@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.10

package/dist/{chunk-5O3AOPDT.js → chunk-MCHVVJIA.js}

@@ -1,367 +1,51 @@
+import {
+  isDeleteMarker,
+  isTombstone
+} from "./chunk-QA2KUPCP.js";
+import {
+  blindedEqual,
+  openVdigPayload,
+  sealVdigPayload
+} from "./chunk-2OV5NVE7.js";
+import {
+  dualReadSealedSlot,
+  parseSealedSlot
+} from "./chunk-VEPTFUJY.js";
+import {
+  mintBidxTag
+} from "./chunk-HYR4WZZ3.js";
+import {
+  VDIG_ITERATIONS,
+  normalizeForVerify,
+  pbkdf2VerifyDigest
+} from "./chunk-LP7BEXCT.js";
+import {
+  base64ToBuffer,
+  bufferToBase64,
+  decrypt,
+  deriveDeterministicKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  encrypt,
+  encryptDeterministic,
+  generateDEK,
+  generateSalt,
+  unwrapCek,
+  wrapCek
+} from "./chunk-3OPY6MK2.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-5TDJ56JE.js";
+} from "./chunk-YN5IAHN6.js";
 import {
+  ClassifiedConfigError,
+  ClassifiedRotationError,
   DebugReservedFieldError,
-  DecryptionError,
-  InvalidKeyError,
   RecordCekNotFoundError,
   SchemaValidationError,
   TamperedError,
   ValidationError
-} from "./chunk-ZYUC53LT.js";
-
-// src/kernel/enclave/crypto.ts
-var PBKDF2_ITERATIONS = 6e5;
-var SALT_BYTES = 32;
-var IV_BYTES = 12;
-var KEY_BITS = 256;
-var subtle = globalThis.crypto.subtle;
-async function deriveKey(passphrase, salt) {
-  const keyMaterial = await subtle.importKey(
-    "raw",
-    new TextEncoder().encode(passphrase),
-    "PBKDF2",
-    false,
-    ["deriveKey"]
-  );
-  return subtle.deriveKey(
-    {
-      name: "PBKDF2",
-      salt,
-      iterations: PBKDF2_ITERATIONS,
-      hash: "SHA-256"
-    },
-    keyMaterial,
-    { name: "AES-KW", length: KEY_BITS },
-    false,
-    ["wrapKey", "unwrapKey"]
-  );
-}
-async function derivePassphraseKey(passphrase, salt, params) {
-  const keyMaterial = await subtle.importKey(
-    "raw",
-    new TextEncoder().encode(passphrase),
-    "PBKDF2",
-    false,
-    ["deriveKey"]
-  );
-  return params.keyUsage === "aes-gcm" ? subtle.deriveKey(
-    {
-      name: "PBKDF2",
-      salt,
-      iterations: params.iterations,
-      hash: "SHA-256"
-    },
-    keyMaterial,
-    { name: "AES-GCM", length: KEY_BITS },
-    false,
-    ["encrypt", "decrypt"]
-  ) : subtle.deriveKey(
-    {
-      name: "PBKDF2",
-      salt,
-      iterations: params.iterations,
-      hash: "SHA-256"
-    },
-    keyMaterial,
-    { name: "AES-KW", length: KEY_BITS },
-    false,
-    ["wrapKey", "unwrapKey"]
-  );
-}
-async function generateDEK() {
-  return subtle.generateKey(
-    { name: "AES-GCM", length: KEY_BITS },
-    true,
-    // extractable — needed for AES-KW wrapping
-    ["encrypt", "decrypt"]
-  );
-}
-async function wrapKey(dek, kek) {
-  const wrapped = await subtle.wrapKey("raw", dek, kek, "AES-KW");
-  return bufferToBase64(wrapped);
-}
-async function unwrapKey(wrappedBase64, kek) {
-  try {
-    return await subtle.unwrapKey(
-      "raw",
-      base64ToBuffer(wrappedBase64),
-      kek,
-      "AES-KW",
-      { name: "AES-GCM", length: KEY_BITS },
-      true,
-      ["encrypt", "decrypt"]
-    );
-  } catch {
-    throw new InvalidKeyError();
-  }
-}
-async function asKwKey(dek) {
-  const rawDek = await subtle.exportKey("raw", dek);
-  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
-  const salt = new TextEncoder().encode("noydb-cek-wrap");
-  const info = new TextEncoder().encode("v1");
-  const bits = await subtle.deriveBits(
-    { name: "HKDF", hash: "SHA-256", salt, info },
-    hkdfKey,
-    KEY_BITS
-  );
-  return subtle.importKey("raw", bits, "AES-KW", false, ["wrapKey", "unwrapKey"]);
-}
-async function wrapCek(cek, dek) {
-  const kw = await asKwKey(dek);
-  const wrapped = await subtle.wrapKey("raw", cek, kw, "AES-KW");
-  return bufferToBase64(wrapped);
-}
-async function unwrapCek(wrappedBase64, dek) {
-  const kw = await asKwKey(dek);
-  try {
-    return await subtle.unwrapKey(
-      "raw",
-      base64ToBuffer(wrappedBase64),
-      kw,
-      "AES-KW",
-      { name: "AES-GCM", length: KEY_BITS },
-      true,
-      ["encrypt", "decrypt"]
-    );
-  } catch {
-    throw new InvalidKeyError();
-  }
-}
-async function importCek(rawKey) {
-  return subtle.importKey("raw", rawKey, { name: "AES-GCM", length: KEY_BITS }, false, ["decrypt"]);
-}
-async function encrypt(plaintext, dek) {
-  const iv = generateIV();
-  const encoded = new TextEncoder().encode(plaintext);
-  const ciphertext = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    dek,
-    encoded
-  );
-  return {
-    iv: bufferToBase64(iv),
-    data: bufferToBase64(ciphertext)
-  };
-}
-async function decrypt(ivBase64, dataBase64, dek) {
-  const iv = base64ToBuffer(ivBase64);
-  const ciphertext = base64ToBuffer(dataBase64);
-  try {
-    const plaintext = await subtle.decrypt(
-      { name: "AES-GCM", iv },
-      dek,
-      ciphertext
-    );
-    return new TextDecoder().decode(plaintext);
-  } catch (err) {
-    if (err instanceof Error && err.name === "OperationError") {
-      throw new TamperedError();
-    }
-    throw new DecryptionError(
-      err instanceof Error ? err.message : "Decryption failed"
-    );
-  }
-}
-async function encryptBytes(data, dek) {
-  const iv = generateIV();
-  const ciphertext = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    dek,
-    data
-  );
-  return {
-    iv: bufferToBase64(iv),
-    data: bufferToBase64(ciphertext)
-  };
-}
-async function decryptBytes(ivBase64, dataBase64, dek) {
-  const iv = base64ToBuffer(ivBase64);
-  const ciphertext = base64ToBuffer(dataBase64);
-  try {
-    const plaintext = await subtle.decrypt(
-      { name: "AES-GCM", iv },
-      dek,
-      ciphertext
-    );
-    return new Uint8Array(plaintext);
-  } catch (err) {
-    if (err instanceof Error && err.name === "OperationError") {
-      throw new TamperedError();
-    }
-    throw new DecryptionError(
-      err instanceof Error ? err.message : "Decryption failed"
-    );
-  }
-}
-async function sha256Hex(data) {
-  const hash = await subtle.digest("SHA-256", data);
-  return Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function hmacSha256Hex(key, data) {
-  const rawKey = await subtle.exportKey("raw", key);
-  const hmacKey = await subtle.importKey(
-    "raw",
-    rawKey,
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const sig = await subtle.sign("HMAC", hmacKey, data);
-  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function encryptBytesWithAAD(data, dek, aad) {
-  const iv = generateIV();
-  const ciphertext = await subtle.encrypt(
-    {
-      name: "AES-GCM",
-      iv,
-      additionalData: aad
-    },
-    dek,
-    data
-  );
-  return {
-    iv: bufferToBase64(iv),
-    data: bufferToBase64(ciphertext)
-  };
-}
-async function decryptBytesWithAAD(ivBase64, dataBase64, dek, aad) {
-  const iv = base64ToBuffer(ivBase64);
-  const ciphertext = base64ToBuffer(dataBase64);
-  try {
-    const plaintext = await subtle.decrypt(
-      {
-        name: "AES-GCM",
-        iv,
-        additionalData: aad
-      },
-      dek,
-      ciphertext
-    );
-    return new Uint8Array(plaintext);
-  } catch (err) {
-    if (err instanceof Error && err.name === "OperationError") {
-      throw new TamperedError();
-    }
-    throw new DecryptionError(
-      err instanceof Error ? err.message : "Decryption failed"
-    );
-  }
-}
-async function derivePresenceKey(dek, collectionName) {
-  const rawDek = await subtle.exportKey("raw", dek);
-  const hkdfKey = await subtle.importKey(
-    "raw",
-    rawDek,
-    "HKDF",
-    false,
-    ["deriveBits"]
-  );
-  const salt = new TextEncoder().encode("noydb-presence");
-  const info = new TextEncoder().encode(collectionName);
-  const bits = await subtle.deriveBits(
-    { name: "HKDF", hash: "SHA-256", salt, info },
-    hkdfKey,
-    KEY_BITS
-  );
-  return subtle.importKey(
-    "raw",
-    bits,
-    { name: "AES-GCM", length: KEY_BITS },
-    false,
-    ["encrypt", "decrypt"]
-  );
-}
-async function deriveSealedFieldKey(dek, collectionName, field) {
-  const rawDek = await subtle.exportKey("raw", dek);
-  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
-  const salt = new TextEncoder().encode("noydb-sealed");
-  const info = new TextEncoder().encode(JSON.stringify(["noydb-sealed", collectionName, field]));
-  const bits = await subtle.deriveBits(
-    { name: "HKDF", hash: "SHA-256", salt, info },
-    hkdfKey,
-    KEY_BITS
-  );
-  return subtle.importKey(
-    "raw",
-    bits,
-    { name: "AES-GCM", length: KEY_BITS },
-    false,
-    ["encrypt", "decrypt"]
-  );
-}
-async function deriveSealedFieldKeyFromCek(cek, collectionName, field) {
-  const rawCek = await subtle.exportKey("raw", cek);
-  const hkdfKey = await subtle.importKey("raw", rawCek, "HKDF", false, ["deriveBits"]);
-  const salt = new TextEncoder().encode("noydb-sealed-cek");
-  const info = new TextEncoder().encode(JSON.stringify(["noydb-sealed-cek", collectionName, field]));
-  const bits = await subtle.deriveBits(
-    { name: "HKDF", hash: "SHA-256", salt, info },
-    hkdfKey,
-    KEY_BITS
-  );
-  return subtle.importKey(
-    "raw",
-    bits,
-    { name: "AES-GCM", length: KEY_BITS },
-    false,
-    ["encrypt", "decrypt"]
-  );
-}
-async function deriveDeterministicIV(dek, context, plaintext) {
-  const rawDek = await subtle.exportKey("raw", dek);
-  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
-  const salt = new TextEncoder().encode("noydb-deterministic-v1");
-  const info = new TextEncoder().encode(`${context}\0${plaintext}`);
-  const bits = await subtle.deriveBits(
-    { name: "HKDF", hash: "SHA-256", salt, info },
-    hkdfKey,
-    IV_BYTES * 8
-  );
-  return new Uint8Array(bits);
-}
-async function encryptDeterministic(plaintext, dek, context) {
-  const iv = await deriveDeterministicIV(dek, context, plaintext);
-  const encoded = new TextEncoder().encode(plaintext);
-  const ciphertext = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    dek,
-    encoded
-  );
-  return {
-    iv: bufferToBase64(iv),
-    data: bufferToBase64(ciphertext)
-  };
-}
-async function decryptDeterministic(ivBase64, dataBase64, dek) {
-  return decrypt(ivBase64, dataBase64, dek);
-}
-function generateIV() {
-  return globalThis.crypto.getRandomValues(new Uint8Array(IV_BYTES));
-}
-function generateSalt() {
-  return globalThis.crypto.getRandomValues(new Uint8Array(SALT_BYTES));
-}
-function bufferToBase64(buffer) {
-  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
-  return btoa(binary);
-}
-function base64ToBuffer(base64) {
-  const binary = atob(base64);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return bytes;
-}
+} from "./chunk-S7VFUQM2.js";
 
 // src/kernel/enclave/record-keys/lifecycle.ts
 async function resolveStableCek(deps, id) {
@@ -389,38 +73,136 @@ async function rewrapBodyToDek(envelope, fromDek, toDek) {
   return { _iv: iv, _data: data, cek: null };
 }
 
-// src/kernel/enclave/record-keys/tombstone.ts
-function isTombstone(envelope, encrypted) {
-  if (!encrypted) return false;
-  return !envelope._data && envelope._cek === void 0;
-}
-function buildTombstone(version, actor) {
+// src/kernel/enclave/record-keys/sealed-slots.ts
+async function sealOneFieldWithDek(field, value, dek, keyMaterial) {
+  const fieldKey = keyMaterial.cek !== void 0 ? await deriveSealedFieldKeyFromCek(keyMaterial.cek, keyMaterial.collection, field) : await deriveSealedFieldKey(dek, keyMaterial.collection, field);
+  return encrypt(JSON.stringify(value), fieldKey);
+}
+async function sealOneField(field, value, keyMaterial) {
+  const dek = await keyMaterial.getDEK();
+  return sealOneFieldWithDek(field, value, dek, keyMaterial);
+}
+async function sealFields(record, sensitiveFields, keyMaterial) {
+  const dek = await keyMaterial.getDEK();
+  const open = { ...record };
+  const slots = {};
+  for (const field of sensitiveFields) {
+    if (!(field in record)) continue;
+    const value = record[field];
+    if (value === void 0) continue;
+    const { iv, data } = await sealOneFieldWithDek(field, value, dek, keyMaterial);
+    slots[field] = `${iv}:${data}`;
+    delete open[field];
+  }
+  if (Object.keys(slots).length === 0) return { openRecord: record, sealed: void 0 };
+  return { openRecord: open, sealed: slots };
+}
+async function unsealOneField(field, blob, keyMaterial) {
+  const dek = await keyMaterial.getDEK();
+  return JSON.parse(await dualReadSealedSlot(blob, field, keyMaterial.collection, keyMaterial.cek, dek));
+}
+function makeHandleProducer(keyMaterial) {
+  return (field, blob) => new SealedHandle(() => unsealOneField(field, blob, keyMaterial));
+}
+async function unsealFields(record, sealed, keyMaterial, opts) {
+  const makeHandle = opts?.asHandles === true ? makeHandleProducer(keyMaterial) : void 0;
+  for (const [field, blob] of Object.entries(sealed)) {
+    record[field] = makeHandle !== void 0 ? makeHandle(field, blob) : await unsealOneField(field, blob, keyMaterial);
+  }
+  return record;
+}
+function makeSealedSlotCapability(ctx, recordId, cek) {
+  const keyMaterial = {
+    collection: ctx.name,
+    ...cek !== void 0 ? { cek } : {},
+    getDEK: () => ctx.getDEK()
+  };
+  const deletedFields = /* @__PURE__ */ new Set();
   return {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: version,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: "",
-    _data: "",
-    ...actor ? { _by: actor } : {}
+    async seal(field, plaintext) {
+      const ref = await sealOneField(field, plaintext, keyMaterial);
+      deletedFields.delete(field);
+      return ref;
+    },
+    async unseal(field, ref) {
+      if (deletedFields.has(field)) {
+        throw new ValidationError(`sealedSlots.unseal: field "${field}" on record "${recordId}" was deleted from this capability`);
+      }
+      return unsealOneField(field, `${ref.iv}:${ref.data}`, keyMaterial);
+    },
+    async delete(field) {
+      deletedFields.add(field);
+    }
   };
 }
-
-// src/kernel/enclave/record-keys/sealed-slot.ts
-function parseSealedSlot(blob) {
-  const sep = blob.indexOf(":");
-  return { iv: blob.slice(0, sep), data: blob.slice(sep + 1) };
+function makeReservedEnvelopes(dekResolver, declaredPrefixes) {
+  const declared = new Set(declaredPrefixes);
+  return (prefix) => {
+    if (!declared.has(prefix)) {
+      throw new ValidationError(`reservedEnvelopes: prefix "${prefix}" is not declared by this binding's reservedPrefixes`);
+    }
+    const assertPrefixed = (collection, method) => {
+      if (!collection.startsWith(prefix)) {
+        throw new ValidationError(
+          `reservedEnvelopes('${prefix}').${method}: collection "${collection}" does not start with "${prefix}"`
+        );
+      }
+    };
+    const encryptForPrefix = async (collection, json, v) => {
+      assertPrefixed(collection, "encrypt");
+      const dek = await dekResolver(collection);
+      const { iv, data } = await encrypt(json, dek);
+      return {
+        _noydb: NOYDB_FORMAT_VERSION,
+        _v: v,
+        _ts: (/* @__PURE__ */ new Date()).toISOString(),
+        _iv: iv,
+        _data: data
+      };
+    };
+    const decryptForPrefix = async (collection, env) => {
+      assertPrefixed(collection, "decrypt");
+      const dek = await dekResolver(collection);
+      return decrypt(env._iv, env._data, dek);
+    };
+    return { encrypt: encryptForPrefix, decrypt: decryptForPrefix };
+  };
 }
-async function dualReadSealedSlot(blob, field, collection, cek, dek) {
-  const { iv, data } = parseSealedSlot(blob);
-  if (cek !== void 0) {
+
+// src/kernel/enclave/classify/write.ts
+async function mintVdigSlot(rawValue, policy, prevBlob, cek, collection, recordId, field) {
+  const normalized = normalizeForVerify(policy.normalize, rawValue);
+  let prev = null;
+  if (prevBlob !== void 0) {
     try {
-      const fieldKey2 = await deriveSealedFieldKeyFromCek(cek, collection, field);
-      return await decrypt(iv, data, fieldKey2);
+      prev = await openVdigPayload(prevBlob, cek, collection, recordId, field);
     } catch {
+      throw new TamperedError();
+    }
+    if (!Number.isInteger(prev.iter) || prev.iter < 1) {
+      throw new TamperedError();
     }
   }
-  const fieldKey = await deriveSealedFieldKey(dek, collection, field);
-  return decrypt(iv, data, fieldKey);
+  if (prev !== null && policy.notLastN > 0) {
+    const history = [prev.cur, ...prev.ring ?? []];
+    for (const entry of history) {
+      const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(entry.salt), prev.iter);
+      if (await blindedEqual(digest, base64ToBuffer(entry.hash))) {
+        throw new ClassifiedRotationError(collection, field, "password was used recently");
+      }
+    }
+  }
+  const salt = generateSalt();
+  const hash = await pbkdf2VerifyDigest(normalized, salt, VDIG_ITERATIONS);
+  const ring = prev !== null && policy.notLastN > 0 ? [...prev.ring ?? [], { salt: prev.cur.salt, hash: prev.cur.hash }].slice(-policy.notLastN) : void 0;
+  const payload = {
+    v: 1,
+    alg: "PBKDF2-SHA256",
+    iter: VDIG_ITERATIONS,
+    cur: { salt: bufferToBase64(salt), hash: bufferToBase64(hash), at: (/* @__PURE__ */ new Date()).toISOString() },
+    ...ring !== void 0 && ring.length > 0 ? { ring } : {}
+  };
+  return sealVdigPayload(payload, cek, collection, recordId, field);
 }
 
 // src/kernel/schema.ts
@@ -467,6 +249,42 @@ var RecordCodec = class _RecordCodec {
     this.ctx = ctx;
   }
   ctx;
+  /**
+   * @internal Update the live Via pipeline this codec's at-rest hooks read
+   * (#638 Task 3) — called by `via/graph-wiring.ts#applyTaintOverlay` right
+   * after it reassigns `Collection.via`, so `hasAtRestHooks`/`encodeAtRest`/
+   * `decodeAtRest` see the newly-added `taint` binding instead of the
+   * pipeline snapshot captured when this codec was constructed.
+   */
+  setVia(via) {
+    this.ctx.via = via;
+  }
+  /** Sealed-slot key material for this codec's collection, for a given per-record CEK (or none). */
+  sealKeyMaterial(cek) {
+    return {
+      collection: this.ctx.name,
+      ...cek !== void 0 ? { cek } : {},
+      getDEK: () => this.ctx.getDEK()
+    };
+  }
+  /**
+   * Build the `ViaCryptoCtx` handed to a binding's `encodeAtRest`/
+   * `decodeAtRest` hook: `sealedSlots` pre-bound to `(this.ctx.name,
+   * recordId)` — always threading `cek` when the caller has one, so the
+   * capability's record-binding stays cryptographic rather than degrading
+   * to collection-scope. `reservedEnvelopes`'s DEK resolver forwards its
+   * `collection` argument straight to `this.ctx.getDEK` (#629 Task 4) — it
+   * resolves the RESERVED collection's own DEK (e.g. `_dict_status`), never
+   * `this.ctx.name`'s, matching `Vault.getDEK`'s per-collection-name
+   * resolution (the same resolver `DictionaryHandle` used pre-cutover).
+   */
+  viaCryptoCtx(recordId, cek) {
+    const declaredPrefixes = this.ctx.via?.bindings.flatMap((b) => b.reservedPrefixes ?? []) ?? [];
+    return {
+      sealedSlots: makeSealedSlotCapability(this.ctx, recordId, cek),
+      reservedEnvelopes: makeReservedEnvelopes((collection) => this.ctx.getDEK(collection), declaredPrefixes)
+    };
+  }
   // ──────────────────────────────────────────────────────────────────────
   // Low-level literal builders
   // ──────────────────────────────────────────────────────────────────────
@@ -552,47 +370,130 @@ var RecordCodec = class _RecordCodec {
     const { iv, data } = await encrypt(json, dek);
     return _RecordCodec.buildEnvelope({ version, iv, data, by, provenance });
   }
-  async encryptRecord(record, version, cek, source, sourceTs) {
+  async encryptRecord(record, version, cek, source, sourceTs, vdig, id) {
     if (!this.ctx.storeCiphertext && this.ctx.debugPlaintext && !this.ctx.name.startsWith("_")) {
       return this.buildDebugEnvelope(record, version, source, sourceTs);
     }
+    if (this.ctx.storeCiphertext) {
+      const declared = this.ctx.vdigFields;
+      const storedClassified = /* @__PURE__ */ new Set();
+      if (vdig?.prev?._vdig) for (const k of Object.keys(vdig.prev._vdig)) storedClassified.add(k);
+      if (vdig?.prev?._bidx) for (const k of Object.keys(vdig.prev._bidx)) storedClassified.add(k);
+      if (this.ctx.classifiedMarkerDigestOnly !== void 0) {
+        for (const k of await this.ctx.classifiedMarkerDigestOnly()) storedClassified.add(k);
+      }
+      let undeclared;
+      for (const field of storedClassified) {
+        if (declared === null || !declared.has(field)) {
+          undeclared = field;
+          break;
+        }
+      }
+      if (undeclared !== void 0) {
+        throw new ClassifiedConfigError(
+          this.ctx.name,
+          `this collection has classified digest-only field "${undeclared}" but this handle does not declare it \u2014 refusing to write (would drop its tag or serialize the secret as plaintext)`
+        );
+      }
+    }
     let openRecord = record;
     let sealed;
-    if (this.ctx.storeCiphertext && this.ctx.sensitiveFields.size > 0) {
+    if (this.ctx.storeCiphertext && this.ctx.via?.hasAtRestHooks) {
+      if (id === void 0) {
+        throw new Error(
+          `RecordCodec.encryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this write path supplied no record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
+        );
+      }
       const src = record;
-      const dek2 = await this.ctx.getDEK();
-      const open = { ...src };
-      const slots = {};
-      for (const field of this.ctx.sensitiveFields) {
-        if (!(field in src)) continue;
-        const value = src[field];
-        if (value === void 0) continue;
-        const fieldKey = cek !== void 0 ? await deriveSealedFieldKeyFromCek(cek, this.ctx.name, field) : await deriveSealedFieldKey(dek2, this.ctx.name, field);
-        const { iv, data } = await encrypt(JSON.stringify(value), fieldKey);
-        slots[field] = `${iv}:${data}`;
-        delete open[field];
+      const result = await this.ctx.via.encodeAtRest(src, this.viaCryptoCtx(id, cek));
+      openRecord = result.record;
+      if (result.sealed !== void 0) {
+        sealed = {};
+        for (const [field, ref] of Object.entries(result.sealed)) sealed[field] = `${ref.iv}:${ref.data}`;
       }
-      if (Object.keys(slots).length > 0) {
-        sealed = slots;
-        openRecord = open;
+    } else if (this.ctx.storeCiphertext && this.ctx.sensitiveFields.size > 0) {
+      const src = record;
+      const result = await sealFields(src, this.ctx.sensitiveFields, this.sealKeyMaterial(cek));
+      if (result.sealed !== void 0) {
+        sealed = result.sealed;
+        openRecord = result.openRecord;
+      }
+    }
+    let vdigOut;
+    let bidxOutMap;
+    if (this.ctx.vdigFields !== null && this.ctx.vdigFields.size > 0 && this.ctx.storeCiphertext) {
+      if (vdig === void 0) {
+        throw new Error(
+          `RecordCodec.encryptRecord: collection "${this.ctx.name}" declares digest-only classified fields but this write path supplied no { id, prev } context \u2014 it would silently destroy _vdig (C6). Caller bug.`
+        );
+      }
+      if (cek === void 0) {
+        throw new Error(
+          `RecordCodec.encryptRecord: digest-only fields require a per-record CEK (R1 invariant) \u2014 collection "${this.ctx.name}" wrote without one. Caller bug.`
+        );
+      }
+      const open = { ...openRecord };
+      const out = {};
+      const bidxOut = {};
+      let bidxDek;
+      for (const [field, policy] of this.ctx.vdigFields) {
+        const value = open[field];
+        const prevBlob = vdig.prev?._vdig?.[field];
+        if (vdig.prev?._sealed?.[field] !== void 0) {
+          throw new ClassifiedConfigError(
+            this.ctx.name,
+            `field "${field}" carries a recoverable _sealed slot from a previous storage form \u2014 recoverable \u2194 digest-only transitions are refused (R6); migrate explicitly`
+          );
+        }
+        if (value === void 0) {
+          if (prevBlob !== void 0) {
+            out[field] = prevBlob;
+            const prevTag = vdig.prev?._bidx?.[field];
+            if (prevTag !== void 0) bidxOut[field] = prevTag;
+          }
+          continue;
+        }
+        if (value === null) {
+          delete open[field];
+          continue;
+        }
+        if (typeof value !== "string") {
+          throw new ValidationError(
+            `digest-only classified field "${field}" in "${this.ctx.name}" must be a string (rotate) or null (clear), got ${typeof value}`
+          );
+        }
+        out[field] = await mintVdigSlot(value, policy, prevBlob, cek, this.ctx.name, vdig.id, field);
+        if (policy.equatable === true) {
+          if (bidxDek === void 0) bidxDek = await this.ctx.getDEK();
+          const normalized = normalizeForVerify(policy.normalize, value);
+          bidxOut[field] = await mintBidxTag(normalized, bidxDek, this.ctx.name, field);
+        }
+        delete open[field];
       }
+      openRecord = open;
+      if (Object.keys(out).length > 0) vdigOut = out;
+      if (Object.keys(bidxOut).length > 0) bidxOutMap = bidxOut;
     }
     const base = await this.encryptJsonString(JSON.stringify(openRecord), version, cek, source, sourceTs);
     const withSealed = sealed ? { ...base, _sealed: sealed } : base;
-    if (!this.ctx.deterministicFields || !this.ctx.storeCiphertext) return withSealed;
+    const withVdig = vdigOut ? { ...withSealed, _vdig: vdigOut } : withSealed;
+    const withBidx = bidxOutMap ? { ...withVdig, _bidx: bidxOutMap } : withVdig;
+    if (!this.ctx.deterministicFields || !this.ctx.storeCiphertext) return withBidx;
     const dek = await this.ctx.getDEK();
+    const detKey = await deriveDeterministicKey(dek);
     const rec = record;
     const det = {};
     for (const field of this.ctx.deterministicFields) {
       if (this.ctx.sensitiveFields.has(field)) continue;
+      if (this.ctx.vdigFields?.has(field)) continue;
       const value = rec[field];
       if (value === void 0 || value === null) continue;
       const plaintext = typeof value === "string" ? value : JSON.stringify(value);
-      const { iv, data } = await encryptDeterministic(plaintext, dek, `${this.ctx.name}/${field}`);
+      const { iv, data } = await encryptDeterministic(plaintext, detKey, `${this.ctx.name}/${field}`);
       det[field] = `${iv}:${data}`;
     }
-    if (Object.keys(det).length === 0) return withSealed;
-    return { ...withSealed, _det: det };
+    if (Object.keys(det).length === 0) return withBidx;
+    return { ...withBidx, _det: det };
   }
   // ──────────────────────────────────────────────────────────────────────
   // Read path
@@ -629,7 +530,7 @@ var RecordCodec = class _RecordCodec {
    * callers (history, conflict merge) that have only the envelope.
    */
   async decryptJsonString(envelope, id) {
-    if (isTombstone(envelope, this.ctx.storeCiphertext)) return null;
+    if (isTombstone(envelope, this.ctx.storeCiphertext) || isDeleteMarker(envelope)) return null;
     if (!this.ctx.storeCiphertext) {
       if (envelope._debug !== void 0) {
         const rec = {};
@@ -638,7 +539,7 @@ var RecordCodec = class _RecordCodec {
         }
         return JSON.stringify(rec);
       }
-      return envelope._data;
+      return envelope._data === "" ? null : envelope._data;
     }
     const cek = await this.resolveEnvelopeCek(envelope, id);
     if (cek !== void 0) return decrypt(envelope._iv, envelope._data, cek);
@@ -653,8 +554,16 @@ var RecordCodec = class _RecordCodec {
    * materialisation always agree byte-for-byte.
    */
   async unsealField(field, blob, cek) {
-    const dek = await this.ctx.getDEK();
-    return JSON.parse(await dualReadSealedSlot(blob, field, this.ctx.name, cek, dek));
+    return unsealOneField(field, blob, this.sealKeyMaterial(cek));
+  }
+  /**
+   * Build the `ViaCryptoCtx` for forget()'s per-ref via-erase fold (#629
+   * Task 10) — resolves the live envelope's CEK exactly like
+   * `decryptRecord` does, then delegates to the same capability factory
+   * `encodeAtRest`/`decodeAtRest` use.
+   */
+  async eraseCryptoCtx(id, live) {
+    return this.viaCryptoCtx(id, await this.resolveEnvelopeCek(live, id));
   }
   /**
    * Classify a live envelope's `_sealed` slots for crypto-shred completeness.
@@ -668,25 +577,32 @@ var RecordCodec = class _RecordCodec {
    * `_cek` (pure legacy collection-DEK sealing) ALL slots are residue.
    */
   async classifySealedShred(live) {
-    const shreddable = [];
-    const dekResidue = [];
+    const slots = [];
+    if (live._vdig !== void 0 && live._cek !== void 0) {
+      for (const field of Object.keys(live._vdig)) {
+        slots.push({
+          field,
+          class: live._bidx?.[field] !== void 0 ? "live-shreddable+dekResidue-in-backups" : "shreddable"
+        });
+      }
+    }
     const sealed = live._sealed;
-    if (sealed === void 0) return { shreddable, dekResidue };
+    if (sealed === void 0) return { slots };
     const cek = await this.resolveEnvelopeCek(live);
     for (const [field, blob] of Object.entries(sealed)) {
       if (cek === void 0) {
-        dekResidue.push(field);
+        slots.push({ field, class: "dekResidue" });
         continue;
       }
       const { iv, data } = parseSealedSlot(blob);
       try {
         await decrypt(iv, data, await deriveSealedFieldKeyFromCek(cek, this.ctx.name, field));
-        shreddable.push(field);
+        slots.push({ field, class: "shreddable" });
       } catch {
-        dekResidue.push(field);
+        slots.push({ field, class: "dekResidue" });
       }
     }
-    return { shreddable, dekResidue };
+    return { slots };
   }
   /**
    * Build a non-leaking {@link Sealed} handle over a sealed field's ciphertext.
@@ -696,18 +612,26 @@ var RecordCodec = class _RecordCodec {
    * exposing the value, which decrypts only on `reveal()`.
    */
   makeSealedHandle(field, blob, cek) {
-    return new SealedHandle(() => this.unsealField(field, blob, cek));
+    return makeHandleProducer(this.sealKeyMaterial(cek))(field, blob);
   }
   /**
-   * Replace a record's declared sensitive fields with {@link Sealed} handles
-   * built from the just-written envelope's `_sealed` slots, leaving every
-   * other field as its plaintext value. Used to populate the cache on the
-   * write path without ever materialising sealed plaintext into it. Returns
-   * `record` untouched when the collection seals nothing.
+   * Replace every field the just-written envelope actually sealed with a
+   * {@link Sealed} handle, leaving every other field as its plaintext value.
+   * Used to populate the cache on the write path without ever materialising
+   * sealed plaintext into it. Returns `record` untouched when nothing was
+   * sealed. Keys off `envelope._sealed` itself (#642 fix) — NOT
+   * `this.ctx.sensitiveFields`, which only names the inline `sensitive:[...]`/
+   * classified-recoverable field set: a collection whose sealing comes
+   * entirely from the `taint` via-binding (a derivation/MV output or rollup
+   * target folded sealed from a classified SOURCE collection, #642) declares
+   * no local `sensitiveFields` at all, so that stale gate skipped this
+   * conversion and left a just-written taint-sealed field as cached
+   * plaintext — read back correctly ONLY after a cold cache miss (`get()`'s
+   * own `decodeAtRest` call, unaffected by this gate) forced a fresh decrypt.
    */
   async toCacheRecord(record, envelope, id) {
     const sealed = envelope._sealed;
-    if (sealed === void 0 || !this.ctx.storeCiphertext || this.ctx.sensitiveFields.size === 0) {
+    if (sealed === void 0 || !this.ctx.storeCiphertext) {
       return record;
     }
     const cek = await this.resolveEnvelopeCek(envelope, id);
@@ -717,6 +641,57 @@ var RecordCodec = class _RecordCodec {
     }
     return clone;
   }
+  /**
+   * Apply `_sealed`-slot post-processing to an ALREADY-DECRYPTED `record`:
+   * restore each `_sealed[field]` blob inline (`sealedAsHandles` falsy) or
+   * as an opaque {@link Sealed} handle (`sealedAsHandles: true`), routing
+   * through a via pipeline's `decodeAtRest` hook when one is declared.
+   * Extracted byte-parity from `decryptRecord`'s inline block (#635) so a
+   * caller that resolves its OWN per-record CEK under a DIFFERENT DEK than
+   * this codec's `this.ctx.getDEK()` — namely the tier>0 `getAtTier` leg in
+   * `with-audit/tiers/index.ts`, whose `_cek` is wrapped under the TIER DEK,
+   * not the collection DEK `decryptRecord`/`resolveEnvelopeCek` always
+   * unwrap under — can still get correct sealed-slot handling without
+   * routing its whole read through `decryptRecord` (which would resolve the
+   * wrong DEK for it).
+   *
+   * Zero-knowledge: takes only the already-resolved per-record `cek` (or
+   * `undefined` for a legacy/no-CEK record) — the same shape `makeSealedHandle`
+   * already takes above. Never the keyring, never a raw DEK: the legacy
+   * fallback key stays fully internal to `sealKeyMaterial`/`viaCryptoCtx`,
+   * which close over THIS codec's own `getDEK` (permanently bound to
+   * `this.ctx.name`'s tier-0 DEK at construction) — so even when called from
+   * a tier>0 context, the legacy-fallback key resolution is correct: sealed
+   * fields are always sealed under the CEK or the collection's tier-0 DEK,
+   * never a tier DEK (tier writes don't seal fields; `_sealed` reaches a
+   * tiered envelope only via a tier-0 write later elevated).
+   */
+  async applySealedSlots(record, sealed, cek, opts = {}) {
+    if (this.ctx.via?.hasAtRestHooks) {
+      if (opts.id === void 0) {
+        throw new Error(
+          `RecordCodec.decryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this read path supplied no record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
+        );
+      }
+      const sealedRefs = {};
+      for (const [field, blob] of Object.entries(sealed)) {
+        const { iv, data } = parseSealedSlot(blob);
+        sealedRefs[field] = { iv, data };
+      }
+      return await this.ctx.via.decodeAtRest(
+        record,
+        sealedRefs,
+        this.viaCryptoCtx(opts.id, cek),
+        { asHandles: opts.sealedAsHandles === true }
+      );
+    }
+    return await unsealFields(
+      record,
+      sealed,
+      this.sealKeyMaterial(cek),
+      { asHandles: opts.sealedAsHandles === true }
+    );
+  }
   /**
    * Decrypt an envelope into a record of type `T`.
    *
@@ -742,10 +717,10 @@ var RecordCodec = class _RecordCodec {
     let record = parsed;
     if (envelope._sealed !== void 0 && this.ctx.storeCiphertext) {
       const sealedCek = await this.resolveEnvelopeCek(envelope, opts.id);
-      const target = record;
-      for (const [field, blob] of Object.entries(envelope._sealed)) {
-        target[field] = opts.sealedAsHandles ? this.makeSealedHandle(field, blob, sealedCek) : await this.unsealField(field, blob, sealedCek);
-      }
+      record = await this.applySealedSlots(record, envelope._sealed, sealedCek, {
+        ...opts.id !== void 0 ? { id: opts.id } : {},
+        ...opts.sealedAsHandles !== void 0 ? { sealedAsHandles: opts.sealedAsHandles } : {}
+      });
     }
     const sealedAsHandles = opts.sealedAsHandles === true && envelope._sealed !== void 0;
     if (this.ctx.schema !== void 0 && !opts.skipValidation && !sealedAsHandles) {
@@ -760,7 +735,7 @@ var RecordCodec = class _RecordCodec {
 };
 
 // src/kernel/enclave/record-keys/sealing.ts
-var subtle2 = globalThis.crypto.subtle;
+var subtle = globalThis.crypto.subtle;
 var SEALED_CEK_NS = "_sealed_cek";
 async function sealRecordToHost(ctx, collection, id, hostSealer, opts) {
   if (collection.includes("/")) throw new ValidationError(`sealRecordToHost: collection "${collection}" must not contain "/"`);
@@ -774,7 +749,7 @@ async function sealRecordToHost(ctx, collection, id, hostSealer, opts) {
   }
   const dek = await ctx.getDEK(collection);
   const cek = await unwrapCek(live._cek, dek);
-  const rawCek = await subtle2.exportKey("raw", cek);
+  const rawCek = await subtle.exportKey("raw", cek);
   const cekB64 = bufferToBase64(rawCek);
   const hint = await hostSealer.publishRecipientHint();
   if (hint.pid.includes("/")) throw new ValidationError(`sealRecordToHost: recipient pid "${hint.pid}" must not contain "/"`);
@@ -837,6 +812,15 @@ async function rotateRecordCek(ctx, collection, id) {
     }
     sealedOut = out;
   }
+  let vdigOut;
+  if (live._vdig !== void 0) {
+    const out = {};
+    for (const [field, blob] of Object.entries(live._vdig)) {
+      const payload = await openVdigPayload(blob, oldCek, collection, id, field);
+      out[field] = await sealVdigPayload(payload, newCek, collection, id, field);
+    }
+    vdigOut = out;
+  }
   const env = {
     _noydb: NOYDB_FORMAT_VERSION,
     _v: live._v + 1,
@@ -847,12 +831,19 @@ async function rotateRecordCek(ctx, collection, id) {
     ...ctx.actor ? { _by: ctx.actor } : {},
     ...live._tier !== void 0 ? { _tier: live._tier } : {},
     ...live._det !== void 0 ? { _det: live._det } : {},
+    // `_bidx` (equality-index tag) is DEK-rooted and CEK-independent, so it is
+    // carried forward VERBATIM — not recomputed — unlike `_vdig`/`_sealed`
+    // below, which are CEK-bound and must be re-sealed under the new CEK.
+    // Dropping this line would silently orphan the equality index on rotation
+    // (the #306 Slice-A data-loss bug, replayed on the index).
+    ...live._bidx !== void 0 ? { _bidx: live._bidx } : {},
     // Re-encrypt sealed (`sensitive`) fields under the new CEK. Sealed
     // keys derive off the per-record CEK, so the rotated record's old CEK is
     // destroyed here — carrying the old `_sealed` slots forward verbatim would
     // orphan them (unreadable under the new CEK). `sealedOut` holds the slots
     // dual-read from the old CEK (or the legacy DEK) and re-sealed under newCek.
-    ...sealedOut !== void 0 ? { _sealed: sealedOut } : {}
+    ...sealedOut !== void 0 ? { _sealed: sealedOut } : {},
+    ...vdigOut !== void 0 ? { _vdig: vdigOut } : {}
   };
   await ctx.adapter.put(ctx.vault, collection, id, env);
   await ctx.invalidateRecordCaches(collection, id);
@@ -866,11 +857,16 @@ async function rotateRecordCek(ctx, collection, id) {
 }
 
 // src/kernel/enclave/record-keys/deterministic.ts
-async function detTarget(ctx, field, value) {
+async function detTargets(ctx, field, value) {
   const dek = await ctx.getDEK();
+  const detKey = await deriveDeterministicKey(dek);
   const plaintext = typeof value === "string" ? value : JSON.stringify(value);
-  const { iv, data } = await encryptDeterministic(plaintext, dek, `${ctx.name}/${field}`);
-  return `${iv}:${data}`;
+  const context = `${ctx.name}/${field}`;
+  const [current, legacy] = await Promise.all([
+    encryptDeterministic(plaintext, detKey, context),
+    encryptDeterministic(plaintext, dek, context)
+  ]);
+  return [`${current.iv}:${current.data}`, `${legacy.iv}:${legacy.data}`];
 }
 function assertDetField(ctx, field, method) {
   if (!ctx.deterministicFields || !ctx.deterministicFields.has(field)) {
@@ -886,27 +882,27 @@ function assertDetField(ctx, field, method) {
 }
 async function findByDet(ctx, field, value) {
   assertDetField(ctx, field, "findByDet");
-  const target = await detTarget(ctx, field, value);
+  const [target, legacyTarget] = await detTargets(ctx, field, value);
   const ids = await ctx.adapter.list(ctx.vault, ctx.name);
   for (const id of ids) {
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env || !env._det) continue;
-    if (env._det[field] === target) {
-      return ctx.codec.decryptRecord(env);
+    if (env._det[field] === target || env._det[field] === legacyTarget) {
+      return ctx.codec.decryptRecord(env, { id });
     }
   }
   return null;
 }
 async function queryByDet(ctx, field, value) {
   assertDetField(ctx, field, "queryByDet");
-  const target = await detTarget(ctx, field, value);
+  const [target, legacyTarget] = await detTargets(ctx, field, value);
   const ids = await ctx.adapter.list(ctx.vault, ctx.name);
   const matches = [];
   for (const id of ids) {
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env || !env._det) continue;
-    if (env._det[field] === target) {
-      const rec = await ctx.codec.decryptRecord(env);
+    if (env._det[field] === target || env._det[field] === legacyTarget) {
+      const rec = await ctx.codec.decryptRecord(env, { id });
       if (rec !== null) matches.push(rec);
     }
   }
@@ -937,44 +933,24 @@ function hasPerRecordKey(env) {
   return env._cek !== void 0;
 }
 function envelopeBodyForHash(env) {
-  if (env._sealed === void 0) return env._data;
-  const sealedKeys = Object.keys(env._sealed).sort();
-  const sealedParts = sealedKeys.map(
-    (k) => `${JSON.stringify(k)}:${JSON.stringify(env._sealed[k])}`
-  );
-  return `{"_data":${JSON.stringify(env._data)},"_sealed":{${sealedParts.join(",")}}}`;
+  if (env._sealed === void 0 && env._vdig === void 0 && env._bidx === void 0) return env._data;
+  const mapPart = (key, map) => {
+    const parts = Object.keys(map).sort().map(
+      (k) => `${JSON.stringify(k)}:${JSON.stringify(map[k])}`
+    );
+    return `${JSON.stringify(key)}:{${parts.join(",")}}`;
+  };
+  const segments = [`"_data":${JSON.stringify(env._data)}`];
+  if (env._sealed !== void 0) segments.push(mapPart("_sealed", env._sealed));
+  if (env._vdig !== void 0) segments.push(mapPart("_vdig", env._vdig));
+  if (env._bidx !== void 0) segments.push(mapPart("_bidx", env._bidx));
+  return `{${segments.join(",")}}`;
 }
 
 export {
-  deriveKey,
-  derivePassphraseKey,
-  generateDEK,
-  wrapKey,
-  unwrapKey,
-  wrapCek,
-  unwrapCek,
-  importCek,
-  encrypt,
-  decrypt,
-  encryptBytes,
-  decryptBytes,
-  sha256Hex,
-  hmacSha256Hex,
-  encryptBytesWithAAD,
-  decryptBytesWithAAD,
-  derivePresenceKey,
-  deriveSealedFieldKey,
-  deriveSealedFieldKeyFromCek,
-  encryptDeterministic,
-  decryptDeterministic,
-  generateIV,
-  generateSalt,
-  bufferToBase64,
-  base64ToBuffer,
   resolveStableCek,
   rewrapBodyToDek,
-  isTombstone,
-  buildTombstone,
+  makeReservedEnvelopes,
   validateSchemaInput,
   validateSchemaOutput,
   RecordCodec,
@@ -989,4 +965,4 @@ export {
   hasPerRecordKey,
   envelopeBodyForHash
 };
-//# sourceMappingURL=chunk-5O3AOPDT.js.map
+//# sourceMappingURL=chunk-MCHVVJIA.js.map