@noy-db/hub 0.6.0-pre.20 → 0.6.0-pre.22

package/dist/{chunk-PNAIDIP7.js.map → chunk-L3AM6EGU.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-party/team/deed.ts","../src/with-party/custody/liberate.ts"],"sourcesContent":["/**\n * FR-6 — Deed: sealed / hidden-owner provisioning.\n *\n * A **Deed** is a vault owned by a *latent* principal who never\n * authenticates. The owner credential (the random secret that\n * derives `KEK_owner`) is minted machine-side and sealed under a\n * **non-firm** {@link SealingKeyProvider} — that sealing boundary is\n * the cryptographic *inalienability anchor*: whoever holds the\n * provider (the client / their KMS) is the only party that can ever\n * re-derive `KEK_owner`. A firm-side custodian operates the vault\n * fully but can never reach the owner key — there is deliberately NO\n * firm-controlled fallback.\n *\n * Provisioning reuses the managed-mode seam:\n *   - {@link resolveManagedSecret} mints + seals + persists the random\n *     secret at `_meta/sealed-secret` (and unseals it on every\n *     subsequent open through the same provider).\n *   - {@link createOwnerKeyring} derives `KEK_owner` from that\n *     secret and writes the `_keyring/<ownerUserId>` file.\n *\n * On top of that, a Deed writes a `_meta/deed` **marker**. The marker\n * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH\n * sealing boundary protects them, so it must be readable without\n * unlocking the vault (a custodian or auditor inspecting the vault must\n * be able to see \"this is a Deed vault, owner = X, sealed under Y\"\n * without any key). The marker itself is therefore never sealed; only\n * the owner *credential* is.\n *\n * @module\n */\n\nimport { buildRecordEnvelope } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { createOwnerKeyring } from './keyring.js'\nimport type { SealingKeyProvider } from './managed-secret.js'\nimport { resolveManagedSecret } from './managed-secret.js'\n\n/** Reserved id for the Deed marker under `_meta`. */\nexport const DEED_RECORD_ID = 'deed' as const\n\n/**\n * Plaintext metadata recording a vault's latent-owner Deed. Persisted\n * at `_meta/deed`. Readable without unlocking the vault by design — it\n * carries no secret material, only the identity of the latent owner\n * and the sealing boundary that anchors inalienability.\n */\nexport interface DeedMarker {\n  /** The latent owner principal — the user id of the `_keyring/<id>` owner file. */\n  readonly ownerUserId: string\n  /**\n   * The `SealingKeyProvider.id` the owner credential is sealed under.\n   * The inalienability anchor: only the holder of this (non-firm)\n   * provider can re-derive `KEK_owner`. Audit metadata — never secret.\n   */\n  readonly sealedUnder: string\n  /** Always `true` for a Deed — the owner never authenticates interactively. */\n  readonly latent: true\n  /** ISO-8601 timestamp the Deed was issued. */\n  readonly issuedAt: string\n  /**\n   * ISO-8601 timestamp the vault was liberated (a new owner claimed it\n   * via the audited Liberate ceremony), if any. Absent until liberation.\n   */\n  readonly liberatedAt?: string\n}\n\n/**\n * Wire-format payload stored inside the `_meta/deed` envelope. Carries\n * a magic marker for forensics + the {@link DeedMarker} fields. JSON,\n * AES-GCM bypassed (the marker is plaintext metadata by design).\n */\ninterface DeedEnvelopePayload extends DeedMarker {\n  readonly _noydb_deed: 1\n}\n\n/**\n * Provision a Deed: a latent owner whose credential is sealed under\n * `sealing` (a NON-firm provider). Mints + seals the owner secret\n * via {@link resolveManagedSecret}, derives the owner keyring via\n * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`\n * marker. Returns the unlocked owner keyring.\n *\n * The returned keyring is the only in-memory window onto `KEK_owner`\n * for this call; the persistent re-entry point is the sealing provider\n * (re-run {@link resolveManagedSecret} with the same provider to\n * re-resolve the secret, then {@link createOwnerKeyring}/load to\n * unlock — no interactive secret is ever required).\n *\n * There is deliberately no firm-controlled fallback: the marker's\n * `sealedUnder` is the single cryptographic anchor of ownership.\n */\nexport async function createDeedOwner(\n  store: NoydbStore,\n  vault: string,\n  ownerUserId: string,\n  sealing: SealingKeyProvider,\n): Promise<UnlockedKeyring> {\n  // 1. Mint + seal + persist the random owner secret under the\n  //    non-firm provider (writes _meta/sealed-secret).\n  const secret = await resolveManagedSecret(store, vault, sealing)\n\n  // 2. Derive KEK_owner from the (never-human-seen) secret and\n  //    write the owner keyring file.\n  const keyring = await createOwnerKeyring(store, vault, { userId: ownerUserId, secret: secret })\n\n  // 3. Write the plaintext Deed marker. NOT sealed — it is audit\n  //    metadata that must be readable without unlocking.\n  await saveDeedMarker(store, vault, {\n    ownerUserId,\n    sealedUnder: sealing.id,\n    latent: true,\n    issuedAt: new Date().toISOString(),\n  })\n\n  return keyring\n}\n\n/**\n * Read the {@link DeedMarker} from `_meta/deed`, or `null` if the vault\n * has no Deed marker (i.e. it is not a Deed vault). Plaintext read — no\n * unlocking required.\n */\nexport async function loadDeedMarker(\n  store: NoydbStore,\n  vault: string,\n): Promise<DeedMarker | null> {\n  const envelope = await store.get(vault, '_meta', DEED_RECORD_ID)\n  if (!envelope) return null\n  let payload: unknown\n  try {\n    payload = JSON.parse(envelope._data)\n  } catch {\n    return null\n  }\n  if (typeof payload !== 'object' || payload === null) return null\n  const r = payload as Record<string, unknown>\n  if (r._noydb_deed !== 1) return null\n  if (\n    typeof r.ownerUserId !== 'string'\n    || typeof r.sealedUnder !== 'string'\n    || r.latent !== true\n    || typeof r.issuedAt !== 'string'\n  ) {\n    return null\n  }\n  const marker: DeedMarker = {\n    ownerUserId: r.ownerUserId,\n    sealedUnder: r.sealedUnder,\n    latent: true,\n    issuedAt: r.issuedAt,\n    ...(typeof r.liberatedAt === 'string' ? { liberatedAt: r.liberatedAt } : {}),\n  }\n  return marker\n}\n\n/** Whether `vault` carries a Deed marker (a sealed/latent owner). */\nexport async function isDeedVault(\n  store: NoydbStore,\n  vault: string,\n): Promise<boolean> {\n  return (await loadDeedMarker(store, vault)) !== null\n}\n\n/**\n * Persist a {@link DeedMarker} at `_meta/deed`. Mirrors\n * `saveSealedSecret`'s envelope shape: a standard\n * {@link EncryptedEnvelope} with AES-GCM bypassed (`_iv: ''`), the\n * payload stored as plaintext JSON in `_data`. The marker is metadata,\n * not a secret — sealing it would defeat its purpose (auditors /\n * custodians must read it without a key).\n *\n * @internal — used by `createDeedOwner` and (later) the Liberate\n * ceremony to stamp `liberatedAt`.\n */\nexport async function saveDeedMarker(\n  store: NoydbStore,\n  vault: string,\n  marker: DeedMarker,\n): Promise<void> {\n  const persisted: DeedEnvelopePayload = { _noydb_deed: 1, ...marker }\n  const prior = await store.get(vault, '_meta', DEED_RECORD_ID)\n  const env = buildRecordEnvelope(\n    { collection: '_meta', id: DEED_RECORD_ID, version: (prior?._v ?? 0) + 1 },\n    // AES-GCM bypassed — the marker is plaintext audit metadata.\n    { iv: '', data: JSON.stringify(persisted) },\n  )\n  await store.put(vault, '_meta', DEED_RECORD_ID, env)\n}\n","/**\n * `liberateVault` — the audited claim of ownership over a\n * sealed-owner (Deed) vault. The inverse of withdrawal.\n *\n * A **Deed** vault's owner credential is sealed under a non-firm provider, so\n * the firm-side **custodian** (which holds every collection DEK and operates\n * the vault fully) can never reach `KEK_owner`. Liberation is the ONLY route\n * by which a custodian assumes ownership, and it is deliberately a manual,\n * audited ceremony:\n *\n *   1. gate `'liberate-vault'` (fail-closed)\n *   2. caller MUST be the `custodian` (the de-facto authority holding the DEKs)\n *   3. freeze a PRE-liberation EVIDENCE snapshot (hash-pinned in the ledger) —\n *      but PRESERVE the live data for the new owner (see the freeze decision\n *      below)\n *   4. mint a NEW owner keyring re-wrapping the incumbent DEKs under the new\n *      owner's KEK\n *   5. lifecycle ledger `liberation-claimed:<newOwnerId>:<legalBasis>`\n *   6. stamp the `_meta/deed` marker with `liberatedAt`\n *\n * ## Security: the inalienability floor\n *\n * Liberation **mints a new owner from the custodian's DEKs** — it does NOT\n * unseal the original sealed owner. The old sealed-owner credential is left\n * untouched and ORPHANED (its `_keyring/<id>` file remains, its KEK is still\n * sealed under the non-firm provider), never impersonated. The new owner is a\n * DISTINCT principal under a fresh KEK derived from `newOwnerSecret`. This\n * preserves the inalienability floor: the act of claiming ownership is itself\n * auditable and produces a different principal, rather than silently assuming\n * the latent owner's identity.\n *\n * ## Freeze decision: snapshot-only, not freeze-and-delete\n *\n * `freezeAndDeleteClosure` (withdraw-accessible.ts) writes a hash-pinned\n * snapshot and THEN delete-closures the live records — correct for a\n * destructive withdrawal, WRONG for liberation. Liberation transfers\n * operational continuity; it must leave the live data intact for the new\n * owner. We therefore call the snapshot-only core `freezeSnapshotOnly`\n * (factored out of that module; the freeze-AND-delete withdrawal path is\n * unchanged) to pin the evidence snapshot while preserving the records.\n *\n * @module\n */\n\nimport type { Vault } from '../../kernel/vault.js'\nimport type { FactorProofBundle, KeyringFile } from '../../kernel/types.js'\nimport { PermissionDeniedError } from '../../kernel/errors.js'\nimport { wrapKey } from '../../kernel/enclave/index.js'\nimport { createOwnerKeyring } from '../team/keyring.js'\nimport type { FrozenSnapshotRef } from '../../with-audit/portability/withdraw-accessible.js'\nimport { freezeSnapshotOnly } from '../../with-audit/portability/withdraw-accessible.js'\nimport { loadDeedMarker, saveDeedMarker } from '../team/deed.js'\n\nexport interface LiberateOptions {\n  /** The id of the new owner principal the custodian mints by claiming ownership. */\n  readonly newOwnerId: string\n  /** The secret that derives the new owner's KEK (the DEKs are re-wrapped under it). */\n  readonly newOwnerSecret: string\n  /** Legal/contractual basis recorded in the audit (e.g. 'contractual-handover'). */\n  readonly legalBasis: string\n  readonly factors?: FactorProofBundle\n}\n\nexport interface LiberateResult {\n  /** The hash-pinned pre-liberation evidence snapshot. */\n  readonly snapshot: FrozenSnapshotRef\n}\n\n/**\n * Audited claim of ownership over a sealed-owner vault by its custodian. See\n * the module doc for the full ceremony + security rationale.\n */\nexport async function liberateVault(\n  vault: Vault,\n  opts: LiberateOptions,\n): Promise<LiberateResult> {\n  // 1. gate — fail-closed `liberate-vault`.\n  await vault.noydb.checkGate(vault.name, 'liberate-vault', opts.factors)\n\n  // 2. caller must be the custodian (the de-facto authority holding the DEKs).\n  const { name: vaultName, adapter, keyring } = vault._introspectState()\n  if (keyring.role !== 'custodian') {\n    throw new PermissionDeniedError(\n      'liberation is claimed only by the custodian (the de-facto authority holding the DEKs)',\n    )\n  }\n\n  // Refuse to clobber an existing principal: the new owner must be a FRESH id.\n  // (Checked before any side effect so a colliding id never leaves a half-run\n  //  ceremony — no orphan snapshot, no partial keyring overwrite.)\n  const existing = await adapter.get(vaultName, '_keyring', opts.newOwnerId)\n  if (existing) {\n    throw new PermissionDeniedError(\n      `liberateVault: newOwnerId \"${opts.newOwnerId}\" already exists as a principal; choose a fresh id (liberation mints a distinct owner, it never overwrites an existing keyring)`,\n    )\n  }\n\n  // 3. Pre-liberation EVIDENCE snapshot of every operational collection —\n  //    snapshot-only (live data preserved for the new owner; liberation\n  //    transfers operational continuity, it does not erase).\n  const collections = await listOperationalCollections(vault)\n  const snapshot = await freezeSnapshotOnly(vault, collections, { actorUserId: keyring.userId })\n\n  // 4. Mint a NEW owner keyring, re-wrapping the incumbent DEKs under the new\n  //    owner's fresh KEK. The old sealed owner is NOT unsealed — a DISTINCT\n  //    principal is minted and the original owner credential is left orphaned\n  //    (inalienability floor). Mirrors adopt-partition.ts's DEK re-wrap.\n  const newOwner = await createOwnerKeyring(adapter, vaultName, { userId: opts.newOwnerId, secret: opts.newOwnerSecret })\n  if (!newOwner.kek) {\n    throw new PermissionDeniedError(\n      `new owner keyring for \"${opts.newOwnerId}\" has no KEK to re-wrap the incumbent DEKs under`,\n    )\n  }\n  const env = await adapter.get(vaultName, '_keyring', opts.newOwnerId)\n  if (!env) {\n    throw new PermissionDeniedError(`new owner keyring for \"${opts.newOwnerId}\" did not persist`)\n  }\n  const keyringFile = JSON.parse(env._data) as KeyringFile\n  const mergedDeks: Record<string, string> = { ...keyringFile.deks }\n  for (const [collection, dek] of keyring.deks) {\n    mergedDeks[collection] = await wrapKey(dek, newOwner.kek)\n  }\n  const mergedFile: KeyringFile = { ...keyringFile, deks: mergedDeks }\n  await adapter.put(vaultName, '_keyring', opts.newOwnerId, { ...env, _data: JSON.stringify(mergedFile) })\n\n  // 5. Lifecycle ledger audit (no-op if the history strategy is absent).\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: opts.newOwnerId, payloadHash: '',\n    reason: `liberation-claimed:${opts.newOwnerId}:${opts.legalBasis}`,\n  })\n\n  // 6. Stamp the Deed marker with `liberatedAt` (if a marker exists).\n  const marker = await loadDeedMarker(adapter, vaultName)\n  if (marker) {\n    await saveDeedMarker(adapter, vaultName, { ...marker, liberatedAt: new Date().toISOString() })\n  }\n\n  return { snapshot }\n}\n\n/**\n * Enumerate the vault's operational (user-facing) collections — those carried\n * by the caller's keyring DEK map, minus the reserved internal collections\n * (`_*`). These are the collections frozen into the evidence snapshot.\n */\nasync function listOperationalCollections(vault: Vault): Promise<readonly string[]> {\n  const { keyring } = vault._introspectState()\n  return [...keyring.deks.keys()].filter((c) => !c.startsWith('_'))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAuCO,IAAM,iBAAiB;AAqD9B,eAAsB,gBACpB,OACA,OACA,aACA,SAC0B;AAG1B,QAAM,SAAS,MAAM,qBAAqB,OAAO,OAAO,OAAO;AAI/D,QAAM,UAAU,MAAM,mBAAmB,OAAO,OAAO,EAAE,QAAQ,aAAa,OAAe,CAAC;AAI9F,QAAM,eAAe,OAAO,OAAO;AAAA,IACjC;AAAA,IACA,aAAa,QAAQ;AAAA,IACrB,QAAQ;AAAA,IACR,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnC,CAAC;AAED,SAAO;AACT;AAOA,eAAsB,eACpB,OACA,OAC4B;AAC5B,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,cAAc;AAC/D,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,SAAS,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,YAAY,YAAY,KAAM,QAAO;AAC5D,QAAM,IAAI;AACV,MAAI,EAAE,gBAAgB,EAAG,QAAO;AAChC,MACE,OAAO,EAAE,gBAAgB,YACtB,OAAO,EAAE,gBAAgB,YACzB,EAAE,WAAW,QACb,OAAO,EAAE,aAAa,UACzB;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAqB;AAAA,IACzB,aAAa,EAAE;AAAA,IACf,aAAa,EAAE;AAAA,IACf,QAAQ;AAAA,IACR,UAAU,EAAE;AAAA,IACZ,GAAI,OAAO,EAAE,gBAAgB,WAAW,EAAE,aAAa,EAAE,YAAY,IAAI,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAGA,eAAsB,YACpB,OACA,OACkB;AAClB,SAAQ,MAAM,eAAe,OAAO,KAAK,MAAO;AAClD;AAaA,eAAsB,eACpB,OACA,OACA,QACe;AACf,QAAM,YAAiC,EAAE,aAAa,GAAG,GAAG,OAAO;AACnE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,cAAc;AAC5D,QAAM,MAAM;AAAA,IACV,EAAE,YAAY,SAAS,IAAI,gBAAgB,UAAU,OAAO,MAAM,KAAK,EAAE;AAAA;AAAA,IAEzE,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,SAAS,EAAE;AAAA,EAC5C;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,gBAAgB,GAAG;AACrD;;;ACpHA,eAAsB,cACpB,OACA,MACyB;AAEzB,QAAM,MAAM,MAAM,UAAU,MAAM,MAAM,kBAAkB,KAAK,OAAO;AAGtE,QAAM,EAAE,MAAM,WAAW,SAAS,QAAQ,IAAI,MAAM,iBAAiB;AACrE,MAAI,QAAQ,SAAS,aAAa;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAKA,QAAM,WAAW,MAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,UAAU;AACzE,MAAI,UAAU;AACZ,UAAM,IAAI;AAAA,MACR,8BAA8B,KAAK,UAAU;AAAA,IAC/C;AAAA,EACF;AAKA,QAAM,cAAc,MAAM,2BAA2B,KAAK;AAC1D,QAAM,WAAW,MAAM,mBAAmB,OAAO,aAAa,EAAE,aAAa,QAAQ,OAAO,CAAC;AAM7F,QAAM,WAAW,MAAM,mBAAmB,SAAS,WAAW,EAAE,QAAQ,KAAK,YAAY,QAAQ,KAAK,eAAe,CAAC;AACtH,MAAI,CAAC,SAAS,KAAK;AACjB,UAAM,IAAI;AAAA,MACR,0BAA0B,KAAK,UAAU;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,UAAU;AACpE,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,sBAAsB,0BAA0B,KAAK,UAAU,mBAAmB;AAAA,EAC9F;AACA,QAAM,cAAc,KAAK,MAAM,IAAI,KAAK;AACxC,QAAM,aAAqC,EAAE,GAAG,YAAY,KAAK;AACjE,aAAW,CAAC,YAAY,GAAG,KAAK,QAAQ,MAAM;AAC5C,eAAW,UAAU,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AAAA,EAC1D;AACA,QAAM,aAA0B,EAAE,GAAG,aAAa,MAAM,WAAW;AACnE,QAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,YAAY,EAAE,GAAG,KAAK,OAAO,KAAK,UAAU,UAAU,EAAE,CAAC;AAGvG,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,KAAK;AAAA,IAAY,aAAa;AAAA,IAC1F,QAAQ,sBAAsB,KAAK,UAAU,IAAI,KAAK,UAAU;AAAA,EAClE,CAAC;AAGD,QAAM,SAAS,MAAM,eAAe,SAAS,SAAS;AACtD,MAAI,QAAQ;AACV,UAAM,eAAe,SAAS,WAAW,EAAE,GAAG,QAAQ,cAAa,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,EAC/F;AAEA,SAAO,EAAE,SAAS;AACpB;AAOA,eAAe,2BAA2B,OAA0C;AAClF,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAC3C,SAAO,CAAC,GAAG,QAAQ,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AAClE;","names":[]}
+{"version":3,"sources":["../src/with-party/team/deed.ts","../src/with-party/custody/liberate.ts"],"sourcesContent":["/**\n * FR-6 — Deed: sealed / hidden-owner provisioning.\n *\n * A **Deed** is a vault owned by a *latent* principal who never\n * authenticates. The owner credential (the random secret that\n * derives `KEK_owner`) is minted machine-side and sealed under a\n * **non-firm** {@link SealingKeyProvider} — that sealing boundary is\n * the cryptographic *inalienability anchor*: whoever holds the\n * provider (the client / their KMS) is the only party that can ever\n * re-derive `KEK_owner`. A firm-side custodian operates the vault\n * fully but can never reach the owner key — there is deliberately NO\n * firm-controlled fallback.\n *\n * Provisioning reuses the managed-mode seam:\n *   - {@link resolveManagedSecret} mints + seals + persists the random\n *     secret at `_meta/sealed-secret` (and unseals it on every\n *     subsequent open through the same provider).\n *   - {@link createOwnerKeyring} derives `KEK_owner` from that\n *     secret and writes the `_keyring/<ownerUserId>` file.\n *\n * On top of that, a Deed writes a `_meta/deed` **marker**. The marker\n * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH\n * sealing boundary protects them, so it must be readable without\n * unlocking the vault (a custodian or auditor inspecting the vault must\n * be able to see \"this is a Deed vault, owner = X, sealed under Y\"\n * without any key). The marker itself is therefore never sealed; only\n * the owner *credential* is.\n *\n * @module\n */\n\nimport { buildRecordEnvelope } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { UnlockedKeyring } from './keyring.js'\nimport { createOwnerKeyring } from './keyring.js'\nimport type { SealingKeyProvider } from './managed-secret.js'\nimport { resolveManagedSecret } from './managed-secret.js'\n\n/** Reserved id for the Deed marker under `_meta`. */\nexport const DEED_RECORD_ID = 'deed' as const\n\n/**\n * Plaintext metadata recording a vault's latent-owner Deed. Persisted\n * at `_meta/deed`. Readable without unlocking the vault by design — it\n * carries no secret material, only the identity of the latent owner\n * and the sealing boundary that anchors inalienability.\n */\nexport interface DeedMarker {\n  /** The latent owner principal — the user id of the `_keyring/<id>` owner file. */\n  readonly ownerUserId: string\n  /**\n   * The `SealingKeyProvider.id` the owner credential is sealed under.\n   * The inalienability anchor: only the holder of this (non-firm)\n   * provider can re-derive `KEK_owner`. Audit metadata — never secret.\n   */\n  readonly sealedUnder: string\n  /** Always `true` for a Deed — the owner never authenticates interactively. */\n  readonly latent: true\n  /** ISO-8601 timestamp the Deed was issued. */\n  readonly issuedAt: string\n  /**\n   * ISO-8601 timestamp the vault was liberated (a new owner claimed it\n   * via the audited Liberate ceremony), if any. Absent until liberation.\n   */\n  readonly liberatedAt?: string\n}\n\n/**\n * Wire-format payload stored inside the `_meta/deed` envelope. Carries\n * a magic marker for forensics + the {@link DeedMarker} fields. JSON,\n * AES-GCM bypassed (the marker is plaintext metadata by design).\n */\ninterface DeedEnvelopePayload extends DeedMarker {\n  readonly _noydb_deed: 1\n}\n\n/**\n * Provision a Deed: a latent owner whose credential is sealed under\n * `sealing` (a NON-firm provider). Mints + seals the owner secret\n * via {@link resolveManagedSecret}, derives the owner keyring via\n * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`\n * marker. Returns the unlocked owner keyring.\n *\n * The returned keyring is the only in-memory window onto `KEK_owner`\n * for this call; the persistent re-entry point is the sealing provider\n * (re-run {@link resolveManagedSecret} with the same provider to\n * re-resolve the secret, then {@link createOwnerKeyring}/load to\n * unlock — no interactive secret is ever required).\n *\n * There is deliberately no firm-controlled fallback: the marker's\n * `sealedUnder` is the single cryptographic anchor of ownership.\n */\nexport async function createDeedOwner(\n  store: NoydbStore,\n  vault: string,\n  ownerUserId: string,\n  sealing: SealingKeyProvider,\n): Promise<UnlockedKeyring> {\n  // 1. Mint + seal + persist the random owner secret under the\n  //    non-firm provider (writes _meta/sealed-secret).\n  const secret = await resolveManagedSecret(store, vault, sealing)\n\n  // 2. Derive KEK_owner from the (never-human-seen) secret and\n  //    write the owner keyring file.\n  const keyring = await createOwnerKeyring(store, vault, { userId: ownerUserId, secret: secret })\n\n  // 3. Write the plaintext Deed marker. NOT sealed — it is audit\n  //    metadata that must be readable without unlocking.\n  await saveDeedMarker(store, vault, {\n    ownerUserId,\n    sealedUnder: sealing.id,\n    latent: true,\n    issuedAt: new Date().toISOString(),\n  })\n\n  return keyring\n}\n\n/**\n * Read the {@link DeedMarker} from `_meta/deed`, or `null` if the vault\n * has no Deed marker (i.e. it is not a Deed vault). Plaintext read — no\n * unlocking required.\n */\nexport async function loadDeedMarker(\n  store: NoydbStore,\n  vault: string,\n): Promise<DeedMarker | null> {\n  const envelope = await store.get(vault, '_meta', DEED_RECORD_ID)\n  if (!envelope) return null\n  let payload: unknown\n  try {\n    payload = JSON.parse(envelope._data)\n  } catch {\n    return null\n  }\n  if (typeof payload !== 'object' || payload === null) return null\n  const r = payload as Record<string, unknown>\n  if (r._noydb_deed !== 1) return null\n  if (\n    typeof r.ownerUserId !== 'string'\n    || typeof r.sealedUnder !== 'string'\n    || r.latent !== true\n    || typeof r.issuedAt !== 'string'\n  ) {\n    return null\n  }\n  const marker: DeedMarker = {\n    ownerUserId: r.ownerUserId,\n    sealedUnder: r.sealedUnder,\n    latent: true,\n    issuedAt: r.issuedAt,\n    ...(typeof r.liberatedAt === 'string' ? { liberatedAt: r.liberatedAt } : {}),\n  }\n  return marker\n}\n\n/** Whether `vault` carries a Deed marker (a sealed/latent owner). */\nexport async function isDeedVault(\n  store: NoydbStore,\n  vault: string,\n): Promise<boolean> {\n  return (await loadDeedMarker(store, vault)) !== null\n}\n\n/**\n * Persist a {@link DeedMarker} at `_meta/deed`. Mirrors\n * `saveSealedSecret`'s envelope shape: a standard\n * {@link EncryptedEnvelope} with AES-GCM bypassed (`_iv: ''`), the\n * payload stored as plaintext JSON in `_data`. The marker is metadata,\n * not a secret — sealing it would defeat its purpose (auditors /\n * custodians must read it without a key).\n *\n * @internal — used by `createDeedOwner` and (later) the Liberate\n * ceremony to stamp `liberatedAt`.\n */\nexport async function saveDeedMarker(\n  store: NoydbStore,\n  vault: string,\n  marker: DeedMarker,\n): Promise<void> {\n  const persisted: DeedEnvelopePayload = { _noydb_deed: 1, ...marker }\n  const prior = await store.get(vault, '_meta', DEED_RECORD_ID)\n  const env = buildRecordEnvelope(\n    { collection: '_meta', id: DEED_RECORD_ID, version: (prior?._v ?? 0) + 1 },\n    // AES-GCM bypassed — the marker is plaintext audit metadata.\n    { iv: '', data: JSON.stringify(persisted) },\n  )\n  await store.put(vault, '_meta', DEED_RECORD_ID, env)\n}\n","/**\n * `liberateVault` — the audited claim of ownership over a\n * sealed-owner (Deed) vault. The inverse of withdrawal.\n *\n * A **Deed** vault's owner credential is sealed under a non-firm provider, so\n * the firm-side **custodian** (which holds every collection DEK and operates\n * the vault fully) can never reach `KEK_owner`. Liberation is the ONLY route\n * by which a custodian assumes ownership, and it is deliberately a manual,\n * audited ceremony:\n *\n *   1. gate `'liberate-vault'` (fail-closed)\n *   2. caller MUST be the `custodian` (the de-facto authority holding the DEKs)\n *   3. freeze a PRE-liberation EVIDENCE snapshot (hash-pinned in the ledger) —\n *      but PRESERVE the live data for the new owner (see the freeze decision\n *      below)\n *   4. mint a NEW owner keyring re-wrapping the incumbent DEKs under the new\n *      owner's KEK\n *   5. lifecycle ledger `liberation-claimed:<newOwnerId>:<legalBasis>`\n *   6. stamp the `_meta/deed` marker with `liberatedAt`\n *\n * ## Security: the inalienability floor\n *\n * Liberation **mints a new owner from the custodian's DEKs** — it does NOT\n * unseal the original sealed owner. The old sealed-owner credential is left\n * untouched and ORPHANED (its `_keyring/<id>` file remains, its KEK is still\n * sealed under the non-firm provider), never impersonated. The new owner is a\n * DISTINCT principal under a fresh KEK derived from `newOwnerSecret`. This\n * preserves the inalienability floor: the act of claiming ownership is itself\n * auditable and produces a different principal, rather than silently assuming\n * the latent owner's identity.\n *\n * ## Freeze decision: snapshot-only, not freeze-and-delete\n *\n * `freezeAndDeleteClosure` (withdraw-accessible.ts) writes a hash-pinned\n * snapshot and THEN delete-closures the live records — correct for a\n * destructive withdrawal, WRONG for liberation. Liberation transfers\n * operational continuity; it must leave the live data intact for the new\n * owner. We therefore call the snapshot-only core `freezeSnapshotOnly`\n * (factored out of that module; the freeze-AND-delete withdrawal path is\n * unchanged) to pin the evidence snapshot while preserving the records.\n *\n * @module\n */\n\nimport type { Vault } from '../../kernel/vault.js'\nimport type { FactorProofBundle, KeyringFile } from '../../kernel/types.js'\nimport { PermissionDeniedError } from '../../kernel/errors.js'\nimport { wrapKey } from '../../kernel/enclave/index.js'\nimport { createOwnerKeyring, requireRosterKey } from '../team/keyring.js'\nimport { mintRosterTag, assertRosterTagValid } from '../team/roster-tag.js'\nimport type { FrozenSnapshotRef } from '../../with-audit/portability/withdraw-accessible.js'\nimport { freezeSnapshotOnly } from '../../with-audit/portability/withdraw-accessible.js'\nimport { loadDeedMarker, saveDeedMarker } from '../team/deed.js'\n\nexport interface LiberateOptions {\n  /** The id of the new owner principal the custodian mints by claiming ownership. */\n  readonly newOwnerId: string\n  /** The secret that derives the new owner's KEK (the DEKs are re-wrapped under it). */\n  readonly newOwnerSecret: string\n  /** Legal/contractual basis recorded in the audit (e.g. 'contractual-handover'). */\n  readonly legalBasis: string\n  readonly factors?: FactorProofBundle\n}\n\nexport interface LiberateResult {\n  /** The hash-pinned pre-liberation evidence snapshot. */\n  readonly snapshot: FrozenSnapshotRef\n}\n\n/**\n * Audited claim of ownership over a sealed-owner vault by its custodian. See\n * the module doc for the full ceremony + security rationale.\n */\nexport async function liberateVault(\n  vault: Vault,\n  opts: LiberateOptions,\n): Promise<LiberateResult> {\n  // 1. gate — fail-closed `liberate-vault`.\n  await vault.noydb.checkGate(vault.name, 'liberate-vault', opts.factors)\n\n  // 2. caller must be the custodian (the de-facto authority holding the DEKs).\n  const { name: vaultName, adapter, keyring } = vault._introspectState()\n  if (keyring.role !== 'custodian') {\n    throw new PermissionDeniedError(\n      'liberation is claimed only by the custodian (the de-facto authority holding the DEKs)',\n    )\n  }\n\n  // Refuse to clobber an existing principal: the new owner must be a FRESH id.\n  // (Checked before any side effect so a colliding id never leaves a half-run\n  //  ceremony — no orphan snapshot, no partial keyring overwrite.)\n  const existing = await adapter.get(vaultName, '_keyring', opts.newOwnerId)\n  if (existing) {\n    throw new PermissionDeniedError(\n      `liberateVault: newOwnerId \"${opts.newOwnerId}\" already exists as a principal; choose a fresh id (liberation mints a distinct owner, it never overwrites an existing keyring)`,\n    )\n  }\n\n  // 3. Pre-liberation EVIDENCE snapshot of every operational collection —\n  //    snapshot-only (live data preserved for the new owner; liberation\n  //    transfers operational continuity, it does not erase).\n  const collections = await listOperationalCollections(vault)\n  const snapshot = await freezeSnapshotOnly(vault, collections, { actorUserId: keyring.userId })\n\n  // 4. Mint a NEW owner keyring, re-wrapping the incumbent DEKs under the new\n  //    owner's fresh KEK. The old sealed owner is NOT unsealed — a DISTINCT\n  //    principal is minted and the original owner credential is left orphaned\n  //    (inalienability floor). Mirrors adopt-partition.ts's DEK re-wrap.\n  const newOwner = await createOwnerKeyring(adapter, vaultName, { userId: opts.newOwnerId, secret: opts.newOwnerSecret })\n  if (!newOwner.kek) {\n    throw new PermissionDeniedError(\n      `new owner keyring for \"${opts.newOwnerId}\" has no KEK to re-wrap the incumbent DEKs under`,\n    )\n  }\n  const env = await adapter.get(vaultName, '_keyring', opts.newOwnerId)\n  if (!env) {\n    throw new PermissionDeniedError(`new owner keyring for \"${opts.newOwnerId}\" did not persist`)\n  }\n  const keyringFile = JSON.parse(env._data) as KeyringFile\n  // #1096 — this is a read-BACK of the file `createOwnerKeyring` just wrote, and\n  // it is about to be edited and restamped, so the store gets a window to alter\n  // it in between. Verified against the NEW owner's own roster key, not the\n  // incumbent's: at this instant the file is still stamped under the fresh key\n  // minted above (the swap to the incumbent key happens below).\n  const mintedRosterKey = requireRosterKey(newOwner, 'liberateVault')\n  await assertRosterTagValid(keyringFile, mintedRosterKey, opts.newOwnerId)\n  const mergedDeks: Record<string, string> = { ...keyringFile.deks }\n  for (const [collection, dek] of keyring.deks) {\n    mergedDeks[collection] = await wrapKey(dek, newOwner.kek)\n  }\n  // #1096 — liberation joins a new owner to an EXISTING vault, so the vault's\n  // roster key must stay the incumbent one. `createOwnerKeyring` above minted a\n  // fresh roster key (correct for a new vault, wrong here), and the merge loop\n  // has just overwritten `_roster` with the incumbent's — so the tag it stamped\n  // no longer matches the key in the file. Restamp under the key that actually\n  // ends up persisted, or the new owner cannot open the vault they just claimed.\n  //\n  // Keeping the incumbent key is the substantive half: a fresh one would leave\n  // the new owner unable to verify any co-member's roster, and every co-member\n  // unable to verify theirs.\n  const rosterKey = requireRosterKey(keyring, 'liberateVault')\n  const merged: KeyringFile = { ...keyringFile, deks: mergedDeks }\n  const mergedFile: KeyringFile = { ...merged, roster_tag: await mintRosterTag(merged, rosterKey) }\n  await adapter.put(vaultName, '_keyring', opts.newOwnerId, { ...env, _data: JSON.stringify(mergedFile) })\n\n  // 5. Lifecycle ledger audit (no-op if the history strategy is absent).\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: opts.newOwnerId, payloadHash: '',\n    reason: `liberation-claimed:${opts.newOwnerId}:${opts.legalBasis}`,\n  })\n\n  // 6. Stamp the Deed marker with `liberatedAt` (if a marker exists).\n  const marker = await loadDeedMarker(adapter, vaultName)\n  if (marker) {\n    await saveDeedMarker(adapter, vaultName, { ...marker, liberatedAt: new Date().toISOString() })\n  }\n\n  return { snapshot }\n}\n\n/**\n * Enumerate the vault's operational (user-facing) collections — those carried\n * by the caller's keyring DEK map, minus the reserved internal collections\n * (`_*`). These are the collections frozen into the evidence snapshot.\n */\nasync function listOperationalCollections(vault: Vault): Promise<readonly string[]> {\n  const { keyring } = vault._introspectState()\n  return [...keyring.deks.keys()].filter((c) => !c.startsWith('_'))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAuCO,IAAM,iBAAiB;AAqD9B,eAAsB,gBACpB,OACA,OACA,aACA,SAC0B;AAG1B,QAAM,SAAS,MAAM,qBAAqB,OAAO,OAAO,OAAO;AAI/D,QAAM,UAAU,MAAM,mBAAmB,OAAO,OAAO,EAAE,QAAQ,aAAa,OAAe,CAAC;AAI9F,QAAM,eAAe,OAAO,OAAO;AAAA,IACjC;AAAA,IACA,aAAa,QAAQ;AAAA,IACrB,QAAQ;AAAA,IACR,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnC,CAAC;AAED,SAAO;AACT;AAOA,eAAsB,eACpB,OACA,OAC4B;AAC5B,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,cAAc;AAC/D,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,SAAS,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,YAAY,YAAY,KAAM,QAAO;AAC5D,QAAM,IAAI;AACV,MAAI,EAAE,gBAAgB,EAAG,QAAO;AAChC,MACE,OAAO,EAAE,gBAAgB,YACtB,OAAO,EAAE,gBAAgB,YACzB,EAAE,WAAW,QACb,OAAO,EAAE,aAAa,UACzB;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAqB;AAAA,IACzB,aAAa,EAAE;AAAA,IACf,aAAa,EAAE;AAAA,IACf,QAAQ;AAAA,IACR,UAAU,EAAE;AAAA,IACZ,GAAI,OAAO,EAAE,gBAAgB,WAAW,EAAE,aAAa,EAAE,YAAY,IAAI,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAGA,eAAsB,YACpB,OACA,OACkB;AAClB,SAAQ,MAAM,eAAe,OAAO,KAAK,MAAO;AAClD;AAaA,eAAsB,eACpB,OACA,OACA,QACe;AACf,QAAM,YAAiC,EAAE,aAAa,GAAG,GAAG,OAAO;AACnE,QAAM,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,cAAc;AAC5D,QAAM,MAAM;AAAA,IACV,EAAE,YAAY,SAAS,IAAI,gBAAgB,UAAU,OAAO,MAAM,KAAK,EAAE;AAAA;AAAA,IAEzE,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,SAAS,EAAE;AAAA,EAC5C;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,gBAAgB,GAAG;AACrD;;;ACnHA,eAAsB,cACpB,OACA,MACyB;AAEzB,QAAM,MAAM,MAAM,UAAU,MAAM,MAAM,kBAAkB,KAAK,OAAO;AAGtE,QAAM,EAAE,MAAM,WAAW,SAAS,QAAQ,IAAI,MAAM,iBAAiB;AACrE,MAAI,QAAQ,SAAS,aAAa;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAKA,QAAM,WAAW,MAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,UAAU;AACzE,MAAI,UAAU;AACZ,UAAM,IAAI;AAAA,MACR,8BAA8B,KAAK,UAAU;AAAA,IAC/C;AAAA,EACF;AAKA,QAAM,cAAc,MAAM,2BAA2B,KAAK;AAC1D,QAAM,WAAW,MAAM,mBAAmB,OAAO,aAAa,EAAE,aAAa,QAAQ,OAAO,CAAC;AAM7F,QAAM,WAAW,MAAM,mBAAmB,SAAS,WAAW,EAAE,QAAQ,KAAK,YAAY,QAAQ,KAAK,eAAe,CAAC;AACtH,MAAI,CAAC,SAAS,KAAK;AACjB,UAAM,IAAI;AAAA,MACR,0BAA0B,KAAK,UAAU;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,UAAU;AACpE,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,sBAAsB,0BAA0B,KAAK,UAAU,mBAAmB;AAAA,EAC9F;AACA,QAAM,cAAc,KAAK,MAAM,IAAI,KAAK;AAMxC,QAAM,kBAAkB,iBAAiB,UAAU,eAAe;AAClE,QAAM,qBAAqB,aAAa,iBAAiB,KAAK,UAAU;AACxE,QAAM,aAAqC,EAAE,GAAG,YAAY,KAAK;AACjE,aAAW,CAAC,YAAY,GAAG,KAAK,QAAQ,MAAM;AAC5C,eAAW,UAAU,IAAI,MAAM,QAAQ,KAAK,SAAS,GAAG;AAAA,EAC1D;AAWA,QAAM,YAAY,iBAAiB,SAAS,eAAe;AAC3D,QAAM,SAAsB,EAAE,GAAG,aAAa,MAAM,WAAW;AAC/D,QAAM,aAA0B,EAAE,GAAG,QAAQ,YAAY,MAAM,cAAc,QAAQ,SAAS,EAAE;AAChG,QAAM,QAAQ,IAAI,WAAW,YAAY,KAAK,YAAY,EAAE,GAAG,KAAK,OAAO,KAAK,UAAU,UAAU,EAAE,CAAC;AAGvG,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,KAAK;AAAA,IAAY,aAAa;AAAA,IAC1F,QAAQ,sBAAsB,KAAK,UAAU,IAAI,KAAK,UAAU;AAAA,EAClE,CAAC;AAGD,QAAM,SAAS,MAAM,eAAe,SAAS,SAAS;AACtD,MAAI,QAAQ;AACV,UAAM,eAAe,SAAS,WAAW,EAAE,GAAG,QAAQ,cAAa,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,EAC/F;AAEA,SAAO,EAAE,SAAS;AACpB;AAOA,eAAe,2BAA2B,OAA0C;AAClF,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAC3C,SAAO,CAAC,GAAG,QAAQ,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AAClE;","names":[]}

package/dist/{chunk-KM6YR5XF.js → chunk-LLLSK7UQ.js}

@@ -1,6 +1,6 @@
 import {
   BrokerNotEnabledError
-} from "./chunk-P7L3OQLL.js";
+} from "./chunk-PKUJ3JLQ.js";
 
 // src/port/with/broker-strategy.ts
 var NO_BROKER = {
@@ -27,4 +27,4 @@ export {
   NO_BROKER,
   buildCredentialBrokerHandle
 };
-//# sourceMappingURL=chunk-KM6YR5XF.js.map
+//# sourceMappingURL=chunk-LLLSK7UQ.js.map

package/dist/{chunk-QPIUFRUC.js → chunk-M3FKPVOU.js}

@@ -1,11 +1,11 @@
 import {
   loadVaultPolicy,
   saveVaultPolicy
-} from "./chunk-DKYEVHZH.js";
+} from "./chunk-3ENNPCIW.js";
 import {
   PolicyDeniedError,
   ValidationError
-} from "./chunk-P7L3OQLL.js";
+} from "./chunk-PKUJ3JLQ.js";
 
 // src/with-party/policy/presets.ts
 var PERSONAL_POLICY = Object.freeze({
@@ -364,4 +364,4 @@ export {
   describeGate,
   createNoydbPolicy
 };
-//# sourceMappingURL=chunk-QPIUFRUC.js.map
+//# sourceMappingURL=chunk-M3FKPVOU.js.map

package/dist/{chunk-CV7WXCZD.js → chunk-M7VSXBUL.js}

@@ -1,10 +1,10 @@
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-YVTADFTC.js";
+} from "./chunk-JPVJTTHU.js";
 import {
   assemblePodContainer,
   buildExtractedPartitionWrapper
-} from "./chunk-2IK6AC6A.js";
+} from "./chunk-2VMCJUK6.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -12,7 +12,7 @@ import {
   BLOB_INTENT_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-IOURTXTM.js";
+} from "./chunk-PNXJV4OS.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
@@ -23,16 +23,16 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-RNSC2ARR.js";
+} from "./chunk-47F6AI2K.js";
 import {
   buildRecordAad,
   openEnvelopeJson,
   recordAadFor,
   writeEnvelopeBody
-} from "./chunk-D5UDZANO.js";
+} from "./chunk-DIVPOJPV.js";
 import {
   buildRecordEnvelope
-} from "./chunk-ZVAFJQZB.js";
+} from "./chunk-PENPHA45.js";
 import {
   bufferToBase64,
   decrypt,
@@ -42,13 +42,13 @@ import {
   generateDEK,
   unwrapCek,
   wrapCek
-} from "./chunk-VJ4B3ZXY.js";
+} from "./chunk-O5QXH7U7.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-3Y4OFWQJ.js";
+} from "./chunk-IGNJOJEP.js";
 import {
   PartitionExtractionError
-} from "./chunk-P7L3OQLL.js";
+} from "./chunk-PKUJ3JLQ.js";
 
 // src/with-cargo/walk-closure.ts
 async function walkClosure(vault, opts) {
@@ -494,4 +494,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-CV7WXCZD.js.map
+//# sourceMappingURL=chunk-M7VSXBUL.js.map

package/dist/{chunk-APV42WPR.js → chunk-MBZFAJKM.js}

@@ -1,7 +1,7 @@
 import {
   MaterializedViewConfigError,
   ValidationError
-} from "./chunk-P7L3OQLL.js";
+} from "./chunk-PKUJ3JLQ.js";
 
 // src/with-formula/materialized-views/with-materialized-view.ts
 function withMaterializedView(spec) {
@@ -177,4 +177,4 @@ function withMaterializedView(spec) {
 export {
   withMaterializedView
 };
-//# sourceMappingURL=chunk-APV42WPR.js.map
+//# sourceMappingURL=chunk-MBZFAJKM.js.map

package/dist/{chunk-SG3OQCRG.js → chunk-MQFKH3ZJ.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-KHKKD62N.js";
 import {
   derivePersistedSchema
-} from "./chunk-N7YAQKAO.js";
+} from "./chunk-BPLSGN4X.js";
 import {
   loadPersistedSchema
-} from "./chunk-YVTADFTC.js";
+} from "./chunk-JPVJTTHU.js";
 
 // src/with-shape/introspection/walk.ts
 var INTERNAL_PREFIX = "_";
@@ -238,4 +238,4 @@ function summariseAggregateOp(value) {
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=chunk-SG3OQCRG.js.map
+//# sourceMappingURL=chunk-MQFKH3ZJ.js.map

package/dist/{chunk-ZWKF3CD3.js → chunk-NB2CKJ27.js}

@@ -1,6 +1,6 @@
 import {
   AttestationNotEnabledError
-} from "./chunk-P7L3OQLL.js";
+} from "./chunk-PKUJ3JLQ.js";
 
 // src/with-audit/attestation/strategy.ts
 var NO_ATTESTATION = {
@@ -27,4 +27,4 @@ var NO_ATTESTATION = {
 export {
   NO_ATTESTATION
 };
-//# sourceMappingURL=chunk-ZWKF3CD3.js.map
+//# sourceMappingURL=chunk-NB2CKJ27.js.map

package/dist/{chunk-HTHRCGWP.js → chunk-NCAMIRFB.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-P7L3OQLL.js";
+} from "./chunk-PKUJ3JLQ.js";
 
 // src/with-audit/periods/window.ts
 var PERIODS_COLLECTION = "_periods";
@@ -23,4 +23,4 @@ export {
   PERIOD_REOPENS_COLLECTION,
   periodExclusiveUpperBound
 };
-//# sourceMappingURL=chunk-HTHRCGWP.js.map
+//# sourceMappingURL=chunk-NCAMIRFB.js.map

package/dist/{chunk-VH2W6BOG.js → chunk-NHXIFF4Y.js}

@@ -7,28 +7,28 @@ import {
   deriveSchemaManifest,
   loadSchemaManifestEntry,
   saveSchemaManifest
-} from "./chunk-E6VDPBE3.js";
+} from "./chunk-OIW75CLW.js";
 import {
   MANIFEST_COLLECTION
 } from "./chunk-EPFF7LOX.js";
 import {
   loadFence,
   saveFence
-} from "./chunk-HJRTFXAA.js";
+} from "./chunk-FFSQFH6D.js";
 import {
   derivePersistedSchema
-} from "./chunk-N7YAQKAO.js";
+} from "./chunk-BPLSGN4X.js";
 import {
   loadPersistedSchemaEntry,
   savePersistedSchema
-} from "./chunk-YVTADFTC.js";
+} from "./chunk-JPVJTTHU.js";
 import {
   envelopePayloadHash
-} from "./chunk-RNSC2ARR.js";
+} from "./chunk-47F6AI2K.js";
 import {
   ManifestConflictError,
   isConflictError
-} from "./chunk-P7L3OQLL.js";
+} from "./chunk-PKUJ3JLQ.js";
 
 // src/with-shape/persisted-schemas/field-ids.ts
 var BASE32URL_ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
@@ -257,4 +257,4 @@ export {
   persistClassifiedMarker,
   persistSatelliteMarker
 };
-//# sourceMappingURL=chunk-VH2W6BOG.js.map
+//# sourceMappingURL=chunk-NHXIFF4Y.js.map

package/dist/{chunk-IGJCYUT5.js → chunk-NSITFOCJ.js}

@@ -96,4 +96,4 @@ export {
   evaluateClause,
   hasFnClause
 };
-//# sourceMappingURL=chunk-IGJCYUT5.js.map
+//# sourceMappingURL=chunk-NSITFOCJ.js.map

package/dist/chunk-NSITFOCJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kernel/query/predicate.ts"],"sourcesContent":["/**\n * Operator implementations for the query DSL.\n *\n * All predicates run client-side, AFTER decryption — they never see ciphertext.\n * Field clauses over a Via-covered field (e.g. money) carry their own\n * evaluator closure (see {@link FieldClause.via}), so this module has no\n * dependency on any Via feature's implementation — still tree-shakeable.\n */\n\n/** Comparison operators supported by the where() builder. */\nexport type Operator =\n  | '=='\n  | '!='\n  | '<'\n  | '<='\n  | '>'\n  | '>='\n  | 'in'\n  | 'contains'\n  | 'startsWith'\n  | 'between'\n\n/**\n * A single field comparison clause inside a query plan.\n * Plans are JSON-serializable, so this type uses primitives only.\n */\nexport interface FieldClause {\n  readonly type: 'field'\n  readonly field: string\n  readonly op: Operator\n  readonly value: unknown\n  /**\n   * Present when `field` is covered by a Via feature binding (e.g. a\n   * declared money field): the opaque payload built by the binding's\n   * `buildClause` at query BUILD time, plus a closure that evaluates it\n   * per record via the binding's `evaluateClause`. Attached by\n   * `Query.where()` / `ScanBuilder.where()` when `source.via` covers the\n   * field. The closure keeps this module free of any dependency on a\n   * Via feature's implementation — clauses are in-memory only, never\n   * serialized, so carrying a function here is safe.\n   */\n  readonly via?: {\n    readonly brand: string\n    readonly payload: unknown\n    readonly evaluate: (actual: unknown, op: string) => boolean\n    /**\n     * The binding's `indexProbe` result for this clause's op/payload\n     * (#625) — the STORED-form operand `candidateRecords()` (`kernel/\n     * query/builder.ts`) can hand to `CollectionIndexes.lookupEqual`/\n     * `lookupIn` for a fast path. `undefined` (no `indexProbe` hook, or\n     * the binding declined to probe this op) means the field must fall\n     * back to a linear scan via `evaluate` above.\n     */\n    readonly indexValue?: unknown\n  }\n}\n\n/**\n * A user-supplied predicate function escape hatch. Not serializable.\n *\n * The predicate accepts `unknown` at the type level so the surrounding\n * Clause type can stay non-parametric — this keeps Collection<T> covariant\n * in T at the public API surface. Builder methods cast user predicates\n * (typed `(record: T) => boolean`) into this shape on the way in.\n */\nexport interface FilterClause {\n  readonly type: 'filter'\n  readonly fn: (record: unknown) => boolean\n}\n\n/**\n * A declared deterministic predicate reference. The query\n * builder produces this via `.wherePredicate(name, ctx?)` when a\n * Query has been augmented with a predicates map (typically by the\n * materialized-view registry).\n *\n * `predicateHash` is the consumer-supplied stable hash for the\n * function body; `ctxHash` is the canonical-JSON SHA-256 of `ctx`.\n * Both fold into the MV's `queryHash` so a function or ctx change\n * forces refresh on next visit.\n *\n * `fn` is resolved at builder time from the predicates map and\n * embedded directly — so `evaluateClause` can fire it without a\n * runtime lookup.\n */\nexport interface WherePredicateClause {\n  readonly type: 'wherePredicate'\n  readonly name: string\n  readonly ctx: unknown\n  readonly predicateHash: string\n  readonly ctxHash: string\n  readonly fn: (record: unknown, ctx?: unknown) => boolean\n}\n\n/** A logical group of clauses combined by AND or OR. */\nexport interface GroupClause {\n  readonly type: 'group'\n  readonly op: 'and' | 'or'\n  readonly clauses: readonly Clause[]\n}\n\n/**\n * Cartesian-product expansion clause. Appended to `QueryPlan.clauses`\n * by `Query.crossJoin()`. Processed in declaration order by\n * `executeClausePipeline` — NOT by `evaluateClause` (which is a\n * per-record predicate and throws on this type).\n */\nexport interface CrossJoinClause {\n  readonly type: 'crossJoin'\n  /** Target collection name to cross-join against. */\n  readonly target: string\n  /** Alias under which the right-side record is exposed on each result row. */\n  readonly as: string\n  /**\n   * Lateral filter callback. `undefined` → full cartesian product.\n   * Two call shapes:\n   *   - Subset:    `(left) => TTarget[]`            — returns the right rows for this left row\n   *   - Predicate: `(left) => (right) => boolean`   — executor materializes then filters\n   */\n  readonly on?: (left: unknown) => unknown[] | ((right: unknown) => boolean)\n  /** When `on:` was supplied as `{ predicate: name }`, the name is stored here for queryHash. */\n  readonly onPredicateName?: string\n  /** Per-clause row ceiling override. `undefined` → `DEFAULT_CROSS_JOIN_MAX_ROWS`. */\n  readonly maxRows?: number\n  /**\n   * Left-outer mode (#1130). When the `on:` subset for a left row is empty,\n   * emit that row once with `null` under `as` instead of dropping it.\n   *\n   * Applies to both call shapes. With `on:` the empty thing is that left\n   * row's subset; without it, an empty TARGET collection is what would\n   * otherwise drop every left row.\n   */\n  readonly outer?: boolean\n}\n\nexport type Clause = FieldClause | FilterClause | WherePredicateClause | GroupClause | CrossJoinClause\n\n/**\n * Read a possibly nested field path like \"address.city\" from a record.\n * Returns undefined if any segment is missing.\n */\nexport function readPath(record: unknown, path: string): unknown {\n  if (record === null || record === undefined) return undefined\n  if (!path.includes('.')) {\n    return (record as Record<string, unknown>)[path]\n  }\n  const segments = path.split('.')\n  let cursor: unknown = record\n  for (const segment of segments) {\n    if (cursor === null || cursor === undefined) return undefined\n    cursor = (cursor as Record<string, unknown>)[segment]\n  }\n  return cursor\n}\n\n/**\n * Evaluate a single field clause against a record.\n * Returns false on type mismatches rather than throwing — query results\n * exclude non-matching records by definition.\n */\nexport function evaluateFieldClause(record: unknown, clause: FieldClause): boolean {\n  const actual = readPath(record, clause.field)\n  const { op, value } = clause\n\n  // A Via-covered field (e.g. money) may store a transformed\n  // representation (money: BigInt-exact in scaled-integer space) that the\n  // generic paths below can't compare correctly — the operand was\n  // pre-built at query BUILD time and the binding's own evaluator knows\n  // how to compare it against the raw stored value.\n  if (clause.via) return clause.via.evaluate(actual, op)\n\n  switch (op) {\n    case '==':\n      return actual === value\n    case '!=':\n      return actual !== value\n    case '<':\n      return isComparable(actual, value) && (actual as number) < (value as number)\n    case '<=':\n      return isComparable(actual, value) && (actual as number) <= (value as number)\n    case '>':\n      return isComparable(actual, value) && (actual as number) > (value as number)\n    case '>=':\n      return isComparable(actual, value) && (actual as number) >= (value as number)\n    case 'in':\n      return Array.isArray(value) && value.includes(actual)\n    case 'contains':\n      if (typeof actual === 'string') return typeof value === 'string' && actual.includes(value)\n      if (Array.isArray(actual)) return actual.includes(value)\n      return false\n    case 'startsWith':\n      return typeof actual === 'string' && typeof value === 'string' && actual.startsWith(value)\n    case 'between': {\n      if (!Array.isArray(value) || value.length !== 2) return false\n      const [lo, hi] = value\n      if (!isComparable(actual, lo) || !isComparable(actual, hi)) return false\n      return (actual as number) >= (lo as number) && (actual as number) <= (hi as number)\n    }\n    default: {\n      // Exhaustiveness — TS will error if a new operator is added without a case.\n      const _exhaustive: never = op\n      void _exhaustive\n      return false\n    }\n  }\n}\n\n/**\n * Two values are \"comparable\" if they share an order-defined runtime type.\n * Strings compare lexicographically; numbers and Dates numerically; otherwise false.\n */\nfunction isComparable(a: unknown, b: unknown): boolean {\n  if (typeof a === 'number' && typeof b === 'number') return true\n  if (typeof a === 'string' && typeof b === 'string') return true\n  if (a instanceof Date && b instanceof Date) return true\n  return false\n}\n\n/**\n * Evaluate any clause (field / filter / group) against a record.\n * The recursion depth is bounded by the user's query expression — no risk of\n * blowing the stack on a 50K-record collection.\n *\n * `fnRecord`, when provided, is the view handed to USER CALLBACK clauses\n * (`filter` / `wherePredicate`) instead of `record` — the executor passes\n * the money-decoded view there so user code never sees the stored\n * scaled-int form, while field clauses keep evaluating against the raw\n * record (their money operands are pre-quantized to that space).\n */\nexport function evaluateClause(record: unknown, clause: Clause, fnRecord?: unknown): boolean {\n  switch (clause.type) {\n    case 'field':\n      return evaluateFieldClause(record, clause)\n    case 'filter':\n      return clause.fn(fnRecord !== undefined ? fnRecord : record)\n    case 'wherePredicate':\n      return clause.fn(fnRecord !== undefined ? fnRecord : record, clause.ctx)\n    case 'crossJoin':\n      throw new Error(\n        `evaluateClause: 'crossJoin' clauses are expansion primitives and are not ` +\n          `evaluated per-record. This is a query planner routing error — ` +\n          `crossJoin clauses must be extracted from the clause list before calling ` +\n          `evaluateClause or filterRecords.`,\n      )\n    case 'group':\n      if (clause.op === 'and') {\n        for (const child of clause.clauses) {\n          if (!evaluateClause(record, child, fnRecord)) return false\n        }\n        return true\n      } else {\n        for (const child of clause.clauses) {\n          if (evaluateClause(record, child, fnRecord)) return true\n        }\n        return false\n      }\n  }\n}\n\n/**\n * Does the clause list contain any user-callback clause (filter /\n * wherePredicate), at any group nesting depth? Used by executors to\n * decide whether the per-record decoded view needs materializing.\n */\nexport function hasFnClause(clauses: readonly Clause[]): boolean {\n  for (const c of clauses) {\n    if (c.type === 'filter' || c.type === 'wherePredicate') return true\n    if (c.type === 'group' && hasFnClause(c.clauses)) return true\n  }\n  return false\n}\n"],"mappings":";AA6IO,SAAS,SAAS,QAAiB,MAAuB;AAC/D,MAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,MAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AACvB,WAAQ,OAAmC,IAAI;AAAA,EACjD;AACA,QAAM,WAAW,KAAK,MAAM,GAAG;AAC/B,MAAI,SAAkB;AACtB,aAAW,WAAW,UAAU;AAC9B,QAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,aAAU,OAAmC,OAAO;AAAA,EACtD;AACA,SAAO;AACT;AAOO,SAAS,oBAAoB,QAAiB,QAA8B;AACjF,QAAM,SAAS,SAAS,QAAQ,OAAO,KAAK;AAC5C,QAAM,EAAE,IAAI,MAAM,IAAI;AAOtB,MAAI,OAAO,IAAK,QAAO,OAAO,IAAI,SAAS,QAAQ,EAAE;AAErD,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,WAAW;AAAA,IACpB,KAAK;AACH,aAAO,WAAW;AAAA,IACpB,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,SAAqB;AAAA,IAC9D,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,UAAsB;AAAA,IAC/D,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,SAAqB;AAAA,IAC9D,KAAK;AACH,aAAO,aAAa,QAAQ,KAAK,KAAM,UAAsB;AAAA,IAC/D,KAAK;AACH,aAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,MAAM;AAAA,IACtD,KAAK;AACH,UAAI,OAAO,WAAW,SAAU,QAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AACzF,UAAI,MAAM,QAAQ,MAAM,EAAG,QAAO,OAAO,SAAS,KAAK;AACvD,aAAO;AAAA,IACT,KAAK;AACH,aAAO,OAAO,WAAW,YAAY,OAAO,UAAU,YAAY,OAAO,WAAW,KAAK;AAAA,IAC3F,KAAK,WAAW;AACd,UAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,EAAG,QAAO;AACxD,YAAM,CAAC,IAAI,EAAE,IAAI;AACjB,UAAI,CAAC,aAAa,QAAQ,EAAE,KAAK,CAAC,aAAa,QAAQ,EAAE,EAAG,QAAO;AACnE,aAAQ,UAAsB,MAAkB,UAAsB;AAAA,IACxE;AAAA,IACA,SAAS;AAEP,YAAM,cAAqB;AAC3B,WAAK;AACL,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAMA,SAAS,aAAa,GAAY,GAAqB;AACrD,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,MAAI,aAAa,QAAQ,aAAa,KAAM,QAAO;AACnD,SAAO;AACT;AAaO,SAAS,eAAe,QAAiB,QAAgB,UAA6B;AAC3F,UAAQ,OAAO,MAAM;AAAA,IACnB,KAAK;AACH,aAAO,oBAAoB,QAAQ,MAAM;AAAA,IAC3C,KAAK;AACH,aAAO,OAAO,GAAG,aAAa,SAAY,WAAW,MAAM;AAAA,IAC7D,KAAK;AACH,aAAO,OAAO,GAAG,aAAa,SAAY,WAAW,QAAQ,OAAO,GAAG;AAAA,IACzE,KAAK;AACH,YAAM,IAAI;AAAA,QACR;AAAA,MAIF;AAAA,IACF,KAAK;AACH,UAAI,OAAO,OAAO,OAAO;AACvB,mBAAW,SAAS,OAAO,SAAS;AAClC,cAAI,CAAC,eAAe,QAAQ,OAAO,QAAQ,EAAG,QAAO;AAAA,QACvD;AACA,eAAO;AAAA,MACT,OAAO;AACL,mBAAW,SAAS,OAAO,SAAS;AAClC,cAAI,eAAe,QAAQ,OAAO,QAAQ,EAAG,QAAO;AAAA,QACtD;AACA,eAAO;AAAA,MACT;AAAA,EACJ;AACF;AAOO,SAAS,YAAY,SAAqC;AAC/D,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,SAAS,YAAY,EAAE,SAAS,iBAAkB,QAAO;AAC/D,QAAI,EAAE,SAAS,WAAW,YAAY,EAAE,OAAO,EAAG,QAAO;AAAA,EAC3D;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-VJ4B3ZXY.js → chunk-O5QXH7U7.js}

@@ -3,7 +3,7 @@ import {
   InvalidKeyError,
   TamperedError,
   ValidationError
-} from "./chunk-P7L3OQLL.js";
+} from "./chunk-PKUJ3JLQ.js";
 
 // src/kernel/enclave/crypto.ts
 var PBKDF2_ITERATIONS = 6e5;
@@ -439,4 +439,4 @@ export {
   bufferToBase64,
   base64ToBuffer
 };
-//# sourceMappingURL=chunk-VJ4B3ZXY.js.map
+//# sourceMappingURL=chunk-O5QXH7U7.js.map

package/dist/{chunk-MQXYR65M.js → chunk-OBPL43F3.js}

@@ -1,18 +1,18 @@
 import {
   installViaBinder
-} from "./chunk-KDX6VEYV.js";
+} from "./chunk-7JOXCSDU.js";
 import {
   buildRecordAad
-} from "./chunk-D5UDZANO.js";
+} from "./chunk-DIVPOJPV.js";
 import {
   buildRecordEnvelope
-} from "./chunk-ZVAFJQZB.js";
+} from "./chunk-PENPHA45.js";
 import {
   encrypt
-} from "./chunk-VJ4B3ZXY.js";
+} from "./chunk-O5QXH7U7.js";
 import {
   ValidationError
-} from "./chunk-P7L3OQLL.js";
+} from "./chunk-PKUJ3JLQ.js";
 
 // src/via/blob/binding.ts
 async function eraseBlobs(ctx, cfg) {
@@ -391,4 +391,4 @@ export {
   BLOB_EVICTION_AUDIT_COLLECTION,
   runCompaction
 };
-//# sourceMappingURL=chunk-MQXYR65M.js.map
+//# sourceMappingURL=chunk-OBPL43F3.js.map

package/dist/{chunk-HTMQBBF3.js → chunk-OCW3IM2F.js}

@@ -1,9 +1,9 @@
 import {
   dekKey
-} from "./chunk-47ZFULEZ.js";
+} from "./chunk-WUNRUSBJ.js";
 import {
   TierNotGrantedError
-} from "./chunk-P7L3OQLL.js";
+} from "./chunk-PKUJ3JLQ.js";
 
 // src/with-party/team/tiers.ts
 function assertTierAccess(keyring, collection, tier) {
@@ -17,4 +17,4 @@ function assertTierAccess(keyring, collection, tier) {
 export {
   assertTierAccess
 };
-//# sourceMappingURL=chunk-HTMQBBF3.js.map
+//# sourceMappingURL=chunk-OCW3IM2F.js.map

package/dist/{chunk-E6VDPBE3.js → chunk-OIW75CLW.js}

@@ -3,22 +3,22 @@ import {
 } from "./chunk-EPFF7LOX.js";
 import {
   loadFence
-} from "./chunk-HJRTFXAA.js";
+} from "./chunk-FFSQFH6D.js";
 import {
   SCHEMAS_COLLECTION,
   loadPersistedSchema
-} from "./chunk-YVTADFTC.js";
+} from "./chunk-JPVJTTHU.js";
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-RNSC2ARR.js";
+} from "./chunk-47F6AI2K.js";
 import {
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-D5UDZANO.js";
+} from "./chunk-DIVPOJPV.js";
 import {
   buildSealedRecordEnvelope
-} from "./chunk-ZVAFJQZB.js";
+} from "./chunk-PENPHA45.js";
 
 // src/with-shape/manifest/types.ts
 var MANIFEST_SCHEMA_RECORD_ID = "schema";
@@ -86,4 +86,4 @@ export {
   saveSchemaManifest,
   deriveSchemaManifest
 };
-//# sourceMappingURL=chunk-E6VDPBE3.js.map
+//# sourceMappingURL=chunk-OIW75CLW.js.map

package/dist/{chunk-NRNTXBHT.js → chunk-OTHHO3KI.js}

@@ -1,6 +1,6 @@
 import {
   buildRecordEnvelope
-} from "./chunk-ZVAFJQZB.js";
+} from "./chunk-PENPHA45.js";
 
 // src/with-party/team/managed-secret.ts
 var MemorySealingKeyProvider = class {
@@ -224,4 +224,4 @@ export {
   loadSealedSecret,
   resolveManagedSecret
 };
-//# sourceMappingURL=chunk-NRNTXBHT.js.map
+//# sourceMappingURL=chunk-OTHHO3KI.js.map

package/dist/{chunk-4HVTRHSA.js → chunk-OZ5QBLEL.js}

@@ -1,22 +1,22 @@
 import {
   ATTESTATIONS_COLLECTION,
   loadOrCreateSigner
-} from "./chunk-ZBDWKPBW.js";
+} from "./chunk-GWJJ5CK3.js";
 import {
   generateULID
 } from "./chunk-4AOERLTV.js";
 import {
   buildRecordAad
-} from "./chunk-D5UDZANO.js";
+} from "./chunk-DIVPOJPV.js";
 import {
   buildRecordEnvelope
-} from "./chunk-ZVAFJQZB.js";
+} from "./chunk-PENPHA45.js";
 import {
   encrypt
-} from "./chunk-VJ4B3ZXY.js";
+} from "./chunk-O5QXH7U7.js";
 import {
   AttestationError
-} from "./chunk-P7L3OQLL.js";
+} from "./chunk-PKUJ3JLQ.js";
 
 // src/with-audit/attestation/issue.ts
 import {
@@ -63,4 +63,4 @@ async function issueAttestationCore(ctx, args) {
 export {
   issueAttestationCore
 };
-//# sourceMappingURL=chunk-4HVTRHSA.js.map
+//# sourceMappingURL=chunk-OZ5QBLEL.js.map

package/dist/{chunk-ZVAFJQZB.js → chunk-PENPHA45.js}

@@ -1,6 +1,6 @@
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-3Y4OFWQJ.js";
+} from "./chunk-IGNJOJEP.js";
 
 // src/kernel/enclave/record-envelope.ts
 function buildRecordEnvelope(identity, body) {
@@ -63,4 +63,4 @@ export {
   isDeleteMarker,
   buildDeleteMarker
 };
-//# sourceMappingURL=chunk-ZVAFJQZB.js.map
+//# sourceMappingURL=chunk-PENPHA45.js.map

package/dist/{chunk-CVYXIN5B.js → chunk-PGHSH4TY.js}

@@ -4,10 +4,10 @@ import {
   persistUserVisibility,
   readUserVisibility,
   saveUserEnvelope
-} from "./chunk-JHO6FGZX.js";
+} from "./chunk-KMGAFLCK.js";
 import {
   PolicyDeniedError
-} from "./chunk-P7L3OQLL.js";
+} from "./chunk-PKUJ3JLQ.js";
 
 // src/with-party/directory/user-envelope/api.ts
 var UserApi = class {
@@ -379,4 +379,4 @@ export {
   UserApi,
   createUserApi
 };
-//# sourceMappingURL=chunk-CVYXIN5B.js.map
+//# sourceMappingURL=chunk-PGHSH4TY.js.map

package/dist/{chunk-P7L3OQLL.js → chunk-PKUJ3JLQ.js}

@@ -2,6 +2,7 @@
 var STATE_VAULT_NAME = "__noydb_state__";
 var USER_ENVELOPE_MAX_BYTES = 64 * 1024;
 var USER_ENVELOPE_COLLECTION = "_users";
+var ROSTER_KEY_ID = "_roster";
 
 // src/kernel/errors.ts
 var NoydbError = class extends Error {
@@ -76,6 +77,27 @@ var KeyringCorruptError = class extends NoydbError {
     this.intactCount = opts.intactCount;
   }
 };
+function keyringTamperedMessage(userId, reason) {
+  const head = `Keyring for "${userId}" failed roster authentication (${reason}). `;
+  switch (reason) {
+    case "canary-missing":
+    case "roster-key-missing":
+    case "roster-tag-missing":
+      return head + "This vault was most likely written before 0.6.0-pre.21, which is when the roster became authenticated \u2014 that format change ships without a migration, so an existing vault must be re-seeded. The same state is what an untrusted store would produce by deleting the field to escape verification, and the two are indistinguishable from here, so access is refused either way. If this vault has been opened by 0.6.0-pre.21 or later before, treat it as the second case.";
+    case "unparseable":
+      return head + "The file did not parse \u2014 truncation or corruption in transit or at rest is the likeliest cause, and a store serving deliberate garbage is indistinguishable from it. `verifyRoster()` reports which members are affected; `quarantineKeyring()` removes one.";
+    case "roster-tag-mismatch":
+      return head + "The roster tag is present but does not match the authority fields it protects, so those fields were altered after they were signed. Unlike a missing tag this is not a format-transition state \u2014 no released version wrote a mismatched tag \u2014 so the store serving this vault, or something between you and it, has changed a member's role, permissions or expiry.";
+  }
+}
+var KeyringTamperedError = class extends NoydbError {
+  details;
+  constructor(details) {
+    super("KEYRING_TAMPERED", keyringTamperedMessage(details.userId, details.reason));
+    this.name = "KeyringTamperedError";
+    this.details = details;
+  }
+};
 var NoAccessError = class extends NoydbError {
   constructor(message = "No access \u2014 user does not have a key for this collection") {
     super("NO_ACCESS", message);
@@ -1567,6 +1589,7 @@ export {
   STATE_VAULT_NAME,
   USER_ENVELOPE_MAX_BYTES,
   USER_ENVELOPE_COLLECTION,
+  ROSTER_KEY_ID,
   NoydbError,
   DebugPlaintextError,
   DebugReservedFieldError,
@@ -1574,6 +1597,7 @@ export {
   TamperedError,
   InvalidKeyError,
   KeyringCorruptError,
+  KeyringTamperedError,
   NoAccessError,
   ReadOnlyError,
   ReadOnlyAtInstantError,
@@ -1715,4 +1739,4 @@ export {
   ClassifiedRotationError,
   SatelliteConfigError
 };
-//# sourceMappingURL=chunk-P7L3OQLL.js.map
+//# sourceMappingURL=chunk-PKUJ3JLQ.js.map