@noy-db/hub 0.8.0-pre.0 → 0.8.0

package/dist/{chunk-KJFW62P4.js → chunk-42ALPZ2B.js}

@@ -1,56 +1,20 @@
 import {
-  buildRecordEnvelope,
-  isDeleteMarker,
-  isTombstone
-} from "./chunk-SEE332EV.js";
-import {
-  blindedEqual,
-  openVdigPayload,
-  sealVdigPayload
-} from "./chunk-6QSQQLSE.js";
-import {
-  dualReadSealedSlot,
-  parseSealedSlot
-} from "./chunk-DE4DH2RZ.js";
-import {
-  mintBidxTag
-} from "./chunk-LQ4ZHOKP.js";
-import {
-  VDIG_ITERATIONS,
-  normalizeForVerify,
-  pbkdf2VerifyDigest
-} from "./chunk-LP7BEXCT.js";
-import {
-  base64ToBuffer,
-  bufferToBase64,
-  decrypt,
-  decryptBytesWithAAD,
-  deriveDeterministicKey,
-  deriveSealedFieldKey,
-  deriveSealedFieldKeyFromCek,
-  encrypt,
-  encryptBytesWithAAD,
-  encryptDeterministic,
-  generateDEK,
-  generateSalt,
-  unwrapCek,
-  wrapCek
-} from "./chunk-UYB234ZR.js";
+  normalizeForVerify
+} from "./chunk-QMWY2FDS.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-ODVPTDPK.js";
+} from "./chunk-SV2PM2OY.js";
 import {
   ClassifiedConfigError,
-  ClassifiedRotationError,
   DebugReservedFieldError,
+  MissingEnvelopeBodyError,
   RecordCekNotFoundError,
   SchemaValidationError,
-  TamperedError,
   ValidationError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
-// src/kernel/enclave/record-aad.ts
+// src/capsule/plumbing/record-aad.ts
 var SCHEME = "noydb-aad/2";
 var encoder = new TextEncoder();
 function buildRecordAad(identity) {
@@ -98,309 +62,148 @@ function recordAadFor(ref, envelope) {
   });
 }
 
-// src/kernel/enclave/record-keys/lifecycle.ts
-async function resolveStableCek(deps, id) {
-  const cached = deps.cache?.get(id);
-  if (cached) return cached;
-  const live = await deps.getLive(id);
-  if (live?._cek !== void 0) {
-    const cek = await unwrapCek(live._cek, await deps.getDEK());
-    deps.cache?.set(id, cek, 1);
-    return cek;
-  }
-  const fresh = await generateDEK();
-  deps.cache?.set(id, fresh, 1);
-  return fresh;
+// src/capsule/plumbing/envelope-body.ts
+function requireSealedBody(env, where) {
+  if (env._iv === void 0 || env._data === void 0) throw new MissingEnvelopeBodyError(where);
+  return { iv: env._iv, data: env._data };
 }
-async function rewrapBodyToDek(from, to, envelope, fromDek, toDek) {
-  const openAad = buildRecordAad(from);
-  const sealAad = buildRecordAad(to);
-  if (envelope._cek !== void 0) {
-    const cek = await unwrapCek(envelope._cek, fromDek);
-    const plaintext2 = await decrypt(envelope._iv, envelope._data, cek, openAad);
-    const { iv: iv2, data: data2 } = await encrypt(plaintext2, cek, sealAad);
-    return { _iv: iv2, _data: data2, _cek: await wrapCek(cek, toDek), cek };
-  }
-  const plaintext = await decrypt(envelope._iv, envelope._data, fromDek, openAad);
-  const { iv, data } = await encrypt(plaintext, toDek, sealAad);
-  return { _iv: iv, _data: data, cek: null };
+function sealedBodyArgs(env, where) {
+  const { iv, data } = requireSealedBody(env, where);
+  return [iv, data];
+}
+function envelopeBodySize(env) {
+  return (env._data?.length ?? 0) + (env._iv?.length ?? 0);
 }
-function applyRewrappedBody(envelope, body) {
-  const next = {
-    ...envelope,
-    _iv: body._iv,
-    _data: body._data,
-    ...body._cek !== void 0 ? { _cek: body._cek } : {}
+function hasPerRecordKey(env) {
+  return env._cek !== void 0;
+}
+function envelopeBodyForHash(env) {
+  const data = env._data ?? "";
+  if (env._sealed === void 0 && env._vdig === void 0 && env._bidx === void 0) return data;
+  const mapPart = (key, map) => {
+    const parts = Object.keys(map).sort().map(
+      (k) => `${JSON.stringify(k)}:${JSON.stringify(map[k])}`
+    );
+    return `${JSON.stringify(key)}:{${parts.join(",")}}`;
   };
-  if (body._cek === void 0 && envelope._cek !== void 0) {
-    delete next._cek;
-  }
-  return next;
+  const segments = [`"_data":${JSON.stringify(data)}`];
+  if (env._sealed !== void 0) segments.push(mapPart("_sealed", env._sealed));
+  if (env._vdig !== void 0) segments.push(mapPart("_vdig", env._vdig));
+  if (env._bidx !== void 0) segments.push(mapPart("_bidx", env._bidx));
+  return `{${segments.join(",")}}`;
 }
-async function rewrapEnvelope(identity, envelope, fromDek, toDek) {
-  return applyRewrappedBody(envelope, await rewrapBodyToDek(identity, identity, envelope, fromDek, toDek));
+function hasSealedBody(env) {
+  return env._iv !== void 0 && env._iv !== "";
 }
-async function isRewrappedUnder(identity, envelope, dek) {
-  try {
-    if (envelope._cek !== void 0) {
-      await unwrapCek(envelope._cek, dek);
-    } else {
-      await decrypt(envelope._iv, envelope._data, dek, buildRecordAad(identity));
+function makeEnvelopeBody(p) {
+  const { encrypt, decrypt, generateDEK, wrapCek, unwrapCek } = p;
+  async function openEnvelopeJson(ref, env, key, opts) {
+    if (opts?.encrypted === false) return env._data ?? "";
+    const aad = recordAadFor(ref, env);
+    const { iv, data } = requireSealedBody(env, "openEnvelopeJson");
+    if (env._cek !== void 0) {
+      const cek = await unwrapCek(env._cek, key);
+      return decrypt(iv, data, cek, aad);
     }
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// src/kernel/enclave/record-keys/rekey.ts
-async function rekeyEnvelopeToDek(ref, envelope, oldDek, newDek) {
-  const aad = recordAadFor(ref, envelope);
-  const { _bidx, ...carried } = envelope;
-  void _bidx;
-  if (envelope._cek !== void 0) {
-    const cek = await unwrapCek(envelope._cek, oldDek);
-    return { ...carried, _cek: await wrapCek(cek, newDek) };
+    return decrypt(iv, data, key, aad);
   }
-  const plaintext = await decrypt(envelope._iv, envelope._data, oldDek, aad);
-  const { iv, data } = await encrypt(plaintext, newDek, aad);
-  return { ...carried, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: iv, _data: data };
-}
-async function rekeyEnvelopeIfNeeded(ref, envelope, oldDek, newDek) {
-  try {
-    return await rekeyEnvelopeToDek(ref, envelope, oldDek, newDek);
-  } catch (errUnderOld) {
-    try {
-      if (envelope._cek !== void 0) await unwrapCek(envelope._cek, newDek);
-      else await decrypt(envelope._iv, envelope._data, newDek, recordAadFor(ref, envelope));
-      return null;
-    } catch {
-      throw errUnderOld;
+  async function writeEnvelopeBody(identity, json, key, opts) {
+    if (opts?.encrypted === false) return { _iv: "", _data: json };
+    const aad = buildRecordAad(identity);
+    if (opts?.perRecordKey === true) {
+      const cek = await generateDEK();
+      const { iv: iv2, data: data2 } = await encrypt(json, cek, aad);
+      const wrapped = await wrapCek(cek, key);
+      return { _iv: iv2, _data: data2, _cek: wrapped };
     }
+    const { iv, data } = await encrypt(json, key, aad);
+    return { _iv: iv, _data: data };
   }
-}
-async function envelopeOpensUnderAny(ref, envelope, keys) {
-  for (const key of keys) {
+  async function verifyRecordIdentity(ref, env, key) {
+    if (!hasSealedBody(env)) return true;
     try {
-      if (envelope._cek !== void 0) await unwrapCek(envelope._cek, key);
-      else await decrypt(envelope._iv, envelope._data, key, recordAadFor(ref, envelope));
+      await openEnvelopeJson(ref, env, key);
       return true;
     } catch {
+      return false;
     }
   }
-  return false;
+  return { openEnvelopeJson, writeEnvelopeBody, verifyRecordIdentity };
 }
 
-// src/kernel/enclave/record-keys/rekey-blob.ts
-var BLOB_INDEX_COLLECTION = "_blob_index";
-var BLOB_CHUNKS_COLLECTION = "_blob_chunks";
-function chunkAad(eTag, index, chunkCount) {
-  return new TextEncoder().encode(`${eTag}:${index}:${chunkCount}`);
+// src/capsule/plumbing/sealed-slot.ts
+function parseSealedSlot(blob) {
+  const sep = blob.indexOf(":");
+  return { iv: blob.slice(0, sep), data: blob.slice(sep + 1) };
 }
-async function opensJson(ref, env, key) {
-  try {
-    return await decrypt(env._iv, env._data, key, recordAadFor(ref, env));
-  } catch {
-    return null;
-  }
-}
-async function rekeyBlobSet(adapter, vault, oldDek, newDek, otherDeks = []) {
-  let blobs = 0;
-  let chunks = 0;
-  let foreign = 0;
-  let alreadyMoved = 0;
-  let eTags;
-  try {
-    eTags = await adapter.list(vault, BLOB_INDEX_COLLECTION);
-  } catch {
-    return { blobs, chunks, foreign, alreadyMoved };
-  }
-  for (const eTag of eTags) {
-    const idxEnv = await adapter.get(vault, BLOB_INDEX_COLLECTION, eTag);
-    if (!idxEnv || !idxEnv._iv) continue;
-    const ref = { collection: BLOB_INDEX_COLLECTION, id: eTag };
-    const json = await opensJson(ref, idxEnv, oldDek);
-    if (json === null) {
-      if (await opensJson(ref, idxEnv, newDek) !== null) {
-        alreadyMoved++;
-        continue;
-      }
-      let claimed = false;
-      for (const key of otherDeks) {
-        if (await opensJson(ref, idxEnv, key) !== null) {
-          claimed = true;
-          break;
-        }
-      }
-      if (claimed) {
-        foreign++;
-        continue;
-      }
-      throw new Error(
-        `[noy-db] rotateKeys: blob index entry "${eTag}" opens under neither the retiring nor the new \`_blob\` DEK, nor any other key this keyring holds. Rotation stopped rather than leaving it unreadable and unreported.`
-      );
-    }
-    const blob = JSON.parse(json);
-    for (let i = 0; i < blob.chunkCount; i++) {
-      const id = `${eTag}_${i}`;
-      const chunkEnv = await adapter.get(vault, BLOB_CHUNKS_COLLECTION, id);
-      if (!chunkEnv || !chunkEnv._iv) continue;
-      const aad = chunkAad(eTag, i, blob.chunkCount);
-      let plain;
+function makeSealedSlot(p) {
+  const { decrypt, deriveSealedFieldKey, deriveSealedFieldKeyFromCek } = p;
+  async function dualReadSealedSlot(blob, field, collection, cek, dek) {
+    const { iv, data } = parseSealedSlot(blob);
+    if (cek !== void 0) {
       try {
-        plain = await decryptBytesWithAAD(chunkEnv._iv, chunkEnv._data, oldDek, aad);
+        const fieldKey2 = await deriveSealedFieldKeyFromCek(cek, collection, field);
+        return await decrypt(iv, data, fieldKey2);
       } catch {
-        if (blob._cek !== void 0 || blob._cekPending !== void 0) continue;
-        try {
-          await decryptBytesWithAAD(chunkEnv._iv, chunkEnv._data, newDek, aad);
-          continue;
-        } catch {
-          throw new Error(
-            `[noy-db] rotateKeys: blob chunk "${id}" (${i + 1}/${blob.chunkCount} of eTag "${eTag}") opens under neither the retiring nor the new \`_blob\` DEK, and its blob holds no content CEK that could explain it. Rotation stopped rather than leaving it unreadable and unreported.`
-          );
-        }
       }
-      const { iv: iv2, data: data2 } = await encryptBytesWithAAD(plain, newDek, aad);
-      await adapter.put(vault, BLOB_CHUNKS_COLLECTION, id, { ...chunkEnv, _iv: iv2, _data: data2 });
-      chunks++;
     }
-    const rewrapped = {
-      ...blob,
-      ...blob._cek !== void 0 ? { _cek: await wrapCek(await unwrapCek(blob._cek, oldDek), newDek) } : {},
-      ...blob._cekPending !== void 0 ? { _cekPending: await wrapCek(await unwrapCek(blob._cekPending, oldDek), newDek) } : {}
-    };
-    const { iv, data } = await encrypt(JSON.stringify(rewrapped), newDek, recordAadFor(ref, idxEnv));
-    await adapter.put(vault, BLOB_INDEX_COLLECTION, eTag, { ...idxEnv, _iv: iv, _data: data });
-    blobs++;
+    const fieldKey = await deriveSealedFieldKey(dek, collection, field);
+    return decrypt(iv, data, fieldKey);
   }
-  return { blobs, chunks, foreign, alreadyMoved };
+  return { dualReadSealedSlot };
 }
 
-// src/kernel/enclave/record-keys/sealed-slots.ts
-async function sealOneFieldWithDek(field, value, dek, keyMaterial) {
-  const fieldKey = keyMaterial.cek !== void 0 ? await deriveSealedFieldKeyFromCek(keyMaterial.cek, keyMaterial.collection, field) : await deriveSealedFieldKey(dek, keyMaterial.collection, field);
-  return encrypt(JSON.stringify(value), fieldKey);
+// src/capsule/plumbing/record-envelope.ts
+function buildRecordEnvelope(identity, body) {
+  return {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: identity.version,
+    _ts: body.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: body.iv,
+    _data: body.data,
+    ...identity.by !== void 0 ? { _by: identity.by } : {},
+    ...identity.tier !== void 0 && identity.tier > 0 ? { _tier: identity.tier } : {},
+    ...body.cek !== void 0 ? { _cek: body.cek } : {},
+    ...body.provenance !== void 0 ? { _source: body.provenance.source, _sourceTs: body.provenance.sourceTs } : {},
+    ...body.extra ?? {}
+  };
 }
-async function sealOneField(field, value, keyMaterial) {
-  const dek = await keyMaterial.getDEK();
-  return sealOneFieldWithDek(field, value, dek, keyMaterial);
+async function buildSealedRecordEnvelope(identity, seal, body) {
+  const sealed = await seal(identity);
+  const { iv, data } = requireSealedBody(sealed, "buildSealedRecordEnvelope");
+  return buildRecordEnvelope(identity, {
+    ...body,
+    iv,
+    data,
+    cek: sealed._cek
+  });
 }
-async function sealFields(record, sensitiveFields, keyMaterial) {
-  const dek = await keyMaterial.getDEK();
-  const open = { ...record };
-  const slots = {};
-  for (const field of sensitiveFields) {
-    if (!(field in record)) continue;
-    const value = record[field];
-    if (value === void 0) continue;
-    const { iv, data } = await sealOneFieldWithDek(field, value, dek, keyMaterial);
-    slots[field] = `${iv}:${data}`;
-    delete open[field];
-  }
-  if (Object.keys(slots).length === 0) return { openRecord: record, sealed: void 0 };
-  return { openRecord: open, sealed: slots };
+
+// src/capsule/plumbing/tombstone.ts
+function isTombstoneShape(envelope) {
+  return envelope._data === "" && envelope._cek === void 0 && envelope._del !== true;
 }
-async function unsealOneField(field, blob, keyMaterial) {
-  const dek = await keyMaterial.getDEK();
-  return JSON.parse(await dualReadSealedSlot(blob, field, keyMaterial.collection, keyMaterial.cek, dek));
+function isTombstone(envelope, encrypted) {
+  if (!encrypted) return false;
+  return isTombstoneShape(envelope);
 }
-function makeHandleProducer(keyMaterial) {
-  return (field, blob) => new SealedHandle(() => unsealOneField(field, blob, keyMaterial));
+function buildTombstone(ref, version, actor) {
+  return buildRecordEnvelope(
+    { ...ref, version, ...actor ? { by: actor } : {} },
+    { iv: "", data: "" }
+  );
 }
-async function unsealFields(record, sealed, keyMaterial, opts) {
-  const makeHandle = opts?.asHandles === true ? makeHandleProducer(keyMaterial) : void 0;
-  for (const [field, blob] of Object.entries(sealed)) {
-    record[field] = makeHandle !== void 0 ? makeHandle(field, blob) : await unsealOneField(field, blob, keyMaterial);
-  }
-  return record;
+function isDeleteMarker(envelope) {
+  return envelope._del === true;
 }
-function makeSealedSlotCapability(ctx, recordId, cek) {
-  const keyMaterial = {
-    collection: ctx.name,
-    ...cek !== void 0 ? { cek } : {},
-    getDEK: () => ctx.getDEK()
-  };
-  const deletedFields = /* @__PURE__ */ new Set();
+function buildDeleteMarker(ref, version, actor) {
   return {
-    async seal(field, plaintext) {
-      const ref = await sealOneField(field, plaintext, keyMaterial);
-      deletedFields.delete(field);
-      return ref;
-    },
-    async unseal(field, ref) {
-      if (deletedFields.has(field)) {
-        throw new ValidationError(`sealedSlots.unseal: field "${field}" on record "${recordId}" was deleted from this capability`);
-      }
-      return unsealOneField(field, `${ref.iv}:${ref.data}`, keyMaterial);
-    },
-    async delete(field) {
-      deletedFields.add(field);
-    }
-  };
-}
-function makeReservedEnvelopes(dekResolver, declaredPrefixes) {
-  const declared = new Set(declaredPrefixes);
-  return (prefix) => {
-    if (!declared.has(prefix)) {
-      throw new ValidationError(`reservedEnvelopes: prefix "${prefix}" is not declared by this binding's reservedPrefixes`);
-    }
-    const assertPrefixed = (collection, method) => {
-      if (!collection.startsWith(prefix)) {
-        throw new ValidationError(
-          `reservedEnvelopes('${prefix}').${method}: collection "${collection}" does not start with "${prefix}"`
-        );
-      }
-    };
-    const encryptForPrefix = async (ref, json, v) => {
-      assertPrefixed(ref.collection, "encrypt");
-      const dek = await dekResolver(ref.collection);
-      const identity = { ...ref, version: v };
-      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
-      return buildRecordEnvelope(identity, { iv, data });
-    };
-    const decryptForPrefix = async (collection, id, env) => {
-      assertPrefixed(collection, "decrypt");
-      const dek = await dekResolver(collection);
-      return decrypt(env._iv, env._data, dek, recordAadFor({ collection, id }, env));
-    };
-    return { encrypt: encryptForPrefix, decrypt: decryptForPrefix };
-  };
-}
-
-// src/kernel/enclave/classify/write.ts
-async function mintVdigSlot(rawValue, policy, prevBlob, cek, collection, recordId, field) {
-  const normalized = normalizeForVerify(policy.normalize, rawValue);
-  let prev = null;
-  if (prevBlob !== void 0) {
-    try {
-      prev = await openVdigPayload(prevBlob, cek, collection, recordId, field);
-    } catch {
-      throw new TamperedError();
-    }
-    if (!Number.isInteger(prev.iter) || prev.iter < 1) {
-      throw new TamperedError();
-    }
-  }
-  if (prev !== null && policy.notLastN > 0) {
-    const history = [prev.cur, ...prev.ring ?? []];
-    for (const entry of history) {
-      const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(entry.salt), prev.iter);
-      if (await blindedEqual(digest, base64ToBuffer(entry.hash))) {
-        throw new ClassifiedRotationError(collection, field, "password was used recently");
-      }
-    }
-  }
-  const salt = generateSalt();
-  const hash = await pbkdf2VerifyDigest(normalized, salt, VDIG_ITERATIONS);
-  const ring = prev !== null && policy.notLastN > 0 ? [...prev.ring ?? [], { salt: prev.cur.salt, hash: prev.cur.hash }].slice(-policy.notLastN) : void 0;
-  const payload = {
-    v: 1,
-    alg: "PBKDF2-SHA256",
-    iter: VDIG_ITERATIONS,
-    cur: { salt: bufferToBase64(salt), hash: bufferToBase64(hash), at: (/* @__PURE__ */ new Date()).toISOString() },
-    ...ring !== void 0 && ring.length > 0 ? { ring } : {}
+    ...buildRecordEnvelope(
+      { ...ref, version, ...actor ? { by: actor } : {} },
+      { iv: "", data: "" }
+    ),
+    _del: true
   };
-  return sealVdigPayload(payload, cek, collection, recordId, field);
 }
 
 // src/kernel/schema.ts
@@ -441,11 +244,109 @@ function formatPath(path) {
   ).join(".");
 }
 
-// src/kernel/enclave/record-keys/record-codec.ts
-var RecordCodec = class _RecordCodec {
-  constructor(ctx) {
+// src/capsule/plumbing/sealed-slots.ts
+function makeSealedSlots(p, sealedSlot) {
+  const { decrypt, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, encrypt } = p;
+  const { dualReadSealedSlot } = sealedSlot;
+  async function sealOneFieldWithDek(field, value, dek, keyMaterial) {
+    const fieldKey = keyMaterial.cek !== void 0 ? await deriveSealedFieldKeyFromCek(keyMaterial.cek, keyMaterial.collection, field) : await deriveSealedFieldKey(dek, keyMaterial.collection, field);
+    return encrypt(JSON.stringify(value), fieldKey);
+  }
+  async function sealOneField(field, value, keyMaterial) {
+    const dek = await keyMaterial.getDEK();
+    return sealOneFieldWithDek(field, value, dek, keyMaterial);
+  }
+  async function sealFields(record, sensitiveFields, keyMaterial) {
+    const dek = await keyMaterial.getDEK();
+    const open = { ...record };
+    const slots = {};
+    for (const field of sensitiveFields) {
+      if (!(field in record)) continue;
+      const value = record[field];
+      if (value === void 0) continue;
+      const { iv, data } = await sealOneFieldWithDek(field, value, dek, keyMaterial);
+      slots[field] = `${iv}:${data}`;
+      delete open[field];
+    }
+    if (Object.keys(slots).length === 0) return { openRecord: record, sealed: void 0 };
+    return { openRecord: open, sealed: slots };
+  }
+  async function unsealOneField(field, blob, keyMaterial) {
+    const dek = await keyMaterial.getDEK();
+    return JSON.parse(await dualReadSealedSlot(blob, field, keyMaterial.collection, keyMaterial.cek, dek));
+  }
+  function makeHandleProducer(keyMaterial) {
+    return (field, blob) => new SealedHandle(() => unsealOneField(field, blob, keyMaterial));
+  }
+  async function unsealFields(record, sealed, keyMaterial, opts) {
+    const makeHandle = opts?.asHandles === true ? makeHandleProducer(keyMaterial) : void 0;
+    for (const [field, blob] of Object.entries(sealed)) {
+      record[field] = makeHandle !== void 0 ? makeHandle(field, blob) : await unsealOneField(field, blob, keyMaterial);
+    }
+    return record;
+  }
+  function makeSealedSlotCapability(ctx, recordId, cek) {
+    const keyMaterial = {
+      collection: ctx.name,
+      ...cek !== void 0 ? { cek } : {},
+      getDEK: () => ctx.getDEK()
+    };
+    const deletedFields = /* @__PURE__ */ new Set();
+    return {
+      async seal(field, plaintext) {
+        const ref = await sealOneField(field, plaintext, keyMaterial);
+        deletedFields.delete(field);
+        return ref;
+      },
+      async unseal(field, ref) {
+        if (deletedFields.has(field)) {
+          throw new ValidationError(`sealedSlots.unseal: field "${field}" on record "${recordId}" was deleted from this capability`);
+        }
+        return unsealOneField(field, `${ref.iv}:${ref.data}`, keyMaterial);
+      },
+      async delete(field) {
+        deletedFields.add(field);
+      }
+    };
+  }
+  function makeReservedEnvelopes(dekResolver, declaredPrefixes) {
+    const declared = new Set(declaredPrefixes);
+    return (prefix) => {
+      if (!declared.has(prefix)) {
+        throw new ValidationError(`reservedEnvelopes: prefix "${prefix}" is not declared by this binding's reservedPrefixes`);
+      }
+      const assertPrefixed = (collection, method) => {
+        if (!collection.startsWith(prefix)) {
+          throw new ValidationError(
+            `reservedEnvelopes('${prefix}').${method}: collection "${collection}" does not start with "${prefix}"`
+          );
+        }
+      };
+      const encryptForPrefix = async (ref, json, v) => {
+        assertPrefixed(ref.collection, "encrypt");
+        const dek = await dekResolver(ref.collection);
+        const identity = { ...ref, version: v };
+        const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+        return buildRecordEnvelope(identity, { iv, data });
+      };
+      const decryptForPrefix = async (collection, id, env) => {
+        assertPrefixed(collection, "decrypt");
+        const dek = await dekResolver(collection);
+        return decrypt(...sealedBodyArgs(env, "openSealedSlots"), dek, recordAadFor({ collection, id }, env));
+      };
+      return { encrypt: encryptForPrefix, decrypt: decryptForPrefix };
+    };
+  }
+  return { sealFields, unsealOneField, makeHandleProducer, unsealFields, makeSealedSlotCapability, makeReservedEnvelopes };
+}
+
+// src/capsule/plumbing/record-codec.ts
+var RecordCodecBase = class _RecordCodecBase {
+  constructor(caps, ctx) {
+    this.caps = caps;
     this.ctx = ctx;
   }
+  caps;
   ctx;
   /**
    * @internal Update the live Via pipeline this codec's at-rest hooks read
@@ -479,8 +380,8 @@ var RecordCodec = class _RecordCodec {
   viaCryptoCtx(recordId, cek) {
     const declaredPrefixes = this.ctx.via?.bindings.flatMap((b) => b.reservedPrefixes ?? []) ?? [];
     return {
-      sealedSlots: makeSealedSlotCapability(this.ctx, recordId, cek),
-      reservedEnvelopes: makeReservedEnvelopes((collection) => this.ctx.getDEK(collection), declaredPrefixes)
+      sealedSlots: this.caps.makeSealedSlotCapability(this.ctx, recordId, cek),
+      reservedEnvelopes: this.caps.makeReservedEnvelopes((collection) => this.ctx.getDEK(collection), declaredPrefixes)
     };
   }
   // ──────────────────────────────────────────────────────────────────────
@@ -561,17 +462,17 @@ var RecordCodec = class _RecordCodec {
     const identity = { ...ref, version, by: this.ctx.actor };
     const provenance = this.ctx.provenance && source !== void 0 ? { source, sourceTs: sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : void 0;
     if (!this.ctx.storeCiphertext) {
-      return _RecordCodec.buildPlaintextEnvelope(identity, { data: json, provenance });
+      return _RecordCodecBase.buildPlaintextEnvelope(identity, { data: json, provenance });
     }
     const dek = await this.ctx.getDEK();
     const aad = buildRecordAad(identity);
     if (cek !== void 0) {
-      const { iv: iv2, data: data2 } = await encrypt(json, cek, aad);
-      const wrapped = await wrapCek(cek, dek);
-      return _RecordCodec.buildEnvelope(identity, { iv: iv2, data: data2, cek: wrapped, provenance });
+      const { iv: iv2, data: data2 } = await this.caps.encrypt(json, cek, aad);
+      const wrapped = await this.caps.wrapCek(cek, dek);
+      return _RecordCodecBase.buildEnvelope(identity, { iv: iv2, data: data2, cek: wrapped, provenance });
     }
-    const { iv, data } = await encrypt(json, dek, aad);
-    return _RecordCodec.buildEnvelope(identity, { iv, data, provenance });
+    const { iv, data } = await this.caps.encrypt(json, dek, aad);
+    return _RecordCodecBase.buildEnvelope(identity, { iv, data, provenance });
   }
   /**
    * `ref` is FIRST and required (#1051). It was previously a trailing optional
@@ -616,7 +517,7 @@ var RecordCodec = class _RecordCodec {
     if (this.ctx.storeCiphertext && this.ctx.via?.hasAtRestHooks) {
       if (id === "") {
         throw new Error(
-          `RecordCodec.encryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this write path supplied an empty record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
+          `RecordCodecBase.encryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this write path supplied an empty record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
         );
       }
       const src = record;
@@ -628,7 +529,7 @@ var RecordCodec = class _RecordCodec {
       }
     } else if (this.ctx.storeCiphertext && this.ctx.sensitiveFields.size > 0) {
       const src = record;
-      const result = await sealFields(src, this.ctx.sensitiveFields, this.sealKeyMaterial(cek));
+      const result = await this.caps.sealFields(src, this.ctx.sensitiveFields, this.sealKeyMaterial(cek));
       if (result.sealed !== void 0) {
         sealed = result.sealed;
         openRecord = result.openRecord;
@@ -639,12 +540,12 @@ var RecordCodec = class _RecordCodec {
     if (this.ctx.vdigFields !== null && this.ctx.vdigFields.size > 0 && this.ctx.storeCiphertext) {
       if (vdig === void 0) {
         throw new Error(
-          `RecordCodec.encryptRecord: collection "${this.ctx.name}" declares digest-only classified fields but this write path supplied no { id, prev } context \u2014 it would silently destroy _vdig (C6). Caller bug.`
+          `RecordCodecBase.encryptRecord: collection "${this.ctx.name}" declares digest-only classified fields but this write path supplied no { id, prev } context \u2014 it would silently destroy _vdig (C6). Caller bug.`
         );
       }
       if (cek === void 0) {
         throw new Error(
-          `RecordCodec.encryptRecord: digest-only fields require a per-record CEK (R1 invariant) \u2014 collection "${this.ctx.name}" wrote without one. Caller bug.`
+          `RecordCodecBase.encryptRecord: digest-only fields require a per-record CEK (R1 invariant) \u2014 collection "${this.ctx.name}" wrote without one. Caller bug.`
         );
       }
       const open = { ...openRecord };
@@ -677,11 +578,11 @@ var RecordCodec = class _RecordCodec {
             `digest-only classified field "${field}" in "${this.ctx.name}" must be a string (rotate) or null (clear), got ${typeof value}`
           );
         }
-        out[field] = await mintVdigSlot(value, policy, prevBlob, cek, this.ctx.name, vdig.id, field);
+        out[field] = await this.caps.mintVdigSlot(value, policy, prevBlob, cek, this.ctx.name, vdig.id, field);
         if (policy.equatable === true) {
           if (bidxDek === void 0) bidxDek = await this.ctx.getDEK();
           const normalized = normalizeForVerify(policy.normalize, value);
-          bidxOut[field] = await mintBidxTag(normalized, bidxDek, this.ctx.name, field);
+          bidxOut[field] = await this.caps.mintBidxTag(normalized, bidxDek, this.ctx.name, field);
         }
         delete open[field];
       }
@@ -695,7 +596,7 @@ var RecordCodec = class _RecordCodec {
     const withBidx = bidxOutMap ? { ...withVdig, _bidx: bidxOutMap } : withVdig;
     if (!this.ctx.deterministicFields || !this.ctx.storeCiphertext) return withBidx;
     const dek = await this.ctx.getDEK();
-    const detKey = await deriveDeterministicKey(dek);
+    const detKey = await this.caps.deriveDeterministicKey(dek);
     const rec = record;
     const det = {};
     for (const field of this.ctx.deterministicFields) {
@@ -704,7 +605,7 @@ var RecordCodec = class _RecordCodec {
       const value = rec[field];
       if (value === void 0 || value === null) continue;
       const plaintext = typeof value === "string" ? value : JSON.stringify(value);
-      const { iv, data } = await encryptDeterministic(plaintext, detKey, `${this.ctx.name}/${field}`);
+      const { iv, data } = await this.caps.encryptDeterministic(plaintext, detKey, `${this.ctx.name}/${field}`);
       det[field] = `${iv}:${data}`;
     }
     if (Object.keys(det).length === 0) return withBidx;
@@ -726,7 +627,7 @@ var RecordCodec = class _RecordCodec {
     const cached = id !== void 0 ? this.ctx.cekCache?.get(id) : void 0;
     if (cached !== void 0) return cached;
     const dek = await this.ctx.getDEK();
-    const cek = await unwrapCek(envelope._cek, dek);
+    const cek = await this.caps.unwrapCek(envelope._cek, dek);
     if (id !== void 0) this.ctx.cekCache?.set(id, cek, 1);
     return cek;
   }
@@ -762,11 +663,12 @@ var RecordCodec = class _RecordCodec {
         }
         return JSON.stringify(rec);
       }
-      return envelope._data === "" ? null : envelope._data;
+      const plain = envelope._data ?? "";
+      return plain === "" ? null : plain;
     }
     const aad = recordAadFor(ref, envelope);
     const cek = await this.resolveEnvelopeCek(envelope, id);
-    const json = cek !== void 0 ? await decrypt(envelope._iv, envelope._data, cek, aad) : await decrypt(envelope._iv, envelope._data, await this.ctx.getDEK(), aad);
+    const json = cek !== void 0 ? await this.caps.decrypt(...sealedBodyArgs(envelope, "RecordCodec"), cek, aad) : await this.caps.decrypt(...sealedBodyArgs(envelope, "RecordCodec"), await this.ctx.getDEK(), aad);
     this.observeDecrypt(ref);
     return json;
   }
@@ -795,7 +697,7 @@ var RecordCodec = class _RecordCodec {
    * materialisation always agree byte-for-byte.
    */
   async unsealField(field, blob, cek) {
-    return unsealOneField(field, blob, this.sealKeyMaterial(cek));
+    return this.caps.unsealOneField(field, blob, this.sealKeyMaterial(cek));
   }
   /**
    * Build the `ViaCryptoCtx` for forget()'s per-ref via-erase fold (#629
@@ -837,7 +739,7 @@ var RecordCodec = class _RecordCodec {
       }
       const { iv, data } = parseSealedSlot(blob);
       try {
-        await decrypt(iv, data, await deriveSealedFieldKeyFromCek(cek, this.ctx.name, field));
+        await this.caps.decrypt(iv, data, await this.caps.deriveSealedFieldKeyFromCek(cek, this.ctx.name, field));
         slots.push({ field, class: "shreddable" });
       } catch {
         slots.push({ field, class: "dekResidue" });
@@ -853,7 +755,7 @@ var RecordCodec = class _RecordCodec {
    * exposing the value, which decrypts only on `reveal()`.
    */
   makeSealedHandle(field, blob, cek) {
-    return makeHandleProducer(this.sealKeyMaterial(cek))(field, blob);
+    return this.caps.makeHandleProducer(this.sealKeyMaterial(cek))(field, blob);
   }
   /**
    * Replace every field the just-written envelope actually sealed with a
@@ -911,7 +813,7 @@ var RecordCodec = class _RecordCodec {
     if (this.ctx.via?.hasAtRestHooks) {
       if (opts.id === void 0 || opts.id === "") {
         throw new Error(
-          `RecordCodec.decryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this read path supplied no record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
+          `RecordCodecBase.decryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this read path supplied no record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
         );
       }
       const sealedRefs = {};
@@ -926,7 +828,7 @@ var RecordCodec = class _RecordCodec {
         { asHandles: opts.sealedAsHandles === true }
       );
     }
-    return await unsealFields(
+    return await this.caps.unsealFields(
       record,
       sealed,
       this.sealKeyMaterial(cek),
@@ -966,10 +868,10 @@ var RecordCodec = class _RecordCodec {
     let cek;
     const aad = recordAadFor(ref, envelope);
     if (envelope._cek !== void 0) {
-      cek = await unwrapCek(envelope._cek, dek);
-      plaintext = await decrypt(envelope._iv, envelope._data, cek, aad);
+      cek = await this.caps.unwrapCek(envelope._cek, dek);
+      plaintext = await this.caps.decrypt(...sealedBodyArgs(envelope, "RecordCodec"), cek, aad);
     } else {
-      plaintext = await decrypt(envelope._iv, envelope._data, dek, aad);
+      plaintext = await this.caps.decrypt(...sealedBodyArgs(envelope, "RecordCodec"), dek, aad);
     }
     let record = JSON.parse(plaintext);
     if (envelope._sealed !== void 0 && this.ctx.storeCiphertext) {
@@ -1019,367 +921,455 @@ var RecordCodec = class _RecordCodec {
     return record;
   }
 };
+function makeRecordCodec(p, slots) {
+  const caps = { ...p, ...slots };
+  const RecordCodec = class extends RecordCodecBase {
+    constructor(ctx) {
+      super(caps, ctx);
+    }
+  };
+  return { RecordCodec };
+}
 
-// src/kernel/enclave/record-keys/sealing.ts
-var subtle = globalThis.crypto.subtle;
-var SEALED_CEK_NS = "_sealed_cek";
-async function sealRecordToHost(ctx, collection, id, hostSealer, opts) {
-  if (collection.includes("/")) throw new ValidationError(`sealRecordToHost: collection "${collection}" must not contain "/"`);
-  if (id.includes("/")) throw new ValidationError(`sealRecordToHost: id "${id}" must not contain "/"`);
-  if (Number.isNaN(Date.parse(opts.expiresAt))) {
-    throw new ValidationError(`sealRecordToHost: expiresAt "${opts.expiresAt}" is not a valid ISO 8601 timestamp`);
+// src/capsule/plumbing/lifecycle.ts
+function makeLifecycle(p) {
+  const { decrypt, encrypt, generateDEK, unwrapCek, wrapCek } = p;
+  async function resolveStableCek(deps, id) {
+    const cached = deps.cache?.get(id);
+    if (cached) return cached;
+    const live = await deps.getLive(id);
+    if (live?._cek !== void 0) {
+      const cek = await unwrapCek(live._cek, await deps.getDEK());
+      deps.cache?.set(id, cek, 1);
+      return cek;
+    }
+    const fresh = await generateDEK();
+    deps.cache?.set(id, fresh, 1);
+    return fresh;
   }
-  const live = await ctx.adapter.get(ctx.vault, collection, id);
-  if (!live || live._cek === void 0) {
-    throw new RecordCekNotFoundError(collection, id);
+  async function rewrapBodyToDek(from, to, envelope, fromDek, toDek) {
+    const openAad = buildRecordAad(from);
+    const sealAad = buildRecordAad(to);
+    if (envelope._cek !== void 0) {
+      const cek = await unwrapCek(envelope._cek, fromDek);
+      const plaintext2 = await decrypt(...sealedBodyArgs(envelope, "rewrapBodyToDek"), cek, openAad);
+      const { iv: iv2, data: data2 } = await encrypt(plaintext2, cek, sealAad);
+      return { _iv: iv2, _data: data2, _cek: await wrapCek(cek, toDek), cek };
+    }
+    const plaintext = await decrypt(...sealedBodyArgs(envelope, "rewrapBodyToDek"), fromDek, openAad);
+    const { iv, data } = await encrypt(plaintext, toDek, sealAad);
+    return { _iv: iv, _data: data, cek: null };
   }
-  const dek = await ctx.getDEK(collection);
-  const cek = await unwrapCek(live._cek, dek);
-  const rawCek = await subtle.exportKey("raw", cek);
-  const cekB64 = bufferToBase64(rawCek);
-  const hint = await hostSealer.publishRecipientHint();
-  if (hint.pid.includes("/")) throw new ValidationError(`sealRecordToHost: recipient pid "${hint.pid}" must not contain "/"`);
-  const binding = {
-    collection,
-    id,
-    cek: cekB64,
-    expiresAt: opts.expiresAt
-  };
-  const sealed = await hostSealer.sealForRecipient(
-    new TextEncoder().encode(JSON.stringify(binding)),
-    hint
-  );
-  const delivery = {
-    v: 1,
-    _noydb_sealed_cek: 1,
-    pid: hint.pid,
-    payload: bufferToBase64(sealed),
-    expiresAt: opts.expiresAt
-  };
-  const envelopeKey = `${collection}/${id}/${hint.pid}`;
-  const prior = await ctx.adapter.get(ctx.vault, SEALED_CEK_NS, envelopeKey);
-  const env = buildRecordEnvelope(
-    { collection: SEALED_CEK_NS, id: envelopeKey, version: (prior?._v ?? 0) + 1 },
-    {
-      // AES-GCM bypassed — the sealing layer is the security boundary, exactly
-      // like the managed-secret `_meta/sealed-secret` envelope.
-      iv: "",
-      data: JSON.stringify(delivery),
-      ...ctx.actor ? { by: ctx.actor } : {}
+  function applyRewrappedBody(envelope, body) {
+    const next = {
+      ...envelope,
+      _iv: body._iv,
+      _data: body._data,
+      ...body._cek !== void 0 ? { _cek: body._cek } : {}
+    };
+    if (body._cek === void 0 && envelope._cek !== void 0) {
+      delete next._cek;
     }
-  );
-  await ctx.adapter.put(ctx.vault, SEALED_CEK_NS, envelopeKey, env);
-  return { pid: hint.pid, envelopeKey };
-}
-async function revokeSealedRecord(ctx, collection, id, pid, opts) {
-  if (opts?.hard === true) {
-    await rotateRecordCek(ctx, collection, id);
-    return;
+    return next;
   }
-  await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, `${collection}/${id}/${pid}`);
-}
-async function rotateRecordCek(ctx, collection, id) {
-  const live = await ctx.adapter.get(ctx.vault, collection, id);
-  if (!live || live._cek === void 0) {
-    throw new RecordCekNotFoundError(collection, id);
+  async function rewrapEnvelope(identity, envelope, fromDek, toDek) {
+    return applyRewrappedBody(envelope, await rewrapBodyToDek(identity, identity, envelope, fromDek, toDek));
   }
-  const dek = await ctx.getDEK(collection);
-  const oldCek = await unwrapCek(live._cek, dek);
-  const openAad = recordAadFor({ collection, id }, live);
-  const json = await decrypt(live._iv, live._data, oldCek, openAad);
-  const rotatedIdentity = {
-    // A CEK rotation DOES bump `_v` (asserted in `record-scoped-cek-sealing`:
-    // "the live envelope was re-keyed — new `_cek`, bumped `_v`"), so it seals
-    // at the new version, not the one it just opened.
-    //
-    // ⚠️ Do not confuse this with `rekeyEnvelopeToDek`, the DEK-rotation helper,
-    // which PRESERVES `_v` (#1074) because it re-keys a record without writing
-    // one. Two rotations, opposite answers — and with `_v` bound (#1093) getting
-    // it backwards no longer produces a wrong number, it produces an
-    // unreadable record.
-    collection,
-    id,
-    version: live._v + 1,
-    ...live._tier !== void 0 ? { tier: live._tier } : {},
-    ...ctx.actor ? { by: ctx.actor } : live._by !== void 0 ? { by: live._by } : {}
-  };
-  const newCek = await generateDEK();
-  const { iv, data } = await encrypt(json, newCek, buildRecordAad(rotatedIdentity));
-  let sealedOut;
-  if (live._sealed !== void 0) {
-    const out = {};
-    for (const [field, slot] of Object.entries(live._sealed)) {
-      const plaintext = await dualReadSealedSlot(slot, field, collection, oldCek, dek);
-      const resealed = await encrypt(plaintext, await deriveSealedFieldKeyFromCek(newCek, collection, field));
-      out[field] = `${resealed.iv}:${resealed.data}`;
+  async function isRewrappedUnder(identity, envelope, dek) {
+    try {
+      if (envelope._cek !== void 0) {
+        await unwrapCek(envelope._cek, dek);
+      } else {
+        await decrypt(...sealedBodyArgs(envelope, "rewrapBodyToDek"), dek, buildRecordAad(identity));
+      }
+      return true;
+    } catch {
+      return false;
     }
-    sealedOut = out;
   }
-  let vdigOut;
-  if (live._vdig !== void 0) {
-    const out = {};
-    for (const [field, blob] of Object.entries(live._vdig)) {
-      const payload = await openVdigPayload(blob, oldCek, collection, id, field);
-      out[field] = await sealVdigPayload(payload, newCek, collection, id, field);
+  return { resolveStableCek, rewrapBodyToDek, applyRewrappedBody, rewrapEnvelope, isRewrappedUnder };
+}
+
+// src/capsule/plumbing/rekey.ts
+function makeRekey(p) {
+  const { decrypt, encrypt, unwrapCek, wrapCek } = p;
+  async function rekeyEnvelopeToDek(ref, envelope, oldDek, newDek) {
+    const aad = recordAadFor(ref, envelope);
+    const { _bidx, ...carried } = envelope;
+    void _bidx;
+    if (envelope._cek !== void 0) {
+      const cek = await unwrapCek(envelope._cek, oldDek);
+      return { ...carried, _cek: await wrapCek(cek, newDek) };
     }
-    vdigOut = out;
+    const plaintext = await decrypt(...sealedBodyArgs(envelope, "rekeyRecord"), oldDek, aad);
+    const { iv, data } = await encrypt(plaintext, newDek, aad);
+    return { ...carried, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: iv, _data: data };
   }
-  const env = buildRecordEnvelope(rotatedIdentity, {
-    iv,
-    data,
-    cek: await wrapCek(newCek, dek),
-    extra: {
-      ...live._det !== void 0 ? { _det: live._det } : {},
-      // `_bidx` (equality-index tag) is DEK-rooted and CEK-independent, so it is
-      // carried forward VERBATIM — not recomputed — unlike `_vdig`/`_sealed`
-      // below, which are CEK-bound and must be re-sealed under the new CEK.
-      // Dropping this line would silently orphan the equality index on rotation
-      // (the #306 Slice-A data-loss bug, replayed on the index).
-      ...live._bidx !== void 0 ? { _bidx: live._bidx } : {},
-      // Re-encrypt sealed (`sensitive`) fields under the new CEK. Sealed
-      // keys derive off the per-record CEK, so the rotated record's old CEK is
-      // destroyed here — carrying the old `_sealed` slots forward verbatim would
-      // orphan them (unreadable under the new CEK). `sealedOut` holds the slots
-      // dual-read from the old CEK (or the legacy DEK) and re-sealed under newCek.
-      ...sealedOut !== void 0 ? { _sealed: sealedOut } : {},
-      ...vdigOut !== void 0 ? { _vdig: vdigOut } : {}
+  async function rekeyEnvelopeIfNeeded(ref, envelope, oldDek, newDek) {
+    try {
+      return await rekeyEnvelopeToDek(ref, envelope, oldDek, newDek);
+    } catch (errUnderOld) {
+      try {
+        if (envelope._cek !== void 0) await unwrapCek(envelope._cek, newDek);
+        else await decrypt(...sealedBodyArgs(envelope, "rekeyRecord"), newDek, recordAadFor(ref, envelope));
+        return null;
+      } catch {
+        throw errUnderOld;
+      }
     }
-  });
-  await ctx.adapter.put(ctx.vault, collection, id, env);
-  await ctx.invalidateRecordCaches(collection, id);
-  const prefix = `${collection}/${id}/`;
-  const keys = await ctx.adapter.list(ctx.vault, SEALED_CEK_NS);
-  for (const key of keys) {
-    if (key.startsWith(prefix)) {
-      await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, key);
+  }
+  async function envelopeOpensUnderAny(ref, envelope, keys) {
+    for (const key of keys) {
+      try {
+        if (envelope._cek !== void 0) await unwrapCek(envelope._cek, key);
+        else await decrypt(...sealedBodyArgs(envelope, "rekeyRecord"), key, recordAadFor(ref, envelope));
+        return true;
+      } catch {
+      }
     }
+    return false;
   }
+  return { rekeyEnvelopeToDek, rekeyEnvelopeIfNeeded, envelopeOpensUnderAny };
 }
 
-// src/kernel/enclave/record-keys/deterministic.ts
-async function detTargets(ctx, field, value) {
-  const dek = await ctx.getDEK();
-  const detKey = await deriveDeterministicKey(dek);
-  const plaintext = typeof value === "string" ? value : JSON.stringify(value);
-  const context = `${ctx.name}/${field}`;
-  const [current, legacy] = await Promise.all([
-    encryptDeterministic(plaintext, detKey, context),
-    encryptDeterministic(plaintext, dek, context)
-  ]);
-  return [`${current.iv}:${current.data}`, `${legacy.iv}:${legacy.data}`];
-}
-function assertDetField(ctx, field, method) {
-  if (!ctx.deterministicFields || !ctx.deterministicFields.has(field)) {
-    throw new Error(
-      `Collection "${ctx.name}": field "${field}" is not declared in deterministicFields`
-    );
-  }
-  if (!ctx.storeCiphertext) {
-    throw new Error(
-      `Collection "${ctx.name}": ${method} is only meaningful on encrypted collections`
-    );
+// src/capsule/plumbing/rekey-blob.ts
+function makeRekeyBlob(p) {
+  const { decrypt, decryptBytesWithAAD, encrypt, encryptBytesWithAAD, unwrapCek, wrapCek } = p;
+  const BLOB_INDEX_COLLECTION = "_blob_index";
+  const BLOB_CHUNKS_COLLECTION = "_blob_chunks";
+  function chunkAad(eTag, index, chunkCount) {
+    return new TextEncoder().encode(`${eTag}:${index}:${chunkCount}`);
   }
-}
-async function findByDet(ctx, field, value) {
-  assertDetField(ctx, field, "findByDet");
-  const [target, legacyTarget] = await detTargets(ctx, field, value);
-  const ids = await ctx.adapter.list(ctx.vault, ctx.name);
-  for (const id of ids) {
-    const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
-    if (!env || !env._det || (env._tier ?? 0) > 0) continue;
-    if (env._det[field] === target || env._det[field] === legacyTarget) {
-      return ctx.codec.decryptRecord({ collection: ctx.name, id }, env);
+  async function opensJson(ref, env, key) {
+    try {
+      return await decrypt(...sealedBodyArgs(env, "rekeyBlob"), key, recordAadFor(ref, env));
+    } catch {
+      return null;
     }
   }
-  return null;
-}
-async function queryByDet(ctx, field, value) {
-  assertDetField(ctx, field, "queryByDet");
-  const [target, legacyTarget] = await detTargets(ctx, field, value);
-  const ids = await ctx.adapter.list(ctx.vault, ctx.name);
-  const matches = [];
-  for (const id of ids) {
-    const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
-    if (!env || !env._det || (env._tier ?? 0) > 0) continue;
-    if (env._det[field] === target || env._det[field] === legacyTarget) {
-      const rec = await ctx.codec.decryptRecord({ collection: ctx.name, id }, env);
-      if (rec !== null) matches.push(rec);
+  async function rekeyBlobSet(adapter, vault, oldDek, newDek, otherDeks = []) {
+    let blobs = 0;
+    let chunks = 0;
+    let foreign = 0;
+    let alreadyMoved = 0;
+    let eTags;
+    try {
+      eTags = await adapter.list(vault, BLOB_INDEX_COLLECTION);
+    } catch {
+      return { blobs, chunks, foreign, alreadyMoved };
+    }
+    for (const eTag of eTags) {
+      const idxEnv = await adapter.get(vault, BLOB_INDEX_COLLECTION, eTag);
+      if (!idxEnv || !idxEnv._iv) continue;
+      const ref = { collection: BLOB_INDEX_COLLECTION, id: eTag };
+      const json = await opensJson(ref, idxEnv, oldDek);
+      if (json === null) {
+        if (await opensJson(ref, idxEnv, newDek) !== null) {
+          alreadyMoved++;
+          continue;
+        }
+        let claimed = false;
+        for (const key of otherDeks) {
+          if (await opensJson(ref, idxEnv, key) !== null) {
+            claimed = true;
+            break;
+          }
+        }
+        if (claimed) {
+          foreign++;
+          continue;
+        }
+        throw new Error(
+          `[noy-db] rotateKeys: blob index entry "${eTag}" opens under neither the retiring nor the new \`_blob\` DEK, nor any other key this keyring holds. Rotation stopped rather than leaving it unreadable and unreported.`
+        );
+      }
+      const blob = JSON.parse(json);
+      for (let i = 0; i < blob.chunkCount; i++) {
+        const id = `${eTag}_${i}`;
+        const chunkEnv = await adapter.get(vault, BLOB_CHUNKS_COLLECTION, id);
+        if (!chunkEnv || !chunkEnv._iv) continue;
+        const aad = chunkAad(eTag, i, blob.chunkCount);
+        let plain;
+        try {
+          plain = await decryptBytesWithAAD(...sealedBodyArgs(chunkEnv, "rekeyBlob"), oldDek, aad);
+        } catch {
+          if (blob._cek !== void 0 || blob._cekPending !== void 0) continue;
+          try {
+            await decryptBytesWithAAD(...sealedBodyArgs(chunkEnv, "rekeyBlob"), newDek, aad);
+            continue;
+          } catch {
+            throw new Error(
+              `[noy-db] rotateKeys: blob chunk "${id}" (${i + 1}/${blob.chunkCount} of eTag "${eTag}") opens under neither the retiring nor the new \`_blob\` DEK, and its blob holds no content CEK that could explain it. Rotation stopped rather than leaving it unreadable and unreported.`
+            );
+          }
+        }
+        const { iv: iv2, data: data2 } = await encryptBytesWithAAD(plain, newDek, aad);
+        await adapter.put(vault, BLOB_CHUNKS_COLLECTION, id, { ...chunkEnv, _iv: iv2, _data: data2 });
+        chunks++;
+      }
+      const rewrapped = {
+        ...blob,
+        ...blob._cek !== void 0 ? { _cek: await wrapCek(await unwrapCek(blob._cek, oldDek), newDek) } : {},
+        ...blob._cekPending !== void 0 ? { _cekPending: await wrapCek(await unwrapCek(blob._cekPending, oldDek), newDek) } : {}
+      };
+      const { iv, data } = await encrypt(JSON.stringify(rewrapped), newDek, recordAadFor(ref, idxEnv));
+      await adapter.put(vault, BLOB_INDEX_COLLECTION, eTag, { ...idxEnv, _iv: iv, _data: data });
+      blobs++;
     }
+    return { blobs, chunks, foreign, alreadyMoved };
   }
-  return matches;
+  return { rekeyBlobSet };
 }
 
-// src/kernel/enclave/record-keys/envelope-body.ts
-async function openEnvelopeJson(ref, env, key, opts) {
-  if (opts?.encrypted === false) return env._data;
-  const aad = recordAadFor(ref, env);
-  if (env._cek !== void 0) {
-    const cek = await unwrapCek(env._cek, key);
-    return decrypt(env._iv, env._data, cek, aad);
+// src/capsule/plumbing/sealing.ts
+function makeSealing(p, sealedSlot) {
+  const { openVdigPayload, sealVdigPayload, bufferToBase64, decrypt, deriveSealedFieldKeyFromCek, encrypt, generateDEK, unwrapCek, wrapCek } = p;
+  const { dualReadSealedSlot } = sealedSlot;
+  const subtle = globalThis.crypto.subtle;
+  const SEALED_CEK_NS = "_sealed_cek";
+  async function sealRecordToHost(ctx, collection, id, hostSealer, opts) {
+    if (collection.includes("/")) throw new ValidationError(`sealRecordToHost: collection "${collection}" must not contain "/"`);
+    if (id.includes("/")) throw new ValidationError(`sealRecordToHost: id "${id}" must not contain "/"`);
+    if (Number.isNaN(Date.parse(opts.expiresAt))) {
+      throw new ValidationError(`sealRecordToHost: expiresAt "${opts.expiresAt}" is not a valid ISO 8601 timestamp`);
+    }
+    const live = await ctx.adapter.get(ctx.vault, collection, id);
+    if (!live || live._cek === void 0) {
+      throw new RecordCekNotFoundError(collection, id);
+    }
+    const dek = await ctx.getDEK(collection);
+    const cek = await unwrapCek(live._cek, dek);
+    const rawCek = await subtle.exportKey("raw", cek);
+    const cekB64 = bufferToBase64(rawCek);
+    const hint = await hostSealer.publishRecipientHint();
+    if (hint.pid.includes("/")) throw new ValidationError(`sealRecordToHost: recipient pid "${hint.pid}" must not contain "/"`);
+    const binding = {
+      collection,
+      id,
+      cek: cekB64,
+      expiresAt: opts.expiresAt
+    };
+    const sealed = await hostSealer.sealForRecipient(
+      new TextEncoder().encode(JSON.stringify(binding)),
+      hint
+    );
+    const delivery = {
+      v: 1,
+      _noydb_sealed_cek: 1,
+      pid: hint.pid,
+      payload: bufferToBase64(sealed),
+      expiresAt: opts.expiresAt
+    };
+    const envelopeKey = `${collection}/${id}/${hint.pid}`;
+    const prior = await ctx.adapter.get(ctx.vault, SEALED_CEK_NS, envelopeKey);
+    const env = buildRecordEnvelope(
+      { collection: SEALED_CEK_NS, id: envelopeKey, version: (prior?._v ?? 0) + 1 },
+      {
+        // AES-GCM bypassed — the sealing layer is the security boundary, exactly
+        // like the managed-secret `_meta/sealed-secret` envelope.
+        iv: "",
+        data: JSON.stringify(delivery),
+        ...ctx.actor ? { by: ctx.actor } : {}
+      }
+    );
+    await ctx.adapter.put(ctx.vault, SEALED_CEK_NS, envelopeKey, env);
+    return { pid: hint.pid, envelopeKey };
   }
-  return decrypt(env._iv, env._data, key, aad);
-}
-async function writeEnvelopeBody(identity, json, key, opts) {
-  if (opts?.encrypted === false) return { _iv: "", _data: json };
-  const aad = buildRecordAad(identity);
-  if (opts?.perRecordKey === true) {
-    const cek = await generateDEK();
-    const { iv: iv2, data: data2 } = await encrypt(json, cek, aad);
-    const wrapped = await wrapCek(cek, key);
-    return { _iv: iv2, _data: data2, _cek: wrapped };
+  async function revokeSealedRecord(ctx, collection, id, pid, opts) {
+    if (opts?.hard === true) {
+      await rotateRecordCek(ctx, collection, id);
+      return;
+    }
+    await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, `${collection}/${id}/${pid}`);
   }
-  const { iv, data } = await encrypt(json, key, aad);
-  return { _iv: iv, _data: data };
-}
-function envelopeBodySize(env) {
-  return env._data.length + env._iv.length;
-}
-function hasPerRecordKey(env) {
-  return env._cek !== void 0;
-}
-function envelopeBodyForHash(env) {
-  if (env._sealed === void 0 && env._vdig === void 0 && env._bidx === void 0) return env._data;
-  const mapPart = (key, map) => {
-    const parts = Object.keys(map).sort().map(
-      (k) => `${JSON.stringify(k)}:${JSON.stringify(map[k])}`
-    );
-    return `${JSON.stringify(key)}:{${parts.join(",")}}`;
-  };
-  const segments = [`"_data":${JSON.stringify(env._data)}`];
-  if (env._sealed !== void 0) segments.push(mapPart("_sealed", env._sealed));
-  if (env._vdig !== void 0) segments.push(mapPart("_vdig", env._vdig));
-  if (env._bidx !== void 0) segments.push(mapPart("_bidx", env._bidx));
-  return `{${segments.join(",")}}`;
-}
-function hasSealedBody(env) {
-  return env._iv !== "";
-}
-async function verifyRecordIdentity(ref, env, key) {
-  if (!hasSealedBody(env)) return true;
-  try {
-    await openEnvelopeJson(ref, env, key);
-    return true;
-  } catch {
-    return false;
+  async function rotateRecordCek(ctx, collection, id) {
+    const live = await ctx.adapter.get(ctx.vault, collection, id);
+    if (!live || live._cek === void 0) {
+      throw new RecordCekNotFoundError(collection, id);
+    }
+    const dek = await ctx.getDEK(collection);
+    const oldCek = await unwrapCek(live._cek, dek);
+    const openAad = recordAadFor({ collection, id }, live);
+    const json = await decrypt(...sealedBodyArgs(live, "reseal"), oldCek, openAad);
+    const rotatedIdentity = {
+      // A CEK rotation DOES bump `_v` (asserted in `record-scoped-cek-sealing`:
+      // "the live envelope was re-keyed — new `_cek`, bumped `_v`"), so it seals
+      // at the new version, not the one it just opened.
+      //
+      // ⚠️ Do not confuse this with `rekeyEnvelopeToDek`, the DEK-rotation helper,
+      // which PRESERVES `_v` (#1074) because it re-keys a record without writing
+      // one. Two rotations, opposite answers — and with `_v` bound (#1093) getting
+      // it backwards no longer produces a wrong number, it produces an
+      // unreadable record.
+      collection,
+      id,
+      version: live._v + 1,
+      ...live._tier !== void 0 ? { tier: live._tier } : {},
+      ...ctx.actor ? { by: ctx.actor } : live._by !== void 0 ? { by: live._by } : {}
+    };
+    const newCek = await generateDEK();
+    const { iv, data } = await encrypt(json, newCek, buildRecordAad(rotatedIdentity));
+    let sealedOut;
+    if (live._sealed !== void 0) {
+      const out = {};
+      for (const [field, slot] of Object.entries(live._sealed)) {
+        const plaintext = await dualReadSealedSlot(slot, field, collection, oldCek, dek);
+        const resealed = await encrypt(plaintext, await deriveSealedFieldKeyFromCek(newCek, collection, field));
+        out[field] = `${resealed.iv}:${resealed.data}`;
+      }
+      sealedOut = out;
+    }
+    let vdigOut;
+    if (live._vdig !== void 0) {
+      const out = {};
+      for (const [field, blob] of Object.entries(live._vdig)) {
+        const payload = await openVdigPayload(blob, oldCek, collection, id, field);
+        out[field] = await sealVdigPayload(payload, newCek, collection, id, field);
+      }
+      vdigOut = out;
+    }
+    const env = buildRecordEnvelope(rotatedIdentity, {
+      iv,
+      data,
+      cek: await wrapCek(newCek, dek),
+      extra: {
+        ...live._det !== void 0 ? { _det: live._det } : {},
+        // `_bidx` (equality-index tag) is DEK-rooted and CEK-independent, so it is
+        // carried forward VERBATIM — not recomputed — unlike `_vdig`/`_sealed`
+        // below, which are CEK-bound and must be re-sealed under the new CEK.
+        // Dropping this line would silently orphan the equality index on rotation
+        // (the #306 Slice-A data-loss bug, replayed on the index).
+        ...live._bidx !== void 0 ? { _bidx: live._bidx } : {},
+        // Re-encrypt sealed (`sensitive`) fields under the new CEK. Sealed
+        // keys derive off the per-record CEK, so the rotated record's old CEK is
+        // destroyed here — carrying the old `_sealed` slots forward verbatim would
+        // orphan them (unreadable under the new CEK). `sealedOut` holds the slots
+        // dual-read from the old CEK (or the legacy DEK) and re-sealed under newCek.
+        ...sealedOut !== void 0 ? { _sealed: sealedOut } : {},
+        ...vdigOut !== void 0 ? { _vdig: vdigOut } : {}
+      }
+    });
+    await ctx.adapter.put(ctx.vault, collection, id, env);
+    await ctx.invalidateRecordCaches(collection, id);
+    const prefix = `${collection}/${id}/`;
+    const keys = await ctx.adapter.list(ctx.vault, SEALED_CEK_NS);
+    for (const key of keys) {
+      if (key.startsWith(prefix)) {
+        await ctx.adapter.delete(ctx.vault, SEALED_CEK_NS, key);
+      }
+    }
   }
+  return { SEALED_CEK_NS, sealRecordToHost, revokeSealedRecord, rotateRecordCek };
 }
 
-// src/kernel/enclave/broker/proof.ts
-var subtle2 = globalThis.crypto.subtle;
-var BROKER_PROOF_DOMAIN = "noydb-broker-proof";
-var BROKER_PROOF_VERSION = "noydb-broker-proof-v1";
-var DEFAULT_CHALLENGE_TTL_MS = 6e4;
-function buildCanonical(vaultId, brokerId, parts) {
-  return JSON.stringify([
-    BROKER_PROOF_VERSION,
-    vaultId,
-    parts.endpointOrigin,
-    brokerId,
-    parts.profile ?? "",
-    parts.instancePid ?? "",
-    parts.challenge,
-    parts.expiresAt
-  ]);
-}
-async function deriveBrokerProofBits(seed, vaultId, brokerId) {
-  const hkdfKey = await subtle2.importKey("raw", seed, "HKDF", false, ["deriveBits"]);
-  const salt = new TextEncoder().encode(BROKER_PROOF_DOMAIN);
-  const info = new TextEncoder().encode(JSON.stringify([BROKER_PROOF_DOMAIN, vaultId, brokerId]));
-  const bits = await subtle2.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
-  return new Uint8Array(bits);
-}
-async function deriveBrokerProofKey(seed, vaultId, brokerId) {
-  const proofBits = await deriveBrokerProofBits(seed, vaultId, brokerId);
-  try {
-    return await subtle2.importKey("raw", proofBits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-  } finally {
-    proofBits.fill(0);
+// src/capsule/plumbing/deterministic.ts
+function makeDeterministic(p) {
+  const { deriveDeterministicKey, encryptDeterministic } = p;
+  async function detTargets(ctx, field, value) {
+    const dek = await ctx.getDEK();
+    const detKey = await deriveDeterministicKey(dek);
+    const plaintext = typeof value === "string" ? value : JSON.stringify(value);
+    const context = `${ctx.name}/${field}`;
+    const [current, legacy] = await Promise.all([
+      encryptDeterministic(plaintext, detKey, context),
+      encryptDeterministic(plaintext, dek, context)
+    ]);
+    return [`${current.iv}:${current.data}`, `${legacy.iv}:${legacy.data}`];
   }
-}
-async function computeBrokerProof(seed, vaultId, brokerId, canonicalParts) {
-  try {
-    if (canonicalParts.instancePid === "") {
-      throw new ValidationError(
-        "computeBrokerProof: instancePid must not be an empty string \u2014 omit the field entirely for 'no instance' (F7); '' would alias onto a registered instance."
+  function assertDetField(ctx, field, method) {
+    if (!ctx.deterministicFields || !ctx.deterministicFields.has(field)) {
+      throw new Error(
+        `Collection "${ctx.name}": field "${field}" is not declared in deterministicFields`
       );
     }
-    const canonical = buildCanonical(vaultId, brokerId, canonicalParts);
-    const key = await deriveBrokerProofKey(seed, vaultId, brokerId);
-    const mac = await subtle2.sign("HMAC", key, new TextEncoder().encode(canonical));
-    return bufferToBase64(new Uint8Array(mac));
-  } finally {
-    seed.fill(0);
+    if (!ctx.storeCiphertext) {
+      throw new Error(
+        `Collection "${ctx.name}": ${method} is only meaningful on encrypted collections`
+      );
+    }
+  }
+  async function findByDet(ctx, field, value) {
+    assertDetField(ctx, field, "findByDet");
+    const [target, legacyTarget] = await detTargets(ctx, field, value);
+    const ids = await ctx.adapter.list(ctx.vault, ctx.name);
+    for (const id of ids) {
+      const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
+      if (!env || !env._det || (env._tier ?? 0) > 0) continue;
+      if (env._det[field] === target || env._det[field] === legacyTarget) {
+        return ctx.codec.decryptRecord({ collection: ctx.name, id }, env);
+      }
+    }
+    return null;
+  }
+  async function queryByDet(ctx, field, value) {
+    assertDetField(ctx, field, "queryByDet");
+    const [target, legacyTarget] = await detTargets(ctx, field, value);
+    const ids = await ctx.adapter.list(ctx.vault, ctx.name);
+    const matches = [];
+    for (const id of ids) {
+      const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
+      if (!env || !env._det || (env._tier ?? 0) > 0) continue;
+      if (env._det[field] === target || env._det[field] === legacyTarget) {
+        const rec = await ctx.codec.decryptRecord({ collection: ctx.name, id }, env);
+        if (rec !== null) matches.push(rec);
+      }
+    }
+    return matches;
   }
+  return { findByDet, queryByDet };
 }
-function issueChallenge(opts) {
-  const ttlMs = opts?.ttlMs ?? DEFAULT_CHALLENGE_TTL_MS;
-  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(32));
+
+// src/capsule/plumbing/index.ts
+function makeCapsule(p) {
+  const sealedSlot = makeSealedSlot(p);
+  const envelopeBody = makeEnvelopeBody(p);
+  const sealedSlots = makeSealedSlots(p, sealedSlot);
+  const codec = makeRecordCodec(p, sealedSlots);
   return {
-    challenge: bufferToBase64(bytes),
-    expiresAt: new Date(Date.now() + ttlMs).toISOString()
+    ...envelopeBody,
+    ...sealedSlot,
+    ...sealedSlots,
+    ...codec,
+    ...makeLifecycle(p),
+    ...makeRekey(p),
+    ...makeRekeyBlob(p),
+    ...makeSealing(p, sealedSlot),
+    ...makeDeterministic(p)
   };
 }
-async function verifyBrokerProof(args) {
-  const fresh = await args.consumeChallenge(args.challenge);
-  if (!fresh) return false;
-  if (args.instancePid === "") return false;
-  const canonical = buildCanonical(args.vaultId, args.brokerId, {
-    endpointOrigin: args.endpointOrigin,
-    profile: args.profile,
-    instancePid: args.instancePid,
-    challenge: args.challenge,
-    expiresAt: args.expiresAt
-  });
-  const key = await subtle2.importKey(
-    "raw",
-    args.registeredProofKey,
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["verify"]
-  );
-  const ok = await subtle2.verify(
-    "HMAC",
-    key,
-    base64ToBuffer(args.proof),
-    new TextEncoder().encode(canonical)
-  );
-  if (!ok) return false;
-  return Date.now() < Date.parse(args.expiresAt);
+
+// src/capsule/plumbing/ct-equal.ts
+function ctEqualTags(a, b) {
+  if (a.length !== 32 || b.length !== 32) {
+    throw new Error(
+      `ctEqualTags: tags must be exactly 32 bytes (got ${a.length}/${b.length}) \u2014 caller bug; reduce comparands with blindedEqual first`
+    );
+  }
+  let diff = 0;
+  for (let i = 0; i < 32; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
 }
 
 export {
   buildRecordAad,
   recordAadFor,
-  resolveStableCek,
-  rewrapBodyToDek,
-  applyRewrappedBody,
-  rewrapEnvelope,
-  isRewrappedUnder,
-  rekeyEnvelopeToDek,
-  rekeyEnvelopeIfNeeded,
-  envelopeOpensUnderAny,
-  rekeyBlobSet,
-  makeReservedEnvelopes,
-  validateSchemaInput,
-  validateSchemaOutput,
-  RecordCodec,
-  SEALED_CEK_NS,
-  sealRecordToHost,
-  revokeSealedRecord,
-  rotateRecordCek,
-  findByDet,
-  queryByDet,
-  openEnvelopeJson,
-  writeEnvelopeBody,
+  requireSealedBody,
+  sealedBodyArgs,
   envelopeBodySize,
   hasPerRecordKey,
   envelopeBodyForHash,
   hasSealedBody,
-  verifyRecordIdentity,
-  deriveBrokerProofBits,
-  deriveBrokerProofKey,
-  computeBrokerProof,
-  issueChallenge,
-  verifyBrokerProof
+  parseSealedSlot,
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
+  isTombstoneShape,
+  isTombstone,
+  buildTombstone,
+  isDeleteMarker,
+  buildDeleteMarker,
+  validateSchemaInput,
+  validateSchemaOutput,
+  makeCapsule,
+  ctEqualTags
 };
-//# sourceMappingURL=chunk-KJFW62P4.js.map
+//# sourceMappingURL=chunk-42ALPZ2B.js.map