@noy-db/hub 0.7.1-pre.0 → 0.8.0

package/dist/{chunk-DFMWUOU5.js → chunk-H7JBY4P7.js}

@@ -1,47 +1,47 @@
 import {
   walkClosure
-} from "./chunk-3PGS7TYR.js";
+} from "./chunk-EGVJ7TM4.js";
 import {
   resolveManagedSecret
-} from "./chunk-4GVM6QZA.js";
+} from "./chunk-3XJQBBZD.js";
 import {
   parseExtractedPartitionBody,
   readPod,
   readPodHeader
-} from "./chunk-BVN6KXL2.js";
+} from "./chunk-KZXDLBY6.js";
 import {
   createOwnerKeyring,
   mintRosterTag,
   nextRosterEpoch,
   requireRosterKey
-} from "./chunk-3V4KWFX7.js";
+} from "./chunk-XSPFDUDG.js";
 import {
   LedgerStore
-} from "./chunk-V7ZRRCRJ.js";
+} from "./chunk-N7EVQD5S.js";
 import {
   LEDGER_COLLECTION
 } from "./chunk-I7FD46FF.js";
-import {
-  openEnvelopeJson
-} from "./chunk-4ZS56W5S.js";
-import {
-  buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
 import {
   base64ToBuffer,
+  bufferToBase64,
+  buildRecordEnvelope,
+  decryptBytes,
+  importDekSet,
+  importTransferKey,
+  openEnvelopeJson,
   wrapKey
-} from "./chunk-HPVZCW43.js";
+} from "./chunk-EZGV6F47.js";
 import {
   AdoptionStateError,
   TransferSealError,
   ValidationError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-cargo/active.ts
 function withCargo() {
   return {
     async extractPartition(vault, opts) {
-      const { extractPartitionCore } = await import("./extract-partition-NKYO3WNG.js");
+      const { extractPartitionCore } = await import("./extract-partition-JD5CUSTG.js");
       return extractPartitionCore(vault, opts);
     }
   };
@@ -103,15 +103,11 @@ async function unsealDeks(seal, transferKey) {
       `transfer key must be 32 bytes, got ${transferKey.byteLength}.`
     );
   }
-  const key = await crypto.subtle.importKey("raw", transferKey, "AES-GCM", false, ["decrypt"]);
+  const key = await importTransferKey(transferKey);
   const raw = base64ToBuffer(seal.payload);
   let plaintext;
   try {
-    plaintext = await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: raw.slice(0, 12) },
-      key,
-      raw.slice(12)
-    );
+    plaintext = await decryptBytes(bufferToBase64(raw.slice(0, 12)), bufferToBase64(raw.slice(12)), key);
   } catch {
     throw new TransferSealError(
       "transfer seal could not be opened \u2014 wrong transfer key (AES-GCM authentication failed)."
@@ -123,12 +119,7 @@ async function unsealDeks(seal, transferKey) {
   } catch {
     throw new TransferSealError("transfer seal payload is not valid JSON after decryption.");
   }
-  const deks = /* @__PURE__ */ new Map();
-  for (const [collection, b64] of Object.entries(dekMap)) {
-    const dek = await crypto.subtle.importKey("raw", base64ToBuffer(b64), "AES-GCM", true, ["encrypt", "decrypt"]);
-    deks.set(collection, dek);
-  }
-  return deks;
+  return importDekSet(dekMap);
 }
 async function adoptPartition(bundleBytes, opts) {
   const { transferKey, destinationStore, vaultName } = opts;
@@ -143,7 +134,7 @@ async function adoptPartition(bundleBytes, opts) {
   await unsealDeks(seal, transferKey);
   const existing = await destinationStore.get(vaultName, "_meta", "adoption");
   if (existing) {
-    const prior = JSON.parse(existing._data);
+    const prior = JSON.parse(existing._data ?? "");
     if (prior.sealId === seal.sealId) {
       throw new AdoptionStateError(
         `partition (sealId ${seal.sealId}) is already adopted into vault "${vaultName}".`
@@ -197,7 +188,7 @@ async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
       `vault "${vaultName}" is not an adopted partition (no _meta/adoption). createOwnerOnAdoptedPartition only applies to vaults created via adoptPartition.`
     );
   }
-  const adoption = JSON.parse(adoptionEnv._data);
+  const adoption = JSON.parse(adoptionEnv._data ?? "");
   if (adoption.consumedAt !== void 0 || adoption.transferSeal === void 0) {
     throw new AdoptionStateError(
       `vault "${vaultName}" already has an owner (transfer seal consumed at ${adoption.consumedAt}).`
@@ -212,14 +203,14 @@ async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
     );
   }
   const partitionCollections = [...partitionDeks.keys()];
-  const priorDeks = existingKeyring ? JSON.parse(existingKeyring._data).deks : {};
+  const priorDeks = existingKeyring ? JSON.parse(existingKeyring._data ?? "").deks : {};
   const ownerMinted = existingKeyring !== null && partitionCollections.every((c) => c in priorDeks);
   if (!ownerMinted) {
     const secret = isManaged(opts) ? await resolveManagedSecret(store, vaultName, opts.sealingKey) : opts.secret;
     const unlocked = await createOwnerKeyring(store, vaultName, { userId, secret });
     const env = await store.get(vaultName, "_keyring", userId);
     if (!env) throw new AdoptionStateError(`keyring write for "${userId}" did not persist`);
-    const keyringFile = JSON.parse(env._data);
+    const keyringFile = JSON.parse(env._data ?? "");
     const kek = unlocked.kek;
     if (!kek) throw new AdoptionStateError(`owner keyring for "${userId}" has no KEK to wrap partition DEKs under`);
     const mergedDeks = { ...keyringFile.deks };
@@ -252,7 +243,7 @@ async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
     }
   }
   if (isManaged(opts)) {
-    const { createNoydb } = await import("./noydb-62MX4QUG.js");
+    const { createNoydb } = await import("./noydb-ITIGNKUF.js");
     const db = await createNoydb({
       store,
       user: userId,
@@ -307,4 +298,4 @@ export {
   withCargo,
   describeExtraction
 };
-//# sourceMappingURL=chunk-DFMWUOU5.js.map
+//# sourceMappingURL=chunk-H7JBY4P7.js.map

package/dist/chunk-H7JBY4P7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-cargo/active.ts","../src/with-cargo/describe-extraction.ts","../src/with-cargo/adopt-partition.ts","../src/with-cargo/decrypt-partition.ts"],"sourcesContent":["/**\n * Enable the cargo (partition extraction) capability.\n * Pass to `createNoydb({ cargoStrategy: withCargo() })` to make the source-side\n * `extractPartition(vault, ...)` free function live. The extraction crypto\n * engine is dynamically imported here, so it stays out of the floor bundle\n * until opted in. The recipient-side `adoptPartition` /\n * `decryptExtractedPartition` free functions — and `diffVault` (shared\n * import/merge infra) — are ungated and unaffected.\n */\nimport type { CargoStrategy } from './strategy.js'\n\nexport function withCargo(): CargoStrategy {\n  return {\n    async extractPartition(vault, opts) {\n      const { extractPartitionCore } = await import('./extract-partition.js')\n      return extractPartitionCore(vault, opts)\n    },\n  }\n}\n","/**\n * Partition-extraction dry-run. Read-only preview of what an\n * `extractPartition` would move: record counts, byte totals, and the\n * timestamp span per collection — computed from raw encrypted\n * envelopes WITHOUT decrypting them. Writes nothing, mutates nothing.\n *\n * @module\n */\nimport type { Vault } from '../kernel/vault.js'\nimport { walkClosure, type WalkClosureOptions, type DanglingRefNotice } from './walk-closure.js'\n\nexport interface ExtractionPreview {\n  readonly totalRecords: number\n  /** Sum of serialized encrypted-envelope sizes (bytes). */\n  readonly totalBytes: number\n  readonly byCollection: ReadonlyArray<{\n    readonly name: string\n    readonly recordCount: number\n    readonly bytes: number\n    /** Earliest envelope `_ts` in this collection (lexicographic). */\n    readonly oldestTs?: string\n    readonly newestTs?: string\n  }>\n  readonly graph: { readonly depth: number; readonly cyclesDetected: boolean }\n  /** Records the walk reached but whose envelope couldn't be read. */\n  readonly inaccessible: ReadonlyArray<{ readonly collection: string; readonly id: string }>\n  /**\n   * #772: outbound FK edges whose referenced parent was excluded from the\n   * closure (missing, or tier-elevated and therefore invisible) — mirrors\n   * `ExtractPartitionResult.danglingRefs` (#759) so a preview/extract pair\n   * gives the SAME signal. A parent excluded this way never appears in\n   * `byCollection` at all; this is the only preview-time indicator.\n   */\n  readonly danglingRefs: ReadonlyArray<DanglingRefNotice>\n}\n\nexport async function describeExtraction(\n  vault: Vault,\n  opts: WalkClosureOptions,\n): Promise<ExtractionPreview> {\n  const { closure, graph, danglingRefs } = await walkClosure(vault, opts)\n\n  const { name: vaultName, adapter } = vault._introspectState()\n  const encoder = new TextEncoder()\n\n  const byCollection: Array<{\n    name: string; recordCount: number; bytes: number; oldestTs?: string; newestTs?: string\n  }> = []\n  const inaccessible: Array<{ collection: string; id: string }> = []\n  let totalBytes = 0\n  let totalRecords = 0\n\n  for (const [collectionName, ids] of closure) {\n    let bytes = 0\n    let oldestTs: string | undefined\n    let newestTs: string | undefined\n    let recordCount = 0\n\n    for (const id of ids) {\n      const env = await adapter.get(vaultName, collectionName, id)\n      if (!env) {\n        // Walk reached it (via decrypted list) but the raw store read\n        // returned nothing — surface rather than miscount.\n        inaccessible.push({ collection: collectionName, id })\n        continue\n      }\n      recordCount++\n      bytes += encoder.encode(JSON.stringify(env)).length\n      const ts = env._ts\n      if (oldestTs === undefined || ts < oldestTs) oldestTs = ts\n      if (newestTs === undefined || ts > newestTs) newestTs = ts\n    }\n\n    byCollection.push({\n      name: collectionName,\n      recordCount,\n      bytes,\n      // Spread conditionally — exactOptionalPropertyTypes forbids an\n      // explicit `undefined` on an optional property.\n      ...(oldestTs !== undefined ? { oldestTs } : {}),\n      ...(newestTs !== undefined ? { newestTs } : {}),\n    })\n    totalBytes += bytes\n    totalRecords += recordCount\n  }\n\n  byCollection.sort((a, b) => a.name.localeCompare(b.name))\n\n  return Object.freeze({\n    totalRecords,\n    totalBytes,\n    byCollection,\n    graph,\n    inaccessible,\n    danglingRefs,\n  })\n}\n","/**\n * Partition adoption. Recipient side: verify an extracted bundle,\n * validate the transfer key, import the re-keyed collections into a\n * destination store, and record an `_meta/adoption` marker. The bundle\n * stays UNOWNED after adoption — `createOwnerOnAdoptedPartition`\n * mints the owner; the transfer seal is then destroyed.\n *\n * @module\n */\nimport {\n  base64ToBuffer, bufferToBase64, wrapKey, importTransferKey, decryptBytes, importDekSet,\n  type EnclaveKey,\n} from '../capsule/index.js'\nimport { TransferSealError, AdoptionStateError, ValidationError } from '../kernel/errors.js'\nimport type { NoydbStore, VaultSnapshot, KeyringFile } from '../kernel/types.js'\nimport { createOwnerKeyring, requireRosterKey } from '../with-party/team/keyring.js'\nimport { mintRosterTag } from '../with-party/team/roster-tag.js' // #1115\nimport { nextRosterEpoch } from '../with-party/team/roster-epoch.js' // #1097\nimport { resolveManagedSecret } from '../with-party/team/managed-secret.js'\nimport type { NoydbSealer } from '../with-party/team/managed-secret.js'\nimport type { NoydbShamir } from '../with-party/team/noydb-shamir.js'\nimport type { RecoveryEnrollmentInput } from '../with-party/team/rotate-recover.js'\nimport { LedgerStore } from '../with-commit/history/ledger/store.js'\nimport { LEDGER_COLLECTION } from '../with-commit/history/ledger/constants.js'\nimport type { TransferSealPayload } from '../with-pod/pod.js'\nimport { readPodHeader, readPod, parseExtractedPartitionBody } from '../with-pod/pod.js'\nimport { buildRecordEnvelope } from '../capsule/index.js'\n\n/**\n * Reverse of `sealDeks`. Imports the transfer key, decrypts the\n * sealed `{ collection: base64(rawDEK) }` map (layout iv(12)‖ct‖tag), and\n * re-imports each DEK as an AES-GCM key. Throws `TransferSealError` on a\n * wrong key (AES-GCM auth-tag failure) or malformed payload.\n */\nexport async function unsealDeks(\n  seal: TransferSealPayload,\n  transferKey: Uint8Array,\n): Promise<Map<string, EnclaveKey>> {\n  if (transferKey.byteLength !== 32) {\n    throw new TransferSealError(\n      `transfer key must be 32 bytes, got ${transferKey.byteLength}.`,\n    )\n  }\n  const key = await importTransferKey(transferKey)\n  const raw = base64ToBuffer(seal.payload)\n  let plaintext: Uint8Array\n  try {\n    plaintext = await decryptBytes(bufferToBase64(raw.slice(0, 12)), bufferToBase64(raw.slice(12)), key)\n  } catch {\n    throw new TransferSealError(\n      'transfer seal could not be opened — wrong transfer key (AES-GCM authentication failed).',\n    )\n  }\n  let dekMap: Record<string, string>\n  try {\n    dekMap = JSON.parse(new TextDecoder().decode(plaintext)) as Record<string, string>\n  } catch {\n    throw new TransferSealError('transfer seal payload is not valid JSON after decryption.')\n  }\n  // Extractable: the recipient re-wraps these under their own KEK (AES-KW)\n  // at owner-creation — importDekSet mints them the way generateDEK does.\n  return importDekSet(dekMap)\n}\n\nexport interface AdoptPartitionOptions {\n  readonly transferKey: Uint8Array\n  readonly destinationStore: NoydbStore\n  readonly vaultName: string\n}\n\nexport interface AdoptPartitionResult {\n  readonly vaultName: string\n  readonly needsOwner: true\n  readonly sealId: string\n}\n\nexport async function adoptPartition(\n  bundleBytes: Uint8Array,\n  opts: AdoptPartitionOptions,\n): Promise<AdoptPartitionResult> {\n  const { transferKey, destinationStore, vaultName } = opts\n\n  const header = readPodHeader(bundleBytes)\n  if (header.bundleKind !== 'extracted-partition' || header.transferSeal === undefined) {\n    throw new ValidationError(\n      'adoptPartition requires an extracted-partition bundle with a transfer seal. '\n      + 'For ordinary backups use readPod + vault.load.',\n    )\n  }\n\n  const { dumpJson } = await readPod(bundleBytes)\n  const { dump, seal } = parseExtractedPartitionBody(dumpJson)\n\n  // Validate the transfer key by unsealing in memory; throws\n  // TransferSealError on mismatch. DEKs are discarded here — they stay\n  // sealed at rest (in _meta/adoption) until owner-creation wraps them under the\n  // recipient's KEK.\n  await unsealDeks(seal, transferKey)\n\n  // Single-occupancy per vaultName: an `_meta/adoption` marker already present\n  // means this slot holds a partition (adopted-and-unowned, or already owned).\n  // saveAll below would overwrite its data and replace the marker, stranding the\n  // prior adoption's transfer seal. Refuse regardless of sealId — re-adopting the\n  // SAME bundle is a redundant call, and adopting a DIFFERENT bundle here would\n  // clobber the existing partition. Either way, pick a fresh vaultName.\n  const existing = await destinationStore.get(vaultName, '_meta', 'adoption')\n  if (existing) {\n    const prior = JSON.parse(existing._data ?? '') as { sealId?: string }\n    if (prior.sealId === seal.sealId) {\n      throw new AdoptionStateError(\n        `partition (sealId ${seal.sealId}) is already adopted into vault \"${vaultName}\".`,\n      )\n    }\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already holds an adopted partition (sealId ${prior.sealId}); `\n      + `adopting a different partition (sealId ${seal.sealId}) here would overwrite it. `\n      + `Adopt into a fresh vaultName instead.`,\n    )\n  }\n\n  // The marker-only check above misses a worse case: a vaultName already in use\n  // by an ORDINARY vault (createNoydb + openVault) carries no `_meta/adoption`,\n  // yet `saveAll` below is destructive on SQL adapters (`DELETE FROM ... WHERE\n  // vault = ?` followed by upsert) and would wipe the legitimate keyring +\n  // data. Refuse adoption into ANY occupied slot — a fresh vaultName is the\n  // documented precondition.\n  const existingKeyring = await destinationStore.list(vaultName, '_keyring')\n  if (existingKeyring.length > 0) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already holds a keyring (an unrelated owner exists at this slot); `\n      + `adoptPartition requires a fresh vaultName to avoid destructive saveAll on SQL adapters.`,\n    )\n  }\n\n  const backup = JSON.parse(dump) as { collections: VaultSnapshot; _internal?: VaultSnapshot }\n  await destinationStore.saveAll(vaultName, backup.collections)\n\n  // Import carried internal collections (e.g. _schemas from carrySchemas).\n  // saveAll only writes data collections; _internal is written per-record.\n  if (backup._internal) {\n    for (const [collection, records] of Object.entries(backup._internal)) {\n      for (const [id, envelope] of Object.entries(records)) {\n        await destinationStore.put(vaultName, collection, id, envelope)\n      }\n    }\n  }\n\n  const adoptedAt = new Date().toISOString()\n  const adoption = { sealId: seal.sealId, adoptedAt, needsOwner: true as const, transferSeal: seal }\n  await destinationStore.put(vaultName, '_meta', 'adoption',\n    buildRecordEnvelope({ collection: '_meta', id: 'adoption', version: 1 },\n      { ts: adoptedAt, iv: '', data: JSON.stringify(adoption) }))\n\n  return { vaultName, needsOwner: true, sealId: seal.sealId }\n}\n\nexport interface CreateOwnerResult {\n  readonly vaultName: string\n  readonly userId: string\n}\n\n/** Standard-mode owner: recipient supplies the secret. */\nexport interface CreateOwnerStandardOptions {\n  readonly userId: string\n  readonly secret: string\n  readonly transferKey: Uint8Array\n}\n\n/**\n * Managed-mode owner: the secret is minted + sealed under\n * a `NoydbSealer` (e.g. an `at-*` OS keychain) so the partition\n * auto-unlocks on the recipient's device. Managed mode mandates a strong\n * (Shamir) recovery profile at creation, which needs the\n * `shamirRecovery` provider injected.\n */\nexport interface CreateOwnerManagedOptions {\n  readonly userId: string\n  readonly secretMode: 'managed'\n  readonly sealingKey: NoydbSealer\n  readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>\n  readonly shamirRecovery: NoydbShamir\n  readonly transferKey: Uint8Array\n}\n\nexport type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManagedOptions\n\nfunction isManaged(o: CreateOwnerOptions): o is CreateOwnerManagedOptions {\n  return 'secretMode' in o && o.secretMode === 'managed'\n}\n\n/**\n * Mint the first owner keyring on an adopted-but-unowned partition,\n * then destroy the transfer seal.\n *\n * Standard mode: the recipient supplies a secret. Managed mode: the\n * secret is minted + sealed under a `NoydbSealer` and a strong\n * (Shamir) recovery profile is enrolled — orchestrated via the existing\n * `openVaultAndEnrollRecovery` ceremony.\n *\n * Either way, reuses `createOwnerKeyring` to derive the KEK + write the base\n * keyring, then wraps the partition's DEKs (recovered from the seal) under that\n * KEK and re-persists the merged keyring file.\n *\n * Idempotent under retry: the seal is destroyed LAST (Stage D), after the\n * keyring (Stage A), the ledger transition (Stage B), and — in managed mode —\n * strong-recovery enrollment (Stage C). A failure in the fallible enrollment\n * step leaves the seal intact, and re-running with the same `userId` +\n * `transferKey` resumes from the first incomplete stage. (Multi-profile recovery\n * arrays may re-enroll an already-enrolled profile on retry; managed mode's\n * mandated single Shamir profile does not.)\n */\nexport async function createOwnerOnAdoptedPartition(\n  store: NoydbStore,\n  vaultName: string,\n  opts: CreateOwnerOptions,\n): Promise<CreateOwnerResult> {\n  const { userId, transferKey } = opts\n\n  // Managed mode requires a strong (Shamir) recovery profile, validated BEFORE\n  // any disk write — same gate as createNoydb.\n  if (isManaged(opts) && !opts.recovery.some((r) => r.profile === 'shamir')) {\n    throw new AdoptionStateError(\n      'managed-mode adoption requires at least one strong (shamir) recovery profile in '\n      + '`recovery` — paper alone is not strong when there is no user secret to fall back on.',\n    )\n  }\n\n  // 1. Verify adopted-unowned state.\n  const adoptionEnv = await store.get(vaultName, '_meta', 'adoption')\n  if (!adoptionEnv) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" is not an adopted partition (no _meta/adoption). `\n      + `createOwnerOnAdoptedPartition only applies to vaults created via adoptPartition.`,\n    )\n  }\n  const adoption = JSON.parse(adoptionEnv._data ?? '') as {\n    sealId: string; adoptedAt: string; needsOwner?: boolean\n    consumedAt?: string; transferSeal?: TransferSealPayload\n  }\n  if (adoption.consumedAt !== undefined || adoption.transferSeal === undefined) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already has an owner (transfer seal consumed at ${adoption.consumedAt}).`,\n    )\n  }\n\n  // 2. Recover the partition DEKs from the seal (throws on wrong key) BEFORE\n  //    writing any keyring, so a bad transfer key leaves no trace. Always\n  //    validated, including when resuming a partial prior call.\n  const partitionDeks = await unsealDeks(adoption.transferSeal, transferKey)\n\n  // The ceremony below is split into stages so a failure in the fallible\n  // managed-enrollment step (network/provider outage) leaves the call RETRYABLE\n  // — the seal is destroyed only once everything durable is in place. Each stage\n  // detects its own prior completion rather than relying on a single resume bit.\n\n  // A keyring present for a DIFFERENT user (with the seal still unconsumed) is a\n  // genuine second-owner attempt — refuse it. A same-user keyring is a resumed\n  // partial call and is handled by the stage checks below.\n  const existingKeyring = await store.get(vaultName, '_keyring', userId)\n  const otherOwners = (await store.list(vaultName, '_keyring')).filter((u) => u !== userId)\n  if (otherOwners.length > 0) {\n    throw new AdoptionStateError(\n      `vault \"${vaultName}\" already has a keyring for a different owner; cannot create owner \"${userId}\".`,\n    )\n  }\n\n  // Stage A — mint the owner keyring + merge the partition DEKs. Considered done\n  // only when the keyring already holds every partition DEK. createOwnerKeyring\n  // overwrites (fresh KEK + fresh _users DEK), so re-running is safe ONLY while\n  // no recovery has been enrolled yet — guaranteed here because enrollment\n  // (Stage C) runs strictly after Stage A completes.\n  const partitionCollections = [...partitionDeks.keys()]\n  const priorDeks = existingKeyring ? (JSON.parse(existingKeyring._data ?? '') as KeyringFile).deks : {}\n  const ownerMinted = existingKeyring !== null && partitionCollections.every((c) => c in priorDeks)\n  if (!ownerMinted) {\n    // Resolve the owner secret. Managed mode mints a random secret, seals\n    // it under the provider, and persists _meta/sealed-secret (so the\n    // partition auto-unlocks on the recipient's device); standard mode uses the\n    // caller's secret. Idempotent under retry — resolveManagedSecret's reopen\n    // arm reuses an already-sealed secret.\n    const secret = isManaged(opts)\n      ? await resolveManagedSecret(store, vaultName, opts.sealingKey)\n      : opts.secret\n\n    // Mint the owner keyring (KEK + _users DEK + canary, written to disk).\n    const unlocked = await createOwnerKeyring(store, vaultName, { userId: userId, secret: secret })\n\n    // Merge the partition DEKs (wrapped under the new KEK) into the keyring.\n    const env = await store.get(vaultName, '_keyring', userId)\n    if (!env) throw new AdoptionStateError(`keyring write for \"${userId}\" did not persist`)\n    const keyringFile = JSON.parse(env._data ?? '') as KeyringFile\n    const kek = unlocked.kek\n    if (!kek) throw new AdoptionStateError(`owner keyring for \"${userId}\" has no KEK to wrap partition DEKs under`)\n    const mergedDeks: Record<string, string> = { ...keyringFile.deks }\n    for (const [collection, dek] of partitionDeks) {\n      mergedDeks[collection] = await wrapKey(dek, kek)\n    }\n    // #1115 — RESTAMP. The roster tag now covers the DEK key SET, and this merge\n    // is precisely a change to that set: adoption joins the partition's\n    // collections to a keyring `createOwnerKeyring` stamped moments earlier\n    // without them. Writing the merged file under the old tag would leave every\n    // adopted vault failing `roster-tag-mismatch` on its first open.\n    //\n    // The roster key is the one just minted for this NEW vault — unlike\n    // `liberateVault`, which joins an EXISTING vault and must keep the\n    // incumbent key so co-members can still verify each other.\n    const merged: KeyringFile = { ...keyringFile, deks: mergedDeks }\n    // #1097 — stamped BEFORE the tag is minted, so it lands inside the\n    // authenticated canonical and a store can neither edit nor strip it.\n    const withEpoch = { ...merged, roster_epoch: nextRosterEpoch(keyringFile.roster_epoch) }\n    const rosterKey = requireRosterKey(unlocked, 'adoptPartition')\n    const mergedFile: KeyringFile = { ...withEpoch, roster_tag: await mintRosterTag(withEpoch, rosterKey) }\n    await store.put(vaultName, '_keyring', userId, { ...env, _data: JSON.stringify(mergedFile) })\n  }\n\n  // Stage B — record the ownership transition on the carried\n  // audit chain (carryLedger sealed the _ledger DEK). No-op without that DEK.\n  // Idempotent: appended only if the closing `transfer-seal-consumed` entry is\n  // absent, so a retry does not duplicate the pair.\n  const ledgerDek = partitionDeks.get(LEDGER_COLLECTION)\n  if (ledgerDek) {\n    const ledger = new LedgerStore({\n      adapter: store,\n      vault: vaultName,\n      encrypted: true,\n      getDEK: async () => ledgerDek,\n      actor: userId,\n    })\n    const creationReason = `creation-of-new-owner:${userId}`\n    const consumedReason = `transfer-seal-consumed:${adoption.sealId}`\n    // Gate each append on its own presence — a crash or store error strictly\n    // between the two adjacent puts would otherwise re-append the first one\n    // on retry. The pair is the audit record, not a single transaction.\n    const recordedReasons = new Set((await ledger.loadAllEntries()).map((e) => e.reason))\n    if (!recordedReasons.has(creationReason)) {\n      await ledger.append({ op: 'lifecycle', collection: '', id: '', version: 0, actor: '', payloadHash: '', reason: creationReason })\n    }\n    if (!recordedReasons.has(consumedReason)) {\n      await ledger.append({ op: 'lifecycle', collection: '', id: '', version: 0, actor: '', payloadHash: '', reason: consumedReason })\n    }\n  }\n\n  // Stage C — Managed mode: enroll the mandatory strong recovery\n  //    by orchestrating the existing public ceremony. The partition is\n  //    now a managed-mode vault on disk (sealed secret + keyring), so we\n  //    open it as a normal client and let openVaultAndEnrollRecovery do the\n  //    gate-bypass + enroll + re-assert. Dynamic import keeps the Noydb class\n  //    out of the @noy-db/hub/cargo static graph. Runs BEFORE seal destruction\n  //    so a failure here leaves the seal intact and the call retryable.\n  if (isManaged(opts)) {\n    const { createNoydb } = await import('../kernel/noydb.js')\n    const db = await createNoydb({\n      store,\n      user: userId,\n      secretMode: 'managed',\n      sealingKey: opts.sealingKey,\n      shamirRecovery: opts.shamirRecovery,\n    })\n    await db.team.openVaultAndEnrollRecovery(vaultName, { recovery: opts.recovery })\n  }\n\n  // Stage D — Destroy the transfer seal LAST — the commit point. Everything\n  //    above is either idempotent or resumable, so the seal is only consumed\n  //    once the owner keyring (and, in managed mode, strong recovery) is\n  //    durably in place. Retain sealId + consumedAt for audit.\n  const consumed = { sealId: adoption.sealId, adoptedAt: adoption.adoptedAt, consumedAt: new Date().toISOString() }\n  await store.put(vaultName, '_meta', 'adoption', { ...adoptionEnv, _data: JSON.stringify(consumed) })\n\n  return { vaultName, userId }\n}\n","/**\n * Read-side counterpart to `extractPartition`: decrypt an\n * extracted-partition bundle's records to plaintext using its transfer\n * key, WITHOUT adopting it into a vault. Used by an outward\n * orchestration layer's reconcile/merge and field-authority flows to\n * compare incoming records against a receiver. The transfer key validates the bundle\n * (wrong key throws).\n * @module\n */\nimport type { EncryptedEnvelope } from '../kernel/types.js'\nimport { openEnvelopeJson } from '../capsule/index.js'\nimport { readPodHeader, readPod, parseExtractedPartitionBody } from '../with-pod/pod.js'\nimport { unsealDeks } from './adopt-partition.js'\n\n/** One decrypted record from an extracted-partition compartment. */\nexport interface DecryptedRecord {\n  readonly id: string\n  readonly record: Record<string, unknown>\n  /** Source envelope write timestamp (ISO) — for last-write-wins merges. */\n  readonly ts: string\n  /** Source envelope version. */\n  readonly version: number\n  /** Provenance source id (FR-5). Present only when the source collection had provenance:true and a source was supplied on put. */\n  readonly source?: string\n  /** ISO-8601 timestamp the provenance source was recorded (FR-5). */\n  readonly sourceTs?: string\n}\n\n/**\n * Decrypt every record of an extracted-partition bundle to plaintext,\n * grouped by collection. Throws if the bundle isn't an\n * extracted-partition or the transfer key is wrong.\n */\nexport async function decryptExtractedPartition(\n  bundleBytes: Uint8Array,\n  transferKey: Uint8Array,\n): Promise<Record<string, DecryptedRecord[]>> {\n  const header = readPodHeader(bundleBytes)\n  if (header.bundleKind !== 'extracted-partition' || header.transferSeal === undefined) {\n    throw new Error('decryptExtractedPartition: bundle is not an extracted-partition.')\n  }\n  const { dumpJson } = await readPod(bundleBytes)\n  const { dump, seal } = parseExtractedPartitionBody(dumpJson)\n  const deks = await unsealDeks(seal, transferKey) // throws TransferSealError on wrong key\n  const backup = JSON.parse(dump) as { collections: Record<string, Record<string, EncryptedEnvelope>> }\n  const out: Record<string, DecryptedRecord[]> = {}\n  for (const [collection, byId] of Object.entries(backup.collections)) {\n    const dek = deks.get(collection)\n    if (dek === undefined) continue // no DEK sealed for this collection — skip\n    const recs: DecryptedRecord[] = []\n    for (const [id, env] of Object.entries(byId)) {\n      const plaintext = await openEnvelopeJson({ collection, id }, env, dek)\n      const body = JSON.parse(plaintext) as Record<string, unknown>\n      recs.push({\n        id,\n        record: { ...body, id },\n        ts: env._ts,\n        version: env._v,\n        ...(env._source !== undefined ? { source: env._source } : {}),\n        ...(env._sourceTs !== undefined ? { sourceTs: env._sourceTs } : {}),\n      })\n    }\n    out[collection] = recs\n  }\n  return out\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWO,SAAS,YAA2B;AACzC,SAAO;AAAA,IACL,MAAM,iBAAiB,OAAO,MAAM;AAClC,YAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,iCAAwB;AACtE,aAAO,qBAAqB,OAAO,IAAI;AAAA,IACzC;AAAA,EACF;AACF;;;ACkBA,eAAsB,mBACpB,OACA,MAC4B;AAC5B,QAAM,EAAE,SAAS,OAAO,aAAa,IAAI,MAAM,YAAY,OAAO,IAAI;AAEtE,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,UAAU,IAAI,YAAY;AAEhC,QAAM,eAED,CAAC;AACN,QAAM,eAA0D,CAAC;AACjE,MAAI,aAAa;AACjB,MAAI,eAAe;AAEnB,aAAW,CAAC,gBAAgB,GAAG,KAAK,SAAS;AAC3C,QAAI,QAAQ;AACZ,QAAI;AACJ,QAAI;AACJ,QAAI,cAAc;AAElB,eAAW,MAAM,KAAK;AACpB,YAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gBAAgB,EAAE;AAC3D,UAAI,CAAC,KAAK;AAGR,qBAAa,KAAK,EAAE,YAAY,gBAAgB,GAAG,CAAC;AACpD;AAAA,MACF;AACA;AACA,eAAS,QAAQ,OAAO,KAAK,UAAU,GAAG,CAAC,EAAE;AAC7C,YAAM,KAAK,IAAI;AACf,UAAI,aAAa,UAAa,KAAK,SAAU,YAAW;AACxD,UAAI,aAAa,UAAa,KAAK,SAAU,YAAW;AAAA,IAC1D;AAEA,iBAAa,KAAK;AAAA,MAChB,MAAM;AAAA,MACN;AAAA,MACA;AAAA;AAAA;AAAA,MAGA,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,IAC/C,CAAC;AACD,kBAAc;AACd,oBAAgB;AAAA,EAClB;AAEA,eAAa,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAExD,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;;;AC9DA,eAAsB,WACpB,MACA,aACkC;AAClC,MAAI,YAAY,eAAe,IAAI;AACjC,UAAM,IAAI;AAAA,MACR,sCAAsC,YAAY,UAAU;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,MAAM,MAAM,kBAAkB,WAAW;AAC/C,QAAM,MAAM,eAAe,KAAK,OAAO;AACvC,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,aAAa,eAAe,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,eAAe,IAAI,MAAM,EAAE,CAAC,GAAG,GAAG;AAAA,EACrG,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAAA,EACzD,QAAQ;AACN,UAAM,IAAI,kBAAkB,2DAA2D;AAAA,EACzF;AAGA,SAAO,aAAa,MAAM;AAC5B;AAcA,eAAsB,eACpB,aACA,MAC+B;AAC/B,QAAM,EAAE,aAAa,kBAAkB,UAAU,IAAI;AAErD,QAAM,SAAS,cAAc,WAAW;AACxC,MAAI,OAAO,eAAe,yBAAyB,OAAO,iBAAiB,QAAW;AACpF,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,WAAW;AAC9C,QAAM,EAAE,MAAM,KAAK,IAAI,4BAA4B,QAAQ;AAM3D,QAAM,WAAW,MAAM,WAAW;AAQlC,QAAM,WAAW,MAAM,iBAAiB,IAAI,WAAW,SAAS,UAAU;AAC1E,MAAI,UAAU;AACZ,UAAM,QAAQ,KAAK,MAAM,SAAS,SAAS,EAAE;AAC7C,QAAI,MAAM,WAAW,KAAK,QAAQ;AAChC,YAAM,IAAI;AAAA,QACR,qBAAqB,KAAK,MAAM,oCAAoC,SAAS;AAAA,MAC/E;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,gDAAgD,MAAM,MAAM,6CACnC,KAAK,MAAM;AAAA,IAEzD;AAAA,EACF;AAQA,QAAM,kBAAkB,MAAM,iBAAiB,KAAK,WAAW,UAAU;AACzE,MAAI,gBAAgB,SAAS,GAAG;AAC9B,UAAM,IAAI;AAAA,MACR,UAAU,SAAS;AAAA,IAErB;AAAA,EACF;AAEA,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAM,iBAAiB,QAAQ,WAAW,OAAO,WAAW;AAI5D,MAAI,OAAO,WAAW;AACpB,eAAW,CAAC,YAAY,OAAO,KAAK,OAAO,QAAQ,OAAO,SAAS,GAAG;AACpE,iBAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,cAAM,iBAAiB,IAAI,WAAW,YAAY,IAAI,QAAQ;AAAA,MAChE;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,WAAW,EAAE,QAAQ,KAAK,QAAQ,WAAW,YAAY,MAAe,cAAc,KAAK;AACjG,QAAM,iBAAiB;AAAA,IAAI;AAAA,IAAW;AAAA,IAAS;AAAA,IAC7C;AAAA,MAAoB,EAAE,YAAY,SAAS,IAAI,YAAY,SAAS,EAAE;AAAA,MACpE,EAAE,IAAI,WAAW,IAAI,IAAI,MAAM,KAAK,UAAU,QAAQ,EAAE;AAAA,IAAC;AAAA,EAAC;AAE9D,SAAO,EAAE,WAAW,YAAY,MAAM,QAAQ,KAAK,OAAO;AAC5D;AAgCA,SAAS,UAAU,GAAuD;AACxE,SAAO,gBAAgB,KAAK,EAAE,eAAe;AAC/C;AAuBA,eAAsB,8BACpB,OACA,WACA,MAC4B;AAC5B,QAAM,EAAE,QAAQ,YAAY,IAAI;AAIhC,MAAI,UAAU,IAAI,KAAK,CAAC,KAAK,SAAS,KAAK,CAAC,MAAM,EAAE,YAAY,QAAQ,GAAG;AACzE,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAGA,QAAM,cAAc,MAAM,MAAM,IAAI,WAAW,SAAS,UAAU;AAClE,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI;AAAA,MACR,UAAU,SAAS;AAAA,IAErB;AAAA,EACF;AACA,QAAM,WAAW,KAAK,MAAM,YAAY,SAAS,EAAE;AAInD,MAAI,SAAS,eAAe,UAAa,SAAS,iBAAiB,QAAW;AAC5E,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,qDAAqD,SAAS,UAAU;AAAA,IAC7F;AAAA,EACF;AAKA,QAAM,gBAAgB,MAAM,WAAW,SAAS,cAAc,WAAW;AAUzE,QAAM,kBAAkB,MAAM,MAAM,IAAI,WAAW,YAAY,MAAM;AACrE,QAAM,eAAe,MAAM,MAAM,KAAK,WAAW,UAAU,GAAG,OAAO,CAAC,MAAM,MAAM,MAAM;AACxF,MAAI,YAAY,SAAS,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,UAAU,SAAS,uEAAuE,MAAM;AAAA,IAClG;AAAA,EACF;AAOA,QAAM,uBAAuB,CAAC,GAAG,cAAc,KAAK,CAAC;AACrD,QAAM,YAAY,kBAAmB,KAAK,MAAM,gBAAgB,SAAS,EAAE,EAAkB,OAAO,CAAC;AACrG,QAAM,cAAc,oBAAoB,QAAQ,qBAAqB,MAAM,CAAC,MAAM,KAAK,SAAS;AAChG,MAAI,CAAC,aAAa;AAMhB,UAAM,SAAS,UAAU,IAAI,IACzB,MAAM,qBAAqB,OAAO,WAAW,KAAK,UAAU,IAC5D,KAAK;AAGT,UAAM,WAAW,MAAM,mBAAmB,OAAO,WAAW,EAAE,QAAgB,OAAe,CAAC;AAG9F,UAAM,MAAM,MAAM,MAAM,IAAI,WAAW,YAAY,MAAM;AACzD,QAAI,CAAC,IAAK,OAAM,IAAI,mBAAmB,sBAAsB,MAAM,mBAAmB;AACtF,UAAM,cAAc,KAAK,MAAM,IAAI,SAAS,EAAE;AAC9C,UAAM,MAAM,SAAS;AACrB,QAAI,CAAC,IAAK,OAAM,IAAI,mBAAmB,sBAAsB,MAAM,2CAA2C;AAC9G,UAAM,aAAqC,EAAE,GAAG,YAAY,KAAK;AACjE,eAAW,CAAC,YAAY,GAAG,KAAK,eAAe;AAC7C,iBAAW,UAAU,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACjD;AAUA,UAAM,SAAsB,EAAE,GAAG,aAAa,MAAM,WAAW;AAG/D,UAAM,YAAY,EAAE,GAAG,QAAQ,cAAc,gBAAgB,YAAY,YAAY,EAAE;AACvF,UAAM,YAAY,iBAAiB,UAAU,gBAAgB;AAC7D,UAAM,aAA0B,EAAE,GAAG,WAAW,YAAY,MAAM,cAAc,WAAW,SAAS,EAAE;AACtG,UAAM,MAAM,IAAI,WAAW,YAAY,QAAQ,EAAE,GAAG,KAAK,OAAO,KAAK,UAAU,UAAU,EAAE,CAAC;AAAA,EAC9F;AAMA,QAAM,YAAY,cAAc,IAAI,iBAAiB;AACrD,MAAI,WAAW;AACb,UAAM,SAAS,IAAI,YAAY;AAAA,MAC7B,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,MACX,QAAQ,YAAY;AAAA,MACpB,OAAO;AAAA,IACT,CAAC;AACD,UAAM,iBAAiB,yBAAyB,MAAM;AACtD,UAAM,iBAAiB,0BAA0B,SAAS,MAAM;AAIhE,UAAM,kBAAkB,IAAI,KAAK,MAAM,OAAO,eAAe,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;AACpF,QAAI,CAAC,gBAAgB,IAAI,cAAc,GAAG;AACxC,YAAM,OAAO,OAAO,EAAE,IAAI,aAAa,YAAY,IAAI,IAAI,IAAI,SAAS,GAAG,OAAO,IAAI,aAAa,IAAI,QAAQ,eAAe,CAAC;AAAA,IACjI;AACA,QAAI,CAAC,gBAAgB,IAAI,cAAc,GAAG;AACxC,YAAM,OAAO,OAAO,EAAE,IAAI,aAAa,YAAY,IAAI,IAAI,IAAI,SAAS,GAAG,OAAO,IAAI,aAAa,IAAI,QAAQ,eAAe,CAAC;AAAA,IACjI;AAAA,EACF;AASA,MAAI,UAAU,IAAI,GAAG;AACnB,UAAM,EAAE,YAAY,IAAI,MAAM,OAAO,qBAAoB;AACzD,UAAM,KAAK,MAAM,YAAY;AAAA,MAC3B;AAAA,MACA,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,YAAY,KAAK;AAAA,MACjB,gBAAgB,KAAK;AAAA,IACvB,CAAC;AACD,UAAM,GAAG,KAAK,2BAA2B,WAAW,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,EACjF;AAMA,QAAM,WAAW,EAAE,QAAQ,SAAS,QAAQ,WAAW,SAAS,WAAW,aAAY,oBAAI,KAAK,GAAE,YAAY,EAAE;AAChH,QAAM,MAAM,IAAI,WAAW,SAAS,YAAY,EAAE,GAAG,aAAa,OAAO,KAAK,UAAU,QAAQ,EAAE,CAAC;AAEnG,SAAO,EAAE,WAAW,OAAO;AAC7B;;;AChVA,eAAsB,0BACpB,aACA,aAC4C;AAC5C,QAAM,SAAS,cAAc,WAAW;AACxC,MAAI,OAAO,eAAe,yBAAyB,OAAO,iBAAiB,QAAW;AACpF,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,WAAW;AAC9C,QAAM,EAAE,MAAM,KAAK,IAAI,4BAA4B,QAAQ;AAC3D,QAAM,OAAO,MAAM,WAAW,MAAM,WAAW;AAC/C,QAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAM,MAAyC,CAAC;AAChD,aAAW,CAAC,YAAY,IAAI,KAAK,OAAO,QAAQ,OAAO,WAAW,GAAG;AACnE,UAAM,MAAM,KAAK,IAAI,UAAU;AAC/B,QAAI,QAAQ,OAAW;AACvB,UAAM,OAA0B,CAAC;AACjC,eAAW,CAAC,IAAI,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC5C,YAAM,YAAY,MAAM,iBAAiB,EAAE,YAAY,GAAG,GAAG,KAAK,GAAG;AACrE,YAAM,OAAO,KAAK,MAAM,SAAS;AACjC,WAAK,KAAK;AAAA,QACR;AAAA,QACA,QAAQ,EAAE,GAAG,MAAM,GAAG;AAAA,QACtB,IAAI,IAAI;AAAA,QACR,SAAS,IAAI;AAAA,QACb,GAAI,IAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,QAAQ,IAAI,CAAC;AAAA,QAC3D,GAAI,IAAI,cAAc,SAAY,EAAE,UAAU,IAAI,UAAU,IAAI,CAAC;AAAA,MACnE,CAAC;AAAA,IACH;AACA,QAAI,UAAU,IAAI;AAAA,EACpB;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-SKGMN35F.js → chunk-HS554XAF.js}

@@ -1,6 +1,6 @@
 import {
   OverlayIdMismatchError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-formula/overlay-views/virtual-collection.ts
 var OverlayedCollection = class {
@@ -168,7 +168,7 @@ var OverlayedCollection = class {
   /** @throws — async iteration over a virtual collection is deferred. */
   scan() {
     throw new Error(
-      `OverlayedCollection "${this.spec.name}".scan() is not yet implemented for overlay views (#154). Use \`list()\` for now (no row-count ceiling at niwat scale), or scan the underlying collections directly.`
+      `OverlayedCollection "${this.spec.name}".scan() is not yet implemented for overlay views (#154). Use \`list()\` for now (no row-count ceiling at pilot1 scale), or scan the underlying collections directly.`
     );
   }
   /** @throws — lazy-mode query is not applicable to virtual collections. */
@@ -206,4 +206,4 @@ var OverlayedCollection = class {
 export {
   OverlayedCollection
 };
-//# sourceMappingURL=chunk-SKGMN35F.js.map
+//# sourceMappingURL=chunk-HS554XAF.js.map

package/dist/chunk-HS554XAF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/overlay-views/virtual-collection.ts"],"sourcesContent":["import { OverlayIdMismatchError } from '../../kernel/errors.js'\nimport type { Collection } from '../../kernel/collection.js'\nimport type { OverlayedViewSpec } from './types.js'\n\n/**\n * Virtual-collection proxy returned by `vault.collection(overlayName)`\n * when `overlayName` is a registered `withOverlayedView`.\n *\n * Implements the core `Collection<T>`-shaped read/write surface with\n * merge-on-read semantics:\n *   - `get(id)`: overlay row wins iff `overlay[shadowField] === shadowValue`;\n *     when `spec.mergeMode` is set, an intermediate status may instead pull\n *     a declared subset of fields from the overlay over the base\n *   - `list()`: union of ids, per-id merge applied\n *   - `put(record)` / `put(id, record)`: routes to overlay; id derived\n *     via the base MV's `rowKey` (validated on the two-arg form)\n *   - `delete(id)`: removes the overlay row only; base stays\n *\n * ⚠️ **`query()` THROWS** — it is not implemented for overlay views (#154);\n * use `list()` + filter, or read the base / overlay collections directly.\n * This paragraph used to list `.query()` beside `list()` as working, while\n * naming only `query().live()` among the deferrals — so the header\n * over-claimed the one method on this class that throws, and the deferral\n * list quietly omitted it. Corrected 2026-09-04; the throw-stubs below are\n * the authority, and a doc comment that disagrees with an adjacent `never`\n * return type is worth more scepticism than one that disagrees with distant\n * code.\n *\n * Also deferred, same issue, same shape: `live`, `subscribe`,\n * `query().live()`.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport class OverlayedCollection<T extends Record<string, unknown> = any> {\n  constructor(\n    private readonly spec: OverlayedViewSpec,\n    private readonly baseCollection: Collection<T>,\n    private readonly overlayCollection: Collection<T>,\n    private readonly baseRowKey: ((row: Record<string, unknown>) => string) | undefined,\n  ) {}\n\n  /**\n   * Convenience accessors for advanced callers that need to bypass the\n   * virtual layer (bulk imports, direct overlay queries). Mirrors the\n   * spec's \"direct writes to the underlying overlay collection skip\n   * the validation\" escape hatch.\n   */\n  readonly overlay = {\n    rowKey: (row: Record<string, unknown>): string => {\n      if (!this.baseRowKey) {\n        throw new Error(\n          `Overlay \"${this.spec.name}\": base \"${this.spec.base}\" is not an MV — ` +\n            `cannot auto-derive id from the row. Use \\`put(id, record)\\` instead.`,\n        )\n      }\n      return this.baseRowKey(row)\n    },\n  }\n\n  /** Get the merged row by id. */\n  async get(id: string): Promise<T | null> {\n    const overlayRow = await this.overlayCollection.get(id)\n    const baseRow = await this.baseCollection.get(id)\n    return this.mergeRows(overlayRow, baseRow)\n  }\n\n  /** List union of base + overlay ids, applying the merge per row. */\n  async list(): Promise<T[]> {\n    const baseRows = await this.baseCollection.list()\n    const overlayRows = await this.overlayCollection.list()\n    const idOf = (row: T): string => {\n      // Best-effort: use baseRowKey if available, else assume the row\n      // has a `.id` field (common pattern). The spec requires every\n      // base MV to declare `rowKey`, so the first branch is the\n      // canonical path.\n      if (this.baseRowKey) return this.baseRowKey(row as Record<string, unknown>)\n      const idField = (row as Record<string, unknown>).id\n      return typeof idField === 'string' ? idField : ''\n    }\n    // Key base + overlay rows by id, then union the id sets and run the\n    // same per-id merge `get()` uses. Nulls (overlay-only rows that\n    // don't qualify and have no base) are filtered out.\n    const baseById = new Map<string, T>()\n    const overlayById = new Map<string, T>()\n    for (const row of baseRows) {\n      const id = idOf(row)\n      if (id) baseById.set(id, row)\n    }\n    for (const row of overlayRows) {\n      const id = idOf(row)\n      if (id) overlayById.set(id, row)\n    }\n    const out: T[] = []\n    for (const id of new Set([...baseById.keys(), ...overlayById.keys()])) {\n      const merged = this.mergeRows(overlayById.get(id) ?? null, baseById.get(id) ?? null)\n      if (merged !== null) out.push(merged)\n    }\n    return out\n  }\n\n  /**\n   * Write to the overlay. Two forms:\n   * - `put(record)`: id is derived via the base MV's `rowKey(record)`.\n   *   Throws if the base isn't an MV.\n   * - `put(id, record)`: validates `id === rowKey(record)`; throws\n   *   `OverlayIdMismatchError` on mismatch.\n   */\n  async put(idOrRecord: string | T, maybeRecord?: T): Promise<void> {\n    let id: string\n    let record: T\n    if (maybeRecord === undefined) {\n      // Single-arg form: put(record). Derive id via base rowKey.\n      record = idOrRecord as T\n      if (!this.baseRowKey) {\n        throw new Error(\n          `Overlay \"${this.spec.name}\".put(record): base \"${this.spec.base}\" is not an MV. ` +\n            `Use put(id, record) explicitly.`,\n        )\n      }\n      id = this.baseRowKey(record as Record<string, unknown>)\n    } else {\n      // Two-arg form: put(id, record). Validate against rowKey.\n      id = idOrRecord as string\n      record = maybeRecord\n      if (this.baseRowKey) {\n        const expected = this.baseRowKey(record as Record<string, unknown>)\n        if (id !== expected) {\n          throw new OverlayIdMismatchError(id, expected)\n        }\n      }\n    }\n    await this.overlayCollection.put(id, record)\n  }\n\n  /**\n   * Remove the overlay row only. Idempotent (no-op on absent).\n   * The base row is untouched — if a base row exists for `id`,\n   * subsequent reads return it.\n   */\n  async delete(id: string): Promise<void> {\n    await this.overlayCollection.delete(id)\n  }\n\n  /**\n   * Merge a single id's overlay + base rows into the visible row.\n   *\n   * Priority (first match wins):\n   *  1. Binary shadow win — overlay present AND\n   *     `overlay[shadowField] === shadowValue` → return the overlay row\n   *     entirely. This stays FIRST so the original binary behaviour is\n   *     unchanged whether or not `mergeMode` is configured.\n   *  2. Field-level merge — overlay present, `mergeMode` configured,\n   *     and a rule whose `whenStatus` equals `overlay[shadowField]`.\n   *     The matched rule pulls its `overlayFields` (those present on\n   *     the overlay row) on top of the base row. With no base row, the\n   *     overlay row is returned as-is.\n   *  3. Fallback — return the base row (possibly `null`). An\n   *     overlay-only row that qualifies under neither (1) nor (2) and\n   *     has no base is therefore NOT surfaced.\n   */\n  private mergeRows(overlayRow: T | null, baseRow: T | null): T | null {\n    const shadowField = this.spec.shadowField\n    if (\n      overlayRow !== null &&\n      (overlayRow as Record<string, unknown>)[shadowField] === this.spec.shadowValue\n    ) {\n      return overlayRow\n    }\n    if (overlayRow !== null && this.spec.mergeMode) {\n      const status = (overlayRow as Record<string, unknown>)[shadowField]\n      const rule = this.spec.mergeMode.rules.find((r) => r.whenStatus === status)\n      if (rule) {\n        if (baseRow === null) return overlayRow\n        const overlaySrc = overlayRow as Record<string, unknown>\n        const picked: Record<string, unknown> = {}\n        for (const field of rule.overlayFields) {\n          if (field in overlaySrc) picked[field] = overlaySrc[field]\n        }\n        return { ...(baseRow as Record<string, unknown>), ...picked } as T\n      }\n    }\n    return baseRow\n  }\n\n  // ─── Throw-stubs for the unimplemented Collection<T> surface ───────\n  //\n  // `Vault.collection(name)` widens the return type to `Collection<T>`\n  // for the overlay intercept, but `OverlayedCollection` doesn't\n  // implement the full surface. These stubs catch the common\n  // reactive / chainable APIs with a clear \"not yet implemented\"\n  // error pointing at the relevant issue — so consumers don't hit a\n  // cryptic `undefined is not a function` runtime crash.\n  //\n  // Throw-stubs so consumers get actionable errors rather than cryptic crashes.\n\n  /** @throws — chainable Query<T> over a virtual collection is deferred. */\n  query(): never {\n    throw new Error(\n      `OverlayedCollection \"${this.spec.name}\".query() is not yet implemented for overlay views (#154). ` +\n        `Use \\`list()\\` + filter for now, or read from the underlying \\`${this.spec.base}\\` / \\`${this.spec.overlay}\\` collections directly. ` +\n        `Reactive APIs land in a future MV sub-issue.`,\n    )\n  }\n\n  /** @throws — change-stream subscription over a virtual collection is deferred. */\n  subscribe(): never {\n    throw new Error(\n      `OverlayedCollection \"${this.spec.name}\".subscribe() is not yet implemented for overlay views (#154). ` +\n        `Subscribe to the underlying \\`${this.spec.base}\\` / \\`${this.spec.overlay}\\` collections individually for now. ` +\n        `Merged change-stream lands in a future MV sub-issue.`,\n    )\n  }\n\n  /** @throws — live query over a virtual collection is deferred. */\n  live(): never {\n    throw new Error(\n      `OverlayedCollection \"${this.spec.name}\".live() is not yet implemented for overlay views (#154). ` +\n        `Reactive APIs land in a future MV sub-issue.`,\n    )\n  }\n\n  /** @throws — async iteration over a virtual collection is deferred. */\n  scan(): never {\n    throw new Error(\n      `OverlayedCollection \"${this.spec.name}\".scan() is not yet implemented for overlay views (#154). ` +\n        `Use \\`list()\\` for now (no row-count ceiling at pilot1 scale), or scan the underlying collections directly.`,\n    )\n  }\n\n  /** @throws — lazy-mode query is not applicable to virtual collections. */\n  lazyQuery(): never {\n    throw new Error(\n      `OverlayedCollection \"${this.spec.name}\".lazyQuery() is not supported. ` +\n        `Virtual collections always materialize through base + overlay reads — lazy-mode indexed lookups don't apply.`,\n    )\n  }\n\n  /** @throws — bulk-atomic put is deferred to a future MV sub-issue. */\n  putManyAtomic(): never {\n    throw new Error(\n      `OverlayedCollection \"${this.spec.name}\".putManyAtomic() is not yet implemented for overlay views (#154). ` +\n        `Use sequential \\`.put(record)\\` calls for now, or write to \\`${this.spec.overlay}\\` directly.`,\n    )\n  }\n\n  /** @throws — bulk delete is deferred to a future MV sub-issue. */\n  deleteMany(): never {\n    throw new Error(\n      `OverlayedCollection \"${this.spec.name}\".deleteMany() is not yet implemented for overlay views (#154). ` +\n        `Use sequential \\`.delete(id)\\` calls for now, or operate on \\`${this.spec.overlay}\\` directly.`,\n    )\n  }\n\n  /** @throws — `.first()` over a virtual collection is deferred. */\n  first(): never {\n    throw new Error(\n      `OverlayedCollection \"${this.spec.name}\".first() is not yet implemented for overlay views (#154). ` +\n        `Use \\`(await list())[0]\\` for now.`,\n    )\n  }\n\n  /** @throws — `.count()` over a virtual collection is deferred. */\n  count(): never {\n    throw new Error(\n      `OverlayedCollection \"${this.spec.name}\".count() is not yet implemented for overlay views (#154). ` +\n        `Use \\`(await list()).length\\` for now.`,\n    )\n  }\n}\n"],"mappings":";;;;;AAgCO,IAAM,sBAAN,MAAmE;AAAA,EACxE,YACmB,MACA,gBACA,mBACA,YACjB;AAJiB;AACA;AACA;AACA;AAAA,EAChB;AAAA,EAJgB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASV,UAAU;AAAA,IACjB,QAAQ,CAAC,QAAyC;AAChD,UAAI,CAAC,KAAK,YAAY;AACpB,cAAM,IAAI;AAAA,UACR,YAAY,KAAK,KAAK,IAAI,YAAY,KAAK,KAAK,IAAI;AAAA,QAEtD;AAAA,MACF;AACA,aAAO,KAAK,WAAW,GAAG;AAAA,IAC5B;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,IAAI,IAA+B;AACvC,UAAM,aAAa,MAAM,KAAK,kBAAkB,IAAI,EAAE;AACtD,UAAM,UAAU,MAAM,KAAK,eAAe,IAAI,EAAE;AAChD,WAAO,KAAK,UAAU,YAAY,OAAO;AAAA,EAC3C;AAAA;AAAA,EAGA,MAAM,OAAqB;AACzB,UAAM,WAAW,MAAM,KAAK,eAAe,KAAK;AAChD,UAAM,cAAc,MAAM,KAAK,kBAAkB,KAAK;AACtD,UAAM,OAAO,CAAC,QAAmB;AAK/B,UAAI,KAAK,WAAY,QAAO,KAAK,WAAW,GAA8B;AAC1E,YAAM,UAAW,IAAgC;AACjD,aAAO,OAAO,YAAY,WAAW,UAAU;AAAA,IACjD;AAIA,UAAM,WAAW,oBAAI,IAAe;AACpC,UAAM,cAAc,oBAAI,IAAe;AACvC,eAAW,OAAO,UAAU;AAC1B,YAAM,KAAK,KAAK,GAAG;AACnB,UAAI,GAAI,UAAS,IAAI,IAAI,GAAG;AAAA,IAC9B;AACA,eAAW,OAAO,aAAa;AAC7B,YAAM,KAAK,KAAK,GAAG;AACnB,UAAI,GAAI,aAAY,IAAI,IAAI,GAAG;AAAA,IACjC;AACA,UAAM,MAAW,CAAC;AAClB,eAAW,MAAM,oBAAI,IAAI,CAAC,GAAG,SAAS,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,GAAG;AACrE,YAAM,SAAS,KAAK,UAAU,YAAY,IAAI,EAAE,KAAK,MAAM,SAAS,IAAI,EAAE,KAAK,IAAI;AACnF,UAAI,WAAW,KAAM,KAAI,KAAK,MAAM;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,IAAI,YAAwB,aAAgC;AAChE,QAAI;AACJ,QAAI;AACJ,QAAI,gBAAgB,QAAW;AAE7B,eAAS;AACT,UAAI,CAAC,KAAK,YAAY;AACpB,cAAM,IAAI;AAAA,UACR,YAAY,KAAK,KAAK,IAAI,wBAAwB,KAAK,KAAK,IAAI;AAAA,QAElE;AAAA,MACF;AACA,WAAK,KAAK,WAAW,MAAiC;AAAA,IACxD,OAAO;AAEL,WAAK;AACL,eAAS;AACT,UAAI,KAAK,YAAY;AACnB,cAAM,WAAW,KAAK,WAAW,MAAiC;AAClE,YAAI,OAAO,UAAU;AACnB,gBAAM,IAAI,uBAAuB,IAAI,QAAQ;AAAA,QAC/C;AAAA,MACF;AAAA,IACF;AACA,UAAM,KAAK,kBAAkB,IAAI,IAAI,MAAM;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,IAA2B;AACtC,UAAM,KAAK,kBAAkB,OAAO,EAAE;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBQ,UAAU,YAAsB,SAA6B;AACnE,UAAM,cAAc,KAAK,KAAK;AAC9B,QACE,eAAe,QACd,WAAuC,WAAW,MAAM,KAAK,KAAK,aACnE;AACA,aAAO;AAAA,IACT;AACA,QAAI,eAAe,QAAQ,KAAK,KAAK,WAAW;AAC9C,YAAM,SAAU,WAAuC,WAAW;AAClE,YAAM,OAAO,KAAK,KAAK,UAAU,MAAM,KAAK,CAAC,MAAM,EAAE,eAAe,MAAM;AAC1E,UAAI,MAAM;AACR,YAAI,YAAY,KAAM,QAAO;AAC7B,cAAM,aAAa;AACnB,cAAM,SAAkC,CAAC;AACzC,mBAAW,SAAS,KAAK,eAAe;AACtC,cAAI,SAAS,WAAY,QAAO,KAAK,IAAI,WAAW,KAAK;AAAA,QAC3D;AACA,eAAO,EAAE,GAAI,SAAqC,GAAG,OAAO;AAAA,MAC9D;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,QAAe;AACb,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,KAAK,IAAI,6HAC8B,KAAK,KAAK,IAAI,UAAU,KAAK,KAAK,OAAO;AAAA,IAE/G;AAAA,EACF;AAAA;AAAA,EAGA,YAAmB;AACjB,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,KAAK,IAAI,gGACH,KAAK,KAAK,IAAI,UAAU,KAAK,KAAK,OAAO;AAAA,IAE9E;AAAA,EACF;AAAA;AAAA,EAGA,OAAc;AACZ,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,KAAK,IAAI;AAAA,IAExC;AAAA,EACF;AAAA;AAAA,EAGA,OAAc;AACZ,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,KAAK,IAAI;AAAA,IAExC;AAAA,EACF;AAAA;AAAA,EAGA,YAAmB;AACjB,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,KAAK,IAAI;AAAA,IAExC;AAAA,EACF;AAAA;AAAA,EAGA,gBAAuB;AACrB,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,KAAK,IAAI,mIAC4B,KAAK,KAAK,OAAO;AAAA,IACrF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB;AAClB,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,KAAK,IAAI,iIAC6B,KAAK,KAAK,OAAO;AAAA,IACtF;AAAA,EACF;AAAA;AAAA,EAGA,QAAe;AACb,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,KAAK,IAAI;AAAA,IAExC;AAAA,EACF;AAAA;AAAA,EAGA,QAAe;AACb,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,KAAK,IAAI;AAAA,IAExC;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-HK67PX4J.js → chunk-HW7CMKUG.js}

@@ -24,4 +24,4 @@ export {
   DEFAULT_HEAD_BUCKETS,
   NO_VAULT_HEAD
 };
-//# sourceMappingURL=chunk-HK67PX4J.js.map
+//# sourceMappingURL=chunk-HW7CMKUG.js.map

package/dist/chunk-HW7CMKUG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/vault-head/strategy.ts"],"sourcesContent":["/**\n * `withVaultHead()` — the opt-in detector for **omission** (#1044).\n *\n * ## What it is for, and what it deliberately is not\n *\n * #1041 made every envelope self-authenticating at its identity, and #1042\n * made the merge reject one that is not. What neither can catch is **absence**:\n * a store that serves a genuine, unmodified `v1` when `v7` exists, or serves\n * nothing at all. An authentic old envelope is indistinguishable from an\n * authentic current one without external knowledge of what *should* be there.\n *\n * The head is that external knowledge: an authenticated `{id → version}`\n * manifest the client writes and the store cannot forge. It is **not** a Merkle\n * chain over content — content integrity is already handled, so the head needs\n * only versions.\n *\n * ## Why it is opt-in when AAD is not\n *\n * AAD costs nothing to coordinate and closes *alteration*, so it is kernel. The\n * head costs a write per commit and needs anti-entropy; on a single-device\n * offline vault it defends against nothing. Making it kernel would tax every\n * user for a multi-writer property. ADR 0003, Decision 3.\n *\n * `SECURITY.md` states the split exactly: a store cannot alter, relocate,\n * re-tier, re-author or rewind a record; **without `withVaultHead()` it can\n * still withhold or omit.**\n *\n * ## Bucketed, and why that is not a compromise\n *\n * ADR 0003 left head granularity open and asked for it to be sized early.\n * Measured, at the documented 50K-record vault ceiling:\n *\n * | shape | write cost per commit | detection |\n * |---|---|---|\n * | one per-vault manifest | **1.1 MiB** | per-record |\n * | one per collection | the same problem, renamed | per-record |\n * | **bucketed, 256 buckets** | **~4.4 KiB** | per-record |\n *\n * Bucketing changes *only* write amplification. Each bucket still lists every\n * one of its records' versions, so detection stays per-record — which is why\n * this is not a trade-off between cost and strength. Verifying one pulled\n * record reads one bucket rather than a megabyte.\n *\n * ## Wired as a bus OBSERVER, not a call in `collection.ts`\n *\n * That is what `kernel-surface` means by \"register on the ServiceBus instead of\n * growing this file\", and it keeps the hot write path untouched for anyone who\n * has not opted in: nothing is registered at all, so `hasHandlers` stays false\n * and the dispatch never happens.\n *\n * Both `afterPut` AND `afterDelete`, because a delete is a version bump like\n * any other. A head that stopped tracking deleted records would let a store\n * resurrect one by withholding the tombstone — precisely the omission this\n * exists to catch.\n *\n * ⚠️ The registration must be UNCONDITIONAL on anything but `enabled`. Its first\n * draft sat inside `#registerForgetHooks()`, which returns early when no forget\n * subjects are declared, so the head silently recorded nothing unless the vault\n * happened to use an unrelated feature. The tests caught it only because they\n * asserted a COUNT rather than \"no error\" — a head that records nothing raises\n * no errors and sweeps perfectly clean.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../capsule/index.js'\n\n/** Reserved collection the head's buckets live in. */\nexport const VAULT_HEAD_COLLECTION = '_head' as const\n\n/** Default bucket count — see the sizing table above. */\nexport const DEFAULT_HEAD_BUCKETS = 256\n\nexport interface WithVaultHeadOptions {\n  /**\n   * How many buckets the manifest is split across. Higher means smaller writes\n   * and more reads to sweep the whole vault; lower means the opposite.\n   * Changing it on an existing vault re-homes every entry, so treat it as a\n   * layout decision rather than a tuning knob.\n   */\n  readonly buckets?: number\n}\n\n/** One record's expected state, as the client last committed it. */\nexport interface HeadEntry {\n  readonly collection: string\n  readonly id: string\n  readonly version: number\n}\n\nexport interface VaultHeadStrategy {\n  /**\n   * Is the head actually keeping a manifest?\n   *\n   * An explicit flag rather than an identity check against the stub: the kernel\n   * decides whether to register the write-path observer at all, and\n   * `port-layering` forbids it importing `NO_VAULT_HEAD` to compare. Without\n   * this, every write in a vault that never opted in would still pay a cache\n   * lookup and a no-op call.\n   */\n  readonly enabled: boolean\n\n  /** Bucket a record id lands in — pure, so callers can pre-group a batch. */\n  bucketFor(collection: string, id: string): string\n\n  /**\n   * Record `entry` as the client's expectation for that record.\n   *\n   * Called on every committed write, INSIDE the same logical operation, so\n   * there is no window where the record exists and the head does not know it.\n   */\n  note(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    entry: HeadEntry,\n  ): Promise<void>\n\n  /**\n   * What the client expects for `collection/id`, or `null` if the head has\n   * never seen it.\n   */\n  expected(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    collection: string,\n    id: string,\n  ): Promise<number | null>\n\n  /**\n   * Every record the head knows about in `collection` — the set a sweep\n   * compares against what the store actually serves, which is how DELETION\n   * SUPPRESSION is caught. A withheld record is absent from the store but\n   * present here.\n   */\n  knownIn(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    collection: string,\n  ): Promise<ReadonlyMap<string, number>>\n}\n\nfunction notEnabled(op: string): Error {\n  return new Error(\n    `${op} requires the vault-head capability. Pass \\`vaultHeadStrategy: withVaultHead()\\` ` +\n    'from \"@noy-db/hub/vault-head\" to createNoydb().',\n  )\n}\n\n/**\n * The un-opted-in stub. `note` is a NO-OP rather than a throw: the write path\n * calls it unconditionally, and a vault without the head must simply not keep\n * one. The READ side throws, because asking what the head expects when there is\n * no head is a caller error, not a silent \"nothing to report\" — the latter\n * would look exactly like a clean sweep.\n */\nexport const NO_VAULT_HEAD: VaultHeadStrategy = {\n  enabled: false,\n  bucketFor: () => '',\n  async note() {},\n  async expected() { throw notEnabled('vault.verifyHead()') },\n  async knownIn() { throw notEnabled('vault.verifyHead()') },\n}\n\nexport type { EncryptedEnvelope }\n"],"mappings":";AAoEO,IAAM,wBAAwB;AAG9B,IAAM,uBAAuB;AAyEpC,SAAS,WAAW,IAAmB;AACrC,SAAO,IAAI;AAAA,IACT,GAAG,EAAE;AAAA,EAEP;AACF;AASO,IAAM,gBAAmC;AAAA,EAC9C,SAAS;AAAA,EACT,WAAW,MAAM;AAAA,EACjB,MAAM,OAAO;AAAA,EAAC;AAAA,EACd,MAAM,WAAW;AAAE,UAAM,WAAW,oBAAoB;AAAA,EAAE;AAAA,EAC1D,MAAM,UAAU;AAAE,UAAM,WAAW,oBAAoB;AAAA,EAAE;AAC3D;","names":[]}

package/dist/{chunk-3BVH633C.js → chunk-IMQKWR46.js}

@@ -1,16 +1,14 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-JVIBCBC7.js";
-import {
-  buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
+} from "./chunk-EJLV62NI.js";
 import {
+  buildRecordEnvelope,
   sha256Hex
-} from "./chunk-HPVZCW43.js";
+} from "./chunk-EZGV6F47.js";
 import {
   ReadOnlyError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-audit/portability/withdraw-accessible.ts
 var FROZEN_SNAPSHOTS_COLLECTION = "_frozen_snapshots";
@@ -117,4 +115,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-3BVH633C.js.map
+//# sourceMappingURL=chunk-IMQKWR46.js.map

package/dist/chunk-IMQKWR46.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/portability/withdraw-accessible.ts"],"sourcesContent":["/**\n * `unilateralWithdrawal`: a non-owner extracts their accessible scope\n * AND disposes of the source copy. Destructive; gated by the default-off\n * fail-closed built-in `client-unilateral-withdraw` policy (checked in the\n * UserApi wrapper).\n *\n * Two source dispositions:\n *  - 'delete'  — delete-closure: the records leave the source vault entirely.\n *  - 'freeze'  — the firm retains a cryptographically-frozen, read-only, write-once\n *                snapshot (hash-pinned in the tamper-evident ledger) while the live\n *                records are removed.\n *\n * Ordering guarantees no data loss: the client's re-keyed export bundle (and the\n * freeze snapshot) are produced BEFORE anything is deleted.\n *\n * The `freezeAndDeleteClosure` core is shared with the two-party approval path\n * (`request-withdrawal.ts`).\n */\nimport type { Vault } from '../../kernel/vault.js'\nimport { buildRecordEnvelope, sha256Hex } from '../../capsule/index.js'\nimport { ReadOnlyError } from '../../kernel/errors.js'\nimport { resolveAccessibleCollections, buildAccessibleBundle } from './export-accessible.js'\n\nexport const FROZEN_SNAPSHOTS_COLLECTION = '_frozen_snapshots'\nconst ENC = new TextEncoder()\n\n/** 24-hex-char random id (used for withdrawal ids + request ids). */\nexport function randomId(): string {\n  const b = globalThis.crypto.getRandomValues(new Uint8Array(12))\n  return Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('')\n}\n\nexport interface FrozenSnapshotRef {\n  readonly withdrawalId: string\n  readonly sha256: string\n  readonly recordCount: number\n  readonly frozenAt: string\n}\n\nexport interface WithdrawAccessibleOptions {\n  /** Legal/contractual basis recorded in the audit (e.g. 'gdpr-art-17'). */\n  readonly legalBasis: string\n  /** Re-key the exported bundle to a new owner secret. */\n  readonly reKey?: { readonly secret: string }\n  /** Source disposition. Default 'delete'. */\n  readonly disposition?: 'delete' | 'freeze'\n  readonly scope?: { readonly collections?: readonly string[] }\n  /** Stable id for idempotent resume (default random). */\n  readonly withdrawalId?: string\n}\n\nexport interface WithdrawResult {\n  readonly bundle: Uint8Array\n  readonly snapshot?: FrozenSnapshotRef\n}\n\n/**\n * Freeze a write-once, hash-pinned snapshot of the current ciphertext for\n * `collections` WITHOUT touching the live records. Returns the snapshot ref.\n *\n * This is the non-destructive core shared by two callers:\n *  - `freezeAndDeleteClosure` (withdrawal, disposition `'freeze'`) — which\n *    pins the snapshot and THEN delete-closures the live records.\n *  - FR-6 `liberateVault` (custody) — which pins a PRE-liberation evidence\n *    snapshot but PRESERVES the live data for the new owner (operational\n *    continuity; liberation transfers, it does not erase).\n *\n * The snapshot put is write-once (CAS expectedVersion 0) and the ledger pin is\n * appended on success, so a crashed run re-run with the same `withdrawalId` is\n * safe. The snapshot is taken under the vault's own firm-owned DEKs — no re-key.\n */\nexport async function freezeSnapshotOnly(\n  vault: Vault,\n  collections: readonly string[],\n  opts: { actorUserId: string; withdrawalId?: string },\n): Promise<FrozenSnapshotRef> {\n  const { name: vaultName, adapter } = vault._introspectState()\n\n  // Enumerate the closure (record ids per collection).\n  const closure: Array<{ collection: string; id: string }> = []\n  for (const c of collections) {\n    for (const id of await adapter.list(vaultName, c)) closure.push({ collection: c, id })\n  }\n\n  const withdrawalId = opts.withdrawalId ?? `wd-${randomId()}`\n  const snap: Record<string, Record<string, unknown>> = {}\n  for (const { collection, id } of closure) {\n    const env = await adapter.get(vaultName, collection, id)\n    if (env) (snap[collection] ??= {})[id] = env\n  }\n  const frozenAt = new Date().toISOString()\n  const body = JSON.stringify({ withdrawalId, frozenAt, by: opts.actorUserId, collections: snap })\n  const sha = await sha256Hex(ENC.encode(body))\n  // Write-once: expectedVersion 0 rejects an overwrite (idempotent resume).\n  await adapter.put(\n    vaultName,\n    FROZEN_SNAPSHOTS_COLLECTION,\n    withdrawalId,\n    buildRecordEnvelope(\n      { collection: FROZEN_SNAPSHOTS_COLLECTION, id: withdrawalId, by: opts.actorUserId, version: 1 },\n      { ts: frozenAt, iv: '', data: body},\n    ),\n    0,\n  )\n  // Hash-pin into the tamper-evident ledger — makes the snapshot provably unaltered.\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: opts.actorUserId, payloadHash: '',\n    reason: `withdrawal-frozen-snapshot:${withdrawalId}:${sha}`,\n  })\n  return { withdrawalId, sha256: sha, recordCount: closure.length, frozenAt }\n}\n\n/**\n * Dispose of the source records for `collections`: optionally freeze a\n * write-once hash-pinned snapshot of the original ciphertext, then\n * delete-closure the live records. Returns the snapshot ref on freeze.\n *\n * Caller MUST have produced the portable bundle FIRST — this is destructive.\n * The delete is best-effort + idempotent (re-deleting an absent record is a\n * no-op) and the snapshot put is write-once (CAS expectedVersion 0), so a\n * crashed run re-run with the same `withdrawalId` is safe.\n */\nexport async function freezeAndDeleteClosure(\n  vault: Vault,\n  collections: readonly string[],\n  opts: { disposition: 'delete' | 'freeze'; actorUserId: string; withdrawalId?: string },\n): Promise<FrozenSnapshotRef | undefined> {\n  // freeze: pin a write-once, hash-pinned snapshot BEFORE any delete. The\n  // snapshot-only core is shared with FR-6 liberation (which never deletes).\n  const snapshot = opts.disposition === 'freeze'\n    ? await freezeSnapshotOnly(vault, collections, {\n        actorUserId: opts.actorUserId,\n        ...(opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}),\n      })\n    : undefined\n\n  // delete-closure — only after the snapshot is durable.\n  const { name: vaultName, adapter } = vault._introspectState()\n  for (const c of collections) {\n    for (const id of await adapter.list(vaultName, c)) {\n      await vault.collection(c).delete(id)\n    }\n  }\n\n  return snapshot\n}\n\nexport async function withdrawAccessibleData(\n  vault: Vault,\n  opts: WithdrawAccessibleOptions,\n): Promise<WithdrawResult> {\n  const { keyring } = vault._introspectState()\n  const disposition = opts.disposition ?? 'delete'\n\n  // Owner-class roles hold blanket authority — they use extractPartition.\n  if (keyring.role === 'owner' || keyring.role === 'admin') {\n    throw new ReadOnlyError(\n      'unilateralWithdrawal is the scoped self-service path; an owner/admin should use extractPartition',\n    )\n  }\n  // FR-6: a custodian must NOT destructively SEVER the vault. It holds the DEKs\n  // and operates fully, but ownership is claimed only through the audited\n  // Liberate ceremony — never by a one-sided delete/freeze withdrawal. Fires\n  // BEFORE the operator rw-scope path below (where a custodian would otherwise\n  // be rejected with the wrong \"requires rw access\" message).\n  if (keyring.role === 'custodian') {\n    throw new ReadOnlyError(\n      'a custodian cannot destructively withdraw/sever; use vault.custody.liberate for an audited ownership claim',\n    )\n  }\n  // client/viewer are read-only by construction (see hasWritePermission): a\n  // destructive withdrawal they cannot self-serve — they use the two-party\n  // requestWithdrawal flow where firm authority executes the delete-closure.\n  if (keyring.role === 'client' || keyring.role === 'viewer') {\n    throw new ReadOnlyError(\n      'read-only role cannot self-serve a destructive withdrawal — use requestWithdrawal (two-party)',\n    )\n  }\n  // Operator path: destructive ops need rw on the whole scope.\n  const collections = resolveAccessibleCollections(keyring, opts.scope, true)\n  if (!collections || collections.length === 0) {\n    throw new ReadOnlyError(\n      'unilateralWithdrawal requires rw access on the withdrawn collections — use requestWithdrawal for read-only scope',\n    )\n  }\n\n  // 1. Produce the client's re-keyed portable copy FIRST (nothing destroyed yet).\n  const bundle = await buildAccessibleBundle(vault, collections, opts.reKey)\n\n  // 2. + 3. freeze (optional) then delete-closure.\n  const snapshot = await freezeAndDeleteClosure(vault, collections, {\n    disposition, actorUserId: keyring.userId, ...(opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}),\n  })\n\n  // 4. audit\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: keyring.userId, payloadHash: '',\n    reason: `user-unilateral-withdrawal:${keyring.userId}:${disposition}:${opts.legalBasis}`,\n  })\n\n  return snapshot ? { bundle, snapshot } : { bundle }\n}\n"],"mappings":";;;;;;;;;;;;;AAuBO,IAAM,8BAA8B;AAC3C,IAAM,MAAM,IAAI,YAAY;AAGrB,SAAS,WAAmB;AACjC,QAAM,IAAI,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC9D,SAAO,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACtE;AAyCA,eAAsB,mBACpB,OACA,aACA,MAC4B;AAC5B,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAG5D,QAAM,UAAqD,CAAC;AAC5D,aAAW,KAAK,aAAa;AAC3B,eAAW,MAAM,MAAM,QAAQ,KAAK,WAAW,CAAC,EAAG,SAAQ,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC;AAAA,EACvF;AAEA,QAAM,eAAe,KAAK,gBAAgB,MAAM,SAAS,CAAC;AAC1D,QAAM,OAAgD,CAAC;AACvD,aAAW,EAAE,YAAY,GAAG,KAAK,SAAS;AACxC,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,YAAY,EAAE;AACvD,QAAI,IAAK,EAAC,KAAK,UAAU,MAAM,CAAC,GAAG,EAAE,IAAI;AAAA,EAC3C;AACA,QAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,QAAM,OAAO,KAAK,UAAU,EAAE,cAAc,UAAU,IAAI,KAAK,aAAa,aAAa,KAAK,CAAC;AAC/F,QAAM,MAAM,MAAM,UAAU,IAAI,OAAO,IAAI,CAAC;AAE5C,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,EAAE,YAAY,6BAA6B,IAAI,cAAc,IAAI,KAAK,aAAa,SAAS,EAAE;AAAA,MAC9F,EAAE,IAAI,UAAU,IAAI,IAAI,MAAM,KAAI;AAAA,IACpC;AAAA,IACA;AAAA,EACF;AAEA,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,KAAK;AAAA,IAAa,aAAa;AAAA,IAC3F,QAAQ,8BAA8B,YAAY,IAAI,GAAG;AAAA,EAC3D,CAAC;AACD,SAAO,EAAE,cAAc,QAAQ,KAAK,aAAa,QAAQ,QAAQ,SAAS;AAC5E;AAYA,eAAsB,uBACpB,OACA,aACA,MACwC;AAGxC,QAAM,WAAW,KAAK,gBAAgB,WAClC,MAAM,mBAAmB,OAAO,aAAa;AAAA,IAC3C,aAAa,KAAK;AAAA,IAClB,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,EACjE,CAAC,IACD;AAGJ,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,aAAW,KAAK,aAAa;AAC3B,eAAW,MAAM,MAAM,QAAQ,KAAK,WAAW,CAAC,GAAG;AACjD,YAAM,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE;AAAA,IACrC;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,uBACpB,OACA,MACyB;AACzB,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAC3C,QAAM,cAAc,KAAK,eAAe;AAGxC,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAMA,MAAI,QAAQ,SAAS,aAAa;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS,YAAY,QAAQ,SAAS,UAAU;AAC1D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,6BAA6B,SAAS,KAAK,OAAO,IAAI;AAC1E,MAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,SAAS,MAAM,sBAAsB,OAAO,aAAa,KAAK,KAAK;AAGzE,QAAM,WAAW,MAAM,uBAAuB,OAAO,aAAa;AAAA,IAChE;AAAA,IAAa,aAAa,QAAQ;AAAA,IAAQ,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,EAC3G,CAAC;AAGD,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,QAAQ;AAAA,IAAQ,aAAa;AAAA,IACzF,QAAQ,8BAA8B,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,UAAU;AAAA,EACxF,CAAC;AAED,SAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,EAAE,OAAO;AACpD;","names":[]}

package/dist/{chunk-R42NSZI6.js → chunk-IUBMZPHM.js}

@@ -1,17 +1,17 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-3BVH633C.js";
+} from "./chunk-IMQKWR46.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-JVIBCBC7.js";
+} from "./chunk-EJLV62NI.js";
 import {
   buildRecordEnvelope
-} from "./chunk-SZJ3DLZA.js";
+} from "./chunk-EZGV6F47.js";
 import {
   NoydbError
-} from "./chunk-7O3Y4PPD.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-audit/portability/request-withdrawal.ts
 var WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
@@ -35,7 +35,7 @@ async function readRequest(vault, requestId) {
   const { name: vaultName, adapter } = vault._introspectState();
   const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, requestId);
   if (!env) throw new WithdrawalRequestError(`withdrawal request "${requestId}" not found`);
-  return { req: JSON.parse(env._data), version: env._v };
+  return { req: JSON.parse(env._data ?? ""), version: env._v };
 }
 async function requestWithdrawal(vault, opts = {}) {
   const { keyring } = vault._introspectState();
@@ -76,7 +76,7 @@ async function listWithdrawalRequests(vault, opts = {}) {
   for (const id of ids) {
     const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, id);
     if (!env) continue;
-    const req = JSON.parse(env._data);
+    const req = JSON.parse(env._data ?? "");
     if (!opts.status || req.status === opts.status) out.push(req);
   }
   return out;
@@ -158,4 +158,4 @@ export {
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-R42NSZI6.js.map
+//# sourceMappingURL=chunk-IUBMZPHM.js.map

package/dist/chunk-IUBMZPHM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/portability/request-withdrawal.ts"],"sourcesContent":["/**\n * Two-party withdrawal ceremony.\n *\n * The conservative counterpart to `unilateralWithdrawal`: a non-owner —\n * including a read-only `client`/`viewer` who cannot self-serve a deletion —\n * files a durable REQUEST; an owner/admin reviews it and either APPROVES\n * (extract-and-dispose under firm authority) or REJECTS it. Every step is\n * audited in the tamper-evident ledger.\n *\n *   requester:  vault.user.requestWithdrawal({ scope, disposition?, legalBasis? })\n *   owner:      vault.user.listWithdrawalRequests()\n *               vault.user.approveWithdrawal(requestId, { reKey })  → { bundle, snapshot? }\n *               vault.user.rejectWithdrawal(requestId, { reason })\n *\n * Requests live in the reserved `_user_withdrawal_requests` namespace. The\n * record body is plaintext metadata (collection names + disposition + legal\n * basis — none secret in this trust model; the owner sees the data anyway) and\n * carries NO secret: the re-key secret is supplied by the approver at\n * approval time and conveyed to the requester out-of-band, so no secret is\n * stored at rest.\n */\nimport type { Vault } from '../../kernel/vault.js'\nimport { buildRecordEnvelope } from '../../capsule/index.js'\nimport { NoydbError } from '../../kernel/errors.js'\nimport { resolveAccessibleCollections, buildAccessibleBundle } from './export-accessible.js'\nimport { freezeAndDeleteClosure, randomId, type FrozenSnapshotRef, type WithdrawResult } from './withdraw-accessible.js'\n\nexport const WITHDRAWAL_REQUESTS_COLLECTION = '_user_withdrawal_requests'\n\n/** Raised when a request is missing, already decided, or expired. */\nexport class WithdrawalRequestError extends NoydbError {\n  constructor(message: string) {\n    super('WITHDRAWAL_REQUEST', message)\n    this.name = 'WithdrawalRequestError'\n  }\n}\n\nexport type WithdrawalRequestStatus = 'pending' | 'approved' | 'rejected'\n\nexport interface WithdrawalRequest {\n  readonly requestId: string\n  readonly requester: string\n  readonly collections: readonly string[]\n  readonly disposition: 'delete' | 'freeze'\n  readonly legalBasis?: string\n  readonly status: WithdrawalRequestStatus\n  readonly requestedAt: string\n  readonly expiresAt?: string\n  readonly decidedAt?: string\n  readonly decidedBy?: string\n  readonly rejectReason?: string\n  readonly snapshotSha256?: string\n}\n\nexport interface RequestWithdrawalOptions {\n  readonly scope?: { readonly collections?: readonly string[] }\n  readonly disposition?: 'delete' | 'freeze'\n  readonly legalBasis?: string\n  /** Time-to-live in ms; after this the request can no longer be approved. */\n  readonly expiresInMs?: number\n}\n\nexport interface RequestWithdrawalResult {\n  readonly requestId: string\n  readonly status: WithdrawalRequestStatus\n  readonly expiresAt?: string\n}\n\nfunction writeRequest(vault: Vault, req: WithdrawalRequest, expectedVersion: number): Promise<void> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const body = JSON.stringify(req)\n  const actor = req.decidedBy ?? req.requester\n  const env = buildRecordEnvelope(\n    { collection: WITHDRAWAL_REQUESTS_COLLECTION, id: req.requestId, by: actor, version: expectedVersion + 1 },\n    { ts: req.decidedAt ?? req.requestedAt, iv: '', data: body},\n  )\n  return adapter.put(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, req.requestId, env, expectedVersion)\n}\n\nasync function readRequest(vault: Vault, requestId: string): Promise<{ req: WithdrawalRequest; version: number }> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, requestId)\n  if (!env) throw new WithdrawalRequestError(`withdrawal request \"${requestId}\" not found`)\n  return { req: JSON.parse(env._data ?? '') as WithdrawalRequest, version: env._v }\n}\n\n/**\n * Requester side. Files a durable request for the caller's accessible scope.\n * Gated by `user-request-withdrawal` (checked in the UserApi wrapper).\n */\nexport async function requestWithdrawal(\n  vault: Vault,\n  opts: RequestWithdrawalOptions = {},\n): Promise<RequestWithdrawalResult> {\n  const { keyring } = vault._introspectState()\n  // Resolve the requester's accessible collections (read access defines \"theirs\";\n  // the owner — who can delete anything — executes the disposition on approval).\n  const collections = resolveAccessibleCollections(keyring, opts.scope, false)\n  if (!collections || collections.length === 0) {\n    throw new WithdrawalRequestError(\n      'requestWithdrawal needs a concrete scope.collections (the caller has all-collection access — name the collections to withdraw)',\n    )\n  }\n  const requestId = `wr-${randomId()}`\n  const requestedAt = new Date().toISOString()\n  const req: WithdrawalRequest = {\n    requestId, requester: keyring.userId, collections, disposition: opts.disposition ?? 'delete',\n    status: 'pending', requestedAt,\n    ...(opts.legalBasis ? { legalBasis: opts.legalBasis } : {}),\n    ...(opts.expiresInMs ? { expiresAt: new Date(Date.parse(requestedAt) + opts.expiresInMs).toISOString() } : {}),\n  }\n  await writeRequest(vault, req, 0) // create-only\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: keyring.userId, payloadHash: '',\n    reason: `user-withdrawal-request:${requestId}:${keyring.userId}`,\n  })\n  return { requestId, status: 'pending', ...(req.expiresAt ? { expiresAt: req.expiresAt } : {}) }\n}\n\n/** Owner side. List filed requests (optionally by status). */\nexport async function listWithdrawalRequests(\n  vault: Vault,\n  opts: { status?: WithdrawalRequestStatus } = {},\n): Promise<WithdrawalRequest[]> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const ids = await adapter.list(vaultName, WITHDRAWAL_REQUESTS_COLLECTION)\n  const out: WithdrawalRequest[] = []\n  for (const id of ids) {\n    const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, id)\n    if (!env) continue\n    const req = JSON.parse(env._data ?? '') as WithdrawalRequest\n    if (!opts.status || req.status === opts.status) out.push(req)\n  }\n  return out\n}\n\nfunction assertApprover(vault: Vault): string {\n  const { keyring } = vault._introspectState()\n  // FR-6: custodian is INTENTIONALLY excluded (SAFER default — review flag).\n  // Approving a two-party withdrawal is a destructive extract-and-dispose\n  // exercised under FIRM authority — a governance act adjacent to grant/revoke,\n  // which a non-owning custodian cannot do. It stays owner/admin-only.\n  if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n    throw new WithdrawalRequestError('approveWithdrawal / rejectWithdrawal require an owner or admin')\n  }\n  return keyring.userId\n}\n\nfunction assertPending(req: WithdrawalRequest): void {\n  if (req.status !== 'pending') {\n    throw new WithdrawalRequestError(`withdrawal request \"${req.requestId}\" is already ${req.status}`)\n  }\n  if (req.expiresAt && Date.now() > Date.parse(req.expiresAt)) {\n    throw new WithdrawalRequestError(`withdrawal request \"${req.requestId}\" expired at ${req.expiresAt}`)\n  }\n}\n\nexport interface ApproveWithdrawalOptions {\n  /** Re-key the handed-back bundle to a secret the requester will use. */\n  readonly reKey?: { readonly secret: string }\n}\n\n/**\n * Owner side. Extract the requester's recorded scope under firm authority,\n * dispose of the source per the request's disposition, mark the request\n * approved, and return the re-keyed bundle to hand back. Gated by\n * `approve-user-withdrawal` (checked in the UserApi wrapper) + owner/admin role.\n */\nexport async function approveWithdrawal(\n  vault: Vault,\n  requestId: string,\n  opts: ApproveWithdrawalOptions = {},\n): Promise<WithdrawResult> {\n  const approver = assertApprover(vault)\n  const { req, version } = await readRequest(vault, requestId)\n  assertPending(req)\n\n  // 1. Produce the requester's re-keyed portable copy FIRST (owner authority\n  //    holds every DEK, so the recorded collections are all readable).\n  const bundle = await buildAccessibleBundle(vault, [...req.collections], opts.reKey)\n\n  // 2. + 3. dispose of the source (freeze snapshot, optional → delete-closure).\n  const snapshot: FrozenSnapshotRef | undefined = await freezeAndDeleteClosure(vault, req.collections, {\n    disposition: req.disposition, actorUserId: approver, withdrawalId: `wd-${requestId}`,\n  })\n\n  // 4. mark approved + audit (OCC against the version we read).\n  const decidedAt = new Date().toISOString()\n  await writeRequest(vault, {\n    ...req, status: 'approved', decidedAt, decidedBy: approver,\n    ...(snapshot ? { snapshotSha256: snapshot.sha256 } : {}),\n  }, version)\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: approver, payloadHash: '',\n    reason: `user-withdrawal-approved:${requestId}:${req.requester}:${req.disposition}`,\n  })\n\n  return snapshot ? { bundle, snapshot } : { bundle }\n}\n\nexport interface RejectWithdrawalOptions {\n  readonly reason?: string\n}\n\n/** Owner side. Decline a pending request (no data is touched). */\nexport async function rejectWithdrawal(\n  vault: Vault,\n  requestId: string,\n  opts: RejectWithdrawalOptions = {},\n): Promise<WithdrawalRequest> {\n  const approver = assertApprover(vault)\n  const { req, version } = await readRequest(vault, requestId)\n  assertPending(req)\n  const decidedAt = new Date().toISOString()\n  const updated: WithdrawalRequest = {\n    ...req, status: 'rejected', decidedAt, decidedBy: approver,\n    ...(opts.reason ? { rejectReason: opts.reason } : {}),\n  }\n  await writeRequest(vault, updated, version)\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: approver, payloadHash: '',\n    reason: `user-withdrawal-rejected:${requestId}:${req.requester}`,\n  })\n  return updated\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA2BO,IAAM,iCAAiC;AAGvC,IAAM,yBAAN,cAAqC,WAAW;AAAA,EACrD,YAAY,SAAiB;AAC3B,UAAM,sBAAsB,OAAO;AACnC,SAAK,OAAO;AAAA,EACd;AACF;AAiCA,SAAS,aAAa,OAAc,KAAwB,iBAAwC;AAClG,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,QAAM,QAAQ,IAAI,aAAa,IAAI;AACnC,QAAM,MAAM;AAAA,IACV,EAAE,YAAY,gCAAgC,IAAI,IAAI,WAAW,IAAI,OAAO,SAAS,kBAAkB,EAAE;AAAA,IACzG,EAAE,IAAI,IAAI,aAAa,IAAI,aAAa,IAAI,IAAI,MAAM,KAAI;AAAA,EAC5D;AACA,SAAO,QAAQ,IAAI,WAAW,gCAAgC,IAAI,WAAW,KAAK,eAAe;AACnG;AAEA,eAAe,YAAY,OAAc,WAAyE;AAChH,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gCAAgC,SAAS;AAClF,MAAI,CAAC,IAAK,OAAM,IAAI,uBAAuB,uBAAuB,SAAS,aAAa;AACxF,SAAO,EAAE,KAAK,KAAK,MAAM,IAAI,SAAS,EAAE,GAAwB,SAAS,IAAI,GAAG;AAClF;AAMA,eAAsB,kBACpB,OACA,OAAiC,CAAC,GACA;AAClC,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAG3C,QAAM,cAAc,6BAA6B,SAAS,KAAK,OAAO,KAAK;AAC3E,MAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,MAAM,SAAS,CAAC;AAClC,QAAM,eAAc,oBAAI,KAAK,GAAE,YAAY;AAC3C,QAAM,MAAyB;AAAA,IAC7B;AAAA,IAAW,WAAW,QAAQ;AAAA,IAAQ;AAAA,IAAa,aAAa,KAAK,eAAe;AAAA,IACpF,QAAQ;AAAA,IAAW;AAAA,IACnB,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IACzD,GAAI,KAAK,cAAc,EAAE,WAAW,IAAI,KAAK,KAAK,MAAM,WAAW,IAAI,KAAK,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC;AAAA,EAC9G;AACA,QAAM,aAAa,OAAO,KAAK,CAAC;AAChC,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,QAAQ;AAAA,IAAQ,aAAa;AAAA,IACzF,QAAQ,2BAA2B,SAAS,IAAI,QAAQ,MAAM;AAAA,EAChE,CAAC;AACD,SAAO,EAAE,WAAW,QAAQ,WAAW,GAAI,IAAI,YAAY,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC,EAAG;AAChG;AAGA,eAAsB,uBACpB,OACA,OAA6C,CAAC,GAChB;AAC9B,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,MAAM,MAAM,QAAQ,KAAK,WAAW,8BAA8B;AACxE,QAAM,MAA2B,CAAC;AAClC,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gCAAgC,EAAE;AAC3E,QAAI,CAAC,IAAK;AACV,UAAM,MAAM,KAAK,MAAM,IAAI,SAAS,EAAE;AACtC,QAAI,CAAC,KAAK,UAAU,IAAI,WAAW,KAAK,OAAQ,KAAI,KAAK,GAAG;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAsB;AAC5C,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAK3C,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI,uBAAuB,gEAAgE;AAAA,EACnG;AACA,SAAO,QAAQ;AACjB;AAEA,SAAS,cAAc,KAA8B;AACnD,MAAI,IAAI,WAAW,WAAW;AAC5B,UAAM,IAAI,uBAAuB,uBAAuB,IAAI,SAAS,gBAAgB,IAAI,MAAM,EAAE;AAAA,EACnG;AACA,MAAI,IAAI,aAAa,KAAK,IAAI,IAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC3D,UAAM,IAAI,uBAAuB,uBAAuB,IAAI,SAAS,gBAAgB,IAAI,SAAS,EAAE;AAAA,EACtG;AACF;AAaA,eAAsB,kBACpB,OACA,WACA,OAAiC,CAAC,GACT;AACzB,QAAM,WAAW,eAAe,KAAK;AACrC,QAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,YAAY,OAAO,SAAS;AAC3D,gBAAc,GAAG;AAIjB,QAAM,SAAS,MAAM,sBAAsB,OAAO,CAAC,GAAG,IAAI,WAAW,GAAG,KAAK,KAAK;AAGlF,QAAM,WAA0C,MAAM,uBAAuB,OAAO,IAAI,aAAa;AAAA,IACnG,aAAa,IAAI;AAAA,IAAa,aAAa;AAAA,IAAU,cAAc,MAAM,SAAS;AAAA,EACpF,CAAC;AAGD,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,aAAa,OAAO;AAAA,IACxB,GAAG;AAAA,IAAK,QAAQ;AAAA,IAAY;AAAA,IAAW,WAAW;AAAA,IAClD,GAAI,WAAW,EAAE,gBAAgB,SAAS,OAAO,IAAI,CAAC;AAAA,EACxD,GAAG,OAAO;AACV,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO;AAAA,IAAU,aAAa;AAAA,IACnF,QAAQ,4BAA4B,SAAS,IAAI,IAAI,SAAS,IAAI,IAAI,WAAW;AAAA,EACnF,CAAC;AAED,SAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,EAAE,OAAO;AACpD;AAOA,eAAsB,iBACpB,OACA,WACA,OAAgC,CAAC,GACL;AAC5B,QAAM,WAAW,eAAe,KAAK;AACrC,QAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,YAAY,OAAO,SAAS;AAC3D,gBAAc,GAAG;AACjB,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,UAA6B;AAAA,IACjC,GAAG;AAAA,IAAK,QAAQ;AAAA,IAAY;AAAA,IAAW,WAAW;AAAA,IAClD,GAAI,KAAK,SAAS,EAAE,cAAc,KAAK,OAAO,IAAI,CAAC;AAAA,EACrD;AACA,QAAM,aAAa,OAAO,SAAS,OAAO;AAC1C,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO;AAAA,IAAU,aAAa;AAAA,IACnF,QAAQ,4BAA4B,SAAS,IAAI,IAAI,SAAS;AAAA,EAChE,CAAC;AACD,SAAO;AACT;","names":[]}