@noy-db/hub 0.10.0-pre.1 → 0.10.0-pre.2

package/dist/blobs/index.js

@@ -10,7 +10,7 @@ import {
   createExportBlobsHandle,
   reportOrphanBlobChunks,
   runCompaction
-} from "../chunk-IIQMNZXT.js";
+} from "../chunk-K5TVSOPQ.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -25,20 +25,17 @@ import {
   detectMimeType,
   isPreCompressed,
   memoryBlobPinStore
-} from "../chunk-6I5RRBPP.js";
-import "../chunk-ZZLIFVZG.js";
-import "../chunk-OCSKQUNE.js";
-import "../chunk-KFYUQMF5.js";
-import "../chunk-WRLWEYHY.js";
-import "../chunk-OJAFKGI7.js";
-import "../chunk-6B4X447I.js";
-import "../chunk-NH2UOV3B.js";
-import "../chunk-YIVAKBCW.js";
-import "../chunk-6Y3UJT5H.js";
-import "../chunk-VUBRHJ4H.js";
+} from "../chunk-YCTSQV7K.js";
+import "../chunk-ZG7DBIVX.js";
+import "../chunk-VKZ3TDET.js";
+import "../chunk-F2FD4LSB.js";
+import "../chunk-EFINFZIF.js";
+import "../chunk-I4S7IZSS.js";
+import "../chunk-XWWDZKLS.js";
+import "../chunk-CR5UPYIJ.js";
 import {
   BlobOfflineError
-} from "../chunk-JGYCKX56.js";
+} from "../chunk-ISIXU45J.js";
 
 // src/via/blob/active.ts
 function withBlobs(options = {}) {

package/dist/blobs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/via/blob/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobsStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobsStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { BlobsStrategy } from '../../port/with/blob-strategy.js'\nimport { createBlobPinCache } from '../../with-shape/blobs/blob-pinning.js'\nimport type { BlobPinStore } from '../../with-shape/blobs/blob-pinning.js'\n\n/** Options for {@link withBlobs} (#808). */\nexport interface WithBlobsOptions {\n  /**\n   * Device-local backend for the offline-pin registry + external side-cache\n   * (`collection.blob(id).pin()`, the `cacheBudget` LRU stamps). Default:\n   * in-memory — pins then last one app session. Supply a durable,\n   * DEVICE-LOCAL store (IndexedDB-backed on the web; it must never sync) to\n   * keep pins across restarts. See `BlobPinStore`'s doc for the posture.\n   */\n  readonly pinStore?: BlobPinStore\n}\n\n/**\n * Build a default `BlobsStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * One `withBlobs()` instance owns one device-local pin registry + KPI\n * counter set (#808) — treat it as \"this device's\" blob service.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobsStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * const vault = await db.openVault('acme')\n * await vault.collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(options: WithBlobsOptions = {}): BlobsStrategy {\n  const pinCache = createBlobPinCache(options.pinStore)\n  return {\n    openSlot(args) {\n      return new BlobSet({ ...args, pinCache })\n    },\n    cacheStats() {\n      return { ...pinCache.stats }\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,UAAU,UAA4B,CAAC,GAAkB;AACvE,QAAM,WAAW,mBAAmB,QAAQ,QAAQ;AACpD,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC;AAAA,IAC1C;AAAA,IACA,aAAa;AACX,aAAO,EAAE,GAAG,SAAS,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/via/blob/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobsStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobsStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { BlobsStrategy } from '../../port/with/blob-strategy.js'\nimport { createBlobPinCache } from '../../with-shape/blobs/blob-pinning.js'\nimport type { BlobPinStore } from '../../with-shape/blobs/blob-pinning.js'\n\n/** Options for {@link withBlobs} (#808). */\nexport interface WithBlobsOptions {\n  /**\n   * Device-local backend for the offline-pin registry + external side-cache\n   * (`collection.blob(id).pin()`, the `cacheBudget` LRU stamps). Default:\n   * in-memory — pins then last one app session. Supply a durable,\n   * DEVICE-LOCAL store (IndexedDB-backed on the web; it must never sync) to\n   * keep pins across restarts. See `BlobPinStore`'s doc for the posture.\n   */\n  readonly pinStore?: BlobPinStore\n}\n\n/**\n * Build a default `BlobsStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * One `withBlobs()` instance owns one device-local pin registry + KPI\n * counter set (#808) — treat it as \"this device's\" blob service.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobsStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * const vault = await db.openVault('acme')\n * await vault.collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(options: WithBlobsOptions = {}): BlobsStrategy {\n  const pinCache = createBlobPinCache(options.pinStore)\n  return {\n    openSlot(args) {\n      return new BlobSet({ ...args, pinCache })\n    },\n    cacheStats() {\n      return { ...pinCache.stats }\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,UAAU,UAA4B,CAAC,GAAkB;AACvE,QAAM,WAAW,mBAAmB,QAAQ,QAAQ;AACpD,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC;AAAA,IAC1C;AAAA,IACA,aAAa;AACX,aAAO,EAAE,GAAG,SAAS,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;","names":[]}

package/dist/broker/index.js

@@ -1,21 +1,18 @@
 import {
   NO_BROKER
-} from "../chunk-PNEBCVXP.js";
+} from "../chunk-JW3I3NNZ.js";
 import {
   issueChallenge,
   verifyBrokerProof
-} from "../chunk-WRLWEYHY.js";
-import "../chunk-OJAFKGI7.js";
-import "../chunk-6B4X447I.js";
-import "../chunk-NH2UOV3B.js";
-import "../chunk-YIVAKBCW.js";
-import "../chunk-6Y3UJT5H.js";
-import "../chunk-VUBRHJ4H.js";
+} from "../chunk-EFINFZIF.js";
+import "../chunk-I4S7IZSS.js";
+import "../chunk-XWWDZKLS.js";
+import "../chunk-CR5UPYIJ.js";
 import {
   BrokerEnrolmentError,
   BrokerNotEnabledError,
   BrokerProofError
-} from "../chunk-JGYCKX56.js";
+} from "../chunk-ISIXU45J.js";
 
 // src/with-party/broker/active.ts
 var DEFAULT_SKEW_MS = 6e4;
@@ -28,7 +25,7 @@ function withBroker(config) {
   const cache = /* @__PURE__ */ new Map();
   return {
     async enroll(ctx) {
-      const { enrollSeed } = await import("../seed-XHQQF6LJ.js");
+      const { enrollSeed } = await import("../seed-F2OSDZJR.js");
       return enrollSeed({ ...ctx, config });
     },
     async rotate(ctx) {
@@ -37,15 +34,15 @@ function withBroker(config) {
       const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
       await Promise.allSettled(inFlight);
       for (const [key] of scoped) cache.delete(key);
-      const { rotateSeed } = await import("../seed-XHQQF6LJ.js");
+      const { rotateSeed } = await import("../seed-F2OSDZJR.js");
       return rotateSeed({ ...ctx, config });
     },
     async enrolMember(ctx, member) {
-      const { enrolMemberSeed } = await import("../seed-XHQQF6LJ.js");
+      const { enrolMemberSeed } = await import("../seed-F2OSDZJR.js");
       return enrolMemberSeed({ ...ctx, config }, member);
     },
     async revokeMember(ctx, userId) {
-      const { revokeMemberSeed } = await import("../seed-XHQQF6LJ.js");
+      const { revokeMemberSeed } = await import("../seed-F2OSDZJR.js");
       return revokeMemberSeed({ ...ctx, config }, userId);
     },
     credentialSource(ctx, profile) {
@@ -62,7 +59,7 @@ function withBroker(config) {
         const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
         const capturedEntry = entry;
         const inFlight = (async () => {
-          const { mintStoreCredentials } = await import("../seed-XHQQF6LJ.js");
+          const { mintStoreCredentials } = await import("../seed-F2OSDZJR.js");
           const creds = await mintStoreCredentials({ ...ctx, config }, profile);
           capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
           return creds;

package/dist/broker/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-party/broker/active.ts","../../src/with-party/broker/index.ts"],"sourcesContent":["/**\n * Enable the credential-broker capability (#479, spec §5).\n *\n * Pass to `createNoydb({ brokerStrategy: withBroker(config) })` to make\n * `vault.broker()` live. Each method dynamic-imports the seed lifecycle\n * engine (`./seed.js`) — mirroring `via/classified/active.ts`'s per-method\n * dynamic-import seam — so `with-party/broker/seed.ts` (the heavy module:\n * the CAS enrol, quiesce-then-swap rotate, and the challenge/response round\n * trip) is reachable only through the `@noy-db/hub/broker` subpath and\n * never enters the single-user floor bundle.\n *\n * The single-flight, per-vault-per-profile refresh cache (H-6/I6) lives\n * HERE, in this factory's closure — shared across every `credentialSource(profile)`\n * call for this one broker instance (in turn shared across every vault of a\n * `createNoydb()` instance — `vault.broker()` passes the SAME `BrokerStrategy`\n * for all of them), so `rotate()` can quiesce it (await any in-flight\n * round-trip, then drop it) before the seed swap. The cache key is\n * `${vault}\\0${profile}` — keyed by vault FIRST, or two vaults sharing this\n * one strategy would collide and hand vault-B a cached credential minted\n * (and STS-scoped) for vault-A.\n */\nimport type { BrokerStrategy, BrokerConfig, BrokerCtx } from '../../port/with/broker-strategy.js'\nimport type { StoreCredentials, StoreCredentialSource } from '../../kernel/types.js'\n\nconst DEFAULT_SKEW_MS = 60_000\n/** Floor under the skew-adjusted boundary so a sub-skew credential TTL\n *  doesn't collapse to \"already expired\" and thrash re-proving every call (I6b). */\nconst MIN_CACHE_MS = 1_000\n\ninterface CacheEntry {\n  cached?: { creds: StoreCredentials; validUntil: number } | undefined\n  inFlight?: Promise<StoreCredentials> | undefined\n}\n\nfunction cacheFloor(creds: StoreCredentials, skewMs: number): number {\n  const expiresAtMs = creds.expiresAt ? Date.parse(creds.expiresAt) : Date.now() + skewMs * 2\n  return Math.max(expiresAtMs - skewMs, Date.now() + MIN_CACHE_MS)\n}\n\nexport function withBroker(config: BrokerConfig): BrokerStrategy {\n  const cache = new Map<string, CacheEntry>()\n\n  return {\n    async enroll(ctx) {\n      const { enrollSeed } = await import('./seed.js')\n      return enrollSeed({ ...ctx, config })\n    },\n    async rotate(ctx) {\n      // Quiesce (I5): let any in-flight round-trip finish (it may still be\n      // proving under the pre-rotation seed) before the local record is\n      // overwritten, then drop the cache — scoped to THIS vault's entries\n      // only (`${ctx.vault}\\0`-prefixed keys). A global cache.clear() here\n      // would blow away every OTHER vault's cache on this shared strategy\n      // too — same root cause as the cross-vault read collision this fixes.\n      const vaultPrefix = `${ctx.vault}\\0`\n      const scoped = [...cache.entries()].filter(([key]) => key.startsWith(vaultPrefix))\n      const inFlight = scoped.map(([, e]) => e.inFlight).filter((p): p is Promise<StoreCredentials> => p !== undefined)\n      await Promise.allSettled(inFlight)\n      for (const [key] of scoped) cache.delete(key)\n      const { rotateSeed } = await import('./seed.js')\n      return rotateSeed({ ...ctx, config })\n    },\n    async enrolMember(ctx, member) {\n      const { enrolMemberSeed } = await import('./seed.js')\n      return enrolMemberSeed({ ...ctx, config }, member)\n    },\n    async revokeMember(ctx, userId) {\n      const { revokeMemberSeed } = await import('./seed.js')\n      return revokeMemberSeed({ ...ctx, config }, userId)\n    },\n    credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource {\n      const key = `${ctx.vault}\\0${profile ?? ''}`\n      return async () => {\n        let entry = cache.get(key)\n        if (!entry) {\n          entry = {}\n          cache.set(key, entry)\n        }\n        const now = Date.now()\n        if (entry.cached && now < entry.cached.validUntil) return entry.cached.creds\n        if (entry.inFlight) return entry.inFlight\n\n        const skewMs = config.skewMs ?? DEFAULT_SKEW_MS\n        const capturedEntry = entry\n        const inFlight = (async () => {\n          const { mintStoreCredentials } = await import('./seed.js')\n          const creds = await mintStoreCredentials({ ...ctx, config }, profile)\n          capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) }\n          return creds\n        })()\n        entry.inFlight = inFlight\n        try {\n          return await inFlight\n        } finally {\n          // Clear-on-settle (I6a): a rejected in-flight promise must never\n          // stay pinned in the cache, or every subsequent call would wedge\n          // on the same rejection instead of retrying.\n          capturedEntry.inFlight = undefined\n        }\n      }\n    },\n  }\n}\n","/**\n * `@noy-db/hub/broker` — subpath export for the credential-broker capability\n * (#479, credential-broker spec). Apps that never call `vault.broker()` can\n * exclude this subpath entirely: the floor default `NO_BROKER` throws, and\n * this module's real engine (`with-party/broker/{seed,active}.ts`) is only\n * ever reached through `withBroker()`'s dynamic imports, so it never enters\n * a floor bundle.\n *\n * Also re-exports the host-side helpers (`issueChallenge`, `verifyBrokerProof`)\n * from the enclave barrel, so a Lambda/Worker implementing the reference\n * broker host can import just this one subpath and get everything it\n * needs, `crypto.subtle`-only.\n */\n\n// ─── Capability opt-in seam ──────────────────────────────────\nexport { withBroker } from './active.js'\nexport {\n  NO_BROKER,\n  type BrokerStrategy,\n  type BrokerCtx,\n  type BrokerConfig,\n  type CredentialBrokerHandle,\n} from '../../port/with/broker-strategy.js'\nexport { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js'\n\n// ─── Host helpers (verify side — for a reference broker host) ───\nimport { issueChallenge as issueChallengeRaw, verifyBrokerProof } from '../../capsule/index.js'\nimport type { IssuedChallenge, VerifyBrokerProofArgs, BrokerMemberIdentity } from '../../capsule/index.js'\n\n/**\n * Floor — a challenge TTL must survive network latency + clock drift\n * between host and client. The enclave's `issueChallenge` is deliberately\n * unclamped (a mechanical primitive, not a policy); this floor is host\n * POLICY, so it lives here in the party layer, not\n * `capsule/enclave-aes/broker/proof.ts` (carried forward from Task 2's review,\n * I6b).\n */\nconst MIN_CHALLENGE_TTL_MS = 10_000\n/** Ceiling — spec §2 step 2: \"TTL ≤ 60 s\". */\nconst MAX_CHALLENGE_TTL_MS = 60_000\n\n/**\n * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a\n * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel\n * gets a safe challenge TTL without having to know the bounds itself.\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const requested = opts?.ttlMs ?? MAX_CHALLENGE_TTL_MS\n  const clamped = Math.min(Math.max(requested, MIN_CHALLENGE_TTL_MS), MAX_CHALLENGE_TTL_MS)\n  return issueChallengeRaw({ ttlMs: clamped })\n}\nexport { verifyBrokerProof }\nexport type { VerifyBrokerProofArgs, BrokerMemberIdentity }\n\n// #837 — issueChallenge's return type must be nameable from this entry.\nexport type { IssuedChallenge } from '../../capsule/index.js'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,kBAAkB;AAGxB,IAAM,eAAe;AAOrB,SAAS,WAAW,OAAyB,QAAwB;AACnE,QAAM,cAAc,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,IAAI,IAAI,SAAS;AAC1F,SAAO,KAAK,IAAI,cAAc,QAAQ,KAAK,IAAI,IAAI,YAAY;AACjE;AAEO,SAAS,WAAW,QAAsC;AAC/D,QAAM,QAAQ,oBAAI,IAAwB;AAE1C,SAAO;AAAA,IACL,MAAM,OAAO,KAAK;AAChB,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,OAAO,KAAK;AAOhB,YAAM,cAAc,GAAG,IAAI,KAAK;AAChC,YAAM,SAAS,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,WAAW,CAAC;AACjF,YAAM,WAAW,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAsC,MAAM,MAAS;AAChH,YAAM,QAAQ,WAAW,QAAQ;AACjC,iBAAW,CAAC,GAAG,KAAK,OAAQ,OAAM,OAAO,GAAG;AAC5C,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,YAAY,KAAK,QAAQ;AAC7B,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,qBAAW;AACpD,aAAO,gBAAgB,EAAE,GAAG,KAAK,OAAO,GAAG,MAAM;AAAA,IACnD;AAAA,IACA,MAAM,aAAa,KAAK,QAAQ;AAC9B,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,qBAAW;AACrD,aAAO,iBAAiB,EAAE,GAAG,KAAK,OAAO,GAAG,MAAM;AAAA,IACpD;AAAA,IACA,iBAAiB,KAAgB,SAAyC;AACxE,YAAM,MAAM,GAAG,IAAI,KAAK,KAAK,WAAW,EAAE;AAC1C,aAAO,YAAY;AACjB,YAAI,QAAQ,MAAM,IAAI,GAAG;AACzB,YAAI,CAAC,OAAO;AACV,kBAAQ,CAAC;AACT,gBAAM,IAAI,KAAK,KAAK;AAAA,QACtB;AACA,cAAM,MAAM,KAAK,IAAI;AACrB,YAAI,MAAM,UAAU,MAAM,MAAM,OAAO,WAAY,QAAO,MAAM,OAAO;AACvE,YAAI,MAAM,SAAU,QAAO,MAAM;AAEjC,cAAM,SAAS,OAAO,UAAU;AAChC,cAAM,gBAAgB;AACtB,cAAM,YAAY,YAAY;AAC5B,gBAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,qBAAW;AACzD,gBAAM,QAAQ,MAAM,qBAAqB,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO;AACpE,wBAAc,SAAS,EAAE,OAAO,YAAY,WAAW,OAAO,MAAM,EAAE;AACtE,iBAAO;AAAA,QACT,GAAG;AACH,cAAM,WAAW;AACjB,YAAI;AACF,iBAAO,MAAM;AAAA,QACf,UAAE;AAIA,wBAAc,WAAW;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACjEA,IAAM,uBAAuB;AAE7B,IAAM,uBAAuB;AAOtB,SAASA,gBAAe,MAA4C;AACzE,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,UAAU,KAAK,IAAI,KAAK,IAAI,WAAW,oBAAoB,GAAG,oBAAoB;AACxF,SAAO,eAAkB,EAAE,OAAO,QAAQ,CAAC;AAC7C;","names":["issueChallenge"]}
+{"version":3,"sources":["../../src/with-party/broker/active.ts","../../src/with-party/broker/index.ts"],"sourcesContent":["/**\n * Enable the credential-broker capability (#479, spec §5).\n *\n * Pass to `createNoydb({ brokerStrategy: withBroker(config) })` to make\n * `vault.broker()` live. Each method dynamic-imports the seed lifecycle\n * engine (`./seed.js`) — mirroring `via/classified/active.ts`'s per-method\n * dynamic-import seam — so `with-party/broker/seed.ts` (the heavy module:\n * the CAS enrol, quiesce-then-swap rotate, and the challenge/response round\n * trip) is reachable only through the `@noy-db/hub/broker` subpath and\n * never enters the single-user floor bundle.\n *\n * The single-flight, per-vault-per-profile refresh cache (H-6/I6) lives\n * HERE, in this factory's closure — shared across every `credentialSource(profile)`\n * call for this one broker instance (in turn shared across every vault of a\n * `createNoydb()` instance — `vault.broker()` passes the SAME `BrokerStrategy`\n * for all of them), so `rotate()` can quiesce it (await any in-flight\n * round-trip, then drop it) before the seed swap. The cache key is\n * `${vault}\\0${profile}` — keyed by vault FIRST, or two vaults sharing this\n * one strategy would collide and hand vault-B a cached credential minted\n * (and STS-scoped) for vault-A.\n */\nimport type { BrokerStrategy, BrokerConfig, BrokerCtx } from '../../port/with/broker-strategy.js'\nimport type { StoreCredentials, StoreCredentialSource } from '../../kernel/types.js'\n\nconst DEFAULT_SKEW_MS = 60_000\n/** Floor under the skew-adjusted boundary so a sub-skew credential TTL\n *  doesn't collapse to \"already expired\" and thrash re-proving every call (I6b). */\nconst MIN_CACHE_MS = 1_000\n\ninterface CacheEntry {\n  cached?: { creds: StoreCredentials; validUntil: number } | undefined\n  inFlight?: Promise<StoreCredentials> | undefined\n}\n\nfunction cacheFloor(creds: StoreCredentials, skewMs: number): number {\n  const expiresAtMs = creds.expiresAt ? Date.parse(creds.expiresAt) : Date.now() + skewMs * 2\n  return Math.max(expiresAtMs - skewMs, Date.now() + MIN_CACHE_MS)\n}\n\nexport function withBroker(config: BrokerConfig): BrokerStrategy {\n  const cache = new Map<string, CacheEntry>()\n\n  return {\n    async enroll(ctx) {\n      const { enrollSeed } = await import('./seed.js')\n      return enrollSeed({ ...ctx, config })\n    },\n    async rotate(ctx) {\n      // Quiesce (I5): let any in-flight round-trip finish (it may still be\n      // proving under the pre-rotation seed) before the local record is\n      // overwritten, then drop the cache — scoped to THIS vault's entries\n      // only (`${ctx.vault}\\0`-prefixed keys). A global cache.clear() here\n      // would blow away every OTHER vault's cache on this shared strategy\n      // too — same root cause as the cross-vault read collision this fixes.\n      const vaultPrefix = `${ctx.vault}\\0`\n      const scoped = [...cache.entries()].filter(([key]) => key.startsWith(vaultPrefix))\n      const inFlight = scoped.map(([, e]) => e.inFlight).filter((p): p is Promise<StoreCredentials> => p !== undefined)\n      await Promise.allSettled(inFlight)\n      for (const [key] of scoped) cache.delete(key)\n      const { rotateSeed } = await import('./seed.js')\n      return rotateSeed({ ...ctx, config })\n    },\n    async enrolMember(ctx, member) {\n      const { enrolMemberSeed } = await import('./seed.js')\n      return enrolMemberSeed({ ...ctx, config }, member)\n    },\n    async revokeMember(ctx, userId) {\n      const { revokeMemberSeed } = await import('./seed.js')\n      return revokeMemberSeed({ ...ctx, config }, userId)\n    },\n    credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource {\n      const key = `${ctx.vault}\\0${profile ?? ''}`\n      return async () => {\n        let entry = cache.get(key)\n        if (!entry) {\n          entry = {}\n          cache.set(key, entry)\n        }\n        const now = Date.now()\n        if (entry.cached && now < entry.cached.validUntil) return entry.cached.creds\n        if (entry.inFlight) return entry.inFlight\n\n        const skewMs = config.skewMs ?? DEFAULT_SKEW_MS\n        const capturedEntry = entry\n        const inFlight = (async () => {\n          const { mintStoreCredentials } = await import('./seed.js')\n          const creds = await mintStoreCredentials({ ...ctx, config }, profile)\n          capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) }\n          return creds\n        })()\n        entry.inFlight = inFlight\n        try {\n          return await inFlight\n        } finally {\n          // Clear-on-settle (I6a): a rejected in-flight promise must never\n          // stay pinned in the cache, or every subsequent call would wedge\n          // on the same rejection instead of retrying.\n          capturedEntry.inFlight = undefined\n        }\n      }\n    },\n  }\n}\n","/**\n * `@noy-db/hub/broker` — subpath export for the credential-broker capability\n * (#479, credential-broker spec). Apps that never call `vault.broker()` can\n * exclude this subpath entirely: the floor default `NO_BROKER` throws, and\n * this module's real engine (`with-party/broker/{seed,active}.ts`) is only\n * ever reached through `withBroker()`'s dynamic imports, so it never enters\n * a floor bundle.\n *\n * Also re-exports the host-side helpers (`issueChallenge`, `verifyBrokerProof`)\n * from the enclave barrel, so a Lambda/Worker implementing the reference\n * broker host can import just this one subpath and get everything it\n * needs, `crypto.subtle`-only.\n */\n\n// ─── Capability opt-in seam ──────────────────────────────────\nexport { withBroker } from './active.js'\nexport {\n  NO_BROKER,\n  type BrokerStrategy,\n  type BrokerCtx,\n  type BrokerConfig,\n  type CredentialBrokerHandle,\n} from '../../port/with/broker-strategy.js'\nexport { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js'\n\n// ─── Host helpers (verify side — for a reference broker host) ───\nimport { issueChallenge as issueChallengeRaw, verifyBrokerProof } from '../../capsule/index.js'\nimport type { IssuedChallenge, VerifyBrokerProofArgs, BrokerMemberIdentity } from '../../capsule/index.js'\n\n/**\n * Floor — a challenge TTL must survive network latency + clock drift\n * between host and client. The enclave's `issueChallenge` is deliberately\n * unclamped (a mechanical primitive, not a policy); this floor is host\n * POLICY, so it lives here in the party layer, not\n * `capsule/enclave-aes/broker/proof.ts` (carried forward from Task 2's review,\n * I6b).\n */\nconst MIN_CHALLENGE_TTL_MS = 10_000\n/** Ceiling — spec §2 step 2: \"TTL ≤ 60 s\". */\nconst MAX_CHALLENGE_TTL_MS = 60_000\n\n/**\n * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a\n * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel\n * gets a safe challenge TTL without having to know the bounds itself.\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const requested = opts?.ttlMs ?? MAX_CHALLENGE_TTL_MS\n  const clamped = Math.min(Math.max(requested, MIN_CHALLENGE_TTL_MS), MAX_CHALLENGE_TTL_MS)\n  return issueChallengeRaw({ ttlMs: clamped })\n}\nexport { verifyBrokerProof }\nexport type { VerifyBrokerProofArgs, BrokerMemberIdentity }\n\n// #837 — issueChallenge's return type must be nameable from this entry.\nexport type { IssuedChallenge } from '../../capsule/index.js'\n"],"mappings":";;;;;;;;;;;;;;;;;AAwBA,IAAM,kBAAkB;AAGxB,IAAM,eAAe;AAOrB,SAAS,WAAW,OAAyB,QAAwB;AACnE,QAAM,cAAc,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,IAAI,IAAI,SAAS;AAC1F,SAAO,KAAK,IAAI,cAAc,QAAQ,KAAK,IAAI,IAAI,YAAY;AACjE;AAEO,SAAS,WAAW,QAAsC;AAC/D,QAAM,QAAQ,oBAAI,IAAwB;AAE1C,SAAO;AAAA,IACL,MAAM,OAAO,KAAK;AAChB,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,OAAO,KAAK;AAOhB,YAAM,cAAc,GAAG,IAAI,KAAK;AAChC,YAAM,SAAS,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,WAAW,CAAC;AACjF,YAAM,WAAW,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAsC,MAAM,MAAS;AAChH,YAAM,QAAQ,WAAW,QAAQ;AACjC,iBAAW,CAAC,GAAG,KAAK,OAAQ,OAAM,OAAO,GAAG;AAC5C,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,YAAY,KAAK,QAAQ;AAC7B,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,qBAAW;AACpD,aAAO,gBAAgB,EAAE,GAAG,KAAK,OAAO,GAAG,MAAM;AAAA,IACnD;AAAA,IACA,MAAM,aAAa,KAAK,QAAQ;AAC9B,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,qBAAW;AACrD,aAAO,iBAAiB,EAAE,GAAG,KAAK,OAAO,GAAG,MAAM;AAAA,IACpD;AAAA,IACA,iBAAiB,KAAgB,SAAyC;AACxE,YAAM,MAAM,GAAG,IAAI,KAAK,KAAK,WAAW,EAAE;AAC1C,aAAO,YAAY;AACjB,YAAI,QAAQ,MAAM,IAAI,GAAG;AACzB,YAAI,CAAC,OAAO;AACV,kBAAQ,CAAC;AACT,gBAAM,IAAI,KAAK,KAAK;AAAA,QACtB;AACA,cAAM,MAAM,KAAK,IAAI;AACrB,YAAI,MAAM,UAAU,MAAM,MAAM,OAAO,WAAY,QAAO,MAAM,OAAO;AACvE,YAAI,MAAM,SAAU,QAAO,MAAM;AAEjC,cAAM,SAAS,OAAO,UAAU;AAChC,cAAM,gBAAgB;AACtB,cAAM,YAAY,YAAY;AAC5B,gBAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,qBAAW;AACzD,gBAAM,QAAQ,MAAM,qBAAqB,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO;AACpE,wBAAc,SAAS,EAAE,OAAO,YAAY,WAAW,OAAO,MAAM,EAAE;AACtE,iBAAO;AAAA,QACT,GAAG;AACH,cAAM,WAAW;AACjB,YAAI;AACF,iBAAO,MAAM;AAAA,QACf,UAAE;AAIA,wBAAc,WAAW;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACjEA,IAAM,uBAAuB;AAE7B,IAAM,uBAAuB;AAOtB,SAASA,gBAAe,MAA4C;AACzE,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,UAAU,KAAK,IAAI,KAAK,IAAI,WAAW,oBAAoB,GAAG,oBAAoB;AACxF,SAAO,eAAkB,EAAE,OAAO,QAAQ,CAAC;AAC7C;","names":["issueChallenge"]}

package/dist/by/index.js

@@ -1,8 +1,8 @@
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-PIEX7WSG.js";
-import "../chunk-JGYCKX56.js";
+} from "../chunk-OOLF5FU2.js";
+import "../chunk-ISIXU45J.js";
 export {
   isQuorum,
   runDrainBarrier

package/dist/capsule/contract.d.ts

@@ -24,12 +24,78 @@ export type CapsuleKeyPair = CryptoKeyPair;
  * The groups a capsule may support. A capsule declares its set via
  * `capabilities()`; a service needing a group asserts at `createNoydb()`.
  *
- * `authenticate` and `seal` are what an `enclave-*` MUST support and an
- * `exclave-*` MUST refuse. That prefix rule is asserted by the conformance
- * suite from the package name, which is what makes the prefix a trust posture
- * rather than a naming convention.
+ * ⭐ `authenticate` AND `seal` ARE POSTURE GROUPS (family#156/#168). They say
+ * whether a capsule holds secrets at all — `authenticate` is `deriveKey`
+ * (secret → KEK) and `seal` is `wrapKey`/`unwrapKey` (KEK wraps DEK), the
+ * keyring's unlock chain. {@link PRIMITIVE_GROUPS} tags no primitive with
+ * either, so no field form and no service implies them: what implies them is
+ * opening a vault with a secret. An `enclave-*` MUST support both and an
+ * `exclave-*` MUST refuse both, and that rule is asserted by the conformance
+ * suite FROM THE PACKAGE NAME — which is what makes the prefix a trust posture
+ * rather than a naming convention, and why a primitive-completeness check names
+ * these two as exempt instead of reporting a green it cannot earn.
+ *
+ * ⛔ THE SHIPPED EXCLAVE DECLARES FOUR AND REFUSES SIX, and the old wording
+ * here named two. `exclave-plain`'s `capabilities()` is exactly `cipher`,
+ * `digest`, `sign`, `codec` — so beyond the two posture groups it also refuses
+ * `per-record-keys`, `deterministic`, `sealing` and `classify`. Reading "an
+ * exclave refuses authenticate and seal" as the whole story is how a consumer
+ * concludes a plaintext capsule can still seal a field.
  */
 export type CapsuleGroup = 'authenticate' | 'seal' | 'cipher' | 'digest' | 'sign' | 'codec' | 'sealing' | 'deterministic' | 'classify' | 'per-record-keys';
+/**
+ * Which group each primitive belongs to — the tag table family#168 asked for,
+ * so `capabilities()` cannot drift from the implementation.
+ *
+ * ⭐ `Record<keyof CapsulePrimitives, …>` IS THE MECHANISM, and the reason this
+ * is a table rather than a comment. A new primitive added without a tag is a
+ * COMPILE error here, and a tag for a primitive that no longer exists is a
+ * compile error too. A hand-kept list of group members is the second copy that
+ * drifts; three vocabularies disagreeing about `per-record-keys` (core#42) is
+ * what that drift looks like when nothing checks it.
+ *
+ * ⚠️ FOUR GROUPS HAVE NO PRIMITIVES, and that is correct, not a gap:
+ *
+ *  - `authenticate` and `seal` are POSTURE groups. They say whether a capsule
+ *    holds secrets at all, which is a property of the implementation's
+ *    intent — enforced by the `enclave-`/`exclave-` package-name rule the
+ *    conformance kit asserts, never by calling a function. A completeness
+ *    check over primitives is VACUOUSLY true for them, so it must name them as
+ *    exempt rather than report a green it cannot earn.
+ *  - `digest` and `sign` are PLUMBING. `sha256Hex`, `generateSigningKeyPair`,
+ *    `signBytes`, `verifyBytes` are shared verbatim by every capsule
+ *    (`plumbing/digest.ts`, `plumbing/sign.ts`) and are deliberately not
+ *    primitives — hashes are not secrets, and a capsule choosing its own hash
+ *    buys nothing but an envelope another capsule cannot read.
+ *
+ * ⛔ `wrapCek`/`unwrapCek` are `per-record-keys`, NOT `seal`. Ruled 2026-10-12
+ * after the two shipped artefacts were found disagreeing: `exclave-plain`
+ * refused them as `'seal'` while this union's own `per-record-keys` member was
+ * added by core#42 expressly for them, and the conformance kit has tested their
+ * refusal under that name since it shipped. The exclave is being corrected.
+ */
+export declare const PRIMITIVE_GROUPS: Readonly<Record<keyof CapsulePrimitives, CapsuleGroup>>;
+/**
+ * The groups `PRIMITIVE_GROUPS` cannot speak for, with the reason.
+ *
+ * Published because a completeness check MUST distinguish "this group has no
+ * unimplemented primitive" from "this group has no primitive to check" — those
+ * are the same green and different facts, and conflating them is how a capsule
+ * declares `seal` while implementing nothing a check can name.
+ */
+export declare const GROUPS_WITHOUT_PRIMITIVES: Readonly<Partial<Record<CapsuleGroup, string>>>;
+/**
+ * The three primitives a capsule MODULE does not expose, so a check driven off
+ * the module object reaches 15 of 18.
+ *
+ * ⚠️ Not a gap in the contract — these are codec-internal by design: the record
+ * codec calls them, nothing outside `capsule/` does, and putting them on the
+ * door would publish the `_vdig` payload format as a consumer-facing API. A
+ * check that silently iterated 15 and reported "every primitive" would be
+ * stating a conjunction it never evaluated, which is this repo's own
+ * false-green shape.
+ */
+export declare const PRIMITIVES_NOT_ON_THE_DOOR: readonly ["mintVdigSlot", "openVdigPayload", "sealVdigPayload"];
 /**
  * Thrown at `createNoydb()` when a service needs a group the bound capsule
  * does not support.
@@ -42,32 +108,75 @@ export type CapsuleGroup = 'authenticate' | 'seal' | 'cipher' | 'digest' | 'sign
  * Refuse at CONSTRUCTION when a service needs a capsule group the bound
  * capsule lacks.
  *
- * ⛔ At startup or not at all. A capability discovered on first write is a
- * half-built vault: some records sealed, a service silently inert, and a
- * consumer who cannot tell a missing capability from a bug. `capabilities()`
- * is a set, so this is a membership test — never a try/catch probe against the
- * primitive itself, which would make "unsupported" and "broken" the same
- * observation.
+ * ⛔ At startup or not at all, and "startup" is TWO POINTS since family#156:
+ * `createNoydb()` for an enabled SERVICE, and `vault.collection()` for a
+ * declared FIELD. Both are needed — a `classifiedFields` declaration writes
+ * `_vdig` with no `classifiedStrategy` at all, so a single check at
+ * `createNoydb()` would leave every write-side requirement unenforced while
+ * looking complete. See `kernel/capsule-requirements.ts`.
+ *
+ * A capability discovered on first write is a half-built vault: some records
+ * sealed, a service silently inert, and a consumer who cannot tell a missing
+ * capability from a bug. `capabilities()` is a set, so this is a membership
+ * test — never a try/catch probe against the primitive itself, which would make
+ * "unsupported" and "broken" the same observation.
  *
  * Lives on the CONTRACT, not in the kernel: it depends on nothing but the
  * declared set, and every capsule's consumers need the same assertion.
  *
- * ⚠️ Per-service wiring is deliberately NOT done yet. `enclave-aes` supports
- * every group, so every call site would be unreachable code behind an
- * untestable branch. It lands in Stage C with `exclave-plain`, which is the
- * first capsule that refuses anything. Until then this is exercised against a
- * stub set — see `__tests__/capsule-capabilities.test.ts`.
+ * ⚠️ WIRED SINCE family#156, and the reason it waited still shapes how it is
+ * tested: `enclave-aes` supports every group, so NO integration path in this
+ * repo can reach a refusal, and a test that opens a real vault proves nothing
+ * about whether the assertion exists. So the requirement tables are pure
+ * functions tested against stub sets
+ * (`__tests__/capsule-requirements.test.ts`) and a separate file mocks
+ * `capabilities()` down to the exclave's four groups to prove the call sites
+ * actually call them (`__tests__/capsule-requirements-wiring.test.ts`). A
+ * predicate with no wiring test is the family#172 defect by construction.
  */
 export declare function assertCapsuleSupports(caps: ReadonlySet<CapsuleGroup>, group: CapsuleGroup, requirer: string): void;
+/**
+ * ⭐ THE CANONICAL not-supported refusal, ruled 2026-10-12 (family#168). Hub
+ * throws it, and every capsule throws it for a group it refuses.
+ *
+ * ⛔ `EnclaveNotSupportedError` (`kernel/errors.ts`, code `ENCLAVE_NOT_SUPPORTED`)
+ * is DEPRECATED and removed at a later breaking cut. Two classes with two codes
+ * shipped side by side: hub never threw the enclave one, `exclave-plain` threw
+ * this one, and the conformance kit matched only the enclave code — so a capsule
+ * refusing a group CORRECTLY was reported as not refusing at all. The kit now
+ * accepts both codes so existing forks keep passing; new code throws this.
+ */
 export declare class CapsuleNotSupportedError extends NoydbError {
     readonly group: CapsuleGroup;
     readonly requirer: string;
     constructor(group: CapsuleGroup, requirer: string);
 }
 /**
- * The 13 cipher primitives the shared plumbing needs — the ENTIRE surface a
+ * Re-exported at the capsule seam (family#156), because a capsule author binding
+ * `@noy-db/hub/capsule` could not previously catch — or construct — the error
+ * their own capsule is expected to THROW.
+ *
+ * ⛔ The asymmetry was the defect: `classify/vdig.ts` raises `TamperedError` on
+ * any AAD or auth-tag mismatch, and `record-codec.ts` converts a subtle
+ * `OperationError` into one, so it is part of the contract a capsule implements.
+ * It shipped only on hub's ROOT barrel, so a capsule package — which must not
+ * import hub's root, that being the whole point of a narrow seam — had to
+ * either re-declare it (two classes, `instanceof` false across the door) or
+ * throw something hub does not recognise.
+ *
+ * ⚠️ Only the base error belongs here. `KeyringTamperedError` is raised by the
+ * keyring, which lives in the kernel on hub's side of the seam — a capsule never
+ * throws it and does not need to name it.
+ */
+export { TamperedError } from '../kernel/errors.js';
+/**
+ * The cipher primitives the shared plumbing needs — the ENTIRE surface a
  * capsule must actually implement.
  *
+ * ⛔ NO COUNT IS STATED HERE, deliberately. This docstring said "the 13 cipher
+ * primitives" while the interface had 16 members, and family#168 added two
+ * more; nothing fails when a number in prose goes stale. Count the members.
+ *
  * ⭐ This is the measurement that shaped Stage C. `enclave-aes` is ~4,200
  * lines, but only ~1,200 of them touch `crypto.subtle`; the other ~3,000 are
  * envelope assembly, record-identity AAD, tombstones and the record codec —
@@ -126,6 +235,39 @@ export interface CapsulePrimitives<K = CapsuleKey> {
     bufferToBase64: (buffer: ArrayBuffer | Uint8Array) => string;
     mintVdigSlot: (value: string, policy: VdigFieldPolicy, prevBlob: string | undefined, cek: K, collection: string, id: string, field: string) => Promise<string>;
     mintBidxTag: (normalized: string, dek: K, collection: string, field: string) => Promise<string>;
+    /**
+     * PBKDF2-SHA256 → a fixed 32-byte verify digest over a PRE-NORMALIZED
+     * candidate. Promoted to a primitive by family#168.
+     *
+     * ⭐ It was already a door export and already implemented by both shipped
+     * capsules (`enclave-aes` for real, `exclave-plain` as a `refuse('classify')`
+     * throw) — but it was not a primitive, so the plumbing could not call it, so
+     * the verify oracle that needs it had to live INSIDE the reference capsule
+     * and be reached by a dynamic import past the barrel. The missing declaration
+     * was the whole reason for `DYNAMIC_ENCLAVE_BYPASS`.
+     *
+     * ⚠️ `iterations` is a PARAMETER, not a constant read from the capsule: a
+     * stored `_vdig` payload carries its own authenticated `iter`, and a verify
+     * must digest at the value the payload declares or it cannot compare against
+     * a record written before an iteration bump.
+     */
+    pbkdf2VerifyDigest: (value: string, salt: Uint8Array, iterations: number) => Promise<Uint8Array>;
+    /**
+     * Blinded equality of two arbitrary-length byte strings — the ONE comparison
+     * construction the classify engines use (capsule seam spec §3 rule 2).
+     * Promoted by family#168 alongside `pbkdf2VerifyDigest`.
+     *
+     * ⛔ It is a CAPSULE primitive, not plumbing, although the comparison itself
+     * is cipher-free: the reference construction reduces both comparands to
+     * 32-byte tags under a fresh ephemeral HMAC key, which is WebCrypto, and
+     * `capsule/plumbing/**` may not call `crypto.subtle` (Check 10b). A capsule
+     * with no MAC of its own answers the whole `classify` group with a throw.
+     *
+     * ⚠️ The constant-time tag compare it ends in (`ctEqualTags`) IS plumbing and
+     * stays shared — a capsule choosing the blinding must not also get to choose
+     * whether the final compare is constant-time.
+     */
+    blindedEqual: (a: Uint8Array, b: Uint8Array) => Promise<boolean>;
     /** The vdig payload is sealed under a capsule-derived slot key, so open/seal
      *  are the capsule's, not the plumbing's. `rotateRecordCek` needs both to
      *  carry a classified slot across a key rotation. */
@@ -138,6 +280,24 @@ export interface VdigDigestEntry {
     readonly salt: string;
     readonly hash: string;
 }
+/**
+ * The family's verify-digest iteration count (600K) — the value a NEW `_vdig`
+ * slot is written at, and the default cost of the verify engines' C4 timing pad.
+ *
+ * ⚠️ A STORED payload's `iter` wins over this constant everywhere. This is the
+ * write-side default only; a record written before an iteration bump must still
+ * verify, which is why {@link CapsulePrimitives.pbkdf2VerifyDigest} takes
+ * `iterations` as an argument.
+ *
+ * ⭐ It lives on the SEAM, next to the payload type that declares `iter`, for a
+ * mechanical reason found in family#168: the verify engines moved into
+ * `capsule/plumbing/` and must stay behind a lazy `import()` (they carry a
+ * PBKDF2 oracle no consumer should pay for), while the enclave's WRITE side
+ * needs the same constant eagerly. Importing it from the engine module would
+ * have made the engine eager and silently undone the laziness — and the only
+ * trace would have been a bundle-baseline number.
+ */
+export declare const VDIG_ITERATIONS = 600000;
 export interface VdigPayload {
     readonly v: 1;
     readonly alg: 'PBKDF2-SHA256';

package/dist/capsule/contract.js

@@ -1,22 +1,40 @@
 import {
   CapsuleNotSupportedError,
-  assertCapsuleSupports
-} from "../chunk-OJAFKGI7.js";
-import {
+  GROUPS_WITHOUT_PRIMITIVES,
+  KEY_BITS,
+  PRIMITIVES_NOT_ON_THE_DOOR,
+  PRIMITIVE_GROUPS,
+  VDIG_ITERATIONS,
+  assertCapsuleSupports,
+  base64ToBuffer,
+  bufferToBase64,
+  ctEqualTags,
+  deriveBlobAddressKey,
+  derivePresenceKey,
+  derivePresenceTagKey,
+  encodeEchoParts,
+  evaluateKofN,
+  generateIV,
+  generateRecoverySecret,
+  generateSalt,
   generateSigningKeyPair,
+  hkdfAesGcmKey,
+  hmacSha256Hex,
+  hmacSignHex,
+  makeCapsule,
+  normalizeForVerify,
+  parseSealedSlot,
+  sha256Bytes,
+  sha256Hex,
   signBytes,
   verifyBytes
-} from "../chunk-6B4X447I.js";
-import {
-  evaluateKofN
-} from "../chunk-NH2UOV3B.js";
+} from "../chunk-I4S7IZSS.js";
 import {
   buildDeleteMarker,
   buildRecordAad,
   buildRecordEnvelope,
   buildSealedRecordEnvelope,
   buildTombstone,
-  ctEqualTags,
   envelopeBodyForHash,
   envelopeBodySize,
   hasPerRecordKey,
@@ -24,35 +42,22 @@ import {
   isDeleteMarker,
   isTombstone,
   isTombstoneShape,
-  makeCapsule,
-  parseSealedSlot,
   recordAadFor,
   requireSealedBody,
   sealedBodyArgs
-} from "../chunk-YIVAKBCW.js";
+} from "../chunk-XWWDZKLS.js";
+import "../chunk-CR5UPYIJ.js";
 import {
-  KEY_BITS,
-  base64ToBuffer,
-  bufferToBase64,
-  deriveBlobAddressKey,
-  derivePresenceKey,
-  derivePresenceTagKey,
-  encodeEchoParts,
-  generateIV,
-  generateRecoverySecret,
-  generateSalt,
-  hkdfAesGcmKey,
-  hmacSha256Hex,
-  hmacSignHex,
-  normalizeForVerify,
-  sha256Bytes,
-  sha256Hex
-} from "../chunk-6Y3UJT5H.js";
-import "../chunk-VUBRHJ4H.js";
-import "../chunk-JGYCKX56.js";
+  TamperedError
+} from "../chunk-ISIXU45J.js";
 export {
   CapsuleNotSupportedError,
+  GROUPS_WITHOUT_PRIMITIVES,
   KEY_BITS,
+  PRIMITIVES_NOT_ON_THE_DOOR,
+  PRIMITIVE_GROUPS,
+  TamperedError,
+  VDIG_ITERATIONS,
   assertCapsuleSupports,
   base64ToBuffer,
   bufferToBase64,

package/dist/capsule/enclave-aes/bound.d.ts

@@ -48,5 +48,15 @@ export declare const aesCapsule: {
         perRecordKey?: boolean;
     }) => Promise<Pick<import("../../index.js").EncryptedEnvelope, "_iv" | "_data" | "_cek">>;
     verifyRecordIdentity: (ref: import("./index.js").RecordRef, env: import("../../index.js").EncryptedEnvelope, key: import("../contract.js").CapsuleKey) => Promise<boolean>;
+    revealSealedField: (ctx: import("../plumbing/classify-reveal.js").RevealEngineCtx, id: string, field: string) => Promise<unknown>;
+    verifyDigestField: (ctx: import("../plumbing/classify-verify.js").VerifyEngineCtx, id: string, field: string, candidate: string, policy: import("../../kernel/types.js").VdigFieldPolicy) => Promise<import("../../index.js").ClassifiedVerdict>;
+    verifyTextField: (ctx: import("../plumbing/classify-verify.js").VerifyEngineCtx, id: string, field: string, candidate: string, normalize: import("../plumbing/normalize.js").VerifyNormalizeMode) => Promise<import("../../index.js").ClassifiedVerdict>;
+    matchGroupFields: (ctx: import("../plumbing/classify-verify.js").VerifyEngineCtx, id: string, answers: Record<string, string>, members: ReadonlyArray<{
+        readonly field: string;
+        readonly policy: import("../../kernel/types.js").VdigFieldPolicy;
+    }>, opts: {
+        readonly min: number;
+    }) => Promise<{
+        readonly passed: boolean;
+    }>;
 };
-export declare const dualReadSealedSlot: (blob: string, field: string, collection: string, cek: CryptoKey | undefined, dek: CryptoKey) => Promise<string>;

package/dist/capsule/enclave-aes/classify/digest.d.ts

@@ -1,5 +1,7 @@
-/** Family KDF constant — matches crypto.ts PBKDF2_ITERATIONS (600K). */
-export declare const VDIG_ITERATIONS = 600000;
+/** Family KDF constant — matches crypto.ts PBKDF2_ITERATIONS (600K). Owned by
+ *  the seam (`contract.ts`) since family#168 and re-exported here, so the write
+ *  side and the plumbing verify engines cannot drift to two numbers. */
+export { VDIG_ITERATIONS } from '../../contract.js';
 /**
  * Digest a (pre-normalized) candidate/value to exactly 32 bytes.
  * PBKDF2-SHA256 with a per-record per-write random salt (§2): verify

package/dist/capsule/enclave-aes/index.d.ts

@@ -101,8 +101,17 @@ export declare const openEnvelopeJson: (ref: import("./index.js").RecordRef, env
 }) => Promise<void>, rotateRecordCek: (ctx: import("./index.js").SealingContext, collection: string, id: string) => Promise<void>, findByDet: <T>(ctx: import("./index.js").DeterministicContext<T>, field: string, value: unknown) => Promise<T | null>, queryByDet: <T>(ctx: import("./index.js").DeterministicContext<T>, field: string, value: unknown) => Promise<T[]>;
 export { deriveVdigSlotKey } from './classify/vdig.js';
 export { pbkdf2VerifyDigest } from './classify/digest.js';
+export { blindedEqual } from './classify/compare.js';
 export { ctEqualTags } from '../plumbing/ct-equal.js';
 export { evaluateKofN } from '../plumbing/kofn.js';
+export declare const revealSealedField: (ctx: import("../plumbing/classify-reveal.js").RevealEngineCtx, id: string, field: string) => Promise<unknown>, verifyDigestField: (ctx: import("../plumbing/classify-verify.js").VerifyEngineCtx, id: string, field: string, candidate: string, policy: import("../../kernel/types.js").VdigFieldPolicy) => Promise<import("../../index.js").ClassifiedVerdict>, verifyTextField: (ctx: import("../plumbing/classify-verify.js").VerifyEngineCtx, id: string, field: string, candidate: string, normalize: import("../plumbing/normalize.js").VerifyNormalizeMode) => Promise<import("../../index.js").ClassifiedVerdict>, matchGroupFields: (ctx: import("../plumbing/classify-verify.js").VerifyEngineCtx, id: string, answers: Record<string, string>, members: ReadonlyArray<{
+    readonly field: string;
+    readonly policy: import("../../kernel/types.js").VdigFieldPolicy;
+}>, opts: {
+    readonly min: number;
+}) => Promise<{
+    readonly passed: boolean;
+}>;
 export { deriveClassifyIndexKey, deriveClassifyIndexSalt, mintBidxTag } from './classify/bidx.js';
 export { computeBidxTarget } from './classify/find.js';
 export { deriveBrokerProofBits, deriveBrokerProofKey, computeBrokerProof, issueChallenge, verifyBrokerProof, } from './broker/proof.js';