@noy-db/hub 0.3.0-pre.3 → 0.3.0-pre.4

package/dist/{chunk-4DZGZ7II.js → chunk-VMJ5URU7.js}

@@ -1,22 +1,22 @@
 import {
   assertTierAccess,
   dekKey
-} from "./chunk-O5DNEXQC.js";
+} from "./chunk-BMQOH7MM.js";
 import {
   rewrapBodyToDek
-} from "./chunk-5EZAJEES.js";
+} from "./chunk-OVO2RZAE.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-LN22XH4B.js";
 import {
   decrypt,
   encrypt,
   unwrapCek
-} from "./chunk-L4IRFTIF.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-TLJOJBZD.js";
 import {
   TierDemoteDeniedError,
   TiersNotEnabledError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-audit/tiers/active.ts
 function withTiers() {
@@ -272,4 +272,4 @@ export {
   demote,
   classifySealedShred
 };
-//# sourceMappingURL=chunk-4DZGZ7II.js.map
+//# sourceMappingURL=chunk-VMJ5URU7.js.map

package/dist/chunk-VMJ5URU7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/tiers/active.ts","../src/with-audit/tiers/strategy.ts","../src/with-audit/tiers/index.ts"],"sourcesContent":["/**\n * Enable the hierarchical-tiers capability.\n * Pass to `createNoydb({ tiersStrategy: withTiers() })` to make a collection's\n * `putAtTier` / `getAtTier` / `listAtTier` / `elevate` / `demote` methods live.\n * The tier read/write/re-key engine is dynamically imported here, so it stays\n * out of the floor bundle until opted in.\n */\nimport type { TiersStrategy } from './strategy.js'\n\nexport function withTiers(): TiersStrategy {\n  return {\n    async putAtTier(ctx, id, record, tier, opts) {\n      const { putAtTier } = await import('./index.js')\n      return putAtTier(ctx, id, record, tier, opts)\n    },\n    async getAtTier(ctx, id) {\n      const { getAtTier } = await import('./index.js')\n      return getAtTier(ctx, id)\n    },\n    async listAtTier(ctx) {\n      const { listAtTier } = await import('./index.js')\n      return listAtTier(ctx)\n    },\n    async elevate(ctx, id, toTier) {\n      const { elevate } = await import('./index.js')\n      return elevate(ctx, id, toTier)\n    },\n    async demote(ctx, id, toTier) {\n      const { demote } = await import('./index.js')\n      return demote(ctx, id, toTier)\n    },\n  }\n}\n","/**\n * Tiers capability strategy — the five on-demand collection-level tier\n * operations the `Collection` routes through. The active engine\n * ({@link withTiers}) dynamically imports the tier cores (keeping them out of\n * the floor bundle); {@link NO_TIERS} throws. Collection always builds its\n * per-call {@link TiersContext} and delegates here, so an un-opted-in caller\n * hits `NO_TIERS`'s throw.\n * @internal\n */\nimport type { GhostRecord } from '../../kernel/types.js'\nimport type { TiersContext } from './index.js'\nimport { TiersNotEnabledError } from '../../kernel/errors.js'\n\nexport interface TiersStrategy {\n  putAtTier<T>(\n    ctx: TiersContext<T>,\n    id: string,\n    record: T,\n    tier: number,\n    opts?: { elevation?: { reason: string; fromTier: number }; source?: string; sourceTs?: string },\n  ): Promise<void>\n  getAtTier<T>(ctx: TiersContext<T>, id: string): Promise<T | GhostRecord | null>\n  listAtTier<T>(ctx: TiersContext<T>): Promise<Array<{ id: string; tier: number; readable: boolean }>>\n  elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void>\n  demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void>\n}\n\n/**\n * No-op stub — the floor default. Every capability method throws\n * {@link TiersNotEnabledError}; opt in with `tiersStrategy: withTiers()` in\n * createNoydb. @internal\n */\nexport const NO_TIERS: TiersStrategy = {\n  async putAtTier() { throw new TiersNotEnabledError() },\n  async getAtTier() { throw new TiersNotEnabledError() },\n  async listAtTier() { throw new TiersNotEnabledError() },\n  async elevate() { throw new TiersNotEnabledError() },\n  async demote() { throw new TiersNotEnabledError() },\n}\n","/**\n * Hierarchical access — the collection-level tier operations\n * (`putAtTier` / `getAtTier` / `listAtTier` / `elevate` / `demote`).\n *\n * A collection opted into `{ tiers: [...] }` stamps `_tier: N` on each envelope\n * and encrypts its body under the tier-N DEK. These helpers are the read/write\n * surface for that scheme: write at a tier, read with tier-aware visibility\n * (invisibility vs. ghost), and move a record up (`elevate`) or down (`demote`)\n * the tier ladder by re-wrapping its body key.\n *\n * Each function takes a small {@link TiersContext} (the exact `this.*` the\n * moving methods touched) instead of `this`, mirroring the `record-keys/`\n * siblings. Behaviour is byte-identical to the inline code it replaced.\n *\n * The crux is `cekCache`: `elevate`/`demote`/`getAtTier` write the SAME `Lru`\n * reference `Collection` owns (never a copy) so a per-record CEK re-wrap stays\n * synchronous with the cache the kernel's write/read path also mutates. The\n * cross-tier event sink stays collection-resident and is reached via the\n * `emitCrossTierEvent` callback.\n *\n * Internal service — not exported as a `@noy-db/hub/*` subpath.\n */\nexport { withTiers } from './active.js'\nexport { NO_TIERS, type TiersStrategy } from './strategy.js'\nexport { TiersNotEnabledError } from '../../kernel/errors.js'\nimport { encrypt, decrypt, unwrapCek, rewrapBodyToDek, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js'\nimport { TierDemoteDeniedError } from '../../kernel/errors.js'\nimport { dekKey, assertTierAccess } from '../../with-party/team/tiers.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { Lru } from '../../kernel/cache/index.js'\nimport {\n  NOYDB_FORMAT_VERSION,\n  type NoydbStore,\n  type EncryptedEnvelope,\n  type GhostRecord,\n  type TierMode,\n  type CrossTierAccessEvent,\n} from '../../kernel/types.js'\n\n/** Everything the moving tier methods touched on `this.*`, as a flat context. */\nexport interface TiersContext<T> {\n  /** Collection name — the crypto AAD scope and tier-DEK key prefix. */\n  readonly name: string\n  /** Vault namespace the records live under. */\n  readonly vault: string\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** The caller's unlocked keyring (tier-DEK holdings + role + userId). */\n  readonly keyring: UnlockedKeyring\n  /** The record codec — decrypts a tier-0 envelope to T. */\n  readonly codec: RecordCodec<T>\n  /**\n   * The collection's per-record CEK cache (SHARED reference, not a copy).\n   * `elevate`/`demote`/`getAtTier` re-wrap a record's CEK and `set` it here so\n   * the move stays synchronous with the cache the kernel's read/write path\n   * owns. `null` → no caching.\n   */\n  readonly cekCache: Lru<string, EnclaveKey> | null\n  /** Emit `_source`/`_sourceTs` provenance fields when a source is supplied. */\n  readonly provenance: boolean\n  /** Declared tiers, or null when the feature is off. */\n  readonly tiers: ReadonlySet<number> | null\n  /** Above-tier read visibility mode (`'invisibility'` | `'ghost'`). */\n  readonly tierMode: TierMode\n  /** Resolve a tier DEK by its `dekKey(name, tier)`. */\n  getDEK(key: string): Promise<EnclaveKey>\n  /** Fire a cross-tier access event (sink stays collection-resident). */\n  emitCrossTierEvent(event: CrossTierAccessEvent): void\n}\n\nexport function assertTiersEnabled<T>(ctx: TiersContext<T>): void {\n  if (!ctx.tiers) {\n    throw new Error(\n      `Collection \"${ctx.name}\": hierarchical tiers are not enabled. ` +\n      `Pass { tiers: [0, 1, 2, …] } to vault.collection() to opt in.`,\n    )\n  }\n}\n\nexport function assertDeclaredTier<T>(ctx: TiersContext<T>, tier: number): void {\n  if (tier < 0 || !Number.isInteger(tier)) {\n    throw new Error(`Collection \"${ctx.name}\": tier must be a non-negative integer, got ${tier}`)\n  }\n  if (tier === 0) return\n  if (!ctx.tiers || !ctx.tiers.has(tier)) {\n    throw new Error(\n      `Collection \"${ctx.name}\": tier ${tier} is not declared in { tiers: [...] }`,\n    )\n  }\n}\n\nfunction isElevatorOrOwner<T>(ctx: TiersContext<T>): boolean {\n  return ctx.keyring.role === 'owner' || ctx.keyring.role === 'admin'\n}\n\n/**\n * tier-aware put. Encrypts the record with the collection's tier-N DEK and\n * stamps `_tier: N` on the envelope. The caller's keyring must hold the tier-N\n * DEK (directly, by delegation, or by virtue of being the grantor); otherwise\n * throws `TierNotGrantedError`.\n *\n * accepts an optional `elevation` context. When present, the emitted cross-tier\n * event is stamped with `authorization: 'elevation'`, the elevation's reason,\n * and the caller's pre-elevation tier. `vault.elevate(...).collection().put`\n * threads this through; direct `putAtTier` calls leave it undefined and fall\n * back to the inherent-write event shape.\n */\nexport async function putAtTier<T>(\n  ctx: TiersContext<T>,\n  id: string,\n  record: T,\n  tier: number,\n  opts?: { elevation?: { reason: string; fromTier: number }; source?: string; sourceTs?: string },\n): Promise<void> {\n  assertTiersEnabled(ctx)\n  assertDeclaredTier(ctx, tier)\n  assertTierAccess(ctx.keyring, ctx.name, tier)\n\n  const key = dekKey(ctx.name, tier)\n  const dek = await ctx.getDEK(key)\n\n  const existing = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  const version = existing ? existing._v + 1 : 1\n  const json = JSON.stringify(record)\n  const { iv, data } = await encrypt(json, dek)\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: version,\n    _ts: new Date().toISOString(),\n    _iv: iv,\n    _data: data,\n    _by: ctx.keyring.userId,\n    ...(tier > 0 && { _tier: tier }),\n    ...(ctx.provenance && opts?.source !== undefined ? { _source: opts.source, _sourceTs: opts.sourceTs ?? new Date().toISOString() } : {}),\n  }\n\n  await ctx.adapter.put(ctx.vault, ctx.name, id, envelope)\n\n  if (tier > 0) {\n    ctx.emitCrossTierEvent({\n      actor: ctx.keyring.userId,\n      collection: ctx.name,\n      id,\n      tier,\n      authorization: opts?.elevation ? 'elevation' : 'inherent',\n      op: 'put',\n      ts: envelope._ts,\n      ...(opts?.elevation && {\n        reason: opts.elevation.reason,\n        elevatedFrom: opts.elevation.fromTier,\n      }),\n    })\n  }\n}\n\n/**\n * tier-aware get. When the stored record is at a tier the caller cannot\n * decrypt:\n *   - `'invisibility'` mode (default) → returns `null`.\n *   - `'ghost'` mode → returns a `GhostRecord` placeholder with the tier and\n *     the record id (the record exists but contents are withheld).\n *\n * Fully-cleared reads return the plaintext record and fire a cross-tier event\n * when `_tier > 0`.\n */\nexport async function getAtTier<T>(ctx: TiersContext<T>, id: string): Promise<T | GhostRecord | null> {\n  assertTiersEnabled(ctx)\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope) return null\n  const tier = envelope._tier ?? 0\n  if (tier === 0) {\n    return ctx.codec.decryptRecord(envelope)\n  }\n\n  const key = dekKey(ctx.name, tier)\n  if (!ctx.keyring.deks.has(key)) {\n    if (ctx.tierMode === 'ghost') {\n      return { _ghost: true, _tier: tier } as GhostRecord\n    }\n    return null\n  }\n\n  const dek = await ctx.getDEK(key)\n  // A tiered record may carry a per-record CEK (e.g. a CEK record\n  // elevated via `elevate()`): the CEK is wrapped under the TIER DEK, so\n  // unwrap under the tier DEK then decrypt the body under the CEK. Legacy\n  // tiered records decrypt directly under the tier DEK.\n  let plaintext: string\n  if (envelope._cek !== undefined) {\n    const cek = await unwrapCek(envelope._cek, dek)\n    ctx.cekCache?.set(id, cek, 1)\n    plaintext = await decrypt(envelope._iv, envelope._data, cek)\n  } else {\n    plaintext = await decrypt(envelope._iv, envelope._data, dek)\n  }\n  const record = JSON.parse(plaintext) as T\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier,\n    authorization: isElevatorOrOwner(ctx) ? 'inherent' : 'delegation',\n    op: 'get',\n    ts: new Date().toISOString(),\n  })\n\n  return record\n}\n\n/**\n * list ids grouped by the caller's readability. Returns only ids whose tier the\n * caller can read. Above-tier ids are omitted in `'invisibility'` mode and\n * included (with tier metadata) in `'ghost'` mode.\n */\nexport async function listAtTier<T>(ctx: TiersContext<T>): Promise<Array<{ id: string; tier: number; readable: boolean }>> {\n  assertTiersEnabled(ctx)\n  const ids = await ctx.adapter.list(ctx.vault, ctx.name)\n  const out: Array<{ id: string; tier: number; readable: boolean }> = []\n  for (const id of ids) {\n    const env = await ctx.adapter.get(ctx.vault, ctx.name, id)\n    if (!env) continue\n    const tier = env._tier ?? 0\n    const readable = tier === 0 || ctx.keyring.deks.has(dekKey(ctx.name, tier))\n    if (!readable && ctx.tierMode === 'invisibility') continue\n    out.push({ id, tier, readable })\n  }\n  return out\n}\n\n/**\n * elevate a record to a higher tier. Re-encrypts with the target tier's DEK.\n * The caller must hold DEKs for both the current tier (to decrypt) and the\n * target tier (to re-encrypt). Stamps `_elevatedBy` with the caller id so\n * `demote()` can check the reverse operation.\n */\nexport async function elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void> {\n  assertTiersEnabled(ctx)\n  assertDeclaredTier(ctx, toTier)\n  assertTierAccess(ctx.keyring, ctx.name, toTier)\n\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope) throw new Error(`Record \"${id}\" not found in collection \"${ctx.name}\"`)\n  const fromTier = envelope._tier ?? 0\n  if (toTier === fromTier) return\n  if (toTier < fromTier) {\n    throw new Error(`Use demote() to lower the tier of \"${id}\" from ${fromTier} to ${toTier}`)\n  }\n  // Caller must have access at the existing tier to decrypt.\n  if (fromTier > 0) assertTierAccess(ctx.keyring, ctx.name, fromTier)\n\n  const fromKey = dekKey(ctx.name, fromTier)\n  const toKey = dekKey(ctx.name, toTier)\n  const fromDek = await ctx.getDEK(fromKey)\n  const toDek = await ctx.getDEK(toKey)\n\n  // Per-record CEK composes with tiers: the body key is unchanged (history\n  // chain identity preserved); only the wrapping key moves with the tier.\n  // Legacy (no `_cek`) records take the direct-DEK path unchanged.\n  const now = new Date().toISOString()\n  const body = await rewrapBodyToDek(envelope, fromDek, toDek)\n  if (body.cek) ctx.cekCache?.set(id, body.cek, 1)\n  const next: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: envelope._v + 1,\n    _ts: now,\n    _iv: body._iv,\n    _data: body._data,\n    _by: ctx.keyring.userId,\n    _tier: toTier,\n    _elevatedBy: ctx.keyring.userId,\n    ...(body._cek !== undefined ? { _cek: body._cek } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, ctx.name, id, next)\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier: toTier,\n    authorization: 'elevation',\n    op: 'elevate',\n    ts: now,\n  })\n}\n\n/**\n * demote a record to a lower tier. Allowed only for the user who performed the\n * last elevation or an owner.\n */\nexport async function demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void> {\n  assertTiersEnabled(ctx)\n  if (toTier < 0) throw new Error(`Cannot demote to negative tier ${toTier}`)\n\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope) throw new Error(`Record \"${id}\" not found in collection \"${ctx.name}\"`)\n  const fromTier = envelope._tier ?? 0\n  if (toTier === fromTier) return\n  if (toTier > fromTier) {\n    throw new Error(`Use elevate() to raise the tier of \"${id}\" from ${fromTier} to ${toTier}`)\n  }\n  const isOwner = ctx.keyring.role === 'owner'\n  const isOriginalElevator = envelope._elevatedBy === ctx.keyring.userId\n  if (!isOwner && !isOriginalElevator) {\n    throw new TierDemoteDeniedError(id, fromTier)\n  }\n  // Caller must still hold the DEK of the current tier to decrypt.\n  assertTierAccess(ctx.keyring, ctx.name, fromTier)\n  if (toTier > 0) assertDeclaredTier(ctx, toTier)\n\n  const fromDek = await ctx.getDEK(dekKey(ctx.name, fromTier))\n  const toDek = await ctx.getDEK(dekKey(ctx.name, toTier))\n\n  // CEK re-wrap on demote — same body key, moved from the source tier\n  // DEK to the target tier DEK. Legacy records take the direct-DEK path.\n  const now = new Date().toISOString()\n  const body = await rewrapBodyToDek(envelope, fromDek, toDek)\n  if (body.cek) ctx.cekCache?.set(id, body.cek, 1)\n  const next: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: envelope._v + 1,\n    _ts: now,\n    _iv: body._iv,\n    _data: body._data,\n    _by: ctx.keyring.userId,\n    ...(toTier > 0 && { _tier: toTier }),\n    ...(body._cek !== undefined ? { _cek: body._cek } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, ctx.name, id, next)\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier: fromTier,\n    authorization: 'elevation',\n    op: 'demote',\n    ts: now,\n  })\n}\n\n/**\n * Classify a live envelope's `_sealed` slots for crypto-shred completeness\n * (#M-1). Thin delegate to {@link RecordCodec.classifySealedShred}; surfaced\n * here because `vault.ts` forget() reaches in via `collection._classifySealedShred`.\n */\nexport function classifySealedShred<T>(\n  ctx: TiersContext<T>,\n  live: EncryptedEnvelope,\n): Promise<{ readonly slots: readonly SealedShredSlot[] }> {\n  return ctx.codec.classifySealedShred(live)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AASO,SAAS,YAA2B;AACzC,SAAO;AAAA,IACL,MAAM,UAAU,KAAK,IAAI,QAAQ,MAAM,MAAM;AAC3C,YAAM,EAAE,WAAAA,WAAU,IAAI,MAAM,OAAO,kBAAY;AAC/C,aAAOA,WAAU,KAAK,IAAI,QAAQ,MAAM,IAAI;AAAA,IAC9C;AAAA,IACA,MAAM,UAAU,KAAK,IAAI;AACvB,YAAM,EAAE,WAAAC,WAAU,IAAI,MAAM,OAAO,kBAAY;AAC/C,aAAOA,WAAU,KAAK,EAAE;AAAA,IAC1B;AAAA,IACA,MAAM,WAAW,KAAK;AACpB,YAAM,EAAE,YAAAC,YAAW,IAAI,MAAM,OAAO,kBAAY;AAChD,aAAOA,YAAW,GAAG;AAAA,IACvB;AAAA,IACA,MAAM,QAAQ,KAAK,IAAI,QAAQ;AAC7B,YAAM,EAAE,SAAAC,SAAQ,IAAI,MAAM,OAAO,kBAAY;AAC7C,aAAOA,SAAQ,KAAK,IAAI,MAAM;AAAA,IAChC;AAAA,IACA,MAAM,OAAO,KAAK,IAAI,QAAQ;AAC5B,YAAM,EAAE,QAAAC,QAAO,IAAI,MAAM,OAAO,kBAAY;AAC5C,aAAOA,QAAO,KAAK,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACF;;;ACAO,IAAM,WAA0B;AAAA,EACrC,MAAM,YAAY;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACrD,MAAM,YAAY;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACrD,MAAM,aAAa;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACtD,MAAM,UAAU;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACnD,MAAM,SAAS;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AACpD;;;ACgCO,SAAS,mBAAsB,KAA4B;AAChE,MAAI,CAAC,IAAI,OAAO;AACd,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI;AAAA,IAEzB;AAAA,EACF;AACF;AAEO,SAAS,mBAAsB,KAAsB,MAAoB;AAC9E,MAAI,OAAO,KAAK,CAAC,OAAO,UAAU,IAAI,GAAG;AACvC,UAAM,IAAI,MAAM,eAAe,IAAI,IAAI,+CAA+C,IAAI,EAAE;AAAA,EAC9F;AACA,MAAI,SAAS,EAAG;AAChB,MAAI,CAAC,IAAI,SAAS,CAAC,IAAI,MAAM,IAAI,IAAI,GAAG;AACtC,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI,WAAW,IAAI;AAAA,IACxC;AAAA,EACF;AACF;AAEA,SAAS,kBAAqB,KAA+B;AAC3D,SAAO,IAAI,QAAQ,SAAS,WAAW,IAAI,QAAQ,SAAS;AAC9D;AAcA,eAAsB,UACpB,KACA,IACA,QACA,MACA,MACe;AACf,qBAAmB,GAAG;AACtB,qBAAmB,KAAK,IAAI;AAC5B,mBAAiB,IAAI,SAAS,IAAI,MAAM,IAAI;AAE5C,QAAM,MAAM,OAAO,IAAI,MAAM,IAAI;AACjC,QAAM,MAAM,MAAM,IAAI,OAAO,GAAG;AAEhC,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,QAAM,UAAU,WAAW,SAAS,KAAK,IAAI;AAC7C,QAAM,OAAO,KAAK,UAAU,MAAM;AAClC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,KAAK,IAAI,QAAQ;AAAA,IACjB,GAAI,OAAO,KAAK,EAAE,OAAO,KAAK;AAAA,IAC9B,GAAI,IAAI,cAAc,MAAM,WAAW,SAAY,EAAE,SAAS,KAAK,QAAQ,WAAW,KAAK,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE,IAAI,CAAC;AAAA,EACvI;AAEA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,QAAQ;AAEvD,MAAI,OAAO,GAAG;AACZ,QAAI,mBAAmB;AAAA,MACrB,OAAO,IAAI,QAAQ;AAAA,MACnB,YAAY,IAAI;AAAA,MAChB;AAAA,MACA;AAAA,MACA,eAAe,MAAM,YAAY,cAAc;AAAA,MAC/C,IAAI;AAAA,MACJ,IAAI,SAAS;AAAA,MACb,GAAI,MAAM,aAAa;AAAA,QACrB,QAAQ,KAAK,UAAU;AAAA,QACvB,cAAc,KAAK,UAAU;AAAA,MAC/B;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAYA,eAAsB,UAAa,KAAsB,IAA6C;AACpG,qBAAmB,GAAG;AACtB,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,OAAO,SAAS,SAAS;AAC/B,MAAI,SAAS,GAAG;AACd,WAAO,IAAI,MAAM,cAAc,QAAQ;AAAA,EACzC;AAEA,QAAM,MAAM,OAAO,IAAI,MAAM,IAAI;AACjC,MAAI,CAAC,IAAI,QAAQ,KAAK,IAAI,GAAG,GAAG;AAC9B,QAAI,IAAI,aAAa,SAAS;AAC5B,aAAO,EAAE,QAAQ,MAAM,OAAO,KAAK;AAAA,IACrC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,MAAM,IAAI,OAAO,GAAG;AAKhC,MAAI;AACJ,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,MAAM,MAAM,UAAU,SAAS,MAAM,GAAG;AAC9C,QAAI,UAAU,IAAI,IAAI,KAAK,CAAC;AAC5B,gBAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAAA,EAC7D,OAAO;AACL,gBAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAAA,EAC7D;AACA,QAAM,SAAS,KAAK,MAAM,SAAS;AAEnC,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA;AAAA,IACA,eAAe,kBAAkB,GAAG,IAAI,aAAa;AAAA,IACrD,IAAI;AAAA,IACJ,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,EAC7B,CAAC;AAED,SAAO;AACT;AAOA,eAAsB,WAAc,KAAuF;AACzH,qBAAmB,GAAG;AACtB,QAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,IAAI;AACtD,QAAM,MAA8D,CAAC;AACrE,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AACzD,QAAI,CAAC,IAAK;AACV,UAAM,OAAO,IAAI,SAAS;AAC1B,UAAM,WAAW,SAAS,KAAK,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,MAAM,IAAI,CAAC;AAC1E,QAAI,CAAC,YAAY,IAAI,aAAa,eAAgB;AAClD,QAAI,KAAK,EAAE,IAAI,MAAM,SAAS,CAAC;AAAA,EACjC;AACA,SAAO;AACT;AAQA,eAAsB,QAAW,KAAsB,IAAY,QAA+B;AAChG,qBAAmB,GAAG;AACtB,qBAAmB,KAAK,MAAM;AAC9B,mBAAiB,IAAI,SAAS,IAAI,MAAM,MAAM;AAE9C,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,WAAW,EAAE,8BAA8B,IAAI,IAAI,GAAG;AACrF,QAAM,WAAW,SAAS,SAAS;AACnC,MAAI,WAAW,SAAU;AACzB,MAAI,SAAS,UAAU;AACrB,UAAM,IAAI,MAAM,sCAAsC,EAAE,UAAU,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC3F;AAEA,MAAI,WAAW,EAAG,kBAAiB,IAAI,SAAS,IAAI,MAAM,QAAQ;AAElE,QAAM,UAAU,OAAO,IAAI,MAAM,QAAQ;AACzC,QAAM,QAAQ,OAAO,IAAI,MAAM,MAAM;AACrC,QAAM,UAAU,MAAM,IAAI,OAAO,OAAO;AACxC,QAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;AAKpC,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,OAAO,MAAM,gBAAgB,UAAU,SAAS,KAAK;AAC3D,MAAI,KAAK,IAAK,KAAI,UAAU,IAAI,IAAI,KAAK,KAAK,CAAC;AAC/C,QAAM,OAA0B;AAAA,IAC9B,QAAQ;AAAA,IACR,IAAI,SAAS,KAAK;AAAA,IAClB,KAAK;AAAA,IACL,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,IAAI,QAAQ;AAAA,IACjB,OAAO;AAAA,IACP,aAAa,IAAI,QAAQ;AAAA,IACzB,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,IAAI;AAEnD,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA,MAAM;AAAA,IACN,eAAe;AAAA,IACf,IAAI;AAAA,IACJ,IAAI;AAAA,EACN,CAAC;AACH;AAMA,eAAsB,OAAU,KAAsB,IAAY,QAA+B;AAC/F,qBAAmB,GAAG;AACtB,MAAI,SAAS,EAAG,OAAM,IAAI,MAAM,kCAAkC,MAAM,EAAE;AAE1E,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,WAAW,EAAE,8BAA8B,IAAI,IAAI,GAAG;AACrF,QAAM,WAAW,SAAS,SAAS;AACnC,MAAI,WAAW,SAAU;AACzB,MAAI,SAAS,UAAU;AACrB,UAAM,IAAI,MAAM,uCAAuC,EAAE,UAAU,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC5F;AACA,QAAM,UAAU,IAAI,QAAQ,SAAS;AACrC,QAAM,qBAAqB,SAAS,gBAAgB,IAAI,QAAQ;AAChE,MAAI,CAAC,WAAW,CAAC,oBAAoB;AACnC,UAAM,IAAI,sBAAsB,IAAI,QAAQ;AAAA,EAC9C;AAEA,mBAAiB,IAAI,SAAS,IAAI,MAAM,QAAQ;AAChD,MAAI,SAAS,EAAG,oBAAmB,KAAK,MAAM;AAE9C,QAAM,UAAU,MAAM,IAAI,OAAO,OAAO,IAAI,MAAM,QAAQ,CAAC;AAC3D,QAAM,QAAQ,MAAM,IAAI,OAAO,OAAO,IAAI,MAAM,MAAM,CAAC;AAIvD,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,OAAO,MAAM,gBAAgB,UAAU,SAAS,KAAK;AAC3D,MAAI,KAAK,IAAK,KAAI,UAAU,IAAI,IAAI,KAAK,KAAK,CAAC;AAC/C,QAAM,OAA0B;AAAA,IAC9B,QAAQ;AAAA,IACR,IAAI,SAAS,KAAK;AAAA,IAClB,KAAK;AAAA,IACL,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,IAAI,QAAQ;AAAA,IACjB,GAAI,SAAS,KAAK,EAAE,OAAO,OAAO;AAAA,IAClC,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,IAAI;AAEnD,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA,MAAM;AAAA,IACN,eAAe;AAAA,IACf,IAAI;AAAA,IACJ,IAAI;AAAA,EACN,CAAC;AACH;AAOO,SAAS,oBACd,KACA,MACyD;AACzD,SAAO,IAAI,MAAM,oBAAoB,IAAI;AAC3C;","names":["putAtTier","getAtTier","listAtTier","elevate","demote"]}

package/dist/{chunk-YDP2SA5K.js → chunk-VPCMJ5Z4.js}

@@ -1,20 +1,20 @@
 import {
   dekKey
-} from "./chunk-O5DNEXQC.js";
+} from "./chunk-BMQOH7MM.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
   openEnvelopeJson
-} from "./chunk-5EZAJEES.js";
+} from "./chunk-OVO2RZAE.js";
 import {
   encrypt,
   unwrapKey,
   wrapKey
-} from "./chunk-L4IRFTIF.js";
+} from "./chunk-TLJOJBZD.js";
 import {
   DelegationTargetMissingError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-party/team/delegation.ts
 var DELEGATIONS_COLLECTION = "_delegations";
@@ -96,4 +96,4 @@ export {
   loadActiveDelegations,
   revokeDelegation
 };
-//# sourceMappingURL=chunk-YDP2SA5K.js.map
+//# sourceMappingURL=chunk-VPCMJ5Z4.js.map

package/dist/{chunk-ZAWD6O46.js → chunk-VRPBEOWU.js}

@@ -2,7 +2,7 @@ import {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,
   OverlayNameCollisionError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-formula/overlay-views/registry.ts
 var OverlayedViewRegistry = class {
@@ -68,4 +68,4 @@ var OverlayedViewRegistry = class {
 export {
   OverlayedViewRegistry
 };
-//# sourceMappingURL=chunk-ZAWD6O46.js.map
+//# sourceMappingURL=chunk-VRPBEOWU.js.map

package/dist/{chunk-AY4P6PHN.js → chunk-VWGCJUTV.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-LN22XH4B.js";
 
 // src/with-party/team/managed-passphrase.ts
 var MemorySealingKeyProvider = class {
@@ -227,4 +227,4 @@ export {
   loadSealedPassphrase,
   resolveManagedSecret
 };
-//# sourceMappingURL=chunk-AY4P6PHN.js.map
+//# sourceMappingURL=chunk-VWGCJUTV.js.map

package/dist/{chunk-IIK7W3AN.js → chunk-XJR3COJO.js}

@@ -1,17 +1,17 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-6CNLU4TO.js";
+} from "./chunk-TYGW5TOR.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-7MHVHGQZ.js";
+} from "./chunk-P2LDXRGP.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-LN22XH4B.js";
 import {
   NoydbError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-audit/portability/request-withdrawal.ts
 var WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
@@ -161,4 +161,4 @@ export {
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-IIK7W3AN.js.map
+//# sourceMappingURL=chunk-XJR3COJO.js.map

package/dist/{chunk-ZD4D7UM6.js → chunk-XYYW64LB.js}

@@ -1,7 +1,7 @@
 import {
   DerivationCapExceededError,
   DerivationOutputShapeError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-formula/derivations/executor.ts
 var DerivationExecutor = {
@@ -121,4 +121,4 @@ var DerivationExecutor = {
 export {
   DerivationExecutor
 };
-//# sourceMappingURL=chunk-ZD4D7UM6.js.map
+//# sourceMappingURL=chunk-XYYW64LB.js.map

package/dist/{chunk-4NZCZUGL.js → chunk-YFF2RP3X.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-LN22XH4B.js";
 
 // src/with-shape/schema-update/fence.ts
 var FENCE_RECORD_ID = "schema-fence";
@@ -37,4 +37,4 @@ export {
   loadFence,
   saveFence
 };
-//# sourceMappingURL=chunk-4NZCZUGL.js.map
+//# sourceMappingURL=chunk-YFF2RP3X.js.map

package/dist/{chunk-WVIIJPTJ.js → chunk-Z3FZC5GV.js}

@@ -1,15 +1,15 @@
 import {
   isTombstone
-} from "./chunk-6RASM2J4.js";
-import {
-  decrypt
-} from "./chunk-L4IRFTIF.js";
+} from "./chunk-QKVILR7N.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-LN22XH4B.js";
+import {
+  decrypt
+} from "./chunk-TLJOJBZD.js";
 import {
   ReadOnlyAtInstantError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-commit/history/history.ts
 var HISTORY_COLLECTION = "_history";
@@ -277,4 +277,4 @@ export {
   VaultInstant,
   CollectionInstant
 };
-//# sourceMappingURL=chunk-WVIIJPTJ.js.map
+//# sourceMappingURL=chunk-Z3FZC5GV.js.map

package/dist/{chunk-55HDKLI3.js → chunk-Z5PIUYNB.js}

@@ -1,6 +1,9 @@
 import {
   openEnvelopeJson
-} from "./chunk-5EZAJEES.js";
+} from "./chunk-OVO2RZAE.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-LN22XH4B.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -12,14 +15,11 @@ import {
   sha256Hex,
   unwrapCek,
   wrapCek
-} from "./chunk-L4IRFTIF.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-TLJOJBZD.js";
 import {
   ConflictError,
   NotFoundError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-shape/blobs/mime-magic.ts
 function hex(s) {
@@ -1155,7 +1155,7 @@ var BlobSet = class {
       return this.buildResponse(slot, result.blob, { inline: true });
     }
     const aad = chunkAAD(slot.eTag, 0, result.blob.chunkCount);
-    const { decryptBytesWithAAD: decryptAAD } = await import("./enclave-IS7HZSQ7.js");
+    const { decryptBytesWithAAD: decryptAAD } = await import("./enclave-YN6223OG.js");
     const decrypted = await decryptAAD(envelope._iv, envelope._data, blobDEK, aad);
     const plaintext = result.blob.compression === "gzip" ? await decompressBytes(decrypted) : decrypted;
     const body = new ReadableStream({
@@ -1218,4 +1218,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-55HDKLI3.js.map
+//# sourceMappingURL=chunk-Z5PIUYNB.js.map

package/dist/{chunk-ZRDYQZYH.js → chunk-Z7KI4WHR.js}

@@ -1,6 +1,6 @@
 import {
   AttestationNotEnabledError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-audit/attestation/strategy.ts
 var NO_ATTESTATION = {
@@ -27,4 +27,4 @@ var NO_ATTESTATION = {
 export {
   NO_ATTESTATION
 };
-//# sourceMappingURL=chunk-ZRDYQZYH.js.map
+//# sourceMappingURL=chunk-Z7KI4WHR.js.map

package/dist/chunk-ZKF6HH7V.js

@@ -0,0 +1,120 @@
+import {
+  NoydbError
+} from "./chunk-U23JUUPX.js";
+
+// src/kernel/money-runtime.ts
+var engine = null;
+function installMoneyEngine(e) {
+  engine ??= e;
+}
+function moneyRuntime() {
+  if (engine === null) {
+    throw new NoydbError(
+      "MONEY_ENGINE_NOT_LINKED",
+      "money fields require descriptors created via money() from @noy-db/hub \u2014 hand-rolled descriptor objects are not supported"
+    );
+  }
+  return engine;
+}
+
+// src/kernel/query/predicate.ts
+function readPath(record, path) {
+  if (record === null || record === void 0) return void 0;
+  if (!path.includes(".")) {
+    return record[path];
+  }
+  const segments = path.split(".");
+  let cursor = record;
+  for (const segment of segments) {
+    if (cursor === null || cursor === void 0) return void 0;
+    cursor = cursor[segment];
+  }
+  return cursor;
+}
+function evaluateFieldClause(record, clause) {
+  const actual = readPath(record, clause.field);
+  const { op, value } = clause;
+  if (clause.money) return moneyRuntime().evaluateMoneyClause(actual, op, clause.money);
+  switch (op) {
+    case "==":
+      return actual === value;
+    case "!=":
+      return actual !== value;
+    case "<":
+      return isComparable(actual, value) && actual < value;
+    case "<=":
+      return isComparable(actual, value) && actual <= value;
+    case ">":
+      return isComparable(actual, value) && actual > value;
+    case ">=":
+      return isComparable(actual, value) && actual >= value;
+    case "in":
+      return Array.isArray(value) && value.includes(actual);
+    case "contains":
+      if (typeof actual === "string") return typeof value === "string" && actual.includes(value);
+      if (Array.isArray(actual)) return actual.includes(value);
+      return false;
+    case "startsWith":
+      return typeof actual === "string" && typeof value === "string" && actual.startsWith(value);
+    case "between": {
+      if (!Array.isArray(value) || value.length !== 2) return false;
+      const [lo, hi] = value;
+      if (!isComparable(actual, lo) || !isComparable(actual, hi)) return false;
+      return actual >= lo && actual <= hi;
+    }
+    default: {
+      const _exhaustive = op;
+      void _exhaustive;
+      return false;
+    }
+  }
+}
+function isComparable(a, b) {
+  if (typeof a === "number" && typeof b === "number") return true;
+  if (typeof a === "string" && typeof b === "string") return true;
+  if (a instanceof Date && b instanceof Date) return true;
+  return false;
+}
+function evaluateClause(record, clause, fnRecord) {
+  switch (clause.type) {
+    case "field":
+      return evaluateFieldClause(record, clause);
+    case "filter":
+      return clause.fn(fnRecord !== void 0 ? fnRecord : record);
+    case "wherePredicate":
+      return clause.fn(fnRecord !== void 0 ? fnRecord : record, clause.ctx);
+    case "crossJoin":
+      throw new Error(
+        `evaluateClause: 'crossJoin' clauses are expansion primitives and are not evaluated per-record. This is a query planner routing error \u2014 crossJoin clauses must be extracted from the clause list before calling evaluateClause or filterRecords.`
+      );
+    case "group":
+      if (clause.op === "and") {
+        for (const child of clause.clauses) {
+          if (!evaluateClause(record, child, fnRecord)) return false;
+        }
+        return true;
+      } else {
+        for (const child of clause.clauses) {
+          if (evaluateClause(record, child, fnRecord)) return true;
+        }
+        return false;
+      }
+  }
+}
+function hasFnClause(clauses) {
+  for (const c of clauses) {
+    if (c.type === "filter" || c.type === "wherePredicate") return true;
+    if (c.type === "group" && hasFnClause(c.clauses)) return true;
+  }
+  return false;
+}
+
+export {
+  installMoneyEngine,
+  moneyRuntime,
+  readPath,
+  evaluateFieldClause,
+  evaluateClause,
+  hasFnClause
+};
+//# sourceMappingURL=chunk-ZKF6HH7V.js.map

package/dist/chunk-ZKF6HH7V.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/money-runtime.ts","../src/kernel/query/predicate.ts"],"sourcesContent":["/**\n * Money engine runtime seam (#553).\n *\n * The kernel floor consults the money engine from SYNC paths — the\n * query DSL executes synchronously (`toArray()`/`first()`/`count()`),\n * `where()` quantizes operands at build time, and `moneyFields` path\n * validation throws at declaration time — so an `await import()` seam\n * would either break those sync semantics or race a fire-and-forget\n * preload. Instead the DECLARATION carries the engine: constructing a\n * descriptor via `money()` statically links the implementation\n * (`with-shape/money/engine.ts`) and installs it here, so by the time\n * any kernel path holds a `MoneyDescriptor` the engine is guaranteed\n * present.\n *\n * The kernel floor imports ONLY this holder plus the erased\n * {@link MoneyEngine} type; the engine modules are reachable solely\n * through the user's own `money()` import — a consumer that never\n * declares a money field tree-shakes the whole family out.\n */\nimport { NoydbError } from './errors.js'\nimport type { MoneyEngine } from '../with-shape/money/engine.js'\n\nexport type { MoneyEngine }\n\nlet engine: MoneyEngine | null = null\n\n/** @internal — called (idempotently) by `money()` when a descriptor is built. */\nexport function installMoneyEngine(e: MoneyEngine): void {\n  engine ??= e\n}\n\n/** @internal — test-only visibility into whether the engine was linked. */\nexport function isMoneyEngineInstalled(): boolean {\n  return engine !== null\n}\n\n/**\n * @internal — resolve the installed engine. Every call site is gated on\n * the presence of a `MoneyDescriptor`, which only `money()` constructs,\n * so this cannot throw for supported inputs. A hand-rolled descriptor\n * object (not produced by `money()`) is the one path that lands here.\n */\nexport function moneyRuntime(): MoneyEngine {\n  if (engine === null) {\n    throw new NoydbError(\n      'MONEY_ENGINE_NOT_LINKED',\n      'money fields require descriptors created via money() from @noy-db/hub — ' +\n        'hand-rolled descriptor objects are not supported',\n    )\n  }\n  return engine\n}\n","/**\n * Operator implementations for the query DSL.\n *\n * All predicates run client-side, AFTER decryption — they never see ciphertext.\n * The only dependency is the money clause evaluator — still\n * tree-shakeable through it.\n */\n\nimport type { MoneyWhereOperand } from '../../with-shape/money/where.js'\nimport { moneyRuntime } from '../money-runtime.js'\n\n/** Comparison operators supported by the where() builder. */\nexport type Operator =\n  | '=='\n  | '!='\n  | '<'\n  | '<='\n  | '>'\n  | '>='\n  | 'in'\n  | 'contains'\n  | 'startsWith'\n  | 'between'\n\n/**\n * A single field comparison clause inside a query plan.\n * Plans are JSON-serializable, so this type uses primitives only.\n */\nexport interface FieldClause {\n  readonly type: 'field'\n  readonly field: string\n  readonly op: Operator\n  readonly value: unknown\n  /**\n   * Present when `field` is a declared money field: the operand\n   * quantized into stored scaled-int space at query BUILD time, so the\n   * per-record comparison is BigInt-exact against the raw stored value.\n   * Built by `moneyFieldClause` — `Query.where()` attaches it when the\n   * source declares the field in `moneyFields`.\n   */\n  readonly money?: MoneyWhereOperand\n}\n\n/**\n * A user-supplied predicate function escape hatch. Not serializable.\n *\n * The predicate accepts `unknown` at the type level so the surrounding\n * Clause type can stay non-parametric — this keeps Collection<T> covariant\n * in T at the public API surface. Builder methods cast user predicates\n * (typed `(record: T) => boolean`) into this shape on the way in.\n */\nexport interface FilterClause {\n  readonly type: 'filter'\n  readonly fn: (record: unknown) => boolean\n}\n\n/**\n * A declared deterministic predicate reference. The query\n * builder produces this via `.wherePredicate(name, ctx?)` when a\n * Query has been augmented with a predicates map (typically by the\n * materialized-view registry).\n *\n * `predicateHash` is the consumer-supplied stable hash for the\n * function body; `ctxHash` is the canonical-JSON SHA-256 of `ctx`.\n * Both fold into the MV's `queryHash` so a function or ctx change\n * forces refresh on next visit.\n *\n * `fn` is resolved at builder time from the predicates map and\n * embedded directly — so `evaluateClause` can fire it without a\n * runtime lookup.\n */\nexport interface WherePredicateClause {\n  readonly type: 'wherePredicate'\n  readonly name: string\n  readonly ctx: unknown\n  readonly predicateHash: string\n  readonly ctxHash: string\n  readonly fn: (record: unknown, ctx?: unknown) => boolean\n}\n\n/** A logical group of clauses combined by AND or OR. */\nexport interface GroupClause {\n  readonly type: 'group'\n  readonly op: 'and' | 'or'\n  readonly clauses: readonly Clause[]\n}\n\n/**\n * Cartesian-product expansion clause. Appended to `QueryPlan.clauses`\n * by `Query.crossJoin()`. Processed in declaration order by\n * `executeClausePipeline` — NOT by `evaluateClause` (which is a\n * per-record predicate and throws on this type).\n */\nexport interface CrossJoinClause {\n  readonly type: 'crossJoin'\n  /** Target collection name to cross-join against. */\n  readonly target: string\n  /** Alias under which the right-side record is exposed on each result row. */\n  readonly as: string\n  /**\n   * Lateral filter callback. `undefined` → full cartesian product.\n   * Two call shapes:\n   *   - Subset:    `(left) => TTarget[]`            — returns the right rows for this left row\n   *   - Predicate: `(left) => (right) => boolean`   — executor materializes then filters\n   */\n  readonly on?: (left: unknown) => unknown[] | ((right: unknown) => boolean)\n  /** When `on:` was supplied as `{ predicate: name }`, the name is stored here for queryHash. */\n  readonly onPredicateName?: string\n  /** Per-clause row ceiling override. `undefined` → `DEFAULT_CROSS_JOIN_MAX_ROWS`. */\n  readonly maxRows?: number\n}\n\nexport type Clause = FieldClause | FilterClause | WherePredicateClause | GroupClause | CrossJoinClause\n\n/**\n * Read a possibly nested field path like \"address.city\" from a record.\n * Returns undefined if any segment is missing.\n */\nexport function readPath(record: unknown, path: string): unknown {\n  if (record === null || record === undefined) return undefined\n  if (!path.includes('.')) {\n    return (record as Record<string, unknown>)[path]\n  }\n  const segments = path.split('.')\n  let cursor: unknown = record\n  for (const segment of segments) {\n    if (cursor === null || cursor === undefined) return undefined\n    cursor = (cursor as Record<string, unknown>)[segment]\n  }\n  return cursor\n}\n\n/**\n * Evaluate a single field clause against a record.\n * Returns false on type mismatches rather than throwing — query results\n * exclude non-matching records by definition.\n */\nexport function evaluateFieldClause(record: unknown, clause: FieldClause): boolean {\n  const actual = readPath(record, clause.field)\n  const { op, value } = clause\n\n  // Money fields compare BigInt-exact in scaled-integer space —\n  // the stored form is a digit string, so the generic paths below would\n  // either reject (string vs number is not comparable) or compare\n  // lexicographically. The operand was quantized at build time.\n  if (clause.money) return moneyRuntime().evaluateMoneyClause(actual, op, clause.money)\n\n  switch (op) {\n    case '==':\n      return actual === value\n    case '!=':\n      return actual !== value\n    case '<':\n      return isComparable(actual, value) && (actual as number) < (value as number)\n    case '<=':\n      return isComparable(actual, value) && (actual as number) <= (value as number)\n    case '>':\n      return isComparable(actual, value) && (actual as number) > (value as number)\n    case '>=':\n      return isComparable(actual, value) && (actual as number) >= (value as number)\n    case 'in':\n      return Array.isArray(value) && value.includes(actual)\n    case 'contains':\n      if (typeof actual === 'string') return typeof value === 'string' && actual.includes(value)\n      if (Array.isArray(actual)) return actual.includes(value)\n      return false\n    case 'startsWith':\n      return typeof actual === 'string' && typeof value === 'string' && actual.startsWith(value)\n    case 'between': {\n      if (!Array.isArray(value) || value.length !== 2) return false\n      const [lo, hi] = value\n      if (!isComparable(actual, lo) || !isComparable(actual, hi)) return false\n      return (actual as number) >= (lo as number) && (actual as number) <= (hi as number)\n    }\n    default: {\n      // Exhaustiveness — TS will error if a new operator is added without a case.\n      const _exhaustive: never = op\n      void _exhaustive\n      return false\n    }\n  }\n}\n\n/**\n * Two values are \"comparable\" if they share an order-defined runtime type.\n * Strings compare lexicographically; numbers and Dates numerically; otherwise false.\n */\nfunction isComparable(a: unknown, b: unknown): boolean {\n  if (typeof a === 'number' && typeof b === 'number') return true\n  if (typeof a === 'string' && typeof b === 'string') return true\n  if (a instanceof Date && b instanceof Date) return true\n  return false\n}\n\n/**\n * Evaluate any clause (field / filter / group) against a record.\n * The recursion depth is bounded by the user's query expression — no risk of\n * blowing the stack on a 50K-record collection.\n *\n * `fnRecord`, when provided, is the view handed to USER CALLBACK clauses\n * (`filter` / `wherePredicate`) instead of `record` — the executor passes\n * the money-decoded view there so user code never sees the stored\n * scaled-int form, while field clauses keep evaluating against the raw\n * record (their money operands are pre-quantized to that space).\n */\nexport function evaluateClause(record: unknown, clause: Clause, fnRecord?: unknown): boolean {\n  switch (clause.type) {\n    case 'field':\n      return evaluateFieldClause(record, clause)\n    case 'filter':\n      return clause.fn(fnRecord !== undefined ? fnRecord : record)\n    case 'wherePredicate':\n      return clause.fn(fnRecord !== undefined ? fnRecord : record, clause.ctx)\n    case 'crossJoin':\n      throw new Error(\n        `evaluateClause: 'crossJoin' clauses are expansion primitives and are not ` +\n          `evaluated per-record. This is a query planner routing error — ` +\n          `crossJoin clauses must be extracted from the clause list before calling ` +\n          `evaluateClause or filterRecords.`,\n      )\n    case 'group':\n      if (clause.op === 'and') {\n        for (const child of clause.clauses) {\n          if (!evaluateClause(record, child, fnRecord)) return false\n        }\n        return true\n      } else {\n        for (const child of clause.clauses) {\n          if (evaluateClause(record, child, fnRecord)) return true\n        }\n        return false\n      }\n  }\n}\n\n/**\n * Does the clause list contain any user-callback clause (filter /\n * wherePredicate), at any group nesting depth? Used by executors to\n * decide whether the per-record decoded view needs materializing.\n */\nexport function hasFnClause(clauses: readonly Clause[]): boolean {\n  for (const c of clauses) {\n    if (c.type === 'filter' || c.type === 'wherePredicate') return true\n    if (c.type === 'group' && hasFnClause(c.clauses)) return true\n  }\n  return false\n}\n"],"mappings":";;;;;AAwBA,IAAI,SAA6B;AAG1B,SAAS,mBAAmB,GAAsB;AACvD,aAAW;AACb;AAaO,SAAS,eAA4B;AAC1C,MAAI,WAAW,MAAM;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IAEF;AAAA,EACF;AACA,SAAO;AACT;;;ACmEO,SAAS,SAAS,QAAiB,MAAuB;AAC/D,MAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,MAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AACvB,WAAQ,OAAmC,IAAI;AAAA,EACjD;AACA,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,MAAI,SAAkB;AACtB,aAAW,WAAW,UAAU;AAC9B,QAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,aAAU,OAAmC,OAAO;AAAA,EACtD;AACA,SAAO;AACT;AAOO,SAAS,oBAAoB,QAAiB,QAA8B;AACjF,QAAM,SAAS,SAAS,QAAQ,OAAO,KAAK;AAC5C,QAAM,EAAE,IAAI,MAAM,IAAI;AAMtB,MAAI,OAAO,MAAO,QAAO,aAAa,EAAE,oBAAoB,QAAQ,IAAI,OAAO,KAAK;AAEpF,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,WAAW;AAAA,IACpB,KAAK;AACH,aAAO,WAAW;AAAA,IACpB,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,SAAqB;AAAA,IAC9D,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,UAAsB;AAAA,IAC/D,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,SAAqB;AAAA,IAC9D,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,UAAsB;AAAA,IAC/D,KAAK;AACH,aAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,MAAM;AAAA,IACtD,KAAK;AACH,UAAI,OAAO,WAAW,SAAU,QAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AACzF,UAAI,MAAM,QAAQ,MAAM,EAAG,QAAO,OAAO,SAAS,KAAK;AACvD,aAAO;AAAA,IACT,KAAK;AACH,aAAO,OAAO,WAAW,YAAY,OAAO,UAAU,YAAY,OAAO,WAAW,KAAK;AAAA,IAC3F,KAAK,WAAW;AACd,UAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,EAAG,QAAO;AACxD,YAAM,CAAC,IAAI,EAAE,IAAI;AACjB,UAAI,CAAC,aAAa,QAAQ,EAAE,KAAK,CAAC,aAAa,QAAQ,EAAE,EAAG,QAAO;AACnE,aAAQ,UAAsB,MAAkB,UAAsB;AAAA,IACxE;AAAA,IACA,SAAS;AAEP,YAAM,cAAqB;AAC3B,WAAK;AACL,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAMA,SAAS,aAAa,GAAY,GAAqB;AACrD,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,aAAa,QAAQ,aAAa,KAAM,QAAO;AACnD,SAAO;AACT;AAaO,SAAS,eAAe,QAAiB,QAAgB,UAA6B;AAC3F,UAAQ,OAAO,MAAM;AAAA,IACnB,KAAK;AACH,aAAO,oBAAoB,QAAQ,MAAM;AAAA,IAC3C,KAAK;AACH,aAAO,OAAO,GAAG,aAAa,SAAY,WAAW,MAAM;AAAA,IAC7D,KAAK;AACH,aAAO,OAAO,GAAG,aAAa,SAAY,WAAW,QAAQ,OAAO,GAAG;AAAA,IACzE,KAAK;AACH,YAAM,IAAI;AAAA,QACR;AAAA,MAIF;AAAA,IACF,KAAK;AACH,UAAI,OAAO,OAAO,OAAO;AACvB,mBAAW,SAAS,OAAO,SAAS;AAClC,cAAI,CAAC,eAAe,QAAQ,OAAO,QAAQ,EAAG,QAAO;AAAA,QACvD;AACA,eAAO;AAAA,MACT,OAAO;AACL,mBAAW,SAAS,OAAO,SAAS;AAClC,cAAI,eAAe,QAAQ,OAAO,QAAQ,EAAG,QAAO;AAAA,QACtD;AACA,eAAO;AAAA,MACT;AAAA,EACJ;AACF;AAOO,SAAS,YAAY,SAAqC;AAC/D,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,SAAS,YAAY,EAAE,SAAS,iBAAkB,QAAO;AAC/D,QAAI,EAAE,SAAS,WAAW,YAAY,EAAE,OAAO,EAAG,QAAO;AAAA,EAC3D;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-P6DN5QU7.js → chunk-ZKYMKF2S.js}

@@ -2,20 +2,20 @@ import {
   ATTESTATIONS_COLLECTION,
   REVOKED_RECORD_ID,
   loadOrCreateSigner
-} from "./chunk-E4YJUNPU.js";
+} from "./chunk-H5XRIJX3.js";
 import {
   openEnvelopeJson
-} from "./chunk-5EZAJEES.js";
-import {
-  encrypt
-} from "./chunk-L4IRFTIF.js";
+} from "./chunk-OVO2RZAE.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-OCDUQUAP.js";
+} from "./chunk-LN22XH4B.js";
+import {
+  encrypt
+} from "./chunk-TLJOJBZD.js";
 import {
   AttestationError,
   ConflictError
-} from "./chunk-BLZRNHMG.js";
+} from "./chunk-U23JUUPX.js";
 
 // src/with-audit/attestation/revoke.ts
 import { signRevocationList } from "@noy-db/attestation";
@@ -82,4 +82,4 @@ export {
   getRevokedDocIdsCore,
   publishRevocationListCore
 };
-//# sourceMappingURL=chunk-P6DN5QU7.js.map
+//# sourceMappingURL=chunk-ZKYMKF2S.js.map