@noy-db/hub 0.8.0 → 0.9.0-pre.0

package/dist/capsule/contract.js

@@ -1,12 +1,12 @@
 import {
   CapsuleNotSupportedError,
   assertCapsuleSupports
-} from "../chunk-OIEO4WDL.js";
+} from "../chunk-ZBUAX4EF.js";
 import {
   generateSigningKeyPair,
   signBytes,
   verifyBytes
-} from "../chunk-Q2XRFWOI.js";
+} from "../chunk-SPPOUJLN.js";
 import {
   evaluateKofN
 } from "../chunk-NH2UOV3B.js";
@@ -29,7 +29,7 @@ import {
   recordAadFor,
   requireSealedBody,
   sealedBodyArgs
-} from "../chunk-42ALPZ2B.js";
+} from "../chunk-OM3SEDI4.js";
 import {
   KEY_BITS,
   base64ToBuffer,
@@ -47,9 +47,9 @@ import {
   normalizeForVerify,
   sha256Bytes,
   sha256Hex
-} from "../chunk-QMWY2FDS.js";
-import "../chunk-SV2PM2OY.js";
-import "../chunk-37EPTBBR.js";
+} from "../chunk-PUBI455O.js";
+import "../chunk-2ELOCEXE.js";
+import "../chunk-VSUQI5Q6.js";
 export {
   CapsuleNotSupportedError,
   KEY_BITS,

package/dist/capsule/enclave-aes/broker/proof.d.ts

@@ -69,11 +69,18 @@
 import type { EnclaveKey } from '../crypto.js';
 /** HKDF salt domain for the broker proof key — also the first `info` array element. */
 export declare const BROKER_PROOF_DOMAIN = "noydb-broker-proof";
-/** MAC version tag — the first element of the `canonical` array signed/verified. */
+/** MAC version tag — the first element of the `canonical` array signed/verified (admin shared seed). */
 export declare const BROKER_PROOF_VERSION = "noydb-broker-proof-v1";
+/** The member identity bound into a v2 canonical and into the HKDF info (core#73). */
+export interface BrokerMemberIdentity {
+    readonly userId: string;
+    readonly role: string;
+}
 /** The canonical-binding fields a client supplies alongside `vaultId`/`brokerId` (spec §2 step 3). */
 export interface BrokerProofCanonicalParts {
     readonly endpointOrigin: string;
+    /** Present ⇒ a member proof (canonical v2, member-scoped HKDF); absent ⇒ the admin shared seed (v1). */
+    readonly member?: BrokerMemberIdentity | undefined;
     readonly profile?: string | undefined;
     readonly instancePid?: string | undefined;
     readonly challenge: string;
@@ -97,6 +104,8 @@ export interface VerifyBrokerProofArgs {
     readonly vaultId: string;
     readonly endpointOrigin: string;
     readonly brokerId: string;
+    /** The member the `registeredProofKey` was registered FOR; the host supplies its own record, never the client's claim. */
+    readonly member?: BrokerMemberIdentity | undefined;
     readonly profile?: string | undefined;
     readonly instancePid?: string | undefined;
     readonly challenge: string;
@@ -110,14 +119,14 @@ export interface VerifyBrokerProofArgs {
  * value registered with the broker host once at enrol (spec §2 step 2/3).
  * Does not mutate or zero `seed`; the caller owns the seed's lifecycle.
  */
-export declare function deriveBrokerProofBits(seed: Uint8Array, vaultId: string, brokerId: string): Promise<Uint8Array>;
+export declare function deriveBrokerProofBits(seed: Uint8Array, vaultId: string, brokerId: string, memberUserId?: string): Promise<Uint8Array>;
 /**
  * Derive the steady-state, non-extractable `['sign']` HMAC proof key from
  * the `_broker` seed. Zeroes the transient HKDF-output bytes in a `finally`
  * once the key has been imported (F5) — the raw bits never leave this
  * function in usable form after import.
  */
-export declare function deriveBrokerProofKey(seed: Uint8Array, vaultId: string, brokerId: string): Promise<EnclaveKey>;
+export declare function deriveBrokerProofKey(seed: Uint8Array, vaultId: string, brokerId: string, memberUserId?: string): Promise<EnclaveKey>;
 /**
  * Compose derive + sign for the client: re-derive the proof key from the
  * seed and sign the canonical over `canonicalParts` (spec §2 step 3).

package/dist/capsule/enclave-aes/index.d.ts

@@ -106,7 +106,7 @@ export { evaluateKofN } from '../plumbing/kofn.js';
 export { deriveClassifyIndexKey, deriveClassifyIndexSalt, mintBidxTag } from './classify/bidx.js';
 export { computeBidxTarget } from './classify/find.js';
 export { deriveBrokerProofBits, deriveBrokerProofKey, computeBrokerProof, issueChallenge, verifyBrokerProof, } from './broker/proof.js';
-export type { BrokerProofCanonicalParts, VerifyBrokerProofArgs, IssuedChallenge } from './broker/proof.js';
+export type { BrokerProofCanonicalParts, BrokerMemberIdentity, VerifyBrokerProofArgs, IssuedChallenge } from './broker/proof.js';
 export { generateSigningKeyPair, signBytes, verifyBytes } from '../plumbing/sign.js';
 export type { EnclaveKeyPair } from './crypto.js';
 export { generateRecipientKeyPair, exportRecipientPublicKeySpki, importRecipientPublicKeySpki, recipientWrap, recipientUnwrap, } from './crypto.js';

package/dist/capsule/enclave-aes/index.js

@@ -1,6 +1,6 @@
 import {
   computeBidxTarget
-} from "../../chunk-BNWA3WG5.js";
+} from "../../chunk-JZ4EDEIP.js";
 import {
   aesCapsule,
   checkCanary,
@@ -35,18 +35,18 @@ import {
   unwrapKey,
   wrapCek,
   wrapKey
-} from "../../chunk-5KC7QYEC.js";
+} from "../../chunk-CB4467G3.js";
 import {
   deriveClassifyIndexKey,
   deriveClassifyIndexSalt,
   mintBidxTag,
   pbkdf2VerifyDigest
-} from "../../chunk-EZOAKKTB.js";
+} from "../../chunk-ABU6A4Z5.js";
 import {
   generateSigningKeyPair,
   signBytes,
   verifyBytes
-} from "../../chunk-Q2XRFWOI.js";
+} from "../../chunk-SPPOUJLN.js";
 import {
   evaluateKofN
 } from "../../chunk-NH2UOV3B.js";
@@ -67,7 +67,7 @@ import {
   recordAadFor,
   requireSealedBody,
   sealedBodyArgs
-} from "../../chunk-42ALPZ2B.js";
+} from "../../chunk-OM3SEDI4.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -83,18 +83,33 @@ import {
   hmacSignHex,
   sha256Bytes,
   sha256Hex
-} from "../../chunk-QMWY2FDS.js";
-import "../../chunk-SV2PM2OY.js";
+} from "../../chunk-PUBI455O.js";
+import "../../chunk-2ELOCEXE.js";
 import {
   ValidationError
-} from "../../chunk-37EPTBBR.js";
+} from "../../chunk-VSUQI5Q6.js";
 
 // src/capsule/enclave-aes/broker/proof.ts
 var subtle = globalThis.crypto.subtle;
 var BROKER_PROOF_DOMAIN = "noydb-broker-proof";
 var BROKER_PROOF_VERSION = "noydb-broker-proof-v1";
+var BROKER_PROOF_MEMBER_VERSION = "noydb-broker-proof-v2";
 var DEFAULT_CHALLENGE_TTL_MS = 6e4;
 function buildCanonical(vaultId, brokerId, parts) {
+  if (parts.member) {
+    return JSON.stringify([
+      BROKER_PROOF_MEMBER_VERSION,
+      vaultId,
+      parts.endpointOrigin,
+      brokerId,
+      parts.member.userId,
+      parts.member.role,
+      parts.profile ?? "",
+      parts.instancePid ?? "",
+      parts.challenge,
+      parts.expiresAt
+    ]);
+  }
   return JSON.stringify([
     BROKER_PROOF_VERSION,
     vaultId,
@@ -106,15 +121,17 @@ function buildCanonical(vaultId, brokerId, parts) {
     parts.expiresAt
   ]);
 }
-async function deriveBrokerProofBits(seed, vaultId, brokerId) {
+async function deriveBrokerProofBits(seed, vaultId, brokerId, memberUserId) {
   const hkdfKey = await subtle.importKey("raw", seed, "HKDF", false, ["deriveBits"]);
   const salt = new TextEncoder().encode(BROKER_PROOF_DOMAIN);
-  const info = new TextEncoder().encode(JSON.stringify([BROKER_PROOF_DOMAIN, vaultId, brokerId]));
+  const info = new TextEncoder().encode(JSON.stringify(
+    memberUserId === void 0 ? [BROKER_PROOF_DOMAIN, vaultId, brokerId] : [BROKER_PROOF_DOMAIN, vaultId, brokerId, memberUserId]
+  ));
   const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info }, hkdfKey, 256);
   return new Uint8Array(bits);
 }
-async function deriveBrokerProofKey(seed, vaultId, brokerId) {
-  const proofBits = await deriveBrokerProofBits(seed, vaultId, brokerId);
+async function deriveBrokerProofKey(seed, vaultId, brokerId, memberUserId) {
+  const proofBits = await deriveBrokerProofBits(seed, vaultId, brokerId, memberUserId);
   try {
     return await subtle.importKey("raw", proofBits, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
   } finally {
@@ -129,7 +146,7 @@ async function computeBrokerProof(seed, vaultId, brokerId, canonicalParts) {
       );
     }
     const canonical = buildCanonical(vaultId, brokerId, canonicalParts);
-    const key = await deriveBrokerProofKey(seed, vaultId, brokerId);
+    const key = await deriveBrokerProofKey(seed, vaultId, brokerId, canonicalParts.member?.userId);
     const mac = await subtle.sign("HMAC", key, new TextEncoder().encode(canonical));
     return bufferToBase64(new Uint8Array(mac));
   } finally {
@@ -150,6 +167,7 @@ async function verifyBrokerProof(args) {
   if (args.instancePid === "") return false;
   const canonical = buildCanonical(args.vaultId, args.brokerId, {
     endpointOrigin: args.endpointOrigin,
+    member: args.member,
     profile: args.profile,
     instancePid: args.instancePid,
     challenge: args.challenge,
@@ -194,7 +212,15 @@ var ALL = sealedSet([
   "codec",
   "sealing",
   "deterministic",
-  "classify"
+  "classify",
+  // ⭐ ADDED 2026-09-16 (core#42). `enclave-aes` implements `wrapCek` and
+  // `unwrapCek`, so advertising the group is the truthful `capabilities()`.
+  // The nine-member set was the REFERENCE capsule under-reporting itself:
+  // "supports every group" was the documented intent above, and it had been
+  // untrue since `per-record-keys` existed as a refusable thing.
+  // ⛔ This is a published behaviour change — `capabilities()` returns one
+  // more member to any consumer that inspects it. Release-noted by name.
+  "per-record-keys"
 ]);
 function capabilities() {
   return ALL;

package/dist/capsule/enclave-aes/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/capsule/enclave-aes/broker/proof.ts","../../../src/capsule/enclave-aes/capabilities.ts","../../../src/capsule/enclave-aes/index.ts"],"sourcesContent":["/**\n * Credential-broker proof crypto (#479, credential-broker spec §3).\n *\n * The `_broker` seed (32 random bytes, decrypted from `_broker/<brokerId>` by\n * the party layer) is never transmitted. Instead, a **proof key** is\n * HKDF-derived from it, domain-separated per `(vaultId, brokerId)`, and the\n * derived bits are registered with the broker host once at enrol. Steady\n * state, the client re-derives the same key from the seed and signs a\n * **canonical** string binding the request's identity/context, so the broker\n * can verify a fresh HMAC on every mint without ever holding the seed itself.\n *\n * ## Derivation (spec §3, follow verbatim)\n *\n * ```\n * hkdf      = importKey('raw', seed, 'HKDF', false, ['deriveBits'])\n * proofBits = deriveBits({ name:'HKDF', hash:'SHA-256',\n *                          salt: utf8(BROKER_PROOF_DOMAIN),\n *                          info: utf8(JSON.stringify([BROKER_PROOF_DOMAIN, vaultId, brokerId])) },\n *                        hkdf, 256)\n * proofKey  = importKey('raw', proofBits, { name:'HMAC', hash:'SHA-256' }, false, ['sign'])\n * proof     = base64(sign('HMAC', proofKey, utf8(canonical)))\n * ```\n *\n * `BROKER_PROOF_DOMAIN` is both the HKDF salt and the first `info` array\n * element (the injective-JSON-array convention `deriveClassifyIndexKey`\n * established — see `classify/bidx.ts`). `BROKER_PROOF_VERSION` is the\n * separate MAC version tag, the first element of the `canonical` array.\n *\n * ## Canonical (spec §2 step 3)\n *\n * `JSON.stringify([BROKER_PROOF_VERSION, vaultId, endpointOrigin, brokerId,\n * profile ?? '', instancePid ?? '', challenge, expiresAt])` — every binding\n * field folded into ONE MAC input:\n *  - `vaultId` (V1), `challenge` (V3), `expiresAt` (V4) — verbatim strings,\n *    never reparsed/reformatted (F8): a byte-identical ISO string is\n *    required, so e.g. `Z` vs `+00:00` for the same instant fails.\n *  - `profile ?? ''` (F1) — a proof captured at one profile cannot be\n *    replayed at another.\n *  - `endpointOrigin` (F4) — a proof cannot be relayed to a different broker\n *    endpoint reusing the same `brokerId`.\n *  - `instancePid ?? ''` (F7) — an EMPTY STRING `instancePid` is forbidden in\n *    both {@link computeBrokerProof} and {@link verifyBrokerProof}: absent\n *    (the field omitted) and `''` must stay distinguishable, or `?? ''`\n *    would alias \"no instance\" onto a real registered instance.\n *\n * ## Verify order (spec §3, non-negotiable, F2/F6)\n *\n * {@link verifyBrokerProof} MUST, in this exact order: (1) burn the challenge\n * via `consumeChallenge` FIRST and short-circuit `false` before any MAC work\n * (F2 — burn-on-presentation, not burn-on-success); (2) recompute the\n * canonical and compare with `crypto.subtle.verify('HMAC', …)` — portable,\n * constant-time, never a manual byte compare or Node `timingSafeEqual` (F6);\n * (3) assert `now < expiresAt` — the client clock is never trusted, so this\n * check only matters once the MAC (which covers `expiresAt`) has verified.\n *\n * ## Zeroing (F5)\n *\n * `seed` and the transient HKDF output are raw, durable secret material —\n * the `recovery.ts:276-307` `try{}finally{secret.fill(0)}` discipline, not\n * the ephemeral-CEK happy-path zeroing elsewhere. {@link computeBrokerProof}\n * zeroes the `seed` argument in a `finally` on every path including a throw;\n * {@link deriveBrokerProofKey} zeroes its own transient HKDF-output bytes the\n * same way. {@link deriveBrokerProofBits} does not zero `seed` — it exists\n * so the party layer can register the raw bits at one-time enrol (the value\n * that must survive the call to be base64-encoded and POSTed).\n *\n * @module\n */\nimport type { EnclaveKey } from '../crypto.js'\nimport { base64ToBuffer, bufferToBase64 } from '../../plumbing/digest.js'\nimport { ValidationError } from '../../../kernel/errors.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/** HKDF salt domain for the broker proof key — also the first `info` array element. */\nexport const BROKER_PROOF_DOMAIN = 'noydb-broker-proof'\n\n/** MAC version tag — the first element of the `canonical` array signed/verified. */\nexport const BROKER_PROOF_VERSION = 'noydb-broker-proof-v1'\n\n/** Default challenge TTL (spec §2 step 2: \"TTL ≤ 60 s\"). */\nconst DEFAULT_CHALLENGE_TTL_MS = 60_000\n\n/** The canonical-binding fields a client supplies alongside `vaultId`/`brokerId` (spec §2 step 3). */\nexport interface BrokerProofCanonicalParts {\n  readonly endpointOrigin: string\n  readonly profile?: string | undefined\n  readonly instancePid?: string | undefined\n  readonly challenge: string\n  readonly expiresAt: string\n}\n\n/** A freshly-minted, server-random single-use challenge (spec §2 step 2). */\nexport interface IssuedChallenge {\n  readonly challenge: string\n  readonly expiresAt: string\n}\n\n/** Arguments the broker host passes to verify a submitted proof (spec §3). */\nexport interface VerifyBrokerProofArgs {\n  /**\n   * Atomically test-and-delete the challenge, returning whether it was still\n   * fresh (unconsumed and unexpired-from-the-store's-perspective). MUST burn\n   * on presentation, not on successful verification (F2).\n   */\n  readonly consumeChallenge: (challenge: string) => Promise<boolean>\n  /** The registered proof key's raw bytes, already KMS-unwrapped by the host (§7). */\n  readonly registeredProofKey: Uint8Array\n  readonly vaultId: string\n  readonly endpointOrigin: string\n  readonly brokerId: string\n  readonly profile?: string | undefined\n  readonly instancePid?: string | undefined\n  readonly challenge: string\n  readonly expiresAt: string\n  /** base64(HMAC-SHA-256(proofKey, canonical)), as submitted by the client. */\n  readonly proof: string\n}\n\n/** Build the canonical MAC input verbatim — never reparses/reformats a field (F8). */\nfunction buildCanonical(vaultId: string, brokerId: string, parts: BrokerProofCanonicalParts): string {\n  return JSON.stringify([\n    BROKER_PROOF_VERSION,\n    vaultId,\n    parts.endpointOrigin,\n    brokerId,\n    parts.profile ?? '',\n    parts.instancePid ?? '',\n    parts.challenge,\n    parts.expiresAt,\n  ])\n}\n\n/**\n * The HKDF step: derive the 256-bit proof bits from the `_broker` seed,\n * domain-separated per `(vaultId, brokerId)`. Returns the raw bits — the\n * value registered with the broker host once at enrol (spec §2 step 2/3).\n * Does not mutate or zero `seed`; the caller owns the seed's lifecycle.\n */\nexport async function deriveBrokerProofBits(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n): Promise<Uint8Array> {\n  const hkdfKey = await subtle.importKey('raw', seed as BufferSource, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(BROKER_PROOF_DOMAIN)\n  const info = new TextEncoder().encode(JSON.stringify([BROKER_PROOF_DOMAIN, vaultId, brokerId]))\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, 256)\n  return new Uint8Array(bits)\n}\n\n/**\n * Derive the steady-state, non-extractable `['sign']` HMAC proof key from\n * the `_broker` seed. Zeroes the transient HKDF-output bytes in a `finally`\n * once the key has been imported (F5) — the raw bits never leave this\n * function in usable form after import.\n */\nexport async function deriveBrokerProofKey(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n): Promise<EnclaveKey> {\n  const proofBits = await deriveBrokerProofBits(seed, vaultId, brokerId)\n  try {\n    return await subtle.importKey('raw', proofBits as BufferSource, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n  } finally {\n    proofBits.fill(0)\n  }\n}\n\n/**\n * Compose derive + sign for the client: re-derive the proof key from the\n * seed and sign the canonical over `canonicalParts` (spec §2 step 3).\n *\n * Rejects an empty-string `instancePid` (F7 — absent is fine, `''` is not).\n * Zeroes the `seed` argument in a `finally` on EVERY path including a throw\n * (F5, durable-secret discipline) — the transient HKDF bits are zeroed one\n * layer down, inside {@link deriveBrokerProofKey}.\n */\nexport async function computeBrokerProof(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n  canonicalParts: BrokerProofCanonicalParts,\n): Promise<string> {\n  try {\n    if (canonicalParts.instancePid === '') {\n      throw new ValidationError(\n        \"computeBrokerProof: instancePid must not be an empty string — omit the field entirely for \" +\n          \"'no instance' (F7); '' would alias onto a registered instance.\",\n      )\n    }\n    const canonical = buildCanonical(vaultId, brokerId, canonicalParts)\n    const key = await deriveBrokerProofKey(seed, vaultId, brokerId)\n    const mac = await subtle.sign('HMAC', key, new TextEncoder().encode(canonical) as BufferSource)\n    return bufferToBase64(new Uint8Array(mac))\n  } finally {\n    seed.fill(0)\n  }\n}\n\n/**\n * Host-side nonce mint: 32 random bytes, base64-encoded, plus an ISO\n * `expiresAt` at most `ttlMs` (default 60 s) in the future. The caller\n * (the broker host) persists both returned strings **verbatim** and MACs\n * those exact bytes on verify — never a reparsed/reformatted copy (F8).\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const ttlMs = opts?.ttlMs ?? DEFAULT_CHALLENGE_TTL_MS\n  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  return {\n    challenge: bufferToBase64(bytes),\n    expiresAt: new Date(Date.now() + ttlMs).toISOString(),\n  }\n}\n\n/**\n * Verify a submitted broker proof. Order is NON-NEGOTIABLE (spec §3):\n *\n * 1. `await consumeChallenge(challenge)` FIRST — burn-and-check-fresh; a\n *    not-fresh (already-consumed or unknown) challenge short-circuits to\n *    `false` before any MAC work (F2).\n * 2. Empty-string `instancePid` is rejected (F7), then the canonical is\n *    recomputed over the verbatim `endpointOrigin`/`brokerId`/`profile`/\n *    `instancePid`/`challenge`/`expiresAt` and compared via\n *    `crypto.subtle.verify('HMAC', …)` — portable, constant-time, never a\n *    manual compare or Node `timingSafeEqual` (F6).\n * 3. `now < expiresAt` — the client clock is never trusted; `expiresAt`\n *    rides inside the already-verified MAC (F4/F8).\n */\nexport async function verifyBrokerProof(args: VerifyBrokerProofArgs): Promise<boolean> {\n  const fresh = await args.consumeChallenge(args.challenge)\n  if (!fresh) return false\n\n  if (args.instancePid === '') return false\n\n  const canonical = buildCanonical(args.vaultId, args.brokerId, {\n    endpointOrigin: args.endpointOrigin,\n    profile: args.profile,\n    instancePid: args.instancePid,\n    challenge: args.challenge,\n    expiresAt: args.expiresAt,\n  })\n  const key = await subtle.importKey(\n    'raw',\n    args.registeredProofKey as BufferSource,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['verify'],\n  )\n  const ok = await subtle.verify(\n    'HMAC',\n    key,\n    base64ToBuffer(args.proof) as BufferSource,\n    new TextEncoder().encode(canonical) as BufferSource,\n  )\n  if (!ok) return false\n\n  return Date.now() < Date.parse(args.expiresAt)\n}\n","import type { CapsuleGroup } from '../contract.js'\n\n/**\n * `enclave-aes` supports every group. It is the REFERENCE capsule — the\n * behaviour every other implementation is compared against, and the one hub\n * ships so that `npm install @noy-db/hub` alone is a working noy-db.\n *\n * An `exclave-*` refuses `authenticate` and `seal` (no secret, no key\n * hierarchy — the store's own IAM is the authority) and may refuse the\n * optional groups. That asymmetry is what the prefix means, and the\n * conformance suite asserts it from the package name rather than trusting a\n * declaration.\n *\n * Frozen so a caller cannot edit what a capsule claims to support: a mutable\n * set would let a service \"enable\" a group by adding to it, which is exactly\n * the confidently-wrong failure the typed refusal exists to prevent.\n */\n/**\n * ⛔ `Object.freeze` does NOT make a Set immutable — it guards own properties,\n * not internal slots, so `frozen.add(x)` still succeeds. Measured 2026-09-12,\n * against a test that asserted otherwise and failed. The mutators are replaced\n * so the refusal is real at runtime, not just in the type.\n *\n * Why it has to be real: a caller holding a mutable capability set can \"enable\"\n * a group the capsule does not implement, and the next thing that happens is a\n * primitive being called on a capsule that has none. `ReadonlySet` alone is a\n * compile-time claim, and a JS consumer never sees it.\n */\nfunction sealedSet<T>(items: readonly T[]): ReadonlySet<T> {\n  const set = new Set<T>(items)\n  const refuse = (): never => {\n    throw new TypeError(\n      'capabilities() is immutable — a capsule\\'s declared groups cannot be edited by a caller',\n    )\n  }\n  set.add = refuse as never\n  set.delete = refuse as never\n  set.clear = refuse as never\n  return Object.freeze(set)\n}\n\nconst ALL: ReadonlySet<CapsuleGroup> = sealedSet<CapsuleGroup>([\n  'authenticate',\n  'seal',\n  'cipher',\n  'digest',\n  'sign',\n  'codec',\n  'sealing',\n  'deterministic',\n  'classify',\n])\n\nexport function capabilities(): ReadonlySet<CapsuleGroup> {\n  return ALL\n}\n","/**\n * **capsule/enclave-aes** — the hub's crypto interior, behind one door.\n *\n * This barrel is **the fork-swap contract**: a sister project that wants a\n * different crypto engine (a different KDF, a hardware-backed keystore, a\n * post-quantum wrap algorithm, …) replaces the entire `capsule/enclave-aes/`\n * folder wholesale and only has to honor the exports below. Nothing outside\n * `capsule/enclave-aes/**` may deep-import `crypto.js` or `record-keys/*` directly\n * — `scripts/check-architecture.mjs`'s `enclave-barrel-only` check enforces\n * that mechanically. Import sites inside `capsule/enclave-aes/**` keep their\n * existing relative imports; this door is for everyone else.\n *\n * The export list is the OBSERVED contract — exactly the symbols consumed\n * from outside this folder today — grouped by the module that defines them:\n *\n *   - key type       — `crypto.ts`: `EnclaveKey`, the opaque key type every\n *                       barrel-facing signature traffics in (`= CryptoKey` in\n *                       noy-db's reference enclave; a fork redefines it to its\n *                       own key representation — see the type's own doc for\n *                       the fork contract).\n *   - crypto ops     — `crypto.ts`: AES-256-GCM encrypt/decrypt (+ bytes, AAD,\n *                       deterministic variants), SHA-256 / HMAC-SHA-256 hashing.\n *   - key lifecycle  — `crypto.ts` + `record-keys/lifecycle.ts`: KEK/DEK\n *                       derivation, AES-KW wrap/unwrap, per-record CEK\n *                       wrap/unwrap/import + resolution/re-wrap, HKDF-derived\n *                       presence/sealed-field keys, base64 helpers.\n *   - record codec   — `record-keys/record-codec.ts`: the per-record\n *                       encode/decode engine.\n *   - sealing        — `record-keys/sealing.ts`: the sealed-record grantor\n *                       primitives (seal/revoke/rotate to an `at-*` host).\n *   - deterministic  — `record-keys/deterministic.ts`: blind-equality lookup\n *                       over deterministically-encrypted fields.\n *   - tombstone      — `record-keys/tombstone.ts`: the erased-record residue.\n *   - envelope body  — `record-keys/envelope-body.ts`: the C1 protected-body\n *                       access contract (`openEnvelopeJson`,\n *                       `writeEnvelopeBody`, `hasPerRecordKey`,\n *                       `hasSealedBody`, `envelopeBodyForHash`) — the\n *                       sanctioned door onto\n *                       `_iv`/`_data`/`_cek`/`_sealed` for everyone outside\n *                       this folder.\n *   - reserved envelopes — `plumbing/sealed-slots.ts`: `makeReservedEnvelopes`,\n *                       the whole-envelope encrypt/decrypt door scoped to a\n *                       declared collection-name prefix (e.g. `_dict_`) —\n *                       `kernel/vault.ts` binds it for `DictionaryHandle`\n *                       (#629 Task 4).\n *\n * Additive changes only — removing or renaming an export here is breaking\n * for any fork. Frozen by `__tests__/enclave-surface-golden.test.ts`.\n *\n * **Refusal contract:** the barrel above is frozen — every symbol must\n * exist in any fork — but the optional groups (sealing, deterministic,\n * per-record-key lifecycle) MAY throw `EnclaveNotSupportedError` instead\n * of implementing the reference behavior. The core groups (crypto ops,\n * record codec, tombstone) MUST NOT throw it — they are load-bearing for\n * every consumer regardless of which enclave is wired in. noy-db's own\n * enclave supports every group, so it never throws this error.\n */\n\nimport { aesCapsule } from './bound.js'\n\n// ─── key type ──────────────────────────────────────────────────────\nexport type { EnclaveKey, EncryptResult } from './crypto.js'\n\n// ─── crypto ops ────────────────────────────────────────────────────\nexport {\n  encrypt,\n  decrypt,\n  encryptBytes,\n  decryptBytes,\n  encryptBytesWithAAD,\n  decryptBytesWithAAD,\n  encryptDeterministic,\n  decryptDeterministic,\n} from './crypto.js'\n\n// ─── key lifecycle ─────────────────────────────────────────────────\nexport {\n  deriveKey,\n  deriveSecretKey,\n  generateDEK,\n  generateEphemeralKey,\n  importTransferKey,\n  exportDekSet,\n  importDekSet,\n  wrapKey,\n  unwrapKey,\n  mintCanary,\n  checkCanary,\n  deriveDeterministicKey,\n  deriveSealedFieldKey,\n  deriveSealedFieldKeyFromCek,\n  wrapCek,\n  unwrapCek,\n  importCek,\n  deriveEchoKey,\n} from './crypto.js'\nexport type { SecretKeyUsage } from './crypto.js'\n// ─── shared plumbing ───────────────────────────────────────────────\n//\n// Everything from here to the end of this block used to be twelve modules\n// under `./record-keys/`. They now live once in `../plumbing/`, and this\n// capsule is one of two callers of `makeCapsule()`.\n//\n// The split below is not cosmetic. The cipher-FREE half is re-exported\n// straight from its module: it inspects envelope fields and derives hash\n// input, so there is nothing to bind and every capsule gets the identical\n// function. The cipher-BOUND half is destructured off `aesCapsule`, which is\n// `makeCapsule(aesPrimitives)` — one binding for the whole capsule, so a value\n// exported here and a value used inside `classify/**` are the SAME object.\nexport {\n  buildRecordAad,\n  recordAadFor,\n  buildRecordEnvelope,\n  isTombstone,\n  isTombstoneShape,\n  buildTombstone,\n  isDeleteMarker,\n  buildDeleteMarker,\n  requireSealedBody,\n  sealedBodyArgs,\n  envelopeBodySize,\n  hasPerRecordKey,\n  envelopeBodyForHash,\n  hasSealedBody,\n} from '../plumbing/index.js'\n// ─── digest group ──────────────────────────────────────────────────\n// Shared, not AES-specific: the seam design marks `digest` \"as today\" for every\n// capsule. Re-exported here so the barrel's surface is unchanged.\nexport {\n  sha256Hex,\n  sha256Bytes,\n  hmacSha256Hex,\n  hmacSignHex,\n  hkdfAesGcmKey,\n  deriveBlobAddressKey,\n  derivePresenceKey,\n  derivePresenceTagKey,\n  generateIV,\n  generateSalt,\n  generateRecoverySecret,\n  bufferToBase64,\n  base64ToBuffer,\n  encodeEchoParts,\n} from '../plumbing/digest.js'\nexport type { EchoSecretParts } from '../plumbing/digest.js'\nexport type { RecordIdentity, RecordRef } from '../plumbing/index.js'\nimport type { RecordCodecBase } from '../plumbing/record-codec.js'\n/**\n * `RecordCodec` is a VALUE (the capsule-bound subclass, destructured below) and\n * a TYPE (the module-level generic base). A type ALIAS can coexist with a value\n * of the same name; a `export type { RecordCodec }` RE-EXPORT cannot, which is\n * what `TS2323: Cannot redeclare exported variable` was saying.\n */\nexport type RecordCodec<T = Record<string, unknown>> = RecordCodecBase<T>\nexport { buildSealedRecordEnvelope } from '../plumbing/record-envelope.js'\nexport type { RecordEnvelopeBody } from '../plumbing/record-envelope.js'\nexport type { RewrappedBody } from '../plumbing/lifecycle.js'\nexport type { SealedShredSlot } from '../plumbing/record-codec.js'\nexport type { SealingContext } from '../plumbing/sealing.js'\nexport type { DeterministicContext } from '../plumbing/deterministic.js'\n\nexport const {\n  // envelope body\n  openEnvelopeJson,\n  writeEnvelopeBody,\n  verifyRecordIdentity,\n  // key lifecycle\n  resolveStableCek,\n  rewrapBodyToDek,\n  rewrapEnvelope,\n  applyRewrappedBody,\n  isRewrappedUnder,\n  // rekey\n  rekeyEnvelopeToDek,\n  rekeyEnvelopeIfNeeded,\n  envelopeOpensUnderAny,\n  rekeyBlobSet,\n  // record codec\n  RecordCodec,\n  // sealed slots — ONLY `makeReservedEnvelopes` is part of the frozen surface.\n  // The other seven are capsule-internal; destructuring the whole capsule here\n  // leaked them and widened the golden by 8 names. A surface is a contract, so\n  // the fix is to narrow the barrel, not to re-baseline the golden.\n  makeReservedEnvelopes,\n  // sealing\n  SEALED_CEK_NS,\n  sealRecordToHost,\n  revokeSealedRecord,\n  rotateRecordCek,\n  // deterministic\n  findByDet,\n  queryByDet,\n} = aesCapsule\n\n// ─── reserved envelopes (ViaCryptoCtx.reservedEnvelopes capability) ──\n\n// ─── classify (stage-2 verify oracle primitives) ────────────────────\n// ADDITIVE per Enclave Contract v1. A fork must provide these four; the\n// verify/matchGroup orchestration (classify/verify.ts) sits behind the\n// with-shape dynamic-import seam and is not part of the fork contract.\nexport { deriveVdigSlotKey } from './classify/vdig.js'\nexport { pbkdf2VerifyDigest } from './classify/digest.js'\nexport { ctEqualTags } from '../plumbing/ct-equal.js'\nexport { evaluateKofN } from '../plumbing/kofn.js'\n\n// ─── classify (slice-2b equatable blind index) ──────────────────────\n// ADDITIVE per Enclave Contract v1. A fork must provide these four; the\n// findByDigest orchestration (collection.ts) sits behind the with-shape\n// dynamic-import seam and is not part of the fork contract.\nexport { deriveClassifyIndexKey, deriveClassifyIndexSalt, mintBidxTag } from './classify/bidx.js'\nexport { computeBidxTarget } from './classify/find.js'\n\n// ─── broker (proof derivation + challenge/verify, #479 slice 2) ─────\n// ADDITIVE per Enclave Contract v1. A fork must provide these five; the\n// seed lifecycle + network/cache orchestration (with-party/broker/**) sits\n// behind its own dynamic-import seam and is not part of the fork contract.\nexport {\n  deriveBrokerProofBits,\n  deriveBrokerProofKey,\n  computeBrokerProof,\n  issueChallenge,\n  verifyBrokerProof,\n} from './broker/proof.js'\nexport type { BrokerProofCanonicalParts, VerifyBrokerProofArgs, IssuedChallenge } from './broker/proof.js'\n\n// ─── sign ─────────────────────────────────────────────────────────────\nexport { generateSigningKeyPair, signBytes, verifyBytes } from '../plumbing/sign.js'\n\n// ─── recipient sealing ────────────────────────────────────────────────\nexport type { EnclaveKeyPair } from './crypto.js'\nexport {\n  generateRecipientKeyPair,\n  exportRecipientPublicKeySpki,\n  importRecipientPublicKeySpki,\n  recipientWrap,\n  recipientUnwrap,\n} from './crypto.js'\n\n// ─── capabilities ─────────────────────────────────────────────────────\n// What THIS capsule supports. Part of the contract every capsule implements,\n// not an enclave-aes detail — an alternative declares its own, and a service\n// asserts against it at createNoydb() rather than failing on first write.\nexport { capabilities } from './capabilities.js'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwEA,IAAM,SAAS,WAAW,OAAO;AAG1B,IAAM,sBAAsB;AAG5B,IAAM,uBAAuB;AAGpC,IAAM,2BAA2B;AAuCjC,SAAS,eAAe,SAAiB,UAAkB,OAA0C;AACnG,SAAO,KAAK,UAAU;AAAA,IACpB;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,MAAM,WAAW;AAAA,IACjB,MAAM,eAAe;AAAA,IACrB,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AACH;AAQA,eAAsB,sBACpB,MACA,SACA,UACqB;AACrB,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,MAAsB,QAAQ,OAAO,CAAC,YAAY,CAAC;AACjG,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,mBAAmB;AACzD,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,qBAAqB,SAAS,QAAQ,CAAC,CAAC;AAC9F,QAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,GAAG;AAChG,SAAO,IAAI,WAAW,IAAI;AAC5B;AAQA,eAAsB,qBACpB,MACA,SACA,UACqB;AACrB,QAAM,YAAY,MAAM,sBAAsB,MAAM,SAAS,QAAQ;AACrE,MAAI;AACF,WAAO,MAAM,OAAO,UAAU,OAAO,WAA2B,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AAAA,EACpH,UAAE;AACA,cAAU,KAAK,CAAC;AAAA,EAClB;AACF;AAWA,eAAsB,mBACpB,MACA,SACA,UACA,gBACiB;AACjB,MAAI;AACF,QAAI,eAAe,gBAAgB,IAAI;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,YAAY,eAAe,SAAS,UAAU,cAAc;AAClE,UAAM,MAAM,MAAM,qBAAqB,MAAM,SAAS,QAAQ;AAC9D,UAAM,MAAM,MAAM,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,SAAS,CAAiB;AAC9F,WAAO,eAAe,IAAI,WAAW,GAAG,CAAC;AAAA,EAC3C,UAAE;AACA,SAAK,KAAK,CAAC;AAAA,EACb;AACF;AAQO,SAAS,eAAe,MAA4C;AACzE,QAAM,QAAQ,MAAM,SAAS;AAC7B,QAAM,QAAQ,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAClE,SAAO;AAAA,IACL,WAAW,eAAe,KAAK;AAAA,IAC/B,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,EAAE,YAAY;AAAA,EACtD;AACF;AAgBA,eAAsB,kBAAkB,MAA+C;AACrF,QAAM,QAAQ,MAAM,KAAK,iBAAiB,KAAK,SAAS;AACxD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI,KAAK,gBAAgB,GAAI,QAAO;AAEpC,QAAM,YAAY,eAAe,KAAK,SAAS,KAAK,UAAU;AAAA,IAC5D,gBAAgB,KAAK;AAAA,IACrB,SAAS,KAAK;AAAA,IACd,aAAa,KAAK;AAAA,IAClB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,EAClB,CAAC;AACD,QAAM,MAAM,MAAM,OAAO;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,IACL,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AACA,QAAM,KAAK,MAAM,OAAO;AAAA,IACtB;AAAA,IACA;AAAA,IACA,eAAe,KAAK,KAAK;AAAA,IACzB,IAAI,YAAY,EAAE,OAAO,SAAS;AAAA,EACpC;AACA,MAAI,CAAC,GAAI,QAAO;AAEhB,SAAO,KAAK,IAAI,IAAI,KAAK,MAAM,KAAK,SAAS;AAC/C;;;ACvOA,SAAS,UAAa,OAAqC;AACzD,QAAM,MAAM,IAAI,IAAO,KAAK;AAC5B,QAAM,SAAS,MAAa;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,MAAM;AACV,MAAI,SAAS;AACb,MAAI,QAAQ;AACZ,SAAO,OAAO,OAAO,GAAG;AAC1B;AAEA,IAAM,MAAiC,UAAwB;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,SAAS,eAA0C;AACxD,SAAO;AACT;;;AC0GO,IAAM;AAAA;AAAA,EAEX;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AACF,IAAI;","names":[]}
+{"version":3,"sources":["../../../src/capsule/enclave-aes/broker/proof.ts","../../../src/capsule/enclave-aes/capabilities.ts","../../../src/capsule/enclave-aes/index.ts"],"sourcesContent":["/**\n * Credential-broker proof crypto (#479, credential-broker spec §3).\n *\n * The `_broker` seed (32 random bytes, decrypted from `_broker/<brokerId>` by\n * the party layer) is never transmitted. Instead, a **proof key** is\n * HKDF-derived from it, domain-separated per `(vaultId, brokerId)`, and the\n * derived bits are registered with the broker host once at enrol. Steady\n * state, the client re-derives the same key from the seed and signs a\n * **canonical** string binding the request's identity/context, so the broker\n * can verify a fresh HMAC on every mint without ever holding the seed itself.\n *\n * ## Derivation (spec §3, follow verbatim)\n *\n * ```\n * hkdf      = importKey('raw', seed, 'HKDF', false, ['deriveBits'])\n * proofBits = deriveBits({ name:'HKDF', hash:'SHA-256',\n *                          salt: utf8(BROKER_PROOF_DOMAIN),\n *                          info: utf8(JSON.stringify([BROKER_PROOF_DOMAIN, vaultId, brokerId])) },\n *                        hkdf, 256)\n * proofKey  = importKey('raw', proofBits, { name:'HMAC', hash:'SHA-256' }, false, ['sign'])\n * proof     = base64(sign('HMAC', proofKey, utf8(canonical)))\n * ```\n *\n * `BROKER_PROOF_DOMAIN` is both the HKDF salt and the first `info` array\n * element (the injective-JSON-array convention `deriveClassifyIndexKey`\n * established — see `classify/bidx.ts`). `BROKER_PROOF_VERSION` is the\n * separate MAC version tag, the first element of the `canonical` array.\n *\n * ## Canonical (spec §2 step 3)\n *\n * `JSON.stringify([BROKER_PROOF_VERSION, vaultId, endpointOrigin, brokerId,\n * profile ?? '', instancePid ?? '', challenge, expiresAt])` — every binding\n * field folded into ONE MAC input:\n *  - `vaultId` (V1), `challenge` (V3), `expiresAt` (V4) — verbatim strings,\n *    never reparsed/reformatted (F8): a byte-identical ISO string is\n *    required, so e.g. `Z` vs `+00:00` for the same instant fails.\n *  - `profile ?? ''` (F1) — a proof captured at one profile cannot be\n *    replayed at another.\n *  - `endpointOrigin` (F4) — a proof cannot be relayed to a different broker\n *    endpoint reusing the same `brokerId`.\n *  - `instancePid ?? ''` (F7) — an EMPTY STRING `instancePid` is forbidden in\n *    both {@link computeBrokerProof} and {@link verifyBrokerProof}: absent\n *    (the field omitted) and `''` must stay distinguishable, or `?? ''`\n *    would alias \"no instance\" onto a real registered instance.\n *\n * ## Verify order (spec §3, non-negotiable, F2/F6)\n *\n * {@link verifyBrokerProof} MUST, in this exact order: (1) burn the challenge\n * via `consumeChallenge` FIRST and short-circuit `false` before any MAC work\n * (F2 — burn-on-presentation, not burn-on-success); (2) recompute the\n * canonical and compare with `crypto.subtle.verify('HMAC', …)` — portable,\n * constant-time, never a manual byte compare or Node `timingSafeEqual` (F6);\n * (3) assert `now < expiresAt` — the client clock is never trusted, so this\n * check only matters once the MAC (which covers `expiresAt`) has verified.\n *\n * ## Zeroing (F5)\n *\n * `seed` and the transient HKDF output are raw, durable secret material —\n * the `recovery.ts:276-307` `try{}finally{secret.fill(0)}` discipline, not\n * the ephemeral-CEK happy-path zeroing elsewhere. {@link computeBrokerProof}\n * zeroes the `seed` argument in a `finally` on every path including a throw;\n * {@link deriveBrokerProofKey} zeroes its own transient HKDF-output bytes the\n * same way. {@link deriveBrokerProofBits} does not zero `seed` — it exists\n * so the party layer can register the raw bits at one-time enrol (the value\n * that must survive the call to be base64-encoded and POSTed).\n *\n * @module\n */\nimport type { EnclaveKey } from '../crypto.js'\nimport { base64ToBuffer, bufferToBase64 } from '../../plumbing/digest.js'\nimport { ValidationError } from '../../../kernel/errors.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/** HKDF salt domain for the broker proof key — also the first `info` array element. */\nexport const BROKER_PROOF_DOMAIN = 'noydb-broker-proof'\n\n/** MAC version tag — the first element of the `canonical` array signed/verified (admin shared seed). */\nexport const BROKER_PROOF_VERSION = 'noydb-broker-proof-v1'\n\n/**\n * MAC version tag for a MEMBER proof (core#73): the canonical additionally\n * binds `userId` and `role` right after `brokerId`, so the host verifies WHO\n * proved and at WHICH role with the key it registered for that member — a\n * member cannot claim another user's key or a wider role than the roster\n * granted. Selected by the presence of `member` on the canonical parts; the\n * admin canonical (v1) is byte-for-byte unchanged.\n */\nconst BROKER_PROOF_MEMBER_VERSION = 'noydb-broker-proof-v2'\n\n/** The member identity bound into a v2 canonical and into the HKDF info (core#73). */\nexport interface BrokerMemberIdentity {\n  readonly userId: string\n  readonly role: string\n}\n\n/** Default challenge TTL (spec §2 step 2: \"TTL ≤ 60 s\"). */\nconst DEFAULT_CHALLENGE_TTL_MS = 60_000\n\n/** The canonical-binding fields a client supplies alongside `vaultId`/`brokerId` (spec §2 step 3). */\nexport interface BrokerProofCanonicalParts {\n  readonly endpointOrigin: string\n  /** Present ⇒ a member proof (canonical v2, member-scoped HKDF); absent ⇒ the admin shared seed (v1). */\n  readonly member?: BrokerMemberIdentity | undefined\n  readonly profile?: string | undefined\n  readonly instancePid?: string | undefined\n  readonly challenge: string\n  readonly expiresAt: string\n}\n\n/** A freshly-minted, server-random single-use challenge (spec §2 step 2). */\nexport interface IssuedChallenge {\n  readonly challenge: string\n  readonly expiresAt: string\n}\n\n/** Arguments the broker host passes to verify a submitted proof (spec §3). */\nexport interface VerifyBrokerProofArgs {\n  /**\n   * Atomically test-and-delete the challenge, returning whether it was still\n   * fresh (unconsumed and unexpired-from-the-store's-perspective). MUST burn\n   * on presentation, not on successful verification (F2).\n   */\n  readonly consumeChallenge: (challenge: string) => Promise<boolean>\n  /** The registered proof key's raw bytes, already KMS-unwrapped by the host (§7). */\n  readonly registeredProofKey: Uint8Array\n  readonly vaultId: string\n  readonly endpointOrigin: string\n  readonly brokerId: string\n  /** The member the `registeredProofKey` was registered FOR; the host supplies its own record, never the client's claim. */\n  readonly member?: BrokerMemberIdentity | undefined\n  readonly profile?: string | undefined\n  readonly instancePid?: string | undefined\n  readonly challenge: string\n  readonly expiresAt: string\n  /** base64(HMAC-SHA-256(proofKey, canonical)), as submitted by the client. */\n  readonly proof: string\n}\n\n/** Build the canonical MAC input verbatim — never reparses/reformats a field (F8). */\nfunction buildCanonical(vaultId: string, brokerId: string, parts: BrokerProofCanonicalParts): string {\n  if (parts.member) {\n    return JSON.stringify([\n      BROKER_PROOF_MEMBER_VERSION,\n      vaultId,\n      parts.endpointOrigin,\n      brokerId,\n      parts.member.userId,\n      parts.member.role,\n      parts.profile ?? '',\n      parts.instancePid ?? '',\n      parts.challenge,\n      parts.expiresAt,\n    ])\n  }\n  return JSON.stringify([\n    BROKER_PROOF_VERSION,\n    vaultId,\n    parts.endpointOrigin,\n    brokerId,\n    parts.profile ?? '',\n    parts.instancePid ?? '',\n    parts.challenge,\n    parts.expiresAt,\n  ])\n}\n\n/**\n * The HKDF step: derive the 256-bit proof bits from the `_broker` seed,\n * domain-separated per `(vaultId, brokerId)`. Returns the raw bits — the\n * value registered with the broker host once at enrol (spec §2 step 2/3).\n * Does not mutate or zero `seed`; the caller owns the seed's lifecycle.\n */\nexport async function deriveBrokerProofBits(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n  memberUserId?: string,\n): Promise<Uint8Array> {\n  const hkdfKey = await subtle.importKey('raw', seed as BufferSource, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(BROKER_PROOF_DOMAIN)\n  // core#73: a member key is domain-separated per user as well — a fourth\n  // element, so an admin info tag and a member info tag can never collide.\n  const info = new TextEncoder().encode(JSON.stringify(\n    memberUserId === undefined ? [BROKER_PROOF_DOMAIN, vaultId, brokerId] : [BROKER_PROOF_DOMAIN, vaultId, brokerId, memberUserId],\n  ))\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, 256)\n  return new Uint8Array(bits)\n}\n\n/**\n * Derive the steady-state, non-extractable `['sign']` HMAC proof key from\n * the `_broker` seed. Zeroes the transient HKDF-output bytes in a `finally`\n * once the key has been imported (F5) — the raw bits never leave this\n * function in usable form after import.\n */\nexport async function deriveBrokerProofKey(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n  memberUserId?: string,\n): Promise<EnclaveKey> {\n  const proofBits = await deriveBrokerProofBits(seed, vaultId, brokerId, memberUserId)\n  try {\n    return await subtle.importKey('raw', proofBits as BufferSource, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n  } finally {\n    proofBits.fill(0)\n  }\n}\n\n/**\n * Compose derive + sign for the client: re-derive the proof key from the\n * seed and sign the canonical over `canonicalParts` (spec §2 step 3).\n *\n * Rejects an empty-string `instancePid` (F7 — absent is fine, `''` is not).\n * Zeroes the `seed` argument in a `finally` on EVERY path including a throw\n * (F5, durable-secret discipline) — the transient HKDF bits are zeroed one\n * layer down, inside {@link deriveBrokerProofKey}.\n */\nexport async function computeBrokerProof(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n  canonicalParts: BrokerProofCanonicalParts,\n): Promise<string> {\n  try {\n    if (canonicalParts.instancePid === '') {\n      throw new ValidationError(\n        \"computeBrokerProof: instancePid must not be an empty string — omit the field entirely for \" +\n          \"'no instance' (F7); '' would alias onto a registered instance.\",\n      )\n    }\n    const canonical = buildCanonical(vaultId, brokerId, canonicalParts)\n    const key = await deriveBrokerProofKey(seed, vaultId, brokerId, canonicalParts.member?.userId)\n    const mac = await subtle.sign('HMAC', key, new TextEncoder().encode(canonical) as BufferSource)\n    return bufferToBase64(new Uint8Array(mac))\n  } finally {\n    seed.fill(0)\n  }\n}\n\n/**\n * Host-side nonce mint: 32 random bytes, base64-encoded, plus an ISO\n * `expiresAt` at most `ttlMs` (default 60 s) in the future. The caller\n * (the broker host) persists both returned strings **verbatim** and MACs\n * those exact bytes on verify — never a reparsed/reformatted copy (F8).\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const ttlMs = opts?.ttlMs ?? DEFAULT_CHALLENGE_TTL_MS\n  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  return {\n    challenge: bufferToBase64(bytes),\n    expiresAt: new Date(Date.now() + ttlMs).toISOString(),\n  }\n}\n\n/**\n * Verify a submitted broker proof. Order is NON-NEGOTIABLE (spec §3):\n *\n * 1. `await consumeChallenge(challenge)` FIRST — burn-and-check-fresh; a\n *    not-fresh (already-consumed or unknown) challenge short-circuits to\n *    `false` before any MAC work (F2).\n * 2. Empty-string `instancePid` is rejected (F7), then the canonical is\n *    recomputed over the verbatim `endpointOrigin`/`brokerId`/`profile`/\n *    `instancePid`/`challenge`/`expiresAt` and compared via\n *    `crypto.subtle.verify('HMAC', …)` — portable, constant-time, never a\n *    manual compare or Node `timingSafeEqual` (F6).\n * 3. `now < expiresAt` — the client clock is never trusted; `expiresAt`\n *    rides inside the already-verified MAC (F4/F8).\n */\nexport async function verifyBrokerProof(args: VerifyBrokerProofArgs): Promise<boolean> {\n  const fresh = await args.consumeChallenge(args.challenge)\n  if (!fresh) return false\n\n  if (args.instancePid === '') return false\n\n  const canonical = buildCanonical(args.vaultId, args.brokerId, {\n    endpointOrigin: args.endpointOrigin,\n    member: args.member,\n    profile: args.profile,\n    instancePid: args.instancePid,\n    challenge: args.challenge,\n    expiresAt: args.expiresAt,\n  })\n  const key = await subtle.importKey(\n    'raw',\n    args.registeredProofKey as BufferSource,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['verify'],\n  )\n  const ok = await subtle.verify(\n    'HMAC',\n    key,\n    base64ToBuffer(args.proof) as BufferSource,\n    new TextEncoder().encode(canonical) as BufferSource,\n  )\n  if (!ok) return false\n\n  return Date.now() < Date.parse(args.expiresAt)\n}\n","import type { CapsuleGroup } from '../contract.js'\n\n/**\n * `enclave-aes` supports every group. It is the REFERENCE capsule — the\n * behaviour every other implementation is compared against, and the one hub\n * ships so that `npm install @noy-db/hub` alone is a working noy-db.\n *\n * An `exclave-*` refuses `authenticate` and `seal` (no secret, no key\n * hierarchy — the store's own IAM is the authority) and may refuse the\n * optional groups. That asymmetry is what the prefix means, and the\n * conformance suite asserts it from the package name rather than trusting a\n * declaration.\n *\n * Frozen so a caller cannot edit what a capsule claims to support: a mutable\n * set would let a service \"enable\" a group by adding to it, which is exactly\n * the confidently-wrong failure the typed refusal exists to prevent.\n */\n/**\n * ⛔ `Object.freeze` does NOT make a Set immutable — it guards own properties,\n * not internal slots, so `frozen.add(x)` still succeeds. Measured 2026-09-12,\n * against a test that asserted otherwise and failed. The mutators are replaced\n * so the refusal is real at runtime, not just in the type.\n *\n * Why it has to be real: a caller holding a mutable capability set can \"enable\"\n * a group the capsule does not implement, and the next thing that happens is a\n * primitive being called on a capsule that has none. `ReadonlySet` alone is a\n * compile-time claim, and a JS consumer never sees it.\n */\nfunction sealedSet<T>(items: readonly T[]): ReadonlySet<T> {\n  const set = new Set<T>(items)\n  const refuse = (): never => {\n    throw new TypeError(\n      'capabilities() is immutable — a capsule\\'s declared groups cannot be edited by a caller',\n    )\n  }\n  set.add = refuse as never\n  set.delete = refuse as never\n  set.clear = refuse as never\n  return Object.freeze(set)\n}\n\nconst ALL: ReadonlySet<CapsuleGroup> = sealedSet<CapsuleGroup>([\n  'authenticate',\n  'seal',\n  'cipher',\n  'digest',\n  'sign',\n  'codec',\n  'sealing',\n  'deterministic',\n  'classify',\n  // ⭐ ADDED 2026-09-16 (core#42). `enclave-aes` implements `wrapCek` and\n  // `unwrapCek`, so advertising the group is the truthful `capabilities()`.\n  // The nine-member set was the REFERENCE capsule under-reporting itself:\n  // \"supports every group\" was the documented intent above, and it had been\n  // untrue since `per-record-keys` existed as a refusable thing.\n  // ⛔ This is a published behaviour change — `capabilities()` returns one\n  // more member to any consumer that inspects it. Release-noted by name.\n  'per-record-keys',\n])\n\nexport function capabilities(): ReadonlySet<CapsuleGroup> {\n  return ALL\n}\n","/**\n * **capsule/enclave-aes** — the hub's crypto interior, behind one door.\n *\n * This barrel is **the fork-swap contract**: a sister project that wants a\n * different crypto engine (a different KDF, a hardware-backed keystore, a\n * post-quantum wrap algorithm, …) replaces the entire `capsule/enclave-aes/`\n * folder wholesale and only has to honor the exports below. Nothing outside\n * `capsule/enclave-aes/**` may deep-import `crypto.js` or `record-keys/*` directly\n * — `scripts/check-architecture.mjs`'s `enclave-barrel-only` check enforces\n * that mechanically. Import sites inside `capsule/enclave-aes/**` keep their\n * existing relative imports; this door is for everyone else.\n *\n * The export list is the OBSERVED contract — exactly the symbols consumed\n * from outside this folder today — grouped by the module that defines them:\n *\n *   - key type       — `crypto.ts`: `EnclaveKey`, the opaque key type every\n *                       barrel-facing signature traffics in (`= CryptoKey` in\n *                       noy-db's reference enclave; a fork redefines it to its\n *                       own key representation — see the type's own doc for\n *                       the fork contract).\n *   - crypto ops     — `crypto.ts`: AES-256-GCM encrypt/decrypt (+ bytes, AAD,\n *                       deterministic variants), SHA-256 / HMAC-SHA-256 hashing.\n *   - key lifecycle  — `crypto.ts` + `record-keys/lifecycle.ts`: KEK/DEK\n *                       derivation, AES-KW wrap/unwrap, per-record CEK\n *                       wrap/unwrap/import + resolution/re-wrap, HKDF-derived\n *                       presence/sealed-field keys, base64 helpers.\n *   - record codec   — `record-keys/record-codec.ts`: the per-record\n *                       encode/decode engine.\n *   - sealing        — `record-keys/sealing.ts`: the sealed-record grantor\n *                       primitives (seal/revoke/rotate to an `at-*` host).\n *   - deterministic  — `record-keys/deterministic.ts`: blind-equality lookup\n *                       over deterministically-encrypted fields.\n *   - tombstone      — `record-keys/tombstone.ts`: the erased-record residue.\n *   - envelope body  — `record-keys/envelope-body.ts`: the C1 protected-body\n *                       access contract (`openEnvelopeJson`,\n *                       `writeEnvelopeBody`, `hasPerRecordKey`,\n *                       `hasSealedBody`, `envelopeBodyForHash`) — the\n *                       sanctioned door onto\n *                       `_iv`/`_data`/`_cek`/`_sealed` for everyone outside\n *                       this folder.\n *   - reserved envelopes — `plumbing/sealed-slots.ts`: `makeReservedEnvelopes`,\n *                       the whole-envelope encrypt/decrypt door scoped to a\n *                       declared collection-name prefix (e.g. `_dict_`) —\n *                       `kernel/vault.ts` binds it for `DictionaryHandle`\n *                       (#629 Task 4).\n *\n * Additive changes only — removing or renaming an export here is breaking\n * for any fork. Frozen by `__tests__/enclave-surface-golden.test.ts`.\n *\n * **Refusal contract:** the barrel above is frozen — every symbol must\n * exist in any fork — but the optional groups (sealing, deterministic,\n * per-record-key lifecycle) MAY throw `EnclaveNotSupportedError` instead\n * of implementing the reference behavior. The core groups (crypto ops,\n * record codec, tombstone) MUST NOT throw it — they are load-bearing for\n * every consumer regardless of which enclave is wired in. noy-db's own\n * enclave supports every group, so it never throws this error.\n */\n\nimport { aesCapsule } from './bound.js'\n\n// ─── key type ──────────────────────────────────────────────────────\nexport type { EnclaveKey, EncryptResult } from './crypto.js'\n\n// ─── crypto ops ────────────────────────────────────────────────────\nexport {\n  encrypt,\n  decrypt,\n  encryptBytes,\n  decryptBytes,\n  encryptBytesWithAAD,\n  decryptBytesWithAAD,\n  encryptDeterministic,\n  decryptDeterministic,\n} from './crypto.js'\n\n// ─── key lifecycle ─────────────────────────────────────────────────\nexport {\n  deriveKey,\n  deriveSecretKey,\n  generateDEK,\n  generateEphemeralKey,\n  importTransferKey,\n  exportDekSet,\n  importDekSet,\n  wrapKey,\n  unwrapKey,\n  mintCanary,\n  checkCanary,\n  deriveDeterministicKey,\n  deriveSealedFieldKey,\n  deriveSealedFieldKeyFromCek,\n  wrapCek,\n  unwrapCek,\n  importCek,\n  deriveEchoKey,\n} from './crypto.js'\nexport type { SecretKeyUsage } from './crypto.js'\n// ─── shared plumbing ───────────────────────────────────────────────\n//\n// Everything from here to the end of this block used to be twelve modules\n// under `./record-keys/`. They now live once in `../plumbing/`, and this\n// capsule is one of two callers of `makeCapsule()`.\n//\n// The split below is not cosmetic. The cipher-FREE half is re-exported\n// straight from its module: it inspects envelope fields and derives hash\n// input, so there is nothing to bind and every capsule gets the identical\n// function. The cipher-BOUND half is destructured off `aesCapsule`, which is\n// `makeCapsule(aesPrimitives)` — one binding for the whole capsule, so a value\n// exported here and a value used inside `classify/**` are the SAME object.\nexport {\n  buildRecordAad,\n  recordAadFor,\n  buildRecordEnvelope,\n  isTombstone,\n  isTombstoneShape,\n  buildTombstone,\n  isDeleteMarker,\n  buildDeleteMarker,\n  requireSealedBody,\n  sealedBodyArgs,\n  envelopeBodySize,\n  hasPerRecordKey,\n  envelopeBodyForHash,\n  hasSealedBody,\n} from '../plumbing/index.js'\n// ─── digest group ──────────────────────────────────────────────────\n// Shared, not AES-specific: the seam design marks `digest` \"as today\" for every\n// capsule. Re-exported here so the barrel's surface is unchanged.\nexport {\n  sha256Hex,\n  sha256Bytes,\n  hmacSha256Hex,\n  hmacSignHex,\n  hkdfAesGcmKey,\n  deriveBlobAddressKey,\n  derivePresenceKey,\n  derivePresenceTagKey,\n  generateIV,\n  generateSalt,\n  generateRecoverySecret,\n  bufferToBase64,\n  base64ToBuffer,\n  encodeEchoParts,\n} from '../plumbing/digest.js'\nexport type { EchoSecretParts } from '../plumbing/digest.js'\nexport type { RecordIdentity, RecordRef } from '../plumbing/index.js'\nimport type { RecordCodecBase } from '../plumbing/record-codec.js'\n/**\n * `RecordCodec` is a VALUE (the capsule-bound subclass, destructured below) and\n * a TYPE (the module-level generic base). A type ALIAS can coexist with a value\n * of the same name; a `export type { RecordCodec }` RE-EXPORT cannot, which is\n * what `TS2323: Cannot redeclare exported variable` was saying.\n */\nexport type RecordCodec<T = Record<string, unknown>> = RecordCodecBase<T>\nexport { buildSealedRecordEnvelope } from '../plumbing/record-envelope.js'\nexport type { RecordEnvelopeBody } from '../plumbing/record-envelope.js'\nexport type { RewrappedBody } from '../plumbing/lifecycle.js'\nexport type { SealedShredSlot } from '../plumbing/record-codec.js'\nexport type { SealingContext } from '../plumbing/sealing.js'\nexport type { DeterministicContext } from '../plumbing/deterministic.js'\n\nexport const {\n  // envelope body\n  openEnvelopeJson,\n  writeEnvelopeBody,\n  verifyRecordIdentity,\n  // key lifecycle\n  resolveStableCek,\n  rewrapBodyToDek,\n  rewrapEnvelope,\n  applyRewrappedBody,\n  isRewrappedUnder,\n  // rekey\n  rekeyEnvelopeToDek,\n  rekeyEnvelopeIfNeeded,\n  envelopeOpensUnderAny,\n  rekeyBlobSet,\n  // record codec\n  RecordCodec,\n  // sealed slots — ONLY `makeReservedEnvelopes` is part of the frozen surface.\n  // The other seven are capsule-internal; destructuring the whole capsule here\n  // leaked them and widened the golden by 8 names. A surface is a contract, so\n  // the fix is to narrow the barrel, not to re-baseline the golden.\n  makeReservedEnvelopes,\n  // sealing\n  SEALED_CEK_NS,\n  sealRecordToHost,\n  revokeSealedRecord,\n  rotateRecordCek,\n  // deterministic\n  findByDet,\n  queryByDet,\n} = aesCapsule\n\n// ─── reserved envelopes (ViaCryptoCtx.reservedEnvelopes capability) ──\n\n// ─── classify (stage-2 verify oracle primitives) ────────────────────\n// ADDITIVE per Enclave Contract v1. A fork must provide these four; the\n// verify/matchGroup orchestration (classify/verify.ts) sits behind the\n// with-shape dynamic-import seam and is not part of the fork contract.\nexport { deriveVdigSlotKey } from './classify/vdig.js'\nexport { pbkdf2VerifyDigest } from './classify/digest.js'\nexport { ctEqualTags } from '../plumbing/ct-equal.js'\nexport { evaluateKofN } from '../plumbing/kofn.js'\n\n// ─── classify (slice-2b equatable blind index) ──────────────────────\n// ADDITIVE per Enclave Contract v1. A fork must provide these four; the\n// findByDigest orchestration (collection.ts) sits behind the with-shape\n// dynamic-import seam and is not part of the fork contract.\nexport { deriveClassifyIndexKey, deriveClassifyIndexSalt, mintBidxTag } from './classify/bidx.js'\nexport { computeBidxTarget } from './classify/find.js'\n\n// ─── broker (proof derivation + challenge/verify, #479 slice 2) ─────\n// ADDITIVE per Enclave Contract v1. A fork must provide these five; the\n// seed lifecycle + network/cache orchestration (with-party/broker/**) sits\n// behind its own dynamic-import seam and is not part of the fork contract.\nexport {\n  deriveBrokerProofBits,\n  deriveBrokerProofKey,\n  computeBrokerProof,\n  issueChallenge,\n  verifyBrokerProof,\n} from './broker/proof.js'\nexport type { BrokerProofCanonicalParts, BrokerMemberIdentity, VerifyBrokerProofArgs, IssuedChallenge } from './broker/proof.js'\n\n// ─── sign ─────────────────────────────────────────────────────────────\nexport { generateSigningKeyPair, signBytes, verifyBytes } from '../plumbing/sign.js'\n\n// ─── recipient sealing ────────────────────────────────────────────────\nexport type { EnclaveKeyPair } from './crypto.js'\nexport {\n  generateRecipientKeyPair,\n  exportRecipientPublicKeySpki,\n  importRecipientPublicKeySpki,\n  recipientWrap,\n  recipientUnwrap,\n} from './crypto.js'\n\n// ─── capabilities ─────────────────────────────────────────────────────\n// What THIS capsule supports. Part of the contract every capsule implements,\n// not an enclave-aes detail — an alternative declares its own, and a service\n// asserts against it at createNoydb() rather than failing on first write.\nexport { capabilities } from './capabilities.js'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwEA,IAAM,SAAS,WAAW,OAAO;AAG1B,IAAM,sBAAsB;AAG5B,IAAM,uBAAuB;AAUpC,IAAM,8BAA8B;AASpC,IAAM,2BAA2B;AA2CjC,SAAS,eAAe,SAAiB,UAAkB,OAA0C;AACnG,MAAI,MAAM,QAAQ;AAChB,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,MAAM,OAAO;AAAA,MACb,MAAM,OAAO;AAAA,MACb,MAAM,WAAW;AAAA,MACjB,MAAM,eAAe;AAAA,MACrB,MAAM;AAAA,MACN,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,KAAK,UAAU;AAAA,IACpB;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,MAAM,WAAW;AAAA,IACjB,MAAM,eAAe;AAAA,IACrB,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AACH;AAQA,eAAsB,sBACpB,MACA,SACA,UACA,cACqB;AACrB,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,MAAsB,QAAQ,OAAO,CAAC,YAAY,CAAC;AACjG,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,mBAAmB;AAGzD,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,IACzC,iBAAiB,SAAY,CAAC,qBAAqB,SAAS,QAAQ,IAAI,CAAC,qBAAqB,SAAS,UAAU,YAAY;AAAA,EAC/H,CAAC;AACD,QAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,GAAG;AAChG,SAAO,IAAI,WAAW,IAAI;AAC5B;AAQA,eAAsB,qBACpB,MACA,SACA,UACA,cACqB;AACrB,QAAM,YAAY,MAAM,sBAAsB,MAAM,SAAS,UAAU,YAAY;AACnF,MAAI;AACF,WAAO,MAAM,OAAO,UAAU,OAAO,WAA2B,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AAAA,EACpH,UAAE;AACA,cAAU,KAAK,CAAC;AAAA,EAClB;AACF;AAWA,eAAsB,mBACpB,MACA,SACA,UACA,gBACiB;AACjB,MAAI;AACF,QAAI,eAAe,gBAAgB,IAAI;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,YAAY,eAAe,SAAS,UAAU,cAAc;AAClE,UAAM,MAAM,MAAM,qBAAqB,MAAM,SAAS,UAAU,eAAe,QAAQ,MAAM;AAC7F,UAAM,MAAM,MAAM,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,SAAS,CAAiB;AAC9F,WAAO,eAAe,IAAI,WAAW,GAAG,CAAC;AAAA,EAC3C,UAAE;AACA,SAAK,KAAK,CAAC;AAAA,EACb;AACF;AAQO,SAAS,eAAe,MAA4C;AACzE,QAAM,QAAQ,MAAM,SAAS;AAC7B,QAAM,QAAQ,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAClE,SAAO;AAAA,IACL,WAAW,eAAe,KAAK;AAAA,IAC/B,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,EAAE,YAAY;AAAA,EACtD;AACF;AAgBA,eAAsB,kBAAkB,MAA+C;AACrF,QAAM,QAAQ,MAAM,KAAK,iBAAiB,KAAK,SAAS;AACxD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI,KAAK,gBAAgB,GAAI,QAAO;AAEpC,QAAM,YAAY,eAAe,KAAK,SAAS,KAAK,UAAU;AAAA,IAC5D,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,aAAa,KAAK;AAAA,IAClB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,EAClB,CAAC;AACD,QAAM,MAAM,MAAM,OAAO;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,IACL,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AACA,QAAM,KAAK,MAAM,OAAO;AAAA,IACtB;AAAA,IACA;AAAA,IACA,eAAe,KAAK,KAAK;AAAA,IACzB,IAAI,YAAY,EAAE,OAAO,SAAS;AAAA,EACpC;AACA,MAAI,CAAC,GAAI,QAAO;AAEhB,SAAO,KAAK,IAAI,IAAI,KAAK,MAAM,KAAK,SAAS;AAC/C;;;AChRA,SAAS,UAAa,OAAqC;AACzD,QAAM,MAAM,IAAI,IAAO,KAAK;AAC5B,QAAM,SAAS,MAAa;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,MAAM;AACV,MAAI,SAAS;AACb,MAAI,QAAQ;AACZ,SAAO,OAAO,OAAO,GAAG;AAC1B;AAEA,IAAM,MAAiC,UAAwB;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA;AACF,CAAC;AAEM,SAAS,eAA0C;AACxD,SAAO;AACT;;;ACkGO,IAAM;AAAA;AAAA,EAEX;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AACF,IAAI;","names":[]}

package/dist/capsule/index.d.ts

@@ -22,6 +22,6 @@
  * capsule primitive means adding it to the golden and regenerating.
  */
 export { RecordCodec, SEALED_CEK_NS, applyRewrappedBody, base64ToBuffer, bufferToBase64, buildDeleteMarker, buildRecordAad, buildRecordEnvelope, buildSealedRecordEnvelope, buildTombstone, capabilities, checkCanary, computeBidxTarget, computeBrokerProof, ctEqualTags, decrypt, decryptBytes, decryptBytesWithAAD, decryptDeterministic, deriveBlobAddressKey, deriveBrokerProofBits, deriveBrokerProofKey, deriveClassifyIndexKey, deriveClassifyIndexSalt, deriveDeterministicKey, deriveEchoKey, deriveKey, derivePresenceKey, derivePresenceTagKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, deriveSecretKey, deriveVdigSlotKey, encodeEchoParts, encrypt, encryptBytes, encryptBytesWithAAD, encryptDeterministic, envelopeBodyForHash, envelopeBodySize, envelopeOpensUnderAny, evaluateKofN, exportDekSet, exportRecipientPublicKeySpki, findByDet, generateDEK, generateEphemeralKey, generateIV, generateRecipientKeyPair, generateRecoverySecret, generateSalt, generateSigningKeyPair, hasPerRecordKey, hasSealedBody, requireSealedBody, sealedBodyArgs, hkdfAesGcmKey, hmacSha256Hex, hmacSignHex, importCek, importDekSet, importRecipientPublicKeySpki, importTransferKey, isDeleteMarker, isRewrappedUnder, isTombstone, isTombstoneShape, issueChallenge, makeReservedEnvelopes, mintBidxTag, mintCanary, openEnvelopeJson, pbkdf2VerifyDigest, queryByDet, recipientUnwrap, recipientWrap, recordAadFor, rekeyBlobSet, rekeyEnvelopeIfNeeded, rekeyEnvelopeToDek, resolveStableCek, revokeSealedRecord, rewrapBodyToDek, rewrapEnvelope, rotateRecordCek, sealRecordToHost, sha256Bytes, sha256Hex, signBytes, unwrapCek, unwrapKey, verifyBrokerProof, verifyBytes, verifyRecordIdentity, wrapCek, wrapKey, writeEnvelopeBody, } from '#capsule';
-export type { BrokerProofCanonicalParts, DeterministicContext, EchoSecretParts, EnclaveKey, EnclaveKeyPair, EncryptResult, IssuedChallenge, RecordEnvelopeBody, RecordIdentity, RecordRef, RewrappedBody, SealedShredSlot, SealingContext, SecretKeyUsage, VerifyBrokerProofArgs, } from '#capsule';
+export type { BrokerMemberIdentity, BrokerProofCanonicalParts, DeterministicContext, EchoSecretParts, EnclaveKey, EnclaveKeyPair, EncryptResult, IssuedChallenge, RecordEnvelopeBody, RecordIdentity, RecordRef, RewrappedBody, SealedShredSlot, SealingContext, SecretKeyUsage, VerifyBrokerProofArgs, } from '#capsule';
 export type { CapsuleKey, CapsuleKeyPair, CapsuleGroup } from './contract.js';
 export { CapsuleNotSupportedError } from './contract.js';

package/dist/capsule/plumbing/record-codec.d.ts

@@ -415,6 +415,13 @@ export declare class RecordCodecBase<T> {
  * The capsule-bound codec constructor: same shape callers have always used
  * (`new RecordCodec(ctx)`), with the capsule already closed over.
  */
+/**
+ * `BoundRecordCodec` — PUBLISHED API, reachable from @noy-db/hub/capsule. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export type BoundRecordCodec = (new <T>(ctx: RecordCodecContext<T>) => RecordCodecBase<T>) & Omit<typeof RecordCodecBase, never>;
 export declare function makeRecordCodec(p: CapsulePrimitives, slots: ReturnType<typeof makeSealedSlots>): {
     RecordCodec: BoundRecordCodec;

package/dist/{capsule-VOLX3QRQ.js → capsule-57BDK7LG.js}

@@ -96,16 +96,16 @@ import {
   wrapCek,
   wrapKey,
   writeEnvelopeBody
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-4J3MNVVX.js";
 import {
   CapsuleNotSupportedError
-} from "./chunk-OIEO4WDL.js";
-import "./chunk-Q2XRFWOI.js";
+} from "./chunk-ZBUAX4EF.js";
+import "./chunk-SPPOUJLN.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-42ALPZ2B.js";
-import "./chunk-QMWY2FDS.js";
-import "./chunk-SV2PM2OY.js";
-import "./chunk-37EPTBBR.js";
+import "./chunk-OM3SEDI4.js";
+import "./chunk-PUBI455O.js";
+import "./chunk-2ELOCEXE.js";
+import "./chunk-VSUQI5Q6.js";
 export {
   CapsuleNotSupportedError,
   RecordCodec,
@@ -206,4 +206,4 @@ export {
   wrapKey,
   writeEnvelopeBody
 };
-//# sourceMappingURL=capsule-VOLX3QRQ.js.map
+//# sourceMappingURL=capsule-57BDK7LG.js.map

package/dist/cargo/index.js

@@ -5,77 +5,77 @@ import {
   describeExtraction,
   unsealDeks,
   withCargo
-} from "../chunk-H7JBY4P7.js";
+} from "../chunk-TFWFPZRU.js";
 import {
   diffVault
 } from "../chunk-LFUID7OW.js";
 import {
   extractPartition,
   walkClosure
-} from "../chunk-EGVJ7TM4.js";
+} from "../chunk-SWXLZ4HX.js";
 import {
   createDeedOwner,
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-UIYESRD6.js";
-import "../chunk-IMQKWR46.js";
-import "../chunk-EJLV62NI.js";
+} from "../chunk-XITHENBI.js";
+import "../chunk-SNM7LSYG.js";
+import "../chunk-55P6OBB7.js";
 import {
   groupAndReduce,
   reduceRecords
-} from "../chunk-N7UDP5VU.js";
+} from "../chunk-WHOKGHJ3.js";
 import {
   NO_CARGO
-} from "../chunk-52MGURXO.js";
-import "../chunk-3XJQBBZD.js";
+} from "../chunk-QGSNJD3B.js";
+import "../chunk-XKBTJGFP.js";
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-DIZLQVAA.js";
+} from "../chunk-UNSQZSZP.js";
 import {
   CustodyApi
-} from "../chunk-V3RWOOSO.js";
-import "../chunk-3L2NBKDR.js";
-import "../chunk-KZXDLBY6.js";
-import "../chunk-5A4345TG.js";
+} from "../chunk-GOJQ5DZA.js";
+import "../chunk-H3YM66EI.js";
+import "../chunk-RDOEOPOI.js";
+import "../chunk-YQFBH5ZJ.js";
 import "../chunk-GMKGGY7V.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
-import "../chunk-G2MVBDFP.js";
+import "../chunk-QXJXG7DN.js";
 import "../chunk-XZHEOSQ2.js";
-import "../chunk-MBMTND6D.js";
+import "../chunk-BJH77UY2.js";
 import "../chunk-SUZKW6UR.js";
 import "../chunk-VHM7HCKB.js";
-import "../chunk-FOEDQATO.js";
+import "../chunk-DHU2AQ6T.js";
 import {
   readPath
-} from "../chunk-5WWDGFOS.js";
-import "../chunk-OKSTSITU.js";
-import "../chunk-SYNY3VB5.js";
-import "../chunk-XSPFDUDG.js";
-import "../chunk-LIOVX5TJ.js";
-import "../chunk-7XMHMVTS.js";
+} from "../chunk-BUE7R3B5.js";
+import "../chunk-V55JASXO.js";
+import "../chunk-PTJY5R3O.js";
+import "../chunk-45VHWE4C.js";
+import "../chunk-FZXRLNJO.js";
+import "../chunk-UHFGK6YA.js";
 import {
   generateULID
 } from "../chunk-4AOERLTV.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-N7EVQD5S.js";
+import "../chunk-L2F3CFCH.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-6QVKPHBF.js";
-import "../chunk-FLPCETP6.js";
+import "../chunk-2WJKJZSO.js";
+import "../chunk-RIZTZJX6.js";
 import {
   sha256Hex
-} from "../chunk-EZGV6F47.js";
-import "../chunk-OIEO4WDL.js";
-import "../chunk-Q2XRFWOI.js";
+} from "../chunk-4J3MNVVX.js";
+import "../chunk-ZBUAX4EF.js";
+import "../chunk-SPPOUJLN.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-42ALPZ2B.js";
-import "../chunk-QMWY2FDS.js";
+import "../chunk-OM3SEDI4.js";
+import "../chunk-PUBI455O.js";
 import {
   NOYDB_ENVELOPE_GENERATION
-} from "../chunk-SV2PM2OY.js";
+} from "../chunk-2ELOCEXE.js";
 import {
   AdoptionStateError,
   CargoNotEnabledError,
@@ -90,7 +90,7 @@ import {
   UnknownShardError,
   ValidationError,
   VaultTemplateNotFoundError
-} from "../chunk-37EPTBBR.js";
+} from "../chunk-VSUQI5Q6.js";
 export {
   AdoptionStateError,
   CargoNotEnabledError,

package/dist/{chunk-A4XMIZT3.js → chunk-226V6XXJ.js}

@@ -58,6 +58,41 @@ var classified = {
     if (fields.cvc !== void 0) members[fields.cvc] = cvcSpec();
     return { _noydbClassifiedGroup: true, _viaBrand: "classified", preset: "creditCard", members };
   },
+  /**
+   * A checksummed government or institutional identifier — a national ID, a
+   * tax number, an employer registration.
+   *
+   * ⭐ The preset exists for the FOUR SECURITY-RELEVANT DEFAULTS, not to save
+   * typing (#26). Hand-rolling a `ClassifiedFieldSpec` means choosing
+   * `storage`, `list`, `sensitivity` and `verifyNormalize` yourself, and
+   * getting `sensitivity` or `list` wrong on a national ID is not cosmetic.
+   * Supply the checksum; the posture is decided here.
+   *
+   * Defaults to `recoverable` + a masked list, which is the shape that lets an
+   * advisor open a list screen without reading every identifier in full while
+   * still allowing an authorised `reveal()`.
+   *
+   * ⛔ IT CANNOT BE UNIQUELY INDEXED, and that is by design rather than a gap
+   * (core#20). A recoverable classified field is sealed, sealed fields are
+   * excluded from the deterministic index, and unique constraints read the
+   * DECRYPTED record — where the value is a `Sealed` handle, not a string. If
+   * you need exact-equality dedup on this identifier, it must stay a plain
+   * field with `unique: true`; the two properties are mutually exclusive.
+   *
+   * @param validate returns `null` when the value passes, or a message. Use
+   *   {@link luhnCheck} for Luhn; supply your own for mod-11 and friends.
+   */
+  checksummed(options) {
+    return {
+      _noydbClassified: true,
+      _viaBrand: "classified",
+      preset: "checksummed",
+      storage: "recoverable",
+      sensitivity: options.sensitivity ?? "pii",
+      list: options.list ?? { kind: "omit" },
+      validate: options.validate
+    };
+  },
   birthDate() {
     return {
       _noydbClassified: true,
@@ -201,7 +236,7 @@ var engineCtx = (ctx) => ({
 function withClassified() {
   return {
     async reveal(ctx, id, field) {
-      const { revealSealedField } = await import("./reveal-B2TLP4JQ.js");
+      const { revealSealedField } = await import("./reveal-YQTRNQFH.js");
       const value = await revealSealedField({
         collection: ctx.collection,
         encrypted: ctx.encrypted,
@@ -213,26 +248,26 @@ function withClassified() {
       return value;
     },
     async verify(ctx, id, field, candidate) {
-      const { verifyDigestField } = await import("./verify-UKALW7C2.js");
+      const { verifyDigestField } = await import("./verify-KWQIWLGH.js");
       const verdict = await verifyDigestField(engineCtx(ctx), id, field, candidate, policyOf(ctx.spec));
       await ctx.onAccess?.("verify", id);
       return verdict;
     },
     async verifyText(ctx, id, field, candidate) {
-      const { verifyTextField } = await import("./verify-UKALW7C2.js");
+      const { verifyTextField } = await import("./verify-KWQIWLGH.js");
       const verdict = await verifyTextField(engineCtx(ctx), id, field, candidate, ctx.spec.verifyNormalize ?? "password");
       await ctx.onAccess?.("verify", id);
       return verdict;
     },
     async matchGroup(ctx, id, answers, opts) {
-      const { matchGroupFields } = await import("./verify-UKALW7C2.js");
+      const { matchGroupFields } = await import("./verify-KWQIWLGH.js");
       const members = (ctx.groupMembers ?? []).map((m) => ({ field: m.field, policy: policyOf(m.spec) }));
       const result = await matchGroupFields(engineCtx(ctx), id, answers, members, opts);
       await ctx.onAccess?.("verify", id);
       return result;
     },
     async computeTarget(ctx, field, candidate, costByte) {
-      const { computeBidxTarget } = await import("./find-JRN4RNQ5.js");
+      const { computeBidxTarget } = await import("./find-6M7GYDUZ.js");
       const dek = await ctx.getDEK();
       return computeBidxTarget(candidate, policyOf(ctx.spec).normalize, dek, ctx.collection, field, costByte);
     }
@@ -244,4 +279,4 @@ export {
   classified,
   withClassified
 };
-//# sourceMappingURL=chunk-A4XMIZT3.js.map
+//# sourceMappingURL=chunk-226V6XXJ.js.map