@noy-db/hub 0.8.0-pre.0 → 0.8.0

package/dist/broker/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-party/broker/active.ts","../../src/with-party/broker/index.ts"],"sourcesContent":["/**\n * Enable the credential-broker capability (#479, spec §5).\n *\n * Pass to `createNoydb({ brokerStrategy: withBroker(config) })` to make\n * `vault.broker()` live. Each method dynamic-imports the seed lifecycle\n * engine (`./seed.js`) — mirroring `via/classified/active.ts`'s per-method\n * dynamic-import seam — so `with-party/broker/seed.ts` (the heavy module:\n * the CAS enrol, quiesce-then-swap rotate, and the challenge/response round\n * trip) is reachable only through the `@noy-db/hub/broker` subpath and\n * never enters the single-user floor bundle.\n *\n * The single-flight, per-vault-per-profile refresh cache (H-6/I6) lives\n * HERE, in this factory's closure — shared across every `credentialSource(profile)`\n * call for this one broker instance (in turn shared across every vault of a\n * `createNoydb()` instance — `vault.broker()` passes the SAME `BrokerStrategy`\n * for all of them), so `rotate()` can quiesce it (await any in-flight\n * round-trip, then drop it) before the seed swap. The cache key is\n * `${vault}\\0${profile}` — keyed by vault FIRST, or two vaults sharing this\n * one strategy would collide and hand vault-B a cached credential minted\n * (and STS-scoped) for vault-A.\n */\nimport type { BrokerStrategy, BrokerConfig, BrokerCtx } from '../../port/with/broker-strategy.js'\nimport type { StoreCredentials, StoreCredentialSource } from '../../kernel/types.js'\n\nconst DEFAULT_SKEW_MS = 60_000\n/** Floor under the skew-adjusted boundary so a sub-skew credential TTL\n *  doesn't collapse to \"already expired\" and thrash re-proving every call (I6b). */\nconst MIN_CACHE_MS = 1_000\n\ninterface CacheEntry {\n  cached?: { creds: StoreCredentials; validUntil: number } | undefined\n  inFlight?: Promise<StoreCredentials> | undefined\n}\n\nfunction cacheFloor(creds: StoreCredentials, skewMs: number): number {\n  const expiresAtMs = creds.expiresAt ? Date.parse(creds.expiresAt) : Date.now() + skewMs * 2\n  return Math.max(expiresAtMs - skewMs, Date.now() + MIN_CACHE_MS)\n}\n\nexport function withBroker(config: BrokerConfig): BrokerStrategy {\n  const cache = new Map<string, CacheEntry>()\n\n  return {\n    async enroll(ctx) {\n      const { enrollSeed } = await import('./seed.js')\n      return enrollSeed({ ...ctx, config })\n    },\n    async rotate(ctx) {\n      // Quiesce (I5): let any in-flight round-trip finish (it may still be\n      // proving under the pre-rotation seed) before the local record is\n      // overwritten, then drop the cache — scoped to THIS vault's entries\n      // only (`${ctx.vault}\\0`-prefixed keys). A global cache.clear() here\n      // would blow away every OTHER vault's cache on this shared strategy\n      // too — same root cause as the cross-vault read collision this fixes.\n      const vaultPrefix = `${ctx.vault}\\0`\n      const scoped = [...cache.entries()].filter(([key]) => key.startsWith(vaultPrefix))\n      const inFlight = scoped.map(([, e]) => e.inFlight).filter((p): p is Promise<StoreCredentials> => p !== undefined)\n      await Promise.allSettled(inFlight)\n      for (const [key] of scoped) cache.delete(key)\n      const { rotateSeed } = await import('./seed.js')\n      return rotateSeed({ ...ctx, config })\n    },\n    credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource {\n      const key = `${ctx.vault}\\0${profile ?? ''}`\n      return async () => {\n        let entry = cache.get(key)\n        if (!entry) {\n          entry = {}\n          cache.set(key, entry)\n        }\n        const now = Date.now()\n        if (entry.cached && now < entry.cached.validUntil) return entry.cached.creds\n        if (entry.inFlight) return entry.inFlight\n\n        const skewMs = config.skewMs ?? DEFAULT_SKEW_MS\n        const capturedEntry = entry\n        const inFlight = (async () => {\n          const { mintStoreCredentials } = await import('./seed.js')\n          const creds = await mintStoreCredentials({ ...ctx, config }, profile)\n          capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) }\n          return creds\n        })()\n        entry.inFlight = inFlight\n        try {\n          return await inFlight\n        } finally {\n          // Clear-on-settle (I6a): a rejected in-flight promise must never\n          // stay pinned in the cache, or every subsequent call would wedge\n          // on the same rejection instead of retrying.\n          capturedEntry.inFlight = undefined\n        }\n      }\n    },\n  }\n}\n","/**\n * `@noy-db/hub/broker` — subpath export for the credential-broker capability\n * (#479, credential-broker spec). Apps that never call `vault.broker()` can\n * exclude this subpath entirely: the floor default `NO_BROKER` throws, and\n * this module's real engine (`with-party/broker/{seed,active}.ts`) is only\n * ever reached through `withBroker()`'s dynamic imports, so it never enters\n * a floor bundle.\n *\n * Also re-exports the host-side helpers (`issueChallenge`, `verifyBrokerProof`)\n * from the enclave barrel, so a Lambda/Worker implementing the reference\n * broker host can import just this one subpath and get everything it\n * needs, `crypto.subtle`-only.\n */\n\n// ─── Capability opt-in seam ──────────────────────────────────\nexport { withBroker } from './active.js'\nexport {\n  NO_BROKER,\n  type BrokerStrategy,\n  type BrokerCtx,\n  type BrokerConfig,\n  type CredentialBrokerHandle,\n} from '../../port/with/broker-strategy.js'\nexport { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js'\n\n// ─── Host helpers (verify side — for a reference broker host) ───\nimport { issueChallenge as issueChallengeRaw, verifyBrokerProof } from '../../kernel/enclave/index.js'\nimport type { IssuedChallenge, VerifyBrokerProofArgs } from '../../kernel/enclave/index.js'\n\n/**\n * Floor — a challenge TTL must survive network latency + clock drift\n * between host and client. The enclave's `issueChallenge` is deliberately\n * unclamped (a mechanical primitive, not a policy); this floor is host\n * POLICY, so it lives here in the party layer, not\n * `kernel/enclave/broker/proof.ts` (carried forward from Task 2's review,\n * I6b).\n */\nconst MIN_CHALLENGE_TTL_MS = 10_000\n/** Ceiling — spec §2 step 2: \"TTL ≤ 60 s\". */\nconst MAX_CHALLENGE_TTL_MS = 60_000\n\n/**\n * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a\n * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel\n * gets a safe challenge TTL without having to know the bounds itself.\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const requested = opts?.ttlMs ?? MAX_CHALLENGE_TTL_MS\n  const clamped = Math.min(Math.max(requested, MIN_CHALLENGE_TTL_MS), MAX_CHALLENGE_TTL_MS)\n  return issueChallengeRaw({ ttlMs: clamped })\n}\nexport { verifyBrokerProof }\nexport type { VerifyBrokerProofArgs }\n\n// #837 — issueChallenge's return type must be nameable from this entry.\nexport type { IssuedChallenge } from '../../kernel/enclave/index.js'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,kBAAkB;AAGxB,IAAM,eAAe;AAOrB,SAAS,WAAW,OAAyB,QAAwB;AACnE,QAAM,cAAc,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,IAAI,IAAI,SAAS;AAC1F,SAAO,KAAK,IAAI,cAAc,QAAQ,KAAK,IAAI,IAAI,YAAY;AACjE;AAEO,SAAS,WAAW,QAAsC;AAC/D,QAAM,QAAQ,oBAAI,IAAwB;AAE1C,SAAO;AAAA,IACL,MAAM,OAAO,KAAK;AAChB,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,OAAO,KAAK;AAOhB,YAAM,cAAc,GAAG,IAAI,KAAK;AAChC,YAAM,SAAS,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,WAAW,CAAC;AACjF,YAAM,WAAW,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAsC,MAAM,MAAS;AAChH,YAAM,QAAQ,WAAW,QAAQ;AACjC,iBAAW,CAAC,GAAG,KAAK,OAAQ,OAAM,OAAO,GAAG;AAC5C,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,iBAAiB,KAAgB,SAAyC;AACxE,YAAM,MAAM,GAAG,IAAI,KAAK,KAAK,WAAW,EAAE;AAC1C,aAAO,YAAY;AACjB,YAAI,QAAQ,MAAM,IAAI,GAAG;AACzB,YAAI,CAAC,OAAO;AACV,kBAAQ,CAAC;AACT,gBAAM,IAAI,KAAK,KAAK;AAAA,QACtB;AACA,cAAM,MAAM,KAAK,IAAI;AACrB,YAAI,MAAM,UAAU,MAAM,MAAM,OAAO,WAAY,QAAO,MAAM,OAAO;AACvE,YAAI,MAAM,SAAU,QAAO,MAAM;AAEjC,cAAM,SAAS,OAAO,UAAU;AAChC,cAAM,gBAAgB;AACtB,cAAM,YAAY,YAAY;AAC5B,gBAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,qBAAW;AACzD,gBAAM,QAAQ,MAAM,qBAAqB,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO;AACpE,wBAAc,SAAS,EAAE,OAAO,YAAY,WAAW,OAAO,MAAM,EAAE;AACtE,iBAAO;AAAA,QACT,GAAG;AACH,cAAM,WAAW;AACjB,YAAI;AACF,iBAAO,MAAM;AAAA,QACf,UAAE;AAIA,wBAAc,WAAW;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACzDA,IAAM,uBAAuB;AAE7B,IAAM,uBAAuB;AAOtB,SAASA,gBAAe,MAA4C;AACzE,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,UAAU,KAAK,IAAI,KAAK,IAAI,WAAW,oBAAoB,GAAG,oBAAoB;AACxF,SAAO,eAAkB,EAAE,OAAO,QAAQ,CAAC;AAC7C;","names":["issueChallenge"]}
+{"version":3,"sources":["../../src/with-party/broker/active.ts","../../src/with-party/broker/index.ts"],"sourcesContent":["/**\n * Enable the credential-broker capability (#479, spec §5).\n *\n * Pass to `createNoydb({ brokerStrategy: withBroker(config) })` to make\n * `vault.broker()` live. Each method dynamic-imports the seed lifecycle\n * engine (`./seed.js`) — mirroring `via/classified/active.ts`'s per-method\n * dynamic-import seam — so `with-party/broker/seed.ts` (the heavy module:\n * the CAS enrol, quiesce-then-swap rotate, and the challenge/response round\n * trip) is reachable only through the `@noy-db/hub/broker` subpath and\n * never enters the single-user floor bundle.\n *\n * The single-flight, per-vault-per-profile refresh cache (H-6/I6) lives\n * HERE, in this factory's closure — shared across every `credentialSource(profile)`\n * call for this one broker instance (in turn shared across every vault of a\n * `createNoydb()` instance — `vault.broker()` passes the SAME `BrokerStrategy`\n * for all of them), so `rotate()` can quiesce it (await any in-flight\n * round-trip, then drop it) before the seed swap. The cache key is\n * `${vault}\\0${profile}` — keyed by vault FIRST, or two vaults sharing this\n * one strategy would collide and hand vault-B a cached credential minted\n * (and STS-scoped) for vault-A.\n */\nimport type { BrokerStrategy, BrokerConfig, BrokerCtx } from '../../port/with/broker-strategy.js'\nimport type { StoreCredentials, StoreCredentialSource } from '../../kernel/types.js'\n\nconst DEFAULT_SKEW_MS = 60_000\n/** Floor under the skew-adjusted boundary so a sub-skew credential TTL\n *  doesn't collapse to \"already expired\" and thrash re-proving every call (I6b). */\nconst MIN_CACHE_MS = 1_000\n\ninterface CacheEntry {\n  cached?: { creds: StoreCredentials; validUntil: number } | undefined\n  inFlight?: Promise<StoreCredentials> | undefined\n}\n\nfunction cacheFloor(creds: StoreCredentials, skewMs: number): number {\n  const expiresAtMs = creds.expiresAt ? Date.parse(creds.expiresAt) : Date.now() + skewMs * 2\n  return Math.max(expiresAtMs - skewMs, Date.now() + MIN_CACHE_MS)\n}\n\nexport function withBroker(config: BrokerConfig): BrokerStrategy {\n  const cache = new Map<string, CacheEntry>()\n\n  return {\n    async enroll(ctx) {\n      const { enrollSeed } = await import('./seed.js')\n      return enrollSeed({ ...ctx, config })\n    },\n    async rotate(ctx) {\n      // Quiesce (I5): let any in-flight round-trip finish (it may still be\n      // proving under the pre-rotation seed) before the local record is\n      // overwritten, then drop the cache — scoped to THIS vault's entries\n      // only (`${ctx.vault}\\0`-prefixed keys). A global cache.clear() here\n      // would blow away every OTHER vault's cache on this shared strategy\n      // too — same root cause as the cross-vault read collision this fixes.\n      const vaultPrefix = `${ctx.vault}\\0`\n      const scoped = [...cache.entries()].filter(([key]) => key.startsWith(vaultPrefix))\n      const inFlight = scoped.map(([, e]) => e.inFlight).filter((p): p is Promise<StoreCredentials> => p !== undefined)\n      await Promise.allSettled(inFlight)\n      for (const [key] of scoped) cache.delete(key)\n      const { rotateSeed } = await import('./seed.js')\n      return rotateSeed({ ...ctx, config })\n    },\n    credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource {\n      const key = `${ctx.vault}\\0${profile ?? ''}`\n      return async () => {\n        let entry = cache.get(key)\n        if (!entry) {\n          entry = {}\n          cache.set(key, entry)\n        }\n        const now = Date.now()\n        if (entry.cached && now < entry.cached.validUntil) return entry.cached.creds\n        if (entry.inFlight) return entry.inFlight\n\n        const skewMs = config.skewMs ?? DEFAULT_SKEW_MS\n        const capturedEntry = entry\n        const inFlight = (async () => {\n          const { mintStoreCredentials } = await import('./seed.js')\n          const creds = await mintStoreCredentials({ ...ctx, config }, profile)\n          capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) }\n          return creds\n        })()\n        entry.inFlight = inFlight\n        try {\n          return await inFlight\n        } finally {\n          // Clear-on-settle (I6a): a rejected in-flight promise must never\n          // stay pinned in the cache, or every subsequent call would wedge\n          // on the same rejection instead of retrying.\n          capturedEntry.inFlight = undefined\n        }\n      }\n    },\n  }\n}\n","/**\n * `@noy-db/hub/broker` — subpath export for the credential-broker capability\n * (#479, credential-broker spec). Apps that never call `vault.broker()` can\n * exclude this subpath entirely: the floor default `NO_BROKER` throws, and\n * this module's real engine (`with-party/broker/{seed,active}.ts`) is only\n * ever reached through `withBroker()`'s dynamic imports, so it never enters\n * a floor bundle.\n *\n * Also re-exports the host-side helpers (`issueChallenge`, `verifyBrokerProof`)\n * from the enclave barrel, so a Lambda/Worker implementing the reference\n * broker host can import just this one subpath and get everything it\n * needs, `crypto.subtle`-only.\n */\n\n// ─── Capability opt-in seam ──────────────────────────────────\nexport { withBroker } from './active.js'\nexport {\n  NO_BROKER,\n  type BrokerStrategy,\n  type BrokerCtx,\n  type BrokerConfig,\n  type CredentialBrokerHandle,\n} from '../../port/with/broker-strategy.js'\nexport { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js'\n\n// ─── Host helpers (verify side — for a reference broker host) ───\nimport { issueChallenge as issueChallengeRaw, verifyBrokerProof } from '../../capsule/index.js'\nimport type { IssuedChallenge, VerifyBrokerProofArgs } from '../../capsule/index.js'\n\n/**\n * Floor — a challenge TTL must survive network latency + clock drift\n * between host and client. The enclave's `issueChallenge` is deliberately\n * unclamped (a mechanical primitive, not a policy); this floor is host\n * POLICY, so it lives here in the party layer, not\n * `capsule/enclave-aes/broker/proof.ts` (carried forward from Task 2's review,\n * I6b).\n */\nconst MIN_CHALLENGE_TTL_MS = 10_000\n/** Ceiling — spec §2 step 2: \"TTL ≤ 60 s\". */\nconst MAX_CHALLENGE_TTL_MS = 60_000\n\n/**\n * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a\n * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel\n * gets a safe challenge TTL without having to know the bounds itself.\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const requested = opts?.ttlMs ?? MAX_CHALLENGE_TTL_MS\n  const clamped = Math.min(Math.max(requested, MIN_CHALLENGE_TTL_MS), MAX_CHALLENGE_TTL_MS)\n  return issueChallengeRaw({ ttlMs: clamped })\n}\nexport { verifyBrokerProof }\nexport type { VerifyBrokerProofArgs }\n\n// #837 — issueChallenge's return type must be nameable from this entry.\nexport type { IssuedChallenge } from '../../capsule/index.js'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,kBAAkB;AAGxB,IAAM,eAAe;AAOrB,SAAS,WAAW,OAAyB,QAAwB;AACnE,QAAM,cAAc,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,IAAI,IAAI,SAAS;AAC1F,SAAO,KAAK,IAAI,cAAc,QAAQ,KAAK,IAAI,IAAI,YAAY;AACjE;AAEO,SAAS,WAAW,QAAsC;AAC/D,QAAM,QAAQ,oBAAI,IAAwB;AAE1C,SAAO;AAAA,IACL,MAAM,OAAO,KAAK;AAChB,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,OAAO,KAAK;AAOhB,YAAM,cAAc,GAAG,IAAI,KAAK;AAChC,YAAM,SAAS,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,WAAW,CAAC;AACjF,YAAM,WAAW,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAsC,MAAM,MAAS;AAChH,YAAM,QAAQ,WAAW,QAAQ;AACjC,iBAAW,CAAC,GAAG,KAAK,OAAQ,OAAM,OAAO,GAAG;AAC5C,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,iBAAiB,KAAgB,SAAyC;AACxE,YAAM,MAAM,GAAG,IAAI,KAAK,KAAK,WAAW,EAAE;AAC1C,aAAO,YAAY;AACjB,YAAI,QAAQ,MAAM,IAAI,GAAG;AACzB,YAAI,CAAC,OAAO;AACV,kBAAQ,CAAC;AACT,gBAAM,IAAI,KAAK,KAAK;AAAA,QACtB;AACA,cAAM,MAAM,KAAK,IAAI;AACrB,YAAI,MAAM,UAAU,MAAM,MAAM,OAAO,WAAY,QAAO,MAAM,OAAO;AACvE,YAAI,MAAM,SAAU,QAAO,MAAM;AAEjC,cAAM,SAAS,OAAO,UAAU;AAChC,cAAM,gBAAgB;AACtB,cAAM,YAAY,YAAY;AAC5B,gBAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,qBAAW;AACzD,gBAAM,QAAQ,MAAM,qBAAqB,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO;AACpE,wBAAc,SAAS,EAAE,OAAO,YAAY,WAAW,OAAO,MAAM,EAAE;AACtE,iBAAO;AAAA,QACT,GAAG;AACH,cAAM,WAAW;AACjB,YAAI;AACF,iBAAO,MAAM;AAAA,QACf,UAAE;AAIA,wBAAc,WAAW;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACzDA,IAAM,uBAAuB;AAE7B,IAAM,uBAAuB;AAOtB,SAASA,gBAAe,MAA4C;AACzE,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,UAAU,KAAK,IAAI,KAAK,IAAI,WAAW,oBAAoB,GAAG,oBAAoB;AACxF,SAAO,eAAkB,EAAE,OAAO,QAAQ,CAAC;AAC7C;","names":["issueChallenge"]}

package/dist/by/index.js

@@ -1,8 +1,8 @@
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-3JWHAR6E.js";
-import "../chunk-244VXYPG.js";
+} from "../chunk-DIZLQVAA.js";
+import "../chunk-37EPTBBR.js";
 export {
   isQuorum,
   runDrainBarrier

package/dist/capsule/contract.d.ts

@@ -0,0 +1,159 @@
+/**
+ * The capsule seam (capsule seam spec, Section 2).
+ *
+ * A capsule is hub's crypto interior behind one contract. `enclave-aes` is the
+ * default and ships INSIDE hub, so `npm install @noy-db/hub` alone is a working
+ * noy-db. An alternative binds at BUILD TIME through hub's `imports` map —
+ * deliberately not at runtime: a `createNoydb({ capsule })` option would be a
+ * hot-swap surface, and a build condition lives in build config where the
+ * shipped bundle stays auditable (`npm ls` tells an auditor whether a build is
+ * plaintext-at-rest).
+ *
+ * ⛔ `CapsuleKey` is OPAQUE outside `capsule/`. Never construct, inspect or
+ * serialise one; only pass it between contract functions. A fork may define it
+ * as something that is not a `CryptoKey` at all — hardware-backed,
+ * post-quantum, or null for a capsule that does no encryption.
+ */
+import { NoydbError } from '../kernel/errors.js';
+import type { VdigFieldPolicy } from '../kernel/types.js';
+/** Opaque key at the capsule seam. `CryptoKey` in the reference capsule. */
+export type CapsuleKey = CryptoKey;
+/** Opaque asymmetric pair at the capsule seam. */
+export type CapsuleKeyPair = CryptoKeyPair;
+/**
+ * The groups a capsule may support. A capsule declares its set via
+ * `capabilities()`; a service needing a group asserts at `createNoydb()`.
+ *
+ * `authenticate` and `seal` are what an `enclave-*` MUST support and an
+ * `exclave-*` MUST refuse. That prefix rule is asserted by the conformance
+ * suite from the package name, which is what makes the prefix a trust posture
+ * rather than a naming convention.
+ */
+export type CapsuleGroup = 'authenticate' | 'seal' | 'cipher' | 'digest' | 'sign' | 'codec' | 'sealing' | 'deterministic' | 'classify';
+/**
+ * Thrown at `createNoydb()` when a service needs a group the bound capsule
+ * does not support.
+ *
+ * ⚠️ Never thrown on first write, and never discovered by try/catch probing: a
+ * consumer learns at startup or not at all. A capability discovered mid-write
+ * is a half-built vault.
+ */
+/**
+ * Refuse at CONSTRUCTION when a service needs a capsule group the bound
+ * capsule lacks.
+ *
+ * ⛔ At startup or not at all. A capability discovered on first write is a
+ * half-built vault: some records sealed, a service silently inert, and a
+ * consumer who cannot tell a missing capability from a bug. `capabilities()`
+ * is a set, so this is a membership test — never a try/catch probe against the
+ * primitive itself, which would make "unsupported" and "broken" the same
+ * observation.
+ *
+ * Lives on the CONTRACT, not in the kernel: it depends on nothing but the
+ * declared set, and every capsule's consumers need the same assertion.
+ *
+ * ⚠️ Per-service wiring is deliberately NOT done yet. `enclave-aes` supports
+ * every group, so every call site would be unreachable code behind an
+ * untestable branch. It lands in Stage C with `exclave-plain`, which is the
+ * first capsule that refuses anything. Until then this is exercised against a
+ * stub set — see `__tests__/capsule-capabilities.test.ts`.
+ */
+export declare function assertCapsuleSupports(caps: ReadonlySet<CapsuleGroup>, group: CapsuleGroup, requirer: string): void;
+export declare class CapsuleNotSupportedError extends NoydbError {
+    readonly group: CapsuleGroup;
+    readonly requirer: string;
+    constructor(group: CapsuleGroup, requirer: string);
+}
+/**
+ * The 13 cipher primitives the shared plumbing needs — the ENTIRE surface a
+ * capsule must actually implement.
+ *
+ * ⭐ This is the measurement that shaped Stage C. `enclave-aes` is ~4,200
+ * lines, but only ~1,200 of them touch `crypto.subtle`; the other ~3,000 are
+ * envelope assembly, record-identity AAD, tombstones and the record codec —
+ * plumbing that is IDENTICAL for every capsule because it encodes hub's
+ * envelope format, not anyone's cipher. `makeCapsule()` binds that plumbing to
+ * these primitives, so a second capsule writes ~400 lines instead of ~3,400
+ * and the format lives in exactly one place.
+ *
+ * The alternative — copying the plumbing into each capsule — was rejected for
+ * a specific reason: nothing would fail when the two copies drifted. A change
+ * to the tombstone shape or the AAD would have to be made twice, and the
+ * second miss surfaces as an envelope that one capsule writes and the other
+ * cannot read.
+ *
+ * ⚠️ Declared with PROPERTY syntax (`encrypt: (…) => …`), never method
+ * shorthand. Two reasons, both measured. TypeScript checks method shorthand
+ * BIVARIANTLY, so a capsule whose `encrypt` took the wrong number of arguments
+ * would satisfy a shorthand declaration and fail only at a call site — the
+ * exact hole #16 fell through. And `@typescript-eslint/unbound-method` refuses
+ * to let a shorthand method be destructured off the object, which is precisely
+ * how the plumbing consumes these.
+ *
+ * ⚠️ Every primitive here is `async` except `bufferToBase64`, including ones a
+ * plaintext capsule answers instantly. That is deliberate: a capsule that
+ * needs real asynchrony (hardware-backed keys, a remote KMS) must be
+ * expressible without changing this type, and a synchronous implementation
+ * loses nothing by returning a resolved promise.
+ */
+export interface CapsulePrimitives<K = CapsuleKey> {
+    encrypt: (plaintext: string, key: K, aad?: Uint8Array) => Promise<{
+        iv: string;
+        data: string;
+    }>;
+    decrypt: (iv: string, data: string, key: K, aad?: Uint8Array) => Promise<string>;
+    encryptBytesWithAAD: (bytes: Uint8Array, key: K, aad: Uint8Array) => Promise<{
+        iv: string;
+        data: string;
+    }>;
+    decryptBytesWithAAD: (iv: string, data: string, key: K, aad: Uint8Array) => Promise<Uint8Array>;
+    /** Same plaintext + key + context ⇒ same ciphertext. Refused by a capsule without the group. */
+    encryptDeterministic: (plaintext: string, key: K, context: string) => Promise<{
+        iv: string;
+        data: string;
+    }>;
+    /** ⚠️ ONE argument. The AES capsule derives the CONTEXT into the IV, not the key
+     *  (`encryptDeterministic` calls `deriveDeterministicIV(dek, context, plaintext)`),
+     *  so a `(dek, context)` signature here would have been a plausible-looking lie
+     *  that only the call sites caught. */
+    deriveDeterministicKey: (dek: K) => Promise<K>;
+    deriveSealedFieldKey: (dek: K, collectionName: string, field: string) => Promise<K>;
+    deriveSealedFieldKeyFromCek: (cek: K, collectionName: string, field: string) => Promise<K>;
+    generateDEK: () => Promise<K>;
+    wrapCek: (cek: K, dek: K) => Promise<string>;
+    unwrapCek: (wrapped: string, dek: K) => Promise<K>;
+    /** Accepts `ArrayBuffer` too — the AES capsule's callers pass raw `subtle` output. */
+    bufferToBase64: (buffer: ArrayBuffer | Uint8Array) => string;
+    mintVdigSlot: (value: string, policy: VdigFieldPolicy, prevBlob: string | undefined, cek: K, collection: string, id: string, field: string) => Promise<string>;
+    mintBidxTag: (normalized: string, dek: K, collection: string, field: string) => Promise<string>;
+    /** The vdig payload is sealed under a capsule-derived slot key, so open/seal
+     *  are the capsule's, not the plumbing's. `rotateRecordCek` needs both to
+     *  carry a classified slot across a key rotation. */
+    openVdigPayload: (blob: string, cek: K, collection: string, id: string, field: string) => Promise<VdigPayload>;
+    sealVdigPayload: (payload: VdigPayload, cek: K, collection: string, id: string, field: string) => Promise<string>;
+}
+/** The classified verify-digest payload, at the seam because both the capsule
+ *  and the plumbing name it. Structural, not the capsule's own type. */
+export interface VdigDigestEntry {
+    readonly salt: string;
+    readonly hash: string;
+}
+export interface VdigPayload {
+    readonly v: 1;
+    readonly alg: 'PBKDF2-SHA256';
+    readonly iter: number;
+    readonly cur: VdigDigestEntry & {
+        readonly at: string;
+    };
+    readonly ring?: readonly VdigDigestEntry[];
+}
+export { makeCapsule } from './plumbing/index.js';
+export type { Capsule, RecordCodec } from './plumbing/index.js';
+export { sha256Hex, sha256Bytes, hmacSha256Hex, hmacSignHex, hkdfAesGcmKey, deriveBlobAddressKey, derivePresenceKey, derivePresenceTagKey, generateIV, generateSalt, generateRecoverySecret, bufferToBase64, base64ToBuffer, encodeEchoParts, KEY_BITS, } from './plumbing/digest.js';
+export type { EchoSecretParts } from './plumbing/digest.js';
+export { buildRecordAad, recordAadFor, buildRecordEnvelope, buildTombstone, isTombstone, isTombstoneShape, buildDeleteMarker, isDeleteMarker, requireSealedBody, sealedBodyArgs, envelopeBodySize, hasPerRecordKey, envelopeBodyForHash, hasSealedBody, normalizeForVerify, parseSealedSlot, } from './plumbing/index.js';
+export type { RecordIdentity, RecordRef } from './plumbing/index.js';
+export { buildSealedRecordEnvelope } from './plumbing/record-envelope.js';
+export { generateSigningKeyPair, signBytes, verifyBytes } from './plumbing/sign.js';
+export { ctEqualTags } from './plumbing/ct-equal.js';
+export { evaluateKofN } from './plumbing/kofn.js';

package/dist/capsule/contract.js

@@ -0,0 +1,95 @@
+import {
+  CapsuleNotSupportedError,
+  assertCapsuleSupports
+} from "../chunk-OIEO4WDL.js";
+import {
+  generateSigningKeyPair,
+  signBytes,
+  verifyBytes
+} from "../chunk-Q2XRFWOI.js";
+import {
+  evaluateKofN
+} from "../chunk-NH2UOV3B.js";
+import {
+  buildDeleteMarker,
+  buildRecordAad,
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
+  buildTombstone,
+  ctEqualTags,
+  envelopeBodyForHash,
+  envelopeBodySize,
+  hasPerRecordKey,
+  hasSealedBody,
+  isDeleteMarker,
+  isTombstone,
+  isTombstoneShape,
+  makeCapsule,
+  parseSealedSlot,
+  recordAadFor,
+  requireSealedBody,
+  sealedBodyArgs
+} from "../chunk-42ALPZ2B.js";
+import {
+  KEY_BITS,
+  base64ToBuffer,
+  bufferToBase64,
+  deriveBlobAddressKey,
+  derivePresenceKey,
+  derivePresenceTagKey,
+  encodeEchoParts,
+  generateIV,
+  generateRecoverySecret,
+  generateSalt,
+  hkdfAesGcmKey,
+  hmacSha256Hex,
+  hmacSignHex,
+  normalizeForVerify,
+  sha256Bytes,
+  sha256Hex
+} from "../chunk-QMWY2FDS.js";
+import "../chunk-SV2PM2OY.js";
+import "../chunk-37EPTBBR.js";
+export {
+  CapsuleNotSupportedError,
+  KEY_BITS,
+  assertCapsuleSupports,
+  base64ToBuffer,
+  bufferToBase64,
+  buildDeleteMarker,
+  buildRecordAad,
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
+  buildTombstone,
+  ctEqualTags,
+  deriveBlobAddressKey,
+  derivePresenceKey,
+  derivePresenceTagKey,
+  encodeEchoParts,
+  envelopeBodyForHash,
+  envelopeBodySize,
+  evaluateKofN,
+  generateIV,
+  generateRecoverySecret,
+  generateSalt,
+  generateSigningKeyPair,
+  hasPerRecordKey,
+  hasSealedBody,
+  hkdfAesGcmKey,
+  hmacSha256Hex,
+  hmacSignHex,
+  isDeleteMarker,
+  isTombstone,
+  isTombstoneShape,
+  makeCapsule,
+  normalizeForVerify,
+  parseSealedSlot,
+  recordAadFor,
+  requireSealedBody,
+  sealedBodyArgs,
+  sha256Bytes,
+  sha256Hex,
+  signBytes,
+  verifyBytes
+};
+//# sourceMappingURL=contract.js.map

package/dist/capsule/enclave-aes/bound.d.ts

@@ -0,0 +1,52 @@
+export declare const aesCapsule: {
+    findByDet: <T>(ctx: import("./index.js").DeterministicContext<T>, field: string, value: unknown) => Promise<T | null>;
+    queryByDet: <T>(ctx: import("./index.js").DeterministicContext<T>, field: string, value: unknown) => Promise<T[]>;
+    SEALED_CEK_NS: string;
+    sealRecordToHost: (ctx: import("./index.js").SealingContext, collection: string, id: string, hostSealer: import("../../index.js").RecipientSealer, opts: {
+        expiresAt: string;
+    }) => Promise<{
+        pid: string;
+        envelopeKey: string;
+    }>;
+    revokeSealedRecord: (ctx: import("./index.js").SealingContext, collection: string, id: string, pid: string, opts?: {
+        hard?: boolean;
+    }) => Promise<void>;
+    rotateRecordCek: (ctx: import("./index.js").SealingContext, collection: string, id: string) => Promise<void>;
+    rekeyBlobSet: (adapter: import("../../index.js").NoydbStore, vault: string, oldDek: import("../contract.js").CapsuleKey, newDek: import("../contract.js").CapsuleKey, otherDeks?: readonly import("../contract.js").CapsuleKey[]) => Promise<import("../plumbing/rekey-blob.js").BlobRekeyReport>;
+    rekeyEnvelopeToDek: (ref: {
+        readonly collection: string;
+        readonly id: string;
+    }, envelope: import("../../index.js").EncryptedEnvelope, oldDek: import("../contract.js").CapsuleKey, newDek: import("../contract.js").CapsuleKey) => Promise<import("../../index.js").EncryptedEnvelope>;
+    rekeyEnvelopeIfNeeded: (ref: {
+        readonly collection: string;
+        readonly id: string;
+    }, envelope: import("../../index.js").EncryptedEnvelope, oldDek: import("../contract.js").CapsuleKey, newDek: import("../contract.js").CapsuleKey) => Promise<import("../../index.js").EncryptedEnvelope | null>;
+    envelopeOpensUnderAny: (ref: {
+        readonly collection: string;
+        readonly id: string;
+    }, envelope: import("../../index.js").EncryptedEnvelope, keys: readonly import("../contract.js").CapsuleKey[]) => Promise<boolean>;
+    resolveStableCek: (deps: import("../plumbing/lifecycle.js").StableCekDeps, id: string) => Promise<import("../contract.js").CapsuleKey>;
+    rewrapBodyToDek: (from: import("./index.js").RecordIdentity, to: import("./index.js").RecordIdentity, envelope: Pick<import("../../index.js").EncryptedEnvelope, "_iv" | "_data" | "_cek" | "_tier" | "_by">, fromDek: import("../contract.js").CapsuleKey, toDek: import("../contract.js").CapsuleKey) => Promise<import("./index.js").RewrappedBody>;
+    applyRewrappedBody: (envelope: import("../../index.js").EncryptedEnvelope, body: import("./index.js").RewrappedBody) => import("../../index.js").EncryptedEnvelope;
+    rewrapEnvelope: (identity: import("./index.js").RecordIdentity, envelope: import("../../index.js").EncryptedEnvelope, fromDek: import("../contract.js").CapsuleKey, toDek: import("../contract.js").CapsuleKey) => Promise<import("../../index.js").EncryptedEnvelope>;
+    isRewrappedUnder: (identity: import("./index.js").RecordIdentity, envelope: Pick<import("../../index.js").EncryptedEnvelope, "_iv" | "_data" | "_cek">, dek: import("../contract.js").CapsuleKey) => Promise<boolean>;
+    RecordCodec: import("../plumbing/record-codec.js").BoundRecordCodec;
+    sealFields: (record: Record<string, unknown>, sensitiveFields: ReadonlySet<string>, keyMaterial: import("../plumbing/sealed-slots.js").SealKeyMaterial) => Promise<import("../plumbing/sealed-slots.js").SealFieldsResult>;
+    unsealOneField: (field: string, blob: string, keyMaterial: import("../plumbing/sealed-slots.js").SealKeyMaterial) => Promise<unknown>;
+    makeHandleProducer: (keyMaterial: import("../plumbing/sealed-slots.js").SealKeyMaterial) => (field: string, blob: string) => import("../../index.js").SealedHandle<unknown>;
+    unsealFields: (record: Record<string, unknown>, sealed: Record<string, string>, keyMaterial: import("../plumbing/sealed-slots.js").SealKeyMaterial, opts?: {
+        asHandles?: boolean;
+    }) => Promise<Record<string, unknown>>;
+    makeSealedSlotCapability: (ctx: import("../plumbing/sealed-slots.js").SealedSlotCapabilityCtx, recordId: string, cek?: import("../contract.js").CapsuleKey) => import("../../kernel/via/index.js").ViaCryptoCtx["sealedSlots"];
+    makeReservedEnvelopes: (dekResolver: import("../plumbing/sealed-slots.js").ReservedEnvelopeDekResolver, declaredPrefixes: readonly string[]) => import("../../kernel/via/index.js").ViaCryptoCtx["reservedEnvelopes"];
+    dualReadSealedSlot: (blob: string, field: string, collection: string, cek: CryptoKey | undefined, dek: CryptoKey) => Promise<string>;
+    openEnvelopeJson: (ref: import("./index.js").RecordRef, env: import("../../index.js").EncryptedEnvelope, key: import("../contract.js").CapsuleKey, opts?: {
+        encrypted?: boolean;
+    }) => Promise<string>;
+    writeEnvelopeBody: (identity: import("./index.js").RecordIdentity, json: string, key: import("../contract.js").CapsuleKey, opts?: {
+        encrypted?: boolean;
+        perRecordKey?: boolean;
+    }) => Promise<Pick<import("../../index.js").EncryptedEnvelope, "_iv" | "_data" | "_cek">>;
+    verifyRecordIdentity: (ref: import("./index.js").RecordRef, env: import("../../index.js").EncryptedEnvelope, key: import("../contract.js").CapsuleKey) => Promise<boolean>;
+};
+export declare const dualReadSealedSlot: (blob: string, field: string, collection: string, cek: CryptoKey | undefined, dek: CryptoKey) => Promise<string>;

package/dist/capsule/enclave-aes/capabilities.d.ts

@@ -0,0 +1,2 @@
+import type { CapsuleGroup } from '../contract.js';
+export declare function capabilities(): ReadonlySet<CapsuleGroup>;

package/dist/capsule/enclave-aes/classify/compare.d.ts

@@ -0,0 +1,20 @@
+/**
+ * C2 — fixed-length-tag constant-time comparison (hub-portable; no
+ * Node timingSafeEqual). Two mandatory rules (spec §3):
+ *  1. Only fixed 32-byte tags are ever compared — ctEqualTags throws on
+ *     anything else (tag length is structural, never secret-dependent).
+ *  2. Every comparand is reduced to a 32-byte tag under a FRESH ephemeral
+ *     HMAC-SHA256 key before comparison — keyed blinding makes compare
+ *     timing uncorrelated with underlying values; rule 1 (not blinding)
+ *     is what removes input-length timing. Length inequality folds into
+ *     unequal tags — never an early return.
+ * @module
+ */
+/**
+ * Blinded equality of arbitrary-length byte strings: fresh K_e per
+ * comparison (never stored, never reused), HMAC both sides to 32-byte
+ * tags, then ctEqualTags. On the digest path the inputs are already
+ * 32-byte PBKDF2 outputs but still route through this reduction so
+ * there is exactly ONE comparison construction (spec §3 rule 2).
+ */
+export declare function blindedEqual(a: Uint8Array, b: Uint8Array): Promise<boolean>;

package/dist/{kernel/enclave → capsule/enclave-aes}/classify/find.d.ts

@@ -25,7 +25,7 @@
  * @module
  */
 import type { EnclaveKey } from '../crypto.js';
-import { type VerifyNormalizeMode } from './normalize.js';
+import { type VerifyNormalizeMode } from '../../plumbing/normalize.js';
 /**
  * Normalize `candidate` and mint it into a blind-index target tag at
  * `costByte` (default {@link CURRENT_COST_BYTE}), for string-comparison

package/dist/{kernel/enclave → capsule/enclave-aes}/classify/reveal.d.ts

@@ -1,4 +1,4 @@
-import type { EncryptedEnvelope } from '../../types.js';
+import type { EncryptedEnvelope } from '../../../kernel/types.js';
 import type { EnclaveKey } from '../crypto.js';
 export interface RevealEngineCtx {
     readonly collection: string;

package/dist/{kernel/enclave → capsule/enclave-aes}/classify/verify.d.ts

@@ -15,8 +15,8 @@
  * @module
  */
 import { type EnclaveKey } from '../crypto.js';
-import { type VerifyNormalizeMode } from './normalize.js';
-import type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../types.js';
+import { type VerifyNormalizeMode } from '../../plumbing/normalize.js';
+import type { EncryptedEnvelope, VdigFieldPolicy, ClassifiedVerdict } from '../../../kernel/types.js';
 export interface VerifyEngineCtx {
     readonly collection: string;
     getEnvelope(id: string): Promise<EncryptedEnvelope | null>;

package/dist/{kernel/enclave → capsule/enclave-aes}/classify/write.d.ts

@@ -4,5 +4,5 @@
  * @module
  */
 import { type EnclaveKey } from '../crypto.js';
-import type { VdigFieldPolicy } from '../../types.js';
+import type { VdigFieldPolicy } from '../../../kernel/types.js';
 export declare function mintVdigSlot(rawValue: string, policy: VdigFieldPolicy, prevBlob: string | undefined, cek: EnclaveKey, collection: string, recordId: string, field: string): Promise<string>;