@noy-db/hub 0.8.0-pre.0 → 0.8.0

package/dist/dispatch-RH4LHKBH.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-formula/derivations/dispatch.ts"],"sourcesContent":["/**\n * Derivation dispatch, lifted out of the kernel spine (#842 part b).\n *\n * `Collection` carried ~380 lines of dispatch logic that belongs to the\n * derivation service, not to the always-on kernel. These are free functions\n * taking an explicit context so the spine keeps only a thin delegator.\n *\n * ## How the spine reaches this module\n *\n * By dynamic `import()`, never a static one. `check-architecture.mjs`'s\n * `port-layering` check forbids the spine from statically importing a\n * `with-*` service; `collection.ts` is grandfathered for ten\n * `with-formula/*` specifiers, but that list is frozen per file and a new\n * one is a violation. A dynamic import is the sanctioned S4 gate recipe, and\n * it keeps this chunk out of the floor bundle for consumers who never fire a\n * derivation.\n *\n * The `Collection` type reference below points back at the spine. That is\n * inward (service → kernel) and so allowed, and it is TYPE-ONLY — erased at\n * build, so no runtime cycle exists.\n *\n * @internal\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { DerivationRegistry } from './registry.js'\nimport type { ReadOnlyVaultFacade } from '../../with-audit/guards/types.js'\nimport type { Collection } from '../../kernel/collection.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport type { ledgerAuditHook, WaveContext } from '../../kernel/via/dispatch.js'\nimport { putDerivedOutput, selfWriteFieldEqual } from '../../kernel/via/dispatch.js'\nimport { DerivationCapExceededError } from '../../kernel/errors.js'\nimport { sameTuple, resolveTuple, tupleFromIntermediate, hopCollections } from './trigger-match.js'\nimport { markStale } from './stale.js'\nimport type { DerivationExecutor } from './executor.js'\n\n/** The per-write dispatch context threaded into `putDerivedOutput`. */\ninterface DispatchCtx {\n  emit: (e: string, p: unknown) => void\n  source: { readonly collection: string; readonly id: string }\n  audit: ReturnType<typeof ledgerAuditHook>\n}\n\n/**\n * What the dispatchers need from the collection that owns them. Passing this\n * explicitly is what lets the logic live outside the class.\n */\nexport interface DerivationDeleteCtx {\n  readonly derivationSource: {\n    registry(): DerivationRegistry\n    getCollection(name: string): Collection<Record<string, unknown>>\n    getActiveTxContext(): TxContext | null\n    getReadOnlyFacade(): ReadOnlyVaultFacade\n  }\n  /** The collection the delete happened in. */\n  readonly collectionName: string\n  readonly adapter: NoydbStore\n  readonly vault: string\n  readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  readonly storeCiphertext: boolean\n}\n\n/**\n * Erase the derived rows a deleted source record fanned out to, and drop the\n * fan-out sidecars that recorded them.\n *\n * @param eraseRecordShapeToo also erase same-id `shape: 'record'` outputs.\n *   Restricted to a source-triggered strategy writing into a DIFFERENT\n *   collection — the self-denorm case would re-delete the record just\n *   tombstoned, and triggerBy/sibling strategies derive under a different id.\n * @returns rows ACTUALLY deleted, not edges visited (#622).\n */\nexport async function dispatchArrayDerivationsOnDelete(\n  ctx: DerivationDeleteCtx,\n  id: string,\n  eraseRecordShapeToo = false,\n): Promise<number> {\n  const { derivationSource, collectionName, adapter, vault, getDEK, storeCiphertext } = ctx\n\n  const strategies = derivationSource.registry().strategiesForSource(collectionName)\n  if (strategies.length === 0) return 0\n\n  const { loadFanoutSidecar, deleteFanoutSidecar } = await import('./fanout-sidecar.js')\n  const txCtx = derivationSource.getActiveTxContext()\n  let erased = 0\n\n  for (const { spec } of strategies) {\n    for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {\n      if (outSpec.shape === 'record') {\n        if (eraseRecordShapeToo && spec.source === collectionName && outSpec.collection !== collectionName) {\n          if (await derivationSource.getCollection(outSpec.collection)._internalDelete(id, txCtx)) erased += 1\n        }\n        continue\n      }\n\n      const sidecar = await loadFanoutSidecar(adapter, vault, spec.source, id, outputKey, getDEK, storeCiphertext)\n      if (!sidecar) continue\n\n      const outputCollection = derivationSource.getCollection(outSpec.collection)\n      for (const derivedId of sidecar.keys) {\n        if (await outputCollection._internalDelete(derivedId, txCtx)) erased += 1\n      }\n      await deleteFanoutSidecar(adapter, vault, spec.source, id, outputKey)\n    }\n  }\n\n  return erased\n}\n\n/** Adds what the on-write derivation dispatch needs beyond the delete path. */\nexport interface DerivationDispatchCtx extends DerivationDeleteCtx {\n  /** Via pipeline, for decoding the stored form back to canonical money shape. */\n  readonly via: { canonicalizeStored(r: Record<string, unknown>): Record<string, unknown> } | undefined\n  /** Recompute a rollup aggregate onto a parent. Stays on the spine — it walks collections. */\n  readonly recomputeRollup: (\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    spec: any,\n    parentId: string,\n    source: { readonly collection: string; readonly id: string },\n    wave?: WaveContext,\n  ) => Promise<unknown>\n  /** Builds the per-write dispatch context threaded into `putDerivedOutput`. */\n  readonly dispatchCtx: (source: { readonly collection: string; readonly id: string }) => DispatchCtx\n  /** Registers a write on the active transaction for rollback. */\n  readonly trackPut: (txCtx: TxContext, collectionName: string, id: string, priorEnvelope: EncryptedEnvelope | null) => void\n}\n\n/**\n * Fire registered derivation strategies for this source collection.\n *\n * Eager mode runs `derive` inline and writes each output; lazy mode records a\n * stale mark for cold-session recompute. Rollups are handled here rather than\n * by the executor — a write to the child recomputes the parent aggregate, and\n * a write to the parent recomputes its own.\n */\nexport async function dispatchDerivations(\n  ctx: DerivationDispatchCtx,\n  id: string,\n  record: Record<string, unknown>,\n  version: number,\n  wave?: WaveContext,\n  /** The pre-write record at `id` in THIS collection (undefined = not\n   *  captured — no field-match trigger, or a sync-applied wave; null =\n   *  captured and absent, i.e. a create). Only a `Record` re-fires the OLD\n   *  matched set alongside the new one (spec §7). */\n  prior?: Record<string, unknown> | null,\n): Promise<void> {\n  const { derivationSource, collectionName, via, recomputeRollup } = ctx\n\n  // `record` is the stored form here (post-quantize) — decode so\n  // derive(source, ctx) sees the canonical money shape.\n  const incoming = (via ? via.canonicalizeStored(record) : record)\n  if (incoming && typeof incoming === 'object' && '_derivedFrom' in incoming) return\n  // `prior` is the raw stored pre-write record — canonicalize it the same\n  // way as `incoming` before it feeds `resolveTuple` below, or a\n  // via-shaped match field (e.g. a money field) compares canonical against\n  // raw and never matches the old tuple (Min 5).\n  const canonicalPrior = prior != null ? (via ? via.canonicalizeStored(prior) : prior) : prior\n  const registry = derivationSource.registry()\n  const strategies = registry.strategiesForSource(collectionName)\n  if (strategies.length === 0) return\n  // Dynamic-import the executor only on the first eager-mode\n  // dispatch. Lazy-mode dispatches use `markStale` (a pure helper)\n  // which doesn't reach into the executor at all. Keeps the\n  // derivation executor chunk out of the floor bundle for any\n  // consumer that doesn't fire an eager derivation.\n  let executorClass: typeof DerivationExecutor | null = null\n  for (const { spec, strategyHash, triggers } of strategies) {\n    const mode = typeof spec.lifecycle === 'string' ? spec.lifecycle : spec.lifecycle.mode\n\n    // Rollup: a write to the child `from` recomputes the\n    // parent at id child[key]; a write to the parent (source = into)\n    // recomputes its own aggregate. Handled here (the executor is not run).\n    if (spec.rollup) {\n      if (mode !== 'eager') continue\n      const asParentId = (v: unknown): string | null =>\n        (typeof v === 'string' || typeof v === 'number') ? String(v) : null\n      let parentId: string | null\n      // #1257 — a child that RE-PARENTS strands the old parent's aggregate\n      // unless the old key is recomputed too. Reads the prior stored record\n      // (canonicalized alongside `incoming`, so a via-shaped key compares like\n      // for like). `undefined` prior — a sync-applied wave write or a tiers\n      // restore, which do not thread it — degrades to new-parent-only, the\n      // pre-#1257 behaviour, rather than guessing.\n      let oldParentId: string | null = null\n      if (collectionName === spec.rollup.from) {\n        parentId = asParentId(incoming[spec.rollup.key])\n        const priorKey = canonicalPrior != null ? asParentId(canonicalPrior[spec.rollup.key]) : null\n        if (priorKey !== null && priorKey !== parentId) oldParentId = priorKey\n      } else {\n        parentId = id // a write to the parent recomputes its own aggregate\n      }\n      if (parentId !== null) await recomputeRollup(spec, parentId, { collection: collectionName, id }, wave)\n      // The old parent is recomputed AFTER the new one so a `maxFanout`-style\n      // failure on the new parent surfaces before extra work is spent.\n      if (oldParentId !== null) await recomputeRollup(spec, oldParentId, { collection: collectionName, id }, wave)\n      continue\n    }\n\n    // Determine how `collectionName` triggers this strategy, and build the list\n    // of source records to (re-)derive:\n    //   • source     — re-derive the written record itself (same-id).\n    //   • sources[]  — re-derive the PRIMARY source at the same id.\n    //   • triggerBy  — FK fan-out: re-derive every source record\n    //                  whose `on` field equals the written parent's id.\n    // `input` is passed to derive(); `base` is the raw stored source record\n    // used as the patch base for a self-write reverse-denorm output.\n    const isSource = spec.source === collectionName\n    const isSibling = !isSource && (spec.sources?.includes(collectionName) ?? false)\n    const triggerEntries = !isSource && !isSibling\n      ? triggers.filter((t) => t.collection === collectionName)\n      : []\n    // #1277 option 2 — a write to an INTERMEDIATE collection fires the trigger\n    // too. Without this, re-pointing the intermediate strands every source it\n    // used to address: nothing is written to the trigger or source collection,\n    // so no other path can notice. Kept separate from `triggerEntries` because\n    // the tuple is derived differently (the intermediate IS the written record,\n    // so no lookup is needed).\n    const hopEntries = !isSource && !isSibling\n      ? triggers.filter((t) => hopCollections(t.match).includes(collectionName))\n      : []\n\n    const runs: Array<{\n      input: Record<string, unknown> & { id: string }\n      base: Record<string, unknown>\n      runId: string\n      version: number\n    }> = []\n\n    if (isSource) {\n      runs.push({ input: { ...incoming, id }, base: incoming, runId: id, version })\n    } else if (isSibling) {\n      const p = await derivationSource.getCollection(spec.source).get(id)\n      if (p !== null && p !== undefined) {\n        // Raw base for a (rare) sibling self-write; falls back to the\n        // resolved primary if the raw read misses.\n        const raw = await derivationSource.getCollection(spec.source)._getStoredRecord(id)\n        runs.push({ input: { ...p, id }, base: raw ?? p, runId: id, version: 0 })\n      }\n    } else if (triggerEntries.length > 0 || hopEntries.length > 0) {\n      const srcColl = derivationSource.getCollection(spec.source)\n      const matched = new Set<string>()\n      // One lookup per hop per written record — `take: 'id'` is a direct get,\n      // anything else is a single field match on the intermediate. Never per\n      // candidate row (#1266's bound).\n      const lookup = async (coll: string, field: string, value: string): Promise<Record<string, unknown> | null> => {\n        const c = derivationSource.getCollection(coll)\n        if (field === 'id') return c._getStoredRecord(value)\n        const ids = await c._findMatchingCompositeIds([{ field, value }])\n        const first = ids[0]\n        return first === undefined ? null : c._getStoredRecord(first)\n      }\n      // A write to an intermediate collection: fan out on its old ∪ new value.\n      // The prior record is the intermediate's own, so #1249's capture already\n      // supplies it — the same mechanism, pointed at a third collection.\n      for (const trigger of hopEntries) {\n        const tuples = [tupleFromIntermediate(trigger.match, collectionName, incoming)]\n        if (canonicalPrior != null) {\n          const old = tupleFromIntermediate(trigger.match, collectionName, canonicalPrior)\n          if (!sameTuple(old, tuples[0]!)) tuples.push(old)\n        }\n        const ids = new Set<string>()\n        for (const tuple of tuples) {\n          if (tuple === null) continue\n          for (const sid of await srcColl._findMatchingCompositeIds(tuple)) ids.add(sid)\n        }\n        if (trigger.maxFanout !== undefined && ids.size > trigger.maxFanout) {\n          throw new DerivationCapExceededError(\n            `triggerBy hop ${collectionName}→${spec.source} [${trigger.match.map(p => p.to).join(',')}]`,\n            ids.size, trigger.maxFanout)\n        }\n        for (const sid of ids) matched.add(sid)\n      }\n      for (const trigger of triggerEntries) {\n        // Union fan-out (spec §7): an update changing any matched component\n        // must re-fire BOTH the old and the new matched set, or the old\n        // set's derived output goes stale (never re-derived once it no\n        // longer matches). `prior` is only ever a `Record` here — a wave\n        // dispatch and a create both skip the old tuple outright.\n        const tuples = [await resolveTuple(trigger.match, id, incoming, lookup)]\n        if (canonicalPrior != null && trigger.match.some((p) => p.from !== 'id')) {\n          const old = await resolveTuple(trigger.match, id, canonicalPrior, lookup)\n          if (!sameTuple(old, tuples[0]!)) tuples.push(old)\n        }\n        const ids = new Set<string>()\n        for (const tuple of tuples) {\n          if (tuple === null) continue   // a from-value is absent/non-scalar: matches nothing\n          for (const sid of await srcColl._findMatchingCompositeIds(tuple)) ids.add(sid)\n        }\n        if (trigger.maxFanout !== undefined && ids.size > trigger.maxFanout) {\n          throw new DerivationCapExceededError(\n            `triggerBy ${collectionName}→${spec.source} [${trigger.match.map(p => p.to).join(',')}]`,\n            ids.size, trigger.maxFanout)\n        }\n        for (const sid of ids) matched.add(sid)\n      }\n      for (const sid of matched) {\n        const raw = await srcColl._getStoredRecord(sid)\n        if (raw === null) continue\n        runs.push({ input: { ...raw, id: sid }, base: raw, runId: sid, version: 0 })\n      }\n    }\n\n    if (runs.length === 0) continue\n\n    if (mode !== 'eager') {\n      for (const run of runs) await markStale(registry, spec, run.runId)\n      continue\n    }\n\n    if (executorClass === null) {\n      ;({ DerivationExecutor: executorClass } = await import('./executor.js'))\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    for (const run of runs) await runOne(ctx, spec as any, strategyHash, executorClass, run)\n  }\n}\n\n/**\n * Run the executor for one (spec, run) pair and write its outputs. Shared by\n * `dispatchDerivations`' eager loop and `dispatchTriggerDerivationsOnDelete`\n * (#1249) — the write-out logic (array diff, record self-write reverse-denorm,\n * normal record output) is identical for a live write and a delete-triggered\n * re-derive; only how `runs` gets built differs.\n */\nasync function runOne(\n  ctx: DerivationDispatchCtx,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  spec: any,\n  strategyHash: string,\n  executorClass: typeof DerivationExecutor,\n  run: { input: Record<string, unknown> & { id: string }; base: Record<string, unknown>; runId: string; version: number },\n): Promise<void> {\n  const { derivationSource, adapter, vault, getDEK, storeCiphertext, dispatchCtx, trackPut } = ctx\n  const execCtx = { vault: derivationSource.getReadOnlyFacade() }\n  const outCtx = dispatchCtx({ collection: spec.source, id: run.runId })\n  const result = await executorClass.run(spec, run.input, run.version, strategyHash, execCtx)\n  for (const key of Object.keys(spec.outputs)) {\n    const out = result.outputs[key]\n    if (!out) continue\n    if (out.kind === 'failed') {\n      const err = out.error\n      if (spec.strict) throw err\n      console.warn(`[derivation] output \"${key}\" for source \"${spec.source}\" id=\"${run.runId}\" failed:`, err)\n      continue\n    }\n    const outSpec = spec.outputs[key]\n    if (!outSpec) continue\n    const outputCollection = derivationSource.getCollection(outSpec.collection)\n    // If we're inside a multi-record transaction, register\n    // derived writes as side-effect ops on the active ctx\n    // BEFORE they fire. `revertExecuted` walks `_executed` in\n    // reverse on rollback, so capturing the pre-write envelope\n    // here lets a later mid-batch failure restore this output's\n    // prior state alongside the source op. Outside a transaction\n    // the context is null and tracking is skipped.\n    const txCtx = derivationSource.getActiveTxContext()\n\n    // ── Array-shape branch ─────────────────────────────────\n    if (out.kind === 'array') {\n      // Load the prior key set from the fanout sidecar.\n      const { loadFanoutSidecar, saveFanoutSidecar } = await import('./fanout-sidecar.js')\n      const prior = await loadFanoutSidecar(adapter, vault, spec.source, run.runId, key, getDEK, storeCiphertext)\n      const prevKeys = new Set<string>(prior?.keys ?? [])\n      const newKeysList = out.entries.map((e: { key: string }) => e.key)\n      const newKeysSet = new Set<string>(newKeysList)\n\n      // Diff — delete keys that were in prev but not in new.\n      for (const k of prevKeys) {\n        if (newKeysSet.has(k)) continue\n        await outputCollection._internalDelete(k, txCtx)\n      }\n\n      // Upsert every entry in the new set. (Slice 1: no\n      // identity-skip optimisation; write every row, idempotent\n      // at the (collection, id) level.)\n      for (const entry of out.entries) {\n        if (txCtx !== null) {\n          trackPut(txCtx, outSpec.collection, entry.key, await adapter.get(vault, outSpec.collection, entry.key))\n        }\n        await putDerivedOutput(outputCollection, entry.key, entry.value, outCtx, { source: 'derived' })\n      }\n\n      // Persist the new key set last, for failure-mode symmetry.\n      await saveFanoutSidecar(adapter, vault, {\n        source: spec.source,\n        sourceId: run.runId,\n        outputKey: key,\n        outputCollection: outSpec.collection,\n        keys: newKeysList,\n      }, getDEK, storeCiphertext)\n      continue\n    }\n\n    // ── Record-shape branch ────────────────────────────────\n    if (out.skipped === true) {\n      // Optional output returned null. Delete the\n      // previously-emitted output at this id, if any. Routed\n      // through `_internalDelete` so a user-registered\n      // `onDelete` on the output collection does NOT\n      // fire — this is a system-internal tombstone, not a\n      // user-initiated delete. The txCtx hookup captures the\n      // prior envelope inside `_internalDelete` for rollback\n      // symmetry; delete-of-absent is a silent no-op.\n      await outputCollection._internalDelete(run.runId, txCtx)\n      continue\n    }\n\n    // ── Self-write reverse-denorm ───────────────────────────\n    // An output back to its own source: patch ONLY the declared\n    // `denorm` fields onto the raw stored record, never the whole\n    // value (which would clobber user fields / i18n maps and carries\n    // the executor's `_derivedFrom` tag). If the patch changes\n    // nothing, skip the write — that value-equality is the cycle\n    // guard: the self-write re-fires the source-path derivation,\n    // which recomputes identical fields and terminates here.\n    if (outSpec.shape === 'record' && outSpec.denorm !== undefined && outSpec.collection === spec.source) {\n      const value = out.value\n      const patched: Record<string, unknown> = { ...run.base }\n      let changed = false\n      for (const f of outSpec.denorm) {\n        if (!selfWriteFieldEqual(run.base[f], value[f])) {\n          patched[f] = value[f]\n          changed = true\n        }\n      }\n      if (!changed) continue // cycle guard — nothing to write\n      if (txCtx !== null) {\n        trackPut(txCtx, outSpec.collection, run.runId, await adapter.get(vault, outSpec.collection, run.runId))\n      }\n      await putDerivedOutput(outputCollection, run.runId, patched, outCtx, { source: 'derived' })\n      continue\n    }\n\n    // ── Normal record output (separate output collection) ──\n    if (txCtx !== null) {\n      trackPut(txCtx, outSpec.collection, run.runId, await adapter.get(vault, outSpec.collection, run.runId))\n    }\n    await putDerivedOutput(outputCollection, run.runId, out.value, outCtx, { source: 'derived' })\n  }\n}\n\n/**\n * Trigger fan-out for a DELETED parent record (#1249, spec §8). Distinct from\n * the \"record-shape derivations not dispatched on delete\" rule — that is\n * about deleting a SOURCE record; this fires when a TRIGGER collection's\n * record is deleted, re-deriving source records that still exist. Pairs\n * evaluate against the tombstoned record's values; matched sources re-derive\n * through the normal executor (their derive() reads the now-absent parent\n * and decides what that means — the engine never cascades deletes).\n */\nexport async function dispatchTriggerDerivationsOnDelete(\n  ctx: DerivationDispatchCtx, id: string, deleted: Record<string, unknown>,\n): Promise<void> {\n  const { derivationSource, collectionName } = ctx\n  const registry = derivationSource.registry()\n  const strategies = registry.strategiesForSource(collectionName)\n  if (strategies.length === 0) return\n  let executorClass: typeof DerivationExecutor | null = null\n  for (const { spec, strategyHash, triggers } of strategies) {\n    if (spec.rollup) continue                                    // rollup-on-delete already exists\n    if (spec.source === collectionName) continue                 // source delete: existing rule, untouched\n    if (spec.sources?.includes(collectionName)) continue          // declared sibling source: same exclusion as the write path's isSibling check\n    const entries = triggers.filter((t) => t.collection === collectionName)\n    // #1294 — deleting an INTERMEDIATE strands every source it addressed, for\n    // the same reason re-pointing one does: nothing is written to the trigger\n    // or source collection. The write path handles this; the delete path did\n    // not, which made the hop's correctness argument hold for puts only.\n    const hopEntries = triggers.filter((t) => hopCollections(t.match).includes(collectionName))\n    if (entries.length === 0 && hopEntries.length === 0) continue\n    const mode = typeof spec.lifecycle === 'string' ? spec.lifecycle : spec.lifecycle.mode\n    const srcColl = derivationSource.getCollection(spec.source)\n    const matched = new Set<string>()\n    const lookup = async (coll: string, field: string, value: string): Promise<Record<string, unknown> | null> => {\n      const c = derivationSource.getCollection(coll)\n      if (field === 'id') return c._getStoredRecord(value)\n      const found = await c._findMatchingCompositeIds([{ field, value }])\n      const first = found[0]\n      return first === undefined ? null : c._getStoredRecord(first)\n    }\n    const cap = (trigger: { maxFanout?: number; match: ReadonlyArray<{ to: string }> }, n: number, label: string): void => {\n      if (trigger.maxFanout !== undefined && n > trigger.maxFanout) {\n        throw new DerivationCapExceededError(\n          `triggerBy ${label} ${collectionName}→${spec.source} [${trigger.match.map(p => p.to).join(',')}] (delete)`,\n          n, trigger.maxFanout)\n      }\n    }\n    for (const trigger of entries) {\n      // #1294 — resolve the hop here too. The old sync builder compared the raw\n      // `from` value against `source[to]`, which for a mapped pair is the\n      // wrong side of the relationship: it matched nothing, silently, so a\n      // delete through a hop fanned out to no one while a delete through a\n      // plain pair worked.\n      const tuple = await resolveTuple(trigger.match, id, deleted, lookup)\n      if (tuple === null) continue\n      const ids = await srcColl._findMatchingCompositeIds(tuple)\n      cap(trigger, ids.length, '')\n      for (const sid of ids) matched.add(sid)\n    }\n    for (const trigger of hopEntries) {\n      const tuple = tupleFromIntermediate(trigger.match, collectionName, deleted)\n      if (tuple === null) continue\n      const ids = await srcColl._findMatchingCompositeIds(tuple)\n      cap(trigger, ids.length, 'hop')\n      for (const sid of ids) matched.add(sid)\n    }\n    if (matched.size === 0) continue\n    if (mode !== 'eager') { for (const sid of matched) await markStale(registry, spec, sid); continue }\n    if (executorClass === null) ({ DerivationExecutor: executorClass } = await import('./executor.js'))\n    for (const sid of matched) {\n      const raw = await srcColl._getStoredRecord(sid)\n      if (raw === null) continue\n      await runOne(ctx, spec, strategyHash, executorClass, { input: { ...raw, id: sid }, base: raw, runId: sid, version: 0 })\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0EA,eAAsB,iCACpB,KACA,IACA,sBAAsB,OACL;AACjB,QAAM,EAAE,kBAAkB,gBAAgB,SAAS,OAAO,QAAQ,gBAAgB,IAAI;AAEtF,QAAM,aAAa,iBAAiB,SAAS,EAAE,oBAAoB,cAAc;AACjF,MAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,QAAM,EAAE,mBAAmB,oBAAoB,IAAI,MAAM,OAAO,8BAAqB;AACrF,QAAM,QAAQ,iBAAiB,mBAAmB;AAClD,MAAI,SAAS;AAEb,aAAW,EAAE,KAAK,KAAK,YAAY;AACjC,eAAW,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AAC/D,UAAI,QAAQ,UAAU,UAAU;AAC9B,YAAI,uBAAuB,KAAK,WAAW,kBAAkB,QAAQ,eAAe,gBAAgB;AAClG,cAAI,MAAM,iBAAiB,cAAc,QAAQ,UAAU,EAAE,gBAAgB,IAAI,KAAK,EAAG,WAAU;AAAA,QACrG;AACA;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,kBAAkB,SAAS,OAAO,KAAK,QAAQ,IAAI,WAAW,QAAQ,eAAe;AAC3G,UAAI,CAAC,QAAS;AAEd,YAAM,mBAAmB,iBAAiB,cAAc,QAAQ,UAAU;AAC1E,iBAAW,aAAa,QAAQ,MAAM;AACpC,YAAI,MAAM,iBAAiB,gBAAgB,WAAW,KAAK,EAAG,WAAU;AAAA,MAC1E;AACA,YAAM,oBAAoB,SAAS,OAAO,KAAK,QAAQ,IAAI,SAAS;AAAA,IACtE;AAAA,EACF;AAEA,SAAO;AACT;AA4BA,eAAsB,oBACpB,KACA,IACA,QACA,SACA,MAKA,OACe;AACf,QAAM,EAAE,kBAAkB,gBAAgB,KAAK,gBAAgB,IAAI;AAInE,QAAM,WAAY,MAAM,IAAI,mBAAmB,MAAM,IAAI;AACzD,MAAI,YAAY,OAAO,aAAa,YAAY,kBAAkB,SAAU;AAK5E,QAAM,iBAAiB,SAAS,OAAQ,MAAM,IAAI,mBAAmB,KAAK,IAAI,QAAS;AACvF,QAAM,WAAW,iBAAiB,SAAS;AAC3C,QAAM,aAAa,SAAS,oBAAoB,cAAc;AAC9D,MAAI,WAAW,WAAW,EAAG;AAM7B,MAAI,gBAAkD;AACtD,aAAW,EAAE,MAAM,cAAc,SAAS,KAAK,YAAY;AACzD,UAAM,OAAO,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAK,UAAU;AAKlF,QAAI,KAAK,QAAQ;AACf,UAAI,SAAS,QAAS;AACtB,YAAM,aAAa,CAAC,MACjB,OAAO,MAAM,YAAY,OAAO,MAAM,WAAY,OAAO,CAAC,IAAI;AACjE,UAAI;AAOJ,UAAI,cAA6B;AACjC,UAAI,mBAAmB,KAAK,OAAO,MAAM;AACvC,mBAAW,WAAW,SAAS,KAAK,OAAO,GAAG,CAAC;AAC/C,cAAM,WAAW,kBAAkB,OAAO,WAAW,eAAe,KAAK,OAAO,GAAG,CAAC,IAAI;AACxF,YAAI,aAAa,QAAQ,aAAa,SAAU,eAAc;AAAA,MAChE,OAAO;AACL,mBAAW;AAAA,MACb;AACA,UAAI,aAAa,KAAM,OAAM,gBAAgB,MAAM,UAAU,EAAE,YAAY,gBAAgB,GAAG,GAAG,IAAI;AAGrG,UAAI,gBAAgB,KAAM,OAAM,gBAAgB,MAAM,aAAa,EAAE,YAAY,gBAAgB,GAAG,GAAG,IAAI;AAC3G;AAAA,IACF;AAUA,UAAM,WAAW,KAAK,WAAW;AACjC,UAAM,YAAY,CAAC,aAAa,KAAK,SAAS,SAAS,cAAc,KAAK;AAC1E,UAAM,iBAAiB,CAAC,YAAY,CAAC,YACjC,SAAS,OAAO,CAAC,MAAM,EAAE,eAAe,cAAc,IACtD,CAAC;AAOL,UAAM,aAAa,CAAC,YAAY,CAAC,YAC7B,SAAS,OAAO,CAAC,MAAM,eAAe,EAAE,KAAK,EAAE,SAAS,cAAc,CAAC,IACvE,CAAC;AAEL,UAAM,OAKD,CAAC;AAEN,QAAI,UAAU;AACZ,WAAK,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,GAAG,GAAG,MAAM,UAAU,OAAO,IAAI,QAAQ,CAAC;AAAA,IAC9E,WAAW,WAAW;AACpB,YAAM,IAAI,MAAM,iBAAiB,cAAc,KAAK,MAAM,EAAE,IAAI,EAAE;AAClE,UAAI,MAAM,QAAQ,MAAM,QAAW;AAGjC,cAAM,MAAM,MAAM,iBAAiB,cAAc,KAAK,MAAM,EAAE,iBAAiB,EAAE;AACjF,aAAK,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,GAAG,GAAG,MAAM,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;AAAA,MAC1E;AAAA,IACF,WAAW,eAAe,SAAS,KAAK,WAAW,SAAS,GAAG;AAC7D,YAAM,UAAU,iBAAiB,cAAc,KAAK,MAAM;AAC1D,YAAM,UAAU,oBAAI,IAAY;AAIhC,YAAM,SAAS,OAAO,MAAc,OAAe,UAA2D;AAC5G,cAAM,IAAI,iBAAiB,cAAc,IAAI;AAC7C,YAAI,UAAU,KAAM,QAAO,EAAE,iBAAiB,KAAK;AACnD,cAAM,MAAM,MAAM,EAAE,0BAA0B,CAAC,EAAE,OAAO,MAAM,CAAC,CAAC;AAChE,cAAM,QAAQ,IAAI,CAAC;AACnB,eAAO,UAAU,SAAY,OAAO,EAAE,iBAAiB,KAAK;AAAA,MAC9D;AAIA,iBAAW,WAAW,YAAY;AAChC,cAAM,SAAS,CAAC,sBAAsB,QAAQ,OAAO,gBAAgB,QAAQ,CAAC;AAC9E,YAAI,kBAAkB,MAAM;AAC1B,gBAAM,MAAM,sBAAsB,QAAQ,OAAO,gBAAgB,cAAc;AAC/E,cAAI,CAAC,UAAU,KAAK,OAAO,CAAC,CAAE,EAAG,QAAO,KAAK,GAAG;AAAA,QAClD;AACA,cAAM,MAAM,oBAAI,IAAY;AAC5B,mBAAW,SAAS,QAAQ;AAC1B,cAAI,UAAU,KAAM;AACpB,qBAAW,OAAO,MAAM,QAAQ,0BAA0B,KAAK,EAAG,KAAI,IAAI,GAAG;AAAA,QAC/E;AACA,YAAI,QAAQ,cAAc,UAAa,IAAI,OAAO,QAAQ,WAAW;AACnE,gBAAM,IAAI;AAAA,YACR,iBAAiB,cAAc,SAAI,KAAK,MAAM,KAAK,QAAQ,MAAM,IAAI,OAAK,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,YACzF,IAAI;AAAA,YAAM,QAAQ;AAAA,UAAS;AAAA,QAC/B;AACA,mBAAW,OAAO,IAAK,SAAQ,IAAI,GAAG;AAAA,MACxC;AACA,iBAAW,WAAW,gBAAgB;AAMpC,cAAM,SAAS,CAAC,MAAM,aAAa,QAAQ,OAAO,IAAI,UAAU,MAAM,CAAC;AACvE,YAAI,kBAAkB,QAAQ,QAAQ,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,GAAG;AACxE,gBAAM,MAAM,MAAM,aAAa,QAAQ,OAAO,IAAI,gBAAgB,MAAM;AACxE,cAAI,CAAC,UAAU,KAAK,OAAO,CAAC,CAAE,EAAG,QAAO,KAAK,GAAG;AAAA,QAClD;AACA,cAAM,MAAM,oBAAI,IAAY;AAC5B,mBAAW,SAAS,QAAQ;AAC1B,cAAI,UAAU,KAAM;AACpB,qBAAW,OAAO,MAAM,QAAQ,0BAA0B,KAAK,EAAG,KAAI,IAAI,GAAG;AAAA,QAC/E;AACA,YAAI,QAAQ,cAAc,UAAa,IAAI,OAAO,QAAQ,WAAW;AACnE,gBAAM,IAAI;AAAA,YACR,aAAa,cAAc,SAAI,KAAK,MAAM,KAAK,QAAQ,MAAM,IAAI,OAAK,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,YACrF,IAAI;AAAA,YAAM,QAAQ;AAAA,UAAS;AAAA,QAC/B;AACA,mBAAW,OAAO,IAAK,SAAQ,IAAI,GAAG;AAAA,MACxC;AACA,iBAAW,OAAO,SAAS;AACzB,cAAM,MAAM,MAAM,QAAQ,iBAAiB,GAAG;AAC9C,YAAI,QAAQ,KAAM;AAClB,aAAK,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,IAAI,GAAG,MAAM,KAAK,OAAO,KAAK,SAAS,EAAE,CAAC;AAAA,MAC7E;AAAA,IACF;AAEA,QAAI,KAAK,WAAW,EAAG;AAEvB,QAAI,SAAS,SAAS;AACpB,iBAAW,OAAO,KAAM,OAAM,UAAU,UAAU,MAAM,IAAI,KAAK;AACjE;AAAA,IACF;AAEA,QAAI,kBAAkB,MAAM;AAC1B;AAAC,OAAC,EAAE,oBAAoB,cAAc,IAAI,MAAM,OAAO,wBAAe;AAAA,IACxE;AAGA,eAAW,OAAO,KAAM,OAAM,OAAO,KAAK,MAAa,cAAc,eAAe,GAAG;AAAA,EACzF;AACF;AASA,eAAe,OACb,KAEA,MACA,cACA,eACA,KACe;AACf,QAAM,EAAE,kBAAkB,SAAS,OAAO,QAAQ,iBAAiB,aAAa,SAAS,IAAI;AAC7F,QAAM,UAAU,EAAE,OAAO,iBAAiB,kBAAkB,EAAE;AAC9D,QAAM,SAAS,YAAY,EAAE,YAAY,KAAK,QAAQ,IAAI,IAAI,MAAM,CAAC;AACrE,QAAM,SAAS,MAAM,cAAc,IAAI,MAAM,IAAI,OAAO,IAAI,SAAS,cAAc,OAAO;AAC1F,aAAW,OAAO,OAAO,KAAK,KAAK,OAAO,GAAG;AAC3C,UAAM,MAAM,OAAO,QAAQ,GAAG;AAC9B,QAAI,CAAC,IAAK;AACV,QAAI,IAAI,SAAS,UAAU;AACzB,YAAM,MAAM,IAAI;AAChB,UAAI,KAAK,OAAQ,OAAM;AACvB,cAAQ,KAAK,wBAAwB,GAAG,iBAAiB,KAAK,MAAM,SAAS,IAAI,KAAK,aAAa,GAAG;AACtG;AAAA,IACF;AACA,UAAM,UAAU,KAAK,QAAQ,GAAG;AAChC,QAAI,CAAC,QAAS;AACd,UAAM,mBAAmB,iBAAiB,cAAc,QAAQ,UAAU;AAQ1E,UAAM,QAAQ,iBAAiB,mBAAmB;AAGlD,QAAI,IAAI,SAAS,SAAS;AAExB,YAAM,EAAE,mBAAmB,kBAAkB,IAAI,MAAM,OAAO,8BAAqB;AACnF,YAAM,QAAQ,MAAM,kBAAkB,SAAS,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,eAAe;AAC1G,YAAM,WAAW,IAAI,IAAY,OAAO,QAAQ,CAAC,CAAC;AAClD,YAAM,cAAc,IAAI,QAAQ,IAAI,CAAC,MAAuB,EAAE,GAAG;AACjE,YAAM,aAAa,IAAI,IAAY,WAAW;AAG9C,iBAAW,KAAK,UAAU;AACxB,YAAI,WAAW,IAAI,CAAC,EAAG;AACvB,cAAM,iBAAiB,gBAAgB,GAAG,KAAK;AAAA,MACjD;AAKA,iBAAW,SAAS,IAAI,SAAS;AAC/B,YAAI,UAAU,MAAM;AAClB,mBAAS,OAAO,QAAQ,YAAY,MAAM,KAAK,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,MAAM,GAAG,CAAC;AAAA,QACxG;AACA,cAAM,iBAAiB,kBAAkB,MAAM,KAAK,MAAM,OAAO,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAAA,MAChG;AAGA,YAAM,kBAAkB,SAAS,OAAO;AAAA,QACtC,QAAQ,KAAK;AAAA,QACb,UAAU,IAAI;AAAA,QACd,WAAW;AAAA,QACX,kBAAkB,QAAQ;AAAA,QAC1B,MAAM;AAAA,MACR,GAAG,QAAQ,eAAe;AAC1B;AAAA,IACF;AAGA,QAAI,IAAI,YAAY,MAAM;AASxB,YAAM,iBAAiB,gBAAgB,IAAI,OAAO,KAAK;AACvD;AAAA,IACF;AAUA,QAAI,QAAQ,UAAU,YAAY,QAAQ,WAAW,UAAa,QAAQ,eAAe,KAAK,QAAQ;AACpG,YAAM,QAAQ,IAAI;AAClB,YAAM,UAAmC,EAAE,GAAG,IAAI,KAAK;AACvD,UAAI,UAAU;AACd,iBAAW,KAAK,QAAQ,QAAQ;AAC9B,YAAI,CAAC,oBAAoB,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG;AAC/C,kBAAQ,CAAC,IAAI,MAAM,CAAC;AACpB,oBAAU;AAAA,QACZ;AAAA,MACF;AACA,UAAI,CAAC,QAAS;AACd,UAAI,UAAU,MAAM;AAClB,iBAAS,OAAO,QAAQ,YAAY,IAAI,OAAO,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,CAAC;AAAA,MACxG;AACA,YAAM,iBAAiB,kBAAkB,IAAI,OAAO,SAAS,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAC1F;AAAA,IACF;AAGA,QAAI,UAAU,MAAM;AAClB,eAAS,OAAO,QAAQ,YAAY,IAAI,OAAO,MAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,CAAC;AAAA,IACxG;AACA,UAAM,iBAAiB,kBAAkB,IAAI,OAAO,IAAI,OAAO,QAAQ,EAAE,QAAQ,UAAU,CAAC;AAAA,EAC9F;AACF;AAWA,eAAsB,mCACpB,KAA4B,IAAY,SACzB;AACf,QAAM,EAAE,kBAAkB,eAAe,IAAI;AAC7C,QAAM,WAAW,iBAAiB,SAAS;AAC3C,QAAM,aAAa,SAAS,oBAAoB,cAAc;AAC9D,MAAI,WAAW,WAAW,EAAG;AAC7B,MAAI,gBAAkD;AACtD,aAAW,EAAE,MAAM,cAAc,SAAS,KAAK,YAAY;AACzD,QAAI,KAAK,OAAQ;AACjB,QAAI,KAAK,WAAW,eAAgB;AACpC,QAAI,KAAK,SAAS,SAAS,cAAc,EAAG;AAC5C,UAAM,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,eAAe,cAAc;AAKtE,UAAM,aAAa,SAAS,OAAO,CAAC,MAAM,eAAe,EAAE,KAAK,EAAE,SAAS,cAAc,CAAC;AAC1F,QAAI,QAAQ,WAAW,KAAK,WAAW,WAAW,EAAG;AACrD,UAAM,OAAO,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAK,UAAU;AAClF,UAAM,UAAU,iBAAiB,cAAc,KAAK,MAAM;AAC1D,UAAM,UAAU,oBAAI,IAAY;AAChC,UAAM,SAAS,OAAO,MAAc,OAAe,UAA2D;AAC5G,YAAM,IAAI,iBAAiB,cAAc,IAAI;AAC7C,UAAI,UAAU,KAAM,QAAO,EAAE,iBAAiB,KAAK;AACnD,YAAM,QAAQ,MAAM,EAAE,0BAA0B,CAAC,EAAE,OAAO,MAAM,CAAC,CAAC;AAClE,YAAM,QAAQ,MAAM,CAAC;AACrB,aAAO,UAAU,SAAY,OAAO,EAAE,iBAAiB,KAAK;AAAA,IAC9D;AACA,UAAM,MAAM,CAAC,SAAuE,GAAW,UAAwB;AACrH,UAAI,QAAQ,cAAc,UAAa,IAAI,QAAQ,WAAW;AAC5D,cAAM,IAAI;AAAA,UACR,aAAa,KAAK,IAAI,cAAc,SAAI,KAAK,MAAM,KAAK,QAAQ,MAAM,IAAI,OAAK,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC;AAAA,UAC9F;AAAA,UAAG,QAAQ;AAAA,QAAS;AAAA,MACxB;AAAA,IACF;AACA,eAAW,WAAW,SAAS;AAM7B,YAAM,QAAQ,MAAM,aAAa,QAAQ,OAAO,IAAI,SAAS,MAAM;AACnE,UAAI,UAAU,KAAM;AACpB,YAAM,MAAM,MAAM,QAAQ,0BAA0B,KAAK;AACzD,UAAI,SAAS,IAAI,QAAQ,EAAE;AAC3B,iBAAW,OAAO,IAAK,SAAQ,IAAI,GAAG;AAAA,IACxC;AACA,eAAW,WAAW,YAAY;AAChC,YAAM,QAAQ,sBAAsB,QAAQ,OAAO,gBAAgB,OAAO;AAC1E,UAAI,UAAU,KAAM;AACpB,YAAM,MAAM,MAAM,QAAQ,0BAA0B,KAAK;AACzD,UAAI,SAAS,IAAI,QAAQ,KAAK;AAC9B,iBAAW,OAAO,IAAK,SAAQ,IAAI,GAAG;AAAA,IACxC;AACA,QAAI,QAAQ,SAAS,EAAG;AACxB,QAAI,SAAS,SAAS;AAAE,iBAAW,OAAO,QAAS,OAAM,UAAU,UAAU,MAAM,GAAG;AAAG;AAAA,IAAS;AAClG,QAAI,kBAAkB,KAAM,EAAC,EAAE,oBAAoB,cAAc,IAAI,MAAM,OAAO,wBAAe;AACjG,eAAW,OAAO,SAAS;AACzB,YAAM,MAAM,MAAM,QAAQ,iBAAiB,GAAG;AAC9C,UAAI,QAAQ,KAAM;AAClB,YAAM,OAAO,KAAK,MAAM,cAAc,eAAe,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,IAAI,GAAG,MAAM,KAAK,OAAO,KAAK,SAAS,EAAE,CAAC;AAAA,IACxH;AAAA,EACF;AACF;","names":[]}

package/dist/executor-B6SRO2QS.js

@@ -1,36 +0,0 @@
-import {
-  MaterializedViewExecutor
-} from "./chunk-QBBUZ3I3.js";
-import "./chunk-NWHBJQAL.js";
-import "./chunk-WY2XXTET.js";
-import "./chunk-T52GX4SA.js";
-import "./chunk-CF5UU4S7.js";
-import "./chunk-K6W7BVZ6.js";
-import "./chunk-FH2L2E34.js";
-import "./chunk-XZHEOSQ2.js";
-import "./chunk-F2TDU7MQ.js";
-import "./chunk-SUZKW6UR.js";
-import "./chunk-VHM7HCKB.js";
-import "./chunk-XBKH4FOC.js";
-import "./chunk-4I522ERM.js";
-import "./chunk-MKXXMNJH.js";
-import "./chunk-LGNDFRYC.js";
-import "./chunk-5O7D6ZTW.js";
-import "./chunk-HLEK5VAN.js";
-import "./chunk-DF73H4UN.js";
-import "./chunk-GHLTDZRS.js";
-import "./chunk-Z5HTYMMQ.js";
-import "./chunk-CKNGS5MH.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
-export {
-  MaterializedViewExecutor
-};
-//# sourceMappingURL=executor-B6SRO2QS.js.map

package/dist/executor-BI5CHWRY.js

@@ -1,8 +0,0 @@
-import {
-  GuardExecutor
-} from "./chunk-FN5EBVTQ.js";
-import "./chunk-244VXYPG.js";
-export {
-  GuardExecutor
-};
-//# sourceMappingURL=executor-BI5CHWRY.js.map

package/dist/executor-RBKM5W5K.js

@@ -1,8 +0,0 @@
-import {
-  DerivationExecutor
-} from "./chunk-MVZ2TPVP.js";
-import "./chunk-244VXYPG.js";
-export {
-  DerivationExecutor
-};
-//# sourceMappingURL=executor-RBKM5W5K.js.map

package/dist/export-accessible-VMA3YM5V.js

@@ -1,22 +0,0 @@
-import {
-  buildAccessibleBundle,
-  exportAccessibleData,
-  resolveAccessibleCollections
-} from "./chunk-WNJ4AVGE.js";
-import "./chunk-HBPPGWUM.js";
-import "./chunk-IUWCVHQ7.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
-export {
-  buildAccessibleBundle,
-  exportAccessibleData,
-  resolveAccessibleCollections
-};
-//# sourceMappingURL=export-accessible-VMA3YM5V.js.map

package/dist/extract-partition-NF7PXGPP.js

@@ -1,37 +0,0 @@
-import {
-  extractPartition,
-  extractPartitionCore,
-  reKeyBlobs,
-  reKeyClosure,
-  reKeyLedger,
-  reKeySchemas,
-  sealDeks
-} from "./chunk-3ELRMVJK.js";
-import "./chunk-HBPPGWUM.js";
-import "./chunk-IUWCVHQ7.js";
-import "./chunk-3H5KLDZN.js";
-import "./chunk-ANWPSTZU.js";
-import "./chunk-SOIQ4MM4.js";
-import "./chunk-4AOERLTV.js";
-import "./chunk-I7FD46FF.js";
-import "./chunk-CKNGS5MH.js";
-import "./chunk-JCN44NCY.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
-export {
-  extractPartition,
-  extractPartitionCore,
-  reKeyBlobs,
-  reKeyClosure,
-  reKeyLedger,
-  reKeySchemas,
-  sealDeks
-};
-//# sourceMappingURL=extract-partition-NF7PXGPP.js.map

package/dist/fanout-sidecar-OT6RYLOL.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-formula/derivations/fanout-sidecar.ts"],"sourcesContent":["/**\n * Per-source-row fanout sidecar for `shape: 'array'` derivations.\n *\n * Each `(sourceCollection, sourceId, outputKey)` triple gets its own\n * envelope at:\n *\n *     _meta/derivations-fanout/<sourceCollection>/<sourceId>/<outputKey>\n *\n * The envelope records the last-emitted derived row ids so the\n * dispatcher can compute the diff on every source-row update in O(1):\n * read prior keys, compute `toDelete = prev \\ new`, write new, persist\n * back.\n *\n * The body is encrypted (AES-GCM under the `_meta` collection DEK) when\n * the vault is encrypted — the `keys[]` are derived-row ids produced by a\n * user-supplied key extractor and can be content-bearing (SKU, tag, email),\n * so a ciphertext-only store must not read them, the derivation graph, or\n * `emittedAt`. Back-compat: sidecars written before this fix are plaintext\n * (`_iv === ''`); `loadFanoutSidecar` dual-reads them.\n *\n * @module\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\n\ntype GetDEK = (collectionName: string) => Promise<EnclaveKey>\n\n/** The `_meta` collection name whose DEK encrypts the sidecar body. */\nconst FANOUT_DEK_COLLECTION = '_meta'\n\n/** Magic-prefixed JSON payload at `_meta/<recordId>`. */\nexport interface FanoutSidecar {\n  readonly _noydb_fanout: 1\n  /** Source collection name. */\n  readonly source: string\n  /** Source record id. */\n  readonly sourceId: string\n  /** Strategy output key (the key in `strategy.outputs`). */\n  readonly outputKey: string\n  /** Output collection name (audit / forensics). */\n  readonly outputCollection: string\n  /** Derived-row ids last emitted for this (source, output) pair. */\n  readonly keys: ReadonlyArray<string>\n  /** ISO timestamp of last dispatch. */\n  readonly emittedAt: string\n}\n\n/**\n * Build the canonical `_meta` record id for a fanout sidecar.\n *\n * The full path inside the store is `_meta/<this-string>`. We pack the\n * full triple into the id so a single `_meta` collection holds all\n * sidecars (collection-per-source would proliferate names; the\n * existing `_meta` flat namespace is cheaper).\n */\nfunction recordId(source: string, sourceId: string, outputKey: string): string {\n  // Use `/` as a separator. None of the components is supposed to\n  // contain it (collection names + output keys are bare identifiers;\n  // source ids are typically ULIDs / UUIDs / app-chosen strings\n  // without slashes). If a future source carries `/` in its id, we'd\n  // need an escape; deferred until that's a real case.\n  return `derivations-fanout/${source}/${sourceId}/${outputKey}`\n}\n\n/**\n * Read the sidecar; returns `undefined` only when it's legitimately absent\n * (no envelope at that id) — the correct signal for callers to skip\n * orphan-row reconciliation because there's nothing to reconcile against.\n *\n * A PRESENT envelope that fails to decrypt or parse is a data-integrity\n * problem, not an absence, and is deliberately NOT caught here: swallowing\n * it to `undefined` would look identical to \"no sidecar\" and make callers\n * (the array-derivation dispatch in `vault.ts`/`collection.ts`) silently\n * skip deleting stale derived rows on a shrink. Let `openEnvelopeJson`'s\n * `DecryptionError`/`TamperedError` and `JSON.parse` failures propagate,\n * matching the no-catch convention of sibling decrypt call-sites (e.g.\n * `with-audit/consent/consent.ts`'s `decryptEntry`).\n *\n * Dual-reads for back-compat: an envelope with `_iv === ''` is a legacy\n * plaintext sidecar (parse `_data` directly); otherwise the body was\n * encrypted under the `_meta` DEK and is decrypted first.\n */\nexport async function loadFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<FanoutSidecar | undefined> {\n  const envelope = await store.get(vault, '_meta', recordId(source, sourceId, outputKey))\n  if (!envelope) return undefined\n  // Legacy plaintext (`_iv === ''`) reads directly; encrypted bodies decrypt.\n  const json = (!encrypted || envelope._iv === '')\n    ? envelope._data\n    : await openEnvelopeJson({ collection: '_meta', id: recordId(source, sourceId, outputKey) }, envelope, await getDEK(FANOUT_DEK_COLLECTION))\n  const parsed = JSON.parse(json) as FanoutSidecar\n  if (parsed._noydb_fanout !== 1) return undefined\n  if (!Array.isArray(parsed.keys)) return undefined\n  return parsed\n}\n\n/**\n * Persist (insert/replace) the sidecar with a fresh key set. The body is\n * encrypted under the `_meta` DEK when the vault is encrypted (the `keys[]`\n * can be content-bearing); plaintext only in debug/unencrypted vaults.\n */\nexport async function saveFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  payload: {\n    readonly source: string\n    readonly sourceId: string\n    readonly outputKey: string\n    readonly outputCollection: string\n    readonly keys: ReadonlyArray<string>\n  },\n  getDEK: GetDEK,\n  encrypted: boolean,\n): Promise<void> {\n  const doc: FanoutSidecar = {\n    _noydb_fanout: 1,\n    source: payload.source,\n    sourceId: payload.sourceId,\n    outputKey: payload.outputKey,\n    outputCollection: payload.outputCollection,\n    keys: payload.keys,\n    emittedAt: new Date().toISOString(),\n  }\n  const id = recordId(payload.source, payload.sourceId, payload.outputKey)\n  const prior = await store.get(vault, '_meta', id)\n  const json = JSON.stringify(doc)\n  const version = (prior?._v ?? 0) + 1\n  const identity = { collection: '_meta', id, version }\n  let envelope: EncryptedEnvelope\n  if (!encrypted) {\n    envelope = buildRecordEnvelope(identity, { iv: '', data: json })\n  } else {\n    const { iv, data } = await encrypt(json, await getDEK(FANOUT_DEK_COLLECTION), buildRecordAad(identity))\n    envelope = buildRecordEnvelope(identity, { iv, data })\n  }\n  await store.put(vault, '_meta', id, envelope)\n}\n\n/** Delete the sidecar (used on source-row delete cascade). */\nexport async function deleteFanoutSidecar(\n  store: NoydbStore,\n  vault: string,\n  source: string,\n  sourceId: string,\n  outputKey: string,\n): Promise<void> {\n  await store.delete(vault, '_meta', recordId(source, sourceId, outputKey))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA4BA,IAAM,wBAAwB;AA2B9B,SAAS,SAAS,QAAgB,UAAkB,WAA2B;AAM7E,SAAO,sBAAsB,MAAM,IAAI,QAAQ,IAAI,SAAS;AAC9D;AAoBA,eAAsB,kBACpB,OACA,OACA,QACA,UACA,WACA,QACA,WACoC;AACpC,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AACtF,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,OAAQ,CAAC,aAAa,SAAS,QAAQ,KACzC,SAAS,QACT,MAAM,iBAAiB,EAAE,YAAY,SAAS,IAAI,SAAS,QAAQ,UAAU,SAAS,EAAE,GAAG,UAAU,MAAM,OAAO,qBAAqB,CAAC;AAC5I,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,MAAI,OAAO,kBAAkB,EAAG,QAAO;AACvC,MAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,QAAO;AACxC,SAAO;AACT;AAOA,eAAsB,kBACpB,OACA,OACA,SAOA,QACA,WACe;AACf,QAAM,MAAqB;AAAA,IACzB,eAAe;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,IACnB,kBAAkB,QAAQ;AAAA,IAC1B,MAAM,QAAQ;AAAA,IACd,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACA,QAAM,KAAK,SAAS,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,EAAE;AAChD,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,QAAM,WAAW,OAAO,MAAM,KAAK;AACnC,QAAM,WAAW,EAAE,YAAY,SAAS,IAAI,QAAQ;AACpD,MAAI;AACJ,MAAI,CAAC,WAAW;AACd,eAAW,oBAAoB,UAAU,EAAE,IAAI,IAAI,MAAM,KAAK,CAAC;AAAA,EACjE,OAAO;AACL,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM,OAAO,qBAAqB,GAAG,eAAe,QAAQ,CAAC;AACtG,eAAW,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAAA,EACvD;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,IAAI,QAAQ;AAC9C;AAGA,eAAsB,oBACpB,OACA,OACA,QACA,UACA,WACe;AACf,QAAM,MAAM,OAAO,OAAO,SAAS,SAAS,QAAQ,UAAU,SAAS,CAAC;AAC1E;","names":[]}

package/dist/find-LZMP26KF.js

@@ -1,10 +0,0 @@
-import {
-  computeBidxTarget
-} from "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-244VXYPG.js";
-export {
-  computeBidxTarget
-};
-//# sourceMappingURL=find-LZMP26KF.js.map

package/dist/issue-IHARXWW5.js

@@ -1,18 +0,0 @@
-import {
-  issueAttestationCore
-} from "./chunk-MTL7MXGR.js";
-import "./chunk-QWFHIOD2.js";
-import "./chunk-4AOERLTV.js";
-import "./chunk-KJFW62P4.js";
-import "./chunk-SEE332EV.js";
-import "./chunk-6QSQQLSE.js";
-import "./chunk-DE4DH2RZ.js";
-import "./chunk-LQ4ZHOKP.js";
-import "./chunk-LP7BEXCT.js";
-import "./chunk-UYB234ZR.js";
-import "./chunk-ODVPTDPK.js";
-import "./chunk-244VXYPG.js";
-export {
-  issueAttestationCore
-};
-//# sourceMappingURL=issue-IHARXWW5.js.map

package/dist/kernel/enclave/classify/compare.d.ts

@@ -1,10 +0,0 @@
-/** Compare exactly-32-byte tags. XOR-accumulate over all 32 bytes, no early exit. */
-export declare function ctEqualTags(a: Uint8Array, b: Uint8Array): boolean;
-/**
- * Blinded equality of arbitrary-length byte strings: fresh K_e per
- * comparison (never stored, never reused), HMAC both sides to 32-byte
- * tags, then ctEqualTags. On the digest path the inputs are already
- * 32-byte PBKDF2 outputs but still route through this reduction so
- * there is exactly ONE comparison construction (spec §3 rule 2).
- */
-export declare function blindedEqual(a: Uint8Array, b: Uint8Array): Promise<boolean>;

package/dist/kernel/enclave/index.d.ts

@@ -1,87 +0,0 @@
-/**
- * **kernel/enclave** — the hub's crypto interior, behind one door.
- *
- * This barrel is **the fork-swap contract**: a sister project that wants a
- * different crypto engine (a different KDF, a hardware-backed keystore, a
- * post-quantum wrap algorithm, …) replaces the entire `kernel/enclave/`
- * folder wholesale and only has to honor the exports below. Nothing outside
- * `kernel/enclave/**` may deep-import `crypto.js` or `record-keys/*` directly
- * — `scripts/check-architecture.mjs`'s `enclave-barrel-only` check enforces
- * that mechanically. Import sites inside `kernel/enclave/**` keep their
- * existing relative imports; this door is for everyone else.
- *
- * The export list is the OBSERVED contract — exactly the symbols consumed
- * from outside this folder today — grouped by the module that defines them:
- *
- *   - key type       — `crypto.ts`: `EnclaveKey`, the opaque key type every
- *                       barrel-facing signature traffics in (`= CryptoKey` in
- *                       noy-db's reference enclave; a fork redefines it to its
- *                       own key representation — see the type's own doc for
- *                       the fork contract).
- *   - crypto ops     — `crypto.ts`: AES-256-GCM encrypt/decrypt (+ bytes, AAD,
- *                       deterministic variants), SHA-256 / HMAC-SHA-256 hashing.
- *   - key lifecycle  — `crypto.ts` + `record-keys/lifecycle.ts`: KEK/DEK
- *                       derivation, AES-KW wrap/unwrap, per-record CEK
- *                       wrap/unwrap/import + resolution/re-wrap, HKDF-derived
- *                       presence/sealed-field keys, base64 helpers.
- *   - record codec   — `record-keys/record-codec.ts`: the per-record
- *                       encode/decode engine.
- *   - sealing        — `record-keys/sealing.ts`: the sealed-record grantor
- *                       primitives (seal/revoke/rotate to an `at-*` host).
- *   - deterministic  — `record-keys/deterministic.ts`: blind-equality lookup
- *                       over deterministically-encrypted fields.
- *   - tombstone      — `record-keys/tombstone.ts`: the erased-record residue.
- *   - envelope body  — `record-keys/envelope-body.ts`: the C1 protected-body
- *                       access contract (`openEnvelopeJson`,
- *                       `writeEnvelopeBody`, `hasPerRecordKey`,
- *                       `hasSealedBody`, `envelopeBodyForHash`) — the
- *                       sanctioned door onto
- *                       `_iv`/`_data`/`_cek`/`_sealed` for everyone outside
- *                       this folder.
- *   - reserved envelopes — `record-keys/sealed-slots.ts`: `makeReservedEnvelopes`,
- *                       the whole-envelope encrypt/decrypt door scoped to a
- *                       declared collection-name prefix (e.g. `_dict_`) —
- *                       `kernel/vault.ts` binds it for `DictionaryHandle`
- *                       (#629 Task 4).
- *
- * Additive changes only — removing or renaming an export here is breaking
- * for any fork. Frozen by `__tests__/enclave-surface-golden.test.ts`.
- *
- * **Refusal contract:** the barrel above is frozen — every symbol must
- * exist in any fork — but the optional groups (sealing, deterministic,
- * per-record-key lifecycle) MAY throw `EnclaveNotSupportedError` instead
- * of implementing the reference behavior. The core groups (crypto ops,
- * record codec, tombstone) MUST NOT throw it — they are load-bearing for
- * every consumer regardless of which enclave is wired in. noy-db's own
- * enclave supports every group, so it never throws this error.
- */
-export type { EnclaveKey, EncryptResult } from './crypto.js';
-export { encrypt, decrypt, encryptBytes, decryptBytes, encryptBytesWithAAD, decryptBytesWithAAD, encryptDeterministic, decryptDeterministic, sha256Hex, hmacSha256Hex, deriveBlobAddressKey, } from './crypto.js';
-export { deriveKey, deriveSecretKey, generateDEK, exportDekSet, importDekSet, generateSalt, generateRecoverySecret, generateIV, wrapKey, unwrapKey, bufferToBase64, base64ToBuffer, derivePresenceKey, deriveDeterministicKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, wrapCek, unwrapCek, importCek, encodeEchoParts, deriveEchoKey, } from './crypto.js';
-export type { SecretKeyUsage } from './crypto.js';
-export type { EchoSecretParts } from './crypto.js';
-export { resolveStableCek, rewrapBodyToDek, rewrapEnvelope, applyRewrappedBody, isRewrappedUnder } from './record-keys/lifecycle.js';
-export type { RewrappedBody } from './record-keys/lifecycle.js';
-export { rekeyEnvelopeToDek, rekeyEnvelopeIfNeeded, envelopeOpensUnderAny } from './record-keys/rekey.js';
-export { rekeyBlobSet } from './record-keys/rekey-blob.js';
-export { buildRecordEnvelope, buildSealedRecordEnvelope } from './record-envelope.js';
-export type { RecordEnvelopeBody } from './record-envelope.js';
-export { buildRecordAad, recordAadFor } from './record-aad.js';
-export type { RecordIdentity, RecordRef } from './record-aad.js';
-export { RecordCodec } from './record-keys/record-codec.js';
-export type { SealedShredSlot } from './record-keys/record-codec.js';
-export { SEALED_CEK_NS, sealRecordToHost, revokeSealedRecord, rotateRecordCek } from './record-keys/sealing.js';
-export type { SealingContext } from './record-keys/sealing.js';
-export { findByDet, queryByDet } from './record-keys/deterministic.js';
-export type { DeterministicContext } from './record-keys/deterministic.js';
-export { isTombstone, isTombstoneShape, buildTombstone, isDeleteMarker, buildDeleteMarker } from './record-keys/tombstone.js';
-export { openEnvelopeJson, writeEnvelopeBody, hasPerRecordKey, hasSealedBody, envelopeBodyForHash, envelopeBodySize, verifyRecordIdentity } from './record-keys/envelope-body.js';
-export { makeReservedEnvelopes } from './record-keys/sealed-slots.js';
-export { deriveVdigSlotKey } from './classify/vdig.js';
-export { pbkdf2VerifyDigest } from './classify/digest.js';
-export { ctEqualTags } from './classify/compare.js';
-export { evaluateKofN } from './classify/kofn.js';
-export { deriveClassifyIndexKey, deriveClassifyIndexSalt, mintBidxTag } from './classify/bidx.js';
-export { computeBidxTarget } from './classify/find.js';
-export { deriveBrokerProofBits, deriveBrokerProofKey, computeBrokerProof, issueChallenge, verifyBrokerProof, } from './broker/proof.js';
-export type { BrokerProofCanonicalParts, VerifyBrokerProofArgs, IssuedChallenge } from './broker/proof.js';

package/dist/kernel/enclave/record-keys/lifecycle.d.ts

@@ -1,124 +0,0 @@
-/**
- * Per-record CEK lifecycle helpers for the WRITE path.
- *
- * These are the collection-coupled CEK operations, lifted off `Collection`
- * behind narrow deps so the kernel file delegates instead of carrying the
- * crypto inline:
- *
- *   - {@link resolveStableCek} — the stable-CEK rule: an update or history
- *     snapshot reuses the record's existing CEK so a single CEK delete kills
- *     the whole version chain; a genuine insert (or legacy record being
- *     migrated) mints a fresh one.
- *   - {@link rewrapBodyToDek} — move a record body's wrapping from one DEK to
- *     another (tier elevate/demote, bundle re-key) WITHOUT changing the body
- *     key: unwrap the CEK under the source DEK, re-encrypt the body under the
- *     same CEK, re-wrap the CEK under the destination DEK. History-chain
- *     identity is preserved because the body key never changes.
- *
- * Both are pure functions over their deps — the `cekCache` ownership stays on
- * the collection (its lifetime is tied to `load()`), so callers cache the
- * returned key themselves.
- */
-import { type EnclaveKey } from '../crypto.js';
-import type { EncryptedEnvelope } from '../../types.js';
-import { type RecordIdentity } from '../record-aad.js';
-import type { Lru } from '../../cache/index.js';
-/** Dependencies {@link resolveStableCek} needs from its collection. */
-export interface StableCekDeps {
-    /** The collection's per-record CEK cache (`null` → no caching). */
-    readonly cache: Lru<string, EnclaveKey> | null;
-    /** Read the record's live envelope (to recover an existing `_cek`). */
-    getLive(id: string): Promise<EncryptedEnvelope | null>;
-    /** The DEK the CEK is wrapped under (the collection DEK on the normal path). */
-    getDEK(): Promise<EnclaveKey>;
-}
-/**
- * Resolve the stable CEK for a record on the write path. Caches the resolved
- * key under `id` so an update + its history snapshot share one CEK.
- */
-export declare function resolveStableCek(deps: StableCekDeps, id: string): Promise<EnclaveKey>;
-/** Re-wrapped body bytes + the (optional) CEK to cache. */
-export interface RewrappedBody {
-    readonly _iv: string;
-    readonly _data: string;
-    /** Present iff the source envelope carried a CEK (per-record-key record). */
-    readonly _cek?: string;
-    /** The body key when one exists, so the caller can cache it; `null` for a legacy record. */
-    readonly cek: EnclaveKey | null;
-}
-/**
- * Move a record body from `fromDek`/`from` to `toDek`/`to`.
- *
- * - Per-record-key record (`_cek` present): unwrap the CEK under `fromDek`,
- *   re-encrypt the body under the SAME CEK, re-wrap the CEK under `toDek`. The
- *   body key is unchanged → history-chain identity preserved.
- * - Legacy record (no `_cek`): decrypt under `fromDek`, re-encrypt under `toDek`
- *   directly.
- *
- * ## Why it takes TWO identities (#1041)
- *
- * A rewrap is the one operation where the identity genuinely **changes**. A
- * tier move rewrites `_tier`; a history snapshot lands at a different
- * `(collection, id)` entirely. Since AAD binds both, the body must be opened
- * under the identity it currently has and re-sealed under the one it is moving
- * to. A single identity would be wrong for one end or the other.
- *
- * ⚠️ **This retires an optimisation, deliberately.** Callers used to compute
- * ONE rewrap and reuse the bytes for both a tier move's live write and its
- * `_history` snapshot (#728). Those now have different destination identities,
- * so they need different AAD and therefore different ciphertext — the same
- * bytes cannot satisfy both. Reusing one rewrap for two destinations is now a
- * silent corruption, not a saving: it produces a record that opens at one
- * address and not the other.
- */
-export declare function rewrapBodyToDek(from: RecordIdentity, to: RecordIdentity, envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek' | '_tier' | '_by'>, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<RewrappedBody>;
-/**
- * Merge an ALREADY-rewrapped {@link RewrappedBody} into `envelope`, keeping
- * every field but the re-keyed body (`_iv`/`_data`/`_cek`) unchanged.
- *
- * Body-field access (`_iv`/`_data`/`_cek`) is sanctioned inside the enclave;
- * this lets callers outside it get back a ready-to-store envelope without
- * reading those fields themselves. Takes a body the caller has ALREADY
- * computed (vs. {@link rewrapEnvelope}, which also runs `rewrapBodyToDek`)
- * so a caller building a SECOND envelope from the same rewrap — a tier
- * move's live write AND its pre-move `_history` snapshot, #728 — pays the
- * unwrap/decrypt/encrypt/wrap crypto once, not twice.
- */
-export declare function applyRewrappedBody(envelope: EncryptedEnvelope, body: RewrappedBody): EncryptedEnvelope;
-/**
- * Move a FULL stored envelope from `fromDek` to `toDek`, preserving every
- * field other than the re-keyed body (`_iv`/`_data`/`_cek`) unchanged.
- * Mirrors the spread-merge idiom `with-audit/tiers/index.ts`'s
- * `elevate()`/`demote()` use to apply `rewrapBodyToDek`'s result to the live
- * envelope, generalized to any envelope shape (history callers don't bump
- * `_v`/`_ts`/`_tier` the way a tier move does).
- */
-export declare function rewrapEnvelope(identity: RecordIdentity, envelope: EncryptedEnvelope, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<EncryptedEnvelope>;
-/**
- * Is `envelope` ALREADY wrapped under `dek` (a per-record CEK wrapped under
- * `dek`, or — legacy, no `_cek` — the body itself decryptable under `dek`)?
- *
- * A toDek-first idempotency check for retry-safe rewrap loops (#712 crash
- * atomicity, `with-commit/history/history.ts`'s `rewrapHistory`): a crash
- * mid-rewrap can strand some entries already moved to `toDek` while others
- * remain under `fromDek`. Calling this with `toDek` before attempting the
- * `fromDek` rewrap lets the caller skip an already-migrated entry instead of
- * re-wrapping it (a re-wrap would be a correctness no-op but doubles as an
- * unnecessary write) — and, more importantly, tells a retry loop that this
- * entry needs no `fromDek` unwrap attempt at all, so a crash that landed some
- * entries under `toDek` doesn't wedge on those already-moved entries.
- *
- * AES-KW (CEK unwrap) and AES-GCM (direct decrypt) are both authenticated —
- * unwrap/decrypt under the wrong key throws, never silently returns garbage
- * — so a caught error here reliably means "not wrapped under `dek`", not a
- * corrupt envelope (a genuinely corrupt envelope also throws under the
- * correct key, but callers that reach this helper only do so as a
- * best-effort probe before their own decisive fromDek attempt, which still
- * surfaces real corruption).
- *
- * Body-field access (`_iv`/`_data`/`_cek`) is sanctioned inside the enclave —
- * this is the sanctioned door so callers outside it (history.ts) never read
- * those fields themselves, preserving the check-architecture body-access
- * ratchet.
- */
-export declare function isRewrappedUnder(identity: RecordIdentity, envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>, dek: EnclaveKey): Promise<boolean>;

package/dist/kernel/enclave/record-keys/rekey-blob.d.ts

@@ -1,88 +0,0 @@
-/**
- * Re-key a vault's blob set from an old `_blob` DEK to a new one (#1122).
- *
- * ## The defect this closes
- *
- * `rotateKeys` re-keys `store.list(vault, <slot>)` plus the derived refs
- * `derivedRefsFor` declares. That assumes a DEK slot named `X` protects data
- * filed under collection `X`. For `_blob` it is false: the slot is `_blob`, but
- * every byte it protects lives in `_blob_index` and `_blob_chunks`. So rotating
- * `_blob` minted a fresh DEK, re-encrypted **nothing**, and made every blob in
- * the vault permanently unreadable — reported to the user as `TamperedError`,
- * i.e. as an attack, when it was self-inflicted. An ordinary `revoke` of a
- * whole-vault grantee reaches it, because such a grantee's DEK map contains
- * `_blob`.
- *
- * ## Why this cannot be done by `rekeyEnvelopeIfNeeded` alone
- *
- * Two of the three surfaces do not have the shape that helper assumes:
- *
- * - a **chunk** envelope is sealed over raw bytes under a bespoke AAD
- *   (`{eTag}:{index}:{count}`), not under the record AAD, so the generic
- *   helper cannot open it;
- * - an **index** envelope's body is JSON that may itself carry a wrapped
- *   per-blob content CEK (`_cek` / `_cekPending`). Re-encrypting the body under
- *   the new DEK without re-wrapping that CEK leaves a blob whose metadata opens
- *   and whose bytes never will.
- *
- * ## Why it lives in the enclave
- *
- * It reads and writes protected body slots and it unwraps/re-wraps keys — the
- * two things `enclave-body-only` reserves to `kernel/enclave/**`, and the same
- * reason `rekeyEnvelopeToDek` moved here in #1074. `with-party` orchestrates
- * the rotation and must not touch a body to do it.
- *
- * The blob layout below is duplicated from its owner rather than imported:
- * `with-shape/blobs/blob-set.ts` already imports `with-party/team/tiers.js`, so
- * a `with-party → with-shape` import would close a cycle, and the kernel may
- * not depend on a service. `BlobObject` itself is a kernel type, so only the
- * three collection/id string layouts are copied, with their owner named.
- *
- * @packageDocumentation
- */
-import { type EnclaveKey } from '../crypto.js';
-import type { NoydbStore } from '../../types.js';
-/**
- * What a rotation did to the blob set.
- *
- * Deliberately NOT on the enclave barrel: no caller outside this module binds
- * it, and that surface is the fork-swap trust boundary, so exporting a type
- * nobody consumes is pure widening.
- *
- * It is a return value rather than a log line because `foreign` and `blobs`
- * are the only way to tell "left alone, correctly" from "left alone, because
- * the caller passed a wrong `otherDeks` set". Both re-key nothing and both
- * return successfully. `rotate-preserves-blobs.test.ts` asserts these counts
- * against a direct call for exactly that reason.
- */
-export interface BlobRekeyReport {
-    /** Index envelopes moved onto the new DEK. */
-    readonly blobs: number;
-    /** Chunk envelopes re-encrypted under the new DEK. */
-    readonly chunks: number;
-    /**
-     * Index envelopes left alone because they open under a DEK the caller holds
-     * for a DIFFERENT slot — an elevated blob, sealed under `_blob#<tier>`. Those
-     * are that slot's rotation to do, not this one's.
-     */
-    readonly foreign: number;
-    /** Index envelopes already under the new DEK — a resumed rotation. */
-    readonly alreadyMoved: number;
-}
-/**
- * Move every blob sealed under `oldDek` onto `newDek`.
- *
- * Chunks are re-encrypted BEFORE their index entry is re-sealed, and that order
- * is the resume property: an index entry still readable under `oldDek` means
- * its chunks may be half-moved (each one is probed individually), and an index
- * entry readable under `newDek` means its chunks are already done. An
- * interrupted rotation is finished by re-running it with the same `newDek`.
- *
- * `otherDeks` is what keeps a tier-elevated blob from being mistaken for a
- * damaged one. Membership in `_blob_index` is by DEK, not by collection name:
- * a record elevated to tier N has its blob metadata sealed under `_blob#N`. An
- * envelope that opens under NONE of the keys the caller holds is genuinely
- * unreadable and throws, exactly as `rekeyEnvelopeIfNeeded` does — silently
- * walking past it would turn a loud failure into permanent quiet loss.
- */
-export declare function rekeyBlobSet(adapter: NoydbStore, vault: string, oldDek: EnclaveKey, newDek: EnclaveKey, otherDeks?: readonly EnclaveKey[]): Promise<BlobRekeyReport>;