@noy-db/hub 0.3.0-pre.3 → 0.3.0-pre.5

package/dist/walk-T65TZDN2.js

@@ -0,0 +1,241 @@
+import {
+  jsonSchemaToFields
+} from "./chunk-TQ3REHVF.js";
+import {
+  derivePersistedSchema
+} from "./chunk-ULIHDPKL.js";
+import {
+  loadPersistedSchema
+} from "./chunk-TL7QR5T6.js";
+import "./chunk-OVO2RZAE.js";
+import "./chunk-QKVILR7N.js";
+import "./chunk-LN22XH4B.js";
+import "./chunk-PGFY7IRW.js";
+import "./chunk-TCIUO62Z.js";
+import "./chunk-UOEWDCUX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-TLJOJBZD.js";
+import "./chunk-U23JUUPX.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/with-shape/introspection/walk.ts
+var INTERNAL_PREFIX = "_";
+var KNOWN_INTERNAL_NAMES = ["_keyring", "_ledger", "_meta", "_schemas", "_deltas"];
+async function dumpVaultSchema(vault, opts) {
+  const state = vault._introspectState();
+  const sampleSize = opts.sampleSize ?? 50;
+  const withStats = opts.withStats === true;
+  const cacheNames = [...state.collectionCache.keys()];
+  const storageNames = (await safeListAllCollections(state.adapter, state.name)).filter((n) => !n.startsWith(INTERNAL_PREFIX));
+  const allNames = Array.from(/* @__PURE__ */ new Set([...cacheNames, ...storageNames])).sort();
+  const collections = {};
+  for (const name of allNames) {
+    collections[name] = await describeCollection(state, name, sampleSize, withStats);
+  }
+  const materializedViews = describeMVs(state.mvRegistry);
+  const overlayViews = describeOverlays(state.overlayRegistry);
+  const derivations = describeDerivations(state.derivationRegistry);
+  let internal;
+  if (withStats) {
+    internal = {};
+    for (const name of KNOWN_INTERNAL_NAMES) {
+      const stats = await statsForCollection(state.adapter, state.name, name);
+      if (stats.records > 0) {
+        internal[name] = { records: stats.records, bytes: stats.bytes };
+      }
+    }
+  }
+  const snap = {
+    _noydb_snapshot: 1,
+    vault: state.name,
+    emittedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    subsystems: state.subsystems,
+    ...state.vaultMeta !== void 0 ? { meta: state.vaultMeta } : {},
+    collections,
+    materializedViews,
+    overlayViews,
+    derivations,
+    ...internal !== void 0 ? { internal } : {}
+  };
+  return snap;
+}
+async function safeListAllCollections(adapter, vault) {
+  try {
+    const snap = await adapter.loadAll(vault);
+    return Object.keys(snap);
+  } catch {
+    return [];
+  }
+}
+async function describeCollection(state, collectionName, sampleSize, withStats) {
+  let fields = {};
+  let validator;
+  const refsRaw = state.refRegistry.getOutbound(collectionName);
+  const refs = {};
+  for (const [name, desc] of Object.entries(refsRaw)) {
+    refs[name] = { target: desc.target, mode: desc.mode };
+  }
+  try {
+    const dek = await state.getDEK(collectionName);
+    const persisted = await loadPersistedSchema(state.adapter, state.name, collectionName, dek);
+    if (persisted) {
+      validator = { kind: persisted.kind, source: "persisted" };
+      if (persisted.jsonSchema) {
+        fields = jsonSchemaToFields(persisted.jsonSchema, "persisted", refsRaw);
+      }
+    }
+  } catch {
+  }
+  const liveColl = state.collectionCache.get(collectionName);
+  if (!validator) {
+    const schema = liveColl?.getSchema();
+    if (schema) {
+      try {
+        const derived = await derivePersistedSchema(schema);
+        validator = { kind: derived.kind, source: "live-validator" };
+        if (derived.jsonSchema) {
+          fields = jsonSchemaToFields(derived.jsonSchema, "live-validator", refsRaw);
+        }
+      } catch {
+      }
+    }
+  }
+  if (Object.keys(fields).length === 0 && sampleSize > 0) {
+  }
+  const collMeta = liveColl?.getMeta();
+  const collConfig = liveColl?.getConfig();
+  const archivePresent = state.hasCollectionArchive?.(collectionName) === true;
+  const schemaUpdateNames = state.getCollectionSchemaUpdateNames?.(collectionName);
+  const hasSchemaUpdate = schemaUpdateNames !== void 0 && schemaUpdateNames.length > 0;
+  let mergedConfig;
+  if (collConfig !== void 0 || archivePresent || hasSchemaUpdate) {
+    mergedConfig = {
+      ...collConfig ?? {},
+      ...archivePresent ? { archive: true } : {},
+      ...hasSchemaUpdate ? { schemaUpdate: schemaUpdateNames } : {}
+    };
+  }
+  const descriptor = {
+    fields,
+    indexes: [],
+    refs,
+    ...validator ? { validator } : {},
+    ...collMeta !== void 0 ? { meta: collMeta } : {},
+    ...mergedConfig !== void 0 ? { config: mergedConfig } : {}
+  };
+  if (withStats) {
+    const stats = await statsForCollection(state.adapter, state.name, collectionName);
+    descriptor.stats = stats;
+  }
+  return descriptor;
+}
+async function statsForCollection(adapter, vault, collection) {
+  const ids = await adapter.list(vault, collection);
+  if (ids.length === 0) {
+    return { records: 0, bytes: 0, bytesAvg: 0, bytesMin: 0, bytesMax: 0, oldest: "", newest: "" };
+  }
+  let total = 0;
+  let min = Number.POSITIVE_INFINITY;
+  let max = 0;
+  let oldest = "\uFFFF";
+  let newest = "";
+  for (const id of ids) {
+    const env = await adapter.get(vault, collection, id);
+    if (!env) continue;
+    const size = env._data.length;
+    total += size;
+    if (size < min) min = size;
+    if (size > max) max = size;
+    if (env._ts < oldest) oldest = env._ts;
+    if (env._ts > newest) newest = env._ts;
+  }
+  return {
+    records: ids.length,
+    bytes: total,
+    bytesAvg: Math.round(total / ids.length),
+    bytesMin: min === Number.POSITIVE_INFINITY ? 0 : min,
+    bytesMax: max,
+    oldest: oldest === "\uFFFF" ? "" : oldest,
+    newest
+  };
+}
+function describeMVs(registry) {
+  if (!registry || typeof registry !== "object") return {};
+  const items = listFromRegistry(registry);
+  const out = {};
+  for (const item of items) {
+    const reg = item;
+    const spec = reg.spec;
+    if (!spec?.name) continue;
+    const sources = spec.unionSources ? spec.unionSources.map((u) => u.collection) : reg.dependencies ? [...reg.dependencies].sort() : [];
+    const groupBy = spec.groupBy ? Array.isArray(spec.groupBy) ? [...spec.groupBy] : [spec.groupBy] : void 0;
+    const aggregate = spec.aggregate ? Object.fromEntries(
+      Object.entries(spec.aggregate).map(([k, v]) => [k, summariseAggregateOp(v)])
+    ) : void 0;
+    out[spec.name] = {
+      sources,
+      ...groupBy ? { groupBy } : {},
+      ...aggregate ? { aggregate } : {},
+      refresh: spec.refresh ?? "eager"
+    };
+  }
+  return out;
+}
+function describeOverlays(registry) {
+  if (!registry || typeof registry !== "object") return {};
+  const specs = listFromRegistry(registry);
+  const out = {};
+  for (const spec of specs) {
+    const s = spec;
+    if (!s.name || !s.base || !s.overlay) continue;
+    out[s.name] = { base: s.base, overlay: s.overlay };
+  }
+  return out;
+}
+function describeDerivations(registry) {
+  if (!registry || typeof registry !== "object") return {};
+  const items = listFromRegistry(registry);
+  const out = {};
+  for (const item of items) {
+    const reg = item;
+    const s = reg.spec ?? reg;
+    if (!s.source) continue;
+    const outputCollections = s.outputs ? Object.values(s.outputs).map((o) => o.collection) : [];
+    const key = outputCollections.length > 0 ? [...outputCollections].sort().join("+") : s.source;
+    out[key] = {
+      source: s.source,
+      outputs: outputCollections
+    };
+  }
+  return out;
+}
+function listFromRegistry(reg) {
+  for (const method of ["all", "list", "specs", "values"]) {
+    const fn = reg[method];
+    if (typeof fn === "function") {
+      try {
+        const out = fn.call(reg);
+        if (Array.isArray(out)) return out;
+        if (out && typeof out.values === "function") {
+          return [...out.values()];
+        }
+      } catch {
+        continue;
+      }
+    }
+  }
+  return [];
+}
+function summariseAggregateOp(value) {
+  if (value && typeof value === "object") {
+    const op = value.op ?? value.kind;
+    const field = value.field;
+    if (op && field) return `${op}(${field})`;
+    if (op) return op;
+  }
+  return String(value);
+}
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-T65TZDN2.js.map

package/dist/walk-T65TZDN2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/introspection/walk.ts"],"sourcesContent":["/**\n * Orchestrate the structural walk of a Vault, producing a\n * {@link VaultSchemaSnapshot}. Called from `Vault.dumpSchema()`.\n *\n * @module\n */\n\nimport { derivePersistedSchema } from '../persisted-schemas/derive.js'\nimport { loadPersistedSchema } from '../persisted-schemas/storage.js'\nimport { jsonSchemaToFields } from './fields.js'\nimport type {\n  CollectionConfig,\n  CollectionDescriptor,\n  CollectionStats,\n  DumpSchemaOptions,\n  FieldDescriptor,\n  InternalCollectionStats,\n  MaterializedViewDescriptor,\n  OverlayViewDescriptor,\n  DerivationDescriptor,\n  VaultSchemaSnapshot,\n} from './types.js'\nimport type { Collection } from '../../kernel/collection.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { RefRegistry } from '../../kernel/refs.js'\nimport type { VaultMeta } from './meta.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\n/**\n * The minimal slice of Vault internal state the walker needs.\n * Exposed via `vault._introspectState()` to keep the public Vault\n * surface narrow.\n *\n * @internal\n */\nexport interface VaultIntrospectState {\n  readonly name: string\n  readonly adapter: NoydbStore\n  readonly collectionCache: Map<string, Collection<unknown>>\n  readonly refRegistry: RefRegistry\n  readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  /** The active unlocked keyring — role/permissions/userId for access-scoped ops. */\n  readonly keyring: UnlockedKeyring\n  readonly subsystems: Record<string, boolean>\n  /** Vault-level descriptive metadata, when set via `openVault({meta})`. */\n  readonly vaultMeta?: VaultMeta\n  // Typed loosely on purpose — these are private service registries\n  // accessed only for \"is anything registered\" enumeration.\n  readonly mvRegistry: unknown\n  readonly overlayRegistry: unknown\n  readonly derivationRegistry: unknown\n  /**\n   * Returns the registered schema-update strategy names for a collection,\n   * or `undefined` when none are registered. Populated from\n   * `vault.#schemaUpdateNames` in `_introspectState()`.\n   */\n  readonly getCollectionSchemaUpdateNames?: (col: string) => readonly string[] | undefined\n  /**\n   * Returns `true` when the collection has an archive policy registered\n   * in `vault.archiveRegistry`, `false` otherwise. Populated from\n   * `vault.archiveRegistry` in `_introspectState()`.\n   */\n  readonly hasCollectionArchive?: (col: string) => boolean\n}\n\nconst INTERNAL_PREFIX = '_'\n\n/** Reserved internal collections always present in any real vault. */\nconst KNOWN_INTERNAL_NAMES = ['_keyring', '_ledger', '_meta', '_schemas', '_deltas']\n\nexport async function dumpVaultSchema(\n  vault: { _introspectState(): VaultIntrospectState },\n  opts: DumpSchemaOptions,\n): Promise<VaultSchemaSnapshot> {\n  const state = vault._introspectState()\n  const sampleSize = opts.sampleSize ?? 50\n  const withStats = opts.withStats === true\n\n  // 1. User-facing collections — alphabetical for diff stability\n  const cacheNames = [...state.collectionCache.keys()]\n  const storageNames = (await safeListAllCollections(state.adapter, state.name))\n    .filter((n) => !n.startsWith(INTERNAL_PREFIX))\n  const allNames = Array.from(new Set([...cacheNames, ...storageNames])).sort()\n\n  const collections: Record<string, CollectionDescriptor> = {}\n  for (const name of allNames) {\n    collections[name] = await describeCollection(state, name, sampleSize, withStats)\n  }\n\n  // 2. Materialized views (placeholder — real walk in MV slice 2 follow-up)\n  const materializedViews = describeMVs(state.mvRegistry)\n  // 3. Overlay views\n  const overlayViews = describeOverlays(state.overlayRegistry)\n  // 4. Derivations\n  const derivations = describeDerivations(state.derivationRegistry)\n\n  // 5. Internal collections — only with stats\n  let internal: Record<string, InternalCollectionStats> | undefined\n  if (withStats) {\n    internal = {}\n    for (const name of KNOWN_INTERNAL_NAMES) {\n      const stats = await statsForCollection(state.adapter, state.name, name)\n      if (stats.records > 0) {\n        internal[name] = { records: stats.records, bytes: stats.bytes }\n      }\n    }\n  }\n\n  const snap: VaultSchemaSnapshot = {\n    _noydb_snapshot: 1,\n    vault: state.name,\n    emittedAt: new Date().toISOString(),\n    subsystems: state.subsystems,\n    ...(state.vaultMeta !== undefined ? { meta: state.vaultMeta } : {}),\n    collections,\n    materializedViews,\n    overlayViews,\n    derivations,\n    ...(internal !== undefined ? { internal } : {}),\n  }\n  return snap\n}\n\nasync function safeListAllCollections(adapter: NoydbStore, vault: string): Promise<string[]> {\n  try {\n    const snap = await adapter.loadAll(vault)\n    return Object.keys(snap)\n  } catch {\n    return []\n  }\n}\n\nasync function describeCollection(\n  state: VaultIntrospectState,\n  collectionName: string,\n  sampleSize: number,\n  withStats: boolean,\n): Promise<CollectionDescriptor> {\n  let fields: Record<string, FieldDescriptor> = {}\n  let validator: CollectionDescriptor['validator']\n\n  const refsRaw = state.refRegistry.getOutbound(collectionName)\n  const refs: CollectionDescriptor['refs'] = {}\n  for (const [name, desc] of Object.entries(refsRaw)) {\n    refs[name] = { target: desc.target, mode: desc.mode }\n  }\n\n  // 1. Try the persisted Route B envelope first.\n  try {\n    const dek = await state.getDEK(collectionName)\n    const persisted = await loadPersistedSchema(state.adapter, state.name, collectionName, dek)\n    if (persisted) {\n      validator = { kind: persisted.kind, source: 'persisted' }\n      if (persisted.jsonSchema) {\n        fields = jsonSchemaToFields(persisted.jsonSchema, 'persisted', refsRaw)\n      }\n    }\n  } catch {\n    // No DEK or decrypt failure — fall through to live-validator\n  }\n\n  const liveColl = state.collectionCache.get(collectionName)\n\n  // 2. Try the live in-process validator (when no persisted envelope).\n  if (!validator) {\n    const schema = liveColl?.getSchema()\n    if (schema) {\n      try {\n        const derived = await derivePersistedSchema(schema)\n        validator = { kind: derived.kind, source: 'live-validator' }\n        if (derived.jsonSchema) {\n          fields = jsonSchemaToFields(derived.jsonSchema, 'live-validator', refsRaw)\n        }\n      } catch {\n        // Derivation failed (e.g. missing peer-dep) — silently leave fields empty\n      }\n    }\n  }\n\n  // 3. Sampling fallback — deferred to a follow-up. For now: empty when no schema.\n  if (Object.keys(fields).length === 0 && sampleSize > 0) {\n    // Sampling path not implemented in baseline slice 2; reserved for follow-up.\n  }\n\n  // Populate collection-level meta and config from the live collection when available.\n  const collMeta = liveColl?.getMeta()\n  const collConfig = liveColl?.getConfig()\n\n  // Thread vault-level config (archive + schemaUpdate) that the Collection cannot see.\n  const archivePresent = state.hasCollectionArchive?.(collectionName) === true\n  const schemaUpdateNames = state.getCollectionSchemaUpdateNames?.(collectionName)\n  const hasSchemaUpdate = schemaUpdateNames !== undefined && schemaUpdateNames.length > 0\n\n  // Merge Collection-level config with vault-level fields. Omit config entirely\n  // when all sources are empty.\n  let mergedConfig: CollectionConfig | undefined\n  if (collConfig !== undefined || archivePresent || hasSchemaUpdate) {\n    mergedConfig = {\n      ...(collConfig ?? {}),\n      ...(archivePresent ? { archive: true as const } : {}),\n      ...(hasSchemaUpdate ? { schemaUpdate: schemaUpdateNames } : {}),\n    }\n  }\n\n  const descriptor: CollectionDescriptor = {\n    fields,\n    indexes: [],\n    refs,\n    ...(validator ? { validator } : {}),\n    ...(collMeta !== undefined ? { meta: collMeta } : {}),\n    ...(mergedConfig !== undefined ? { config: mergedConfig } : {}),\n  }\n  if (withStats) {\n    const stats = await statsForCollection(state.adapter, state.name, collectionName)\n    ;(descriptor as { stats?: CollectionStats }).stats = stats\n  }\n  return descriptor\n}\n\nasync function statsForCollection(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n): Promise<CollectionStats> {\n  const ids = await adapter.list(vault, collection)\n  if (ids.length === 0) {\n    return { records: 0, bytes: 0, bytesAvg: 0, bytesMin: 0, bytesMax: 0, oldest: '', newest: '' }\n  }\n  let total = 0\n  let min = Number.POSITIVE_INFINITY\n  let max = 0\n  let oldest = '￿'\n  let newest = ''\n  for (const id of ids) {\n    const env = await adapter.get(vault, collection, id)\n    if (!env) continue\n    const size = env._data.length\n    total += size\n    if (size < min) min = size\n    if (size > max) max = size\n    if (env._ts < oldest) oldest = env._ts\n    if (env._ts > newest) newest = env._ts\n  }\n  return {\n    records: ids.length,\n    bytes: total,\n    bytesAvg: Math.round(total / ids.length),\n    bytesMin: min === Number.POSITIVE_INFINITY ? 0 : min,\n    bytesMax: max,\n    oldest: oldest === '￿' ? '' : oldest,\n    newest,\n  }\n}\n\nfunction describeMVs(registry: unknown): Record<string, MaterializedViewDescriptor> {\n  if (!registry || typeof registry !== 'object') return {}\n  const items = listFromRegistry(registry as Record<string, unknown>)\n  const out: Record<string, MaterializedViewDescriptor> = {}\n  // Each item is RegisteredMV { spec, dependencies, outputCollection, ... }\n  for (const item of items) {\n    const reg = item as {\n      spec?: {\n        name?: string\n        unionSources?: ReadonlyArray<{ collection: string }>\n        groupBy?: string | ReadonlyArray<string>\n        aggregate?: Record<string, unknown>\n        refresh?: string\n      }\n      dependencies?: ReadonlySet<string>\n    }\n    const spec = reg.spec\n    if (!spec?.name) continue\n    const sources = spec.unionSources\n      ? spec.unionSources.map((u) => u.collection)\n      : (reg.dependencies ? [...reg.dependencies].sort() : [])\n    const groupBy = spec.groupBy\n      ? Array.isArray(spec.groupBy) ? [...spec.groupBy] : [spec.groupBy]\n      : undefined\n    const aggregate = spec.aggregate ? Object.fromEntries(\n      Object.entries(spec.aggregate).map(([k, v]) => [k, summariseAggregateOp(v)]),\n    ) : undefined\n    out[spec.name] = {\n      sources,\n      ...(groupBy ? { groupBy } : {}),\n      ...(aggregate ? { aggregate } : {}),\n      refresh: spec.refresh ?? 'eager',\n    }\n  }\n  return out\n}\n\nfunction describeOverlays(registry: unknown): Record<string, OverlayViewDescriptor> {\n  if (!registry || typeof registry !== 'object') return {}\n  const specs = listFromRegistry(registry as Record<string, unknown>)\n  const out: Record<string, OverlayViewDescriptor> = {}\n  for (const spec of specs) {\n    const s = spec as { name?: string; base?: string; overlay?: string }\n    if (!s.name || !s.base || !s.overlay) continue\n    out[s.name] = { base: s.base, overlay: s.overlay }\n  }\n  return out\n}\n\nfunction describeDerivations(registry: unknown): Record<string, DerivationDescriptor> {\n  if (!registry || typeof registry !== 'object') return {}\n  const items = listFromRegistry(registry as Record<string, unknown>)\n  const out: Record<string, DerivationDescriptor> = {}\n  for (const item of items) {\n    // `all()` on DerivationRegistry returns RegisteredStrategy objects:\n    // { spec: DerivationStrategy, strategyHash }. Read `spec` and fall\n    // back to the item itself for forward-compat with other registries.\n    const reg = item as { spec?: { source?: string; outputs?: Record<string, { collection: string }> }; source?: string; outputs?: Record<string, { collection: string }> }\n    const s = reg.spec ?? reg\n    if (!s.source) continue\n    const outputCollections = s.outputs\n      ? Object.values(s.outputs).map((o) => (o as { collection: string }).collection)\n      : []\n    // Key by sorted output-collection names so co-sourced derivations don't\n    // collide. A single-output derivation keys as just that collection name\n    // (e.g. 'billSummary'); multi-output keys as sorted join (e.g. 'a+b').\n    // Falls back to source when no outputs are declared (defensive).\n    const key = outputCollections.length > 0\n      ? [...outputCollections].sort().join('+')\n      : s.source\n    out[key] = {\n      source: s.source,\n      outputs: outputCollections,\n    }\n  }\n  return out\n}\n\nfunction listFromRegistry(reg: Record<string, unknown>): readonly unknown[] {\n  // Registries expose different accessor methods; try the common ones.\n  for (const method of ['all', 'list', 'specs', 'values']) {\n    const fn = reg[method]\n    if (typeof fn === 'function') {\n      try {\n        const out = (fn as () => unknown).call(reg)\n        if (Array.isArray(out)) return out\n        if (out && typeof (out as { values?: () => unknown }).values === 'function') {\n          return [...(out as { values: () => Iterable<unknown> }).values()]\n        }\n      } catch {\n        continue\n      }\n    }\n  }\n  return []\n}\n\nfunction summariseAggregateOp(value: unknown): string {\n  if (value && typeof value === 'object') {\n    const op = (value as { op?: string; kind?: string; field?: string }).op\n      ?? (value as { kind?: string }).kind\n    const field = (value as { field?: string }).field\n    if (op && field) return `${op}(${field})`\n    if (op) return op\n  }\n  return String(value)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkEA,IAAM,kBAAkB;AAGxB,IAAM,uBAAuB,CAAC,YAAY,WAAW,SAAS,YAAY,SAAS;AAEnF,eAAsB,gBACpB,OACA,MAC8B;AAC9B,QAAM,QAAQ,MAAM,iBAAiB;AACrC,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,YAAY,KAAK,cAAc;AAGrC,QAAM,aAAa,CAAC,GAAG,MAAM,gBAAgB,KAAK,CAAC;AACnD,QAAM,gBAAgB,MAAM,uBAAuB,MAAM,SAAS,MAAM,IAAI,GACzE,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,eAAe,CAAC;AAC/C,QAAM,WAAW,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,YAAY,GAAG,YAAY,CAAC,CAAC,EAAE,KAAK;AAE5E,QAAM,cAAoD,CAAC;AAC3D,aAAW,QAAQ,UAAU;AAC3B,gBAAY,IAAI,IAAI,MAAM,mBAAmB,OAAO,MAAM,YAAY,SAAS;AAAA,EACjF;AAGA,QAAM,oBAAoB,YAAY,MAAM,UAAU;AAEtD,QAAM,eAAe,iBAAiB,MAAM,eAAe;AAE3D,QAAM,cAAc,oBAAoB,MAAM,kBAAkB;AAGhE,MAAI;AACJ,MAAI,WAAW;AACb,eAAW,CAAC;AACZ,eAAW,QAAQ,sBAAsB;AACvC,YAAM,QAAQ,MAAM,mBAAmB,MAAM,SAAS,MAAM,MAAM,IAAI;AACtE,UAAI,MAAM,UAAU,GAAG;AACrB,iBAAS,IAAI,IAAI,EAAE,SAAS,MAAM,SAAS,OAAO,MAAM,MAAM;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAA4B;AAAA,IAChC,iBAAiB;AAAA,IACjB,OAAO,MAAM;AAAA,IACb,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,YAAY,MAAM;AAAA,IAClB,GAAI,MAAM,cAAc,SAAY,EAAE,MAAM,MAAM,UAAU,IAAI,CAAC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,EAC/C;AACA,SAAO;AACT;AAEA,eAAe,uBAAuB,SAAqB,OAAkC;AAC3F,MAAI;AACF,UAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,WAAO,OAAO,KAAK,IAAI;AAAA,EACzB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,mBACb,OACA,gBACA,YACA,WAC+B;AAC/B,MAAI,SAA0C,CAAC;AAC/C,MAAI;AAEJ,QAAM,UAAU,MAAM,YAAY,YAAY,cAAc;AAC5D,QAAM,OAAqC,CAAC;AAC5C,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,SAAK,IAAI,IAAI,EAAE,QAAQ,KAAK,QAAQ,MAAM,KAAK,KAAK;AAAA,EACtD;AAGA,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,OAAO,cAAc;AAC7C,UAAM,YAAY,MAAM,oBAAoB,MAAM,SAAS,MAAM,MAAM,gBAAgB,GAAG;AAC1F,QAAI,WAAW;AACb,kBAAY,EAAE,MAAM,UAAU,MAAM,QAAQ,YAAY;AACxD,UAAI,UAAU,YAAY;AACxB,iBAAS,mBAAmB,UAAU,YAAY,aAAa,OAAO;AAAA,MACxE;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,WAAW,MAAM,gBAAgB,IAAI,cAAc;AAGzD,MAAI,CAAC,WAAW;AACd,UAAM,SAAS,UAAU,UAAU;AACnC,QAAI,QAAQ;AACV,UAAI;AACF,cAAM,UAAU,MAAM,sBAAsB,MAAM;AAClD,oBAAY,EAAE,MAAM,QAAQ,MAAM,QAAQ,iBAAiB;AAC3D,YAAI,QAAQ,YAAY;AACtB,mBAAS,mBAAmB,QAAQ,YAAY,kBAAkB,OAAO;AAAA,QAC3E;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAGA,MAAI,OAAO,KAAK,MAAM,EAAE,WAAW,KAAK,aAAa,GAAG;AAAA,EAExD;AAGA,QAAM,WAAW,UAAU,QAAQ;AACnC,QAAM,aAAa,UAAU,UAAU;AAGvC,QAAM,iBAAiB,MAAM,uBAAuB,cAAc,MAAM;AACxE,QAAM,oBAAoB,MAAM,iCAAiC,cAAc;AAC/E,QAAM,kBAAkB,sBAAsB,UAAa,kBAAkB,SAAS;AAItF,MAAI;AACJ,MAAI,eAAe,UAAa,kBAAkB,iBAAiB;AACjE,mBAAe;AAAA,MACb,GAAI,cAAc,CAAC;AAAA,MACnB,GAAI,iBAAiB,EAAE,SAAS,KAAc,IAAI,CAAC;AAAA,MACnD,GAAI,kBAAkB,EAAE,cAAc,kBAAkB,IAAI,CAAC;AAAA,IAC/D;AAAA,EACF;AAEA,QAAM,aAAmC;AAAA,IACvC;AAAA,IACA,SAAS,CAAC;AAAA,IACV;AAAA,IACA,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACjC,GAAI,aAAa,SAAY,EAAE,MAAM,SAAS,IAAI,CAAC;AAAA,IACnD,GAAI,iBAAiB,SAAY,EAAE,QAAQ,aAAa,IAAI,CAAC;AAAA,EAC/D;AACA,MAAI,WAAW;AACb,UAAM,QAAQ,MAAM,mBAAmB,MAAM,SAAS,MAAM,MAAM,cAAc;AAC/E,IAAC,WAA2C,QAAQ;AAAA,EACvD;AACA,SAAO;AACT;AAEA,eAAe,mBACb,SACA,OACA,YAC0B;AAC1B,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,UAAU;AAChD,MAAI,IAAI,WAAW,GAAG;AACpB,WAAO,EAAE,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,IAAI,QAAQ,GAAG;AAAA,EAC/F;AACA,MAAI,QAAQ;AACZ,MAAI,MAAM,OAAO;AACjB,MAAI,MAAM;AACV,MAAI,SAAS;AACb,MAAI,SAAS;AACb,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,YAAY,EAAE;AACnD,QAAI,CAAC,IAAK;AACV,UAAM,OAAO,IAAI,MAAM;AACvB,aAAS;AACT,QAAI,OAAO,IAAK,OAAM;AACtB,QAAI,OAAO,IAAK,OAAM;AACtB,QAAI,IAAI,MAAM,OAAQ,UAAS,IAAI;AACnC,QAAI,IAAI,MAAM,OAAQ,UAAS,IAAI;AAAA,EACrC;AACA,SAAO;AAAA,IACL,SAAS,IAAI;AAAA,IACb,OAAO;AAAA,IACP,UAAU,KAAK,MAAM,QAAQ,IAAI,MAAM;AAAA,IACvC,UAAU,QAAQ,OAAO,oBAAoB,IAAI;AAAA,IACjD,UAAU;AAAA,IACV,QAAQ,WAAW,WAAM,KAAK;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,SAAS,YAAY,UAA+D;AAClF,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO,CAAC;AACvD,QAAM,QAAQ,iBAAiB,QAAmC;AAClE,QAAM,MAAkD,CAAC;AAEzD,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM;AAUZ,UAAM,OAAO,IAAI;AACjB,QAAI,CAAC,MAAM,KAAM;AACjB,UAAM,UAAU,KAAK,eACjB,KAAK,aAAa,IAAI,CAAC,MAAM,EAAE,UAAU,IACxC,IAAI,eAAe,CAAC,GAAG,IAAI,YAAY,EAAE,KAAK,IAAI,CAAC;AACxD,UAAM,UAAU,KAAK,UACjB,MAAM,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,IAC/D;AACJ,UAAM,YAAY,KAAK,YAAY,OAAO;AAAA,MACxC,OAAO,QAAQ,KAAK,SAAS,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC;AAAA,IAC7E,IAAI;AACJ,QAAI,KAAK,IAAI,IAAI;AAAA,MACf;AAAA,MACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7B,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACjC,SAAS,KAAK,WAAW;AAAA,IAC3B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,UAA0D;AAClF,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO,CAAC;AACvD,QAAM,QAAQ,iBAAiB,QAAmC;AAClE,QAAM,MAA6C,CAAC;AACpD,aAAW,QAAQ,OAAO;AACxB,UAAM,IAAI;AACV,QAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,EAAE,QAAS;AACtC,QAAI,EAAE,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,QAAQ;AAAA,EACnD;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,UAAyD;AACpF,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO,CAAC;AACvD,QAAM,QAAQ,iBAAiB,QAAmC;AAClE,QAAM,MAA4C,CAAC;AACnD,aAAW,QAAQ,OAAO;AAIxB,UAAM,MAAM;AACZ,UAAM,IAAI,IAAI,QAAQ;AACtB,QAAI,CAAC,EAAE,OAAQ;AACf,UAAM,oBAAoB,EAAE,UACxB,OAAO,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,MAAO,EAA6B,UAAU,IAC5E,CAAC;AAKL,UAAM,MAAM,kBAAkB,SAAS,IACnC,CAAC,GAAG,iBAAiB,EAAE,KAAK,EAAE,KAAK,GAAG,IACtC,EAAE;AACN,QAAI,GAAG,IAAI;AAAA,MACT,QAAQ,EAAE;AAAA,MACV,SAAS;AAAA,IACX;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,KAAkD;AAE1E,aAAW,UAAU,CAAC,OAAO,QAAQ,SAAS,QAAQ,GAAG;AACvD,UAAM,KAAK,IAAI,MAAM;AACrB,QAAI,OAAO,OAAO,YAAY;AAC5B,UAAI;AACF,cAAM,MAAO,GAAqB,KAAK,GAAG;AAC1C,YAAI,MAAM,QAAQ,GAAG,EAAG,QAAO;AAC/B,YAAI,OAAO,OAAQ,IAAmC,WAAW,YAAY;AAC3E,iBAAO,CAAC,GAAI,IAA4C,OAAO,CAAC;AAAA,QAClE;AAAA,MACF,QAAQ;AACN;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEA,SAAS,qBAAqB,OAAwB;AACpD,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,KAAM,MAAyD,MAC/D,MAA4B;AAClC,UAAM,QAAS,MAA6B;AAC5C,QAAI,MAAM,MAAO,QAAO,GAAG,EAAE,IAAI,KAAK;AACtC,QAAI,GAAI,QAAO;AAAA,EACjB;AACA,SAAO,OAAO,KAAK;AACrB;","names":[]}

package/dist/with/index.d.ts

@@ -1,8 +1,8 @@
 export { U as Unsubscribe, W as WriteEvent, a as WriteHook, b as WriteHookRegistry } from '../index-B9QdHytu.js';
-import { cF as UnlockedKeyring, cG as ExportFormat } from '../index-D05bV0_g.js';
-export { cH as BusHandler, cI as GateDeleteEvent, cJ as GateEventMap, cK as GateHandler, cL as GatePoint, cM as GatePutEvent, cN as LifecycleEventMap, cO as LifecyclePoint, cP as ServiceBus, cQ as SubsystemBus } from '../index-D05bV0_g.js';
+import { cF as UnlockedKeyring, cG as ExportFormat } from '../index-D4GQe1Rx.js';
+export { cH as BusHandler, cI as GateDeleteEvent, cJ as GateEventMap, cK as GateHandler, cL as GatePoint, cM as GatePutEvent, cN as LifecycleEventMap, cO as LifecyclePoint, cP as ServiceBus, cQ as SubsystemBus } from '../index-D4GQe1Rx.js';
 import '../subject-index-O75wKshW.js';
-import '../describe-0tiXAjoO.js';
+import '../describe-C6iHNlqJ.js';
 import '@noy-db/attestation';
 
 /**

package/dist/with/index.js

@@ -6,15 +6,18 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "../chunk-YN66UOXT.js";
-import "../chunk-5A6TC3RQ.js";
-import "../chunk-2N4MUSF3.js";
-import "../chunk-5EZAJEES.js";
-import "../chunk-6RASM2J4.js";
-import "../chunk-CPAROOKP.js";
-import "../chunk-L4IRFTIF.js";
-import "../chunk-OCDUQUAP.js";
-import "../chunk-BLZRNHMG.js";
+} from "../chunk-7SY3PTED.js";
+import "../chunk-ZT4GWVTX.js";
+import "../chunk-TB5RNNJ4.js";
+import "../chunk-OVO2RZAE.js";
+import "../chunk-QKVILR7N.js";
+import "../chunk-LN22XH4B.js";
+import "../chunk-PGFY7IRW.js";
+import "../chunk-TCIUO62Z.js";
+import "../chunk-UOEWDCUX.js";
+import "../chunk-LP7BEXCT.js";
+import "../chunk-TLJOJBZD.js";
+import "../chunk-U23JUUPX.js";
 import "../chunk-PZ5AY32C.js";
 export {
   ServiceBus,

package/dist/{with-materialized-view-NKxs6iK5.d.ts → with-materialized-view-Bp65kKdQ.d.ts}

@@ -1,4 +1,4 @@
-import { cf as MaterializedViewStrategy, cg as MaterializedViewStrategyHandle } from './index-D05bV0_g.js';
+import { cf as MaterializedViewStrategy, cg as MaterializedViewStrategyHandle } from './index-D4GQe1Rx.js';
 
 /**
  * Register a materialized view: a declared query whose result is

package/dist/{with-overlayed-view-B4fPYHwV.d.ts → with-overlayed-view-BRhdQNrK.d.ts}

@@ -1,4 +1,4 @@
-import { ch as OverlayedViewStrategy, cq as OverlayedViewStrategyHandle } from './index-D05bV0_g.js';
+import { ch as OverlayedViewStrategy, cq as OverlayedViewStrategyHandle } from './index-D4GQe1Rx.js';
 
 /**
  * Register a read-shadow overlay: bind an MV-owned base collection to

package/dist/{with-rollup-Bl0sRFEt.d.ts → with-rollup-bQRPc3y1.d.ts}

@@ -1,4 +1,4 @@
-import { c2 as DerivationStrategy, cb as DerivationStrategyHandle } from './index-D05bV0_g.js';
+import { c2 as DerivationStrategy, cb as DerivationStrategyHandle } from './index-D4GQe1Rx.js';
 
 /**
  * Register a deterministic derivation: one source collection → one or

package/dist/withdraw-accessible-JMX2TCPX.js

@@ -0,0 +1,28 @@
+import {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+} from "./chunk-TYGW5TOR.js";
+import "./chunk-P2LDXRGP.js";
+import "./chunk-EWR7HL3K.js";
+import "./chunk-3QRQOBS7.js";
+import "./chunk-OVO2RZAE.js";
+import "./chunk-QKVILR7N.js";
+import "./chunk-LN22XH4B.js";
+import "./chunk-PGFY7IRW.js";
+import "./chunk-TCIUO62Z.js";
+import "./chunk-UOEWDCUX.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-TLJOJBZD.js";
+import "./chunk-U23JUUPX.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  FROZEN_SNAPSHOTS_COLLECTION,
+  freezeAndDeleteClosure,
+  freezeSnapshotOnly,
+  randomId,
+  withdrawAccessibleData
+};
+//# sourceMappingURL=withdraw-accessible-JMX2TCPX.js.map

package/dist/withdraw-accessible-JMX2TCPX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/hub",
-  "version": "0.3.0-pre.3",
+  "version": "0.3.0-pre.5",
   "description": "Zero-knowledge, offline-first, encrypted document store — core library with AES-256-GCM, PBKDF2, multi-user keyring, and sync engine",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -56,6 +56,10 @@
       "types": "./dist/indexing/index.d.ts",
       "default": "./dist/indexing/index.js"
     },
+    "./lazy": {
+      "types": "./dist/lazy/index.d.ts",
+      "default": "./dist/lazy/index.js"
+    },
     "./aggregate": {
       "types": "./dist/aggregate/index.d.ts",
       "default": "./dist/aggregate/index.js"
@@ -192,14 +196,14 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@noy-db/attestation": "0.3.0-pre.3"
+    "@noy-db/attestation": "0.3.0-pre.5"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "esbuild": "^0.25.0",
     "zod": "^4.0.0",
     "zod-to-json-schema": "^3.25.2",
-    "@noy-db/on-shamir": "0.3.0-pre.3"
+    "@noy-db/on-shamir": "0.3.0-pre.5"
   },
   "peerDependencies": {
     "zod-to-json-schema": "^3.25.0"

package/dist/api-LORZ2EZU.js

@@ -1,17 +0,0 @@
-import {
-  UserApi,
-  createUserApi
-} from "./chunk-MCJAUQGE.js";
-import "./chunk-2N4MUSF3.js";
-import "./chunk-5EZAJEES.js";
-import "./chunk-6RASM2J4.js";
-import "./chunk-CPAROOKP.js";
-import "./chunk-L4IRFTIF.js";
-import "./chunk-OCDUQUAP.js";
-import "./chunk-BLZRNHMG.js";
-import "./chunk-PZ5AY32C.js";
-export {
-  UserApi,
-  createUserApi
-};
-//# sourceMappingURL=api-LORZ2EZU.js.map

package/dist/chunk-4DZGZ7II.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-audit/tiers/active.ts","../src/with-audit/tiers/strategy.ts","../src/with-audit/tiers/index.ts"],"sourcesContent":["/**\n * Enable the hierarchical-tiers capability.\n * Pass to `createNoydb({ tiersStrategy: withTiers() })` to make a collection's\n * `putAtTier` / `getAtTier` / `listAtTier` / `elevate` / `demote` methods live.\n * The tier read/write/re-key engine is dynamically imported here, so it stays\n * out of the floor bundle until opted in.\n */\nimport type { TiersStrategy } from './strategy.js'\n\nexport function withTiers(): TiersStrategy {\n  return {\n    async putAtTier(ctx, id, record, tier, opts) {\n      const { putAtTier } = await import('./index.js')\n      return putAtTier(ctx, id, record, tier, opts)\n    },\n    async getAtTier(ctx, id) {\n      const { getAtTier } = await import('./index.js')\n      return getAtTier(ctx, id)\n    },\n    async listAtTier(ctx) {\n      const { listAtTier } = await import('./index.js')\n      return listAtTier(ctx)\n    },\n    async elevate(ctx, id, toTier) {\n      const { elevate } = await import('./index.js')\n      return elevate(ctx, id, toTier)\n    },\n    async demote(ctx, id, toTier) {\n      const { demote } = await import('./index.js')\n      return demote(ctx, id, toTier)\n    },\n  }\n}\n","/**\n * Tiers capability strategy — the five on-demand collection-level tier\n * operations the `Collection` routes through. The active engine\n * ({@link withTiers}) dynamically imports the tier cores (keeping them out of\n * the floor bundle); {@link NO_TIERS} throws. Collection always builds its\n * per-call {@link TiersContext} and delegates here, so an un-opted-in caller\n * hits `NO_TIERS`'s throw.\n * @internal\n */\nimport type { GhostRecord } from '../../kernel/types.js'\nimport type { TiersContext } from './index.js'\nimport { TiersNotEnabledError } from '../../kernel/errors.js'\n\nexport interface TiersStrategy {\n  putAtTier<T>(\n    ctx: TiersContext<T>,\n    id: string,\n    record: T,\n    tier: number,\n    opts?: { elevation?: { reason: string; fromTier: number }; source?: string; sourceTs?: string },\n  ): Promise<void>\n  getAtTier<T>(ctx: TiersContext<T>, id: string): Promise<T | GhostRecord | null>\n  listAtTier<T>(ctx: TiersContext<T>): Promise<Array<{ id: string; tier: number; readable: boolean }>>\n  elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void>\n  demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void>\n}\n\n/**\n * No-op stub — the floor default. Every capability method throws\n * {@link TiersNotEnabledError}; opt in with `tiersStrategy: withTiers()` in\n * createNoydb. @internal\n */\nexport const NO_TIERS: TiersStrategy = {\n  async putAtTier() { throw new TiersNotEnabledError() },\n  async getAtTier() { throw new TiersNotEnabledError() },\n  async listAtTier() { throw new TiersNotEnabledError() },\n  async elevate() { throw new TiersNotEnabledError() },\n  async demote() { throw new TiersNotEnabledError() },\n}\n","/**\n * Hierarchical access — the collection-level tier operations\n * (`putAtTier` / `getAtTier` / `listAtTier` / `elevate` / `demote`).\n *\n * A collection opted into `{ tiers: [...] }` stamps `_tier: N` on each envelope\n * and encrypts its body under the tier-N DEK. These helpers are the read/write\n * surface for that scheme: write at a tier, read with tier-aware visibility\n * (invisibility vs. ghost), and move a record up (`elevate`) or down (`demote`)\n * the tier ladder by re-wrapping its body key.\n *\n * Each function takes a small {@link TiersContext} (the exact `this.*` the\n * moving methods touched) instead of `this`, mirroring the `record-keys/`\n * siblings. Behaviour is byte-identical to the inline code it replaced.\n *\n * The crux is `cekCache`: `elevate`/`demote`/`getAtTier` write the SAME `Lru`\n * reference `Collection` owns (never a copy) so a per-record CEK re-wrap stays\n * synchronous with the cache the kernel's write/read path also mutates. The\n * cross-tier event sink stays collection-resident and is reached via the\n * `emitCrossTierEvent` callback.\n *\n * Internal service — not exported as a `@noy-db/hub/*` subpath.\n */\nexport { withTiers } from './active.js'\nexport { NO_TIERS, type TiersStrategy } from './strategy.js'\nexport { TiersNotEnabledError } from '../../kernel/errors.js'\nimport { encrypt, decrypt, unwrapCek, rewrapBodyToDek, type RecordCodec, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { TierDemoteDeniedError } from '../../kernel/errors.js'\nimport { dekKey, assertTierAccess } from '../../with-party/team/tiers.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { Lru } from '../../kernel/cache/index.js'\nimport {\n  NOYDB_FORMAT_VERSION,\n  type NoydbStore,\n  type EncryptedEnvelope,\n  type GhostRecord,\n  type TierMode,\n  type CrossTierAccessEvent,\n} from '../../kernel/types.js'\n\n/** Everything the moving tier methods touched on `this.*`, as a flat context. */\nexport interface TiersContext<T> {\n  /** Collection name — the crypto AAD scope and tier-DEK key prefix. */\n  readonly name: string\n  /** Vault namespace the records live under. */\n  readonly vault: string\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** The caller's unlocked keyring (tier-DEK holdings + role + userId). */\n  readonly keyring: UnlockedKeyring\n  /** The record codec — decrypts a tier-0 envelope to T. */\n  readonly codec: RecordCodec<T>\n  /**\n   * The collection's per-record CEK cache (SHARED reference, not a copy).\n   * `elevate`/`demote`/`getAtTier` re-wrap a record's CEK and `set` it here so\n   * the move stays synchronous with the cache the kernel's read/write path\n   * owns. `null` → no caching.\n   */\n  readonly cekCache: Lru<string, EnclaveKey> | null\n  /** Emit `_source`/`_sourceTs` provenance fields when a source is supplied. */\n  readonly provenance: boolean\n  /** Declared tiers, or null when the feature is off. */\n  readonly tiers: ReadonlySet<number> | null\n  /** Above-tier read visibility mode (`'invisibility'` | `'ghost'`). */\n  readonly tierMode: TierMode\n  /** Resolve a tier DEK by its `dekKey(name, tier)`. */\n  getDEK(key: string): Promise<EnclaveKey>\n  /** Fire a cross-tier access event (sink stays collection-resident). */\n  emitCrossTierEvent(event: CrossTierAccessEvent): void\n}\n\nexport function assertTiersEnabled<T>(ctx: TiersContext<T>): void {\n  if (!ctx.tiers) {\n    throw new Error(\n      `Collection \"${ctx.name}\": hierarchical tiers are not enabled. ` +\n      `Pass { tiers: [0, 1, 2, …] } to vault.collection() to opt in.`,\n    )\n  }\n}\n\nexport function assertDeclaredTier<T>(ctx: TiersContext<T>, tier: number): void {\n  if (tier < 0 || !Number.isInteger(tier)) {\n    throw new Error(`Collection \"${ctx.name}\": tier must be a non-negative integer, got ${tier}`)\n  }\n  if (tier === 0) return\n  if (!ctx.tiers || !ctx.tiers.has(tier)) {\n    throw new Error(\n      `Collection \"${ctx.name}\": tier ${tier} is not declared in { tiers: [...] }`,\n    )\n  }\n}\n\nfunction isElevatorOrOwner<T>(ctx: TiersContext<T>): boolean {\n  return ctx.keyring.role === 'owner' || ctx.keyring.role === 'admin'\n}\n\n/**\n * tier-aware put. Encrypts the record with the collection's tier-N DEK and\n * stamps `_tier: N` on the envelope. The caller's keyring must hold the tier-N\n * DEK (directly, by delegation, or by virtue of being the grantor); otherwise\n * throws `TierNotGrantedError`.\n *\n * accepts an optional `elevation` context. When present, the emitted cross-tier\n * event is stamped with `authorization: 'elevation'`, the elevation's reason,\n * and the caller's pre-elevation tier. `vault.elevate(...).collection().put`\n * threads this through; direct `putAtTier` calls leave it undefined and fall\n * back to the inherent-write event shape.\n */\nexport async function putAtTier<T>(\n  ctx: TiersContext<T>,\n  id: string,\n  record: T,\n  tier: number,\n  opts?: { elevation?: { reason: string; fromTier: number }; source?: string; sourceTs?: string },\n): Promise<void> {\n  assertTiersEnabled(ctx)\n  assertDeclaredTier(ctx, tier)\n  assertTierAccess(ctx.keyring, ctx.name, tier)\n\n  const key = dekKey(ctx.name, tier)\n  const dek = await ctx.getDEK(key)\n\n  const existing = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  const version = existing ? existing._v + 1 : 1\n  const json = JSON.stringify(record)\n  const { iv, data } = await encrypt(json, dek)\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: version,\n    _ts: new Date().toISOString(),\n    _iv: iv,\n    _data: data,\n    _by: ctx.keyring.userId,\n    ...(tier > 0 && { _tier: tier }),\n    ...(ctx.provenance && opts?.source !== undefined ? { _source: opts.source, _sourceTs: opts.sourceTs ?? new Date().toISOString() } : {}),\n  }\n\n  await ctx.adapter.put(ctx.vault, ctx.name, id, envelope)\n\n  if (tier > 0) {\n    ctx.emitCrossTierEvent({\n      actor: ctx.keyring.userId,\n      collection: ctx.name,\n      id,\n      tier,\n      authorization: opts?.elevation ? 'elevation' : 'inherent',\n      op: 'put',\n      ts: envelope._ts,\n      ...(opts?.elevation && {\n        reason: opts.elevation.reason,\n        elevatedFrom: opts.elevation.fromTier,\n      }),\n    })\n  }\n}\n\n/**\n * tier-aware get. When the stored record is at a tier the caller cannot\n * decrypt:\n *   - `'invisibility'` mode (default) → returns `null`.\n *   - `'ghost'` mode → returns a `GhostRecord` placeholder with the tier and\n *     the record id (the record exists but contents are withheld).\n *\n * Fully-cleared reads return the plaintext record and fire a cross-tier event\n * when `_tier > 0`.\n */\nexport async function getAtTier<T>(ctx: TiersContext<T>, id: string): Promise<T | GhostRecord | null> {\n  assertTiersEnabled(ctx)\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope) return null\n  const tier = envelope._tier ?? 0\n  if (tier === 0) {\n    return ctx.codec.decryptRecord(envelope)\n  }\n\n  const key = dekKey(ctx.name, tier)\n  if (!ctx.keyring.deks.has(key)) {\n    if (ctx.tierMode === 'ghost') {\n      return { _ghost: true, _tier: tier } as GhostRecord\n    }\n    return null\n  }\n\n  const dek = await ctx.getDEK(key)\n  // A tiered record may carry a per-record CEK (e.g. a CEK record\n  // elevated via `elevate()`): the CEK is wrapped under the TIER DEK, so\n  // unwrap under the tier DEK then decrypt the body under the CEK. Legacy\n  // tiered records decrypt directly under the tier DEK.\n  let plaintext: string\n  if (envelope._cek !== undefined) {\n    const cek = await unwrapCek(envelope._cek, dek)\n    ctx.cekCache?.set(id, cek, 1)\n    plaintext = await decrypt(envelope._iv, envelope._data, cek)\n  } else {\n    plaintext = await decrypt(envelope._iv, envelope._data, dek)\n  }\n  const record = JSON.parse(plaintext) as T\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier,\n    authorization: isElevatorOrOwner(ctx) ? 'inherent' : 'delegation',\n    op: 'get',\n    ts: new Date().toISOString(),\n  })\n\n  return record\n}\n\n/**\n * list ids grouped by the caller's readability. Returns only ids whose tier the\n * caller can read. Above-tier ids are omitted in `'invisibility'` mode and\n * included (with tier metadata) in `'ghost'` mode.\n */\nexport async function listAtTier<T>(ctx: TiersContext<T>): Promise<Array<{ id: string; tier: number; readable: boolean }>> {\n  assertTiersEnabled(ctx)\n  const ids = await ctx.adapter.list(ctx.vault, ctx.name)\n  const out: Array<{ id: string; tier: number; readable: boolean }> = []\n  for (const id of ids) {\n    const env = await ctx.adapter.get(ctx.vault, ctx.name, id)\n    if (!env) continue\n    const tier = env._tier ?? 0\n    const readable = tier === 0 || ctx.keyring.deks.has(dekKey(ctx.name, tier))\n    if (!readable && ctx.tierMode === 'invisibility') continue\n    out.push({ id, tier, readable })\n  }\n  return out\n}\n\n/**\n * elevate a record to a higher tier. Re-encrypts with the target tier's DEK.\n * The caller must hold DEKs for both the current tier (to decrypt) and the\n * target tier (to re-encrypt). Stamps `_elevatedBy` with the caller id so\n * `demote()` can check the reverse operation.\n */\nexport async function elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void> {\n  assertTiersEnabled(ctx)\n  assertDeclaredTier(ctx, toTier)\n  assertTierAccess(ctx.keyring, ctx.name, toTier)\n\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope) throw new Error(`Record \"${id}\" not found in collection \"${ctx.name}\"`)\n  const fromTier = envelope._tier ?? 0\n  if (toTier === fromTier) return\n  if (toTier < fromTier) {\n    throw new Error(`Use demote() to lower the tier of \"${id}\" from ${fromTier} to ${toTier}`)\n  }\n  // Caller must have access at the existing tier to decrypt.\n  if (fromTier > 0) assertTierAccess(ctx.keyring, ctx.name, fromTier)\n\n  const fromKey = dekKey(ctx.name, fromTier)\n  const toKey = dekKey(ctx.name, toTier)\n  const fromDek = await ctx.getDEK(fromKey)\n  const toDek = await ctx.getDEK(toKey)\n\n  // Per-record CEK composes with tiers: the body key is unchanged (history\n  // chain identity preserved); only the wrapping key moves with the tier.\n  // Legacy (no `_cek`) records take the direct-DEK path unchanged.\n  const now = new Date().toISOString()\n  const body = await rewrapBodyToDek(envelope, fromDek, toDek)\n  if (body.cek) ctx.cekCache?.set(id, body.cek, 1)\n  const next: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: envelope._v + 1,\n    _ts: now,\n    _iv: body._iv,\n    _data: body._data,\n    _by: ctx.keyring.userId,\n    _tier: toTier,\n    _elevatedBy: ctx.keyring.userId,\n    ...(body._cek !== undefined ? { _cek: body._cek } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, ctx.name, id, next)\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier: toTier,\n    authorization: 'elevation',\n    op: 'elevate',\n    ts: now,\n  })\n}\n\n/**\n * demote a record to a lower tier. Allowed only for the user who performed the\n * last elevation or an owner.\n */\nexport async function demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<void> {\n  assertTiersEnabled(ctx)\n  if (toTier < 0) throw new Error(`Cannot demote to negative tier ${toTier}`)\n\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope) throw new Error(`Record \"${id}\" not found in collection \"${ctx.name}\"`)\n  const fromTier = envelope._tier ?? 0\n  if (toTier === fromTier) return\n  if (toTier > fromTier) {\n    throw new Error(`Use elevate() to raise the tier of \"${id}\" from ${fromTier} to ${toTier}`)\n  }\n  const isOwner = ctx.keyring.role === 'owner'\n  const isOriginalElevator = envelope._elevatedBy === ctx.keyring.userId\n  if (!isOwner && !isOriginalElevator) {\n    throw new TierDemoteDeniedError(id, fromTier)\n  }\n  // Caller must still hold the DEK of the current tier to decrypt.\n  assertTierAccess(ctx.keyring, ctx.name, fromTier)\n  if (toTier > 0) assertDeclaredTier(ctx, toTier)\n\n  const fromDek = await ctx.getDEK(dekKey(ctx.name, fromTier))\n  const toDek = await ctx.getDEK(dekKey(ctx.name, toTier))\n\n  // CEK re-wrap on demote — same body key, moved from the source tier\n  // DEK to the target tier DEK. Legacy records take the direct-DEK path.\n  const now = new Date().toISOString()\n  const body = await rewrapBodyToDek(envelope, fromDek, toDek)\n  if (body.cek) ctx.cekCache?.set(id, body.cek, 1)\n  const next: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: envelope._v + 1,\n    _ts: now,\n    _iv: body._iv,\n    _data: body._data,\n    _by: ctx.keyring.userId,\n    ...(toTier > 0 && { _tier: toTier }),\n    ...(body._cek !== undefined ? { _cek: body._cek } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, ctx.name, id, next)\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier: fromTier,\n    authorization: 'elevation',\n    op: 'demote',\n    ts: now,\n  })\n}\n\n/**\n * Classify a live envelope's `_sealed` slots for crypto-shred completeness\n * (#M-1). Thin delegate to {@link RecordCodec.classifySealedShred}; surfaced\n * here because `vault.ts` forget() reaches in via `collection._classifySealedShred`.\n */\nexport function classifySealedShred<T>(\n  ctx: TiersContext<T>,\n  live: EncryptedEnvelope,\n): Promise<{ shreddable: string[]; dekResidue: string[] }> {\n  return ctx.codec.classifySealedShred(live)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AASO,SAAS,YAA2B;AACzC,SAAO;AAAA,IACL,MAAM,UAAU,KAAK,IAAI,QAAQ,MAAM,MAAM;AAC3C,YAAM,EAAE,WAAAA,WAAU,IAAI,MAAM,OAAO,kBAAY;AAC/C,aAAOA,WAAU,KAAK,IAAI,QAAQ,MAAM,IAAI;AAAA,IAC9C;AAAA,IACA,MAAM,UAAU,KAAK,IAAI;AACvB,YAAM,EAAE,WAAAC,WAAU,IAAI,MAAM,OAAO,kBAAY;AAC/C,aAAOA,WAAU,KAAK,EAAE;AAAA,IAC1B;AAAA,IACA,MAAM,WAAW,KAAK;AACpB,YAAM,EAAE,YAAAC,YAAW,IAAI,MAAM,OAAO,kBAAY;AAChD,aAAOA,YAAW,GAAG;AAAA,IACvB;AAAA,IACA,MAAM,QAAQ,KAAK,IAAI,QAAQ;AAC7B,YAAM,EAAE,SAAAC,SAAQ,IAAI,MAAM,OAAO,kBAAY;AAC7C,aAAOA,SAAQ,KAAK,IAAI,MAAM;AAAA,IAChC;AAAA,IACA,MAAM,OAAO,KAAK,IAAI,QAAQ;AAC5B,YAAM,EAAE,QAAAC,QAAO,IAAI,MAAM,OAAO,kBAAY;AAC5C,aAAOA,QAAO,KAAK,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACF;;;ACAO,IAAM,WAA0B;AAAA,EACrC,MAAM,YAAY;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACrD,MAAM,YAAY;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACrD,MAAM,aAAa;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACtD,MAAM,UAAU;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACnD,MAAM,SAAS;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AACpD;;;ACgCO,SAAS,mBAAsB,KAA4B;AAChE,MAAI,CAAC,IAAI,OAAO;AACd,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI;AAAA,IAEzB;AAAA,EACF;AACF;AAEO,SAAS,mBAAsB,KAAsB,MAAoB;AAC9E,MAAI,OAAO,KAAK,CAAC,OAAO,UAAU,IAAI,GAAG;AACvC,UAAM,IAAI,MAAM,eAAe,IAAI,IAAI,+CAA+C,IAAI,EAAE;AAAA,EAC9F;AACA,MAAI,SAAS,EAAG;AAChB,MAAI,CAAC,IAAI,SAAS,CAAC,IAAI,MAAM,IAAI,IAAI,GAAG;AACtC,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI,WAAW,IAAI;AAAA,IACxC;AAAA,EACF;AACF;AAEA,SAAS,kBAAqB,KAA+B;AAC3D,SAAO,IAAI,QAAQ,SAAS,WAAW,IAAI,QAAQ,SAAS;AAC9D;AAcA,eAAsB,UACpB,KACA,IACA,QACA,MACA,MACe;AACf,qBAAmB,GAAG;AACtB,qBAAmB,KAAK,IAAI;AAC5B,mBAAiB,IAAI,SAAS,IAAI,MAAM,IAAI;AAE5C,QAAM,MAAM,OAAO,IAAI,MAAM,IAAI;AACjC,QAAM,MAAM,MAAM,IAAI,OAAO,GAAG;AAEhC,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,QAAM,UAAU,WAAW,SAAS,KAAK,IAAI;AAC7C,QAAM,OAAO,KAAK,UAAU,MAAM;AAClC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,KAAK,IAAI,QAAQ;AAAA,IACjB,GAAI,OAAO,KAAK,EAAE,OAAO,KAAK;AAAA,IAC9B,GAAI,IAAI,cAAc,MAAM,WAAW,SAAY,EAAE,SAAS,KAAK,QAAQ,WAAW,KAAK,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE,IAAI,CAAC;AAAA,EACvI;AAEA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,QAAQ;AAEvD,MAAI,OAAO,GAAG;AACZ,QAAI,mBAAmB;AAAA,MACrB,OAAO,IAAI,QAAQ;AAAA,MACnB,YAAY,IAAI;AAAA,MAChB;AAAA,MACA;AAAA,MACA,eAAe,MAAM,YAAY,cAAc;AAAA,MAC/C,IAAI;AAAA,MACJ,IAAI,SAAS;AAAA,MACb,GAAI,MAAM,aAAa;AAAA,QACrB,QAAQ,KAAK,UAAU;AAAA,QACvB,cAAc,KAAK,UAAU;AAAA,MAC/B;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAYA,eAAsB,UAAa,KAAsB,IAA6C;AACpG,qBAAmB,GAAG;AACtB,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,OAAO,SAAS,SAAS;AAC/B,MAAI,SAAS,GAAG;AACd,WAAO,IAAI,MAAM,cAAc,QAAQ;AAAA,EACzC;AAEA,QAAM,MAAM,OAAO,IAAI,MAAM,IAAI;AACjC,MAAI,CAAC,IAAI,QAAQ,KAAK,IAAI,GAAG,GAAG;AAC9B,QAAI,IAAI,aAAa,SAAS;AAC5B,aAAO,EAAE,QAAQ,MAAM,OAAO,KAAK;AAAA,IACrC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,MAAM,IAAI,OAAO,GAAG;AAKhC,MAAI;AACJ,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,MAAM,MAAM,UAAU,SAAS,MAAM,GAAG;AAC9C,QAAI,UAAU,IAAI,IAAI,KAAK,CAAC;AAC5B,gBAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAAA,EAC7D,OAAO;AACL,gBAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAAA,EAC7D;AACA,QAAM,SAAS,KAAK,MAAM,SAAS;AAEnC,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA;AAAA,IACA,eAAe,kBAAkB,GAAG,IAAI,aAAa;AAAA,IACrD,IAAI;AAAA,IACJ,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,EAC7B,CAAC;AAED,SAAO;AACT;AAOA,eAAsB,WAAc,KAAuF;AACzH,qBAAmB,GAAG;AACtB,QAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,IAAI;AACtD,QAAM,MAA8D,CAAC;AACrE,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AACzD,QAAI,CAAC,IAAK;AACV,UAAM,OAAO,IAAI,SAAS;AAC1B,UAAM,WAAW,SAAS,KAAK,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,MAAM,IAAI,CAAC;AAC1E,QAAI,CAAC,YAAY,IAAI,aAAa,eAAgB;AAClD,QAAI,KAAK,EAAE,IAAI,MAAM,SAAS,CAAC;AAAA,EACjC;AACA,SAAO;AACT;AAQA,eAAsB,QAAW,KAAsB,IAAY,QAA+B;AAChG,qBAAmB,GAAG;AACtB,qBAAmB,KAAK,MAAM;AAC9B,mBAAiB,IAAI,SAAS,IAAI,MAAM,MAAM;AAE9C,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,WAAW,EAAE,8BAA8B,IAAI,IAAI,GAAG;AACrF,QAAM,WAAW,SAAS,SAAS;AACnC,MAAI,WAAW,SAAU;AACzB,MAAI,SAAS,UAAU;AACrB,UAAM,IAAI,MAAM,sCAAsC,EAAE,UAAU,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC3F;AAEA,MAAI,WAAW,EAAG,kBAAiB,IAAI,SAAS,IAAI,MAAM,QAAQ;AAElE,QAAM,UAAU,OAAO,IAAI,MAAM,QAAQ;AACzC,QAAM,QAAQ,OAAO,IAAI,MAAM,MAAM;AACrC,QAAM,UAAU,MAAM,IAAI,OAAO,OAAO;AACxC,QAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;AAKpC,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,OAAO,MAAM,gBAAgB,UAAU,SAAS,KAAK;AAC3D,MAAI,KAAK,IAAK,KAAI,UAAU,IAAI,IAAI,KAAK,KAAK,CAAC;AAC/C,QAAM,OAA0B;AAAA,IAC9B,QAAQ;AAAA,IACR,IAAI,SAAS,KAAK;AAAA,IAClB,KAAK;AAAA,IACL,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,IAAI,QAAQ;AAAA,IACjB,OAAO;AAAA,IACP,aAAa,IAAI,QAAQ;AAAA,IACzB,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,IAAI;AAEnD,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA,MAAM;AAAA,IACN,eAAe;AAAA,IACf,IAAI;AAAA,IACJ,IAAI;AAAA,EACN,CAAC;AACH;AAMA,eAAsB,OAAU,KAAsB,IAAY,QAA+B;AAC/F,qBAAmB,GAAG;AACtB,MAAI,SAAS,EAAG,OAAM,IAAI,MAAM,kCAAkC,MAAM,EAAE;AAE1E,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,WAAW,EAAE,8BAA8B,IAAI,IAAI,GAAG;AACrF,QAAM,WAAW,SAAS,SAAS;AACnC,MAAI,WAAW,SAAU;AACzB,MAAI,SAAS,UAAU;AACrB,UAAM,IAAI,MAAM,uCAAuC,EAAE,UAAU,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC5F;AACA,QAAM,UAAU,IAAI,QAAQ,SAAS;AACrC,QAAM,qBAAqB,SAAS,gBAAgB,IAAI,QAAQ;AAChE,MAAI,CAAC,WAAW,CAAC,oBAAoB;AACnC,UAAM,IAAI,sBAAsB,IAAI,QAAQ;AAAA,EAC9C;AAEA,mBAAiB,IAAI,SAAS,IAAI,MAAM,QAAQ;AAChD,MAAI,SAAS,EAAG,oBAAmB,KAAK,MAAM;AAE9C,QAAM,UAAU,MAAM,IAAI,OAAO,OAAO,IAAI,MAAM,QAAQ,CAAC;AAC3D,QAAM,QAAQ,MAAM,IAAI,OAAO,OAAO,IAAI,MAAM,MAAM,CAAC;AAIvD,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,OAAO,MAAM,gBAAgB,UAAU,SAAS,KAAK;AAC3D,MAAI,KAAK,IAAK,KAAI,UAAU,IAAI,IAAI,KAAK,KAAK,CAAC;AAC/C,QAAM,OAA0B;AAAA,IAC9B,QAAQ;AAAA,IACR,IAAI,SAAS,KAAK;AAAA,IAClB,KAAK;AAAA,IACL,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,IAAI,QAAQ;AAAA,IACjB,GAAI,SAAS,KAAK,EAAE,OAAO,OAAO;AAAA,IAClC,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,IAAI;AAEnD,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA,MAAM;AAAA,IACN,eAAe;AAAA,IACf,IAAI;AAAA,IACJ,IAAI;AAAA,EACN,CAAC;AACH;AAOO,SAAS,oBACd,KACA,MACyD;AACzD,SAAO,IAAI,MAAM,oBAAoB,IAAI;AAC3C;","names":["putAtTier","getAtTier","listAtTier","elevate","demote"]}