@noy-db/hub 0.3.0-pre.9 → 0.3.0

package/dist/chunk-XHD3L3JO.js

@@ -1,930 +0,0 @@
-import {
-  isDeleteMarker,
-  isTombstone
-} from "./chunk-Z5YFRMG5.js";
-import {
-  blindedEqual,
-  openVdigPayload,
-  sealVdigPayload
-} from "./chunk-XQ7UYPVN.js";
-import {
-  dualReadSealedSlot,
-  parseSealedSlot
-} from "./chunk-6MWUANRF.js";
-import {
-  mintBidxTag
-} from "./chunk-2KOSJTMU.js";
-import {
-  VDIG_ITERATIONS,
-  normalizeForVerify,
-  pbkdf2VerifyDigest
-} from "./chunk-LP7BEXCT.js";
-import {
-  base64ToBuffer,
-  bufferToBase64,
-  decrypt,
-  deriveDeterministicKey,
-  deriveSealedFieldKey,
-  deriveSealedFieldKeyFromCek,
-  encrypt,
-  encryptDeterministic,
-  generateDEK,
-  generateSalt,
-  unwrapCek,
-  wrapCek
-} from "./chunk-AUR7MRHA.js";
-import {
-  NOYDB_FORMAT_VERSION,
-  SealedHandle
-} from "./chunk-UNJU345Q.js";
-import {
-  ClassifiedConfigError,
-  ClassifiedRotationError,
-  DebugReservedFieldError,
-  RecordCekNotFoundError,
-  SchemaValidationError,
-  TamperedError,
-  ValidationError
-} from "./chunk-CU62BBRB.js";
-
-// src/kernel/enclave/record-keys/lifecycle.ts
-async function resolveStableCek(deps, id) {
-  const cached = deps.cache?.get(id);
-  if (cached) return cached;
-  const live = await deps.getLive(id);
-  if (live?._cek !== void 0) {
-    const cek = await unwrapCek(live._cek, await deps.getDEK());
-    deps.cache?.set(id, cek, 1);
-    return cek;
-  }
-  const fresh = await generateDEK();
-  deps.cache?.set(id, fresh, 1);
-  return fresh;
-}
-async function rewrapBodyToDek(envelope, fromDek, toDek) {
-  if (envelope._cek !== void 0) {
-    const cek = await unwrapCek(envelope._cek, fromDek);
-    const plaintext2 = await decrypt(envelope._iv, envelope._data, cek);
-    const { iv: iv2, data: data2 } = await encrypt(plaintext2, cek);
-    return { _iv: iv2, _data: data2, _cek: await wrapCek(cek, toDek), cek };
-  }
-  const plaintext = await decrypt(envelope._iv, envelope._data, fromDek);
-  const { iv, data } = await encrypt(plaintext, toDek);
-  return { _iv: iv, _data: data, cek: null };
-}
-
-// src/kernel/enclave/record-keys/sealed-slots.ts
-async function sealOneFieldWithDek(field, value, dek, keyMaterial) {
-  const fieldKey = keyMaterial.cek !== void 0 ? await deriveSealedFieldKeyFromCek(keyMaterial.cek, keyMaterial.collection, field) : await deriveSealedFieldKey(dek, keyMaterial.collection, field);
-  return encrypt(JSON.stringify(value), fieldKey);
-}
-async function sealOneField(field, value, keyMaterial) {
-  const dek = await keyMaterial.getDEK();
-  return sealOneFieldWithDek(field, value, dek, keyMaterial);
-}
-async function sealFields(record, sensitiveFields, keyMaterial) {
-  const dek = await keyMaterial.getDEK();
-  const open = { ...record };
-  const slots = {};
-  for (const field of sensitiveFields) {
-    if (!(field in record)) continue;
-    const value = record[field];
-    if (value === void 0) continue;
-    const { iv, data } = await sealOneFieldWithDek(field, value, dek, keyMaterial);
-    slots[field] = `${iv}:${data}`;
-    delete open[field];
-  }
-  if (Object.keys(slots).length === 0) return { openRecord: record, sealed: void 0 };
-  return { openRecord: open, sealed: slots };
-}
-async function unsealOneField(field, blob, keyMaterial) {
-  const dek = await keyMaterial.getDEK();
-  return JSON.parse(await dualReadSealedSlot(blob, field, keyMaterial.collection, keyMaterial.cek, dek));
-}
-function makeHandleProducer(keyMaterial) {
-  return (field, blob) => new SealedHandle(() => unsealOneField(field, blob, keyMaterial));
-}
-async function unsealFields(record, sealed, keyMaterial, opts) {
-  const makeHandle = opts?.asHandles === true ? makeHandleProducer(keyMaterial) : void 0;
-  for (const [field, blob] of Object.entries(sealed)) {
-    record[field] = makeHandle !== void 0 ? makeHandle(field, blob) : await unsealOneField(field, blob, keyMaterial);
-  }
-  return record;
-}
-function makeSealedSlotCapability(ctx, recordId, cek) {
-  const keyMaterial = {
-    collection: ctx.name,
-    ...cek !== void 0 ? { cek } : {},
-    getDEK: () => ctx.getDEK()
-  };
-  const deletedFields = /* @__PURE__ */ new Set();
-  return {
-    async seal(field, plaintext) {
-      const ref = await sealOneField(field, plaintext, keyMaterial);
-      deletedFields.delete(field);
-      return ref;
-    },
-    async unseal(field, ref) {
-      if (deletedFields.has(field)) {
-        throw new ValidationError(`sealedSlots.unseal: field "${field}" on record "${recordId}" was deleted from this capability`);
-      }
-      return unsealOneField(field, `${ref.iv}:${ref.data}`, keyMaterial);
-    },
-    async delete(field) {
-      deletedFields.add(field);
-    }
-  };
-}
-function makeReservedEnvelopes(dekResolver, declaredPrefixes) {
-  const declared = new Set(declaredPrefixes);
-  return (prefix) => {
-    if (!declared.has(prefix)) {
-      throw new ValidationError(`reservedEnvelopes: prefix "${prefix}" is not declared by this binding's reservedPrefixes`);
-    }
-    const assertPrefixed = (collection, method) => {
-      if (!collection.startsWith(prefix)) {
-        throw new ValidationError(
-          `reservedEnvelopes('${prefix}').${method}: collection "${collection}" does not start with "${prefix}"`
-        );
-      }
-    };
-    const encryptForPrefix = async (collection, json, v) => {
-      assertPrefixed(collection, "encrypt");
-      const dek = await dekResolver(collection);
-      const { iv, data } = await encrypt(json, dek);
-      return {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: v,
-        _ts: (/* @__PURE__ */ new Date()).toISOString(),
-        _iv: iv,
-        _data: data
-      };
-    };
-    const decryptForPrefix = async (collection, env) => {
-      assertPrefixed(collection, "decrypt");
-      const dek = await dekResolver(collection);
-      return decrypt(env._iv, env._data, dek);
-    };
-    return { encrypt: encryptForPrefix, decrypt: decryptForPrefix };
-  };
-}
-
-// src/kernel/enclave/classify/write.ts
-async function mintVdigSlot(rawValue, policy, prevBlob, cek, collection, recordId, field) {
-  const normalized = normalizeForVerify(policy.normalize, rawValue);
-  let prev = null;
-  if (prevBlob !== void 0) {
-    try {
-      prev = await openVdigPayload(prevBlob, cek, collection, recordId, field);
-    } catch {
-      throw new TamperedError();
-    }
-    if (!Number.isInteger(prev.iter) || prev.iter < 1) {
-      throw new TamperedError();
-    }
-  }
-  if (prev !== null && policy.notLastN > 0) {
-    const history = [prev.cur, ...prev.ring ?? []];
-    for (const entry of history) {
-      const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(entry.salt), prev.iter);
-      if (await blindedEqual(digest, base64ToBuffer(entry.hash))) {
-        throw new ClassifiedRotationError(collection, field, "password was used recently");
-      }
-    }
-  }
-  const salt = generateSalt();
-  const hash = await pbkdf2VerifyDigest(normalized, salt, VDIG_ITERATIONS);
-  const ring = prev !== null && policy.notLastN > 0 ? [...prev.ring ?? [], { salt: prev.cur.salt, hash: prev.cur.hash }].slice(-policy.notLastN) : void 0;
-  const payload = {
-    v: 1,
-    alg: "PBKDF2-SHA256",
-    iter: VDIG_ITERATIONS,
-    cur: { salt: bufferToBase64(salt), hash: bufferToBase64(hash), at: (/* @__PURE__ */ new Date()).toISOString() },
-    ...ring !== void 0 && ring.length > 0 ? { ring } : {}
-  };
-  return sealVdigPayload(payload, cek, collection, recordId, field);
-}
-
-// src/kernel/schema.ts
-async function validateSchemaInput(schema, value, context) {
-  const result = await schema["~standard"].validate(value);
-  if (result.issues !== void 0 && result.issues.length > 0) {
-    throw new SchemaValidationError(
-      `Schema validation failed on ${context}: ${summarizeIssues(result.issues)}`,
-      result.issues,
-      "input"
-    );
-  }
-  return result.value;
-}
-async function validateSchemaOutput(schema, value, context) {
-  const result = await schema["~standard"].validate(value);
-  if (result.issues !== void 0 && result.issues.length > 0) {
-    throw new SchemaValidationError(
-      `Stored data for ${context} does not match the current schema \u2014 schema drift? ${summarizeIssues(result.issues)}`,
-      result.issues,
-      "output"
-    );
-  }
-  return result.value;
-}
-function summarizeIssues(issues) {
-  const shown = issues.slice(0, 3).map((issue) => {
-    const pathStr = formatPath(issue.path);
-    return `${pathStr}: ${issue.message}`;
-  });
-  const suffix = issues.length > 3 ? ` (+${issues.length - 3} more)` : "";
-  return shown.join("; ") + suffix;
-}
-function formatPath(path) {
-  if (!path || path.length === 0) return "root";
-  return path.map(
-    (segment) => typeof segment === "object" && segment !== null ? String(segment.key) : String(segment)
-  ).join(".");
-}
-
-// src/kernel/enclave/record-keys/record-codec.ts
-var RecordCodec = class _RecordCodec {
-  constructor(ctx) {
-    this.ctx = ctx;
-  }
-  ctx;
-  /**
-   * @internal Update the live Via pipeline this codec's at-rest hooks read
-   * (#638 Task 3) — called by `via-graph-wiring.ts#applyTaintOverlay` right
-   * after it reassigns `Collection.via`, so `hasAtRestHooks`/`encodeAtRest`/
-   * `decodeAtRest` see the newly-added `taint` binding instead of the
-   * pipeline snapshot captured when this codec was constructed.
-   */
-  setVia(via) {
-    this.ctx.via = via;
-  }
-  /** Sealed-slot key material for this codec's collection, for a given per-record CEK (or none). */
-  sealKeyMaterial(cek) {
-    return {
-      collection: this.ctx.name,
-      ...cek !== void 0 ? { cek } : {},
-      getDEK: () => this.ctx.getDEK()
-    };
-  }
-  /**
-   * Build the `ViaCryptoCtx` handed to a binding's `encodeAtRest`/
-   * `decodeAtRest` hook: `sealedSlots` pre-bound to `(this.ctx.name,
-   * recordId)` — always threading `cek` when the caller has one, so the
-   * capability's record-binding stays cryptographic rather than degrading
-   * to collection-scope. `reservedEnvelopes`'s DEK resolver forwards its
-   * `collection` argument straight to `this.ctx.getDEK` (#629 Task 4) — it
-   * resolves the RESERVED collection's own DEK (e.g. `_dict_status`), never
-   * `this.ctx.name`'s, matching `Vault.getDEK`'s per-collection-name
-   * resolution (the same resolver `DictionaryHandle` used pre-cutover).
-   */
-  viaCryptoCtx(recordId, cek) {
-    const declaredPrefixes = this.ctx.via?.bindings.flatMap((b) => b.reservedPrefixes ?? []) ?? [];
-    return {
-      sealedSlots: makeSealedSlotCapability(this.ctx, recordId, cek),
-      reservedEnvelopes: makeReservedEnvelopes((collection) => this.ctx.getDEK(collection), declaredPrefixes)
-    };
-  }
-  // ──────────────────────────────────────────────────────────────────────
-  // Low-level literal builders
-  // ──────────────────────────────────────────────────────────────────────
-  /**
-   * Assemble a canonical ciphertext body envelope literal from already-computed
-   * parts. Pure, no crypto. Each call stamps its own `_ts` — provenance carries
-   * a SEPARATE timestamp (computed by the caller), so the two never share one.
-   */
-  static buildEnvelope(p) {
-    return {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: p.version,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: p.iv,
-      _data: p.data,
-      ...p.by !== void 0 ? { _by: p.by } : {},
-      ...p.cek !== void 0 ? { _cek: p.cek } : {},
-      ...p.provenance !== void 0 ? { _source: p.provenance.source, _sourceTs: p.provenance.sourceTs } : {},
-      ...p.extra ?? {}
-    };
-  }
-  /** Plaintext (`_iv:''`) body envelope — the `!storeCiphertext` shape. */
-  static buildPlaintextEnvelope(p) {
-    return {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: p.version,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: "",
-      _data: p.data,
-      ...p.by !== void 0 ? { _by: p.by } : {},
-      ...p.provenance !== void 0 ? { _source: p.provenance.source, _sourceTs: p.provenance.sourceTs } : {}
-    };
-  }
-  // ──────────────────────────────────────────────────────────────────────
-  // Write path
-  // ──────────────────────────────────────────────────────────────────────
-  /**
-   * Build a debug-plaintext envelope: the record's own fields inlined as
-   * top-level keys beside the reserved `_`-metadata, with `_debug: 1` and an
-   * empty `_data`. Lets native store tooling read the record without
-   * unwrapping. Only reached for user collections under `debugPlaintext`
-   * (see {@link encryptRecord}). Rejects `_`-prefixed record fields, which
-   * would collide with the reserved metadata namespace.
-   */
-  buildDebugEnvelope(record, version, source, sourceTs) {
-    const rec = record;
-    for (const key of Object.keys(rec)) {
-      if (key.startsWith("_")) throw new DebugReservedFieldError(this.ctx.name, key);
-    }
-    return {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: version,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: "",
-      _data: "",
-      _by: this.ctx.actor,
-      _debug: NOYDB_FORMAT_VERSION,
-      ...this.ctx.provenance && source !== void 0 ? { _source: source, _sourceTs: sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : {},
-      ...rec
-    };
-  }
-  /**
-   * Encrypt a JSON body into an envelope.
-   *
-   * When `cek` is supplied (per-record CEK collections), the body is
-   * encrypted under the CEK and the CEK is AES-KW-wrapped under the
-   * collection DEK and stamped on `_cek`. When `cek` is omitted, the legacy
-   * path encrypts the body directly under the collection DEK — byte-identical
-   * to pre-CEK behaviour, so non-adopting collections pay nothing.
-   */
-  async encryptJsonString(json, version, cek, source, sourceTs) {
-    const by = this.ctx.actor;
-    const provenance = this.ctx.provenance && source !== void 0 ? { source, sourceTs: sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : void 0;
-    if (!this.ctx.storeCiphertext) {
-      return _RecordCodec.buildPlaintextEnvelope({ version, data: json, by, provenance });
-    }
-    const dek = await this.ctx.getDEK();
-    if (cek !== void 0) {
-      const { iv: iv2, data: data2 } = await encrypt(json, cek);
-      const wrapped = await wrapCek(cek, dek);
-      return _RecordCodec.buildEnvelope({ version, iv: iv2, data: data2, by, cek: wrapped, provenance });
-    }
-    const { iv, data } = await encrypt(json, dek);
-    return _RecordCodec.buildEnvelope({ version, iv, data, by, provenance });
-  }
-  async encryptRecord(record, version, cek, source, sourceTs, vdig, id) {
-    if (!this.ctx.storeCiphertext && this.ctx.debugPlaintext && !this.ctx.name.startsWith("_")) {
-      return this.buildDebugEnvelope(record, version, source, sourceTs);
-    }
-    if (this.ctx.storeCiphertext) {
-      const declared = this.ctx.vdigFields;
-      const storedClassified = /* @__PURE__ */ new Set();
-      if (vdig?.prev?._vdig) for (const k of Object.keys(vdig.prev._vdig)) storedClassified.add(k);
-      if (vdig?.prev?._bidx) for (const k of Object.keys(vdig.prev._bidx)) storedClassified.add(k);
-      if (this.ctx.classifiedMarkerDigestOnly !== void 0) {
-        for (const k of await this.ctx.classifiedMarkerDigestOnly()) storedClassified.add(k);
-      }
-      let undeclared;
-      for (const field of storedClassified) {
-        if (declared === null || !declared.has(field)) {
-          undeclared = field;
-          break;
-        }
-      }
-      if (undeclared !== void 0) {
-        throw new ClassifiedConfigError(
-          this.ctx.name,
-          `this collection has classified digest-only field "${undeclared}" but this handle does not declare it \u2014 refusing to write (would drop its tag or serialize the secret as plaintext)`
-        );
-      }
-    }
-    let openRecord = record;
-    let sealed;
-    if (this.ctx.storeCiphertext && this.ctx.via?.hasAtRestHooks) {
-      if (id === void 0) {
-        throw new Error(
-          `RecordCodec.encryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this write path supplied no record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
-        );
-      }
-      const src = record;
-      const result = await this.ctx.via.encodeAtRest(src, this.viaCryptoCtx(id, cek));
-      openRecord = result.record;
-      if (result.sealed !== void 0) {
-        sealed = {};
-        for (const [field, ref] of Object.entries(result.sealed)) sealed[field] = `${ref.iv}:${ref.data}`;
-      }
-    } else if (this.ctx.storeCiphertext && this.ctx.sensitiveFields.size > 0) {
-      const src = record;
-      const result = await sealFields(src, this.ctx.sensitiveFields, this.sealKeyMaterial(cek));
-      if (result.sealed !== void 0) {
-        sealed = result.sealed;
-        openRecord = result.openRecord;
-      }
-    }
-    let vdigOut;
-    let bidxOutMap;
-    if (this.ctx.vdigFields !== null && this.ctx.vdigFields.size > 0 && this.ctx.storeCiphertext) {
-      if (vdig === void 0) {
-        throw new Error(
-          `RecordCodec.encryptRecord: collection "${this.ctx.name}" declares digest-only classified fields but this write path supplied no { id, prev } context \u2014 it would silently destroy _vdig (C6). Caller bug.`
-        );
-      }
-      if (cek === void 0) {
-        throw new Error(
-          `RecordCodec.encryptRecord: digest-only fields require a per-record CEK (R1 invariant) \u2014 collection "${this.ctx.name}" wrote without one. Caller bug.`
-        );
-      }
-      const open = { ...openRecord };
-      const out = {};
-      const bidxOut = {};
-      let bidxDek;
-      for (const [field, policy] of this.ctx.vdigFields) {
-        const value = open[field];
-        const prevBlob = vdig.prev?._vdig?.[field];
-        if (vdig.prev?._sealed?.[field] !== void 0) {
-          throw new ClassifiedConfigError(
-            this.ctx.name,
-            `field "${field}" carries a recoverable _sealed slot from a previous storage form \u2014 recoverable \u2194 digest-only transitions are refused (R6); migrate explicitly`
-          );
-        }
-        if (value === void 0) {
-          if (prevBlob !== void 0) {
-            out[field] = prevBlob;
-            const prevTag = vdig.prev?._bidx?.[field];
-            if (prevTag !== void 0) bidxOut[field] = prevTag;
-          }
-          continue;
-        }
-        if (value === null) {
-          delete open[field];
-          continue;
-        }
-        if (typeof value !== "string") {
-          throw new ValidationError(
-            `digest-only classified field "${field}" in "${this.ctx.name}" must be a string (rotate) or null (clear), got ${typeof value}`
-          );
-        }
-        out[field] = await mintVdigSlot(value, policy, prevBlob, cek, this.ctx.name, vdig.id, field);
-        if (policy.equatable === true) {
-          if (bidxDek === void 0) bidxDek = await this.ctx.getDEK();
-          const normalized = normalizeForVerify(policy.normalize, value);
-          bidxOut[field] = await mintBidxTag(normalized, bidxDek, this.ctx.name, field);
-        }
-        delete open[field];
-      }
-      openRecord = open;
-      if (Object.keys(out).length > 0) vdigOut = out;
-      if (Object.keys(bidxOut).length > 0) bidxOutMap = bidxOut;
-    }
-    const base = await this.encryptJsonString(JSON.stringify(openRecord), version, cek, source, sourceTs);
-    const withSealed = sealed ? { ...base, _sealed: sealed } : base;
-    const withVdig = vdigOut ? { ...withSealed, _vdig: vdigOut } : withSealed;
-    const withBidx = bidxOutMap ? { ...withVdig, _bidx: bidxOutMap } : withVdig;
-    if (!this.ctx.deterministicFields || !this.ctx.storeCiphertext) return withBidx;
-    const dek = await this.ctx.getDEK();
-    const detKey = await deriveDeterministicKey(dek);
-    const rec = record;
-    const det = {};
-    for (const field of this.ctx.deterministicFields) {
-      if (this.ctx.sensitiveFields.has(field)) continue;
-      if (this.ctx.vdigFields?.has(field)) continue;
-      const value = rec[field];
-      if (value === void 0 || value === null) continue;
-      const plaintext = typeof value === "string" ? value : JSON.stringify(value);
-      const { iv, data } = await encryptDeterministic(plaintext, detKey, `${this.ctx.name}/${field}`);
-      det[field] = `${iv}:${data}`;
-    }
-    if (Object.keys(det).length === 0) return withBidx;
-    return { ...withBidx, _det: det };
-  }
-  // ──────────────────────────────────────────────────────────────────────
-  // Read path
-  // ──────────────────────────────────────────────────────────────────────
-  /**
-   * Resolve the per-record CEK for a stored envelope, or `undefined` for a
-   * legacy (`_cek`-absent) envelope. Unwraps `_cek` under the collection DEK and
-   * memoises it in the CEK cache under `id` (when supplied) so repeated reads of
-   * the same record skip the unwrap. Shared by the body-decrypt path
-   * ({@link decryptJsonString}) and the sealed-field path ({@link decryptRecord}
-   * / {@link toCacheRecord}) so both agree on the record's key.
-   */
-  async resolveEnvelopeCek(envelope, id) {
-    if (envelope._cek === void 0) return void 0;
-    const cached = id !== void 0 ? this.ctx.cekCache?.get(id) : void 0;
-    if (cached !== void 0) return cached;
-    const dek = await this.ctx.getDEK();
-    const cek = await unwrapCek(envelope._cek, dek);
-    if (id !== void 0) this.ctx.cekCache?.set(id, cek, 1);
-    return cek;
-  }
-  /**
-   * Low-level: decrypt an envelope and return the raw JSON string.
-   *
-   * `_cek` presence is the format discriminant (NOT `this.perRecordCek`),
-   * so a mixed vault — and a recipient that never opted into
-   * `perRecordKeys` — decrypts both legacy and CEK records:
-   *  - `_cek` present → unwrap the CEK under the collection DEK, decrypt the
-   *    body under the CEK (cache the unwrapped CEK so repeated reads skip it).
-   *  - `_cek` absent → legacy path, body decrypts directly under the
-   *    collection DEK.
-   *
-   * The optional `id` lets reads populate the CEK cache; it is omitted by
-   * callers (history, conflict merge) that have only the envelope.
-   */
-  async decryptJsonString(envelope, id) {
-    if (isTombstone(envelope, this.ctx.storeCiphertext) || isDeleteMarker(envelope)) return null;
-    if (!this.ctx.storeCiphertext) {
-      if (envelope._debug !== void 0) {
-        const rec = {};
-        for (const [key, value] of Object.entries(envelope)) {
-          if (!key.startsWith("_")) rec[key] = value;
-        }
-        return JSON.stringify(rec);
-      }
-      return envelope._data === "" ? null : envelope._data;
-    }
-    const cek = await this.resolveEnvelopeCek(envelope, id);
-    if (cek !== void 0) return decrypt(envelope._iv, envelope._data, cek);
-    const dek = await this.ctx.getDEK();
-    return decrypt(envelope._iv, envelope._data, dek);
-  }
-  /**
-   * Unseal a single `_sealed[field]` slot to its plaintext value: derive the
-   * per-field key off the collection DEK, AES-GCM-decrypt the `iv:data` blob,
-   * and JSON-parse the result. Shared by both the inline-decrypt path and a
-   * {@link Sealed} handle's `reveal()` — so the on-demand reveal and the eager
-   * materialisation always agree byte-for-byte.
-   */
-  async unsealField(field, blob, cek) {
-    return unsealOneField(field, blob, this.sealKeyMaterial(cek));
-  }
-  /**
-   * Build the `ViaCryptoCtx` for forget()'s per-ref via-erase fold (#629
-   * Task 10) — resolves the live envelope's CEK exactly like
-   * `decryptRecord` does, then delegates to the same capability factory
-   * `encodeAtRest`/`decodeAtRest` use.
-   */
-  async eraseCryptoCtx(id, live) {
-    return this.viaCryptoCtx(id, await this.resolveEnvelopeCek(live, id));
-  }
-  /**
-   * Classify a live envelope's `_sealed` slots for crypto-shred completeness.
-   * `forget()` drops `_cek`/`_sealed` but
-   * RETAINS the collection DEK, so only a slot keyed off the per-record CEK is
-   * genuinely shredded by the tombstone; a legacy slot keyed off the
-   * collection DEK survives in any synced/backup copy.
-   *
-   * Mirrors {@link unsealField}'s dual-read split: try the CEK-derived key per
-   * slot — success → `shreddable`, AES-GCM auth failure → `dekResidue`. With no
-   * `_cek` (pure legacy collection-DEK sealing) ALL slots are residue.
-   */
-  async classifySealedShred(live) {
-    const slots = [];
-    if (live._vdig !== void 0 && live._cek !== void 0) {
-      for (const field of Object.keys(live._vdig)) {
-        slots.push({
-          field,
-          class: live._bidx?.[field] !== void 0 ? "live-shreddable+dekResidue-in-backups" : "shreddable"
-        });
-      }
-    }
-    const sealed = live._sealed;
-    if (sealed === void 0) return { slots };
-    const cek = await this.resolveEnvelopeCek(live);
-    for (const [field, blob] of Object.entries(sealed)) {
-      if (cek === void 0) {
-        slots.push({ field, class: "dekResidue" });
-        continue;
-      }
-      const { iv, data } = parseSealedSlot(blob);
-      try {
-        await decrypt(iv, data, await deriveSealedFieldKeyFromCek(cek, this.ctx.name, field));
-        slots.push({ field, class: "shreddable" });
-      } catch {
-        slots.push({ field, class: "dekResidue" });
-      }
-    }
-    return { slots };
-  }
-  /**
-   * Build a non-leaking {@link Sealed} handle over a sealed field's ciphertext.
-   * The handle captures only the ciphertext `blob` and a closure to
-   * {@link unsealField}; the plaintext is never stored on it — so the handle
-   * may sit in the working-set cache (or be logged/serialised) without
-   * exposing the value, which decrypts only on `reveal()`.
-   */
-  makeSealedHandle(field, blob, cek) {
-    return makeHandleProducer(this.sealKeyMaterial(cek))(field, blob);
-  }
-  /**
-   * Replace a record's declared sensitive fields with {@link Sealed} handles
-   * built from the just-written envelope's `_sealed` slots, leaving every
-   * other field as its plaintext value. Used to populate the cache on the
-   * write path without ever materialising sealed plaintext into it. Returns
-   * `record` untouched when the collection seals nothing.
-   */
-  async toCacheRecord(record, envelope, id) {
-    const sealed = envelope._sealed;
-    if (sealed === void 0 || !this.ctx.storeCiphertext || this.ctx.sensitiveFields.size === 0) {
-      return record;
-    }
-    const cek = await this.resolveEnvelopeCek(envelope, id);
-    const clone = { ...record };
-    for (const [field, blob] of Object.entries(sealed)) {
-      clone[field] = this.makeSealedHandle(field, blob, cek);
-    }
-    return clone;
-  }
-  /**
-   * Decrypt an envelope into a record of type `T`.
-   *
-   * When a schema is attached, the decrypted value is validated before
-   * being returned. A divergence between the stored bytes and the
-   * current schema throws `SchemaValidationError` with
-   * `direction: 'output'` — silently returning drifted data would
-   * propagate garbage into the UI and break the whole point of having
-   * a schema.
-   *
-   * `skipValidation` exists for history reads: when calling
-   * `getVersion()` the caller is explicitly asking for an old snapshot
-   * that may predate a schema change, so validating it would be a
-   * false positive. Every non-history read leaves this flag `false`.
-   */
-  async decryptRecord(envelope, opts = {}) {
-    const json = await this.decryptJsonString(envelope, opts.id);
-    if (json === null) return null;
-    let parsed = JSON.parse(json);
-    if (this.ctx.crdtMode && parsed !== null && typeof parsed === "object" && "_crdt" in parsed) {
-      parsed = this.ctx.crdtStrategy.resolveCrdtSnapshot(parsed);
-    }
-    let record = parsed;
-    if (envelope._sealed !== void 0 && this.ctx.storeCiphertext) {
-      const sealedCek = await this.resolveEnvelopeCek(envelope, opts.id);
-      if (this.ctx.via?.hasAtRestHooks) {
-        if (opts.id === void 0) {
-          throw new Error(
-            `RecordCodec.decryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this read path supplied no record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
-          );
-        }
-        const sealedRefs = {};
-        for (const [field, blob] of Object.entries(envelope._sealed)) {
-          const { iv, data } = parseSealedSlot(blob);
-          sealedRefs[field] = { iv, data };
-        }
-        record = await this.ctx.via.decodeAtRest(
-          record,
-          sealedRefs,
-          this.viaCryptoCtx(opts.id, sealedCek),
-          { asHandles: opts.sealedAsHandles === true }
-        );
-      } else {
-        record = await unsealFields(
-          record,
-          envelope._sealed,
-          this.sealKeyMaterial(sealedCek),
-          { asHandles: opts.sealedAsHandles === true }
-        );
-      }
-    }
-    const sealedAsHandles = opts.sealedAsHandles === true && envelope._sealed !== void 0;
-    if (this.ctx.schema !== void 0 && !opts.skipValidation && !sealedAsHandles) {
-      record = await validateSchemaOutput(
-        this.ctx.schema,
-        record,
-        `${this.ctx.name}@v${envelope._v}`
-      );
-    }
-    return record;
-  }
-};
-
-// src/kernel/enclave/record-keys/sealing.ts
-var subtle = globalThis.crypto.subtle;
-var SEALED_CEK_NS = "_sealed_cek";
-async function sealRecordToHost(ctx, collection, id, hostSealer, opts) {
-  if (collection.includes("/")) throw new ValidationError(`sealRecordToHost: collection "${collection}" must not contain "/"`);
-  if (id.includes("/")) throw new ValidationError(`sealRecordToHost: id "${id}" must not contain "/"`);
-  if (Number.isNaN(Date.parse(opts.expiresAt))) {
-    throw new ValidationError(`sealRecordToHost: expiresAt "${opts.expiresAt}" is not a valid ISO 8601 timestamp`);
-  }
-  const live = await ctx.adapter.get(ctx.vault, collection, id);
-  if (!live || live._cek === void 0) {
-    throw new RecordCekNotFoundError(collection, id);
-  }
-  const dek = await ctx.getDEK(collection);
-  const cek = await unwrapCek(live._cek, dek);
-  const rawCek = await subtle.exportKey("raw", cek);
-  const cekB64 = bufferToBase64(rawCek);
-  const hint = await hostSealer.publishRecipientHint();
-  if (hint.pid.includes("/")) throw new ValidationError(`sealRecordToHost: recipient pid "${hint.pid}" must not contain "/"`);
-  const binding = {
-    collection,
-    id,
-    cek: cekB64,
-    expiresAt: opts.expiresAt
-  };
-  const sealed = await hostSealer.sealForRecipient(
-    new TextEncoder().encode(JSON.stringify(binding)),
-    hint
-  );
-  const delivery = {
-    v: 1,
-    _noydb_sealed_cek: 1,
-    pid: hint.pid,
-    payload: bufferToBase64(sealed),
-    expiresAt: opts.expiresAt
-  };
-  const envelopeKey = `${collection}/${id}/${hint.pid}`;
-  const prior = await ctx.adapter.get(ctx.vault, SEALED_CEK_NS, envelopeKey);
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: (prior?._v ?? 0) + 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    // AES-GCM bypassed — the sealing layer is the security boundary, exactly
-    // like the managed-passphrase `_meta/sealed-passphrase` envelope.
-    _iv: "",
-    _data: JSON.stringify(delivery),
-    ...ctx.actor ? { _by: ctx.actor } : {}
-  };
-  await ctx.adapter.put(ctx.vault, SEALED_CEK_NS, envelopeKey, env);
-  return { pid: hint.pid, envelopeKey };
-}
-async function revokeSealedRecord(ctx, collection, id, pid, opts) {
-  if (opts?.hard === true) {
-    await rotateRecordCek(ctx, collection, id);
-    return;
-  }
-  await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, `${collection}/${id}/${pid}`);
-}
-async function rotateRecordCek(ctx, collection, id) {
-  const live = await ctx.adapter.get(ctx.vault, collection, id);
-  if (!live || live._cek === void 0) {
-    throw new RecordCekNotFoundError(collection, id);
-  }
-  const dek = await ctx.getDEK(collection);
-  const oldCek = await unwrapCek(live._cek, dek);
-  const json = await decrypt(live._iv, live._data, oldCek);
-  const newCek = await generateDEK();
-  const { iv, data } = await encrypt(json, newCek);
-  let sealedOut;
-  if (live._sealed !== void 0) {
-    const out = {};
-    for (const [field, slot] of Object.entries(live._sealed)) {
-      const plaintext = await dualReadSealedSlot(slot, field, collection, oldCek, dek);
-      const resealed = await encrypt(plaintext, await deriveSealedFieldKeyFromCek(newCek, collection, field));
-      out[field] = `${resealed.iv}:${resealed.data}`;
-    }
-    sealedOut = out;
-  }
-  let vdigOut;
-  if (live._vdig !== void 0) {
-    const out = {};
-    for (const [field, blob] of Object.entries(live._vdig)) {
-      const payload = await openVdigPayload(blob, oldCek, collection, id, field);
-      out[field] = await sealVdigPayload(payload, newCek, collection, id, field);
-    }
-    vdigOut = out;
-  }
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: live._v + 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: iv,
-    _data: data,
-    _cek: await wrapCek(newCek, dek),
-    ...ctx.actor ? { _by: ctx.actor } : {},
-    ...live._tier !== void 0 ? { _tier: live._tier } : {},
-    ...live._det !== void 0 ? { _det: live._det } : {},
-    // `_bidx` (equality-index tag) is DEK-rooted and CEK-independent, so it is
-    // carried forward VERBATIM — not recomputed — unlike `_vdig`/`_sealed`
-    // below, which are CEK-bound and must be re-sealed under the new CEK.
-    // Dropping this line would silently orphan the equality index on rotation
-    // (the #306 Slice-A data-loss bug, replayed on the index).
-    ...live._bidx !== void 0 ? { _bidx: live._bidx } : {},
-    // Re-encrypt sealed (`sensitive`) fields under the new CEK. Sealed
-    // keys derive off the per-record CEK, so the rotated record's old CEK is
-    // destroyed here — carrying the old `_sealed` slots forward verbatim would
-    // orphan them (unreadable under the new CEK). `sealedOut` holds the slots
-    // dual-read from the old CEK (or the legacy DEK) and re-sealed under newCek.
-    ...sealedOut !== void 0 ? { _sealed: sealedOut } : {},
-    ...vdigOut !== void 0 ? { _vdig: vdigOut } : {}
-  };
-  await ctx.adapter.put(ctx.vault, collection, id, env);
-  await ctx.invalidateRecordCaches(collection, id);
-  const prefix = `${collection}/${id}/`;
-  const keys = await ctx.adapter.list(ctx.vault, SEALED_CEK_NS);
-  for (const key of keys) {
-    if (key.startsWith(prefix)) {
-      await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, key);
-    }
-  }
-}
-
-// src/kernel/enclave/record-keys/deterministic.ts
-async function detTargets(ctx, field, value) {
-  const dek = await ctx.getDEK();
-  const detKey = await deriveDeterministicKey(dek);
-  const plaintext = typeof value === "string" ? value : JSON.stringify(value);
-  const context = `${ctx.name}/${field}`;
-  const [current, legacy] = await Promise.all([
-    encryptDeterministic(plaintext, detKey, context),
-    encryptDeterministic(plaintext, dek, context)
-  ]);
-  return [`${current.iv}:${current.data}`, `${legacy.iv}:${legacy.data}`];
-}
-function assertDetField(ctx, field, method) {
-  if (!ctx.deterministicFields || !ctx.deterministicFields.has(field)) {
-    throw new Error(
-      `Collection "${ctx.name}": field "${field}" is not declared in deterministicFields`
-    );
-  }
-  if (!ctx.storeCiphertext) {
-    throw new Error(
-      `Collection "${ctx.name}": ${method} is only meaningful on encrypted collections`
-    );
-  }
-}
-async function findByDet(ctx, field, value) {
-  assertDetField(ctx, field, "findByDet");
-  const [target, legacyTarget] = await detTargets(ctx, field, value);
-  const ids = await ctx.adapter.list(ctx.vault, ctx.name);
-  for (const id of ids) {
-    const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
-    if (!env || !env._det) continue;
-    if (env._det[field] === target || env._det[field] === legacyTarget) {
-      return ctx.codec.decryptRecord(env, { id });
-    }
-  }
-  return null;
-}
-async function queryByDet(ctx, field, value) {
-  assertDetField(ctx, field, "queryByDet");
-  const [target, legacyTarget] = await detTargets(ctx, field, value);
-  const ids = await ctx.adapter.list(ctx.vault, ctx.name);
-  const matches = [];
-  for (const id of ids) {
-    const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
-    if (!env || !env._det) continue;
-    if (env._det[field] === target || env._det[field] === legacyTarget) {
-      const rec = await ctx.codec.decryptRecord(env, { id });
-      if (rec !== null) matches.push(rec);
-    }
-  }
-  return matches;
-}
-
-// src/kernel/enclave/record-keys/envelope-body.ts
-async function openEnvelopeJson(env, key, opts) {
-  if (opts?.encrypted === false) return env._data;
-  if (env._cek !== void 0) {
-    const cek = await unwrapCek(env._cek, key);
-    return decrypt(env._iv, env._data, cek);
-  }
-  return decrypt(env._iv, env._data, key);
-}
-async function writeEnvelopeBody(json, key, opts) {
-  if (opts?.encrypted === false) return { _iv: "", _data: json };
-  if (opts?.perRecordKey === true) {
-    const cek = await generateDEK();
-    const { iv: iv2, data: data2 } = await encrypt(json, cek);
-    const wrapped = await wrapCek(cek, key);
-    return { _iv: iv2, _data: data2, _cek: wrapped };
-  }
-  const { iv, data } = await encrypt(json, key);
-  return { _iv: iv, _data: data };
-}
-function hasPerRecordKey(env) {
-  return env._cek !== void 0;
-}
-function envelopeBodyForHash(env) {
-  if (env._sealed === void 0 && env._vdig === void 0 && env._bidx === void 0) return env._data;
-  const mapPart = (key, map) => {
-    const parts = Object.keys(map).sort().map(
-      (k) => `${JSON.stringify(k)}:${JSON.stringify(map[k])}`
-    );
-    return `${JSON.stringify(key)}:{${parts.join(",")}}`;
-  };
-  const segments = [`"_data":${JSON.stringify(env._data)}`];
-  if (env._sealed !== void 0) segments.push(mapPart("_sealed", env._sealed));
-  if (env._vdig !== void 0) segments.push(mapPart("_vdig", env._vdig));
-  if (env._bidx !== void 0) segments.push(mapPart("_bidx", env._bidx));
-  return `{${segments.join(",")}}`;
-}
-
-export {
-  resolveStableCek,
-  rewrapBodyToDek,
-  makeReservedEnvelopes,
-  validateSchemaInput,
-  validateSchemaOutput,
-  RecordCodec,
-  SEALED_CEK_NS,
-  sealRecordToHost,
-  revokeSealedRecord,
-  rotateRecordCek,
-  findByDet,
-  queryByDet,
-  openEnvelopeJson,
-  writeEnvelopeBody,
-  hasPerRecordKey,
-  envelopeBodyForHash
-};
-//# sourceMappingURL=chunk-XHD3L3JO.js.map