@noy-db/hub 0.3.0-pre.11 → 0.3.0-pre.12

package/dist/chunk-AAIIDAUC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/best-effort-revert.ts","../src/with-commit/tx/transaction.ts"],"sourcesContent":["/**\n * Best-effort reverse-revert — the shape shared by two independent rollback\n * paths that used to duplicate it: satellite fan-out\n * (`with-shape/satellites/fanout.ts`'s `revertAndCompensate`) and\n * multi-record transactions (`with-commit/tx/transaction.ts`'s\n * `revertExecuted`). Both revert a list of already-executed writes on\n * failure by walking them in REVERSE order and, per leg, restoring the\n * captured prior envelope straight through the raw adapter — `put(prior)`\n * when one existed, `delete` when the leg was a fresh insert — bypassing\n * the Collection layer so the revert itself doesn't re-fire\n * encryption/ledger/change-event machinery. Each leg's raw-adapter revert\n * is best-effort: a throw is swallowed so a revert-path failure never masks\n * the original error that triggered the rollback, and the loop moves on to\n * the next leg.\n *\n * An optional per-leg `compensate` callback runs immediately after a\n * successful raw-adapter revert (still inside the same try, so a throwing\n * callback is swallowed the same way as a throwing raw revert). What the\n * callback does is entirely caller-defined — satellites' fan-out fires\n * `_compensateRevertedWrite` only for legs whose write actually landed\n * (#596); with-commit's transaction executor invalidates the Collection\n * cache. Neither concern belongs here: this helper only knows the generic\n * reverse/best-effort/raw-revert shape.\n *\n * Lives in `kernel/` — not a `with-*` service — so both consumers (one a\n * gated service, `with-commit`; one an always-on schema feature,\n * `with-shape/satellites`) can import it without creating a\n * `with-* → with-*` edge, which would force either family to always bundle\n * the other and defeat the opt-in tree-shaking both are built around.\n *\n * @internal — implementation-sharing only, not part of the public surface.\n */\nimport type { EncryptedEnvelope } from './types.js'\n\n/** One already-executed write a revert pass needs to unwind. */\nexport interface BestEffortRevertLeg {\n  readonly vaultName: string\n  readonly collectionName: string\n  readonly id: string\n  /** Envelope captured before the write, or `null` if the id didn't exist yet. */\n  readonly prior: EncryptedEnvelope | null\n}\n\n/** The subset of `NoydbStore` a raw-adapter revert needs. */\nexport interface BestEffortRevertAdapter {\n  put(vaultName: string, collectionName: string, id: string, envelope: EncryptedEnvelope): Promise<void>\n  delete(vaultName: string, collectionName: string, id: string): Promise<void>\n}\n\n/**\n * Revert `executed` in reverse order via the raw adapter, best-effort.\n * `compensate`, when supplied, runs once per leg immediately after that\n * leg's own raw revert succeeds.\n */\nexport async function bestEffortRevert<T extends BestEffortRevertLeg>(\n  executed: readonly T[],\n  adapter: BestEffortRevertAdapter,\n  compensate?: (leg: T) => Promise<void> | void,\n): Promise<void> {\n  for (const leg of [...executed].reverse()) {\n    try {\n      if (leg.prior !== null) {\n        await adapter.put(leg.vaultName, leg.collectionName, leg.id, leg.prior)\n      } else {\n        await adapter.delete(leg.vaultName, leg.collectionName, leg.id)\n      }\n      if (compensate) await compensate(leg)\n    } catch {\n      // best-effort — a revert-path failure must not mask the original\n      // error that triggered the rollback (matches both callers' prior\n      // independent implementations).\n    }\n  }\n}\n","/**\n * Multi-record atomic transactions.\n *\n * Lets an application stage writes across two or more collections (or\n * vaults) and commit them all-or-nothing.\n *\n * ```ts\n * await db.transaction(async (tx) => {\n *   const inv = tx.vault('acme').collection<Invoice>('invoices')\n *   const pay = tx.vault('acme').collection<Payment>('payments')\n *   await inv.put(invoiceId, { ...invoice, status: 'paid' })\n *   await pay.put(paymentId, { invoiceId, amount, paidAt })\n * })\n * // If the body throws before returning: nothing persisted.\n * // If the body returns: all puts committed; any CAS mismatch rolls\n * // the batch back and surfaces as ConflictError.\n * ```\n *\n * ## Atomicity semantics\n *\n * Ops are buffered during the body. On body-return the hub:\n *\n * 1. **Pre-flight** — re-reads every touched envelope and enforces\n *    any caller-supplied `expectedVersion`. A mismatch throws\n *    `ConflictError` with *no* writes performed.\n * 2. **Execute** — calls `Collection.put()` / `.delete()` for each\n *    staged op in declaration order. History snapshots, ledger\n *    appends, and change events fire as normal per op.\n * 3. **Unwind on failure** — if step 2 throws mid-batch, each\n *    already-committed op is reverted via the raw store (restoring\n *    the captured prior envelope, or deleting if none existed). The\n *    ledger is NOT rewritten — audit history preserves the partial\n *    commit and the revert.\n *\n * **Crash window.** Steps 2–3 are not a storage-layer transaction —\n * if the process dies between two executed ops, the on-disk state is\n * partial. True all-or-nothing atomicity requires a store that\n * implements `NoydbStore.tx()` (DynamoDB `TransactWriteItems`,\n * IndexedDB `readwrite` transaction, …). This executor declares\n * that future integration point via the `tx?()` method + the\n * `StoreCapabilities.txAtomic` bit, but does not yet delegate\n * to it — the cascade into `Fork · Stores` tracks the per-adapter\n * wire-up.\n *\n * ## Not covered\n *\n * - Cross-sync-peer atomicity. Transactions commit against the\n *   primary store only; the sync engine pushes on its normal\n *   schedule. For cross-peer two-phase commit use `SyncTransaction`\n * via `db.transaction(vaultName)`.\n * - Read-your-writes within the body. `tx.collection().get(id)`\n *   returns the most-recently-staged value for that id when one\n *   exists; if no staged op has touched the id, it reads the current\n *   committed state. Version numbers returned by `get` reflect the\n *   pre-transaction state (staged puts have no version yet).\n *\n * @module\n */\n\nimport type { Noydb } from '../../kernel/noydb.js'\nimport type { Vault } from '../../kernel/vault.js'\nimport type { Collection } from '../../kernel/collection.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport {\n  AmendmentForbiddenError,\n  ConflictError,\n  InvariantError,\n  ValidationError,\n} from '../../kernel/errors.js'\nimport { generateULID } from '../../with-pod/ulid.js'\nimport type { GuardExecutor as GuardExecutorModule } from '../../with-audit/guards/executor.js'\nimport type { LedgerEntry } from '../history/ledger/entry.js'\nimport type { TransactionInvariant } from './invariants.js'\nimport type { GuardChange, GuardContext, ReadOnlyVaultFacade } from '../../with-audit/guards/types.js'\nimport { bestEffortRevert } from '../../kernel/best-effort-revert.js'\n\n/** One op buffered inside a running `TxContext`. @internal */\nexport interface StagedOp {\n  type: 'put' | 'delete'\n  vaultName: string\n  collectionName: string\n  id: string\n  record?: unknown\n  expectedVersion?: number\n  /**\n   * Optional human-readable tag forwarded to the resulting ledger\n   * entry's `reason` field. Set by callers via\n   * `tx.vault(v).collection(c).put(id, record, { reason })`.\n   */\n  reason?: string\n}\n\n/**\n * One executed op (main staged op or recursive side-effect like a\n * derivation output) paired with the envelope captured before the write.\n * `revertExecuted` walks this array in reverse on rollback.\n * @internal\n */\nexport interface ExecutedOp {\n  op: StagedOp\n  priorEnvelope: EncryptedEnvelope | null\n}\n\n/**\n * Options accepted by `db.transaction({ amendment, reason }, fn)`.\n * Only the amendment variant uses these — a plain `db.transaction(fn)`\n * never sees this shape.\n */\nexport interface AmendmentTxOptions {\n  /** Opt into amendment mode. Required to be `true`. */\n  readonly amendment: true\n  /** Human-readable rationale recorded in the ledger entry. Required. */\n  readonly reason: string\n}\n\n/**\n * Transaction handle passed to the user's body. Use\n * `tx.vault(name).collection<T>(name)` to get a per-collection\n * facade; its `put`/`delete`/`get` calls stage ops against the tx.\n */\nexport class TxContext {\n  /** Stable id for this transaction; shared by all writes it performs. */\n  readonly txId: string = generateULID()\n  /** @internal */\n  readonly _ops: StagedOp[] = []\n  /**\n   * @internal — write log built up in Phase 2. Each entry records the\n   * envelope captured BEFORE the write so a mid-batch failure can\n   * restore prior state via `revertExecuted`. Side-effect writes (e.g.\n   * recursive derivation outputs fired inside `Collection.put`) are\n   * appended here in execution order so they roll back alongside the\n   * main staged ops.\n   */\n  readonly _executed: ExecutedOp[] = []\n  /** @internal */\n  readonly _db: Noydb\n  /**\n   * @internal — true when this TxContext was opened in amendment\n   * mode. Toggles the lazy-`beginAmendment` + role-check path on first\n   * `tx.vault(name)` and unlocks the post-Phase-2 invariant + audit run.\n   */\n  readonly _amendment: boolean\n  /** @internal — vaults that have already had `beginAmendment` called. */\n  readonly _amendmentVaults = new Map<string, Vault>()\n\n  /** @internal */\n  constructor(db: Noydb, amendment = false) {\n    this._db = db\n    this._amendment = amendment\n  }\n\n  /** Scope subsequent `collection()` calls to the named vault. */\n  vault(name: string): TxVault {\n    const v = this._db.vault(name)\n    if (this._amendment && !this._amendmentVaults.has(name)) {\n      // Role check is per-vault. The task spec (\"only admin or owner\n      // can open an amendment\") is implemented lazy-on-first-touch\n      // because the role lives on the vault's keyring, and `tx.vault()`\n      // is the first place we know which vault we're addressing. The\n      // observable effect is identical to an eager check in the single-\n      // vault case the tests exercise; multi-vault amendments check\n      // each touched vault as they first appear.\n      const role = v.role\n      // FR-6: custodian is admin-rank for operational mutations, and an\n      // amendment is an operational (data-correcting) act — not an ownership\n      // meta-capability — so custodian is allowed alongside owner/admin.\n      if (role !== 'admin' && role !== 'owner' && role !== 'custodian') {\n        throw new AmendmentForbiddenError(v.userId, role)\n      }\n      // Amendments require an initialised guard registry — they\n      // produce a structured invariant + change-set audit. A vault\n      // opened without `guardStrategies` (or via the sync fallback\n      // path) has a null registry and cannot run an amendment.\n      const reg = v._getGuardRegistry()\n      if (reg === null) {\n        throw new ValidationError(\n          `Vault \"${name}\": amendment mode requires at least one ` +\n          `guardStrategy registered via createNoydb({ guardStrategies }). ` +\n          `Open the vault with guardStrategies before calling ` +\n          `db.transaction({ amendment: true }).`,\n        )\n      }\n      reg.beginAmendment()\n      this._amendmentVaults.set(name, v)\n    }\n    return new TxVault(this, v)\n  }\n}\n\n/** Per-vault facade inside a running transaction. */\nexport class TxVault {\n  /** @internal */\n  readonly _ctx: TxContext\n  /** @internal */\n  readonly _vault: Vault\n\n  /** @internal */\n  constructor(ctx: TxContext, vault: Vault) {\n    this._ctx = ctx\n    this._vault = vault\n  }\n\n  /** Scope subsequent op calls to the named collection. */\n  collection<T>(name: string): TxCollection<T> {\n    const c = this._vault.collection<T>(name)\n    return new TxCollection<T>(this._ctx, this._vault, c, name)\n  }\n}\n\n/** Per-collection facade inside a running transaction. */\nexport class TxCollection<T> {\n  /** @internal */\n  readonly _ctx: TxContext\n  /** @internal */\n  readonly _vault: Vault\n  /** @internal */\n  readonly _coll: Collection<T>\n  /** @internal */\n  readonly _name: string\n\n  /** @internal */\n  constructor(ctx: TxContext, vault: Vault, coll: Collection<T>, name: string) {\n    this._ctx = ctx\n    this._vault = vault\n    this._coll = coll\n    this._name = name\n  }\n\n  /**\n   * Read the current committed value, or the most-recently-staged\n   * value from the same transaction if one exists.\n   */\n  async get(id: string): Promise<T | null> {\n    for (let i = this._ctx._ops.length - 1; i >= 0; i--) {\n      const op = this._ctx._ops[i]!\n      if (\n        op.vaultName === this._vault.name &&\n        op.collectionName === this._name &&\n        op.id === id\n      ) {\n        if (op.type === 'delete') return null\n        return op.record as T\n      }\n    }\n    return this._coll.get(id)\n  }\n\n  /**\n   * Stage a put. Does not write until the transaction body returns.\n   * Supply `{ expectedVersion }` to enforce optimistic concurrency\n   * during the commit pre-flight.\n   */\n  put(id: string, record: T, options?: { expectedVersion?: number; reason?: string }): void {\n    const op: StagedOp = {\n      type: 'put',\n      vaultName: this._vault.name,\n      collectionName: this._name,\n      id,\n      record,\n    }\n    if (options?.expectedVersion !== undefined) op.expectedVersion = options.expectedVersion\n    if (options?.reason !== undefined) op.reason = options.reason\n    this._ctx._ops.push(op)\n  }\n\n  /**\n   * Stage a delete. Does not write until the transaction body returns.\n   * Supply `{ expectedVersion }` to enforce optimistic concurrency\n   * during the commit pre-flight.\n   */\n  delete(id: string, options?: { expectedVersion?: number }): void {\n    const op: StagedOp = {\n      type: 'delete',\n      vaultName: this._vault.name,\n      collectionName: this._name,\n      id,\n    }\n    if (options?.expectedVersion !== undefined) op.expectedVersion = options.expectedVersion\n    this._ctx._ops.push(op)\n  }\n}\n\n/**\n * Commit plan: pre-flight check + execution + revert plan.\n *\n * @internal — driven by `withTransactions()` (via `tx/active.ts`) for\n * user-facing `db.transaction(...)` calls and by the `amendment` path\n * in `noydb.ts`. `Collection.putManyAtomic` runs its own Phase 2 loop\n * but shares the `_activeTxContext` mechanism (and the `revertExecuted`\n * helper) so nested side-effect derivation writes get registered for\n * revert alongside the bulk-put source ops.\n */\nexport async function runTransaction<T>(\n  db: Noydb,\n  fn: (tx: TxContext) => Promise<T> | T,\n  options?: AmendmentTxOptions,\n  txInvariants?: ReadonlyArray<TransactionInvariant>,\n): Promise<T> {\n  // ─── Amendment-mode pre-flight ───────────────────────────────\n  // `reason` is the only thing we can validate before the body runs;\n  // the per-vault role check happens lazily on first `tx.vault(name)`\n  // because we don't know which vaults the body will touch ahead of\n  // time. Throwing here keeps the failure mode close to the call site\n  // so the developer doesn't have to walk an async stack to find the\n  // missing-reason mistake.\n  if (options?.amendment) {\n    if (typeof options.reason !== 'string' || options.reason.trim().length === 0) {\n      throw new ValidationError(\n        'db.transaction({ amendment: true }) requires a non-empty `reason` string.',\n      )\n    }\n  }\n\n  const ctx = new TxContext(db, options?.amendment === true)\n  const bodyResult = await fn(ctx)\n\n  if (ctx._ops.length === 0) {\n    // Body produced no ops. If amendment mode was active we still\n    // need to close any opened windows so a subsequent (unrelated)\n    // write doesn't surprise-collect into a stale change-set. Each\n    // `beginAmendment` is matched by exactly one `consumeChanges`.\n    if (ctx._amendment) {\n      for (const v of ctx._amendmentVaults.values()) {\n        // Registry is guaranteed non-null here — `tx.vault(name)`\n        // threw above if it was null before adding to\n        // `_amendmentVaults`.\n        const reg = v._getGuardRegistry()\n        if (reg !== null) {\n          reg.consumeChanges()\n          reg.consumeMeta()\n        }\n      }\n    }\n    return bodyResult\n  }\n\n  // Phase 1 — pre-flight: snapshot every touched envelope and enforce\n  // any caller-supplied expectedVersion. Same (vault, coll, id) touched\n  // more than once in one tx snapshots only the *initial* committed\n  // state; the in-order replay in Phase 2 takes care of successor ops.\n  const priorEnvelopes = new Map<string, EncryptedEnvelope | null>()\n  const store = db._store\n\n  // Commit-time changeset invariants need PLAINTEXT prior records\n  // for `before`, but `priorEnvelopes` holds ENCRYPTED envelopes. So for\n  // ops in a watched scope we additionally decrypt the prior record here,\n  // in Phase 1, BEFORE Phase 2 overwrites it. Snapshots only the initial\n  // committed state per (vault, coll, id), matching the envelope snapshot.\n  const invariants = txInvariants ?? []\n  const watchedScopes = new Set(invariants.map(i => i.scope))\n  const plainBefore = new Map<string, unknown>()\n\n  for (const op of ctx._ops) {\n    const key = keyOf(op)\n    if (!priorEnvelopes.has(key)) {\n      const env = await store.get(op.vaultName, op.collectionName, op.id)\n      priorEnvelopes.set(key, env)\n    }\n    if (watchedScopes.has(op.collectionName) && !plainBefore.has(key)) {\n      const prior = await db\n        .vault(op.vaultName)\n        .collection(op.collectionName)\n        .get(op.id)\n      plainBefore.set(key, prior ?? null)\n    }\n    if (op.expectedVersion !== undefined) {\n      const env = priorEnvelopes.get(key) ?? null\n      const actual = env?._v ?? 0\n      if (actual !== op.expectedVersion) {\n        throw new ConflictError(\n          actual,\n          `Transaction pre-flight: ${op.vaultName}/${op.collectionName}/${op.id} ` +\n            `expected v${op.expectedVersion}, found v${actual}`,\n        )\n      }\n    }\n  }\n\n  // Phase 2 — execute via the Collection layer so history snapshots,\n  // ledger entries, and change events fire normally. We capture each\n  // successful op so a mid-batch throw can revert in Phase 3.\n  //\n  // `_activeTxContext` is published on the Noydb instance for the\n  // duration of Phase 2 so recursive writes triggered inside\n  // `Collection.put` (today: eager derivation outputs) can register\n  // their own envelopes onto `ctx._executed` and roll back alongside\n  // the main staged ops. The `finally` clears it before the\n  // amendment commit phase runs.\n  db._setActiveTxContext(ctx)\n  try {\n    try {\n      for (const op of ctx._ops) {\n        const coll = db.vault(op.vaultName).collection(op.collectionName)\n        const key = keyOf(op)\n        const prior = priorEnvelopes.get(key) ?? null\n        // Record the revert plan BEFORE the call so a mid-`coll.put` throw\n        // (e.g. strict-mode derivation failure firing after `store.put`\n        // has already committed the envelope) still has its source write\n        // reverted. `revertExecuted` is best-effort: putting prior back is\n        // idempotent when the failing op never actually wrote, and\n        // `_invalidateCacheEntry` is a no-op when the collection isn't\n        // hydrated.\n        ctx._executed.push({ op, priorEnvelope: prior })\n        if (op.type === 'put') {\n          // eslint-disable-next-line @typescript-eslint/no-explicit-any\n          await coll.put(op.id, op.record as any, op.reason !== undefined ? { reason: op.reason } : undefined)\n        } else {\n          await coll.delete(op.id)\n        }\n      }\n    } catch (err) {\n      // Phase 3 — best-effort revert. See helper docstring.\n      await revertExecuted(ctx._executed, store, db)\n      // Drain amendment windows so the next transaction starts clean.\n      if (ctx._amendment) {\n        for (const v of ctx._amendmentVaults.values()) {\n          const reg = v._getGuardRegistry()\n          if (reg !== null) {\n            reg.consumeChanges()\n            reg.consumeMeta()\n          }\n        }\n      }\n      throw err\n    }\n  } finally {\n    db._clearActiveTxContext(ctx)\n  }\n\n  // ─── Amendment commit phase (only if amendment === true) ────\n  // Body succeeded — now run each touched vault's invariants over the\n  // collected change-set, then append a structured ledger entry. If\n  // any invariant throws, treat it exactly like a mid-Phase-2 failure:\n  // revert every executed op and re-throw the InvariantError.\n  if (ctx._amendment) {\n    // Lazy-load GuardExecutor at the dispatch site — keeps the floor\n    // bundle free of the guards service when amendments aren't used.\n    // Mirrors the deferred-load pattern from elsewhere in this module.\n    const { GuardExecutor } = (await import('../../with-audit/guards/executor.js')) as {\n      GuardExecutor: typeof GuardExecutorModule\n    }\n    try {\n      for (const [vaultName, v] of ctx._amendmentVaults) {\n        const registry = v._getGuardRegistry()\n        // Registry is guaranteed non-null at this point — the\n        // `tx.vault(name)` path that populates `_amendmentVaults`\n        // throws if the registry is null. The defensive check here\n        // is for TypeScript's narrowing.\n        if (registry === null) continue\n        const changesByCollection = registry.consumeChanges()\n        const meta = registry.consumeMeta()\n        if (changesByCollection.size === 0) continue\n\n        const readOnlyVault = v._getReadOnlyFacade()\n        if (readOnlyVault === null) continue\n\n        // Build the invariant ctx once per vault — it's the same shape\n        // every guard sees on the normal `check` path, just with a\n        // synthetic `existing: null` (invariants get the full change\n        // set in their first parameter; `existing` is a per-record\n        // concept that doesn't apply here).\n        const invariantsPassed: string[] = []\n        for (const [collection, changes] of changesByCollection) {\n          const guards = registry.guardsFor(collection).filter(g => g.amendment !== undefined)\n          for (const guard of guards) {\n            await GuardExecutor.runInvariant(guard, changes, {\n              existing: null,\n              vault: readOnlyVault,\n              userId: v.userId,\n              role: v.role,\n            })\n          }\n          if (guards.length > 0) invariantsPassed.push(collection)\n        }\n\n        // Append the audit ledger entry. Silent no-op when the\n        // history strategy isn't configured — the records still\n        // committed, only the multi-record summary is unavailable.\n        const ledger = v._getLedgerOrNull()\n        if (ledger) {\n          const role = v.role as 'admin' | 'owner'\n          const amendment: NonNullable<LedgerEntry['amendment']> = {\n            reason: options!.reason,\n            role,\n            changes: meta,\n            invariantsPassed,\n          }\n          await ledger.append({\n            op: 'amendment',\n            collection: '',\n            id: '',\n            version: 0,\n            actor: v.userId,\n            // No payload to hash — the per-record entries already\n            // captured `payloadHash` at their own append time. We use\n            // a sha256 of the canonical reason string so the field is\n            // populated with something deterministic and non-empty.\n            payloadHash: '',\n            amendment,\n          })\n        }\n        void vaultName\n      }\n    } catch (err) {\n      await revertExecuted(ctx._executed, store, db)\n      throw err instanceof InvariantError ? err : new InvariantError(\n        err instanceof Error ? err.message : `invariant violated: ${String(err)}`,\n      )\n    }\n  }\n\n  // ─── Commit-time changeset invariant phase ───────────\n  // Runs for BOTH ordinary and amendment transactions (placed after the\n  // amendment phase so an amendment commit is still subject to these\n  // set-level constraints). Assemble the changeset from the executed\n  // staged ops, deduped to the LAST write per (vault, coll, id) while\n  // preserving write order, then group `GuardChange` by collection\n  // (scope) and run each matching invariant. A throw mirrors the\n  // amendment-phase failure mode exactly: revert every executed op and\n  // re-throw as `InvariantError`.\n  if (invariants.length > 0) {\n    // Dedup ctx._ops to the last write per key, preserving first-seen\n    // (write) order so the changeset is stable and order-meaningful.\n    const lastOp = new Map<string, StagedOp>()\n    const order: string[] = []\n    for (const op of ctx._ops) {\n      const key = keyOf(op)\n      if (!lastOp.has(key)) order.push(key)\n      lastOp.set(key, op)\n    }\n\n    // Group {before, after} pairs by collection name (the invariant\n    // scope). `before` is the plaintext prior captured in Phase 1 (null\n    // for inserts / unwatched — only watched scopes were captured, and\n    // every grouped key belongs to a watched scope). `after` is the\n    // written record, null for a delete.\n    const changesByScope = new Map<string, GuardChange<unknown>[]>()\n    // Parallel map: scope → the vault name of its (last-seen) op, used to\n    // build the per-invariant read-only ctx (facade + userId + role).\n    const scopeVault = new Map<string, string>()\n    for (const key of order) {\n      const op = lastOp.get(key)!\n      if (!watchedScopes.has(op.collectionName)) continue\n      const before = plainBefore.get(key) ?? null\n      const after = op.type === 'delete' ? null : (op.record ?? null)\n      const change = { before, after } as GuardChange<unknown>\n      const arr = changesByScope.get(op.collectionName)\n      if (arr) arr.push(change)\n      else changesByScope.set(op.collectionName, [change])\n\n      // Stash the vault name alongside so we can build a per-vault ctx.\n      // (All ops in a scope group could span vaults; we resolve the\n      // vault per change below via a parallel map keyed the same way.)\n      scopeVault.set(op.collectionName, op.vaultName)\n    }\n\n    try {\n      for (const inv of invariants) {\n        const changes = changesByScope.get(inv.scope)\n        if (changes === undefined || changes.length === 0) continue\n        const vaultName = scopeVault.get(inv.scope)!\n        const v = db.vault(vaultName)\n        // Prefer the real read-only facade so the invariant can read\n        // sibling collections; fall back to a minimal read-only stub.\n        const facade: ReadOnlyVaultFacade =\n          v._getReadOnlyFacade() ?? {\n            collection<R = unknown>(name: string) {\n              const c = v.collection<R>(name)\n              return {\n                get: (id: string) => c.get(id),\n                list: () => c.list(),\n                query: () => c.query(),\n              }\n            },\n          }\n        const ctxForInv: GuardContext<unknown> = {\n          existing: null,\n          vault: facade,\n          userId: v.userId,\n          role: v.role,\n        }\n        await inv.check(changes, ctxForInv)\n      }\n    } catch (err) {\n      await revertExecuted(ctx._executed, store, db)\n      throw err instanceof InvariantError ? err : new InvariantError(\n        err instanceof Error ? err.message : `invariant violated: ${String(err)}`,\n      )\n    }\n  }\n\n  return bodyResult\n}\n\n/**\n * Phase 3 helper — restore captured prior envelopes via the raw store\n * to avoid re-firing Collection-level side effects (we don't want a\n * cascade of change events undoing themselves). The ledger is left\n * as-is: each committed op appended an entry; the revert is\n * deliberately NOT recorded as a compensating entry because the\n * caller-facing contract is \"atomic or not at all,\" not \"every write\n * visible in the audit trail.\" Auditors who need the intermediate\n * state can still reconstruct it by walking the ledger through the\n * failed-tx timestamp.\n *\n * Delegates the reverse/best-effort/raw-revert shape to the shared\n * `bestEffortRevert` helper (`kernel/best-effort-revert.ts`); the cache\n * invalidation below rides along as that helper's per-leg `compensate`\n * callback, gated on `db` exactly as before.\n *\n * @internal — shared between `runTransaction` and\n * `Collection.putManyAtomic`. Both register source ops + nested\n * derivation side-effect ops onto `_executed`; this helper unwinds the\n * combined list in reverse on rollback.\n */\nexport async function revertExecuted(\n  executed: ReadonlyArray<ExecutedOp>,\n  store: Noydb['_store'],\n  db?: Noydb,\n): Promise<void> {\n  const legs = executed.map(({ op, priorEnvelope }) => ({\n    vaultName: op.vaultName,\n    collectionName: op.collectionName,\n    id: op.id,\n    prior: priorEnvelope,\n  }))\n  await bestEffortRevert(\n    legs,\n    store,\n    db\n      ? async (leg) => {\n          // Sync the Collection-layer cache with what we just wrote at\n          // the raw store. Without this, eager-mode `get` would still\n          // return the rolled-back record from its in-memory map. The\n          // Collection's `_invalidateCacheEntry` is a no-op when the\n          // collection hasn't yet been hydrated.\n          const coll = db.vault(leg.vaultName).collection(leg.collectionName)\n          // eslint-disable-next-line @typescript-eslint/no-explicit-any\n          await (coll as any)._invalidateCacheEntry(leg.id)\n        }\n      : undefined,\n  )\n}\n\nfunction keyOf(op: StagedOp): string {\n  return `${op.vaultName}\\x00${op.collectionName}\\x00${op.id}`\n}\n"],"mappings":";;;;;;;;;;;AAsDA,eAAsB,iBACpB,UACA,SACA,YACe;AACf,aAAW,OAAO,CAAC,GAAG,QAAQ,EAAE,QAAQ,GAAG;AACzC,QAAI;AACF,UAAI,IAAI,UAAU,MAAM;AACtB,cAAM,QAAQ,IAAI,IAAI,WAAW,IAAI,gBAAgB,IAAI,IAAI,IAAI,KAAK;AAAA,MACxE,OAAO;AACL,cAAM,QAAQ,OAAO,IAAI,WAAW,IAAI,gBAAgB,IAAI,EAAE;AAAA,MAChE;AACA,UAAI,WAAY,OAAM,WAAW,GAAG;AAAA,IACtC,QAAQ;AAAA,IAIR;AAAA,EACF;AACF;;;AC+CO,IAAM,YAAN,MAAgB;AAAA;AAAA,EAEZ,OAAe,aAAa;AAAA;AAAA,EAE5B,OAAmB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASpB,YAA0B,CAAC;AAAA;AAAA,EAE3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA;AAAA,EAEA,mBAAmB,oBAAI,IAAmB;AAAA;AAAA,EAGnD,YAAY,IAAW,YAAY,OAAO;AACxC,SAAK,MAAM;AACX,SAAK,aAAa;AAAA,EACpB;AAAA;AAAA,EAGA,MAAM,MAAuB;AAC3B,UAAM,IAAI,KAAK,IAAI,MAAM,IAAI;AAC7B,QAAI,KAAK,cAAc,CAAC,KAAK,iBAAiB,IAAI,IAAI,GAAG;AAQvD,YAAM,OAAO,EAAE;AAIf,UAAI,SAAS,WAAW,SAAS,WAAW,SAAS,aAAa;AAChE,cAAM,IAAI,wBAAwB,EAAE,QAAQ,IAAI;AAAA,MAClD;AAKA,YAAM,MAAM,EAAE,kBAAkB;AAChC,UAAI,QAAQ,MAAM;AAChB,cAAM,IAAI;AAAA,UACR,UAAU,IAAI;AAAA,QAIhB;AAAA,MACF;AACA,UAAI,eAAe;AACnB,WAAK,iBAAiB,IAAI,MAAM,CAAC;AAAA,IACnC;AACA,WAAO,IAAI,QAAQ,MAAM,CAAC;AAAA,EAC5B;AACF;AAGO,IAAM,UAAN,MAAc;AAAA;AAAA,EAEV;AAAA;AAAA,EAEA;AAAA;AAAA,EAGT,YAAY,KAAgB,OAAc;AACxC,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA,EAGA,WAAc,MAA+B;AAC3C,UAAM,IAAI,KAAK,OAAO,WAAc,IAAI;AACxC,WAAO,IAAI,aAAgB,KAAK,MAAM,KAAK,QAAQ,GAAG,IAAI;AAAA,EAC5D;AACF;AAGO,IAAM,eAAN,MAAsB;AAAA;AAAA,EAElB;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAGT,YAAY,KAAgB,OAAc,MAAqB,MAAc;AAC3E,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,IAAI,IAA+B;AACvC,aAAS,IAAI,KAAK,KAAK,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK;AACnD,YAAM,KAAK,KAAK,KAAK,KAAK,CAAC;AAC3B,UACE,GAAG,cAAc,KAAK,OAAO,QAC7B,GAAG,mBAAmB,KAAK,SAC3B,GAAG,OAAO,IACV;AACA,YAAI,GAAG,SAAS,SAAU,QAAO;AACjC,eAAO,GAAG;AAAA,MACZ;AAAA,IACF;AACA,WAAO,KAAK,MAAM,IAAI,EAAE;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,IAAY,QAAW,SAA+D;AACxF,UAAM,KAAe;AAAA,MACnB,MAAM;AAAA,MACN,WAAW,KAAK,OAAO;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,IACF;AACA,QAAI,SAAS,oBAAoB,OAAW,IAAG,kBAAkB,QAAQ;AACzE,QAAI,SAAS,WAAW,OAAW,IAAG,SAAS,QAAQ;AACvD,SAAK,KAAK,KAAK,KAAK,EAAE;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,IAAY,SAA8C;AAC/D,UAAM,KAAe;AAAA,MACnB,MAAM;AAAA,MACN,WAAW,KAAK,OAAO;AAAA,MACvB,gBAAgB,KAAK;AAAA,MACrB;AAAA,IACF;AACA,QAAI,SAAS,oBAAoB,OAAW,IAAG,kBAAkB,QAAQ;AACzE,SAAK,KAAK,KAAK,KAAK,EAAE;AAAA,EACxB;AACF;AAYA,eAAsB,eACpB,IACA,IACA,SACA,cACY;AAQZ,MAAI,SAAS,WAAW;AACtB,QAAI,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,KAAK,EAAE,WAAW,GAAG;AAC5E,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,IAAI,UAAU,IAAI,SAAS,cAAc,IAAI;AACzD,QAAM,aAAa,MAAM,GAAG,GAAG;AAE/B,MAAI,IAAI,KAAK,WAAW,GAAG;AAKzB,QAAI,IAAI,YAAY;AAClB,iBAAW,KAAK,IAAI,iBAAiB,OAAO,GAAG;AAI7C,cAAM,MAAM,EAAE,kBAAkB;AAChC,YAAI,QAAQ,MAAM;AAChB,cAAI,eAAe;AACnB,cAAI,YAAY;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAMA,QAAM,iBAAiB,oBAAI,IAAsC;AACjE,QAAM,QAAQ,GAAG;AAOjB,QAAM,aAAa,gBAAgB,CAAC;AACpC,QAAM,gBAAgB,IAAI,IAAI,WAAW,IAAI,OAAK,EAAE,KAAK,CAAC;AAC1D,QAAM,cAAc,oBAAI,IAAqB;AAE7C,aAAW,MAAM,IAAI,MAAM;AACzB,UAAM,MAAM,MAAM,EAAE;AACpB,QAAI,CAAC,eAAe,IAAI,GAAG,GAAG;AAC5B,YAAM,MAAM,MAAM,MAAM,IAAI,GAAG,WAAW,GAAG,gBAAgB,GAAG,EAAE;AAClE,qBAAe,IAAI,KAAK,GAAG;AAAA,IAC7B;AACA,QAAI,cAAc,IAAI,GAAG,cAAc,KAAK,CAAC,YAAY,IAAI,GAAG,GAAG;AACjE,YAAM,QAAQ,MAAM,GACjB,MAAM,GAAG,SAAS,EAClB,WAAW,GAAG,cAAc,EAC5B,IAAI,GAAG,EAAE;AACZ,kBAAY,IAAI,KAAK,SAAS,IAAI;AAAA,IACpC;AACA,QAAI,GAAG,oBAAoB,QAAW;AACpC,YAAM,MAAM,eAAe,IAAI,GAAG,KAAK;AACvC,YAAM,SAAS,KAAK,MAAM;AAC1B,UAAI,WAAW,GAAG,iBAAiB;AACjC,cAAM,IAAI;AAAA,UACR;AAAA,UACA,2BAA2B,GAAG,SAAS,IAAI,GAAG,cAAc,IAAI,GAAG,EAAE,cACtD,GAAG,eAAe,YAAY,MAAM;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAYA,KAAG,oBAAoB,GAAG;AAC1B,MAAI;AACF,QAAI;AACF,iBAAW,MAAM,IAAI,MAAM;AACzB,cAAM,OAAO,GAAG,MAAM,GAAG,SAAS,EAAE,WAAW,GAAG,cAAc;AAChE,cAAM,MAAM,MAAM,EAAE;AACpB,cAAM,QAAQ,eAAe,IAAI,GAAG,KAAK;AAQzC,YAAI,UAAU,KAAK,EAAE,IAAI,eAAe,MAAM,CAAC;AAC/C,YAAI,GAAG,SAAS,OAAO;AAErB,gBAAM,KAAK,IAAI,GAAG,IAAI,GAAG,QAAe,GAAG,WAAW,SAAY,EAAE,QAAQ,GAAG,OAAO,IAAI,MAAS;AAAA,QACrG,OAAO;AACL,gBAAM,KAAK,OAAO,GAAG,EAAE;AAAA,QACzB;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AAEZ,YAAM,eAAe,IAAI,WAAW,OAAO,EAAE;AAE7C,UAAI,IAAI,YAAY;AAClB,mBAAW,KAAK,IAAI,iBAAiB,OAAO,GAAG;AAC7C,gBAAM,MAAM,EAAE,kBAAkB;AAChC,cAAI,QAAQ,MAAM;AAChB,gBAAI,eAAe;AACnB,gBAAI,YAAY;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF,UAAE;AACA,OAAG,sBAAsB,GAAG;AAAA,EAC9B;AAOA,MAAI,IAAI,YAAY;AAIlB,UAAM,EAAE,cAAc,IAAK,MAAM,OAAO,wBAAqC;AAG7E,QAAI;AACF,iBAAW,CAAC,WAAW,CAAC,KAAK,IAAI,kBAAkB;AACjD,cAAM,WAAW,EAAE,kBAAkB;AAKrC,YAAI,aAAa,KAAM;AACvB,cAAM,sBAAsB,SAAS,eAAe;AACpD,cAAM,OAAO,SAAS,YAAY;AAClC,YAAI,oBAAoB,SAAS,EAAG;AAEpC,cAAM,gBAAgB,EAAE,mBAAmB;AAC3C,YAAI,kBAAkB,KAAM;AAO5B,cAAM,mBAA6B,CAAC;AACpC,mBAAW,CAAC,YAAY,OAAO,KAAK,qBAAqB;AACvD,gBAAM,SAAS,SAAS,UAAU,UAAU,EAAE,OAAO,OAAK,EAAE,cAAc,MAAS;AACnF,qBAAW,SAAS,QAAQ;AAC1B,kBAAM,cAAc,aAAa,OAAO,SAAS;AAAA,cAC/C,UAAU;AAAA,cACV,OAAO;AAAA,cACP,QAAQ,EAAE;AAAA,cACV,MAAM,EAAE;AAAA,YACV,CAAC;AAAA,UACH;AACA,cAAI,OAAO,SAAS,EAAG,kBAAiB,KAAK,UAAU;AAAA,QACzD;AAKA,cAAM,SAAS,EAAE,iBAAiB;AAClC,YAAI,QAAQ;AACV,gBAAM,OAAO,EAAE;AACf,gBAAM,YAAmD;AAAA,YACvD,QAAQ,QAAS;AAAA,YACjB;AAAA,YACA,SAAS;AAAA,YACT;AAAA,UACF;AACA,gBAAM,OAAO,OAAO;AAAA,YAClB,IAAI;AAAA,YACJ,YAAY;AAAA,YACZ,IAAI;AAAA,YACJ,SAAS;AAAA,YACT,OAAO,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,YAKT,aAAa;AAAA,YACb;AAAA,UACF,CAAC;AAAA,QACH;AACA,aAAK;AAAA,MACP;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,eAAe,IAAI,WAAW,OAAO,EAAE;AAC7C,YAAM,eAAe,iBAAiB,MAAM,IAAI;AAAA,QAC9C,eAAe,QAAQ,IAAI,UAAU,uBAAuB,OAAO,GAAG,CAAC;AAAA,MACzE;AAAA,IACF;AAAA,EACF;AAWA,MAAI,WAAW,SAAS,GAAG;AAGzB,UAAM,SAAS,oBAAI,IAAsB;AACzC,UAAM,QAAkB,CAAC;AACzB,eAAW,MAAM,IAAI,MAAM;AACzB,YAAM,MAAM,MAAM,EAAE;AACpB,UAAI,CAAC,OAAO,IAAI,GAAG,EAAG,OAAM,KAAK,GAAG;AACpC,aAAO,IAAI,KAAK,EAAE;AAAA,IACpB;AAOA,UAAM,iBAAiB,oBAAI,IAAoC;AAG/D,UAAM,aAAa,oBAAI,IAAoB;AAC3C,eAAW,OAAO,OAAO;AACvB,YAAM,KAAK,OAAO,IAAI,GAAG;AACzB,UAAI,CAAC,cAAc,IAAI,GAAG,cAAc,EAAG;AAC3C,YAAM,SAAS,YAAY,IAAI,GAAG,KAAK;AACvC,YAAM,QAAQ,GAAG,SAAS,WAAW,OAAQ,GAAG,UAAU;AAC1D,YAAM,SAAS,EAAE,QAAQ,MAAM;AAC/B,YAAM,MAAM,eAAe,IAAI,GAAG,cAAc;AAChD,UAAI,IAAK,KAAI,KAAK,MAAM;AAAA,UACnB,gBAAe,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC;AAKnD,iBAAW,IAAI,GAAG,gBAAgB,GAAG,SAAS;AAAA,IAChD;AAEA,QAAI;AACF,iBAAW,OAAO,YAAY;AAC5B,cAAM,UAAU,eAAe,IAAI,IAAI,KAAK;AAC5C,YAAI,YAAY,UAAa,QAAQ,WAAW,EAAG;AACnD,cAAM,YAAY,WAAW,IAAI,IAAI,KAAK;AAC1C,cAAM,IAAI,GAAG,MAAM,SAAS;AAG5B,cAAM,SACJ,EAAE,mBAAmB,KAAK;AAAA,UACxB,WAAwB,MAAc;AACpC,kBAAM,IAAI,EAAE,WAAc,IAAI;AAC9B,mBAAO;AAAA,cACL,KAAK,CAAC,OAAe,EAAE,IAAI,EAAE;AAAA,cAC7B,MAAM,MAAM,EAAE,KAAK;AAAA,cACnB,OAAO,MAAM,EAAE,MAAM;AAAA,YACvB;AAAA,UACF;AAAA,QACF;AACF,cAAM,YAAmC;AAAA,UACvC,UAAU;AAAA,UACV,OAAO;AAAA,UACP,QAAQ,EAAE;AAAA,UACV,MAAM,EAAE;AAAA,QACV;AACA,cAAM,IAAI,MAAM,SAAS,SAAS;AAAA,MACpC;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,eAAe,IAAI,WAAW,OAAO,EAAE;AAC7C,YAAM,eAAe,iBAAiB,MAAM,IAAI;AAAA,QAC9C,eAAe,QAAQ,IAAI,UAAU,uBAAuB,OAAO,GAAG,CAAC;AAAA,MACzE;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAuBA,eAAsB,eACpB,UACA,OACA,IACe;AACf,QAAM,OAAO,SAAS,IAAI,CAAC,EAAE,IAAI,cAAc,OAAO;AAAA,IACpD,WAAW,GAAG;AAAA,IACd,gBAAgB,GAAG;AAAA,IACnB,IAAI,GAAG;AAAA,IACP,OAAO;AAAA,EACT,EAAE;AACF,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,KACI,OAAO,QAAQ;AAMb,YAAM,OAAO,GAAG,MAAM,IAAI,SAAS,EAAE,WAAW,IAAI,cAAc;AAElE,YAAO,KAAa,sBAAsB,IAAI,EAAE;AAAA,IAClD,IACA;AAAA,EACN;AACF;AAEA,SAAS,MAAM,IAAsB;AACnC,SAAO,GAAG,GAAG,SAAS,KAAO,GAAG,cAAc,KAAO,GAAG,EAAE;AAC5D;","names":[]}

package/dist/{chunk-H6HM6CVR.js → chunk-AKEOHKMT.js}

@@ -1,22 +1,22 @@
 import {
   assertTierAccess,
   dekKey
-} from "./chunk-4R4Q64W5.js";
+} from "./chunk-KKYEZCQG.js";
 import {
   rewrapBodyToDek
-} from "./chunk-QQJXBZCO.js";
+} from "./chunk-HA6ZQWA2.js";
 import {
   decrypt,
   encrypt,
   unwrapCek
-} from "./chunk-HUS3J5WM.js";
+} from "./chunk-37WOJQWY.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-CKZW6P5V.js";
+} from "./chunk-JC75UBMT.js";
 import {
   TierDemoteDeniedError,
   TiersNotEnabledError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/with-audit/tiers/active.ts
 function withTiers() {
@@ -196,6 +196,7 @@ async function elevate(ctx, id, toTier) {
   const body = await rewrapBodyToDek(envelope, fromDek, toDek);
   if (body.cek) ctx.cekCache?.set(id, body.cek, 1);
   const next = {
+    ...envelope,
     _noydb: NOYDB_FORMAT_VERSION,
     _v: envelope._v + 1,
     _ts: now,
@@ -239,14 +240,16 @@ async function demote(ctx, id, toTier) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const body = await rewrapBodyToDek(envelope, fromDek, toDek);
   if (body.cek) ctx.cekCache?.set(id, body.cek, 1);
+  const { _elevatedBy, _tier: _priorTier, ...carried } = envelope;
   const next = {
+    ...carried,
     _noydb: NOYDB_FORMAT_VERSION,
     _v: envelope._v + 1,
     _ts: now,
     _iv: body._iv,
     _data: body._data,
     _by: ctx.keyring.userId,
-    ...toTier > 0 && { _tier: toTier },
+    ...toTier > 0 ? { _tier: toTier } : {},
     ...body._cek !== void 0 ? { _cek: body._cek } : {}
   };
   await ctx.adapter.put(ctx.vault, ctx.name, id, next);
@@ -276,4 +279,4 @@ export {
   demote,
   classifySealedShred
 };
-//# sourceMappingURL=chunk-H6HM6CVR.js.map
+//# sourceMappingURL=chunk-AKEOHKMT.js.map

package/dist/{chunk-H6HM6CVR.js.map → chunk-AKEOHKMT.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-audit/tiers/active.ts","../src/with-audit/tiers/strategy.ts","../src/with-audit/tiers/index.ts"],"sourcesContent":["/**\n * Enable the hierarchical-tiers capability.\n * Pass to `createNoydb({ tiersStrategy: withTiers() })` to make a collection's\n * `putAtTier` / `getAtTier` / `listAtTier` / `elevate` / `demote` methods live.\n * The tier read/write/re-key engine is dynamically imported here, so it stays\n * out of the floor bundle until opted in.\n */\nimport type { TiersStrategy } from './strategy.js'\n\nexport function withTiers(): TiersStrategy {\n  return {\n    async putAtTier(ctx, id, record, tier, opts) {\n      const { putAtTier } = await import('./index.js')\n      return putAtTier(ctx, id, record, tier, opts)\n    },\n    async getAtTier(ctx, id) {\n      const { getAtTier } = await import('./index.js')\n      return getAtTier(ctx, id)\n    },\n    async listAtTier(ctx) {\n      const { listAtTier } = await import('./index.js')\n      return listAtTier(ctx)\n    },\n    async elevate(ctx, id, toTier) {\n      const { elevate } = await import('./index.js')\n      return elevate(ctx, id, toTier)\n    },\n    async demote(ctx, id, toTier) {\n      const { demote } = await import('./index.js')\n      return demote(ctx, id, toTier)\n    },\n  }\n}\n","/**\n * Tiers capability strategy — the five on-demand collection-level tier\n * operations the `Collection` routes through. The active engine\n * ({@link withTiers}) dynamically imports the tier cores (keeping them out of\n * the floor bundle); {@link NO_TIERS} throws. Collection always builds its\n * per-call {@link TiersContext} and delegates here, so an un-opted-in caller\n * hits `NO_TIERS`'s throw.\n * @internal\n */\nimport type { GhostRecord } from '../../kernel/types.js'\nimport type { TiersContext } from './index.js'\nimport { TiersNotEnabledError } from '../../kernel/errors.js'\n\nexport interface TiersStrategy {\n  putAtTier<T>(\n    ctx: TiersContext<T>,\n    id: string,\n    record: T,\n    tier: number,\n    opts?: { elevation?: { reason: string; fromTier: number }; source?: string; sourceTs?: string },\n  ): Promise<void>\n  getAtTier<T>(ctx: TiersContext<T>, id: string): Promise<T | GhostRecord | null>\n  listAtTier<T>(ctx: TiersContext<T>): Promise<Array<{ id: string; tier: number; readable: boolean }>>\n  elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void>\n  demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void>\n}\n\n/**\n * No-op stub — the floor default. Every capability method throws\n * {@link TiersNotEnabledError}; opt in with `tiersStrategy: withTiers()` in\n * createNoydb. @internal\n */\nexport const NO_TIERS: TiersStrategy = {\n  async putAtTier() { throw new TiersNotEnabledError() },\n  async getAtTier() { throw new TiersNotEnabledError() },\n  async listAtTier() { throw new TiersNotEnabledError() },\n  async elevate() { throw new TiersNotEnabledError() },\n  async demote() { throw new TiersNotEnabledError() },\n}\n","/**\n * Hierarchical access — the collection-level tier operations\n * (`putAtTier` / `getAtTier` / `listAtTier` / `elevate` / `demote`).\n *\n * A collection opted into `{ tiers: [...] }` stamps `_tier: N` on each envelope\n * and encrypts its body under the tier-N DEK. These helpers are the read/write\n * surface for that scheme: write at a tier, read with tier-aware visibility\n * (invisibility vs. ghost), and move a record up (`elevate`) or down (`demote`)\n * the tier ladder by re-wrapping its body key.\n *\n * Each function takes a small {@link TiersContext} (the exact `this.*` the\n * moving methods touched) instead of `this`, mirroring the `record-keys/`\n * siblings. Behaviour is byte-identical to the inline code it replaced.\n *\n * The crux is `cekCache`: `elevate`/`demote`/`getAtTier` write the SAME `Lru`\n * reference `Collection` owns (never a copy) so a per-record CEK re-wrap stays\n * synchronous with the cache the kernel's write/read path also mutates. The\n * cross-tier event sink stays collection-resident and is reached via the\n * `emitCrossTierEvent` callback.\n *\n * Internal service — not exported as a `@noy-db/hub/*` subpath.\n */\nexport { withTiers } from './active.js'\nexport { NO_TIERS, type TiersStrategy } from './strategy.js'\nexport { TiersNotEnabledError } from '../../kernel/errors.js'\nimport { encrypt, decrypt, unwrapCek, rewrapBodyToDek, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js'\nimport { TierDemoteDeniedError } from '../../kernel/errors.js'\nimport { dekKey, assertTierAccess } from '../../with-party/team/tiers.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { Lru } from '../../kernel/cache/index.js'\nimport {\n  NOYDB_FORMAT_VERSION,\n  type NoydbStore,\n  type EncryptedEnvelope,\n  type GhostRecord,\n  type TierMode,\n  type CrossTierAccessEvent,\n} from '../../kernel/types.js'\n\n/** Everything the moving tier methods touched on `this.*`, as a flat context. */\nexport interface TiersContext<T> {\n  /** Collection name — the crypto AAD scope and tier-DEK key prefix. */\n  readonly name: string\n  /** Vault namespace the records live under. */\n  readonly vault: string\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** The caller's unlocked keyring (tier-DEK holdings + role + userId). */\n  readonly keyring: UnlockedKeyring\n  /** The record codec — decrypts a tier-0 envelope to T. */\n  readonly codec: RecordCodec<T>\n  /**\n   * The collection's per-record CEK cache (SHARED reference, not a copy).\n   * `elevate`/`demote`/`getAtTier` re-wrap a record's CEK and `set` it here so\n   * the move stays synchronous with the cache the kernel's read/write path\n   * owns. `null` → no caching.\n   */\n  readonly cekCache: Lru<string, EnclaveKey> | null\n  /** Emit `_source`/`_sourceTs` provenance fields when a source is supplied. */\n  readonly provenance: boolean\n  /** Declared tiers, or null when the feature is off. */\n  readonly tiers: ReadonlySet<number> | null\n  /** Above-tier read visibility mode (`'invisibility'` | `'ghost'`). */\n  readonly tierMode: TierMode\n  /** Resolve a tier DEK by its `dekKey(name, tier)`. */\n  getDEK(key: string): Promise<EnclaveKey>\n  /** Fire a cross-tier access event (sink stays collection-resident). */\n  emitCrossTierEvent(event: CrossTierAccessEvent): void\n}\n\nexport function assertTiersEnabled<T>(ctx: TiersContext<T>): void {\n  if (!ctx.tiers) {\n    throw new Error(\n      `Collection \"${ctx.name}\": hierarchical tiers are not enabled. ` +\n      `Pass { tiers: [0, 1, 2, …] } to vault.collection() to opt in.`,\n    )\n  }\n}\n\nexport function assertDeclaredTier<T>(ctx: TiersContext<T>, tier: number): void {\n  if (tier < 0 || !Number.isInteger(tier)) {\n    throw new Error(`Collection \"${ctx.name}\": tier must be a non-negative integer, got ${tier}`)\n  }\n  if (tier === 0) return\n  if (!ctx.tiers || !ctx.tiers.has(tier)) {\n    throw new Error(\n      `Collection \"${ctx.name}\": tier ${tier} is not declared in { tiers: [...] }`,\n    )\n  }\n}\n\nfunction isElevatorOrOwner<T>(ctx: TiersContext<T>): boolean {\n  return ctx.keyring.role === 'owner' || ctx.keyring.role === 'admin'\n}\n\n/**\n * tier-aware put. Encrypts the record with the collection's tier-N DEK and\n * stamps `_tier: N` on the envelope. The caller's keyring must hold the tier-N\n * DEK (directly, by delegation, or by virtue of being the grantor); otherwise\n * throws `TierNotGrantedError`.\n *\n * accepts an optional `elevation` context. When present, the emitted cross-tier\n * event is stamped with `authorization: 'elevation'`, the elevation's reason,\n * and the caller's pre-elevation tier. `vault.elevate(...).collection().put`\n * threads this through; direct `putAtTier` calls leave it undefined and fall\n * back to the inherent-write event shape.\n */\nexport async function putAtTier<T>(\n  ctx: TiersContext<T>,\n  id: string,\n  record: T,\n  tier: number,\n  opts?: { elevation?: { reason: string; fromTier: number }; source?: string; sourceTs?: string },\n): Promise<void> {\n  assertTiersEnabled(ctx)\n  assertDeclaredTier(ctx, tier)\n  assertTierAccess(ctx.keyring, ctx.name, tier)\n\n  const key = dekKey(ctx.name, tier)\n  const dek = await ctx.getDEK(key)\n\n  const existing = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  const version = existing ? existing._v + 1 : 1\n  const json = JSON.stringify(record)\n  const { iv, data } = await encrypt(json, dek)\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: version,\n    _ts: new Date().toISOString(),\n    _iv: iv,\n    _data: data,\n    _by: ctx.keyring.userId,\n    ...(tier > 0 && { _tier: tier }),\n    ...(ctx.provenance && opts?.source !== undefined ? { _source: opts.source, _sourceTs: opts.sourceTs ?? new Date().toISOString() } : {}),\n  }\n\n  await ctx.adapter.put(ctx.vault, ctx.name, id, envelope)\n\n  if (tier > 0) {\n    ctx.emitCrossTierEvent({\n      actor: ctx.keyring.userId,\n      collection: ctx.name,\n      id,\n      tier,\n      authorization: opts?.elevation ? 'elevation' : 'inherent',\n      op: 'put',\n      ts: envelope._ts,\n      ...(opts?.elevation && {\n        reason: opts.elevation.reason,\n        elevatedFrom: opts.elevation.fromTier,\n      }),\n    })\n  }\n}\n\n/**\n * tier-aware get. When the stored record is at a tier the caller cannot\n * decrypt:\n *   - `'invisibility'` mode (default) → returns `null`.\n *   - `'ghost'` mode → returns a `GhostRecord` placeholder with the tier and\n *     the record id (the record exists but contents are withheld).\n *\n * Fully-cleared reads return the plaintext record and fire a cross-tier event\n * when `_tier > 0`.\n */\nexport async function getAtTier<T>(ctx: TiersContext<T>, id: string): Promise<T | GhostRecord | null> {\n  assertTiersEnabled(ctx)\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope) return null\n  const tier = envelope._tier ?? 0\n  if (tier === 0) {\n    return ctx.codec.decryptRecord(envelope, { id })\n  }\n\n  const key = dekKey(ctx.name, tier)\n  if (!ctx.keyring.deks.has(key)) {\n    if (ctx.tierMode === 'ghost') {\n      return { _ghost: true, _tier: tier } as GhostRecord\n    }\n    return null\n  }\n\n  const dek = await ctx.getDEK(key)\n  // A tiered record may carry a per-record CEK (e.g. a CEK record\n  // elevated via `elevate()`): the CEK is wrapped under the TIER DEK, so\n  // unwrap under the tier DEK then decrypt the body under the CEK. Legacy\n  // tiered records decrypt directly under the tier DEK.\n  let plaintext: string\n  let cek: EnclaveKey | undefined\n  if (envelope._cek !== undefined) {\n    cek = await unwrapCek(envelope._cek, dek)\n    ctx.cekCache?.set(id, cek, 1)\n    plaintext = await decrypt(envelope._iv, envelope._data, cek)\n  } else {\n    plaintext = await decrypt(envelope._iv, envelope._data, dek)\n  }\n  let record = JSON.parse(plaintext) as T\n\n  // #635: this manual-decrypt leg never went through `decryptRecord`, so it\n  // never processed `_sealed` slots — an elevated classified record read\n  // back through here would return the body WITHOUT its sealed fields\n  // (silent omission). `applySealedSlots` is the same post-processing\n  // `decryptRecord`'s tier-0 branch above gets for free, extracted so it can\n  // take OUR already-unwrapped `cek` (unwrapped under the TIER dek above)\n  // instead of resolving one itself under the collection DEK the way\n  // `decryptRecord`/`resolveEnvelopeCek` would — which would be the wrong\n  // key for a `_cek` wrapped under a tier DEK. `sealedAsHandles` is omitted\n  // (default false) to match this function's OWN tier-0 branch above\n  // (`ctx.codec.decryptRecord(envelope, { id })`, no `sealedAsHandles`) —\n  // both tiers return sealed fields inline-decrypted, not as handles.\n  if (envelope._sealed !== undefined) {\n    record = await ctx.codec.applySealedSlots(record, envelope._sealed, cek, { id })\n  }\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier,\n    authorization: isElevatorOrOwner(ctx) ? 'inherent' : 'delegation',\n    op: 'get',\n    ts: new Date().toISOString(),\n  })\n\n  return record\n}\n\n/**\n * list ids grouped by the caller's readability. Returns only ids whose tier the\n * caller can read. Above-tier ids are omitted in `'invisibility'` mode and\n * included (with tier metadata) in `'ghost'` mode.\n */\nexport async function listAtTier<T>(ctx: TiersContext<T>): Promise<Array<{ id: string; tier: number; readable: boolean }>> {\n  assertTiersEnabled(ctx)\n  const ids = await ctx.adapter.list(ctx.vault, ctx.name)\n  const out: Array<{ id: string; tier: number; readable: boolean }> = []\n  for (const id of ids) {\n    const env = await ctx.adapter.get(ctx.vault, ctx.name, id)\n    if (!env) continue\n    const tier = env._tier ?? 0\n    const readable = tier === 0 || ctx.keyring.deks.has(dekKey(ctx.name, tier))\n    if (!readable && ctx.tierMode === 'invisibility') continue\n    out.push({ id, tier, readable })\n  }\n  return out\n}\n\n/**\n * elevate a record to a higher tier. Re-encrypts with the target tier's DEK.\n * The caller must hold DEKs for both the current tier (to decrypt) and the\n * target tier (to re-encrypt). Stamps `_elevatedBy` with the caller id so\n * `demote()` can check the reverse operation.\n */\nexport async function elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void> {\n  assertTiersEnabled(ctx)\n  assertDeclaredTier(ctx, toTier)\n  assertTierAccess(ctx.keyring, ctx.name, toTier)\n\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope) throw new Error(`Record \"${id}\" not found in collection \"${ctx.name}\"`)\n  const fromTier = envelope._tier ?? 0\n  if (toTier === fromTier) return\n  if (toTier < fromTier) {\n    throw new Error(`Use demote() to lower the tier of \"${id}\" from ${fromTier} to ${toTier}`)\n  }\n  // Caller must have access at the existing tier to decrypt.\n  if (fromTier > 0) assertTierAccess(ctx.keyring, ctx.name, fromTier)\n\n  const fromKey = dekKey(ctx.name, fromTier)\n  const toKey = dekKey(ctx.name, toTier)\n  const fromDek = await ctx.getDEK(fromKey)\n  const toDek = await ctx.getDEK(toKey)\n\n  // Per-record CEK composes with tiers: the body key is unchanged (history\n  // chain identity preserved); only the wrapping key moves with the tier.\n  // Legacy (no `_cek`) records take the direct-DEK path unchanged.\n  const now = new Date().toISOString()\n  const body = await rewrapBodyToDek(envelope, fromDek, toDek)\n  if (body.cek) ctx.cekCache?.set(id, body.cek, 1)\n  const next: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: envelope._v + 1,\n    _ts: now,\n    _iv: body._iv,\n    _data: body._data,\n    _by: ctx.keyring.userId,\n    _tier: toTier,\n    _elevatedBy: ctx.keyring.userId,\n    ...(body._cek !== undefined ? { _cek: body._cek } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, ctx.name, id, next)\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier: toTier,\n    authorization: 'elevation',\n    op: 'elevate',\n    ts: now,\n  })\n}\n\n/**\n * demote a record to a lower tier. Allowed only for the user who performed the\n * last elevation or an owner.\n */\nexport async function demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void> {\n  assertTiersEnabled(ctx)\n  if (toTier < 0) throw new Error(`Cannot demote to negative tier ${toTier}`)\n\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope) throw new Error(`Record \"${id}\" not found in collection \"${ctx.name}\"`)\n  const fromTier = envelope._tier ?? 0\n  if (toTier === fromTier) return\n  if (toTier > fromTier) {\n    throw new Error(`Use elevate() to raise the tier of \"${id}\" from ${fromTier} to ${toTier}`)\n  }\n  const isOwner = ctx.keyring.role === 'owner'\n  const isOriginalElevator = envelope._elevatedBy === ctx.keyring.userId\n  if (!isOwner && !isOriginalElevator) {\n    throw new TierDemoteDeniedError(id, fromTier)\n  }\n  // Caller must still hold the DEK of the current tier to decrypt.\n  assertTierAccess(ctx.keyring, ctx.name, fromTier)\n  if (toTier > 0) assertDeclaredTier(ctx, toTier)\n\n  const fromDek = await ctx.getDEK(dekKey(ctx.name, fromTier))\n  const toDek = await ctx.getDEK(dekKey(ctx.name, toTier))\n\n  // CEK re-wrap on demote — same body key, moved from the source tier\n  // DEK to the target tier DEK. Legacy records take the direct-DEK path.\n  const now = new Date().toISOString()\n  const body = await rewrapBodyToDek(envelope, fromDek, toDek)\n  if (body.cek) ctx.cekCache?.set(id, body.cek, 1)\n  const next: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: envelope._v + 1,\n    _ts: now,\n    _iv: body._iv,\n    _data: body._data,\n    _by: ctx.keyring.userId,\n    ...(toTier > 0 && { _tier: toTier }),\n    ...(body._cek !== undefined ? { _cek: body._cek } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, ctx.name, id, next)\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier: fromTier,\n    authorization: 'elevation',\n    op: 'demote',\n    ts: now,\n  })\n}\n\n/**\n * Classify a live envelope's `_sealed` slots for crypto-shred completeness\n * (#M-1). Thin delegate to {@link RecordCodec.classifySealedShred}; surfaced\n * here because `vault.ts` forget() reaches in via `collection._classifySealedShred`.\n */\nexport function classifySealedShred<T>(\n  ctx: TiersContext<T>,\n  live: EncryptedEnvelope,\n): Promise<{ readonly slots: readonly SealedShredSlot[] }> {\n  return ctx.codec.classifySealedShred(live)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AASO,SAAS,YAA2B;AACzC,SAAO;AAAA,IACL,MAAM,UAAU,KAAK,IAAI,QAAQ,MAAM,MAAM;AAC3C,YAAM,EAAE,WAAAA,WAAU,IAAI,MAAM,OAAO,kBAAY;AAC/C,aAAOA,WAAU,KAAK,IAAI,QAAQ,MAAM,IAAI;AAAA,IAC9C;AAAA,IACA,MAAM,UAAU,KAAK,IAAI;AACvB,YAAM,EAAE,WAAAC,WAAU,IAAI,MAAM,OAAO,kBAAY;AAC/C,aAAOA,WAAU,KAAK,EAAE;AAAA,IAC1B;AAAA,IACA,MAAM,WAAW,KAAK;AACpB,YAAM,EAAE,YAAAC,YAAW,IAAI,MAAM,OAAO,kBAAY;AAChD,aAAOA,YAAW,GAAG;AAAA,IACvB;AAAA,IACA,MAAM,QAAQ,KAAK,IAAI,QAAQ;AAC7B,YAAM,EAAE,SAAAC,SAAQ,IAAI,MAAM,OAAO,kBAAY;AAC7C,aAAOA,SAAQ,KAAK,IAAI,MAAM;AAAA,IAChC;AAAA,IACA,MAAM,OAAO,KAAK,IAAI,QAAQ;AAC5B,YAAM,EAAE,QAAAC,QAAO,IAAI,MAAM,OAAO,kBAAY;AAC5C,aAAOA,QAAO,KAAK,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACF;;;ACAO,IAAM,WAA0B;AAAA,EACrC,MAAM,YAAY;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACrD,MAAM,YAAY;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACrD,MAAM,aAAa;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACtD,MAAM,UAAU;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACnD,MAAM,SAAS;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AACpD;;;ACgCO,SAAS,mBAAsB,KAA4B;AAChE,MAAI,CAAC,IAAI,OAAO;AACd,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI;AAAA,IAEzB;AAAA,EACF;AACF;AAEO,SAAS,mBAAsB,KAAsB,MAAoB;AAC9E,MAAI,OAAO,KAAK,CAAC,OAAO,UAAU,IAAI,GAAG;AACvC,UAAM,IAAI,MAAM,eAAe,IAAI,IAAI,+CAA+C,IAAI,EAAE;AAAA,EAC9F;AACA,MAAI,SAAS,EAAG;AAChB,MAAI,CAAC,IAAI,SAAS,CAAC,IAAI,MAAM,IAAI,IAAI,GAAG;AACtC,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI,WAAW,IAAI;AAAA,IACxC;AAAA,EACF;AACF;AAEA,SAAS,kBAAqB,KAA+B;AAC3D,SAAO,IAAI,QAAQ,SAAS,WAAW,IAAI,QAAQ,SAAS;AAC9D;AAcA,eAAsB,UACpB,KACA,IACA,QACA,MACA,MACe;AACf,qBAAmB,GAAG;AACtB,qBAAmB,KAAK,IAAI;AAC5B,mBAAiB,IAAI,SAAS,IAAI,MAAM,IAAI;AAE5C,QAAM,MAAM,OAAO,IAAI,MAAM,IAAI;AACjC,QAAM,MAAM,MAAM,IAAI,OAAO,GAAG;AAEhC,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,QAAM,UAAU,WAAW,SAAS,KAAK,IAAI;AAC7C,QAAM,OAAO,KAAK,UAAU,MAAM;AAClC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,KAAK,IAAI,QAAQ;AAAA,IACjB,GAAI,OAAO,KAAK,EAAE,OAAO,KAAK;AAAA,IAC9B,GAAI,IAAI,cAAc,MAAM,WAAW,SAAY,EAAE,SAAS,KAAK,QAAQ,WAAW,KAAK,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE,IAAI,CAAC;AAAA,EACvI;AAEA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,QAAQ;AAEvD,MAAI,OAAO,GAAG;AACZ,QAAI,mBAAmB;AAAA,MACrB,OAAO,IAAI,QAAQ;AAAA,MACnB,YAAY,IAAI;AAAA,MAChB;AAAA,MACA;AAAA,MACA,eAAe,MAAM,YAAY,cAAc;AAAA,MAC/C,IAAI;AAAA,MACJ,IAAI,SAAS;AAAA,MACb,GAAI,MAAM,aAAa;AAAA,QACrB,QAAQ,KAAK,UAAU;AAAA,QACvB,cAAc,KAAK,UAAU;AAAA,MAC/B;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAYA,eAAsB,UAAa,KAAsB,IAA6C;AACpG,qBAAmB,GAAG;AACtB,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,OAAO,SAAS,SAAS;AAC/B,MAAI,SAAS,GAAG;AACd,WAAO,IAAI,MAAM,cAAc,UAAU,EAAE,GAAG,CAAC;AAAA,EACjD;AAEA,QAAM,MAAM,OAAO,IAAI,MAAM,IAAI;AACjC,MAAI,CAAC,IAAI,QAAQ,KAAK,IAAI,GAAG,GAAG;AAC9B,QAAI,IAAI,aAAa,SAAS;AAC5B,aAAO,EAAE,QAAQ,MAAM,OAAO,KAAK;AAAA,IACrC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,MAAM,IAAI,OAAO,GAAG;AAKhC,MAAI;AACJ,MAAI;AACJ,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,MAAM,UAAU,SAAS,MAAM,GAAG;AACxC,QAAI,UAAU,IAAI,IAAI,KAAK,CAAC;AAC5B,gBAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAAA,EAC7D,OAAO;AACL,gBAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAAA,EAC7D;AACA,MAAI,SAAS,KAAK,MAAM,SAAS;AAcjC,MAAI,SAAS,YAAY,QAAW;AAClC,aAAS,MAAM,IAAI,MAAM,iBAAiB,QAAQ,SAAS,SAAS,KAAK,EAAE,GAAG,CAAC;AAAA,EACjF;AAEA,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA;AAAA,IACA,eAAe,kBAAkB,GAAG,IAAI,aAAa;AAAA,IACrD,IAAI;AAAA,IACJ,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,EAC7B,CAAC;AAED,SAAO;AACT;AAOA,eAAsB,WAAc,KAAuF;AACzH,qBAAmB,GAAG;AACtB,QAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,IAAI;AACtD,QAAM,MAA8D,CAAC;AACrE,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AACzD,QAAI,CAAC,IAAK;AACV,UAAM,OAAO,IAAI,SAAS;AAC1B,UAAM,WAAW,SAAS,KAAK,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,MAAM,IAAI,CAAC;AAC1E,QAAI,CAAC,YAAY,IAAI,aAAa,eAAgB;AAClD,QAAI,KAAK,EAAE,IAAI,MAAM,SAAS,CAAC;AAAA,EACjC;AACA,SAAO;AACT;AAQA,eAAsB,QAAW,KAAsB,IAAY,QAA+B;AAChG,qBAAmB,GAAG;AACtB,qBAAmB,KAAK,MAAM;AAC9B,mBAAiB,IAAI,SAAS,IAAI,MAAM,MAAM;AAE9C,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,WAAW,EAAE,8BAA8B,IAAI,IAAI,GAAG;AACrF,QAAM,WAAW,SAAS,SAAS;AACnC,MAAI,WAAW,SAAU;AACzB,MAAI,SAAS,UAAU;AACrB,UAAM,IAAI,MAAM,sCAAsC,EAAE,UAAU,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC3F;AAEA,MAAI,WAAW,EAAG,kBAAiB,IAAI,SAAS,IAAI,MAAM,QAAQ;AAElE,QAAM,UAAU,OAAO,IAAI,MAAM,QAAQ;AACzC,QAAM,QAAQ,OAAO,IAAI,MAAM,MAAM;AACrC,QAAM,UAAU,MAAM,IAAI,OAAO,OAAO;AACxC,QAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;AAKpC,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,OAAO,MAAM,gBAAgB,UAAU,SAAS,KAAK;AAC3D,MAAI,KAAK,IAAK,KAAI,UAAU,IAAI,IAAI,KAAK,KAAK,CAAC;AAC/C,QAAM,OAA0B;AAAA,IAC9B,QAAQ;AAAA,IACR,IAAI,SAAS,KAAK;AAAA,IAClB,KAAK;AAAA,IACL,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,IAAI,QAAQ;AAAA,IACjB,OAAO;AAAA,IACP,aAAa,IAAI,QAAQ;AAAA,IACzB,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,IAAI;AAEnD,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA,MAAM;AAAA,IACN,eAAe;AAAA,IACf,IAAI;AAAA,IACJ,IAAI;AAAA,EACN,CAAC;AACH;AAMA,eAAsB,OAAU,KAAsB,IAAY,QAA+B;AAC/F,qBAAmB,GAAG;AACtB,MAAI,SAAS,EAAG,OAAM,IAAI,MAAM,kCAAkC,MAAM,EAAE;AAE1E,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,WAAW,EAAE,8BAA8B,IAAI,IAAI,GAAG;AACrF,QAAM,WAAW,SAAS,SAAS;AACnC,MAAI,WAAW,SAAU;AACzB,MAAI,SAAS,UAAU;AACrB,UAAM,IAAI,MAAM,uCAAuC,EAAE,UAAU,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC5F;AACA,QAAM,UAAU,IAAI,QAAQ,SAAS;AACrC,QAAM,qBAAqB,SAAS,gBAAgB,IAAI,QAAQ;AAChE,MAAI,CAAC,WAAW,CAAC,oBAAoB;AACnC,UAAM,IAAI,sBAAsB,IAAI,QAAQ;AAAA,EAC9C;AAEA,mBAAiB,IAAI,SAAS,IAAI,MAAM,QAAQ;AAChD,MAAI,SAAS,EAAG,oBAAmB,KAAK,MAAM;AAE9C,QAAM,UAAU,MAAM,IAAI,OAAO,OAAO,IAAI,MAAM,QAAQ,CAAC;AAC3D,QAAM,QAAQ,MAAM,IAAI,OAAO,OAAO,IAAI,MAAM,MAAM,CAAC;AAIvD,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,OAAO,MAAM,gBAAgB,UAAU,SAAS,KAAK;AAC3D,MAAI,KAAK,IAAK,KAAI,UAAU,IAAI,IAAI,KAAK,KAAK,CAAC;AAC/C,QAAM,OAA0B;AAAA,IAC9B,QAAQ;AAAA,IACR,IAAI,SAAS,KAAK;AAAA,IAClB,KAAK;AAAA,IACL,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,IAAI,QAAQ;AAAA,IACjB,GAAI,SAAS,KAAK,EAAE,OAAO,OAAO;AAAA,IAClC,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,IAAI;AAEnD,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA,MAAM;AAAA,IACN,eAAe;AAAA,IACf,IAAI;AAAA,IACJ,IAAI;AAAA,EACN,CAAC;AACH;AAOO,SAAS,oBACd,KACA,MACyD;AACzD,SAAO,IAAI,MAAM,oBAAoB,IAAI;AAC3C;","names":["putAtTier","getAtTier","listAtTier","elevate","demote"]}
+{"version":3,"sources":["../src/with-audit/tiers/active.ts","../src/with-audit/tiers/strategy.ts","../src/with-audit/tiers/index.ts"],"sourcesContent":["/**\n * Enable the hierarchical-tiers capability.\n * Pass to `createNoydb({ tiersStrategy: withTiers() })` to make a collection's\n * `putAtTier` / `getAtTier` / `listAtTier` / `elevate` / `demote` methods live.\n * The tier read/write/re-key engine is dynamically imported here, so it stays\n * out of the floor bundle until opted in.\n */\nimport type { TiersStrategy } from './strategy.js'\n\nexport function withTiers(): TiersStrategy {\n  return {\n    async putAtTier(ctx, id, record, tier, opts) {\n      const { putAtTier } = await import('./index.js')\n      return putAtTier(ctx, id, record, tier, opts)\n    },\n    async getAtTier(ctx, id) {\n      const { getAtTier } = await import('./index.js')\n      return getAtTier(ctx, id)\n    },\n    async listAtTier(ctx) {\n      const { listAtTier } = await import('./index.js')\n      return listAtTier(ctx)\n    },\n    async elevate(ctx, id, toTier) {\n      const { elevate } = await import('./index.js')\n      return elevate(ctx, id, toTier)\n    },\n    async demote(ctx, id, toTier) {\n      const { demote } = await import('./index.js')\n      return demote(ctx, id, toTier)\n    },\n  }\n}\n","/**\n * Tiers capability strategy — the five on-demand collection-level tier\n * operations the `Collection` routes through. The active engine\n * ({@link withTiers}) dynamically imports the tier cores (keeping them out of\n * the floor bundle); {@link NO_TIERS} throws. Collection always builds its\n * per-call {@link TiersContext} and delegates here, so an un-opted-in caller\n * hits `NO_TIERS`'s throw.\n * @internal\n */\nimport type { GhostRecord } from '../../kernel/types.js'\nimport type { TiersContext } from './index.js'\nimport { TiersNotEnabledError } from '../../kernel/errors.js'\n\nexport interface TiersStrategy {\n  putAtTier<T>(\n    ctx: TiersContext<T>,\n    id: string,\n    record: T,\n    tier: number,\n    opts?: { elevation?: { reason: string; fromTier: number }; source?: string; sourceTs?: string },\n  ): Promise<void>\n  getAtTier<T>(ctx: TiersContext<T>, id: string): Promise<T | GhostRecord | null>\n  listAtTier<T>(ctx: TiersContext<T>): Promise<Array<{ id: string; tier: number; readable: boolean }>>\n  elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void>\n  demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void>\n}\n\n/**\n * No-op stub — the floor default. Every capability method throws\n * {@link TiersNotEnabledError}; opt in with `tiersStrategy: withTiers()` in\n * createNoydb. @internal\n */\nexport const NO_TIERS: TiersStrategy = {\n  async putAtTier() { throw new TiersNotEnabledError() },\n  async getAtTier() { throw new TiersNotEnabledError() },\n  async listAtTier() { throw new TiersNotEnabledError() },\n  async elevate() { throw new TiersNotEnabledError() },\n  async demote() { throw new TiersNotEnabledError() },\n}\n","/**\n * Hierarchical access — the collection-level tier operations\n * (`putAtTier` / `getAtTier` / `listAtTier` / `elevate` / `demote`).\n *\n * A collection opted into `{ tiers: [...] }` stamps `_tier: N` on each envelope\n * and encrypts its body under the tier-N DEK. These helpers are the read/write\n * surface for that scheme: write at a tier, read with tier-aware visibility\n * (invisibility vs. ghost), and move a record up (`elevate`) or down (`demote`)\n * the tier ladder by re-wrapping its body key.\n *\n * Each function takes a small {@link TiersContext} (the exact `this.*` the\n * moving methods touched) instead of `this`, mirroring the `record-keys/`\n * siblings. Behaviour is byte-identical to the inline code it replaced.\n *\n * The crux is `cekCache`: `elevate`/`demote`/`getAtTier` write the SAME `Lru`\n * reference `Collection` owns (never a copy) so a per-record CEK re-wrap stays\n * synchronous with the cache the kernel's write/read path also mutates. The\n * cross-tier event sink stays collection-resident and is reached via the\n * `emitCrossTierEvent` callback.\n *\n * Internal service — not exported as a `@noy-db/hub/*` subpath.\n */\nexport { withTiers } from './active.js'\nexport { NO_TIERS, type TiersStrategy } from './strategy.js'\nexport { TiersNotEnabledError } from '../../kernel/errors.js'\nimport { encrypt, decrypt, unwrapCek, rewrapBodyToDek, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js'\nimport { TierDemoteDeniedError } from '../../kernel/errors.js'\nimport { dekKey, assertTierAccess } from '../../with-party/team/tiers.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { Lru } from '../../kernel/cache/index.js'\nimport {\n  NOYDB_FORMAT_VERSION,\n  type NoydbStore,\n  type EncryptedEnvelope,\n  type GhostRecord,\n  type TierMode,\n  type CrossTierAccessEvent,\n} from '../../kernel/types.js'\n\n/** Everything the moving tier methods touched on `this.*`, as a flat context. */\nexport interface TiersContext<T> {\n  /** Collection name — the crypto AAD scope and tier-DEK key prefix. */\n  readonly name: string\n  /** Vault namespace the records live under. */\n  readonly vault: string\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** The caller's unlocked keyring (tier-DEK holdings + role + userId). */\n  readonly keyring: UnlockedKeyring\n  /** The record codec — decrypts a tier-0 envelope to T. */\n  readonly codec: RecordCodec<T>\n  /**\n   * The collection's per-record CEK cache (SHARED reference, not a copy).\n   * `elevate`/`demote`/`getAtTier` re-wrap a record's CEK and `set` it here so\n   * the move stays synchronous with the cache the kernel's read/write path\n   * owns. `null` → no caching.\n   */\n  readonly cekCache: Lru<string, EnclaveKey> | null\n  /** Emit `_source`/`_sourceTs` provenance fields when a source is supplied. */\n  readonly provenance: boolean\n  /** Declared tiers, or null when the feature is off. */\n  readonly tiers: ReadonlySet<number> | null\n  /** Above-tier read visibility mode (`'invisibility'` | `'ghost'`). */\n  readonly tierMode: TierMode\n  /** Resolve a tier DEK by its `dekKey(name, tier)`. */\n  getDEK(key: string): Promise<EnclaveKey>\n  /** Fire a cross-tier access event (sink stays collection-resident). */\n  emitCrossTierEvent(event: CrossTierAccessEvent): void\n}\n\nexport function assertTiersEnabled<T>(ctx: TiersContext<T>): void {\n  if (!ctx.tiers) {\n    throw new Error(\n      `Collection \"${ctx.name}\": hierarchical tiers are not enabled. ` +\n      `Pass { tiers: [0, 1, 2, …] } to vault.collection() to opt in.`,\n    )\n  }\n}\n\nexport function assertDeclaredTier<T>(ctx: TiersContext<T>, tier: number): void {\n  if (tier < 0 || !Number.isInteger(tier)) {\n    throw new Error(`Collection \"${ctx.name}\": tier must be a non-negative integer, got ${tier}`)\n  }\n  if (tier === 0) return\n  if (!ctx.tiers || !ctx.tiers.has(tier)) {\n    throw new Error(\n      `Collection \"${ctx.name}\": tier ${tier} is not declared in { tiers: [...] }`,\n    )\n  }\n}\n\nfunction isElevatorOrOwner<T>(ctx: TiersContext<T>): boolean {\n  return ctx.keyring.role === 'owner' || ctx.keyring.role === 'admin'\n}\n\n/**\n * tier-aware put. Encrypts the record with the collection's tier-N DEK and\n * stamps `_tier: N` on the envelope. The caller's keyring must hold the tier-N\n * DEK (directly, by delegation, or by virtue of being the grantor); otherwise\n * throws `TierNotGrantedError`.\n *\n * accepts an optional `elevation` context. When present, the emitted cross-tier\n * event is stamped with `authorization: 'elevation'`, the elevation's reason,\n * and the caller's pre-elevation tier. `vault.elevate(...).collection().put`\n * threads this through; direct `putAtTier` calls leave it undefined and fall\n * back to the inherent-write event shape.\n */\nexport async function putAtTier<T>(\n  ctx: TiersContext<T>,\n  id: string,\n  record: T,\n  tier: number,\n  opts?: { elevation?: { reason: string; fromTier: number }; source?: string; sourceTs?: string },\n): Promise<void> {\n  assertTiersEnabled(ctx)\n  assertDeclaredTier(ctx, tier)\n  assertTierAccess(ctx.keyring, ctx.name, tier)\n\n  const key = dekKey(ctx.name, tier)\n  const dek = await ctx.getDEK(key)\n\n  const existing = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  const version = existing ? existing._v + 1 : 1\n  const json = JSON.stringify(record)\n  const { iv, data } = await encrypt(json, dek)\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: version,\n    _ts: new Date().toISOString(),\n    _iv: iv,\n    _data: data,\n    _by: ctx.keyring.userId,\n    ...(tier > 0 && { _tier: tier }),\n    ...(ctx.provenance && opts?.source !== undefined ? { _source: opts.source, _sourceTs: opts.sourceTs ?? new Date().toISOString() } : {}),\n  }\n\n  await ctx.adapter.put(ctx.vault, ctx.name, id, envelope)\n\n  if (tier > 0) {\n    ctx.emitCrossTierEvent({\n      actor: ctx.keyring.userId,\n      collection: ctx.name,\n      id,\n      tier,\n      authorization: opts?.elevation ? 'elevation' : 'inherent',\n      op: 'put',\n      ts: envelope._ts,\n      ...(opts?.elevation && {\n        reason: opts.elevation.reason,\n        elevatedFrom: opts.elevation.fromTier,\n      }),\n    })\n  }\n}\n\n/**\n * tier-aware get. When the stored record is at a tier the caller cannot\n * decrypt:\n *   - `'invisibility'` mode (default) → returns `null`.\n *   - `'ghost'` mode → returns a `GhostRecord` placeholder with the tier and\n *     the record id (the record exists but contents are withheld).\n *\n * Fully-cleared reads return the plaintext record and fire a cross-tier event\n * when `_tier > 0`.\n */\nexport async function getAtTier<T>(ctx: TiersContext<T>, id: string): Promise<T | GhostRecord | null> {\n  assertTiersEnabled(ctx)\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope) return null\n  const tier = envelope._tier ?? 0\n  if (tier === 0) {\n    return ctx.codec.decryptRecord(envelope, { id })\n  }\n\n  const key = dekKey(ctx.name, tier)\n  if (!ctx.keyring.deks.has(key)) {\n    if (ctx.tierMode === 'ghost') {\n      return { _ghost: true, _tier: tier } as GhostRecord\n    }\n    return null\n  }\n\n  const dek = await ctx.getDEK(key)\n  // A tiered record may carry a per-record CEK (e.g. a CEK record\n  // elevated via `elevate()`): the CEK is wrapped under the TIER DEK, so\n  // unwrap under the tier DEK then decrypt the body under the CEK. Legacy\n  // tiered records decrypt directly under the tier DEK.\n  let plaintext: string\n  let cek: EnclaveKey | undefined\n  if (envelope._cek !== undefined) {\n    cek = await unwrapCek(envelope._cek, dek)\n    ctx.cekCache?.set(id, cek, 1)\n    plaintext = await decrypt(envelope._iv, envelope._data, cek)\n  } else {\n    plaintext = await decrypt(envelope._iv, envelope._data, dek)\n  }\n  let record = JSON.parse(plaintext) as T\n\n  // #635: this manual-decrypt leg never went through `decryptRecord`, so it\n  // never processed `_sealed` slots — an elevated classified record read\n  // back through here would return the body WITHOUT its sealed fields\n  // (silent omission). `applySealedSlots` is the same post-processing\n  // `decryptRecord`'s tier-0 branch above gets for free, extracted so it can\n  // take OUR already-unwrapped `cek` (unwrapped under the TIER dek above)\n  // instead of resolving one itself under the collection DEK the way\n  // `decryptRecord`/`resolveEnvelopeCek` would — which would be the wrong\n  // key for a `_cek` wrapped under a tier DEK. `sealedAsHandles` is omitted\n  // (default false) to match this function's OWN tier-0 branch above\n  // (`ctx.codec.decryptRecord(envelope, { id })`, no `sealedAsHandles`) —\n  // both tiers return sealed fields inline-decrypted, not as handles.\n  if (envelope._sealed !== undefined) {\n    record = await ctx.codec.applySealedSlots(record, envelope._sealed, cek, { id })\n  }\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier,\n    authorization: isElevatorOrOwner(ctx) ? 'inherent' : 'delegation',\n    op: 'get',\n    ts: new Date().toISOString(),\n  })\n\n  return record\n}\n\n/**\n * list ids grouped by the caller's readability. Returns only ids whose tier the\n * caller can read. Above-tier ids are omitted in `'invisibility'` mode and\n * included (with tier metadata) in `'ghost'` mode.\n */\nexport async function listAtTier<T>(ctx: TiersContext<T>): Promise<Array<{ id: string; tier: number; readable: boolean }>> {\n  assertTiersEnabled(ctx)\n  const ids = await ctx.adapter.list(ctx.vault, ctx.name)\n  const out: Array<{ id: string; tier: number; readable: boolean }> = []\n  for (const id of ids) {\n    const env = await ctx.adapter.get(ctx.vault, ctx.name, id)\n    if (!env) continue\n    const tier = env._tier ?? 0\n    const readable = tier === 0 || ctx.keyring.deks.has(dekKey(ctx.name, tier))\n    if (!readable && ctx.tierMode === 'invisibility') continue\n    out.push({ id, tier, readable })\n  }\n  return out\n}\n\n/**\n * elevate a record to a higher tier. Re-encrypts with the target tier's DEK.\n * The caller must hold DEKs for both the current tier (to decrypt) and the\n * target tier (to re-encrypt). Stamps `_elevatedBy` with the caller id so\n * `demote()` can check the reverse operation.\n */\nexport async function elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void> {\n  assertTiersEnabled(ctx)\n  assertDeclaredTier(ctx, toTier)\n  assertTierAccess(ctx.keyring, ctx.name, toTier)\n\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope) throw new Error(`Record \"${id}\" not found in collection \"${ctx.name}\"`)\n  const fromTier = envelope._tier ?? 0\n  if (toTier === fromTier) return\n  if (toTier < fromTier) {\n    throw new Error(`Use demote() to lower the tier of \"${id}\" from ${fromTier} to ${toTier}`)\n  }\n  // Caller must have access at the existing tier to decrypt.\n  if (fromTier > 0) assertTierAccess(ctx.keyring, ctx.name, fromTier)\n\n  const fromKey = dekKey(ctx.name, fromTier)\n  const toKey = dekKey(ctx.name, toTier)\n  const fromDek = await ctx.getDEK(fromKey)\n  const toDek = await ctx.getDEK(toKey)\n\n  // Per-record CEK composes with tiers: the body key is unchanged (history\n  // chain identity preserved); only the wrapping key moves with the tier.\n  // Legacy (no `_cek`) records take the direct-DEK path unchanged.\n  const now = new Date().toISOString()\n  const body = await rewrapBodyToDek(envelope, fromDek, toDek)\n  if (body.cek) ctx.cekCache?.set(id, body.cek, 1)\n  // #662: spread every slot the source carries (_sealed/_det/_vdig/_bidx/\n  // _source/_sourceTs/_debug) through UNCHANGED, then override only\n  // the fields a tier move manages. rewrapBodyToDek preserves the CEK, so no\n  // passenger slot is re-keyed by the move. The old field-literal dropped every\n  // unlisted slot.\n  const next: EncryptedEnvelope = {\n    ...envelope,\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: envelope._v + 1,\n    _ts: now,\n    _iv: body._iv,\n    _data: body._data,\n    _by: ctx.keyring.userId,\n    _tier: toTier,\n    _elevatedBy: ctx.keyring.userId,\n    ...(body._cek !== undefined ? { _cek: body._cek } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, ctx.name, id, next)\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier: toTier,\n    authorization: 'elevation',\n    op: 'elevate',\n    ts: now,\n  })\n}\n\n/**\n * demote a record to a lower tier. Allowed only for the user who performed the\n * last elevation or an owner.\n */\nexport async function demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void> {\n  assertTiersEnabled(ctx)\n  if (toTier < 0) throw new Error(`Cannot demote to negative tier ${toTier}`)\n\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope) throw new Error(`Record \"${id}\" not found in collection \"${ctx.name}\"`)\n  const fromTier = envelope._tier ?? 0\n  if (toTier === fromTier) return\n  if (toTier > fromTier) {\n    throw new Error(`Use elevate() to raise the tier of \"${id}\" from ${fromTier} to ${toTier}`)\n  }\n  const isOwner = ctx.keyring.role === 'owner'\n  const isOriginalElevator = envelope._elevatedBy === ctx.keyring.userId\n  if (!isOwner && !isOriginalElevator) {\n    throw new TierDemoteDeniedError(id, fromTier)\n  }\n  // Caller must still hold the DEK of the current tier to decrypt.\n  assertTierAccess(ctx.keyring, ctx.name, fromTier)\n  if (toTier > 0) assertDeclaredTier(ctx, toTier)\n\n  const fromDek = await ctx.getDEK(dekKey(ctx.name, fromTier))\n  const toDek = await ctx.getDEK(dekKey(ctx.name, toTier))\n\n  // CEK re-wrap on demote — same body key, moved from the source tier\n  // DEK to the target tier DEK. Legacy records take the direct-DEK path.\n  const now = new Date().toISOString()\n  const body = await rewrapBodyToDek(envelope, fromDek, toDek)\n  if (body.cek) ctx.cekCache?.set(id, body.cek, 1)\n  // #662: same passenger carry-through as elevate(). demote additionally CLEARS\n  // `_elevatedBy` (the demote right is consumed) and OMITS `_tier` at tier 0, so\n  // both are destructured out of the spread rather than carried.\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars -- excluded from ...carried\n  const { _elevatedBy, _tier: _priorTier, ...carried } = envelope\n  const next: EncryptedEnvelope = {\n    ...carried,\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: envelope._v + 1,\n    _ts: now,\n    _iv: body._iv,\n    _data: body._data,\n    _by: ctx.keyring.userId,\n    ...(toTier > 0 ? { _tier: toTier } : {}),\n    ...(body._cek !== undefined ? { _cek: body._cek } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, ctx.name, id, next)\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier: fromTier,\n    authorization: 'elevation',\n    op: 'demote',\n    ts: now,\n  })\n}\n\n/**\n * Classify a live envelope's `_sealed` slots for crypto-shred completeness\n * (#M-1). Thin delegate to {@link RecordCodec.classifySealedShred}; surfaced\n * here because `vault.ts` forget() reaches in via `collection._classifySealedShred`.\n */\nexport function classifySealedShred<T>(\n  ctx: TiersContext<T>,\n  live: EncryptedEnvelope,\n): Promise<{ readonly slots: readonly SealedShredSlot[] }> {\n  return ctx.codec.classifySealedShred(live)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AASO,SAAS,YAA2B;AACzC,SAAO;AAAA,IACL,MAAM,UAAU,KAAK,IAAI,QAAQ,MAAM,MAAM;AAC3C,YAAM,EAAE,WAAAA,WAAU,IAAI,MAAM,OAAO,kBAAY;AAC/C,aAAOA,WAAU,KAAK,IAAI,QAAQ,MAAM,IAAI;AAAA,IAC9C;AAAA,IACA,MAAM,UAAU,KAAK,IAAI;AACvB,YAAM,EAAE,WAAAC,WAAU,IAAI,MAAM,OAAO,kBAAY;AAC/C,aAAOA,WAAU,KAAK,EAAE;AAAA,IAC1B;AAAA,IACA,MAAM,WAAW,KAAK;AACpB,YAAM,EAAE,YAAAC,YAAW,IAAI,MAAM,OAAO,kBAAY;AAChD,aAAOA,YAAW,GAAG;AAAA,IACvB;AAAA,IACA,MAAM,QAAQ,KAAK,IAAI,QAAQ;AAC7B,YAAM,EAAE,SAAAC,SAAQ,IAAI,MAAM,OAAO,kBAAY;AAC7C,aAAOA,SAAQ,KAAK,IAAI,MAAM;AAAA,IAChC;AAAA,IACA,MAAM,OAAO,KAAK,IAAI,QAAQ;AAC5B,YAAM,EAAE,QAAAC,QAAO,IAAI,MAAM,OAAO,kBAAY;AAC5C,aAAOA,QAAO,KAAK,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACF;;;ACAO,IAAM,WAA0B;AAAA,EACrC,MAAM,YAAY;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACrD,MAAM,YAAY;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACrD,MAAM,aAAa;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACtD,MAAM,UAAU;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACnD,MAAM,SAAS;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AACpD;;;ACgCO,SAAS,mBAAsB,KAA4B;AAChE,MAAI,CAAC,IAAI,OAAO;AACd,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI;AAAA,IAEzB;AAAA,EACF;AACF;AAEO,SAAS,mBAAsB,KAAsB,MAAoB;AAC9E,MAAI,OAAO,KAAK,CAAC,OAAO,UAAU,IAAI,GAAG;AACvC,UAAM,IAAI,MAAM,eAAe,IAAI,IAAI,+CAA+C,IAAI,EAAE;AAAA,EAC9F;AACA,MAAI,SAAS,EAAG;AAChB,MAAI,CAAC,IAAI,SAAS,CAAC,IAAI,MAAM,IAAI,IAAI,GAAG;AACtC,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI,WAAW,IAAI;AAAA,IACxC;AAAA,EACF;AACF;AAEA,SAAS,kBAAqB,KAA+B;AAC3D,SAAO,IAAI,QAAQ,SAAS,WAAW,IAAI,QAAQ,SAAS;AAC9D;AAcA,eAAsB,UACpB,KACA,IACA,QACA,MACA,MACe;AACf,qBAAmB,GAAG;AACtB,qBAAmB,KAAK,IAAI;AAC5B,mBAAiB,IAAI,SAAS,IAAI,MAAM,IAAI;AAE5C,QAAM,MAAM,OAAO,IAAI,MAAM,IAAI;AACjC,QAAM,MAAM,MAAM,IAAI,OAAO,GAAG;AAEhC,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,QAAM,UAAU,WAAW,SAAS,KAAK,IAAI;AAC7C,QAAM,OAAO,KAAK,UAAU,MAAM;AAClC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,KAAK,IAAI,QAAQ;AAAA,IACjB,GAAI,OAAO,KAAK,EAAE,OAAO,KAAK;AAAA,IAC9B,GAAI,IAAI,cAAc,MAAM,WAAW,SAAY,EAAE,SAAS,KAAK,QAAQ,WAAW,KAAK,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE,IAAI,CAAC;AAAA,EACvI;AAEA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,QAAQ;AAEvD,MAAI,OAAO,GAAG;AACZ,QAAI,mBAAmB;AAAA,MACrB,OAAO,IAAI,QAAQ;AAAA,MACnB,YAAY,IAAI;AAAA,MAChB;AAAA,MACA;AAAA,MACA,eAAe,MAAM,YAAY,cAAc;AAAA,MAC/C,IAAI;AAAA,MACJ,IAAI,SAAS;AAAA,MACb,GAAI,MAAM,aAAa;AAAA,QACrB,QAAQ,KAAK,UAAU;AAAA,QACvB,cAAc,KAAK,UAAU;AAAA,MAC/B;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAYA,eAAsB,UAAa,KAAsB,IAA6C;AACpG,qBAAmB,GAAG;AACtB,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,OAAO,SAAS,SAAS;AAC/B,MAAI,SAAS,GAAG;AACd,WAAO,IAAI,MAAM,cAAc,UAAU,EAAE,GAAG,CAAC;AAAA,EACjD;AAEA,QAAM,MAAM,OAAO,IAAI,MAAM,IAAI;AACjC,MAAI,CAAC,IAAI,QAAQ,KAAK,IAAI,GAAG,GAAG;AAC9B,QAAI,IAAI,aAAa,SAAS;AAC5B,aAAO,EAAE,QAAQ,MAAM,OAAO,KAAK;AAAA,IACrC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,MAAM,IAAI,OAAO,GAAG;AAKhC,MAAI;AACJ,MAAI;AACJ,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,MAAM,UAAU,SAAS,MAAM,GAAG;AACxC,QAAI,UAAU,IAAI,IAAI,KAAK,CAAC;AAC5B,gBAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAAA,EAC7D,OAAO;AACL,gBAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAAA,EAC7D;AACA,MAAI,SAAS,KAAK,MAAM,SAAS;AAcjC,MAAI,SAAS,YAAY,QAAW;AAClC,aAAS,MAAM,IAAI,MAAM,iBAAiB,QAAQ,SAAS,SAAS,KAAK,EAAE,GAAG,CAAC;AAAA,EACjF;AAEA,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA;AAAA,IACA,eAAe,kBAAkB,GAAG,IAAI,aAAa;AAAA,IACrD,IAAI;AAAA,IACJ,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,EAC7B,CAAC;AAED,SAAO;AACT;AAOA,eAAsB,WAAc,KAAuF;AACzH,qBAAmB,GAAG;AACtB,QAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,IAAI;AACtD,QAAM,MAA8D,CAAC;AACrE,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AACzD,QAAI,CAAC,IAAK;AACV,UAAM,OAAO,IAAI,SAAS;AAC1B,UAAM,WAAW,SAAS,KAAK,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,MAAM,IAAI,CAAC;AAC1E,QAAI,CAAC,YAAY,IAAI,aAAa,eAAgB;AAClD,QAAI,KAAK,EAAE,IAAI,MAAM,SAAS,CAAC;AAAA,EACjC;AACA,SAAO;AACT;AAQA,eAAsB,QAAW,KAAsB,IAAY,QAA+B;AAChG,qBAAmB,GAAG;AACtB,qBAAmB,KAAK,MAAM;AAC9B,mBAAiB,IAAI,SAAS,IAAI,MAAM,MAAM;AAE9C,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,WAAW,EAAE,8BAA8B,IAAI,IAAI,GAAG;AACrF,QAAM,WAAW,SAAS,SAAS;AACnC,MAAI,WAAW,SAAU;AACzB,MAAI,SAAS,UAAU;AACrB,UAAM,IAAI,MAAM,sCAAsC,EAAE,UAAU,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC3F;AAEA,MAAI,WAAW,EAAG,kBAAiB,IAAI,SAAS,IAAI,MAAM,QAAQ;AAElE,QAAM,UAAU,OAAO,IAAI,MAAM,QAAQ;AACzC,QAAM,QAAQ,OAAO,IAAI,MAAM,MAAM;AACrC,QAAM,UAAU,MAAM,IAAI,OAAO,OAAO;AACxC,QAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;AAKpC,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,OAAO,MAAM,gBAAgB,UAAU,SAAS,KAAK;AAC3D,MAAI,KAAK,IAAK,KAAI,UAAU,IAAI,IAAI,KAAK,KAAK,CAAC;AAM/C,QAAM,OAA0B;AAAA,IAC9B,GAAG;AAAA,IACH,QAAQ;AAAA,IACR,IAAI,SAAS,KAAK;AAAA,IAClB,KAAK;AAAA,IACL,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,IAAI,QAAQ;AAAA,IACjB,OAAO;AAAA,IACP,aAAa,IAAI,QAAQ;AAAA,IACzB,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,IAAI;AAEnD,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA,MAAM;AAAA,IACN,eAAe;AAAA,IACf,IAAI;AAAA,IACJ,IAAI;AAAA,EACN,CAAC;AACH;AAMA,eAAsB,OAAU,KAAsB,IAAY,QAA+B;AAC/F,qBAAmB,GAAG;AACtB,MAAI,SAAS,EAAG,OAAM,IAAI,MAAM,kCAAkC,MAAM,EAAE;AAE1E,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,WAAW,EAAE,8BAA8B,IAAI,IAAI,GAAG;AACrF,QAAM,WAAW,SAAS,SAAS;AACnC,MAAI,WAAW,SAAU;AACzB,MAAI,SAAS,UAAU;AACrB,UAAM,IAAI,MAAM,uCAAuC,EAAE,UAAU,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC5F;AACA,QAAM,UAAU,IAAI,QAAQ,SAAS;AACrC,QAAM,qBAAqB,SAAS,gBAAgB,IAAI,QAAQ;AAChE,MAAI,CAAC,WAAW,CAAC,oBAAoB;AACnC,UAAM,IAAI,sBAAsB,IAAI,QAAQ;AAAA,EAC9C;AAEA,mBAAiB,IAAI,SAAS,IAAI,MAAM,QAAQ;AAChD,MAAI,SAAS,EAAG,oBAAmB,KAAK,MAAM;AAE9C,QAAM,UAAU,MAAM,IAAI,OAAO,OAAO,IAAI,MAAM,QAAQ,CAAC;AAC3D,QAAM,QAAQ,MAAM,IAAI,OAAO,OAAO,IAAI,MAAM,MAAM,CAAC;AAIvD,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,OAAO,MAAM,gBAAgB,UAAU,SAAS,KAAK;AAC3D,MAAI,KAAK,IAAK,KAAI,UAAU,IAAI,IAAI,KAAK,KAAK,CAAC;AAK/C,QAAM,EAAE,aAAa,OAAO,YAAY,GAAG,QAAQ,IAAI;AACvD,QAAM,OAA0B;AAAA,IAC9B,GAAG;AAAA,IACH,QAAQ;AAAA,IACR,IAAI,SAAS,KAAK;AAAA,IAClB,KAAK;AAAA,IACL,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,IAAI,QAAQ;AAAA,IACjB,GAAI,SAAS,IAAI,EAAE,OAAO,OAAO,IAAI,CAAC;AAAA,IACtC,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,IAAI;AAEnD,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA,MAAM;AAAA,IACN,eAAe;AAAA,IACf,IAAI;AAAA,IACJ,IAAI;AAAA,EACN,CAAC;AACH;AAOO,SAAS,oBACd,KACA,MACyD;AACzD,SAAO,IAAI,MAAM,oBAAoB,IAAI;AAC3C;","names":["putAtTier","getAtTier","listAtTier","elevate","demote"]}

package/dist/{chunk-YSXEFGND.js → chunk-APHLCXVC.js}

@@ -1,7 +1,7 @@
 import {
   DerivationCapExceededError,
   DerivationOutputShapeError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/with-formula/derivations/executor.ts
 var DerivationExecutor = {
@@ -121,4 +121,4 @@ var DerivationExecutor = {
 export {
   DerivationExecutor
 };
-//# sourceMappingURL=chunk-YSXEFGND.js.map
+//# sourceMappingURL=chunk-APHLCXVC.js.map

package/dist/{chunk-CB25ONKC.js → chunk-BDEMZD4F.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/with-formula/derivations/with-derivation.ts
 function withDerivation(spec) {
@@ -126,4 +126,4 @@ export {
   withDerivation,
   withRollup
 };
-//# sourceMappingURL=chunk-CB25ONKC.js.map
+//# sourceMappingURL=chunk-BDEMZD4F.js.map

package/dist/{chunk-P5RY4ZWD.js → chunk-BDPAVYGJ.js}

@@ -5,12 +5,12 @@ import {
   getAtPath,
   isStaticDictDescriptor,
   stripI18nFilled
-} from "./chunk-BE7N3AXA.js";
+} from "./chunk-VCUQR6ZL.js";
 import {
   EmbeddingDimMismatchError,
   EmbeddingModelMismatchError,
   SearchNotEnabledError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/with-lookup/embeddings/cosine.ts
 function cosine(a, b) {
@@ -355,27 +355,27 @@ function buildBlobFieldEntries(filenamesByField) {
 function withSearch() {
   return {
     async search(ctx, field, query, opts) {
-      const { search: search2 } = await import("./collection-facade-YE2O4J4O.js");
+      const { search: search2 } = await import("./collection-facade-DWA735G2.js");
       return search2(ctx, field, query, opts);
     },
     async retrieve(ctx, query, opts) {
-      const { retrieve: retrieve2 } = await import("./collection-facade-YE2O4J4O.js");
+      const { retrieve: retrieve2 } = await import("./collection-facade-DWA735G2.js");
       return retrieve2(ctx, query, opts);
     },
     async similarTo(ctx, vector, opts) {
-      const { similarTo: similarTo2 } = await import("./collection-facade-YE2O4J4O.js");
+      const { similarTo: similarTo2 } = await import("./collection-facade-DWA735G2.js");
       return similarTo2(ctx, vector, opts);
     },
     async warmIndex(ctx) {
-      const { warmIndex: warmIndex2 } = await import("./collection-facade-YE2O4J4O.js");
+      const { warmIndex: warmIndex2 } = await import("./collection-facade-DWA735G2.js");
       return warmIndex2(ctx);
     },
     async flushIndex(ctx) {
-      const { flushIndex: flushIndex2 } = await import("./collection-facade-YE2O4J4O.js");
+      const { flushIndex: flushIndex2 } = await import("./collection-facade-DWA735G2.js");
       return flushIndex2(ctx);
     },
     async embedOnWrite(ctx, id, record, version) {
-      const { embedOnWrite: embedOnWrite2 } = await import("./collection-facade-YE2O4J4O.js");
+      const { embedOnWrite: embedOnWrite2 } = await import("./collection-facade-DWA735G2.js");
       return embedOnWrite2(ctx, id, record, version);
     }
   };
@@ -659,4 +659,4 @@ export {
   similarTo,
   embedOnWrite
 };
-//# sourceMappingURL=chunk-P5RY4ZWD.js.map
+//# sourceMappingURL=chunk-BDPAVYGJ.js.map

package/dist/{chunk-DIRRS7WP.js → chunk-BLUT46UP.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-CKZW6P5V.js";
+} from "./chunk-JC75UBMT.js";
 
 // src/with-party/policy/storage.ts
 var META_COLLECTION = "_meta";
@@ -39,4 +39,4 @@ export {
   loadVaultPolicy,
   saveVaultPolicy
 };
-//# sourceMappingURL=chunk-DIRRS7WP.js.map
+//# sourceMappingURL=chunk-BLUT46UP.js.map

package/dist/{chunk-5ZOSG3RJ.js → chunk-CCIR2OJH.js}

@@ -5,7 +5,7 @@ import {
   readDirectoryConfig,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-4N5QFSNQ.js";
+} from "./chunk-JGUZMC3I.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -16,11 +16,11 @@ import {
   generateSalt,
   unwrapKey,
   wrapKey
-} from "./chunk-HUS3J5WM.js";
+} from "./chunk-37WOJQWY.js";
 import {
   NOYDB_FORMAT_VERSION,
   NOYDB_KEYRING_VERSION
-} from "./chunk-CKZW6P5V.js";
+} from "./chunk-JC75UBMT.js";
 import {
   DirectoryDisabledError,
   InvalidKeyError,
@@ -32,7 +32,7 @@ import {
   PrivilegeEscalationError,
   USER_ENVELOPE_COLLECTION,
   ValidationError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/kernel/validation.ts
 var WeakPassphraseError = class extends NoydbError {
@@ -775,4 +775,4 @@ export {
   hasImportCapability,
   evaluateImportCapability
 };
-//# sourceMappingURL=chunk-5ZOSG3RJ.js.map
+//# sourceMappingURL=chunk-CCIR2OJH.js.map

package/dist/{chunk-7E67FJ33.js → chunk-CXC3JLAQ.js}

@@ -1,7 +1,7 @@
 import {
   ConflictError,
   PodVersionConflictError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/with-pod/pod-store.ts
 var BUNDLE_STORE_VERSION = 1;
@@ -152,4 +152,4 @@ export {
   wrapBundleStore,
   createBundleStore
 };
-//# sourceMappingURL=chunk-7E67FJ33.js.map
+//# sourceMappingURL=chunk-CXC3JLAQ.js.map

package/dist/{chunk-AOVDSIL3.js → chunk-CZMCOFEA.js}

@@ -1,6 +1,6 @@
 import {
   openEnvelopeJson
-} from "./chunk-QQJXBZCO.js";
+} from "./chunk-HA6ZQWA2.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -12,14 +12,14 @@ import {
   sha256Hex,
   unwrapCek,
   wrapCek
-} from "./chunk-HUS3J5WM.js";
+} from "./chunk-37WOJQWY.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-CKZW6P5V.js";
+} from "./chunk-JC75UBMT.js";
 import {
   ConflictError,
   NotFoundError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/with-shape/blobs/mime-magic.ts
 function hex(s) {
@@ -1155,7 +1155,7 @@ var BlobSet = class {
       return this.buildResponse(slot, result.blob, { inline: true });
     }
     const aad = chunkAAD(slot.eTag, 0, result.blob.chunkCount);
-    const { decryptBytesWithAAD: decryptAAD } = await import("./enclave-VXAQD4XJ.js");
+    const { decryptBytesWithAAD: decryptAAD } = await import("./enclave-XXFUKJC6.js");
     const decrypted = await decryptAAD(envelope._iv, envelope._data, blobDEK, aad);
     const plaintext = result.blob.compression === "gzip" ? await decompressBytes(decrypted) : decrypted;
     const body = new ReadableStream({
@@ -1218,4 +1218,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-AOVDSIL3.js.map
+//# sourceMappingURL=chunk-CZMCOFEA.js.map

package/dist/{chunk-SRVQHVNX.js → chunk-DIB2BOIH.js}

@@ -1,17 +1,17 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-7NS43EXZ.js";
+} from "./chunk-NEYKOESM.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-BCYQA5BK.js";
+} from "./chunk-QF5LGMSV.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-CKZW6P5V.js";
+} from "./chunk-JC75UBMT.js";
 import {
   NoydbError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/with-audit/portability/request-withdrawal.ts
 var WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
@@ -161,4 +161,4 @@ export {
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-SRVQHVNX.js.map
+//# sourceMappingURL=chunk-DIB2BOIH.js.map

package/dist/{chunk-7QIXUSDQ.js → chunk-DJ7MRXNA.js}

@@ -1,7 +1,7 @@
 import {
   DerivationCycleError,
   MaterializedViewCycleError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-FZCGIJEJ.js";
 
 // src/kernel/via/graph.ts
 var DEFAULT_POSTURE = { encryptedAtRest: "envelope", queryable: "full", exportable: true, forgettable: false };
@@ -45,7 +45,8 @@ var ViaGraph = class {
   _posture = /* @__PURE__ */ new Map();
   /** Every derived target's registration, keyed by the target's node id. */
   _in = /* @__PURE__ */ new Map();
-  /** source node id -> derived targets that depend on it (dispatch/erasure). */
+  /** source node id -> derived edges that depend on it (dispatch/erasure), each carrying
+   *  its own registration's `kind` (#678 — see {@link OutEdge}). */
   _out = /* @__PURE__ */ new Map();
   /** Memoized effective posture per derived target node id. */
   _effectiveCache = /* @__PURE__ */ new Map();
@@ -88,9 +89,10 @@ var ViaGraph = class {
     });
     for (const source of sources) {
       const sourceId = nodeId(source);
+      const outEdge = { target, kind };
       const dependents = this._out.get(sourceId);
-      if (dependents) dependents.push(target);
-      else this._out.set(sourceId, [target]);
+      if (dependents) dependents.push(outEdge);
+      else this._out.set(sourceId, [outEdge]);
     }
     this._effectiveCache.clear();
     this._wildcardCache.clear();
@@ -151,12 +153,12 @@ var ViaGraph = class {
   assertAcyclic() {
     const visited = /* @__PURE__ */ new Set();
     const stack = [];
-    const notRefEdge = (t) => this._in.get(nodeId(t))?.kind !== "ref";
+    const notRefEdge = (entry) => entry.kind !== "ref";
     const neighboursOf = (id) => {
-      const own = (this._out.get(id) ?? []).filter(notRefEdge);
+      const own = (this._out.get(id) ?? []).filter(notRefEdge).map((entry) => entry.target);
       const sep = id.indexOf(SEP);
       if (id.slice(sep + 1) === "*") return own;
-      const wildcard = (this._out.get(`${id.slice(0, sep)}${SEP}*`) ?? []).filter(notRefEdge);
+      const wildcard = (this._out.get(`${id.slice(0, sep)}${SEP}*`) ?? []).filter(notRefEdge).map((entry) => entry.target);
       if (wildcard.length === 0) return own;
       return [...own, ...wildcard];
     };
@@ -324,10 +326,11 @@ var ViaGraph = class {
     const targets = this._out.get(nodeId({ collection: backing, field: "*" }));
     if (!targets) return [];
     const out = [];
-    for (const target of targets) {
-      const edge = this._in.get(nodeId(target));
-      if (edge?.kind === "ref" && edge.onDelete !== void 0) {
-        out.push({ referencing: target, onDelete: edge.onDelete, keyField: edge.keyField ?? "id" });
+    for (const entry of targets) {
+      if (entry.kind !== "ref") continue;
+      const edge = this._in.get(nodeId(entry.target));
+      if (edge?.onDelete !== void 0) {
+        out.push({ referencing: entry.target, onDelete: edge.onDelete, keyField: edge.keyField ?? "id" });
       }
     }
     return out;
@@ -338,4 +341,4 @@ export {
   DEFAULT_POSTURE,
   ViaGraph
 };
-//# sourceMappingURL=chunk-7QIXUSDQ.js.map
+//# sourceMappingURL=chunk-DJ7MRXNA.js.map