@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.2

package/dist/chunk-5O3AOPDT.js

@@ -0,0 +1,992 @@
+import {
+  NOYDB_FORMAT_VERSION,
+  SealedHandle
+} from "./chunk-5TDJ56JE.js";
+import {
+  DebugReservedFieldError,
+  DecryptionError,
+  InvalidKeyError,
+  RecordCekNotFoundError,
+  SchemaValidationError,
+  TamperedError,
+  ValidationError
+} from "./chunk-ZYUC53LT.js";
+
+// src/kernel/enclave/crypto.ts
+var PBKDF2_ITERATIONS = 6e5;
+var SALT_BYTES = 32;
+var IV_BYTES = 12;
+var KEY_BITS = 256;
+var subtle = globalThis.crypto.subtle;
+async function deriveKey(passphrase, salt) {
+  const keyMaterial = await subtle.importKey(
+    "raw",
+    new TextEncoder().encode(passphrase),
+    "PBKDF2",
+    false,
+    ["deriveKey"]
+  );
+  return subtle.deriveKey(
+    {
+      name: "PBKDF2",
+      salt,
+      iterations: PBKDF2_ITERATIONS,
+      hash: "SHA-256"
+    },
+    keyMaterial,
+    { name: "AES-KW", length: KEY_BITS },
+    false,
+    ["wrapKey", "unwrapKey"]
+  );
+}
+async function derivePassphraseKey(passphrase, salt, params) {
+  const keyMaterial = await subtle.importKey(
+    "raw",
+    new TextEncoder().encode(passphrase),
+    "PBKDF2",
+    false,
+    ["deriveKey"]
+  );
+  return params.keyUsage === "aes-gcm" ? subtle.deriveKey(
+    {
+      name: "PBKDF2",
+      salt,
+      iterations: params.iterations,
+      hash: "SHA-256"
+    },
+    keyMaterial,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  ) : subtle.deriveKey(
+    {
+      name: "PBKDF2",
+      salt,
+      iterations: params.iterations,
+      hash: "SHA-256"
+    },
+    keyMaterial,
+    { name: "AES-KW", length: KEY_BITS },
+    false,
+    ["wrapKey", "unwrapKey"]
+  );
+}
+async function generateDEK() {
+  return subtle.generateKey(
+    { name: "AES-GCM", length: KEY_BITS },
+    true,
+    // extractable — needed for AES-KW wrapping
+    ["encrypt", "decrypt"]
+  );
+}
+async function wrapKey(dek, kek) {
+  const wrapped = await subtle.wrapKey("raw", dek, kek, "AES-KW");
+  return bufferToBase64(wrapped);
+}
+async function unwrapKey(wrappedBase64, kek) {
+  try {
+    return await subtle.unwrapKey(
+      "raw",
+      base64ToBuffer(wrappedBase64),
+      kek,
+      "AES-KW",
+      { name: "AES-GCM", length: KEY_BITS },
+      true,
+      ["encrypt", "decrypt"]
+    );
+  } catch {
+    throw new InvalidKeyError();
+  }
+}
+async function asKwKey(dek) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-cek-wrap");
+  const info = new TextEncoder().encode("v1");
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey("raw", bits, "AES-KW", false, ["wrapKey", "unwrapKey"]);
+}
+async function wrapCek(cek, dek) {
+  const kw = await asKwKey(dek);
+  const wrapped = await subtle.wrapKey("raw", cek, kw, "AES-KW");
+  return bufferToBase64(wrapped);
+}
+async function unwrapCek(wrappedBase64, dek) {
+  const kw = await asKwKey(dek);
+  try {
+    return await subtle.unwrapKey(
+      "raw",
+      base64ToBuffer(wrappedBase64),
+      kw,
+      "AES-KW",
+      { name: "AES-GCM", length: KEY_BITS },
+      true,
+      ["encrypt", "decrypt"]
+    );
+  } catch {
+    throw new InvalidKeyError();
+  }
+}
+async function importCek(rawKey) {
+  return subtle.importKey("raw", rawKey, { name: "AES-GCM", length: KEY_BITS }, false, ["decrypt"]);
+}
+async function encrypt(plaintext, dek) {
+  const iv = generateIV();
+  const encoded = new TextEncoder().encode(plaintext);
+  const ciphertext = await subtle.encrypt(
+    { name: "AES-GCM", iv },
+    dek,
+    encoded
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decrypt(ivBase64, dataBase64, dek) {
+  const iv = base64ToBuffer(ivBase64);
+  const ciphertext = base64ToBuffer(dataBase64);
+  try {
+    const plaintext = await subtle.decrypt(
+      { name: "AES-GCM", iv },
+      dek,
+      ciphertext
+    );
+    return new TextDecoder().decode(plaintext);
+  } catch (err) {
+    if (err instanceof Error && err.name === "OperationError") {
+      throw new TamperedError();
+    }
+    throw new DecryptionError(
+      err instanceof Error ? err.message : "Decryption failed"
+    );
+  }
+}
+async function encryptBytes(data, dek) {
+  const iv = generateIV();
+  const ciphertext = await subtle.encrypt(
+    { name: "AES-GCM", iv },
+    dek,
+    data
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decryptBytes(ivBase64, dataBase64, dek) {
+  const iv = base64ToBuffer(ivBase64);
+  const ciphertext = base64ToBuffer(dataBase64);
+  try {
+    const plaintext = await subtle.decrypt(
+      { name: "AES-GCM", iv },
+      dek,
+      ciphertext
+    );
+    return new Uint8Array(plaintext);
+  } catch (err) {
+    if (err instanceof Error && err.name === "OperationError") {
+      throw new TamperedError();
+    }
+    throw new DecryptionError(
+      err instanceof Error ? err.message : "Decryption failed"
+    );
+  }
+}
+async function sha256Hex(data) {
+  const hash = await subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function hmacSha256Hex(key, data) {
+  const rawKey = await subtle.exportKey("raw", key);
+  const hmacKey = await subtle.importKey(
+    "raw",
+    rawKey,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await subtle.sign("HMAC", hmacKey, data);
+  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function encryptBytesWithAAD(data, dek, aad) {
+  const iv = generateIV();
+  const ciphertext = await subtle.encrypt(
+    {
+      name: "AES-GCM",
+      iv,
+      additionalData: aad
+    },
+    dek,
+    data
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decryptBytesWithAAD(ivBase64, dataBase64, dek, aad) {
+  const iv = base64ToBuffer(ivBase64);
+  const ciphertext = base64ToBuffer(dataBase64);
+  try {
+    const plaintext = await subtle.decrypt(
+      {
+        name: "AES-GCM",
+        iv,
+        additionalData: aad
+      },
+      dek,
+      ciphertext
+    );
+    return new Uint8Array(plaintext);
+  } catch (err) {
+    if (err instanceof Error && err.name === "OperationError") {
+      throw new TamperedError();
+    }
+    throw new DecryptionError(
+      err instanceof Error ? err.message : "Decryption failed"
+    );
+  }
+}
+async function derivePresenceKey(dek, collectionName) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey(
+    "raw",
+    rawDek,
+    "HKDF",
+    false,
+    ["deriveBits"]
+  );
+  const salt = new TextEncoder().encode("noydb-presence");
+  const info = new TextEncoder().encode(collectionName);
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function deriveSealedFieldKey(dek, collectionName, field) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-sealed");
+  const info = new TextEncoder().encode(JSON.stringify(["noydb-sealed", collectionName, field]));
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function deriveSealedFieldKeyFromCek(cek, collectionName, field) {
+  const rawCek = await subtle.exportKey("raw", cek);
+  const hkdfKey = await subtle.importKey("raw", rawCek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-sealed-cek");
+  const info = new TextEncoder().encode(JSON.stringify(["noydb-sealed-cek", collectionName, field]));
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function deriveDeterministicIV(dek, context, plaintext) {
+  const rawDek = await subtle.exportKey("raw", dek);
+  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-deterministic-v1");
+  const info = new TextEncoder().encode(`${context}\0${plaintext}`);
+  const bits = await subtle.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    IV_BYTES * 8
+  );
+  return new Uint8Array(bits);
+}
+async function encryptDeterministic(plaintext, dek, context) {
+  const iv = await deriveDeterministicIV(dek, context, plaintext);
+  const encoded = new TextEncoder().encode(plaintext);
+  const ciphertext = await subtle.encrypt(
+    { name: "AES-GCM", iv },
+    dek,
+    encoded
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decryptDeterministic(ivBase64, dataBase64, dek) {
+  return decrypt(ivBase64, dataBase64, dek);
+}
+function generateIV() {
+  return globalThis.crypto.getRandomValues(new Uint8Array(IV_BYTES));
+}
+function generateSalt() {
+  return globalThis.crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+}
+function bufferToBase64(buffer) {
+  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary);
+}
+function base64ToBuffer(base64) {
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+
+// src/kernel/enclave/record-keys/lifecycle.ts
+async function resolveStableCek(deps, id) {
+  const cached = deps.cache?.get(id);
+  if (cached) return cached;
+  const live = await deps.getLive(id);
+  if (live?._cek !== void 0) {
+    const cek = await unwrapCek(live._cek, await deps.getDEK());
+    deps.cache?.set(id, cek, 1);
+    return cek;
+  }
+  const fresh = await generateDEK();
+  deps.cache?.set(id, fresh, 1);
+  return fresh;
+}
+async function rewrapBodyToDek(envelope, fromDek, toDek) {
+  if (envelope._cek !== void 0) {
+    const cek = await unwrapCek(envelope._cek, fromDek);
+    const plaintext2 = await decrypt(envelope._iv, envelope._data, cek);
+    const { iv: iv2, data: data2 } = await encrypt(plaintext2, cek);
+    return { _iv: iv2, _data: data2, _cek: await wrapCek(cek, toDek), cek };
+  }
+  const plaintext = await decrypt(envelope._iv, envelope._data, fromDek);
+  const { iv, data } = await encrypt(plaintext, toDek);
+  return { _iv: iv, _data: data, cek: null };
+}
+
+// src/kernel/enclave/record-keys/tombstone.ts
+function isTombstone(envelope, encrypted) {
+  if (!encrypted) return false;
+  return !envelope._data && envelope._cek === void 0;
+}
+function buildTombstone(version, actor) {
+  return {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: version,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: "",
+    _data: "",
+    ...actor ? { _by: actor } : {}
+  };
+}
+
+// src/kernel/enclave/record-keys/sealed-slot.ts
+function parseSealedSlot(blob) {
+  const sep = blob.indexOf(":");
+  return { iv: blob.slice(0, sep), data: blob.slice(sep + 1) };
+}
+async function dualReadSealedSlot(blob, field, collection, cek, dek) {
+  const { iv, data } = parseSealedSlot(blob);
+  if (cek !== void 0) {
+    try {
+      const fieldKey2 = await deriveSealedFieldKeyFromCek(cek, collection, field);
+      return await decrypt(iv, data, fieldKey2);
+    } catch {
+    }
+  }
+  const fieldKey = await deriveSealedFieldKey(dek, collection, field);
+  return decrypt(iv, data, fieldKey);
+}
+
+// src/kernel/schema.ts
+async function validateSchemaInput(schema, value, context) {
+  const result = await schema["~standard"].validate(value);
+  if (result.issues !== void 0 && result.issues.length > 0) {
+    throw new SchemaValidationError(
+      `Schema validation failed on ${context}: ${summarizeIssues(result.issues)}`,
+      result.issues,
+      "input"
+    );
+  }
+  return result.value;
+}
+async function validateSchemaOutput(schema, value, context) {
+  const result = await schema["~standard"].validate(value);
+  if (result.issues !== void 0 && result.issues.length > 0) {
+    throw new SchemaValidationError(
+      `Stored data for ${context} does not match the current schema \u2014 schema drift? ${summarizeIssues(result.issues)}`,
+      result.issues,
+      "output"
+    );
+  }
+  return result.value;
+}
+function summarizeIssues(issues) {
+  const shown = issues.slice(0, 3).map((issue) => {
+    const pathStr = formatPath(issue.path);
+    return `${pathStr}: ${issue.message}`;
+  });
+  const suffix = issues.length > 3 ? ` (+${issues.length - 3} more)` : "";
+  return shown.join("; ") + suffix;
+}
+function formatPath(path) {
+  if (!path || path.length === 0) return "root";
+  return path.map(
+    (segment) => typeof segment === "object" && segment !== null ? String(segment.key) : String(segment)
+  ).join(".");
+}
+
+// src/kernel/enclave/record-keys/record-codec.ts
+var RecordCodec = class _RecordCodec {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  // ──────────────────────────────────────────────────────────────────────
+  // Low-level literal builders
+  // ──────────────────────────────────────────────────────────────────────
+  /**
+   * Assemble a canonical ciphertext body envelope literal from already-computed
+   * parts. Pure, no crypto. Each call stamps its own `_ts` — provenance carries
+   * a SEPARATE timestamp (computed by the caller), so the two never share one.
+   */
+  static buildEnvelope(p) {
+    return {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: p.version,
+      _ts: (/* @__PURE__ */ new Date()).toISOString(),
+      _iv: p.iv,
+      _data: p.data,
+      ...p.by !== void 0 ? { _by: p.by } : {},
+      ...p.cek !== void 0 ? { _cek: p.cek } : {},
+      ...p.provenance !== void 0 ? { _source: p.provenance.source, _sourceTs: p.provenance.sourceTs } : {},
+      ...p.extra ?? {}
+    };
+  }
+  /** Plaintext (`_iv:''`) body envelope — the `!storeCiphertext` shape. */
+  static buildPlaintextEnvelope(p) {
+    return {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: p.version,
+      _ts: (/* @__PURE__ */ new Date()).toISOString(),
+      _iv: "",
+      _data: p.data,
+      ...p.by !== void 0 ? { _by: p.by } : {},
+      ...p.provenance !== void 0 ? { _source: p.provenance.source, _sourceTs: p.provenance.sourceTs } : {}
+    };
+  }
+  // ──────────────────────────────────────────────────────────────────────
+  // Write path
+  // ──────────────────────────────────────────────────────────────────────
+  /**
+   * Build a debug-plaintext envelope: the record's own fields inlined as
+   * top-level keys beside the reserved `_`-metadata, with `_debug: 1` and an
+   * empty `_data`. Lets native store tooling read the record without
+   * unwrapping. Only reached for user collections under `debugPlaintext`
+   * (see {@link encryptRecord}). Rejects `_`-prefixed record fields, which
+   * would collide with the reserved metadata namespace.
+   */
+  buildDebugEnvelope(record, version, source, sourceTs) {
+    const rec = record;
+    for (const key of Object.keys(rec)) {
+      if (key.startsWith("_")) throw new DebugReservedFieldError(this.ctx.name, key);
+    }
+    return {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: version,
+      _ts: (/* @__PURE__ */ new Date()).toISOString(),
+      _iv: "",
+      _data: "",
+      _by: this.ctx.actor,
+      _debug: NOYDB_FORMAT_VERSION,
+      ...this.ctx.provenance && source !== void 0 ? { _source: source, _sourceTs: sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : {},
+      ...rec
+    };
+  }
+  /**
+   * Encrypt a JSON body into an envelope.
+   *
+   * When `cek` is supplied (per-record CEK collections), the body is
+   * encrypted under the CEK and the CEK is AES-KW-wrapped under the
+   * collection DEK and stamped on `_cek`. When `cek` is omitted, the legacy
+   * path encrypts the body directly under the collection DEK — byte-identical
+   * to pre-CEK behaviour, so non-adopting collections pay nothing.
+   */
+  async encryptJsonString(json, version, cek, source, sourceTs) {
+    const by = this.ctx.actor;
+    const provenance = this.ctx.provenance && source !== void 0 ? { source, sourceTs: sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : void 0;
+    if (!this.ctx.storeCiphertext) {
+      return _RecordCodec.buildPlaintextEnvelope({ version, data: json, by, provenance });
+    }
+    const dek = await this.ctx.getDEK();
+    if (cek !== void 0) {
+      const { iv: iv2, data: data2 } = await encrypt(json, cek);
+      const wrapped = await wrapCek(cek, dek);
+      return _RecordCodec.buildEnvelope({ version, iv: iv2, data: data2, by, cek: wrapped, provenance });
+    }
+    const { iv, data } = await encrypt(json, dek);
+    return _RecordCodec.buildEnvelope({ version, iv, data, by, provenance });
+  }
+  async encryptRecord(record, version, cek, source, sourceTs) {
+    if (!this.ctx.storeCiphertext && this.ctx.debugPlaintext && !this.ctx.name.startsWith("_")) {
+      return this.buildDebugEnvelope(record, version, source, sourceTs);
+    }
+    let openRecord = record;
+    let sealed;
+    if (this.ctx.storeCiphertext && this.ctx.sensitiveFields.size > 0) {
+      const src = record;
+      const dek2 = await this.ctx.getDEK();
+      const open = { ...src };
+      const slots = {};
+      for (const field of this.ctx.sensitiveFields) {
+        if (!(field in src)) continue;
+        const value = src[field];
+        if (value === void 0) continue;
+        const fieldKey = cek !== void 0 ? await deriveSealedFieldKeyFromCek(cek, this.ctx.name, field) : await deriveSealedFieldKey(dek2, this.ctx.name, field);
+        const { iv, data } = await encrypt(JSON.stringify(value), fieldKey);
+        slots[field] = `${iv}:${data}`;
+        delete open[field];
+      }
+      if (Object.keys(slots).length > 0) {
+        sealed = slots;
+        openRecord = open;
+      }
+    }
+    const base = await this.encryptJsonString(JSON.stringify(openRecord), version, cek, source, sourceTs);
+    const withSealed = sealed ? { ...base, _sealed: sealed } : base;
+    if (!this.ctx.deterministicFields || !this.ctx.storeCiphertext) return withSealed;
+    const dek = await this.ctx.getDEK();
+    const rec = record;
+    const det = {};
+    for (const field of this.ctx.deterministicFields) {
+      if (this.ctx.sensitiveFields.has(field)) continue;
+      const value = rec[field];
+      if (value === void 0 || value === null) continue;
+      const plaintext = typeof value === "string" ? value : JSON.stringify(value);
+      const { iv, data } = await encryptDeterministic(plaintext, dek, `${this.ctx.name}/${field}`);
+      det[field] = `${iv}:${data}`;
+    }
+    if (Object.keys(det).length === 0) return withSealed;
+    return { ...withSealed, _det: det };
+  }
+  // ──────────────────────────────────────────────────────────────────────
+  // Read path
+  // ──────────────────────────────────────────────────────────────────────
+  /**
+   * Resolve the per-record CEK for a stored envelope, or `undefined` for a
+   * legacy (`_cek`-absent) envelope. Unwraps `_cek` under the collection DEK and
+   * memoises it in the CEK cache under `id` (when supplied) so repeated reads of
+   * the same record skip the unwrap. Shared by the body-decrypt path
+   * ({@link decryptJsonString}) and the sealed-field path ({@link decryptRecord}
+   * / {@link toCacheRecord}) so both agree on the record's key.
+   */
+  async resolveEnvelopeCek(envelope, id) {
+    if (envelope._cek === void 0) return void 0;
+    const cached = id !== void 0 ? this.ctx.cekCache?.get(id) : void 0;
+    if (cached !== void 0) return cached;
+    const dek = await this.ctx.getDEK();
+    const cek = await unwrapCek(envelope._cek, dek);
+    if (id !== void 0) this.ctx.cekCache?.set(id, cek, 1);
+    return cek;
+  }
+  /**
+   * Low-level: decrypt an envelope and return the raw JSON string.
+   *
+   * `_cek` presence is the format discriminant (NOT `this.perRecordCek`),
+   * so a mixed vault — and a recipient that never opted into
+   * `perRecordKeys` — decrypts both legacy and CEK records:
+   *  - `_cek` present → unwrap the CEK under the collection DEK, decrypt the
+   *    body under the CEK (cache the unwrapped CEK so repeated reads skip it).
+   *  - `_cek` absent → legacy path, body decrypts directly under the
+   *    collection DEK.
+   *
+   * The optional `id` lets reads populate the CEK cache; it is omitted by
+   * callers (history, conflict merge) that have only the envelope.
+   */
+  async decryptJsonString(envelope, id) {
+    if (isTombstone(envelope, this.ctx.storeCiphertext)) return null;
+    if (!this.ctx.storeCiphertext) {
+      if (envelope._debug !== void 0) {
+        const rec = {};
+        for (const [key, value] of Object.entries(envelope)) {
+          if (!key.startsWith("_")) rec[key] = value;
+        }
+        return JSON.stringify(rec);
+      }
+      return envelope._data;
+    }
+    const cek = await this.resolveEnvelopeCek(envelope, id);
+    if (cek !== void 0) return decrypt(envelope._iv, envelope._data, cek);
+    const dek = await this.ctx.getDEK();
+    return decrypt(envelope._iv, envelope._data, dek);
+  }
+  /**
+   * Unseal a single `_sealed[field]` slot to its plaintext value: derive the
+   * per-field key off the collection DEK, AES-GCM-decrypt the `iv:data` blob,
+   * and JSON-parse the result. Shared by both the inline-decrypt path and a
+   * {@link Sealed} handle's `reveal()` — so the on-demand reveal and the eager
+   * materialisation always agree byte-for-byte.
+   */
+  async unsealField(field, blob, cek) {
+    const dek = await this.ctx.getDEK();
+    return JSON.parse(await dualReadSealedSlot(blob, field, this.ctx.name, cek, dek));
+  }
+  /**
+   * Classify a live envelope's `_sealed` slots for crypto-shred completeness.
+   * `forget()` drops `_cek`/`_sealed` but
+   * RETAINS the collection DEK, so only a slot keyed off the per-record CEK is
+   * genuinely shredded by the tombstone; a legacy slot keyed off the
+   * collection DEK survives in any synced/backup copy.
+   *
+   * Mirrors {@link unsealField}'s dual-read split: try the CEK-derived key per
+   * slot — success → `shreddable`, AES-GCM auth failure → `dekResidue`. With no
+   * `_cek` (pure legacy collection-DEK sealing) ALL slots are residue.
+   */
+  async classifySealedShred(live) {
+    const shreddable = [];
+    const dekResidue = [];
+    const sealed = live._sealed;
+    if (sealed === void 0) return { shreddable, dekResidue };
+    const cek = await this.resolveEnvelopeCek(live);
+    for (const [field, blob] of Object.entries(sealed)) {
+      if (cek === void 0) {
+        dekResidue.push(field);
+        continue;
+      }
+      const { iv, data } = parseSealedSlot(blob);
+      try {
+        await decrypt(iv, data, await deriveSealedFieldKeyFromCek(cek, this.ctx.name, field));
+        shreddable.push(field);
+      } catch {
+        dekResidue.push(field);
+      }
+    }
+    return { shreddable, dekResidue };
+  }
+  /**
+   * Build a non-leaking {@link Sealed} handle over a sealed field's ciphertext.
+   * The handle captures only the ciphertext `blob` and a closure to
+   * {@link unsealField}; the plaintext is never stored on it — so the handle
+   * may sit in the working-set cache (or be logged/serialised) without
+   * exposing the value, which decrypts only on `reveal()`.
+   */
+  makeSealedHandle(field, blob, cek) {
+    return new SealedHandle(() => this.unsealField(field, blob, cek));
+  }
+  /**
+   * Replace a record's declared sensitive fields with {@link Sealed} handles
+   * built from the just-written envelope's `_sealed` slots, leaving every
+   * other field as its plaintext value. Used to populate the cache on the
+   * write path without ever materialising sealed plaintext into it. Returns
+   * `record` untouched when the collection seals nothing.
+   */
+  async toCacheRecord(record, envelope, id) {
+    const sealed = envelope._sealed;
+    if (sealed === void 0 || !this.ctx.storeCiphertext || this.ctx.sensitiveFields.size === 0) {
+      return record;
+    }
+    const cek = await this.resolveEnvelopeCek(envelope, id);
+    const clone = { ...record };
+    for (const [field, blob] of Object.entries(sealed)) {
+      clone[field] = this.makeSealedHandle(field, blob, cek);
+    }
+    return clone;
+  }
+  /**
+   * Decrypt an envelope into a record of type `T`.
+   *
+   * When a schema is attached, the decrypted value is validated before
+   * being returned. A divergence between the stored bytes and the
+   * current schema throws `SchemaValidationError` with
+   * `direction: 'output'` — silently returning drifted data would
+   * propagate garbage into the UI and break the whole point of having
+   * a schema.
+   *
+   * `skipValidation` exists for history reads: when calling
+   * `getVersion()` the caller is explicitly asking for an old snapshot
+   * that may predate a schema change, so validating it would be a
+   * false positive. Every non-history read leaves this flag `false`.
+   */
+  async decryptRecord(envelope, opts = {}) {
+    const json = await this.decryptJsonString(envelope, opts.id);
+    if (json === null) return null;
+    let parsed = JSON.parse(json);
+    if (this.ctx.crdtMode && parsed !== null && typeof parsed === "object" && "_crdt" in parsed) {
+      parsed = this.ctx.crdtStrategy.resolveCrdtSnapshot(parsed);
+    }
+    let record = parsed;
+    if (envelope._sealed !== void 0 && this.ctx.storeCiphertext) {
+      const sealedCek = await this.resolveEnvelopeCek(envelope, opts.id);
+      const target = record;
+      for (const [field, blob] of Object.entries(envelope._sealed)) {
+        target[field] = opts.sealedAsHandles ? this.makeSealedHandle(field, blob, sealedCek) : await this.unsealField(field, blob, sealedCek);
+      }
+    }
+    const sealedAsHandles = opts.sealedAsHandles === true && envelope._sealed !== void 0;
+    if (this.ctx.schema !== void 0 && !opts.skipValidation && !sealedAsHandles) {
+      record = await validateSchemaOutput(
+        this.ctx.schema,
+        record,
+        `${this.ctx.name}@v${envelope._v}`
+      );
+    }
+    return record;
+  }
+};
+
+// src/kernel/enclave/record-keys/sealing.ts
+var subtle2 = globalThis.crypto.subtle;
+var SEALED_CEK_NS = "_sealed_cek";
+async function sealRecordToHost(ctx, collection, id, hostSealer, opts) {
+  if (collection.includes("/")) throw new ValidationError(`sealRecordToHost: collection "${collection}" must not contain "/"`);
+  if (id.includes("/")) throw new ValidationError(`sealRecordToHost: id "${id}" must not contain "/"`);
+  if (Number.isNaN(Date.parse(opts.expiresAt))) {
+    throw new ValidationError(`sealRecordToHost: expiresAt "${opts.expiresAt}" is not a valid ISO 8601 timestamp`);
+  }
+  const live = await ctx.adapter.get(ctx.vault, collection, id);
+  if (!live || live._cek === void 0) {
+    throw new RecordCekNotFoundError(collection, id);
+  }
+  const dek = await ctx.getDEK(collection);
+  const cek = await unwrapCek(live._cek, dek);
+  const rawCek = await subtle2.exportKey("raw", cek);
+  const cekB64 = bufferToBase64(rawCek);
+  const hint = await hostSealer.publishRecipientHint();
+  if (hint.pid.includes("/")) throw new ValidationError(`sealRecordToHost: recipient pid "${hint.pid}" must not contain "/"`);
+  const binding = {
+    collection,
+    id,
+    cek: cekB64,
+    expiresAt: opts.expiresAt
+  };
+  const sealed = await hostSealer.sealForRecipient(
+    new TextEncoder().encode(JSON.stringify(binding)),
+    hint
+  );
+  const delivery = {
+    v: 1,
+    _noydb_sealed_cek: 1,
+    pid: hint.pid,
+    payload: bufferToBase64(sealed),
+    expiresAt: opts.expiresAt
+  };
+  const envelopeKey = `${collection}/${id}/${hint.pid}`;
+  const prior = await ctx.adapter.get(ctx.vault, SEALED_CEK_NS, envelopeKey);
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: (prior?._v ?? 0) + 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    // AES-GCM bypassed — the sealing layer is the security boundary, exactly
+    // like the managed-passphrase `_meta/sealed-passphrase` envelope.
+    _iv: "",
+    _data: JSON.stringify(delivery),
+    ...ctx.actor ? { _by: ctx.actor } : {}
+  };
+  await ctx.adapter.put(ctx.vault, SEALED_CEK_NS, envelopeKey, env);
+  return { pid: hint.pid, envelopeKey };
+}
+async function revokeSealedRecord(ctx, collection, id, pid, opts) {
+  if (opts?.hard === true) {
+    await rotateRecordCek(ctx, collection, id);
+    return;
+  }
+  await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, `${collection}/${id}/${pid}`);
+}
+async function rotateRecordCek(ctx, collection, id) {
+  const live = await ctx.adapter.get(ctx.vault, collection, id);
+  if (!live || live._cek === void 0) {
+    throw new RecordCekNotFoundError(collection, id);
+  }
+  const dek = await ctx.getDEK(collection);
+  const oldCek = await unwrapCek(live._cek, dek);
+  const json = await decrypt(live._iv, live._data, oldCek);
+  const newCek = await generateDEK();
+  const { iv, data } = await encrypt(json, newCek);
+  let sealedOut;
+  if (live._sealed !== void 0) {
+    const out = {};
+    for (const [field, slot] of Object.entries(live._sealed)) {
+      const plaintext = await dualReadSealedSlot(slot, field, collection, oldCek, dek);
+      const resealed = await encrypt(plaintext, await deriveSealedFieldKeyFromCek(newCek, collection, field));
+      out[field] = `${resealed.iv}:${resealed.data}`;
+    }
+    sealedOut = out;
+  }
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: live._v + 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: iv,
+    _data: data,
+    _cek: await wrapCek(newCek, dek),
+    ...ctx.actor ? { _by: ctx.actor } : {},
+    ...live._tier !== void 0 ? { _tier: live._tier } : {},
+    ...live._det !== void 0 ? { _det: live._det } : {},
+    // Re-encrypt sealed (`sensitive`) fields under the new CEK. Sealed
+    // keys derive off the per-record CEK, so the rotated record's old CEK is
+    // destroyed here — carrying the old `_sealed` slots forward verbatim would
+    // orphan them (unreadable under the new CEK). `sealedOut` holds the slots
+    // dual-read from the old CEK (or the legacy DEK) and re-sealed under newCek.
+    ...sealedOut !== void 0 ? { _sealed: sealedOut } : {}
+  };
+  await ctx.adapter.put(ctx.vault, collection, id, env);
+  await ctx.invalidateRecordCaches(collection, id);
+  const prefix = `${collection}/${id}/`;
+  const keys = await ctx.adapter.list(ctx.vault, SEALED_CEK_NS);
+  for (const key of keys) {
+    if (key.startsWith(prefix)) {
+      await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, key);
+    }
+  }
+}
+
+// src/kernel/enclave/record-keys/deterministic.ts
+async function detTarget(ctx, field, value) {
+  const dek = await ctx.getDEK();
+  const plaintext = typeof value === "string" ? value : JSON.stringify(value);
+  const { iv, data } = await encryptDeterministic(plaintext, dek, `${ctx.name}/${field}`);
+  return `${iv}:${data}`;
+}
+function assertDetField(ctx, field, method) {
+  if (!ctx.deterministicFields || !ctx.deterministicFields.has(field)) {
+    throw new Error(
+      `Collection "${ctx.name}": field "${field}" is not declared in deterministicFields`
+    );
+  }
+  if (!ctx.storeCiphertext) {
+    throw new Error(
+      `Collection "${ctx.name}": ${method} is only meaningful on encrypted collections`
+    );
+  }
+}
+async function findByDet(ctx, field, value) {
+  assertDetField(ctx, field, "findByDet");
+  const target = await detTarget(ctx, field, value);
+  const ids = await ctx.adapter.list(ctx.vault, ctx.name);
+  for (const id of ids) {
+    const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
+    if (!env || !env._det) continue;
+    if (env._det[field] === target) {
+      return ctx.codec.decryptRecord(env);
+    }
+  }
+  return null;
+}
+async function queryByDet(ctx, field, value) {
+  assertDetField(ctx, field, "queryByDet");
+  const target = await detTarget(ctx, field, value);
+  const ids = await ctx.adapter.list(ctx.vault, ctx.name);
+  const matches = [];
+  for (const id of ids) {
+    const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
+    if (!env || !env._det) continue;
+    if (env._det[field] === target) {
+      const rec = await ctx.codec.decryptRecord(env);
+      if (rec !== null) matches.push(rec);
+    }
+  }
+  return matches;
+}
+
+// src/kernel/enclave/record-keys/envelope-body.ts
+async function openEnvelopeJson(env, key, opts) {
+  if (opts?.encrypted === false) return env._data;
+  if (env._cek !== void 0) {
+    const cek = await unwrapCek(env._cek, key);
+    return decrypt(env._iv, env._data, cek);
+  }
+  return decrypt(env._iv, env._data, key);
+}
+async function writeEnvelopeBody(json, key, opts) {
+  if (opts?.encrypted === false) return { _iv: "", _data: json };
+  if (opts?.perRecordKey === true) {
+    const cek = await generateDEK();
+    const { iv: iv2, data: data2 } = await encrypt(json, cek);
+    const wrapped = await wrapCek(cek, key);
+    return { _iv: iv2, _data: data2, _cek: wrapped };
+  }
+  const { iv, data } = await encrypt(json, key);
+  return { _iv: iv, _data: data };
+}
+function hasPerRecordKey(env) {
+  return env._cek !== void 0;
+}
+function envelopeBodyForHash(env) {
+  if (env._sealed === void 0) return env._data;
+  const sealedKeys = Object.keys(env._sealed).sort();
+  const sealedParts = sealedKeys.map(
+    (k) => `${JSON.stringify(k)}:${JSON.stringify(env._sealed[k])}`
+  );
+  return `{"_data":${JSON.stringify(env._data)},"_sealed":{${sealedParts.join(",")}}}`;
+}
+
+export {
+  deriveKey,
+  derivePassphraseKey,
+  generateDEK,
+  wrapKey,
+  unwrapKey,
+  wrapCek,
+  unwrapCek,
+  importCek,
+  encrypt,
+  decrypt,
+  encryptBytes,
+  decryptBytes,
+  sha256Hex,
+  hmacSha256Hex,
+  encryptBytesWithAAD,
+  decryptBytesWithAAD,
+  derivePresenceKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  encryptDeterministic,
+  decryptDeterministic,
+  generateIV,
+  generateSalt,
+  bufferToBase64,
+  base64ToBuffer,
+  resolveStableCek,
+  rewrapBodyToDek,
+  isTombstone,
+  buildTombstone,
+  validateSchemaInput,
+  validateSchemaOutput,
+  RecordCodec,
+  SEALED_CEK_NS,
+  sealRecordToHost,
+  revokeSealedRecord,
+  rotateRecordCek,
+  findByDet,
+  queryByDet,
+  openEnvelopeJson,
+  writeEnvelopeBody,
+  hasPerRecordKey,
+  envelopeBodyForHash
+};
+//# sourceMappingURL=chunk-5O3AOPDT.js.map