@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.21

package/dist/{chunk-GASWQ3XG.js → chunk-ESKIAXO2.js}

@@ -1,15 +1,16 @@
 import {
+  buildRecordAad,
   openEnvelopeJson
-} from "./chunk-VN45YLWM.js";
+} from "./chunk-OHOKBMTM.js";
 import {
-  encrypt
-} from "./chunk-VCETL77O.js";
+  buildRecordEnvelope
+} from "./chunk-PENPHA45.js";
 import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-W5W6KHN2.js";
+  encrypt
+} from "./chunk-AU3AUJIZ.js";
 import {
   ConflictError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-audit/attestation/signer.ts
 import { generateDocSigningKeyPair } from "@noy-db/attestation";
@@ -20,7 +21,7 @@ async function loadSigner(store, vault, getDEK) {
   const existing = await store.get(vault, ATTESTATIONS_COLLECTION, SIGNER_RECORD_ID);
   if (!existing) return null;
   const dek = await getDEK(ATTESTATIONS_COLLECTION);
-  const json = await openEnvelopeJson(existing, dek);
+  const json = await openEnvelopeJson({ collection: ATTESTATIONS_COLLECTION, id: SIGNER_RECORD_ID }, existing, dek);
   return JSON.parse(json);
 }
 async function loadOrCreateSigner(store, vault, getDEK) {
@@ -28,14 +29,12 @@ async function loadOrCreateSigner(store, vault, getDEK) {
   if (existing) return existing;
   const dek = await getDEK(ATTESTATIONS_COLLECTION);
   const signer = await generateDocSigningKeyPair();
-  const { iv, data } = await encrypt(JSON.stringify(signer), dek);
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: iv,
-    _data: data
-  };
+  const identity = { collection: ATTESTATIONS_COLLECTION, id: SIGNER_RECORD_ID, version: 1 };
+  const { iv, data } = await encrypt(JSON.stringify(signer), dek, buildRecordAad(identity));
+  const env = buildRecordEnvelope(
+    identity,
+    { iv, data }
+  );
   try {
     await store.put(vault, ATTESTATIONS_COLLECTION, SIGNER_RECORD_ID, env, 0);
     return signer;
@@ -56,4 +55,4 @@ export {
   loadSigner,
   loadOrCreateSigner
 };
-//# sourceMappingURL=chunk-GASWQ3XG.js.map
+//# sourceMappingURL=chunk-ESKIAXO2.js.map

package/dist/chunk-ESKIAXO2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/attestation/signer.ts"],"sourcesContent":["import type { NoydbStore } from '../../kernel/types.js'\nimport { buildRecordAad, buildRecordEnvelope, encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { ConflictError } from '../../kernel/errors.js'\nimport { generateDocSigningKeyPair } from '@noy-db/attestation'\n\nexport const ATTESTATIONS_COLLECTION = '_attestations'\nexport const SIGNER_RECORD_ID = '_signer'\nexport const REVOKED_RECORD_ID = '_revoked'\n\nexport interface DocSigner {\n  readonly keyId: string\n  readonly publicKeyB64: string\n  readonly privateKeyPkcs8B64: string\n}\n\n/**\n * Pure read: return the firm's persisted document-signing keypair, or `null`\n * if none has been minted yet. Never writes — callers that must NOT mint\n * (e.g. an ungated public-key getter) use this instead of `loadOrCreateSigner`.\n *\n * Stored as an encrypted record `_attestations/_signer` under the\n * `_attestations` collection DEK (resolved via `getDEK`, which is\n * AES-KW-wrapped under the owner KEK + persisted by the keyring). The KEK\n * itself is AES-KW-only and cannot AES-GCM-encrypt these bytes — hence\n * storage under a normal collection DEK.\n */\nexport async function loadSigner(\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<DocSigner | null> {\n  const existing = await store.get(vault, ATTESTATIONS_COLLECTION, SIGNER_RECORD_ID)\n  if (!existing) return null\n  const dek = await getDEK(ATTESTATIONS_COLLECTION)\n  const json = await openEnvelopeJson({ collection: ATTESTATIONS_COLLECTION, id: SIGNER_RECORD_ID }, existing, dek)\n  return JSON.parse(json) as DocSigner\n}\n\n/**\n * Lazily mint (or load) the firm's Ed25519 document-signing keypair.\n *\n * On a concurrent first-mint, two callers can both read `null` and both mint\n * distinct keypairs. The `put(…, expectedVersion: 0)` (\"must not already\n * exist\") lets exactly one win; the loser catches `ConflictError`, re-reads,\n * and returns the winner's signer — converging on a single keypair rather than\n * clobbering it or surfacing a raw conflict. (All real stores treat a missing\n * record + `ev: 0` as a no-conflict write, so the catch fires on lost-race only.)\n */\nexport async function loadOrCreateSigner(\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n): Promise<DocSigner> {\n  const existing = await loadSigner(store, vault, getDEK)\n  if (existing) return existing\n\n  const dek = await getDEK(ATTESTATIONS_COLLECTION)\n  const signer = await generateDocSigningKeyPair()\n  const identity = { collection: ATTESTATIONS_COLLECTION, id: SIGNER_RECORD_ID, version: 1 }\n  const { iv, data } = await encrypt(JSON.stringify(signer), dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(\n    identity,\n    { iv, data },\n  )\n  try {\n    await store.put(vault, ATTESTATIONS_COLLECTION, SIGNER_RECORD_ID, env, 0)\n    return signer\n  } catch (e) {\n    if (!(e instanceof ConflictError)) throw e\n    // Lost the race — another writer minted first. Adopt the winner.\n    const winner = await loadSigner(store, vault, getDEK)\n    if (!winner) {\n      throw new ConflictError(0, 'loadOrCreateSigner: signer mint lost a concurrent race but the winning record could not be re-read.')\n    }\n    return winner\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAGA,SAAS,iCAAiC;AAEnC,IAAM,0BAA0B;AAChC,IAAM,mBAAmB;AACzB,IAAM,oBAAoB;AAmBjC,eAAsB,WACpB,OACA,OACA,QAC2B;AAC3B,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,yBAAyB,gBAAgB;AACjF,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,MAAM,MAAM,OAAO,uBAAuB;AAChD,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,yBAAyB,IAAI,iBAAiB,GAAG,UAAU,GAAG;AAChH,SAAO,KAAK,MAAM,IAAI;AACxB;AAYA,eAAsB,mBACpB,OACA,OACA,QACoB;AACpB,QAAM,WAAW,MAAM,WAAW,OAAO,OAAO,MAAM;AACtD,MAAI,SAAU,QAAO;AAErB,QAAM,MAAM,MAAM,OAAO,uBAAuB;AAChD,QAAM,SAAS,MAAM,0BAA0B;AAC/C,QAAM,WAAW,EAAE,YAAY,yBAAyB,IAAI,kBAAkB,SAAS,EAAE;AACzF,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,MAAM,GAAG,KAAK,eAAe,QAAQ,CAAC;AACxF,QAAM,MAAM;AAAA,IACV;AAAA,IACA,EAAE,IAAI,KAAK;AAAA,EACb;AACA,MAAI;AACF,UAAM,MAAM,IAAI,OAAO,yBAAyB,kBAAkB,KAAK,CAAC;AACxE,WAAO;AAAA,EACT,SAAS,GAAG;AACV,QAAI,EAAE,aAAa,eAAgB,OAAM;AAEzC,UAAM,SAAS,MAAM,WAAW,OAAO,OAAO,MAAM;AACpD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,cAAc,GAAG,qGAAqG;AAAA,IAClI;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-TOAIYQJR.js → chunk-FFSQFH6D.js}

@@ -1,6 +1,6 @@
 import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-W5W6KHN2.js";
+  buildRecordEnvelope
+} from "./chunk-PENPHA45.js";
 
 // src/with-shape/schema-update/fence.ts
 var FENCE_RECORD_ID = "schema-fence";
@@ -18,13 +18,10 @@ async function loadFence(store, vault) {
   }
 }
 async function saveFence(store, vault, fence) {
-  const envelope = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: "",
-    _data: JSON.stringify(fence)
-  };
+  const envelope = buildRecordEnvelope(
+    { collection: META_COLLECTION, id: FENCE_RECORD_ID, version: 1 },
+    { iv: "", data: JSON.stringify(fence) }
+  );
   await store.put(vault, META_COLLECTION, FENCE_RECORD_ID, envelope);
 }
 function isFenceDoc(x) {
@@ -39,4 +36,4 @@ export {
   loadFence,
   saveFence
 };
-//# sourceMappingURL=chunk-TOAIYQJR.js.map
+//# sourceMappingURL=chunk-FFSQFH6D.js.map

package/dist/chunk-FFSQFH6D.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/schema-update/fence.ts"],"sourcesContent":["/**\n * Schema-fence document. Vault-level generation counter + drain\n * state, stored at `_meta/schema-fence` using the plaintext-envelope\n * pattern of `_meta/policy` (no PII — a counter + a state enum).\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { buildRecordEnvelope } from '../../kernel/enclave/index.js'\n\nexport type FenceState = 'normal' | 'draining' | 'migrating' | 'complete'\n\nexport interface FenceDoc {\n  readonly currentSchemaVersion: number\n  readonly fenceState: FenceState\n  /**\n   * Content hash (`PersistedSchemaEnvelope.hash`) of the schema most\n   * recently persisted while the vault sat at `currentSchemaVersion` —\n   * binds \"generation N\" to a concrete schema-content hash (#946), so\n   * \"which schema is generation N\" is answerable from `schemaFenceState()`\n   * alone. Optional: absent on a fresh vault (generation 0, nothing\n   * persisted yet) and on a fence document written before #946.\n   */\n  readonly schemaHash?: string\n}\n\nexport const FENCE_RECORD_ID = 'schema-fence'\nconst META_COLLECTION = '_meta'\n\nexport const DEFAULT_FENCE: FenceDoc = { currentSchemaVersion: 0, fenceState: 'normal' }\n\nexport async function loadFence(store: NoydbStore, vault: string): Promise<FenceDoc> {\n  const envelope = await store.get(vault, META_COLLECTION, FENCE_RECORD_ID)\n  if (!envelope) return DEFAULT_FENCE\n  try {\n    const parsed = JSON.parse(envelope._data) as unknown\n    if (!isFenceDoc(parsed)) return DEFAULT_FENCE\n    return parsed\n  } catch {\n    return DEFAULT_FENCE\n  }\n}\n\nexport async function saveFence(store: NoydbStore, vault: string, fence: FenceDoc): Promise<void> {\n  const envelope = buildRecordEnvelope(\n    { collection: META_COLLECTION, id: FENCE_RECORD_ID, version: 1 },\n    { iv: '', data: JSON.stringify(fence) },\n  )\n  await store.put(vault, META_COLLECTION, FENCE_RECORD_ID, envelope)\n}\n\nfunction isFenceDoc(x: unknown): x is FenceDoc {\n  if (x === null || typeof x !== 'object') return false\n  const o = x as Record<string, unknown>\n  if (typeof o['currentSchemaVersion'] !== 'number') return false\n  if (o['fenceState'] !== 'normal' && o['fenceState'] !== 'draining'\n    && o['fenceState'] !== 'migrating' && o['fenceState'] !== 'complete') return false\n  // schemaHash is optional (#946) — a legacy fence doc without it is still valid.\n  return o['schemaHash'] === undefined || typeof o['schemaHash'] === 'string'\n}\n"],"mappings":";;;;;AAwBO,IAAM,kBAAkB;AAC/B,IAAM,kBAAkB;AAEjB,IAAM,gBAA0B,EAAE,sBAAsB,GAAG,YAAY,SAAS;AAEvF,eAAsB,UAAU,OAAmB,OAAkC;AACnF,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,iBAAiB,eAAe;AACxE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,QAAI,CAAC,WAAW,MAAM,EAAG,QAAO;AAChC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,UAAU,OAAmB,OAAe,OAAgC;AAChG,QAAM,WAAW;AAAA,IACf,EAAE,YAAY,iBAAiB,IAAI,iBAAiB,SAAS,EAAE;AAAA,IAC/D,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,KAAK,EAAE;AAAA,EACxC;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,iBAAiB,QAAQ;AACnE;AAEA,SAAS,WAAW,GAA2B;AAC7C,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,sBAAsB,MAAM,SAAU,QAAO;AAC1D,MAAI,EAAE,YAAY,MAAM,YAAY,EAAE,YAAY,MAAM,cACnD,EAAE,YAAY,MAAM,eAAe,EAAE,YAAY,MAAM,WAAY,QAAO;AAE/E,SAAO,EAAE,YAAY,MAAM,UAAa,OAAO,EAAE,YAAY,MAAM;AACrE;","names":[]}

package/dist/{chunk-DG27IUVI.js → chunk-FS7NTGCJ.js}

@@ -1,7 +1,7 @@
 import {
   CargoNotEnabledError,
   QuiesceTimeoutError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-cargo/strategy.ts
 var NO_CARGO = {
@@ -60,4 +60,4 @@ export {
   isQuorum,
   runDrainBarrier
 };
-//# sourceMappingURL=chunk-DG27IUVI.js.map
+//# sourceMappingURL=chunk-FS7NTGCJ.js.map

package/dist/{chunk-V5KYPBUR.js → chunk-FW7NGYLT.js}

@@ -1,17 +1,17 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-EP7VPR7Y.js";
+} from "./chunk-5Q7AJ7DN.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-52QYGZHH.js";
+} from "./chunk-GBBDFE6C.js";
 import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-W5W6KHN2.js";
+  buildRecordEnvelope
+} from "./chunk-PENPHA45.js";
 import {
   NoydbError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-audit/portability/request-withdrawal.ts
 var WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
@@ -24,14 +24,11 @@ var WithdrawalRequestError = class extends NoydbError {
 function writeRequest(vault, req, expectedVersion) {
   const { name: vaultName, adapter } = vault._introspectState();
   const body = JSON.stringify(req);
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: expectedVersion + 1,
-    _ts: req.decidedAt ?? req.requestedAt,
-    _iv: "",
-    _data: body,
-    _by: req.decidedBy ?? req.requester
-  };
+  const actor = req.decidedBy ?? req.requester;
+  const env = buildRecordEnvelope(
+    { collection: WITHDRAWAL_REQUESTS_COLLECTION, id: req.requestId, by: actor, version: expectedVersion + 1 },
+    { ts: req.decidedAt ?? req.requestedAt, iv: "", data: body }
+  );
   return adapter.put(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, req.requestId, env, expectedVersion);
 }
 async function readRequest(vault, requestId) {
@@ -161,4 +158,4 @@ export {
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-V5KYPBUR.js.map
+//# sourceMappingURL=chunk-FW7NGYLT.js.map

package/dist/chunk-FW7NGYLT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/portability/request-withdrawal.ts"],"sourcesContent":["/**\n * Two-party withdrawal ceremony.\n *\n * The conservative counterpart to `unilateralWithdrawal`: a non-owner —\n * including a read-only `client`/`viewer` who cannot self-serve a deletion —\n * files a durable REQUEST; an owner/admin reviews it and either APPROVES\n * (extract-and-dispose under firm authority) or REJECTS it. Every step is\n * audited in the tamper-evident ledger.\n *\n *   requester:  vault.user.requestWithdrawal({ scope, disposition?, legalBasis? })\n *   owner:      vault.user.listWithdrawalRequests()\n *               vault.user.approveWithdrawal(requestId, { reKey })  → { bundle, snapshot? }\n *               vault.user.rejectWithdrawal(requestId, { reason })\n *\n * Requests live in the reserved `_user_withdrawal_requests` namespace. The\n * record body is plaintext metadata (collection names + disposition + legal\n * basis — none secret in this trust model; the owner sees the data anyway) and\n * carries NO secret: the re-key secret is supplied by the approver at\n * approval time and conveyed to the requester out-of-band, so no secret is\n * stored at rest.\n */\nimport type { Vault } from '../../kernel/vault.js'\nimport { buildRecordEnvelope } from '../../kernel/enclave/index.js'\nimport { NoydbError } from '../../kernel/errors.js'\nimport { resolveAccessibleCollections, buildAccessibleBundle } from './export-accessible.js'\nimport { freezeAndDeleteClosure, randomId, type FrozenSnapshotRef, type WithdrawResult } from './withdraw-accessible.js'\n\nexport const WITHDRAWAL_REQUESTS_COLLECTION = '_user_withdrawal_requests'\n\n/** Raised when a request is missing, already decided, or expired. */\nexport class WithdrawalRequestError extends NoydbError {\n  constructor(message: string) {\n    super('WITHDRAWAL_REQUEST', message)\n    this.name = 'WithdrawalRequestError'\n  }\n}\n\nexport type WithdrawalRequestStatus = 'pending' | 'approved' | 'rejected'\n\nexport interface WithdrawalRequest {\n  readonly requestId: string\n  readonly requester: string\n  readonly collections: readonly string[]\n  readonly disposition: 'delete' | 'freeze'\n  readonly legalBasis?: string\n  readonly status: WithdrawalRequestStatus\n  readonly requestedAt: string\n  readonly expiresAt?: string\n  readonly decidedAt?: string\n  readonly decidedBy?: string\n  readonly rejectReason?: string\n  readonly snapshotSha256?: string\n}\n\nexport interface RequestWithdrawalOptions {\n  readonly scope?: { readonly collections?: readonly string[] }\n  readonly disposition?: 'delete' | 'freeze'\n  readonly legalBasis?: string\n  /** Time-to-live in ms; after this the request can no longer be approved. */\n  readonly expiresInMs?: number\n}\n\nexport interface RequestWithdrawalResult {\n  readonly requestId: string\n  readonly status: WithdrawalRequestStatus\n  readonly expiresAt?: string\n}\n\nfunction writeRequest(vault: Vault, req: WithdrawalRequest, expectedVersion: number): Promise<void> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const body = JSON.stringify(req)\n  const actor = req.decidedBy ?? req.requester\n  const env = buildRecordEnvelope(\n    { collection: WITHDRAWAL_REQUESTS_COLLECTION, id: req.requestId, by: actor, version: expectedVersion + 1 },\n    { ts: req.decidedAt ?? req.requestedAt, iv: '', data: body},\n  )\n  return adapter.put(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, req.requestId, env, expectedVersion)\n}\n\nasync function readRequest(vault: Vault, requestId: string): Promise<{ req: WithdrawalRequest; version: number }> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, requestId)\n  if (!env) throw new WithdrawalRequestError(`withdrawal request \"${requestId}\" not found`)\n  return { req: JSON.parse(env._data) as WithdrawalRequest, version: env._v }\n}\n\n/**\n * Requester side. Files a durable request for the caller's accessible scope.\n * Gated by `user-request-withdrawal` (checked in the UserApi wrapper).\n */\nexport async function requestWithdrawal(\n  vault: Vault,\n  opts: RequestWithdrawalOptions = {},\n): Promise<RequestWithdrawalResult> {\n  const { keyring } = vault._introspectState()\n  // Resolve the requester's accessible collections (read access defines \"theirs\";\n  // the owner — who can delete anything — executes the disposition on approval).\n  const collections = resolveAccessibleCollections(keyring, opts.scope, false)\n  if (!collections || collections.length === 0) {\n    throw new WithdrawalRequestError(\n      'requestWithdrawal needs a concrete scope.collections (the caller has all-collection access — name the collections to withdraw)',\n    )\n  }\n  const requestId = `wr-${randomId()}`\n  const requestedAt = new Date().toISOString()\n  const req: WithdrawalRequest = {\n    requestId, requester: keyring.userId, collections, disposition: opts.disposition ?? 'delete',\n    status: 'pending', requestedAt,\n    ...(opts.legalBasis ? { legalBasis: opts.legalBasis } : {}),\n    ...(opts.expiresInMs ? { expiresAt: new Date(Date.parse(requestedAt) + opts.expiresInMs).toISOString() } : {}),\n  }\n  await writeRequest(vault, req, 0) // create-only\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: keyring.userId, payloadHash: '',\n    reason: `user-withdrawal-request:${requestId}:${keyring.userId}`,\n  })\n  return { requestId, status: 'pending', ...(req.expiresAt ? { expiresAt: req.expiresAt } : {}) }\n}\n\n/** Owner side. List filed requests (optionally by status). */\nexport async function listWithdrawalRequests(\n  vault: Vault,\n  opts: { status?: WithdrawalRequestStatus } = {},\n): Promise<WithdrawalRequest[]> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const ids = await adapter.list(vaultName, WITHDRAWAL_REQUESTS_COLLECTION)\n  const out: WithdrawalRequest[] = []\n  for (const id of ids) {\n    const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, id)\n    if (!env) continue\n    const req = JSON.parse(env._data) as WithdrawalRequest\n    if (!opts.status || req.status === opts.status) out.push(req)\n  }\n  return out\n}\n\nfunction assertApprover(vault: Vault): string {\n  const { keyring } = vault._introspectState()\n  // FR-6: custodian is INTENTIONALLY excluded (SAFER default — review flag).\n  // Approving a two-party withdrawal is a destructive extract-and-dispose\n  // exercised under FIRM authority — a governance act adjacent to grant/revoke,\n  // which a non-owning custodian cannot do. It stays owner/admin-only.\n  if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n    throw new WithdrawalRequestError('approveWithdrawal / rejectWithdrawal require an owner or admin')\n  }\n  return keyring.userId\n}\n\nfunction assertPending(req: WithdrawalRequest): void {\n  if (req.status !== 'pending') {\n    throw new WithdrawalRequestError(`withdrawal request \"${req.requestId}\" is already ${req.status}`)\n  }\n  if (req.expiresAt && Date.now() > Date.parse(req.expiresAt)) {\n    throw new WithdrawalRequestError(`withdrawal request \"${req.requestId}\" expired at ${req.expiresAt}`)\n  }\n}\n\nexport interface ApproveWithdrawalOptions {\n  /** Re-key the handed-back bundle to a secret the requester will use. */\n  readonly reKey?: { readonly secret: string }\n}\n\n/**\n * Owner side. Extract the requester's recorded scope under firm authority,\n * dispose of the source per the request's disposition, mark the request\n * approved, and return the re-keyed bundle to hand back. Gated by\n * `approve-user-withdrawal` (checked in the UserApi wrapper) + owner/admin role.\n */\nexport async function approveWithdrawal(\n  vault: Vault,\n  requestId: string,\n  opts: ApproveWithdrawalOptions = {},\n): Promise<WithdrawResult> {\n  const approver = assertApprover(vault)\n  const { req, version } = await readRequest(vault, requestId)\n  assertPending(req)\n\n  // 1. Produce the requester's re-keyed portable copy FIRST (owner authority\n  //    holds every DEK, so the recorded collections are all readable).\n  const bundle = await buildAccessibleBundle(vault, [...req.collections], opts.reKey)\n\n  // 2. + 3. dispose of the source (freeze snapshot, optional → delete-closure).\n  const snapshot: FrozenSnapshotRef | undefined = await freezeAndDeleteClosure(vault, req.collections, {\n    disposition: req.disposition, actorUserId: approver, withdrawalId: `wd-${requestId}`,\n  })\n\n  // 4. mark approved + audit (OCC against the version we read).\n  const decidedAt = new Date().toISOString()\n  await writeRequest(vault, {\n    ...req, status: 'approved', decidedAt, decidedBy: approver,\n    ...(snapshot ? { snapshotSha256: snapshot.sha256 } : {}),\n  }, version)\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: approver, payloadHash: '',\n    reason: `user-withdrawal-approved:${requestId}:${req.requester}:${req.disposition}`,\n  })\n\n  return snapshot ? { bundle, snapshot } : { bundle }\n}\n\nexport interface RejectWithdrawalOptions {\n  readonly reason?: string\n}\n\n/** Owner side. Decline a pending request (no data is touched). */\nexport async function rejectWithdrawal(\n  vault: Vault,\n  requestId: string,\n  opts: RejectWithdrawalOptions = {},\n): Promise<WithdrawalRequest> {\n  const approver = assertApprover(vault)\n  const { req, version } = await readRequest(vault, requestId)\n  assertPending(req)\n  const decidedAt = new Date().toISOString()\n  const updated: WithdrawalRequest = {\n    ...req, status: 'rejected', decidedAt, decidedBy: approver,\n    ...(opts.reason ? { rejectReason: opts.reason } : {}),\n  }\n  await writeRequest(vault, updated, version)\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: approver, payloadHash: '',\n    reason: `user-withdrawal-rejected:${requestId}:${req.requester}`,\n  })\n  return updated\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA2BO,IAAM,iCAAiC;AAGvC,IAAM,yBAAN,cAAqC,WAAW;AAAA,EACrD,YAAY,SAAiB;AAC3B,UAAM,sBAAsB,OAAO;AACnC,SAAK,OAAO;AAAA,EACd;AACF;AAiCA,SAAS,aAAa,OAAc,KAAwB,iBAAwC;AAClG,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,QAAM,QAAQ,IAAI,aAAa,IAAI;AACnC,QAAM,MAAM;AAAA,IACV,EAAE,YAAY,gCAAgC,IAAI,IAAI,WAAW,IAAI,OAAO,SAAS,kBAAkB,EAAE;AAAA,IACzG,EAAE,IAAI,IAAI,aAAa,IAAI,aAAa,IAAI,IAAI,MAAM,KAAI;AAAA,EAC5D;AACA,SAAO,QAAQ,IAAI,WAAW,gCAAgC,IAAI,WAAW,KAAK,eAAe;AACnG;AAEA,eAAe,YAAY,OAAc,WAAyE;AAChH,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gCAAgC,SAAS;AAClF,MAAI,CAAC,IAAK,OAAM,IAAI,uBAAuB,uBAAuB,SAAS,aAAa;AACxF,SAAO,EAAE,KAAK,KAAK,MAAM,IAAI,KAAK,GAAwB,SAAS,IAAI,GAAG;AAC5E;AAMA,eAAsB,kBACpB,OACA,OAAiC,CAAC,GACA;AAClC,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAG3C,QAAM,cAAc,6BAA6B,SAAS,KAAK,OAAO,KAAK;AAC3E,MAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,MAAM,SAAS,CAAC;AAClC,QAAM,eAAc,oBAAI,KAAK,GAAE,YAAY;AAC3C,QAAM,MAAyB;AAAA,IAC7B;AAAA,IAAW,WAAW,QAAQ;AAAA,IAAQ;AAAA,IAAa,aAAa,KAAK,eAAe;AAAA,IACpF,QAAQ;AAAA,IAAW;AAAA,IACnB,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IACzD,GAAI,KAAK,cAAc,EAAE,WAAW,IAAI,KAAK,KAAK,MAAM,WAAW,IAAI,KAAK,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC;AAAA,EAC9G;AACA,QAAM,aAAa,OAAO,KAAK,CAAC;AAChC,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,QAAQ;AAAA,IAAQ,aAAa;AAAA,IACzF,QAAQ,2BAA2B,SAAS,IAAI,QAAQ,MAAM;AAAA,EAChE,CAAC;AACD,SAAO,EAAE,WAAW,QAAQ,WAAW,GAAI,IAAI,YAAY,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC,EAAG;AAChG;AAGA,eAAsB,uBACpB,OACA,OAA6C,CAAC,GAChB;AAC9B,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,MAAM,MAAM,QAAQ,KAAK,WAAW,8BAA8B;AACxE,QAAM,MAA2B,CAAC;AAClC,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gCAAgC,EAAE;AAC3E,QAAI,CAAC,IAAK;AACV,UAAM,MAAM,KAAK,MAAM,IAAI,KAAK;AAChC,QAAI,CAAC,KAAK,UAAU,IAAI,WAAW,KAAK,OAAQ,KAAI,KAAK,GAAG;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAsB;AAC5C,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAK3C,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI,uBAAuB,gEAAgE;AAAA,EACnG;AACA,SAAO,QAAQ;AACjB;AAEA,SAAS,cAAc,KAA8B;AACnD,MAAI,IAAI,WAAW,WAAW;AAC5B,UAAM,IAAI,uBAAuB,uBAAuB,IAAI,SAAS,gBAAgB,IAAI,MAAM,EAAE;AAAA,EACnG;AACA,MAAI,IAAI,aAAa,KAAK,IAAI,IAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC3D,UAAM,IAAI,uBAAuB,uBAAuB,IAAI,SAAS,gBAAgB,IAAI,SAAS,EAAE;AAAA,EACtG;AACF;AAaA,eAAsB,kBACpB,OACA,WACA,OAAiC,CAAC,GACT;AACzB,QAAM,WAAW,eAAe,KAAK;AACrC,QAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,YAAY,OAAO,SAAS;AAC3D,gBAAc,GAAG;AAIjB,QAAM,SAAS,MAAM,sBAAsB,OAAO,CAAC,GAAG,IAAI,WAAW,GAAG,KAAK,KAAK;AAGlF,QAAM,WAA0C,MAAM,uBAAuB,OAAO,IAAI,aAAa;AAAA,IACnG,aAAa,IAAI;AAAA,IAAa,aAAa;AAAA,IAAU,cAAc,MAAM,SAAS;AAAA,EACpF,CAAC;AAGD,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,aAAa,OAAO;AAAA,IACxB,GAAG;AAAA,IAAK,QAAQ;AAAA,IAAY;AAAA,IAAW,WAAW;AAAA,IAClD,GAAI,WAAW,EAAE,gBAAgB,SAAS,OAAO,IAAI,CAAC;AAAA,EACxD,GAAG,OAAO;AACV,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO;AAAA,IAAU,aAAa;AAAA,IACnF,QAAQ,4BAA4B,SAAS,IAAI,IAAI,SAAS,IAAI,IAAI,WAAW;AAAA,EACnF,CAAC;AAED,SAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,EAAE,OAAO;AACpD;AAOA,eAAsB,iBACpB,OACA,WACA,OAAgC,CAAC,GACL;AAC5B,QAAM,WAAW,eAAe,KAAK;AACrC,QAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,YAAY,OAAO,SAAS;AAC3D,gBAAc,GAAG;AACjB,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,UAA6B;AAAA,IACjC,GAAG;AAAA,IAAK,QAAQ;AAAA,IAAY;AAAA,IAAW,WAAW;AAAA,IAClD,GAAI,KAAK,SAAS,EAAE,cAAc,KAAK,OAAO,IAAI,CAAC;AAAA,EACrD;AACA,QAAM,aAAa,OAAO,SAAS,OAAO;AAC1C,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO;AAAA,IAAU,aAAa;AAAA,IACnF,QAAQ,4BAA4B,SAAS,IAAI,IAAI,SAAS;AAAA,EAChE,CAAC;AACD,SAAO;AACT;","names":[]}

package/dist/{chunk-52QYGZHH.js → chunk-GBBDFE6C.js}

@@ -1,6 +1,6 @@
 import {
   writePod
-} from "./chunk-VOQW5LAM.js";
+} from "./chunk-QSIEL6TL.js";
 
 // src/with-audit/portability/export-accessible.ts
 function resolveAccessibleCollections(keyring, scope, writableOnly = false) {
@@ -42,4 +42,4 @@ export {
   buildAccessibleBundle,
   exportAccessibleData
 };
-//# sourceMappingURL=chunk-52QYGZHH.js.map
+//# sourceMappingURL=chunk-GBBDFE6C.js.map

package/dist/chunk-GBBDFE6C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/portability/export-accessible.ts"],"sourcesContent":["/**\n * `exportMyAccessibleData`: a non-owner user exports the scope they\n * can decrypt as a portable, re-keyed `.noydb` bundle. Non-destructive and\n * **always allowed** (the \"data sovereignty by construction\" property of\n * sealing-at-dimension — the firm cannot deny it) but **audited**.\n *\n * Reuses the existing bundle machinery: the access boundary is the caller's DEK\n * set (operator/client → `keyring.permissions`; owner/admin/viewer → all), so a\n * record outside the caller's keys can never enter the bundle. Re-keying to a\n * new owner reuses `writePod`'s `exportSecret` shorthand.\n */\nimport type { Vault } from '../../kernel/vault.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { writePod } from '../../with-pod/pod.js'\n\n/**\n * Resolve the collections a caller may export/withdraw: operator/client are\n * scoped to their granted collections; owner/admin/viewer see everything\n * (`undefined` = no allowlist). A `scope.collections` sub-scope intersects the\n * granted set. `writableOnly` keeps only `rw` grants (for destructive ops).\n */\nexport function resolveAccessibleCollections(\n  keyring: UnlockedKeyring,\n  scope: { collections?: readonly string[] } | undefined,\n  writableOnly = false,\n): string[] | undefined {\n  let collections: string[] | undefined\n  if (keyring.role === 'operator' || keyring.role === 'client') {\n    collections = Object.entries(keyring.permissions)\n      .filter(([, mode]) => !writableOnly || mode === 'rw')\n      .map(([c]) => c)\n  }\n  if (scope?.collections) {\n    const allow = new Set(scope.collections)\n    collections = (collections ?? [...scope.collections]).filter((c) => allow.has(c))\n  }\n  return collections\n}\n\n/** Produce a (optionally re-keyed, scoped) `.noydb` bundle — no audit. */\nexport async function buildAccessibleBundle(\n  vault: Vault,\n  collections: string[] | undefined,\n  reKey: { secret: string } | undefined,\n  compression: 'auto' | 'brotli' | 'gzip' | 'none' = 'auto',\n): Promise<Uint8Array> {\n  return writePod(vault, {\n    compression,\n    ...(collections !== undefined ? { collections } : {}),\n    ...(reKey ? { exportSecret: reKey.secret } : {}),\n  })\n}\n\nexport interface ExportAccessibleOptions {\n  /**\n   * Re-key the bundle so it is independently openable by a new owner with this\n   * secret (the receiving firm / the client themselves). Omit to inherit\n   * the source keyring (personal backup).\n   */\n  readonly reKey?: { readonly secret: string }\n  /** Narrow the export to a subset of the caller's accessible collections. */\n  readonly scope?: { readonly collections?: readonly string[] }\n  readonly compression?: 'auto' | 'brotli' | 'gzip' | 'none'\n}\n\n/**\n * Produce a re-keyed, access-scoped `.noydb` bundle of the caller's accessible\n * data. Appends a tamper-evident audit entry (`reason: 'user-export:<userId>'`).\n */\nexport async function exportAccessibleData(\n  vault: Vault,\n  opts: ExportAccessibleOptions = {},\n): Promise<Uint8Array> {\n  const { keyring } = vault._introspectState()\n  const collections = resolveAccessibleCollections(keyring, opts.scope)\n  const bytes = await buildAccessibleBundle(vault, collections, opts.reKey, opts.compression ?? 'auto')\n\n  // §11.11 audit — non-destructive, always-allowed export. No-op when the vault\n  // has no history/ledger strategy (avoids minting a phantom _ledger DEK).\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle',\n    collection: '',\n    id: '',\n    version: 0,\n    actor: keyring.userId,\n    payloadHash: '',\n    reason: `user-export:${keyring.userId}`,\n  })\n\n  return bytes\n}\n"],"mappings":";;;;;AAqBO,SAAS,6BACd,SACA,OACA,eAAe,OACO;AACtB,MAAI;AACJ,MAAI,QAAQ,SAAS,cAAc,QAAQ,SAAS,UAAU;AAC5D,kBAAc,OAAO,QAAQ,QAAQ,WAAW,EAC7C,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,gBAAgB,SAAS,IAAI,EACnD,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AAAA,EACnB;AACA,MAAI,OAAO,aAAa;AACtB,UAAM,QAAQ,IAAI,IAAI,MAAM,WAAW;AACvC,mBAAe,eAAe,CAAC,GAAG,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,MAAM,IAAI,CAAC,CAAC;AAAA,EAClF;AACA,SAAO;AACT;AAGA,eAAsB,sBACpB,OACA,aACA,OACA,cAAmD,QAC9B;AACrB,SAAO,SAAS,OAAO;AAAA,IACrB;AAAA,IACA,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACnD,GAAI,QAAQ,EAAE,cAAc,MAAM,OAAO,IAAI,CAAC;AAAA,EAChD,CAAC;AACH;AAkBA,eAAsB,qBACpB,OACA,OAAgC,CAAC,GACZ;AACrB,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAC3C,QAAM,cAAc,6BAA6B,SAAS,KAAK,KAAK;AACpE,QAAM,QAAQ,MAAM,sBAAsB,OAAO,aAAa,KAAK,OAAO,KAAK,eAAe,MAAM;AAIpG,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IACJ,YAAY;AAAA,IACZ,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,OAAO,QAAQ;AAAA,IACf,aAAa;AAAA,IACb,QAAQ,eAAe,QAAQ,MAAM;AAAA,EACvC,CAAC;AAED,SAAO;AACT;","names":[]}

package/dist/{chunk-HXGUIPQB.js → chunk-GQXFOAYZ.js}

@@ -2,10 +2,10 @@ import {
   base64ToBuffer,
   decryptBytesWithAAD,
   encryptBytesWithAAD
-} from "./chunk-VCETL77O.js";
+} from "./chunk-AU3AUJIZ.js";
 import {
   TamperedError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/kernel/enclave/classify/compare.ts
 var subtle = globalThis.crypto.subtle;
@@ -92,4 +92,4 @@ export {
   openVdigPayload,
   evaluateKofN
 };
-//# sourceMappingURL=chunk-HXGUIPQB.js.map
+//# sourceMappingURL=chunk-GQXFOAYZ.js.map

package/dist/{chunk-BTVYJWSN.js → chunk-GTHVPVAR.js}

@@ -1,9 +1,9 @@
 import {
   getAtPath
-} from "./chunk-7G6VDWXB.js";
+} from "./chunk-WVE6YKMX.js";
 import {
   SearchNotEnabledError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-lookup/search/tokenize.ts
 var WORD = /[\p{L}\p{N}]+/gu;
@@ -294,31 +294,31 @@ function buildBlobFieldEntries(filenamesByField) {
 function withSearch() {
   return {
     async search(ctx, field, query, opts) {
-      const { search } = await import("./collection-facade-QN5ULWYC.js");
+      const { search } = await import("./collection-facade-VBM35WAH.js");
       return search(ctx, field, query, opts);
     },
     async retrieve(ctx, query, opts) {
-      const { retrieve } = await import("./collection-facade-QN5ULWYC.js");
+      const { retrieve } = await import("./collection-facade-VBM35WAH.js");
       return retrieve(ctx, query, opts);
     },
     async similarTo(ctx, vector, opts) {
-      const { similarTo } = await import("./collection-facade-QN5ULWYC.js");
+      const { similarTo } = await import("./collection-facade-VBM35WAH.js");
       return similarTo(ctx, vector, opts);
     },
     async warmIndex(ctx) {
-      const { warmIndex } = await import("./collection-facade-QN5ULWYC.js");
+      const { warmIndex } = await import("./collection-facade-VBM35WAH.js");
       return warmIndex(ctx);
     },
     async flushIndex(ctx) {
-      const { flushIndex } = await import("./collection-facade-QN5ULWYC.js");
+      const { flushIndex } = await import("./collection-facade-VBM35WAH.js");
       return flushIndex(ctx);
     },
     async embedOnWrite(ctx, id, record, version) {
-      const { embedOnWrite } = await import("./collection-facade-QN5ULWYC.js");
+      const { embedOnWrite } = await import("./collection-facade-VBM35WAH.js");
       return embedOnWrite(ctx, id, record, version);
     },
     async rebuildEmbeddings(ctx) {
-      const { rebuildEmbeddings } = await import("./collection-facade-QN5ULWYC.js");
+      const { rebuildEmbeddings } = await import("./collection-facade-VBM35WAH.js");
       return rebuildEmbeddings(ctx);
     }
   };
@@ -364,4 +364,4 @@ export {
   buildBlobFieldEntries,
   withSearch
 };
-//# sourceMappingURL=chunk-BTVYJWSN.js.map
+//# sourceMappingURL=chunk-GTHVPVAR.js.map

package/dist/{chunk-DMQCLZ4Z.js → chunk-GWO2IDAB.js}

@@ -1,7 +1,7 @@
 import {
   NonAdditiveSchemaChangeError,
   SchemaLockedError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-shape/schema-update/strategies.ts
 function blindUpdate() {
@@ -62,4 +62,4 @@ export {
   lockSchema,
   coordinatedCutover
 };
-//# sourceMappingURL=chunk-DMQCLZ4Z.js.map
+//# sourceMappingURL=chunk-GWO2IDAB.js.map

package/dist/{chunk-6HFM7EIT.js → chunk-H3G4I3PN.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-formula/derivations/with-derivation.ts
 function withDerivation(spec) {
@@ -126,4 +126,4 @@ export {
   withDerivation,
   withRollup
 };
-//# sourceMappingURL=chunk-6HFM7EIT.js.map
+//# sourceMappingURL=chunk-H3G4I3PN.js.map

package/dist/chunk-HK67PX4J.js

@@ -0,0 +1,27 @@
+// src/with-commit/vault-head/strategy.ts
+var VAULT_HEAD_COLLECTION = "_head";
+var DEFAULT_HEAD_BUCKETS = 256;
+function notEnabled(op) {
+  return new Error(
+    `${op} requires the vault-head capability. Pass \`vaultHeadStrategy: withVaultHead()\` from "@noy-db/hub/vault-head" to createNoydb().`
+  );
+}
+var NO_VAULT_HEAD = {
+  enabled: false,
+  bucketFor: () => "",
+  async note() {
+  },
+  async expected() {
+    throw notEnabled("vault.verifyHead()");
+  },
+  async knownIn() {
+    throw notEnabled("vault.verifyHead()");
+  }
+};
+
+export {
+  VAULT_HEAD_COLLECTION,
+  DEFAULT_HEAD_BUCKETS,
+  NO_VAULT_HEAD
+};
+//# sourceMappingURL=chunk-HK67PX4J.js.map

package/dist/chunk-HK67PX4J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/vault-head/strategy.ts"],"sourcesContent":["/**\n * `withVaultHead()` — the opt-in detector for **omission** (#1044).\n *\n * ## What it is for, and what it deliberately is not\n *\n * #1041 made every envelope self-authenticating at its identity, and #1042\n * made the merge reject one that is not. What neither can catch is **absence**:\n * a store that serves a genuine, unmodified `v1` when `v7` exists, or serves\n * nothing at all. An authentic old envelope is indistinguishable from an\n * authentic current one without external knowledge of what *should* be there.\n *\n * The head is that external knowledge: an authenticated `{id → version}`\n * manifest the client writes and the store cannot forge. It is **not** a Merkle\n * chain over content — content integrity is already handled, so the head needs\n * only versions.\n *\n * ## Why it is opt-in when AAD is not\n *\n * AAD costs nothing to coordinate and closes *alteration*, so it is kernel. The\n * head costs a write per commit and needs anti-entropy; on a single-device\n * offline vault it defends against nothing. Making it kernel would tax every\n * user for a multi-writer property. ADR 0003, Decision 3.\n *\n * `SECURITY.md` states the split exactly: a store cannot alter, relocate,\n * re-tier, re-author or rewind a record; **without `withVaultHead()` it can\n * still withhold or omit.**\n *\n * ## Bucketed, and why that is not a compromise\n *\n * ADR 0003 left head granularity open and asked for it to be sized early.\n * Measured, at the documented 50K-record vault ceiling:\n *\n * | shape | write cost per commit | detection |\n * |---|---|---|\n * | one per-vault manifest | **1.1 MiB** | per-record |\n * | one per collection | the same problem, renamed | per-record |\n * | **bucketed, 256 buckets** | **~4.4 KiB** | per-record |\n *\n * Bucketing changes *only* write amplification. Each bucket still lists every\n * one of its records' versions, so detection stays per-record — which is why\n * this is not a trade-off between cost and strength. Verifying one pulled\n * record reads one bucket rather than a megabyte.\n *\n * ## Wired as a bus OBSERVER, not a call in `collection.ts`\n *\n * That is what `kernel-surface` means by \"register on the ServiceBus instead of\n * growing this file\", and it keeps the hot write path untouched for anyone who\n * has not opted in: nothing is registered at all, so `hasHandlers` stays false\n * and the dispatch never happens.\n *\n * Both `afterPut` AND `afterDelete`, because a delete is a version bump like\n * any other. A head that stopped tracking deleted records would let a store\n * resurrect one by withholding the tombstone — precisely the omission this\n * exists to catch.\n *\n * ⚠️ The registration must be UNCONDITIONAL on anything but `enabled`. Its first\n * draft sat inside `#registerForgetHooks()`, which returns early when no forget\n * subjects are declared, so the head silently recorded nothing unless the vault\n * happened to use an unrelated feature. The tests caught it only because they\n * asserted a COUNT rather than \"no error\" — a head that records nothing raises\n * no errors and sweeps perfectly clean.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\n/** Reserved collection the head's buckets live in. */\nexport const VAULT_HEAD_COLLECTION = '_head' as const\n\n/** Default bucket count — see the sizing table above. */\nexport const DEFAULT_HEAD_BUCKETS = 256\n\nexport interface WithVaultHeadOptions {\n  /**\n   * How many buckets the manifest is split across. Higher means smaller writes\n   * and more reads to sweep the whole vault; lower means the opposite.\n   * Changing it on an existing vault re-homes every entry, so treat it as a\n   * layout decision rather than a tuning knob.\n   */\n  readonly buckets?: number\n}\n\n/** One record's expected state, as the client last committed it. */\nexport interface HeadEntry {\n  readonly collection: string\n  readonly id: string\n  readonly version: number\n}\n\nexport interface VaultHeadStrategy {\n  /**\n   * Is the head actually keeping a manifest?\n   *\n   * An explicit flag rather than an identity check against the stub: the kernel\n   * decides whether to register the write-path observer at all, and\n   * `port-layering` forbids it importing `NO_VAULT_HEAD` to compare. Without\n   * this, every write in a vault that never opted in would still pay a cache\n   * lookup and a no-op call.\n   */\n  readonly enabled: boolean\n\n  /** Bucket a record id lands in — pure, so callers can pre-group a batch. */\n  bucketFor(collection: string, id: string): string\n\n  /**\n   * Record `entry` as the client's expectation for that record.\n   *\n   * Called on every committed write, INSIDE the same logical operation, so\n   * there is no window where the record exists and the head does not know it.\n   */\n  note(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    entry: HeadEntry,\n  ): Promise<void>\n\n  /**\n   * What the client expects for `collection/id`, or `null` if the head has\n   * never seen it.\n   */\n  expected(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    collection: string,\n    id: string,\n  ): Promise<number | null>\n\n  /**\n   * Every record the head knows about in `collection` — the set a sweep\n   * compares against what the store actually serves, which is how DELETION\n   * SUPPRESSION is caught. A withheld record is absent from the store but\n   * present here.\n   */\n  knownIn(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    collection: string,\n  ): Promise<ReadonlyMap<string, number>>\n}\n\nfunction notEnabled(op: string): Error {\n  return new Error(\n    `${op} requires the vault-head capability. Pass \\`vaultHeadStrategy: withVaultHead()\\` ` +\n    'from \"@noy-db/hub/vault-head\" to createNoydb().',\n  )\n}\n\n/**\n * The un-opted-in stub. `note` is a NO-OP rather than a throw: the write path\n * calls it unconditionally, and a vault without the head must simply not keep\n * one. The READ side throws, because asking what the head expects when there is\n * no head is a caller error, not a silent \"nothing to report\" — the latter\n * would look exactly like a clean sweep.\n */\nexport const NO_VAULT_HEAD: VaultHeadStrategy = {\n  enabled: false,\n  bucketFor: () => '',\n  async note() {},\n  async expected() { throw notEnabled('vault.verifyHead()') },\n  async knownIn() { throw notEnabled('vault.verifyHead()') },\n}\n\nexport type { EncryptedEnvelope }\n"],"mappings":";AAoEO,IAAM,wBAAwB;AAG9B,IAAM,uBAAuB;AAyEpC,SAAS,WAAW,IAAmB;AACrC,SAAO,IAAI;AAAA,IACT,GAAG,EAAE;AAAA,EAEP;AACF;AASO,IAAM,gBAAmC;AAAA,EAC9C,SAAS;AAAA,EACT,WAAW,MAAM;AAAA,EACjB,MAAM,OAAO;AAAA,EAAC;AAAA,EACd,MAAM,WAAW;AAAE,UAAM,WAAW,oBAAoB;AAAA,EAAE;AAAA,EAC1D,MAAM,UAAU;AAAE,UAAM,WAAW,oBAAoB;AAAA,EAAE;AAC3D;","names":[]}

package/dist/{chunk-E7OBCBXS.js → chunk-HQSPF5IY.js}

@@ -1,21 +1,24 @@
 import {
   freezeSnapshotOnly
-} from "./chunk-EP7VPR7Y.js";
+} from "./chunk-5Q7AJ7DN.js";
 import {
   resolveManagedSecret
-} from "./chunk-TAGFGKHP.js";
+} from "./chunk-OTHHO3KI.js";
 import {
-  createOwnerKeyring
-} from "./chunk-ERB6NDDW.js";
+  assertRosterTagValid,
+  createOwnerKeyring,
+  mintRosterTag,
+  requireRosterKey
+} from "./chunk-CAGI4LLJ.js";
 import {
-  wrapKey
-} from "./chunk-VCETL77O.js";
+  buildRecordEnvelope
+} from "./chunk-PENPHA45.js";
 import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-W5W6KHN2.js";
+  wrapKey
+} from "./chunk-AU3AUJIZ.js";
 import {
   PermissionDeniedError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-party/team/deed.ts
 var DEED_RECORD_ID = "deed";
@@ -60,14 +63,11 @@ async function isDeedVault(store, vault) {
 async function saveDeedMarker(store, vault, marker) {
   const persisted = { _noydb_deed: 1, ...marker };
   const prior = await store.get(vault, "_meta", DEED_RECORD_ID);
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: (prior?._v ?? 0) + 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+  const env = buildRecordEnvelope(
+    { collection: "_meta", id: DEED_RECORD_ID, version: (prior?._v ?? 0) + 1 },
     // AES-GCM bypassed — the marker is plaintext audit metadata.
-    _iv: "",
-    _data: JSON.stringify(persisted)
-  };
+    { iv: "", data: JSON.stringify(persisted) }
+  );
   await store.put(vault, "_meta", DEED_RECORD_ID, env);
 }
 
@@ -99,11 +99,15 @@ async function liberateVault(vault, opts) {
     throw new PermissionDeniedError(`new owner keyring for "${opts.newOwnerId}" did not persist`);
   }
   const keyringFile = JSON.parse(env._data);
+  const mintedRosterKey = requireRosterKey(newOwner, "liberateVault");
+  await assertRosterTagValid(keyringFile, mintedRosterKey, opts.newOwnerId);
   const mergedDeks = { ...keyringFile.deks };
   for (const [collection, dek] of keyring.deks) {
     mergedDeks[collection] = await wrapKey(dek, newOwner.kek);
   }
-  const mergedFile = { ...keyringFile, deks: mergedDeks };
+  const rosterKey = requireRosterKey(keyring, "liberateVault");
+  const merged = { ...keyringFile, deks: mergedDeks };
+  const mergedFile = { ...merged, roster_tag: await mintRosterTag(merged, rosterKey) };
   await adapter.put(vaultName, "_keyring", opts.newOwnerId, { ...env, _data: JSON.stringify(mergedFile) });
   await vault._getLedgerOrNull()?.append({
     op: "lifecycle",
@@ -131,4 +135,4 @@ export {
   isDeedVault,
   liberateVault
 };
-//# sourceMappingURL=chunk-E7OBCBXS.js.map
+//# sourceMappingURL=chunk-HQSPF5IY.js.map

package/dist/chunk-HQSPF5IY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/deed.ts","../src/with-party/custody/liberate.ts"],"sourcesContent":["/**\n * FR-6 — Deed: sealed / hidden-owner provisioning.\n *\n * A **Deed** is a vault owned by a *latent* principal who never\n * authenticates. The owner credential (the random secret that\n * derives `KEK_owner`) is minted machine-side and sealed under a\n * **non-firm** {@link SealingKeyProvider} — that sealing boundary is\n * the cryptographic *inalienability anchor*: whoever holds the\n * provider (the client / their KMS) is the only party that can ever\n * re-derive `KEK_owner`. A firm-side custodian operates the vault\n * fully but can never reach the owner key — there is deliberately NO\n * firm-controlled fallback.\n *\n * Provisioning reuses the managed-mode seam:\n *   - {@link resolveManagedSecret} mints + seals + persists the random\n *     secret at `_meta/sealed-secret` (and unseals it on every\n *     subsequent open through the same provider).\n *   - {@link createOwnerKeyring} derives `KEK_owner` from that\n *     secret and writes the `_keyring/<ownerUserId>` file.\n *\n * On top of that, a Deed writes a `_meta/deed` **marker**. The marker\n * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH\n * sealing boundary protects them, so it must be readable without\n * unlocking the vault (a custodian or auditor inspecting the vault must\n * be able to see \"this is a Deed vault, owner = X, sealed under Y\"\n * without any key). The marker itself is therefore never sealed; only\n * the owner *credential* is.\n *\n * @module\n */\n\nimport { buildRecordEnvelope } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { createOwnerKeyring } from './keyring.js'\nimport type { SealingKeyProvider } from './managed-secret.js'\nimport { resolveManagedSecret } from './managed-secret.js'\n\n/** Reserved id for the Deed marker under `_meta`. */\nexport const DEED_RECORD_ID = 'deed' as const\n\n/**\n * Plaintext metadata recording a vault's latent-owner Deed. Persisted\n * at `_meta/deed`. Readable without unlocking the vault by design — it\n * carries no secret material, only the identity of the latent owner\n * and the sealing boundary that anchors inalienability.\n */\nexport interface DeedMarker {\n  /** The latent owner principal — the user id of the `_keyring/<id>` owner file. */\n  readonly ownerUserId: string\n  /**\n   * The `SealingKeyProvider.id` the owner credential is sealed under.\n   * The inalienability anchor: only the holder of this (non-firm)\n   * provider can re-derive `KEK_owner`. Audit metadata — never secret.\n   */\n  readonly sealedUnder: string\n  /** Always `true` for a Deed — the owner never authenticates interactively. */\n  readonly latent: true\n  /** ISO-8601 timestamp the Deed was issued. */\n  readonly issuedAt: string\n  /**\n   * ISO-8601 timestamp the vault was liberated (a new owner claimed it\n   * via the audited Liberate ceremony), if any. Absent until liberation.\n   */\n  readonly liberatedAt?: string\n}\n\n/**\n * Wire-format payload stored inside the `_meta/deed` envelope. Carries\n * a magic marker for forensics + the {@link DeedMarker} fields. JSON,\n * AES-GCM bypassed (the marker is plaintext metadata by design).\n */\ninterface DeedEnvelopePayload extends DeedMarker {\n  readonly _noydb_deed: 1\n}\n\n/**\n * Provision a Deed: a latent owner whose credential is sealed under\n * `sealing` (a NON-firm provider). Mints + seals the owner secret\n * via {@link resolveManagedSecret}, derives the owner keyring via\n * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`\n * marker. Returns the unlocked owner keyring.\n *\n * The returned keyring is the only in-memory window onto `KEK_owner`\n * for this call; the persistent re-entry point is the sealing provider\n * (re-run {@link resolveManagedSecret} with the same provider to\n * re-resolve the secret, then {@link createOwnerKeyring}/load to\n * unlock — no interactive secret is ever required).\n *\n * There is deliberately no firm-controlled fallback: the marker's\n * `sealedUnder` is the single cryptographic anchor of ownership.\n */\nexport async function createDeedOwner(\n  store: NoydbStore,\n  vault: string,\n  ownerUserId: string,\n  sealing: SealingKeyProvider,\n): Promise<UnlockedKeyring> {\n  // 1. Mint + seal + persist the random owner secret under the\n  //    non-firm provider (writes _meta/sealed-secret).\n  const secret = await resolveManagedSecret(store, vault, sealing)\n\n  // 2. Derive KEK_owner from the (never-human-seen) secret and\n  //    write the owner keyring file.\n  const keyring = await createOwnerKeyring(store, vault, { userId: ownerUserId, secret: secret })\n\n  // 3. Write the plaintext Deed marker. NOT sealed — it is audit\n  //    metadata that must be readable without unlocking.\n  await saveDeedMarker(store, vault, {\n    ownerUserId,\n    sealedUnder: sealing.id,\n    latent: true,\n    issuedAt: new Date().toISOString(),\n  })\n\n  return keyring\n}\n\n/**\n * Read the {@link DeedMarker} from `_meta/deed`, or `null` if the vault\n * has no Deed marker (i.e. it is not a Deed vault). Plaintext read — no\n * unlocking required.\n */\nexport async function loadDeedMarker(\n  store: NoydbStore,\n  vault: string,\n): Promise<DeedMarker | null> {\n  const envelope = await store.get(vault, '_meta', DEED_RECORD_ID)\n  if (!envelope) return null\n  let payload: unknown\n  try {\n    payload = JSON.parse(envelope._data)\n  } catch {\n    return null\n  }\n  if (typeof payload !== 'object' || payload === null) return null\n  const r = payload as Record<string, unknown>\n  if (r._noydb_deed !== 1) return null\n  if (\n    typeof r.ownerUserId !== 'string'\n    || typeof r.sealedUnder !== 'string'\n    || r.latent !== true\n    || typeof r.issuedAt !== 'string'\n  ) {\n    return null\n  }\n  const marker: DeedMarker = {\n    ownerUserId: r.ownerUserId,\n    sealedUnder: r.sealedUnder,\n    latent: true,\n    issuedAt: r.issuedAt,\n    ...(typeof r.liberatedAt === 'string' ? { liberatedAt: r.liberatedAt } : {}),\n  }\n  return marker\n}\n\n/** Whether `vault` carries a Deed marker (a sealed/latent owner). */\nexport async function isDeedVault(\n  store: NoydbStore,\n  vault: string,\n): Promise<boolean> {\n  return (await loadDeedMarker(store, vault)) !== null\n}\n\n/**\n * Persist a {@link DeedMarker} at `_meta/deed`. Mirrors\n * `saveSealedSecret`'s envelope shape: a standard\n * {@link EncryptedEnvelope} with AES-GCM bypassed (`_iv: ''`), the\n * payload stored as plaintext JSON in `_data`. The marker is metadata,\n * not a secret — sealing it would defeat its purpose (auditors /\n * custodians must read it without a key).\n *\n * @internal — used by `createDeedOwner` and (later) the Liberate\n * ceremony to stamp `liberatedAt`.\n */\nexport async function saveDeedMarker(\n  store: NoydbStore,\n  vault: string,\n  marker: DeedMarker,\n): Promise<void> {\n  const persisted: DeedEnvelopePayload = { _noydb_deed: 1, ...marker }\n  const prior = await store.get(vault, '_meta', DEED_RECORD_ID)\n  const env = buildRecordEnvelope(\n    { collection: '_meta', id: DEED_RECORD_ID, version: (prior?._v ?? 0) + 1 },\n    // AES-GCM bypassed — the marker is plaintext audit metadata.\n    { iv: '', data: JSON.stringify(persisted) },\n  )\n  await store.put(vault, '_meta', DEED_RECORD_ID, env)\n}\n","/**\n * `liberateVault` — the audited claim of ownership over a\n * sealed-owner (Deed) vault. The inverse of withdrawal.\n *\n * A **Deed** vault's owner credential is sealed under a non-firm provider, so\n * the firm-side **custodian** (which holds every collection DEK and operates\n * the vault fully) can never reach `KEK_owner`. Liberation is the ONLY route\n * by which a custodian assumes ownership, and it is deliberately a manual,\n * audited ceremony:\n *\n *   1. gate `'liberate-vault'` (fail-closed)\n *   2. caller MUST be the `custodian` (the de-facto authority holding the DEKs)\n *   3. freeze a PRE-liberation EVIDENCE snapshot (hash-pinned in the ledger) —\n *      but PRESERVE the live data for the new owner (see the freeze decision\n *      below)\n *   4. mint a NEW owner keyring re-wrapping the incumbent DEKs under the new\n *      owner's KEK\n *   5. lifecycle ledger `liberation-claimed:<newOwnerId>:<legalBasis>`\n *   6. stamp the `_meta/deed` marker with `liberatedAt`\n *\n * ## Security: the inalienability floor\n *\n * Liberation **mints a new owner from the custodian's DEKs** — it does NOT\n * unseal the original sealed owner. The old sealed-owner credential is left\n * untouched and ORPHANED (its `_keyring/<id>` file remains, its KEK is still\n * sealed under the non-firm provider), never impersonated. The new owner is a\n * DISTINCT principal under a fresh KEK derived from `newOwnerSecret`. This\n * preserves the inalienability floor: the act of claiming ownership is itself\n * auditable and produces a different principal, rather than silently assuming\n * the latent owner's identity.\n *\n * ## Freeze decision: snapshot-only, not freeze-and-delete\n *\n * `freezeAndDeleteClosure` (withdraw-accessible.ts) writes a hash-pinned\n * snapshot and THEN delete-closures the live records — correct for a\n * destructive withdrawal, WRONG for liberation. Liberation transfers\n * operational continuity; it must leave the live data intact for the new\n * owner. We therefore call the snapshot-only core `freezeSnapshotOnly`\n * (factored out of that module; the freeze-AND-delete withdrawal path is\n * unchanged) to pin the evidence snapshot while preserving the records.\n *\n * @module\n */\n\nimport type { Vault } from '../../kernel/vault.js'\nimport type { FactorProofBundle, KeyringFile } from '../../kernel/types.js'\nimport { PermissionDeniedError } from '../../kernel/errors.js'\nimport { wrapKey } from '../../kernel/enclave/index.js'\nimport { createOwnerKeyring, requireRosterKey } from '../team/keyring.js'\nimport { mintRosterTag, assertRosterTagValid } from '../team/roster-tag.js'\nimport type { FrozenSnapshotRef } from '../../with-audit/portability/withdraw-accessible.js'\nimport { freezeSnapshotOnly } from '../../with-audit/portability/withdraw-accessible.js'\nimport { loadDeedMarker, saveDeedMarker } from '../team/deed.js'\n\nexport interface LiberateOptions {\n  /** The id of the new owner principal the custodian mints by claiming ownership. */\n  readonly newOwnerId: string\n  /** The secret that derives the new owner's KEK (the DEKs are re-wrapped under it). */\n  readonly newOwnerSecret: string\n  /** Legal/contractual basis recorded in the audit (e.g. 'contractual-handover'). */\n  readonly legalBasis: string\n  readonly factors?: FactorProofBundle\n}\n\nexport interface LiberateResult {\n  /** The hash-pinned pre-liberation evidence snapshot. */\n  readonly snapshot: FrozenSnapshotRef\n}\n\n/**\n * Audited claim of ownership over a sealed-owner vault by its custodian. See\n * the module doc for the full ceremony + security rationale.\n */\nexport async function liberateVault(\n  vault: Vault,\n  opts: LiberateOptions,\n): Promise<LiberateResult> {\n  // 1. gate — fail-closed `liberate-vault`.\n  await vault.noydb.checkGate(vault.name, 'liberate-vault', opts.factors)\n\n  // 2. caller must be the custodian (the de-facto authority holding the DEKs).\n  const { name: vaultName, adapter, keyring } = vault._introspectState()\n  if (keyring.role !== 'custodian') {\n    throw new PermissionDeniedError(\n      'liberation is claimed only by the custodian (the de-facto authority holding the DEKs)',\n    )\n  }\n\n  // Refuse to clobber an existing principal: the new owner must be a FRESH id.\n  // (Checked before any side effect so a colliding id never leaves a half-run\n  //  ceremony — no orphan snapshot, no partial keyring overwrite.)\n  const existing = await adapter.get(vaultName, '_keyring', opts.newOwnerId)\n  if (existing) {\n    throw new PermissionDeniedError(\n      `liberateVault: newOwnerId \"${opts.newOwnerId}\" already exists as a principal; choose a fresh id (liberation mints a distinct owner, it never overwrites an existing keyring)`,\n    )\n  }\n\n  // 3. Pre-liberation EVIDENCE snapshot of every operational collection —\n  //    snapshot-only (live data preserved for the new owner; liberation\n  //    transfers operational continuity, it does not erase).\n  const collections = await listOperationalCollections(vault)\n  const snapshot = await freezeSnapshotOnly(vault, collections, { actorUserId: keyring.userId })\n\n  // 4. Mint a NEW owner keyring, re-wrapping the incumbent DEKs under the new\n  //    owner's fresh KEK. The old sealed owner is NOT unsealed — a DISTINCT\n  //    principal is minted and the original owner credential is left orphaned\n  //    (inalienability floor). Mirrors adopt-partition.ts's DEK re-wrap.\n  const newOwner = await createOwnerKeyring(adapter, vaultName, { userId: opts.newOwnerId, secret: opts.newOwnerSecret })\n  if (!newOwner.kek) {\n    throw new PermissionDeniedError(\n      `new owner keyring for \"${opts.newOwnerId}\" has no KEK to re-wrap the incumbent DEKs under`,\n    )\n  }\n  const env = await adapter.get(vaultName, '_keyring', opts.newOwnerId)\n  if (!env) {\n    throw new PermissionDeniedError(`new owner keyring for \"${opts.newOwnerId}\" did not persist`)\n  }\n  const keyringFile = JSON.parse(env._data) as KeyringFile\n  // #1096 — this is a read-BACK of the file `createOwnerKeyring` just wrote, and\n  // it is about to be edited and restamped, so the store gets a window to alter\n  // it in between. Verified against the NEW owner's own roster key, not the\n  // incumbent's: at this instant the file is still stamped under the fresh key\n  // minted above (the swap to the incumbent key happens below).\n  const mintedRosterKey = requireRosterKey(newOwner, 'liberateVault')\n  await assertRosterTagValid(keyringFile, mintedRosterKey, opts.newOwnerId)\n  const mergedDeks: Record<string, string> = { ...keyringFile.deks }\n  for (const [collection, dek] of keyring.deks) {\n    mergedDeks[collection] = await wrapKey(dek, newOwner.kek)\n  }\n  // #1096 — liberation joins a new owner to an EXISTING vault, so the vault's\n  // roster key must stay the incumbent one. `createOwnerKeyring` above minted a\n  // fresh roster key (correct for a new vault, wrong here), and the merge loop\n  // has just overwritten `_roster` with the incumbent's — so the tag it stamped\n  // no longer matches the key in the file. Restamp under the key that actually\n  // ends up persisted, or the new owner cannot open the vault they just claimed.\n  //\n  // Keeping the incumbent key is the substantive half: a fresh one would leave\n  // the new owner unable to verify any co-member's roster, and every co-member\n  // unable to verify theirs.\n  const rosterKey = requireRosterKey(keyring, 'liberateVault')\n  const merged: KeyringFile = { ...keyringFile, deks: mergedDeks }\n  const mergedFile: KeyringFile = { ...merged, roster_tag: await mintRosterTag(merged, rosterKey) }\n  await adapter.put(vaultName, '_keyring', opts.newOwnerId, { ...env, _data: JSON.stringify(mergedFile) })\n\n  // 5. Lifecycle ledger audit (no-op if the history strategy is absent).\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: opts.newOwnerId, payloadHash: '',\n    reason: `liberation-claimed:${opts.newOwnerId}:${opts.legalBasis}`,\n  })\n\n  // 6. Stamp the Deed marker with `liberatedAt` (if a marker exists).\n  const marker = await loadDeedMarker(adapter, vaultName)\n  if (marker) {\n    await saveDeedMarker(adapter, vaultName, { ...marker, liberatedAt: new Date().toISOString() })\n  }\n\n  return { snapshot }\n}\n\n/**\n * Enumerate the vault's operational (user-facing) collections — those carried\n * by the caller's keyring DEK map, minus the reserved internal collections\n * (`_*`). These are the collections frozen into the evidence snapshot.\n */\nasync function listOperationalCollections(vault: Vault): Promise<readonly string[]> {\n  const { keyring } = vault._introspectState()\n  return [...keyring.deks.keys()].filter((c) => !c.startsWith('_'))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAuCO,IAAM,iBAAiB;AAqD9B,eAAsB,gBACpB,OACA,OACA,aACA,SAC0B;AAG1B,QAAM,SAAS,MAAM,qBAAqB,OAAO,OAAO,OAAO;AAI/D,QAAM,UAAU,MAAM,mBAAmB,OAAO,OAAO,EAAE,QAAQ,aAAa,OAAe,CAAC;AAI9F,QAAM,eAAe,OAAO,OAAO;AAAA,IACjC;AAAA,IACA,aAAa,QAAQ;AAAA,IACrB,QAAQ;AAAA,IACR,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnC,CAAC;AAED,SAAO;AACT;AAOA,eAAsB,eACpB,OACA,OAC4B;AAC5B,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,cAAc;AAC/D,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,SAAS,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,YAAY,YAAY,KAAM,QAAO;AAC5D,QAAM,IAAI;AACV,MAAI,EAAE,gBAAgB,EAAG,QAAO;AAChC,MACE,OAAO,EAAE,gBAAgB,YACtB,OAAO,EAAE,gBAAgB,YACzB,EAAE,WAAW,QACb,OAAO,EAAE,aAAa,UACzB;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAqB;AAAA,IACzB,aAAa,EAAE;AAAA,IACf,aAAa,EAAE;AAAA,IACf,QAAQ;AAAA,IACR,UAAU,EAAE;AAAA,IACZ,GAAI,OAAO,EAAE,gBAAgB,WAAW,EAAE,aAAa,EAAE,YAAY,IAAI,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAGA,eAAsB,YACpB,OACA,OACkB;AAClB,SAAQ,MAAM,eAAe,OAAO,KAAK,MAAO;AAClD;AAaA,eAAsB,eACpB,OACA,OACA,QACe;AACf,QAAM,YAAiC,EAAE,aAAa,GAAG,GAAG,OAAO;AACnE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,cAAc;AAC5D,QAAM,MAAM;AAAA,IACV,EAAE,YAAY,SAAS,IAAI,gBAAgB,UAAU,OAAO,MAAM,KAAK,EAAE;AAAA;AAAA,IAEzE,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,SAAS,EAAE;AAAA,EAC5C;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,gBAAgB,GAAG;AACrD;;;ACnHA,eAAsB,cACpB,OACA,MACyB;AAEzB,QAAM,MAAM,MAAM,UAAU,MAAM,MAAM,kBAAkB,KAAK,OAAO;AAGtE,QAAM,EAAE,MAAM,WAAW,SAAS,QAAQ,IAAI,MAAM,iBAAiB;AACrE,MAAI,QAAQ,SAAS,aAAa;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAKA,QAAM,WAAW,MAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,UAAU;AACzE,MAAI,UAAU;AACZ,UAAM,IAAI;AAAA,MACR,8BAA8B,KAAK,UAAU;AAAA,IAC/C;AAAA,EACF;AAKA,QAAM,cAAc,MAAM,2BAA2B,KAAK;AAC1D,QAAM,WAAW,MAAM,mBAAmB,OAAO,aAAa,EAAE,aAAa,QAAQ,OAAO,CAAC;AAM7F,QAAM,WAAW,MAAM,mBAAmB,SAAS,WAAW,EAAE,QAAQ,KAAK,YAAY,QAAQ,KAAK,eAAe,CAAC;AACtH,MAAI,CAAC,SAAS,KAAK;AACjB,UAAM,IAAI;AAAA,MACR,0BAA0B,KAAK,UAAU;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,UAAU;AACpE,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,sBAAsB,0BAA0B,KAAK,UAAU,mBAAmB;AAAA,EAC9F;AACA,QAAM,cAAc,KAAK,MAAM,IAAI,KAAK;AAMxC,QAAM,kBAAkB,iBAAiB,UAAU,eAAe;AAClE,QAAM,qBAAqB,aAAa,iBAAiB,KAAK,UAAU;AACxE,QAAM,aAAqC,EAAE,GAAG,YAAY,KAAK;AACjE,aAAW,CAAC,YAAY,GAAG,KAAK,QAAQ,MAAM;AAC5C,eAAW,UAAU,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AAAA,EAC1D;AAWA,QAAM,YAAY,iBAAiB,SAAS,eAAe;AAC3D,QAAM,SAAsB,EAAE,GAAG,aAAa,MAAM,WAAW;AAC/D,QAAM,aAA0B,EAAE,GAAG,QAAQ,YAAY,MAAM,cAAc,QAAQ,SAAS,EAAE;AAChG,QAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,YAAY,EAAE,GAAG,KAAK,OAAO,KAAK,UAAU,UAAU,EAAE,CAAC;AAGvG,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,KAAK;AAAA,IAAY,aAAa;AAAA,IAC1F,QAAQ,sBAAsB,KAAK,UAAU,IAAI,KAAK,UAAU;AAAA,EAClE,CAAC;AAGD,QAAM,SAAS,MAAM,eAAe,SAAS,SAAS;AACtD,MAAI,QAAQ;AACV,UAAM,eAAe,SAAS,WAAW,EAAE,GAAG,QAAQ,cAAa,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,EAC/F;AAEA,SAAO,EAAE,SAAS;AACpB;AAOA,eAAe,2BAA2B,OAA0C;AAClF,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAC3C,SAAO,CAAC,GAAG,QAAQ,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AAClE;","names":[]}

package/dist/{chunk-VJFMXYKP.js → chunk-HR5R5JOM.js}

@@ -1,6 +1,6 @@
 import {
   AttestationNotEnabledError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-audit/attestation/strategy.ts
 var NO_ATTESTATION = {
@@ -27,4 +27,4 @@ var NO_ATTESTATION = {
 export {
   NO_ATTESTATION
 };
-//# sourceMappingURL=chunk-VJFMXYKP.js.map
+//# sourceMappingURL=chunk-HR5R5JOM.js.map

package/dist/{chunk-FDX7OWWI.js → chunk-HYYVT2KZ.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-formula/overlay-views/with-overlayed-view.ts
 function withOverlayedView(spec) {
@@ -33,4 +33,4 @@ function withOverlayedView(spec) {
 export {
   withOverlayedView
 };
-//# sourceMappingURL=chunk-FDX7OWWI.js.map
+//# sourceMappingURL=chunk-HYYVT2KZ.js.map

package/dist/{chunk-JRCYZEHU.js → chunk-I6QKB7MT.js}

@@ -1,6 +1,6 @@
 import {
   ReadOnlyFrameError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-fork/shadow/vault-frame.ts
 var VaultFrame = class {
@@ -71,4 +71,4 @@ export {
   VaultFrame,
   CollectionFrame
 };
-//# sourceMappingURL=chunk-JRCYZEHU.js.map
+//# sourceMappingURL=chunk-I6QKB7MT.js.map