@noy-db/hub 0.3.0-pre.8 → 0.3.0

package/dist/tiers/index.js

@@ -1,6 +1,7 @@
 import {
   NO_TIERS,
   assertDeclaredTier,
+  assertTierComposition,
   assertTiersEnabled,
   classifySealedShred,
   demote,
@@ -8,25 +9,27 @@ import {
   getAtTier,
   listAtTier,
   putAtTier,
+  syncDerivedOutputs,
   withTiers
-} from "../chunk-4VDFUBTS.js";
-import "../chunk-26FSVNBL.js";
-import "../chunk-7TAV3BFQ.js";
-import "../chunk-PVC2FBCQ.js";
-import "../chunk-5UOPIPZC.js";
-import "../chunk-UWZ7O4NR.js";
-import "../chunk-REWTMYSF.js";
-import "../chunk-VFQOE76I.js";
+} from "../chunk-CDUQTA3Z.js";
+import "../chunk-ZICD77GM.js";
+import "../chunk-XDYREZWE.js";
+import "../chunk-7DSTRQIJ.js";
+import "../chunk-HB3RFQSC.js";
+import "../chunk-JKJOGPZN.js";
+import "../chunk-5M5DVGV7.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-5HZULLHE.js";
+import "../chunk-CIE2BASH.js";
+import "../chunk-JNAI2HN2.js";
 import {
   TiersNotEnabledError
-} from "../chunk-OJ64XMPJ.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,
   TiersNotEnabledError,
   assertDeclaredTier,
+  assertTierComposition,
   assertTiersEnabled,
   classifySealedShred,
   demote,
@@ -34,6 +37,7 @@ export {
   getAtTier,
   listAtTier,
   putAtTier,
+  syncDerivedOutputs,
   withTiers
 };
 //# sourceMappingURL=index.js.map

package/dist/to/index.js

@@ -1,11 +1,10 @@
-import "../chunk-K2WCO3NX.js";
 import {
   BundleVersionConflictError,
   ConflictError,
   NetworkError,
   PodVersionConflictError,
   StoreCapabilityError
-} from "../chunk-OJ64XMPJ.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   BundleVersionConflictError,

package/dist/tx/index.js

@@ -3,9 +3,9 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-FCOZ7DEC.js";
+} from "../chunk-MEFJPTZ4.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-OJ64XMPJ.js";
+import "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
@@ -44,7 +44,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-KZ4B3PRT.js");
+      const { GuardExecutor } = await import("../executor-KGWTNEQD.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-OJ64XMPJ.js";
+} from "../chunk-BIOUI4HL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/verify-ZASTRNPR.js

@@ -0,0 +1,140 @@
+import {
+  blindedEqual,
+  evaluateKofN,
+  openVdigPayload
+} from "./chunk-HB3RFQSC.js";
+import {
+  dualReadSealedSlot
+} from "./chunk-JKJOGPZN.js";
+import {
+  VDIG_ITERATIONS,
+  normalizeForVerify,
+  pbkdf2VerifyDigest
+} from "./chunk-LP7BEXCT.js";
+import {
+  base64ToBuffer,
+  generateSalt
+} from "./chunk-CIE2BASH.js";
+import {
+  ClassifiedConfigError,
+  ClassifiedVerifyError
+} from "./chunk-BIOUI4HL.js";
+import "./chunk-PZ5AY32C.js";
+
+// src/kernel/enclave/classify/verify.ts
+async function padOnce(iter = VDIG_ITERATIONS) {
+  const dummy = await pbkdf2VerifyDigest("noydb-classify-c4-pad", generateSalt(), iter);
+  await blindedEqual(dummy, dummy);
+}
+async function padFalse() {
+  await padOnce();
+  return { ok: false };
+}
+function refuseSealedResidue(collection, field) {
+  throw new ClassifiedConfigError(
+    collection,
+    `field "${field}" carries a recoverable _sealed slot but no _vdig \u2014 storage-form transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`
+  );
+}
+async function verifyDigestField(ctx, id, field, candidate, policy) {
+  const env = await ctx.getEnvelope(id);
+  if (env === null || (env._tier ?? 0) > 0) return padFalse();
+  const blob = env._vdig?.[field];
+  if (blob === void 0) {
+    if (env._sealed?.[field] !== void 0) refuseSealedResidue(ctx.collection, field);
+    return padFalse();
+  }
+  const cek = await ctx.resolveCek(env);
+  if (cek === void 0) return padFalse();
+  let payload;
+  try {
+    payload = await openVdigPayload(blob, cek, ctx.collection, id, field);
+  } catch {
+    return padFalse();
+  }
+  const normalized = normalizeForVerify(policy.normalize, candidate);
+  const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter);
+  const ok = await blindedEqual(digest, base64ToBuffer(payload.cur.hash));
+  if (!ok) return { ok: false };
+  if (policy.rotateDays !== void 0 && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 864e5) {
+    return { ok: true, mustRotate: true };
+  }
+  return { ok: true };
+}
+async function verifyTextField(ctx, id, field, candidate, normalize) {
+  const env = await ctx.getEnvelope(id);
+  const blob = env?._sealed?.[field];
+  let stored;
+  if (env !== null && (env._tier ?? 0) === 0 && blob !== void 0) {
+    const cek = await ctx.resolveCek(env);
+    const dek = await ctx.getDEK();
+    try {
+      stored = String(JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek)));
+    } catch {
+      stored = void 0;
+    }
+  }
+  await padOnce();
+  const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate));
+  const b = stored !== void 0 ? new TextEncoder().encode(normalizeForVerify(normalize, stored)) : a;
+  const eq = await blindedEqual(a, b);
+  return { ok: stored !== void 0 && eq };
+}
+async function matchGroupFields(ctx, id, answers, members, opts) {
+  if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {
+    throw new ClassifiedVerifyError(
+      ctx.collection,
+      "*",
+      `matchGroup min ${opts.min} out of range 1..${members.length}`
+    );
+  }
+  const normalized = /* @__PURE__ */ new Map();
+  for (const m of members) {
+    const answer = answers[m.field];
+    if (answer === void 0) continue;
+    if (typeof answer !== "string") {
+      throw new ClassifiedVerifyError(ctx.collection, m.field, "candidate must be a string");
+    }
+    normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer));
+  }
+  const fetched = await ctx.getEnvelope(id);
+  const env = fetched === null || (fetched._tier ?? 0) > 0 ? null : fetched;
+  if (env !== null) {
+    for (const m of members) {
+      if (env._sealed?.[m.field] !== void 0 && env._vdig?.[m.field] === void 0) {
+        refuseSealedResidue(ctx.collection, m.field);
+      }
+    }
+  }
+  const cek = env !== null ? await ctx.resolveCek(env) : void 0;
+  const results = [];
+  for (const m of members) {
+    const candidate = normalized.get(m.field);
+    const blob = env?._vdig?.[m.field];
+    if (env === null || cek === void 0 || blob === void 0) {
+      await padOnce();
+      results.push(false);
+      continue;
+    }
+    try {
+      const payload = await openVdigPayload(blob, cek, ctx.collection, id, m.field);
+      if (candidate === void 0) {
+        await padOnce(payload.iter);
+        results.push(false);
+        continue;
+      }
+      const digest = await pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter);
+      results.push(await blindedEqual(digest, base64ToBuffer(payload.cur.hash)));
+    } catch {
+      await padOnce();
+      results.push(false);
+    }
+  }
+  return { passed: evaluateKofN(results, opts.min) };
+}
+export {
+  matchGroupFields,
+  verifyDigestField,
+  verifyTextField
+};
+//# sourceMappingURL=verify-ZASTRNPR.js.map

package/dist/verify-ZASTRNPR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/enclave/classify/verify.ts"],"sourcesContent":["/**\n * The enclave verify oracle (spec §3). Verdict-only egress: no path\n * distinguishes \"record missing\" / \"no digest\" / \"AAD-tamper\" / \"mismatch\"\n * beyond { ok: false } — existence oracles are oracles too. Every path that\n * cannot run a real comparison runs ONE dummy PBKDF2 + ONE dummy tag-compare\n * first (C4), so wall-clock cannot enumerate records/fields/answers. The\n * text door (verifyTextField) has no real PBKDF2 of its own, so it pays the\n * pad UNCONDITIONALLY — every outcome, including a real compare, costs the\n * same one PBKDF2 unit (no inverted exists-vs-absent oracle).\n * Elevated records (_tier > 0, with-audit tier moves) are non-comparable\n * through every door and pad-false exactly like missing records (#691) —\n * the tier-aware read surface is getAtTier, never verify.\n * Throws are reserved for caller/config bugs (ClassifiedVerifyError /\n * ClassifiedConfigError) and are exempt from the pad by design (R6 note).\n * @module\n */\nimport { generateSalt, base64ToBuffer, type EnclaveKey } from '../crypto.js'\nimport { pbkdf2VerifyDigest, VDIG_ITERATIONS } from './digest.js'\nimport { normalizeForVerify, type VerifyNormalizeMode } from './normalize.js'\nimport { blindedEqual } from './compare.js'\nimport { evaluateKofN } from './kofn.js'\nimport { openVdigPayload, type VdigPayload } from './vdig.js'\nimport { dualReadSealedSlot } from '../record-keys/sealed-slot.js'\nimport { ClassifiedConfigError, ClassifiedVerifyError } from '../../errors.js'\nimport type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../types.js'\n\nexport interface VerifyEngineCtx {\n  readonly collection: string\n  getEnvelope(id: string): Promise<EncryptedEnvelope | null>\n  resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>\n  getDEK(): Promise<EnclaveKey>\n  readonly now: () => number\n}\n\n/**\n * C4 pad: one full-cost dummy digest + one dummy compare; result discarded.\n * Pad at `iter` when the caller holds an AUTHENTICATED payload.iter, so pad\n * cost tracks the real compare cost across future iteration bumps; the\n * fully-absent paths (no payload to read an iter from) use VDIG_ITERATIONS.\n */\nasync function padOnce(iter: number = VDIG_ITERATIONS): Promise<void> {\n  const dummy = await pbkdf2VerifyDigest('noydb-classify-c4-pad', generateSalt(), iter)\n  await blindedEqual(dummy, dummy)\n}\n\nasync function padFalse(): Promise<ClassifiedVerdict> {\n  await padOnce()\n  return { ok: false }\n}\n\n/** R6 verify-side transition evidence — config bug, fail-loud, pad-exempt. */\nfunction refuseSealedResidue(collection: string, field: string): never {\n  throw new ClassifiedConfigError(collection,\n    `field \"${field}\" carries a recoverable _sealed slot but no _vdig — storage-form ` +\n    `transition detected (R6); refused fail-loud, never an ok:false masquerading as wrong-password`)\n}\n\nexport async function verifyDigestField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  policy: VdigFieldPolicy,\n): Promise<ClassifiedVerdict> {\n  const env = await ctx.getEnvelope(id)\n  // #691: an elevated envelope (_tier > 0) is non-comparable through every\n  // tier-0 door — its key material is tier-DEK-wrapped and must never be\n  // resolved here (the elevating session's warm cekCache would otherwise\n  // leak past the tier audit). Exactly the missing-record pad path, checked\n  // BEFORE the R6 residue probe so tier-0 callers learn nothing.\n  if (env === null || (env._tier ?? 0) > 0) return padFalse()\n  const blob = env._vdig?.[field]\n  if (blob === undefined) {\n    if (env._sealed?.[field] !== undefined) refuseSealedResidue(ctx.collection, field)\n    return padFalse()\n  }\n  const cek = await ctx.resolveCek(env)\n  if (cek === undefined) return padFalse()\n\n  let payload: VdigPayload\n  try {\n    payload = await openVdigPayload(blob, cek, ctx.collection, id, field)\n  } catch {\n    return padFalse() // AAD/tamper (C1) → padded false; no tamper oracle to the caller\n  }\n\n  const normalized = normalizeForVerify(policy.normalize, candidate)\n  const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(payload.cur.salt), payload.iter)\n  const ok = await blindedEqual(digest, base64ToBuffer(payload.cur.hash))\n  if (!ok) return { ok: false } // I1: bare false — mustRotate never computed here\n\n  if (policy.rotateDays !== undefined\n    && ctx.now() > Date.parse(payload.cur.at) + policy.rotateDays * 86_400_000) {\n    // Disclosing write-age-vs-policy to a SUCCESSFUL verifier is intended (audit F6).\n    return { ok: true, mustRotate: true }\n  }\n  return { ok: true }\n}\n\nexport async function verifyTextField(\n  ctx: VerifyEngineCtx,\n  id: string,\n  field: string,\n  candidate: string,\n  normalize: VerifyNormalizeMode,\n): Promise<ClassifiedVerdict> {\n  // C4, single code path: (a) attempt the unseal where a slot exists, then\n  // for EVERY outcome — present-correct, present-wrong, missing record,\n  // missing slot, tampered — (b) run the one constant-cost pad, (c) run one\n  // blindedEqual, (d) return the boolean. Unlike the digest door there is no\n  // real PBKDF2 here (unseal is sub-ms AES-GCM), so skipping the pad on the\n  // real compare would make exists-but-wrong ~100x FASTER than absent — an\n  // inverted existence oracle. No branch below skips the dominant cost.\n  const env = await ctx.getEnvelope(id)\n  const blob = env?._sealed?.[field]\n  let stored: string | undefined\n  if (env !== null && (env._tier ?? 0) === 0 && blob !== undefined) { // #691: elevated ≡ missing\n    const cek = await ctx.resolveCek(env)\n    const dek = await ctx.getDEK()\n    try {\n      // Plaintext exists microseconds inside this function; only the boolean leaves.\n      stored = String(JSON.parse(await dualReadSealedSlot(blob, field, ctx.collection, cek, dek)))\n    } catch {\n      stored = undefined // AAD/tamper (C1) → same padded compare tail as absent\n    }\n  }\n  await padOnce()\n  const a = new TextEncoder().encode(normalizeForVerify(normalize, candidate))\n  const b = stored !== undefined\n    ? new TextEncoder().encode(normalizeForVerify(normalize, stored))\n    : a // no-compare dummy comparand — the verdict is forced false below\n  const eq = await blindedEqual(a, b)\n  return { ok: stored !== undefined && eq }\n}\n\nexport async function matchGroupFields(\n  ctx: VerifyEngineCtx,\n  id: string,\n  answers: Record<string, string>,\n  members: ReadonlyArray<{ readonly field: string; readonly policy: VdigFieldPolicy }>,\n  opts: { readonly min: number },\n): Promise<{ readonly passed: boolean }> {\n  // I2 step 1 — validate EVERYTHING up front, before any PBKDF2, throwing\n  // uniformly at ~0 elapsed (no member-position leak via timing/throw type).\n  if (!Number.isInteger(opts.min) || opts.min < 1 || opts.min > members.length) {\n    throw new ClassifiedVerifyError(ctx.collection, '*',\n      `matchGroup min ${opts.min} out of range 1..${members.length}`)\n  }\n  const normalized = new Map<string, string>()\n  for (const m of members) {\n    const answer = answers[m.field] // non-member answer keys: silently ignored\n    if (answer === undefined) continue\n    if (typeof answer !== 'string') {\n      throw new ClassifiedVerifyError(ctx.collection, m.field, 'candidate must be a string')\n    }\n    normalized.set(m.field, normalizeForVerify(m.policy.normalize, answer))\n  }\n\n  const fetched = await ctx.getEnvelope(id)\n  // #691: elevated ≡ missing — nulling the view here also skips the R6\n  // residue probe (a tier-0 caller must not learn an elevated record's\n  // storage form) and forces the cek-undefined pad path for every member.\n  const env = fetched === null || (fetched._tier ?? 0) > 0 ? null : fetched\n  if (env !== null) {\n    for (const m of members) { // R6 evidence — uniform, before any PBKDF2\n      if (env._sealed?.[m.field] !== undefined && env._vdig?.[m.field] === undefined) {\n        refuseSealedResidue(ctx.collection, m.field)\n      }\n    }\n  }\n  const cek = env !== null ? await ctx.resolveCek(env) : undefined\n\n  // I2 step 2+3 — iterate RESOLVED GROUP MEMBERS (denominator = |members|),\n  // evaluate EVERY member (collect, never break), pad every no-compare slot.\n  const results: boolean[] = []\n  for (const m of members) {\n    const candidate = normalized.get(m.field)\n    const blob = env?._vdig?.[m.field]\n    if (env === null || cek === undefined || blob === undefined) {\n      await padOnce()\n      results.push(false)\n      continue\n    }\n    try {\n      const payload = await openVdigPayload(blob, cek, ctx.collection, id, m.field)\n      if (candidate === undefined) {\n        // Slot present, answer absent: the payload's authenticated iter is in\n        // hand — pad at IT (not the constant) so a future iteration bump\n        // cannot desync this pad's cost from the real compare's cost.\n        await padOnce(payload.iter)\n        results.push(false)\n        continue\n      }\n      const digest = await pbkdf2VerifyDigest(candidate, base64ToBuffer(payload.cur.salt), payload.iter)\n      results.push(await blindedEqual(digest, base64ToBuffer(payload.cur.hash)))\n    } catch {\n      await padOnce()\n      results.push(false)\n    }\n  }\n  // Per-member results never appear in any return, error, or audit payload.\n  return { passed: evaluateKofN(results, opts.min) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwCA,eAAe,QAAQ,OAAe,iBAAgC;AACpE,QAAM,QAAQ,MAAM,mBAAmB,yBAAyB,aAAa,GAAG,IAAI;AACpF,QAAM,aAAa,OAAO,KAAK;AACjC;AAEA,eAAe,WAAuC;AACpD,QAAM,QAAQ;AACd,SAAO,EAAE,IAAI,MAAM;AACrB;AAGA,SAAS,oBAAoB,YAAoB,OAAsB;AACrE,QAAM,IAAI;AAAA,IAAsB;AAAA,IAC9B,UAAU,KAAK;AAAA,EACgF;AACnG;AAEA,eAAsB,kBACpB,KACA,IACA,OACA,WACA,QAC4B;AAC5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AAMpC,MAAI,QAAQ,SAAS,IAAI,SAAS,KAAK,EAAG,QAAO,SAAS;AAC1D,QAAM,OAAO,IAAI,QAAQ,KAAK;AAC9B,MAAI,SAAS,QAAW;AACtB,QAAI,IAAI,UAAU,KAAK,MAAM,OAAW,qBAAoB,IAAI,YAAY,KAAK;AACjF,WAAO,SAAS;AAAA,EAClB;AACA,QAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,MAAI,QAAQ,OAAW,QAAO,SAAS;AAEvC,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,KAAK;AAAA,EACtE,QAAQ;AACN,WAAO,SAAS;AAAA,EAClB;AAEA,QAAM,aAAa,mBAAmB,OAAO,WAAW,SAAS;AACjE,QAAM,SAAS,MAAM,mBAAmB,YAAY,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AAClG,QAAM,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC;AACtE,MAAI,CAAC,GAAI,QAAO,EAAE,IAAI,MAAM;AAE5B,MAAI,OAAO,eAAe,UACrB,IAAI,IAAI,IAAI,KAAK,MAAM,QAAQ,IAAI,EAAE,IAAI,OAAO,aAAa,OAAY;AAE5E,WAAO,EAAE,IAAI,MAAM,YAAY,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;AAEA,eAAsB,gBACpB,KACA,IACA,OACA,WACA,WAC4B;AAQ5B,QAAM,MAAM,MAAM,IAAI,YAAY,EAAE;AACpC,QAAM,OAAO,KAAK,UAAU,KAAK;AACjC,MAAI;AACJ,MAAI,QAAQ,SAAS,IAAI,SAAS,OAAO,KAAK,SAAS,QAAW;AAChE,UAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AACpC,UAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAI;AAEF,eAAS,OAAO,KAAK,MAAM,MAAM,mBAAmB,MAAM,OAAO,IAAI,YAAY,KAAK,GAAG,CAAC,CAAC;AAAA,IAC7F,QAAQ;AACN,eAAS;AAAA,IACX;AAAA,EACF;AACA,QAAM,QAAQ;AACd,QAAM,IAAI,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,SAAS,CAAC;AAC3E,QAAM,IAAI,WAAW,SACjB,IAAI,YAAY,EAAE,OAAO,mBAAmB,WAAW,MAAM,CAAC,IAC9D;AACJ,QAAM,KAAK,MAAM,aAAa,GAAG,CAAC;AAClC,SAAO,EAAE,IAAI,WAAW,UAAa,GAAG;AAC1C;AAEA,eAAsB,iBACpB,KACA,IACA,SACA,SACA,MACuC;AAGvC,MAAI,CAAC,OAAO,UAAU,KAAK,GAAG,KAAK,KAAK,MAAM,KAAK,KAAK,MAAM,QAAQ,QAAQ;AAC5E,UAAM,IAAI;AAAA,MAAsB,IAAI;AAAA,MAAY;AAAA,MAC9C,kBAAkB,KAAK,GAAG,oBAAoB,QAAQ,MAAM;AAAA,IAAE;AAAA,EAClE;AACA,QAAM,aAAa,oBAAI,IAAoB;AAC3C,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,QAAQ,EAAE,KAAK;AAC9B,QAAI,WAAW,OAAW;AAC1B,QAAI,OAAO,WAAW,UAAU;AAC9B,YAAM,IAAI,sBAAsB,IAAI,YAAY,EAAE,OAAO,4BAA4B;AAAA,IACvF;AACA,eAAW,IAAI,EAAE,OAAO,mBAAmB,EAAE,OAAO,WAAW,MAAM,CAAC;AAAA,EACxE;AAEA,QAAM,UAAU,MAAM,IAAI,YAAY,EAAE;AAIxC,QAAM,MAAM,YAAY,SAAS,QAAQ,SAAS,KAAK,IAAI,OAAO;AAClE,MAAI,QAAQ,MAAM;AAChB,eAAW,KAAK,SAAS;AACvB,UAAI,IAAI,UAAU,EAAE,KAAK,MAAM,UAAa,IAAI,QAAQ,EAAE,KAAK,MAAM,QAAW;AAC9E,4BAAoB,IAAI,YAAY,EAAE,KAAK;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,QAAQ,OAAO,MAAM,IAAI,WAAW,GAAG,IAAI;AAIvD,QAAM,UAAqB,CAAC;AAC5B,aAAW,KAAK,SAAS;AACvB,UAAM,YAAY,WAAW,IAAI,EAAE,KAAK;AACxC,UAAM,OAAO,KAAK,QAAQ,EAAE,KAAK;AACjC,QAAI,QAAQ,QAAQ,QAAQ,UAAa,SAAS,QAAW;AAC3D,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAClB;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,MAAM,gBAAgB,MAAM,KAAK,IAAI,YAAY,IAAI,EAAE,KAAK;AAC5E,UAAI,cAAc,QAAW;AAI3B,cAAM,QAAQ,QAAQ,IAAI;AAC1B,gBAAQ,KAAK,KAAK;AAClB;AAAA,MACF;AACA,YAAM,SAAS,MAAM,mBAAmB,WAAW,eAAe,QAAQ,IAAI,IAAI,GAAG,QAAQ,IAAI;AACjG,cAAQ,KAAK,MAAM,aAAa,QAAQ,eAAe,QAAQ,IAAI,IAAI,CAAC,CAAC;AAAA,IAC3E,QAAQ;AACN,YAAM,QAAQ;AACd,cAAQ,KAAK,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,SAAS,KAAK,GAAG,EAAE;AACnD;","names":[]}

package/dist/via/blob/active.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Active blob strategy factory. Calling `blobs()` returns a
+ * `BlobStrategy` whose `openSlot` constructs a real `BlobSet` bound
+ * to the caller's record. The returned strategy is passed into
+ * `createNoydb({ blobStrategy: blobs() })` to light up the
+ * `collection.blob(id)` path.
+ *
+ * This module is only reachable through the `@noy-db/hub/blobs`
+ * subpath — a consumer that never imports the subpath ships none of
+ * this (ESM tree-shaking + hub's `"sideEffects": false`).
+ */
+import type { BlobStrategy } from '../../port/with/blob-strategy.js';
+/**
+ * Build a default `BlobStrategy` ready to pass into `createNoydb`.
+ *
+ * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to
+ * avoid shadowing the very common local idiom
+ * `const blobs = invoices.blob(id)` in user code.
+ *
+ * @example
+ * ```ts
+ * import { createNoydb } from '@noy-db/hub'
+ * import { withBlobs } from '@noy-db/hub/blobs'
+ *
+ * const db = await createNoydb({
+ *   store, user, secret,
+ *   blobStrategy: withBlobs(),
+ * })
+ *
+ * // Now live — delegates to BlobSet.
+ * await db.vault('acme').collection('invoices').blob('inv-1').put('receipt.pdf', bytes)
+ * ```
+ */
+export declare function withBlobs(): BlobStrategy;

package/dist/via/blob/binding.d.ts

@@ -0,0 +1,86 @@
+/**
+ * The blob `ViaBinding` (#629 Task 7) — wires the `blobFields` declaration
+ * into the kernel's generic Via port as a deliberately THIN binding:
+ * declaration + posture + `describeFragment` + `erase` glue, and nothing
+ * else. Blob content is fully out-of-band (`collection.blob(id)` →
+ * `BlobSet` writing `_blob_*` side-collections; it never touches
+ * `_putInternal` or the record codec), so this binding declares **no
+ * write/read pipeline hooks** — in particular no `encodeAtRest`/
+ * `decodeAtRest`: a blobFields collection must not flip the pipeline's
+ * `hasAtRestHooks`, or the codec would abandon its inline seal path for a
+ * feature that never seals record fields. The routing/compaction/TTL/
+ * legal-hold/exportBlobs machinery stays service-side in
+ * `with-shape/blobs/` (the i18n-dictionary precedent — that machinery
+ * does real chunk AEAD + key-lifecycle work `via-enclave-isolation`
+ * forbids under `via/*`).
+ *
+ * Like classified (see `port/with/classified-strategy.ts`), the link is
+ * EAGER — `port/with/blob-strategy.ts` calls {@link linkBlobVia} at module
+ * load. `blobFields` policies are plain object literals (there is no
+ * `blob.*()` declaration factory to hang a lazy link on), so the binder
+ * must be installed before `compileViaBindings` ever sees one.
+ *
+ * There is no `declare`-time validation: `blobFields` has never had a
+ * construction-time refusal matrix (policies are consulted lazily by
+ * `vault.compact()` and `BlobSet.put`), and inventing one here would
+ * break the behavior lock.
+ *
+ * `covers` (#629 Task 8) is a passive coverage predicate, not a pipeline
+ * hook — it lets `ViaPipeline.postureFor` recognize a `blobFields` slot so
+ * `.where()`/`.orderBy()`/`.aggregate()` can refuse it (posture
+ * `queryable: 'none'`); it does not participate in clause building or
+ * evaluation.
+ */
+import type { ViaBinding, ViaEraseReport } from '../../kernel/via/index.js';
+import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
+/**
+ * Config a blob collection's `blobFields` declaration resolves to — the
+ * binding's construction input. `purgeBlobsForRecord` is an OPTIONAL
+ * vault/service-provided closure for the `erase` hook, mapping
+ * `collection.blob(id).shredAllForRecord()`'s `{shredded, retainedShared,
+ * residue}: string[]` accounting onto `ViaEraseReport` — `shredded`/
+ * `retainedShared` become counts, each residue eTag becomes a tagged
+ * `{kind: 'blob-residue', eTag}` entry.
+ *
+ * DELIBERATELY left unwired by `compileViaBindings` (#629 Task 10, resolved
+ * within parity-first — see task-10-report.md "blob purge" section):
+ * `per-blob-cek.test.ts`/`forget.test.ts` prove blob-shred-on-forget is
+ * gated SOLELY on the vault's `blobStrategy` being configured, never on a
+ * given collection's OWN `blobFields` declaration (`.blob(id)` is callable,
+ * and IS exercised by those tests, on collections with no `blobFields` at
+ * all). Routing it exclusively through this binding would silently stop
+ * blob crypto-shredding for every such collection; `vault.forget()` keeps
+ * calling `collection.blob(id).shredAllForRecord()` directly for that
+ * reason. The hook stays real/tested (see `blob-binding.test.ts`) for a
+ * future caller that wants it.
+ */
+export interface BlobViaConfig {
+    readonly fields: BlobFieldsConfig;
+    readonly collectionName: string;
+    /** Purge one record's blob slots (crypto-shred participation). Returns the erase report for `forget()`'s summary. */
+    readonly purgeBlobsForRecord?: (id: string) => Promise<ViaEraseReport>;
+}
+/**
+ * One field's blob knobs as they appear on `describeFragment()`'s payload
+ * (#657 — the second real `ViaBinding.describeFragment` consumer after
+ * `lookup`'s; see `with-shape/introspection/describe.ts`'s `buildDescription`).
+ * Declarative scalars (`retainDays`/`external`/`public`/`backlink`) verbatim;
+ * predicate knobs (`evictWhen`/`legalHold`/`retainUntil` — functions over the
+ * decrypted record) as presence flags, since a predicate has no serializable
+ * form — mirrors `buildBlobDescribeFragment`'s per-field shape below.
+ */
+export interface BlobDescribeFragmentEntry {
+    readonly retainDays?: number;
+    readonly evictWhen?: true;
+    readonly legalHold?: true;
+    readonly retainUntil?: true;
+    readonly external?: true;
+    readonly public?: true;
+    readonly backlink?: string;
+}
+/** The `'blob'` binding's `describeFragment()` payload shape. */
+export interface BlobDescribeFragment {
+    readonly blobFields: Record<string, BlobDescribeFragmentEntry>;
+}
+export declare function blobBinding(cfg: BlobViaConfig): ViaBinding;
+export declare function linkBlobVia(): void;

package/dist/via/blob/index.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @noy-db/hub/blobs — opt-in blob / document service.
+ *
+ * @category capability
+ *
+ * This subpath fronts every blob-storage entry point: `BlobSet`
+ * (slot-based attachments with chunked encryption and dedup),
+ * `mime-magic` (MIME detection from magic bytes), `blob-compaction`
+ * (TTL eviction via `blobFields`), `export-blobs` (bulk export
+ * primitive), and the legacy `attachments` API. The barrel + the
+ * `withBlobs()` factory live here in `via/blob/` (#629 Task 7);
+ * the content-crypto machinery itself stays in `with-shape/blobs/`
+ * (service-side — it does real chunk AEAD/key-lifecycle work the
+ * `via-enclave-isolation` guard forbids under `via/*`).
+ *
+ * Hub's root barrel (`@noy-db/hub`) still re-exports `BlobSet` + the
+ * MIME helpers for backward compatibility with `@noy-db/as-blob`,
+ * `@noy-db/as-zip`, and any consumer written before this split. New
+ * code should prefer this subpath so the import boundary is explicit.
+ */
+export { withBlobs } from './active.js';
+export type { BlobStrategy, BlobStrategyOpenArgs } from '../../port/with/blob-strategy.js';
+export { memoryObjectProjection } from '../../with-shape/blobs/object-projection.js';
+export type { ObjectProjection, ObjectMeta, ObjectListEntry, PutObjectOptions, ObjectUrlOptions, PutUrlOptions, } from '../../with-shape/blobs/object-projection.js';
+export { importExternalObjects } from '../../with-shape/blobs/import-external.js';
+export type { ImportableCollection, ImportExternalOptions, ImportExternalResult, } from '../../with-shape/blobs/import-external.js';
+export { BlobSet } from '../../with-shape/blobs/blob-set.js';
+export { BLOB_COLLECTION, BLOB_INDEX_COLLECTION, BLOB_CHUNKS_COLLECTION, BLOB_SLOTS_PREFIX, BLOB_VERSIONS_PREFIX, DEFAULT_CHUNK_SIZE, } from '../../with-shape/blobs/blob-set.js';
+export type { BlobObject, SlotRecord, SlotInfo, VersionRecord, BlobPutOptions, BlobResponseOptions, } from '../../kernel/types.js';
+export { detectMimeType, detectMagic, isPreCompressed } from '../../with-shape/blobs/mime-magic.js';
+export { runCompaction, BLOB_EVICTION_AUDIT_COLLECTION } from '../../with-shape/blobs/blob-compaction.js';
+export type { BlobFieldsConfig, BlobFieldPolicy, BlobEvictionEntry, CompactRunOptions, CompactionResult, CompactionContext, } from '../../with-shape/blobs/blob-compaction.js';
+export { createExportBlobsHandle, ExportBlobsAbortedError, EXPORT_AUDIT_COLLECTION, } from '../../with-shape/blobs/export-blobs.js';
+export type { ExportBlobsOptions, ExportedBlob, ExportBlobsHandle, ExportBlobsAuditEntry, } from '../../with-shape/blobs/export-blobs.js';

package/dist/via/classified/active.d.ts

@@ -0,0 +1,3 @@
+import type { ClassifiedStrategy } from './strategy.js';
+/** Opt-in factory: enables reveal + verify/verifyText/matchGroup (stage 2). */
+export declare function withClassified(): ClassifiedStrategy;

package/dist/via/classified/binding.d.ts

@@ -0,0 +1,83 @@
+/**
+ * The classified `ViaBinding` (#629 Task 5, LIVE since Task 6) — wires
+ * classified-fields declaration/write-enforcement/at-rest sealing/erasure
+ * into the kernel's generic Via port. Mirrors `via/money/binding.ts`'s
+ * inline declaration-time validation and `via/i18n/binding.ts`'s
+ * `linkXVia` static-link pattern — except the link itself is EAGER
+ * (`port/with/classified-strategy.ts` calls `linkClassifiedVia()` at module
+ * load, not lazily from a `classified.*()` preset call): several fixtures
+ * build a raw `ClassifiedFieldSpec` literal without ever calling a preset,
+ * and the binder must be installed before `compileViaBindings` needs it
+ * regardless.
+ *
+ * `compileViaBindings` (`kernel/collection-config.ts`) compiles this binding
+ * in whenever a collection declares `classifiedFields` — money then i18n
+ * then classified, order pinned. `kernel/collection.ts`'s `_putInternal`
+ * runs `enforceClassifiedWrite`'s effect via the pipeline's `enforceWrite`
+ * phase; the codec's `encodeAtRest`/`decodeAtRest` hooks (Task 3's boundary)
+ * replace the inline `sensitiveFields` seal path for any collection this
+ * binding is compiled into.
+ *
+ * `declare` — `classifiedBinding(cfg)` runs `resolveClassifiedFields` +
+ * `guardClassifiedCompat` at CONSTRUCTION time (the same #553 pattern
+ * `moneyBinding`'s `validateMoneyFieldPaths(moneyFields)` call uses) —
+ * mirrors today's "door 1" (`collection-config.ts`'s
+ * `resolveCollectionConfig`). Both may throw `ClassifiedConfigError`.
+ */
+import type { ViaBinding } from '../../kernel/via/index.js';
+import { type ClassifiedEntry } from './resolve.js';
+import { type ClassifiedGuardCtx } from './guards.js';
+/**
+ * One classified per-slot shred/residue verdict — mirrors
+ * `RecordCodec.SealedShredSlot` (`kernel/enclave/record-keys/record-codec.ts`)
+ * byte-for-byte. Duplicated here (not imported) so this binding never
+ * reaches into `kernel/enclave/` (`via-enclave-isolation`, #629) — the
+ * closure that PRODUCES real values of this shape is codec-owned and
+ * injected via {@link ClassifiedViaConfig.classifySealedShred}.
+ */
+export interface ClassifiedShredSlot {
+    readonly field: string;
+    readonly class: 'shreddable' | 'dekResidue' | 'live-shreddable+dekResidue-in-backups';
+}
+/**
+ * Config a classified collection's declarations resolve to — the binding's
+ * construction input. `entries`/`guardCtx` are the raw "door 1" inputs
+ * (`resolveClassifiedFields`/`guardClassifiedCompat`'s own parameters);
+ * `classifySealedShred`/`purgeSealedCekEnvelopes` are OPTIONAL codec/vault-
+ * provided closures for the `erase` hook — undefined in this dormant task
+ * (no caller wires them yet), wired for real in #629 Task 10 ("posture
+ * enforcement — forget + erase hooks live").
+ */
+export interface ClassifiedViaConfig {
+    readonly entries: Record<string, ClassifiedEntry>;
+    readonly collectionName: string;
+    readonly guardCtx: ClassifiedGuardCtx;
+    /**
+     * Codec-provided closure mirroring `RecordCodec.classifySealedShred` —
+     * classifies a live envelope's `_sealed` slots for crypto-shred
+     * completeness (see that method's doc comment for the shreddable/
+     * dekResidue/both-class semantics). `live` is `ViaEraseCtx.live`'s opaque
+     * envelope, passed straight through. NOT `readonly` (#629 Task 10):
+     * `compileViaBindings` builds this cfg before the owning `Collection`'s
+     * `RecordCodec` exists, so `Collection`'s constructor mutates this field
+     * in place once `this.codec` is available — the closure `eraseClassified`
+     * reads is looked up at CALL time, not at binding-construction time, so
+     * the late assignment is picked up correctly.
+     */
+    classifySealedShred?: (live: unknown) => Promise<{
+        readonly slots: readonly ClassifiedShredSlot[];
+    }>;
+    /**
+     * Vault-provided closure that purges every `_sealed_cek/<collection>/<id>/*`
+     * host-delivery envelope for one record (mirrors `rotateRecordCek`'s own
+     * prefix-delete) and returns the count purged. Deliberately left UNWIRED
+     * by `compileViaBindings` (#629 Task 10) — `forget-sealed-erasure.test.ts`
+     * proves this purge is UNCONDITIONAL on `sealRecordToHost` usage alone,
+     * independent of whether `classifiedFields` is declared (a bare
+     * `sensitive: [...]` collection exercises it with no classified binding
+     * at all) — vault.ts keeps owning it directly so that case stays correct.
+     */
+    readonly purgeSealedCekEnvelopes?: (id: string) => Promise<number>;
+}
+export declare function classifiedBinding(cfg: ClassifiedViaConfig): ViaBinding;
+export declare function linkClassifiedVia(): void;

package/dist/via/classified/config-drift.d.ts

@@ -0,0 +1,34 @@
+/**
+ * C-A / R10 config-drift marker I/O — the store side of the guard, kept OUT of
+ * the kernel `Collection` so the always-on kernel surface stays lean. The
+ * kernel holds only the per-handle memoization; these helpers do the actual
+ * persisted-schema read/write (via the persisted-schemas storage seam, lazily
+ * imported so the classified spine tree-shakes).
+ *
+ * Marker semantics: a collection declaring classified digest-only fields writes
+ * an `x-classified` marker into its `_schemas/<collection>` record on the first
+ * classified write. A handle later opened WITHOUT `classifiedFields` (a naive
+ * handle) reads it back and refuses to write — see RecordCodec.encryptRecord's
+ * R10 guard.
+ *
+ * `dek` is typed as the bare `CryptoKey` global rather than `EnclaveKey`
+ * (`kernel/enclave/crypto.ts`'s alias for the same type) — this file lives
+ * under `via/classified/`, which the `via-enclave-isolation`
+ * architecture guard (#629) forbids from importing `kernel/enclave/` at
+ * all, even type-only.
+ *
+ * @module
+ */
+import type { NoydbStore, VdigFieldPolicy } from '../../kernel/types.js';
+/**
+ * Persist the classified marker for a handle's digest-only fields. No-op when
+ * the handle declares none. Idempotent (delegates to `persistClassifiedMarker`).
+ */
+export declare function persistClassifiedMarkerForFields(store: NoydbStore, vault: string, collectionName: string, vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null, dek: CryptoKey): Promise<void>;
+/**
+ * Read a collection's persisted classified marker's declared digest-only field
+ * set (empty when the collection carries no marker). Cross-session drift signal:
+ * the R10 superset guard refuses a handle whose declared classified set does not
+ * cover every field in this set.
+ */
+export declare function readClassifiedMarkerDigestOnly(store: NoydbStore, vault: string, collectionName: string, dek: CryptoKey): Promise<readonly string[]>;

package/dist/via/classified/descriptor.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Classified fields — behavioral sensitive-field descriptors (stage 1).
+ * Design: docs/superpowers/specs/2026-07-04-classified-fields-design.md
+ * Law: open on write, declarative on read — read-side behavior is this
+ * closed vocabulary; there are no read-side callbacks.
+ * @module
+ */
+export type ClassifiedStorage = 'recoverable' | 'never' | 'digest-only';
+export type ClassifiedList = {
+    readonly kind: 'omit';
+} | {
+    readonly kind: 'mask';
+    readonly pattern: string;
+} | {
+    readonly kind: 'rider';
+    readonly rider: string;
+};
+export type ClassifiedRider = (value: unknown) => unknown;
+export interface ClassifiedFieldSpec {
+    readonly _noydbClassified: true;
+    /**
+     * Via port brand marker — lets a `ClassifiedFieldSpec` satisfy the
+     * kernel's opaque `ViaDescriptor` (#629 Task 5). Optional (unlike
+     * `MoneyDescriptor._viaBrand`/`I18nTextDescriptor._viaBrand`, which are
+     * required): every `classified.*()` preset factory stamps it, but the
+     * pre-existing test suite's hand-rolled `ClassifiedFieldSpec` fixtures
+     * (built without going through a preset) predate this field and would
+     * fail to compile if it were mandatory.
+     */
+    readonly _viaBrand?: 'classified';
+    readonly preset: string;
+    readonly storage: ClassifiedStorage;
+    readonly list: ClassifiedList;
+    readonly sensitivity: 'pii' | 'secret';
+    /** Write-time safe projections; companion field name is `<field>_<rider>`. */
+    readonly riders?: Record<string, ClassifiedRider>;
+    /** Write-time validator: error message, or null when valid. */
+    readonly validate?: (value: unknown) => string | null;
+    /** Digest-only verify policy (stage 2). Mode both sides normalize under. */
+    readonly verifyNormalize?: 'password' | 'secret-answer';
+    /** Decorate ok:true verdicts with mustRotate after this many days (I1). */
+    readonly rotateDays?: number;
+    /** Refuse reuse of the last N values on rotate (cap 8, spec Q4). */
+    readonly notLastN?: number;
+    /** Member of the collection's matchGroup (secretAnswer preset). */
+    readonly verifyGroupMember?: true;
+    /**
+     * Opt into a store-visible blind-index (`_bidx`) tag so equal values become
+     * queryable/joinable while staying digest-only. Digest-only knob (R7); gated
+     * behind the collection's `acknowledgeEquatableRisk` door (R8). Equal values
+     * produce equal tags — a partition leak a DEK holder can offline-dictionary
+     * at the PBKDF2 floor. Absent/false ⇒ refused-by-default.
+     */
+    readonly equatable?: true;
+}
+export interface ClassifiedGroup {
+    readonly _noydbClassifiedGroup: true;
+    /** Via port brand marker — see {@link ClassifiedFieldSpec._viaBrand}. */
+    readonly _viaBrand?: 'classified';
+    readonly preset: string;
+    /** member record-field name -> spec (differential per-member policy). */
+    readonly members: Record<string, ClassifiedFieldSpec>;
+}
+export type ClassifiedEntry = ClassifiedFieldSpec | ClassifiedGroup;
+export declare function isClassifiedFieldSpec(x: unknown): x is ClassifiedFieldSpec;
+export declare function isClassifiedGroup(x: unknown): x is ClassifiedGroup;

package/dist/via/classified/errors.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Configuration/write errors for classified fields. @module
+ *
+ * `ClassifiedConfigError` / `ClassifiedRevealError` moved to `kernel/errors.ts`
+ * (stage 2) so `kernel/enclave/classify/*` can throw them without importing
+ * with-*. Re-exported here under the same names so existing import paths
+ * keep working.
+ */
+export { ClassifiedConfigError, ClassifiedRevealError, ClassifiedVerifyError, ClassifiedRotationError } from '../../kernel/errors.js';
+export declare class ClassifiedNeverStoredError extends Error {
+    readonly collection: string;
+    readonly field: string;
+    constructor(collection: string, field: string);
+}
+export declare class ClassifiedValidationError extends Error {
+    readonly collection: string;
+    readonly field: string;
+    constructor(collection: string, field: string, detail: string);
+}