sealkeep 0.9.0 → 0.11.0

package/dist/src/team-offboarding.js

@@ -0,0 +1,1043 @@
+import { createHash, randomUUID } from "node:crypto";
+import { link, mkdir, open, readFile, readdir, rename, rm, stat } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { Writable } from "node:stream";
+import { execFile } from "node:child_process";
+import { openArchiveToFile, sealArchiveToFile, unwrapArchiveKey, validateEnvelope, wrapAll, x25519PrivateKeyFromRaw, x25519PublicKeyFromRaw, zeroize, } from "../packages/sealkeep-crypto/src/index.js";
+import { getTeamRoster, listTeamArchives, pullTeamCiphertextStream, pushFramedArchive, registerTeamArchive, } from "./cloud.js";
+import { managedIndexStore, managedTeamIndexStore } from "./index-sync.js";
+import { mergeTeamProjectShard, openVerifiedManagedIndex, writeContentIndexCheckpoint, } from "./search.js";
+import { MAX_FRAME_METADATA_BYTES, writeChunksToFile } from "./byte-stream.js";
+import { fail, isSealkeepError } from "./errors.js";
+import { ensureTeamIdentity } from "./team-presence.js";
+import { createProgressDeadline } from "./progress-deadline.js";
+import { backgroundUploadBytesPerSecond, readLocalSettings } from "./machine-settings.js";
+import { paceBackgroundByteStream } from "./background-bandwidth.js";
+import { freeBytes, resolveReserveBytes } from "./disk.js";
+import { listArchives, MAX_DELTA_CHAIN_LINKS, readConfig, teamSpaceOf, writeRecord } from "./vault.js";
+import { isV2 } from "./types.js";
+const journalDirectory = (dataDir, scope) => join(dataDir, scope.transition === "invitation" ? "team-invitations" : "team-offboarding", createHash("sha256")
+    .update(JSON.stringify([scope.spaceKey, scope.targetAccountId])).digest("hex"));
+const emptyIndex = () => ({
+    version: 2, builtAt: new Date().toISOString(),
+    archives: Object.create(null), tokens: Object.create(null), meta: Object.create(null),
+});
+const sameRoster = (roster) => JSON.stringify(roster.members
+    .map((member) => [member.account_id, member.public_key, member.role]).sort((a, b) => Number(a[0]) - Number(b[0])));
+const MAX_HANDOFF_INDEX_BYTES = 64 * 1024 * 1024;
+async function remote(operation, action) {
+    const deadline = createProgressDeadline({ operation, idleMs: 2 * 60_000 });
+    try {
+        return await deadline.wait(action({ signal: deadline.signal, onProgress: () => deadline.progress() }));
+    }
+    finally {
+        deadline.close();
+    }
+}
+async function atomicJson(path, value) {
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    const handle = await open(temporary, "wx", 0o600);
+    try {
+        await handle.writeFile(JSON.stringify(value));
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    await rename(temporary, path);
+    // The membership commit is remote. Persist directory entries as well as
+    // file contents before allowing it to depend on this local recovery state.
+    const directory = await open(dirname(path), "r").catch((error) => {
+        if (["EISDIR", "EPERM", "EACCES", "ENOTSUP"].includes(error.code ?? ""))
+            return null;
+        throw error;
+    });
+    if (!directory)
+        return; // Directory descriptors are unavailable on some platforms.
+    try {
+        await directory.sync();
+    }
+    catch (error) {
+        if (!["EINVAL", "EPERM", "ENOTSUP", "EBADF"].includes(error.code ?? ""))
+            throw error;
+    }
+    finally {
+        await directory.close();
+    }
+}
+async function requireStagingRoom(dataDir, directory, bytes) {
+    if (!Number.isSafeInteger(bytes) || bytes < 0)
+        fail("ciphertext_integrity_failed", "Shared history has no valid staging size");
+    const available = await freeBytes(directory);
+    const reserve = await resolveReserveBytes(dataDir);
+    if (available !== undefined && available < bytes + reserve) {
+        fail("insufficient_disk_space", "There is not enough free space to preserve team history before this departure", {
+            availableBytes: available, stagingBytes: bytes, reserveBytes: reserve,
+        });
+    }
+}
+async function discardCapturedFiles(directory, journal) {
+    const files = Object.values(journal.archives).map((archive) => archive.file);
+    if (journal.snapshot)
+        files.push(journal.snapshot.file);
+    for (const file of files) {
+        if (!/^[a-f0-9-]{36}\.(?:ciphertext|index)$/.test(file)) {
+            fail("ciphertext_integrity_failed", "The saved team handoff has an invalid cleanup filename");
+        }
+        await rm(join(directory, file), { force: true });
+    }
+}
+async function cleanupCompleted(directory, journal) {
+    if (!journal.completed || !journal.completedReceipt)
+        return;
+    await discardCapturedFiles(directory, journal);
+    journal.archives = Object.create(null);
+    delete journal.snapshot;
+    delete journal.sizes;
+    delete journal.generation;
+    delete journal.custody;
+    await atomicJson(join(directory, "journal.json"), journal);
+}
+async function readJournal(directory, scope) {
+    const value = await readFile(join(directory, "journal.json"), "utf8").catch((error) => {
+        if (error?.code === "ENOENT")
+            return null;
+        throw error;
+    });
+    if (value === null)
+        return null;
+    const journal = JSON.parse(value);
+    if (journal.version !== 1 || journal.scope?.spaceKey !== scope.spaceKey
+        || journal.scope?.targetAccountId !== scope.targetAccountId
+        || journal.scope?.transition !== scope.transition
+        || !Array.isArray(journal.refs) || !journal.archives
+        || !Number.isSafeInteger(journal.membershipVersion) || journal.membershipVersion < 1) {
+        fail("ciphertext_integrity_failed", "The saved team departure handoff is not valid");
+    }
+    if ((journal.snapshot && !/^[a-f0-9-]{36}\.index$/.test(journal.snapshot.file))
+        || Object.values(journal.archives).some((archive) => !/^[a-f0-9-]{36}\.ciphertext$/.test(archive.file))) {
+        fail("ciphertext_integrity_failed", "The saved departure references a path outside its bounded staging files");
+    }
+    return journal;
+}
+/** A live process owns one short phase; a crashed process leaves a recoverable lock. */
+const PROCESS_INSTANCE = randomUUID();
+const processStart = (pid) => new Promise((resolve) => {
+    execFile("ps", ["-p", String(pid), "-o", "lstart="], { timeout: 1_000, maxBuffer: 4_096 }, (error, stdout) => resolve(error ? null : stdout.trim() || null));
+});
+async function withJournal(directory, work) {
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const path = join(directory, "lock");
+    const token = randomUUID();
+    const candidate = join(directory, `lock.${token}.tmp`);
+    const handle = await open(candidate, "wx", 0o600);
+    try {
+        await handle.writeFile(JSON.stringify({ pid: process.pid, token, instance: PROCESS_INSTANCE,
+            processStart: await processStart(process.pid) }));
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        for (let attempt = 0;; attempt += 1) {
+            try {
+                // Link only a fully written owner record: another process never observes
+                // an empty lock left between exclusive creation and the first write.
+                await link(candidate, path);
+                break;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+                const previous = JSON.parse(await readFile(path, "utf8"));
+                let alive = true;
+                try {
+                    process.kill(previous.pid, 0);
+                }
+                catch (failure) {
+                    if (failure.code === "ESRCH")
+                        alive = false;
+                }
+                if (alive && previous.processStart) {
+                    const actualStart = await processStart(previous.pid);
+                    if (actualStart && actualStart !== previous.processStart)
+                        alive = false;
+                }
+                if (alive && previous.pid === process.pid && previous.instance && previous.instance !== PROCESS_INSTANCE)
+                    alive = false;
+                if (alive || attempt > 0)
+                    fail("team_state_changed", "A team departure handoff is already running; retry when it finishes");
+                await rm(path);
+            }
+        }
+    }
+    finally {
+        await rm(candidate, { force: true });
+    }
+    try {
+        // Only this locked handoff directory owns these temporary files. Recover
+        // plaintext/compressor scratch left by a process exit during sealing.
+        const saved = await readFile(join(directory, "journal.json"), "utf8").then((raw) => JSON.parse(raw))
+            .catch((error) => { if (error?.code === "ENOENT")
+            return null; throw error; });
+        const referenced = new Set([...(saved?.snapshot ? [saved.snapshot.file] : []),
+            ...Object.values(saved?.archives ?? {}).map((archive) => archive.file)]);
+        for (const name of await readdir(directory)) {
+            if (/^(?:[a-f0-9-]{36}\.temporary\.(?:jsonl|index)|\.vlbody-[a-f0-9-]{36}|journal\.json\.[a-f0-9-]{36}\.tmp)$/.test(name)
+                || (/^[a-f0-9-]{36}\.(?:ciphertext|index)$/.test(name) && !referenced.has(name))) {
+                await rm(join(directory, name), { force: true });
+            }
+        }
+        return await work();
+    }
+    finally {
+        const current = JSON.parse(await readFile(path, "utf8"));
+        if (current.token === token)
+            await rm(path);
+    }
+}
+/** Extract a capped envelope while ciphertext continues directly to disk. */
+async function* archiveBody(source, captured, maximumBytes) {
+    let prefix = Buffer.alloc(0);
+    let parsed = false;
+    let bytes = 0;
+    const admit = (chunk) => {
+        bytes += chunk.length;
+        if (bytes > maximumBytes)
+            fail("ciphertext_integrity_failed", "A shared archive exceeds its authenticated ciphertext size");
+        return chunk;
+    };
+    for await (const chunk of source) {
+        if (parsed) {
+            yield admit(chunk);
+            continue;
+        }
+        prefix = Buffer.concat([prefix, chunk]);
+        if (prefix.length < 8)
+            continue;
+        if (prefix.subarray(0, 4).toString("ascii") !== "VLA1") {
+            fail("ciphertext_integrity_failed", "A shared archive has no authenticated envelope");
+        }
+        const size = prefix.readUInt32BE(4);
+        if (size > MAX_FRAME_METADATA_BYTES)
+            fail("ciphertext_integrity_failed", "A shared archive envelope exceeds the bounded metadata limit");
+        if (prefix.length < 8 + size)
+            continue;
+        captured.envelope = JSON.parse(prefix.subarray(8, 8 + size).toString("utf8"));
+        parsed = true;
+        const rest = prefix.subarray(8 + size);
+        prefix = Buffer.alloc(0);
+        if (rest.length)
+            yield admit(rest);
+    }
+    if (!parsed)
+        fail("ciphertext_integrity_failed", "A shared archive envelope is truncated");
+}
+/** Every live grant must be restorable, not merely present in a token index. */
+function validateCapturedCatalog(index, journal) {
+    const refs = new Set(journal.refs);
+    if (refs.size !== journal.refs.length || Object.keys(index.archives).length !== refs.size) {
+        fail("ciphertext_integrity_failed", "Every current team grant requires a complete authenticated scoped catalog row before departure");
+    }
+    const ordered = [];
+    const done = new Set();
+    const visiting = new Set();
+    const depth = new Map();
+    const check = (ref) => {
+        const row = index.archives[ref];
+        const facts = index.meta?.[ref]?.archiveRecord;
+        if (!refs.has(ref) || !row || row[3] !== journal.scope.spaceKey || !facts || facts.v !== 1
+            || !Number.isSafeInteger(facts.sourceBytes) || facts.sourceBytes < 0
+            || !Number.isSafeInteger(facts.storedBytes) || facts.storedBytes < 0
+            || !Number.isSafeInteger(facts.chunks) || facts.chunks < 0
+            || !/^[a-f0-9]{64}$/.test(facts.sourceSha256) || !/^[a-f0-9]{64}$/.test(facts.ciphertextSha256)) {
+            fail("ciphertext_integrity_failed", "A current team grant lacks verified scoped archive facts; departure was withheld");
+        }
+        if (facts.delta) {
+            const base = index.meta?.[facts.delta.baseArchiveId]?.archiveRecord;
+            if (!Number.isSafeInteger(facts.delta.baseBytes) || facts.delta.baseBytes <= 0
+                || facts.delta.baseBytes >= facts.sourceBytes || base?.sourceBytes !== facts.delta.baseBytes) {
+                fail("ciphertext_integrity_failed", "A shared delta does not match its authenticated base size");
+            }
+            return facts.delta.baseArchiveId;
+        }
+        return undefined;
+    };
+    for (const start of journal.refs) {
+        const path = [];
+        let ref = start;
+        while (ref !== undefined && !done.has(ref)) {
+            if (visiting.has(ref))
+                fail("ciphertext_integrity_failed", "The shared history catalog contains a delta cycle");
+            visiting.add(ref);
+            path.push(ref);
+            ref = check(ref);
+        }
+        for (const member of path.reverse()) {
+            const base = index.meta[member].archiveRecord.delta?.baseArchiveId;
+            const links = base ? depth.get(base) + 1 : 1;
+            if (links > MAX_DELTA_CHAIN_LINKS) {
+                fail("ciphertext_integrity_failed", "A shared delta chain exceeds the native recovery depth; consolidate it before departure");
+            }
+            depth.set(member, links);
+            visiting.delete(member);
+            done.add(member);
+            ordered.push(member);
+        }
+    }
+    return ordered;
+}
+async function verifyCapturedArchives(directory, journal, index, ordered, privateKey) {
+    // Copy incremental hash states at branches. Every ciphertext opens once,
+    // plaintext only crosses a bounded writable sink, and each delta proves its
+    // full source hash (a tail hash cannot stand in for the complete transcript).
+    const hashes = new Map();
+    for (const ref of ordered) {
+        const facts = index.meta[ref].archiveRecord;
+        const captured = journal.archives[ref];
+        const envelope = captured.envelope;
+        validateEnvelope(envelope, facts.storedBytes);
+        if (envelope.chunks.some((chunk) => !Number.isSafeInteger(chunk.storedBytes) || chunk.storedBytes > 16 * 1024 * 1024)) {
+            fail("ciphertext_integrity_failed", "Shared history exceeds the bounded departure verification chunk size");
+        }
+        const expectedBytes = facts.sourceBytes - (facts.delta?.baseBytes ?? 0);
+        if (captured.bytes !== facts.storedBytes || captured.sha256 !== facts.ciphertextSha256
+            || envelope.archiveId !== (facts.envelopeArchiveId ?? ref) || envelope.suite !== facts.algorithm
+            || envelope.chunks.length !== facts.chunks
+            || (envelope.manifest.originalBytes ?? envelope.manifest.plaintextBytes) !== expectedBytes) {
+            fail("ciphertext_integrity_failed", "A retained envelope does not match its authenticated archive facts");
+        }
+        const hash = facts.delta ? hashes.get(facts.delta.baseArchiveId).copy() : createHash("sha256");
+        let bytes = 0;
+        const sink = new Writable({ write(chunk, _encoding, callback) {
+                bytes += chunk.length;
+                if (bytes > expectedBytes) {
+                    callback(new Error("Shared history exceeds its authenticated plaintext size"));
+                    return;
+                }
+                hash.update(chunk);
+                callback();
+            } });
+        await openArchiveToFile(envelope, join(directory, captured.file), sink, { privateKey }, {
+            maxStoredChunkBytes: 16 * 1024 * 1024,
+            maxOriginalBytes: expectedBytes,
+            maxExpandedChunkBytes: 64 * 1024 * 1024,
+            streamChunkDecompression: true,
+        });
+        if (bytes !== expectedBytes || hash.copy().digest("hex") !== facts.sourceSha256) {
+            fail("ciphertext_integrity_failed", "Shared history cannot reproduce its authenticated source hash");
+        }
+        hashes.set(ref, hash);
+    }
+}
+function filtered(index, scope, allowed) {
+    const result = emptyIndex();
+    mergeTeamProjectShard(result, index, scope.project, scope.spaceKey, new Map(), scope.projectKey);
+    for (const ref of Object.keys(result.archives)) {
+        if (allowed.has(ref))
+            continue;
+        delete result.archives[ref];
+        delete result.meta?.[ref];
+    }
+    for (const token of Object.keys(result.tokens)) {
+        result.tokens[token] = result.tokens[token].filter((posting) => allowed.has(posting.split("@")[0]));
+        if (!result.tokens[token].length)
+            delete result.tokens[token];
+    }
+    return result;
+}
+async function openBoundedIndex(dataDir, directory, envelope, ciphertext, opener, coverage) {
+    const originalBytes = envelope.manifest.originalBytes ?? envelope.manifest.plaintextBytes;
+    if (ciphertext.length > MAX_HANDOFF_INDEX_BYTES || !Number.isSafeInteger(originalBytes)
+        || originalBytes < 0 || originalBytes > MAX_HANDOFF_INDEX_BYTES) {
+        fail("provider_unsupported", "Departure history exceeds the bounded 64 MiB index checkpoint limit");
+    }
+    if (envelope.chunks.some((chunk) => !Number.isSafeInteger(chunk.storedBytes) || chunk.storedBytes > 16 * 1024 * 1024)) {
+        fail("ciphertext_integrity_failed", "The departure index exceeds the bounded verification chunk size");
+    }
+    await requireStagingRoom(dataDir, directory, ciphertext.length);
+    const path = join(directory, `${randomUUID()}.temporary.index`);
+    const handle = await open(path, "wx", 0o600);
+    try {
+        await handle.writeFile(ciphertext);
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        let bytes = 0;
+        const sink = new Writable({ write(chunk, _encoding, callback) {
+                bytes += chunk.length;
+                callback(bytes > originalBytes ? new Error("The departure index exceeds its bounded plaintext size") : undefined);
+            } });
+        // Prove actual expansion before the buffered index parser sees the same
+        // immutable ciphertext. A small declared size alone is not a zip-bomb gate.
+        await openArchiveToFile(envelope, path, sink, opener, {
+            maxStoredChunkBytes: 16 * 1024 * 1024,
+            maxOriginalBytes: originalBytes,
+            maxExpandedChunkBytes: MAX_HANDOFF_INDEX_BYTES,
+            streamChunkDecompression: true,
+        });
+        return openVerifiedManagedIndex(envelope, ciphertext, opener, coverage);
+    }
+    finally {
+        await rm(path, { force: true });
+    }
+}
+async function capturedIndex(dataDir, directory, journal, privateKey) {
+    if (!journal.snapshot)
+        return emptyIndex();
+    if (journal.snapshot.receipt.blob.bytes > MAX_HANDOFF_INDEX_BYTES) {
+        fail("provider_unsupported", "Departure history exceeds the bounded 64 MiB index checkpoint limit");
+    }
+    if ((await stat(join(directory, journal.snapshot.file))).size !== journal.snapshot.receipt.blob.bytes) {
+        fail("ciphertext_integrity_failed", "The saved departure index has changed size");
+    }
+    const ciphertext = await readFile(join(directory, journal.snapshot.file));
+    if (ciphertext.length !== journal.snapshot.receipt.blob.bytes
+        || createHash("sha256").update(ciphertext).digest("hex") !== journal.snapshot.receipt.blob.sha256) {
+        fail("ciphertext_integrity_failed", "The saved team index changed during its departure handoff");
+    }
+    return filtered(await openBoundedIndex(dataDir, directory, journal.snapshot.envelope, ciphertext, { privateKey }, journal.snapshot.receipt.coverageJson), journal.scope, new Set(journal.refs));
+}
+/**
+ * Pin already-shared history before the membership commit. Only ciphertext,
+ * wrapped keys and opaque references survive a process exit; transcript and
+ * searchable index plaintext are never written to the durable journal.
+ */
+export async function prepareTeamOffboarding(dataDir, scope, phrase, preferred) {
+    const directory = journalDirectory(dataDir, scope);
+    return withJournal(directory, async () => {
+        let journal = await readJournal(directory, scope);
+        let retainedCustody;
+        const roster = await remote("Reading the departure roster", (io) => getTeamRoster(dataDir, scope.spaceKey, preferred, io));
+        const targetPresent = roster.members.some((member) => Number(member.account_id) === scope.targetAccountId);
+        const transitioned = scope.transition === "invitation" ? targetPresent : !targetPresent;
+        if (journal?.prepared && transitioned)
+            return {
+                membershipVersion: journal.membershipVersion, keyVersion: journal.keyVersion,
+                indexRevision: journal.indexRevision ?? journal.snapshot?.receipt.revision ?? 0, archiveRefs: [...journal.refs],
+            };
+        if ((journal?.completed || journal?.obsolete) && !transitioned) {
+            await discardCapturedFiles(directory, journal);
+            journal = null;
+        }
+        if (scope.transition === "invitation" && !journal && transitioned) {
+            fail("team_state_changed", "This accepted invitation has no prior captured history handoff");
+        }
+        if (scope.transition === "invitation" && journal && !transitioned) {
+            // Pending invitations can wait while contributors keep writing. Refresh
+            // their complete snapshot, never merely its membership/key version.
+            const cas = (await managedTeamIndexStore(dataDir, scope.spaceKey)).cas;
+            if (!cas)
+                fail("provider_unsupported", "Invitations require immutable team history support");
+            const head = await remote("Checking pending invitation history", (io) => cas.head(io));
+            const refs = (await remote("Checking pending invitation grants", (io) => listTeamArchives(dataDir, scope.spaceKey, preferred, io)))
+                .filter((grant) => grant.membership_version === roster.membership_version).map((grant) => grant.vault_ref).sort();
+            const unchanged = head.status === "ok" && journal.membershipVersion === roster.membership_version
+                && journal.capturedRoster === sameRoster(roster) && journal.scope.targetPublicKey === scope.targetPublicKey
+                && (head.head?.receipt.revision ?? 0) === journal.indexRevision
+                && JSON.stringify(refs) === JSON.stringify(journal.refs);
+            if (unchanged && journal.prepared && (!journal.refs.length || !!journal.custodyReceipt)) {
+                return { membershipVersion: journal.membershipVersion, keyVersion: journal.keyVersion,
+                    indexRevision: journal.indexRevision ?? 0, archiveRefs: [...journal.refs] };
+            }
+            if (!unchanged) {
+                retainedCustody = journal.custody;
+                await discardCapturedFiles(directory, journal);
+                journal = null;
+            }
+        }
+        if (journal && journal.membershipVersion !== roster.membership_version) {
+            fail("team_state_changed", "Team membership changed during history capture; finish the saved handoff before another departure");
+        }
+        const identity = await ensureTeamIdentity(dataDir, phrase, preferred);
+        const privateRaw = Buffer.from(identity.privateKey, "base64");
+        const privateKey = x25519PrivateKeyFromRaw(privateRaw);
+        const maxBytesPerSecond = backgroundUploadBytesPerSecond(await readLocalSettings(dataDir));
+        try {
+            if (!journal) {
+                const grants = await remote("Reading shared departure history", (io) => listTeamArchives(dataDir, scope.spaceKey, preferred, io));
+                const cas = (await managedTeamIndexStore(dataDir, scope.spaceKey, { maxBytesPerSecond })).cas;
+                if (!cas)
+                    fail("provider_unsupported", "Team departure requires immutable team index support");
+                const pulled = await remote("Capturing the departure index", (io) => cas.pullSnapshot({ ...io, maxBytes: MAX_HANDOFF_INDEX_BYTES }));
+                if (pulled.status === "unsupported")
+                    fail("provider_unsupported", "Team departure requires immutable team index support");
+                if (pulled.snapshot && pulled.snapshot.receipt.membershipVersion !== roster.membership_version) {
+                    fail("team_state_changed", "Publish the current team history generation before removing another member");
+                }
+                journal = {
+                    version: 1, scope, membershipVersion: roster.membership_version, capturedRoster: sameRoster(roster), keyVersion: roster.key_version,
+                    indexRevision: pulled.snapshot?.receipt.revision ?? 0,
+                    refs: grants.filter((grant) => grant.membership_version === roster.membership_version).map((grant) => grant.vault_ref).sort(),
+                    sizes: Object.fromEntries(grants.filter((grant) => grant.membership_version === roster.membership_version)
+                        .map((grant) => [grant.vault_ref, Number(grant.bytes)])),
+                    archives: Object.create(null), prepared: false,
+                };
+                if (retainedCustody)
+                    journal.custody = Object.fromEntries(Object.entries(retainedCustody)
+                        .filter(([ref]) => journal.refs.includes(ref)));
+                await requireStagingRoom(dataDir, directory, Object.values(journal.sizes).reduce((sum, bytes) => sum + bytes, 0)
+                    + (pulled.snapshot?.ciphertext.length ?? 0));
+                if (pulled.snapshot) {
+                    const snapshot = pulled.snapshot;
+                    await openBoundedIndex(dataDir, directory, snapshot.envelope, snapshot.ciphertext, { privateKey }, snapshot.receipt.coverageJson);
+                    const file = `${randomUUID()}.index`;
+                    const handle = await open(join(directory, file), "wx", 0o600);
+                    try {
+                        await handle.writeFile(snapshot.ciphertext);
+                        await handle.sync();
+                    }
+                    finally {
+                        await handle.close();
+                    }
+                    journal.snapshot = { file, envelope: snapshot.envelope, receipt: snapshot.receipt };
+                }
+                await atomicJson(join(directory, "journal.json"), journal);
+            }
+            const index = await capturedIndex(dataDir, directory, journal, privateKey);
+            const ordered = validateCapturedCatalog(index, journal);
+            for (const ref of journal.refs) {
+                if (journal.archives[ref])
+                    continue;
+                const file = `${randomUUID()}.ciphertext`;
+                const path = join(directory, file);
+                const captured = {};
+                try {
+                    await requireStagingRoom(dataDir, directory, index.meta[ref].archiveRecord.storedBytes);
+                    const digest = await remote("Capturing a shared departure archive", async (io) => {
+                        const source = await pullTeamCiphertextStream(dataDir, scope.spaceKey, ref, preferred, io);
+                        return writeChunksToFile(path, archiveBody(paceBackgroundByteStream(dataDir, source, maxBytesPerSecond, io), captured, index.meta[ref].archiveRecord.storedBytes), { ...io, expectedBytes: index.meta[ref].archiveRecord.storedBytes });
+                    });
+                    const envelope = captured.envelope;
+                    validateEnvelope(envelope, digest.bytes);
+                    const archiveKey = unwrapArchiveKey(envelope.wrappedKeys, envelope.suite, envelope.archiveId, { privateKey });
+                    zeroize(archiveKey);
+                    const facts = index.meta?.[ref]?.archiveRecord;
+                    if (facts && (facts.storedBytes !== digest.bytes || facts.ciphertextSha256 !== digest.sha256Hex
+                        || (facts.envelopeArchiveId ?? ref) !== envelope.archiveId)) {
+                        fail("ciphertext_integrity_failed", "A shared archive does not match its authenticated team catalog");
+                    }
+                    journal.archives[ref] = { file, envelope, bytes: digest.bytes, sha256: digest.sha256Hex };
+                    await atomicJson(join(directory, "journal.json"), journal);
+                }
+                catch (error) {
+                    await rm(path, { force: true });
+                    throw error;
+                }
+            }
+            await verifyCapturedArchives(directory, journal, index, ordered, privateKey);
+            const custodyRecords = await persistOwnerCustody(dataDir, directory, journal, index, privateKey, phrase, preferred, maxBytesPerSecond, false);
+            await publishOwnerCustody(dataDir, directory, journal, index, custodyRecords, phrase, maxBytesPerSecond);
+            const current = await remote("Confirming the departure roster", (io) => getTeamRoster(dataDir, scope.spaceKey, preferred, io));
+            const cas = (await managedTeamIndexStore(dataDir, scope.spaceKey, { maxBytesPerSecond })).cas;
+            const head = await remote("Confirming the captured team index", (io) => cas.head(io));
+            const currentRefs = (await remote("Confirming captured history grants", (io) => listTeamArchives(dataDir, scope.spaceKey, preferred, io)))
+                .filter((grant) => grant.membership_version === current.membership_version).map((grant) => grant.vault_ref).sort();
+            if (current.membership_version !== journal.membershipVersion || sameRoster(current) !== sameRoster(roster)
+                || head.status === "unsupported" || (head.head?.receipt.revision ?? 0) !== (journal.snapshot?.receipt.revision ?? 0)
+                || JSON.stringify(currentRefs) !== JSON.stringify(journal.refs)) {
+                journal.obsolete = true;
+                journal.prepared = false;
+                await atomicJson(join(directory, "journal.json"), journal);
+                fail("team_state_changed", "Team history changed while it was being captured; retry the departure with a fresh snapshot");
+            }
+            journal.prepared = true;
+            await atomicJson(join(directory, "journal.json"), journal);
+            return {
+                membershipVersion: journal.membershipVersion, keyVersion: journal.keyVersion,
+                indexRevision: journal.indexRevision ?? journal.snapshot?.receipt.revision ?? 0, archiveRefs: [...journal.refs],
+            };
+        }
+        finally {
+            zeroize(privateRaw);
+        }
+    });
+}
+function remappedIndex(source, journal, aliases = journal.generation.aliases) {
+    const index = emptyIndex();
+    for (const [oldRef, line] of Object.entries(source.archives)) {
+        const alias = aliases[oldRef];
+        if (!alias)
+            continue;
+        index.archives[alias.ref] = [...line];
+        const oldMeta = source.meta?.[oldRef];
+        if (oldMeta) {
+            const meta = structuredClone(oldMeta);
+            if (meta.archiveRecord) {
+                const facts = meta.archiveRecord;
+                facts.envelopeArchiveId = journal.archives[oldRef].envelope.archiveId;
+                // New wraps are a new authenticated descriptor even though the
+                // underlying ciphertext/source is retained byte-for-byte.
+                facts.envelopeSha256 = createHash("sha256").update(JSON.stringify(alias.envelope)).digest("hex");
+                if (facts.delta) {
+                    const base = aliases[facts.delta.baseArchiveId];
+                    if (!base)
+                        fail("ciphertext_integrity_failed", "A retained team delta has no retained base");
+                    facts.delta.baseArchiveId = base.ref;
+                }
+                if (facts.supersedes) {
+                    const previous = aliases[facts.supersedes.archiveId];
+                    if (previous)
+                        facts.supersedes.archiveId = previous.ref;
+                    else
+                        delete facts.supersedes;
+                }
+            }
+            index.meta[alias.ref] = meta;
+        }
+    }
+    for (const [token, postings] of Object.entries(source.tokens)) {
+        const remapped = [];
+        for (const posting of postings) {
+            const separator = posting.indexOf("@");
+            const ref = separator < 0 ? posting : posting.slice(0, separator);
+            const alias = aliases[ref];
+            if (alias && index.archives[alias.ref])
+                remapped.push(alias.ref + (separator < 0 ? "" : posting.slice(separator)));
+        }
+        if (remapped.length)
+            index.tokens[token] = remapped;
+    }
+    return index;
+}
+/**
+ * Team aliases authorize one roster. A surviving owner's separate private
+ * custody copy supplies the stable local archive inventory which ordinary
+ * backfill needs when another invitation advances that roster again. Its
+ * phrase wrap is never uploaded as a team grant or used as a shared envelope.
+ */
+async function persistOwnerCustody(dataDir, directory, journal, source, privateKey, phrase, preferred, maxBytesPerSecond, installRecords) {
+    const config = await readConfig(dataDir);
+    const custody = journal.custody ??= Object.create(null);
+    const owned = (await listArchives(dataDir)).filter(isV2);
+    const ownedById = new Map(owned.map((record) => [record.id, record]));
+    const reusable = new Map(owned.filter((record) => record.teamCustody?.spaceKey === journal.scope.spaceKey
+        && record.remote?.verifiedAt && record.envelope.wrappedKeys.length === 1 && record.envelope.wrappedKeys[0].type === "phrase")
+        .map((record) => [JSON.stringify([record.envelope.archiveId, record.source.bytes, record.source.sha256,
+            record.cipher.storedBytes, record.cipher.ciphertextSha256, record.delta?.baseBytes ?? null,
+            record.delta ? ownedById.get(record.delta.baseArchiveId)?.envelope.archiveId : null]), record]));
+    for (const ref of journal.refs) {
+        if (custody[ref])
+            continue;
+        const original = journal.archives[ref].envelope;
+        const key = unwrapArchiveKey(original.wrappedKeys, original.suite, original.archiveId, { privateKey });
+        try {
+            const facts = source.meta[ref].archiveRecord;
+            const reusableCopy = reusable.get(JSON.stringify([original.archiveId, facts.sourceBytes, facts.sourceSha256,
+                facts.storedBytes, facts.ciphertextSha256, facts.delta?.baseBytes ?? null,
+                facts.delta ? journal.archives[facts.delta.baseArchiveId].envelope.archiveId : null]));
+            if (reusableCopy) {
+                let opened;
+                try {
+                    opened = unwrapArchiveKey(reusableCopy.envelope.wrappedKeys, reusableCopy.envelope.suite, reusableCopy.envelope.archiveId, { phrase });
+                    if (opened.equals(key)) {
+                        custody[ref] = { ref: reusableCopy.id, envelope: reusableCopy.envelope, remote: reusableCopy.remote, installed: true };
+                        continue;
+                    }
+                }
+                catch { /* A different phrase/key cannot authorize custody reuse. */ }
+                finally {
+                    if (opened)
+                        zeroize(opened);
+                }
+            }
+            custody[ref] = {
+                ref: randomUUID(),
+                envelope: { ...original, wrappedKeys: wrapAll(key, [{ kind: "phrase", phrase }], original.suite, original.archiveId) },
+            };
+        }
+        finally {
+            zeroize(key);
+        }
+    }
+    await atomicJson(join(directory, "journal.json"), journal);
+    const finished = new Set();
+    const visiting = new Set();
+    const records = [];
+    const sourceRoots = new Map();
+    const sourceRoot = (ref) => {
+        const base = source.meta?.[ref]?.archiveRecord?.delta?.baseArchiveId;
+        const root = base ? sourceRoots.get(base) : ref;
+        sourceRoots.set(ref, root);
+        return root;
+    };
+    const install = async (ref) => {
+        if (finished.has(ref))
+            return;
+        if (visiting.has(ref))
+            fail("ciphertext_integrity_failed", "A custody delta chain contains a cycle");
+        visiting.add(ref);
+        const facts = source.meta?.[ref]?.archiveRecord;
+        if (facts?.delta)
+            await install(facts.delta.baseArchiveId);
+        const copy = custody[ref];
+        const archive = journal.archives[ref];
+        if (!copy.remote) {
+            const uploaded = await remote("Saving owner custody of shared history", (io) => pushFramedArchive(dataDir, {
+                vaultRef: copy.ref, envelope: copy.envelope, ciphertextPath: join(directory, archive.file),
+                ciphertextSha256: archive.sha256, ciphertextBytes: archive.bytes,
+            }, preferred, { ...io, maxBytesPerSecond }));
+            if (!uploaded.durable)
+                fail("ciphertext_integrity_failed", "The owner custody copy has no verified managed-storage receipt");
+            copy.remote = {
+                provider: "vaultline", bucket: "vaultline-managed", objectKey: uploaded.objectKey,
+                bytes: uploaded.bytes, checksum: uploaded.checksum ?? "", verifiedAt: new Date().toISOString(),
+            };
+            await atomicJson(join(directory, "journal.json"), journal);
+        }
+        {
+            const sealed = archive.envelope;
+            const record = {
+                version: 2, id: copy.ref, createdAt: facts?.createdAt ?? sealed.manifest.createdAt,
+                source: {
+                    // The same proven delta chain receives one synthetic nonexistent
+                    // path. Never inherit another machine's absolute source path or
+                    // point retention at an unrelated file on this owner's machine.
+                    path: join(dataDir, "team-custody-source", `${custody[sourceRoot(ref)].ref}.jsonl`),
+                    agent: source.archives[ref]?.[0] ?? sealed.manifest.adapter?.agent ?? "shared-history",
+                    bytes: facts?.sourceBytes ?? sealed.manifest.originalBytes ?? sealed.manifest.plaintextBytes,
+                    sha256: facts?.sourceSha256 ?? sealed.manifest.originalSha256 ?? sealed.manifest.plaintextSha256,
+                    project: journal.scope.project,
+                    ...(journal.scope.projectKey ? { projectKey: journal.scope.projectKey } : {}),
+                    projectScope: journal.scope.spaceKey,
+                },
+                cipher: { algorithm: sealed.suite, ciphertextSha256: archive.sha256, storedBytes: archive.bytes, chunks: sealed.chunks.length },
+                envelope: copy.envelope,
+                teamCustody: { version: 1, spaceKey: journal.scope.spaceKey, envelopeArchiveId: sealed.archiveId },
+                objectPath: join(config.storage.root, `${copy.ref}.sealed`),
+                remote: copy.remote,
+                offloaded: {
+                    at: copy.remote.verifiedAt, provider: copy.remote.provider, bucket: copy.remote.bucket,
+                    objectKey: copy.remote.objectKey, localBytes: archive.bytes, freedBytes: 0,
+                },
+                ...(facts?.delta ? { delta: { ...facts.delta, baseArchiveId: custody[facts.delta.baseArchiveId].ref } } : {}),
+                ...(facts?.supersedes && custody[facts.supersedes.archiveId]
+                    ? { supersedes: { ...facts.supersedes, archiveId: custody[facts.supersedes.archiveId].ref } } : {}),
+            };
+            records.push(record);
+            if (installRecords && !copy.installed) {
+                await writeRecord(config.storage.root, record);
+                copy.installed = true;
+                await atomicJson(join(directory, "journal.json"), journal);
+            }
+        }
+        visiting.delete(ref);
+        finished.add(ref);
+    };
+    for (const ref of validateCapturedCatalog(source, journal)) {
+        sourceRoot(ref);
+        await install(ref);
+    }
+    return records;
+}
+/** Publish only the owner's private account index; never advance a team fence. */
+async function publishOwnerCustody(dataDir, directory, journal, source, records, phrase, maxBytesPerSecond) {
+    if (!journal.refs.length)
+        return;
+    const cas = (await managedIndexStore(dataDir, { maxBytesPerSecond })).cas;
+    if (!cas?.publishFile)
+        fail("provider_unsupported", "Departure requires a durable immutable owner custody catalog");
+    const retained = remappedIndex(source, journal, journal.custody);
+    // Match the safe local custody provenance. Team readers never receive these
+    // owner-only locators or phrase wraps; ordinary backfill derives new ones.
+    const { archiveCatalogFacts } = await import("./search.js");
+    for (const copy of Object.values(journal.custody)) {
+        const record = records.find((record) => record.id === copy.ref);
+        if (!record || !copy.remote)
+            fail("ciphertext_integrity_failed", "Owner custody is not durable");
+        retained.archives[copy.ref] = [record.source.agent, record.source.path, journal.scope.project,
+            journal.scope.spaceKey, journal.scope.projectKey ?? ""];
+        retained.meta[copy.ref].archiveRecord = archiveCatalogFacts(record);
+    }
+    for (let attempt = 0; attempt < 5; attempt += 1) {
+        const pulled = await remote("Reading the owner custody catalog", (io) => cas.pullSnapshot({ ...io, maxBytes: MAX_HANDOFF_INDEX_BYTES }));
+        if (pulled.status === "unsupported")
+            fail("provider_unsupported", "Departure requires a durable immutable owner custody catalog");
+        const index = pulled.snapshot
+            ? await openBoundedIndex(dataDir, directory, pulled.snapshot.envelope, pulled.snapshot.ciphertext, { phrase }, pulled.snapshot.receipt.coverageJson)
+            : emptyIndex();
+        Object.assign(index.archives, retained.archives);
+        Object.assign(index.meta ??= Object.create(null), retained.meta);
+        for (const [token, postings] of Object.entries(retained.tokens)) {
+            index.tokens[token] = [...new Set([...(index.tokens[token] ?? []), ...postings])];
+        }
+        index.builtAt = new Date().toISOString();
+        const plaintext = join(directory, `${randomUUID()}.temporary.jsonl`);
+        const ciphertext = join(directory, `${randomUUID()}.temporary.index`);
+        try {
+            let checkpointBytes = 1_024;
+            for (const [ref, line] of Object.entries(index.archives))
+                checkpointBytes += Buffer.byteLength(JSON.stringify(["a", ref, ...line])) + 1;
+            for (const [token, postings] of Object.entries(index.tokens))
+                checkpointBytes += Buffer.byteLength(JSON.stringify(["t", token, postings])) + 1;
+            for (const [ref, meta] of Object.entries(index.meta ?? {}))
+                checkpointBytes += Buffer.byteLength(JSON.stringify(["m", ref, meta])) + 1;
+            if (checkpointBytes > MAX_HANDOFF_INDEX_BYTES)
+                fail("provider_unsupported", "Owner custody exceeds the bounded 64 MiB index checkpoint limit");
+            await requireStagingRoom(dataDir, directory, checkpointBytes * 3 + 8 * 1024 * 1024);
+            const coverage = await writeContentIndexCheckpoint(plaintext, index);
+            const sealed = await sealArchiveToFile({ path: plaintext }, ciphertext, {
+                recipients: [{ kind: "phrase", phrase }], compression: "gzip",
+                adapter: { agent: "sealkeep-index", version: "1" }, scratchDir: directory,
+            });
+            await rm(plaintext, { force: true });
+            const published = await remote("Publishing durable owner custody", (io) => cas.publishFile(sealed.envelope, ciphertext, {
+                ...io, maxBytesPerSecond, expectedRevision: pulled.snapshot?.receipt.revision ?? 0, coverageJson: coverage.publication,
+            }));
+            if (published.status === "unsupported")
+                fail("provider_unsupported", "Departure requires a durable immutable owner custody catalog");
+            if (published.status === "conflict")
+                continue;
+            if (!published.verifiedReadBack)
+                fail("ciphertext_integrity_failed", "Owner custody catalog has no verified immutable read-back receipt");
+            journal.custodyReceipt = published.receipt;
+            await atomicJson(join(directory, "journal.json"), journal);
+            return;
+        }
+        finally {
+            await rm(plaintext, { force: true });
+            await rm(ciphertext, { force: true });
+        }
+    }
+    fail("team_state_changed", "Concurrent owner catalog publication delayed departure; retry it");
+}
+/**
+ * Resume after the authoritative removal, including a lost removal response.
+ * The surviving uploader owns new immutable aliases; old author-owned grants
+ * and old membership receipts are never promoted to the new epoch.
+ */
+export async function completeTeamOffboarding(dataDir, scope, phrase, preferred) {
+    const directory = journalDirectory(dataDir, scope);
+    await withJournal(directory, async () => {
+        const journal = await readJournal(directory, scope);
+        if (!journal?.prepared)
+            fail("team_state_changed", "The departure has no complete saved history handoff");
+        if (journal.completed) {
+            await cleanupCompleted(directory, journal);
+            return;
+        }
+        const roster = await remote("Reading the surviving team roster", (io) => getTeamRoster(dataDir, scope.spaceKey, preferred, io));
+        const target = roster.members.find((member) => Number(member.account_id) === scope.targetAccountId);
+        if (scope.transition === "invitation") {
+            const previousMembers = roster.members.filter((member) => Number(member.account_id) !== scope.targetAccountId);
+            if (!target || roster.membership_version !== journal.membershipVersion + 1
+                || target.public_key !== journal.scope.targetPublicKey
+                || sameRoster({ ...roster, members: previousMembers }) !== journal.capturedRoster) {
+                fail("team_state_changed", "The invitation history handoff does not match this accepted roster");
+            }
+        }
+        else if (target || roster.membership_version <= journal.membershipVersion) {
+            fail("team_state_changed", "Remove the departing account before completing its history handoff");
+        }
+        const privateRaw = Buffer.from((await ensureTeamIdentity(dataDir, phrase, preferred)).privateKey, "base64");
+        const privateKey = x25519PrivateKeyFromRaw(privateRaw);
+        const maxBytesPerSecond = backgroundUploadBytesPerSecond(await readLocalSettings(dataDir));
+        try {
+            const source = await capturedIndex(dataDir, directory, journal, privateKey);
+            const recipients = roster.members.map((member) => ({
+                kind: "x25519", publicKey: x25519PublicKeyFromRaw(Buffer.from(member.public_key, "base64")),
+            }));
+            if (!journal.generation || journal.generation.membershipVersion !== roster.membership_version
+                || journal.generation.roster !== sameRoster(roster)) {
+                const aliases = Object.create(null);
+                for (const ref of journal.refs) {
+                    const original = journal.archives[ref].envelope;
+                    const key = unwrapArchiveKey(original.wrappedKeys, original.suite, original.archiveId, { privateKey });
+                    try {
+                        aliases[ref] = { ref: randomUUID(), envelope: {
+                                ...original, wrappedKeys: wrapAll(key, recipients, original.suite, original.archiveId),
+                            } };
+                    }
+                    finally {
+                        zeroize(key);
+                    }
+                }
+                journal.generation = { membershipVersion: roster.membership_version, roster: sameRoster(roster), aliases };
+                await atomicJson(join(directory, "journal.json"), journal);
+            }
+            const aliases = journal.generation.aliases;
+            const granted = new Set((await remote("Reading surviving history grants", (io) => listTeamArchives(dataDir, scope.spaceKey, preferred, io)))
+                .filter((grant) => grant.membership_version === roster.membership_version).map((grant) => grant.vault_ref));
+            const visiting = new Set();
+            const finished = new Set();
+            const transfer = async (ref) => {
+                if (finished.has(ref))
+                    return;
+                if (visiting.has(ref))
+                    fail("ciphertext_integrity_failed", "A team history delta chain contains a cycle");
+                visiting.add(ref);
+                const base = source.meta?.[ref]?.archiveRecord?.delta?.baseArchiveId;
+                if (base)
+                    await transfer(base);
+                const alias = aliases[ref];
+                if (!granted.has(alias.ref)) {
+                    const archive = journal.archives[ref];
+                    const uploaded = await remote("Preserving a shared departure archive", (io) => pushFramedArchive(dataDir, {
+                        vaultRef: alias.ref, envelope: alias.envelope, ciphertextPath: join(directory, archive.file),
+                        ciphertextSha256: archive.sha256, ciphertextBytes: archive.bytes,
+                    }, preferred, { ...io, maxBytesPerSecond }));
+                    if (!uploaded.durable)
+                        fail("ciphertext_integrity_failed", "The retained team archive was not verified in managed storage");
+                    await remote("Granting preserved team history", (io) => registerTeamArchive(dataDir, scope.spaceKey, alias.ref, roster.membership_version, preferred, io));
+                    granted.add(alias.ref);
+                    alias.registered = true;
+                    await atomicJson(join(directory, "journal.json"), journal);
+                }
+                visiting.delete(ref);
+                finished.add(ref);
+            };
+            for (const ref of validateCapturedCatalog(source, journal))
+                await transfer(ref);
+            if (journal.refs.length && !journal.custodyReceipt) {
+                fail("ciphertext_integrity_failed", "The saved departure has no pre-removal durable owner custody catalog");
+            }
+            await persistOwnerCustody(dataDir, directory, journal, source, privateKey, phrase, preferred, maxBytesPerSecond, true);
+            const cas = (await managedTeamIndexStore(dataDir, scope.spaceKey, { maxBytesPerSecond })).cas;
+            if (!cas?.publishFile)
+                fail("provider_unsupported", "The team history handoff requires streaming index publication");
+            let usedCapturedRevision = false;
+            for (let attempt = 0; attempt < 5; attempt += 1) {
+                let pulled;
+                let capturedRevision;
+                try {
+                    pulled = await remote("Reading the surviving team index", (io) => cas.pullSnapshot({ ...io, maxBytes: MAX_HANDOFF_INDEX_BYTES }));
+                }
+                catch (error) {
+                    // Hosted HEAD deliberately vends no download capabilities for the
+                    // prior roster. The removal transaction fenced this exact revision,
+                    // so one replacement CAS can use the saved snapshot without reading
+                    // stale data. Every other failure and every later conflict remains a
+                    // normal hard failure/current-head merge, never a guessed revision.
+                    const savedRevision = journal.indexRevision ?? journal.snapshot?.receipt.revision;
+                    if (usedCapturedRevision || !isSealkeepError(error) || error.code !== "team_state_changed"
+                        || error.message !== "Team membership changed; publish a new search index"
+                        || !journal.snapshot || !Number.isSafeInteger(savedRevision) || Number(savedRevision) < 1
+                        || savedRevision !== journal.snapshot.receipt.revision
+                        || roster.membership_version !== journal.membershipVersion + 1)
+                        throw error;
+                    const current = await remote("Confirming the fenced departure epoch", (io) => getTeamRoster(dataDir, scope.spaceKey, preferred, io));
+                    if (current.membership_version !== roster.membership_version || sameRoster(current) !== sameRoster(roster)
+                        || (current.members.some((member) => Number(member.account_id) === scope.targetAccountId) !== (scope.transition === "invitation")))
+                        throw error;
+                    usedCapturedRevision = true;
+                    capturedRevision = savedRevision;
+                    pulled = { status: "ok", snapshot: null };
+                }
+                if (pulled.status === "unsupported")
+                    fail("provider_unsupported", "Immutable team index publication is unavailable");
+                const index = remappedIndex(source, journal);
+                if (pulled.snapshot?.receipt.membershipVersion === roster.membership_version) {
+                    const currentGrants = new Set((await remote("Confirming surviving history grants", (io) => listTeamArchives(dataDir, scope.spaceKey, preferred, io)))
+                        .filter((grant) => grant.membership_version === roster.membership_version).map((grant) => grant.vault_ref));
+                    const current = filtered(await openBoundedIndex(dataDir, directory, pulled.snapshot.envelope, pulled.snapshot.ciphertext, { privateKey }, pulled.snapshot.receipt.coverageJson), scope, currentGrants);
+                    mergeTeamProjectShard(index, current, scope.project, scope.spaceKey, new Map(), scope.projectKey);
+                }
+                else if (pulled.snapshot && pulled.snapshot.receipt.membershipVersion !== journal.membershipVersion) {
+                    fail("team_state_changed", "Another roster transition changed the team history handoff");
+                }
+                const plaintext = join(directory, `${randomUUID()}.temporary.jsonl`);
+                const ciphertext = join(directory, `${randomUUID()}.temporary.index`);
+                try {
+                    // JSONL, compressor scratch, and sealed output can coexist briefly.
+                    // Measure per row so admission itself never builds one index-sized
+                    // JSON string. The margin covers framing and compression overhead.
+                    let checkpointBytes = 1_024;
+                    for (const [ref, line] of Object.entries(index.archives))
+                        checkpointBytes += Buffer.byteLength(JSON.stringify(["a", ref, ...line])) + 1;
+                    for (const [token, postings] of Object.entries(index.tokens))
+                        checkpointBytes += Buffer.byteLength(JSON.stringify(["t", token, postings])) + 1;
+                    for (const [ref, meta] of Object.entries(index.meta ?? {}))
+                        checkpointBytes += Buffer.byteLength(JSON.stringify(["m", ref, meta])) + 1;
+                    if (checkpointBytes > MAX_HANDOFF_INDEX_BYTES)
+                        fail("provider_unsupported", "Retained team history exceeds the bounded 64 MiB index checkpoint limit");
+                    await requireStagingRoom(dataDir, directory, checkpointBytes * 3 + 8 * 1024 * 1024);
+                    const coverage = await writeContentIndexCheckpoint(plaintext, index);
+                    const sealed = await sealArchiveToFile({ path: plaintext }, ciphertext, {
+                        recipients, compression: "gzip", adapter: { agent: "sealkeep-index", version: "1" }, scratchDir: directory,
+                    });
+                    await rm(plaintext, { force: true });
+                    const published = await remote("Publishing preserved team history", (io) => cas.publishFile(sealed.envelope, ciphertext, {
+                        ...io, maxBytesPerSecond,
+                        expectedRevision: capturedRevision ?? pulled.snapshot?.receipt.revision ?? 0,
+                        expectedMembershipVersion: roster.membership_version, coverageJson: coverage.publication,
+                    }));
+                    if (published.status === "unsupported")
+                        fail("provider_unsupported", "Immutable team index publication is unavailable");
+                    if (published.status === "conflict")
+                        continue;
+                    if (!published.verifiedReadBack || published.receipt.membershipVersion !== roster.membership_version) {
+                        fail("ciphertext_integrity_failed", "The retained team index has no verified current membership receipt");
+                    }
+                    const current = await remote("Confirming preserved team membership", (io) => getTeamRoster(dataDir, scope.spaceKey, preferred, io));
+                    if (current.membership_version !== roster.membership_version || sameRoster(current) !== sameRoster(roster)) {
+                        fail("team_state_changed", "Team membership changed while retained history was published; retry its handoff");
+                    }
+                    journal.completed = true;
+                    journal.completedReceipt = published.receipt;
+                    await atomicJson(join(directory, "journal.json"), journal);
+                    await cleanupCompleted(directory, journal);
+                    return;
+                }
+                finally {
+                    await rm(plaintext, { force: true });
+                    await rm(ciphertext, { force: true });
+                }
+            }
+            fail("team_state_changed", "Concurrent team history publication delayed the saved departure handoff; retry it");
+        }
+        finally {
+            zeroize(privateRaw);
+        }
+    });
+}
+export async function prepareTeamInvitationHistory(dataDir, scope, phrase, preferred) {
+    if (!Number.isSafeInteger(scope.targetAccountId) || scope.targetAccountId <= 0
+        || Buffer.from(scope.targetPublicKey, "base64").length !== 32) {
+        fail("invalid_argument", "A history invitation requires an identified recipient encryption key");
+    }
+    return prepareTeamOffboarding(dataDir, { ...scope, transition: "invitation" }, phrase, preferred);
+}
+/** Owner-side background continuation; pending invitations grant no access. */
+export async function reconcileTeamInvitationHandoffs(dataDir, phrase, preferred) {
+    const root = join(dataDir, "team-invitations");
+    const names = await readdir(root).catch((error) => {
+        if (error?.code === "ENOENT")
+            return [];
+        throw error;
+    });
+    if (!names.length)
+        return 0;
+    const config = await readConfig(dataDir);
+    let completed = 0;
+    for (const name of names.sort()) {
+        if (!/^[a-f0-9]{64}$/.test(name))
+            continue;
+        const directory = join(root, name);
+        const raw = await readFile(join(directory, "journal.json"), "utf8").catch((error) => {
+            if (error?.code === "ENOENT")
+                return null;
+            throw error;
+        });
+        if (!raw)
+            continue;
+        const scope = JSON.parse(raw).scope;
+        if (scope?.transition !== "invitation" || journalDirectory(dataDir, scope) !== directory) {
+            fail("ciphertext_integrity_failed", "The saved invitation handoff has an invalid scope");
+        }
+        const journal = await readJournal(directory, scope);
+        if (!journal?.prepared || journal.completed)
+            continue;
+        const binding = teamSpaceOf(config, scope.project, scope.projectKey);
+        if (!binding || binding.role !== "owner" || binding.spaceKey !== scope.spaceKey)
+            continue;
+        const roster = await remote("Checking accepted invitation history", (io) => getTeamRoster(dataDir, scope.spaceKey, preferred, io));
+        if (!roster.members.some((member) => Number(member.account_id) === scope.targetAccountId))
+            continue;
+        await completeTeamOffboarding(dataDir, scope, phrase, preferred);
+        completed += 1;
+    }
+    return completed;
+}