enigma-memory 0.1.18 → 0.1.22

package/packages/vault/src/index.js

@@ -13,18 +13,22 @@ import {
 } from 'node:crypto';
 import {
   canonicalize,
-  createMemoryAddress,
   createReceipt,
   generateSigningKeyPair,
   MerkleSet,
   hmacSha256Hex,
   receiptHash,
   sha256Hex,
+  verifyReceiptChain,
 } from '../../core/src/index.js';
 
-const VAULT_SCHEMA = 'enigma.vault.local.v1';
-const EVENT_SCHEMA = 'enigma.memory_event.v1';
-const MEMORY_DOMAIN = 'enigma.memory.v1';
+export const VAULT_SCHEMA = 'enigma.vault.local.v1';
+export const VAULT_BUNDLE_SCHEMA = 'enigma.vault_bundle.v1';
+export const MEMORY_OBJECT_SCHEMA = 'enigma.memory_object.v1';
+export const EVENT_SCHEMA = 'enigma.memory_event.v1';
+const MEMORY_DOMAIN = 'enigma.memory.v2';
+const CONTENT_AAD_DOMAIN = 'enigma.memory.content_aad.v1';
+const PRIVATE_MEMORY_SCHEMA = 'enigma.memory_private.v1';
 const ZERO_ROOT = new MerkleSet().root();
 const RECEIPT_PLAINTEXT_KEYS = new Set(['content', 'plaintext', 'text', 'memory', 'prompt', 'response']);
 const PUBLIC_PLAINTEXT_KEYS = new Set([
@@ -49,9 +53,20 @@ const PUBLIC_PLAINTEXT_KEYS = new Set([
 ]);
 const SAFE_METADATA_DIGEST_RE = /^(?:sha256:)?[a-f0-9]{64}$|^hmac-sha256:[a-f0-9]{64}$/;
 const SOURCE_REF_ROOT_RE = /^sha256:[a-f0-9]{64}$/;
-
 export const KEYRING_ENCRYPTED_TYPE = 'local_secret_encrypted';
 export const KEYRING_PLAINTEXT_TYPE = 'local_secret';
+export const DEFAULT_KDF_SPEC = {
+  algorithm: 'scrypt',
+  n: 16384,
+  r: 8,
+  p: 1,
+  maxmem: 64 * 1024 * 1024,
+};
+export const PBKDF2_KDF_SPEC = {
+  algorithm: 'pbkdf2',
+  iterations: 600000,
+  hash: 'sha256',
+};
 const DERIVED_KEY_LENGTH = 128; // 32 bytes each: KEK, vaultKey, addressKey, signingSeed
 const SALT_LENGTH = 16;
 const IV_LENGTH = 12;
@@ -99,44 +114,54 @@ function isSafeMetadataPrimitive(key, value) {
   return false;
 }
 
-function commitMetadataValue(out, key, value) {
-  out[metadataCommitmentKey(key)] = asSha256(isMetadataPrimitive(value) ? String(value) : canonical(value));
+function privateValueCommitment(key, value) {
+  const encoded = typeof value === 'string' ? value : canonical(value);
+  return key ? `sha256:${asHmacSha256(key, encoded)}` : asSha256(encoded);
+}
+
+function commitMetadataValue(out, key, value, commitmentKey) {
+  out[metadataCommitmentKey(key)] = privateValueCommitment(
+    commitmentKey,
+    isMetadataPrimitive(value) ? String(value) : value,
+  );
 }
 
-function sanitizeSourceRefValue(value) {
+function sanitizeSourceRefValue(value, commitmentKey) {
   if (value === undefined || value === null) return undefined;
-  if (typeof value === 'string') return asSha256(value);
+  if (typeof value === 'string') {
+    return SAFE_METADATA_DIGEST_RE.test(value) ? value : privateValueCommitment(commitmentKey, value);
+  }
   if (['number', 'boolean'].includes(typeof value)) return value;
-  if (Array.isArray(value)) return value.map(sanitizeSourceRefValue).filter((item) => item !== undefined);
+  if (Array.isArray(value)) return value.map((item) => sanitizeSourceRefValue(item, commitmentKey)).filter((item) => item !== undefined);
   if (typeof value !== 'object') return undefined;
 
   const out = {};
   for (const [key, item] of Object.entries(value)) {
     if (isSourceRefPlaintextLikeKey(key)) {
       if (item !== undefined && item !== null && ['string', 'number', 'boolean'].includes(typeof item)) {
-        out[privateCommitmentKey(key)] = asSha256(String(item));
+        out[privateCommitmentKey(key)] = privateValueCommitment(commitmentKey, String(item));
       }
       continue;
     }
-    if (key === 'source_hash' && typeof item === 'string' && SOURCE_REF_ROOT_RE.test(item)) {
+    if (key === 'source_hash' && typeof item === 'string' && SAFE_METADATA_DIGEST_RE.test(item)) {
       out[key] = item;
       continue;
     }
-    const sanitized = sanitizeSourceRefValue(item);
+    const sanitized = sanitizeSourceRefValue(item, commitmentKey);
     if (sanitized !== undefined) out[key] = sanitized;
   }
   return Object.keys(out).length > 0 ? out : undefined;
 }
 
-function sanitizeSourceRefs(refs) {
+function sanitizeSourceRefs(refs, commitmentKey) {
   if (!Array.isArray(refs)) return [];
   const out = [];
   for (const ref of refs) {
     if (typeof ref === 'string') {
-      out.push({ source_hash: asSha256(ref) });
+      out.push({ source_hash: privateValueCommitment(commitmentKey, ref) });
       continue;
     }
-    const sanitized = sanitizeSourceRefValue(ref);
+    const sanitized = sanitizeSourceRefValue(ref, commitmentKey);
     if (sanitized !== undefined) out.push(sanitized);
   }
   return out;
@@ -187,12 +212,15 @@ function receiptEvent(receipt) {
 function deriveReceiptLifecycle(receipts) {
   const active = new Set();
   const tombstones = new Map();
+  let activeRoot = computeSetRoot(active);
   for (const receipt of receipts) {
     const event = receiptEvent(receipt);
     if (!event) continue;
+    let activeChanged = false;
     if (event.operation === 'create' && event.memory_addr) {
       active.add(event.memory_addr);
       tombstones.delete(event.memory_addr);
+      activeChanged = true;
     } else if (event.operation === 'update' && event.memory_addr) {
       if (event.source_addr) {
         active.delete(event.source_addr);
@@ -207,6 +235,7 @@ function deriveReceiptLifecycle(receipts) {
       }
       active.add(event.memory_addr);
       tombstones.delete(event.memory_addr);
+      activeChanged = true;
     } else if (event.operation === 'delete' && event.memory_addr) {
       active.delete(event.memory_addr);
       tombstones.set(event.memory_addr, {
@@ -216,8 +245,14 @@ function deriveReceiptLifecycle(receipts) {
         tombstoned_at: event.timestamp,
         reason: 'deleted',
       });
+      activeChanged = true;
+    } else if (event.operation === 'key_reset') {
+      active.clear();
+      tombstones.clear();
+      activeChanged = true;
     }
-    if (typeof receipt.active_set_root === 'string' && receipt.active_set_root !== computeSetRoot(active)) {
+    if (activeChanged) activeRoot = computeSetRoot(active);
+    if (typeof receipt.active_set_root === 'string' && receipt.active_set_root !== activeRoot) {
       throw new Error('importBundle receipt active_set_root mismatch');
     }
   }
@@ -339,19 +374,55 @@ function buildEd25519Pkcs8(seed) {
   ]);
 }
 
-function deriveMasterKeyFromPassphrase(passphrase, salt) {
+export function validateKdfSpec(kdfSpec = DEFAULT_KDF_SPEC) {
+  const algorithm = kdfSpec?.algorithm ?? 'scrypt';
+  if (algorithm === 'scrypt') {
+    const n = kdfSpec?.n ?? 16384;
+    const r = kdfSpec?.r ?? 8;
+    const p = kdfSpec?.p ?? 1;
+    const maxmem = kdfSpec?.maxmem ?? 64 * 1024 * 1024;
+    if (!Number.isInteger(n) || n < 16384 || n > 131072 || (n & (n - 1)) !== 0) {
+      throw new Error('scrypt n must be a power of two from 16384 through 131072');
+    }
+    if (!Number.isInteger(r) || r < 1 || r > 32) throw new Error('scrypt r must be an integer from 1 through 32');
+    if (!Number.isInteger(p) || p < 1 || p > 8) throw new Error('scrypt p must be an integer from 1 through 8');
+    const requiredMemory = 128 * n * r + 1024 * 1024;
+    if (!Number.isInteger(maxmem) || maxmem < requiredMemory || maxmem > 256 * 1024 * 1024) {
+      throw new Error(`scrypt maxmem must be an integer from ${requiredMemory} through 268435456`);
+    }
+    return { ...kdfSpec, algorithm, n, r, p, maxmem };
+  }
+  if (algorithm === 'pbkdf2') {
+    const iterations = kdfSpec?.iterations ?? 600000;
+    const hash = kdfSpec?.hash ?? 'sha256';
+    if (!Number.isInteger(iterations) || iterations < 100000 || iterations > 2000000) {
+      throw new Error('PBKDF2 iterations must be an integer from 100000 through 2000000');
+    }
+    if (!['sha256', 'sha512'].includes(hash)) throw new Error('PBKDF2 hash must be sha256 or sha512');
+    return { ...kdfSpec, algorithm, iterations, hash };
+  }
+  throw new Error(`Unsupported KDF algorithm: ${algorithm}`);
+}
+
+export function deriveMasterKeyFromPassphrase(passphrase, salt, kdfSpec = DEFAULT_KDF_SPEC) {
   const normalized = Buffer.from(String(passphrase), 'utf8');
+  if (typeof salt === 'string' && salt.length > 128) throw new Error('Encoded salt is too large');
   const saltBuf = typeof salt === 'string' ? Buffer.from(salt, 'base64') : Buffer.from(salt);
-  if (saltBuf.length < 8) throw new Error('Salt must be at least 8 bytes');
-  try {
-    return scryptSync(normalized, saltBuf, DERIVED_KEY_LENGTH);
-  } catch {
-    return pbkdf2Sync(normalized, saltBuf, 600000, DERIVED_KEY_LENGTH, 'sha256');
+  if (saltBuf.length < 8 || saltBuf.length > 64) throw new Error('Salt must be from 8 through 64 bytes');
+  const validated = validateKdfSpec(kdfSpec);
+  if (validated.algorithm === 'scrypt') {
+    return scryptSync(normalized, saltBuf, DERIVED_KEY_LENGTH, {
+      N: validated.n,
+      r: validated.r,
+      p: validated.p,
+      maxmem: validated.maxmem,
+    });
   }
+  return pbkdf2Sync(normalized, saltBuf, validated.iterations, DERIVED_KEY_LENGTH, validated.hash);
 }
 
-function deriveKeysFromPassphrase(passphrase, salt) {
-  const master = deriveMasterKeyFromPassphrase(passphrase, salt);
+export function deriveKeysFromPassphrase(passphrase, salt, kdfSpec = DEFAULT_KDF_SPEC) {
+  const master = deriveMasterKeyFromPassphrase(passphrase, salt, kdfSpec);
   return {
     kek: master.subarray(0, 32),
     vaultKey: master.subarray(32, 64),
@@ -360,9 +431,29 @@ function deriveKeysFromPassphrase(passphrase, salt) {
   };
 }
 
-function encryptKeyring(plaintextKeyring, kek) {
+export function canonicalKeyringAad(meta = {}) {
+  const aad = {
+    schema: meta.schema ?? 'enigma.vault_keyring.v2',
+    type: meta.type ?? KEYRING_ENCRYPTED_TYPE,
+    kdf: meta.kdf ?? DEFAULT_KDF_SPEC,
+    salt: String(meta.salt ?? ''),
+    vault_schema: meta.vault_schema ?? VAULT_SCHEMA,
+    vault_id: meta.vault_id ?? null,
+    active_key_epoch: meta.active_key_epoch ?? 1,
+    key_epochs: Array.isArray(meta.key_epochs) ? meta.key_epochs : [],
+    old_epoch_read_policy: meta.old_epoch_read_policy ?? 'retained_keys_allowed',
+    signer: meta.signer ?? 'ed25519',
+    publicKey: meta.publicKey ?? null,
+  };
+  return Buffer.from(canonical(aad), 'utf8');
+}
+
+function encryptKeyring(plaintextKeyring, kek, aadMeta = undefined) {
   const iv = randomBytes(IV_LENGTH);
   const cipher = createCipheriv('aes-256-gcm', kek, iv);
+  if (aadMeta) {
+    cipher.setAAD(canonicalKeyringAad(aadMeta));
+  }
   const plaintext = Buffer.from(JSON.stringify(plaintextKeyring), 'utf8');
   const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
   const tag = cipher.getAuthTag();
@@ -373,19 +464,48 @@ function encryptKeyring(plaintextKeyring, kek) {
   };
 }
 
+function zeroDerivedKeys(keys) {
+  for (const value of Object.values(keys ?? {})) value?.fill?.(0);
+}
+
 export function decryptKeyring(keyring, passphrase) {
   if (keyring?.type !== KEYRING_ENCRYPTED_TYPE) throw new Error('Keyring is not encrypted');
-  if (passphrase === undefined || passphrase === null || String(passphrase).length === 0) {
+  if (passphrase === undefined || passphrase === null || String(passphrase).trim().length === 0) {
     throw new Error('Encrypted keyring requires passphrase');
   }
-  const { kek } = deriveKeysFromPassphrase(passphrase, keyring.salt);
-  const decipher = createDecipheriv('aes-256-gcm', kek, Buffer.from(keyring.iv, 'base64'));
-  decipher.setAuthTag(Buffer.from(keyring.tag, 'base64'));
-  const plaintext = Buffer.concat([
-    decipher.update(Buffer.from(keyring.ciphertext, 'base64')),
-    decipher.final(),
-  ]).toString('utf8');
-  return JSON.parse(plaintext);
+  const kdf = keyring.kdf || DEFAULT_KDF_SPEC;
+  const salt = keyring.kdf?.salt ?? keyring.salt;
+  const derived = deriveKeysFromPassphrase(passphrase, salt, kdf);
+  try {
+    if (keyring.kdf) {
+      const decipher = createDecipheriv('aes-256-gcm', derived.kek, Buffer.from(keyring.iv, 'base64'));
+      decipher.setAuthTag(Buffer.from(keyring.tag, 'base64'));
+      decipher.setAAD(canonicalKeyringAad(keyring));
+      const plaintext = Buffer.concat([
+        decipher.update(Buffer.from(keyring.ciphertext, 'base64')),
+        decipher.final(),
+      ]);
+      try {
+        return JSON.parse(plaintext.toString('utf8'));
+      } finally {
+        plaintext.fill(0);
+      }
+    }
+
+    const legacyDecipher = createDecipheriv('aes-256-gcm', derived.kek, Buffer.from(keyring.iv, 'base64'));
+    legacyDecipher.setAuthTag(Buffer.from(keyring.tag, 'base64'));
+    const plaintext = Buffer.concat([
+      legacyDecipher.update(Buffer.from(keyring.ciphertext, 'base64')),
+      legacyDecipher.final(),
+    ]);
+    try {
+      return JSON.parse(plaintext.toString('utf8'));
+    } finally {
+      plaintext.fill(0);
+    }
+  } finally {
+    zeroDerivedKeys(derived);
+  }
 }
 
 function signingPair(seed) {
@@ -456,7 +576,7 @@ function nowIso(now) {
   return new Date().toISOString();
 }
 
-function metadata(input) {
+function metadata(input, commitmentKey) {
   const out = {};
   if (!input || typeof input !== 'object') return out;
   for (const [key, value] of Object.entries(input)) {
@@ -465,12 +585,12 @@ function metadata(input) {
       if (isSafeMetadataPrimitive(key, value)) {
         out[key] = value;
       } else {
-        commitMetadataValue(out, key, value);
+        commitMetadataValue(out, key, value, commitmentKey);
       }
       continue;
     }
     if (Array.isArray(value) || typeof value === 'object') {
-      commitMetadataValue(out, key, value);
+      commitMetadataValue(out, key, value, commitmentKey);
     }
   }
   return out;
@@ -558,7 +678,7 @@ function appendEvent(vault, fields) {
     sequence,
     policy_id: fields.policy_id ?? vault.policy_id,
     decision: fields.decision,
-    metadata: metadata(fields.metadata),
+    metadata: metadata(fields.metadata, vault.addressKey),
   });
   const eventCanonical = canonical(event);
   const eventHash = asSha256(eventCanonical);
@@ -570,45 +690,75 @@ function appendEvent(vault, fields) {
   vault.receipts.push(receipt);
   vault.sequence += 1;
   vault.updated_at = event.timestamp;
-  vault.active_set_root = activeSetRoot;
-  vault.receipt_log_root = computeReceiptLogRootFrom(vault.receipts);
+  Object.assign(vault, lifecycleRoots(vault));
   return { event, receipt };
 }
 
-function memoryAddress(vault, subjectId, memoryId, contentHash) {
-  const payload = canonical({ domain: MEMORY_DOMAIN, subject_id: subjectId, memory_id: memoryId, content_hash: contentHash });
-  try {
-    const addr = createMemoryAddress({
-      vault_addr_key: vault.addressKey,
-      vaultAddressKey: vault.addressKey,
-      key: vault.addressKey,
-      value: payload,
-      components: { domain: MEMORY_DOMAIN, subject_id: subjectId, memory_id: memoryId, content_hash: contentHash },
-      domain: MEMORY_DOMAIN,
-      subject_id: subjectId,
-      subjectId,
-      memory_id: memoryId,
-      memoryId,
-      content_hash: contentHash,
-      contentHash,
-    });
-    if (typeof addr === 'string' && addr.length > 0) return addr;
-  } catch {
-    // Local HMAC construction below follows the protocol domain separation.
-  }
+function contentCommitment(vault, plaintext) {
+  return `hmac-sha256:${asHmacSha256(vault.addressKey, canonical({
+    domain: `${MEMORY_DOMAIN}/content_commitment`,
+    vault_id: vault.vault_id,
+    content: String(plaintext),
+  }))}`;
+}
+
+function memoryAddress(vault, subjectId, memoryId, commitment) {
+  const payload = canonical({
+    domain: MEMORY_DOMAIN,
+    vault_id: vault.vault_id,
+    subject_id: subjectId,
+    memory_id: memoryId,
+    content_commitment: commitment,
+  });
   return `mem:${asHmacSha256(vault.addressKey, payload)}`;
 }
 
-function encryptContent(vault, memoryAddr, plaintext) {
+function canonicalContentAad(vault, memoryAddr, epoch, keyId) {
+  return canonical({
+    domain: CONTENT_AAD_DOMAIN,
+    schema: MEMORY_OBJECT_SCHEMA,
+    vault_id: vault.vault_id,
+    memory_addr: memoryAddr,
+    key_epoch: epoch,
+    key_id: keyId,
+  });
+}
+
+function normalizedPrivateTags(value) {
+  if (!Array.isArray(value)) return [];
+  return value.map((tag) => String(tag)).filter((tag) => tag.length > 0);
+}
+
+function setPrivateTags(record, tags) {
+  Object.defineProperty(record, 'purpose_tags', {
+    value: normalizedPrivateTags(tags),
+    enumerable: false,
+    configurable: true,
+    writable: true,
+  });
+}
+
+function privateTags(record) {
+  const descriptor = Object.getOwnPropertyDescriptor(record, 'purpose_tags');
+  return descriptor && descriptor.enumerable === false ? normalizedPrivateTags(descriptor.value) : [];
+}
+
+function encryptContent(vault, memoryAddr, plaintext, epochEntry = activeContentEpoch(vault), privateFields = {}) {
   const iv = randomBytes(12);
-  const cipher = createCipheriv('aes-256-gcm', vault.vaultKey, iv);
-  cipher.setAAD(Buffer.from(memoryAddr));
-  const ciphertext = Buffer.concat([cipher.update(String(plaintext), 'utf8'), cipher.final()]);
+  const aad = canonicalContentAad(vault, memoryAddr, epochEntry.epoch, epochEntry.key_id);
+  const cipher = createCipheriv('aes-256-gcm', epochEntry.key, iv);
+  cipher.setAAD(Buffer.from(aad, 'utf8'));
+  const privatePayload = JSON.stringify({
+    schema: PRIVATE_MEMORY_SCHEMA,
+    content: String(plaintext),
+    purpose_tags: normalizedPrivateTags(privateFields.purpose_tags),
+  });
+  const ciphertext = Buffer.concat([cipher.update(privatePayload, 'utf8'), cipher.final()]);
   const tag = cipher.getAuthTag();
   return {
     alg: 'AES-256-GCM',
     iv: iv.toString('base64'),
-    aad: memoryAddr,
+    aad,
     ciphertext: ciphertext.toString('base64'),
     tag: tag.toString('base64'),
   };
@@ -635,16 +785,31 @@ function getPlaintextCache(record) {
 }
 
 function decryptContent(vault, record) {
+  if (!record) throw new Error('memory record is unavailable');
+  const epochEntry = contentKeyForRecord(vault, record);
   const cached = getPlaintextCache(record);
   if (cached !== undefined) return cached;
   const encrypted = record.content_ciphertext;
-  const decipher = createDecipheriv('aes-256-gcm', vault.vaultKey, Buffer.from(encrypted.iv, 'base64'));
-  decipher.setAAD(Buffer.from(encrypted.aad ?? record.memory_addr));
+  if (!encrypted || encrypted.alg !== 'AES-256-GCM') throw new Error('memory ciphertext envelope is invalid');
+  const expectedAad = canonicalContentAad(vault, record.memory_addr, epochEntry.epoch, epochEntry.key_id);
+  if (encrypted.aad !== expectedAad) throw new Error('memory ciphertext AAD mismatch');
+  const decipher = createDecipheriv('aes-256-gcm', epochEntry.key, Buffer.from(encrypted.iv, 'base64'));
+  decipher.setAAD(Buffer.from(expectedAad, 'utf8'));
   decipher.setAuthTag(Buffer.from(encrypted.tag, 'base64'));
-  const plaintext = Buffer.concat([
+  const decrypted = Buffer.concat([
     decipher.update(Buffer.from(encrypted.ciphertext, 'base64')),
     decipher.final(),
   ]).toString('utf8');
+  let plaintext = decrypted;
+  try {
+    const payload = JSON.parse(decrypted);
+    if (payload?.schema === PRIVATE_MEMORY_SCHEMA && typeof payload.content === 'string') {
+      plaintext = payload.content;
+      setPrivateTags(record, payload.purpose_tags);
+    }
+  } catch {
+    // Pre-private-envelope ciphertext stores the content string directly.
+  }
   return setPlaintextCache(record, plaintext);
 }
 
@@ -652,22 +817,277 @@ function publicRecord(record) {
   return pruneUndefined(sanitizePublicValue(record));
 }
 
+function requireVault(input, functionName) {
+  const vault = input?.vault ?? input;
+  if (!vault) throw new Error(`${functionName} requires a vault`);
+  return vault;
+}
+
+function signerRef(signer) {
+  if (!signer || typeof signer !== 'object') return undefined;
+  return pruneUndefined({
+    key_id: signer.key_id ?? signer.keyId,
+    alg: signer.alg,
+    publicKey: signer.publicKey,
+  });
+}
+
+function signatureRef(signature) {
+  if (!signature || typeof signature !== 'object') return undefined;
+  return pruneUndefined({
+    alg: signature.alg,
+    value: signature.value,
+  });
+}
+
+function sortedMapValues(mapLike) {
+  if (!mapLike) return [];
+  if (typeof mapLike.values === 'function') return [...mapLike.values()];
+  if (Array.isArray(mapLike)) return mapLike;
+  return [];
+}
+
+function quarantineAddresses(vault) {
+  const out = new Set(vault.quarantineAddresses ?? []);
+  for (const [memoryAddr, record] of vault.memories ?? []) {
+    if (record?.state === 'quarantine' || record?.state === 'quarantined') out.add(memoryAddr);
+  }
+  return sortedStrings(out);
+}
+
+function publicTombstone(tombstone) {
+  if (!tombstone || typeof tombstone !== 'object') return undefined;
+  return pruneUndefined({
+    schema: tombstone.schema ?? 'enigma.deletion_tombstone.v1',
+    memory_addr: tombstone.memory_addr,
+    operation: tombstone.operation,
+    successor_addr: tombstone.successor_addr,
+    tombstoned_at: tombstone.tombstoned_at,
+    reason_hash: tombstone.reason ? asSha256(String(tombstone.reason)) : undefined,
+  });
+}
+
+function tombstoneRootItems(vault) {
+  return sortedMapValues(vault.tombstones)
+    .map(publicTombstone)
+    .filter(Boolean)
+    .sort((a, b) => String(a.memory_addr).localeCompare(String(b.memory_addr)))
+    .map((tombstone) => asSha256(canonical(tombstone)));
+}
+
+function lifecycleRoots(vault) {
+  const active = sortedStrings(vault.activeAddresses ?? []);
+  const quarantine = quarantineAddresses(vault);
+  const tombstones = tombstoneRootItems(vault);
+  const activeSetRoot = computeSetRoot(active);
+  const quarantineSetRoot = computeSetRoot(quarantine);
+  const tombstoneSetRoot = computeSetRoot(tombstones);
+  const receiptLogRoot = computeReceiptLogRootFrom(vault.receipts ?? []);
+  return {
+    active_set_root: activeSetRoot,
+    quarantine_set_root: quarantineSetRoot,
+    tombstone_set_root: tombstoneSetRoot,
+    receipt_log_root: receiptLogRoot,
+    lifecycle_root: computeSetRoot([activeSetRoot, quarantineSetRoot, tombstoneSetRoot, receiptLogRoot]),
+  };
+}
+
+function applyLifecycleRoots(vault) {
+  return Object.assign(vault, lifecycleRoots(vault));
+}
+
+function projectLifecycleReceipt(receipt) {
+  if (!receipt || typeof receipt !== 'object') return undefined;
+  return pruneUndefined({
+    schema: 'enigma.lifecycle_receipt_projection.v1',
+    receipt_id: receipt.receipt_id,
+    receipt_hash: hashReceipt(receipt),
+    event_hash: receipt.event_hash,
+    operation: receipt.operation,
+    tenant_id: receipt.tenant_id,
+    subject_id: receipt.subject_id,
+    memory_addr: receipt.memory_addr,
+    source_addr: receipt.source_addr,
+    policy_id: receipt.policy_id,
+    sequence: receipt.sequence,
+    previous_receipt_hash: receipt.previous_receipt_hash,
+    active_set_root: receipt.active_set_root,
+    receipt_log_root: receipt.receipt_log_root,
+    timestamp: receipt.timestamp,
+    signer: signerRef(receipt.signer),
+    signature: signatureRef(receipt.signature),
+  });
+}
+
+function lifecycleStateForReceipt(receipt) {
+  if (receipt?.operation === 'delete') return 'tombstone';
+  if (receipt?.operation === 'quarantine') return 'quarantine';
+  return 'active';
+}
+
+function projectLifecycleReceiptRef(receipt) {
+  if (!receipt || typeof receipt !== 'object') return undefined;
+  const receiptHash = hashReceipt(receipt);
+  return pruneUndefined({
+    sequence: receipt.sequence,
+    receipt_ref: receipt.receipt_id ?? receiptHash,
+    receipt_hash: receiptHash,
+    previous_receipt_hash: receipt.previous_receipt_hash,
+    lifecycle_state: lifecycleStateForReceipt(receipt),
+  });
+}
+
+function lifecycleLogId(vault, roots, issuedAt) {
+  return `log_${sha256Hex(canonical({
+    schema: 'enigma.lifecycle_receipt_log.id.v1',
+    vault_id: vault.vault_id,
+    receipt_log_root: roots.receipt_log_root,
+    lifecycle_root: roots.lifecycle_root,
+    issued_at: issuedAt,
+  })).slice(0, 32)}`;
+}
+
+function refHash(value) {
+  return asSha256(canonical(value));
+}
+
+
+export function buildLifecycleRootSummary(args = {}) {
+  const vault = requireVault(args, 'buildLifecycleRootSummary');
+  const roots = lifecycleRoots(vault);
+  const active = sortedStrings(vault.activeAddresses ?? []);
+  const quarantine = quarantineAddresses(vault);
+  const tombstones = tombstoneRootItems(vault);
+  return pruneUndefined({
+    schema: 'enigma.lifecycle_root_summary.v1',
+    vault_id: vault.vault_id,
+    tenant_id: vault.tenant_id,
+    subject_id: vault.subject_id,
+    policy_id: vault.policy_id,
+    sequence: vault.sequence,
+    active_count: active.length,
+    quarantine_count: quarantine.length,
+    tombstone_count: tombstones.length,
+    receipt_count: Array.isArray(vault.receipts) ? vault.receipts.length : 0,
+    active_set_root: roots.active_set_root,
+    quarantine_set_root: roots.quarantine_set_root,
+    tombstone_set_root: roots.tombstone_set_root,
+    active_root: roots.active_set_root,
+    quarantine_root: roots.quarantine_set_root,
+    tombstone_root: roots.tombstone_set_root,
+    receipt_log_root: roots.receipt_log_root,
+    lifecycle_root: roots.lifecycle_root,
+    updated_at: vault.updated_at,
+    signer: signerRef(vault.signer),
+  });
+}
+
+export function buildMemoryBoundaryTransactionSummary(args = {}) {
+  const vault = requireVault(args, 'buildMemoryBoundaryTransactionSummary');
+  const receipt = args.receipt ?? args.transaction ?? vault.receipts?.[vault.receipts.length - 1];
+  const projection = projectLifecycleReceipt(receipt);
+  if (!projection) throw new Error('buildMemoryBoundaryTransactionSummary requires at least one receipt');
+  return pruneUndefined({
+    schema: 'enigma.memory_boundary_transaction_summary.v1',
+    vault_id: vault.vault_id,
+    tenant_id: vault.tenant_id,
+    subject_id: vault.subject_id,
+    operation: projection.operation,
+    sequence: projection.sequence,
+    timestamp: projection.timestamp,
+    memory_addr: projection.memory_addr,
+    source_addr: projection.source_addr,
+    policy_id: projection.policy_id,
+    event_hash: projection.event_hash,
+    receipt_hash: projection.receipt_hash,
+    previous_receipt_hash: projection.previous_receipt_hash,
+    active_set_root: projection.active_set_root,
+    receipt_log_root: projection.receipt_log_root,
+    lifecycle_root: buildLifecycleRootSummary({ vault }).lifecycle_root,
+    signer: projection.signer,
+    signature: projection.signature,
+    public_safe: true,
+  });
+}
+
+export function buildPublicLifecycleReceiptLog(args = {}) {
+  const vault = requireVault(args, 'buildPublicLifecycleReceiptLog');
+  const receiptRefs = (vault.receipts ?? []).map(projectLifecycleReceiptRef).filter(Boolean);
+  if (receiptRefs.length === 0) throw new Error('buildPublicLifecycleReceiptLog requires at least one receipt');
+  const roots = buildLifecycleRootSummary({ vault });
+  const issuedAt = args.now ? nowIso(args.now) : vault.updated_at;
+  const latestReceipt = vault.receipts?.[vault.receipts.length - 1];
+  const logId = lifecycleLogId(vault, roots, issuedAt);
+  return pruneUndefined({
+    schema: 'enigma.lifecycle_receipt_log.v1',
+    log_id: logId,
+    log_ref: refHash({ schema: 'enigma.lifecycle_receipt_log.ref.v1', log_id: logId, receipt_log_root: roots.receipt_log_root }),
+    subject_ref: refHash({ schema: 'enigma.subject_ref.v1', subject_id: vault.subject_id }),
+    tenant_ref: refHash({ schema: 'enigma.tenant_ref.v1', tenant_id: vault.tenant_id }),
+    epoch: vault.sequence,
+    previous_log_root: latestReceipt?.receipt_log_root ?? ZERO_ROOT,
+    receipt_refs: receiptRefs,
+    active_root: roots.active_set_root,
+    quarantine_root: roots.quarantine_set_root,
+    tombstone_root: roots.tombstone_set_root,
+    receipt_log_root: roots.receipt_log_root,
+    issued_at: issuedAt,
+    signer_ref: refHash(signerRef(vault.signer) ?? { key_id: vault.signer?.key_id ?? null }),
+    signature_ref: latestReceipt?.signature ? refHash(signatureRef(latestReceipt.signature)) : undefined,
+  });
+}
+
+
 function attachInternals(vault) {
   Object.defineProperties(vault, {
     __recordEvent: { value: (fields) => appendEvent(vault, fields), enumerable: false },
     __getRecord: { value: (memoryAddr) => vault.memories.get(memoryAddr), enumerable: false },
     __getPlaintext: { value: (memoryAddr) => decryptContent(vault, vault.memories.get(memoryAddr)), enumerable: false },
     __computeRoots: {
-      value: () => ({
-        active_set_root: computeSetRoot(vault.activeAddresses),
-        receipt_log_root: computeReceiptLogRootFrom(vault.receipts),
-      }),
+      value: () => lifecycleRoots(vault),
       enumerable: false,
     },
   });
   return vault;
 }
 
+function normalizeKeyEpoch(entry, fallbackKey, fallbackKeyId, createdAt) {
+  const epoch = Number(entry?.epoch ?? 1);
+  if (!Number.isInteger(epoch) || epoch < 1) throw new Error('content key epoch must be a positive integer');
+  const key = keyBytes(entry?.key ?? entry?.key_b64 ?? fallbackKey, `content key for epoch ${epoch}`);
+  const keyId = entry?.key_id ?? entry?.keyId ?? fallbackKeyId;
+  if (typeof keyId !== 'string' || keyId.length === 0) throw new Error(`content key epoch ${epoch} requires key_id`);
+  const status = entry?.status ?? 'active';
+  if (!['active', 'retained', 'sealed'].includes(status)) throw new Error(`unsupported content key epoch status: ${status}`);
+  return {
+    epoch,
+    key_id: keyId,
+    key,
+    status,
+    created_at: entry?.created_at ?? createdAt,
+    sealed_at: entry?.sealed_at,
+  };
+}
+
+function activeContentEpoch(vault) {
+  const entry = vault.keyEpochs.get(vault.activeKeyEpoch);
+  if (!entry) throw new Error(`active content key epoch ${vault.activeKeyEpoch} is unavailable`);
+  if (entry.status === 'sealed') throw new Error(`content key epoch ${entry.epoch} is sealed and rejects writes`);
+  if (entry.status !== 'active') throw new Error(`content key epoch ${entry.epoch} is not active`);
+  return entry;
+}
+
+function contentKeyForRecord(vault, record) {
+  const epoch = Number(record.key_epoch ?? 1);
+  const entry = vault.keyEpochs.get(epoch);
+  if (!entry || !entry.key) throw new Error(`content key epoch ${epoch} has been destroyed or is unavailable`);
+  if (entry.key_id !== record.key_id) throw new Error(`content key id mismatch for epoch ${epoch}`);
+  if (epoch !== vault.activeKeyEpoch && vault.allowOldEpochReads !== true) {
+    throw new Error(`read policy rejects old content key epoch ${epoch}`);
+  }
+  return entry;
+}
+
 export function createVault(args = {}) {
   const createdAt = nowIso(args.now);
   const passphrase = args.passphrase;
@@ -676,8 +1096,13 @@ export function createVault(args = {}) {
   let addressKey;
   let signingSeed;
   let keyringType = KEYRING_PLAINTEXT_TYPE;
-  if (passphrase !== undefined && passphrase !== null && String(passphrase).length > 0) {
-    const derived = deriveKeysFromPassphrase(passphrase, salt);
+  if (passphrase !== undefined && passphrase !== null) {
+    const rawPass = String(passphrase);
+    if (rawPass.length === 0 || rawPass.trim().length === 0) {
+      throw new Error('Passphrase provided to createVault cannot be empty.');
+    }
+    const kdf = args.kdf || DEFAULT_KDF_SPEC;
+    const derived = deriveKeysFromPassphrase(rawPass, salt, kdf);
     vaultKey = derived.vaultKey;
     addressKey = derived.addressKey;
     signingSeed = derived.signingSeed;
@@ -687,6 +1112,20 @@ export function createVault(args = {}) {
     addressKey = keyBytes(args.address_key ?? args.addressKey, 'address key');
   }
   const signingKeyPair = args.signingKeyPair ?? signingPair(signingSeed);
+  const activeKeyEpoch = Number(args.active_key_epoch ?? args.activeKeyEpoch ?? 1);
+  const initialKeyId = args.key_id ?? args.keyId ?? `vault-key-${randomUUID()}`;
+  const suppliedEpochs = args.key_epochs ?? args.keyEpochs;
+  const epochEntries = Array.isArray(suppliedEpochs) && suppliedEpochs.length > 0
+    ? suppliedEpochs.map((entry) => normalizeKeyEpoch(entry, undefined, undefined, createdAt))
+    : [normalizeKeyEpoch({ epoch: activeKeyEpoch, key_id: initialKeyId, key: vaultKey, status: 'active' }, undefined, undefined, createdAt)];
+  const keyEpochs = new Map(epochEntries.map((entry) => [entry.epoch, entry]));
+  if (keyEpochs.size !== epochEntries.length) throw new Error('duplicate content key epoch');
+  const activeEpochEntry = keyEpochs.get(activeKeyEpoch);
+  if (!activeEpochEntry) throw new Error(`active content key epoch ${activeKeyEpoch} is missing`);
+  if (!['active', 'sealed'].includes(activeEpochEntry.status)) {
+    throw new Error(`active content key epoch ${activeKeyEpoch} cannot have ${activeEpochEntry.status} status`);
+  }
+  vaultKey = activeEpochEntry.key;
   const vault = {
     schema: VAULT_SCHEMA,
     vault_id: args.vault_id ?? args.vaultId ?? `vault_${randomUUID()}`,
@@ -697,7 +1136,10 @@ export function createVault(args = {}) {
     created_at: createdAt,
     updated_at: createdAt,
     encryption: 'local_aead',
-    key_id: args.key_id ?? args.keyId ?? `vault-key-${randomUUID()}`,
+    key_id: activeEpochEntry.key_id,
+    activeKeyEpoch,
+    keyEpochs,
+    allowOldEpochReads: args.allow_old_epoch_reads ?? args.allowOldEpochReads ?? true,
     vaultKey,
     addressKey,
     signingKeyPair,
@@ -707,14 +1149,127 @@ export function createVault(args = {}) {
     receipts: [],
     activeAddresses: new Set(),
     tombstones: new Map(),
+    quarantineAddresses: new Set(),
     sequence: 0,
     active_set_root: ZERO_ROOT,
+    quarantine_set_root: ZERO_ROOT,
+    tombstone_set_root: ZERO_ROOT,
     receipt_log_root: ZERO_ROOT,
+    lifecycle_root: ZERO_ROOT,
     keyringType,
   };
+  applyLifecycleRoots(vault);
   return attachInternals(vault);
 }
 
+export function rotateContentKey(args = {}) {
+  const vault = requireVault(args, 'rotateContentKey');
+  const previous = vault.keyEpochs.get(vault.activeKeyEpoch);
+  if (previous.status === 'active') previous.status = 'retained';
+  const epoch = Math.max(...vault.keyEpochs.keys()) + 1;
+  const createdAt = nowIso(args.now);
+  const next = normalizeKeyEpoch({
+    epoch,
+    key_id: args.key_id ?? args.keyId ?? `vault-key-${randomUUID()}`,
+    key: args.key,
+    status: 'active',
+    created_at: createdAt,
+  }, undefined, undefined, createdAt);
+  vault.keyEpochs.set(epoch, next);
+  vault.activeKeyEpoch = epoch;
+  vault.key_id = next.key_id;
+  vault.vaultKey = next.key;
+  const { event, receipt } = appendEvent(vault, {
+    operation: 'key_rotate',
+    actor_id: args.actor_id ?? args.actorId,
+    now: args.now,
+    metadata: { prior_epoch: previous.epoch, new_epoch: epoch, prior_key_id: previous.key_id, new_key_id: next.key_id },
+  });
+  return {
+    epoch,
+    key_id: next.key_id,
+    prior_epoch: previous.epoch,
+    prior_key_status: previous.status,
+    old_key_retained: true,
+    external_copies_destroyed: false,
+    event,
+    receipt,
+  };
+}
+
+export function sealContentKeyEpoch(args = {}) {
+  const vault = requireVault(args, 'sealContentKeyEpoch');
+  const epoch = Number(args.epoch ?? vault.activeKeyEpoch);
+  const entry = vault.keyEpochs.get(epoch);
+  if (!entry) throw new Error(`unknown content key epoch ${epoch}`);
+  if (entry.status === 'sealed') throw new Error(`content key epoch ${epoch} is already sealed`);
+  entry.status = 'sealed';
+  entry.sealed_at = nowIso(args.now);
+  const { event, receipt } = appendEvent(vault, {
+    operation: 'key_seal',
+    actor_id: args.actor_id ?? args.actorId,
+    now: args.now,
+    metadata: { epoch, key_id: entry.key_id, key_retained: true },
+  });
+  return {
+    epoch,
+    key_id: entry.key_id,
+    status: entry.status,
+    key_retained_for_reads: true,
+    cryptographic_erasure_performed: false,
+    external_copies_destroyed: false,
+    event,
+    receipt,
+  };
+}
+
+export function resetVaultContentKeys(args = {}) {
+  const vault = requireVault(args, 'resetVaultContentKeys');
+  const destroyedEpochs = [...vault.keyEpochs.keys()].sort((a, b) => a - b);
+  const oldEpochEntries = [...vault.keyEpochs.values()];
+  const removedRecords = vault.memories.size;
+  const nextEpoch = Math.max(0, ...destroyedEpochs) + 1;
+  const createdAt = nowIso(args.now);
+  const next = normalizeKeyEpoch({
+    epoch: nextEpoch,
+    key_id: args.key_id ?? args.keyId ?? `vault-key-${randomUUID()}`,
+    key: args.key,
+    status: 'active',
+    created_at: createdAt,
+  }, undefined, undefined, createdAt);
+  const oldAddressKey = vault.addressKey;
+  vault.memories.clear();
+  vault.activeAddresses.clear();
+  vault.tombstones.clear();
+  vault.quarantineAddresses.clear();
+  vault.keyEpochs = new Map([[nextEpoch, next]]);
+  vault.activeKeyEpoch = nextEpoch;
+  vault.key_id = next.key_id;
+  vault.vaultKey = next.key;
+  vault.addressKey = keyBytes(args.address_key ?? args.addressKey, 'address key');
+  applyLifecycleRoots(vault);
+  const { event, receipt } = appendEvent(vault, {
+    operation: 'key_reset',
+    actor_id: args.actor_id ?? args.actorId,
+    now: args.now,
+    metadata: { destroyed_epoch_count: destroyedEpochs.length, removed_record_count: removedRecords, new_epoch: nextEpoch, new_key_id: next.key_id },
+  });
+  for (const entry of oldEpochEntries) entry.key?.fill?.(0);
+  oldAddressKey?.fill?.(0);
+  return {
+    destroyed_epochs: destroyedEpochs,
+    removed_record_count: removedRecords,
+    epoch: nextEpoch,
+    key_id: next.key_id,
+    software_key_material_zeroized_in_process: true,
+    process_memory_overwrite_guaranteed: false,
+    backups_and_external_copies_destroyed: false,
+    physical_media_erasure_guaranteed: false,
+    event,
+    receipt,
+  };
+}
+
 function normalizeImportance(value) {
   if (value === undefined || value === null) return undefined;
   const num = Number(value);
@@ -731,30 +1286,38 @@ export function remember(args = {}) {
   const memoryId = args.memory_id ?? args.memoryId ?? `mem_${randomUUID()}`;
   const subjectId = args.subject_id ?? args.subjectId ?? vault.subject_id;
   const createdAt = nowIso(args.now);
-  const contentHash = asSha256(String(plaintext));
-  const memoryAddr = memoryAddress(vault, subjectId, memoryId, contentHash);
+  const epochEntry = activeContentEpoch(vault);
+  const requestedEpoch = args.key_epoch ?? args.keyEpoch;
+  if (requestedEpoch !== undefined && Number(requestedEpoch) !== epochEntry.epoch) {
+    throw new Error(`writes require active content key epoch ${epochEntry.epoch}`);
+  }
+  const commitment = contentCommitment(vault, plaintext);
+  const memoryAddr = memoryAddress(vault, subjectId, memoryId, commitment);
   if (vault.tombstones.has(memoryAddr)) throw new Error(`memory address is tombstoned: ${memoryAddr}`);
+  const rawPurposeTags = normalizedPrivateTags(args.purpose_tags ?? args.purposeTags);
 
   const record = pruneUndefined({
-    schema: 'enigma.memory_object.v1',
+    schema: MEMORY_OBJECT_SCHEMA,
     memory_id: memoryId,
     memory_addr: memoryAddr,
     subject_id: subjectId,
-    kind: args.kind ?? 'fact',
-    content_ciphertext: encryptContent(vault, memoryAddr, plaintext),
-    content_hash: contentHash,
-    content_commitment: `hmac-sha256:${asHmacSha256(vault.addressKey, contentHash)}`,
-    source_refs: sanitizeSourceRefs(args.source_refs ?? args.sourceRefs),
-    confidence: args.confidence ?? 'user_confirmed',
-    sensitivity: args.sensitivity ?? 'normal',
-    purpose_tags: Array.isArray(args.purpose_tags ?? args.purposeTags) ? (args.purpose_tags ?? args.purposeTags) : [],
-    retention: args.retention ?? 'durable',
+    kind: ['fact', 'preference', 'goal', 'instruction', 'episode'].includes(args.kind) ? args.kind : 'fact',
+    key_epoch: epochEntry.epoch,
+    key_id: epochEntry.key_id,
+    content_ciphertext: encryptContent(vault, memoryAddr, plaintext, epochEntry, { purpose_tags: rawPurposeTags }),
+    content_commitment: commitment,
+    source_refs: sanitizeSourceRefs(args.source_refs ?? args.sourceRefs, vault.addressKey),
+    confidence: ['user_confirmed', 'inferred', 'verified'].includes(args.confidence) ? args.confidence : 'user_confirmed',
+    sensitivity: ['normal', 'sensitive', 'restricted'].includes(args.sensitivity) ? args.sensitivity : 'normal',
+    purpose_tag_commitments: rawPurposeTags.map((tag) => privateValueCommitment(vault.addressKey, tag)),
+    retention: ['durable', 'session', 'ephemeral'].includes(args.retention) ? args.retention : 'durable',
     importance: normalizeImportance(args.importance),
     state: 'active',
-    metadata: metadata(args.metadata),
+    metadata: metadata(args.metadata, vault.addressKey),
     created_at: createdAt,
     updated_at: createdAt,
   });
+  setPrivateTags(record, rawPurposeTags);
 
   vault.memories.set(memoryAddr, record);
   vault.activeAddresses.add(memoryAddr);
@@ -814,22 +1377,34 @@ export function updateMemory(args = {}) {
 
   const oldRecord = vault.memories.get(oldAddr);
   if (!oldRecord) throw new Error(`unknown memory: ${oldAddr}`);
+  const epochEntry = activeContentEpoch(vault);
+  const requestedEpoch = args.key_epoch ?? args.keyEpoch;
+  if (requestedEpoch !== undefined && Number(requestedEpoch) !== epochEntry.epoch) {
+    throw new Error(`writes require active content key epoch ${epochEntry.epoch}`);
+  }
+  decryptContent(vault, oldRecord);
+  const rawPurposeTags = args.purpose_tags !== undefined || args.purposeTags !== undefined
+    ? normalizedPrivateTags(args.purpose_tags ?? args.purposeTags)
+    : privateTags(oldRecord);
   oldRecord.state = 'superseded';
   oldRecord.updated_at = nowIso(args.now);
   vault.activeAddresses.delete(oldAddr);
 
-  const contentHash = asSha256(String(plaintext));
-  const newAddr = memoryAddress(vault, oldRecord.subject_id, oldRecord.memory_id, contentHash);
+  const commitment = contentCommitment(vault, plaintext);
+  const newAddr = memoryAddress(vault, oldRecord.subject_id, oldRecord.memory_id, commitment);
   const updatedAt = nowIso(args.now);
   const newRecord = pruneUndefined({
     ...publicRecord(oldRecord),
     memory_addr: newAddr,
-    content_ciphertext: encryptContent(vault, newAddr, plaintext),
-    content_hash: contentHash,
-    content_commitment: `hmac-sha256:${asHmacSha256(vault.addressKey, contentHash)}`,
+    key_epoch: epochEntry.epoch,
+    key_id: epochEntry.key_id,
+    content_ciphertext: encryptContent(vault, newAddr, plaintext, epochEntry, { purpose_tags: rawPurposeTags }),
+    content_commitment: commitment,
+    purpose_tag_commitments: rawPurposeTags.map((tag) => privateValueCommitment(vault.addressKey, tag)),
     state: 'active',
     updated_at: updatedAt,
   });
+  setPrivateTags(newRecord, rawPurposeTags);
 
   vault.memories.set(newAddr, newRecord);
   vault.activeAddresses.add(newAddr);
@@ -903,39 +1478,86 @@ export function deleteMemory(args = {}) {
   return { memory_addr: memoryAddr, tombstone, event, receipt };
 }
 
-function buildKeyring(vault, passphrase) {
-  if (passphrase !== undefined && passphrase !== null && String(passphrase).length > 0) {
+function publicKeyEpochs(vault) {
+  return [...vault.keyEpochs.values()]
+    .sort((left, right) => left.epoch - right.epoch)
+    .map((entry) => pruneUndefined({
+      epoch: entry.epoch,
+      key_id: entry.key_id,
+      status: entry.status,
+      created_at: entry.created_at,
+      sealed_at: entry.sealed_at,
+    }));
+}
+
+function privateKeyEpochs(vault) {
+  return [...vault.keyEpochs.values()]
+    .sort((left, right) => left.epoch - right.epoch)
+    .map((entry) => ({
+      epoch: entry.epoch,
+      key_id: entry.key_id,
+      status: entry.status,
+      created_at: entry.created_at,
+      sealed_at: entry.sealed_at,
+      key_b64: entry.key.toString('base64'),
+    }));
+}
+
+function buildKeyring(vault, passphrase, options = {}) {
+  const signer = vault.signer;
+  const publicKey = exportPublicKey(vault.signingKeyPair);
+  const keyEpochs = publicKeyEpochs(vault);
+  const common = {
+    schema: 'enigma.vault_keyring.v2',
+    vault_schema: vault.schema,
+    vault_id: vault.vault_id,
+    active_key_epoch: vault.activeKeyEpoch,
+    key_epochs: keyEpochs,
+    old_epoch_read_policy: vault.allowOldEpochReads === true ? 'retained_keys_allowed' : 'active_epoch_only',
+    signer,
+    publicKey,
+  };
+  if (passphrase !== undefined && passphrase !== null) {
+    const rawPass = String(passphrase);
+    if (rawPass.length === 0 || rawPass.trim().length === 0) {
+      throw new Error('Passphrase provided to buildKeyring cannot be empty.');
+    }
     const salt = randomBytes(SALT_LENGTH).toString('base64');
-    const { kek } = deriveKeysFromPassphrase(passphrase, salt);
+    const kdf = { ...(options.kdf || DEFAULT_KDF_SPEC), salt };
+    const derived = deriveKeysFromPassphrase(rawPass, salt, kdf);
+    const aadMeta = { ...common, type: KEYRING_ENCRYPTED_TYPE, kdf, salt };
     const plaintextKeyring = {
       vault_key_b64: vault.vaultKey.toString('base64'),
       address_key_b64: vault.addressKey.toString('base64'),
       privateKey: exportPrivateKey(vault.signingKeyPair),
+      content_keys: privateKeyEpochs(vault),
     };
-    const encrypted = encryptKeyring(plaintextKeyring, kek);
+    let encrypted;
+    try {
+      encrypted = encryptKeyring(plaintextKeyring, derived.kek, aadMeta);
+    } finally {
+      zeroDerivedKeys(derived);
+    }
     return {
+      ...aadMeta,
       type: KEYRING_ENCRYPTED_TYPE,
       warning: ENCRYPTED_KEYRING_WARNING,
-      salt,
       iv: encrypted.iv,
       tag: encrypted.tag,
       ciphertext: encrypted.ciphertext,
-      signer: vault.signer,
-      publicKey: exportPublicKey(vault.signingKeyPair),
     };
   }
   return {
+    ...common,
     type: KEYRING_PLAINTEXT_TYPE,
     unencrypted: true,
     warning: PLAINTEXT_KEYRING_WARNING,
     vault_key_b64: vault.vaultKey.toString('base64'),
     address_key_b64: vault.addressKey.toString('base64'),
-    signer: vault.signer,
-    publicKey: exportPublicKey(vault.signingKeyPair),
+    content_keys: privateKeyEpochs(vault),
     privateKey: exportPrivateKey(vault.signingKeyPair),
   };
 }
-
 export function exportBundle(args = {}) {
   const vault = args.vault;
   if (!vault) throw new Error('exportBundle requires a vault');
@@ -953,7 +1575,7 @@ export function exportBundle(args = {}) {
 
   const roots = vault.__computeRoots();
   const bundle = {
-    schema: 'enigma.vault_bundle.v1',
+    schema: VAULT_BUNDLE_SCHEMA,
     exported_at: nowIso(args.now),
     vault: {
       schema: vault.schema,
@@ -966,11 +1588,15 @@ export function exportBundle(args = {}) {
       updated_at: vault.updated_at,
       encryption: vault.encryption,
       key_id: vault.key_id,
+      active_key_epoch: vault.activeKeyEpoch,
+      key_epochs: publicKeyEpochs(vault),
+      old_epoch_read_policy: vault.allowOldEpochReads === true ? 'retained_keys_allowed' : 'active_epoch_only',
+      key_erasure_scope: 'software_process_and_persisted_bundle_only',
       active_set_root: roots.active_set_root,
       receipt_log_root: roots.receipt_log_root,
       sequence: vault.sequence,
     },
-    keyring: buildKeyring(vault, args.passphrase),
+    keyring: buildKeyring(vault, args.passphrase, { kdf: args.kdf }),
     memory_objects: [...vault.memories.values()].map(publicRecord),
     active_memory_addresses: [...vault.activeAddresses].sort(),
     tombstones: [...vault.tombstones.values()].sort((a, b) => a.memory_addr.localeCompare(b.memory_addr)),
@@ -986,81 +1612,318 @@ export function exportBundle(args = {}) {
   return bundle;
 }
 
+function isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function assertExactKeys(value, allowed, label) {
+  if (!isPlainObject(value)) throw new Error(`${label} must be an object`);
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) throw new Error(`${label} contains unsupported field: ${key}`);
+  }
+}
+
+function assertNonEmptyString(value, label) {
+  if (typeof value !== 'string' || value.length === 0) throw new Error(`${label} must be a non-empty string`);
+}
+
+function derivedPublicKeyPem(privateKey) {
+  return createPublicKey(createPrivateKey(privateKey)).export({ type: 'spki', format: 'pem' }).trim();
+}
+
+function validateRecordCiphertext(bundle, record, epochEntries) {
+  if (record?.schema !== MEMORY_OBJECT_SCHEMA) throw new Error(`unsupported memory object schema: ${record?.schema ?? '<missing>'}`);
+  assertNonEmptyString(record.memory_addr, 'memory_object.memory_addr');
+  assertNonEmptyString(record.key_id, 'memory_object.key_id');
+  if (Object.prototype.hasOwnProperty.call(record, 'content_hash')) throw new Error('memory object exposes a forbidden unkeyed content hash');
+  for (const key of Object.keys(record)) {
+    if (isPlaintextLikeKey(key)) throw new Error(`memory object exposes forbidden plaintext field: ${key}`);
+  }
+  if (!/^hmac-sha256:[a-f0-9]{64}$/.test(record.content_commitment ?? '')) {
+    throw new Error('memory object content commitment must be keyed');
+  }
+  if (!Number.isInteger(record.key_epoch) || record.key_epoch < 1) throw new Error('memory_object.key_epoch must be a positive integer');
+  const epoch = epochEntries.get(record.key_epoch);
+  if (!epoch || epoch.key_id !== record.key_id) throw new Error(`memory object references unknown key epoch/id: ${record.key_epoch}/${record.key_id}`);
+  const encrypted = record.content_ciphertext;
+  if (!isPlainObject(encrypted) || encrypted.alg !== 'AES-256-GCM') throw new Error('memory object ciphertext envelope is invalid');
+  const expectedAad = canonicalContentAad({ vault_id: bundle.vault.vault_id }, record.memory_addr, record.key_epoch, record.key_id);
+  if (encrypted.aad !== expectedAad) throw new Error(`memory object AAD mismatch: ${record.memory_addr}`);
+  let plaintext;
+  try {
+    const decipher = createDecipheriv('aes-256-gcm', epoch.key, Buffer.from(encrypted.iv, 'base64'));
+    decipher.setAAD(Buffer.from(expectedAad, 'utf8'));
+    decipher.setAuthTag(Buffer.from(encrypted.tag, 'base64'));
+    plaintext = Buffer.concat([
+      decipher.update(Buffer.from(encrypted.ciphertext, 'base64')),
+      decipher.final(),
+    ]);
+  } catch {
+    throw new Error(`memory object authentication failed: ${record.memory_addr}`);
+  } finally {
+    plaintext?.fill(0);
+  }
+}
+
+function validateStrictBundle(bundle, keyring, decrypted, epochEntries) {
+  assertExactKeys(bundle, new Set([
+    'schema', 'exported_at', 'vault', 'keyring', 'memory_objects',
+    'active_memory_addresses', 'tombstones', 'events', 'receipts', 'export_receipt',
+  ]), 'vault bundle');
+  assertExactKeys(bundle.vault, new Set([
+    'schema', 'vault_id', 'tenant_id', 'subject_id', 'actor_id', 'policy_id',
+    'created_at', 'updated_at', 'encryption', 'key_id', 'active_key_epoch',
+    'key_epochs', 'old_epoch_read_policy', 'key_erasure_scope', 'active_set_root',
+    'receipt_log_root', 'sequence',
+  ]), 'vault bundle manifest');
+  const encryptedKeyringFields = new Set([
+    'schema', 'vault_schema', 'vault_id', 'active_key_epoch', 'key_epochs',
+    'old_epoch_read_policy', 'signer', 'publicKey', 'type', 'warning', 'kdf', 'salt', 'iv', 'tag', 'ciphertext',
+  ]);
+  const plaintextKeyringFields = new Set([
+    'schema', 'vault_schema', 'vault_id', 'active_key_epoch', 'key_epochs',
+    'old_epoch_read_policy', 'signer', 'publicKey', 'type', 'warning', 'unencrypted', 'vault_key_b64',
+    'address_key_b64', 'content_keys', 'privateKey',
+  ]);
+  assertExactKeys(
+    keyring,
+    keyring.type === KEYRING_ENCRYPTED_TYPE ? encryptedKeyringFields : plaintextKeyringFields,
+    'vault keyring',
+  );
+  assertExactKeys(
+    decrypted,
+    keyring.type === KEYRING_ENCRYPTED_TYPE
+      ? new Set(['vault_key_b64', 'address_key_b64', 'privateKey', 'content_keys'])
+      : new Set(['vault_key_b64', 'address_key_b64', 'privateKey', 'content_keys']),
+    'decrypted vault keyring',
+  );
+  if (bundle.vault.schema !== VAULT_SCHEMA) throw new Error('vault manifest schema mismatch');
+  if (bundle.vault.encryption !== 'local_aead') throw new Error('vault manifest encryption mismatch');
+  assertNonEmptyString(bundle.vault.vault_id, 'vault.vault_id');
+  if (!Number.isInteger(bundle.vault.active_key_epoch) || bundle.vault.active_key_epoch < 1) {
+    throw new Error('vault.active_key_epoch must be a positive integer');
+  }
+  if (!Number.isInteger(bundle.vault.sequence) || bundle.vault.sequence < 0) throw new Error('vault.sequence must be a non-negative integer');
+  if (keyring.schema !== 'enigma.vault_keyring.v2') throw new Error('keyring schema mismatch');
+  if (keyring.vault_schema !== bundle.vault.schema || keyring.vault_id !== bundle.vault.vault_id) {
+    throw new Error('keyring vault binding mismatch');
+  }
+  if (keyring.active_key_epoch !== bundle.vault.active_key_epoch) throw new Error('keyring active key epoch mismatch');
+  if (keyring.old_epoch_read_policy !== bundle.vault.old_epoch_read_policy) {
+    throw new Error('keyring old-epoch read policy mismatch');
+  }
+  const decryptedEpochDescriptors = [...epochEntries.values()]
+    .sort((left, right) => left.epoch - right.epoch)
+    .map((entry) => pruneUndefined({
+      epoch: entry.epoch,
+      key_id: entry.key_id,
+      status: entry.status,
+      created_at: entry.created_at,
+      sealed_at: entry.sealed_at,
+    }));
+  if (canonical(decryptedEpochDescriptors) !== canonical(keyring.key_epochs)) {
+    throw new Error('decrypted content keys do not match signed key epoch descriptors');
+  }
+  if (bundle.vault.key_id !== epochEntries.get(bundle.vault.active_key_epoch)?.key_id) throw new Error('vault active key id mismatch');
+  if (canonical(keyring.key_epochs) !== canonical(bundle.vault.key_epochs)) throw new Error('key epoch manifest mismatch');
+  if (derivedPublicKeyPem(decrypted.privateKey) !== String(keyring.publicKey).trim()) throw new Error('keyring public/private signing key mismatch');
+  if (keyring.signer?.key_id === undefined) throw new Error('keyring signer key id is missing');
+  if (!Array.isArray(keyring.key_epochs) || keyring.key_epochs.length !== epochEntries.size) {
+    throw new Error('keyring key epoch descriptor count mismatch');
+  }
+
+  if (!Array.isArray(bundle.receipts) || !Array.isArray(bundle.events)) throw new Error('bundle receipts and events must be arrays');
+  if (bundle.receipts.length !== bundle.events.length || bundle.vault.sequence !== bundle.receipts.length) {
+    throw new Error('bundle event/receipt sequence length mismatch');
+  }
+  for (let index = 0; index < bundle.events.length; index += 1) {
+    const entry = bundle.events[index];
+    assertExactKeys(entry, new Set(['event', 'canonical', 'hash']), `event entry ${index}`);
+    if (entry.event?.schema !== EVENT_SCHEMA || entry.event?.sequence !== index) throw new Error(`event ${index} schema or sequence mismatch`);
+    const expectedCanonical = canonical(entry.event);
+    const expectedHash = asSha256(expectedCanonical);
+    if (entry.canonical !== expectedCanonical || entry.hash !== expectedHash) throw new Error(`event ${index} canonical/hash mismatch`);
+    const receipt = bundle.receipts[index];
+    if (receipt?.tenant_id !== bundle.vault.tenant_id || receipt?.subject_id !== bundle.vault.subject_id) {
+      throw new Error(`receipt ${index} vault identity binding mismatch`);
+    }
+    if (receipt?.event_hash !== expectedHash || receipt?.operation !== entry.event.operation) throw new Error(`event ${index} receipt binding mismatch`);
+  }
+  const chain = verifyReceiptChain({
+    receipts: bundle.receipts,
+    publicKey: keyring.publicKey,
+    expectedSignerKeyId: keyring.signer.key_id,
+    expectedReceiptLogRoot: bundle.vault.receipt_log_root,
+    expectedActiveSetRoot: bundle.vault.active_set_root,
+    verifyEmbeddedReceiptLogRoot: false,
+  });
+  if (!chain.ok) throw new Error(`receipt chain verification failed: ${chain.errors.join('; ')}`);
+  if (bundle.receipts.length === 0 || canonical(bundle.export_receipt) !== canonical(bundle.receipts.at(-1))) {
+    throw new Error('export receipt does not match the signed receipt chain');
+  }
+  if (computeSetRoot(bundle.active_memory_addresses ?? []) !== bundle.vault.active_set_root) {
+    throw new Error('active memory address root mismatch');
+  }
+
+  if (!Array.isArray(bundle.memory_objects) || !Array.isArray(bundle.active_memory_addresses) || !Array.isArray(bundle.tombstones)) {
+    throw new Error('bundle lifecycle collections must be arrays');
+  }
+  const recordByAddress = new Map();
+  const activeAddressSet = new Set(bundle.active_memory_addresses);
+  if (activeAddressSet.size !== bundle.active_memory_addresses.length) throw new Error('duplicate active memory address');
+  for (const record of bundle.memory_objects) {
+    if (recordByAddress.has(record.memory_addr)) throw new Error(`duplicate memory address: ${record.memory_addr}`);
+    recordByAddress.set(record.memory_addr, record);
+    validateRecordCiphertext(bundle, record, epochEntries);
+  }
+  for (const address of bundle.active_memory_addresses) {
+    if (!recordByAddress.has(address)) throw new Error(`active memory address has no record: ${address}`);
+    const record = recordByAddress.get(address);
+    if (record?.state !== 'active') throw new Error(`active memory address references non-active record: ${address}`);
+  }
+  for (const record of bundle.memory_objects) {
+    if (record.state === 'active' && !activeAddressSet.has(record.memory_addr)) {
+      throw new Error(`active memory record is absent from active address set: ${record.memory_addr}`);
+    }
+  }
+}
+
 export function importBundle(args = {}) {
-  const source = args.schema === 'enigma.vault_bundle.v1' ? args : (args.bundle?.bundle ?? args.bundle ?? args);
+  const source = args.schema === VAULT_BUNDLE_SCHEMA ? args : (args.bundle?.bundle ?? args.bundle ?? args);
   const bundle = typeof source === 'string' ? JSON.parse(source) : source;
-  if (!bundle || bundle.schema !== 'enigma.vault_bundle.v1') throw new Error('importBundle requires an enigma.vault_bundle.v1 bundle');
+  if (!bundle || bundle.schema !== VAULT_BUNDLE_SCHEMA) throw new Error(`importBundle requires an ${VAULT_BUNDLE_SCHEMA} bundle`);
+  const strict = args.strict === true;
+  const insecureDevMode = args.insecureDevMode === true || args.insecure_dev_mode === true;
   const warnings = [];
-  let vaultKey;
-  let addressKey;
-  let privateKey;
   const keyring = bundle.keyring;
+  let decrypted;
   if (keyring?.type === KEYRING_ENCRYPTED_TYPE) {
-    if (args.passphrase === undefined || args.passphrase === null || String(args.passphrase).length === 0) {
+    if (args.passphrase === undefined || args.passphrase === null || String(args.passphrase).trim().length === 0) {
       throw new Error('Encrypted keyring requires passphrase');
     }
-    const decrypted = decryptKeyring(keyring, args.passphrase);
-    vaultKey = decrypted.vault_key_b64;
-    addressKey = decrypted.address_key_b64;
-    privateKey = decrypted.privateKey;
+    decrypted = decryptKeyring(keyring, args.passphrase);
+  } else if (keyring?.type === KEYRING_PLAINTEXT_TYPE) {
+    if (strict && !insecureDevMode) throw new Error('Strict vault import rejects plaintext keyrings outside explicit insecure-dev mode');
+    warnings.push(DEPRECATION_PLAINTEXT_KEYRING);
+    decrypted = {
+      vault_key_b64: keyring.vault_key_b64,
+      address_key_b64: keyring.address_key_b64,
+      privateKey: keyring.privateKey,
+      content_keys: keyring.content_keys,
+    };
   } else {
-    if (keyring?.type === KEYRING_PLAINTEXT_TYPE) {
-      warnings.push(DEPRECATION_PLAINTEXT_KEYRING);
-    }
-    vaultKey = keyring?.vault_key_b64;
-    addressKey = keyring?.address_key_b64;
-    privateKey = keyring?.privateKey;
+    throw new Error(`Unsupported vault keyring type: ${keyring?.type ?? '<missing>'}`);
   }
-  const restoredSigningKeyPair = privateKey
-    ? {
-        key_id: keyring?.signer?.key_id,
-        signer: keyring?.signer,
-        publicKey: keyring?.publicKey,
-        privateKey,
-      }
-    : undefined;
+  assertNonEmptyString(decrypted?.address_key_b64, 'keyring address key');
+  assertNonEmptyString(decrypted?.privateKey, 'keyring private signing key');
+  keyBytes(decrypted.address_key_b64, 'address key');
+
+  const activeKeyEpoch = Number(bundle.vault?.active_key_epoch ?? keyring.active_key_epoch ?? 1);
+  const rawContentKeys = Array.isArray(decrypted.content_keys) && decrypted.content_keys.length > 0
+    ? decrypted.content_keys
+    : [{
+      epoch: activeKeyEpoch,
+      key_id: bundle.vault?.key_id,
+      status: 'active',
+      created_at: bundle.vault?.created_at,
+      key_b64: decrypted.vault_key_b64,
+    }];
+  const epochs = rawContentKeys.map((entry) => normalizeKeyEpoch(entry, undefined, undefined, bundle.vault?.created_at));
+  const epochEntries = new Map(epochs.map((entry) => [entry.epoch, entry]));
+  if (epochEntries.size !== epochs.length) throw new Error('duplicate content key epoch');
+  if (!epochEntries.has(activeKeyEpoch)) throw new Error(`active content key epoch ${activeKeyEpoch} is unavailable`);
+  if (decrypted.vault_key_b64 !== undefined
+    && decrypted.vault_key_b64 !== epochEntries.get(activeKeyEpoch).key.toString('base64')) {
+    throw new Error('active vault key alias does not match the active content key epoch');
+  }
+  if (strict) validateStrictBundle(bundle, keyring, decrypted, epochEntries);
+
+  const restoredSigningKeyPair = {
+    key_id: keyring.signer?.key_id,
+    signer: keyring.signer,
+    publicKey: keyring.publicKey,
+    privateKey: decrypted.privateKey,
+  };
   const vault = createVault({
     vault_id: bundle.vault?.vault_id,
     tenant_id: bundle.vault?.tenant_id,
     subject_id: bundle.vault?.subject_id,
     actor_id: args.actor_id ?? args.actorId ?? bundle.vault?.actor_id,
     policy_id: bundle.vault?.policy_id,
-    vault_key: vaultKey,
-    address_key: addressKey,
+    vault_key: epochEntries.get(activeKeyEpoch).key,
+    address_key: decrypted.address_key_b64,
+    key_epochs: epochs,
+    active_key_epoch: activeKeyEpoch,
+    allow_old_epoch_reads: args.allowOldEpochReads ?? args.allow_old_epoch_reads
+      ?? (keyring.old_epoch_read_policy ?? bundle.vault?.old_epoch_read_policy) !== 'active_epoch_only',
     signingKeyPair: restoredSigningKeyPair,
-    signer: keyring?.signer,
+    signer: keyring.signer,
     now: bundle.vault?.created_at,
   });
   vault.created_at = bundle.vault?.created_at ?? vault.created_at;
   vault.updated_at = bundle.vault?.updated_at ?? vault.updated_at;
   vault.sequence = Number.isInteger(bundle.vault?.sequence) ? bundle.vault.sequence : 0;
-  vault.events = Array.isArray(bundle.events) ? bundle.events.map(sanitizeImportedEventEntry).filter(Boolean) : [];
+  vault.events = Array.isArray(bundle.events)
+    ? (strict
+      ? bundle.events.map((entry) => ({ ...entry, event: { ...entry.event } }))
+      : bundle.events.map(sanitizeImportedEventEntry).filter(Boolean))
+    : [];
   vault.receipts = Array.isArray(bundle.receipts) ? bundle.receipts.map((receipt) => ({
-    ...sanitizePublicValue(receipt),
-    signer: receipt.signer ? { ...sanitizePublicValue(receipt.signer) } : receipt.signer,
-    signature: receipt.signature ? { ...sanitizePublicValue(receipt.signature) } : receipt.signature,
+    ...(strict ? receipt : sanitizePublicValue(receipt)),
+    signer: receipt.signer ? { ...(strict ? receipt.signer : sanitizePublicValue(receipt.signer)) } : receipt.signer,
+    signature: receipt.signature ? { ...(strict ? receipt.signature : sanitizePublicValue(receipt.signature)) } : receipt.signature,
   })) : [];
   vault.memories = new Map();
   for (const record of bundle.memory_objects ?? []) {
-    vault.memories.set(record.memory_addr, publicRecord(record));
+    const imported = strict ? record : publicRecord(record);
+    vault.memories.set(record.memory_addr, { ...imported, content_ciphertext: { ...imported.content_ciphertext } });
   }
   const lifecycle = reconcileImportedLifecycle(bundle, vault.memories, vault.receipts);
   vault.activeAddresses = lifecycle.active;
   vault.tombstones = lifecycle.tombstones;
-  const roots = vault.__computeRoots();
-  vault.active_set_root = roots.active_set_root;
-  vault.receipt_log_root = roots.receipt_log_root;
-  appendEvent(vault, {
-    operation: 'import',
-    actor_id: args.actor_id ?? args.actorId,
-    policy_id: args.policy_id ?? args.policyId,
-    now: args.now,
-    metadata: {
-      imported_memory_count: vault.memories.size,
-      imported_active_count: vault.activeAddresses.size,
-      imported_tombstone_count: vault.tombstones.size,
-    },
-  });
-  return { vault, active_memory_addresses: [...vault.activeAddresses].sort(), tombstones: [...vault.tombstones.values()], warnings };
-
+  applyLifecycleRoots(vault);
+  if (args.recordImport !== false) {
+    appendEvent(vault, {
+      operation: 'import',
+      actor_id: args.actor_id ?? args.actorId,
+      policy_id: args.policy_id ?? args.policyId,
+      now: args.now,
+      metadata: {
+        imported_memory_count: vault.memories.size,
+        imported_active_count: vault.activeAddresses.size,
+        imported_tombstone_count: vault.tombstones.size,
+      },
+    });
+  }
+  return {
+    vault,
+    active_memory_addresses: [...vault.activeAddresses].sort(),
+    tombstones: [...vault.tombstones.values()],
+    warnings,
+    verified: strict,
+  };
 }
+
+export * from './poseidon.js';
+export * from './enclave.js';
+// Named (not star) export: e2ee.mjs also defines poseidon(), which would conflict
+// with poseidon.js under export *.
+export {
+  E2EE_SCHEMA,
+  PAYLOAD_COMMIT_DOMAIN,
+  HPKE_WRAP_INFO,
+  BN254_SCALAR_FIELD,
+  canonicalJson,
+  normalizeFieldElement32,
+  deriveScopeCommit,
+  deriveNoteContext,
+  deriveAad,
+  generateRecipientKeyPair,
+  derivePayloadCommit,
+  deriveFinalNote,
+  e2eeEncrypt,
+  e2eeDecrypt,
+} from './e2ee.mjs';
+export * from './receipt.js';
+export * from './erasure.js';
+export * from './persistence.js';