@noy-db/hub 0.8.0-pre.0 → 0.8.0

package/dist/chunk-5KC7QYEC.js

@@ -0,0 +1,565 @@
+import {
+  VDIG_ITERATIONS,
+  mintBidxTag,
+  pbkdf2VerifyDigest
+} from "./chunk-EZOAKKTB.js";
+import {
+  ctEqualTags,
+  makeCapsule
+} from "./chunk-42ALPZ2B.js";
+import {
+  IV_BYTES,
+  KEY_BITS,
+  base64ToBuffer,
+  bufferToBase64,
+  encodeEchoParts,
+  generateIV,
+  generateSalt,
+  normalizeForVerify
+} from "./chunk-QMWY2FDS.js";
+import {
+  ClassifiedRotationError,
+  DecryptionError,
+  InvalidKeyError,
+  TamperedError,
+  ValidationError
+} from "./chunk-37EPTBBR.js";
+
+// src/capsule/enclave-aes/classify/compare.ts
+var subtle = globalThis.crypto.subtle;
+async function blindedEqual(a, b) {
+  const ke = await subtle.generateKey({ name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const tagA = new Uint8Array(await subtle.sign("HMAC", ke, a));
+  const tagB = new Uint8Array(await subtle.sign("HMAC", ke, b));
+  return ctEqualTags(tagA, tagB);
+}
+
+// src/capsule/enclave-aes/crypto.ts
+var PBKDF2_ITERATIONS = 6e5;
+var subtle2 = globalThis.crypto.subtle;
+async function deriveKey(secret, salt) {
+  return deriveKekFromMaterial(new TextEncoder().encode(secret), salt);
+}
+async function deriveKekFromMaterial(material, salt) {
+  const keyMaterial = await subtle2.importKey("raw", material, "PBKDF2", false, ["deriveKey"]);
+  return subtle2.deriveKey(
+    { name: "PBKDF2", salt, iterations: PBKDF2_ITERATIONS, hash: "SHA-256" },
+    keyMaterial,
+    { name: "AES-KW", length: KEY_BITS },
+    false,
+    ["wrapKey", "unwrapKey"]
+  );
+}
+async function deriveEchoKey(parts, salt) {
+  return deriveKekFromMaterial(encodeEchoParts(parts), salt);
+}
+async function deriveSecretKey(secret, salt, params) {
+  const keyMaterial = await subtle2.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    "PBKDF2",
+    false,
+    ["deriveKey"]
+  );
+  return params.keyUsage === "aes-gcm" ? subtle2.deriveKey(
+    {
+      name: "PBKDF2",
+      salt,
+      iterations: params.iterations,
+      hash: "SHA-256"
+    },
+    keyMaterial,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  ) : subtle2.deriveKey(
+    {
+      name: "PBKDF2",
+      salt,
+      iterations: params.iterations,
+      hash: "SHA-256"
+    },
+    keyMaterial,
+    { name: "AES-KW", length: KEY_BITS },
+    false,
+    ["wrapKey", "unwrapKey"]
+  );
+}
+async function generateDEK() {
+  return subtle2.generateKey(
+    { name: "AES-GCM", length: KEY_BITS },
+    true,
+    // extractable — needed for AES-KW wrapping
+    ["encrypt", "decrypt"]
+  );
+}
+async function generateEphemeralKey() {
+  return subtle2.generateKey({ name: "AES-GCM", length: KEY_BITS }, false, ["encrypt", "decrypt"]);
+}
+async function exportDekSet(deks) {
+  const out = {};
+  for (const [coll, dek] of deks) {
+    out[coll] = bufferToBase64(await subtle2.exportKey("raw", dek));
+  }
+  return out;
+}
+async function importDekSet(exported) {
+  const deks = /* @__PURE__ */ new Map();
+  for (const [coll, b64] of Object.entries(exported)) {
+    const key = await subtle2.importKey(
+      "raw",
+      base64ToBuffer(b64),
+      { name: "AES-GCM", length: KEY_BITS },
+      true,
+      ["encrypt", "decrypt"]
+    );
+    deks.set(coll, key);
+  }
+  return deks;
+}
+async function wrapKey(dek, kek) {
+  const wrapped = await subtle2.wrapKey("raw", dek, kek, "AES-KW");
+  return bufferToBase64(wrapped);
+}
+async function unwrapKey(wrappedBase64, kek) {
+  try {
+    return await subtle2.unwrapKey(
+      "raw",
+      base64ToBuffer(wrappedBase64),
+      kek,
+      "AES-KW",
+      { name: "AES-GCM", length: KEY_BITS },
+      true,
+      ["encrypt", "decrypt"]
+    );
+  } catch {
+    throw new InvalidKeyError();
+  }
+}
+async function mintCanary(kek, plaintext) {
+  const constant = await subtle2.importKey(
+    "raw",
+    plaintext,
+    { name: "AES-GCM", length: KEY_BITS },
+    true,
+    ["encrypt", "decrypt"]
+  );
+  return wrapKey(constant, kek);
+}
+async function checkCanary(wrapped, kek) {
+  try {
+    await unwrapKey(wrapped, kek);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function asKwKey(dek) {
+  const rawDek = await subtle2.exportKey("raw", dek);
+  const hkdfKey = await subtle2.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-cek-wrap");
+  const info = new TextEncoder().encode("v1");
+  const bits = await subtle2.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle2.importKey("raw", bits, "AES-KW", false, ["wrapKey", "unwrapKey"]);
+}
+async function wrapCek(cek, dek) {
+  const kw = await asKwKey(dek);
+  const wrapped = await subtle2.wrapKey("raw", cek, kw, "AES-KW");
+  return bufferToBase64(wrapped);
+}
+async function unwrapCek(wrappedBase64, dek) {
+  const kw = await asKwKey(dek);
+  try {
+    return await subtle2.unwrapKey(
+      "raw",
+      base64ToBuffer(wrappedBase64),
+      kw,
+      "AES-KW",
+      { name: "AES-GCM", length: KEY_BITS },
+      true,
+      ["encrypt", "decrypt"]
+    );
+  } catch {
+    throw new InvalidKeyError();
+  }
+}
+async function importCek(rawKey) {
+  return subtle2.importKey("raw", rawKey, { name: "AES-GCM", length: KEY_BITS }, false, ["decrypt"]);
+}
+async function importTransferKey(raw) {
+  if (raw.byteLength !== 32) {
+    throw new ValidationError(`transfer key must be 32 bytes, got ${raw.byteLength}.`);
+  }
+  return subtle2.importKey("raw", raw, { name: "AES-GCM", length: KEY_BITS }, false, ["encrypt", "decrypt"]);
+}
+async function encrypt(plaintext, dek, aad) {
+  const iv = generateIV();
+  const encoded = new TextEncoder().encode(plaintext);
+  const ciphertext = await subtle2.encrypt(
+    {
+      name: "AES-GCM",
+      iv,
+      ...aad !== void 0 && { additionalData: aad }
+    },
+    dek,
+    encoded
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decrypt(ivBase64, dataBase64, dek, aad) {
+  const iv = base64ToBuffer(ivBase64);
+  const ciphertext = base64ToBuffer(dataBase64);
+  try {
+    const plaintext = await subtle2.decrypt(
+      {
+        name: "AES-GCM",
+        iv,
+        ...aad !== void 0 && { additionalData: aad }
+      },
+      dek,
+      ciphertext
+    );
+    return new TextDecoder().decode(plaintext);
+  } catch (err) {
+    if (err instanceof Error && err.name === "OperationError") {
+      throw new TamperedError(...await classifyTagFailure(iv, ciphertext, dek, aad));
+    }
+    throw new DecryptionError(
+      err instanceof Error ? err.message : "Decryption failed"
+    );
+  }
+}
+async function classifyTagFailure(iv, ciphertext, dek, aad) {
+  if (aad === void 0) return [];
+  try {
+    await subtle2.decrypt({ name: "AES-GCM", iv }, dek, ciphertext);
+  } catch {
+    return [];
+  }
+  return [
+    "This record was sealed BEFORE record-identity binding (#1041) and cannot be read by this version. Its body decrypts correctly under the record key, so this is a data-format transition, not tampering \u2014 but it also means the record predates authenticated metadata. There is no migration path; see noy-db #1100.",
+    "unbound-legacy-format"
+  ];
+}
+async function encryptBytes(data, dek) {
+  const iv = generateIV();
+  const ciphertext = await subtle2.encrypt(
+    { name: "AES-GCM", iv },
+    dek,
+    data
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decryptBytes(ivBase64, dataBase64, dek) {
+  const iv = base64ToBuffer(ivBase64);
+  const ciphertext = base64ToBuffer(dataBase64);
+  try {
+    const plaintext = await subtle2.decrypt(
+      { name: "AES-GCM", iv },
+      dek,
+      ciphertext
+    );
+    return new Uint8Array(plaintext);
+  } catch (err) {
+    if (err instanceof Error && err.name === "OperationError") {
+      throw new TamperedError();
+    }
+    throw new DecryptionError(
+      err instanceof Error ? err.message : "Decryption failed"
+    );
+  }
+}
+async function encryptBytesWithAAD(data, dek, aad) {
+  const iv = generateIV();
+  const ciphertext = await subtle2.encrypt(
+    {
+      name: "AES-GCM",
+      iv,
+      additionalData: aad
+    },
+    dek,
+    data
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decryptBytesWithAAD(ivBase64, dataBase64, dek, aad) {
+  const iv = base64ToBuffer(ivBase64);
+  const ciphertext = base64ToBuffer(dataBase64);
+  try {
+    const plaintext = await subtle2.decrypt(
+      {
+        name: "AES-GCM",
+        iv,
+        additionalData: aad
+      },
+      dek,
+      ciphertext
+    );
+    return new Uint8Array(plaintext);
+  } catch (err) {
+    if (err instanceof Error && err.name === "OperationError") {
+      throw new TamperedError();
+    }
+    throw new DecryptionError(
+      err instanceof Error ? err.message : "Decryption failed"
+    );
+  }
+}
+async function deriveSealedFieldKey(dek, collectionName, field) {
+  const rawDek = await subtle2.exportKey("raw", dek);
+  const hkdfKey = await subtle2.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-sealed");
+  const info = new TextEncoder().encode(JSON.stringify(["noydb-sealed", collectionName, field]));
+  const bits = await subtle2.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle2.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function deriveSealedFieldKeyFromCek(cek, collectionName, field) {
+  const rawCek = await subtle2.exportKey("raw", cek);
+  const hkdfKey = await subtle2.importKey("raw", rawCek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-sealed-cek");
+  const info = new TextEncoder().encode(JSON.stringify(["noydb-sealed-cek", collectionName, field]));
+  const bits = await subtle2.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle2.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function deriveDeterministicKey(dek) {
+  const rawDek = await subtle2.exportKey("raw", dek);
+  const hkdfKey = await subtle2.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-det");
+  const info = new TextEncoder().encode(JSON.stringify(["noydb-det"]));
+  const bits = await subtle2.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    KEY_BITS
+  );
+  return subtle2.importKey(
+    "raw",
+    bits,
+    { name: "AES-GCM", length: KEY_BITS },
+    true,
+    ["encrypt", "decrypt"]
+  );
+}
+async function deriveDeterministicIV(dek, context, plaintext) {
+  const rawDek = await subtle2.exportKey("raw", dek);
+  const hkdfKey = await subtle2.importKey("raw", rawDek, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode("noydb-deterministic-v1");
+  const info = new TextEncoder().encode(`${context}\0${plaintext}`);
+  const bits = await subtle2.deriveBits(
+    { name: "HKDF", hash: "SHA-256", salt, info },
+    hkdfKey,
+    IV_BYTES * 8
+  );
+  return new Uint8Array(bits);
+}
+async function encryptDeterministic(plaintext, dek, context) {
+  const iv = await deriveDeterministicIV(dek, context, plaintext);
+  const encoded = new TextEncoder().encode(plaintext);
+  const ciphertext = await subtle2.encrypt(
+    { name: "AES-GCM", iv },
+    dek,
+    encoded
+  );
+  return {
+    iv: bufferToBase64(iv),
+    data: bufferToBase64(ciphertext)
+  };
+}
+async function decryptDeterministic(ivBase64, dataBase64, dek) {
+  return decrypt(ivBase64, dataBase64, dek);
+}
+async function generateRecipientKeyPair() {
+  return subtle2.generateKey(
+    { name: "RSA-OAEP", modulusLength: 2048, publicExponent: new Uint8Array([1, 0, 1]), hash: "SHA-256" },
+    true,
+    ["encrypt", "decrypt"]
+  );
+}
+async function exportRecipientPublicKeySpki(pair) {
+  return new Uint8Array(await subtle2.exportKey("spki", pair.publicKey));
+}
+async function importRecipientPublicKeySpki(spki) {
+  return subtle2.importKey("spki", spki, { name: "RSA-OAEP", hash: "SHA-256" }, false, ["encrypt"]);
+}
+async function recipientWrap(pub, bytes) {
+  return new Uint8Array(await subtle2.encrypt({ name: "RSA-OAEP" }, pub, bytes));
+}
+async function recipientUnwrap(pair, wrapped) {
+  return new Uint8Array(await subtle2.decrypt({ name: "RSA-OAEP" }, pair.privateKey, wrapped));
+}
+
+// src/capsule/enclave-aes/classify/vdig.ts
+var subtle3 = globalThis.crypto.subtle;
+var VDIG_SALT_DOMAIN = "noydb-classify-vdig";
+function buildVdigAad(collection, recordId, field) {
+  return new TextEncoder().encode(JSON.stringify([VDIG_SALT_DOMAIN, collection, recordId, field]));
+}
+async function deriveVdigSlotKey(cek, collection, field) {
+  const raw = await subtle3.exportKey("raw", cek);
+  const hkdf = await subtle3.importKey("raw", raw, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(VDIG_SALT_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([VDIG_SALT_DOMAIN, collection, field]));
+  const bits = await subtle3.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdf, 256);
+  return subtle3.importKey("raw", bits, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+async function sealVdigPayload(payload, cek, collection, recordId, field) {
+  const key = await deriveVdigSlotKey(cek, collection, field);
+  const { iv, data } = await encryptBytesWithAAD(
+    new TextEncoder().encode(JSON.stringify(payload)),
+    key,
+    buildVdigAad(collection, recordId, field)
+  );
+  return `${iv}:${data}`;
+}
+async function openVdigPayload(blob, cek, collection, recordId, field) {
+  const sep = blob.indexOf(":");
+  if (sep === -1) throw new TamperedError();
+  const ivPart = blob.slice(0, sep);
+  const dataPart = blob.slice(sep + 1);
+  try {
+    base64ToBuffer(ivPart);
+    base64ToBuffer(dataPart);
+  } catch {
+    throw new TamperedError();
+  }
+  const key = await deriveVdigSlotKey(cek, collection, field);
+  const bytes = await decryptBytesWithAAD(
+    ivPart,
+    dataPart,
+    key,
+    buildVdigAad(collection, recordId, field)
+  );
+  return JSON.parse(new TextDecoder().decode(bytes));
+}
+
+// src/capsule/enclave-aes/classify/write.ts
+async function mintVdigSlot(rawValue, policy, prevBlob, cek, collection, recordId, field) {
+  const normalized = normalizeForVerify(policy.normalize, rawValue);
+  let prev = null;
+  if (prevBlob !== void 0) {
+    try {
+      prev = await openVdigPayload(prevBlob, cek, collection, recordId, field);
+    } catch {
+      throw new TamperedError();
+    }
+    if (!Number.isInteger(prev.iter) || prev.iter < 1) {
+      throw new TamperedError();
+    }
+  }
+  if (prev !== null && policy.notLastN > 0) {
+    const history = [prev.cur, ...prev.ring ?? []];
+    for (const entry of history) {
+      const digest = await pbkdf2VerifyDigest(normalized, base64ToBuffer(entry.salt), prev.iter);
+      if (await blindedEqual(digest, base64ToBuffer(entry.hash))) {
+        throw new ClassifiedRotationError(collection, field, "password was used recently");
+      }
+    }
+  }
+  const salt = generateSalt();
+  const hash = await pbkdf2VerifyDigest(normalized, salt, VDIG_ITERATIONS);
+  const ring = prev !== null && policy.notLastN > 0 ? [...prev.ring ?? [], { salt: prev.cur.salt, hash: prev.cur.hash }].slice(-policy.notLastN) : void 0;
+  const payload = {
+    v: 1,
+    alg: "PBKDF2-SHA256",
+    iter: VDIG_ITERATIONS,
+    cur: { salt: bufferToBase64(salt), hash: bufferToBase64(hash), at: (/* @__PURE__ */ new Date()).toISOString() },
+    ...ring !== void 0 && ring.length > 0 ? { ring } : {}
+  };
+  return sealVdigPayload(payload, cek, collection, recordId, field);
+}
+
+// src/capsule/enclave-aes/primitives.ts
+var aesPrimitives = {
+  encrypt,
+  decrypt,
+  encryptBytesWithAAD,
+  decryptBytesWithAAD,
+  encryptDeterministic,
+  deriveDeterministicKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  generateDEK,
+  wrapCek,
+  unwrapCek,
+  bufferToBase64,
+  mintVdigSlot,
+  mintBidxTag,
+  openVdigPayload,
+  sealVdigPayload
+};
+
+// src/capsule/enclave-aes/bound.ts
+var aesCapsule = makeCapsule(aesPrimitives);
+var { dualReadSealedSlot } = aesCapsule;
+
+export {
+  blindedEqual,
+  deriveKey,
+  deriveEchoKey,
+  deriveSecretKey,
+  generateDEK,
+  generateEphemeralKey,
+  exportDekSet,
+  importDekSet,
+  wrapKey,
+  unwrapKey,
+  mintCanary,
+  checkCanary,
+  wrapCek,
+  unwrapCek,
+  importCek,
+  importTransferKey,
+  encrypt,
+  decrypt,
+  encryptBytes,
+  decryptBytes,
+  encryptBytesWithAAD,
+  decryptBytesWithAAD,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  deriveDeterministicKey,
+  encryptDeterministic,
+  decryptDeterministic,
+  generateRecipientKeyPair,
+  exportRecipientPublicKeySpki,
+  importRecipientPublicKeySpki,
+  recipientWrap,
+  recipientUnwrap,
+  deriveVdigSlotKey,
+  openVdigPayload,
+  aesCapsule,
+  dualReadSealedSlot
+};
+//# sourceMappingURL=chunk-5KC7QYEC.js.map