@noy-db/hub 0.10.0-pre.0 → 0.10.0-pre.2

package/dist/capsule/enclave-aes/index.js

@@ -1,65 +1,35 @@
 import {
-  computeBidxTarget
-} from "../../chunk-ODBOHPZU.js";
-import {
-  aesCapsule,
-  checkCanary,
-  decrypt,
-  decryptBytes,
-  decryptBytesWithAAD,
-  decryptDeterministic,
-  deriveDeterministicKey,
-  deriveEchoKey,
-  deriveKey,
-  deriveSealedFieldKey,
-  deriveSealedFieldKeyFromCek,
-  deriveSecretKey,
-  deriveVdigSlotKey,
-  encrypt,
-  encryptBytes,
-  encryptBytesWithAAD,
-  encryptDeterministic,
-  exportDekSet,
-  exportRecipientPrivateKeyPkcs8,
-  exportRecipientPublicKeySpki,
-  generateDEK,
-  generateEphemeralKey,
-  generateRecipientKeyPair,
-  importCek,
-  importDekSet,
-  importRecipientKeyPair,
-  importRecipientPublicKeySpki,
-  importTransferKey,
-  importWrappingKey,
-  mintCanary,
-  recipientUnwrap,
-  recipientWrap,
-  unwrapCek,
-  unwrapKey,
-  wrapCek,
-  wrapKey
-} from "../../chunk-5A3HOTP5.js";
-import {
-  deriveClassifyIndexKey,
-  deriveClassifyIndexSalt,
-  mintBidxTag,
-  pbkdf2VerifyDigest
-} from "../../chunk-Q4DBU5RM.js";
-import {
+  IV_BYTES,
+  KEY_BITS,
+  VDIG_ITERATIONS,
+  base64ToBuffer,
+  bufferToBase64,
+  ctEqualTags,
+  deriveBlobAddressKey,
+  derivePresenceKey,
+  derivePresenceTagKey,
+  encodeEchoParts,
+  evaluateKofN,
+  generateIV,
+  generateRecoverySecret,
+  generateSalt,
   generateSigningKeyPair,
+  hkdfAesGcmKey,
+  hmacSha256Hex,
+  hmacSignHex,
+  makeCapsule,
+  normalizeForVerify,
+  sha256Bytes,
+  sha256Hex,
   signBytes,
   verifyBytes
-} from "../../chunk-VZFTON37.js";
-import {
-  evaluateKofN
-} from "../../chunk-NH2UOV3B.js";
+} from "../../chunk-I4S7IZSS.js";
 import {
   buildDeleteMarker,
   buildRecordAad,
   buildRecordEnvelope,
   buildSealedRecordEnvelope,
   buildTombstone,
-  ctEqualTags,
   envelopeBodyForHash,
   envelopeBodySize,
   hasPerRecordKey,
@@ -70,30 +40,614 @@ import {
   recordAadFor,
   requireSealedBody,
   sealedBodyArgs
-} from "../../chunk-HTRLQ4ZZ.js";
-import {
-  base64ToBuffer,
-  bufferToBase64,
-  deriveBlobAddressKey,
-  derivePresenceKey,
-  derivePresenceTagKey,
-  encodeEchoParts,
-  generateIV,
-  generateRecoverySecret,
-  generateSalt,
-  hkdfAesGcmKey,
-  hmacSha256Hex,
-  hmacSignHex,
-  sha256Bytes,
-  sha256Hex
-} from "../../chunk-EPPAEGH5.js";
-import "../../chunk-URGHKZPL.js";
+} from "../../chunk-XWWDZKLS.js";
+import "../../chunk-CR5UPYIJ.js";
 import {
+  ClassifiedRotationError,
+  DecryptionError,
+  InvalidKeyError,
+  TamperedError,
   ValidationError
-} from "../../chunk-2RH5SEY7.js";
+} from "../../chunk-ISIXU45J.js";
 
-// src/capsule/enclave-aes/broker/proof.ts
+// src/capsule/enclave-aes/crypto.ts
+var PBKDF2_ITERATIONS = 6e5;
 var subtle = globalThis.crypto.subtle;
+async function deriveKey(secret, salt) {
+  return deriveKekFromMaterial(new TextEncoder().encode(secret), salt);
+}
+async function deriveKekFromMaterial(material, salt) {
+  const keyMaterial = await subtle.importKey("raw", material, "PBKDF2", false, ["deriveKey"]);
+  return subtle.deriveKey(
+    { name: "PBKDF2", salt, iterations: PBKDF2_ITERATIONS, hash: "SHA-256" },
+    keyMaterial,
+    { name: "AES-KW", length: KEY_BITS },
+    false,
+    ["wrapKey", "unwrapKey"]
+  );
+}
+async function deriveEchoKey(parts, salt) {
+  return deriveKekFromMaterial(encodeEchoParts(parts), salt);
+}
+async function deriveSecretKey(secret, salt, params) {
+  const keyMaterial = await subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    "PBKDF2",
+    false,
+    ["deriveKey"]
+  );
+  return params.keyUsage === "aes-gcm" ? subtle.deriveKey(
+    {
+      name: "PBKDF2",
+      salt,
+      iterations: params.iterations,
+      hash: "SHA-256"
+    },
+    keyMaterial,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  ) : subtle.deriveKey(
+    {
+      name: "PBKDF2",
+      salt,
+      iterations: params.iterations,
+      hash: "SHA-256"
+    },
+    keyMaterial,
+    { name: "AES-KW", length: KEY_BITS },
+    false,
+    ["wrapKey", "unwrapKey"]
+  );
+}
+async function generateDEK() {
+  return subtle.generateKey(
+    { name: "AES-GCM", length: KEY_BITS },
+    true,
+    // extractable — needed for AES-KW wrapping
+    ["encrypt", "decrypt"]
+  );
+}
+async function generateEphemeralKey() {
+  return subtle.generateKey({ name: "AES-GCM", length: KEY_BITS }, false, ["encrypt", "decrypt"]);
+}
+async function exportDekSet(deks) {
+  const out = {};
+  for (const [coll, dek] of deks) {
+    out[coll] = bufferToBase64(await subtle.exportKey("raw", dek));
+  }
+  return out;
+}
+async function importDekSet(exported) {
+  const deks = /* @__PURE__ */ new Map();
+  for (const [coll, b64] of Object.entries(exported)) {
+    const key = await subtle.importKey(
+      "raw",
+      base64ToBuffer(b64),
+      { name: "AES-GCM", length: KEY_BITS },
+      true,
+      ["encrypt", "decrypt"]
+    );
+    deks.set(coll, key);
+  }
+  return deks;
+}
+async function wrapKey(dek, kek) {
+  const wrapped = await subtle.wrapKey("raw", dek, kek, "AES-KW");
+  return bufferToBase64(wrapped);
+}
+async function unwrapKey(wrappedBase64, kek) {
+  try {
+    return await subtle.unwrapKey(
+      "raw",
+      base64ToBuffer(wrappedBase64),
+      kek,
+      "AES-KW",
+      { name: "AES-GCM", length: KEY_BITS },
+      true,
+      ["encrypt", "decrypt"]
+    );
+  } catch {
+    throw new InvalidKeyError();
+  }
+}
+async function mintCanary(kek, plaintext) {
+  const constant = await subtle.importKey(
+    "raw",
+    plaintext,
+    { name: "AES-GCM", length: KEY_BITS },
+    true,
+    ["encrypt", "decrypt"]
+  );
+  return wrapKey(constant, kek);
+}
+async function checkCanary(wrapped, kek) {
+  try {
+    await unwrapKey(wrapped, kek);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function asKwKey(dek) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-cek-wrap");
+  const info = new TextEncoder().encode("v1");
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey("raw", bits, "AES-KW", false, ["wrapKey", "unwrapKey"]);
+}
+async function wrapCek(cek, dek) {
+  const kw = await asKwKey(dek);
+  const wrapped = await subtle.wrapKey("raw", cek, kw, "AES-KW");
+  return bufferToBase64(wrapped);
+}
+async function unwrapCek(wrappedBase64, dek) {
+  const kw = await asKwKey(dek);
+  try {
+    return await subtle.unwrapKey(
+      "raw",
+      base64ToBuffer(wrappedBase64),
+      kw,
+      "AES-KW",
+      { name: "AES-GCM", length: KEY_BITS },
+      true,
+      ["encrypt", "decrypt"]
+    );
+  } catch {
+    throw new InvalidKeyError();
+  }
+}
+async function importCek(rawKey) {
+  return subtle.importKey("raw", rawKey, { name: "AES-GCM", length: KEY_BITS }, false, ["decrypt"]);
+}
+async function importTransferKey(raw) {
+  if (raw.byteLength !== 32) {
+    throw new ValidationError(`transfer key must be 32 bytes, got ${raw.byteLength}.`);
+  }
+  return subtle.importKey("raw", raw, { name: "AES-GCM", length: KEY_BITS }, false, ["encrypt", "decrypt"]);
+}
+async function importWrappingKey(raw) {
+  if (raw.byteLength !== 32) {
+    throw new ValidationError(`wrapping key must be 32 bytes, got ${raw.byteLength}.`);
+  }
+  return subtle.importKey("raw", raw, { name: "AES-KW", length: KEY_BITS }, false, ["wrapKey", "unwrapKey"]);
+}
+async function encrypt(plaintext, dek, aad) {
+  const iv = generateIV();
+  const encoded = new TextEncoder().encode(plaintext);
+  const ciphertext = await subtle.encrypt(
+    {
+      name: "AES-GCM",
+      iv,
+      ...aad !== void 0 && { additionalData: aad }
+    },
+    dek,
+    encoded
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decrypt(ivBase64, dataBase64, dek, aad) {
+  let iv;
+  let ciphertext;
+  try {
+    iv = base64ToBuffer(ivBase64);
+    ciphertext = base64ToBuffer(dataBase64);
+  } catch (err) {
+    throw new DecryptionError(`envelope body is not valid base64: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    const plaintext = await subtle.decrypt(
+      {
+        name: "AES-GCM",
+        iv,
+        ...aad !== void 0 && { additionalData: aad }
+      },
+      dek,
+      ciphertext
+    );
+    return new TextDecoder().decode(plaintext);
+  } catch (err) {
+    if (err instanceof Error && err.name === "OperationError") {
+      throw new TamperedError(...await classifyTagFailure(iv, ciphertext, dek, aad));
+    }
+    throw new DecryptionError(
+      err instanceof Error ? err.message : "Decryption failed"
+    );
+  }
+}
+async function classifyTagFailure(iv, ciphertext, dek, aad) {
+  if (aad === void 0) return [];
+  try {
+    await subtle.decrypt({ name: "AES-GCM", iv }, dek, ciphertext);
+  } catch {
+    return [];
+  }
+  return [
+    "This record was sealed BEFORE record-identity binding (#1041) and cannot be read by this version. Its body decrypts correctly under the record key, so this is a data-format transition, not tampering \u2014 but it also means the record predates authenticated metadata. There is no migration path; see noy-db #1100.",
+    "unbound-legacy-format"
+  ];
+}
+async function encryptBytes(data, dek) {
+  const iv = generateIV();
+  const ciphertext = await subtle.encrypt(
+    { name: "AES-GCM", iv },
+    dek,
+    data
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decryptBytes(ivBase64, dataBase64, dek) {
+  const iv = base64ToBuffer(ivBase64);
+  const ciphertext = base64ToBuffer(dataBase64);
+  try {
+    const plaintext = await subtle.decrypt(
+      { name: "AES-GCM", iv },
+      dek,
+      ciphertext
+    );
+    return new Uint8Array(plaintext);
+  } catch (err) {
+    if (err instanceof Error && err.name === "OperationError") {
+      throw new TamperedError();
+    }
+    throw new DecryptionError(
+      err instanceof Error ? err.message : "Decryption failed"
+    );
+  }
+}
+async function encryptBytesWithAAD(data, dek, aad) {
+  const iv = generateIV();
+  const ciphertext = await subtle.encrypt(
+    {
+      name: "AES-GCM",
+      iv,
+      additionalData: aad
+    },
+    dek,
+    data
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decryptBytesWithAAD(ivBase64, dataBase64, dek, aad) {
+  const iv = base64ToBuffer(ivBase64);
+  const ciphertext = base64ToBuffer(dataBase64);
+  try {
+    const plaintext = await subtle.decrypt(
+      {
+        name: "AES-GCM",
+        iv,
+        additionalData: aad
+      },
+      dek,
+      ciphertext
+    );
+    return new Uint8Array(plaintext);
+  } catch (err) {
+    if (err instanceof Error && err.name === "OperationError") {
+      throw new TamperedError();
+    }
+    throw new DecryptionError(
+      err instanceof Error ? err.message : "Decryption failed"
+    );
+  }
+}
+async function deriveSealedFieldKey(dek, collectionName, field) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-sealed");
+  const info = new TextEncoder().encode(JSON.stringify(["noydb-sealed", collectionName, field]));
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function deriveSealedFieldKeyFromCek(cek, collectionName, field) {
+  const rawCek = await subtle.exportKey("raw", cek);
+  const hkdfKey = await subtle.importKey("raw", rawCek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-sealed-cek");
+  const info = new TextEncoder().encode(JSON.stringify(["noydb-sealed-cek", collectionName, field]));
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function deriveDeterministicKey(dek) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-det");
+  const info = new TextEncoder().encode(JSON.stringify(["noydb-det"]));
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    true,
+    ["encrypt", "decrypt"]
+  );
+}
+async function deriveDeterministicIV(dek, context, plaintext) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-deterministic-v1");
+  const info = new TextEncoder().encode(`${context}\0${plaintext}`);
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    IV_BYTES * 8
+  );
+  return new Uint8Array(bits);
+}
+async function encryptDeterministic(plaintext, dek, context) {
+  const iv = await deriveDeterministicIV(dek, context, plaintext);
+  const encoded = new TextEncoder().encode(plaintext);
+  const ciphertext = await subtle.encrypt(
+    { name: "AES-GCM", iv },
+    dek,
+    encoded
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decryptDeterministic(ivBase64, dataBase64, dek) {
+  return decrypt(ivBase64, dataBase64, dek);
+}
+async function generateRecipientKeyPair() {
+  return subtle.generateKey(
+    { name: "RSA-OAEP", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
+    true,
+    ["encrypt", "decrypt"]
+  );
+}
+async function exportRecipientPublicKeySpki(pair) {
+  return new Uint8Array(await subtle.exportKey("spki", pair.publicKey));
+}
+async function importRecipientPublicKeySpki(spki) {
+  return subtle.importKey("spki", spki, { name: "RSA-OAEP", hash: "SHA-256" }, false, ["encrypt"]);
+}
+async function recipientWrap(pub, bytes) {
+  return new Uint8Array(await subtle.encrypt({ name: "RSA-OAEP" }, pub, bytes));
+}
+async function recipientUnwrap(pair, wrapped) {
+  return new Uint8Array(await subtle.decrypt({ name: "RSA-OAEP" }, pair.privateKey, wrapped));
+}
+async function exportRecipientPrivateKeyPkcs8(pair) {
+  return new Uint8Array(await subtle.exportKey("pkcs8", pair.privateKey));
+}
+async function importRecipientKeyPair(pkcs8, spki) {
+  const alg = { name: "RSA-OAEP", hash: "SHA-256" };
+  const [privateKey, publicKey] = await Promise.all([
+    subtle.importKey("pkcs8", pkcs8, alg, false, ["decrypt"]),
+    subtle.importKey("spki", spki, alg, false, ["encrypt"])
+  ]);
+  return { privateKey, publicKey };
+}
+
+// src/capsule/enclave-aes/classify/digest.ts
+var subtle2 = globalThis.crypto.subtle;
+async function pbkdf2VerifyDigest(value, salt, iterations) {
+  const keyMaterial = await subtle2.importKey(
+    "raw",
+    new TextEncoder().encode(value),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const bits = await subtle2.deriveBits(
+    { name: "PBKDF2", salt, iterations, hash: "SHA-256" },
+    keyMaterial,
+    256
+  );
+  return new Uint8Array(bits);
+}
+
+// src/capsule/enclave-aes/classify/compare.ts
+var subtle3 = globalThis.crypto.subtle;
+async function blindedEqual(a, b) {
+  const ke = await subtle3.generateKey({ name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const tagA = new Uint8Array(await subtle3.sign("HMAC", ke, a));
+  const tagB = new Uint8Array(await subtle3.sign("HMAC", ke, b));
+  return ctEqualTags(tagA, tagB);
+}
+
+// src/capsule/enclave-aes/classify/vdig.ts
+var subtle4 = globalThis.crypto.subtle;
+var VDIG_SALT_DOMAIN = "noydb-classify-vdig";
+function buildVdigAad(collection, recordId, field) {
+  return new TextEncoder().encode(JSON.stringify([VDIG_SALT_DOMAIN, collection, recordId, field]));
+}
+async function deriveVdigSlotKey(cek, collection, field) {
+  const raw = await subtle4.exportKey("raw", cek);
+  const hkdf = await subtle4.importKey("raw", raw, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(VDIG_SALT_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([VDIG_SALT_DOMAIN, collection, field]));
+  const bits = await subtle4.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdf, 256);
+  return subtle4.importKey("raw", bits, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+async function sealVdigPayload(payload, cek, collection, recordId, field) {
+  const key = await deriveVdigSlotKey(cek, collection, field);
+  const { iv, data } = await encryptBytesWithAAD(
+    new TextEncoder().encode(JSON.stringify(payload)),
+    key,
+    buildVdigAad(collection, recordId, field)
+  );
+  return `${iv}:${data}`;
+}
+async function openVdigPayload(blob, cek, collection, recordId, field) {
+  const sep = blob.indexOf(":");
+  if (sep === -1) throw new TamperedError();
+  const ivPart = blob.slice(0, sep);
+  const dataPart = blob.slice(sep + 1);
+  try {
+    base64ToBuffer(ivPart);
+    base64ToBuffer(dataPart);
+  } catch {
+    throw new TamperedError();
+  }
+  const key = await deriveVdigSlotKey(cek, collection, field);
+  const bytes = await decryptBytesWithAAD(
+    ivPart,
+    dataPart,
+    key,
+    buildVdigAad(collection, recordId, field)
+  );
+  return JSON.parse(new TextDecoder().decode(bytes));
+}
+
+// src/capsule/enclave-aes/classify/write.ts
+async function mintVdigSlot(rawValue, policy, prevBlob, cek, collection, recordId, field) {
+  const normalized = normalizeForVerify(policy.normalize, rawValue);
+  let prev = null;
+  if (prevBlob !== void 0) {
+    try {
+      prev = await openVdigPayload(prevBlob, cek, collection, recordId, field);
+    } catch {
+      throw new TamperedError();
+    }
+    if (!Number.isInteger(prev.iter) || prev.iter < 1) {
+      throw new TamperedError();
+    }
+  }
+  if (prev !== null && policy.notLastN > 0) {
+    const history = [prev.cur, ...prev.ring ?? []];
+    for (const entry of history) {
+      const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(entry.salt), prev.iter);
+      if (await blindedEqual(digest, base64ToBuffer(entry.hash))) {
+        throw new ClassifiedRotationError(collection, field, "password was used recently");
+      }
+    }
+  }
+  const salt = generateSalt();
+  const hash = await pbkdf2VerifyDigest(normalized, salt, VDIG_ITERATIONS);
+  const ring = prev !== null && policy.notLastN > 0 ? [...prev.ring ?? [], { salt: prev.cur.salt, hash: prev.cur.hash }].slice(-policy.notLastN) : void 0;
+  const payload = {
+    v: 1,
+    alg: "PBKDF2-SHA256",
+    iter: VDIG_ITERATIONS,
+    cur: { salt: bufferToBase64(salt), hash: bufferToBase64(hash), at: (/* @__PURE__ */ new Date()).toISOString() },
+    ...ring !== void 0 && ring.length > 0 ? { ring } : {}
+  };
+  return sealVdigPayload(payload, cek, collection, recordId, field);
+}
+
+// src/capsule/enclave-aes/classify/bidx.ts
+var subtle5 = globalThis.crypto.subtle;
+var CLASSIFY_INDEX_KEY_DOMAIN = "noydb-classify-index-v1";
+var CLASSIFY_INDEX_SALT_DOMAIN = "noydb-classify-index-salt-v1";
+var COST_BYTE_V1 = 1;
+var CURRENT_COST_BYTE = COST_BYTE_V1;
+function iterationsForCostByte(b) {
+  if (b === COST_BYTE_V1) return VDIG_ITERATIONS;
+  return null;
+}
+async function deriveClassifyIndexKey(dek, collection, field) {
+  const rawDek = await subtle5.exportKey("raw", dek);
+  const hkdfKey = await subtle5.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(CLASSIFY_INDEX_KEY_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_KEY_DOMAIN, collection, field]));
+  const bits = await subtle5.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return subtle5.importKey("raw", bits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+}
+async function deriveClassifyIndexSalt(dek, collection, field) {
+  const rawDek = await subtle5.exportKey("raw", dek);
+  const hkdfKey = await subtle5.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(CLASSIFY_INDEX_SALT_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([CLASSIFY_INDEX_SALT_DOMAIN, collection, field]));
+  const bits = await subtle5.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return new Uint8Array(bits);
+}
+async function mintAt(normalized, dek, collection, field, costByte) {
+  const iterations = iterationsForCostByte(costByte);
+  if (iterations == null) {
+    throw new Error(`bidx: unknown cost byte 0x${costByte.toString(16)}`);
+  }
+  const saltCf = await deriveClassifyIndexSalt(dek, collection, field);
+  const inner = await pbkdf2VerifyDigest(normalized, saltCf, iterations);
+  const kIdx = await deriveClassifyIndexKey(dek, collection, field);
+  const mac = await subtle5.sign("HMAC", kIdx, inner);
+  const tag = new Uint8Array(1 + 32);
+  tag[0] = costByte;
+  tag.set(new Uint8Array(mac), 1);
+  return bufferToBase64(tag);
+}
+async function mintBidxTag(normalized, dek, collection, field) {
+  return mintAt(normalized, dek, collection, field, CURRENT_COST_BYTE);
+}
+
+// src/capsule/enclave-aes/primitives.ts
+var aesPrimitives = {
+  encrypt,
+  decrypt,
+  encryptBytesWithAAD,
+  decryptBytesWithAAD,
+  encryptDeterministic,
+  deriveDeterministicKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  generateDEK,
+  wrapCek,
+  unwrapCek,
+  bufferToBase64,
+  mintVdigSlot,
+  mintBidxTag,
+  openVdigPayload,
+  sealVdigPayload,
+  // family#168 — the two the verify engines need, so the engines can live in
+  // the plumbing instead of in here.
+  pbkdf2VerifyDigest,
+  blindedEqual
+};
+
+// src/capsule/enclave-aes/bound.ts
+var aesCapsule = makeCapsule(aesPrimitives);
+
+// src/capsule/enclave-aes/classify/find.ts
+async function computeBidxTarget(candidate, normalize, dek, collection, field, costByte) {
+  const resolvedCostByte = costByte ?? CURRENT_COST_BYTE;
+  const iters = iterationsForCostByte(resolvedCostByte);
+  if (iters === null) return null;
+  const normalized = normalizeForVerify(normalize, candidate);
+  return mintAt(normalized, dek, collection, field, resolvedCostByte);
+}
+
+// src/capsule/enclave-aes/broker/proof.ts
+var subtle6 = globalThis.crypto.subtle;
 var BROKER_PROOF_DOMAIN = "noydb-broker-proof";
 var BROKER_PROOF_VERSION = "noydb-broker-proof-v1";
 var BROKER_PROOF_MEMBER_VERSION = "noydb-broker-proof-v2";
@@ -125,18 +679,18 @@ function buildCanonical(vaultId, brokerId, parts) {
   ]);
 }
 async function deriveBrokerProofBits(seed, vaultId, brokerId, memberUserId) {
-  const hkdfKey = await subtle.importKey("raw", seed, "HKDF", false, ["deriveBits"]);
+  const hkdfKey = await subtle6.importKey("raw", seed, "HKDF", false, ["deriveBits"]);
   const salt = new TextEncoder().encode(BROKER_PROOF_DOMAIN);
   const info = new TextEncoder().encode(JSON.stringify(
     memberUserId === void 0 ? [BROKER_PROOF_DOMAIN, vaultId, brokerId] : [BROKER_PROOF_DOMAIN, vaultId, brokerId, memberUserId]
   ));
-  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  const bits = await subtle6.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
   return new Uint8Array(bits);
 }
 async function deriveBrokerProofKey(seed, vaultId, brokerId, memberUserId) {
   const proofBits = await deriveBrokerProofBits(seed, vaultId, brokerId, memberUserId);
   try {
-    return await subtle.importKey("raw", proofBits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    return await subtle6.importKey("raw", proofBits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
   } finally {
     proofBits.fill(0);
   }
@@ -150,7 +704,7 @@ async function computeBrokerProof(seed, vaultId, brokerId, canonicalParts) {
     }
     const canonical = buildCanonical(vaultId, brokerId, canonicalParts);
     const key = await deriveBrokerProofKey(seed, vaultId, brokerId, canonicalParts.member?.userId);
-    const mac = await subtle.sign("HMAC", key, new TextEncoder().encode(canonical));
+    const mac = await subtle6.sign("HMAC", key, new TextEncoder().encode(canonical));
     return bufferToBase64(new Uint8Array(mac));
   } finally {
     seed.fill(0);
@@ -176,14 +730,14 @@ async function verifyBrokerProof(args) {
     challenge: args.challenge,
     expiresAt: args.expiresAt
   });
-  const key = await subtle.importKey(
+  const key = await subtle6.importKey(
     "raw",
     args.registeredProofKey,
     { name: "HMAC", hash: "SHA-256" },
     false,
     ["verify"]
   );
-  const ok = await subtle.verify(
+  const ok = await subtle6.verify(
     "HMAC",
     key,
     base64ToBuffer(args.proof),
@@ -262,11 +816,18 @@ var {
   findByDet,
   queryByDet
 } = aesCapsule;
+var {
+  revealSealedField,
+  verifyDigestField,
+  verifyTextField,
+  matchGroupFields
+} = aesCapsule;
 export {
   RecordCodec,
   SEALED_CEK_NS,
   applyRewrappedBody,
   base64ToBuffer,
+  blindedEqual,
   bufferToBase64,
   buildDeleteMarker,
   buildRecordAad,
@@ -333,6 +894,7 @@ export {
   isTombstoneShape,
   issueChallenge,
   makeReservedEnvelopes,
+  matchGroupFields,
   mintBidxTag,
   mintCanary,
   openEnvelopeJson,
@@ -346,6 +908,7 @@ export {
   rekeyEnvelopeToDek,
   requireSealedBody,
   resolveStableCek,
+  revealSealedField,
   revokeSealedRecord,
   rewrapBodyToDek,
   rewrapEnvelope,
@@ -359,7 +922,9 @@ export {
   unwrapKey,
   verifyBrokerProof,
   verifyBytes,
+  verifyDigestField,
   verifyRecordIdentity,
+  verifyTextField,
   wrapCek,
   wrapKey,
   writeEnvelopeBody