@tokenoftrust/storefront-runner 4.11.0 → 4.11.1

package/apps/storefront/src/lib/engagement/contact/contactMessages.ts

@@ -1,28 +1,42 @@
 /**
  * `contact_messages` store — visitor messages from a store's contact form, kept in
- * `STOREFRONT_APPS_DB` (migrations-apps/0021). Pure over a minimal SQL seam, so the Worker runs it
- * against D1 and tests against `node:sqlite`.
+ * `STOREFRONT_APPS_DB` (migrations-apps/0022). Pure over a minimal SQL seam and an injected KMS
+ * client, so the Worker runs it against D1 and tests against `node:sqlite`.
  *
- * The visitor's name, email, phone and message exist at rest only as one contact vault envelope
- * (`lib/customers/contactVault/envelope.ts`, purpose `contact-message`) whose AAD binds tenant, stage, message
- * id and the immutable `not_after`. A row still holding legacy plaintext is never read; the rollout
- * and the hourly sweep seal it ({@link sealLegacyContactMessages}).
+ * Field-level vault. The visitor's name, email, phone and message are each their own AES-256-GCM
+ * ciphertext (`lib/customers/contactVault/fieldEnvelope.ts`) under the tenant's `contact-message`
+ * data key; the AAD binds purpose, field, tenant, stage, message id, kid and the row's immutable
+ * `ceiling`, so a ciphertext moved to another field, row, tenant or stage reads as absent. Email and
+ * phone also carry blind indexes under the tenant's `blind-index` key for exact-match search.
+ * A message is sealed in ONE batch: any pending data-key rows first, the conditional insert, the
+ * key cleanups last (the dataKeys.ts seal protocol), so a refused or racing insert commits nothing.
+ *
+ * Retention (retention.ts `messageRetention`): 365 days from receipt; preview runs it on the
+ * compressed clock and deletes the whole row at receipt + the preview cutoff. Content is readable
+ * strictly before `min(expires_at, ceiling)`.
  *
  * Every method takes the tenant id and the routed stage and scopes its SQL by both: an id belonging
  * to another tenant or stage is indistinguishable from an id that does not exist. Every read writes
- * its `contact_access_audit` row before anything is decrypted. Nothing here logs.
+ * its `contact_access_audit` row before anything is decrypted. Nothing here logs, and every error is
+ * a fixed code.
  */
+import { activeKey, cleanupStatement, keyForKid, type ActiveDataKey } from "@/lib/customers/contactVault/dataKeys.js";
+import { openField, sealField, type FieldBinding } from "@/lib/customers/contactVault/fieldEnvelope.js";
+import { blindIndex, normalizeEmail, normalizePhone } from "@/lib/customers/contactVault/blindIndex.js";
+import { VaultKeyUnavailableError, type EncryptionContext, type KmsClient } from "@/lib/customers/contactVault/kms.js";
+import { isGroupReadable, messageRetention, previewDeleteAt, readInstant } from "@/lib/customers/contactVault/retention.js";
+import { RETENTION_POLICY } from "@/lib/customers/contactVault/retentionPolicy.js";
 import {
-  openVaultRecord,
-  sealVaultRecord,
-  VaultKeyUnavailableError,
-  type VaultBinding,
-  type VaultKeyring,
-} from "@/lib/customers/contactVault/envelope.js";
-import { isReadable, notAfterFrom } from "@/lib/customers/contactVault/retention.js";
-import { admitAudit, auditStatement, type ContactActor, type VaultStage } from "@/lib/customers/contactVault/contactAudit.js";
-
-interface QueryStatement {
+  AUDIT_RECORD_IDS_MAX,
+  admitAudit,
+  auditRecordIds,
+  auditStatement,
+  batchAuditStatement,
+  type ContactActor,
+  type VaultStage,
+} from "@/lib/customers/contactVault/contactAudit.js";
+
+export interface QueryStatement {
   sql: string;
   params?: readonly unknown[];
 }
@@ -32,13 +46,18 @@ export interface ContactDb {
   all<T = Record<string, unknown>>(sql: string, ...params: unknown[]): Promise<T[]>;
   first<T = Record<string, unknown>>(sql: string, ...params: unknown[]): Promise<T | null>;
   run(sql: string, ...params: unknown[]): Promise<void>;
+  exec(sql: string): Promise<void>;
   /** D1 executes a batch sequentially inside one implicit transaction. */
   batch?(statements: readonly QueryStatement[]): Promise<void>;
 }
 
-export const CONTACT_LIST_LIMIT = 200;
+export const CONTACT_LIST_LIMIT = AUDIT_RECORD_IDS_MAX;
+/** Insert attempts when a concurrent first seal for the tenant wins the data-key race. */
+const SEAL_ATTEMPTS = 3;
+const DAY_MS = 86_400_000;
 
 export type ContactMessageStatus = "unread" | "read";
+export type MessageField = "name" | "email" | "phone" | "message";
 
 export interface NewContactMessage {
   id: string;
@@ -63,8 +82,12 @@ export interface ContactMessage {
   readAt: string | null;
 }
 
+/** An exact-match inbox filter; the value never reaches a log, an audit row or a URL. */
+export type ContactSearch = { kind: "email"; value: string } | { kind: "phone"; value: string };
+
 export type ContactRefusal =
   | { ok: false; status: 404; reason: "not-found" }
+  | { ok: false; status: 410; reason: "contact-expired" }
   | { ok: false; status: 429; reason: "quota" }
   | { ok: false; status: 503; reason: "audit-unavailable" | "vault-key-unavailable" };
 
@@ -72,12 +95,22 @@ export type ListOutcome = { ok: true; messages: ContactMessage[] } | ContactRefu
 export type SupportReadOutcome = { ok: true; message: ContactMessage } | ContactRefusal;
 export type EraseOutcome = { ok: true } | ContactRefusal;
 
+/** A message the store could not write; carries a fixed code only. */
+export class ContactMessageNotStoredError extends Error {
+  constructor(readonly code: "contact-expired" | "seal-race-lost") {
+    super(code);
+    this.name = "ContactMessageNotStoredError";
+  }
+}
+
 interface SealedRow {
   id: string;
-  key_id: string;
-  nonce: string;
-  ciphertext: string;
-  not_after: string;
+  msg_kid: string;
+  name_ct: string | null;
+  email_ct: string | null;
+  phone_ct: string | null;
+  message_ct: string;
+  ceiling: string;
   expires_at: string;
   page_path: string | null;
   status: string;
@@ -85,19 +118,27 @@ interface SealedRow {
   read_at: string | null;
 }
 
-interface ContactPlaintext {
-  name: string;
-  email: string;
-  phone: string;
-  message: string;
+const SEALED_COLUMNS =
+  "id, msg_kid, name_ct, email_ct, phone_ct, message_ct, ceiling, expires_at, page_path, status, created_at, read_at";
+/** A row the store may act on: sealed, and strictly before both its expiry and its ceiling. */
+const READABLE = "msg_kid IS NOT NULL AND message_ct IS NOT NULL AND ? < expires_at AND ? < ceiling";
+/** Rows that still hold legacy plaintext in any column. */
+const HOLDS_LEGACY =
+  "(legacy_name IS NOT NULL OR legacy_email IS NOT NULL OR legacy_phone IS NOT NULL OR legacy_message IS NOT NULL)";
+const REFERENCES_MSG_KID = `SELECT 1 FROM contact_messages WHERE tenant_id = ? AND stage = ? AND msg_kid = ?`;
+const REFERENCES_BIDX_KID = `SELECT 1 FROM order_contact_vault WHERE tenant_id = ? AND stage = ? AND bidx_kid = ?
+  UNION ALL SELECT 1 FROM contact_messages WHERE tenant_id = ? AND stage = ? AND bidx_kid = ?`;
+
+function messageContext(tenantId: string, stage: VaultStage): EncryptionContext {
+  return { tenantId, stage, purpose: "contact-message" };
 }
 
-const SEALED_COLUMNS = "id, key_id, nonce, ciphertext, not_after, expires_at, page_path, status, created_at, read_at";
-/** A row the store may act on: sealed, and strictly before both its expiry and its ceiling. */
-const READABLE = "ciphertext IS NOT NULL AND ? < expires_at AND ? < not_after";
+function blindIndexContext(tenantId: string, stage: VaultStage): EncryptionContext {
+  return { tenantId, stage, purpose: "blind-index" };
+}
 
-function binding(tenantId: string, stage: VaultStage, id: string, notAfter: string): VaultBinding {
-  return { purpose: "contact-message", tenantId, stage, recordId: id, notAfter };
+function fieldBinding(tenantId: string, stage: VaultStage, id: string, kid: string, ceiling: string, field: MessageField): FieldBinding {
+  return { purpose: "contact-message", field, tenantId, stage, recordId: id, kid, notAfter: ceiling };
 }
 
 function requireBatch(db: ContactDb): NonNullable<ContactDb["batch"]> {
@@ -105,64 +146,159 @@ function requireBatch(db: ContactDb): NonNullable<ContactDb["batch"]> {
   return db.batch.bind(db);
 }
 
-function asPlaintext(value: unknown): ContactPlaintext | null {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-  const v = value as Record<string, unknown>;
-  const fields = [v.name, v.email, v.phone, v.message];
-  if (!fields.every((f) => typeof f === "string")) return null;
-  return { name: v.name as string, email: v.email as string, phone: v.phone as string, message: v.message as string };
+function keyExists(ctx: EncryptionContext, kid: string): { sql: string; params: unknown[] } {
+  return {
+    sql: `SELECT 1 FROM contact_vault_data_keys WHERE tenant_id = ? AND stage = ? AND purpose = ? AND kid = ?`,
+    params: [ctx.tenantId, ctx.stage, ctx.purpose, kid],
+  };
+}
+
+function cleanups(ctx: EncryptionContext, key: ActiveDataKey, referenced: string, params: readonly unknown[]): QueryStatement[] {
+  return key.pending.length > 0 ? [cleanupStatement(ctx, key.kid, referenced, params)] : [];
+}
+
+interface SealedFields {
+  msgKid: string;
+  bidxKid: string | null;
+  nameCt: string | null;
+  emailCt: string | null;
+  emailBidx: string | null;
+  phoneCt: string | null;
+  phoneBidx: string | null;
+  messageCt: string;
+  /** Batch prefix (pending key rows), the key-existence guard for the record write, and the batch suffix (cleanups). */
+  pending: QueryStatement[];
+  guard: { sql: string; params: unknown[] };
+  cleanup: QueryStatement[];
+}
+
+/**
+ * Seal one message's fields under the tenant's active keys. Empty optional values store NULL; the
+ * message text is always sealed. Throws {@link VaultKeyUnavailableError} when KMS cannot serve.
+ */
+async function sealFields(
+  db: ContactDb,
+  kms: KmsClient,
+  tenantId: string,
+  stage: VaultStage,
+  id: string,
+  ceiling: string,
+  values: { name: string; email: string; phone: string; message: string },
+  now: Date,
+): Promise<SealedFields> {
+  const msgCtx = messageContext(tenantId, stage);
+  const bidxCtx = blindIndexContext(tenantId, stage);
+  const email = normalizeEmail(values.email);
+  const phone = normalizePhone(values.phone);
+  const msgKey = await activeKey(db, kms, msgCtx, now);
+  const bidxKey = email !== null || phone !== null ? await activeKey(db, kms, bidxCtx, now) : null;
+  const seal = (field: MessageField, value: string) =>
+    sealField(msgKey.key, fieldBinding(tenantId, stage, id, msgKey.kid, ceiling, field), value);
+  const optional = (field: MessageField, value: string) => (value === "" ? Promise.resolve(null) : seal(field, value));
+  const msgGuard = keyExists(msgCtx, msgKey.kid);
+  const bidxGuard = bidxKey ? keyExists(bidxCtx, bidxKey.kid) : null;
+  return {
+    msgKid: msgKey.kid,
+    bidxKid: bidxKey?.kid ?? null,
+    nameCt: await optional("name", values.name),
+    emailCt: await optional("email", values.email),
+    emailBidx: bidxKey && email !== null ? await blindIndex(bidxKey.key, email) : null,
+    phoneCt: await optional("phone", values.phone),
+    phoneBidx: bidxKey && phone !== null ? await blindIndex(bidxKey.key, phone) : null,
+    messageCt: await seal("message", values.message),
+    pending: [...msgKey.pending, ...(bidxKey?.pending ?? [])],
+    guard: {
+      sql: `EXISTS (${msgGuard.sql})${bidxGuard ? ` AND EXISTS (${bidxGuard.sql})` : ""}`,
+      params: [...msgGuard.params, ...(bidxGuard?.params ?? [])],
+    },
+    cleanup: [
+      ...cleanups(msgCtx, msgKey, REFERENCES_MSG_KID, [tenantId, stage, msgKey.kid]),
+      ...(bidxKey ? cleanups(bidxCtx, bidxKey, REFERENCES_BIDX_KID, [tenantId, stage, bidxKey.kid, tenantId, stage, bidxKey.kid]) : []),
+    ],
+  };
+}
+
+function isKeyUnavailable(error: unknown): boolean {
+  return error instanceof VaultKeyUnavailableError;
 }
 
 export class ContactMessagesStore {
   constructor(
     private readonly db: ContactDb,
-    private readonly keyring: VaultKeyring | null,
+    private readonly kms: KmsClient,
     private readonly now: () => Date = () => new Date(),
   ) {}
 
-  /** Seal and store one message. Throws {@link VaultKeyUnavailableError} (writing nothing) without a keyring. */
+  /**
+   * Seal and store one message in one batch. Throws {@link VaultKeyUnavailableError} (writing
+   * nothing) when KMS cannot serve, and {@link ContactMessageNotStoredError} when retention refuses
+   * or the data-key race is lost on every attempt.
+   */
   async insert(input: NewContactMessage): Promise<void> {
-    const created = this.now();
-    const notAfter = notAfterFrom(created);
-    const plaintext: ContactPlaintext = { name: input.name, email: input.email, phone: input.phone, message: input.message };
-    const sealed = await sealVaultRecord(this.keyring, binding(input.tenantId, input.stage, input.id, notAfter), plaintext);
-    await this.db.run(
-      `INSERT INTO contact_messages
-         (id, tenant_id, stage, key_id, nonce, ciphertext, not_after, expires_at, page_path, status, created_at, notify_status, notify_attempts)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'unread', ?, 'pending', 0)`,
-      input.id,
-      input.tenantId,
-      input.stage,
-      sealed.keyId,
-      sealed.nonce,
-      sealed.ciphertext,
-      notAfter,
-      notAfter,
-      input.pagePath,
-      created.toISOString(),
-    );
+    const received = this.now();
+    const retention = await messageRetention({ stage: input.stage, receivedAt: received, now: received });
+    if (retention.kind !== "ok") throw new ContactMessageNotStoredError("contact-expired");
+    const batch = requireBatch(this.db);
+    for (let attempt = 0; attempt < SEAL_ATTEMPTS; attempt++) {
+      const sealed = await sealFields(this.db, this.kms, input.tenantId, input.stage, input.id, retention.ceiling, input, received);
+      await batch([
+        ...sealed.pending,
+        {
+          sql: `INSERT INTO contact_messages
+                  (id, tenant_id, stage, msg_kid, bidx_kid, name_ct, email_ct, email_bidx, phone_ct, phone_bidx, message_ct,
+                   ceiling, expires_at, time_scale, rule_version, page_path, status, created_at, notify_status, notify_attempts)
+                SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'unread', ?, 'pending', 0
+                WHERE ${sealed.guard.sql} AND NOT EXISTS (SELECT 1 FROM contact_messages WHERE id = ?)`,
+          params: [
+            input.id, input.tenantId, input.stage, sealed.msgKid, sealed.bidxKid, sealed.nameCt, sealed.emailCt, sealed.emailBidx,
+            sealed.phoneCt, sealed.phoneBidx, sealed.messageCt, retention.ceiling, retention.expiresAt, retention.timeScale,
+            retention.ruleVersion, input.pagePath, received.toISOString(), ...sealed.guard.params, input.id,
+          ],
+        },
+        ...sealed.cleanup,
+      ]);
+      const stored = await this.db.first(
+        `SELECT 1 AS present FROM contact_messages WHERE id = ? AND tenant_id = ? AND stage = ? AND msg_kid = ?`,
+        input.id, input.tenantId, input.stage, sealed.msgKid,
+      );
+      if (stored) return;
+    }
+    throw new ContactMessageNotStoredError("seal-race-lost");
   }
 
-  /** The owner inbox: one `list` audit row commits, then newest first, capped at {@link CONTACT_LIST_LIMIT}. */
-  async list(tenantId: string, stage: VaultStage, actor: ContactActor, auditId: string): Promise<ListOutcome> {
-    if (!this.keyring) return { ok: false, status: 503, reason: "vault-key-unavailable" };
+  /**
+   * The owner inbox, newest first and capped at {@link CONTACT_LIST_LIMIT}, optionally narrowed by
+   * an exact email or phone match. Order: select the sealed rows, unwrap their keys (a KMS failure
+   * answers 503 with no audit row), commit ONE `list` (or `search`) audit row naming the message ids
+   * it returns and their count (never the searched value), then decrypt.
+   */
+  async list(tenantId: string, stage: VaultStage, actor: ContactActor, auditId: string, search?: ContactSearch): Promise<ListOutcome> {
     const now = this.now();
+    const iso = now.toISOString();
+    let rows: SealedRow[];
+    let keys: Map<string, CryptoKey | null>;
+    try {
+      rows = search ? await this.searchRows(tenantId, stage, iso, search) : await this.db.all<SealedRow>(
+        `SELECT ${SEALED_COLUMNS} FROM contact_messages
+          WHERE tenant_id = ? AND stage = ? AND ${READABLE}
+          ORDER BY created_at DESC, id DESC
+          LIMIT ?`,
+        tenantId, stage, iso, iso, CONTACT_LIST_LIMIT,
+      );
+      keys = await this.keysFor(tenantId, stage, rows);
+    } catch (error) {
+      if (isKeyUnavailable(error)) return { ok: false, status: 503, reason: "vault-key-unavailable" };
+      throw error;
+    }
     const admitted = await admitAudit(this.db, auditStatement({
-      auditId, tenantId, stage, recordKind: "contact-message", recordId: "*", actor, action: "list", now,
+      auditId, tenantId, stage, recordKind: "contact-message", recordId: auditRecordIds(rows.map((row) => row.id)), recordCount: rows.length,
+      actor, action: search ? "search" : "list", now,
     }));
     if (admitted === "quota") return { ok: false, status: 429, reason: "quota" };
     if (admitted === "unavailable") return { ok: false, status: 503, reason: "audit-unavailable" };
-    const iso = now.toISOString();
-    const rows = await this.db.all<SealedRow>(
-      `SELECT ${SEALED_COLUMNS} FROM contact_messages
-        WHERE tenant_id = ? AND stage = ? AND ${READABLE}
-        ORDER BY created_at DESC, id DESC
-        LIMIT ?`,
-      tenantId, stage, iso, iso, CONTACT_LIST_LIMIT,
-    );
     const messages: ContactMessage[] = [];
     for (const row of rows) {
-      const message = await this.open(tenantId, stage, row, now);
+      const message = await this.open(tenantId, stage, row, keys.get(row.msg_kid) ?? null, now);
       if (message) messages.push(message);
     }
     return { ok: true, messages };
@@ -170,11 +306,18 @@ export class ContactMessagesStore {
 
   /**
    * ToT support reads one message. The caller has already proven a live staff selection and a live
-   * owner-consented grant; the audit row (with the staff quota in the same statement) commits first.
+   * owner-consented grant. A preview message at or past received_at + the preview cutoff answers 410
+   * with zero writes; otherwise the audit row (with the staff quota in the same statement) commits first.
    */
   async supportRead(tenantId: string, stage: VaultStage, id: string, actor: ContactActor, auditId: string): Promise<SupportReadOutcome> {
-    if (!this.keyring) return { ok: false, status: 503, reason: "vault-key-unavailable" };
     const now = this.now();
+    if (stage === "preview") {
+      const received = await this.db.first<{ created_at: unknown }>(
+        `SELECT created_at FROM contact_messages WHERE tenant_id = ? AND stage = ? AND id = ?`, tenantId, stage, id,
+      );
+      const receivedAt = received ? readInstant(received.created_at) : null;
+      if (receivedAt && now.getTime() >= Date.parse(previewDeleteAt(receivedAt))) return { ok: false, status: 410, reason: "contact-expired" };
+    }
     const admitted = await admitAudit(this.db, auditStatement({
       auditId, tenantId, stage, recordKind: "contact-message", recordId: id, actor, action: "read", now,
     }));
@@ -185,7 +328,15 @@ export class ContactMessagesStore {
       `SELECT ${SEALED_COLUMNS} FROM contact_messages WHERE tenant_id = ? AND stage = ? AND id = ? AND ${READABLE}`,
       tenantId, stage, id, iso, iso,
     );
-    const message = row ? await this.open(tenantId, stage, row, now) : null;
+    if (!row) return { ok: false, status: 404, reason: "not-found" };
+    let key: CryptoKey | null;
+    try {
+      key = await keyForKid(this.db, this.kms, messageContext(tenantId, stage), row.msg_kid);
+    } catch (error) {
+      if (isKeyUnavailable(error)) return { ok: false, status: 503, reason: "vault-key-unavailable" };
+      throw error;
+    }
+    const message = await this.open(tenantId, stage, row, key, now);
     return message ? { ok: true, message } : { ok: false, status: 404, reason: "not-found" };
   }
 
@@ -214,7 +365,7 @@ export class ContactMessagesStore {
   /** Erase one sealed message: its audit row and its delete commit in one batch, or neither does. */
   async erase(tenantId: string, stage: VaultStage, id: string, actor: ContactActor, auditId: string): Promise<EraseOutcome> {
     const now = this.now();
-    const rowSql = `SELECT 1 FROM contact_messages WHERE tenant_id = ? AND stage = ? AND id = ? AND ciphertext IS NOT NULL`;
+    const rowSql = `SELECT 1 FROM contact_messages WHERE tenant_id = ? AND stage = ? AND id = ? AND message_ct IS NOT NULL`;
     const exists = await this.db.first(rowSql, tenantId, stage, id);
     if (!exists) return { ok: false, status: 404, reason: "not-found" };
     const audit = auditStatement({
@@ -222,9 +373,9 @@ export class ContactMessagesStore {
       requireRow: { sql: rowSql, params: [tenantId, stage, id] },
     });
     const statements: QueryStatement[] = [
-      { sql: audit.sql.replace(/\s*RETURNING audit_id$/, ""), params: audit.params },
+      batchAuditStatement(audit),
       {
-        sql: `DELETE FROM contact_messages WHERE tenant_id = ? AND stage = ? AND id = ? AND ciphertext IS NOT NULL
+        sql: `DELETE FROM contact_messages WHERE tenant_id = ? AND stage = ? AND id = ? AND message_ct IS NOT NULL
                 AND EXISTS (SELECT 1 FROM contact_access_audit WHERE audit_id = ?)`,
         params: [tenantId, stage, id, auditId],
       },
@@ -240,20 +391,64 @@ export class ContactMessagesStore {
     return still ? { ok: false, status: 429, reason: "quota" } : { ok: false, status: 404, reason: "not-found" };
   }
 
-  /** Decrypt one row, or null when it is past retention or does not authenticate under its binding. */
-  private async open(tenantId: string, stage: VaultStage, row: SealedRow, now: Date): Promise<ContactMessage | null> {
-    if (!isReadable(now, row.expires_at, row.not_after)) return null;
-    const opened = await openVaultRecord(this.keyring, binding(tenantId, stage, row.id, row.not_after), {
-      keyId: row.key_id, nonce: row.nonce, ciphertext: row.ciphertext,
-    }).catch((error: unknown) => {
-      if (error instanceof VaultKeyUnavailableError) return null;
-      throw error;
-    });
-    const plain = asPlaintext(opened);
-    if (!plain) return null;
+  /**
+   * Readable rows whose blind index equals the searched value under ANY of the tenant's blind-index
+   * keys (rotation leaves still-sealed rows on the retired kid until they are recomputed). A tenant
+   * with no blind-index key holds no indexed row; a value that normalizes to nothing matches nothing.
+   */
+  private async searchRows(tenantId: string, stage: VaultStage, iso: string, search: ContactSearch): Promise<SealedRow[]> {
+    const normalized = search.kind === "email" ? normalizeEmail(search.value) : normalizePhone(search.value);
+    if (normalized === null) return [];
+    const ctx = blindIndexContext(tenantId, stage);
+    const kids = await this.db.all<{ kid: string }>(
+      `SELECT kid FROM contact_vault_data_keys WHERE tenant_id = ? AND stage = ? AND purpose = 'blind-index' ORDER BY created_at, kid`,
+      tenantId, stage,
+    );
+    const pairs: unknown[] = [];
+    for (const { kid } of kids) {
+      const key = await keyForKid(this.db, this.kms, ctx, kid);
+      if (key) pairs.push(kid, await blindIndex(key, normalized));
+    }
+    if (pairs.length === 0) return [];
+    const column = search.kind === "email" ? "email_bidx" : "phone_bidx";
+    const match = Array.from({ length: pairs.length / 2 }, () => `(bidx_kid = ? AND ${column} = ?)`).join(" OR ");
+    return this.db.all<SealedRow>(
+      `SELECT ${SEALED_COLUMNS} FROM contact_messages
+        WHERE tenant_id = ? AND stage = ? AND ${READABLE} AND (${match})
+        ORDER BY created_at DESC, id DESC
+        LIMIT ?`,
+      tenantId, stage, iso, iso, ...pairs, CONTACT_LIST_LIMIT,
+    );
+  }
+
+  /** Each distinct kid's key, its row read from D1 once per call (null when the row is gone). */
+  private async keysFor(tenantId: string, stage: VaultStage, rows: readonly SealedRow[]): Promise<Map<string, CryptoKey | null>> {
+    const keys = new Map<string, CryptoKey | null>();
+    for (const kid of new Set(rows.map((row) => row.msg_kid))) {
+      keys.set(kid, await keyForKid(this.db, this.kms, messageContext(tenantId, stage), kid));
+    }
+    return keys;
+  }
+
+  /**
+   * Decrypt one row, or null when it is past retention, its key is gone, or any present field does
+   * not authenticate under its own binding.
+   */
+  private async open(tenantId: string, stage: VaultStage, row: SealedRow, key: CryptoKey | null, now: Date): Promise<ContactMessage | null> {
+    if (!key || !isGroupReadable(now, row.expires_at, row.ceiling)) return null;
+    const read = async (field: MessageField, sealed: string | null): Promise<string | null> =>
+      sealed === null ? "" : openField(key, fieldBinding(tenantId, stage, row.id, row.msg_kid, row.ceiling, field), sealed);
+    const name = await read("name", row.name_ct);
+    const email = await read("email", row.email_ct);
+    const phone = await read("phone", row.phone_ct);
+    const message = await read("message", row.message_ct);
+    if (name === null || email === null || phone === null || message === null) return null;
     return {
       id: row.id,
-      ...plain,
+      name,
+      email,
+      phone,
+      message,
       pagePath: row.page_path,
       status: row.status === "read" ? "read" : "unread",
       createdAt: row.created_at,
@@ -262,25 +457,151 @@ export class ContactMessagesStore {
   }
 }
 
+export interface MessagePurgeCounts {
+  /** Rows whose expired content (ciphertexts, blind indexes, legacy plaintext) was nulled. */
+  contentCleared: number;
+  /** Preview rows deleted whole at receipt + the preview cutoff. */
+  previewDeleted: number;
+  /** Publication rows deleted once their content was gone and their ceiling had passed. */
+  publicationDeleted: number;
+}
+
+export const PURGE_PAGE_SIZE = 500;
+export const PURGE_MAX_PAGES = 20;
+
 /**
- * Delete every message at or past its expiry or its ceiling, across all tenants and stages (legacy
- * rows included). Returns the number of rows removed. An unreadable clock throws.
+ * The hourly purge, across all tenants and stages, under ONE clock reading:
+ *   1. null the content of every row at or past `min(expires_at, ceiling)`: each ciphertext, both
+ *      blind indexes, `bidx_kid` and any legacy plaintext. `msg_kid` stays, so the row can never
+ *      be refilled (the 0022 trigger guards the ciphertexts while a kid is set);
+ *   2. delete every preview row at or past receipt + the preview cutoff, content or not;
+ *   3. delete every publication row whose content is gone and whose ceiling has passed. A message
+ *      has no facts row (design 8c), so once its content is gone nothing left in it is worth
+ *      keeping: the row goes rather than lingering as metadata.
+ * Bounded: each step works in pages of `pageSize`, at most `maxPages` pages per step per run; the
+ * next run takes whatever is left. Returns counts only. An unreadable clock throws.
  */
-export async function purgeExpiredContactMessages(db: ContactDb, now: Date): Promise<number> {
+export async function purgeContactMessages(
+  db: ContactDb,
+  now: Date,
+  pageSize = PURGE_PAGE_SIZE,
+  maxPages = PURGE_MAX_PAGES,
+): Promise<MessagePurgeCounts> {
   if (Number.isNaN(now.getTime())) throw new Error("contact message purge: unreadable clock");
   const iso = now.toISOString();
-  const rows = await db.all<{ id: string }>(
-    `DELETE FROM contact_messages WHERE expires_at <= ? OR not_after <= ? RETURNING id`,
-    iso, iso,
+  const previewCutoff = new Date(now.getTime() - RETENTION_POLICY.previewCutoffDays * DAY_MS).toISOString();
+  const paged = async (sql: string, params: unknown[]): Promise<number> => {
+    let total = 0;
+    for (let page = 0; page < maxPages; page++) {
+      const rows = await db.all<{ id: string }>(sql, ...params, pageSize);
+      total += rows.length;
+      if (rows.length < pageSize) break;
+    }
+    return total;
+  };
+  const contentCleared = await paged(
+    `UPDATE contact_messages
+        SET name_ct = NULL, email_ct = NULL, email_bidx = NULL, phone_ct = NULL, phone_bidx = NULL, message_ct = NULL,
+            bidx_kid = NULL, legacy_name = NULL, legacy_email = NULL, legacy_phone = NULL, legacy_message = NULL
+      WHERE id IN (
+        SELECT id FROM contact_messages
+         WHERE (expires_at <= ? OR ceiling <= ?)
+           AND (name_ct IS NOT NULL OR email_ct IS NOT NULL OR email_bidx IS NOT NULL OR phone_ct IS NOT NULL
+                OR phone_bidx IS NOT NULL OR message_ct IS NOT NULL OR bidx_kid IS NOT NULL OR ${HOLDS_LEGACY})
+         LIMIT ?)
+      RETURNING id`,
+    [iso, iso],
+  );
+  const previewDeleted = await paged(
+    `DELETE FROM contact_messages
+      WHERE id IN (SELECT id FROM contact_messages WHERE stage = 'preview' AND created_at <= ? LIMIT ?)
+      RETURNING id`,
+    [previewCutoff],
+  );
+  const publicationDeleted = await paged(
+    `DELETE FROM contact_messages
+      WHERE id IN (
+        SELECT id FROM contact_messages
+         WHERE stage = 'publication' AND ceiling <= ?
+           AND name_ct IS NULL AND email_ct IS NULL AND phone_ct IS NULL AND message_ct IS NULL
+           AND email_bidx IS NULL AND phone_bidx IS NULL AND NOT ${HOLDS_LEGACY}
+         LIMIT ?)
+      RETURNING id`,
+    [iso],
+  );
+  return { contentCleared, previewDeleted, publicationDeleted };
+}
+
+interface BlindIndexRow {
+  id: string;
+  tenant_id: string;
+  stage: VaultStage;
+  msg_kid: string;
+  bidx_kid: string;
+  email_ct: string | null;
+  email_bidx: string | null;
+  phone_ct: string | null;
+  phone_bidx: string | null;
+  ceiling: string;
+}
+
+/**
+ * Blind-index rotation recompute for messages (orderContactVault.ts `rotateContactVaultKeys` runs
+ * it): up to `limit` sealed rows whose bidx_kid is retired are re-indexed under the active
+ * blind-index key, by decrypting email and phone under the message key, in ONE update per row that
+ * moves both indexes and bidx_kid together, conditioned on the row being unchanged since it was
+ * read. An index whose field no longer opens is cleared. Returns the rows moved. Throws
+ * {@link VaultKeyUnavailableError} when KMS cannot serve.
+ */
+export async function recomputeMessageBlindIndexes(
+  db: Pick<ContactDb, "all" | "first">,
+  kms: KmsClient,
+  now: Date,
+  limit: number,
+): Promise<number> {
+  const rows = await db.all<BlindIndexRow>(
+    `SELECT m.id, m.tenant_id, m.stage, m.msg_kid, m.bidx_kid, m.email_ct, m.email_bidx, m.phone_ct, m.phone_bidx, m.ceiling
+       FROM contact_messages m
+       JOIN contact_vault_data_keys k ON k.tenant_id = m.tenant_id AND k.stage = m.stage AND k.purpose = 'blind-index' AND k.kid = m.bidx_kid
+      WHERE k.retired_at IS NOT NULL AND m.msg_kid IS NOT NULL
+      ORDER BY m.id LIMIT ?`,
+    Math.max(0, Math.floor(limit)),
   );
-  return rows.length;
+  let moved = 0;
+  for (const row of rows) {
+    const active = await activeKey(db, kms, blindIndexContext(row.tenant_id, row.stage), now);
+    // Rotation installs the new active key before this runs; never mint one from here.
+    if (active.pending.length > 0 || active.kid === row.bidx_kid) continue;
+    const msgKey = await keyForKid(db, kms, messageContext(row.tenant_id, row.stage), row.msg_kid);
+    const reindex = async (field: "email" | "phone", sealed: string | null, current: string | null): Promise<string | null> => {
+      if (current === null || sealed === null || !msgKey) return null;
+      const value = await openField(msgKey, fieldBinding(row.tenant_id, row.stage, row.id, row.msg_kid, row.ceiling, field), sealed);
+      const normalized = value === null ? null : field === "email" ? normalizeEmail(value) : normalizePhone(value);
+      return normalized === null ? null : blindIndex(active.key, normalized);
+    };
+    const email = await reindex("email", row.email_ct, row.email_bidx);
+    const phone = await reindex("phone", row.phone_ct, row.phone_bidx);
+    const updated = await db.all(
+      `UPDATE contact_messages SET email_bidx = ?, phone_bidx = ?, bidx_kid = ?
+        WHERE id = ? AND msg_kid = ? AND bidx_kid = ? AND email_bidx IS ? AND phone_bidx IS ? AND email_ct IS ? AND phone_ct IS ?
+          AND EXISTS (SELECT 1 FROM contact_vault_data_keys
+                       WHERE tenant_id = ? AND stage = ? AND purpose = 'blind-index' AND kid = ? AND retired_at IS NULL)
+        RETURNING id`,
+      email, phone, email === null && phone === null ? null : active.kid,
+      row.id, row.msg_kid, row.bidx_kid, row.email_bidx, row.phone_bidx, row.email_ct, row.phone_ct,
+      row.tenant_id, row.stage, active.kid,
+    );
+    moved += updated.length;
+  }
+  return moved;
 }
 
 interface LegacyRow {
   id: string;
   tenant_id: string;
   stage: VaultStage;
-  not_after: string;
+  ceiling: string;
+  expires_at: string;
   legacy_name: string | null;
   legacy_email: string | null;
   legacy_phone: string | null;
@@ -289,43 +610,62 @@ interface LegacyRow {
 
 /**
  * Seal up to `limit` rows still holding legacy plaintext (oldest id first), across all tenants.
- * Each row is one statement: the envelope is written and every `legacy_*` column nulled together,
- * only while the row is still unsealed. `remaining` counts the unsealed rows left.
+ * Each row is sealed field by field under its own tenant and stage keys, keeping its recorded
+ * ceiling, and ONE statement writes `msg_kid`, every ciphertext and blind index and nulls every
+ * `legacy_*` column, only while the row is still unsealed (any pending key rows before it and the
+ * key cleanups after it, in one batch). A row already past its retention is not sealed: its
+ * plaintext is nulled instead. `sealed` counts rows that no longer hold plaintext; `remaining`
+ * counts the rows that still do. Throws {@link VaultKeyUnavailableError} when KMS cannot serve.
  */
 export async function sealLegacyContactMessages(
   db: ContactDb,
-  keyring: VaultKeyring,
+  kms: KmsClient,
   now: Date,
   limit: number,
 ): Promise<{ sealed: number; remaining: number }> {
   if (Number.isNaN(now.getTime())) throw new Error("contact message sealing: unreadable clock");
+  const batch = requireBatch(db);
   const rows = await db.all<LegacyRow>(
-    `SELECT id, tenant_id, stage, not_after, legacy_name, legacy_email, legacy_phone, legacy_message
-       FROM contact_messages WHERE ciphertext IS NULL
+    `SELECT id, tenant_id, stage, ceiling, expires_at, legacy_name, legacy_email, legacy_phone, legacy_message
+       FROM contact_messages WHERE msg_kid IS NULL AND ${HOLDS_LEGACY}
       ORDER BY id LIMIT ?`,
     Math.max(0, Math.floor(limit)),
   );
+  const unsealed = `id = ? AND msg_kid IS NULL AND ${HOLDS_LEGACY}`;
   let sealed = 0;
   for (const row of rows) {
-    const plaintext: ContactPlaintext = {
+    if (!isGroupReadable(now, row.expires_at, row.ceiling)) {
+      const cleared = await db.all<{ id: string }>(
+        `UPDATE contact_messages SET legacy_name = NULL, legacy_email = NULL, legacy_phone = NULL, legacy_message = NULL
+          WHERE ${unsealed} RETURNING id`,
+        row.id,
+      );
+      sealed += cleared.length;
+      continue;
+    }
+    const fields = await sealFields(db, kms, row.tenant_id, row.stage, row.id, row.ceiling, {
       name: row.legacy_name ?? "",
       email: row.legacy_email ?? "",
       phone: row.legacy_phone ?? "",
       message: row.legacy_message ?? "",
-    };
-    const envelope = await sealVaultRecord(keyring, binding(row.tenant_id, row.stage, row.id, row.not_after), plaintext);
-    const changed = await db.all<{ id: string }>(
-      `UPDATE contact_messages
-          SET key_id = ?, nonce = ?, ciphertext = ?,
-              legacy_name = NULL, legacy_email = NULL, legacy_phone = NULL, legacy_message = NULL
-        WHERE id = ? AND ciphertext IS NULL
-        RETURNING id`,
-      envelope.keyId, envelope.nonce, envelope.ciphertext, row.id,
-    );
-    sealed += changed.length;
+    }, now);
+    await batch([
+      ...fields.pending,
+      {
+        sql: `UPDATE contact_messages
+                 SET msg_kid = ?, bidx_kid = ?, name_ct = ?, email_ct = ?, email_bidx = ?, phone_ct = ?, phone_bidx = ?, message_ct = ?,
+                     legacy_name = NULL, legacy_email = NULL, legacy_phone = NULL, legacy_message = NULL
+               WHERE ${unsealed} AND ${fields.guard.sql}`,
+        params: [
+          fields.msgKid, fields.bidxKid, fields.nameCt, fields.emailCt, fields.emailBidx, fields.phoneCt, fields.phoneBidx,
+          fields.messageCt, row.id, ...fields.guard.params,
+        ],
+      },
+      ...fields.cleanup,
+    ]);
+    const done = await db.first(`SELECT 1 AS present FROM contact_messages WHERE id = ? AND msg_kid = ?`, row.id, fields.msgKid);
+    if (done) sealed++;
   }
-  const left = await db.first<{ n: number }>(
-    `SELECT COUNT(*) AS n FROM contact_messages WHERE ciphertext IS NULL`,
-  );
+  const left = await db.first<{ n: number }>(`SELECT COUNT(*) AS n FROM contact_messages WHERE ${HOLDS_LEGACY}`);
   return { sealed, remaining: Number(left?.n ?? 0) };
 }