@noy-db/hub 0.3.0-pre.10 → 0.3.0-pre.11

package/dist/chunk-MSPNM2OM.js

@@ -0,0 +1,95 @@
+import {
+  base64ToBuffer,
+  decryptBytesWithAAD,
+  encryptBytesWithAAD
+} from "./chunk-HUS3J5WM.js";
+import {
+  TamperedError
+} from "./chunk-FH542DDY.js";
+
+// src/kernel/enclave/classify/compare.ts
+var subtle = globalThis.crypto.subtle;
+function ctEqualTags(a, b) {
+  if (a.length !== 32 || b.length !== 32) {
+    throw new Error(
+      `ctEqualTags: tags must be exactly 32 bytes (got ${a.length}/${b.length}) \u2014 caller bug; reduce comparands with blindedEqual first`
+    );
+  }
+  let diff = 0;
+  for (let i = 0; i < 32; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+async function blindedEqual(a, b) {
+  const ke = await subtle.generateKey({ name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const tagA = new Uint8Array(await subtle.sign("HMAC", ke, a));
+  const tagB = new Uint8Array(await subtle.sign("HMAC", ke, b));
+  return ctEqualTags(tagA, tagB);
+}
+
+// src/kernel/enclave/classify/vdig.ts
+var subtle2 = globalThis.crypto.subtle;
+var VDIG_SALT_DOMAIN = "noydb-classify-vdig";
+function buildVdigAad(collection, recordId, field) {
+  return new TextEncoder().encode(JSON.stringify([VDIG_SALT_DOMAIN, collection, recordId, field]));
+}
+async function deriveVdigSlotKey(cek, collection, field) {
+  const raw = await subtle2.exportKey("raw", cek);
+  const hkdf = await subtle2.importKey("raw", raw, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(VDIG_SALT_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([VDIG_SALT_DOMAIN, collection, field]));
+  const bits = await subtle2.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdf, 256);
+  return subtle2.importKey("raw", bits, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+async function sealVdigPayload(payload, cek, collection, recordId, field) {
+  const key = await deriveVdigSlotKey(cek, collection, field);
+  const { iv, data } = await encryptBytesWithAAD(
+    new TextEncoder().encode(JSON.stringify(payload)),
+    key,
+    buildVdigAad(collection, recordId, field)
+  );
+  return `${iv}:${data}`;
+}
+async function openVdigPayload(blob, cek, collection, recordId, field) {
+  const sep = blob.indexOf(":");
+  if (sep === -1) throw new TamperedError();
+  const ivPart = blob.slice(0, sep);
+  const dataPart = blob.slice(sep + 1);
+  try {
+    base64ToBuffer(ivPart);
+    base64ToBuffer(dataPart);
+  } catch {
+    throw new TamperedError();
+  }
+  const key = await deriveVdigSlotKey(cek, collection, field);
+  const bytes = await decryptBytesWithAAD(
+    ivPart,
+    dataPart,
+    key,
+    buildVdigAad(collection, recordId, field)
+  );
+  return JSON.parse(new TextDecoder().decode(bytes));
+}
+
+// src/kernel/enclave/classify/kofn.ts
+function evaluateKofN(results, min) {
+  if (!Number.isInteger(min) || min < 1 || min > results.length) {
+    throw new Error(
+      `evaluateKofN: min ${min} out of range 1..${results.length} \u2014 caller bug (matchGroup validates bounds up front, before any PBKDF2)`
+    );
+  }
+  let count = 0;
+  for (const r of results) {
+    if (r) count += 1;
+  }
+  return count >= min;
+}
+
+export {
+  ctEqualTags,
+  blindedEqual,
+  deriveVdigSlotKey,
+  sealVdigPayload,
+  openVdigPayload,
+  evaluateKofN
+};
+//# sourceMappingURL=chunk-MSPNM2OM.js.map

package/dist/chunk-O2DYPAZY.js

@@ -0,0 +1,23 @@
+import {
+  appendPeriodLedgerEntry,
+  assertTsWritable,
+  chainAnchor,
+  loadPeriods,
+  validatePeriodName
+} from "./chunk-FXK4X4BL.js";
+
+// src/with-audit/periods/active.ts
+function withPeriods() {
+  return {
+    loadPeriods,
+    chainAnchor,
+    assertTsWritable,
+    validatePeriodName,
+    appendPeriodLedgerEntry
+  };
+}
+
+export {
+  withPeriods
+};
+//# sourceMappingURL=chunk-O2DYPAZY.js.map

package/dist/chunk-ODJWBC5I.js

@@ -0,0 +1,30 @@
+import {
+  PortabilityNotEnabledError
+} from "./chunk-FH542DDY.js";
+
+// src/with-audit/portability/strategy.ts
+var NO_PORTABILITY = {
+  async exportAccessibleData() {
+    throw new PortabilityNotEnabledError();
+  },
+  async withdrawAccessibleData() {
+    throw new PortabilityNotEnabledError();
+  },
+  async requestWithdrawal() {
+    throw new PortabilityNotEnabledError();
+  },
+  async listWithdrawalRequests() {
+    throw new PortabilityNotEnabledError();
+  },
+  async approveWithdrawal() {
+    throw new PortabilityNotEnabledError();
+  },
+  async rejectWithdrawal() {
+    throw new PortabilityNotEnabledError();
+  }
+};
+
+export {
+  NO_PORTABILITY
+};
+//# sourceMappingURL=chunk-ODJWBC5I.js.map