@noy-db/hub 0.8.0-pre.0 → 0.9.0-pre.0

package/dist/{chunk-YNIUIERI.js → chunk-JPSL5GIZ.js}

@@ -3,48 +3,37 @@ import {
 } from "./chunk-4AOERLTV.js";
 import {
   base64ToBuffer,
-  bufferToBase64
-} from "./chunk-UYB234ZR.js";
+  bufferToBase64,
+  decryptBytes,
+  encryptBytes,
+  exportDekSet,
+  generateEphemeralKey,
+  importDekSet
+} from "./chunk-4J3MNVVX.js";
 import {
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError,
   ValidationError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-party/session/session.ts
-var subtle = globalThis.crypto.subtle;
 var DEFAULT_TTL_MS = 60 * 60 * 1e3;
 var sessionKeyStore = /* @__PURE__ */ new Map();
 async function createSession(keyring, vault, options = {}) {
   const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
   const sessionId = generateULID();
   const expiresAt = new Date(Date.now() + ttlMs).toISOString();
-  const sessionKey = await subtle.generateKey(
-    { name: "AES-GCM", length: 256 },
-    false,
-    // non-extractable — this is the tab-scope security invariant
-    ["encrypt", "decrypt"]
-  );
-  const dekMap = {};
-  for (const [collName, dek] of keyring.deks) {
-    const raw = await subtle.exportKey("raw", dek);
-    dekMap[collName] = bufferToBase64(raw);
-  }
+  const sessionKey = await generateEphemeralKey();
   const payload = JSON.stringify({
     userId: keyring.userId,
     displayName: keyring.displayName,
     role: keyring.role,
     permissions: keyring.permissions,
-    deks: dekMap,
+    deks: await exportDekSet(keyring.deks),
     salt: bufferToBase64(keyring.salt)
   });
-  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
-  const encrypted = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    sessionKey,
-    new TextEncoder().encode(payload)
-  );
+  const { iv, data } = await encryptBytes(new TextEncoder().encode(payload), sessionKey);
   const token = {
     _noydb_session: 1,
     sessionId,
@@ -52,8 +41,8 @@ async function createSession(keyring, vault, options = {}) {
     vault,
     role: keyring.role,
     expiresAt,
-    wrappedKek: bufferToBase64(encrypted),
-    kekIv: bufferToBase64(iv)
+    wrappedKek: data,
+    kekIv: iv
   };
   sessionKeyStore.set(sessionId, sessionKey);
   return { token, sessionId };
@@ -67,30 +56,14 @@ async function resolveSession(token) {
   if (!sessionKey) {
     throw new SessionNotFoundError(token.sessionId);
   }
-  const iv = base64ToBuffer(token.kekIv);
-  const ciphertext = base64ToBuffer(token.wrappedKek);
   let plaintext;
   try {
-    plaintext = await subtle.decrypt(
-      { name: "AES-GCM", iv },
-      sessionKey,
-      ciphertext
-    );
+    plaintext = await decryptBytes(token.kekIv, token.wrappedKek, sessionKey);
   } catch {
     throw new SessionNotFoundError(token.sessionId);
   }
   const payload = JSON.parse(new TextDecoder().decode(plaintext));
-  const deks = /* @__PURE__ */ new Map();
-  for (const [collName, rawBase64] of Object.entries(payload.deks)) {
-    const dek = await subtle.importKey(
-      "raw",
-      base64ToBuffer(rawBase64),
-      { name: "AES-GCM", length: 256 },
-      true,
-      ["encrypt", "decrypt"]
-    );
-    deks.set(collName, dek);
-  }
+  const deks = await importDekSet(payload.deks);
   return {
     userId: payload.userId,
     displayName: payload.displayName,
@@ -279,11 +252,7 @@ async function enableDevUnlock(vault, userId, keyring, options) {
   }
   assertDevEnvironment();
   const storage = resolveStorage(options.persistAcrossTabs);
-  const dekMap = {};
-  for (const [collName, dek] of keyring.deks) {
-    const raw = await globalThis.crypto.subtle.exportKey("raw", dek);
-    dekMap[collName] = bufferToBase64(raw);
-  }
+  const dekMap = await exportDekSet(keyring.deks);
   const payload = JSON.stringify({
     _noydb_dev_unlock: 1,
     userId: keyring.userId,
@@ -316,17 +285,7 @@ async function loadDevUnlock(vault, userId, options = {}) {
     return null;
   }
   if (parsed._noydb_dev_unlock !== 1) return null;
-  const deks = /* @__PURE__ */ new Map();
-  for (const [collName, rawBase64] of Object.entries(parsed.deks)) {
-    const dek = await globalThis.crypto.subtle.importKey(
-      "raw",
-      base64ToBuffer(rawBase64),
-      { name: "AES-GCM", length: 256 },
-      true,
-      ["encrypt", "decrypt"]
-    );
-    deks.set(collName, dek);
-  }
+  const deks = await importDekSet(parsed.deks);
   return {
     userId: parsed.userId,
     displayName: parsed.displayName,
@@ -364,4 +323,4 @@ export {
   clearDevUnlock,
   isDevUnlockActive
 };
-//# sourceMappingURL=chunk-YNIUIERI.js.map
+//# sourceMappingURL=chunk-JPSL5GIZ.js.map

package/dist/chunk-JPSL5GIZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/session/session.ts","../src/with-party/session/session-policy.ts","../src/with-party/session/dev-unlock.ts"],"sourcesContent":["/**\n * Session tokens —\n *\n * After a vault is unlocked (via secret, WebAuthn, OIDC, or magic-\n * link), the caller can call `createSession()` to get a session token that\n * allows re-establishing the KEK for the session lifetime without re-running\n * PBKDF2 or any interactive auth challenge.\n *\n * Security model\n * ──────────────\n * A session consists of two pieces that must both be present to recover the\n * KEK:\n *\n *   1. The **session key** — a non-extractable AES-256-GCM CryptoKey that\n *      exists only in memory. \"Non-extractable\" is enforced by the WebCrypto\n *      API: the key object cannot be serialized, exported, or sent over\n *      postMessage. When the JS context is GC'd (tab close, navigation away,\n *      worker termination) the key becomes unrecoverable.\n *\n *   2. The **session token** — a JSON object that carries the KEK wrapped\n *      with the session key (AES-256-GCM, fresh IV per session), plus\n *      unencrypted session metadata (sessionId, userId, vault, role,\n *      expiresAt). The token can be serialized to JSON and stored in\n *      sessionStorage or passed across callsites within the same tab, but\n *      it is useless without the session key.\n *\n * The session key is kept in a module-level Map indexed by sessionId. Callers\n * that need to re-use a session must hold on to the sessionId returned from\n * `createSession()`; the key is looked up automatically by `resolveSession()`.\n *\n * Revocation: `revokeSession()` removes the entry from the Map. Because the\n * key is non-extractable, removal is sufficient — no one holds a serializable\n * copy of the key.\n *\n * Tab-scoped lifetime: the module-level Map lives only as long as the JS\n * module. Tab close → module unloaded → Map GC'd → all session keys gone.\n * This is the zero-effort logout: closing the tab is always a secure logout.\n *\n * Expiry: `createSession()` accepts a `ttlMs` option. `resolveSession()`\n * checks `expiresAt` and throws `SessionExpiredError` if the token is stale,\n * even if the session key is still in the Map.\n */\n\nimport {\n  bufferToBase64, base64ToBuffer, exportDekSet, importDekSet,\n  generateEphemeralKey, encryptBytes, decryptBytes,\n} from '../../capsule/index.js'\nimport { generateULID } from '../../with-pod/ulid.js'\nimport type { Role } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../team/keyring.js'\nimport { SessionExpiredError, SessionNotFoundError } from '../../kernel/errors.js'\n\n\n// Default session TTL: 60 minutes\nconst DEFAULT_TTL_MS = 60 * 60 * 1000\n\n// Module-level session key store. Tab-scoped by construction.\nconst sessionKeyStore = new Map<string, CryptoKey>()\n\n// ─── Public types ──────────────────────────────────────────────────────\n\n/** The serializable part of a session token. Safe to store in sessionStorage. */\nexport interface SessionToken {\n  readonly _noydb_session: 1\n  /** Unique session identifier (ULID). Use this as the handle for resolve/revoke. */\n  readonly sessionId: string\n  readonly userId: string\n  readonly vault: string\n  readonly role: Role\n  /** ISO timestamp — resolveSession() rejects this token after this time. */\n  readonly expiresAt: string\n  /** KEK wrapped with the session key (AES-256-GCM). Base64. */\n  readonly wrappedKek: string\n  /** IV used for the wrapping operation. Base64. */\n  readonly kekIv: string\n}\n\n/** Result returned from `createSession()`. */\nexport interface CreateSessionResult {\n  /** Serializable token — store in sessionStorage or pass to `resolveSession()`. */\n  token: SessionToken\n  /** The sessionId — use this handle for `resolveSession()` and `revokeSession()`. */\n  sessionId: string\n}\n\n/** Options for `createSession()`. */\nexport interface CreateSessionOptions {\n  /**\n   * Session lifetime in milliseconds. Defaults to 60 minutes.\n   * After this duration, `resolveSession()` throws `SessionExpiredError`.\n   */\n  ttlMs?: number\n}\n\n// ─── Core session operations ───────────────────────────────────────────\n\n/**\n * Create a session for an already-unlocked keyring.\n *\n * Call this after any successful unlock (secret, WebAuthn, OIDC,\n * magic-link). The returned `sessionId` is the handle for later\n * `resolveSession()` and `revokeSession()` calls.\n *\n * The session key is generated fresh (non-extractable) and stored in the\n * module-level Map. The KEK from `keyring.kek` is exported (it must be\n * extractable — it was derived by `deriveKey()` which sets extractable: false,\n * but it's unwrapped from the keyring which sets extractable: true) and then\n * re-wrapped with the session key.\n *\n * @param keyring - An already-unlocked keyring whose `kek` is available.\n * @param vault - The vault name this session is scoped to.\n * @param options - Optional session configuration.\n */\nexport async function createSession(\n  keyring: UnlockedKeyring,\n  vault: string,\n  options: CreateSessionOptions = {},\n): Promise<CreateSessionResult> {\n  const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS\n  const sessionId = generateULID()\n  const expiresAt = new Date(Date.now() + ttlMs).toISOString()\n\n  // Non-extractable — the tab-scope security invariant (see module doc).\n  const sessionKey = await generateEphemeralKey()\n\n  // Sessions do not need the KEK (no re-grant, no re-derive during the\n  // session lifetime). They need the DEK set, which IS extractable.\n  const payload = JSON.stringify({\n    userId: keyring.userId,\n    displayName: keyring.displayName,\n    role: keyring.role,\n    permissions: keyring.permissions,\n    deks: await exportDekSet(keyring.deks),\n    salt: bufferToBase64(keyring.salt),\n  })\n\n  const { iv, data } = await encryptBytes(new TextEncoder().encode(payload), sessionKey)\n\n  const token: SessionToken = {\n    _noydb_session: 1,\n    sessionId,\n    userId: keyring.userId,\n    vault,\n    role: keyring.role,\n    expiresAt,\n    wrappedKek: data,\n    kekIv: iv,\n  }\n\n  sessionKeyStore.set(sessionId, sessionKey)\n  return { token, sessionId }\n}\n\n/**\n * Resolve a session token back into an UnlockedKeyring.\n *\n * Looks up the session key by `sessionId`, checks the token is not expired,\n * then decrypts the payload to reconstruct the keyring's DEK set.\n *\n * Throws `SessionExpiredError` if the token's `expiresAt` is in the past.\n * Throws `SessionNotFoundError` if the session key is not in the store\n * (tab was reloaded, session was revoked, or the sessionId is wrong).\n *\n * @param token - The SessionToken from `createSession()`.\n */\nexport async function resolveSession(token: SessionToken): Promise<UnlockedKeyring> {\n  // Expiry check first — fast path without touching crypto\n  if (Date.now() > new Date(token.expiresAt).getTime()) {\n    sessionKeyStore.delete(token.sessionId)\n    throw new SessionExpiredError(token.sessionId)\n  }\n\n  const sessionKey = sessionKeyStore.get(token.sessionId)\n  if (!sessionKey) {\n    throw new SessionNotFoundError(token.sessionId)\n  }\n\n  let plaintext: Uint8Array\n  try {\n    plaintext = await decryptBytes(token.kekIv, token.wrappedKek, sessionKey)\n  } catch {\n    throw new SessionNotFoundError(token.sessionId)\n  }\n\n  const payload = JSON.parse(new TextDecoder().decode(plaintext)) as {\n    userId: string\n    displayName: string\n    role: Role\n    permissions: Record<string, 'rw' | 'ro'>\n    deks: Record<string, string>\n    salt: string\n  }\n\n  const deks = await importDekSet(payload.deks)\n\n  return {\n    userId: payload.userId,\n    displayName: payload.displayName,\n    role: payload.role,\n    permissions: payload.permissions,\n    deks,\n    kek: null, // KEK not available in session context\n    salt: base64ToBuffer(payload.salt),\n    authenticators: [],\n  }\n}\n\n/**\n * Revoke a session by removing its key from the store.\n *\n * After revocation, `resolveSession()` will throw `SessionNotFoundError`\n * for this sessionId. The session token (if held by the caller) becomes\n * permanently useless. This is the explicit logout path.\n *\n * No-op if the session was already expired or does not exist.\n */\nexport function revokeSession(sessionId: string): void {\n  sessionKeyStore.delete(sessionId)\n}\n\n/**\n * Check if a session is still alive (key in store + not expired).\n * Does not decrypt anything — purely a metadata check.\n */\nexport function isSessionAlive(token: SessionToken): boolean {\n  if (Date.now() > new Date(token.expiresAt).getTime()) return false\n  return sessionKeyStore.has(token.sessionId)\n}\n\n/**\n * Revoke all active sessions. Used by `Noydb.close()` to ensure that\n * closing the instance destroys all session state, not just the keyring\n * cache.\n */\nexport function revokeAllSessions(): void {\n  sessionKeyStore.clear()\n}\n\n/**\n * Return the number of active sessions currently in the store.\n * Useful for diagnostics and tests.\n */\nexport function activeSessionCount(): number {\n  return sessionKeyStore.size\n}\n","/**\n * Session policies —\n *\n * A `SessionPolicy` is a small declarative object that controls how long a\n * session lives and which operations require re-authentication. It is\n * evaluated by the `PolicyEnforcer` class, which the Noydb instance\n * integrates to replace the bare `sessionTimeout` timer from.\n *\n * Design decisions\n * ────────────────\n * Policies are stateless value objects — no timers, no event listeners.\n * The Noydb instance is the stateful coordinator: it holds the enforcer,\n * calls `enforcer.touch()` on every operation, and calls\n * `enforcer.checkOperation()` before high-risk operations.\n *\n * This keeps the policy module easy to unit-test (no global timers to mock)\n * and avoids the \"who owns cleanup\" problem that comes with timer-based\n * callbacks embedded in a value object.\n *\n * `lockOnBackground` registers a `visibilitychange` listener on the document\n * at enforcer creation time and removes it on `destroy()`. It is a no-op in\n * non-browser environments (no `document`).\n */\n\nimport type { SessionPolicy, ReAuthOperation } from '../../kernel/types.js'\nimport { SessionExpiredError, SessionPolicyError } from '../../kernel/errors.js'\nimport { revokeSession } from './session.js'\n\n// ─── PolicyEnforcer ────────────────────────────────────────────────────\n\nexport interface PolicyEnforcerOptions {\n  /** The policy to enforce. */\n  policy: SessionPolicy\n  /** The session ID to revoke when idle/absolute timeouts fire. */\n  sessionId: string\n  /**\n   * Called when the policy decides the session should end (idle timeout,\n   * absolute timeout, or lockOnBackground). Use this to trigger the\n   * same cleanup that `Noydb.close()` would perform.\n   */\n  onRevoke: (reason: 'idle' | 'absolute' | 'background') => void\n}\n\n/**\n * Stateful enforcer for a single session policy.\n *\n * Create one per open session, call `touch()` on every operation,\n * call `checkOperation(op)` before export/grant/revoke/rotate/changeSecret,\n * and call `destroy()` when the session ends.\n */\nexport class PolicyEnforcer {\n  private readonly policy: SessionPolicy\n  private readonly sessionId: string\n  private readonly onRevoke: PolicyEnforcerOptions['onRevoke']\n  private readonly createdAt: number\n  private lastActivityAt: number\n  private idleTimer: ReturnType<typeof setTimeout> | null = null\n  private absoluteTimer: ReturnType<typeof setTimeout> | null = null\n  private visibilityHandler: (() => void) | null = null\n\n  constructor(opts: PolicyEnforcerOptions) {\n    this.policy = opts.policy\n    this.sessionId = opts.sessionId\n    this.onRevoke = opts.onRevoke\n    this.createdAt = Date.now()\n    this.lastActivityAt = Date.now()\n\n    this.scheduleIdleTimer()\n    this.scheduleAbsoluteTimer()\n    this.registerBackgroundLock()\n  }\n\n  /**\n   * Record an activity timestamp and reset the idle timer.\n   * Call this at the top of every Noydb public method.\n   */\n  touch(): void {\n    this.lastActivityAt = Date.now()\n    this.scheduleIdleTimer()\n  }\n\n  /**\n   * Check whether the given operation is allowed under the active policy.\n   * Throws `SessionPolicyError` if the operation requires re-authentication.\n   * Throws `SessionExpiredError` if the absolute timeout has been exceeded\n   * (defensive check in case the timer fired before the call arrived).\n   *\n   * This is a synchronous check — callers don't await it.\n   */\n  checkOperation(op: ReAuthOperation): void {\n    // Defensive absolute-timeout check (timer may have fired late)\n    const { absoluteTimeoutMs } = this.policy\n    if (absoluteTimeoutMs !== undefined && Date.now() - this.createdAt >= absoluteTimeoutMs) {\n      this.expire('absolute')\n      throw new SessionExpiredError(this.sessionId)\n    }\n\n    const required = this.policy.requireReAuthFor ?? []\n    if (required.includes(op)) {\n      throw new SessionPolicyError(op)\n    }\n  }\n\n  /**\n   * Tear down timers and background-lock listener. Call from `Noydb.close()`\n   * and whenever the session is revoked externally.\n   */\n  destroy(): void {\n    if (this.idleTimer) {\n      clearTimeout(this.idleTimer)\n      this.idleTimer = null\n    }\n    if (this.absoluteTimer) {\n      clearTimeout(this.absoluteTimer)\n      this.absoluteTimer = null\n    }\n    if (this.visibilityHandler && typeof document !== 'undefined') {\n      document.removeEventListener('visibilitychange', this.visibilityHandler)\n      this.visibilityHandler = null\n    }\n  }\n\n  /** How long since the last activity, in ms. */\n  get idleMs(): number {\n    return Date.now() - this.lastActivityAt\n  }\n\n  /** How long since session creation, in ms. */\n  get ageMs(): number {\n    return Date.now() - this.createdAt\n  }\n\n  // ── Private ──────────────────────────────────────────────────────────\n\n  private scheduleIdleTimer(): void {\n    const { idleTimeoutMs } = this.policy\n    if (!idleTimeoutMs) return\n\n    if (this.idleTimer) clearTimeout(this.idleTimer)\n    this.idleTimer = setTimeout(() => {\n      this.expire('idle')\n    }, idleTimeoutMs)\n  }\n\n  private scheduleAbsoluteTimer(): void {\n    const { absoluteTimeoutMs } = this.policy\n    if (!absoluteTimeoutMs) return\n\n    if (this.absoluteTimer) clearTimeout(this.absoluteTimer)\n    this.absoluteTimer = setTimeout(() => {\n      this.expire('absolute')\n    }, absoluteTimeoutMs)\n  }\n\n  private registerBackgroundLock(): void {\n    if (!this.policy.lockOnBackground) return\n    if (typeof document === 'undefined') return\n\n    this.visibilityHandler = () => {\n      if (document.hidden) {\n        this.expire('background')\n      }\n    }\n    document.addEventListener('visibilitychange', this.visibilityHandler)\n  }\n\n  private expire(reason: 'idle' | 'absolute' | 'background'): void {\n    this.destroy()\n    revokeSession(this.sessionId)\n    this.onRevoke(reason)\n  }\n}\n\n// ─── Helpers ───────────────────────────────────────────────────────────\n\n/**\n * Build a `PolicyEnforcer` from a policy + session token, and return it\n * alongside a cleanup function. Convenience wrapper for Noydb.\n */\nexport function createEnforcer(opts: PolicyEnforcerOptions): PolicyEnforcer {\n  return new PolicyEnforcer(opts)\n}\n\n/**\n * Validate that a `SessionPolicy` is well-formed.\n * Throws a plain `Error` (not `NoydbError`) because this is a developer\n * error — invalid policies passed at construction time, not at runtime.\n */\nexport function validateSessionPolicy(policy: SessionPolicy): void {\n  const { idleTimeoutMs, absoluteTimeoutMs } = policy\n  if (idleTimeoutMs !== undefined && (typeof idleTimeoutMs !== 'number' || idleTimeoutMs <= 0)) {\n    throw new Error(`SessionPolicy.idleTimeoutMs must be a positive number, got ${idleTimeoutMs}`)\n  }\n  if (absoluteTimeoutMs !== undefined && (typeof absoluteTimeoutMs !== 'number' || absoluteTimeoutMs <= 0)) {\n    throw new Error(`SessionPolicy.absoluteTimeoutMs must be a positive number, got ${absoluteTimeoutMs}`)\n  }\n  if (idleTimeoutMs !== undefined && absoluteTimeoutMs !== undefined && idleTimeoutMs >= absoluteTimeoutMs) {\n    throw new Error(\n      `SessionPolicy.idleTimeoutMs (${idleTimeoutMs}ms) must be less than absoluteTimeoutMs (${absoluteTimeoutMs}ms)`,\n    )\n  }\n}\n","/**\n * Dev-mode persistent unlock —\n *\n * Solves the developer inner-loop friction: hot-reload destroys the session\n * (page navigation semantics), forcing a secret re-entry every refresh.\n *\n * This module provides an opt-in, deliberately-named escape hatch that lets\n * developers store the keyring payload in sessionStorage or localStorage so\n * the vault auto-unlocks on every page load — without a secret,\n * without a biometric prompt, without any OIDC flow.\n *\n * ⚠️ WARNING — this is a loaded footgun ⚠️\n * ─────────────────────────────────────────\n * The keyring payload stored by this module contains the DEKs. Whoever has\n * access to sessionStorage/localStorage has access to the DEKs. On a shared\n * development machine, a compromised browser extension, or a mis-configured\n * origin, this is a complete key exposure.\n *\n * This module is ONLY safe for local development. It must NEVER be active\n * in production builds.\n *\n * Guardrails (all enforced by the module, not by the caller)\n * ──────────────────────────────────────────────────────────\n * 1. **Production guard:** `enableDevUnlock()` throws immediately if\n *    `process.env.NODE_ENV === 'production'` or if `import.meta.env?.PROD === true`\n *    (Vite convention). Also throws if the hostname is NOT localhost or 127.0.0.1.\n *\n * 2. **Explicit acknowledgement string:** the caller must pass\n *    `acknowledge: 'I-UNDERSTAND-THIS-DISABLES-UNLOCK-SECURITY'` or the call\n *    throws. This string appears in every grep for `devUnlock` in the codebase,\n *    making it impossible to enable this feature accidentally.\n *\n * 3. **Scope is vault + userId:** the storage key includes both the\n *    vault name and the userId, so dev-unlock for vault-A does\n *    NOT auto-unlock vault-B.\n *\n * 4. **Storage scope:** default is `sessionStorage` (cleared on tab close).\n *    `localStorage` is opt-in and requires an additional\n *    `persistAcrossTabs: true` flag in the options.\n *\n * 5. **Clear method:** `clearDevUnlock()` removes the stored payload. Wire\n *    this to a dev toolbar button or `Ctrl+Shift+L` so clearing is one action.\n *\n * 6. **Console banner:** on first enable, a highly visible console warning\n *    fires. Cannot be suppressed.\n *\n * Usage\n * ─────\n * ```ts\n * // In your dev entry point only (guarded by import.meta.env.DEV):\n * if (import.meta.env.DEV) {\n *   const { enableDevUnlock, loadDevUnlock } = await import('@noy-db/hub')\n *   enableDevUnlock('my-compartment', 'alice', keyring, {\n *     acknowledge: 'I-UNDERSTAND-THIS-DISABLES-UNLOCK-SECURITY',\n *   })\n * }\n *\n * // On page load:\n * if (import.meta.env.DEV) {\n *   const keyring = await loadDevUnlock('my-compartment', 'alice')\n *   if (keyring) {\n *     // Skip unlock prompt, use keyring directly\n *   }\n * }\n * ```\n */\n\nimport { bufferToBase64, base64ToBuffer, exportDekSet, importDekSet } from '../../capsule/index.js'\nimport { ValidationError } from '../../kernel/errors.js'\nimport type { UnlockedKeyring } from '../team/keyring.js'\nimport type { Role } from '../../kernel/types.js'\n\n// The exact acknowledgement string callers must pass\nconst REQUIRED_ACKNOWLEDGE = 'I-UNDERSTAND-THIS-DISABLES-UNLOCK-SECURITY'\n\nconst STORAGE_PREFIX = 'noydb:dev-unlock:'\n\n// ─── Options ──────────────────────────────────────────────────────────\n\nexport interface DevUnlockOptions {\n  /**\n   * Required: the exact string 'I-UNDERSTAND-THIS-DISABLES-UNLOCK-SECURITY'.\n   * Any other value causes `enableDevUnlock()` to throw.\n   */\n  acknowledge: string\n  /**\n   * If `true`, stores in localStorage (persists across tabs and browser restarts).\n   * If `false` (default), stores in sessionStorage (cleared on tab close).\n   */\n  persistAcrossTabs?: boolean\n}\n\n// ─── Production guard ─────────────────────────────────────────────────\n\nfunction assertDevEnvironment(): void {\n  // Node.js: check NODE_ENV\n  if (\n    typeof process !== 'undefined' &&\n    process.env.NODE_ENV === 'production'\n  ) {\n    throw new ValidationError(\n      'devUnlock is not available in production builds. ' +\n      'process.env.NODE_ENV is \"production\".',\n    )\n  }\n\n  // Vite / build tool convention\n  if (\n    typeof globalThis !== 'undefined' &&\n    (globalThis as Record<string, unknown>).__vite_is_production__ === true\n  ) {\n    throw new ValidationError('devUnlock is not available in production builds.')\n  }\n\n  // Browser: only allow on localhost\n  if (\n    typeof window !== 'undefined' &&\n    typeof window.location !== 'undefined'\n  ) {\n    const host = window.location.hostname\n    if (host !== 'localhost' && host !== '127.0.0.1' && host !== '::1' && !host.endsWith('.local')) {\n      throw new ValidationError(\n        `devUnlock is only available on localhost. Current hostname: \"${host}\". ` +\n        'Set NODE_ENV=development and run on localhost to use dev unlock.',\n      )\n    }\n  }\n}\n\n// ─── Storage key ──────────────────────────────────────────────────────\n\nfunction storageKey(vault: string, userId: string): string {\n  return `${STORAGE_PREFIX}${vault}:${userId}`\n}\n\nfunction resolveStorage(persistAcrossTabs?: boolean): Storage {\n  if (typeof window === 'undefined') {\n    throw new ValidationError('devUnlock requires a browser environment (window.sessionStorage / window.localStorage).')\n  }\n  return persistAcrossTabs ? window.localStorage : window.sessionStorage\n}\n\n// ─── Public API ────────────────────────────────────────────────────────\n\n/**\n * Serialize and store a keyring to browser storage for dev-mode auto-unlock.\n *\n * Throws immediately if:\n *   - The acknowledge string is wrong.\n *   - Running in a production environment (NODE_ENV=production).\n *   - Running on a non-localhost hostname.\n *\n * Emits a highly visible console warning that cannot be suppressed.\n *\n * @param vault - The vault name.\n * @param userId - The user ID.\n * @param keyring - The unlocked keyring to persist.\n * @param options - Options including the required acknowledge string.\n */\nexport async function enableDevUnlock(\n  vault: string,\n  userId: string,\n  keyring: UnlockedKeyring,\n  options: DevUnlockOptions,\n): Promise<void> {\n  if (options.acknowledge !== REQUIRED_ACKNOWLEDGE) {\n    throw new ValidationError(\n      `devUnlock requires acknowledge: '${REQUIRED_ACKNOWLEDGE}'. ` +\n      `Got: '${options.acknowledge}'. This is intentional — the full string must appear in your source.`,\n    )\n  }\n\n  assertDevEnvironment()\n\n  const storage = resolveStorage(options.persistAcrossTabs)\n\n  const dekMap = await exportDekSet(keyring.deks)\n\n  const payload = JSON.stringify({\n    _noydb_dev_unlock: 1,\n    userId: keyring.userId,\n    displayName: keyring.displayName,\n    role: keyring.role,\n    permissions: keyring.permissions,\n    deks: dekMap,\n    salt: bufferToBase64(keyring.salt),\n  })\n\n  storage.setItem(storageKey(vault, userId), payload)\n\n  // Visible, unsuppressable warning\n  console.warn(\n    '%c⚠️ NOYDB DEV UNLOCK ACTIVE ⚠️',\n    'color: red; font-size: 16px; font-weight: bold',\n    `\\n\\nVault \"${vault}\" user \"${userId}\" is stored in ` +\n    `${options.persistAcrossTabs ? 'localStorage' : 'sessionStorage'} in PLAINTEXT DEKs.\\n` +\n    'This is ONLY safe for local development. Never use in production.\\n' +\n    'Call clearDevUnlock() to remove.',\n  )\n}\n\n/**\n * Load a dev-mode keyring from browser storage.\n *\n * Returns `null` if no dev-unlock state is stored for this vault + user,\n * or if the stored payload is malformed.\n *\n * Does NOT perform the production environment check — it's safe to CALL\n * `loadDevUnlock` in production (it will simply return `null` because no\n * dev-unlock state was ever written). The guard only fires on `enableDevUnlock`.\n *\n * @param vault - The vault name.\n * @param userId - The user ID.\n * @param options - Optional storage override.\n */\nexport async function loadDevUnlock(\n  vault: string,\n  userId: string,\n  options: { persistAcrossTabs?: boolean } = {},\n): Promise<UnlockedKeyring | null> {\n  if (typeof window === 'undefined') return null\n\n  const storage = resolveStorage(options.persistAcrossTabs)\n  const raw = storage.getItem(storageKey(vault, userId))\n  if (!raw) return null\n\n  let parsed: {\n    _noydb_dev_unlock?: number\n    userId: string\n    displayName: string\n    role: Role\n    permissions: Record<string, 'rw' | 'ro'>\n    deks: Record<string, string>\n    salt: string\n  }\n  try {\n    parsed = JSON.parse(raw)\n  } catch {\n    return null\n  }\n\n  if (parsed._noydb_dev_unlock !== 1) return null\n\n  const deks = await importDekSet(parsed.deks)\n\n  return {\n    userId: parsed.userId,\n    displayName: parsed.displayName,\n    role: parsed.role,\n    permissions: parsed.permissions,\n    deks,\n    kek: null,\n    salt: base64ToBuffer(parsed.salt),\n    authenticators: [],\n  }\n}\n\n/**\n * Remove dev-unlock state from browser storage.\n *\n * Safe to call in production (no-op if no dev state exists).\n */\nexport function clearDevUnlock(\n  vault: string,\n  userId: string,\n  options: { persistAcrossTabs?: boolean } = {},\n): void {\n  if (typeof window === 'undefined') return\n  const storage = resolveStorage(options.persistAcrossTabs)\n  storage.removeItem(storageKey(vault, userId))\n}\n\n/**\n * Check if dev-unlock state exists for this vault + user.\n *\n * Safe to call in production (returns false if nothing is stored).\n */\nexport function isDevUnlockActive(\n  vault: string,\n  userId: string,\n  options: { persistAcrossTabs?: boolean } = {},\n): boolean {\n  if (typeof window === 'undefined') return false\n  const storage = resolveStorage(options.persistAcrossTabs)\n  return storage.getItem(storageKey(vault, userId)) !== null\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAsDA,IAAM,iBAAiB,KAAK,KAAK;AAGjC,IAAM,kBAAkB,oBAAI,IAAuB;AAwDnD,eAAsB,cACpB,SACA,OACA,UAAgC,CAAC,GACH;AAC9B,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,YAAY,aAAa;AAC/B,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,EAAE,YAAY;AAG3D,QAAM,aAAa,MAAM,qBAAqB;AAI9C,QAAM,UAAU,KAAK,UAAU;AAAA,IAC7B,QAAQ,QAAQ;AAAA,IAChB,aAAa,QAAQ;AAAA,IACrB,MAAM,QAAQ;AAAA,IACd,aAAa,QAAQ;AAAA,IACrB,MAAM,MAAM,aAAa,QAAQ,IAAI;AAAA,IACrC,MAAM,eAAe,QAAQ,IAAI;AAAA,EACnC,CAAC;AAED,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,aAAa,IAAI,YAAY,EAAE,OAAO,OAAO,GAAG,UAAU;AAErF,QAAM,QAAsB;AAAA,IAC1B,gBAAgB;AAAA,IAChB;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA,MAAM,QAAQ;AAAA,IACd;AAAA,IACA,YAAY;AAAA,IACZ,OAAO;AAAA,EACT;AAEA,kBAAgB,IAAI,WAAW,UAAU;AACzC,SAAO,EAAE,OAAO,UAAU;AAC5B;AAcA,eAAsB,eAAe,OAA+C;AAElF,MAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,SAAS,EAAE,QAAQ,GAAG;AACpD,oBAAgB,OAAO,MAAM,SAAS;AACtC,UAAM,IAAI,oBAAoB,MAAM,SAAS;AAAA,EAC/C;AAEA,QAAM,aAAa,gBAAgB,IAAI,MAAM,SAAS;AACtD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,qBAAqB,MAAM,SAAS;AAAA,EAChD;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,aAAa,MAAM,OAAO,MAAM,YAAY,UAAU;AAAA,EAC1E,QAAQ;AACN,UAAM,IAAI,qBAAqB,MAAM,SAAS;AAAA,EAChD;AAEA,QAAM,UAAU,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAS9D,QAAM,OAAO,MAAM,aAAa,QAAQ,IAAI;AAE5C,SAAO;AAAA,IACL,QAAQ,QAAQ;AAAA,IAChB,aAAa,QAAQ;AAAA,IACrB,MAAM,QAAQ;AAAA,IACd,aAAa,QAAQ;AAAA,IACrB;AAAA,IACA,KAAK;AAAA;AAAA,IACL,MAAM,eAAe,QAAQ,IAAI;AAAA,IACjC,gBAAgB,CAAC;AAAA,EACnB;AACF;AAWO,SAAS,cAAc,WAAyB;AACrD,kBAAgB,OAAO,SAAS;AAClC;AAMO,SAAS,eAAe,OAA8B;AAC3D,MAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,SAAS,EAAE,QAAQ,EAAG,QAAO;AAC7D,SAAO,gBAAgB,IAAI,MAAM,SAAS;AAC5C;AAOO,SAAS,oBAA0B;AACxC,kBAAgB,MAAM;AACxB;AAMO,SAAS,qBAA6B;AAC3C,SAAO,gBAAgB;AACzB;;;AClMO,IAAM,iBAAN,MAAqB;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EACA,YAAkD;AAAA,EAClD,gBAAsD;AAAA,EACtD,oBAAyC;AAAA,EAEjD,YAAY,MAA6B;AACvC,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AACtB,SAAK,WAAW,KAAK;AACrB,SAAK,YAAY,KAAK,IAAI;AAC1B,SAAK,iBAAiB,KAAK,IAAI;AAE/B,SAAK,kBAAkB;AACvB,SAAK,sBAAsB;AAC3B,SAAK,uBAAuB;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAc;AACZ,SAAK,iBAAiB,KAAK,IAAI;AAC/B,SAAK,kBAAkB;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,eAAe,IAA2B;AAExC,UAAM,EAAE,kBAAkB,IAAI,KAAK;AACnC,QAAI,sBAAsB,UAAa,KAAK,IAAI,IAAI,KAAK,aAAa,mBAAmB;AACvF,WAAK,OAAO,UAAU;AACtB,YAAM,IAAI,oBAAoB,KAAK,SAAS;AAAA,IAC9C;AAEA,UAAM,WAAW,KAAK,OAAO,oBAAoB,CAAC;AAClD,QAAI,SAAS,SAAS,EAAE,GAAG;AACzB,YAAM,IAAI,mBAAmB,EAAE;AAAA,IACjC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,UAAgB;AACd,QAAI,KAAK,WAAW;AAClB,mBAAa,KAAK,SAAS;AAC3B,WAAK,YAAY;AAAA,IACnB;AACA,QAAI,KAAK,eAAe;AACtB,mBAAa,KAAK,aAAa;AAC/B,WAAK,gBAAgB;AAAA,IACvB;AACA,QAAI,KAAK,qBAAqB,OAAO,aAAa,aAAa;AAC7D,eAAS,oBAAoB,oBAAoB,KAAK,iBAAiB;AACvE,WAAK,oBAAoB;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,SAAiB;AACnB,WAAO,KAAK,IAAI,IAAI,KAAK;AAAA,EAC3B;AAAA;AAAA,EAGA,IAAI,QAAgB;AAClB,WAAO,KAAK,IAAI,IAAI,KAAK;AAAA,EAC3B;AAAA;AAAA,EAIQ,oBAA0B;AAChC,UAAM,EAAE,cAAc,IAAI,KAAK;AAC/B,QAAI,CAAC,cAAe;AAEpB,QAAI,KAAK,UAAW,cAAa,KAAK,SAAS;AAC/C,SAAK,YAAY,WAAW,MAAM;AAChC,WAAK,OAAO,MAAM;AAAA,IACpB,GAAG,aAAa;AAAA,EAClB;AAAA,EAEQ,wBAA8B;AACpC,UAAM,EAAE,kBAAkB,IAAI,KAAK;AACnC,QAAI,CAAC,kBAAmB;AAExB,QAAI,KAAK,cAAe,cAAa,KAAK,aAAa;AACvD,SAAK,gBAAgB,WAAW,MAAM;AACpC,WAAK,OAAO,UAAU;AAAA,IACxB,GAAG,iBAAiB;AAAA,EACtB;AAAA,EAEQ,yBAA+B;AACrC,QAAI,CAAC,KAAK,OAAO,iBAAkB;AACnC,QAAI,OAAO,aAAa,YAAa;AAErC,SAAK,oBAAoB,MAAM;AAC7B,UAAI,SAAS,QAAQ;AACnB,aAAK,OAAO,YAAY;AAAA,MAC1B;AAAA,IACF;AACA,aAAS,iBAAiB,oBAAoB,KAAK,iBAAiB;AAAA,EACtE;AAAA,EAEQ,OAAO,QAAkD;AAC/D,SAAK,QAAQ;AACb,kBAAc,KAAK,SAAS;AAC5B,SAAK,SAAS,MAAM;AAAA,EACtB;AACF;AAQO,SAAS,eAAe,MAA6C;AAC1E,SAAO,IAAI,eAAe,IAAI;AAChC;AAOO,SAAS,sBAAsB,QAA6B;AACjE,QAAM,EAAE,eAAe,kBAAkB,IAAI;AAC7C,MAAI,kBAAkB,WAAc,OAAO,kBAAkB,YAAY,iBAAiB,IAAI;AAC5F,UAAM,IAAI,MAAM,8DAA8D,aAAa,EAAE;AAAA,EAC/F;AACA,MAAI,sBAAsB,WAAc,OAAO,sBAAsB,YAAY,qBAAqB,IAAI;AACxG,UAAM,IAAI,MAAM,kEAAkE,iBAAiB,EAAE;AAAA,EACvG;AACA,MAAI,kBAAkB,UAAa,sBAAsB,UAAa,iBAAiB,mBAAmB;AACxG,UAAM,IAAI;AAAA,MACR,gCAAgC,aAAa,4CAA4C,iBAAiB;AAAA,IAC5G;AAAA,EACF;AACF;;;AChIA,IAAM,uBAAuB;AAE7B,IAAM,iBAAiB;AAmBvB,SAAS,uBAA6B;AAEpC,MACE,OAAO,YAAY,eACnB,QAAQ,IAAI,aAAa,cACzB;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAGA,MACE,OAAO,eAAe,eACrB,WAAuC,2BAA2B,MACnE;AACA,UAAM,IAAI,gBAAgB,kDAAkD;AAAA,EAC9E;AAGA,MACE,OAAO,WAAW,eAClB,OAAO,OAAO,aAAa,aAC3B;AACA,UAAM,OAAO,OAAO,SAAS;AAC7B,QAAI,SAAS,eAAe,SAAS,eAAe,SAAS,SAAS,CAAC,KAAK,SAAS,QAAQ,GAAG;AAC9F,YAAM,IAAI;AAAA,QACR,gEAAgE,IAAI;AAAA,MAEtE;AAAA,IACF;AAAA,EACF;AACF;AAIA,SAAS,WAAW,OAAe,QAAwB;AACzD,SAAO,GAAG,cAAc,GAAG,KAAK,IAAI,MAAM;AAC5C;AAEA,SAAS,eAAe,mBAAsC;AAC5D,MAAI,OAAO,WAAW,aAAa;AACjC,UAAM,IAAI,gBAAgB,yFAAyF;AAAA,EACrH;AACA,SAAO,oBAAoB,OAAO,eAAe,OAAO;AAC1D;AAmBA,eAAsB,gBACpB,OACA,QACA,SACA,SACe;AACf,MAAI,QAAQ,gBAAgB,sBAAsB;AAChD,UAAM,IAAI;AAAA,MACR,oCAAoC,oBAAoB,YAC/C,QAAQ,WAAW;AAAA,IAC9B;AAAA,EACF;AAEA,uBAAqB;AAErB,QAAM,UAAU,eAAe,QAAQ,iBAAiB;AAExD,QAAM,SAAS,MAAM,aAAa,QAAQ,IAAI;AAE9C,QAAM,UAAU,KAAK,UAAU;AAAA,IAC7B,mBAAmB;AAAA,IACnB,QAAQ,QAAQ;AAAA,IAChB,aAAa,QAAQ;AAAA,IACrB,MAAM,QAAQ;AAAA,IACd,aAAa,QAAQ;AAAA,IACrB,MAAM;AAAA,IACN,MAAM,eAAe,QAAQ,IAAI;AAAA,EACnC,CAAC;AAED,UAAQ,QAAQ,WAAW,OAAO,MAAM,GAAG,OAAO;AAGlD,UAAQ;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA;AAAA,SAAc,KAAK,WAAW,MAAM,kBACjC,QAAQ,oBAAoB,iBAAiB,gBAAgB;AAAA;AAAA;AAAA,EAGlE;AACF;AAgBA,eAAsB,cACpB,OACA,QACA,UAA2C,CAAC,GACX;AACjC,MAAI,OAAO,WAAW,YAAa,QAAO;AAE1C,QAAM,UAAU,eAAe,QAAQ,iBAAiB;AACxD,QAAM,MAAM,QAAQ,QAAQ,WAAW,OAAO,MAAM,CAAC;AACrD,MAAI,CAAC,IAAK,QAAO;AAEjB,MAAI;AASJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,sBAAsB,EAAG,QAAO;AAE3C,QAAM,OAAO,MAAM,aAAa,OAAO,IAAI;AAE3C,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,aAAa,OAAO;AAAA,IACpB,MAAM,OAAO;AAAA,IACb,aAAa,OAAO;AAAA,IACpB;AAAA,IACA,KAAK;AAAA,IACL,MAAM,eAAe,OAAO,IAAI;AAAA,IAChC,gBAAgB,CAAC;AAAA,EACnB;AACF;AAOO,SAAS,eACd,OACA,QACA,UAA2C,CAAC,GACtC;AACN,MAAI,OAAO,WAAW,YAAa;AACnC,QAAM,UAAU,eAAe,QAAQ,iBAAiB;AACxD,UAAQ,WAAW,WAAW,OAAO,MAAM,CAAC;AAC9C;AAOO,SAAS,kBACd,OACA,QACA,UAA2C,CAAC,GACnC;AACT,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,QAAM,UAAU,eAAe,QAAQ,iBAAiB;AACxD,SAAO,QAAQ,QAAQ,WAAW,OAAO,MAAM,CAAC,MAAM;AACxD;","names":[]}

package/dist/{chunk-TKUOEU2F.js → chunk-JSWKVZCR.js}

@@ -1,6 +1,6 @@
 import {
   linkI18nVia
-} from "./chunk-GHLTDZRS.js";
+} from "./chunk-V55JASXO.js";
 
 // src/via/i18n/dictionary.ts
 function dictKey(name, keysOrMap, opts) {
@@ -71,4 +71,4 @@ export {
   dictKey,
   staticDict
 };
-//# sourceMappingURL=chunk-TKUOEU2F.js.map
+//# sourceMappingURL=chunk-JSWKVZCR.js.map

package/dist/chunk-JZ4EDEIP.js

@@ -0,0 +1,22 @@
+import {
+  CURRENT_COST_BYTE,
+  iterationsForCostByte,
+  mintAt
+} from "./chunk-ABU6A4Z5.js";
+import {
+  normalizeForVerify
+} from "./chunk-PUBI455O.js";
+
+// src/capsule/enclave-aes/classify/find.ts
+async function computeBidxTarget(candidate, normalize, dek, collection, field, costByte) {
+  const resolvedCostByte = costByte ?? CURRENT_COST_BYTE;
+  const iters = iterationsForCostByte(resolvedCostByte);
+  if (iters === null) return null;
+  const normalized = normalizeForVerify(normalize, candidate);
+  return mintAt(normalized, dek, collection, field, resolvedCostByte);
+}
+
+export {
+  computeBidxTarget
+};
+//# sourceMappingURL=chunk-JZ4EDEIP.js.map

package/dist/chunk-JZ4EDEIP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/capsule/enclave-aes/classify/find.ts"],"sourcesContent":["/**\n * Query-side blind-index target derivation for classified `equatable`\n * fields (stage 2). `computeBidxTarget` normalizes a caller-supplied\n * candidate and mints it into the same 33-byte `_bidx` tag shape produced by\n * `mintBidxTag` (`bidx.ts`), so a caller can string-compare the result\n * against a stored tag to answer \"does this candidate match?\" without ever\n * decrypting or dictionary-attacking the field.\n *\n * Discriminator-scan contract (Oracle #4): a scanning caller reads each\n * stored tag's leading cost-byte discriminator and derives the target tag\n * **once per distinct discriminator present** — never per-record. `find.ts`\n * itself only computes a single target for a single requested `costByte`;\n * the batching-by-discriminator behavior belongs to the scanner\n * (`findByDigest`, a later task), which calls this function once per\n * distinct discriminator it encounters at step 2 of its scan.\n *\n * An unrecognized `costByte` (unknown or legacy tier not yet supported) is a\n * cheap `null` non-match — `computeBidxTarget` never runs PBKDF2 at a wrong\n * iteration tier just to produce a target that could not possibly match.\n * A legacy tag of a KNOWN older tier remains matchable today by passing that\n * tier's `costByte` explicitly (v1-only today: `CURRENT_COST_BYTE` is the\n * only recognized tier, so this is a future-proofing hook, not live behavior\n * yet).\n *\n * @module\n */\nimport type { EnclaveKey } from '../crypto.js'\nimport { mintAt, iterationsForCostByte, CURRENT_COST_BYTE } from './bidx.js'\nimport { normalizeForVerify, type VerifyNormalizeMode } from '../../plumbing/normalize.js'\n\n/**\n * Normalize `candidate` and mint it into a blind-index target tag at\n * `costByte` (default {@link CURRENT_COST_BYTE}), for string-comparison\n * against a stored `_bidx` tag. Returns `null` when `costByte` is not a\n * recognized discriminator — no PBKDF2 is attempted at an unknown/wrong\n * tier (Oracle #4).\n */\nexport async function computeBidxTarget(\n  candidate: string,\n  normalize: VerifyNormalizeMode,\n  dek: EnclaveKey,\n  collection: string,\n  field: string,\n  costByte?: number,\n): Promise<string | null> {\n  const resolvedCostByte = costByte ?? CURRENT_COST_BYTE\n  const iters = iterationsForCostByte(resolvedCostByte)\n  if (iters === null) return null\n  const normalized = normalizeForVerify(normalize, candidate)\n  return mintAt(normalized, dek, collection, field, resolvedCostByte)\n}\n"],"mappings":";;;;;;;;;;AAqCA,eAAsB,kBACpB,WACA,WACA,KACA,YACA,OACA,UACwB;AACxB,QAAM,mBAAmB,YAAY;AACrC,QAAM,QAAQ,sBAAsB,gBAAgB;AACpD,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,aAAa,mBAAmB,WAAW,SAAS;AAC1D,SAAO,OAAO,YAAY,KAAK,YAAY,OAAO,gBAAgB;AACpE;","names":[]}

package/dist/{chunk-QOOUUR4A.js → chunk-K673OO6B.js}

@@ -1,13 +1,13 @@
 import {
   installViaBinder
-} from "./chunk-Z5HTYMMQ.js";
+} from "./chunk-PTJY5R3O.js";
 import {
   SealedHandle
-} from "./chunk-ODVPTDPK.js";
+} from "./chunk-2ELOCEXE.js";
 import {
   ClassifiedConfigError,
   ClassifiedNotEnabledError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/via/classified/descriptor.ts
 function isClassifiedFieldSpec(x) {
@@ -43,6 +43,12 @@ var ClassifiedValidationError = class extends Error {
 function resolveClassifiedFields(collection, config) {
   const byField = {};
   const claim = (field, spec) => {
+    if (field.includes(".") || field.includes("[")) {
+      throw new ClassifiedConfigError(
+        collection,
+        `field "${field}" is a nested path, which classifiedFields does not support \u2014 it would register without error and seal nothing, returning the value in plaintext. Promote it to a top-level field on this collection (or its own document) and declare that instead. (Dotted paths ARE supported by moneyFields and i18nFields, which is why this is an easy mistake.)`
+      );
+    }
     if (byField[field] !== void 0) {
       throw new ClassifiedConfigError(
         collection,
@@ -264,4 +270,4 @@ export {
   enforceClassifiedWrite,
   NO_CLASSIFIED
 };
-//# sourceMappingURL=chunk-QOOUUR4A.js.map
+//# sourceMappingURL=chunk-K673OO6B.js.map

package/dist/chunk-K673OO6B.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/via/classified/descriptor.ts","../src/via/classified/errors.ts","../src/via/classified/resolve.ts","../src/via/classified/write.ts","../src/via/classified/guards.ts","../src/via/classified/binding.ts","../src/port/with/classified-strategy.ts"],"sourcesContent":["/**\n * Classified fields — behavioral sensitive-field descriptors (stage 1).\n * Design: design-history/2026-07-04-classified-fields-design.md\n * Law: open on write, declarative on read — read-side behavior is this\n * closed vocabulary; there are no read-side callbacks.\n * @module\n */\n\nexport type ClassifiedStorage = 'recoverable' | 'never' | 'digest-only'\n\nexport type ClassifiedList =\n  | { readonly kind: 'omit' }\n  | { readonly kind: 'mask'; readonly pattern: string }\n  | { readonly kind: 'rider'; readonly rider: string }\n\nexport type ClassifiedRider = (value: unknown) => unknown\n\nexport interface ClassifiedFieldSpec {\n  readonly _noydbClassified: true\n  /**\n   * Via port brand marker — lets a `ClassifiedFieldSpec` satisfy the\n   * kernel's opaque `ViaDescriptor` (#629 Task 5). Optional (unlike\n   * `MoneyDescriptor._viaBrand`/`I18nTextDescriptor._viaBrand`, which are\n   * required): every `classified.*()` preset factory stamps it, but the\n   * pre-existing test suite's hand-rolled `ClassifiedFieldSpec` fixtures\n   * (built without going through a preset) predate this field and would\n   * fail to compile if it were mandatory.\n   */\n  readonly _viaBrand?: 'classified'\n  readonly preset: string\n  readonly storage: ClassifiedStorage\n  readonly list: ClassifiedList\n  readonly sensitivity: 'pii' | 'secret'\n  /** Write-time safe projections; companion field name is `<field>_<rider>`. */\n  readonly riders?: Record<string, ClassifiedRider>\n  /** Write-time validator: error message, or null when valid. */\n  readonly validate?: (value: unknown) => string | null\n  /** Digest-only verify policy (stage 2). Mode both sides normalize under. */\n  readonly verifyNormalize?: 'password' | 'secret-answer'\n  /** Decorate ok:true verdicts with mustRotate after this many days (I1). */\n  readonly rotateDays?: number\n  /** Refuse reuse of the last N values on rotate (cap 8, spec Q4). */\n  readonly notLastN?: number\n  /** Member of the collection's matchGroup (secretAnswer preset). */\n  readonly verifyGroupMember?: true\n  /**\n   * Opt into a store-visible blind-index (`_bidx`) tag so equal values become\n   * queryable/joinable while staying digest-only. Digest-only knob (R7); gated\n   * behind the collection's `acknowledgeEquatableRisk` door (R8). Equal values\n   * produce equal tags — a partition leak a DEK holder can offline-dictionary\n   * at the PBKDF2 floor. Absent/false ⇒ refused-by-default.\n   */\n  readonly equatable?: true\n}\n\nexport interface ClassifiedGroup {\n  readonly _noydbClassifiedGroup: true\n  /** Via port brand marker — see {@link ClassifiedFieldSpec._viaBrand}. */\n  readonly _viaBrand?: 'classified'\n  readonly preset: string\n  /** member record-field name -> spec (differential per-member policy). */\n  readonly members: Record<string, ClassifiedFieldSpec>\n}\n\nexport type ClassifiedEntry = ClassifiedFieldSpec | ClassifiedGroup\n\nexport function isClassifiedFieldSpec(x: unknown): x is ClassifiedFieldSpec {\n  return typeof x === 'object' && x !== null\n    && (x as { _noydbClassified?: unknown })._noydbClassified === true\n}\n\nexport function isClassifiedGroup(x: unknown): x is ClassifiedGroup {\n  return typeof x === 'object' && x !== null\n    && (x as { _noydbClassifiedGroup?: unknown })._noydbClassifiedGroup === true\n}\n","/**\n * Configuration/write errors for classified fields. @module\n *\n * `ClassifiedConfigError` / `ClassifiedRevealError` moved to `kernel/errors.ts`\n * (stage 2) so `capsule/enclave-aes/classify/*` can throw them without importing\n * with-*. Re-exported here under the same names so existing import paths\n * keep working.\n */\nexport { ClassifiedConfigError, ClassifiedRevealError, ClassifiedVerifyError, ClassifiedRotationError } from '../../kernel/errors.js'\n\nexport class ClassifiedNeverStoredError extends Error {\n  constructor(public readonly collection: string, public readonly field: string) {\n    super(`Field \"${field}\" in collection \"${collection}\" is classified storage:'never' `\n      + `(e.g. a CVC) and must not be persisted. Validate it at capture and drop it before put().`)\n    this.name = 'ClassifiedNeverStoredError'\n  }\n}\n\nexport class ClassifiedValidationError extends Error {\n  constructor(public readonly collection: string, public readonly field: string, detail: string) {\n    super(`Classified field \"${field}\" in collection \"${collection}\" failed validation: ${detail}`)\n    this.name = 'ClassifiedValidationError'\n  }\n}\n","/** Flatten a classifiedFields config into a per-field map + rider computed entries. @module */\n\nimport { isClassifiedGroup, type ClassifiedEntry, type ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedConfigError } from './errors.js'\n\n/**\n * `ClassifiedList` — PUBLISHED API, reachable from @noy-db/hub, @noy-db/hub/classified. Flagged as unused because\n * nothing inside hub imports it from this module; a consumer does. Do not narrow\n * or delete without a seam change (#55).\n *\n * @public\n */\nexport type { ClassifiedEntry, ClassifiedFieldSpec, ClassifiedGroup, ClassifiedList } from './descriptor.js'\nexport { ClassifiedConfigError } from './errors.js'\n\nexport interface ResolvedClassified {\n  readonly byField: Record<string, ClassifiedFieldSpec>\n  readonly riderComputed: Record<string, (record: Record<string, unknown>) => unknown>\n}\n\nexport function resolveClassifiedFields(\n  collection: string,\n  config: Record<string, ClassifiedEntry>,\n): ResolvedClassified {\n  const byField: Record<string, ClassifiedFieldSpec> = {}\n  const claim = (field: string, spec: ClassifiedFieldSpec): void => {\n    // ⛔ #19 — REFUSE A NESTED PATH. Declaring `'account.password'` used to\n    // register cleanly and seal NOTHING: the write succeeded and the secret\n    // came back in full plaintext from `get()` and `list()`, with the only\n    // signal being a `reveal()` that a developer who believes the field is\n    // sealed has no reason to call. \"Misconfigured\" and \"not classified at\n    // all\" were observationally identical, which is the wrong way round for a\n    // security primitive — a misunderstood declaration must fail closed.\n    //\n    // Guarded HERE rather than at the two call sites below because `claim` is\n    // the one chokepoint both the flat form and a group's members pass\n    // through; a guard on the flat key alone would leave the leak reachable\n    // behind one extra level of syntax.\n    //\n    // ⭐ `via/money/paths.ts` already carries this lesson for `moneyFields`\n    // (\"a declared-but-unreachable path that was silently ignored ... a latent\n    // 100× bug\"). Same class, different family — and here the cost is the\n    // secret rather than the precision.\n    if (field.includes('.') || field.includes('[')) {\n      throw new ClassifiedConfigError(collection,\n        `field \"${field}\" is a nested path, which classifiedFields does not support — ` +\n        `it would register without error and seal nothing, returning the value in plaintext. ` +\n        `Promote it to a top-level field on this collection (or its own document) and declare that instead. ` +\n        `(Dotted paths ARE supported by moneyFields and i18nFields, which is why this is an easy mistake.)`)\n    }\n    if (byField[field] !== undefined) {\n      throw new ClassifiedConfigError(collection,\n        `field \"${field}\" is claimed twice — storage forms are mutually exclusive per field (R5): ` +\n        `a field is digest-only OR recoverable OR never, exactly one`)\n    }\n    byField[field] = spec\n  }\n  for (const [key, entry] of Object.entries(config)) {\n    if (isClassifiedGroup(entry)) {\n      for (const [field, spec] of Object.entries(entry.members)) claim(field, spec)\n    } else {\n      claim(key, entry)\n    }\n  }\n  const riderComputed: Record<string, (record: Record<string, unknown>) => unknown> = {}\n  for (const [field, spec] of Object.entries(byField)) {\n    for (const [name, rider] of Object.entries(spec.riders ?? {})) {\n      const companion = `${field}_${name}`\n      if (byField[companion] !== undefined || riderComputed[companion] !== undefined) {\n        throw new ClassifiedConfigError(collection, `rider companion \"${companion}\" collides with a declared field`)\n      }\n      riderComputed[companion] = (record) =>\n        record[field] === undefined ? undefined : rider(record[field])\n    }\n  }\n  return { byField, riderComputed }\n}\n","/** Write-path enforcement: storage:'never' rejection + preset validators.\n *  Runs BEFORE riders/computed and BEFORE schema validation. Pure. @module */\n\nimport type { ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedNeverStoredError, ClassifiedValidationError } from './errors.js'\n\nexport function enforceClassifiedWrite(\n  record: Record<string, unknown>,\n  byField: Record<string, ClassifiedFieldSpec>,\n  collection: string,\n): void {\n  for (const [field, spec] of Object.entries(byField)) {\n    const value = record[field]\n    if (value === undefined) continue\n    if (value === null && spec.storage === 'digest-only') continue // explicit clear (C6 branch 3)\n    if (spec.storage === 'never') throw new ClassifiedNeverStoredError(collection, field)\n    const problem = spec.validate?.(value) ?? null\n    if (problem !== null) throw new ClassifiedValidationError(collection, field, problem)\n  }\n}\n","/**\n * Refusal matrix R1-R5 (spec) — ONE guard, run at BOTH doors:\n * `collection()` config resolution AND `_applyClassifiedFields` (the reconcile\n * seam), because crdt/conflictPolicy/perRecordKeys are construction-only\n * while classifiedFields can attach later (C5's lesson). @module\n */\nimport type { ClassifiedFieldSpec } from './descriptor.js'\nimport { ClassifiedConfigError } from '../../kernel/errors.js'\n\nexport interface ClassifiedGuardCtx {\n  readonly perRecordKeys: boolean\n  readonly crdt: boolean\n  readonly hasConflictPolicy: boolean\n  /** False on plaintext (`encrypt: false`) collections — no vdig/seal path exists. */\n  readonly storeCiphertext: boolean\n  readonly deterministicFields: ReadonlySet<string> | null\n  readonly indexedFields: ReadonlySet<string>\n  readonly textIndexFields: ReadonlySet<string>\n  readonly vectorSourceFields: ReadonlySet<string>\n  readonly subjectKeyField: string | undefined\n  readonly bareSensitiveFields: ReadonlySet<string>\n  /** Collection-level gate for the `equatable` knob (R8 double door). */\n  readonly acknowledgeEquatableRisk: boolean\n}\n\nexport function guardClassifiedCompat(\n  collection: string,\n  byField: Record<string, ClassifiedFieldSpec>,\n  ctx: ClassifiedGuardCtx,\n): void {\n  const digestOnly = Object.entries(byField)\n    .filter(([, s]) => s.storage === 'digest-only')\n  const protectedForms = Object.values(byField)\n    .filter((s) => s.storage === 'digest-only' || s.storage === 'recoverable')\n\n  // R2 — merge resolvers bypass the write pipeline entirely (C5): a merge\n  // could carry stale/foreign _vdig or resurrect plaintext (the CRDT put\n  // branch persists via encryptJsonString with no vdig backstop). Fail-loud.\n  if (protectedForms.length > 0 && (ctx.crdt || ctx.hasConflictPolicy)) {\n    throw new ClassifiedConfigError(collection,\n      'digest-only/recoverable classified fields cannot combine with a crdt mode or a ' +\n      'conflictPolicy resolver — merge paths bypass write enforcement (R2)')\n  }\n  // R7 — `equatable` is a digest-only knob: it drives the `_bidx` blind-index\n  // slot, which only exists on the digest-only write path. A recoverable/never\n  // field carrying it would silently no-op (recoverable equality is `_det`'s\n  // job). Refuse rather than accept-and-ignore. Checked over ALL specs, before\n  // the digest-only early-return below, precisely to catch the non-digest case.\n  for (const [f, spec] of Object.entries(byField)) {\n    if (spec.equatable === true && spec.storage !== 'digest-only') {\n      throw new ClassifiedConfigError(collection,\n        `field \"${f}\" declares equatable but storage is '${spec.storage}' — equatable is a ` +\n        `digest-only knob; recoverable equality is _det's job (R7)`)\n    }\n  }\n\n  // R8 — the equatable double door (mirrors deterministicFields ×\n  // acknowledgeDeterministicRisk): any field opting into `equatable` requires\n  // the collection to acknowledge the partition-leak risk. One-directional —\n  // `acknowledgeEquatableRisk: true` with ZERO equatable members is a silent\n  // no-op (never throws here), so the ack can sit on a collection config\n  // ahead of the field landing.\n  const hasEquatable = Object.values(byField).some((s) => s.equatable === true)\n  if (hasEquatable && ctx.acknowledgeEquatableRisk !== true) {\n    throw new ClassifiedConfigError(collection,\n      `classified equatable fields require \\`acknowledgeEquatableRisk: true\\` — equal values ` +\n      `produce equal store-visible index tags (a partition leak a DEK holder can offline-` +\n      `dictionary at the PBKDF2 floor); the door is the real control for low-entropy fields (R8)`)\n  }\n\n  if (digestOnly.length === 0) return\n\n  // Digest-only on a plaintext collection: the codec's vdig block is gated on\n  // storeCiphertext, so the secret would persist as raw plaintext. Refuse.\n  if (!ctx.storeCiphertext) {\n    throw new ClassifiedConfigError(collection,\n      `storage:'digest-only' requires an encrypted collection — with encrypt: false the ` +\n      `write path skips the digest slot entirely and the secret would persist as raw plaintext`)\n  }\n  // R1 — vdig slot keys are CEK-only (I3); without perRecordKeys a digest\n  // would survive forget() in backups as offline-crackable material.\n  if (!ctx.perRecordKeys) {\n    throw new ClassifiedConfigError(collection,\n      `storage:'digest-only' requires perRecordKeys: true — vdig keys derive from the ` +\n      `per-record CEK so forget() shreds them (R1)`)\n  }\n  for (const [f, spec] of digestOnly) {\n    // notLastN cap: presets clamp this at construction, but a raw spec object\n    // bypasses the preset — enforce the same 0..8 cap in the policy projection.\n    const n = spec.notLastN ?? 0\n    if (!Number.isInteger(n) || n < 0 || n > 8) {\n      throw new ClassifiedConfigError(collection,\n        `digest-only field \"${f}\" declares notLastN ${n} — must be an integer 0..8 ` +\n        `(write cost is n × 600K PBKDF2; ring blast radius is documented)`)\n    }\n    if (ctx.bareSensitiveFields.has(f)) {\n      // R5 — the sealed block runs before the vdig block in the codec, so the\n      // overlap would seal the value recoverably (silent downgrade + I4\n      // double-slot). Storage forms are mutually exclusive per field.\n      throw new ClassifiedConfigError(collection,\n        `field \"${f}\" is digest-only AND listed in sensitive[] — storage forms are mutually exclusive per field (R5)`)\n    }\n    if (ctx.deterministicFields?.has(f)) {\n      throw new ClassifiedConfigError(collection,\n        `digest-only field \"${f}\" cannot be deterministic — equality-correlatable ciphertext defeats per-write salts (R3)`)\n    }\n    if (ctx.indexedFields.has(f) || ctx.textIndexFields.has(f)\n      || ctx.vectorSourceFields.has(f) || ctx.subjectKeyField === f) {\n      throw new ClassifiedConfigError(collection,\n        `digest-only field \"${f}\" cannot be indexed, text-indexed, embedded, or a forget-subject key (R4)`)\n    }\n  }\n}\n","/**\n * The classified `NoydbVia` (#629 Task 5, LIVE since Task 6) — wires\n * classified-fields declaration/write-enforcement/at-rest sealing/erasure\n * into the kernel's generic Via port. Mirrors `via/money/binding.ts`'s\n * inline declaration-time validation and `via/i18n/binding.ts`'s\n * `linkXVia` static-link pattern — except the link itself is EAGER\n * (`port/with/classified-strategy.ts` calls `linkClassifiedVia()` at module\n * load, not lazily from a `classified.*()` preset call): several fixtures\n * build a raw `ClassifiedFieldSpec` literal without ever calling a preset,\n * and the binder must be installed before `compileVias` needs it\n * regardless.\n *\n * `compileVias` (`kernel/collection-config.ts`) compiles this binding\n * in whenever a collection declares `classifiedFields` — money then i18n\n * then classified, order pinned. `kernel/collection.ts`'s `_putInternal`\n * runs `enforceClassifiedWrite`'s effect via the pipeline's `enforceWrite`\n * phase; the codec's `encodeAtRest`/`decodeAtRest` hooks (Task 3's boundary)\n * replace the inline `sensitiveFields` seal path for any collection this\n * binding is compiled into.\n *\n * `declare` — `classifiedVia(cfg)` runs `resolveClassifiedFields` +\n * `guardClassifiedCompat` at CONSTRUCTION time (the same #553 pattern\n * `moneyVia`'s `validateMoneyFieldPaths(moneyFields)` call uses) —\n * mirrors today's \"door 1\" (`collection-config.ts`'s\n * `resolveCollectionConfig`). Both may throw `ClassifiedConfigError`.\n */\nimport type { NoydbVia, ViaWriteCtx, ViaCryptoCtx, SealedSlotRef, ViaEraseCtx, ViaEraseReport } from '../../kernel/via/index.js'\nimport { installViaBinder } from '../../kernel/via/index.js'\nimport { SealedHandle } from '../../kernel/types.js'\nimport { resolveClassifiedFields, type ClassifiedEntry } from './resolve.js'\nimport { guardClassifiedCompat, type ClassifiedGuardCtx } from './guards.js'\nimport { enforceClassifiedWrite } from './write.js'\nimport type { ClassifiedFieldSpec } from './descriptor.js'\n\n/**\n * One classified per-slot shred/residue verdict — mirrors\n * `RecordCodec.SealedShredSlot` (`capsule/plumbing/record-codec.ts`)\n * byte-for-byte. Duplicated here (not imported) so this binding never\n * reaches into `capsule/enclave-aes/` (`via-enclave-isolation`, #629) — the\n * closure that PRODUCES real values of this shape is codec-owned and\n * injected via {@link ClassifiedViaConfig.classifySealedShred}.\n */\nexport interface ClassifiedShredSlot {\n  readonly field: string\n  readonly class: 'shreddable' | 'dekResidue' | 'live-shreddable+dekResidue-in-backups'\n}\n\n/**\n * Config a classified collection's declarations resolve to — the binding's\n * construction input. `entries`/`guardCtx` are the raw \"door 1\" inputs\n * (`resolveClassifiedFields`/`guardClassifiedCompat`'s own parameters);\n * `classifySealedShred`/`purgeSealedCekEnvelopes` are OPTIONAL codec/vault-\n * provided closures for the `erase` hook — undefined in this dormant task\n * (no caller wires them yet), wired for real in #629 Task 10 (\"posture\n * enforcement — forget + erase hooks live\").\n */\nexport interface ClassifiedViaConfig {\n  readonly entries: Record<string, ClassifiedEntry>\n  readonly collectionName: string\n  readonly guardCtx: ClassifiedGuardCtx\n  /**\n   * Codec-provided closure mirroring `RecordCodec.classifySealedShred` —\n   * classifies a live envelope's `_sealed` slots for crypto-shred\n   * completeness (see that method's doc comment for the shreddable/\n   * dekResidue/both-class semantics). `live` is `ViaEraseCtx.live`'s opaque\n   * envelope, passed straight through. NOT `readonly` (#629 Task 10):\n   * `compileVias` builds this cfg before the owning `Collection`'s\n   * `RecordCodec` exists, so `Collection`'s constructor mutates this field\n   * in place once `this.codec` is available — the closure `eraseClassified`\n   * reads is looked up at CALL time, not at binding-construction time, so\n   * the late assignment is picked up correctly.\n   */\n  classifySealedShred?: (live: unknown) => Promise<{ readonly slots: readonly ClassifiedShredSlot[] }>\n  /**\n   * Vault-provided closure that purges every `_sealed_cek/<collection>/<id>/*`\n   * host-delivery envelope for one record (mirrors `rotateRecordCek`'s own\n   * prefix-delete) and returns the count purged. Deliberately left UNWIRED\n   * by `compileVias` (#629 Task 10) — `forget-sealed-erasure.test.ts`\n   * proves this purge is UNCONDITIONAL on `sealRecordToHost` usage alone,\n   * independent of whether `classifiedFields` is declared (a bare\n   * `sensitive: [...]` collection exercises it with no classified binding\n   * at all) — vault.ts keeps owning it directly so that case stays correct.\n   */\n  readonly purgeSealedCekEnvelopes?: (id: string) => Promise<number>\n}\n\n/** Fields declared `storage: 'recoverable'` (digest-only stays codec-inline; `'never'` is rejected by `enforceWrite` before either hook runs). */\nfunction recoverableFields(byField: Record<string, ClassifiedFieldSpec>): string[] {\n  return Object.entries(byField).filter(([, spec]) => spec.storage === 'recoverable').map(([field]) => field)\n}\n\n/**\n * The full set this binding's `encodeAtRest`/`decodeAtRest` seal: declared\n * recoverable classified fields UNION bare `sensitive[]` fields — mirrors\n * `collection-config.ts`'s pre-cutover \"recoverable classified fields are\n * unioned into sensitiveFields... zero new crypto code\" semantics. Once this\n * binding is compiled into a collection's pipeline, `hasAtRestHooks` is true\n * and the codec's inline `sensitiveFields` seal path (record-codec.ts) is\n * DEAD for that collection — mutually exclusive with the hook path (#629\n * Task 3) — so bare `sensitive[]` fields MUST seal through here too, or\n * they'd silently stop being sealed at all (#629 Task 6 reconciliation).\n * `guardCtx.bareSensitiveFields` is the exact same `Set` the collection's\n * refusal-matrix guard already carries (`ClassifiedGuardCtx`).\n */\nfunction sealFieldNames(byField: Record<string, ClassifiedFieldSpec>, guardCtx: ClassifiedGuardCtx): string[] {\n  return [...recoverableFields(byField), ...guardCtx.bareSensitiveFields]\n}\n\n/**\n * Seal every named field present with a defined value into its own sealed\n * slot via `crypto.sealedSlots`, peeling it out of the record.\n */\nasync function encodeClassifiedAtRest(\n  record: Record<string, unknown>,\n  crypto: ViaCryptoCtx,\n  fields: readonly string[],\n): Promise<{ record: Record<string, unknown>; sealed?: Record<string, SealedSlotRef> }> {\n  let open = record\n  let sealed: Record<string, SealedSlotRef> | undefined\n  for (const field of fields) {\n    if (!(field in record)) continue\n    const value = record[field]\n    if (value === undefined) continue\n    const ref = await crypto.sealedSlots.seal(field, value)\n    if (open === record) open = { ...record }\n    delete open[field]\n    sealed ??= {}\n    sealed[field] = ref\n  }\n  return sealed ? { record: open, sealed } : { record }\n}\n\n/**\n * Restore every named field's sealed slot back onto the record: an opaque\n * `SealedHandle` under `asHandles` (never materialises plaintext into the\n * cache — `SealedHandle.toJSON()` returns `'[sealed]'`, the export-redaction\n * guarantee `reveal()` alone can lift), the plaintext value otherwise.\n */\nasync function decodeClassifiedAtRest(\n  record: Record<string, unknown>,\n  sealed: Record<string, SealedSlotRef>,\n  crypto: ViaCryptoCtx,\n  opts: { asHandles: boolean },\n  fields: readonly string[],\n): Promise<Record<string, unknown>> {\n  let out = record\n  for (const field of fields) {\n    const ref = sealed[field]\n    if (ref === undefined) continue\n    if (out === record) out = { ...record }\n    out[field] = opts.asHandles\n      ? new SealedHandle(() => crypto.sealedSlots.unseal(field, ref))\n      : await crypto.sealedSlots.unseal(field, ref)\n  }\n  return out\n}\n\n/**\n * `forget()`'s per-ref erasure participation: classify the live envelope's\n * sealed slots (via the codec-provided closure) and mark each shreddable\n * one deleted on this call's sealed-slots capability, then purge the\n * record's sealed-CEK host-delivery envelopes (via the vault-provided\n * closure). Both closures are optional — undefined (this dormant task's\n * only caller, its own unit tests) reports a zero-shredded, zero-residue\n * no-op rather than throwing.\n */\nasync function eraseClassified(\n  ctx: ViaEraseCtx,\n  cfg: ClassifiedViaConfig,\n): Promise<ViaEraseReport> {\n  let shredded = 0\n  const residue: unknown[] = []\n\n  if (cfg.classifySealedShred) {\n    const { slots } = await cfg.classifySealedShred(ctx.live)\n    for (const slot of slots) {\n      if (slot.class === 'shreddable' || slot.class === 'live-shreddable+dekResidue-in-backups') {\n        shredded += 1\n        await ctx.crypto.sealedSlots.delete(slot.field)\n      }\n      if (slot.class === 'dekResidue' || slot.class === 'live-shreddable+dekResidue-in-backups') {\n        residue.push({ kind: 'classified-sealed-dek-residue', field: slot.field })\n      }\n    }\n  }\n\n  if (cfg.purgeSealedCekEnvelopes) {\n    shredded += await cfg.purgeSealedCekEnvelopes(ctx.id)\n  }\n\n  return { shredded, residue }\n}\n\nfunction buildClassifiedDescribeFragment(byField: Record<string, ClassifiedFieldSpec>): Record<string, unknown> {\n  return {\n    classifiedFields: Object.fromEntries(\n      Object.entries(byField).map(([field, spec]) => [field, { storage: spec.storage, sensitivity: spec.sensitivity }]),\n    ),\n  }\n}\n\nexport function classifiedVia(cfg: ClassifiedViaConfig): NoydbVia {\n  // declare — door 1: resolve + guard, exactly like collection-config.ts's\n  // resolveCollectionConfig does today. Throws ClassifiedConfigError on any\n  // R1-R8 refusal-matrix violation or field-collision.\n  const resolved = resolveClassifiedFields(cfg.collectionName, cfg.entries)\n  guardClassifiedCompat(cfg.collectionName, resolved.byField, cfg.guardCtx)\n  const byField = resolved.byField\n  const sealFields = sealFieldNames(byField, cfg.guardCtx)\n\n  return {\n    brand: 'classified',\n    posture: { encryptedAtRest: 'sealed', queryable: 'det-exact', exportable: false, forgettable: true },\n    covers: (field) => field in byField,\n    coveredFields: Object.keys(byField), // #1447 — the FIELD only; the sensitivity label is deliberately NOT reported\n    // async (rather than a bare passthrough) so a refusal is always a\n    // rejected Promise for direct callers, matching every other async-stack\n    // hook's calling convention — `enforceClassifiedWrite` itself stays sync.\n    enforceWrite: async (record: Record<string, unknown>, _ctx: ViaWriteCtx) =>\n      enforceClassifiedWrite(record, byField, cfg.collectionName),\n    encodeAtRest: (record, crypto) => encodeClassifiedAtRest(record, crypto, sealFields),\n    decodeAtRest: (record, sealed, crypto, opts) => decodeClassifiedAtRest(record, sealed, crypto, opts, sealFields),\n    erase: (ctx) => eraseClassified(ctx, cfg),\n    describeFragment: () => buildClassifiedDescribeFragment(byField),\n  }\n}\n\nexport function linkClassifiedVia(): void {\n  installViaBinder('classified', (c) => classifiedVia(c as ClassifiedViaConfig))\n}\n","/**\n * Classified strategy seam (#629 Task 5 — moved out of\n * `via/classified/strategy.ts`, precedent: `port/with/i18n-strategy.ts`).\n * Lives on the `/with` port (the one seam the kernel spine may import\n * statically) so `Collection`/`Vault` can hold the `NO_CLASSIFIED` default\n * without a spine→service static import.\n *\n * This file (unlike `via/classified/**`) is NOT subject to the\n * `via-enclave-isolation` architecture guard — it may import `EnclaveKey`\n * from the enclave barrel freely, the same way `port/with/i18n-strategy.ts`\n * did before #629 Task 4's DictionaryHandle cutover.\n *\n * The ② capability seam for classified read-egress ops (stage 1: reveal;\n * stage 2: verify).\n *\n * @internal\n */\nimport type { ClassifiedFieldSpec } from '../../via/classified/descriptor.js'\nimport { ClassifiedNotEnabledError } from '../../kernel/errors.js'\nimport type { EncryptedEnvelope } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport { linkClassifiedVia } from '../../via/classified/binding.js'\n\n// #629 Task 10 — re-export the classified binding's erase-cfg TYPE (not\n// `via/classified/binding.js` directly) so the kernel spine can name\n// it for the post-construction `classifySealedShred` wiring, same rationale\n// as `resolveClassifiedFields`/`guardClassifiedCompat` above.\nexport type { ClassifiedViaConfig } from '../../via/classified/binding.js'\n\nexport type { ClassifiedVerdict } from '../../kernel/types.js'\nimport type { ClassifiedVerdict } from '../../kernel/types.js'\n\n// #629 Task 6 — the classified binding's construction-time resolve/guard,\n// re-exported here (not `via/classified/{resolve,guards}.js` directly)\n// so the kernel spine keeps importing only this one `/with` port seam, same\n// rationale as `NO_CLASSIFIED` below.\nexport { resolveClassifiedFields, type ClassifiedEntry, type ResolvedClassified } from '../../via/classified/resolve.js'\nexport { guardClassifiedCompat, type ClassifiedGuardCtx } from '../../via/classified/guards.js'\nexport type { ClassifiedFieldSpec }\n\n// Install the classified Via binder EAGERLY — unlike money()/i18nText(),\n// several classified fixtures (both hub tests and consumer code) build a raw\n// `ClassifiedFieldSpec` object literal without ever calling a\n// `classified.*()` preset (bypassing `via/classified/presets.ts`\n// entirely — an intentionally supported pattern, see that module's Task 5\n// doc comment). Linking lazily at preset-call time (the money/i18n pattern)\n// would leave `viaBinder('classified')` unlinked for those declarations.\n// This port module is already unconditionally imported by the kernel spine\n// (for the `NO_CLASSIFIED` strategy default below), so linking here\n// guarantees the binder is always installed before `compileVias`\n// ever needs it, regardless of how a collection's classifiedFields were\n// constructed.\nlinkClassifiedVia()\n\nexport interface ClassifiedRevealCtx {\n  readonly collection: string\n  readonly spec: ClassifiedFieldSpec\n  /** True on an encrypted collection — false selects the plaintext-body read. */\n  readonly encrypted: boolean\n  readonly getEnvelope: (id: string) => Promise<EncryptedEnvelope | null>\n  readonly resolveCek: (env: EncryptedEnvelope) => Promise<EnclaveKey | undefined>\n  readonly getDEK: () => Promise<EnclaveKey>\n  readonly onAccess?: ((op: 'reveal', id: string) => Promise<void>) | undefined\n}\n\nexport interface ClassifiedVerifyCtx {\n  readonly collection: string\n  readonly spec: ClassifiedFieldSpec\n  readonly getEnvelope: (id: string) => Promise<EncryptedEnvelope | null>       // raw envelope, NOT a decrypted view\n  readonly resolveCek: (env: EncryptedEnvelope) => Promise<EnclaveKey | undefined>\n  readonly getDEK: () => Promise<EnclaveKey>\n  readonly now: () => number                                        // injected (Q7)\n  /** Group members resolved by the collection (matchGroup only). */\n  readonly groupMembers?: ReadonlyArray<{ readonly field: string; readonly spec: ClassifiedFieldSpec }>\n  readonly onAccess?: ((op: 'verify' | 'find', id: string) => Promise<void>) | undefined\n}\n\nexport interface ClassifiedStrategy {\n  reveal(ctx: ClassifiedRevealCtx, id: string, field: string): Promise<unknown>\n  verify(ctx: ClassifiedVerifyCtx, id: string, field: string, candidate: string): Promise<ClassifiedVerdict>\n  verifyText(ctx: ClassifiedVerifyCtx, id: string, field: string, candidate: string): Promise<ClassifiedVerdict>\n  matchGroup(ctx: ClassifiedVerifyCtx, id: string, answers: Record<string, string>,\n             opts: { readonly min: number }): Promise<{ readonly passed: boolean }>\n  computeTarget(ctx: ClassifiedVerifyCtx, field: string, candidate: string, costByte?: number): Promise<string | null>\n}\n\nexport const NO_CLASSIFIED: ClassifiedStrategy = {\n  async reveal() { throw new ClassifiedNotEnabledError() },\n  async verify() { throw new ClassifiedNotEnabledError() },\n  async verifyText() { throw new ClassifiedNotEnabledError() },\n  async matchGroup() { throw new ClassifiedNotEnabledError() },\n  async computeTarget() { throw new ClassifiedNotEnabledError() },\n}\n"],"mappings":";;;;;;;;;;;;AAkEO,SAAS,sBAAsB,GAAsC;AAC1E,SAAO,OAAO,MAAM,YAAY,MAAM,QAChC,EAAqC,qBAAqB;AAClE;AAEO,SAAS,kBAAkB,GAAkC;AAClE,SAAO,OAAO,MAAM,YAAY,MAAM,QAChC,EAA0C,0BAA0B;AAC5E;;;AChEO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EACpD,YAA4B,YAAoC,OAAe;AAC7E,UAAM,UAAU,KAAK,oBAAoB,UAAU,0HAC2C;AAFpE;AAAoC;AAG9D,SAAK,OAAO;AAAA,EACd;AAAA,EAJ4B;AAAA,EAAoC;AAKlE;AAEO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnD,YAA4B,YAAoC,OAAe,QAAgB;AAC7F,UAAM,qBAAqB,KAAK,oBAAoB,UAAU,wBAAwB,MAAM,EAAE;AADpE;AAAoC;AAE9D,SAAK,OAAO;AAAA,EACd;AAAA,EAH4B;AAAA,EAAoC;AAIlE;;;ACHO,SAAS,wBACd,YACA,QACoB;AACpB,QAAM,UAA+C,CAAC;AACtD,QAAM,QAAQ,CAAC,OAAe,SAAoC;AAkBhE,QAAI,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,GAAG;AAC9C,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,UAAU,KAAK;AAAA,MAGoF;AAAA,IACvG;AACA,QAAI,QAAQ,KAAK,MAAM,QAAW;AAChC,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,UAAU,KAAK;AAAA,MAC8C;AAAA,IACjE;AACA,YAAQ,KAAK,IAAI;AAAA,EACnB;AACA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,kBAAkB,KAAK,GAAG;AAC5B,iBAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,MAAM,OAAO,EAAG,OAAM,OAAO,IAAI;AAAA,IAC9E,OAAO;AACL,YAAM,KAAK,KAAK;AAAA,IAClB;AAAA,EACF;AACA,QAAM,gBAA8E,CAAC;AACrF,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACnD,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,GAAG;AAC7D,YAAM,YAAY,GAAG,KAAK,IAAI,IAAI;AAClC,UAAI,QAAQ,SAAS,MAAM,UAAa,cAAc,SAAS,MAAM,QAAW;AAC9E,cAAM,IAAI,sBAAsB,YAAY,oBAAoB,SAAS,kCAAkC;AAAA,MAC7G;AACA,oBAAc,SAAS,IAAI,CAAC,WAC1B,OAAO,KAAK,MAAM,SAAY,SAAY,MAAM,OAAO,KAAK,CAAC;AAAA,IACjE;AAAA,EACF;AACA,SAAO,EAAE,SAAS,cAAc;AAClC;;;ACtEO,SAAS,uBACd,QACA,SACA,YACM;AACN,aAAW,CAAC,OAAO,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACnD,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,UAAU,OAAW;AACzB,QAAI,UAAU,QAAQ,KAAK,YAAY,cAAe;AACtD,QAAI,KAAK,YAAY,QAAS,OAAM,IAAI,2BAA2B,YAAY,KAAK;AACpF,UAAM,UAAU,KAAK,WAAW,KAAK,KAAK;AAC1C,QAAI,YAAY,KAAM,OAAM,IAAI,0BAA0B,YAAY,OAAO,OAAO;AAAA,EACtF;AACF;;;ACMO,SAAS,sBACd,YACA,SACA,KACM;AACN,QAAM,aAAa,OAAO,QAAQ,OAAO,EACtC,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,aAAa;AAChD,QAAM,iBAAiB,OAAO,OAAO,OAAO,EACzC,OAAO,CAAC,MAAM,EAAE,YAAY,iBAAiB,EAAE,YAAY,aAAa;AAK3E,MAAI,eAAe,SAAS,MAAM,IAAI,QAAQ,IAAI,oBAAoB;AACpE,UAAM,IAAI;AAAA,MAAsB;AAAA,MAC9B;AAAA,IACqE;AAAA,EACzE;AAMA,aAAW,CAAC,GAAG,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC/C,QAAI,KAAK,cAAc,QAAQ,KAAK,YAAY,eAAe;AAC7D,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,UAAU,CAAC,wCAAwC,KAAK,OAAO;AAAA,MACJ;AAAA,IAC/D;AAAA,EACF;AAQA,QAAM,eAAe,OAAO,OAAO,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,IAAI;AAC5E,MAAI,gBAAgB,IAAI,6BAA6B,MAAM;AACzD,UAAM,IAAI;AAAA,MAAsB;AAAA,MAC9B;AAAA,IAE2F;AAAA,EAC/F;AAEA,MAAI,WAAW,WAAW,EAAG;AAI7B,MAAI,CAAC,IAAI,iBAAiB;AACxB,UAAM,IAAI;AAAA,MAAsB;AAAA,MAC9B;AAAA,IACyF;AAAA,EAC7F;AAGA,MAAI,CAAC,IAAI,eAAe;AACtB,UAAM,IAAI;AAAA,MAAsB;AAAA,MAC9B;AAAA,IAC6C;AAAA,EACjD;AACA,aAAW,CAAC,GAAG,IAAI,KAAK,YAAY;AAGlC,UAAM,IAAI,KAAK,YAAY;AAC3B,QAAI,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,KAAK,IAAI,GAAG;AAC1C,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,sBAAsB,CAAC,uBAAuB,CAAC;AAAA,MACmB;AAAA,IACtE;AACA,QAAI,IAAI,oBAAoB,IAAI,CAAC,GAAG;AAIlC,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,UAAU,CAAC;AAAA,MAAkG;AAAA,IACjH;AACA,QAAI,IAAI,qBAAqB,IAAI,CAAC,GAAG;AACnC,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,sBAAsB,CAAC;AAAA,MAA2F;AAAA,IACtH;AACA,QAAI,IAAI,cAAc,IAAI,CAAC,KAAK,IAAI,gBAAgB,IAAI,CAAC,KACpD,IAAI,mBAAmB,IAAI,CAAC,KAAK,IAAI,oBAAoB,GAAG;AAC/D,YAAM,IAAI;AAAA,QAAsB;AAAA,QAC9B,sBAAsB,CAAC;AAAA,MAA2E;AAAA,IACtG;AAAA,EACF;AACF;;;ACzBA,SAAS,kBAAkB,SAAwD;AACjF,SAAO,OAAO,QAAQ,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,KAAK,YAAY,aAAa,EAAE,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AAC5G;AAeA,SAAS,eAAe,SAA8C,UAAwC;AAC5G,SAAO,CAAC,GAAG,kBAAkB,OAAO,GAAG,GAAG,SAAS,mBAAmB;AACxE;AAMA,eAAe,uBACb,QACA,QACA,QACsF;AACtF,MAAI,OAAO;AACX,MAAI;AACJ,aAAW,SAAS,QAAQ;AAC1B,QAAI,EAAE,SAAS,QAAS;AACxB,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,UAAU,OAAW;AACzB,UAAM,MAAM,MAAM,OAAO,YAAY,KAAK,OAAO,KAAK;AACtD,QAAI,SAAS,OAAQ,QAAO,EAAE,GAAG,OAAO;AACxC,WAAO,KAAK,KAAK;AACjB,eAAW,CAAC;AACZ,WAAO,KAAK,IAAI;AAAA,EAClB;AACA,SAAO,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,EAAE,OAAO;AACtD;AAQA,eAAe,uBACb,QACA,QACA,QACA,MACA,QACkC;AAClC,MAAI,MAAM;AACV,aAAW,SAAS,QAAQ;AAC1B,UAAM,MAAM,OAAO,KAAK;AACxB,QAAI,QAAQ,OAAW;AACvB,QAAI,QAAQ,OAAQ,OAAM,EAAE,GAAG,OAAO;AACtC,QAAI,KAAK,IAAI,KAAK,YACd,IAAI,aAAa,MAAM,OAAO,YAAY,OAAO,OAAO,GAAG,CAAC,IAC5D,MAAM,OAAO,YAAY,OAAO,OAAO,GAAG;AAAA,EAChD;AACA,SAAO;AACT;AAWA,eAAe,gBACb,KACA,KACyB;AACzB,MAAI,WAAW;AACf,QAAM,UAAqB,CAAC;AAE5B,MAAI,IAAI,qBAAqB;AAC3B,UAAM,EAAE,MAAM,IAAI,MAAM,IAAI,oBAAoB,IAAI,IAAI;AACxD,eAAW,QAAQ,OAAO;AACxB,UAAI,KAAK,UAAU,gBAAgB,KAAK,UAAU,yCAAyC;AACzF,oBAAY;AACZ,cAAM,IAAI,OAAO,YAAY,OAAO,KAAK,KAAK;AAAA,MAChD;AACA,UAAI,KAAK,UAAU,gBAAgB,KAAK,UAAU,yCAAyC;AACzF,gBAAQ,KAAK,EAAE,MAAM,iCAAiC,OAAO,KAAK,MAAM,CAAC;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AAEA,MAAI,IAAI,yBAAyB;AAC/B,gBAAY,MAAM,IAAI,wBAAwB,IAAI,EAAE;AAAA,EACtD;AAEA,SAAO,EAAE,UAAU,QAAQ;AAC7B;AAEA,SAAS,gCAAgC,SAAuE;AAC9G,SAAO;AAAA,IACL,kBAAkB,OAAO;AAAA,MACvB,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,aAAa,KAAK,YAAY,CAAC,CAAC;AAAA,IAClH;AAAA,EACF;AACF;AAEO,SAAS,cAAc,KAAoC;AAIhE,QAAM,WAAW,wBAAwB,IAAI,gBAAgB,IAAI,OAAO;AACxE,wBAAsB,IAAI,gBAAgB,SAAS,SAAS,IAAI,QAAQ;AACxE,QAAM,UAAU,SAAS;AACzB,QAAM,aAAa,eAAe,SAAS,IAAI,QAAQ;AAEvD,SAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS,EAAE,iBAAiB,UAAU,WAAW,aAAa,YAAY,OAAO,aAAa,KAAK;AAAA,IACnG,QAAQ,CAAC,UAAU,SAAS;AAAA,IAC5B,eAAe,OAAO,KAAK,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,IAIlC,cAAc,OAAO,QAAiC,SACpD,uBAAuB,QAAQ,SAAS,IAAI,cAAc;AAAA,IAC5D,cAAc,CAAC,QAAQ,WAAW,uBAAuB,QAAQ,QAAQ,UAAU;AAAA,IACnF,cAAc,CAAC,QAAQ,QAAQ,QAAQ,SAAS,uBAAuB,QAAQ,QAAQ,QAAQ,MAAM,UAAU;AAAA,IAC/G,OAAO,CAAC,QAAQ,gBAAgB,KAAK,GAAG;AAAA,IACxC,kBAAkB,MAAM,gCAAgC,OAAO;AAAA,EACjE;AACF;AAEO,SAAS,oBAA0B;AACxC,mBAAiB,cAAc,CAAC,MAAM,cAAc,CAAwB,CAAC;AAC/E;;;ACjLA,kBAAkB;AAkCX,IAAM,gBAAoC;AAAA,EAC/C,MAAM,SAAS;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EACvD,MAAM,SAAS;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EACvD,MAAM,aAAa;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EAC3D,MAAM,aAAa;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAAA,EAC3D,MAAM,gBAAgB;AAAE,UAAM,IAAI,0BAA0B;AAAA,EAAE;AAChE;","names":[]}

package/dist/{chunk-NNARWO72.js → chunk-K7RW7FI4.js}

@@ -1,25 +1,26 @@
+import {
+  ENCLAVE_SCHEME
+} from "./chunk-5XONHAFD.js";
 import {
   ATTESTATIONS_COLLECTION,
   REVOKED_RECORD_ID,
   loadOrCreateSigner
-} from "./chunk-QWFHIOD2.js";
+} from "./chunk-D5A3GCZ4.js";
+import {
+  signRevocationList
+} from "./chunk-GMKGGY7V.js";
 import {
   buildRecordAad,
+  buildRecordEnvelope,
+  encrypt,
   openEnvelopeJson
-} from "./chunk-KJFW62P4.js";
-import {
-  buildRecordEnvelope
-} from "./chunk-SEE332EV.js";
-import {
-  encrypt
-} from "./chunk-UYB234ZR.js";
+} from "./chunk-4J3MNVVX.js";
 import {
   AttestationError,
   ConflictError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-audit/attestation/revoke.ts
-import { signRevocationList } from "@noy-db/attestation";
 function requireOwner(ctx, op) {
   if (ctx.role !== "owner") {
     throw new AttestationError(`${op} requires the 'owner' role; caller is '${ctx.role}'. Revocation is the firm's identity operation.`);
@@ -72,7 +73,7 @@ async function publishRevocationListCore(ctx) {
   requireOwner(ctx, "publishRevocationList");
   const docIds = await getRevokedDocIdsCore(ctx);
   const signer = await loadOrCreateSigner(ctx.store, ctx.vault, () => ctx.getDEK());
-  return signRevocationList(docIds, (/* @__PURE__ */ new Date()).toISOString(), signer.keyId, signer.privateKeyPkcs8B64);
+  return signRevocationList(docIds, (/* @__PURE__ */ new Date()).toISOString(), signer.keyId, signer.privateKeyPkcs8B64, ENCLAVE_SCHEME);
 }
 
 export {
@@ -81,4 +82,4 @@ export {
   getRevokedDocIdsCore,
   publishRevocationListCore
 };
-//# sourceMappingURL=chunk-NNARWO72.js.map
+//# sourceMappingURL=chunk-K7RW7FI4.js.map

package/dist/chunk-K7RW7FI4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/attestation/revoke.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../capsule/index.js'\nimport { AttestationError, ConflictError } from '../../kernel/errors.js'\nimport { loadOrCreateSigner, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID } from './signer.js'\nimport { ENCLAVE_SCHEME } from './scheme.js'\nimport { signRevocationList } from '@noy-db/attestation'\nimport type { RevocationList } from './types.js'\n\n/** Everything the revoke core needs from the Vault, injected for testability. */\nexport interface RevokeContext {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly role: string\n  /** The _attestations collection DEK. */\n  getDEK(): Promise<EnclaveKey>\n}\n\ninterface RevokedSet {\n  docIds: string[]\n  updatedAt: string\n}\n\nfunction requireOwner(ctx: RevokeContext, op: string): void {\n  if (ctx.role !== 'owner') {\n    throw new AttestationError(`${op} requires the 'owner' role; caller is '${ctx.role}'. Revocation is the firm's identity operation.`)\n  }\n}\n\nasync function readSet(store: NoydbStore, vault: string, dek: EnclaveKey): Promise<{ docIds: Set<string>; version: number | undefined }> {\n  const env = await store.get(vault, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID)\n  if (!env) return { docIds: new Set<string>(), version: undefined }\n  const set = JSON.parse(await openEnvelopeJson({ collection: ATTESTATIONS_COLLECTION, id: REVOKED_RECORD_ID }, env, dek)) as RevokedSet\n  return { docIds: new Set(set.docIds), version: env._v }\n}\n\n/** Read-modify-write the _revoked set with optimistic concurrency + one retry. */\nasync function mutateSet(ctx: RevokeContext, mutate: (ids: Set<string>) => void): Promise<void> {\n  const dek = await ctx.getDEK()\n  for (let attempt = 0; attempt < 2; attempt++) {\n    const { docIds, version } = await readSet(ctx.store, ctx.vault, dek)\n    mutate(docIds)\n    const payload: RevokedSet = { docIds: [...docIds].sort(), updatedAt: new Date().toISOString() }\n    const expectedVersion = version ?? 0\n    const identity = { collection: ATTESTATIONS_COLLECTION, id: REVOKED_RECORD_ID, version: expectedVersion + 1 }\n    const { iv, data } = await encrypt(JSON.stringify(payload), dek, buildRecordAad(identity))\n    const env = buildRecordEnvelope(\n      identity,\n      { ts: payload.updatedAt, iv, data },\n    )\n    try {\n      await ctx.store.put(ctx.vault, ATTESTATIONS_COLLECTION, REVOKED_RECORD_ID, env, expectedVersion)\n      return\n    } catch (e) {\n      if (e instanceof ConflictError && attempt === 0) continue\n      throw e\n    }\n  }\n}\n\nexport async function revokeDocCore(ctx: RevokeContext, docId: string): Promise<void> {\n  requireOwner(ctx, 'revokeAttestation')\n  const issued = await ctx.store.get(ctx.vault, ATTESTATIONS_COLLECTION, docId)\n  if (!issued) throw new AttestationError(`revokeAttestation: attestation '${docId}' not found (was it issued by this vault?).`)\n  await mutateSet(ctx, (ids) => ids.add(docId))\n}\n\nexport async function unrevokeDocCore(ctx: RevokeContext, docId: string): Promise<void> {\n  requireOwner(ctx, 'unrevokeAttestation')\n  await mutateSet(ctx, (ids) => ids.delete(docId))\n}\n\nexport async function getRevokedDocIdsCore(ctx: RevokeContext): Promise<string[]> {\n  const dek = await ctx.getDEK()\n  const { docIds } = await readSet(ctx.store, ctx.vault, dek)\n  return [...docIds].sort()\n}\n\nexport async function publishRevocationListCore(ctx: RevokeContext): Promise<RevocationList> {\n  requireOwner(ctx, 'publishRevocationList')\n  const docIds = await getRevokedDocIdsCore(ctx)\n  const signer = await loadOrCreateSigner(ctx.store, ctx.vault, () => ctx.getDEK())\n  return signRevocationList(docIds, new Date().toISOString(), signer.keyId, signer.privateKeyPkcs8B64, ENCLAVE_SCHEME)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAS,aAAa,KAAoB,IAAkB;AAC1D,MAAI,IAAI,SAAS,SAAS;AACxB,UAAM,IAAI,iBAAiB,GAAG,EAAE,0CAA0C,IAAI,IAAI,iDAAiD;AAAA,EACrI;AACF;AAEA,eAAe,QAAQ,OAAmB,OAAe,KAAgF;AACvI,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,yBAAyB,iBAAiB;AAC7E,MAAI,CAAC,IAAK,QAAO,EAAE,QAAQ,oBAAI,IAAY,GAAG,SAAS,OAAU;AACjE,QAAM,MAAM,KAAK,MAAM,MAAM,iBAAiB,EAAE,YAAY,yBAAyB,IAAI,kBAAkB,GAAG,KAAK,GAAG,CAAC;AACvH,SAAO,EAAE,QAAQ,IAAI,IAAI,IAAI,MAAM,GAAG,SAAS,IAAI,GAAG;AACxD;AAGA,eAAe,UAAU,KAAoB,QAAmD;AAC9F,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,UAAM,EAAE,QAAQ,QAAQ,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,GAAG;AACnE,WAAO,MAAM;AACb,UAAM,UAAsB,EAAE,QAAQ,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAC9F,UAAM,kBAAkB,WAAW;AACnC,UAAM,WAAW,EAAE,YAAY,yBAAyB,IAAI,mBAAmB,SAAS,kBAAkB,EAAE;AAC5G,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,OAAO,GAAG,KAAK,eAAe,QAAQ,CAAC;AACzF,UAAM,MAAM;AAAA,MACV;AAAA,MACA,EAAE,IAAI,QAAQ,WAAW,IAAI,KAAK;AAAA,IACpC;AACA,QAAI;AACF,YAAM,IAAI,MAAM,IAAI,IAAI,OAAO,yBAAyB,mBAAmB,KAAK,eAAe;AAC/F;AAAA,IACF,SAAS,GAAG;AACV,UAAI,aAAa,iBAAiB,YAAY,EAAG;AACjD,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,eAAsB,cAAc,KAAoB,OAA8B;AACpF,eAAa,KAAK,mBAAmB;AACrC,QAAM,SAAS,MAAM,IAAI,MAAM,IAAI,IAAI,OAAO,yBAAyB,KAAK;AAC5E,MAAI,CAAC,OAAQ,OAAM,IAAI,iBAAiB,mCAAmC,KAAK,6CAA6C;AAC7H,QAAM,UAAU,KAAK,CAAC,QAAQ,IAAI,IAAI,KAAK,CAAC;AAC9C;AAEA,eAAsB,gBAAgB,KAAoB,OAA8B;AACtF,eAAa,KAAK,qBAAqB;AACvC,QAAM,UAAU,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,CAAC;AACjD;AAEA,eAAsB,qBAAqB,KAAuC;AAChF,QAAM,MAAM,MAAM,IAAI,OAAO;AAC7B,QAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,IAAI,OAAO,IAAI,OAAO,GAAG;AAC1D,SAAO,CAAC,GAAG,MAAM,EAAE,KAAK;AAC1B;AAEA,eAAsB,0BAA0B,KAA6C;AAC3F,eAAa,KAAK,uBAAuB;AACzC,QAAM,SAAS,MAAM,qBAAqB,GAAG;AAC7C,QAAM,SAAS,MAAM,mBAAmB,IAAI,OAAO,IAAI,OAAO,MAAM,IAAI,OAAO,CAAC;AAChF,SAAO,mBAAmB,SAAQ,oBAAI,KAAK,GAAE,YAAY,GAAG,OAAO,OAAO,OAAO,oBAAoB,cAAc;AACrH;","names":[]}

package/dist/{chunk-ZXABPVM6.js → chunk-L2F3CFCH.js}

@@ -7,21 +7,17 @@ import {
   hashEntry,
   paddedIndex,
   sha256Hex
-} from "./chunk-CKNGS5MH.js";
+} from "./chunk-2WJKJZSO.js";
 import {
   buildRecordAad,
+  buildRecordEnvelope,
+  encrypt,
   openEnvelopeJson
-} from "./chunk-KJFW62P4.js";
-import {
-  buildRecordEnvelope
-} from "./chunk-SEE332EV.js";
-import {
-  encrypt
-} from "./chunk-UYB234ZR.js";
+} from "./chunk-4J3MNVVX.js";
 import {
   LedgerContentionError,
   isConflictError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-VSUQI5Q6.js";
 
 // src/with-commit/history/ledger/patch.ts
 function computePatch(prev, next) {
@@ -359,7 +355,7 @@ var LedgerStore = class {
     let deltaHash;
     if (input.delta !== void 0) {
       deltaEnvelope = await this.encryptDelta(input.delta, nextIndex);
-      deltaHash = await sha256Hex(deltaEnvelope._data);
+      deltaHash = await sha256Hex(deltaEnvelope._data ?? "");
     }
     const entryBase = {
       index: nextIndex,
@@ -416,7 +412,7 @@ var LedgerStore = class {
     );
     if (!envelope) return null;
     if (!this.encrypted) {
-      return JSON.parse(envelope._data);
+      return JSON.parse(envelope._data ?? "");
     }
     const dek = await this.getDEK(LEDGER_COLLECTION);
     const json = await openEnvelopeJson({ collection: LEDGER_DELTAS_COLLECTION, id: paddedIndex(index) }, envelope, dek);
@@ -681,7 +677,7 @@ var LedgerStore = class {
   /** Decrypt an envelope into a LedgerEntry. Throws on bad key / tamper. */
   async decryptEntry(key, envelope) {
     if (!this.encrypted) {
-      return JSON.parse(envelope._data);
+      return JSON.parse(envelope._data ?? "");
     }
     const dek = await this.getDEK(LEDGER_COLLECTION);
     const json = await openEnvelopeJson({ collection: LEDGER_COLLECTION, id: key }, envelope, dek);
@@ -699,4 +695,4 @@ export {
   applyPatch,
   LedgerStore
 };
-//# sourceMappingURL=chunk-ZXABPVM6.js.map
+//# sourceMappingURL=chunk-L2F3CFCH.js.map