@agentcomms/events-daemon 0.0.0-stage → 0.16.0

package/dist/records-3rGS8spn.mjs

@@ -0,0 +1,1143 @@
+import { t as canonicalSecretWebhookUrl } from "./webhook-target-BkA_wHIu.mjs";
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from "node:crypto";
+import "node:fs/promises";
+import { FileSecretStore, KeychainSecretStore, canonicalJson, keychainNamespace, loadKeyringModule, sha256Hex, withFileLock } from "@agentcomms/core";
+import { join } from "node:path";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/store/aad.ts
+const AAD_PREFIX = Buffer.from("aec-v1", "ascii");
+const PRIMARY_KEY_COMPONENT_COUNTS = {
+	"source_scan_state.encryptedRecord": 1,
+	"rule_activation_points.encryptedPosition": 5,
+	"activation_baselines.encryptedPosition": 4,
+	"ingest_rules.encryptedProjection": 3,
+	"decisions.encryptedRecord": 1,
+	"deliveries.encryptedRecord": 1,
+	"dryrun_log.encryptedRecord": 1,
+	"stream_log.encryptedRecord": 1,
+	"event_secret_generations.encryptedReference": 5,
+	"system_reset_outbox.encryptedRecord": 1
+};
+var AadError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "AadError";
+	}
+};
+function lengthPrefixed(value) {
+	if (value.byteLength > 4294967295) throw new AadError("AAD value is too large to encode");
+	const length = Buffer.allocUnsafe(4);
+	length.writeUInt32BE(value.byteLength);
+	return Buffer.concat([length, value]);
+}
+function integerBytes(value) {
+	const integer = typeof value === "bigint" ? value : BigInt(value);
+	if (typeof value === "number" && (!Number.isSafeInteger(value) || !Number.isInteger(value))) throw new AadError("AAD INTEGER must be a safe integer or bigint");
+	if (integer < -(1n << 63n) || integer > (1n << 63n) - 1n) throw new AadError("AAD INTEGER is outside SQLite’s signed 64-bit range");
+	const encoded = Buffer.allocUnsafe(8);
+	encoded.writeBigInt64BE(integer);
+	return encoded;
+}
+function componentBytes(component) {
+	switch (component.type) {
+		case "integer": return Buffer.concat([Buffer.from([1]), integerBytes(component.value)]);
+		case "text": return Buffer.concat([Buffer.from([2]), lengthPrefixed(Buffer.from(component.value, "utf8"))]);
+		case "blob": return Buffer.concat([Buffer.from([3]), lengthPrefixed(Buffer.from(component.value))]);
+	}
+}
+/**
+* Encodes the one AAD form every encrypted event record uses.
+*
+* Components must arrive in the primary-key order declared by the migration. The table/column map intentionally
+* lives here as well as in the schema, so a caller cannot silently encrypt an unsupported column or omit one part
+* of its row identity.
+*/
+function encodeAad(table, column, components) {
+	const id = `${table}.${column}`;
+	const expected = PRIMARY_KEY_COMPONENT_COUNTS[id];
+	if (expected === void 0) throw new AadError(`no encrypted event column is named ${id}`);
+	if (components.length !== expected) throw new AadError(`${id} needs ${expected} primary-key components, got ${components.length}`);
+	return Buffer.concat([
+		AAD_PREFIX,
+		lengthPrefixed(Buffer.from(table, "utf8")),
+		lengthPrefixed(Buffer.from(column, "utf8")),
+		Buffer.from([components.length]),
+		...components.map(componentBytes)
+	]);
+}
+Object.freeze({ ...PRIMARY_KEY_COMPONENT_COUNTS });
+//#endregion
+//#region src/store/crypto.ts
+const FORMAT_VERSION = 1;
+const NONCE_BYTES = 12;
+const TAG_BYTES = 16;
+var PackedRecordError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "PackedRecordError";
+		this.code = code;
+	}
+};
+function checkedKey(key) {
+	if (key.byteLength !== 32) throw new PackedRecordError("PACKED_RECORD_INVALID", "AES-256-GCM needs a 32-byte key");
+	return Buffer.from(key);
+}
+function checkedKeyId(keyId) {
+	const encoded = Buffer.from(keyId, "ascii");
+	if (keyId.length === 0 || keyId.length > 255 || encoded.toString("ascii") !== keyId) throw new PackedRecordError("PACKED_RECORD_INVALID", "packed record key identifiers are non-empty ASCII of at most 255 bytes");
+	return encoded;
+}
+function unpack(record) {
+	const bytes = Buffer.from(record);
+	if (bytes.byteLength < 31 || bytes[0] !== FORMAT_VERSION) throw new PackedRecordError("PACKED_RECORD_INVALID", "encrypted record is not packed record format v1");
+	const keyIdLength = bytes[1] ?? 0;
+	const keyStart = 2;
+	const nonceStart = keyStart + keyIdLength;
+	const ciphertextStart = nonceStart + NONCE_BYTES;
+	const tagStart = bytes.byteLength - TAG_BYTES;
+	if (keyIdLength === 0 || ciphertextStart > tagStart) throw new PackedRecordError("PACKED_RECORD_INVALID", "encrypted record has invalid packed boundaries");
+	const keyIdBytes = bytes.subarray(keyStart, nonceStart);
+	const keyId = keyIdBytes.toString("ascii");
+	if (keyIdBytes.toString("ascii") !== keyId || !/^[\x21-\x7e]+$/.test(keyId)) throw new PackedRecordError("PACKED_RECORD_INVALID", "encrypted record has a non-ASCII key identifier");
+	return {
+		keyId,
+		nonce: bytes.subarray(nonceStart, ciphertextStart),
+		ciphertext: bytes.subarray(ciphertextStart, tagStart),
+		tag: bytes.subarray(tagStart)
+	};
+}
+/** Packs AES-256-GCM ciphertext exactly as D8 record format v1. */
+function encryptPackedRecord(input) {
+	const keyId = checkedKeyId(input.keyId);
+	const key = checkedKey(input.key);
+	const nonce = input.nonce === void 0 ? randomBytes(NONCE_BYTES) : Buffer.from(input.nonce);
+	if (nonce.byteLength !== NONCE_BYTES) throw new PackedRecordError("PACKED_RECORD_INVALID", "packed record nonces must be 96 bits");
+	const cipher = createCipheriv("aes-256-gcm", key, nonce, { authTagLength: TAG_BYTES });
+	cipher.setAAD(Buffer.from(input.aad));
+	const ciphertext = Buffer.concat([cipher.update(Buffer.from(input.plaintext)), cipher.final()]);
+	return Buffer.concat([
+		Buffer.from([FORMAT_VERSION, keyId.byteLength]),
+		keyId,
+		nonce,
+		ciphertext,
+		cipher.getAuthTag()
+	]);
+}
+/** Opens one packed record and refuses a missing key, malformed record, or an authentication mismatch. */
+function decryptPackedRecord(input) {
+	const parsed = unpack(input.record);
+	const selected = input.keyForId(parsed.keyId);
+	if (selected === null) throw new PackedRecordError("UNKNOWN_KEY", "encrypted record names an unavailable master key");
+	try {
+		const decipher = createDecipheriv("aes-256-gcm", checkedKey(selected), parsed.nonce, { authTagLength: TAG_BYTES });
+		decipher.setAAD(Buffer.from(input.aad));
+		decipher.setAuthTag(parsed.tag);
+		return Buffer.concat([decipher.update(parsed.ciphertext), decipher.final()]);
+	} catch (error) {
+		if (error instanceof PackedRecordError) throw error;
+		throw new PackedRecordError("AUTHENTICATION_FAILED", "encrypted record did not authenticate for its declared row");
+	}
+}
+/** Reads only the identifier from a syntactically valid packed record, before its master is looked up asynchronously. */
+function packedRecordKeyId(record) {
+	return unpack(record).keyId;
+}
+/** Derives the prescribed table subkey from one installation master without putting the key id in HKDF info. */
+function deriveTableKey(master, table) {
+	return Buffer.from(hkdfSync("sha256", checkedKey(master), Buffer.alloc(0), `agentcomms-events/${table}/v1`, 32));
+}
+//#endregion
+//#region src/store/event-secrets.ts
+var EventSecretError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "EventSecretError";
+		this.code = code;
+	}
+};
+const lockScope = new AsyncLocalStorage();
+/** Shares the one process- and filesystem-wide lock across master, generation and migration work. */
+async function withEventSecretsLock(paths, work) {
+	const lockPath = join(paths.root, "secrets.lock");
+	if (lockScope.getStore()?.has(lockPath)) return work();
+	return withFileLock(lockPath, async () => lockScope.run(/* @__PURE__ */ new Set([...lockScope.getStore() ?? [], lockPath]), work), {
+		timeoutMs: 5e3,
+		staleMs: 3e4
+	});
+}
+function generationLocation(owner, purpose, generation) {
+	return {
+		table: "event_secret_generations",
+		column: "encryptedReference",
+		key: [
+			{
+				type: "text",
+				value: owner.kind
+			},
+			{
+				type: "text",
+				value: owner.id
+			},
+			{
+				type: "integer",
+				value: owner.version
+			},
+			{
+				type: "text",
+				value: purpose
+			},
+			{
+				type: "integer",
+				value: generation
+			}
+		]
+	};
+}
+function assertPurpose(owner, purpose) {
+	if (!(owner.kind === "target" && (purpose === "secret-url" || purpose === "webhook-signing") || owner.kind === "subscriber" && purpose === "sse-bearer" || owner.kind === "judge" && purpose === "judge-key")) throw new EventSecretError("EVENT_SECRET_REFERENCE", "the secret purpose does not belong to the exact object version");
+}
+function asStoredGeneration(row) {
+	const ownerKind = row.owner_kind;
+	const purpose = row.purpose;
+	const lifecycle = row.lifecycle;
+	if (ownerKind !== "target" && ownerKind !== "subscriber" && ownerKind !== "judge" || purpose !== "secret-url" && purpose !== "webhook-signing" && purpose !== "sse-bearer" && purpose !== "judge-key" || lifecycle !== "current" && lifecycle !== "overlap" && lifecycle !== "retired" || typeof row.owner_id !== "string" || typeof row.owner_version !== "number" || typeof row.owner_digest !== "string" || typeof row.generation !== "number" || typeof row.secret_digest !== "string" || !(row.encrypted_ref instanceof Uint8Array)) throw new EventSecretError("EVENT_SECRET_REFERENCE", "event secret generation ledger has an invalid row");
+	return {
+		owner: {
+			kind: ownerKind,
+			id: row.owner_id,
+			version: row.owner_version,
+			digest: row.owner_digest
+		},
+		purpose,
+		generation: row.generation,
+		lifecycle,
+		expiresAt: typeof row.expires_at === "number" ? row.expires_at : null,
+		secretDigest: row.secret_digest,
+		encryptedRef: row.encrypted_ref
+	};
+}
+async function referencesFor(database, cipher) {
+	const masters = database.prepare("SELECT secret_ref FROM event_secret_masters").all().map((row) => row.secret_ref);
+	const rows = database.prepare(`SELECT owner_kind, owner_id, owner_version, purpose, generation, owner_digest, secret_digest,
+              encrypted_ref, lifecycle, expires_at
+       FROM event_secret_generations WHERE lifecycle IN ('current', 'overlap')`).all();
+	if (rows.length === 0) return [...new Set(masters)].sort();
+	if (cipher === void 0) throw new EventSecretError("EVENT_SECRET_REFERENCE", "event secret generations need the record cipher for reference reconciliation");
+	const references = [...masters];
+	for (const row of rows) {
+		const generation = asStoredGeneration(row);
+		const value = (await cipher.decrypt(generationLocation(generation.owner, generation.purpose, generation.generation), generation.encryptedRef)).toString("utf8");
+		if (!/^event-secret:[a-f0-9]{24}$/.test(value)) throw new EventSecretError("EVENT_SECRET_REFERENCE", "event secret generation has an invalid opaque reference");
+		references.push(value);
+	}
+	return [...new Set(references)].sort();
+}
+function selectedKind(database) {
+	const row = database.prepare("SELECT value FROM meta WHERE key = 'event_secret_store'").get();
+	if (row === void 0) return null;
+	if (row.value === "keychain" || row.value === "file") return row.value;
+	throw new EventSecretError("EVENT_SECRET_SELECTOR", "event secret selector is not a recognised backend");
+}
+function setSelector(database, kind) {
+	database.prepare("INSERT INTO meta (key, value) VALUES ('event_secret_store', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(kind);
+}
+/** A synchronous transaction-safe representation of every reference migration is allowed to move. */
+function referenceSnapshot(database) {
+	const masters = database.prepare("SELECT key_id, secret_ref, retired_at FROM event_secret_masters ORDER BY key_id").all();
+	const generations = database.prepare(`SELECT owner_kind, owner_id, owner_version, purpose, generation, owner_digest, secret_digest,
+              hex(encrypted_ref) AS encrypted_ref, lifecycle, expires_at
+       FROM event_secret_generations ORDER BY owner_kind, owner_id, owner_version, purpose, generation`).all();
+	return canonicalJson({
+		masters,
+		generations
+	});
+}
+/** The core keychain namespace deliberately gains an events-only suffix. */
+function eventKeychainNamespace(configDir) {
+	return `${keychainNamespace(configDir)}:events`;
+}
+async function storeFor(options, kind) {
+	const injected = options.stores?.[kind];
+	if (injected !== void 0) return injected;
+	if (kind === "file") return new FileSecretStore(options.paths.secretsDir);
+	const keyring = options.keyring === void 0 ? await loadKeyringModule() : options.keyring;
+	if (keyring === null) throw new EventSecretError("EVENT_SECRET_SELECTOR", "event secrets default to the system keychain, which is unavailable");
+	return new KeychainSecretStore(keyring, eventKeychainNamespace(options.configDir));
+}
+function parseMaster(ref, value) {
+	if (value === null) throw new EventSecretError("EVENT_MASTER_LOST", `event master ${ref} is unavailable`);
+	const key = Buffer.from(value, "base64");
+	if (key.byteLength !== 32 || key.toString("base64") !== value) throw new EventSecretError("EVENT_MASTER_LOST", `event master ${ref} is invalid`);
+	return key;
+}
+/**
+* The daemon's independent master-key ledger. It uses core's hardened physical backends but owns selection,
+* references, locking and migration boundaries itself.
+*/
+var EventSecretStore = class {
+	#database;
+	#paths;
+	#kind;
+	#store;
+	#selectorWasAbsent;
+	#openStore;
+	constructor(database, paths, kind, store, selectorWasAbsent, openStore) {
+		this.#database = database;
+		this.#paths = paths;
+		this.#kind = kind;
+		this.#store = store;
+		this.#selectorWasAbsent = selectorWasAbsent;
+		this.#openStore = openStore;
+	}
+	get kind() {
+		return this.#kind;
+	}
+	async references(cipher) {
+		return this.withLock(() => referencesFor(this.#database, cipher));
+	}
+	/** The owner alone opens the other events-only backend; no core selector or namespace participates. */
+	async migrateTo(to, referenceCipher) {
+		const target = to === this.#kind ? this.#store : await this.#openStore(to);
+		const result = await migrateEventSecrets({
+			database: this.#database,
+			paths: this.#paths,
+			from: this.#kind,
+			to,
+			source: this.#store,
+			target,
+			referenceCipher
+		});
+		if (selectedKind(this.#database) === to) {
+			this.#kind = to;
+			this.#store = target;
+		}
+		return result;
+	}
+	async currentMaster() {
+		return this.withLock(async () => {
+			this.assertSelectedBackend();
+			const current = this.#database.prepare("SELECT key_id, secret_ref FROM event_secret_masters WHERE retired_at IS NULL ORDER BY created_at DESC LIMIT 1").get();
+			if (current !== void 0) return {
+				keyId: current.key_id,
+				key: parseMaster(current.secret_ref, await readBackend(this.#store, current.secret_ref))
+			};
+			if (this.#selectorWasAbsent) await this.probeInitialBackend();
+			return this.createMaster(void 0);
+		});
+	}
+	async master(keyId) {
+		return this.withLock(async () => {
+			this.assertSelectedBackend();
+			const row = this.#database.prepare("SELECT secret_ref FROM event_secret_masters WHERE key_id = ?").get(keyId);
+			if (row === void 0) throw new EventSecretError("EVENT_MASTER_UNKNOWN", `event master ${keyId} is unknown`);
+			return parseMaster(row.secret_ref, await readBackend(this.#store, row.secret_ref));
+		});
+	}
+	async rotateMaster() {
+		return this.withLock(async () => {
+			this.assertSelectedBackend();
+			const current = this.#database.prepare("SELECT key_id FROM event_secret_masters WHERE retired_at IS NULL ORDER BY created_at DESC LIMIT 1").get();
+			return this.createMaster(current?.key_id);
+		});
+	}
+	/**
+	* A retired master may be physically deleted only once every packed record
+	* and encrypted opaque-reference column proves it no longer names that key.
+	* The caller owns the writer-quiescer exclusive lease; this method retains
+	* the secrets lock for the entire scan and deletion.
+	*/
+	async destroyRetiredMaster(input) {
+		input.quiescer.assertExclusive();
+		return this.withLock(async () => {
+			this.assertSelectedBackend();
+			const row = this.#database.prepare("SELECT secret_ref, retired_at FROM event_secret_masters WHERE key_id = ?").get(input.keyId);
+			if (row === void 0 || row.retired_at === null) throw new EventSecretError("EVENT_MASTER_UNKNOWN", "only a known retired event master may be destroyed");
+			const { RECORD_LAYOUTS } = await import("./records-DojbuTaG.mjs");
+			for (const layout of RECORD_LAYOUTS) {
+				const records = this.#database.prepare(`SELECT ${layout.sqlColumn} AS record FROM ${layout.table} WHERE ${layout.sqlColumn} IS NOT NULL`).all();
+				for (const record of records) {
+					if (!(record.record instanceof Uint8Array)) throw new EventSecretError("RETIRED_MASTER_REFERENCED", "a packed record column is not a BLOB");
+					let keyId;
+					try {
+						keyId = packedRecordKeyId(record.record);
+					} catch {
+						throw new EventSecretError("RETIRED_MASTER_REFERENCED", "a packed record cannot be proven independent");
+					}
+					if (keyId === input.keyId) throw new EventSecretError("RETIRED_MASTER_REFERENCED", "a packed record still names the retired event master");
+				}
+			}
+			await referencesFor(this.#database, input.cipher);
+			this.#database.exec("BEGIN IMMEDIATE");
+			try {
+				const current = this.#database.prepare("SELECT retired_at FROM event_secret_masters WHERE key_id = ?").get(input.keyId);
+				if (current === void 0 || current.retired_at === null) throw new EventSecretError("RETIRED_MASTER_REFERENCED", "the retired master changed during its destruction scan");
+				this.#database.prepare("DELETE FROM nonce_counters WHERE key_id = ?").run(input.keyId);
+				this.#database.prepare("DELETE FROM event_secret_masters WHERE key_id = ? AND retired_at IS NOT NULL").run(input.keyId);
+				this.#database.exec("COMMIT");
+			} catch (error) {
+				this.#database.exec("ROLLBACK");
+				throw error;
+			}
+			if (!await this.#store.delete(row.secret_ref)) throw new EventSecretError("RETIRED_MASTER_REFERENCED", "the retired event master could not be deleted");
+		});
+	}
+	/**
+	* Resolves the current and still-valid overlap generations for one exact immutable owner. The opaque backend
+	* reference stays inside this store; only the byte-boundary adapter receives material, and only in memory.
+	*/
+	async readLiveGenerations(input) {
+		assertPurpose(input.owner, input.purpose);
+		return this.withLock(async () => {
+			this.assertSelectedBackend();
+			this.assertLiveOwner(input.owner);
+			const now = input.now ?? Date.now();
+			const rows = this.#database.prepare(`SELECT owner_kind, owner_id, owner_version, purpose, generation, owner_digest, secret_digest,
+                  encrypted_ref, lifecycle, expires_at
+           FROM event_secret_generations
+           WHERE owner_kind = ? AND owner_id = ? AND owner_version = ? AND purpose = ?
+             AND (lifecycle = 'current' OR (lifecycle = 'overlap' AND expires_at > ?))
+           ORDER BY generation DESC`).all(input.owner.kind, input.owner.id, input.owner.version, input.purpose, now);
+			const resolved = [];
+			for (const row of rows) {
+				const generation = asStoredGeneration(row);
+				if (generation.owner.digest !== input.owner.digest) throw new EventSecretError("EVENT_SECRET_OWNER_STALE", "the secret generation owner digest is no longer exact");
+				const ref = (await input.cipher.decrypt(generationLocation(generation.owner, generation.purpose, generation.generation), generation.encryptedRef)).toString("utf8");
+				if (!/^event-secret:[a-f0-9]{24}$/.test(ref)) throw new EventSecretError("EVENT_SECRET_REFERENCE", "event secret generation has an invalid opaque reference");
+				const material = await readBackend(this.#store, ref);
+				if (material === null || sha256Hex(material) !== generation.secretDigest) throw new EventSecretError("EVENT_SECRET_REFERENCE", "event secret generation material is unavailable or changed");
+				resolved.push({
+					owner: generation.owner,
+					purpose: generation.purpose,
+					generation: generation.generation,
+					lifecycle: generation.lifecycle,
+					expiresAt: generation.expiresAt,
+					secretDigest: generation.secretDigest,
+					material
+				});
+			}
+			return resolved;
+		});
+	}
+	/** Writes a concealed backend value, verifies it, then commits only the exact immutable owner/generation reference. */
+	async storeGeneration(options) {
+		const { owner, purpose, material, expectedPriorGeneration, overlapExpiresAt, retirePrevious = false, requireEmpty = false } = options;
+		assertPurpose(owner, purpose);
+		if (typeof material !== "string" || material.length === 0) throw new EventSecretError("EVENT_SECRET_REFERENCE", "event secret generation material is non-empty");
+		if (!Number.isSafeInteger(owner.version) || owner.version < 1 || !/^[a-f0-9]{64}$/.test(owner.digest) || expectedPriorGeneration !== null && (!Number.isSafeInteger(expectedPriorGeneration) || expectedPriorGeneration < 1)) throw new EventSecretError("EVENT_SECRET_REFERENCE", "event secret generation has an exact immutable owner");
+		return this.withLock(async () => {
+			this.assertSelectedBackend();
+			if (requireEmpty) {
+				if (this.#database.prepare(`SELECT 1 AS present FROM event_secret_generations
+             WHERE owner_kind = ? AND owner_id = ? AND owner_version = ? AND purpose = ? LIMIT 1`).get(owner.kind, owner.id, owner.version, purpose) !== void 0) throw new EventSecretError("EVENT_SECRET_OWNER_STALE", "the exact immutable secret slot is not empty");
+			}
+			if ((this.currentGeneration(owner, purpose)?.generation ?? null) !== expectedPriorGeneration) throw new EventSecretError("EVENT_SECRET_OWNER_STALE", "the expected prior secret generation is no longer current");
+			const generation = (this.#database.prepare(`SELECT MAX(generation) AS maximum FROM event_secret_generations
+           WHERE owner_kind = ? AND owner_id = ? AND owner_version = ? AND purpose = ?`).get(owner.kind, owner.id, owner.version, purpose)?.maximum ?? 0) + 1;
+			const ref = `event-secret:${randomBytes(12).toString("hex")}`;
+			const materialDigest = sha256Hex(material);
+			await this.#store.set(ref, material);
+			try {
+				if (await readBackend(this.#store, ref) !== material) throw new EventSecretError("EVENT_SECRET_REFERENCE", "event secret generation did not read back from the selected backend");
+				const encryptedRef = await options.cipher.encrypt(generationLocation(owner, purpose, generation), Buffer.from(ref, "utf8"));
+				this.#database.exec("BEGIN IMMEDIATE");
+				try {
+					this.assertSelectedBackend();
+					this.assertLiveOwner(owner);
+					if (requireEmpty) {
+						if (this.#database.prepare(`SELECT 1 AS present FROM event_secret_generations
+                 WHERE owner_kind = ? AND owner_id = ? AND owner_version = ? AND purpose = ? LIMIT 1`).get(owner.kind, owner.id, owner.version, purpose) !== void 0) throw new EventSecretError("EVENT_SECRET_OWNER_STALE", "the exact immutable secret slot changed while writing");
+					}
+					const current = this.currentGeneration(owner, purpose);
+					if ((current?.generation ?? null) !== expectedPriorGeneration || current !== null && current.owner.digest !== owner.digest) throw new EventSecretError("EVENT_SECRET_OWNER_STALE", "the expected prior secret generation changed while writing");
+					const now = Date.now();
+					if (current !== null) {
+						if (retirePrevious) this.#database.prepare(`UPDATE event_secret_generations SET lifecycle = 'retired', expires_at = ?
+                   WHERE owner_kind = ? AND owner_id = ? AND owner_version = ? AND purpose = ? AND generation = ?
+                     AND lifecycle = 'current'`).run(now, owner.kind, owner.id, owner.version, purpose, current.generation);
+						else {
+							const overlap = overlapExpiresAt ?? now + 3e5;
+							if (!Number.isSafeInteger(overlap) || overlap <= now || overlap > now + 3e5) throw new EventSecretError("EVENT_SECRET_REFERENCE", "a rotating event secret generation has an overlap expiry within five minutes");
+							if ((this.#database.prepare(`SELECT COUNT(*) AS count FROM event_secret_generations
+                   WHERE owner_kind = ? AND owner_id = ? AND owner_version = ? AND purpose = ? AND lifecycle = 'overlap'`).get(owner.kind, owner.id, owner.version, purpose)?.count ?? 0) !== 0) throw new EventSecretError("EVENT_SECRET_REFERENCE", "an event secret slot already has its bounded overlap generation");
+							this.#database.prepare(`UPDATE event_secret_generations SET lifecycle = 'overlap', expires_at = ?
+                   WHERE owner_kind = ? AND owner_id = ? AND owner_version = ? AND purpose = ? AND generation = ?
+                     AND lifecycle = 'current'`).run(overlap, owner.kind, owner.id, owner.version, purpose, current.generation);
+						}
+					}
+					this.#database.prepare(`INSERT INTO event_secret_generations
+               (owner_kind, owner_id, owner_version, purpose, generation, owner_digest, secret_digest, encrypted_ref, lifecycle, expires_at, created_at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'current', NULL, ?)`).run(owner.kind, owner.id, owner.version, purpose, generation, owner.digest, materialDigest, encryptedRef, now);
+					this.#database.exec("COMMIT");
+				} catch (error) {
+					this.#database.exec("ROLLBACK");
+					throw error;
+				}
+			} catch (error) {
+				await this.#store.delete(ref).catch(() => false);
+				throw error;
+			}
+			return {
+				owner,
+				purpose,
+				generation,
+				lifecycle: "current",
+				expiresAt: null,
+				secretDigest: materialDigest
+			};
+		});
+	}
+	/**
+	* The only factory that can turn hidden URL bytes into a new immutable target
+	* version.  It writes and verifies physical material before one compensated
+	* SQLite commit; an existing version is never an update target.
+	*/
+	async createSecretUrlTargetVersion(options) {
+		if (options.document.url.kind !== "secret") throw new EventSecretError("EVENT_SECRET_REFERENCE", "a new secret URL target needs a secret URL descriptor");
+		const canonical = canonicalSecretWebhookUrl(options.completeUrl);
+		if (canonical.descriptor.scheme !== options.document.url.scheme || canonical.descriptor.host !== options.document.url.host || canonical.descriptor.port !== options.document.url.port || canonical.descriptor.sha256 !== options.document.url.sha256) throw new EventSecretError("EVENT_SECRET_REFERENCE", "the hidden URL does not match the new immutable descriptor");
+		const document = canonicalJson(options.document);
+		const owner = {
+			kind: "target",
+			id: options.document.targetId,
+			version: options.document.version,
+			digest: sha256Hex(document)
+		};
+		return this.withLock(async () => {
+			this.assertSelectedBackend();
+			if (this.#database.prepare("SELECT 1 AS present FROM target_versions WHERE target_id = ? AND version = ?").get(owner.id, owner.version) !== void 0) throw new EventSecretError("EVENT_SECRET_OWNER_STALE", "the requested new target version already exists");
+			const ref = `event-secret:${randomBytes(12).toString("hex")}`;
+			await this.#store.set(ref, canonical.value);
+			try {
+				if (await readBackend(this.#store, ref) !== canonical.value) throw new EventSecretError("EVENT_SECRET_REFERENCE", "the new target URL did not read back from the selected backend");
+				const encryptedRef = await options.cipher.encrypt(generationLocation(owner, "secret-url", 1), Buffer.from(ref, "utf8"));
+				this.#database.exec("BEGIN IMMEDIATE");
+				try {
+					this.assertSelectedBackend();
+					if (this.#database.prepare("SELECT 1 AS present FROM target_versions WHERE target_id = ? AND version = ?").get(owner.id, owner.version) !== void 0) throw new EventSecretError("EVENT_SECRET_OWNER_STALE", "the requested new target version already exists");
+					this.#database.prepare("INSERT INTO target_versions (id, target_id, version, document, digest) VALUES (?, ?, ?, ?, ?)").run(`${owner.id}@${owner.version}`, owner.id, owner.version, document, owner.digest);
+					this.#database.prepare(`INSERT INTO event_secret_generations
+               (owner_kind, owner_id, owner_version, purpose, generation, owner_digest, secret_digest, encrypted_ref, lifecycle, expires_at, created_at)
+               VALUES ('target', ?, ?, 'secret-url', 1, ?, ?, ?, 'current', NULL, ?)`).run(owner.id, owner.version, owner.digest, sha256Hex(canonical.value), encryptedRef, Date.now());
+					this.#database.exec("COMMIT");
+				} catch (error) {
+					this.#database.exec("ROLLBACK");
+					throw error;
+				}
+			} catch (error) {
+				await this.#store.delete(ref).catch(() => false);
+				throw error;
+			}
+			return {
+				owner,
+				purpose: "secret-url",
+				generation: 1,
+				lifecycle: "current",
+				expiresAt: null,
+				secretDigest: sha256Hex(canonical.value)
+			};
+		});
+	}
+	/** Reconciles only proven-retired opaque references after their database rows are no longer reachable. */
+	async reconcileRetiredGenerations(cipher, now = Date.now()) {
+		return this.withLock(async () => {
+			this.assertSelectedBackend();
+			this.#database.prepare("UPDATE event_secret_generations SET lifecycle = 'retired' WHERE lifecycle = 'overlap' AND expires_at <= ?").run(now);
+			const rows = this.#database.prepare(`SELECT owner_kind, owner_id, owner_version, purpose, generation, owner_digest, secret_digest,
+                  encrypted_ref, lifecycle, expires_at
+           FROM event_secret_generations WHERE lifecycle = 'retired'`).all();
+			const stale = await Promise.all(rows.map(async (row) => {
+				const generation = asStoredGeneration(row);
+				const value = (await cipher.decrypt(generationLocation(generation.owner, generation.purpose, generation.generation), generation.encryptedRef)).toString("utf8");
+				if (!/^event-secret:[a-f0-9]{24}$/.test(value)) throw new EventSecretError("EVENT_SECRET_REFERENCE", "event secret generation has an invalid opaque reference");
+				return {
+					generation,
+					ref: value
+				};
+			}));
+			const liveReferences = new Set(await referencesFor(this.#database, cipher));
+			this.#database.exec("BEGIN IMMEDIATE");
+			try {
+				this.assertSelectedBackend();
+				for (const entry of stale) this.#database.prepare(`DELETE FROM event_secret_generations
+               WHERE owner_kind = ? AND owner_id = ? AND owner_version = ? AND purpose = ? AND generation = ?
+                 AND lifecycle = 'retired'`).run(entry.generation.owner.kind, entry.generation.owner.id, entry.generation.owner.version, entry.generation.purpose, entry.generation.generation);
+				this.#database.exec("COMMIT");
+			} catch (error) {
+				this.#database.exec("ROLLBACK");
+				throw error;
+			}
+			const leftovers = [];
+			for (const entry of stale) {
+				if (liveReferences.has(entry.ref)) continue;
+				try {
+					if (!await this.#store.delete(entry.ref)) leftovers.push(entry.ref);
+				} catch {
+					leftovers.push(entry.ref);
+				}
+			}
+			return leftovers;
+		});
+	}
+	async probeInitialBackend() {
+		const ref = `event-master-probe:${randomBytes(12).toString("hex")}`;
+		const value = randomBytes(32).toString("base64");
+		await this.#store.set(ref, value);
+		try {
+			if (await readBackend(this.#store, ref) !== value) throw new EventSecretError("EVENT_SECRET_SELECTOR", "event keychain probe did not read back its value");
+		} finally {
+			await this.#store.delete(ref).catch(() => void 0);
+		}
+	}
+	async createMaster(retire) {
+		const keyId = `evt_${randomBytes(12).toString("hex")}`;
+		const ref = `event-master:${keyId}`;
+		const key = randomBytes(32);
+		const encoded = key.toString("base64");
+		await this.#store.set(ref, encoded);
+		try {
+			if (await readBackend(this.#store, ref) !== encoded) throw new EventSecretError("EVENT_SECRET_SELECTOR", "event master did not read back from its selected backend");
+			this.#database.exec("BEGIN IMMEDIATE");
+			try {
+				const now = Date.now();
+				this.#database.prepare("INSERT INTO event_secret_masters (key_id, secret_ref, created_at) VALUES (?, ?, ?)").run(keyId, ref, now);
+				if (retire !== void 0) this.#database.prepare("UPDATE event_secret_masters SET retired_at = ? WHERE key_id = ?").run(now, retire);
+				if (this.#selectorWasAbsent) setSelector(this.#database, this.#kind);
+				this.#database.exec("COMMIT");
+			} catch (error) {
+				this.#database.exec("ROLLBACK");
+				throw error;
+			}
+		} catch (error) {
+			await this.#store.delete(ref).catch(() => void 0);
+			throw error;
+		}
+		return {
+			keyId,
+			key
+		};
+	}
+	currentGeneration(owner, purpose) {
+		const row = this.#database.prepare(`SELECT owner_kind, owner_id, owner_version, purpose, generation, owner_digest, secret_digest,
+                encrypted_ref, lifecycle, expires_at
+         FROM event_secret_generations
+         WHERE owner_kind = ? AND owner_id = ? AND owner_version = ? AND purpose = ? AND lifecycle = 'current'`).get(owner.kind, owner.id, owner.version, purpose);
+		if (row === void 0) return null;
+		const generation = asStoredGeneration(row);
+		return {
+			owner: generation.owner,
+			purpose: generation.purpose,
+			generation: generation.generation,
+			lifecycle: generation.lifecycle,
+			expiresAt: generation.expiresAt,
+			secretDigest: generation.secretDigest
+		};
+	}
+	assertLiveOwner(owner) {
+		const table = owner.kind === "target" ? "target_versions" : owner.kind === "subscriber" ? "subscriber_versions" : "judge_versions";
+		const idColumn = owner.kind === "target" ? "target_id" : owner.kind === "subscriber" ? "subscriber_id" : "judge_id";
+		const row = this.#database.prepare(`SELECT digest, revoked_at FROM ${table} WHERE ${idColumn} = ? AND version = ?`).get(owner.id, owner.version);
+		if (row === void 0 || row.revoked_at !== null || row.digest !== owner.digest) throw new EventSecretError("EVENT_SECRET_OWNER_STALE", "the exact secret owner version is no longer live");
+	}
+	/** A queued stale store may never write/delete after migration selected the other independent backend. */
+	assertSelectedBackend() {
+		const selected = selectedKind(this.#database);
+		if (selected !== null && selected !== this.#kind) throw new EventSecretError("EVENT_SECRET_SELECTOR", "event secret backend changed; reopen the selected backend");
+	}
+	async withLock(work) {
+		return withEventSecretsLock(this.#paths, work);
+	}
+};
+/**
+* Reads what the backend holds now. Core's keychain store answers `get` from a cache its own `set` fills, so a read-back
+* or a migration check through it would otherwise see what this process last wrote rather than the keychain item, which
+* another process, or a keychain reset, may have changed since.
+*/
+async function readBackend(store, ref) {
+	store.invalidate(ref);
+	return store.get(ref);
+}
+/** Opens only the backend selected by SQLite; an unselected installation tries keychain and never falls back. */
+async function openEventSecretStore(options) {
+	const recorded = selectedKind(options.database);
+	const kind = recorded ?? "keychain";
+	return new EventSecretStore(options.database, options.paths, kind, await storeFor(options, kind), recorded === null, (requested) => storeFor(options, requested));
+}
+/**
+* Moves every reference the event database names, under the events-only lock. No core selector, lock or reference
+* discovery participates. Before the selector changes, every copy is verified and any attempted target value is
+* removed again on failure; after it changes, failed source cleanup is returned as a retryable leftover.
+*/
+async function migrateEventSecrets(options) {
+	if (options.from === options.to) return {
+		moved: 0,
+		leftovers: []
+	};
+	if (options.source === options.target || options.source.kind !== options.from || options.target.kind !== options.to) throw new EventSecretError("EVENT_SECRET_SELECTOR", "event secret migration stores do not match its backends");
+	return withEventSecretsLock(options.paths, async () => {
+		const selected = selectedKind(options.database);
+		if (selected === options.to) {
+			const references = await referencesForSelectedTarget(options.database, options.target);
+			const snapshot = referenceSnapshot(options.database);
+			const present = [];
+			for (const ref of references) {
+				const selectedValue = await readBackend(options.target, ref);
+				if (selectedValue === null) throw new EventSecretError("EVENT_MASTER_LOST", "a selected event secret is unavailable; old migration leftovers are retained");
+				const leftover = await readBackend(options.source, ref);
+				if (leftover !== null && leftover !== selectedValue) throw new EventSecretError("EVENT_SECRET_SELECTOR", "a selected event secret no longer matches its migration source; old migration leftovers are retained");
+				if (leftover !== null) present.push(ref);
+			}
+			options.database.exec("BEGIN IMMEDIATE");
+			try {
+				if (referenceSnapshot(options.database) !== snapshot || selectedKind(options.database) !== options.to) throw new EventSecretError("EVENT_SECRET_SELECTOR", "event secret references changed before leftover cleanup");
+				options.database.exec("COMMIT");
+			} catch (error) {
+				options.database.exec("ROLLBACK");
+				throw error;
+			}
+			const leftovers = [];
+			for (const ref of present) try {
+				if (!await options.source.delete(ref)) leftovers.push(ref);
+			} catch {
+				leftovers.push(ref);
+			}
+			return {
+				moved: 0,
+				leftovers
+			};
+		}
+		if (selected !== options.from) throw new EventSecretError("EVENT_SECRET_SELECTOR", "event secret migration source is not the selected backend");
+		const references = await referencesFor(options.database, options.referenceCipher);
+		const snapshot = referenceSnapshot(options.database);
+		const copied = [];
+		try {
+			for (const ref of references) {
+				const value = await readBackend(options.source, ref);
+				if (value === null) throw new EventSecretError("EVENT_MASTER_LOST", "a referenced event secret is unavailable");
+				copied.push({
+					ref,
+					value
+				});
+				await options.target.set(ref, value);
+				if (await readBackend(options.target, ref) !== value) throw new EventSecretError("EVENT_SECRET_SELECTOR", `event secret ${ref} did not verify in the destination backend`);
+			}
+			options.database.exec("BEGIN IMMEDIATE");
+			try {
+				if (referenceSnapshot(options.database) !== snapshot) throw new EventSecretError("EVENT_SECRET_SELECTOR", "event secret references changed during migration");
+				if (selectedKind(options.database) !== options.from) throw new EventSecretError("EVENT_SECRET_SELECTOR", "event secret selector changed during migration");
+				setSelector(options.database, options.to);
+				options.database.exec("COMMIT");
+			} catch (error) {
+				options.database.exec("ROLLBACK");
+				throw error;
+			}
+		} catch (error) {
+			await Promise.all(copied.map(({ ref }) => options.target.delete(ref).catch(() => false)));
+			throw error;
+		}
+		if (!await copiedTargetValuesMatch(options.target, copied)) return {
+			moved: references.length,
+			leftovers: references,
+			code: "SELECTED_COPY_CHANGED_AFTER_MIGRATION"
+		};
+		const leftovers = [];
+		for (const ref of references) try {
+			if (!await options.source.delete(ref)) leftovers.push(ref);
+		} catch {
+			leftovers.push(ref);
+		}
+		return {
+			moved: references.length,
+			leftovers
+		};
+	});
+}
+/** A post-selector cleanup may delete a source only if its selected counterpart still has the verified exact bytes. */
+async function copiedTargetValuesMatch(target, copied) {
+	try {
+		for (const { ref, value } of copied) if (await readBackend(target, ref) !== value) return false;
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Resolves opaque generation references from the selected migration target without retaining an old-store handle. */
+async function referencesForSelectedTarget(database, target) {
+	const masters = database.prepare("SELECT key_id, secret_ref FROM event_secret_masters ORDER BY key_id").all();
+	const masterByKey = /* @__PURE__ */ new Map();
+	for (const master of masters) {
+		const encoded = await readBackend(target, master.secret_ref);
+		if (encoded === null) throw new EventSecretError("EVENT_MASTER_LOST", "a selected event master is unavailable during leftover cleanup");
+		const key = Buffer.from(encoded, "base64");
+		if (key.length !== 32) throw new EventSecretError("EVENT_MASTER_LOST", "a selected event master is malformed during leftover cleanup");
+		masterByKey.set(master.key_id, key);
+	}
+	const rows = database.prepare(`SELECT owner_kind, owner_id, owner_version, purpose, generation, owner_digest, secret_digest,
+              encrypted_ref, lifecycle, expires_at
+       FROM event_secret_generations
+       ORDER BY owner_kind, owner_id, owner_version, purpose, generation`).all();
+	const references = masters.map((master) => master.secret_ref);
+	for (const row of rows) {
+		const generation = asStoredGeneration(row);
+		const keyId = packedRecordKeyId(generation.encryptedRef);
+		const master = masterByKey.get(keyId);
+		if (master === void 0) throw new EventSecretError("EVENT_MASTER_LOST", "an event secret reference names an unavailable selected master");
+		let reference;
+		try {
+			reference = decryptPackedRecord({
+				record: generation.encryptedRef,
+				keyForId: (selectedKeyId) => selectedKeyId === keyId ? deriveTableKey(master, "event_secret_generations") : null,
+				aad: encodeAad("event_secret_generations", "encryptedReference", generationLocation(generation.owner, generation.purpose, generation.generation).key)
+			});
+		} catch {
+			throw new EventSecretError("EVENT_SECRET_REFERENCE", "an event secret reference is unreadable during leftover cleanup");
+		}
+		const value = reference.toString("utf8");
+		if (!/^event-secret:[a-f0-9]{24}$/.test(value)) throw new EventSecretError("EVENT_SECRET_REFERENCE", "an event secret reference is not an opaque event reference");
+		references.push(value);
+	}
+	return [...new Set(references)].sort();
+}
+//#endregion
+//#region src/runtime/writer-quiescer.ts
+const leaseContext = new AsyncLocalStorage();
+/**
+* Stops new encrypted-state writers while a rare owner-wide rekey drains the
+* writers already between their cipher work and durable commit.  It is purely
+* in-memory: a failed operation never leaves persistent pause state behind.
+*/
+var WriterQuiescer = class {
+	#shared = 0;
+	#exclusive = false;
+	#exclusiveWaiting = 0;
+	#waiters = [];
+	async withShared(work) {
+		if (leaseContext.getStore()?.quiescer === this) return work();
+		await this.acquireShared();
+		try {
+			return await leaseContext.run({
+				quiescer: this,
+				kind: "shared"
+			}, work);
+		} finally {
+			this.#shared -= 1;
+			this.wake();
+		}
+	}
+	async withExclusive(work) {
+		const held = leaseContext.getStore();
+		if (held?.quiescer === this && held.kind === "exclusive") return work();
+		if (held?.quiescer === this) throw new Error("an event writer cannot upgrade its shared lease to an exclusive lease");
+		this.#exclusiveWaiting += 1;
+		try {
+			await this.waitFor(() => !this.#exclusive && this.#shared === 0);
+			this.#exclusive = true;
+			return await leaseContext.run({
+				quiescer: this,
+				kind: "exclusive"
+			}, work);
+		} finally {
+			if (this.#exclusive) this.#exclusive = false;
+			this.#exclusiveWaiting -= 1;
+			this.wake();
+		}
+	}
+	/** Fails closed when a destructive key operation escaped the owner-wide rekey lease. */
+	assertExclusive() {
+		const held = leaseContext.getStore();
+		if (held?.quiescer !== this || held.kind !== "exclusive") throw new Error("the event writer quiescer exclusive lease is required");
+	}
+	async acquireShared() {
+		await this.waitFor(() => !this.#exclusive && this.#exclusiveWaiting === 0);
+		this.#shared += 1;
+	}
+	async waitFor(predicate) {
+		while (!predicate()) await new Promise((resolve) => this.#waiters.push(resolve));
+	}
+	wake() {
+		const waiters = this.#waiters.splice(0);
+		for (const wake of waiters) wake();
+	}
+};
+/** Required shared lease wrapper for every B3 writer-inventory entrypoint. */
+async function withEventWriterLease(quiescer, work) {
+	return quiescer.withShared(work);
+}
+//#endregion
+//#region src/store/records.ts
+const MAX_INVOCATIONS_PER_TABLE_KEY = 4294967295;
+var RecordStorageError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "RecordStorageError";
+		this.code = code;
+	}
+};
+/** Maps ciphertext/key failures to the reset path; callers must never substitute plaintext for these records. */
+function unreadableRecordReason(error) {
+	if (error instanceof EventSecretError) {
+		if (error.code === "EVENT_MASTER_LOST") return "master-lost";
+		if (error.code === "EVENT_MASTER_UNKNOWN") return "unknown-key";
+	}
+	if (error instanceof PackedRecordError) {
+		if (error.code === "AUTHENTICATION_FAILED") return "authentication-failed";
+		if (error.code === "UNKNOWN_KEY") return "unknown-key";
+	}
+	return null;
+}
+/** Each encrypted column, with its table's primary key in the order the v1 migration declares it — the AAD order. */
+const RECORD_LAYOUTS = [
+	{
+		table: "source_scan_state",
+		column: "encryptedRecord",
+		sqlColumn: "encrypted_record",
+		keyColumns: ["id"]
+	},
+	{
+		table: "rule_activation_points",
+		column: "encryptedPosition",
+		sqlColumn: "encrypted_position",
+		keyColumns: [
+			"activation_id",
+			"rule_id",
+			"rule_version",
+			"account_id",
+			"position_scope"
+		]
+	},
+	{
+		table: "activation_baselines",
+		column: "encryptedPosition",
+		sqlColumn: "encrypted_position",
+		keyColumns: [
+			"intent_id",
+			"source",
+			"account_id",
+			"position_scope"
+		]
+	},
+	{
+		table: "ingest_rules",
+		column: "encryptedProjection",
+		sqlColumn: "encrypted_projection",
+		keyColumns: [
+			"event_id",
+			"rule_id",
+			"rule_version"
+		]
+	},
+	{
+		table: "decisions",
+		column: "encryptedRecord",
+		sqlColumn: "encrypted_record",
+		keyColumns: ["id"]
+	},
+	{
+		table: "deliveries",
+		column: "encryptedRecord",
+		sqlColumn: "encrypted_record",
+		keyColumns: ["id"]
+	},
+	{
+		table: "dryrun_log",
+		column: "encryptedRecord",
+		sqlColumn: "encrypted_record",
+		keyColumns: ["delivery_id"]
+	},
+	{
+		table: "stream_log",
+		column: "encryptedRecord",
+		sqlColumn: "encrypted_record",
+		keyColumns: ["id"]
+	},
+	{
+		table: "event_secret_generations",
+		column: "encryptedReference",
+		sqlColumn: "encrypted_ref",
+		keyColumns: [
+			"owner_kind",
+			"owner_id",
+			"owner_version",
+			"purpose",
+			"generation"
+		]
+	},
+	{
+		table: "system_reset_outbox",
+		column: "encryptedRecord",
+		sqlColumn: "encrypted_record",
+		keyColumns: ["id"]
+	}
+];
+/** Encrypts and decrypts B1 table records while reserving the D8 nonce-invocation budget in SQLite. */
+/** A rotation pass that still meets an older key this many times is refused, never looped. */
+const MAX_ROTATION_PASSES = 32;
+var EventRecordCipher = class {
+	#database;
+	#secrets;
+	#quiescer;
+	#tableKeys = /* @__PURE__ */ new Map();
+	constructor(database, secrets, quiescer) {
+		this.#database = database;
+		this.#secrets = secrets;
+		this.#quiescer = quiescer;
+	}
+	/** The B3 secret service must share this exact owner-wide lease, never a look-alike lock. */
+	get writerQuiescer() {
+		return this.#quiescer;
+	}
+	async encrypt(location, plaintext) {
+		return withEventWriterLease(this.#quiescer, () => this.encryptHeld(location, plaintext));
+	}
+	async encryptHeld(location, plaintext) {
+		const master = await this.#secrets.currentMaster();
+		this.reserveInvocation(master.keyId, location.table);
+		return encryptPackedRecord({
+			keyId: master.keyId,
+			key: this.tableKey(master.keyId, master.key, location.table),
+			aad: encodeAad(location.table, location.column, location.key),
+			plaintext
+		});
+	}
+	async decrypt(location, stored) {
+		return withEventWriterLease(this.#quiescer, () => this.decryptHeld(location, stored));
+	}
+	async decryptHeld(location, stored) {
+		if (!(stored instanceof Uint8Array)) throw new RecordStorageError("RECORD_STORAGE_CLASS", "encrypted event records must be SQLite BLOB values");
+		const record = Buffer.from(stored);
+		try {
+			const keyId = packedRecordKeyId(record);
+			const master = await this.#secrets.master(keyId);
+			return decryptPackedRecord({
+				record,
+				keyForId: (selected) => selected === keyId ? this.tableKey(keyId, master, location.table) : null,
+				aad: encodeAad(location.table, location.column, location.key)
+			});
+		} catch (error) {
+			const reason = unreadableRecordReason(error);
+			if (reason === null) throw error;
+			throw new RecordStorageError("RECORD_UNREADABLE_RESET_REQUIRED", `encrypted event record is unreadable (${reason}); installation reset is required`);
+		}
+	}
+	/**
+	* Re-encrypts every B1 packed column in small SQLite write batches under a newly generated master.
+	*
+	* Precondition, owed by its caller: no writer may hold ciphertext between `encrypt()` and its own write across the
+	* rotation. A record a worker encrypted under the old master before `rotateMaster()` and wrote after the last pass
+	* would stay under the retired key (still readable: retired masters are kept). B1 exposes no caller; the B3 operation
+	* that does must stop the owner's writers and await their in-flight work first, and destroying a retired master must
+	* refuse while any record still names it (plan, "PR #59 review (Blocks)" row).
+	*/
+	async rotateAndReencrypt(options = {}) {
+		return this.#quiescer.withExclusive(() => this.rotateAndReencryptHeld(options));
+	}
+	async rotateAndReencryptHeld(options = {}) {
+		const batchSize = options.batchSize ?? 100;
+		if (!Number.isSafeInteger(batchSize) || batchSize < 1) throw new RecordStorageError("NONCE_LIMIT", "rotation batch size must be positive");
+		const master = await this.#secrets.rotateMaster();
+		let rewritten = 0;
+		for (const layout of RECORD_LAYOUTS) rewritten += await this.reencryptLayout(layout, master, batchSize);
+		return {
+			keyId: master.keyId,
+			rewritten
+		};
+	}
+	reserveInvocation(keyId, table) {
+		this.#database.exec("BEGIN IMMEDIATE");
+		try {
+			if ((this.#database.prepare("SELECT invocations FROM nonce_counters WHERE key_id = ? AND table_name = ?").get(keyId, table)?.invocations ?? 0) >= MAX_INVOCATIONS_PER_TABLE_KEY) throw new RecordStorageError("NONCE_LIMIT", "the event table key reached its nonce limit; rotate the master key before encrypting again");
+			this.#database.prepare(`INSERT INTO nonce_counters (key_id, table_name, invocations) VALUES (?, ?, 1)
+           ON CONFLICT(key_id, table_name) DO UPDATE SET invocations = nonce_counters.invocations + 1`).run(keyId, table);
+			this.#database.exec("COMMIT");
+		} catch (error) {
+			this.#database.exec("ROLLBACK");
+			throw error;
+		}
+	}
+	tableKey(keyId, master, table) {
+		const cacheKey = `${keyId}\u0000${table}`;
+		const cached = this.#tableKeys.get(cacheKey);
+		if (cached !== void 0) return cached;
+		const derived = deriveTableKey(master, table);
+		this.#tableKeys.set(cacheKey, derived);
+		return derived;
+	}
+	async reencryptLayout(layout, master, batchSize) {
+		let rewritten = 0;
+		const selectedColumns = [...layout.keyColumns, layout.sqlColumn].join(", ");
+		const orderedColumns = layout.keyColumns.join(", ");
+		const first = this.#database.prepare(`SELECT ${selectedColumns} FROM ${layout.table} WHERE ${layout.sqlColumn} IS NOT NULL ORDER BY ${orderedColumns} LIMIT ?`);
+		const next = this.#database.prepare(`SELECT ${selectedColumns} FROM ${layout.table}
+       WHERE ${layout.sqlColumn} IS NOT NULL AND (${orderedColumns}) > (${layout.keyColumns.map(() => "?").join(", ")})
+       ORDER BY ${orderedColumns} LIMIT ?`);
+		const where = layout.keyColumns.map((column) => `${column} = ?`).join(" AND ");
+		const update = this.#database.prepare(`UPDATE ${layout.table} SET ${layout.sqlColumn} = ? WHERE ${where} AND ${layout.sqlColumn} = ?`);
+		for (let pass = 0;; pass += 1) {
+			if (pass === MAX_ROTATION_PASSES) throw new RecordStorageError("ROTATION_INCOMPLETE", `${layout.table}.${layout.sqlColumn} still held a record under an older key after ${MAX_ROTATION_PASSES} passes`);
+			let sawOlder = false;
+			let last;
+			for (;;) {
+				const rows = last === void 0 ? first.all(batchSize) : next.all(...last, batchSize);
+				if (rows.length === 0) break;
+				last = this.keyValues(layout, rows[rows.length - 1]);
+				const updates = [];
+				for (const row of rows) {
+					const stored = row[layout.sqlColumn];
+					if (!(stored instanceof Uint8Array)) throw new RecordStorageError("RECORD_STORAGE_CLASS", `${layout.table}.${layout.sqlColumn} is not a BLOB`);
+					if (packedRecordKeyId(stored) === master.keyId) continue;
+					sawOlder = true;
+					const location = this.locationFor(layout, row);
+					const plaintext = await this.decrypt(location, stored);
+					updates.push({
+						record: await this.encrypt(location, plaintext),
+						read: stored,
+						keys: this.keyValues(layout, row)
+					});
+				}
+				if (updates.length === 0) continue;
+				this.#database.exec("BEGIN IMMEDIATE");
+				try {
+					for (const item of updates) if (Number(update.run(item.record, ...item.keys, item.read).changes) === 1) rewritten += 1;
+					this.#database.exec("COMMIT");
+				} catch (error) {
+					this.#database.exec("ROLLBACK");
+					throw error;
+				}
+			}
+			if (!sawOlder) return rewritten;
+		}
+	}
+	locationFor(layout, row) {
+		return {
+			table: layout.table,
+			column: layout.column,
+			key: layout.keyColumns.map((column) => this.component(row[column], `${layout.table}.${column}`))
+		};
+	}
+	keyValues(layout, row) {
+		return layout.keyColumns.map((column) => this.sqlValue(row[column], `${layout.table}.${column}`));
+	}
+	component(value, name) {
+		if (typeof value === "string") return {
+			type: "text",
+			value
+		};
+		if (typeof value === "number" || typeof value === "bigint") return {
+			type: "integer",
+			value
+		};
+		if (value instanceof Uint8Array) return {
+			type: "blob",
+			value
+		};
+		throw new RecordStorageError("RECORD_STORAGE_CLASS", `${name} is not a valid primary-key storage class`);
+	}
+	sqlValue(value, name) {
+		if (typeof value === "string" || typeof value === "number" || typeof value === "bigint" || value instanceof Uint8Array || value === null) return value;
+		throw new RecordStorageError("RECORD_STORAGE_CLASS", `${name} is not a SQLite value`);
+	}
+};
+//#endregion
+export { WriterQuiescer as a, openEventSecretStore as c, unreadableRecordReason as i, RECORD_LAYOUTS as n, withEventWriterLease as o, RecordStorageError as r, migrateEventSecrets as s, EventRecordCipher as t };