@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.21

package/dist/chunk-4OQZNXQG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/via/blob/binding.ts","../src/port/with/blob-strategy.ts","../src/with-shape/blobs/export-blobs.ts","../src/with-shape/blobs/blob-compaction.ts"],"sourcesContent":["/**\n * The blob `ViaBinding` (#629 Task 7) — wires the `blobFields` declaration\n * into the kernel's generic Via port as a deliberately THIN binding:\n * declaration + posture + `describeFragment` + `erase` glue, and nothing\n * else. Blob content is fully out-of-band (`collection.blob(id)` →\n * `BlobSet` writing `_blob_*` side-collections; it never touches\n * `_putInternal` or the record codec), so this binding declares **no\n * write/read pipeline hooks** — in particular no `encodeAtRest`/\n * `decodeAtRest`: a blobFields collection must not flip the pipeline's\n * `hasAtRestHooks`, or the codec would abandon its inline seal path for a\n * feature that never seals record fields. The routing/compaction/TTL/\n * legal-hold/exportBlobs machinery stays service-side in\n * `with-shape/blobs/` (the i18n-dictionary precedent — that machinery\n * does real chunk AEAD + key-lifecycle work `via-enclave-isolation`\n * forbids under `via/*`).\n *\n * Like classified (see `port/with/classified-strategy.ts`), the link is\n * EAGER — `port/with/blob-strategy.ts` calls {@link linkBlobVia} at module\n * load. `blobFields` policies are plain object literals (there is no\n * `blob.*()` declaration factory to hang a lazy link on), so the binder\n * must be installed before `compileViaBindings` ever sees one.\n *\n * There is no `declare`-time validation: `blobFields` has never had a\n * construction-time refusal matrix (policies are consulted lazily by\n * `vault.compact()` and `BlobSet.put`), and inventing one here would\n * break the behavior lock.\n *\n * `covers` (#629 Task 8) is a passive coverage predicate, not a pipeline\n * hook — it lets `ViaPipeline.postureFor` recognize a `blobFields` slot so\n * `.where()`/`.orderBy()`/`.aggregate()` can refuse it (posture\n * `queryable: 'none'`); it does not participate in clause building or\n * evaluation.\n */\nimport type { ViaBinding, ViaEraseCtx, ViaEraseReport } from '../../kernel/via/index.js'\nimport { installViaBinder } from '../../kernel/via/index.js'\nimport type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js'\n\n/**\n * Config a blob collection's `blobFields` declaration resolves to — the\n * binding's construction input. `purgeBlobsForRecord` is an OPTIONAL\n * vault/service-provided closure for the `erase` hook, mapping\n * `collection.blob(id).shredAllForRecord()`'s `{shredded, retainedShared,\n * residue}: string[]` accounting onto `ViaEraseReport` — `shredded`/\n * `retainedShared` become counts, each residue eTag becomes a tagged\n * `{kind: 'blob-residue', eTag}` entry.\n *\n * DELIBERATELY left unwired by `compileViaBindings` (#629 Task 10, resolved\n * within parity-first — see task-10-report.md \"blob purge\" section):\n * `per-blob-cek.test.ts`/`forget.test.ts` prove blob-shred-on-forget is\n * gated SOLELY on the vault's `blobsStrategy` being configured, never on a\n * given collection's OWN `blobFields` declaration (`.blob(id)` is callable,\n * and IS exercised by those tests, on collections with no `blobFields` at\n * all). Routing it exclusively through this binding would silently stop\n * blob crypto-shredding for every such collection; `vault.forget()` keeps\n * calling `collection.blob(id).shredAllForRecord()` directly for that\n * reason. The hook stays real/tested (see `blob-binding.test.ts`) for a\n * future caller that wants it.\n */\nexport interface BlobViaConfig {\n  readonly fields: BlobFieldsConfig\n  readonly collectionName: string\n  /** Purge one record's blob slots (crypto-shred participation). Returns the erase report for `forget()`'s summary. */\n  readonly purgeBlobsForRecord?: (id: string) => Promise<ViaEraseReport>\n}\n\n/**\n * `forget()`'s per-ref blob-purge participation: delegate to the wired\n * closure, or report a clean zero-shredded, zero-residue no-op — the\n * default in production too (#629 Task 10 deliberately leaves this unwired;\n * see `BlobViaConfig`'s doc comment).\n */\nasync function eraseBlobs(ctx: ViaEraseCtx, cfg: BlobViaConfig): Promise<ViaEraseReport> {\n  if (cfg.purgeBlobsForRecord) return cfg.purgeBlobsForRecord(ctx.id)\n  return { shredded: 0, residue: [] }\n}\n\n/**\n * One field's blob knobs as they appear on `describeFragment()`'s payload\n * (#657 — the second real `ViaBinding.describeFragment` consumer after\n * `lookup`'s; see `with-shape/introspection/describe.ts`'s `buildDescription`).\n * Declarative scalars (`retainDays`/`external`/`public`/`backlink`) verbatim;\n * predicate knobs (`evictWhen`/`legalHold`/`retainUntil` — functions over the\n * decrypted record) as presence flags, since a predicate has no serializable\n * form — mirrors `buildBlobDescribeFragment`'s per-field shape below.\n */\nexport interface BlobDescribeFragmentEntry {\n  readonly retainDays?: number\n  readonly evictWhen?: true\n  readonly legalHold?: true\n  readonly retainUntil?: true\n  readonly external?: true\n  readonly public?: true\n  readonly backlink?: string\n}\n\n/** The `'blob'` binding's `describeFragment()` payload shape. */\nexport interface BlobDescribeFragment {\n  readonly blobFields: Record<string, BlobDescribeFragmentEntry>\n}\n\n/**\n * `{ blobFields: { <field>: <knobs> } }` — declarative scalars\n * (`retainDays`/`external`/`public`/`backlink`) verbatim; predicate knobs\n * (`evictWhen`/`legalHold`/`retainUntil` — functions over the decrypted\n * record) as presence flags, since a predicate has no serializable form.\n */\nfunction buildBlobDescribeFragment(fields: BlobFieldsConfig): Record<string, unknown> {\n  return {\n    blobFields: Object.fromEntries(\n      Object.entries(fields).map(([field, p]) => [field, {\n        ...(p.retainDays !== undefined ? { retainDays: p.retainDays } : {}),\n        ...(p.evictWhen !== undefined ? { evictWhen: true } : {}),\n        ...(p.legalHold !== undefined ? { legalHold: true } : {}),\n        ...(p.retainUntil !== undefined ? { retainUntil: true } : {}),\n        ...(p.external === true ? { external: true } : {}),\n        ...(p.public === true ? { public: true } : {}),\n        ...(p.backlink !== undefined ? { backlink: p.backlink } : {}),\n      }]),\n    ),\n  }\n}\n\nexport function blobBinding(cfg: BlobViaConfig): ViaBinding {\n  return {\n    brand: 'blob',\n    // encryptedAtRest: 'envelope' — blob chunks are AEAD-encrypted envelopes\n    // in `_blob_chunks` (service-side), not sealed record fields; queryable:\n    // 'none' — nothing indexes blob content; exportable — vault.exportBlobs()\n    // is a first-class door; forgettable — shredAllForRecord participates in\n    // vault.forget().\n    posture: { encryptedAtRest: 'envelope', queryable: 'none', exportable: true, forgettable: true },\n    covers: (field) => field in cfg.fields,\n    erase: (ctx) => eraseBlobs(ctx, cfg),\n    describeFragment: () => buildBlobDescribeFragment(cfg.fields),\n  }\n}\n\nexport function linkBlobVia(): void {\n  installViaBinder('blob', (c) => blobBinding(c as BlobViaConfig))\n}\n","/**\n * Strategy seam between core Collection and the optional blob service\n * (#629 Task 7 — moved out of `with-shape/blobs/strategy.ts`, precedent:\n * `port/with/classified-strategy.ts`/`i18n-strategy.ts`). Lives on the\n * `/with` port (the one seam the kernel spine may import statically) so\n * `Collection`/`Vault` can hold the `NO_BLOBS` default without a\n * spine→service static import.\n *\n * Core imports `BlobsStrategy` as a TYPE-ONLY symbol and `NO_BLOBS` as a\n * minimal runtime stub. Neither pulls in the heavy `BlobSet` / chunk /\n * MIME machinery — those only arrive when the consumer explicitly\n * imports `@noy-db/hub/blobs` (see `via/blob/index.ts` →\n * `withBlobs()` factory).\n *\n * This file is intentionally tiny so the bundler keeps it in the graph\n * without dragging everything else in.\n *\n * @internal\n */\n\nimport type { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { ObjectProjection } from '../../with-shape/blobs/object-projection.js'\nimport type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { BlobCacheStats } from '../../with-shape/blobs/blob-pinning.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { linkBlobVia } from '../../via/blob/binding.js'\n\n// Install the blob Via binder EAGERLY (#629 Task 7) — `blobFields` policies\n// are plain object literals (there is no `blob.*()` declaration factory to\n// hang a lazy money/i18n-style link on), so the binder must be installed\n// before `compileViaBindings` ever compiles one. This port module is\n// already unconditionally imported by the kernel spine (for the `NO_BLOBS`\n// strategy default below), so linking here guarantees it — same rationale\n// as `port/with/classified-strategy.ts`'s eager `linkClassifiedVia()`. The\n// binding module is hook-free glue (declare/describe/erase) and imports no\n// machinery, so the eager cost is a few hundred bytes, not `BlobSet`.\nlinkBlobVia()\n\n/**\n * Args forwarded by `Collection.blob(id)` to the active strategy's\n * `openSlot`. The strategy is responsible for returning a live\n * `BlobSet` bound to the given record.\n *\n * @internal\n */\nexport interface BlobsStrategyOpenArgs {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly collection: string\n  readonly recordId: string\n  readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  readonly encrypted: boolean\n  readonly userId: string\n  /**\n   * Collection opts into per-record keys (`perRecordKeys`), so its blobs are\n   * erasable: new uploads mint a per-blob content CEK (crypto-shreddable at\n   * `refCount → 0`). Off → legacy shared-`_blob`-DEK chunks. See the per-blob\n   * CEK design spec.\n   */\n  readonly erasableBlobs?: boolean\n  /**\n   * Collection has `tiers` active (#724 I1 completion). Combined with\n   * `erasableBlobs` false, a content write is refused —\n   * `UnsupportedTierCompositionError` — since a legacy blob has no\n   * per-blob `_cek` and can never be tier-isolated on elevate/demote.\n   */\n  readonly tiersActive?: boolean\n  /**\n   * Vault is in debug-plaintext mode (`encrypt: false` + `debugPlaintext: true`).\n   * Blobs are then written as a single un-gzipped object (one base64 chunk) so\n   * the stored object is directly recoverable with native tools (`base64 -d`),\n   * matching the directly-inspectable record layout. Dev-only — see the\n   * plaintext/debug-store-mode design.\n   */\n  readonly debugPlaintext?: boolean\n  /**\n   * Object projection for `external` blob fields (`createNoydb({ objectStore })`).\n   * When present, fields declared `external` in `blobFields` route their raw\n   * bytes here instead of the encrypted-chunk path.\n   */\n  readonly objectStore?: ObjectProjection\n  /** Per-collection blob field policies — used to resolve `external` / `public`. */\n  readonly blobFields?: BlobFieldsConfig\n  /**\n   * The caller's unlocked keyring (#749). Threaded through so `BlobSet.atTier()`\n   * can run `assertTierAccess` — the SAME clearance gate `putAtTier`/`elevate`/\n   * `demote` run before any tier `getDEK` call — rather than relying on a bare\n   * `getDEK`, which auto-mints a DEK for ANY role and never throws (verified: it\n   * is not itself a gate). Omitted only by a construction path that never calls\n   * `atTier()`.\n   */\n  readonly keyring?: UnlockedKeyring\n}\n\n/**\n * The seam interface. `@internal` — do not build public APIs on this\n * shape; it can evolve freely until blobs are extracted into their\n * own package, at which point it will be promoted to public.\n *\n * @internal\n */\nexport interface BlobsStrategy {\n  openSlot(args: BlobsStrategyOpenArgs): BlobSet\n  /**\n   * Snapshot of this device's blob-cache KPI counters: local-read hits,\n   * network misses, and total bytes downloaded from the object store (#808).\n   *\n   * Lives on the seam rather than on the `withBlobs()` return type so the\n   * service has exactly one name (#844b) — `NO_BLOBS` answers with zeros,\n   * which is the truthful reading of \"blobs were never enabled\".\n   */\n  cacheStats(): BlobCacheStats\n}\n\n/**\n * Default strategy for collections that did not opt into blob storage.\n * Every operation surfaces an actionable error that points the caller\n * at the opt-in path.\n *\n * @internal\n */\nexport const NO_BLOBS: BlobsStrategy = {\n  openSlot() {\n    throw new Error(\n      'Blob storage is not enabled on this Noydb instance. ' +\n      'Import `{ withBlobs }` from \"@noy-db/hub/blobs\" and pass `withBlobs()` to `createNoydb({ blobsStrategy: withBlobs() })`.',\n    )\n  },\n  cacheStats() {\n    return { hits: 0, misses: 0, bytesDownloaded: 0 }\n  },\n}\n","/**\n * `vault.exportBlobs()` — bulk blob extraction primitive.\n *\n * Async-iterable handle over every blob attached to records in a\n * vault, optionally filtered by collection allowlist and per-record\n * predicate. Emits tuples of `{ blobId, recordRef, bytes, meta }` so\n * the consumer can pipe into any sink (zip stream, S3 multipart, USB\n * copy, cold-storage tape) without pulling the whole export into\n * memory.\n *\n * ## Auth + audit\n *\n * - Capability check runs **once** at handle creation via\n *   `Vault.assertCanExport('plaintext', 'blob')`. An operator whose\n *   keyring lacks that bit fails before a single byte of ciphertext\n *   is decrypted.\n * - Audit entry lands in `_export_audit` at handle creation: the\n *   actor, start timestamp, target collections, predicate presence,\n *   and batch mechanism. **No content hashes** — per the spec\n *   non-correlation invariant.\n *\n * ## Abort + resume\n *\n * - `handle.abort()` flips the internal signal; the next iteration\n *   boundary throws `AbortError`. Consumers already in `for await`\n *   can catch and exit cleanly.\n * - Restart after a partial failure with `{ afterBlobId }` — the\n *   iterator skips tuples up to (and including) that blob id before\n *   yielding again. Combined with a blob-count ceiling it supports\n *   idempotent batch re-runs.\n *\n * @module\n */\n\nimport type { Collection } from '../../kernel/collection.js'\nimport type { SlotInfo } from '../../kernel/types.js'\n\n// ─── Types ──────────────────────────────────────────────────────────────\n\nexport interface ExportBlobsOptions {\n  /**\n   * Collection allowlist. Omit to export blobs from every collection\n   * the caller has read access to.\n   */\n  readonly collections?: readonly string[]\n  /**\n   * Per-record predicate. Called on the decrypted record BEFORE any\n   * blob bytes are read for that record — returning false skips the\n   * record and all its slots without touching their chunks.\n   */\n  readonly where?: (record: unknown, context: { collection: string; id: string }) => boolean\n  /**\n   * Resume after a specific blob id. The iterator skips tuples up to\n   * and including this id, then yields. Format of the id is the same\n   * as `ExportedBlob.blobId` (the HMAC-keyed eTag).\n   */\n  readonly afterBlobId?: string\n  /**\n   * External abort signal. When fired, the next iterator tick throws\n   * `ExportBlobsAbortedError`. Honored alongside `handle.abort()`.\n   */\n  readonly signal?: AbortSignal\n}\n\nexport interface ExportedBlob {\n  /** Opaque blob identifier — HMAC-keyed eTag, stable across vaults. */\n  readonly blobId: string\n  /** Where this blob came from in the vault. */\n  readonly recordRef: {\n    readonly collection: string\n    readonly id: string\n    readonly slot: string\n  }\n  /** Decrypted plaintext bytes. */\n  readonly bytes: Uint8Array\n  /** Best-effort metadata (from the blob slot record). */\n  readonly meta: {\n    readonly size: number\n    /**\n     * User-visible filename stored on the slot. Often equal to the\n     * slot name; differs when the caller supplied an explicit\n     * `filename` to `BlobSet.put()`.\n     */\n    readonly filename: string\n    readonly mimeType?: string\n    readonly createdAt?: string\n  }\n}\n\nexport interface ExportBlobsHandle extends AsyncIterable<ExportedBlob> {\n  /** Abort the export. Safe to call multiple times. */\n  abort(): void\n  /** True once `abort()` has fired or the external signal aborted. */\n  readonly aborted: boolean\n}\n\nexport class ExportBlobsAbortedError extends Error {\n  constructor(reason: string) {\n    super(`exportBlobs aborted: ${reason}`)\n    this.name = 'ExportBlobsAbortedError'\n  }\n}\n\n// ─── Audit ──────────────────────────────────────────────────────────────\n\nexport const EXPORT_AUDIT_COLLECTION = '_export_audit'\n\nexport interface ExportBlobsAuditEntry {\n  readonly id: string\n  readonly mechanism: 'exportBlobs'\n  readonly actor: string\n  readonly startedAt: string\n  readonly collections: readonly string[] | null\n  readonly predicate: boolean\n  readonly afterBlobId: string | null\n}\n\n// ─── Implementation ─────────────────────────────────────────────────────\n\n/**\n * Build the handle. Factored out of `Vault.exportBlobs` so the\n * implementation can be unit-tested without going through the\n * compartment lifecycle.\n */\nexport function createExportBlobsHandle(\n  actor: string,\n  listAccessibleCollections: () => Promise<string[]>,\n  getCollection: <T>(name: string) => Collection<T>,\n  writeAudit: (entry: ExportBlobsAuditEntry) => Promise<void>,\n  options: ExportBlobsOptions,\n): ExportBlobsHandle {\n  let aborted = false\n\n  const abort = (): void => {\n    aborted = true\n  }\n\n  if (options.signal) {\n    if (options.signal.aborted) aborted = true\n    options.signal.addEventListener('abort', () => { aborted = true })\n  }\n\n  function assertLive(): void {\n    if (aborted) throw new ExportBlobsAbortedError('aborted by caller')\n  }\n\n  const allowlist = options.collections ? new Set(options.collections) : null\n\n  // Write the audit entry BEFORE the first yield so a blocked\n  // iteration still leaves an audit trail that the export started.\n  let auditPromise: Promise<void> | null = null\n  function writeAuditOnce(): Promise<void> {\n    if (!auditPromise) {\n      auditPromise = writeAudit({\n        id: generateBatchId(),\n        mechanism: 'exportBlobs',\n        actor,\n        startedAt: new Date().toISOString(),\n        collections: options.collections ?? null,\n        predicate: Boolean(options.where),\n        afterBlobId: options.afterBlobId ?? null,\n      })\n    }\n    return auditPromise\n  }\n\n  async function* generate(): AsyncGenerator<ExportedBlob> {\n    await writeAuditOnce()\n    assertLive()\n\n    // Resolve target collections lazily — also keeps the call async.\n    const allCollections = await listAccessibleCollections()\n    const targets = allCollections.filter(name => {\n      if (name.startsWith('_')) return false\n      if (allowlist && !allowlist.has(name)) return false\n      return true\n    })\n\n    let resumeCursorHit = options.afterBlobId === undefined\n\n    for (const collectionName of targets) {\n      if (aborted) return\n\n      const coll = getCollection<Record<string, unknown>>(collectionName)\n      const records = await coll.list().catch(() => [])\n      for (const record of records) {\n        if (aborted) return\n        assertLive()\n\n        const idField = (record as { id?: unknown }).id\n        if (typeof idField !== 'string') continue\n\n        if (options.where && !options.where(record, { collection: collectionName, id: idField })) continue\n\n        const blobSet = coll.blob(idField)\n        const slots = await blobSet.list().catch(() => [] as SlotInfo[])\n        for (const slot of slots) {\n          if (aborted) return\n\n          if (!resumeCursorHit) {\n            if (slot.eTag === options.afterBlobId) {\n              resumeCursorHit = true\n            }\n            continue\n          }\n\n          const bytes = await blobSet.get(slot.name)\n          if (!bytes) continue\n\n          const item: ExportedBlob = {\n            blobId: slot.eTag,\n            recordRef: { collection: collectionName, id: idField, slot: slot.name },\n            bytes,\n            meta: {\n              size: slot.size,\n              filename: slot.filename,\n              ...(slot.mimeType !== undefined && { mimeType: slot.mimeType }),\n              ...(slot.uploadedAt !== undefined && { createdAt: slot.uploadedAt }),\n            },\n          }\n          yield item\n        }\n      }\n    }\n  }\n\n  const handle: ExportBlobsHandle = {\n    abort,\n    get aborted() { return aborted },\n    [Symbol.asyncIterator]: () => generate(),\n  }\n  return handle\n}\n\n// ─── Helpers ────────────────────────────────────────────────────────────\n\nfunction generateBatchId(): string {\n  // 16 bytes of crypto randomness, URL-safe base64, no padding.\n  const raw = globalThis.crypto.getRandomValues(new Uint8Array(16))\n  let s = ''\n  for (const b of raw) s += b.toString(16).padStart(2, '0')\n  return `batch-${Date.now().toString(36)}-${s.slice(0, 12)}`\n}\n","/**\n * Blob retention + compaction.\n *\n * Declarative per-collection / per-slot eviction policy. Two\n * triggers:\n *\n *   - **`retainDays`** — age-based TTL. A slot uploaded more than N\n *     days ago is evicted.\n *   - **`evictWhen(record)`** — predicate over the **decrypted**\n *     record. Lets consumers express \"the image is safe to drop once\n *     the structured invoice has been reviewed and confirmed.\"\n *\n * Either trigger (or both) causes the slot to evict. Eviction removes\n * the slot entry from `_blob_slots_{collection}`, decrements the\n * blob's refCount (so unreferenced chunks can be GC'd by the next\n * sweep), and writes one entry to the `_blob_eviction_audit`\n * collection for tamper-evident record-keeping.\n *\n * The audit entry carries the eTag of the evicted blob (opaque HMAC\n * of plaintext under the vault's `_blob` DEK) — no plaintext leakage,\n * per the SPEC non-correlation invariant. Consumers reconstructing\n * \"what used to be attached\" can look up the audit entry by record\n * id.\n *\n * Compaction is **consumer-scheduled** — noy-db never runs a\n * background daemon. Call `vault.compact()` whenever your workflow\n * allows (cron, manual \"tidy\" button, cold-storage export prep, …).\n *\n * @module\n */\n\nimport type { NoydbStore, EncryptedEnvelope, SlotInfo } from '../../kernel/types.js'\nimport { ValidationError } from '../../kernel/errors.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, type EnclaveKey } from '../../kernel/enclave/index.js'\n\n// ─── Config types ───────────────────────────────────────────────────────\n\nexport interface BlobFieldPolicy<T = unknown> {\n  /**\n   * Via port brand marker — lets a `BlobFieldPolicy` satisfy the kernel's\n   * opaque `ViaDescriptor` (#629 Task 7). Optional (the\n   * `ClassifiedFieldSpec._viaBrand` precedent): `blobFields` policies are\n   * plain object literals with no declaration factory to stamp it, so a\n   * mandatory field would break every existing declaration.\n   */\n  readonly _viaBrand?: 'blob'\n  /**\n   * Age-based TTL in days. A slot whose `uploadedAt` is older than\n   * `now - retainDays × 86400s` evicts on the next `vault.compact()`.\n   * Omit to disable age-based eviction.\n   */\n  readonly retainDays?: number\n  /**\n   * Predicate evaluated against the decrypted record. When it returns\n   * `true`, every matching slot on that record evicts. Omit to\n   * disable predicate-based eviction.\n   */\n  readonly evictWhen?: (record: T) => boolean\n  /**\n   * **Legal hold.** When this predicate returns `true`, the slot is\n   * never evicted — `retainDays`/`evictWhen` are overridden. Use for a\n   * litigation / audit hold on a fiscal document: the blob stays until\n   * the predicate returns `false` (the hold is released). Fail-closed:\n   * if the predicate throws, the slot is treated as held.\n   */\n  readonly legalHold?: (record: T) => boolean\n  /**\n   * **Period-bound retention.** Returns the date (Date / ISO string /\n   * epoch ms) until which the slot must be retained — typically derived\n   * from the record's fiscal period (e.g. period end + 10 years). While\n   * `now < retainUntil`, the slot is never evicted, regardless of\n   * `retainDays`. Return `null`/`undefined` to impose no floor.\n   * Fail-closed: a throwing function holds the slot.\n   */\n  readonly retainUntil?: (record: T) => Date | string | number | null | undefined\n  /**\n   * **External projection.** When `true`, this field's bytes are stored in the\n   * vault's `ObjectProjection` (`createNoydb({ objectStore })`) as a single raw,\n   * **unencrypted** object — servable directly from S3/CDN and processable by\n   * native tooling — instead of the encrypted-chunk path. The encrypted slot\n   * record remains the catalog (anchoring invariant). Requires an `objectStore`;\n   * **outside the zero-knowledge guarantee** — use only for assets meant to\n   * leave the vault. See the as-aws-s3 design spec.\n   */\n  readonly external?: boolean\n  /**\n   * For an `external` field: make the object world-readable (CDN origin) rather\n   * than presigned-only. Default `false` (presigned). Ignored unless `external`.\n   */\n  readonly public?: boolean\n  /**\n   * For an `external` field: how to stamp a **backlink** (this record's\n   * vault/collection/id/field) onto the object's metadata — the self-describing\n   * \"secondary store\" that powers reconcile / DR / import re-pairing.\n   * - `'opaque-token'` (default): a random id; preserves the opaque-bucket\n   *   property (no names leak); the token is also recorded on the slot.\n   * - `'encrypted'`: the reference encrypted under the blob DEK (ZK-preserving;\n   *   falls back to `'opaque-token'` on a plaintext vault).\n   * - `'plain'`: the reference in cleartext metadata — **leaks structure** to\n   *   bucket readers; only for non-sensitive deployments.\n   * - `'none'`: no backlink.\n   */\n  readonly backlink?: 'opaque-token' | 'encrypted' | 'plain' | 'none'\n}\n\nexport type BlobFieldsConfig<T = unknown> = Record<string, BlobFieldPolicy<T>>\n\n// ─── Audit collection ──────────────────────────────────────────────────\n\nexport const BLOB_EVICTION_AUDIT_COLLECTION = '_blob_eviction_audit'\n\nexport interface BlobEvictionEntry {\n  readonly id: string\n  readonly collection: string\n  readonly recordId: string\n  readonly slotName: string\n  readonly blobHash: string\n  /** `'budget'` — evicted by the #808 cache-budget LRU pass, not a policy. */\n  readonly reason: 'ttl' | 'predicate' | 'both' | 'budget'\n  readonly evictedAt: string\n  readonly actor: string\n}\n\n// ─── Compaction result ──────────────────────────────────────────────────\n\nexport interface CompactionResult {\n  /** Number of blob slots evicted by the policy pass across all collections. */\n  readonly evicted: number\n  /** Number of records touched (iterated + policy checked). */\n  readonly records: number\n  /** Number of collections with `blobFields` configured. */\n  readonly collections: number\n  /**\n   * Number of audit entries written — one per policy eviction plus one per\n   * budget SLOT eviction (dropping a device-local cache copy writes none).\n   */\n  readonly auditEntries: number\n  /**\n   * Number of slots that would have evicted (TTL/predicate triggered)\n   * but were retained by a `legalHold` or `retainUntil` floor.\n   */\n  readonly held: number\n  /**\n   * #808: number of slots whose due policy eviction was skipped because they\n   * are pinned for offline on THIS device (pin state is device-local).\n   */\n  readonly pinned: number\n  /**\n   * #808: number of evictions performed by the `cacheBudget` LRU pass —\n   * internal slots evicted through the standard eviction writer plus\n   * device-local external cache copies dropped. 0 when no budget was given.\n   */\n  readonly budgetEvicted: number\n  /** #808: plaintext bytes freed by the `cacheBudget` LRU pass. */\n  readonly budgetBytesFreed: number\n  /** Per-collection breakdown for diagnostics. */\n  readonly byCollection: Record<string, { records: number; evicted: number }>\n}\n\n// ─── Core ──────────────────────────────────────────────────────────────\n\nexport interface CompactRunOptions {\n  /** Override \"now\" for deterministic testing. */\n  readonly now?: Date\n  /**\n   * Stop after this many evictions. Useful for capped batches / cron\n   * jobs that need to fit in a time window. `undefined` = unbounded.\n   */\n  readonly maxEvictions?: number\n  /**\n   * Dry-run — evaluate policies and return the counts, but do NOT\n   * delete slots or write audit entries. Lets a consumer preview\n   * what would happen.\n   */\n  readonly dryRun?: boolean\n  /**\n   * #808 mobile cache budget: cap the locally-cached UNPINNED blob bytes.\n   * After the policy pass, a dedicated LRU pass walks every collection's\n   * slots (pinned slots and `legalHold`/`retainUntil`-held slots are exempt\n   * and uncounted) and evicts oldest-access-first — internal slots through\n   * the standard eviction writer (`deleteSlot` + a `'budget'` audit entry),\n   * external slots by dropping their device-local encrypted cache copy only\n   * (the object-store copy is authoritative and untouched) — until the\n   * remaining unpinned bytes fit `maxBytes`. Internal slots count their\n   * uncompressed `size`; external slots count `cachedBytes` (0 = nothing\n   * local, nothing to evict). LRU order comes from the device-local\n   * `lastAccessAt` stamp, falling back to `uploadedAt`.\n   */\n  readonly cacheBudget?: { readonly maxBytes: number }\n}\n\nexport interface CompactionContext {\n  readonly adapter: NoydbStore\n  readonly vault: string\n  readonly actor: string\n  readonly encrypted: boolean\n  readonly getDEK: (collection: string) => Promise<EnclaveKey>\n  /**\n   * Resolve a collection's declared `blobFields` config. Returns an\n   * empty map for collections without the config — the walk skips\n   * those.\n   */\n  readonly getBlobFields: <T>(collection: string) => BlobFieldsConfig<T> | null\n  /** List collection names in the vault. */\n  readonly listCollections: () => Promise<string[]>\n  /** List record ids in a collection. */\n  readonly listRecords: (collection: string) => Promise<string[]>\n  /** Decrypt and return the record. Null when absent. */\n  readonly getRecord: <T>(collection: string, id: string) => Promise<T | null>\n  /** Return the BlobSet-like handle for a record's slots. */\n  readonly listSlots: (collection: string, id: string) => Promise<SlotInfo[]>\n  /** Delete a slot and decrement its blob's refCount. */\n  readonly deleteSlot: (collection: string, id: string, slotName: string) => Promise<void>\n  /**\n   * #808: drop a slot's DEVICE-LOCAL cached copy (the encrypted external\n   * side-cache) without touching the slot or the object store. Returns the\n   * plaintext bytes freed. Optional — absent (or a 0 return) means external\n   * cache entries simply cannot be budget-evicted through this context.\n   */\n  readonly dropLocalCache?: (collection: string, id: string, slotName: string) => Promise<number>\n}\n\nexport async function runCompaction(\n  ctx: CompactionContext,\n  options: CompactRunOptions = {},\n): Promise<CompactionResult> {\n  const now = options.now ?? new Date()\n  const maxEvictions = options.maxEvictions ?? Infinity\n  const dryRun = options.dryRun === true\n  if (options.cacheBudget !== undefined\n    && (!Number.isFinite(options.cacheBudget.maxBytes) || options.cacheBudget.maxBytes < 0)) {\n    throw new ValidationError('compact(): cacheBudget.maxBytes must be a non-negative finite number (#808)')\n  }\n\n  const allCollections = await ctx.listCollections()\n  const byCollection: Record<string, { records: number; evicted: number }> = {}\n  let evicted = 0\n  let records = 0\n  let auditEntries = 0\n  let held = 0\n  let pinned = 0\n  let collectionsWithPolicy = 0\n\n  outer: for (const collectionName of allCollections) {\n    if (collectionName.startsWith('_')) continue\n    const config = ctx.getBlobFields(collectionName)\n    if (!config) continue\n    const configuredSlots = Object.keys(config)\n    if (configuredSlots.length === 0) continue\n    collectionsWithPolicy += 1\n    byCollection[collectionName] = { records: 0, evicted: 0 }\n\n    const ids = await ctx.listRecords(collectionName)\n    for (const recordId of ids) {\n      if (evicted >= maxEvictions) break outer\n\n      const record = await ctx.getRecord(collectionName, recordId).catch(() => null)\n      if (record === null) continue\n      records += 1\n      byCollection[collectionName].records += 1\n\n      const slots = await ctx.listSlots(collectionName, recordId).catch(() => [])\n      for (const slot of slots) {\n        if (evicted >= maxEvictions) break outer\n        const policy = config[slot.name]\n        if (!policy) continue\n\n        const reason = evaluatePolicy(policy, record, slot, now)\n        if (!reason) continue\n\n        // #808: device-local offline pin — an exemption inside this existing\n        // pass, exactly like a hold: counted, never evicted. `slot.pinned` is\n        // the device-local annotation `BlobSet.list()` stamps from the\n        // withBlobs() pin registry (never synced state).\n        if (slot.pinned === true) {\n          pinned += 1\n          continue\n        }\n\n        // Retention floor: a legal hold or period-bound retainUntil\n        // blocks an otherwise-due eviction. Counted, never evicted.\n        if (isHeld(policy, record, now)) {\n          held += 1\n          continue\n        }\n\n        if (!dryRun) {\n          await ctx.deleteSlot(collectionName, recordId, slot.name)\n          await writeAuditEntry(ctx, {\n            id: generateEvictionId(collectionName, recordId, slot.name),\n            collection: collectionName,\n            recordId,\n            slotName: slot.name,\n            blobHash: slot.eTag,\n            reason,\n            evictedAt: now.toISOString(),\n            actor: ctx.actor,\n          })\n          auditEntries += 1\n        }\n        evicted += 1\n        byCollection[collectionName].evicted += 1\n      }\n    }\n  }\n\n  // #808: cache-budget LRU pass — runs AFTER the policy pass so a slot that\n  // just evicted no longer counts toward the budget. Reuses this module's own\n  // eviction writer (deleteSlot + audit), never a parallel one.\n  let budgetEvicted = 0\n  let budgetBytesFreed = 0\n  if (options.cacheBudget !== undefined) {\n    const pass = await runBudgetPass(ctx, options.cacheBudget.maxBytes, {\n      now, dryRun, remainingEvictions: maxEvictions - evicted,\n    })\n    budgetEvicted = pass.evicted\n    budgetBytesFreed = pass.bytesFreed\n    auditEntries += pass.auditEntries\n  }\n\n  return {\n    evicted,\n    records,\n    collections: collectionsWithPolicy,\n    auditEntries,\n    held,\n    pinned,\n    budgetEvicted,\n    budgetBytesFreed,\n    byCollection,\n  }\n}\n\n// ─── #808: cache-budget LRU pass ───────────────────────────────────────\n\ninterface BudgetCandidate {\n  readonly collection: string\n  readonly recordId: string\n  readonly slotName: string\n  readonly eTag: string\n  readonly bytes: number\n  /** `'slot'` — internal blob, evicted via `deleteSlot`; `'cache'` — external device-local copy, dropped via `dropLocalCache`. */\n  readonly kind: 'slot' | 'cache'\n  readonly lastAccessMs: number\n}\n\n/**\n * Enforce `cacheBudget.maxBytes` over the locally-cached UNPINNED blob bytes\n * (see {@link CompactRunOptions.cacheBudget} for the full contract). Walks\n * EVERY collection — unlike the policy pass, the budget is not gated on a\n * declared `blobFields` config — but still honors a declared policy's\n * `legalHold`/`retainUntil` floor where one exists.\n */\nasync function runBudgetPass(\n  ctx: CompactionContext,\n  maxBytes: number,\n  opts: { now: Date; dryRun: boolean; remainingEvictions: number },\n): Promise<{ evicted: number; bytesFreed: number; auditEntries: number }> {\n  const candidates: BudgetCandidate[] = []\n  let total = 0\n\n  for (const collectionName of await ctx.listCollections()) {\n    if (collectionName.startsWith('_')) continue\n    const config = ctx.getBlobFields(collectionName)\n    for (const recordId of await ctx.listRecords(collectionName)) {\n      const slots = await ctx.listSlots(collectionName, recordId).catch(() => [])\n      if (slots.length === 0) continue\n      // The record is only needed to evaluate a declared policy's retention\n      // floor — skip the decrypt entirely for policy-less collections.\n      const record = config\n        ? await ctx.getRecord<unknown>(collectionName, recordId).catch(() => null)\n        : null\n      for (const slot of slots) {\n        if (slot.pinned === true) continue // pinned: exempt AND uncounted (#808)\n        const policy = config?.[slot.name]\n        if (policy && record !== null && isHeld(policy, record, opts.now)) continue // floor blocks budget too\n        const lastAccessMs = Date.parse(slot.lastAccessAt ?? slot.uploadedAt) || 0\n        const isExternal = slot.external !== undefined\n        const bytes = isExternal ? slot.cachedBytes ?? 0 : slot.size\n        if (bytes <= 0) continue // external with no local copy: nothing cached to evict\n        total += bytes\n        candidates.push({\n          collection: collectionName, recordId, slotName: slot.name, eTag: slot.eTag,\n          bytes, kind: isExternal ? 'cache' : 'slot', lastAccessMs,\n        })\n      }\n    }\n  }\n\n  // Oldest access first; deterministic tiebreak so equal timestamps (common\n  // within one ms) never make the eviction order flap between runs.\n  candidates.sort((a, b) =>\n    a.lastAccessMs - b.lastAccessMs\n    || a.collection.localeCompare(b.collection)\n    || a.recordId.localeCompare(b.recordId)\n    || a.slotName.localeCompare(b.slotName))\n\n  let evicted = 0\n  let bytesFreed = 0\n  let auditEntries = 0\n  for (const c of candidates) {\n    if (total <= maxBytes || evicted >= opts.remainingEvictions) break\n    if (!opts.dryRun) {\n      if (c.kind === 'slot') {\n        await ctx.deleteSlot(c.collection, c.recordId, c.slotName)\n        await writeAuditEntry(ctx, {\n          id: generateEvictionId(c.collection, c.recordId, c.slotName),\n          collection: c.collection,\n          recordId: c.recordId,\n          slotName: c.slotName,\n          blobHash: c.eTag,\n          reason: 'budget',\n          evictedAt: opts.now.toISOString(),\n          actor: ctx.actor,\n        })\n        auditEntries += 1\n      } else {\n        // Device-local cache drop only — the slot (catalog) and the\n        // object-store copy are untouched, so no eviction audit entry.\n        await ctx.dropLocalCache?.(c.collection, c.recordId, c.slotName)\n      }\n    }\n    evicted += 1\n    bytesFreed += c.bytes\n    total -= c.bytes\n  }\n\n  return { evicted, bytesFreed, auditEntries }\n}\n\n/**\n * Whether a retention floor (legal hold or period-bound `retainUntil`)\n * currently blocks eviction of this record's slots. Fail-closed: a\n * throwing predicate holds the slot.\n */\nfunction isHeld<T>(policy: BlobFieldPolicy<T>, record: T, now: Date): boolean {\n  if (policy.legalHold) {\n    try {\n      if (policy.legalHold(record)) return true\n    } catch {\n      return true\n    }\n  }\n  if (policy.retainUntil) {\n    try {\n      const until = policy.retainUntil(record)\n      if (until !== null && until !== undefined) {\n        const t = until instanceof Date ? until.getTime() : typeof until === 'number' ? until : Date.parse(String(until))\n        if (!Number.isFinite(t)) return true   // fail-closed: unparseable retainUntil holds the slot\n        if (t > now.getTime()) return true\n      }\n    } catch {\n      return true\n    }\n  }\n  return false\n}\n\nfunction evaluatePolicy<T>(\n  policy: BlobFieldPolicy<T>,\n  record: T,\n  slot: SlotInfo,\n  now: Date,\n): 'ttl' | 'predicate' | 'both' | null {\n  let ttlTriggered = false\n  let predicateTriggered = false\n\n  if (policy.retainDays !== undefined && policy.retainDays > 0) {\n    const uploadedAt = Date.parse(slot.uploadedAt)\n    if (Number.isFinite(uploadedAt)) {\n      const ageMs = now.getTime() - uploadedAt\n      const limitMs = policy.retainDays * 86_400_000\n      if (ageMs > limitMs) ttlTriggered = true\n    }\n  }\n\n  if (policy.evictWhen) {\n    try {\n      if (policy.evictWhen(record)) predicateTriggered = true\n    } catch {\n      // Predicate error → do NOT evict. Fail closed.\n    }\n  }\n\n  if (ttlTriggered && predicateTriggered) return 'both'\n  if (ttlTriggered) return 'ttl'\n  if (predicateTriggered) return 'predicate'\n  return null\n}\n\nfunction generateEvictionId(collection: string, recordId: string, slotName: string): string {\n  const rand = globalThis.crypto.getRandomValues(new Uint8Array(8))\n  let suffix = ''\n  for (const b of rand) suffix += b.toString(16).padStart(2, '0')\n  return `${collection}__${recordId}__${slotName}__${suffix}`\n}\n\nasync function writeAuditEntry(ctx: CompactionContext, entry: BlobEvictionEntry): Promise<void> {\n  const json = JSON.stringify(entry)\n  const identity = { collection: BLOB_EVICTION_AUDIT_COLLECTION, id: entry.id, by: entry.actor, version: 1 }\n  const body = { ts: entry.evictedAt }\n  let envelope: EncryptedEnvelope\n  if (ctx.encrypted) {\n    const dek = await ctx.getDEK(BLOB_EVICTION_AUDIT_COLLECTION)\n    const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n    envelope = buildRecordEnvelope(identity, { ...body, iv, data })\n  } else {\n    envelope = buildRecordEnvelope(identity, { ...body, iv: '', data: json })\n  }\n  await ctx.adapter.put(ctx.vault, BLOB_EVICTION_AUDIT_COLLECTION, entry.id, envelope)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAuEA,eAAe,WAAW,KAAkB,KAA6C;AACvF,MAAI,IAAI,oBAAqB,QAAO,IAAI,oBAAoB,IAAI,EAAE;AAClE,SAAO,EAAE,UAAU,GAAG,SAAS,CAAC,EAAE;AACpC;AAgCA,SAAS,0BAA0B,QAAmD;AACpF,SAAO;AAAA,IACL,YAAY,OAAO;AAAA,MACjB,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;AAAA,QACjD,GAAI,EAAE,eAAe,SAAY,EAAE,YAAY,EAAE,WAAW,IAAI,CAAC;AAAA,QACjE,GAAI,EAAE,cAAc,SAAY,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,QACvD,GAAI,EAAE,cAAc,SAAY,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,QACvD,GAAI,EAAE,gBAAgB,SAAY,EAAE,aAAa,KAAK,IAAI,CAAC;AAAA,QAC3D,GAAI,EAAE,aAAa,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;AAAA,QAChD,GAAI,EAAE,WAAW,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC;AAAA,QAC5C,GAAI,EAAE,aAAa,SAAY,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7D,CAAC,CAAC;AAAA,IACJ;AAAA,EACF;AACF;AAEO,SAAS,YAAY,KAAgC;AAC1D,SAAO;AAAA,IACL,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMP,SAAS,EAAE,iBAAiB,YAAY,WAAW,QAAQ,YAAY,MAAM,aAAa,KAAK;AAAA,IAC/F,QAAQ,CAAC,UAAU,SAAS,IAAI;AAAA,IAChC,OAAO,CAAC,QAAQ,WAAW,KAAK,GAAG;AAAA,IACnC,kBAAkB,MAAM,0BAA0B,IAAI,MAAM;AAAA,EAC9D;AACF;AAEO,SAAS,cAAoB;AAClC,mBAAiB,QAAQ,CAAC,MAAM,YAAY,CAAkB,CAAC;AACjE;;;ACrGA,YAAY;AAqFL,IAAM,WAA0B;AAAA,EACrC,WAAW;AACT,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAAA,EACA,aAAa;AACX,WAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,iBAAiB,EAAE;AAAA,EAClD;AACF;;;ACrCO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,QAAgB;AAC1B,UAAM,wBAAwB,MAAM,EAAE;AACtC,SAAK,OAAO;AAAA,EACd;AACF;AAIO,IAAM,0BAA0B;AAmBhC,SAAS,wBACd,OACA,2BACA,eACA,YACA,SACmB;AACnB,MAAI,UAAU;AAEd,QAAM,QAAQ,MAAY;AACxB,cAAU;AAAA,EACZ;AAEA,MAAI,QAAQ,QAAQ;AAClB,QAAI,QAAQ,OAAO,QAAS,WAAU;AACtC,YAAQ,OAAO,iBAAiB,SAAS,MAAM;AAAE,gBAAU;AAAA,IAAK,CAAC;AAAA,EACnE;AAEA,WAAS,aAAmB;AAC1B,QAAI,QAAS,OAAM,IAAI,wBAAwB,mBAAmB;AAAA,EACpE;AAEA,QAAM,YAAY,QAAQ,cAAc,IAAI,IAAI,QAAQ,WAAW,IAAI;AAIvE,MAAI,eAAqC;AACzC,WAAS,iBAAgC;AACvC,QAAI,CAAC,cAAc;AACjB,qBAAe,WAAW;AAAA,QACxB,IAAI,gBAAgB;AAAA,QACpB,WAAW;AAAA,QACX;AAAA,QACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,aAAa,QAAQ,eAAe;AAAA,QACpC,WAAW,QAAQ,QAAQ,KAAK;AAAA,QAChC,aAAa,QAAQ,eAAe;AAAA,MACtC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,kBAAgB,WAAyC;AACvD,UAAM,eAAe;AACrB,eAAW;AAGX,UAAM,iBAAiB,MAAM,0BAA0B;AACvD,UAAM,UAAU,eAAe,OAAO,UAAQ;AAC5C,UAAI,KAAK,WAAW,GAAG,EAAG,QAAO;AACjC,UAAI,aAAa,CAAC,UAAU,IAAI,IAAI,EAAG,QAAO;AAC9C,aAAO;AAAA,IACT,CAAC;AAED,QAAI,kBAAkB,QAAQ,gBAAgB;AAE9C,eAAW,kBAAkB,SAAS;AACpC,UAAI,QAAS;AAEb,YAAM,OAAO,cAAuC,cAAc;AAClE,YAAM,UAAU,MAAM,KAAK,KAAK,EAAE,MAAM,MAAM,CAAC,CAAC;AAChD,iBAAW,UAAU,SAAS;AAC5B,YAAI,QAAS;AACb,mBAAW;AAEX,cAAM,UAAW,OAA4B;AAC7C,YAAI,OAAO,YAAY,SAAU;AAEjC,YAAI,QAAQ,SAAS,CAAC,QAAQ,MAAM,QAAQ,EAAE,YAAY,gBAAgB,IAAI,QAAQ,CAAC,EAAG;AAE1F,cAAM,UAAU,KAAK,KAAK,OAAO;AACjC,cAAM,QAAQ,MAAM,QAAQ,KAAK,EAAE,MAAM,MAAM,CAAC,CAAe;AAC/D,mBAAW,QAAQ,OAAO;AACxB,cAAI,QAAS;AAEb,cAAI,CAAC,iBAAiB;AACpB,gBAAI,KAAK,SAAS,QAAQ,aAAa;AACrC,gCAAkB;AAAA,YACpB;AACA;AAAA,UACF;AAEA,gBAAM,QAAQ,MAAM,QAAQ,IAAI,KAAK,IAAI;AACzC,cAAI,CAAC,MAAO;AAEZ,gBAAM,OAAqB;AAAA,YACzB,QAAQ,KAAK;AAAA,YACb,WAAW,EAAE,YAAY,gBAAgB,IAAI,SAAS,MAAM,KAAK,KAAK;AAAA,YACtE;AAAA,YACA,MAAM;AAAA,cACJ,MAAM,KAAK;AAAA,cACX,UAAU,KAAK;AAAA,cACf,GAAI,KAAK,aAAa,UAAa,EAAE,UAAU,KAAK,SAAS;AAAA,cAC7D,GAAI,KAAK,eAAe,UAAa,EAAE,WAAW,KAAK,WAAW;AAAA,YACpE;AAAA,UACF;AACA,gBAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAA4B;AAAA,IAChC;AAAA,IACA,IAAI,UAAU;AAAE,aAAO;AAAA,IAAQ;AAAA,IAC/B,CAAC,OAAO,aAAa,GAAG,MAAM,SAAS;AAAA,EACzC;AACA,SAAO;AACT;AAIA,SAAS,kBAA0B;AAEjC,QAAM,MAAM,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAChE,MAAI,IAAI;AACR,aAAW,KAAK,IAAK,MAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACxD,SAAO,SAAS,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC;AAC3D;;;ACrIO,IAAM,iCAAiC;AAiH9C,eAAsB,cACpB,KACA,UAA6B,CAAC,GACH;AAC3B,QAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,SAAS,QAAQ,WAAW;AAClC,MAAI,QAAQ,gBAAgB,WACtB,CAAC,OAAO,SAAS,QAAQ,YAAY,QAAQ,KAAK,QAAQ,YAAY,WAAW,IAAI;AACzF,UAAM,IAAI,gBAAgB,6EAA6E;AAAA,EACzG;AAEA,QAAM,iBAAiB,MAAM,IAAI,gBAAgB;AACjD,QAAM,eAAqE,CAAC;AAC5E,MAAI,UAAU;AACd,MAAI,UAAU;AACd,MAAI,eAAe;AACnB,MAAI,OAAO;AACX,MAAI,SAAS;AACb,MAAI,wBAAwB;AAE5B,QAAO,YAAW,kBAAkB,gBAAgB;AAClD,QAAI,eAAe,WAAW,GAAG,EAAG;AACpC,UAAM,SAAS,IAAI,cAAc,cAAc;AAC/C,QAAI,CAAC,OAAQ;AACb,UAAM,kBAAkB,OAAO,KAAK,MAAM;AAC1C,QAAI,gBAAgB,WAAW,EAAG;AAClC,6BAAyB;AACzB,iBAAa,cAAc,IAAI,EAAE,SAAS,GAAG,SAAS,EAAE;AAExD,UAAM,MAAM,MAAM,IAAI,YAAY,cAAc;AAChD,eAAW,YAAY,KAAK;AAC1B,UAAI,WAAW,aAAc,OAAM;AAEnC,YAAM,SAAS,MAAM,IAAI,UAAU,gBAAgB,QAAQ,EAAE,MAAM,MAAM,IAAI;AAC7E,UAAI,WAAW,KAAM;AACrB,iBAAW;AACX,mBAAa,cAAc,EAAE,WAAW;AAExC,YAAM,QAAQ,MAAM,IAAI,UAAU,gBAAgB,QAAQ,EAAE,MAAM,MAAM,CAAC,CAAC;AAC1E,iBAAW,QAAQ,OAAO;AACxB,YAAI,WAAW,aAAc,OAAM;AACnC,cAAM,SAAS,OAAO,KAAK,IAAI;AAC/B,YAAI,CAAC,OAAQ;AAEb,cAAM,SAAS,eAAe,QAAQ,QAAQ,MAAM,GAAG;AACvD,YAAI,CAAC,OAAQ;AAMb,YAAI,KAAK,WAAW,MAAM;AACxB,oBAAU;AACV;AAAA,QACF;AAIA,YAAI,OAAO,QAAQ,QAAQ,GAAG,GAAG;AAC/B,kBAAQ;AACR;AAAA,QACF;AAEA,YAAI,CAAC,QAAQ;AACX,gBAAM,IAAI,WAAW,gBAAgB,UAAU,KAAK,IAAI;AACxD,gBAAM,gBAAgB,KAAK;AAAA,YACzB,IAAI,mBAAmB,gBAAgB,UAAU,KAAK,IAAI;AAAA,YAC1D,YAAY;AAAA,YACZ;AAAA,YACA,UAAU,KAAK;AAAA,YACf,UAAU,KAAK;AAAA,YACf;AAAA,YACA,WAAW,IAAI,YAAY;AAAA,YAC3B,OAAO,IAAI;AAAA,UACb,CAAC;AACD,0BAAgB;AAAA,QAClB;AACA,mBAAW;AACX,qBAAa,cAAc,EAAE,WAAW;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AAKA,MAAI,gBAAgB;AACpB,MAAI,mBAAmB;AACvB,MAAI,QAAQ,gBAAgB,QAAW;AACrC,UAAM,OAAO,MAAM,cAAc,KAAK,QAAQ,YAAY,UAAU;AAAA,MAClE;AAAA,MAAK;AAAA,MAAQ,oBAAoB,eAAe;AAAA,IAClD,CAAC;AACD,oBAAgB,KAAK;AACrB,uBAAmB,KAAK;AACxB,oBAAgB,KAAK;AAAA,EACvB;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAsBA,eAAe,cACb,KACA,UACA,MACwE;AACxE,QAAM,aAAgC,CAAC;AACvC,MAAI,QAAQ;AAEZ,aAAW,kBAAkB,MAAM,IAAI,gBAAgB,GAAG;AACxD,QAAI,eAAe,WAAW,GAAG,EAAG;AACpC,UAAM,SAAS,IAAI,cAAc,cAAc;AAC/C,eAAW,YAAY,MAAM,IAAI,YAAY,cAAc,GAAG;AAC5D,YAAM,QAAQ,MAAM,IAAI,UAAU,gBAAgB,QAAQ,EAAE,MAAM,MAAM,CAAC,CAAC;AAC1E,UAAI,MAAM,WAAW,EAAG;AAGxB,YAAM,SAAS,SACX,MAAM,IAAI,UAAmB,gBAAgB,QAAQ,EAAE,MAAM,MAAM,IAAI,IACvE;AACJ,iBAAW,QAAQ,OAAO;AACxB,YAAI,KAAK,WAAW,KAAM;AAC1B,cAAM,SAAS,SAAS,KAAK,IAAI;AACjC,YAAI,UAAU,WAAW,QAAQ,OAAO,QAAQ,QAAQ,KAAK,GAAG,EAAG;AACnE,cAAM,eAAe,KAAK,MAAM,KAAK,gBAAgB,KAAK,UAAU,KAAK;AACzE,cAAM,aAAa,KAAK,aAAa;AACrC,cAAM,QAAQ,aAAa,KAAK,eAAe,IAAI,KAAK;AACxD,YAAI,SAAS,EAAG;AAChB,iBAAS;AACT,mBAAW,KAAK;AAAA,UACd,YAAY;AAAA,UAAgB;AAAA,UAAU,UAAU,KAAK;AAAA,UAAM,MAAM,KAAK;AAAA,UACtE;AAAA,UAAO,MAAM,aAAa,UAAU;AAAA,UAAQ;AAAA,QAC9C,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAIA,aAAW,KAAK,CAAC,GAAG,MAClB,EAAE,eAAe,EAAE,gBAChB,EAAE,WAAW,cAAc,EAAE,UAAU,KACvC,EAAE,SAAS,cAAc,EAAE,QAAQ,KACnC,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AAEzC,MAAI,UAAU;AACd,MAAI,aAAa;AACjB,MAAI,eAAe;AACnB,aAAW,KAAK,YAAY;AAC1B,QAAI,SAAS,YAAY,WAAW,KAAK,mBAAoB;AAC7D,QAAI,CAAC,KAAK,QAAQ;AAChB,UAAI,EAAE,SAAS,QAAQ;AACrB,cAAM,IAAI,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AACzD,cAAM,gBAAgB,KAAK;AAAA,UACzB,IAAI,mBAAmB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AAAA,UAC3D,YAAY,EAAE;AAAA,UACd,UAAU,EAAE;AAAA,UACZ,UAAU,EAAE;AAAA,UACZ,UAAU,EAAE;AAAA,UACZ,QAAQ;AAAA,UACR,WAAW,KAAK,IAAI,YAAY;AAAA,UAChC,OAAO,IAAI;AAAA,QACb,CAAC;AACD,wBAAgB;AAAA,MAClB,OAAO;AAGL,cAAM,IAAI,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;AAAA,MACjE;AAAA,IACF;AACA,eAAW;AACX,kBAAc,EAAE;AAChB,aAAS,EAAE;AAAA,EACb;AAEA,SAAO,EAAE,SAAS,YAAY,aAAa;AAC7C;AAOA,SAAS,OAAU,QAA4B,QAAW,KAAoB;AAC5E,MAAI,OAAO,WAAW;AACpB,QAAI;AACF,UAAI,OAAO,UAAU,MAAM,EAAG,QAAO;AAAA,IACvC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,OAAO,aAAa;AACtB,QAAI;AACF,YAAM,QAAQ,OAAO,YAAY,MAAM;AACvC,UAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,cAAM,IAAI,iBAAiB,OAAO,MAAM,QAAQ,IAAI,OAAO,UAAU,WAAW,QAAQ,KAAK,MAAM,OAAO,KAAK,CAAC;AAChH,YAAI,CAAC,OAAO,SAAS,CAAC,EAAG,QAAO;AAChC,YAAI,IAAI,IAAI,QAAQ,EAAG,QAAO;AAAA,MAChC;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eACP,QACA,QACA,MACA,KACqC;AACrC,MAAI,eAAe;AACnB,MAAI,qBAAqB;AAEzB,MAAI,OAAO,eAAe,UAAa,OAAO,aAAa,GAAG;AAC5D,UAAM,aAAa,KAAK,MAAM,KAAK,UAAU;AAC7C,QAAI,OAAO,SAAS,UAAU,GAAG;AAC/B,YAAM,QAAQ,IAAI,QAAQ,IAAI;AAC9B,YAAM,UAAU,OAAO,aAAa;AACpC,UAAI,QAAQ,QAAS,gBAAe;AAAA,IACtC;AAAA,EACF;AAEA,MAAI,OAAO,WAAW;AACpB,QAAI;AACF,UAAI,OAAO,UAAU,MAAM,EAAG,sBAAqB;AAAA,IACrD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,gBAAgB,mBAAoB,QAAO;AAC/C,MAAI,aAAc,QAAO;AACzB,MAAI,mBAAoB,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,mBAAmB,YAAoB,UAAkB,UAA0B;AAC1F,QAAM,OAAO,WAAW,OAAO,gBAAgB,IAAI,WAAW,CAAC,CAAC;AAChE,MAAI,SAAS;AACb,aAAW,KAAK,KAAM,WAAU,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC9D,SAAO,GAAG,UAAU,KAAK,QAAQ,KAAK,QAAQ,KAAK,MAAM;AAC3D;AAEA,eAAe,gBAAgB,KAAwB,OAAyC;AAC9F,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,QAAM,WAAW,EAAE,YAAY,gCAAgC,IAAI,MAAM,IAAI,IAAI,MAAM,OAAO,SAAS,EAAE;AACzG,QAAM,OAAO,EAAE,IAAI,MAAM,UAAU;AACnC,MAAI;AACJ,MAAI,IAAI,WAAW;AACjB,UAAM,MAAM,MAAM,IAAI,OAAO,8BAA8B;AAC3D,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,eAAW,oBAAoB,UAAU,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC;AAAA,EAChE,OAAO;AACL,eAAW,oBAAoB,UAAU,EAAE,GAAG,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC;AAAA,EAC1E;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,gCAAgC,MAAM,IAAI,QAAQ;AACrF;","names":[]}

package/dist/{chunk-FAXZQ5UF.js → chunk-4RAS6HN6.js}

@@ -1,6 +1,6 @@
 import {
   SealedRecordNotEnabledError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-audit/sealed-record/strategy.ts
 var NO_SEALED_RECORD = {
@@ -18,4 +18,4 @@ var NO_SEALED_RECORD = {
 export {
   NO_SEALED_RECORD
 };
-//# sourceMappingURL=chunk-FAXZQ5UF.js.map
+//# sourceMappingURL=chunk-4RAS6HN6.js.map

package/dist/{chunk-C2OOEM57.js → chunk-4YL2LMXK.js}

@@ -1,29 +1,34 @@
 import {
-  assertTierAccess,
+  assertTierAccess
+} from "./chunk-NW4TY6VC.js";
+import {
   dekKey
-} from "./chunk-AHLJSVRL.js";
+} from "./chunk-PPCOKVFA.js";
 import {
   applyRewrappedBody,
+  buildRecordAad,
+  recordAadFor,
   rewrapBodyToDek
-} from "./chunk-VN45YLWM.js";
+} from "./chunk-OHOKBMTM.js";
 import {
+  buildRecordEnvelope,
   isDeleteMarker,
   isTombstoneShape
-} from "./chunk-NWCGDAV6.js";
+} from "./chunk-PENPHA45.js";
 import {
   decrypt,
   encrypt,
   unwrapCek
-} from "./chunk-VCETL77O.js";
+} from "./chunk-AU3AUJIZ.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-W5W6KHN2.js";
+} from "./chunk-IGNJOJEP.js";
 import {
   PersistedIndexCompensationError,
   TierDemoteDeniedError,
   TiersNotEnabledError,
   UnsupportedTierCompositionError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-audit/tiers/active.ts
 function withTiers() {
@@ -124,22 +129,33 @@ async function putAtTier(ctx, id, record, tier, opts) {
   const fromKey = dekKey(ctx.name, existing?._tier ?? 0);
   const fromDek = await ctx.getDEK(fromKey);
   if (existing && ctx.historyEnabled) {
-    const body = await rewrapBodyToDek(existing, fromDek, dek);
-    const { _tier: _preTier, _elevatedBy: _preElevatedBy, ...preCarried } = existing;
-    await ctx.saveHistorySnapshot(id, applyRewrappedBody(preCarried, body));
+    const preFrom = {
+      // The PRE-move version — this identity opens what is already stored.
+      collection: ctx.name,
+      id,
+      version: existing._v,
+      ...existing._tier !== void 0 ? { tier: existing._tier } : {},
+      ...existing._by !== void 0 ? { by: existing._by } : {}
+    };
+    await ctx.saveHistorySnapshot(id, existing._v, async (address) => {
+      const to = { ...address, ...existing._by !== void 0 ? { by: existing._by } : {} };
+      const body = await rewrapBodyToDek(preFrom, to, existing, fromDek, dek);
+      const { _tier: _preTier, _elevatedBy: _preElevatedBy, ...preCarried } = existing;
+      return applyRewrappedBody(preCarried, body);
+    });
   }
   const json = JSON.stringify(record);
-  const { iv, data } = await encrypt(json, dek);
-  const envelope = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: version,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: iv,
-    _data: data,
-    _by: ctx.keyring.userId,
-    ...tier > 0 && { _tier: tier },
-    ...ctx.provenance && opts?.source !== void 0 ? { _source: opts.source, _sourceTs: opts.sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : {}
-  };
+  const identity = { collection: ctx.name, id, version, by: ctx.keyring.userId, ...tier > 0 ? { tier } : {} };
+  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+  const envelope = buildRecordEnvelope(
+    identity,
+    {
+      iv,
+      data,
+      // `_tier` is stamped from `identity.tier` above — the single source.
+      ...ctx.provenance && opts?.source !== void 0 ? { provenance: { source: opts.source, sourceTs: opts.sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } } : {}
+    }
+  );
   await ctx.adapter.put(ctx.vault, ctx.name, id, envelope);
   await ctx.addSubjectRef(id, record);
   if (tier > 0) {
@@ -148,11 +164,11 @@ async function putAtTier(ctx, id, record, tier, opts) {
     await ctx.syncLedger(id);
     await ctx.syncDerived(
       id,
-      ctx.hasDerivedOutputs && existing ? await ctx.codec.decryptRecordAtDek(existing, await ctx.getDEK(dekKey(ctx.name, existing._tier ?? 0)), id) : null,
+      ctx.hasDerivedOutputs && existing ? await ctx.codec.decryptRecordAtDek({ collection: ctx.name, id }, existing, await ctx.getDEK(dekKey(ctx.name, existing._tier ?? 0))) : null,
       true
     );
   } else {
-    const rec = await ctx.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
+    const rec = await ctx.codec.decryptRecord({ collection: ctx.name, id }, envelope, { sealedAsHandles: true });
     await ctx.syncIndexes(id, rec, envelope._v, existing ?? void 0);
     ctx.syncCache(id, rec !== null ? { record: rec, version: envelope._v } : null);
     await ctx.syncDerived(id, rec, false, envelope._v);
@@ -185,7 +201,7 @@ async function getAtTier(ctx, id) {
   if (!envelope) return null;
   const tier = envelope._tier ?? 0;
   if (tier === 0) {
-    return ctx.codec.decryptRecord(envelope, { id });
+    return ctx.codec.decryptRecord({ collection: ctx.name, id }, envelope);
   }
   const key = dekKey(ctx.name, tier);
   if (!ctx.keyring.deks.has(key)) {
@@ -195,14 +211,15 @@ async function getAtTier(ctx, id) {
     return null;
   }
   const dek = await ctx.getDEK(key);
+  const aad = recordAadFor({ collection: ctx.name, id }, envelope);
   let plaintext;
   let cek;
   if (envelope._cek !== void 0) {
     cek = await unwrapCek(envelope._cek, dek);
     ctx.cekCache?.set(id, cek, 1);
-    plaintext = await decrypt(envelope._iv, envelope._data, cek);
+    plaintext = await decrypt(envelope._iv, envelope._data, cek, aad);
   } else {
-    plaintext = await decrypt(envelope._iv, envelope._data, dek);
+    plaintext = await decrypt(envelope._iv, envelope._data, dek, aad);
   }
   let record = JSON.parse(plaintext);
   if (envelope._sealed !== void 0) {
@@ -261,10 +278,30 @@ async function elevate(ctx, id, toTier) {
   const fromDek = await ctx.getDEK(fromKey);
   const toDek = await ctx.getDEK(toKey);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const body = await rewrapBodyToDek(envelope, fromDek, toDek);
+  const moveFrom = {
+    // Opens at the version currently stored; the live write below re-seals at
+    // `_v + 1`, so the two ends of a move are NOT the same identity (#1093).
+    collection: ctx.name,
+    id,
+    version: envelope._v,
+    ...fromTier > 0 ? { tier: fromTier } : {},
+    ...envelope._by !== void 0 ? { by: envelope._by } : {}
+  };
+  const moveTo = {
+    collection: ctx.name,
+    id,
+    version: envelope._v + 1,
+    ...toTier > 0 ? { tier: toTier } : {},
+    by: ctx.keyring.userId
+  };
+  const body = await rewrapBodyToDek(moveFrom, moveTo, envelope, fromDek, toDek);
   if (body.cek) ctx.cekCache?.set(id, body.cek, 1);
-  const { _tier: _preTier, _elevatedBy: _preElevatedBy, ...snapshot } = applyRewrappedBody(envelope, body);
-  await ctx.saveHistorySnapshot(id, snapshot);
+  await ctx.saveHistorySnapshot(id, envelope._v, async (address) => {
+    const to = { ...address, ...envelope._by !== void 0 ? { by: envelope._by } : {} };
+    const histBody = await rewrapBodyToDek(moveFrom, to, envelope, fromDek, toDek);
+    const { _tier: _preTier, _elevatedBy: _preElevatedBy, ...snapshot } = applyRewrappedBody(envelope, histBody);
+    return snapshot;
+  });
   const next = {
     ...envelope,
     _noydb: NOYDB_FORMAT_VERSION,
@@ -282,7 +319,7 @@ async function elevate(ctx, id, toTier) {
   ctx.syncCache(id, null);
   const searchResidue = await syncSearchResilient(ctx, id, null);
   await ctx.syncLedger(id);
-  await ctx.syncDerived(id, ctx.hasDerivedOutputs ? await ctx.codec.decryptRecordAtDek(envelope, fromDek, id) : null, true);
+  await ctx.syncDerived(id, ctx.hasDerivedOutputs ? await ctx.codec.decryptRecordAtDek({ collection: ctx.name, id }, envelope, fromDek) : null, true);
   ctx.emitCrossTierEvent({
     actor: ctx.keyring.userId,
     collection: ctx.name,
@@ -318,10 +355,30 @@ async function demote(ctx, id, toTier) {
   const fromDek = await ctx.getDEK(dekKey(ctx.name, fromTier));
   const toDek = await ctx.getDEK(dekKey(ctx.name, toTier));
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const body = await rewrapBodyToDek(envelope, fromDek, toDek);
+  const moveFrom = {
+    // Opens at the version currently stored; the live write below re-seals at
+    // `_v + 1`, so the two ends of a move are NOT the same identity (#1093).
+    collection: ctx.name,
+    id,
+    version: envelope._v,
+    ...fromTier > 0 ? { tier: fromTier } : {},
+    ...envelope._by !== void 0 ? { by: envelope._by } : {}
+  };
+  const moveTo = {
+    collection: ctx.name,
+    id,
+    version: envelope._v + 1,
+    ...toTier > 0 ? { tier: toTier } : {},
+    by: ctx.keyring.userId
+  };
+  const body = await rewrapBodyToDek(moveFrom, moveTo, envelope, fromDek, toDek);
   if (body.cek) ctx.cekCache?.set(id, body.cek, 1);
   const { _elevatedBy, _tier: _priorTier, ...carried } = envelope;
-  await ctx.saveHistorySnapshot(id, applyRewrappedBody(carried, body));
+  await ctx.saveHistorySnapshot(id, envelope._v, async (address) => {
+    const to = { ...address, ...envelope._by !== void 0 ? { by: envelope._by } : {} };
+    const histBody = await rewrapBodyToDek(moveFrom, to, envelope, fromDek, toDek);
+    return applyRewrappedBody(carried, histBody);
+  });
   const next = {
     ...carried,
     _noydb: NOYDB_FORMAT_VERSION,
@@ -336,7 +393,7 @@ async function demote(ctx, id, toTier) {
   await ctx.adapter.put(ctx.vault, ctx.name, id, next);
   let searchResidue;
   if (toTier === 0) {
-    const rec = await ctx.codec.decryptRecord(next, { id, sealedAsHandles: true });
+    const rec = await ctx.codec.decryptRecord({ collection: ctx.name, id }, next, { sealedAsHandles: true });
     await ctx.syncIndexes(id, rec, next._v, envelope);
     ctx.syncCache(id, rec !== null ? { record: rec, version: next._v } : null);
     searchResidue = await syncSearchResilient(ctx, id, rec, next._v);
@@ -345,7 +402,7 @@ async function demote(ctx, id, toTier) {
     await ctx.syncIndexes(id, null, next._v);
     ctx.syncCache(id, null);
     searchResidue = await syncSearchResilient(ctx, id, null);
-    await ctx.syncDerived(id, ctx.hasDerivedOutputs ? await ctx.codec.decryptRecordAtDek(envelope, fromDek, id) : null, true);
+    await ctx.syncDerived(id, ctx.hasDerivedOutputs ? await ctx.codec.decryptRecordAtDek({ collection: ctx.name, id }, envelope, fromDek) : null, true);
   }
   ctx.emitCrossTierEvent({
     actor: ctx.keyring.userId,
@@ -378,4 +435,4 @@ export {
   demote,
   classifySealedShred
 };
-//# sourceMappingURL=chunk-C2OOEM57.js.map
+//# sourceMappingURL=chunk-4YL2LMXK.js.map

package/dist/chunk-4YL2LMXK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/tiers/active.ts","../src/with-audit/tiers/strategy.ts","../src/with-audit/tiers/index.ts"],"sourcesContent":["/**\n * Enable the hierarchical-tiers capability.\n * Pass to `createNoydb({ tiersStrategy: withTiers() })` to make a collection's\n * `putAtTier` / `getAtTier` / `listAtTier` / `elevate` / `demote` methods live.\n * The tier read/write/re-key engine is dynamically imported here, so it stays\n * out of the floor bundle until opted in.\n */\nimport type { TiersStrategy } from './strategy.js'\n\nexport function withTiers(): TiersStrategy {\n  return {\n    async putAtTier(ctx, id, record, tier, opts) {\n      const { putAtTier } = await import('./index.js')\n      return putAtTier(ctx, id, record, tier, opts)\n    },\n    async getAtTier(ctx, id) {\n      const { getAtTier } = await import('./index.js')\n      return getAtTier(ctx, id)\n    },\n    async listAtTier(ctx) {\n      const { listAtTier } = await import('./index.js')\n      return listAtTier(ctx)\n    },\n    async elevate(ctx, id, toTier) {\n      const { elevate } = await import('./index.js')\n      return elevate(ctx, id, toTier)\n    },\n    async demote(ctx, id, toTier) {\n      const { demote } = await import('./index.js')\n      return demote(ctx, id, toTier)\n    },\n  }\n}\n","/**\n * Tiers capability strategy — the five on-demand collection-level tier\n * operations the `Collection` routes through. The active engine\n * ({@link withTiers}) dynamically imports the tier cores (keeping them out of\n * the floor bundle); {@link NO_TIERS} throws. Collection always builds its\n * per-call {@link TiersContext} and delegates here, so an un-opted-in caller\n * hits `NO_TIERS`'s throw.\n * @internal\n */\nimport type { GhostRecord } from '../../kernel/types.js'\nimport type { TiersContext, TierMoveResult } from './index.js'\nimport { TiersNotEnabledError } from '../../kernel/errors.js'\n\n// #779 — re-exported so kernel-spine callers (e.g. `Vault._elevatedPut`) can reference the\n// result shape via this grandfathered strategy.js seam instead of statically importing\n// tiers/index.js directly (the port-layering check only grandfathers this file).\nexport type { TierMoveResult }\n\nexport interface TiersStrategy {\n  putAtTier<T>(\n    ctx: TiersContext<T>,\n    id: string,\n    record: T,\n    tier: number,\n    opts?: { elevation?: { reason: string; fromTier: number }; source?: string; sourceTs?: string },\n  ): Promise<TierMoveResult>\n  getAtTier<T>(ctx: TiersContext<T>, id: string): Promise<T | GhostRecord | null>\n  listAtTier<T>(ctx: TiersContext<T>): Promise<Array<{ id: string; tier: number; readable: boolean }>>\n  elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<TierMoveResult>\n  demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<TierMoveResult>\n}\n\n/**\n * No-op stub — the floor default. Every capability method throws\n * {@link TiersNotEnabledError}; opt in with `tiersStrategy: withTiers()` in\n * createNoydb. @internal\n */\nexport const NO_TIERS: TiersStrategy = {\n  async putAtTier() { throw new TiersNotEnabledError() },\n  async getAtTier() { throw new TiersNotEnabledError() },\n  async listAtTier() { throw new TiersNotEnabledError() },\n  async elevate() { throw new TiersNotEnabledError() },\n  async demote() { throw new TiersNotEnabledError() },\n}\n","/**\n * Hierarchical access — the collection-level tier operations\n * (`putAtTier` / `getAtTier` / `listAtTier` / `elevate` / `demote`).\n *\n * A collection opted into `{ tiers: [...] }` stamps `_tier: N` on each envelope\n * and encrypts its body under the tier-N DEK. These helpers are the read/write\n * surface for that scheme: write at a tier, read with tier-aware visibility\n * (invisibility vs. ghost), and move a record up (`elevate`) or down (`demote`)\n * the tier ladder by re-wrapping its body key.\n *\n * Each function takes a small {@link TiersContext} (the exact `this.*` the\n * moving methods touched) instead of `this`, mirroring the `record-keys/`\n * siblings. Behaviour is byte-identical to the inline code it replaced.\n *\n * The crux is `cekCache`: `elevate`/`demote`/`getAtTier` write the SAME `Lru`\n * reference `Collection` owns (never a copy) so a per-record CEK re-wrap stays\n * synchronous with the cache the kernel's write/read path also mutates. The\n * cross-tier event sink stays collection-resident and is reached via the\n * `emitCrossTierEvent` callback.\n *\n * Internal service — not exported as a `@noy-db/hub/*` subpath.\n */\nexport { withTiers } from './active.js'\nexport { NO_TIERS, type TiersStrategy } from './strategy.js'\nexport { TiersNotEnabledError } from '../../kernel/errors.js'\nimport { recordAadFor, type RecordIdentity, buildRecordAad, buildRecordEnvelope, encrypt, decrypt, unwrapCek, rewrapBodyToDek, applyRewrappedBody, isDeleteMarker, isTombstoneShape, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js'\nimport { TierDemoteDeniedError, UnsupportedTierCompositionError, PersistedIndexCompensationError } from '../../kernel/errors.js'\nimport { dekKey, assertTierAccess } from '../../with-party/team/tiers.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { Lru } from '../../kernel/cache/index.js'\nimport type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js'\nimport {\n  NOYDB_FORMAT_VERSION,\n  type NoydbStore,\n  type EncryptedEnvelope,\n  type GhostRecord,\n  type TierMode,\n  type CrossTierAccessEvent,\n} from '../../kernel/types.js'\n\n/** Everything the moving tier methods touched on `this.*`, as a flat context. */\nexport interface TiersContext<T> {\n  /** Collection name — the crypto AAD scope and tier-DEK key prefix. */\n  readonly name: string\n  /** Vault namespace the records live under. */\n  readonly vault: string\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** The caller's unlocked keyring (tier-DEK holdings + role + userId). */\n  readonly keyring: UnlockedKeyring\n  /** The record codec — decrypts a tier-0 envelope to T. */\n  readonly codec: RecordCodec<T>\n  /**\n   * The collection's per-record CEK cache (SHARED reference, not a copy).\n   * `elevate`/`demote`/`getAtTier` re-wrap a record's CEK and `set` it here so\n   * the move stays synchronous with the cache the kernel's read/write path\n   * owns. `null` → no caching.\n   */\n  readonly cekCache: Lru<string, EnclaveKey> | null\n  /**\n   * Sync the collection's decoded-record cache after a tier move rewraps the\n   * envelope (#691). The lazy LRU is evicted on EVERY call — it is never\n   * re-seeded, since a lazy `#getRaw` miss refetches and decodes the fresh\n   * envelope via its adapter fallback (a stale LRU entry after a tier-0\n   * `putAtTier` overwrite was the #702 lazy-mode gap). `null` → also evict\n   * the eager cache entry; an `entry` → set the eager cache to the given\n   * decoded record/version (used by `demote()` landing back at tier 0 and\n   * `putAtTier`'s tier-0 write, #702 — the record is tier-0, so it must stay\n   * plain-`get()`-readable in-session).\n   */\n  syncCache(id: string, entry: { record: T; version: number } | null): void\n  /**\n   * Sync the collection's indexes after a tier move rewraps the envelope\n   * (#709). Persisted `_idx/<field>/<recordId>` side-cars hold the indexed\n   * field's PLAINTEXT value and are always encrypted under the tier-0 DEK,\n   * whatever the record's own tier — the same leak class `forget()` fixed\n   * via `purgePersistedIndexes` (\"forget() crypto-shreds the body but keeps\n   * the collection DEK, under which these side-cars are encrypted — so\n   * without this they leave the indexed field VALUES readable\"). `null` →\n   * the record just left tier 0: purge its persisted side-cars and drop its\n   * in-memory index entries. A record → it is tier-0 again: (re)build its\n   * entries from that record. Call this BEFORE {@link syncCache} — the\n   * implementation reads the pre-write cached value as \"previous\" to clean\n   * up stale index buckets, so it must run while that entry is still live.\n   * `version` stamps a rebuilt side-car's own envelope version — every\n   * caller has one in scope (the envelope it just wrote), including the\n   * purge (`null`) branches, which pass it along even though it's ignored\n   * there (#720: keeps the parameter honestly required, no dead default).\n   * `priorEnvelope` (#720) — the RAW envelope read BEFORE this call's own\n   * overwrite (already in scope as `existing`/`envelope` at every record-\n   * branch call site), so a lazy same-tier value change (a `putAtTier(0)`\n   * dropping an indexed field, a `demote(0)` off an elevated record) can\n   * still be tier-gate-decoded as \"previous\" once the live envelope itself\n   * has already moved past it. The `null`-record branches never pass one —\n   * see the implementation's doc comment for why they don't need to.\n   */\n  syncIndexes(id: string, record: T | null, version: number, priorEnvelope?: EncryptedEnvelope): Promise<void>\n  /** Sync the collection's SEARCH artifacts after a tier move (#721). Both the\n   *  lexical `_ftindex` blob and the `_vec/<id>` embedding are encrypted under\n   *  the tier-0 DEK and hold the record's derived plaintext (full field text /\n   *  a text-invertible vector), so leaving them means elevation never hid what\n   *  the record was searchable by — the `forget()` precedent, unapplied to\n   *  elevate. `null` → the record left tier 0: purge its `_vec`, and\n   *  invalidate the `_ftindex` blob (the cache-driven rebuild then excludes\n   *  it). A record → it is tier-0 again: re-embed it, and invalidate\n   *  `_ftindex` (rebuild includes it). No-op fast when the collection has no\n   *  search. */\n  syncSearch(id: string, record: T | null, version?: number): Promise<void>\n  /**\n   * Sync a record's `_history` snapshots after a tier move rewraps the live\n   * envelope (#712, at-rest hardening). Each snapshot carries its own key\n   * material (a direct DEK wrap, or a per-record `_cek` itself wrapped under\n   * the tier DEK) — `elevate()`'s live-body rewrap moves only the live\n   * envelope, leaving prior versions decryptable at rest under the tier the\n   * record has moved away from (the same leak class `forget()`'s\n   * `tombstoneHistory` closed for erasure). `fromDek`/`toDek` are the SAME\n   * DEKs the caller already resolved for the live rewrap — reuse them, don't\n   * recompute. No-op when the strategy is `NO_HISTORY`.\n   */\n  syncHistory(id: string, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<void>\n  /**\n   * Save a raw pre-move envelope as a `_history` snapshot (#728). Tier moves\n   * (`putAtTier`/`elevate`/`demote`) bump `_v` and overwrite the live\n   * envelope without ever snapshotting the version that existed just before\n   * the move — so `history()` silently lost it. The caller (`tiers/index.ts`)\n   * builds `envelope` by reusing the SAME `rewrapBodyToDek(envelope, fromDek,\n   * toDek)` result it already computed for the live write, so the snapshot\n   * lands wrapped under the DESTINATION tier's DEK — never `ctx.codec.\n   * encryptRecord`, which always resolves the tier-0 DEK and would leak the\n   * pre-move body whenever `fromTier > 0`. No-op when history is disabled\n   * (folds the `historyConfig.enabled` gate so `tiers/index.ts` stays simple).\n   */\n  /**\n   * Persist a `_history` snapshot of `version`, sealed against the address it\n   * will be STORED at (#1041).\n   *\n   * Takes a **sealer**, not a finished envelope, because the destination\n   * identity is not knowable here: only the history strategy owns the\n   * `_history` layout. It hands the address in; the caller seals to it.\n   *\n   * ⚠️ The identity passed to `rewrapBodyToDek` must be what a READER will\n   * recompute — `recordAadFor(address, finalEnvelope)`. A tier-move snapshot\n   * strips `_tier`/`_elevatedBy` but KEEPS `_by`, so the destination is\n   * `{...address, by: envelope._by}` with no tier. Sealing against the bare\n   * address would produce history nothing can open, and the failure would\n   * surface only when someone reads it.\n   */\n  saveHistorySnapshot(\n    id: string,\n    version: number,\n    seal: (address: RecordIdentity) => Promise<EncryptedEnvelope>,\n  ): Promise<void>\n  /**\n   * `true` iff a real history strategy is wired (not `NO_HISTORY`) AND not\n   * explicitly disabled via `historyConfig.enabled`. `putAtTier` checks this\n   * BEFORE decrypting `existing` to build a snapshot (#728, #737 regression\n   * fix) — unlike elevate/demote, which reuse a `body` rewrap their live\n   * write needs unconditionally, putAtTier's live write never decrypts the\n   * prior envelope, so building a snapshot is the ONLY reason it would\n   * touch (and potentially throw decrypting) `existing`'s ciphertext. A\n   * derivation-free, history-disabled collection must not pay that decode —\n   * or risk it, on a corrupted/inaccessible prior body — same law\n   * `hasDerivedOutputs` already enforces for the derived-outputs decode.\n   */\n  readonly historyEnabled: boolean\n  /**\n   * Rehome a record's blob attachments after a tier move (#724 Arc 10 Task\n   * 2, at-rest hardening). A blob's home tier is its owning record's tier —\n   * the `_blob` DEK is tier-scoped (`dekKey('_blob', tier)`), so a solo-\n   * owned blob's content CEK must move with the record or it stays\n   * tier-0-unwrappable at rest even once the live body has moved (the same\n   * leak class `syncHistory` closes for `_history` snapshots). Delegates to\n   * `BlobSet.rehomeForTier`; no-op fast when the collection has no blob\n   * fields. Order-independent with the other sync hooks — touches only\n   * blob side structures, not this collection's own cache/indexes.\n   */\n  syncBlobs(id: string, fromTier: number, toTier: number): Promise<void>\n  /**\n   * Purge a record's tier-0-era plaintext ledger deltas after a tier move\n   * lands it above tier 0 (#729). The audit ledger is a flat, vault-wide,\n   * hash-chained log — a record's reverse-JSON-Patch deltas in\n   * `_ledger_deltas` are encrypted under one collection-wide `_ledger` DEK\n   * (not the record's own tier DEK), so `elevate()`/`putAtTier()`'s live-body\n   * rewrap never moves them: they stay readable at rest to any tier-0\n   * caller, the same leak class `syncHistory` closed for `_history`\n   * snapshots. Chain-safe: `verify()` reads only `_ledger` entry fields\n   * (including `deltaHash`, which lives on the entry, not the deleted delta\n   * row), never `_ledger_deltas`, so a purge cannot break it.\n   * **Irreversible** — the deleted plaintext cannot be restored by\n   * `demote()`. **Metadata-retained** — the `_ledger` entries (that the\n   * record was mutated, at which version/timestamp/actor) are untouched;\n   * only the delta *content* is purged. No-op when the collection has no\n   * ledger (`withHistory()` not enabled).\n   */\n  syncLedger(id: string): Promise<void>\n  /**\n   * Sync a record's derived outputs (materialized-view rows, rollup\n   * contributions, `withDerivation` outputs) after a tier move (#722).\n   * Those outputs are computed from this record and written to OTHER\n   * (output) collections via a plain `put` at tier 0 — `elevate()`'s live-\n   * body rewrap moves only the source envelope, so the output rows keep\n   * holding the source's tier-0-era plaintext, the same leak class\n   * `syncSearch`/`syncIndexes` closed for THIS collection's own artifacts.\n   * `elevated` (landing tier > 0) reuses the SAME onDelete fanout\n   * `forgetDerivedFanout` drives for `forget()` (`kernel/via/dispatch.ts`)\n   * — minus its `'ref'` cascade edge (elevate/demote never erase a\n   * *different* record) — to recompute this record's derived outputs as\n   * REMOVED. Recompute is tier-safe: the fanout's own source scan reads\n   * the elevated-excluding cache (#701/#709/#712), so it naturally omits\n   * the now-elevated record instead of re-embedding its plaintext. Landing\n   * back at tier 0 (`elevated === false`) is the reverse (Task 2, #722):\n   * `syncDerivedOutputs` instead runs the ordinary local-write add-\n   * dispatchers (`dispatchDerivations`/`dispatchMaterializedViews`, the\n   * same ones a plain `put()` fires) to restore the contribution —\n   * reversible, since the source's plaintext survives the elevate/demote\n   * rewrap round-trip. `record` is the decoded source record (PRE-move on\n   * the remove side, POST-move on the add side); only the rollup edge\n   * consumes it on remove, both add-dispatchers require it on add; `null`\n   * (tombstone/delete-marker) skips both. `version` stamps the add-\n   * dispatchers' `_derivedFrom.sourceVersion` metadata — reuses the version\n   * the tier op already has, no re-read; unused on the remove side. No-op\n   * fast when the collection has no MV/derivation source — each dispatcher\n   * below checks its own source before doing any work.\n   */\n  syncDerived(id: string, record: T | null, elevated: boolean, version?: number): Promise<void>\n  /**\n   * `true` iff the collection has a materialized-view or derivation source\n   * attached. Gates the {@link syncDerived} pre-move decode on the remove\n   * direction (`elevate()`, `putAtTier(tier>0)`, `demote()`'s intermediate-\n   * tier branch): those sites decode the record SOLELY to feed\n   * `syncDerived(..., true)`, whose dispatchers no-op immediately when the\n   * collection has no MV/derivation source — so a no-derivation collection\n   * would otherwise pay a full record-body decrypt on every tier move for\n   * nothing (#722 perf regression). `false` short-circuits the decode to\n   * `null`, which `syncDerivedOutputs` already treats safely.\n   */\n  readonly hasDerivedOutputs: boolean\n  /** Emit `_source`/`_sourceTs` provenance fields when a source is supplied. */\n  readonly provenance: boolean\n  /** Declared tiers, or null when the feature is off. */\n  readonly tiers: ReadonlySet<number> | null\n  /** Above-tier read visibility mode (`'invisibility'` | `'ghost'`). */\n  readonly tierMode: TierMode\n  /** Resolve a tier DEK by its `dekKey(name, tier)`. */\n  getDEK(key: string): Promise<EnclaveKey>\n  /** Fire a cross-tier access event (sink stays collection-resident). */\n  emitCrossTierEvent(event: CrossTierAccessEvent): void\n  /**\n   * Register this record's ref in the encrypted `_subject_index` (#766).\n   * `putAtTier`'s raw `ctx.adapter.put` bypasses `Collection.put()`'s write-\n   * hook pipeline — the `onAfterWrite` hook that normally does this — so a\n   * record whose FIRST persistence is `putAtTier` (sensitive from birth, a\n   * documented legitimate use) would otherwise never enter the index and\n   * stay unreachable by `vault.forget()`. Idempotent (safe on every call,\n   * including a repeat write of an already-registered record) and a no-op\n   * when the collection declares no forget-subject field.\n   */\n  addSubjectRef(id: string, record: T): Promise<void>\n}\n\nexport function assertTiersEnabled<T>(ctx: TiersContext<T>): void {\n  if (!ctx.tiers) {\n    throw new Error(\n      `Collection \"${ctx.name}\": hierarchical tiers are not enabled. ` +\n      `Pass { tiers: [0, 1, 2, …] } to vault.collection() to opt in.`,\n    )\n  }\n}\n\nexport function assertDeclaredTier<T>(ctx: TiersContext<T>, tier: number): void {\n  if (tier < 0 || !Number.isInteger(tier)) {\n    throw new Error(`Collection \"${ctx.name}\": tier must be a non-negative integer, got ${tier}`)\n  }\n  if (tier === 0) return\n  if (!ctx.tiers || !ctx.tiers.has(tier)) {\n    throw new Error(\n      `Collection \"${ctx.name}\": tier ${tier} is not declared in { tiers: [...] }`,\n    )\n  }\n}\n\n/**\n * Tier-composition guard (#724 / Arc 7 of the tier-invisibility campaign).\n *\n * Refuses `tiers` declared together with a derived-artifact feature whose\n * crypto has not yet been made tier-aware — i.e. a feature `elevate()` /\n * `demote()` does not re-key when a record moves tiers, so an elevated\n * record's data for that feature would stay readable at tier 0.\n *\n * **Status:** the original call site (`Collection` constructor, beside\n * `buildUniqueConstraintSet`) was removed by Arc 10 Task 1 (#724) — the\n * `tiers + blobFields` refusal below was superseded by a runtime read gate\n * on `collection.blob(id)` (`with-shape/blobs/blob-set.ts`), so this\n * function currently has no caller. Relocated here from\n * `with-lookup/indexing/unique-constraints.ts` (#733) so the tier-domain\n * guard lives in the tier domain, rather than an indexing file it only\n * borrowed for a grandfathered import specifier.\n *\n * ## #724 verified: `tiers + blobFields` leaks\n *\n * `collection.blob(id)` (`Collection.blob()`) never checks the live\n * record's tier before returning a `BlobSet` handle, and `BlobSet`'s crypto\n * is entirely orthogonal to the tier ladder:\n *  - the slot map (`_blob_slots_{collection}/{id}`) is encrypted under the\n *    collection's TIER-0 DEK (`getDEK(name)` ≡ `dekKey(name, 0)` — see\n *    `dekKey` in `with-party/team/tiers.ts`), never a tier-N DEK;\n *  - chunk content (`_blob_index` / `_blob_chunks`) is encrypted under the\n *    vault-shared `_blob` DEK (`BLOB_COLLECTION`), which has no tier\n *    dimension at all.\n * `elevate()`/`demote()` (this file) rewrap only the live record body,\n * `_history` snapshots (#712), and index side-cars — blob slots and chunks\n * are untouched. A caller whose keyring never held the record's elevated\n * tier DEK can still open `collection.blob(id).get(slot)` and read full\n * plaintext, even though `collection.get(id)` correctly reports the same\n * record as invisible. See `__tests__/tier-composition-guard.test.ts` for\n * the reproduction.\n *\n * ## Safe today — no check needed here\n *\n * Field indexes, search (`textIndexes`/`embeddings`), `withHistory`\n * (snapshot keys are rewrapped by `elevate()`/`demote()`, #712), and the\n * decoded-record cache (evicted on tier moves) are already tier-safe. They\n * are not enumerated below; only known-unsafe features are refused, so any\n * combination not named here passes silently by default.\n *\n * ## Deliberately NOT handled here\n *\n * - `ledger` — `withHistory` threads a ledger writer onto every tiered\n *   collection by default in shipped usage; refusing `tiers + ledger` would\n *   break that default. A ledger-specific tier-rekey handler (rewrap ledger\n *   entries, or scope ledger visibility to tier) is a separate arc.\n * - materialized-view (MV) output — an MV's fanout spec lives on the\n *   SOURCE collection, not on the MV collection's own config, so it is not\n *   visible at `vault.collection()` registration time and this guard cannot\n *   detect it structurally.\n */\nexport function assertTierComposition(\n  collectionName: string,\n  cfg: { readonly tiers: boolean; readonly blobFields: BlobFieldsConfig | undefined },\n): void {\n  if (!cfg.tiers) return\n  if (cfg.blobFields !== undefined && Object.keys(cfg.blobFields).length > 0) {\n    throw new UnsupportedTierCompositionError(\n      'blobs',\n      `Collection \"${collectionName}\": blobFields are not supported together with tiers (#724) — ` +\n        `blob chunk content is encrypted under a vault-shared DEK that elevate()/demote() do not ` +\n        `re-key, so an elevated record's blob attachments would remain readable at tier 0. Use a ` +\n        `non-tiered collection for blob-bearing records until a blob tier-rekey handler ships.`,\n    )\n  }\n}\n\nfunction isElevatorOrOwner<T>(ctx: TiersContext<T>): boolean {\n  return ctx.keyring.role === 'owner' || ctx.keyring.role === 'admin'\n}\n\n/**\n * Structural surface {@link syncDerivedOutputs} needs from the owning\n * collection — the SAME onDelete dispatchers `forgetDerivedFanout` already\n * drives (`kernel/via/dispatch.ts`), reused as-is (#722). Narrower than\n * `Collection<T>` (avoids an import cycle: collection.ts constructs\n * `TiersContext` FROM `this`, which already satisfies this shape\n * structurally — no cast needed at the `tiersContext()` call site).\n */\nexport interface DerivedOutputsHost<T> {\n  dispatchMaterializedViewsOnDelete(id: string): Promise<{ deleted: number; residueUndecodable: string[]; residueDeclined: string[] }>\n  dispatchArrayDerivationsOnDelete(id: string, eraseRecordShapeToo?: boolean): Promise<number>\n  dispatchRollupsOnDelete(id: string, deleted: T): Promise<unknown>\n  /** Task 2 (#722) add-direction: the same local-write dispatchers an ordinary `put()` fires. */\n  dispatchMaterializedViews(id: string, record: T): Promise<void>\n  dispatchDerivations(id: string, record: T, version: number): Promise<void>\n}\n\n/**\n * The {@link TiersContext.syncDerived} implementation collection.ts's\n * `tiersContext()` binds `this` into (#722). See that field's doc comment\n * for the design; `host` is `this` — every dispatcher below is a public\n * Collection method, already self-guarding (no-op) when the collection has\n * no materialized-view/derivation source, so no separate fast-path check is\n * needed here.\n */\nexport async function syncDerivedOutputs<T>(\n  host: DerivedOutputsHost<T>,\n  id: string,\n  record: T | null,\n  elevated: boolean,\n  version?: number,\n): Promise<void> {\n  if (elevated) {\n    await host.dispatchMaterializedViewsOnDelete(id)\n    await host.dispatchArrayDerivationsOnDelete(id, true)\n    if (record !== null) await host.dispatchRollupsOnDelete(id, record)\n    return\n  }\n  // Task 2 (#722) recompute-as-add: the record rejoined tier 0 (demote(→0) /\n  // putAtTier(0)) — restore its contribution via the SAME local-write\n  // dispatchers an ordinary `put()` fires (`collection.ts`'s\n  // `_onRecordMutated('local-write')`), same order. `record === null` only\n  // when a caller demotes a tombstone/delete-marker to 0 — nothing to add.\n  if (record === null) return\n  await host.dispatchDerivations(id, record, version ?? 0)\n  await host.dispatchMaterializedViews(id, record)\n}\n\n/**\n * tier-aware put. Encrypts the record with the collection's tier-N DEK and\n * stamps `_tier: N` on the envelope. The caller's keyring must hold the tier-N\n * DEK (directly, by delegation, or by virtue of being the grantor); otherwise\n * throws `TierNotGrantedError`.\n *\n * accepts an optional `elevation` context. When present, the emitted cross-tier\n * event is stamped with `authorization: 'elevation'`, the elevation's reason,\n * and the caller's pre-elevation tier. `vault.elevate(...).collection().put`\n * threads this through; direct `putAtTier` calls leave it undefined and fall\n * back to the inherent-write event shape.\n */\nexport async function putAtTier<T>(\n  ctx: TiersContext<T>,\n  id: string,\n  record: T,\n  tier: number,\n  opts?: { elevation?: { reason: string; fromTier: number }; source?: string; sourceTs?: string },\n): Promise<TierMoveResult> {\n  assertTiersEnabled(ctx)\n  assertDeclaredTier(ctx, tier)\n  assertTierAccess(ctx.keyring, ctx.name, tier)\n\n  const key = dekKey(ctx.name, tier)\n  const dek = await ctx.getDEK(key)\n\n  const existing = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  // #712/whole-branch-fix-1: putAtTier moves the record OFF its existing\n  // tier, same as elevate/demote — so the caller must also be cleared for\n  // that existing tier, not just the target. Without this, a member holding\n  // only the target tier's DEK could putAtTier over a record parked at a\n  // tier they've never been granted; the from-tier `getDEK` below would then\n  // silently MINT a fresh DEK for that tier into their keyring (a\n  // non-cleared caller creating tier key material inside the trust\n  // boundary — see `assertTierAccess`'s doc comment). Gate here, BEFORE any\n  // from-tier getDEK/syncHistory call, so the mint never happens; owner/\n  // admin/custodian still bypass (they may mint, same as elevate/demote).\n  assertTierAccess(ctx.keyring, ctx.name, existing?._tier ?? 0)\n  const version = existing ? existing._v + 1 : 1\n\n  // #728 review-fix-2: resolve the from-tier DEK and snapshot the PRE-move\n  // version BEFORE the live write below, mirroring elevate()/demote() —\n  // originally this ran much later (after syncIndexes/syncLedger/syncDerived/\n  // syncSearchResilient), so a throw in any of those left the live record\n  // already moved with `existing` — its sole pre-move copy — gone, silently\n  // losing the version #728 exists to preserve. `fromKey`/`fromDek` are\n  // resolved ONCE here and reused below for the trailing syncHistory rewrap.\n  const fromKey = dekKey(ctx.name, existing?._tier ?? 0)\n  const fromDek = await ctx.getDEK(fromKey)\n  if (existing && ctx.historyEnabled) {\n    // Snapshot the version this write is about to overwrite — same law as\n    // Collection.put()'s history save, extended to putAtTier (#728). Rewrap\n    // under the DESTINATION `dek` via `applyRewrappedBody` (never\n    // `ctx.codec.encryptRecord`, which always resolves the tier-0 DEK and\n    // would leak this body at rest whenever the prior tier was > 0).\n    // Untagged (`_tier`/`_elevatedBy` stripped), same as elevate()/\n    // demote()'s snapshots. `_v` stays the PRE-move version (unbumped), as\n    // `preCarried` already carries it.\n    const preFrom: RecordIdentity = {\n      // The PRE-move version — this identity opens what is already stored.\n      collection: ctx.name, id, version: existing._v,\n      ...(existing._tier !== undefined ? { tier: existing._tier } : {}),\n      ...(existing._by !== undefined ? { by: existing._by } : {}),\n    }\n    await ctx.saveHistorySnapshot(id, existing._v, async (address) => {\n      // The snapshot is UNTAGGED (`_tier` stripped) and keeps `_by`, so that is\n      // the identity a reader will recompute from it (#1041).\n      const to: RecordIdentity = { ...address, ...(existing._by !== undefined ? { by: existing._by } : {}) }\n      const body = await rewrapBodyToDek(preFrom, to, existing, fromDek, dek)\n      // eslint-disable-next-line @typescript-eslint/no-unused-vars -- excluded from ...preCarried\n      const { _tier: _preTier, _elevatedBy: _preElevatedBy, ...preCarried } = existing\n      return applyRewrappedBody(preCarried, body)\n    })\n  }\n\n  const json = JSON.stringify(record)\n  const identity = { collection: ctx.name, id, version, by: ctx.keyring.userId, ...(tier > 0 ? { tier } : {}) }\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const envelope = buildRecordEnvelope(\n    identity,\n    {\n      iv,\n      data,\n      // `_tier` is stamped from `identity.tier` above — the single source.\n      ...(ctx.provenance && opts?.source !== undefined\n        ? { provenance: { source: opts.source, sourceTs: opts.sourceTs ?? new Date().toISOString() } }\n        : {}),\n    },\n  )\n\n  await ctx.adapter.put(ctx.vault, ctx.name, id, envelope)\n\n  // #766: putAtTier bypasses Collection.put()'s onAfterWrite hook — register\n  // the subject ref directly so a sensitive-from-birth first write stays\n  // reachable by vault.forget(). No-op when no forget-subject field is declared.\n  await ctx.addSubjectRef(id, record)\n\n  // #702/#709: keep the record cache AND indexes coherent with the raw\n  // write — same law as elevate/demote (#691): tier > 0 → invisible on\n  // tier-0 surfaces (evict + purge); tier 0 → an ordinary write (re-seed +\n  // reindex). syncIndexes runs first — it needs the pre-write cache entry\n  // as \"previous\", which syncCache is about to overwrite/evict.\n  if (tier > 0) {\n    await ctx.syncIndexes(id, null, version)\n    ctx.syncCache(id, null)\n    // #729: the record lands above tier 0 — purge its tier-0-era plaintext\n    // ledger deltas (irreversible; a tier-0 putAtTier(0) has nothing to purge).\n    await ctx.syncLedger(id)\n    // #722: recompute this record's derived outputs now that it left tier 0\n    // — same law as elevate() below. `existing` is the PRE-write envelope;\n    // decode it only here (the rollup edge is the only consumer). Gated by\n    // `hasDerivedOutputs` — no-derivation collections skip this decrypt\n    // entirely (perf regression review finding, Arc 9 #722). Whole-branch\n    // review: `existing` may sit at ANY prior tier (including a\n    // `putAtTier`-origin tier>0 record with no `_cek` ever minted) — decode\n    // it under ITS OWN tier's DEK via `codec.decryptRecordAtDek`, not\n    // `ctx.codec.decryptRecord`'s tier-unaware default, which threw\n    // `TamperedError` here.\n    await ctx.syncDerived(\n      id,\n      ctx.hasDerivedOutputs && existing\n        ? await ctx.codec.decryptRecordAtDek({ collection: ctx.name, id }, existing, await ctx.getDEK(dekKey(ctx.name, existing._tier ?? 0)))\n        : null,\n      true,\n    )\n  } else {\n    const rec = await ctx.codec.decryptRecord({ collection: ctx.name, id }, envelope, { sealedAsHandles: true })\n    await ctx.syncIndexes(id, rec, envelope._v, existing ?? undefined)\n    ctx.syncCache(id, rec !== null ? { record: rec, version: envelope._v } : null)\n    // #722 Task 2: the record is written at tier 0 — restore its\n    // contribution to every derived output (reuse the decode above, no\n    // double-decrypt).\n    await ctx.syncDerived(id, rec, false, envelope._v)\n  }\n  // #721: search artifacts follow the same tier > 0 → purge / tier 0 →\n  // re-embed law as syncIndexes above. No ordering dependency on syncCache —\n  // the _ftindex rebuild is deferred to the next retrieve() and _vec re-embed\n  // reads `record` directly, not the cache. #774: a permanently stuck\n  // compensation must not abort the write — the record put above already\n  // landed — so it is caught and surfaced as residue instead, same as\n  // elevate()/demote() (#764).\n  const searchResidue = await syncSearchResilient(ctx, id, tier > 0 ? null : record, envelope._v)\n\n  if (tier > 0) {\n    ctx.emitCrossTierEvent({\n      actor: ctx.keyring.userId,\n      collection: ctx.name,\n      id,\n      tier,\n      authorization: opts?.elevation ? 'elevation' : 'inherent',\n      op: 'put',\n      ts: envelope._ts,\n      ...(opts?.elevation && {\n        reason: opts.elevation.reason,\n        elevatedFrom: opts.elevation.fromTier,\n      }),\n    })\n  }\n\n  // #712/whole-branch-fix-2: syncHistory runs LAST — after syncIndexes/\n  // syncCache/syncSearch (and the cross-tier emit) have already landed. Its\n  // own throw (adapter I/O, the Fix-1 assertion, the rewrap) then strands\n  // only the `_history` artifact instead of leaving indexes/cache/search\n  // unsynced behind an already-moved live record (would conditionally\n  // reopen #709/#721/#723 on the error path). A direct putAtTier also moves\n  // the record's tier — its history snapshots (if any exist from an earlier\n  // tier-0 put()) must follow, same as elevate/demote. Skip when the record\n  // was already at this tier (no move, nothing to rewrap). `fromKey`/\n  // `fromDek` were already resolved above (review-fix-2), before the live\n  // write, for the pre-move snapshot — reused here rather than recomputed.\n  if (fromKey !== key) {\n    await ctx.syncHistory(id, fromDek, dek)\n    // #724: this putAtTier moved the record's tier — rehome its blobs too.\n    await ctx.syncBlobs(id, existing?._tier ?? 0, tier)\n  }\n  return { searchResidue }\n}\n\n/**\n * tier-aware get. When the stored record is at a tier the caller cannot\n * decrypt:\n *   - `'invisibility'` mode (default) → returns `null`.\n *   - `'ghost'` mode → returns a `GhostRecord` placeholder with the tier and\n *     the record id (the record exists but contents are withheld).\n *\n * Fully-cleared reads return the plaintext record and fire a cross-tier event\n * when `_tier > 0`.\n */\nexport async function getAtTier<T>(ctx: TiersContext<T>, id: string): Promise<T | GhostRecord | null> {\n  assertTiersEnabled(ctx)\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope) return null\n  const tier = envelope._tier ?? 0\n  if (tier === 0) {\n    return ctx.codec.decryptRecord({ collection: ctx.name, id }, envelope)\n  }\n\n  const key = dekKey(ctx.name, tier)\n  if (!ctx.keyring.deks.has(key)) {\n    if (ctx.tierMode === 'ghost') {\n      return { _ghost: true, _tier: tier } as GhostRecord\n    }\n    return null\n  }\n\n  const dek = await ctx.getDEK(key)\n  // A tiered record may carry a per-record CEK (e.g. a CEK record\n  // elevated via `elevate()`): the CEK is wrapped under the TIER DEK, so\n  // unwrap under the tier DEK then decrypt the body under the CEK. Legacy\n  // tiered records decrypt directly under the tier DEK.\n  // This leg decrypts manually rather than through `decryptRecord` (#635), so\n  // it must build the AAD itself — from the address it fetched from plus the\n  // envelope's own `_tier`/`_by`, exactly as `recordAadFor` does everywhere\n  // else (#1041).\n  const aad = recordAadFor({ collection: ctx.name, id }, envelope)\n  let plaintext: string\n  let cek: EnclaveKey | undefined\n  if (envelope._cek !== undefined) {\n    cek = await unwrapCek(envelope._cek, dek)\n    ctx.cekCache?.set(id, cek, 1)\n    plaintext = await decrypt(envelope._iv, envelope._data, cek, aad)\n  } else {\n    plaintext = await decrypt(envelope._iv, envelope._data, dek, aad)\n  }\n  let record = JSON.parse(plaintext) as T\n\n  // #635: this manual-decrypt leg never went through `decryptRecord`, so it\n  // never processed `_sealed` slots — an elevated classified record read\n  // back through here would return the body WITHOUT its sealed fields\n  // (silent omission). `applySealedSlots` is the same post-processing\n  // `decryptRecord`'s tier-0 branch above gets for free, extracted so it can\n  // take OUR already-unwrapped `cek` (unwrapped under the TIER dek above)\n  // instead of resolving one itself under the collection DEK the way\n  // `decryptRecord`/`resolveEnvelopeCek` would — which would be the wrong\n  // key for a `_cek` wrapped under a tier DEK. `sealedAsHandles` is omitted\n  // (default false) to match this function's OWN tier-0 branch above\n  // (`ctx.codec.decryptRecord({ collection: ctx.name, id }, envelope)`, no `sealedAsHandles`) —\n  // both tiers return sealed fields inline-decrypted, not as handles.\n  if (envelope._sealed !== undefined) {\n    record = await ctx.codec.applySealedSlots(record, envelope._sealed, cek, { id })\n  }\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier,\n    authorization: isElevatorOrOwner(ctx) ? 'inherent' : 'delegation',\n    op: 'get',\n    ts: new Date().toISOString(),\n  })\n\n  return record\n}\n\n/**\n * list ids grouped by the caller's readability. Returns only ids whose tier the\n * caller can read. Above-tier ids are omitted in `'invisibility'` mode and\n * included (with tier metadata) in `'ghost'` mode.\n */\nexport async function listAtTier<T>(ctx: TiersContext<T>): Promise<Array<{ id: string; tier: number; readable: boolean }>> {\n  assertTiersEnabled(ctx)\n  const ids = await ctx.adapter.list(ctx.vault, ctx.name)\n  const out: Array<{ id: string; tier: number; readable: boolean }> = []\n  for (const id of ids) {\n    const env = await ctx.adapter.get(ctx.vault, ctx.name, id)\n    if (!env) continue\n    const tier = env._tier ?? 0\n    const readable = tier === 0 || ctx.keyring.deks.has(dekKey(ctx.name, tier))\n    if (!readable && ctx.tierMode === 'invisibility') continue\n    out.push({ id, tier, readable })\n  }\n  return out\n}\n\n/**\n * Result of a completed `elevate()`/`demote()` (#764). The record move\n * (put + indexes/cache/ledger/derived/history/blobs sync) always completes —\n * `searchResidue: true` means only the search-index side (`_vec`/`_ftindex`)\n * was left in a needs-retry state (a stuck `PersistedIndexCompensationError`),\n * mirroring `forget()`'s `indexResidue` posture rather than aborting the move.\n */\nexport interface TierMoveResult {\n  readonly searchResidue: boolean\n}\n\n/**\n * Run {@link TiersContext.syncSearch} with #764 resilience: a permanently\n * stuck compensation (`PersistedIndexCompensationError`, thrown by\n * `PersistedIndexStore` when its compensating `remove()` of a stale\n * `_ftindex` blob keeps failing) must not abort `elevate()`/`demote()` — the\n * record's tier-move `put` has already landed, and aborting here would leave\n * `syncLedger`/`syncDerived`/`syncHistory`/`syncBlobs` unsynced behind it (the\n * partial-completion hazard #764 names). Same posture `forget()` takes for\n * `_purgeSearchIndex` (`vault.ts`'s `indexResidue`) — everything else (a\n * genuinely unexpected search-hook error) still aborts, undisturbed.\n */\nasync function syncSearchResilient<T>(ctx: TiersContext<T>, id: string, record: T | null, version?: number): Promise<boolean> {\n  try {\n    await ctx.syncSearch(id, record, version)\n    return false\n  } catch (e) {\n    if (e instanceof PersistedIndexCompensationError) return true\n    throw e\n  }\n}\n\n/**\n * elevate a record to a higher tier. Re-encrypts with the target tier's DEK.\n * The caller must hold DEKs for both the current tier (to decrypt) and the\n * target tier (to re-encrypt). Stamps `_elevatedBy` with the caller id so\n * `demote()` can check the reverse operation.\n */\nexport async function elevate<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<TierMoveResult> {\n  assertTiersEnabled(ctx)\n  assertDeclaredTier(ctx, toTier)\n  assertTierAccess(ctx.keyring, ctx.name, toTier)\n\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope || isDeleteMarker(envelope) || isTombstoneShape(envelope)) {\n    throw new Error(`Record \"${id}\" not found in collection \"${ctx.name}\"`)\n  }\n  const fromTier = envelope._tier ?? 0\n  if (toTier === fromTier) return { searchResidue: false }\n  if (toTier < fromTier) {\n    throw new Error(`Use demote() to lower the tier of \"${id}\" from ${fromTier} to ${toTier}`)\n  }\n  // Caller must have access at the existing tier to decrypt.\n  if (fromTier > 0) assertTierAccess(ctx.keyring, ctx.name, fromTier)\n\n  const fromKey = dekKey(ctx.name, fromTier)\n  const toKey = dekKey(ctx.name, toTier)\n  const fromDek = await ctx.getDEK(fromKey)\n  const toDek = await ctx.getDEK(toKey)\n\n  // Per-record CEK composes with tiers: the body key is unchanged (history\n  // chain identity preserved); only the wrapping key moves with the tier.\n  // Legacy (no `_cek`) records take the direct-DEK path unchanged.\n  const now = new Date().toISOString()\n  const moveFrom: RecordIdentity = {\n    // Opens at the version currently stored; the live write below re-seals at\n    // `_v + 1`, so the two ends of a move are NOT the same identity (#1093).\n    collection: ctx.name, id, version: envelope._v,\n    ...(fromTier > 0 ? { tier: fromTier } : {}),\n    ...(envelope._by !== undefined ? { by: envelope._by } : {}),\n  }\n  const moveTo: RecordIdentity = {\n    collection: ctx.name, id, version: envelope._v + 1,\n    ...(toTier > 0 ? { tier: toTier } : {}),\n    by: ctx.keyring.userId,\n  }\n  const body = await rewrapBodyToDek(moveFrom, moveTo, envelope, fromDek, toDek)\n  if (body.cek) ctx.cekCache?.set(id, body.cek, 1)\n  // #728: snapshot the PRE-move version into `_history` before it's\n  // overwritten below — reuses `body` (already fromDek→toDek) via\n  // `applyRewrappedBody` (never `ctx.codec.encryptRecord`, which always\n  // resolves the tier-0 DEK and would leak this body at rest whenever\n  // `fromTier > 0`). Untagged (`_tier`/`_elevatedBy` stripped) so the\n  // history read-gate doesn't hide it PERMANENTLY once the record demotes\n  // back — at-rest protection comes from the ciphertext being under\n  // `toDek`, not from the tag. `_v` stays the PRE-move version (unbumped),\n  // exactly as `envelope` already carries it.\n  //\n  // A SECOND rewrap, not a reuse of `body` above. The live write and the\n  // snapshot now land at different identities, so they need different AAD and\n  // therefore different ciphertext — sharing one rewrap would produce bytes\n  // that open at one address and not the other (#1041).\n  await ctx.saveHistorySnapshot(id, envelope._v, async (address) => {\n    const to: RecordIdentity = { ...address, ...(envelope._by !== undefined ? { by: envelope._by } : {}) }\n    const histBody = await rewrapBodyToDek(moveFrom, to, envelope, fromDek, toDek)\n    // eslint-disable-next-line @typescript-eslint/no-unused-vars -- excluded from ...snapshot\n    const { _tier: _preTier, _elevatedBy: _preElevatedBy, ...snapshot } = applyRewrappedBody(envelope, histBody)\n    return snapshot\n  })\n  // #662: spread every slot the source carries (_sealed/_det/_vdig/_bidx/\n  // _source/_sourceTs/_debug) through UNCHANGED, then override only\n  // the fields a tier move manages. rewrapBodyToDek preserves the CEK, so no\n  // passenger slot is re-keyed by the move. The old field-literal dropped every\n  // unlisted slot.\n  // NOT a `buildRecordEnvelope` site, deliberately (#1051). This is an envelope\n  // TRANSFORM, not a construction: the spread is load-bearing (#662) — it carries\n  // every passenger slot (`_sealed`/`_det`/`_vdig`/`_bidx`/`_source`/`_debug`)\n  // through unchanged, which a fresh literal would drop. That drop is exactly the\n  // defect #1074 found in `rotateKeys`. Its body already goes through the enclave\n  // (`rewrapBodyToDek`), which is where a tier move will supply AAD.\n  const next: EncryptedEnvelope = {\n    ...envelope,\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: envelope._v + 1,\n    _ts: now,\n    _iv: body._iv,\n    _data: body._data,\n    _by: ctx.keyring.userId,\n    _tier: toTier,\n    _elevatedBy: ctx.keyring.userId,\n    ...(body._cek !== undefined ? { _cek: body._cek } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, ctx.name, id, next)\n  // Evict/purge only once the write landed — a throwing put must not blind\n  // the eager cache or leave a readable index behind for a still-valid\n  // tier-0 record (same ordering as demote). #709: syncIndexes runs first —\n  // it needs the pre-elevation cache entry as \"previous\" to clean the\n  // eager index bucket; the persisted side-car purge is content-free.\n  await ctx.syncIndexes(id, null, next._v)\n  ctx.syncCache(id, null)\n  // #721: same purge law as syncIndexes above — the record left tier 0, so\n  // its _vec sidecar is purged and _ftindex is invalidated. #764: a\n  // permanently stuck compensation must not abort the move — the record put\n  // above already landed — so it is caught and surfaced as residue instead.\n  const searchResidue = await syncSearchResilient(ctx, id, null)\n  // #729: elevate always lands the record at tier > 0 — purge its\n  // tier-0-era plaintext ledger deltas (irreversible; entry metadata stays).\n  await ctx.syncLedger(id)\n  // #722: recompute this record's derived outputs now that it left tier 0 —\n  // same law as putAtTier(tier>0) above. `envelope` is the PRE-move envelope\n  // (captured before the rewrap), decoded only here (the rollup edge is the\n  // only consumer of the record content). Gated by `hasDerivedOutputs` — no-\n  // derivation collections skip this decrypt entirely (perf regression\n  // review finding, Arc 9 #722). Whole-branch review: decode under `fromDek`\n  // via `codec.decryptRecordAtDek` — `fromTier` may be > 0 here (a prior\n  // elevate), and `ctx.codec.decryptRecord`'s tier-unaware CEK resolution\n  // threw `TamperedError` whenever this op's own rewrap hadn't just primed\n  // the cekCache (non-`perRecordKeys` collections; `_cek`-absent bodies).\n  await ctx.syncDerived(id, ctx.hasDerivedOutputs ? await ctx.codec.decryptRecordAtDek({ collection: ctx.name, id }, envelope, fromDek) : null, true)\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier: toTier,\n    authorization: 'elevation',\n    op: 'elevate',\n    ts: now,\n  })\n\n  // #712/whole-branch-fix-2: syncHistory runs LAST — after syncIndexes/\n  // syncCache/syncSearch/the cross-tier emit have already landed, so its own\n  // throw (adapter I/O, the rewrap) strands only the `_history` artifact\n  // instead of leaving indexes/cache/search unsynced behind an already-moved\n  // live record (would conditionally reopen #709/#721/#723 on the error\n  // path). Rewraps prior-version history snapshots to the SAME toTier DEK —\n  // otherwise they stay decryptable at rest under fromDek forever.\n  await ctx.syncHistory(id, fromDek, toDek)\n  // #724: rehome any solo-owned blob attachments to the target tier's\n  // `_blob` DEK — same at-rest law as syncHistory above.\n  await ctx.syncBlobs(id, fromTier, toTier)\n  return { searchResidue }\n}\n\n/**\n * demote a record to a lower tier. Allowed only for the user who performed the\n * last elevation or an owner.\n */\nexport async function demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Promise<TierMoveResult> {\n  assertTiersEnabled(ctx)\n  if (toTier < 0) throw new Error(`Cannot demote to negative tier ${toTier}`)\n\n  const envelope = await ctx.adapter.get(ctx.vault, ctx.name, id)\n  if (!envelope || isDeleteMarker(envelope) || isTombstoneShape(envelope)) {\n    throw new Error(`Record \"${id}\" not found in collection \"${ctx.name}\"`)\n  }\n  const fromTier = envelope._tier ?? 0\n  if (toTier === fromTier) return { searchResidue: false }\n  if (toTier > fromTier) {\n    throw new Error(`Use elevate() to raise the tier of \"${id}\" from ${fromTier} to ${toTier}`)\n  }\n  const isOwner = ctx.keyring.role === 'owner'\n  const isOriginalElevator = envelope._elevatedBy === ctx.keyring.userId\n  if (!isOwner && !isOriginalElevator) {\n    throw new TierDemoteDeniedError(id, fromTier)\n  }\n  // Caller must still hold the DEK of the current tier to decrypt.\n  assertTierAccess(ctx.keyring, ctx.name, fromTier)\n  if (toTier > 0) assertDeclaredTier(ctx, toTier)\n\n  const fromDek = await ctx.getDEK(dekKey(ctx.name, fromTier))\n  const toDek = await ctx.getDEK(dekKey(ctx.name, toTier))\n\n  // CEK re-wrap on demote — same body key, moved from the source tier\n  // DEK to the target tier DEK. Legacy records take the direct-DEK path.\n  const now = new Date().toISOString()\n  const moveFrom: RecordIdentity = {\n    // Opens at the version currently stored; the live write below re-seals at\n    // `_v + 1`, so the two ends of a move are NOT the same identity (#1093).\n    collection: ctx.name, id, version: envelope._v,\n    ...(fromTier > 0 ? { tier: fromTier } : {}),\n    ...(envelope._by !== undefined ? { by: envelope._by } : {}),\n  }\n  const moveTo: RecordIdentity = {\n    collection: ctx.name, id, version: envelope._v + 1,\n    ...(toTier > 0 ? { tier: toTier } : {}),\n    by: ctx.keyring.userId,\n  }\n  const body = await rewrapBodyToDek(moveFrom, moveTo, envelope, fromDek, toDek)\n  if (body.cek) ctx.cekCache?.set(id, body.cek, 1)\n  // #662: same passenger carry-through as elevate(). demote additionally CLEARS\n  // `_elevatedBy` (the demote right is consumed) and OMITS `_tier` at tier 0, so\n  // both are destructured out of the spread rather than carried.\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars -- excluded from ...carried\n  const { _elevatedBy, _tier: _priorTier, ...carried } = envelope\n  // #728: snapshot the PRE-move version into `_history` — reuses `body`\n  // (already fromDek→toDek) and `carried` (envelope minus `_tier`/\n  // `_elevatedBy`, computed above for the live write) via\n  // `applyRewrappedBody`, so a tier-0-landing demote's snapshot is untagged\n  // just like an ordinary put() entry, same law as elevate()'s snapshot\n  // above. `_v` stays the PRE-move version (unbumped), as `carried` already\n  // carries it.\n  // A SECOND rewrap — see elevate()'s note. The snapshot's destination\n  // identity differs from the live write's, so the bytes must differ too.\n  await ctx.saveHistorySnapshot(id, envelope._v, async (address) => {\n    const to: RecordIdentity = { ...address, ...(envelope._by !== undefined ? { by: envelope._by } : {}) }\n    const histBody = await rewrapBodyToDek(moveFrom, to, envelope, fromDek, toDek)\n    return applyRewrappedBody(carried, histBody)\n  })\n  // Transform, not construction — see the note on elevate()'s `next` above.\n  const next: EncryptedEnvelope = {\n    ...carried,\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: envelope._v + 1,\n    _ts: now,\n    _iv: body._iv,\n    _data: body._data,\n    _by: ctx.keyring.userId,\n    ...(toTier > 0 ? { _tier: toTier } : {}),\n    ...(body._cek !== undefined ? { _cek: body._cek } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, ctx.name, id, next)\n\n  // #691/#709: landing back at tier 0 makes this a plain tier-0 record\n  // again — it must stay plain-get()-readable AND indexed in the same\n  // session, so re-seed the eager cache and rebuild its index entries from\n  // the just-written (now tier-0-keyed) envelope through the canonical\n  // codec path, the same decode collection.ts's own eager hydration / lazy\n  // cache-miss paths use — reused for both, no double-decrypt. A demote\n  // that lands on an intermediate elevated tier (toTier > 0) still evicts\n  // + purges: the record stays above tier 0 and must remain invisible on\n  // tier-0 surfaces, unindexed. syncIndexes runs first in both branches —\n  // it needs the pre-demote cache entry as \"previous\".\n  // #764: a permanently stuck search-index compensation must not abort the\n  // move — the record put above already landed — so it is caught in both\n  // branches and surfaced as residue on the return value instead.\n  let searchResidue: boolean\n  if (toTier === 0) {\n    const rec = await ctx.codec.decryptRecord({ collection: ctx.name, id }, next, { sealedAsHandles: true })\n    await ctx.syncIndexes(id, rec, next._v, envelope)\n    ctx.syncCache(id, rec !== null ? { record: rec, version: next._v } : null)\n    // #721: reuse the decode above — no double-decrypt. The record is tier-0\n    // again, so re-embed its _vec and invalidate _ftindex to include it.\n    searchResidue = await syncSearchResilient(ctx, id, rec, next._v)\n    // #722 Task 2: the record rejoined tier 0 — restore its contribution to\n    // every derived output (reuse the decode above, no double-decrypt).\n    await ctx.syncDerived(id, rec, false, next._v)\n  } else {\n    await ctx.syncIndexes(id, null, next._v)\n    ctx.syncCache(id, null)\n    // #721: still above tier 0 — purge _vec, invalidate _ftindex.\n    searchResidue = await syncSearchResilient(ctx, id, null)\n    // #722 Task 2: still elevated (an intermediate tier) — the source's\n    // derived outputs stay recompute-as-removed, same law as elevate()\n    // above. `envelope` is the PRE-move envelope captured at function\n    // entry; decoded only here (the rollup edge is the only consumer).\n    // Gated by `hasDerivedOutputs` — no-derivation collections skip this\n    // decrypt entirely (perf regression review finding, Arc 9 #722).\n    // Whole-branch review: decode under `fromDek` via\n    // `codec.decryptRecordAtDek` — this branch's `fromTier` is always > 0 (a\n    // demote FROM tier `fromTier` TO an intermediate `toTier` > 0), so\n    // `ctx.codec.decryptRecord`'s tier-unaware CEK resolution threw\n    // `TamperedError` here exactly as it did in elevate() above\n    // (code-identical bug, same fix).\n    await ctx.syncDerived(id, ctx.hasDerivedOutputs ? await ctx.codec.decryptRecordAtDek({ collection: ctx.name, id }, envelope, fromDek) : null, true)\n  }\n\n  ctx.emitCrossTierEvent({\n    actor: ctx.keyring.userId,\n    collection: ctx.name,\n    id,\n    tier: fromTier,\n    authorization: 'elevation',\n    op: 'demote',\n    ts: now,\n  })\n\n  // #712/whole-branch-fix-2: syncHistory runs LAST — after syncIndexes/\n  // syncCache/syncSearch/the cross-tier emit have already landed, so its own\n  // throw (adapter I/O, the rewrap) strands only the `_history` artifact\n  // instead of leaving indexes/cache/search unsynced behind an already-moved\n  // live record (would conditionally reopen #709/#721/#723 on the error\n  // path). Rewraps history snapshots the same direction as the live body —\n  // demote restores tier-0 (or intermediate-tier) readability at rest.\n  await ctx.syncHistory(id, fromDek, toDek)\n  // #724: rehome any solo-owned blob attachments the same direction as the\n  // live body — restores tier-0 (or intermediate-tier) readability at rest.\n  await ctx.syncBlobs(id, fromTier, toTier)\n  return { searchResidue }\n}\n\n/**\n * Classify a live envelope's `_sealed` slots for crypto-shred completeness\n * (#M-1). Thin delegate to {@link RecordCodec.classifySealedShred}; surfaced\n * here because `vault.ts` forget() reaches in via `collection._classifySealedShred`.\n */\nexport function classifySealedShred<T>(\n  ctx: TiersContext<T>,\n  live: EncryptedEnvelope,\n): Promise<{ readonly slots: readonly SealedShredSlot[] }> {\n  return ctx.codec.classifySealedShred(live)\n}\n\n// #837 — classifySealedShred's slot type must be nameable from this entry.\nexport type { SealedShredSlot } from '../../kernel/enclave/index.js'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASO,SAAS,YAA2B;AACzC,SAAO;AAAA,IACL,MAAM,UAAU,KAAK,IAAI,QAAQ,MAAM,MAAM;AAC3C,YAAM,EAAE,WAAAA,WAAU,IAAI,MAAM,OAAO,kBAAY;AAC/C,aAAOA,WAAU,KAAK,IAAI,QAAQ,MAAM,IAAI;AAAA,IAC9C;AAAA,IACA,MAAM,UAAU,KAAK,IAAI;AACvB,YAAM,EAAE,WAAAC,WAAU,IAAI,MAAM,OAAO,kBAAY;AAC/C,aAAOA,WAAU,KAAK,EAAE;AAAA,IAC1B;AAAA,IACA,MAAM,WAAW,KAAK;AACpB,YAAM,EAAE,YAAAC,YAAW,IAAI,MAAM,OAAO,kBAAY;AAChD,aAAOA,YAAW,GAAG;AAAA,IACvB;AAAA,IACA,MAAM,QAAQ,KAAK,IAAI,QAAQ;AAC7B,YAAM,EAAE,SAAAC,SAAQ,IAAI,MAAM,OAAO,kBAAY;AAC7C,aAAOA,SAAQ,KAAK,IAAI,MAAM;AAAA,IAChC;AAAA,IACA,MAAM,OAAO,KAAK,IAAI,QAAQ;AAC5B,YAAM,EAAE,QAAAC,QAAO,IAAI,MAAM,OAAO,kBAAY;AAC5C,aAAOA,QAAO,KAAK,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACF;;;ACKO,IAAM,WAA0B;AAAA,EACrC,MAAM,YAAY;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACrD,MAAM,YAAY;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACrD,MAAM,aAAa;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACtD,MAAM,UAAU;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AAAA,EACnD,MAAM,SAAS;AAAE,UAAM,IAAI,qBAAqB;AAAA,EAAE;AACpD;;;ACyNO,SAAS,mBAAsB,KAA4B;AAChE,MAAI,CAAC,IAAI,OAAO;AACd,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI;AAAA,IAEzB;AAAA,EACF;AACF;AAEO,SAAS,mBAAsB,KAAsB,MAAoB;AAC9E,MAAI,OAAO,KAAK,CAAC,OAAO,UAAU,IAAI,GAAG;AACvC,UAAM,IAAI,MAAM,eAAe,IAAI,IAAI,+CAA+C,IAAI,EAAE;AAAA,EAC9F;AACA,MAAI,SAAS,EAAG;AAChB,MAAI,CAAC,IAAI,SAAS,CAAC,IAAI,MAAM,IAAI,IAAI,GAAG;AACtC,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI,WAAW,IAAI;AAAA,IACxC;AAAA,EACF;AACF;AAyDO,SAAS,sBACd,gBACA,KACM;AACN,MAAI,CAAC,IAAI,MAAO;AAChB,MAAI,IAAI,eAAe,UAAa,OAAO,KAAK,IAAI,UAAU,EAAE,SAAS,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR;AAAA,MACA,eAAe,cAAc;AAAA,IAI/B;AAAA,EACF;AACF;AAEA,SAAS,kBAAqB,KAA+B;AAC3D,SAAO,IAAI,QAAQ,SAAS,WAAW,IAAI,QAAQ,SAAS;AAC9D;AA2BA,eAAsB,mBACpB,MACA,IACA,QACA,UACA,SACe;AACf,MAAI,UAAU;AACZ,UAAM,KAAK,kCAAkC,EAAE;AAC/C,UAAM,KAAK,iCAAiC,IAAI,IAAI;AACpD,QAAI,WAAW,KAAM,OAAM,KAAK,wBAAwB,IAAI,MAAM;AAClE;AAAA,EACF;AAMA,MAAI,WAAW,KAAM;AACrB,QAAM,KAAK,oBAAoB,IAAI,QAAQ,WAAW,CAAC;AACvD,QAAM,KAAK,0BAA0B,IAAI,MAAM;AACjD;AAcA,eAAsB,UACpB,KACA,IACA,QACA,MACA,MACyB;AACzB,qBAAmB,GAAG;AACtB,qBAAmB,KAAK,IAAI;AAC5B,mBAAiB,IAAI,SAAS,IAAI,MAAM,IAAI;AAE5C,QAAM,MAAM,OAAO,IAAI,MAAM,IAAI;AACjC,QAAM,MAAM,MAAM,IAAI,OAAO,GAAG;AAEhC,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAW9D,mBAAiB,IAAI,SAAS,IAAI,MAAM,UAAU,SAAS,CAAC;AAC5D,QAAM,UAAU,WAAW,SAAS,KAAK,IAAI;AAS7C,QAAM,UAAU,OAAO,IAAI,MAAM,UAAU,SAAS,CAAC;AACrD,QAAM,UAAU,MAAM,IAAI,OAAO,OAAO;AACxC,MAAI,YAAY,IAAI,gBAAgB;AASlC,UAAM,UAA0B;AAAA;AAAA,MAE9B,YAAY,IAAI;AAAA,MAAM;AAAA,MAAI,SAAS,SAAS;AAAA,MAC5C,GAAI,SAAS,UAAU,SAAY,EAAE,MAAM,SAAS,MAAM,IAAI,CAAC;AAAA,MAC/D,GAAI,SAAS,QAAQ,SAAY,EAAE,IAAI,SAAS,IAAI,IAAI,CAAC;AAAA,IAC3D;AACA,UAAM,IAAI,oBAAoB,IAAI,SAAS,IAAI,OAAO,YAAY;AAGhE,YAAM,KAAqB,EAAE,GAAG,SAAS,GAAI,SAAS,QAAQ,SAAY,EAAE,IAAI,SAAS,IAAI,IAAI,CAAC,EAAG;AACrG,YAAM,OAAO,MAAM,gBAAgB,SAAS,IAAI,UAAU,SAAS,GAAG;AAEtE,YAAM,EAAE,OAAO,UAAU,aAAa,gBAAgB,GAAG,WAAW,IAAI;AACxE,aAAO,mBAAmB,YAAY,IAAI;AAAA,IAC5C,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,KAAK,UAAU,MAAM;AAClC,QAAM,WAAW,EAAE,YAAY,IAAI,MAAM,IAAI,SAAS,IAAI,IAAI,QAAQ,QAAQ,GAAI,OAAO,IAAI,EAAE,KAAK,IAAI,CAAC,EAAG;AAC5G,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,WAAW;AAAA,IACf;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA;AAAA,MAEA,GAAI,IAAI,cAAc,MAAM,WAAW,SACnC,EAAE,YAAY,EAAE,QAAQ,KAAK,QAAQ,UAAU,KAAK,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE,EAAE,IAC3F,CAAC;AAAA,IACP;AAAA,EACF;AAEA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,QAAQ;AAKvD,QAAM,IAAI,cAAc,IAAI,MAAM;AAOlC,MAAI,OAAO,GAAG;AACZ,UAAM,IAAI,YAAY,IAAI,MAAM,OAAO;AACvC,QAAI,UAAU,IAAI,IAAI;AAGtB,UAAM,IAAI,WAAW,EAAE;AAWvB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,IAAI,qBAAqB,WACrB,MAAM,IAAI,MAAM,mBAAmB,EAAE,YAAY,IAAI,MAAM,GAAG,GAAG,UAAU,MAAM,IAAI,OAAO,OAAO,IAAI,MAAM,SAAS,SAAS,CAAC,CAAC,CAAC,IAClI;AAAA,MACJ;AAAA,IACF;AAAA,EACF,OAAO;AACL,UAAM,MAAM,MAAM,IAAI,MAAM,cAAc,EAAE,YAAY,IAAI,MAAM,GAAG,GAAG,UAAU,EAAE,iBAAiB,KAAK,CAAC;AAC3G,UAAM,IAAI,YAAY,IAAI,KAAK,SAAS,IAAI,YAAY,MAAS;AACjE,QAAI,UAAU,IAAI,QAAQ,OAAO,EAAE,QAAQ,KAAK,SAAS,SAAS,GAAG,IAAI,IAAI;AAI7E,UAAM,IAAI,YAAY,IAAI,KAAK,OAAO,SAAS,EAAE;AAAA,EACnD;AAQA,QAAM,gBAAgB,MAAM,oBAAoB,KAAK,IAAI,OAAO,IAAI,OAAO,QAAQ,SAAS,EAAE;AAE9F,MAAI,OAAO,GAAG;AACZ,QAAI,mBAAmB;AAAA,MACrB,OAAO,IAAI,QAAQ;AAAA,MACnB,YAAY,IAAI;AAAA,MAChB;AAAA,MACA;AAAA,MACA,eAAe,MAAM,YAAY,cAAc;AAAA,MAC/C,IAAI;AAAA,MACJ,IAAI,SAAS;AAAA,MACb,GAAI,MAAM,aAAa;AAAA,QACrB,QAAQ,KAAK,UAAU;AAAA,QACvB,cAAc,KAAK,UAAU;AAAA,MAC/B;AAAA,IACF,CAAC;AAAA,EACH;AAaA,MAAI,YAAY,KAAK;AACnB,UAAM,IAAI,YAAY,IAAI,SAAS,GAAG;AAEtC,UAAM,IAAI,UAAU,IAAI,UAAU,SAAS,GAAG,IAAI;AAAA,EACpD;AACA,SAAO,EAAE,cAAc;AACzB;AAYA,eAAsB,UAAa,KAAsB,IAA6C;AACpG,qBAAmB,GAAG;AACtB,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,OAAO,SAAS,SAAS;AAC/B,MAAI,SAAS,GAAG;AACd,WAAO,IAAI,MAAM,cAAc,EAAE,YAAY,IAAI,MAAM,GAAG,GAAG,QAAQ;AAAA,EACvE;AAEA,QAAM,MAAM,OAAO,IAAI,MAAM,IAAI;AACjC,MAAI,CAAC,IAAI,QAAQ,KAAK,IAAI,GAAG,GAAG;AAC9B,QAAI,IAAI,aAAa,SAAS;AAC5B,aAAO,EAAE,QAAQ,MAAM,OAAO,KAAK;AAAA,IACrC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,MAAM,IAAI,OAAO,GAAG;AAShC,QAAM,MAAM,aAAa,EAAE,YAAY,IAAI,MAAM,GAAG,GAAG,QAAQ;AAC/D,MAAI;AACJ,MAAI;AACJ,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,MAAM,UAAU,SAAS,MAAM,GAAG;AACxC,QAAI,UAAU,IAAI,IAAI,KAAK,CAAC;AAC5B,gBAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,KAAK,GAAG;AAAA,EAClE,OAAO;AACL,gBAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,KAAK,GAAG;AAAA,EAClE;AACA,MAAI,SAAS,KAAK,MAAM,SAAS;AAcjC,MAAI,SAAS,YAAY,QAAW;AAClC,aAAS,MAAM,IAAI,MAAM,iBAAiB,QAAQ,SAAS,SAAS,KAAK,EAAE,GAAG,CAAC;AAAA,EACjF;AAEA,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA;AAAA,IACA,eAAe,kBAAkB,GAAG,IAAI,aAAa;AAAA,IACrD,IAAI;AAAA,IACJ,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,EAC7B,CAAC;AAED,SAAO;AACT;AAOA,eAAsB,WAAc,KAAuF;AACzH,qBAAmB,GAAG;AACtB,QAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,IAAI;AACtD,QAAM,MAA8D,CAAC;AACrE,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AACzD,QAAI,CAAC,IAAK;AACV,UAAM,OAAO,IAAI,SAAS;AAC1B,UAAM,WAAW,SAAS,KAAK,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,MAAM,IAAI,CAAC;AAC1E,QAAI,CAAC,YAAY,IAAI,aAAa,eAAgB;AAClD,QAAI,KAAK,EAAE,IAAI,MAAM,SAAS,CAAC;AAAA,EACjC;AACA,SAAO;AACT;AAwBA,eAAe,oBAAuB,KAAsB,IAAY,QAAkB,SAAoC;AAC5H,MAAI;AACF,UAAM,IAAI,WAAW,IAAI,QAAQ,OAAO;AACxC,WAAO;AAAA,EACT,SAAS,GAAG;AACV,QAAI,aAAa,gCAAiC,QAAO;AACzD,UAAM;AAAA,EACR;AACF;AAQA,eAAsB,QAAW,KAAsB,IAAY,QAAyC;AAC1G,qBAAmB,GAAG;AACtB,qBAAmB,KAAK,MAAM;AAC9B,mBAAiB,IAAI,SAAS,IAAI,MAAM,MAAM;AAE9C,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,YAAY,eAAe,QAAQ,KAAK,iBAAiB,QAAQ,GAAG;AACvE,UAAM,IAAI,MAAM,WAAW,EAAE,8BAA8B,IAAI,IAAI,GAAG;AAAA,EACxE;AACA,QAAM,WAAW,SAAS,SAAS;AACnC,MAAI,WAAW,SAAU,QAAO,EAAE,eAAe,MAAM;AACvD,MAAI,SAAS,UAAU;AACrB,UAAM,IAAI,MAAM,sCAAsC,EAAE,UAAU,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC3F;AAEA,MAAI,WAAW,EAAG,kBAAiB,IAAI,SAAS,IAAI,MAAM,QAAQ;AAElE,QAAM,UAAU,OAAO,IAAI,MAAM,QAAQ;AACzC,QAAM,QAAQ,OAAO,IAAI,MAAM,MAAM;AACrC,QAAM,UAAU,MAAM,IAAI,OAAO,OAAO;AACxC,QAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;AAKpC,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,WAA2B;AAAA;AAAA;AAAA,IAG/B,YAAY,IAAI;AAAA,IAAM;AAAA,IAAI,SAAS,SAAS;AAAA,IAC5C,GAAI,WAAW,IAAI,EAAE,MAAM,SAAS,IAAI,CAAC;AAAA,IACzC,GAAI,SAAS,QAAQ,SAAY,EAAE,IAAI,SAAS,IAAI,IAAI,CAAC;AAAA,EAC3D;AACA,QAAM,SAAyB;AAAA,IAC7B,YAAY,IAAI;AAAA,IAAM;AAAA,IAAI,SAAS,SAAS,KAAK;AAAA,IACjD,GAAI,SAAS,IAAI,EAAE,MAAM,OAAO,IAAI,CAAC;AAAA,IACrC,IAAI,IAAI,QAAQ;AAAA,EAClB;AACA,QAAM,OAAO,MAAM,gBAAgB,UAAU,QAAQ,UAAU,SAAS,KAAK;AAC7E,MAAI,KAAK,IAAK,KAAI,UAAU,IAAI,IAAI,KAAK,KAAK,CAAC;AAe/C,QAAM,IAAI,oBAAoB,IAAI,SAAS,IAAI,OAAO,YAAY;AAChE,UAAM,KAAqB,EAAE,GAAG,SAAS,GAAI,SAAS,QAAQ,SAAY,EAAE,IAAI,SAAS,IAAI,IAAI,CAAC,EAAG;AACrG,UAAM,WAAW,MAAM,gBAAgB,UAAU,IAAI,UAAU,SAAS,KAAK;AAE7E,UAAM,EAAE,OAAO,UAAU,aAAa,gBAAgB,GAAG,SAAS,IAAI,mBAAmB,UAAU,QAAQ;AAC3G,WAAO;AAAA,EACT,CAAC;AAYD,QAAM,OAA0B;AAAA,IAC9B,GAAG;AAAA,IACH,QAAQ;AAAA,IACR,IAAI,SAAS,KAAK;AAAA,IAClB,KAAK;AAAA,IACL,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,IAAI,QAAQ;AAAA,IACjB,OAAO;AAAA,IACP,aAAa,IAAI,QAAQ;AAAA,IACzB,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,IAAI;AAMnD,QAAM,IAAI,YAAY,IAAI,MAAM,KAAK,EAAE;AACvC,MAAI,UAAU,IAAI,IAAI;AAKtB,QAAM,gBAAgB,MAAM,oBAAoB,KAAK,IAAI,IAAI;AAG7D,QAAM,IAAI,WAAW,EAAE;AAWvB,QAAM,IAAI,YAAY,IAAI,IAAI,oBAAoB,MAAM,IAAI,MAAM,mBAAmB,EAAE,YAAY,IAAI,MAAM,GAAG,GAAG,UAAU,OAAO,IAAI,MAAM,IAAI;AAElJ,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA,MAAM;AAAA,IACN,eAAe;AAAA,IACf,IAAI;AAAA,IACJ,IAAI;AAAA,EACN,CAAC;AASD,QAAM,IAAI,YAAY,IAAI,SAAS,KAAK;AAGxC,QAAM,IAAI,UAAU,IAAI,UAAU,MAAM;AACxC,SAAO,EAAE,cAAc;AACzB;AAMA,eAAsB,OAAU,KAAsB,IAAY,QAAyC;AACzG,qBAAmB,GAAG;AACtB,MAAI,SAAS,EAAG,OAAM,IAAI,MAAM,kCAAkC,MAAM,EAAE;AAE1E,QAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AAC9D,MAAI,CAAC,YAAY,eAAe,QAAQ,KAAK,iBAAiB,QAAQ,GAAG;AACvE,UAAM,IAAI,MAAM,WAAW,EAAE,8BAA8B,IAAI,IAAI,GAAG;AAAA,EACxE;AACA,QAAM,WAAW,SAAS,SAAS;AACnC,MAAI,WAAW,SAAU,QAAO,EAAE,eAAe,MAAM;AACvD,MAAI,SAAS,UAAU;AACrB,UAAM,IAAI,MAAM,uCAAuC,EAAE,UAAU,QAAQ,OAAO,MAAM,EAAE;AAAA,EAC5F;AACA,QAAM,UAAU,IAAI,QAAQ,SAAS;AACrC,QAAM,qBAAqB,SAAS,gBAAgB,IAAI,QAAQ;AAChE,MAAI,CAAC,WAAW,CAAC,oBAAoB;AACnC,UAAM,IAAI,sBAAsB,IAAI,QAAQ;AAAA,EAC9C;AAEA,mBAAiB,IAAI,SAAS,IAAI,MAAM,QAAQ;AAChD,MAAI,SAAS,EAAG,oBAAmB,KAAK,MAAM;AAE9C,QAAM,UAAU,MAAM,IAAI,OAAO,OAAO,IAAI,MAAM,QAAQ,CAAC;AAC3D,QAAM,QAAQ,MAAM,IAAI,OAAO,OAAO,IAAI,MAAM,MAAM,CAAC;AAIvD,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,WAA2B;AAAA;AAAA;AAAA,IAG/B,YAAY,IAAI;AAAA,IAAM;AAAA,IAAI,SAAS,SAAS;AAAA,IAC5C,GAAI,WAAW,IAAI,EAAE,MAAM,SAAS,IAAI,CAAC;AAAA,IACzC,GAAI,SAAS,QAAQ,SAAY,EAAE,IAAI,SAAS,IAAI,IAAI,CAAC;AAAA,EAC3D;AACA,QAAM,SAAyB;AAAA,IAC7B,YAAY,IAAI;AAAA,IAAM;AAAA,IAAI,SAAS,SAAS,KAAK;AAAA,IACjD,GAAI,SAAS,IAAI,EAAE,MAAM,OAAO,IAAI,CAAC;AAAA,IACrC,IAAI,IAAI,QAAQ;AAAA,EAClB;AACA,QAAM,OAAO,MAAM,gBAAgB,UAAU,QAAQ,UAAU,SAAS,KAAK;AAC7E,MAAI,KAAK,IAAK,KAAI,UAAU,IAAI,IAAI,KAAK,KAAK,CAAC;AAK/C,QAAM,EAAE,aAAa,OAAO,YAAY,GAAG,QAAQ,IAAI;AAUvD,QAAM,IAAI,oBAAoB,IAAI,SAAS,IAAI,OAAO,YAAY;AAChE,UAAM,KAAqB,EAAE,GAAG,SAAS,GAAI,SAAS,QAAQ,SAAY,EAAE,IAAI,SAAS,IAAI,IAAI,CAAC,EAAG;AACrG,UAAM,WAAW,MAAM,gBAAgB,UAAU,IAAI,UAAU,SAAS,KAAK;AAC7E,WAAO,mBAAmB,SAAS,QAAQ;AAAA,EAC7C,CAAC;AAED,QAAM,OAA0B;AAAA,IAC9B,GAAG;AAAA,IACH,QAAQ;AAAA,IACR,IAAI,SAAS,KAAK;AAAA,IAClB,KAAK;AAAA,IACL,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,IAAI,QAAQ;AAAA,IACjB,GAAI,SAAS,IAAI,EAAE,OAAO,OAAO,IAAI,CAAC;AAAA,IACtC,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvD;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,IAAI;AAenD,MAAI;AACJ,MAAI,WAAW,GAAG;AAChB,UAAM,MAAM,MAAM,IAAI,MAAM,cAAc,EAAE,YAAY,IAAI,MAAM,GAAG,GAAG,MAAM,EAAE,iBAAiB,KAAK,CAAC;AACvG,UAAM,IAAI,YAAY,IAAI,KAAK,KAAK,IAAI,QAAQ;AAChD,QAAI,UAAU,IAAI,QAAQ,OAAO,EAAE,QAAQ,KAAK,SAAS,KAAK,GAAG,IAAI,IAAI;AAGzE,oBAAgB,MAAM,oBAAoB,KAAK,IAAI,KAAK,KAAK,EAAE;AAG/D,UAAM,IAAI,YAAY,IAAI,KAAK,OAAO,KAAK,EAAE;AAAA,EAC/C,OAAO;AACL,UAAM,IAAI,YAAY,IAAI,MAAM,KAAK,EAAE;AACvC,QAAI,UAAU,IAAI,IAAI;AAEtB,oBAAgB,MAAM,oBAAoB,KAAK,IAAI,IAAI;AAavD,UAAM,IAAI,YAAY,IAAI,IAAI,oBAAoB,MAAM,IAAI,MAAM,mBAAmB,EAAE,YAAY,IAAI,MAAM,GAAG,GAAG,UAAU,OAAO,IAAI,MAAM,IAAI;AAAA,EACpJ;AAEA,MAAI,mBAAmB;AAAA,IACrB,OAAO,IAAI,QAAQ;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB;AAAA,IACA,MAAM;AAAA,IACN,eAAe;AAAA,IACf,IAAI;AAAA,IACJ,IAAI;AAAA,EACN,CAAC;AASD,QAAM,IAAI,YAAY,IAAI,SAAS,KAAK;AAGxC,QAAM,IAAI,UAAU,IAAI,UAAU,MAAM;AACxC,SAAO,EAAE,cAAc;AACzB;AAOO,SAAS,oBACd,KACA,MACyD;AACzD,SAAO,IAAI,MAAM,oBAAoB,IAAI;AAC3C;","names":["putAtTier","getAtTier","listAtTier","elevate","demote"]}

package/dist/{chunk-EP7VPR7Y.js → chunk-5Q7AJ7DN.js}

@@ -1,16 +1,16 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-52QYGZHH.js";
+} from "./chunk-GBBDFE6C.js";
 import {
-  sha256Hex
-} from "./chunk-VCETL77O.js";
+  buildRecordEnvelope
+} from "./chunk-PENPHA45.js";
 import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-W5W6KHN2.js";
+  sha256Hex
+} from "./chunk-AU3AUJIZ.js";
 import {
   ReadOnlyError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-audit/portability/withdraw-accessible.ts
 var FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
@@ -38,7 +38,10 @@ async function freezeSnapshotOnly(vault, collections, opts) {
     vaultName,
     FROZEN_SNAPSHOTS_COLLECTION,
     withdrawalId,
-    { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: frozenAt, _iv: "", _data: body, _by: opts.actorUserId },
+    buildRecordEnvelope(
+      { collection: FROZEN_SNAPSHOTS_COLLECTION, id: withdrawalId, by: opts.actorUserId, version: 1 },
+      { ts: frozenAt, iv: "", data: body }
+    ),
     0
   );
   await vault._getLedgerOrNull()?.append({
@@ -114,4 +117,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-EP7VPR7Y.js.map
+//# sourceMappingURL=chunk-5Q7AJ7DN.js.map

package/dist/chunk-5Q7AJ7DN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/portability/withdraw-accessible.ts"],"sourcesContent":["/**\n * `unilateralWithdrawal`: a non-owner extracts their accessible scope\n * AND disposes of the source copy. Destructive; gated by the default-off\n * fail-closed built-in `client-unilateral-withdraw` policy (checked in the\n * UserApi wrapper).\n *\n * Two source dispositions:\n *  - 'delete'  — delete-closure: the records leave the source vault entirely.\n *  - 'freeze'  — the firm retains a cryptographically-frozen, read-only, write-once\n *                snapshot (hash-pinned in the tamper-evident ledger) while the live\n *                records are removed.\n *\n * Ordering guarantees no data loss: the client's re-keyed export bundle (and the\n * freeze snapshot) are produced BEFORE anything is deleted.\n *\n * The `freezeAndDeleteClosure` core is shared with the two-party approval path\n * (`request-withdrawal.ts`).\n */\nimport type { Vault } from '../../kernel/vault.js'\nimport { buildRecordEnvelope, sha256Hex } from '../../kernel/enclave/index.js'\nimport { ReadOnlyError } from '../../kernel/errors.js'\nimport { resolveAccessibleCollections, buildAccessibleBundle } from './export-accessible.js'\n\nexport const FROZEN_SNAPSHOTS_COLLECTION = '_frozen_snapshots'\nconst ENC = new TextEncoder()\n\n/** 24-hex-char random id (used for withdrawal ids + request ids). */\nexport function randomId(): string {\n  const b = globalThis.crypto.getRandomValues(new Uint8Array(12))\n  return Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('')\n}\n\nexport interface FrozenSnapshotRef {\n  readonly withdrawalId: string\n  readonly sha256: string\n  readonly recordCount: number\n  readonly frozenAt: string\n}\n\nexport interface WithdrawAccessibleOptions {\n  /** Legal/contractual basis recorded in the audit (e.g. 'gdpr-art-17'). */\n  readonly legalBasis: string\n  /** Re-key the exported bundle to a new owner secret. */\n  readonly reKey?: { readonly secret: string }\n  /** Source disposition. Default 'delete'. */\n  readonly disposition?: 'delete' | 'freeze'\n  readonly scope?: { readonly collections?: readonly string[] }\n  /** Stable id for idempotent resume (default random). */\n  readonly withdrawalId?: string\n}\n\nexport interface WithdrawResult {\n  readonly bundle: Uint8Array\n  readonly snapshot?: FrozenSnapshotRef\n}\n\n/**\n * Freeze a write-once, hash-pinned snapshot of the current ciphertext for\n * `collections` WITHOUT touching the live records. Returns the snapshot ref.\n *\n * This is the non-destructive core shared by two callers:\n *  - `freezeAndDeleteClosure` (withdrawal, disposition `'freeze'`) — which\n *    pins the snapshot and THEN delete-closures the live records.\n *  - FR-6 `liberateVault` (custody) — which pins a PRE-liberation evidence\n *    snapshot but PRESERVES the live data for the new owner (operational\n *    continuity; liberation transfers, it does not erase).\n *\n * The snapshot put is write-once (CAS expectedVersion 0) and the ledger pin is\n * appended on success, so a crashed run re-run with the same `withdrawalId` is\n * safe. The snapshot is taken under the vault's own firm-owned DEKs — no re-key.\n */\nexport async function freezeSnapshotOnly(\n  vault: Vault,\n  collections: readonly string[],\n  opts: { actorUserId: string; withdrawalId?: string },\n): Promise<FrozenSnapshotRef> {\n  const { name: vaultName, adapter } = vault._introspectState()\n\n  // Enumerate the closure (record ids per collection).\n  const closure: Array<{ collection: string; id: string }> = []\n  for (const c of collections) {\n    for (const id of await adapter.list(vaultName, c)) closure.push({ collection: c, id })\n  }\n\n  const withdrawalId = opts.withdrawalId ?? `wd-${randomId()}`\n  const snap: Record<string, Record<string, unknown>> = {}\n  for (const { collection, id } of closure) {\n    const env = await adapter.get(vaultName, collection, id)\n    if (env) (snap[collection] ??= {})[id] = env\n  }\n  const frozenAt = new Date().toISOString()\n  const body = JSON.stringify({ withdrawalId, frozenAt, by: opts.actorUserId, collections: snap })\n  const sha = await sha256Hex(ENC.encode(body))\n  // Write-once: expectedVersion 0 rejects an overwrite (idempotent resume).\n  await adapter.put(\n    vaultName,\n    FROZEN_SNAPSHOTS_COLLECTION,\n    withdrawalId,\n    buildRecordEnvelope(\n      { collection: FROZEN_SNAPSHOTS_COLLECTION, id: withdrawalId, by: opts.actorUserId, version: 1 },\n      { ts: frozenAt, iv: '', data: body},\n    ),\n    0,\n  )\n  // Hash-pin into the tamper-evident ledger — makes the snapshot provably unaltered.\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: opts.actorUserId, payloadHash: '',\n    reason: `withdrawal-frozen-snapshot:${withdrawalId}:${sha}`,\n  })\n  return { withdrawalId, sha256: sha, recordCount: closure.length, frozenAt }\n}\n\n/**\n * Dispose of the source records for `collections`: optionally freeze a\n * write-once hash-pinned snapshot of the original ciphertext, then\n * delete-closure the live records. Returns the snapshot ref on freeze.\n *\n * Caller MUST have produced the portable bundle FIRST — this is destructive.\n * The delete is best-effort + idempotent (re-deleting an absent record is a\n * no-op) and the snapshot put is write-once (CAS expectedVersion 0), so a\n * crashed run re-run with the same `withdrawalId` is safe.\n */\nexport async function freezeAndDeleteClosure(\n  vault: Vault,\n  collections: readonly string[],\n  opts: { disposition: 'delete' | 'freeze'; actorUserId: string; withdrawalId?: string },\n): Promise<FrozenSnapshotRef | undefined> {\n  // freeze: pin a write-once, hash-pinned snapshot BEFORE any delete. The\n  // snapshot-only core is shared with FR-6 liberation (which never deletes).\n  const snapshot = opts.disposition === 'freeze'\n    ? await freezeSnapshotOnly(vault, collections, {\n        actorUserId: opts.actorUserId,\n        ...(opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}),\n      })\n    : undefined\n\n  // delete-closure — only after the snapshot is durable.\n  const { name: vaultName, adapter } = vault._introspectState()\n  for (const c of collections) {\n    for (const id of await adapter.list(vaultName, c)) {\n      await vault.collection(c).delete(id)\n    }\n  }\n\n  return snapshot\n}\n\nexport async function withdrawAccessibleData(\n  vault: Vault,\n  opts: WithdrawAccessibleOptions,\n): Promise<WithdrawResult> {\n  const { keyring } = vault._introspectState()\n  const disposition = opts.disposition ?? 'delete'\n\n  // Owner-class roles hold blanket authority — they use extractPartition.\n  if (keyring.role === 'owner' || keyring.role === 'admin') {\n    throw new ReadOnlyError(\n      'unilateralWithdrawal is the scoped self-service path; an owner/admin should use extractPartition',\n    )\n  }\n  // FR-6: a custodian must NOT destructively SEVER the vault. It holds the DEKs\n  // and operates fully, but ownership is claimed only through the audited\n  // Liberate ceremony — never by a one-sided delete/freeze withdrawal. Fires\n  // BEFORE the operator rw-scope path below (where a custodian would otherwise\n  // be rejected with the wrong \"requires rw access\" message).\n  if (keyring.role === 'custodian') {\n    throw new ReadOnlyError(\n      'a custodian cannot destructively withdraw/sever; use vault.custody.liberate for an audited ownership claim',\n    )\n  }\n  // client/viewer are read-only by construction (see hasWritePermission): a\n  // destructive withdrawal they cannot self-serve — they use the two-party\n  // requestWithdrawal flow where firm authority executes the delete-closure.\n  if (keyring.role === 'client' || keyring.role === 'viewer') {\n    throw new ReadOnlyError(\n      'read-only role cannot self-serve a destructive withdrawal — use requestWithdrawal (two-party)',\n    )\n  }\n  // Operator path: destructive ops need rw on the whole scope.\n  const collections = resolveAccessibleCollections(keyring, opts.scope, true)\n  if (!collections || collections.length === 0) {\n    throw new ReadOnlyError(\n      'unilateralWithdrawal requires rw access on the withdrawn collections — use requestWithdrawal for read-only scope',\n    )\n  }\n\n  // 1. Produce the client's re-keyed portable copy FIRST (nothing destroyed yet).\n  const bundle = await buildAccessibleBundle(vault, collections, opts.reKey)\n\n  // 2. + 3. freeze (optional) then delete-closure.\n  const snapshot = await freezeAndDeleteClosure(vault, collections, {\n    disposition, actorUserId: keyring.userId, ...(opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}),\n  })\n\n  // 4. audit\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: keyring.userId, payloadHash: '',\n    reason: `user-unilateral-withdrawal:${keyring.userId}:${disposition}:${opts.legalBasis}`,\n  })\n\n  return snapshot ? { bundle, snapshot } : { bundle }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuBO,IAAM,8BAA8B;AAC3C,IAAM,MAAM,IAAI,YAAY;AAGrB,SAAS,WAAmB;AACjC,QAAM,IAAI,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC9D,SAAO,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACtE;AAyCA,eAAsB,mBACpB,OACA,aACA,MAC4B;AAC5B,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAG5D,QAAM,UAAqD,CAAC;AAC5D,aAAW,KAAK,aAAa;AAC3B,eAAW,MAAM,MAAM,QAAQ,KAAK,WAAW,CAAC,EAAG,SAAQ,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC;AAAA,EACvF;AAEA,QAAM,eAAe,KAAK,gBAAgB,MAAM,SAAS,CAAC;AAC1D,QAAM,OAAgD,CAAC;AACvD,aAAW,EAAE,YAAY,GAAG,KAAK,SAAS;AACxC,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,YAAY,EAAE;AACvD,QAAI,IAAK,EAAC,KAAK,UAAU,MAAM,CAAC,GAAG,EAAE,IAAI;AAAA,EAC3C;AACA,QAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,QAAM,OAAO,KAAK,UAAU,EAAE,cAAc,UAAU,IAAI,KAAK,aAAa,aAAa,KAAK,CAAC;AAC/F,QAAM,MAAM,MAAM,UAAU,IAAI,OAAO,IAAI,CAAC;AAE5C,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,EAAE,YAAY,6BAA6B,IAAI,cAAc,IAAI,KAAK,aAAa,SAAS,EAAE;AAAA,MAC9F,EAAE,IAAI,UAAU,IAAI,IAAI,MAAM,KAAI;AAAA,IACpC;AAAA,IACA;AAAA,EACF;AAEA,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,KAAK;AAAA,IAAa,aAAa;AAAA,IAC3F,QAAQ,8BAA8B,YAAY,IAAI,GAAG;AAAA,EAC3D,CAAC;AACD,SAAO,EAAE,cAAc,QAAQ,KAAK,aAAa,QAAQ,QAAQ,SAAS;AAC5E;AAYA,eAAsB,uBACpB,OACA,aACA,MACwC;AAGxC,QAAM,WAAW,KAAK,gBAAgB,WAClC,MAAM,mBAAmB,OAAO,aAAa;AAAA,IAC3C,aAAa,KAAK;AAAA,IAClB,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,EACjE,CAAC,IACD;AAGJ,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,aAAW,KAAK,aAAa;AAC3B,eAAW,MAAM,MAAM,QAAQ,KAAK,WAAW,CAAC,GAAG;AACjD,YAAM,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE;AAAA,IACrC;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,uBACpB,OACA,MACyB;AACzB,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAC3C,QAAM,cAAc,KAAK,eAAe;AAGxC,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAMA,MAAI,QAAQ,SAAS,aAAa;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS,YAAY,QAAQ,SAAS,UAAU;AAC1D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,6BAA6B,SAAS,KAAK,OAAO,IAAI;AAC1E,MAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,SAAS,MAAM,sBAAsB,OAAO,aAAa,KAAK,KAAK;AAGzE,QAAM,WAAW,MAAM,uBAAuB,OAAO,aAAa;AAAA,IAChE;AAAA,IAAa,aAAa,QAAQ;AAAA,IAAQ,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,EAC3G,CAAC;AAGD,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,QAAQ;AAAA,IAAQ,aAAa;AAAA,IACzF,QAAQ,8BAA8B,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,UAAU;AAAA,EACxF,CAAC;AAED,SAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,EAAE,OAAO;AACpD;","names":[]}