@noy-db/hub 0.6.0-pre.9 → 0.7.0-pre.0

package/dist/with-party/team/deed.d.ts

@@ -4,7 +4,7 @@
  * A **Deed** is a vault owned by a *latent* principal who never
  * authenticates. The owner credential (the random secret that
  * derives `KEK_owner`) is minted machine-side and sealed under a
- * **non-firm** {@link SealingKeyProvider} — that sealing boundary is
+ * **non-firm** {@link NoydbSealer} — that sealing boundary is
  * the cryptographic *inalienability anchor*: whoever holds the
  * provider (the client / their KMS) is the only party that can ever
  * re-derive `KEK_owner`. A firm-side custodian operates the vault
@@ -30,7 +30,7 @@
  */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { UnlockedKeyring } from './keyring.js';
-import type { SealingKeyProvider } from './managed-secret.js';
+import type { NoydbSealer } from './managed-secret.js';
 /** Reserved id for the Deed marker under `_meta`. */
 export declare const DEED_RECORD_ID: "deed";
 /**
@@ -43,7 +43,7 @@ export interface DeedMarker {
     /** The latent owner principal — the user id of the `_keyring/<id>` owner file. */
     readonly ownerUserId: string;
     /**
-     * The `SealingKeyProvider.id` the owner credential is sealed under.
+     * The `NoydbSealer.id` the owner credential is sealed under.
      * The inalienability anchor: only the holder of this (non-firm)
      * provider can re-derive `KEK_owner`. Audit metadata — never secret.
      */
@@ -74,7 +74,7 @@ export interface DeedMarker {
  * There is deliberately no firm-controlled fallback: the marker's
  * `sealedUnder` is the single cryptographic anchor of ownership.
  */
-export declare function createDeedOwner(store: NoydbStore, vault: string, ownerUserId: string, sealing: SealingKeyProvider): Promise<UnlockedKeyring>;
+export declare function createDeedOwner(store: NoydbStore, vault: string, ownerUserId: string, sealing: NoydbSealer): Promise<UnlockedKeyring>;
 /**
  * Read the {@link DeedMarker} from `_meta/deed`, or `null` if the vault
  * has no Deed marker (i.e. it is not a Deed vault). Plaintext read — no

package/dist/with-party/team/device-seal.d.ts

@@ -1,20 +1,20 @@
-import type { DeviceSealProvider } from '../../port/with/device-seal-strategy.js';
+import type { NoydbDeviceSeal } from '../../port/with/device-seal-strategy.js';
 /**
  * Device-local sealer for the echo reveal-blob (spec decision 5).
- * DISTINCT from `SealingKeyProvider` (managed-secret mode, which seals
+ * DISTINCT from `NoydbSealer` (managed-secret mode, which seals
  * the WHOLE secret): this seals only the echo part, and only so an
  * enrolled device can display it during the unlock ceremony. The
  * sealed bytes may sit in the (untrusted) keyring file — attacker-B
  * resistance comes from `unseal` requiring this device's key store.
  *
  * The interface itself is declared on the `/with` port
- * ({@link DeviceSealProvider} from `port/with/device-seal-strategy.js`)
+ * ({@link NoydbDeviceSeal} from `port/with/device-seal-strategy.js`)
  * so the kernel spine can reference it without a static spine→service
  * import; re-exported here as the canonical consumer-facing home.
  */
-export type { DeviceSealProvider };
+export type { NoydbDeviceSeal };
 /** In-memory test provider — AES-GCM under a per-instance random key. */
-export declare class MemoryDeviceSealProvider implements DeviceSealProvider {
+export declare class MemoryDeviceSeal implements NoydbDeviceSeal {
     readonly id: string;
     private readonly keyPromise;
     constructor(opts: {

package/dist/with-party/team/echo-ceremony.d.ts

@@ -15,13 +15,13 @@
  * @module
  */
 import type { NoydbStore } from '../../kernel/types.js';
-import type { DeviceSealProvider } from './device-seal.js';
+import type { NoydbDeviceSeal } from './device-seal.js';
 import { type UnlockedKeyring } from './keyring.js';
 /** Options for {@link beginEchoUnlock}. */
 export interface BeginEchoUnlockOptions {
     readonly userId: string;
     readonly prompt: string;
-    readonly deviceSeal?: DeviceSealProvider;
+    readonly deviceSeal?: NoydbDeviceSeal;
 }
 /**
  * A prompt-verified, in-progress echo unlock. Stateless w.r.t. attempts —

package/dist/with-party/team/echo-secret.d.ts

@@ -11,7 +11,7 @@
  *   - Building the reveal blob per the hybrid reveal policy (spec decision
  *     4): `portable` (AES-GCM under the prompt, own salt), `sealed`
  *     (opaque to hub, unsealed only by the enrolling device's
- *     {@link DeviceSealProvider}), or `none`.
+ *     {@link NoydbDeviceSeal}), or `none`.
  *   - Resolving the echo for display (`resolveEchoReveal`, `null` ⇒
  *     degraded typed-echo path) and verifying a typed echo
  *     (`verifyTypedEcho`) for that degraded path.
@@ -30,14 +30,14 @@
  */
 import { type EchoSecretParts } from '../../kernel/enclave/index.js';
 import type { KeyringEchoBlock } from '../../kernel/types.js';
-import type { DeviceSealProvider } from './device-seal.js';
+import type { NoydbDeviceSeal } from './device-seal.js';
 /** Same iteration floor as the KEK (spec resolved question 1). */
 export declare const ECHO_KDF_ITERATIONS = 600000;
 export type EchoRevealChoice = {
     readonly kind: 'portable';
 } | {
     readonly kind: 'sealed';
-    readonly deviceSeal: DeviceSealProvider;
+    readonly deviceSeal: NoydbDeviceSeal;
 } | {
     readonly kind: 'none';
 };
@@ -52,5 +52,5 @@ export declare function verifyPrompt(block: KeyringEchoBlock, prompt: string): P
  * @throws WrongPromptError when the prompt cannot open the portable reveal
  * (callers should verifyPrompt first for a boolean check).
  */
-export declare function resolveEchoReveal(block: KeyringEchoBlock, prompt: string, deviceSeal?: DeviceSealProvider): Promise<string | null>;
+export declare function resolveEchoReveal(block: KeyringEchoBlock, prompt: string, deviceSeal?: NoydbDeviceSeal): Promise<string | null>;
 export declare function verifyTypedEcho(block: KeyringEchoBlock, echo: string): Promise<boolean>;

package/dist/with-party/team/index.d.ts

@@ -17,7 +17,7 @@ export { NO_TEAM, type TeamStrategy } from './strategy.js';
 export { TeamNotEnabledError } from '../../kernel/errors.js';
 export type { UnlockedKeyring } from './keyring.js';
 export { loadKeyring, createOwnerKeyring, grant, revoke, changeSecret, listUsers, listUsersWithEnvelopes, ensureCollectionDEK, persistKeyring, updateKeyringIdentity, buildRecipientKeyringFile, } from './keyring.js';
-export type { BundleRecipient, ListUsersOptions } from './keyring.js';
+export type { PodRecipient, ListUsersOptions } from './keyring.js';
 export type { LoadKeyringOptions, CreateOwnerKeyringOptions, RotateKeysOptions, ChangeSecretOptions, } from './keyring.js';
 export { enrollAuthenticator, removeAuthenticator, updateAuthenticator, findAuthenticator, } from './authenticators.js';
 export type { EnrollAuthenticatorOptions, EnrollAuthenticatorWrappingKEKOptions, EnrollAuthenticatorWrappingDEKsOptions, UpdateAuthenticatorOptions, } from './authenticators.js';
@@ -36,8 +36,8 @@ export { buildEchoBlock, verifyPrompt, resolveEchoReveal, verifyTypedEcho, } fro
 export type { EchoRevealChoice } from './echo-secret.js';
 export { beginEchoUnlock } from './echo-ceremony.js';
 export type { BeginEchoUnlockOptions, EchoCeremony } from './echo-ceremony.js';
-export { MemoryDeviceSealProvider } from './device-seal.js';
-export type { DeviceSealProvider } from './device-seal.js';
+export { MemoryDeviceSeal } from './device-seal.js';
+export type { NoydbDeviceSeal } from './device-seal.js';
 export type { EchoSecretParts } from '../../kernel/enclave/index.js';
 export type { KeyringEchoBlock, NoydbStore } from '../../kernel/types.js';
 export { describeAuthConfig, diagramAuthConfig, describeUserAuth, describeAllUsersAuth, } from '../auth-introspection/index.js';

package/dist/with-party/team/keyring.d.ts

@@ -1,7 +1,8 @@
 import type { NoydbStore, KeyringFile, KeyringAuthenticator, Role, Permissions, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, EncryptedEnvelope, ExportCapability, ExportFormat, ImportCapability, VaultPolicyOnDisk, UserEnvelope } from '../../kernel/types.js';
 import { type EnclaveKey, type EchoSecretParts } from '../../kernel/enclave/index.js';
+import type { KeyringTamperedReason } from '../../kernel/errors.js';
 import { type SecretPolicy, type EchoSecretPolicy } from '../../kernel/validation.js';
-import type { DeviceSealProvider } from './device-seal.js';
+import type { NoydbDeviceSeal } from './device-seal.js';
 /** In-memory representation of an unlocked keyring. */
 export interface UnlockedKeyring {
     readonly userId: string;
@@ -9,6 +10,11 @@ export interface UnlockedKeyring {
     readonly role: Role;
     readonly permissions: Permissions;
     readonly deks: Map<string, EnclaveKey>;
+    /**
+     * Unwrapped counterpart of {@link KeyringFile.pending_deks} — an
+     * uncommitted rotation (#1074). Empty in the normal state.
+     */
+    readonly pendingDeks?: Map<string, EnclaveKey> | undefined;
     /**
      * The KEK, when this keyring was unlocked via tier 1 (secret) or
      * a wrap-KEK tier-2 method (WebAuthn / OIDC). `null` when the
@@ -72,6 +78,23 @@ export interface UnlockedKeyring {
 }
 /** Mint a fresh wrapped-canary string. Deterministic for a given KEK. */
 export declare function mintKeyringCanary(kek: EnclaveKey): Promise<string>;
+/**
+ * The vault roster key held by this keyring, or `null` when the keyring
+ * carries none.
+ *
+ * Null is expected on the resume-style paths (`kek: null` sessions, tier-3
+ * PIN resume, plaintext mode) — none of which may write a keyring file.
+ * Every stamping site null-guards this exactly as it guards `kek`: minting a
+ * file without a verifiable `roster_tag` would be worse than refusing, since
+ * it is indistinguishable on the next load from a store having stripped it.
+ */
+export declare function rosterKeyOf(keyring: UnlockedKeyring): EnclaveKey | null;
+/**
+ * Shared wording for the stamping-site guards — mirrors the `kek` guard's shape.
+ * Exported so every roster-stamping site in the hub raises ONE error with one
+ * wording, rather than each hand-copying it (`peer-recover`, `liberate`).
+ */
+export declare function requireRosterKey(keyring: UnlockedKeyring, fn: string): EnclaveKey;
 /** Options for {@link loadKeyring} (#846b). */
 export interface LoadKeyringOptions {
     /** The user whose keyring to unlock. */
@@ -142,7 +165,7 @@ export interface CreateOwnerKeyringOptions extends SecretPolicy {
      * ⇒ `reveal: 'sealed'` (attacker-B resistance); absent ⇒ `reveal:
      * 'portable'` (spec resolved question 4). Ignored for a string secret.
      */
-    readonly deviceSeal?: DeviceSealProvider;
+    readonly deviceSeal?: NoydbDeviceSeal;
     /** Echo enrollment only: optional display hint for the masked echo. */
     readonly echoMaskHint?: string;
     /**
@@ -168,6 +191,100 @@ export declare function createOwnerKeyring(store: NoydbStore, vault: string, opt
 export declare function grant(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions): Promise<void>;
 /** Revoke a user's access. Optionally rotate keys for affected collections. */
 export declare function revoke(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions): Promise<void>;
+/** What {@link verifyRoster} found. */
+export interface RosterVerifyResult {
+    /**
+     * How many `_keyring` files were examined.
+     *
+     * Reported first, and deliberately: "nothing unverified" is equally true of a
+     * sweep that examined nothing, and a roster check that silently covered zero
+     * members would look identical to a healthy vault. Same lesson as the vault
+     * head's `no-expectations` verdict (#1101).
+     */
+    readonly checked: number;
+    /** The files that failed authentication, and why. */
+    readonly unverified: ReadonlyArray<{
+        readonly userId: string;
+        readonly reason: KeyringTamperedReason;
+    }>;
+}
+export declare function verifyRoster(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring): Promise<RosterVerifyResult>;
+/** What {@link quarantineKeyring} did. */
+export interface QuarantineResult {
+    readonly userId: string;
+    /** Why the file could not be authenticated — the justification for removing it. */
+    readonly reason: KeyringTamperedReason;
+    /** Collections re-keyed as part of the removal. */
+    readonly rotated: readonly string[];
+    /**
+     * (member, collection) pairs whose access the rotation dropped — the OTHER
+     * members, who must be re-granted.
+     *
+     * Passed through from `rotateKeys` rather than discarded, because a
+     * quarantine rotates broadly (see the scope note on the function) and so
+     * de-provisions more people than the one being removed. An operator who is
+     * not told this discovers it as unrelated `NoAccessError`s later.
+     */
+    readonly needsRegrant: RotateResult['needsRegrant'];
+    /**
+     * OTHER members whose own files also failed authentication, found while
+     * rotating. One forged file is rarely the only one, and the operator is
+     * already holding the tool for them.
+     */
+    readonly alsoUnverified: RotateResult['unverified'];
+}
+/**
+ * Remove a `_keyring` file that cannot be authenticated, and re-key behind it
+ * (#1121).
+ *
+ * ## Why this is not a flag on `revoke`
+ *
+ * `revoke` reads the target's own `role` to decide whether the caller may
+ * revoke them, so it cannot act on a file it will not trust — which left a
+ * forged file removable only by editing the store by hand. Relaxing `revoke`
+ * conditionally would grow the safe path a parameter that turns it into the
+ * dangerous one; ADR 0003's standing rule is that if the implementation needs
+ * to weaken a guard, the design is wrong. This is a separate operation with its
+ * own contract, so `revoke`'s invariant stays absolute and the dangerous act is
+ * named at the call site rather than hidden in an option bag.
+ *
+ * ## The two properties that keep it from being a backdoor
+ *
+ * 1. **It refuses a file that verifies.** Otherwise it would delete any keyring
+ *    while ignoring `canRevoke` — including an owner's, which `revoke` protects
+ *    unconditionally.
+ * 2. **Because of (1) it can safely ignore the claimed `role` — and it must.**
+ *    `canRevoke` refuses any target whose role reads `owner`, so a store that
+ *    forged `"role":"owner"` onto its victim would otherwise make them
+ *    permanently unremovable. Consulting the forged field is exactly the
+ *    mistake this operation exists to avoid.
+ *
+ * Owner-only: the narrowest role that can always act, and quarantine
+ * deliberately consumes NO field of the file it is removing.
+ *
+ * ## Why it rotates, and why the scope comes from the CALLER
+ *
+ * Deleting the file is not a revocation — the store may decline the delete, and
+ * the member may already hold unwrapped DEKs. So this rotates, exactly as
+ * `revoke` does. The scope is every collection the CALLER holds, not the
+ * target's DEK map: that map is unauthenticated (#1115), so deriving the scope
+ * from it would let the store choose which collections survive a quarantine.
+ *
+ * ⚠️ **That is the security-correct scope, and it is NOT free.** An earlier
+ * draft of this comment called over-rotating "the safe direction"; a review
+ * probe disproved it. Rotation re-keys `store.list(vault, <name>)` plus the
+ * derived refs `rotateKeys` knows about, so a DEK slot whose ciphertext lives
+ * under a *different* collection name — `_blob`, whose data sits in
+ * `_blob_index`/`_blob_chunks`, and the `collection#tier` slots — is re-keyed
+ * without its data being re-encrypted, and that data then fails to open. That
+ * gap belongs to `rotateKeys` (it is reachable through an ordinary `revoke` of
+ * a whole-vault grantee, with no quarantine involved) and is filed as #1122,
+ * but a quarantine takes the maximal scope *unconditionally*, so it meets the
+ * gap every time rather than occasionally. Until that is fixed, treat a
+ * quarantine as an emergency operation with a real blast radius, and read
+ * `needsRegrant` afterwards.
+ */
+export declare function quarantineKeyring(store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, userId: string): Promise<QuarantineResult>;
 /**
  * Mutate `role`, `displayName`, and/or `permissions` on an existing
  * keyring. Pure plaintext-header rewrite — no DEK rewrap, no KEK
@@ -217,6 +334,26 @@ export interface RotateResult {
         readonly userId: string;
         readonly collection: string;
     }>;
+    /**
+     * Members skipped because their `_keyring` file failed roster verification
+     * (#1114).
+     *
+     * Rotation hands a member re-wrapped DEKs, so skipping one gives them
+     * **less**, never more: the file is left untouched and its wrappings for the
+     * rotated collections go stale. That is the same fail-closed end state as
+     * `needsRegrant`, but it needs a different remedy and so gets a different
+     * field — a `needsRegrant` entry is fixed by `grant()`, whereas one of these
+     * is a file that no longer authenticates and cannot be repaired by granting
+     * over it.
+     *
+     * Before this existed, one such file threw and took `revoke` and
+     * `rotateKeys` down vault-wide — the two operations most needed when a
+     * roster is suspect.
+     */
+    readonly unverified: ReadonlyArray<{
+        readonly userId: string;
+        readonly reason: KeyringTamperedReason;
+    }>;
 }
 /** Options for {@link rotateKeys} (#846b — was a bare `string[]`). */
 export interface RotateKeysOptions {
@@ -261,7 +398,7 @@ export interface EchoRecipientSecret extends EchoSecretParts {
  *
  * @public
  */
-export interface BundleRecipient {
+export interface PodRecipient {
     /** User id stamped onto the keyring file in the bundle. */
     readonly id: string;
     /** Optional display name. Defaults to `id`. */
@@ -312,7 +449,7 @@ export interface BundleRecipient {
  *
  * @internal
  */
-export declare function buildRecipientKeyringFile(callerKeyring: UnlockedKeyring, recipient: BundleRecipient): Promise<KeyringFile>;
+export declare function buildRecipientKeyringFile(callerKeyring: UnlockedKeyring, recipient: PodRecipient): Promise<KeyringFile>;
 /** List all users with access to a vault. */
 export declare function listUsers(store: NoydbStore, vault: string): Promise<UserInfo[]>;
 /**

package/dist/with-party/team/managed-secret.d.ts

@@ -3,16 +3,16 @@
  *
  * A vault mode where the secret is machine-generated and never
  * exposed to the user, sealed under a developer-provided
- * {@link SealingKeyProvider} (macOS Keychain, Windows Credential
+ * {@link NoydbSealer} (macOS Keychain, Windows Credential
  * Manager, libsecret, AWS KMS, …). The user has no secret to give
  * up to coercion — they can't reveal what they don't know.
  *
  * ## Components in this file
  *
- *   - {@link SealingKeyProvider} — the interface concrete providers
+ *   - {@link NoydbSealer} — the interface concrete providers
  *     implement. Provider implementations live OUTSIDE hub (per-
  *     platform packages).
- *   - {@link MemorySealingKeyProvider} — in-memory test provider; uses
+ *   - {@link MemorySealer} — in-memory test provider; uses
  *     a deterministic per-instance "key" so two providers with
  *     different ids cannot unseal each other's outputs.
  *   - {@link RecipientHint} — public material a sender uses to seal
@@ -22,10 +22,10 @@
  *   - {@link RecipientSealer} — interface for asymmetric/granted
  *     providers that support recipient-target sealing (RSA-OAEP,
  *     cloud-KMS asymmetric, etc.); distinct from self-only
- *     {@link SealingKeyProvider} (macOS Keychain, WebAuthn-PRF).
+ *     {@link NoydbSealer} (macOS Keychain, WebAuthn-PRF).
  *   - {@link MemoryRecipientSealer} — in-process reference
  *     implementation of both `RecipientSealer` and
- *     `SealingKeyProvider` using real WebCrypto RSA-OAEP + AES-GCM;
+ *     `NoydbSealer` using real WebCrypto RSA-OAEP + AES-GCM;
  *     safe for tests and same-process sender/recipient scenarios.
  *   - {@link loadSealedSecret} / {@link saveSealedSecret} —
  *     plaintext envelope storage at `_meta/sealed-secret`.
@@ -66,7 +66,7 @@ import type { NoydbStore, RecipientSealer } from '../../kernel/types.js';
  * | Linux | `@noy-db/seal-libsecret` | libsecret / secret-service |
  * | Cloud / server | `@noy-db/seal-aws-kms` | AWS KMS Decrypt |
  */
-export interface SealingKeyProvider {
+export interface NoydbSealer {
     /**
      * Non-sensitive identifier disclosed in the persisted envelope.
      * Surfaced to consumers via `loadSealedSecret().providerId` so
@@ -97,13 +97,23 @@ export interface SealingKeyProvider {
  *
  * Replace with a real platform provider in production.
  */
-export declare class MemorySealingKeyProvider implements SealingKeyProvider {
+export declare class MemorySealer implements NoydbSealer {
     readonly id: string;
     private readonly fingerprint;
     private readonly keyBytes;
     constructor(opts: {
         id: string;
     });
+    /**
+     * Deterministic 4-byte integrity tag over the ciphertext, keyed by the
+     * same derived bytes. NOT a MAC and not forgery-resistant — a real
+     * provider authenticates with its backend. It exists because the contract
+     * says `unseal` MUST throw on tamper, and a double that silently returns
+     * corrupted bytes is not modelling the contract it stands in for. Without
+     * it, every managed-mode test ran against a provider that could not fail
+     * the way a real one must (found by @noy-db/test-sealer-conformance).
+     */
+    private tag;
     seal(secret: Uint8Array): Promise<Uint8Array>;
     unseal(sealed: Uint8Array): Promise<Uint8Array>;
 }
@@ -168,7 +178,7 @@ export declare function parseRsaOaepTlv(bytes: Uint8Array): {
  */
 export declare function aesGcmOpen(cekBytes: Uint8Array, iv: Uint8Array, ct: Uint8Array): Promise<Uint8Array>;
 /**
- * Reference implementation of `RecipientSealer` + `SealingKeyProvider`.
+ * Reference implementation of `RecipientSealer` + `NoydbSealer`.
  * Uses WebCrypto RSA-OAEP-SHA256 (2048-bit) to wrap a fresh 32-byte
  * AES-GCM CEK, AES-GCM-encrypts plaintext under it, and packs the
  * result into a self-describing TLV:
@@ -190,7 +200,7 @@ export declare function aesGcmOpen(cekBytes: Uint8Array, iv: Uint8Array, ct: Uin
  * keychain; use it for tests and for shipping bundles where the
  * recipient instance lives in the same process as the sender (rare).
  */
-export declare class MemoryRecipientSealer implements SealingKeyProvider, RecipientSealer {
+export declare class MemoryRecipientSealer implements NoydbSealer, RecipientSealer {
     readonly id: string;
     private readonly keypair;
     constructor(opts: {
@@ -213,7 +223,7 @@ export interface SealedSecret {
 /**
  * Wire-format envelope persisted at `_meta/sealed-secret` for
  * managed-mode vaults. The provider produces raw sealed bytes via
- * {@link SealingKeyProvider.seal}; this wrapper carries the dispatch
+ * {@link NoydbSealer.seal}; this wrapper carries the dispatch
  * metadata hub needs to pick the right provider on the unseal path.
  *
  * Stability boundary: once shipped, the wire format only grows by
@@ -277,4 +287,4 @@ export declare function loadSealedSecret(store: NoydbStore, vault: string): Prom
  *
  * @internal — called from `createNoydb` / `getKeyringInternal`.
  */
-export declare function resolveManagedSecret(store: NoydbStore, vault: string, provider: SealingKeyProvider): Promise<string>;
+export declare function resolveManagedSecret(store: NoydbStore, vault: string, provider: NoydbSealer): Promise<string>;

package/dist/with-party/team/noydb-facade.d.ts

@@ -19,7 +19,7 @@
  * Internal service — reached through `noydb.team.rotateSecret(...)` etc.
  */
 import type { NoydbOptions, NoydbStore, KeyringAuthenticator } from '../../kernel/types.js';
-import type { RotateResult, RotateKeysOptions } from './keyring.js';
+import type { RotateResult, RotateKeysOptions, RosterVerifyResult, QuarantineResult } from './keyring.js';
 import { type RotateSecretInput, type RecoverSecretInput, type RecoverSecretResult, type RotateRecoveryOptions, type RotateRecoveryResult, type EnrollRecoveryResult, type RecoveryEnrollmentInput, type RecoveryProof } from './rotate-recover.js';
 import { type RecoverUserOptions } from './peer-recover.js';
 import { type PaperRecoveryEntry, type ShamirRecoveryEntry } from './recovery.js';
@@ -74,6 +74,10 @@ export declare class TeamFacade {
     runRevoke(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
     /** Gate + run a `rotateKeys` engine. See `Noydb.rotate` for the public contract. */
     runRotate(engine: (store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, opts: RotateKeysOptions) => Promise<RotateResult>, vault: string, collections: string[]): Promise<RotateResult>;
+    /** Gate + run the `verifyRoster` engine (#1121). See `Noydb.verifyRoster`. */
+    runVerifyRoster(engine: (store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring) => Promise<RosterVerifyResult>, vault: string): Promise<RosterVerifyResult>;
+    /** Gate + run the `quarantineKeyring` engine (#1121). See `Noydb.quarantineKeyring`. */
+    runQuarantine(engine: (store: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, userId: string) => Promise<QuarantineResult>, vault: string, userId: string, factors?: FactorProofBundle): Promise<QuarantineResult>;
     /**
      * Add a tier-2 authenticator slot to the calling user's keyring.
      * Each slot independently wraps the SAME KEK under a method-specific
@@ -299,7 +303,7 @@ export declare class TeamFacade {
      * const db = await createNoydb({
      *   store, user: 'alice',
      *   secretMode: 'managed',
-     *   sealingKey: macosKeychainSealingProvider({ ... }),
+     *   sealingKey: atMacosKeychain({ ... }),
      * })
      *
      * const { vault, recoveryEnrollments } = await db.team.openVaultAndEnrollRecovery('acme', {
@@ -325,7 +329,7 @@ export declare class TeamFacade {
      *
      * Replaces the sealed secret of a managed-mode vault with a
      * fresh 256-bit random, sealed under the configured
-     * `SealingKeyProvider`. The user never sees the new secret.
+     * `NoydbSealer`. The user never sees the new secret.
      *
      * Internally:
      *   1. Verify the recovery proof (Shamir today) and unwrap the

package/dist/with-party/team/{shamir-recovery-provider.d.ts → noydb-shamir.d.ts}

@@ -4,7 +4,7 @@
  * sees `RawShare` or the share codecs. Implemented by
  * `shamirRecoveryProvider()` from `@noy-db/on-shamir`.
  */
-export interface ShamirRecoveryProvider {
+export interface NoydbShamir {
     /** Split `secret` into `n` base32 share strings; any `k` recombine it. */
     splitToShares(secret: Uint8Array, k: number, n: number): string[];
     /**

package/dist/with-party/team/recovery.d.ts

@@ -25,7 +25,7 @@
 import type { NoydbStore } from '../../kernel/types.js';
 import type { EnclaveKey } from '../../kernel/enclave/index.js';
 import { type WrappedDeksBlob } from './wrapped-deks.js';
-import type { ShamirRecoveryProvider } from './shamir-recovery-provider.js';
+import type { NoydbShamir } from './noydb-shamir.js';
 /**
  * One paper recovery code as persisted in `_meta/recovery-paper`.
  *
@@ -146,7 +146,7 @@ export declare function saveShamirRecoveryEntries(store: NoydbStore, vault: stri
  * @param n - Total shares (k <= n <= 255).
  * @param label - Optional caller label.
  */
-export declare function mintShamirRecoveryEntry(provider: ShamirRecoveryProvider, deks: Map<string, EnclaveKey>, entryId: string, k: number, n: number, label?: string): Promise<{
+export declare function mintShamirRecoveryEntry(provider: NoydbShamir, deks: Map<string, EnclaveKey>, entryId: string, k: number, n: number, label?: string): Promise<{
     entry: ShamirRecoveryEntry;
     shareStrings: string[];
 }>;
@@ -161,7 +161,7 @@ export declare function mintShamirRecoveryEntry(provider: ShamirRecoveryProvider
  * because they came from a different enrollment or were tampered
  * with. Callers iterating multiple entries should catch.
  */
-export declare function unwrapDeksFromShamirEntry(provider: ShamirRecoveryProvider, entry: ShamirRecoveryEntry, shareStrings: readonly string[]): Promise<Map<string, EnclaveKey>>;
+export declare function unwrapDeksFromShamirEntry(provider: NoydbShamir, entry: ShamirRecoveryEntry, shareStrings: readonly string[]): Promise<Map<string, EnclaveKey>>;
 /**
  * Generate one paper-recovery entry from an unlocked DEK set.
  *

package/dist/with-party/team/roster-tag.d.ts

@@ -0,0 +1,101 @@
+/**
+ * #1096 — the authenticated half of a `_keyring` file's AUTHORITY.
+ *
+ * A `_keyring` file is stored plaintext (`_iv: ''`) so admins can edit a
+ * member's authority without holding that member's credential. That means
+ * `role`/`permissions` were authenticated by NOTHING — a hostile store could
+ * promote a viewer to admin by editing one word (proven in
+ * `__tests__/keyring-replay-escalation.test.ts`).
+ *
+ * The fix is a vault-wide ROSTER KEY, carried as a reserved DEK-map entry
+ * (`deks['_roster']`, see `ROSTER_KEY_ID`) so it reaches every member through
+ * the channels a DEK already travels — grant's `_`-prefix propagation,
+ * `persistKeyring`, the wrapped-DEKs recovery blob, `peer-recover`, pod
+ * recipient slots — and a `roster_tag`: AES-GCM of the canonical authority
+ * fields under that key. Every roster EDITOR holds the key (constraint:
+ * admins edit authority they don't hold the target's credential for) — which
+ * is what sets the bound below.
+ *
+ * `user_id` is inside the canonical string so a genuine tag cannot be
+ * transplanted onto another member's file.
+ *
+ * ## What "authority half" does NOT cover
+ *
+ * The canonical string is exactly {@link RosterAuthorityFields} — the fields a
+ * privilege decision reads. Other plaintext fields are deliberately excluded
+ * and REMAIN FORGEABLE by the store: `display_name` (cosmetic), `policy`
+ * (round-tripped, never enforced at v1.0), `echo` and `authenticators` (each
+ * authenticated by its own wrapped key material — a forged one fails to
+ * unlock rather than granting anything), plus `created_at` / `salt` /
+ * `_noydb_keyring`. Adding a field to the tag means adding it to
+ * `rosterCanonical`; nothing else here is a claim about it.
+ *
+ * ## The bound
+ *
+ * This stops the STORE, which holds no keys. It deliberately does NOT stop a
+ * malicious MEMBER: every roster editor must hold the roster key, so anyone
+ * who legitimately holds it can forge any authority field for any member.
+ * That bound must be stated in `SECURITY.md` (tracked as part of the #1096
+ * PR) — it is not written there yet.
+ */
+import type { KeyringFile } from '../../kernel/types.js';
+import type { EnclaveKey } from '../../kernel/enclave/index.js';
+export interface RosterTag {
+    readonly iv: string;
+    readonly data: string;
+}
+export type RosterAuthorityFields = Pick<KeyringFile, 'user_id' | 'role' | 'permissions' | 'granted_by' | 'expires_at' | 'export_capability' | 'import_capability' | 'deks' | 'pending_deks'>;
+export declare function rosterCanonical(file: RosterAuthorityFields): string;
+export declare function mintRosterTag(file: RosterAuthorityFields, rosterKey: EnclaveKey): Promise<RosterTag>;
+/**
+ * false on decrypt failure OR canonical mismatch — never throws.
+ *
+ * `null` is accepted alongside `undefined` because the tag arrives from
+ * JSON a store controls: `"roster_tag": null` is a shape the type system
+ * says is impossible and the wire permits.
+ */
+export declare function verifyRosterTag(file: RosterAuthorityFields, tag: RosterTag | undefined | null, rosterKey: EnclaveKey): Promise<boolean>;
+/**
+ * #1096 — THE CHOKEPOINT. Verify a keyring file's plaintext AUTHORITY half
+ * against the roster key carried in its own, already-unwrapped, DEK set.
+ * Throws {@link KeyringTamperedError}; returns silently when the roster is
+ * authentic.
+ *
+ * **Every path that builds an `UnlockedKeyring` from a `KeyringFile` must call
+ * this — not just `loadKeyring`.** A tier-2 unlock that reconstructs
+ * `role`/`permissions` from the plaintext header without it accepts exactly
+ * the forgery tier-1 refuses, and the vault is only as strong as its weakest
+ * unlock path. That is not hypothetical: the wrap-DEKs password path shipped
+ * in this state until it was caught in review.
+ *
+ * Deliberately says nothing about the canary. The canary proves the KEK, and
+ * tier-2 paths have no KEK to prove — the roster key they hold comes from the
+ * slot's own wrapped-DEK blob, which is authenticated by its own AES-GCM tag.
+ * Callers that DO hold a KEK check the canary separately, before this.
+ *
+ * @param deks the caller's UNWRAPPED DEK set — a roster key here is proof of
+ *   possession, so this must never be handed a map built from unverified input.
+ */
+export declare function assertRosterAuthenticated(file: KeyringFile, deks: ReadonlyMap<string, EnclaveKey>, userId: string): Promise<void>;
+/**
+ * #1096 — VERIFY BEFORE YOU TRUST, and especially before you RESTAMP.
+ *
+ * The sibling of {@link assertRosterAuthenticated} for the other half of the
+ * problem. That one guards paths that *unlock* a keyring; this one guards paths
+ * that **read another member's file** — because the roster key is vault-wide, a
+ * caller holding it can verify any member's tag, not just their own.
+ *
+ * Every read-modify-write on a member's roster must call this **before** the
+ * modify. A flow that reads a forged file, edits one field and restamps does
+ * not merely tolerate the forgery — it **launders** it, converting a file
+ * `loadKeyring` refuses into one it accepts, under a genuine tag. `revoke`
+ * calls into such a flow unconditionally, so without this a single forged
+ * member plus any later revocation anywhere in the vault is a complete bypass.
+ *
+ * Fail-closed, deliberately: a forged member's file aborts the operation rather
+ * than being skipped. Skipping would complete the revoke while leaving the
+ * forgery in place, and an untrusted store can already refuse writes — so the
+ * availability it costs was never guaranteed, while the integrity it buys is
+ * the point of the mechanism.
+ */
+export declare function assertRosterTagValid(file: KeyringFile, rosterKey: EnclaveKey, userId: string): Promise<void>;

package/dist/with-party/team/rotate-recover.d.ts

@@ -19,10 +19,10 @@
 import type { NoydbStore } from '../../kernel/types.js';
 import { type EnclaveKey, type EchoSecretParts } from '../../kernel/enclave/index.js';
 import { type PaperRecoveryEntry } from './recovery.js';
-import type { ShamirRecoveryProvider } from './shamir-recovery-provider.js';
+import type { NoydbShamir } from './noydb-shamir.js';
 import { type SecretPolicy, type EchoSecretPolicy } from '../../kernel/validation.js';
 import type { UnlockedKeyring } from './keyring.js';
-import type { DeviceSealProvider } from './device-seal.js';
+import type { NoydbDeviceSeal } from './device-seal.js';
 import type { KeyringAuthenticator } from '../../kernel/types.js';
 import type { EnrollAuthenticatorOptions } from './authenticators.js';
 /**
@@ -38,7 +38,7 @@ interface RotateEchoOptions {
      * absent ⇒ `reveal: 'portable'`. Mirrors
      * {@link CreateOwnerKeyringOptions.deviceSeal}.
      */
-    readonly deviceSeal?: DeviceSealProvider;
+    readonly deviceSeal?: NoydbDeviceSeal;
     /** Optional display hint for the masked echo. */
     readonly maskHint?: string;
 }
@@ -189,7 +189,7 @@ export type RecoveryProof = {
         /** Optional disambiguator when multiple Shamir entries are enrolled.
          *  When omitted, hub tries each entry until one combines. */
         readonly entryId?: string;
-        /** K or more opaque share strings, as returned by `ShamirRecoveryProvider.splitToShares`. */
+        /** K or more opaque share strings, as returned by `NoydbShamir.splitToShares`. */
         readonly shares: ReadonlyArray<string>;
     };
 };
@@ -365,5 +365,5 @@ export type RecoveryEnrollmentInput = {
  * On success, the used recovery entry is burned (deleted from the
  * stored set).
  */
-export declare function recoverSecret(provider: ShamirRecoveryProvider | undefined, store: NoydbStore, vault: string, userId: string, input: RecoverSecretInput): Promise<UnlockedKeyring>;
+export declare function recoverSecret(provider: NoydbShamir | undefined, store: NoydbStore, vault: string, userId: string, input: RecoverSecretInput): Promise<UnlockedKeyring>;
 export {};