@noy-db/hub 0.9.0-pre.0 → 0.9.0-pre.2

package/dist/{chunk-CAD7N6HQ.js → chunk-WIUH6EJ7.js}

@@ -1,9 +1,9 @@
 import {
   matchesReferencingValue
-} from "./chunk-GETUTTZU.js";
+} from "./chunk-PZN76MMV.js";
 import {
   PeriodClosedError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/kernel/via/dispatch.ts
 function touchFor(batch, collection) {
@@ -45,8 +45,8 @@ async function runGraphDispatchWave(vault, batch) {
       try {
         const stored = await coll._getStoredRecordForDispatch(id);
         if (!stored) continue;
-        await coll.dispatchDerivations(id, stored.record, stored.version, wave);
-        await coll.dispatchMaterializedViews(id, stored.record, wave);
+        await coll._dispatchDerivations(id, stored.record, stored.version, wave);
+        await coll._dispatchMaterializedViews(id, stored.record, wave);
       } catch (err) {
         console.warn(`[via-dispatch] wave recompute failed for ${collectionName}/${id}:`, err);
         vault._emit("derivation:wave-error", { collection: collectionName, id, error: err });
@@ -55,8 +55,8 @@ async function runGraphDispatchWave(vault, batch) {
     for (const [id, intents] of touch.deletes) {
       try {
         await coll._recomputeDeletedRollups(intents, wave);
-        await coll.dispatchMaterializedViewsOnDelete(id);
-        await coll.dispatchArrayDerivationsOnDelete(id);
+        await coll._dispatchMaterializedViewsOnDelete(id);
+        await coll._dispatchArrayDerivationsOnDelete(id);
       } catch (err) {
         console.warn(`[via-dispatch] wave delete-recompute failed for ${collectionName}/${id}:`, err);
         vault._emit("derivation:wave-error", { collection: collectionName, id, error: err });
@@ -99,7 +99,7 @@ function ledgerAuditHook(ledger, actor) {
 async function forgetDerivedFanout(vault, ref, envelope, stats, lookupCompareKeys) {
   const coll = vault._getCollection(ref.collection);
   if (coll) {
-    const mv = await coll.dispatchMaterializedViewsOnDelete(ref.id);
+    const mv = await coll._dispatchMaterializedViewsOnDelete(ref.id);
     stats.recordsErased += mv.deleted;
     stats.derivedResidueUndecodable.push(...mv.residueUndecodable);
     stats.derivedResidueDeclined.push(...mv.residueDeclined);
@@ -113,12 +113,12 @@ async function forgetDerivedFanout(vault, ref, envelope, stats, lookupCompareKey
     stats.lookupReferencesResidue.push(...residue);
   }
   if (edges.some((e) => e.kind === "derivation")) {
-    stats.recordsErased += await coll.dispatchArrayDerivationsOnDelete(ref.id, true);
+    stats.recordsErased += await coll._dispatchArrayDerivationsOnDelete(ref.id, true);
   }
   if (envelope && edges.some((e) => e.kind === "rollup")) {
     const priorRecord = await coll._decodeEnvelope(envelope, ref.id);
     if (priorRecord) {
-      for (const r of await coll.dispatchRollupsOnDelete(ref.id, priorRecord)) {
+      for (const r of await coll._dispatchRollupsOnDelete(ref.id, priorRecord)) {
         if (r.outcome === "written") stats.aggregatesRecomputed += 1;
         else if (r.outcome === "skipped-frozen") stats.residueFrozen.push(`${r.into}:${r.parentId}`);
       }
@@ -173,4 +173,4 @@ export {
   forgetDerivedFanout,
   selfWriteFieldEqual
 };
-//# sourceMappingURL=chunk-CAD7N6HQ.js.map
+//# sourceMappingURL=chunk-WIUH6EJ7.js.map

package/dist/chunk-WIUH6EJ7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/via/dispatch.ts"],"sourcesContent":["// kernel/via/dispatch.ts — the batched, origin-aware sync/cutover/restore dispatch wave\n// (Via port phase C, #638 Task 4, fixes #621).\n//\n// `Collection._onRecordMutated`'s `sync-apply`/`cutover`/`restore` cases feed touched\n// (collection, id) pairs into a per-session `GraphBatch` (owned by `Vault._collectGraphTouch`)\n// instead of dispatching inline — the `local-write` path keeps its own byte-identical inline\n// dispatch (`wave` stays `undefined` there, per the spec's behavior lock). At batch-flush time\n// `runGraphDispatchWave` decrypts each touched record (id threaded into the decrypt, matching\n// the phase-B at-rest contract) and re-runs the SAME `dispatchDerivations`/\n// `dispatchMaterializedViews` the local-write path uses, sharing one `WaveContext` so N touched\n// records feeding the SAME rollup/MV target recompute exactly once (per-target dedup).\n// See design-history/2026-07-11-via-phase-c-design.md §3.\n\nimport type { ViaGraph } from './graph.js'\nimport type { Collection } from '../collection.js'\nimport type { EncryptedEnvelope } from '../types.js'\nimport { PeriodClosedError } from '../errors.js'\nimport { matchesReferencingValue } from '../../port/with/lookup-strategy.js'\n\n/** One deleted child's resolved rollup PARENT intent (#640) — ids + a field name only. A\n *  resolved `parentId` is an id, same class as any touched record id — never a stored value. */\nexport interface RollupDeleteIntent {\n  readonly into: string\n  readonly parentId: string\n  readonly field: string\n}\n\n/** One collection's batched touches this session (#640 widens the #638 `Set<string>` shape):\n *  `puts` — the original semantics, unchanged; `deletes` — a deleted record's id mapped to its\n *  resolved rollup-parent intents, captured PRE-invalidation by `Collection._onRecordMutated`'s\n *  sync-apply delete case (the FK is only readable there — see `kernel/collection.ts\n *  #_rollupDeleteIntents`). */\nexport interface GraphTouch {\n  readonly puts: Set<string>\n  readonly deletes: Map<string, readonly RollupDeleteIntent[]>\n}\n\n/** Per-session touched set — collection → its `GraphTouch`. Metadata only — ids (collection\n *  names, record ids INCLUDING resolved rollup parent ids) and field names; NEVER record payload\n *  or key material. A resolved parentId is an id, same class as the touched ids — not a stored\n *  value. */\nexport type GraphBatch = Map<string, GraphTouch>\n\n/** Get-or-create `batch`'s `GraphTouch` entry for `collection` (#640) — shared by\n *  `Vault._collectGraphTouch`/`_collectGraphDelete` so each stays a one-line call. */\nexport function touchFor(batch: GraphBatch, collection: string): GraphTouch {\n  let t = batch.get(collection)\n  if (!t) {\n    t = { puts: new Set(), deletes: new Map() }\n    batch.set(collection, t)\n  }\n  return t\n}\n\n/** #640 — sync, I/O-free: `deleted`'s resolved rollup PARENT intents (the FK is only readable\n *  NOW, before the record is gone) — a pure function so `Collection._rollupDeleteIntents` stays\n *  a one-line delegator under the kernel-surface ceiling. `registry` is `this.derivationSource\n *  ?.registry()`; `collectionName` is `this.name` (the CHILD/`rollup.from` side). Generic over\n *  the registry's own spec shape so this file never imports a `with-formula` type (port-layering\n *  — via/dispatch.ts must not gain a with-* import). */\nexport function resolveRollupDeleteIntents<S extends { source: string; rollup?: { from: string; key: string; field: string } }>(\n  registry: { strategiesForSource(name: string): ReadonlyArray<{ spec: S }> } | undefined,\n  collectionName: string,\n  deleted: Record<string, unknown>,\n): RollupDeleteIntent[] {\n  if (!registry) return []\n  const intents: RollupDeleteIntent[] = []\n  for (const { spec } of registry.strategiesForSource(collectionName)) {\n    if (!spec.rollup || spec.rollup.from !== collectionName) continue\n    const kv = deleted[spec.rollup.key]\n    if (typeof kv === 'string' || typeof kv === 'number') intents.push({ into: spec.source, parentId: String(kv), field: spec.rollup.field })\n  }\n  return intents\n}\n\n/** #640 — resolve a `RollupDeleteIntent` back to its registry `spec`. The wave's per-intent\n *  driver needs `spec.rollup.compute`, which `GraphBatch`'s metadata-only pin forbids batching —\n *  so it's re-resolved here, post-boundary, instead of carried across it. `undefined` if the\n *  intent's originating strategy was unregistered between collect time and wave time (residual\n *  gap, freshness-only). */\nexport function findRollupSpecForIntent<S extends { source: string; rollup?: { from: string; field: string } }>(\n  registry: { strategiesForSource(name: string): ReadonlyArray<{ spec: S }> } | undefined,\n  collectionName: string,\n  intent: RollupDeleteIntent,\n): S | undefined {\n  return registry?.strategiesForSource(collectionName).find((s) => s.spec.source === intent.into && s.spec.rollup?.field === intent.field && s.spec.rollup?.from === collectionName)?.spec\n}\n\n/** One dedup ledger for a single wave — a target is recomputed at most once (mark-on-check). */\nexport class WaveContext {\n  private readonly _seen = new Set<string>()\n  seen(targetKey: string): boolean {\n    if (this._seen.has(targetKey)) return true\n    this._seen.add(targetKey)\n    return false\n  }\n}\n\n/** The slice of `Vault` the wave needs: the shared graph (the #553 zero-cost skip) and cached-\n *  collection lookup — never constructs, since a touched collection is, by construction,\n *  already open (it just fired `_onRecordMutated`). */\nexport interface VaultLike {\n  readonly graph: ViaGraph\n  _getCollection(name: string): Collection<Record<string, unknown>> | undefined\n  /** #640 (#644 item 3) — structured wave-error surfacing, additive to the existing console.warn. */\n  _emit(event: string, payload: unknown): void\n}\n\n/**\n * Run ONE dispatch wave for a completed batch: for each touched (collection, id), decrypt the\n * applied envelope (id threaded), then run the SAME `dispatchDerivations` +\n * `dispatchMaterializedViews` the local-write path uses — with a shared `WaveContext` so N\n * touched records feeding the SAME target recompute once. #553: a collection with no graph\n * out-edges (e.g. money-only) is skipped before any decrypt/dispatch async work.\n */\nexport async function runGraphDispatchWave(vault: VaultLike, batch: GraphBatch): Promise<void> {\n  const wave = new WaveContext()\n  for (const [collectionName, touch] of batch) {\n    if (vault.graph.dependentsOf(collectionName).length === 0) continue\n    const coll = vault._getCollection(collectionName)\n    if (!coll) continue\n    for (const id of touch.puts) {\n      try {\n        // Decrypt is INSIDE the per-id isolation boundary (whole-branch review Important\n        // finding, #638): an undecryptable synced envelope (`TamperedError`) must not\n        // escape `_getStoredRecordForDispatch` and abort the wave — that would propagate\n        // through `_flushGraphBatch` and reject the surrounding `SyncEngine.pull`/`push`\n        // AFTER records were already applied + meta persisted, starving every other\n        // touched target in the same batch.\n        const stored = await coll._getStoredRecordForDispatch(id)\n        if (!stored) continue\n        await coll._dispatchDerivations(id, stored.record, stored.version, wave)\n        await coll._dispatchMaterializedViews(id, stored.record, wave)\n      } catch (err) {\n        // #638 Task 5 review mandate: one touched record's recompute must not abort the\n        // whole wave (starving co-batched healthy targets) or the pull/push it's nested\n        // inside. `PeriodClosedError` never reaches here — `putDerivedOutput` already\n        // intercepts it at every output-write call site and turns it into a skip+event.\n        // Anything else (a genuine decrypt failure, a derive()/executor bug, a schema\n        // violation on the output, ...) is surfaced — not silently swallowed — via the\n        // SAME console.warn channel `dispatchDerivations`/the MV executor already use for\n        // their own non-strict-mode output failures, then isolated to just this one id.\n        // #644 item 3: ADDITIVELY (never in place of the warn) emit a structured event too,\n        // so a listener doesn't have to scrape console output to react to a wave failure.\n        console.warn(`[via-dispatch] wave recompute failed for ${collectionName}/${id}:`, err)\n        vault._emit('derivation:wave-error', { collection: collectionName, id, error: err })\n      }\n    }\n    // #640 — delete-kind touches: the deleted child's rollup-parent intents, resolved (sync,\n    // pre-invalidation) at collect time by `Collection._rollupDeleteIntents`. Same per-id\n    // isolation as the puts loop above. #658: the wave now ALSO heals MV rows and array-shape\n    // derivation output rows for the deleted child — parity with the local-delete boundary\n    // (`Collection._doDelete`'s `!internal` block, which already calls all three). Still never\n    // routed through `dispatchDerivations` (the mutation-choke-point.test.ts:85-99 pin — sync-\n    // applied deletes never RE-DERIVE); `dispatchMaterializedViewsOnDelete`/\n    // `dispatchArrayDerivationsOnDelete` only need `id` (MV refresh recomputes+diffs; array-\n    // derivation reads its per-source sidecar) and never call `derive()`, so the pin holds.\n    for (const [id, intents] of touch.deletes) {\n      try {\n        await coll._recomputeDeletedRollups(intents, wave)\n        // #658: record-shape same-id outputs are left untouched (eraseRecordShapeToo defaults\n        // false), matching local delete — the user deletes those directly if wanted.\n        // #658: TODO dedup MV refresh per wave — `dispatchMaterializedViewsOnDelete` doesn't\n        // accept a `WaveContext` (unlike the put-path `dispatchMaterializedViews`), so N deleted\n        // children of one eager MV in a batch each trigger a full refresh pass. Threading `wave`\n        // through would touch collection.ts's zero-slack kernel-surface ceiling for a perf-only\n        // win; correctness doesn't depend on it (idempotent per source-id) — left as a follow-up.\n        await coll._dispatchMaterializedViewsOnDelete(id)\n        await coll._dispatchArrayDerivationsOnDelete(id)\n      } catch (err) {\n        console.warn(`[via-dispatch] wave delete-recompute failed for ${collectionName}/${id}:`, err)\n        vault._emit('derivation:wave-error', { collection: collectionName, id, error: err })\n      }\n    }\n  }\n}\n\n/** A record's post-freeze source mutation, for the `'derivation:skipped-frozen'` event\n *  and the optional audit-trail entry. See {@link putDerivedOutput}. */\nexport interface DerivationSkippedFrozen {\n  readonly source: { readonly collection: string; readonly id: string }\n  readonly target: { readonly collection: string; readonly id: string }\n  readonly period: string\n  readonly endDate: string\n}\n\n/** The minimal put-capable shape `putDerivedOutput` needs. Any `Collection<T>` structurally\n *  satisfies this — its real `options` type is a superset of what's declared here. */\nexport interface CollectionLike {\n  put(id: string, value: unknown, options?: { readonly source?: string }): Promise<void>\n}\n\nexport interface PutDerivedOutputCtx {\n  readonly emit: (ev: string, p: unknown) => void\n  readonly source: { readonly collection: string; readonly id: string }\n  readonly audit?: ((e: DerivationSkippedFrozen) => Promise<void>) | undefined\n}\n\n/**\n * Attempt a dispatch-driven output write. On `PeriodClosedError` (the closed-period\n * `beforePut` gate — `freezePeriod`/`archivePeriod` add no separate gate, per seam map\n * Part 7): SKIP (no `_ts` stamped — the gate throws before any write happens), emit\n * `'derivation:skipped-frozen'` on the event bus (ALWAYS), and append an audit-trail entry\n * when the with-history ledger is active. Returns `'written' | 'skipped-frozen'`. Any OTHER\n * error propagates unchanged — this helper narrows exactly one error class. The SOURCE\n * write is never wrapped through this helper — only derived-output writes are (§7).\n */\nexport async function putDerivedOutput(\n  outColl: CollectionLike, id: string, value: unknown,\n  ctx: PutDerivedOutputCtx,\n  options?: { readonly source?: string },\n): Promise<'written' | 'skipped-frozen'> {\n  try {\n    await outColl.put(id, value, options)\n    return 'written'\n  } catch (err) {\n    if (!(err instanceof PeriodClosedError)) throw err\n    // Reach-around for the target collection's private `name` — the SAME pattern\n    // `with-formula/materialized-views/executor.ts`'s `listOutputIds` already uses to\n    // read a `Collection`'s private `adapter`/`vault`/`name` fields from outside the class.\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const targetCollection = (outColl as any).name as string\n    const event: DerivationSkippedFrozen = {\n      source: ctx.source,\n      target: { collection: targetCollection, id },\n      period: err.periodName,\n      endDate: err.endDate,\n    }\n    ctx.emit('derivation:skipped-frozen', event)\n    if (ctx.audit) await ctx.audit(event)\n    return 'skipped-frozen'\n  }\n}\n\n/** Structural (no static import — kernel spine may not statically reach a with-* service,\n *  the S4 gate recipe `check-architecture.mjs`'s port-layering check enforces) shape of the\n *  with-history `LedgerStore.append` seam this helper needs. */\ninterface AuditLedgerLike {\n  append(input: {\n    readonly op: 'lifecycle'\n    readonly collection: string\n    readonly id: string\n    readonly version: number\n    readonly actor: string\n    readonly payloadHash: string\n    readonly reason?: string\n  }): Promise<unknown>\n}\n\n/** @internal — the optional with-history ledger audit hook for `putDerivedOutput`, present\n *  only when the ledger is active (mirrors every other kernel event's `if (this.ledger)`\n *  gate). Encoded as a `'lifecycle'` entry — the existing \"non-data audit event\" op (the\n *  same convention `forget`'s JSON-summary-in-`reason` entry uses; `ledger/entry.ts:88-104`). */\nexport function ledgerAuditHook(\n  ledger: AuditLedgerLike | undefined, actor: string,\n): ((e: DerivationSkippedFrozen) => Promise<void>) | undefined {\n  if (!ledger) return undefined\n  return async (e) => {\n    await ledger.append({\n      op: 'lifecycle', collection: e.target.collection, id: e.target.id, version: 0, actor, payloadHash: '',\n      reason: JSON.stringify({ event: 'derivation-skipped-frozen', ...e }),\n    })\n  }\n}\n\n/** `recomputeRollup`/`dispatchRollupsOnDelete`'s per-target write outcome (#638 Task 6):\n *  `'written'`/`'skipped-frozen'` mirror {@link putDerivedOutput}'s result; `'noop'` covers\n *  no-parent/no-change/deduped-by-wave — nothing to report either way. */\nexport type RollupOutcome = 'written' | 'skipped-frozen' | 'noop'\n\n/** Mutable accumulator `forgetDerivedFanout` writes into, one per `Vault.forget()` call — keeps\n *  the per-ref loop's call site to a single line under vault.ts's tight kernel-surface ceiling.\n *  Maps 1:1 onto `ForgetResult`'s additive fields (`with-audit/forget/strategy.ts`). */\nexport interface ForgetFanoutStats {\n  recordsErased: number\n  aggregatesRecomputed: number\n  readonly residueFrozen: string[]\n  /** #650 Task 5 (#648) — referencing records tombstoned via a `'ref'` edge's `cascade` policy. */\n  lookupReferencesCascaded: number\n  /** #650 Task 5 (#648) — referencing fields cleared via a `'ref'` edge's `nullify` policy. */\n  lookupReferencesNullified: number\n  /** #650 Task 5 review (Important fix) — `'ref'` edges whose compare-key could NOT be resolved,\n   *  even from the LIVE pre-shred row (the backing row itself is unreadable) — propagation was\n   *  skipped for these, reported here so the skip is never silent. `backing:key:collection.field`\n   *  entries, one per un-propagated edge. */\n  readonly lookupReferencesResidue: string[]\n  /** #776/#782/#785 — `outputCollection:id` MV-output rows that survived erasure invalidation\n   *  (eager tombstone leg AND lazy/manual `invalidateMVAtRest`) despite belonging to the\n   *  forgotten subject, because the ownership stamp could not be decoded (undecodable under\n   *  the default DEK — e.g. elevated above tier 0 on a tiered output collection). Ownership\n   *  UNCONFIRMED. Never erased, but surfaced here rather than silently skipped. */\n  readonly derivedResidueUndecodable: string[]\n  /** #782/#785 — `outputCollection:id` MV-output rows that decoded and stamp-matched but whose\n   *  `_internalDelete` declined (the #718 tier-elevation gate). Ownership CONFIRMED, erasure\n   *  declined — a real silent survival, surfaced here rather than silently skipped. */\n  readonly derivedResidueDeclined: string[]\n}\n\n/**\n * #622 — after `_writeTombstone(ref.id, actor)` erases the forgotten subject's own record, fan\n * out to its derived residue via the graph (spec §5): record-grain artifacts (MV rows,\n * array-shape derivation rows, same-id record-shape derivation copies) are ERASED through the\n * SAME `!internal` housekeeping-bypass machinery the ordinary delete path uses (no user\n * `onDelete` re-fires — the shred-is-not-a-domain-delete property `_writeTombstone` protects);\n * aggregate-grain rollups are RECOMPUTED without the forgotten contribution in open periods, or\n * skip+audit (via `putDerivedOutput`, already wired into the rollup/MV output paths) in frozen\n * ones. Mutates `stats` in place. `envelope` is `ref`'s PRE-tombstone envelope, decoded only if\n * a rollup edge is actually present — the #553 zero-cost-skip discipline: no decrypt for the\n * common case of a forgotten record with no aggregate-grain consumer, and no work at all when\n * `ref.collection` has no graph out-edges. `lookupCompareKeys` is the `'ref'` edges' compare-key\n * map, resolved from the LIVE row BEFORE any shred (`VaultLinks.checkLookupRefsRestrict`'s return\n * value — `Vault.forget()`'s pre-shred restrict check doubles as the live-resolve pass) — see\n * {@link applyLookupRefsFanout}.\n */\nexport async function forgetDerivedFanout(\n  vault: VaultLike,\n  ref: { readonly collection: string; readonly id: string },\n  envelope: EncryptedEnvelope | null,\n  stats: ForgetFanoutStats,\n  lookupCompareKeys: ReadonlyMap<string, string | undefined>,\n): Promise<void> {\n  const coll = vault._getCollection(ref.collection)\n\n  // #761 item 4 — drive the MV arm off `dispatchMaterializedViewsOnDelete` UNCONDITIONALLY,\n  // ABOVE the `edges` check below: `registry.edges()` drops the same-collection\n  // partition-disjoint MV edge (registry.ts's `sources.length === 0 → continue`), so a\n  // same-collection MV's source collection never appears in `vault.graph`'s derived-artifact\n  // edges even though the MV IS registered — forget() would otherwise never reach it.\n  // `dispatchMaterializedViewsOnDelete` self-guards O(1) via `mvsForSource` (a no-op when\n  // this collection isn't an MV source), so this is safe to call unconditionally. Safe to\n  // route through the eager executor's tombstone leg ONLY because that leg is now\n  // stamp-scoped (#762) — before that fix this would have opened a NEW forget-time\n  // data-loss path into the unscoped tombstone diff.\n  if (coll) {\n    const mv = await coll._dispatchMaterializedViewsOnDelete(ref.id)\n    stats.recordsErased += mv.deleted\n    stats.derivedResidueUndecodable.push(...mv.residueUndecodable)\n    stats.derivedResidueDeclined.push(...mv.residueDeclined)\n  }\n\n  const edges = vault.graph.derivedArtifactsOf(ref.collection)\n  if (edges.length === 0 || !coll) return\n\n  // #650 Task 5 (#648) — 'ref' cascade/nullify propagate ADDITIVELY, here, AFTER the shred\n  // (restrict already refused BEFORE any shred — the caller's pre-tombstone check, spec §4).\n  // The I/O shell (loop shape, collection accessor) is duplicated, not imported, from\n  // `VaultLinks.applyLookupRefsPropagation`/`checkLookupRefsRestrict` (with-shape/links/\n  // vault-facade.ts) — the kernel spine may not statically import a with-* service\n  // (port-layering, the #638 Task 5 via/dispatch.ts precedent); `vault._getCollection` is\n  // cached-only while `VaultLinks`' accessor constructs. The pure match predicate itself is\n  // shared through the port seam (#651 Task 3 — `matchesReferencingValue`, `port/with/\n  // lookup-strategy.ts`), so only the shell, not the coercion logic, stays duplicated. A\n  // referencing edge whose dimension uses a non-default `key` (matrix tier only) needs the\n  // backing row's OWN value at that field, not its PUT-id — the row is ALREADY tombstoned by\n  // now, so it's read from `lookupCompareKeys`, resolved by the caller from the LIVE row\n  // BEFORE the shred (#650 Task 5 review, Important fix — eliminates the post-shred\n  // envelope-decode dependency this used to have, which silently skipped propagation whenever\n  // that decode failed).\n  if (edges.some((e) => e.kind === 'ref')) {\n    const { cascaded, nullified, residue } = await applyLookupRefsFanout(vault, ref.collection, ref.id, lookupCompareKeys)\n    stats.lookupReferencesCascaded += cascaded\n    stats.lookupReferencesNullified += nullified\n    stats.lookupReferencesResidue.push(...residue)\n  }\n\n  if (edges.some((e) => e.kind === 'derivation')) {\n    // #622 review Finding 1: count REAL erasures (dispatchArrayDerivationsOnDelete's own\n    // `_internalDelete`-backed tally), not the derivation EDGE count — an edge exists whenever\n    // this collection is ANY trigger (source/sources[]/triggerBy), but the same-id record-shape\n    // guard only erases for `spec.source === this.name`, and `derive()` may never have produced\n    // an output row (optional-skip) in the first place. Both cases must contribute 0, not +1.\n    stats.recordsErased += await coll._dispatchArrayDerivationsOnDelete(ref.id, true)\n  }\n\n  if (envelope && edges.some((e) => e.kind === 'rollup')) {\n    const priorRecord = await coll._decodeEnvelope(envelope, ref.id)\n    if (priorRecord) {\n      for (const r of await coll._dispatchRollupsOnDelete(ref.id, priorRecord)) {\n        if (r.outcome === 'written') stats.aggregatesRecomputed += 1\n        else if (r.outcome === 'skipped-frozen') stats.residueFrozen.push(`${r.into}:${r.parentId}`)\n      }\n    }\n  }\n}\n\n/**\n * Apply `cascade`/`nullify` propagation for `backing`'s non-restrict `'ref'` edges — the\n * forget-path counterpart of `VaultLinks.applyLookupRefsPropagation` (I/O shell duplicated, not\n * imported, match predicate shared via the port — see {@link forgetDerivedFanout}'s call site\n * comment). `restrict` edges are skipped here: the\n * forget loop's `checkLookupRefsRestrict`-equivalent call already refused (or the reference no\n * longer existed) BEFORE `_writeTombstone` ran, so by the time this runs only cascade/nullify\n * remain to propagate. `compareKeys` is the non-`'id'`-`keyField` compare-value map, resolved by\n * the caller from the LIVE row BEFORE the shred (#650 Task 5 review, Important fix) — the live row\n * is already shredded by the time THIS function runs, so it can no longer resolve one itself. A\n * `keyField` absent from (or `undefined` in) the map means that live resolve failed too — the edge\n * is reported as residue instead of silently skipped (never a bare `continue` with no trace).\n */\nasync function applyLookupRefsFanout(\n  vault: VaultLike,\n  backing: string,\n  key: string,\n  compareKeys: ReadonlyMap<string, string | undefined>,\n): Promise<{ cascaded: number; nullified: number; residue: string[] }> {\n  let cascaded = 0\n  let nullified = 0\n  const residue: string[] = []\n  for (const { referencing, onDelete, keyField } of vault.graph.referencingEdgesOf(backing)) {\n    if (onDelete === 'restrict') continue\n    const compareKey = keyField === 'id' ? key : compareKeys.get(keyField)\n    if (compareKey === undefined) {\n      residue.push(`${backing}:${key}:${referencing.collection}.${referencing.field}`)\n      continue\n    }\n    const coll = vault._getCollection(referencing.collection)\n    if (!coll) continue\n    const matches = (await coll.list()).filter((rec) => matchesReferencingValue(rec, referencing.field, compareKey))\n    for (const rec of matches) {\n      const id = rec['id'] as string | undefined\n      if (id === undefined) continue\n      if (onDelete === 'cascade') {\n        await coll.delete(id)\n        cascaded++\n      } else if (onDelete === 'nullify') {\n        await coll.put(id, { ...rec, [referencing.field]: null })\n        nullified++\n      }\n    }\n  }\n  return { cascaded, nullified, residue }\n}\n\n/**\n * Value-equality for a single self-write reverse-denorm field. Scalars\n * compare by identity; objects by canonical JSON (denorm values should be\n * deterministically shaped). Used as the cycle guard — when every denorm\n * field already matches, no write is issued and the self-write recursion ends.\n */\nexport function selfWriteFieldEqual(a: unknown, b: unknown): boolean {\n  if (a === b) return true\n  if (a === null || b === null || typeof a !== 'object' || typeof b !== 'object') return false\n  try {\n    return JSON.stringify(a) === JSON.stringify(b)\n  } catch {\n    return false\n  }\n}\n"],"mappings":";;;;;;;;AA6CO,SAAS,SAAS,OAAmB,YAAgC;AAC1E,MAAI,IAAI,MAAM,IAAI,UAAU;AAC5B,MAAI,CAAC,GAAG;AACN,QAAI,EAAE,MAAM,oBAAI,IAAI,GAAG,SAAS,oBAAI,IAAI,EAAE;AAC1C,UAAM,IAAI,YAAY,CAAC;AAAA,EACzB;AACA,SAAO;AACT;AAQO,SAAS,2BACd,UACA,gBACA,SACsB;AACtB,MAAI,CAAC,SAAU,QAAO,CAAC;AACvB,QAAM,UAAgC,CAAC;AACvC,aAAW,EAAE,KAAK,KAAK,SAAS,oBAAoB,cAAc,GAAG;AACnE,QAAI,CAAC,KAAK,UAAU,KAAK,OAAO,SAAS,eAAgB;AACzD,UAAM,KAAK,QAAQ,KAAK,OAAO,GAAG;AAClC,QAAI,OAAO,OAAO,YAAY,OAAO,OAAO,SAAU,SAAQ,KAAK,EAAE,MAAM,KAAK,QAAQ,UAAU,OAAO,EAAE,GAAG,OAAO,KAAK,OAAO,MAAM,CAAC;AAAA,EAC1I;AACA,SAAO;AACT;AAOO,SAAS,wBACd,UACA,gBACA,QACe;AACf,SAAO,UAAU,oBAAoB,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,WAAW,OAAO,QAAQ,EAAE,KAAK,QAAQ,UAAU,OAAO,SAAS,EAAE,KAAK,QAAQ,SAAS,cAAc,GAAG;AACtL;AAGO,IAAM,cAAN,MAAkB;AAAA,EACN,QAAQ,oBAAI,IAAY;AAAA,EACzC,KAAK,WAA4B;AAC/B,QAAI,KAAK,MAAM,IAAI,SAAS,EAAG,QAAO;AACtC,SAAK,MAAM,IAAI,SAAS;AACxB,WAAO;AAAA,EACT;AACF;AAmBA,eAAsB,qBAAqB,OAAkB,OAAkC;AAC7F,QAAM,OAAO,IAAI,YAAY;AAC7B,aAAW,CAAC,gBAAgB,KAAK,KAAK,OAAO;AAC3C,QAAI,MAAM,MAAM,aAAa,cAAc,EAAE,WAAW,EAAG;AAC3D,UAAM,OAAO,MAAM,eAAe,cAAc;AAChD,QAAI,CAAC,KAAM;AACX,eAAW,MAAM,MAAM,MAAM;AAC3B,UAAI;AAOF,cAAM,SAAS,MAAM,KAAK,4BAA4B,EAAE;AACxD,YAAI,CAAC,OAAQ;AACb,cAAM,KAAK,qBAAqB,IAAI,OAAO,QAAQ,OAAO,SAAS,IAAI;AACvE,cAAM,KAAK,2BAA2B,IAAI,OAAO,QAAQ,IAAI;AAAA,MAC/D,SAAS,KAAK;AAWZ,gBAAQ,KAAK,4CAA4C,cAAc,IAAI,EAAE,KAAK,GAAG;AACrF,cAAM,MAAM,yBAAyB,EAAE,YAAY,gBAAgB,IAAI,OAAO,IAAI,CAAC;AAAA,MACrF;AAAA,IACF;AAUA,eAAW,CAAC,IAAI,OAAO,KAAK,MAAM,SAAS;AACzC,UAAI;AACF,cAAM,KAAK,yBAAyB,SAAS,IAAI;AAQjD,cAAM,KAAK,mCAAmC,EAAE;AAChD,cAAM,KAAK,kCAAkC,EAAE;AAAA,MACjD,SAAS,KAAK;AACZ,gBAAQ,KAAK,mDAAmD,cAAc,IAAI,EAAE,KAAK,GAAG;AAC5F,cAAM,MAAM,yBAAyB,EAAE,YAAY,gBAAgB,IAAI,OAAO,IAAI,CAAC;AAAA,MACrF;AAAA,IACF;AAAA,EACF;AACF;AAgCA,eAAsB,iBACpB,SAAyB,IAAY,OACrC,KACA,SACuC;AACvC,MAAI;AACF,UAAM,QAAQ,IAAI,IAAI,OAAO,OAAO;AACpC,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,EAAE,eAAe,mBAAoB,OAAM;AAK/C,UAAM,mBAAoB,QAAgB;AAC1C,UAAM,QAAiC;AAAA,MACrC,QAAQ,IAAI;AAAA,MACZ,QAAQ,EAAE,YAAY,kBAAkB,GAAG;AAAA,MAC3C,QAAQ,IAAI;AAAA,MACZ,SAAS,IAAI;AAAA,IACf;AACA,QAAI,KAAK,6BAA6B,KAAK;AAC3C,QAAI,IAAI,MAAO,OAAM,IAAI,MAAM,KAAK;AACpC,WAAO;AAAA,EACT;AACF;AAqBO,SAAS,gBACd,QAAqC,OACwB;AAC7D,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,OAAO,MAAM;AAClB,UAAM,OAAO,OAAO;AAAA,MAClB,IAAI;AAAA,MAAa,YAAY,EAAE,OAAO;AAAA,MAAY,IAAI,EAAE,OAAO;AAAA,MAAI,SAAS;AAAA,MAAG;AAAA,MAAO,aAAa;AAAA,MACnG,QAAQ,KAAK,UAAU,EAAE,OAAO,6BAA6B,GAAG,EAAE,CAAC;AAAA,IACrE,CAAC;AAAA,EACH;AACF;AAmDA,eAAsB,oBACpB,OACA,KACA,UACA,OACA,mBACe;AACf,QAAM,OAAO,MAAM,eAAe,IAAI,UAAU;AAYhD,MAAI,MAAM;AACR,UAAM,KAAK,MAAM,KAAK,mCAAmC,IAAI,EAAE;AAC/D,UAAM,iBAAiB,GAAG;AAC1B,UAAM,0BAA0B,KAAK,GAAG,GAAG,kBAAkB;AAC7D,UAAM,uBAAuB,KAAK,GAAG,GAAG,eAAe;AAAA,EACzD;AAEA,QAAM,QAAQ,MAAM,MAAM,mBAAmB,IAAI,UAAU;AAC3D,MAAI,MAAM,WAAW,KAAK,CAAC,KAAM;AAiBjC,MAAI,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,KAAK,GAAG;AACvC,UAAM,EAAE,UAAU,WAAW,QAAQ,IAAI,MAAM,sBAAsB,OAAO,IAAI,YAAY,IAAI,IAAI,iBAAiB;AACrH,UAAM,4BAA4B;AAClC,UAAM,6BAA6B;AACnC,UAAM,wBAAwB,KAAK,GAAG,OAAO;AAAA,EAC/C;AAEA,MAAI,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,YAAY,GAAG;AAM9C,UAAM,iBAAiB,MAAM,KAAK,kCAAkC,IAAI,IAAI,IAAI;AAAA,EAClF;AAEA,MAAI,YAAY,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ,GAAG;AACtD,UAAM,cAAc,MAAM,KAAK,gBAAgB,UAAU,IAAI,EAAE;AAC/D,QAAI,aAAa;AACf,iBAAW,KAAK,MAAM,KAAK,yBAAyB,IAAI,IAAI,WAAW,GAAG;AACxE,YAAI,EAAE,YAAY,UAAW,OAAM,wBAAwB;AAAA,iBAClD,EAAE,YAAY,iBAAkB,OAAM,cAAc,KAAK,GAAG,EAAE,IAAI,IAAI,EAAE,QAAQ,EAAE;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;AAeA,eAAe,sBACb,OACA,SACA,KACA,aACqE;AACrE,MAAI,WAAW;AACf,MAAI,YAAY;AAChB,QAAM,UAAoB,CAAC;AAC3B,aAAW,EAAE,aAAa,UAAU,SAAS,KAAK,MAAM,MAAM,mBAAmB,OAAO,GAAG;AACzF,QAAI,aAAa,WAAY;AAC7B,UAAM,aAAa,aAAa,OAAO,MAAM,YAAY,IAAI,QAAQ;AACrE,QAAI,eAAe,QAAW;AAC5B,cAAQ,KAAK,GAAG,OAAO,IAAI,GAAG,IAAI,YAAY,UAAU,IAAI,YAAY,KAAK,EAAE;AAC/E;AAAA,IACF;AACA,UAAM,OAAO,MAAM,eAAe,YAAY,UAAU;AACxD,QAAI,CAAC,KAAM;AACX,UAAM,WAAW,MAAM,KAAK,KAAK,GAAG,OAAO,CAAC,QAAQ,wBAAwB,KAAK,YAAY,OAAO,UAAU,CAAC;AAC/G,eAAW,OAAO,SAAS;AACzB,YAAM,KAAK,IAAI,IAAI;AACnB,UAAI,OAAO,OAAW;AACtB,UAAI,aAAa,WAAW;AAC1B,cAAM,KAAK,OAAO,EAAE;AACpB;AAAA,MACF,WAAW,aAAa,WAAW;AACjC,cAAM,KAAK,IAAI,IAAI,EAAE,GAAG,KAAK,CAAC,YAAY,KAAK,GAAG,KAAK,CAAC;AACxD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,UAAU,WAAW,QAAQ;AACxC;AAQO,SAAS,oBAAoB,GAAY,GAAqB;AACnE,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,MAAM,QAAQ,MAAM,QAAQ,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AACvF,MAAI;AACF,WAAO,KAAK,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-YQFBH5ZJ.js → chunk-WQUIJPN4.js}

@@ -1,9 +1,9 @@
 import {
   buildRecordEnvelope
-} from "./chunk-4J3MNVVX.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   ValidationError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-party/directory/cover/custom.ts
 var CUSTOM_KEY_PATTERN = /^[a-z0-9]+([.-][a-z0-9]+)+$/i;
@@ -230,4 +230,4 @@ export {
   resolveLocale,
   pickLocale
 };
-//# sourceMappingURL=chunk-YQFBH5ZJ.js.map
+//# sourceMappingURL=chunk-WQUIJPN4.js.map

package/dist/{chunk-4J3MNVVX.js → chunk-WRLWEYHY.js}

@@ -49,6 +49,8 @@ import {
   generateEphemeralKey,
   generateIV,
   generateRecipientKeyPair,
+  exportRecipientPrivateKeyPkcs8,
+  importRecipientKeyPair,
   generateRecoverySecret,
   generateSalt,
   generateSigningKeyPair,
@@ -63,6 +65,7 @@ import {
   importDekSet,
   importRecipientPublicKeySpki,
   importTransferKey,
+  importWrappingKey,
   isDeleteMarker,
   isRewrappedUnder,
   isTombstone,
@@ -149,6 +152,8 @@ export {
   generateEphemeralKey,
   generateIV,
   generateRecipientKeyPair,
+  exportRecipientPrivateKeyPkcs8,
+  importRecipientKeyPair,
   generateRecoverySecret,
   generateSalt,
   generateSigningKeyPair,
@@ -163,6 +168,7 @@ export {
   importDekSet,
   importRecipientPublicKeySpki,
   importTransferKey,
+  importWrappingKey,
   isDeleteMarker,
   isRewrappedUnder,
   isTombstone,
@@ -198,4 +204,4 @@ export {
   wrapKey,
   writeEnvelopeBody
 };
-//# sourceMappingURL=chunk-4J3MNVVX.js.map
+//# sourceMappingURL=chunk-WRLWEYHY.js.map

package/dist/{chunk-4J3MNVVX.js.map → chunk-WRLWEYHY.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/capsule/index.ts"],"sourcesContent":["/**\n * THE DOOR. This is the ONLY hub file that may import the bound capsule.\n * Everything else in hub imports THIS file.\n *\n * Enforced by `capsule-door-only` in `scripts/check-architecture.mjs`, which\n * fails any other file naming `#capsule`. A door nothing enforces is not a\n * door — the enclave barrel it replaces was reached around 38 times before a\n * check existed.\n *\n * `#capsule` resolves through hub's `imports` map: `capsule/enclave-aes/` by\n * default, or an alternative package when a consumer sets a build condition.\n *\n * ⛔ THE RE-EXPORTS BELOW ARE EXPLICIT, AND MUST STAY THAT WAY.\n * `export * from '#capsule'` is the obvious spelling and it does not build:\n * `#capsule` is EXTERNAL (it has to be, or the capsule choice bakes in at hub's\n * build time), and esbuild cannot enumerate an external module's exports. Every\n * named import through the door then fails with \"No matching export\". Measured\n * 2026-09-12.\n *\n * Generated from `__tests__/enclave-surface.golden.json` — the same artefact\n * the surface test freezes, so the door and the golden cannot drift. Adding a\n * capsule primitive means adding it to the golden and regenerating.\n */\nexport {\n  RecordCodec,\n  SEALED_CEK_NS,\n  applyRewrappedBody,\n  base64ToBuffer,\n  bufferToBase64,\n  buildDeleteMarker,\n  buildRecordAad,\n  buildRecordEnvelope,\n  buildSealedRecordEnvelope,\n  buildTombstone,\n  capabilities,\n  checkCanary,\n  computeBidxTarget,\n  computeBrokerProof,\n  ctEqualTags,\n  decrypt,\n  decryptBytes,\n  decryptBytesWithAAD,\n  decryptDeterministic,\n  deriveBlobAddressKey,\n  deriveBrokerProofBits,\n  deriveBrokerProofKey,\n  deriveClassifyIndexKey,\n  deriveClassifyIndexSalt,\n  deriveDeterministicKey,\n  deriveEchoKey,\n  deriveKey,\n  derivePresenceKey,\n  derivePresenceTagKey,\n  deriveSealedFieldKey,\n  deriveSealedFieldKeyFromCek,\n  deriveSecretKey,\n  deriveVdigSlotKey,\n  encodeEchoParts,\n  encrypt,\n  encryptBytes,\n  encryptBytesWithAAD,\n  encryptDeterministic,\n  envelopeBodyForHash,\n  envelopeBodySize,\n  envelopeOpensUnderAny,\n  evaluateKofN,\n  exportDekSet,\n  exportRecipientPublicKeySpki,\n  findByDet,\n  generateDEK,\n  generateEphemeralKey,\n  generateIV,\n  generateRecipientKeyPair,\n  generateRecoverySecret,\n  generateSalt,\n  generateSigningKeyPair,\n  hasPerRecordKey,\n  hasSealedBody,\n  requireSealedBody,\n  sealedBodyArgs,\n  hkdfAesGcmKey,\n  hmacSha256Hex,\n  hmacSignHex,\n  importCek,\n  importDekSet,\n  importRecipientPublicKeySpki,\n  importTransferKey,\n  isDeleteMarker,\n  isRewrappedUnder,\n  isTombstone,\n  isTombstoneShape,\n  issueChallenge,\n  makeReservedEnvelopes,\n  mintBidxTag,\n  mintCanary,\n  openEnvelopeJson,\n  pbkdf2VerifyDigest,\n  queryByDet,\n  recipientUnwrap,\n  recipientWrap,\n  recordAadFor,\n  rekeyBlobSet,\n  rekeyEnvelopeIfNeeded,\n  rekeyEnvelopeToDek,\n  resolveStableCek,\n  revokeSealedRecord,\n  rewrapBodyToDek,\n  rewrapEnvelope,\n  rotateRecordCek,\n  sealRecordToHost,\n  sha256Bytes,\n  sha256Hex,\n  signBytes,\n  unwrapCek,\n  unwrapKey,\n  verifyBrokerProof,\n  verifyBytes,\n  verifyRecordIdentity,\n  wrapCek,\n  wrapKey,\n  writeEnvelopeBody,\n} from '#capsule'\n\nexport type {\n  BrokerMemberIdentity,\n  BrokerProofCanonicalParts,\n  DeterministicContext,\n  EchoSecretParts,\n  EnclaveKey,\n  EnclaveKeyPair,\n  EncryptResult,\n  IssuedChallenge,\n  RecordEnvelopeBody,\n  RecordIdentity,\n  RecordRef,\n  RewrappedBody,\n  SealedShredSlot,\n  SealingContext,\n  SecretKeyUsage,\n  VerifyBrokerProofArgs,\n} from '#capsule'\n\nexport type { CapsuleKey, CapsuleKeyPair, CapsuleGroup } from './contract.js'\nexport { CapsuleNotSupportedError } from './contract.js'\n"],"mappings":";AAuBA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;","names":[]}
+{"version":3,"sources":["../src/capsule/index.ts"],"sourcesContent":["/**\n * THE DOOR. This is the ONLY hub file that may import the bound capsule.\n * Everything else in hub imports THIS file.\n *\n * Enforced by `capsule-door-only` in `scripts/check-architecture.mjs`, which\n * fails any other file naming `#capsule`. A door nothing enforces is not a\n * door — the enclave barrel it replaces was reached around 38 times before a\n * check existed.\n *\n * `#capsule` resolves through hub's `imports` map: `capsule/enclave-aes/` by\n * default, or an alternative package when a consumer sets a build condition.\n *\n * ⛔ THE RE-EXPORTS BELOW ARE EXPLICIT, AND MUST STAY THAT WAY.\n * `export * from '#capsule'` is the obvious spelling and it does not build:\n * `#capsule` is EXTERNAL (it has to be, or the capsule choice bakes in at hub's\n * build time), and esbuild cannot enumerate an external module's exports. Every\n * named import through the door then fails with \"No matching export\". Measured\n * 2026-09-12.\n *\n * Generated from `__tests__/enclave-surface.golden.json` — the same artefact\n * the surface test freezes, so the door and the golden cannot drift. Adding a\n * capsule primitive means adding it to the golden and regenerating.\n */\nexport {\n  RecordCodec,\n  SEALED_CEK_NS,\n  applyRewrappedBody,\n  base64ToBuffer,\n  bufferToBase64,\n  buildDeleteMarker,\n  buildRecordAad,\n  buildRecordEnvelope,\n  buildSealedRecordEnvelope,\n  buildTombstone,\n  capabilities,\n  checkCanary,\n  computeBidxTarget,\n  computeBrokerProof,\n  ctEqualTags,\n  decrypt,\n  decryptBytes,\n  decryptBytesWithAAD,\n  decryptDeterministic,\n  deriveBlobAddressKey,\n  deriveBrokerProofBits,\n  deriveBrokerProofKey,\n  deriveClassifyIndexKey,\n  deriveClassifyIndexSalt,\n  deriveDeterministicKey,\n  deriveEchoKey,\n  deriveKey,\n  derivePresenceKey,\n  derivePresenceTagKey,\n  deriveSealedFieldKey,\n  deriveSealedFieldKeyFromCek,\n  deriveSecretKey,\n  deriveVdigSlotKey,\n  encodeEchoParts,\n  encrypt,\n  encryptBytes,\n  encryptBytesWithAAD,\n  encryptDeterministic,\n  envelopeBodyForHash,\n  envelopeBodySize,\n  envelopeOpensUnderAny,\n  evaluateKofN,\n  exportDekSet,\n  exportRecipientPublicKeySpki,\n  findByDet,\n  generateDEK,\n  generateEphemeralKey,\n  generateIV,\n  generateRecipientKeyPair,\n  exportRecipientPrivateKeyPkcs8,\n  importRecipientKeyPair,\n  generateRecoverySecret,\n  generateSalt,\n  generateSigningKeyPair,\n  hasPerRecordKey,\n  hasSealedBody,\n  requireSealedBody,\n  sealedBodyArgs,\n  hkdfAesGcmKey,\n  hmacSha256Hex,\n  hmacSignHex,\n  importCek,\n  importDekSet,\n  importRecipientPublicKeySpki,\n  importTransferKey,\n  importWrappingKey,\n  isDeleteMarker,\n  isRewrappedUnder,\n  isTombstone,\n  isTombstoneShape,\n  issueChallenge,\n  makeReservedEnvelopes,\n  mintBidxTag,\n  mintCanary,\n  openEnvelopeJson,\n  pbkdf2VerifyDigest,\n  queryByDet,\n  recipientUnwrap,\n  recipientWrap,\n  recordAadFor,\n  rekeyBlobSet,\n  rekeyEnvelopeIfNeeded,\n  rekeyEnvelopeToDek,\n  resolveStableCek,\n  revokeSealedRecord,\n  rewrapBodyToDek,\n  rewrapEnvelope,\n  rotateRecordCek,\n  sealRecordToHost,\n  sha256Bytes,\n  sha256Hex,\n  signBytes,\n  unwrapCek,\n  unwrapKey,\n  verifyBrokerProof,\n  verifyBytes,\n  verifyRecordIdentity,\n  wrapCek,\n  wrapKey,\n  writeEnvelopeBody,\n} from '#capsule'\n\nexport type {\n  BrokerMemberIdentity,\n  BrokerProofCanonicalParts,\n  DeterministicContext,\n  EchoSecretParts,\n  EnclaveKey,\n  EnclaveKeyPair,\n  EncryptResult,\n  IssuedChallenge,\n  RecordEnvelopeBody,\n  RecordIdentity,\n  RecordRef,\n  RewrappedBody,\n  SealedShredSlot,\n  SealingContext,\n  SecretKeyUsage,\n  VerifyBrokerProofArgs,\n} from '#capsule'\n\nexport type { CapsuleKey, CapsuleKeyPair, CapsuleGroup } from './contract.js'\nexport { CapsuleNotSupportedError } from './contract.js'\n"],"mappings":";AAuBA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;","names":[]}

package/dist/{chunk-NZULV7LK.js → chunk-WVQDY3UM.js}

@@ -1,13 +1,13 @@
 import {
   envelopePayloadHash
-} from "./chunk-2WJKJZSO.js";
+} from "./chunk-QHG7GQKM.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-2ELOCEXE.js";
+} from "./chunk-URGHKZPL.js";
 import {
   DictKeyMissingError,
   PermissionDeniedError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/via/lookup/handle.ts
 function isDeleteMarker(envelope) {
@@ -392,4 +392,4 @@ export {
   dictCollectionName,
   LookupHandle
 };
-//# sourceMappingURL=chunk-NZULV7LK.js.map
+//# sourceMappingURL=chunk-WVQDY3UM.js.map

package/dist/{chunk-3Y5JLSXS.js → chunk-X5RGG3ZW.js}

@@ -1,7 +1,7 @@
 import {
   NonAdditiveSchemaChangeError,
   SchemaLockedError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-shape/schema-update/strategies.ts
 function blindUpdate() {
@@ -62,4 +62,4 @@ export {
   lockSchema,
   coordinatedCutover
 };
-//# sourceMappingURL=chunk-3Y5JLSXS.js.map
+//# sourceMappingURL=chunk-X5RGG3ZW.js.map

package/dist/{chunk-PFCTSXHU.js → chunk-X6Z2SIRF.js}

@@ -1,6 +1,6 @@
 import {
   hasSealedBody
-} from "./chunk-4J3MNVVX.js";
+} from "./chunk-WRLWEYHY.js";
 
 // src/with-shape/satellites/existence.ts
 function isEnvelopeLive(env) {
@@ -20,4 +20,4 @@ export {
   isBaseLive,
   liveBaseIdSet
 };
-//# sourceMappingURL=chunk-PFCTSXHU.js.map
+//# sourceMappingURL=chunk-X6Z2SIRF.js.map

package/dist/{chunk-UHFGK6YA.js → chunk-XQGKS4OW.js}

@@ -1,9 +1,9 @@
 import {
   dekKey
-} from "./chunk-RIZTZJX6.js";
+} from "./chunk-LJ744WXU.js";
 import {
   TierNotGrantedError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-party/team/tiers.ts
 function effectiveClearance(dekSlots, collection) {
@@ -37,4 +37,4 @@ export {
   keyringClearance,
   assertTierAccess
 };
-//# sourceMappingURL=chunk-UHFGK6YA.js.map
+//# sourceMappingURL=chunk-XQGKS4OW.js.map

package/dist/{chunk-L2F3CFCH.js → chunk-Y22JWHCP.js}

@@ -7,17 +7,17 @@ import {
   hashEntry,
   paddedIndex,
   sha256Hex
-} from "./chunk-2WJKJZSO.js";
+} from "./chunk-QHG7GQKM.js";
 import {
   buildRecordAad,
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "./chunk-4J3MNVVX.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   LedgerContentionError,
   isConflictError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-commit/history/ledger/patch.ts
 function computePatch(prev, next) {
@@ -695,4 +695,4 @@ export {
   applyPatch,
   LedgerStore
 };
-//# sourceMappingURL=chunk-L2F3CFCH.js.map
+//# sourceMappingURL=chunk-Y22JWHCP.js.map

package/dist/{chunk-C53ER7AG.js → chunk-YVA6UPRN.js}

@@ -1,6 +1,6 @@
 import {
   LookupHandle
-} from "./chunk-NZULV7LK.js";
+} from "./chunk-WVQDY3UM.js";
 
 // src/via/lookup/active.ts
 function withLookup() {
@@ -33,4 +33,4 @@ function withLookup() {
 export {
   withLookup
 };
-//# sourceMappingURL=chunk-C53ER7AG.js.map
+//# sourceMappingURL=chunk-YVA6UPRN.js.map

package/dist/{chunk-226V6XXJ.js → chunk-Z2KP6PNF.js}

@@ -236,7 +236,7 @@ var engineCtx = (ctx) => ({
 function withClassified() {
   return {
     async reveal(ctx, id, field) {
-      const { revealSealedField } = await import("./reveal-YQTRNQFH.js");
+      const { revealSealedField } = await import("./reveal-UAPBG743.js");
       const value = await revealSealedField({
         collection: ctx.collection,
         encrypted: ctx.encrypted,
@@ -248,26 +248,26 @@ function withClassified() {
       return value;
     },
     async verify(ctx, id, field, candidate) {
-      const { verifyDigestField } = await import("./verify-KWQIWLGH.js");
+      const { verifyDigestField } = await import("./verify-QWO5UKD6.js");
       const verdict = await verifyDigestField(engineCtx(ctx), id, field, candidate, policyOf(ctx.spec));
       await ctx.onAccess?.("verify", id);
       return verdict;
     },
     async verifyText(ctx, id, field, candidate) {
-      const { verifyTextField } = await import("./verify-KWQIWLGH.js");
+      const { verifyTextField } = await import("./verify-QWO5UKD6.js");
       const verdict = await verifyTextField(engineCtx(ctx), id, field, candidate, ctx.spec.verifyNormalize ?? "password");
       await ctx.onAccess?.("verify", id);
       return verdict;
     },
     async matchGroup(ctx, id, answers, opts) {
-      const { matchGroupFields } = await import("./verify-KWQIWLGH.js");
+      const { matchGroupFields } = await import("./verify-QWO5UKD6.js");
       const members = (ctx.groupMembers ?? []).map((m) => ({ field: m.field, policy: policyOf(m.spec) }));
       const result = await matchGroupFields(engineCtx(ctx), id, answers, members, opts);
       await ctx.onAccess?.("verify", id);
       return result;
     },
     async computeTarget(ctx, field, candidate, costByte) {
-      const { computeBidxTarget } = await import("./find-6M7GYDUZ.js");
+      const { computeBidxTarget } = await import("./find-KWB2RYWJ.js");
       const dek = await ctx.getDEK();
       return computeBidxTarget(candidate, policyOf(ctx.spec).normalize, dek, ctx.collection, field, costByte);
     }
@@ -279,4 +279,4 @@ export {
   classified,
   withClassified
 };
-//# sourceMappingURL=chunk-226V6XXJ.js.map
+//# sourceMappingURL=chunk-Z2KP6PNF.js.map

package/dist/{chunk-G5EDYVSE.js → chunk-ZK2WT532.js}

@@ -2,20 +2,20 @@ import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
   BLOB_INDEX_COLLECTION
-} from "./chunk-QXJXG7DN.js";
+} from "./chunk-7IV7GVOS.js";
 import {
   installViaBinder
-} from "./chunk-PTJY5R3O.js";
+} from "./chunk-PIO6NW7O.js";
 import {
   buildRecordAad,
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "./chunk-4J3MNVVX.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   TamperedError,
   ValidationError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/via/blob/binding.ts
 async function eraseBlobs(ctx, cfg) {
@@ -472,4 +472,4 @@ export {
   BLOB_EVICTION_AUDIT_COLLECTION,
   runCompaction
 };
-//# sourceMappingURL=chunk-G5EDYVSE.js.map
+//# sourceMappingURL=chunk-ZK2WT532.js.map

package/dist/{chunk-SFCD6OU7.js → chunk-ZNVBCKMV.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-5D2ALSM5.js";
 
 // src/with-formula/derivations/stale.ts
-var loadDerivationExecutor = lazy(() => import("./executor-E6YDJ7YA.js"));
+var loadDerivationExecutor = lazy(() => import("./executor-Z3IKK7G3.js"));
 var _staleByRegistry = /* @__PURE__ */ new WeakMap();
 var keyFor = (source, sourceId) => `${source}/${sourceId}`;
 async function markStale(registry, strategy, sourceId) {
@@ -84,4 +84,4 @@ export {
   markStale,
   resolveStaleOnRead
 };
-//# sourceMappingURL=chunk-SFCD6OU7.js.map
+//# sourceMappingURL=chunk-ZNVBCKMV.js.map

package/dist/{chunk-BU2ABHFW.js → chunk-ZOFNZLAA.js}

@@ -4,17 +4,17 @@ import {
   revoke,
   rotateKeys,
   verifyRoster
-} from "./chunk-45VHWE4C.js";
+} from "./chunk-QVUMKG3Z.js";
 import {
   base64ToBuffer,
   bufferToBase64,
   decryptBytes,
   encryptBytes,
   generateEphemeralKey
-} from "./chunk-4J3MNVVX.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   NoydbError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-party/team/device-seal.ts
 var MemoryDeviceSeal = class {
@@ -71,4 +71,4 @@ export {
   MemoryDeviceSeal,
   withTeam
 };
-//# sourceMappingURL=chunk-BU2ABHFW.js.map
+//# sourceMappingURL=chunk-ZOFNZLAA.js.map

package/dist/{chunk-X2RP4TO5.js → chunk-ZVJKHGE5.js}

@@ -1,22 +1,22 @@
 import {
   createNoydb
-} from "./chunk-FSQNGPHH.js";
+} from "./chunk-U277K5GR.js";
 import {
   deriveSchemaManifest
-} from "./chunk-5LMCVBMY.js";
+} from "./chunk-T5EXREMW.js";
 import {
   loadFence
-} from "./chunk-BMHQHH7Q.js";
+} from "./chunk-TLIFNRU5.js";
 import {
   readPod,
   readPodRedirect,
   signRecord,
   verifyPodHeader,
   verifyRecord
-} from "./chunk-RDOEOPOI.js";
+} from "./chunk-4N4OIVK3.js";
 import {
   loadKeyring
-} from "./chunk-45VHWE4C.js";
+} from "./chunk-QVUMKG3Z.js";
 import {
   ConflictError,
   MigrationRequiredError,
@@ -26,7 +26,7 @@ import {
   RedirectDepthExceededError,
   RedirectLoopError,
   RedirectUnreachableError
-} from "./chunk-VSUQI5Q6.js";
+} from "./chunk-2RH5SEY7.js";
 
 // src/with-pod/pod-store.ts
 var BUNDLE_STORE_VERSION = 1;
@@ -286,4 +286,4 @@ export {
   followRedirects,
   open
 };
-//# sourceMappingURL=chunk-X2RP4TO5.js.map
+//# sourceMappingURL=chunk-ZVJKHGE5.js.map

package/dist/classified/index.js

@@ -2,7 +2,7 @@ import {
   classified,
   luhnCheck,
   withClassified
-} from "../chunk-226V6XXJ.js";
+} from "../chunk-Z2KP6PNF.js";
 import {
   ClassifiedNeverStoredError,
   ClassifiedValidationError,
@@ -11,15 +11,15 @@ import {
   isClassifiedFieldSpec,
   isClassifiedGroup,
   resolveClassifiedFields
-} from "../chunk-K673OO6B.js";
-import "../chunk-PTJY5R3O.js";
-import "../chunk-2ELOCEXE.js";
+} from "../chunk-ID4ZBC3X.js";
+import "../chunk-PIO6NW7O.js";
+import "../chunk-URGHKZPL.js";
 import {
   ClassifiedConfigError,
   ClassifiedRevealError,
   ClassifiedRotationError,
   ClassifiedVerifyError
-} from "../chunk-VSUQI5Q6.js";
+} from "../chunk-2RH5SEY7.js";
 export {
   ClassifiedConfigError,
   ClassifiedNeverStoredError,

package/dist/{classified-marker-KHDOYIJB.js → classified-marker-7HXDMYHI.js}

@@ -11,11 +11,11 @@ function markerForFields(vdigFields) {
 async function persistClassifiedMarkerForFields(store, vault, collectionName, vdigFields, dek) {
   const marker = markerForFields(vdigFields);
   if (marker === null) return;
-  const { persistClassifiedMarker } = await import("./register-SN72QALV.js");
+  const { persistClassifiedMarker } = await import("./register-PIORIMMR.js");
   await persistClassifiedMarker({ store, vault, collectionName, dek, marker });
 }
 async function readClassifiedMarkerDigestOnly(store, vault, collectionName, dek) {
-  const { loadPersistedSchema } = await import("./storage-NPBYP2SM.js");
+  const { loadPersistedSchema } = await import("./storage-SO2L2Z5J.js");
   const persisted = await loadPersistedSchema(store, vault, collectionName, dek);
   return persisted?.classified?.digestOnly ?? [];
 }
@@ -23,4 +23,4 @@ export {
   persistClassifiedMarkerForFields,
   readClassifiedMarkerDigestOnly
 };
-//# sourceMappingURL=classified-marker-KHDOYIJB.js.map
+//# sourceMappingURL=classified-marker-7HXDMYHI.js.map

package/dist/collection-facade-V63BEBGU.js

@@ -0,0 +1,41 @@
+import {
+  buildPersistedIndexCallbacks,
+  embedOnWrite,
+  flushIndex,
+  rebuildEmbeddings,
+  retrieve,
+  search,
+  similarTo,
+  syncTierSearch,
+  warmIndex
+} from "./chunk-CSAN22QG.js";
+import "./chunk-TU6ZJTYT.js";
+import "./chunk-DL4GCSTS.js";
+import "./chunk-AURFOK3D.js";
+import "./chunk-NYMLINRP.js";
+import "./chunk-NUZ7ROUZ.js";
+import "./chunk-WVQDY3UM.js";
+import "./chunk-UQRKAM2R.js";
+import "./chunk-PIO6NW7O.js";
+import "./chunk-QHG7GQKM.js";
+import "./chunk-LJ744WXU.js";
+import "./chunk-WRLWEYHY.js";
+import "./chunk-O6VOR4NH.js";
+import "./chunk-VZFTON37.js";
+import "./chunk-NH2UOV3B.js";
+import "./chunk-HTRLQ4ZZ.js";
+import "./chunk-EPPAEGH5.js";
+import "./chunk-URGHKZPL.js";
+import "./chunk-2RH5SEY7.js";
+export {
+  buildPersistedIndexCallbacks,
+  embedOnWrite,
+  flushIndex,
+  rebuildEmbeddings,
+  retrieve,
+  search,
+  similarTo,
+  syncTierSearch,
+  warmIndex
+};
+//# sourceMappingURL=collection-facade-V63BEBGU.js.map

package/dist/{computed-XMFTHAXV.js → computed-LZLSYOPG.js}

@@ -1,10 +1,10 @@
 import {
   ComputedFieldError,
   evalComputedFields
-} from "./chunk-ECGXA4LT.js";
-import "./chunk-VSUQI5Q6.js";
+} from "./chunk-OR3OHKU6.js";
+import "./chunk-2RH5SEY7.js";
 export {
   ComputedFieldError,
   evalComputedFields
 };
-//# sourceMappingURL=computed-XMFTHAXV.js.map
+//# sourceMappingURL=computed-LZLSYOPG.js.map

package/dist/consent/index.js

@@ -2,19 +2,19 @@ import {
   CONSENT_AUDIT_COLLECTION,
   loadConsentEntries,
   writeConsentEntry
-} from "../chunk-UOZOWN73.js";
+} from "../chunk-ND6S2DKC.js";
 import {
   NO_CONSENT
 } from "../chunk-GSAK56VF.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-4J3MNVVX.js";
-import "../chunk-ZBUAX4EF.js";
-import "../chunk-SPPOUJLN.js";
+import "../chunk-WRLWEYHY.js";
+import "../chunk-O6VOR4NH.js";
+import "../chunk-VZFTON37.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-OM3SEDI4.js";
-import "../chunk-PUBI455O.js";
-import "../chunk-2ELOCEXE.js";
-import "../chunk-VSUQI5Q6.js";
+import "../chunk-HTRLQ4ZZ.js";
+import "../chunk-EPPAEGH5.js";
+import "../chunk-URGHKZPL.js";
+import "../chunk-2RH5SEY7.js";
 
 // src/with-audit/consent/active.ts
 function withConsent() {