@noy-db/hub 0.3.0-pre.2 → 0.3.0-pre.4

package/dist/{chunk-5O3AOPDT.js → chunk-OVO2RZAE.js}

@@ -1,367 +1,50 @@
+import {
+  isTombstone
+} from "./chunk-QKVILR7N.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-5TDJ56JE.js";
+} from "./chunk-LN22XH4B.js";
+import {
+  blindedEqual,
+  openVdigPayload,
+  sealVdigPayload
+} from "./chunk-PGFY7IRW.js";
+import {
+  dualReadSealedSlot,
+  parseSealedSlot
+} from "./chunk-TCIUO62Z.js";
+import {
+  mintBidxTag
+} from "./chunk-UOEWDCUX.js";
+import {
+  VDIG_ITERATIONS,
+  normalizeForVerify,
+  pbkdf2VerifyDigest
+} from "./chunk-LP7BEXCT.js";
+import {
+  base64ToBuffer,
+  bufferToBase64,
+  decrypt,
+  deriveDeterministicKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  encrypt,
+  encryptDeterministic,
+  generateDEK,
+  generateSalt,
+  unwrapCek,
+  wrapCek
+} from "./chunk-TLJOJBZD.js";
 import {
+  ClassifiedConfigError,
+  ClassifiedRotationError,
   DebugReservedFieldError,
-  DecryptionError,
-  InvalidKeyError,
   RecordCekNotFoundError,
   SchemaValidationError,
   TamperedError,
   ValidationError
-} from "./chunk-ZYUC53LT.js";
-
-// src/kernel/enclave/crypto.ts
-var PBKDF2_ITERATIONS = 6e5;
-var SALT_BYTES = 32;
-var IV_BYTES = 12;
-var KEY_BITS = 256;
-var subtle = globalThis.crypto.subtle;
-async function deriveKey(passphrase, salt) {
-  const keyMaterial = await subtle.importKey(
-    "raw",
-    new TextEncoder().encode(passphrase),
-    "PBKDF2",
-    false,
-    ["deriveKey"]
-  );
-  return subtle.deriveKey(
-    {
-      name: "PBKDF2",
-      salt,
-      iterations: PBKDF2_ITERATIONS,
-      hash: "SHA-256"
-    },
-    keyMaterial,
-    { name: "AES-KW", length: KEY_BITS },
-    false,
-    ["wrapKey", "unwrapKey"]
-  );
-}
-async function derivePassphraseKey(passphrase, salt, params) {
-  const keyMaterial = await subtle.importKey(
-    "raw",
-    new TextEncoder().encode(passphrase),
-    "PBKDF2",
-    false,
-    ["deriveKey"]
-  );
-  return params.keyUsage === "aes-gcm" ? subtle.deriveKey(
-    {
-      name: "PBKDF2",
-      salt,
-      iterations: params.iterations,
-      hash: "SHA-256"
-    },
-    keyMaterial,
-    { name: "AES-GCM", length: KEY_BITS },
-    false,
-    ["encrypt", "decrypt"]
-  ) : subtle.deriveKey(
-    {
-      name: "PBKDF2",
-      salt,
-      iterations: params.iterations,
-      hash: "SHA-256"
-    },
-    keyMaterial,
-    { name: "AES-KW", length: KEY_BITS },
-    false,
-    ["wrapKey", "unwrapKey"]
-  );
-}
-async function generateDEK() {
-  return subtle.generateKey(
-    { name: "AES-GCM", length: KEY_BITS },
-    true,
-    // extractable — needed for AES-KW wrapping
-    ["encrypt", "decrypt"]
-  );
-}
-async function wrapKey(dek, kek) {
-  const wrapped = await subtle.wrapKey("raw", dek, kek, "AES-KW");
-  return bufferToBase64(wrapped);
-}
-async function unwrapKey(wrappedBase64, kek) {
-  try {
-    return await subtle.unwrapKey(
-      "raw",
-      base64ToBuffer(wrappedBase64),
-      kek,
-      "AES-KW",
-      { name: "AES-GCM", length: KEY_BITS },
-      true,
-      ["encrypt", "decrypt"]
-    );
-  } catch {
-    throw new InvalidKeyError();
-  }
-}
-async function asKwKey(dek) {
-  const rawDek = await subtle.exportKey("raw", dek);
-  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
-  const salt = new TextEncoder().encode("noydb-cek-wrap");
-  const info = new TextEncoder().encode("v1");
-  const bits = await subtle.deriveBits(
-    { name: "HKDF", hash: "SHA-256", salt, info },
-    hkdfKey,
-    KEY_BITS
-  );
-  return subtle.importKey("raw", bits, "AES-KW", false, ["wrapKey", "unwrapKey"]);
-}
-async function wrapCek(cek, dek) {
-  const kw = await asKwKey(dek);
-  const wrapped = await subtle.wrapKey("raw", cek, kw, "AES-KW");
-  return bufferToBase64(wrapped);
-}
-async function unwrapCek(wrappedBase64, dek) {
-  const kw = await asKwKey(dek);
-  try {
-    return await subtle.unwrapKey(
-      "raw",
-      base64ToBuffer(wrappedBase64),
-      kw,
-      "AES-KW",
-      { name: "AES-GCM", length: KEY_BITS },
-      true,
-      ["encrypt", "decrypt"]
-    );
-  } catch {
-    throw new InvalidKeyError();
-  }
-}
-async function importCek(rawKey) {
-  return subtle.importKey("raw", rawKey, { name: "AES-GCM", length: KEY_BITS }, false, ["decrypt"]);
-}
-async function encrypt(plaintext, dek) {
-  const iv = generateIV();
-  const encoded = new TextEncoder().encode(plaintext);
-  const ciphertext = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    dek,
-    encoded
-  );
-  return {
-    iv: bufferToBase64(iv),
-    data: bufferToBase64(ciphertext)
-  };
-}
-async function decrypt(ivBase64, dataBase64, dek) {
-  const iv = base64ToBuffer(ivBase64);
-  const ciphertext = base64ToBuffer(dataBase64);
-  try {
-    const plaintext = await subtle.decrypt(
-      { name: "AES-GCM", iv },
-      dek,
-      ciphertext
-    );
-    return new TextDecoder().decode(plaintext);
-  } catch (err) {
-    if (err instanceof Error && err.name === "OperationError") {
-      throw new TamperedError();
-    }
-    throw new DecryptionError(
-      err instanceof Error ? err.message : "Decryption failed"
-    );
-  }
-}
-async function encryptBytes(data, dek) {
-  const iv = generateIV();
-  const ciphertext = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    dek,
-    data
-  );
-  return {
-    iv: bufferToBase64(iv),
-    data: bufferToBase64(ciphertext)
-  };
-}
-async function decryptBytes(ivBase64, dataBase64, dek) {
-  const iv = base64ToBuffer(ivBase64);
-  const ciphertext = base64ToBuffer(dataBase64);
-  try {
-    const plaintext = await subtle.decrypt(
-      { name: "AES-GCM", iv },
-      dek,
-      ciphertext
-    );
-    return new Uint8Array(plaintext);
-  } catch (err) {
-    if (err instanceof Error && err.name === "OperationError") {
-      throw new TamperedError();
-    }
-    throw new DecryptionError(
-      err instanceof Error ? err.message : "Decryption failed"
-    );
-  }
-}
-async function sha256Hex(data) {
-  const hash = await subtle.digest("SHA-256", data);
-  return Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function hmacSha256Hex(key, data) {
-  const rawKey = await subtle.exportKey("raw", key);
-  const hmacKey = await subtle.importKey(
-    "raw",
-    rawKey,
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const sig = await subtle.sign("HMAC", hmacKey, data);
-  return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function encryptBytesWithAAD(data, dek, aad) {
-  const iv = generateIV();
-  const ciphertext = await subtle.encrypt(
-    {
-      name: "AES-GCM",
-      iv,
-      additionalData: aad
-    },
-    dek,
-    data
-  );
-  return {
-    iv: bufferToBase64(iv),
-    data: bufferToBase64(ciphertext)
-  };
-}
-async function decryptBytesWithAAD(ivBase64, dataBase64, dek, aad) {
-  const iv = base64ToBuffer(ivBase64);
-  const ciphertext = base64ToBuffer(dataBase64);
-  try {
-    const plaintext = await subtle.decrypt(
-      {
-        name: "AES-GCM",
-        iv,
-        additionalData: aad
-      },
-      dek,
-      ciphertext
-    );
-    return new Uint8Array(plaintext);
-  } catch (err) {
-    if (err instanceof Error && err.name === "OperationError") {
-      throw new TamperedError();
-    }
-    throw new DecryptionError(
-      err instanceof Error ? err.message : "Decryption failed"
-    );
-  }
-}
-async function derivePresenceKey(dek, collectionName) {
-  const rawDek = await subtle.exportKey("raw", dek);
-  const hkdfKey = await subtle.importKey(
-    "raw",
-    rawDek,
-    "HKDF",
-    false,
-    ["deriveBits"]
-  );
-  const salt = new TextEncoder().encode("noydb-presence");
-  const info = new TextEncoder().encode(collectionName);
-  const bits = await subtle.deriveBits(
-    { name: "HKDF", hash: "SHA-256", salt, info },
-    hkdfKey,
-    KEY_BITS
-  );
-  return subtle.importKey(
-    "raw",
-    bits,
-    { name: "AES-GCM", length: KEY_BITS },
-    false,
-    ["encrypt", "decrypt"]
-  );
-}
-async function deriveSealedFieldKey(dek, collectionName, field) {
-  const rawDek = await subtle.exportKey("raw", dek);
-  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
-  const salt = new TextEncoder().encode("noydb-sealed");
-  const info = new TextEncoder().encode(JSON.stringify(["noydb-sealed", collectionName, field]));
-  const bits = await subtle.deriveBits(
-    { name: "HKDF", hash: "SHA-256", salt, info },
-    hkdfKey,
-    KEY_BITS
-  );
-  return subtle.importKey(
-    "raw",
-    bits,
-    { name: "AES-GCM", length: KEY_BITS },
-    false,
-    ["encrypt", "decrypt"]
-  );
-}
-async function deriveSealedFieldKeyFromCek(cek, collectionName, field) {
-  const rawCek = await subtle.exportKey("raw", cek);
-  const hkdfKey = await subtle.importKey("raw", rawCek, "HKDF", false, ["deriveBits"]);
-  const salt = new TextEncoder().encode("noydb-sealed-cek");
-  const info = new TextEncoder().encode(JSON.stringify(["noydb-sealed-cek", collectionName, field]));
-  const bits = await subtle.deriveBits(
-    { name: "HKDF", hash: "SHA-256", salt, info },
-    hkdfKey,
-    KEY_BITS
-  );
-  return subtle.importKey(
-    "raw",
-    bits,
-    { name: "AES-GCM", length: KEY_BITS },
-    false,
-    ["encrypt", "decrypt"]
-  );
-}
-async function deriveDeterministicIV(dek, context, plaintext) {
-  const rawDek = await subtle.exportKey("raw", dek);
-  const hkdfKey = await subtle.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
-  const salt = new TextEncoder().encode("noydb-deterministic-v1");
-  const info = new TextEncoder().encode(`${context}\0${plaintext}`);
-  const bits = await subtle.deriveBits(
-    { name: "HKDF", hash: "SHA-256", salt, info },
-    hkdfKey,
-    IV_BYTES * 8
-  );
-  return new Uint8Array(bits);
-}
-async function encryptDeterministic(plaintext, dek, context) {
-  const iv = await deriveDeterministicIV(dek, context, plaintext);
-  const encoded = new TextEncoder().encode(plaintext);
-  const ciphertext = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    dek,
-    encoded
-  );
-  return {
-    iv: bufferToBase64(iv),
-    data: bufferToBase64(ciphertext)
-  };
-}
-async function decryptDeterministic(ivBase64, dataBase64, dek) {
-  return decrypt(ivBase64, dataBase64, dek);
-}
-function generateIV() {
-  return globalThis.crypto.getRandomValues(new Uint8Array(IV_BYTES));
-}
-function generateSalt() {
-  return globalThis.crypto.getRandomValues(new Uint8Array(SALT_BYTES));
-}
-function bufferToBase64(buffer) {
-  const bytes = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
-  return btoa(binary);
-}
-function base64ToBuffer(base64) {
-  const binary = atob(base64);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return bytes;
-}
+} from "./chunk-U23JUUPX.js";
 
 // src/kernel/enclave/record-keys/lifecycle.ts
 async function resolveStableCek(deps, id) {
@@ -389,38 +72,40 @@ async function rewrapBodyToDek(envelope, fromDek, toDek) {
   return { _iv: iv, _data: data, cek: null };
 }
 
-// src/kernel/enclave/record-keys/tombstone.ts
-function isTombstone(envelope, encrypted) {
-  if (!encrypted) return false;
-  return !envelope._data && envelope._cek === void 0;
-}
-function buildTombstone(version, actor) {
-  return {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: version,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: "",
-    _data: "",
-    ...actor ? { _by: actor } : {}
-  };
-}
-
-// src/kernel/enclave/record-keys/sealed-slot.ts
-function parseSealedSlot(blob) {
-  const sep = blob.indexOf(":");
-  return { iv: blob.slice(0, sep), data: blob.slice(sep + 1) };
-}
-async function dualReadSealedSlot(blob, field, collection, cek, dek) {
-  const { iv, data } = parseSealedSlot(blob);
-  if (cek !== void 0) {
+// src/kernel/enclave/classify/write.ts
+async function mintVdigSlot(rawValue, policy, prevBlob, cek, collection, recordId, field) {
+  const normalized = normalizeForVerify(policy.normalize, rawValue);
+  let prev = null;
+  if (prevBlob !== void 0) {
     try {
-      const fieldKey2 = await deriveSealedFieldKeyFromCek(cek, collection, field);
-      return await decrypt(iv, data, fieldKey2);
+      prev = await openVdigPayload(prevBlob, cek, collection, recordId, field);
     } catch {
+      throw new TamperedError();
+    }
+    if (!Number.isInteger(prev.iter) || prev.iter < 1) {
+      throw new TamperedError();
     }
   }
-  const fieldKey = await deriveSealedFieldKey(dek, collection, field);
-  return decrypt(iv, data, fieldKey);
+  if (prev !== null && policy.notLastN > 0) {
+    const history = [prev.cur, ...prev.ring ?? []];
+    for (const entry of history) {
+      const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(entry.salt), prev.iter);
+      if (await blindedEqual(digest, base64ToBuffer(entry.hash))) {
+        throw new ClassifiedRotationError(collection, field, "password was used recently");
+      }
+    }
+  }
+  const salt = generateSalt();
+  const hash = await pbkdf2VerifyDigest(normalized, salt, VDIG_ITERATIONS);
+  const ring = prev !== null && policy.notLastN > 0 ? [...prev.ring ?? [], { salt: prev.cur.salt, hash: prev.cur.hash }].slice(-policy.notLastN) : void 0;
+  const payload = {
+    v: 1,
+    alg: "PBKDF2-SHA256",
+    iter: VDIG_ITERATIONS,
+    cur: { salt: bufferToBase64(salt), hash: bufferToBase64(hash), at: (/* @__PURE__ */ new Date()).toISOString() },
+    ...ring !== void 0 && ring.length > 0 ? { ring } : {}
+  };
+  return sealVdigPayload(payload, cek, collection, recordId, field);
 }
 
 // src/kernel/schema.ts
@@ -552,10 +237,32 @@ var RecordCodec = class _RecordCodec {
     const { iv, data } = await encrypt(json, dek);
     return _RecordCodec.buildEnvelope({ version, iv, data, by, provenance });
   }
-  async encryptRecord(record, version, cek, source, sourceTs) {
+  async encryptRecord(record, version, cek, source, sourceTs, vdig) {
     if (!this.ctx.storeCiphertext && this.ctx.debugPlaintext && !this.ctx.name.startsWith("_")) {
       return this.buildDebugEnvelope(record, version, source, sourceTs);
     }
+    if (this.ctx.storeCiphertext) {
+      const declared = this.ctx.vdigFields;
+      const storedClassified = /* @__PURE__ */ new Set();
+      if (vdig?.prev?._vdig) for (const k of Object.keys(vdig.prev._vdig)) storedClassified.add(k);
+      if (vdig?.prev?._bidx) for (const k of Object.keys(vdig.prev._bidx)) storedClassified.add(k);
+      if (this.ctx.classifiedMarkerDigestOnly !== void 0) {
+        for (const k of await this.ctx.classifiedMarkerDigestOnly()) storedClassified.add(k);
+      }
+      let undeclared;
+      for (const field of storedClassified) {
+        if (declared === null || !declared.has(field)) {
+          undeclared = field;
+          break;
+        }
+      }
+      if (undeclared !== void 0) {
+        throw new ClassifiedConfigError(
+          this.ctx.name,
+          `this collection has classified digest-only field "${undeclared}" but this handle does not declare it \u2014 refusing to write (would drop its tag or serialize the secret as plaintext)`
+        );
+      }
+    }
     let openRecord = record;
     let sealed;
     if (this.ctx.storeCiphertext && this.ctx.sensitiveFields.size > 0) {
@@ -577,22 +284,81 @@ var RecordCodec = class _RecordCodec {
         openRecord = open;
       }
     }
+    let vdigOut;
+    let bidxOutMap;
+    if (this.ctx.vdigFields !== null && this.ctx.vdigFields.size > 0 && this.ctx.storeCiphertext) {
+      if (vdig === void 0) {
+        throw new Error(
+          `RecordCodec.encryptRecord: collection "${this.ctx.name}" declares digest-only classified fields but this write path supplied no { id, prev } context \u2014 it would silently destroy _vdig (C6). Caller bug.`
+        );
+      }
+      if (cek === void 0) {
+        throw new Error(
+          `RecordCodec.encryptRecord: digest-only fields require a per-record CEK (R1 invariant) \u2014 collection "${this.ctx.name}" wrote without one. Caller bug.`
+        );
+      }
+      const open = { ...openRecord };
+      const out = {};
+      const bidxOut = {};
+      let bidxDek;
+      for (const [field, policy] of this.ctx.vdigFields) {
+        const value = open[field];
+        const prevBlob = vdig.prev?._vdig?.[field];
+        if (vdig.prev?._sealed?.[field] !== void 0) {
+          throw new ClassifiedConfigError(
+            this.ctx.name,
+            `field "${field}" carries a recoverable _sealed slot from a previous storage form \u2014 recoverable \u2194 digest-only transitions are refused (R6); migrate explicitly`
+          );
+        }
+        if (value === void 0) {
+          if (prevBlob !== void 0) {
+            out[field] = prevBlob;
+            const prevTag = vdig.prev?._bidx?.[field];
+            if (prevTag !== void 0) bidxOut[field] = prevTag;
+          }
+          continue;
+        }
+        if (value === null) {
+          delete open[field];
+          continue;
+        }
+        if (typeof value !== "string") {
+          throw new ValidationError(
+            `digest-only classified field "${field}" in "${this.ctx.name}" must be a string (rotate) or null (clear), got ${typeof value}`
+          );
+        }
+        out[field] = await mintVdigSlot(value, policy, prevBlob, cek, this.ctx.name, vdig.id, field);
+        if (policy.equatable === true) {
+          if (bidxDek === void 0) bidxDek = await this.ctx.getDEK();
+          const normalized = normalizeForVerify(policy.normalize, value);
+          bidxOut[field] = await mintBidxTag(normalized, bidxDek, this.ctx.name, field);
+        }
+        delete open[field];
+      }
+      openRecord = open;
+      if (Object.keys(out).length > 0) vdigOut = out;
+      if (Object.keys(bidxOut).length > 0) bidxOutMap = bidxOut;
+    }
     const base = await this.encryptJsonString(JSON.stringify(openRecord), version, cek, source, sourceTs);
     const withSealed = sealed ? { ...base, _sealed: sealed } : base;
-    if (!this.ctx.deterministicFields || !this.ctx.storeCiphertext) return withSealed;
+    const withVdig = vdigOut ? { ...withSealed, _vdig: vdigOut } : withSealed;
+    const withBidx = bidxOutMap ? { ...withVdig, _bidx: bidxOutMap } : withVdig;
+    if (!this.ctx.deterministicFields || !this.ctx.storeCiphertext) return withBidx;
     const dek = await this.ctx.getDEK();
+    const detKey = await deriveDeterministicKey(dek);
     const rec = record;
     const det = {};
     for (const field of this.ctx.deterministicFields) {
       if (this.ctx.sensitiveFields.has(field)) continue;
+      if (this.ctx.vdigFields?.has(field)) continue;
       const value = rec[field];
       if (value === void 0 || value === null) continue;
       const plaintext = typeof value === "string" ? value : JSON.stringify(value);
-      const { iv, data } = await encryptDeterministic(plaintext, dek, `${this.ctx.name}/${field}`);
+      const { iv, data } = await encryptDeterministic(plaintext, detKey, `${this.ctx.name}/${field}`);
       det[field] = `${iv}:${data}`;
     }
-    if (Object.keys(det).length === 0) return withSealed;
-    return { ...withSealed, _det: det };
+    if (Object.keys(det).length === 0) return withBidx;
+    return { ...withBidx, _det: det };
   }
   // ──────────────────────────────────────────────────────────────────────
   // Read path
@@ -668,25 +434,32 @@ var RecordCodec = class _RecordCodec {
    * `_cek` (pure legacy collection-DEK sealing) ALL slots are residue.
    */
   async classifySealedShred(live) {
-    const shreddable = [];
-    const dekResidue = [];
+    const slots = [];
+    if (live._vdig !== void 0 && live._cek !== void 0) {
+      for (const field of Object.keys(live._vdig)) {
+        slots.push({
+          field,
+          class: live._bidx?.[field] !== void 0 ? "live-shreddable+dekResidue-in-backups" : "shreddable"
+        });
+      }
+    }
     const sealed = live._sealed;
-    if (sealed === void 0) return { shreddable, dekResidue };
+    if (sealed === void 0) return { slots };
     const cek = await this.resolveEnvelopeCek(live);
     for (const [field, blob] of Object.entries(sealed)) {
       if (cek === void 0) {
-        dekResidue.push(field);
+        slots.push({ field, class: "dekResidue" });
         continue;
       }
       const { iv, data } = parseSealedSlot(blob);
       try {
         await decrypt(iv, data, await deriveSealedFieldKeyFromCek(cek, this.ctx.name, field));
-        shreddable.push(field);
+        slots.push({ field, class: "shreddable" });
       } catch {
-        dekResidue.push(field);
+        slots.push({ field, class: "dekResidue" });
       }
     }
-    return { shreddable, dekResidue };
+    return { slots };
   }
   /**
    * Build a non-leaking {@link Sealed} handle over a sealed field's ciphertext.
@@ -760,7 +533,7 @@ var RecordCodec = class _RecordCodec {
 };
 
 // src/kernel/enclave/record-keys/sealing.ts
-var subtle2 = globalThis.crypto.subtle;
+var subtle = globalThis.crypto.subtle;
 var SEALED_CEK_NS = "_sealed_cek";
 async function sealRecordToHost(ctx, collection, id, hostSealer, opts) {
   if (collection.includes("/")) throw new ValidationError(`sealRecordToHost: collection "${collection}" must not contain "/"`);
@@ -774,7 +547,7 @@ async function sealRecordToHost(ctx, collection, id, hostSealer, opts) {
   }
   const dek = await ctx.getDEK(collection);
   const cek = await unwrapCek(live._cek, dek);
-  const rawCek = await subtle2.exportKey("raw", cek);
+  const rawCek = await subtle.exportKey("raw", cek);
   const cekB64 = bufferToBase64(rawCek);
   const hint = await hostSealer.publishRecipientHint();
   if (hint.pid.includes("/")) throw new ValidationError(`sealRecordToHost: recipient pid "${hint.pid}" must not contain "/"`);
@@ -837,6 +610,15 @@ async function rotateRecordCek(ctx, collection, id) {
     }
     sealedOut = out;
   }
+  let vdigOut;
+  if (live._vdig !== void 0) {
+    const out = {};
+    for (const [field, blob] of Object.entries(live._vdig)) {
+      const payload = await openVdigPayload(blob, oldCek, collection, id, field);
+      out[field] = await sealVdigPayload(payload, newCek, collection, id, field);
+    }
+    vdigOut = out;
+  }
   const env = {
     _noydb: NOYDB_FORMAT_VERSION,
     _v: live._v + 1,
@@ -847,12 +629,19 @@ async function rotateRecordCek(ctx, collection, id) {
     ...ctx.actor ? { _by: ctx.actor } : {},
     ...live._tier !== void 0 ? { _tier: live._tier } : {},
     ...live._det !== void 0 ? { _det: live._det } : {},
+    // `_bidx` (equality-index tag) is DEK-rooted and CEK-independent, so it is
+    // carried forward VERBATIM — not recomputed — unlike `_vdig`/`_sealed`
+    // below, which are CEK-bound and must be re-sealed under the new CEK.
+    // Dropping this line would silently orphan the equality index on rotation
+    // (the #306 Slice-A data-loss bug, replayed on the index).
+    ...live._bidx !== void 0 ? { _bidx: live._bidx } : {},
     // Re-encrypt sealed (`sensitive`) fields under the new CEK. Sealed
     // keys derive off the per-record CEK, so the rotated record's old CEK is
     // destroyed here — carrying the old `_sealed` slots forward verbatim would
     // orphan them (unreadable under the new CEK). `sealedOut` holds the slots
     // dual-read from the old CEK (or the legacy DEK) and re-sealed under newCek.
-    ...sealedOut !== void 0 ? { _sealed: sealedOut } : {}
+    ...sealedOut !== void 0 ? { _sealed: sealedOut } : {},
+    ...vdigOut !== void 0 ? { _vdig: vdigOut } : {}
   };
   await ctx.adapter.put(ctx.vault, collection, id, env);
   await ctx.invalidateRecordCaches(collection, id);
@@ -866,11 +655,16 @@ async function rotateRecordCek(ctx, collection, id) {
 }
 
 // src/kernel/enclave/record-keys/deterministic.ts
-async function detTarget(ctx, field, value) {
+async function detTargets(ctx, field, value) {
   const dek = await ctx.getDEK();
+  const detKey = await deriveDeterministicKey(dek);
   const plaintext = typeof value === "string" ? value : JSON.stringify(value);
-  const { iv, data } = await encryptDeterministic(plaintext, dek, `${ctx.name}/${field}`);
-  return `${iv}:${data}`;
+  const context = `${ctx.name}/${field}`;
+  const [current, legacy] = await Promise.all([
+    encryptDeterministic(plaintext, detKey, context),
+    encryptDeterministic(plaintext, dek, context)
+  ]);
+  return [`${current.iv}:${current.data}`, `${legacy.iv}:${legacy.data}`];
 }
 function assertDetField(ctx, field, method) {
   if (!ctx.deterministicFields || !ctx.deterministicFields.has(field)) {
@@ -886,12 +680,12 @@ function assertDetField(ctx, field, method) {
 }
 async function findByDet(ctx, field, value) {
   assertDetField(ctx, field, "findByDet");
-  const target = await detTarget(ctx, field, value);
+  const [target, legacyTarget] = await detTargets(ctx, field, value);
   const ids = await ctx.adapter.list(ctx.vault, ctx.name);
   for (const id of ids) {
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env || !env._det) continue;
-    if (env._det[field] === target) {
+    if (env._det[field] === target || env._det[field] === legacyTarget) {
       return ctx.codec.decryptRecord(env);
     }
   }
@@ -899,13 +693,13 @@ async function findByDet(ctx, field, value) {
 }
 async function queryByDet(ctx, field, value) {
   assertDetField(ctx, field, "queryByDet");
-  const target = await detTarget(ctx, field, value);
+  const [target, legacyTarget] = await detTargets(ctx, field, value);
   const ids = await ctx.adapter.list(ctx.vault, ctx.name);
   const matches = [];
   for (const id of ids) {
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env || !env._det) continue;
-    if (env._det[field] === target) {
+    if (env._det[field] === target || env._det[field] === legacyTarget) {
       const rec = await ctx.codec.decryptRecord(env);
       if (rec !== null) matches.push(rec);
     }
@@ -937,44 +731,23 @@ function hasPerRecordKey(env) {
   return env._cek !== void 0;
 }
 function envelopeBodyForHash(env) {
-  if (env._sealed === void 0) return env._data;
-  const sealedKeys = Object.keys(env._sealed).sort();
-  const sealedParts = sealedKeys.map(
-    (k) => `${JSON.stringify(k)}:${JSON.stringify(env._sealed[k])}`
-  );
-  return `{"_data":${JSON.stringify(env._data)},"_sealed":{${sealedParts.join(",")}}}`;
+  if (env._sealed === void 0 && env._vdig === void 0 && env._bidx === void 0) return env._data;
+  const mapPart = (key, map) => {
+    const parts = Object.keys(map).sort().map(
+      (k) => `${JSON.stringify(k)}:${JSON.stringify(map[k])}`
+    );
+    return `${JSON.stringify(key)}:{${parts.join(",")}}`;
+  };
+  const segments = [`"_data":${JSON.stringify(env._data)}`];
+  if (env._sealed !== void 0) segments.push(mapPart("_sealed", env._sealed));
+  if (env._vdig !== void 0) segments.push(mapPart("_vdig", env._vdig));
+  if (env._bidx !== void 0) segments.push(mapPart("_bidx", env._bidx));
+  return `{${segments.join(",")}}`;
 }
 
 export {
-  deriveKey,
-  derivePassphraseKey,
-  generateDEK,
-  wrapKey,
-  unwrapKey,
-  wrapCek,
-  unwrapCek,
-  importCek,
-  encrypt,
-  decrypt,
-  encryptBytes,
-  decryptBytes,
-  sha256Hex,
-  hmacSha256Hex,
-  encryptBytesWithAAD,
-  decryptBytesWithAAD,
-  derivePresenceKey,
-  deriveSealedFieldKey,
-  deriveSealedFieldKeyFromCek,
-  encryptDeterministic,
-  decryptDeterministic,
-  generateIV,
-  generateSalt,
-  bufferToBase64,
-  base64ToBuffer,
   resolveStableCek,
   rewrapBodyToDek,
-  isTombstone,
-  buildTombstone,
   validateSchemaInput,
   validateSchemaOutput,
   RecordCodec,
@@ -989,4 +762,4 @@ export {
   hasPerRecordKey,
   envelopeBodyForHash
 };
-//# sourceMappingURL=chunk-5O3AOPDT.js.map
+//# sourceMappingURL=chunk-OVO2RZAE.js.map