@noy-db/hub 0.8.0-pre.0 → 0.8.0

package/dist/{chunk-SYVZW77S.js → chunk-TEHHROZL.js}

@@ -3,22 +3,20 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   loadFence
-} from "./chunk-L7DOS3TE.js";
+} from "./chunk-VAORSCSU.js";
 import {
   SCHEMAS_COLLECTION,
   loadPersistedSchema
-} from "./chunk-3H5KLDZN.js";
+} from "./chunk-3L2NBKDR.js";
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-CKNGS5MH.js";
+} from "./chunk-6QVKPHBF.js";
 import {
+  buildSealedRecordEnvelope,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-KJFW62P4.js";
-import {
-  buildSealedRecordEnvelope
-} from "./chunk-SEE332EV.js";
+} from "./chunk-EZGV6F47.js";
 
 // src/with-shape/manifest/types.ts
 var MANIFEST_SCHEMA_RECORD_ID = "schema";
@@ -86,4 +84,4 @@ export {
   saveSchemaManifest,
   deriveSchemaManifest
 };
-//# sourceMappingURL=chunk-SYVZW77S.js.map
+//# sourceMappingURL=chunk-TEHHROZL.js.map

package/dist/chunk-TEHHROZL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/manifest/types.ts","../src/with-shape/manifest/storage.ts","../src/with-shape/manifest/derive.ts"],"sourcesContent":["/**\n * The pod-wide **schema manifest** record type (#941).\n *\n * This is an INDEX, not a full-inline manifest: `SchemaManifest.collections`\n * carries per-collection *metadata* (generation / content hash / field ids),\n * never the JSON Schema body itself. The JSON Schema stays the source of\n * truth at `_schemas/<collection>`, encrypted under that collection's own\n * DEK (see `with-shape/persisted-schemas`). Inlining full schemas into one\n * pod-wide manifest record would either leak every collection's schema to a\n * principal scoped to a single collection, or force the manifest itself\n * onto a collection-DEK it has no business holding — the index preserves\n * per-collection DEK isolation while still giving a single place to answer\n * \"what schema generation is this pod at, and does collection X's stored\n * schema match its declared content hash.\"\n *\n * `aggregateHash` binds the whole per-collection index's content: it is\n * `sha256Hex(canonicalJson(collections))`, so any change to any collection's\n * entry (a new generation, a changed hash, added/renamed field ids) changes\n * `aggregateHash` too. Canonical JSON (sorted object keys, no whitespace)\n * makes the hash independent of the map's key insertion order.\n *\n * @module\n */\n\n/** Per-collection entry inside a {@link SchemaManifest}'s `collections` index. */\nexport interface SchemaManifestEntry {\n  /** The vault-wide schema-fence generation this collection's schema was last written at. */\n  readonly generation: number\n  /** SHA-256 (hex) of the collection's canonicalised JSON Schema (see `persisted-schemas/derive.ts`). */\n  readonly contentHash: string\n  /** Stable per-field ids (#946), keyed by the field's current name. Absent when the collection has none. */\n  readonly fieldIds?: Record<string, string>\n}\n\n/**\n * The pod-wide schema manifest — one record per pod, stored at\n * `_manifest/schema` (see `storage.ts`). An INDEX over the per-collection\n * `_schemas/<collection>` entries, not the schemas themselves.\n */\nexport interface SchemaManifest {\n  readonly v: 1\n  readonly kind: 'schema'\n  /** Pod-wide schema-fence generation (`FenceDoc.currentSchemaVersion`) as of this manifest's derivation. */\n  readonly generation: number\n  /** Per-collection index: collection name → its manifest entry. */\n  readonly collections: Record<string, SchemaManifestEntry>\n  /** `sha256Hex(canonicalJson(collections))` — the pod-wide content binding over the index. */\n  readonly aggregateHash: string\n}\n\n/** The record id the schema manifest is stored under inside `_manifest`. */\nexport const MANIFEST_SCHEMA_RECORD_ID = 'schema' as const\n","/**\n * Read / write the pod-wide `_manifest/schema` envelope.\n *\n * Mirrors `with-shape/persisted-schemas/storage.ts`'s shape: the same\n * standard noy-db record envelope, AES-GCM encrypted with a collection DEK\n * (here, the `_manifest` collection's own DEK — the manifest INDEX\n * discloses collection names + hashes + generations + field ids, metadata\n * rather than schema bodies, so it gets the same encryption grain as\n * `_schemas` itself).\n *\n * Storage layout:\n *\n *   <vault>/_manifest/schema   →   EncryptedEnvelope\n *\n * Unlike `persisted-schemas/storage.ts` (which takes an already-resolved\n * `EnclaveKey`), these functions take a `getDEK` resolver and call\n * `getDEK(MANIFEST_COLLECTION)` themselves — there is exactly one manifest\n * record per pod, so there is no per-collection DEK the caller needs to\n * pick; resolving it here keeps every manifest call-site symmetric.\n *\n * @module\n */\n\nimport { buildSealedRecordEnvelope, openEnvelopeJson, writeEnvelopeBody, type EnclaveKey } from '../../capsule/index.js'\nimport { canonicalJson, sha256Hex } from '../../with-commit/history/ledger/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { MANIFEST_COLLECTION } from './reserved-collections.js'\nimport { MANIFEST_SCHEMA_RECORD_ID, type SchemaManifest, type SchemaManifestEntry } from './types.js'\n\n/** A resolver for a collection's DEK — the same shape as `Vault`'s internal `getDEK`. */\nexport type GetManifestDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/**\n * A decrypted schema-manifest read paired with the wrapping envelope's `_v`\n * — the optimistic-concurrency token. Pass `version` back to\n * {@link saveSchemaManifest} (via `writeSchemaManifest`'s `expectedVersion`)\n * to make the write a strict CAS.\n */\nexport interface LoadedSchemaManifest {\n  /** Wrapping envelope `_v`. */\n  readonly version: number\n  /** Decrypted schema manifest. */\n  readonly manifest: SchemaManifest\n}\n\n/**\n * Read the `_manifest/schema` envelope together with its wrapping `_v`.\n * Returns `undefined` when no manifest has ever been written, when the\n * envelope fails to decrypt (wrong DEK), or when it doesn't parse as a\n * `v: 1, kind: 'schema'` manifest.\n */\nexport async function loadSchemaManifestEntry(\n  store: NoydbStore,\n  vault: string,\n  getDEK: GetManifestDEK,\n): Promise<LoadedSchemaManifest | undefined> {\n  const envelope = await store.get(vault, MANIFEST_COLLECTION, MANIFEST_SCHEMA_RECORD_ID)\n  if (!envelope) return undefined\n  const dek = await getDEK(MANIFEST_COLLECTION)\n  try {\n    const plaintext = await openEnvelopeJson({ collection: MANIFEST_COLLECTION, id: MANIFEST_SCHEMA_RECORD_ID }, envelope, dek)\n    const parsed = JSON.parse(plaintext) as SchemaManifest\n    if (parsed.v !== 1 || parsed.kind !== 'schema') return undefined\n    return { version: envelope._v, manifest: parsed }\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Encrypt and persist the schema manifest as a strict CAS write:\n * `expectedVersion` must match the stored envelope's `_v` (0 when no\n * envelope exists yet) or `store.put` throws `ConflictError` — surfaced by\n * `writer.ts`'s `writeSchemaManifest` as `ManifestConflictError` rather than\n * retried.\n */\nexport async function saveSchemaManifest(\n  store: NoydbStore,\n  vault: string,\n  manifest: SchemaManifest,\n  expectedVersion: number,\n  getDEK: GetManifestDEK,\n): Promise<void> {\n  const dek = await getDEK(MANIFEST_COLLECTION)\n  const json = JSON.stringify(manifest)\n  const env = await buildSealedRecordEnvelope(\n    { collection: MANIFEST_COLLECTION, id: MANIFEST_SCHEMA_RECORD_ID, version: expectedVersion + 1 },\n    (identity) => writeEnvelopeBody(identity, json, dek),\n    {},\n  )\n  await store.put(vault, MANIFEST_COLLECTION, MANIFEST_SCHEMA_RECORD_ID, env, expectedVersion)\n}\n\n/**\n * `sha256Hex(canonicalJson(collections))` — the pod-wide content binding\n * over a schema manifest's per-collection index. Canonical JSON sorts\n * object keys at every depth, so the result is independent of the map's\n * key insertion order. Shared by the writer's tests and (#941 Task 3) the\n * derivation path, so the hash is computed identically everywhere.\n */\nexport async function computeAggregateHash(\n  collections: Record<string, SchemaManifestEntry>,\n): Promise<string> {\n  return sha256Hex(canonicalJson(collections))\n}\n","/**\n * Derive the pod-wide {@link SchemaManifest} from the per-collection\n * `_schemas/<collection>` records — the source of truth (#941 Task 3).\n *\n * The manifest is an INDEX, never a cache with independent state: every\n * field in a {@link SchemaManifestEntry} is a direct projection of the\n * matching `PersistedSchemaEnvelope` (`hash` → `contentHash`, `fieldIds` →\n * `fieldIds`, `generation` → `generation`, falling back to the live fence's\n * `currentSchemaVersion` for a legacy pre-#946 envelope that never got a\n * generation stamp). Re-running this function against the same stored state\n * always produces the same manifest — that's what makes round-trip identity\n * (AC #2: dump → restore → re-derive matches the original) hold for free,\n * with no special-cased restore logic.\n *\n * A collection whose `_schemas/<collection>` envelope decrypts successfully\n * but has no derivable content (`hash === null` — a stub envelope for a\n * non-Zod validator) is legitimately omitted from the index: there is no\n * content hash to bind.\n *\n * ## Scoped principals: \"cannot decrypt\" is NOT \"doesn't exist\"\n *\n * A `_schemas/<collection>` envelope is encrypted under **that data\n * collection's own DEK** — the same key its records use — NOT a shared\n * `_schemas`-wide key. In a team vault, a collection-scoped grantee (e.g.\n * `grant(..., { role: 'operator', permissions: { invoices: 'rw' } })`) holds\n * only the DEKs their `permissions` name, plus every system-prefixed (`_*`)\n * collection's DEK — `_manifest` included, by `grant()`'s \"propagate system\n * collections to every role\" rule (`keyring.ts`). So a member scoped to\n * `invoices` CAN decrypt `_manifest/schema` (the pod-wide index) but CANNOT\n * decrypt a sibling's `_schemas/customers` envelope — even though that\n * envelope is right there in `store.list(vault, SCHEMAS_COLLECTION)`.\n *\n * `lookupDEK` (the {@link LookupDEK} passed in) reflects this: it returns\n * `undefined` for a collection name whose DEK the caller does not hold —\n * deliberately NEVER minting a fresh one (see the module doc on\n * `LookupDEK` for why). This function distinguishes that case\n * (`undecodableCollections`) from \"the schema envelope legitimately has no\n * derivable content\" (`hash === null`) — the caller (`sync.ts`) MUST treat\n * an incomplete view differently: writing a manifest derived from a\n * partial view would silently drop every collection this principal can't\n * see. See `sync.ts`'s module doc for how the sync path handles this.\n *\n * @module\n */\n\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport { loadFence } from '../schema-update/fence.js'\nimport { loadPersistedSchema, SCHEMAS_COLLECTION } from '../persisted-schemas/storage.js'\nimport { computeAggregateHash } from './storage.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { SchemaManifest, SchemaManifestEntry } from './types.js'\n\n/**\n * A NON-MINTING DEK lookup: returns the collection's DEK if the caller\n * already holds it, `undefined` otherwise. Deliberately distinct from\n * `storage.ts`'s `GetManifestDEK` (which mints+persists a fresh DEK for an\n * absent collection — correct for a caller about to WRITE that collection,\n * e.g. `_manifest` itself). `deriveSchemaManifest` only ever READS sibling\n * collections it never created and has no business minting keys for — an\n * absent DEK here means \"not my collection to see,\" never \"new collection\n * that needs a key.\" Minting here would be worse than a no-op: it would\n * silently persist a garbage DEK into the caller's OWN `_keyring/<user>`\n * file (via `ensureCollectionDEK`'s `persistKeyring` side effect) that\n * still can't decrypt anything — see `sync.ts` / `with-pod/open.ts`'s\n * fix notes (#941 review).\n */\nexport type LookupDEK = (collectionName: string) => Promise<EnclaveKey | undefined>\n\nexport interface DeriveSchemaManifestResult {\n  /** The derived manifest — an index over every collection this principal could decrypt. */\n  readonly manifest: SchemaManifest\n  /**\n   * Names present in `_schemas` (per `store.list`) whose envelope this\n   * principal could NOT decrypt — either no DEK held for that collection,\n   * or the DEK held failed to decrypt/parse it (treated the same: the\n   * caller cannot verify what's there, so it cannot safely be omitted or\n   * asserted). Empty for a principal with full visibility (typically the\n   * owner/admin/custodian). Non-empty means `manifest.collections` is\n   * DEFINITELY INCOMPLETE relative to the pod's true collection set —\n   * see `sync.ts` for why that must gate whether the manifest gets written.\n   */\n  readonly undecodableCollections: readonly string[]\n}\n\n/**\n * Read the fence generation + every `_schemas/<collection>` envelope this\n * principal can decrypt, and project them into a fresh {@link SchemaManifest}.\n * `lookupDEK` is called once per collection found under `_schemas` (never\n * mints — see {@link LookupDEK}). Names whose DEK isn't held, or whose\n * envelope fails to decrypt/parse despite holding a DEK, are reported via\n * `undecodableCollections` rather than silently dropped from the result.\n */\nexport async function deriveSchemaManifest(\n  store: NoydbStore,\n  vault: string,\n  lookupDEK: LookupDEK,\n): Promise<DeriveSchemaManifestResult> {\n  const fence = await loadFence(store, vault)\n  const collectionNames = await store.list(vault, SCHEMAS_COLLECTION)\n\n  const collections: Record<string, SchemaManifestEntry> = {}\n  const undecodableCollections: string[] = []\n  for (const name of collectionNames) {\n    const dek = await lookupDEK(name)\n    if (dek === undefined) {\n      undecodableCollections.push(name) // present in _schemas, but not decodable by this principal\n      continue\n    }\n\n    const payload = await loadPersistedSchema(store, vault, name, dek)\n    if (!payload) {\n      // Held a DEK but still couldn't decrypt/parse — cannot distinguish\n      // \"wrong key after all\" from real corruption from here; treat as\n      // undecodable (never silently drop) rather than \"no content.\"\n      undecodableCollections.push(name)\n      continue\n    }\n    if (payload.hash === null) continue // legitimately no derivable content (stub envelope)\n\n    const entry: SchemaManifestEntry = {\n      generation: payload.generation ?? fence.currentSchemaVersion,\n      contentHash: payload.hash,\n    }\n    collections[name] = payload.fieldIds !== undefined ? { ...entry, fieldIds: payload.fieldIds } : entry\n  }\n\n  const aggregateHash = await computeAggregateHash(collections)\n  const manifest: SchemaManifest = { v: 1, kind: 'schema', generation: fence.currentSchemaVersion, collections, aggregateHash }\n  return { manifest, undecodableCollections }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAmDO,IAAM,4BAA4B;;;ACAzC,eAAsB,wBACpB,OACA,OACA,QAC2C;AAC3C,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,qBAAqB,yBAAyB;AACtF,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,MAAM,MAAM,OAAO,mBAAmB;AAC5C,MAAI;AACF,UAAM,YAAY,MAAM,iBAAiB,EAAE,YAAY,qBAAqB,IAAI,0BAA0B,GAAG,UAAU,GAAG;AAC1H,UAAM,SAAS,KAAK,MAAM,SAAS;AACnC,QAAI,OAAO,MAAM,KAAK,OAAO,SAAS,SAAU,QAAO;AACvD,WAAO,EAAE,SAAS,SAAS,IAAI,UAAU,OAAO;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASA,eAAsB,mBACpB,OACA,OACA,UACA,iBACA,QACe;AACf,QAAM,MAAM,MAAM,OAAO,mBAAmB;AAC5C,QAAM,OAAO,KAAK,UAAU,QAAQ;AACpC,QAAM,MAAM,MAAM;AAAA,IAChB,EAAE,YAAY,qBAAqB,IAAI,2BAA2B,SAAS,kBAAkB,EAAE;AAAA,IAC/F,CAAC,aAAa,kBAAkB,UAAU,MAAM,GAAG;AAAA,IACnD,CAAC;AAAA,EACH;AACA,QAAM,MAAM,IAAI,OAAO,qBAAqB,2BAA2B,KAAK,eAAe;AAC7F;AASA,eAAsB,qBACpB,aACiB;AACjB,SAAO,UAAU,cAAc,WAAW,CAAC;AAC7C;;;ACZA,eAAsB,qBACpB,OACA,OACA,WACqC;AACrC,QAAM,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC1C,QAAM,kBAAkB,MAAM,MAAM,KAAK,OAAO,kBAAkB;AAElE,QAAM,cAAmD,CAAC;AAC1D,QAAM,yBAAmC,CAAC;AAC1C,aAAW,QAAQ,iBAAiB;AAClC,UAAM,MAAM,MAAM,UAAU,IAAI;AAChC,QAAI,QAAQ,QAAW;AACrB,6BAAuB,KAAK,IAAI;AAChC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM,oBAAoB,OAAO,OAAO,MAAM,GAAG;AACjE,QAAI,CAAC,SAAS;AAIZ,6BAAuB,KAAK,IAAI;AAChC;AAAA,IACF;AACA,QAAI,QAAQ,SAAS,KAAM;AAE3B,UAAM,QAA6B;AAAA,MACjC,YAAY,QAAQ,cAAc,MAAM;AAAA,MACxC,aAAa,QAAQ;AAAA,IACvB;AACA,gBAAY,IAAI,IAAI,QAAQ,aAAa,SAAY,EAAE,GAAG,OAAO,UAAU,QAAQ,SAAS,IAAI;AAAA,EAClG;AAEA,QAAM,gBAAgB,MAAM,qBAAqB,WAAW;AAC5D,QAAM,WAA2B,EAAE,GAAG,GAAG,MAAM,UAAU,YAAY,MAAM,sBAAsB,aAAa,cAAc;AAC5H,SAAO,EAAE,UAAU,uBAAuB;AAC5C;","names":[]}

package/dist/{chunk-ZSX4S5XB.js → chunk-TKVUE4JF.js}

@@ -7,15 +7,15 @@ import {
   joinsDropLeftRows,
   orderReferencesJoinAlias,
   splitAroundJoins
-} from "./chunk-4I522ERM.js";
+} from "./chunk-NCO25JZO.js";
 import {
   describeJoinOn,
   joinOnDispatch,
   normalizeJoinOn
-} from "./chunk-MKXXMNJH.js";
+} from "./chunk-4V3Q35WG.js";
 import {
   ScanBuilder
-} from "./chunk-F24ZZTHQ.js";
+} from "./chunk-JQYKPKG6.js";
 import {
   installMethods
 } from "./chunk-F6NCB7KT.js";
@@ -27,22 +27,22 @@ import {
   pickCompound,
   pickCompoundOrder,
   viaOrdersField
-} from "./chunk-7JE7BDYJ.js";
+} from "./chunk-AL6ML4LA.js";
 import {
   gateTerminal
-} from "./chunk-5O7D6ZTW.js";
+} from "./chunk-FOEDQATO.js";
 import {
   readPath
-} from "./chunk-HLEK5VAN.js";
+} from "./chunk-5WWDGFOS.js";
 import {
   isViaPrefixProbe
-} from "./chunk-Z5HTYMMQ.js";
+} from "./chunk-SYNY3VB5.js";
 import {
   CrossJoinTooLargeError,
   DanglingReferenceError,
   RefNotDeclaredError,
   TraversalCycleError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/kernel/query/relate/explain.ts
 var WARN_FRACTION = 0.8;
@@ -1286,4 +1286,4 @@ export {
   runTraversal,
   installRelate
 };
-//# sourceMappingURL=chunk-ZSX4S5XB.js.map
+//# sourceMappingURL=chunk-TKVUE4JF.js.map

package/dist/{chunk-B57AFBY2.js → chunk-TZZBXPZK.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-formula/overlay-views/with-overlayed-view.ts
 function withOverlayedView(spec) {
@@ -33,4 +33,4 @@ function withOverlayedView(spec) {
 export {
   withOverlayedView
 };
-//# sourceMappingURL=chunk-B57AFBY2.js.map
+//# sourceMappingURL=chunk-TZZBXPZK.js.map

package/dist/{chunk-VNPEWFPD.js → chunk-U2FZNEWJ.js}

@@ -6,15 +6,15 @@ import {
   ViaGraph,
   matchTargetFieldNames,
   schemaFieldKeys
-} from "./chunk-UD5EVGZ7.js";
+} from "./chunk-IUT3GWP3.js";
 import {
   sha256Hex
-} from "./chunk-UYB234ZR.js";
+} from "./chunk-EZGV6F47.js";
 import {
   DerivationCycleError,
   DuplicateBehaviorNameError,
   ValidationError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-formula/derivations/strategy-hash.ts
 async function computeStrategyHash(source, outputKeys, derive, sources) {
@@ -244,4 +244,4 @@ var DerivationRegistry = class {
 export {
   DerivationRegistry
 };
-//# sourceMappingURL=chunk-VNPEWFPD.js.map
+//# sourceMappingURL=chunk-U2FZNEWJ.js.map

package/dist/chunk-U2FZNEWJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/derivations/strategy-hash.ts","../src/with-formula/derivations/registry.ts"],"sourcesContent":["/**\n * Deterministic hash of a derivation strategy's \"shape\": source\n * collection, declared sibling sources, output keys, derive function\n * source. Used to detect\n * strategy drift: a record whose `_derivedFrom.strategyHash` doesn't\n * match the current strategy is considered stale.\n *\n * Web Crypto SHA-256 — no extra deps.\n */\nimport { sha256Hex } from '../../capsule/index.js'\n\nexport async function computeStrategyHash(\n  source: string,\n  outputKeys: readonly string[],\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  derive: (...args: any[]) => any,\n  sources?: ReadonlyArray<string>,\n): Promise<string> {\n  const canonical = JSON.stringify({\n    source,\n    outputs: [...outputKeys].sort(),\n    derive: derive.toString(),\n    // Declared sibling sources — adding/removing a trigger\n    // collection invalidates cached derived records. Omitted when empty\n    // so strategies without siblings keep their existing hash.\n    ...(sources?.length ? { sources: [...sources].sort() } : {}),\n  })\n  const bytes = new TextEncoder().encode(canonical)\n  return sha256Hex(bytes)\n}\n","import { matchTargetFieldNames } from '../../kernel/collection-config.js'\nimport { DerivationCycleError, DuplicateBehaviorNameError, ValidationError } from '../../kernel/errors.js'\nimport { ViaGraph, type FieldRef, type EdgeKind, type Grain } from '../../kernel/via/graph.js'\nimport { schemaFieldKeys } from '../../with-shape/introspection/describe.js'\nimport { computeStrategyHash } from './strategy-hash.js'\nimport { hopCollections, normalizeTriggerBy, type NormalizedTrigger } from './trigger-match.js'\nimport type { DerivationSpec } from './types.js'\n\n/**\n * Whole-record artifact-grain field marker (#638 Task 2). A derivation's\n * `derive()`/a rollup's `compute()` reads the WHOLE source record — there is\n * no single declared field to point at — so a trigger/output collection is\n * modelled as one artifact node per collection (`kernel/via/graph.ts`'s\n * \"Artifact-grain targets... modelled as a field node whose field is the\n * artifact key\" convention). MUST match `materialized-views/registry.ts`'s\n * and `vault.ts`'s overlay-edge marker so cross-registry edges (a derivation\n * feeding into / out of an MV or overlay collection) resolve to the SAME\n * graph node.\n */\nconst WHOLE_RECORD = '*'\n\n/** Strip this registry's `.${WHOLE_RECORD}` artifact suffix off a graph cycle\n *  path entry, recovering the bare collection name — preserves the exact\n *  pre-#638 `DerivationCycleError` message shape (behavior lock) for a pure\n *  record-shape derivation cycle. A rollup's real-field target (not suffixed\n *  `.${WHOLE_RECORD}`) is left untouched. */\nfunction stripArtifactSuffix(displayId: string): string {\n  const suffix = `.${WHOLE_RECORD}`\n  return displayId.endsWith(suffix) ? displayId.slice(0, -suffix.length) : displayId\n}\n\ninterface RegisteredStrategy {\n  // Type-erased to allow the registry to hold heterogeneous strategies.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  spec: DerivationSpec<any, any>\n  strategyHash: string\n  readonly triggers: ReadonlyArray<NormalizedTrigger>\n}\n\n/**\n * Vault-internal registry of derivation strategies. Owned by `Vault`;\n * not exported.\n *\n * @internal\n */\nexport class DerivationRegistry {\n  private readonly _bySource = new Map<string, RegisteredStrategy[]>()\n  private readonly _byOutput = new Map<string, RegisteredStrategy[]>()\n  private readonly _byName = new Map<string, RegisteredStrategy>()\n\n  /**\n   * Register a derivation strategy. If `spec.name` is given and already\n   * registered by another derivation in this vault, throws\n   * {@link DuplicateBehaviorNameError} before indexing.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  async register(spec: DerivationSpec<any, any>): Promise<void> {\n    if (spec.name !== undefined && this._byName.has(spec.name)) {\n      throw new DuplicateBehaviorNameError(spec.name, 'derivation')\n    }\n\n    const outputKeys = Object.keys(spec.outputs)\n    const strategyHash = await computeStrategyHash(spec.source, outputKeys, spec.derive, spec.sources)\n    const triggers = normalizeTriggerBy(spec.triggerBy)\n    const reg: RegisteredStrategy = { spec, strategyHash, triggers }\n\n    if (spec.name !== undefined) this._byName.set(spec.name, reg)\n\n    const fromSource = this._bySource.get(spec.source)\n    if (fromSource) fromSource.push(reg)\n    else this._bySource.set(spec.source, [reg])\n\n    // Declared sibling sources index the SAME `reg` under each\n    // extra collection so `strategiesForSource(extra)` returns it and a\n    // sibling write re-fires the derivation. Sibling keys also enter\n    // `_bySource`, so `validate()`'s cycle DFS walks them automatically.\n    for (const extra of spec.sources ?? []) {\n      const fromExtra = this._bySource.get(extra)\n      if (fromExtra) fromExtra.push(reg)\n      else this._bySource.set(extra, [reg])\n    }\n\n    // FK triggers index the SAME `reg` under each parent collection so\n    // a parent write re-fires the derivation (fanned out to matching source\n    // records in `dispatchDerivations`). Like sources[], these keys enter\n    // `_bySource` so the cycle DFS walks the trigger→output edge.\n    // #1277 — the INTERMEDIATE of a declared hop is indexed too, so a write\n    // that re-points it re-fires the derivation. Without this the hop's whole\n    // correctness argument fails: nothing is written to the trigger or source\n    // collection when an intermediate moves, so no other path can notice, and\n    // every source it used to address is stranded silently. Entering `_bySource`\n    // also puts the hop edge into `validate()`'s cycle DFS, which would\n    // otherwise be blind to it.\n    for (const t of triggers) {\n      for (const hop of hopCollections(t.match)) {\n        const fromHop = this._bySource.get(hop)\n        if (fromHop) { if (!fromHop.includes(reg)) fromHop.push(reg) }\n        else this._bySource.set(hop, [reg])\n      }\n    }\n    for (const t of triggers) {\n      const fromTrigger = this._bySource.get(t.collection)\n      if (fromTrigger) fromTrigger.push(reg)\n      else this._bySource.set(t.collection, [reg])\n    }\n\n    // Rollup: a write to the child `from` collection recomputes\n    // the parent (= spec.source = into) at id child[key]. Index under `from`\n    // so a child write fires it; spec.source (into) is already indexed above,\n    // so a parent write also recomputes its own aggregate (covers the\n    // parent-created-after-children case). The from→into edge enters the cycle\n    // DFS automatically.\n    if (spec.rollup) {\n      const fromRollup = this._bySource.get(spec.rollup.from)\n      if (fromRollup) fromRollup.push(reg)\n      else this._bySource.set(spec.rollup.from, [reg])\n    }\n\n    for (const key of outputKeys) {\n      const output = spec.outputs[key]\n      if (!output) continue\n      const outputCollection = output.collection\n      const arr = this._byOutput.get(outputCollection)\n      if (arr) arr.push(reg)\n      else this._byOutput.set(outputCollection, [reg])\n    }\n  }\n\n  strategiesForSource(source: string): ReadonlyArray<RegisteredStrategy> {\n    return this._bySource.get(source) ?? []\n  }\n\n  strategiesProducingOutput(collection: string): ReadonlyArray<RegisteredStrategy> {\n    return this._byOutput.get(collection) ?? []\n  }\n\n  /**\n   * The #1253-pattern typo guard for match fields (#1249): a misspelt\n   * `to`/`from` silently matches nothing forever, so validate against the\n   * collection's enumerable field set at the earliest point it exists.\n   * `schemaFieldKeys(schema) === undefined` (TS-generic collection,\n   * unreadable validator) is DELIBERATELY silent — those fields are real\n   * and unenumerable. `configKeys` folds in the collection's other\n   * non-schema field declarations (fieldMeta/moneyFields/dictKeyFields/\n   * refs/computed); `denormExempt` is derived here from this registry's\n   * own strategies rather than taken as a parameter — a field this\n   * collection's own derivations write via `denorm` is never a typo.\n   */\n  validateFieldsFor(\n    collectionName: string,\n    schema: unknown,\n    configKeys: ReadonlyArray<string>,\n    viaSources: {\n      readonly computed?: Readonly<Record<string, unknown>> | undefined\n      readonly viaFields?: Readonly<Record<string, unknown>> | undefined\n    } | undefined = undefined,\n  ): void {\n    const targets = matchTargetFieldNames(viaSources ?? {})\n    const virtual = new Set(targets.virtual)\n    const shapeKeys = schemaFieldKeys(schema)\n    // The two checks have DIFFERENT preconditions, which is why one loop runs\n    // both rather than an early return covering both. The typo check needs a\n    // readable field list and must stay silent without one — a false \"unknown\n    // field\" on a TS-generic collection would be worse than no check. The\n    // virtual check needs nothing but the declaration in hand: \"declared, and\n    // never stored\" is provable from the declaration alone (#1266).\n    if (shapeKeys === undefined && virtual.size === 0) return\n    const keys = shapeKeys === undefined ? undefined\n      : new Set([...shapeKeys, ...configKeys, ...targets.declared])\n    const denormExempt = new Set<string>()\n    const regs = new Set([...this._bySource.values()].flat())\n    for (const reg of regs) {\n      if (reg.spec.source !== collectionName) continue\n      for (const out of Object.values(reg.spec.outputs) as Array<{ collection?: string; denorm?: readonly string[] }>) {\n        if (out.collection === collectionName) for (const d of out.denorm ?? []) denormExempt.add(d)\n      }\n    }\n    const unknown = (f: string): boolean =>\n      keys !== undefined && !keys.has(f) && !denormExempt.has(f)\n    for (const reg of regs) {\n      const name = reg.spec.name ?? reg.spec.source\n      for (const t of reg.triggers) {\n        for (const p of t.match) {\n          // `to` reads the SOURCE record; `from` reads the WRITTEN record.\n          // Both are the stored shape, so both refuse a virtual target.\n          if (reg.spec.source === collectionName) {\n            if (virtual.has(p.to)) throw new ValidationError(this._virtualMatchMessage(name, collectionName, p.to, 'to'))\n            if (unknown(p.to)) {\n              throw new ValidationError(\n                `derivation \"${name}\": triggerBy match names source field \"${p.to}\", which \"${collectionName}\" does not declare — a typo here silently matches nothing forever`)\n            }\n          }\n          if (t.collection === collectionName && p.from !== 'id') {\n            if (virtual.has(p.from)) throw new ValidationError(this._virtualMatchMessage(name, collectionName, p.from, 'from'))\n            if (unknown(p.from)) {\n              throw new ValidationError(\n                `derivation \"${name}\": triggerBy match reads \"${p.from}\" from written \"${collectionName}\" records, which that collection does not declare — a typo here silently matches nothing forever`)\n            }\n          }\n        }\n      }\n    }\n  }\n\n  /** #1266 — one message shape for both match sides; see {@link matchTargetFieldNames}. */\n  private _virtualMatchMessage(name: string, collectionName: string, field: string, side: 'to' | 'from'): string {\n    const where = side === 'to'\n      ? `names source field \"${field}\", which \"${collectionName}\"`\n      : `reads \"${field}\" from written \"${collectionName}\" records, which that collection`\n    return `derivation \"${name}\": triggerBy match ${where} declares as a VIRTUAL computed field — virtual fields are evaluated on read and never stored, so the matcher would read every candidate record and match nothing, forever. Declare it as \\`mode: 'materialized'\\` (stored, indexable) or match on a stored field.`\n  }\n\n  /**\n   * All registered strategies as a flat, deduplicated array.\n   * Each strategy is indexed once per source (not once per output key),\n   * so iterating `_bySource.values()` naturally yields each strategy\n   * exactly once per source — deduplication is handled by flattening\n   * the per-source arrays and collecting into a Set by identity.\n   *\n   * Used by `dumpSchema()` / `describeDerivations()` in the introspection\n   * walker to populate the derivations map.\n   */\n  all(): ReadonlyArray<RegisteredStrategy> {\n    const seen = new Set<RegisteredStrategy>()\n    for (const strategies of this._bySource.values()) {\n      for (const s of strategies) seen.add(s)\n    }\n    return [...seen]\n  }\n\n  /**\n   * Graph edges for #638 Task 2: one `'derivation'`/`'record'` edge per\n   * (non-self-write) output key — target = the output collection (a\n   * `WHOLE_RECORD` artifact node), sources = every collection that can\n   * trigger this strategy (`source`, `sources[]`, `triggerBy[].collection`,\n   * and — for a rollup — `rollup.from`), mirroring EXACTLY the trigger keys\n   * `register()` indexes under `_bySource`. The self-write reverse-denorm\n   * output (`output.collection === source` with `denorm` declared) is\n   * skipped — the SAME condition the old local DFS used; it is not a cycle\n   * (see the comment `validate()` used to carry, now on this skip).\n   * Rollups ADDITIONALLY get a dedicated `'rollup'`/`'aggregate'` edge\n   * targeting the real `rollup.field` on the parent (`source`) — the\n   * self-write output above only covers the cycle-DFS skip, not\n   * dispatch/taint (Tasks 3/4/6), which need the real field.\n   */\n  edges(): ReadonlyArray<{ readonly target: FieldRef; readonly sources: readonly FieldRef[]; readonly kind: EdgeKind; readonly grain: Grain }> {\n    const out: Array<{ target: FieldRef; sources: FieldRef[]; kind: EdgeKind; grain: Grain }> = []\n    for (const reg of this.all()) {\n      const spec = reg.spec\n      const triggerCollections = [\n        spec.source,\n        ...(spec.sources ?? []),\n        ...(spec.triggerBy ?? []).map((t) => t.collection),\n        ...(spec.rollup ? [spec.rollup.from] : []),\n      ]\n      const sources: FieldRef[] = triggerCollections.map((c) => ({ collection: c, field: WHOLE_RECORD }))\n      for (const key of Object.keys(spec.outputs)) {\n        const output = spec.outputs[key]\n        if (!output) continue\n        if (output.shape === 'record' && output.collection === spec.source && output.denorm !== undefined) continue\n        out.push({ target: { collection: output.collection, field: WHOLE_RECORD }, sources, kind: 'derivation', grain: 'record' })\n      }\n      if (spec.rollup) {\n        out.push({\n          target: { collection: spec.source, field: spec.rollup.field },\n          sources: [{ collection: spec.rollup.from, field: WHOLE_RECORD }],\n          kind: 'rollup',\n          grain: 'aggregate',\n        })\n      }\n    }\n    return out\n  }\n\n  /**\n   * Cycle detection, delegated to `ViaGraph.assertAcyclic()` (#638 Task 2 —\n   * retires the local DFS). Call after all `register()` calls complete (i.e.\n   * at vault open). Throws `DerivationCycleError` on the first cycle found —\n   * SAME class/timing as before; the message/path is byte-identical to the\n   * pre-#638 shape for a pure record-shape derivation cycle (the\n   * `WHOLE_RECORD` artifact suffix is stripped back to a bare collection\n   * name before re-throwing).\n   *\n   * `graph` is the caller's shared per-vault graph, ALREADY carrying this\n   * registry's `edges()` (the caller registers them — see `Vault._initDerivations`)\n   * — omit it (e.g. this registry's own unit tests) to validate this\n   * registry's edges in isolation against a throwaway graph.\n   */\n  validate(graph?: ViaGraph): void {\n    const g = graph ?? new ViaGraph()\n    if (!graph) {\n      for (const edge of this.edges()) g.registerDerived(edge.target, edge.sources, edge.kind, edge.grain)\n    }\n    try {\n      g.assertAcyclic()\n    } catch (e) {\n      if (e instanceof DerivationCycleError) throw new DerivationCycleError(e.path.map(stripArtifactSuffix))\n      throw e\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAWA,eAAsB,oBACpB,QACA,YAEA,QACA,SACiB;AACjB,QAAM,YAAY,KAAK,UAAU;AAAA,IAC/B;AAAA,IACA,SAAS,CAAC,GAAG,UAAU,EAAE,KAAK;AAAA,IAC9B,QAAQ,OAAO,SAAS;AAAA;AAAA;AAAA;AAAA,IAIxB,GAAI,SAAS,SAAS,EAAE,SAAS,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,EAC5D,CAAC;AACD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,SAAS;AAChD,SAAO,UAAU,KAAK;AACxB;;;ACVA,IAAM,eAAe;AAOrB,SAAS,oBAAoB,WAA2B;AACtD,QAAM,SAAS,IAAI,YAAY;AAC/B,SAAO,UAAU,SAAS,MAAM,IAAI,UAAU,MAAM,GAAG,CAAC,OAAO,MAAM,IAAI;AAC3E;AAgBO,IAAM,qBAAN,MAAyB;AAAA,EACb,YAAY,oBAAI,IAAkC;AAAA,EAClD,YAAY,oBAAI,IAAkC;AAAA,EAClD,UAAU,oBAAI,IAAgC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ/D,MAAM,SAAS,MAA+C;AAC5D,QAAI,KAAK,SAAS,UAAa,KAAK,QAAQ,IAAI,KAAK,IAAI,GAAG;AAC1D,YAAM,IAAI,2BAA2B,KAAK,MAAM,YAAY;AAAA,IAC9D;AAEA,UAAM,aAAa,OAAO,KAAK,KAAK,OAAO;AAC3C,UAAM,eAAe,MAAM,oBAAoB,KAAK,QAAQ,YAAY,KAAK,QAAQ,KAAK,OAAO;AACjG,UAAM,WAAW,mBAAmB,KAAK,SAAS;AAClD,UAAM,MAA0B,EAAE,MAAM,cAAc,SAAS;AAE/D,QAAI,KAAK,SAAS,OAAW,MAAK,QAAQ,IAAI,KAAK,MAAM,GAAG;AAE5D,UAAM,aAAa,KAAK,UAAU,IAAI,KAAK,MAAM;AACjD,QAAI,WAAY,YAAW,KAAK,GAAG;AAAA,QAC9B,MAAK,UAAU,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC;AAM1C,eAAW,SAAS,KAAK,WAAW,CAAC,GAAG;AACtC,YAAM,YAAY,KAAK,UAAU,IAAI,KAAK;AAC1C,UAAI,UAAW,WAAU,KAAK,GAAG;AAAA,UAC5B,MAAK,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC;AAAA,IACtC;AAaA,eAAW,KAAK,UAAU;AACxB,iBAAW,OAAO,eAAe,EAAE,KAAK,GAAG;AACzC,cAAM,UAAU,KAAK,UAAU,IAAI,GAAG;AACtC,YAAI,SAAS;AAAE,cAAI,CAAC,QAAQ,SAAS,GAAG,EAAG,SAAQ,KAAK,GAAG;AAAA,QAAE,MACxD,MAAK,UAAU,IAAI,KAAK,CAAC,GAAG,CAAC;AAAA,MACpC;AAAA,IACF;AACA,eAAW,KAAK,UAAU;AACxB,YAAM,cAAc,KAAK,UAAU,IAAI,EAAE,UAAU;AACnD,UAAI,YAAa,aAAY,KAAK,GAAG;AAAA,UAChC,MAAK,UAAU,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC;AAAA,IAC7C;AAQA,QAAI,KAAK,QAAQ;AACf,YAAM,aAAa,KAAK,UAAU,IAAI,KAAK,OAAO,IAAI;AACtD,UAAI,WAAY,YAAW,KAAK,GAAG;AAAA,UAC9B,MAAK,UAAU,IAAI,KAAK,OAAO,MAAM,CAAC,GAAG,CAAC;AAAA,IACjD;AAEA,eAAW,OAAO,YAAY;AAC5B,YAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,UAAI,CAAC,OAAQ;AACb,YAAM,mBAAmB,OAAO;AAChC,YAAM,MAAM,KAAK,UAAU,IAAI,gBAAgB;AAC/C,UAAI,IAAK,KAAI,KAAK,GAAG;AAAA,UAChB,MAAK,UAAU,IAAI,kBAAkB,CAAC,GAAG,CAAC;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,oBAAoB,QAAmD;AACrE,WAAO,KAAK,UAAU,IAAI,MAAM,KAAK,CAAC;AAAA,EACxC;AAAA,EAEA,0BAA0B,YAAuD;AAC/E,WAAO,KAAK,UAAU,IAAI,UAAU,KAAK,CAAC;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,kBACE,gBACA,QACA,YACA,aAGgB,QACV;AACN,UAAM,UAAU,sBAAsB,cAAc,CAAC,CAAC;AACtD,UAAM,UAAU,IAAI,IAAI,QAAQ,OAAO;AACvC,UAAM,YAAY,gBAAgB,MAAM;AAOxC,QAAI,cAAc,UAAa,QAAQ,SAAS,EAAG;AACnD,UAAM,OAAO,cAAc,SAAY,SACnC,oBAAI,IAAI,CAAC,GAAG,WAAW,GAAG,YAAY,GAAG,QAAQ,QAAQ,CAAC;AAC9D,UAAM,eAAe,oBAAI,IAAY;AACrC,UAAM,OAAO,IAAI,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,EAAE,KAAK,CAAC;AACxD,eAAW,OAAO,MAAM;AACtB,UAAI,IAAI,KAAK,WAAW,eAAgB;AACxC,iBAAW,OAAO,OAAO,OAAO,IAAI,KAAK,OAAO,GAAiE;AAC/G,YAAI,IAAI,eAAe,eAAgB,YAAW,KAAK,IAAI,UAAU,CAAC,EAAG,cAAa,IAAI,CAAC;AAAA,MAC7F;AAAA,IACF;AACA,UAAM,UAAU,CAAC,MACf,SAAS,UAAa,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC;AAC3D,eAAW,OAAO,MAAM;AACtB,YAAM,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK;AACvC,iBAAW,KAAK,IAAI,UAAU;AAC5B,mBAAW,KAAK,EAAE,OAAO;AAGvB,cAAI,IAAI,KAAK,WAAW,gBAAgB;AACtC,gBAAI,QAAQ,IAAI,EAAE,EAAE,EAAG,OAAM,IAAI,gBAAgB,KAAK,qBAAqB,MAAM,gBAAgB,EAAE,IAAI,IAAI,CAAC;AAC5G,gBAAI,QAAQ,EAAE,EAAE,GAAG;AACjB,oBAAM,IAAI;AAAA,gBACR,eAAe,IAAI,0CAA0C,EAAE,EAAE,aAAa,cAAc;AAAA,cAAmE;AAAA,YACnK;AAAA,UACF;AACA,cAAI,EAAE,eAAe,kBAAkB,EAAE,SAAS,MAAM;AACtD,gBAAI,QAAQ,IAAI,EAAE,IAAI,EAAG,OAAM,IAAI,gBAAgB,KAAK,qBAAqB,MAAM,gBAAgB,EAAE,MAAM,MAAM,CAAC;AAClH,gBAAI,QAAQ,EAAE,IAAI,GAAG;AACnB,oBAAM,IAAI;AAAA,gBACR,eAAe,IAAI,6BAA6B,EAAE,IAAI,mBAAmB,cAAc;AAAA,cAAkG;AAAA,YAC7L;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGQ,qBAAqB,MAAc,gBAAwB,OAAe,MAA6B;AAC7G,UAAM,QAAQ,SAAS,OACnB,uBAAuB,KAAK,aAAa,cAAc,MACvD,UAAU,KAAK,mBAAmB,cAAc;AACpD,WAAO,eAAe,IAAI,sBAAsB,KAAK;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAyC;AACvC,UAAM,OAAO,oBAAI,IAAwB;AACzC,eAAW,cAAc,KAAK,UAAU,OAAO,GAAG;AAChD,iBAAW,KAAK,WAAY,MAAK,IAAI,CAAC;AAAA,IACxC;AACA,WAAO,CAAC,GAAG,IAAI;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,QAA6I;AAC3I,UAAM,MAAsF,CAAC;AAC7F,eAAW,OAAO,KAAK,IAAI,GAAG;AAC5B,YAAM,OAAO,IAAI;AACjB,YAAM,qBAAqB;AAAA,QACzB,KAAK;AAAA,QACL,GAAI,KAAK,WAAW,CAAC;AAAA,QACrB,IAAI,KAAK,aAAa,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU;AAAA,QACjD,GAAI,KAAK,SAAS,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC;AAAA,MAC1C;AACA,YAAM,UAAsB,mBAAmB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,aAAa,EAAE;AAClG,iBAAW,OAAO,OAAO,KAAK,KAAK,OAAO,GAAG;AAC3C,cAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,YAAI,CAAC,OAAQ;AACb,YAAI,OAAO,UAAU,YAAY,OAAO,eAAe,KAAK,UAAU,OAAO,WAAW,OAAW;AACnG,YAAI,KAAK,EAAE,QAAQ,EAAE,YAAY,OAAO,YAAY,OAAO,aAAa,GAAG,SAAS,MAAM,cAAc,OAAO,SAAS,CAAC;AAAA,MAC3H;AACA,UAAI,KAAK,QAAQ;AACf,YAAI,KAAK;AAAA,UACP,QAAQ,EAAE,YAAY,KAAK,QAAQ,OAAO,KAAK,OAAO,MAAM;AAAA,UAC5D,SAAS,CAAC,EAAE,YAAY,KAAK,OAAO,MAAM,OAAO,aAAa,CAAC;AAAA,UAC/D,MAAM;AAAA,UACN,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,SAAS,OAAwB;AAC/B,UAAM,IAAI,SAAS,IAAI,SAAS;AAChC,QAAI,CAAC,OAAO;AACV,iBAAW,QAAQ,KAAK,MAAM,EAAG,GAAE,gBAAgB,KAAK,QAAQ,KAAK,SAAS,KAAK,MAAM,KAAK,KAAK;AAAA,IACrG;AACA,QAAI;AACF,QAAE,cAAc;AAAA,IAClB,SAAS,GAAG;AACV,UAAI,aAAa,qBAAsB,OAAM,IAAI,qBAAqB,EAAE,KAAK,IAAI,mBAAmB,CAAC;AACrG,YAAM;AAAA,IACR;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-5FDLC6G7.js → chunk-UA372JHH.js}

@@ -6,7 +6,7 @@ import {
   ConflictError,
   InvariantError,
   ValidationError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-commit/tx/atomic-eligibility.ts
 function canCommitAtomically(db, ctx) {
@@ -322,7 +322,7 @@ async function runTransaction(db, fn, options, txInvariants) {
     db._clearActiveTxContext(ctx);
   }
   if (ctx._amendment) {
-    const { GuardExecutor } = await import("./executor-BI5CHWRY.js");
+    const { GuardExecutor } = await import("./executor-LBBBRTN5.js");
     try {
       for (const [vaultName, v] of ctx._amendmentVaults) {
         const registry = v._getGuardRegistry();
@@ -500,4 +500,4 @@ export {
   TxCollection,
   runTransaction
 };
-//# sourceMappingURL=chunk-5FDLC6G7.js.map
+//# sourceMappingURL=chunk-UA372JHH.js.map

package/dist/{chunk-PDCG6PR5.js → chunk-UEFOQH74.js}

@@ -1,6 +1,6 @@
 import {
   SealedRecordNotEnabledError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-audit/sealed-record/strategy.ts
 var NO_SEALED_RECORD = {
@@ -18,4 +18,4 @@ var NO_SEALED_RECORD = {
 export {
   NO_SEALED_RECORD
 };
-//# sourceMappingURL=chunk-PDCG6PR5.js.map
+//# sourceMappingURL=chunk-UEFOQH74.js.map

package/dist/chunk-UEFOQH74.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/sealed-record/strategy.ts"],"sourcesContent":["/**\n * Sealed-record (grantor-side) capability strategy — the three on-demand vault\n * methods the record-scoped CEK sealing surface routes through. The active\n * engine ({@link withSealedRecord}) dynamically imports the `record-keys`\n * grantor cores (keeping them reachable only via opt-in); {@link NO_SEALED_RECORD}\n * throws. The vault always assembles the per-call {@link SealingContext} and\n * delegates here, so an un-opted-in caller hits `NO_SEALED_RECORD`'s throw.\n *\n * Note: the recipient-host opener (`openSealedRecord`) is a pure decrypt\n * function exported from this subpath and is NOT gated — it runs on a remote\n * host with no `createNoydb` instance (the same way the attestation verifier\n * stays ungated). Only the vault-side grantor operations are the capability.\n * @internal\n */\nimport type { SealingContext } from '../../capsule/index.js'\nimport type { RecipientSealer } from '../../with-party/team/managed-secret.js'\nimport { SealedRecordNotEnabledError } from '../../kernel/errors.js'\n\nexport interface SealedRecordStrategy {\n  sealRecordToHost(\n    ctx: SealingContext,\n    collection: string,\n    id: string,\n    hostSealer: RecipientSealer,\n    opts: { expiresAt: string },\n  ): Promise<{ pid: string; envelopeKey: string }>\n  revokeSealedRecord(\n    ctx: SealingContext,\n    collection: string,\n    id: string,\n    pid: string,\n    opts?: { hard?: boolean },\n  ): Promise<void>\n  rotateRecordCek(ctx: SealingContext, collection: string, id: string): Promise<void>\n}\n\n/**\n * No-op stub — the floor default. Every grantor method throws\n * {@link SealedRecordNotEnabledError}; opt in with\n * `sealedRecordStrategy: withSealedRecord()` in createNoydb. @internal\n */\nexport const NO_SEALED_RECORD: SealedRecordStrategy = {\n  async sealRecordToHost() { throw new SealedRecordNotEnabledError() },\n  async revokeSealedRecord() { throw new SealedRecordNotEnabledError() },\n  async rotateRecordCek() { throw new SealedRecordNotEnabledError() },\n}\n"],"mappings":";;;;;AAyCO,IAAM,mBAAyC;AAAA,EACpD,MAAM,mBAAmB;AAAE,UAAM,IAAI,4BAA4B;AAAA,EAAE;AAAA,EACnE,MAAM,qBAAqB;AAAE,UAAM,IAAI,4BAA4B;AAAA,EAAE;AAAA,EACrE,MAAM,kBAAkB;AAAE,UAAM,IAAI,4BAA4B;AAAA,EAAE;AACpE;","names":[]}

package/dist/{chunk-HVSCEIYL.js → chunk-UIYESRD6.js}

@@ -1,25 +1,23 @@
 import {
   freezeSnapshotOnly
-} from "./chunk-S57HTZ6X.js";
+} from "./chunk-IMQKWR46.js";
 import {
   resolveManagedSecret
-} from "./chunk-ENAG3IY7.js";
+} from "./chunk-3XJQBBZD.js";
 import {
   assertRosterTagValid,
   createOwnerKeyring,
   mintRosterTag,
   nextRosterEpoch,
   requireRosterKey
-} from "./chunk-M7NI3IWE.js";
-import {
-  buildRecordEnvelope
-} from "./chunk-SEE332EV.js";
+} from "./chunk-XSPFDUDG.js";
 import {
+  buildRecordEnvelope,
   wrapKey
-} from "./chunk-UYB234ZR.js";
+} from "./chunk-EZGV6F47.js";
 import {
   PermissionDeniedError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-party/team/deed.ts
 var DEED_RECORD_ID = "deed";
@@ -39,7 +37,7 @@ async function loadDeedMarker(store, vault) {
   if (!envelope) return null;
   let payload;
   try {
-    payload = JSON.parse(envelope._data);
+    payload = JSON.parse(envelope._data ?? "");
   } catch {
     return null;
   }
@@ -99,7 +97,7 @@ async function liberateVault(vault, opts) {
   if (!env) {
     throw new PermissionDeniedError(`new owner keyring for "${opts.newOwnerId}" did not persist`);
   }
-  const keyringFile = JSON.parse(env._data);
+  const keyringFile = JSON.parse(env._data ?? "");
   const mintedRosterKey = requireRosterKey(newOwner, "liberateVault");
   await assertRosterTagValid(keyringFile, mintedRosterKey, opts.newOwnerId);
   const mergedDeks = { ...keyringFile.deks };
@@ -137,4 +135,4 @@ export {
   isDeedVault,
   liberateVault
 };
-//# sourceMappingURL=chunk-HVSCEIYL.js.map
+//# sourceMappingURL=chunk-UIYESRD6.js.map

package/dist/chunk-UIYESRD6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/deed.ts","../src/with-party/custody/liberate.ts"],"sourcesContent":["/**\n * FR-6 — Deed: sealed / hidden-owner provisioning.\n *\n * A **Deed** is a vault owned by a *latent* principal who never\n * authenticates. The owner credential (the random secret that\n * derives `KEK_owner`) is minted machine-side and sealed under a\n * **non-firm** {@link NoydbSealer} — that sealing boundary is\n * the cryptographic *inalienability anchor*: whoever holds the\n * provider (the client / their KMS) is the only party that can ever\n * re-derive `KEK_owner`. A firm-side custodian operates the vault\n * fully but can never reach the owner key — there is deliberately NO\n * firm-controlled fallback.\n *\n * Provisioning reuses the managed-mode seam:\n *   - {@link resolveManagedSecret} mints + seals + persists the random\n *     secret at `_meta/sealed-secret` (and unseals it on every\n *     subsequent open through the same provider).\n *   - {@link createOwnerKeyring} derives `KEK_owner` from that\n *     secret and writes the `_keyring/<ownerUserId>` file.\n *\n * On top of that, a Deed writes a `_meta/deed` **marker**. The marker\n * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH\n * sealing boundary protects them, so it must be readable without\n * unlocking the vault (a custodian or auditor inspecting the vault must\n * be able to see \"this is a Deed vault, owner = X, sealed under Y\"\n * without any key). The marker itself is therefore never sealed; only\n * the owner *credential* is.\n *\n * @module\n */\n\nimport { buildRecordEnvelope } from '../../capsule/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { createOwnerKeyring } from './keyring.js'\nimport type { NoydbSealer } from './managed-secret.js'\nimport { resolveManagedSecret } from './managed-secret.js'\n\n/** Reserved id for the Deed marker under `_meta`. */\nexport const DEED_RECORD_ID = 'deed' as const\n\n/**\n * Plaintext metadata recording a vault's latent-owner Deed. Persisted\n * at `_meta/deed`. Readable without unlocking the vault by design — it\n * carries no secret material, only the identity of the latent owner\n * and the sealing boundary that anchors inalienability.\n */\nexport interface DeedMarker {\n  /** The latent owner principal — the user id of the `_keyring/<id>` owner file. */\n  readonly ownerUserId: string\n  /**\n   * The `NoydbSealer.id` the owner credential is sealed under.\n   * The inalienability anchor: only the holder of this (non-firm)\n   * provider can re-derive `KEK_owner`. Audit metadata — never secret.\n   */\n  readonly sealedUnder: string\n  /** Always `true` for a Deed — the owner never authenticates interactively. */\n  readonly latent: true\n  /** ISO-8601 timestamp the Deed was issued. */\n  readonly issuedAt: string\n  /**\n   * ISO-8601 timestamp the vault was liberated (a new owner claimed it\n   * via the audited Liberate ceremony), if any. Absent until liberation.\n   */\n  readonly liberatedAt?: string\n}\n\n/**\n * Wire-format payload stored inside the `_meta/deed` envelope. Carries\n * a magic marker for forensics + the {@link DeedMarker} fields. JSON,\n * AES-GCM bypassed (the marker is plaintext metadata by design).\n */\ninterface DeedEnvelopePayload extends DeedMarker {\n  readonly _noydb_deed: 1\n}\n\n/**\n * Provision a Deed: a latent owner whose credential is sealed under\n * `sealing` (a NON-firm provider). Mints + seals the owner secret\n * via {@link resolveManagedSecret}, derives the owner keyring via\n * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`\n * marker. Returns the unlocked owner keyring.\n *\n * The returned keyring is the only in-memory window onto `KEK_owner`\n * for this call; the persistent re-entry point is the sealing provider\n * (re-run {@link resolveManagedSecret} with the same provider to\n * re-resolve the secret, then {@link createOwnerKeyring}/load to\n * unlock — no interactive secret is ever required).\n *\n * There is deliberately no firm-controlled fallback: the marker's\n * `sealedUnder` is the single cryptographic anchor of ownership.\n */\nexport async function createDeedOwner(\n  store: NoydbStore,\n  vault: string,\n  ownerUserId: string,\n  sealing: NoydbSealer,\n): Promise<UnlockedKeyring> {\n  // 1. Mint + seal + persist the random owner secret under the\n  //    non-firm provider (writes _meta/sealed-secret).\n  const secret = await resolveManagedSecret(store, vault, sealing)\n\n  // 2. Derive KEK_owner from the (never-human-seen) secret and\n  //    write the owner keyring file.\n  const keyring = await createOwnerKeyring(store, vault, { userId: ownerUserId, secret: secret })\n\n  // 3. Write the plaintext Deed marker. NOT sealed — it is audit\n  //    metadata that must be readable without unlocking.\n  await saveDeedMarker(store, vault, {\n    ownerUserId,\n    sealedUnder: sealing.id,\n    latent: true,\n    issuedAt: new Date().toISOString(),\n  })\n\n  return keyring\n}\n\n/**\n * Read the {@link DeedMarker} from `_meta/deed`, or `null` if the vault\n * has no Deed marker (i.e. it is not a Deed vault). Plaintext read — no\n * unlocking required.\n */\nexport async function loadDeedMarker(\n  store: NoydbStore,\n  vault: string,\n): Promise<DeedMarker | null> {\n  const envelope = await store.get(vault, '_meta', DEED_RECORD_ID)\n  if (!envelope) return null\n  let payload: unknown\n  try {\n    payload = JSON.parse(envelope._data ?? '')\n  } catch {\n    return null\n  }\n  if (typeof payload !== 'object' || payload === null) return null\n  const r = payload as Record<string, unknown>\n  if (r._noydb_deed !== 1) return null\n  if (\n    typeof r.ownerUserId !== 'string'\n    || typeof r.sealedUnder !== 'string'\n    || r.latent !== true\n    || typeof r.issuedAt !== 'string'\n  ) {\n    return null\n  }\n  const marker: DeedMarker = {\n    ownerUserId: r.ownerUserId,\n    sealedUnder: r.sealedUnder,\n    latent: true,\n    issuedAt: r.issuedAt,\n    ...(typeof r.liberatedAt === 'string' ? { liberatedAt: r.liberatedAt } : {}),\n  }\n  return marker\n}\n\n/** Whether `vault` carries a Deed marker (a sealed/latent owner). */\nexport async function isDeedVault(\n  store: NoydbStore,\n  vault: string,\n): Promise<boolean> {\n  return (await loadDeedMarker(store, vault)) !== null\n}\n\n/**\n * Persist a {@link DeedMarker} at `_meta/deed`. Mirrors\n * `saveSealedSecret`'s envelope shape: a standard\n * {@link EncryptedEnvelope} with AES-GCM bypassed (`_iv: ''`), the\n * payload stored as plaintext JSON in `_data`. The marker is metadata,\n * not a secret — sealing it would defeat its purpose (auditors /\n * custodians must read it without a key).\n *\n * @internal — used by `createDeedOwner` and (later) the Liberate\n * ceremony to stamp `liberatedAt`.\n */\nexport async function saveDeedMarker(\n  store: NoydbStore,\n  vault: string,\n  marker: DeedMarker,\n): Promise<void> {\n  const persisted: DeedEnvelopePayload = { _noydb_deed: 1, ...marker }\n  const prior = await store.get(vault, '_meta', DEED_RECORD_ID)\n  const env = buildRecordEnvelope(\n    { collection: '_meta', id: DEED_RECORD_ID, version: (prior?._v ?? 0) + 1 },\n    // AES-GCM bypassed — the marker is plaintext audit metadata.\n    { iv: '', data: JSON.stringify(persisted) },\n  )\n  await store.put(vault, '_meta', DEED_RECORD_ID, env)\n}\n","/**\n * `liberateVault` — the audited claim of ownership over a\n * sealed-owner (Deed) vault. The inverse of withdrawal.\n *\n * A **Deed** vault's owner credential is sealed under a non-firm provider, so\n * the firm-side **custodian** (which holds every collection DEK and operates\n * the vault fully) can never reach `KEK_owner`. Liberation is the ONLY route\n * by which a custodian assumes ownership, and it is deliberately a manual,\n * audited ceremony:\n *\n *   1. gate `'liberate-vault'` (fail-closed)\n *   2. caller MUST be the `custodian` (the de-facto authority holding the DEKs)\n *   3. freeze a PRE-liberation EVIDENCE snapshot (hash-pinned in the ledger) —\n *      but PRESERVE the live data for the new owner (see the freeze decision\n *      below)\n *   4. mint a NEW owner keyring re-wrapping the incumbent DEKs under the new\n *      owner's KEK\n *   5. lifecycle ledger `liberation-claimed:<newOwnerId>:<legalBasis>`\n *   6. stamp the `_meta/deed` marker with `liberatedAt`\n *\n * ## Security: the inalienability floor\n *\n * Liberation **mints a new owner from the custodian's DEKs** — it does NOT\n * unseal the original sealed owner. The old sealed-owner credential is left\n * untouched and ORPHANED (its `_keyring/<id>` file remains, its KEK is still\n * sealed under the non-firm provider), never impersonated. The new owner is a\n * DISTINCT principal under a fresh KEK derived from `newOwnerSecret`. This\n * preserves the inalienability floor: the act of claiming ownership is itself\n * auditable and produces a different principal, rather than silently assuming\n * the latent owner's identity.\n *\n * ## Freeze decision: snapshot-only, not freeze-and-delete\n *\n * `freezeAndDeleteClosure` (withdraw-accessible.ts) writes a hash-pinned\n * snapshot and THEN delete-closures the live records — correct for a\n * destructive withdrawal, WRONG for liberation. Liberation transfers\n * operational continuity; it must leave the live data intact for the new\n * owner. We therefore call the snapshot-only core `freezeSnapshotOnly`\n * (factored out of that module; the freeze-AND-delete withdrawal path is\n * unchanged) to pin the evidence snapshot while preserving the records.\n *\n * @module\n */\n\nimport type { Vault } from '../../kernel/vault.js'\nimport type { FactorProofBundle, KeyringFile } from '../../kernel/types.js'\nimport { PermissionDeniedError } from '../../kernel/errors.js'\nimport { wrapKey } from '../../capsule/index.js'\nimport { createOwnerKeyring, requireRosterKey } from '../team/keyring.js'\nimport { mintRosterTag, assertRosterTagValid } from '../team/roster-tag.js'\nimport { nextRosterEpoch } from '../team/roster-epoch.js'\nimport type { FrozenSnapshotRef } from '../../with-audit/portability/withdraw-accessible.js'\nimport { freezeSnapshotOnly } from '../../with-audit/portability/withdraw-accessible.js'\nimport { loadDeedMarker, saveDeedMarker } from '../team/deed.js'\n\nexport interface LiberateOptions {\n  /** The id of the new owner principal the custodian mints by claiming ownership. */\n  readonly newOwnerId: string\n  /** The secret that derives the new owner's KEK (the DEKs are re-wrapped under it). */\n  readonly newOwnerSecret: string\n  /** Legal/contractual basis recorded in the audit (e.g. 'contractual-handover'). */\n  readonly legalBasis: string\n  readonly factors?: FactorProofBundle\n}\n\nexport interface LiberateResult {\n  /** The hash-pinned pre-liberation evidence snapshot. */\n  readonly snapshot: FrozenSnapshotRef\n}\n\n/**\n * Audited claim of ownership over a sealed-owner vault by its custodian. See\n * the module doc for the full ceremony + security rationale.\n */\nexport async function liberateVault(\n  vault: Vault,\n  opts: LiberateOptions,\n): Promise<LiberateResult> {\n  // 1. gate — fail-closed `liberate-vault`.\n  await vault.noydb.checkGate(vault.name, 'liberate-vault', opts.factors)\n\n  // 2. caller must be the custodian (the de-facto authority holding the DEKs).\n  const { name: vaultName, adapter, keyring } = vault._introspectState()\n  if (keyring.role !== 'custodian') {\n    throw new PermissionDeniedError(\n      'liberation is claimed only by the custodian (the de-facto authority holding the DEKs)',\n    )\n  }\n\n  // Refuse to clobber an existing principal: the new owner must be a FRESH id.\n  // (Checked before any side effect so a colliding id never leaves a half-run\n  //  ceremony — no orphan snapshot, no partial keyring overwrite.)\n  const existing = await adapter.get(vaultName, '_keyring', opts.newOwnerId)\n  if (existing) {\n    throw new PermissionDeniedError(\n      `liberateVault: newOwnerId \"${opts.newOwnerId}\" already exists as a principal; choose a fresh id (liberation mints a distinct owner, it never overwrites an existing keyring)`,\n    )\n  }\n\n  // 3. Pre-liberation EVIDENCE snapshot of every operational collection —\n  //    snapshot-only (live data preserved for the new owner; liberation\n  //    transfers operational continuity, it does not erase).\n  const collections = await listOperationalCollections(vault)\n  const snapshot = await freezeSnapshotOnly(vault, collections, { actorUserId: keyring.userId })\n\n  // 4. Mint a NEW owner keyring, re-wrapping the incumbent DEKs under the new\n  //    owner's fresh KEK. The old sealed owner is NOT unsealed — a DISTINCT\n  //    principal is minted and the original owner credential is left orphaned\n  //    (inalienability floor). Mirrors adopt-partition.ts's DEK re-wrap.\n  const newOwner = await createOwnerKeyring(adapter, vaultName, { userId: opts.newOwnerId, secret: opts.newOwnerSecret })\n  if (!newOwner.kek) {\n    throw new PermissionDeniedError(\n      `new owner keyring for \"${opts.newOwnerId}\" has no KEK to re-wrap the incumbent DEKs under`,\n    )\n  }\n  const env = await adapter.get(vaultName, '_keyring', opts.newOwnerId)\n  if (!env) {\n    throw new PermissionDeniedError(`new owner keyring for \"${opts.newOwnerId}\" did not persist`)\n  }\n  const keyringFile = JSON.parse(env._data ?? '') as KeyringFile\n  // #1096 — this is a read-BACK of the file `createOwnerKeyring` just wrote, and\n  // it is about to be edited and restamped, so the store gets a window to alter\n  // it in between. Verified against the NEW owner's own roster key, not the\n  // incumbent's: at this instant the file is still stamped under the fresh key\n  // minted above (the swap to the incumbent key happens below).\n  const mintedRosterKey = requireRosterKey(newOwner, 'liberateVault')\n  await assertRosterTagValid(keyringFile, mintedRosterKey, opts.newOwnerId)\n  const mergedDeks: Record<string, string> = { ...keyringFile.deks }\n  for (const [collection, dek] of keyring.deks) {\n    mergedDeks[collection] = await wrapKey(dek, newOwner.kek)\n  }\n  // #1096 — liberation joins a new owner to an EXISTING vault, so the vault's\n  // roster key must stay the incumbent one. `createOwnerKeyring` above minted a\n  // fresh roster key (correct for a new vault, wrong here), and the merge loop\n  // has just overwritten `_roster` with the incumbent's — so the tag it stamped\n  // no longer matches the key in the file. Restamp under the key that actually\n  // ends up persisted, or the new owner cannot open the vault they just claimed.\n  //\n  // Keeping the incumbent key is the substantive half: a fresh one would leave\n  // the new owner unable to verify any co-member's roster, and every co-member\n  // unable to verify theirs.\n  const rosterKey = requireRosterKey(keyring, 'liberateVault')\n  const merged: KeyringFile = { ...keyringFile, deks: mergedDeks }\n  // #1097 — stamped BEFORE the tag is minted, so it lands inside the\n  // authenticated canonical and a store can neither edit nor strip it.\n  const withEpoch = { ...merged, roster_epoch: nextRosterEpoch(keyringFile.roster_epoch) }\n  const mergedFile: KeyringFile = { ...withEpoch, roster_tag: await mintRosterTag(withEpoch, rosterKey) }\n  await adapter.put(vaultName, '_keyring', opts.newOwnerId, { ...env, _data: JSON.stringify(mergedFile) })\n\n  // 5. Lifecycle ledger audit (no-op if the history strategy is absent).\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: opts.newOwnerId, payloadHash: '',\n    reason: `liberation-claimed:${opts.newOwnerId}:${opts.legalBasis}`,\n  })\n\n  // 6. Stamp the Deed marker with `liberatedAt` (if a marker exists).\n  const marker = await loadDeedMarker(adapter, vaultName)\n  if (marker) {\n    await saveDeedMarker(adapter, vaultName, { ...marker, liberatedAt: new Date().toISOString() })\n  }\n\n  return { snapshot }\n}\n\n/**\n * Enumerate the vault's operational (user-facing) collections — those carried\n * by the caller's keyring DEK map, minus the reserved internal collections\n * (`_*`). These are the collections frozen into the evidence snapshot.\n */\nasync function listOperationalCollections(vault: Vault): Promise<readonly string[]> {\n  const { keyring } = vault._introspectState()\n  return [...keyring.deks.keys()].filter((c) => !c.startsWith('_'))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuCO,IAAM,iBAAiB;AAqD9B,eAAsB,gBACpB,OACA,OACA,aACA,SAC0B;AAG1B,QAAM,SAAS,MAAM,qBAAqB,OAAO,OAAO,OAAO;AAI/D,QAAM,UAAU,MAAM,mBAAmB,OAAO,OAAO,EAAE,QAAQ,aAAa,OAAe,CAAC;AAI9F,QAAM,eAAe,OAAO,OAAO;AAAA,IACjC;AAAA,IACA,aAAa,QAAQ;AAAA,IACrB,QAAQ;AAAA,IACR,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnC,CAAC;AAED,SAAO;AACT;AAOA,eAAsB,eACpB,OACA,OAC4B;AAC5B,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,cAAc;AAC/D,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,SAAS,SAAS,EAAE;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,YAAY,YAAY,KAAM,QAAO;AAC5D,QAAM,IAAI;AACV,MAAI,EAAE,gBAAgB,EAAG,QAAO;AAChC,MACE,OAAO,EAAE,gBAAgB,YACtB,OAAO,EAAE,gBAAgB,YACzB,EAAE,WAAW,QACb,OAAO,EAAE,aAAa,UACzB;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAqB;AAAA,IACzB,aAAa,EAAE;AAAA,IACf,aAAa,EAAE;AAAA,IACf,QAAQ;AAAA,IACR,UAAU,EAAE;AAAA,IACZ,GAAI,OAAO,EAAE,gBAAgB,WAAW,EAAE,aAAa,EAAE,YAAY,IAAI,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAGA,eAAsB,YACpB,OACA,OACkB;AAClB,SAAQ,MAAM,eAAe,OAAO,KAAK,MAAO;AAClD;AAaA,eAAsB,eACpB,OACA,OACA,QACe;AACf,QAAM,YAAiC,EAAE,aAAa,GAAG,GAAG,OAAO;AACnE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,cAAc;AAC5D,QAAM,MAAM;AAAA,IACV,EAAE,YAAY,SAAS,IAAI,gBAAgB,UAAU,OAAO,MAAM,KAAK,EAAE;AAAA;AAAA,IAEzE,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,SAAS,EAAE;AAAA,EAC5C;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,gBAAgB,GAAG;AACrD;;;AClHA,eAAsB,cACpB,OACA,MACyB;AAEzB,QAAM,MAAM,MAAM,UAAU,MAAM,MAAM,kBAAkB,KAAK,OAAO;AAGtE,QAAM,EAAE,MAAM,WAAW,SAAS,QAAQ,IAAI,MAAM,iBAAiB;AACrE,MAAI,QAAQ,SAAS,aAAa;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAKA,QAAM,WAAW,MAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,UAAU;AACzE,MAAI,UAAU;AACZ,UAAM,IAAI;AAAA,MACR,8BAA8B,KAAK,UAAU;AAAA,IAC/C;AAAA,EACF;AAKA,QAAM,cAAc,MAAM,2BAA2B,KAAK;AAC1D,QAAM,WAAW,MAAM,mBAAmB,OAAO,aAAa,EAAE,aAAa,QAAQ,OAAO,CAAC;AAM7F,QAAM,WAAW,MAAM,mBAAmB,SAAS,WAAW,EAAE,QAAQ,KAAK,YAAY,QAAQ,KAAK,eAAe,CAAC;AACtH,MAAI,CAAC,SAAS,KAAK;AACjB,UAAM,IAAI;AAAA,MACR,0BAA0B,KAAK,UAAU;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,UAAU;AACpE,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,sBAAsB,0BAA0B,KAAK,UAAU,mBAAmB;AAAA,EAC9F;AACA,QAAM,cAAc,KAAK,MAAM,IAAI,SAAS,EAAE;AAM9C,QAAM,kBAAkB,iBAAiB,UAAU,eAAe;AAClE,QAAM,qBAAqB,aAAa,iBAAiB,KAAK,UAAU;AACxE,QAAM,aAAqC,EAAE,GAAG,YAAY,KAAK;AACjE,aAAW,CAAC,YAAY,GAAG,KAAK,QAAQ,MAAM;AAC5C,eAAW,UAAU,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AAAA,EAC1D;AAWA,QAAM,YAAY,iBAAiB,SAAS,eAAe;AAC3D,QAAM,SAAsB,EAAE,GAAG,aAAa,MAAM,WAAW;AAG/D,QAAM,YAAY,EAAE,GAAG,QAAQ,cAAc,gBAAgB,YAAY,YAAY,EAAE;AACvF,QAAM,aAA0B,EAAE,GAAG,WAAW,YAAY,MAAM,cAAc,WAAW,SAAS,EAAE;AACtG,QAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,YAAY,EAAE,GAAG,KAAK,OAAO,KAAK,UAAU,UAAU,EAAE,CAAC;AAGvG,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,KAAK;AAAA,IAAY,aAAa;AAAA,IAC1F,QAAQ,sBAAsB,KAAK,UAAU,IAAI,KAAK,UAAU;AAAA,EAClE,CAAC;AAGD,QAAM,SAAS,MAAM,eAAe,SAAS,SAAS;AACtD,MAAI,QAAQ;AACV,UAAM,eAAe,SAAS,WAAW,EAAE,GAAG,QAAQ,cAAa,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,EAC/F;AAEA,SAAO,EAAE,SAAS;AACpB;AAOA,eAAe,2BAA2B,OAA0C;AAClF,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAC3C,SAAO,CAAC,GAAG,QAAQ,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AAClE;","names":[]}

package/dist/{chunk-B6SJIBQK.js → chunk-V3RWOOSO.js}

@@ -1,10 +1,10 @@
 import {
   grant,
   revoke
-} from "./chunk-M7NI3IWE.js";
+} from "./chunk-XSPFDUDG.js";
 import {
   CustodyNotEnabledError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-party/custody/active.ts
 function withCustody() {
@@ -16,7 +16,7 @@ function withCustody() {
       return host._revokeCustodianImpl(revoke, vault, options, factors);
     },
     async liberate(vault, opts) {
-      const { liberateVault } = await import("./liberate-GRLCZMW4.js");
+      const { liberateVault } = await import("./liberate-WZSZM2W6.js");
       return liberateVault(vault, opts);
     }
   };
@@ -74,4 +74,4 @@ export {
   withCustody,
   CustodyApi
 };
-//# sourceMappingURL=chunk-B6SJIBQK.js.map
+//# sourceMappingURL=chunk-V3RWOOSO.js.map

package/dist/{chunk-HBRLNOHL.js → chunk-V7ADQF5O.js}

@@ -3,14 +3,14 @@ import {
   normalizeMatches,
   normalizeSubqueryOperand,
   readPath
-} from "./chunk-HLEK5VAN.js";
+} from "./chunk-5WWDGFOS.js";
 import {
   isViaPrefixProbe
-} from "./chunk-Z5HTYMMQ.js";
+} from "./chunk-SYNY3VB5.js";
 import {
   FieldNotQueryableError,
   IndexRequiredError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-lookup/indexing/strategy.ts
 var NO_INDEXING = {
@@ -608,4 +608,4 @@ export {
   PersistedCollectionIndex,
   LazyQuery
 };
-//# sourceMappingURL=chunk-HBRLNOHL.js.map
+//# sourceMappingURL=chunk-V7ADQF5O.js.map

package/dist/{chunk-L7DOS3TE.js → chunk-VAORSCSU.js}

@@ -1,6 +1,6 @@
 import {
   buildRecordEnvelope
-} from "./chunk-SEE332EV.js";
+} from "./chunk-EZGV6F47.js";
 
 // src/with-shape/schema-update/fence.ts
 var FENCE_RECORD_ID = "schema-fence";
@@ -10,7 +10,7 @@ async function loadFence(store, vault) {
   const envelope = await store.get(vault, META_COLLECTION, FENCE_RECORD_ID);
   if (!envelope) return DEFAULT_FENCE;
   try {
-    const parsed = JSON.parse(envelope._data);
+    const parsed = JSON.parse(envelope._data ?? "");
     if (!isFenceDoc(parsed)) return DEFAULT_FENCE;
     return parsed;
   } catch {
@@ -36,4 +36,4 @@ export {
   loadFence,
   saveFence
 };
-//# sourceMappingURL=chunk-L7DOS3TE.js.map
+//# sourceMappingURL=chunk-VAORSCSU.js.map

package/dist/chunk-VAORSCSU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/schema-update/fence.ts"],"sourcesContent":["/**\n * Schema-fence document. Vault-level generation counter + drain\n * state, stored at `_meta/schema-fence` using the plaintext-envelope\n * pattern of `_meta/policy` (no PII — a counter + a state enum).\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { buildRecordEnvelope } from '../../capsule/index.js'\n\nexport type FenceState = 'normal' | 'draining' | 'migrating' | 'complete'\n\nexport interface FenceDoc {\n  readonly currentSchemaVersion: number\n  readonly fenceState: FenceState\n  /**\n   * Content hash (`PersistedSchemaEnvelope.hash`) of the schema most\n   * recently persisted while the vault sat at `currentSchemaVersion` —\n   * binds \"generation N\" to a concrete schema-content hash (#946), so\n   * \"which schema is generation N\" is answerable from `schemaFenceState()`\n   * alone. Optional: absent on a fresh vault (generation 0, nothing\n   * persisted yet) and on a fence document written before #946.\n   */\n  readonly schemaHash?: string\n}\n\nexport const FENCE_RECORD_ID = 'schema-fence'\nconst META_COLLECTION = '_meta'\n\nexport const DEFAULT_FENCE: FenceDoc = { currentSchemaVersion: 0, fenceState: 'normal' }\n\nexport async function loadFence(store: NoydbStore, vault: string): Promise<FenceDoc> {\n  const envelope = await store.get(vault, META_COLLECTION, FENCE_RECORD_ID)\n  if (!envelope) return DEFAULT_FENCE\n  try {\n    const parsed = JSON.parse(envelope._data ?? '') as unknown\n    if (!isFenceDoc(parsed)) return DEFAULT_FENCE\n    return parsed\n  } catch {\n    return DEFAULT_FENCE\n  }\n}\n\nexport async function saveFence(store: NoydbStore, vault: string, fence: FenceDoc): Promise<void> {\n  const envelope = buildRecordEnvelope(\n    { collection: META_COLLECTION, id: FENCE_RECORD_ID, version: 1 },\n    { iv: '', data: JSON.stringify(fence) },\n  )\n  await store.put(vault, META_COLLECTION, FENCE_RECORD_ID, envelope)\n}\n\nfunction isFenceDoc(x: unknown): x is FenceDoc {\n  if (x === null || typeof x !== 'object') return false\n  const o = x as Record<string, unknown>\n  if (typeof o['currentSchemaVersion'] !== 'number') return false\n  if (o['fenceState'] !== 'normal' && o['fenceState'] !== 'draining'\n    && o['fenceState'] !== 'migrating' && o['fenceState'] !== 'complete') return false\n  // schemaHash is optional (#946) — a legacy fence doc without it is still valid.\n  return o['schemaHash'] === undefined || typeof o['schemaHash'] === 'string'\n}\n"],"mappings":";;;;;AAwBO,IAAM,kBAAkB;AAC/B,IAAM,kBAAkB;AAEjB,IAAM,gBAA0B,EAAE,sBAAsB,GAAG,YAAY,SAAS;AAEvF,eAAsB,UAAU,OAAmB,OAAkC;AACnF,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,iBAAiB,eAAe;AACxE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,SAAS,EAAE;AAC9C,QAAI,CAAC,WAAW,MAAM,EAAG,QAAO;AAChC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,UAAU,OAAmB,OAAe,OAAgC;AAChG,QAAM,WAAW;AAAA,IACf,EAAE,YAAY,iBAAiB,IAAI,iBAAiB,SAAS,EAAE;AAAA,IAC/D,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,KAAK,EAAE;AAAA,EACxC;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,iBAAiB,QAAQ;AACnE;AAEA,SAAS,WAAW,GAA2B;AAC7C,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,sBAAsB,MAAM,SAAU,QAAO;AAC1D,MAAI,EAAE,YAAY,MAAM,YAAY,EAAE,YAAY,MAAM,cACnD,EAAE,YAAY,MAAM,eAAe,EAAE,YAAY,MAAM,WAAY,QAAO;AAE/E,SAAO,EAAE,YAAY,MAAM,UAAa,OAAO,EAAE,YAAY,MAAM;AACrE;","names":[]}

package/dist/{chunk-M522UYZ2.js → chunk-VFHCKG5M.js}

@@ -1,20 +1,16 @@
 import {
   buildRecordAad,
+  buildRecordEnvelope,
+  encrypt,
   openEnvelopeJson
-} from "./chunk-KJFW62P4.js";
-import {
-  buildRecordEnvelope
-} from "./chunk-SEE332EV.js";
-import {
-  encrypt
-} from "./chunk-UYB234ZR.js";
+} from "./chunk-EZGV6F47.js";
 import {
   SequenceContentionError,
   SequenceNotEnabledError,
   SequenceOfflineError,
   ValidationError,
   isConflictError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-commit/sequence/active.ts
 function withSequence() {
@@ -128,7 +124,7 @@ var SequenceStore = class {
   async read(name) {
     const env = await this.adapter.get(this.vault, SEQUENCE_COLLECTION, name);
     if (!env) return { env: null, value: 0 };
-    const json = this.encrypted ? await openEnvelopeJson({ collection: SEQUENCE_COLLECTION, id: name }, env, await this.dek()) : env._data;
+    const json = this.encrypted ? await openEnvelopeJson({ collection: SEQUENCE_COLLECTION, id: name }, env, await this.dek()) : env._data ?? "";
     const state = JSON.parse(json);
     return { env, value: state.value };
   }
@@ -201,4 +197,4 @@ export {
   resolveSequenceKey,
   SequenceStore
 };
-//# sourceMappingURL=chunk-M522UYZ2.js.map
+//# sourceMappingURL=chunk-VFHCKG5M.js.map

package/dist/chunk-VFHCKG5M.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/sequence/active.ts","../src/with-commit/sequence/strategy.ts","../src/with-commit/sequence/index.ts"],"sourcesContent":["/**\n * Enable the atomic-sequence capability.\n * Pass to `createNoydb({ sequenceStrategy: withSequence() })` to make\n * `vault.sequence('name').next()` / `.peek()` / `.seedTo()` live. The\n * {@link SequenceStore} CAS engine is statically imported here, so it is pulled\n * into the bundle only when `withSequence()` is referenced (the floor never\n * imports it).\n */\nimport type { SequenceStrategy } from './strategy.js'\nimport { SequenceStore } from './index.js'\n\nexport function withSequence(): SequenceStrategy {\n  return {\n    createStore(opts) {\n      return new SequenceStore(opts)\n    },\n  }\n}\n","/**\n * Sequence capability strategy — the single on-demand factory the vault routes\n * `vault.sequence()` through to build its atomic-CAS {@link SequenceStore}. The\n * active engine ({@link withSequence}) constructs the real store (kept out of\n * the floor bundle — the store class is reached only via the opt-in\n * `active.ts` chunk); {@link NO_SEQUENCE} throws. The vault always assembles the\n * per-call {@link SequenceStoreOptions} and delegates here, so an un-opted-in\n * caller hits `NO_SEQUENCE`'s throw at `vault.sequence()`.\n *\n * Note: `vault.sequence()` is synchronous, so the factory is a plain (sync)\n * constructor — the engine is tree-shaken by reachability (only `withSequence()`\n * pulls `active.ts`, which statically imports the store), not by a dynamic\n * import. Deferred-numbering series (`withDeferredNumbering`) are a distinct\n * capability and are NOT routed through this strategy.\n * @internal\n */\nimport type { SequenceStore, SequenceStoreOptions } from './index.js'\nimport { SequenceNotEnabledError } from '../../kernel/errors.js'\n\nexport interface SequenceStrategy {\n  createStore(opts: SequenceStoreOptions): SequenceStore\n}\n\n/**\n * No-op stub — the floor default. The capability factory throws\n * {@link SequenceNotEnabledError}; opt in with `sequenceStrategy: withSequence()`\n * in createNoydb. @internal\n */\nexport const NO_SEQUENCE: SequenceStrategy = {\n  createStore(): SequenceStore {\n    throw new SequenceNotEnabledError()\n  },\n}\n","/**\n * Atomic sequence primitive — online-coordinated gap-free numbering.\n *\n * `vault.sequence('invoice-2026').next()` returns 1, 2, 3, … with no\n * gaps and no duplicates, even under concurrent callers. Each named\n * sequence is an independent counter record at `_sequences/<name>`,\n * incremented with an optimistic compare-and-swap retry loop — the same\n * proven pattern as the ledger head (`history/ledger/store.ts`).\n *\n * **Explicitly online-only.** Gap-free numbering requires single-authority\n * serialization, which an offline / non-CAS store cannot provide. `next()`\n * throws {@link SequenceOfflineError} unless the backing store advertises\n * `capabilities.casAtomic`. This is a deliberate, honest wall — an offline\n * writer cannot safely allocate a global sequence number.\n *\n * Note on \"gap-free\": the *sequence* is gap-free (each `next()` yields a\n * unique, +1 value). If a caller discards a value without using it, that\n * is a gap in *usage*, not in the sequence — assign each `next()` result\n * to its record in the same operation.\n */\n\nimport { buildRecordAad, buildRecordEnvelope } from '../../capsule/index.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../capsule/index.js'\nimport type { ConflictError} from '../../kernel/errors.js';\nimport { isConflictError, SequenceContentionError, SequenceOfflineError, ValidationError } from '../../kernel/errors.js'\n\n// Capability opt-in seam (S4): `vault.sequence()` builds its CAS store through\n// the sequenceStrategy, so it throws SequenceNotEnabledError unless opted in.\nexport { withSequence } from './active.js'\nexport { NO_SEQUENCE, type SequenceStrategy } from './strategy.js'\nexport { SequenceNotEnabledError } from '../../kernel/errors.js'\n\nexport const SEQUENCE_COLLECTION = '_sequences'\n// A sequence is a single hot CAS row — higher contention than a ledger\n// append. A larger budget + jittered backoff absorbs moderate concurrency;\n// a genuine burst beyond this surfaces SequenceContentionError so the\n// caller can retry / queue (the honest online-only contract).\nconst MAX_NEXT_ATTEMPTS = 16\n\ninterface SequenceState {\n  value: number\n}\n\n/** Options for `SequenceHandle.next`. Deferred-numbering series use `for`; the CAS counter ignores all of these. */\nexport interface NextOptions {\n  /** Deferred mode: the record id to number. Ignored by the CAS counter. */\n  readonly for?: string\n  /** Deferred mode: reject after this many ms if still unsealed (reserved; not yet enforced in this slice). */\n  readonly timeoutMs?: number\n}\n\n/**\n * Partitioning for a CAS sequence. A partitioned sequence is an\n * independent counter scoped to one tuple of values — e.g.\n * `sequence('invoice', { partition: [2026, 'EU'] })` numbers EU-2026 invoices\n * separately from `[2026, 'US']` and from the bare `invoice` series.\n *\n * Partition components are URI-encoded (so `/`, null bytes and other\n * separators in a value can never collide with the structural separators) and\n * `'/'`-joined, then appended to the series with a null-byte (`\\x00`)\n * separator. The null byte is illegal in a plain series name, which guarantees\n * a partitioned key is always disjoint from any unpartitioned series.\n */\nexport interface SequenceOptions {\n  /** Partition tuple. Each component is URI-encoded and `'/'`-joined. */\n  readonly partition?: readonly (string | number)[]\n  /**\n   * Render template for the serial string. When set, `vault.sequence`\n   * returns a {@link FormattedSequenceHandle} whose `next()` resolves to\n   * `{ serial, formatted }`. Tokens:\n   * - `{seq}` — the allocated integer\n   * - `{seq:0N}` — zero-padded to width N (e.g. `{seq:04}` → `0001`)\n   * - `{partition.i}` — the i-th `partition` component (original value)\n   *\n   * Any other token, or a `{partition.i}` index beyond the supplied\n   * `partition`, throws `ValidationError` at `vault.sequence()` construction.\n   * Per-partition reset is inherent: a new partition tuple starts at 1.\n   */\n  readonly format?: string\n}\n\n/**\n * A formatted sequence handle. Identical to {@link SequenceHandle}\n * except `next()` also returns the rendered `formatted` string. `peek()` /\n * `seedTo()` operate on the underlying integer counter, unchanged.\n */\nexport interface FormattedSequenceHandle {\n  /** Allocate the next value and return it with its rendered serial string. */\n  next(opts?: NextOptions): Promise<{ serial: number; formatted: string }>\n  /** Read the current integer value without allocating. Returns 0 if never used. */\n  peek(): Promise<number>\n  /** Set-if-greater on the underlying integer counter. See {@link SequenceHandle.seedTo}. */\n  seedTo(n: number): Promise<void>\n}\n\n// Matches a single `{...}` token with no nested braces.\nconst SEQ_FORMAT_TOKEN = /\\{([^{}]*)\\}/g\nconst SEQ_PAD_TOKEN = /^seq:0(\\d+)$/\nconst SEQ_PARTITION_TOKEN = /^partition\\.(\\d+)$/\n\n/**\n * Validate a sequence `format` against the supplied partition and return a\n * pure `(serial) => string` renderer. Eager validation: every token is\n * checked now, so a bad pattern throws `ValidationError` at construction —\n * never at `next()` time.\n */\nexport function compileSequenceFormat(\n  format: string,\n  series: string,\n  partition: readonly (string | number)[] | undefined,\n): (serial: number) => string {\n  const parts = partition ?? []\n  for (const m of format.matchAll(SEQ_FORMAT_TOKEN)) {\n    const token = m[1] ?? ''\n    if (token === 'seq') continue\n    if (SEQ_PAD_TOKEN.test(token)) continue\n    const partMatch = SEQ_PARTITION_TOKEN.exec(token)\n    if (partMatch) {\n      const idx = Number(partMatch[1])\n      if (idx >= parts.length) {\n        throw new ValidationError(\n          `sequence(\"${series}\"): format token \"{${token}}\" references partition index ${idx}, ` +\n            `but only ${parts.length} partition component(s) were supplied.`,\n        )\n      }\n      continue\n    }\n    throw new ValidationError(\n      `sequence(\"${series}\"): format contains unknown token \"{${token}}\". ` +\n        `Accepted tokens: {seq}, {seq:0N}, {partition.i}.`,\n    )\n  }\n  return (serial: number): string =>\n    format.replace(SEQ_FORMAT_TOKEN, (full, token: string) => {\n      if (token === 'seq') return String(serial)\n      const padMatch = SEQ_PAD_TOKEN.exec(token)\n      if (padMatch) return String(serial).padStart(Number(padMatch[1]), '0')\n      const partMatch = SEQ_PARTITION_TOKEN.exec(token)\n      if (partMatch) return String(parts[Number(partMatch[1])])\n      return full // unreachable — validated above\n    })\n}\n\n/**\n * Resolve the CAS storage key for a (series, partition) pair.\n *\n * With no partition the key is `series` verbatim. With a partition the key is\n * `${series}\\x00${parts}` where `parts` is each component passed through\n * `encodeURIComponent(String(part))` and `'/'`-joined. The null-byte separator\n * is illegal in a plain series name, so partitioned keys never collide with\n * unpartitioned ones; URI-encoding keeps any component containing `/` distinct\n * from a multi-component partition.\n *\n * @throws {ValidationError} if any partition component is empty after `String()`\n *   or is a non-finite number (`NaN`, `±Infinity`).\n */\nexport function resolveSequenceKey(series: string, opts?: SequenceOptions): string {\n  const partition = opts?.partition\n  if (!partition || partition.length === 0) return series\n  const parts = partition.map((p) => {\n    if (typeof p === 'number' && !Number.isFinite(p)) {\n      throw new ValidationError(`sequence partition component must be a finite number, got ${p}`)\n    }\n    const s = String(p)\n    if (s === '') {\n      throw new ValidationError('sequence partition component must not be empty')\n    }\n    return encodeURIComponent(s)\n  })\n  return `${series}\\x00${parts.join('/')}`\n}\n\nexport interface SequenceHandle {\n  /** Atomically allocate and return the next value (1, 2, 3, …). Deferred series resolve at the next pass. */\n  next(opts?: NextOptions): Promise<number>\n  /** Read the current value without allocating. Returns 0 if never used. */\n  peek(): Promise<number>\n  /**\n   * Set-if-greater: advance the counter to at least `n`. A no-op if the\n   * current value is already `>= n` (so it never rewinds), and `seedTo(0)` is\n   * a no-op. Idempotent and CAS-safe under concurrent `next()` / `seedTo()`.\n   *\n   * Use after a bundle / CSV import to fast-forward the counter past the\n   * highest imported serial, so subsequent `next()` calls cannot re-use a\n   * number that is already on a record.\n   *\n   * Online-only: throws {@link SequenceOfflineError} on a non-CAS store.\n   */\n  seedTo(n: number): Promise<void>\n}\n\nasync function sleepBackoff(attempt: number): Promise<void> {\n  // Exponential backoff with full jitter to break the thundering herd\n  // when many writers contend on the same counter row.\n  const ceil = Math.min(2 ** attempt, 32)\n  const ms = Math.floor(Math.random() * ceil)\n  await new Promise((r) => setTimeout(r, ms))\n}\n\n/** Per-call context the vault assembles to build a {@link SequenceStore}. */\nexport interface SequenceStoreOptions {\n  adapter: NoydbStore\n  vault: string\n  encrypted: boolean\n  getDEK: (collectionName: string) => Promise<EnclaveKey>\n  actor: string\n}\n\nexport class SequenceStore {\n  private readonly adapter: NoydbStore\n  private readonly vault: string\n  private readonly encrypted: boolean\n  private readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  private readonly actor: string\n  /**\n   * Memoized DEK promise. The `_sequences` collection DEK is created on\n   * first access; without sharing one promise, a burst of concurrent\n   * `next()` calls would each trigger DEK creation and diverge (one\n   * writer's ciphertext unreadable by another). One shared promise → one\n   * DEK.\n   */\n  private dekPromise: Promise<EnclaveKey> | null = null\n\n  constructor(opts: SequenceStoreOptions) {\n    this.adapter = opts.adapter\n    this.vault = opts.vault\n    this.encrypted = opts.encrypted\n    this.getDEK = opts.getDEK\n    this.actor = opts.actor\n  }\n\n  /** A handle bound to one sequence name. */\n  handle(name: string): SequenceHandle {\n    return {\n      next: () => this.next(name),\n      peek: () => this.peek(name),\n      seedTo: (n) => this.seedTo(name, n),\n    }\n  }\n\n  private assertOnline(): void {\n    if (this.adapter.capabilities?.casAtomic !== true) {\n      throw new SequenceOfflineError()\n    }\n  }\n\n  private dek(): Promise<EnclaveKey> {\n    if (!this.dekPromise) this.dekPromise = this.getDEK(SEQUENCE_COLLECTION)\n    return this.dekPromise\n  }\n\n  private async read(name: string): Promise<{ env: EncryptedEnvelope | null; value: number }> {\n    const env = await this.adapter.get(this.vault, SEQUENCE_COLLECTION, name)\n    if (!env) return { env: null, value: 0 }\n    const json = this.encrypted ? await openEnvelopeJson({ collection: SEQUENCE_COLLECTION, id: name }, env, await this.dek()) : (env._data ?? '')\n    const state = JSON.parse(json) as SequenceState\n    return { env, value: state.value }\n  }\n\n  private async encryptState(name: string, state: SequenceState, version: number): Promise<EncryptedEnvelope> {\n    const json = JSON.stringify(state)\n    if (!this.encrypted) {\n      return buildRecordEnvelope({ collection: SEQUENCE_COLLECTION, id: name, version }, { iv: '', data: json})\n    }\n    const identity = { collection: SEQUENCE_COLLECTION, id: name, version }\n    const { iv, data } = await encrypt(json, await this.dek(), buildRecordAad(identity))\n    return buildRecordEnvelope(identity, { iv, data})\n  }\n\n  async peek(name: string): Promise<number> {\n    return (await this.read(name)).value\n  }\n\n  async next(name: string): Promise<number> {\n    this.assertOnline()\n    let lastConflict: ConflictError | undefined\n    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {\n      const { env, value } = await this.read(name)\n      const nextValue = value + 1\n      const expectedVersion = env?._v ?? 0 // 0 ≡ \"must not yet exist\" (create)\n      const envelope = await this.encryptState(name, { value: nextValue }, expectedVersion + 1)\n      try {\n        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion)\n        return nextValue\n      } catch (err) {\n        if (isConflictError(err)) {\n          lastConflict = err\n          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt)\n          continue\n        }\n        throw err\n      }\n    }\n    void lastConflict\n    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS)\n  }\n\n  async seedTo(name: string, n: number): Promise<void> {\n    this.assertOnline()\n    if (n <= 0) return // set-if-greater: 0 (and any non-positive seed) is a no-op\n    let lastConflict: ConflictError | undefined\n    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {\n      const { env, value } = await this.read(name)\n      if (value >= n) return // already at or past the floor — no write, idempotent\n      const expectedVersion = env?._v ?? 0 // 0 ≡ \"must not yet exist\" (create)\n      const envelope = await this.encryptState(name, { value: n }, expectedVersion + 1)\n      try {\n        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion)\n        return\n      } catch (err) {\n        if (isConflictError(err)) {\n          lastConflict = err\n          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt)\n          continue\n        }\n        throw err\n      }\n    }\n    void lastConflict\n    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS)\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAWO,SAAS,eAAiC;AAC/C,SAAO;AAAA,IACL,YAAY,MAAM;AAChB,aAAO,IAAI,cAAc,IAAI;AAAA,IAC/B;AAAA,EACF;AACF;;;ACWO,IAAM,cAAgC;AAAA,EAC3C,cAA6B;AAC3B,UAAM,IAAI,wBAAwB;AAAA,EACpC;AACF;;;ACCO,IAAM,sBAAsB;AAKnC,IAAM,oBAAoB;AA2D1B,IAAM,mBAAmB;AACzB,IAAM,gBAAgB;AACtB,IAAM,sBAAsB;AAQrB,SAAS,sBACd,QACA,QACA,WAC4B;AAC5B,QAAM,QAAQ,aAAa,CAAC;AAC5B,aAAW,KAAK,OAAO,SAAS,gBAAgB,GAAG;AACjD,UAAM,QAAQ,EAAE,CAAC,KAAK;AACtB,QAAI,UAAU,MAAO;AACrB,QAAI,cAAc,KAAK,KAAK,EAAG;AAC/B,UAAM,YAAY,oBAAoB,KAAK,KAAK;AAChD,QAAI,WAAW;AACb,YAAM,MAAM,OAAO,UAAU,CAAC,CAAC;AAC/B,UAAI,OAAO,MAAM,QAAQ;AACvB,cAAM,IAAI;AAAA,UACR,aAAa,MAAM,sBAAsB,KAAK,iCAAiC,GAAG,cACpE,MAAM,MAAM;AAAA,QAC5B;AAAA,MACF;AACA;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,aAAa,MAAM,uCAAuC,KAAK;AAAA,IAEjE;AAAA,EACF;AACA,SAAO,CAAC,WACN,OAAO,QAAQ,kBAAkB,CAAC,MAAM,UAAkB;AACxD,QAAI,UAAU,MAAO,QAAO,OAAO,MAAM;AACzC,UAAM,WAAW,cAAc,KAAK,KAAK;AACzC,QAAI,SAAU,QAAO,OAAO,MAAM,EAAE,SAAS,OAAO,SAAS,CAAC,CAAC,GAAG,GAAG;AACrE,UAAM,YAAY,oBAAoB,KAAK,KAAK;AAChD,QAAI,UAAW,QAAO,OAAO,MAAM,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;AACxD,WAAO;AAAA,EACT,CAAC;AACL;AAeO,SAAS,mBAAmB,QAAgB,MAAgC;AACjF,QAAM,YAAY,MAAM;AACxB,MAAI,CAAC,aAAa,UAAU,WAAW,EAAG,QAAO;AACjD,QAAM,QAAQ,UAAU,IAAI,CAAC,MAAM;AACjC,QAAI,OAAO,MAAM,YAAY,CAAC,OAAO,SAAS,CAAC,GAAG;AAChD,YAAM,IAAI,gBAAgB,6DAA6D,CAAC,EAAE;AAAA,IAC5F;AACA,UAAM,IAAI,OAAO,CAAC;AAClB,QAAI,MAAM,IAAI;AACZ,YAAM,IAAI,gBAAgB,gDAAgD;AAAA,IAC5E;AACA,WAAO,mBAAmB,CAAC;AAAA,EAC7B,CAAC;AACD,SAAO,GAAG,MAAM,KAAO,MAAM,KAAK,GAAG,CAAC;AACxC;AAqBA,eAAe,aAAa,SAAgC;AAG1D,QAAM,OAAO,KAAK,IAAI,KAAK,SAAS,EAAE;AACtC,QAAM,KAAK,KAAK,MAAM,KAAK,OAAO,IAAI,IAAI;AAC1C,QAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC5C;AAWO,IAAM,gBAAN,MAAoB;AAAA,EACR;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQT,aAAyC;AAAA,EAEjD,YAAY,MAA4B;AACtC,SAAK,UAAU,KAAK;AACpB,SAAK,QAAQ,KAAK;AAClB,SAAK,YAAY,KAAK;AACtB,SAAK,SAAS,KAAK;AACnB,SAAK,QAAQ,KAAK;AAAA,EACpB;AAAA;AAAA,EAGA,OAAO,MAA8B;AACnC,WAAO;AAAA,MACL,MAAM,MAAM,KAAK,KAAK,IAAI;AAAA,MAC1B,MAAM,MAAM,KAAK,KAAK,IAAI;AAAA,MAC1B,QAAQ,CAAC,MAAM,KAAK,OAAO,MAAM,CAAC;AAAA,IACpC;AAAA,EACF;AAAA,EAEQ,eAAqB;AAC3B,QAAI,KAAK,QAAQ,cAAc,cAAc,MAAM;AACjD,YAAM,IAAI,qBAAqB;AAAA,IACjC;AAAA,EACF;AAAA,EAEQ,MAA2B;AACjC,QAAI,CAAC,KAAK,WAAY,MAAK,aAAa,KAAK,OAAO,mBAAmB;AACvE,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,KAAK,MAAyE;AAC1F,UAAM,MAAM,MAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,IAAI;AACxE,QAAI,CAAC,IAAK,QAAO,EAAE,KAAK,MAAM,OAAO,EAAE;AACvC,UAAM,OAAO,KAAK,YAAY,MAAM,iBAAiB,EAAE,YAAY,qBAAqB,IAAI,KAAK,GAAG,KAAK,MAAM,KAAK,IAAI,CAAC,IAAK,IAAI,SAAS;AAC3I,UAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,WAAO,EAAE,KAAK,OAAO,MAAM,MAAM;AAAA,EACnC;AAAA,EAEA,MAAc,aAAa,MAAc,OAAsB,SAA6C;AAC1G,UAAM,OAAO,KAAK,UAAU,KAAK;AACjC,QAAI,CAAC,KAAK,WAAW;AACnB,aAAO,oBAAoB,EAAE,YAAY,qBAAqB,IAAI,MAAM,QAAQ,GAAG,EAAE,IAAI,IAAI,MAAM,KAAI,CAAC;AAAA,IAC1G;AACA,UAAM,WAAW,EAAE,YAAY,qBAAqB,IAAI,MAAM,QAAQ;AACtE,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,KAAK,IAAI,GAAG,eAAe,QAAQ,CAAC;AACnF,WAAO,oBAAoB,UAAU,EAAE,IAAI,KAAI,CAAC;AAAA,EAClD;AAAA,EAEA,MAAM,KAAK,MAA+B;AACxC,YAAQ,MAAM,KAAK,KAAK,IAAI,GAAG;AAAA,EACjC;AAAA,EAEA,MAAM,KAAK,MAA+B;AACxC,SAAK,aAAa;AAClB,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,YAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI;AAC3C,YAAM,YAAY,QAAQ;AAC1B,YAAM,kBAAkB,KAAK,MAAM;AACnC,YAAM,WAAW,MAAM,KAAK,aAAa,MAAM,EAAE,OAAO,UAAU,GAAG,kBAAkB,CAAC;AACxF,UAAI;AACF,cAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,MAAM,UAAU,eAAe;AACvF,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,YAAI,gBAAgB,GAAG,GAAG;AACxB,yBAAe;AACf,cAAI,UAAU,oBAAoB,EAAG,OAAM,aAAa,OAAO;AAC/D;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,SAAK;AACL,UAAM,IAAI,wBAAwB,MAAM,iBAAiB;AAAA,EAC3D;AAAA,EAEA,MAAM,OAAO,MAAc,GAA0B;AACnD,SAAK,aAAa;AAClB,QAAI,KAAK,EAAG;AACZ,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,mBAAmB,WAAW;AAC5D,YAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI;AAC3C,UAAI,SAAS,EAAG;AAChB,YAAM,kBAAkB,KAAK,MAAM;AACnC,YAAM,WAAW,MAAM,KAAK,aAAa,MAAM,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC;AAChF,UAAI;AACF,cAAM,KAAK,QAAQ,IAAI,KAAK,OAAO,qBAAqB,MAAM,UAAU,eAAe;AACvF;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,gBAAgB,GAAG,GAAG;AACxB,yBAAe;AACf,cAAI,UAAU,oBAAoB,EAAG,OAAM,aAAa,OAAO;AAC/D;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,SAAK;AACL,UAAM,IAAI,wBAAwB,MAAM,iBAAiB;AAAA,EAC3D;AACF;","names":[]}

package/dist/{chunk-DC5QVPV7.js → chunk-VHBKYN2J.js}

@@ -1,6 +1,6 @@
 import {
   buildRecordEnvelope
-} from "./chunk-SEE332EV.js";
+} from "./chunk-EZGV6F47.js";
 
 // src/with-party/policy/storage.ts
 var META_COLLECTION = "_meta";
@@ -9,7 +9,7 @@ async function loadVaultPolicy(store, vault) {
   const envelope = await store.get(vault, META_COLLECTION, POLICY_RECORD_ID);
   if (!envelope) return void 0;
   try {
-    const parsed = JSON.parse(envelope._data);
+    const parsed = JSON.parse(envelope._data ?? "");
     if (!isVaultPolicy(parsed)) return void 0;
     return parsed;
   } catch {
@@ -36,4 +36,4 @@ export {
   loadVaultPolicy,
   saveVaultPolicy
 };
-//# sourceMappingURL=chunk-DC5QVPV7.js.map
+//# sourceMappingURL=chunk-VHBKYN2J.js.map

package/dist/chunk-VHBKYN2J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/policy/storage.ts"],"sourcesContent":["/**\n * Persistence helpers for the vault-level policy document\n * (`_meta/policy`). Mirrors the bypass-AES pattern used by\n * `_meta/handle` — the policy document is plain JSON, the envelope's\n * `_iv` field is left empty.\n *\n * @see https://github.com/noy-db/docs/blob/main/content/docs/services/session-tiers.md → Storage location\n *\n * @module\n */\nimport { buildRecordEnvelope } from '../../capsule/index.js'\nimport type { NoydbStore, VaultPolicy } from '../../kernel/types.js'\n\n/** Reserved collection name for vault-level metadata documents. */\nexport const META_COLLECTION = '_meta'\n/** Reserved id for the vault-level policy document. */\nexport const POLICY_RECORD_ID = 'policy'\n\n/**\n * Read the vault-level policy from `_meta/policy`. Returns `undefined`\n * when no policy has been persisted (fresh vault, or a vault written\n * before the policy module landed). The caller falls back to the\n * default preset.\n *\n * Tolerates corrupted documents the same way `_meta/handle` does: a\n * JSON parse failure surfaces as `undefined`, not a thrown error, so\n * a bad write never permanently locks a vault.\n */\nexport async function loadVaultPolicy(\n  store: NoydbStore,\n  vault: string,\n): Promise<VaultPolicy | undefined> {\n  const envelope = await store.get(vault, META_COLLECTION, POLICY_RECORD_ID)\n  if (!envelope) return undefined\n  try {\n    const parsed = JSON.parse(envelope._data ?? '') as unknown\n    if (!isVaultPolicy(parsed)) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Persist the vault-level policy at `_meta/policy`. Idempotent — call\n * once at vault creation and again on `db.updatePolicy()` invocations.\n */\nexport async function saveVaultPolicy(\n  store: NoydbStore,\n  vault: string,\n  policy: VaultPolicy,\n): Promise<void> {\n  const envelope = buildRecordEnvelope(\n    { collection: META_COLLECTION, id: POLICY_RECORD_ID, version: 1 },\n    { iv: '', data: JSON.stringify(policy) },\n  )\n  await store.put(vault, META_COLLECTION, POLICY_RECORD_ID, envelope)\n}\n\nfunction isVaultPolicy(x: unknown): x is VaultPolicy {\n  if (x === null || typeof x !== 'object') return false\n  if (!('gates' in x)) return false\n  const gates = (x as { gates: unknown }).gates\n  return gates !== null && typeof gates === 'object'\n}\n"],"mappings":";;;;;AAcO,IAAM,kBAAkB;AAExB,IAAM,mBAAmB;AAYhC,eAAsB,gBACpB,OACA,OACkC;AAClC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,iBAAiB,gBAAgB;AACzE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,SAAS,EAAE;AAC9C,QAAI,CAAC,cAAc,MAAM,EAAG,QAAO;AACnC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAsB,gBACpB,OACA,OACA,QACe;AACf,QAAM,WAAW;AAAA,IACf,EAAE,YAAY,iBAAiB,IAAI,kBAAkB,SAAS,EAAE;AAAA,IAChE,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,MAAM,EAAE;AAAA,EACzC;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,kBAAkB,QAAQ;AACpE;AAEA,SAAS,cAAc,GAA8B;AACnD,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,MAAI,EAAE,WAAW,GAAI,QAAO;AAC5B,QAAM,QAAS,EAAyB;AACxC,SAAO,UAAU,QAAQ,OAAO,UAAU;AAC5C;","names":[]}

package/dist/{chunk-WX5ADGTZ.js → chunk-VKI2EB3N.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-5D2ALSM5.js";
 import {
   RecordCodec
-} from "./chunk-KJFW62P4.js";
+} from "./chunk-EZGV6F47.js";
 
 // src/with-formula/materialized-views/stale.ts
-var loadMVExecutor = lazy(() => import("./executor-B6SRO2QS.js"));
+var loadMVExecutor = lazy(() => import("./executor-FMPVN6DT.js"));
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 function markMVStale(registry, mvName) {
   let set = _staleByRegistry.get(registry);
@@ -134,4 +134,4 @@ export {
   clearMVStale,
   clearMVStaleFully
 };
-//# sourceMappingURL=chunk-WX5ADGTZ.js.map
+//# sourceMappingURL=chunk-VKI2EB3N.js.map