@noy-db/hub 0.3.0-pre.12 → 0.3.0-pre.13

package/dist/registry-EPKPD5SM.js

@@ -0,0 +1,18 @@
+import {
+  DerivationRegistry
+} from "./chunk-RCVJZMFE.js";
+import "./chunk-HTJQYHZP.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DerivationRegistry
+};
+//# sourceMappingURL=registry-EPKPD5SM.js.map

package/dist/registry-P5T7PS2U.js

@@ -0,0 +1,9 @@
+import {
+  OverlayedViewRegistry
+} from "./chunk-3B5VVCNY.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  OverlayedViewRegistry
+};
+//# sourceMappingURL=registry-P5T7PS2U.js.map

package/dist/request-withdrawal-TI3A5WPS.js

@@ -0,0 +1,31 @@
+import {
+  WITHDRAWAL_REQUESTS_COLLECTION,
+  WithdrawalRequestError,
+  approveWithdrawal,
+  listWithdrawalRequests,
+  rejectWithdrawal,
+  requestWithdrawal
+} from "./chunk-BDVFPG6Y.js";
+import "./chunk-IU6SNYX6.js";
+import "./chunk-F64IRYG3.js";
+import "./chunk-FHS2HQSH.js";
+import "./chunk-X3YYQWOQ.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  WITHDRAWAL_REQUESTS_COLLECTION,
+  WithdrawalRequestError,
+  approveWithdrawal,
+  listWithdrawalRequests,
+  rejectWithdrawal,
+  requestWithdrawal
+};
+//# sourceMappingURL=request-withdrawal-TI3A5WPS.js.map

package/dist/{reveal-NPVROV4D.js → reveal-DIBHLUZX.js}

@@ -1,20 +1,20 @@
 import {
   isTombstone
-} from "./chunk-J3JIYFYL.js";
+} from "./chunk-7DSTRQIJ.js";
 import {
   dualReadSealedSlot
-} from "./chunk-NM3IFKBL.js";
-import "./chunk-37WOJQWY.js";
-import "./chunk-JC75UBMT.js";
+} from "./chunk-JKJOGPZN.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
 import {
   ClassifiedRevealError
-} from "./chunk-FZCGIJEJ.js";
+} from "./chunk-BIOUI4HL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/reveal.ts
 async function revealSealedField(ctx, id, field) {
   const env = await ctx.getEnvelope(id);
-  if (env === null || isTombstone(env, ctx.encrypted)) {
+  if (env === null || isTombstone(env, ctx.encrypted) || (env._tier ?? 0) > 0) {
     throw new ClassifiedRevealError(ctx.collection, field, `record "${id}" not found in "${ctx.collection}"`);
   }
   if (!ctx.encrypted) {
@@ -35,4 +35,4 @@ async function revealSealedField(ctx, id, field) {
 export {
   revealSealedField
 };
-//# sourceMappingURL=reveal-NPVROV4D.js.map
+//# sourceMappingURL=reveal-DIBHLUZX.js.map

package/dist/reveal-DIBHLUZX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/enclave/classify/reveal.ts"],"sourcesContent":["/**\n * Single-point audited reveal, stage-2 rework (I6): decrypt ONE sealed slot\n * from the raw envelope — no full record view, no collection.get(), so no\n * spurious 'get' consent entry. Fail-closed gates (b)/(c) live here; gate\n * (a) (storage:'never') fires in collection.reveal before any strategy call.\n * @module\n */\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { isTombstone } from '../record-keys/tombstone.js'\nimport { ClassifiedRevealError } from '../../errors.js'\nimport type { EncryptedEnvelope } from '../../types.js'\nimport type { EnclaveKey } from '../crypto.js'\n\nexport interface RevealEngineCtx {\n  readonly collection: string\n  readonly encrypted: boolean\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n}\n\nexport async function revealSealedField(ctx: RevealEngineCtx, id: string, field: string): Promise<unknown> {\n  const env = await ctx.getEnvelope(id)\n  if (env === null || isTombstone(env, ctx.encrypted) || (env._tier ?? 0) > 0) {\n    throw new ClassifiedRevealError(ctx.collection, field, `record \"${id}\" not found in \"${ctx.collection}\"`)\n  }\n  if (!ctx.encrypted) {\n    // Plaintext collection: nothing is sealed; the value sits in the open body.\n    const record = JSON.parse(env._data || '{}') as Record<string, unknown>\n    if (!(field in record)) {\n      throw new ClassifiedRevealError(ctx.collection, field, `no stored value for \"${field}\"`)\n    }\n    return record[field]\n  }\n  const blob = env._sealed?.[field]\n  if (blob === undefined) {\n    // Gate (c): fail-closed error, never parseSealedSlot(undefined)'s TypeError.\n    throw new ClassifiedRevealError(ctx.collection, field, `no sealed value stored for \"${field}\"`)\n  }\n  const cek = await ctx.resolveCek(env)\n  const dek = await ctx.getDEK()\n  return JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek))\n}\n"],"mappings":";;;;;;;;;;;;;;AAqBA,eAAsB,kBAAkB,KAAsB,IAAY,OAAiC;AACzG,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,MAAI,QAAQ,QAAQ,YAAY,KAAK,IAAI,SAAS,MAAM,IAAI,SAAS,KAAK,GAAG;AAC3E,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,WAAW,EAAE,mBAAmB,IAAI,UAAU,GAAG;AAAA,EAC1G;AACA,MAAI,CAAC,IAAI,WAAW;AAElB,UAAM,SAAS,KAAK,MAAM,IAAI,SAAS,IAAI;AAC3C,QAAI,EAAE,SAAS,SAAS;AACtB,YAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,wBAAwB,KAAK,GAAG;AAAA,IACzF;AACA,WAAO,OAAO,KAAK;AAAA,EACrB;AACA,QAAM,OAAO,IAAI,UAAU,KAAK;AAChC,MAAI,SAAS,QAAW;AAEtB,UAAM,IAAI,sBAAsB,IAAI,YAAY,OAAO,+BAA+B,KAAK,GAAG;AAAA,EAChG;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,SAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC;AACnF;","names":[]}

package/dist/revoke-FDRD6GRW.js

@@ -0,0 +1,24 @@
+import {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+} from "./chunk-YFXZEAYK.js";
+import "./chunk-EXK7QRWF.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  getRevokedDocIdsCore,
+  publishRevocationListCore,
+  revokeDocCore,
+  unrevokeDocCore
+};
+//# sourceMappingURL=revoke-FDRD6GRW.js.map

package/dist/satellites/index.js

@@ -1,6 +1,6 @@
 import {
   SatelliteConfigError
-} from "../chunk-FZCGIJEJ.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   SatelliteConfigError

package/dist/sealed-record/index.js

@@ -1,38 +1,38 @@
 import {
   NO_SEALED_RECORD
-} from "../chunk-TVOHSPVK.js";
-import "../chunk-HA6ZQWA2.js";
-import "../chunk-J3JIYFYL.js";
-import "../chunk-XS6DLN67.js";
-import "../chunk-NM3IFKBL.js";
-import "../chunk-45QPICLE.js";
+} from "../chunk-QLWMEXCT.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
 import {
   base64ToBuffer,
   decrypt,
   importCek
-} from "../chunk-37WOJQWY.js";
-import "../chunk-JC75UBMT.js";
+} from "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
 import {
   SealedRecordExpiredError,
   SealedRecordMismatchError,
   SealedRecordNotEnabledError
-} from "../chunk-FZCGIJEJ.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-audit/sealed-record/active.ts
 function withSealedRecord() {
   return {
     async sealRecordToHost(ctx, collection, id, hostSealer, opts) {
-      const { sealRecordToHost } = await import("../enclave-XXFUKJC6.js");
+      const { sealRecordToHost } = await import("../enclave-AP3I5W7O.js");
       return sealRecordToHost(ctx, collection, id, hostSealer, opts);
     },
     async revokeSealedRecord(ctx, collection, id, pid, opts) {
-      const { revokeSealedRecord } = await import("../enclave-XXFUKJC6.js");
+      const { revokeSealedRecord } = await import("../enclave-AP3I5W7O.js");
       return revokeSealedRecord(ctx, collection, id, pid, opts);
     },
     async rotateRecordCek(ctx, collection, id) {
-      const { rotateRecordCek } = await import("../enclave-XXFUKJC6.js");
+      const { rotateRecordCek } = await import("../enclave-AP3I5W7O.js");
       return rotateRecordCek(ctx, collection, id);
     }
   };

package/dist/{seed-VI4FU7UH.js → seed-Q6M2IZFL.js}

@@ -1,26 +1,26 @@
 import {
   BROKER_COLLECTION,
   ensureCollectionDEK
-} from "./chunk-CCIR2OJH.js";
-import "./chunk-JGUZMC3I.js";
+} from "./chunk-J2ZX2XUV.js";
+import "./chunk-4JBYV75E.js";
 import {
   computeBrokerProof,
   deriveBrokerProofBits,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-HA6ZQWA2.js";
-import "./chunk-J3JIYFYL.js";
-import "./chunk-XS6DLN67.js";
-import "./chunk-NM3IFKBL.js";
-import "./chunk-45QPICLE.js";
+} from "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
 import "./chunk-LP7BEXCT.js";
 import {
   base64ToBuffer,
   bufferToBase64
-} from "./chunk-37WOJQWY.js";
+} from "./chunk-CIE2BASH.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-JC75UBMT.js";
+} from "./chunk-JNAI2HN2.js";
 import {
   BrokerEnrolmentError,
   BrokerProofError,
@@ -28,7 +28,7 @@ import {
   NetworkError,
   PermissionDeniedError,
   ValidationError
-} from "./chunk-FZCGIJEJ.js";
+} from "./chunk-BIOUI4HL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-party/broker/seed.ts
@@ -228,4 +228,4 @@ export {
   mintStoreCredentials,
   rotateSeed
 };
-//# sourceMappingURL=seed-VI4FU7UH.js.map
+//# sourceMappingURL=seed-Q6M2IZFL.js.map

package/dist/session/index.js

@@ -12,21 +12,21 @@ import {
   revokeAllSessions,
   revokeSession,
   validateSessionPolicy
-} from "../chunk-QG5RQQBO.js";
+} from "../chunk-RIX4V2TB.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-HA6ZQWA2.js";
-import "../chunk-J3JIYFYL.js";
-import "../chunk-XS6DLN67.js";
-import "../chunk-NM3IFKBL.js";
-import "../chunk-45QPICLE.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-37WOJQWY.js";
-import "../chunk-JC75UBMT.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
 import {
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError
-} from "../chunk-FZCGIJEJ.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/session/active.ts

package/dist/shadow/index.js

@@ -1,8 +1,8 @@
 import {
   CollectionFrame,
   VaultFrame
-} from "../chunk-X6Y5MXTH.js";
-import "../chunk-FZCGIJEJ.js";
+} from "../chunk-R4ROFEYC.js";
+import "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-fork/shadow/active.ts

package/dist/signer-MUWEIUI6.js

@@ -0,0 +1,25 @@
+import {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+} from "./chunk-EXK7QRWF.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  ATTESTATIONS_COLLECTION,
+  REVOKED_RECORD_ID,
+  SIGNER_RECORD_ID,
+  loadOrCreateSigner,
+  loadSigner
+};
+//# sourceMappingURL=signer-MUWEIUI6.js.map

package/dist/snapshots/index.js

@@ -1,19 +1,19 @@
 import {
   readPod,
   writePod
-} from "../chunk-PH7G7ZI7.js";
-import "../chunk-FJTWLQV3.js";
-import "../chunk-HA6ZQWA2.js";
-import "../chunk-J3JIYFYL.js";
-import "../chunk-XS6DLN67.js";
-import "../chunk-NM3IFKBL.js";
-import "../chunk-45QPICLE.js";
+} from "../chunk-FHS2HQSH.js";
+import "../chunk-X3YYQWOQ.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-37WOJQWY.js";
-import "../chunk-JC75UBMT.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
 import {
   SnapshotNotFoundError
-} from "../chunk-FZCGIJEJ.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-fork/snapshots/engine.ts

package/dist/stale-OSQ7J3AA.js

@@ -0,0 +1,29 @@
+import {
+  MV_STALE_COLLECTION,
+  clearMVStale,
+  clearMVStaleFully,
+  invalidateMVAtRest,
+  isMVStale,
+  markMVStale,
+  resolveStaleMVOnRead
+} from "./chunk-HDQIIUPH.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  MV_STALE_COLLECTION,
+  clearMVStale,
+  clearMVStaleFully,
+  invalidateMVAtRest,
+  isMVStale,
+  markMVStale,
+  resolveStaleMVOnRead
+};
+//# sourceMappingURL=stale-OSQ7J3AA.js.map

package/dist/storage-MVFCGEQE.js

@@ -0,0 +1,23 @@
+import {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+} from "./chunk-VZRODIM3.js";
+import "./chunk-XDYREZWE.js";
+import "./chunk-7DSTRQIJ.js";
+import "./chunk-HB3RFQSC.js";
+import "./chunk-JKJOGPZN.js";
+import "./chunk-5M5DVGV7.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-CIE2BASH.js";
+import "./chunk-JNAI2HN2.js";
+import "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  loadPersistedSchemaEntry,
+  savePersistedSchema
+};
+//# sourceMappingURL=storage-MVFCGEQE.js.map

package/dist/{store-coordination-provider-5KDS2RRP.js → store-coordination-provider-64OEZFGS.js}

@@ -1,10 +1,10 @@
 import {
   loadFence,
   saveFence
-} from "./chunk-SAL5X5OK.js";
+} from "./chunk-RYCTDFUX.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-JC75UBMT.js";
+} from "./chunk-JNAI2HN2.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/schema-update/client-registry.ts
@@ -139,4 +139,4 @@ function unref(timer) {
 export {
   StoreCoordinationProvider
 };
-//# sourceMappingURL=store-coordination-provider-5KDS2RRP.js.map
+//# sourceMappingURL=store-coordination-provider-64OEZFGS.js.map

package/dist/sync/index.js

@@ -2,17 +2,17 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-VXZNSPJM.js";
+} from "../chunk-HDMEGAQE.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-HA6ZQWA2.js";
-import "../chunk-J3JIYFYL.js";
-import "../chunk-XS6DLN67.js";
-import "../chunk-NM3IFKBL.js";
-import "../chunk-45QPICLE.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-37WOJQWY.js";
-import "../chunk-JC75UBMT.js";
-import "../chunk-FZCGIJEJ.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
+import "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-party/team/sync-active.ts

package/dist/team/index.js

@@ -5,7 +5,7 @@ import {
   listCredentials,
   putCredential,
   withTeam
-} from "../chunk-NRYNRSGV.js";
+} from "../chunk-I6GALP6E.js";
 import {
   NO_TEAM,
   deriveMagicLinkContentKey,
@@ -23,7 +23,7 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-3QSOFZQB.js";
+} from "../chunk-AUSTCW2X.js";
 import {
   burnPaperRecoveryEntry,
   loadPaperRecoveryEntries,
@@ -32,14 +32,13 @@ import {
   savePaperRecoveryEntries,
   unwrapDeksFromBlob,
   unwrapDeksFromPaperEntry
-} from "../chunk-S7TAPIRS.js";
+} from "../chunk-EVVGJDRQ.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-VXZNSPJM.js";
+} from "../chunk-HDMEGAQE.js";
 import "../chunk-VQNJ7UZL.js";
-import "../chunk-KKYEZCQG.js";
 import {
   SYNC_CREDENTIALS_COLLECTION,
   buildRecipientKeyringFile,
@@ -57,19 +56,20 @@ import {
   persistKeyring,
   revoke,
   updateKeyringIdentity
-} from "../chunk-CCIR2OJH.js";
-import "../chunk-JGUZMC3I.js";
-import "../chunk-HA6ZQWA2.js";
-import "../chunk-J3JIYFYL.js";
-import "../chunk-XS6DLN67.js";
-import "../chunk-NM3IFKBL.js";
-import "../chunk-45QPICLE.js";
+} from "../chunk-J2ZX2XUV.js";
+import "../chunk-4JBYV75E.js";
+import "../chunk-ZICD77GM.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-37WOJQWY.js";
-import "../chunk-JC75UBMT.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
 import {
   TeamNotEnabledError
-} from "../chunk-FZCGIJEJ.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TEAM,

package/dist/tiers/index.js

@@ -1,6 +1,7 @@
 import {
   NO_TIERS,
   assertDeclaredTier,
+  assertTierComposition,
   assertTiersEnabled,
   classifySealedShred,
   demote,
@@ -8,25 +9,27 @@ import {
   getAtTier,
   listAtTier,
   putAtTier,
+  syncDerivedOutputs,
   withTiers
-} from "../chunk-AKEOHKMT.js";
-import "../chunk-KKYEZCQG.js";
-import "../chunk-HA6ZQWA2.js";
-import "../chunk-J3JIYFYL.js";
-import "../chunk-XS6DLN67.js";
-import "../chunk-NM3IFKBL.js";
-import "../chunk-45QPICLE.js";
+} from "../chunk-CDUQTA3Z.js";
+import "../chunk-ZICD77GM.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-37WOJQWY.js";
-import "../chunk-JC75UBMT.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
 import {
   TiersNotEnabledError
-} from "../chunk-FZCGIJEJ.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,
   TiersNotEnabledError,
   assertDeclaredTier,
+  assertTierComposition,
   assertTiersEnabled,
   classifySealedShred,
   demote,
@@ -34,6 +37,7 @@ export {
   getAtTier,
   listAtTier,
   putAtTier,
+  syncDerivedOutputs,
   withTiers
 };
 //# sourceMappingURL=index.js.map

package/dist/to/index.js

@@ -4,7 +4,7 @@ import {
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError
-} from "../chunk-FZCGIJEJ.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BundleVersionConflictError,

package/dist/tx/index.js

@@ -3,9 +3,9 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-AAIIDAUC.js";
+} from "../chunk-MEFJPTZ4.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-FZCGIJEJ.js";
+import "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
@@ -44,7 +44,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-UPSH5O3F.js");
+      const { GuardExecutor } = await import("../executor-KGWTNEQD.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-FZCGIJEJ.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/{verify-QK76NJ4G.js → verify-ZASTRNPR.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-XS6DLN67.js";
+} from "./chunk-HB3RFQSC.js";
 import {
   dualReadSealedSlot
-} from "./chunk-NM3IFKBL.js";
+} from "./chunk-JKJOGPZN.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-37WOJQWY.js";
+} from "./chunk-CIE2BASH.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-FZCGIJEJ.js";
+} from "./chunk-BIOUI4HL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -38,7 +38,7 @@ function refuseSealedResidue(collection, field) {
 }
 async function verifyDigestField(ctx, id, field, candidate, policy) {
   const env = await ctx.getEnvelope(id);
-  if (env === null) return padFalse();
+  if (env === null || (env._tier ?? 0) > 0) return padFalse();
   const blob = env._vdig?.[field];
   if (blob === void 0) {
     if (env._sealed?.[field] !== void 0) refuseSealedResidue(ctx.collection, field);
@@ -65,7 +65,7 @@ async function verifyTextField(ctx, id, field, candidate, normalize) {
   const env = await ctx.getEnvelope(id);
   const blob = env?._sealed?.[field];
   let stored;
-  if (env !== null && blob !== void 0) {
+  if (env !== null && (env._tier ?? 0) === 0 && blob !== void 0) {
     const cek = await ctx.resolveCek(env);
     const dek = await ctx.getDEK();
     try {
@@ -97,7 +97,8 @@ async function matchGroupFields(ctx, id, answers, members, opts) {
     }
     normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer));
   }
-  const env = await ctx.getEnvelope(id);
+  const fetched = await ctx.getEnvelope(id);
+  const env = fetched === null || (fetched._tier ?? 0) > 0 ? null : fetched;
   if (env !== null) {
     for (const m of members) {
       if (env._sealed?.[m.field] !== void 0 && env._vdig?.[m.field] === void 0) {
@@ -136,4 +137,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-QK76NJ4G.js.map
+//# sourceMappingURL=verify-ZASTRNPR.js.map