Authenticated encrypted records — Node.js 22 or newer, no dependencies

Reference solution: not included here, so the exercise does not hand you the answer.
Attempt the repair first. Then download encrypted-records-solution.zip from the project card
on https://softwaresecurity.com/labs/#project-encrypted-records and extract it into this folder;
it adds reference.mjs without changing your files, and the reference commands below
need it.

Goal: prevent a valid encrypted invoice from being moved to another tenant,
record, purpose or unsupported format version. The tests use Node Web Crypto
AES-GCM with generated in-memory keys, fresh 96-bit random IVs and 128-bit tags.

1. Run: node --test exercise.test.mjs
   Round-trip, tamper and wrong-key cases pass. Context transplant cases fail:
   authentication of ciphertext alone does not establish which record it belongs to.
2. Read records.mjs. additionalData is authenticated but is not encrypted.
   It must come from the trusted destination record, not attacker-controlled envelope
   fields. The ciphertext does not contain that authority.
3. Edit recordContext in exercise.mjs. Bind version, tenant, record ID and purpose
   in an unambiguous ordered encoding. Reject unsupported versions and purposes.
4. Run the same test command. All ten cases should pass. Use reference.mjs to
   compare the reasoning after attempting your own repair.
5. Try joining fields with a colon. Explain why the boundary-collision test fails.

Reference check (macOS/Linux): EXERCISE_MODULE=reference node --test exercise.test.mjs
PowerShell: $env:EXERCISE_MODULE='reference'; node --test exercise.test.mjs
Then remove the environment variable before testing your own repair.

Scope: this is a local binding exercise, not a key-management service. Random IVs
require per-key usage limits and a collision-risk policy at scale. Real designs
also need key IDs, envelope version dispatch, rotation, access control and recovery.
This example intentionally retains no keys or files after the process exits.
Source: https://developer.mozilla.org/en-US/docs/Web/API/AesGcmParams

Dev container
.devcontainer/devcontainer.json opens this folder in VS Code Dev Containers or
GitHub Codespaces using the Dev Containers Node.js 24 image, pinned by digest.
Run the commands above in its terminal.
