@noy-db/hub 0.3.0-pre.2 → 0.3.0-pre.3

package/dist/chunk-5EZAJEES.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/enclave/record-keys/lifecycle.ts","../src/kernel/enclave/classify/write.ts","../src/kernel/schema.ts","../src/kernel/enclave/record-keys/record-codec.ts","../src/kernel/enclave/record-keys/sealing.ts","../src/kernel/enclave/record-keys/deterministic.ts","../src/kernel/enclave/record-keys/envelope-body.ts"],"sourcesContent":["/**\n * Per-record CEK lifecycle helpers for the WRITE path.\n *\n * These are the collection-coupled CEK operations, lifted off `Collection`\n * behind narrow deps so the kernel file delegates instead of carrying the\n * crypto inline:\n *\n *   - {@link resolveStableCek} — the stable-CEK rule: an update or history\n *     snapshot reuses the record's existing CEK so a single CEK delete kills\n *     the whole version chain; a genuine insert (or legacy record being\n *     migrated) mints a fresh one.\n *   - {@link rewrapBodyToDek} — move a record body's wrapping from one DEK to\n *     another (tier elevate/demote, bundle re-key) WITHOUT changing the body\n *     key: unwrap the CEK under the source DEK, re-encrypt the body under the\n *     same CEK, re-wrap the CEK under the destination DEK. History-chain\n *     identity is preserved because the body key never changes.\n *\n * Both are pure functions over their deps — the `cekCache` ownership stays on\n * the collection (its lifetime is tied to `load()`), so callers cache the\n * returned key themselves.\n */\nimport { encrypt, decrypt, generateDEK, wrapCek, unwrapCek, type EnclaveKey } from '../crypto.js'\nimport type { EncryptedEnvelope } from '../../types.js'\nimport type { Lru } from '../../cache/index.js'\n\n/** Dependencies {@link resolveStableCek} needs from its collection. */\nexport interface StableCekDeps {\n  /** The collection's per-record CEK cache (`null` → no caching). */\n  readonly cache: Lru<string, EnclaveKey> | null\n  /** Read the record's live envelope (to recover an existing `_cek`). */\n  getLive(id: string): Promise<EncryptedEnvelope | null>\n  /** The DEK the CEK is wrapped under (the collection DEK on the normal path). */\n  getDEK(): Promise<EnclaveKey>\n}\n\n/**\n * Resolve the stable CEK for a record on the write path. Caches the resolved\n * key under `id` so an update + its history snapshot share one CEK.\n */\nexport async function resolveStableCek(deps: StableCekDeps, id: string): Promise<EnclaveKey> {\n  const cached = deps.cache?.get(id)\n  if (cached) return cached\n\n  const live = await deps.getLive(id)\n  if (live?._cek !== undefined) {\n    const cek = await unwrapCek(live._cek, await deps.getDEK())\n    deps.cache?.set(id, cek, 1)\n    return cek\n  }\n\n  const fresh = await generateDEK()\n  deps.cache?.set(id, fresh, 1)\n  return fresh\n}\n\n/** Re-wrapped body bytes + the (optional) CEK to cache. */\nexport interface RewrappedBody {\n  readonly _iv: string\n  readonly _data: string\n  /** Present iff the source envelope carried a CEK (per-record-key record). */\n  readonly _cek?: string\n  /** The body key when one exists, so the caller can cache it; `null` for a legacy record. */\n  readonly cek: EnclaveKey | null\n}\n\n/**\n * Move a record body from `fromDek` to `toDek`.\n *\n * - Per-record-key record (`_cek` present): unwrap the CEK under `fromDek`,\n *   re-encrypt the body under the SAME CEK, re-wrap the CEK under `toDek`. The\n *   body key is unchanged → history-chain identity preserved.\n * - Legacy record (no `_cek`): decrypt under `fromDek`, re-encrypt under `toDek`\n *   directly — byte-for-byte the pre-CEK behaviour.\n */\nexport async function rewrapBodyToDek(\n  envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>,\n  fromDek: EnclaveKey,\n  toDek: EnclaveKey,\n): Promise<RewrappedBody> {\n  if (envelope._cek !== undefined) {\n    const cek = await unwrapCek(envelope._cek, fromDek)\n    const plaintext = await decrypt(envelope._iv, envelope._data, cek)\n    const { iv, data } = await encrypt(plaintext, cek)\n    return { _iv: iv, _data: data, _cek: await wrapCek(cek, toDek), cek }\n  }\n  const plaintext = await decrypt(envelope._iv, envelope._data, fromDek)\n  const { iv, data } = await encrypt(plaintext, toDek)\n  return { _iv: iv, _data: data, cek: null }\n}\n","/**\n * Digest-only write engine (C6 rotate branch + notLastN ring, spec §2/§4).\n * Called ONLY by RecordCodec.encryptRecord — both live inside the enclave.\n * @module\n */\nimport { generateSalt, bufferToBase64, base64ToBuffer, type EnclaveKey } from '../crypto.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\nimport { normalizeForVerify } from './normalize.js'\nimport { blindedEqual } from './compare.js'\nimport { sealVdigPayload, openVdigPayload, type VdigPayload, type VdigDigestEntry } from './vdig.js'\nimport { ClassifiedRotationError, TamperedError } from '../../errors.js'\nimport type { VdigFieldPolicy } from '../../types.js'\n\nexport async function mintVdigSlot(\n  rawValue: string,\n  policy: VdigFieldPolicy,\n  prevBlob: string | undefined,\n  cek: EnclaveKey,\n  collection: string,\n  recordId: string,\n  field: string,\n): Promise<string> {\n  const normalized = normalizeForVerify(policy.normalize, rawValue)\n\n  let prev: VdigPayload | null = null\n  if (prevBlob !== undefined) {\n    try {\n      prev = await openVdigPayload(prevBlob, cek, collection, recordId, field)\n    } catch {\n      // Any failure opening a prior _vdig slot (auth-tag mismatch, malformed\n      // JSON, wrong AAD) is a tamper/false condition — normalize to\n      // TamperedError so the write path never sees a distinct error shape.\n      throw new TamperedError()\n    }\n    if (!Number.isInteger(prev.iter) || prev.iter < 1) {\n      // A corrupted/tampered iter count would silently weaken (or break)\n      // the reuse-check PBKDF2 pass — floor/validate before trusting it.\n      throw new TamperedError()\n    }\n  }\n\n  // notLastN reuse refusal: candidate vs cur + every ring entry, each a full\n  // PBKDF2 at the payload's own iteration count (n × 600K is the documented\n  // write-time cost ceiling, cap 8 — spec Q4).\n  if (prev !== null && policy.notLastN > 0) {\n    const history: readonly VdigDigestEntry[] = [prev.cur, ...(prev.ring ?? [])]\n    for (const entry of history) {\n      const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(entry.salt), prev.iter)\n      if (await blindedEqual(digest, base64ToBuffer(entry.hash))) {\n        throw new ClassifiedRotationError(collection, field, 'password was used recently')\n      }\n    }\n  }\n\n  const salt = generateSalt()\n  const hash = await pbkdf2VerifyDigest(normalized, salt, VDIG_ITERATIONS)\n  const ring = prev !== null && policy.notLastN > 0\n    ? [...(prev.ring ?? []), { salt: prev.cur.salt, hash: prev.cur.hash }].slice(-policy.notLastN)\n    : undefined\n\n  const payload: VdigPayload = {\n    v: 1,\n    alg: 'PBKDF2-SHA256',\n    iter: VDIG_ITERATIONS,\n    cur: { salt: bufferToBase64(salt), hash: bufferToBase64(hash), at: new Date().toISOString() },\n    ...(ring !== undefined && ring.length > 0 ? { ring } : {}),\n  }\n  return sealVdigPayload(payload, cek, collection, recordId, field)\n}\n","/**\n * Standard Schema v1 integration.\n *\n * This file is the entry point for **schema validation**. Any\n * validator that implements the [Standard Schema v1\n * protocol](https://standardschema.dev) — Zod, Valibot, ArkType, Effect\n * Schema, etc. — can be attached to a `Collection` or `defineNoydbStore`\n * and will:\n *\n *   1. Validate the record BEFORE encryption on `put()` — bad data is\n *      rejected at the store boundary with a rich issue list.\n *   2. Validate the record AFTER decryption on `get()`/`list()`/`query()`\n *      — stored data that has drifted from the current schema throws\n *      loudly instead of silently propagating garbage to the UI.\n *\n * ## Why vendor the types?\n *\n * Standard Schema is a protocol, not a library. The spec is <200 lines of\n * TypeScript and has no runtime. There's an official `@standard-schema/spec`\n * types package on npm, but pulling it in would add a dependency edge\n * purely for type definitions. Vendoring the minimal surface keeps\n * `@noy-db/core` at **zero runtime dependencies** and gives us freedom to\n * evolve the helpers without a version-lock on the spec package.\n *\n * If the spec changes in a breaking way (unlikely — it's frozen at v1),\n * we update this file and bump our minor.\n *\n * ## Why not just run `schema.parse(value)` directly?\n *\n * Because then we'd be locked to whichever validator happens to have\n * `.parse`. Standard Schema's `'~standard'.validate` contract is the same\n * across every implementation and includes a structured issues list,\n * which is much more useful than a thrown error for programmatic error\n * handling (e.g., rendering field-level messages in a Vue component).\n */\n\nimport { SchemaValidationError } from './errors.js'\n\n/**\n * The Standard Schema v1 protocol. A schema is any object that exposes a\n * `'~standard'` property with `version: 1` and a `validate` function.\n *\n * The type parameters are:\n *   - `Input`  — the type accepted by `validate` (what the user passes in)\n *   - `Output` — the type produced by `validate` (what we store/return,\n *                may differ from Input if the schema transforms or coerces)\n *\n * In most cases `Input === Output`, but validators that transform\n * (Zod's `.transform`, Valibot's `transform`, etc.) can narrow or widen.\n *\n * We intentionally keep the `types` field `readonly` and optional — the\n * spec marks it as optional because it's only used for inference, and\n * not every implementation bothers populating it at runtime.\n */\nexport interface StandardSchemaV1<Input = unknown, Output = Input> {\n  readonly '~standard': {\n    readonly version: 1\n    readonly vendor: string\n    readonly validate: (\n      value: unknown,\n    ) =>\n      | StandardSchemaV1SyncResult<Output>\n      | Promise<StandardSchemaV1SyncResult<Output>>\n    readonly types?:\n      | {\n          readonly input: Input\n          readonly output: Output\n        }\n      | undefined\n  }\n}\n\n/**\n * The result of a single call to `schema['~standard'].validate`. Either\n * `{ value }` on success or `{ issues }` on failure — never both.\n *\n * The spec allows `issues` to be undefined on success (and some\n * validators leave it that way), so consumers should discriminate on\n * `issues?.length` rather than on truthiness of `value`.\n */\nexport type StandardSchemaV1SyncResult<Output> =\n  | { readonly value: Output; readonly issues?: undefined }\n  | {\n      readonly value?: undefined\n      readonly issues: readonly StandardSchemaV1Issue[]\n    }\n\n/**\n * A single validation issue. The `message` is always present; the `path`\n * is optional and points at the offending field when the schema tracks\n * it (virtually every validator does for object types).\n *\n * The path is deliberately permissive — both a plain `PropertyKey` and a\n * `{ key }` wrapper are allowed so validators that wrap path segments in\n * objects (Zod does this in some modes) don't need special handling.\n */\nexport interface StandardSchemaV1Issue {\n  readonly message: string\n  readonly path?:\n    | ReadonlyArray<PropertyKey | { readonly key: PropertyKey }>\n    | undefined\n}\n\n/**\n * Infer the output type of a Standard Schema. Consumers use this to\n * pull the type out of a schema instance when they want to declare a\n * Collection<T> or defineNoydbStore<T> with `T` derived from the schema.\n *\n * Example:\n * ```ts\n * const InvoiceSchema = z.object({ id: z.string(), amount: z.number() })\n * type Invoice = InferOutput<typeof InvoiceSchema>\n * ```\n */\nexport type InferOutput<T extends StandardSchemaV1> =\n  T extends StandardSchemaV1<unknown, infer O> ? O : never\n\n/**\n * Validate an input value against a schema. Throws\n * `SchemaValidationError` if the schema rejects, with the rich issue\n * list attached. Otherwise returns the (possibly transformed) output\n * value.\n *\n * The `context` string is included in the thrown error's message so the\n * caller knows where the failure happened (e.g. `\"put(inv-001)\"`) without\n * every caller having to wrap the throw in a try/catch.\n *\n * This function is ALWAYS async because some validators (notably Effect\n * Schema and Zod's `.refine` with async predicates) can return a\n * Promise. We `await` the result unconditionally to normalize the\n * contract — the extra microtask is free compared to the cost of an\n * encrypt/decrypt round-trip.\n */\nexport async function validateSchemaInput<Output>(\n  schema: StandardSchemaV1<unknown, Output>,\n  value: unknown,\n  context: string,\n): Promise<Output> {\n  const result = await schema['~standard'].validate(value)\n  if (result.issues !== undefined && result.issues.length > 0) {\n    throw new SchemaValidationError(\n      `Schema validation failed on ${context}: ${summarizeIssues(result.issues)}`,\n      result.issues,\n      'input',\n    )\n  }\n  // Safe: the spec guarantees `value` is present when `issues` is absent.\n  return result.value as Output\n}\n\n/**\n * Validate an already-stored value coming OUT of the collection. This\n * is a distinct helper from `validateSchemaInput` because the error\n * semantics differ: an output-validation failure means the data in\n * storage has drifted from the current schema (an unexpected state),\n * whereas an input-validation failure means the user passed bad data\n * (an expected state for a UI that isn't guarding its inputs).\n *\n * We still throw — silently returning bad data would be worse — but\n * the error carries `direction: 'output'` so upstream code (and a\n * potential migrate hook) can distinguish the two cases.\n */\nexport async function validateSchemaOutput<Output>(\n  schema: StandardSchemaV1<unknown, Output>,\n  value: unknown,\n  context: string,\n): Promise<Output> {\n  const result = await schema['~standard'].validate(value)\n  if (result.issues !== undefined && result.issues.length > 0) {\n    throw new SchemaValidationError(\n      `Stored data for ${context} does not match the current schema — ` +\n        `schema drift? ${summarizeIssues(result.issues)}`,\n      result.issues,\n      'output',\n    )\n  }\n  return result.value as Output\n}\n\n/**\n * Produce a short human-readable summary of an issue list for the\n * thrown error's message. The full issue array is still attached to the\n * error as a property — this is only for the `.message` string that\n * shows up in console.error / stack traces.\n *\n * Format: `field: message; field2: message2` (up to 3 issues, then `…`).\n * Issues without a path are shown as `root: message`.\n */\nfunction summarizeIssues(\n  issues: readonly StandardSchemaV1Issue[],\n): string {\n  const shown = issues.slice(0, 3).map((issue) => {\n    const pathStr = formatPath(issue.path)\n    return `${pathStr}: ${issue.message}`\n  })\n  const suffix = issues.length > 3 ? ` (+${issues.length - 3} more)` : ''\n  return shown.join('; ') + suffix\n}\n\nfunction formatPath(\n  path: StandardSchemaV1Issue['path'],\n): string {\n  if (!path || path.length === 0) return 'root'\n  return path\n    .map((segment) =>\n      typeof segment === 'object' && segment !== null\n        ? String(segment.key)\n        : String(segment),\n    )\n    .join('.')\n}\n","/**\n * RecordCodec — the per-record envelope build + encrypt/decrypt + per-record-CEK\n * + sealed-field crypto.\n *\n * `Collection` holds one `RecordCodec` instance and delegates the crypto write\n * path (`encryptRecord` / `encryptJsonString` / `buildDebugEnvelope`), the read\n * path (`decryptRecord` / `decryptJsonString` / `resolveEnvelopeCek`), and the\n * sealed-field helpers (`unsealField` / `makeSealedHandle` / `toCacheRecord` /\n * `classifySealedShred`) to it. The codec receives every `this.*` dependency\n * it needs via {@link RecordCodecContext}.\n *\n * The crux is `cekCache`: it is the SAME `Lru` reference `Collection` owns (not\n * a copy). `resolveEnvelopeCek` reads/writes it, and tier methods +\n * `vault.invalidateRecordCaches` keep mutating that same object — a copy would\n * silently break the \"single CEK delete kills the version chain\" invariant.\n *\n * Internal service — not exported as a `@noy-db/hub/*` subpath.\n */\nimport { encrypt, decrypt, encryptDeterministic, deriveDeterministicKey, wrapCek, unwrapCek, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, type EnclaveKey } from '../crypto.js'\nimport { NOYDB_FORMAT_VERSION, SealedHandle, type EncryptedEnvelope, type CrdtMode, type CrdtState, type CrdtStrategy, type VdigFieldPolicy } from '../../types.js'\nimport { isTombstone } from './tombstone.js'\nimport { parseSealedSlot, dualReadSealedSlot } from './sealed-slot.js'\nimport { DebugReservedFieldError, ClassifiedConfigError, ValidationError } from '../../errors.js'\nimport { mintVdigSlot } from '../classify/write.js'\nimport { validateSchemaOutput, type StandardSchemaV1 } from '../../schema.js'\nimport type { Lru } from '../../cache/index.js'\n\n/** Everything the moving crypto methods touched on `this.*`, as a flat context. */\nexport interface RecordCodecContext<T> {\n  /** Collection name — the crypto AAD scope and schema-error context. */\n  readonly name: string\n  /** Actor id stamped on `_by` (the collection's keyring.userId). */\n  readonly actor: string\n  /** False on plaintext collections — selects the no-ciphertext envelope branch. */\n  readonly storeCiphertext: boolean\n  /** keyring.debugPlaintext — debug-inline envelope on user collections. */\n  readonly debugPlaintext: boolean\n  /** Emit `_source`/`_sourceTs` provenance fields when a source is supplied. */\n  readonly provenance: boolean\n  /** Declared `sensitive` fields → sealed into `_sealed[field]`. */\n  readonly sensitiveFields: ReadonlySet<string>\n  /** Declared deterministic-index fields, or null. */\n  readonly deterministicFields: ReadonlySet<string> | null\n  /** Digest-only classified fields → verify policy (stage 2). Null when none. */\n  readonly vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null\n  /** CRDT mode (decrypt resolves CrdtState→snapshot when set). */\n  readonly crdtMode: CrdtMode | undefined\n  /** CRDT strategy seam (resolveCrdtSnapshot). */\n  readonly crdtStrategy: CrdtStrategy\n  /** Output-schema validator, or undefined. */\n  readonly schema: StandardSchemaV1<unknown, T> | undefined\n  /** The collection DEK (codec only ever needs this.name's DEK). */\n  getDEK(): Promise<EnclaveKey>\n  /**\n   * The collection's per-record CEK cache (SHARED reference, not a copy).\n   * Ownership/lifetime stays on Collection; codec reads+writes it in\n   * resolveEnvelopeCek exactly as the inline code did. `null` → no caching.\n   */\n  readonly cekCache: Lru<string, EnclaveKey> | null\n}\n\nexport class RecordCodec<T> {\n  constructor(private readonly ctx: RecordCodecContext<T>) {}\n\n  // ──────────────────────────────────────────────────────────────────────\n  // Low-level literal builders\n  // ──────────────────────────────────────────────────────────────────────\n\n  /**\n   * Assemble a canonical ciphertext body envelope literal from already-computed\n   * parts. Pure, no crypto. Each call stamps its own `_ts` — provenance carries\n   * a SEPARATE timestamp (computed by the caller), so the two never share one.\n   */\n  static buildEnvelope(p: {\n    version: number\n    iv: string\n    data: string\n    by?: string\n    cek?: string\n    provenance?: { source: string; sourceTs: string } | undefined\n    extra?: Partial<Pick<EncryptedEnvelope, '_tier' | '_det' | '_sealed'>>\n  }): EncryptedEnvelope {\n    return {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: p.version,\n      _ts: new Date().toISOString(),\n      _iv: p.iv,\n      _data: p.data,\n      ...(p.by !== undefined ? { _by: p.by } : {}),\n      ...(p.cek !== undefined ? { _cek: p.cek } : {}),\n      ...(p.provenance !== undefined ? { _source: p.provenance.source, _sourceTs: p.provenance.sourceTs } : {}),\n      ...(p.extra ?? {}),\n    }\n  }\n\n  /** Plaintext (`_iv:''`) body envelope — the `!storeCiphertext` shape. */\n  static buildPlaintextEnvelope(p: {\n    version: number\n    data: string\n    by?: string\n    provenance?: { source: string; sourceTs: string } | undefined\n  }): EncryptedEnvelope {\n    return {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: p.version,\n      _ts: new Date().toISOString(),\n      _iv: '',\n      _data: p.data,\n      ...(p.by !== undefined ? { _by: p.by } : {}),\n      ...(p.provenance !== undefined ? { _source: p.provenance.source, _sourceTs: p.provenance.sourceTs } : {}),\n    }\n  }\n\n  // ──────────────────────────────────────────────────────────────────────\n  // Write path\n  // ──────────────────────────────────────────────────────────────────────\n\n  /**\n   * Build a debug-plaintext envelope: the record's own fields inlined as\n   * top-level keys beside the reserved `_`-metadata, with `_debug: 1` and an\n   * empty `_data`. Lets native store tooling read the record without\n   * unwrapping. Only reached for user collections under `debugPlaintext`\n   * (see {@link encryptRecord}). Rejects `_`-prefixed record fields, which\n   * would collide with the reserved metadata namespace.\n   */\n  buildDebugEnvelope(record: T, version: number, source?: string, sourceTs?: string): EncryptedEnvelope {\n    const rec = record as unknown as Record<string, unknown>\n    for (const key of Object.keys(rec)) {\n      if (key.startsWith('_')) throw new DebugReservedFieldError(this.ctx.name, key)\n    }\n    return {\n      _noydb: NOYDB_FORMAT_VERSION,\n      _v: version,\n      _ts: new Date().toISOString(),\n      _iv: '',\n      _data: '',\n      _by: this.ctx.actor,\n      _debug: NOYDB_FORMAT_VERSION,\n      ...(this.ctx.provenance && source !== undefined ? { _source: source, _sourceTs: sourceTs ?? new Date().toISOString() } : {}),\n      ...rec,\n    } as unknown as EncryptedEnvelope\n  }\n\n  /**\n   * Encrypt a JSON body into an envelope.\n   *\n   * When `cek` is supplied (per-record CEK collections), the body is\n   * encrypted under the CEK and the CEK is AES-KW-wrapped under the\n   * collection DEK and stamped on `_cek`. When `cek` is omitted, the legacy\n   * path encrypts the body directly under the collection DEK — byte-identical\n   * to pre-CEK behaviour, so non-adopting collections pay nothing.\n   */\n  async encryptJsonString(\n    json: string,\n    version: number,\n    cek?: EnclaveKey,\n    source?: string,\n    sourceTs?: string,\n  ): Promise<EncryptedEnvelope> {\n    const by = this.ctx.actor\n    const provenance = this.ctx.provenance && source !== undefined\n      ? { source, sourceTs: sourceTs ?? new Date().toISOString() }\n      : undefined\n\n    if (!this.ctx.storeCiphertext) {\n      return RecordCodec.buildPlaintextEnvelope({ version, data: json, by, provenance })\n    }\n\n    const dek = await this.ctx.getDEK()\n\n    if (cek !== undefined) {\n      const { iv, data } = await encrypt(json, cek)\n      const wrapped = await wrapCek(cek, dek)\n      return RecordCodec.buildEnvelope({ version, iv, data, by, cek: wrapped, provenance })\n    }\n\n    const { iv, data } = await encrypt(json, dek)\n    return RecordCodec.buildEnvelope({ version, iv, data, by, provenance })\n  }\n\n  async encryptRecord(\n    record: T,\n    version: number,\n    cek?: EnclaveKey,\n    source?: string,\n    sourceTs?: string,\n    vdig?: { readonly id: string; readonly prev: EncryptedEnvelope | null },\n  ): Promise<EncryptedEnvelope> {\n    // Debug-plaintext: write user-collection records with their fields inlined\n    // beside the envelope metadata so native store tools read them directly.\n    // Internal (`_`-prefixed) collections keep the classic shape — some store\n    // `_`-prefixed fields that the inline layout would collide with.\n    if (!this.ctx.storeCiphertext && this.ctx.debugPlaintext && !this.ctx.name.startsWith('_')) {\n      return this.buildDebugEnvelope(record, version, source, sourceTs)\n    }\n\n    // Structural group-encryption: peel declared sensitive fields out\n    // of the record BEFORE building `_data`, sealing each into its own\n    // `_sealed[field]` slot under a per-field key. Default-off — with no\n    // sensitive fields the open record is unchanged and no `_sealed` is\n    // emitted, so the envelope stays byte-identical to legacy output.\n    let openRecord = record\n    let sealed: Record<string, string> | undefined\n    if (this.ctx.storeCiphertext && this.ctx.sensitiveFields.size > 0) {\n      const src = record as unknown as Record<string, unknown>\n      const dek = await this.ctx.getDEK()\n      const open: Record<string, unknown> = { ...src }\n      const slots: Record<string, string> = {}\n      for (const field of this.ctx.sensitiveFields) {\n        if (!(field in src)) continue\n        const value = src[field]\n        if (value === undefined) continue\n        const fieldKey = cek !== undefined\n          ? await deriveSealedFieldKeyFromCek(cek, this.ctx.name, field)\n          : await deriveSealedFieldKey(dek, this.ctx.name, field)\n        const { iv, data } = await encrypt(JSON.stringify(value), fieldKey)\n        slots[field] = `${iv}:${data}`\n        delete open[field]\n      }\n      if (Object.keys(slots).length > 0) {\n        sealed = slots\n        openRecord = open as unknown as T\n      }\n    }\n\n    // ── Digest-only classified fields (stage 2, C6) ────────────────────\n    // Per field, exactly one of: carry-forward (absent) / rotate (string) /\n    // clear (null) / loud error (anything else). Runs on a CLONE so the\n    // caller's record object is never mutated.\n    let vdigOut: Record<string, string> | undefined\n    if (this.ctx.vdigFields !== null && this.ctx.vdigFields.size > 0 && this.ctx.storeCiphertext) {\n      if (vdig === undefined) {\n        throw new Error(\n          `RecordCodec.encryptRecord: collection \"${this.ctx.name}\" declares digest-only classified ` +\n          `fields but this write path supplied no { id, prev } context — it would silently destroy _vdig (C6). Caller bug.`,\n        )\n      }\n      if (cek === undefined) {\n        throw new Error(\n          `RecordCodec.encryptRecord: digest-only fields require a per-record CEK (R1 invariant) — ` +\n          `collection \"${this.ctx.name}\" wrote without one. Caller bug.`,\n        )\n      }\n      const open: Record<string, unknown> = { ...(openRecord as unknown as Record<string, unknown>) }\n      const out: Record<string, string> = {}\n      for (const [field, policy] of this.ctx.vdigFields) {\n        const value = open[field]\n        const prevBlob = vdig.prev?._vdig?.[field]\n        if (vdig.prev?._sealed?.[field] !== undefined) {\n          // R6 transition evidence: never silently delete recoverable\n          // plaintext. Checked BEFORE the value-type dispatch so the\n          // carry-forward (absent) and clear (null) branches refuse too —\n          // both would otherwise drop the `_sealed` slot from the new\n          // envelope, silently destroying the recoverable ciphertext.\n          throw new ClassifiedConfigError(\n            this.ctx.name,\n            `field \"${field}\" carries a recoverable _sealed slot from a previous storage form — ` +\n            `recoverable ↔ digest-only transitions are refused (R6); migrate explicitly`,\n          )\n        }\n        if (value === undefined) {\n          // 1. carry-forward: verbatim bytes (CEK version-stable, AAD _v-free;\n          //    byte-identity keeps the ledger payload hash deterministic).\n          if (prevBlob !== undefined) out[field] = prevBlob\n          continue\n        }\n        if (value === null) {\n          // 3. clear: the defined deletion short of forget().\n          delete open[field]\n          continue\n        }\n        if (typeof value !== 'string') {\n          // 4. caller bug, fail-loud.\n          throw new ValidationError(\n            `digest-only classified field \"${field}\" in \"${this.ctx.name}\" must be a string (rotate) or null (clear), got ${typeof value}`,\n          )\n        }\n        // 2. rotate: validate ran in the stage-1 write seam; digest + ring here.\n        out[field] = await mintVdigSlot(value, policy, prevBlob, cek, this.ctx.name, vdig.id, field)\n        delete open[field] // strip from _data — digest-only never persists plaintext\n      }\n      openRecord = open as unknown as T\n      if (Object.keys(out).length > 0) vdigOut = out\n    }\n\n    const base = await this.encryptJsonString(JSON.stringify(openRecord), version, cek, source, sourceTs)\n    const withSealed = sealed ? { ...base, _sealed: sealed } : base\n    const withVdig = vdigOut ? { ...withSealed, _vdig: vdigOut } : withSealed\n    if (!this.ctx.deterministicFields || !this.ctx.storeCiphertext) return withVdig\n\n    // compute deterministic-ciphertext slots for every\n    // declared field. Non-primitive values are JSON-stringified so\n    // objects/arrays still dedupe on structural equality. Sealed fields are\n    // excluded — they live only in `_sealed`, never the `_det` index.\n    // L-1: `_det` encrypts under a dedicated HKDF-derived key (salt\n    // `noydb-det`), never the raw DEK — the DEK's randomized-IV `_data`\n    // regime and `_det`'s deterministic-IV regime must not share a key.\n    const dek = await this.ctx.getDEK()\n    const detKey = await deriveDeterministicKey(dek)\n    const rec = record as unknown as Record<string, unknown>\n    const det: Record<string, string> = {}\n    for (const field of this.ctx.deterministicFields) {\n      if (this.ctx.sensitiveFields.has(field)) continue\n      if (this.ctx.vdigFields?.has(field)) continue // I5: digest-only never equality-correlatable\n      const value = rec[field]\n      if (value === undefined || value === null) continue\n      const plaintext = typeof value === 'string' ? value : JSON.stringify(value)\n      const { iv, data } = await encryptDeterministic(plaintext, detKey, `${this.ctx.name}/${field}`)\n      det[field] = `${iv}:${data}`\n    }\n    if (Object.keys(det).length === 0) return withVdig\n    return { ...withVdig, _det: det }\n  }\n\n  // ──────────────────────────────────────────────────────────────────────\n  // Read path\n  // ──────────────────────────────────────────────────────────────────────\n\n  /**\n   * Resolve the per-record CEK for a stored envelope, or `undefined` for a\n   * legacy (`_cek`-absent) envelope. Unwraps `_cek` under the collection DEK and\n   * memoises it in the CEK cache under `id` (when supplied) so repeated reads of\n   * the same record skip the unwrap. Shared by the body-decrypt path\n   * ({@link decryptJsonString}) and the sealed-field path ({@link decryptRecord}\n   * / {@link toCacheRecord}) so both agree on the record's key.\n   */\n  async resolveEnvelopeCek(envelope: EncryptedEnvelope, id?: string): Promise<EnclaveKey | undefined> {\n    if (envelope._cek === undefined) return undefined\n    const cached = id !== undefined ? this.ctx.cekCache?.get(id) : undefined\n    if (cached !== undefined) return cached\n    const dek = await this.ctx.getDEK()\n    const cek = await unwrapCek(envelope._cek, dek)\n    if (id !== undefined) this.ctx.cekCache?.set(id, cek, 1)\n    return cek\n  }\n\n  /**\n   * Low-level: decrypt an envelope and return the raw JSON string.\n   *\n   * `_cek` presence is the format discriminant (NOT `this.perRecordCek`),\n   * so a mixed vault — and a recipient that never opted into\n   * `perRecordKeys` — decrypts both legacy and CEK records:\n   *  - `_cek` present → unwrap the CEK under the collection DEK, decrypt the\n   *    body under the CEK (cache the unwrapped CEK so repeated reads skip it).\n   *  - `_cek` absent → legacy path, body decrypts directly under the\n   *    collection DEK.\n   *\n   * The optional `id` lets reads populate the CEK cache; it is omitted by\n   * callers (history, conflict merge) that have only the envelope.\n   */\n  async decryptJsonString(envelope: EncryptedEnvelope, id?: string): Promise<string | null> {\n    // RISK #1 (forget cascade): a shred tombstone carries `_data: ''` and no\n    // `_cek`. Decrypting it would call `decrypt('', '', dek)` → AES-GCM\n    // OperationError → TamperedError. Return null so every read callsite\n    // treats it as \"absent / skip\", matching how get()/list already drop\n    // tombstones. Legacy plaintext collections (`!this.storeCiphertext`) legitimately\n    // have empty `_iv`/`_data`, so `isTombstone` is false for them — preserved.\n    if (isTombstone(envelope, this.ctx.storeCiphertext)) return null\n    if (!this.ctx.storeCiphertext) {\n      // Debug-plaintext layout: record fields were inlined as top-level keys\n      // (see buildDebugEnvelope). Reconstruct the record from the non-`_`\n      // keys. Self-describing via `_debug`, so a classic plaintext reader\n      // handles debug-written envelopes too.\n      if (envelope._debug !== undefined) {\n        const rec: Record<string, unknown> = {}\n        for (const [key, value] of Object.entries(envelope)) {\n          if (!key.startsWith('_')) rec[key] = value\n        }\n        return JSON.stringify(rec)\n      }\n      return envelope._data\n    }\n    const cek = await this.resolveEnvelopeCek(envelope, id)\n    if (cek !== undefined) return decrypt(envelope._iv, envelope._data, cek)\n    const dek = await this.ctx.getDEK()\n    return decrypt(envelope._iv, envelope._data, dek)\n  }\n\n  /**\n   * Unseal a single `_sealed[field]` slot to its plaintext value: derive the\n   * per-field key off the collection DEK, AES-GCM-decrypt the `iv:data` blob,\n   * and JSON-parse the result. Shared by both the inline-decrypt path and a\n   * {@link Sealed} handle's `reveal()` — so the on-demand reveal and the eager\n   * materialisation always agree byte-for-byte.\n   */\n  async unsealField(field: string, blob: string, cek?: EnclaveKey): Promise<unknown> {\n    // Dual-read. Current writes seal under a key derived from the record's\n    // per-record CEK; legacy records (even ones whose body is\n    // CEK-encrypted) are sealed under the collection-DEK key. Try the CEK key\n    // first; on its AES-GCM auth failure, fall back to the DEK key. Without this\n    // fallback every legacy `_sealed` record would throw TamperedError (data loss).\n    const dek = await this.ctx.getDEK()\n    return JSON.parse(await dualReadSealedSlot(blob, field, this.ctx.name, cek, dek))\n  }\n\n  /**\n   * Classify a live envelope's `_sealed` slots for crypto-shred completeness.\n   * `forget()` drops `_cek`/`_sealed` but\n   * RETAINS the collection DEK, so only a slot keyed off the per-record CEK is\n   * genuinely shredded by the tombstone; a legacy slot keyed off the\n   * collection DEK survives in any synced/backup copy.\n   *\n   * Mirrors {@link unsealField}'s dual-read split: try the CEK-derived key per\n   * slot — success → `shreddable`, AES-GCM auth failure → `dekResidue`. With no\n   * `_cek` (pure legacy collection-DEK sealing) ALL slots are residue.\n   */\n  async classifySealedShred(\n    live: EncryptedEnvelope,\n  ): Promise<{ shreddable: string[]; dekResidue: string[] }> {\n    const shreddable: string[] = []\n    const dekResidue: string[] = []\n    // Verify-digest slots are CEK-only by construction (I3): dropping `_cek`\n    // makes every `_vdig[field]` permanently undecryptable — shreddable\n    // unconditionally, no vdig-dekResidue class (spec §2 forget()). Same\n    // honesty caveats as #306 D5 for synced/backup copies of the ciphertext.\n    if (live._vdig !== undefined && live._cek !== undefined) {\n      shreddable.push(...Object.keys(live._vdig))\n    }\n    const sealed = live._sealed\n    if (sealed === undefined) return { shreddable, dekResidue }\n    const cek = await this.resolveEnvelopeCek(live)\n    for (const [field, blob] of Object.entries(sealed)) {\n      if (cek === undefined) { dekResidue.push(field); continue }\n      const { iv, data } = parseSealedSlot(blob)\n      try {\n        await decrypt(iv, data, await deriveSealedFieldKeyFromCek(cek, this.ctx.name, field))\n        shreddable.push(field)\n      } catch {\n        dekResidue.push(field)\n      }\n    }\n    return { shreddable, dekResidue }\n  }\n\n  /**\n   * Build a non-leaking {@link Sealed} handle over a sealed field's ciphertext.\n   * The handle captures only the ciphertext `blob` and a closure to\n   * {@link unsealField}; the plaintext is never stored on it — so the handle\n   * may sit in the working-set cache (or be logged/serialised) without\n   * exposing the value, which decrypts only on `reveal()`.\n   */\n  makeSealedHandle(field: string, blob: string, cek?: EnclaveKey): SealedHandle<unknown> {\n    return new SealedHandle(() => this.unsealField(field, blob, cek))\n  }\n\n  /**\n   * Replace a record's declared sensitive fields with {@link Sealed} handles\n   * built from the just-written envelope's `_sealed` slots, leaving every\n   * other field as its plaintext value. Used to populate the cache on the\n   * write path without ever materialising sealed plaintext into it. Returns\n   * `record` untouched when the collection seals nothing.\n   */\n  async toCacheRecord(record: T, envelope: EncryptedEnvelope, id?: string): Promise<T> {\n    const sealed = envelope._sealed\n    if (sealed === undefined || !this.ctx.storeCiphertext || this.ctx.sensitiveFields.size === 0) {\n      return record\n    }\n    const cek = await this.resolveEnvelopeCek(envelope, id)\n    const clone = { ...(record as unknown as Record<string, unknown>) }\n    for (const [field, blob] of Object.entries(sealed)) {\n      clone[field] = this.makeSealedHandle(field, blob, cek)\n    }\n    return clone as unknown as T\n  }\n\n  /**\n   * Decrypt an envelope into a record of type `T`.\n   *\n   * When a schema is attached, the decrypted value is validated before\n   * being returned. A divergence between the stored bytes and the\n   * current schema throws `SchemaValidationError` with\n   * `direction: 'output'` — silently returning drifted data would\n   * propagate garbage into the UI and break the whole point of having\n   * a schema.\n   *\n   * `skipValidation` exists for history reads: when calling\n   * `getVersion()` the caller is explicitly asking for an old snapshot\n   * that may predate a schema change, so validating it would be a\n   * false positive. Every non-history read leaves this flag `false`.\n   */\n  async decryptRecord(\n    envelope: EncryptedEnvelope,\n    opts: { skipValidation?: boolean; id?: string; sealedAsHandles?: boolean } = {},\n  ): Promise<T | null> {\n    const json = await this.decryptJsonString(envelope, opts.id)\n    // Tombstone (shredded record) → null, propagated from decryptJsonString.\n    // Callers skip null exactly as they already skip a tombstone envelope.\n    if (json === null) return null\n    let parsed: unknown = JSON.parse(json)\n\n    // CRDT resolution: if this collection is in CRDT mode, the\n    // stored JSON is a CrdtState, not T directly. Resolve to the snapshot.\n    if (this.ctx.crdtMode && parsed !== null && typeof parsed === 'object' && '_crdt' in parsed) {\n      parsed = this.ctx.crdtStrategy.resolveCrdtSnapshot(parsed as CrdtState)\n    }\n\n    let record = parsed as T\n\n    // Structural group-encryption + sealed access gate.\n    // Each `_sealed[field]` slot is restored under its own per-field key.\n    // `sealedAsHandles: false` (default — internal callers that compute on\n    // real values) inline-decrypts to the plaintext value; `true` (the\n    // public / cache path) yields an opaque {@link Sealed} handle so the\n    // plaintext is never materialised into the working-set cache.\n    if (envelope._sealed !== undefined && this.ctx.storeCiphertext) {\n      const sealedCek = await this.resolveEnvelopeCek(envelope, opts.id)\n      const target = record as unknown as Record<string, unknown>\n      for (const [field, blob] of Object.entries(envelope._sealed)) {\n        target[field] = opts.sealedAsHandles\n          ? this.makeSealedHandle(field, blob, sealedCek)\n          : await this.unsealField(field, blob, sealedCek)\n      }\n    }\n\n    // Skip output validation when sealed fields are returned as handles:\n    // the record carries opaque `Sealed` handles in place of the declared\n    // values, so a whole-record schema check would false-positive on them.\n    // (The values were validated on input/write; the open fields are\n    // unchanged from the validated body.) The inline-value path below still\n    // validates fully.\n    const sealedAsHandles = opts.sealedAsHandles === true && envelope._sealed !== undefined\n    if (this.ctx.schema !== undefined && !opts.skipValidation && !sealedAsHandles) {\n      // Context string deliberately avoids leaking the record id — the\n      // envelope only carries the version, not the id (the id lives in\n      // the adapter-side key). `<collection>@v<n>` is enough for the\n      // developer to find the offending record.\n      record = await validateSchemaOutput(\n        this.ctx.schema,\n        record,\n        `${this.ctx.name}@v${envelope._v}`,\n      )\n    }\n\n    return record\n  }\n}\n","/**\n * Record-scoped CEK sealing — grantor side.\n *\n * The **grantor** holds the collection DEK and seals ONE record's CEK to an\n * `at-*` host so that host — and only that host — can decrypt exactly that\n * record, with no access to the vault DEK and no ability to read any other\n * record. This is the counterpart to the host-side `openSealedRecord`\n * (`@noy-db/hub/sealed-record`), which holds no DEK.\n *\n * These functions are the orchestration behind `vault.sealRecordToHost` /\n * `vault.revokeSealedRecord` / `vault.rotateRecordCek`, lifted off `Vault`\n * behind a narrow {@link SealingContext} so the kernel file delegates. They\n * live in `record-keys/` (the vault-side CEK policy layer), NOT in\n * `sealed-record/`, so the host-side subpath stays DEK-free — the wire\n * *types* they share are spine-owned (`kernel/types.ts`), not imported from\n * `sealed-record/` directly.\n */\nimport { encrypt, decrypt, generateDEK, wrapCek, unwrapCek, bufferToBase64, deriveSealedFieldKeyFromCek, type EnclaveKey } from '../crypto.js'\nimport {\n  NOYDB_FORMAT_VERSION,\n  type EncryptedEnvelope,\n  type NoydbStore,\n  type RecipientSealer,\n  type SealedCekBinding,\n  type SealedCekDeliveryEnvelope,\n} from '../../types.js'\nimport { dualReadSealedSlot } from './sealed-slot.js'\nimport { openVdigPayload, sealVdigPayload } from '../classify/vdig.js'\nimport { RecordCekNotFoundError, ValidationError } from '../../errors.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/** The `_sealed_cek` delivery namespace (one envelope per `collection/id/pid`). */\nexport const SEALED_CEK_NS = '_sealed_cek'\n\n/** What the grantor functions need from their `Vault`. */\nexport interface SealingContext {\n  readonly adapter: NoydbStore\n  /** Vault id (the adapter's first coordinate). */\n  readonly vault: string\n  /** Resolve the DEK a record's CEK is wrapped under. */\n  getDEK(collection: string): Promise<EnclaveKey>\n  /** Actor id stamped on `_by` (empty string → omit). */\n  readonly actor: string\n  /** Evict the per-record CEK cache + decrypted-record cache after a rotation. */\n  invalidateRecordCaches(collection: string, id: string): Promise<void>\n}\n\n/**\n * Seal a record's CEK to a host. See `vault.sealRecordToHost` for the contract.\n * Returns `{ pid, envelopeKey }`.\n */\nexport async function sealRecordToHost(\n  ctx: SealingContext,\n  collection: string,\n  id: string,\n  hostSealer: RecipientSealer,\n  opts: { expiresAt: string },\n): Promise<{ pid: string; envelopeKey: string }> {\n  // Guard separators: the `_sealed_cek` id is `collection/id/pid`, so a `/` in\n  // any component would make the prefix-delete in rotateRecordCek() (which\n  // matches `${collection}/${id}/`) ambiguous and could over- or under-match.\n  if (collection.includes('/')) throw new ValidationError(`sealRecordToHost: collection \"${collection}\" must not contain \"/\"`)\n  if (id.includes('/')) throw new ValidationError(`sealRecordToHost: id \"${id}\" must not contain \"/\"`)\n  // M-4: reject a malformed/empty expiry at seal time. `Date.parse('')` (and any\n  // non-ISO string) is NaN, and the open-time check `NaN <= now` is `false` — so\n  // a malformed expiry would silently mint an ETERNAL grant. A *past* (but valid)\n  // timestamp is still allowed: it seals, then fails closed at open time.\n  if (Number.isNaN(Date.parse(opts.expiresAt))) {\n    throw new ValidationError(`sealRecordToHost: expiresAt \"${opts.expiresAt}\" is not a valid ISO 8601 timestamp`)\n  }\n\n  const live = await ctx.adapter.get(ctx.vault, collection, id)\n  if (!live || live._cek === undefined) {\n    throw new RecordCekNotFoundError(collection, id)\n  }\n\n  const dek = await ctx.getDEK(collection)\n  const cek = await unwrapCek(live._cek, dek)\n  const rawCek = await subtle.exportKey('raw', cek)\n  const cekB64 = bufferToBase64(rawCek)\n\n  const hint = await hostSealer.publishRecipientHint()\n  if (hint.pid.includes('/')) throw new ValidationError(`sealRecordToHost: recipient pid \"${hint.pid}\" must not contain \"/\"`)\n\n  const binding: SealedCekBinding = {\n    collection,\n    id,\n    cek: cekB64,\n    expiresAt: opts.expiresAt,\n  }\n  const sealed = await hostSealer.sealForRecipient(\n    new TextEncoder().encode(JSON.stringify(binding)),\n    hint,\n  )\n\n  const delivery: SealedCekDeliveryEnvelope = {\n    v: 1,\n    _noydb_sealed_cek: 1,\n    pid: hint.pid,\n    payload: bufferToBase64(sealed),\n    expiresAt: opts.expiresAt,\n  }\n\n  const envelopeKey = `${collection}/${id}/${hint.pid}`\n  const prior = await ctx.adapter.get(ctx.vault, SEALED_CEK_NS, envelopeKey)\n  const env: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: (prior?._v ?? 0) + 1,\n    _ts: new Date().toISOString(),\n    // AES-GCM bypassed — the sealing layer is the security boundary, exactly\n    // like the managed-passphrase `_meta/sealed-passphrase` envelope.\n    _iv: '',\n    _data: JSON.stringify(delivery),\n    ...(ctx.actor ? { _by: ctx.actor } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, SEALED_CEK_NS, envelopeKey, env)\n\n  return { pid: hint.pid, envelopeKey }\n}\n\n/**\n * Revoke one sealed-CEK grant.\n *\n * **Default (`{ hard: false }`) is SOFT** — it only deletes the delivery\n * envelope from the store. A host that already fetched (or cached the unsealed\n * CEK from) that envelope KEEPS decrypt capability for the record; soft revoke\n * is a \"stop new fetches\" control, not a cryptographic cutoff.\n *\n * **`{ hard: true }`** additionally rotates the record's CEK (via\n * {@link rotateRecordCek}): the live body is re-encrypted under a fresh CEK and\n * EVERY sealed-CEK delivery envelope for the record (all pids) is deleted, so\n * any previously-sealed CEK fails the AES-GCM auth tag on the rotated body —\n * future opens are cryptographically denied. (PRE-rotation history versions,\n * which keep their old `_cek`, remain openable — same semantics as\n * `rotateRecordCek`.)\n */\nexport async function revokeSealedRecord(\n  ctx: SealingContext,\n  collection: string,\n  id: string,\n  pid: string,\n  opts?: { hard?: boolean },\n): Promise<void> {\n  if (opts?.hard === true) {\n    // Hard revocation supersedes the single-pid soft delete: rotateRecordCek\n    // re-keys the record and drops every delivery envelope for it.\n    await rotateRecordCek(ctx, collection, id)\n    return\n  }\n  await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, `${collection}/${id}/${pid}`)\n}\n\n/**\n * HARD-rotate a record's CEK: re-encrypt the live body under a fresh CEK, evict\n * caches, and delete EVERY sealed-CEK delivery envelope for the record. See\n * `vault.rotateRecordCek` for why this bypasses `Collection.put` (no guards, no\n * history bump — a key rotation must not re-encrypt prior history under the new\n * CEK).\n */\nexport async function rotateRecordCek(\n  ctx: SealingContext,\n  collection: string,\n  id: string,\n): Promise<void> {\n  const live = await ctx.adapter.get(ctx.vault, collection, id)\n  if (!live || live._cek === undefined) {\n    throw new RecordCekNotFoundError(collection, id)\n  }\n\n  const dek = await ctx.getDEK(collection)\n  const oldCek = await unwrapCek(live._cek, dek)\n  const json = await decrypt(live._iv, live._data, oldCek)\n\n  const newCek = await generateDEK()\n  const { iv, data } = await encrypt(json, newCek)\n\n  // Sealed fields are keyed off the per-record CEK, so a rotation\n  // must RE-ENCRYPT each `_sealed[field]` under the new CEK (carrying the old\n  // slots forward would orphan them — the old CEK is gone after this rotate).\n  // Dual-read the old slot: try the old-CEK-derived key, fall\n  // back to the collection-DEK key (legacy), then re-seal under newCek.\n  let sealedOut: Record<string, string> | undefined\n  if (live._sealed !== undefined) {\n    const out: Record<string, string> = {}\n    for (const [field, slot] of Object.entries(live._sealed)) {\n      const plaintext = await dualReadSealedSlot(slot, field, collection, oldCek, dek)\n      const resealed = await encrypt(plaintext, await deriveSealedFieldKeyFromCek(newCek, collection, field))\n      out[field] = `${resealed.iv}:${resealed.data}`\n    }\n    sealedOut = out\n  }\n\n  // Verify-digest slots are keyed off the per-record CEK too (I3: CEK-only,\n  // no DEK fallback → single read, not a dual-read). Rotation must re-seal\n  // each `_vdig[field]` under the new CEK with the SAME reconstructed AAD, or\n  // the correct password would false-reject forever (C3).\n  let vdigOut: Record<string, string> | undefined\n  if (live._vdig !== undefined) {\n    const out: Record<string, string> = {}\n    for (const [field, blob] of Object.entries(live._vdig)) {\n      const payload = await openVdigPayload(blob, oldCek, collection, id, field)\n      out[field] = await sealVdigPayload(payload, newCek, collection, id, field)\n    }\n    vdigOut = out\n  }\n\n  const env: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: live._v + 1,\n    _ts: new Date().toISOString(),\n    _iv: iv,\n    _data: data,\n    _cek: await wrapCek(newCek, dek),\n    ...(ctx.actor ? { _by: ctx.actor } : {}),\n    ...(live._tier !== undefined ? { _tier: live._tier } : {}),\n    ...(live._det !== undefined ? { _det: live._det } : {}),\n    // Re-encrypt sealed (`sensitive`) fields under the new CEK. Sealed\n    // keys derive off the per-record CEK, so the rotated record's old CEK is\n    // destroyed here — carrying the old `_sealed` slots forward verbatim would\n    // orphan them (unreadable under the new CEK). `sealedOut` holds the slots\n    // dual-read from the old CEK (or the legacy DEK) and re-sealed under newCek.\n    ...(sealedOut !== undefined ? { _sealed: sealedOut } : {}),\n    ...(vdigOut !== undefined ? { _vdig: vdigOut } : {}),\n  }\n  await ctx.adapter.put(ctx.vault, collection, id, env)\n\n  // Evict BOTH caches synchronously so no read returns the stale old-CEK record.\n  await ctx.invalidateRecordCaches(collection, id)\n\n  // Delete every sealed-CEK delivery envelope for this record — all pids.\n  const prefix = `${collection}/${id}/`\n  const keys = await ctx.adapter.list(ctx.vault, SEALED_CEK_NS)\n  for (const key of keys) {\n    if (key.startsWith(prefix)) {\n      await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, key)\n    }\n  }\n}\n","/**\n * Deterministic-index lookups (`findByDet` / `queryByDet`).\n *\n * A collection that declares `deterministicFields` stamps a deterministic\n * AES-GCM ciphertext for each such field on the envelope's `_det` slot at write\n * time (the encrypt side lives in {@link RecordCodec.encryptRecord}). These\n * helpers are the READ side: recompute the deterministic ciphertext for a query\n * value and scan the adapter for envelopes whose `_det[field]` matches — no\n * record bodies are decrypted during the scan, which is the whole point of a\n * deterministic index.\n *\n * Both functions take a small {@link DeterministicContext} (the exact `this.*`\n * the moving methods touched) instead of `this`, mirroring the `record-keys/`\n * siblings. Behaviour is byte-identical to the inline code they replaced.\n *\n * Internal service — not exported as a `@noy-db/hub/*` subpath.\n */\nimport { encryptDeterministic, deriveDeterministicKey, type EnclaveKey } from '../crypto.js'\nimport type { NoydbStore } from '../../types.js'\nimport type { RecordCodec } from './record-codec.js'\n\n/** Everything the moving deterministic-index methods touched on `this.*`. */\nexport interface DeterministicContext<T> {\n  /** Collection name — the deterministic-encryption AAD scope. */\n  readonly name: string\n  /** Vault namespace the records live under. */\n  readonly vault: string\n  /** The ciphertext store (scanned envelope-by-envelope). */\n  readonly adapter: NoydbStore\n  /** Declared deterministic-index fields, or null when the feature is off. */\n  readonly deterministicFields: ReadonlySet<string> | null\n  /** False on plaintext collections — det lookups are encrypted-only. */\n  readonly storeCiphertext: boolean\n  /** The collection DEK resolver. */\n  getDEK(): Promise<EnclaveKey>\n  /** The record codec — decrypts a matched envelope to T. */\n  readonly codec: RecordCodec<T>\n}\n\n/**\n * Recompute the deterministic ciphertext targets for a query value.\n *\n * L-1: _det migrated to a dedicated HKDF key (salt noydb-det); dual-query\n * keeps pre-migration envelopes findable — they self-heal to the new key on\n * their next write. Index 0 is the current (derived-key) target, index 1 the\n * legacy raw-DEK target. Both are derived once per query call, not per\n * envelope, so the extra derivation is a fixed cost.\n */\nasync function detTargets<T>(ctx: DeterministicContext<T>, field: string, value: unknown): Promise<[string, string]> {\n  const dek = await ctx.getDEK()\n  const detKey = await deriveDeterministicKey(dek)\n  const plaintext = typeof value === 'string' ? value : JSON.stringify(value)\n  const context = `${ctx.name}/${field}`\n  const [current, legacy] = await Promise.all([\n    encryptDeterministic(plaintext, detKey, context),\n    encryptDeterministic(plaintext, dek, context),\n  ])\n  return [`${current.iv}:${current.data}`, `${legacy.iv}:${legacy.data}`]\n}\n\nfunction assertDetField<T>(ctx: DeterministicContext<T>, field: string, method: string): void {\n  if (!ctx.deterministicFields || !ctx.deterministicFields.has(field)) {\n    throw new Error(\n      `Collection \"${ctx.name}\": field \"${field}\" is not declared in deterministicFields`,\n    )\n  }\n  if (!ctx.storeCiphertext) {\n    throw new Error(\n      `Collection \"${ctx.name}\": ${method} is only meaningful on encrypted collections`,\n    )\n  }\n}\n\n/**\n * Find the first record whose deterministic field matches the given plaintext.\n * Returns `null` when no match exists.\n *\n * Reads every envelope via the adapter and compares the stored `_det[field]` to\n * a freshly computed deterministic ciphertext — no record bodies are decrypted\n * during the search.\n *\n * Throws when the field is not declared in `deterministicFields`, so a typo\n * fails loudly at the call site rather than silently returning null forever.\n */\nexport async function findByDet<T>(ctx: DeterministicContext<T>, field: string, value: unknown): Promise<T | null> {\n  assertDetField(ctx, field, 'findByDet')\n  const [target, legacyTarget] = await detTargets(ctx, field, value)\n\n  const ids = await ctx.adapter.list(ctx.vault, ctx.name)\n  for (const id of ids) {\n    const env = await ctx.adapter.get(ctx.vault, ctx.name, id)\n    if (!env || !env._det) continue\n    if (env._det[field] === target || env._det[field] === legacyTarget) {\n      return ctx.codec.decryptRecord(env)\n    }\n  }\n  return null\n}\n\n/**\n * Return every record whose deterministic field matches. Same semantics as\n * {@link findByDet} but without the short-circuit.\n */\nexport async function queryByDet<T>(ctx: DeterministicContext<T>, field: string, value: unknown): Promise<T[]> {\n  assertDetField(ctx, field, 'queryByDet')\n  const [target, legacyTarget] = await detTargets(ctx, field, value)\n\n  const ids = await ctx.adapter.list(ctx.vault, ctx.name)\n  const matches: T[] = []\n  for (const id of ids) {\n    const env = await ctx.adapter.get(ctx.vault, ctx.name, id)\n    if (!env || !env._det) continue\n    if (env._det[field] === target || env._det[field] === legacyTarget) {\n      const rec = await ctx.codec.decryptRecord(env)\n      if (rec !== null) matches.push(rec) // skip tombstone (defensive)\n    }\n  }\n  return matches\n}\n","/**\n * Enclave body helpers — the C1 protected-body access contract.\n *\n * `EncryptedEnvelope` splits into a protocol header (family-owned; `_noydb`,\n * `_v`, `_ts`, `_by`, `_source`, `_sourceTs`, `_tier`, `_elevatedBy`) and a\n * protected body (enclave-owned; `_iv`, `_data`, `_cek`, `_det`, `_sealed`,\n * `_debug`). The four helpers below are the ONLY sanctioned way for code\n * outside `kernel/enclave/**` to read or construct the protected body —\n * later migration batches move the ~121 direct `_iv`/`_data`/`_cek`/`_sealed`\n * access sites in `with-*` services onto these.\n *\n * Each helper reproduces an EXISTING behavior byte-for-byte (see the\n * per-function doc for its oracle call site) — this file introduces no new\n * crypto or semantics, only a narrower door onto what already runs.\n */\nimport { encrypt, decrypt, generateDEK, wrapCek, unwrapCek, type EnclaveKey } from '../crypto.js'\nimport type { EncryptedEnvelope } from '../../types.js'\n\n/**\n * Open an envelope's protected body to its JSON text.\n *\n * Mirrors the dominant direct-decrypt call-site shape (e.g.\n * `with-audit/consent/consent.ts`'s `decryptEntry`):\n *  - `opts.encrypted === false` (default `true`) → plaintext collection;\n *    returns `env._data` as-is, `key` untouched.\n *  - `env._cek` present → per-record-key envelope (mirrors\n *    `record-codec.ts`'s `resolveEnvelopeCek`): unwrap the CEK under `key`\n *    (the collection DEK), decrypt the body under the unwrapped CEK.\n *  - `env._cek` absent → legacy path, decrypt the body directly under `key`.\n */\nexport async function openEnvelopeJson(\n  env: EncryptedEnvelope,\n  key: EnclaveKey,\n  opts?: { encrypted?: boolean },\n): Promise<string> {\n  if (opts?.encrypted === false) return env._data\n  if (env._cek !== undefined) {\n    const cek = await unwrapCek(env._cek, key)\n    return decrypt(env._iv, env._data, cek)\n  }\n  return decrypt(env._iv, env._data, key)\n}\n\n/**\n * Produce the protected-body fields (`_iv`/`_data`/`_cek`) for an envelope a\n * caller is assembling.\n *\n *  - `opts.encrypted === false` (default `true`) → plaintext collection;\n *    emits `{ _iv: '', _data: json }` (today's `buildPlaintextEnvelope`\n *    shape), `key` untouched.\n *  - `opts.perRecordKey === true` → mints a fresh per-record CEK, encrypts\n *    the body under it, and AES-KW-wraps the CEK under `key` (mirrors\n *    `encryptJsonString`'s `cek !== undefined` branch, except the CEK is\n *    generated here rather than supplied by the caller).\n *  - otherwise → legacy path, body encrypted directly under `key`.\n */\nexport async function writeEnvelopeBody(\n  json: string,\n  key: EnclaveKey,\n  opts?: { encrypted?: boolean; perRecordKey?: boolean },\n): Promise<Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>> {\n  if (opts?.encrypted === false) return { _iv: '', _data: json }\n\n  if (opts?.perRecordKey === true) {\n    const cek = await generateDEK()\n    const { iv, data } = await encrypt(json, cek)\n    const wrapped = await wrapCek(cek, key)\n    return { _iv: iv, _data: data, _cek: wrapped }\n  }\n\n  const { iv, data } = await encrypt(json, key)\n  return { _iv: iv, _data: data }\n}\n\n/**\n * Discriminant: does this envelope carry a per-record key?\n *\n * Replaces raw `envelope._cek !== undefined` checks scattered across\n * services — `_cek` presence is the format discriminant (see\n * `record-codec.ts`'s `resolveEnvelopeCek` doc).\n */\nexport function hasPerRecordKey(env: EncryptedEnvelope): boolean {\n  return env._cek !== undefined\n}\n\n/**\n * Canonical body string for the ledger hash chain — the exact bytes\n * `with-commit/history/ledger/hash.ts`'s `envelopePayloadHash` derives from\n * `_data` + `_sealed` + `_vdig` before hashing:\n *  - no `_sealed`, no `_vdig` → `_data` alone (back-compat: every\n *    pre-existing ledger entry and non-sealed backup hashes byte-identically).\n *  - either map present → canonical JSON of `{ _data, _sealed?, _vdig? }`\n *    with sorted keys at every level, each map bound ONLY when present, so\n *    the result is independent of the maps' field-insertion / store-\n *    serialization order.\n *\n * Deliberately reimplements the two-key-object canonicalization inline\n * rather than importing `with-commit/history/ledger/entry.ts`'s general\n * `canonicalJson` — `kernel/enclave/**` may import only spine types (C3),\n * never a `with-*` service. For this fixed `{ _data: string; _sealed:\n * Record<string, string> }` shape the two produce byte-identical output\n * (verified against that exact call site's oracle expression in\n * `envelope-body.test.ts`).\n */\nexport function envelopeBodyForHash(env: EncryptedEnvelope): string {\n  // Conditional widen (stage 2): bind `_vdig` exactly the way `_sealed` is\n  // bound — only when present. No existing envelope carries `_vdig`, so this\n  // ships with no flag-day PROVIDED it lands in the same slice as the first\n  // `_vdig` writer (it does — Tasks 7/8/11 are one branch). This binding is\n  // the temporal-rollback detector completing C1: AAD stops cross-record/\n  // cross-field splices; the ledger hash catches same-slot rollbacks.\n  if (env._sealed === undefined && env._vdig === undefined) return env._data\n  const mapPart = (key: '_sealed' | '_vdig', map: Record<string, string>): string => {\n    const parts = Object.keys(map).sort().map(\n      (k) => `${JSON.stringify(k)}:${JSON.stringify(map[k])}`,\n    )\n    return `${JSON.stringify(key)}:{${parts.join(',')}}`\n  }\n  const segments = [`\"_data\":${JSON.stringify(env._data)}`]\n  if (env._sealed !== undefined) segments.push(mapPart('_sealed', env._sealed))\n  if (env._vdig !== undefined) segments.push(mapPart('_vdig', env._vdig))\n  return `{${segments.join(',')}}`\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,eAAsB,iBAAiB,MAAqB,IAAiC;AAC3F,QAAM,SAAS,KAAK,OAAO,IAAI,EAAE;AACjC,MAAI,OAAQ,QAAO;AAEnB,QAAM,OAAO,MAAM,KAAK,QAAQ,EAAE;AAClC,MAAI,MAAM,SAAS,QAAW;AAC5B,UAAM,MAAM,MAAM,UAAU,KAAK,MAAM,MAAM,KAAK,OAAO,CAAC;AAC1D,SAAK,OAAO,IAAI,IAAI,KAAK,CAAC;AAC1B,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,MAAM,YAAY;AAChC,OAAK,OAAO,IAAI,IAAI,OAAO,CAAC;AAC5B,SAAO;AACT;AAqBA,eAAsB,gBACpB,UACA,SACA,OACwB;AACxB,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,MAAM,MAAM,UAAU,SAAS,MAAM,OAAO;AAClD,UAAMA,aAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AACjE,UAAM,EAAE,IAAAC,KAAI,MAAAC,MAAK,IAAI,MAAM,QAAQF,YAAW,GAAG;AACjD,WAAO,EAAE,KAAKC,KAAI,OAAOC,OAAM,MAAM,MAAM,QAAQ,KAAK,KAAK,GAAG,IAAI;AAAA,EACtE;AACA,QAAM,YAAY,MAAM,QAAQ,SAAS,KAAK,SAAS,OAAO,OAAO;AACrE,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,KAAK;AACnD,SAAO,EAAE,KAAK,IAAI,OAAO,MAAM,KAAK,KAAK;AAC3C;;;AC3EA,eAAsB,aACpB,UACA,QACA,UACA,KACA,YACA,UACA,OACiB;AACjB,QAAM,aAAa,mBAAmB,OAAO,WAAW,QAAQ;AAEhE,MAAI,OAA2B;AAC/B,MAAI,aAAa,QAAW;AAC1B,QAAI;AACF,aAAO,MAAM,gBAAgB,UAAU,KAAK,YAAY,UAAU,KAAK;AAAA,IACzE,QAAQ;AAIN,YAAM,IAAI,cAAc;AAAA,IAC1B;AACA,QAAI,CAAC,OAAO,UAAU,KAAK,IAAI,KAAK,KAAK,OAAO,GAAG;AAGjD,YAAM,IAAI,cAAc;AAAA,IAC1B;AAAA,EACF;AAKA,MAAI,SAAS,QAAQ,OAAO,WAAW,GAAG;AACxC,UAAM,UAAsC,CAAC,KAAK,KAAK,GAAI,KAAK,QAAQ,CAAC,CAAE;AAC3E,eAAW,SAAS,SAAS;AAC3B,YAAM,SAAS,MAAM,mBAAmB,YAAY,eAAe,MAAM,IAAI,GAAG,KAAK,IAAI;AACzF,UAAI,MAAM,aAAa,QAAQ,eAAe,MAAM,IAAI,CAAC,GAAG;AAC1D,cAAM,IAAI,wBAAwB,YAAY,OAAO,4BAA4B;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,aAAa;AAC1B,QAAM,OAAO,MAAM,mBAAmB,YAAY,MAAM,eAAe;AACvE,QAAM,OAAO,SAAS,QAAQ,OAAO,WAAW,IAC5C,CAAC,GAAI,KAAK,QAAQ,CAAC,GAAI,EAAE,MAAM,KAAK,IAAI,MAAM,MAAM,KAAK,IAAI,KAAK,CAAC,EAAE,MAAM,CAAC,OAAO,QAAQ,IAC3F;AAEJ,QAAM,UAAuB;AAAA,IAC3B,GAAG;AAAA,IACH,KAAK;AAAA,IACL,MAAM;AAAA,IACN,KAAK,EAAE,MAAM,eAAe,IAAI,GAAG,MAAM,eAAe,IAAI,GAAG,KAAI,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,IAC5F,GAAI,SAAS,UAAa,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,CAAC;AAAA,EAC1D;AACA,SAAO,gBAAgB,SAAS,KAAK,YAAY,UAAU,KAAK;AAClE;;;ACiEA,eAAsB,oBACpB,QACA,OACA,SACiB;AACjB,QAAM,SAAS,MAAM,OAAO,WAAW,EAAE,SAAS,KAAK;AACvD,MAAI,OAAO,WAAW,UAAa,OAAO,OAAO,SAAS,GAAG;AAC3D,UAAM,IAAI;AAAA,MACR,+BAA+B,OAAO,KAAK,gBAAgB,OAAO,MAAM,CAAC;AAAA,MACzE,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AAEA,SAAO,OAAO;AAChB;AAcA,eAAsB,qBACpB,QACA,OACA,SACiB;AACjB,QAAM,SAAS,MAAM,OAAO,WAAW,EAAE,SAAS,KAAK;AACvD,MAAI,OAAO,WAAW,UAAa,OAAO,OAAO,SAAS,GAAG;AAC3D,UAAM,IAAI;AAAA,MACR,mBAAmB,OAAO,2DACP,gBAAgB,OAAO,MAAM,CAAC;AAAA,MACjD,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO;AAChB;AAWA,SAAS,gBACP,QACQ;AACR,QAAM,QAAQ,OAAO,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,UAAU;AAC9C,UAAM,UAAU,WAAW,MAAM,IAAI;AACrC,WAAO,GAAG,OAAO,KAAK,MAAM,OAAO;AAAA,EACrC,CAAC;AACD,QAAM,SAAS,OAAO,SAAS,IAAI,MAAM,OAAO,SAAS,CAAC,WAAW;AACrE,SAAO,MAAM,KAAK,IAAI,IAAI;AAC5B;AAEA,SAAS,WACP,MACQ;AACR,MAAI,CAAC,QAAQ,KAAK,WAAW,EAAG,QAAO;AACvC,SAAO,KACJ;AAAA,IAAI,CAAC,YACJ,OAAO,YAAY,YAAY,YAAY,OACvC,OAAO,QAAQ,GAAG,IAClB,OAAO,OAAO;AAAA,EACpB,EACC,KAAK,GAAG;AACb;;;ACrJO,IAAM,cAAN,MAAM,aAAe;AAAA,EAC1B,YAA6B,KAA4B;AAA5B;AAAA,EAA6B;AAAA,EAA7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW7B,OAAO,cAAc,GAQC;AACpB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,IAAI,EAAE;AAAA,MACN,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK,EAAE;AAAA,MACP,OAAO,EAAE;AAAA,MACT,GAAI,EAAE,OAAO,SAAY,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;AAAA,MAC1C,GAAI,EAAE,QAAQ,SAAY,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,MAC7C,GAAI,EAAE,eAAe,SAAY,EAAE,SAAS,EAAE,WAAW,QAAQ,WAAW,EAAE,WAAW,SAAS,IAAI,CAAC;AAAA,MACvG,GAAI,EAAE,SAAS,CAAC;AAAA,IAClB;AAAA,EACF;AAAA;AAAA,EAGA,OAAO,uBAAuB,GAKR;AACpB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,IAAI,EAAE;AAAA,MACN,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO,EAAE;AAAA,MACT,GAAI,EAAE,OAAO,SAAY,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;AAAA,MAC1C,GAAI,EAAE,eAAe,SAAY,EAAE,SAAS,EAAE,WAAW,QAAQ,WAAW,EAAE,WAAW,SAAS,IAAI,CAAC;AAAA,IACzG;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,mBAAmB,QAAW,SAAiB,QAAiB,UAAsC;AACpG,UAAM,MAAM;AACZ,eAAW,OAAO,OAAO,KAAK,GAAG,GAAG;AAClC,UAAI,IAAI,WAAW,GAAG,EAAG,OAAM,IAAI,wBAAwB,KAAK,IAAI,MAAM,GAAG;AAAA,IAC/E;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO;AAAA,MACP,KAAK,KAAK,IAAI;AAAA,MACd,QAAQ;AAAA,MACR,GAAI,KAAK,IAAI,cAAc,WAAW,SAAY,EAAE,SAAS,QAAQ,WAAW,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE,IAAI,CAAC;AAAA,MAC1H,GAAG;AAAA,IACL;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,kBACJ,MACA,SACA,KACA,QACA,UAC4B;AAC5B,UAAM,KAAK,KAAK,IAAI;AACpB,UAAM,aAAa,KAAK,IAAI,cAAc,WAAW,SACjD,EAAE,QAAQ,UAAU,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE,IACzD;AAEJ,QAAI,CAAC,KAAK,IAAI,iBAAiB;AAC7B,aAAO,aAAY,uBAAuB,EAAE,SAAS,MAAM,MAAM,IAAI,WAAW,CAAC;AAAA,IACnF;AAEA,UAAM,MAAM,MAAM,KAAK,IAAI,OAAO;AAElC,QAAI,QAAQ,QAAW;AACrB,YAAM,EAAE,IAAAC,KAAI,MAAAC,MAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,YAAM,UAAU,MAAM,QAAQ,KAAK,GAAG;AACtC,aAAO,aAAY,cAAc,EAAE,SAAS,IAAAD,KAAI,MAAAC,OAAM,IAAI,KAAK,SAAS,WAAW,CAAC;AAAA,IACtF;AAEA,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,WAAO,aAAY,cAAc,EAAE,SAAS,IAAI,MAAM,IAAI,WAAW,CAAC;AAAA,EACxE;AAAA,EAEA,MAAM,cACJ,QACA,SACA,KACA,QACA,UACA,MAC4B;AAK5B,QAAI,CAAC,KAAK,IAAI,mBAAmB,KAAK,IAAI,kBAAkB,CAAC,KAAK,IAAI,KAAK,WAAW,GAAG,GAAG;AAC1F,aAAO,KAAK,mBAAmB,QAAQ,SAAS,QAAQ,QAAQ;AAAA,IAClE;AAOA,QAAI,aAAa;AACjB,QAAI;AACJ,QAAI,KAAK,IAAI,mBAAmB,KAAK,IAAI,gBAAgB,OAAO,GAAG;AACjE,YAAM,MAAM;AACZ,YAAMC,OAAM,MAAM,KAAK,IAAI,OAAO;AAClC,YAAM,OAAgC,EAAE,GAAG,IAAI;AAC/C,YAAM,QAAgC,CAAC;AACvC,iBAAW,SAAS,KAAK,IAAI,iBAAiB;AAC5C,YAAI,EAAE,SAAS,KAAM;AACrB,cAAM,QAAQ,IAAI,KAAK;AACvB,YAAI,UAAU,OAAW;AACzB,cAAM,WAAW,QAAQ,SACrB,MAAM,4BAA4B,KAAK,KAAK,IAAI,MAAM,KAAK,IAC3D,MAAM,qBAAqBA,MAAK,KAAK,IAAI,MAAM,KAAK;AACxD,cAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,KAAK,GAAG,QAAQ;AAClE,cAAM,KAAK,IAAI,GAAG,EAAE,IAAI,IAAI;AAC5B,eAAO,KAAK,KAAK;AAAA,MACnB;AACA,UAAI,OAAO,KAAK,KAAK,EAAE,SAAS,GAAG;AACjC,iBAAS;AACT,qBAAa;AAAA,MACf;AAAA,IACF;AAMA,QAAI;AACJ,QAAI,KAAK,IAAI,eAAe,QAAQ,KAAK,IAAI,WAAW,OAAO,KAAK,KAAK,IAAI,iBAAiB;AAC5F,UAAI,SAAS,QAAW;AACtB,cAAM,IAAI;AAAA,UACR,0CAA0C,KAAK,IAAI,IAAI;AAAA,QAEzD;AAAA,MACF;AACA,UAAI,QAAQ,QAAW;AACrB,cAAM,IAAI;AAAA,UACR,4GACe,KAAK,IAAI,IAAI;AAAA,QAC9B;AAAA,MACF;AACA,YAAM,OAAgC,EAAE,GAAI,WAAkD;AAC9F,YAAM,MAA8B,CAAC;AACrC,iBAAW,CAAC,OAAO,MAAM,KAAK,KAAK,IAAI,YAAY;AACjD,cAAM,QAAQ,KAAK,KAAK;AACxB,cAAM,WAAW,KAAK,MAAM,QAAQ,KAAK;AACzC,YAAI,KAAK,MAAM,UAAU,KAAK,MAAM,QAAW;AAM7C,gBAAM,IAAI;AAAA,YACR,KAAK,IAAI;AAAA,YACT,UAAU,KAAK;AAAA,UAEjB;AAAA,QACF;AACA,YAAI,UAAU,QAAW;AAGvB,cAAI,aAAa,OAAW,KAAI,KAAK,IAAI;AACzC;AAAA,QACF;AACA,YAAI,UAAU,MAAM;AAElB,iBAAO,KAAK,KAAK;AACjB;AAAA,QACF;AACA,YAAI,OAAO,UAAU,UAAU;AAE7B,gBAAM,IAAI;AAAA,YACR,iCAAiC,KAAK,SAAS,KAAK,IAAI,IAAI,oDAAoD,OAAO,KAAK;AAAA,UAC9H;AAAA,QACF;AAEA,YAAI,KAAK,IAAI,MAAM,aAAa,OAAO,QAAQ,UAAU,KAAK,KAAK,IAAI,MAAM,KAAK,IAAI,KAAK;AAC3F,eAAO,KAAK,KAAK;AAAA,MACnB;AACA,mBAAa;AACb,UAAI,OAAO,KAAK,GAAG,EAAE,SAAS,EAAG,WAAU;AAAA,IAC7C;AAEA,UAAM,OAAO,MAAM,KAAK,kBAAkB,KAAK,UAAU,UAAU,GAAG,SAAS,KAAK,QAAQ,QAAQ;AACpG,UAAM,aAAa,SAAS,EAAE,GAAG,MAAM,SAAS,OAAO,IAAI;AAC3D,UAAM,WAAW,UAAU,EAAE,GAAG,YAAY,OAAO,QAAQ,IAAI;AAC/D,QAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,KAAK,IAAI,gBAAiB,QAAO;AASvE,UAAM,MAAM,MAAM,KAAK,IAAI,OAAO;AAClC,UAAM,SAAS,MAAM,uBAAuB,GAAG;AAC/C,UAAM,MAAM;AACZ,UAAM,MAA8B,CAAC;AACrC,eAAW,SAAS,KAAK,IAAI,qBAAqB;AAChD,UAAI,KAAK,IAAI,gBAAgB,IAAI,KAAK,EAAG;AACzC,UAAI,KAAK,IAAI,YAAY,IAAI,KAAK,EAAG;AACrC,YAAM,QAAQ,IAAI,KAAK;AACvB,UAAI,UAAU,UAAa,UAAU,KAAM;AAC3C,YAAM,YAAY,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC1E,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,qBAAqB,WAAW,QAAQ,GAAG,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE;AAC9F,UAAI,KAAK,IAAI,GAAG,EAAE,IAAI,IAAI;AAAA,IAC5B;AACA,QAAI,OAAO,KAAK,GAAG,EAAE,WAAW,EAAG,QAAO;AAC1C,WAAO,EAAE,GAAG,UAAU,MAAM,IAAI;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,mBAAmB,UAA6B,IAA8C;AAClG,QAAI,SAAS,SAAS,OAAW,QAAO;AACxC,UAAM,SAAS,OAAO,SAAY,KAAK,IAAI,UAAU,IAAI,EAAE,IAAI;AAC/D,QAAI,WAAW,OAAW,QAAO;AACjC,UAAM,MAAM,MAAM,KAAK,IAAI,OAAO;AAClC,UAAM,MAAM,MAAM,UAAU,SAAS,MAAM,GAAG;AAC9C,QAAI,OAAO,OAAW,MAAK,IAAI,UAAU,IAAI,IAAI,KAAK,CAAC;AACvD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,kBAAkB,UAA6B,IAAqC;AAOxF,QAAI,YAAY,UAAU,KAAK,IAAI,eAAe,EAAG,QAAO;AAC5D,QAAI,CAAC,KAAK,IAAI,iBAAiB;AAK7B,UAAI,SAAS,WAAW,QAAW;AACjC,cAAM,MAA+B,CAAC;AACtC,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,cAAI,CAAC,IAAI,WAAW,GAAG,EAAG,KAAI,GAAG,IAAI;AAAA,QACvC;AACA,eAAO,KAAK,UAAU,GAAG;AAAA,MAC3B;AACA,aAAO,SAAS;AAAA,IAClB;AACA,UAAM,MAAM,MAAM,KAAK,mBAAmB,UAAU,EAAE;AACtD,QAAI,QAAQ,OAAW,QAAO,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AACvE,UAAM,MAAM,MAAM,KAAK,IAAI,OAAO;AAClC,WAAO,QAAQ,SAAS,KAAK,SAAS,OAAO,GAAG;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,YAAY,OAAe,MAAc,KAAoC;AAMjF,UAAM,MAAM,MAAM,KAAK,IAAI,OAAO;AAClC,WAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,KAAK,IAAI,MAAM,KAAK,GAAG,CAAC;AAAA,EAClF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,oBACJ,MACyD;AACzD,UAAM,aAAuB,CAAC;AAC9B,UAAM,aAAuB,CAAC;AAK9B,QAAI,KAAK,UAAU,UAAa,KAAK,SAAS,QAAW;AACvD,iBAAW,KAAK,GAAG,OAAO,KAAK,KAAK,KAAK,CAAC;AAAA,IAC5C;AACA,UAAM,SAAS,KAAK;AACpB,QAAI,WAAW,OAAW,QAAO,EAAE,YAAY,WAAW;AAC1D,UAAM,MAAM,MAAM,KAAK,mBAAmB,IAAI;AAC9C,eAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,UAAI,QAAQ,QAAW;AAAE,mBAAW,KAAK,KAAK;AAAG;AAAA,MAAS;AAC1D,YAAM,EAAE,IAAI,KAAK,IAAI,gBAAgB,IAAI;AACzC,UAAI;AACF,cAAM,QAAQ,IAAI,MAAM,MAAM,4BAA4B,KAAK,KAAK,IAAI,MAAM,KAAK,CAAC;AACpF,mBAAW,KAAK,KAAK;AAAA,MACvB,QAAQ;AACN,mBAAW,KAAK,KAAK;AAAA,MACvB;AAAA,IACF;AACA,WAAO,EAAE,YAAY,WAAW;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,iBAAiB,OAAe,MAAc,KAAyC;AACrF,WAAO,IAAI,aAAa,MAAM,KAAK,YAAY,OAAO,MAAM,GAAG,CAAC;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,cAAc,QAAW,UAA6B,IAAyB;AACnF,UAAM,SAAS,SAAS;AACxB,QAAI,WAAW,UAAa,CAAC,KAAK,IAAI,mBAAmB,KAAK,IAAI,gBAAgB,SAAS,GAAG;AAC5F,aAAO;AAAA,IACT;AACA,UAAM,MAAM,MAAM,KAAK,mBAAmB,UAAU,EAAE;AACtD,UAAM,QAAQ,EAAE,GAAI,OAA8C;AAClE,eAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,YAAM,KAAK,IAAI,KAAK,iBAAiB,OAAO,MAAM,GAAG;AAAA,IACvD;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,cACJ,UACA,OAA6E,CAAC,GAC3D;AACnB,UAAM,OAAO,MAAM,KAAK,kBAAkB,UAAU,KAAK,EAAE;AAG3D,QAAI,SAAS,KAAM,QAAO;AAC1B,QAAI,SAAkB,KAAK,MAAM,IAAI;AAIrC,QAAI,KAAK,IAAI,YAAY,WAAW,QAAQ,OAAO,WAAW,YAAY,WAAW,QAAQ;AAC3F,eAAS,KAAK,IAAI,aAAa,oBAAoB,MAAmB;AAAA,IACxE;AAEA,QAAI,SAAS;AAQb,QAAI,SAAS,YAAY,UAAa,KAAK,IAAI,iBAAiB;AAC9D,YAAM,YAAY,MAAM,KAAK,mBAAmB,UAAU,KAAK,EAAE;AACjE,YAAM,SAAS;AACf,iBAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,SAAS,OAAO,GAAG;AAC5D,eAAO,KAAK,IAAI,KAAK,kBACjB,KAAK,iBAAiB,OAAO,MAAM,SAAS,IAC5C,MAAM,KAAK,YAAY,OAAO,MAAM,SAAS;AAAA,MACnD;AAAA,IACF;AAQA,UAAM,kBAAkB,KAAK,oBAAoB,QAAQ,SAAS,YAAY;AAC9E,QAAI,KAAK,IAAI,WAAW,UAAa,CAAC,KAAK,kBAAkB,CAAC,iBAAiB;AAK7E,eAAS,MAAM;AAAA,QACb,KAAK,IAAI;AAAA,QACT;AAAA,QACA,GAAG,KAAK,IAAI,IAAI,KAAK,SAAS,EAAE;AAAA,MAClC;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;;;ACzfA,IAAM,SAAS,WAAW,OAAO;AAG1B,IAAM,gBAAgB;AAmB7B,eAAsB,iBACpB,KACA,YACA,IACA,YACA,MAC+C;AAI/C,MAAI,WAAW,SAAS,GAAG,EAAG,OAAM,IAAI,gBAAgB,iCAAiC,UAAU,wBAAwB;AAC3H,MAAI,GAAG,SAAS,GAAG,EAAG,OAAM,IAAI,gBAAgB,yBAAyB,EAAE,wBAAwB;AAKnG,MAAI,OAAO,MAAM,KAAK,MAAM,KAAK,SAAS,CAAC,GAAG;AAC5C,UAAM,IAAI,gBAAgB,gCAAgC,KAAK,SAAS,qCAAqC;AAAA,EAC/G;AAEA,QAAM,OAAO,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAC5D,MAAI,CAAC,QAAQ,KAAK,SAAS,QAAW;AACpC,UAAM,IAAI,uBAAuB,YAAY,EAAE;AAAA,EACjD;AAEA,QAAM,MAAM,MAAM,IAAI,OAAO,UAAU;AACvC,QAAM,MAAM,MAAM,UAAU,KAAK,MAAM,GAAG;AAC1C,QAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAChD,QAAM,SAAS,eAAe,MAAM;AAEpC,QAAM,OAAO,MAAM,WAAW,qBAAqB;AACnD,MAAI,KAAK,IAAI,SAAS,GAAG,EAAG,OAAM,IAAI,gBAAgB,oCAAoC,KAAK,GAAG,wBAAwB;AAE1H,QAAM,UAA4B;AAAA,IAChC;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL,WAAW,KAAK;AAAA,EAClB;AACA,QAAM,SAAS,MAAM,WAAW;AAAA,IAC9B,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,OAAO,CAAC;AAAA,IAChD;AAAA,EACF;AAEA,QAAM,WAAsC;AAAA,IAC1C,GAAG;AAAA,IACH,mBAAmB;AAAA,IACnB,KAAK,KAAK;AAAA,IACV,SAAS,eAAe,MAAM;AAAA,IAC9B,WAAW,KAAK;AAAA,EAClB;AAEA,QAAM,cAAc,GAAG,UAAU,IAAI,EAAE,IAAI,KAAK,GAAG;AACnD,QAAM,QAAQ,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,eAAe,WAAW;AACzE,QAAM,MAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,KAAK,OAAO,MAAM,KAAK;AAAA,IACvB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA;AAAA;AAAA,IAG5B,KAAK;AAAA,IACL,OAAO,KAAK,UAAU,QAAQ;AAAA,IAC9B,GAAI,IAAI,QAAQ,EAAE,KAAK,IAAI,MAAM,IAAI,CAAC;AAAA,EACxC;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,eAAe,aAAa,GAAG;AAEhE,SAAO,EAAE,KAAK,KAAK,KAAK,YAAY;AACtC;AAkBA,eAAsB,mBACpB,KACA,YACA,IACA,KACA,MACe;AACf,MAAI,MAAM,SAAS,MAAM;AAGvB,UAAM,gBAAgB,KAAK,YAAY,EAAE;AACzC;AAAA,EACF;AACA,QAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,eAAe,GAAG,UAAU,IAAI,EAAE,IAAI,GAAG,EAAE;AACjF;AASA,eAAsB,gBACpB,KACA,YACA,IACe;AACf,QAAM,OAAO,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAC5D,MAAI,CAAC,QAAQ,KAAK,SAAS,QAAW;AACpC,UAAM,IAAI,uBAAuB,YAAY,EAAE;AAAA,EACjD;AAEA,QAAM,MAAM,MAAM,IAAI,OAAO,UAAU;AACvC,QAAM,SAAS,MAAM,UAAU,KAAK,MAAM,GAAG;AAC7C,QAAM,OAAO,MAAM,QAAQ,KAAK,KAAK,KAAK,OAAO,MAAM;AAEvD,QAAM,SAAS,MAAM,YAAY;AACjC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM;AAO/C,MAAI;AACJ,MAAI,KAAK,YAAY,QAAW;AAC9B,UAAM,MAA8B,CAAC;AACrC,eAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,KAAK,OAAO,GAAG;AACxD,YAAM,YAAY,MAAM,mBAAmB,MAAM,OAAO,YAAY,QAAQ,GAAG;AAC/E,YAAM,WAAW,MAAM,QAAQ,WAAW,MAAM,4BAA4B,QAAQ,YAAY,KAAK,CAAC;AACtG,UAAI,KAAK,IAAI,GAAG,SAAS,EAAE,IAAI,SAAS,IAAI;AAAA,IAC9C;AACA,gBAAY;AAAA,EACd;AAMA,MAAI;AACJ,MAAI,KAAK,UAAU,QAAW;AAC5B,UAAM,MAA8B,CAAC;AACrC,eAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,KAAK,KAAK,GAAG;AACtD,YAAM,UAAU,MAAM,gBAAgB,MAAM,QAAQ,YAAY,IAAI,KAAK;AACzE,UAAI,KAAK,IAAI,MAAM,gBAAgB,SAAS,QAAQ,YAAY,IAAI,KAAK;AAAA,IAC3E;AACA,cAAU;AAAA,EACZ;AAEA,QAAM,MAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,IAAI,KAAK,KAAK;AAAA,IACd,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,IACP,MAAM,MAAM,QAAQ,QAAQ,GAAG;AAAA,IAC/B,GAAI,IAAI,QAAQ,EAAE,KAAK,IAAI,MAAM,IAAI,CAAC;AAAA,IACtC,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,IACxD,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMrD,GAAI,cAAc,SAAY,EAAE,SAAS,UAAU,IAAI,CAAC;AAAA,IACxD,GAAI,YAAY,SAAY,EAAE,OAAO,QAAQ,IAAI,CAAC;AAAA,EACpD;AACA,QAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,IAAI,GAAG;AAGpD,QAAM,IAAI,uBAAuB,YAAY,EAAE;AAG/C,QAAM,SAAS,GAAG,UAAU,IAAI,EAAE;AAClC,QAAM,OAAO,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,aAAa;AAC5D,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,WAAW,MAAM,GAAG;AAC1B,YAAM,IAAI,QAAQ,OAAO,IAAI,OAAO,eAAe,GAAG;AAAA,IACxD;AAAA,EACF;AACF;;;AC9LA,eAAe,WAAc,KAA8B,OAAe,OAA2C;AACnH,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAM,SAAS,MAAM,uBAAuB,GAAG;AAC/C,QAAM,YAAY,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,KAAK;AAC1E,QAAM,UAAU,GAAG,IAAI,IAAI,IAAI,KAAK;AACpC,QAAM,CAAC,SAAS,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC1C,qBAAqB,WAAW,QAAQ,OAAO;AAAA,IAC/C,qBAAqB,WAAW,KAAK,OAAO;AAAA,EAC9C,CAAC;AACD,SAAO,CAAC,GAAG,QAAQ,EAAE,IAAI,QAAQ,IAAI,IAAI,GAAG,OAAO,EAAE,IAAI,OAAO,IAAI,EAAE;AACxE;AAEA,SAAS,eAAkB,KAA8B,OAAe,QAAsB;AAC5F,MAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,oBAAoB,IAAI,KAAK,GAAG;AACnE,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI,aAAa,KAAK;AAAA,IAC3C;AAAA,EACF;AACA,MAAI,CAAC,IAAI,iBAAiB;AACxB,UAAM,IAAI;AAAA,MACR,eAAe,IAAI,IAAI,MAAM,MAAM;AAAA,IACrC;AAAA,EACF;AACF;AAaA,eAAsB,UAAa,KAA8B,OAAe,OAAmC;AACjH,iBAAe,KAAK,OAAO,WAAW;AACtC,QAAM,CAAC,QAAQ,YAAY,IAAI,MAAM,WAAW,KAAK,OAAO,KAAK;AAEjE,QAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,IAAI;AACtD,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AACzD,QAAI,CAAC,OAAO,CAAC,IAAI,KAAM;AACvB,QAAI,IAAI,KAAK,KAAK,MAAM,UAAU,IAAI,KAAK,KAAK,MAAM,cAAc;AAClE,aAAO,IAAI,MAAM,cAAc,GAAG;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAMA,eAAsB,WAAc,KAA8B,OAAe,OAA8B;AAC7G,iBAAe,KAAK,OAAO,YAAY;AACvC,QAAM,CAAC,QAAQ,YAAY,IAAI,MAAM,WAAW,KAAK,OAAO,KAAK;AAEjE,QAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,IAAI,IAAI;AACtD,QAAM,UAAe,CAAC;AACtB,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE;AACzD,QAAI,CAAC,OAAO,CAAC,IAAI,KAAM;AACvB,QAAI,IAAI,KAAK,KAAK,MAAM,UAAU,IAAI,KAAK,KAAK,MAAM,cAAc;AAClE,YAAM,MAAM,MAAM,IAAI,MAAM,cAAc,GAAG;AAC7C,UAAI,QAAQ,KAAM,SAAQ,KAAK,GAAG;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;;;ACxFA,eAAsB,iBACpB,KACA,KACA,MACiB;AACjB,MAAI,MAAM,cAAc,MAAO,QAAO,IAAI;AAC1C,MAAI,IAAI,SAAS,QAAW;AAC1B,UAAM,MAAM,MAAM,UAAU,IAAI,MAAM,GAAG;AACzC,WAAO,QAAQ,IAAI,KAAK,IAAI,OAAO,GAAG;AAAA,EACxC;AACA,SAAO,QAAQ,IAAI,KAAK,IAAI,OAAO,GAAG;AACxC;AAeA,eAAsB,kBACpB,MACA,KACA,MAC4D;AAC5D,MAAI,MAAM,cAAc,MAAO,QAAO,EAAE,KAAK,IAAI,OAAO,KAAK;AAE7D,MAAI,MAAM,iBAAiB,MAAM;AAC/B,UAAM,MAAM,MAAM,YAAY;AAC9B,UAAM,EAAE,IAAAC,KAAI,MAAAC,MAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,UAAM,UAAU,MAAM,QAAQ,KAAK,GAAG;AACtC,WAAO,EAAE,KAAKD,KAAI,OAAOC,OAAM,MAAM,QAAQ;AAAA,EAC/C;AAEA,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,SAAO,EAAE,KAAK,IAAI,OAAO,KAAK;AAChC;AASO,SAAS,gBAAgB,KAAiC;AAC/D,SAAO,IAAI,SAAS;AACtB;AAqBO,SAAS,oBAAoB,KAAgC;AAOlE,MAAI,IAAI,YAAY,UAAa,IAAI,UAAU,OAAW,QAAO,IAAI;AACrE,QAAM,UAAU,CAAC,KAA0B,QAAwC;AACjF,UAAM,QAAQ,OAAO,KAAK,GAAG,EAAE,KAAK,EAAE;AAAA,MACpC,CAAC,MAAM,GAAG,KAAK,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC;AAAA,IACvD;AACA,WAAO,GAAG,KAAK,UAAU,GAAG,CAAC,KAAK,MAAM,KAAK,GAAG,CAAC;AAAA,EACnD;AACA,QAAM,WAAW,CAAC,WAAW,KAAK,UAAU,IAAI,KAAK,CAAC,EAAE;AACxD,MAAI,IAAI,YAAY,OAAW,UAAS,KAAK,QAAQ,WAAW,IAAI,OAAO,CAAC;AAC5E,MAAI,IAAI,UAAU,OAAW,UAAS,KAAK,QAAQ,SAAS,IAAI,KAAK,CAAC;AACtE,SAAO,IAAI,SAAS,KAAK,GAAG,CAAC;AAC/B;","names":["plaintext","iv","data","iv","data","dek","iv","data"]}

package/dist/{chunk-62QYRORB.js → chunk-5Z3RNFJC.js}

@@ -1,10 +1,10 @@
 import {
   sha256Hex
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-L4IRFTIF.js";
 import {
   MaterializedViewCycleError,
   MaterializedViewSourceUnknownError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-BLZRNHMG.js";
 
 // src/with-formula/materialized-views/dependency-analyzer.ts
 function analyzeDependencies(query) {
@@ -317,4 +317,4 @@ export {
   MaterializedViewRegistry,
   wrapDbWithPredicates
 };
-//# sourceMappingURL=chunk-62QYRORB.js.map
+//# sourceMappingURL=chunk-5Z3RNFJC.js.map

package/dist/{chunk-M6OST55S.js → chunk-5ZPWVNL3.js}

@@ -2,7 +2,7 @@
 function withCargo() {
   return {
     async extractPartition(vault, opts) {
-      const { extractPartitionCore } = await import("./extract-partition-GLKBOXFQ.js");
+      const { extractPartitionCore } = await import("./extract-partition-52LX6RQH.js");
       return extractPartitionCore(vault, opts);
     }
   };
@@ -11,4 +11,4 @@ function withCargo() {
 export {
   withCargo
 };
-//# sourceMappingURL=chunk-M6OST55S.js.map
+//# sourceMappingURL=chunk-5ZPWVNL3.js.map

package/dist/{chunk-PSMV73A5.js → chunk-6CNLU4TO.js}

@@ -1,16 +1,16 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-HCIPRAGS.js";
+} from "./chunk-7MHVHGQZ.js";
 import {
   sha256Hex
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-L4IRFTIF.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-5TDJ56JE.js";
+} from "./chunk-OCDUQUAP.js";
 import {
   ReadOnlyError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-BLZRNHMG.js";
 
 // src/with-audit/portability/withdraw-accessible.ts
 var FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
@@ -114,4 +114,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-PSMV73A5.js.map
+//# sourceMappingURL=chunk-6CNLU4TO.js.map

package/dist/{chunk-QZISFCVG.js → chunk-6DP5HBQD.js}

@@ -1,30 +1,32 @@
 import {
   resolveManagedSecret
-} from "./chunk-ZCGAHGUS.js";
+} from "./chunk-AY4P6PHN.js";
 import {
   parseExtractedPartitionBody,
   readPod,
   readPodHeader
-} from "./chunk-FISN7WE4.js";
+} from "./chunk-3UDPDRUC.js";
 import {
   createOwnerKeyring
-} from "./chunk-WWGT2MDV.js";
+} from "./chunk-5A6TC3RQ.js";
 import {
   LedgerStore
-} from "./chunk-LXQT4WMP.js";
+} from "./chunk-DHIN36UC.js";
 import {
   LEDGER_COLLECTION
 } from "./chunk-I7FD46FF.js";
+import {
+  openEnvelopeJson
+} from "./chunk-5EZAJEES.js";
 import {
   base64ToBuffer,
-  openEnvelopeJson,
   wrapKey
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-L4IRFTIF.js";
 import {
   AdoptionStateError,
   TransferSealError,
   ValidationError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-BLZRNHMG.js";
 
 // src/with-cargo/adopt-partition.ts
 async function unsealDeks(seal, transferKey) {
@@ -177,7 +179,7 @@ async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
     }
   }
   if (isManaged(opts)) {
-    const { createNoydb } = await import("./noydb-LDEBLNHY.js");
+    const { createNoydb } = await import("./noydb-WQNBVJIG.js");
     const db = await createNoydb({
       store,
       user: userId,
@@ -230,4 +232,4 @@ export {
   createOwnerOnAdoptedPartition,
   decryptExtractedPartition
 };
-//# sourceMappingURL=chunk-QZISFCVG.js.map
+//# sourceMappingURL=chunk-6DP5HBQD.js.map

package/dist/{chunk-QZISFCVG.js.map → chunk-6DP5HBQD.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-cargo/adopt-partition.ts","../src/with-cargo/decrypt-partition.ts"],"sourcesContent":["/**\n * Partition adoption. Recipient side: verify an extracted bundle,\n * validate the transfer key, import the re-keyed collections into a\n * destination store, and record an `_meta/adoption` marker. The bundle\n * stays UNOWNED after adoption — `createOwnerOnAdoptedPartition`\n * mints the owner; the transfer seal is then destroyed.\n *\n * @module\n */\nimport { base64ToBuffer, wrapKey, type EnclaveKey } from '../kernel/enclave/index.js'\nimport { TransferSealError, AdoptionStateError, ValidationError } from '../kernel/errors.js'\nimport type { NoydbStore, VaultSnapshot, KeyringFile } from '../kernel/types.js'\nimport { createOwnerKeyring } from '../with-party/team/keyring.js'\nimport { resolveManagedSecret } from '../with-party/team/managed-passphrase.js'\nimport type { SealingKeyProvider } from '../with-party/team/managed-passphrase.js'\nimport type { ShamirRecoveryProvider } from '../with-party/team/shamir-recovery-provider.js'\nimport type { RecoveryEnrollmentInput } from '../with-party/team/rotate-recover.js'\nimport { LedgerStore } from '../with-commit/history/ledger/store.js'\nimport { LEDGER_COLLECTION } from '../with-commit/history/ledger/constants.js'\nimport type { TransferSealPayload } from '../with-pod/bundle.js'\nimport { readPodHeader, readPod, parseExtractedPartitionBody } from '../with-pod/bundle.js'\n\n/**\n * Reverse of `sealDeks`. Imports the transfer key, decrypts the\n * sealed `{ collection: base64(rawDEK) }` map (layout iv(12)‖ct‖tag), and\n * re-imports each DEK as an AES-GCM key. Throws `TransferSealError` on a\n * wrong key (AES-GCM auth-tag failure) or malformed payload.\n */\nexport async function unsealDeks(\n  seal: TransferSealPayload,\n  transferKey: Uint8Array,\n): Promise<Map<string, EnclaveKey>> {\n  if (transferKey.byteLength !== 32) {\n    throw new TransferSealError(\n      `transfer key must be 32 bytes, got ${transferKey.byteLength}.`,\n    )\n  }\n  const key = await crypto.subtle.importKey('raw', transferKey as BufferSource, 'AES-GCM', false, ['decrypt'])\n  const raw = base64ToBuffer(seal.payload)\n  let plaintext: ArrayBuffer\n  try {\n    plaintext = await crypto.subtle.decrypt(\n      { name: 'AES-GCM', iv: raw.slice(0, 12) as BufferSource },\n      key,\n      raw.slice(12) as BufferSource,\n    )\n  } catch {\n    throw new TransferSealError(\n      'transfer seal could not be opened — wrong transfer key (AES-GCM authentication failed).',\n    )\n  }\n  let dekMap: Record<string, string>\n  try {\n    dekMap = JSON.parse(new TextDecoder().decode(plaintext)) as Record<string, string>\n  } catch {\n    throw new TransferSealError('transfer seal payload is not valid JSON after decryption.')\n  }\n  const deks = new Map<string, EnclaveKey>()\n  for (const [collection, b64] of Object.entries(dekMap)) {\n    // Extractable: the recipient must be able to re-wrap these under their\n    // own KEK (AES-KW) at owner-creation. Matches generateDEK.\n    const dek = await crypto.subtle.importKey('raw', base64ToBuffer(b64) as BufferSource, 'AES-GCM', true, ['encrypt', 'decrypt'])\n    deks.set(collection, dek)\n  }\n  return deks\n}\n\nexport interface AdoptPartitionOptions {\n  readonly transferKey: Uint8Array\n  readonly destinationStore: NoydbStore\n  readonly vaultName: string\n}\n\nexport interface AdoptPartitionResult {\n  readonly vaultName: string\n  readonly needsOwner: true\n  readonly sealId: string\n}\n\nexport async function adoptPartition(\n  bundleBytes: Uint8Array,\n  opts: AdoptPartitionOptions,\n): Promise<AdoptPartitionResult> {\n  const { transferKey, destinationStore, vaultName } = opts\n\n  const header = readPodHeader(bundleBytes)\n  if (header.bundleKind !== 'extracted-partition' || header.transferSeal === undefined) {\n    throw new ValidationError(\n      'adoptPartition requires an extracted-partition bundle with a transfer seal. '\n      + 'For ordinary backups use readPod + vault.load.',\n    )\n  }\n\n  const { dumpJson } = await readPod(bundleBytes)\n  const { dump, seal } = parseExtractedPartitionBody(dumpJson)\n\n  // Validate the transfer key by unsealing in memory; throws\n  // TransferSealError on mismatch. DEKs are discarded here — they stay\n  // sealed at rest (in _meta/adoption) until owner-creation wraps them under the\n  // recipient's KEK.\n  await unsealDeks(seal, transferKey)\n\n  // Single-occupancy per vaultName: an `_meta/adoption` marker already present\n  // means this slot holds a partition (adopted-and-unowned, or already owned).\n  // saveAll below would overwrite its data and replace the marker, stranding the\n  // prior adoption's transfer seal. Refuse regardless of sealId — re-adopting the\n  // SAME bundle is a redundant call, and adopting a DIFFERENT bundle here would\n  // clobber the existing partition. Either way, pick a fresh vaultName.\n  const existing = await destinationStore.get(vaultName, '_meta', 'adoption')\n  if (existing) {\n    const prior = JSON.parse(existing._data) as { sealId?: string }\n    if (prior.sealId === seal.sealId) {\n      throw new AdoptionStateError(\n        `partition (sealId ${seal.sealId}) is already adopted into vault \"${vaultName}\".`,\n      )\n    }\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already holds an adopted partition (sealId ${prior.sealId}); `\n      + `adopting a different partition (sealId ${seal.sealId}) here would overwrite it. `\n      + `Adopt into a fresh vaultName instead.`,\n    )\n  }\n\n  // The marker-only check above misses a worse case: a vaultName already in use\n  // by an ORDINARY vault (createNoydb + openVault) carries no `_meta/adoption`,\n  // yet `saveAll` below is destructive on SQL adapters (`DELETE FROM ... WHERE\n  // vault = ?` followed by upsert) and would wipe the legitimate keyring +\n  // data. Refuse adoption into ANY occupied slot — a fresh vaultName is the\n  // documented precondition.\n  const existingKeyring = await destinationStore.list(vaultName, '_keyring')\n  if (existingKeyring.length > 0) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already holds a keyring (an unrelated owner exists at this slot); `\n      + `adoptPartition requires a fresh vaultName to avoid destructive saveAll on SQL adapters.`,\n    )\n  }\n\n  const backup = JSON.parse(dump) as { collections: VaultSnapshot; _internal?: VaultSnapshot }\n  await destinationStore.saveAll(vaultName, backup.collections)\n\n  // Import carried internal collections (e.g. _schemas from carrySchemas).\n  // saveAll only writes data collections; _internal is written per-record.\n  if (backup._internal) {\n    for (const [collection, records] of Object.entries(backup._internal)) {\n      for (const [id, envelope] of Object.entries(records)) {\n        await destinationStore.put(vaultName, collection, id, envelope)\n      }\n    }\n  }\n\n  const adoptedAt = new Date().toISOString()\n  const adoption = { sealId: seal.sealId, adoptedAt, needsOwner: true as const, transferSeal: seal }\n  await destinationStore.put(vaultName, '_meta', 'adoption', {\n    _noydb: 1, _v: 1, _ts: adoptedAt, _iv: '', _data: JSON.stringify(adoption),\n  })\n\n  return { vaultName, needsOwner: true, sealId: seal.sealId }\n}\n\nexport interface CreateOwnerResult {\n  readonly vaultName: string\n  readonly userId: string\n}\n\n/** Standard-mode owner: recipient supplies the passphrase. */\nexport interface CreateOwnerStandardOptions {\n  readonly userId: string\n  readonly passphrase: string\n  readonly transferKey: Uint8Array\n}\n\n/**\n * Managed-mode owner: the passphrase is minted + sealed under\n * a `SealingKeyProvider` (e.g. an `at-*` OS keychain) so the partition\n * auto-unlocks on the recipient's device. Managed mode mandates a strong\n * (Shamir) recovery profile at creation, which needs the\n * `shamirRecovery` provider injected.\n */\nexport interface CreateOwnerManagedOptions {\n  readonly userId: string\n  readonly passphraseMode: 'managed'\n  readonly sealingKey: SealingKeyProvider\n  readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>\n  readonly shamirRecovery: ShamirRecoveryProvider\n  readonly transferKey: Uint8Array\n}\n\nexport type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManagedOptions\n\nfunction isManaged(o: CreateOwnerOptions): o is CreateOwnerManagedOptions {\n  return 'passphraseMode' in o && o.passphraseMode === 'managed'\n}\n\n/**\n * Mint the first owner keyring on an adopted-but-unowned partition,\n * then destroy the transfer seal.\n *\n * Standard mode: the recipient supplies a passphrase. Managed mode: the\n * passphrase is minted + sealed under a `SealingKeyProvider` and a strong\n * (Shamir) recovery profile is enrolled — orchestrated via the existing\n * `openVaultAndEnrollRecovery` ceremony.\n *\n * Either way, reuses `createOwnerKeyring` to derive the KEK + write the base\n * keyring, then wraps the partition's DEKs (recovered from the seal) under that\n * KEK and re-persists the merged keyring file.\n *\n * Idempotent under retry: the seal is destroyed LAST (Stage D), after the\n * keyring (Stage A), the ledger transition (Stage B), and — in managed mode —\n * strong-recovery enrollment (Stage C). A failure in the fallible enrollment\n * step leaves the seal intact, and re-running with the same `userId` +\n * `transferKey` resumes from the first incomplete stage. (Multi-profile recovery\n * arrays may re-enroll an already-enrolled profile on retry; managed mode's\n * mandated single Shamir profile does not.)\n */\nexport async function createOwnerOnAdoptedPartition(\n  store: NoydbStore,\n  vaultName: string,\n  opts: CreateOwnerOptions,\n): Promise<CreateOwnerResult> {\n  const { userId, transferKey } = opts\n\n  // Managed mode requires a strong (Shamir) recovery profile, validated BEFORE\n  // any disk write — same gate as createNoydb.\n  if (isManaged(opts) && !opts.recovery.some((r) => r.profile === 'shamir')) {\n    throw new AdoptionStateError(\n      'managed-mode adoption requires at least one strong (shamir) recovery profile in '\n      + '`recovery` — paper alone is not strong when there is no user passphrase to fall back on.',\n    )\n  }\n\n  // 1. Verify adopted-unowned state.\n  const adoptionEnv = await store.get(vaultName, '_meta', 'adoption')\n  if (!adoptionEnv) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" is not an adopted partition (no _meta/adoption). `\n      + `createOwnerOnAdoptedPartition only applies to vaults created via adoptPartition.`,\n    )\n  }\n  const adoption = JSON.parse(adoptionEnv._data) as {\n    sealId: string; adoptedAt: string; needsOwner?: boolean\n    consumedAt?: string; transferSeal?: TransferSealPayload\n  }\n  if (adoption.consumedAt !== undefined || adoption.transferSeal === undefined) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already has an owner (transfer seal consumed at ${adoption.consumedAt}).`,\n    )\n  }\n\n  // 2. Recover the partition DEKs from the seal (throws on wrong key) BEFORE\n  //    writing any keyring, so a bad transfer key leaves no trace. Always\n  //    validated, including when resuming a partial prior call.\n  const partitionDeks = await unsealDeks(adoption.transferSeal, transferKey)\n\n  // The ceremony below is split into stages so a failure in the fallible\n  // managed-enrollment step (network/provider outage) leaves the call RETRYABLE\n  // — the seal is destroyed only once everything durable is in place. Each stage\n  // detects its own prior completion rather than relying on a single resume bit.\n\n  // A keyring present for a DIFFERENT user (with the seal still unconsumed) is a\n  // genuine second-owner attempt — refuse it. A same-user keyring is a resumed\n  // partial call and is handled by the stage checks below.\n  const existingKeyring = await store.get(vaultName, '_keyring', userId)\n  const otherOwners = (await store.list(vaultName, '_keyring')).filter((u) => u !== userId)\n  if (otherOwners.length > 0) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already has a keyring for a different owner; cannot create owner \"${userId}\".`,\n    )\n  }\n\n  // Stage A — mint the owner keyring + merge the partition DEKs. Considered done\n  // only when the keyring already holds every partition DEK. createOwnerKeyring\n  // overwrites (fresh KEK + fresh _users DEK), so re-running is safe ONLY while\n  // no recovery has been enrolled yet — guaranteed here because enrollment\n  // (Stage C) runs strictly after Stage A completes.\n  const partitionCollections = [...partitionDeks.keys()]\n  const priorDeks = existingKeyring ? (JSON.parse(existingKeyring._data) as KeyringFile).deks : {}\n  const ownerMinted = existingKeyring !== null && partitionCollections.every((c) => c in priorDeks)\n  if (!ownerMinted) {\n    // Resolve the owner passphrase. Managed mode mints a random passphrase, seals\n    // it under the provider, and persists _meta/sealed-passphrase (so the\n    // partition auto-unlocks on the recipient's device); standard mode uses the\n    // caller's passphrase. Idempotent under retry — resolveManagedSecret's reopen\n    // arm reuses an already-sealed passphrase.\n    const passphrase = isManaged(opts)\n      ? await resolveManagedSecret(store, vaultName, opts.sealingKey)\n      : opts.passphrase\n\n    // Mint the owner keyring (KEK + _users DEK + canary, written to disk).\n    const unlocked = await createOwnerKeyring(store, vaultName, userId, passphrase)\n\n    // Merge the partition DEKs (wrapped under the new KEK) into the keyring.\n    const env = await store.get(vaultName, '_keyring', userId)\n    if (!env) throw new AdoptionStateError(`keyring write for \"${userId}\" did not persist`)\n    const keyringFile = JSON.parse(env._data) as KeyringFile\n    const kek = unlocked.kek\n    if (!kek) throw new AdoptionStateError(`owner keyring for \"${userId}\" has no KEK to wrap partition DEKs under`)\n    const mergedDeks: Record<string, string> = { ...keyringFile.deks }\n    for (const [collection, dek] of partitionDeks) {\n      mergedDeks[collection] = await wrapKey(dek, kek)\n    }\n    const mergedFile: KeyringFile = { ...keyringFile, deks: mergedDeks }\n    await store.put(vaultName, '_keyring', userId, { ...env, _data: JSON.stringify(mergedFile) })\n  }\n\n  // Stage B — record the ownership transition on the carried\n  // audit chain (carryLedger sealed the _ledger DEK). No-op without that DEK.\n  // Idempotent: appended only if the closing `transfer-seal-consumed` entry is\n  // absent, so a retry does not duplicate the pair.\n  const ledgerDek = partitionDeks.get(LEDGER_COLLECTION)\n  if (ledgerDek) {\n    const ledger = new LedgerStore({\n      adapter: store,\n      vault: vaultName,\n      encrypted: true,\n      getDEK: async () => ledgerDek,\n      actor: userId,\n    })\n    const creationReason = `creation-of-new-owner:${userId}`\n    const consumedReason = `transfer-seal-consumed:${adoption.sealId}`\n    // Gate each append on its own presence — a crash or store error strictly\n    // between the two adjacent puts would otherwise re-append the first one\n    // on retry. The pair is the audit record, not a single transaction.\n    const recordedReasons = new Set((await ledger.loadAllEntries()).map((e) => e.reason))\n    if (!recordedReasons.has(creationReason)) {\n      await ledger.append({ op: 'lifecycle', collection: '', id: '', version: 0, actor: '', payloadHash: '', reason: creationReason })\n    }\n    if (!recordedReasons.has(consumedReason)) {\n      await ledger.append({ op: 'lifecycle', collection: '', id: '', version: 0, actor: '', payloadHash: '', reason: consumedReason })\n    }\n  }\n\n  // Stage C — Managed mode: enroll the mandatory strong recovery\n  //    by orchestrating the existing public ceremony. The partition is\n  //    now a managed-mode vault on disk (sealed passphrase + keyring), so we\n  //    open it as a normal client and let openVaultAndEnrollRecovery do the\n  //    gate-bypass + enroll + re-assert. Dynamic import keeps the Noydb class\n  //    out of the @noy-db/hub/bundle static graph. Runs BEFORE seal destruction\n  //    so a failure here leaves the seal intact and the call retryable.\n  if (isManaged(opts)) {\n    const { createNoydb } = await import('../kernel/noydb.js')\n    const db = await createNoydb({\n      store,\n      user: userId,\n      passphraseMode: 'managed',\n      sealingKey: opts.sealingKey,\n      shamirRecovery: opts.shamirRecovery,\n    })\n    await db.openVaultAndEnrollRecovery(vaultName, { recovery: opts.recovery })\n  }\n\n  // Stage D — Destroy the transfer seal LAST — the commit point. Everything\n  //    above is either idempotent or resumable, so the seal is only consumed\n  //    once the owner keyring (and, in managed mode, strong recovery) is\n  //    durably in place. Retain sealId + consumedAt for audit.\n  const consumed = { sealId: adoption.sealId, adoptedAt: adoption.adoptedAt, consumedAt: new Date().toISOString() }\n  await store.put(vaultName, '_meta', 'adoption', { ...adoptionEnv, _data: JSON.stringify(consumed) })\n\n  return { vaultName, userId }\n}\n","/**\n * Read-side counterpart to `extractPartition`: decrypt an\n * extracted-partition bundle's records to plaintext using its transfer\n * key, WITHOUT adopting it into a vault. Used by an outward\n * orchestration layer's reconcile/merge and field-authority flows to\n * compare incoming records against a receiver. The transfer key validates the bundle\n * (wrong key throws).\n * @module\n */\nimport type { EncryptedEnvelope } from '../kernel/types.js'\nimport { openEnvelopeJson } from '../kernel/enclave/index.js'\nimport { readPodHeader, readPod, parseExtractedPartitionBody } from '../with-pod/bundle.js'\nimport { unsealDeks } from './adopt-partition.js'\n\n/** One decrypted record from an extracted-partition compartment. */\nexport interface DecryptedRecord {\n  readonly id: string\n  readonly record: Record<string, unknown>\n  /** Source envelope write timestamp (ISO) — for last-write-wins merges. */\n  readonly ts: string\n  /** Source envelope version. */\n  readonly version: number\n  /** Provenance source id (FR-5). Present only when the source collection had provenance:true and a source was supplied on put. */\n  readonly source?: string\n  /** ISO-8601 timestamp the provenance source was recorded (FR-5). */\n  readonly sourceTs?: string\n}\n\n/**\n * Decrypt every record of an extracted-partition bundle to plaintext,\n * grouped by collection. Throws if the bundle isn't an\n * extracted-partition or the transfer key is wrong.\n */\nexport async function decryptExtractedPartition(\n  bundleBytes: Uint8Array,\n  transferKey: Uint8Array,\n): Promise<Record<string, DecryptedRecord[]>> {\n  const header = readPodHeader(bundleBytes)\n  if (header.bundleKind !== 'extracted-partition' || header.transferSeal === undefined) {\n    throw new Error('decryptExtractedPartition: bundle is not an extracted-partition.')\n  }\n  const { dumpJson } = await readPod(bundleBytes)\n  const { dump, seal } = parseExtractedPartitionBody(dumpJson)\n  const deks = await unsealDeks(seal, transferKey) // throws TransferSealError on wrong key\n  const backup = JSON.parse(dump) as { collections: Record<string, Record<string, EncryptedEnvelope>> }\n  const out: Record<string, DecryptedRecord[]> = {}\n  for (const [collection, byId] of Object.entries(backup.collections)) {\n    const dek = deks.get(collection)\n    if (dek === undefined) continue // no DEK sealed for this collection — skip\n    const recs: DecryptedRecord[] = []\n    for (const [id, env] of Object.entries(byId)) {\n      const plaintext = await openEnvelopeJson(env, dek)\n      const body = JSON.parse(plaintext) as Record<string, unknown>\n      recs.push({\n        id,\n        record: { ...body, id },\n        ts: env._ts,\n        version: env._v,\n        ...(env._source !== undefined ? { source: env._source } : {}),\n        ...(env._sourceTs !== undefined ? { sourceTs: env._sourceTs } : {}),\n      })\n    }\n    out[collection] = recs\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,WACpB,MACA,aACkC;AAClC,MAAI,YAAY,eAAe,IAAI;AACjC,UAAM,IAAI;AAAA,MACR,sCAAsC,YAAY,UAAU;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,aAA6B,WAAW,OAAO,CAAC,SAAS,CAAC;AAC3G,QAAM,MAAM,eAAe,KAAK,OAAO;AACvC,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,OAAO,OAAO;AAAA,MAC9B,EAAE,MAAM,WAAW,IAAI,IAAI,MAAM,GAAG,EAAE,EAAkB;AAAA,MACxD;AAAA,MACA,IAAI,MAAM,EAAE;AAAA,IACd;AAAA,EACF,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAAA,EACzD,QAAQ;AACN,UAAM,IAAI,kBAAkB,2DAA2D;AAAA,EACzF;AACA,QAAM,OAAO,oBAAI,IAAwB;AACzC,aAAW,CAAC,YAAY,GAAG,KAAK,OAAO,QAAQ,MAAM,GAAG;AAGtD,UAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,eAAe,GAAG,GAAmB,WAAW,MAAM,CAAC,WAAW,SAAS,CAAC;AAC7H,SAAK,IAAI,YAAY,GAAG;AAAA,EAC1B;AACA,SAAO;AACT;AAcA,eAAsB,eACpB,aACA,MAC+B;AAC/B,QAAM,EAAE,aAAa,kBAAkB,UAAU,IAAI;AAErD,QAAM,SAAS,cAAc,WAAW;AACxC,MAAI,OAAO,eAAe,yBAAyB,OAAO,iBAAiB,QAAW;AACpF,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,WAAW;AAC9C,QAAM,EAAE,MAAM,KAAK,IAAI,4BAA4B,QAAQ;AAM3D,QAAM,WAAW,MAAM,WAAW;AAQlC,QAAM,WAAW,MAAM,iBAAiB,IAAI,WAAW,SAAS,UAAU;AAC1E,MAAI,UAAU;AACZ,UAAM,QAAQ,KAAK,MAAM,SAAS,KAAK;AACvC,QAAI,MAAM,WAAW,KAAK,QAAQ;AAChC,YAAM,IAAI;AAAA,QACR,qBAAqB,KAAK,MAAM,oCAAoC,SAAS;AAAA,MAC/E;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,gDAAgD,MAAM,MAAM,6CACnC,KAAK,MAAM;AAAA,IAEzD;AAAA,EACF;AAQA,QAAM,kBAAkB,MAAM,iBAAiB,KAAK,WAAW,UAAU;AACzE,MAAI,gBAAgB,SAAS,GAAG;AAC9B,UAAM,IAAI;AAAA,MACR,UAAU,SAAS;AAAA,IAErB;AAAA,EACF;AAEA,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAM,iBAAiB,QAAQ,WAAW,OAAO,WAAW;AAI5D,MAAI,OAAO,WAAW;AACpB,eAAW,CAAC,YAAY,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AACpE,iBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,cAAM,iBAAiB,IAAI,WAAW,YAAY,IAAI,QAAQ;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,WAAW,EAAE,QAAQ,KAAK,QAAQ,WAAW,YAAY,MAAe,cAAc,KAAK;AACjG,QAAM,iBAAiB,IAAI,WAAW,SAAS,YAAY;AAAA,IACzD,QAAQ;AAAA,IAAG,IAAI;AAAA,IAAG,KAAK;AAAA,IAAW,KAAK;AAAA,IAAI,OAAO,KAAK,UAAU,QAAQ;AAAA,EAC3E,CAAC;AAED,SAAO,EAAE,WAAW,YAAY,MAAM,QAAQ,KAAK,OAAO;AAC5D;AAgCA,SAAS,UAAU,GAAuD;AACxE,SAAO,oBAAoB,KAAK,EAAE,mBAAmB;AACvD;AAuBA,eAAsB,8BACpB,OACA,WACA,MAC4B;AAC5B,QAAM,EAAE,QAAQ,YAAY,IAAI;AAIhC,MAAI,UAAU,IAAI,KAAK,CAAC,KAAK,SAAS,KAAK,CAAC,MAAM,EAAE,YAAY,QAAQ,GAAG;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAGA,QAAM,cAAc,MAAM,MAAM,IAAI,WAAW,SAAS,UAAU;AAClE,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI;AAAA,MACR,UAAU,SAAS;AAAA,IAErB;AAAA,EACF;AACA,QAAM,WAAW,KAAK,MAAM,YAAY,KAAK;AAI7C,MAAI,SAAS,eAAe,UAAa,SAAS,iBAAiB,QAAW;AAC5E,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,qDAAqD,SAAS,UAAU;AAAA,IAC7F;AAAA,EACF;AAKA,QAAM,gBAAgB,MAAM,WAAW,SAAS,cAAc,WAAW;AAUzE,QAAM,kBAAkB,MAAM,MAAM,IAAI,WAAW,YAAY,MAAM;AACrE,QAAM,eAAe,MAAM,MAAM,KAAK,WAAW,UAAU,GAAG,OAAO,CAAC,MAAM,MAAM,MAAM;AACxF,MAAI,YAAY,SAAS,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,uEAAuE,MAAM;AAAA,IAClG;AAAA,EACF;AAOA,QAAM,uBAAuB,CAAC,GAAG,cAAc,KAAK,CAAC;AACrD,QAAM,YAAY,kBAAmB,KAAK,MAAM,gBAAgB,KAAK,EAAkB,OAAO,CAAC;AAC/F,QAAM,cAAc,oBAAoB,QAAQ,qBAAqB,MAAM,CAAC,MAAM,KAAK,SAAS;AAChG,MAAI,CAAC,aAAa;AAMhB,UAAM,aAAa,UAAU,IAAI,IAC7B,MAAM,qBAAqB,OAAO,WAAW,KAAK,UAAU,IAC5D,KAAK;AAGT,UAAM,WAAW,MAAM,mBAAmB,OAAO,WAAW,QAAQ,UAAU;AAG9E,UAAM,MAAM,MAAM,MAAM,IAAI,WAAW,YAAY,MAAM;AACzD,QAAI,CAAC,IAAK,OAAM,IAAI,mBAAmB,sBAAsB,MAAM,mBAAmB;AACtF,UAAM,cAAc,KAAK,MAAM,IAAI,KAAK;AACxC,UAAM,MAAM,SAAS;AACrB,QAAI,CAAC,IAAK,OAAM,IAAI,mBAAmB,sBAAsB,MAAM,2CAA2C;AAC9G,UAAM,aAAqC,EAAE,GAAG,YAAY,KAAK;AACjE,eAAW,CAAC,YAAY,GAAG,KAAK,eAAe;AAC7C,iBAAW,UAAU,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACjD;AACA,UAAM,aAA0B,EAAE,GAAG,aAAa,MAAM,WAAW;AACnE,UAAM,MAAM,IAAI,WAAW,YAAY,QAAQ,EAAE,GAAG,KAAK,OAAO,KAAK,UAAU,UAAU,EAAE,CAAC;AAAA,EAC9F;AAMA,QAAM,YAAY,cAAc,IAAI,iBAAiB;AACrD,MAAI,WAAW;AACb,UAAM,SAAS,IAAI,YAAY;AAAA,MAC7B,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,MACX,QAAQ,YAAY;AAAA,MACpB,OAAO;AAAA,IACT,CAAC;AACD,UAAM,iBAAiB,yBAAyB,MAAM;AACtD,UAAM,iBAAiB,0BAA0B,SAAS,MAAM;AAIhE,UAAM,kBAAkB,IAAI,KAAK,MAAM,OAAO,eAAe,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;AACpF,QAAI,CAAC,gBAAgB,IAAI,cAAc,GAAG;AACxC,YAAM,OAAO,OAAO,EAAE,IAAI,aAAa,YAAY,IAAI,IAAI,IAAI,SAAS,GAAG,OAAO,IAAI,aAAa,IAAI,QAAQ,eAAe,CAAC;AAAA,IACjI;AACA,QAAI,CAAC,gBAAgB,IAAI,cAAc,GAAG;AACxC,YAAM,OAAO,OAAO,EAAE,IAAI,aAAa,YAAY,IAAI,IAAI,IAAI,SAAS,GAAG,OAAO,IAAI,aAAa,IAAI,QAAQ,eAAe,CAAC;AAAA,IACjI;AAAA,EACF;AASA,MAAI,UAAU,IAAI,GAAG;AACnB,UAAM,EAAE,YAAY,IAAI,MAAM,OAAO,qBAAoB;AACzD,UAAM,KAAK,MAAM,YAAY;AAAA,MAC3B;AAAA,MACA,MAAM;AAAA,MACN,gBAAgB;AAAA,MAChB,YAAY,KAAK;AAAA,MACjB,gBAAgB,KAAK;AAAA,IACvB,CAAC;AACD,UAAM,GAAG,2BAA2B,WAAW,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,EAC5E;AAMA,QAAM,WAAW,EAAE,QAAQ,SAAS,QAAQ,WAAW,SAAS,WAAW,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE;AAChH,QAAM,MAAM,IAAI,WAAW,SAAS,YAAY,EAAE,GAAG,aAAa,OAAO,KAAK,UAAU,QAAQ,EAAE,CAAC;AAEnG,SAAO,EAAE,WAAW,OAAO;AAC7B;;;ACrUA,eAAsB,0BACpB,aACA,aAC4C;AAC5C,QAAM,SAAS,cAAc,WAAW;AACxC,MAAI,OAAO,eAAe,yBAAyB,OAAO,iBAAiB,QAAW;AACpF,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,WAAW;AAC9C,QAAM,EAAE,MAAM,KAAK,IAAI,4BAA4B,QAAQ;AAC3D,QAAM,OAAO,MAAM,WAAW,MAAM,WAAW;AAC/C,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAM,MAAyC,CAAC;AAChD,aAAW,CAAC,YAAY,IAAI,KAAK,OAAO,QAAQ,OAAO,WAAW,GAAG;AACnE,UAAM,MAAM,KAAK,IAAI,UAAU;AAC/B,QAAI,QAAQ,OAAW;AACvB,UAAM,OAA0B,CAAC;AACjC,eAAW,CAAC,IAAI,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC5C,YAAM,YAAY,MAAM,iBAAiB,KAAK,GAAG;AACjD,YAAM,OAAO,KAAK,MAAM,SAAS;AACjC,WAAK,KAAK;AAAA,QACR;AAAA,QACA,QAAQ,EAAE,GAAG,MAAM,GAAG;AAAA,QACtB,IAAI,IAAI;AAAA,QACR,SAAS,IAAI;AAAA,QACb,GAAI,IAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,QAAQ,IAAI,CAAC;AAAA,QAC3D,GAAI,IAAI,cAAc,SAAY,EAAE,UAAU,IAAI,UAAU,IAAI,CAAC;AAAA,MACnE,CAAC;AAAA,IACH;AACA,QAAI,UAAU,IAAI;AAAA,EACpB;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/with-cargo/adopt-partition.ts","../src/with-cargo/decrypt-partition.ts"],"sourcesContent":["/**\n * Partition adoption. Recipient side: verify an extracted bundle,\n * validate the transfer key, import the re-keyed collections into a\n * destination store, and record an `_meta/adoption` marker. The bundle\n * stays UNOWNED after adoption — `createOwnerOnAdoptedPartition`\n * mints the owner; the transfer seal is then destroyed.\n *\n * @module\n */\nimport { base64ToBuffer, wrapKey, type EnclaveKey } from '../kernel/enclave/index.js'\nimport { TransferSealError, AdoptionStateError, ValidationError } from '../kernel/errors.js'\nimport type { NoydbStore, VaultSnapshot, KeyringFile } from '../kernel/types.js'\nimport { createOwnerKeyring } from '../with-party/team/keyring.js'\nimport { resolveManagedSecret } from '../with-party/team/managed-passphrase.js'\nimport type { SealingKeyProvider } from '../with-party/team/managed-passphrase.js'\nimport type { ShamirRecoveryProvider } from '../with-party/team/shamir-recovery-provider.js'\nimport type { RecoveryEnrollmentInput } from '../with-party/team/rotate-recover.js'\nimport { LedgerStore } from '../with-commit/history/ledger/store.js'\nimport { LEDGER_COLLECTION } from '../with-commit/history/ledger/constants.js'\nimport type { TransferSealPayload } from '../with-pod/bundle.js'\nimport { readPodHeader, readPod, parseExtractedPartitionBody } from '../with-pod/bundle.js'\n\n/**\n * Reverse of `sealDeks`. Imports the transfer key, decrypts the\n * sealed `{ collection: base64(rawDEK) }` map (layout iv(12)‖ct‖tag), and\n * re-imports each DEK as an AES-GCM key. Throws `TransferSealError` on a\n * wrong key (AES-GCM auth-tag failure) or malformed payload.\n */\nexport async function unsealDeks(\n  seal: TransferSealPayload,\n  transferKey: Uint8Array,\n): Promise<Map<string, EnclaveKey>> {\n  if (transferKey.byteLength !== 32) {\n    throw new TransferSealError(\n      `transfer key must be 32 bytes, got ${transferKey.byteLength}.`,\n    )\n  }\n  const key = await crypto.subtle.importKey('raw', transferKey as BufferSource, 'AES-GCM', false, ['decrypt'])\n  const raw = base64ToBuffer(seal.payload)\n  let plaintext: ArrayBuffer\n  try {\n    plaintext = await crypto.subtle.decrypt(\n      { name: 'AES-GCM', iv: raw.slice(0, 12) as BufferSource },\n      key,\n      raw.slice(12) as BufferSource,\n    )\n  } catch {\n    throw new TransferSealError(\n      'transfer seal could not be opened — wrong transfer key (AES-GCM authentication failed).',\n    )\n  }\n  let dekMap: Record<string, string>\n  try {\n    dekMap = JSON.parse(new TextDecoder().decode(plaintext)) as Record<string, string>\n  } catch {\n    throw new TransferSealError('transfer seal payload is not valid JSON after decryption.')\n  }\n  const deks = new Map<string, EnclaveKey>()\n  for (const [collection, b64] of Object.entries(dekMap)) {\n    // Extractable: the recipient must be able to re-wrap these under their\n    // own KEK (AES-KW) at owner-creation. Matches generateDEK.\n    const dek = await crypto.subtle.importKey('raw', base64ToBuffer(b64) as BufferSource, 'AES-GCM', true, ['encrypt', 'decrypt'])\n    deks.set(collection, dek)\n  }\n  return deks\n}\n\nexport interface AdoptPartitionOptions {\n  readonly transferKey: Uint8Array\n  readonly destinationStore: NoydbStore\n  readonly vaultName: string\n}\n\nexport interface AdoptPartitionResult {\n  readonly vaultName: string\n  readonly needsOwner: true\n  readonly sealId: string\n}\n\nexport async function adoptPartition(\n  bundleBytes: Uint8Array,\n  opts: AdoptPartitionOptions,\n): Promise<AdoptPartitionResult> {\n  const { transferKey, destinationStore, vaultName } = opts\n\n  const header = readPodHeader(bundleBytes)\n  if (header.bundleKind !== 'extracted-partition' || header.transferSeal === undefined) {\n    throw new ValidationError(\n      'adoptPartition requires an extracted-partition bundle with a transfer seal. '\n      + 'For ordinary backups use readPod + vault.load.',\n    )\n  }\n\n  const { dumpJson } = await readPod(bundleBytes)\n  const { dump, seal } = parseExtractedPartitionBody(dumpJson)\n\n  // Validate the transfer key by unsealing in memory; throws\n  // TransferSealError on mismatch. DEKs are discarded here — they stay\n  // sealed at rest (in _meta/adoption) until owner-creation wraps them under the\n  // recipient's KEK.\n  await unsealDeks(seal, transferKey)\n\n  // Single-occupancy per vaultName: an `_meta/adoption` marker already present\n  // means this slot holds a partition (adopted-and-unowned, or already owned).\n  // saveAll below would overwrite its data and replace the marker, stranding the\n  // prior adoption's transfer seal. Refuse regardless of sealId — re-adopting the\n  // SAME bundle is a redundant call, and adopting a DIFFERENT bundle here would\n  // clobber the existing partition. Either way, pick a fresh vaultName.\n  const existing = await destinationStore.get(vaultName, '_meta', 'adoption')\n  if (existing) {\n    const prior = JSON.parse(existing._data) as { sealId?: string }\n    if (prior.sealId === seal.sealId) {\n      throw new AdoptionStateError(\n        `partition (sealId ${seal.sealId}) is already adopted into vault \"${vaultName}\".`,\n      )\n    }\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already holds an adopted partition (sealId ${prior.sealId}); `\n      + `adopting a different partition (sealId ${seal.sealId}) here would overwrite it. `\n      + `Adopt into a fresh vaultName instead.`,\n    )\n  }\n\n  // The marker-only check above misses a worse case: a vaultName already in use\n  // by an ORDINARY vault (createNoydb + openVault) carries no `_meta/adoption`,\n  // yet `saveAll` below is destructive on SQL adapters (`DELETE FROM ... WHERE\n  // vault = ?` followed by upsert) and would wipe the legitimate keyring +\n  // data. Refuse adoption into ANY occupied slot — a fresh vaultName is the\n  // documented precondition.\n  const existingKeyring = await destinationStore.list(vaultName, '_keyring')\n  if (existingKeyring.length > 0) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already holds a keyring (an unrelated owner exists at this slot); `\n      + `adoptPartition requires a fresh vaultName to avoid destructive saveAll on SQL adapters.`,\n    )\n  }\n\n  const backup = JSON.parse(dump) as { collections: VaultSnapshot; _internal?: VaultSnapshot }\n  await destinationStore.saveAll(vaultName, backup.collections)\n\n  // Import carried internal collections (e.g. _schemas from carrySchemas).\n  // saveAll only writes data collections; _internal is written per-record.\n  if (backup._internal) {\n    for (const [collection, records] of Object.entries(backup._internal)) {\n      for (const [id, envelope] of Object.entries(records)) {\n        await destinationStore.put(vaultName, collection, id, envelope)\n      }\n    }\n  }\n\n  const adoptedAt = new Date().toISOString()\n  const adoption = { sealId: seal.sealId, adoptedAt, needsOwner: true as const, transferSeal: seal }\n  await destinationStore.put(vaultName, '_meta', 'adoption', {\n    _noydb: 1, _v: 1, _ts: adoptedAt, _iv: '', _data: JSON.stringify(adoption),\n  })\n\n  return { vaultName, needsOwner: true, sealId: seal.sealId }\n}\n\nexport interface CreateOwnerResult {\n  readonly vaultName: string\n  readonly userId: string\n}\n\n/** Standard-mode owner: recipient supplies the passphrase. */\nexport interface CreateOwnerStandardOptions {\n  readonly userId: string\n  readonly passphrase: string\n  readonly transferKey: Uint8Array\n}\n\n/**\n * Managed-mode owner: the passphrase is minted + sealed under\n * a `SealingKeyProvider` (e.g. an `at-*` OS keychain) so the partition\n * auto-unlocks on the recipient's device. Managed mode mandates a strong\n * (Shamir) recovery profile at creation, which needs the\n * `shamirRecovery` provider injected.\n */\nexport interface CreateOwnerManagedOptions {\n  readonly userId: string\n  readonly passphraseMode: 'managed'\n  readonly sealingKey: SealingKeyProvider\n  readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>\n  readonly shamirRecovery: ShamirRecoveryProvider\n  readonly transferKey: Uint8Array\n}\n\nexport type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManagedOptions\n\nfunction isManaged(o: CreateOwnerOptions): o is CreateOwnerManagedOptions {\n  return 'passphraseMode' in o && o.passphraseMode === 'managed'\n}\n\n/**\n * Mint the first owner keyring on an adopted-but-unowned partition,\n * then destroy the transfer seal.\n *\n * Standard mode: the recipient supplies a passphrase. Managed mode: the\n * passphrase is minted + sealed under a `SealingKeyProvider` and a strong\n * (Shamir) recovery profile is enrolled — orchestrated via the existing\n * `openVaultAndEnrollRecovery` ceremony.\n *\n * Either way, reuses `createOwnerKeyring` to derive the KEK + write the base\n * keyring, then wraps the partition's DEKs (recovered from the seal) under that\n * KEK and re-persists the merged keyring file.\n *\n * Idempotent under retry: the seal is destroyed LAST (Stage D), after the\n * keyring (Stage A), the ledger transition (Stage B), and — in managed mode —\n * strong-recovery enrollment (Stage C). A failure in the fallible enrollment\n * step leaves the seal intact, and re-running with the same `userId` +\n * `transferKey` resumes from the first incomplete stage. (Multi-profile recovery\n * arrays may re-enroll an already-enrolled profile on retry; managed mode's\n * mandated single Shamir profile does not.)\n */\nexport async function createOwnerOnAdoptedPartition(\n  store: NoydbStore,\n  vaultName: string,\n  opts: CreateOwnerOptions,\n): Promise<CreateOwnerResult> {\n  const { userId, transferKey } = opts\n\n  // Managed mode requires a strong (Shamir) recovery profile, validated BEFORE\n  // any disk write — same gate as createNoydb.\n  if (isManaged(opts) && !opts.recovery.some((r) => r.profile === 'shamir')) {\n    throw new AdoptionStateError(\n      'managed-mode adoption requires at least one strong (shamir) recovery profile in '\n      + '`recovery` — paper alone is not strong when there is no user passphrase to fall back on.',\n    )\n  }\n\n  // 1. Verify adopted-unowned state.\n  const adoptionEnv = await store.get(vaultName, '_meta', 'adoption')\n  if (!adoptionEnv) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" is not an adopted partition (no _meta/adoption). `\n      + `createOwnerOnAdoptedPartition only applies to vaults created via adoptPartition.`,\n    )\n  }\n  const adoption = JSON.parse(adoptionEnv._data) as {\n    sealId: string; adoptedAt: string; needsOwner?: boolean\n    consumedAt?: string; transferSeal?: TransferSealPayload\n  }\n  if (adoption.consumedAt !== undefined || adoption.transferSeal === undefined) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already has an owner (transfer seal consumed at ${adoption.consumedAt}).`,\n    )\n  }\n\n  // 2. Recover the partition DEKs from the seal (throws on wrong key) BEFORE\n  //    writing any keyring, so a bad transfer key leaves no trace. Always\n  //    validated, including when resuming a partial prior call.\n  const partitionDeks = await unsealDeks(adoption.transferSeal, transferKey)\n\n  // The ceremony below is split into stages so a failure in the fallible\n  // managed-enrollment step (network/provider outage) leaves the call RETRYABLE\n  // — the seal is destroyed only once everything durable is in place. Each stage\n  // detects its own prior completion rather than relying on a single resume bit.\n\n  // A keyring present for a DIFFERENT user (with the seal still unconsumed) is a\n  // genuine second-owner attempt — refuse it. A same-user keyring is a resumed\n  // partial call and is handled by the stage checks below.\n  const existingKeyring = await store.get(vaultName, '_keyring', userId)\n  const otherOwners = (await store.list(vaultName, '_keyring')).filter((u) => u !== userId)\n  if (otherOwners.length > 0) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already has a keyring for a different owner; cannot create owner \"${userId}\".`,\n    )\n  }\n\n  // Stage A — mint the owner keyring + merge the partition DEKs. Considered done\n  // only when the keyring already holds every partition DEK. createOwnerKeyring\n  // overwrites (fresh KEK + fresh _users DEK), so re-running is safe ONLY while\n  // no recovery has been enrolled yet — guaranteed here because enrollment\n  // (Stage C) runs strictly after Stage A completes.\n  const partitionCollections = [...partitionDeks.keys()]\n  const priorDeks = existingKeyring ? (JSON.parse(existingKeyring._data) as KeyringFile).deks : {}\n  const ownerMinted = existingKeyring !== null && partitionCollections.every((c) => c in priorDeks)\n  if (!ownerMinted) {\n    // Resolve the owner passphrase. Managed mode mints a random passphrase, seals\n    // it under the provider, and persists _meta/sealed-passphrase (so the\n    // partition auto-unlocks on the recipient's device); standard mode uses the\n    // caller's passphrase. Idempotent under retry — resolveManagedSecret's reopen\n    // arm reuses an already-sealed passphrase.\n    const passphrase = isManaged(opts)\n      ? await resolveManagedSecret(store, vaultName, opts.sealingKey)\n      : opts.passphrase\n\n    // Mint the owner keyring (KEK + _users DEK + canary, written to disk).\n    const unlocked = await createOwnerKeyring(store, vaultName, userId, passphrase)\n\n    // Merge the partition DEKs (wrapped under the new KEK) into the keyring.\n    const env = await store.get(vaultName, '_keyring', userId)\n    if (!env) throw new AdoptionStateError(`keyring write for \"${userId}\" did not persist`)\n    const keyringFile = JSON.parse(env._data) as KeyringFile\n    const kek = unlocked.kek\n    if (!kek) throw new AdoptionStateError(`owner keyring for \"${userId}\" has no KEK to wrap partition DEKs under`)\n    const mergedDeks: Record<string, string> = { ...keyringFile.deks }\n    for (const [collection, dek] of partitionDeks) {\n      mergedDeks[collection] = await wrapKey(dek, kek)\n    }\n    const mergedFile: KeyringFile = { ...keyringFile, deks: mergedDeks }\n    await store.put(vaultName, '_keyring', userId, { ...env, _data: JSON.stringify(mergedFile) })\n  }\n\n  // Stage B — record the ownership transition on the carried\n  // audit chain (carryLedger sealed the _ledger DEK). No-op without that DEK.\n  // Idempotent: appended only if the closing `transfer-seal-consumed` entry is\n  // absent, so a retry does not duplicate the pair.\n  const ledgerDek = partitionDeks.get(LEDGER_COLLECTION)\n  if (ledgerDek) {\n    const ledger = new LedgerStore({\n      adapter: store,\n      vault: vaultName,\n      encrypted: true,\n      getDEK: async () => ledgerDek,\n      actor: userId,\n    })\n    const creationReason = `creation-of-new-owner:${userId}`\n    const consumedReason = `transfer-seal-consumed:${adoption.sealId}`\n    // Gate each append on its own presence — a crash or store error strictly\n    // between the two adjacent puts would otherwise re-append the first one\n    // on retry. The pair is the audit record, not a single transaction.\n    const recordedReasons = new Set((await ledger.loadAllEntries()).map((e) => e.reason))\n    if (!recordedReasons.has(creationReason)) {\n      await ledger.append({ op: 'lifecycle', collection: '', id: '', version: 0, actor: '', payloadHash: '', reason: creationReason })\n    }\n    if (!recordedReasons.has(consumedReason)) {\n      await ledger.append({ op: 'lifecycle', collection: '', id: '', version: 0, actor: '', payloadHash: '', reason: consumedReason })\n    }\n  }\n\n  // Stage C — Managed mode: enroll the mandatory strong recovery\n  //    by orchestrating the existing public ceremony. The partition is\n  //    now a managed-mode vault on disk (sealed passphrase + keyring), so we\n  //    open it as a normal client and let openVaultAndEnrollRecovery do the\n  //    gate-bypass + enroll + re-assert. Dynamic import keeps the Noydb class\n  //    out of the @noy-db/hub/bundle static graph. Runs BEFORE seal destruction\n  //    so a failure here leaves the seal intact and the call retryable.\n  if (isManaged(opts)) {\n    const { createNoydb } = await import('../kernel/noydb.js')\n    const db = await createNoydb({\n      store,\n      user: userId,\n      passphraseMode: 'managed',\n      sealingKey: opts.sealingKey,\n      shamirRecovery: opts.shamirRecovery,\n    })\n    await db.openVaultAndEnrollRecovery(vaultName, { recovery: opts.recovery })\n  }\n\n  // Stage D — Destroy the transfer seal LAST — the commit point. Everything\n  //    above is either idempotent or resumable, so the seal is only consumed\n  //    once the owner keyring (and, in managed mode, strong recovery) is\n  //    durably in place. Retain sealId + consumedAt for audit.\n  const consumed = { sealId: adoption.sealId, adoptedAt: adoption.adoptedAt, consumedAt: new Date().toISOString() }\n  await store.put(vaultName, '_meta', 'adoption', { ...adoptionEnv, _data: JSON.stringify(consumed) })\n\n  return { vaultName, userId }\n}\n","/**\n * Read-side counterpart to `extractPartition`: decrypt an\n * extracted-partition bundle's records to plaintext using its transfer\n * key, WITHOUT adopting it into a vault. Used by an outward\n * orchestration layer's reconcile/merge and field-authority flows to\n * compare incoming records against a receiver. The transfer key validates the bundle\n * (wrong key throws).\n * @module\n */\nimport type { EncryptedEnvelope } from '../kernel/types.js'\nimport { openEnvelopeJson } from '../kernel/enclave/index.js'\nimport { readPodHeader, readPod, parseExtractedPartitionBody } from '../with-pod/bundle.js'\nimport { unsealDeks } from './adopt-partition.js'\n\n/** One decrypted record from an extracted-partition compartment. */\nexport interface DecryptedRecord {\n  readonly id: string\n  readonly record: Record<string, unknown>\n  /** Source envelope write timestamp (ISO) — for last-write-wins merges. */\n  readonly ts: string\n  /** Source envelope version. */\n  readonly version: number\n  /** Provenance source id (FR-5). Present only when the source collection had provenance:true and a source was supplied on put. */\n  readonly source?: string\n  /** ISO-8601 timestamp the provenance source was recorded (FR-5). */\n  readonly sourceTs?: string\n}\n\n/**\n * Decrypt every record of an extracted-partition bundle to plaintext,\n * grouped by collection. Throws if the bundle isn't an\n * extracted-partition or the transfer key is wrong.\n */\nexport async function decryptExtractedPartition(\n  bundleBytes: Uint8Array,\n  transferKey: Uint8Array,\n): Promise<Record<string, DecryptedRecord[]>> {\n  const header = readPodHeader(bundleBytes)\n  if (header.bundleKind !== 'extracted-partition' || header.transferSeal === undefined) {\n    throw new Error('decryptExtractedPartition: bundle is not an extracted-partition.')\n  }\n  const { dumpJson } = await readPod(bundleBytes)\n  const { dump, seal } = parseExtractedPartitionBody(dumpJson)\n  const deks = await unsealDeks(seal, transferKey) // throws TransferSealError on wrong key\n  const backup = JSON.parse(dump) as { collections: Record<string, Record<string, EncryptedEnvelope>> }\n  const out: Record<string, DecryptedRecord[]> = {}\n  for (const [collection, byId] of Object.entries(backup.collections)) {\n    const dek = deks.get(collection)\n    if (dek === undefined) continue // no DEK sealed for this collection — skip\n    const recs: DecryptedRecord[] = []\n    for (const [id, env] of Object.entries(byId)) {\n      const plaintext = await openEnvelopeJson(env, dek)\n      const body = JSON.parse(plaintext) as Record<string, unknown>\n      recs.push({\n        id,\n        record: { ...body, id },\n        ts: env._ts,\n        version: env._v,\n        ...(env._source !== undefined ? { source: env._source } : {}),\n        ...(env._sourceTs !== undefined ? { sourceTs: env._sourceTs } : {}),\n      })\n    }\n    out[collection] = recs\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,WACpB,MACA,aACkC;AAClC,MAAI,YAAY,eAAe,IAAI;AACjC,UAAM,IAAI;AAAA,MACR,sCAAsC,YAAY,UAAU;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,aAA6B,WAAW,OAAO,CAAC,SAAS,CAAC;AAC3G,QAAM,MAAM,eAAe,KAAK,OAAO;AACvC,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,OAAO,OAAO;AAAA,MAC9B,EAAE,MAAM,WAAW,IAAI,IAAI,MAAM,GAAG,EAAE,EAAkB;AAAA,MACxD;AAAA,MACA,IAAI,MAAM,EAAE;AAAA,IACd;AAAA,EACF,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAAA,EACzD,QAAQ;AACN,UAAM,IAAI,kBAAkB,2DAA2D;AAAA,EACzF;AACA,QAAM,OAAO,oBAAI,IAAwB;AACzC,aAAW,CAAC,YAAY,GAAG,KAAK,OAAO,QAAQ,MAAM,GAAG;AAGtD,UAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,eAAe,GAAG,GAAmB,WAAW,MAAM,CAAC,WAAW,SAAS,CAAC;AAC7H,SAAK,IAAI,YAAY,GAAG;AAAA,EAC1B;AACA,SAAO;AACT;AAcA,eAAsB,eACpB,aACA,MAC+B;AAC/B,QAAM,EAAE,aAAa,kBAAkB,UAAU,IAAI;AAErD,QAAM,SAAS,cAAc,WAAW;AACxC,MAAI,OAAO,eAAe,yBAAyB,OAAO,iBAAiB,QAAW;AACpF,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,WAAW;AAC9C,QAAM,EAAE,MAAM,KAAK,IAAI,4BAA4B,QAAQ;AAM3D,QAAM,WAAW,MAAM,WAAW;AAQlC,QAAM,WAAW,MAAM,iBAAiB,IAAI,WAAW,SAAS,UAAU;AAC1E,MAAI,UAAU;AACZ,UAAM,QAAQ,KAAK,MAAM,SAAS,KAAK;AACvC,QAAI,MAAM,WAAW,KAAK,QAAQ;AAChC,YAAM,IAAI;AAAA,QACR,qBAAqB,KAAK,MAAM,oCAAoC,SAAS;AAAA,MAC/E;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,gDAAgD,MAAM,MAAM,6CACnC,KAAK,MAAM;AAAA,IAEzD;AAAA,EACF;AAQA,QAAM,kBAAkB,MAAM,iBAAiB,KAAK,WAAW,UAAU;AACzE,MAAI,gBAAgB,SAAS,GAAG;AAC9B,UAAM,IAAI;AAAA,MACR,UAAU,SAAS;AAAA,IAErB;AAAA,EACF;AAEA,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAM,iBAAiB,QAAQ,WAAW,OAAO,WAAW;AAI5D,MAAI,OAAO,WAAW;AACpB,eAAW,CAAC,YAAY,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AACpE,iBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,cAAM,iBAAiB,IAAI,WAAW,YAAY,IAAI,QAAQ;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,WAAW,EAAE,QAAQ,KAAK,QAAQ,WAAW,YAAY,MAAe,cAAc,KAAK;AACjG,QAAM,iBAAiB,IAAI,WAAW,SAAS,YAAY;AAAA,IACzD,QAAQ;AAAA,IAAG,IAAI;AAAA,IAAG,KAAK;AAAA,IAAW,KAAK;AAAA,IAAI,OAAO,KAAK,UAAU,QAAQ;AAAA,EAC3E,CAAC;AAED,SAAO,EAAE,WAAW,YAAY,MAAM,QAAQ,KAAK,OAAO;AAC5D;AAgCA,SAAS,UAAU,GAAuD;AACxE,SAAO,oBAAoB,KAAK,EAAE,mBAAmB;AACvD;AAuBA,eAAsB,8BACpB,OACA,WACA,MAC4B;AAC5B,QAAM,EAAE,QAAQ,YAAY,IAAI;AAIhC,MAAI,UAAU,IAAI,KAAK,CAAC,KAAK,SAAS,KAAK,CAAC,MAAM,EAAE,YAAY,QAAQ,GAAG;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAGA,QAAM,cAAc,MAAM,MAAM,IAAI,WAAW,SAAS,UAAU;AAClE,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI;AAAA,MACR,UAAU,SAAS;AAAA,IAErB;AAAA,EACF;AACA,QAAM,WAAW,KAAK,MAAM,YAAY,KAAK;AAI7C,MAAI,SAAS,eAAe,UAAa,SAAS,iBAAiB,QAAW;AAC5E,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,qDAAqD,SAAS,UAAU;AAAA,IAC7F;AAAA,EACF;AAKA,QAAM,gBAAgB,MAAM,WAAW,SAAS,cAAc,WAAW;AAUzE,QAAM,kBAAkB,MAAM,MAAM,IAAI,WAAW,YAAY,MAAM;AACrE,QAAM,eAAe,MAAM,MAAM,KAAK,WAAW,UAAU,GAAG,OAAO,CAAC,MAAM,MAAM,MAAM;AACxF,MAAI,YAAY,SAAS,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,uEAAuE,MAAM;AAAA,IAClG;AAAA,EACF;AAOA,QAAM,uBAAuB,CAAC,GAAG,cAAc,KAAK,CAAC;AACrD,QAAM,YAAY,kBAAmB,KAAK,MAAM,gBAAgB,KAAK,EAAkB,OAAO,CAAC;AAC/F,QAAM,cAAc,oBAAoB,QAAQ,qBAAqB,MAAM,CAAC,MAAM,KAAK,SAAS;AAChG,MAAI,CAAC,aAAa;AAMhB,UAAM,aAAa,UAAU,IAAI,IAC7B,MAAM,qBAAqB,OAAO,WAAW,KAAK,UAAU,IAC5D,KAAK;AAGT,UAAM,WAAW,MAAM,mBAAmB,OAAO,WAAW,QAAQ,UAAU;AAG9E,UAAM,MAAM,MAAM,MAAM,IAAI,WAAW,YAAY,MAAM;AACzD,QAAI,CAAC,IAAK,OAAM,IAAI,mBAAmB,sBAAsB,MAAM,mBAAmB;AACtF,UAAM,cAAc,KAAK,MAAM,IAAI,KAAK;AACxC,UAAM,MAAM,SAAS;AACrB,QAAI,CAAC,IAAK,OAAM,IAAI,mBAAmB,sBAAsB,MAAM,2CAA2C;AAC9G,UAAM,aAAqC,EAAE,GAAG,YAAY,KAAK;AACjE,eAAW,CAAC,YAAY,GAAG,KAAK,eAAe;AAC7C,iBAAW,UAAU,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACjD;AACA,UAAM,aAA0B,EAAE,GAAG,aAAa,MAAM,WAAW;AACnE,UAAM,MAAM,IAAI,WAAW,YAAY,QAAQ,EAAE,GAAG,KAAK,OAAO,KAAK,UAAU,UAAU,EAAE,CAAC;AAAA,EAC9F;AAMA,QAAM,YAAY,cAAc,IAAI,iBAAiB;AACrD,MAAI,WAAW;AACb,UAAM,SAAS,IAAI,YAAY;AAAA,MAC7B,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,MACX,QAAQ,YAAY;AAAA,MACpB,OAAO;AAAA,IACT,CAAC;AACD,UAAM,iBAAiB,yBAAyB,MAAM;AACtD,UAAM,iBAAiB,0BAA0B,SAAS,MAAM;AAIhE,UAAM,kBAAkB,IAAI,KAAK,MAAM,OAAO,eAAe,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;AACpF,QAAI,CAAC,gBAAgB,IAAI,cAAc,GAAG;AACxC,YAAM,OAAO,OAAO,EAAE,IAAI,aAAa,YAAY,IAAI,IAAI,IAAI,SAAS,GAAG,OAAO,IAAI,aAAa,IAAI,QAAQ,eAAe,CAAC;AAAA,IACjI;AACA,QAAI,CAAC,gBAAgB,IAAI,cAAc,GAAG;AACxC,YAAM,OAAO,OAAO,EAAE,IAAI,aAAa,YAAY,IAAI,IAAI,IAAI,SAAS,GAAG,OAAO,IAAI,aAAa,IAAI,QAAQ,eAAe,CAAC;AAAA,IACjI;AAAA,EACF;AASA,MAAI,UAAU,IAAI,GAAG;AACnB,UAAM,EAAE,YAAY,IAAI,MAAM,OAAO,qBAAoB;AACzD,UAAM,KAAK,MAAM,YAAY;AAAA,MAC3B;AAAA,MACA,MAAM;AAAA,MACN,gBAAgB;AAAA,MAChB,YAAY,KAAK;AAAA,MACjB,gBAAgB,KAAK;AAAA,IACvB,CAAC;AACD,UAAM,GAAG,2BAA2B,WAAW,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,EAC5E;AAMA,QAAM,WAAW,EAAE,QAAQ,SAAS,QAAQ,WAAW,SAAS,WAAW,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE;AAChH,QAAM,MAAM,IAAI,WAAW,SAAS,YAAY,EAAE,GAAG,aAAa,OAAO,KAAK,UAAU,QAAQ,EAAE,CAAC;AAEnG,SAAO,EAAE,WAAW,OAAO;AAC7B;;;ACrUA,eAAsB,0BACpB,aACA,aAC4C;AAC5C,QAAM,SAAS,cAAc,WAAW;AACxC,MAAI,OAAO,eAAe,yBAAyB,OAAO,iBAAiB,QAAW;AACpF,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,WAAW;AAC9C,QAAM,EAAE,MAAM,KAAK,IAAI,4BAA4B,QAAQ;AAC3D,QAAM,OAAO,MAAM,WAAW,MAAM,WAAW;AAC/C,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAM,MAAyC,CAAC;AAChD,aAAW,CAAC,YAAY,IAAI,KAAK,OAAO,QAAQ,OAAO,WAAW,GAAG;AACnE,UAAM,MAAM,KAAK,IAAI,UAAU;AAC/B,QAAI,QAAQ,OAAW;AACvB,UAAM,OAA0B,CAAC;AACjC,eAAW,CAAC,IAAI,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC5C,YAAM,YAAY,MAAM,iBAAiB,KAAK,GAAG;AACjD,YAAM,OAAO,KAAK,MAAM,SAAS;AACjC,WAAK,KAAK;AAAA,QACR;AAAA,QACA,QAAQ,EAAE,GAAG,MAAM,GAAG;AAAA,QACtB,IAAI,IAAI;AAAA,QACR,SAAS,IAAI;AAAA,QACb,GAAI,IAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,QAAQ,IAAI,CAAC;AAAA,QAC3D,GAAI,IAAI,cAAc,SAAY,EAAE,UAAU,IAAI,UAAU,IAAI,CAAC;AAAA,MACnE,CAAC;AAAA,IACH;AACA,QAAI,UAAU,IAAI;AAAA,EACpB;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-AIWULCUO.js → chunk-6EVZXETK.js}

@@ -1,7 +1,9 @@
 import {
-  envelopeBodyForHash,
+  envelopeBodyForHash
+} from "./chunk-5EZAJEES.js";
+import {
   sha256Hex
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-L4IRFTIF.js";
 
 // src/with-commit/history/ledger/entry.ts
 function canonicalJson(value) {
@@ -65,4 +67,4 @@ export {
   parseIndex,
   envelopePayloadHash
 };
-//# sourceMappingURL=chunk-AIWULCUO.js.map
+//# sourceMappingURL=chunk-6EVZXETK.js.map

package/dist/{chunk-AIWULCUO.js.map → chunk-6EVZXETK.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-commit/history/ledger/entry.ts","../src/with-commit/history/ledger/hash.ts"],"sourcesContent":["/**\n * Ledger entry shape + canonical JSON + sha256 helpers.\n *\n * This file holds the PURE primitives used by the hash-chained ledger:\n * the entry type, the deterministic (sort-stable) JSON encoder, and\n * the sha256 hasher that produces `prevHash` and `ledger.head()`.\n *\n * Everything here is validator-free and side-effect free — the only\n * runtime dep is Web Crypto's `subtle.digest` for the sha256 call,\n * which we already use for every other hashing operation in the core.\n *\n * The hash chain property works like this:\n *\n *   hash(entry[i])       = sha256(canonicalJSON(entry[i]))\n *   entry[i+1].prevHash  = hash(entry[i])\n *\n * Any modification to `entry[i]` (field values, field order, whitespace)\n * produces a different `hash(entry[i])`, which means `entry[i+1]`'s\n * stored `prevHash` no longer matches the recomputed hash, which means\n * `verify()` returns `{ ok: false, divergedAt: i + 1 }`. The chain is\n * append-only and tamper-evident without external anchoring.\n */\n\n/**\n * A single ledger entry in its plaintext form — what gets serialized,\n * hashed, and then encrypted with the ledger DEK before being written\n * to the `_ledger/` adapter collection.\n *\n * ## Why hash the ciphertext, not the plaintext?\n *\n * `payloadHash` is the sha256 of the record's ENCRYPTED envelope bytes,\n * not its plaintext. This matters:\n *\n *   1. **Zero-knowledge preserved.** A user (or a third party) can\n *      verify the ledger against the stored envelopes without any\n *      decryption keys. The adapter layer already holds only\n *      ciphertext, so hashing the ciphertext keeps the ledger at the\n *      same privacy level as the adapter.\n *\n *   2. **Determinism.** Plaintext → ciphertext is randomized by the\n *      fresh per-write IV, so `hash(plaintext)` would need extra\n *      normalization. `hash(ciphertext)` is already deterministic and\n *      unique per write.\n *\n *   3. **Detection property.** If an attacker modifies even one byte of\n *      the stored ciphertext (trying to flip a record), the hash\n *      changes, the ledger's recorded `payloadHash` no longer matches,\n *      and a data-integrity check fails. We don't do that check in\n *      `verify()` today, but the\n *      hook is there for a future `verifyIntegrity()` follow-up.\n *\n * Fields marked `op`, `collection`, `id`, `version`, `ts`, `actor` are\n * plaintext METADATA about the operation — NOT the record itself. The\n * entry is still encrypted at rest via the ledger DEK, but adapters\n * could theoretically infer operation patterns from the sizes and\n * timestamps. This is an accepted trade-off for the tamper-evidence\n * property; full ORAM-level privacy is out of scope for noy-db.\n */\nimport { sha256Hex as sha256HexBytes } from '../../../kernel/enclave/index.js'\n\nexport interface LedgerEntry {\n  /**\n   * Zero-based sequential position of this entry in the chain. The\n   * canonical adapter key is this number zero-padded to 10 digits\n   * (`\"0000000001\"`) so lexicographic ordering matches numeric order.\n   */\n  readonly index: number\n\n  /**\n   * Hex-encoded sha256 of the canonical JSON of the PREVIOUS entry.\n   * The genesis entry (index 0) has `prevHash === ''` — the first\n   * entry in a fresh vault has nothing to point back to.\n   */\n  readonly prevHash: string\n\n  /**\n   * Which kind of mutation this entry records. only supports\n   * data operations (`put`, `delete`, `amendment`). Access-control\n   * operations (`grant`, `revoke`, `rotate`) will be added in a\n   * follow-up once the keyring write path is instrumented — that's\n   * tracked in the epic issue.\n   *\n   * `'amendment'` is the multi-record audit entry written by the\n   * guards service when an admin/owner uses `withTransactions(...)`\n   * to repair a constraint-violating state. See `amendment` field\n   * below for the structured payload.\n   *\n   * `'lifecycle'` records a non-data audit event (e.g. partition\n   * handover) — `collection`/`id` are empty and the event detail\n   * lives in `reason` (e.g. `'partition-handed-over:<sealId>'`). Like\n   * `amendment`, it carries no data envelope, so `verifyBackupIntegrity`\n   * skips it in the data cross-check (it still participates in the\n   * tamper-evident chain).\n   *\n   * `'forget'` is the single summary entry written by `vault.forget()`\n   * (GDPR crypto-shred). `collection`/`id` are empty and `version`\n   * is 0 — a forget is not scoped to one record. `payloadHash` carries\n   * `sha256Hex(subjectId)` so the ledger PROVES \"subject X existed and\n   * was erased on date D\" without retaining the subject id or any\n   * plaintext; `reason` holds a JSON summary of the shred counts. Like\n   * `amendment`/`lifecycle` it carries no data envelope and is skipped\n   * by the reconstruct walker (it still participates in the chain, so\n   * `verify()` passes after a shred).\n   */\n  readonly op: 'put' | 'delete' | 'amendment' | 'lifecycle' | 'migration' | 'forget'\n\n  /** The collection the mutation targeted. */\n  readonly collection: string\n\n  /** The record id the mutation targeted. */\n  readonly id: string\n\n  /**\n   * The record version AFTER this mutation. For `put` this is the\n   * newly assigned version; for `delete` this is the version that\n   * was deleted (the last version visible to reads).\n   */\n  readonly version: number\n\n  /** ISO timestamp of the mutation. */\n  readonly ts: string\n\n  /** User id of the actor who performed the mutation. */\n  readonly actor: string\n\n  /**\n   * Hex-encoded sha256 over the encrypted envelope's `_data` field, plus its\n   * sealed-field ciphertext map (`_sealed`) when the record carries one —\n   * so the ledger attests to both the open body and every sealed\n   * value. A record with no `_sealed` hashes `_data` alone.\n   * For `put`, this is the hash of the new ciphertext. For `delete`,\n   * it's the hash of the last visible ciphertext at deletion time, or the empty\n   * string if nothing was there to delete. Hashing the ciphertext (not the\n   * plaintext) preserves zero-knowledge — see the file docstring. The exact\n   * recipe lives in `envelopePayloadHash` (`hash.ts`).\n   */\n  readonly payloadHash: string\n\n  /**\n   * Optional human-readable tag describing why this mutation happened.\n   * Threaded through `collection.put(_, _, { reason })`. Common\n   * values include `'import:csv'`, `'import:json'`, `'import:xlsx'` from\n   * `as-*` ImportPlan.apply(), but consumers can use any string for\n   * domain-specific audit filtering. Auto-strip via `canonicalJson` —\n   * absent on the wire, never serialized as `null`.\n   *\n   * Audit consumers filter: `entries.filter(e => e.reason?.startsWith('import:'))`.\n   */\n  readonly reason?: string\n\n  /**\n   * Optional hex-encoded sha256 of the encrypted JSON Patch delta\n   * blob stored alongside this entry in `_ledger_deltas/`. Present\n   * only for `put` operations that had a previous version — the\n   * genesis put of a new record, and every `delete`, leave this\n   * field undefined.\n   *\n   * The delta payload itself lives in a sibling internal collection\n   * (`_ledger_deltas/<paddedIndex>`) and is encrypted with the\n   * ledger DEK. Callers use `ledger.loadDelta(index)` to decrypt and\n   * deserialize it when reconstructing a historical version.\n   *\n   * Why optional instead of always-present: the first put of a\n   * record has no previous version to diff against, so storing an\n   * empty patch would be noise. For deletes there's no \"next\" state\n   * to describe with a delta. Both cases set this field to undefined.\n   *\n   * Note: the canonical-JSON hasher treats `undefined` as invalid\n   * (it's one of the guard rails), so on the wire this field is\n   * either `{ deltaHash: '<hex>' }` or absent from the JSON\n   * entirely — never `{ deltaHash: undefined }`.\n   */\n  readonly deltaHash?: string\n\n  /**\n   * Present only when `op === 'amendment'`. Records the human reason,\n   * the role of the actor, the (collection, id, vBefore, vAfter) tuple\n   * for every record touched, and which guard invariants passed.\n   *\n   * See docs/superpowers/specs/2026-05-18-guards-design.md.\n   */\n  readonly amendment?: {\n    readonly reason: string\n    readonly role: 'admin' | 'owner'\n    readonly changes: ReadonlyArray<{\n      readonly collection: string\n      readonly id: string\n      readonly vBefore: number\n      readonly vAfter: number\n    }>\n    readonly invariantsPassed: ReadonlyArray<string>\n  }\n}\n\n/**\n * Canonical (sort-stable) JSON encoder.\n *\n * This function is the load-bearing primitive of the hash chain:\n * `sha256(canonicalJSON(entry))` must produce the same hex string\n * every time, on every machine, for the same logical entry — otherwise\n * `verify()` would return `{ ok: false }` on cross-platform reads.\n *\n * JavaScript's `JSON.stringify` is almost canonical, but NOT quite:\n * it preserves the insertion order of object keys, which means\n * `{a:1,b:2}` and `{b:2,a:1}` serialize differently. We fix this by\n * recursively walking objects and sorting their keys before\n * concatenation.\n *\n * Arrays keep their original order (reordering them would change\n * semantics). Numbers, strings, booleans, and `null` use the default\n * JSON encoding. `undefined` and functions are rejected — ledger\n * entries are plain data, and silently dropping `undefined` would\n * break the \"same input → same hash\" property if a caller forgot to\n * omit a field.\n *\n * Performance: one pass per nesting level; O(n log n) for key sorting\n * at each object. Entries are small (< 1 KB) so this is negligible\n * compared to the sha256 call.\n */\nexport function canonicalJson(value: unknown): string {\n  if (value === null) return 'null'\n  if (typeof value === 'boolean') return value ? 'true' : 'false'\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) {\n      throw new Error(\n        `canonicalJson: refusing to encode non-finite number ${String(value)}`,\n      )\n    }\n    return JSON.stringify(value)\n  }\n  if (typeof value === 'string') return JSON.stringify(value)\n  if (typeof value === 'bigint') {\n    throw new Error('canonicalJson: BigInt is not JSON-serializable')\n  }\n  if (typeof value === 'undefined' || typeof value === 'function') {\n    throw new Error(\n      `canonicalJson: refusing to encode ${typeof value} — include all fields explicitly`,\n    )\n  }\n  if (Array.isArray(value)) {\n    return '[' + value.map((v) => canonicalJson(v)).join(',') + ']'\n  }\n  if (typeof value === 'object') {\n    const obj = value as Record<string, unknown>\n    const keys = Object.keys(obj).sort()\n    const parts: string[] = []\n    for (const key of keys) {\n      parts.push(JSON.stringify(key) + ':' + canonicalJson(obj[key]))\n    }\n    return '{' + parts.join(',') + '}'\n  }\n  throw new Error(`canonicalJson: unexpected value type: ${typeof value}`)\n}\n\n/**\n * Compute a hex-encoded sha256 of a string via Web Crypto's subtle API.\n *\n * We use hex (not base64) for hashes because hex is case-insensitive,\n * fixed-length (64 chars), and easier to compare visually in debug\n * output. Base64 would save a few bytes in storage but every encrypted\n * ledger entry is already much larger than the hash itself.\n */\nexport async function sha256Hex(input: string): Promise<string> {\n  return sha256HexBytes(new TextEncoder().encode(input))\n}\n\n/**\n * Compute the canonical hash of a ledger entry. Short wrapper around\n * `canonicalJson` + `sha256Hex`; callers use this instead of composing\n * the two functions every time, so any future change to the hashing\n * pipeline (e.g., adding a domain-separation prefix) lives in one place.\n */\nexport async function hashEntry(entry: LedgerEntry): Promise<string> {\n  return sha256Hex(canonicalJson(entry))\n}\n\n/**\n * Pad an index to the canonical 10-digit form used as the adapter key.\n * Ten digits is enough for ~10 billion ledger entries per vault\n * — far beyond any realistic use case, but cheap enough that the extra\n * digits don't hurt storage.\n */\nexport function paddedIndex(index: number): string {\n  return String(index).padStart(10, '0')\n}\n\n/** Parse a padded adapter key back into a number. Returns NaN on malformed input. */\nexport function parseIndex(key: string): number {\n  return Number.parseInt(key, 10)\n}\n","/**\n * Envelope payload hash — pinned in its own leaf module so consumers\n * (DictionaryHandle, the active history strategy) can import it\n * without dragging in the `LedgerStore` class.\n *\n * see `constants.ts` for the broader rationale.\n *\n * @internal\n */\n\nimport type { EncryptedEnvelope } from '../../../kernel/types.js'\nimport { sha256Hex } from './entry.js'\nimport { envelopeBodyForHash } from '../../../kernel/enclave/index.js'\n\n/**\n * Compute the `payloadHash` value for an encrypted envelope. Used by\n * `LedgerStore.append` for both put (hash the new envelope) and\n * delete (hash the previous envelope) paths, and by\n * `DictionaryHandle` so its ledger entries match the same contract.\n *\n * Hashes the open `_data` ciphertext, plus the sealed-field ciphertext\n * map (`_sealed`) when a record carries one — so the ledger attests to\n * both the open body AND every sealed value.\n *\n * Returns the empty string when there is no envelope (delete of a\n * never-existed record). The empty string tolerated by the ledger\n * entry's `payloadHash` field as the canonical \"nothing here\" value.\n */\nexport async function envelopePayloadHash(\n  envelope: EncryptedEnvelope | null,\n): Promise<string> {\n  if (!envelope) return ''\n  // Back-compat: a record with NO sealed fields hashes as sha256 of\n  // `_data` alone — so every pre-existing ledger entry\n  // and every non-sealed backup verifies byte-identically. A record WITH\n  // `_sealed` widens the hash to also bind the sealed-field ciphertext, so the\n  // ledger attests to sealed-value tamper/erasure (a dropped or swapped\n  // `_sealed[field]` now diverges `verifyBackupIntegrity`'s data cross-check).\n  // `envelopeBodyForHash` (the enclave barrel's C1 protected-body access\n  // contract) derives this exact string — see its own doc for the\n  // canonicalization recipe (sorted keys, independent of `_sealed`'s\n  // field-insertion / store-serialization order).\n  //\n  // `_cek` is deliberately NOT bound: a tampered wrapped-CEK already self-\n  // detects (it fails to unwrap), and `rotateRecordCek` rewrites `_cek` with no\n  // ledger entry — binding it would make every legitimate rotation fail verify.\n  //\n  // RESIDUAL: a backup containing sealed records created BEFORE this change\n  // stored `payloadHash` over `_data` only, so it will fail the data cross-check\n  // and must be re-anchored (re-`put`/re-baseline). Sealed fields are new, so\n  // this is expected to affect ~no real vault.\n  //\n  // The two branches are NOT domain-separated — D1 pins the no-`_sealed` branch\n  // to exactly `sha256(_data)`, so it cannot carry a discriminator tag. An actor\n  // with raw-store write access could therefore set a non-sealed record's `_data`\n  // equal to the canonical-JSON string below and collide a sealed record's hash —\n  // but doing so overwrites `_data` itself, which then no longer GCM-decrypts, so\n  // it only suppresses the verify signal on an already-destroyed record; it cannot\n  // silently erase one sealed field while leaving the record readable.\n  return sha256Hex(envelopeBodyForHash(envelope))\n}\n"],"mappings":";;;;;;AA2NO,SAAS,cAAc,OAAwB;AACpD,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,UAAW,QAAO,QAAQ,SAAS;AACxD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,uDAAuD,OAAO,KAAK,CAAC;AAAA,MACtE;AAAA,IACF;AACA,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC1D,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,OAAO,UAAU,eAAe,OAAO,UAAU,YAAY;AAC/D,UAAM,IAAI;AAAA,MACR,qCAAqC,OAAO,KAAK;AAAA,IACnD;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,MAAM,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI;AAAA,EAC9D;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,MAAM;AACZ,UAAM,OAAO,OAAO,KAAK,GAAG,EAAE,KAAK;AACnC,UAAM,QAAkB,CAAC;AACzB,eAAW,OAAO,MAAM;AACtB,YAAM,KAAK,KAAK,UAAU,GAAG,IAAI,MAAM,cAAc,IAAI,GAAG,CAAC,CAAC;AAAA,IAChE;AACA,WAAO,MAAM,MAAM,KAAK,GAAG,IAAI;AAAA,EACjC;AACA,QAAM,IAAI,MAAM,yCAAyC,OAAO,KAAK,EAAE;AACzE;AAUA,eAAsBA,WAAU,OAAgC;AAC9D,SAAO,UAAe,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACvD;AAQA,eAAsB,UAAU,OAAqC;AACnE,SAAOA,WAAU,cAAc,KAAK,CAAC;AACvC;AAQO,SAAS,YAAY,OAAuB;AACjD,SAAO,OAAO,KAAK,EAAE,SAAS,IAAI,GAAG;AACvC;AAGO,SAAS,WAAW,KAAqB;AAC9C,SAAO,OAAO,SAAS,KAAK,EAAE;AAChC;;;ACrQA,eAAsB,oBACpB,UACiB;AACjB,MAAI,CAAC,SAAU,QAAO;AA4BtB,SAAOC,WAAU,oBAAoB,QAAQ,CAAC;AAChD;","names":["sha256Hex","sha256Hex"]}
+{"version":3,"sources":["../src/with-commit/history/ledger/entry.ts","../src/with-commit/history/ledger/hash.ts"],"sourcesContent":["/**\n * Ledger entry shape + canonical JSON + sha256 helpers.\n *\n * This file holds the PURE primitives used by the hash-chained ledger:\n * the entry type, the deterministic (sort-stable) JSON encoder, and\n * the sha256 hasher that produces `prevHash` and `ledger.head()`.\n *\n * Everything here is validator-free and side-effect free — the only\n * runtime dep is Web Crypto's `subtle.digest` for the sha256 call,\n * which we already use for every other hashing operation in the core.\n *\n * The hash chain property works like this:\n *\n *   hash(entry[i])       = sha256(canonicalJSON(entry[i]))\n *   entry[i+1].prevHash  = hash(entry[i])\n *\n * Any modification to `entry[i]` (field values, field order, whitespace)\n * produces a different `hash(entry[i])`, which means `entry[i+1]`'s\n * stored `prevHash` no longer matches the recomputed hash, which means\n * `verify()` returns `{ ok: false, divergedAt: i + 1 }`. The chain is\n * append-only and tamper-evident without external anchoring.\n */\n\n/**\n * A single ledger entry in its plaintext form — what gets serialized,\n * hashed, and then encrypted with the ledger DEK before being written\n * to the `_ledger/` adapter collection.\n *\n * ## Why hash the ciphertext, not the plaintext?\n *\n * `payloadHash` is the sha256 of the record's ENCRYPTED envelope bytes,\n * not its plaintext. This matters:\n *\n *   1. **Zero-knowledge preserved.** A user (or a third party) can\n *      verify the ledger against the stored envelopes without any\n *      decryption keys. The adapter layer already holds only\n *      ciphertext, so hashing the ciphertext keeps the ledger at the\n *      same privacy level as the adapter.\n *\n *   2. **Determinism.** Plaintext → ciphertext is randomized by the\n *      fresh per-write IV, so `hash(plaintext)` would need extra\n *      normalization. `hash(ciphertext)` is already deterministic and\n *      unique per write.\n *\n *   3. **Detection property.** If an attacker modifies even one byte of\n *      the stored ciphertext (trying to flip a record), the hash\n *      changes, the ledger's recorded `payloadHash` no longer matches,\n *      and a data-integrity check fails. We don't do that check in\n *      `verify()` today, but the\n *      hook is there for a future `verifyIntegrity()` follow-up.\n *\n * Fields marked `op`, `collection`, `id`, `version`, `ts`, `actor` are\n * plaintext METADATA about the operation — NOT the record itself. The\n * entry is still encrypted at rest via the ledger DEK, but adapters\n * could theoretically infer operation patterns from the sizes and\n * timestamps. This is an accepted trade-off for the tamper-evidence\n * property; full ORAM-level privacy is out of scope for noy-db.\n */\nimport { sha256Hex as sha256HexBytes } from '../../../kernel/enclave/index.js'\n\nexport interface LedgerEntry {\n  /**\n   * Zero-based sequential position of this entry in the chain. The\n   * canonical adapter key is this number zero-padded to 10 digits\n   * (`\"0000000001\"`) so lexicographic ordering matches numeric order.\n   */\n  readonly index: number\n\n  /**\n   * Hex-encoded sha256 of the canonical JSON of the PREVIOUS entry.\n   * The genesis entry (index 0) has `prevHash === ''` — the first\n   * entry in a fresh vault has nothing to point back to.\n   */\n  readonly prevHash: string\n\n  /**\n   * Which kind of mutation this entry records. only supports\n   * data operations (`put`, `delete`, `amendment`). Access-control\n   * operations (`grant`, `revoke`, `rotate`) will be added in a\n   * follow-up once the keyring write path is instrumented — that's\n   * tracked in the epic issue.\n   *\n   * `'amendment'` is the multi-record audit entry written by the\n   * guards service when an admin/owner uses `withTransactions(...)`\n   * to repair a constraint-violating state. See `amendment` field\n   * below for the structured payload.\n   *\n   * `'lifecycle'` records a non-data audit event (e.g. partition\n   * handover) — `collection`/`id` are empty and the event detail\n   * lives in `reason` (e.g. `'partition-handed-over:<sealId>'`). Like\n   * `amendment`, it carries no data envelope, so `verifyBackupIntegrity`\n   * skips it in the data cross-check (it still participates in the\n   * tamper-evident chain).\n   *\n   * `'forget'` is the single summary entry written by `vault.forget()`\n   * (GDPR crypto-shred). `collection`/`id` are empty and `version`\n   * is 0 — a forget is not scoped to one record. `payloadHash` carries\n   * `sha256Hex(subjectId)` so the ledger PROVES \"subject X existed and\n   * was erased on date D\" without retaining the subject id or any\n   * plaintext; `reason` holds a JSON summary of the shred counts. Like\n   * `amendment`/`lifecycle` it carries no data envelope and is skipped\n   * by the reconstruct walker (it still participates in the chain, so\n   * `verify()` passes after a shred).\n   */\n  readonly op: 'put' | 'delete' | 'amendment' | 'lifecycle' | 'migration' | 'forget'\n\n  /** The collection the mutation targeted. */\n  readonly collection: string\n\n  /** The record id the mutation targeted. */\n  readonly id: string\n\n  /**\n   * The record version AFTER this mutation. For `put` this is the\n   * newly assigned version; for `delete` this is the version that\n   * was deleted (the last version visible to reads).\n   */\n  readonly version: number\n\n  /** ISO timestamp of the mutation. */\n  readonly ts: string\n\n  /** User id of the actor who performed the mutation. */\n  readonly actor: string\n\n  /**\n   * Hex-encoded sha256 over the encrypted envelope's `_data` field, plus its\n   * sealed-field ciphertext map (`_sealed`) when the record carries one —\n   * so the ledger attests to both the open body and every sealed\n   * value. A record with no `_sealed` hashes `_data` alone.\n   * For `put`, this is the hash of the new ciphertext. For `delete`,\n   * it's the hash of the last visible ciphertext at deletion time, or the empty\n   * string if nothing was there to delete. Hashing the ciphertext (not the\n   * plaintext) preserves zero-knowledge — see the file docstring. The exact\n   * recipe lives in `envelopePayloadHash` (`hash.ts`).\n   */\n  readonly payloadHash: string\n\n  /**\n   * Optional human-readable tag describing why this mutation happened.\n   * Threaded through `collection.put(_, _, { reason })`. Common\n   * values include `'import:csv'`, `'import:json'`, `'import:xlsx'` from\n   * `as-*` ImportPlan.apply(), but consumers can use any string for\n   * domain-specific audit filtering. Auto-strip via `canonicalJson` —\n   * absent on the wire, never serialized as `null`.\n   *\n   * Audit consumers filter: `entries.filter(e => e.reason?.startsWith('import:'))`.\n   */\n  readonly reason?: string\n\n  /**\n   * Optional hex-encoded sha256 of the encrypted JSON Patch delta\n   * blob stored alongside this entry in `_ledger_deltas/`. Present\n   * only for `put` operations that had a previous version — the\n   * genesis put of a new record, and every `delete`, leave this\n   * field undefined.\n   *\n   * The delta payload itself lives in a sibling internal collection\n   * (`_ledger_deltas/<paddedIndex>`) and is encrypted with the\n   * ledger DEK. Callers use `ledger.loadDelta(index)` to decrypt and\n   * deserialize it when reconstructing a historical version.\n   *\n   * Why optional instead of always-present: the first put of a\n   * record has no previous version to diff against, so storing an\n   * empty patch would be noise. For deletes there's no \"next\" state\n   * to describe with a delta. Both cases set this field to undefined.\n   *\n   * Note: the canonical-JSON hasher treats `undefined` as invalid\n   * (it's one of the guard rails), so on the wire this field is\n   * either `{ deltaHash: '<hex>' }` or absent from the JSON\n   * entirely — never `{ deltaHash: undefined }`.\n   */\n  readonly deltaHash?: string\n\n  /**\n   * Present only when `op === 'amendment'`. Records the human reason,\n   * the role of the actor, the (collection, id, vBefore, vAfter) tuple\n   * for every record touched, and which guard invariants passed.\n   *\n   * See docs/superpowers/specs/2026-05-18-guards-design.md.\n   */\n  readonly amendment?: {\n    readonly reason: string\n    readonly role: 'admin' | 'owner'\n    readonly changes: ReadonlyArray<{\n      readonly collection: string\n      readonly id: string\n      readonly vBefore: number\n      readonly vAfter: number\n    }>\n    readonly invariantsPassed: ReadonlyArray<string>\n  }\n}\n\n/**\n * Canonical (sort-stable) JSON encoder.\n *\n * This function is the load-bearing primitive of the hash chain:\n * `sha256(canonicalJSON(entry))` must produce the same hex string\n * every time, on every machine, for the same logical entry — otherwise\n * `verify()` would return `{ ok: false }` on cross-platform reads.\n *\n * JavaScript's `JSON.stringify` is almost canonical, but NOT quite:\n * it preserves the insertion order of object keys, which means\n * `{a:1,b:2}` and `{b:2,a:1}` serialize differently. We fix this by\n * recursively walking objects and sorting their keys before\n * concatenation.\n *\n * Arrays keep their original order (reordering them would change\n * semantics). Numbers, strings, booleans, and `null` use the default\n * JSON encoding. `undefined` and functions are rejected — ledger\n * entries are plain data, and silently dropping `undefined` would\n * break the \"same input → same hash\" property if a caller forgot to\n * omit a field.\n *\n * Performance: one pass per nesting level; O(n log n) for key sorting\n * at each object. Entries are small (< 1 KB) so this is negligible\n * compared to the sha256 call.\n */\nexport function canonicalJson(value: unknown): string {\n  if (value === null) return 'null'\n  if (typeof value === 'boolean') return value ? 'true' : 'false'\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) {\n      throw new Error(\n        `canonicalJson: refusing to encode non-finite number ${String(value)}`,\n      )\n    }\n    return JSON.stringify(value)\n  }\n  if (typeof value === 'string') return JSON.stringify(value)\n  if (typeof value === 'bigint') {\n    throw new Error('canonicalJson: BigInt is not JSON-serializable')\n  }\n  if (typeof value === 'undefined' || typeof value === 'function') {\n    throw new Error(\n      `canonicalJson: refusing to encode ${typeof value} — include all fields explicitly`,\n    )\n  }\n  if (Array.isArray(value)) {\n    return '[' + value.map((v) => canonicalJson(v)).join(',') + ']'\n  }\n  if (typeof value === 'object') {\n    const obj = value as Record<string, unknown>\n    const keys = Object.keys(obj).sort()\n    const parts: string[] = []\n    for (const key of keys) {\n      parts.push(JSON.stringify(key) + ':' + canonicalJson(obj[key]))\n    }\n    return '{' + parts.join(',') + '}'\n  }\n  throw new Error(`canonicalJson: unexpected value type: ${typeof value}`)\n}\n\n/**\n * Compute a hex-encoded sha256 of a string via Web Crypto's subtle API.\n *\n * We use hex (not base64) for hashes because hex is case-insensitive,\n * fixed-length (64 chars), and easier to compare visually in debug\n * output. Base64 would save a few bytes in storage but every encrypted\n * ledger entry is already much larger than the hash itself.\n */\nexport async function sha256Hex(input: string): Promise<string> {\n  return sha256HexBytes(new TextEncoder().encode(input))\n}\n\n/**\n * Compute the canonical hash of a ledger entry. Short wrapper around\n * `canonicalJson` + `sha256Hex`; callers use this instead of composing\n * the two functions every time, so any future change to the hashing\n * pipeline (e.g., adding a domain-separation prefix) lives in one place.\n */\nexport async function hashEntry(entry: LedgerEntry): Promise<string> {\n  return sha256Hex(canonicalJson(entry))\n}\n\n/**\n * Pad an index to the canonical 10-digit form used as the adapter key.\n * Ten digits is enough for ~10 billion ledger entries per vault\n * — far beyond any realistic use case, but cheap enough that the extra\n * digits don't hurt storage.\n */\nexport function paddedIndex(index: number): string {\n  return String(index).padStart(10, '0')\n}\n\n/** Parse a padded adapter key back into a number. Returns NaN on malformed input. */\nexport function parseIndex(key: string): number {\n  return Number.parseInt(key, 10)\n}\n","/**\n * Envelope payload hash — pinned in its own leaf module so consumers\n * (DictionaryHandle, the active history strategy) can import it\n * without dragging in the `LedgerStore` class.\n *\n * see `constants.ts` for the broader rationale.\n *\n * @internal\n */\n\nimport type { EncryptedEnvelope } from '../../../kernel/types.js'\nimport { sha256Hex } from './entry.js'\nimport { envelopeBodyForHash } from '../../../kernel/enclave/index.js'\n\n/**\n * Compute the `payloadHash` value for an encrypted envelope. Used by\n * `LedgerStore.append` for both put (hash the new envelope) and\n * delete (hash the previous envelope) paths, and by\n * `DictionaryHandle` so its ledger entries match the same contract.\n *\n * Hashes the open `_data` ciphertext, plus the sealed-field ciphertext\n * map (`_sealed`) when a record carries one — so the ledger attests to\n * both the open body AND every sealed value … and the verify-digest\n * ciphertext map (`_vdig`), each bound only when present — the `_vdig`\n * binding is the temporal-rollback detector for the C1 splice class.\n * `rotateRecordCek` rewrites `_vdig` with no ledger entry, the same\n * pre-existing rotation property `_sealed`/`_cek` already have\n * (`verifyBackupIntegrity` flags rotated records until re-anchored).\n *\n * Returns the empty string when there is no envelope (delete of a\n * never-existed record). The empty string tolerated by the ledger\n * entry's `payloadHash` field as the canonical \"nothing here\" value.\n */\nexport async function envelopePayloadHash(\n  envelope: EncryptedEnvelope | null,\n): Promise<string> {\n  if (!envelope) return ''\n  // Back-compat: a record with NO sealed fields hashes as sha256 of\n  // `_data` alone — so every pre-existing ledger entry\n  // and every non-sealed backup verifies byte-identically. A record WITH\n  // `_sealed` widens the hash to also bind the sealed-field ciphertext, so the\n  // ledger attests to sealed-value tamper/erasure (a dropped or swapped\n  // `_sealed[field]` now diverges `verifyBackupIntegrity`'s data cross-check).\n  // `envelopeBodyForHash` (the enclave barrel's C1 protected-body access\n  // contract) derives this exact string — see its own doc for the\n  // canonicalization recipe (sorted keys, independent of `_sealed`'s\n  // field-insertion / store-serialization order).\n  //\n  // `_cek` is deliberately NOT bound: a tampered wrapped-CEK already self-\n  // detects (it fails to unwrap), and `rotateRecordCek` rewrites `_cek` with no\n  // ledger entry — binding it would make every legitimate rotation fail verify.\n  //\n  // RESIDUAL: a backup containing sealed records created BEFORE this change\n  // stored `payloadHash` over `_data` only, so it will fail the data cross-check\n  // and must be re-anchored (re-`put`/re-baseline). Sealed fields are new, so\n  // this is expected to affect ~no real vault.\n  //\n  // The two branches are NOT domain-separated — D1 pins the no-`_sealed` branch\n  // to exactly `sha256(_data)`, so it cannot carry a discriminator tag. An actor\n  // with raw-store write access could therefore set a non-sealed record's `_data`\n  // equal to the canonical-JSON string below and collide a sealed record's hash —\n  // but doing so overwrites `_data` itself, which then no longer GCM-decrypts, so\n  // it only suppresses the verify signal on an already-destroyed record; it cannot\n  // silently erase one sealed field while leaving the record readable.\n  return sha256Hex(envelopeBodyForHash(envelope))\n}\n"],"mappings":";;;;;;;;AA2NO,SAAS,cAAc,OAAwB;AACpD,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,UAAW,QAAO,QAAQ,SAAS;AACxD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,uDAAuD,OAAO,KAAK,CAAC;AAAA,MACtE;AAAA,IACF;AACA,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC1D,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,OAAO,UAAU,eAAe,OAAO,UAAU,YAAY;AAC/D,UAAM,IAAI;AAAA,MACR,qCAAqC,OAAO,KAAK;AAAA,IACnD;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,MAAM,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI;AAAA,EAC9D;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,MAAM;AACZ,UAAM,OAAO,OAAO,KAAK,GAAG,EAAE,KAAK;AACnC,UAAM,QAAkB,CAAC;AACzB,eAAW,OAAO,MAAM;AACtB,YAAM,KAAK,KAAK,UAAU,GAAG,IAAI,MAAM,cAAc,IAAI,GAAG,CAAC,CAAC;AAAA,IAChE;AACA,WAAO,MAAM,MAAM,KAAK,GAAG,IAAI;AAAA,EACjC;AACA,QAAM,IAAI,MAAM,yCAAyC,OAAO,KAAK,EAAE;AACzE;AAUA,eAAsBA,WAAU,OAAgC;AAC9D,SAAO,UAAe,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACvD;AAQA,eAAsB,UAAU,OAAqC;AACnE,SAAOA,WAAU,cAAc,KAAK,CAAC;AACvC;AAQO,SAAS,YAAY,OAAuB;AACjD,SAAO,OAAO,KAAK,EAAE,SAAS,IAAI,GAAG;AACvC;AAGO,SAAS,WAAW,KAAqB;AAC9C,SAAO,OAAO,SAAS,KAAK,EAAE;AAChC;;;AChQA,eAAsB,oBACpB,UACiB;AACjB,MAAI,CAAC,SAAU,QAAO;AA4BtB,SAAOC,WAAU,oBAAoB,QAAQ,CAAC;AAChD;","names":["sha256Hex","sha256Hex"]}

package/dist/{chunk-GYGWYIOZ.js → chunk-6I2YPLAG.js}

@@ -1,17 +1,19 @@
 import {
-  encrypt,
   openEnvelopeJson
-} from "./chunk-5O3AOPDT.js";
+} from "./chunk-5EZAJEES.js";
+import {
+  encrypt
+} from "./chunk-L4IRFTIF.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-5TDJ56JE.js";
+} from "./chunk-OCDUQUAP.js";
 import {
   ConflictError,
   SequenceContentionError,
   SequenceNotEnabledError,
   SequenceOfflineError,
   ValidationError
-} from "./chunk-ZYUC53LT.js";
+} from "./chunk-BLZRNHMG.js";
 
 // src/with-commit/sequence/strategy.ts
 var NO_SEQUENCE = {
@@ -197,4 +199,4 @@ export {
   resolveSequenceKey,
   SequenceStore
 };
-//# sourceMappingURL=chunk-GYGWYIOZ.js.map
+//# sourceMappingURL=chunk-6I2YPLAG.js.map