@noy-db/hub 0.8.0-pre.0 → 0.9.0-pre.0

package/dist/backup-7RKNZMQO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-pod/backup.ts"],"sourcesContent":["/**\n * Vault backup / restore / integrity.\n *\n * Holds `dump()` (verifiable encrypted JSON backup, including the blob\n * collections so blob \"covers\" travel in the bundle), `load()` (restore +\n * post-load integrity gate), `verifyBackupIntegrity()` (chain + data-envelope\n * cross-check), and `exportJSON()` (plaintext per-collection export, built on\n * the vault's `exportStream`). Behaviour is byte-identical to the inline\n * `Vault` methods these functions replaced — every dependency the moving code\n * touched on `this.*` arrives via {@link BackupContext}. `Vault` keeps the\n * public methods as thin delegators.\n *\n * Internal — reached through `vault.dump()` / `vault.load()` / etc.\n */\nimport { NOYDB_BACKUP_VERSION } from '../kernel/types.js'\nimport { BackupLedgerError, BackupCorruptedError } from '../kernel/errors.js'\nimport { LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION } from '../with-commit/history/ledger/constants.js'\nimport { SCHEMAS_COLLECTION } from '../with-shape/persisted-schemas/storage.js'\nimport { SEQUENCE_COLLECTION } from '../with-commit/sequence/index.js'\nimport { MANIFEST_COLLECTION } from '../with-shape/manifest/reserved-collections.js'\n// #1025 — imported from the dependency-light `window.ts`, not `periods.ts`: that\n// module exists precisely so a consumer can name the period collections without\n// dragging the ledger hash-chain machinery (`sha256Hex`/`canonicalJson`) into a\n// bundle that opted out of the periods service. Same reason the sync engine's\n// period-scoped pull imports it.\nimport {\n  PERIODS_COLLECTION,\n  PERIOD_FREEZES_COLLECTION,\n  PERIOD_ARCHIVES_COLLECTION,\n  PERIOD_TARGET_PURGES_COLLECTION,\n  PERIOD_REOPENS_COLLECTION,\n} from '../with-audit/periods/window.js'\nimport type {\n  NoydbStore,\n  EncryptedEnvelope,\n  VaultBackup,\n  VaultSnapshot,\n  ExportStreamOptions,\n  ExportChunk,\n} from '../kernel/types.js'\nimport type { LedgerStore } from '../with-commit/history/ledger/store.js'\nimport { buildRecordEnvelope } from '../capsule/index.js'\n\n/** Everything the moving backup methods touched on the vault's `this.*`. */\nexport interface BackupContext {\n  /** The ciphertext store. */\n  readonly adapter: NoydbStore\n  /** Vault namespace name. */\n  readonly vault: string\n  /** The invoking keyring's user id (read fresh per call). */\n  userId(): string\n  /** The vault's ledger store, or null when history is off. */\n  getLedgerOrNull(): LedgerStore | null\n  /** Recompute an envelope's `payloadHash` (bound `historyStrategy.envelopePayloadHash`). */\n  envelopePayloadHash(envelope: EncryptedEnvelope): Promise<string>\n  /**\n   * Refresh the in-memory keyring from the freshly-loaded keyring file and\n   * rebuild the DEK resolver. No-op when the vault has no `reloadKeyring`\n   * callback (plaintext vaults / test constructions).\n   */\n  reloadKeyringAndRebuildDEK(): Promise<void>\n  /** Clear the vault's collection cache (post-load). */\n  clearCollectionCache(): void\n  /** Reset the ledger store so the next `ledger()` rebuilds its head cache. */\n  resetLedgerStore(): void\n  /** The vault's decrypt+ACL export stream (used by `exportJSON`). */\n  exportStream(opts: ExportStreamOptions): AsyncIterableIterator<ExportChunk>\n}\n\n/** Result of {@link verifyBackupIntegrity}. */\nexport type VerifyBackupResult =\n  | { readonly ok: true; readonly head: string; readonly length: number }\n  | {\n      readonly ok: false\n      readonly kind: 'chain'\n      readonly divergedAt: number\n      readonly message: string\n    }\n  | {\n      readonly ok: false\n      readonly kind: 'data'\n      readonly collection: string\n      readonly id: string\n      readonly message: string\n    }\n\n/**\n * Dump vault as a verifiable encrypted JSON backup string.\n *\n * backups embed the current ledger head and the full `_ledger` +\n * `_ledger_deltas` internal collections so the receiver can run\n * `verifyBackupIntegrity()` after `load()` and detect any tampering between\n * dump and restore. Backups produced without a ledger skip the integrity check\n * with a warning — both modes round-trip cleanly.\n */\nexport async function dumpVault(ctx: BackupContext): Promise<string> {\n  const snapshot = await ctx.adapter.loadAll(ctx.vault)\n\n  // Load keyrings (separate path because loadAll filters them out\n  // along with all other underscore-prefixed internal collections).\n  const keyringIds = await ctx.adapter.list(ctx.vault, '_keyring')\n  const keyrings: Record<string, unknown> = {}\n  for (const keyringId of keyringIds) {\n    const envelope = await ctx.adapter.get(ctx.vault, '_keyring', keyringId)\n    if (envelope) {\n      keyrings[keyringId] = JSON.parse(envelope._data ?? '')\n    }\n  }\n\n  // Load the ledger entries + deltas so the receiver can replay\n  // the chain after restore. Without this, `load()` would have an\n  // empty ledger and `verifyBackupIntegrity()` would have nothing\n  // to compare against.\n  //\n  // Also enumerate the blob collections so blob content (\"covers\")\n  // travels in the bundle (the blob DEK already travels in `_keyring`).\n  // Literals are inlined (not imported from blobs/blob-set.ts) to keep\n  // the blob runtime out of this kernel hot path — they mirror\n  // BLOB_INDEX/CHUNKS/EVICTION_AUDIT_COLLECTION and SLOTS/VERSIONS_PREFIX.\n  // The collect-loop skips empty ids, so this no-ops without blobs.\n  const internalSnapshot: VaultSnapshot = {}\n  const internalNames = [\n    LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, SCHEMAS_COLLECTION, SEQUENCE_COLLECTION,\n    MANIFEST_COLLECTION, // #941: the pod's manifest-set record(s) travel in the bundle too\n    // #1025: the accounting-period close state + its companions. The bundle is\n    // the backup/restore path, so without these a restore discarded the\n    // hash-chained evidence that a month was ever closed — the artifact\n    // `closePeriod` exists to produce — and dropped the write gate with it, so\n    // the restored vault silently accepted back-dated writes into a sealed\n    // month. The companions matter as much as the close: a bounded reopen\n    // window (`reopenPeriod({ until })`) is state a restore must not lose.\n    PERIODS_COLLECTION,\n    PERIOD_REOPENS_COLLECTION,\n    PERIOD_FREEZES_COLLECTION,\n    PERIOD_ARCHIVES_COLLECTION,\n    PERIOD_TARGET_PURGES_COLLECTION,\n    '_history', // full-snapshot version history — so history()/getVersion()/diff() survive the bundle\n    '_blob_index', '_blob_chunks', '_blob_eviction_audit',\n    // #753 spec §7 Q3: `_blob_intent` markers travel too — restoring mid-op\n    // state (a blob row without its marker) would reproduce the ambiguity\n    // the journal exists to prevent. Note: `_mv_stale` does NOT travel\n    // today (a pre-existing, separate gap) — observed here, tracked on\n    // #761, not fixed in this pass.\n    '_blob_intent',\n    // #769: `_blob_slots_<c>` envelopes travel verbatim (raw ciphertext,\n    // same DEK, same vault) — including any `SlotRecord.pendingRelease`\n    // resume breadcrumb they carry. This is INTENTIONALLY the opposite of\n    // `extract-partition`'s `reKeyBlobs`, which STRIPS `pendingRelease`:\n    // a full-vault backup restores into the SAME vault it was taken from,\n    // so a breadcrumb taken mid-rehome (together with its `_blob_intent`\n    // marker, carried above) is resumable on restore — carry-and-resume is\n    // correct here. A partition extraction crosses vaults: the breadcrumb's\n    // old eTag may not exist in the destination, so it must be stripped\n    // there instead. Asymmetry: backup = same-vault-resumable = carry;\n    // partition = cross-vault = strip-breadcrumb-carry-marker.\n    ...Object.keys(snapshot).flatMap((c) => [`_blob_slots_${c}`, `_blob_versions_${c}`]),\n  ]\n  for (const internalName of internalNames) {\n    const ids = await ctx.adapter.list(ctx.vault, internalName)\n    if (ids.length === 0) continue\n    const records: Record<string, EncryptedEnvelope> = {}\n    for (const id of ids) {\n      const envelope = await ctx.adapter.get(ctx.vault, internalName, id)\n      if (envelope) records[id] = envelope\n    }\n    internalSnapshot[internalName] = records\n  }\n\n  // Embed the ledger head if there's a chain. An empty ledger\n  // (fresh vault) leaves `ledgerHead` undefined, which\n  // load() treats the same as a legacy backup (no integrity\n  // check, console warning). If history is not opted in,\n  // `getLedgerOrNull` returns null and we skip embedding entirely\n  // — the backup is still valid, just without the integrity head.\n  const ledgerForHead = ctx.getLedgerOrNull()\n  const head = ledgerForHead ? await ledgerForHead.head() : null\n  const backup: VaultBackup = {\n    _noydb_backup: NOYDB_BACKUP_VERSION,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    keyrings: keyrings as VaultBackup['keyrings'],\n    collections: snapshot,\n    ...(Object.keys(internalSnapshot).length > 0\n      ? { _internal: internalSnapshot }\n      : {}),\n    ...(head\n      ? {\n          ledgerHead: {\n            hash: head.hash,\n            index: head.entry.index,\n            ts: head.entry.ts,\n          },\n        }\n      : {}),\n  }\n\n  return JSON.stringify(backup)\n}\n\n/**\n * Restore a vault from a verifiable backup. After loading, runs\n * `verifyBackupIntegrity()` to confirm the hash chain, the embedded head, and\n * every data envelope's payload hash. Legacy backups (no `ledgerHead`) load\n * with a console warning and skip the integrity check.\n */\nexport async function loadVault(ctx: BackupContext, backupJson: string): Promise<void> {\n  const backup = JSON.parse(backupJson) as VaultBackup\n\n  // 1. Restore data collections.\n  await ctx.adapter.saveAll(ctx.vault, backup.collections)\n\n  // 2. Restore keyrings.\n  for (const [userId, keyringFile] of Object.entries(backup.keyrings)) {\n    const envelope = buildRecordEnvelope({ collection: '_keyring', id: userId, version: 1 },\n      { iv: '', data: JSON.stringify(keyringFile) })\n    await ctx.adapter.put(ctx.vault, '_keyring', userId, envelope)\n  }\n\n  // 3. Restore internal collections (`_ledger`, `_ledger_deltas`).\n  //    Required so verifyBackupIntegrity has the chain to walk.\n  if (backup._internal) {\n    for (const [internalName, records] of Object.entries(backup._internal)) {\n      for (const [id, envelope] of Object.entries(records)) {\n        await ctx.adapter.put(ctx.vault, internalName, id, envelope)\n      }\n    }\n  }\n\n  // 4. Refresh the in-memory keyring from the freshly-loaded\n  //    keyring file. Without this, the Vault's getDEK\n  //    closure still holds the OLD session's DEKs, and every\n  //    decrypt of a loaded ledger entry / data envelope fails\n  //    with TamperedError because the DEK doesn't match the\n  //    ciphertext that was encrypted with the SOURCE user's DEK.\n  //    Skipped for plaintext vaults and for tests that\n  //    construct Vault without a reloadKeyring callback.\n  await ctx.reloadKeyringAndRebuildDEK()\n\n  // 5. Clear collection cache + reset the ledger store so the\n  //    next ledger() call rebuilds its head cache from the\n  //    freshly-loaded entries.\n  ctx.clearCollectionCache()\n  ctx.resetLedgerStore()\n\n  // 5. Run the verification gate. A backup with no ledgerHead cannot be\n  //    integrity-checked, and skipping silently would collapse\n  //    *unverifiable* into *clean* — so it always warns. But the REMEDY\n  //    depends on the reader, not the pod (#1303): the pod cannot say\n  //    whether its exporter predates the ledger or never enabled it, and\n  //    the reader knows its own configuration.\n  //\n  //    - Reader HAS the ledger: the pod is behind it. \"Re-export\" is\n  //      actionable; keep the migration wording.\n  //    - Reader has NO ledger: nothing is stale and nothing is migrating —\n  //      the consumer priced the ledger (#1248 measured ~2.4x) and declined.\n  //      Prescribing a re-export is advice they should not take, and\n  //      repeating it on every read trains people to filter the one line\n  //      that also fires on a genuinely stale pod. State the consequence,\n  //      name the discriminator, prescribe nothing.\n  if (!backup.ledgerHead) {\n    if (ctx.getLedgerOrNull()) {\n      console.warn(\n        `[noy-db] Loaded a legacy backup with no ledgerHead — ` +\n        `verifiable-backup integrity check skipped. ` +\n        `Re-export with a ledger-aware build to get tamper detection.`,\n      )\n    } else {\n      console.warn(\n        `[noy-db] Loaded a backup with no ledgerHead — this pod is not integrity-checked. ` +\n        `This reader has no ledger enabled (withHistory() is not configured), so nothing is stale: ` +\n        `enable the ledger on both the exporter and this reader if tamper detection is wanted.`,\n      )\n    }\n    return\n  }\n\n  const result = await verifyBackupIntegrity(ctx)\n  if (!result.ok) {\n    // Surface the most specific error class we can. The result\n    // shape carries enough info for callers to inspect.\n    if (result.kind === 'data') {\n      throw new BackupCorruptedError(\n        result.collection,\n        result.id,\n        result.message,\n      )\n    }\n    throw new BackupLedgerError(result.message, result.divergedAt)\n  }\n\n  // 6. Cross-check: the freshly-verified head must match the\n  //    value embedded at dump time. A mismatch means someone\n  //    truncated or extended the chain after dump.\n  if (result.head !== backup.ledgerHead.hash) {\n    throw new BackupLedgerError(\n      `Backup ledger head mismatch: embedded \"${backup.ledgerHead.hash}\" ` +\n      `but reconstructed \"${result.head}\".`,\n    )\n  }\n}\n\n/**\n * End-to-end backup integrity check: `ledger.verify()` (hash chain) plus a data\n * envelope cross-check (every current record's `_data` hash must match the\n * latest `put` entry's `payloadHash`). Returns a discriminated union so callers\n * can distinguish chain vs data failures.\n */\nexport async function verifyBackupIntegrity(ctx: BackupContext): Promise<VerifyBackupResult> {\n  // Step 1: chain verification. Without the history strategy there\n  // is no ledger; an unaudited backup verifies trivially as `ok`\n  // because there's nothing to diverge from.\n  const ledgerForVerify = ctx.getLedgerOrNull()\n  if (!ledgerForVerify) {\n    return { ok: true, head: '', length: 0 }\n  }\n  const chainResult = await ledgerForVerify.verify()\n  if (!chainResult.ok) {\n    return {\n      ok: false,\n      kind: 'chain',\n      divergedAt: chainResult.divergedAt,\n      message:\n        `Ledger chain diverged at index ${chainResult.divergedAt}: ` +\n        `expected prevHash \"${chainResult.expected}\" but found \"${chainResult.actual}\".`,\n    }\n  }\n\n  // Step 2: data envelope cross-check. Walk every entry in the\n  // ledger and, for the LATEST `put` per (collection, id), recompute\n  // the data envelope's payloadHash and compare. Earlier puts of the\n  // same id are skipped because the data collection only holds the\n  // current version — historical envelopes live in the deltas\n  // collection (which is itself protected by the chain).\n  // Reuse the ledger we already resolved in step 1.\n  const allEntries = await ledgerForVerify.loadAllEntries()\n\n  // Find the latest non-delete entry per (collection, id). Walk\n  // the entries in reverse so we hit the latest first; mark each\n  // (collection, id) as seen and skip subsequent entries.\n  const seen = new Set<string>()\n  const latest = new Map<\n    string,\n    { collection: string; id: string; expectedHash: string }\n  >()\n  for (let i = allEntries.length - 1; i >= 0; i--) {\n    const entry = allEntries[i]\n    if (!entry) continue\n    // Amendment entries are multi-record audit entries whose\n    // `collection` and `id` are empty strings — building a `\"/\"`\n    // key here would mark that synthetic slot as seen and falsely\n    // trip the data check on a record that never existed. Skip\n    // them BEFORE the key/seen bookkeeping so they neither\n    // tombstone real entries nor enter the latest map.\n    if (entry.op === 'amendment' || entry.op === 'lifecycle') continue\n    const key = `${entry.collection}/${entry.id}`\n    if (seen.has(key)) continue\n    seen.add(key)\n    // For deletes the data collection should NOT have the record,\n    // so we skip — there's nothing to cross-check. Marking the key\n    // as seen above ensures any earlier `put` of the same id is\n    // also skipped (the record was subsequently deleted).\n    if (entry.op === 'delete') continue\n    latest.set(key, {\n      collection: entry.collection,\n      id: entry.id,\n      expectedHash: entry.payloadHash,\n    })\n  }\n\n  for (const { collection, id, expectedHash } of latest.values()) {\n    const envelope = await ctx.adapter.get(ctx.vault, collection, id)\n    if (!envelope) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Ledger expects data record \"${collection}/${id}\" to exist, ` +\n          `but the adapter has no envelope for it.`,\n      }\n    }\n    const actualHash = await ctx.envelopePayloadHash(envelope)\n    if (actualHash !== expectedHash) {\n      return {\n        ok: false,\n        kind: 'data',\n        collection,\n        id,\n        message:\n          `Data envelope \"${collection}/${id}\" has been tampered with: ` +\n          `expected payloadHash \"${expectedHash}\", got \"${actualHash}\".`,\n      }\n    }\n  }\n\n  return {\n    ok: true,\n    head: chainResult.head,\n    length: chainResult.length,\n  }\n}\n\n/**\n * Plaintext per-collection export, built on the vault's `exportStream`. Forces\n * collection granularity (record-by-record output makes no sense in a single\n * string) and merges dictionary snapshots across collections.\n */\nexport async function exportVaultJSON(ctx: BackupContext, opts: ExportStreamOptions = {}): Promise<string> {\n  // Force per-collection granularity regardless of caller setting:\n  // record-by-record output doesn't make sense in a single string.\n  const collections: Record<\n    string,\n    {\n      schema: null\n      refs: Record<string, { target: string; mode: 'strict' | 'warn' | 'cascade' }>\n      records: unknown[]\n    }\n  > = {}\n  let ledgerHead: ExportChunk['ledgerHead'] | undefined\n  // Merged dictionary snapshot across all collections.\n  // Only populated when `resolveLabels` is not set.\n  const allDictionaries: Record<\n    string, // collection name\n    Record<string, Record<string, Record<string, string>>>\n  > = {}\n\n  for await (const chunk of ctx.exportStream({\n    granularity: 'collection',\n    withLedgerHead: opts.withLedgerHead === true,\n    // Thread the export locale so records are read at the\n    // `export` layer (i18nText collapsed + dictKey/staticDict labels resolved).\n    ...(opts.resolveLabels !== undefined ? { resolveLabels: opts.resolveLabels } : {}),\n  })) {\n    collections[chunk.collection] = {\n      schema: null, // Standard Schema validators are not JSON-serializable\n      refs: chunk.refs,\n      records: chunk.records,\n    }\n    if (chunk.ledgerHead) ledgerHead = chunk.ledgerHead\n    // Collect dictionary snapshots unless resolveLabels is set\n    if (!opts.resolveLabels && chunk.dictionaries) {\n      allDictionaries[chunk.collection] = chunk.dictionaries\n    }\n  }\n\n  const hasDictionaries = Object.keys(allDictionaries).length > 0\n  return JSON.stringify({\n    _noydb_export: 1,\n    _compartment: ctx.vault,\n    _exported_at: new Date().toISOString(),\n    _exported_by: ctx.userId(),\n    collections,\n    ...(hasDictionaries ? { _dictionaries: allDictionaries } : {}),\n    ...(ledgerHead ? { ledgerHead } : {}),\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+FA,eAAsB,UAAU,KAAqC;AACnE,QAAM,WAAW,MAAM,IAAI,QAAQ,QAAQ,IAAI,KAAK;AAIpD,QAAM,aAAa,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,UAAU;AAC/D,QAAM,WAAoC,CAAC;AAC3C,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,SAAS;AACvE,QAAI,UAAU;AACZ,eAAS,SAAS,IAAI,KAAK,MAAM,SAAS,SAAS,EAAE;AAAA,IACvD;AAAA,EACF;AAaA,QAAM,mBAAkC,CAAC;AACzC,QAAM,gBAAgB;AAAA,IACpB;AAAA,IAAmB;AAAA,IAA0B;AAAA,IAAoB;AAAA,IACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IACA;AAAA,IAAe;AAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAM/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAYA,GAAG,OAAO,KAAK,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC;AAAA,EACrF;AACA,aAAW,gBAAgB,eAAe;AACxC,UAAM,MAAM,MAAM,IAAI,QAAQ,KAAK,IAAI,OAAO,YAAY;AAC1D,QAAI,IAAI,WAAW,EAAG;AACtB,UAAM,UAA6C,CAAC;AACpD,eAAW,MAAM,KAAK;AACpB,YAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,EAAE;AAClE,UAAI,SAAU,SAAQ,EAAE,IAAI;AAAA,IAC9B;AACA,qBAAiB,YAAY,IAAI;AAAA,EACnC;AAQA,QAAM,gBAAgB,IAAI,gBAAgB;AAC1C,QAAM,OAAO,gBAAgB,MAAM,cAAc,KAAK,IAAI;AAC1D,QAAM,SAAsB;AAAA,IAC1B,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,aAAa;AAAA,IACb,GAAI,OAAO,KAAK,gBAAgB,EAAE,SAAS,IACvC,EAAE,WAAW,iBAAiB,IAC9B,CAAC;AAAA,IACL,GAAI,OACA;AAAA,MACE,YAAY;AAAA,QACV,MAAM,KAAK;AAAA,QACX,OAAO,KAAK,MAAM;AAAA,QAClB,IAAI,KAAK,MAAM;AAAA,MACjB;AAAA,IACF,IACA,CAAC;AAAA,EACP;AAEA,SAAO,KAAK,UAAU,MAAM;AAC9B;AAQA,eAAsB,UAAU,KAAoB,YAAmC;AACrF,QAAM,SAAS,KAAK,MAAM,UAAU;AAGpC,QAAM,IAAI,QAAQ,QAAQ,IAAI,OAAO,OAAO,WAAW;AAGvD,aAAW,CAAC,QAAQ,WAAW,KAAK,OAAO,QAAQ,OAAO,QAAQ,GAAG;AACnE,UAAM,WAAW;AAAA,MAAoB,EAAE,YAAY,YAAY,IAAI,QAAQ,SAAS,EAAE;AAAA,MACpF,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,WAAW,EAAE;AAAA,IAAC;AAC/C,UAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,QAAQ,QAAQ;AAAA,EAC/D;AAIA,MAAI,OAAO,WAAW;AACpB,eAAW,CAAC,cAAc,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AACtE,iBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,cAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,cAAc,IAAI,QAAQ;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAUA,QAAM,IAAI,2BAA2B;AAKrC,MAAI,qBAAqB;AACzB,MAAI,iBAAiB;AAiBrB,MAAI,CAAC,OAAO,YAAY;AACtB,QAAI,IAAI,gBAAgB,GAAG;AACzB,cAAQ;AAAA,QACN;AAAA,MAGF;AAAA,IACF,OAAO;AACL,cAAQ;AAAA,QACN;AAAA,MAGF;AAAA,IACF;AACA;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,sBAAsB,GAAG;AAC9C,MAAI,CAAC,OAAO,IAAI;AAGd,QAAI,OAAO,SAAS,QAAQ;AAC1B,YAAM,IAAI;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,IAAI,kBAAkB,OAAO,SAAS,OAAO,UAAU;AAAA,EAC/D;AAKA,MAAI,OAAO,SAAS,OAAO,WAAW,MAAM;AAC1C,UAAM,IAAI;AAAA,MACR,0CAA0C,OAAO,WAAW,IAAI,wBAC1C,OAAO,IAAI;AAAA,IACnC;AAAA,EACF;AACF;AAQA,eAAsB,sBAAsB,KAAiD;AAI3F,QAAM,kBAAkB,IAAI,gBAAgB;AAC5C,MAAI,CAAC,iBAAiB;AACpB,WAAO,EAAE,IAAI,MAAM,MAAM,IAAI,QAAQ,EAAE;AAAA,EACzC;AACA,QAAM,cAAc,MAAM,gBAAgB,OAAO;AACjD,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,YAAY,YAAY;AAAA,MACxB,SACE,kCAAkC,YAAY,UAAU,wBAClC,YAAY,QAAQ,gBAAgB,YAAY,MAAM;AAAA,IAChF;AAAA,EACF;AASA,QAAM,aAAa,MAAM,gBAAgB,eAAe;AAKxD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAAS,oBAAI,IAGjB;AACF,WAAS,IAAI,WAAW,SAAS,GAAG,KAAK,GAAG,KAAK;AAC/C,UAAM,QAAQ,WAAW,CAAC;AAC1B,QAAI,CAAC,MAAO;AAOZ,QAAI,MAAM,OAAO,eAAe,MAAM,OAAO,YAAa;AAC1D,UAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAC3C,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AAKZ,QAAI,MAAM,OAAO,SAAU;AAC3B,WAAO,IAAI,KAAK;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,IAAI,MAAM;AAAA,MACV,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,aAAW,EAAE,YAAY,IAAI,aAAa,KAAK,OAAO,OAAO,GAAG;AAC9D,UAAM,WAAW,MAAM,IAAI,QAAQ,IAAI,IAAI,OAAO,YAAY,EAAE;AAChE,QAAI,CAAC,UAAU;AACb,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,+BAA+B,UAAU,IAAI,EAAE;AAAA,MAEnD;AAAA,IACF;AACA,UAAM,aAAa,MAAM,IAAI,oBAAoB,QAAQ;AACzD,QAAI,eAAe,cAAc;AAC/B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA,SACE,kBAAkB,UAAU,IAAI,EAAE,mDACT,YAAY,WAAW,UAAU;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM,YAAY;AAAA,IAClB,QAAQ,YAAY;AAAA,EACtB;AACF;AAOA,eAAsB,gBAAgB,KAAoB,OAA4B,CAAC,GAAoB;AAGzG,QAAM,cAOF,CAAC;AACL,MAAI;AAGJ,QAAM,kBAGF,CAAC;AAEL,mBAAiB,SAAS,IAAI,aAAa;AAAA,IACzC,aAAa;AAAA,IACb,gBAAgB,KAAK,mBAAmB;AAAA;AAAA;AAAA,IAGxC,GAAI,KAAK,kBAAkB,SAAY,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,EAClF,CAAC,GAAG;AACF,gBAAY,MAAM,UAAU,IAAI;AAAA,MAC9B,QAAQ;AAAA;AAAA,MACR,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,IACjB;AACA,QAAI,MAAM,WAAY,cAAa,MAAM;AAEzC,QAAI,CAAC,KAAK,iBAAiB,MAAM,cAAc;AAC7C,sBAAgB,MAAM,UAAU,IAAI,MAAM;AAAA,IAC5C;AAAA,EACF;AAEA,QAAM,kBAAkB,OAAO,KAAK,eAAe,EAAE,SAAS;AAC9D,SAAO,KAAK,UAAU;AAAA,IACpB,eAAe;AAAA,IACf,cAAc,IAAI;AAAA,IAClB,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc,IAAI,OAAO;AAAA,IACzB;AAAA,IACA,GAAI,kBAAkB,EAAE,eAAe,gBAAgB,IAAI,CAAC;AAAA,IAC5D,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,EACrC,CAAC;AACH;","names":[]}

package/dist/blobs/index.js

@@ -10,7 +10,7 @@ import {
   createExportBlobsHandle,
   reportOrphanBlobChunks,
   runCompaction
-} from "../chunk-GF5BZ7D4.js";
+} from "../chunk-G5EDYVSE.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -25,21 +25,20 @@ import {
   detectMimeType,
   isPreCompressed,
   memoryBlobPinStore
-} from "../chunk-ANWPSTZU.js";
-import "../chunk-Z5HTYMMQ.js";
-import "../chunk-SOIQ4MM4.js";
-import "../chunk-JCN44NCY.js";
-import "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
+} from "../chunk-QXJXG7DN.js";
+import "../chunk-PTJY5R3O.js";
+import "../chunk-UHFGK6YA.js";
+import "../chunk-RIZTZJX6.js";
+import "../chunk-4J3MNVVX.js";
+import "../chunk-ZBUAX4EF.js";
+import "../chunk-SPPOUJLN.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-OM3SEDI4.js";
+import "../chunk-PUBI455O.js";
+import "../chunk-2ELOCEXE.js";
 import {
   BlobOfflineError
-} from "../chunk-244VXYPG.js";
+} from "../chunk-VSUQI5Q6.js";
 
 // src/via/blob/active.ts
 function withBlobs(options = {}) {

package/dist/blobs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/via/blob/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobsStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobsStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { BlobsStrategy } from '../../port/with/blob-strategy.js'\nimport { createBlobPinCache } from '../../with-shape/blobs/blob-pinning.js'\nimport type { BlobPinStore } from '../../with-shape/blobs/blob-pinning.js'\n\n/** Options for {@link withBlobs} (#808). */\nexport interface WithBlobsOptions {\n  /**\n   * Device-local backend for the offline-pin registry + external side-cache\n   * (`collection.blob(id).pin()`, the `cacheBudget` LRU stamps). Default:\n   * in-memory — pins then last one app session. Supply a durable,\n   * DEVICE-LOCAL store (IndexedDB-backed on the web; it must never sync) to\n   * keep pins across restarts. See `BlobPinStore`'s doc for the posture.\n   */\n  readonly pinStore?: BlobPinStore\n}\n\n/**\n * Build a default `BlobsStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * One `withBlobs()` instance owns one device-local pin registry + KPI\n * counter set (#808) — treat it as \"this device's\" blob service.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobsStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * const vault = await db.openVault('acme')\n * await vault.collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(options: WithBlobsOptions = {}): BlobsStrategy {\n  const pinCache = createBlobPinCache(options.pinStore)\n  return {\n    openSlot(args) {\n      return new BlobSet({ ...args, pinCache })\n    },\n    cacheStats() {\n      return { ...pinCache.stats }\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,UAAU,UAA4B,CAAC,GAAkB;AACvE,QAAM,WAAW,mBAAmB,QAAQ,QAAQ;AACpD,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC;AAAA,IAC1C;AAAA,IACA,aAAa;AACX,aAAO,EAAE,GAAG,SAAS,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/via/blob/active.ts"],"sourcesContent":["/**\n * Active blob strategy factory. Calling `blobs()` returns a\n * `BlobsStrategy` whose `openSlot` constructs a real `BlobSet` bound\n * to the caller's record. The returned strategy is passed into\n * `createNoydb({ blobsStrategy: blobs() })` to light up the\n * `collection.blob(id)` path.\n *\n * This module is only reachable through the `@noy-db/hub/blobs`\n * subpath — a consumer that never imports the subpath ships none of\n * this (ESM tree-shaking + hub's `\"sideEffects\": false`).\n */\n\nimport { BlobSet } from '../../with-shape/blobs/blob-set.js'\nimport type { BlobsStrategy } from '../../port/with/blob-strategy.js'\nimport { createBlobPinCache } from '../../with-shape/blobs/blob-pinning.js'\nimport type { BlobPinStore } from '../../with-shape/blobs/blob-pinning.js'\n\n/** Options for {@link withBlobs} (#808). */\nexport interface WithBlobsOptions {\n  /**\n   * Device-local backend for the offline-pin registry + external side-cache\n   * (`collection.blob(id).pin()`, the `cacheBudget` LRU stamps). Default:\n   * in-memory — pins then last one app session. Supply a durable,\n   * DEVICE-LOCAL store (IndexedDB-backed on the web; it must never sync) to\n   * keep pins across restarts. See `BlobPinStore`'s doc for the posture.\n   */\n  readonly pinStore?: BlobPinStore\n}\n\n/**\n * Build a default `BlobsStrategy` ready to pass into `createNoydb`.\n *\n * Named `withBlobs` (plugin-pattern canonical) rather than `blobs` to\n * avoid shadowing the very common local idiom\n * `const blobs = invoices.blob(id)` in user code.\n *\n * One `withBlobs()` instance owns one device-local pin registry + KPI\n * counter set (#808) — treat it as \"this device's\" blob service.\n *\n * @example\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withBlobs } from '@noy-db/hub/blobs'\n *\n * const db = await createNoydb({\n *   store, user, secret,\n *   blobsStrategy: withBlobs(),\n * })\n *\n * // Now live — delegates to BlobSet.\n * const vault = await db.openVault('acme')\n * await vault.collection('invoices').blob('inv-1').put('receipt.pdf', bytes)\n * ```\n */\nexport function withBlobs(options: WithBlobsOptions = {}): BlobsStrategy {\n  const pinCache = createBlobPinCache(options.pinStore)\n  return {\n    openSlot(args) {\n      return new BlobSet({ ...args, pinCache })\n    },\n    cacheStats() {\n      return { ...pinCache.stats }\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,UAAU,UAA4B,CAAC,GAAkB;AACvE,QAAM,WAAW,mBAAmB,QAAQ,QAAQ;AACpD,SAAO;AAAA,IACL,SAAS,MAAM;AACb,aAAO,IAAI,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC;AAAA,IAC1C;AAAA,IACA,aAAa;AACX,aAAO,EAAE,GAAG,SAAS,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;","names":[]}

package/dist/broker/index.js

@@ -1,22 +1,21 @@
 import {
   NO_BROKER
-} from "../chunk-4AF3TUMP.js";
+} from "../chunk-72XBVN4J.js";
 import {
   issueChallenge,
   verifyBrokerProof
-} from "../chunk-KJFW62P4.js";
-import "../chunk-SEE332EV.js";
-import "../chunk-6QSQQLSE.js";
-import "../chunk-DE4DH2RZ.js";
-import "../chunk-LQ4ZHOKP.js";
-import "../chunk-LP7BEXCT.js";
-import "../chunk-UYB234ZR.js";
-import "../chunk-ODVPTDPK.js";
+} from "../chunk-4J3MNVVX.js";
+import "../chunk-ZBUAX4EF.js";
+import "../chunk-SPPOUJLN.js";
+import "../chunk-NH2UOV3B.js";
+import "../chunk-OM3SEDI4.js";
+import "../chunk-PUBI455O.js";
+import "../chunk-2ELOCEXE.js";
 import {
   BrokerEnrolmentError,
   BrokerNotEnabledError,
   BrokerProofError
-} from "../chunk-244VXYPG.js";
+} from "../chunk-VSUQI5Q6.js";
 
 // src/with-party/broker/active.ts
 var DEFAULT_SKEW_MS = 6e4;
@@ -29,7 +28,7 @@ function withBroker(config) {
   const cache = /* @__PURE__ */ new Map();
   return {
     async enroll(ctx) {
-      const { enrollSeed } = await import("../seed-4JS2RJ4A.js");
+      const { enrollSeed } = await import("../seed-JMQTRKRE.js");
       return enrollSeed({ ...ctx, config });
     },
     async rotate(ctx) {
@@ -38,9 +37,17 @@ function withBroker(config) {
       const inFlight = scoped.map(([, e]) => e.inFlight).filter((p) => p !== void 0);
       await Promise.allSettled(inFlight);
       for (const [key] of scoped) cache.delete(key);
-      const { rotateSeed } = await import("../seed-4JS2RJ4A.js");
+      const { rotateSeed } = await import("../seed-JMQTRKRE.js");
       return rotateSeed({ ...ctx, config });
     },
+    async enrolMember(ctx, member) {
+      const { enrolMemberSeed } = await import("../seed-JMQTRKRE.js");
+      return enrolMemberSeed({ ...ctx, config }, member);
+    },
+    async revokeMember(ctx, userId) {
+      const { revokeMemberSeed } = await import("../seed-JMQTRKRE.js");
+      return revokeMemberSeed({ ...ctx, config }, userId);
+    },
     credentialSource(ctx, profile) {
       const key = `${ctx.vault}\0${profile ?? ""}`;
       return async () => {
@@ -55,7 +62,7 @@ function withBroker(config) {
         const skewMs = config.skewMs ?? DEFAULT_SKEW_MS;
         const capturedEntry = entry;
         const inFlight = (async () => {
-          const { mintStoreCredentials } = await import("../seed-4JS2RJ4A.js");
+          const { mintStoreCredentials } = await import("../seed-JMQTRKRE.js");
           const creds = await mintStoreCredentials({ ...ctx, config }, profile);
           capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) };
           return creds;

package/dist/broker/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-party/broker/active.ts","../../src/with-party/broker/index.ts"],"sourcesContent":["/**\n * Enable the credential-broker capability (#479, spec §5).\n *\n * Pass to `createNoydb({ brokerStrategy: withBroker(config) })` to make\n * `vault.broker()` live. Each method dynamic-imports the seed lifecycle\n * engine (`./seed.js`) — mirroring `via/classified/active.ts`'s per-method\n * dynamic-import seam — so `with-party/broker/seed.ts` (the heavy module:\n * the CAS enrol, quiesce-then-swap rotate, and the challenge/response round\n * trip) is reachable only through the `@noy-db/hub/broker` subpath and\n * never enters the single-user floor bundle.\n *\n * The single-flight, per-vault-per-profile refresh cache (H-6/I6) lives\n * HERE, in this factory's closure — shared across every `credentialSource(profile)`\n * call for this one broker instance (in turn shared across every vault of a\n * `createNoydb()` instance — `vault.broker()` passes the SAME `BrokerStrategy`\n * for all of them), so `rotate()` can quiesce it (await any in-flight\n * round-trip, then drop it) before the seed swap. The cache key is\n * `${vault}\\0${profile}` — keyed by vault FIRST, or two vaults sharing this\n * one strategy would collide and hand vault-B a cached credential minted\n * (and STS-scoped) for vault-A.\n */\nimport type { BrokerStrategy, BrokerConfig, BrokerCtx } from '../../port/with/broker-strategy.js'\nimport type { StoreCredentials, StoreCredentialSource } from '../../kernel/types.js'\n\nconst DEFAULT_SKEW_MS = 60_000\n/** Floor under the skew-adjusted boundary so a sub-skew credential TTL\n *  doesn't collapse to \"already expired\" and thrash re-proving every call (I6b). */\nconst MIN_CACHE_MS = 1_000\n\ninterface CacheEntry {\n  cached?: { creds: StoreCredentials; validUntil: number } | undefined\n  inFlight?: Promise<StoreCredentials> | undefined\n}\n\nfunction cacheFloor(creds: StoreCredentials, skewMs: number): number {\n  const expiresAtMs = creds.expiresAt ? Date.parse(creds.expiresAt) : Date.now() + skewMs * 2\n  return Math.max(expiresAtMs - skewMs, Date.now() + MIN_CACHE_MS)\n}\n\nexport function withBroker(config: BrokerConfig): BrokerStrategy {\n  const cache = new Map<string, CacheEntry>()\n\n  return {\n    async enroll(ctx) {\n      const { enrollSeed } = await import('./seed.js')\n      return enrollSeed({ ...ctx, config })\n    },\n    async rotate(ctx) {\n      // Quiesce (I5): let any in-flight round-trip finish (it may still be\n      // proving under the pre-rotation seed) before the local record is\n      // overwritten, then drop the cache — scoped to THIS vault's entries\n      // only (`${ctx.vault}\\0`-prefixed keys). A global cache.clear() here\n      // would blow away every OTHER vault's cache on this shared strategy\n      // too — same root cause as the cross-vault read collision this fixes.\n      const vaultPrefix = `${ctx.vault}\\0`\n      const scoped = [...cache.entries()].filter(([key]) => key.startsWith(vaultPrefix))\n      const inFlight = scoped.map(([, e]) => e.inFlight).filter((p): p is Promise<StoreCredentials> => p !== undefined)\n      await Promise.allSettled(inFlight)\n      for (const [key] of scoped) cache.delete(key)\n      const { rotateSeed } = await import('./seed.js')\n      return rotateSeed({ ...ctx, config })\n    },\n    credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource {\n      const key = `${ctx.vault}\\0${profile ?? ''}`\n      return async () => {\n        let entry = cache.get(key)\n        if (!entry) {\n          entry = {}\n          cache.set(key, entry)\n        }\n        const now = Date.now()\n        if (entry.cached && now < entry.cached.validUntil) return entry.cached.creds\n        if (entry.inFlight) return entry.inFlight\n\n        const skewMs = config.skewMs ?? DEFAULT_SKEW_MS\n        const capturedEntry = entry\n        const inFlight = (async () => {\n          const { mintStoreCredentials } = await import('./seed.js')\n          const creds = await mintStoreCredentials({ ...ctx, config }, profile)\n          capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) }\n          return creds\n        })()\n        entry.inFlight = inFlight\n        try {\n          return await inFlight\n        } finally {\n          // Clear-on-settle (I6a): a rejected in-flight promise must never\n          // stay pinned in the cache, or every subsequent call would wedge\n          // on the same rejection instead of retrying.\n          capturedEntry.inFlight = undefined\n        }\n      }\n    },\n  }\n}\n","/**\n * `@noy-db/hub/broker` — subpath export for the credential-broker capability\n * (#479, credential-broker spec). Apps that never call `vault.broker()` can\n * exclude this subpath entirely: the floor default `NO_BROKER` throws, and\n * this module's real engine (`with-party/broker/{seed,active}.ts`) is only\n * ever reached through `withBroker()`'s dynamic imports, so it never enters\n * a floor bundle.\n *\n * Also re-exports the host-side helpers (`issueChallenge`, `verifyBrokerProof`)\n * from the enclave barrel, so a Lambda/Worker implementing the reference\n * broker host can import just this one subpath and get everything it\n * needs, `crypto.subtle`-only.\n */\n\n// ─── Capability opt-in seam ──────────────────────────────────\nexport { withBroker } from './active.js'\nexport {\n  NO_BROKER,\n  type BrokerStrategy,\n  type BrokerCtx,\n  type BrokerConfig,\n  type CredentialBrokerHandle,\n} from '../../port/with/broker-strategy.js'\nexport { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js'\n\n// ─── Host helpers (verify side — for a reference broker host) ───\nimport { issueChallenge as issueChallengeRaw, verifyBrokerProof } from '../../kernel/enclave/index.js'\nimport type { IssuedChallenge, VerifyBrokerProofArgs } from '../../kernel/enclave/index.js'\n\n/**\n * Floor — a challenge TTL must survive network latency + clock drift\n * between host and client. The enclave's `issueChallenge` is deliberately\n * unclamped (a mechanical primitive, not a policy); this floor is host\n * POLICY, so it lives here in the party layer, not\n * `kernel/enclave/broker/proof.ts` (carried forward from Task 2's review,\n * I6b).\n */\nconst MIN_CHALLENGE_TTL_MS = 10_000\n/** Ceiling — spec §2 step 2: \"TTL ≤ 60 s\". */\nconst MAX_CHALLENGE_TTL_MS = 60_000\n\n/**\n * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a\n * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel\n * gets a safe challenge TTL without having to know the bounds itself.\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const requested = opts?.ttlMs ?? MAX_CHALLENGE_TTL_MS\n  const clamped = Math.min(Math.max(requested, MIN_CHALLENGE_TTL_MS), MAX_CHALLENGE_TTL_MS)\n  return issueChallengeRaw({ ttlMs: clamped })\n}\nexport { verifyBrokerProof }\nexport type { VerifyBrokerProofArgs }\n\n// #837 — issueChallenge's return type must be nameable from this entry.\nexport type { IssuedChallenge } from '../../kernel/enclave/index.js'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,kBAAkB;AAGxB,IAAM,eAAe;AAOrB,SAAS,WAAW,OAAyB,QAAwB;AACnE,QAAM,cAAc,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,IAAI,IAAI,SAAS;AAC1F,SAAO,KAAK,IAAI,cAAc,QAAQ,KAAK,IAAI,IAAI,YAAY;AACjE;AAEO,SAAS,WAAW,QAAsC;AAC/D,QAAM,QAAQ,oBAAI,IAAwB;AAE1C,SAAO;AAAA,IACL,MAAM,OAAO,KAAK;AAChB,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,OAAO,KAAK;AAOhB,YAAM,cAAc,GAAG,IAAI,KAAK;AAChC,YAAM,SAAS,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,WAAW,CAAC;AACjF,YAAM,WAAW,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAsC,MAAM,MAAS;AAChH,YAAM,QAAQ,WAAW,QAAQ;AACjC,iBAAW,CAAC,GAAG,KAAK,OAAQ,OAAM,OAAO,GAAG;AAC5C,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,iBAAiB,KAAgB,SAAyC;AACxE,YAAM,MAAM,GAAG,IAAI,KAAK,KAAK,WAAW,EAAE;AAC1C,aAAO,YAAY;AACjB,YAAI,QAAQ,MAAM,IAAI,GAAG;AACzB,YAAI,CAAC,OAAO;AACV,kBAAQ,CAAC;AACT,gBAAM,IAAI,KAAK,KAAK;AAAA,QACtB;AACA,cAAM,MAAM,KAAK,IAAI;AACrB,YAAI,MAAM,UAAU,MAAM,MAAM,OAAO,WAAY,QAAO,MAAM,OAAO;AACvE,YAAI,MAAM,SAAU,QAAO,MAAM;AAEjC,cAAM,SAAS,OAAO,UAAU;AAChC,cAAM,gBAAgB;AACtB,cAAM,YAAY,YAAY;AAC5B,gBAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,qBAAW;AACzD,gBAAM,QAAQ,MAAM,qBAAqB,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO;AACpE,wBAAc,SAAS,EAAE,OAAO,YAAY,WAAW,OAAO,MAAM,EAAE;AACtE,iBAAO;AAAA,QACT,GAAG;AACH,cAAM,WAAW;AACjB,YAAI;AACF,iBAAO,MAAM;AAAA,QACf,UAAE;AAIA,wBAAc,WAAW;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACzDA,IAAM,uBAAuB;AAE7B,IAAM,uBAAuB;AAOtB,SAASA,gBAAe,MAA4C;AACzE,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,UAAU,KAAK,IAAI,KAAK,IAAI,WAAW,oBAAoB,GAAG,oBAAoB;AACxF,SAAO,eAAkB,EAAE,OAAO,QAAQ,CAAC;AAC7C;","names":["issueChallenge"]}
+{"version":3,"sources":["../../src/with-party/broker/active.ts","../../src/with-party/broker/index.ts"],"sourcesContent":["/**\n * Enable the credential-broker capability (#479, spec §5).\n *\n * Pass to `createNoydb({ brokerStrategy: withBroker(config) })` to make\n * `vault.broker()` live. Each method dynamic-imports the seed lifecycle\n * engine (`./seed.js`) — mirroring `via/classified/active.ts`'s per-method\n * dynamic-import seam — so `with-party/broker/seed.ts` (the heavy module:\n * the CAS enrol, quiesce-then-swap rotate, and the challenge/response round\n * trip) is reachable only through the `@noy-db/hub/broker` subpath and\n * never enters the single-user floor bundle.\n *\n * The single-flight, per-vault-per-profile refresh cache (H-6/I6) lives\n * HERE, in this factory's closure — shared across every `credentialSource(profile)`\n * call for this one broker instance (in turn shared across every vault of a\n * `createNoydb()` instance — `vault.broker()` passes the SAME `BrokerStrategy`\n * for all of them), so `rotate()` can quiesce it (await any in-flight\n * round-trip, then drop it) before the seed swap. The cache key is\n * `${vault}\\0${profile}` — keyed by vault FIRST, or two vaults sharing this\n * one strategy would collide and hand vault-B a cached credential minted\n * (and STS-scoped) for vault-A.\n */\nimport type { BrokerStrategy, BrokerConfig, BrokerCtx } from '../../port/with/broker-strategy.js'\nimport type { StoreCredentials, StoreCredentialSource } from '../../kernel/types.js'\n\nconst DEFAULT_SKEW_MS = 60_000\n/** Floor under the skew-adjusted boundary so a sub-skew credential TTL\n *  doesn't collapse to \"already expired\" and thrash re-proving every call (I6b). */\nconst MIN_CACHE_MS = 1_000\n\ninterface CacheEntry {\n  cached?: { creds: StoreCredentials; validUntil: number } | undefined\n  inFlight?: Promise<StoreCredentials> | undefined\n}\n\nfunction cacheFloor(creds: StoreCredentials, skewMs: number): number {\n  const expiresAtMs = creds.expiresAt ? Date.parse(creds.expiresAt) : Date.now() + skewMs * 2\n  return Math.max(expiresAtMs - skewMs, Date.now() + MIN_CACHE_MS)\n}\n\nexport function withBroker(config: BrokerConfig): BrokerStrategy {\n  const cache = new Map<string, CacheEntry>()\n\n  return {\n    async enroll(ctx) {\n      const { enrollSeed } = await import('./seed.js')\n      return enrollSeed({ ...ctx, config })\n    },\n    async rotate(ctx) {\n      // Quiesce (I5): let any in-flight round-trip finish (it may still be\n      // proving under the pre-rotation seed) before the local record is\n      // overwritten, then drop the cache — scoped to THIS vault's entries\n      // only (`${ctx.vault}\\0`-prefixed keys). A global cache.clear() here\n      // would blow away every OTHER vault's cache on this shared strategy\n      // too — same root cause as the cross-vault read collision this fixes.\n      const vaultPrefix = `${ctx.vault}\\0`\n      const scoped = [...cache.entries()].filter(([key]) => key.startsWith(vaultPrefix))\n      const inFlight = scoped.map(([, e]) => e.inFlight).filter((p): p is Promise<StoreCredentials> => p !== undefined)\n      await Promise.allSettled(inFlight)\n      for (const [key] of scoped) cache.delete(key)\n      const { rotateSeed } = await import('./seed.js')\n      return rotateSeed({ ...ctx, config })\n    },\n    async enrolMember(ctx, member) {\n      const { enrolMemberSeed } = await import('./seed.js')\n      return enrolMemberSeed({ ...ctx, config }, member)\n    },\n    async revokeMember(ctx, userId) {\n      const { revokeMemberSeed } = await import('./seed.js')\n      return revokeMemberSeed({ ...ctx, config }, userId)\n    },\n    credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource {\n      const key = `${ctx.vault}\\0${profile ?? ''}`\n      return async () => {\n        let entry = cache.get(key)\n        if (!entry) {\n          entry = {}\n          cache.set(key, entry)\n        }\n        const now = Date.now()\n        if (entry.cached && now < entry.cached.validUntil) return entry.cached.creds\n        if (entry.inFlight) return entry.inFlight\n\n        const skewMs = config.skewMs ?? DEFAULT_SKEW_MS\n        const capturedEntry = entry\n        const inFlight = (async () => {\n          const { mintStoreCredentials } = await import('./seed.js')\n          const creds = await mintStoreCredentials({ ...ctx, config }, profile)\n          capturedEntry.cached = { creds, validUntil: cacheFloor(creds, skewMs) }\n          return creds\n        })()\n        entry.inFlight = inFlight\n        try {\n          return await inFlight\n        } finally {\n          // Clear-on-settle (I6a): a rejected in-flight promise must never\n          // stay pinned in the cache, or every subsequent call would wedge\n          // on the same rejection instead of retrying.\n          capturedEntry.inFlight = undefined\n        }\n      }\n    },\n  }\n}\n","/**\n * `@noy-db/hub/broker` — subpath export for the credential-broker capability\n * (#479, credential-broker spec). Apps that never call `vault.broker()` can\n * exclude this subpath entirely: the floor default `NO_BROKER` throws, and\n * this module's real engine (`with-party/broker/{seed,active}.ts`) is only\n * ever reached through `withBroker()`'s dynamic imports, so it never enters\n * a floor bundle.\n *\n * Also re-exports the host-side helpers (`issueChallenge`, `verifyBrokerProof`)\n * from the enclave barrel, so a Lambda/Worker implementing the reference\n * broker host can import just this one subpath and get everything it\n * needs, `crypto.subtle`-only.\n */\n\n// ─── Capability opt-in seam ──────────────────────────────────\nexport { withBroker } from './active.js'\nexport {\n  NO_BROKER,\n  type BrokerStrategy,\n  type BrokerCtx,\n  type BrokerConfig,\n  type CredentialBrokerHandle,\n} from '../../port/with/broker-strategy.js'\nexport { BrokerNotEnabledError, BrokerEnrolmentError, BrokerProofError } from '../../kernel/errors.js'\n\n// ─── Host helpers (verify side — for a reference broker host) ───\nimport { issueChallenge as issueChallengeRaw, verifyBrokerProof } from '../../capsule/index.js'\nimport type { IssuedChallenge, VerifyBrokerProofArgs, BrokerMemberIdentity } from '../../capsule/index.js'\n\n/**\n * Floor — a challenge TTL must survive network latency + clock drift\n * between host and client. The enclave's `issueChallenge` is deliberately\n * unclamped (a mechanical primitive, not a policy); this floor is host\n * POLICY, so it lives here in the party layer, not\n * `capsule/enclave-aes/broker/proof.ts` (carried forward from Task 2's review,\n * I6b).\n */\nconst MIN_CHALLENGE_TTL_MS = 10_000\n/** Ceiling — spec §2 step 2: \"TTL ≤ 60 s\". */\nconst MAX_CHALLENGE_TTL_MS = 60_000\n\n/**\n * {@link issueChallengeRaw} (the enclave's mechanical primitive) with a\n * `[10s, 60s]` TTL clamp applied, so a reference host built on this barrel\n * gets a safe challenge TTL without having to know the bounds itself.\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const requested = opts?.ttlMs ?? MAX_CHALLENGE_TTL_MS\n  const clamped = Math.min(Math.max(requested, MIN_CHALLENGE_TTL_MS), MAX_CHALLENGE_TTL_MS)\n  return issueChallengeRaw({ ttlMs: clamped })\n}\nexport { verifyBrokerProof }\nexport type { VerifyBrokerProofArgs, BrokerMemberIdentity }\n\n// #837 — issueChallenge's return type must be nameable from this entry.\nexport type { IssuedChallenge } from '../../capsule/index.js'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,kBAAkB;AAGxB,IAAM,eAAe;AAOrB,SAAS,WAAW,OAAyB,QAAwB;AACnE,QAAM,cAAc,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,IAAI,IAAI,SAAS;AAC1F,SAAO,KAAK,IAAI,cAAc,QAAQ,KAAK,IAAI,IAAI,YAAY;AACjE;AAEO,SAAS,WAAW,QAAsC;AAC/D,QAAM,QAAQ,oBAAI,IAAwB;AAE1C,SAAO;AAAA,IACL,MAAM,OAAO,KAAK;AAChB,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,OAAO,KAAK;AAOhB,YAAM,cAAc,GAAG,IAAI,KAAK;AAChC,YAAM,SAAS,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,WAAW,CAAC;AACjF,YAAM,WAAW,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAsC,MAAM,MAAS;AAChH,YAAM,QAAQ,WAAW,QAAQ;AACjC,iBAAW,CAAC,GAAG,KAAK,OAAQ,OAAM,OAAO,GAAG;AAC5C,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,qBAAW;AAC/C,aAAO,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC;AAAA,IACtC;AAAA,IACA,MAAM,YAAY,KAAK,QAAQ;AAC7B,YAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,qBAAW;AACpD,aAAO,gBAAgB,EAAE,GAAG,KAAK,OAAO,GAAG,MAAM;AAAA,IACnD;AAAA,IACA,MAAM,aAAa,KAAK,QAAQ;AAC9B,YAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,qBAAW;AACrD,aAAO,iBAAiB,EAAE,GAAG,KAAK,OAAO,GAAG,MAAM;AAAA,IACpD;AAAA,IACA,iBAAiB,KAAgB,SAAyC;AACxE,YAAM,MAAM,GAAG,IAAI,KAAK,KAAK,WAAW,EAAE;AAC1C,aAAO,YAAY;AACjB,YAAI,QAAQ,MAAM,IAAI,GAAG;AACzB,YAAI,CAAC,OAAO;AACV,kBAAQ,CAAC;AACT,gBAAM,IAAI,KAAK,KAAK;AAAA,QACtB;AACA,cAAM,MAAM,KAAK,IAAI;AACrB,YAAI,MAAM,UAAU,MAAM,MAAM,OAAO,WAAY,QAAO,MAAM,OAAO;AACvE,YAAI,MAAM,SAAU,QAAO,MAAM;AAEjC,cAAM,SAAS,OAAO,UAAU;AAChC,cAAM,gBAAgB;AACtB,cAAM,YAAY,YAAY;AAC5B,gBAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,qBAAW;AACzD,gBAAM,QAAQ,MAAM,qBAAqB,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO;AACpE,wBAAc,SAAS,EAAE,OAAO,YAAY,WAAW,OAAO,MAAM,EAAE;AACtE,iBAAO;AAAA,QACT,GAAG;AACH,cAAM,WAAW;AACjB,YAAI;AACF,iBAAO,MAAM;AAAA,QACf,UAAE;AAIA,wBAAc,WAAW;AAAA,QAC3B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACjEA,IAAM,uBAAuB;AAE7B,IAAM,uBAAuB;AAOtB,SAASA,gBAAe,MAA4C;AACzE,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,UAAU,KAAK,IAAI,KAAK,IAAI,WAAW,oBAAoB,GAAG,oBAAoB;AACxF,SAAO,eAAkB,EAAE,OAAO,QAAQ,CAAC;AAC7C;","names":["issueChallenge"]}

package/dist/by/index.js

@@ -1,8 +1,8 @@
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-3JWHAR6E.js";
-import "../chunk-244VXYPG.js";
+} from "../chunk-UNSQZSZP.js";
+import "../chunk-VSUQI5Q6.js";
 export {
   isQuorum,
   runDrainBarrier

package/dist/capsule/contract.d.ts

@@ -0,0 +1,159 @@
+/**
+ * The capsule seam (capsule seam spec, Section 2).
+ *
+ * A capsule is hub's crypto interior behind one contract. `enclave-aes` is the
+ * default and ships INSIDE hub, so `npm install @noy-db/hub` alone is a working
+ * noy-db. An alternative binds at BUILD TIME through hub's `imports` map —
+ * deliberately not at runtime: a `createNoydb({ capsule })` option would be a
+ * hot-swap surface, and a build condition lives in build config where the
+ * shipped bundle stays auditable (`npm ls` tells an auditor whether a build is
+ * plaintext-at-rest).
+ *
+ * ⛔ `CapsuleKey` is OPAQUE outside `capsule/`. Never construct, inspect or
+ * serialise one; only pass it between contract functions. A fork may define it
+ * as something that is not a `CryptoKey` at all — hardware-backed,
+ * post-quantum, or null for a capsule that does no encryption.
+ */
+import { NoydbError } from '../kernel/errors.js';
+import type { VdigFieldPolicy } from '../kernel/types.js';
+/** Opaque key at the capsule seam. `CryptoKey` in the reference capsule. */
+export type CapsuleKey = CryptoKey;
+/** Opaque asymmetric pair at the capsule seam. */
+export type CapsuleKeyPair = CryptoKeyPair;
+/**
+ * The groups a capsule may support. A capsule declares its set via
+ * `capabilities()`; a service needing a group asserts at `createNoydb()`.
+ *
+ * `authenticate` and `seal` are what an `enclave-*` MUST support and an
+ * `exclave-*` MUST refuse. That prefix rule is asserted by the conformance
+ * suite from the package name, which is what makes the prefix a trust posture
+ * rather than a naming convention.
+ */
+export type CapsuleGroup = 'authenticate' | 'seal' | 'cipher' | 'digest' | 'sign' | 'codec' | 'sealing' | 'deterministic' | 'classify' | 'per-record-keys';
+/**
+ * Thrown at `createNoydb()` when a service needs a group the bound capsule
+ * does not support.
+ *
+ * ⚠️ Never thrown on first write, and never discovered by try/catch probing: a
+ * consumer learns at startup or not at all. A capability discovered mid-write
+ * is a half-built vault.
+ */
+/**
+ * Refuse at CONSTRUCTION when a service needs a capsule group the bound
+ * capsule lacks.
+ *
+ * ⛔ At startup or not at all. A capability discovered on first write is a
+ * half-built vault: some records sealed, a service silently inert, and a
+ * consumer who cannot tell a missing capability from a bug. `capabilities()`
+ * is a set, so this is a membership test — never a try/catch probe against the
+ * primitive itself, which would make "unsupported" and "broken" the same
+ * observation.
+ *
+ * Lives on the CONTRACT, not in the kernel: it depends on nothing but the
+ * declared set, and every capsule's consumers need the same assertion.
+ *
+ * ⚠️ Per-service wiring is deliberately NOT done yet. `enclave-aes` supports
+ * every group, so every call site would be unreachable code behind an
+ * untestable branch. It lands in Stage C with `exclave-plain`, which is the
+ * first capsule that refuses anything. Until then this is exercised against a
+ * stub set — see `__tests__/capsule-capabilities.test.ts`.
+ */
+export declare function assertCapsuleSupports(caps: ReadonlySet<CapsuleGroup>, group: CapsuleGroup, requirer: string): void;
+export declare class CapsuleNotSupportedError extends NoydbError {
+    readonly group: CapsuleGroup;
+    readonly requirer: string;
+    constructor(group: CapsuleGroup, requirer: string);
+}
+/**
+ * The 13 cipher primitives the shared plumbing needs — the ENTIRE surface a
+ * capsule must actually implement.
+ *
+ * ⭐ This is the measurement that shaped Stage C. `enclave-aes` is ~4,200
+ * lines, but only ~1,200 of them touch `crypto.subtle`; the other ~3,000 are
+ * envelope assembly, record-identity AAD, tombstones and the record codec —
+ * plumbing that is IDENTICAL for every capsule because it encodes hub's
+ * envelope format, not anyone's cipher. `makeCapsule()` binds that plumbing to
+ * these primitives, so a second capsule writes ~400 lines instead of ~3,400
+ * and the format lives in exactly one place.
+ *
+ * The alternative — copying the plumbing into each capsule — was rejected for
+ * a specific reason: nothing would fail when the two copies drifted. A change
+ * to the tombstone shape or the AAD would have to be made twice, and the
+ * second miss surfaces as an envelope that one capsule writes and the other
+ * cannot read.
+ *
+ * ⚠️ Declared with PROPERTY syntax (`encrypt: (…) => …`), never method
+ * shorthand. Two reasons, both measured. TypeScript checks method shorthand
+ * BIVARIANTLY, so a capsule whose `encrypt` took the wrong number of arguments
+ * would satisfy a shorthand declaration and fail only at a call site — the
+ * exact hole #16 fell through. And `@typescript-eslint/unbound-method` refuses
+ * to let a shorthand method be destructured off the object, which is precisely
+ * how the plumbing consumes these.
+ *
+ * ⚠️ Every primitive here is `async` except `bufferToBase64`, including ones a
+ * plaintext capsule answers instantly. That is deliberate: a capsule that
+ * needs real asynchrony (hardware-backed keys, a remote KMS) must be
+ * expressible without changing this type, and a synchronous implementation
+ * loses nothing by returning a resolved promise.
+ */
+export interface CapsulePrimitives<K = CapsuleKey> {
+    encrypt: (plaintext: string, key: K, aad?: Uint8Array) => Promise<{
+        iv: string;
+        data: string;
+    }>;
+    decrypt: (iv: string, data: string, key: K, aad?: Uint8Array) => Promise<string>;
+    encryptBytesWithAAD: (bytes: Uint8Array, key: K, aad: Uint8Array) => Promise<{
+        iv: string;
+        data: string;
+    }>;
+    decryptBytesWithAAD: (iv: string, data: string, key: K, aad: Uint8Array) => Promise<Uint8Array>;
+    /** Same plaintext + key + context ⇒ same ciphertext. Refused by a capsule without the group. */
+    encryptDeterministic: (plaintext: string, key: K, context: string) => Promise<{
+        iv: string;
+        data: string;
+    }>;
+    /** ⚠️ ONE argument. The AES capsule derives the CONTEXT into the IV, not the key
+     *  (`encryptDeterministic` calls `deriveDeterministicIV(dek, context, plaintext)`),
+     *  so a `(dek, context)` signature here would have been a plausible-looking lie
+     *  that only the call sites caught. */
+    deriveDeterministicKey: (dek: K) => Promise<K>;
+    deriveSealedFieldKey: (dek: K, collectionName: string, field: string) => Promise<K>;
+    deriveSealedFieldKeyFromCek: (cek: K, collectionName: string, field: string) => Promise<K>;
+    generateDEK: () => Promise<K>;
+    wrapCek: (cek: K, dek: K) => Promise<string>;
+    unwrapCek: (wrapped: string, dek: K) => Promise<K>;
+    /** Accepts `ArrayBuffer` too — the AES capsule's callers pass raw `subtle` output. */
+    bufferToBase64: (buffer: ArrayBuffer | Uint8Array) => string;
+    mintVdigSlot: (value: string, policy: VdigFieldPolicy, prevBlob: string | undefined, cek: K, collection: string, id: string, field: string) => Promise<string>;
+    mintBidxTag: (normalized: string, dek: K, collection: string, field: string) => Promise<string>;
+    /** The vdig payload is sealed under a capsule-derived slot key, so open/seal
+     *  are the capsule's, not the plumbing's. `rotateRecordCek` needs both to
+     *  carry a classified slot across a key rotation. */
+    openVdigPayload: (blob: string, cek: K, collection: string, id: string, field: string) => Promise<VdigPayload>;
+    sealVdigPayload: (payload: VdigPayload, cek: K, collection: string, id: string, field: string) => Promise<string>;
+}
+/** The classified verify-digest payload, at the seam because both the capsule
+ *  and the plumbing name it. Structural, not the capsule's own type. */
+export interface VdigDigestEntry {
+    readonly salt: string;
+    readonly hash: string;
+}
+export interface VdigPayload {
+    readonly v: 1;
+    readonly alg: 'PBKDF2-SHA256';
+    readonly iter: number;
+    readonly cur: VdigDigestEntry & {
+        readonly at: string;
+    };
+    readonly ring?: readonly VdigDigestEntry[];
+}
+export { makeCapsule } from './plumbing/index.js';
+export type { Capsule, RecordCodec } from './plumbing/index.js';
+export { sha256Hex, sha256Bytes, hmacSha256Hex, hmacSignHex, hkdfAesGcmKey, deriveBlobAddressKey, derivePresenceKey, derivePresenceTagKey, generateIV, generateSalt, generateRecoverySecret, bufferToBase64, base64ToBuffer, encodeEchoParts, KEY_BITS, } from './plumbing/digest.js';
+export type { EchoSecretParts } from './plumbing/digest.js';
+export { buildRecordAad, recordAadFor, buildRecordEnvelope, buildTombstone, isTombstone, isTombstoneShape, buildDeleteMarker, isDeleteMarker, requireSealedBody, sealedBodyArgs, envelopeBodySize, hasPerRecordKey, envelopeBodyForHash, hasSealedBody, normalizeForVerify, parseSealedSlot, } from './plumbing/index.js';
+export type { RecordIdentity, RecordRef } from './plumbing/index.js';
+export { buildSealedRecordEnvelope } from './plumbing/record-envelope.js';
+export { generateSigningKeyPair, signBytes, verifyBytes } from './plumbing/sign.js';
+export { ctEqualTags } from './plumbing/ct-equal.js';
+export { evaluateKofN } from './plumbing/kofn.js';

package/dist/capsule/contract.js

@@ -0,0 +1,95 @@
+import {
+  CapsuleNotSupportedError,
+  assertCapsuleSupports
+} from "../chunk-ZBUAX4EF.js";
+import {
+  generateSigningKeyPair,
+  signBytes,
+  verifyBytes
+} from "../chunk-SPPOUJLN.js";
+import {
+  evaluateKofN
+} from "../chunk-NH2UOV3B.js";
+import {
+  buildDeleteMarker,
+  buildRecordAad,
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
+  buildTombstone,
+  ctEqualTags,
+  envelopeBodyForHash,
+  envelopeBodySize,
+  hasPerRecordKey,
+  hasSealedBody,
+  isDeleteMarker,
+  isTombstone,
+  isTombstoneShape,
+  makeCapsule,
+  parseSealedSlot,
+  recordAadFor,
+  requireSealedBody,
+  sealedBodyArgs
+} from "../chunk-OM3SEDI4.js";
+import {
+  KEY_BITS,
+  base64ToBuffer,
+  bufferToBase64,
+  deriveBlobAddressKey,
+  derivePresenceKey,
+  derivePresenceTagKey,
+  encodeEchoParts,
+  generateIV,
+  generateRecoverySecret,
+  generateSalt,
+  hkdfAesGcmKey,
+  hmacSha256Hex,
+  hmacSignHex,
+  normalizeForVerify,
+  sha256Bytes,
+  sha256Hex
+} from "../chunk-PUBI455O.js";
+import "../chunk-2ELOCEXE.js";
+import "../chunk-VSUQI5Q6.js";
+export {
+  CapsuleNotSupportedError,
+  KEY_BITS,
+  assertCapsuleSupports,
+  base64ToBuffer,
+  bufferToBase64,
+  buildDeleteMarker,
+  buildRecordAad,
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope,
+  buildTombstone,
+  ctEqualTags,
+  deriveBlobAddressKey,
+  derivePresenceKey,
+  derivePresenceTagKey,
+  encodeEchoParts,
+  envelopeBodyForHash,
+  envelopeBodySize,
+  evaluateKofN,
+  generateIV,
+  generateRecoverySecret,
+  generateSalt,
+  generateSigningKeyPair,
+  hasPerRecordKey,
+  hasSealedBody,
+  hkdfAesGcmKey,
+  hmacSha256Hex,
+  hmacSignHex,
+  isDeleteMarker,
+  isTombstone,
+  isTombstoneShape,
+  makeCapsule,
+  normalizeForVerify,
+  parseSealedSlot,
+  recordAadFor,
+  requireSealedBody,
+  sealedBodyArgs,
+  sha256Bytes,
+  sha256Hex,
+  signBytes,
+  verifyBytes
+};
+//# sourceMappingURL=contract.js.map

package/dist/capsule/enclave-aes/bound.d.ts

@@ -0,0 +1,52 @@
+export declare const aesCapsule: {
+    findByDet: <T>(ctx: import("./index.js").DeterministicContext<T>, field: string, value: unknown) => Promise<T | null>;
+    queryByDet: <T>(ctx: import("./index.js").DeterministicContext<T>, field: string, value: unknown) => Promise<T[]>;
+    SEALED_CEK_NS: string;
+    sealRecordToHost: (ctx: import("./index.js").SealingContext, collection: string, id: string, hostSealer: import("../../index.js").RecipientSealer, opts: {
+        expiresAt: string;
+    }) => Promise<{
+        pid: string;
+        envelopeKey: string;
+    }>;
+    revokeSealedRecord: (ctx: import("./index.js").SealingContext, collection: string, id: string, pid: string, opts?: {
+        hard?: boolean;
+    }) => Promise<void>;
+    rotateRecordCek: (ctx: import("./index.js").SealingContext, collection: string, id: string) => Promise<void>;
+    rekeyBlobSet: (adapter: import("../../index.js").NoydbStore, vault: string, oldDek: import("../contract.js").CapsuleKey, newDek: import("../contract.js").CapsuleKey, otherDeks?: readonly import("../contract.js").CapsuleKey[]) => Promise<import("../plumbing/rekey-blob.js").BlobRekeyReport>;
+    rekeyEnvelopeToDek: (ref: {
+        readonly collection: string;
+        readonly id: string;
+    }, envelope: import("../../index.js").EncryptedEnvelope, oldDek: import("../contract.js").CapsuleKey, newDek: import("../contract.js").CapsuleKey) => Promise<import("../../index.js").EncryptedEnvelope>;
+    rekeyEnvelopeIfNeeded: (ref: {
+        readonly collection: string;
+        readonly id: string;
+    }, envelope: import("../../index.js").EncryptedEnvelope, oldDek: import("../contract.js").CapsuleKey, newDek: import("../contract.js").CapsuleKey) => Promise<import("../../index.js").EncryptedEnvelope | null>;
+    envelopeOpensUnderAny: (ref: {
+        readonly collection: string;
+        readonly id: string;
+    }, envelope: import("../../index.js").EncryptedEnvelope, keys: readonly import("../contract.js").CapsuleKey[]) => Promise<boolean>;
+    resolveStableCek: (deps: import("../plumbing/lifecycle.js").StableCekDeps, id: string) => Promise<import("../contract.js").CapsuleKey>;
+    rewrapBodyToDek: (from: import("./index.js").RecordIdentity, to: import("./index.js").RecordIdentity, envelope: Pick<import("../../index.js").EncryptedEnvelope, "_iv" | "_data" | "_cek" | "_tier" | "_by">, fromDek: import("../contract.js").CapsuleKey, toDek: import("../contract.js").CapsuleKey) => Promise<import("./index.js").RewrappedBody>;
+    applyRewrappedBody: (envelope: import("../../index.js").EncryptedEnvelope, body: import("./index.js").RewrappedBody) => import("../../index.js").EncryptedEnvelope;
+    rewrapEnvelope: (identity: import("./index.js").RecordIdentity, envelope: import("../../index.js").EncryptedEnvelope, fromDek: import("../contract.js").CapsuleKey, toDek: import("../contract.js").CapsuleKey) => Promise<import("../../index.js").EncryptedEnvelope>;
+    isRewrappedUnder: (identity: import("./index.js").RecordIdentity, envelope: Pick<import("../../index.js").EncryptedEnvelope, "_iv" | "_data" | "_cek">, dek: import("../contract.js").CapsuleKey) => Promise<boolean>;
+    RecordCodec: import("../plumbing/record-codec.js").BoundRecordCodec;
+    sealFields: (record: Record<string, unknown>, sensitiveFields: ReadonlySet<string>, keyMaterial: import("../plumbing/sealed-slots.js").SealKeyMaterial) => Promise<import("../plumbing/sealed-slots.js").SealFieldsResult>;
+    unsealOneField: (field: string, blob: string, keyMaterial: import("../plumbing/sealed-slots.js").SealKeyMaterial) => Promise<unknown>;
+    makeHandleProducer: (keyMaterial: import("../plumbing/sealed-slots.js").SealKeyMaterial) => (field: string, blob: string) => import("../../index.js").SealedHandle<unknown>;
+    unsealFields: (record: Record<string, unknown>, sealed: Record<string, string>, keyMaterial: import("../plumbing/sealed-slots.js").SealKeyMaterial, opts?: {
+        asHandles?: boolean;
+    }) => Promise<Record<string, unknown>>;
+    makeSealedSlotCapability: (ctx: import("../plumbing/sealed-slots.js").SealedSlotCapabilityCtx, recordId: string, cek?: import("../contract.js").CapsuleKey) => import("../../kernel/via/index.js").ViaCryptoCtx["sealedSlots"];
+    makeReservedEnvelopes: (dekResolver: import("../plumbing/sealed-slots.js").ReservedEnvelopeDekResolver, declaredPrefixes: readonly string[]) => import("../../kernel/via/index.js").ViaCryptoCtx["reservedEnvelopes"];
+    dualReadSealedSlot: (blob: string, field: string, collection: string, cek: CryptoKey | undefined, dek: CryptoKey) => Promise<string>;
+    openEnvelopeJson: (ref: import("./index.js").RecordRef, env: import("../../index.js").EncryptedEnvelope, key: import("../contract.js").CapsuleKey, opts?: {
+        encrypted?: boolean;
+    }) => Promise<string>;
+    writeEnvelopeBody: (identity: import("./index.js").RecordIdentity, json: string, key: import("../contract.js").CapsuleKey, opts?: {
+        encrypted?: boolean;
+        perRecordKey?: boolean;
+    }) => Promise<Pick<import("../../index.js").EncryptedEnvelope, "_iv" | "_data" | "_cek">>;
+    verifyRecordIdentity: (ref: import("./index.js").RecordRef, env: import("../../index.js").EncryptedEnvelope, key: import("../contract.js").CapsuleKey) => Promise<boolean>;
+};
+export declare const dualReadSealedSlot: (blob: string, field: string, collection: string, cek: CryptoKey | undefined, dek: CryptoKey) => Promise<string>;

package/dist/{kernel/enclave → capsule/enclave-aes}/broker/proof.d.ts

@@ -69,11 +69,18 @@
 import type { EnclaveKey } from '../crypto.js';
 /** HKDF salt domain for the broker proof key — also the first `info` array element. */
 export declare const BROKER_PROOF_DOMAIN = "noydb-broker-proof";
-/** MAC version tag — the first element of the `canonical` array signed/verified. */
+/** MAC version tag — the first element of the `canonical` array signed/verified (admin shared seed). */
 export declare const BROKER_PROOF_VERSION = "noydb-broker-proof-v1";
+/** The member identity bound into a v2 canonical and into the HKDF info (core#73). */
+export interface BrokerMemberIdentity {
+    readonly userId: string;
+    readonly role: string;
+}
 /** The canonical-binding fields a client supplies alongside `vaultId`/`brokerId` (spec §2 step 3). */
 export interface BrokerProofCanonicalParts {
     readonly endpointOrigin: string;
+    /** Present ⇒ a member proof (canonical v2, member-scoped HKDF); absent ⇒ the admin shared seed (v1). */
+    readonly member?: BrokerMemberIdentity | undefined;
     readonly profile?: string | undefined;
     readonly instancePid?: string | undefined;
     readonly challenge: string;
@@ -97,6 +104,8 @@ export interface VerifyBrokerProofArgs {
     readonly vaultId: string;
     readonly endpointOrigin: string;
     readonly brokerId: string;
+    /** The member the `registeredProofKey` was registered FOR; the host supplies its own record, never the client's claim. */
+    readonly member?: BrokerMemberIdentity | undefined;
     readonly profile?: string | undefined;
     readonly instancePid?: string | undefined;
     readonly challenge: string;
@@ -110,14 +119,14 @@ export interface VerifyBrokerProofArgs {
  * value registered with the broker host once at enrol (spec §2 step 2/3).
  * Does not mutate or zero `seed`; the caller owns the seed's lifecycle.
  */
-export declare function deriveBrokerProofBits(seed: Uint8Array, vaultId: string, brokerId: string): Promise<Uint8Array>;
+export declare function deriveBrokerProofBits(seed: Uint8Array, vaultId: string, brokerId: string, memberUserId?: string): Promise<Uint8Array>;
 /**
  * Derive the steady-state, non-extractable `['sign']` HMAC proof key from
  * the `_broker` seed. Zeroes the transient HKDF-output bytes in a `finally`
  * once the key has been imported (F5) — the raw bits never leave this
  * function in usable form after import.
  */
-export declare function deriveBrokerProofKey(seed: Uint8Array, vaultId: string, brokerId: string): Promise<EnclaveKey>;
+export declare function deriveBrokerProofKey(seed: Uint8Array, vaultId: string, brokerId: string, memberUserId?: string): Promise<EnclaveKey>;
 /**
  * Compose derive + sign for the client: re-derive the proof key from the
  * seed and sign the canonical over `canonicalParts` (spec §2 step 3).

package/dist/capsule/enclave-aes/capabilities.d.ts

@@ -0,0 +1,2 @@
+import type { CapsuleGroup } from '../contract.js';
+export declare function capabilities(): ReadonlySet<CapsuleGroup>;

package/dist/capsule/enclave-aes/classify/compare.d.ts

@@ -0,0 +1,20 @@
+/**
+ * C2 — fixed-length-tag constant-time comparison (hub-portable; no
+ * Node timingSafeEqual). Two mandatory rules (spec §3):
+ *  1. Only fixed 32-byte tags are ever compared — ctEqualTags throws on
+ *     anything else (tag length is structural, never secret-dependent).
+ *  2. Every comparand is reduced to a 32-byte tag under a FRESH ephemeral
+ *     HMAC-SHA256 key before comparison — keyed blinding makes compare
+ *     timing uncorrelated with underlying values; rule 1 (not blinding)
+ *     is what removes input-length timing. Length inequality folds into
+ *     unequal tags — never an early return.
+ * @module
+ */
+/**
+ * Blinded equality of arbitrary-length byte strings: fresh K_e per
+ * comparison (never stored, never reused), HMAC both sides to 32-byte
+ * tags, then ctEqualTags. On the digest path the inputs are already
+ * 32-byte PBKDF2 outputs but still route through this reduction so
+ * there is exactly ONE comparison construction (spec §3 rule 2).
+ */
+export declare function blindedEqual(a: Uint8Array, b: Uint8Array): Promise<boolean>;