@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/{chunk-3EWS67C7.js → chunk-4TG2ITRW.js}

@@ -1,7 +1,7 @@
 import {
   FieldNotQueryableError,
   ValidationError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/kernel/via/pipeline.ts
 var ViaPipeline = class _ViaPipeline {
@@ -458,4 +458,4 @@ export {
   EXPORT_REDACTION_MARKER,
   exportRedact
 };
-//# sourceMappingURL=chunk-3EWS67C7.js.map
+//# sourceMappingURL=chunk-4TG2ITRW.js.map

package/dist/{chunk-HS554XAF.js → chunk-5HQFROZS.js}

@@ -1,6 +1,6 @@
 import {
   OverlayIdMismatchError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-formula/overlay-views/virtual-collection.ts
 var OverlayedCollection = class {
@@ -206,4 +206,4 @@ var OverlayedCollection = class {
 export {
   OverlayedCollection
 };
-//# sourceMappingURL=chunk-HS554XAF.js.map
+//# sourceMappingURL=chunk-5HQFROZS.js.map

package/dist/{chunk-IUBMZPHM.js → chunk-5ZVE3N5C.js}

@@ -1,17 +1,17 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-IMQKWR46.js";
+} from "./chunk-R2ZULFXU.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-EJLV62NI.js";
+} from "./chunk-KN4LUMH6.js";
 import {
   buildRecordEnvelope
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   NoydbError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-audit/portability/request-withdrawal.ts
 var WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
@@ -151,11 +151,10 @@ async function rejectWithdrawal(vault, requestId, opts = {}) {
 }
 
 export {
-  WITHDRAWAL_REQUESTS_COLLECTION,
   WithdrawalRequestError,
   requestWithdrawal,
   listWithdrawalRequests,
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-IUBMZPHM.js.map
+//# sourceMappingURL=chunk-5ZVE3N5C.js.map

package/dist/chunk-5ZVE3N5C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/portability/request-withdrawal.ts"],"sourcesContent":["/**\n * Two-party withdrawal ceremony.\n *\n * The conservative counterpart to `unilateralWithdrawal`: a non-owner —\n * including a read-only `client`/`viewer` who cannot self-serve a deletion —\n * files a durable REQUEST; an owner/admin reviews it and either APPROVES\n * (extract-and-dispose under firm authority) or REJECTS it. Every step is\n * audited in the tamper-evident ledger.\n *\n *   requester:  vault.user.requestWithdrawal({ scope, disposition?, legalBasis? })\n *   owner:      vault.user.listWithdrawalRequests()\n *               vault.user.approveWithdrawal(requestId, { reKey })  → { bundle, snapshot? }\n *               vault.user.rejectWithdrawal(requestId, { reason })\n *\n * Requests live in the reserved `_user_withdrawal_requests` namespace. The\n * record body is plaintext metadata (collection names + disposition + legal\n * basis — none secret in this trust model; the owner sees the data anyway) and\n * carries NO secret: the re-key secret is supplied by the approver at\n * approval time and conveyed to the requester out-of-band, so no secret is\n * stored at rest.\n */\nimport type { Vault } from '../../kernel/vault.js'\nimport { buildRecordEnvelope } from '../../capsule/index.js'\nimport { NoydbError } from '../../kernel/errors.js'\nimport { resolveAccessibleCollections, buildAccessibleBundle } from './export-accessible.js'\nimport { freezeAndDeleteClosure, randomId, type FrozenSnapshotRef, type WithdrawResult } from './withdraw-accessible.js'\n\nconst WITHDRAWAL_REQUESTS_COLLECTION = '_user_withdrawal_requests'\n\n/** Raised when a request is missing, already decided, or expired. */\nexport class WithdrawalRequestError extends NoydbError {\n  constructor(message: string) {\n    super('WITHDRAWAL_REQUEST', message)\n    this.name = 'WithdrawalRequestError'\n  }\n}\n\nexport type WithdrawalRequestStatus = 'pending' | 'approved' | 'rejected'\n\nexport interface WithdrawalRequest {\n  readonly requestId: string\n  readonly requester: string\n  readonly collections: readonly string[]\n  readonly disposition: 'delete' | 'freeze'\n  readonly legalBasis?: string\n  readonly status: WithdrawalRequestStatus\n  readonly requestedAt: string\n  readonly expiresAt?: string\n  readonly decidedAt?: string\n  readonly decidedBy?: string\n  readonly rejectReason?: string\n  readonly snapshotSha256?: string\n}\n\nexport interface RequestWithdrawalOptions {\n  readonly scope?: { readonly collections?: readonly string[] }\n  readonly disposition?: 'delete' | 'freeze'\n  readonly legalBasis?: string\n  /** Time-to-live in ms; after this the request can no longer be approved. */\n  readonly expiresInMs?: number\n}\n\nexport interface RequestWithdrawalResult {\n  readonly requestId: string\n  readonly status: WithdrawalRequestStatus\n  readonly expiresAt?: string\n}\n\nfunction writeRequest(vault: Vault, req: WithdrawalRequest, expectedVersion: number): Promise<void> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const body = JSON.stringify(req)\n  const actor = req.decidedBy ?? req.requester\n  const env = buildRecordEnvelope(\n    { collection: WITHDRAWAL_REQUESTS_COLLECTION, id: req.requestId, by: actor, version: expectedVersion + 1 },\n    { ts: req.decidedAt ?? req.requestedAt, iv: '', data: body},\n  )\n  return adapter.put(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, req.requestId, env, expectedVersion)\n}\n\nasync function readRequest(vault: Vault, requestId: string): Promise<{ req: WithdrawalRequest; version: number }> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, requestId)\n  if (!env) throw new WithdrawalRequestError(`withdrawal request \"${requestId}\" not found`)\n  return { req: JSON.parse(env._data ?? '') as WithdrawalRequest, version: env._v }\n}\n\n/**\n * Requester side. Files a durable request for the caller's accessible scope.\n * Gated by `user-request-withdrawal` (checked in the UserApi wrapper).\n */\nexport async function requestWithdrawal(\n  vault: Vault,\n  opts: RequestWithdrawalOptions = {},\n): Promise<RequestWithdrawalResult> {\n  const { keyring } = vault._introspectState()\n  // Resolve the requester's accessible collections (read access defines \"theirs\";\n  // the owner — who can delete anything — executes the disposition on approval).\n  const collections = resolveAccessibleCollections(keyring, opts.scope, false)\n  if (!collections || collections.length === 0) {\n    throw new WithdrawalRequestError(\n      'requestWithdrawal needs a concrete scope.collections (the caller has all-collection access — name the collections to withdraw)',\n    )\n  }\n  const requestId = `wr-${randomId()}`\n  const requestedAt = new Date().toISOString()\n  const req: WithdrawalRequest = {\n    requestId, requester: keyring.userId, collections, disposition: opts.disposition ?? 'delete',\n    status: 'pending', requestedAt,\n    ...(opts.legalBasis ? { legalBasis: opts.legalBasis } : {}),\n    ...(opts.expiresInMs ? { expiresAt: new Date(Date.parse(requestedAt) + opts.expiresInMs).toISOString() } : {}),\n  }\n  await writeRequest(vault, req, 0) // create-only\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: keyring.userId, payloadHash: '',\n    reason: `user-withdrawal-request:${requestId}:${keyring.userId}`,\n  })\n  return { requestId, status: 'pending', ...(req.expiresAt ? { expiresAt: req.expiresAt } : {}) }\n}\n\n/** Owner side. List filed requests (optionally by status). */\nexport async function listWithdrawalRequests(\n  vault: Vault,\n  opts: { status?: WithdrawalRequestStatus } = {},\n): Promise<WithdrawalRequest[]> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const ids = await adapter.list(vaultName, WITHDRAWAL_REQUESTS_COLLECTION)\n  const out: WithdrawalRequest[] = []\n  for (const id of ids) {\n    const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, id)\n    if (!env) continue\n    const req = JSON.parse(env._data ?? '') as WithdrawalRequest\n    if (!opts.status || req.status === opts.status) out.push(req)\n  }\n  return out\n}\n\nfunction assertApprover(vault: Vault): string {\n  const { keyring } = vault._introspectState()\n  // FR-6: custodian is INTENTIONALLY excluded (SAFER default — review flag).\n  // Approving a two-party withdrawal is a destructive extract-and-dispose\n  // exercised under FIRM authority — a governance act adjacent to grant/revoke,\n  // which a non-owning custodian cannot do. It stays owner/admin-only.\n  if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n    throw new WithdrawalRequestError('approveWithdrawal / rejectWithdrawal require an owner or admin')\n  }\n  return keyring.userId\n}\n\nfunction assertPending(req: WithdrawalRequest): void {\n  if (req.status !== 'pending') {\n    throw new WithdrawalRequestError(`withdrawal request \"${req.requestId}\" is already ${req.status}`)\n  }\n  if (req.expiresAt && Date.now() > Date.parse(req.expiresAt)) {\n    throw new WithdrawalRequestError(`withdrawal request \"${req.requestId}\" expired at ${req.expiresAt}`)\n  }\n}\n\nexport interface ApproveWithdrawalOptions {\n  /** Re-key the handed-back bundle to a secret the requester will use. */\n  readonly reKey?: { readonly secret: string }\n}\n\n/**\n * Owner side. Extract the requester's recorded scope under firm authority,\n * dispose of the source per the request's disposition, mark the request\n * approved, and return the re-keyed bundle to hand back. Gated by\n * `approve-user-withdrawal` (checked in the UserApi wrapper) + owner/admin role.\n */\nexport async function approveWithdrawal(\n  vault: Vault,\n  requestId: string,\n  opts: ApproveWithdrawalOptions = {},\n): Promise<WithdrawResult> {\n  const approver = assertApprover(vault)\n  const { req, version } = await readRequest(vault, requestId)\n  assertPending(req)\n\n  // 1. Produce the requester's re-keyed portable copy FIRST (owner authority\n  //    holds every DEK, so the recorded collections are all readable).\n  const bundle = await buildAccessibleBundle(vault, [...req.collections], opts.reKey)\n\n  // 2. + 3. dispose of the source (freeze snapshot, optional → delete-closure).\n  const snapshot: FrozenSnapshotRef | undefined = await freezeAndDeleteClosure(vault, req.collections, {\n    disposition: req.disposition, actorUserId: approver, withdrawalId: `wd-${requestId}`,\n  })\n\n  // 4. mark approved + audit (OCC against the version we read).\n  const decidedAt = new Date().toISOString()\n  await writeRequest(vault, {\n    ...req, status: 'approved', decidedAt, decidedBy: approver,\n    ...(snapshot ? { snapshotSha256: snapshot.sha256 } : {}),\n  }, version)\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: approver, payloadHash: '',\n    reason: `user-withdrawal-approved:${requestId}:${req.requester}:${req.disposition}`,\n  })\n\n  return snapshot ? { bundle, snapshot } : { bundle }\n}\n\nexport interface RejectWithdrawalOptions {\n  readonly reason?: string\n}\n\n/** Owner side. Decline a pending request (no data is touched). */\nexport async function rejectWithdrawal(\n  vault: Vault,\n  requestId: string,\n  opts: RejectWithdrawalOptions = {},\n): Promise<WithdrawalRequest> {\n  const approver = assertApprover(vault)\n  const { req, version } = await readRequest(vault, requestId)\n  assertPending(req)\n  const decidedAt = new Date().toISOString()\n  const updated: WithdrawalRequest = {\n    ...req, status: 'rejected', decidedAt, decidedBy: approver,\n    ...(opts.reason ? { rejectReason: opts.reason } : {}),\n  }\n  await writeRequest(vault, updated, version)\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: approver, payloadHash: '',\n    reason: `user-withdrawal-rejected:${requestId}:${req.requester}`,\n  })\n  return updated\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA2BA,IAAM,iCAAiC;AAGhC,IAAM,yBAAN,cAAqC,WAAW;AAAA,EACrD,YAAY,SAAiB;AAC3B,UAAM,sBAAsB,OAAO;AACnC,SAAK,OAAO;AAAA,EACd;AACF;AAiCA,SAAS,aAAa,OAAc,KAAwB,iBAAwC;AAClG,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,QAAM,QAAQ,IAAI,aAAa,IAAI;AACnC,QAAM,MAAM;AAAA,IACV,EAAE,YAAY,gCAAgC,IAAI,IAAI,WAAW,IAAI,OAAO,SAAS,kBAAkB,EAAE;AAAA,IACzG,EAAE,IAAI,IAAI,aAAa,IAAI,aAAa,IAAI,IAAI,MAAM,KAAI;AAAA,EAC5D;AACA,SAAO,QAAQ,IAAI,WAAW,gCAAgC,IAAI,WAAW,KAAK,eAAe;AACnG;AAEA,eAAe,YAAY,OAAc,WAAyE;AAChH,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gCAAgC,SAAS;AAClF,MAAI,CAAC,IAAK,OAAM,IAAI,uBAAuB,uBAAuB,SAAS,aAAa;AACxF,SAAO,EAAE,KAAK,KAAK,MAAM,IAAI,SAAS,EAAE,GAAwB,SAAS,IAAI,GAAG;AAClF;AAMA,eAAsB,kBACpB,OACA,OAAiC,CAAC,GACA;AAClC,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAG3C,QAAM,cAAc,6BAA6B,SAAS,KAAK,OAAO,KAAK;AAC3E,MAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,MAAM,SAAS,CAAC;AAClC,QAAM,eAAc,oBAAI,KAAK,GAAE,YAAY;AAC3C,QAAM,MAAyB;AAAA,IAC7B;AAAA,IAAW,WAAW,QAAQ;AAAA,IAAQ;AAAA,IAAa,aAAa,KAAK,eAAe;AAAA,IACpF,QAAQ;AAAA,IAAW;AAAA,IACnB,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IACzD,GAAI,KAAK,cAAc,EAAE,WAAW,IAAI,KAAK,KAAK,MAAM,WAAW,IAAI,KAAK,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC;AAAA,EAC9G;AACA,QAAM,aAAa,OAAO,KAAK,CAAC;AAChC,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,QAAQ;AAAA,IAAQ,aAAa;AAAA,IACzF,QAAQ,2BAA2B,SAAS,IAAI,QAAQ,MAAM;AAAA,EAChE,CAAC;AACD,SAAO,EAAE,WAAW,QAAQ,WAAW,GAAI,IAAI,YAAY,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC,EAAG;AAChG;AAGA,eAAsB,uBACpB,OACA,OAA6C,CAAC,GAChB;AAC9B,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,MAAM,MAAM,QAAQ,KAAK,WAAW,8BAA8B;AACxE,QAAM,MAA2B,CAAC;AAClC,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gCAAgC,EAAE;AAC3E,QAAI,CAAC,IAAK;AACV,UAAM,MAAM,KAAK,MAAM,IAAI,SAAS,EAAE;AACtC,QAAI,CAAC,KAAK,UAAU,IAAI,WAAW,KAAK,OAAQ,KAAI,KAAK,GAAG;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAsB;AAC5C,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAK3C,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI,uBAAuB,gEAAgE;AAAA,EACnG;AACA,SAAO,QAAQ;AACjB;AAEA,SAAS,cAAc,KAA8B;AACnD,MAAI,IAAI,WAAW,WAAW;AAC5B,UAAM,IAAI,uBAAuB,uBAAuB,IAAI,SAAS,gBAAgB,IAAI,MAAM,EAAE;AAAA,EACnG;AACA,MAAI,IAAI,aAAa,KAAK,IAAI,IAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC3D,UAAM,IAAI,uBAAuB,uBAAuB,IAAI,SAAS,gBAAgB,IAAI,SAAS,EAAE;AAAA,EACtG;AACF;AAaA,eAAsB,kBACpB,OACA,WACA,OAAiC,CAAC,GACT;AACzB,QAAM,WAAW,eAAe,KAAK;AACrC,QAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,YAAY,OAAO,SAAS;AAC3D,gBAAc,GAAG;AAIjB,QAAM,SAAS,MAAM,sBAAsB,OAAO,CAAC,GAAG,IAAI,WAAW,GAAG,KAAK,KAAK;AAGlF,QAAM,WAA0C,MAAM,uBAAuB,OAAO,IAAI,aAAa;AAAA,IACnG,aAAa,IAAI;AAAA,IAAa,aAAa;AAAA,IAAU,cAAc,MAAM,SAAS;AAAA,EACpF,CAAC;AAGD,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,aAAa,OAAO;AAAA,IACxB,GAAG;AAAA,IAAK,QAAQ;AAAA,IAAY;AAAA,IAAW,WAAW;AAAA,IAClD,GAAI,WAAW,EAAE,gBAAgB,SAAS,OAAO,IAAI,CAAC;AAAA,EACxD,GAAG,OAAO;AACV,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO;AAAA,IAAU,aAAa;AAAA,IACnF,QAAQ,4BAA4B,SAAS,IAAI,IAAI,SAAS,IAAI,IAAI,WAAW;AAAA,EACnF,CAAC;AAED,SAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,EAAE,OAAO;AACpD;AAOA,eAAsB,iBACpB,OACA,WACA,OAAgC,CAAC,GACL;AAC5B,QAAM,WAAW,eAAe,KAAK;AACrC,QAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,YAAY,OAAO,SAAS;AAC3D,gBAAc,GAAG;AACjB,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,UAA6B;AAAA,IACjC,GAAG;AAAA,IAAK,QAAQ;AAAA,IAAY;AAAA,IAAW,WAAW;AAAA,IAClD,GAAI,KAAK,SAAS,EAAE,cAAc,KAAK,OAAO,IAAI,CAAC;AAAA,EACrD;AACA,QAAM,aAAa,OAAO,SAAS,OAAO;AAC1C,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO;AAAA,IAAU,aAAa;AAAA,IACnF,QAAQ,4BAA4B,SAAS,IAAI,IAAI,SAAS;AAAA,EAChE,CAAC;AACD,SAAO;AACT;","names":[]}

package/dist/{chunk-PP3K67AJ.js → chunk-654RE5YC.js}

@@ -6,10 +6,10 @@ import {
 } from "./chunk-VYYM3MEN.js";
 import {
   derivePersistedSchema
-} from "./chunk-747G6CT3.js";
+} from "./chunk-UORWAG7K.js";
 import {
   loadPersistedSchema
-} from "./chunk-3L2NBKDR.js";
+} from "./chunk-IF2M43G4.js";
 
 // src/with-shape/introspection/walk.ts
 var INTERNAL_PREFIX = "_";
@@ -268,4 +268,4 @@ function summariseAggregateOp(value) {
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=chunk-PP3K67AJ.js.map
+//# sourceMappingURL=chunk-654RE5YC.js.map

package/dist/{chunk-FOEDQATO.js → chunk-66GD7XXU.js}

@@ -1,6 +1,6 @@
 import {
   CollectionNotHydratedError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/kernel/query/hydration.ts
 var INSPECT = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
@@ -50,4 +50,4 @@ function gateTerminal(gate, terminal, compute) {
 export {
   gateTerminal
 };
-//# sourceMappingURL=chunk-FOEDQATO.js.map
+//# sourceMappingURL=chunk-66GD7XXU.js.map

package/dist/{chunk-BNWA3WG5.js → chunk-72FQ46VW.js}

@@ -2,10 +2,10 @@ import {
   CURRENT_COST_BYTE,
   iterationsForCostByte,
   mintAt
-} from "./chunk-EZOAKKTB.js";
+} from "./chunk-MBPZMZVB.js";
 import {
   normalizeForVerify
-} from "./chunk-QMWY2FDS.js";
+} from "./chunk-THQ3BHLM.js";
 
 // src/capsule/enclave-aes/classify/find.ts
 async function computeBidxTarget(candidate, normalize, dek, collection, field, costByte) {
@@ -19,4 +19,4 @@ async function computeBidxTarget(candidate, normalize, dek, collection, field, c
 export {
   computeBidxTarget
 };
-//# sourceMappingURL=chunk-BNWA3WG5.js.map
+//# sourceMappingURL=chunk-72FQ46VW.js.map

package/dist/{chunk-EYG2CY2X.js → chunk-7JPA3LIH.js}

@@ -4,27 +4,27 @@ import {
   resolveLegOwner,
   ungatedMvContext,
   wrapDbWithPredicates
-} from "./chunk-JIBUPZHA.js";
+} from "./chunk-ZNEKQFGF.js";
 import {
   canonicalizeMoneyFieldsAsDecimal,
   decodeMoneyFields,
   exactMath
-} from "./chunk-BPWYQ25R.js";
+} from "./chunk-7Q6IU3R7.js";
 import {
   applyWindow
-} from "./chunk-O46CHQT7.js";
+} from "./chunk-MAQBYBUX.js";
 import {
   groupAndReduce
-} from "./chunk-N7UDP5VU.js";
+} from "./chunk-SCH2F7R2.js";
 import {
   putDerivedOutput
-} from "./chunk-MILI22XQ.js";
+} from "./chunk-ZZZ4VCY2.js";
 import {
   canonicalGroupKey
 } from "./chunk-XZHEOSQ2.js";
 import {
   bindDistinctReducers
-} from "./chunk-MBMTND6D.js";
+} from "./chunk-AGGPT4UE.js";
 import {
   groupKeyName,
   isDateTruncKey,
@@ -32,19 +32,19 @@ import {
 } from "./chunk-XBKH4FOC.js";
 import {
   DEFAULT_JOIN_MAX_ROWS
-} from "./chunk-NCO25JZO.js";
+} from "./chunk-VP37VUKQ.js";
 import {
   applyI18nLocale
-} from "./chunk-OKSTSITU.js";
+} from "./chunk-PR7ILCIH.js";
 import {
   viaBinder
-} from "./chunk-SYNY3VB5.js";
+} from "./chunk-NCTN2FW4.js";
 import {
   JoinTooLargeError,
   LocaleNotSpecifiedError,
   MaterializedViewConfigError,
   MaterializedViewTooLargeError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-formula/materialized-views/window-stage.ts
 function isWindowFn(v) {
@@ -449,4 +449,4 @@ async function listOutputIds(outputColl) {
 export {
   MaterializedViewExecutor
 };
-//# sourceMappingURL=chunk-EYG2CY2X.js.map
+//# sourceMappingURL=chunk-7JPA3LIH.js.map

package/dist/chunk-7JPA3LIH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/materialized-views/window-stage.ts","../src/with-formula/materialized-views/emit-memo.ts","../src/with-formula/materialized-views/executor.ts"],"sourcesContent":["/**\n * #1411 — the declared window stage of a materialized view.\n *\n * `unionSources` → `map` → `groupBy` → `aggregate` → **`window`** → `derive`.\n *\n * ## Why a window is safe here when `derive` is deliberately single-row\n *\n * `derive`'s contract is *pure, single-row, no cross-row access* — a window is\n * the opposite of all three. The difference is not caution, it is that\n * materialization is a FULL RECOMPUTE: the executor holds every row the view\n * will store, in one array, before it writes any of them. So an\n * order-dependent, cross-row pass runs exactly once over exactly the rows that\n * get stored, and its output is then an ordinary column. A per-row recompute\n * could not do this — inserting a row early in a partition moves every later\n * row's running total.\n *\n * ## Why this does not simply call `applyWindow`\n *\n * ⚠️ `applyWindow` does no Via rewriting. On the ad-hoc builder,\n * `Query.window().select()` rewrites reducer slots through the COLLECTION's\n * Via pipeline first, which is what makes `runningMoneySum` exact. A UNION-mode\n * MV has no collection — its rows are MAPPED — so it has the same answer\n * `aggregate` already uses: the MV's own `moneyFields` descriptors, bound\n * through the kernel's Via port. This mirrors `groupAndReduce`'s money block\n * line for line, deliberately: two places that must agree about what a money\n * reducer is, doing it the same way.\n *\n * Without that rewrite the failure is silent and specific — a running total\n * over decimal strings accumulates in float and returns\n * `0.6000000000000001` where the aggregate on the same rows returns `'0.60'`.\n */\nimport { applyWindow } from '../../with-lookup/reduce/window.js'\nimport type { WindowSelectSpec, WindowSpec } from '../../with-lookup/reduce/window.js'\nimport { bindDistinctReducers } from '../../with-lookup/reduce/reducers.js'\nimport type { Reducer } from '../../with-lookup/reduce/reducers.js'\nimport type { ReduceSpec } from '../../with-lookup/reduce/reduction.js'\nimport { viaBinder } from '../../kernel/via/index.js'\nimport type { MaterializedViewWindow, MoneyDescriptorMap } from './types.js'\n\n/** Is this slot a window function rather than a reducer? */\nfunction isWindowFn(v: unknown): boolean {\n  return typeof v === 'object' && v !== null && (v as { __window?: unknown }).__window === true\n}\n\n/**\n * Apply a declared window to the finished row set.\n *\n * `moneyFields` is the MV's own descriptor map; when present, every REDUCER\n * slot is rewritten exactly as `aggregate`'s are. Window functions\n * (`rowNumber`, `rank`, `lag`, `lead`) are passed through untouched — they\n * navigate rows rather than accumulate values, so there is nothing to make\n * exact.\n */\nexport function applyDeclaredWindow(\n  rows: readonly Record<string, unknown>[],\n  window: MaterializedViewWindow,\n  moneyFields?: MoneyDescriptorMap,\n): ReadonlyArray<Record<string, unknown>> {\n  if (rows.length === 0) return rows\n\n  let select: WindowSelectSpec = window.select\n  if (moneyFields) {\n    const reducersOnly: Record<string, Reducer<unknown, unknown>> = {}\n    for (const [k, v] of Object.entries(select)) {\n      if (!isWindowFn(v)) reducersOnly[k] = v as Reducer<unknown, unknown>\n    }\n    if (Object.keys(reducersOnly).length > 0) {\n      const binding = viaBinder('money')({ moneyFields })\n      let wrapped = binding.wrapReducers!(reducersOnly as ReduceSpec) as Record<\n        string,\n        Reducer<unknown, unknown>\n      >\n      wrapped = bindDistinctReducers(wrapped as ReduceSpec, {\n        canonicalizeIndexKey: (f, v) => binding.canonicalizeIndexKey?.(f, v),\n      }) as Record<string, Reducer<unknown, unknown>>\n      select = { ...select, ...wrapped }\n    }\n  }\n\n  // `applyWindow` takes the partition/order spec and the select list\n  // separately, so strip `select` off rather than pass it twice. Built by\n  // spreading absent keys away rather than assigning `undefined` — the package\n  // compiles under `exactOptionalPropertyTypes`, where the two differ.\n  const spec: WindowSpec = {\n    ...(window.partitionBy !== undefined && { partitionBy: window.partitionBy }),\n    ...(window.orderBy !== undefined && { orderBy: window.orderBy }),\n  }\n  return applyWindow<Record<string, unknown>>(rows, spec, select)\n}\n","/**\n * Skip re-writing materialized-view output rows whose content has not changed\n * (#1418).\n *\n * `MaterializedViewExecutor.refresh()` recomputes the whole view and then\n * writes EVERY output row, on every source write. Measured on one MV with a\n * single union arm, writing rows the MV's own `map` drops:\n *\n *     250 receipts / 250 bills   →  23.0 ms per source write\n *     450 receipts / 450 bills   →  41.6 ms per source write\n *\n * 1.8x the sources, 1.8x the cost — because the thing that grew was the OUTPUT\n * ROW COUNT, and each row is an encrypt-and-store round trip. The query and the\n * aggregation are not where the time goes.\n *\n * ## Why this, and not \"skip the refresh when the row maps to nothing\"\n *\n * The issue proposed short-circuiting the refresh when the written row's `map`\n * returns null. That cannot be built as stated, and the reason is worth\n * recording so nobody re-attempts it:\n *\n *  1. `materializeUnionResult` feeds `map` rows from `coll.query().toArray()`,\n *     which applies `decodeVia` — money arrives as a canonical decimal string,\n *     not the stored scaled integer. Probing `arm.map(writtenRecord)` at\n *     dispatch time hands `map` a DIFFERENTLY SHAPED row, so any `map` that\n *     filters on a money field can answer `null` where the real pipeline would\n *     not. The view then silently stops updating, which is far worse than the\n *     latency it was meant to fix.\n *  2. Skipping also requires that the row contributed nothing BEFORE, or an\n *     update that removes a row from the view is dropped. The prior record is\n *     not passed to the dispatcher, and is a stored record, so it hits (1)\n *     twice over.\n *  3. An arm with `join` legs has the right side attached before `map` runs, so\n *     a probe would have to resolve the legs too.\n *\n * Comparing the row we are ABOUT to write against the row we LAST wrote sides\n * steps all three. It needs no prior record, it is form-agnostic (query, union\n * and projection all benefit), and it degrades to the right thing: a write that\n * changes one group rewrites one row instead of all of them.\n *\n * ## Why the entries are canonical strings and not short hashes\n *\n * A hash collision here means a row that is never rewritten — a silently stale\n * view with no symptom. At the 20k-row cap below, an 8-byte hash carries a\n * couple of percent chance of one collision somewhere, which is not a trade\n * worth making for memory. So entries hold the full canonical string, and\n * memory is bounded by refusing to memoize a view larger than the cap.\n *\n * ## Why a mutation stamp, and what it does NOT cover\n *\n * The memo is only sound while nothing else writes the output collection —\n * tombstoning, `invalidateMVAtRest`, forget/erase and sync cut-over all can. So\n * a refresh records the output collection's mutation stamp AFTER its writes,\n * and the next refresh discards the whole set unless the stamp is still where\n * it left it. That is a \"nobody else touched this\" test rather than an\n * enumeration of writers — the same reasoning that made #1417's keyset memo and\n * #1426's slot guard safe, and it does not rot when a new writer is added.\n *\n * ⚠️ It covers writers that go THROUGH the output `Collection`. A writer that\n * bypasses it and edits the store directly moves neither the stamp nor the\n * collection's own cache — but such a writer already makes `list()` on that\n * collection wrong, so it is a broader defect than this memo.\n *\n * ## ⛔ There is no explicit drop, and that is the design (#59)\n *\n * Invalidation is BY STAMP, in both directions: `readEmitMemo` deletes a memo\n * whose stamp no longer matches, and `writeEmitMemo` deletes rather than store\n * one it cannot trust (`null` stamp, or over the row cap). A refresh that\n * throws midway has already written some rows, so the output collection's\n * stamp has moved and the next read drops the memo itself; a row that failed,\n * was declined or was tombstoned is simply absent from `emitted` and is written\n * again (`executor.ts`, \"Record the stamp AFTER every write and tombstone\").\n *\n * So there is no invalidation path the stamp guard does not already cover. A\n * `dropEmitMemo(key)` hook existed until #59 and was called by nothing for\n * exactly that reason — do not re-add one without first naming the path that\n * leaves a stale memo behind.\n *\n * ## ⛔ The memo stands down when a REDUNDANT write is still observable\n *\n * `Collection._cacheStamp` returns `null` — no memo — whenever writing the same\n * bytes again would have an effect beyond the stored bytes. This is the half\n * that is easy to get wrong, and it was found by a failing test rather than by\n * reasoning, so the cases are recorded:\n *\n *  - **A `beforePut` gate handler.** Measured: with `withPeriods()` and a\n *    closed period, an unchanged MV row previously produced a\n *    `PeriodClosedError` from `put`, which `putDerivedOutput` converts into a\n *    `derivation:skipped-frozen` event and an audit record. Skipping the write\n *    silences that — `written=0 skipped=2 events=0` where the suite expects one\n *    event. A performance change must not quietly narrow a compliance signal.\n *  - **Explicit history.** A put records a version, so skipping changes what\n *    `history()` returns. (Arguably an improvement — 450 identical versions per\n *    source write is not useful — but that is a product call, not this one.)\n *  - **Sync (`onDirty`) and the search index.** Both mark state from the fact\n *    that a write happened, independently of what was written.\n *  - **Lazy mode**, which has no eager cache to stamp.\n *\n * The asymmetry is what makes this the right default: opting out costs the old\n * write path, opting in wrongly changes behaviour with no symptom at all.\n *\n * ⭐ So an MV whose OUTPUT collection carries periods, history, sync or search\n * gets no speedup. That is deliberate, and it is the first thing to check when\n * this fix appears not to help a real workload — the answer is per output\n * collection, not per vault.\n *\n * ⛔ A row is recorded ONLY when the write actually landed. A `putDerivedOutput`\n * that declines (the frozen-period skip) or throws leaves no entry, so the next\n * refresh writes it again rather than believing a row exists that does not.\n *\n * @module\n */\nimport { canonicalizeQueryPlan } from './query-hash.js'\n\n/**\n * Views larger than this are not memoized at all. The memo would otherwise\n * hold a canonical string per row for the process's life, and a view this size\n * is dominated by its write cost in ways one skip cannot rescue.\n */\nconst MAX_MEMOIZED_ROWS = 20_000\n\ninterface EmitMemo {\n  /** The output collection's mutation stamp when this set was written. */\n  readonly stamp: number\n  /** `outputId -> canonical content string` for rows this MV actually wrote. */\n  readonly rows: Map<string, string>\n}\n\nconst memos = new Map<string, EmitMemo>()\n\n/**\n * Identity of one MV's output, per vault — MV names are not globally unique.\n *\n * ⚠️ `\\0` written as the ESCAPE, not as a raw byte. A raw NUL in the source\n * makes git classify the whole file as binary, so it stops diffing and stops\n * being reviewable — caught here by a `Bin 0 -> 8811 bytes` line in a diffstat.\n * The separator itself is right: no vault or collection name can contain one.\n */\nexport function emitMemoKey(vault: string, mvName: string, outputCollection: string): string {\n  return `${vault}\\0${mvName}\\0${outputCollection}`\n}\n\n/**\n * The rows this MV last wrote, or `null` when the memo cannot be trusted —\n * nothing recorded yet, or the output collection moved under us.\n *\n * `stamp` of `null` means the collection cannot supply one (lazy mode), which\n * is treated as \"no memo\" rather than \"unchanged\".\n */\nexport function readEmitMemo(key: string, stamp: number | null): ReadonlyMap<string, string> | null {\n  if (stamp === null) return null\n  const hit = memos.get(key)\n  if (!hit || hit.stamp !== stamp) {\n    // Someone else wrote the output collection. Everything we believed about\n    // its contents is now a guess, so drop all of it rather than reconcile.\n    if (hit) memos.delete(key)\n    return null\n  }\n  return hit.rows\n}\n\n/** Record what this refresh actually left on disk. A `null` stamp records nothing. */\nexport function writeEmitMemo(key: string, stamp: number | null, rows: Map<string, string>): void {\n  if (stamp === null || rows.size > MAX_MEMOIZED_ROWS) {\n    memos.delete(key)\n    return\n  }\n  memos.set(key, { stamp, rows })\n}\n\n/**\n * A canonical string for the row a refresh is about to write, or `null` when no\n * safe one exists.\n *\n * The MV's `queryHash` is folded in so a strategy change rewrites every row\n * even where the projected content happens to match — a row carrying a stale\n * `_materializedFrom.queryHash` is stale by definition (`stale.ts`).\n *\n * `_materializedFrom` itself is excluded: its `materializedAt` moves on every\n * refresh, so including it would make every comparison differ and the memo a\n * pure cost.\n *\n * ⛔ Returns `null` rather than throwing on anything `JSON.stringify` refuses\n * (a `BigInt`, a cycle). Declining to memoize costs the old write; guessing\n * costs a stale view.\n */\nexport function rowContentKey(row: Record<string, unknown>, queryHash: string): string | null {\n  try {\n    // `_materializedFrom` is excluded by rebuilding without it rather than by\n    // destructuring into an unused binding — same result, no dead name.\n    const content: Record<string, unknown> = {}\n    for (const k of Object.keys(row)) {\n      if (k !== '_materializedFrom') content[k] = row[k]\n    }\n    return `${queryHash}\\0${canonicalizeQueryPlan(content)}`\n  } catch {\n    return null\n  }\n}\n\n/** Test seam — the process-wide memo must not leak between test cases. */\nexport function _clearEmitMemos(): void {\n  memos.clear()\n}\n","import { groupKeyName, isDateTruncKey, projectDateTruncKeys, type GroupKey } from '../../kernel/query/reduce/date-trunc.js'\nimport type { Collection } from '../../kernel/collection.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport { MaterializedViewTooLargeError, MaterializedViewConfigError, LocaleNotSpecifiedError, JoinTooLargeError } from '../../kernel/errors.js'\nimport { DEFAULT_JOIN_MAX_ROWS } from '../../kernel/query/relate/join.js'\nimport type { MaterializedFromMeta, MVQueryContext, MaterializedViewSpec, ProjectionJoinLeg } from './types.js'\nimport type { RegisteredMV } from './registry.js'\nimport { wrapDbWithPredicates, ungatedMvContext } from './registry.js'\nimport { groupAndReduce } from '../../with-lookup/reduce/groupby.js'\nimport { applyDeclaredWindow } from './window-stage.js'\nimport { canonicalGroupKey } from '../../with-lookup/reduce/canonical-key.js'\nimport { applyI18nLocale, type I18nTextDescriptor } from '../../via/i18n/core.js'\nimport { canonicalizeMoneyFieldsAsDecimal, decodeMoneyFields } from '../../via/money/normalize.js'\nimport { exactMath } from '../../via/money/exact.js'\nimport { putDerivedOutput, type PutDerivedOutputCtx } from '../../kernel/via/dispatch.js'\nimport { isCollectLeg, resolveLegOwner, type RefLookup } from './projection-legs.js' // #1140\nimport { emitMemoKey, readEmitMemo, writeEmitMemo, rowContentKey } from './emit-memo.js' // #1418\n\n/**\n * Accessor shape passed in from the owning Vault. Mirrors v1's\n * `DerivationStaleAccessor` — provides the per-collection resolver\n * and the active TxContext so refresh writes/tombstones register on\n * `_executed` for rollback symmetry.\n */\nexport interface MVExecutorAccessor {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  getCollection(name: string): Collection<any>\n  getActiveTxContext(): TxContext | null\n  /**\n   * Vault-shaped accessor passed to the MV's `query()` callback at\n   * each refresh. Same instance the registry used at registration\n   * time; threading through the executor lets the refresh path\n   * re-evaluate the closure against the live vault state.\n   */\n  getQueryContext(): MVQueryContext\n  /**\n   * #638 Task 5 — ctx for `putDerivedOutput`'s frozen-period skip+audit. #641: the lazy\n   * resolve-on-read caller (`stale.ts#resolveStaleMVOnRead`) now supplies one too — built at\n   * the `Collection.get()`/`list()` entry point with a `'resolve-on-read'` sentinel id (no\n   * real \"reacting write\" for a read-triggered materialize, mirroring `refreshView()`'s\n   * `'refreshView'` sentinel). Still declared optional here since `MVExecutorAccessor` is a\n   * general shape and a future caller could reasonably omit it.\n   */\n  dispatchCtx?: PutDerivedOutputCtx\n}\n\nexport interface RefreshResult {\n  /** Rows newly written / overwritten. */\n  written: number\n  /**\n   * #1418 — rows whose content was byte-identical to what this MV last wrote,\n   * so the encrypt-and-store round trip was skipped. Counted separately from\n   * `written` on purpose: `written` means \"a row was persisted\", and reporting\n   * a skip as a write would make the two indistinguishable to anyone\n   * diagnosing whether a refresh actually did anything.\n   */\n  skipped: number\n  /** Rows tombstoned via `_internalDelete` (only when `onEmpty: 'delete'`). */\n  deleted: number\n  /** Failed row writes (non-strict mode). */\n  failed: number\n  /** #782/#785 — `outputCollection:id` entries from the tombstone pass whose ownership stamp\n   *  couldn't be decoded under the collection's default DEK (undecodable, mirroring\n   *  `invalidateMVAtRest`'s #776 posture) — ownership UNCONFIRMED. Only populated when\n   *  `onEmpty: 'delete'`. */\n  residueUndecodable: string[]\n  /** #782/#785 — `outputCollection:id` entries that decoded, stamp-matched this MV, but\n   *  `_internalDelete` declined (the #718 tier-elevation gate) — ownership CONFIRMED, a real\n   *  silent survival, surfaced rather than dropped. Only populated when `onEmpty: 'delete'`. */\n  residueDeclined: string[]\n}\n\n/** Default cost ceiling — overridable per-MV via `spec.maxRows`. */\nconst DEFAULT_MAX_ROWS = 100_000\n\n/**\n * Materialize a query terminal that may be a `Query<T>` (call\n * `.toArray()`), an `Reduction<R>` (call `.run()` returning a\n * single object — wrap as a one-row array), or a `GroupedReduction<R>`\n * (call `.run()` returning an array of grouped rows). Branches on\n * available terminal at runtime — no type-discrimination at registration.\n */\nasync function materializeQueryResult(\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  q: any,\n  mvName: string,\n  i18nLocale?: string,\n  i18nFields?: Record<string, I18nTextDescriptor>,\n): Promise<ReadonlyArray<Record<string, unknown>>> {\n  if (typeof q?.toArray === 'function') {\n    // Query<T> — non-aggregate path. `.toArray()` returns Promise<T[]>.\n    return await q.toArray()\n  }\n  if (typeof q?.run === 'function') {\n    // Reduction<R> or GroupedReduction<R>. `.run()` is synchronous\n    // and returns either a single object (Reduction) or an array of\n    // rows (GroupedReduction). Promise.resolve() normalizes both\n    // sync and async (future) variants.\n    // Query-form MV grouping: when the MV declares i18nLocale, pass it +\n    // i18nFields so a GroupedReduction resolves i18n group keys before\n    // bucketing (the Reduction path ignores the extra arg).\n    const runOpts = i18nLocale !== undefined ? { locale: i18nLocale, i18nFields } : undefined\n    const result: unknown = await Promise.resolve(q.run(runOpts))\n    if (Array.isArray(result)) {\n      return result as ReadonlyArray<Record<string, unknown>>\n    }\n    // Single-aggregate result — wrap as one-row array. The consumer's\n    // `rowKey()` should return a stable identity (often a literal\n    // constant like `'total'`) since there's only one row.\n    return [result as Record<string, unknown>]\n  }\n  throw new Error(\n    `MV \"${mvName}\": query() must return a Query<T>, Reduction, or GroupedReduction. ` +\n      `Got something without a .toArray() or .run() terminal.`,\n  )\n}\n\n/**\n * Materialize a UNION-form MV: read every arm's source\n * collection, apply each arm's `map` to project rows into the unified\n * MV row shape, concatenate the mapped streams, then optionally run\n * `groupBy` + `aggregate` over the result.\n *\n * Modes (driven by `spec.groupBy` / `spec.aggregate`):\n *\n *   - No `groupBy` → return the concatenated mapped rows unchanged.\n *   - `groupBy` without `aggregate` → dedupe by composite group key,\n *     keep the first row seen per key (later arms don't overwrite\n *     earlier arms — Map insertion order rules).\n *   - `groupBy` + `aggregate` → delegate to the shared `groupAndReduce`\n *     pipeline used by `Query.groupBy().aggregate()`.\n *\n * Per-arm `map` is the schema-unification boundary; the strategy's\n * `TRow` type parameter enforces that every arm projects into the\n * same shape at compile time.\n *\n * @internal\n */\nasync function materializeUnionResult<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n  db: MVQueryContext,\n): Promise<ReadonlyArray<Record<string, unknown>>> {\n  const unified: TRow[] = []\n  for (const arm of spec.unionSources!) {\n    const coll = db.collection<Record<string, unknown>>(arm.collection)\n    // Optional per-arm FK joins: chain `.join(field, { as, ... })` for\n    // each declared leg before terminating. The aliased right-side\n    // record lands at `sourceRow[leg.as]`, where the arm's `map` reads\n    // it. Cast to `any` because the chained join widens the row type but\n    // the executor treats every row as `Record<string, unknown>` — same\n    // pattern the query-form join path uses.\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    let q: any = coll.query()\n    if (arm.join?.length) {\n      for (const leg of arm.join) {\n        // #1411 — a declared leg is `Query.joinOn()`; a ref leg is `Query.join()`.\n        q = 'on' in leg\n          ? q.joinOn(leg.target, { as: leg.as, on: leg.on, mode: leg.mode, maxRows: leg.maxRows })\n          : q.join(leg.field, { as: leg.as, maxRows: leg.maxRows, strategy: leg.strategy })\n      }\n    }\n    const sourceRows = q.toArray() as ReadonlyArray<Record<string, unknown>>\n    for (const r of sourceRows) {\n      const mapped = arm.map(r)\n      // null / undefined means \"omit this source row\" — skip without\n      // pushing so groupBy/aggregate never see a null entry.\n      if (mapped == null) continue\n      unified.push(mapped)\n    }\n  }\n\n  return finalizeMappedRows(spec, unified)\n}\n\n\n/**\n * #1411 — the window stage, applied at every exit from the grouping tail.\n *\n * A no-op without `spec.window`, so the ungrouped and grouped paths can both\n * call it unconditionally rather than each remembering to.\n */\nfunction applyWindowStage<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n  rows: ReadonlyArray<Record<string, unknown>>,\n): ReadonlyArray<Record<string, unknown>> {\n  if (!spec.window) return rows\n  return applyDeclaredWindow(rows, spec.window, spec.moneyFields)\n}\n\n/**\n * Shared post-map tail for the UNION and projection (#810) forms:\n * optional `groupBy` (+ `aggregate`) over the mapped-row stream.\n * Extracted verbatim from `materializeUnionResult` so both forms feed\n * the identical grouping pipeline — i18n group-key resolution, the\n * object-group-key guard, dedup-without-aggregate, and the shared\n * `groupAndReduce` delegate.\n *\n * @internal\n */\nfunction finalizeMappedRows<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n  unified: TRow[],\n): ReadonlyArray<Record<string, unknown>> {\n  // #1411 — a window with no grouping is a legitimate shape: the pilot's\n  // running total is per-row, not per-bucket. Both exits go through the same\n  // stage so the two cannot drift on whether a window ran.\n  if (!spec.groupBy) return applyWindowStage(spec, unified)\n\n  const groupKeys: readonly GroupKey[] = Array.isArray(spec.groupBy)\n    ? (spec.groupBy as readonly GroupKey[])\n    : [spec.groupBy as GroupKey]\n  const groupFields: readonly string[] = groupKeys.map(groupKeyName)\n\n  // Derived calendar keys (#1350) are bucketed onto the mapped row first, so\n  // every rule below — the i18n resolution, the object-key refusal, the dedup\n  // path and `groupAndReduce` — sees an ordinary stored field.\n  const derivedKeys = groupKeys.filter(isDateTruncKey)\n  if (derivedKeys.length > 0) {\n    unified = projectDateTruncKeys(unified, derivedKeys)\n  }\n\n  // i18n-aware group keys. An `i18nText` group field carries a raw\n  // `{ locale: string }` map, an unstable object key. When `i18nLocale` is\n  // declared (with `i18nFields` describing those fields), resolve the declared\n  // group-key i18n fields to it at the `mv` layer FIRST — the same unified-rows\n  // boundary where money is threaded — so buckets are stable strings and the\n  // `mv`-layer `onMissing` policy fires here.\n  if (spec.i18nLocale !== undefined && spec.i18nFields !== undefined) {\n    const groupI18n: Record<string, I18nTextDescriptor> = {}\n    for (const f of groupFields) {\n      const d = spec.i18nFields[f]\n      if (d !== undefined) groupI18n[f] = d\n    }\n    if (Object.keys(groupI18n).length > 0) {\n      for (let i = 0; i < unified.length; i++) {\n        unified[i] = applyI18nLocale(unified[i] as Record<string, unknown>, groupI18n, spec.i18nLocale, undefined, 'mv') as TRow\n      }\n    }\n  }\n  // Guard (always): a remaining object-valued group key — an undeclared i18n\n  // field or a locale-less MV — would bucket on a map. Refuse, don't bucket wrong.\n  for (const f of groupFields) {\n    for (const row of unified) {\n      const v = (row as Record<string, unknown>)[f]\n      if (v !== null && typeof v === 'object') {\n        throw new LocaleNotSpecifiedError(\n          f,\n          `Materialized view \"${spec.name}\" groups by \"${f}\", whose value is a raw i18n locale map — ` +\n            `an unstable object group key. Declare { i18nLocale, i18nFields } on the MV to resolve it at ` +\n            `the 'mv' layer, or group by a dictKey/staticDict code (the stable key) and resolve the label at read time.`,\n        )\n      }\n    }\n  }\n\n  // groupBy without aggregate — dedupe by composite key, keep first\n  // seen row per key. Useful for cross-arm uniqueness (e.g. unify two\n  // sibling collections, keeping one row per natural key).\n  if (!spec.aggregate) {\n    const seen = new Map<string, TRow>()\n    for (const row of unified) {\n      const k = canonicalGroupKey(groupFields, row as Record<string, unknown>)\n      if (!seen.has(k)) seen.set(k, row)\n    }\n    return [...seen.values()]\n  }\n\n  // groupBy + aggregate — delegate to the shared pipeline used by\n  // `Query.groupBy().aggregate()`. Result rows carry each grouped\n  // field in declaration order followed by the spec's reducer outputs.\n  return applyWindowStage(\n    spec,\n    groupAndReduce<Record<string, unknown>>(unified, groupFields, spec.aggregate, spec.moneyFields),\n  )\n}\n\n/**\n * Apply the spec's `derive` to each finished row (#1007).\n *\n * Three rules, all of them about keeping the hook narrow enough that the\n * engine never has to reason about the function:\n *\n *  - a `null` / `undefined` return leaves the row untouched;\n *  - a returned key that collides with a `groupBy` field is refused — group\n *    keys are the row's identity and feed `rowKey`, so letting `derive`\n *    rewrite one would silently re-home the row into a different bucket than\n *    the one it was aggregated for;\n *  - a derived field declared in `moneyFields` is quantised through its\n *    descriptor, so the stored value is exact at the declared scale instead of\n *    whatever the user's arithmetic produced.\n *\n * @internal\n */\nfunction applyDerive<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n  rows: ReadonlyArray<Record<string, unknown>>,\n): ReadonlyArray<Record<string, unknown>> {\n  const groupFields = new Set<string>(\n    spec.groupBy === undefined\n      ? []\n      : (Array.isArray(spec.groupBy) ? spec.groupBy : [spec.groupBy]).map(groupKeyName),\n  )\n  return rows.map((row) => {\n    // `derive` sees the row the way a READER would: money decoded to its\n    // canonical decimal form, not the scaled integer the reducer left behind.\n    // Handing over `1005` where the schema says `10.05` would make every\n    // derived money expression quietly wrong by a factor of the scale.\n    // `'raw'` keeps it at the exact decimal rather than a locale-formatted\n    // string, which is what `exact.*` consumes.\n    const view = spec.moneyFields ? decodeMoneyFields(row, spec.moneyFields, 'raw') : row\n    const patch = spec.derive!(view as TRow, exactMath)\n    if (patch === null || patch === undefined) return row\n    for (const key of Object.keys(patch)) {\n      if (groupFields.has(key)) {\n        throw new MaterializedViewConfigError(\n          `Materialized view \"${spec.name}\": derive() returned the group key \"${key}\". ` +\n            'A group key is the row\\'s identity and feeds rowKey — rewriting it would re-home the ' +\n            'row into a bucket it was not aggregated for. Emit a differently-named field instead.',\n        )\n      }\n    }\n    // Canonicalize the PATCH only, into the DECIMAL form the money-aware\n    // reducers emit — not the scaled-integer storage form a collection uses.\n    // An MV row's money fields are decimal strings, so a derived field\n    // quantised into storage form reads back as the scaled integer beside\n    // correctly-decoded siblings: `\"1000000\"` next to `\"10000.00\"` (#1018).\n    // Precision is still enforced; only the output shape differs.\n    const canonical = spec.moneyFields\n      ? canonicalizeMoneyFieldsAsDecimal(patch, spec.moneyFields)\n      : patch\n    return { ...row, ...canonical }\n  })\n}\n\n/**\n * Materialize a projection-form MV (#810): hydrate the primary source\n * rows, resolve forward FK legs through the same `.join()` machinery\n * the UNION arms use, attach reverse \"collect\" legs via one\n * hash-grouped snapshot pass per leg, then run the projection `map`\n * (null / undefined omits the primary row) and the shared post-map\n * grouping tail.\n *\n * @internal\n */\nasync function materializeProjectionResult<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n  db: MVQueryContext,\n): Promise<ReadonlyArray<Record<string, unknown>>> {\n  const projection = spec.projection!\n  const coll = db.collection<Record<string, unknown>>(projection.source)\n  // ROOT forward legs chain through the query builder exactly like UNION arm\n  // joins — ref() resolution, dangling-mode semantics, presentation dressing,\n  // and ceilings all ride the existing `.join()` path. Cast to `any` for the\n  // same reason `materializeUnionResult` does.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  let q: any = coll.query()\n  for (const leg of projection.joins) {\n    if (isCollectLeg(leg) || leg.from !== undefined) continue\n    q = q.join(leg.field, { as: leg.as, maxRows: leg.maxRows, strategy: leg.strategy })\n  }\n  let rows = q.toArray() as Array<Record<string, unknown>>\n  // Remaining legs in DECLARATION order — which is what makes `from` work: a leg\n  // may only name an alias declared earlier, so by the time it runs, the rows it\n  // attaches to are already on the row. Root collect legs are in this loop too;\n  // they were never part of the query chain.\n  for (const leg of projection.joins) {\n    if (isCollectLeg(leg)) {\n      rows = applyCollectLeg(rows, leg, spec.name, projection.source, projection.joins, db)\n    } else if (leg.from !== undefined) {\n      rows = applyLegRelativeForwardLeg(rows, leg, spec.name, projection.source, projection.joins, db)\n    }\n  }\n  const mapped: TRow[] = []\n  for (const r of rows) {\n    const m = projection.map(r)\n    // null / undefined means \"omit this primary row\" — same contract\n    // as the UNION arm `map`.\n    if (m == null) continue\n    mapped.push(m)\n  }\n  return finalizeMappedRows(spec, mapped)\n}\n\n/**\n * A `RefLookup` backed by the live join contexts — the executor's answer to the\n * same question the registry answers from the ref registry. Reads through, so a\n * ref declared after `openVault()` (the only place refs CAN be declared) is\n * visible here.\n *\n * @internal\n */\nfunction legOwnerLookup(db: MVQueryContext): RefLookup {\n  return (collection, field) => {\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const q = db.collection<Record<string, unknown>>(collection).query() as any\n    return (q._joinContext?.()?.resolveRef(field) as { target: string } | null | undefined) ?? null\n  }\n}\n\n/**\n * Attach one FORWARD leg that hangs off another leg's alias (#1140).\n *\n * Root forward legs ride `Query.join()` and are resolved before this runs; a\n * leg-relative one cannot, because the FK it follows lives on an already-attached\n * record rather than on a column of the primary query. It is therefore resolved\n * the same way a collect leg is — one snapshot of the target collection, indexed\n * by id — which keeps it O(N+M) rather than one `get()` per row.\n *\n * Attaches `null` when the `from` alias is null (a dangling ref upstream), when\n * the FK is nullish, or when the target row is missing. That is deliberately\n * outer-by-nature and matches the collect leg's empty array: a projection MV\n * must not drop a primary row because something two hops away is absent.\n *\n * @internal\n */\nfunction applyLegRelativeForwardLeg(\n  primaryRows: ReadonlyArray<Record<string, unknown>>,\n  leg: Extract<ProjectionJoinLeg, { field: string }>,\n  mvName: string,\n  source: string,\n  joins: ReadonlyArray<ProjectionJoinLeg>,\n  db: MVQueryContext,\n): Array<Record<string, unknown>> {\n  const lookup = legOwnerLookup(db)\n  const owner = resolveLegOwner(leg, joins, source, lookup)\n  const refDesc = owner === null ? null : lookup(owner, leg.field)\n  if (owner === null || refDesc === null) {\n    throw new MaterializedViewConfigError(\n      `\"${mvName}\": projection leg \"${leg.as}\" requires a ref() on field \"${leg.field}\" of `\n      + `collection \"${owner ?? `(behind from: \"${leg.from}\")`}\" — declare it on that collection, `\n      + `then retry`,\n    )\n  }\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const targetQ = db.collection<Record<string, unknown>>(refDesc.target).query() as any\n  const byId = new Map<string, Record<string, unknown>>()\n  for (const row of targetQ.toArray() as Array<Record<string, unknown>>) {\n    const id = coerceCollectKey(row.id)\n    if (id !== null) byId.set(id, row)\n  }\n  return primaryRows.map((row) => {\n    const anchor = leg.from === undefined\n      ? row\n      : (row[leg.from] as Record<string, unknown> | null | undefined)\n    const key = anchor == null ? null : coerceCollectKey(anchor[leg.field])\n    return { ...row, [leg.as]: key === null ? null : byId.get(key) ?? null }\n  })\n}\n\n/**\n * Attach one reverse \"collect\" leg (#810): every row of `leg.collect`\n * whose `leg.on` field references the ATTACH POINT's id lands in a\n * possibly-empty ARRAY under `leg.as` on that primary row. One\n * snapshot pass over the collect collection, hash-grouped by the `on`\n * FK — O(N+M), mirroring the forward hash-join fallback.\n *\n * The attach point is the primary record, or — with `from` (#1140) — the record\n * already attached under that alias. Matching then keys off `row[from].id`\n * instead of `row.id`, and `leg.on` must ref THAT leg's collection. A row whose\n * `from` alias is null (a dangling forward ref) gets `[]`, which is the same\n * outer-by-nature semantics a root collect leg already has for a primary record\n * with no children.\n *\n * Semantic check (first materialization, not factory time — parity\n * with join-time ref errors): `leg.on` must carry a `ref()` declared\n * on the collect collection targeting the attach point's collection.\n *\n * @internal\n */\nfunction applyCollectLeg(\n  primaryRows: ReadonlyArray<Record<string, unknown>>,\n  leg: { readonly collect: string; readonly on: string; readonly as: string; readonly from?: string; readonly maxRows?: number },\n  mvName: string,\n  source: string,\n  joins: ReadonlyArray<ProjectionJoinLeg>,\n  db: MVQueryContext,\n): Array<Record<string, unknown>> {\n  const childColl = db.collection<Record<string, unknown>>(leg.collect)\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const childQ = childColl.query() as any\n  const refDesc = childQ._joinContext?.()?.resolveRef(leg.on) as { target: string } | null | undefined\n  // The collection this leg matches AGAINST: the projection source for a root\n  // leg, the `from` leg's own target otherwise (#1140).\n  const expected = resolveLegOwner(leg, joins, source, legOwnerLookup(db))\n  const expectedName = expected ?? source\n  if (refDesc == null) {\n    throw new MaterializedViewConfigError(\n      `\"${mvName}\": projection collect leg \"${leg.as}\" requires a ref() on field \"${leg.on}\" of `\n      + `collection \"${leg.collect}\" targeting \"${expectedName}\" — declare `\n      + `refs: { ${leg.on}: ref('${expectedName}') } on collection \"${leg.collect}\", then retry`,\n    )\n  }\n  if (refDesc.target !== expectedName) {\n    throw new MaterializedViewConfigError(\n      `\"${mvName}\": projection collect leg \"${leg.as}\" expects field \"${leg.on}\" of collection `\n      + `\"${leg.collect}\" to reference ${leg.from === undefined\n        ? `the projection source \"${expectedName}\"`\n        : `\"${expectedName}\" (the collection behind from: \"${leg.from}\")`}`\n      + `, but its ref() targets \"${refDesc.target}\"`,\n    )\n  }\n  const maxRows = leg.maxRows ?? DEFAULT_JOIN_MAX_ROWS\n  const groups = new Map<string, Array<Record<string, unknown>>>()\n  for (const child of childQ.toArray() as Array<Record<string, unknown>>) {\n    const key = coerceCollectKey(child[leg.on])\n    // Nullish / non-scalar FK values mean \"no reference\" — same\n    // narrowing as the forward join path's key coercion.\n    if (key === null) continue\n    const bucket = groups.get(key)\n    if (bucket) bucket.push(child)\n    else groups.set(key, [child])\n  }\n  const out: Array<Record<string, unknown>> = []\n  for (const row of primaryRows) {\n    // `from` matches against the attached record's id, not the primary row's.\n    const anchor = leg.from === undefined\n      ? row\n      : (row[leg.from] as Record<string, unknown> | null | undefined)\n    const key = anchor == null ? null : coerceCollectKey(anchor.id)\n    const children = key === null ? [] : groups.get(key) ?? []\n    if (children.length > maxRows) {\n      throw new JoinTooLargeError({\n        leftRows: primaryRows.length,\n        rightRows: children.length,\n        maxRows,\n        side: 'right',\n        message:\n          `projection MV \"${mvName}\": collect leg \"${leg.as}\" gathered ${children.length} ` +\n          `\"${leg.collect}\" rows for one \"${source}\" record, exceeding the ${maxRows}-row ` +\n          `per-primary-row ceiling. Raise the ceiling via { maxRows } on the leg if the ` +\n          `fan-out genuinely fits in memory, or restructure the child collection.`,\n      })\n    }\n    out.push({ ...row, [leg.as]: children })\n  }\n  return out\n}\n\n/**\n * Coerce an unknown FK value into a collect-grouping key. Same\n * narrowing as the join path's `coerceRefKey` (not exported from\n * there): strings and numbers are legitimate ref values; anything\n * else is \"no reference\" and returns `null`.\n *\n * @internal\n */\nfunction coerceCollectKey(value: unknown): string | null {\n  if (value === null || value === undefined) return null\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'bigint') return String(value)\n  return null\n}\n\n/**\n * Run an MV's `query()` and write the result rows to the output\n * collection. Same-DEK encryption: routes through the standard\n * `Collection.put` pipeline, so the output collection's DEK is what\n * gets used (matches the v2 spec's \"same DEK as the left-most source\"\n * invariant — `Collection.put` looks up the DEK by collection name,\n * and the output collection IS the MV's owned collection).\n *\n * Stamps `_materializedFrom` onto every emitted row.\n *\n * **Tombstoning:** when `spec.onEmpty: 'delete'` (default), rows\n * that existed in a prior refresh but no longer appear in the new\n * materialized result are deleted via `Collection._internalDelete` —\n * the housekeeping bypass primitive prevents user\n * `onDelete` guards on the output collection from firing on these\n * system-internal deletes. `onEmpty: 'keep'` opts out (rows from\n * prior refreshes linger even when the new result lacks them).\n *\n * **Cost ceiling:** if the materialized row count exceeds\n * `spec.maxRows` (default 100k), throws `MaterializedViewTooLargeError`\n * before any writes hit the store — so strict-mode rollback is\n * clean.\n *\n * **Strict mode:** `spec.strict === true` re-throws on any\n * row-write failure; the active TxContext registration means the\n * source-write rolls back atomically via `revertExecuted`.\n *\n * @internal\n */\nexport const MaterializedViewExecutor = {\n  async refresh(\n    reg: RegisteredMV,\n    accessor: MVExecutorAccessor,\n  ): Promise<RefreshResult> {\n    const spec = reg.spec\n    const outputColl = accessor.getCollection(reg.outputCollection)\n    const maxRows = spec.maxRows ?? DEFAULT_MAX_ROWS\n    const onEmpty = spec.onEmpty ?? 'delete'\n    const strict = spec.strict ?? false\n\n    // 1. Materialize the query (branches on terminal shape). If the\n    //    MV declared predicates, wrap the query context the same way\n    //    the registry did at registration time so `.wherePredicate()`\n    //    calls resolve to the registered functions.\n    // #1414 — `ungatedMvContext` keeps the engine's synchronous source reads\n    // exactly as they were before the cold-collection gate existed.\n    const baseCtx = ungatedMvContext(accessor.getQueryContext())\n    const ctxForQuery: MVQueryContext = spec.predicates\n      ? wrapDbWithPredicates(baseCtx, spec.predicates)\n      : baseCtx\n    // UNION-form strategies: read every arm, map to the unified\n    // row shape, concatenate, then optionally groupBy + aggregate.\n    // Projection-form strategies (#810): hydrate the primary source,\n    // attach forward + collect legs, map, then the same optional\n    // grouping tail. The single-source `query()` path is untouched.\n    let rows: ReadonlyArray<Record<string, unknown>>\n    if (spec.unionSources) {\n      rows = await materializeUnionResult(spec, ctxForQuery)\n    } else if (spec.projection) {\n      rows = await materializeProjectionResult(spec, ctxForQuery)\n    } else {\n      const q = spec.query!(ctxForQuery)\n      rows = await materializeQueryResult(q, spec.name, spec.i18nLocale, spec.i18nFields)\n    }\n\n    // #1007 — the post-aggregate projection. Applied here, after every form has\n    // produced its finished rows, so union / projection / query all get the\n    // same single definition of \"last step before materialisation\".\n    if (spec.derive) rows = applyDerive(spec, rows)\n\n    // #777 — exclude this MV's OWN previously-stamped output rows from the\n    // input scan. A same-collection Query-form MV copies the whole source row\n    // verbatim into its output, so a stale output row can itself satisfy the\n    // MV's own input filter (when the filter is on a field disjoint from the\n    // partition field) and get re-selected as if it were live source — the\n    // row self-perpetuates after its true source is gone. Prior output is\n    // never this MV's own source.\n    rows = rows.filter((row) => {\n      const stamp = row._materializedFrom as { mvName?: string } | undefined\n      return stamp?.mvName !== spec.name\n    })\n\n    // 2. Cost ceiling check BEFORE any writes — keeps the rollback\n    //    clean if the source-write is wrapped in a transaction.\n    if (rows.length > maxRows) {\n      throw new MaterializedViewTooLargeError(spec.name, rows.length, maxRows)\n    }\n\n    const txCtx = accessor.getActiveTxContext()\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const adapter = (outputColl as any).adapter as {\n      get(v: string, c: string, i: string): Promise<EncryptedEnvelope | null>\n    }\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const vaultName = (outputColl as any).vault as string\n\n    // 3. Compute the post-refresh id set so we can diff against the\n    //    prior-emitted id set for tombstoning (when onEmpty === 'delete').\n    const newIds = new Set<string>()\n    const enrichedRows: Array<{ id: string; record: Record<string, unknown> }> = []\n    for (const row of rows) {\n      const id = spec.rowKey(row)\n      newIds.add(id)\n      const meta: MaterializedFromMeta = {\n        mvName: spec.name,\n        queryHash: reg.queryHash,\n        sourceVersions: {},\n        materializedAt: new Date().toISOString(),\n      }\n      enrichedRows.push({ id, record: { ...row, _materializedFrom: meta } })\n    }\n\n    // 4. Write the new rows — skipping any whose content is unchanged (#1418).\n    //\n    // ⛔ THE OUTPUT ROW COUNT, NOT THE SOURCE SCAN, IS WHAT MADE THIS EXPENSIVE.\n    // This loop used to encrypt-and-store EVERY row of the view on EVERY source\n    // write, so per-write cost tracked the size of the view: measured 23 ms at\n    // 250 output rows and 41.6 ms at 450, for source writes the MV's own `map`\n    // dropped entirely. Comparing against what this MV last wrote turns \"one\n    // source write rewrites the whole view\" into \"one source write rewrites the\n    // groups that moved\". See `emit-memo.ts` for why this, and not a\n    // predict-whether-the-refresh-is-needed short circuit.\n    const memoKey = emitMemoKey(vaultName, spec.name, reg.outputCollection)\n    // Read the stamp BEFORE writing: it has to describe the collection as this\n    // refresh found it, so a write by anyone else since last time invalidates.\n    const priorEmitted = readEmitMemo(memoKey, outputColl._cacheStamp)\n    const emitted = new Map<string, string>()\n\n    let written = 0\n    let skipped = 0\n    let failed = 0\n    for (const { id, record } of enrichedRows) {\n      const contentKey = rowContentKey(record, reg.queryHash)\n      // ⚠️ A txCtx changes what a \"skip\" means: the rollback journal below\n      // needs an entry for every row the transaction could revert, and a row we\n      // never wrote has nothing to revert TO. Rather than reason about partial\n      // journals, the memo stands down inside a transaction entirely.\n      // #1439 — and only when no `beforePut` gate can fire FOR THIS ROW. Asking\n      // the bus \"is anything registered\" instead disabled the skip for every\n      // collection in any vault carrying a guard or a periods strategy —\n      // measured by the reporter at 54 redundant writes per source write with\n      // guards alone, which is close to every real consumer.\n      if (\n        contentKey !== null && txCtx === null\n        && !outputColl._derivedWriteGated(record)\n        && priorEmitted?.get(id) === contentKey\n      ) {\n        skipped++\n        emitted.set(id, contentKey)\n        continue\n      }\n      try {\n        if (txCtx !== null) {\n          const prior = await adapter.get(vaultName, reg.outputCollection, id)\n          txCtx._executed.push({\n            op: { type: 'put', vaultName, collectionName: reg.outputCollection, id },\n            priorEnvelope: prior,\n          })\n        }\n        let landed = false\n        if (accessor.dispatchCtx) {\n          if (await putDerivedOutput(outputColl, id, record, accessor.dispatchCtx) === 'written') {\n            written++\n            landed = true\n          }\n        } else {\n          await outputColl.put(id, record)\n          written++\n          landed = true\n        }\n        // ⛔ ONLY a write that actually landed is remembered. `putDerivedOutput`\n        // declines inside a frozen period, and recording that row would make\n        // every later refresh skip a row that is not there.\n        if (landed && contentKey !== null) emitted.set(id, contentKey)\n      } catch (err) {\n        failed++\n        if (strict) throw err\n         \n        console.warn(`[mv] \"${spec.name}\" row write failed:`, err)\n      }\n    }\n\n    // 5. Tombstone rows that existed before but don't appear now.\n    //    `onEmpty: 'keep'` skips this pass entirely. Uses\n    //    `_internalDelete` so a user-registered `onDelete` on the\n    //    output collection does NOT fire on housekeeping (composition fix).\n    let deleted = 0\n    const residueUndecodable: string[] = []\n    const residueDeclined: string[] = []\n    if (onEmpty === 'delete') {\n      const priorIds = await listOutputIds(outputColl)\n      for (const priorId of priorIds) {\n        if (newIds.has(priorId)) continue\n        // #762 — a same-collection partition MV (`output: { collection: <source>, partition }`,\n        // the DERIV-PP30-001 shape) writes INTO its own source collection, so `listOutputIds`\n        // also returns untouched USER source rows here. Decode each candidate and only\n        // tombstone rows THIS MV stamped via `_materializedFrom.mvName` — the exact discipline\n        // `invalidateMVAtRest` uses (stale.ts:151-162). An unstamped row, or one stamped by a\n        // different MV, is never this MV's to delete.\n        const priorEnvelope = await adapter.get(vaultName, reg.outputCollection, priorId)\n        if (priorEnvelope === null) continue\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        const priorDecoded = await (outputColl as any)._decodeEnvelope(priorEnvelope, priorId)\n        if (priorDecoded === null) {\n          // #782 part a — ownership unknown (undecodable, e.g. elevated above tier 0 on a\n          // tiered output collection): can't rule out this being THIS MV's own stamped row.\n          // Surface it rather than silently skip (mirrors invalidateMVAtRest's #776 posture —\n          // previously this leg had NO residue channel at all).\n          residueUndecodable.push(`${reg.outputCollection}:${priorId}`)\n          continue\n        }\n        const priorStampedBy =\n          typeof priorDecoded === 'object'\n            ? (priorDecoded as Record<string, unknown>)._materializedFrom as { mvName?: string } | undefined\n            : undefined\n        if (priorStampedBy?.mvName !== spec.name) continue\n        try {\n          // eslint-disable-next-line @typescript-eslint/no-explicit-any\n          const outAny = outputColl as any\n          if (typeof outAny._internalDelete === 'function') {\n            // #776 part b — gate on the boolean, matching invalidateMVAtRest's discipline\n            // (stale.ts): `_internalDelete` returns `false` for a #718 elevated-skip (no\n            // erasure happened), and that must not inflate the tombstone count.\n            if (await outAny._internalDelete(priorId, txCtx)) {\n              deleted++\n            } else {\n              // #782 part b — decoded AND stamp-owned, but erasure was declined (#718\n              // tier-elevation gate). Ownership IS confirmed here — a real silent survival,\n              // not a legit stamp-mismatch skip. Surface it too.\n              residueDeclined.push(`${reg.outputCollection}:${priorId}`)\n            }\n          } else {\n            // Defensive fallback — should never hit in real flow since\n            // every Collection has `_internalDelete`.\n            await outputColl.delete(priorId)\n            deleted++\n          }\n        } catch (err) {\n          failed++\n          if (strict) throw err\n\n          console.warn(`[mv] \"${spec.name}\" tombstone failed for id=\"${priorId}\":`, err)\n        }\n      }\n    }\n\n    // Record the stamp AFTER every write and tombstone, so the next refresh's\n    // check means \"nothing has happened to this collection since I finished\".\n    // A row that failed, was declined, or was tombstoned is simply absent from\n    // `emitted` and will be written again.\n    writeEmitMemo(memoKey, outputColl._cacheStamp, emitted)\n\n    return { written, skipped, deleted, failed, residueUndecodable, residueDeclined }\n  },\n}\n\n/**\n * List ids currently present in the MV's output collection via the\n * adapter directly (avoids triggering the lazy resolve-on-read path\n * we're INSIDE). Returns an empty array if the collection doesn't\n * exist or the adapter doesn't surface a list method.\n *\n * @internal\n */\nasync function listOutputIds(\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  outputColl: Collection<any>,\n): Promise<string[]> {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const cAny = outputColl as any\n  const adapter = cAny.adapter as { list?: (v: string, c: string) => Promise<readonly string[]> }\n  const vault = cAny.vault as string\n  const name = cAny.name as string\n  if (typeof adapter?.list !== 'function') return []\n  try {\n    const ids = await adapter.list(vault, name)\n    return [...ids]\n  } catch {\n    return []\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,SAAS,WAAW,GAAqB;AACvC,SAAO,OAAO,MAAM,YAAY,MAAM,QAAS,EAA6B,aAAa;AAC3F;AAWO,SAAS,oBACd,MACA,QACA,aACwC;AACxC,MAAI,KAAK,WAAW,EAAG,QAAO;AAE9B,MAAI,SAA2B,OAAO;AACtC,MAAI,aAAa;AACf,UAAM,eAA0D,CAAC;AACjE,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,UAAI,CAAC,WAAW,CAAC,EAAG,cAAa,CAAC,IAAI;AAAA,IACxC;AACA,QAAI,OAAO,KAAK,YAAY,EAAE,SAAS,GAAG;AACxC,YAAM,UAAU,UAAU,OAAO,EAAE,EAAE,YAAY,CAAC;AAClD,UAAI,UAAU,QAAQ,aAAc,YAA0B;AAI9D,gBAAU,qBAAqB,SAAuB;AAAA,QACpD,sBAAsB,CAAC,GAAG,MAAM,QAAQ,uBAAuB,GAAG,CAAC;AAAA,MACrE,CAAC;AACD,eAAS,EAAE,GAAG,QAAQ,GAAG,QAAQ;AAAA,IACnC;AAAA,EACF;AAMA,QAAM,OAAmB;AAAA,IACvB,GAAI,OAAO,gBAAgB,UAAa,EAAE,aAAa,OAAO,YAAY;AAAA,IAC1E,GAAI,OAAO,YAAY,UAAa,EAAE,SAAS,OAAO,QAAQ;AAAA,EAChE;AACA,SAAO,YAAqC,MAAM,MAAM,MAAM;AAChE;;;AC+BA,IAAM,oBAAoB;AAS1B,IAAM,QAAQ,oBAAI,IAAsB;AAUjC,SAAS,YAAY,OAAe,QAAgB,kBAAkC;AAC3F,SAAO,GAAG,KAAK,KAAK,MAAM,KAAK,gBAAgB;AACjD;AASO,SAAS,aAAa,KAAa,OAA0D;AAClG,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,MAAM,MAAM,IAAI,GAAG;AACzB,MAAI,CAAC,OAAO,IAAI,UAAU,OAAO;AAG/B,QAAI,IAAK,OAAM,OAAO,GAAG;AACzB,WAAO;AAAA,EACT;AACA,SAAO,IAAI;AACb;AAGO,SAAS,cAAc,KAAa,OAAsB,MAAiC;AAChG,MAAI,UAAU,QAAQ,KAAK,OAAO,mBAAmB;AACnD,UAAM,OAAO,GAAG;AAChB;AAAA,EACF;AACA,QAAM,IAAI,KAAK,EAAE,OAAO,KAAK,CAAC;AAChC;AAkBO,SAAS,cAAc,KAA8B,WAAkC;AAC5F,MAAI;AAGF,UAAM,UAAmC,CAAC;AAC1C,eAAW,KAAK,OAAO,KAAK,GAAG,GAAG;AAChC,UAAI,MAAM,oBAAqB,SAAQ,CAAC,IAAI,IAAI,CAAC;AAAA,IACnD;AACA,WAAO,GAAG,SAAS,KAAK,sBAAsB,OAAO,CAAC;AAAA,EACxD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC5HA,IAAM,mBAAmB;AASzB,eAAe,uBAEb,GACA,QACA,YACA,YACiD;AACjD,MAAI,OAAO,GAAG,YAAY,YAAY;AAEpC,WAAO,MAAM,EAAE,QAAQ;AAAA,EACzB;AACA,MAAI,OAAO,GAAG,QAAQ,YAAY;AAQhC,UAAM,UAAU,eAAe,SAAY,EAAE,QAAQ,YAAY,WAAW,IAAI;AAChF,UAAM,SAAkB,MAAM,QAAQ,QAAQ,EAAE,IAAI,OAAO,CAAC;AAC5D,QAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,aAAO;AAAA,IACT;AAIA,WAAO,CAAC,MAAiC;AAAA,EAC3C;AACA,QAAM,IAAI;AAAA,IACR,OAAO,MAAM;AAAA,EAEf;AACF;AAuBA,eAAe,uBACb,MACA,IACiD;AACjD,QAAM,UAAkB,CAAC;AACzB,aAAW,OAAO,KAAK,cAAe;AACpC,UAAM,OAAO,GAAG,WAAoC,IAAI,UAAU;AAQlE,QAAI,IAAS,KAAK,MAAM;AACxB,QAAI,IAAI,MAAM,QAAQ;AACpB,iBAAW,OAAO,IAAI,MAAM;AAE1B,YAAI,QAAQ,MACR,EAAE,OAAO,IAAI,QAAQ,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM,IAAI,MAAM,SAAS,IAAI,QAAQ,CAAC,IACrF,EAAE,KAAK,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,SAAS,IAAI,SAAS,UAAU,IAAI,SAAS,CAAC;AAAA,MACpF;AAAA,IACF;AACA,UAAM,aAAa,EAAE,QAAQ;AAC7B,eAAW,KAAK,YAAY;AAC1B,YAAM,SAAS,IAAI,IAAI,CAAC;AAGxB,UAAI,UAAU,KAAM;AACpB,cAAQ,KAAK,MAAM;AAAA,IACrB;AAAA,EACF;AAEA,SAAO,mBAAmB,MAAM,OAAO;AACzC;AASA,SAAS,iBACP,MACA,MACwC;AACxC,MAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,SAAO,oBAAoB,MAAM,KAAK,QAAQ,KAAK,WAAW;AAChE;AAYA,SAAS,mBACP,MACA,SACwC;AAIxC,MAAI,CAAC,KAAK,QAAS,QAAO,iBAAiB,MAAM,OAAO;AAExD,QAAM,YAAiC,MAAM,QAAQ,KAAK,OAAO,IAC5D,KAAK,UACN,CAAC,KAAK,OAAmB;AAC7B,QAAM,cAAiC,UAAU,IAAI,YAAY;AAKjE,QAAM,cAAc,UAAU,OAAO,cAAc;AACnD,MAAI,YAAY,SAAS,GAAG;AAC1B,cAAU,qBAAqB,SAAS,WAAW;AAAA,EACrD;AAQA,MAAI,KAAK,eAAe,UAAa,KAAK,eAAe,QAAW;AAClE,UAAM,YAAgD,CAAC;AACvD,eAAW,KAAK,aAAa;AAC3B,YAAM,IAAI,KAAK,WAAW,CAAC;AAC3B,UAAI,MAAM,OAAW,WAAU,CAAC,IAAI;AAAA,IACtC;AACA,QAAI,OAAO,KAAK,SAAS,EAAE,SAAS,GAAG;AACrC,eAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,gBAAQ,CAAC,IAAI,gBAAgB,QAAQ,CAAC,GAA8B,WAAW,KAAK,YAAY,QAAW,IAAI;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AAGA,aAAW,KAAK,aAAa;AAC3B,eAAW,OAAO,SAAS;AACzB,YAAM,IAAK,IAAgC,CAAC;AAC5C,UAAI,MAAM,QAAQ,OAAO,MAAM,UAAU;AACvC,cAAM,IAAI;AAAA,UACR;AAAA,UACA,sBAAsB,KAAK,IAAI,gBAAgB,CAAC;AAAA,QAGlD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAKA,MAAI,CAAC,KAAK,WAAW;AACnB,UAAM,OAAO,oBAAI,IAAkB;AACnC,eAAW,OAAO,SAAS;AACzB,YAAM,IAAI,kBAAkB,aAAa,GAA8B;AACvE,UAAI,CAAC,KAAK,IAAI,CAAC,EAAG,MAAK,IAAI,GAAG,GAAG;AAAA,IACnC;AACA,WAAO,CAAC,GAAG,KAAK,OAAO,CAAC;AAAA,EAC1B;AAKA,SAAO;AAAA,IACL;AAAA,IACA,eAAwC,SAAS,aAAa,KAAK,WAAW,KAAK,WAAW;AAAA,EAChG;AACF;AAmBA,SAAS,YACP,MACA,MACwC;AACxC,QAAM,cAAc,IAAI;AAAA,IACtB,KAAK,YAAY,SACb,CAAC,KACA,MAAM,QAAQ,KAAK,OAAO,IAAI,KAAK,UAAU,CAAC,KAAK,OAAO,GAAG,IAAI,YAAY;AAAA,EACpF;AACA,SAAO,KAAK,IAAI,CAAC,QAAQ;AAOvB,UAAM,OAAO,KAAK,cAAc,kBAAkB,KAAK,KAAK,aAAa,KAAK,IAAI;AAClF,UAAM,QAAQ,KAAK,OAAQ,MAAc,SAAS;AAClD,QAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,eAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAI,YAAY,IAAI,GAAG,GAAG;AACxB,cAAM,IAAI;AAAA,UACR,sBAAsB,KAAK,IAAI,uCAAuC,GAAG;AAAA,QAG3E;AAAA,MACF;AAAA,IACF;AAOA,UAAM,YAAY,KAAK,cACnB,iCAAiC,OAAO,KAAK,WAAW,IACxD;AACJ,WAAO,EAAE,GAAG,KAAK,GAAG,UAAU;AAAA,EAChC,CAAC;AACH;AAYA,eAAe,4BACb,MACA,IACiD;AACjD,QAAM,aAAa,KAAK;AACxB,QAAM,OAAO,GAAG,WAAoC,WAAW,MAAM;AAMrE,MAAI,IAAS,KAAK,MAAM;AACxB,aAAW,OAAO,WAAW,OAAO;AAClC,QAAI,aAAa,GAAG,KAAK,IAAI,SAAS,OAAW;AACjD,QAAI,EAAE,KAAK,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,SAAS,IAAI,SAAS,UAAU,IAAI,SAAS,CAAC;AAAA,EACpF;AACA,MAAI,OAAO,EAAE,QAAQ;AAKrB,aAAW,OAAO,WAAW,OAAO;AAClC,QAAI,aAAa,GAAG,GAAG;AACrB,aAAO,gBAAgB,MAAM,KAAK,KAAK,MAAM,WAAW,QAAQ,WAAW,OAAO,EAAE;AAAA,IACtF,WAAW,IAAI,SAAS,QAAW;AACjC,aAAO,2BAA2B,MAAM,KAAK,KAAK,MAAM,WAAW,QAAQ,WAAW,OAAO,EAAE;AAAA,IACjG;AAAA,EACF;AACA,QAAM,SAAiB,CAAC;AACxB,aAAW,KAAK,MAAM;AACpB,UAAM,IAAI,WAAW,IAAI,CAAC;AAG1B,QAAI,KAAK,KAAM;AACf,WAAO,KAAK,CAAC;AAAA,EACf;AACA,SAAO,mBAAmB,MAAM,MAAM;AACxC;AAUA,SAAS,eAAe,IAA+B;AACrD,SAAO,CAAC,YAAY,UAAU;AAE5B,UAAM,IAAI,GAAG,WAAoC,UAAU,EAAE,MAAM;AACnE,WAAQ,EAAE,eAAe,GAAG,WAAW,KAAK,KAA+C;AAAA,EAC7F;AACF;AAkBA,SAAS,2BACP,aACA,KACA,QACA,QACA,OACA,IACgC;AAChC,QAAM,SAAS,eAAe,EAAE;AAChC,QAAM,QAAQ,gBAAgB,KAAK,OAAO,QAAQ,MAAM;AACxD,QAAM,UAAU,UAAU,OAAO,OAAO,OAAO,OAAO,IAAI,KAAK;AAC/D,MAAI,UAAU,QAAQ,YAAY,MAAM;AACtC,UAAM,IAAI;AAAA,MACR,IAAI,MAAM,sBAAsB,IAAI,EAAE,gCAAgC,IAAI,KAAK,oBAC9D,SAAS,kBAAkB,IAAI,IAAI,IAAI;AAAA,IAE1D;AAAA,EACF;AAEA,QAAM,UAAU,GAAG,WAAoC,QAAQ,MAAM,EAAE,MAAM;AAC7E,QAAM,OAAO,oBAAI,IAAqC;AACtD,aAAW,OAAO,QAAQ,QAAQ,GAAqC;AACrE,UAAM,KAAK,iBAAiB,IAAI,EAAE;AAClC,QAAI,OAAO,KAAM,MAAK,IAAI,IAAI,GAAG;AAAA,EACnC;AACA,SAAO,YAAY,IAAI,CAAC,QAAQ;AAC9B,UAAM,SAAS,IAAI,SAAS,SACxB,MACC,IAAI,IAAI,IAAI;AACjB,UAAM,MAAM,UAAU,OAAO,OAAO,iBAAiB,OAAO,IAAI,KAAK,CAAC;AACtE,WAAO,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,QAAQ,OAAO,OAAO,KAAK,IAAI,GAAG,KAAK,KAAK;AAAA,EACzE,CAAC;AACH;AAsBA,SAAS,gBACP,aACA,KACA,QACA,QACA,OACA,IACgC;AAChC,QAAM,YAAY,GAAG,WAAoC,IAAI,OAAO;AAEpE,QAAM,SAAS,UAAU,MAAM;AAC/B,QAAM,UAAU,OAAO,eAAe,GAAG,WAAW,IAAI,EAAE;AAG1D,QAAM,WAAW,gBAAgB,KAAK,OAAO,QAAQ,eAAe,EAAE,CAAC;AACvE,QAAM,eAAe,YAAY;AACjC,MAAI,WAAW,MAAM;AACnB,UAAM,IAAI;AAAA,MACR,IAAI,MAAM,8BAA8B,IAAI,EAAE,gCAAgC,IAAI,EAAE,oBACnE,IAAI,OAAO,gBAAgB,YAAY,4BAC3C,IAAI,EAAE,UAAU,YAAY,uBAAuB,IAAI,OAAO;AAAA,IAC7E;AAAA,EACF;AACA,MAAI,QAAQ,WAAW,cAAc;AACnC,UAAM,IAAI;AAAA,MACR,IAAI,MAAM,8BAA8B,IAAI,EAAE,oBAAoB,IAAI,EAAE,oBAClE,IAAI,OAAO,kBAAkB,IAAI,SAAS,SAC5C,0BAA0B,YAAY,MACtC,IAAI,YAAY,mCAAmC,IAAI,IAAI,IAAI,4BACrC,QAAQ,MAAM;AAAA,IAC9C;AAAA,EACF;AACA,QAAM,UAAU,IAAI,WAAW;AAC/B,QAAM,SAAS,oBAAI,IAA4C;AAC/D,aAAW,SAAS,OAAO,QAAQ,GAAqC;AACtE,UAAM,MAAM,iBAAiB,MAAM,IAAI,EAAE,CAAC;AAG1C,QAAI,QAAQ,KAAM;AAClB,UAAM,SAAS,OAAO,IAAI,GAAG;AAC7B,QAAI,OAAQ,QAAO,KAAK,KAAK;AAAA,QACxB,QAAO,IAAI,KAAK,CAAC,KAAK,CAAC;AAAA,EAC9B;AACA,QAAM,MAAsC,CAAC;AAC7C,aAAW,OAAO,aAAa;AAE7B,UAAM,SAAS,IAAI,SAAS,SACxB,MACC,IAAI,IAAI,IAAI;AACjB,UAAM,MAAM,UAAU,OAAO,OAAO,iBAAiB,OAAO,EAAE;AAC9D,UAAM,WAAW,QAAQ,OAAO,CAAC,IAAI,OAAO,IAAI,GAAG,KAAK,CAAC;AACzD,QAAI,SAAS,SAAS,SAAS;AAC7B,YAAM,IAAI,kBAAkB;AAAA,QAC1B,UAAU,YAAY;AAAA,QACtB,WAAW,SAAS;AAAA,QACpB;AAAA,QACA,MAAM;AAAA,QACN,SACE,kBAAkB,MAAM,mBAAmB,IAAI,EAAE,cAAc,SAAS,MAAM,KAC1E,IAAI,OAAO,mBAAmB,MAAM,2BAA2B,OAAO;AAAA,MAG9E,CAAC;AAAA,IACH;AACA,QAAI,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC;AAAA,EACzC;AACA,SAAO;AACT;AAUA,SAAS,iBAAiB,OAA+B;AACvD,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAC/E,SAAO;AACT;AA+BO,IAAM,2BAA2B;AAAA,EACtC,MAAM,QACJ,KACA,UACwB;AACxB,UAAM,OAAO,IAAI;AACjB,UAAM,aAAa,SAAS,cAAc,IAAI,gBAAgB;AAC9D,UAAM,UAAU,KAAK,WAAW;AAChC,UAAM,UAAU,KAAK,WAAW;AAChC,UAAM,SAAS,KAAK,UAAU;AAQ9B,UAAM,UAAU,iBAAiB,SAAS,gBAAgB,CAAC;AAC3D,UAAM,cAA8B,KAAK,aACrC,qBAAqB,SAAS,KAAK,UAAU,IAC7C;AAMJ,QAAI;AACJ,QAAI,KAAK,cAAc;AACrB,aAAO,MAAM,uBAAuB,MAAM,WAAW;AAAA,IACvD,WAAW,KAAK,YAAY;AAC1B,aAAO,MAAM,4BAA4B,MAAM,WAAW;AAAA,IAC5D,OAAO;AACL,YAAM,IAAI,KAAK,MAAO,WAAW;AACjC,aAAO,MAAM,uBAAuB,GAAG,KAAK,MAAM,KAAK,YAAY,KAAK,UAAU;AAAA,IACpF;AAKA,QAAI,KAAK,OAAQ,QAAO,YAAY,MAAM,IAAI;AAS9C,WAAO,KAAK,OAAO,CAAC,QAAQ;AAC1B,YAAM,QAAQ,IAAI;AAClB,aAAO,OAAO,WAAW,KAAK;AAAA,IAChC,CAAC;AAID,QAAI,KAAK,SAAS,SAAS;AACzB,YAAM,IAAI,8BAA8B,KAAK,MAAM,KAAK,QAAQ,OAAO;AAAA,IACzE;AAEA,UAAM,QAAQ,SAAS,mBAAmB;AAE1C,UAAM,UAAW,WAAmB;AAIpC,UAAM,YAAa,WAAmB;AAItC,UAAM,SAAS,oBAAI,IAAY;AAC/B,UAAM,eAAuE,CAAC;AAC9E,eAAW,OAAO,MAAM;AACtB,YAAM,KAAK,KAAK,OAAO,GAAG;AAC1B,aAAO,IAAI,EAAE;AACb,YAAM,OAA6B;AAAA,QACjC,QAAQ,KAAK;AAAA,QACb,WAAW,IAAI;AAAA,QACf,gBAAgB,CAAC;AAAA,QACjB,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAAA,MACzC;AACA,mBAAa,KAAK,EAAE,IAAI,QAAQ,EAAE,GAAG,KAAK,mBAAmB,KAAK,EAAE,CAAC;AAAA,IACvE;AAYA,UAAM,UAAU,YAAY,WAAW,KAAK,MAAM,IAAI,gBAAgB;AAGtE,UAAM,eAAe,aAAa,SAAS,WAAW,WAAW;AACjE,UAAM,UAAU,oBAAI,IAAoB;AAExC,QAAI,UAAU;AACd,QAAI,UAAU;AACd,QAAI,SAAS;AACb,eAAW,EAAE,IAAI,OAAO,KAAK,cAAc;AACzC,YAAM,aAAa,cAAc,QAAQ,IAAI,SAAS;AAUtD,UACE,eAAe,QAAQ,UAAU,QAC9B,CAAC,WAAW,mBAAmB,MAAM,KACrC,cAAc,IAAI,EAAE,MAAM,YAC7B;AACA;AACA,gBAAQ,IAAI,IAAI,UAAU;AAC1B;AAAA,MACF;AACA,UAAI;AACF,YAAI,UAAU,MAAM;AAClB,gBAAM,QAAQ,MAAM,QAAQ,IAAI,WAAW,IAAI,kBAAkB,EAAE;AACnE,gBAAM,UAAU,KAAK;AAAA,YACnB,IAAI,EAAE,MAAM,OAAO,WAAW,gBAAgB,IAAI,kBAAkB,GAAG;AAAA,YACvE,eAAe;AAAA,UACjB,CAAC;AAAA,QACH;AACA,YAAI,SAAS;AACb,YAAI,SAAS,aAAa;AACxB,cAAI,MAAM,iBAAiB,YAAY,IAAI,QAAQ,SAAS,WAAW,MAAM,WAAW;AACtF;AACA,qBAAS;AAAA,UACX;AAAA,QACF,OAAO;AACL,gBAAM,WAAW,IAAI,IAAI,MAAM;AAC/B;AACA,mBAAS;AAAA,QACX;AAIA,YAAI,UAAU,eAAe,KAAM,SAAQ,IAAI,IAAI,UAAU;AAAA,MAC/D,SAAS,KAAK;AACZ;AACA,YAAI,OAAQ,OAAM;AAElB,gBAAQ,KAAK,SAAS,KAAK,IAAI,uBAAuB,GAAG;AAAA,MAC3D;AAAA,IACF;AAMA,QAAI,UAAU;AACd,UAAM,qBAA+B,CAAC;AACtC,UAAM,kBAA4B,CAAC;AACnC,QAAI,YAAY,UAAU;AACxB,YAAM,WAAW,MAAM,cAAc,UAAU;AAC/C,iBAAW,WAAW,UAAU;AAC9B,YAAI,OAAO,IAAI,OAAO,EAAG;AAOzB,cAAM,gBAAgB,MAAM,QAAQ,IAAI,WAAW,IAAI,kBAAkB,OAAO;AAChF,YAAI,kBAAkB,KAAM;AAE5B,cAAM,eAAe,MAAO,WAAmB,gBAAgB,eAAe,OAAO;AACrF,YAAI,iBAAiB,MAAM;AAKzB,6BAAmB,KAAK,GAAG,IAAI,gBAAgB,IAAI,OAAO,EAAE;AAC5D;AAAA,QACF;AACA,cAAM,iBACJ,OAAO,iBAAiB,WACnB,aAAyC,oBAC1C;AACN,YAAI,gBAAgB,WAAW,KAAK,KAAM;AAC1C,YAAI;AAEF,gBAAM,SAAS;AACf,cAAI,OAAO,OAAO,oBAAoB,YAAY;AAIhD,gBAAI,MAAM,OAAO,gBAAgB,SAAS,KAAK,GAAG;AAChD;AAAA,YACF,OAAO;AAIL,8BAAgB,KAAK,GAAG,IAAI,gBAAgB,IAAI,OAAO,EAAE;AAAA,YAC3D;AAAA,UACF,OAAO;AAGL,kBAAM,WAAW,OAAO,OAAO;AAC/B;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AACZ;AACA,cAAI,OAAQ,OAAM;AAElB,kBAAQ,KAAK,SAAS,KAAK,IAAI,8BAA8B,OAAO,MAAM,GAAG;AAAA,QAC/E;AAAA,MACF;AAAA,IACF;AAMA,kBAAc,SAAS,WAAW,aAAa,OAAO;AAEtD,WAAO,EAAE,SAAS,SAAS,SAAS,QAAQ,oBAAoB,gBAAgB;AAAA,EAClF;AACF;AAUA,eAAe,cAEb,YACmB;AAEnB,QAAM,OAAO;AACb,QAAM,UAAU,KAAK;AACrB,QAAM,QAAQ,KAAK;AACnB,QAAM,OAAO,KAAK;AAClB,MAAI,OAAO,SAAS,SAAS,WAAY,QAAO,CAAC;AACjD,MAAI;AACF,UAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI;AAC1C,WAAO,CAAC,GAAG,GAAG;AAAA,EAChB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;","names":[]}

package/dist/{chunk-JQYKPKG6.js → chunk-7K42TSCY.js}

@@ -1,16 +1,16 @@
 import {
   splitAroundJoins
-} from "./chunk-AL6ML4LA.js";
+} from "./chunk-DWCFGF2K.js";
 import {
   evaluateClause,
   hasFnClause,
   normalizeMatches,
   normalizeSubqueryOperand
-} from "./chunk-5WWDGFOS.js";
+} from "./chunk-GIQJGXV7.js";
 import {
   FieldNotQueryableError,
   QueryExtensionMissingError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/kernel/query/scan-builder.ts
 var DEFAULT_SCAN_PAGE_SIZE = 100;
@@ -190,4 +190,4 @@ for (const [method, subpath] of SCAN_EXTENSION_METHODS) {
 export {
   ScanBuilder
 };
-//# sourceMappingURL=chunk-JQYKPKG6.js.map
+//# sourceMappingURL=chunk-7K42TSCY.js.map

package/dist/{chunk-BPWYQ25R.js → chunk-7Q6IU3R7.js}

@@ -1,13 +1,13 @@
 import {
   readPath
-} from "./chunk-5WWDGFOS.js";
+} from "./chunk-GIQJGXV7.js";
 import {
   installViaBinder
-} from "./chunk-SYNY3VB5.js";
+} from "./chunk-NCTN2FW4.js";
 import {
   NoydbError,
   ValidationError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/via/money/iso4217.ts
 var MINOR_UNITS = {
@@ -1130,4 +1130,4 @@ export {
   decodeMoneyFields,
   exactMath
 };
-//# sourceMappingURL=chunk-BPWYQ25R.js.map
+//# sourceMappingURL=chunk-7Q6IU3R7.js.map