@noy-db/hub 0.8.0 → 0.9.0-pre.1

package/dist/capsule/enclave-aes/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/capsule/enclave-aes/broker/proof.ts","../../../src/capsule/enclave-aes/capabilities.ts","../../../src/capsule/enclave-aes/index.ts"],"sourcesContent":["/**\n * Credential-broker proof crypto (#479, credential-broker spec §3).\n *\n * The `_broker` seed (32 random bytes, decrypted from `_broker/<brokerId>` by\n * the party layer) is never transmitted. Instead, a **proof key** is\n * HKDF-derived from it, domain-separated per `(vaultId, brokerId)`, and the\n * derived bits are registered with the broker host once at enrol. Steady\n * state, the client re-derives the same key from the seed and signs a\n * **canonical** string binding the request's identity/context, so the broker\n * can verify a fresh HMAC on every mint without ever holding the seed itself.\n *\n * ## Derivation (spec §3, follow verbatim)\n *\n * ```\n * hkdf      = importKey('raw', seed, 'HKDF', false, ['deriveBits'])\n * proofBits = deriveBits({ name:'HKDF', hash:'SHA-256',\n *                          salt: utf8(BROKER_PROOF_DOMAIN),\n *                          info: utf8(JSON.stringify([BROKER_PROOF_DOMAIN, vaultId, brokerId])) },\n *                        hkdf, 256)\n * proofKey  = importKey('raw', proofBits, { name:'HMAC', hash:'SHA-256' }, false, ['sign'])\n * proof     = base64(sign('HMAC', proofKey, utf8(canonical)))\n * ```\n *\n * `BROKER_PROOF_DOMAIN` is both the HKDF salt and the first `info` array\n * element (the injective-JSON-array convention `deriveClassifyIndexKey`\n * established — see `classify/bidx.ts`). `BROKER_PROOF_VERSION` is the\n * separate MAC version tag, the first element of the `canonical` array.\n *\n * ## Canonical (spec §2 step 3)\n *\n * `JSON.stringify([BROKER_PROOF_VERSION, vaultId, endpointOrigin, brokerId,\n * profile ?? '', instancePid ?? '', challenge, expiresAt])` — every binding\n * field folded into ONE MAC input:\n *  - `vaultId` (V1), `challenge` (V3), `expiresAt` (V4) — verbatim strings,\n *    never reparsed/reformatted (F8): a byte-identical ISO string is\n *    required, so e.g. `Z` vs `+00:00` for the same instant fails.\n *  - `profile ?? ''` (F1) — a proof captured at one profile cannot be\n *    replayed at another.\n *  - `endpointOrigin` (F4) — a proof cannot be relayed to a different broker\n *    endpoint reusing the same `brokerId`.\n *  - `instancePid ?? ''` (F7) — an EMPTY STRING `instancePid` is forbidden in\n *    both {@link computeBrokerProof} and {@link verifyBrokerProof}: absent\n *    (the field omitted) and `''` must stay distinguishable, or `?? ''`\n *    would alias \"no instance\" onto a real registered instance.\n *\n * ## Verify order (spec §3, non-negotiable, F2/F6)\n *\n * {@link verifyBrokerProof} MUST, in this exact order: (1) burn the challenge\n * via `consumeChallenge` FIRST and short-circuit `false` before any MAC work\n * (F2 — burn-on-presentation, not burn-on-success); (2) recompute the\n * canonical and compare with `crypto.subtle.verify('HMAC', …)` — portable,\n * constant-time, never a manual byte compare or Node `timingSafeEqual` (F6);\n * (3) assert `now < expiresAt` — the client clock is never trusted, so this\n * check only matters once the MAC (which covers `expiresAt`) has verified.\n *\n * ## Zeroing (F5)\n *\n * `seed` and the transient HKDF output are raw, durable secret material —\n * the `recovery.ts:276-307` `try{}finally{secret.fill(0)}` discipline, not\n * the ephemeral-CEK happy-path zeroing elsewhere. {@link computeBrokerProof}\n * zeroes the `seed` argument in a `finally` on every path including a throw;\n * {@link deriveBrokerProofKey} zeroes its own transient HKDF-output bytes the\n * same way. {@link deriveBrokerProofBits} does not zero `seed` — it exists\n * so the party layer can register the raw bits at one-time enrol (the value\n * that must survive the call to be base64-encoded and POSTed).\n *\n * @module\n */\nimport type { EnclaveKey } from '../crypto.js'\nimport { base64ToBuffer, bufferToBase64 } from '../../plumbing/digest.js'\nimport { ValidationError } from '../../../kernel/errors.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/** HKDF salt domain for the broker proof key — also the first `info` array element. */\nexport const BROKER_PROOF_DOMAIN = 'noydb-broker-proof'\n\n/** MAC version tag — the first element of the `canonical` array signed/verified. */\nexport const BROKER_PROOF_VERSION = 'noydb-broker-proof-v1'\n\n/** Default challenge TTL (spec §2 step 2: \"TTL ≤ 60 s\"). */\nconst DEFAULT_CHALLENGE_TTL_MS = 60_000\n\n/** The canonical-binding fields a client supplies alongside `vaultId`/`brokerId` (spec §2 step 3). */\nexport interface BrokerProofCanonicalParts {\n  readonly endpointOrigin: string\n  readonly profile?: string | undefined\n  readonly instancePid?: string | undefined\n  readonly challenge: string\n  readonly expiresAt: string\n}\n\n/** A freshly-minted, server-random single-use challenge (spec §2 step 2). */\nexport interface IssuedChallenge {\n  readonly challenge: string\n  readonly expiresAt: string\n}\n\n/** Arguments the broker host passes to verify a submitted proof (spec §3). */\nexport interface VerifyBrokerProofArgs {\n  /**\n   * Atomically test-and-delete the challenge, returning whether it was still\n   * fresh (unconsumed and unexpired-from-the-store's-perspective). MUST burn\n   * on presentation, not on successful verification (F2).\n   */\n  readonly consumeChallenge: (challenge: string) => Promise<boolean>\n  /** The registered proof key's raw bytes, already KMS-unwrapped by the host (§7). */\n  readonly registeredProofKey: Uint8Array\n  readonly vaultId: string\n  readonly endpointOrigin: string\n  readonly brokerId: string\n  readonly profile?: string | undefined\n  readonly instancePid?: string | undefined\n  readonly challenge: string\n  readonly expiresAt: string\n  /** base64(HMAC-SHA-256(proofKey, canonical)), as submitted by the client. */\n  readonly proof: string\n}\n\n/** Build the canonical MAC input verbatim — never reparses/reformats a field (F8). */\nfunction buildCanonical(vaultId: string, brokerId: string, parts: BrokerProofCanonicalParts): string {\n  return JSON.stringify([\n    BROKER_PROOF_VERSION,\n    vaultId,\n    parts.endpointOrigin,\n    brokerId,\n    parts.profile ?? '',\n    parts.instancePid ?? '',\n    parts.challenge,\n    parts.expiresAt,\n  ])\n}\n\n/**\n * The HKDF step: derive the 256-bit proof bits from the `_broker` seed,\n * domain-separated per `(vaultId, brokerId)`. Returns the raw bits — the\n * value registered with the broker host once at enrol (spec §2 step 2/3).\n * Does not mutate or zero `seed`; the caller owns the seed's lifecycle.\n */\nexport async function deriveBrokerProofBits(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n): Promise<Uint8Array> {\n  const hkdfKey = await subtle.importKey('raw', seed as BufferSource, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(BROKER_PROOF_DOMAIN)\n  const info = new TextEncoder().encode(JSON.stringify([BROKER_PROOF_DOMAIN, vaultId, brokerId]))\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, 256)\n  return new Uint8Array(bits)\n}\n\n/**\n * Derive the steady-state, non-extractable `['sign']` HMAC proof key from\n * the `_broker` seed. Zeroes the transient HKDF-output bytes in a `finally`\n * once the key has been imported (F5) — the raw bits never leave this\n * function in usable form after import.\n */\nexport async function deriveBrokerProofKey(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n): Promise<EnclaveKey> {\n  const proofBits = await deriveBrokerProofBits(seed, vaultId, brokerId)\n  try {\n    return await subtle.importKey('raw', proofBits as BufferSource, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n  } finally {\n    proofBits.fill(0)\n  }\n}\n\n/**\n * Compose derive + sign for the client: re-derive the proof key from the\n * seed and sign the canonical over `canonicalParts` (spec §2 step 3).\n *\n * Rejects an empty-string `instancePid` (F7 — absent is fine, `''` is not).\n * Zeroes the `seed` argument in a `finally` on EVERY path including a throw\n * (F5, durable-secret discipline) — the transient HKDF bits are zeroed one\n * layer down, inside {@link deriveBrokerProofKey}.\n */\nexport async function computeBrokerProof(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n  canonicalParts: BrokerProofCanonicalParts,\n): Promise<string> {\n  try {\n    if (canonicalParts.instancePid === '') {\n      throw new ValidationError(\n        \"computeBrokerProof: instancePid must not be an empty string — omit the field entirely for \" +\n          \"'no instance' (F7); '' would alias onto a registered instance.\",\n      )\n    }\n    const canonical = buildCanonical(vaultId, brokerId, canonicalParts)\n    const key = await deriveBrokerProofKey(seed, vaultId, brokerId)\n    const mac = await subtle.sign('HMAC', key, new TextEncoder().encode(canonical) as BufferSource)\n    return bufferToBase64(new Uint8Array(mac))\n  } finally {\n    seed.fill(0)\n  }\n}\n\n/**\n * Host-side nonce mint: 32 random bytes, base64-encoded, plus an ISO\n * `expiresAt` at most `ttlMs` (default 60 s) in the future. The caller\n * (the broker host) persists both returned strings **verbatim** and MACs\n * those exact bytes on verify — never a reparsed/reformatted copy (F8).\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const ttlMs = opts?.ttlMs ?? DEFAULT_CHALLENGE_TTL_MS\n  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  return {\n    challenge: bufferToBase64(bytes),\n    expiresAt: new Date(Date.now() + ttlMs).toISOString(),\n  }\n}\n\n/**\n * Verify a submitted broker proof. Order is NON-NEGOTIABLE (spec §3):\n *\n * 1. `await consumeChallenge(challenge)` FIRST — burn-and-check-fresh; a\n *    not-fresh (already-consumed or unknown) challenge short-circuits to\n *    `false` before any MAC work (F2).\n * 2. Empty-string `instancePid` is rejected (F7), then the canonical is\n *    recomputed over the verbatim `endpointOrigin`/`brokerId`/`profile`/\n *    `instancePid`/`challenge`/`expiresAt` and compared via\n *    `crypto.subtle.verify('HMAC', …)` — portable, constant-time, never a\n *    manual compare or Node `timingSafeEqual` (F6).\n * 3. `now < expiresAt` — the client clock is never trusted; `expiresAt`\n *    rides inside the already-verified MAC (F4/F8).\n */\nexport async function verifyBrokerProof(args: VerifyBrokerProofArgs): Promise<boolean> {\n  const fresh = await args.consumeChallenge(args.challenge)\n  if (!fresh) return false\n\n  if (args.instancePid === '') return false\n\n  const canonical = buildCanonical(args.vaultId, args.brokerId, {\n    endpointOrigin: args.endpointOrigin,\n    profile: args.profile,\n    instancePid: args.instancePid,\n    challenge: args.challenge,\n    expiresAt: args.expiresAt,\n  })\n  const key = await subtle.importKey(\n    'raw',\n    args.registeredProofKey as BufferSource,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['verify'],\n  )\n  const ok = await subtle.verify(\n    'HMAC',\n    key,\n    base64ToBuffer(args.proof) as BufferSource,\n    new TextEncoder().encode(canonical) as BufferSource,\n  )\n  if (!ok) return false\n\n  return Date.now() < Date.parse(args.expiresAt)\n}\n","import type { CapsuleGroup } from '../contract.js'\n\n/**\n * `enclave-aes` supports every group. It is the REFERENCE capsule — the\n * behaviour every other implementation is compared against, and the one hub\n * ships so that `npm install @noy-db/hub` alone is a working noy-db.\n *\n * An `exclave-*` refuses `authenticate` and `seal` (no secret, no key\n * hierarchy — the store's own IAM is the authority) and may refuse the\n * optional groups. That asymmetry is what the prefix means, and the\n * conformance suite asserts it from the package name rather than trusting a\n * declaration.\n *\n * Frozen so a caller cannot edit what a capsule claims to support: a mutable\n * set would let a service \"enable\" a group by adding to it, which is exactly\n * the confidently-wrong failure the typed refusal exists to prevent.\n */\n/**\n * ⛔ `Object.freeze` does NOT make a Set immutable — it guards own properties,\n * not internal slots, so `frozen.add(x)` still succeeds. Measured 2026-09-12,\n * against a test that asserted otherwise and failed. The mutators are replaced\n * so the refusal is real at runtime, not just in the type.\n *\n * Why it has to be real: a caller holding a mutable capability set can \"enable\"\n * a group the capsule does not implement, and the next thing that happens is a\n * primitive being called on a capsule that has none. `ReadonlySet` alone is a\n * compile-time claim, and a JS consumer never sees it.\n */\nfunction sealedSet<T>(items: readonly T[]): ReadonlySet<T> {\n  const set = new Set<T>(items)\n  const refuse = (): never => {\n    throw new TypeError(\n      'capabilities() is immutable — a capsule\\'s declared groups cannot be edited by a caller',\n    )\n  }\n  set.add = refuse as never\n  set.delete = refuse as never\n  set.clear = refuse as never\n  return Object.freeze(set)\n}\n\nconst ALL: ReadonlySet<CapsuleGroup> = sealedSet<CapsuleGroup>([\n  'authenticate',\n  'seal',\n  'cipher',\n  'digest',\n  'sign',\n  'codec',\n  'sealing',\n  'deterministic',\n  'classify',\n])\n\nexport function capabilities(): ReadonlySet<CapsuleGroup> {\n  return ALL\n}\n","/**\n * **capsule/enclave-aes** — the hub's crypto interior, behind one door.\n *\n * This barrel is **the fork-swap contract**: a sister project that wants a\n * different crypto engine (a different KDF, a hardware-backed keystore, a\n * post-quantum wrap algorithm, …) replaces the entire `capsule/enclave-aes/`\n * folder wholesale and only has to honor the exports below. Nothing outside\n * `capsule/enclave-aes/**` may deep-import `crypto.js` or `record-keys/*` directly\n * — `scripts/check-architecture.mjs`'s `enclave-barrel-only` check enforces\n * that mechanically. Import sites inside `capsule/enclave-aes/**` keep their\n * existing relative imports; this door is for everyone else.\n *\n * The export list is the OBSERVED contract — exactly the symbols consumed\n * from outside this folder today — grouped by the module that defines them:\n *\n *   - key type       — `crypto.ts`: `EnclaveKey`, the opaque key type every\n *                       barrel-facing signature traffics in (`= CryptoKey` in\n *                       noy-db's reference enclave; a fork redefines it to its\n *                       own key representation — see the type's own doc for\n *                       the fork contract).\n *   - crypto ops     — `crypto.ts`: AES-256-GCM encrypt/decrypt (+ bytes, AAD,\n *                       deterministic variants), SHA-256 / HMAC-SHA-256 hashing.\n *   - key lifecycle  — `crypto.ts` + `record-keys/lifecycle.ts`: KEK/DEK\n *                       derivation, AES-KW wrap/unwrap, per-record CEK\n *                       wrap/unwrap/import + resolution/re-wrap, HKDF-derived\n *                       presence/sealed-field keys, base64 helpers.\n *   - record codec   — `record-keys/record-codec.ts`: the per-record\n *                       encode/decode engine.\n *   - sealing        — `record-keys/sealing.ts`: the sealed-record grantor\n *                       primitives (seal/revoke/rotate to an `at-*` host).\n *   - deterministic  — `record-keys/deterministic.ts`: blind-equality lookup\n *                       over deterministically-encrypted fields.\n *   - tombstone      — `record-keys/tombstone.ts`: the erased-record residue.\n *   - envelope body  — `record-keys/envelope-body.ts`: the C1 protected-body\n *                       access contract (`openEnvelopeJson`,\n *                       `writeEnvelopeBody`, `hasPerRecordKey`,\n *                       `hasSealedBody`, `envelopeBodyForHash`) — the\n *                       sanctioned door onto\n *                       `_iv`/`_data`/`_cek`/`_sealed` for everyone outside\n *                       this folder.\n *   - reserved envelopes — `plumbing/sealed-slots.ts`: `makeReservedEnvelopes`,\n *                       the whole-envelope encrypt/decrypt door scoped to a\n *                       declared collection-name prefix (e.g. `_dict_`) —\n *                       `kernel/vault.ts` binds it for `DictionaryHandle`\n *                       (#629 Task 4).\n *\n * Additive changes only — removing or renaming an export here is breaking\n * for any fork. Frozen by `__tests__/enclave-surface-golden.test.ts`.\n *\n * **Refusal contract:** the barrel above is frozen — every symbol must\n * exist in any fork — but the optional groups (sealing, deterministic,\n * per-record-key lifecycle) MAY throw `EnclaveNotSupportedError` instead\n * of implementing the reference behavior. The core groups (crypto ops,\n * record codec, tombstone) MUST NOT throw it — they are load-bearing for\n * every consumer regardless of which enclave is wired in. noy-db's own\n * enclave supports every group, so it never throws this error.\n */\n\nimport { aesCapsule } from './bound.js'\n\n// ─── key type ──────────────────────────────────────────────────────\nexport type { EnclaveKey, EncryptResult } from './crypto.js'\n\n// ─── crypto ops ────────────────────────────────────────────────────\nexport {\n  encrypt,\n  decrypt,\n  encryptBytes,\n  decryptBytes,\n  encryptBytesWithAAD,\n  decryptBytesWithAAD,\n  encryptDeterministic,\n  decryptDeterministic,\n} from './crypto.js'\n\n// ─── key lifecycle ─────────────────────────────────────────────────\nexport {\n  deriveKey,\n  deriveSecretKey,\n  generateDEK,\n  generateEphemeralKey,\n  importTransferKey,\n  exportDekSet,\n  importDekSet,\n  wrapKey,\n  unwrapKey,\n  mintCanary,\n  checkCanary,\n  deriveDeterministicKey,\n  deriveSealedFieldKey,\n  deriveSealedFieldKeyFromCek,\n  wrapCek,\n  unwrapCek,\n  importCek,\n  deriveEchoKey,\n} from './crypto.js'\nexport type { SecretKeyUsage } from './crypto.js'\n// ─── shared plumbing ───────────────────────────────────────────────\n//\n// Everything from here to the end of this block used to be twelve modules\n// under `./record-keys/`. They now live once in `../plumbing/`, and this\n// capsule is one of two callers of `makeCapsule()`.\n//\n// The split below is not cosmetic. The cipher-FREE half is re-exported\n// straight from its module: it inspects envelope fields and derives hash\n// input, so there is nothing to bind and every capsule gets the identical\n// function. The cipher-BOUND half is destructured off `aesCapsule`, which is\n// `makeCapsule(aesPrimitives)` — one binding for the whole capsule, so a value\n// exported here and a value used inside `classify/**` are the SAME object.\nexport {\n  buildRecordAad,\n  recordAadFor,\n  buildRecordEnvelope,\n  isTombstone,\n  isTombstoneShape,\n  buildTombstone,\n  isDeleteMarker,\n  buildDeleteMarker,\n  requireSealedBody,\n  sealedBodyArgs,\n  envelopeBodySize,\n  hasPerRecordKey,\n  envelopeBodyForHash,\n  hasSealedBody,\n} from '../plumbing/index.js'\n// ─── digest group ──────────────────────────────────────────────────\n// Shared, not AES-specific: the seam design marks `digest` \"as today\" for every\n// capsule. Re-exported here so the barrel's surface is unchanged.\nexport {\n  sha256Hex,\n  sha256Bytes,\n  hmacSha256Hex,\n  hmacSignHex,\n  hkdfAesGcmKey,\n  deriveBlobAddressKey,\n  derivePresenceKey,\n  derivePresenceTagKey,\n  generateIV,\n  generateSalt,\n  generateRecoverySecret,\n  bufferToBase64,\n  base64ToBuffer,\n  encodeEchoParts,\n} from '../plumbing/digest.js'\nexport type { EchoSecretParts } from '../plumbing/digest.js'\nexport type { RecordIdentity, RecordRef } from '../plumbing/index.js'\nimport type { RecordCodecBase } from '../plumbing/record-codec.js'\n/**\n * `RecordCodec` is a VALUE (the capsule-bound subclass, destructured below) and\n * a TYPE (the module-level generic base). A type ALIAS can coexist with a value\n * of the same name; a `export type { RecordCodec }` RE-EXPORT cannot, which is\n * what `TS2323: Cannot redeclare exported variable` was saying.\n */\nexport type RecordCodec<T = Record<string, unknown>> = RecordCodecBase<T>\nexport { buildSealedRecordEnvelope } from '../plumbing/record-envelope.js'\nexport type { RecordEnvelopeBody } from '../plumbing/record-envelope.js'\nexport type { RewrappedBody } from '../plumbing/lifecycle.js'\nexport type { SealedShredSlot } from '../plumbing/record-codec.js'\nexport type { SealingContext } from '../plumbing/sealing.js'\nexport type { DeterministicContext } from '../plumbing/deterministic.js'\n\nexport const {\n  // envelope body\n  openEnvelopeJson,\n  writeEnvelopeBody,\n  verifyRecordIdentity,\n  // key lifecycle\n  resolveStableCek,\n  rewrapBodyToDek,\n  rewrapEnvelope,\n  applyRewrappedBody,\n  isRewrappedUnder,\n  // rekey\n  rekeyEnvelopeToDek,\n  rekeyEnvelopeIfNeeded,\n  envelopeOpensUnderAny,\n  rekeyBlobSet,\n  // record codec\n  RecordCodec,\n  // sealed slots — ONLY `makeReservedEnvelopes` is part of the frozen surface.\n  // The other seven are capsule-internal; destructuring the whole capsule here\n  // leaked them and widened the golden by 8 names. A surface is a contract, so\n  // the fix is to narrow the barrel, not to re-baseline the golden.\n  makeReservedEnvelopes,\n  // sealing\n  SEALED_CEK_NS,\n  sealRecordToHost,\n  revokeSealedRecord,\n  rotateRecordCek,\n  // deterministic\n  findByDet,\n  queryByDet,\n} = aesCapsule\n\n// ─── reserved envelopes (ViaCryptoCtx.reservedEnvelopes capability) ──\n\n// ─── classify (stage-2 verify oracle primitives) ────────────────────\n// ADDITIVE per Enclave Contract v1. A fork must provide these four; the\n// verify/matchGroup orchestration (classify/verify.ts) sits behind the\n// with-shape dynamic-import seam and is not part of the fork contract.\nexport { deriveVdigSlotKey } from './classify/vdig.js'\nexport { pbkdf2VerifyDigest } from './classify/digest.js'\nexport { ctEqualTags } from '../plumbing/ct-equal.js'\nexport { evaluateKofN } from '../plumbing/kofn.js'\n\n// ─── classify (slice-2b equatable blind index) ──────────────────────\n// ADDITIVE per Enclave Contract v1. A fork must provide these four; the\n// findByDigest orchestration (collection.ts) sits behind the with-shape\n// dynamic-import seam and is not part of the fork contract.\nexport { deriveClassifyIndexKey, deriveClassifyIndexSalt, mintBidxTag } from './classify/bidx.js'\nexport { computeBidxTarget } from './classify/find.js'\n\n// ─── broker (proof derivation + challenge/verify, #479 slice 2) ─────\n// ADDITIVE per Enclave Contract v1. A fork must provide these five; the\n// seed lifecycle + network/cache orchestration (with-party/broker/**) sits\n// behind its own dynamic-import seam and is not part of the fork contract.\nexport {\n  deriveBrokerProofBits,\n  deriveBrokerProofKey,\n  computeBrokerProof,\n  issueChallenge,\n  verifyBrokerProof,\n} from './broker/proof.js'\nexport type { BrokerProofCanonicalParts, VerifyBrokerProofArgs, IssuedChallenge } from './broker/proof.js'\n\n// ─── sign ─────────────────────────────────────────────────────────────\nexport { generateSigningKeyPair, signBytes, verifyBytes } from '../plumbing/sign.js'\n\n// ─── recipient sealing ────────────────────────────────────────────────\nexport type { EnclaveKeyPair } from './crypto.js'\nexport {\n  generateRecipientKeyPair,\n  exportRecipientPublicKeySpki,\n  importRecipientPublicKeySpki,\n  recipientWrap,\n  recipientUnwrap,\n} from './crypto.js'\n\n// ─── capabilities ─────────────────────────────────────────────────────\n// What THIS capsule supports. Part of the contract every capsule implements,\n// not an enclave-aes detail — an alternative declares its own, and a service\n// asserts against it at createNoydb() rather than failing on first write.\nexport { capabilities } from './capabilities.js'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwEA,IAAM,SAAS,WAAW,OAAO;AAG1B,IAAM,sBAAsB;AAG5B,IAAM,uBAAuB;AAGpC,IAAM,2BAA2B;AAuCjC,SAAS,eAAe,SAAiB,UAAkB,OAA0C;AACnG,SAAO,KAAK,UAAU;AAAA,IACpB;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,MAAM,WAAW;AAAA,IACjB,MAAM,eAAe;AAAA,IACrB,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AACH;AAQA,eAAsB,sBACpB,MACA,SACA,UACqB;AACrB,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,MAAsB,QAAQ,OAAO,CAAC,YAAY,CAAC;AACjG,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,mBAAmB;AACzD,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,qBAAqB,SAAS,QAAQ,CAAC,CAAC;AAC9F,QAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,GAAG;AAChG,SAAO,IAAI,WAAW,IAAI;AAC5B;AAQA,eAAsB,qBACpB,MACA,SACA,UACqB;AACrB,QAAM,YAAY,MAAM,sBAAsB,MAAM,SAAS,QAAQ;AACrE,MAAI;AACF,WAAO,MAAM,OAAO,UAAU,OAAO,WAA2B,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AAAA,EACpH,UAAE;AACA,cAAU,KAAK,CAAC;AAAA,EAClB;AACF;AAWA,eAAsB,mBACpB,MACA,SACA,UACA,gBACiB;AACjB,MAAI;AACF,QAAI,eAAe,gBAAgB,IAAI;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,YAAY,eAAe,SAAS,UAAU,cAAc;AAClE,UAAM,MAAM,MAAM,qBAAqB,MAAM,SAAS,QAAQ;AAC9D,UAAM,MAAM,MAAM,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,SAAS,CAAiB;AAC9F,WAAO,eAAe,IAAI,WAAW,GAAG,CAAC;AAAA,EAC3C,UAAE;AACA,SAAK,KAAK,CAAC;AAAA,EACb;AACF;AAQO,SAAS,eAAe,MAA4C;AACzE,QAAM,QAAQ,MAAM,SAAS;AAC7B,QAAM,QAAQ,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAClE,SAAO;AAAA,IACL,WAAW,eAAe,KAAK;AAAA,IAC/B,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,EAAE,YAAY;AAAA,EACtD;AACF;AAgBA,eAAsB,kBAAkB,MAA+C;AACrF,QAAM,QAAQ,MAAM,KAAK,iBAAiB,KAAK,SAAS;AACxD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI,KAAK,gBAAgB,GAAI,QAAO;AAEpC,QAAM,YAAY,eAAe,KAAK,SAAS,KAAK,UAAU;AAAA,IAC5D,gBAAgB,KAAK;AAAA,IACrB,SAAS,KAAK;AAAA,IACd,aAAa,KAAK;AAAA,IAClB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,EAClB,CAAC;AACD,QAAM,MAAM,MAAM,OAAO;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,IACL,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AACA,QAAM,KAAK,MAAM,OAAO;AAAA,IACtB;AAAA,IACA;AAAA,IACA,eAAe,KAAK,KAAK;AAAA,IACzB,IAAI,YAAY,EAAE,OAAO,SAAS;AAAA,EACpC;AACA,MAAI,CAAC,GAAI,QAAO;AAEhB,SAAO,KAAK,IAAI,IAAI,KAAK,MAAM,KAAK,SAAS;AAC/C;;;ACvOA,SAAS,UAAa,OAAqC;AACzD,QAAM,MAAM,IAAI,IAAO,KAAK;AAC5B,QAAM,SAAS,MAAa;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,MAAM;AACV,MAAI,SAAS;AACb,MAAI,QAAQ;AACZ,SAAO,OAAO,OAAO,GAAG;AAC1B;AAEA,IAAM,MAAiC,UAAwB;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,SAAS,eAA0C;AACxD,SAAO;AACT;;;AC0GO,IAAM;AAAA;AAAA,EAEX;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AACF,IAAI;","names":[]}
+{"version":3,"sources":["../../../src/capsule/enclave-aes/broker/proof.ts","../../../src/capsule/enclave-aes/capabilities.ts","../../../src/capsule/enclave-aes/index.ts"],"sourcesContent":["/**\n * Credential-broker proof crypto (#479, credential-broker spec §3).\n *\n * The `_broker` seed (32 random bytes, decrypted from `_broker/<brokerId>` by\n * the party layer) is never transmitted. Instead, a **proof key** is\n * HKDF-derived from it, domain-separated per `(vaultId, brokerId)`, and the\n * derived bits are registered with the broker host once at enrol. Steady\n * state, the client re-derives the same key from the seed and signs a\n * **canonical** string binding the request's identity/context, so the broker\n * can verify a fresh HMAC on every mint without ever holding the seed itself.\n *\n * ## Derivation (spec §3, follow verbatim)\n *\n * ```\n * hkdf      = importKey('raw', seed, 'HKDF', false, ['deriveBits'])\n * proofBits = deriveBits({ name:'HKDF', hash:'SHA-256',\n *                          salt: utf8(BROKER_PROOF_DOMAIN),\n *                          info: utf8(JSON.stringify([BROKER_PROOF_DOMAIN, vaultId, brokerId])) },\n *                        hkdf, 256)\n * proofKey  = importKey('raw', proofBits, { name:'HMAC', hash:'SHA-256' }, false, ['sign'])\n * proof     = base64(sign('HMAC', proofKey, utf8(canonical)))\n * ```\n *\n * `BROKER_PROOF_DOMAIN` is both the HKDF salt and the first `info` array\n * element (the injective-JSON-array convention `deriveClassifyIndexKey`\n * established — see `classify/bidx.ts`). `BROKER_PROOF_VERSION` is the\n * separate MAC version tag, the first element of the `canonical` array.\n *\n * ## Canonical (spec §2 step 3)\n *\n * `JSON.stringify([BROKER_PROOF_VERSION, vaultId, endpointOrigin, brokerId,\n * profile ?? '', instancePid ?? '', challenge, expiresAt])` — every binding\n * field folded into ONE MAC input:\n *  - `vaultId` (V1), `challenge` (V3), `expiresAt` (V4) — verbatim strings,\n *    never reparsed/reformatted (F8): a byte-identical ISO string is\n *    required, so e.g. `Z` vs `+00:00` for the same instant fails.\n *  - `profile ?? ''` (F1) — a proof captured at one profile cannot be\n *    replayed at another.\n *  - `endpointOrigin` (F4) — a proof cannot be relayed to a different broker\n *    endpoint reusing the same `brokerId`.\n *  - `instancePid ?? ''` (F7) — an EMPTY STRING `instancePid` is forbidden in\n *    both {@link computeBrokerProof} and {@link verifyBrokerProof}: absent\n *    (the field omitted) and `''` must stay distinguishable, or `?? ''`\n *    would alias \"no instance\" onto a real registered instance.\n *\n * ## Verify order (spec §3, non-negotiable, F2/F6)\n *\n * {@link verifyBrokerProof} MUST, in this exact order: (1) burn the challenge\n * via `consumeChallenge` FIRST and short-circuit `false` before any MAC work\n * (F2 — burn-on-presentation, not burn-on-success); (2) recompute the\n * canonical and compare with `crypto.subtle.verify('HMAC', …)` — portable,\n * constant-time, never a manual byte compare or Node `timingSafeEqual` (F6);\n * (3) assert `now < expiresAt` — the client clock is never trusted, so this\n * check only matters once the MAC (which covers `expiresAt`) has verified.\n *\n * ## Zeroing (F5)\n *\n * `seed` and the transient HKDF output are raw, durable secret material —\n * the `recovery.ts:276-307` `try{}finally{secret.fill(0)}` discipline, not\n * the ephemeral-CEK happy-path zeroing elsewhere. {@link computeBrokerProof}\n * zeroes the `seed` argument in a `finally` on every path including a throw;\n * {@link deriveBrokerProofKey} zeroes its own transient HKDF-output bytes the\n * same way. {@link deriveBrokerProofBits} does not zero `seed` — it exists\n * so the party layer can register the raw bits at one-time enrol (the value\n * that must survive the call to be base64-encoded and POSTed).\n *\n * @module\n */\nimport type { EnclaveKey } from '../crypto.js'\nimport { base64ToBuffer, bufferToBase64 } from '../../plumbing/digest.js'\nimport { ValidationError } from '../../../kernel/errors.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/** HKDF salt domain for the broker proof key — also the first `info` array element. */\nexport const BROKER_PROOF_DOMAIN = 'noydb-broker-proof'\n\n/** MAC version tag — the first element of the `canonical` array signed/verified (admin shared seed). */\nexport const BROKER_PROOF_VERSION = 'noydb-broker-proof-v1'\n\n/**\n * MAC version tag for a MEMBER proof (core#73): the canonical additionally\n * binds `userId` and `role` right after `brokerId`, so the host verifies WHO\n * proved and at WHICH role with the key it registered for that member — a\n * member cannot claim another user's key or a wider role than the roster\n * granted. Selected by the presence of `member` on the canonical parts; the\n * admin canonical (v1) is byte-for-byte unchanged.\n */\nconst BROKER_PROOF_MEMBER_VERSION = 'noydb-broker-proof-v2'\n\n/** The member identity bound into a v2 canonical and into the HKDF info (core#73). */\nexport interface BrokerMemberIdentity {\n  readonly userId: string\n  readonly role: string\n}\n\n/** Default challenge TTL (spec §2 step 2: \"TTL ≤ 60 s\"). */\nconst DEFAULT_CHALLENGE_TTL_MS = 60_000\n\n/** The canonical-binding fields a client supplies alongside `vaultId`/`brokerId` (spec §2 step 3). */\nexport interface BrokerProofCanonicalParts {\n  readonly endpointOrigin: string\n  /** Present ⇒ a member proof (canonical v2, member-scoped HKDF); absent ⇒ the admin shared seed (v1). */\n  readonly member?: BrokerMemberIdentity | undefined\n  readonly profile?: string | undefined\n  readonly instancePid?: string | undefined\n  readonly challenge: string\n  readonly expiresAt: string\n}\n\n/** A freshly-minted, server-random single-use challenge (spec §2 step 2). */\nexport interface IssuedChallenge {\n  readonly challenge: string\n  readonly expiresAt: string\n}\n\n/** Arguments the broker host passes to verify a submitted proof (spec §3). */\nexport interface VerifyBrokerProofArgs {\n  /**\n   * Atomically test-and-delete the challenge, returning whether it was still\n   * fresh (unconsumed and unexpired-from-the-store's-perspective). MUST burn\n   * on presentation, not on successful verification (F2).\n   */\n  readonly consumeChallenge: (challenge: string) => Promise<boolean>\n  /** The registered proof key's raw bytes, already KMS-unwrapped by the host (§7). */\n  readonly registeredProofKey: Uint8Array\n  readonly vaultId: string\n  readonly endpointOrigin: string\n  readonly brokerId: string\n  /** The member the `registeredProofKey` was registered FOR; the host supplies its own record, never the client's claim. */\n  readonly member?: BrokerMemberIdentity | undefined\n  readonly profile?: string | undefined\n  readonly instancePid?: string | undefined\n  readonly challenge: string\n  readonly expiresAt: string\n  /** base64(HMAC-SHA-256(proofKey, canonical)), as submitted by the client. */\n  readonly proof: string\n}\n\n/** Build the canonical MAC input verbatim — never reparses/reformats a field (F8). */\nfunction buildCanonical(vaultId: string, brokerId: string, parts: BrokerProofCanonicalParts): string {\n  if (parts.member) {\n    return JSON.stringify([\n      BROKER_PROOF_MEMBER_VERSION,\n      vaultId,\n      parts.endpointOrigin,\n      brokerId,\n      parts.member.userId,\n      parts.member.role,\n      parts.profile ?? '',\n      parts.instancePid ?? '',\n      parts.challenge,\n      parts.expiresAt,\n    ])\n  }\n  return JSON.stringify([\n    BROKER_PROOF_VERSION,\n    vaultId,\n    parts.endpointOrigin,\n    brokerId,\n    parts.profile ?? '',\n    parts.instancePid ?? '',\n    parts.challenge,\n    parts.expiresAt,\n  ])\n}\n\n/**\n * The HKDF step: derive the 256-bit proof bits from the `_broker` seed,\n * domain-separated per `(vaultId, brokerId)`. Returns the raw bits — the\n * value registered with the broker host once at enrol (spec §2 step 2/3).\n * Does not mutate or zero `seed`; the caller owns the seed's lifecycle.\n */\nexport async function deriveBrokerProofBits(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n  memberUserId?: string,\n): Promise<Uint8Array> {\n  const hkdfKey = await subtle.importKey('raw', seed as BufferSource, 'HKDF', false, ['deriveBits'])\n  const salt = new TextEncoder().encode(BROKER_PROOF_DOMAIN)\n  // core#73: a member key is domain-separated per user as well — a fourth\n  // element, so an admin info tag and a member info tag can never collide.\n  const info = new TextEncoder().encode(JSON.stringify(\n    memberUserId === undefined ? [BROKER_PROOF_DOMAIN, vaultId, brokerId] : [BROKER_PROOF_DOMAIN, vaultId, brokerId, memberUserId],\n  ))\n  const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, 256)\n  return new Uint8Array(bits)\n}\n\n/**\n * Derive the steady-state, non-extractable `['sign']` HMAC proof key from\n * the `_broker` seed. Zeroes the transient HKDF-output bytes in a `finally`\n * once the key has been imported (F5) — the raw bits never leave this\n * function in usable form after import.\n */\nexport async function deriveBrokerProofKey(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n  memberUserId?: string,\n): Promise<EnclaveKey> {\n  const proofBits = await deriveBrokerProofBits(seed, vaultId, brokerId, memberUserId)\n  try {\n    return await subtle.importKey('raw', proofBits as BufferSource, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n  } finally {\n    proofBits.fill(0)\n  }\n}\n\n/**\n * Compose derive + sign for the client: re-derive the proof key from the\n * seed and sign the canonical over `canonicalParts` (spec §2 step 3).\n *\n * Rejects an empty-string `instancePid` (F7 — absent is fine, `''` is not).\n * Zeroes the `seed` argument in a `finally` on EVERY path including a throw\n * (F5, durable-secret discipline) — the transient HKDF bits are zeroed one\n * layer down, inside {@link deriveBrokerProofKey}.\n */\nexport async function computeBrokerProof(\n  seed: Uint8Array,\n  vaultId: string,\n  brokerId: string,\n  canonicalParts: BrokerProofCanonicalParts,\n): Promise<string> {\n  try {\n    if (canonicalParts.instancePid === '') {\n      throw new ValidationError(\n        \"computeBrokerProof: instancePid must not be an empty string — omit the field entirely for \" +\n          \"'no instance' (F7); '' would alias onto a registered instance.\",\n      )\n    }\n    const canonical = buildCanonical(vaultId, brokerId, canonicalParts)\n    const key = await deriveBrokerProofKey(seed, vaultId, brokerId, canonicalParts.member?.userId)\n    const mac = await subtle.sign('HMAC', key, new TextEncoder().encode(canonical) as BufferSource)\n    return bufferToBase64(new Uint8Array(mac))\n  } finally {\n    seed.fill(0)\n  }\n}\n\n/**\n * Host-side nonce mint: 32 random bytes, base64-encoded, plus an ISO\n * `expiresAt` at most `ttlMs` (default 60 s) in the future. The caller\n * (the broker host) persists both returned strings **verbatim** and MACs\n * those exact bytes on verify — never a reparsed/reformatted copy (F8).\n */\nexport function issueChallenge(opts?: { ttlMs?: number }): IssuedChallenge {\n  const ttlMs = opts?.ttlMs ?? DEFAULT_CHALLENGE_TTL_MS\n  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(32))\n  return {\n    challenge: bufferToBase64(bytes),\n    expiresAt: new Date(Date.now() + ttlMs).toISOString(),\n  }\n}\n\n/**\n * Verify a submitted broker proof. Order is NON-NEGOTIABLE (spec §3):\n *\n * 1. `await consumeChallenge(challenge)` FIRST — burn-and-check-fresh; a\n *    not-fresh (already-consumed or unknown) challenge short-circuits to\n *    `false` before any MAC work (F2).\n * 2. Empty-string `instancePid` is rejected (F7), then the canonical is\n *    recomputed over the verbatim `endpointOrigin`/`brokerId`/`profile`/\n *    `instancePid`/`challenge`/`expiresAt` and compared via\n *    `crypto.subtle.verify('HMAC', …)` — portable, constant-time, never a\n *    manual compare or Node `timingSafeEqual` (F6).\n * 3. `now < expiresAt` — the client clock is never trusted; `expiresAt`\n *    rides inside the already-verified MAC (F4/F8).\n */\nexport async function verifyBrokerProof(args: VerifyBrokerProofArgs): Promise<boolean> {\n  const fresh = await args.consumeChallenge(args.challenge)\n  if (!fresh) return false\n\n  if (args.instancePid === '') return false\n\n  const canonical = buildCanonical(args.vaultId, args.brokerId, {\n    endpointOrigin: args.endpointOrigin,\n    member: args.member,\n    profile: args.profile,\n    instancePid: args.instancePid,\n    challenge: args.challenge,\n    expiresAt: args.expiresAt,\n  })\n  const key = await subtle.importKey(\n    'raw',\n    args.registeredProofKey as BufferSource,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['verify'],\n  )\n  const ok = await subtle.verify(\n    'HMAC',\n    key,\n    base64ToBuffer(args.proof) as BufferSource,\n    new TextEncoder().encode(canonical) as BufferSource,\n  )\n  if (!ok) return false\n\n  return Date.now() < Date.parse(args.expiresAt)\n}\n","import type { CapsuleGroup } from '../contract.js'\n\n/**\n * `enclave-aes` supports every group. It is the REFERENCE capsule — the\n * behaviour every other implementation is compared against, and the one hub\n * ships so that `npm install @noy-db/hub` alone is a working noy-db.\n *\n * An `exclave-*` refuses `authenticate` and `seal` (no secret, no key\n * hierarchy — the store's own IAM is the authority) and may refuse the\n * optional groups. That asymmetry is what the prefix means, and the\n * conformance suite asserts it from the package name rather than trusting a\n * declaration.\n *\n * Frozen so a caller cannot edit what a capsule claims to support: a mutable\n * set would let a service \"enable\" a group by adding to it, which is exactly\n * the confidently-wrong failure the typed refusal exists to prevent.\n */\n/**\n * ⛔ `Object.freeze` does NOT make a Set immutable — it guards own properties,\n * not internal slots, so `frozen.add(x)` still succeeds. Measured 2026-09-12,\n * against a test that asserted otherwise and failed. The mutators are replaced\n * so the refusal is real at runtime, not just in the type.\n *\n * Why it has to be real: a caller holding a mutable capability set can \"enable\"\n * a group the capsule does not implement, and the next thing that happens is a\n * primitive being called on a capsule that has none. `ReadonlySet` alone is a\n * compile-time claim, and a JS consumer never sees it.\n */\nfunction sealedSet<T>(items: readonly T[]): ReadonlySet<T> {\n  const set = new Set<T>(items)\n  const refuse = (): never => {\n    throw new TypeError(\n      'capabilities() is immutable — a capsule\\'s declared groups cannot be edited by a caller',\n    )\n  }\n  set.add = refuse as never\n  set.delete = refuse as never\n  set.clear = refuse as never\n  return Object.freeze(set)\n}\n\nconst ALL: ReadonlySet<CapsuleGroup> = sealedSet<CapsuleGroup>([\n  'authenticate',\n  'seal',\n  'cipher',\n  'digest',\n  'sign',\n  'codec',\n  'sealing',\n  'deterministic',\n  'classify',\n  // ⭐ ADDED 2026-09-16 (core#42). `enclave-aes` implements `wrapCek` and\n  // `unwrapCek`, so advertising the group is the truthful `capabilities()`.\n  // The nine-member set was the REFERENCE capsule under-reporting itself:\n  // \"supports every group\" was the documented intent above, and it had been\n  // untrue since `per-record-keys` existed as a refusable thing.\n  // ⛔ This is a published behaviour change — `capabilities()` returns one\n  // more member to any consumer that inspects it. Release-noted by name.\n  'per-record-keys',\n])\n\nexport function capabilities(): ReadonlySet<CapsuleGroup> {\n  return ALL\n}\n","/**\n * **capsule/enclave-aes** — the hub's crypto interior, behind one door.\n *\n * This barrel is **the fork-swap contract**: a sister project that wants a\n * different crypto engine (a different KDF, a hardware-backed keystore, a\n * post-quantum wrap algorithm, …) replaces the entire `capsule/enclave-aes/`\n * folder wholesale and only has to honor the exports below. Nothing outside\n * `capsule/enclave-aes/**` may deep-import `crypto.js` or `record-keys/*` directly\n * — `scripts/check-architecture.mjs`'s `enclave-barrel-only` check enforces\n * that mechanically. Import sites inside `capsule/enclave-aes/**` keep their\n * existing relative imports; this door is for everyone else.\n *\n * The export list is the OBSERVED contract — exactly the symbols consumed\n * from outside this folder today — grouped by the module that defines them:\n *\n *   - key type       — `crypto.ts`: `EnclaveKey`, the opaque key type every\n *                       barrel-facing signature traffics in (`= CryptoKey` in\n *                       noy-db's reference enclave; a fork redefines it to its\n *                       own key representation — see the type's own doc for\n *                       the fork contract).\n *   - crypto ops     — `crypto.ts`: AES-256-GCM encrypt/decrypt (+ bytes, AAD,\n *                       deterministic variants), SHA-256 / HMAC-SHA-256 hashing.\n *   - key lifecycle  — `crypto.ts` + `record-keys/lifecycle.ts`: KEK/DEK\n *                       derivation, AES-KW wrap/unwrap, per-record CEK\n *                       wrap/unwrap/import + resolution/re-wrap, HKDF-derived\n *                       presence/sealed-field keys, base64 helpers.\n *   - record codec   — `record-keys/record-codec.ts`: the per-record\n *                       encode/decode engine.\n *   - sealing        — `record-keys/sealing.ts`: the sealed-record grantor\n *                       primitives (seal/revoke/rotate to an `at-*` host).\n *   - deterministic  — `record-keys/deterministic.ts`: blind-equality lookup\n *                       over deterministically-encrypted fields.\n *   - tombstone      — `record-keys/tombstone.ts`: the erased-record residue.\n *   - envelope body  — `record-keys/envelope-body.ts`: the C1 protected-body\n *                       access contract (`openEnvelopeJson`,\n *                       `writeEnvelopeBody`, `hasPerRecordKey`,\n *                       `hasSealedBody`, `envelopeBodyForHash`) — the\n *                       sanctioned door onto\n *                       `_iv`/`_data`/`_cek`/`_sealed` for everyone outside\n *                       this folder.\n *   - reserved envelopes — `plumbing/sealed-slots.ts`: `makeReservedEnvelopes`,\n *                       the whole-envelope encrypt/decrypt door scoped to a\n *                       declared collection-name prefix (e.g. `_dict_`) —\n *                       `kernel/vault.ts` binds it for `DictionaryHandle`\n *                       (#629 Task 4).\n *\n * Additive changes only — removing or renaming an export here is breaking\n * for any fork. Frozen by `__tests__/enclave-surface-golden.test.ts`.\n *\n * **Refusal contract:** the barrel above is frozen — every symbol must\n * exist in any fork — but the optional groups (sealing, deterministic,\n * per-record-key lifecycle) MAY throw `EnclaveNotSupportedError` instead\n * of implementing the reference behavior. The core groups (crypto ops,\n * record codec, tombstone) MUST NOT throw it — they are load-bearing for\n * every consumer regardless of which enclave is wired in. noy-db's own\n * enclave supports every group, so it never throws this error.\n */\n\nimport { aesCapsule } from './bound.js'\n\n// ─── key type ──────────────────────────────────────────────────────\nexport type { EnclaveKey, EncryptResult } from './crypto.js'\n\n// ─── crypto ops ────────────────────────────────────────────────────\nexport {\n  encrypt,\n  decrypt,\n  encryptBytes,\n  decryptBytes,\n  encryptBytesWithAAD,\n  decryptBytesWithAAD,\n  encryptDeterministic,\n  decryptDeterministic,\n} from './crypto.js'\n\n// ─── key lifecycle ─────────────────────────────────────────────────\nexport {\n  deriveKey,\n  deriveSecretKey,\n  generateDEK,\n  generateEphemeralKey,\n  importTransferKey,\n  importWrappingKey,\n  exportDekSet,\n  importDekSet,\n  wrapKey,\n  unwrapKey,\n  mintCanary,\n  checkCanary,\n  deriveDeterministicKey,\n  deriveSealedFieldKey,\n  deriveSealedFieldKeyFromCek,\n  wrapCek,\n  unwrapCek,\n  importCek,\n  deriveEchoKey,\n} from './crypto.js'\nexport type { SecretKeyUsage } from './crypto.js'\n// ─── shared plumbing ───────────────────────────────────────────────\n//\n// Everything from here to the end of this block used to be twelve modules\n// under `./record-keys/`. They now live once in `../plumbing/`, and this\n// capsule is one of two callers of `makeCapsule()`.\n//\n// The split below is not cosmetic. The cipher-FREE half is re-exported\n// straight from its module: it inspects envelope fields and derives hash\n// input, so there is nothing to bind and every capsule gets the identical\n// function. The cipher-BOUND half is destructured off `aesCapsule`, which is\n// `makeCapsule(aesPrimitives)` — one binding for the whole capsule, so a value\n// exported here and a value used inside `classify/**` are the SAME object.\nexport {\n  buildRecordAad,\n  recordAadFor,\n  buildRecordEnvelope,\n  isTombstone,\n  isTombstoneShape,\n  buildTombstone,\n  isDeleteMarker,\n  buildDeleteMarker,\n  requireSealedBody,\n  sealedBodyArgs,\n  envelopeBodySize,\n  hasPerRecordKey,\n  envelopeBodyForHash,\n  hasSealedBody,\n} from '../plumbing/index.js'\n// ─── digest group ──────────────────────────────────────────────────\n// Shared, not AES-specific: the seam design marks `digest` \"as today\" for every\n// capsule. Re-exported here so the barrel's surface is unchanged.\nexport {\n  sha256Hex,\n  sha256Bytes,\n  hmacSha256Hex,\n  hmacSignHex,\n  hkdfAesGcmKey,\n  deriveBlobAddressKey,\n  derivePresenceKey,\n  derivePresenceTagKey,\n  generateIV,\n  generateSalt,\n  generateRecoverySecret,\n  bufferToBase64,\n  base64ToBuffer,\n  encodeEchoParts,\n} from '../plumbing/digest.js'\nexport type { EchoSecretParts } from '../plumbing/digest.js'\nexport type { RecordIdentity, RecordRef } from '../plumbing/index.js'\nimport type { RecordCodecBase } from '../plumbing/record-codec.js'\n/**\n * `RecordCodec` is a VALUE (the capsule-bound subclass, destructured below) and\n * a TYPE (the module-level generic base). A type ALIAS can coexist with a value\n * of the same name; a `export type { RecordCodec }` RE-EXPORT cannot, which is\n * what `TS2323: Cannot redeclare exported variable` was saying.\n */\nexport type RecordCodec<T = Record<string, unknown>> = RecordCodecBase<T>\nexport { buildSealedRecordEnvelope } from '../plumbing/record-envelope.js'\nexport type { RecordEnvelopeBody } from '../plumbing/record-envelope.js'\nexport type { RewrappedBody } from '../plumbing/lifecycle.js'\nexport type { SealedShredSlot } from '../plumbing/record-codec.js'\nexport type { SealingContext } from '../plumbing/sealing.js'\nexport type { DeterministicContext } from '../plumbing/deterministic.js'\n\nexport const {\n  // envelope body\n  openEnvelopeJson,\n  writeEnvelopeBody,\n  verifyRecordIdentity,\n  // key lifecycle\n  resolveStableCek,\n  rewrapBodyToDek,\n  rewrapEnvelope,\n  applyRewrappedBody,\n  isRewrappedUnder,\n  // rekey\n  rekeyEnvelopeToDek,\n  rekeyEnvelopeIfNeeded,\n  envelopeOpensUnderAny,\n  rekeyBlobSet,\n  // record codec\n  RecordCodec,\n  // sealed slots — ONLY `makeReservedEnvelopes` is part of the frozen surface.\n  // The other seven are capsule-internal; destructuring the whole capsule here\n  // leaked them and widened the golden by 8 names. A surface is a contract, so\n  // the fix is to narrow the barrel, not to re-baseline the golden.\n  makeReservedEnvelopes,\n  // sealing\n  SEALED_CEK_NS,\n  sealRecordToHost,\n  revokeSealedRecord,\n  rotateRecordCek,\n  // deterministic\n  findByDet,\n  queryByDet,\n} = aesCapsule\n\n// ─── reserved envelopes (ViaCryptoCtx.reservedEnvelopes capability) ──\n\n// ─── classify (stage-2 verify oracle primitives) ────────────────────\n// ADDITIVE per Enclave Contract v1. A fork must provide these four; the\n// verify/matchGroup orchestration (classify/verify.ts) sits behind the\n// with-shape dynamic-import seam and is not part of the fork contract.\nexport { deriveVdigSlotKey } from './classify/vdig.js'\nexport { pbkdf2VerifyDigest } from './classify/digest.js'\nexport { ctEqualTags } from '../plumbing/ct-equal.js'\nexport { evaluateKofN } from '../plumbing/kofn.js'\n\n// ─── classify (slice-2b equatable blind index) ──────────────────────\n// ADDITIVE per Enclave Contract v1. A fork must provide these four; the\n// findByDigest orchestration (collection.ts) sits behind the with-shape\n// dynamic-import seam and is not part of the fork contract.\nexport { deriveClassifyIndexKey, deriveClassifyIndexSalt, mintBidxTag } from './classify/bidx.js'\nexport { computeBidxTarget } from './classify/find.js'\n\n// ─── broker (proof derivation + challenge/verify, #479 slice 2) ─────\n// ADDITIVE per Enclave Contract v1. A fork must provide these five; the\n// seed lifecycle + network/cache orchestration (with-party/broker/**) sits\n// behind its own dynamic-import seam and is not part of the fork contract.\nexport {\n  deriveBrokerProofBits,\n  deriveBrokerProofKey,\n  computeBrokerProof,\n  issueChallenge,\n  verifyBrokerProof,\n} from './broker/proof.js'\nexport type { BrokerProofCanonicalParts, BrokerMemberIdentity, VerifyBrokerProofArgs, IssuedChallenge } from './broker/proof.js'\n\n// ─── sign ─────────────────────────────────────────────────────────────\nexport { generateSigningKeyPair, signBytes, verifyBytes } from '../plumbing/sign.js'\n\n// ─── recipient sealing ────────────────────────────────────────────────\nexport type { EnclaveKeyPair } from './crypto.js'\nexport {\n  generateRecipientKeyPair,\n  exportRecipientPrivateKeyPkcs8,\n  importRecipientKeyPair,\n  exportRecipientPublicKeySpki,\n  importRecipientPublicKeySpki,\n  recipientWrap,\n  recipientUnwrap,\n} from './crypto.js'\n\n// ─── capabilities ─────────────────────────────────────────────────────\n// What THIS capsule supports. Part of the contract every capsule implements,\n// not an enclave-aes detail — an alternative declares its own, and a service\n// asserts against it at createNoydb() rather than failing on first write.\nexport { capabilities } from './capabilities.js'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwEA,IAAM,SAAS,WAAW,OAAO;AAG1B,IAAM,sBAAsB;AAG5B,IAAM,uBAAuB;AAUpC,IAAM,8BAA8B;AASpC,IAAM,2BAA2B;AA2CjC,SAAS,eAAe,SAAiB,UAAkB,OAA0C;AACnG,MAAI,MAAM,QAAQ;AAChB,WAAO,KAAK,UAAU;AAAA,MACpB;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,MAAM,OAAO;AAAA,MACb,MAAM,OAAO;AAAA,MACb,MAAM,WAAW;AAAA,MACjB,MAAM,eAAe;AAAA,MACrB,MAAM;AAAA,MACN,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,KAAK,UAAU;AAAA,IACpB;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,MAAM,WAAW;AAAA,IACjB,MAAM,eAAe;AAAA,IACrB,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AACH;AAQA,eAAsB,sBACpB,MACA,SACA,UACA,cACqB;AACrB,QAAM,UAAU,MAAM,OAAO,UAAU,OAAO,MAAsB,QAAQ,OAAO,CAAC,YAAY,CAAC;AACjG,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,mBAAmB;AAGzD,QAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,IACzC,iBAAiB,SAAY,CAAC,qBAAqB,SAAS,QAAQ,IAAI,CAAC,qBAAqB,SAAS,UAAU,YAAY;AAAA,EAC/H,CAAC;AACD,QAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,GAAG;AAChG,SAAO,IAAI,WAAW,IAAI;AAC5B;AAQA,eAAsB,qBACpB,MACA,SACA,UACA,cACqB;AACrB,QAAM,YAAY,MAAM,sBAAsB,MAAM,SAAS,UAAU,YAAY;AACnF,MAAI;AACF,WAAO,MAAM,OAAO,UAAU,OAAO,WAA2B,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AAAA,EACpH,UAAE;AACA,cAAU,KAAK,CAAC;AAAA,EAClB;AACF;AAWA,eAAsB,mBACpB,MACA,SACA,UACA,gBACiB;AACjB,MAAI;AACF,QAAI,eAAe,gBAAgB,IAAI;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,UAAM,YAAY,eAAe,SAAS,UAAU,cAAc;AAClE,UAAM,MAAM,MAAM,qBAAqB,MAAM,SAAS,UAAU,eAAe,QAAQ,MAAM;AAC7F,UAAM,MAAM,MAAM,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,SAAS,CAAiB;AAC9F,WAAO,eAAe,IAAI,WAAW,GAAG,CAAC;AAAA,EAC3C,UAAE;AACA,SAAK,KAAK,CAAC;AAAA,EACb;AACF;AAQO,SAAS,eAAe,MAA4C;AACzE,QAAM,QAAQ,MAAM,SAAS;AAC7B,QAAM,QAAQ,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAClE,SAAO;AAAA,IACL,WAAW,eAAe,KAAK;AAAA,IAC/B,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,EAAE,YAAY;AAAA,EACtD;AACF;AAgBA,eAAsB,kBAAkB,MAA+C;AACrF,QAAM,QAAQ,MAAM,KAAK,iBAAiB,KAAK,SAAS;AACxD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI,KAAK,gBAAgB,GAAI,QAAO;AAEpC,QAAM,YAAY,eAAe,KAAK,SAAS,KAAK,UAAU;AAAA,IAC5D,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,aAAa,KAAK;AAAA,IAClB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,EAClB,CAAC;AACD,QAAM,MAAM,MAAM,OAAO;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,IACL,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AACA,QAAM,KAAK,MAAM,OAAO;AAAA,IACtB;AAAA,IACA;AAAA,IACA,eAAe,KAAK,KAAK;AAAA,IACzB,IAAI,YAAY,EAAE,OAAO,SAAS;AAAA,EACpC;AACA,MAAI,CAAC,GAAI,QAAO;AAEhB,SAAO,KAAK,IAAI,IAAI,KAAK,MAAM,KAAK,SAAS;AAC/C;;;AChRA,SAAS,UAAa,OAAqC;AACzD,QAAM,MAAM,IAAI,IAAO,KAAK;AAC5B,QAAM,SAAS,MAAa;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,MAAM;AACV,MAAI,SAAS;AACb,MAAI,QAAQ;AACZ,SAAO,OAAO,OAAO,GAAG;AAC1B;AAEA,IAAM,MAAiC,UAAwB;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA;AACF,CAAC;AAEM,SAAS,eAA0C;AACxD,SAAO;AACT;;;ACmGO,IAAM;AAAA;AAAA,EAEX;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AACF,IAAI;","names":[]}

package/dist/capsule/index.d.ts

@@ -21,7 +21,7 @@
  * the surface test freezes, so the door and the golden cannot drift. Adding a
  * capsule primitive means adding it to the golden and regenerating.
  */
-export { RecordCodec, SEALED_CEK_NS, applyRewrappedBody, base64ToBuffer, bufferToBase64, buildDeleteMarker, buildRecordAad, buildRecordEnvelope, buildSealedRecordEnvelope, buildTombstone, capabilities, checkCanary, computeBidxTarget, computeBrokerProof, ctEqualTags, decrypt, decryptBytes, decryptBytesWithAAD, decryptDeterministic, deriveBlobAddressKey, deriveBrokerProofBits, deriveBrokerProofKey, deriveClassifyIndexKey, deriveClassifyIndexSalt, deriveDeterministicKey, deriveEchoKey, deriveKey, derivePresenceKey, derivePresenceTagKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, deriveSecretKey, deriveVdigSlotKey, encodeEchoParts, encrypt, encryptBytes, encryptBytesWithAAD, encryptDeterministic, envelopeBodyForHash, envelopeBodySize, envelopeOpensUnderAny, evaluateKofN, exportDekSet, exportRecipientPublicKeySpki, findByDet, generateDEK, generateEphemeralKey, generateIV, generateRecipientKeyPair, generateRecoverySecret, generateSalt, generateSigningKeyPair, hasPerRecordKey, hasSealedBody, requireSealedBody, sealedBodyArgs, hkdfAesGcmKey, hmacSha256Hex, hmacSignHex, importCek, importDekSet, importRecipientPublicKeySpki, importTransferKey, isDeleteMarker, isRewrappedUnder, isTombstone, isTombstoneShape, issueChallenge, makeReservedEnvelopes, mintBidxTag, mintCanary, openEnvelopeJson, pbkdf2VerifyDigest, queryByDet, recipientUnwrap, recipientWrap, recordAadFor, rekeyBlobSet, rekeyEnvelopeIfNeeded, rekeyEnvelopeToDek, resolveStableCek, revokeSealedRecord, rewrapBodyToDek, rewrapEnvelope, rotateRecordCek, sealRecordToHost, sha256Bytes, sha256Hex, signBytes, unwrapCek, unwrapKey, verifyBrokerProof, verifyBytes, verifyRecordIdentity, wrapCek, wrapKey, writeEnvelopeBody, } from '#capsule';
-export type { BrokerProofCanonicalParts, DeterministicContext, EchoSecretParts, EnclaveKey, EnclaveKeyPair, EncryptResult, IssuedChallenge, RecordEnvelopeBody, RecordIdentity, RecordRef, RewrappedBody, SealedShredSlot, SealingContext, SecretKeyUsage, VerifyBrokerProofArgs, } from '#capsule';
+export { RecordCodec, SEALED_CEK_NS, applyRewrappedBody, base64ToBuffer, bufferToBase64, buildDeleteMarker, buildRecordAad, buildRecordEnvelope, buildSealedRecordEnvelope, buildTombstone, capabilities, checkCanary, computeBidxTarget, computeBrokerProof, ctEqualTags, decrypt, decryptBytes, decryptBytesWithAAD, decryptDeterministic, deriveBlobAddressKey, deriveBrokerProofBits, deriveBrokerProofKey, deriveClassifyIndexKey, deriveClassifyIndexSalt, deriveDeterministicKey, deriveEchoKey, deriveKey, derivePresenceKey, derivePresenceTagKey, deriveSealedFieldKey, deriveSealedFieldKeyFromCek, deriveSecretKey, deriveVdigSlotKey, encodeEchoParts, encrypt, encryptBytes, encryptBytesWithAAD, encryptDeterministic, envelopeBodyForHash, envelopeBodySize, envelopeOpensUnderAny, evaluateKofN, exportDekSet, exportRecipientPublicKeySpki, findByDet, generateDEK, generateEphemeralKey, generateIV, generateRecipientKeyPair, exportRecipientPrivateKeyPkcs8, importRecipientKeyPair, generateRecoverySecret, generateSalt, generateSigningKeyPair, hasPerRecordKey, hasSealedBody, requireSealedBody, sealedBodyArgs, hkdfAesGcmKey, hmacSha256Hex, hmacSignHex, importCek, importDekSet, importRecipientPublicKeySpki, importTransferKey, importWrappingKey, isDeleteMarker, isRewrappedUnder, isTombstone, isTombstoneShape, issueChallenge, makeReservedEnvelopes, mintBidxTag, mintCanary, openEnvelopeJson, pbkdf2VerifyDigest, queryByDet, recipientUnwrap, recipientWrap, recordAadFor, rekeyBlobSet, rekeyEnvelopeIfNeeded, rekeyEnvelopeToDek, resolveStableCek, revokeSealedRecord, rewrapBodyToDek, rewrapEnvelope, rotateRecordCek, sealRecordToHost, sha256Bytes, sha256Hex, signBytes, unwrapCek, unwrapKey, verifyBrokerProof, verifyBytes, verifyRecordIdentity, wrapCek, wrapKey, writeEnvelopeBody, } from '#capsule';
+export type { BrokerMemberIdentity, BrokerProofCanonicalParts, DeterministicContext, EchoSecretParts, EnclaveKey, EnclaveKeyPair, EncryptResult, IssuedChallenge, RecordEnvelopeBody, RecordIdentity, RecordRef, RewrappedBody, SealedShredSlot, SealingContext, SecretKeyUsage, VerifyBrokerProofArgs, } from '#capsule';
 export type { CapsuleKey, CapsuleKeyPair, CapsuleGroup } from './contract.js';
 export { CapsuleNotSupportedError } from './contract.js';

package/dist/capsule/plumbing/record-codec.d.ts

@@ -415,6 +415,13 @@ export declare class RecordCodecBase<T> {
  * The capsule-bound codec constructor: same shape callers have always used
  * (`new RecordCodec(ctx)`), with the capsule already closed over.
  */
+/**
+ * `BoundRecordCodec` — PUBLISHED API, reachable from @noy-db/hub/capsule. Flagged as unused because
+ * nothing inside hub imports it from this module; a consumer does. Do not narrow
+ * or delete without a seam change (#55).
+ *
+ * @public
+ */
 export type BoundRecordCodec = (new <T>(ctx: RecordCodecContext<T>) => RecordCodecBase<T>) & Omit<typeof RecordCodecBase, never>;
 export declare function makeRecordCodec(p: CapsulePrimitives, slots: ReturnType<typeof makeSealedSlots>): {
     RecordCodec: BoundRecordCodec;

package/dist/{capsule-VOLX3QRQ.js → capsule-6LJAVQNM.js}

@@ -42,6 +42,7 @@ import {
   envelopeOpensUnderAny,
   evaluateKofN,
   exportDekSet,
+  exportRecipientPrivateKeyPkcs8,
   exportRecipientPublicKeySpki,
   findByDet,
   generateDEK,
@@ -58,8 +59,10 @@ import {
   hmacSignHex,
   importCek,
   importDekSet,
+  importRecipientKeyPair,
   importRecipientPublicKeySpki,
   importTransferKey,
+  importWrappingKey,
   isDeleteMarker,
   isRewrappedUnder,
   isTombstone,
@@ -96,16 +99,16 @@ import {
   wrapCek,
   wrapKey,
   writeEnvelopeBody
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   CapsuleNotSupportedError
-} from "./chunk-OIEO4WDL.js";
-import "./chunk-Q2XRFWOI.js";
+} from "./chunk-ZD7WFMV2.js";
+import "./chunk-RRTQAQ3N.js";
 import "./chunk-NH2UOV3B.js";
-import "./chunk-42ALPZ2B.js";
-import "./chunk-QMWY2FDS.js";
-import "./chunk-SV2PM2OY.js";
-import "./chunk-37EPTBBR.js";
+import "./chunk-ZF6JECDT.js";
+import "./chunk-THQ3BHLM.js";
+import "./chunk-XX4R7TUB.js";
+import "./chunk-IKPQ2GGB.js";
 export {
   CapsuleNotSupportedError,
   RecordCodec,
@@ -151,6 +154,7 @@ export {
   envelopeOpensUnderAny,
   evaluateKofN,
   exportDekSet,
+  exportRecipientPrivateKeyPkcs8,
   exportRecipientPublicKeySpki,
   findByDet,
   generateDEK,
@@ -167,8 +171,10 @@ export {
   hmacSignHex,
   importCek,
   importDekSet,
+  importRecipientKeyPair,
   importRecipientPublicKeySpki,
   importTransferKey,
+  importWrappingKey,
   isDeleteMarker,
   isRewrappedUnder,
   isTombstone,
@@ -206,4 +212,4 @@ export {
   wrapKey,
   writeEnvelopeBody
 };
-//# sourceMappingURL=capsule-VOLX3QRQ.js.map
+//# sourceMappingURL=capsule-6LJAVQNM.js.map

package/dist/cargo/index.js

@@ -5,77 +5,77 @@ import {
   describeExtraction,
   unsealDeks,
   withCargo
-} from "../chunk-H7JBY4P7.js";
-import {
-  diffVault
-} from "../chunk-LFUID7OW.js";
+} from "../chunk-B7Y2BRQA.js";
 import {
   extractPartition,
   walkClosure
-} from "../chunk-EGVJ7TM4.js";
+} from "../chunk-UL6MTRMJ.js";
+import {
+  diffVault
+} from "../chunk-LFUID7OW.js";
 import {
   createDeedOwner,
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-UIYESRD6.js";
-import "../chunk-IMQKWR46.js";
-import "../chunk-EJLV62NI.js";
+} from "../chunk-LUCQY3OM.js";
+import "../chunk-R2ZULFXU.js";
+import "../chunk-KN4LUMH6.js";
 import {
   groupAndReduce,
   reduceRecords
-} from "../chunk-N7UDP5VU.js";
+} from "../chunk-SCH2F7R2.js";
 import {
   NO_CARGO
-} from "../chunk-52MGURXO.js";
-import "../chunk-3XJQBBZD.js";
+} from "../chunk-WBUHHMLN.js";
+import "../chunk-NTVKHQ3L.js";
 import {
   isQuorum,
   runDrainBarrier
-} from "../chunk-DIZLQVAA.js";
+} from "../chunk-4CHM2TRS.js";
 import {
   CustodyApi
-} from "../chunk-V3RWOOSO.js";
-import "../chunk-3L2NBKDR.js";
-import "../chunk-KZXDLBY6.js";
-import "../chunk-5A4345TG.js";
+} from "../chunk-GYZICGRU.js";
+import "../chunk-IF2M43G4.js";
+import "../chunk-XPW7T2GN.js";
+import "../chunk-DMIEKD24.js";
 import "../chunk-GMKGGY7V.js";
 import {
   fuseRetrieval
 } from "../chunk-AURFOK3D.js";
-import "../chunk-G2MVBDFP.js";
+import "../chunk-QFW4MYGN.js";
 import "../chunk-XZHEOSQ2.js";
-import "../chunk-MBMTND6D.js";
+import "../chunk-AGGPT4UE.js";
 import "../chunk-SUZKW6UR.js";
 import "../chunk-VHM7HCKB.js";
-import "../chunk-FOEDQATO.js";
+import "../chunk-66GD7XXU.js";
 import {
   readPath
-} from "../chunk-5WWDGFOS.js";
-import "../chunk-OKSTSITU.js";
-import "../chunk-SYNY3VB5.js";
-import "../chunk-XSPFDUDG.js";
-import "../chunk-LIOVX5TJ.js";
-import "../chunk-7XMHMVTS.js";
+} from "../chunk-GIQJGXV7.js";
+import "../chunk-PR7ILCIH.js";
+import "../chunk-NCTN2FW4.js";
+import "../chunk-V7AKGAXY.js";
+import "../chunk-QT5ITL25.js";
+import "../chunk-NXQEOC3X.js";
 import {
   generateULID
 } from "../chunk-4AOERLTV.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-N7EVQD5S.js";
+import "../chunk-ONZ3B5EW.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-6QVKPHBF.js";
-import "../chunk-FLPCETP6.js";
+import "../chunk-QHG7GQKM.js";
+import "../chunk-2LBS62AC.js";
 import {
   sha256Hex
-} from "../chunk-EZGV6F47.js";
-import "../chunk-OIEO4WDL.js";
-import "../chunk-Q2XRFWOI.js";
+} from "../chunk-WRLWEYHY.js";
+import "../chunk-ZD7WFMV2.js";
+import "../chunk-RRTQAQ3N.js";
 import "../chunk-NH2UOV3B.js";
-import "../chunk-42ALPZ2B.js";
-import "../chunk-QMWY2FDS.js";
+import "../chunk-ZF6JECDT.js";
+import "../chunk-THQ3BHLM.js";
 import {
   NOYDB_ENVELOPE_GENERATION
-} from "../chunk-SV2PM2OY.js";
+} from "../chunk-XX4R7TUB.js";
 import {
   AdoptionStateError,
   CargoNotEnabledError,
@@ -90,7 +90,7 @@ import {
   UnknownShardError,
   ValidationError,
   VaultTemplateNotFoundError
-} from "../chunk-37EPTBBR.js";
+} from "../chunk-IKPQ2GGB.js";
 export {
   AdoptionStateError,
   CargoNotEnabledError,

package/dist/{chunk-GZT3NQRA.js → chunk-25FXU6WS.js}

@@ -1,6 +1,6 @@
 import {
   BrokerNotEnabledError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/port/with/broker-strategy.ts
 var NO_BROKER = {
@@ -12,6 +12,12 @@ var NO_BROKER = {
   },
   credentialSource() {
     throw new BrokerNotEnabledError();
+  },
+  // grant()/revoke() must keep working without a broker — these two are the
+  // only members of this stub that do NOT throw.
+  async enrolMember() {
+  },
+  async revokeMember() {
   }
 };
 function buildCredentialBrokerHandle(strategy, store, vault, getKeyring) {
@@ -27,4 +33,4 @@ export {
   NO_BROKER,
   buildCredentialBrokerHandle
 };
-//# sourceMappingURL=chunk-GZT3NQRA.js.map
+//# sourceMappingURL=chunk-25FXU6WS.js.map

package/dist/chunk-25FXU6WS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/port/with/broker-strategy.ts"],"sourcesContent":["/**\n * Credential-broker strategy seam (#479, credential-broker spec §5). Lives\n * on the `/with` port (the one seam the kernel spine may import statically)\n * so `Vault` can hold the `NO_BROKER` floor default without a spine→service\n * static import — the same idiom as `port/with/team-strategy.ts`.\n *\n * `BrokerCtx` bundles what the `_broker` seed lifecycle needs (`store`/\n * `vault`/`keyring`) into one argument, so `BrokerStrategy`'s three methods\n * stay uniform. The `BrokerConfig` a strategy was built with is NOT part of\n * this port-level ctx — `withBroker(config)` (`with-party/broker/active.ts`)\n * keeps it in its own closure and injects it into the richer\n * {@link BrokerSeedCtx} it passes to the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`). `NO_BROKER` (the floor\n * default) never builds a ctx — every method throws first.\n * @internal\n */\nimport type { NoydbStore, StoreCredentialSource } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\nimport { BrokerNotEnabledError } from '../../kernel/errors.js'\n\n/** Construction-time options for `withBroker(config)` (spec §5 client surface). */\nexport interface BrokerConfig {\n  /**\n   * Stable id; part of the HKDF info tag AND the proof canonical. MUST be\n   * globally-unique / endpoint-derived (spec F4) — reusing one `brokerId`\n   * across two endpoints enables a cross-endpoint relay.\n   */\n  readonly brokerId: string\n  /** https broker base URL; its origin is bound into the proof MAC (F4). */\n  readonly endpoint: string\n  /** Dev-backend session token for `/enroll` (spec decision 1). */\n  readonly attestation?: (() => string | Promise<string>) | undefined\n  /** DI for tests / non-window runtimes. */\n  readonly fetch?: typeof fetch | undefined\n  /** Refresh margin in ms, default 60_000. */\n  readonly skewMs?: number | undefined\n}\n\n/**\n * Per-call context a {@link BrokerStrategy} method needs: the seed API's\n * `store`/`vault`/`keyring`.\n */\nexport interface BrokerCtx {\n  readonly store: NoydbStore\n  readonly vault: string\n  readonly keyring: UnlockedKeyring\n}\n\n/**\n * {@link BrokerCtx} augmented with the `BrokerConfig` the `_broker` seed ops\n * (`enrollSeed`/`rotateSeed`/`mintStoreCredentials`) need. `withBroker(config)`\n * (`with-party/broker/active.ts`) builds this by injecting its closed-over\n * `config` into the port-level `BrokerCtx` it receives — the port interface\n * itself never carries `config`.\n */\nexport interface BrokerSeedCtx extends BrokerCtx {\n  readonly config: BrokerConfig\n}\n\n/** The vault-bound handle `vault.broker()` returns (spec §5). */\nexport interface CredentialBrokerHandle {\n  /** Generate+persist the `_broker` seed (idempotent), register its proof key. */\n  enroll(): Promise<void>\n  /** Rotate the seed + re-register (revokes the old proof key after a grace window). */\n  rotate(): Promise<void>\n  /** Single-flight, per-profile cache of a `StoreCredentialSource`. */\n  credentialSource(profile?: string): StoreCredentialSource\n}\n\n/** The opt-in strategy contract `withBroker(config)` implements. */\nexport interface BrokerStrategy {\n  enroll(ctx: BrokerCtx): Promise<void>\n  rotate(ctx: BrokerCtx): Promise<void>\n  credentialSource(ctx: BrokerCtx, profile?: string): StoreCredentialSource\n  /**\n   * core#73 — called by the kernel right after `grant()`: register the\n   * grantee with the broker host under its own per-member key. Needs the\n   * grantee's `secret` because the member's `_broker_member` DEK can only be\n   * opened with it, and only at this moment does the grantor hold it. A\n   * no-op for owner/admin grantees (they use the shared seed) and for the\n   * floor stub (no broker ⇒ nothing to register).\n   */\n  /**\n   * core#73 — register a sub-admin member with the host. With `secret` (a\n   * grant) the member's `_broker_member` DEK is read from their keyring; with\n   * `dek` (core#96, a role change through `updateUser`) it is the fresh key\n   * just delivered through the member's inbox.\n   */\n  enrolMember(ctx: BrokerCtx, member: { readonly userId: string; readonly secret: string } | { readonly userId: string; readonly dek: EnclaveKey }): Promise<void>\n  /** core#73 — called by the kernel right after `revoke()`: de-register the member with the host and drop its record. */\n  revokeMember(ctx: BrokerCtx, userId: string): Promise<void>\n}\n\n/**\n * No-op stub — the floor default. Every broker operation throws\n * {@link BrokerNotEnabledError}; opt in with `brokerStrategy: withBroker(config)`\n * (from `@noy-db/hub/broker`) in `createNoydb()`.\n * @internal\n */\nexport const NO_BROKER: BrokerStrategy = {\n  async enroll() { throw new BrokerNotEnabledError() },\n  async rotate() { throw new BrokerNotEnabledError() },\n  credentialSource() { throw new BrokerNotEnabledError() },\n  // grant()/revoke() must keep working without a broker — these two are the\n  // only members of this stub that do NOT throw.\n  async enrolMember() { /* no broker configured */ },\n  async revokeMember() { /* no broker configured */ },\n}\n\n/**\n * Build the vault-bound {@link CredentialBrokerHandle} `vault.broker()`\n * returns — factored out of `kernel/vault.ts` to keep that file's footprint\n * to a single accessor line (the kernel-surface ceiling). `getKeyring` is a\n * thunk, not a snapshot: the active keyring can change after `vault.load()`,\n * so each handle method re-reads it fresh at call time.\n */\nexport function buildCredentialBrokerHandle(\n  strategy: BrokerStrategy,\n  store: NoydbStore,\n  vault: string,\n  getKeyring: () => UnlockedKeyring,\n): CredentialBrokerHandle {\n  const ctx = (): BrokerCtx => ({ store, vault, keyring: getKeyring() })\n  return {\n    enroll: () => strategy.enroll(ctx()),\n    rotate: () => strategy.rotate(ctx()),\n    credentialSource: (profile) => strategy.credentialSource(ctx(), profile),\n  }\n}\n"],"mappings":";;;;;AAoGO,IAAM,YAA4B;AAAA,EACvC,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,MAAM,SAAS;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA,EACnD,mBAAmB;AAAE,UAAM,IAAI,sBAAsB;AAAA,EAAE;AAAA;AAAA;AAAA,EAGvD,MAAM,cAAc;AAAA,EAA6B;AAAA,EACjD,MAAM,eAAe;AAAA,EAA6B;AACpD;AASO,SAAS,4BACd,UACA,OACA,OACA,YACwB;AACxB,QAAM,MAAM,OAAkB,EAAE,OAAO,OAAO,SAAS,WAAW,EAAE;AACpE,SAAO;AAAA,IACL,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,QAAQ,MAAM,SAAS,OAAO,IAAI,CAAC;AAAA,IACnC,kBAAkB,CAAC,YAAY,SAAS,iBAAiB,IAAI,GAAG,OAAO;AAAA,EACzE;AACF;","names":[]}

package/dist/{chunk-OYW3I5M4.js → chunk-2DOCDOPL.js}

@@ -1,19 +1,19 @@
 import {
   installLive
-} from "./chunk-NBQ3KK6X.js";
+} from "./chunk-Y55XHMQB.js";
 import {
   installReduce
-} from "./chunk-4CIQDWRB.js";
+} from "./chunk-BFJE2GPP.js";
 import {
   installRelate
-} from "./chunk-TKVUE4JF.js";
+} from "./chunk-DQAXA2GK.js";
 import {
   ScanBuilder
-} from "./chunk-JQYKPKG6.js";
+} from "./chunk-7K42TSCY.js";
 import {
   Query,
   executePlan
-} from "./chunk-AL6ML4LA.js";
+} from "./chunk-DWCFGF2K.js";
 
 // src/kernel/query/all.ts
 installRelate();
@@ -28,4 +28,4 @@ export {
   ScanBuilder2 as ScanBuilder,
   executePlan2 as executePlan
 };
-//# sourceMappingURL=chunk-OYW3I5M4.js.map
+//# sourceMappingURL=chunk-2DOCDOPL.js.map

package/dist/chunk-2DX4JCRI.js

@@ -0,0 +1 @@
+//# sourceMappingURL=chunk-2DX4JCRI.js.map

package/dist/{chunk-FLPCETP6.js → chunk-2LBS62AC.js}

@@ -1,6 +1,6 @@
 import {
   TierWriteRefusedError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/kernel/tier-visibility.ts
 async function peekLiveTier(adapter, vault, name, id) {
@@ -49,4 +49,4 @@ export {
   dekKey,
   parseDekKey
 };
-//# sourceMappingURL=chunk-FLPCETP6.js.map
+//# sourceMappingURL=chunk-2LBS62AC.js.map

package/dist/{chunk-WXE4W2U6.js → chunk-2ST3WA3C.js}

@@ -1,16 +1,16 @@
 import {
   linkCollectionName,
   linkRowKey
-} from "./chunk-Q4UHJ5SN.js";
+} from "./chunk-O2VQ3K36.js";
 import {
   buildRecordAad,
   buildRecordEnvelope,
   encrypt,
   openEnvelopeJson
-} from "./chunk-EZGV6F47.js";
+} from "./chunk-WRLWEYHY.js";
 import {
   NoydbError
-} from "./chunk-37EPTBBR.js";
+} from "./chunk-IKPQ2GGB.js";
 
 // src/with-shape/links/link-set.ts
 var LinkSet = class {
@@ -126,4 +126,4 @@ export {
   LinkSet,
   LinkEndpointError
 };
-//# sourceMappingURL=chunk-WXE4W2U6.js.map
+//# sourceMappingURL=chunk-2ST3WA3C.js.map