@noy-db/hub 0.3.0-pre.11 → 0.3.0-pre.13

package/dist/pod/index.js

@@ -4,7 +4,7 @@ import {
   createPodStore,
   wrapBundleStore,
   wrapPodStore
-} from "../chunk-7E67FJ33.js";
+} from "../chunk-RZ5SVOYR.js";
 import {
   COMPRESSION_BROTLI,
   COMPRESSION_GZIP,
@@ -23,21 +23,21 @@ import {
   validateBundleHeader,
   writeNoydbBundle,
   writePod
-} from "../chunk-K62IUKOD.js";
-import "../chunk-5XIPOCQC.js";
+} from "../chunk-FHS2HQSH.js";
+import "../chunk-X3YYQWOQ.js";
 import {
   generateULID,
   isULID
 } from "../chunk-ZJADGNYF.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
-import "../chunk-FH542DDY.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
+import "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   COMPRESSION_BROTLI,

package/dist/{policy-JTFOPPUU.js → policy-Z3RUAIY2.js}

@@ -6,20 +6,20 @@ import {
   createNoydbPolicy,
   describeGate,
   mergePolicy
-} from "./chunk-MCEKIAO4.js";
+} from "./chunk-ERJ7FU55.js";
 import {
   META_COLLECTION,
   POLICY_RECORD_ID,
   loadVaultPolicy,
   saveVaultPolicy
-} from "./chunk-DIRRS7WP.js";
-import "./chunk-CKZW6P5V.js";
+} from "./chunk-CRI4OUV4.js";
+import "./chunk-JNAI2HN2.js";
 import {
   ManagedRecoveryNotEnrolledError,
   PolicyDeniedError,
   RecoveryNotEnrolledError,
   RecoveryProfileNotImplementedError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-BIOUI4HL.js";
 import "./chunk-PZ5AY32C.js";
 export {
   DEFAULT_FRESHNESS_MS,
@@ -38,4 +38,4 @@ export {
   mergePolicy,
   saveVaultPolicy
 };
-//# sourceMappingURL=policy-JTFOPPUU.js.map
+//# sourceMappingURL=policy-Z3RUAIY2.js.map

package/dist/port/with/blob-strategy.d.ts

@@ -22,6 +22,7 @@ import type { NoydbStore } from '../../kernel/types.js';
 import type { ObjectProjection } from '../../with-shape/blobs/object-projection.js';
 import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
 import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
 /**
  * Args forwarded by `Collection.blob(id)` to the active strategy's
  * `openSlot`. The strategy is responsible for returning a live
@@ -44,6 +45,13 @@ export interface BlobStrategyOpenArgs {
      * CEK design spec.
      */
     readonly erasableBlobs?: boolean;
+    /**
+     * Collection has `tiers` active (#724 I1 completion). Combined with
+     * `erasableBlobs` false, a content write is refused —
+     * `UnsupportedTierCompositionError` — since a legacy blob has no
+     * per-blob `_cek` and can never be tier-isolated on elevate/demote.
+     */
+    readonly tiersActive?: boolean;
     /**
      * Vault is in debug-plaintext mode (`encrypt: false` + `debugPlaintext: true`).
      * Blobs are then written as a single un-gzipped object (one base64 chunk) so
@@ -60,6 +68,15 @@ export interface BlobStrategyOpenArgs {
     readonly objectStore?: ObjectProjection;
     /** Per-collection blob field policies — used to resolve `external` / `public`. */
     readonly blobFields?: BlobFieldsConfig;
+    /**
+     * The caller's unlocked keyring (#749). Threaded through so `BlobSet.atTier()`
+     * can run `assertTierAccess` — the SAME clearance gate `putAtTier`/`elevate`/
+     * `demote` run before any tier `getDEK` call — rather than relying on a bare
+     * `getDEK`, which auto-mints a DEK for ANY role and never throws (verified: it
+     * is not itself a gate). Omitted only by a construction path that never calls
+     * `atTier()`.
+     */
+    readonly keyring?: UnlockedKeyring;
 }
 /**
  * The seam interface. `@internal` — do not build public APIs on this

package/dist/port/with/lookup-strategy.d.ts

@@ -24,7 +24,7 @@ import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
 import type { NoydbEventEmitter } from '../../kernel/events.js';
 import type { ViaCryptoCtx } from '../../kernel/via/index.js';
 import type { LookupHandle, DictionaryOptions } from '../../via/lookup/handle.js';
-import { enforceStaticDictOnPut, resolveDictSource, updateReferencingRecords, resolveLabelFromMap, collectLookupDictCompat, lookupToStaticDictCompat, materializeBackingTable, checkLookupMembership, buildLookupAltIndex, registerLookupRefEdges, buildLookupSnapshotRows, coerceLookupKey, resolveBackingRowKey, matchesReferencingValue, type DictReferencingCollection, type LookupDictCompat, type MaterializedBacking } from '../../via/lookup/registry.js';
+import { enforceStaticDictOnPut, resolveDictSource, updateReferencingRecords, resolveLabelFromMap, collectLookupDictCompat, lookupToStaticDictCompat, reservedDictDepsOf, materializeBackingTable, checkLookupMembership, buildLookupAltIndex, registerLookupRefEdges, buildLookupSnapshotRows, coerceLookupKey, resolveBackingRowKey, matchesReferencingValue, type DictReferencingCollection, type LookupDictCompat, type MaterializedBacking } from '../../via/lookup/registry.js';
 import { buildPresentForJoin } from '../../via/lookup/snapshot.js';
 import type { LookupDescriptor } from '../../via/lookup/descriptor.js';
 /**
@@ -106,6 +106,7 @@ export type { DictReferencingCollection };
 export { dictCollectionName } from '../../via/lookup/handle.js';
 export { resolveLabelFromMap, collectLookupDictCompat, lookupToStaticDictCompat };
 export type { LookupDictCompat };
+export { reservedDictDepsOf };
 export { materializeBackingTable, checkLookupMembership, buildLookupAltIndex };
 export type { MaterializedBacking };
 export { registerLookupRefEdges };

package/dist/portability/index.js

@@ -1,36 +1,36 @@
 import {
   NO_PORTABILITY
-} from "../chunk-ODJWBC5I.js";
+} from "../chunk-K5IMOGHB.js";
 import {
   PortabilityNotEnabledError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/portability/active.ts
 function withPortability() {
   return {
     async exportAccessibleData(vault, opts) {
-      const { exportAccessibleData } = await import("../export-accessible-BMULIOYB.js");
+      const { exportAccessibleData } = await import("../export-accessible-PCMXSUZS.js");
       return exportAccessibleData(vault, opts);
     },
     async withdrawAccessibleData(vault, opts) {
-      const { withdrawAccessibleData } = await import("../withdraw-accessible-CLMZEHQT.js");
+      const { withdrawAccessibleData } = await import("../withdraw-accessible-WZIEVWSR.js");
       return withdrawAccessibleData(vault, opts);
     },
     async requestWithdrawal(vault, opts) {
-      const { requestWithdrawal } = await import("../request-withdrawal-6MJRMFHF.js");
+      const { requestWithdrawal } = await import("../request-withdrawal-TI3A5WPS.js");
       return requestWithdrawal(vault, opts);
     },
     async listWithdrawalRequests(vault, opts) {
-      const { listWithdrawalRequests } = await import("../request-withdrawal-6MJRMFHF.js");
+      const { listWithdrawalRequests } = await import("../request-withdrawal-TI3A5WPS.js");
       return listWithdrawalRequests(vault, opts);
     },
     async approveWithdrawal(vault, requestId, opts) {
-      const { approveWithdrawal } = await import("../request-withdrawal-6MJRMFHF.js");
+      const { approveWithdrawal } = await import("../request-withdrawal-TI3A5WPS.js");
       return approveWithdrawal(vault, requestId, opts);
     },
     async rejectWithdrawal(vault, requestId, opts) {
-      const { rejectWithdrawal } = await import("../request-withdrawal-6MJRMFHF.js");
+      const { rejectWithdrawal } = await import("../request-withdrawal-TI3A5WPS.js");
       return rejectWithdrawal(vault, requestId, opts);
     }
   };

package/dist/{post-register-HAWO3O7O.js → post-register-JTH76BLY.js}

@@ -1,15 +1,20 @@
 import {
   hashFields
-} from "./chunk-7ITPJFGC.js";
+} from "./chunk-ZAJAVEXY.js";
 import {
   SatelliteConfigError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-BIOUI4HL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/satellites/marker.ts
 async function ensureSatelliteMarker(store, vaultName, spec, dek) {
-  const next = { base: spec.base, fieldsHash: hashFields(spec.fields), joined: spec.joined };
-  const { loadPersistedSchema } = await import("./storage-IR6EEAV2.js");
+  const next = {
+    base: spec.base,
+    fieldsHash: hashFields(spec.fields),
+    joined: spec.joined,
+    epoch: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const { loadPersistedSchema } = await import("./storage-MVFCGEQE.js");
   const persisted = await loadPersistedSchema(store, vaultName, spec.satellite, dek);
   const prior = persisted?.satellite;
   if (prior) {
@@ -20,7 +25,7 @@ async function ensureSatelliteMarker(store, vaultName, spec, dek) {
     }
     return;
   }
-  const { persistSatelliteMarker } = await import("./register-VCKOBWKT.js");
+  const { persistSatelliteMarker } = await import("./register-VAHONCID.js");
   await persistSatelliteMarker({ store, vault: vaultName, collectionName: spec.satellite, dek, marker: next });
 }
 
@@ -34,7 +39,7 @@ async function postRegister(store, vaultName, spec, getDEK, baseSchema, registry
   }
   if (baseSchema !== void 0) {
     try {
-      const { derivePersistedSchema } = await import("./derive-BGUHU663.js");
+      const { derivePersistedSchema } = await import("./derive-H2BJTLUI.js");
       const envelope = await derivePersistedSchema(baseSchema);
       const properties = envelope.jsonSchema?.["properties"];
       const baseFields = Object.keys(properties ?? {});
@@ -52,4 +57,4 @@ async function postRegister(store, vaultName, spec, getDEK, baseSchema, registry
 export {
   postRegister
 };
-//# sourceMappingURL=post-register-HAWO3O7O.js.map
+//# sourceMappingURL=post-register-JTH76BLY.js.map

package/dist/post-register-JTH76BLY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/satellites/marker.ts","../src/with-shape/satellites/post-register.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport { SatelliteConfigError } from '../../kernel/errors.js'\nimport { hashFields } from './validate.js'\nimport type { PairingMarker, SatelliteSpec } from './types.js'\n\n/**\n * Persist-or-reconcile the pairing marker in `_schemas/<satellite>`.\n * First declaration writes { base, fieldsHash, joined }; later declarations\n * must match exactly or are refused (R-S9). Lazy imports keep the satellite\n * spine tree-shakeable (config-drift.ts pattern).\n */\nexport async function ensureSatelliteMarker(\n  store: NoydbStore, vaultName: string, spec: SatelliteSpec, dek: EnclaveKey,\n): Promise<void> {\n  // #597: `epoch` only matters the first time this marker is ever persisted —\n  // when a `prior` marker already exists below we return without ever using\n  // it, so re-declaring a LIVE collection never mints (or compares) a new\n  // epoch; the persisted one is carried forward untouched. Stamped here as a\n  // timestamp (mirrors `derivedAt` in persisted-schemas/register.ts) rather\n  // than a counter, since there's nothing to count from yet.\n  const next: PairingMarker = {\n    base: spec.base, fieldsHash: hashFields(spec.fields), joined: spec.joined,\n    epoch: new Date().toISOString(),\n  }\n  const { loadPersistedSchema } = await import('../persisted-schemas/storage.js')\n  const persisted = await loadPersistedSchema(store, vaultName, spec.satellite, dek)\n  const prior = persisted?.satellite\n  if (prior) {\n    if (prior.base !== next.base || prior.fieldsHash !== next.fieldsHash || (prior.joined ?? null) !== (next.joined ?? null)) {\n      throw new SatelliteConfigError(\n        `R-S9: satellite \"${spec.satellite}\" re-declared divergently from its persisted pairing marker ` +\n        `(persisted base=\"${prior.base}\" fieldsHash=${prior.fieldsHash}; declared base=\"${next.base}\" fieldsHash=${next.fieldsHash}). ` +\n        `Evolve the marker deliberately, don't redeclare.`,\n      )\n    }\n    return\n  }\n  const { persistSatelliteMarker } = await import('../persisted-schemas/register.js')\n  await persistSatelliteMarker({ store, vault: vaultName, collectionName: spec.satellite, dek, marker: next })\n}\n","import type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { SatelliteSpec } from './types.js'\nimport type { SatelliteRegistry } from './registry.js'\nimport { ensureSatelliteMarker } from './marker.js'\n\n/** Async post-registration: R-S9 marker reconcile + R-S1/R-S5 derivable-schema cross-check. Failures poison, never throw. */\nexport async function postRegister(\n  store: NoydbStore, vaultName: string, spec: SatelliteSpec,\n  getDEK: (collectionName: string) => Promise<EnclaveKey>,\n  baseSchema: unknown, registry: SatelliteRegistry,\n): Promise<void> {\n  try {\n    await ensureSatelliteMarker(store, vaultName, spec, await getDEK(spec.satellite))\n  } catch (err) {\n    registry.poison(spec.satellite, (err as Error).message); return\n  }\n  if (baseSchema !== undefined) {\n    try {\n      const { derivePersistedSchema } = await import('../persisted-schemas/derive.js')\n      const envelope = await derivePersistedSchema(baseSchema)\n      const properties = (envelope.jsonSchema as Record<string, unknown> | null)?.['properties'] as Record<string, unknown> | undefined\n      const baseFields: string[] = Object.keys(properties ?? {})\n      const overlap = spec.fields.filter(f => baseFields.includes(f))\n      if (overlap.length > 0) {\n        registry.poison(spec.satellite,\n          `R-S1: satellite \"${spec.satellite}\" fields overlap the base schema: ${overlap.join(', ')} — routing must be unambiguous.`)\n      }\n    } catch { /* non-derivable validator → cross-check unavailable, by design (spec R-S5) */ }\n  }\n}\n"],"mappings":";;;;;;;;;AAYA,eAAsB,sBACpB,OAAmB,WAAmB,MAAqB,KAC5C;AAOf,QAAM,OAAsB;AAAA,IAC1B,MAAM,KAAK;AAAA,IAAM,YAAY,WAAW,KAAK,MAAM;AAAA,IAAG,QAAQ,KAAK;AAAA,IACnE,QAAO,oBAAI,KAAK,GAAE,YAAY;AAAA,EAChC;AACA,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,uBAAiC;AAC9E,QAAM,YAAY,MAAM,oBAAoB,OAAO,WAAW,KAAK,WAAW,GAAG;AACjF,QAAM,QAAQ,WAAW;AACzB,MAAI,OAAO;AACT,QAAI,MAAM,SAAS,KAAK,QAAQ,MAAM,eAAe,KAAK,eAAe,MAAM,UAAU,WAAW,KAAK,UAAU,OAAO;AACxH,YAAM,IAAI;AAAA,QACR,oBAAoB,KAAK,SAAS,gFACd,MAAM,IAAI,gBAAgB,MAAM,UAAU,oBAAoB,KAAK,IAAI,gBAAgB,KAAK,UAAU;AAAA,MAE5H;AAAA,IACF;AACA;AAAA,EACF;AACA,QAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,wBAAkC;AAClF,QAAM,uBAAuB,EAAE,OAAO,OAAO,WAAW,gBAAgB,KAAK,WAAW,KAAK,QAAQ,KAAK,CAAC;AAC7G;;;ACjCA,eAAsB,aACpB,OAAmB,WAAmB,MACtC,QACA,YAAqB,UACN;AACf,MAAI;AACF,UAAM,sBAAsB,OAAO,WAAW,MAAM,MAAM,OAAO,KAAK,SAAS,CAAC;AAAA,EAClF,SAAS,KAAK;AACZ,aAAS,OAAO,KAAK,WAAY,IAAc,OAAO;AAAG;AAAA,EAC3D;AACA,MAAI,eAAe,QAAW;AAC5B,QAAI;AACF,YAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,sBAAgC;AAC/E,YAAM,WAAW,MAAM,sBAAsB,UAAU;AACvD,YAAM,aAAc,SAAS,aAAgD,YAAY;AACzF,YAAM,aAAuB,OAAO,KAAK,cAAc,CAAC,CAAC;AACzD,YAAM,UAAU,KAAK,OAAO,OAAO,OAAK,WAAW,SAAS,CAAC,CAAC;AAC9D,UAAI,QAAQ,SAAS,GAAG;AACtB,iBAAS;AAAA,UAAO,KAAK;AAAA,UACnB,oBAAoB,KAAK,SAAS,qCAAqC,QAAQ,KAAK,IAAI,CAAC;AAAA,QAAiC;AAAA,MAC9H;AAAA,IACF,QAAQ;AAAA,IAAiF;AAAA,EAC3F;AACF;","names":[]}

package/dist/{public-envelope-NJVB7LPA.js → public-envelope-B4KNWVUA.js}

@@ -12,9 +12,9 @@ import {
   resolveLocale,
   savePublicEnvelope,
   validatePublicEnvelopeInput
-} from "./chunk-5XIPOCQC.js";
-import "./chunk-CKZW6P5V.js";
-import "./chunk-FH542DDY.js";
+} from "./chunk-X3YYQWOQ.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
 import "./chunk-PZ5AY32C.js";
 export {
   DEFAULT_PUBLIC_ENVELOPE_SCHEMA,
@@ -29,4 +29,4 @@ export {
   savePublicEnvelope,
   validatePublicEnvelopeInput
 };
-//# sourceMappingURL=public-envelope-NJVB7LPA.js.map
+//# sourceMappingURL=public-envelope-B4KNWVUA.js.map

package/dist/query/index.js

@@ -7,7 +7,7 @@ import {
   buildLiveQuery,
   executePlan,
   resetJoinWarnings
-} from "../chunk-H6CZSDWK.js";
+} from "../chunk-454JXE57.js";
 import {
   CollectionIndexes
 } from "../chunk-KPZS5QAQ.js";
@@ -31,14 +31,14 @@ import {
   reducerBuilder,
   resetGroupByWarnings,
   sum
-} from "../chunk-IGJHJYM6.js";
+} from "../chunk-LXEXBTKL.js";
 import {
   evaluateClause,
   evaluateFieldClause,
   readPath
 } from "../chunk-IGJCYUT5.js";
-import "../chunk-BE7N3AXA.js";
-import "../chunk-ARSAMO24.js";
+import "../chunk-6JTIAGHD.js";
+import "../chunk-4VNQOLML.js";
 import {
   CrossJoinSourceUnknownError,
   CrossJoinTooLargeError,
@@ -48,7 +48,7 @@ import {
   IndexRequiredError,
   IndexWriteFailureError,
   JoinTooLargeError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   Aggregation,

package/dist/register-VAHONCID.js

@@ -0,0 +1,23 @@
+import {
+  persistClassifiedMarker,
+  persistSatelliteMarker,
+  persistSchemaIfNeeded
+} from "./chunk-2NVOWNI3.js";
+import "./chunk-W22IKJE2.js";
+import "./chunk-VZRODIM3.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  persistClassifiedMarker,
+  persistSatelliteMarker,
+  persistSchemaIfNeeded
+};
+//# sourceMappingURL=register-VAHONCID.js.map

package/dist/registry-7MLVD3VO.js

@@ -0,0 +1,19 @@
+import {
+  MaterializedViewRegistry,
+  wrapDbWithPredicates
+} from "./chunk-KSKBRKGJ.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MaterializedViewRegistry,
+  wrapDbWithPredicates
+};
+//# sourceMappingURL=registry-7MLVD3VO.js.map

package/dist/registry-EPKPD5SM.js

@@ -0,0 +1,18 @@
+import {
+  DerivationRegistry
+} from "./chunk-RCVJZMFE.js";
+import "./chunk-HTJQYHZP.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationRegistry
+};
+//# sourceMappingURL=registry-EPKPD5SM.js.map

package/dist/registry-P5T7PS2U.js

@@ -0,0 +1,9 @@
+import {
+  OverlayedViewRegistry
+} from "./chunk-3B5VVCNY.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  OverlayedViewRegistry
+};
+//# sourceMappingURL=registry-P5T7PS2U.js.map

package/dist/request-withdrawal-TI3A5WPS.js

@@ -0,0 +1,31 @@
+import {
+  WITHDRAWAL_REQUESTS_COLLECTION,
+  WithdrawalRequestError,
+  approveWithdrawal,
+  listWithdrawalRequests,
+  rejectWithdrawal,
+  requestWithdrawal
+} from "./chunk-BDVFPG6Y.js";
+import "./chunk-IU6SNYX6.js";
+import "./chunk-F64IRYG3.js";
+import "./chunk-FHS2HQSH.js";
+import "./chunk-X3YYQWOQ.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  WITHDRAWAL_REQUESTS_COLLECTION,
+  WithdrawalRequestError,
+  approveWithdrawal,
+  listWithdrawalRequests,
+  rejectWithdrawal,
+  requestWithdrawal
+};
+//# sourceMappingURL=request-withdrawal-TI3A5WPS.js.map

package/dist/{reveal-BOY7XYFH.js → reveal-DIBHLUZX.js}

@@ -1,20 +1,20 @@
 import {
   isTombstone
-} from "./chunk-FQQF23MC.js";
+} from "./chunk-7DSTRQIJ.js";
 import {
   dualReadSealedSlot
-} from "./chunk-SYMS4546.js";
-import "./chunk-HUS3J5WM.js";
-import "./chunk-CKZW6P5V.js";
+} from "./chunk-JKJOGPZN.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
 import {
   ClassifiedRevealError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-BIOUI4HL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/reveal.ts
 async function revealSealedField(ctx, id, field) {
   const env = await ctx.getEnvelope(id);
-  if (env === null || isTombstone(env, ctx.encrypted)) {
+  if (env === null || isTombstone(env, ctx.encrypted) || (env._tier ?? 0) > 0) {
     throw new ClassifiedRevealError(ctx.collection, field, `record "${id}" not found in "${ctx.collection}"`);
   }
   if (!ctx.encrypted) {
@@ -35,4 +35,4 @@ async function revealSealedField(ctx, id, field) {
 export {
   revealSealedField
 };
-//# sourceMappingURL=reveal-BOY7XYFH.js.map
+//# sourceMappingURL=reveal-DIBHLUZX.js.map

package/dist/reveal-DIBHLUZX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/enclave/classify/reveal.ts"],"sourcesContent":["/**\n * Single-point audited reveal, stage-2 rework (I6): decrypt ONE sealed slot\n * from the raw envelope — no full record view, no collection.get(), so no\n * spurious 'get' consent entry. Fail-closed gates (b)/(c) live here; gate\n * (a) (storage:'never') fires in collection.reveal before any strategy call.\n * @module\n */\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { isTombstone } from '../record-keys/tombstone.js'\nimport { ClassifiedRevealError } from '../../errors.js'\nimport type { EncryptedEnvelope } from '../../types.js'\nimport type { EnclaveKey } from '../crypto.js'\n\nexport interface RevealEngineCtx {\n  readonly collection: string\n  readonly encrypted: boolean\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n}\n\nexport async function revealSealedField(ctx: RevealEngineCtx, id: string, field: string): Promise<unknown> {\n  const env = await ctx.getEnvelope(id)\n  if (env === null || isTombstone(env, ctx.encrypted) || (env._tier ?? 0) > 0) {\n    throw new ClassifiedRevealError(ctx.collection, field, `record \"${id}\" not found in \"${ctx.collection}\"`)\n  }\n  if (!ctx.encrypted) {\n    // Plaintext collection: nothing is sealed; the value sits in the open body.\n    const record = JSON.parse(env._data || '{}') as Record<string, unknown>\n    if (!(field in record)) {\n      throw new ClassifiedRevealError(ctx.collection, field, `no stored value for \"${field}\"`)\n    }\n    return record[field]\n  }\n  const blob = env._sealed?.[field]\n  if (blob === undefined) {\n    // Gate (c): fail-closed error, never parseSealedSlot(undefined)'s TypeError.\n    throw new ClassifiedRevealError(ctx.collection, field, `no sealed value stored for \"${field}\"`)\n  }\n  const cek = await ctx.resolveCek(env)\n  const dek = await ctx.getDEK()\n  return JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek))\n}\n"],"mappings":";;;;;;;;;;;;;;AAqBA,eAAsB,kBAAkB,KAAsB,IAAY,OAAiC;AACzG,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,QAAQ,YAAY,KAAK,IAAI,SAAS,MAAM,IAAI,SAAS,KAAK,GAAG;AAC3E,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,WAAW,EAAE,mBAAmB,IAAI,UAAU,GAAG;AAAA,EAC1G;AACA,MAAI,CAAC,IAAI,WAAW;AAElB,UAAM,SAAS,KAAK,MAAM,IAAI,SAAS,IAAI;AAC3C,QAAI,EAAE,SAAS,SAAS;AACtB,YAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,wBAAwB,KAAK,GAAG;AAAA,IACzF;AACA,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,QAAM,OAAO,IAAI,UAAU,KAAK;AAChC,MAAI,SAAS,QAAW;AAEtB,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,+BAA+B,KAAK,GAAG;AAAA,EAChG;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,SAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC;AACnF;","names":[]}

package/dist/revoke-FDRD6GRW.js

@@ -0,0 +1,24 @@
+import {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+} from "./chunk-YFXZEAYK.js";
+import "./chunk-EXK7QRWF.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+};
+//# sourceMappingURL=revoke-FDRD6GRW.js.map

package/dist/satellites/index.js

@@ -1,6 +1,6 @@
 import {
   SatelliteConfigError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   SatelliteConfigError

package/dist/sealed-record/index.js

@@ -1,38 +1,38 @@
 import {
   NO_SEALED_RECORD
-} from "../chunk-CIKY6I4W.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+} from "../chunk-QLWMEXCT.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
 import {
   base64ToBuffer,
   decrypt,
   importCek
-} from "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
+} from "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
 import {
   SealedRecordExpiredError,
   SealedRecordMismatchError,
   SealedRecordNotEnabledError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/sealed-record/active.ts
 function withSealedRecord() {
   return {
     async sealRecordToHost(ctx, collection, id, hostSealer, opts) {
-      const { sealRecordToHost } = await import("../enclave-VXAQD4XJ.js");
+      const { sealRecordToHost } = await import("../enclave-AP3I5W7O.js");
       return sealRecordToHost(ctx, collection, id, hostSealer, opts);
     },
     async revokeSealedRecord(ctx, collection, id, pid, opts) {
-      const { revokeSealedRecord } = await import("../enclave-VXAQD4XJ.js");
+      const { revokeSealedRecord } = await import("../enclave-AP3I5W7O.js");
       return revokeSealedRecord(ctx, collection, id, pid, opts);
     },
     async rotateRecordCek(ctx, collection, id) {
-      const { rotateRecordCek } = await import("../enclave-VXAQD4XJ.js");
+      const { rotateRecordCek } = await import("../enclave-AP3I5W7O.js");
       return rotateRecordCek(ctx, collection, id);
     }
   };

package/dist/{seed-4RRXT42N.js → seed-Q6M2IZFL.js}

@@ -1,26 +1,26 @@
 import {
   BROKER_COLLECTION,
   ensureCollectionDEK
-} from "./chunk-5ZOSG3RJ.js";
-import "./chunk-4N5QFSNQ.js";
+} from "./chunk-J2ZX2XUV.js";
+import "./chunk-4JBYV75E.js";
 import {
   computeBrokerProof,
   deriveBrokerProofBits,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-QQJXBZCO.js";
-import "./chunk-FQQF23MC.js";
-import "./chunk-MSPNM2OM.js";
-import "./chunk-SYMS4546.js";
-import "./chunk-X6CMGUAG.js";
+} from "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
 import "./chunk-LP7BEXCT.js";
 import {
   base64ToBuffer,
   bufferToBase64
-} from "./chunk-HUS3J5WM.js";
+} from "./chunk-CIE2BASH.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-CKZW6P5V.js";
+} from "./chunk-JNAI2HN2.js";
 import {
   BrokerEnrolmentError,
   BrokerProofError,
@@ -28,7 +28,7 @@ import {
   NetworkError,
   PermissionDeniedError,
   ValidationError
-} from "./chunk-FH542DDY.js";
+} from "./chunk-BIOUI4HL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-party/broker/seed.ts
@@ -228,4 +228,4 @@ export {
   mintStoreCredentials,
   rotateSeed
 };
-//# sourceMappingURL=seed-4RRXT42N.js.map
+//# sourceMappingURL=seed-Q6M2IZFL.js.map

package/dist/session/index.js

@@ -12,21 +12,21 @@ import {
   revokeAllSessions,
   revokeSession,
   validateSessionPolicy
-} from "../chunk-VR24ILCR.js";
+} from "../chunk-RIX4V2TB.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-QQJXBZCO.js";
-import "../chunk-FQQF23MC.js";
-import "../chunk-MSPNM2OM.js";
-import "../chunk-SYMS4546.js";
-import "../chunk-X6CMGUAG.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-HUS3J5WM.js";
-import "../chunk-CKZW6P5V.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
 import {
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError
-} from "../chunk-FH542DDY.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/session/active.ts

package/dist/shadow/index.js

@@ -1,8 +1,8 @@
 import {
   CollectionFrame,
   VaultFrame
-} from "../chunk-3MSQLQNZ.js";
-import "../chunk-FH542DDY.js";
+} from "../chunk-R4ROFEYC.js";
+import "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-fork/shadow/active.ts

package/dist/signer-MUWEIUI6.js

@@ -0,0 +1,25 @@
+import {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+} from "./chunk-EXK7QRWF.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+};
+//# sourceMappingURL=signer-MUWEIUI6.js.map