@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.21

package/dist/chunk-7G6VDWXB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/port/with/i18n-strategy.ts","../src/kernel/paths.ts","../src/via/i18n/policy.ts","../src/via/i18n/script.ts","../src/via/i18n/binding.ts","../src/via/i18n/core.ts"],"sourcesContent":["/**\n * i18n strategy seam (#623 Task 7 — moved out of `via/i18n/strategy.ts`\n * and `via/i18n/dictionary.ts`, precedent: `port/with/lazy-strategy.ts`).\n * Lives on the `/with` port (the one seam the kernel spine may import\n * statically) so `Collection`/`Vault` can hold the `NO_I18N` default and the\n * two reserved-name/brand predicates without a spine→service static import.\n *\n * Core imports `I18nStrategy` type-only + `NO_I18N` stub; real\n * `applyI18nLocale` / `validateI18nTextValue` / `DictionaryHandle` are only\n * reachable via `withI18n()` in `via/i18n/active.ts`.\n *\n * Solo apps that don't use `i18nText()` fields, don't declare `dictKey()`\n * fields, and don't open a `vault.dictionary(...)` handle ship none of the\n * ~854 LOC behind this seam.\n *\n * Behavior under NO_I18N:\n *\n * - **applyI18nLocale** — returns the record unchanged. Apps without\n *   any i18n descriptors never observe a difference; apps that\n *   *did* declare i18nText/dictKey fields without opting into the\n *   strategy still get raw values back (locale resolution silently\n *   skipped). The validators below ensure the misconfiguration is\n *   caught at write time instead.\n * - **validateI18nTextValue** — throws when called. Only fires when\n *   a collection declared `i18nFields`; if you declared the field,\n *   you must opt in.\n * - **buildDictionaryHandle** — throws when called. Only fires when\n *   user code calls `vault.dictionary(...)`.\n *\n * #650 Task 1 (via-lookup extraction, phase D): the real\n * `buildDictionaryHandle` (in `via/i18n/active.ts`) now delegates to\n * `withLookup().buildLookupHandle` (`via/lookup/active.ts`) — same\n * handle (`LookupHandle`, aliased as `DictionaryHandle`), new home. This\n * interface's shape is unchanged.\n *\n * @internal\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { LedgerStore } from '../../with-commit/history/ledger/store.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { NoydbEventEmitter } from '../../kernel/events.js'\nimport type { I18nTextDescriptor } from '../../via/i18n/core.js'\nimport type { Layer } from '../../via/i18n/policy.js'\nimport type { ScriptWarning } from '../../via/i18n/script.js'\nimport type { DictKeyDescriptor, DictionaryHandle, DictionaryOptions, StaticDictDescriptor } from '../../via/i18n/dictionary.js'\nimport type { ViaCryptoCtx } from '../../kernel/via/index.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\n\n/**\n * Options accepted by `I18nStrategy.buildDictionaryHandle`. Mirrors\n * the `DictionaryHandle` constructor verbatim — kept here so core\n * code never imports the dictionary module at runtime.\n *\n * @internal\n */\nexport interface BuildDictionaryHandleOptions<Keys extends string = string> {\n  adapter: NoydbStore\n  compartmentName: string\n  dictionaryName: string\n  keyring: UnlockedKeyring\n  /**\n   * The `reservedEnvelopes('_dict_')` capability (#629 Task 4) — DictionaryHandle's\n   * sanctioned crypto door onto its `_dict_<name>` collection. Bound by the\n   * Vault to its own `getDEK`, the same per-collection-name DEK resolver\n   * every other collection uses.\n   */\n  reservedEnvelopes: ReturnType<ViaCryptoCtx['reservedEnvelopes']>\n  encrypted: boolean\n  ledger: LedgerStore | undefined\n  options: DictionaryOptions\n  findAndUpdateReferences:\n    | ((\n        dictionaryName: string,\n        oldKey: string,\n        newKey: string,\n      ) => Promise<void>)\n    | undefined\n  emitter: NoydbEventEmitter\n  /**\n   * Used by the active strategy to satisfy the generic-key parameter\n   * on the returned handle. The NO_I18N stub never reads it.\n   */\n  // marker generic — runtime sees no value\n  _keyMarker?: Keys\n  /** #650 Task 4 (#647) — choke-point participation hooks, passed through to `buildLookupHandle`. */\n  onDirty?: ((collection: string, id: string, action: 'put' | 'delete', version: number) => Promise<void>) | undefined\n  onRecordMutated?: ((collection: string, id: string, action: 'put' | 'delete', version: number) => Promise<void>) | undefined\n  /**\n   * #647 fix wave 1 — mints a version-ordered delete-marker envelope, passed through to\n   * `buildLookupHandle`. See `port/with/lookup-strategy.ts`'s `BuildLookupHandleOptions` doc\n   * comment for why this is injected rather than imported by the handle itself.\n   */\n  buildDeleteMarker: (version: number, actor: string) => EncryptedEnvelope\n  /** #650 Task 5 (#648) — the real reference check, passed through to `buildLookupHandle`. */\n  checkReferencesOnDelete?: ((key: string) => Promise<unknown>) | undefined\n}\n\n/**\n * @internal\n */\nexport interface I18nStrategy {\n  /**\n   * Resolve `i18nText` fields on a record to the requested locale and\n   * return a new object. Returns the input unchanged under\n   * `NO_I18N`.\n   */\n  applyI18nLocale(\n    record: Record<string, unknown>,\n    fields: Record<string, I18nTextDescriptor>,\n    locale: string,\n    fallback?: string | readonly string[],\n    layer?: Layer,\n  ): Record<string, unknown>\n\n  /**\n   * Validate that an i18nText field's value satisfies its descriptor\n   * (required locales present, etc.). Throws under `NO_I18N` —\n   * declaring i18nFields without opting in is a misconfiguration.\n   */\n  validateI18nTextValue(\n    value: unknown,\n    field: string,\n    descriptor: I18nTextDescriptor,\n  ): void\n\n  /**\n   * Enforce per-locale script constraints over an i18nText value map\n   * (write-time). Returns the (possibly filtered) value plus any\n   * non-fatal warnings. Returns the value unchanged when the field has\n   * no `script` option, or under `NO_I18N`.\n   */\n  enforceScript(\n    value: Record<string, unknown>,\n    field: string,\n    descriptor: I18nTextDescriptor,\n    exempt?: ReadonlySet<string>,\n  ): { value: Record<string, unknown>; warnings: ScriptWarning[] }\n\n  /**\n   * Per-field locales that are unchanged round-tripped densify fills (exempt\n   * from write-time script enforcement). Empty under NO_I18N.\n   */\n  computeExemptFills(\n    prior: Record<string, unknown> | undefined,\n    incoming: Record<string, unknown>,\n    fields: Record<string, I18nTextDescriptor>,\n  ): Map<string, Set<string>>\n\n  /**\n   * Eager-fill empty i18n slots from each field's substitute chain and record\n   * provenance in `record['_i18nFilled']`. Mutates `record`. No-op under\n   * NO_I18N.\n   */\n  densify(\n    record: Record<string, unknown>,\n    prior: Record<string, unknown> | undefined,\n    fields: Record<string, I18nTextDescriptor>,\n  ): void\n\n  /**\n   * Construct a typed `DictionaryHandle` for the named dictionary.\n   * Throws under `NO_I18N`.\n   */\n  buildDictionaryHandle<Keys extends string = string>(\n    opts: BuildDictionaryHandleOptions<Keys>,\n  ): DictionaryHandle<Keys>\n}\n\nfunction notEnabled(op: string): Error {\n  return new Error(\n    `${op} requires the i18n strategy. Import ` +\n    '`{ withI18n }` from \"@noy-db/hub/i18n\" and pass it to ' +\n    '`createNoydb({ i18nStrategy: withI18n() })`.',\n  )\n}\n\n/**\n * No-i18n stub. Locale resolution is the identity; validation and\n * dictionary construction throw with an actionable pointer.\n *\n * @internal\n */\nexport const NO_I18N: I18nStrategy = {\n  applyI18nLocale(record) { return record },\n  validateI18nTextValue() { throw notEnabled('i18nText field validation') },\n  enforceScript(value) { return { value, warnings: [] } },\n  computeExemptFills() { return new Map<string, Set<string>>() },\n  densify() {},\n  buildDictionaryHandle() { throw notEnabled('vault.dictionary()') },\n}\n\n/**\n * Return true when a collection name is a reserved dictionary collection\n * (the `_dict_*` prefix). Mirrors `DICT_COLLECTION_PREFIX` — now on\n * `via/lookup/handle.ts` (#650 Task 1), re-exported from\n * `via/i18n/dictionary.ts` for compat — duplicated here (not\n * imported) so this port has no VALUE dependency back on the feature; keep\n * the two in sync if the prefix ever changes.\n */\nexport function isDictCollectionName(name: string): boolean {\n  return name.startsWith('_dict_')\n}\n\n/** Runtime predicate for detecting a StaticDictDescriptor. */\nexport function isStaticDictDescriptor(x: unknown): x is StaticDictDescriptor {\n  return (\n    typeof x === 'object' &&\n    x !== null &&\n    (x as { _noydbStaticDict?: unknown })._noydbStaticDict === true\n  )\n}\n\n/**\n * Runtime predicate for detecting an I18nTextDescriptor. Pure tag check —\n * moved here (#623 Task 11) alongside `isStaticDictDescriptor` so\n * `kernel/via/compose.ts` (`mergeViaFields`'s descriptor-shape classification)\n * can reach it through the port instead of importing `via/i18n/core.js`\n * directly. Re-exported from that module for compat with existing importers.\n */\nexport function isI18nTextDescriptor(x: unknown): x is I18nTextDescriptor {\n  return (\n    typeof x === 'object' &&\n    x !== null &&\n    (x as { _noydbI18nText?: unknown })._noydbI18nText === true\n  )\n}\n\n/**\n * Runtime predicate for detecting a DictKeyDescriptor. Pure tag check —\n * moved here (#623 Task 11) for the same reason as `isI18nTextDescriptor`\n * above. Re-exported from `via/i18n/dictionary.js` for compat with\n * existing importers.\n */\nexport function isDictKeyDescriptor(x: unknown): x is DictKeyDescriptor {\n  return (\n    typeof x === 'object' &&\n    x !== null &&\n    (x as { _noydbDictKey?: unknown })._noydbDictKey === true\n  )\n}\n\n/**\n * Type-only re-exports (#623 Task 8) — the kernel spine (collection.ts,\n * collection-config.ts, vault.ts, types.ts) imports these descriptor/handle\n * types through the port instead of reaching into `via/i18n/*`\n * directly, so `src/kernel/**` carries no via-i18n specifier at all.\n * `isolatedModules: true` erases these at build time — no runtime coupling.\n */\nexport type { I18nTextDescriptor } from '../../via/i18n/core.js'\nexport type { DictKeyDescriptor, DictionaryHandle, DictionaryOptions, StaticDictDescriptor } from '../../via/i18n/dictionary.js'\nexport type { Layer } from '../../via/i18n/policy.js'\nexport type { ScriptWarning } from '../../via/i18n/script.js'\n","/**\n * Generic dotted-path / `[]`-wildcard record helpers. Kernel-owned:\n * these carry zero i18n logic — they were extracted out of\n * `via/i18n/core.ts` (Task 7, #623) so kernel call-sites (put-time\n * validation, densify) can import them without a spine→service edge.\n *\n * @internal\n */\n\n/**\n * Return all leaf values at `path`, expanding `[].` array wildcards.\n *\n * - `'name'`              → `[obj.name]`\n * - `'address.lineOne'`   → `[obj.address.lineOne]`\n * - `'contacts[].title'`  → `[obj.contacts[0].title, obj.contacts[1].title, …]`\n *\n * Returns an empty array when the path does not resolve (missing key,\n * wrong type, etc.). Used by `enforceI18nOnPut` to validate nested fields.\n */\nexport function getAtPath(obj: Record<string, unknown>, path: string): unknown[] {\n  const arrayIdx = path.indexOf('[].')\n  if (arrayIdx !== -1) {\n    const arrayKey = path.slice(0, arrayIdx)\n    const restPath = path.slice(arrayIdx + 3)\n    const arr = obj[arrayKey]\n    if (!Array.isArray(arr)) return []\n    return arr.flatMap(item => {\n      if (!item || typeof item !== 'object' || Array.isArray(item)) return []\n      return getAtPath(item as Record<string, unknown>, restPath)\n    })\n  }\n  const dotIdx = path.indexOf('.')\n  if (dotIdx !== -1) {\n    const head = path.slice(0, dotIdx)\n    const rest = path.slice(dotIdx + 1)\n    const nested = obj[head]\n    if (!nested || typeof nested !== 'object' || Array.isArray(nested)) return []\n    return getAtPath(nested as Record<string, unknown>, rest)\n  }\n  const val = obj[path]\n  return val !== undefined ? [val] : []\n}\n\n/**\n * Mutate `obj` in-place, setting `value` at the nested `path`.\n * Supports dot notation (`'address.lineOne'`) but not array wildcards —\n * auto-translate on `contacts[].title` style paths is not supported.\n */\nexport function setAtPathInPlace(\n  obj: Record<string, unknown>,\n  path: string,\n  value: unknown,\n): void {\n  const dotIdx = path.indexOf('.')\n  if (dotIdx !== -1) {\n    const head = path.slice(0, dotIdx)\n    const rest = path.slice(dotIdx + 1)\n    const nested = obj[head]\n    if (!nested || typeof nested !== 'object' || Array.isArray(nested)) return\n    setAtPathInPlace(nested as Record<string, unknown>, rest, value)\n    return\n  }\n  obj[path] = value\n}\n","/**\n * Per-layer i18n resolution policy.\n *\n * `onMissing` governs what happens when a multilingual field is resolved\n * to a target locale that is absent. It may be a single scalar policy or\n * a per-layer map, so a field can be lenient at the app read boundary but\n * strict inside a materialized view.\n *\n * Effective policy for layer `λ`:\n *\n * ```\n * explicit(λ) = typeof onMissing === 'object' ? onMissing[λ] : undefined\n * scalar      = typeof onMissing === 'string' ? onMissing : undefined\n * policy(λ)   = explicit(λ) ?? layerDefault(λ) ?? scalar ?? 'throw'\n * ```\n *\n * - `layerDefault('guard') = 'substitute'` — guards are lenient unless\n *   EXPLICITLY overridden; they never inherit a scalar policy (a guard\n *   reading a display value must not hard-fail on a missing locale).\n * - every other layer has no default, so it inherits the scalar, else\n *   falls back to `'throw'` (today's behavior — zero breaking change).\n *\n * @public\n */\nexport type OnMissing = 'substitute' | 'null' | 'throw'\n\n/**\n * The contexts in which a multilingual field is resolved. Each can carry\n * its own `onMissing` policy.\n *\n * - `read`       — ordinary app reads (`get`/`list`/query projection).\n * - `guard`      — a guard callback reading a value.\n * - `join`       — a joined record expanded onto a row.\n * - `mv`         — materialized-view input.\n * - `derivation` — derivation input.\n * - `export`     — bundle/cover export.\n */\nexport type Layer = 'read' | 'guard' | 'join' | 'mv' | 'derivation' | 'export'\n\n/** Field-level policy: a single scalar, or a per-layer map. */\nexport type OnMissingPolicy = OnMissing | Partial<Record<Layer, OnMissing>>\n\n/**\n * Resolve the effective `OnMissing` for a layer from a field's declared\n * policy. See module docs for the resolution rule.\n */\nexport function resolvePolicy(\n  onMissing: OnMissingPolicy | undefined,\n  layer: Layer,\n): OnMissing {\n  const explicit =\n    onMissing && typeof onMissing === 'object' ? onMissing[layer] : undefined\n  const scalar = typeof onMissing === 'string' ? onMissing : undefined\n  const layerDefault: OnMissing | undefined =\n    layer === 'guard' ? 'substitute' : undefined\n  return explicit ?? layerDefault ?? scalar ?? 'throw'\n}\n","/**\n * Per-locale script enforcement for `i18nText` fields (write-time).\n *\n * Each locale slot's string is validated against an allowed set of\n * Unicode scripts. `'auto'` infers the set from the locale code with\n * **asymmetric Latin tolerance**: every non-Latin-script locale\n * also allows `Latin`, because proper names and addresses in those\n * locales routinely embed Latin brand/building/technical names — while\n * Latin-script locales do NOT allow other scripts, so the common error\n * (e.g. Thai text dumped into an `en` slot) is still caught.\n *\n * The always-on baseline is `Common` (digits, punctuation), `Inherited`\n * and `Mark` (combining diacritics, joiners, harakat, tone marks), and\n * whitespace — so Latin digits and in-script combining marks never\n * false-reject.\n *\n * @public\n */\nimport { ScriptViolationError } from '../../kernel/errors.js'\nimport type { I18nTextDescriptor } from './core.js'\n\n/** Locales whose base language is written in the Latin script. */\nconst LATIN_BASE = new Set([\n  'en', 'fr', 'de', 'es', 'it', 'pt', 'nl', 'sv', 'no', 'da', 'fi', 'is',\n  'pl', 'cs', 'sk', 'hu', 'ro', 'hr', 'sl', 'et', 'lv', 'lt', 'tr', 'vi',\n  'id', 'ms', 'tl', 'sw', 'af', 'ca', 'gl', 'eu', 'cy', 'ga',\n])\n\n/** Base-language → primary (non-Latin) scripts. Latin is appended by inferScripts. */\nconst SCRIPT_TABLE: Record<string, readonly string[]> = {\n  th: ['Thai'],\n  ko: ['Hangul', 'Han'],\n  ja: ['Han', 'Hiragana', 'Katakana'],\n  zh: ['Han'],\n  ar: ['Arabic'],\n  fa: ['Arabic'],\n  ur: ['Arabic'],\n  ru: ['Cyrillic'],\n  uk: ['Cyrillic'],\n  bg: ['Cyrillic'],\n  sr: ['Cyrillic'],\n  he: ['Hebrew'],\n  el: ['Greek'],\n  hi: ['Devanagari'],\n  ta: ['Tamil'],\n  km: ['Khmer'],\n  lo: ['Lao'],\n  my: ['Myanmar'],\n}\n\n/** Map a BCP-47 script subtag (e.g. `Latn`, `Cyrl`) to allowed scripts. */\nconst SUBTAG_SCRIPTS: Record<string, readonly string[]> = {\n  Latn: ['Latin'],\n  Cyrl: ['Cyrillic', 'Latin'],\n  Hans: ['Han', 'Latin'],\n  Hant: ['Han', 'Latin'],\n  Thai: ['Thai', 'Latin'],\n  Arab: ['Arabic', 'Latin'],\n}\n\n/**\n * Infer the allowed Unicode scripts for a BCP-47 locale, with asymmetric\n * Latin tolerance. A script subtag (`th-Latn`) wins over the base\n * language. Unknown locales default to `['Latin']`.\n */\nexport function inferScripts(locale: string): readonly string[] {\n  const parts = locale.split('-')\n  const subtag = parts.find((t) => /^[A-Z][a-z]{3}$/.test(t))\n  if (subtag && SUBTAG_SCRIPTS[subtag]) return SUBTAG_SCRIPTS[subtag]\n\n  const base = (parts[0] ?? '').toLowerCase()\n  if (LATIN_BASE.has(base)) return ['Latin']\n  const primary = SCRIPT_TABLE[base]\n  if (primary) return [...primary, 'Latin'] // asymmetric Latin tolerance\n  return ['Latin']\n}\n\n/** Resolve the allowed scripts for a field's locale slot. */\nfunction allowedFor(descriptor: I18nTextDescriptor, locale: string): readonly string[] {\n  const script = descriptor.options.script\n  if (script && script !== 'auto') {\n    const explicit = script[locale]\n    if (explicit) return explicit\n  }\n  return inferScripts(locale)\n}\n\n/** Always-allowed baseline character classes (besides the named scripts). */\nconst BASELINE = String.raw`\\p{White_Space}\\p{Script=Common}\\p{Script=Inherited}\\p{Mark}`\n\n/** Build a whole-string matcher for the allowed scripts. */\nfunction fullMatcher(scripts: readonly string[]): RegExp {\n  const cls = scripts.map((s) => `\\\\p{Script=${s}}`).join('')\n  return new RegExp(`^[${BASELINE}${cls}]*$`, 'u')\n}\n\n/** Build a single-character matcher (for sampling / stripping). */\nfunction charMatcher(scripts: readonly string[]): RegExp {\n  const cls = scripts.map((s) => `\\\\p{Script=${s}}`).join('')\n  return new RegExp(`[${BASELINE}${cls}]`, 'u')\n}\n\n/** Collect a short sample of characters that violate the allowed scripts. */\nfunction offendingSample(str: string, scripts: readonly string[]): string {\n  const ok = charMatcher(scripts)\n  const bad: string[] = []\n  for (const ch of str) {\n    if (!ok.test(ch)) bad.push(ch)\n    if (bad.length >= 8) break\n  }\n  return bad.join('')\n}\n\n/** Remove characters that violate the allowed scripts. */\nfunction stripDisallowed(str: string, scripts: readonly string[]): string {\n  const ok = charMatcher(scripts)\n  let out = ''\n  for (const ch of str) if (ok.test(ch)) out += ch\n  return out\n}\n\n/** A non-fatal script violation recorded under `'filter'`/`'warn'` modes. */\nexport interface ScriptWarning {\n  readonly field: string\n  readonly locale: string\n  readonly expected: readonly string[]\n  readonly sample: string\n}\n\n/**\n * Enforce a field's script constraint over an i18nText value map.\n *\n * - No `script` option ⇒ returns the value unchanged.\n * - `onScriptViolation: 'reject'` (default) ⇒ throws {@link ScriptViolationError}.\n * - `'filter'` ⇒ returns a copy with disallowed characters stripped + warnings.\n * - `'warn'` ⇒ returns the value unchanged + warnings.\n */\nexport function enforceScript(\n  value: Record<string, unknown>,\n  field: string,\n  descriptor: I18nTextDescriptor,\n  exempt?: ReadonlySet<string>,\n): { value: Record<string, unknown>; warnings: ScriptWarning[] } {\n  const opt = descriptor.options\n  if (!opt.script) return { value, warnings: [] }\n\n  const mode = opt.onScriptViolation ?? 'reject'\n  const warnings: ScriptWarning[] = []\n  let out = value\n\n  for (const [locale, raw] of Object.entries(value)) {\n    if (exempt?.has(locale)) continue\n    if (typeof raw !== 'string') continue\n    const allowed = allowedFor(descriptor, locale)\n    if (fullMatcher(allowed).test(raw)) continue\n\n    const sample = offendingSample(raw, allowed)\n    if (mode === 'reject') {\n      throw new ScriptViolationError(field, locale, allowed, sample)\n    }\n    warnings.push({ field, locale, expected: allowed, sample })\n    if (mode === 'filter') {\n      if (out === value) out = { ...value }\n      out[locale] = stripDisallowed(raw, allowed)\n    }\n  }\n\n  return { value: out, warnings }\n}\n","/**\n * The i18n `ViaBinding` — wires the i18n engine (auto-translate/script\n * enforcement/validation/densify on write; locale + dict-label presentation\n * on read) into the kernel's generic Via port. Mirrors\n * `via/money/binding.ts`'s #553 static-link pattern.\n *\n * LIVE (#623 Task 8 wired the cutover): `i18nBinding()`/`linkI18nVia()` are\n * the real put/read path for every i18n-declaring collection —\n * `collection.ts`'s `_putInternal`/`applyLocaleToRecord` (the call sites\n * this file's bodies were moved/adapted from) now delegate their i18n\n * stages to `this.via.encodeWrite`/`this.via.present` instead of running\n * the hand-wired i18n logic inline.\n *\n * `i18nText()`, `dictKey()`, `staticDict()` each call {@link linkI18nVia}\n * first — the same #553 pattern `money()` uses.\n */\nimport type { ViaBinding, ViaWriteCtx, ViaReadCtx } from '../../kernel/via/index.js'\nimport { installViaBinder } from '../../kernel/via/index.js'\nimport type { I18nTextDescriptor } from './core.js'\nimport { stripI18nFilled } from './core.js'\nimport type { DictKeyDescriptor, StaticDictDescriptor } from './dictionary.js'\nimport type { I18nStrategy } from '../../port/with/i18n-strategy.js'\nimport { isStaticDictDescriptor } from '../../port/with/i18n-strategy.js'\nimport { resolvePolicy, type Layer } from './policy.js'\nimport { getAtPath, setAtPathInPlace } from '../../kernel/paths.js'\nimport { TranslatorNotConfiguredError, LocaleNotSpecifiedError } from '../../kernel/errors.js'\n\n/**\n * Config a collection's i18n declarations resolve to — the binding's\n * construction input. Fields are loosely typed (`unknown`) at this seam\n * because the kernel's `ViaBinder` contract is opaque-config-in; the\n * concrete i18n types are applied inside the binding's own functions.\n */\nexport interface I18nViaConfig {\n  i18nFields?: Record<string, unknown>          // I18nTextDescriptor map\n  dictKeyFields?: Record<string, unknown>       // DictKeyDescriptor | StaticDictDescriptor map\n  i18nDensifyFields?: Record<string, unknown>   // I18nTextDescriptor subset (densifyOnWrite: true)\n  strategy: unknown                              // I18nStrategy (real or NO_I18N)\n  defaultLocale?: string\n  autoTranslateHook?: (...args: unknown[]) => Promise<string>\n  dictLabelResolver?: (...args: unknown[]) => Promise<string | undefined>\n  i18nPutValidator?: (record: unknown) => void   // the vault-built closure (unchanged wiring)\n  collectionName: string\n}\n\n// ─── write pipeline ─────────────────────────────────────────────────────\n\n/**\n * Auto-translate missing i18nText translations. Runs BEFORE i18n\n * validation so translated values satisfy the required-locale constraint.\n * Throws `TranslatorNotConfiguredError` when a field has\n * `autoTranslate: true` but no hook was configured. Mutates `record`\n * in place (mirrors `collection.ts:1830-1874`).\n */\nasync function runI18nAutoTranslate(\n  record: Record<string, unknown>,\n  i18nFields: Record<string, I18nTextDescriptor>,\n  cfg: I18nViaConfig,\n): Promise<void> {\n  for (const [field, descriptor] of Object.entries(i18nFields)) {\n    if (!descriptor.options.autoTranslate) continue\n    // getAtPath returns [] for array-wildcard paths — auto-translate on\n    // 'contacts[].field' style paths is not supported; skip silently.\n    const leafValues = getAtPath(record, field)\n    if (leafValues.length !== 1) continue\n    const value = leafValues[0]\n    if (!value || typeof value !== 'object' || Array.isArray(value)) continue\n    const map = value as Record<string, string>\n    // Determine which locales need translation. For 'all', translate all\n    // declared languages that are missing. For 'any', only translate if\n    // none are present. For string[], translate the listed required ones.\n    const { languages, required } = descriptor.options\n    const missing: string[] = languages.filter(\n      (lang) => !(lang in map) || map[lang] === '',\n    )\n    if (missing.length === 0) continue\n    // Find a source locale (first present non-empty value)\n    const sourceLocale = languages.find((l) => l in map && map[l] !== '')\n    if (!sourceLocale) continue\n    if (!cfg.autoTranslateHook) {\n      throw new TranslatorNotConfiguredError(field, cfg.collectionName)\n    }\n    // Only translate locales that are actually needed\n    const toTranslate =\n      required === 'any'\n        ? [] // 'any' is already satisfied since sourceLocale exists\n        : required === 'all'\n          ? missing\n          : missing.filter((l) => required.includes(l))\n    const translated = { ...map }\n    for (const targetLocale of toTranslate) {\n      translated[targetLocale] = await cfg.autoTranslateHook(\n        map[sourceLocale]!,\n        sourceLocale,\n        targetLocale,\n        field,\n        cfg.collectionName,\n      )\n    }\n    setAtPathInPlace(record, field, translated)\n  }\n}\n\n/**\n * i18nText script enforcement — runs AFTER auto-translate (so generated\n * values are checked too). Throws `ScriptViolationError` (from inside\n * `strategy.enforceScript`) under the default 'reject'; 'filter' strips\n * disallowed chars in place; 'warn' leaves the value unchanged. Mirrors\n * `collection.ts:1896-1927`.\n */\nfunction runI18nScriptEnforcement(\n  record: Record<string, unknown>,\n  i18nFields: Record<string, I18nTextDescriptor>,\n  strategy: I18nStrategy,\n  exemptFills: Map<string, Set<string>> | undefined,\n  ctx: ViaWriteCtx,\n  cfg: I18nViaConfig,\n): void {\n  for (const [field, descriptor] of Object.entries(i18nFields)) {\n    if (!descriptor.options.script) continue\n    for (const leaf of getAtPath(record, field)) {\n      if (!leaf || typeof leaf !== 'object' || Array.isArray(leaf)) continue\n      const leafMap = leaf as Record<string, unknown>\n      const { value: cleaned, warnings } = strategy.enforceScript(\n        leafMap,\n        field,\n        descriptor,\n        exemptFills?.get(field),\n      )\n      if (cleaned !== leafMap) Object.assign(leafMap, cleaned)\n      // enforceScript only returns warnings under 'warn'/'filter' ('reject'\n      // throws first), so this guard never fires — it makes that invariant\n      // explicit and keeps `mode` off the optional-undefined type.\n      const mode = descriptor.options.onScriptViolation\n      if (mode === 'warn' || mode === 'filter') {\n        for (const w of warnings) {\n          // Exact original payload shape (collection.ts:1916-1922 pre-cutover).\n          ctx.emit('i18n:script-violation', {\n            vault: ctx.vault,\n            collection: cfg.collectionName,\n            id: ctx.id,\n            mode,\n            warning: w,\n          })\n        }\n      }\n    }\n  }\n}\n\n/**\n * `encodeWrite` — translate → script → validate → densify, in the EXACT\n * order `_putInternal` runs them today (seam-map Part 2, stages 7-11).\n */\nasync function runI18nWriteStages(\n  record: Record<string, unknown>,\n  ctx: ViaWriteCtx,\n  cfg: I18nViaConfig,\n): Promise<Record<string, unknown>> {\n  const i18nFields = cfg.i18nFields as Record<string, I18nTextDescriptor> | undefined\n  const i18nDensifyFields = cfg.i18nDensifyFields as Record<string, I18nTextDescriptor> | undefined\n  const strategy = cfg.strategy as I18nStrategy\n\n  // 1. Auto-translate.\n  if (i18nFields) {\n    await runI18nAutoTranslate(record, i18nFields, cfg)\n  }\n\n  // 2. densifyOnWrite: read prior fills so a round-tripped derived copy is\n  // exempt from script enforcement and can be refreshed. Read once here,\n  // reused by densify() below. `ctx.prior()` resolves the real prior\n  // record (collection.ts wires it to `resolveDensifyPrior`, #623 Task 8).\n  let densifyPrior: Record<string, unknown> | undefined\n  let exemptFills: Map<string, Set<string>> | undefined\n  if (i18nDensifyFields) {\n    densifyPrior = (await ctx.prior()) ?? undefined\n    exemptFills = strategy.computeExemptFills(densifyPrior, record, i18nDensifyFields)\n  }\n\n  // 3. Script enforcement.\n  if (i18nFields) {\n    runI18nScriptEnforcement(record, i18nFields, strategy, exemptFills, ctx, cfg)\n  }\n\n  // 4. i18nText validation — AFTER auto-translate + script so the record is\n  // trustworthy. Throws MissingTranslationError when required translations\n  // are absent. The vault-built closure (unchanged wiring).\n  cfg.i18nPutValidator?.(record)\n\n  // 5. Eager-fill empty slots + record provenance. Runs AFTER the authored\n  // gates (required + script) so only authored slots are validated.\n  if (i18nDensifyFields) {\n    strategy.densify(record, densifyPrior, i18nDensifyFields)\n  }\n\n  return record\n}\n\n// ─── read pipeline ──────────────────────────────────────────────────────\n\n/**\n * `present` — i18nText locale resolution + dictKey/staticDict label\n * resolution + `_i18nFilled` stripping. Adapted from\n * `applyLocaleToRecord`'s i18n+dict+strip portions (`collection.ts:4184-\n * 4301`) — the money-decode portion of that method is a separate binding\n * (`via/money`) and is NOT this function's concern.\n */\nasync function runI18nPresent(\n  record: Record<string, unknown>,\n  ctx: ViaReadCtx,\n  cfg: I18nViaConfig,\n): Promise<Record<string, unknown>> {\n  const i18nFields = cfg.i18nFields as Record<string, I18nTextDescriptor> | undefined\n  const dictKeyFields = cfg.dictKeyFields as Record<string, DictKeyDescriptor | StaticDictDescriptor> | undefined\n  const strategy = cfg.strategy as I18nStrategy\n  const hasI18n = i18nFields !== undefined && Object.keys(i18nFields).length > 0\n  const hasDict = dictKeyFields !== undefined && Object.keys(dictKeyFields).length > 0\n  if (!hasI18n && !hasDict) return record\n\n  const locale = typeof ctx.locale === 'string' ? ctx.locale : undefined\n  const fallback = ctx.fallback as string | readonly string[] | undefined\n  const layer = ctx.layer as Layer\n\n  let result = record\n\n  // i18nText / dictKey resolution require an active locale — EXCEPT a\n  // static dict declaring a `displayLocale`, which resolves its\n  // `<field>Label` even under a locale-less read (the hybrid hinge). Only\n  // this second gate relaxes, and ONLY for static-display fields — folding\n  // `hasI18n` in here would let an i18nText-only collection fall through to\n  // applyI18nLocale(…, undefined) on a locale-less read, breaking the\n  // raw-{th,en}-map invariant.\n  const hasStaticDisplay =\n    hasDict &&\n    dictKeyFields !== undefined &&\n    Object.values(dictKeyFields).some(\n      (d) => isStaticDictDescriptor(d) && d.displayLocale !== undefined,\n    )\n\n  // Strip the internal densify marker even when no locale is active\n  // (applyI18nLocale, which normally strips it, is skipped on this path).\n  // Non-mutating: never touches the cached/stored record object.\n  if (!locale && !hasStaticDisplay) return stripI18nFilled(result)\n\n  // 1. i18nText resolution — guarded on `locale`, because the relaxed gate\n  // above can now be entered with `locale === undefined` (static-display).\n  // The layer selects the field's per-layer `onMissing` policy inside\n  // applyI18nLocale.\n  if (locale && hasI18n && i18nFields) {\n    result = strategy.applyI18nLocale(result, i18nFields, locale, fallback, layer)\n  }\n\n  // 2. dictKey / staticDict label resolution\n  if (hasDict && dictKeyFields && cfg.dictLabelResolver && locale !== 'raw') {\n    const withLabels = { ...result }\n    const resolver = cfg.dictLabelResolver\n    for (const [field, desc] of Object.entries(dictKeyFields)) {\n      // dictKey default policy is 'null' (omit/null on miss) — today's\n      // behavior — unless the field declares onMissing. 'substitute'\n      // walks the declared substitute chain (passed as the resolver's\n      // fallback); 'throw' raises LocaleNotSpecifiedError.\n      const policy = desc.onMissing ? resolvePolicy(desc.onMissing, layer) : 'null'\n      const fieldFallback =\n        policy === 'substitute'\n          ? (fallback ?? desc.substitute)\n          : fallback\n      // Per-field effective locale: a static dict falls back to its\n      // `displayLocale` when no locale is active (the hybrid hinge); a\n      // plain dictKey with no displayLocale gets `undefined` → its\n      // <field>Label is omitted on a locale-less read (today's behavior).\n      const effLocale =\n        locale ??\n        (isStaticDictDescriptor(desc) ? desc.displayLocale : undefined)\n      // Resolve one key → label | null, honoring the policy. With no\n      // effective locale there is nothing to resolve against.\n      const resolveKey = async (key: string): Promise<string | null> => {\n        if (!effLocale) {\n          if (policy === 'throw') {\n            throw new LocaleNotSpecifiedError(\n              field,\n              `dictKey \"${field}\": no locale active to resolve key \"${key}\".`,\n            )\n          }\n          return null\n        }\n        const label = await resolver(desc.name, key, effLocale, fieldFallback)\n        if (label === undefined) {\n          if (policy === 'throw') {\n            throw new LocaleNotSpecifiedError(\n              field,\n              `dictKey \"${field}\": no label for key \"${key}\" in locale \"${effLocale}\".`,\n            )\n          }\n          return null\n        }\n        return label\n      }\n\n      if (field.includes('[].')) {\n        // Wildcard path `arrayKey[].leaf`: add a per-element sibling\n        // `<leaf>Label`. Single level + simple leaf.\n        const parts = field.split('[].')\n        const arrayKey = parts[0]!\n        const leaf = parts[1]\n        if (!leaf || leaf.includes('.')) continue\n        const arr = (withLabels as Record<string, unknown>)[arrayKey]\n        if (!Array.isArray(arr)) continue\n        const labelKey = `${leaf}Label`\n        ;(withLabels as Record<string, unknown>)[arrayKey] = await Promise.all(\n          arr.map(async (el) => {\n            if (!el || typeof el !== 'object' || Array.isArray(el)) return el\n            const k = (el as Record<string, unknown>)[leaf]\n            if (typeof k !== 'string') return el\n            return { ...(el as Record<string, unknown>), [labelKey]: await resolveKey(k) }\n          }),\n        )\n        continue\n      }\n\n      const val = result[field]\n      if (Array.isArray(val)) {\n        // Array-of-keys → [{ key, label }] pair objects (key preserved).\n        withLabels[`${field}Label`] = await Promise.all(\n          val.map(async (k) => ({\n            key: k,\n            label: typeof k === 'string' ? await resolveKey(k) : null,\n          })),\n        )\n      } else if (typeof val === 'string') {\n        const label = await resolveKey(val)\n        // Scalar under 'null'/default omits the label key (today's\n        // behavior); 'substitute' returns a value; 'throw' threw above.\n        if (label !== null) withLabels[`${field}Label`] = label\n      }\n    }\n    result = withLabels\n  }\n\n  // Final guard: the locale-less static-display path skips\n  // applyI18nLocale's strip, so ensure the densify marker never leaks here\n  // either. Non-mutating (no-op when absent or already stripped above).\n  return stripI18nFilled(result)\n}\n\n// ─── introspection ──────────────────────────────────────────────────────\n\nfunction buildI18nDescribeFragment(cfg: I18nViaConfig): Record<string, unknown> {\n  return {\n    i18nFields: cfg.i18nFields ? Object.keys(cfg.i18nFields) : [],\n    dictKeyFields: cfg.dictKeyFields ? Object.keys(cfg.dictKeyFields) : [],\n    ...(cfg.defaultLocale !== undefined ? { defaultLocale: cfg.defaultLocale } : {}),\n  }\n}\n\n// ─── binding ────────────────────────────────────────────────────────────\n\nexport function i18nBinding(cfg: I18nViaConfig): ViaBinding {\n  return {\n    brand: 'i18n',\n    posture: { encryptedAtRest: 'envelope', queryable: 'full', exportable: true, forgettable: true },\n    // DictionaryHandle's `_dict_*` reserved collections (#629 Task 4) — the\n    // codec boundary's `reservedEnvelopes` door may address any collection\n    // name under this prefix.\n    reservedPrefixes: ['_dict_'],\n    covers: (field) =>\n      (cfg.i18nFields !== undefined && field in cfg.i18nFields)\n      || (cfg.dictKeyFields !== undefined && field in cfg.dictKeyFields),\n    encodeWrite: async (record, ctx) => runI18nWriteStages(record, ctx, cfg),\n    present: async (record, ctx) => runI18nPresent(record, ctx, cfg),\n    describeFragment: () => buildI18nDescribeFragment(cfg),\n  }\n}\n\nexport function linkI18nVia(): void {\n  installViaBinder('i18n', (c) => i18nBinding(c as I18nViaConfig))\n}\n","/**\n * i18nText schema type —\n *\n * `i18nText({ languages, required })` creates a descriptor for a\n * multi-language content field whose value is stored as a\n * `{ [locale]: string }` map (e.g. `{ en: 'Consulting', th: 'ที่ปรึกษา' }`).\n *\n * On put, the descriptor validates that required languages are present.\n * On read (when a `locale` option is passed), the map is collapsed to the\n * caller's locale string via the fallback chain.\n *\n * Design decisions\n * ────────────────\n *\n * **Descriptor pattern (not a Zod type).**\n * `i18nText()` returns a plain descriptor object used in the collection's\n * `i18nFields` option — same pattern as `ref()` / `dictKey()`. This keeps\n * `@noy-db/core` at zero runtime dependencies and avoids Zod v3 field-type\n * constraints. TypeScript inference is handled via the descriptor's type.\n *\n * **Enforcement at the collection boundary.**\n * The `required` option is checked by `Collection.put()` via the compartment's\n * registered `i18nFields`. Failed validation throws `MissingTranslationError`\n * — a distinct class from `SchemaValidationError` so callers can tell\n * \"wrong shape\" from \"missing translations\".\n *\n * **Resolution is post-decryption.**\n * Locale resolution happens AFTER `decryptRecord()`, as a pure in-memory\n * transform. No additional crypto work is needed. The resolved record is\n * returned in place of the stored one, with i18nText fields replaced by\n * their locale-resolved strings.\n *\n * **`locale: 'raw'`.**\n * Passing `{ locale: 'raw' }` skips resolution and returns the full\n * `{ [locale]: string }` map — useful for bilingual exports, admin UIs,\n * and any context where all translations must be visible at once.\n *\n * **Out of scope.**\n * Pluralization, RTL rendering, date/number formatting, per-locale CRDT\n * merging.\n */\n\nimport { MissingTranslationError, LocaleNotSpecifiedError } from '../../kernel/errors.js'\nimport type { OnMissing, OnMissingPolicy, Layer } from './policy.js'\nimport { resolvePolicy } from './policy.js'\nimport { inferScripts } from './script.js'\nimport { linkI18nVia } from './binding.js'\n\n// ─── I18nMap type helper ───────────────────────────────────────────────\n\n/** Flatten an intersection into a single object literal for nicer hovers. */\ntype Prettify<T> = { [K in keyof T]: T[K] } & {}\n\n/**\n * The stored shape of a multilingual field, inferred from its `required`\n * mode — so the compiler forces you to handle an absent optional locale\n * (`string | undefined`) instead of silently yielding `undefined`.\n *\n * Mirrors `i18nText({ languages, required })`:\n * - `'all'` (default) — every locale required: `{ th: string; en: string }`\n * - `'any'`           — every locale optional: `{ th?: string; en?: string }`\n *   (the \"at least one present\" guarantee is runtime-only — not expressible\n *   in TypeScript — so each key is optional)\n * - `readonly L[]`    — listed locales required, the rest optional:\n *   `I18nMap<'th'|'en', ['th']>` → `{ th: string; en?: string }`\n *\n * @example\n * ```ts\n * type Lang = 'th' | 'en'\n * interface Contact {\n *   name: I18nMap<Lang, 'any'>      // { th?: string; en?: string }\n *   legalName: I18nMap<Lang, ['th']> // { th: string; en?: string }\n *   slug: I18nMap<Lang>             // { th: string; en: string }\n * }\n * ```\n *\n * @public\n */\nexport type I18nMap<\n  Langs extends string,\n  Required extends 'all' | 'any' | readonly Langs[] = 'all',\n> = Required extends 'all'\n  ? Record<Langs, string>\n  : Required extends 'any'\n    ? Partial<Record<Langs, string>>\n    : Required extends readonly (infer R extends Langs)[]\n      ? Prettify<Record<R, string> & Partial<Record<Exclude<Langs, R>, string>>>\n      : never\n\n// ─── i18nText descriptor ───────────────────────────────────────────────\n\n/**\n * Options for `i18nText()`.\n *\n * `languages` declares the full set of supported locales. `required`\n * controls which must be present on every `put()`.\n *\n * `autoTranslate` is the per-field opt-in for the `plaintextTranslator`\n * hook. When `true` and a `plaintextTranslator` is configured\n * on `createNoydb()`, missing translations are generated before `put()`.\n * Default: `false`.\n */\nexport interface I18nTextOptions {\n  /** All supported locale codes (BCP 47). */\n  readonly languages: readonly string[]\n  /**\n   * Which locales must be present on every `put()`.\n   *\n   * - `'all'`       — every declared language must be present.\n   * - `'any'`       — at least one declared language must be present.\n   * - `string[]`    — listed locales are required; others are optional.\n   */\n  readonly required: 'all' | 'any' | readonly string[]\n  /**\n   * Per-field opt-in for the `plaintextTranslator` hook.\n   * When `true`, missing required translations are auto-generated\n   * before `put()` if a translator is configured. Default: `false`.\n   */\n  readonly autoTranslate?: boolean\n  /**\n   * What to do when this field is resolved to a locale that is absent.\n   * A single policy, or a per-layer map (read/guard/join/mv/derivation/\n   * export). Default `'throw'` — today's behavior, zero breaking change.\n   * See {@link OnMissingPolicy}.\n   *\n   * NOTE (current wiring): ALL layers are enforced — `read` (`get`/`list`),\n   * `guard`, `derivation`, `mv`, `join`, `export`. Guard / derivation\n   * `ctx.vault` reads resolve under their own layer policy (`guard` defaults to\n   * the lenient `'substitute'`). The `mv` layer fires for materialized views\n   * that declare `{ i18nLocale, i18nFields }` — UNION (group-key i18n fields\n   * resolve before the unified-row bucketing) and query-form (resolved in\n   * `GroupedReduction.run` before `groupAndReduce`); grouping a raw i18n field\n   * without a locale throws. The `join` layer resolves a joined right-side i18n\n   * field to the query locale (`toArray({ locale })` or the vault default; raw\n   * when locale-less). The `export` layer fires for\n   * `exportStream`/`exportJSON({ resolveLabels })` — records collapse to the\n   * export locale.\n   */\n  readonly onMissing?: OnMissingPolicy\n  /**\n   * Ordered preferred-substitute locales used when `onMissing` resolves\n   * to `'substitute'` and the target locale is absent. `'any'` as an\n   * element means \"first non-empty value\". A caller-supplied `fallback`\n   * at read time takes precedence over this declared list.\n   */\n  readonly substitute?: readonly string[]\n  /**\n   * Smart-substitute. When `true`, a missing-locale `substitute` walk that\n   * misses the explicit chain prefers the available locale whose script is\n   * nearest the target (same script, then Latin) rather than an arbitrary value\n   * — e.g. a missing Thai label prefers another Thai (or Latin) translation over\n   * an unreadable script. Default `false` (legacy first-non-empty behavior).\n   */\n  readonly smartSubstitute?: boolean\n  /**\n   * Per-locale script enforcement (write-time). `'auto'` infers the\n   * allowed Unicode scripts per locale (asymmetric Latin tolerance); an\n   * object overrides per slot. Absent ⇒ no check. See `./script.ts`.\n   */\n  readonly script?: 'auto' | Partial<Record<string, readonly string[]>>\n  /**\n   * What to do when a slot's value contains characters outside its\n   * allowed script set. Default `'reject'`.\n   */\n  readonly onScriptViolation?: 'reject' | 'filter' | 'warn'\n  /**\n   * Eager-fill empty locale slots from the substitute chain at\n   * write time, recording provenance in the internal `_i18nFilled` marker.\n   * Mutually exclusive with an EXPLICIT `'throw'` onMissing policy (densify\n   * fills every hole, so a throw would be unreachable). Without an explicit\n   * `substitute`, fills from `'any'` (first non-empty). Default absent.\n   */\n  readonly densifyOnWrite?: boolean\n}\n\n/**\n * Descriptor returned by `i18nText()`. Attach to the collection's\n * `i18nFields` option:\n *\n * ```ts\n * const lineItems = company.collection<LineItem>('line-items', {\n *   i18nFields: {\n *     description: i18nText({ languages: ['en', 'th'], required: 'all' }),\n *   },\n * })\n * ```\n */\nexport interface I18nTextDescriptor {\n  readonly _noydbI18nText: true\n  /** Via port brand marker — lets an `I18nTextDescriptor` satisfy the kernel's opaque `ViaDescriptor` (#623 Task 9). */\n  readonly _viaBrand: 'i18n'\n  readonly options: I18nTextOptions\n}\n\n/**\n * Create an `I18nTextDescriptor` for a multi-language content field.\n *\n * @param options  Language list + enforcement mode.\n *\n * @example\n * ```ts\n * i18nText({ languages: ['en', 'th'], required: 'all' })\n * i18nText({ languages: ['en', 'th'], required: ['th'], autoTranslate: true })\n * ```\n */\nexport function i18nText(options: I18nTextOptions): I18nTextDescriptor {\n  // The declaration is the Via binding's opt-in unit (#553): constructing\n  // a descriptor statically links the i18n binding into the kernel's Via\n  // port, so every later kernel consultation finds it already installed.\n  linkI18nVia()\n  if (options.densifyOnWrite === true && hasThrowPolicy(options.onMissing)) {\n    throw new Error(\n      `i18nText: densifyOnWrite cannot be combined with an explicit onMissing 'throw' ` +\n        `policy — densify fills every empty slot, so a 'throw' would be unreachable. ` +\n        `Remove the 'throw' policy or disable densifyOnWrite.`,\n    )\n  }\n  return { _noydbI18nText: true, _viaBrand: 'i18n', options }\n}\n\n/** True when `onMissing` declares `'throw'` for any layer (scalar or per-layer). */\nfunction hasThrowPolicy(onMissing: OnMissingPolicy | undefined): boolean {\n  if (onMissing === undefined) return false\n  if (typeof onMissing === 'string') return onMissing === 'throw'\n  return Object.values(onMissing).includes('throw')\n}\n\n// `isI18nTextDescriptor` now lives on the kernel port (#623 Task 11,\n// port/with/i18n-strategy.ts, alongside `isStaticDictDescriptor`) —\n// re-exported here for compat with existing importers of this module.\nexport { isI18nTextDescriptor } from '../../port/with/i18n-strategy.js'\n\n// ─── Validation helpers ────────────────────────────────────────────────\n\n/**\n * Validate that a value is a valid `{ [locale]: string }` map and that\n * all required locales are present. Throws `MissingTranslationError`\n * when the required constraint is violated.\n *\n * Called by `Collection.put()` for each registered `i18nField`.\n *\n * @param value       The raw field value from the record being put.\n * @param field       The field name (used in the thrown error message).\n * @param descriptor  The `i18nText()` descriptor for this field.\n */\nexport function validateI18nTextValue(\n  value: unknown,\n  field: string,\n  descriptor: I18nTextDescriptor,\n): void {\n  const { options } = descriptor\n\n  // Must be a non-null object\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n    throw new MissingTranslationError(\n      field,\n      options.languages,\n      `Field \"${field}\" must be a { [locale]: string } map, got ${typeof value}.`,\n    )\n  }\n\n  const map = value as Record<string, unknown>\n\n  // All values must be strings\n  for (const [locale, v] of Object.entries(map)) {\n    if (typeof v !== 'string') {\n      throw new MissingTranslationError(\n        field,\n        [locale],\n        `Field \"${field}\": locale \"${locale}\" must be a string, got ${typeof v}.`,\n      )\n    }\n  }\n\n  // Check required constraint\n  const { required } = options\n  if (required === 'all') {\n    const missing = options.languages.filter(\n      (lang) => !(lang in map) || map[lang] === '',\n    )\n    if (missing.length > 0) {\n      throw new MissingTranslationError(\n        field,\n        missing,\n        `Field \"${field}\" requires all declared languages. Missing: ${missing.join(', ')}.`,\n      )\n    }\n  } else if (required === 'any') {\n    const present = options.languages.some(\n      (lang) => lang in map && map[lang] !== '',\n    )\n    if (!present) {\n      throw new MissingTranslationError(\n        field,\n        options.languages,\n        `Field \"${field}\" requires at least one declared language. None present.`,\n      )\n    }\n  } else {\n    // string[] — named required locales; TypeScript narrows required to readonly string[]\n    const requiredList = required\n    const missing = requiredList.filter(\n      (lang) => !(lang in map) || map[lang] === '',\n    )\n    if (missing.length > 0) {\n      throw new MissingTranslationError(\n        field,\n        missing,\n        `Field \"${field}\" requires: ${requiredList.join(', ')}. Missing: ${missing.join(', ')}.`,\n      )\n    }\n  }\n}\n\n// ─── Locale resolution ─────────────────────────────────────────────────\n\n/**\n * Resolve an i18nText value (`{ [locale]: string }` map) to a string\n * for the given locale.\n *\n * @param value    The stored locale map.\n * @param locale   The requested locale code, or `'raw'` to return the map.\n * @param fallback Single locale or ordered list; use `'any'` as the last\n *                 element to fall back to any available translation.\n * @param field    Field name used in `LocaleNotSpecifiedError` messages.\n * @returns The resolved string, OR the original map when `locale === 'raw'`.\n */\n/** Options for the policy-aware form of {@link resolveI18nText}. */\nexport interface ResolveI18nOptions {\n  /** Effective policy for the resolution layer. Default `'throw'`. */\n  readonly policy?: OnMissing\n  /** Declared substitute chain; applied only under policy `'substitute'`. */\n  readonly substitute?: readonly string[]\n  /**\n   * Smart-substitute. When `true` and policy is `'substitute'`, after the\n   * explicit chain misses, pick the available locale whose script is nearest the\n   * target (same script first, then Latin's broad readability) instead of an\n   * arbitrary value. Default `false`.\n   */\n  readonly smartSubstitute?: boolean\n}\n\n/** Normalize a single-or-list fallback into an array. */\nfunction toChain(fallback: string | readonly string[] | undefined): readonly string[] {\n  return Array.isArray(fallback) ? fallback : fallback ? [fallback as string] : []\n}\n\n/** Walk a chain, returning the first non-empty value (or `'any'` match). */\nfunction pickFromChain(\n  value: Record<string, string>,\n  chain: readonly string[],\n): string | undefined {\n  for (const fb of chain) {\n    if (fb === 'any') {\n      const any = Object.values(value).find((v) => v !== '')\n      if (any !== undefined) return any\n    } else if (value[fb] !== undefined && value[fb] !== '') {\n      return value[fb]\n    }\n  }\n  return undefined\n}\n\n// Legacy 4-arg form: can only throw or return — never null. Keeps every\n// existing call site's type unchanged (default policy is 'throw').\nexport function resolveI18nText(\n  value: Record<string, string>,\n  locale: string,\n  fallback?: string | readonly string[],\n  field?: string,\n): string | Record<string, string>\n// Policy-aware form: may return null under 'null'/'substitute' policies.\nexport function resolveI18nText(\n  value: Record<string, string>,\n  locale: string,\n  fallback: string | readonly string[] | undefined,\n  field: string | undefined,\n  opts: ResolveI18nOptions,\n): string | Record<string, string> | null\nexport function resolveI18nText(\n  value: Record<string, string>,\n  locale: string,\n  fallback?: string | readonly string[],\n  field?: string,\n  opts?: ResolveI18nOptions,\n): string | Record<string, string> | null {\n  if (locale === 'raw') {\n    return value\n  }\n\n  if (!locale) {\n    throw new LocaleNotSpecifiedError(field ?? '<unknown>')\n  }\n\n  // Primary locale\n  if (value[locale] !== undefined && value[locale] !== '') {\n    return value[locale]\n  }\n\n  const policy: OnMissing = opts?.policy ?? 'throw'\n\n  // Caller-supplied fallback ALWAYS applies first (backward compat +\n  // explicit read-time override), regardless of policy.\n  const callerChain = toChain(fallback)\n  const callerHit = pickFromChain(value, callerChain)\n  if (callerHit !== undefined) return callerHit\n\n  // Declared substitute applies ONLY under policy 'substitute'.\n  if (policy === 'substitute') {\n    const subHit = pickFromChain(value, toChain(opts?.substitute))\n    if (subHit !== undefined) return subHit\n    // Smart-substitute: after the explicit chain, prefer the script-nearest\n    // available locale over an arbitrary first-non-empty value.\n    if (opts?.smartSubstitute) {\n      const smartHit = pickNearestScript(value, locale)\n      if (smartHit !== undefined) return smartHit\n    }\n  }\n\n  // Exhausted.\n  if (policy === 'throw') {\n    throw new LocaleNotSpecifiedError(\n      field ?? '<unknown>',\n      `No translation available for locale \"${locale}\"` +\n        (callerChain.length > 0 ? ` or fallback chain [${callerChain.join(', ')}]` : '') +\n        '.',\n    )\n  }\n  return null\n}\n\n/**\n * Smart-substitute: among the non-empty locales in `value`, pick the one\n * whose primary script is nearest the target `locale` — same script first, then\n * Latin (broadly readable), then any other — so a missing Thai label falls back\n * to another Thai (or Latin) value rather than, say, an Arabic one. First-seen\n * wins on ties. Returns the value string, or `undefined` when `value` has no\n * non-empty entry.\n */\nfunction pickNearestScript(value: Record<string, string>, target: string): string | undefined {\n  const targetScript = inferScripts(target)[0] ?? 'Latin'\n  let best: { score: number; v: string } | undefined\n  for (const [loc, v] of Object.entries(value)) {\n    if (typeof v !== 'string' || v === '') continue\n    const s = inferScripts(loc)[0] ?? 'Latin'\n    const score = s === targetScript ? 0 : s === 'Latin' ? 1 : 2\n    if (best === undefined || score < best.score) best = { score, v }\n    if (score === 0) break // nothing beats a same-script match\n  }\n  return best?.v\n}\n\n// ─── Path helpers (nested i18nFields like 'address.lineOne') ──────────\n\n// `getAtPath`/`setAtPathInPlace` are generic dotted-path/[]-wildcard record\n// helpers, not i18n logic — moved to `kernel/paths.ts` (Task 7, #623).\n// `getAtPath` re-exported here for compat with existing importers of this\n// module (embeddings/descriptor.ts, search/build-docs.ts); `setAtPathInPlace`\n// is not re-exported — its only consumer (via-i18n/binding.ts) imports it\n// directly from kernel/paths.ts.\nexport { getAtPath } from '../../kernel/paths.js'\n\n/** Recursively resolve i18nText at a single path within a record copy. */\nfunction applyAtPath(\n  obj: Record<string, unknown>,\n  path: string,\n  locale: string,\n  fallback: string | readonly string[] | undefined,\n  opts: ResolveI18nOptions,\n): Record<string, unknown> {\n  const arrayIdx = path.indexOf('[].')\n  if (arrayIdx !== -1) {\n    const arrayKey = path.slice(0, arrayIdx)\n    const restPath = path.slice(arrayIdx + 3)\n    const arr = obj[arrayKey]\n    if (!Array.isArray(arr)) return obj\n    return {\n      ...obj,\n      [arrayKey]: arr.map(item => {\n        if (!item || typeof item !== 'object' || Array.isArray(item)) return item\n        return applyAtPath(item as Record<string, unknown>, restPath, locale, fallback, opts)\n      }),\n    }\n  }\n  const dotIdx = path.indexOf('.')\n  if (dotIdx !== -1) {\n    const head = path.slice(0, dotIdx)\n    const rest = path.slice(dotIdx + 1)\n    const nested = obj[head]\n    if (!nested || typeof nested !== 'object' || Array.isArray(nested)) return obj\n    return {\n      ...obj,\n      [head]: applyAtPath(nested as Record<string, unknown>, rest, locale, fallback, opts),\n    }\n  }\n  const raw = obj[path]\n  if (raw === undefined || raw === null) return obj\n  if (typeof raw !== 'object' || Array.isArray(raw)) return obj\n  return {\n    ...obj,\n    [path]: resolveI18nText(raw as Record<string, string>, locale, fallback, path, opts),\n  }\n}\n\n/**\n * Apply locale resolution to a single record, returning a new copy.\n *\n * For each field registered as an `i18nText` descriptor:\n * - If `locale === 'raw'`, the field value is left as the stored map.\n * - Otherwise, the field value is replaced with the resolved string.\n *\n * Field paths support dot notation (`'address.lineOne'`) and array\n * wildcards (`'contacts[].title'`). Top-level fields work as before.\n *\n * @param record      The decrypted record.\n * @param i18nFields  Map of field path → `I18nTextDescriptor`.\n * @param locale      The requested locale (or `'raw'`).\n * @param fallback    Fallback chain (optional).\n * @param layer       Resolution layer (default `'read'`). Each field's\n *                    `onMissing` policy is resolved for this layer, so the\n *                    same record resolves leniently on a get but strictly\n *                    inside an mv/derivation.\n */\nexport function applyI18nLocale(\n  record: Record<string, unknown>,\n  i18nFields: Record<string, I18nTextDescriptor>,\n  locale: string,\n  fallback?: string | readonly string[],\n  layer: Layer = 'read',\n): Record<string, unknown> {\n  const fieldNames = Object.keys(i18nFields)\n  if (fieldNames.length === 0) return record\n\n  let result = record\n\n  for (const [field, descriptor] of Object.entries(i18nFields)) {\n    const { onMissing, substitute, smartSubstitute } = descriptor.options\n    const opts: ResolveI18nOptions = {\n      policy: resolvePolicy(onMissing, layer),\n      ...(substitute !== undefined ? { substitute } : {}),\n      ...(smartSubstitute ? { smartSubstitute } : {}),\n    }\n    result = applyAtPath(result, field, locale, fallback, opts)\n  }\n\n  // The internal densify provenance marker never leaves the store.\n  result = stripI18nFilled(result)\n\n  return result\n}\n\n/**\n * Sync i18n-text-only present-for-join dressing — the exact `join`-layer\n * partial application `kernel/query/join.ts` used to import and call\n * directly before #626's retirement (#650 Task 6): fixes `fallback`\n * `undefined` and `layer` `'join'`. `via/lookup/snapshot.ts`'s\n * `buildPresentForJoin` composes this with the lookup-label half to build\n * the `JoinableSource.presentForJoin` hook the join executor now calls\n * instead of reaching into this module.\n */\nexport function presentI18nForJoin(\n  record: Record<string, unknown>,\n  i18nFields: Record<string, I18nTextDescriptor>,\n  locale: string,\n): Record<string, unknown> {\n  return applyI18nLocale(record, i18nFields, locale, undefined, 'join')\n}\n\n/**\n * Remove the internal densify provenance marker (`_i18nFilled`) from a\n * read-facing record. NON-mutating: returns the same object when the\n * marker is absent, otherwise a shallow copy without the marker.\n *\n * MUST be applied on every user-facing read return — even locale-less ones,\n * which bypass {@link applyI18nLocale}. MUST NOT be applied on the internal\n * prior-read path (decryptRecord / resolveDensifyPrior), where densify needs\n * the marker.\n */\nexport function stripI18nFilled<T extends Record<string, unknown>>(record: T): T {\n  if (!Object.prototype.hasOwnProperty.call(record, '_i18nFilled')) return record\n  const rest: T = { ...record }\n  delete (rest as Record<string, unknown>)._i18nFilled\n  return rest\n}\n"],"mappings":";;;;;;;;;;;AAyKA,SAAS,WAAW,IAAmB;AACrC,SAAO,IAAI;AAAA,IACT,GAAG,EAAE;AAAA,EAGP;AACF;AAQO,IAAM,UAAwB;AAAA,EACnC,gBAAgB,QAAQ;AAAE,WAAO;AAAA,EAAO;AAAA,EACxC,wBAAwB;AAAE,UAAM,WAAW,2BAA2B;AAAA,EAAE;AAAA,EACxE,cAAc,OAAO;AAAE,WAAO,EAAE,OAAO,UAAU,CAAC,EAAE;AAAA,EAAE;AAAA,EACtD,qBAAqB;AAAE,WAAO,oBAAI,IAAyB;AAAA,EAAE;AAAA,EAC7D,UAAU;AAAA,EAAC;AAAA,EACX,wBAAwB;AAAE,UAAM,WAAW,oBAAoB;AAAA,EAAE;AACnE;AAUO,SAAS,qBAAqB,MAAuB;AAC1D,SAAO,KAAK,WAAW,QAAQ;AACjC;AAGO,SAAS,uBAAuB,GAAuC;AAC5E,SACE,OAAO,MAAM,YACb,MAAM,QACL,EAAqC,qBAAqB;AAE/D;AASO,SAAS,qBAAqB,GAAqC;AACxE,SACE,OAAO,MAAM,YACb,MAAM,QACL,EAAmC,mBAAmB;AAE3D;AAQO,SAAS,oBAAoB,GAAoC;AACtE,SACE,OAAO,MAAM,YACb,MAAM,QACL,EAAkC,kBAAkB;AAEzD;;;AC7NO,SAAS,UAAU,KAA8B,MAAyB;AAC/E,QAAM,WAAW,KAAK,QAAQ,KAAK;AACnC,MAAI,aAAa,IAAI;AACnB,UAAM,WAAW,KAAK,MAAM,GAAG,QAAQ;AACvC,UAAM,WAAW,KAAK,MAAM,WAAW,CAAC;AACxC,UAAM,MAAM,IAAI,QAAQ;AACxB,QAAI,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AACjC,WAAO,IAAI,QAAQ,UAAQ;AACzB,UAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO,CAAC;AACtE,aAAO,UAAU,MAAiC,QAAQ;AAAA,IAC5D,CAAC;AAAA,EACH;AACA,QAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,MAAI,WAAW,IAAI;AACjB,UAAM,OAAO,KAAK,MAAM,GAAG,MAAM;AACjC,UAAM,OAAO,KAAK,MAAM,SAAS,CAAC;AAClC,UAAM,SAAS,IAAI,IAAI;AACvB,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AAC5E,WAAO,UAAU,QAAmC,IAAI;AAAA,EAC1D;AACA,QAAM,MAAM,IAAI,IAAI;AACpB,SAAO,QAAQ,SAAY,CAAC,GAAG,IAAI,CAAC;AACtC;AAOO,SAAS,iBACd,KACA,MACA,OACM;AACN,QAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,MAAI,WAAW,IAAI;AACjB,UAAM,OAAO,KAAK,MAAM,GAAG,MAAM;AACjC,UAAM,OAAO,KAAK,MAAM,SAAS,CAAC;AAClC,UAAM,SAAS,IAAI,IAAI;AACvB,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG;AACpE,qBAAiB,QAAmC,MAAM,KAAK;AAC/D;AAAA,EACF;AACA,MAAI,IAAI,IAAI;AACd;;;ACjBO,SAAS,cACd,WACA,OACW;AACX,QAAM,WACJ,aAAa,OAAO,cAAc,WAAW,UAAU,KAAK,IAAI;AAClE,QAAM,SAAS,OAAO,cAAc,WAAW,YAAY;AAC3D,QAAM,eACJ,UAAU,UAAU,eAAe;AACrC,SAAO,YAAY,gBAAgB,UAAU;AAC/C;;;AClCA,IAAM,aAAa,oBAAI,IAAI;AAAA,EACzB;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAClE;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAClE;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AACxD,CAAC;AAGD,IAAM,eAAkD;AAAA,EACtD,IAAI,CAAC,MAAM;AAAA,EACX,IAAI,CAAC,UAAU,KAAK;AAAA,EACpB,IAAI,CAAC,OAAO,YAAY,UAAU;AAAA,EAClC,IAAI,CAAC,KAAK;AAAA,EACV,IAAI,CAAC,QAAQ;AAAA,EACb,IAAI,CAAC,QAAQ;AAAA,EACb,IAAI,CAAC,QAAQ;AAAA,EACb,IAAI,CAAC,UAAU;AAAA,EACf,IAAI,CAAC,UAAU;AAAA,EACf,IAAI,CAAC,UAAU;AAAA,EACf,IAAI,CAAC,UAAU;AAAA,EACf,IAAI,CAAC,QAAQ;AAAA,EACb,IAAI,CAAC,OAAO;AAAA,EACZ,IAAI,CAAC,YAAY;AAAA,EACjB,IAAI,CAAC,OAAO;AAAA,EACZ,IAAI,CAAC,OAAO;AAAA,EACZ,IAAI,CAAC,KAAK;AAAA,EACV,IAAI,CAAC,SAAS;AAChB;AAGA,IAAM,iBAAoD;AAAA,EACxD,MAAM,CAAC,OAAO;AAAA,EACd,MAAM,CAAC,YAAY,OAAO;AAAA,EAC1B,MAAM,CAAC,OAAO,OAAO;AAAA,EACrB,MAAM,CAAC,OAAO,OAAO;AAAA,EACrB,MAAM,CAAC,QAAQ,OAAO;AAAA,EACtB,MAAM,CAAC,UAAU,OAAO;AAC1B;AAOO,SAAS,aAAa,QAAmC;AAC9D,QAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,QAAM,SAAS,MAAM,KAAK,CAAC,MAAM,kBAAkB,KAAK,CAAC,CAAC;AAC1D,MAAI,UAAU,eAAe,MAAM,EAAG,QAAO,eAAe,MAAM;AAElE,QAAM,QAAQ,MAAM,CAAC,KAAK,IAAI,YAAY;AAC1C,MAAI,WAAW,IAAI,IAAI,EAAG,QAAO,CAAC,OAAO;AACzC,QAAM,UAAU,aAAa,IAAI;AACjC,MAAI,QAAS,QAAO,CAAC,GAAG,SAAS,OAAO;AACxC,SAAO,CAAC,OAAO;AACjB;AAGA,SAAS,WAAW,YAAgC,QAAmC;AACrF,QAAM,SAAS,WAAW,QAAQ;AAClC,MAAI,UAAU,WAAW,QAAQ;AAC/B,UAAM,WAAW,OAAO,MAAM;AAC9B,QAAI,SAAU,QAAO;AAAA,EACvB;AACA,SAAO,aAAa,MAAM;AAC5B;AAGA,IAAM,WAAW,OAAO;AAGxB,SAAS,YAAY,SAAoC;AACvD,QAAM,MAAM,QAAQ,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE;AAC1D,SAAO,IAAI,OAAO,KAAK,QAAQ,GAAG,GAAG,OAAO,GAAG;AACjD;AAGA,SAAS,YAAY,SAAoC;AACvD,QAAM,MAAM,QAAQ,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE;AAC1D,SAAO,IAAI,OAAO,IAAI,QAAQ,GAAG,GAAG,KAAK,GAAG;AAC9C;AAGA,SAAS,gBAAgB,KAAa,SAAoC;AACxE,QAAM,KAAK,YAAY,OAAO;AAC9B,QAAM,MAAgB,CAAC;AACvB,aAAW,MAAM,KAAK;AACpB,QAAI,CAAC,GAAG,KAAK,EAAE,EAAG,KAAI,KAAK,EAAE;AAC7B,QAAI,IAAI,UAAU,EAAG;AAAA,EACvB;AACA,SAAO,IAAI,KAAK,EAAE;AACpB;AAGA,SAAS,gBAAgB,KAAa,SAAoC;AACxE,QAAM,KAAK,YAAY,OAAO;AAC9B,MAAI,MAAM;AACV,aAAW,MAAM,IAAK,KAAI,GAAG,KAAK,EAAE,EAAG,QAAO;AAC9C,SAAO;AACT;AAkBO,SAAS,cACd,OACA,OACA,YACA,QAC+D;AAC/D,QAAM,MAAM,WAAW;AACvB,MAAI,CAAC,IAAI,OAAQ,QAAO,EAAE,OAAO,UAAU,CAAC,EAAE;AAE9C,QAAM,OAAO,IAAI,qBAAqB;AACtC,QAAM,WAA4B,CAAC;AACnC,MAAI,MAAM;AAEV,aAAW,CAAC,QAAQ,GAAG,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,QAAI,QAAQ,IAAI,MAAM,EAAG;AACzB,QAAI,OAAO,QAAQ,SAAU;AAC7B,UAAM,UAAU,WAAW,YAAY,MAAM;AAC7C,QAAI,YAAY,OAAO,EAAE,KAAK,GAAG,EAAG;AAEpC,UAAM,SAAS,gBAAgB,KAAK,OAAO;AAC3C,QAAI,SAAS,UAAU;AACrB,YAAM,IAAI,qBAAqB,OAAO,QAAQ,SAAS,MAAM;AAAA,IAC/D;AACA,aAAS,KAAK,EAAE,OAAO,QAAQ,UAAU,SAAS,OAAO,CAAC;AAC1D,QAAI,SAAS,UAAU;AACrB,UAAI,QAAQ,MAAO,OAAM,EAAE,GAAG,MAAM;AACpC,UAAI,MAAM,IAAI,gBAAgB,KAAK,OAAO;AAAA,IAC5C;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,KAAK,SAAS;AAChC;;;AClHA,eAAe,qBACb,QACA,YACA,KACe;AACf,aAAW,CAAC,OAAO,UAAU,KAAK,OAAO,QAAQ,UAAU,GAAG;AAC5D,QAAI,CAAC,WAAW,QAAQ,cAAe;AAGvC,UAAM,aAAa,UAAU,QAAQ,KAAK;AAC1C,QAAI,WAAW,WAAW,EAAG;AAC7B,UAAM,QAAQ,WAAW,CAAC;AAC1B,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG;AACjE,UAAM,MAAM;AAIZ,UAAM,EAAE,WAAW,SAAS,IAAI,WAAW;AAC3C,UAAM,UAAoB,UAAU;AAAA,MAClC,CAAC,SAAS,EAAE,QAAQ,QAAQ,IAAI,IAAI,MAAM;AAAA,IAC5C;AACA,QAAI,QAAQ,WAAW,EAAG;AAE1B,UAAM,eAAe,UAAU,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,MAAM,EAAE;AACpE,QAAI,CAAC,aAAc;AACnB,QAAI,CAAC,IAAI,mBAAmB;AAC1B,YAAM,IAAI,6BAA6B,OAAO,IAAI,cAAc;AAAA,IAClE;AAEA,UAAM,cACJ,aAAa,QACT,CAAC,IACD,aAAa,QACX,UACA,QAAQ,OAAO,CAAC,MAAM,SAAS,SAAS,CAAC,CAAC;AAClD,UAAM,aAAa,EAAE,GAAG,IAAI;AAC5B,eAAW,gBAAgB,aAAa;AACtC,iBAAW,YAAY,IAAI,MAAM,IAAI;AAAA,QACnC,IAAI,YAAY;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,QACA,IAAI;AAAA,MACN;AAAA,IACF;AACA,qBAAiB,QAAQ,OAAO,UAAU;AAAA,EAC5C;AACF;AASA,SAAS,yBACP,QACA,YACA,UACA,aACA,KACA,KACM;AACN,aAAW,CAAC,OAAO,UAAU,KAAK,OAAO,QAAQ,UAAU,GAAG;AAC5D,QAAI,CAAC,WAAW,QAAQ,OAAQ;AAChC,eAAW,QAAQ,UAAU,QAAQ,KAAK,GAAG;AAC3C,UAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG;AAC9D,YAAM,UAAU;AAChB,YAAM,EAAE,OAAO,SAAS,SAAS,IAAI,SAAS;AAAA,QAC5C;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,IAAI,KAAK;AAAA,MACxB;AACA,UAAI,YAAY,QAAS,QAAO,OAAO,SAAS,OAAO;AAIvD,YAAM,OAAO,WAAW,QAAQ;AAChC,UAAI,SAAS,UAAU,SAAS,UAAU;AACxC,mBAAW,KAAK,UAAU;AAExB,cAAI,KAAK,yBAAyB;AAAA,YAChC,OAAO,IAAI;AAAA,YACX,YAAY,IAAI;AAAA,YAChB,IAAI,IAAI;AAAA,YACR;AAAA,YACA,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAMA,eAAe,mBACb,QACA,KACA,KACkC;AAClC,QAAM,aAAa,IAAI;AACvB,QAAM,oBAAoB,IAAI;AAC9B,QAAM,WAAW,IAAI;AAGrB,MAAI,YAAY;AACd,UAAM,qBAAqB,QAAQ,YAAY,GAAG;AAAA,EACpD;AAMA,MAAI;AACJ,MAAI;AACJ,MAAI,mBAAmB;AACrB,mBAAgB,MAAM,IAAI,MAAM,KAAM;AACtC,kBAAc,SAAS,mBAAmB,cAAc,QAAQ,iBAAiB;AAAA,EACnF;AAGA,MAAI,YAAY;AACd,6BAAyB,QAAQ,YAAY,UAAU,aAAa,KAAK,GAAG;AAAA,EAC9E;AAKA,MAAI,mBAAmB,MAAM;AAI7B,MAAI,mBAAmB;AACrB,aAAS,QAAQ,QAAQ,cAAc,iBAAiB;AAAA,EAC1D;AAEA,SAAO;AACT;AAWA,eAAe,eACb,QACA,KACA,KACkC;AAClC,QAAM,aAAa,IAAI;AACvB,QAAM,gBAAgB,IAAI;AAC1B,QAAM,WAAW,IAAI;AACrB,QAAM,UAAU,eAAe,UAAa,OAAO,KAAK,UAAU,EAAE,SAAS;AAC7E,QAAM,UAAU,kBAAkB,UAAa,OAAO,KAAK,aAAa,EAAE,SAAS;AACnF,MAAI,CAAC,WAAW,CAAC,QAAS,QAAO;AAEjC,QAAM,SAAS,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS;AAC7D,QAAM,WAAW,IAAI;AACrB,QAAM,QAAQ,IAAI;AAElB,MAAI,SAAS;AASb,QAAM,mBACJ,WACA,kBAAkB,UAClB,OAAO,OAAO,aAAa,EAAE;AAAA,IAC3B,CAAC,MAAM,uBAAuB,CAAC,KAAK,EAAE,kBAAkB;AAAA,EAC1D;AAKF,MAAI,CAAC,UAAU,CAAC,iBAAkB,QAAO,gBAAgB,MAAM;AAM/D,MAAI,UAAU,WAAW,YAAY;AACnC,aAAS,SAAS,gBAAgB,QAAQ,YAAY,QAAQ,UAAU,KAAK;AAAA,EAC/E;AAGA,MAAI,WAAW,iBAAiB,IAAI,qBAAqB,WAAW,OAAO;AACzE,UAAM,aAAa,EAAE,GAAG,OAAO;AAC/B,UAAM,WAAW,IAAI;AACrB,eAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,aAAa,GAAG;AAKzD,YAAM,SAAS,KAAK,YAAY,cAAc,KAAK,WAAW,KAAK,IAAI;AACvE,YAAM,gBACJ,WAAW,eACN,YAAY,KAAK,aAClB;AAKN,YAAM,YACJ,WACC,uBAAuB,IAAI,IAAI,KAAK,gBAAgB;AAGvD,YAAM,aAAa,OAAO,QAAwC;AAChE,YAAI,CAAC,WAAW;AACd,cAAI,WAAW,SAAS;AACtB,kBAAM,IAAI;AAAA,cACR;AAAA,cACA,YAAY,KAAK,uCAAuC,GAAG;AAAA,YAC7D;AAAA,UACF;AACA,iBAAO;AAAA,QACT;AACA,cAAM,QAAQ,MAAM,SAAS,KAAK,MAAM,KAAK,WAAW,aAAa;AACrE,YAAI,UAAU,QAAW;AACvB,cAAI,WAAW,SAAS;AACtB,kBAAM,IAAI;AAAA,cACR;AAAA,cACA,YAAY,KAAK,wBAAwB,GAAG,gBAAgB,SAAS;AAAA,YACvE;AAAA,UACF;AACA,iBAAO;AAAA,QACT;AACA,eAAO;AAAA,MACT;AAEA,UAAI,MAAM,SAAS,KAAK,GAAG;AAGzB,cAAM,QAAQ,MAAM,MAAM,KAAK;AAC/B,cAAM,WAAW,MAAM,CAAC;AACxB,cAAM,OAAO,MAAM,CAAC;AACpB,YAAI,CAAC,QAAQ,KAAK,SAAS,GAAG,EAAG;AACjC,cAAM,MAAO,WAAuC,QAAQ;AAC5D,YAAI,CAAC,MAAM,QAAQ,GAAG,EAAG;AACzB,cAAM,WAAW,GAAG,IAAI;AACvB,QAAC,WAAuC,QAAQ,IAAI,MAAM,QAAQ;AAAA,UACjE,IAAI,IAAI,OAAO,OAAO;AACpB,gBAAI,CAAC,MAAM,OAAO,OAAO,YAAY,MAAM,QAAQ,EAAE,EAAG,QAAO;AAC/D,kBAAM,IAAK,GAA+B,IAAI;AAC9C,gBAAI,OAAO,MAAM,SAAU,QAAO;AAClC,mBAAO,EAAE,GAAI,IAAgC,CAAC,QAAQ,GAAG,MAAM,WAAW,CAAC,EAAE;AAAA,UAC/E,CAAC;AAAA,QACH;AACA;AAAA,MACF;AAEA,YAAM,MAAM,OAAO,KAAK;AACxB,UAAI,MAAM,QAAQ,GAAG,GAAG;AAEtB,mBAAW,GAAG,KAAK,OAAO,IAAI,MAAM,QAAQ;AAAA,UAC1C,IAAI,IAAI,OAAO,OAAO;AAAA,YACpB,KAAK;AAAA,YACL,OAAO,OAAO,MAAM,WAAW,MAAM,WAAW,CAAC,IAAI;AAAA,UACvD,EAAE;AAAA,QACJ;AAAA,MACF,WAAW,OAAO,QAAQ,UAAU;AAClC,cAAM,QAAQ,MAAM,WAAW,GAAG;AAGlC,YAAI,UAAU,KAAM,YAAW,GAAG,KAAK,OAAO,IAAI;AAAA,MACpD;AAAA,IACF;AACA,aAAS;AAAA,EACX;AAKA,SAAO,gBAAgB,MAAM;AAC/B;AAIA,SAAS,0BAA0B,KAA6C;AAC9E,SAAO;AAAA,IACL,YAAY,IAAI,aAAa,OAAO,KAAK,IAAI,UAAU,IAAI,CAAC;AAAA,IAC5D,eAAe,IAAI,gBAAgB,OAAO,KAAK,IAAI,aAAa,IAAI,CAAC;AAAA,IACrE,GAAI,IAAI,kBAAkB,SAAY,EAAE,eAAe,IAAI,cAAc,IAAI,CAAC;AAAA,EAChF;AACF;AAIO,SAAS,YAAY,KAAgC;AAC1D,SAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS,EAAE,iBAAiB,YAAY,WAAW,QAAQ,YAAY,MAAM,aAAa,KAAK;AAAA;AAAA;AAAA;AAAA,IAI/F,kBAAkB,CAAC,QAAQ;AAAA,IAC3B,QAAQ,CAAC,UACN,IAAI,eAAe,UAAa,SAAS,IAAI,cAC1C,IAAI,kBAAkB,UAAa,SAAS,IAAI;AAAA,IACtD,aAAa,OAAO,QAAQ,QAAQ,mBAAmB,QAAQ,KAAK,GAAG;AAAA,IACvE,SAAS,OAAO,QAAQ,QAAQ,eAAe,QAAQ,KAAK,GAAG;AAAA,IAC/D,kBAAkB,MAAM,0BAA0B,GAAG;AAAA,EACvD;AACF;AAEO,SAAS,cAAoB;AAClC,mBAAiB,QAAQ,CAAC,MAAM,YAAY,CAAkB,CAAC;AACjE;;;AC1KO,SAAS,SAAS,SAA8C;AAIrE,cAAY;AACZ,MAAI,QAAQ,mBAAmB,QAAQ,eAAe,QAAQ,SAAS,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,SAAO,EAAE,gBAAgB,MAAM,WAAW,QAAQ,QAAQ;AAC5D;AAGA,SAAS,eAAe,WAAiD;AACvE,MAAI,cAAc,OAAW,QAAO;AACpC,MAAI,OAAO,cAAc,SAAU,QAAO,cAAc;AACxD,SAAO,OAAO,OAAO,SAAS,EAAE,SAAS,OAAO;AAClD;AAoBO,SAAS,sBACd,OACA,OACA,YACM;AACN,QAAM,EAAE,QAAQ,IAAI;AAGpB,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,UAAU,KAAK,6CAA6C,OAAO,KAAK;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,MAAM;AAGZ,aAAW,CAAC,QAAQ,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC7C,QAAI,OAAO,MAAM,UAAU;AACzB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,CAAC,MAAM;AAAA,QACP,UAAU,KAAK,cAAc,MAAM,2BAA2B,OAAO,CAAC;AAAA,MACxE;AAAA,IACF;AAAA,EACF;AAGA,QAAM,EAAE,SAAS,IAAI;AACrB,MAAI,aAAa,OAAO;AACtB,UAAM,UAAU,QAAQ,UAAU;AAAA,MAChC,CAAC,SAAS,EAAE,QAAQ,QAAQ,IAAI,IAAI,MAAM;AAAA,IAC5C;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,UAAU,KAAK,+CAA+C,QAAQ,KAAK,IAAI,CAAC;AAAA,MAClF;AAAA,IACF;AAAA,EACF,WAAW,aAAa,OAAO;AAC7B,UAAM,UAAU,QAAQ,UAAU;AAAA,MAChC,CAAC,SAAS,QAAQ,OAAO,IAAI,IAAI,MAAM;AAAA,IACzC;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,QACA,QAAQ;AAAA,QACR,UAAU,KAAK;AAAA,MACjB;AAAA,IACF;AAAA,EACF,OAAO;AAEL,UAAM,eAAe;AACrB,UAAM,UAAU,aAAa;AAAA,MAC3B,CAAC,SAAS,EAAE,QAAQ,QAAQ,IAAI,IAAI,MAAM;AAAA,IAC5C;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,UAAU,KAAK,eAAe,aAAa,KAAK,IAAI,CAAC,cAAc,QAAQ,KAAK,IAAI,CAAC;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AACF;AA+BA,SAAS,QAAQ,UAAqE;AACpF,SAAO,MAAM,QAAQ,QAAQ,IAAI,WAAW,WAAW,CAAC,QAAkB,IAAI,CAAC;AACjF;AAGA,SAAS,cACP,OACA,OACoB;AACpB,aAAW,MAAM,OAAO;AACtB,QAAI,OAAO,OAAO;AAChB,YAAM,MAAM,OAAO,OAAO,KAAK,EAAE,KAAK,CAAC,MAAM,MAAM,EAAE;AACrD,UAAI,QAAQ,OAAW,QAAO;AAAA,IAChC,WAAW,MAAM,EAAE,MAAM,UAAa,MAAM,EAAE,MAAM,IAAI;AACtD,aAAO,MAAM,EAAE;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;AAkBO,SAAS,gBACd,OACA,QACA,UACA,OACA,MACwC;AACxC,MAAI,WAAW,OAAO;AACpB,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,wBAAwB,SAAS,WAAW;AAAA,EACxD;AAGA,MAAI,MAAM,MAAM,MAAM,UAAa,MAAM,MAAM,MAAM,IAAI;AACvD,WAAO,MAAM,MAAM;AAAA,EACrB;AAEA,QAAM,SAAoB,MAAM,UAAU;AAI1C,QAAM,cAAc,QAAQ,QAAQ;AACpC,QAAM,YAAY,cAAc,OAAO,WAAW;AAClD,MAAI,cAAc,OAAW,QAAO;AAGpC,MAAI,WAAW,cAAc;AAC3B,UAAM,SAAS,cAAc,OAAO,QAAQ,MAAM,UAAU,CAAC;AAC7D,QAAI,WAAW,OAAW,QAAO;AAGjC,QAAI,MAAM,iBAAiB;AACzB,YAAM,WAAW,kBAAkB,OAAO,MAAM;AAChD,UAAI,aAAa,OAAW,QAAO;AAAA,IACrC;AAAA,EACF;AAGA,MAAI,WAAW,SAAS;AACtB,UAAM,IAAI;AAAA,MACR,SAAS;AAAA,MACT,wCAAwC,MAAM,OAC3C,YAAY,SAAS,IAAI,uBAAuB,YAAY,KAAK,IAAI,CAAC,MAAM,MAC7E;AAAA,IACJ;AAAA,EACF;AACA,SAAO;AACT;AAUA,SAAS,kBAAkB,OAA+B,QAAoC;AAC5F,QAAM,eAAe,aAAa,MAAM,EAAE,CAAC,KAAK;AAChD,MAAI;AACJ,aAAW,CAAC,KAAK,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC5C,QAAI,OAAO,MAAM,YAAY,MAAM,GAAI;AACvC,UAAM,IAAI,aAAa,GAAG,EAAE,CAAC,KAAK;AAClC,UAAM,QAAQ,MAAM,eAAe,IAAI,MAAM,UAAU,IAAI;AAC3D,QAAI,SAAS,UAAa,QAAQ,KAAK,MAAO,QAAO,EAAE,OAAO,EAAE;AAChE,QAAI,UAAU,EAAG;AAAA,EACnB;AACA,SAAO,MAAM;AACf;AAaA,SAAS,YACP,KACA,MACA,QACA,UACA,MACyB;AACzB,QAAM,WAAW,KAAK,QAAQ,KAAK;AACnC,MAAI,aAAa,IAAI;AACnB,UAAM,WAAW,KAAK,MAAM,GAAG,QAAQ;AACvC,UAAM,WAAW,KAAK,MAAM,WAAW,CAAC;AACxC,UAAM,MAAM,IAAI,QAAQ;AACxB,QAAI,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO;AAChC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,CAAC,QAAQ,GAAG,IAAI,IAAI,UAAQ;AAC1B,YAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AACrE,eAAO,YAAY,MAAiC,UAAU,QAAQ,UAAU,IAAI;AAAA,MACtF,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,MAAI,WAAW,IAAI;AACjB,UAAM,OAAO,KAAK,MAAM,GAAG,MAAM;AACjC,UAAM,OAAO,KAAK,MAAM,SAAS,CAAC;AAClC,UAAM,SAAS,IAAI,IAAI;AACvB,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO;AAC3E,WAAO;AAAA,MACL,GAAG;AAAA,MACH,CAAC,IAAI,GAAG,YAAY,QAAmC,MAAM,QAAQ,UAAU,IAAI;AAAA,IACrF;AAAA,EACF;AACA,QAAM,MAAM,IAAI,IAAI;AACpB,MAAI,QAAQ,UAAa,QAAQ,KAAM,QAAO;AAC9C,MAAI,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO;AAC1D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,CAAC,IAAI,GAAG,gBAAgB,KAA+B,QAAQ,UAAU,MAAM,IAAI;AAAA,EACrF;AACF;AAqBO,SAAS,gBACd,QACA,YACA,QACA,UACA,QAAe,QACU;AACzB,QAAM,aAAa,OAAO,KAAK,UAAU;AACzC,MAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,MAAI,SAAS;AAEb,aAAW,CAAC,OAAO,UAAU,KAAK,OAAO,QAAQ,UAAU,GAAG;AAC5D,UAAM,EAAE,WAAW,YAAY,gBAAgB,IAAI,WAAW;AAC9D,UAAM,OAA2B;AAAA,MAC/B,QAAQ,cAAc,WAAW,KAAK;AAAA,MACtC,GAAI,eAAe,SAAY,EAAE,WAAW,IAAI,CAAC;AAAA,MACjD,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;AAAA,IAC/C;AACA,aAAS,YAAY,QAAQ,OAAO,QAAQ,UAAU,IAAI;AAAA,EAC5D;AAGA,WAAS,gBAAgB,MAAM;AAE/B,SAAO;AACT;AAWO,SAAS,mBACd,QACA,YACA,QACyB;AACzB,SAAO,gBAAgB,QAAQ,YAAY,QAAQ,QAAW,MAAM;AACtE;AAYO,SAAS,gBAAmD,QAAc;AAC/E,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,QAAQ,aAAa,EAAG,QAAO;AACzE,QAAM,OAAU,EAAE,GAAG,OAAO;AAC5B,SAAQ,KAAiC;AACzC,SAAO;AACT;","names":[]}

package/dist/chunk-A67356IR.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-formula/materialized-views/executor.ts"],"sourcesContent":["import type { Collection } from '../../kernel/collection.js'\nimport type { TxContext } from '../../with-commit/tx/transaction.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport { MaterializedViewTooLargeError, MaterializedViewConfigError, LocaleNotSpecifiedError, JoinTooLargeError } from '../../kernel/errors.js'\nimport { DEFAULT_JOIN_MAX_ROWS } from '../../kernel/query/join.js'\nimport type { MaterializedFromMeta, MVQueryContext, MaterializedViewSpec } from './types.js'\nimport type { RegisteredMV } from './registry.js'\nimport { wrapDbWithPredicates } from './registry.js'\nimport { groupAndReduce } from '../../with-lookup/reduce/groupby.js'\nimport { canonicalGroupKey } from '../../with-lookup/reduce/canonical-key.js'\nimport { applyI18nLocale, type I18nTextDescriptor } from '../../via/i18n/core.js'\nimport { putDerivedOutput, type PutDerivedOutputCtx } from '../../kernel/via/dispatch.js'\n\n/**\n * Accessor shape passed in from the owning Vault. Mirrors v1's\n * `DerivationStaleAccessor` — provides the per-collection resolver\n * and the active TxContext so refresh writes/tombstones register on\n * `_executed` for rollback symmetry.\n */\nexport interface MVExecutorAccessor {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  getCollection(name: string): Collection<any>\n  getActiveTxContext(): TxContext | null\n  /**\n   * Vault-shaped accessor passed to the MV's `query()` callback at\n   * each refresh. Same instance the registry used at registration\n   * time; threading through the executor lets the refresh path\n   * re-evaluate the closure against the live vault state.\n   */\n  getQueryContext(): MVQueryContext\n  /**\n   * #638 Task 5 — ctx for `putDerivedOutput`'s frozen-period skip+audit. #641: the lazy\n   * resolve-on-read caller (`stale.ts#resolveStaleMVOnRead`) now supplies one too — built at\n   * the `Collection.get()`/`list()` entry point with a `'resolve-on-read'` sentinel id (no\n   * real \"reacting write\" for a read-triggered materialize, mirroring `refreshView()`'s\n   * `'refreshView'` sentinel). Still declared optional here since `MVExecutorAccessor` is a\n   * general shape and a future caller could reasonably omit it.\n   */\n  dispatchCtx?: PutDerivedOutputCtx\n}\n\nexport interface RefreshResult {\n  /** Rows newly written / overwritten. */\n  written: number\n  /** Rows tombstoned via `_internalDelete` (only when `onEmpty: 'delete'`). */\n  deleted: number\n  /** Failed row writes (non-strict mode). */\n  failed: number\n  /** #782/#785 — `outputCollection:id` entries from the tombstone pass whose ownership stamp\n   *  couldn't be decoded under the collection's default DEK (undecodable, mirroring\n   *  `invalidateMVAtRest`'s #776 posture) — ownership UNCONFIRMED. Only populated when\n   *  `onEmpty: 'delete'`. */\n  residueUndecodable: string[]\n  /** #782/#785 — `outputCollection:id` entries that decoded, stamp-matched this MV, but\n   *  `_internalDelete` declined (the #718 tier-elevation gate) — ownership CONFIRMED, a real\n   *  silent survival, surfaced rather than dropped. Only populated when `onEmpty: 'delete'`. */\n  residueDeclined: string[]\n}\n\n/** Default cost ceiling — overridable per-MV via `spec.maxRows`. */\nconst DEFAULT_MAX_ROWS = 100_000\n\n/**\n * Materialize a query terminal that may be a `Query<T>` (call\n * `.toArray()`), an `Reduction<R>` (call `.run()` returning a\n * single object — wrap as a one-row array), or a `GroupedReduction<R>`\n * (call `.run()` returning an array of grouped rows). Branches on\n * available terminal at runtime — no type-discrimination at registration.\n */\nasync function materializeQueryResult(\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  q: any,\n  mvName: string,\n  i18nLocale?: string,\n  i18nFields?: Record<string, I18nTextDescriptor>,\n): Promise<ReadonlyArray<Record<string, unknown>>> {\n  if (typeof q?.toArray === 'function') {\n    // Query<T> — non-aggregate path. `.toArray()` returns Promise<T[]>.\n    return await q.toArray()\n  }\n  if (typeof q?.run === 'function') {\n    // Reduction<R> or GroupedReduction<R>. `.run()` is synchronous\n    // and returns either a single object (Reduction) or an array of\n    // rows (GroupedReduction). Promise.resolve() normalizes both\n    // sync and async (future) variants.\n    // Query-form MV grouping: when the MV declares i18nLocale, pass it +\n    // i18nFields so a GroupedReduction resolves i18n group keys before\n    // bucketing (the Reduction path ignores the extra arg).\n    const runOpts = i18nLocale !== undefined ? { locale: i18nLocale, i18nFields } : undefined\n    const result: unknown = await Promise.resolve(q.run(runOpts))\n    if (Array.isArray(result)) {\n      return result as ReadonlyArray<Record<string, unknown>>\n    }\n    // Single-aggregate result — wrap as one-row array. The consumer's\n    // `rowKey()` should return a stable identity (often a literal\n    // constant like `'total'`) since there's only one row.\n    return [result as Record<string, unknown>]\n  }\n  throw new Error(\n    `MV \"${mvName}\": query() must return a Query<T>, Reduction, or GroupedReduction. ` +\n      `Got something without a .toArray() or .run() terminal.`,\n  )\n}\n\n/**\n * Materialize a UNION-form MV: read every arm's source\n * collection, apply each arm's `map` to project rows into the unified\n * MV row shape, concatenate the mapped streams, then optionally run\n * `groupBy` + `aggregate` over the result.\n *\n * Modes (driven by `spec.groupBy` / `spec.aggregate`):\n *\n *   - No `groupBy` → return the concatenated mapped rows unchanged.\n *   - `groupBy` without `aggregate` → dedupe by composite group key,\n *     keep the first row seen per key (later arms don't overwrite\n *     earlier arms — Map insertion order rules).\n *   - `groupBy` + `aggregate` → delegate to the shared `groupAndReduce`\n *     pipeline used by `Query.groupBy().aggregate()`.\n *\n * Per-arm `map` is the schema-unification boundary; the strategy's\n * `TRow` type parameter enforces that every arm projects into the\n * same shape at compile time.\n *\n * @internal\n */\nasync function materializeUnionResult<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n  db: MVQueryContext,\n): Promise<ReadonlyArray<Record<string, unknown>>> {\n  const unified: TRow[] = []\n  for (const arm of spec.unionSources!) {\n    const coll = db.collection<Record<string, unknown>>(arm.collection)\n    // Optional per-arm FK joins: chain `.join(field, { as, ... })` for\n    // each declared leg before terminating. The aliased right-side\n    // record lands at `sourceRow[leg.as]`, where the arm's `map` reads\n    // it. Cast to `any` because the chained join widens the row type but\n    // the executor treats every row as `Record<string, unknown>` — same\n    // pattern the query-form join path uses.\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    let q: any = coll.query()\n    if (arm.join?.length) {\n      for (const leg of arm.join) {\n        q = q.join(leg.field, { as: leg.as, maxRows: leg.maxRows, strategy: leg.strategy })\n      }\n    }\n    const sourceRows = q.toArray() as ReadonlyArray<Record<string, unknown>>\n    for (const r of sourceRows) {\n      const mapped = arm.map(r)\n      // null / undefined means \"omit this source row\" — skip without\n      // pushing so groupBy/aggregate never see a null entry.\n      if (mapped == null) continue\n      unified.push(mapped)\n    }\n  }\n\n  return finalizeMappedRows(spec, unified)\n}\n\n/**\n * Shared post-map tail for the UNION and projection (#810) forms:\n * optional `groupBy` (+ `aggregate`) over the mapped-row stream.\n * Extracted verbatim from `materializeUnionResult` so both forms feed\n * the identical grouping pipeline — i18n group-key resolution, the\n * object-group-key guard, dedup-without-aggregate, and the shared\n * `groupAndReduce` delegate.\n *\n * @internal\n */\nfunction finalizeMappedRows<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n  unified: TRow[],\n): ReadonlyArray<Record<string, unknown>> {\n  if (!spec.groupBy) return unified\n\n  const groupFields: readonly string[] =\n    typeof spec.groupBy === 'string' ? [spec.groupBy] : spec.groupBy\n\n  // i18n-aware group keys. An `i18nText` group field carries a raw\n  // `{ locale: string }` map, an unstable object key. When `i18nLocale` is\n  // declared (with `i18nFields` describing those fields), resolve the declared\n  // group-key i18n fields to it at the `mv` layer FIRST — the same unified-rows\n  // boundary where money is threaded — so buckets are stable strings and the\n  // `mv`-layer `onMissing` policy fires here.\n  if (spec.i18nLocale !== undefined && spec.i18nFields !== undefined) {\n    const groupI18n: Record<string, I18nTextDescriptor> = {}\n    for (const f of groupFields) {\n      const d = spec.i18nFields[f]\n      if (d !== undefined) groupI18n[f] = d\n    }\n    if (Object.keys(groupI18n).length > 0) {\n      for (let i = 0; i < unified.length; i++) {\n        unified[i] = applyI18nLocale(unified[i] as Record<string, unknown>, groupI18n, spec.i18nLocale, undefined, 'mv') as TRow\n      }\n    }\n  }\n  // Guard (always): a remaining object-valued group key — an undeclared i18n\n  // field or a locale-less MV — would bucket on a map. Refuse, don't bucket wrong.\n  for (const f of groupFields) {\n    for (const row of unified) {\n      const v = (row as Record<string, unknown>)[f]\n      if (v !== null && typeof v === 'object') {\n        throw new LocaleNotSpecifiedError(\n          f,\n          `Materialized view \"${spec.name}\" groups by \"${f}\", whose value is a raw i18n locale map — ` +\n            `an unstable object group key. Declare { i18nLocale, i18nFields } on the MV to resolve it at ` +\n            `the 'mv' layer, or group by a dictKey/staticDict code (the stable key) and resolve the label at read time.`,\n        )\n      }\n    }\n  }\n\n  // groupBy without aggregate — dedupe by composite key, keep first\n  // seen row per key. Useful for cross-arm uniqueness (e.g. unify two\n  // sibling collections, keeping one row per natural key).\n  if (!spec.aggregate) {\n    const seen = new Map<string, TRow>()\n    for (const row of unified) {\n      const k = canonicalGroupKey(groupFields, row as Record<string, unknown>)\n      if (!seen.has(k)) seen.set(k, row)\n    }\n    return [...seen.values()]\n  }\n\n  // groupBy + aggregate — delegate to the shared pipeline used by\n  // `Query.groupBy().aggregate()`. Result rows carry each grouped\n  // field in declaration order followed by the spec's reducer outputs.\n  return groupAndReduce<Record<string, unknown>>(unified, groupFields, spec.aggregate, spec.moneyFields)\n}\n\n/**\n * Materialize a projection-form MV (#810): hydrate the primary source\n * rows, resolve forward FK legs through the same `.join()` machinery\n * the UNION arms use, attach reverse \"collect\" legs via one\n * hash-grouped snapshot pass per leg, then run the projection `map`\n * (null / undefined omits the primary row) and the shared post-map\n * grouping tail.\n *\n * @internal\n */\nasync function materializeProjectionResult<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n  db: MVQueryContext,\n): Promise<ReadonlyArray<Record<string, unknown>>> {\n  const projection = spec.projection!\n  const coll = db.collection<Record<string, unknown>>(projection.source)\n  // Forward legs chain through the query builder exactly like UNION arm\n  // joins — ref() resolution, dangling-mode semantics, presentation\n  // dressing, and ceilings all ride the existing `.join()` path. Cast to\n  // `any` for the same reason `materializeUnionResult` does.\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  let q: any = coll.query()\n  for (const leg of projection.joins) {\n    if ('collect' in leg) continue\n    q = q.join(leg.field, { as: leg.as, maxRows: leg.maxRows, strategy: leg.strategy })\n  }\n  let rows = q.toArray() as Array<Record<string, unknown>>\n  for (const leg of projection.joins) {\n    if (!('collect' in leg)) continue\n    rows = applyCollectLeg(rows, leg, spec.name, projection.source, db)\n  }\n  const mapped: TRow[] = []\n  for (const r of rows) {\n    const m = projection.map(r)\n    // null / undefined means \"omit this primary row\" — same contract\n    // as the UNION arm `map`.\n    if (m == null) continue\n    mapped.push(m)\n  }\n  return finalizeMappedRows(spec, mapped)\n}\n\n/**\n * Attach one reverse \"collect\" leg (#810): every row of `leg.collect`\n * whose `leg.on` field references a primary record's id lands in a\n * possibly-empty ARRAY under `leg.as` on that primary row. One\n * snapshot pass over the collect collection, hash-grouped by the `on`\n * FK — O(N+M), mirroring the forward hash-join fallback.\n *\n * Semantic check (first materialization, not factory time — parity\n * with join-time ref errors): `leg.on` must carry a `ref()` declared\n * on the collect collection targeting the projection `source`.\n *\n * @internal\n */\nfunction applyCollectLeg(\n  primaryRows: ReadonlyArray<Record<string, unknown>>,\n  leg: { readonly collect: string; readonly on: string; readonly as: string; readonly maxRows?: number },\n  mvName: string,\n  source: string,\n  db: MVQueryContext,\n): Array<Record<string, unknown>> {\n  const childColl = db.collection<Record<string, unknown>>(leg.collect)\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const childQ = childColl.query() as any\n  const refDesc = childQ._joinContext?.()?.resolveRef(leg.on) as { target: string } | null | undefined\n  if (refDesc == null) {\n    throw new MaterializedViewConfigError(\n      `\"${mvName}\": projection collect leg \"${leg.as}\" requires a ref() on field \"${leg.on}\" of `\n      + `collection \"${leg.collect}\" targeting \"${source}\" — declare `\n      + `refs: { ${leg.on}: ref('${source}') } on collection \"${leg.collect}\", then retry`,\n    )\n  }\n  if (refDesc.target !== source) {\n    throw new MaterializedViewConfigError(\n      `\"${mvName}\": projection collect leg \"${leg.as}\" expects field \"${leg.on}\" of collection `\n      + `\"${leg.collect}\" to reference the projection source \"${source}\", but its ref() targets `\n      + `\"${refDesc.target}\"`,\n    )\n  }\n  const maxRows = leg.maxRows ?? DEFAULT_JOIN_MAX_ROWS\n  const groups = new Map<string, Array<Record<string, unknown>>>()\n  for (const child of childQ.toArray() as Array<Record<string, unknown>>) {\n    const key = coerceCollectKey(child[leg.on])\n    // Nullish / non-scalar FK values mean \"no reference\" — same\n    // narrowing as the forward join path's key coercion.\n    if (key === null) continue\n    const bucket = groups.get(key)\n    if (bucket) bucket.push(child)\n    else groups.set(key, [child])\n  }\n  const out: Array<Record<string, unknown>> = []\n  for (const row of primaryRows) {\n    const key = coerceCollectKey(row.id)\n    const children = key === null ? [] : groups.get(key) ?? []\n    if (children.length > maxRows) {\n      throw new JoinTooLargeError({\n        leftRows: primaryRows.length,\n        rightRows: children.length,\n        maxRows,\n        side: 'right',\n        message:\n          `projection MV \"${mvName}\": collect leg \"${leg.as}\" gathered ${children.length} ` +\n          `\"${leg.collect}\" rows for one \"${source}\" record, exceeding the ${maxRows}-row ` +\n          `per-primary-row ceiling. Raise the ceiling via { maxRows } on the leg if the ` +\n          `fan-out genuinely fits in memory, or restructure the child collection.`,\n      })\n    }\n    out.push({ ...row, [leg.as]: children })\n  }\n  return out\n}\n\n/**\n * Coerce an unknown FK value into a collect-grouping key. Same\n * narrowing as the join path's `coerceRefKey` (not exported from\n * there): strings and numbers are legitimate ref values; anything\n * else is \"no reference\" and returns `null`.\n *\n * @internal\n */\nfunction coerceCollectKey(value: unknown): string | null {\n  if (value === null || value === undefined) return null\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'bigint') return String(value)\n  return null\n}\n\n/**\n * Run an MV's `query()` and write the result rows to the output\n * collection. Same-DEK encryption: routes through the standard\n * `Collection.put` pipeline, so the output collection's DEK is what\n * gets used (matches the v2 spec's \"same DEK as the left-most source\"\n * invariant — `Collection.put` looks up the DEK by collection name,\n * and the output collection IS the MV's owned collection).\n *\n * Stamps `_materializedFrom` onto every emitted row.\n *\n * **Tombstoning:** when `spec.onEmpty: 'delete'` (default), rows\n * that existed in a prior refresh but no longer appear in the new\n * materialized result are deleted via `Collection._internalDelete` —\n * the housekeeping bypass primitive prevents user\n * `onDelete` guards on the output collection from firing on these\n * system-internal deletes. `onEmpty: 'keep'` opts out (rows from\n * prior refreshes linger even when the new result lacks them).\n *\n * **Cost ceiling:** if the materialized row count exceeds\n * `spec.maxRows` (default 100k), throws `MaterializedViewTooLargeError`\n * before any writes hit the store — so strict-mode rollback is\n * clean.\n *\n * **Strict mode:** `spec.strict === true` re-throws on any\n * row-write failure; the active TxContext registration means the\n * source-write rolls back atomically via `revertExecuted`.\n *\n * @internal\n */\nexport const MaterializedViewExecutor = {\n  async refresh(\n    reg: RegisteredMV,\n    accessor: MVExecutorAccessor,\n  ): Promise<RefreshResult> {\n    const spec = reg.spec\n    const outputColl = accessor.getCollection(reg.outputCollection)\n    const maxRows = spec.maxRows ?? DEFAULT_MAX_ROWS\n    const onEmpty = spec.onEmpty ?? 'delete'\n    const strict = spec.strict ?? false\n\n    // 1. Materialize the query (branches on terminal shape). If the\n    //    MV declared predicates, wrap the query context the same way\n    //    the registry did at registration time so `.wherePredicate()`\n    //    calls resolve to the registered functions.\n    const baseCtx = accessor.getQueryContext()\n    const ctxForQuery: MVQueryContext = spec.predicates\n      ? wrapDbWithPredicates(baseCtx, spec.predicates)\n      : baseCtx\n    // UNION-form strategies: read every arm, map to the unified\n    // row shape, concatenate, then optionally groupBy + aggregate.\n    // Projection-form strategies (#810): hydrate the primary source,\n    // attach forward + collect legs, map, then the same optional\n    // grouping tail. The single-source `query()` path is untouched.\n    let rows: ReadonlyArray<Record<string, unknown>>\n    if (spec.unionSources) {\n      rows = await materializeUnionResult(spec, ctxForQuery)\n    } else if (spec.projection) {\n      rows = await materializeProjectionResult(spec, ctxForQuery)\n    } else {\n      const q = spec.query!(ctxForQuery)\n      rows = await materializeQueryResult(q, spec.name, spec.i18nLocale, spec.i18nFields)\n    }\n\n    // #777 — exclude this MV's OWN previously-stamped output rows from the\n    // input scan. A same-collection Query-form MV copies the whole source row\n    // verbatim into its output, so a stale output row can itself satisfy the\n    // MV's own input filter (when the filter is on a field disjoint from the\n    // partition field) and get re-selected as if it were live source — the\n    // row self-perpetuates after its true source is gone. Prior output is\n    // never this MV's own source.\n    rows = rows.filter((row) => {\n      const stamp = row._materializedFrom as { mvName?: string } | undefined\n      return stamp?.mvName !== spec.name\n    })\n\n    // 2. Cost ceiling check BEFORE any writes — keeps the rollback\n    //    clean if the source-write is wrapped in a transaction.\n    if (rows.length > maxRows) {\n      throw new MaterializedViewTooLargeError(spec.name, rows.length, maxRows)\n    }\n\n    const txCtx = accessor.getActiveTxContext()\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const adapter = (outputColl as any).adapter as {\n      get(v: string, c: string, i: string): Promise<EncryptedEnvelope | null>\n    }\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    const vaultName = (outputColl as any).vault as string\n\n    // 3. Compute the post-refresh id set so we can diff against the\n    //    prior-emitted id set for tombstoning (when onEmpty === 'delete').\n    const newIds = new Set<string>()\n    const enrichedRows: Array<{ id: string; record: Record<string, unknown> }> = []\n    for (const row of rows) {\n      const id = spec.rowKey(row)\n      newIds.add(id)\n      const meta: MaterializedFromMeta = {\n        mvName: spec.name,\n        queryHash: reg.queryHash,\n        sourceVersions: {},\n        materializedAt: new Date().toISOString(),\n      }\n      enrichedRows.push({ id, record: { ...row, _materializedFrom: meta } })\n    }\n\n    // 4. Write the new rows.\n    let written = 0\n    let failed = 0\n    for (const { id, record } of enrichedRows) {\n      try {\n        if (txCtx !== null) {\n          const prior = await adapter.get(vaultName, reg.outputCollection, id)\n          txCtx._executed.push({\n            op: { type: 'put', vaultName, collectionName: reg.outputCollection, id },\n            priorEnvelope: prior,\n          })\n        }\n        if (accessor.dispatchCtx) {\n          if (await putDerivedOutput(outputColl, id, record, accessor.dispatchCtx) === 'written') written++\n        } else {\n          await outputColl.put(id, record)\n          written++\n        }\n      } catch (err) {\n        failed++\n        if (strict) throw err\n         \n        console.warn(`[mv] \"${spec.name}\" row write failed:`, err)\n      }\n    }\n\n    // 5. Tombstone rows that existed before but don't appear now.\n    //    `onEmpty: 'keep'` skips this pass entirely. Uses\n    //    `_internalDelete` so a user-registered `onDelete` on the\n    //    output collection does NOT fire on housekeeping (composition fix).\n    let deleted = 0\n    const residueUndecodable: string[] = []\n    const residueDeclined: string[] = []\n    if (onEmpty === 'delete') {\n      const priorIds = await listOutputIds(outputColl)\n      for (const priorId of priorIds) {\n        if (newIds.has(priorId)) continue\n        // #762 — a same-collection partition MV (`output: { collection: <source>, partition }`,\n        // the DERIV-PP30-001 shape) writes INTO its own source collection, so `listOutputIds`\n        // also returns untouched USER source rows here. Decode each candidate and only\n        // tombstone rows THIS MV stamped via `_materializedFrom.mvName` — the exact discipline\n        // `invalidateMVAtRest` uses (stale.ts:151-162). An unstamped row, or one stamped by a\n        // different MV, is never this MV's to delete.\n        const priorEnvelope = await adapter.get(vaultName, reg.outputCollection, priorId)\n        if (priorEnvelope === null) continue\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        const priorDecoded = await (outputColl as any)._decodeEnvelope(priorEnvelope, priorId)\n        if (priorDecoded === null) {\n          // #782 part a — ownership unknown (undecodable, e.g. elevated above tier 0 on a\n          // tiered output collection): can't rule out this being THIS MV's own stamped row.\n          // Surface it rather than silently skip (mirrors invalidateMVAtRest's #776 posture —\n          // previously this leg had NO residue channel at all).\n          residueUndecodable.push(`${reg.outputCollection}:${priorId}`)\n          continue\n        }\n        const priorStampedBy =\n          typeof priorDecoded === 'object'\n            ? (priorDecoded as Record<string, unknown>)._materializedFrom as { mvName?: string } | undefined\n            : undefined\n        if (priorStampedBy?.mvName !== spec.name) continue\n        try {\n          // eslint-disable-next-line @typescript-eslint/no-explicit-any\n          const outAny = outputColl as any\n          if (typeof outAny._internalDelete === 'function') {\n            // #776 part b — gate on the boolean, matching invalidateMVAtRest's discipline\n            // (stale.ts): `_internalDelete` returns `false` for a #718 elevated-skip (no\n            // erasure happened), and that must not inflate the tombstone count.\n            if (await outAny._internalDelete(priorId, txCtx)) {\n              deleted++\n            } else {\n              // #782 part b — decoded AND stamp-owned, but erasure was declined (#718\n              // tier-elevation gate). Ownership IS confirmed here — a real silent survival,\n              // not a legit stamp-mismatch skip. Surface it too.\n              residueDeclined.push(`${reg.outputCollection}:${priorId}`)\n            }\n          } else {\n            // Defensive fallback — should never hit in real flow since\n            // every Collection has `_internalDelete`.\n            await outputColl.delete(priorId)\n            deleted++\n          }\n        } catch (err) {\n          failed++\n          if (strict) throw err\n\n          console.warn(`[mv] \"${spec.name}\" tombstone failed for id=\"${priorId}\":`, err)\n        }\n      }\n    }\n\n    return { written, deleted, failed, residueUndecodable, residueDeclined }\n  },\n}\n\n/**\n * List ids currently present in the MV's output collection via the\n * adapter directly (avoids triggering the lazy resolve-on-read path\n * we're INSIDE). Returns an empty array if the collection doesn't\n * exist or the adapter doesn't surface a list method.\n *\n * @internal\n */\nasync function listOutputIds(\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  outputColl: Collection<any>,\n): Promise<string[]> {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  const cAny = outputColl as any\n  const adapter = cAny.adapter as { list?: (v: string, c: string) => Promise<readonly string[]> }\n  const vault = cAny.vault as string\n  const name = cAny.name as string\n  if (typeof adapter?.list !== 'function') return []\n  try {\n    const ids = await adapter.list(vault, name)\n    return [...ids]\n  } catch {\n    return []\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,IAAM,mBAAmB;AASzB,eAAe,uBAEb,GACA,QACA,YACA,YACiD;AACjD,MAAI,OAAO,GAAG,YAAY,YAAY;AAEpC,WAAO,MAAM,EAAE,QAAQ;AAAA,EACzB;AACA,MAAI,OAAO,GAAG,QAAQ,YAAY;AAQhC,UAAM,UAAU,eAAe,SAAY,EAAE,QAAQ,YAAY,WAAW,IAAI;AAChF,UAAM,SAAkB,MAAM,QAAQ,QAAQ,EAAE,IAAI,OAAO,CAAC;AAC5D,QAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,aAAO;AAAA,IACT;AAIA,WAAO,CAAC,MAAiC;AAAA,EAC3C;AACA,QAAM,IAAI;AAAA,IACR,OAAO,MAAM;AAAA,EAEf;AACF;AAuBA,eAAe,uBACb,MACA,IACiD;AACjD,QAAM,UAAkB,CAAC;AACzB,aAAW,OAAO,KAAK,cAAe;AACpC,UAAM,OAAO,GAAG,WAAoC,IAAI,UAAU;AAQlE,QAAI,IAAS,KAAK,MAAM;AACxB,QAAI,IAAI,MAAM,QAAQ;AACpB,iBAAW,OAAO,IAAI,MAAM;AAC1B,YAAI,EAAE,KAAK,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,SAAS,IAAI,SAAS,UAAU,IAAI,SAAS,CAAC;AAAA,MACpF;AAAA,IACF;AACA,UAAM,aAAa,EAAE,QAAQ;AAC7B,eAAW,KAAK,YAAY;AAC1B,YAAM,SAAS,IAAI,IAAI,CAAC;AAGxB,UAAI,UAAU,KAAM;AACpB,cAAQ,KAAK,MAAM;AAAA,IACrB;AAAA,EACF;AAEA,SAAO,mBAAmB,MAAM,OAAO;AACzC;AAYA,SAAS,mBACP,MACA,SACwC;AACxC,MAAI,CAAC,KAAK,QAAS,QAAO;AAE1B,QAAM,cACJ,OAAO,KAAK,YAAY,WAAW,CAAC,KAAK,OAAO,IAAI,KAAK;AAQ3D,MAAI,KAAK,eAAe,UAAa,KAAK,eAAe,QAAW;AAClE,UAAM,YAAgD,CAAC;AACvD,eAAW,KAAK,aAAa;AAC3B,YAAM,IAAI,KAAK,WAAW,CAAC;AAC3B,UAAI,MAAM,OAAW,WAAU,CAAC,IAAI;AAAA,IACtC;AACA,QAAI,OAAO,KAAK,SAAS,EAAE,SAAS,GAAG;AACrC,eAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,gBAAQ,CAAC,IAAI,gBAAgB,QAAQ,CAAC,GAA8B,WAAW,KAAK,YAAY,QAAW,IAAI;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AAGA,aAAW,KAAK,aAAa;AAC3B,eAAW,OAAO,SAAS;AACzB,YAAM,IAAK,IAAgC,CAAC;AAC5C,UAAI,MAAM,QAAQ,OAAO,MAAM,UAAU;AACvC,cAAM,IAAI;AAAA,UACR;AAAA,UACA,sBAAsB,KAAK,IAAI,gBAAgB,CAAC;AAAA,QAGlD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAKA,MAAI,CAAC,KAAK,WAAW;AACnB,UAAM,OAAO,oBAAI,IAAkB;AACnC,eAAW,OAAO,SAAS;AACzB,YAAM,IAAI,kBAAkB,aAAa,GAA8B;AACvE,UAAI,CAAC,KAAK,IAAI,CAAC,EAAG,MAAK,IAAI,GAAG,GAAG;AAAA,IACnC;AACA,WAAO,CAAC,GAAG,KAAK,OAAO,CAAC;AAAA,EAC1B;AAKA,SAAO,eAAwC,SAAS,aAAa,KAAK,WAAW,KAAK,WAAW;AACvG;AAYA,eAAe,4BACb,MACA,IACiD;AACjD,QAAM,aAAa,KAAK;AACxB,QAAM,OAAO,GAAG,WAAoC,WAAW,MAAM;AAMrE,MAAI,IAAS,KAAK,MAAM;AACxB,aAAW,OAAO,WAAW,OAAO;AAClC,QAAI,aAAa,IAAK;AACtB,QAAI,EAAE,KAAK,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,SAAS,IAAI,SAAS,UAAU,IAAI,SAAS,CAAC;AAAA,EACpF;AACA,MAAI,OAAO,EAAE,QAAQ;AACrB,aAAW,OAAO,WAAW,OAAO;AAClC,QAAI,EAAE,aAAa,KAAM;AACzB,WAAO,gBAAgB,MAAM,KAAK,KAAK,MAAM,WAAW,QAAQ,EAAE;AAAA,EACpE;AACA,QAAM,SAAiB,CAAC;AACxB,aAAW,KAAK,MAAM;AACpB,UAAM,IAAI,WAAW,IAAI,CAAC;AAG1B,QAAI,KAAK,KAAM;AACf,WAAO,KAAK,CAAC;AAAA,EACf;AACA,SAAO,mBAAmB,MAAM,MAAM;AACxC;AAeA,SAAS,gBACP,aACA,KACA,QACA,QACA,IACgC;AAChC,QAAM,YAAY,GAAG,WAAoC,IAAI,OAAO;AAEpE,QAAM,SAAS,UAAU,MAAM;AAC/B,QAAM,UAAU,OAAO,eAAe,GAAG,WAAW,IAAI,EAAE;AAC1D,MAAI,WAAW,MAAM;AACnB,UAAM,IAAI;AAAA,MACR,IAAI,MAAM,8BAA8B,IAAI,EAAE,gCAAgC,IAAI,EAAE,oBACnE,IAAI,OAAO,gBAAgB,MAAM,4BACrC,IAAI,EAAE,UAAU,MAAM,uBAAuB,IAAI,OAAO;AAAA,IACvE;AAAA,EACF;AACA,MAAI,QAAQ,WAAW,QAAQ;AAC7B,UAAM,IAAI;AAAA,MACR,IAAI,MAAM,8BAA8B,IAAI,EAAE,oBAAoB,IAAI,EAAE,oBAClE,IAAI,OAAO,yCAAyC,MAAM,6BAC1D,QAAQ,MAAM;AAAA,IACtB;AAAA,EACF;AACA,QAAM,UAAU,IAAI,WAAW;AAC/B,QAAM,SAAS,oBAAI,IAA4C;AAC/D,aAAW,SAAS,OAAO,QAAQ,GAAqC;AACtE,UAAM,MAAM,iBAAiB,MAAM,IAAI,EAAE,CAAC;AAG1C,QAAI,QAAQ,KAAM;AAClB,UAAM,SAAS,OAAO,IAAI,GAAG;AAC7B,QAAI,OAAQ,QAAO,KAAK,KAAK;AAAA,QACxB,QAAO,IAAI,KAAK,CAAC,KAAK,CAAC;AAAA,EAC9B;AACA,QAAM,MAAsC,CAAC;AAC7C,aAAW,OAAO,aAAa;AAC7B,UAAM,MAAM,iBAAiB,IAAI,EAAE;AACnC,UAAM,WAAW,QAAQ,OAAO,CAAC,IAAI,OAAO,IAAI,GAAG,KAAK,CAAC;AACzD,QAAI,SAAS,SAAS,SAAS;AAC7B,YAAM,IAAI,kBAAkB;AAAA,QAC1B,UAAU,YAAY;AAAA,QACtB,WAAW,SAAS;AAAA,QACpB;AAAA,QACA,MAAM;AAAA,QACN,SACE,kBAAkB,MAAM,mBAAmB,IAAI,EAAE,cAAc,SAAS,MAAM,KAC1E,IAAI,OAAO,mBAAmB,MAAM,2BAA2B,OAAO;AAAA,MAG9E,CAAC;AAAA,IACH;AACA,QAAI,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC;AAAA,EACzC;AACA,SAAO;AACT;AAUA,SAAS,iBAAiB,OAA+B;AACvD,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAC/E,SAAO;AACT;AA+BO,IAAM,2BAA2B;AAAA,EACtC,MAAM,QACJ,KACA,UACwB;AACxB,UAAM,OAAO,IAAI;AACjB,UAAM,aAAa,SAAS,cAAc,IAAI,gBAAgB;AAC9D,UAAM,UAAU,KAAK,WAAW;AAChC,UAAM,UAAU,KAAK,WAAW;AAChC,UAAM,SAAS,KAAK,UAAU;AAM9B,UAAM,UAAU,SAAS,gBAAgB;AACzC,UAAM,cAA8B,KAAK,aACrC,qBAAqB,SAAS,KAAK,UAAU,IAC7C;AAMJ,QAAI;AACJ,QAAI,KAAK,cAAc;AACrB,aAAO,MAAM,uBAAuB,MAAM,WAAW;AAAA,IACvD,WAAW,KAAK,YAAY;AAC1B,aAAO,MAAM,4BAA4B,MAAM,WAAW;AAAA,IAC5D,OAAO;AACL,YAAM,IAAI,KAAK,MAAO,WAAW;AACjC,aAAO,MAAM,uBAAuB,GAAG,KAAK,MAAM,KAAK,YAAY,KAAK,UAAU;AAAA,IACpF;AASA,WAAO,KAAK,OAAO,CAAC,QAAQ;AAC1B,YAAM,QAAQ,IAAI;AAClB,aAAO,OAAO,WAAW,KAAK;AAAA,IAChC,CAAC;AAID,QAAI,KAAK,SAAS,SAAS;AACzB,YAAM,IAAI,8BAA8B,KAAK,MAAM,KAAK,QAAQ,OAAO;AAAA,IACzE;AAEA,UAAM,QAAQ,SAAS,mBAAmB;AAE1C,UAAM,UAAW,WAAmB;AAIpC,UAAM,YAAa,WAAmB;AAItC,UAAM,SAAS,oBAAI,IAAY;AAC/B,UAAM,eAAuE,CAAC;AAC9E,eAAW,OAAO,MAAM;AACtB,YAAM,KAAK,KAAK,OAAO,GAAG;AAC1B,aAAO,IAAI,EAAE;AACb,YAAM,OAA6B;AAAA,QACjC,QAAQ,KAAK;AAAA,QACb,WAAW,IAAI;AAAA,QACf,gBAAgB,CAAC;AAAA,QACjB,iBAAgB,oBAAI,KAAK,GAAE,YAAY;AAAA,MACzC;AACA,mBAAa,KAAK,EAAE,IAAI,QAAQ,EAAE,GAAG,KAAK,mBAAmB,KAAK,EAAE,CAAC;AAAA,IACvE;AAGA,QAAI,UAAU;AACd,QAAI,SAAS;AACb,eAAW,EAAE,IAAI,OAAO,KAAK,cAAc;AACzC,UAAI;AACF,YAAI,UAAU,MAAM;AAClB,gBAAM,QAAQ,MAAM,QAAQ,IAAI,WAAW,IAAI,kBAAkB,EAAE;AACnE,gBAAM,UAAU,KAAK;AAAA,YACnB,IAAI,EAAE,MAAM,OAAO,WAAW,gBAAgB,IAAI,kBAAkB,GAAG;AAAA,YACvE,eAAe;AAAA,UACjB,CAAC;AAAA,QACH;AACA,YAAI,SAAS,aAAa;AACxB,cAAI,MAAM,iBAAiB,YAAY,IAAI,QAAQ,SAAS,WAAW,MAAM,UAAW;AAAA,QAC1F,OAAO;AACL,gBAAM,WAAW,IAAI,IAAI,MAAM;AAC/B;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ;AACA,YAAI,OAAQ,OAAM;AAElB,gBAAQ,KAAK,SAAS,KAAK,IAAI,uBAAuB,GAAG;AAAA,MAC3D;AAAA,IACF;AAMA,QAAI,UAAU;AACd,UAAM,qBAA+B,CAAC;AACtC,UAAM,kBAA4B,CAAC;AACnC,QAAI,YAAY,UAAU;AACxB,YAAM,WAAW,MAAM,cAAc,UAAU;AAC/C,iBAAW,WAAW,UAAU;AAC9B,YAAI,OAAO,IAAI,OAAO,EAAG;AAOzB,cAAM,gBAAgB,MAAM,QAAQ,IAAI,WAAW,IAAI,kBAAkB,OAAO;AAChF,YAAI,kBAAkB,KAAM;AAE5B,cAAM,eAAe,MAAO,WAAmB,gBAAgB,eAAe,OAAO;AACrF,YAAI,iBAAiB,MAAM;AAKzB,6BAAmB,KAAK,GAAG,IAAI,gBAAgB,IAAI,OAAO,EAAE;AAC5D;AAAA,QACF;AACA,cAAM,iBACJ,OAAO,iBAAiB,WACnB,aAAyC,oBAC1C;AACN,YAAI,gBAAgB,WAAW,KAAK,KAAM;AAC1C,YAAI;AAEF,gBAAM,SAAS;AACf,cAAI,OAAO,OAAO,oBAAoB,YAAY;AAIhD,gBAAI,MAAM,OAAO,gBAAgB,SAAS,KAAK,GAAG;AAChD;AAAA,YACF,OAAO;AAIL,8BAAgB,KAAK,GAAG,IAAI,gBAAgB,IAAI,OAAO,EAAE;AAAA,YAC3D;AAAA,UACF,OAAO;AAGL,kBAAM,WAAW,OAAO,OAAO;AAC/B;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AACZ;AACA,cAAI,OAAQ,OAAM;AAElB,kBAAQ,KAAK,SAAS,KAAK,IAAI,8BAA8B,OAAO,MAAM,GAAG;AAAA,QAC/E;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,SAAS,SAAS,QAAQ,oBAAoB,gBAAgB;AAAA,EACzE;AACF;AAUA,eAAe,cAEb,YACmB;AAEnB,QAAM,OAAO;AACb,QAAM,UAAU,KAAK;AACrB,QAAM,QAAQ,KAAK;AACnB,QAAM,OAAO,KAAK;AAClB,MAAI,OAAO,SAAS,SAAS,WAAY,QAAO,CAAC;AACjD,MAAI;AACF,UAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI;AAC1C,WAAO,CAAC,GAAG,GAAG;AAAA,EAChB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;","names":[]}

package/dist/chunk-AFHQATY4.js

@@ -1,47 +0,0 @@
-// src/with-commit/history/strategy.ts
-function notEnabled(op) {
-  return new Error(
-    `${op} requires the history strategy. Import \`{ withHistory }\` from "@noy-db/hub/history" and pass it to \`createNoydb({ historyStrategy: withHistory() })\`.`
-  );
-}
-var NO_HISTORY = {
-  async saveHistory() {
-  },
-  async getHistoryEntries() {
-    throw notEnabled("collection.history()");
-  },
-  async getVersionEnvelope() {
-    throw notEnabled("collection.getVersion()");
-  },
-  async pruneHistory() {
-    return 0;
-  },
-  async clearHistory() {
-    return 0;
-  },
-  async tombstoneHistory() {
-    return 0;
-  },
-  async rewrapHistory() {
-  },
-  async envelopePayloadHash() {
-    return "";
-  },
-  computePatch() {
-    return [];
-  },
-  diff() {
-    throw notEnabled("collection.diff()");
-  },
-  buildLedger() {
-    return null;
-  },
-  buildVaultInstant() {
-    throw notEnabled("vault.at() / vault.timeMachine()");
-  }
-};
-
-export {
-  NO_HISTORY
-};
-//# sourceMappingURL=chunk-AFHQATY4.js.map

package/dist/chunk-AFHQATY4.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-commit/history/strategy.ts"],"sourcesContent":["/**\n * Strategy seam for the optional history + ledger + time-machine\n * service. Core imports `HistoryStrategy` type-only + `NO_HISTORY`\n * stub; real implementations of `saveHistory`, `LedgerStore`,\n * `VaultInstant`, `computePatch`, `diff` etc. are only reachable via\n * `withHistory()` in `./active.ts`.\n *\n * Applications that don't track per-record versioning, don't need the\n * hash-chained audit ledger, and don't restore to past instants ship\n * none of the ~1,880 LOC behind this seam.\n *\n * Strategy contract:\n *\n * - **saveHistory / pruneHistory / clearHistory** — no-ops under\n *   NO_HISTORY. Writes still succeed; no snapshot is captured.\n * - **getHistoryEntries / getVersionEnvelope / diff** — throw under\n *   NO_HISTORY. These are read APIs the consumer would only call\n *   after explicitly asking for history; the throw guides them to\n *   `@noy-db/hub/history`.\n * - **envelopePayloadHash / computePatch** — return empty / `[]`\n *   under NO_HISTORY. These are only used inside the\n *   `if (this.ledger)` branch, which is itself gated by\n *   `buildLedger()` returning null.\n * - **buildLedger** — returns `null` under NO_HISTORY. The Vault's\n *   public `vault.ledger()` accessor throws when null.\n * - **buildVaultInstant** — throws under NO_HISTORY. `vault.at()`\n *   propagates the throw.\n *\n * @internal\n */\n\nimport type {\n  EncryptedEnvelope,\n  NoydbStore,\n  HistoryOptions,\n  PruneOptions,\n} from '../../kernel/types.js'\nimport type { LedgerStore } from './ledger/store.js'\nimport type { JsonPatch } from './ledger/patch.js'\nimport type { DiffEntry } from './diff.js'\nimport type { VaultInstant, VaultEngine } from './time-machine.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\n/**\n * Options accepted by `HistoryStrategy.buildLedger`. Mirrors the\n * `LedgerStore` constructor verbatim — kept in this file so `core`\n * code never imports the LedgerStore module at runtime.\n *\n * @internal\n */\nexport interface BuildLedgerOptions {\n  adapter: NoydbStore\n  vault: string\n  encrypted: boolean\n  getDEK: (collectionName: string) => Promise<EnclaveKey>\n  actor: string\n}\n\n/**\n * @internal\n */\nexport interface HistoryStrategy {\n  /**\n   * Persist a full encrypted envelope snapshot of the prior version\n   * under `_history/{collection}:{id}:{paddedVersion}`. No-op under\n   * `NO_HISTORY`.\n   */\n  saveHistory(\n    adapter: NoydbStore,\n    vault: string,\n    collection: string,\n    recordId: string,\n    envelope: EncryptedEnvelope,\n  ): Promise<void>\n\n  /**\n   * List history envelopes for a record, newest first. Throws under\n   * `NO_HISTORY` — callers reach this via `collection.history()` /\n   * `collection.getVersion()` / `collection.diff()`, which only work\n   * with the strategy enabled.\n   */\n  getHistoryEntries(\n    adapter: NoydbStore,\n    vault: string,\n    collection: string,\n    recordId: string,\n    options?: HistoryOptions,\n  ): Promise<EncryptedEnvelope[]>\n\n  /**\n   * Fetch a specific version's envelope. Throws under `NO_HISTORY`.\n   */\n  getVersionEnvelope(\n    adapter: NoydbStore,\n    vault: string,\n    collection: string,\n    recordId: string,\n    version: number,\n  ): Promise<EncryptedEnvelope | null>\n\n  /**\n   * Prune history entries by retention rule. Returns `0` under\n   * `NO_HISTORY`.\n   */\n  pruneHistory(\n    adapter: NoydbStore,\n    vault: string,\n    collection: string,\n    recordId: string | undefined,\n    options: PruneOptions,\n  ): Promise<number>\n\n  /**\n   * Clear all history for vault/collection/record. Returns `0` under\n   * `NO_HISTORY`.\n   */\n  clearHistory(\n    adapter: NoydbStore,\n    vault: string,\n    collection?: string,\n    recordId?: string,\n  ): Promise<number>\n\n  /**\n   * Crypto-shred (overwrite-to-tombstone) every `_history` version of a\n   * record for GDPR erasure. Returns the number of versions newly\n   * tombstoned, or `0` under `NO_HISTORY` (no history = nothing to shred).\n   */\n  tombstoneHistory(\n    adapter: NoydbStore,\n    vault: string,\n    collection: string,\n    recordId: string,\n    actor: string,\n    encrypted: boolean,\n  ): Promise<number>\n\n  /**\n   * Re-key every `_history` snapshot of a record from `fromDek` to `toDek`\n   * on a tier move (elevate/demote/putAtTier), mirroring the live-body\n   * rewrap so prior versions are not left decryptable at rest under a tier\n   * the record has moved away from. Optional `tier0Dek` enables the legacy\n   * fallback for snapshots written before this rewrap existed (see\n   * `history.ts` for the full contract). No-op under `NO_HISTORY` (no\n   * history = nothing to rewrap).\n   */\n  rewrapHistory(\n    adapter: NoydbStore,\n    vault: string,\n    collection: string,\n    recordId: string,\n    fromDek: EnclaveKey,\n    toDek: EnclaveKey,\n    tier0Dek?: EnclaveKey,\n  ): Promise<void>\n\n  /**\n   * Compute the SHA-256 hash of an envelope's encrypted payload, used\n   * by `LedgerStore.append` to track tamper-evidence. Returns the\n   * empty string under `NO_HISTORY` (the call site is gated by\n   * `if (this.ledger)`, so the value is never observed).\n   */\n  envelopePayloadHash(envelope: EncryptedEnvelope | null): Promise<string>\n\n  /**\n   * Compute the JSON patch from `from` → `to`. Returns `[]` under\n   * `NO_HISTORY`.\n   */\n  computePatch(from: unknown, to: unknown): JsonPatch\n\n  /**\n   * Compute the typed diff between two records. Throws under\n   * `NO_HISTORY` — `collection.diff()` is a history-read API.\n   */\n  diff(recordA: unknown, recordB: unknown): DiffEntry[]\n\n  /**\n   * Construct (or return null) a `LedgerStore` for the vault. Returns\n   * `null` under `NO_HISTORY`; the Vault treats null as \"no ledger\n   * attached\" — collection write paths skip the append branch and the\n   * public `vault.ledger()` accessor throws.\n   */\n  buildLedger(opts: BuildLedgerOptions): LedgerStore | null\n\n  /**\n   * Construct a `VaultInstant` for time-machine reads. Throws under\n   * `NO_HISTORY`.\n   */\n  buildVaultInstant(engine: VaultEngine, timestamp: string): VaultInstant\n}\n\n/**\n * Error thrown when the consumer reaches a history-gated surface\n * without opting into the strategy. The message names the offending\n * operation and points to the subpath import.\n *\n * @internal\n */\nfunction notEnabled(op: string): Error {\n  return new Error(\n    `${op} requires the history strategy. Import ` +\n    '`{ withHistory }` from \"@noy-db/hub/history\" and pass it to ' +\n    '`createNoydb({ historyStrategy: withHistory() })`.',\n  )\n}\n\n/**\n * No-history stub. Snapshots and prune/clear are no-ops; reads and\n * time-machine throw with an actionable message; ledger construction\n * returns null so the write-path's `if (this.ledger)` branch is dead\n * code in the bundle.\n *\n * @internal\n */\nexport const NO_HISTORY: HistoryStrategy = {\n  async saveHistory() {},\n  async getHistoryEntries() { throw notEnabled('collection.history()') },\n  async getVersionEnvelope() { throw notEnabled('collection.getVersion()') },\n  async pruneHistory() { return 0 },\n  async clearHistory() { return 0 },\n  async tombstoneHistory() { return 0 },\n  async rewrapHistory() {},\n  async envelopePayloadHash() { return '' },\n  computePatch() { return [] },\n  diff() { throw notEnabled('collection.diff()') },\n  buildLedger() { return null },\n  buildVaultInstant() { throw notEnabled('vault.at() / vault.timeMachine()') },\n}\n"],"mappings":";AAsMA,SAAS,WAAW,IAAmB;AACrC,SAAO,IAAI;AAAA,IACT,GAAG,EAAE;AAAA,EAGP;AACF;AAUO,IAAM,aAA8B;AAAA,EACzC,MAAM,cAAc;AAAA,EAAC;AAAA,EACrB,MAAM,oBAAoB;AAAE,UAAM,WAAW,sBAAsB;AAAA,EAAE;AAAA,EACrE,MAAM,qBAAqB;AAAE,UAAM,WAAW,yBAAyB;AAAA,EAAE;AAAA,EACzE,MAAM,eAAe;AAAE,WAAO;AAAA,EAAE;AAAA,EAChC,MAAM,eAAe;AAAE,WAAO;AAAA,EAAE;AAAA,EAChC,MAAM,mBAAmB;AAAE,WAAO;AAAA,EAAE;AAAA,EACpC,MAAM,gBAAgB;AAAA,EAAC;AAAA,EACvB,MAAM,sBAAsB;AAAE,WAAO;AAAA,EAAG;AAAA,EACxC,eAAe;AAAE,WAAO,CAAC;AAAA,EAAE;AAAA,EAC3B,OAAO;AAAE,UAAM,WAAW,mBAAmB;AAAA,EAAE;AAAA,EAC/C,cAAc;AAAE,WAAO;AAAA,EAAK;AAAA,EAC5B,oBAAoB;AAAE,UAAM,WAAW,kCAAkC;AAAA,EAAE;AAC7E;","names":[]}

package/dist/chunk-AHLJSVRL.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-party/team/tiers.ts"],"sourcesContent":["/**\n * Hierarchical access — tier-aware keyring helpers.\n *\n * The keyring's existing `deks: Map<string, CryptoKey>` is keyed by\n * collection name. extends the key space:\n *\n *   `'invoices'`      — tier-0 DEK (unchanged from v0.x)\n *   `'invoices#1'`    — tier-1 DEK\n *   `'invoices#2'`    — tier-2 DEK\n *\n * Tier 0 keeps the bare collection name so any keyring written\n * before tiers existed loads without migration. Tiers ≥ 1 use `#N`\n * suffixes that\n * would be invalid as user-supplied collection names (see\n * `ReservedCollectionNameError` — `#` is reserved).\n *\n * @module\n */\n\nimport type { UnlockedKeyring } from './keyring.js'\nimport { TierNotGrantedError } from '../../kernel/errors.js'\n\n/** Canonical DEK key for a given collection + tier. Tier 0 → bare name. */\nexport function dekKey(collection: string, tier: number): string {\n  if (tier <= 0) return collection\n  return `${collection}#${tier}`\n}\n\n/**\n * Returns the user's effective clearance for a given collection: the\n * maximum tier for which their keyring holds a DEK. Falls back to 0\n * when the user has only the tier-0 DEK (or none — the getDEK caller\n * will raise separately).\n */\nexport function effectiveClearance(keyring: UnlockedKeyring, collection: string): number {\n  let max = 0\n  const prefix = `${collection}#`\n  for (const key of keyring.deks.keys()) {\n    if (!key.startsWith(prefix)) continue\n    const suffix = key.slice(prefix.length)\n    const n = Number.parseInt(suffix, 10)\n    if (Number.isFinite(n) && n > max) max = n\n  }\n  return max\n}\n\n/**\n * Assert the caller is cleared for the requested tier. Owners and\n * admins always pass (they can mint any new tier DEK on demand);\n * other roles must already hold the tier DEK — via a prior grant or\n * an active delegation — otherwise this throws `TierNotGrantedError`.\n *\n * This gate runs BEFORE `getDEK()` on the mutation path so a\n * non-cleared operator never has the opportunity to silently\n * auto-create a tier DEK they shouldn't have.\n */\nexport function assertTierAccess(\n  keyring: UnlockedKeyring,\n  collection: string,\n  tier: number,\n): void {\n  if (tier <= 0) return\n  // FR-6: custodian operates every collection at every tier (admin-level\n  // operational authority), so it may mint a tier DEK on demand like admin.\n  if (keyring.role === 'owner' || keyring.role === 'admin' || keyring.role === 'custodian') return\n  if (!keyring.deks.has(dekKey(collection, tier))) {\n    throw new TierNotGrantedError(collection, tier)\n  }\n}\n"],"mappings":";;;;;AAuBO,SAAS,OAAO,YAAoB,MAAsB;AAC/D,MAAI,QAAQ,EAAG,QAAO;AACtB,SAAO,GAAG,UAAU,IAAI,IAAI;AAC9B;AA8BO,SAAS,iBACd,SACA,YACA,MACM;AACN,MAAI,QAAQ,EAAG;AAGf,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,WAAW,QAAQ,SAAS,YAAa;AAC1F,MAAI,CAAC,QAAQ,KAAK,IAAI,OAAO,YAAY,IAAI,CAAC,GAAG;AAC/C,UAAM,IAAI,oBAAoB,YAAY,IAAI;AAAA,EAChD;AACF;","names":[]}

package/dist/chunk-C2OOEM57.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-audit/tiers/active.ts","../src/with-audit/tiers/strategy.ts","../src/with-audit/tiers/index.ts"],"sourcesContent":["/**\n * Enable the hierarchical-tiers capability.\n * Pass to `createNoydb({ tiersStrategy: withTiers() })` to make a collection's\n * `putAtTier` / `getAtTier` / `listAtTier` / `elevate` / `demote` methods live.\n * The tier read/write/re-key engine is dynamically imported here, so it stays\n * out of the floor bundle until opted in.\n */\nimport type { TiersStrategy } from './strategy.js'\n\nexport function withTiers(): TiersStrategy {\n  return {\n    async putAtTier(ctx, id, record, tier, opts) {\n      const { putAtTier } = await import('./index.js')\n      return putAtTier(ctx, id, record, tier, opts)\n    },\n    async getAtTier(ctx, id) {\n      const { getAtTier } = await import('./index.js')\n      return getAtTier(ctx, id)\n    },\n    async listAtTier(ctx) {\n      const { listAtTier } = await import('./index.js')\n      return listAtTier(ctx)\n    },\n    async elevate(ctx, id, toTier) {\n      const { elevate } = await import('./index.js')\n      return elevate(ctx, id, toTier)\n    },\n    async demote(ctx, id, toTier) {\n      const { demote } = await import('./index.js')\n      return demote(ctx, id, toTier)\n    },\n  }\n}\n","/**\n * Tiers capability strategy — the five on-demand collection-level tier\n * operations the `Collection` routes through. The active engine\n * ({@link withTiers}) dynamically imports the tier cores (keeping them out of\n * the floor bundle); {@link NO_TIERS} throws. Collection always builds its\n * per-call {@link TiersContext} and delegates here, so an un-opted-in caller\n * hits `NO_TIERS`'s throw.\n * @internal\n */\nimport type { GhostRecord } from '../../kernel/types.js'\nimport type { TiersContext, TierMoveResult } from './index.js'\nimport { TiersNotEnabledError } from '../../kernel/errors.js'\n\n// #779 — re-exported so kernel-spine callers (e.g. `Vault._elevatedPut`) can reference the\n// result shape via this grandfathered strategy.js seam instead of statically importing\n// tiers/index.js directly (the port-layering check only grandfathers this file).\nexport type { TierMoveResult }\n\nexport interface TiersStrategy {\n  putAtTier<T>(\n    ctx: TiersContext<T>,\n    id: string,\n    record: T,\n    tier: number,\n    opts?: { elevation?: { reason: string; fromTier: number }; source?: string; sourceTs?: string },\n  ): Promise<TierMoveResult>\n  getAtTier<T>(ctx: TiersContext<T>, id: string): Promise<T | GhostRecord | null>\n  listAtTier<T>(ctx: TiersContext<T>): Promise<Array<{ id: string; tier: number; readable: boolean }>>\n  elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<TierMoveResult>\n  demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<TierMoveResult>\n}\n\n/**\n * No-op stub — the floor default. Every capability method throws\n * {@link TiersNotEnabledError}; opt in with `tiersStrategy: withTiers()` in\n * createNoydb. @internal\n */\nexport const NO_TIERS: TiersStrategy = {\n  async putAtTier() { throw new TiersNotEnabledError() },\n  async getAtTier() { throw new TiersNotEnabledError() },\n  async listAtTier() { throw new TiersNotEnabledError() },\n  async elevate() { throw new TiersNotEnabledError() },\n  async demote() { throw new TiersNotEnabledError() },\n}\n","/**\n * Hierarchical access — the collection-level tier operations\n * (`putAtTier` / `getAtTier` / `listAtTier` / `elevate` / `demote`).\n *\n * A collection opted into `{ tiers: [...] }` stamps `_tier: N` on each envelope\n * and encrypts its body under the tier-N DEK. These helpers are the read/write\n * surface for that scheme: write at a tier, read with tier-aware visibility\n * (invisibility vs. ghost), and move a record up (`elevate`) or down (`demote`)\n * the tier ladder by re-wrapping its body key.\n *\n * Each function takes a small {@link TiersContext} (the exact `this.*` the\n * moving methods touched) instead of `this`, mirroring the `record-keys/`\n * siblings. Behaviour is byte-identical to the inline code it replaced.\n *\n * The crux is `cekCache`: `elevate`/`demote`/`getAtTier` write the SAME `Lru`\n * reference `Collection` owns (never a copy) so a per-record CEK re-wrap stays\n * synchronous with the cache the kernel's write/read path also mutates. The\n * cross-tier event sink stays collection-resident and is reached via the\n * `emitCrossTierEvent` callback.\n *\n * Internal service — not exported as a `@noy-db/hub/*` subpath.\n */\nexport { withTiers } from './active.js'\nexport { NO_TIERS, type TiersStrategy } from './strategy.js'\nexport { TiersNotEnabledError } from '../../kernel/errors.js'\nimport { encrypt, decrypt, unwrapCek, rewrapBodyToDek, applyRewrappedBody, isDeleteMarker, isTombstoneShape, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js'\nimport { TierDemoteDeniedError, UnsupportedTierCompositionError, PersistedIndexCompensationError } from '../../kernel/errors.js'\nimport { dekKey, assertTierAccess } from '../../with-party/team/tiers.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { Lru } from '../../kernel/cache/index.js'\nimport type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js'\nimport {\n  NOYDB_FORMAT_VERSION,\n  type NoydbStore,\n  type EncryptedEnvelope,\n  type GhostRecord,\n  type TierMode,\n  type CrossTierAccessEvent,\n} from '../../kernel/types.js'\n\n/** Everything the moving tier methods touched on `this.*`, as a flat context. */\nexport interface TiersContext<T> {\n  /** Collection name — the crypto AAD scope and tier-DEK key prefix. */\n  readonly name: string\n  /** Vault namespace the records live under. */\n  readonly vault: string\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** The caller's unlocked keyring (tier-DEK holdings + role + userId). */\n  readonly keyring: UnlockedKeyring\n  /** The record codec — decrypts a tier-0 envelope to T. */\n  readonly codec: RecordCodec<T>\n  /**\n   * The collection's per-record CEK cache (SHARED reference, not a copy).\n   * `elevate`/`demote`/`getAtTier` re-wrap a record's CEK and `set` it here so\n   * the move stays synchronous with the cache the kernel's read/write path\n   * owns. `null` → no caching.\n   */\n  readonly cekCache: Lru<string, EnclaveKey> | null\n  /**\n   * Sync the collection's decoded-record cache after a tier move rewraps the\n   * envelope (#691). The lazy LRU is evicted on EVERY call — it is never\n   * re-seeded, since a lazy `#getRaw` miss refetches and decodes the fresh\n   * envelope via its adapter fallback (a stale LRU entry after a tier-0\n   * `putAtTier` overwrite was the #702 lazy-mode gap). `null` → also evict\n   * the eager cache entry; an `entry` → set the eager cache to the given\n   * decoded record/version (used by `demote()` landing back at tier 0 and\n   * `putAtTier`'s tier-0 write, #702 — the record is tier-0, so it must stay\n   * plain-`get()`-readable in-session).\n   */\n  syncCache(id: string, entry: { record: T; version: number } | null): void\n  /**\n   * Sync the collection's indexes after a tier move rewraps the envelope\n   * (#709). Persisted `_idx/<field>/<recordId>` side-cars hold the indexed\n   * field's PLAINTEXT value and are always encrypted under the tier-0 DEK,\n   * whatever the record's own tier — the same leak class `forget()` fixed\n   * via `purgePersistedIndexes` (\"forget() crypto-shreds the body but keeps\n   * the collection DEK, under which these side-cars are encrypted — so\n   * without this they leave the indexed field VALUES readable\"). `null` →\n   * the record just left tier 0: purge its persisted side-cars and drop its\n   * in-memory index entries. A record → it is tier-0 again: (re)build its\n   * entries from that record. Call this BEFORE {@link syncCache} — the\n   * implementation reads the pre-write cached value as \"previous\" to clean\n   * up stale index buckets, so it must run while that entry is still live.\n   * `version` stamps a rebuilt side-car's own envelope version — every\n   * caller has one in scope (the envelope it just wrote), including the\n   * purge (`null`) branches, which pass it along even though it's ignored\n   * there (#720: keeps the parameter honestly required, no dead default).\n   * `priorEnvelope` (#720) — the RAW envelope read BEFORE this call's own\n   * overwrite (already in scope as `existing`/`envelope` at every record-\n   * branch call site), so a lazy same-tier value change (a `putAtTier(0)`\n   * dropping an indexed field, a `demote(0)` off an elevated record) can\n   * still be tier-gate-decoded as \"previous\" once the live envelope itself\n   * has already moved past it. The `null`-record branches never pass one —\n   * see the implementation's doc comment for why they don't need to.\n   */\n  syncIndexes(id: string, record: T | null, version: number, priorEnvelope?: EncryptedEnvelope): Promise<void>\n  /** Sync the collection's SEARCH artifacts after a tier move (#721). Both the\n   *  lexical `_ftindex` blob and the `_vec/<id>` embedding are encrypted under\n   *  the tier-0 DEK and hold the record's derived plaintext (full field text /\n   *  a text-invertible vector), so leaving them means elevation never hid what\n   *  the record was searchable by — the `forget()` precedent, unapplied to\n   *  elevate. `null` → the record left tier 0: purge its `_vec`, and\n   *  invalidate the `_ftindex` blob (the cache-driven rebuild then excludes\n   *  it). A record → it is tier-0 again: re-embed it, and invalidate\n   *  `_ftindex` (rebuild includes it). No-op fast when the collection has no\n   *  search. */\n  syncSearch(id: string, record: T | null, version?: number): Promise<void>\n  /**\n   * Sync a record's `_history` snapshots after a tier move rewraps the live\n   * envelope (#712, at-rest hardening). Each snapshot carries its own key\n   * material (a direct DEK wrap, or a per-record `_cek` itself wrapped under\n   * the tier DEK) — `elevate()`'s live-body rewrap moves only the live\n   * envelope, leaving prior versions decryptable at rest under the tier the\n   * record has moved away from (the same leak class `forget()`'s\n   * `tombstoneHistory` closed for erasure). `fromDek`/`toDek` are the SAME\n   * DEKs the caller already resolved for the live rewrap — reuse them, don't\n   * recompute. No-op when the strategy is `NO_HISTORY`.\n   */\n  syncHistory(id: string, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<void>\n  /**\n   * Save a raw pre-move envelope as a `_history` snapshot (#728). Tier moves\n   * (`putAtTier`/`elevate`/`demote`) bump `_v` and overwrite the live\n   * envelope without ever snapshotting the version that existed just before\n   * the move — so `history()` silently lost it. The caller (`tiers/index.ts`)\n   * builds `envelope` by reusing the SAME `rewrapBodyToDek(envelope, fromDek,\n   * toDek)` result it already computed for the live write, so the snapshot\n   * lands wrapped under the DESTINATION tier's DEK — never `ctx.codec.\n   * encryptRecord`, which always resolves the tier-0 DEK and would leak the\n   * pre-move body whenever `fromTier > 0`. No-op when history is disabled\n   * (folds the `historyConfig.enabled` gate so `tiers/index.ts` stays simple).\n   */\n  saveHistorySnapshot(id: string, envelope: EncryptedEnvelope): Promise<void>\n  /**\n   * `true` iff a real history strategy is wired (not `NO_HISTORY`) AND not\n   * explicitly disabled via `historyConfig.enabled`. `putAtTier` checks this\n   * BEFORE decrypting `existing` to build a snapshot (#728, #737 regression\n   * fix) — unlike elevate/demote, which reuse a `body` rewrap their live\n   * write needs unconditionally, putAtTier's live write never decrypts the\n   * prior envelope, so building a snapshot is the ONLY reason it would\n   * touch (and potentially throw decrypting) `existing`'s ciphertext. A\n   * derivation-free, history-disabled collection must not pay that decode —\n   * or risk it, on a corrupted/inaccessible prior body — same law\n   * `hasDerivedOutputs` already enforces for the derived-outputs decode.\n   */\n  readonly historyEnabled: boolean\n  /**\n   * Rehome a record's blob attachments after a tier move (#724 Arc 10 Task\n   * 2, at-rest hardening). A blob's home tier is its owning record's tier —\n   * the `_blob` DEK is tier-scoped (`dekKey('_blob', tier)`), so a solo-\n   * owned blob's content CEK must move with the record or it stays\n   * tier-0-unwrappable at rest even once the live body has moved (the same\n   * leak class `syncHistory` closes for `_history` snapshots). Delegates to\n   * `BlobSet.rehomeForTier`; no-op fast when the collection has no blob\n   * fields. Order-independent with the other sync hooks — touches only\n   * blob side structures, not this collection's own cache/indexes.\n   */\n  syncBlobs(id: string, fromTier: number, toTier: number): Promise<void>\n  /**\n   * Purge a record's tier-0-era plaintext ledger deltas after a tier move\n   * lands it above tier 0 (#729). The audit ledger is a flat, vault-wide,\n   * hash-chained log — a record's reverse-JSON-Patch deltas in\n   * `_ledger_deltas` are encrypted under one collection-wide `_ledger` DEK\n   * (not the record's own tier DEK), so `elevate()`/`putAtTier()`'s live-body\n   * rewrap never moves them: they stay readable at rest to any tier-0\n   * caller, the same leak class `syncHistory` closed for `_history`\n   * snapshots. Chain-safe: `verify()` reads only `_ledger` entry fields\n   * (including `deltaHash`, which lives on the entry, not the deleted delta\n   * row), never `_ledger_deltas`, so a purge cannot break it.\n   * **Irreversible** — the deleted plaintext cannot be restored by\n   * `demote()`. **Metadata-retained** — the `_ledger` entries (that the\n   * record was mutated, at which version/timestamp/actor) are untouched;\n   * only the delta *content* is purged. No-op when the collection has no\n   * ledger (`withHistory()` not enabled).\n   */\n  syncLedger(id: string): Promise<void>\n  /**\n   * Sync a record's derived outputs (materialized-view rows, rollup\n   * contributions, `withDerivation` outputs) after a tier move (#722).\n   * Those outputs are computed from this record and written to OTHER\n   * (output) collections via a plain `put` at tier 0 — `elevate()`'s live-\n   * body rewrap moves only the source envelope, so the output rows keep\n   * holding the source's tier-0-era plaintext, the same leak class\n   * `syncSearch`/`syncIndexes` closed for THIS collection's own artifacts.\n   * `elevated` (landing tier > 0) reuses the SAME onDelete fanout\n   * `forgetDerivedFanout` drives for `forget()` (`kernel/via/dispatch.ts`)\n   * — minus its `'ref'` cascade edge (elevate/demote never erase a\n   * *different* record) — to recompute this record's derived outputs as\n   * REMOVED. Recompute is tier-safe: the fanout's own source scan reads\n   * the elevated-excluding cache (#701/#709/#712), so it naturally omits\n   * the now-elevated record instead of re-embedding its plaintext. Landing\n   * back at tier 0 (`elevated === false`) is the reverse (Task 2, #722):\n   * `syncDerivedOutputs` instead runs the ordinary local-write add-\n   * dispatchers (`dispatchDerivations`/`dispatchMaterializedViews`, the\n   * same ones a plain `put()` fires) to restore the contribution —\n   * reversible, since the source's plaintext survives the elevate/demote\n   * rewrap round-trip. `record` is the decoded source record (PRE-move on\n   * the remove side, POST-move on the add side); only the rollup edge\n   * consumes it on remove, both add-dispatchers require it on add; `null`\n   * (tombstone/delete-marker) skips both. `version` stamps the add-\n   * dispatchers' `_derivedFrom.sourceVersion` metadata — reuses the version\n   * the tier op already has, no re-read; unused on the remove side. No-op\n   * fast when the collection has no MV/derivation source — each dispatcher\n   * below checks its own source before doing any work.\n   */\n  syncDerived(id: string, record: T | null, elevated: boolean, version?: number): Promise<void>\n  /**\n   * `true` iff the collection has a materialized-view or derivation source\n   * attached. Gates the {@link syncDerived} pre-move decode on the remove\n   * direction (`elevate()`, `putAtTier(tier>0)`, `demote()`'s intermediate-\n   * tier branch): those sites decode the record SOLELY to feed\n   * `syncDerived(..., true)`, whose dispatchers no-op immediately when the\n   * collection has no MV/derivation source — so a no-derivation collection\n   * would otherwise pay a full record-body decrypt on every tier move for\n   * nothing (#722 perf regression). `false` short-circuits the decode to\n   * `null`, which `syncDerivedOutputs` already treats safely.\n   */\n  readonly hasDerivedOutputs: boolean\n  /** Emit `_source`/`_sourceTs` provenance fields when a source is supplied. */\n  readonly provenance: boolean\n  /** Declared tiers, or null when the feature is off. */\n  readonly tiers: ReadonlySet<number> | null\n  /** Above-tier read visibility mode (`'invisibility'` | `'ghost'`). */\n  readonly tierMode: TierMode\n  /** Resolve a tier DEK by its `dekKey(name, tier)`. */\n  getDEK(key: string): Promise<EnclaveKey>\n  /** Fire a cross-tier access event (sink stays collection-resident). */\n  emitCrossTierEvent(event: CrossTierAccessEvent): void\n  /**\n   * Register this record's ref in the encrypted `_subject_index` (#766).\n   * `putAtTier`'s raw `ctx.adapter.put` bypasses `Collection.put()`'s write-\n   * hook pipeline — the `onAfterWrite` hook that normally does this — so a\n   * record whose FIRST persistence is `putAtTier` (sensitive from birth, a\n   * documented legitimate use) would otherwise never enter the index and\n   * stay unreachable by `vault.forget()`. Idempotent (safe on every call,\n   * including a repeat write of an already-registered record) and a no-op\n   * when the collection declares no forget-subject field.\n   */\n  addSubjectRef(id: string, record: T): Promise<void>\n}\n\nexport function assertTiersEnabled<T>(ctx: TiersContext<T>): void {\n  if (!ctx.tiers) {\n    throw new Error(\n      `Collection \"${ctx.name}\": hierarchical tiers are not enabled. ` +\n      `Pass { tiers: [0, 1, 2, …] } to vault.collection() to opt in.`,\n    )\n  }\n}\n\nexport function assertDeclaredTier<T>(ctx: TiersContext<T>, tier: number): void {\n  if (tier < 0 || !Number.isInteger(tier)) {\n    throw new Error(`Collection \"${ctx.name}\": tier must be a non-negative integer, got ${tier}`)\n  }\n  if (tier === 0) return\n  if (!ctx.tiers || !ctx.tiers.has(tier)) {\n    throw new Error(\n      `Collection \"${ctx.name}\": tier ${tier} is not declared in { tiers: [...] }`,\n    )\n  }\n}\n\n/**\n * Tier-composition guard (#724 / Arc 7 of the tier-invisibility campaign).\n *\n * Refuses `tiers` declared together with a derived-artifact feature whose\n * crypto has not yet been made tier-aware — i.e. a feature `elevate()` /\n * `demote()` does not re-key when a record moves tiers, so an elevated\n * record's data for that feature would stay readable at tier 0.\n *\n * **Status:** the original call site (`Collection` constructor, beside\n * `buildUniqueConstraintSet`) was removed by Arc 10 Task 1 (#724) — the\n * `tiers + blobFields` refusal below was superseded by a runtime read gate\n * on `collection.blob(id)` (`with-shape/blobs/blob-set.ts`), so this\n * function currently has no caller. Relocated here from\n * `with-lookup/indexing/unique-constraints.ts` (#733) so the tier-domain\n * guard lives in the tier domain, rather than an indexing file it only\n * borrowed for a grandfathered import specifier.\n *\n * ## #724 verified: `tiers + blobFields` leaks\n *\n * `collection.blob(id)` (`Collection.blob()`) never checks the live\n * record's tier before returning a `BlobSet` handle, and `BlobSet`'s crypto\n * is entirely orthogonal to the tier ladder:\n *  - the slot map (`_blob_slots_{collection}/{id}`) is encrypted under the\n *    collection's TIER-0 DEK (`getDEK(name)` ≡ `dekKey(name, 0)` — see\n *    `dekKey` in `with-party/team/tiers.ts`), never a tier-N DEK;\n *  - chunk content (`_blob_index` / `_blob_chunks`) is encrypted under the\n *    vault-shared `_blob` DEK (`BLOB_COLLECTION`), which has no tier\n *    dimension at all.\n * `elevate()`/`demote()` (this file) rewrap only the live record body,\n * `_history` snapshots (#712), and index side-cars — blob slots and chunks\n * are untouched. A caller whose keyring never held the record's elevated\n * tier DEK can still open `collection.blob(id).get(slot)` and read full\n * plaintext, even though `collection.get(id)` correctly reports the same\n * record as invisible. See `__tests__/tier-composition-guard.test.ts` for\n * the reproduction.\n *\n * ## Safe today — no check needed here\n *\n * Field indexes, search (`textIndexes`/`embeddings`), `withHistory`\n * (snapshot keys are rewrapped by `elevate()`/`demote()`, #712), and the\n * decoded-record cache (evicted on tier moves) are already tier-safe. They\n * are not enumerated below; only known-unsafe features are refused, so any\n * combination not named here passes silently by default.\n *\n * ## Deliberately NOT handled here\n *\n * - `ledger` — `withHistory` threads a ledger writer onto every tiered\n *   collection by default in shipped usage; refusing `tiers + ledger` would\n *   break that default. A ledger-specific tier-rekey handler (rewrap ledger\n *   entries, or scope ledger visibility to tier) is a separate arc.\n * - materialized-view (MV) output — an MV's fanout spec lives on the\n *   SOURCE collection, not on the MV collection's own config, so it is not\n *   visible at `vault.collection()` registration time and this guard cannot\n *   detect it structurally.\n */\nexport function assertTierComposition(\n  collectionName: string,\n  cfg: { readonly tiers: boolean; readonly blobFields: BlobFieldsConfig | undefined },\n): void {\n  if (!cfg.tiers) return\n  if (cfg.blobFields !== undefined && Object.keys(cfg.blobFields).length > 0) {\n    throw new UnsupportedTierCompositionError(\n      'blobs',\n      `Collection \"${collectionName}\": blobFields are not supported together with tiers (#724) — ` +\n        `blob chunk content is encrypted under a vault-shared DEK that elevate()/demote() do not ` +\n        `re-key, so an elevated record's blob attachments would remain readable at tier 0. Use a ` +\n        `non-tiered collection for blob-bearing records until a blob tier-rekey handler ships.`,\n    )\n  }\n}\n\nfunction isElevatorOrOwner<T>(ctx: TiersContext<T>): boolean {\n  return ctx.keyring.role === 'owner' || ctx.keyring.role === 'admin'\n}\n\n/**\n * Structural surface {@link syncDerivedOutputs} needs from the owning\n * collection — the SAME onDelete dispatchers `forgetDerivedFanout` already\n * drives (`kernel/via/dispatch.ts`), reused as-is (#722). Narrower than\n * `Collection<T>` (avoids an import cycle: collection.ts constructs\n * `TiersContext` FROM `this`, which already satisfies this shape\n * structurally — no cast needed at the `tiersContext()` call site).\n */\nexport interface DerivedOutputsHost<T> {\n  dispatchMaterializedViewsOnDelete(id: string): Promise<{ deleted: number; residueUndecodable: string[]; residueDeclined: string[] }>\n  dispatchArrayDerivationsOnDelete(id: string, eraseRecordShapeToo?: boolean): Promise<number>\n  dispatchRollupsOnDelete(id: string, deleted: T): Promise<unknown>\n  /** Task 2 (#722) add-direction: the same local-write dispatchers an ordinary `put()` fires. */\n  dispatchMaterializedViews(id: string, record: T): Promise<void>\n  dispatchDerivations(id: string, record: T, version: number): Promise<void>\n}\n\n/**\n * The {@link TiersContext.syncDerived} implementation collection.ts's\n * `tiersContext()` binds `this` into (#722). See that field's doc comment\n * for the design; `host` is `this` — every dispatcher below is a public\n * Collection method, already self-guarding (no-op) when the collection has\n * no materialized-view/derivation source, so no separate fast-path check is\n * needed here.\n */\nexport async function syncDerivedOutputs<T>(\n  host: DerivedOutputsHost<T>,\n  id: string,\n  record: T | null,\n  elevated: boolean,\n  version?: number,\n): Promise<void> {\n  if (elevated) {\n    await host.dispatchMaterializedViewsOnDelete(id)\n    await host.dispatchArrayDerivationsOnDelete(id, true)\n    if (record !== null) await host.dispatchRollupsOnDelete(id, record)\n    return\n  }\n  // Task 2 (#722) recompute-as-add: the record rejoined tier 0 (demote(→0) /\n  // putAtTier(0)) — restore its contribution via the SAME local-write\n  // dispatchers an ordinary `put()` fires (`collection.ts`'s\n  // `_onRecordMutated('local-write')`), same order. `record === null` only\n  // when a caller demotes a tombstone/delete-marker to 0 — nothing to add.\n  if (record === null) return\n  await host.dispatchDerivations(id, record, version ?? 0)\n  await host.dispatchMaterializedViews(id, record)\n}\n\n/**\n * tier-aware put. Encrypts the record with the collection's tier-N DEK and\n * stamps `_tier: N` on the envelope. The caller's keyring must hold the tier-N\n * DEK (directly, by delegation, or by virtue of being the grantor); otherwise\n * throws `TierNotGrantedError`.\n *\n * accepts an optional `elevation` context. When present, the emitted cross-tier\n * event is stamped with `authorization: 'elevation'`, the elevation's reason,\n * and the caller's pre-elevation tier. `vault.elevate(...).collection().put`\n * threads this through; direct `putAtTier` calls leave it undefined and fall\n * back to the inherent-write event shape.\n */\nexport async function putAtTier<T>(\n  ctx: TiersContext<T>,\n  id: string,\n  record: T,\n  tier: number,\n  opts?: { elevation?: { reason: string; fromTier: number }; source?: string; sourceTs?: string },\n): Promise<TierMoveResult> {\n  assertTiersEnabled(ctx)\n  assertDeclaredTier(ctx, tier)\n  assertTierAccess(ctx.keyring, ctx.name, tier)\n\n  const key = dekKey(ctx.name, tier)\n  const dek = await ctx.getDEK(key)\n\n  const existing = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  // #712/whole-branch-fix-1: putAtTier moves the record OFF its existing\n  // tier, same as elevate/demote — so the caller must also be cleared for\n  // that existing tier, not just the target. Without this, a member holding\n  // only the target tier's DEK could putAtTier over a record parked at a\n  // tier they've never been granted; the from-tier `getDEK` below would then\n  // silently MINT a fresh DEK for that tier into their keyring (a\n  // non-cleared caller creating tier key material inside the trust\n  // boundary — see `assertTierAccess`'s doc comment). Gate here, BEFORE any\n  // from-tier getDEK/syncHistory call, so the mint never happens; owner/\n  // admin/custodian still bypass (they may mint, same as elevate/demote).\n  assertTierAccess(ctx.keyring, ctx.name, existing?._tier ?? 0)\n  const version = existing ? existing._v + 1 : 1\n\n  // #728 review-fix-2: resolve the from-tier DEK and snapshot the PRE-move\n  // version BEFORE the live write below, mirroring elevate()/demote() —\n  // originally this ran much later (after syncIndexes/syncLedger/syncDerived/\n  // syncSearchResilient), so a throw in any of those left the live record\n  // already moved with `existing` — its sole pre-move copy — gone, silently\n  // losing the version #728 exists to preserve. `fromKey`/`fromDek` are\n  // resolved ONCE here and reused below for the trailing syncHistory rewrap.\n  const fromKey = dekKey(ctx.name, existing?._tier ?? 0)\n  const fromDek = await ctx.getDEK(fromKey)\n  if (existing && ctx.historyEnabled) {\n    // Snapshot the version this write is about to overwrite — same law as\n    // Collection.put()'s history save, extended to putAtTier (#728). Rewrap\n    // under the DESTINATION `dek` via `applyRewrappedBody` (never\n    // `ctx.codec.encryptRecord`, which always resolves the tier-0 DEK and\n    // would leak this body at rest whenever the prior tier was > 0).\n    // Untagged (`_tier`/`_elevatedBy` stripped), same as elevate()/\n    // demote()'s snapshots. `_v` stays the PRE-move version (unbumped), as\n    // `preCarried` already carries it.\n    const body = await rewrapBodyToDek(existing, fromDek, dek)\n    // eslint-disable-next-line @typescript-eslint/no-unused-vars -- excluded from ...preCarried\n    const { _tier: _preTier, _elevatedBy: _preElevatedBy, ...preCarried } = existing\n    await ctx.saveHistorySnapshot(id, applyRewrappedBody(preCarried, body))\n  }\n\n  const json = JSON.stringify(record)\n  const { iv, data } = await encrypt(json, dek)\n  const envelope: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: version,\n    _ts: new Date().toISOString(),\n    _iv: iv,\n    _data: data,\n    _by: ctx.keyring.userId,\n    ...(tier > 0 && { _tier: tier }),\n    ...(ctx.provenance && opts?.source !== undefined ? { _source: opts.source, _sourceTs: opts.sourceTs ?? new Date().toISOString() } : {}),\n  }\n\n  await ctx.adapter.put(ctx.vault, ctx.name, id, envelope)\n\n  // #766: putAtTier bypasses Collection.put()'s onAfterWrite hook — register\n  // the subject ref directly so a sensitive-from-birth first write stays\n  // reachable by vault.forget(). No-op when no forget-subject field is declared.\n  await ctx.addSubjectRef(id, record)\n\n  // #702/#709: keep the record cache AND indexes coherent with the raw\n  // write — same law as elevate/demote (#691): tier > 0 → invisible on\n  // tier-0 surfaces (evict + purge); tier 0 → an ordinary write (re-seed +\n  // reindex). syncIndexes runs first — it needs the pre-write cache entry\n  // as \"previous\", which syncCache is about to overwrite/evict.\n  if (tier > 0) {\n    await ctx.syncIndexes(id, null, version)\n    ctx.syncCache(id, null)\n    // #729: the record lands above tier 0 — purge its tier-0-era plaintext\n    // ledger deltas (irreversible; a tier-0 putAtTier(0) has nothing to purge).\n    await ctx.syncLedger(id)\n    // #722: recompute this record's derived outputs now that it left tier 0\n    // — same law as elevate() below. `existing` is the PRE-write envelope;\n    // decode it only here (the rollup edge is the only consumer). Gated by\n    // `hasDerivedOutputs` — no-derivation collections skip this decrypt\n    // entirely (perf regression review finding, Arc 9 #722). Whole-branch\n    // review: `existing` may sit at ANY prior tier (including a\n    // `putAtTier`-origin tier>0 record with no `_cek` ever minted) — decode\n    // it under ITS OWN tier's DEK via `codec.decryptRecordAtDek`, not\n    // `ctx.codec.decryptRecord`'s tier-unaware default, which threw\n    // `TamperedError` here.\n    await ctx.syncDerived(\n      id,\n      ctx.hasDerivedOutputs && existing\n        ? await ctx.codec.decryptRecordAtDek(existing, await ctx.getDEK(dekKey(ctx.name, existing._tier ?? 0)), id)\n        : null,\n      true,\n    )\n  } else {\n    const rec = await ctx.codec.decryptRecord(envelope, { id, sealedAsHandles: true })\n    await ctx.syncIndexes(id, rec, envelope._v, existing ?? undefined)\n    ctx.syncCache(id, rec !== null ? { record: rec, version: envelope._v } : null)\n    // #722 Task 2: the record is written at tier 0 — restore its\n    // contribution to every derived output (reuse the decode above, no\n    // double-decrypt).\n    await ctx.syncDerived(id, rec, false, envelope._v)\n  }\n  // #721: search artifacts follow the same tier > 0 → purge / tier 0 →\n  // re-embed law as syncIndexes above. No ordering dependency on syncCache —\n  // the _ftindex rebuild is deferred to the next retrieve() and _vec re-embed\n  // reads `record` directly, not the cache. #774: a permanently stuck\n  // compensation must not abort the write — the record put above already\n  // landed — so it is caught and surfaced as residue instead, same as\n  // elevate()/demote() (#764).\n  const searchResidue = await syncSearchResilient(ctx, id, tier > 0 ? null : record, envelope._v)\n\n  if (tier > 0) {\n    ctx.emitCrossTierEvent({\n      actor: ctx.keyring.userId,\n      collection: ctx.name,\n      id,\n      tier,\n      authorization: opts?.elevation ? 'elevation' : 'inherent',\n      op: 'put',\n      ts: envelope._ts,\n      ...(opts?.elevation && {\n        reason: opts.elevation.reason,\n        elevatedFrom: opts.elevation.fromTier,\n      }),\n    })\n  }\n\n  // #712/whole-branch-fix-2: syncHistory runs LAST — after syncIndexes/\n  // syncCache/syncSearch (and the cross-tier emit) have already landed. Its\n  // own throw (adapter I/O, the Fix-1 assertion, the rewrap) then strands\n  // only the `_history` artifact instead of leaving indexes/cache/search\n  // unsynced behind an already-moved live record (would conditionally\n  // reopen #709/#721/#723 on the error path). A direct putAtTier also moves\n  // the record's tier — its history snapshots (if any exist from an earlier\n  // tier-0 put()) must follow, same as elevate/demote. Skip when the record\n  // was already at this tier (no move, nothing to rewrap). `fromKey`/\n  // `fromDek` were already resolved above (review-fix-2), before the live\n  // write, for the pre-move snapshot — reused here rather than recomputed.\n  if (fromKey !== key) {\n    await ctx.syncHistory(id, fromDek, dek)\n    // #724: this putAtTier moved the record's tier — rehome its blobs too.\n    await ctx.syncBlobs(id, existing?._tier ?? 0, tier)\n  }\n  return { searchResidue }\n}\n\n/**\n * tier-aware get. When the stored record is at a tier the caller cannot\n * decrypt:\n *   - `'invisibility'` mode (default) → returns `null`.\n *   - `'ghost'` mode → returns a `GhostRecord` placeholder with the tier and\n *     the record id (the record exists but contents are withheld).\n *\n * Fully-cleared reads return the plaintext record and fire a cross-tier event\n * when `_tier > 0`.\n */\nexport async function getAtTier<T>(ctx: TiersContext<T>, id: string): Promise<T | GhostRecord | null> {\n  assertTiersEnabled(ctx)\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope) return null\n  const tier = envelope._tier ?? 0\n  if (tier === 0) {\n    return ctx.codec.decryptRecord(envelope, { id })\n  }\n\n  const key = dekKey(ctx.name, tier)\n  if (!ctx.keyring.deks.has(key)) {\n    if (ctx.tierMode === 'ghost') {\n      return { _ghost: true, _tier: tier } as GhostRecord\n    }\n    return null\n  }\n\n  const dek = await ctx.getDEK(key)\n  // A tiered record may carry a per-record CEK (e.g. a CEK record\n  // elevated via `elevate()`): the CEK is wrapped under the TIER DEK, so\n  // unwrap under the tier DEK then decrypt the body under the CEK. Legacy\n  // tiered records decrypt directly under the tier DEK.\n  let plaintext: string\n  let cek: EnclaveKey | undefined\n  if (envelope._cek !== undefined) {\n    cek = await unwrapCek(envelope._cek, dek)\n    ctx.cekCache?.set(id, cek, 1)\n    plaintext = await decrypt(envelope._iv, envelope._data, cek)\n  } else {\n    plaintext = await decrypt(envelope._iv, envelope._data, dek)\n  }\n  let record = JSON.parse(plaintext) as T\n\n  // #635: this manual-decrypt leg never went through `decryptRecord`, so it\n  // never processed `_sealed` slots — an elevated classified record read\n  // back through here would return the body WITHOUT its sealed fields\n  // (silent omission). `applySealedSlots` is the same post-processing\n  // `decryptRecord`'s tier-0 branch above gets for free, extracted so it can\n  // take OUR already-unwrapped `cek` (unwrapped under the TIER dek above)\n  // instead of resolving one itself under the collection DEK the way\n  // `decryptRecord`/`resolveEnvelopeCek` would — which would be the wrong\n  // key for a `_cek` wrapped under a tier DEK. `sealedAsHandles` is omitted\n  // (default false) to match this function's OWN tier-0 branch above\n  // (`ctx.codec.decryptRecord(envelope, { id })`, no `sealedAsHandles`) —\n  // both tiers return sealed fields inline-decrypted, not as handles.\n  if (envelope._sealed !== undefined) {\n    record = await ctx.codec.applySealedSlots(record, envelope._sealed, cek, { id })\n  }\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier,\n    authorization: isElevatorOrOwner(ctx) ? 'inherent' : 'delegation',\n    op: 'get',\n    ts: new Date().toISOString(),\n  })\n\n  return record\n}\n\n/**\n * list ids grouped by the caller's readability. Returns only ids whose tier the\n * caller can read. Above-tier ids are omitted in `'invisibility'` mode and\n * included (with tier metadata) in `'ghost'` mode.\n */\nexport async function listAtTier<T>(ctx: TiersContext<T>): Promise<Array<{ id: string; tier: number; readable: boolean }>> {\n  assertTiersEnabled(ctx)\n  const ids = await ctx.adapter.list(ctx.vault, ctx.name)\n  const out: Array<{ id: string; tier: number; readable: boolean }> = []\n  for (const id of ids) {\n    const env = await ctx.adapter.get(ctx.vault, ctx.name, id)\n    if (!env) continue\n    const tier = env._tier ?? 0\n    const readable = tier === 0 || ctx.keyring.deks.has(dekKey(ctx.name, tier))\n    if (!readable && ctx.tierMode === 'invisibility') continue\n    out.push({ id, tier, readable })\n  }\n  return out\n}\n\n/**\n * Result of a completed `elevate()`/`demote()` (#764). The record move\n * (put + indexes/cache/ledger/derived/history/blobs sync) always completes —\n * `searchResidue: true` means only the search-index side (`_vec`/`_ftindex`)\n * was left in a needs-retry state (a stuck `PersistedIndexCompensationError`),\n * mirroring `forget()`'s `indexResidue` posture rather than aborting the move.\n */\nexport interface TierMoveResult {\n  readonly searchResidue: boolean\n}\n\n/**\n * Run {@link TiersContext.syncSearch} with #764 resilience: a permanently\n * stuck compensation (`PersistedIndexCompensationError`, thrown by\n * `PersistedIndexStore` when its compensating `remove()` of a stale\n * `_ftindex` blob keeps failing) must not abort `elevate()`/`demote()` — the\n * record's tier-move `put` has already landed, and aborting here would leave\n * `syncLedger`/`syncDerived`/`syncHistory`/`syncBlobs` unsynced behind it (the\n * partial-completion hazard #764 names). Same posture `forget()` takes for\n * `_purgeSearchIndex` (`vault.ts`'s `indexResidue`) — everything else (a\n * genuinely unexpected search-hook error) still aborts, undisturbed.\n */\nasync function syncSearchResilient<T>(ctx: TiersContext<T>, id: string, record: T | null, version?: number): Promise<boolean> {\n  try {\n    await ctx.syncSearch(id, record, version)\n    return false\n  } catch (e) {\n    if (e instanceof PersistedIndexCompensationError) return true\n    throw e\n  }\n}\n\n/**\n * elevate a record to a higher tier. Re-encrypts with the target tier's DEK.\n * The caller must hold DEKs for both the current tier (to decrypt) and the\n * target tier (to re-encrypt). Stamps `_elevatedBy` with the caller id so\n * `demote()` can check the reverse operation.\n */\nexport async function elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<TierMoveResult> {\n  assertTiersEnabled(ctx)\n  assertDeclaredTier(ctx, toTier)\n  assertTierAccess(ctx.keyring, ctx.name, toTier)\n\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope || isDeleteMarker(envelope) || isTombstoneShape(envelope)) {\n    throw new Error(`Record \"${id}\" not found in collection \"${ctx.name}\"`)\n  }\n  const fromTier = envelope._tier ?? 0\n  if (toTier === fromTier) return { searchResidue: false }\n  if (toTier < fromTier) {\n    throw new Error(`Use demote() to lower the tier of \"${id}\" from ${fromTier} to ${toTier}`)\n  }\n  // Caller must have access at the existing tier to decrypt.\n  if (fromTier > 0) assertTierAccess(ctx.keyring, ctx.name, fromTier)\n\n  const fromKey = dekKey(ctx.name, fromTier)\n  const toKey = dekKey(ctx.name, toTier)\n  const fromDek = await ctx.getDEK(fromKey)\n  const toDek = await ctx.getDEK(toKey)\n\n  // Per-record CEK composes with tiers: the body key is unchanged (history\n  // chain identity preserved); only the wrapping key moves with the tier.\n  // Legacy (no `_cek`) records take the direct-DEK path unchanged.\n  const now = new Date().toISOString()\n  const body = await rewrapBodyToDek(envelope, fromDek, toDek)\n  if (body.cek) ctx.cekCache?.set(id, body.cek, 1)\n  // #728: snapshot the PRE-move version into `_history` before it's\n  // overwritten below — reuses `body` (already fromDek→toDek) via\n  // `applyRewrappedBody` (never `ctx.codec.encryptRecord`, which always\n  // resolves the tier-0 DEK and would leak this body at rest whenever\n  // `fromTier > 0`). Untagged (`_tier`/`_elevatedBy` stripped) so the\n  // history read-gate doesn't hide it PERMANENTLY once the record demotes\n  // back — at-rest protection comes from the ciphertext being under\n  // `toDek`, not from the tag. `_v` stays the PRE-move version (unbumped),\n  // exactly as `envelope` already carries it.\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars -- excluded from ...snapshot\n  const { _tier: _preTier, _elevatedBy: _preElevatedBy, ...snapshot } = applyRewrappedBody(envelope, body)\n  await ctx.saveHistorySnapshot(id, snapshot)\n  // #662: spread every slot the source carries (_sealed/_det/_vdig/_bidx/\n  // _source/_sourceTs/_debug) through UNCHANGED, then override only\n  // the fields a tier move manages. rewrapBodyToDek preserves the CEK, so no\n  // passenger slot is re-keyed by the move. The old field-literal dropped every\n  // unlisted slot.\n  const next: EncryptedEnvelope = {\n    ...envelope,\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: envelope._v + 1,\n    _ts: now,\n    _iv: body._iv,\n    _data: body._data,\n    _by: ctx.keyring.userId,\n    _tier: toTier,\n    _elevatedBy: ctx.keyring.userId,\n    ...(body._cek !== undefined ? { _cek: body._cek } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, ctx.name, id, next)\n  // Evict/purge only once the write landed — a throwing put must not blind\n  // the eager cache or leave a readable index behind for a still-valid\n  // tier-0 record (same ordering as demote). #709: syncIndexes runs first —\n  // it needs the pre-elevation cache entry as \"previous\" to clean the\n  // eager index bucket; the persisted side-car purge is content-free.\n  await ctx.syncIndexes(id, null, next._v)\n  ctx.syncCache(id, null)\n  // #721: same purge law as syncIndexes above — the record left tier 0, so\n  // its _vec sidecar is purged and _ftindex is invalidated. #764: a\n  // permanently stuck compensation must not abort the move — the record put\n  // above already landed — so it is caught and surfaced as residue instead.\n  const searchResidue = await syncSearchResilient(ctx, id, null)\n  // #729: elevate always lands the record at tier > 0 — purge its\n  // tier-0-era plaintext ledger deltas (irreversible; entry metadata stays).\n  await ctx.syncLedger(id)\n  // #722: recompute this record's derived outputs now that it left tier 0 —\n  // same law as putAtTier(tier>0) above. `envelope` is the PRE-move envelope\n  // (captured before the rewrap), decoded only here (the rollup edge is the\n  // only consumer of the record content). Gated by `hasDerivedOutputs` — no-\n  // derivation collections skip this decrypt entirely (perf regression\n  // review finding, Arc 9 #722). Whole-branch review: decode under `fromDek`\n  // via `codec.decryptRecordAtDek` — `fromTier` may be > 0 here (a prior\n  // elevate), and `ctx.codec.decryptRecord`'s tier-unaware CEK resolution\n  // threw `TamperedError` whenever this op's own rewrap hadn't just primed\n  // the cekCache (non-`perRecordKeys` collections; `_cek`-absent bodies).\n  await ctx.syncDerived(id, ctx.hasDerivedOutputs ? await ctx.codec.decryptRecordAtDek(envelope, fromDek, id) : null, true)\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier: toTier,\n    authorization: 'elevation',\n    op: 'elevate',\n    ts: now,\n  })\n\n  // #712/whole-branch-fix-2: syncHistory runs LAST — after syncIndexes/\n  // syncCache/syncSearch/the cross-tier emit have already landed, so its own\n  // throw (adapter I/O, the rewrap) strands only the `_history` artifact\n  // instead of leaving indexes/cache/search unsynced behind an already-moved\n  // live record (would conditionally reopen #709/#721/#723 on the error\n  // path). Rewraps prior-version history snapshots to the SAME toTier DEK —\n  // otherwise they stay decryptable at rest under fromDek forever.\n  await ctx.syncHistory(id, fromDek, toDek)\n  // #724: rehome any solo-owned blob attachments to the target tier's\n  // `_blob` DEK — same at-rest law as syncHistory above.\n  await ctx.syncBlobs(id, fromTier, toTier)\n  return { searchResidue }\n}\n\n/**\n * demote a record to a lower tier. Allowed only for the user who performed the\n * last elevation or an owner.\n */\nexport async function demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<TierMoveResult> {\n  assertTiersEnabled(ctx)\n  if (toTier < 0) throw new Error(`Cannot demote to negative tier ${toTier}`)\n\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope || isDeleteMarker(envelope) || isTombstoneShape(envelope)) {\n    throw new Error(`Record \"${id}\" not found in collection \"${ctx.name}\"`)\n  }\n  const fromTier = envelope._tier ?? 0\n  if (toTier === fromTier) return { searchResidue: false }\n  if (toTier > fromTier) {\n    throw new Error(`Use elevate() to raise the tier of \"${id}\" from ${fromTier} to ${toTier}`)\n  }\n  const isOwner = ctx.keyring.role === 'owner'\n  const isOriginalElevator = envelope._elevatedBy === ctx.keyring.userId\n  if (!isOwner && !isOriginalElevator) {\n    throw new TierDemoteDeniedError(id, fromTier)\n  }\n  // Caller must still hold the DEK of the current tier to decrypt.\n  assertTierAccess(ctx.keyring, ctx.name, fromTier)\n  if (toTier > 0) assertDeclaredTier(ctx, toTier)\n\n  const fromDek = await ctx.getDEK(dekKey(ctx.name, fromTier))\n  const toDek = await ctx.getDEK(dekKey(ctx.name, toTier))\n\n  // CEK re-wrap on demote — same body key, moved from the source tier\n  // DEK to the target tier DEK. Legacy records take the direct-DEK path.\n  const now = new Date().toISOString()\n  const body = await rewrapBodyToDek(envelope, fromDek, toDek)\n  if (body.cek) ctx.cekCache?.set(id, body.cek, 1)\n  // #662: same passenger carry-through as elevate(). demote additionally CLEARS\n  // `_elevatedBy` (the demote right is consumed) and OMITS `_tier` at tier 0, so\n  // both are destructured out of the spread rather than carried.\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars -- excluded from ...carried\n  const { _elevatedBy, _tier: _priorTier, ...carried } = envelope\n  // #728: snapshot the PRE-move version into `_history` — reuses `body`\n  // (already fromDek→toDek) and `carried` (envelope minus `_tier`/\n  // `_elevatedBy`, computed above for the live write) via\n  // `applyRewrappedBody`, so a tier-0-landing demote's snapshot is untagged\n  // just like an ordinary put() entry, same law as elevate()'s snapshot\n  // above. `_v` stays the PRE-move version (unbumped), as `carried` already\n  // carries it.\n  await ctx.saveHistorySnapshot(id, applyRewrappedBody(carried, body))\n  const next: EncryptedEnvelope = {\n    ...carried,\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: envelope._v + 1,\n    _ts: now,\n    _iv: body._iv,\n    _data: body._data,\n    _by: ctx.keyring.userId,\n    ...(toTier > 0 ? { _tier: toTier } : {}),\n    ...(body._cek !== undefined ? { _cek: body._cek } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, ctx.name, id, next)\n\n  // #691/#709: landing back at tier 0 makes this a plain tier-0 record\n  // again — it must stay plain-get()-readable AND indexed in the same\n  // session, so re-seed the eager cache and rebuild its index entries from\n  // the just-written (now tier-0-keyed) envelope through the canonical\n  // codec path, the same decode collection.ts's own eager hydration / lazy\n  // cache-miss paths use — reused for both, no double-decrypt. A demote\n  // that lands on an intermediate elevated tier (toTier > 0) still evicts\n  // + purges: the record stays above tier 0 and must remain invisible on\n  // tier-0 surfaces, unindexed. syncIndexes runs first in both branches —\n  // it needs the pre-demote cache entry as \"previous\".\n  // #764: a permanently stuck search-index compensation must not abort the\n  // move — the record put above already landed — so it is caught in both\n  // branches and surfaced as residue on the return value instead.\n  let searchResidue: boolean\n  if (toTier === 0) {\n    const rec = await ctx.codec.decryptRecord(next, { id, sealedAsHandles: true })\n    await ctx.syncIndexes(id, rec, next._v, envelope)\n    ctx.syncCache(id, rec !== null ? { record: rec, version: next._v } : null)\n    // #721: reuse the decode above — no double-decrypt. The record is tier-0\n    // again, so re-embed its _vec and invalidate _ftindex to include it.\n    searchResidue = await syncSearchResilient(ctx, id, rec, next._v)\n    // #722 Task 2: the record rejoined tier 0 — restore its contribution to\n    // every derived output (reuse the decode above, no double-decrypt).\n    await ctx.syncDerived(id, rec, false, next._v)\n  } else {\n    await ctx.syncIndexes(id, null, next._v)\n    ctx.syncCache(id, null)\n    // #721: still above tier 0 — purge _vec, invalidate _ftindex.\n    searchResidue = await syncSearchResilient(ctx, id, null)\n    // #722 Task 2: still elevated (an intermediate tier) — the source's\n    // derived outputs stay recompute-as-removed, same law as elevate()\n    // above. `envelope` is the PRE-move envelope captured at function\n    // entry; decoded only here (the rollup edge is the only consumer).\n    // Gated by `hasDerivedOutputs` — no-derivation collections skip this\n    // decrypt entirely (perf regression review finding, Arc 9 #722).\n    // Whole-branch review: decode under `fromDek` via\n    // `codec.decryptRecordAtDek` — this branch's `fromTier` is always > 0 (a\n    // demote FROM tier `fromTier` TO an intermediate `toTier` > 0), so\n    // `ctx.codec.decryptRecord`'s tier-unaware CEK resolution threw\n    // `TamperedError` here exactly as it did in elevate() above\n    // (code-identical bug, same fix).\n    await ctx.syncDerived(id, ctx.hasDerivedOutputs ? await ctx.codec.decryptRecordAtDek(envelope, fromDek, id) : null, true)\n  }\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier: fromTier,\n    authorization: 'elevation',\n    op: 'demote',\n    ts: now,\n  })\n\n  // #712/whole-branch-fix-2: syncHistory runs LAST — after syncIndexes/\n  // syncCache/syncSearch/the cross-tier emit have already landed, so its own\n  // throw (adapter I/O, the rewrap) strands only the `_history` artifact\n  // instead of leaving indexes/cache/search unsynced behind an already-moved\n  // live record (would conditionally reopen #709/#721/#723 on the error\n  // path). Rewraps history snapshots the same direction as the live body —\n  // demote restores tier-0 (or intermediate-tier) readability at rest.\n  await ctx.syncHistory(id, fromDek, toDek)\n  // #724: rehome any solo-owned blob attachments the same direction as the\n  // live body — restores tier-0 (or intermediate-tier) readability at rest.\n  await ctx.syncBlobs(id, fromTier, toTier)\n  return { searchResidue }\n}\n\n/**\n * Classify a live envelope's `_sealed` slots for crypto-shred completeness\n * (#M-1). Thin delegate to {@link RecordCodec.classifySealedShred}; surfaced\n * here because `vault.ts` forget() reaches in via `collection._classifySealedShred`.\n */\nexport function classifySealedShred<T>(\n  ctx: TiersContext<T>,\n  live: EncryptedEnvelope,\n): Promise<{ readonly slots: readonly SealedShredSlot[] }> {\n  return ctx.codec.classifySealedShred(live)\n}\n\n// #837 — classifySealedShred's slot type must be nameable from this entry.\nexport type { SealedShredSlot } from '../../kernel/enclave/index.js'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AASO,SAAS,YAA2B;AACzC,SAAO;AAAA,IACL,MAAM,UAAU,KAAK,IAAI,QAAQ,MAAM,MAAM;AAC3C,YAAM,EAAE,WAAAA,WAAU,IAAI,MAAM,OAAO,kBAAY;AAC/C,aAAOA,WAAU,KAAK,IAAI,QAAQ,MAAM,IAAI;AAAA,IAC9C;AAAA,IACA,MAAM,UAAU,KAAK,IAAI;AACvB,YAAM,EAAE,WAAAC,WAAU,IAAI,MAAM,OAAO,kBAAY;AAC/C,aAAOA,WAAU,KAAK,EAAE;AAAA,IAC1B;AAAA,IACA,MAAM,WAAW,KAAK;AACpB,YAAM,EAAE,YAAAC,YAAW,IAAI,MAAM,OAAO,kBAAY;AAChD,aAAOA,YAAW,GAAG;AAAA,IACvB;AAAA,IACA,MAAM,QAAQ,KAAK,IAAI,QAAQ;AAC7B,YAAM,EAAE,SAAAC,SAAQ,IAAI,MAAM,OAAO,kBAAY;AAC7C,aAAOA,SAAQ,KAAK,IAAI,MAAM;AAAA,IAChC;AAAA,IACA,MAAM,OAAO,KAAK,IAAI,QAAQ;AAC5B,YAAM,EAAE,QAAAC,QAAO,IAAI,MAAM,OAAO,kBAAY;AAC5C,aAAOA,QAAO,KAAK,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACF;;;ACKO,IAAM,WAA0B;AAAA,EACrC,MAAM,YAAY;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACrD,MAAM,YAAY;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACrD,MAAM,aAAa;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACtD,MAAM,UAAU;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACnD,MAAM,SAAS;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AACpD;;;ACsMO,SAAS,mBAAsB,KAA4B;AAChE,MAAI,CAAC,IAAI,OAAO;AACd,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI;AAAA,IAEzB;AAAA,EACF;AACF;AAEO,SAAS,mBAAsB,KAAsB,MAAoB;AAC9E,MAAI,OAAO,KAAK,CAAC,OAAO,UAAU,IAAI,GAAG;AACvC,UAAM,IAAI,MAAM,eAAe,IAAI,IAAI,+CAA+C,IAAI,EAAE;AAAA,EAC9F;AACA,MAAI,SAAS,EAAG;AAChB,MAAI,CAAC,IAAI,SAAS,CAAC,IAAI,MAAM,IAAI,IAAI,GAAG;AACtC,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI,WAAW,IAAI;AAAA,IACxC;AAAA,EACF;AACF;AAyDO,SAAS,sBACd,gBACA,KACM;AACN,MAAI,CAAC,IAAI,MAAO;AAChB,MAAI,IAAI,eAAe,UAAa,OAAO,KAAK,IAAI,UAAU,EAAE,SAAS,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR;AAAA,MACA,eAAe,cAAc;AAAA,IAI/B;AAAA,EACF;AACF;AAEA,SAAS,kBAAqB,KAA+B;AAC3D,SAAO,IAAI,QAAQ,SAAS,WAAW,IAAI,QAAQ,SAAS;AAC9D;AA2BA,eAAsB,mBACpB,MACA,IACA,QACA,UACA,SACe;AACf,MAAI,UAAU;AACZ,UAAM,KAAK,kCAAkC,EAAE;AAC/C,UAAM,KAAK,iCAAiC,IAAI,IAAI;AACpD,QAAI,WAAW,KAAM,OAAM,KAAK,wBAAwB,IAAI,MAAM;AAClE;AAAA,EACF;AAMA,MAAI,WAAW,KAAM;AACrB,QAAM,KAAK,oBAAoB,IAAI,QAAQ,WAAW,CAAC;AACvD,QAAM,KAAK,0BAA0B,IAAI,MAAM;AACjD;AAcA,eAAsB,UACpB,KACA,IACA,QACA,MACA,MACyB;AACzB,qBAAmB,GAAG;AACtB,qBAAmB,KAAK,IAAI;AAC5B,mBAAiB,IAAI,SAAS,IAAI,MAAM,IAAI;AAE5C,QAAM,MAAM,OAAO,IAAI,MAAM,IAAI;AACjC,QAAM,MAAM,MAAM,IAAI,OAAO,GAAG;AAEhC,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAW9D,mBAAiB,IAAI,SAAS,IAAI,MAAM,UAAU,SAAS,CAAC;AAC5D,QAAM,UAAU,WAAW,SAAS,KAAK,IAAI;AAS7C,QAAM,UAAU,OAAO,IAAI,MAAM,UAAU,SAAS,CAAC;AACrD,QAAM,UAAU,MAAM,IAAI,OAAO,OAAO;AACxC,MAAI,YAAY,IAAI,gBAAgB;AASlC,UAAM,OAAO,MAAM,gBAAgB,UAAU,SAAS,GAAG;AAEzD,UAAM,EAAE,OAAO,UAAU,aAAa,gBAAgB,GAAG,WAAW,IAAI;AACxE,UAAM,IAAI,oBAAoB,IAAI,mBAAmB,YAAY,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,OAAO,KAAK,UAAU,MAAM;AAClC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,QAAM,WAA8B;AAAA,IAClC,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,KAAK,IAAI,QAAQ;AAAA,IACjB,GAAI,OAAO,KAAK,EAAE,OAAO,KAAK;AAAA,IAC9B,GAAI,IAAI,cAAc,MAAM,WAAW,SAAY,EAAE,SAAS,KAAK,QAAQ,WAAW,KAAK,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE,IAAI,CAAC;AAAA,EACvI;AAEA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,QAAQ;AAKvD,QAAM,IAAI,cAAc,IAAI,MAAM;AAOlC,MAAI,OAAO,GAAG;AACZ,UAAM,IAAI,YAAY,IAAI,MAAM,OAAO;AACvC,QAAI,UAAU,IAAI,IAAI;AAGtB,UAAM,IAAI,WAAW,EAAE;AAWvB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,IAAI,qBAAqB,WACrB,MAAM,IAAI,MAAM,mBAAmB,UAAU,MAAM,IAAI,OAAO,OAAO,IAAI,MAAM,SAAS,SAAS,CAAC,CAAC,GAAG,EAAE,IACxG;AAAA,MACJ;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,MAAM,MAAM,IAAI,MAAM,cAAc,UAAU,EAAE,IAAI,iBAAiB,KAAK,CAAC;AACjF,UAAM,IAAI,YAAY,IAAI,KAAK,SAAS,IAAI,YAAY,MAAS;AACjE,QAAI,UAAU,IAAI,QAAQ,OAAO,EAAE,QAAQ,KAAK,SAAS,SAAS,GAAG,IAAI,IAAI;AAI7E,UAAM,IAAI,YAAY,IAAI,KAAK,OAAO,SAAS,EAAE;AAAA,EACnD;AAQA,QAAM,gBAAgB,MAAM,oBAAoB,KAAK,IAAI,OAAO,IAAI,OAAO,QAAQ,SAAS,EAAE;AAE9F,MAAI,OAAO,GAAG;AACZ,QAAI,mBAAmB;AAAA,MACrB,OAAO,IAAI,QAAQ;AAAA,MACnB,YAAY,IAAI;AAAA,MAChB;AAAA,MACA;AAAA,MACA,eAAe,MAAM,YAAY,cAAc;AAAA,MAC/C,IAAI;AAAA,MACJ,IAAI,SAAS;AAAA,MACb,GAAI,MAAM,aAAa;AAAA,QACrB,QAAQ,KAAK,UAAU;AAAA,QACvB,cAAc,KAAK,UAAU;AAAA,MAC/B;AAAA,IACF,CAAC;AAAA,EACH;AAaA,MAAI,YAAY,KAAK;AACnB,UAAM,IAAI,YAAY,IAAI,SAAS,GAAG;AAEtC,UAAM,IAAI,UAAU,IAAI,UAAU,SAAS,GAAG,IAAI;AAAA,EACpD;AACA,SAAO,EAAE,cAAc;AACzB;AAYA,eAAsB,UAAa,KAAsB,IAA6C;AACpG,qBAAmB,GAAG;AACtB,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,OAAO,SAAS,SAAS;AAC/B,MAAI,SAAS,GAAG;AACd,WAAO,IAAI,MAAM,cAAc,UAAU,EAAE,GAAG,CAAC;AAAA,EACjD;AAEA,QAAM,MAAM,OAAO,IAAI,MAAM,IAAI;AACjC,MAAI,CAAC,IAAI,QAAQ,KAAK,IAAI,GAAG,GAAG;AAC9B,QAAI,IAAI,aAAa,SAAS;AAC5B,aAAO,EAAE,QAAQ,MAAM,OAAO,KAAK;AAAA,IACrC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,MAAM,IAAI,OAAO,GAAG;AAKhC,MAAI;AACJ,MAAI;AACJ,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,MAAM,UAAU,SAAS,MAAM,GAAG;AACxC,QAAI,UAAU,IAAI,IAAI,KAAK,CAAC;AAC5B,gBAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAAA,EAC7D,OAAO;AACL,gBAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAAA,EAC7D;AACA,MAAI,SAAS,KAAK,MAAM,SAAS;AAcjC,MAAI,SAAS,YAAY,QAAW;AAClC,aAAS,MAAM,IAAI,MAAM,iBAAiB,QAAQ,SAAS,SAAS,KAAK,EAAE,GAAG,CAAC;AAAA,EACjF;AAEA,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA;AAAA,IACA,eAAe,kBAAkB,GAAG,IAAI,aAAa;AAAA,IACrD,IAAI;AAAA,IACJ,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,EAC7B,CAAC;AAED,SAAO;AACT;AAOA,eAAsB,WAAc,KAAuF;AACzH,qBAAmB,GAAG;AACtB,QAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,IAAI;AACtD,QAAM,MAA8D,CAAC;AACrE,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AACzD,QAAI,CAAC,IAAK;AACV,UAAM,OAAO,IAAI,SAAS;AAC1B,UAAM,WAAW,SAAS,KAAK,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,MAAM,IAAI,CAAC;AAC1E,QAAI,CAAC,YAAY,IAAI,aAAa,eAAgB;AAClD,QAAI,KAAK,EAAE,IAAI,MAAM,SAAS,CAAC;AAAA,EACjC;AACA,SAAO;AACT;AAwBA,eAAe,oBAAuB,KAAsB,IAAY,QAAkB,SAAoC;AAC5H,MAAI;AACF,UAAM,IAAI,WAAW,IAAI,QAAQ,OAAO;AACxC,WAAO;AAAA,EACT,SAAS,GAAG;AACV,QAAI,aAAa,gCAAiC,QAAO;AACzD,UAAM;AAAA,EACR;AACF;AAQA,eAAsB,QAAW,KAAsB,IAAY,QAAyC;AAC1G,qBAAmB,GAAG;AACtB,qBAAmB,KAAK,MAAM;AAC9B,mBAAiB,IAAI,SAAS,IAAI,MAAM,MAAM;AAE9C,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,YAAY,eAAe,QAAQ,KAAK,iBAAiB,QAAQ,GAAG;AACvE,UAAM,IAAI,MAAM,WAAW,EAAE,8BAA8B,IAAI,IAAI,GAAG;AAAA,EACxE;AACA,QAAM,WAAW,SAAS,SAAS;AACnC,MAAI,WAAW,SAAU,QAAO,EAAE,eAAe,MAAM;AACvD,MAAI,SAAS,UAAU;AACrB,UAAM,IAAI,MAAM,sCAAsC,EAAE,UAAU,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC3F;AAEA,MAAI,WAAW,EAAG,kBAAiB,IAAI,SAAS,IAAI,MAAM,QAAQ;AAElE,QAAM,UAAU,OAAO,IAAI,MAAM,QAAQ;AACzC,QAAM,QAAQ,OAAO,IAAI,MAAM,MAAM;AACrC,QAAM,UAAU,MAAM,IAAI,OAAO,OAAO;AACxC,QAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;AAKpC,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,OAAO,MAAM,gBAAgB,UAAU,SAAS,KAAK;AAC3D,MAAI,KAAK,IAAK,KAAI,UAAU,IAAI,IAAI,KAAK,KAAK,CAAC;AAW/C,QAAM,EAAE,OAAO,UAAU,aAAa,gBAAgB,GAAG,SAAS,IAAI,mBAAmB,UAAU,IAAI;AACvG,QAAM,IAAI,oBAAoB,IAAI,QAAQ;AAM1C,QAAM,OAA0B;AAAA,IAC9B,GAAG;AAAA,IACH,QAAQ;AAAA,IACR,IAAI,SAAS,KAAK;AAAA,IAClB,KAAK;AAAA,IACL,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,IAAI,QAAQ;AAAA,IACjB,OAAO;AAAA,IACP,aAAa,IAAI,QAAQ;AAAA,IACzB,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,IAAI;AAMnD,QAAM,IAAI,YAAY,IAAI,MAAM,KAAK,EAAE;AACvC,MAAI,UAAU,IAAI,IAAI;AAKtB,QAAM,gBAAgB,MAAM,oBAAoB,KAAK,IAAI,IAAI;AAG7D,QAAM,IAAI,WAAW,EAAE;AAWvB,QAAM,IAAI,YAAY,IAAI,IAAI,oBAAoB,MAAM,IAAI,MAAM,mBAAmB,UAAU,SAAS,EAAE,IAAI,MAAM,IAAI;AAExH,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA,MAAM;AAAA,IACN,eAAe;AAAA,IACf,IAAI;AAAA,IACJ,IAAI;AAAA,EACN,CAAC;AASD,QAAM,IAAI,YAAY,IAAI,SAAS,KAAK;AAGxC,QAAM,IAAI,UAAU,IAAI,UAAU,MAAM;AACxC,SAAO,EAAE,cAAc;AACzB;AAMA,eAAsB,OAAU,KAAsB,IAAY,QAAyC;AACzG,qBAAmB,GAAG;AACtB,MAAI,SAAS,EAAG,OAAM,IAAI,MAAM,kCAAkC,MAAM,EAAE;AAE1E,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,YAAY,eAAe,QAAQ,KAAK,iBAAiB,QAAQ,GAAG;AACvE,UAAM,IAAI,MAAM,WAAW,EAAE,8BAA8B,IAAI,IAAI,GAAG;AAAA,EACxE;AACA,QAAM,WAAW,SAAS,SAAS;AACnC,MAAI,WAAW,SAAU,QAAO,EAAE,eAAe,MAAM;AACvD,MAAI,SAAS,UAAU;AACrB,UAAM,IAAI,MAAM,uCAAuC,EAAE,UAAU,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC5F;AACA,QAAM,UAAU,IAAI,QAAQ,SAAS;AACrC,QAAM,qBAAqB,SAAS,gBAAgB,IAAI,QAAQ;AAChE,MAAI,CAAC,WAAW,CAAC,oBAAoB;AACnC,UAAM,IAAI,sBAAsB,IAAI,QAAQ;AAAA,EAC9C;AAEA,mBAAiB,IAAI,SAAS,IAAI,MAAM,QAAQ;AAChD,MAAI,SAAS,EAAG,oBAAmB,KAAK,MAAM;AAE9C,QAAM,UAAU,MAAM,IAAI,OAAO,OAAO,IAAI,MAAM,QAAQ,CAAC;AAC3D,QAAM,QAAQ,MAAM,IAAI,OAAO,OAAO,IAAI,MAAM,MAAM,CAAC;AAIvD,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,OAAO,MAAM,gBAAgB,UAAU,SAAS,KAAK;AAC3D,MAAI,KAAK,IAAK,KAAI,UAAU,IAAI,IAAI,KAAK,KAAK,CAAC;AAK/C,QAAM,EAAE,aAAa,OAAO,YAAY,GAAG,QAAQ,IAAI;AAQvD,QAAM,IAAI,oBAAoB,IAAI,mBAAmB,SAAS,IAAI,CAAC;AACnE,QAAM,OAA0B;AAAA,IAC9B,GAAG;AAAA,IACH,QAAQ;AAAA,IACR,IAAI,SAAS,KAAK;AAAA,IAClB,KAAK;AAAA,IACL,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,IAAI,QAAQ;AAAA,IACjB,GAAI,SAAS,IAAI,EAAE,OAAO,OAAO,IAAI,CAAC;AAAA,IACtC,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,IAAI;AAenD,MAAI;AACJ,MAAI,WAAW,GAAG;AAChB,UAAM,MAAM,MAAM,IAAI,MAAM,cAAc,MAAM,EAAE,IAAI,iBAAiB,KAAK,CAAC;AAC7E,UAAM,IAAI,YAAY,IAAI,KAAK,KAAK,IAAI,QAAQ;AAChD,QAAI,UAAU,IAAI,QAAQ,OAAO,EAAE,QAAQ,KAAK,SAAS,KAAK,GAAG,IAAI,IAAI;AAGzE,oBAAgB,MAAM,oBAAoB,KAAK,IAAI,KAAK,KAAK,EAAE;AAG/D,UAAM,IAAI,YAAY,IAAI,KAAK,OAAO,KAAK,EAAE;AAAA,EAC/C,OAAO;AACL,UAAM,IAAI,YAAY,IAAI,MAAM,KAAK,EAAE;AACvC,QAAI,UAAU,IAAI,IAAI;AAEtB,oBAAgB,MAAM,oBAAoB,KAAK,IAAI,IAAI;AAavD,UAAM,IAAI,YAAY,IAAI,IAAI,oBAAoB,MAAM,IAAI,MAAM,mBAAmB,UAAU,SAAS,EAAE,IAAI,MAAM,IAAI;AAAA,EAC1H;AAEA,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA,MAAM;AAAA,IACN,eAAe;AAAA,IACf,IAAI;AAAA,IACJ,IAAI;AAAA,EACN,CAAC;AASD,QAAM,IAAI,YAAY,IAAI,SAAS,KAAK;AAGxC,QAAM,IAAI,UAAU,IAAI,UAAU,MAAM;AACxC,SAAO,EAAE,cAAc;AACzB;AAOO,SAAS,oBACd,KACA,MACyD;AACzD,SAAO,IAAI,MAAM,oBAAoB,IAAI;AAC3C;","names":["putAtTier","getAtTier","listAtTier","elevate","demote"]}