@noy-db/hub 0.3.0-pre.9 → 0.3.0

package/dist/kernel/constants.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Hub-core constants that must be referenceable without pulling any
+ * service chunk. Kept import-free.
+ */
+/** Reserved fleet-wide control-plane vault name. Hub reserves it for an outward orchestration framework's state/control-plane vault. */
+export declare const STATE_VAULT_NAME = "__noydb_state__";
+/**
+ * Soft cap on the JSON-serialized user-envelope payload size. Generous (a
+ * typical profile + preferences + small app annex is ~1 KiB); rejects
+ * accidental "stuff app state in here" anti-patterns.
+ */
+export declare const USER_ENVELOPE_MAX_BYTES: number;
+/**
+ * Reserved store collection name for user envelopes. Starts with `_` so the
+ * keyring grant machinery propagates the DEK to every granted user via the
+ * existing system-collection DEK propagation path in `team/keyring.ts`.
+ */
+export declare const USER_ENVELOPE_COLLECTION = "_users";

package/dist/kernel/debug.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Helpers for reading records out of a *plaintext* store (`encrypt: false`)
+ * with native tooling — the programmatic core of a `noydb cat`-style unwrap.
+ * See the plaintext/debug-store-mode design.
+ */
+import type { EncryptedEnvelope } from './types.js';
+/**
+ * Extract the record from a plaintext stored envelope, handling both layouts:
+ *
+ *   - **classic plaintext** (`encrypt: false`): the record is JSON in `_data`.
+ *   - **debugPlaintext**: the record's fields are inlined beside the
+ *     `_`-prefixed metadata (marked by `_debug`).
+ *
+ * Returns `null` for an empty/absent body. Throws if handed an **encrypted**
+ * envelope (non-empty `_iv`) — there is no key here; decrypt through the vault
+ * instead. Intended for record envelopes, not blob chunks.
+ *
+ * @example
+ * ```ts
+ * // node script over a to-file store, no vault needed:
+ * const env = JSON.parse(readFileSync('data/acme/invoices/inv-1.json', 'utf8'))
+ * console.log(readPlaintextRecord(env)) // → { id: 'inv-1', total: '120.00', … }
+ * ```
+ */
+export declare function readPlaintextRecord<T = Record<string, unknown>>(envelope: EncryptedEnvelope): T | null;

package/dist/kernel/enclave/broker/proof.d.ts

@@ -0,0 +1,154 @@
+/**
+ * Credential-broker proof crypto (#479, credential-broker spec §3).
+ *
+ * The `_broker` seed (32 random bytes, decrypted from `_broker/<brokerId>` by
+ * the party layer) is never transmitted. Instead, a **proof key** is
+ * HKDF-derived from it, domain-separated per `(vaultId, brokerId)`, and the
+ * derived bits are registered with the broker host once at enrol. Steady
+ * state, the client re-derives the same key from the seed and signs a
+ * **canonical** string binding the request's identity/context, so the broker
+ * can verify a fresh HMAC on every mint without ever holding the seed itself.
+ *
+ * ## Derivation (spec §3, follow verbatim)
+ *
+ * ```
+ * hkdf      = importKey('raw', seed, 'HKDF', false, ['deriveBits'])
+ * proofBits = deriveBits({ name:'HKDF', hash:'SHA-256',
+ *                          salt: utf8(BROKER_PROOF_DOMAIN),
+ *                          info: utf8(JSON.stringify([BROKER_PROOF_DOMAIN, vaultId, brokerId])) },
+ *                        hkdf, 256)
+ * proofKey  = importKey('raw', proofBits, { name:'HMAC', hash:'SHA-256' }, false, ['sign'])
+ * proof     = base64(sign('HMAC', proofKey, utf8(canonical)))
+ * ```
+ *
+ * `BROKER_PROOF_DOMAIN` is both the HKDF salt and the first `info` array
+ * element (the injective-JSON-array convention `deriveClassifyIndexKey`
+ * established — see `classify/bidx.ts`). `BROKER_PROOF_VERSION` is the
+ * separate MAC version tag, the first element of the `canonical` array.
+ *
+ * ## Canonical (spec §2 step 3)
+ *
+ * `JSON.stringify([BROKER_PROOF_VERSION, vaultId, endpointOrigin, brokerId,
+ * profile ?? '', instancePid ?? '', challenge, expiresAt])` — every binding
+ * field folded into ONE MAC input:
+ *  - `vaultId` (V1), `challenge` (V3), `expiresAt` (V4) — verbatim strings,
+ *    never reparsed/reformatted (F8): a byte-identical ISO string is
+ *    required, so e.g. `Z` vs `+00:00` for the same instant fails.
+ *  - `profile ?? ''` (F1) — a proof captured at one profile cannot be
+ *    replayed at another.
+ *  - `endpointOrigin` (F4) — a proof cannot be relayed to a different broker
+ *    endpoint reusing the same `brokerId`.
+ *  - `instancePid ?? ''` (F7) — an EMPTY STRING `instancePid` is forbidden in
+ *    both {@link computeBrokerProof} and {@link verifyBrokerProof}: absent
+ *    (the field omitted) and `''` must stay distinguishable, or `?? ''`
+ *    would alias "no instance" onto a real registered instance.
+ *
+ * ## Verify order (spec §3, non-negotiable, F2/F6)
+ *
+ * {@link verifyBrokerProof} MUST, in this exact order: (1) burn the challenge
+ * via `consumeChallenge` FIRST and short-circuit `false` before any MAC work
+ * (F2 — burn-on-presentation, not burn-on-success); (2) recompute the
+ * canonical and compare with `crypto.subtle.verify('HMAC', …)` — portable,
+ * constant-time, never a manual byte compare or Node `timingSafeEqual` (F6);
+ * (3) assert `now < expiresAt` — the client clock is never trusted, so this
+ * check only matters once the MAC (which covers `expiresAt`) has verified.
+ *
+ * ## Zeroing (F5)
+ *
+ * `seed` and the transient HKDF output are raw, durable secret material —
+ * the `recovery.ts:276-307` `try{}finally{secret.fill(0)}` discipline, not
+ * the ephemeral-CEK happy-path zeroing elsewhere. {@link computeBrokerProof}
+ * zeroes the `seed` argument in a `finally` on every path including a throw;
+ * {@link deriveBrokerProofKey} zeroes its own transient HKDF-output bytes the
+ * same way. {@link deriveBrokerProofBits} does not zero `seed` — it exists
+ * so the party layer can register the raw bits at one-time enrol (the value
+ * that must survive the call to be base64-encoded and POSTed).
+ *
+ * @module
+ */
+import type { EnclaveKey } from '../crypto.js';
+/** HKDF salt domain for the broker proof key — also the first `info` array element. */
+export declare const BROKER_PROOF_DOMAIN = "noydb-broker-proof";
+/** MAC version tag — the first element of the `canonical` array signed/verified. */
+export declare const BROKER_PROOF_VERSION = "noydb-broker-proof-v1";
+/** The canonical-binding fields a client supplies alongside `vaultId`/`brokerId` (spec §2 step 3). */
+export interface BrokerProofCanonicalParts {
+    readonly endpointOrigin: string;
+    readonly profile?: string | undefined;
+    readonly instancePid?: string | undefined;
+    readonly challenge: string;
+    readonly expiresAt: string;
+}
+/** A freshly-minted, server-random single-use challenge (spec §2 step 2). */
+export interface IssuedChallenge {
+    readonly challenge: string;
+    readonly expiresAt: string;
+}
+/** Arguments the broker host passes to verify a submitted proof (spec §3). */
+export interface VerifyBrokerProofArgs {
+    /**
+     * Atomically test-and-delete the challenge, returning whether it was still
+     * fresh (unconsumed and unexpired-from-the-store's-perspective). MUST burn
+     * on presentation, not on successful verification (F2).
+     */
+    readonly consumeChallenge: (challenge: string) => Promise<boolean>;
+    /** The registered proof key's raw bytes, already KMS-unwrapped by the host (§7). */
+    readonly registeredProofKey: Uint8Array;
+    readonly vaultId: string;
+    readonly endpointOrigin: string;
+    readonly brokerId: string;
+    readonly profile?: string | undefined;
+    readonly instancePid?: string | undefined;
+    readonly challenge: string;
+    readonly expiresAt: string;
+    /** base64(HMAC-SHA-256(proofKey, canonical)), as submitted by the client. */
+    readonly proof: string;
+}
+/**
+ * The HKDF step: derive the 256-bit proof bits from the `_broker` seed,
+ * domain-separated per `(vaultId, brokerId)`. Returns the raw bits — the
+ * value registered with the broker host once at enrol (spec §2 step 2/3).
+ * Does not mutate or zero `seed`; the caller owns the seed's lifecycle.
+ */
+export declare function deriveBrokerProofBits(seed: Uint8Array, vaultId: string, brokerId: string): Promise<Uint8Array>;
+/**
+ * Derive the steady-state, non-extractable `['sign']` HMAC proof key from
+ * the `_broker` seed. Zeroes the transient HKDF-output bytes in a `finally`
+ * once the key has been imported (F5) — the raw bits never leave this
+ * function in usable form after import.
+ */
+export declare function deriveBrokerProofKey(seed: Uint8Array, vaultId: string, brokerId: string): Promise<EnclaveKey>;
+/**
+ * Compose derive + sign for the client: re-derive the proof key from the
+ * seed and sign the canonical over `canonicalParts` (spec §2 step 3).
+ *
+ * Rejects an empty-string `instancePid` (F7 — absent is fine, `''` is not).
+ * Zeroes the `seed` argument in a `finally` on EVERY path including a throw
+ * (F5, durable-secret discipline) — the transient HKDF bits are zeroed one
+ * layer down, inside {@link deriveBrokerProofKey}.
+ */
+export declare function computeBrokerProof(seed: Uint8Array, vaultId: string, brokerId: string, canonicalParts: BrokerProofCanonicalParts): Promise<string>;
+/**
+ * Host-side nonce mint: 32 random bytes, base64-encoded, plus an ISO
+ * `expiresAt` at most `ttlMs` (default 60 s) in the future. The caller
+ * (the broker host) persists both returned strings **verbatim** and MACs
+ * those exact bytes on verify — never a reparsed/reformatted copy (F8).
+ */
+export declare function issueChallenge(opts?: {
+    ttlMs?: number;
+}): IssuedChallenge;
+/**
+ * Verify a submitted broker proof. Order is NON-NEGOTIABLE (spec §3):
+ *
+ * 1. `await consumeChallenge(challenge)` FIRST — burn-and-check-fresh; a
+ *    not-fresh (already-consumed or unknown) challenge short-circuits to
+ *    `false` before any MAC work (F2).
+ * 2. Empty-string `instancePid` is rejected (F7), then the canonical is
+ *    recomputed over the verbatim `endpointOrigin`/`brokerId`/`profile`/
+ *    `instancePid`/`challenge`/`expiresAt` and compared via
+ *    `crypto.subtle.verify('HMAC', …)` — portable, constant-time, never a
+ *    manual compare or Node `timingSafeEqual` (F6).
+ * 3. `now < expiresAt` — the client clock is never trusted; `expiresAt`
+ *    rides inside the already-verified MAC (F4/F8).
+ */
+export declare function verifyBrokerProof(args: VerifyBrokerProofArgs): Promise<boolean>;

package/dist/kernel/enclave/classify/bidx.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Blind-index slow-tag primitive for classified `equatable` fields (stage 2).
+ *
+ * `mintBidxTag` mints a deterministic, key-and-cost-gated tag —
+ * `COST_BYTE ‖ HMAC-SHA256(K_idx, PBKDF2-SHA256(normalized, salt_cf))` — that
+ * lets `find.ts` do blind equality lookup over an otherwise-opaque field
+ * without ever storing the plaintext or a fast dictionary-crackable digest.
+ *
+ * Rationale (M-2/I3, spec §4/Crypto #1):
+ *  - The outer HMAC is **keyed** by `K_idx`, a DEK-derived key never seen by
+ *    the store. A key-less adversary (store access only) cannot mint a
+ *    candidate tag to test against the index at all — the HMAC blocks the
+ *    classic "key-less dictionary attack" a plain digest would invite.
+ *  - The inner `pbkdf2VerifyDigest` (stage-2, `digest.ts`) reuses the
+ *    existing 600K-iteration cost floor, so even a **DEK holder** who can
+ *    compute `K_idx` still pays the PBKDF2 cost per guess — minting is not
+ *    free just because you crossed the door.
+ *  - Neither control is the real security boundary: the DOOR (who is ever
+ *    handed the DEK to begin with) is. These two costs only shape the
+ *    economics for whoever is already inside; they do not substitute for
+ *    access control.
+ *
+ * `K_idx` and `salt_cf` are separate HKDF derivations off the same DEK
+ * (L-1, #554 precedent: dedicated keys from day one, no shared/legacy form) —
+ * sign-key hygiene, not `HMAC(K_idx, const)`. Both derivations are
+ * domain-separated per `(collection, field)` so a tag cannot be replayed
+ * across fields or collections (join-attack separation).
+ *
+ * `CURRENT_COST_BYTE` is a 1-byte discriminator prefixed onto every tag so a
+ * future iteration-tier bump can mint new tags while old ones still parse:
+ * an unknown discriminator is a cheap, immediate non-match instead of a
+ * PBKDF2 run at the wrong iteration count.
+ *
+ * @module
+ */
+import type { EnclaveKey } from '../crypto.js';
+/** HKDF salt domain for the `K_idx` (blind-index HMAC key) derivation. */
+export declare const CLASSIFY_INDEX_KEY_DOMAIN = "noydb-classify-index-v1";
+/** HKDF salt domain for the `salt_cf` (per collection/field PBKDF2 salt) derivation. */
+export declare const CLASSIFY_INDEX_SALT_DOMAIN = "noydb-classify-index-salt-v1";
+/** Cost-byte discriminator: version 1, iteration-tier 600K. */
+export declare const COST_BYTE_V1 = 1;
+/** The cost byte new tags are minted at. */
+export declare const CURRENT_COST_BYTE = 1;
+/**
+ * Map a tag's cost-byte discriminator to its PBKDF2 iteration count.
+ * An unrecognized discriminator returns `null` — a mismatched/legacy byte
+ * is a cheap non-match, never a PBKDF2 run at the wrong tier.
+ */
+export declare function iterationsForCostByte(b: number): number | null;
+/**
+ * Derive the collection+field's dedicated blind-index HMAC key `K_idx` from
+ * the DEK via HKDF-SHA256. Non-extractable, `sign`-only — it never leaves
+ * this module in usable form.
+ */
+export declare function deriveClassifyIndexKey(dek: EnclaveKey, collection: string, field: string): Promise<EnclaveKey>;
+/**
+ * Derive the collection+field's dedicated PBKDF2 salt `salt_cf` from the DEK
+ * via a SEPARATE HKDF-deriveBits (distinct from {@link deriveClassifyIndexKey}
+ * — sign-key hygiene, not `HMAC(K_idx, const)`). 32 raw bytes.
+ */
+export declare function deriveClassifyIndexSalt(dek: EnclaveKey, collection: string, field: string): Promise<Uint8Array>;
+/**
+ * Mint a blind-index tag at a given cost byte:
+ * `tag = base64(COST_BYTE ‖ HMAC(K_idx, PBKDF2(normalized, salt_cf, iterations-for(COST_BYTE))))`.
+ * Factored out of {@link mintBidxTag} so `find.ts`'s `computeBidxTarget` can
+ * reuse the same crypto at a caller-chosen cost byte (e.g. to evaluate a
+ * legacy tier) without duplicating the derivation/digest/MAC pipeline.
+ */
+export declare function mintAt(normalized: string, dek: EnclaveKey, collection: string, field: string, costByte: number): Promise<string>;
+/**
+ * Mint a blind-index tag for an already-normalized value at
+ * {@link CURRENT_COST_BYTE}. The caller normalizes once via
+ * `normalizeForVerify` (the shared pipeline with `mintVdigSlot`) —
+ * `mintBidxTag` never re-normalizes.
+ */
+export declare function mintBidxTag(normalized: string, dek: EnclaveKey, collection: string, field: string): Promise<string>;

package/dist/kernel/enclave/classify/compare.d.ts

@@ -0,0 +1,10 @@
+/** Compare exactly-32-byte tags. XOR-accumulate over all 32 bytes, no early exit. */
+export declare function ctEqualTags(a: Uint8Array, b: Uint8Array): boolean;
+/**
+ * Blinded equality of arbitrary-length byte strings: fresh K_e per
+ * comparison (never stored, never reused), HMAC both sides to 32-byte
+ * tags, then ctEqualTags. On the digest path the inputs are already
+ * 32-byte PBKDF2 outputs but still route through this reduction so
+ * there is exactly ONE comparison construction (spec §3 rule 2).
+ */
+export declare function blindedEqual(a: Uint8Array, b: Uint8Array): Promise<boolean>;

package/dist/kernel/enclave/classify/digest.d.ts

@@ -0,0 +1,8 @@
+/** Family KDF constant — matches crypto.ts PBKDF2_ITERATIONS (600K). */
+export declare const VDIG_ITERATIONS = 600000;
+/**
+ * Digest a (pre-normalized) candidate/value to exactly 32 bytes.
+ * PBKDF2-SHA256 with a per-record per-write random salt (§2): verify
+ * digests are non-equatable by construction.
+ */
+export declare function pbkdf2VerifyDigest(value: string, salt: Uint8Array, iterations: number): Promise<Uint8Array>;

package/dist/kernel/enclave/classify/find.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Query-side blind-index target derivation for classified `equatable`
+ * fields (stage 2). `computeBidxTarget` normalizes a caller-supplied
+ * candidate and mints it into the same 33-byte `_bidx` tag shape produced by
+ * `mintBidxTag` (`bidx.ts`), so a caller can string-compare the result
+ * against a stored tag to answer "does this candidate match?" without ever
+ * decrypting or dictionary-attacking the field.
+ *
+ * Discriminator-scan contract (Oracle #4): a scanning caller reads each
+ * stored tag's leading cost-byte discriminator and derives the target tag
+ * **once per distinct discriminator present** — never per-record. `find.ts`
+ * itself only computes a single target for a single requested `costByte`;
+ * the batching-by-discriminator behavior belongs to the scanner
+ * (`findByDigest`, a later task), which calls this function once per
+ * distinct discriminator it encounters at step 2 of its scan.
+ *
+ * An unrecognized `costByte` (unknown or legacy tier not yet supported) is a
+ * cheap `null` non-match — `computeBidxTarget` never runs PBKDF2 at a wrong
+ * iteration tier just to produce a target that could not possibly match.
+ * A legacy tag of a KNOWN older tier remains matchable today by passing that
+ * tier's `costByte` explicitly (v1-only today: `CURRENT_COST_BYTE` is the
+ * only recognized tier, so this is a future-proofing hook, not live behavior
+ * yet).
+ *
+ * @module
+ */
+import type { EnclaveKey } from '../crypto.js';
+import { type VerifyNormalizeMode } from './normalize.js';
+/**
+ * Normalize `candidate` and mint it into a blind-index target tag at
+ * `costByte` (default {@link CURRENT_COST_BYTE}), for string-comparison
+ * against a stored `_bidx` tag. Returns `null` when `costByte` is not a
+ * recognized discriminator — no PBKDF2 is attempted at an unknown/wrong
+ * tier (Oracle #4).
+ */
+export declare function computeBidxTarget(candidate: string, normalize: VerifyNormalizeMode, dek: EnclaveKey, collection: string, field: string, costByte?: number): Promise<string | null>;

package/dist/kernel/enclave/classify/kofn.d.ts

@@ -0,0 +1,7 @@
+/**
+ * k-of-n aggregate for matchGroup (§3). Deliberately a full scan that
+ * never breaks: per-member results must never influence control flow in
+ * a way an observer could time or decompose. Returns ONLY the aggregate.
+ * @module
+ */
+export declare function evaluateKofN(results: readonly boolean[], min: number): boolean;

package/dist/kernel/enclave/classify/normalize.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Preset normalization for verify candidates AND stored comparands (§4).
+ * Both sides of every comparison route through the SAME function so
+ * write-time digests and verify-time candidates agree. @module
+ */
+export type VerifyNormalizeMode = 'password' | 'secret-answer';
+export declare function normalizeForVerify(mode: VerifyNormalizeMode, value: string): string;

package/dist/kernel/enclave/classify/reveal.d.ts

@@ -0,0 +1,10 @@
+import type { EncryptedEnvelope } from '../../types.js';
+import type { EnclaveKey } from '../crypto.js';
+export interface RevealEngineCtx {
+    readonly collection: string;
+    readonly encrypted: boolean;
+    getEnvelope(id: string): Promise<EncryptedEnvelope | null>;
+    resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>;
+    getDEK(): Promise<EnclaveKey>;
+}
+export declare function revealSealedField(ctx: RevealEngineCtx, id: string, field: string): Promise<unknown>;

package/dist/kernel/enclave/classify/vdig.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The `_vdig` slot payload + crypto (stage 2, spec §2).
+ *
+ * A `_vdig[field]` blob is AES-256-GCM `"iv:data"` sealed under an
+ * HKDF(CEK) slot key with AAD = ['noydb-classify-vdig', collection,
+ * recordId, field] (C1 rollback-splice hardening). The AAD is NOT stored —
+ * readers reconstruct it. It is deliberately `_v`-independent: C6's
+ * carry-forward copies blob bytes verbatim across version bumps; the
+ * same-record same-field TEMPORAL rollback residual is detected by the
+ * ledger's conditional `_vdig` binding (envelope-body.ts).
+ *
+ * CEK-ONLY (I3): there is no DEK derivation and no
+ * 'noydb-classify-vdig-dek' salt domain — every vdig slot dies with the
+ * record's `_cek` (forget() shreds it totally; no vdig-dekResidue class).
+ * @module
+ */
+import { type EnclaveKey } from '../crypto.js';
+export declare const VDIG_SALT_DOMAIN = "noydb-classify-vdig";
+export interface VdigDigestEntry {
+    readonly salt: string;
+    readonly hash: string;
+}
+export interface VdigPayload {
+    readonly v: 1;
+    readonly alg: 'PBKDF2-SHA256';
+    readonly iter: number;
+    readonly cur: VdigDigestEntry & {
+        readonly at: string;
+    };
+    /** Previous digests, oldest-first, length ≤ notLastN (cap 8). */
+    readonly ring?: readonly VdigDigestEntry[];
+}
+/** Injective JSON-array AAD — same collision argument as deriveSealedFieldKey. */
+export declare function buildVdigAad(collection: string, recordId: string, field: string): Uint8Array;
+/** HKDF(CEK) → non-extractable AES-256-GCM vdig slot key. CEK-only (I3). */
+export declare function deriveVdigSlotKey(cek: EnclaveKey, collection: string, field: string): Promise<EnclaveKey>;
+export declare function sealVdigPayload(payload: VdigPayload, cek: EnclaveKey, collection: string, recordId: string, field: string): Promise<string>;
+/** Throws TamperedError on any AAD / auth-tag mismatch (C1). */
+export declare function openVdigPayload(blob: string, cek: EnclaveKey, collection: string, recordId: string, field: string): Promise<VdigPayload>;

package/dist/kernel/enclave/classify/verify.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The enclave verify oracle (spec §3). Verdict-only egress: no path
+ * distinguishes "record missing" / "no digest" / "AAD-tamper" / "mismatch"
+ * beyond { ok: false } — existence oracles are oracles too. Every path that
+ * cannot run a real comparison runs ONE dummy PBKDF2 + ONE dummy tag-compare
+ * first (C4), so wall-clock cannot enumerate records/fields/answers. The
+ * text door (verifyTextField) has no real PBKDF2 of its own, so it pays the
+ * pad UNCONDITIONALLY — every outcome, including a real compare, costs the
+ * same one PBKDF2 unit (no inverted exists-vs-absent oracle).
+ * Elevated records (_tier > 0, with-audit tier moves) are non-comparable
+ * through every door and pad-false exactly like missing records (#691) —
+ * the tier-aware read surface is getAtTier, never verify.
+ * Throws are reserved for caller/config bugs (ClassifiedVerifyError /
+ * ClassifiedConfigError) and are exempt from the pad by design (R6 note).
+ * @module
+ */
+import { type EnclaveKey } from '../crypto.js';
+import { type VerifyNormalizeMode } from './normalize.js';
+import type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../types.js';
+export interface VerifyEngineCtx {
+    readonly collection: string;
+    getEnvelope(id: string): Promise<EncryptedEnvelope | null>;
+    resolveCek(env: EncryptedEnvelope): Promise<EnclaveKey | undefined>;
+    getDEK(): Promise<EnclaveKey>;
+    readonly now: () => number;
+}
+export declare function verifyDigestField(ctx: VerifyEngineCtx, id: string, field: string, candidate: string, policy: VdigFieldPolicy): Promise<ClassifiedVerdict>;
+export declare function verifyTextField(ctx: VerifyEngineCtx, id: string, field: string, candidate: string, normalize: VerifyNormalizeMode): Promise<ClassifiedVerdict>;
+export declare function matchGroupFields(ctx: VerifyEngineCtx, id: string, answers: Record<string, string>, members: ReadonlyArray<{
+    readonly field: string;
+    readonly policy: VdigFieldPolicy;
+}>, opts: {
+    readonly min: number;
+}): Promise<{
+    readonly passed: boolean;
+}>;

package/dist/kernel/enclave/classify/write.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Digest-only write engine (C6 rotate branch + notLastN ring, spec §2/§4).
+ * Called ONLY by RecordCodec.encryptRecord — both live inside the enclave.
+ * @module
+ */
+import { type EnclaveKey } from '../crypto.js';
+import type { VdigFieldPolicy } from '../../types.js';
+export declare function mintVdigSlot(rawValue: string, policy: VdigFieldPolicy, prevBlob: string | undefined, cek: EnclaveKey, collection: string, recordId: string, field: string): Promise<string>;