY.js → dispatch-JDZNGEB3.js}

@@ -6,36 +6,35 @@ import {
 } from "./chunk-FFWI7UH7.js";
 import {
   markStale
-} from "./chunk-SMH6SRX7.js";
+} from "./chunk-JOSPH3E5.js";
 import "./chunk-TFMM5DBB.js";
 import {
   putDerivedOutput,
   selfWriteFieldEqual
-} from "./chunk-3BZZJJMQ.js";
-import "./chunk-R7BX2NB3.js";
+} from "./chunk-MILI22XQ.js";
+import "./chunk-244QBK7Z.js";
 import "./chunk-5D2ALSM5.js";
-import "./chunk-Q2MPFCQ7.js";
-import "./chunk-TRGTKX5E.js";
-import "./chunk-UXVWEX5L.js";
-import "./chunk-QPQUVOZ2.js";
-import "./chunk-4ZS56W5S.js";
-import "./chunk-SZJ3DLZA.js";
-import "./chunk-BRLKZUBT.js";
-import "./chunk-BTDR2PXY.js";
-import "./chunk-CHQCZZWC.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-HPVZCW43.js";
-import "./chunk-7MG7SJT7.js";
+import "./chunk-23D6M6VM.js";
+import "./chunk-OKSTSITU.js";
+import "./chunk-SYNY3VB5.js";
+import "./chunk-6QVKPHBF.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
 import {
   DerivationCapExceededError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-formula/derivations/dispatch.ts
 async function dispatchArrayDerivationsOnDelete(ctx, id, eraseRecordShapeToo = false) {
   const { derivationSource, collectionName, adapter, vault, getDEK, storeCiphertext } = ctx;
   const strategies = derivationSource.registry().strategiesForSource(collectionName);
   if (strategies.length === 0) return 0;
-  const { loadFanoutSidecar, deleteFanoutSidecar } = await import("./fanout-sidecar-S3QL53YX.js");
+  const { loadFanoutSidecar, deleteFanoutSidecar } = await import("./fanout-sidecar-L7NHPIOC.js");
   const txCtx = derivationSource.getActiveTxContext();
   let erased = 0;
   for (const { spec } of strategies) {
@@ -160,7 +159,7 @@ async function dispatchDerivations(ctx, id, record, version, wave, prior) {
     }
     if (executorClass === null) {
       ;
-      ({ DerivationExecutor: executorClass } = await import("./executor-5NIMLSKZ.js"));
+      ({ DerivationExecutor: executorClass } = await import("./executor-OSRZST2U.js"));
     }
     for (const run of runs) await runOne(ctx, spec, strategyHash, executorClass, run);
   }
@@ -184,7 +183,7 @@ async function runOne(ctx, spec, strategyHash, executorClass, run) {
     const outputCollection = derivationSource.getCollection(outSpec.collection);
     const txCtx = derivationSource.getActiveTxContext();
     if (out.kind === "array") {
-      const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-S3QL53YX.js");
+      const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-L7NHPIOC.js");
       const prior = await loadFanoutSidecar(adapter, vault, spec.source, run.runId, key, getDEK, storeCiphertext);
       const prevKeys = new Set(prior?.keys ?? []);
       const newKeysList = out.entries.map((e) => e.key);
@@ -286,7 +285,7 @@ async function dispatchTriggerDerivationsOnDelete(ctx, id, deleted) {
       for (const sid of matched) await markStale(registry, spec, sid);
       continue;
     }
-    if (executorClass === null) ({ DerivationExecutor: executorClass } = await import("./executor-5NIMLSKZ.js"));
+    if (executorClass === null) ({ DerivationExecutor: executorClass } = await import("./executor-OSRZST2U.js"));
     for (const sid of matched) {
       const raw = await srcColl._getStoredRecord(sid);
       if (raw === null) continue;
@@ -299,4 +298,4 @@ export {
   dispatchDerivations,
   dispatchTriggerDerivationsOnDelete
 };
-//# sourceMappingURL=dispatch-Q6MWLOJY.js.map
+//# sourceMappingURL=dispatch-JDZNGEB3.js.map

package/dist/dispatch-JDZNGEB3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/dispatch.ts"],"sourcesContent":["/**\n * Derivation dispatch, lifted out of the kernel spine (#842 part b).\n *\n * `Collection` carried ~380 lines of dispatch logic that belongs to the\n * derivation service, not to the always-on kernel. These are free functions\n * taking an explicit context so the spine keeps only a thin delegator.\n *\n * ## How the spine reaches this module\n *\n * By dynamic `import()`, never a static one. `check-architecture.mjs`'s\n * `port-layering` check forbids the spine from statically importing a\n * `with-*` service; `collection.ts` is grandfathered for ten\n * `with-formula/*` specifiers, but that list is frozen per file and a new\n * one is a violation. A dynamic import is the sanctioned S4 gate recipe, and\n * it keeps this chunk out of the floor bundle for consumers who never fire a\n * derivation.\n *\n * The `Collection` type reference below points back at the spine. That is\n * inward (service → kernel) and so allowed, and it is TYPE-ONLY — erased at\n * build, so no runtime cycle exists.\n *\n * @internal\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { DerivationRegistry } from './registry.js'\nimport type { ReadOnlyVaultFacade } from '../../with-audit/guards/types.js'\nimport type { Collection } from '../../kernel/collection.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport type { ledgerAuditHook, WaveContext } from '../../kernel/via/dispatch.js'\nimport { putDerivedOutput, selfWriteFieldEqual } from '../../kernel/via/dispatch.js'\nimport { DerivationCapExceededError } from '../../kernel/errors.js'\nimport { sameTuple, resolveTuple, tupleFromIntermediate, hopCollections } from './trigger-match.js'\nimport { markStale } from './stale.js'\nimport type { DerivationExecutor } from './executor.js'\n\n/** The per-write dispatch context threaded into `putDerivedOutput`. */\ninterface DispatchCtx {\n  emit: (e: string, p: unknown) => void\n  source: { readonly collection: string; readonly id: string }\n  audit: ReturnType<typeof ledgerAuditHook>\n}\n\n/**\n * What the dispatchers need from the collection that owns them. Passing this\n * explicitly is what lets the logic live outside the class.\n */\nexport interface DerivationDeleteCtx {\n  readonly derivationSource: {\n    registry(): DerivationRegistry\n    getCollection(name: string): Collection<Record<string, unknown>>\n    getActiveTxContext(): TxContext | null\n    getReadOnlyFacade(): ReadOnlyVaultFacade\n  }\n  /** The collection the delete happened in. */\n  readonly collectionName: string\n  readonly adapter: NoydbStore\n  readonly vault: string\n  readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  readonly storeCiphertext: boolean\n}\n\n/**\n * Erase the derived rows a deleted source record fanned out to, and drop the\n * fan-out sidecars that recorded them.\n *\n * @param eraseRecordShapeToo also erase same-id `shape: 'record'` outputs.\n *   Restricted to a source-triggered strategy writing into a DIFFERENT\n *   collection — the self-denorm case would re-delete the record just\n *   tombstoned, and triggerBy/sibling strategies derive under a different id.\n * @returns rows ACTUALLY deleted, not edges visited (#622).\n */\nexport async function dispatchArrayDerivationsOnDelete(\n  ctx: DerivationDeleteCtx,\n  id: string,\n  eraseRecordShapeToo = false,\n): Promise<number> {\n  const { derivationSource, collectionName, adapter, vault, getDEK, storeCiphertext } = ctx\n\n  const strategies = derivationSource.registry().strategiesForSource(collectionName)\n  if (strategies.length === 0) return 0\n\n  const { loadFanoutSidecar, deleteFanoutSidecar } = await import('./fanout-sidecar.js')\n  const txCtx = derivationSource.getActiveTxContext()\n  let erased = 0\n\n  for (const { spec } of strategies) {\n    for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {\n      if (outSpec.shape === 'record') {\n        if (eraseRecordShapeToo && spec.source === collectionName && outSpec.collection !== collectionName) {\n          if (await derivationSource.getCollection(outSpec.collection)._internalDelete(id, txCtx)) erased += 1\n        }\n        continue\n      }\n\n      const sidecar = await loadFanoutSidecar(adapter, vault, spec.source, id, outputKey, getDEK, storeCiphertext)\n      if (!sidecar) continue\n\n      const outputCollection = derivationSource.getCollection(outSpec.collection)\n      for (const derivedId of sidecar.keys) {\n        if (await outputCollection._internalDelete(derivedId, txCtx)) erased += 1\n      }\n      await deleteFanoutSidecar(adapter, vault, spec.source, id, outputKey)\n    }\n  }\n\n  return erased\n}\n\n/** Adds what the on-write derivation dispatch needs beyond the delete path. */\nexport interface DerivationDispatchCtx extends DerivationDeleteCtx {\n  /** Via pipeline, for decoding the stored form back to canonical money shape. */\n  readonly via: { canonicalizeStored(r: Record<string, unknown>): Record<string, unknown> } | undefined\n  /** Recompute a rollup aggregate onto a parent. Stays on the spine — it walks collections. */\n  readonly recomputeRollup: (\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    spec: any,\n    parentId: string,\n    source: { readonly collection: string; readonly id: string },\n    wave?: WaveContext,\n  ) => Promise<unknown>\n  /** Builds the per-write dispatch context threaded into `putDerivedOutput`. */\n  readonly dispatchCtx: (source: { readonly collection: string; readonly id: string }) => DispatchCtx\n  /** Registers a write on the active transaction for rollback. */\n  readonly trackPut: (txCtx: TxContext, collectionName: string, id: string, priorEnvelope: EncryptedEnvelope | null) => void\n}\n\n/**\n * Fire registered derivation strategies for this source collection.\n *\n * Eager mode runs `derive` inline and writes each output; lazy mode records a\n * stale mark for cold-session recompute. Rollups are handled here rather than\n * by the executor — a write to the child recomputes the parent aggregate, and\n * a write to the parent recomputes its own.\n */\nexport async function dispatchDerivations(\n  ctx: DerivationDispatchCtx,\n  id: string,\n  record: Record<string, unknown>,\n  version: number,\n  wave?: WaveContext,\n  /** The pre-write record at `id` in THIS collection (undefined = not\n   *  captured — no field-match trigger, or a sync-applied wave; null =\n   *  captured and absent, i.e. a create). Only a `Record` re-fires the OLD\n   *  matched set alongside the new one (spec §7). */\n  prior?: Record<string, unknown> | null,\n): Promise<void> {\n  const { derivationSource, collectionName, via, recomputeRollup } = ctx\n\n  // `record` is the stored form here (post-quantize) — decode so\n  // derive(source, ctx) sees the canonical money shape.\n  const incoming = (via ? via.canonicalizeStored(record) : record)\n  if (incoming && typeof incoming === 'object' && '_derivedFrom' in incoming) return\n  // `prior` is the raw stored pre-write record — canonicalize it the same\n  // way as `incoming` before it feeds `resolveTuple` below, or a\n  // via-shaped match field (e.g. a money field) compares canonical against\n  // raw and never matches the old tuple (Min 5).\n  const canonicalPrior = prior != null ? (via ? via.canonicalizeStored(prior) : prior) : prior\n  const registry = derivationSource.registry()\n  const strategies = registry.strategiesForSource(collectionName)\n  if (strategies.length === 0) return\n  // Dynamic-import the executor only on the first eager-mode\n  // dispatch. Lazy-mode dispatches use `markStale` (a pure helper)\n  // which doesn't reach into the executor at all. Keeps the\n  // derivation executor chunk out of the floor bundle for any\n  // consumer that doesn't fire an eager derivation.\n  let executorClass: typeof DerivationExecutor | null = null\n  for (const { spec, strategyHash, triggers } of strategies) {\n    const mode = typeof spec.lifecycle === 'string' ? spec.lifecycle : spec.lifecycle.mode\n\n    // Rollup: a write to the child `from` recomputes the\n    // parent at id child[key]; a write to the parent (source = into)\n    // recomputes its own aggregate. Handled here (the executor is not run).\n    if (spec.rollup) {\n      if (mode !== 'eager') continue\n      const asParentId = (v: unknown): string | null =>\n        (typeof v === 'string' || typeof v === 'number') ? String(v) : null\n      let parentId: string | null\n      // #1257 — a child that RE-PARENTS strands the old parent's aggregate\n      // unless the old key is recomputed too. Reads the prior stored record\n      // (canonicalized alongside `incoming`, so a via-shaped key compares like\n      // for like). `undefined` prior — a sync-applied wave write or a tiers\n      // restore, which do not thread it — degrades to new-parent-only, the\n      // pre-#1257 behaviour, rather than guessing.\n      let oldParentId: string | null = null\n      if (collectionName === spec.rollup.from) {\n        parentId = asParentId(incoming[spec.rollup.key])\n        const priorKey = canonicalPrior != null ? asParentId(canonicalPrior[spec.rollup.key]) : null\n        if (priorKey !== null && priorKey !== parentId) oldParentId = priorKey\n      } else {\n        parentId = id // a write to the parent recomputes its own aggregate\n      }\n      if (parentId !== null) await recomputeRollup(spec, parentId, { collection: collectionName, id }, wave)\n      // The old parent is recomputed AFTER the new one so a `maxFanout`-style\n      // failure on the new parent surfaces before extra work is spent.\n      if (oldParentId !== null) await recomputeRollup(spec, oldParentId, { collection: collectionName, id }, wave)\n      continue\n    }\n\n    // Determine how `collectionName` triggers this strategy, and build the list\n    // of source records to (re-)derive:\n    //   • source     — re-derive the written record itself (same-id).\n    //   • sources[]  — re-derive the PRIMARY source at the same id.\n    //   • triggerBy  — FK fan-out: re-derive every source record\n    //                  whose `on` field equals the written parent's id.\n    // `input` is passed to derive(); `base` is the raw stored source record\n    // used as the patch base for a self-write reverse-denorm output.\n    const isSource = spec.source === collectionName\n    const isSibling = !isSource && (spec.sources?.includes(collectionName) ?? false)\n    const triggerEntries = !isSource && !isSibling\n      ? triggers.filter((t) => t.collection === collectionName)\n      : []\n    // #1277 option 2 — a write to an INTERMEDIATE collection fires the trigger\n    // too. Without this, re-pointing the intermediate strands every source it\n    // used to address: nothing is written to the trigger or source collection,\n    // so no other path can notice. Kept separate from `triggerEntries` because\n    // the tuple is derived differently (the intermediate IS the written record,\n    // so no lookup is needed).\n    const hopEntries = !isSource && !isSibling\n      ? triggers.filter((t) => hopCollections(t.match).includes(collectionName))\n      : []\n\n    const runs: Array<{\n      input: Record<string, unknown> & { id: string }\n      base: Record<string, unknown>\n      runId: string\n      version: number\n    }> = []\n\n    if (isSource) {\n      runs.push({ input: { ...incoming, id }, base: incoming, runId: id, version })\n    } else if (isSibling) {\n      const p = await derivationSource.getCollection(spec.source).get(id)\n      if (p !== null && p !== undefined) {\n        // Raw base for a (rare) sibling self-write; falls back to the\n        // resolved primary if the raw read misses.\n        const raw = await derivationSource.getCollection(spec.source)._getStoredRecord(id)\n        runs.push({ input: { ...p, id }, base: raw ?? p, runId: id, version: 0 })\n      }\n    } else if (triggerEntries.length > 0 || hopEntries.length > 0) {\n      const srcColl = derivationSource.getCollection(spec.source)\n      const matched = new Set<string>()\n      // One lookup per hop per written record — `take: 'id'` is a direct get,\n      // anything else is a single field match on the intermediate. Never per\n      // candidate row (#1266's bound).\n      const lookup = async (coll: string, field: string, value: string): Promise<Record<string, unknown> | null> => {\n        const c = derivationSource.getCollection(coll)\n        if (field === 'id') return c._getStoredRecord(value)\n        const ids = await c._findMatchingCompositeIds([{ field, value }])\n        const first = ids[0]\n        return first === undefined ? null : c._getStoredRecord(first)\n      }\n      // A write to an intermediate collection: fan out on its old ∪ new value.\n      // The prior record is the intermediate's own, so #1249's capture already\n      // supplies it — the same mechanism, pointed at a third collection.\n      for (const trigger of hopEntries) {\n        const tuples = [tupleFromIntermediate(trigger.match, collectionName, incoming)]\n        if (canonicalPrior != null) {\n          const old = tupleFromIntermediate(trigger.match, collectionName, canonicalPrior)\n          if (!sameTuple(old, tuples[0]!)) tuples.push(old)\n        }\n        const ids = new Set<string>()\n        for (const tuple of tuples) {\n          if (tuple === null) continue\n          for (const sid of await srcColl._findMatchingCompositeIds(tuple)) ids.add(sid)\n        }\n        if (trigger.maxFanout !== undefined && ids.size > trigger.maxFanout) {\n          throw new DerivationCapExceededError(\n            `triggerBy hop ${collectionName}→${spec.source} [${trigger.match.map(p => p.to).join(',')}]`,\n            ids.size, trigger.maxFanout)\n        }\n        for (const sid of ids) matched.add(sid)\n      }\n      for (const trigger of triggerEntries) {\n        // Union fan-out (spec §7): an update changing any matched component\n        // must re-fire BOTH the old and the new matched set, or the old\n        // set's derived output goes stale (never re-derived once it no\n        // longer matches). `prior` is only ever a `Record` here — a wave\n        // dispatch and a create both skip the old tuple outright.\n        const tuples = [await resolveTuple(trigger.match, id, incoming, lookup)]\n        if (canonicalPrior != null && trigger.match.some((p) => p.from !== 'id')) {\n          const old = await resolveTuple(trigger.match, id, canonicalPrior, lookup)\n          if (!sameTuple(old, tuples[0]!)) tuples.push(old)\n        }\n        const ids = new Set<string>()\n        for (const tuple of tuples) {\n          if (tuple === null) continue   // a from-value is absent/non-scalar: matches nothing\n          for (const sid of await srcColl._findMatchingCompositeIds(tuple)) ids.add(sid)\n        }\n        if (trigger.maxFanout !== undefined && ids.size > trigger.maxFanout) {\n          throw new DerivationCapExceededError(\n            `triggerBy ${collectionName}→${spec.source} [${trigger.match.map(p => p.to).join(',')}]`,\n            ids.size, trigger.maxFanout)\n        }\n        for (const sid of ids) matched.add(sid)\n      }\n      for (const sid of matched) {\n        const raw = await srcColl._getStoredRecord(sid)\n        if (raw === null) continue\n        runs.push({ input: { ...raw, id: sid }, base: raw, runId: sid, version: 0 })\n      }\n    }\n\n    if (runs.length === 0) continue\n\n    if (mode !== 'eager') {\n      for (const run of runs) await markStale(registry, spec, run.runId)\n      continue\n    }\n\n    if (executorClass === null) {\n      ;({ DerivationExecutor: executorClass } = await import('./executor.js'))\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    for (const run of runs) await runOne(ctx, spec as any, strategyHash, executorClass, run)\n  }\n}\n\n/**\n * Run the executor for one (spec, run) pair and write its outputs. Shared by\n * `dispatchDerivations`' eager loop and `dispatchTriggerDerivationsOnDelete`\n * (#1249) — the write-out logic (array diff, record self-write reverse-denorm,\n * normal record output) is identical for a live write and a delete-triggered\n * re-derive; only how `runs` gets built differs.\n */\nasync function runOne(\n  ctx: DerivationDispatchCtx,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  spec: any,\n  strategyHash: string,\n  executorClass: typeof DerivationExecutor,\n  run: { input: Record<string, unknown> & { id: string }; base: Record<string, unknown>; runId: string; version: number },\n): Promise<void> {\n  const { derivationSource, adapter, vault, getDEK, storeCiphertext, dispatchCtx, trackPut } = ctx\n  const execCtx = { vault: derivationSource.getReadOnlyFacade() }\n  const outCtx = dispatchCtx({ collection: spec.source, id: run.runId })\n  const result = await executorClass.run(spec, run.input, run.version, strategyHash, execCtx)\n  for (const key of Object.keys(spec.outputs)) {\n    const out = result.outputs[key]\n    if (!out) continue\n    if (out.kind === 'failed') {\n      const err = out.error\n      if (spec.strict) throw err\n      console.warn(`[derivation] output \"${key}\" for source \"${spec.source}\" id=\"${run.runId}\" failed:`, err)\n      continue\n    }\n    const outSpec = spec.outputs[key]\n    if (!outSpec) continue\n    const outputCollection = derivationSource.getCollection(outSpec.collection)\n    // If we're inside a multi-record transaction, register\n    // derived writes as side-effect ops on the active ctx\n    // BEFORE they fire. `revertExecuted` walks `_executed` in\n    // reverse on rollback, so capturing the pre-write envelope\n    // here lets a later mid-batch failure restore this output's\n    // prior state alongside the source op. Outside a transaction\n    // the context is null and tracking is skipped.\n    const txCtx = derivationSource.getActiveTxContext()\n\n    // ── Array-shape branch ─────────────────────────────────\n    if (out.kind === 'array') {\n      // Load the prior key set from the fanout sidecar.\n      const { loadFanoutSidecar, saveFanoutSidecar } = await import('./fanout-sidecar.js')\n      const prior = await loadFanoutSidecar(adapter, vault, spec.source, run.runId, key, getDEK, storeCiphertext)\n      const prevKeys = new Set<string>(prior?.keys ?? [])\n      const newKeysList = out.entries.map((e: { key: string }) => e.key)\n      const newKeysSet = new Set<string>(newKeysList)\n\n      // Diff — delete keys that were in prev but not in new.\n      for (const k of prevKeys) {\n        if (newKeysSet.has(k)) continue\n        await outputCollection._internalDelete(k, txCtx)\n      }\n\n      // Upsert every entry in the new set. (Slice 1: no\n      // identity-skip optimisation; write every row, idempotent\n      // at the (collection, id) level.)\n      for (const entry of out.entries) {\n        if (txCtx !== null) {\n          trackPut(txCtx, outSpec.collection, entry.key, await adapter.get(vault, outSpec.collection, entry.key))\n        }\n        await putDerivedOutput(outputCollection, entry.key, entry.value, outCtx, { source: 'derived' })\n      }\n\n      // Persist the new key set last, for failure-mode symmetry.\n      await saveFanoutSidecar(adapter, vault, {\n        source: spec.source,\n        sourceId: run.runId,\n        outputKey: key,\n        outputCollection: outSpec.collection,\n        keys: newKeysList,\n      }, getDEK, storeCiphertext)\n      continue\n    }\n\n    // ── Record-shape branch ────────────────────────────────\n    if (out.skipped === true) {\n      // Optional output returned null. Delete the\n      // previously-emitted output at this id, if any. Routed\n      // through `_internalDelete` so a user-registered\n      // `onDelete` on the output collection does NOT\n      // fire — this is a system-internal tombstone, not a\n      // user-initiated delete. The txCtx hookup captures the\n      // prior envelope inside `_internalDelete` for rollback\n      // symmetry; delete-of-absent is a silent no-op.\n      await outputCollection._internalDelete(run.runId, txCtx)\n      continue\n    }\n\n    // ── Self-write reverse-denorm ───────────────────────────\n    // An output back to its own source: patch ONLY the declared\n    // `denorm` fields onto the raw stored record, never the whole\n    // value (which would clobber user fields / i18n maps and carries\n    // the executor's `_derivedFrom` tag). If the patch changes\n    // nothing, skip the write — that value-equality is the cycle\n    // guard: the self-write re-fires the source-path derivation,\n    // which recomputes identical fields and terminates here.\n    if (outSpec.shape === 'record' && outSpec.denorm !== undefined && outSpec.collection === spec.source) {\n      const value = out.value\n      const patched: Record<string, unknown> = { ...run.base }\n      let changed = false\n      for (const f of outSpec.denorm) {\n        if (!selfWriteFieldEqual(run.base[f], value[f])) {\n          patched[f] = value[f]\n          changed = true\n        }\n      }\n      if (!changed) continue // cycle guard — nothing to write\n      if (txCtx !== null) {\n        trackPut(txCtx, outSpec.collection, run.runId, await adapter.get(vault, outSpec.collection, run.runId))\n      }\n      await putDerivedOutput(outputCollection, run.runId, patched, outCtx, { source: 'derived' })\n      continue\n    }\n\n    // ── Normal record output (separate output collection) ──\n    if (txCtx !== null) {\n      trackPut(txCtx, outSpec.collection, run.runId, await adapter.get(vault, outSpec.collection, run.runId))\n    }\n    await putDerivedOutput(outputCollection, run.runId, out.value, outCtx, { source: 'derived' })\n  }\n}\n\n/**\n * Trigger fan-out for a DELETED parent record (#1249, spec §8). Distinct from\n * the \"record-shape derivations not dispatched on delete\" rule — that is\n * about deleting a SOURCE record; this fires when a TRIGGER collection's\n * record is deleted, re-deriving source records that still exist. Pairs\n * evaluate against the tombstoned record's values; matched sources re-derive\n * through the normal executor (their derive() reads the now-absent parent\n * and decides what that means — the engine never cascades deletes).\n */\nexport async function dispatchTriggerDerivationsOnDelete(\n  ctx: DerivationDispatchCtx, id: string, deleted: Record<string, unknown>,\n): Promise<void> {\n  const { derivationSource, collectionName } = ctx\n  const registry = derivationSource.registry()\n  const strategies = registry.strategiesForSource(collectionName)\n  if (strategies.length === 0) return\n  let executorClass: typeof DerivationExecutor | null = null\n  for (const { spec, strategyHash, triggers } of strategies) {\n    if (spec.rollup) continue                                    // rollup-on-delete already exists\n    if (spec.source === collectionName) continue                 // source delete: existing rule, untouched\n    if (spec.sources?.includes(collectionName)) continue          // declared sibling source: same exclusion as the write path's isSibling check\n    const entries = triggers.filter((t) => t.collection === collectionName)\n    // #1294 — deleting an INTERMEDIATE strands every source it addressed, for\n    // the same reason re-pointing one does: nothing is written to the trigger\n    // or source collection. The write path handles this; the delete path did\n    // not, which made the hop's correctness argument hold for puts only.\n    const hopEntries = triggers.filter((t) => hopCollections(t.match).includes(collectionName))\n    if (entries.length === 0 && hopEntries.length === 0) continue\n    const mode = typeof spec.lifecycle === 'string' ? spec.lifecycle : spec.lifecycle.mode\n    const srcColl = derivationSource.getCollection(spec.source)\n    const matched = new Set<string>()\n    const lookup = async (coll: string, field: string, value: string): Promise<Record<string, unknown> | null> => {\n      const c = derivationSource.getCollection(coll)\n      if (field === 'id') return c._getStoredRecord(value)\n      const found = await c._findMatchingCompositeIds([{ field, value }])\n      const first = found[0]\n      return first === undefined ? null : c._getStoredRecord(first)\n    }\n    const cap = (trigger: { maxFanout?: number; match: ReadonlyArray<{ to: string }> }, n: number, label: string): void => {\n      if (trigger.maxFanout !== undefined && n > trigger.maxFanout) {\n        throw new DerivationCapExceededError(\n          `triggerBy ${label} ${collectionName}→${spec.source} [${trigger.match.map(p => p.to).join(',')}] (delete)`,\n          n, trigger.maxFanout)\n      }\n    }\n    for (const trigger of entries) {\n      // #1294 — resolve the hop here too. The old sync builder compared the raw\n      // `from` value against `source[to]`, which for a mapped pair is the\n      // wrong side of the relationship: it matched nothing, silently, so a\n      // delete through a hop fanned out to no one while a delete through a\n      // plain pair worked.\n      const tuple = await resolveTuple(trigger.match, id, deleted, lookup)\n      if (tuple === null) continue\n      const ids = await srcColl._findMatchingCompositeIds(tuple)\n      cap(trigger, ids.length, '')\n      for (const sid of ids) matched.add(sid)\n    }\n    for (const trigger of hopEntries) {\n      const tuple = tupleFromIntermediate(trigger.match, collectionName, deleted)\n      if (tuple === null) continue\n      const ids = await srcColl._findMatchingCompositeIds(tuple)\n      cap(trigger, ids.length, 'hop')\n      for (const sid of ids) matched.add(sid)\n    }\n    if (matched.size === 0) continue\n    if (mode !== 'eager') { for (const sid of matched) await markStale(registry, spec, sid); continue }\n    if (executorClass === null) ({ DerivationExecutor: executorClass } = await import('./executor.js'))\n    for (const sid of matched) {\n      const raw = await srcColl._getStoredRecord(sid)\n      if (raw === null) continue\n      await runOne(ctx, spec, strategyHash, executorClass, { input: { ...raw, id: sid }, base: raw, runId: sid, version: 0 })\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0EA,eAAsB,iCACpB,KACA,IACA,sBAAsB,OACL;AACjB,QAAM,EAAE,kBAAkB,gBAAgB,SAAS,OAAO,QAAQ,gBAAgB,IAAI;AAEtF,QAAM,aAAa,iBAAiB,SAAS,EAAE,oBAAoB,cAAc;AACjF,MAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,QAAM,EAAE,mBAAmB,oBAAoB,IAAI,MAAM,OAAO,8BAAqB;AACrF,QAAM,QAAQ,iBAAiB,mBAAmB;AAClD,MAAI,SAAS;AAEb,aAAW,EAAE,KAAK,KAAK,YAAY;AACjC,eAAW,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAC/D,UAAI,QAAQ,UAAU,UAAU;AAC9B,YAAI,uBAAuB,KAAK,WAAW,kBAAkB,QAAQ,eAAe,gBAAgB;AAClG,cAAI,MAAM,iBAAiB,cAAc,QAAQ,UAAU,EAAE,gBAAgB,IAAI,KAAK,EAAG,WAAU;AAAA,QACrG;AACA;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,kBAAkB,SAAS,OAAO,KAAK,QAAQ,IAAI,WAAW,QAAQ,eAAe;AAC3G,UAAI,CAAC,QAAS;AAEd,YAAM,mBAAmB,iBAAiB,cAAc,QAAQ,UAAU;AAC1E,iBAAW,aAAa,QAAQ,MAAM;AACpC,YAAI,MAAM,iBAAiB,gBAAgB,WAAW,KAAK,EAAG,WAAU;AAAA,MAC1E;AACA,YAAM,oBAAoB,SAAS,OAAO,KAAK,QAAQ,IAAI,SAAS;AAAA,IACtE;AAAA,EACF;AAEA,SAAO;AACT;AA4BA,eAAsB,oBACpB,KACA,IACA,QACA,SACA,MAKA,OACe;AACf,QAAM,EAAE,kBAAkB,gBAAgB,KAAK,gBAAgB,IAAI;AAInE,QAAM,WAAY,MAAM,IAAI,mBAAmB,MAAM,IAAI;AACzD,MAAI,YAAY,OAAO,aAAa,YAAY,kBAAkB,SAAU;AAK5E,QAAM,iBAAiB,SAAS,OAAQ,MAAM,IAAI,mBAAmB,KAAK,IAAI,QAAS;AACvF,QAAM,WAAW,iBAAiB,SAAS;AAC3C,QAAM,aAAa,SAAS,oBAAoB,cAAc;AAC9D,MAAI,WAAW,WAAW,EAAG;AAM7B,MAAI,gBAAkD;AACtD,aAAW,EAAE,MAAM,cAAc,SAAS,KAAK,YAAY;AACzD,UAAM,OAAO,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAK,UAAU;AAKlF,QAAI,KAAK,QAAQ;AACf,UAAI,SAAS,QAAS;AACtB,YAAM,aAAa,CAAC,MACjB,OAAO,MAAM,YAAY,OAAO,MAAM,WAAY,OAAO,CAAC,IAAI;AACjE,UAAI;AAOJ,UAAI,cAA6B;AACjC,UAAI,mBAAmB,KAAK,OAAO,MAAM;AACvC,mBAAW,WAAW,SAAS,KAAK,OAAO,GAAG,CAAC;AAC/C,cAAM,WAAW,kBAAkB,OAAO,WAAW,eAAe,KAAK,OAAO,GAAG,CAAC,IAAI;AACxF,YAAI,aAAa,QAAQ,aAAa,SAAU,eAAc;AAAA,MAChE,OAAO;AACL,mBAAW;AAAA,MACb;AACA,UAAI,aAAa,KAAM,OAAM,gBAAgB,MAAM,UAAU,EAAE,YAAY,gBAAgB,GAAG,GAAG,IAAI;AAGrG,UAAI,gBAAgB,KAAM,OAAM,gBAAgB,MAAM,aAAa,EAAE,YAAY,gBAAgB,GAAG,GAAG,IAAI;AAC3G;AAAA,IACF;AAUA,UAAM,WAAW,KAAK,WAAW;AACjC,UAAM,YAAY,CAAC,aAAa,KAAK,SAAS,SAAS,cAAc,KAAK;AAC1E,UAAM,iBAAiB,CAAC,YAAY,CAAC,YACjC,SAAS,OAAO,CAAC,MAAM,EAAE,eAAe,cAAc,IACtD,CAAC;AAOL,UAAM,aAAa,CAAC,YAAY,CAAC,YAC7B,SAAS,OAAO,CAAC,MAAM,eAAe,EAAE,KAAK,EAAE,SAAS,cAAc,CAAC,IACvE,CAAC;AAEL,UAAM,OAKD,CAAC;AAEN,QAAI,UAAU;AACZ,WAAK,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,GAAG,GAAG,MAAM,UAAU,OAAO,IAAI,QAAQ,CAAC;AAAA,IAC9E,WAAW,WAAW;AACpB,YAAM,IAAI,MAAM,iBAAiB,cAAc,KAAK,MAAM,EAAE,IAAI,EAAE;AAClE,UAAI,MAAM,QAAQ,MAAM,QAAW;AAGjC,cAAM,MAAM,MAAM,iBAAiB,cAAc,KAAK,MAAM,EAAE,iBAAiB,EAAE;AACjF,aAAK,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,GAAG,GAAG,MAAM,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;AAAA,MAC1E;AAAA,IACF,WAAW,eAAe,SAAS,KAAK,WAAW,SAAS,GAAG;AAC7D,YAAM,UAAU,iBAAiB,cAAc,KAAK,MAAM;AAC1D,YAAM,UAAU,oBAAI,IAAY;AAIhC,YAAM,SAAS,OAAO,MAAc,OAAe,UAA2D;AAC5G,cAAM,IAAI,iBAAiB,cAAc,IAAI;AAC7C,YAAI,UAAU,KAAM,QAAO,EAAE,iBAAiB,KAAK;AACnD,cAAM,MAAM,MAAM,EAAE,0BAA0B,CAAC,EAAE,OAAO,MAAM,CAAC,CAAC;AAChE,cAAM,QAAQ,IAAI,CAAC;AACnB,eAAO,UAAU,SAAY,OAAO,EAAE,iBAAiB,KAAK;AAAA,MAC9D;AAIA,iBAAW,WAAW,YAAY;AAChC,cAAM,SAAS,CAAC,sBAAsB,QAAQ,OAAO,gBAAgB,QAAQ,CAAC;AAC9E,YAAI,kBAAkB,MAAM;AAC1B,gBAAM,MAAM,sBAAsB,QAAQ,OAAO,gBAAgB,cAAc;AAC/E,cAAI,CAAC,UAAU,KAAK,OAAO,CAAC,CAAE,EAAG,QAAO,KAAK,GAAG;AAAA,QAClD;AACA,cAAM,MAAM,oBAAI,IAAY;AAC5B,mBAAW,SAAS,QAAQ;AAC1B,cAAI,UAAU,KAAM;AACpB,qBAAW,OAAO,MAAM,QAAQ,0BAA0B,KAAK,EAAG,KAAI,IAAI,GAAG;AAAA,QAC/E;AACA,YAAI,QAAQ,cAAc,UAAa,IAAI,OAAO,QAAQ,WAAW;AACnE,gBAAM,IAAI;AAAA,YACR,iBAAiB,cAAc,SAAI,KAAK,MAAM,KAAK,QAAQ,MAAM,IAAI,OAAK,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,YACzF,IAAI;AAAA,YAAM,QAAQ;AAAA,UAAS;AAAA,QAC/B;AACA,mBAAW,OAAO,IAAK,SAAQ,IAAI,GAAG;AAAA,MACxC;AACA,iBAAW,WAAW,gBAAgB;AAMpC,cAAM,SAAS,CAAC,MAAM,aAAa,QAAQ,OAAO,IAAI,UAAU,MAAM,CAAC;AACvE,YAAI,kBAAkB,QAAQ,QAAQ,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,GAAG;AACxE,gBAAM,MAAM,MAAM,aAAa,QAAQ,OAAO,IAAI,gBAAgB,MAAM;AACxE,cAAI,CAAC,UAAU,KAAK,OAAO,CAAC,CAAE,EAAG,QAAO,KAAK,GAAG;AAAA,QAClD;AACA,cAAM,MAAM,oBAAI,IAAY;AAC5B,mBAAW,SAAS,QAAQ;AAC1B,cAAI,UAAU,KAAM;AACpB,qBAAW,OAAO,MAAM,QAAQ,0BAA0B,KAAK,EAAG,KAAI,IAAI,GAAG;AAAA,QAC/E;AACA,YAAI,QAAQ,cAAc,UAAa,IAAI,OAAO,QAAQ,WAAW;AACnE,gBAAM,IAAI;AAAA,YACR,aAAa,cAAc,SAAI,KAAK,MAAM,KAAK,QAAQ,MAAM,IAAI,OAAK,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,YACrF,IAAI;AAAA,YAAM,QAAQ;AAAA,UAAS;AAAA,QAC/B;AACA,mBAAW,OAAO,IAAK,SAAQ,IAAI,GAAG;AAAA,MACxC;AACA,iBAAW,OAAO,SAAS;AACzB,cAAM,MAAM,MAAM,QAAQ,iBAAiB,GAAG;AAC9C,YAAI,QAAQ,KAAM;AAClB,aAAK,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,IAAI,GAAG,MAAM,KAAK,OAAO,KAAK,SAAS,EAAE,CAAC;AAAA,MAC7E;AAAA,IACF;AAEA,QAAI,KAAK,WAAW,EAAG;AAEvB,QAAI,SAAS,SAAS;AACpB,iBAAW,OAAO,KAAM,OAAM,UAAU,UAAU,MAAM,IAAI,KAAK;AACjE;AAAA,IACF;AAEA,QAAI,kBAAkB,MAAM;AAC1B;AAAC,OAAC,EAAE,oBAAoB,cAAc,IAAI,MAAM,OAAO,wBAAe;AAAA,IACxE;AAGA,eAAW,OAAO,KAAM,OAAM,OAAO,KAAK,MAAa,cAAc,eAAe,GAAG;AAAA,EACzF;AACF;AASA,eAAe,OACb,KAEA,MACA,cACA,eACA,KACe;AACf,QAAM,EAAE,kBAAkB,SAAS,OAAO,QAAQ,iBAAiB,aAAa,SAAS,IAAI;AAC7F,QAAM,UAAU,EAAE,OAAO,iBAAiB,kBAAkB,EAAE;AAC9D,QAAM,SAAS,YAAY,EAAE,YAAY,KAAK,QAAQ,IAAI,IAAI,MAAM,CAAC;AACrE,QAAM,SAAS,MAAM,cAAc,IAAI,MAAM,IAAI,OAAO,IAAI,SAAS,cAAc,OAAO;AAC1F,aAAW,OAAO,OAAO,KAAK,KAAK,OAAO,GAAG;AAC3C,UAAM,MAAM,OAAO,QAAQ,GAAG;AAC9B,QAAI,CAAC,IAAK;AACV,QAAI,IAAI,SAAS,UAAU;AACzB,YAAM,MAAM,IAAI;AAChB,UAAI,KAAK,OAAQ,OAAM;AACvB,cAAQ,KAAK,wBAAwB,GAAG,iBAAiB,KAAK,MAAM,SAAS,IAAI,KAAK,aAAa,GAAG;AACtG;AAAA,IACF;AACA,UAAM,UAAU,KAAK,QAAQ,GAAG;AAChC,QAAI,CAAC,QAAS;AACd,UAAM,mBAAmB,iBAAiB,cAAc,QAAQ,UAAU;AAQ1E,UAAM,QAAQ,iBAAiB,mBAAmB;AAGlD,QAAI,IAAI,SAAS,SAAS;AAExB,YAAM,EAAE,mBAAmB,kBAAkB,IAAI,MAAM,OAAO,8BAAqB;AACnF,YAAM,QAAQ,MAAM,kBAAkB,SAAS,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,eAAe;AAC1G,YAAM,WAAW,IAAI,IAAY,OAAO,QAAQ,CAAC,CAAC;AAClD,YAAM,cAAc,IAAI,QAAQ,IAAI,CAAC,MAAuB,EAAE,GAAG;AACjE,YAAM,aAAa,IAAI,IAAY,WAAW;AAG9C,iBAAW,KAAK,UAAU;AACxB,YAAI,WAAW,IAAI,CAAC,EAAG;AACvB,cAAM,iBAAiB,gBAAgB,GAAG,KAAK;AAAA,MACjD;AAKA,iBAAW,SAAS,IAAI,SAAS;AAC/B,YAAI,UAAU,MAAM;AAClB,mBAAS,OAAO,QAAQ,YAAY,MAAM,KAAK,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,MAAM,GAAG,CAAC;AAAA,QACxG;AACA,cAAM,iBAAiB,kBAAkB,MAAM,KAAK,MAAM,OAAO,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAAA,MAChG;AAGA,YAAM,kBAAkB,SAAS,OAAO;AAAA,QACtC,QAAQ,KAAK;AAAA,QACb,UAAU,IAAI;AAAA,QACd,WAAW;AAAA,QACX,kBAAkB,QAAQ;AAAA,QAC1B,MAAM;AAAA,MACR,GAAG,QAAQ,eAAe;AAC1B;AAAA,IACF;AAGA,QAAI,IAAI,YAAY,MAAM;AASxB,YAAM,iBAAiB,gBAAgB,IAAI,OAAO,KAAK;AACvD;AAAA,IACF;AAUA,QAAI,QAAQ,UAAU,YAAY,QAAQ,WAAW,UAAa,QAAQ,eAAe,KAAK,QAAQ;AACpG,YAAM,QAAQ,IAAI;AAClB,YAAM,UAAmC,EAAE,GAAG,IAAI,KAAK;AACvD,UAAI,UAAU;AACd,iBAAW,KAAK,QAAQ,QAAQ;AAC9B,YAAI,CAAC,oBAAoB,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG;AAC/C,kBAAQ,CAAC,IAAI,MAAM,CAAC;AACpB,oBAAU;AAAA,QACZ;AAAA,MACF;AACA,UAAI,CAAC,QAAS;AACd,UAAI,UAAU,MAAM;AAClB,iBAAS,OAAO,QAAQ,YAAY,IAAI,OAAO,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,CAAC;AAAA,MACxG;AACA,YAAM,iBAAiB,kBAAkB,IAAI,OAAO,SAAS,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAC1F;AAAA,IACF;AAGA,QAAI,UAAU,MAAM;AAClB,eAAS,OAAO,QAAQ,YAAY,IAAI,OAAO,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,CAAC;AAAA,IACxG;AACA,UAAM,iBAAiB,kBAAkB,IAAI,OAAO,IAAI,OAAO,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAAA,EAC9F;AACF;AAWA,eAAsB,mCACpB,KAA4B,IAAY,SACzB;AACf,QAAM,EAAE,kBAAkB,eAAe,IAAI;AAC7C,QAAM,WAAW,iBAAiB,SAAS;AAC3C,QAAM,aAAa,SAAS,oBAAoB,cAAc;AAC9D,MAAI,WAAW,WAAW,EAAG;AAC7B,MAAI,gBAAkD;AACtD,aAAW,EAAE,MAAM,cAAc,SAAS,KAAK,YAAY;AACzD,QAAI,KAAK,OAAQ;AACjB,QAAI,KAAK,WAAW,eAAgB;AACpC,QAAI,KAAK,SAAS,SAAS,cAAc,EAAG;AAC5C,UAAM,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,eAAe,cAAc;AAKtE,UAAM,aAAa,SAAS,OAAO,CAAC,MAAM,eAAe,EAAE,KAAK,EAAE,SAAS,cAAc,CAAC;AAC1F,QAAI,QAAQ,WAAW,KAAK,WAAW,WAAW,EAAG;AACrD,UAAM,OAAO,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAK,UAAU;AAClF,UAAM,UAAU,iBAAiB,cAAc,KAAK,MAAM;AAC1D,UAAM,UAAU,oBAAI,IAAY;AAChC,UAAM,SAAS,OAAO,MAAc,OAAe,UAA2D;AAC5G,YAAM,IAAI,iBAAiB,cAAc,IAAI;AAC7C,UAAI,UAAU,KAAM,QAAO,EAAE,iBAAiB,KAAK;AACnD,YAAM,QAAQ,MAAM,EAAE,0BAA0B,CAAC,EAAE,OAAO,MAAM,CAAC,CAAC;AAClE,YAAM,QAAQ,MAAM,CAAC;AACrB,aAAO,UAAU,SAAY,OAAO,EAAE,iBAAiB,KAAK;AAAA,IAC9D;AACA,UAAM,MAAM,CAAC,SAAuE,GAAW,UAAwB;AACrH,UAAI,QAAQ,cAAc,UAAa,IAAI,QAAQ,WAAW;AAC5D,cAAM,IAAI;AAAA,UACR,aAAa,KAAK,IAAI,cAAc,SAAI,KAAK,MAAM,KAAK,QAAQ,MAAM,IAAI,OAAK,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,UAC9F;AAAA,UAAG,QAAQ;AAAA,QAAS;AAAA,MACxB;AAAA,IACF;AACA,eAAW,WAAW,SAAS;AAM7B,YAAM,QAAQ,MAAM,aAAa,QAAQ,OAAO,IAAI,SAAS,MAAM;AACnE,UAAI,UAAU,KAAM;AACpB,YAAM,MAAM,MAAM,QAAQ,0BAA0B,KAAK;AACzD,UAAI,SAAS,IAAI,QAAQ,EAAE;AAC3B,iBAAW,OAAO,IAAK,SAAQ,IAAI,GAAG;AAAA,IACxC;AACA,eAAW,WAAW,YAAY;AAChC,YAAM,QAAQ,sBAAsB,QAAQ,OAAO,gBAAgB,OAAO;AAC1E,UAAI,UAAU,KAAM;AACpB,YAAM,MAAM,MAAM,QAAQ,0BAA0B,KAAK;AACzD,UAAI,SAAS,IAAI,QAAQ,KAAK;AAC9B,iBAAW,OAAO,IAAK,SAAQ,IAAI,GAAG;AAAA,IACxC;AACA,QAAI,QAAQ,SAAS,EAAG;AACxB,QAAI,SAAS,SAAS;AAAE,iBAAW,OAAO,QAAS,OAAM,UAAU,UAAU,MAAM,GAAG;AAAG;AAAA,IAAS;AAClG,QAAI,kBAAkB,KAAM,EAAC,EAAE,oBAAoB,cAAc,IAAI,MAAM,OAAO,wBAAe;AACjG,eAAW,OAAO,SAAS;AACzB,YAAM,MAAM,MAAM,QAAQ,iBAAiB,GAAG;AAC9C,UAAI,QAAQ,KAAM;AAClB,YAAM,OAAO,KAAK,MAAM,cAAc,eAAe,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,IAAI,GAAG,MAAM,KAAK,OAAO,KAAK,SAAS,EAAE,CAAC;AAAA,IACxH;AAAA,EACF;AACF;","names":[]}

package/dist/executor-FMPVN6DT.js

@@ -0,0 +1,35 @@
+import {
+  MaterializedViewExecutor
+} from "./chunk-EYG2CY2X.js";
+import "./chunk-JIBUPZHA.js";
+import "./chunk-BPWYQ25R.js";
+import "./chunk-O46CHQT7.js";
+import "./chunk-N7UDP5VU.js";
+import "./chunk-MILI22XQ.js";
+import "./chunk-244QBK7Z.js";
+import "./chunk-XZHEOSQ2.js";
+import "./chunk-MBMTND6D.js";
+import "./chunk-SUZKW6UR.js";
+import "./chunk-VHM7HCKB.js";
+import "./chunk-XBKH4FOC.js";
+import "./chunk-NCO25JZO.js";
+import "./chunk-4V3Q35WG.js";
+import "./chunk-LGNDFRYC.js";
+import "./chunk-FOEDQATO.js";
+import "./chunk-5WWDGFOS.js";
+import "./chunk-23D6M6VM.js";
+import "./chunk-OKSTSITU.js";
+import "./chunk-SYNY3VB5.js";
+import "./chunk-6QVKPHBF.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  MaterializedViewExecutor
+};
+//# sourceMappingURL=executor-FMPVN6DT.js.map

package/dist/executor-LBBBRTN5.js

@@ -0,0 +1,8 @@
+import {
+  GuardExecutor
+} from "./chunk-YRXFFWG4.js";
+import "./chunk-37EPTBBR.js";
+export {
+  GuardExecutor
+};
+//# sourceMappingURL=executor-LBBBRTN5.js.map

package/dist/executor-OSRZST2U.js

@@ -0,0 +1,8 @@
+import {
+  DerivationExecutor
+} from "./chunk-H427H63K.js";
+import "./chunk-37EPTBBR.js";
+export {
+  DerivationExecutor
+};
+//# sourceMappingURL=executor-OSRZST2U.js.map

package/dist/export-accessible-RAOJAAU5.js

@@ -0,0 +1,22 @@
+import {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+} from "./chunk-EJLV62NI.js";
+import "./chunk-KZXDLBY6.js";
+import "./chunk-5A4345TG.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  buildAccessibleBundle,
+  exportAccessibleData,
+  resolveAccessibleCollections
+};
+//# sourceMappingURL=export-accessible-RAOJAAU5.js.map

package/dist/extract-partition-JD5CUSTG.js

@@ -0,0 +1,37 @@
+import {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+} from "./chunk-EGVJ7TM4.js";
+import "./chunk-3L2NBKDR.js";
+import "./chunk-KZXDLBY6.js";
+import "./chunk-5A4345TG.js";
+import "./chunk-GMKGGY7V.js";
+import "./chunk-G2MVBDFP.js";
+import "./chunk-7XMHMVTS.js";
+import "./chunk-4AOERLTV.js";
+import "./chunk-I7FD46FF.js";
+import "./chunk-6QVKPHBF.js";
+import "./chunk-FLPCETP6.js";
+import "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
+export {
+  extractPartition,
+  extractPartitionCore,
+  reKeyBlobs,
+  reKeyClosure,
+  reKeyLedger,
+  reKeySchemas,
+  sealDeks
+};
+//# sourceMappingURL=extract-partition-JD5CUSTG.js.map

package/dist/{fanout-sidecar-S3QL53YX.js → fanout-sidecar-L7NHPIOC.js}

@@ -1,19 +1,17 @@
 import {
   buildRecordAad,
+  buildRecordEnvelope,
+  encrypt,
+  hasSealedBody,
   openEnvelopeJson
-} from "./chunk-4ZS56W5S.js";
-import {
-  buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
-import "./chunk-BRLKZUBT.js";
-import "./chunk-BTDR2PXY.js";
-import "./chunk-CHQCZZWC.js";
-import "./chunk-LP7BEXCT.js";
-import {
-  encrypt
-} from "./chunk-HPVZCW43.js";
-import "./chunk-7MG7SJT7.js";
-import "./chunk-7O3Y4PPD.js";
+} from "./chunk-EZGV6F47.js";
+import "./chunk-OIEO4WDL.js";
+import "./chunk-Q2XRFWOI.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-42ALPZ2B.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-SV2PM2OY.js";
+import "./chunk-37EPTBBR.js";
 
 // src/with-formula/derivations/fanout-sidecar.ts
 var FANOUT_DEK_COLLECTION = "_meta";
@@ -23,7 +21,7 @@ function recordId(source, sourceId, outputKey) {
 async function loadFanoutSidecar(store, vault, source, sourceId, outputKey, getDEK, encrypted) {
   const envelope = await store.get(vault, "_meta", recordId(source, sourceId, outputKey));
   if (!envelope) return void 0;
-  const json = !encrypted || envelope._iv === "" ? envelope._data : await openEnvelopeJson({ collection: "_meta", id: recordId(source, sourceId, outputKey) }, envelope, await getDEK(FANOUT_DEK_COLLECTION));
+  const json = !encrypted || !hasSealedBody(envelope) ? envelope._data ?? "" : await openEnvelopeJson({ collection: "_meta", id: recordId(source, sourceId, outputKey) }, envelope, await getDEK(FANOUT_DEK_COLLECTION));
   const parsed = JSON.parse(json);
   if (parsed._noydb_fanout !== 1) return void 0;
   if (!Array.isArray(parsed.keys)) return void 0;
@@ -61,4 +59,4 @@ export {
   loadFanoutSidecar,
   saveFanoutSidecar
 };
-//# sourceMappingURL=fanout-sidecar-S3QL53YX.js.map
+//# sourceMappingURL=fanout-sidecar-L7NHPIOC.js.map

package/dist/fanout-sidecar-L7NHPIOC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations.\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * The body is encrypted (AES-GCM under the `_meta` collection DEK) when\n * the vault is encrypted — the `keys[]` are derived-row ids produced by a\n * user-supplied key extractor and can be content-bearing (SKU, tag, email),\n * so a ciphertext-only store must not read them, the derivation graph, or\n * `emittedAt`. Back-compat: sidecars written before this fix are plaintext\n * (`_iv === ''`); `loadFanoutSidecar` dual-reads them.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../capsule/index.js'\nimport { hasSealedBody } from '../../capsule/index.js'\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** The `_meta` collection name whose DEK encrypts the sidecar body. */\nconst FANOUT_DEK_COLLECTION = '_meta'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/**\n * Read the sidecar; returns `undefined` only when it's legitimately absent\n * (no envelope at that id) — the correct signal for callers to skip\n * orphan-row reconciliation because there's nothing to reconcile against.\n *\n * A PRESENT envelope that fails to decrypt or parse is a data-integrity\n * problem, not an absence, and is deliberately NOT caught here: swallowing\n * it to `undefined` would look identical to \"no sidecar\" and make callers\n * (the array-derivation dispatch in `vault.ts`/`collection.ts`) silently\n * skip deleting stale derived rows on a shrink. Let `openEnvelopeJson`'s\n * `DecryptionError`/`TamperedError` and `JSON.parse` failures propagate,\n * matching the no-catch convention of sibling decrypt call-sites (e.g.\n * `with-audit/consent/consent.ts`'s `decryptEntry`).\n *\n * Dual-reads for back-compat: an envelope with `_iv === ''` is a legacy\n * plaintext sidecar (parse `_data` directly); otherwise the body was\n * encrypted under the `_meta` DEK and is decrypted first.\n */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  // Legacy plaintext reads directly; encrypted bodies decrypt.\n  // #15: ask `hasSealedBody`, not `_iv === ''` — an omitted `_iv` is the\n  // same statement as an empty one, and the raw comparison answers `false`\n  // for it, routing a bodyless row into the decrypt branch.\n  const json = (!encrypted || !hasSealedBody(envelope))\n    ? (envelope._data ?? '')\n    : await openEnvelopeJson({ collection: '_meta', id: recordId(source, sourceId, outputKey) }, envelope, await getDEK(FANOUT_DEK_COLLECTION))\n  const parsed = JSON.parse(json) as FanoutSidecar\n  if (parsed._noydb_fanout !== 1) return undefined\n  if (!Array.isArray(parsed.keys)) return undefined\n  return parsed\n}\n\n/**\n * Persist (insert/replace) the sidecar with a fresh key set. The body is\n * encrypted under the `_meta` DEK when the vault is encrypted (the `keys[]`\n * can be content-bearing); plaintext only in debug/unencrypted vaults.\n */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const json = JSON.stringify(doc)\n  const version = (prior?._v ?? 0) + 1\n  const identity = { collection: '_meta', id, version }\n  let envelope: EncryptedEnvelope\n  if (!encrypted) {\n    envelope = buildRecordEnvelope(identity, { iv: '', data: json })\n  } else {\n    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION), buildRecordAad(identity))\n    envelope = buildRecordEnvelope(identity, { iv, data })\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA6BA,IAAM,wBAAwB;AA2B9B,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AAoBA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACA,QACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AAKtB,QAAM,OAAQ,CAAC,aAAa,CAAC,cAAc,QAAQ,IAC9C,SAAS,SAAS,KACnB,MAAM,iBAAiB,EAAE,YAAY,SAAS,IAAI,SAAS,QAAQ,UAAU,SAAS,EAAE,GAAG,UAAU,MAAM,OAAO,qBAAqB,CAAC;AAC5I,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,MAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,SAAO;AACT;AAOA,eAAsB,kBACpB,OACA,OACA,SAOA,QACA,WACe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,QAAM,WAAW,OAAO,MAAM,KAAK;AACnC,QAAM,WAAW,EAAE,YAAY,SAAS,IAAI,QAAQ;AACpD,MAAI;AACJ,MAAI,CAAC,WAAW;AACd,eAAW,oBAAoB,UAAU,EAAE,IAAI,IAAI,MAAM,KAAK,CAAC;AAAA,EACjE,OAAO;AACL,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,OAAO,qBAAqB,GAAG,eAAe,QAAQ,CAAC;AACtG,eAAW,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAAA,EACvD;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}

package/dist/find-JRN4RNQ5.js

@@ -0,0 +1,10 @@
+import {
+  computeBidxTarget
+} from "./chunk-BNWA3WG5.js";
+import "./chunk-EZOAKKTB.js";
+import "./chunk-QMWY2FDS.js";
+import "./chunk-37EPTBBR.js";
+export {
+  computeBidxTarget
+};
+//# sourceMappingURL=find-JRN4RNQ5.js.map

package/dist/forget/index.js

@@ -1,16 +1,15 @@
 import {
   NO_FORGET,
   SUBJECT_INDEX_COLLECTION
-} from "../chunk-RF6D3Y5E.js";
-import "../chunk-4ZS56W5S.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BRLKZUBT.js";
-import "../chunk-BTDR2PXY.js";
-import "../chunk-CHQCZZWC.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-HPVZCW43.js";
-import "../chunk-7MG7SJT7.js";
-import "../chunk-7O3Y4PPD.js";
+} from "../chunk-JDEYF3PJ.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
+import "../chunk-37EPTBBR.js";
 
 // src/with-audit/forget/active.ts
 function withForget(opts) {

package/dist/forget/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-audit/forget/active.ts"],"sourcesContent":["/**\n * `withForget` — the active factory for GDPR right-to-erasure via\n * per-record CEK crypto-shred. Mirrors the canonical\n * `strategy.ts` (type + `NO_FORGET` sentinel) / `active.ts` (factory) split\n * used by the other services.\n *\n * @module\n */\nimport type { SubjectDeclaration, ForgetStrategy } from './strategy.js'\n\n/**\n * Declare GDPR crypto-shred for one or more collections.\n *\n * Each declared collection is forced to `perRecordKeys: true` (a shred can\n * only guarantee erasure of a record whose body is keyed off a per-record\n * CEK). On write, Noydb extracts `record[subjectField]` and maintains an\n * encrypted `_subject_index` mapping `subject → [{collection, id}]`, so\n * `vault.forget(subjectId)` can find every record for a subject and rewrite\n * each to a tombstone (body + history permanently undecryptable) while the\n * collection DEK and every other record stay intact.\n *\n * @example\n * ```ts\n * createNoydb({\n *   secret, user,\n *   forgetStrategy: withForget({ subjects: { invoices: 'buyerId' } }),\n * })\n * const result = await vault.forget('buyer-123')\n * // → { subject, recordsShredded, historyVersionsShredded, collections, … }\n * ```\n */\nexport function withForget(opts: SubjectDeclaration): ForgetStrategy {\n  return { subjects: { ...opts.subjects }, ...(opts.scopedPurge !== undefined ? { scopedPurge: opts.scopedPurge } : {}) }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA+BO,SAAS,WAAW,MAA0C;AACnE,SAAO,EAAE,UAAU,EAAE,GAAG,KAAK,SAAS,GAAG,GAAI,KAAK,gBAAgB,SAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC,EAAG;AACxH;","names":[]}
+{"version":3,"sources":["../../src/with-audit/forget/active.ts"],"sourcesContent":["/**\n * `withForget` — the active factory for GDPR right-to-erasure via\n * per-record CEK crypto-shred. Mirrors the canonical\n * `strategy.ts` (type + `NO_FORGET` sentinel) / `active.ts` (factory) split\n * used by the other services.\n *\n * @module\n */\nimport type { SubjectDeclaration, ForgetStrategy } from './strategy.js'\n\n/**\n * Declare GDPR crypto-shred for one or more collections.\n *\n * Each declared collection is forced to `perRecordKeys: true` (a shred can\n * only guarantee erasure of a record whose body is keyed off a per-record\n * CEK). On write, Noydb extracts `record[subjectField]` and maintains an\n * encrypted `_subject_index` mapping `subject → [{collection, id}]`, so\n * `vault.forget(subjectId)` can find every record for a subject and rewrite\n * each to a tombstone (body + history permanently undecryptable) while the\n * collection DEK and every other record stay intact.\n *\n * @example\n * ```ts\n * createNoydb({\n *   secret, user,\n *   forgetStrategy: withForget({ subjects: { invoices: 'buyerId' } }),\n * })\n * const result = await vault.forget('buyer-123')\n * // → { subject, recordsShredded, historyVersionsShredded, collections, … }\n * ```\n */\nexport function withForget(opts: SubjectDeclaration): ForgetStrategy {\n  return { subjects: { ...opts.subjects }, ...(opts.scopedPurge !== undefined ? { scopedPurge: opts.scopedPurge } : {}) }\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BO,SAAS,WAAW,MAA0C;AACnE,SAAO,EAAE,UAAU,EAAE,GAAG,KAAK,SAAS,GAAG,GAAI,KAAK,gBAAgB,SAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC,EAAG;AACxH;","names":[]}

package/dist/guards/index.js

@@ -2,13 +2,13 @@ import {
   immutableGuard,
   transitionGuard,
   withGuard
-} from "../chunk-YYP7WSEB.js";
+} from "../chunk-O2IMQSNA.js";
 import {
   GuardExecutor
-} from "../chunk-4OZNXTO4.js";
+} from "../chunk-YRXFFWG4.js";
 import {
   GuardRegistry
-} from "../chunk-DGOZ4UZD.js";
+} from "../chunk-FVH5QYY2.js";
 import {
   ReadOnlyVaultFacade
 } from "../chunk-JK733I5V.js";
@@ -18,7 +18,7 @@ import {
   IllegalTransitionError,
   InvariantError,
   RecordLockedError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-37EPTBBR.js";
 export {
   AmendmentForbiddenError,
   FieldFrozenError,

package/dist/history/index.js

@@ -1,7 +1,7 @@
 import {
   CollectionInstant,
   VaultInstant
-} from "../chunk-334WSVOW.js";
+} from "../chunk-5FE75J4S.js";
 import {
   diff,
   formatDiff
@@ -16,12 +16,12 @@ import {
   rewrapHistory,
   saveHistory,
   tombstoneHistory
-} from "../chunk-AYX7AINO.js";
+} from "../chunk-LNSVGRHO.js";
 import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "../chunk-V7ZRRCRJ.js";
+} from "../chunk-N7EVQD5S.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -33,17 +33,16 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "../chunk-QPQUVOZ2.js";
-import "../chunk-JMGDHKQF.js";
-import "../chunk-4ZS56W5S.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BRLKZUBT.js";
-import "../chunk-BTDR2PXY.js";
-import "../chunk-CHQCZZWC.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-HPVZCW43.js";
-import "../chunk-7MG7SJT7.js";
-import "../chunk-7O3Y4PPD.js";
+} from "../chunk-6QVKPHBF.js";
+import "../chunk-FLPCETP6.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
+import "../chunk-37EPTBBR.js";
 
 // src/with-commit/history/active.ts
 function withHistory() {

package/dist/history/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  historyIdentity,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n  rewrapHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    historyIdentity,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    rewrapHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  historyIdentity,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n  rewrapHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    historyIdentity,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    rewrapHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}

package/dist/i18n/index.js

@@ -1,15 +1,15 @@
 import {
   withLookup
-} from "../chunk-6LKOJBV6.js";
+} from "../chunk-BVCUTXE3.js";
 import {
   dictKey,
   staticDict
-} from "../chunk-MVMXZYXT.js";
+} from "../chunk-2GHDLTPE.js";
 import {
   DICT_COLLECTION_PREFIX,
   LookupHandle,
   dictCollectionName
-} from "../chunk-Q2MPFCQ7.js";
+} from "../chunk-23D6M6VM.js";
 import {
   NO_I18N,
   applyI18nLocale,
@@ -26,17 +26,16 @@ import {
   resolvePolicy,
   stripI18nFilled,
   validateI18nTextValue
-} from "../chunk-TRGTKX5E.js";
-import "../chunk-UXVWEX5L.js";
-import "../chunk-QPQUVOZ2.js";
-import "../chunk-4ZS56W5S.js";
-import "../chunk-SZJ3DLZA.js";
-import "../chunk-BRLKZUBT.js";
-import "../chunk-BTDR2PXY.js";
-import "../chunk-CHQCZZWC.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-HPVZCW43.js";
-import "../chunk-7MG7SJT7.js";
+} from "../chunk-OKSTSITU.js";
+import "../chunk-SYNY3VB5.js";
+import "../chunk-6QVKPHBF.js";
+import "../chunk-EZGV6F47.js";
+import "../chunk-OIEO4WDL.js";
+import "../chunk-Q2XRFWOI.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-42ALPZ2B.js";
+import "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
 import {
   DictKeyInUseError,
   DictKeyMissingError,
@@ -47,7 +46,7 @@ import {
   StaticDictReadonlyError,
   TranslatorNotConfiguredError,
   UnknownDictCodeError
-} from "../chunk-7O3Y4PPD.js";
+} from "../chunk-37EPTBBR.js";
 
 // src/via/i18n/densify.ts
 var MARKER = "_i18nFilled";