@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/capsule/contract.d.ts

@@ -0,0 +1,159 @@
+/**
+ * The capsule seam (capsule seam spec, Section 2).
+ *
+ * A capsule is hub's crypto interior behind one contract. `enclave-aes` is the
+ * default and ships INSIDE hub, so `npm install @noy-db/hub` alone is a working
+ * noy-db. An alternative binds at BUILD TIME through hub's `imports` map —
+ * deliberately not at runtime: a `createNoydb({ capsule })` option would be a
+ * hot-swap surface, and a build condition lives in build config where the
+ * shipped bundle stays auditable (`npm ls` tells an auditor whether a build is
+ * plaintext-at-rest).
+ *
+ * ⛔ `CapsuleKey` is OPAQUE outside `capsule/`. Never construct, inspect or
+ * serialise one; only pass it between contract functions. A fork may define it
+ * as something that is not a `CryptoKey` at all — hardware-backed,
+ * post-quantum, or null for a capsule that does no encryption.
+ */
+import { NoydbError } from '../kernel/errors.js';
+import type { VdigFieldPolicy } from '../kernel/types.js';
+/** Opaque key at the capsule seam. `CryptoKey` in the reference capsule. */
+export type CapsuleKey = CryptoKey;
+/** Opaque asymmetric pair at the capsule seam. */
+export type CapsuleKeyPair = CryptoKeyPair;
+/**
+ * The groups a capsule may support. A capsule declares its set via
+ * `capabilities()`; a service needing a group asserts at `createNoydb()`.
+ *
+ * `authenticate` and `seal` are what an `enclave-*` MUST support and an
+ * `exclave-*` MUST refuse. That prefix rule is asserted by the conformance
+ * suite from the package name, which is what makes the prefix a trust posture
+ * rather than a naming convention.
+ */
+export type CapsuleGroup = 'authenticate' | 'seal' | 'cipher' | 'digest' | 'sign' | 'codec' | 'sealing' | 'deterministic' | 'classify';
+/**
+ * Thrown at `createNoydb()` when a service needs a group the bound capsule
+ * does not support.
+ *
+ * ⚠️ Never thrown on first write, and never discovered by try/catch probing: a
+ * consumer learns at startup or not at all. A capability discovered mid-write
+ * is a half-built vault.
+ */
+/**
+ * Refuse at CONSTRUCTION when a service needs a capsule group the bound
+ * capsule lacks.
+ *
+ * ⛔ At startup or not at all. A capability discovered on first write is a
+ * half-built vault: some records sealed, a service silently inert, and a
+ * consumer who cannot tell a missing capability from a bug. `capabilities()`
+ * is a set, so this is a membership test — never a try/catch probe against the
+ * primitive itself, which would make "unsupported" and "broken" the same
+ * observation.
+ *
+ * Lives on the CONTRACT, not in the kernel: it depends on nothing but the
+ * declared set, and every capsule's consumers need the same assertion.
+ *
+ * ⚠️ Per-service wiring is deliberately NOT done yet. `enclave-aes` supports
+ * every group, so every call site would be unreachable code behind an
+ * untestable branch. It lands in Stage C with `exclave-plain`, which is the
+ * first capsule that refuses anything. Until then this is exercised against a
+ * stub set — see `__tests__/capsule-capabilities.test.ts`.
+ */
+export declare function assertCapsuleSupports(caps: ReadonlySet<CapsuleGroup>, group: CapsuleGroup, requirer: string): void;
+export declare class CapsuleNotSupportedError extends NoydbError {
+    readonly group: CapsuleGroup;
+    readonly requirer: string;
+    constructor(group: CapsuleGroup, requirer: string);
+}
+/**
+ * The 13 cipher primitives the shared plumbing needs — the ENTIRE surface a
+ * capsule must actually implement.
+ *
+ * ⭐ This is the measurement that shaped Stage C. `enclave-aes` is ~4,200
+ * lines, but only ~1,200 of them touch `crypto.subtle`; the other ~3,000 are
+ * envelope assembly, record-identity AAD, tombstones and the record codec —
+ * plumbing that is IDENTICAL for every capsule because it encodes hub's
+ * envelope format, not anyone's cipher. `makeCapsule()` binds that plumbing to
+ * these primitives, so a second capsule writes ~400 lines instead of ~3,400
+ * and the format lives in exactly one place.
+ *
+ * The alternative — copying the plumbing into each capsule — was rejected for
+ * a specific reason: nothing would fail when the two copies drifted. A change
+ * to the tombstone shape or the AAD would have to be made twice, and the
+ * second miss surfaces as an envelope that one capsule writes and the other
+ * cannot read.
+ *
+ * ⚠️ Declared with PROPERTY syntax (`encrypt: (…) => …`), never method
+ * shorthand. Two reasons, both measured. TypeScript checks method shorthand
+ * BIVARIANTLY, so a capsule whose `encrypt` took the wrong number of arguments
+ * would satisfy a shorthand declaration and fail only at a call site — the
+ * exact hole #16 fell through. And `@typescript-eslint/unbound-method` refuses
+ * to let a shorthand method be destructured off the object, which is precisely
+ * how the plumbing consumes these.
+ *
+ * ⚠️ Every primitive here is `async` except `bufferToBase64`, including ones a
+ * plaintext capsule answers instantly. That is deliberate: a capsule that
+ * needs real asynchrony (hardware-backed keys, a remote KMS) must be
+ * expressible without changing this type, and a synchronous implementation
+ * loses nothing by returning a resolved promise.
+ */
+export interface CapsulePrimitives<K = CapsuleKey> {
+    encrypt: (plaintext: string, key: K, aad?: Uint8Array) => Promise<{
+        iv: string;
+        data: string;
+    }>;
+    decrypt: (iv: string, data: string, key: K, aad?: Uint8Array) => Promise<string>;
+    encryptBytesWithAAD: (bytes: Uint8Array, key: K, aad: Uint8Array) => Promise<{
+        iv: string;
+        data: string;
+    }>;
+    decryptBytesWithAAD: (iv: string, data: string, key: K, aad: Uint8Array) => Promise<Uint8Array>;
+    /** Same plaintext + key + context ⇒ same ciphertext. Refused by a capsule without the group. */
+    encryptDeterministic: (plaintext: string, key: K, context: string) => Promise<{
+        iv: string;
+        data: string;
+    }>;
+    /** ⚠️ ONE argument. The AES capsule derives the CONTEXT into the IV, not the key
+     *  (`encryptDeterministic` calls `deriveDeterministicIV(dek, context, plaintext)`),
+     *  so a `(dek, context)` signature here would have been a plausible-looking lie
+     *  that only the call sites caught. */
+    deriveDeterministicKey: (dek: K) => Promise<K>;
+    deriveSealedFieldKey: (dek: K, collectionName: string, field: string) => Promise<K>;
+    deriveSealedFieldKeyFromCek: (cek: K, collectionName: string, field: string) => Promise<K>;
+    generateDEK: () => Promise<K>;
+    wrapCek: (cek: K, dek: K) => Promise<string>;
+    unwrapCek: (wrapped: string, dek: K) => Promise<K>;
+    /** Accepts `ArrayBuffer` too — the AES capsule's callers pass raw `subtle` output. */
+    bufferToBase64: (buffer: ArrayBuffer | Uint8Array) => string;
+    mintVdigSlot: (value: string, policy: VdigFieldPolicy, prevBlob: string | undefined, cek: K, collection: string, id: string, field: string) => Promise<string>;
+    mintBidxTag: (normalized: string, dek: K, collection: string, field: string) => Promise<string>;
+    /** The vdig payload is sealed under a capsule-derived slot key, so open/seal
+     *  are the capsule's, not the plumbing's. `rotateRecordCek` needs both to
+     *  carry a classified slot across a key rotation. */
+    openVdigPayload: (blob: string, cek: K, collection: string, id: string, field: string) => Promise<VdigPayload>;
+    sealVdigPayload: (payload: VdigPayload, cek: K, collection: string, id: string, field: string) => Promise<string>;
+}
+/** The classified verify-digest payload, at the seam because both the capsule
+ *  and the plumbing name it. Structural, not the capsule's own type. */
+export interface VdigDigestEntry {
+    readonly salt: string;
+    readonly hash: string;
+}
+export interface VdigPayload {
+    readonly v: 1;
+    readonly alg: 'PBKDF2-SHA256';
+    readonly iter: number;
+    readonly cur: VdigDigestEntry & {
+        readonly at: string;
+    };
+    readonly ring?: readonly VdigDigestEntry[];
+}
+export { makeCapsule } from './plumbing/index.js';
+export type { Capsule, RecordCodec } from './plumbing/index.js';
+export { sha256Hex, sha256Bytes, hmacSha256Hex, hmacSignHex, hkdfAesGcmKey, deriveBlobAddressKey, derivePresenceKey, derivePresenceTagKey, generateIV, generateSalt, generateRecoverySecret, bufferToBase64, base64ToBuffer, encodeEchoParts, KEY_BITS, } from './plumbing/digest.js';
+export type { EchoSecretParts } from './plumbing/digest.js';
+export { buildRecordAad, recordAadFor, buildRecordEnvelope, buildTombstone, isTombstone, isTombstoneShape, buildDeleteMarker, isDeleteMarker, requireSealedBody, sealedBodyArgs, envelopeBodySize, hasPerRecordKey, envelopeBodyForHash, hasSealedBody, normalizeForVerify, parseSealedSlot, } from './plumbing/index.js';
+export type { RecordIdentity, RecordRef } from './plumbing/index.js';
+export { buildSealedRecordEnvelope } from './plumbing/record-envelope.js';
+export { generateSigningKeyPair, signBytes, verifyBytes } from './plumbing/sign.js';
+export { ctEqualTags } from './plumbing/ct-equal.js';
+export { evaluateKofN } from './plumbing/kofn.js';

package/dist/capsule/contract.js

@@ -0,0 +1,95 @@
+import {
+  CapsuleNotSupportedError,
+  assertCapsuleSupports
+} from "../chunk-OIEO4WDL.js";
+import {
+  generateSigningKeyPair,
+  signBytes,
+  verifyBytes
+} from "../chunk-Q2XRFWOI.js";
+import {
+  evaluateKofN
+} from "../chunk-NH2UOV3B.js";
+import {
+  buildDeleteMarker,
+  buildRecordAad,
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
+  buildTombstone,
+  ctEqualTags,
+  envelopeBodyForHash,
+  envelopeBodySize,
+  hasPerRecordKey,
+  hasSealedBody,
+  isDeleteMarker,
+  isTombstone,
+  isTombstoneShape,
+  makeCapsule,
+  parseSealedSlot,
+  recordAadFor,
+  requireSealedBody,
+  sealedBodyArgs
+} from "../chunk-42ALPZ2B.js";
+import {
+  KEY_BITS,
+  base64ToBuffer,
+  bufferToBase64,
+  deriveBlobAddressKey,
+  derivePresenceKey,
+  derivePresenceTagKey,
+  encodeEchoParts,
+  generateIV,
+  generateRecoverySecret,
+  generateSalt,
+  hkdfAesGcmKey,
+  hmacSha256Hex,
+  hmacSignHex,
+  normalizeForVerify,
+  sha256Bytes,
+  sha256Hex
+} from "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
+import "../chunk-37EPTBBR.js";
+export {
+  CapsuleNotSupportedError,
+  KEY_BITS,
+  assertCapsuleSupports,
+  base64ToBuffer,
+  bufferToBase64,
+  buildDeleteMarker,
+  buildRecordAad,
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
+  buildTombstone,
+  ctEqualTags,
+  deriveBlobAddressKey,
+  derivePresenceKey,
+  derivePresenceTagKey,
+  encodeEchoParts,
+  envelopeBodyForHash,
+  envelopeBodySize,
+  evaluateKofN,
+  generateIV,
+  generateRecoverySecret,
+  generateSalt,
+  generateSigningKeyPair,
+  hasPerRecordKey,
+  hasSealedBody,
+  hkdfAesGcmKey,
+  hmacSha256Hex,
+  hmacSignHex,
+  isDeleteMarker,
+  isTombstone,
+  isTombstoneShape,
+  makeCapsule,
+  normalizeForVerify,
+  parseSealedSlot,
+  recordAadFor,
+  requireSealedBody,
+  sealedBodyArgs,
+  sha256Bytes,
+  sha256Hex,
+  signBytes,
+  verifyBytes
+};
+//# sourceMappingURL=contract.js.map

package/dist/capsule/enclave-aes/bound.d.ts

@@ -0,0 +1,52 @@
+export declare const aesCapsule: {
+    findByDet: <T>(ctx: import("./index.js").DeterministicContext<T>, field: string, value: unknown) => Promise<T | null>;
+    queryByDet: <T>(ctx: import("./index.js").DeterministicContext<T>, field: string, value: unknown) => Promise<T[]>;
+    SEALED_CEK_NS: string;
+    sealRecordToHost: (ctx: import("./index.js").SealingContext, collection: string, id: string, hostSealer: import("../../index.js").RecipientSealer, opts: {
+        expiresAt: string;
+    }) => Promise<{
+        pid: string;
+        envelopeKey: string;
+    }>;
+    revokeSealedRecord: (ctx: import("./index.js").SealingContext, collection: string, id: string, pid: string, opts?: {
+        hard?: boolean;
+    }) => Promise<void>;
+    rotateRecordCek: (ctx: import("./index.js").SealingContext, collection: string, id: string) => Promise<void>;
+    rekeyBlobSet: (adapter: import("../../index.js").NoydbStore, vault: string, oldDek: import("../contract.js").CapsuleKey, newDek: import("../contract.js").CapsuleKey, otherDeks?: readonly import("../contract.js").CapsuleKey[]) => Promise<import("../plumbing/rekey-blob.js").BlobRekeyReport>;
+    rekeyEnvelopeToDek: (ref: {
+        readonly collection: string;
+        readonly id: string;
+    }, envelope: import("../../index.js").EncryptedEnvelope, oldDek: import("../contract.js").CapsuleKey, newDek: import("../contract.js").CapsuleKey) => Promise<import("../../index.js").EncryptedEnvelope>;
+    rekeyEnvelopeIfNeeded: (ref: {
+        readonly collection: string;
+        readonly id: string;
+    }, envelope: import("../../index.js").EncryptedEnvelope, oldDek: import("../contract.js").CapsuleKey, newDek: import("../contract.js").CapsuleKey) => Promise<import("../../index.js").EncryptedEnvelope | null>;
+    envelopeOpensUnderAny: (ref: {
+        readonly collection: string;
+        readonly id: string;
+    }, envelope: import("../../index.js").EncryptedEnvelope, keys: readonly import("../contract.js").CapsuleKey[]) => Promise<boolean>;
+    resolveStableCek: (deps: import("../plumbing/lifecycle.js").StableCekDeps, id: string) => Promise<import("../contract.js").CapsuleKey>;
+    rewrapBodyToDek: (from: import("./index.js").RecordIdentity, to: import("./index.js").RecordIdentity, envelope: Pick<import("../../index.js").EncryptedEnvelope, "_iv" | "_data" | "_cek" | "_tier" | "_by">, fromDek: import("../contract.js").CapsuleKey, toDek: import("../contract.js").CapsuleKey) => Promise<import("./index.js").RewrappedBody>;
+    applyRewrappedBody: (envelope: import("../../index.js").EncryptedEnvelope, body: import("./index.js").RewrappedBody) => import("../../index.js").EncryptedEnvelope;
+    rewrapEnvelope: (identity: import("./index.js").RecordIdentity, envelope: import("../../index.js").EncryptedEnvelope, fromDek: import("../contract.js").CapsuleKey, toDek: import("../contract.js").CapsuleKey) => Promise<import("../../index.js").EncryptedEnvelope>;
+    isRewrappedUnder: (identity: import("./index.js").RecordIdentity, envelope: Pick<import("../../index.js").EncryptedEnvelope, "_iv" | "_data" | "_cek">, dek: import("../contract.js").CapsuleKey) => Promise<boolean>;
+    RecordCodec: import("../plumbing/record-codec.js").BoundRecordCodec;
+    sealFields: (record: Record<string, unknown>, sensitiveFields: ReadonlySet<string>, keyMaterial: import("../plumbing/sealed-slots.js").SealKeyMaterial) => Promise<import("../plumbing/sealed-slots.js").SealFieldsResult>;
+    unsealOneField: (field: string, blob: string, keyMaterial: import("../plumbing/sealed-slots.js").SealKeyMaterial) => Promise<unknown>;
+    makeHandleProducer: (keyMaterial: import("../plumbing/sealed-slots.js").SealKeyMaterial) => (field: string, blob: string) => import("../../index.js").SealedHandle<unknown>;
+    unsealFields: (record: Record<string, unknown>, sealed: Record<string, string>, keyMaterial: import("../plumbing/sealed-slots.js").SealKeyMaterial, opts?: {
+        asHandles?: boolean;
+    }) => Promise<Record<string, unknown>>;
+    makeSealedSlotCapability: (ctx: import("../plumbing/sealed-slots.js").SealedSlotCapabilityCtx, recordId: string, cek?: import("../contract.js").CapsuleKey) => import("../../kernel/via/index.js").ViaCryptoCtx["sealedSlots"];
+    makeReservedEnvelopes: (dekResolver: import("../plumbing/sealed-slots.js").ReservedEnvelopeDekResolver, declaredPrefixes: readonly string[]) => import("../../kernel/via/index.js").ViaCryptoCtx["reservedEnvelopes"];
+    dualReadSealedSlot: (blob: string, field: string, collection: string, cek: CryptoKey | undefined, dek: CryptoKey) => Promise<string>;
+    openEnvelopeJson: (ref: import("./index.js").RecordRef, env: import("../../index.js").EncryptedEnvelope, key: import("../contract.js").CapsuleKey, opts?: {
+        encrypted?: boolean;
+    }) => Promise<string>;
+    writeEnvelopeBody: (identity: import("./index.js").RecordIdentity, json: string, key: import("../contract.js").CapsuleKey, opts?: {
+        encrypted?: boolean;
+        perRecordKey?: boolean;
+    }) => Promise<Pick<import("../../index.js").EncryptedEnvelope, "_iv" | "_data" | "_cek">>;
+    verifyRecordIdentity: (ref: import("./index.js").RecordRef, env: import("../../index.js").EncryptedEnvelope, key: import("../contract.js").CapsuleKey) => Promise<boolean>;
+};
+export declare const dualReadSealedSlot: (blob: string, field: string, collection: string, cek: CryptoKey | undefined, dek: CryptoKey) => Promise<string>;

package/dist/capsule/enclave-aes/capabilities.d.ts

@@ -0,0 +1,2 @@
+import type { CapsuleGroup } from '../contract.js';
+export declare function capabilities(): ReadonlySet<CapsuleGroup>;

package/dist/capsule/enclave-aes/classify/compare.d.ts

@@ -0,0 +1,20 @@
+/**
+ * C2 — fixed-length-tag constant-time comparison (hub-portable; no
+ * Node timingSafeEqual). Two mandatory rules (spec §3):
+ *  1. Only fixed 32-byte tags are ever compared — ctEqualTags throws on
+ *     anything else (tag length is structural, never secret-dependent).
+ *  2. Every comparand is reduced to a 32-byte tag under a FRESH ephemeral
+ *     HMAC-SHA256 key before comparison — keyed blinding makes compare
+ *     timing uncorrelated with underlying values; rule 1 (not blinding)
+ *     is what removes input-length timing. Length inequality folds into
+ *     unequal tags — never an early return.
+ * @module
+ */
+/**
+ * Blinded equality of arbitrary-length byte strings: fresh K_e per
+ * comparison (never stored, never reused), HMAC both sides to 32-byte
+ * tags, then ctEqualTags. On the digest path the inputs are already
+ * 32-byte PBKDF2 outputs but still route through this reduction so
+ * there is exactly ONE comparison construction (spec §3 rule 2).
+ */
+export declare function blindedEqual(a: Uint8Array, b: Uint8Array): Promise<boolean>;

package/dist/{kernel/enclave → capsule/enclave-aes}/classify/find.d.ts

@@ -25,7 +25,7 @@
  * @module
  */
 import type { EnclaveKey } from '../crypto.js';
-import { type VerifyNormalizeMode } from './normalize.js';
+import { type VerifyNormalizeMode } from '../../plumbing/normalize.js';
 /**
  * Normalize `candidate` and mint it into a blind-index target tag at
  * `costByte` (default {@link CURRENT_COST_BYTE}), for string-comparison

package/dist/{kernel/enclave → capsule/enclave-aes}/classify/reveal.d.ts

@@ -1,4 +1,4 @@
-import type { EncryptedEnvelope } from '../../types.js';
+import type { EncryptedEnvelope } from '../../../kernel/types.js';
 import type { EnclaveKey } from '../crypto.js';
 export interface RevealEngineCtx {
     readonly collection: string;

package/dist/{kernel/enclave → capsule/enclave-aes}/classify/verify.d.ts

@@ -15,8 +15,8 @@
  * @module
  */
 import { type EnclaveKey } from '../crypto.js';
-import { type VerifyNormalizeMode } from './normalize.js';
-import type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../types.js';
+import { type VerifyNormalizeMode } from '../../plumbing/normalize.js';
+import type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../../kernel/types.js';
 export interface VerifyEngineCtx {
     readonly collection: string;
     getEnvelope(id: string): Promise<EncryptedEnvelope | null>;

package/dist/{kernel/enclave → capsule/enclave-aes}/classify/write.d.ts

@@ -4,5 +4,5 @@
  * @module
  */
 import { type EnclaveKey } from '../crypto.js';
-import type { VdigFieldPolicy } from '../../types.js';
+import type { VdigFieldPolicy } from '../../../kernel/types.js';
 export declare function mintVdigSlot(rawValue: string, policy: VdigFieldPolicy, prevBlob: string | undefined, cek: EnclaveKey, collection: string, recordId: string, field: string): Promise<string>;

package/dist/{kernel/enclave → capsule/enclave-aes}/crypto.d.ts

@@ -35,42 +35,28 @@
  *
  * @module
  */
+import { type EchoSecretParts } from '../plumbing/digest.js';
 /**
  * **EnclaveKey** — the opaque key type at the enclave seam.
  *
  * In noy-db's reference enclave this is `CryptoKey` (the Web Crypto API's
  * key handle). A fork's enclave redefines this alias to its own key
  * representation (e.g. `type EnclaveKey = null` for a keyless HSM-backed
- * fork) — outside `kernel/enclave/**`, every consumer must treat it as
+ * fork) — outside `capsule/enclave-aes/**`, every consumer must treat it as
  * opaque: never construct, inspect, or serialize it directly, only pass it
  * between barrel functions (`encrypt`/`decrypt`/`wrapKey`/`unwrapKey`/…).
  */
 export type EnclaveKey = CryptoKey;
+/** Opaque asymmetric pair at the enclave seam — `CryptoKeyPair` in the reference enclave. */
+export type EnclaveKeyPair = CryptoKeyPair;
 /** Derive a KEK from a secret and salt using PBKDF2-SHA256. */
 export declare function deriveKey(secret: string, salt: Uint8Array): Promise<CryptoKey>;
 /** One three-part echo secret: prompt (typed) → echo (revealed) → key (typed). */
-export interface EchoSecretParts {
-    readonly prompt: string;
-    readonly echo: string;
-    readonly key: string;
-}
 /**
- * AG-1 encoding: domain context + 4-byte big-endian length prefix per
- * part. Two independent guarantees make a single typed string unable to
- * derive an echo vault's KEK (spec AG-1):
- *
- *   1. The `0xFF` context prefix — UTF-8 never produces that byte, so the
- *      encoding is provably not the encoding of ANY string (not merely of
- *      no separator-joined form).
- *   2. Structural length prefixes — part boundaries are key material, so
- *      re-splitting the same characters changes the derived KEK.
- *
- * @throws ValidationError when any part is not a string — the single
- * chokepoint every echo KEK derivation and block mint passes through, so a
- * malformed parts object cannot be `TextEncoder`-coerced into key material.
+ * Domain context for the AG-1 encoding. The leading `0xFF` is the load-bearing
+ * byte: it is not a legal UTF-8 lead byte, so `TextEncoder` can never emit it —
+ * no string's UTF-8 encoding can equal an AG-1 encoding, whatever the string.
  */
-export declare function encodeEchoParts(parts: EchoSecretParts): Uint8Array;
-/** Derive the tier-1 KEK from a 3-part echo secret (spec: KEK from ALL parts). */
 export declare function deriveEchoKey(parts: EchoSecretParts, salt: Uint8Array): Promise<CryptoKey>;
 /**
  * Which AES algorithm/usage a {@link deriveSecretKey} result is for:
@@ -93,6 +79,13 @@ export declare function deriveSecretKey(secret: string, salt: Uint8Array, params
 }): Promise<CryptoKey>;
 /** Generate a random AES-256-GCM data encryption key. */
 export declare function generateDEK(): Promise<CryptoKey>;
+/**
+ * Generate a NON-extractable AES-256-GCM key for in-memory-only use — a
+ * session key, a device seal. Unlike {@link generateDEK} it can never be
+ * wrapped or exported: WebCrypto enforces that, and it is the tab-scope
+ * invariant `with-party/session` and `device-seal` rely on.
+ */
+export declare function generateEphemeralKey(): Promise<CryptoKey>;
 /** Serialize a DEK set to `{ collection: base64(rawKey) }`. */
 export declare function exportDekSet(deks: Map<string, CryptoKey>): Promise<Record<string, string>>;
 /**
@@ -104,6 +97,10 @@ export declare function importDekSet(exported: Record<string, string>): Promise<
 export declare function wrapKey(dek: CryptoKey, kek: CryptoKey): Promise<string>;
 /** Unwrap (decrypt) a DEK from base64 string using a KEK. */
 export declare function unwrapKey(wrappedBase64: string, kek: CryptoKey): Promise<CryptoKey>;
+/** Wrap the constant AES-GCM key built from `plaintext` under `kek`. */
+export declare function mintCanary(kek: CryptoKey, plaintext: Uint8Array): Promise<string>;
+/** True iff `wrapped` unwraps under `kek` — the KEK is right AND the bytes are intact. */
+export declare function checkCanary(wrapped: string, kek: CryptoKey): Promise<boolean>;
 /**
  * AES-KW-wrap a per-record CEK under a collection/tier DEK. Returns base64.
  * Deterministic over `(cek, dek)`.
@@ -120,6 +117,13 @@ export declare function unwrapCek(wrappedBase64: string, dek: CryptoKey): Promis
  * used solely to open the record's `_iv`/`_data` body under `decrypt()`.
  */
 export declare function importCek(rawKey: Uint8Array): Promise<CryptoKey>;
+/**
+ * Import a raw 32-byte pre-shared key as a NON-extractable AES-256-GCM key
+ * (encrypt + decrypt). The transfer seal (`with-cargo`) and the RSA-OAEP
+ * TLV's per-blob CEK (`managed-secret`) both hand raw bytes to the enclave
+ * here; the bytes never become a key anywhere else.
+ */
+export declare function importTransferKey(raw: Uint8Array): Promise<CryptoKey>;
 export interface EncryptResult {
     iv: string;
     data: string;
@@ -160,66 +164,6 @@ export declare function encryptBytes(data: Uint8Array, dek: CryptoKey): Promise<
  * Counterpart to `encryptBytes`. Throws `TamperedError` on auth-tag failure.
  */
 export declare function decryptBytes(ivBase64: string, dataBase64: string, dek: CryptoKey): Promise<Uint8Array>;
-/**
- * SHA-256 hex digest of raw bytes. Used to derive content-addressed
- * eTags for blob deduplication. Computed on plaintext bytes
- * before compression and encryption so the eTag identifies content, not
- * ciphertext, and survives re-encryption (key rotation, re-upload).
- */
-export declare function sha256Hex(data: Uint8Array): Promise<string>;
-/**
- * Compute HMAC-SHA-256(key, data) and return hex string.
- *
- * Used to derive content-addressed eTags that are opaque to the store:
- * ```
- * eTag = hmacSha256Hex(blobDEK, plaintext)
- * ```
- *
- * Unlike a plain SHA-256, the HMAC is keyed by the vault-shared `_blob` DEK,
- * so an attacker with store access cannot pre-compute eTags for known files.
- * Deduplication still works within a vault (same key + same content = same eTag).
- */
-/**
- * Derive the blob CONTENT-ADDRESSING key for one tier (#1126).
- *
- * The blob eTag is an HMAC over the plaintext. It used to be keyed by the
- * `_blob` DEK — the very key `rotateKeys` replaces — so after any rotation
- * `HMAC(live DEK, plaintext) !== storedETag` for every blob written before it,
- * permanently. `decryptResponse()` checks that unconditionally, so the
- * presigned-URL read path raised `TamperedError` on legitimate data forever;
- * dedup also split, minting a second address for identical bytes.
- *
- * The fix is a `root` that rotation never touches (`_blob_addr`, refused by
- * `rotateKeys` exactly as `_roster` is). Rotation then re-keys chunk BODIES
- * while every address stays stable, which is what makes the AAD
- * `{eTag}:{i}:{count}` and every `_blob_index` / `_blob_slots_*` /
- * `_blob_versions_*` row survive it untouched.
- *
- * **Derived PER TIER, deliberately.** A single vault-wide address would make an
- * elevated blob and a tier-0 blob with identical content share an eTag,
- * leaking equality across a boundary the tier system exists to enforce — and
- * `rehomeForTier` re-addresses on a tier move precisely because the address is
- * tier-scoped today. Domain separation keeps that property while removing the
- * rotation coupling: the two are independent axes, and only one of them was
- * ever meant to change the address.
- *
- * Same HKDF idiom as `asKwKey`, with its own salt so the addressing key can
- * never coincide with a wrapping or encryption key.
- */
-export declare function deriveBlobAddressKey(root: CryptoKey, tier: number): Promise<CryptoKey>;
-export declare function hmacSha256Hex(key: CryptoKey, data: Uint8Array): Promise<string>;
-/**
- * Encrypt raw bytes with AES-256-GCM using Additional Authenticated Data.
- *
- * The AAD binds each chunk to its parent blob and position, preventing
- * chunk reorder, substitution, and truncation attacks:
- * ```
- * AAD = UTF-8("{eTag}:{chunkIndex}:{chunkCount}")
- * ```
- *
- * The AAD is NOT stored — the reader reconstructs it from `BlobObject`
- * metadata and passes it to `decryptBytesWithAAD`.
- */
 export declare function encryptBytesWithAAD(data: Uint8Array, dek: CryptoKey, aad: Uint8Array): Promise<EncryptResult>;
 /**
  * Decrypt AES-256-GCM ciphertext with AAD verification.
@@ -229,41 +173,6 @@ export declare function encryptBytesWithAAD(data: Uint8Array, dek: CryptoKey, aa
  * tag fails and this throws `TamperedError`.
  */
 export declare function decryptBytesWithAAD(ivBase64: string, dataBase64: string, dek: CryptoKey, aad: Uint8Array): Promise<Uint8Array>;
-/**
- * Derive an AES-256-GCM presence key from a collection DEK using HKDF-SHA256.
- *
- * The presence key is domain-separated from the data DEK by the fixed salt
- * `'noydb-presence'` and the `info` = collection name. This means:
- *  - The adapter never sees the presence key.
- *  - Presence payloads rotate automatically when the collection DEK is rotated.
- *  - Revoked users cannot derive the new presence key after a DEK rotation.
- *
- * @param dek            The collection's AES-256-GCM DEK (extractable).
- * @param collectionName Used as the HKDF `info` parameter for domain separation.
- * @returns A non-extractable AES-256-GCM key suitable for presence payload encryption.
- */
-export declare function derivePresenceKey(dek: CryptoKey, collectionName: string): Promise<CryptoKey>;
-/**
- * Derive a **per-field** AES-256-GCM key from a collection DEK using
- * HKDF-SHA256, used to encrypt a single sensitive field into its own
- * `_sealed[field]` envelope slot (structural group-encryption).
- *
- * Domain-separated from the data DEK (and from the presence/deterministic
- * channels) by the fixed salt `'noydb-sealed'` and an `info` of
- * `JSON.stringify(['noydb-sealed', collectionName, field])`. The JSON-array
- * encoding is injective — each element is separately quoted/escaped — so
- * collection `a/sealed/b` + field `c` cannot collide with collection `a` +
- * field `b/sealed/c`. Each sensitive field gets a **distinct** key, so a
- * `_sealed[a]` ciphertext does not authenticate under field `b`'s key —
- * sealed fields are cryptographically isolated from one another. The
- * collection name keeps the same field name in two collections from sharing a
- * key, mirroring how `derivePresenceKey` / `encryptDeterministic` domain-separate.
- *
- * @param dek            The collection's AES-256-GCM DEK (extractable).
- * @param collectionName Part of the HKDF `info` for domain separation.
- * @param field          Sensitive field name — the rest of the `info`.
- * @returns A non-extractable AES-256-GCM key for that field's sealed slot.
- */
 export declare function deriveSealedFieldKey(dek: CryptoKey, collectionName: string, field: string): Promise<CryptoKey>;
 /**
  * Derive a per-record sealed-field key from the record's **per-record CEK**
@@ -334,18 +243,13 @@ export declare function encryptDeterministic(plaintext: string, dek: CryptoKey,
  * ciphertext throws `TamperedError` just like randomized AES-GCM.
  */
 export declare function decryptDeterministic(ivBase64: string, dataBase64: string, dek: CryptoKey): Promise<string>;
-/** Generate a random 12-byte IV for AES-GCM. */
-export declare function generateIV(): Uint8Array;
-/** Generate a random 32-byte salt for PBKDF2. */
-export declare function generateSalt(): Uint8Array;
+export declare function generateRecipientKeyPair(): Promise<CryptoKeyPair>;
+export declare function exportRecipientPublicKeySpki(pair: CryptoKeyPair): Promise<Uint8Array>;
+export declare function importRecipientPublicKeySpki(spki: Uint8Array): Promise<CryptoKey>;
+/** RSA-OAEP-encrypt `bytes` (a 32-byte CEK) to the recipient's public key. */
+export declare function recipientWrap(pub: CryptoKey, bytes: Uint8Array): Promise<Uint8Array>;
 /**
- * Mint a fresh recovery secret — the high-entropy value a recovery profile
- * wraps the DEK set under and then hands out (Shamir splits it into shares;
- * paper prints it). Not a salt: a salt is public, this is not, and a fork
- * may size them differently. The reference enclave returns 32 bytes.
- *
- * Callers must zero the buffer once it has been wrapped and split.
+ * RSA-OAEP-decrypt with the pair's private key. Propagates WebCrypto's own
+ * error on failure — callers that need a typed error map it themselves.
  */
-export declare function generateRecoverySecret(): Uint8Array;
-export declare function bufferToBase64(buffer: ArrayBuffer | Uint8Array): string;
-export declare function base64ToBuffer(base64: string): Uint8Array<ArrayBuffer>;
+export declare function recipientUnwrap(pair: CryptoKeyPair, wrapped: Uint8Array): Promise<Uint8Array>;