@noy-db/hub 0.8.0-pre.0 → 0.8.0

package/dist/{kernel/enclave → capsule/enclave-aes}/crypto.d.ts

@@ -35,42 +35,28 @@
  *
  * @module
  */
+import { type EchoSecretParts } from '../plumbing/digest.js';
 /**
  * **EnclaveKey** — the opaque key type at the enclave seam.
  *
  * In noy-db's reference enclave this is `CryptoKey` (the Web Crypto API's
  * key handle). A fork's enclave redefines this alias to its own key
  * representation (e.g. `type EnclaveKey = null` for a keyless HSM-backed
- * fork) — outside `kernel/enclave/**`, every consumer must treat it as
+ * fork) — outside `capsule/enclave-aes/**`, every consumer must treat it as
  * opaque: never construct, inspect, or serialize it directly, only pass it
  * between barrel functions (`encrypt`/`decrypt`/`wrapKey`/`unwrapKey`/…).
  */
 export type EnclaveKey = CryptoKey;
+/** Opaque asymmetric pair at the enclave seam — `CryptoKeyPair` in the reference enclave. */
+export type EnclaveKeyPair = CryptoKeyPair;
 /** Derive a KEK from a secret and salt using PBKDF2-SHA256. */
 export declare function deriveKey(secret: string, salt: Uint8Array): Promise<CryptoKey>;
 /** One three-part echo secret: prompt (typed) → echo (revealed) → key (typed). */
-export interface EchoSecretParts {
-    readonly prompt: string;
-    readonly echo: string;
-    readonly key: string;
-}
 /**
- * AG-1 encoding: domain context + 4-byte big-endian length prefix per
- * part. Two independent guarantees make a single typed string unable to
- * derive an echo vault's KEK (spec AG-1):
- *
- *   1. The `0xFF` context prefix — UTF-8 never produces that byte, so the
- *      encoding is provably not the encoding of ANY string (not merely of
- *      no separator-joined form).
- *   2. Structural length prefixes — part boundaries are key material, so
- *      re-splitting the same characters changes the derived KEK.
- *
- * @throws ValidationError when any part is not a string — the single
- * chokepoint every echo KEK derivation and block mint passes through, so a
- * malformed parts object cannot be `TextEncoder`-coerced into key material.
+ * Domain context for the AG-1 encoding. The leading `0xFF` is the load-bearing
+ * byte: it is not a legal UTF-8 lead byte, so `TextEncoder` can never emit it —
+ * no string's UTF-8 encoding can equal an AG-1 encoding, whatever the string.
  */
-export declare function encodeEchoParts(parts: EchoSecretParts): Uint8Array;
-/** Derive the tier-1 KEK from a 3-part echo secret (spec: KEK from ALL parts). */
 export declare function deriveEchoKey(parts: EchoSecretParts, salt: Uint8Array): Promise<CryptoKey>;
 /**
  * Which AES algorithm/usage a {@link deriveSecretKey} result is for:
@@ -93,6 +79,13 @@ export declare function deriveSecretKey(secret: string, salt: Uint8Array, params
 }): Promise<CryptoKey>;
 /** Generate a random AES-256-GCM data encryption key. */
 export declare function generateDEK(): Promise<CryptoKey>;
+/**
+ * Generate a NON-extractable AES-256-GCM key for in-memory-only use — a
+ * session key, a device seal. Unlike {@link generateDEK} it can never be
+ * wrapped or exported: WebCrypto enforces that, and it is the tab-scope
+ * invariant `with-party/session` and `device-seal` rely on.
+ */
+export declare function generateEphemeralKey(): Promise<CryptoKey>;
 /** Serialize a DEK set to `{ collection: base64(rawKey) }`. */
 export declare function exportDekSet(deks: Map<string, CryptoKey>): Promise<Record<string, string>>;
 /**
@@ -104,6 +97,10 @@ export declare function importDekSet(exported: Record<string, string>): Promise<
 export declare function wrapKey(dek: CryptoKey, kek: CryptoKey): Promise<string>;
 /** Unwrap (decrypt) a DEK from base64 string using a KEK. */
 export declare function unwrapKey(wrappedBase64: string, kek: CryptoKey): Promise<CryptoKey>;
+/** Wrap the constant AES-GCM key built from `plaintext` under `kek`. */
+export declare function mintCanary(kek: CryptoKey, plaintext: Uint8Array): Promise<string>;
+/** True iff `wrapped` unwraps under `kek` — the KEK is right AND the bytes are intact. */
+export declare function checkCanary(wrapped: string, kek: CryptoKey): Promise<boolean>;
 /**
  * AES-KW-wrap a per-record CEK under a collection/tier DEK. Returns base64.
  * Deterministic over `(cek, dek)`.
@@ -120,6 +117,13 @@ export declare function unwrapCek(wrappedBase64: string, dek: CryptoKey): Promis
  * used solely to open the record's `_iv`/`_data` body under `decrypt()`.
  */
 export declare function importCek(rawKey: Uint8Array): Promise<CryptoKey>;
+/**
+ * Import a raw 32-byte pre-shared key as a NON-extractable AES-256-GCM key
+ * (encrypt + decrypt). The transfer seal (`with-cargo`) and the RSA-OAEP
+ * TLV's per-blob CEK (`managed-secret`) both hand raw bytes to the enclave
+ * here; the bytes never become a key anywhere else.
+ */
+export declare function importTransferKey(raw: Uint8Array): Promise<CryptoKey>;
 export interface EncryptResult {
     iv: string;
     data: string;
@@ -160,66 +164,6 @@ export declare function encryptBytes(data: Uint8Array, dek: CryptoKey): Promise<
  * Counterpart to `encryptBytes`. Throws `TamperedError` on auth-tag failure.
  */
 export declare function decryptBytes(ivBase64: string, dataBase64: string, dek: CryptoKey): Promise<Uint8Array>;
-/**
- * SHA-256 hex digest of raw bytes. Used to derive content-addressed
- * eTags for blob deduplication. Computed on plaintext bytes
- * before compression and encryption so the eTag identifies content, not
- * ciphertext, and survives re-encryption (key rotation, re-upload).
- */
-export declare function sha256Hex(data: Uint8Array): Promise<string>;
-/**
- * Compute HMAC-SHA-256(key, data) and return hex string.
- *
- * Used to derive content-addressed eTags that are opaque to the store:
- * ```
- * eTag = hmacSha256Hex(blobDEK, plaintext)
- * ```
- *
- * Unlike a plain SHA-256, the HMAC is keyed by the vault-shared `_blob` DEK,
- * so an attacker with store access cannot pre-compute eTags for known files.
- * Deduplication still works within a vault (same key + same content = same eTag).
- */
-/**
- * Derive the blob CONTENT-ADDRESSING key for one tier (#1126).
- *
- * The blob eTag is an HMAC over the plaintext. It used to be keyed by the
- * `_blob` DEK — the very key `rotateKeys` replaces — so after any rotation
- * `HMAC(live DEK, plaintext) !== storedETag` for every blob written before it,
- * permanently. `decryptResponse()` checks that unconditionally, so the
- * presigned-URL read path raised `TamperedError` on legitimate data forever;
- * dedup also split, minting a second address for identical bytes.
- *
- * The fix is a `root` that rotation never touches (`_blob_addr`, refused by
- * `rotateKeys` exactly as `_roster` is). Rotation then re-keys chunk BODIES
- * while every address stays stable, which is what makes the AAD
- * `{eTag}:{i}:{count}` and every `_blob_index` / `_blob_slots_*` /
- * `_blob_versions_*` row survive it untouched.
- *
- * **Derived PER TIER, deliberately.** A single vault-wide address would make an
- * elevated blob and a tier-0 blob with identical content share an eTag,
- * leaking equality across a boundary the tier system exists to enforce — and
- * `rehomeForTier` re-addresses on a tier move precisely because the address is
- * tier-scoped today. Domain separation keeps that property while removing the
- * rotation coupling: the two are independent axes, and only one of them was
- * ever meant to change the address.
- *
- * Same HKDF idiom as `asKwKey`, with its own salt so the addressing key can
- * never coincide with a wrapping or encryption key.
- */
-export declare function deriveBlobAddressKey(root: CryptoKey, tier: number): Promise<CryptoKey>;
-export declare function hmacSha256Hex(key: CryptoKey, data: Uint8Array): Promise<string>;
-/**
- * Encrypt raw bytes with AES-256-GCM using Additional Authenticated Data.
- *
- * The AAD binds each chunk to its parent blob and position, preventing
- * chunk reorder, substitution, and truncation attacks:
- * ```
- * AAD = UTF-8("{eTag}:{chunkIndex}:{chunkCount}")
- * ```
- *
- * The AAD is NOT stored — the reader reconstructs it from `BlobObject`
- * metadata and passes it to `decryptBytesWithAAD`.
- */
 export declare function encryptBytesWithAAD(data: Uint8Array, dek: CryptoKey, aad: Uint8Array): Promise<EncryptResult>;
 /**
  * Decrypt AES-256-GCM ciphertext with AAD verification.
@@ -229,41 +173,6 @@ export declare function encryptBytesWithAAD(data: Uint8Array, dek: CryptoKey, aa
  * tag fails and this throws `TamperedError`.
  */
 export declare function decryptBytesWithAAD(ivBase64: string, dataBase64: string, dek: CryptoKey, aad: Uint8Array): Promise<Uint8Array>;
-/**
- * Derive an AES-256-GCM presence key from a collection DEK using HKDF-SHA256.
- *
- * The presence key is domain-separated from the data DEK by the fixed salt
- * `'noydb-presence'` and the `info` = collection name. This means:
- *  - The adapter never sees the presence key.
- *  - Presence payloads rotate automatically when the collection DEK is rotated.
- *  - Revoked users cannot derive the new presence key after a DEK rotation.
- *
- * @param dek            The collection's AES-256-GCM DEK (extractable).
- * @param collectionName Used as the HKDF `info` parameter for domain separation.
- * @returns A non-extractable AES-256-GCM key suitable for presence payload encryption.
- */
-export declare function derivePresenceKey(dek: CryptoKey, collectionName: string): Promise<CryptoKey>;
-/**
- * Derive a **per-field** AES-256-GCM key from a collection DEK using
- * HKDF-SHA256, used to encrypt a single sensitive field into its own
- * `_sealed[field]` envelope slot (structural group-encryption).
- *
- * Domain-separated from the data DEK (and from the presence/deterministic
- * channels) by the fixed salt `'noydb-sealed'` and an `info` of
- * `JSON.stringify(['noydb-sealed', collectionName, field])`. The JSON-array
- * encoding is injective — each element is separately quoted/escaped — so
- * collection `a/sealed/b` + field `c` cannot collide with collection `a` +
- * field `b/sealed/c`. Each sensitive field gets a **distinct** key, so a
- * `_sealed[a]` ciphertext does not authenticate under field `b`'s key —
- * sealed fields are cryptographically isolated from one another. The
- * collection name keeps the same field name in two collections from sharing a
- * key, mirroring how `derivePresenceKey` / `encryptDeterministic` domain-separate.
- *
- * @param dek            The collection's AES-256-GCM DEK (extractable).
- * @param collectionName Part of the HKDF `info` for domain separation.
- * @param field          Sensitive field name — the rest of the `info`.
- * @returns A non-extractable AES-256-GCM key for that field's sealed slot.
- */
 export declare function deriveSealedFieldKey(dek: CryptoKey, collectionName: string, field: string): Promise<CryptoKey>;
 /**
  * Derive a per-record sealed-field key from the record's **per-record CEK**
@@ -334,18 +243,13 @@ export declare function encryptDeterministic(plaintext: string, dek: CryptoKey,
  * ciphertext throws `TamperedError` just like randomized AES-GCM.
  */
 export declare function decryptDeterministic(ivBase64: string, dataBase64: string, dek: CryptoKey): Promise<string>;
-/** Generate a random 12-byte IV for AES-GCM. */
-export declare function generateIV(): Uint8Array;
-/** Generate a random 32-byte salt for PBKDF2. */
-export declare function generateSalt(): Uint8Array;
+export declare function generateRecipientKeyPair(): Promise<CryptoKeyPair>;
+export declare function exportRecipientPublicKeySpki(pair: CryptoKeyPair): Promise<Uint8Array>;
+export declare function importRecipientPublicKeySpki(spki: Uint8Array): Promise<CryptoKey>;
+/** RSA-OAEP-encrypt `bytes` (a 32-byte CEK) to the recipient's public key. */
+export declare function recipientWrap(pub: CryptoKey, bytes: Uint8Array): Promise<Uint8Array>;
 /**
- * Mint a fresh recovery secret — the high-entropy value a recovery profile
- * wraps the DEK set under and then hands out (Shamir splits it into shares;
- * paper prints it). Not a salt: a salt is public, this is not, and a fork
- * may size them differently. The reference enclave returns 32 bytes.
- *
- * Callers must zero the buffer once it has been wrapped and split.
+ * RSA-OAEP-decrypt with the pair's private key. Propagates WebCrypto's own
+ * error on failure — callers that need a typed error map it themselves.
  */
-export declare function generateRecoverySecret(): Uint8Array;
-export declare function bufferToBase64(buffer: ArrayBuffer | Uint8Array): string;
-export declare function base64ToBuffer(base64: string): Uint8Array<ArrayBuffer>;
+export declare function recipientUnwrap(pair: CryptoKeyPair, wrapped: Uint8Array): Promise<Uint8Array>;

package/dist/capsule/enclave-aes/index.d.ts

@@ -0,0 +1,113 @@
+/**
+ * **capsule/enclave-aes** — the hub's crypto interior, behind one door.
+ *
+ * This barrel is **the fork-swap contract**: a sister project that wants a
+ * different crypto engine (a different KDF, a hardware-backed keystore, a
+ * post-quantum wrap algorithm, …) replaces the entire `capsule/enclave-aes/`
+ * folder wholesale and only has to honor the exports below. Nothing outside
+ * `capsule/enclave-aes/**` may deep-import `crypto.js` or `record-keys/*` directly
+ * — `scripts/check-architecture.mjs`'s `enclave-barrel-only` check enforces
+ * that mechanically. Import sites inside `capsule/enclave-aes/**` keep their
+ * existing relative imports; this door is for everyone else.
+ *
+ * The export list is the OBSERVED contract — exactly the symbols consumed
+ * from outside this folder today — grouped by the module that defines them:
+ *
+ *   - key type       — `crypto.ts`: `EnclaveKey`, the opaque key type every
+ *                       barrel-facing signature traffics in (`= CryptoKey` in
+ *                       noy-db's reference enclave; a fork redefines it to its
+ *                       own key representation — see the type's own doc for
+ *                       the fork contract).
+ *   - crypto ops     — `crypto.ts`: AES-256-GCM encrypt/decrypt (+ bytes, AAD,
+ *                       deterministic variants), SHA-256 / HMAC-SHA-256 hashing.
+ *   - key lifecycle  — `crypto.ts` + `record-keys/lifecycle.ts`: KEK/DEK
+ *                       derivation, AES-KW wrap/unwrap, per-record CEK
+ *                       wrap/unwrap/import + resolution/re-wrap, HKDF-derived
+ *                       presence/sealed-field keys, base64 helpers.
+ *   - record codec   — `record-keys/record-codec.ts`: the per-record
+ *                       encode/decode engine.
+ *   - sealing        — `record-keys/sealing.ts`: the sealed-record grantor
+ *                       primitives (seal/revoke/rotate to an `at-*` host).
+ *   - deterministic  — `record-keys/deterministic.ts`: blind-equality lookup
+ *                       over deterministically-encrypted fields.
+ *   - tombstone      — `record-keys/tombstone.ts`: the erased-record residue.
+ *   - envelope body  — `record-keys/envelope-body.ts`: the C1 protected-body
+ *                       access contract (`openEnvelopeJson`,
+ *                       `writeEnvelopeBody`, `hasPerRecordKey`,
+ *                       `hasSealedBody`, `envelopeBodyForHash`) — the
+ *                       sanctioned door onto
+ *                       `_iv`/`_data`/`_cek`/`_sealed` for everyone outside
+ *                       this folder.
+ *   - reserved envelopes — `plumbing/sealed-slots.ts`: `makeReservedEnvelopes`,
+ *                       the whole-envelope encrypt/decrypt door scoped to a
+ *                       declared collection-name prefix (e.g. `_dict_`) —
+ *                       `kernel/vault.ts` binds it for `DictionaryHandle`
+ *                       (#629 Task 4).
+ *
+ * Additive changes only — removing or renaming an export here is breaking
+ * for any fork. Frozen by `__tests__/enclave-surface-golden.test.ts`.
+ *
+ * **Refusal contract:** the barrel above is frozen — every symbol must
+ * exist in any fork — but the optional groups (sealing, deterministic,
+ * per-record-key lifecycle) MAY throw `EnclaveNotSupportedError` instead
+ * of implementing the reference behavior. The core groups (crypto ops,
+ * record codec, tombstone) MUST NOT throw it — they are load-bearing for
+ * every consumer regardless of which enclave is wired in. noy-db's own
+ * enclave supports every group, so it never throws this error.
+ */
+export type { EnclaveKey, EncryptResult } from './crypto.js';
+export { encrypt, decrypt, encryptBytes, decryptBytes, encryptBytesWithAAD, decryptBytesWithAAD, encryptDeterministic, decryptDeterministic, } from './crypto.js';
+export { deriveKey, deriveSecretKey, generateDEK, generateEphemeralKey, importTransferKey, exportDekSet, importDekSet, wrapKey, unwrapKey, mintCanary, checkCanary, deriveDeterministicKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, wrapCek, unwrapCek, importCek, deriveEchoKey, } from './crypto.js';
+export type { SecretKeyUsage } from './crypto.js';
+export { buildRecordAad, recordAadFor, buildRecordEnvelope, isTombstone, isTombstoneShape, buildTombstone, isDeleteMarker, buildDeleteMarker, requireSealedBody, sealedBodyArgs, envelopeBodySize, hasPerRecordKey, envelopeBodyForHash, hasSealedBody, } from '../plumbing/index.js';
+export { sha256Hex, sha256Bytes, hmacSha256Hex, hmacSignHex, hkdfAesGcmKey, deriveBlobAddressKey, derivePresenceKey, derivePresenceTagKey, generateIV, generateSalt, generateRecoverySecret, bufferToBase64, base64ToBuffer, encodeEchoParts, } from '../plumbing/digest.js';
+export type { EchoSecretParts } from '../plumbing/digest.js';
+export type { RecordIdentity, RecordRef } from '../plumbing/index.js';
+import type { RecordCodecBase } from '../plumbing/record-codec.js';
+/**
+ * `RecordCodec` is a VALUE (the capsule-bound subclass, destructured below) and
+ * a TYPE (the module-level generic base). A type ALIAS can coexist with a value
+ * of the same name; a `export type { RecordCodec }` RE-EXPORT cannot, which is
+ * what `TS2323: Cannot redeclare exported variable` was saying.
+ */
+export type RecordCodec<T = Record<string, unknown>> = RecordCodecBase<T>;
+export { buildSealedRecordEnvelope } from '../plumbing/record-envelope.js';
+export type { RecordEnvelopeBody } from '../plumbing/record-envelope.js';
+export type { RewrappedBody } from '../plumbing/lifecycle.js';
+export type { SealedShredSlot } from '../plumbing/record-codec.js';
+export type { SealingContext } from '../plumbing/sealing.js';
+export type { DeterministicContext } from '../plumbing/deterministic.js';
+export declare const openEnvelopeJson: (ref: import("./index.js").RecordRef, env: import("../../index.js").EncryptedEnvelope, key: import("../contract.js").CapsuleKey, opts?: {
+    encrypted?: boolean;
+}) => Promise<string>, writeEnvelopeBody: (identity: import("./index.js").RecordIdentity, json: string, key: import("../contract.js").CapsuleKey, opts?: {
+    encrypted?: boolean;
+    perRecordKey?: boolean;
+}) => Promise<Pick<import("../../index.js").EncryptedEnvelope, "_iv" | "_data" | "_cek">>, verifyRecordIdentity: (ref: import("./index.js").RecordRef, env: import("../../index.js").EncryptedEnvelope, key: import("../contract.js").CapsuleKey) => Promise<boolean>, resolveStableCek: (deps: import("../plumbing/lifecycle.js").StableCekDeps, id: string) => Promise<import("../contract.js").CapsuleKey>, rewrapBodyToDek: (from: import("./index.js").RecordIdentity, to: import("./index.js").RecordIdentity, envelope: Pick<import("../../index.js").EncryptedEnvelope, "_iv" | "_data" | "_cek" | "_tier" | "_by">, fromDek: import("../contract.js").CapsuleKey, toDek: import("../contract.js").CapsuleKey) => Promise<import("./index.js").RewrappedBody>, rewrapEnvelope: (identity: import("./index.js").RecordIdentity, envelope: import("../../index.js").EncryptedEnvelope, fromDek: import("../contract.js").CapsuleKey, toDek: import("../contract.js").CapsuleKey) => Promise<import("../../index.js").EncryptedEnvelope>, applyRewrappedBody: (envelope: import("../../index.js").EncryptedEnvelope, body: import("./index.js").RewrappedBody) => import("../../index.js").EncryptedEnvelope, isRewrappedUnder: (identity: import("./index.js").RecordIdentity, envelope: Pick<import("../../index.js").EncryptedEnvelope, "_iv" | "_data" | "_cek">, dek: import("../contract.js").CapsuleKey) => Promise<boolean>, rekeyEnvelopeToDek: (ref: {
+    readonly collection: string;
+    readonly id: string;
+}, envelope: import("../../index.js").EncryptedEnvelope, oldDek: import("../contract.js").CapsuleKey, newDek: import("../contract.js").CapsuleKey) => Promise<import("../../index.js").EncryptedEnvelope>, rekeyEnvelopeIfNeeded: (ref: {
+    readonly collection: string;
+    readonly id: string;
+}, envelope: import("../../index.js").EncryptedEnvelope, oldDek: import("../contract.js").CapsuleKey, newDek: import("../contract.js").CapsuleKey) => Promise<import("../../index.js").EncryptedEnvelope | null>, envelopeOpensUnderAny: (ref: {
+    readonly collection: string;
+    readonly id: string;
+}, envelope: import("../../index.js").EncryptedEnvelope, keys: readonly import("../contract.js").CapsuleKey[]) => Promise<boolean>, rekeyBlobSet: (adapter: import("../../index.js").NoydbStore, vault: string, oldDek: import("../contract.js").CapsuleKey, newDek: import("../contract.js").CapsuleKey, otherDeks?: readonly import("../contract.js").CapsuleKey[]) => Promise<import("../plumbing/rekey-blob.js").BlobRekeyReport>, RecordCodec: import("../plumbing/record-codec.js").BoundRecordCodec, makeReservedEnvelopes: (dekResolver: import("../plumbing/sealed-slots.js").ReservedEnvelopeDekResolver, declaredPrefixes: readonly string[]) => import("../../kernel/via/index.js").ViaCryptoCtx["reservedEnvelopes"], SEALED_CEK_NS: string, sealRecordToHost: (ctx: import("./index.js").SealingContext, collection: string, id: string, hostSealer: import("../../index.js").RecipientSealer, opts: {
+    expiresAt: string;
+}) => Promise<{
+    pid: string;
+    envelopeKey: string;
+}>, revokeSealedRecord: (ctx: import("./index.js").SealingContext, collection: string, id: string, pid: string, opts?: {
+    hard?: boolean;
+}) => Promise<void>, rotateRecordCek: (ctx: import("./index.js").SealingContext, collection: string, id: string) => Promise<void>, findByDet: <T>(ctx: import("./index.js").DeterministicContext<T>, field: string, value: unknown) => Promise<T | null>, queryByDet: <T>(ctx: import("./index.js").DeterministicContext<T>, field: string, value: unknown) => Promise<T[]>;
+export { deriveVdigSlotKey } from './classify/vdig.js';
+export { pbkdf2VerifyDigest } from './classify/digest.js';
+export { ctEqualTags } from '../plumbing/ct-equal.js';
+export { evaluateKofN } from '../plumbing/kofn.js';
+export { deriveClassifyIndexKey, deriveClassifyIndexSalt, mintBidxTag } from './classify/bidx.js';
+export { computeBidxTarget } from './classify/find.js';
+export { deriveBrokerProofBits, deriveBrokerProofKey, computeBrokerProof, issueChallenge, verifyBrokerProof, } from './broker/proof.js';
+export type { BrokerProofCanonicalParts, VerifyBrokerProofArgs, IssuedChallenge } from './broker/proof.js';
+export { generateSigningKeyPair, signBytes, verifyBytes } from '../plumbing/sign.js';
+export type { EnclaveKeyPair } from './crypto.js';
+export { generateRecipientKeyPair, exportRecipientPublicKeySpki, importRecipientPublicKeySpki, recipientWrap, recipientUnwrap, } from './crypto.js';
+export { capabilities } from './capabilities.js';

package/dist/capsule/enclave-aes/index.js

@@ -0,0 +1,335 @@
+import {
+  computeBidxTarget
+} from "../../chunk-BNWA3WG5.js";
+import {
+  aesCapsule,
+  checkCanary,
+  decrypt,
+  decryptBytes,
+  decryptBytesWithAAD,
+  decryptDeterministic,
+  deriveDeterministicKey,
+  deriveEchoKey,
+  deriveKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  deriveSecretKey,
+  deriveVdigSlotKey,
+  encrypt,
+  encryptBytes,
+  encryptBytesWithAAD,
+  encryptDeterministic,
+  exportDekSet,
+  exportRecipientPublicKeySpki,
+  generateDEK,
+  generateEphemeralKey,
+  generateRecipientKeyPair,
+  importCek,
+  importDekSet,
+  importRecipientPublicKeySpki,
+  importTransferKey,
+  mintCanary,
+  recipientUnwrap,
+  recipientWrap,
+  unwrapCek,
+  unwrapKey,
+  wrapCek,
+  wrapKey
+} from "../../chunk-5KC7QYEC.js";
+import {
+  deriveClassifyIndexKey,
+  deriveClassifyIndexSalt,
+  mintBidxTag,
+  pbkdf2VerifyDigest
+} from "../../chunk-EZOAKKTB.js";
+import {
+  generateSigningKeyPair,
+  signBytes,
+  verifyBytes
+} from "../../chunk-Q2XRFWOI.js";
+import {
+  evaluateKofN
+} from "../../chunk-NH2UOV3B.js";
+import {
+  buildDeleteMarker,
+  buildRecordAad,
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
+  buildTombstone,
+  ctEqualTags,
+  envelopeBodyForHash,
+  envelopeBodySize,
+  hasPerRecordKey,
+  hasSealedBody,
+  isDeleteMarker,
+  isTombstone,
+  isTombstoneShape,
+  recordAadFor,
+  requireSealedBody,
+  sealedBodyArgs
+} from "../../chunk-42ALPZ2B.js";
+import {
+  base64ToBuffer,
+  bufferToBase64,
+  deriveBlobAddressKey,
+  derivePresenceKey,
+  derivePresenceTagKey,
+  encodeEchoParts,
+  generateIV,
+  generateRecoverySecret,
+  generateSalt,
+  hkdfAesGcmKey,
+  hmacSha256Hex,
+  hmacSignHex,
+  sha256Bytes,
+  sha256Hex
+} from "../../chunk-QMWY2FDS.js";
+import "../../chunk-SV2PM2OY.js";
+import {
+  ValidationError
+} from "../../chunk-37EPTBBR.js";
+
+// src/capsule/enclave-aes/broker/proof.ts
+var subtle = globalThis.crypto.subtle;
+var BROKER_PROOF_DOMAIN = "noydb-broker-proof";
+var BROKER_PROOF_VERSION = "noydb-broker-proof-v1";
+var DEFAULT_CHALLENGE_TTL_MS = 6e4;
+function buildCanonical(vaultId, brokerId, parts) {
+  return JSON.stringify([
+    BROKER_PROOF_VERSION,
+    vaultId,
+    parts.endpointOrigin,
+    brokerId,
+    parts.profile ?? "",
+    parts.instancePid ?? "",
+    parts.challenge,
+    parts.expiresAt
+  ]);
+}
+async function deriveBrokerProofBits(seed, vaultId, brokerId) {
+  const hkdfKey = await subtle.importKey("raw", seed, "HKDF", false, ["deriveBits"]);
+  const salt = new TextEncoder().encode(BROKER_PROOF_DOMAIN);
+  const info = new TextEncoder().encode(JSON.stringify([BROKER_PROOF_DOMAIN, vaultId, brokerId]));
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
+  return new Uint8Array(bits);
+}
+async function deriveBrokerProofKey(seed, vaultId, brokerId) {
+  const proofBits = await deriveBrokerProofBits(seed, vaultId, brokerId);
+  try {
+    return await subtle.importKey("raw", proofBits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  } finally {
+    proofBits.fill(0);
+  }
+}
+async function computeBrokerProof(seed, vaultId, brokerId, canonicalParts) {
+  try {
+    if (canonicalParts.instancePid === "") {
+      throw new ValidationError(
+        "computeBrokerProof: instancePid must not be an empty string \u2014 omit the field entirely for 'no instance' (F7); '' would alias onto a registered instance."
+      );
+    }
+    const canonical = buildCanonical(vaultId, brokerId, canonicalParts);
+    const key = await deriveBrokerProofKey(seed, vaultId, brokerId);
+    const mac = await subtle.sign("HMAC", key, new TextEncoder().encode(canonical));
+    return bufferToBase64(new Uint8Array(mac));
+  } finally {
+    seed.fill(0);
+  }
+}
+function issueChallenge(opts) {
+  const ttlMs = opts?.ttlMs ?? DEFAULT_CHALLENGE_TTL_MS;
+  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(32));
+  return {
+    challenge: bufferToBase64(bytes),
+    expiresAt: new Date(Date.now() + ttlMs).toISOString()
+  };
+}
+async function verifyBrokerProof(args) {
+  const fresh = await args.consumeChallenge(args.challenge);
+  if (!fresh) return false;
+  if (args.instancePid === "") return false;
+  const canonical = buildCanonical(args.vaultId, args.brokerId, {
+    endpointOrigin: args.endpointOrigin,
+    profile: args.profile,
+    instancePid: args.instancePid,
+    challenge: args.challenge,
+    expiresAt: args.expiresAt
+  });
+  const key = await subtle.importKey(
+    "raw",
+    args.registeredProofKey,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["verify"]
+  );
+  const ok = await subtle.verify(
+    "HMAC",
+    key,
+    base64ToBuffer(args.proof),
+    new TextEncoder().encode(canonical)
+  );
+  if (!ok) return false;
+  return Date.now() < Date.parse(args.expiresAt);
+}
+
+// src/capsule/enclave-aes/capabilities.ts
+function sealedSet(items) {
+  const set = new Set(items);
+  const refuse = () => {
+    throw new TypeError(
+      "capabilities() is immutable \u2014 a capsule's declared groups cannot be edited by a caller"
+    );
+  };
+  set.add = refuse;
+  set.delete = refuse;
+  set.clear = refuse;
+  return Object.freeze(set);
+}
+var ALL = sealedSet([
+  "authenticate",
+  "seal",
+  "cipher",
+  "digest",
+  "sign",
+  "codec",
+  "sealing",
+  "deterministic",
+  "classify"
+]);
+function capabilities() {
+  return ALL;
+}
+
+// src/capsule/enclave-aes/index.ts
+var {
+  // envelope body
+  openEnvelopeJson,
+  writeEnvelopeBody,
+  verifyRecordIdentity,
+  // key lifecycle
+  resolveStableCek,
+  rewrapBodyToDek,
+  rewrapEnvelope,
+  applyRewrappedBody,
+  isRewrappedUnder,
+  // rekey
+  rekeyEnvelopeToDek,
+  rekeyEnvelopeIfNeeded,
+  envelopeOpensUnderAny,
+  rekeyBlobSet,
+  // record codec
+  RecordCodec,
+  // sealed slots — ONLY `makeReservedEnvelopes` is part of the frozen surface.
+  // The other seven are capsule-internal; destructuring the whole capsule here
+  // leaked them and widened the golden by 8 names. A surface is a contract, so
+  // the fix is to narrow the barrel, not to re-baseline the golden.
+  makeReservedEnvelopes,
+  // sealing
+  SEALED_CEK_NS,
+  sealRecordToHost,
+  revokeSealedRecord,
+  rotateRecordCek,
+  // deterministic
+  findByDet,
+  queryByDet
+} = aesCapsule;
+export {
+  RecordCodec,
+  SEALED_CEK_NS,
+  applyRewrappedBody,
+  base64ToBuffer,
+  bufferToBase64,
+  buildDeleteMarker,
+  buildRecordAad,
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
+  buildTombstone,
+  capabilities,
+  checkCanary,
+  computeBidxTarget,
+  computeBrokerProof,
+  ctEqualTags,
+  decrypt,
+  decryptBytes,
+  decryptBytesWithAAD,
+  decryptDeterministic,
+  deriveBlobAddressKey,
+  deriveBrokerProofBits,
+  deriveBrokerProofKey,
+  deriveClassifyIndexKey,
+  deriveClassifyIndexSalt,
+  deriveDeterministicKey,
+  deriveEchoKey,
+  deriveKey,
+  derivePresenceKey,
+  derivePresenceTagKey,
+  deriveSealedFieldKey,
+  deriveSealedFieldKeyFromCek,
+  deriveSecretKey,
+  deriveVdigSlotKey,
+  encodeEchoParts,
+  encrypt,
+  encryptBytes,
+  encryptBytesWithAAD,
+  encryptDeterministic,
+  envelopeBodyForHash,
+  envelopeBodySize,
+  envelopeOpensUnderAny,
+  evaluateKofN,
+  exportDekSet,
+  exportRecipientPublicKeySpki,
+  findByDet,
+  generateDEK,
+  generateEphemeralKey,
+  generateIV,
+  generateRecipientKeyPair,
+  generateRecoverySecret,
+  generateSalt,
+  generateSigningKeyPair,
+  hasPerRecordKey,
+  hasSealedBody,
+  hkdfAesGcmKey,
+  hmacSha256Hex,
+  hmacSignHex,
+  importCek,
+  importDekSet,
+  importRecipientPublicKeySpki,
+  importTransferKey,
+  isDeleteMarker,
+  isRewrappedUnder,
+  isTombstone,
+  isTombstoneShape,
+  issueChallenge,
+  makeReservedEnvelopes,
+  mintBidxTag,
+  mintCanary,
+  openEnvelopeJson,
+  pbkdf2VerifyDigest,
+  queryByDet,
+  recipientUnwrap,
+  recipientWrap,
+  recordAadFor,
+  rekeyBlobSet,
+  rekeyEnvelopeIfNeeded,
+  rekeyEnvelopeToDek,
+  requireSealedBody,
+  resolveStableCek,
+  revokeSealedRecord,
+  rewrapBodyToDek,
+  rewrapEnvelope,
+  rotateRecordCek,
+  sealRecordToHost,
+  sealedBodyArgs,
+  sha256Bytes,
+  sha256Hex,
+  signBytes,
+  unwrapCek,
+  unwrapKey,
+  verifyBrokerProof,
+  verifyBytes,
+  verifyRecordIdentity,
+  wrapCek,
+  wrapKey,
+  writeEnvelopeBody
+};
+//# sourceMappingURL=index.js.map