@noy-db/hub 0.3.0-pre.8 → 0.3.0

package/dist/chunk-XDYREZWE.js

@@ -0,0 +1,1128 @@
+import {
+  isDeleteMarker,
+  isTombstone
+} from "./chunk-7DSTRQIJ.js";
+import {
+  blindedEqual,
+  openVdigPayload,
+  sealVdigPayload
+} from "./chunk-HB3RFQSC.js";
+import {
+  dualReadSealedSlot,
+  parseSealedSlot
+} from "./chunk-JKJOGPZN.js";
+import {
+  mintBidxTag
+} from "./chunk-5M5DVGV7.js";
+import {
+  VDIG_ITERATIONS,
+  normalizeForVerify,
+  pbkdf2VerifyDigest
+} from "./chunk-LP7BEXCT.js";
+import {
+  base64ToBuffer,
+  bufferToBase64,
+  decrypt,
+  deriveDeterministicKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  encrypt,
+  encryptDeterministic,
+  generateDEK,
+  generateSalt,
+  unwrapCek,
+  wrapCek
+} from "./chunk-CIE2BASH.js";
+import {
+  NOYDB_FORMAT_VERSION,
+  SealedHandle
+} from "./chunk-JNAI2HN2.js";
+import {
+  ClassifiedConfigError,
+  ClassifiedRotationError,
+  DebugReservedFieldError,
+  RecordCekNotFoundError,
+  SchemaValidationError,
+  TamperedError,
+  ValidationError
+} from "./chunk-BIOUI4HL.js";
+
+// src/kernel/enclave/record-keys/lifecycle.ts
+async function resolveStableCek(deps, id) {
+  const cached = deps.cache?.get(id);
+  if (cached) return cached;
+  const live = await deps.getLive(id);
+  if (live?._cek !== void 0) {
+    const cek = await unwrapCek(live._cek, await deps.getDEK());
+    deps.cache?.set(id, cek, 1);
+    return cek;
+  }
+  const fresh = await generateDEK();
+  deps.cache?.set(id, fresh, 1);
+  return fresh;
+}
+async function rewrapBodyToDek(envelope, fromDek, toDek) {
+  if (envelope._cek !== void 0) {
+    const cek = await unwrapCek(envelope._cek, fromDek);
+    const plaintext2 = await decrypt(envelope._iv, envelope._data, cek);
+    const { iv: iv2, data: data2 } = await encrypt(plaintext2, cek);
+    return { _iv: iv2, _data: data2, _cek: await wrapCek(cek, toDek), cek };
+  }
+  const plaintext = await decrypt(envelope._iv, envelope._data, fromDek);
+  const { iv, data } = await encrypt(plaintext, toDek);
+  return { _iv: iv, _data: data, cek: null };
+}
+function applyRewrappedBody(envelope, body) {
+  const next = {
+    ...envelope,
+    _iv: body._iv,
+    _data: body._data,
+    ...body._cek !== void 0 ? { _cek: body._cek } : {}
+  };
+  if (body._cek === void 0 && envelope._cek !== void 0) {
+    delete next._cek;
+  }
+  return next;
+}
+async function rewrapEnvelope(envelope, fromDek, toDek) {
+  return applyRewrappedBody(envelope, await rewrapBodyToDek(envelope, fromDek, toDek));
+}
+async function isRewrappedUnder(envelope, dek) {
+  try {
+    if (envelope._cek !== void 0) {
+      await unwrapCek(envelope._cek, dek);
+    } else {
+      await decrypt(envelope._iv, envelope._data, dek);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/kernel/enclave/record-keys/sealed-slots.ts
+async function sealOneFieldWithDek(field, value, dek, keyMaterial) {
+  const fieldKey = keyMaterial.cek !== void 0 ? await deriveSealedFieldKeyFromCek(keyMaterial.cek, keyMaterial.collection, field) : await deriveSealedFieldKey(dek, keyMaterial.collection, field);
+  return encrypt(JSON.stringify(value), fieldKey);
+}
+async function sealOneField(field, value, keyMaterial) {
+  const dek = await keyMaterial.getDEK();
+  return sealOneFieldWithDek(field, value, dek, keyMaterial);
+}
+async function sealFields(record, sensitiveFields, keyMaterial) {
+  const dek = await keyMaterial.getDEK();
+  const open = { ...record };
+  const slots = {};
+  for (const field of sensitiveFields) {
+    if (!(field in record)) continue;
+    const value = record[field];
+    if (value === void 0) continue;
+    const { iv, data } = await sealOneFieldWithDek(field, value, dek, keyMaterial);
+    slots[field] = `${iv}:${data}`;
+    delete open[field];
+  }
+  if (Object.keys(slots).length === 0) return { openRecord: record, sealed: void 0 };
+  return { openRecord: open, sealed: slots };
+}
+async function unsealOneField(field, blob, keyMaterial) {
+  const dek = await keyMaterial.getDEK();
+  return JSON.parse(await dualReadSealedSlot(blob, field, keyMaterial.collection, keyMaterial.cek, dek));
+}
+function makeHandleProducer(keyMaterial) {
+  return (field, blob) => new SealedHandle(() => unsealOneField(field, blob, keyMaterial));
+}
+async function unsealFields(record, sealed, keyMaterial, opts) {
+  const makeHandle = opts?.asHandles === true ? makeHandleProducer(keyMaterial) : void 0;
+  for (const [field, blob] of Object.entries(sealed)) {
+    record[field] = makeHandle !== void 0 ? makeHandle(field, blob) : await unsealOneField(field, blob, keyMaterial);
+  }
+  return record;
+}
+function makeSealedSlotCapability(ctx, recordId, cek) {
+  const keyMaterial = {
+    collection: ctx.name,
+    ...cek !== void 0 ? { cek } : {},
+    getDEK: () => ctx.getDEK()
+  };
+  const deletedFields = /* @__PURE__ */ new Set();
+  return {
+    async seal(field, plaintext) {
+      const ref = await sealOneField(field, plaintext, keyMaterial);
+      deletedFields.delete(field);
+      return ref;
+    },
+    async unseal(field, ref) {
+      if (deletedFields.has(field)) {
+        throw new ValidationError(`sealedSlots.unseal: field "${field}" on record "${recordId}" was deleted from this capability`);
+      }
+      return unsealOneField(field, `${ref.iv}:${ref.data}`, keyMaterial);
+    },
+    async delete(field) {
+      deletedFields.add(field);
+    }
+  };
+}
+function makeReservedEnvelopes(dekResolver, declaredPrefixes) {
+  const declared = new Set(declaredPrefixes);
+  return (prefix) => {
+    if (!declared.has(prefix)) {
+      throw new ValidationError(`reservedEnvelopes: prefix "${prefix}" is not declared by this binding's reservedPrefixes`);
+    }
+    const assertPrefixed = (collection, method) => {
+      if (!collection.startsWith(prefix)) {
+        throw new ValidationError(
+          `reservedEnvelopes('${prefix}').${method}: collection "${collection}" does not start with "${prefix}"`
+        );
+      }
+    };
+    const encryptForPrefix = async (collection, json, v) => {
+      assertPrefixed(collection, "encrypt");
+      const dek = await dekResolver(collection);
+      const { iv, data } = await encrypt(json, dek);
+      return {
+        _noydb: NOYDB_FORMAT_VERSION,
+        _v: v,
+        _ts: (/* @__PURE__ */ new Date()).toISOString(),
+        _iv: iv,
+        _data: data
+      };
+    };
+    const decryptForPrefix = async (collection, env) => {
+      assertPrefixed(collection, "decrypt");
+      const dek = await dekResolver(collection);
+      return decrypt(env._iv, env._data, dek);
+    };
+    return { encrypt: encryptForPrefix, decrypt: decryptForPrefix };
+  };
+}
+
+// src/kernel/enclave/classify/write.ts
+async function mintVdigSlot(rawValue, policy, prevBlob, cek, collection, recordId, field) {
+  const normalized = normalizeForVerify(policy.normalize, rawValue);
+  let prev = null;
+  if (prevBlob !== void 0) {
+    try {
+      prev = await openVdigPayload(prevBlob, cek, collection, recordId, field);
+    } catch {
+      throw new TamperedError();
+    }
+    if (!Number.isInteger(prev.iter) || prev.iter < 1) {
+      throw new TamperedError();
+    }
+  }
+  if (prev !== null && policy.notLastN > 0) {
+    const history = [prev.cur, ...prev.ring ?? []];
+    for (const entry of history) {
+      const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(entry.salt), prev.iter);
+      if (await blindedEqual(digest, base64ToBuffer(entry.hash))) {
+        throw new ClassifiedRotationError(collection, field, "password was used recently");
+      }
+    }
+  }
+  const salt = generateSalt();
+  const hash = await pbkdf2VerifyDigest(normalized, salt, VDIG_ITERATIONS);
+  const ring = prev !== null && policy.notLastN > 0 ? [...prev.ring ?? [], { salt: prev.cur.salt, hash: prev.cur.hash }].slice(-policy.notLastN) : void 0;
+  const payload = {
+    v: 1,
+    alg: "PBKDF2-SHA256",
+    iter: VDIG_ITERATIONS,
+    cur: { salt: bufferToBase64(salt), hash: bufferToBase64(hash), at: (/* @__PURE__ */ new Date()).toISOString() },
+    ...ring !== void 0 && ring.length > 0 ? { ring } : {}
+  };
+  return sealVdigPayload(payload, cek, collection, recordId, field);
+}
+
+// src/kernel/schema.ts
+async function validateSchemaInput(schema, value, context) {
+  const result = await schema["~standard"].validate(value);
+  if (result.issues !== void 0 && result.issues.length > 0) {
+    throw new SchemaValidationError(
+      `Schema validation failed on ${context}: ${summarizeIssues(result.issues)}`,
+      result.issues,
+      "input"
+    );
+  }
+  return result.value;
+}
+async function validateSchemaOutput(schema, value, context) {
+  const result = await schema["~standard"].validate(value);
+  if (result.issues !== void 0 && result.issues.length > 0) {
+    throw new SchemaValidationError(
+      `Stored data for ${context} does not match the current schema \u2014 schema drift? ${summarizeIssues(result.issues)}`,
+      result.issues,
+      "output"
+    );
+  }
+  return result.value;
+}
+function summarizeIssues(issues) {
+  const shown = issues.slice(0, 3).map((issue) => {
+    const pathStr = formatPath(issue.path);
+    return `${pathStr}: ${issue.message}`;
+  });
+  const suffix = issues.length > 3 ? ` (+${issues.length - 3} more)` : "";
+  return shown.join("; ") + suffix;
+}
+function formatPath(path) {
+  if (!path || path.length === 0) return "root";
+  return path.map(
+    (segment) => typeof segment === "object" && segment !== null ? String(segment.key) : String(segment)
+  ).join(".");
+}
+
+// src/kernel/enclave/record-keys/record-codec.ts
+var RecordCodec = class _RecordCodec {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  /**
+   * @internal Update the live Via pipeline this codec's at-rest hooks read
+   * (#638 Task 3) — called by `via/graph-wiring.ts#applyTaintOverlay` right
+   * after it reassigns `Collection.via`, so `hasAtRestHooks`/`encodeAtRest`/
+   * `decodeAtRest` see the newly-added `taint` binding instead of the
+   * pipeline snapshot captured when this codec was constructed.
+   */
+  setVia(via) {
+    this.ctx.via = via;
+  }
+  /** Sealed-slot key material for this codec's collection, for a given per-record CEK (or none). */
+  sealKeyMaterial(cek) {
+    return {
+      collection: this.ctx.name,
+      ...cek !== void 0 ? { cek } : {},
+      getDEK: () => this.ctx.getDEK()
+    };
+  }
+  /**
+   * Build the `ViaCryptoCtx` handed to a binding's `encodeAtRest`/
+   * `decodeAtRest` hook: `sealedSlots` pre-bound to `(this.ctx.name,
+   * recordId)` — always threading `cek` when the caller has one, so the
+   * capability's record-binding stays cryptographic rather than degrading
+   * to collection-scope. `reservedEnvelopes`'s DEK resolver forwards its
+   * `collection` argument straight to `this.ctx.getDEK` (#629 Task 4) — it
+   * resolves the RESERVED collection's own DEK (e.g. `_dict_status`), never
+   * `this.ctx.name`'s, matching `Vault.getDEK`'s per-collection-name
+   * resolution (the same resolver `DictionaryHandle` used pre-cutover).
+   */
+  viaCryptoCtx(recordId, cek) {
+    const declaredPrefixes = this.ctx.via?.bindings.flatMap((b) => b.reservedPrefixes ?? []) ?? [];
+    return {
+      sealedSlots: makeSealedSlotCapability(this.ctx, recordId, cek),
+      reservedEnvelopes: makeReservedEnvelopes((collection) => this.ctx.getDEK(collection), declaredPrefixes)
+    };
+  }
+  // ──────────────────────────────────────────────────────────────────────
+  // Low-level literal builders
+  // ──────────────────────────────────────────────────────────────────────
+  /**
+   * Assemble a canonical ciphertext body envelope literal from already-computed
+   * parts. Pure, no crypto. Each call stamps its own `_ts` — provenance carries
+   * a SEPARATE timestamp (computed by the caller), so the two never share one.
+   */
+  static buildEnvelope(p) {
+    return {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: p.version,
+      _ts: (/* @__PURE__ */ new Date()).toISOString(),
+      _iv: p.iv,
+      _data: p.data,
+      ...p.by !== void 0 ? { _by: p.by } : {},
+      ...p.cek !== void 0 ? { _cek: p.cek } : {},
+      ...p.provenance !== void 0 ? { _source: p.provenance.source, _sourceTs: p.provenance.sourceTs } : {},
+      ...p.extra ?? {}
+    };
+  }
+  /** Plaintext (`_iv:''`) body envelope — the `!storeCiphertext` shape. */
+  static buildPlaintextEnvelope(p) {
+    return {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: p.version,
+      _ts: (/* @__PURE__ */ new Date()).toISOString(),
+      _iv: "",
+      _data: p.data,
+      ...p.by !== void 0 ? { _by: p.by } : {},
+      ...p.provenance !== void 0 ? { _source: p.provenance.source, _sourceTs: p.provenance.sourceTs } : {}
+    };
+  }
+  // ──────────────────────────────────────────────────────────────────────
+  // Write path
+  // ──────────────────────────────────────────────────────────────────────
+  /**
+   * Build a debug-plaintext envelope: the record's own fields inlined as
+   * top-level keys beside the reserved `_`-metadata, with `_debug: 1` and an
+   * empty `_data`. Lets native store tooling read the record without
+   * unwrapping. Only reached for user collections under `debugPlaintext`
+   * (see {@link encryptRecord}). Rejects `_`-prefixed record fields, which
+   * would collide with the reserved metadata namespace.
+   */
+  buildDebugEnvelope(record, version, source, sourceTs) {
+    const rec = record;
+    for (const key of Object.keys(rec)) {
+      if (key.startsWith("_")) throw new DebugReservedFieldError(this.ctx.name, key);
+    }
+    return {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: version,
+      _ts: (/* @__PURE__ */ new Date()).toISOString(),
+      _iv: "",
+      _data: "",
+      _by: this.ctx.actor,
+      _debug: NOYDB_FORMAT_VERSION,
+      ...this.ctx.provenance && source !== void 0 ? { _source: source, _sourceTs: sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : {},
+      ...rec
+    };
+  }
+  /**
+   * Encrypt a JSON body into an envelope.
+   *
+   * When `cek` is supplied (per-record CEK collections), the body is
+   * encrypted under the CEK and the CEK is AES-KW-wrapped under the
+   * collection DEK and stamped on `_cek`. When `cek` is omitted, the legacy
+   * path encrypts the body directly under the collection DEK — byte-identical
+   * to pre-CEK behaviour, so non-adopting collections pay nothing.
+   */
+  async encryptJsonString(json, version, cek, source, sourceTs) {
+    const by = this.ctx.actor;
+    const provenance = this.ctx.provenance && source !== void 0 ? { source, sourceTs: sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : void 0;
+    if (!this.ctx.storeCiphertext) {
+      return _RecordCodec.buildPlaintextEnvelope({ version, data: json, by, provenance });
+    }
+    const dek = await this.ctx.getDEK();
+    if (cek !== void 0) {
+      const { iv: iv2, data: data2 } = await encrypt(json, cek);
+      const wrapped = await wrapCek(cek, dek);
+      return _RecordCodec.buildEnvelope({ version, iv: iv2, data: data2, by, cek: wrapped, provenance });
+    }
+    const { iv, data } = await encrypt(json, dek);
+    return _RecordCodec.buildEnvelope({ version, iv, data, by, provenance });
+  }
+  async encryptRecord(record, version, cek, source, sourceTs, vdig, id) {
+    if (!this.ctx.storeCiphertext && this.ctx.debugPlaintext && !this.ctx.name.startsWith("_")) {
+      return this.buildDebugEnvelope(record, version, source, sourceTs);
+    }
+    if (this.ctx.storeCiphertext) {
+      const declared = this.ctx.vdigFields;
+      const storedClassified = /* @__PURE__ */ new Set();
+      if (vdig?.prev?._vdig) for (const k of Object.keys(vdig.prev._vdig)) storedClassified.add(k);
+      if (vdig?.prev?._bidx) for (const k of Object.keys(vdig.prev._bidx)) storedClassified.add(k);
+      if (this.ctx.classifiedMarkerDigestOnly !== void 0) {
+        for (const k of await this.ctx.classifiedMarkerDigestOnly()) storedClassified.add(k);
+      }
+      let undeclared;
+      for (const field of storedClassified) {
+        if (declared === null || !declared.has(field)) {
+          undeclared = field;
+          break;
+        }
+      }
+      if (undeclared !== void 0) {
+        throw new ClassifiedConfigError(
+          this.ctx.name,
+          `this collection has classified digest-only field "${undeclared}" but this handle does not declare it \u2014 refusing to write (would drop its tag or serialize the secret as plaintext)`
+        );
+      }
+    }
+    let openRecord = record;
+    let sealed;
+    if (this.ctx.storeCiphertext && this.ctx.via?.hasAtRestHooks) {
+      if (id === void 0) {
+        throw new Error(
+          `RecordCodec.encryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this write path supplied no record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
+        );
+      }
+      const src = record;
+      const result = await this.ctx.via.encodeAtRest(src, this.viaCryptoCtx(id, cek));
+      openRecord = result.record;
+      if (result.sealed !== void 0) {
+        sealed = {};
+        for (const [field, ref] of Object.entries(result.sealed)) sealed[field] = `${ref.iv}:${ref.data}`;
+      }
+    } else if (this.ctx.storeCiphertext && this.ctx.sensitiveFields.size > 0) {
+      const src = record;
+      const result = await sealFields(src, this.ctx.sensitiveFields, this.sealKeyMaterial(cek));
+      if (result.sealed !== void 0) {
+        sealed = result.sealed;
+        openRecord = result.openRecord;
+      }
+    }
+    let vdigOut;
+    let bidxOutMap;
+    if (this.ctx.vdigFields !== null && this.ctx.vdigFields.size > 0 && this.ctx.storeCiphertext) {
+      if (vdig === void 0) {
+        throw new Error(
+          `RecordCodec.encryptRecord: collection "${this.ctx.name}" declares digest-only classified fields but this write path supplied no { id, prev } context \u2014 it would silently destroy _vdig (C6). Caller bug.`
+        );
+      }
+      if (cek === void 0) {
+        throw new Error(
+          `RecordCodec.encryptRecord: digest-only fields require a per-record CEK (R1 invariant) \u2014 collection "${this.ctx.name}" wrote without one. Caller bug.`
+        );
+      }
+      const open = { ...openRecord };
+      const out = {};
+      const bidxOut = {};
+      let bidxDek;
+      for (const [field, policy] of this.ctx.vdigFields) {
+        const value = open[field];
+        const prevBlob = vdig.prev?._vdig?.[field];
+        if (vdig.prev?._sealed?.[field] !== void 0) {
+          throw new ClassifiedConfigError(
+            this.ctx.name,
+            `field "${field}" carries a recoverable _sealed slot from a previous storage form \u2014 recoverable \u2194 digest-only transitions are refused (R6); migrate explicitly`
+          );
+        }
+        if (value === void 0) {
+          if (prevBlob !== void 0) {
+            out[field] = prevBlob;
+            const prevTag = vdig.prev?._bidx?.[field];
+            if (prevTag !== void 0) bidxOut[field] = prevTag;
+          }
+          continue;
+        }
+        if (value === null) {
+          delete open[field];
+          continue;
+        }
+        if (typeof value !== "string") {
+          throw new ValidationError(
+            `digest-only classified field "${field}" in "${this.ctx.name}" must be a string (rotate) or null (clear), got ${typeof value}`
+          );
+        }
+        out[field] = await mintVdigSlot(value, policy, prevBlob, cek, this.ctx.name, vdig.id, field);
+        if (policy.equatable === true) {
+          if (bidxDek === void 0) bidxDek = await this.ctx.getDEK();
+          const normalized = normalizeForVerify(policy.normalize, value);
+          bidxOut[field] = await mintBidxTag(normalized, bidxDek, this.ctx.name, field);
+        }
+        delete open[field];
+      }
+      openRecord = open;
+      if (Object.keys(out).length > 0) vdigOut = out;
+      if (Object.keys(bidxOut).length > 0) bidxOutMap = bidxOut;
+    }
+    const base = await this.encryptJsonString(JSON.stringify(openRecord), version, cek, source, sourceTs);
+    const withSealed = sealed ? { ...base, _sealed: sealed } : base;
+    const withVdig = vdigOut ? { ...withSealed, _vdig: vdigOut } : withSealed;
+    const withBidx = bidxOutMap ? { ...withVdig, _bidx: bidxOutMap } : withVdig;
+    if (!this.ctx.deterministicFields || !this.ctx.storeCiphertext) return withBidx;
+    const dek = await this.ctx.getDEK();
+    const detKey = await deriveDeterministicKey(dek);
+    const rec = record;
+    const det = {};
+    for (const field of this.ctx.deterministicFields) {
+      if (this.ctx.sensitiveFields.has(field)) continue;
+      if (this.ctx.vdigFields?.has(field)) continue;
+      const value = rec[field];
+      if (value === void 0 || value === null) continue;
+      const plaintext = typeof value === "string" ? value : JSON.stringify(value);
+      const { iv, data } = await encryptDeterministic(plaintext, detKey, `${this.ctx.name}/${field}`);
+      det[field] = `${iv}:${data}`;
+    }
+    if (Object.keys(det).length === 0) return withBidx;
+    return { ...withBidx, _det: det };
+  }
+  // ──────────────────────────────────────────────────────────────────────
+  // Read path
+  // ──────────────────────────────────────────────────────────────────────
+  /**
+   * Resolve the per-record CEK for a stored envelope, or `undefined` for a
+   * legacy (`_cek`-absent) envelope. Unwraps `_cek` under the collection DEK and
+   * memoises it in the CEK cache under `id` (when supplied) so repeated reads of
+   * the same record skip the unwrap. Shared by the body-decrypt path
+   * ({@link decryptJsonString}) and the sealed-field path ({@link decryptRecord}
+   * / {@link toCacheRecord}) so both agree on the record's key.
+   */
+  async resolveEnvelopeCek(envelope, id) {
+    if (envelope._cek === void 0) return void 0;
+    const cached = id !== void 0 ? this.ctx.cekCache?.get(id) : void 0;
+    if (cached !== void 0) return cached;
+    const dek = await this.ctx.getDEK();
+    const cek = await unwrapCek(envelope._cek, dek);
+    if (id !== void 0) this.ctx.cekCache?.set(id, cek, 1);
+    return cek;
+  }
+  /**
+   * Low-level: decrypt an envelope and return the raw JSON string.
+   *
+   * `_cek` presence is the format discriminant (NOT `this.perRecordCek`),
+   * so a mixed vault — and a recipient that never opted into
+   * `perRecordKeys` — decrypts both legacy and CEK records:
+   *  - `_cek` present → unwrap the CEK under the collection DEK, decrypt the
+   *    body under the CEK (cache the unwrapped CEK so repeated reads skip it).
+   *  - `_cek` absent → legacy path, body decrypts directly under the
+   *    collection DEK.
+   *
+   * The optional `id` lets reads populate the CEK cache; it is omitted by
+   * callers (history, conflict merge) that have only the envelope.
+   */
+  async decryptJsonString(envelope, id) {
+    if (isTombstone(envelope, this.ctx.storeCiphertext) || isDeleteMarker(envelope)) return null;
+    if (!this.ctx.storeCiphertext) {
+      if (envelope._debug !== void 0) {
+        const rec = {};
+        for (const [key, value] of Object.entries(envelope)) {
+          if (!key.startsWith("_")) rec[key] = value;
+        }
+        return JSON.stringify(rec);
+      }
+      return envelope._data === "" ? null : envelope._data;
+    }
+    const cek = await this.resolveEnvelopeCek(envelope, id);
+    if (cek !== void 0) return decrypt(envelope._iv, envelope._data, cek);
+    const dek = await this.ctx.getDEK();
+    return decrypt(envelope._iv, envelope._data, dek);
+  }
+  /**
+   * Unseal a single `_sealed[field]` slot to its plaintext value: derive the
+   * per-field key off the collection DEK, AES-GCM-decrypt the `iv:data` blob,
+   * and JSON-parse the result. Shared by both the inline-decrypt path and a
+   * {@link Sealed} handle's `reveal()` — so the on-demand reveal and the eager
+   * materialisation always agree byte-for-byte.
+   */
+  async unsealField(field, blob, cek) {
+    return unsealOneField(field, blob, this.sealKeyMaterial(cek));
+  }
+  /**
+   * Build the `ViaCryptoCtx` for forget()'s per-ref via-erase fold (#629
+   * Task 10) — resolves the live envelope's CEK exactly like
+   * `decryptRecord` does, then delegates to the same capability factory
+   * `encodeAtRest`/`decodeAtRest` use.
+   */
+  async eraseCryptoCtx(id, live) {
+    return this.viaCryptoCtx(id, await this.resolveEnvelopeCek(live, id));
+  }
+  /**
+   * Classify a live envelope's `_sealed` slots for crypto-shred completeness.
+   * `forget()` drops `_cek`/`_sealed` but
+   * RETAINS the collection DEK, so only a slot keyed off the per-record CEK is
+   * genuinely shredded by the tombstone; a legacy slot keyed off the
+   * collection DEK survives in any synced/backup copy.
+   *
+   * Mirrors {@link unsealField}'s dual-read split: try the CEK-derived key per
+   * slot — success → `shreddable`, AES-GCM auth failure → `dekResidue`. With no
+   * `_cek` (pure legacy collection-DEK sealing) ALL slots are residue.
+   */
+  async classifySealedShred(live) {
+    const slots = [];
+    if (live._vdig !== void 0 && live._cek !== void 0) {
+      for (const field of Object.keys(live._vdig)) {
+        slots.push({
+          field,
+          class: live._bidx?.[field] !== void 0 ? "live-shreddable+dekResidue-in-backups" : "shreddable"
+        });
+      }
+    }
+    const sealed = live._sealed;
+    if (sealed === void 0) return { slots };
+    const cek = await this.resolveEnvelopeCek(live);
+    for (const [field, blob] of Object.entries(sealed)) {
+      if (cek === void 0) {
+        slots.push({ field, class: "dekResidue" });
+        continue;
+      }
+      const { iv, data } = parseSealedSlot(blob);
+      try {
+        await decrypt(iv, data, await deriveSealedFieldKeyFromCek(cek, this.ctx.name, field));
+        slots.push({ field, class: "shreddable" });
+      } catch {
+        slots.push({ field, class: "dekResidue" });
+      }
+    }
+    return { slots };
+  }
+  /**
+   * Build a non-leaking {@link Sealed} handle over a sealed field's ciphertext.
+   * The handle captures only the ciphertext `blob` and a closure to
+   * {@link unsealField}; the plaintext is never stored on it — so the handle
+   * may sit in the working-set cache (or be logged/serialised) without
+   * exposing the value, which decrypts only on `reveal()`.
+   */
+  makeSealedHandle(field, blob, cek) {
+    return makeHandleProducer(this.sealKeyMaterial(cek))(field, blob);
+  }
+  /**
+   * Replace every field the just-written envelope actually sealed with a
+   * {@link Sealed} handle, leaving every other field as its plaintext value.
+   * Used to populate the cache on the write path without ever materialising
+   * sealed plaintext into it. Returns `record` untouched when nothing was
+   * sealed. Keys off `envelope._sealed` itself (#642 fix) — NOT
+   * `this.ctx.sensitiveFields`, which only names the inline `sensitive:[...]`/
+   * classified-recoverable field set: a collection whose sealing comes
+   * entirely from the `taint` via-binding (a derivation/MV output or rollup
+   * target folded sealed from a classified SOURCE collection, #642) declares
+   * no local `sensitiveFields` at all, so that stale gate skipped this
+   * conversion and left a just-written taint-sealed field as cached
+   * plaintext — read back correctly ONLY after a cold cache miss (`get()`'s
+   * own `decodeAtRest` call, unaffected by this gate) forced a fresh decrypt.
+   */
+  async toCacheRecord(record, envelope, id) {
+    const sealed = envelope._sealed;
+    if (sealed === void 0 || !this.ctx.storeCiphertext) {
+      return record;
+    }
+    const cek = await this.resolveEnvelopeCek(envelope, id);
+    const clone = { ...record };
+    for (const [field, blob] of Object.entries(sealed)) {
+      clone[field] = this.makeSealedHandle(field, blob, cek);
+    }
+    return clone;
+  }
+  /**
+   * Apply `_sealed`-slot post-processing to an ALREADY-DECRYPTED `record`:
+   * restore each `_sealed[field]` blob inline (`sealedAsHandles` falsy) or
+   * as an opaque {@link Sealed} handle (`sealedAsHandles: true`), routing
+   * through a via pipeline's `decodeAtRest` hook when one is declared.
+   * Extracted byte-parity from `decryptRecord`'s inline block (#635) so a
+   * caller that resolves its OWN per-record CEK under a DIFFERENT DEK than
+   * this codec's `this.ctx.getDEK()` — namely the tier>0 `getAtTier` leg in
+   * `with-audit/tiers/index.ts`, whose `_cek` is wrapped under the TIER DEK,
+   * not the collection DEK `decryptRecord`/`resolveEnvelopeCek` always
+   * unwrap under — can still get correct sealed-slot handling without
+   * routing its whole read through `decryptRecord` (which would resolve the
+   * wrong DEK for it).
+   *
+   * Zero-knowledge: takes only the already-resolved per-record `cek` (or
+   * `undefined` for a legacy/no-CEK record) — the same shape `makeSealedHandle`
+   * already takes above. Never the keyring, never a raw DEK: the legacy
+   * fallback key stays fully internal to `sealKeyMaterial`/`viaCryptoCtx`,
+   * which close over THIS codec's own `getDEK` (permanently bound to
+   * `this.ctx.name`'s tier-0 DEK at construction) — so even when called from
+   * a tier>0 context, the legacy-fallback key resolution is correct: sealed
+   * fields are always sealed under the CEK or the collection's tier-0 DEK,
+   * never a tier DEK (tier writes don't seal fields; `_sealed` reaches a
+   * tiered envelope only via a tier-0 write later elevated).
+   */
+  async applySealedSlots(record, sealed, cek, opts = {}) {
+    if (this.ctx.via?.hasAtRestHooks) {
+      if (opts.id === void 0) {
+        throw new Error(
+          `RecordCodec.decryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this read path supplied no record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
+        );
+      }
+      const sealedRefs = {};
+      for (const [field, blob] of Object.entries(sealed)) {
+        const { iv, data } = parseSealedSlot(blob);
+        sealedRefs[field] = { iv, data };
+      }
+      return await this.ctx.via.decodeAtRest(
+        record,
+        sealedRefs,
+        this.viaCryptoCtx(opts.id, cek),
+        { asHandles: opts.sealedAsHandles === true }
+      );
+    }
+    return await unsealFields(
+      record,
+      sealed,
+      this.sealKeyMaterial(cek),
+      { asHandles: opts.sealedAsHandles === true }
+    );
+  }
+  /**
+   * Decrypt an envelope under an EXPLICIT `dek` instead of this codec's own
+   * `ctx.getDEK()` / cekCache resolution — for a from-tier>0 pre-move decode
+   * (`with-audit/tiers/index.ts`'s `putAtTier`/`elevate`/`demote` sites,
+   * #722 whole-branch review). Mirrors the manual unwrap-then-decrypt
+   * `getAtTier`'s own tier>0 leg performs there (same primitives, same
+   * `applySealedSlots` extraction point #635 built for exactly this caller).
+   *
+   * `decryptRecord` is tier-UNAWARE: `resolveEnvelopeCek` reads the cekCache
+   * or falls back to `ctx.getDEK()` — this codec's DEFAULT (tier-0/
+   * collection) DEK — never the envelope's OWN tier. That only happens to
+   * decrypt a from-tier>0 envelope correctly when some other call in the
+   * SAME op already primed the cekCache with this record's CEK (true for an
+   * ordinary put()-then-elevate(0→1); NOT true for a `putAtTier`-origin
+   * envelope, whose body is encrypted directly under its tier DEK with no
+   * `_cek` ever minted, or a non-`perRecordKeys` collection, which has no
+   * `_cek` at all) — those throw `TamperedError`. Decrypting under the
+   * caller-resolved `dek` is correct regardless of cache state or
+   * `perRecordKeys`.
+   *
+   * No CRDT resolution, no schema validation — same scope as `getAtTier`'s
+   * tier>0 branch (the established precedent for a tier-aware read), which
+   * skips both for the same reason: a tier>0 read is an internal/derived-
+   * output-recompute path, not the public per-record read surface schema
+   * validation guards.
+   */
+  async decryptRecordAtDek(envelope, dek, id) {
+    if (isTombstone(envelope, this.ctx.storeCiphertext) || isDeleteMarker(envelope)) return null;
+    let plaintext;
+    let cek;
+    if (envelope._cek !== void 0) {
+      cek = await unwrapCek(envelope._cek, dek);
+      plaintext = await decrypt(envelope._iv, envelope._data, cek);
+    } else {
+      plaintext = await decrypt(envelope._iv, envelope._data, dek);
+    }
+    let record = JSON.parse(plaintext);
+    if (envelope._sealed !== void 0 && this.ctx.storeCiphertext) {
+      record = await this.applySealedSlots(record, envelope._sealed, cek, { ...id !== void 0 ? { id } : {}, sealedAsHandles: true });
+    }
+    return record;
+  }
+  /**
+   * Decrypt an envelope into a record of type `T`.
+   *
+   * When a schema is attached, the decrypted value is validated before
+   * being returned. A divergence between the stored bytes and the
+   * current schema throws `SchemaValidationError` with
+   * `direction: 'output'` — silently returning drifted data would
+   * propagate garbage into the UI and break the whole point of having
+   * a schema.
+   *
+   * `skipValidation` exists for history reads: when calling
+   * `getVersion()` the caller is explicitly asking for an old snapshot
+   * that may predate a schema change, so validating it would be a
+   * false positive. Every non-history read leaves this flag `false`.
+   */
+  async decryptRecord(envelope, opts = {}) {
+    const json = await this.decryptJsonString(envelope, opts.id);
+    if (json === null) return null;
+    let parsed = JSON.parse(json);
+    if (this.ctx.crdtMode && parsed !== null && typeof parsed === "object" && "_crdt" in parsed) {
+      parsed = this.ctx.crdtStrategy.resolveCrdtSnapshot(parsed);
+    }
+    let record = parsed;
+    if (envelope._sealed !== void 0 && this.ctx.storeCiphertext) {
+      const sealedCek = await this.resolveEnvelopeCek(envelope, opts.id);
+      record = await this.applySealedSlots(record, envelope._sealed, sealedCek, {
+        ...opts.id !== void 0 ? { id: opts.id } : {},
+        ...opts.sealedAsHandles !== void 0 ? { sealedAsHandles: opts.sealedAsHandles } : {}
+      });
+    }
+    const sealedAsHandles = opts.sealedAsHandles === true && envelope._sealed !== void 0;
+    if (this.ctx.schema !== void 0 && !opts.skipValidation && !sealedAsHandles) {
+      record = await validateSchemaOutput(
+        this.ctx.schema,
+        record,
+        `${this.ctx.name}@v${envelope._v}`
+      );
+    }
+    return record;
+  }
+};
+
+// src/kernel/enclave/record-keys/sealing.ts
+var subtle = globalThis.crypto.subtle;
+var SEALED_CEK_NS = "_sealed_cek";
+async function sealRecordToHost(ctx, collection, id, hostSealer, opts) {
+  if (collection.includes("/")) throw new ValidationError(`sealRecordToHost: collection "${collection}" must not contain "/"`);
+  if (id.includes("/")) throw new ValidationError(`sealRecordToHost: id "${id}" must not contain "/"`);
+  if (Number.isNaN(Date.parse(opts.expiresAt))) {
+    throw new ValidationError(`sealRecordToHost: expiresAt "${opts.expiresAt}" is not a valid ISO 8601 timestamp`);
+  }
+  const live = await ctx.adapter.get(ctx.vault, collection, id);
+  if (!live || live._cek === void 0) {
+    throw new RecordCekNotFoundError(collection, id);
+  }
+  const dek = await ctx.getDEK(collection);
+  const cek = await unwrapCek(live._cek, dek);
+  const rawCek = await subtle.exportKey("raw", cek);
+  const cekB64 = bufferToBase64(rawCek);
+  const hint = await hostSealer.publishRecipientHint();
+  if (hint.pid.includes("/")) throw new ValidationError(`sealRecordToHost: recipient pid "${hint.pid}" must not contain "/"`);
+  const binding = {
+    collection,
+    id,
+    cek: cekB64,
+    expiresAt: opts.expiresAt
+  };
+  const sealed = await hostSealer.sealForRecipient(
+    new TextEncoder().encode(JSON.stringify(binding)),
+    hint
+  );
+  const delivery = {
+    v: 1,
+    _noydb_sealed_cek: 1,
+    pid: hint.pid,
+    payload: bufferToBase64(sealed),
+    expiresAt: opts.expiresAt
+  };
+  const envelopeKey = `${collection}/${id}/${hint.pid}`;
+  const prior = await ctx.adapter.get(ctx.vault, SEALED_CEK_NS, envelopeKey);
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: (prior?._v ?? 0) + 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    // AES-GCM bypassed — the sealing layer is the security boundary, exactly
+    // like the managed-passphrase `_meta/sealed-passphrase` envelope.
+    _iv: "",
+    _data: JSON.stringify(delivery),
+    ...ctx.actor ? { _by: ctx.actor } : {}
+  };
+  await ctx.adapter.put(ctx.vault, SEALED_CEK_NS, envelopeKey, env);
+  return { pid: hint.pid, envelopeKey };
+}
+async function revokeSealedRecord(ctx, collection, id, pid, opts) {
+  if (opts?.hard === true) {
+    await rotateRecordCek(ctx, collection, id);
+    return;
+  }
+  await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, `${collection}/${id}/${pid}`);
+}
+async function rotateRecordCek(ctx, collection, id) {
+  const live = await ctx.adapter.get(ctx.vault, collection, id);
+  if (!live || live._cek === void 0) {
+    throw new RecordCekNotFoundError(collection, id);
+  }
+  const dek = await ctx.getDEK(collection);
+  const oldCek = await unwrapCek(live._cek, dek);
+  const json = await decrypt(live._iv, live._data, oldCek);
+  const newCek = await generateDEK();
+  const { iv, data } = await encrypt(json, newCek);
+  let sealedOut;
+  if (live._sealed !== void 0) {
+    const out = {};
+    for (const [field, slot] of Object.entries(live._sealed)) {
+      const plaintext = await dualReadSealedSlot(slot, field, collection, oldCek, dek);
+      const resealed = await encrypt(plaintext, await deriveSealedFieldKeyFromCek(newCek, collection, field));
+      out[field] = `${resealed.iv}:${resealed.data}`;
+    }
+    sealedOut = out;
+  }
+  let vdigOut;
+  if (live._vdig !== void 0) {
+    const out = {};
+    for (const [field, blob] of Object.entries(live._vdig)) {
+      const payload = await openVdigPayload(blob, oldCek, collection, id, field);
+      out[field] = await sealVdigPayload(payload, newCek, collection, id, field);
+    }
+    vdigOut = out;
+  }
+  const env = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: live._v + 1,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: iv,
+    _data: data,
+    _cek: await wrapCek(newCek, dek),
+    ...ctx.actor ? { _by: ctx.actor } : {},
+    ...live._tier !== void 0 ? { _tier: live._tier } : {},
+    ...live._det !== void 0 ? { _det: live._det } : {},
+    // `_bidx` (equality-index tag) is DEK-rooted and CEK-independent, so it is
+    // carried forward VERBATIM — not recomputed — unlike `_vdig`/`_sealed`
+    // below, which are CEK-bound and must be re-sealed under the new CEK.
+    // Dropping this line would silently orphan the equality index on rotation
+    // (the #306 Slice-A data-loss bug, replayed on the index).
+    ...live._bidx !== void 0 ? { _bidx: live._bidx } : {},
+    // Re-encrypt sealed (`sensitive`) fields under the new CEK. Sealed
+    // keys derive off the per-record CEK, so the rotated record's old CEK is
+    // destroyed here — carrying the old `_sealed` slots forward verbatim would
+    // orphan them (unreadable under the new CEK). `sealedOut` holds the slots
+    // dual-read from the old CEK (or the legacy DEK) and re-sealed under newCek.
+    ...sealedOut !== void 0 ? { _sealed: sealedOut } : {},
+    ...vdigOut !== void 0 ? { _vdig: vdigOut } : {}
+  };
+  await ctx.adapter.put(ctx.vault, collection, id, env);
+  await ctx.invalidateRecordCaches(collection, id);
+  const prefix = `${collection}/${id}/`;
+  const keys = await ctx.adapter.list(ctx.vault, SEALED_CEK_NS);
+  for (const key of keys) {
+    if (key.startsWith(prefix)) {
+      await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, key);
+    }
+  }
+}
+
+// src/kernel/enclave/record-keys/deterministic.ts
+async function detTargets(ctx, field, value) {
+  const dek = await ctx.getDEK();
+  const detKey = await deriveDeterministicKey(dek);
+  const plaintext = typeof value === "string" ? value : JSON.stringify(value);
+  const context = `${ctx.name}/${field}`;
+  const [current, legacy] = await Promise.all([
+    encryptDeterministic(plaintext, detKey, context),
+    encryptDeterministic(plaintext, dek, context)
+  ]);
+  return [`${current.iv}:${current.data}`, `${legacy.iv}:${legacy.data}`];
+}
+function assertDetField(ctx, field, method) {
+  if (!ctx.deterministicFields || !ctx.deterministicFields.has(field)) {
+    throw new Error(
+      `Collection "${ctx.name}": field "${field}" is not declared in deterministicFields`
+    );
+  }
+  if (!ctx.storeCiphertext) {
+    throw new Error(
+      `Collection "${ctx.name}": ${method} is only meaningful on encrypted collections`
+    );
+  }
+}
+async function findByDet(ctx, field, value) {
+  assertDetField(ctx, field, "findByDet");
+  const [target, legacyTarget] = await detTargets(ctx, field, value);
+  const ids = await ctx.adapter.list(ctx.vault, ctx.name);
+  for (const id of ids) {
+    const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
+    if (!env || !env._det || (env._tier ?? 0) > 0) continue;
+    if (env._det[field] === target || env._det[field] === legacyTarget) {
+      return ctx.codec.decryptRecord(env, { id });
+    }
+  }
+  return null;
+}
+async function queryByDet(ctx, field, value) {
+  assertDetField(ctx, field, "queryByDet");
+  const [target, legacyTarget] = await detTargets(ctx, field, value);
+  const ids = await ctx.adapter.list(ctx.vault, ctx.name);
+  const matches = [];
+  for (const id of ids) {
+    const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
+    if (!env || !env._det || (env._tier ?? 0) > 0) continue;
+    if (env._det[field] === target || env._det[field] === legacyTarget) {
+      const rec = await ctx.codec.decryptRecord(env, { id });
+      if (rec !== null) matches.push(rec);
+    }
+  }
+  return matches;
+}
+
+// src/kernel/enclave/record-keys/envelope-body.ts
+async function openEnvelopeJson(env, key, opts) {
+  if (opts?.encrypted === false) return env._data;
+  if (env._cek !== void 0) {
+    const cek = await unwrapCek(env._cek, key);
+    return decrypt(env._iv, env._data, cek);
+  }
+  return decrypt(env._iv, env._data, key);
+}
+async function writeEnvelopeBody(json, key, opts) {
+  if (opts?.encrypted === false) return { _iv: "", _data: json };
+  if (opts?.perRecordKey === true) {
+    const cek = await generateDEK();
+    const { iv: iv2, data: data2 } = await encrypt(json, cek);
+    const wrapped = await wrapCek(cek, key);
+    return { _iv: iv2, _data: data2, _cek: wrapped };
+  }
+  const { iv, data } = await encrypt(json, key);
+  return { _iv: iv, _data: data };
+}
+function hasPerRecordKey(env) {
+  return env._cek !== void 0;
+}
+function envelopeBodyForHash(env) {
+  if (env._sealed === void 0 && env._vdig === void 0 && env._bidx === void 0) return env._data;
+  const mapPart = (key, map) => {
+    const parts = Object.keys(map).sort().map(
+      (k) => `${JSON.stringify(k)}:${JSON.stringify(map[k])}`
+    );
+    return `${JSON.stringify(key)}:{${parts.join(",")}}`;
+  };
+  const segments = [`"_data":${JSON.stringify(env._data)}`];
+  if (env._sealed !== void 0) segments.push(mapPart("_sealed", env._sealed));
+  if (env._vdig !== void 0) segments.push(mapPart("_vdig", env._vdig));
+  if (env._bidx !== void 0) segments.push(mapPart("_bidx", env._bidx));
+  return `{${segments.join(",")}}`;
+}
+
+// src/kernel/enclave/broker/proof.ts
+var subtle2 = globalThis.crypto.subtle;
+var BROKER_PROOF_DOMAIN = "noydb-broker-proof";
+var BROKER_PROOF_VERSION = "noydb-broker-proof-v1";
+var DEFAULT_CHALLENGE_TTL_MS = 6e4;
+function buildCanonical(vaultId, brokerId, parts) {
+  return JSON.stringify([
+    BROKER_PROOF_VERSION,
+    vaultId,
+    parts.endpointOrigin,
+    brokerId,
+    parts.profile ?? "",
+    parts.instancePid ?? "",
+    parts.challenge,
+    parts.expiresAt
+  ]);
+}
+async function deriveBrokerProofBits(seed, vaultId, brokerId) {
+  const hkdfKey = await subtle2.importKey("raw", seed, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(BROKER_PROOF_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([BROKER_PROOF_DOMAIN, vaultId, brokerId]));
+  const bits = await subtle2.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return new Uint8Array(bits);
+}
+async function deriveBrokerProofKey(seed, vaultId, brokerId) {
+  const proofBits = await deriveBrokerProofBits(seed, vaultId, brokerId);
+  try {
+    return await subtle2.importKey("raw", proofBits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  } finally {
+    proofBits.fill(0);
+  }
+}
+async function computeBrokerProof(seed, vaultId, brokerId, canonicalParts) {
+  try {
+    if (canonicalParts.instancePid === "") {
+      throw new ValidationError(
+        "computeBrokerProof: instancePid must not be an empty string \u2014 omit the field entirely for 'no instance' (F7); '' would alias onto a registered instance."
+      );
+    }
+    const canonical = buildCanonical(vaultId, brokerId, canonicalParts);
+    const key = await deriveBrokerProofKey(seed, vaultId, brokerId);
+    const mac = await subtle2.sign("HMAC", key, new TextEncoder().encode(canonical));
+    return bufferToBase64(new Uint8Array(mac));
+  } finally {
+    seed.fill(0);
+  }
+}
+function issueChallenge(opts) {
+  const ttlMs = opts?.ttlMs ?? DEFAULT_CHALLENGE_TTL_MS;
+  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(32));
+  return {
+    challenge: bufferToBase64(bytes),
+    expiresAt: new Date(Date.now() + ttlMs).toISOString()
+  };
+}
+async function verifyBrokerProof(args) {
+  const fresh = await args.consumeChallenge(args.challenge);
+  if (!fresh) return false;
+  if (args.instancePid === "") return false;
+  const canonical = buildCanonical(args.vaultId, args.brokerId, {
+    endpointOrigin: args.endpointOrigin,
+    profile: args.profile,
+    instancePid: args.instancePid,
+    challenge: args.challenge,
+    expiresAt: args.expiresAt
+  });
+  const key = await subtle2.importKey(
+    "raw",
+    args.registeredProofKey,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["verify"]
+  );
+  const ok = await subtle2.verify(
+    "HMAC",
+    key,
+    base64ToBuffer(args.proof),
+    new TextEncoder().encode(canonical)
+  );
+  if (!ok) return false;
+  return Date.now() < Date.parse(args.expiresAt);
+}
+
+export {
+  resolveStableCek,
+  rewrapBodyToDek,
+  applyRewrappedBody,
+  rewrapEnvelope,
+  isRewrappedUnder,
+  makeReservedEnvelopes,
+  validateSchemaInput,
+  validateSchemaOutput,
+  RecordCodec,
+  SEALED_CEK_NS,
+  sealRecordToHost,
+  revokeSealedRecord,
+  rotateRecordCek,
+  findByDet,
+  queryByDet,
+  openEnvelopeJson,
+  writeEnvelopeBody,
+  hasPerRecordKey,
+  envelopeBodyForHash,
+  deriveBrokerProofBits,
+  deriveBrokerProofKey,
+  computeBrokerProof,
+  issueChallenge,
+  verifyBrokerProof
+};
+//# sourceMappingURL=chunk-XDYREZWE.js.map