@forklaunch/core 2.1.1 → 3.0.0

package/lib/persistence/index.js

@@ -30,7 +30,13 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/persistence/index.ts
 var persistence_exports = {};
 __export(persistence_exports, {
+  Anon: () => Anon,
+  BLIND_INDEX_PREFIX: () => BLIND_INDEX_PREFIX,
   ComplianceLevel: () => ComplianceLevel,
+  CompliantField: () => CompliantField,
+  CompliantIndexType: () => CompliantIndexType,
+  CompliantQueryError: () => CompliantQueryError,
+  CompliantType: () => CompliantType,
   DecryptionError: () => DecryptionError,
   ENCRYPTED_PREFIXES: () => ENCRYPTED_PREFIXES2,
   ENCRYPTION_FORMAT_ENV: () => ENCRYPTION_FORMAT_ENV,
@@ -41,6 +47,7 @@ __export(persistence_exports, {
   FieldEncryptor: () => FieldEncryptor,
   LEGACY_ENCRYPTION_KEYS_ENV: () => LEGACY_ENCRYPTION_KEYS_ENV,
   LEGACY_ENCRYPTION_KEY_ENV: () => LEGACY_ENCRYPTION_KEY_ENV,
+  LegacyCiphertextError: () => LegacyCiphertextError,
   MissingEncryptionKeyError: () => MissingEncryptionKeyError,
   RetentionAction: () => RetentionAction,
   RetentionDuration: () => RetentionDuration,
@@ -53,6 +60,7 @@ __export(persistence_exports, {
   collectFallbackTenantIds: () => collectFallbackTenantIds,
   countValuesByKeyId: () => countValuesByKeyId,
   createTenantFilterDef: () => createTenantFilterDef,
+  deanon: () => deanon,
   defaultTenantIdsFor: () => defaultTenantIdsFor,
   defineComplianceEntity: () => defineComplianceEntity,
   encryptionKeyId: () => encryptionKeyId,
@@ -68,13 +76,17 @@ __export(persistence_exports, {
   getEntityRetention: () => getEntityRetention,
   getEntityUserIdField: () => getEntityUserIdField,
   getSuperAdminContext: () => getSuperAdminContext,
+  isAnon: () => isAnon,
+  isCompliantField: () => isCompliantField,
   isEncryptedCiphertext: () => isEncryptedCiphertext,
   isEncryptedValue: () => isEncryptedValue,
+  onComplianceAccess: () => onComplianceAccess,
   parseDuration: () => parseDuration,
   parseEncryptionKeyList: () => parseEncryptionKeyList,
   reencryptEncryptedColumns: () => reencryptEncryptedColumns,
   registerEncryptor: () => registerEncryptor,
   rotationTotals: () => rotationTotals,
+  sealedAnon: () => sealedAnon,
   setEncryptionTenantId: () => setEncryptionTenantId,
   setupRls: () => setupRls,
   setupTenantFilter: () => setupTenantFilter,
@@ -249,8 +261,8 @@ function asEncryptionSafe(em) {
   return em;
 }
 
-// src/persistence/compliancePropertyBuilder.ts
-var import_common = require("@forklaunch/common");
+// src/persistence/compliantField.ts
+var import_crypto2 = __toESM(require("crypto"));
 var import_core2 = require("@mikro-orm/core");
 
 // src/persistence/encryptedType.ts
@@ -265,6 +277,9 @@ var _tenantContext = new import_node_async_hooks.AsyncLocalStorage();
 function registerEncryptor(encryptor) {
   _encryptor = encryptor;
 }
+function getRegisteredEncryptor() {
+  return _encryptor;
+}
 var EmptyTenantError = class extends Error {
   constructor(api) {
     super(
@@ -420,252 +435,55 @@ var EncryptedType = class extends import_core.Type {
   // Serialization helpers
   // ---------------------------------------------------------------------------
   serialize(value) {
-    if (typeof value === "string") return value;
-    if (value instanceof Date) return value.toISOString();
-    if (typeof value === "bigint") return value.toString();
-    if (Buffer.isBuffer(value) || value instanceof Uint8Array)
-      return Buffer.from(value).toString("base64");
-    return JSON.stringify(value);
+    return serializeForEncryption(value);
   }
   deserialize(value) {
-    if (this._isArray) {
-      try {
-        const arr = JSON.parse(value);
-        if (!Array.isArray(arr)) return arr;
-        return arr.map(
-          (el) => hydrateValue(el, this._elementRuntimeType)
-        );
-      } catch {
-        return value;
-      }
-    }
-    switch (this._elementRuntimeType) {
-      case "string":
-        return value;
-      case "any":
-        try {
-          return JSON.parse(value);
-        } catch {
-          return value;
-        }
-      // Types serialized via toString/toISOString/base64 — hydrate from string directly
-      case "bigint":
-      case "Date":
-      case "Buffer":
-        return hydrateValue(value, this._elementRuntimeType);
-      // Types where JSON.parse recovers the native JS value (number, boolean)
-      default:
-        return hydrateValue(this.tryJsonParse(value), this._elementRuntimeType);
-    }
-  }
-  tryJsonParse(value) {
-    try {
-      return JSON.parse(value);
-    } catch {
-      return value;
-    }
+    return deserializeFromEncryption(
+      value,
+      this._elementRuntimeType,
+      this._isArray
+    );
   }
 };
-
-// src/persistence/compliancePropertyBuilder.ts
-function isBuilder(value) {
-  return value != null && typeof value === "object" && "~options" in value;
-}
-function wrapUnclassified(builder) {
-  return new Proxy(builder, {
-    get(target, prop) {
-      if (prop === "compliance") {
-        return (level) => wrapClassified(target, level);
-      }
-      if (prop === "~options") return Reflect.get(target, prop, target);
-      if (prop === COMPLIANCE_KEY) return void 0;
-      const value = Reflect.get(target, prop, target);
-      if (typeof value === "function") {
-        return (...args) => {
-          const result = value.apply(
-            target,
-            args
-          );
-          return isBuilder(result) ? wrapUnclassified(result) : result;
-        };
-      }
-      return value;
-    }
-  });
+function serializeForEncryption(value) {
+  if (typeof value === "string") return value;
+  if (value instanceof Date) return value.toISOString();
+  if (typeof value === "bigint") return value.toString();
+  if (Buffer.isBuffer(value) || value instanceof Uint8Array)
+    return Buffer.from(value).toString("base64");
+  return JSON.stringify(value);
 }
-var ENCRYPTED_LEVELS2 = /* @__PURE__ */ new Set([
-  "pii",
-  "phi",
-  "pci"
-]);
-function resolveEncryptedTypeArgs(options) {
-  const type = options.type;
-  const isArray = options.array === true;
-  const resolved = resolveTypeInstance(type);
-  if (resolved) {
-    const rt = resolved.runtimeType;
-    if (rt.endsWith("[]")) {
-      return { elementRuntimeType: rt.slice(0, -2) || "string", isArray: true };
-    }
-    return { elementRuntimeType: rt, isArray };
+function tryJsonParse(value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
   }
-  return { elementRuntimeType: "string", isArray };
 }
-function wrapClassified(builder, level) {
-  if (ENCRYPTED_LEVELS2.has(level)) {
-    const options = builder["~options"];
-    if (options) {
-      const { elementRuntimeType, isArray } = resolveEncryptedTypeArgs(options);
-      let enumValues;
-      if (options.items) {
-        enumValues = extractEnumValues(options.items);
-        delete options.items;
-        delete options.nativeEnumName;
-        delete options.enum;
-      }
-      options.type = new EncryptedType(elementRuntimeType, isArray, enumValues);
-      options.columnType = "text";
-      options.runtimeType = isArray ? "object" : elementRuntimeType;
-    }
-  }
-  return new Proxy(builder, {
-    get(target, prop) {
-      if (prop === COMPLIANCE_KEY) return level;
-      if (prop === "~options") return Reflect.get(target, prop, target);
-      const value = Reflect.get(target, prop, target);
-      if (typeof value === "function") {
-        return (...args) => {
-          const result = value.apply(
-            target,
-            args
-          );
-          return isBuilder(result) ? wrapClassified(result, level) : result;
-        };
-      }
+function deserializeFromEncryption(value, elementRuntimeType, isArray) {
+  if (isArray) {
+    try {
+      const arr = JSON.parse(value);
+      if (!Array.isArray(arr)) return arr;
+      return arr.map((el) => hydrateValue(el, elementRuntimeType));
+    } catch {
       return value;
     }
-  });
-}
-function wrapRelation(builder) {
-  return wrapClassified(builder, "none");
-}
-var RELATION_METHODS = /* @__PURE__ */ new Set([
-  "manyToOne",
-  "oneToMany",
-  "manyToMany",
-  "oneToOne",
-  "embedded"
-]);
-function isRelationMethod(prop) {
-  return typeof prop === "string" && RELATION_METHODS.has(prop);
-}
-function extractEnumValues(items) {
-  if (typeof items === "function") {
-    return extractEnumValues(items());
-  }
-  if (Array.isArray(items)) return items;
-  if (items != null && typeof items === "object") {
-    const obj = items;
-    const allValues = Object.values(obj);
-    return allValues.filter((v) => typeof v !== "string" || !(v in obj));
-  }
-  return [];
-}
-var EnumTextType = class extends import_core2.Type {
-  convertToDatabaseValue(value) {
-    return (0, import_common.safeStringify)(value);
-  }
-  convertToJSValue(value) {
-    return (0, import_common.safeParse)(value);
-  }
-  getColumnType() {
-    return "text";
-  }
-  get runtimeType() {
-    return "string";
-  }
-};
-function inferEnumType(items) {
-  const values = extractEnumValues(items);
-  if (values.length === 0) return "text";
-  const allStrings = values.every((v) => typeof v === "string");
-  if (allStrings) return "text";
-  const allNumbers = values.every((v) => typeof v === "number");
-  if (allNumbers) return "integer";
-  return new EnumTextType();
-}
-var fp = new Proxy(import_core2.p, {
-  get(target, prop) {
-    const value = Reflect.get(target, prop, target);
-    if (typeof value !== "function") return value;
-    if (isRelationMethod(prop)) {
-      return (...args) => {
-        const result = value.apply(
-          target,
-          args
-        );
-        return isBuilder(result) ? wrapRelation(result) : result;
-      };
-    }
-    return (...args) => {
-      const result = value.apply(
-        target,
-        args
-      );
-      if (isBuilder(result)) {
-        if (prop === "enum") {
-          const options = result["~options"];
-          if (options && !options.type) {
-            options.type = inferEnumType(options.items);
-          }
-        }
-        return wrapUnclassified(result);
-      }
-      return result;
-    };
-  }
-});
-
-// src/persistence/defineComplianceEntity.ts
-var import_core3 = require("@mikro-orm/core");
-function readComplianceLevel(builder) {
-  if (builder == null || typeof builder !== "object") return void 0;
-  return builder[COMPLIANCE_KEY];
-}
-function defineComplianceEntity(meta) {
-  const entityName = "name" in meta ? meta.name : "Unknown";
-  const complianceFields = /* @__PURE__ */ new Map();
-  const rawProperties = meta.properties;
-  const resolvedProperties = typeof rawProperties === "function" ? rawProperties(import_core3.p) : rawProperties;
-  for (const [fieldName, rawProp] of Object.entries(resolvedProperties)) {
-    if (typeof rawProp === "function") {
-      complianceFields.set(fieldName, "none");
-      continue;
-    }
-    const level = readComplianceLevel(rawProp);
-    if (level == null) {
-      throw new Error(
-        `Field '${entityName}.${fieldName}' is missing compliance classification. Call .compliance('pii' | 'phi' | 'pci' | 'none') on this property, or use a relation method (fp.manyToOne, etc.) which is auto-classified.`
-      );
-    }
-    complianceFields.set(fieldName, level);
-  }
-  registerEntityCompliance(entityName, complianceFields);
-  if (meta.retention) {
-    parseDuration(meta.retention.duration);
-    if (!resolvedProperties["createdAt"]) {
-      throw new Error(
-        `Entity '${entityName}' has a retention policy but no 'createdAt' property. Retention requires createdAt to compute expiration.`
-      );
-    }
-    registerEntityRetention(entityName, meta.retention);
   }
-  if (meta.userIdField) {
-    registerEntityUserIdField(entityName, meta.userIdField);
+  switch (elementRuntimeType) {
+    case "string":
+      return value;
+    case "any":
+      return tryJsonParse(value);
+    // Types serialized via toString/toISOString/base64 — hydrate from string directly
+    case "bigint":
+    case "Date":
+    case "Buffer":
+      return hydrateValue(value, elementRuntimeType);
+    // Types where JSON.parse recovers the native JS value (number, boolean)
+    default:
+      return hydrateValue(tryJsonParse(value), elementRuntimeType);
   }
-  return (0, import_core3.defineEntity)(
-    meta
-  );
 }
 
 // src/persistence/fieldEncryptor.ts
@@ -693,9 +511,17 @@ var IV_BYTES = 12;
 var KEY_BYTES = 32;
 var HKDF_HASH = "sha256";
 var HKDF_SALT = Buffer.alloc(0);
+var BLIND_INDEX_INFO = "forklaunch:blind-index\0";
 var KEY_ID_HEX_CHARS = 12;
 var DERIVED_KEY_CACHE_LIMIT = 4096;
-var ENCRYPTED_PREFIXES2 = ["v1:", "v2:", "v3:"];
+var ENCRYPTED_PREFIXES2 = ["v1:", "v2:", "v3:", "v4:"];
+var BLIND_INDEX_PREFIX = "bi1:";
+function sealedAnon(ciphertext) {
+  if (!ciphertext.startsWith("v4:")) return null;
+  const parts = ciphertext.split(":");
+  if (parts.length !== 6) return null;
+  return Buffer.from(parts[2], "base64url").toString("utf8");
+}
 function isEncryptedCiphertext(value) {
   return typeof value === "string" && ENCRYPTED_PREFIXES2.some((p3) => value.startsWith(p3));
 }
@@ -717,9 +543,12 @@ function encryptionKeyId(masterKey) {
   return import_crypto.default.createHash("sha256").update(masterKey).digest("hex").slice(0, KEY_ID_HEX_CHARS);
 }
 function stampedKeyId(ciphertext) {
-  if (!ciphertext.startsWith("v3:")) return null;
   const parts = ciphertext.split(":");
-  return parts.length === 5 ? parts[1] : null;
+  if (ciphertext.startsWith("v3:")) return parts.length === 5 ? parts[1] : null;
+  if (ciphertext.startsWith("v4:")) return parts.length === 6 ? parts[1] : null;
+  if (ciphertext.startsWith(BLIND_INDEX_PREFIX))
+    return parts.length === 3 ? parts[1] : null;
+  return null;
 }
 function stampedPrefix(keyId) {
   return `v3:${keyId}:`;
@@ -852,7 +681,8 @@ var FieldEncryptor = class _FieldEncryptor {
     const version = parts[0];
     let candidates;
     let body;
-    if (version === "v3" && parts.length === 5) {
+    let anon;
+    if (version === "v3" && parts.length === 5 || version === "v4" && parts.length === 6) {
       const key = this.byId.get(parts[1]);
       if (!key) {
         throw new DecryptionError(
@@ -860,7 +690,12 @@ var FieldEncryptor = class _FieldEncryptor {
         );
       }
       candidates = [key];
-      body = parts.slice(2);
+      if (version === "v4") {
+        anon = Buffer.from(parts[2], "base64url").toString("utf8");
+        body = parts.slice(3);
+      } else {
+        body = parts.slice(2);
+      }
     } else if ((version === "v1" || version === "v2") && parts.length === 4) {
       candidates = this.ring;
       body = parts.slice(1);
@@ -891,7 +726,8 @@ var FieldEncryptor = class _FieldEncryptor {
           keyId: key.id,
           current,
           version,
-          stale: !current || this.format === "v3" && version !== "v3"
+          anon,
+          stale: version === "v4" ? !current : !current || this.format === "v3" && version !== "v3"
         };
       } catch {
       }
@@ -917,22 +753,776 @@ var FieldEncryptor = class _FieldEncryptor {
     if (ciphertext === null || ciphertext === void 0) return null;
     const opened = this.open(ciphertext, tenantId);
     if (!opened.stale) return ciphertext;
+    if (opened.version === "v4") {
+      return this.seal(opened.plaintext, tenantId, opened.anon ?? "");
+    }
     return this.encrypt(opened.plaintext, tenantId);
   }
+  /**
+   * Encrypt for a compliant field: a fresh random IV every time (equal
+   * plaintexts produce unrelated ciphertexts), stamped with the current key,
+   * and carrying `anon` — the field's de-identified value — in clear so it
+   * can be read without decrypting.
+   *
+   * Equality lookups do not use the ciphertext; they use {@link blindIndex}.
+   *
+   * @returns `v4:{keyId}:{anon}:{iv}:{tag}:{data}`
+   */
+  seal(plaintext, tenantId, anon) {
+    const key = this.deriveKey(tenantId);
+    const iv = import_crypto.default.randomBytes(IV_BYTES);
+    const cipher = import_crypto.default.createCipheriv(ALGORITHM, key, iv);
+    const encrypted = Buffer.concat([
+      cipher.update(plaintext, "utf8"),
+      cipher.final()
+    ]);
+    return [
+      "v4",
+      this.ring[0].id,
+      Buffer.from(anon, "utf8").toString("base64url"),
+      iv.toString("base64"),
+      cipher.getAuthTag().toString("base64"),
+      encrypted.toString("base64")
+    ].join(":");
+  }
+  /**
+   * Keyed HMAC of a plaintext for equality lookups, under a key derived
+   * from the current master key and the tenant (separate from the
+   * encryption key). Deterministic per tenant and key, one-way, and never
+   * decryptable.
+   *
+   * After a master key rotation, rows still indexed under the previous key
+   * do not match until `reencryptEncryptedColumns` re-indexes them; see
+   * {@link blindIndexes} for a lookup that spans the ring.
+   *
+   * @returns `bi1:{keyId}:{hmac base64url}`
+   */
+  blindIndex(plaintext, tenantId) {
+    return this.blindIndexFor(this.ring[0], plaintext, tenantId);
+  }
+  /** {@link blindIndex} under every key in the ring, current first. */
+  blindIndexes(plaintext, tenantId) {
+    return this.ring.map((k) => this.blindIndexFor(k, plaintext, tenantId));
+  }
+  /** True when a blind index was computed under a previous key. */
+  isStaleBlindIndex(index) {
+    return stampedKeyId(index) !== this.ring[0].id;
+  }
+  blindIndexFor(key, plaintext, tenantId) {
+    const indexKey = this.deriveKeyFor(key, BLIND_INDEX_INFO + tenantId);
+    const mac = import_crypto.default.createHmac("sha256", indexKey).update(plaintext, "utf8").digest("base64url");
+    return `${BLIND_INDEX_PREFIX}${key.id}:${mac}`;
+  }
 };
 
-// src/persistence/complianceEventSubscriber.ts
-var ENCRYPTED_LEVELS3 = /* @__PURE__ */ new Set([
-  "pii",
-  "phi",
-  "pci"
+// src/persistence/compliantField.ts
+var LISTENERS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.listeners")] ??= /* @__PURE__ */ new Set();
+function onComplianceAccess(listener) {
+  LISTENERS.add(listener);
+  return () => LISTENERS.delete(listener);
+}
+var LegacyCiphertextError = class extends Error {
+  name = "LegacyCiphertextError";
+};
+var CompliantQueryError = class extends Error {
+  name = "CompliantQueryError";
+};
+var MINT = /* @__PURE__ */ Symbol.for("forklaunch.compliance.mint");
+var ANON_BRAND = /* @__PURE__ */ Symbol.for("forklaunch.compliance.anon");
+var Anon = class {
+  value;
+  /** @internal */
+  constructor(value, key) {
+    if (key !== MINT) {
+      throw new Error("Anon values can only be produced by a compliant field");
+    }
+    Object.defineProperty(this, ANON_BRAND, { value: true });
+    Object.defineProperty(this, "value", { value, enumerable: true });
+    Object.freeze(this);
+  }
+};
+function isAnon(value) {
+  return value != null && typeof value === "object" && value[ANON_BRAND] === true;
+}
+var RESTRICTED_ZIP3 = /* @__PURE__ */ new Set([
+  "036",
+  "059",
+  "063",
+  "102",
+  "203",
+  "556",
+  "692",
+  "790",
+  "821",
+  "823",
+  "830",
+  "831",
+  "878",
+  "879",
+  "884",
+  "890",
+  "893"
 ]);
-function wrapEmWithNativeQueryBlocking(em) {
-  const BLOCKED_METHODS = [
-    "nativeInsert",
-    "nativeUpdate",
-    "nativeDelete"
-  ];
+var REDACTED = "[redacted]";
+function computeAnon(strategy, value) {
+  switch (strategy) {
+    case "token":
+      return "tok_" + import_crypto2.default.randomBytes(9).toString("base64url");
+    case "year": {
+      if (value instanceof Date && !isNaN(value.getTime()))
+        return String(value.getUTCFullYear());
+      const match = /\d{4}/.exec(String(value));
+      return match ? match[0] : REDACTED;
+    }
+    case "zip3": {
+      const digits = String(value).replace(/\D/g, "").slice(0, 3);
+      if (digits.length < 3 || RESTRICTED_ZIP3.has(digits)) return "000";
+      return digits;
+    }
+    case "last4": {
+      const digits = String(value).replace(/\D/g, "");
+      return digits.length >= 4 ? `\u2022\u2022\u2022\u2022 ${digits.slice(-4)}` : REDACTED;
+    }
+    case "redact":
+      return REDACTED;
+  }
+}
+function defaultAnonStrategy(elementRuntimeType, isArray, hasEnum) {
+  if (isArray || hasEnum) return "redact";
+  if (elementRuntimeType === "string") return "token";
+  if (elementRuntimeType === "Date") return "year";
+  return "redact";
+}
+var STATE = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.state")] ??= /* @__PURE__ */ new WeakMap();
+var FIELD_BRAND = /* @__PURE__ */ Symbol.for("forklaunch.compliance.field");
+function stateOf(field) {
+  const state = STATE.get(field);
+  if (!state) throw new Error("Not a compliant field");
+  return state;
+}
+var CompliantField = class _CompliantField {
+  constructor(state) {
+    Object.defineProperty(this, FIELD_BRAND, { value: true });
+    STATE.set(this, state);
+    Object.freeze(this);
+  }
+  /**
+   * @internal Wrap a plaintext value for `spec`. Applications assign plain
+   * values to the entity property instead.
+   */
+  static fromPlain(value, spec) {
+    if (spec.enumValues) {
+      const values = spec.isArray && Array.isArray(value) ? value : [value];
+      for (const v of values) {
+        if (!spec.enumValues.includes(v)) {
+          throw new Error(
+            `Invalid enum value${spec.path ? ` for ${spec.path}` : ""}: ${String(v)}. Allowed values: ${spec.enumValues.join(", ")}`
+          );
+        }
+      }
+    }
+    return new _CompliantField({
+      spec,
+      hasPlain: true,
+      plain: value,
+      anon: computeAnon(spec.anon, value)
+    });
+  }
+  /** @internal Wrap a stored value (any envelope, or legacy plaintext). */
+  static fromStored(stored, spec, index) {
+    if (!isEncryptedCiphertext(stored)) {
+      return new _CompliantField({
+        spec,
+        hasPlain: true,
+        plain: deserializeFromEncryption(
+          stored,
+          spec.elementRuntimeType,
+          spec.isArray
+        ),
+        index
+      });
+    }
+    return new _CompliantField({
+      spec,
+      hasPlain: false,
+      sealed: stored,
+      anon: sealedAnon(stored) ?? void 0,
+      index
+    });
+  }
+  /** @internal A queryable field whose ciphertext column was not selected. */
+  static fromIndexOnly(index, spec) {
+    return new _CompliantField({ spec, hasPlain: false, index });
+  }
+  /** The field's classification. */
+  get level() {
+    return stateOf(this).spec.level;
+  }
+  /** The de-identified value. Never decrypts for values in a `v4` envelope. */
+  get anon() {
+    const state = stateOf(this);
+    if (state.anon === void 0) {
+      if (state.spec.anon === "token") {
+        throw new LegacyCiphertextError(
+          `${state.spec.path} is stored in a pre-v4 envelope and has no token yet; run reencryptEncryptedColumns() once to upgrade it`
+        );
+      }
+      state.anon = computeAnon(state.spec.anon, readPlaintext(this, false));
+    }
+    return new Anon(state.anon, MINT);
+  }
+  /** The plaintext. Every read is reported to access listeners. */
+  get deanon() {
+    return readPlaintext(this, true);
+  }
+};
+function readPlaintext(field, report) {
+  const state = stateOf(field);
+  let tenantId = "";
+  if (!state.hasPlain) {
+    tenantId = requireBoundTenantId("read");
+    if (state.sealed === void 0) {
+      throw new Error(
+        `${state.spec.path} was not loaded: its ciphertext column was left out of the selection`
+      );
+    }
+    const encryptor = getRegisteredEncryptor();
+    if (!encryptor) {
+      throw new EncryptionRequiredError(
+        `Cannot read ${state.spec.path}: no encryptor registered. Call registerEncryptor() at bootstrap.`
+      );
+    }
+    const opened = encryptor.open(state.sealed, tenantId);
+    state.plain = deserializeFromEncryption(
+      opened.plaintext,
+      state.spec.elementRuntimeType,
+      state.spec.isArray
+    );
+    state.hasPlain = true;
+  }
+  if (report) {
+    tenantId ||= getBoundTenantId() ?? "";
+    for (const listener of LISTENERS) {
+      listener({ field: state.spec.path, level: state.spec.level, tenantId });
+    }
+  }
+  return state.plain;
+}
+function isCompliantField(value) {
+  return value != null && typeof value === "object" && value[FIELD_BRAND] === true;
+}
+function requireEncryptor(path) {
+  const encryptor = getRegisteredEncryptor();
+  if (!encryptor) {
+    throw new EncryptionRequiredError(
+      `Cannot write ${path}: no encryptor registered. Call registerEncryptor() at bootstrap; compliant fields are never stored in plaintext.`
+    );
+  }
+  return encryptor;
+}
+function sealedValueOf(field) {
+  const state = stateOf(field);
+  if (state.sealed !== void 0 && state.sealedTenant === void 0) {
+    return state.sealed;
+  }
+  if (!state.hasPlain) return state.sealed;
+  const tenantId = requireBoundTenantId("write");
+  if (state.sealed !== void 0 && state.sealedTenant === tenantId) {
+    return state.sealed;
+  }
+  if (state.anon === void 0) {
+    state.anon = computeAnon(state.spec.anon, state.plain);
+  }
+  state.sealed = requireEncryptor(state.spec.path).seal(
+    serializeForEncryption(state.plain),
+    tenantId,
+    state.anon
+  );
+  state.sealedTenant = tenantId;
+  return state.sealed;
+}
+function normalizeSerializedForIndex(serialized, spec) {
+  return spec.normalize === "lowercase" ? serialized.trim().toLowerCase() : serialized;
+}
+function normalizedForIndex(value, spec) {
+  return normalizeSerializedForIndex(serializeForEncryption(value), spec);
+}
+function blindIndexOfValue(value, spec) {
+  return requireEncryptor(spec.path).blindIndex(
+    normalizedForIndex(value, spec),
+    requireBoundTenantId("query")
+  );
+}
+function blindIndexOf(field) {
+  const state = stateOf(field);
+  if (state.index) return state.index;
+  if (!state.hasPlain && state.sealed === void 0) return state.index ?? null;
+  try {
+    const plain = state.hasPlain ? state.plain : readPlaintext(field, false);
+    state.index = blindIndexOfValue(plain, state.spec);
+  } catch {
+    return state.index ?? null;
+  }
+  return state.index;
+}
+var PENDING = /* @__PURE__ */ Symbol.for("forklaunch.compliance.pending");
+function isPendingIndex(value) {
+  return value != null && typeof value === "object" && PENDING in value;
+}
+function pendingIndexValue(value) {
+  return value[PENDING];
+}
+var CompliantTypeBase = class extends import_core2.Type {
+  constructor(spec) {
+    super();
+    this.spec = spec;
+  }
+  spec;
+  getColumnType() {
+    return "text";
+  }
+  get runtimeType() {
+    return "string";
+  }
+  ensureComparable() {
+    return false;
+  }
+  compareAsType() {
+    return "string";
+  }
+};
+var CompliantType = class extends CompliantTypeBase {
+  convertToDatabaseValue(value, _platform, context) {
+    if (context?.fromQuery) {
+      throw new CompliantQueryError(
+        `${this.spec.path} cannot be queried: declare it with .compliance('${this.spec.level}', { queryable: true }) to allow equality lookups`
+      );
+    }
+    if (value === null || value === void 0) return null;
+    if (isCompliantField(value)) return sealedValueOf(value) ?? null;
+    if (isEncryptedCiphertext(value)) return value;
+    return sealedValueOf(CompliantField.fromPlain(value, this.spec)) ?? null;
+  }
+  convertToJSValue(value) {
+    if (value === null || value === void 0) return value;
+    if (isCompliantField(value)) return value;
+    return CompliantField.fromStored(String(value), this.spec);
+  }
+};
+var EQUALITY_OPERATORS = /* @__PURE__ */ new Set(["$eq", "$ne", "$in", "$nin"]);
+var CompliantIndexType = class extends CompliantTypeBase {
+  convertToDatabaseValue(value, _platform, context) {
+    if (value === null || value === void 0) return null;
+    if (context?.fromQuery) {
+      const key = context.key;
+      if (key !== void 0 && !EQUALITY_OPERATORS.has(String(key)) && !/^\d+$/.test(String(key))) {
+        throw new CompliantQueryError(
+          `${this.spec.path} supports equality lookups only ($eq, $ne, $in, $nin); ${String(key)} would need the plaintext`
+        );
+      }
+    }
+    if (isCompliantField(value)) return blindIndexOf(value);
+    if (isPendingIndex(value)) return pendingIndexValue(value);
+    if (typeof value === "string" && value.startsWith("bi1:")) return value;
+    return blindIndexOfValue(value, this.spec);
+  }
+  convertToJSValue(value) {
+    if (isCompliantField(value) || isPendingIndex(value)) return value;
+    return { [PENDING]: value ?? null };
+  }
+};
+function isCompliantType(type) {
+  return type instanceof CompliantType || type instanceof CompliantIndexType;
+}
+var SLOTS = globalThis[/* @__PURE__ */ Symbol.for("forklaunch.compliance.slots")] ??= /* @__PURE__ */ new WeakMap();
+function slotsOf(entity) {
+  let slots = SLOTS.get(entity);
+  if (!slots) {
+    slots = {};
+    SLOTS.set(entity, slots);
+  }
+  return slots;
+}
+function readProperty(entity, binding) {
+  const slots = slotsOf(entity);
+  const value = slots[binding.property];
+  if (binding.sibling) {
+    const stored = slots[binding.sibling];
+    if (isPendingIndex(value)) {
+      const index = pendingIndexValue(value);
+      const field = typeof stored === "string" ? CompliantField.fromStored(stored, binding.spec, index) : CompliantField.fromIndexOnly(index, binding.spec);
+      slots[binding.property] = field;
+      return field;
+    }
+    if (value == null && typeof stored === "string") {
+      const field = CompliantField.fromStored(stored, binding.spec, null);
+      slots[binding.property] = field;
+      return field;
+    }
+  }
+  return value;
+}
+function sameRules(a, b) {
+  return a === b || a.path === b.path && a.anon === b.anon && a.normalize === b.normalize && a.queryable === b.queryable;
+}
+function writeProperty(entity, binding, value) {
+  const slots = slotsOf(entity);
+  if (isPendingIndex(value)) {
+    slots[binding.property] = value;
+    return;
+  }
+  if (value === null || value === void 0) {
+    slots[binding.property] = value;
+    if (binding.sibling) slots[binding.sibling] = value;
+    return;
+  }
+  if (isCompliantField(value)) {
+    slots[binding.property] = sameRules(stateOf(value).spec, binding.spec) ? value : CompliantField.fromPlain(readPlaintext(value, false), binding.spec);
+    return;
+  }
+  slots[binding.property] = CompliantField.fromPlain(value, binding.spec);
+}
+function installCompliantAccessors(prototype, bindings) {
+  installInspect(prototype, bindings);
+  for (const binding of bindings) {
+    Object.defineProperty(prototype, binding.property, {
+      configurable: true,
+      enumerable: true,
+      get() {
+        return readProperty(this, binding);
+      },
+      set(value) {
+        writeProperty(this, binding, value);
+      }
+    });
+    if (binding.sibling) {
+      const sibling = binding.sibling;
+      Object.defineProperty(prototype, sibling, {
+        configurable: true,
+        enumerable: false,
+        get() {
+          const field = readProperty(this, binding);
+          const stored = slotsOf(this)[sibling];
+          if (field === null || field === void 0) return stored ?? field;
+          return sealedValueOf(field) ?? stored;
+        },
+        set(value) {
+          slotsOf(this)[sibling] = value;
+        }
+      });
+    }
+  }
+}
+var INSPECT = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
+function installInspect(prototype, bindings) {
+  const hidden = new Set(
+    bindings.map((b) => b.sibling).filter((s) => !!s)
+  );
+  Object.defineProperty(prototype, INSPECT, {
+    configurable: true,
+    writable: true,
+    value(depth, options, inspect) {
+      const shown = {};
+      for (const key of Object.keys(this)) {
+        if (!hidden.has(key)) shown[key] = this[key];
+      }
+      for (const binding of bindings) {
+        const value = this[binding.property];
+        if (value !== void 0) shown[binding.property] = value;
+      }
+      const name = this.constructor?.name ?? "Entity";
+      return `${name} ${inspect(shown, { ...options, depth })}`;
+    }
+  });
+}
+function deanon(entity) {
+  const copy = {};
+  for (const key in entity) {
+    const value = entity[key];
+    copy[key] = isCompliantField(value) ? value.deanon : value;
+  }
+  return copy;
+}
+
+// src/persistence/compliancePropertyBuilder.ts
+var import_common = require("@forklaunch/common");
+var import_core3 = require("@mikro-orm/core");
+function isBuilder(value) {
+  return value != null && typeof value === "object" && "~options" in value;
+}
+function wrapUnclassified(builder) {
+  return new Proxy(builder, {
+    get(target, prop) {
+      if (prop === "compliance") {
+        return (level, options) => wrapClassified(target, level, options);
+      }
+      if (prop === "~options") return Reflect.get(target, prop, target);
+      if (prop === COMPLIANCE_KEY) return void 0;
+      const value = Reflect.get(target, prop, target);
+      if (typeof value === "function") {
+        return (...args) => {
+          const result = value.apply(
+            target,
+            args
+          );
+          return isBuilder(result) ? wrapUnclassified(result) : result;
+        };
+      }
+      return value;
+    }
+  });
+}
+var ENCRYPTED_LEVELS2 = /* @__PURE__ */ new Set([
+  "pii",
+  "phi",
+  "pci"
+]);
+function resolveEncryptedTypeArgs(options) {
+  const type = options.type;
+  const isArray = options.array === true;
+  const resolved = resolveTypeInstance(type);
+  if (resolved) {
+    const rt = resolved.runtimeType;
+    if (rt.endsWith("[]")) {
+      return { elementRuntimeType: rt.slice(0, -2) || "string", isArray: true };
+    }
+    return { elementRuntimeType: rt, isArray };
+  }
+  return { elementRuntimeType: "string", isArray };
+}
+function wrapClassified(builder, level, complianceOptions) {
+  if (ENCRYPTED_LEVELS2.has(level)) {
+    const options = builder["~options"];
+    if (options) {
+      const { elementRuntimeType, isArray } = resolveEncryptedTypeArgs(options);
+      let enumValues;
+      if (options.items) {
+        enumValues = extractEnumValues(options.items);
+        delete options.items;
+        delete options.nativeEnumName;
+        delete options.enum;
+      }
+      const spec = {
+        level,
+        anon: complianceOptions?.anon ?? defaultAnonStrategy(elementRuntimeType, isArray, !!enumValues),
+        queryable: complianceOptions?.queryable === true,
+        normalize: complianceOptions?.normalize ?? "exact",
+        elementRuntimeType,
+        isArray,
+        enumValues,
+        path: ""
+        // set by defineComplianceEntity once the property name is known
+      };
+      options.type = spec.queryable ? new CompliantIndexType(spec) : new CompliantType(spec);
+      options.columnType = "text";
+      options.runtimeType = "string";
+      options.accessor = true;
+    }
+  }
+  return new Proxy(builder, {
+    get(target, prop) {
+      if (prop === COMPLIANCE_KEY) return level;
+      if (prop === "~options") return Reflect.get(target, prop, target);
+      const value = Reflect.get(target, prop, target);
+      if (typeof value === "function") {
+        return (...args) => {
+          const result = value.apply(
+            target,
+            args
+          );
+          return isBuilder(result) ? wrapClassified(result, level) : result;
+        };
+      }
+      return value;
+    }
+  });
+}
+function wrapRelation(builder) {
+  return wrapClassified(builder, "none");
+}
+var RELATION_METHODS = /* @__PURE__ */ new Set([
+  "manyToOne",
+  "oneToMany",
+  "manyToMany",
+  "oneToOne",
+  "embedded"
+]);
+function isRelationMethod(prop) {
+  return typeof prop === "string" && RELATION_METHODS.has(prop);
+}
+function extractEnumValues(items) {
+  if (typeof items === "function") {
+    return extractEnumValues(items());
+  }
+  if (Array.isArray(items)) return items;
+  if (items != null && typeof items === "object") {
+    const obj = items;
+    const allValues = Object.values(obj);
+    return allValues.filter((v) => typeof v !== "string" || !(v in obj));
+  }
+  return [];
+}
+var EnumTextType = class extends import_core3.Type {
+  convertToDatabaseValue(value) {
+    return (0, import_common.safeStringify)(value);
+  }
+  convertToJSValue(value) {
+    return (0, import_common.safeParse)(value);
+  }
+  getColumnType() {
+    return "text";
+  }
+  get runtimeType() {
+    return "string";
+  }
+};
+function inferEnumType(items) {
+  const values = extractEnumValues(items);
+  if (values.length === 0) return "text";
+  const allStrings = values.every((v) => typeof v === "string");
+  if (allStrings) return "text";
+  const allNumbers = values.every((v) => typeof v === "number");
+  if (allNumbers) return "integer";
+  return new EnumTextType();
+}
+var fp = new Proxy(import_core3.p, {
+  get(target, prop) {
+    const value = Reflect.get(target, prop, target);
+    if (typeof value !== "function") return value;
+    if (isRelationMethod(prop)) {
+      return (...args) => {
+        const result = value.apply(
+          target,
+          args
+        );
+        return isBuilder(result) ? wrapRelation(result) : result;
+      };
+    }
+    return (...args) => {
+      const result = value.apply(
+        target,
+        args
+      );
+      if (isBuilder(result)) {
+        if (prop === "enum") {
+          const options = result["~options"];
+          if (options && !options.type) {
+            options.type = inferEnumType(options.items);
+          }
+        }
+        return wrapUnclassified(result);
+      }
+      return result;
+    };
+  }
+});
+
+// src/persistence/defineComplianceEntity.ts
+var import_core4 = require("@mikro-orm/core");
+var naming = new import_core4.UnderscoreNamingStrategy();
+function wireCompliantProperties(entityName, properties) {
+  const wired = {};
+  const bindings = [];
+  for (const [name, prop] of Object.entries(properties)) {
+    wired[name] = prop;
+    if (typeof prop === "function" || prop == null) continue;
+    const options = prop["~options"] ?? prop;
+    const type = options.type;
+    if (!isCompliantType(type)) continue;
+    type.spec.path = `${entityName}.${name}`;
+    if (!(type instanceof CompliantIndexType)) {
+      bindings.push({ property: name, spec: type.spec });
+      continue;
+    }
+    const sibling = `${name}Sealed`;
+    if (sibling in properties) {
+      throw new Error(
+        `Entity '${entityName}': '${sibling}' is reserved for the encrypted value of queryable field '${name}'`
+      );
+    }
+    const explicit = options.fieldName ?? options.fieldNames?.[0];
+    const column = typeof explicit === "string" ? explicit : naming.propertyToColumnName(name);
+    const required = options.nullable !== true;
+    options.fieldName = `${column}_idx`;
+    delete options.fieldNames;
+    options.nullable = true;
+    wired[sibling] = {
+      type: "text",
+      columnType: "text",
+      fieldName: column,
+      nullable: !required,
+      hidden: true,
+      accessor: true
+    };
+    bindings.push({ property: name, spec: type.spec, sibling });
+  }
+  return { properties: wired, bindings };
+}
+function readComplianceLevel(builder) {
+  if (builder == null || typeof builder !== "object") return void 0;
+  return builder[COMPLIANCE_KEY];
+}
+function defineComplianceEntity(meta) {
+  const entityName = "name" in meta ? meta.name : "Unknown";
+  const complianceFields = /* @__PURE__ */ new Map();
+  const rawProperties = meta.properties;
+  const resolvedProperties = typeof rawProperties === "function" ? rawProperties(import_core4.p) : rawProperties;
+  for (const [fieldName, rawProp] of Object.entries(resolvedProperties)) {
+    if (typeof rawProp === "function") {
+      complianceFields.set(fieldName, "none");
+      continue;
+    }
+    const level = readComplianceLevel(rawProp);
+    if (level == null) {
+      throw new Error(
+        `Field '${entityName}.${fieldName}' is missing compliance classification. Call .compliance('pii' | 'phi' | 'pci' | 'none') on this property, or use a relation method (fp.manyToOne, etc.) which is auto-classified.`
+      );
+    }
+    complianceFields.set(fieldName, level);
+  }
+  registerEntityCompliance(entityName, complianceFields);
+  if (meta.retention) {
+    parseDuration(meta.retention.duration);
+    if (!resolvedProperties["createdAt"]) {
+      throw new Error(
+        `Entity '${entityName}' has a retention policy but no 'createdAt' property. Retention requires createdAt to compute expiration.`
+      );
+    }
+    registerEntityRetention(entityName, meta.retention);
+  }
+  if (meta.userIdField) {
+    registerEntityUserIdField(entityName, meta.userIdField);
+  }
+  const wired = wireCompliantProperties(entityName, resolvedProperties);
+  const schema = (0, import_core4.defineEntity)({
+    ...meta,
+    properties: wired.properties
+  });
+  if (wired.bindings.length > 0) {
+    const entityClass = schema.meta.class;
+    if (entityClass)
+      installCompliantAccessors(entityClass.prototype, wired.bindings);
+    const setClass = schema.setClass.bind(schema);
+    schema.setClass = ((cls) => {
+      installCompliantAccessors(cls.prototype, wired.bindings);
+      return setClass(cls);
+    });
+  }
+  return schema;
+}
+
+// src/persistence/complianceEventSubscriber.ts
+var ENCRYPTED_LEVELS3 = /* @__PURE__ */ new Set([
+  "pii",
+  "phi",
+  "pci"
+]);
+function wrapEmWithNativeQueryBlocking(em) {
+  const BLOCKED_METHODS = [
+    "nativeInsert",
+    "nativeUpdate",
+    "nativeDelete"
+  ];
   return new Proxy(em, {
     get(target, prop, receiver) {
       if (typeof prop === "string" && BLOCKED_METHODS.includes(prop)) {
@@ -1061,14 +1651,23 @@ async function reencryptEncryptedColumns(options) {
     const fields = getEntityComplianceFields(meta.className);
     if (!fields) continue;
     const props = meta.properties;
-    const encryptedProps = [...fields.entries()].filter(([, level]) => ENCRYPTED_LEVELS4.has(level)).map(([prop]) => props[prop]).filter(
+    const compliant = compliantColumnsOf(props);
+    const compliantNames = new Set(compliant.map((c) => c.property));
+    const encryptedProps = [...fields.entries()].filter(
+      ([prop, level]) => ENCRYPTED_LEVELS4.has(level) && !compliantNames.has(prop)
+    ).map(([prop]) => props[prop]).filter(
       (p3) => !!p3 && Array.isArray(p3.fieldNames) && p3.fieldNames.length === 1
     );
-    if (encryptedProps.length === 0) continue;
+    if (encryptedProps.length === 0 && compliant.length === 0) continue;
     const pkProp = props[meta.primaryKeys[0]];
     if (!pkProp) continue;
     const pkColumn = pkProp.fieldNames[0];
-    const columns = encryptedProps.map((p3) => p3.fieldNames[0]);
+    const columns = [
+      ...encryptedProps.map((p3) => p3.fieldNames[0]),
+      ...compliant.flatMap(
+        (c) => c.indexColumn ? [c.envelopeColumn, c.indexColumn] : [c.envelopeColumn]
+      )
+    ];
     const report = {
       table: meta.tableName,
       columns,
@@ -1079,7 +1678,9 @@ async function reencryptEncryptedColumns(options) {
       unreadable: 0,
       unreadableIds: [],
       byKeyId: {},
-      missingKeyIds: {}
+      missingKeyIds: {},
+      sealed: 0,
+      reindexed: 0
     };
     const exists = await execute(`select to_regclass(?) as t`, [
       quote(meta.tableName)
@@ -1124,6 +1725,34 @@ async function reencryptEncryptedColumns(options) {
             report.missingKeyIds[missing2] = (report.missingKeyIds[missing2] ?? 0) + 1;
         }
       }
+      for (const column of compliant) {
+        const outcome = planCompliantColumn(
+          column,
+          row,
+          encryptor,
+          tenantIds,
+          fallbackTenantIds
+        );
+        if (outcome.kind === "unreadable") {
+          report.unreadable += 1;
+          rowUnreadable = true;
+          const missing2 = stampedKeyId(String(row[column.envelopeColumn]));
+          if (missing2)
+            report.missingKeyIds[missing2] = (report.missingKeyIds[missing2] ?? 0) + 1;
+          continue;
+        }
+        if (outcome.kind === "empty") continue;
+        if (outcome.sealed) {
+          report.sealed = (report.sealed ?? 0) + 1;
+          report.rewritten += 1;
+          if (outcome.fromKeyId)
+            report.byKeyId[outcome.fromKeyId] = (report.byKeyId[outcome.fromKeyId] ?? 0) + 1;
+        } else {
+          report.current += 1;
+        }
+        if (outcome.reindexed) report.reindexed = (report.reindexed ?? 0) + 1;
+        updates.push(...outcome.updates.map((u) => ({ ...u, jsonb: false })));
+      }
       if (rowUnreadable) report.unreadableIds.push(String(row[pkColumn]));
       if (updates.length && !dryRun) {
         const sets = updates.map(
@@ -1138,7 +1767,7 @@ async function reencryptEncryptedColumns(options) {
     const byKey = Object.entries(report.byKeyId).map(([k, n]) => `${k}: ${n}`).join(", ");
     const missing = Object.entries(report.missingKeyIds).map(([k, n]) => `${k}: ${n}`).join(", ");
     log(
-      `[key-rotation] ${meta.tableName}: scanned ${report.scanned} rows, ${report.rewritten} values ${dryRun ? "would be " : ""}rewritten${byKey ? ` (from ${byKey})` : ""}, ${report.current} already current, ${report.plaintext} plaintext, ${report.unreadable} unreadable${missing ? ` (stamped with keys not in the ring: ${missing})` : ""}${report.unreadableIds.length ? ` (rows ${report.unreadableIds.slice(0, 10).join(", ")}${report.unreadableIds.length > 10 ? ", ..." : ""})` : ""}`
+      `[key-rotation] ${meta.tableName}: scanned ${report.scanned} rows, ${report.rewritten} values ${dryRun ? "would be " : ""}rewritten${byKey ? ` (from ${byKey})` : ""}, ${report.current} already current, ${report.plaintext} plaintext, ${report.sealed ?? 0} compliant values sealed, ${report.reindexed ?? 0} blind indexes written, ${report.unreadable} unreadable${missing ? ` (stamped with keys not in the ring: ${missing})` : ""}${report.unreadableIds.length ? ` (rows ${report.unreadableIds.slice(0, 10).join(", ")}${report.unreadableIds.length > 10 ? ", ..." : ""})` : ""}`
     );
     reports.push(report);
   }
@@ -1169,6 +1798,93 @@ function rotationTotals(reports) {
     unreadable: sum((r) => r.unreadable)
   };
 }
+function compliantColumnsOf(props) {
+  const columns = [];
+  for (const [property, prop] of Object.entries(props)) {
+    const type = prop?.customType;
+    if (!prop || !isCompliantType(type)) continue;
+    if (type instanceof CompliantIndexType) {
+      const sibling = props[`${property}Sealed`];
+      if (!sibling?.fieldNames?.[0]) continue;
+      columns.push({
+        property,
+        spec: type.spec,
+        envelopeColumn: sibling.fieldNames[0],
+        indexColumn: prop.fieldNames[0]
+      });
+    } else {
+      columns.push({
+        property,
+        spec: type.spec,
+        envelopeColumn: prop.fieldNames[0]
+      });
+    }
+  }
+  return columns;
+}
+function planCompliantColumn(column, row, encryptor, tenantIds, fallbackTenantIds) {
+  const stored = row[column.envelopeColumn];
+  if (stored === null || stored === void 0) {
+    if (column.indexColumn && row[column.indexColumn] != null) {
+      return {
+        kind: "ok",
+        sealed: false,
+        reindexed: true,
+        updates: [{ column: column.indexColumn, next: null }]
+      };
+    }
+    return { kind: "empty" };
+  }
+  const primary = tenantIds.length ? tenantIds : [""];
+  const candidates = [
+    ...primary,
+    ...fallbackTenantIds.filter((t) => !primary.includes(t))
+  ];
+  for (const tenantId of candidates) {
+    let serialized;
+    let anon;
+    let current = false;
+    let fromKeyId;
+    if (!isEncryptedValue(stored)) {
+      serialized = String(stored);
+    } else {
+      const opened = tryOpen(encryptor, String(stored), tenantId);
+      if (!opened) continue;
+      serialized = opened.plaintext;
+      anon = opened.anon;
+      current = opened.version === "v4" && !opened.stale;
+      fromKeyId = opened.keyId;
+    }
+    const updates = [];
+    if (!current) {
+      anon ??= computeAnon(
+        column.spec.anon,
+        deserializeFromEncryption(
+          serialized,
+          column.spec.elementRuntimeType,
+          column.spec.isArray
+        )
+      );
+      updates.push({
+        column: column.envelopeColumn,
+        next: encryptor.seal(serialized, tenantId, anon)
+      });
+    }
+    let reindexed = false;
+    if (column.indexColumn) {
+      const index = encryptor.blindIndex(
+        normalizeSerializedForIndex(serialized, column.spec),
+        tenantId
+      );
+      if (row[column.indexColumn] !== index) {
+        updates.push({ column: column.indexColumn, next: index });
+        reindexed = true;
+      }
+    }
+    return { kind: "ok", sealed: !current, reindexed, fromKeyId, updates };
+  }
+  return { kind: "unreadable" };
+}
 
 // src/persistence/tenantFilter.ts
 var TENANT_FILTER_NAME = "tenant";
@@ -1341,7 +2057,13 @@ function rebind(result, target, proxy) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  Anon,
+  BLIND_INDEX_PREFIX,
   ComplianceLevel,
+  CompliantField,
+  CompliantIndexType,
+  CompliantQueryError,
+  CompliantType,
   DecryptionError,
   ENCRYPTED_PREFIXES,
   ENCRYPTION_FORMAT_ENV,
@@ -1352,6 +2074,7 @@ function rebind(result, target, proxy) {
   FieldEncryptor,
   LEGACY_ENCRYPTION_KEYS_ENV,
   LEGACY_ENCRYPTION_KEY_ENV,
+  LegacyCiphertextError,
   MissingEncryptionKeyError,
   RetentionAction,
   RetentionDuration,
@@ -1364,6 +2087,7 @@ function rebind(result, target, proxy) {
   collectFallbackTenantIds,
   countValuesByKeyId,
   createTenantFilterDef,
+  deanon,
   defaultTenantIdsFor,
   defineComplianceEntity,
   encryptionKeyId,
@@ -1379,13 +2103,17 @@ function rebind(result, target, proxy) {
   getEntityRetention,
   getEntityUserIdField,
   getSuperAdminContext,
+  isAnon,
+  isCompliantField,
   isEncryptedCiphertext,
   isEncryptedValue,
+  onComplianceAccess,
   parseDuration,
   parseEncryptionKeyList,
   reencryptEncryptedColumns,
   registerEncryptor,
   rotationTotals,
+  sealedAnon,
   setEncryptionTenantId,
   setupRls,
   setupTenantFilter,