From 6e76da2428cdfc6062b92327a850da886e47a19d Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Wed, 3 Jun 2026 08:25:21 -0400
Subject: [PATCH 01/45] Save design notes

---
 results-encryption-design-notes.md  | 165 ++++++++++++++++++++++++++++
 src/server/actions/study.actions.ts |   1 +
 src/server/storage.ts               |   1 +
 3 files changed, 167 insertions(+)
 create mode 100644 results-encryption-design-notes.md

diff --git a/results-encryption-design-notes.md b/results-encryption-design-notes.md
new file mode 100644
index 000000000..4cf19e019
--- /dev/null
+++ b/results-encryption-design-notes.md
@@ -0,0 +1,165 @@
+# Results Encryption for Researchers — Design Notes
+
+> Working synthesis from a grilling session against the codebase (management-app + trusted-output-app).
+> Status: **draft for review.** Decisions locked so far are marked ✅; open items are in §8.
+> **Scope for this work: Card 72 (prerequisite) → Card 71 only.** Happy path only. Cards 73 / 74 (regeneration, recovery) are explicitly out of scope here.
+
+---
+
+## 1. The problem
+
+The secure enclave's output (result files + run logs) is delivered to **DO reviewers** encrypted, but the same output is currently exposed to **researchers in plaintext**. Reviewers decrypt client-side with a private key generated at signup; researchers get an unencrypted copy.
+
+Goal: researchers must *also* decrypt with their own key, so output is never available in plaintext on the researcher side.
+
+---
+
+## 2. How the encryption works today (the "post office" analogy)
+
+| Concept (analogy) | Implementation | Where in code |
+|---|---|---|
+| **Results key** — a padlock whose one key both locks and unlocks | A random **AES-256-CBC** symmetric key, generated **per file** (+ a per-file random IV) | `si-encryption/job-results/writer.ts:19,22` |
+| **Lock the results** | Encrypt each file's bytes with its AES key | `writer.ts:25` |
+| **A PO box for each person** | The AES key is "wrapped" (encrypted) with each recipient's **RSA-OAEP-4096 public key** | `writer.ts:31-35,58-84` |
+| **The PO box number** | The recipient's **fingerprint** = SHA-256 of their public key | `util/keypair.ts:105-111` |
+| **The post office (directory of boxes)** | `manifest.json` — maps `fingerprint → { crypt }`, plus per-file `iv`, `path`, `bytes` | `writer.ts:39-44`; types in `job-results/types.ts` |
+| **Ship it** | TOA zips `manifest.json` + encrypted bodies, POSTs to MA | TOA `src/app/api/job/encrypt-results.ts` |
+| **Open the box** | Browser fetches the zip, finds its PO box by fingerprint, unwraps the AES key with its private key, decrypts | `hooks/use-decrypt-files.ts`, `job-results/reader.ts:95-109` |
+
+**Key types, ELI5**
+- **RSA keypair (asymmetric)** — public key = a mail slot anyone can drop into; private key = the only physical key that opens the box. Mathematically bound; you can't edit one to fit the other.
+- **AES key (symmetric)** — one key locks and unlocks. Fast; used for big file bodies. One per file.
+- **IV (initialization vector)** — a per-file random value, **not secret**, but **required** to decrypt (AES-CBC). Must always travel with its ciphertext.
+- **Fingerprint** — the nameplate on the box; SHA-256 of the public key.
+- **Envelope encryption** — lock the big file once with a fast AES padlock, then put a *copy* of that AES key into a personal RSA-locked box per recipient. The manifest is the directory of boxes.
+
+**Where keys live**
+- **Public key** → DB `user_public_key` (`public_key` bytea, `fingerprint` text, `UNIQUE(user_id)`). Schema is already **role-agnostic**.
+- **Private key** → user downloads a PEM; **never stored server-side**. This is the core guarantee: *the server cannot read results.*
+
+---
+
+## 3. The fact that reframes the work
+
+Approve currently stores **plaintext**. `approveStudyJobFilesAction` (`src/server/actions/study-job.actions.ts:12-45`) takes the DO's already-decrypted contents and writes them to `results/approved/` via `storeApprovedJobFile`. Researchers read those plaintext files. So this project is *"stop writing the decrypted copy, and give researchers their own PO boxes instead."*
+
+---
+
+## 4. Architecture decisions (locked)
+
+### ✅ 4.1 One key per user, not per role (Card 72)
+A single keypair serves a person as reviewer *and* researcher. Encryption already takes all org public keys regardless of role (`writer.ts`), so the same key works for both hats. Consequence: key handling is user-level, not role-level.
+
+### ✅ 4.2 Re-wrap, not re-encrypt (core mechanic)
+Granting a researcher access does **not** re-encrypt file bodies. The file's existing AES key is **wrapped again** for the researcher's public key → a new PO box. The ciphertext and IV never change.
+- The DO's browser already holds the raw AES key (it just decrypted to review), so it wraps that key for each researcher and uploads new boxes. **The server never sees plaintext.**
+- A regenerated key cannot open old boxes — that impossibility *is* the security. (Recovery/regeneration handling = out of scope here; see §8.)
+
+### ✅ 4.3 Option B — decompose on ingest
+When MA receives TOA's zip, it **unzips once on the server** and stores the pieces separately:
+- each **encrypted body** → its own S3 object
+- per-file **metadata (iv, path, bytes)** + per-recipient **wrapped keys** → Postgres
+
+The manifest is **plaintext metadata** (IVs/fingerprints/wrapped keys are not secret), and the server already parses it today with an empty key just to list files (`study-job.actions.ts:72-76`). So decompose-on-ingest needs **no private keys and touches no plaintext** — the zero-plaintext-on-server guarantee holds.
+
+Postgres is the **single source of truth for PO boxes** (both DO and researcher). The zip is reduced to a transient ingest format; the read path no longer unzips.
+
+**Proposed schema (per file — a zip can hold many files, so do NOT model "zip = one row"):**
+```
+job_file      (id, study_job_id, path, bytes, iv, blob_location)   -- one row per file; IV lives here in Option B
+job_file_key  (job_file_id, fingerprint, crypt)                    -- one row per recipient-per-file = a PO box
+                UNIQUE(job_file_id, fingerprint)
+```
+
+**Read path (DO and researcher, identical):** fetch encrypted body from S3 + `iv` and the row matching *my* fingerprint from `job_file_key` → decrypt client-side. `SELECT crypt FROM job_file_key WHERE fingerprint = ? AND job_file_id IN (...)` (one box per file).
+
+### ✅ 4.4 Re-wrap at approve, client-side (Card 71)
+On **Approve**, the DO's browser:
+1. Fetches the **lab's** public keys — members of `study.submittedByOrgId` who have a key.
+2. Wraps each approved file's AES key (already in memory from decrypting) to each researcher public key.
+3. POSTs the new PO boxes; server inserts `job_file_key` rows in one transaction (atomic, idempotent via the unique constraint).
+
+### ✅ 4.5 Remove plaintext storage
+Drop the `storeApprovedJobFile` plaintext write. Researchers read the encrypted body + their PO box and decrypt client-side, using the **same** path as reviewers.
+
+---
+
+## 5. Blast radius / implementation notes
+
+**Reassuring:** decompose-on-ingest and re-wrap both operate only on encrypted bytes + non-secret metadata. No server-side plaintext, no server-side private keys.
+
+**Hidden cost of Option B — shared library change.** The current decrypt path is zip-shaped end-to-end: `ResultsReader`'s constructor takes a zip blob and reads `manifest.json` from inside it (`reader.ts:17,45-49`). Option B has no zip at read time, so we must:
+- Add a **zip-free decrypt primitive** to `si-encryption`, e.g. `decryptFile(encryptedBody, iv, wrappedKeyForMyFingerprint, privateKey) → plaintext`. The guts already exist (`readFile` does `decryptKeyWithPrivateKey` + `decryptData`, `reader.ts:95-109`) — they just need to be unwelded from zip iteration.
+- Have the reader **expose the raw AES key** per file (today `readFile` computes it but only returns the decrypted body) — **re-wrap needs that key**.
+- Rewrite the client hook (`use-decrypt-files.ts` / `use-encrypted-files-panel.ts`) to fetch body-from-S3 + iv/crypt-from-PG instead of unzipping.
+
+This is a **shared-library change, not MA-only.**
+
+### Card 72 — researcher key generation (prerequisite)
+The `user_public_key` schema is already role-agnostic; only the **gate** is enclave-scoped. To include lab-org users:
+- `src/app/account/invitation/[inviteId]/create-account.action.ts:155` — `org.type === 'enclave'` → include `'lab'`
+- `src/components/require-reviewer-key.tsx:17` + login check in `src/server/actions/user.actions.ts` — `isEnclaveOrg` → include lab
+- `src/lib/permissions.ts:67-70` — permit `ReviewerKey` for lab orgs too
+- Naming: keep the existing `ReviewerKey` / `require-reviewer-key` / `set/updateReviewerPublicKeyAction` names as-is. **Renaming is out of scope for this work** — just widen the gate.
+
+### Card 71 — Option B steps
+1. **Ingest** (`src/app/api/job/[jobId]/results/route.ts`, ~line 52, currently calls `storeStudyEncryptedResultsFile` → `results/encrypted-results.zip`): replace store-zip-as-is with decompose → S3 bodies + `job_file`/`job_file_key` rows (including DO boxes), one transaction.
+2. **Decrypt path:** new zip-free primitive + client-hook rewrite (body + iv + crypt-from-PG).
+3. **Approve:** drop plaintext write; DO browser re-wraps approved files' AES keys for lab researchers and POSTs `job_file_key` inserts.
+4. **Researcher view:** reuse the DO decrypt path.
+
+---
+
+## 6. Per-file approve/reject (confirmed from code)
+
+Today's behavior is **asymmetric**:
+- **Approve = per-file subset.** Checkbox per result file; all auto-selected on decrypt, reviewer can uncheck (`use-encrypted-files-panel.ts:39,85-86,94-101`). The action takes the chosen subset: `approveStudyJobFilesAction.params({ jobFiles: z.array(...) })` (`study-job.actions.ts:12-45`); button passes `jobFiles: decryptedResults` (`job-review-buttons.tsx:45`).
+- **Reject = whole job.** `rejectStudyJobFilesAction` takes no file list — flips job to `FILES-REJECTED` (`study-job.actions.ts:47-70`).
+
+**Important catch:** there is **no per-file approval column.** Approval is tracked only at the **job level** (`jobStatusChange.status`). "This file is approved" is encoded *implicitly* today by the existence of a plaintext `APPROVED-*` copy — which Option B (§4.5) **deletes**. So if per-file approve is kept, approval state needs a new home:
+- **(a)** The researcher `job_file_key` rows *are* the signal — re-wrap only approved files; "has a researcher PO box" = "approved & shared." No new column. (Recommended — the rows are already per-file and already being inserted.)
+- **(b)** An explicit `approved` flag/status on `job_file`. Cleaner/queryable, decouples "approved" from "shared," but adds a column.
+
+If product chooses **all-or-nothing** approve/reject instead, the existing job-level status suffices, re-wrap covers all files, and no per-file state is needed.
+
+> **Open product decision (Phil):** support per-file approve/reject, or approve/reject the whole artifact set together? This decides whether (a)/(b) is needed. Re-wrap must only ever cover **approved** files — rejected outputs must never get researcher PO boxes.
+
+---
+
+## 7. The cards (this work = 72 → 71 only)
+
+- ✅ **Card 72 — researcher key generation (prerequisite for 71).** Widen the key-gen gate to lab orgs; decide naming.
+- ✅ **Card 71 — enable encryption for researchers.** Decompose on ingest (Option B); re-wrap approved files at approve; remove plaintext; researcher decrypts client-side.
+- ⛔ **Card 73 — key re-generation flow.** Out of scope here.
+- ⛔ **Card 74 — user-led re-encryption / recovery.** Out of scope here.
+
+---
+
+## 8. Open questions
+
+1. **Per-file vs all-together approve/reject** (§6) — **NOTE FOR PHIL: finalize with team/PMs.** Should reviewers approve/reject result files individually (per-file subset, as approve works today) or approve/reject the whole artifact set together? This is the one open decision that affects implementation: per-file requires a new home for approval state (§6 a/b) since Option B removes the implicit plaintext-copy signal; all-together needs none. Re-wrap must only ever cover **approved** files.
+
+**Out of scope for this work (recorded so they aren't lost; whatever's easiest, UX/product decide later):**
+- Renaming "Reviewer key" → role-neutral.
+- Forced regeneration, key-loss responsibility, UX regeneration/access-split questions.
+- Legacy/beta data handling, concurrent-study key association.
+
+---
+
+## 9. Key file references
+
+**TOA** — `src/app/api/job/encrypt-results.ts` (encryption), `src/app/management-app-requests.ts` (fetches org public keys).
+
+**MA**
+- `src/app/api/job/[jobId]/results/route.ts` — **ingest point** (decompose here)
+- `src/app/api/job/[jobId]/keys/route.ts` — public-keys endpoint
+- `src/server/storage.ts` — `storeStudyEncryptedResultsFile` (zip today), `storeApprovedJobFile` (plaintext — to remove)
+- `src/server/actions/study-job.actions.ts` — `approve/rejectStudyJobFilesAction`; server-side `ResultsReader.listFiles` precedent (:72-76)
+- `src/server/db/queries.ts` — `getOrgIdForJobId` (enclave org), `getOrgPublicKeys` (INNER JOIN = has-key filter); **needs a new lab-org query keyed on `submittedByOrgId`**
+- `src/server/actions/user-keys.actions.ts` — public-key write path (role-agnostic)
+- `src/lib/permissions.ts:67-70` — key-gen gate (enclave-only today)
+- `src/components/require-reviewer-key.tsx`, `src/app/account/invitation/[inviteId]/create-account.action.ts:155`, `src/server/actions/user.actions.ts` — key-gen onboarding gates
+- `src/hooks/use-decrypt-files.ts`, `src/hooks/use-encrypted-files-panel.ts`, `src/components/encrypted-files-panel.tsx` — client decrypt + per-file selection
+- review views: `src/app/[orgSlug]/study/[studyId]/review/...`; researcher view: `.../study/[studyId]/view/...`
+
+**si-encryption** — `job-results/writer.ts` (envelope encryption), `job-results/reader.ts` (decryption — needs zip-free primitive + expose AES key), `job-results/types.ts`, `util/keypair.ts`.
diff --git a/src/server/actions/study.actions.ts b/src/server/actions/study.actions.ts
index 77ba1790d..38918d988 100644
--- a/src/server/actions/study.actions.ts
+++ b/src/server/actions/study.actions.ts
@@ -316,6 +316,7 @@ async function approveJobCode({
         const info = { studyId, studyJobId: job.id, orgSlug }
         for (const jobFile of jobFiles) {
             const file = new File([jobFile.contents], jobFile.path)
+            // TODO Delete me in new approach, no longer storing approved job file
             await storeApprovedJobFile(info, file, jobFile.fileType, jobFile.sourceId)
         }
     }
diff --git a/src/server/storage.ts b/src/server/storage.ts
index e1ac66e90..a57dae5e1 100644
--- a/src/server/storage.ts
+++ b/src/server/storage.ts
@@ -48,6 +48,7 @@ export async function storeStudyEncryptedResultsFile(info: MinimalJobInfo, file:
     return await storeJobFile(info, `${pathForStudyJob(info)}/results/encrypted-results.zip`, file, 'ENCRYPTED-RESULT')
 }
 
+// TODO No longer exists in future iteration
 export async function storeApprovedJobFile(info: MinimalJobInfo, file: File, fileType: FileType, sourceId: string) {
     return await storeJobFile(info, `${pathForStudyJob(info)}/results/approved/${file.name}`, file, fileType, sourceId)
 }

From b39ec874474a1fcf49a6812fd7693f806973a3ca Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Wed, 3 Jun 2026 11:02:04 -0400
Subject: [PATCH 02/45] Allow for researcher to get keys now too

---
 .../[inviteId]/create-account.action.test.ts  |  4 ++--
 .../[inviteId]/create-account.action.ts       |  3 ++-
 src/components/require-reviewer-key.test.tsx  | 23 ++++++++++++-------
 src/components/require-reviewer-key.tsx       |  6 ++---
 src/lib/permissions.test.ts                   |  8 +++++++
 src/lib/permissions.ts                        |  6 ++---
 src/lib/types.test.ts                         | 12 +++++++++-
 src/lib/types.ts                              |  7 ++++++
 src/server/actions/user.actions.test.ts       |  8 +++++++
 src/server/actions/user.actions.ts            |  4 ++--
 10 files changed, 61 insertions(+), 20 deletions(-)

diff --git a/src/app/account/invitation/[inviteId]/create-account.action.test.ts b/src/app/account/invitation/[inviteId]/create-account.action.test.ts
index a1befdc45..cb073f14c 100644
--- a/src/app/account/invitation/[inviteId]/create-account.action.test.ts
+++ b/src/app/account/invitation/[inviteId]/create-account.action.test.ts
@@ -180,7 +180,7 @@ describe('Create Account Actions', () => {
         expect(result.needsReviewerKey).toBe(false)
     })
 
-    it('onJoinTeamAccountAction returns needsReviewerKey false for lab org', async () => {
+    it('onJoinTeamAccountAction returns needsReviewerKey true for lab org without existing key', async () => {
         const { user } = await insertTestUser({ org })
 
         const labOrg = await insertTestOrg({ slug: faker.string.alpha(10), type: 'lab' })
@@ -197,7 +197,7 @@ describe('Create Account Actions', () => {
             .executeTakeFirstOrThrow()
 
         const result = actionResult(await onJoinTeamAccountAction({ inviteId: invite.id }))
-        expect(result.needsReviewerKey).toBe(false)
+        expect(result.needsReviewerKey).toBe(true)
     })
 
     it('onRevokeInviteAction removes invite', async () => {
diff --git a/src/app/account/invitation/[inviteId]/create-account.action.ts b/src/app/account/invitation/[inviteId]/create-account.action.ts
index 1b2786e6a..1d95a1bc6 100644
--- a/src/app/account/invitation/[inviteId]/create-account.action.ts
+++ b/src/app/account/invitation/[inviteId]/create-account.action.ts
@@ -5,6 +5,7 @@ import { updateClerkUserMetadata } from '@/server/clerk'
 import { getReviewerPublicKey } from '@/server/db/queries'
 import { onUserAcceptInvite } from '@/server/events'
 import { clerkClient } from '@clerk/nextjs/server'
+import { orgNeedsKey } from '@/lib/types'
 
 export const onPendingUserLoginAction = new Action('onPendingUserLoginAction')
     .params(z.object({ inviteId: z.string() }))
@@ -152,7 +153,7 @@ export const onJoinTeamAccountAction = new Action('onJoinTeamAccountAction')
             .where('org.id', '=', invite.orgId)
             .executeTakeFirstOrThrow()
 
-        const needsReviewerKey = org.type === 'enclave' && !(await getReviewerPublicKey(siUser.id))
+        const needsReviewerKey = orgNeedsKey(org) && !(await getReviewerPublicKey(siUser.id))
 
         return { ...siUser, needsReviewerKey }
     })
diff --git a/src/components/require-reviewer-key.test.tsx b/src/components/require-reviewer-key.test.tsx
index ee3c63317..c480cbddc 100644
--- a/src/components/require-reviewer-key.test.tsx
+++ b/src/components/require-reviewer-key.test.tsx
@@ -1,15 +1,11 @@
 import { reviewerKeyExistsAction } from '@/server/actions/user-keys.actions'
+import { useSession } from '@/hooks/session'
 import { render, waitFor } from '@testing-library/react'
 import { describe, expect, it, Mock, vi } from 'vitest'
 import { RequireReviewerKey } from './require-reviewer-key'
 
-vi.mock('@/hooks/session', () => ({
-    useSession: () => ({
-        session: {
-            orgs: { enclave: { type: 'enclave' } },
-        },
-    }),
-}))
+vi.mock('@/hooks/session', () => ({ useSession: vi.fn() }))
+
 const push = vi.fn()
 vi.mock('next/navigation', () => ({
     useRouter: () => ({ push }),
@@ -19,17 +15,28 @@ vi.mock('@/server/actions/user-keys.actions', () => ({
     reviewerKeyExistsAction: vi.fn(),
 }))
 
+const mockSessionOrgs = (orgs: Record<string, { type: string }>) =>
+    (useSession as Mock).mockReturnValue({ session: { orgs } })
+
 describe('RequireReviewerKey', () => {
     it('redirects when key is missing', async () => {
+        mockSessionOrgs({ enclave: { type: 'enclave' } })
         ;(reviewerKeyExistsAction as Mock).mockResolvedValue(false)
         render(<RequireReviewerKey />)
         await waitFor(() => expect(push).toHaveBeenCalledWith('/account/keys'))
     })
 
     it('does nothing when key exists', async () => {
-        push.mockClear()
+        mockSessionOrgs({ enclave: { type: 'enclave' } })
         ;(reviewerKeyExistsAction as Mock).mockResolvedValue(true)
         render(<RequireReviewerKey />)
         expect(push).not.toHaveBeenCalled()
     })
+
+    it('redirects lab researchers without a key', async () => {
+        mockSessionOrgs({ lab: { type: 'lab' } })
+        ;(reviewerKeyExistsAction as Mock).mockResolvedValue(false)
+        render(<RequireReviewerKey />)
+        await waitFor(() => expect(push).toHaveBeenCalledWith('/account/keys'))
+    })
 })
diff --git a/src/components/require-reviewer-key.tsx b/src/components/require-reviewer-key.tsx
index 4b3940b5f..1e744d11b 100644
--- a/src/components/require-reviewer-key.tsx
+++ b/src/components/require-reviewer-key.tsx
@@ -1,6 +1,6 @@
 'use client'
 
-import { isEnclaveOrg } from '@/lib/types'
+import { orgNeedsKey } from '@/lib/types'
 import { actionResult } from '@/lib/utils'
 import { reviewerKeyExistsAction } from '@/server/actions/user-keys.actions'
 import { useRouter } from 'next/navigation'
@@ -14,8 +14,8 @@ export const RequireReviewerKey = () => {
 
     useLayoutEffect(() => {
         const checkForReviewerKey = async () => {
-            const enclaveOrgs = Object.values(session?.orgs || {}).some(isEnclaveOrg)
-            if (!session || !enclaveOrgs) return
+            const needsKey = Object.values(session?.orgs || {}).some(orgNeedsKey)
+            if (!session || !needsKey) return
 
             const hasKey = actionResult(await reviewerKeyExistsAction())
 
diff --git a/src/lib/permissions.test.ts b/src/lib/permissions.test.ts
index b6e89bb9e..926ebedf1 100644
--- a/src/lib/permissions.test.ts
+++ b/src/lib/permissions.test.ts
@@ -37,6 +37,10 @@ test('reviewer role', () => {
     expect(ability.can('invite', toRecord('User', { orgId: session.orgs.test.id }))).toBe(false)
     expect(ability.can('update', toRecord('User', { id: session.user.id }))).toBe(true)
     expect(ability.can('update', toRecord('User', { id: faker.string.uuid() }))).toBe(false)
+
+    // enclave members hold a key to decrypt results for review
+    expect(ability.can('view', 'ReviewerKey')).toBe(true)
+    expect(ability.can('update', 'ReviewerKey')).toBe(true)
 })
 
 test('researcher role', () => {
@@ -51,6 +55,10 @@ test('researcher role', () => {
 
     // Researchers cannot invite users to their org (not admins)
     expect(ability.can('invite', toRecord('User', { orgId: session.orgs.test.id }))).toBe(false)
+
+    // lab members also hold a key now, to decrypt approved results
+    expect(ability.can('view', 'ReviewerKey')).toBe(true)
+    expect(ability.can('update', 'ReviewerKey')).toBe(true)
 })
 
 test('admin role', () => {
diff --git a/src/lib/permissions.ts b/src/lib/permissions.ts
index 2b31b6820..b4646303b 100644
--- a/src/lib/permissions.ts
+++ b/src/lib/permissions.ts
@@ -1,4 +1,4 @@
-import { type UserSession, isLabOrg, isEnclaveOrg, isOrgAdmin } from './types'
+import { type UserSession, isLabOrg, isEnclaveOrg, isOrgAdmin, orgNeedsKey } from './types'
 import { AbilityBuilder, createMongoAbility, subject } from '@casl/ability'
 import {
     AppAbility,
@@ -63,8 +63,8 @@ export function defineAbilityFor(session: UserSession) {
     permit('view', 'Study', { submittedByOrgId: { $in: usersOrgIds } })
     permit('view', 'StudyJob', { submittedByOrgId: { $in: usersOrgIds } })
 
-    // user who belongs to any enclave orgs can view/create/update their keys
-    if (usersReviewerOrgIds.length) {
+    // users who belong to any key-holding org (enclave or lab) can view/create/update their keys
+    if (orgs.some(orgNeedsKey)) {
         permit('view', 'ReviewerKey')
         permit('update', 'ReviewerKey')
     }
diff --git a/src/lib/types.test.ts b/src/lib/types.test.ts
index 6426ef741..5fff19304 100644
--- a/src/lib/types.test.ts
+++ b/src/lib/types.test.ts
@@ -1,7 +1,17 @@
 import { describe, it, expect } from 'vitest'
-import { getLabOrg } from '@/lib/types'
+import { getLabOrg, orgNeedsKey } from '@/lib/types'
 import { mockSessionWithTestData, createMockUserSession } from '@/tests/unit.helpers'
 
+describe('orgNeedsKey helper', () => {
+    it('returns true for enclave orgs', () => {
+        expect(orgNeedsKey({ type: 'enclave' })).toBe(true)
+    })
+
+    it('returns true for lab orgs', () => {
+        expect(orgNeedsKey({ type: 'lab' })).toBe(true)
+    })
+})
+
 describe('getLabOrg helper', () => {
     it('returns null when user has only enclave orgs', async () => {
         const { user, org } = await mockSessionWithTestData({ orgType: 'enclave' })
diff --git a/src/lib/types.ts b/src/lib/types.ts
index 2fcad26b7..fafe0df80 100644
--- a/src/lib/types.ts
+++ b/src/lib/types.ts
@@ -38,6 +38,13 @@ export function isLabOrg(org: { type: OrgType }): org is LabOrg {
     return org.type === 'lab'
 }
 
+// Members of these org types hold an encryption key: enclave reviewers decrypt to
+// review, lab researchers decrypt approved results. A user without a key for one of
+// these orgs is gated into key generation.
+export function orgNeedsKey(org: { type: OrgType }): boolean {
+    return isEnclaveOrg(org) || isLabOrg(org)
+}
+
 // Helper functions to get orgs from session
 export function getLabOrg(session: UserSession): Org | null {
     return Object.values(session.orgs).find(isLabOrg) || null
diff --git a/src/server/actions/user.actions.test.ts b/src/server/actions/user.actions.test.ts
index bab371bfa..53d54c9c6 100644
--- a/src/server/actions/user.actions.test.ts
+++ b/src/server/actions/user.actions.test.ts
@@ -47,6 +47,14 @@ describe('User Actions', () => {
         expect(result).toEqual({})
     })
 
+    test('onUserSignInAction should redirect lab researchers without a key to the key page', async () => {
+        const { user } = await mockSessionWithTestData({ orgType: 'lab' })
+        await db.deleteFrom('userPublicKey').where('userId', '=', user.id).execute()
+
+        const result = await onUserSignInAction()
+        expect(result).toEqual({ redirectToReviewerKey: true })
+    })
+
     test('syncUserMetadataAction should sync metadata', async () => {
         await mockSessionWithTestData()
         const result = await syncUserMetadataAction()
diff --git a/src/server/actions/user.actions.ts b/src/server/actions/user.actions.ts
index 324f0605a..d6166ec77 100644
--- a/src/server/actions/user.actions.ts
+++ b/src/server/actions/user.actions.ts
@@ -5,7 +5,7 @@ import { sessionFromClerk } from '../clerk'
 import { getReviewerPublicKey } from '../db/queries'
 import { onUserLogIn, onUserResetPW, onUserRoleUpdate } from '../events'
 import { Action, z } from './action'
-import { isEnclaveOrg } from '@/lib/types'
+import { orgNeedsKey } from '@/lib/types'
 
 export const onUserSignInAction = new Action('onUserSignInAction').handler(async () => {
     // Force metadata sync on sign-in to ensure session has fresh data
@@ -14,7 +14,7 @@ export const onUserSignInAction = new Action('onUserSignInAction').handler(async
         throw new Error('Failed to establish session')
     }
     onUserLogIn({ userId: session.user.id })
-    if (Object.values(session.orgs).some((org) => isEnclaveOrg(org))) {
+    if (Object.values(session.orgs).some((org) => orgNeedsKey(org))) {
         const publicKey = await getReviewerPublicKey(session.user.id)
         if (!publicKey) {
             return { redirectToReviewerKey: true }

From 863078eecc0ebf5bb846ed4bb5c1a1d0e4e28266 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Wed, 3 Jun 2026 13:43:16 -0400
Subject: [PATCH 03/45] Fix tests + ci lint

---
 results-encryption-design-notes.md           | 55 +++++++++++++-------
 src/hooks/use-workspace-launcher.tsx         |  2 +-
 src/server/actions/user-keys.actions.test.ts | 19 +++----
 src/server/actions/user.actions.ts           |  2 +-
 4 files changed, 47 insertions(+), 31 deletions(-)

diff --git a/results-encryption-design-notes.md b/results-encryption-design-notes.md
index 4cf19e019..219d68545 100644
--- a/results-encryption-design-notes.md
+++ b/results-encryption-design-notes.md
@@ -10,53 +10,60 @@
 
 The secure enclave's output (result files + run logs) is delivered to **DO reviewers** encrypted, but the same output is currently exposed to **researchers in plaintext**. Reviewers decrypt client-side with a private key generated at signup; researchers get an unencrypted copy.
 
-Goal: researchers must *also* decrypt with their own key, so output is never available in plaintext on the researcher side.
+Goal: researchers must _also_ decrypt with their own key, so output is never available in plaintext on the researcher side.
 
 ---
 
 ## 2. How the encryption works today (the "post office" analogy)
 
-| Concept (analogy) | Implementation | Where in code |
-|---|---|---|
-| **Results key** — a padlock whose one key both locks and unlocks | A random **AES-256-CBC** symmetric key, generated **per file** (+ a per-file random IV) | `si-encryption/job-results/writer.ts:19,22` |
-| **Lock the results** | Encrypt each file's bytes with its AES key | `writer.ts:25` |
-| **A PO box for each person** | The AES key is "wrapped" (encrypted) with each recipient's **RSA-OAEP-4096 public key** | `writer.ts:31-35,58-84` |
-| **The PO box number** | The recipient's **fingerprint** = SHA-256 of their public key | `util/keypair.ts:105-111` |
-| **The post office (directory of boxes)** | `manifest.json` — maps `fingerprint → { crypt }`, plus per-file `iv`, `path`, `bytes` | `writer.ts:39-44`; types in `job-results/types.ts` |
-| **Ship it** | TOA zips `manifest.json` + encrypted bodies, POSTs to MA | TOA `src/app/api/job/encrypt-results.ts` |
-| **Open the box** | Browser fetches the zip, finds its PO box by fingerprint, unwraps the AES key with its private key, decrypts | `hooks/use-decrypt-files.ts`, `job-results/reader.ts:95-109` |
+| Concept (analogy)                                                | Implementation                                                                                               | Where in code                                                |
+| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------ |
+| **Results key** — a padlock whose one key both locks and unlocks | A random **AES-256-CBC** symmetric key, generated **per file** (+ a per-file random IV)                      | `si-encryption/job-results/writer.ts:19,22`                  |
+| **Lock the results**                                             | Encrypt each file's bytes with its AES key                                                                   | `writer.ts:25`                                               |
+| **A PO box for each person**                                     | The AES key is "wrapped" (encrypted) with each recipient's **RSA-OAEP-4096 public key**                      | `writer.ts:31-35,58-84`                                      |
+| **The PO box number**                                            | The recipient's **fingerprint** = SHA-256 of their public key                                                | `util/keypair.ts:105-111`                                    |
+| **The post office (directory of boxes)**                         | `manifest.json` — maps `fingerprint → { crypt }`, plus per-file `iv`, `path`, `bytes`                        | `writer.ts:39-44`; types in `job-results/types.ts`           |
+| **Ship it**                                                      | TOA zips `manifest.json` + encrypted bodies, POSTs to MA                                                     | TOA `src/app/api/job/encrypt-results.ts`                     |
+| **Open the box**                                                 | Browser fetches the zip, finds its PO box by fingerprint, unwraps the AES key with its private key, decrypts | `hooks/use-decrypt-files.ts`, `job-results/reader.ts:95-109` |
 
 **Key types, ELI5**
+
 - **RSA keypair (asymmetric)** — public key = a mail slot anyone can drop into; private key = the only physical key that opens the box. Mathematically bound; you can't edit one to fit the other.
 - **AES key (symmetric)** — one key locks and unlocks. Fast; used for big file bodies. One per file.
 - **IV (initialization vector)** — a per-file random value, **not secret**, but **required** to decrypt (AES-CBC). Must always travel with its ciphertext.
 - **Fingerprint** — the nameplate on the box; SHA-256 of the public key.
-- **Envelope encryption** — lock the big file once with a fast AES padlock, then put a *copy* of that AES key into a personal RSA-locked box per recipient. The manifest is the directory of boxes.
+- **Envelope encryption** — lock the big file once with a fast AES padlock, then put a _copy_ of that AES key into a personal RSA-locked box per recipient. The manifest is the directory of boxes.
 
 **Where keys live**
+
 - **Public key** → DB `user_public_key` (`public_key` bytea, `fingerprint` text, `UNIQUE(user_id)`). Schema is already **role-agnostic**.
-- **Private key** → user downloads a PEM; **never stored server-side**. This is the core guarantee: *the server cannot read results.*
+- **Private key** → user downloads a PEM; **never stored server-side**. This is the core guarantee: _the server cannot read results._
 
 ---
 
 ## 3. The fact that reframes the work
 
-Approve currently stores **plaintext**. `approveStudyJobFilesAction` (`src/server/actions/study-job.actions.ts:12-45`) takes the DO's already-decrypted contents and writes them to `results/approved/` via `storeApprovedJobFile`. Researchers read those plaintext files. So this project is *"stop writing the decrypted copy, and give researchers their own PO boxes instead."*
+Approve currently stores **plaintext**. `approveStudyJobFilesAction` (`src/server/actions/study-job.actions.ts:12-45`) takes the DO's already-decrypted contents and writes them to `results/approved/` via `storeApprovedJobFile`. Researchers read those plaintext files. So this project is _"stop writing the decrypted copy, and give researchers their own PO boxes instead."_
 
 ---
 
 ## 4. Architecture decisions (locked)
 
 ### ✅ 4.1 One key per user, not per role (Card 72)
-A single keypair serves a person as reviewer *and* researcher. Encryption already takes all org public keys regardless of role (`writer.ts`), so the same key works for both hats. Consequence: key handling is user-level, not role-level.
+
+A single keypair serves a person as reviewer _and_ researcher. Encryption already takes all org public keys regardless of role (`writer.ts`), so the same key works for both hats. Consequence: key handling is user-level, not role-level.
 
 ### ✅ 4.2 Re-wrap, not re-encrypt (core mechanic)
+
 Granting a researcher access does **not** re-encrypt file bodies. The file's existing AES key is **wrapped again** for the researcher's public key → a new PO box. The ciphertext and IV never change.
+
 - The DO's browser already holds the raw AES key (it just decrypted to review), so it wraps that key for each researcher and uploads new boxes. **The server never sees plaintext.**
-- A regenerated key cannot open old boxes — that impossibility *is* the security. (Recovery/regeneration handling = out of scope here; see §8.)
+- A regenerated key cannot open old boxes — that impossibility _is_ the security. (Recovery/regeneration handling = out of scope here; see §8.)
 
 ### ✅ 4.3 Option B — decompose on ingest
+
 When MA receives TOA's zip, it **unzips once on the server** and stores the pieces separately:
+
 - each **encrypted body** → its own S3 object
 - per-file **metadata (iv, path, bytes)** + per-recipient **wrapped keys** → Postgres
 
@@ -65,21 +72,25 @@ The manifest is **plaintext metadata** (IVs/fingerprints/wrapped keys are not se
 Postgres is the **single source of truth for PO boxes** (both DO and researcher). The zip is reduced to a transient ingest format; the read path no longer unzips.
 
 **Proposed schema (per file — a zip can hold many files, so do NOT model "zip = one row"):**
+
 ```
 job_file      (id, study_job_id, path, bytes, iv, blob_location)   -- one row per file; IV lives here in Option B
 job_file_key  (job_file_id, fingerprint, crypt)                    -- one row per recipient-per-file = a PO box
                 UNIQUE(job_file_id, fingerprint)
 ```
 
-**Read path (DO and researcher, identical):** fetch encrypted body from S3 + `iv` and the row matching *my* fingerprint from `job_file_key` → decrypt client-side. `SELECT crypt FROM job_file_key WHERE fingerprint = ? AND job_file_id IN (...)` (one box per file).
+**Read path (DO and researcher, identical):** fetch encrypted body from S3 + `iv` and the row matching _my_ fingerprint from `job_file_key` → decrypt client-side. `SELECT crypt FROM job_file_key WHERE fingerprint = ? AND job_file_id IN (...)` (one box per file).
 
 ### ✅ 4.4 Re-wrap at approve, client-side (Card 71)
+
 On **Approve**, the DO's browser:
+
 1. Fetches the **lab's** public keys — members of `study.submittedByOrgId` who have a key.
 2. Wraps each approved file's AES key (already in memory from decrypting) to each researcher public key.
 3. POSTs the new PO boxes; server inserts `job_file_key` rows in one transaction (atomic, idempotent via the unique constraint).
 
 ### ✅ 4.5 Remove plaintext storage
+
 Drop the `storeApprovedJobFile` plaintext write. Researchers read the encrypted body + their PO box and decrypt client-side, using the **same** path as reviewers.
 
 ---
@@ -89,6 +100,7 @@ Drop the `storeApprovedJobFile` plaintext write. Researchers read the encrypted
 **Reassuring:** decompose-on-ingest and re-wrap both operate only on encrypted bytes + non-secret metadata. No server-side plaintext, no server-side private keys.
 
 **Hidden cost of Option B — shared library change.** The current decrypt path is zip-shaped end-to-end: `ResultsReader`'s constructor takes a zip blob and reads `manifest.json` from inside it (`reader.ts:17,45-49`). Option B has no zip at read time, so we must:
+
 - Add a **zip-free decrypt primitive** to `si-encryption`, e.g. `decryptFile(encryptedBody, iv, wrappedKeyForMyFingerprint, privateKey) → plaintext`. The guts already exist (`readFile` does `decryptKeyWithPrivateKey` + `decryptData`, `reader.ts:95-109`) — they just need to be unwelded from zip iteration.
 - Have the reader **expose the raw AES key** per file (today `readFile` computes it but only returns the decrypted body) — **re-wrap needs that key**.
 - Rewrite the client hook (`use-decrypt-files.ts` / `use-encrypted-files-panel.ts`) to fetch body-from-S3 + iv/crypt-from-PG instead of unzipping.
@@ -96,13 +108,16 @@ Drop the `storeApprovedJobFile` plaintext write. Researchers read the encrypted
 This is a **shared-library change, not MA-only.**
 
 ### Card 72 — researcher key generation (prerequisite)
+
 The `user_public_key` schema is already role-agnostic; only the **gate** is enclave-scoped. To include lab-org users:
+
 - `src/app/account/invitation/[inviteId]/create-account.action.ts:155` — `org.type === 'enclave'` → include `'lab'`
 - `src/components/require-reviewer-key.tsx:17` + login check in `src/server/actions/user.actions.ts` — `isEnclaveOrg` → include lab
 - `src/lib/permissions.ts:67-70` — permit `ReviewerKey` for lab orgs too
 - Naming: keep the existing `ReviewerKey` / `require-reviewer-key` / `set/updateReviewerPublicKeyAction` names as-is. **Renaming is out of scope for this work** — just widen the gate.
 
 ### Card 71 — Option B steps
+
 1. **Ingest** (`src/app/api/job/[jobId]/results/route.ts`, ~line 52, currently calls `storeStudyEncryptedResultsFile` → `results/encrypted-results.zip`): replace store-zip-as-is with decompose → S3 bodies + `job_file`/`job_file_key` rows (including DO boxes), one transaction.
 2. **Decrypt path:** new zip-free primitive + client-hook rewrite (body + iv + crypt-from-PG).
 3. **Approve:** drop plaintext write; DO browser re-wraps approved files' AES keys for lab researchers and POSTs `job_file_key` inserts.
@@ -113,11 +128,13 @@ The `user_public_key` schema is already role-agnostic; only the **gate** is encl
 ## 6. Per-file approve/reject (confirmed from code)
 
 Today's behavior is **asymmetric**:
+
 - **Approve = per-file subset.** Checkbox per result file; all auto-selected on decrypt, reviewer can uncheck (`use-encrypted-files-panel.ts:39,85-86,94-101`). The action takes the chosen subset: `approveStudyJobFilesAction.params({ jobFiles: z.array(...) })` (`study-job.actions.ts:12-45`); button passes `jobFiles: decryptedResults` (`job-review-buttons.tsx:45`).
 - **Reject = whole job.** `rejectStudyJobFilesAction` takes no file list — flips job to `FILES-REJECTED` (`study-job.actions.ts:47-70`).
 
-**Important catch:** there is **no per-file approval column.** Approval is tracked only at the **job level** (`jobStatusChange.status`). "This file is approved" is encoded *implicitly* today by the existence of a plaintext `APPROVED-*` copy — which Option B (§4.5) **deletes**. So if per-file approve is kept, approval state needs a new home:
-- **(a)** The researcher `job_file_key` rows *are* the signal — re-wrap only approved files; "has a researcher PO box" = "approved & shared." No new column. (Recommended — the rows are already per-file and already being inserted.)
+**Important catch:** there is **no per-file approval column.** Approval is tracked only at the **job level** (`jobStatusChange.status`). "This file is approved" is encoded _implicitly_ today by the existence of a plaintext `APPROVED-*` copy — which Option B (§4.5) **deletes**. So if per-file approve is kept, approval state needs a new home:
+
+- **(a)** The researcher `job_file_key` rows _are_ the signal — re-wrap only approved files; "has a researcher PO box" = "approved & shared." No new column. (Recommended — the rows are already per-file and already being inserted.)
 - **(b)** An explicit `approved` flag/status on `job_file`. Cleaner/queryable, decouples "approved" from "shared," but adds a column.
 
 If product chooses **all-or-nothing** approve/reject instead, the existing job-level status suffices, re-wrap covers all files, and no per-file state is needed.
@@ -140,6 +157,7 @@ If product chooses **all-or-nothing** approve/reject instead, the existing job-l
 1. **Per-file vs all-together approve/reject** (§6) — **NOTE FOR PHIL: finalize with team/PMs.** Should reviewers approve/reject result files individually (per-file subset, as approve works today) or approve/reject the whole artifact set together? This is the one open decision that affects implementation: per-file requires a new home for approval state (§6 a/b) since Option B removes the implicit plaintext-copy signal; all-together needs none. Re-wrap must only ever cover **approved** files.
 
 **Out of scope for this work (recorded so they aren't lost; whatever's easiest, UX/product decide later):**
+
 - Renaming "Reviewer key" → role-neutral.
 - Forced regeneration, key-loss responsibility, UX regeneration/access-split questions.
 - Legacy/beta data handling, concurrent-study key association.
@@ -151,6 +169,7 @@ If product chooses **all-or-nothing** approve/reject instead, the existing job-l
 **TOA** — `src/app/api/job/encrypt-results.ts` (encryption), `src/app/management-app-requests.ts` (fetches org public keys).
 
 **MA**
+
 - `src/app/api/job/[jobId]/results/route.ts` — **ingest point** (decompose here)
 - `src/app/api/job/[jobId]/keys/route.ts` — public-keys endpoint
 - `src/server/storage.ts` — `storeStudyEncryptedResultsFile` (zip today), `storeApprovedJobFile` (plaintext — to remove)
diff --git a/src/hooks/use-workspace-launcher.tsx b/src/hooks/use-workspace-launcher.tsx
index 8317c1668..08704a774 100644
--- a/src/hooks/use-workspace-launcher.tsx
+++ b/src/hooks/use-workspace-launcher.tsx
@@ -119,7 +119,7 @@ export function useWorkspaceLauncher({ studyId, onSuccess }: UseWorkspaceLaunche
             }
             onSuccessRef.current?.()
         }
-    }, [workspaceQuery.data, workspaceQuery.error, launchComplete])
+    }, [workspaceQuery.data, workspaceQuery.error, launchComplete, studyId])
 
     const launchWorkspace = useCallback(() => {
         setError(null)
diff --git a/src/server/actions/user-keys.actions.test.ts b/src/server/actions/user-keys.actions.test.ts
index f4fb6eb20..66dfd38bb 100644
--- a/src/server/actions/user-keys.actions.test.ts
+++ b/src/server/actions/user-keys.actions.test.ts
@@ -6,7 +6,6 @@ import {
     updateReviewerPublicKeyAction,
 } from './user-keys.actions'
 import { db } from '@/database'
-import logger from '@/lib/logger'
 
 vi.mock('@/server/events', async (importOriginal) => ({
     ...(await importOriginal<typeof import('@/server/events')>()),
@@ -15,17 +14,15 @@ vi.mock('@/server/events', async (importOriginal) => ({
 }))
 
 describe('User Keys Actions', () => {
-    it('only allows reviewer users to access the actions', async () => {
-        await mockSessionWithTestData({ orgType: 'lab' })
-        vi.spyOn(logger, 'error').mockImplementation(() => undefined)
+    it('allows lab researchers to access the actions, since they now hold keys too', async () => {
+        const { user } = await mockSessionWithTestData({ orgType: 'lab' })
+        await db.deleteFrom('userPublicKey').where('userId', '=', user.id).execute()
+        const publicKey = Buffer.from('lab-public-key')
+        const fingerprint = 'lab-fingerprint'
+        await db.insertInto('userPublicKey').values({ userId: user.id, publicKey, fingerprint }).execute()
 
-        try {
-            actionResult(await getReviewerPublicKeyAction())
-            expect.fail('Expected an error to be thrown')
-        } catch (error) {
-            expect(error).toBeInstanceOf(Error)
-            expect((error as Error).message).toMatch(/cannot view ReviewerKey/)
-        }
+        const result = actionResult(await getReviewerPublicKeyAction())
+        expect(result?.fingerprint).toEqual(fingerprint)
     })
 
     it('getReviewerPublicKeyAction returns the public key for the current user', async () => {
diff --git a/src/server/actions/user.actions.ts b/src/server/actions/user.actions.ts
index d6166ec77..b170caa60 100644
--- a/src/server/actions/user.actions.ts
+++ b/src/server/actions/user.actions.ts
@@ -14,7 +14,7 @@ export const onUserSignInAction = new Action('onUserSignInAction').handler(async
         throw new Error('Failed to establish session')
     }
     onUserLogIn({ userId: session.user.id })
-    if (Object.values(session.orgs).some((org) => orgNeedsKey(org))) {
+    if (Object.values(session.orgs).some(orgNeedsKey)) {
         const publicKey = await getReviewerPublicKey(session.user.id)
         if (!publicKey) {
             return { redirectToReviewerKey: true }

From ff8fd26027f4aef8f6db4b6706204e5791230c2a Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Wed, 3 Jun 2026 16:26:27 -0400
Subject: [PATCH 04/45] Fix test

---
 .../invitation/[inviteId]/create-account.action.test.ts      | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/app/account/invitation/[inviteId]/create-account.action.test.ts b/src/app/account/invitation/[inviteId]/create-account.action.test.ts
index 58d006123..d4fb48ca6 100644
--- a/src/app/account/invitation/[inviteId]/create-account.action.test.ts
+++ b/src/app/account/invitation/[inviteId]/create-account.action.test.ts
@@ -229,7 +229,10 @@ describe('Create Account Actions', () => {
     })
 
     it('onJoinTeamAccountAction returns needsReviewerKey true for lab org without existing key', async () => {
-        const { user } = await insertTestUser({ org })
+        // insertTestUser only auto-creates a key for enclave-org users, so seed this user in a
+        // lab org to keep them key-less and exercise the lab researcher gate.
+        const existingLabOrg = await insertTestOrg({ slug: faker.string.alpha(10), type: 'lab' })
+        const { user } = await insertTestUser({ org: existingLabOrg })
 
         const labOrg = await insertTestOrg({ slug: faker.string.alpha(10), type: 'lab' })
 

From 014af9f18010650cadde4b79c04a5045ea4e9903 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Thu, 4 Jun 2026 10:52:12 -0400
Subject: [PATCH 05/45] Add keys for test researchers

---
 .../seeds/1743608138837_test_users.ts         | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/src/database/seeds/1743608138837_test_users.ts b/src/database/seeds/1743608138837_test_users.ts
index b90632e4c..3b8bf0f10 100644
--- a/src/database/seeds/1743608138837_test_users.ts
+++ b/src/database/seeds/1743608138837_test_users.ts
@@ -227,4 +227,28 @@ export async function seed(db: Kysely<DB>): Promise<void> {
             await db.insertInto('orgUser').values({ userId, orgId, isAdmin: membership.isAdmin }).execute()
         }
     }
+
+    // Every test user belongs to an org that requires an encryption key (enclave or lab), so the
+    // RequireReviewerKey gate redirects them to key generation until one exists. Seed a placeholder
+    // key so e2e flows land on the real dashboard; decryption isn't exercised here, so the bytes
+    // only need to exist.
+    for (const user of TEST_USERS) {
+        const userId = userIdByRole.get(user.role)!
+
+        const existing = await db
+            .selectFrom('userPublicKey')
+            .select('id')
+            .where('userId', '=', userId)
+            .executeTakeFirst()
+        if (existing) continue
+
+        await db
+            .insertInto('userPublicKey')
+            .values({
+                userId,
+                publicKey: Buffer.from(`e2e-test-public-key-${user.role}`),
+                fingerprint: `e2e-test-fingerprint-${user.role}`,
+            })
+            .execute()
+    }
 }

From 1b112c89be5a75547279ece0ef6bc9895128fe19 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Thu, 4 Jun 2026 11:36:54 -0400
Subject: [PATCH 06/45] Update and compress notes

---
 results-encryption-design-notes.md | 138 ++++++++++++++++-------------
 1 file changed, 76 insertions(+), 62 deletions(-)

diff --git a/results-encryption-design-notes.md b/results-encryption-design-notes.md
index 219d68545..fea04d534 100644
--- a/results-encryption-design-notes.md
+++ b/results-encryption-design-notes.md
@@ -1,49 +1,50 @@
 # Results Encryption for Researchers — Design Notes
 
-> Working synthesis from a grilling session against the codebase (management-app + trusted-output-app).
-> Status: **draft for review.** Decisions locked so far are marked ✅; open items are in §8.
-> **Scope for this work: Card 72 (prerequisite) → Card 71 only.** Happy path only. Cards 73 / 74 (regeneration, recovery) are explicitly out of scope here.
+> Working synthesis from grilling session against codebase (management-app + trusted-output-app).
+> Status: **draft for review.** Locked decisions marked ✅; open items in §8.
+> **Scope: Card 72 (prerequisite) → Card 71 only.** Happy path only. Cards 73/74 (regeneration, recovery) explicitly out of scope.
+> **Progress: Card 72 DONE (PR #764). Card 71 not started — next session.**
 
 ---
 
 ## 1. The problem
 
-The secure enclave's output (result files + run logs) is delivered to **DO reviewers** encrypted, but the same output is currently exposed to **researchers in plaintext**. Reviewers decrypt client-side with a private key generated at signup; researchers get an unencrypted copy.
+Enclave output (result files + run logs) delivered to **DO reviewers** encrypted, but same output currently exposed to **researchers in plaintext**. Reviewers decrypt client-side with private key generated at signup; researchers get unencrypted copy.
 
-Goal: researchers must _also_ decrypt with their own key, so output is never available in plaintext on the researcher side.
+Goal: researchers must _also_ decrypt with own key, so output never available plaintext on researcher side.
 
 ---
 
-## 2. How the encryption works today (the "post office" analogy)
+## 2. How encryption works today (the "post office" analogy)
 
-| Concept (analogy)                                                | Implementation                                                                                               | Where in code                                                |
-| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------ |
-| **Results key** — a padlock whose one key both locks and unlocks | A random **AES-256-CBC** symmetric key, generated **per file** (+ a per-file random IV)                      | `si-encryption/job-results/writer.ts:19,22`                  |
-| **Lock the results**                                             | Encrypt each file's bytes with its AES key                                                                   | `writer.ts:25`                                               |
-| **A PO box for each person**                                     | The AES key is "wrapped" (encrypted) with each recipient's **RSA-OAEP-4096 public key**                      | `writer.ts:31-35,58-84`                                      |
-| **The PO box number**                                            | The recipient's **fingerprint** = SHA-256 of their public key                                                | `util/keypair.ts:105-111`                                    |
-| **The post office (directory of boxes)**                         | `manifest.json` — maps `fingerprint → { crypt }`, plus per-file `iv`, `path`, `bytes`                        | `writer.ts:39-44`; types in `job-results/types.ts`           |
-| **Ship it**                                                      | TOA zips `manifest.json` + encrypted bodies, POSTs to MA                                                     | TOA `src/app/api/job/encrypt-results.ts`                     |
-| **Open the box**                                                 | Browser fetches the zip, finds its PO box by fingerprint, unwraps the AES key with its private key, decrypts | `hooks/use-decrypt-files.ts`, `job-results/reader.ts:95-109` |
+| Concept (analogy)                                              | Implementation                                                                                   | Where in code                                                |
+| -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------ |
+| **Results key** — padlock whose one key both locks and unlocks | Random **AES-256-CBC** symmetric key, generated **per file** (+ per-file random IV)              | `si-encryption/job-results/writer.ts:19,22`                  |
+| **Lock the results**                                           | Encrypt each file's bytes with its AES key                                                       | `writer.ts:25`                                               |
+| **PO box per person**                                          | AES key "wrapped" (encrypted) with each recipient's **RSA-OAEP-4096 public key**                 | `writer.ts:31-35,58-84`                                      |
+| **PO box number**                                              | Recipient's **fingerprint** = SHA-256 of public key                                              | `util/keypair.ts:105-111`                                    |
+| **Post office (directory of boxes)**                           | `manifest.json` — maps `fingerprint → { crypt }`, plus per-file `iv`, `path`, `bytes`            | `writer.ts:39-44`; types in `job-results/types.ts`           |
+| **Ship it**                                                    | TOA zips `manifest.json` + encrypted bodies, POSTs to MA                                         | TOA `src/app/api/job/encrypt-results.ts`                     |
+| **Open the box**                                               | Browser fetches zip, finds its PO box by fingerprint, unwraps AES key with private key, decrypts | `hooks/use-decrypt-files.ts`, `job-results/reader.ts:95-109` |
 
 **Key types, ELI5**
 
-- **RSA keypair (asymmetric)** — public key = a mail slot anyone can drop into; private key = the only physical key that opens the box. Mathematically bound; you can't edit one to fit the other.
+- **RSA keypair (asymmetric)** — public key = mail slot anyone can drop into; private key = only physical key that opens box. Mathematically bound; can't edit one to fit other.
 - **AES key (symmetric)** — one key locks and unlocks. Fast; used for big file bodies. One per file.
-- **IV (initialization vector)** — a per-file random value, **not secret**, but **required** to decrypt (AES-CBC). Must always travel with its ciphertext.
-- **Fingerprint** — the nameplate on the box; SHA-256 of the public key.
-- **Envelope encryption** — lock the big file once with a fast AES padlock, then put a _copy_ of that AES key into a personal RSA-locked box per recipient. The manifest is the directory of boxes.
+- **IV (initialization vector)** — per-file random value, **not secret**, but **required** to decrypt (AES-CBC). Must travel with ciphertext.
+- **Fingerprint** — nameplate on box; SHA-256 of public key.
+- **Envelope encryption** — lock big file once with fast AES padlock, then put _copy_ of that AES key into personal RSA-locked box per recipient. Manifest = directory of boxes.
 
 **Where keys live**
 
-- **Public key** → DB `user_public_key` (`public_key` bytea, `fingerprint` text, `UNIQUE(user_id)`). Schema is already **role-agnostic**.
-- **Private key** → user downloads a PEM; **never stored server-side**. This is the core guarantee: _the server cannot read results._
+- **Public key** → DB `user_public_key` (`public_key` bytea, `fingerprint` text, `UNIQUE(user_id)`). Schema already **role-agnostic**.
+- **Private key** → user downloads PEM; **never stored server-side**. Core guarantee: _server cannot read results._
 
 ---
 
 ## 3. The fact that reframes the work
 
-Approve currently stores **plaintext**. `approveStudyJobFilesAction` (`src/server/actions/study-job.actions.ts:12-45`) takes the DO's already-decrypted contents and writes them to `results/approved/` via `storeApprovedJobFile`. Researchers read those plaintext files. So this project is _"stop writing the decrypted copy, and give researchers their own PO boxes instead."_
+Approve currently stores **plaintext**. `approveStudyJobFilesAction` (`src/server/actions/study-job.actions.ts:12-45`) takes DO's already-decrypted contents and writes them to `results/approved/` via `storeApprovedJobFile`. Researchers read those plaintext files. Project = _"stop writing decrypted copy, give researchers own PO boxes instead."_
 
 ---
 
@@ -51,27 +52,27 @@ Approve currently stores **plaintext**. `approveStudyJobFilesAction` (`src/serve
 
 ### ✅ 4.1 One key per user, not per role (Card 72)
 
-A single keypair serves a person as reviewer _and_ researcher. Encryption already takes all org public keys regardless of role (`writer.ts`), so the same key works for both hats. Consequence: key handling is user-level, not role-level.
+Single keypair serves person as reviewer _and_ researcher. Encryption already takes all org public keys regardless of role (`writer.ts`), so same key works for both hats. Consequence: key handling is user-level, not role-level.
 
 ### ✅ 4.2 Re-wrap, not re-encrypt (core mechanic)
 
-Granting a researcher access does **not** re-encrypt file bodies. The file's existing AES key is **wrapped again** for the researcher's public key → a new PO box. The ciphertext and IV never change.
+Granting researcher access does **not** re-encrypt file bodies. File's existing AES key **wrapped again** for researcher's public key → new PO box. Ciphertext and IV never change.
 
-- The DO's browser already holds the raw AES key (it just decrypted to review), so it wraps that key for each researcher and uploads new boxes. **The server never sees plaintext.**
-- A regenerated key cannot open old boxes — that impossibility _is_ the security. (Recovery/regeneration handling = out of scope here; see §8.)
+- DO's browser already holds raw AES key (just decrypted to review), so it wraps that key for each researcher and uploads new boxes. **Server never sees plaintext.**
+- Regenerated key cannot open old boxes — that impossibility _is_ the security. (Recovery/regeneration = out of scope; see §8.)
 
 ### ✅ 4.3 Option B — decompose on ingest
 
-When MA receives TOA's zip, it **unzips once on the server** and stores the pieces separately:
+When MA receives TOA's zip, **unzips once on server** and stores pieces separately:
 
-- each **encrypted body** → its own S3 object
+- each **encrypted body** → own S3 object
 - per-file **metadata (iv, path, bytes)** + per-recipient **wrapped keys** → Postgres
 
-The manifest is **plaintext metadata** (IVs/fingerprints/wrapped keys are not secret), and the server already parses it today with an empty key just to list files (`study-job.actions.ts:72-76`). So decompose-on-ingest needs **no private keys and touches no plaintext** — the zero-plaintext-on-server guarantee holds.
+Manifest is **plaintext metadata** (IVs/fingerprints/wrapped keys not secret), and server already parses it today with empty key to list files (`study-job.actions.ts:72-76`). Decompose-on-ingest needs **no private keys, touches no plaintext** — zero-plaintext-on-server guarantee holds.
 
-Postgres is the **single source of truth for PO boxes** (both DO and researcher). The zip is reduced to a transient ingest format; the read path no longer unzips.
+Postgres = **single source of truth for PO boxes** (DO and researcher). Zip reduced to transient ingest format; read path no longer unzips.
 
-**Proposed schema (per file — a zip can hold many files, so do NOT model "zip = one row"):**
+**Proposed schema (per file — zip can hold many files, do NOT model "zip = one row"):**
 
 ```
 job_file      (id, study_job_id, path, bytes, iv, blob_location)   -- one row per file; IV lives here in Option B
@@ -79,19 +80,19 @@ job_file_key  (job_file_id, fingerprint, crypt)                    -- one row pe
                 UNIQUE(job_file_id, fingerprint)
 ```
 
-**Read path (DO and researcher, identical):** fetch encrypted body from S3 + `iv` and the row matching _my_ fingerprint from `job_file_key` → decrypt client-side. `SELECT crypt FROM job_file_key WHERE fingerprint = ? AND job_file_id IN (...)` (one box per file).
+**Read path (DO and researcher, identical):** fetch encrypted body from S3 + `iv` and row matching _my_ fingerprint from `job_file_key` → decrypt client-side. `SELECT crypt FROM job_file_key WHERE fingerprint = ? AND job_file_id IN (...)` (one box per file).
 
 ### ✅ 4.4 Re-wrap at approve, client-side (Card 71)
 
-On **Approve**, the DO's browser:
+On **Approve**, DO's browser:
 
-1. Fetches the **lab's** public keys — members of `study.submittedByOrgId` who have a key.
+1. Fetches **lab's** public keys — members of `study.submittedByOrgId` who have key.
 2. Wraps each approved file's AES key (already in memory from decrypting) to each researcher public key.
-3. POSTs the new PO boxes; server inserts `job_file_key` rows in one transaction (atomic, idempotent via the unique constraint).
+3. POSTs new PO boxes; server inserts `job_file_key` rows in one transaction (atomic, idempotent via unique constraint).
 
 ### ✅ 4.5 Remove plaintext storage
 
-Drop the `storeApprovedJobFile` plaintext write. Researchers read the encrypted body + their PO box and decrypt client-side, using the **same** path as reviewers.
+Drop `storeApprovedJobFile` plaintext write. Researchers read encrypted body + their PO box and decrypt client-side, using **same** path as reviewers.
 
 ---
 
@@ -99,64 +100,77 @@ Drop the `storeApprovedJobFile` plaintext write. Researchers read the encrypted
 
 **Reassuring:** decompose-on-ingest and re-wrap both operate only on encrypted bytes + non-secret metadata. No server-side plaintext, no server-side private keys.
 
-**Hidden cost of Option B — shared library change.** The current decrypt path is zip-shaped end-to-end: `ResultsReader`'s constructor takes a zip blob and reads `manifest.json` from inside it (`reader.ts:17,45-49`). Option B has no zip at read time, so we must:
+**Hidden cost of Option B — shared library change.** Current decrypt path is zip-shaped end-to-end: `ResultsReader`'s constructor takes zip blob and reads `manifest.json` from inside it (`reader.ts:17,45-49`). Option B has no zip at read time, so must:
 
-- Add a **zip-free decrypt primitive** to `si-encryption`, e.g. `decryptFile(encryptedBody, iv, wrappedKeyForMyFingerprint, privateKey) → plaintext`. The guts already exist (`readFile` does `decryptKeyWithPrivateKey` + `decryptData`, `reader.ts:95-109`) — they just need to be unwelded from zip iteration.
-- Have the reader **expose the raw AES key** per file (today `readFile` computes it but only returns the decrypted body) — **re-wrap needs that key**.
-- Rewrite the client hook (`use-decrypt-files.ts` / `use-encrypted-files-panel.ts`) to fetch body-from-S3 + iv/crypt-from-PG instead of unzipping.
+- Add **zip-free decrypt primitive** to `si-encryption`, e.g. `decryptFile(encryptedBody, iv, wrappedKeyForMyFingerprint, privateKey) → plaintext`. Guts already exist (`readFile` does `decryptKeyWithPrivateKey` + `decryptData`, `reader.ts:95-109`) — just need unwelding from zip iteration.
+- Have reader **expose raw AES key** per file (today `readFile` computes it but returns only decrypted body) — **re-wrap needs that key**.
+- Rewrite client hook (`use-decrypt-files.ts` / `use-encrypted-files-panel.ts`) to fetch body-from-S3 + iv/crypt-from-PG instead of unzipping.
 
-This is a **shared-library change, not MA-only.**
+**Shared-library change, not MA-only.**
 
-### Card 72 — researcher key generation (prerequisite)
+### Card 72 — researcher key generation (prerequisite) — ✅ DONE (PR #764)
 
-The `user_public_key` schema is already role-agnostic; only the **gate** is enclave-scoped. To include lab-org users:
+`user_public_key` schema already role-agnostic; only **gate** was enclave-scoped. Widened to include lab-org users.
 
-- `src/app/account/invitation/[inviteId]/create-account.action.ts:155` — `org.type === 'enclave'` → include `'lab'`
-- `src/components/require-reviewer-key.tsx:17` + login check in `src/server/actions/user.actions.ts` — `isEnclaveOrg` → include lab
-- `src/lib/permissions.ts:67-70` — permit `ReviewerKey` for lab orgs too
-- Naming: keep the existing `ReviewerKey` / `require-reviewer-key` / `set/updateReviewerPublicKeyAction` names as-is. **Renaming is out of scope for this work** — just widen the gate.
+**What shipped:**
+
+- New predicate `orgNeedsKey(org)` in `src/lib/types.ts` = `isEnclaveOrg(org) || isLabOrg(org)`. One named concept, four call-sites — chosen over inlining `|| isLabOrg` (drift risk) and over coupling to reviewer-only concept (`usersReviewerOrgIds` stays enclave-only for approve/reject/review).
+- Four gates flipped `isEnclaveOrg` → `orgNeedsKey`:
+    - `src/lib/permissions.ts:67` — `if (orgs.some(orgNeedsKey))` permits view/update `ReviewerKey`
+    - `src/components/require-reviewer-key.tsx:17` — redirect guard
+    - `src/server/actions/user.actions.ts:17` — sign-in redirect
+    - `src/app/account/invitation/[inviteId]/create-account.action.ts:155` — invite `needsReviewerKey`
+- Names kept (`ReviewerKey` / `require-reviewer-key` / `set/updateReviewerPublicKeyAction`) — rename still out of scope.
+- Researcher now: generates keypair client-side at `/account/keys`, downloads PEM (server never stores private key), public key + fingerprint → `userPublicKey`. Reuses reviewer path entirely; zero new storage code.
+
+**Test fallout fixed (same PR):**
+
+- `user-keys.actions.test.ts` — flipped stale "lab user `cannot view ReviewerKey`" assertion to assert access.
+- `create-account.action.test.ts` — lab "needsReviewerKey true" case must seed user in **lab** org; `insertTestUser` auto-creates key only for **enclave**-org users (`tests/unit.helpers.tsx:215`), so enclave-seeded user already had key and broke assertion.
+- e2e seed `src/database/seeds/1743608138837_test_users.ts` — seed placeholder `userPublicKey` for all test users. `RequireReviewerKey` now gates lab researchers too; key-less seeded users were redirected off dashboard, detaching `new-study` button mid-click → all study-flow specs timed out.
+- Unrelated pre-existing lint warning fixed to unblock CI: `studyId` added to `useEffect` dep array in `src/hooks/use-workspace-launcher.tsx:122`.
 
 ### Card 71 — Option B steps
 
 1. **Ingest** (`src/app/api/job/[jobId]/results/route.ts`, ~line 52, currently calls `storeStudyEncryptedResultsFile` → `results/encrypted-results.zip`): replace store-zip-as-is with decompose → S3 bodies + `job_file`/`job_file_key` rows (including DO boxes), one transaction.
 2. **Decrypt path:** new zip-free primitive + client-hook rewrite (body + iv + crypt-from-PG).
 3. **Approve:** drop plaintext write; DO browser re-wraps approved files' AES keys for lab researchers and POSTs `job_file_key` inserts.
-4. **Researcher view:** reuse the DO decrypt path.
+4. **Researcher view:** reuse DO decrypt path.
 
 ---
 
 ## 6. Per-file approve/reject (confirmed from code)
 
-Today's behavior is **asymmetric**:
+Today's behavior **asymmetric**:
 
-- **Approve = per-file subset.** Checkbox per result file; all auto-selected on decrypt, reviewer can uncheck (`use-encrypted-files-panel.ts:39,85-86,94-101`). The action takes the chosen subset: `approveStudyJobFilesAction.params({ jobFiles: z.array(...) })` (`study-job.actions.ts:12-45`); button passes `jobFiles: decryptedResults` (`job-review-buttons.tsx:45`).
+- **Approve = per-file subset.** Checkbox per result file; all auto-selected on decrypt, reviewer can uncheck (`use-encrypted-files-panel.ts:39,85-86,94-101`). Action takes chosen subset: `approveStudyJobFilesAction.params({ jobFiles: z.array(...) })` (`study-job.actions.ts:12-45`); button passes `jobFiles: decryptedResults` (`job-review-buttons.tsx:45`).
 - **Reject = whole job.** `rejectStudyJobFilesAction` takes no file list — flips job to `FILES-REJECTED` (`study-job.actions.ts:47-70`).
 
-**Important catch:** there is **no per-file approval column.** Approval is tracked only at the **job level** (`jobStatusChange.status`). "This file is approved" is encoded _implicitly_ today by the existence of a plaintext `APPROVED-*` copy — which Option B (§4.5) **deletes**. So if per-file approve is kept, approval state needs a new home:
+**Important catch:** **no per-file approval column.** Approval tracked only at **job level** (`jobStatusChange.status`). "This file is approved" encoded _implicitly_ today by existence of plaintext `APPROVED-*` copy — which Option B (§4.5) **deletes**. So if per-file approve kept, approval state needs new home:
 
-- **(a)** The researcher `job_file_key` rows _are_ the signal — re-wrap only approved files; "has a researcher PO box" = "approved & shared." No new column. (Recommended — the rows are already per-file and already being inserted.)
-- **(b)** An explicit `approved` flag/status on `job_file`. Cleaner/queryable, decouples "approved" from "shared," but adds a column.
+- **(a)** Researcher `job_file_key` rows _are_ the signal — re-wrap only approved files; "has researcher PO box" = "approved & shared." No new column. (Recommended — rows already per-file and already being inserted.)
+- **(b)** Explicit `approved` flag/status on `job_file`. Cleaner/queryable, decouples "approved" from "shared," but adds column.
 
-If product chooses **all-or-nothing** approve/reject instead, the existing job-level status suffices, re-wrap covers all files, and no per-file state is needed.
+If product chooses **all-or-nothing** approve/reject, existing job-level status suffices, re-wrap covers all files, no per-file state needed.
 
-> **Open product decision (Phil):** support per-file approve/reject, or approve/reject the whole artifact set together? This decides whether (a)/(b) is needed. Re-wrap must only ever cover **approved** files — rejected outputs must never get researcher PO boxes.
+> **Open product decision (Phil):** support per-file approve/reject, or approve/reject whole artifact set together? Decides whether (a)/(b) needed. Re-wrap must only ever cover **approved** files — rejected outputs must never get researcher PO boxes.
 
 ---
 
 ## 7. The cards (this work = 72 → 71 only)
 
-- ✅ **Card 72 — researcher key generation (prerequisite for 71).** Widen the key-gen gate to lab orgs; decide naming.
-- ✅ **Card 71 — enable encryption for researchers.** Decompose on ingest (Option B); re-wrap approved files at approve; remove plaintext; researcher decrypts client-side.
-- ⛔ **Card 73 — key re-generation flow.** Out of scope here.
-- ⛔ **Card 74 — user-led re-encryption / recovery.** Out of scope here.
+- ✅ **Card 72 — researcher key generation (prerequisite for 71).** DONE — PR #764. Gate widened to lab orgs via `orgNeedsKey`; names kept.
+- ⬜ **Card 71 — enable encryption for researchers.** NOT STARTED (next session). Decompose on ingest (Option B); re-wrap approved files at approve; remove plaintext; researcher decrypts client-side.
+- ⛔ **Card 73 — key re-generation flow.** Out of scope.
+- ⛔ **Card 74 — user-led re-encryption / recovery.** Out of scope.
 
 ---
 
 ## 8. Open questions
 
-1. **Per-file vs all-together approve/reject** (§6) — **NOTE FOR PHIL: finalize with team/PMs.** Should reviewers approve/reject result files individually (per-file subset, as approve works today) or approve/reject the whole artifact set together? This is the one open decision that affects implementation: per-file requires a new home for approval state (§6 a/b) since Option B removes the implicit plaintext-copy signal; all-together needs none. Re-wrap must only ever cover **approved** files.
+1. **Per-file vs all-together approve/reject** (§6) — **NOTE FOR PHIL: finalize with team/PMs.** Should reviewers approve/reject result files individually (per-file subset, as approve works today) or approve/reject whole artifact set together? One open decision affecting implementation: per-file requires new home for approval state (§6 a/b) since Option B removes implicit plaintext-copy signal; all-together needs none. Re-wrap must only ever cover **approved** files.
 
-**Out of scope for this work (recorded so they aren't lost; whatever's easiest, UX/product decide later):**
+**Out of scope (recorded so not lost; UX/product decide later):**
 
 - Renaming "Reviewer key" → role-neutral.
 - Forced regeneration, key-loss responsibility, UX regeneration/access-split questions.
@@ -174,7 +188,7 @@ If product chooses **all-or-nothing** approve/reject instead, the existing job-l
 - `src/app/api/job/[jobId]/keys/route.ts` — public-keys endpoint
 - `src/server/storage.ts` — `storeStudyEncryptedResultsFile` (zip today), `storeApprovedJobFile` (plaintext — to remove)
 - `src/server/actions/study-job.actions.ts` — `approve/rejectStudyJobFilesAction`; server-side `ResultsReader.listFiles` precedent (:72-76)
-- `src/server/db/queries.ts` — `getOrgIdForJobId` (enclave org), `getOrgPublicKeys` (INNER JOIN = has-key filter); **needs a new lab-org query keyed on `submittedByOrgId`**
+- `src/server/db/queries.ts` — `getOrgIdForJobId` (enclave org), `getOrgPublicKeys` (INNER JOIN = has-key filter); **needs new lab-org query keyed on `submittedByOrgId`**
 - `src/server/actions/user-keys.actions.ts` — public-key write path (role-agnostic)
 - `src/lib/permissions.ts:67-70` — key-gen gate (enclave-only today)
 - `src/components/require-reviewer-key.tsx`, `src/app/account/invitation/[inviteId]/create-account.action.ts:155`, `src/server/actions/user.actions.ts` — key-gen onboarding gates

From f4ded752195cfefcff13a06e83b6ee8263bb944c Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Thu, 4 Jun 2026 15:24:06 -0400
Subject: [PATCH 07/45] Test CI

---
 results-encryption-design-notes.md            | 87 ++++++++++++++++---
 .../[studyId]/review/job-review-buttons.tsx   |  6 +-
 .../[studyId]/review/study-results.test.tsx   | 32 ++++---
 .../[studyId]/review/study-review-buttons.tsx | 10 ++-
 src/components/encrypted-files-panel.test.tsx | 19 ++--
 src/components/job-results.tsx                | 62 ++++++++++---
 src/hooks/use-decrypt-files.ts                |  6 +-
 src/hooks/use-encrypted-files-panel.ts        | 64 +++++++-------
 src/lib/re-encrypt-results.ts                 | 29 +++++++
 .../actions/results-reencryption.test.ts      | 66 ++++++++++++++
 src/server/actions/study-job.actions.test.ts  |  3 +-
 src/server/actions/study-job.actions.ts       | 48 ++++++++--
 src/server/actions/study.actions.ts           |  3 +-
 src/server/db/queries.ts                      | 26 ++++++
 src/server/storage.ts                         |  3 +-
 15 files changed, 374 insertions(+), 90 deletions(-)
 create mode 100644 src/lib/re-encrypt-results.ts
 create mode 100644 src/server/actions/results-reencryption.test.ts

diff --git a/results-encryption-design-notes.md b/results-encryption-design-notes.md
index fea04d534..e1978b21d 100644
--- a/results-encryption-design-notes.md
+++ b/results-encryption-design-notes.md
@@ -3,7 +3,14 @@
 > Working synthesis from grilling session against codebase (management-app + trusted-output-app).
 > Status: **draft for review.** Locked decisions marked ✅; open items in §8.
 > **Scope: Card 72 (prerequisite) → Card 71 only.** Happy path only. Cards 73/74 (regeneration, recovery) explicitly out of scope.
-> **Progress: Card 72 DONE (PR #764). Card 71 not started — next session.**
+> **All phases land on one branch/PR (`researcher-encrypted-results`).** Not split per-card.
+> **Progress: Card 72 code complete on branch (not yet merged to main). Card 71 in progress (re-encrypt approach).**
+> **Testing: local e2e unreliable — rely on CI for e2e coverage. Unit tests still run/pass locally.**
+>
+> ## ⚠️ APPROACH PIVOT (supersedes §3–§5, §10 below)
+> The detailed "Proposed implementation" (decompose the post office into Postgres + **re-wrap** PO boxes for researchers — §4.2, §4.3, Option B) was **built and then reverted**. We pivoted to **re-encrypt at approve** (Phil + NS in the living doc). See **§11** for the chosen design. Sections §3–§5/§10 are kept for rationale/history but are NOT the implementation.
+>
+> **Why pivot:** re-wrap forced encryption-library changes + new schema (`study_job_file_key`, decompose-on-ingest) + a full read-path rewrite. Re-encrypt needs **zero lib changes, no schema** — the DO browser already holds plaintext at review time, so at approve it re-encrypts the approved files for reviewers+researchers using the existing `ResultsWriter`. It also matches the living doc's own Card 74 recovery mechanic ("remove old lock, put new lock" = re-encrypt), so it's the better foundation for the documented future work. The one thing re-wrap/boxes does better — granular **revocation** ("user leaves the lab") — is noted in code at the approve site as a future consideration.
 
 ---
 
@@ -72,15 +79,22 @@ Manifest is **plaintext metadata** (IVs/fingerprints/wrapped keys not secret), a
 
 Postgres = **single source of truth for PO boxes** (DO and researcher). Zip reduced to transient ingest format; read path no longer unzips.
 
-**Proposed schema (per file — zip can hold many files, do NOT model "zip = one row"):**
+**Schema (DECIDED: extend existing `study_job_file`, do NOT add a new `job_file` table).** `study_job_file` already models one-row-per-file with `source_id` linkage; reuse it to avoid duplicating the file concept and migrating references.
 
 ```
-job_file      (id, study_job_id, path, bytes, iv, blob_location)   -- one row per file; IV lives here in Option B
-job_file_key  (job_file_id, fingerprint, crypt)                    -- one row per recipient-per-file = a PO box
-                UNIQUE(job_file_id, fingerprint)
+study_job_file      -- EXISTING (1750186286777). Add nullable: iv text
+                       path = S3 object key of the body (existing invariant across all 12 consumers)
+                       name = logical/inner filename
+                       (NO blob_location — would be redundant with path; dropped after consumer audit)
+study_job_file_key  (id, study_job_file_id → study_job_file.id, fingerprint, crypt, created_at)
+                       UNIQUE(study_job_file_id, fingerprint)   -- one row per recipient-per-file = a PO box
 ```
 
-**Read path (DO and researcher, identical):** fetch encrypted body from S3 + `iv` and row matching _my_ fingerprint from `job_file_key` → decrypt client-side. `SELECT crypt FROM job_file_key WHERE fingerprint = ? AND job_file_id IN (...)` (one box per file).
+**Model inversion:** today 1 `study_job_file` row = 1 zip holding many files (client gets whole blob + `ResultsReader.listFiles()`). Option B: **1 row = 1 decomposed file** (`path`=S3 key of body, `iv` on row, wrapped keys in `study_job_file_key`).
+
+**Coupling:** ingest (writes decomposed rows) and `fetchEncryptedJobFilesAction` + `use-decrypt-files`/`use-encrypted-files-panel` share the row contract. They must change **together** — ingest cannot land alone without breaking the review read path.
+
+**Read path (DO and researcher, identical):** fetch encrypted body from S3 (`path`) + `iv` and row matching _my_ fingerprint from `study_job_file_key` → `decryptFile({encryptedBody, iv, crypt, privateKey})`. `SELECT crypt FROM study_job_file_key WHERE fingerprint = ? AND study_job_file_id IN (...)` (one box per file).
 
 ### ✅ 4.4 Re-wrap at approve, client-side (Card 71)
 
@@ -132,10 +146,29 @@ Drop `storeApprovedJobFile` plaintext write. Researchers read encrypted body + t
 
 ### Card 71 — Option B steps
 
-1. **Ingest** (`src/app/api/job/[jobId]/results/route.ts`, ~line 52, currently calls `storeStudyEncryptedResultsFile` → `results/encrypted-results.zip`): replace store-zip-as-is with decompose → S3 bodies + `job_file`/`job_file_key` rows (including DO boxes), one transaction.
-2. **Decrypt path:** new zip-free primitive + client-hook rewrite (body + iv + crypt-from-PG).
-3. **Approve:** drop plaintext write; DO browser re-wraps approved files' AES keys for lab researchers and POSTs `job_file_key` inserts.
-4. **Researcher view:** reuse DO decrypt path.
+0. ✅ **Migration** (MA): extend `study_job_file` (`iv` text, `bytes` integer — both nullable; NO blob_location, redundant with `path`) + new `study_job_file_key(study_job_file_id, fingerprint, crypt, created_at)` UNIQUE(study_job_file_id, fingerprint). `1780000000000_study_job_file_keys.ts`. Types hand-stubbed in `src/database/types.ts` (CI regenerates — local DB/docker down).
+0b. ✅ **si-encryption primitives** (encryption repo): added zip-free `job-results/crypto.ts` (`unwrapAesKey` exposes raw AES bytes, `wrapAesKey` re-wrap, `decryptFileBody`, `decryptFile`) + `job-results/decompose.ts` (`decomposeResultsZip`). Reader/writer refactored to call primitives (no behavior change). 9/9 tests incl. re-wrap round-trip. **Needs push + MA `package.json` hash bump to consume.** (currently local `link:../encryption` override in `pnpm-workspace.yaml`.)
+1. ✅ **Ingest** (`storage.ts`): `storeDecomposedEncryptedFiles(info, file, fileType, subdir)` — `decomposeResultsZip` → per-file S3 bodies + `study_job_file`(+iv,bytes) + `study_job_file_key`(DO boxes) rows, one txn. **Results AND logs decomposed** (logs share ResultsWriter format; `results/encrypted/` vs `results/encrypted-logs/`). `storeStudyEncryptedResultsFiles` + `storeStudyEncryptedLogFile` both delegate. Route + `encrypt-and-store-log.ts` callers unchanged (same signatures).
+2. ✅ **Lab-pubkey query** `getLabPublicKeysForJob(jobId)` keyed on `study.submittedByOrgId` (queries.ts).
+3. ✅ **Decrypt/read path:** `fetchEncryptedJobFilesAction` → per-file shape `{studyJobFileId, fileType, path, iv, crypt(=my box), encryptedBody}` (resolves session fingerprint via `getReviewerPublicKey`, joins `study_job_file_key`). `getStudyJobInfo`/`latestJobForStudyQuery` selects gained `iv`/`bytes`/`id`. `use-decrypt-files` uses `decryptFile`, drops `ResultsReader`, carries `rawAesKey`+`sourceId` on `JobFileInfo`. `use-encrypted-files-panel` rewritten to per-file/option-(a) model (approved=has researcher box via new `fetchSharedFileIdsAction`/`getSharedFileIdsForJob`; one row per `job.files` entry).
+4. ✅ **Approve re-wrap:** `approveStudyJobFilesAction` now takes `sharedFiles:[{studyJobFileId, boxes:[{fingerprint,crypt}]}]`, inserts `study_job_file_key` (idempotent `onConflict doNothing`), server-validates fingerprints ∈ lab keys, no plaintext write. `job-review-buttons` fetches lab pubkeys (`fetchLabPublicKeysAction`) + `wrapAesKey` client-side per selected file. **Server never receives `rawAesKey`.** Old `fetchApprovedJobFilesAction` removed.
+5. ✅ **Researcher view:** `components/job-results.tsx` (rendered in `study/[studyId]/view/`) now fetches encrypted files + prompts for the researcher's key + decrypts (same `useDecryptFiles` path) instead of reading plaintext APPROVED-* files.
+
+**Source compiles clean (`tsc`).** REMAINING:
+- **Tests** (~15 files): mocks still use the old `EncryptedJobFile` `{blob, metadata}` shape + `fetchApprovedJobFilesAction`; test `job.files` mocks need `id`/`bytes`. New unit tests for ingest decompose, re-wrap approve, shared-file signal, researcher decrypt view.
+- **Tangential cleanup:** `study.actions.ts:320` still writes plaintext via `storeApprovedJobFile` in the *proposal/code approval* path (pre-existing "delete me" TODO). Separate from results encryption; evaluate whether it ever carries result files before removing. `storeApprovedJobFile` now used ONLY there.
+- **Cross-repo:** push encryption changes, bump MA `package.json` hash, remove `link:../encryption` override.
+
+## 10. Approval-signal model change (discovered while rewriting panel) — NEEDS DECISION
+
+Today "approved" is encoded by the existence of an `APPROVED-RESULT` plaintext `study_job_file` row (written by `storeApprovedJobFile`). Option B (§4.5) **deletes that write**, and the new approve only inserts **researcher key boxes**. ⇒ **No `APPROVED-*` rows are created anymore.** Consequences:
+- `fetchApprovedJobFilesAction` (filters `APPROVED-RESULT`) returns empty → dead.
+- Panel `use-encrypted-files-panel` state model (locked / decrypted / **approved** / not-shared) loses its "approved" + "not-shared" signal.
+- There is no plaintext approved copy to view — researcher & post-approval DO both **decrypt the encrypted body** via the same path.
+
+**This forces §6 option (a):** "file has a researcher PO box" = "approved & shared." No new `approved` column. Panel must derive approved/withheld from `study_job_file_key` rows whose fingerprint ∈ lab-org fingerprints (a new query). Per-file selection (already present) drives which files get boxes. **Decision-independent of per-file-vs-all** (boxes are per-file regardless).
+
+Remaining UI plane to build on this model: panel rewrite (iterate per-file `job.files` rows, approved=has-researcher-box), approve action rewrite (insert boxes, no plaintext), approved-file viewing (decrypt, no plaintext copy), lab-pubkey fetch action for client wrap.
 
 ---
 
@@ -154,6 +187,8 @@ Today's behavior **asymmetric**:
 If product chooses **all-or-nothing** approve/reject, existing job-level status suffices, re-wrap covers all files, no per-file state needed.
 
 > **Open product decision (Phil):** support per-file approve/reject, or approve/reject whole artifact set together? Decides whether (a)/(b) needed. Re-wrap must only ever cover **approved** files — rejected outputs must never get researcher PO boxes.
+>
+> **NON-BLOCKING for build.** Per-file is the superset: `approveStudyJobFilesAction` already takes a `jobFiles` subset today, so building for per-file matches current behavior; all-or-nothing falls out as "pass all files". Same re-wrap plumbing either way. Only option (b)'s explicit `approved` column is decision-dependent, and that's a cheap **additive** migration later. Everything upstream of approve (schema core, ingest/DO boxes, si-encryption primitive, lab-pubkey query, decrypt rewrite, researcher view) is fully decision-independent. → Build the spine now; defer only approve input-set semantics.
 
 ---
 
@@ -196,3 +231,35 @@ If product chooses **all-or-nothing** approve/reject, existing job-level status
 - review views: `src/app/[orgSlug]/study/[studyId]/review/...`; researcher view: `.../study/[studyId]/view/...`
 
 **si-encryption** — `job-results/writer.ts` (envelope encryption), `job-results/reader.ts` (decryption — needs zip-free primitive + expose AES key), `job-results/types.ts`, `util/keypair.ts`.
+
+---
+
+## 11. CHOSEN DESIGN — re-encrypt at approve (Card 71)
+
+**Zero encryption-lib changes. No schema changes.** Reuses existing `ResultsWriter`/`ResultsReader`.
+
+**Unchanged:** TOA ingest (stores `encrypted-results.zip` as-is), the DO **review** read path (`fetchEncryptedJobFilesAction` + `use-decrypt-files` + panel decrypt of the original zip with the reviewer key). Card 72 key-gen (researchers already generate keys).
+
+**Changes — the approve write + approved-file viewing become encrypted:**
+
+1. **Approve (client, `job-review-buttons`):** the DO browser already holds the decrypted plaintext from review. For each selected approved file it re-encrypts with the **existing `ResultsWriter([...reviewerKeys, ...researcherKeys])`** → an encrypted zip, and sends those to the server. **Plaintext never leaves the browser** (improvement over today, where approve POSTs plaintext).
+   - Recipients = enclave org keys (reviewers, so DO can still view post-approval) + lab org keys (researchers). New `fetchResultsRecipientKeysAction({jobId})`.
+2. **Approve (server, `approveStudyJobFilesAction`):** stores the re-encrypted zips via `storeApprovedJobFile` (now ciphertext, not plaintext). Sets `FILES-APPROVED` + `reviewerId`. No plaintext write.
+   - **Revocation note (future / Card 74):** re-encrypt cannot cleanly *revoke* a recipient who has left the lab (they may have decrypted already, and the box model is needed for true per-recipient removal). A code comment flags this at the approve site. Out of scope now.
+3. **Approved viewing (`fetchApprovedJobFilesAction` → blob + metadata; researcher `components/job-results.tsx` + DO post-approval):** returns the encrypted approved zips; the client decrypts with the viewer's key via the **same** `use-decrypt-files` path. Researchers decrypt with their key; reviewers with theirs (both are recipients).
+
+**Kept from the reverted build:** `getLabPublicKeysForJob(jobId)` query (lab keys keyed on `study.submittedByOrgId`) — re-added; needed for recipient assembly.
+
+**Per-file / all-or-nothing (§6):** unaffected — re-encrypt only the selected files. Approval signal stays "APPROVED-* row exists" (unchanged from today), just encrypted content.
+
+### Status (verified)
+
+- **Both** results-approve paths re-encrypt now (plaintext fully removed): `approveStudyJobFilesAction` (JobReviewButtons) **and** `approveStudyProposalAction`→`approveJobCode` (StudyReviewButtons / redesign). Shared client helper `src/lib/re-encrypt-results.ts`.
+- `tsc` 0 errors, eslint clean.
+- Unit tests **run in the `mgmnt-app` docker container** (host can't reach pg; port not published). Green: `encrypted-files-panel`, `study-job.actions`, `study-results`, `study-review-buttons`, `study.actions`, `study-results-redesign`. Run one-file-at-a-time with `NODE_OPTIONS=--max-old-space-size=4096` — running several suites together OOMs the container (exit 137).
+- Behavioral test change: approved files now require decryption to view, so panel/study-results tests assert approved **rows by name** (decrypt covered by the dedicated decrypt tests) rather than plaintext download links.
+- Revocation limitation (Card 74) noted in code at `approveStudyJobFilesAction` + `approveJobCode`.
+
+- **Round-trip test added:** `src/server/actions/results-reencryption.test.ts` — real crypto, no mocks. Enclave reviewer (test PEM key) + lab researcher (distinct generated key) on a cross-org study; calls the real `reEncryptApprovedFiles` and asserts both the researcher's own key AND the reviewer's key decrypt the re-encrypted output back to plaintext. (Gotcha: pass `researcherId` to `insertTestStudyJobData` so it doesn't seed a fake-key enclave user that breaks `ResultsWriter`.)
+
+Cross-repo: nothing — encryption lib untouched.
diff --git a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx
index 1713c08c3..bbdf03897 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx
@@ -8,6 +8,7 @@ import { Routes } from '@/lib/routes'
 import { JobFileInfo, MinimalJobInfo } from '@/lib/types'
 import { approveStudyJobFilesAction, rejectStudyJobFilesAction } from '@/server/actions/study-job.actions'
 import type { LatestJobForStudy } from '@/server/db/queries'
+import { reEncryptApprovedFiles } from '@/lib/re-encrypt-results'
 import { Button, Group, Text, useMantineTheme } from '@mantine/core'
 import { CheckCircleIcon, XCircleIcon } from '@phosphor-icons/react/dist/ssr'
 import dayjs from 'dayjs'
@@ -42,7 +43,10 @@ export const JobReviewButtons = ({
             }
 
             if (status === 'FILES-APPROVED') {
-                await approveStudyJobFilesAction({ orgSlug, jobInfo, jobFiles: decryptedResults })
+                // Re-encrypt approved files for reviewers + researchers client-side; only
+                // ciphertext is sent to the server.
+                const jobFiles = await reEncryptApprovedFiles(job.studyId, decryptedResults)
+                await approveStudyJobFilesAction({ orgSlug, jobInfo, jobFiles })
             }
 
             if (status === 'FILES-REJECTED') {
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
index 8d135b3b0..9512a62e1 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
@@ -14,13 +14,15 @@ import { latestJobForStudy } from '@/server/db/queries'
 import { ResultsWriter } from 'si-encryption/job-results/writer'
 import { fingerprintKeyData, pemToArrayBuffer } from 'si-encryption/util'
 import { type FileType, type StudyJobStatus, type StudyStatus } from '@/database/types'
-import { type JobFile } from '@/lib/types'
 
-const mockedApprovedJobFiles: JobFile[] = [
+// Approved files are now re-encrypted (same shape as encrypted files); content is
+// viewed by decrypting, so the mock carries metadata, not plaintext contents.
+const mockedApprovedJobFiles = [
     {
-        contents: new TextEncoder().encode('title\nhello world').buffer as ArrayBuffer,
-        path: 'approved.csv',
+        blob: new Blob(),
+        sourceId: 'approved-1',
         fileType: 'APPROVED-RESULT' as FileType,
+        metadata: [{ path: 'approved.csv', bytes: 17 }],
     },
 ]
 
@@ -76,11 +78,12 @@ describe('View Study Results', () => {
         const job = await latestJobForStudy(study.id)
         renderWithProviders(<StudyResults job={job} />)
 
+        // Approved files render once per file in the unified table (not duplicated). Content
+        // is encrypted now — the row lists by name; downloading requires decryption.
         await waitFor(() => {
-            expect(screen.getByTestId('download-link')).toBeDefined()
+            expect(screen.getByText('approved.csv')).toBeDefined()
         })
-        // approved files render once per file in the unified table — not duplicated by the legacy JobResults section
-        expect(screen.getAllByTestId('download-link')).toHaveLength(1)
+        expect(screen.getAllByText('approved.csv')).toHaveLength(1)
     })
 
     it('does not duplicate rows when multiple APPROVED-RESULT files share a fileType', async () => {
@@ -110,14 +113,16 @@ describe('View Study Results', () => {
 
         vi.mocked(fetchApprovedJobFilesAction).mockResolvedValue([
             {
-                contents: new TextEncoder().encode('a').buffer as ArrayBuffer,
-                path: 'results.csv',
+                blob: new Blob(),
+                sourceId: 'approved-1',
                 fileType: 'APPROVED-RESULT' as FileType,
+                metadata: [{ path: 'results.csv', bytes: 1 }],
             },
             {
-                contents: new TextEncoder().encode('b').buffer as ArrayBuffer,
-                path: 'results2.csv',
+                blob: new Blob(),
+                sourceId: 'approved-2',
                 fileType: 'APPROVED-RESULT' as FileType,
+                metadata: [{ path: 'results2.csv', bytes: 1 }],
             },
         ])
 
@@ -125,10 +130,9 @@ describe('View Study Results', () => {
         renderWithProviders(<StudyResults job={job} />)
 
         await waitFor(() => {
-            expect(screen.getAllByTestId('download-link')).toHaveLength(2)
+            expect(screen.getAllByText('results.csv')).toHaveLength(1)
+            expect(screen.getAllByText('results2.csv')).toHaveLength(1)
         })
-        expect(screen.getAllByText('results.csv')).toHaveLength(1)
-        expect(screen.getAllByText('results2.csv')).toHaveLength(1)
     })
 
     it('renders the form to unlock results', async () => {
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
index 3792e0069..487592106 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
@@ -9,6 +9,7 @@ import {
     rejectStudyProposalAction,
     type SelectedStudy,
 } from '@/server/actions/study.actions'
+import { reEncryptApprovedFiles } from '@/lib/re-encrypt-results'
 import { Button, Group, Stack } from '@mantine/core'
 import { useRouter } from 'next/navigation'
 import { FC, useState } from 'react'
@@ -32,13 +33,18 @@ export const StudyReviewButtons: FC<{ study: SelectedStudy; approvedFiles?: JobF
         isSuccess,
         variables: pendingStatus,
     } = useMutation({
-        mutationFn: (status: StudyStatus) => {
+        mutationFn: async (status: StudyStatus) => {
             if (status === 'APPROVED') {
+                // Re-encrypt approved result files for reviewers + researchers client-side;
+                // the server stores only ciphertext (no plaintext approved copies).
+                const jobFiles = approvedFiles?.length
+                    ? await reEncryptApprovedFiles(study.id, approvedFiles)
+                    : undefined
                 return approveStudyProposalAction({
                     orgSlug,
                     studyId: study.id,
                     useTestImage,
-                    jobFiles: approvedFiles,
+                    jobFiles,
                 })
             }
             return rejectStudyProposalAction({ orgSlug, studyId: study.id })
diff --git a/src/components/encrypted-files-panel.test.tsx b/src/components/encrypted-files-panel.test.tsx
index d8f76cae8..f9be587ac 100644
--- a/src/components/encrypted-files-panel.test.tsx
+++ b/src/components/encrypted-files-panel.test.tsx
@@ -436,20 +436,22 @@ describe('EncryptedFilesPanel', () => {
         ])
 
         vi.mocked(fetchApprovedJobFilesAction).mockResolvedValue([
-            { contents: new ArrayBuffer(10), path: 'first.csv', fileType: 'APPROVED-RESULT' },
+            {
+                blob: new Blob(),
+                sourceId: 'approved-1',
+                fileType: 'APPROVED-RESULT',
+                metadata: [{ path: 'first.csv', bytes: 1024 }],
+            },
         ])
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
 
+        // Shared (green) and withheld (red X) states render from metadata without decrypting.
         await waitFor(() => {
             expect(screen.getByText('first.csv')).toBeDefined()
             expect(screen.getByLabelText('second.csv not shared with researcher')).toBeDefined()
         })
-
-        // Withheld file has no View/Download — only the shared file does
-        expect(screen.getAllByRole('button', { name: 'View' })).toHaveLength(1)
-        expect(screen.getAllByTestId('download-link')).toHaveLength(1)
     })
 
     it('shows a red "not shared" X (not a lock icon) for an entire log type withheld after approval', async () => {
@@ -492,7 +494,12 @@ describe('EncryptedFilesPanel', () => {
         ])
 
         vi.mocked(fetchApprovedJobFilesAction).mockResolvedValue([
-            { contents: new ArrayBuffer(10), path: 'first.csv', fileType: 'APPROVED-RESULT' },
+            {
+                blob: new Blob(),
+                sourceId: 'approved-1',
+                fileType: 'APPROVED-RESULT',
+                metadata: [{ path: 'first.csv', bytes: 1024 }],
+            },
         ])
 
         const latestJob = await latestJobForStudy(study.id)
diff --git a/src/components/job-results.tsx b/src/components/job-results.tsx
index 18e3e8bbd..000f253d5 100644
--- a/src/components/job-results.tsx
+++ b/src/components/job-results.tsx
@@ -1,14 +1,15 @@
 'use client'
 
-import React, { FC, useMemo } from 'react'
-import { Anchor, Group, LoadingOverlay, Stack, Text, useMantineTheme } from '@mantine/core'
+import React, { FC, useMemo, useState } from 'react'
+import { Anchor, Button, Group, LoadingOverlay, Stack, Text, Textarea, useMantineTheme } from '@mantine/core'
 import { ArrowSquareOutIcon } from '@phosphor-icons/react/dist/ssr'
 import { useQuery } from '@/common'
 import { ErrorAlert } from '@/components/errors'
 import { DownloadBlobLink } from '@/components/download-blob-link'
 import { isApprovedLogType, logLabel } from '@/lib/file-type-helpers'
+import { useDecryptFiles, type EncryptedJobFile } from '@/hooks/use-decrypt-files'
 import { fetchApprovedJobFilesAction } from '@/server/actions/study-job.actions'
-import { JobFile } from '@/lib/types'
+import { JobFile, JobFileInfo } from '@/lib/types'
 import { LatestJobForStudy } from '@/server/db/queries'
 
 const ViewResultsLink: FC<{ content: ArrayBuffer }> = ({ content }) => {
@@ -30,44 +31,79 @@ const ViewResultsLink: FC<{ content: ArrayBuffer }> = ({ content }) => {
     )
 }
 
+// Researcher-facing view of shared results. There is no plaintext copy: the
+// researcher decrypts the re-encrypted approved files with their own key (they
+// are a recipient of the re-encryption done at approve time).
 export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
+    const [decryptedFiles, setDecryptedFiles] = useState<JobFileInfo[]>()
+
     const {
         data: approvedFiles,
         isLoading,
         isError,
         error,
     } = useQuery({
-        queryKey: ['job-results', job.id],
+        queryKey: ['approved-files', job.id],
         queryFn: async () => await fetchApprovedJobFilesAction({ studyJobId: job.id }),
     })
 
+    const {
+        decrypt,
+        isPending: isDecrypting,
+        form,
+    } = useDecryptFiles({
+        encryptedFiles: approvedFiles as EncryptedJobFile[] | undefined,
+        onSuccess: setDecryptedFiles,
+    })
+
     const { resultsFiles, logFiles } = useMemo(() => {
-        const res: JobFile[] = []
-        const logs: JobFile[] = []
+        const res: JobFileInfo[] = []
+        const logs: JobFileInfo[] = []
 
-        approvedFiles?.forEach((f) => {
+        decryptedFiles?.forEach((f) => {
             if (f.fileType === 'APPROVED-RESULT') res.push(f)
             else if (isApprovedLogType(f.fileType)) logs.push(f)
         })
 
         return { resultsFiles: res, logFiles: logs }
-    }, [approvedFiles])
+    }, [decryptedFiles])
 
     if (isError) {
         return <ErrorAlert error={error} />
     }
 
-    if (isLoading || !approvedFiles) {
+    if (isLoading) {
         return <LoadingOverlay />
     }
 
+    if (!decryptedFiles) {
+        return (
+            <form onSubmit={form.onSubmit((values) => decrypt(values.privateKey))}>
+                <Stack>
+                    <Textarea
+                        label={<Text mb="sm">Enter your key to view results</Text>}
+                        resize="vertical"
+                        placeholder="Enter your key to access encrypted results."
+                        {...form.getInputProps('privateKey')}
+                        key={form.key('privateKey')}
+                    />
+                    <Group>
+                        <Button type="submit" disabled={!form.isValid()} loading={isDecrypting}>
+                            View Results
+                        </Button>
+                    </Group>
+                </Stack>
+            </form>
+        )
+    }
+
     return (
         <Stack>
-            {resultsFiles.map((approvedFile) => (
-                <ViewFile file={approvedFile} key={approvedFile.path} />
+            {resultsFiles.map((file) => (
+                <ViewFile file={file} key={file.path} />
             ))}
-            {logFiles.map((approvedFile) => (
-                <ViewFile file={approvedFile} key={approvedFile.path} />
+            {logFiles.map((file) => (
+                <ViewFile file={file} key={file.path} />
             ))}
         </Stack>
     )
diff --git a/src/hooks/use-decrypt-files.ts b/src/hooks/use-decrypt-files.ts
index b13beaa54..a1274f359 100644
--- a/src/hooks/use-decrypt-files.ts
+++ b/src/hooks/use-decrypt-files.ts
@@ -1,5 +1,5 @@
 import { reportMutationError } from '@/components/errors'
-import { approvedTypeForFile } from '@/lib/file-type-helpers'
+import { ENCRYPTED_TO_APPROVED } from '@/lib/file-type-helpers'
 import type { JobFileInfo } from '@/lib/types'
 import { isNotEmpty, useForm } from '@mantine/form'
 import { useMutation } from '@/common'
@@ -37,7 +37,9 @@ async function decryptFiles(encryptedFiles: EncryptedJobFile[], privateKey: stri
                 decryptedFiles.push({
                     ...extractedFile,
                     sourceId: encryptedBlob.sourceId,
-                    fileType: approvedTypeForFile(encryptedBlob.fileType),
+                    // Map an encrypted type to its approved form; an already-approved input
+                    // (researcher viewing shared results) keeps its type.
+                    fileType: ENCRYPTED_TO_APPROVED[encryptedBlob.fileType] ?? encryptedBlob.fileType,
                 })
             }
         }
diff --git a/src/hooks/use-encrypted-files-panel.ts b/src/hooks/use-encrypted-files-panel.ts
index e4765edee..8fa85c9fb 100644
--- a/src/hooks/use-encrypted-files-panel.ts
+++ b/src/hooks/use-encrypted-files-panel.ts
@@ -40,10 +40,6 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
     const [selectedPaths, setSelectedPaths] = useState<Set<string>>(new Set())
     const [viewingFile, setViewingFile] = useState<JobFile | null>(null)
 
-    const encryptedFileTypes = (job.files ?? [])
-        .filter((f) => isEncryptedLogType(f.fileType) || f.fileType === 'ENCRYPTED-RESULT')
-        .map((f) => f.fileType)
-
     const approvedFileTypes = useMemo(() => new Set((job.files ?? []).map((f) => f.fileType)), [job.files])
 
     const hasPreviouslyApprovedFiles = (job.files ?? []).some(
@@ -53,18 +49,14 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
     // Once a job is approved, files the DO withheld are surfaced as "not shared" (red X) rather than hidden.
     const isJobApproved = (job.statusChanges ?? []).some((sc) => sc.status === 'FILES-APPROVED')
 
+    // Approved files are now re-encrypted (same shape as encrypted files). We use them
+    // to know *which* files were shared; their plaintext for display comes from decrypting.
     const { data: previouslyApprovedFiles = [] } = useQuery({
         queryKey: ['approved-files', job.id],
         queryFn: () => fetchApprovedJobFilesAction({ studyJobId: job.id }),
         enabled: hasPreviouslyApprovedFiles,
     })
 
-    const hasUndecryptedFiles = encryptedFileTypes.some((ft) => !approvedFileTypes.has(ENCRYPTED_TO_APPROVED[ft]))
-
-    const undecryptedFileTypes = encryptedFileTypes.filter((ft) => !approvedFileTypes.has(ENCRYPTED_TO_APPROVED[ft]))
-    const uniqueLabels = [...new Set(undecryptedFileTypes.map((ft) => logLabel(ft).toLowerCase()))]
-    const encryptedFileTypesLabel = toSentence(uniqueLabels)
-
     const { isLoading: isLoadingBlob, data: encryptedFiles } = useQuery({
         queryKey: ['encrypted-files', job.id],
         queryFn: async () => {
@@ -104,8 +96,18 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
         })
     }
 
+    const encryptedFileTypes = (job.files ?? [])
+        .filter((f) => isEncryptedLogType(f.fileType) || f.fileType === 'ENCRYPTED-RESULT')
+        .map((f) => f.fileType)
+
+    const hasUndecryptedFiles = encryptedFileTypes.some((ft) => !approvedFileTypes.has(ENCRYPTED_TO_APPROVED[ft]))
     const shouldShowForm = hasUndecryptedFiles && decryptedFiles.length === 0
 
+    const undecryptedFileTypes = encryptedFileTypes.filter((ft) => !approvedFileTypes.has(ENCRYPTED_TO_APPROVED[ft]))
+    const encryptedFileTypesLabel = toSentence([
+        ...new Set(undecryptedFileTypes.map((ft) => logLabel(ft).toLowerCase())),
+    ])
+
     const handleSubmit = form.onSubmit(
         (values) => decrypt(values.privateKey),
         (errors) => {
@@ -125,12 +127,13 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
         return map
     }, [decryptedFiles])
 
-    const approvedFilesByType = useMemo(() => {
-        const map = new Map<FileType, JobFile[]>()
-        for (const f of previouslyApprovedFiles) {
-            const list = map.get(f.fileType) ?? []
-            list.push(f)
-            map.set(f.fileType, list)
+    // Names + sizes of the files that were shared (approved), per approved fileType.
+    const approvedMetaByType = useMemo(() => {
+        const map = new Map<FileType, FileInfo[]>()
+        for (const file of previouslyApprovedFiles) {
+            const list = map.get(file.fileType) ?? []
+            list.push(...file.metadata)
+            map.set(file.fileType, list)
         }
         return map
     }, [previouslyApprovedFiles])
@@ -164,30 +167,30 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
             seenApprovedTypes.add(approvedType)
 
             const encryptedType = isEncrypted ? f.fileType : encryptedTypeForApproved(f.fileType)
-            const approvedFilesForType = approvedFilesByType.get(approvedType) ?? []
+            const approvedMeta = approvedMetaByType.get(approvedType) ?? []
             const decryptedFilesForType = decryptedFilesByType.get(approvedType) ?? []
             const metaList = metadataByFileType.get(encryptedType) ?? []
             const label = logLabel(f.fileType)
 
-            // Approved (shared) files always render, independent of whether the encrypted-file
-            // metadata has loaded — the green rows must never blink out while metaList is in flight.
-            if (approvedFilesForType.length > 0) {
-                const approvedPaths = new Set(approvedFilesForType.map((af) => af.path))
-                for (const approvedFile of approvedFilesForType) {
+            // Approved (shared) files. Their plaintext for view/download comes from the
+            // decrypted originals (matched by name) once the DO has entered their key.
+            if (approvedMeta.length > 0) {
+                const approvedNames = new Set(approvedMeta.map((m) => m.path))
+                for (const meta of approvedMeta) {
+                    const decrypted = decryptedFilesForType.find((d) => d.path === meta.path) ?? null
                     rows.push({
-                        key: `${f.fileType}-approved-${approvedFile.path}`,
+                        key: `${f.fileType}-approved-${meta.path}`,
                         label,
-                        name: approvedFile.path,
-                        bytes: approvedFile.contents.byteLength,
+                        name: meta.path,
+                        bytes: meta.bytes,
                         fileType: f.fileType,
                         state: 'approved',
-                        file: approvedFile,
+                        file: decrypted,
                     })
                 }
                 // Withheld files are surfaced only once metadata is available to enumerate them.
-                // Without it we can't tell what was withheld, so we show nothing rather than guess.
                 for (const meta of metaList) {
-                    if (approvedPaths.has(meta.path)) continue
+                    if (approvedNames.has(meta.path)) continue
                     rows.push({
                         key: `${f.fileType}-not-shared-${meta.path}`,
                         label,
@@ -213,8 +216,7 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
                 }
             } else if (metaList.length > 0) {
                 // A type with metadata but no approved files. If the job is approved and no APPROVED-*
-                // rows exist for it, the whole type was withheld → red X. Otherwise (still encrypted, or
-                // approved files merely not fetched yet) keep the lock icon.
+                // rows exist for it, the whole type was withheld → red X. Otherwise keep the lock icon.
                 const withheld = isJobApproved && !approvedFileTypes.has(approvedType)
                 for (const meta of metaList) {
                     rows.push({
@@ -241,7 +243,7 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
         }
 
         return rows
-    }, [job.files, isJobApproved, approvedFileTypes, approvedFilesByType, decryptedFilesByType, metadataByFileType])
+    }, [job.files, isJobApproved, approvedFileTypes, approvedMetaByType, decryptedFilesByType, metadataByFileType])
 
     const hasFileRows = fileRows.length > 0
 
diff --git a/src/lib/re-encrypt-results.ts b/src/lib/re-encrypt-results.ts
new file mode 100644
index 000000000..d3c4c74dc
--- /dev/null
+++ b/src/lib/re-encrypt-results.ts
@@ -0,0 +1,29 @@
+import { ResultsWriter } from 'si-encryption/job-results/writer'
+import { actionResult } from '@/lib/utils'
+import { fetchResultsRecipientKeysAction } from '@/server/actions/study-job.actions'
+import type { JobFileInfo, jobFileSchema } from '@/lib/types'
+import type { z } from 'zod'
+
+type ReEncryptedJobFile = z.infer<typeof jobFileSchema>
+
+// Re-encrypt approved (already-decrypted) files for the study's reviewers + researchers,
+// entirely client-side. The DO browser holds the plaintext from review; it wraps each
+// file for every recipient via ResultsWriter so the server only ever stores ciphertext.
+// Returned entries are jobFileSchema-shaped (contents = the re-encrypted zip bytes).
+export async function reEncryptApprovedFiles(studyId: string, files: JobFileInfo[]): Promise<ReEncryptedJobFile[]> {
+    const recipients = actionResult(await fetchResultsRecipientKeysAction({ studyId }))
+
+    return Promise.all(
+        files.map(async (file) => {
+            const writer = new ResultsWriter(recipients)
+            await writer.addFile(file.path, file.contents)
+            const zip = await writer.generate()
+            return {
+                path: file.path,
+                contents: await zip.arrayBuffer(),
+                sourceId: file.sourceId,
+                fileType: file.fileType,
+            }
+        }),
+    )
+}
diff --git a/src/server/actions/results-reencryption.test.ts b/src/server/actions/results-reencryption.test.ts
new file mode 100644
index 000000000..41e9de9bd
--- /dev/null
+++ b/src/server/actions/results-reencryption.test.ts
@@ -0,0 +1,66 @@
+import { describe, expect, test } from 'vitest'
+import {
+    db,
+    insertTestOrg,
+    insertTestStudyJobData,
+    insertTestUser,
+    mockSessionWithTestData,
+    readTestSupportFile,
+} from '@/tests/unit.helpers'
+import { reEncryptApprovedFiles } from '@/lib/re-encrypt-results'
+import { ResultsReader } from 'si-encryption/job-results/reader'
+import { fingerprintKeyData, generateKeyPair, pemToArrayBuffer } from 'si-encryption/util'
+
+// End-to-end re-encryption at approve: a reviewer's browser re-encrypts an approved
+// file for the enclave (reviewers) AND the submitting lab (researchers); the result
+// must decrypt with the researcher's own — distinct — private key, and still with the
+// reviewer's. Uses real crypto (no storage/reader mocks).
+describe('approve re-encryption round trip', () => {
+    test('re-encrypts an approved file so the researcher can decrypt it with their own key', async () => {
+        // Enclave reviewer seeded with the real test keypair (public_key.pem / private_key.pem).
+        const { org: enclave } = await mockSessionWithTestData({ orgType: 'enclave', useRealKeys: true })
+
+        // Submitting lab + a researcher holding a *different* keypair.
+        const lab = await insertTestOrg({ slug: 'lab-org', type: 'lab' })
+        const { user: researcher } = await insertTestUser({ org: { id: lab.id, slug: lab.slug, type: 'lab' } })
+        const researcherKeys = await generateKeyPair()
+        await db
+            .insertInto('userPublicKey')
+            .values({
+                userId: researcher.id,
+                publicKey: Buffer.from(researcherKeys.exportedPublicKey),
+                fingerprint: researcherKeys.fingerprint,
+            })
+            .executeTakeFirstOrThrow()
+
+        // Study reviewed by the enclave, submitted by the lab. Passing researcherId avoids
+        // seeding an extra (fake-key) enclave user, which would break ResultsWriter.
+        const { study } = await insertTestStudyJobData({ org: enclave, researcherId: researcher.id })
+        await db.updateTable('study').set({ submittedByOrgId: lab.id }).where('id', '=', study.id).execute()
+
+        // Mirror exactly what the approve buttons do client-side.
+        const plaintext = 'col1,col2\nsensitive,value'
+        const [jobFile] = await reEncryptApprovedFiles(study.id, [
+            {
+                path: 'results.csv',
+                contents: new TextEncoder().encode(plaintext).buffer as ArrayBuffer,
+                sourceId: 'source-1',
+                fileType: 'APPROVED-RESULT',
+            },
+        ])
+
+        const decryptWith = async (privateKey: ArrayBuffer, fingerprint: string) => {
+            const reader = new ResultsReader(new Blob([jobFile.contents]), privateKey, fingerprint)
+            const [file] = await reader.extractFiles()
+            return new TextDecoder().decode(new Uint8Array(file.contents))
+        }
+
+        // Researcher decrypts with their own key — the core Card 71 guarantee.
+        expect(await decryptWith(researcherKeys.exportedPrivateKey, researcherKeys.fingerprint)).toBe(plaintext)
+
+        // Reviewer retains access with the enclave (test) key.
+        const reviewerPrivateKey = pemToArrayBuffer(await readTestSupportFile('private_key.pem'))
+        const reviewerFingerprint = await fingerprintKeyData(pemToArrayBuffer(await readTestSupportFile('public_key.pem')))
+        expect(await decryptWith(reviewerPrivateKey, reviewerFingerprint)).toBe(plaintext)
+    })
+})
diff --git a/src/server/actions/study-job.actions.test.ts b/src/server/actions/study-job.actions.test.ts
index 02ebf6631..3a29501b6 100644
--- a/src/server/actions/study-job.actions.test.ts
+++ b/src/server/actions/study-job.actions.test.ts
@@ -58,7 +58,8 @@ describe('Study Job Actions', () => {
         const result = actionResult(await fetchApprovedJobFilesAction({ studyJobId: job.id }))
 
         expect(result).toHaveLength(1)
-        expect(result[0].path).toBe('test.csv')
+        expect(result[0].fileType).toBe('APPROVED-CODE-RUN-LOG')
+        expect(result[0].metadata).toEqual([{ path: 'test.csv', bytes: 0 }])
     })
 
     test('fetchEncryptedJobFilesAction', async () => {
diff --git a/src/server/actions/study-job.actions.ts b/src/server/actions/study-job.actions.ts
index 4e831e561..0ed878394 100644
--- a/src/server/actions/study-job.actions.ts
+++ b/src/server/actions/study-job.actions.ts
@@ -2,8 +2,13 @@
 
 import { ActionFailure } from '@/lib/errors'
 import { isApprovedLogType, isEncryptedLogType } from '@/lib/file-type-helpers'
-import { JobFile, jobFileSchema, minimalJobInfoSchema } from '@/lib/types'
-import { getStudyJobInfo, getStudyReviewForJob, latestJobForStudy } from '@/server/db/queries'
+import { jobFileSchema, minimalJobInfoSchema } from '@/lib/types'
+import {
+    getResultsRecipientPublicKeys,
+    getStudyJobInfo,
+    getStudyReviewForJob,
+    latestJobForStudy,
+} from '@/server/db/queries'
 import { onStudyResultsApproved, onStudyResultsRejected } from '@/server/events'
 import { fetchFileContents, storeApprovedJobFile } from '@/server/storage'
 import { ResultsReader } from 'si-encryption/job-results/reader'
@@ -27,6 +32,15 @@ export const approveStudyJobFilesAction = new Action('approveStudyJobFilesAction
     })
     .requireAbilityTo('approve', 'Study')
     .handler(async ({ params: { jobInfo: info, jobFiles }, session, db }) => {
+        // jobFiles.contents are now RE-ENCRYPTED zips (the reviewer's browser re-encrypted
+        // each approved file for reviewers + researchers using ResultsWriter). The server
+        // only persists ciphertext — plaintext never reaches it.
+        //
+        // NOTE (future / Card 74 — revocation): re-encryption cannot cleanly *revoke* a
+        // recipient who later leaves the lab; they were baked into this artifact's boxes and
+        // may already have decrypted. True per-recipient revocation would need the re-wrap /
+        // per-recipient PO-box model (a key box you can delete) instead of re-encryption.
+        // Out of scope for now; revisit if revocation becomes a hard requirement.
         for (const jobFile of jobFiles) {
             const file = new File([jobFile.contents], jobFile.path)
             await storeApprovedJobFile(info, file, jobFile.fileType, jobFile.sourceId)
@@ -50,6 +64,19 @@ export const approveStudyJobFilesAction = new Action('approveStudyJobFilesAction
         onStudyResultsApproved({ studyId: info.studyId, userId: session.user.id })
     })
 
+// Recipients for re-encrypting approved results: enclave reviewers (so the DO can
+// still view post-approval) + lab researchers (the new audience).
+export const fetchResultsRecipientKeysAction = new Action('fetchResultsRecipientKeysAction')
+    .params(z.object({ studyId: z.string() }))
+    .middleware(async ({ params: { studyId }, db }) => {
+        const study = await db.selectFrom('study').select('orgId').where('id', '=', studyId).executeTakeFirstOrThrow()
+        return { orgId: study.orgId }
+    })
+    .requireAbilityTo('approve', 'Study')
+    .handler(async ({ params: { studyId } }) => {
+        return await getResultsRecipientPublicKeys(studyId)
+    })
+
 export const rejectStudyJobFilesAction = new Action('rejectStudyJobFilesAction', { performsMutations: true })
     .params(
         minimalJobInfoSchema.extend({
@@ -123,22 +150,27 @@ export const fetchApprovedJobFilesAction = new Action('fetchApprovedJobFilesActi
     .requireAbilityTo('view', 'StudyJob')
 
     .handler(async ({ studyJob }) => {
+        // Approved files are now re-encrypted zips (not plaintext). Return them in the
+        // same shape as encrypted files so the client decrypts them with the viewer's
+        // key (reviewer or researcher — both are recipients).
         const approvedJobFiles = studyJob.files.filter(
             (jobFile) => isApprovedLogType(jobFile.fileType) || jobFile.fileType === 'APPROVED-RESULT',
         )
 
-        const jobFiles: JobFile[] = []
+        const encryptedJobFiles = []
         for (const jobFile of approvedJobFiles) {
             const blob = await fetchFileContents(jobFile.path)
-            const contents = await blob.arrayBuffer()
-            jobFiles.push({
-                contents,
-                path: jobFile.name,
+            const reader = new ResultsReader(blob, new ArrayBuffer(0), '')
+            const metadata = await reader.listFiles()
+            encryptedJobFiles.push({
                 fileType: jobFile.fileType,
+                sourceId: jobFile.id,
+                blob,
+                metadata,
             })
         }
 
-        return jobFiles
+        return encryptedJobFiles
     })
 
 export const fetchStudyJobCodeFileAction = new Action('fetchStudyJobCodeFileAction')
diff --git a/src/server/actions/study.actions.ts b/src/server/actions/study.actions.ts
index 733a51506..e97f5a6d5 100644
--- a/src/server/actions/study.actions.ts
+++ b/src/server/actions/study.actions.ts
@@ -315,8 +315,9 @@ async function approveJobCode({
     if (jobFiles?.length) {
         const info = { studyId, studyJobId: job.id, orgSlug }
         for (const jobFile of jobFiles) {
+            // jobFile.contents is a RE-ENCRYPTED zip (wrapped client-side for reviewers +
+            // researchers) — we persist ciphertext only, never plaintext.
             const file = new File([jobFile.contents], jobFile.path)
-            // TODO Delete me in new approach, no longer storing approved job file
             await storeApprovedJobFile(info, file, jobFile.fileType, jobFile.sourceId)
         }
     }
diff --git a/src/server/db/queries.ts b/src/server/db/queries.ts
index d00846686..c6db58a40 100644
--- a/src/server/db/queries.ts
+++ b/src/server/db/queries.ts
@@ -455,6 +455,32 @@ export async function getOrgPublicKeys(orgId: string): Promise<PublicKey[]> {
     })
 }
 
+/**
+ * Recipients for re-encrypting a study's approved results: the enclave org that
+ * runs/reviews it (`study.orgId`, so reviewers keep access) plus the lab org that
+ * submitted it (`study.submittedByOrgId`, the researchers). Deduped by fingerprint
+ * since one person may belong to both orgs with a single key. si-encryption
+ * (ArrayBuffer) format; empty if the study/users have no keys.
+ */
+export async function getResultsRecipientPublicKeys(studyId: string): Promise<PublicKey[]> {
+    const study = await Action.db
+        .selectFrom('study')
+        .where('id', '=', studyId)
+        .select(['orgId', 'submittedByOrgId'])
+        .executeTakeFirst()
+
+    if (!study) return []
+
+    const [reviewerKeys, researcherKeys] = await Promise.all([
+        getOrgPublicKeys(study.orgId),
+        getOrgPublicKeys(study.submittedByOrgId),
+    ])
+
+    const byFingerprint = new Map<string, PublicKey>()
+    for (const key of [...reviewerKeys, ...researcherKeys]) byFingerprint.set(key.fingerprint, key)
+    return [...byFingerprint.values()]
+}
+
 export type StudyReviewWithMeta = {
     report: AnalysisReport
     createdAt: Date
diff --git a/src/server/storage.ts b/src/server/storage.ts
index a57dae5e1..6110d1437 100644
--- a/src/server/storage.ts
+++ b/src/server/storage.ts
@@ -48,7 +48,8 @@ export async function storeStudyEncryptedResultsFile(info: MinimalJobInfo, file:
     return await storeJobFile(info, `${pathForStudyJob(info)}/results/encrypted-results.zip`, file, 'ENCRYPTED-RESULT')
 }
 
-// TODO No longer exists in future iteration
+// Stores an approved results file. Its contents are now a re-encrypted zip (wrapped
+// for reviewers + researchers client-side) — ciphertext, never plaintext.
 export async function storeApprovedJobFile(info: MinimalJobInfo, file: File, fileType: FileType, sourceId: string) {
     return await storeJobFile(info, `${pathForStudyJob(info)}/results/approved/${file.name}`, file, fileType, sourceId)
 }

From 1df75c0e8c060fd17b704d8d3e05bff706ae42b0 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Thu, 4 Jun 2026 15:32:36 -0400
Subject: [PATCH 08/45] Lint

---
 results-encryption-design-notes.md              | 15 +++++++++------
 src/server/actions/results-reencryption.test.ts |  4 +++-
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/results-encryption-design-notes.md b/results-encryption-design-notes.md
index e1978b21d..1df81d231 100644
--- a/results-encryption-design-notes.md
+++ b/results-encryption-design-notes.md
@@ -8,6 +8,7 @@
 > **Testing: local e2e unreliable — rely on CI for e2e coverage. Unit tests still run/pass locally.**
 >
 > ## ⚠️ APPROACH PIVOT (supersedes §3–§5, §10 below)
+>
 > The detailed "Proposed implementation" (decompose the post office into Postgres + **re-wrap** PO boxes for researchers — §4.2, §4.3, Option B) was **built and then reverted**. We pivoted to **re-encrypt at approve** (Phil + NS in the living doc). See **§11** for the chosen design. Sections §3–§5/§10 are kept for rationale/history but are NOT the implementation.
 >
 > **Why pivot:** re-wrap forced encryption-library changes + new schema (`study_job_file_key`, decompose-on-ingest) + a full read-path rewrite. Re-encrypt needs **zero lib changes, no schema** — the DO browser already holds plaintext at review time, so at approve it re-encrypts the approved files for reviewers+researchers using the existing `ResultsWriter`. It also matches the living doc's own Card 74 recovery mechanic ("remove old lock, put new lock" = re-encrypt), so it's the better foundation for the documented future work. The one thing re-wrap/boxes does better — granular **revocation** ("user leaves the lab") — is noted in code at the approve site as a future consideration.
@@ -147,21 +148,23 @@ Drop `storeApprovedJobFile` plaintext write. Researchers read encrypted body + t
 ### Card 71 — Option B steps
 
 0. ✅ **Migration** (MA): extend `study_job_file` (`iv` text, `bytes` integer — both nullable; NO blob_location, redundant with `path`) + new `study_job_file_key(study_job_file_id, fingerprint, crypt, created_at)` UNIQUE(study_job_file_id, fingerprint). `1780000000000_study_job_file_keys.ts`. Types hand-stubbed in `src/database/types.ts` (CI regenerates — local DB/docker down).
-0b. ✅ **si-encryption primitives** (encryption repo): added zip-free `job-results/crypto.ts` (`unwrapAesKey` exposes raw AES bytes, `wrapAesKey` re-wrap, `decryptFileBody`, `decryptFile`) + `job-results/decompose.ts` (`decomposeResultsZip`). Reader/writer refactored to call primitives (no behavior change). 9/9 tests incl. re-wrap round-trip. **Needs push + MA `package.json` hash bump to consume.** (currently local `link:../encryption` override in `pnpm-workspace.yaml`.)
+   0b. ✅ **si-encryption primitives** (encryption repo): added zip-free `job-results/crypto.ts` (`unwrapAesKey` exposes raw AES bytes, `wrapAesKey` re-wrap, `decryptFileBody`, `decryptFile`) + `job-results/decompose.ts` (`decomposeResultsZip`). Reader/writer refactored to call primitives (no behavior change). 9/9 tests incl. re-wrap round-trip. **Needs push + MA `package.json` hash bump to consume.** (currently local `link:../encryption` override in `pnpm-workspace.yaml`.)
 1. ✅ **Ingest** (`storage.ts`): `storeDecomposedEncryptedFiles(info, file, fileType, subdir)` — `decomposeResultsZip` → per-file S3 bodies + `study_job_file`(+iv,bytes) + `study_job_file_key`(DO boxes) rows, one txn. **Results AND logs decomposed** (logs share ResultsWriter format; `results/encrypted/` vs `results/encrypted-logs/`). `storeStudyEncryptedResultsFiles` + `storeStudyEncryptedLogFile` both delegate. Route + `encrypt-and-store-log.ts` callers unchanged (same signatures).
 2. ✅ **Lab-pubkey query** `getLabPublicKeysForJob(jobId)` keyed on `study.submittedByOrgId` (queries.ts).
 3. ✅ **Decrypt/read path:** `fetchEncryptedJobFilesAction` → per-file shape `{studyJobFileId, fileType, path, iv, crypt(=my box), encryptedBody}` (resolves session fingerprint via `getReviewerPublicKey`, joins `study_job_file_key`). `getStudyJobInfo`/`latestJobForStudyQuery` selects gained `iv`/`bytes`/`id`. `use-decrypt-files` uses `decryptFile`, drops `ResultsReader`, carries `rawAesKey`+`sourceId` on `JobFileInfo`. `use-encrypted-files-panel` rewritten to per-file/option-(a) model (approved=has researcher box via new `fetchSharedFileIdsAction`/`getSharedFileIdsForJob`; one row per `job.files` entry).
 4. ✅ **Approve re-wrap:** `approveStudyJobFilesAction` now takes `sharedFiles:[{studyJobFileId, boxes:[{fingerprint,crypt}]}]`, inserts `study_job_file_key` (idempotent `onConflict doNothing`), server-validates fingerprints ∈ lab keys, no plaintext write. `job-review-buttons` fetches lab pubkeys (`fetchLabPublicKeysAction`) + `wrapAesKey` client-side per selected file. **Server never receives `rawAesKey`.** Old `fetchApprovedJobFilesAction` removed.
-5. ✅ **Researcher view:** `components/job-results.tsx` (rendered in `study/[studyId]/view/`) now fetches encrypted files + prompts for the researcher's key + decrypts (same `useDecryptFiles` path) instead of reading plaintext APPROVED-* files.
+5. ✅ **Researcher view:** `components/job-results.tsx` (rendered in `study/[studyId]/view/`) now fetches encrypted files + prompts for the researcher's key + decrypts (same `useDecryptFiles` path) instead of reading plaintext APPROVED-\* files.
 
 **Source compiles clean (`tsc`).** REMAINING:
+
 - **Tests** (~15 files): mocks still use the old `EncryptedJobFile` `{blob, metadata}` shape + `fetchApprovedJobFilesAction`; test `job.files` mocks need `id`/`bytes`. New unit tests for ingest decompose, re-wrap approve, shared-file signal, researcher decrypt view.
-- **Tangential cleanup:** `study.actions.ts:320` still writes plaintext via `storeApprovedJobFile` in the *proposal/code approval* path (pre-existing "delete me" TODO). Separate from results encryption; evaluate whether it ever carries result files before removing. `storeApprovedJobFile` now used ONLY there.
+- **Tangential cleanup:** `study.actions.ts:320` still writes plaintext via `storeApprovedJobFile` in the _proposal/code approval_ path (pre-existing "delete me" TODO). Separate from results encryption; evaluate whether it ever carries result files before removing. `storeApprovedJobFile` now used ONLY there.
 - **Cross-repo:** push encryption changes, bump MA `package.json` hash, remove `link:../encryption` override.
 
 ## 10. Approval-signal model change (discovered while rewriting panel) — NEEDS DECISION
 
 Today "approved" is encoded by the existence of an `APPROVED-RESULT` plaintext `study_job_file` row (written by `storeApprovedJobFile`). Option B (§4.5) **deletes that write**, and the new approve only inserts **researcher key boxes**. ⇒ **No `APPROVED-*` rows are created anymore.** Consequences:
+
 - `fetchApprovedJobFilesAction` (filters `APPROVED-RESULT`) returns empty → dead.
 - Panel `use-encrypted-files-panel` state model (locked / decrypted / **approved** / not-shared) loses its "approved" + "not-shared" signal.
 - There is no plaintext approved copy to view — researcher & post-approval DO both **decrypt the encrypted body** via the same path.
@@ -243,14 +246,14 @@ If product chooses **all-or-nothing** approve/reject, existing job-level status
 **Changes — the approve write + approved-file viewing become encrypted:**
 
 1. **Approve (client, `job-review-buttons`):** the DO browser already holds the decrypted plaintext from review. For each selected approved file it re-encrypts with the **existing `ResultsWriter([...reviewerKeys, ...researcherKeys])`** → an encrypted zip, and sends those to the server. **Plaintext never leaves the browser** (improvement over today, where approve POSTs plaintext).
-   - Recipients = enclave org keys (reviewers, so DO can still view post-approval) + lab org keys (researchers). New `fetchResultsRecipientKeysAction({jobId})`.
+    - Recipients = enclave org keys (reviewers, so DO can still view post-approval) + lab org keys (researchers). New `fetchResultsRecipientKeysAction({jobId})`.
 2. **Approve (server, `approveStudyJobFilesAction`):** stores the re-encrypted zips via `storeApprovedJobFile` (now ciphertext, not plaintext). Sets `FILES-APPROVED` + `reviewerId`. No plaintext write.
-   - **Revocation note (future / Card 74):** re-encrypt cannot cleanly *revoke* a recipient who has left the lab (they may have decrypted already, and the box model is needed for true per-recipient removal). A code comment flags this at the approve site. Out of scope now.
+    - **Revocation note (future / Card 74):** re-encrypt cannot cleanly _revoke_ a recipient who has left the lab (they may have decrypted already, and the box model is needed for true per-recipient removal). A code comment flags this at the approve site. Out of scope now.
 3. **Approved viewing (`fetchApprovedJobFilesAction` → blob + metadata; researcher `components/job-results.tsx` + DO post-approval):** returns the encrypted approved zips; the client decrypts with the viewer's key via the **same** `use-decrypt-files` path. Researchers decrypt with their key; reviewers with theirs (both are recipients).
 
 **Kept from the reverted build:** `getLabPublicKeysForJob(jobId)` query (lab keys keyed on `study.submittedByOrgId`) — re-added; needed for recipient assembly.
 
-**Per-file / all-or-nothing (§6):** unaffected — re-encrypt only the selected files. Approval signal stays "APPROVED-* row exists" (unchanged from today), just encrypted content.
+**Per-file / all-or-nothing (§6):** unaffected — re-encrypt only the selected files. Approval signal stays "APPROVED-\* row exists" (unchanged from today), just encrypted content.
 
 ### Status (verified)
 
diff --git a/src/server/actions/results-reencryption.test.ts b/src/server/actions/results-reencryption.test.ts
index 41e9de9bd..aa966aaf3 100644
--- a/src/server/actions/results-reencryption.test.ts
+++ b/src/server/actions/results-reencryption.test.ts
@@ -60,7 +60,9 @@ describe('approve re-encryption round trip', () => {
 
         // Reviewer retains access with the enclave (test) key.
         const reviewerPrivateKey = pemToArrayBuffer(await readTestSupportFile('private_key.pem'))
-        const reviewerFingerprint = await fingerprintKeyData(pemToArrayBuffer(await readTestSupportFile('public_key.pem')))
+        const reviewerFingerprint = await fingerprintKeyData(
+            pemToArrayBuffer(await readTestSupportFile('public_key.pem')),
+        )
         expect(await decryptWith(reviewerPrivateKey, reviewerFingerprint)).toBe(plaintext)
     })
 })

From a15d60a523f804c7a30f20ebc6d48efa9ae21aee Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Mon, 8 Jun 2026 10:35:23 -0400
Subject: [PATCH 09/45] Local dev working again

---
 .npmrc                                        |    1 +
 bin/docker-dev-init                           |    5 +-
 package.json                                  |    2 +-
 pnpm-lock.yaml                                | 3307 +++++++----------
 results-encryption-design-notes.md            |   49 +-
 .../review/job-review-buttons.test.tsx        |   58 +-
 .../[studyId]/review/job-review-buttons.tsx   |   10 +-
 .../review/study-results-redesign.test.tsx    |   49 +-
 .../[studyId]/review/study-results.test.tsx   |  177 +-
 .../[studyId]/review/study-review-buttons.tsx |   12 +-
 src/app/api/job/[jobId]/results/route.test.ts |   54 +-
 src/components/encrypted-files-panel.test.tsx |  548 +--
 src/components/job-results.tsx                |   11 +-
 .../study/submitted-code-table.test.tsx       |    4 +
 .../1780000000000_study_job_file_keys.ts      |   36 +
 src/database/types.ts                         |   13 +
 src/hooks/use-decrypt-files.ts                |   52 +-
 src/hooks/use-encrypted-files-panel.ts        |  215 +-
 src/lib/re-encrypt-results.ts                 |   29 -
 src/lib/re-wrap-results.ts                    |   33 +
 src/lib/types.ts                              |   15 +-
 .../actions/results-reencryption.test.ts      |   68 -
 src/server/actions/study-job.actions.test.ts  |   70 +-
 src/server/actions/study-job.actions.ts       |  143 +-
 src/server/actions/study.actions.ts           |   32 +-
 src/server/db/queries.ts                      |   58 +-
 src/server/results-sharing.ts                 |   53 +
 src/server/storage.ts                         |   67 +-
 28 files changed, 2255 insertions(+), 2916 deletions(-)
 create mode 100644 src/database/migrations/1780000000000_study_job_file_keys.ts
 delete mode 100644 src/lib/re-encrypt-results.ts
 create mode 100644 src/lib/re-wrap-results.ts
 delete mode 100644 src/server/actions/results-reencryption.test.ts
 create mode 100644 src/server/results-sharing.ts

diff --git a/.npmrc b/.npmrc
index 43c97e719..94005ac25 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1 +1,2 @@
 package-lock=false
+confirm-modules-purge=false
\ No newline at end of file
diff --git a/bin/docker-dev-init b/bin/docker-dev-init
index 2c526bcce..0f6e9804c 100755
--- a/bin/docker-dev-init
+++ b/bin/docker-dev-init
@@ -5,7 +5,10 @@
 
 set -e
 
-pnpm install --frozen-lockfile
+# CI=true lets pnpm auto-purge a stale node_modules volume (e.g. after a lockfile change)
+# without a TTY prompt — the container is non-interactive, so the prompt would otherwise
+# abort the install and crash-loop. Scoped to install so it doesn't affect `pnpm run dev`.
+CI=true pnpm install --frozen-lockfile
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
 
diff --git a/package.json b/package.json
index 120a6c5b5..139225abc 100644
--- a/package.json
+++ b/package.json
@@ -109,7 +109,7 @@
         "react-phone-number-input": "^3.4.16",
         "remeda": "^2.33.6",
         "server-only": "^0.0.1",
-        "si-encryption": "github:safeinsights/encryption#2e35d3bb56f02bfc0e6d5cd9d83c54637ed0ac20",
+        "si-encryption": "github:safeinsights/encryption#2c495dae94942895a34e64d91f83809750867f4e",
         "uuid": "^14.0.0",
         "validator": "^13.15.26",
         "yjs": "^13.6.30",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c6e8e31cc..ad43627b9 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -25,58 +25,58 @@ importers:
         version: 0.95.2(zod@4.4.3)
       '@aws-sdk/client-codebuild':
         specifier: ^3.893.0
-        version: 3.1049.0
+        version: 3.1063.0
       '@aws-sdk/client-ecr':
         specifier: ^3.893.0
-        version: 3.1049.0
+        version: 3.1063.0
       '@aws-sdk/client-glue':
         specifier: ^3.893.0
-        version: 3.1049.0
+        version: 3.1063.0
       '@aws-sdk/client-s3':
         specifier: ^3.893.0
-        version: 3.1049.0
+        version: 3.1063.0
       '@aws-sdk/client-secrets-manager':
         specifier: ^3.893.0
-        version: 3.1049.0
+        version: 3.1063.0
       '@aws-sdk/client-sts':
         specifier: ^3.893.0
-        version: 3.1049.0
+        version: 3.1063.0
       '@aws-sdk/credential-providers':
         specifier: ^3.893.0
-        version: 3.1049.0
+        version: 3.1063.0
       '@aws-sdk/lib-storage':
         specifier: ^3.893.0
-        version: 3.1049.0(@aws-sdk/client-s3@3.1049.0)
+        version: 3.1063.0(@aws-sdk/client-s3@3.1063.0)
       '@aws-sdk/rds-signer':
         specifier: ^3.893.0
-        version: 3.1049.0
+        version: 3.1063.0
       '@aws-sdk/s3-presigned-post':
         specifier: ^3.893.0
-        version: 3.1049.0
+        version: 3.1063.0
       '@aws-sdk/s3-request-presigner':
         specifier: ^3.893.0
-        version: 3.1049.0
+        version: 3.1063.0
       '@casl/ability':
         specifier: ^6.8.0
         version: 6.8.1
       '@clerk/backend':
         specifier: ^2.33.4
-        version: 2.33.4(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+        version: 2.33.5(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       '@clerk/nextjs':
         specifier: ^6.39.4
-        version: 6.39.4(next@16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+        version: 6.39.5(next@16.2.7(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       '@clerk/types':
         specifier: ^4.101.24
-        version: 4.101.24(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+        version: 4.101.25(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       '@faker-js/faker':
         specifier: ^10.3.0
         version: 10.4.0
       '@hocuspocus/provider':
         specifier: ^3.4.4
-        version: 3.4.4(y-protocols@1.0.7(yjs@13.6.30))(yjs@13.6.30)
+        version: 3.4.4(y-protocols@1.0.7(yjs@13.6.31))(yjs@13.6.31)
       '@hocuspocus/server':
         specifier: ^3.4.4
-        version: 3.4.4(y-protocols@1.0.7(yjs@13.6.30))(yjs@13.6.30)
+        version: 3.4.4(y-protocols@1.0.7(yjs@13.6.31))(yjs@13.6.31)
       '@lexical/headless':
         specifier: ^0.41.0
         version: 0.41.0
@@ -88,13 +88,13 @@ importers:
         version: 0.41.0
       '@lexical/react':
         specifier: ^0.41.0
-        version: 0.41.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(yjs@13.6.30)
+        version: 0.41.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(yjs@13.6.31)
       '@lexical/utils':
         specifier: ^0.41.0
         version: 0.41.0
       '@lexical/yjs':
         specifier: ^0.41.0
-        version: 0.41.0(yjs@13.6.30)
+        version: 0.41.0(yjs@13.6.31)
       '@mantine/core':
         specifier: ^8.3
         version: 8.3.18(@mantine/hooks@8.3.18(react@19.2.4))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
@@ -118,13 +118,13 @@ importers:
         version: 2.1.10(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       '@sentry/nextjs':
         specifier: ^10.41.0
-        version: 10.53.1(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(next@16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)(webpack@5.106.2(esbuild@0.27.7)(postcss@8.5.15))
+        version: 10.56.0(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(next@16.2.7(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)(webpack@5.107.2(esbuild@0.27.7)(postcss@8.5.15))
       '@swc/helpers':
         specifier: 0.5.15
         version: 0.5.15
       '@tanstack/react-query':
         specifier: ^5.90.21
-        version: 5.100.11(react@19.2.4)
+        version: 5.101.0(react@19.2.4)
       '@types/jsonwebtoken':
         specifier: ^9.0.10
         version: 9.0.10
@@ -133,7 +133,7 @@ importers:
         version: 5.5.2
       '@types/pg':
         specifier: ^8.15.6
-        version: 8.15.6
+        version: 8.20.0
       aws-iam-policy-types:
         specifier: ^1.0.2
         version: 1.0.2
@@ -148,13 +148,13 @@ importers:
         version: 14.0.3
       dayjs:
         specifier: ^1.11.19
-        version: 1.11.20
+        version: 1.11.21
       debug:
         specifier: ^4.4.3
         version: 4.4.3
       eventsource-parser:
         specifier: ^3.0.6
-        version: 3.0.8
+        version: 3.1.0
       highlight.js:
         specifier: ^11.11.1
         version: 11.11.1
@@ -175,7 +175,7 @@ importers:
         version: 0.41.0
       libphonenumber-js:
         specifier: ^1.12.38
-        version: 1.13.2
+        version: 1.13.6
       mailgun.js:
         specifier: ^12.7.0
         version: 12.9.0(debug@4.4.3)
@@ -187,10 +187,10 @@ importers:
         version: 1.3.0(@mantine/form@8.3.18(react@19.2.4))(zod@4.4.3)
       next:
         specifier: ^16.2.0
-        version: 16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+        version: 16.2.7(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       next-swagger-doc:
         specifier: ^0.4.1
-        version: 0.4.1(next@16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(openapi-types@12.1.3)
+        version: 0.4.1(next@16.2.7(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(openapi-types@12.1.3)
       papaparse:
         specifier: ^5.5.3
         version: 5.5.3
@@ -211,16 +211,16 @@ importers:
         version: 5.6.0(react@19.2.4)
       react-phone-number-input:
         specifier: ^3.4.16
-        version: 3.4.16(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+        version: 3.4.17(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       remeda:
         specifier: ^2.33.6
-        version: 2.34.1
+        version: 2.37.0
       server-only:
         specifier: ^0.0.1
         version: 0.0.1
       si-encryption:
-        specifier: github:safeinsights/encryption#2e35d3bb56f02bfc0e6d5cd9d83c54637ed0ac20
-        version: https://codeload.github.com/safeinsights/encryption/tar.gz/2e35d3bb56f02bfc0e6d5cd9d83c54637ed0ac20
+        specifier: github:safeinsights/encryption#2c495dae94942895a34e64d91f83809750867f4e
+        version: https://codeload.github.com/safeinsights/encryption/tar.gz/2c495dae94942895a34e64d91f83809750867f4e
       uuid:
         specifier: ^14.0.0
         version: 14.0.0
@@ -229,17 +229,17 @@ importers:
         version: 13.15.35
       yjs:
         specifier: ^13.6.30
-        version: 13.6.30
+        version: 13.6.31
       zod:
         specifier: ^4.3.6
         version: 4.4.3
       zustand:
         specifier: ^5.0.11
-        version: 5.0.13(@types/react@19.2.14)(react@19.2.4)(use-sync-external-store@1.6.0(react@19.2.4))
+        version: 5.0.14(@types/react@19.2.14)(react@19.2.4)(use-sync-external-store@1.6.0(react@19.2.4))
     devDependencies:
       '@clerk/testing':
         specifier: ^1.14.7
-        version: 1.14.7(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+        version: 1.14.8(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       '@eslint/js':
         specifier: ^9.39.2
         version: 9.39.4
@@ -251,7 +251,7 @@ importers:
         version: 22.0.1
       '@pandacss/dev':
         specifier: ^1.8.2
-        version: 1.11.1(typescript@5.9.3)
+        version: 1.11.3(typescript@5.9.3)
       '@playwright/test':
         specifier: ^1.58
         version: 1.60.0
@@ -278,7 +278,7 @@ importers:
         version: 19.2.14
       '@vitejs/plugin-react':
         specifier: ^5.1.4
-        version: 5.2.0(vite@8.0.13(@types/node@25.9.1)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0))
+        version: 5.2.0(vite@8.0.16(@types/node@25.9.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0))
       aws-sdk-client-mock:
         specifier: ^4.1.0
         version: 4.1.0
@@ -299,13 +299,13 @@ importers:
         version: 10.1.8(eslint@9.39.4(jiti@2.7.0))
       eslint-import-resolver-typescript:
         specifier: ^4.4.4
-        version: 4.4.4(eslint-plugin-import@2.32.0)(eslint@9.39.4(jiti@2.7.0))
+        version: 4.4.5(eslint-plugin-import@2.32.0)(eslint@9.39.4(jiti@2.7.0))
       eslint-plugin-anti-trojan-source:
         specifier: ^1.1.4
         version: 1.1.6
       eslint-plugin-import:
         specifier: ^2.32.0
-        version: 2.32.0(@typescript-eslint/parser@8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.4)(eslint@9.39.4(jiti@2.7.0))
+        version: 2.32.0(@typescript-eslint/parser@8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.5)(eslint@9.39.4(jiti@2.7.0))
       eslint-plugin-react:
         specifier: ^7.37.5
         version: 7.37.5(eslint@9.39.4(jiti@2.7.0))
@@ -317,7 +317,7 @@ importers:
         version: 17.6.0
       happy-dom:
         specifier: '*'
-        version: 20.9.0
+        version: 20.10.1
       husky:
         specifier: ^9.1.7
         version: 9.1.7
@@ -332,13 +332,13 @@ importers:
         version: 1.2.8
       monocart-coverage-reports:
         specifier: ^2.12.11
-        version: 2.12.11
+        version: 2.12.12
       monocart-reporter:
         specifier: ^2.10.0
         version: 2.11.2
       next-router-mock:
         specifier: ^1.0.5
-        version: 1.0.5(next@16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)
+        version: 1.0.5(next@16.2.7(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)
       pg-transactional-tests:
         specifier: ^1.2.0
         version: 1.2.0(pg@8.21.0)
@@ -356,31 +356,31 @@ importers:
         version: 5.9.3
       typescript-eslint:
         specifier: ^8.56.1
-        version: 8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
+        version: 8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
       vite:
         specifier: '>=8.0.0'
-        version: 8.0.13(@types/node@25.9.1)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0)
+        version: 8.0.16(@types/node@25.9.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0)
       vitest:
         specifier: '>=4.1.6'
-        version: 4.1.6(@opentelemetry/api@1.9.1)(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.6)(@vitest/coverage-v8@4.1.6)(happy-dom@20.9.0)(vite@8.0.13(@types/node@25.9.1)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0))
+        version: 4.1.8(@opentelemetry/api@1.9.1)(@types/node@25.9.2)(@vitest/coverage-istanbul@4.1.8)(@vitest/coverage-v8@4.1.8)(happy-dom@20.10.1)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0))
       vitest-monocart-coverage:
         specifier: ^4.0.1
-        version: 4.0.2(vitest@4.1.6)
+        version: 4.0.2(vitest@4.1.8)
 
   services/editor:
     dependencies:
       '@aws-sdk/client-secrets-manager':
         specifier: ^3.893.0
-        version: 3.1049.0
+        version: 3.1063.0
       '@clerk/backend':
         specifier: ^2.33.4
-        version: 2.33.4(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+        version: 2.33.5(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       '@hocuspocus/extension-database':
         specifier: ^3.4.4
-        version: 3.4.4(y-protocols@1.0.7(yjs@13.6.30))(yjs@13.6.30)
+        version: 3.4.4(y-protocols@1.0.7(yjs@13.6.31))(yjs@13.6.31)
       '@hocuspocus/server':
         specifier: ^3.4.4
-        version: 3.4.4(y-protocols@1.0.7(yjs@13.6.30))(yjs@13.6.30)
+        version: 3.4.4(y-protocols@1.0.7(yjs@13.6.31))(yjs@13.6.31)
       '@lexical/headless':
         specifier: ^0.41.0
         version: 0.41.0
@@ -392,7 +392,7 @@ importers:
         version: 0.41.0
       '@lexical/yjs':
         specifier: ^0.41.0
-        version: 0.41.0(yjs@13.6.30)
+        version: 0.41.0(yjs@13.6.31)
       lexical:
         specifier: ^0.41.0
         version: 0.41.0
@@ -401,12 +401,12 @@ importers:
         version: 8.21.0
       yjs:
         specifier: ^13.6.8
-        version: 13.6.30
+        version: 13.6.31
 
 packages:
 
-  '@adobe/css-tools@4.4.4':
-    resolution: {integrity: sha512-Elp+iwUx5rN5+Y8xLt5/GRoG20WGoDCQ/1Fb+1LiGtvwbDavuSk0jhD/eZdckHAuzcDzccnkv+rEjyWfRx18gg==}
+  '@adobe/css-tools@4.5.0':
+    resolution: {integrity: sha512-6OzddxPio9UiWTCemp4N8cYLV2ZN1ncRnV1cVGtve7dhPOtRkleRyx32GQCYSwDYgaHU3USMm84tNsvKzRCa1Q==}
 
   '@anthropic-ai/sdk@0.95.2':
     resolution: {integrity: sha512-Egddwo3sheo1PzUrMkZnH6VkQYwS0h/b/i8vSK8Ta9M45UQipAMeDFH57dYuDAfXMEUUGeKw6CMlremgMZgrSQ==}
@@ -455,237 +455,221 @@ packages:
   '@aws-crypto/util@5.2.0':
     resolution: {integrity: sha512-4RkU9EsI6ZpBve5fseQlGNUWKMa1RLPQ1dnjnQoe07ldfIzcsGb5hC5W0Dm7u423KWzawlrpbjXBrXCEv9zazQ==}
 
-  '@aws-sdk/client-codebuild@3.1049.0':
-    resolution: {integrity: sha512-Yxb7nHy6eECZzbj2awgDdgSlwbb3bk3LACnnDRtg5Pdgi4bO3puQPNyBUsqGMCf3sahS0sSRRK0SAj8XhH8VoQ==}
+  '@aws-sdk/checksums@3.1000.2':
+    resolution: {integrity: sha512-PIha+kauTbp6IRmOpYktPTrlfrrSqDVixvhO/EUOFOf62DPX81CaJoHJreuA1m9HYpSKyXf99BKjU1dvJPeUfw==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/client-cognito-identity@3.1049.0':
-    resolution: {integrity: sha512-gfgKqA8If1CVtHgDma2yIpBDbYiB8jshbGe+nagfjBmlOmrBAycpgXxPGg3VONtm+UfgzbkSYbbR9xKW8rRCQg==}
+  '@aws-sdk/client-codebuild@3.1063.0':
+    resolution: {integrity: sha512-IXmvK/EMWh76Xz950mQbgtHoT9+O1rUMFfRMYZ12jrDstnYRircYuYxEx0ZATcimNh3zacqE7oTxC/CEQEKRpQ==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/client-ecr@3.1049.0':
-    resolution: {integrity: sha512-DkLyg4kXthvZOLT84gdXVBwQQ4qc749TG05r1boTMmlgF/ns+7JjgFpJ1CNXIgxP4Q/72N//H3vIUhTVNBi8NA==}
+  '@aws-sdk/client-cognito-identity@3.1063.0':
+    resolution: {integrity: sha512-fLwNblkowkRyuxdVehlHVOnr/7bBf8Y1UGYdhhpuMPHOQL2QTY6kLcQ+EV1BhTQG1p4ATwaONNJsIk44hxEGMA==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/client-glue@3.1049.0':
-    resolution: {integrity: sha512-I6gSGWv8U8j0dFTJbx2wmuExF43s+CTVq5j87Ypt4tkow8PqmU/A99yWmpqjJF45g5nhwYA3VLpDorIa1eOuDQ==}
+  '@aws-sdk/client-ecr@3.1063.0':
+    resolution: {integrity: sha512-ylSTvy+NXbU6qv4yjM4XkXJ8WvG3/g8ksEnzik6SlcnGB5zhn3+CKLA3LgkusKQ6S86/WaX4tTtCp+HPNCRxnA==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/client-s3@3.1049.0':
-    resolution: {integrity: sha512-e5ToFwYeHSfkKDPs/G0yhO7vxvfVOF6DhmlvI2xFi4m12NvjxPhaA2Y35QMaYLrw/oGPXmu9McfKnBm/oXYXbg==}
+  '@aws-sdk/client-glue@3.1063.0':
+    resolution: {integrity: sha512-yG95M3nWp3KUuNK6rZeEEovYGrCppoG1KftR3TMGEhWOjzQQMONMvQsfomVwZtOil/wmSQsEdl7z3GmsBmDiQg==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/client-secrets-manager@3.1049.0':
-    resolution: {integrity: sha512-SHj5WzvYis2OBhbGY83WyFluUMl4DU6ZuJPrlAECfvr2lkRI4uiLd7a3MSmdZ5FlINcURLrPqhyHdzvZHCy3qw==}
+  '@aws-sdk/client-s3@3.1063.0':
+    resolution: {integrity: sha512-ETn+vvmZVK1MmOZwVBXmWANpmD5iTbzojIqyEIoZ86qo+8oWy35S8QyQNE/ZDI+WHgMU1dS+VSYbpRl1QkEySg==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/client-sts@3.1049.0':
-    resolution: {integrity: sha512-Dq8WJk3oPNQvK7gOYDFnOl6jXh2TiwggATqzs3bbboOu5hleZ50Nt9Zm38jA0zWnWm2nJ5p/qdKJzXeGecHRvA==}
+  '@aws-sdk/client-secrets-manager@3.1063.0':
+    resolution: {integrity: sha512-oP3/vHpo93rb/0JWhNcLA7fVbV1I6fBV9DrprScf71t3EVzwMyqLnVuv+5q2/3o32sCZ58YouZmqL0CqczyQzA==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/core@3.974.12':
-    resolution: {integrity: sha512-qrqgioqYFjwR6LatVNS1L2Vk++EwRIxqSQXPKNv5Ofux2D8UNgqMQ1znnMyEImXquVPTtbf71fc128pvmU6y9A==}
+  '@aws-sdk/client-sts@3.1063.0':
+    resolution: {integrity: sha512-5SZhiVKuufk/dUcfNr6hZymQSTSnh12paXRLq+YS8OmsozpChNG0wHaKH/hXA/mdGwLxgdudqHAHxygbCiwzqQ==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/crc64-nvme@3.972.8':
-    resolution: {integrity: sha512-fVfUCL/Xh2zINYMPZvj+iBn6XWouQf0DAnjaWCI9MkmqXzL2Iy5FoQB8O7syFe6gN6AH1ecDDU58T51Ou0kFkA==}
+  '@aws-sdk/core@3.974.18':
+    resolution: {integrity: sha512-JDYCPI0j7zGrzXTDFsLB346cxss7J/AxH7+O0MzWlqppJBEyB9Qe6TQXRL6iwLUo/xZkNv9KFmBL2hqElmwW0g==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-cognito-identity@3.972.35':
-    resolution: {integrity: sha512-mMQsBJv40oi5QdqRj4Xbc9jTlWMxqWfs5zWu+RhbOuF5F0AxxWXT70hm0abOmLbF2M/Tkuygs01H4eWIQMfoMw==}
+  '@aws-sdk/credential-provider-cognito-identity@3.972.42':
+    resolution: {integrity: sha512-94W7f8xVsdLEjv3TY8R+beoFL0pIRduiGZdqMfIVMvQfn6q9IA3SgE2mIQluu3VCULn8PopB/gx7Fns8ETn/1Q==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-env@3.972.38':
-    resolution: {integrity: sha512-m3WjZEgPtioMhPmwqUt+DhlTJ2i9ufR6DhfkyXojb9puEvfR+ur2U5shavu5/Cc9WHHsDCvALi6UFHgcqjhQ5w==}
+  '@aws-sdk/credential-provider-env@3.972.44':
+    resolution: {integrity: sha512-3hKJVrZ7bqXzDAXCQp+OaQ1ASN+vWstaNuEH418wQVl//cRZhqhfR9Bjk1qIWmgUGe8/D3gdO73PgidRj378EQ==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-http@3.972.40':
-    resolution: {integrity: sha512-D78L/m2Dr6cJnnSvWoAudPhQmCwmJ7j6APXsPYmFpPaKfQTfCSu0rdm8j14Np+VmXF9z8Aj8HE3xFpsrwtfgeg==}
+  '@aws-sdk/credential-provider-http@3.972.46':
+    resolution: {integrity: sha512-VhwC9pGAZHhiQ2xSViyOPDFqvr9aRxGCAXZtADsUhU3R65nad7y//CwynE6mQnWNR+suRlqE79W36IVayL+m1g==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-ini@3.972.42':
-    resolution: {integrity: sha512-Mu5ESvFXeinafVM8jTIvRqcvK2Ehj4kz3auT39yUcHwu1Vfxo6xRlmUafdKLW4tusjAJukQwK09sCSMgOm7OKg==}
+  '@aws-sdk/credential-provider-ini@3.972.50':
+    resolution: {integrity: sha512-09Xi6ovxiK42+De/qBGF71sT5F2bWgYM+1fFyDwSOpy1xpsQ5R/naIu7MVDpH6Dic36QNc8dAv4KADtMGK2JYg==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-login@3.972.42':
-    resolution: {integrity: sha512-O6WkZga3kf0yqyJYd1dbeJqVhEgJx/x1UaLgtbR+XuL/YP+K5y6QTxQKL7ka9z3jnQASESKGAPnRyt4D5hQrxA==}
+  '@aws-sdk/credential-provider-login@3.972.49':
+    resolution: {integrity: sha512-EfJF/1Fh9mI4pZyoheU2RY9xUhTcugIZNkD63+orXMkYj/QXacJNbKVDUK90Yv5hE+aX+rt9J/EZ9Qr3vKOa7g==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-node@3.972.43':
-    resolution: {integrity: sha512-D/DJmbrWRP5BXEO3FH+ar4el+2n6OlGofiud7dQun2jES+AQEJjczenp1jBb4MBN7CpGpS8nsWGQLtuzc9tQbA==}
+  '@aws-sdk/credential-provider-node@3.972.52':
+    resolution: {integrity: sha512-7QX+PbyiWBEOVipJq8Nke/TqXT6lAPLE7fvTaopa39/IVWuLfS+Fzdy71sZJONf/mLGgmtj6aU17+REw3+aRrw==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-process@3.972.38':
-    resolution: {integrity: sha512-EnbYVajGgbkb24s0K1eo4VNAPV5mHIET7LSvirTaFCwkfrfaOJxtSE+wY/tJdKDS21cEYkZs2ruCaAm+W4iblg==}
+  '@aws-sdk/credential-provider-process@3.972.44':
+    resolution: {integrity: sha512-V+UUhZpRP7QDRhi+qgBDisM9tUBnYmMje8Bk77A6MZsfeGeGdMsQXmaHP1CDYFcept0o/Rz5g2Y0TMeVlG9dzg==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-sso@3.972.42':
-    resolution: {integrity: sha512-RVV/9NbFwI8ZHEH5dn39lGyFmSbSVj1+orZdr6QsOe1mW9DCglmlen0cFaNZmCcqkqc7erNRHNBduxbeZuHAnw==}
+  '@aws-sdk/credential-provider-sso@3.972.49':
+    resolution: {integrity: sha512-9QqOYGuh5tZ76OzaT68kwI78AH+5lS/uZGGvkfxb3fc8FzRrIz2jOufNTliEBEeSAwmgK2rWLNsK+IB3zbtNPA==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-web-identity@3.972.42':
-    resolution: {integrity: sha512-/67fXX0ddllD4u2Nujc5PvT4byHgpMUfz6+RxIKi/0nFIckeorm7JvXgzBuDyVKw0s58EbofmETDWUf9vTEuHQ==}
+  '@aws-sdk/credential-provider-web-identity@3.972.49':
+    resolution: {integrity: sha512-IYx1lN38MnnPXv+NBLpuATu0cZakbZ321TAfjW+aVkw7HIJF38YnEwdeEO55MSl3pl7hIX1IvvnD6EmnAzmAJw==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-providers@3.1049.0':
-    resolution: {integrity: sha512-2B0ljqENrXKHlPg50kCV12RA35jcAfgZLLB38NW9qv5gUtOHFS8/wW7AkbyVAFYQySl/+2a3x1MAjY2d+Ed71g==}
+  '@aws-sdk/credential-providers@3.1063.0':
+    resolution: {integrity: sha512-ApW861WX8h7wKDKRNj7Dyne7awtq/PHrJVSdr3NsE/rmuFUxSha6BFJJ1H0S1MD7hCqZjYqz2VPPmCXo3IKC9A==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/lib-storage@3.1049.0':
-    resolution: {integrity: sha512-lOfzDq9+knTOpkgtpO32R1rtN5kBbPqJ8WHDcqd+1PpXrA4J8kbnHgBJFA3iv6jhmoCL6bG56OISLQmnskFY2A==}
+  '@aws-sdk/lib-storage@3.1063.0':
+    resolution: {integrity: sha512-WfDUIna6HicL8oTs26etBIr7yGwHIkadr8ecp/SjQAhX3t5xM/PLJCl0ZJ+bcLtYyjmWrO3Ydyf/EUyraEz8Qw==}
     engines: {node: '>=20.0.0'}
     peerDependencies:
-      '@aws-sdk/client-s3': ^3.1049.0
+      '@aws-sdk/client-s3': ^3.1063.0
 
-  '@aws-sdk/middleware-bucket-endpoint@3.972.14':
-    resolution: {integrity: sha512-Aaj0d+xbo1jJquBWJP0/9V/XZRYukO3LWIRp3dOLHmoFrYKb4YZ0aLefgVHfGcNOVBS2ZTq7L/n5JcrE7DaC+Q==}
+  '@aws-sdk/middleware-flexible-checksums@3.974.27':
+    resolution: {integrity: sha512-bZqezPLdllFC4VAeV/f+EIc/hz56ab3TD/+4zNCgOgmG5ZHAE5dMHrX1gtTwdcQXbPr3KR7x3zTC3zuCTE6+ng==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-expect-continue@3.972.12':
-    resolution: {integrity: sha512-dA5pKTom/Ls9mgeyeaRBNQrRIVOLVjv4AmKOB0/e4yaiXEUy0gSz2d3liP8JHtYoCAEWySU1jWnyzwLOREN+4g==}
+  '@aws-sdk/middleware-sdk-s3@3.972.48':
+    resolution: {integrity: sha512-MRTqx8wD/T3REt6LTT3/yN8rrp6+xIHrbUekkDYJTYWVch70mwtdJBovR4qKJz1jIPlbN+9R/Sn6R04BfsglzA==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-flexible-checksums@3.974.20':
-    resolution: {integrity: sha512-NdnMVQCR1YjIcqFAiNLdBiOwr2DyQDB2IiXQrBhzolKOv32ae4d4Ll7IzLMi04eMHiq/o/Y/GjFuVjF9HuG0QA==}
+  '@aws-sdk/nested-clients@3.997.17':
+    resolution: {integrity: sha512-lDRgraoTfKRawUyc176Ow93mrNrOho/x+EoK4C+lKU+vKkHWhNhzvSMVAx0WEJUJoeQxxDN5ZdKMfiGEyNejig==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-location-constraint@3.972.10':
-    resolution: {integrity: sha512-rI3NZvJcEvjoD0+0PI0iUAwlPw2IlSlhyvgBK/3WkKJQE/YiKFedd9dMN2lVacdNxPNhxL/jzQaKQdrGtQagjQ==}
+  '@aws-sdk/rds-signer@3.1063.0':
+    resolution: {integrity: sha512-U/t4PcQDkIqKSkwLwY3+zxm92lHcZWnbIYgDZR1sSR/MKns+1j1rkm33SMApQ1Pp6W6BhSEvOehCmC17lLv4DQ==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-sdk-s3@3.972.41':
-    resolution: {integrity: sha512-M4T2I2WPuH5WQpU8Tsp+u2bcO29zGRkU14ATzuqb9I4xh8tzsLqtp4hzaJM5aO2dhMZnHDzyQwSFVgc3XbnoGg==}
+  '@aws-sdk/s3-presigned-post@3.1063.0':
+    resolution: {integrity: sha512-5iASs4kaN6OXTzryNQEVAqogDqdD7b1DsqSd6hcUC73Izj2vpSBK6RCDSiHmSNe7HQQIF8B72XBi+NtCixop2A==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-ssec@3.972.10':
-    resolution: {integrity: sha512-Gli9A0u8EVVb+5bFDGS/QbSVg28w/wpEidg1ggVcSj65BDTdGR6punsOcVjqdiu1i42WHWo51MCvARPIIz9juw==}
+  '@aws-sdk/s3-request-presigner@3.1063.0':
+    resolution: {integrity: sha512-uYDuWEbBYz/DfS0sEbDA3BeBCNNaLiE+dmblIRrmU02bhoqsotJb3qWfx0+I3JlukC7Vk8wRuyRgjZzq1FyXGA==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/nested-clients@3.997.10':
-    resolution: {integrity: sha512-FtQ/Bt327peZJuyo4WZSOLVUTw9ujRxntepiC7L65FxA2P82Xlq0g14T22BuqBUeMjDoxa9nvwiMHjLIfP3eUg==}
+  '@aws-sdk/signature-v4-multi-region@3.996.32':
+    resolution: {integrity: sha512-llvApLcsWtmRFhG2wT3WIp1CmDeRaIYutqty1ZZXoMzK7TiJ6MOLOimk9eXUS8PwgG4ew4pa4QAbt0lfhn++1w==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/rds-signer@3.1049.0':
-    resolution: {integrity: sha512-2lYsmU4PPMdShpcJSXSqIRp4tsYWmYVyQF2xfneddWGHYegFXqyhJMQyBOz7OK9yQ+KjH71t+88LcQp6nwj5Qg==}
+  '@aws-sdk/token-providers@3.1063.0':
+    resolution: {integrity: sha512-nYDaWWdzjKiDP5xj8k4oUgcYd4WPgzfAOgdU5vJsaqH/07Dfvm7ffisHCFJ+NEl7kUC9JEIUxh0kznvenbo3NQ==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/s3-presigned-post@3.1049.0':
-    resolution: {integrity: sha512-f7cFAofInPoL3uz8yZWg97+u8Ur9BFVR7e6SraM7MW43EsS0GxJcvVOuNBpufSQsEYCFP7NeKsKhgYt5eJwJZg==}
+  '@aws-sdk/types@3.973.11':
+    resolution: {integrity: sha512-YjS0qFuECClRh4qhEyW8XagW0fwEPBeZ1cfsW/gU73Kh/ExFILxbzxOfPCmzF/2DwEvhvsHYt0b0qnvStwKYrg==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/s3-request-presigner@3.1049.0':
-    resolution: {integrity: sha512-pffbb4YNXB2OeqoFMEyFLg1J7SZu5fMf4D/NiCmwzSumLuUb8FVU+oNbmhVA2bgr1B78Hz9h7zObaVgLKh/bTw==}
+  '@aws-sdk/util-locate-window@3.965.6':
+    resolution: {integrity: sha512-ZfHjfwSzeXj+Lg9AK5ZNmeDkXev6V+w2tn1t4kgDdRtUaRCthepTQiFwbD06EF9oNGH4LaLg+Mb6U16Ypv5bSw==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/signature-v4-multi-region@3.996.27':
-    resolution: {integrity: sha512-0Phbz4t6HI3D3skxvG2uI+VWU034/nSIw1T8d+FPzzQG9EQTrw94o9mOKO2Gv3n3Oc8P7JD7RAUxkoneLWv5Eg==}
-    engines: {node: '>=20.0.0'}
-
-  '@aws-sdk/token-providers@3.1049.0':
-    resolution: {integrity: sha512-r7+d0lQMTHKypkmaF5jRTBYLYHCUHzt3gaVoN9SidLhQeWhCmHk3AKrboDTpPF5b7Pt7vKu3+oeMjznM2Eu1ow==}
-    engines: {node: '>=20.0.0'}
-
-  '@aws-sdk/types@3.973.8':
-    resolution: {integrity: sha512-gjlAdtHMbtR9X5iIhVUvbVcy55KnznpC6bkDUWW9z915bi0ckdUr5cjf16Kp6xq0bP5HBD2xzgbL9F9Quv5vUw==}
-    engines: {node: '>=20.0.0'}
-
-  '@aws-sdk/util-locate-window@3.965.5':
-    resolution: {integrity: sha512-WhlJNNINQB+9qtLtZJcpQdgZw3SCDCpXdUJP7cToGwHbCWCnRckGlc6Bx/OhWwIYFNAn+FIydY8SZ0QmVu3xTQ==}
-    engines: {node: '>=20.0.0'}
-
-  '@aws-sdk/xml-builder@3.972.24':
-    resolution: {integrity: sha512-V8z5YcDPfsvzrBlj0xR1vhRtocblhYbqdreCJB/voGd4Sr5zjNAeWxexbnqVtskTJe0vFb5KMqbSL++ePl+zRw==}
+  '@aws-sdk/xml-builder@3.972.28':
+    resolution: {integrity: sha512-lI/l3c/vPvsxmspzV63NfS3x9q4CkMmdhJy4QiM+NThAufVkDvi/PZZQ6xETnICL0UD7jI808pY83gllf86RFg==}
     engines: {node: '>=20.0.0'}
 
   '@aws/lambda-invoke-store@0.2.4':
     resolution: {integrity: sha512-iY8yvjE0y651BixKNPgmv1WrQc+GZ142sb0z4gYnChDDY2YqI4P/jsSopBWrKfAt7LOJAkOXt7rC/hms+WclQQ==}
     engines: {node: '>=18.0.0'}
 
-  '@babel/code-frame@7.29.0':
-    resolution: {integrity: sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==}
+  '@babel/code-frame@7.29.7':
+    resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/compat-data@7.29.3':
-    resolution: {integrity: sha512-LIVqM46zQWZhj17qA8wb4nW/ixr2y1Nw+r1etiAWgRM6U1IqP+LNhL1yg440jYZR72jCWcWbLWzIosH+uP1fqg==}
+  '@babel/compat-data@7.29.7':
+    resolution: {integrity: sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/core@7.29.0':
-    resolution: {integrity: sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==}
+  '@babel/core@7.29.7':
+    resolution: {integrity: sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/generator@7.29.1':
-    resolution: {integrity: sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==}
+  '@babel/generator@7.29.7':
+    resolution: {integrity: sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-compilation-targets@7.28.6':
-    resolution: {integrity: sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==}
+  '@babel/helper-compilation-targets@7.29.7':
+    resolution: {integrity: sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-globals@7.28.0':
-    resolution: {integrity: sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==}
+  '@babel/helper-globals@7.29.7':
+    resolution: {integrity: sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-module-imports@7.28.6':
-    resolution: {integrity: sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==}
+  '@babel/helper-module-imports@7.29.7':
+    resolution: {integrity: sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-module-transforms@7.28.6':
-    resolution: {integrity: sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==}
+  '@babel/helper-module-transforms@7.29.7':
+    resolution: {integrity: sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0
 
-  '@babel/helper-plugin-utils@7.28.6':
-    resolution: {integrity: sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==}
+  '@babel/helper-plugin-utils@7.29.7':
+    resolution: {integrity: sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-string-parser@7.27.1':
-    resolution: {integrity: sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==}
+  '@babel/helper-string-parser@7.29.7':
+    resolution: {integrity: sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-validator-identifier@7.28.5':
-    resolution: {integrity: sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==}
+  '@babel/helper-validator-identifier@7.29.7':
+    resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-validator-option@7.27.1':
-    resolution: {integrity: sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==}
+  '@babel/helper-validator-option@7.29.7':
+    resolution: {integrity: sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helpers@7.29.2':
-    resolution: {integrity: sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw==}
+  '@babel/helpers@7.29.7':
+    resolution: {integrity: sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/parser@7.29.3':
-    resolution: {integrity: sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==}
+  '@babel/parser@7.29.7':
+    resolution: {integrity: sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==}
     engines: {node: '>=6.0.0'}
     hasBin: true
 
-  '@babel/plugin-transform-react-jsx-self@7.27.1':
-    resolution: {integrity: sha512-6UzkCs+ejGdZ5mFFC/OCUrv028ab2fp1znZmCZjAOBKiBK2jXD1O+BPSfX8X2qjJ75fZBMSnQn3Rq2mrBJK2mw==}
+  '@babel/plugin-transform-react-jsx-self@7.29.7':
+    resolution: {integrity: sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk4v0TTEFfm53fw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
 
-  '@babel/plugin-transform-react-jsx-source@7.27.1':
-    resolution: {integrity: sha512-zbwoTsBruTeKB9hSq73ha66iFeJHuaFkUbwvqElnygoNbj/jHRsSeokowZFN3CZ64IvEqcmmkVe89OPXc7ldAw==}
+  '@babel/plugin-transform-react-jsx-source@7.29.7':
+    resolution: {integrity: sha512-06IyK09H3wi4cGbhDBwp5gUGo0IKtnYa8tyTiephirPCK6fbobVGiXMMI5zLQ4aKEYP3wZ3ArU44o+8KMrSG/Q==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
 
-  '@babel/runtime@7.29.2':
-    resolution: {integrity: sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g==}
+  '@babel/runtime@7.29.7':
+    resolution: {integrity: sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/template@7.28.6':
-    resolution: {integrity: sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==}
+  '@babel/template@7.29.7':
+    resolution: {integrity: sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/traverse@7.29.0':
-    resolution: {integrity: sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==}
+  '@babel/traverse@7.29.7':
+    resolution: {integrity: sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/types@7.29.0':
-    resolution: {integrity: sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==}
+  '@babel/types@7.29.7':
+    resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
     engines: {node: '>=6.9.0'}
 
   '@bcoe/v8-coverage@1.0.2':
@@ -701,27 +685,27 @@ packages:
   '@clack/prompts@0.11.0':
     resolution: {integrity: sha512-pMN5FcrEw9hUkZA4f+zLlzivQSeQf5dRGJjSUbvVYDLvpKCdQx5OaknvKzgbtXOizhP+SJJJjqEbOe55uKKfAw==}
 
-  '@clerk/backend@2.33.4':
-    resolution: {integrity: sha512-aF5IZGxicN6I5tq1g8GFTS3wbSVGzCRQ4zyZmZvRrux1xre2pVyWRoZ1qvMOjQ7doWJtEndxTZPjUaxXa4Zr2Q==}
+  '@clerk/backend@2.33.5':
+    resolution: {integrity: sha512-YOzUYJfb1d4w+0rKKm+LnnNpkJGQ+NI/g7qmF3mgaSN9X9huteuwCZyufdsI7z2DDkwy/yGRgb9eUWV96t7xLg==}
     engines: {node: '>=18.17.0'}
 
-  '@clerk/clerk-react@5.61.7':
-    resolution: {integrity: sha512-w2V01rQiQdZHmnvSD8TjHoPq2lXQ9Ft2sT+Zu9ZQXzhyKF02ZFKENUFG40rkxmFViZXfcLhzLauiEbh42jBd6g==}
+  '@clerk/clerk-react@5.61.8':
+    resolution: {integrity: sha512-n+k3q3xeyDkIPGTVA1J4Pd0+6MbS9Ia04qNlecOztTHwFfcirO5hy4TpOXrpGnO+GzYBuUMp7pYc3//ybMdEfg==}
     engines: {node: '>=18.17.0'}
     peerDependencies:
       react: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
       react-dom: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
 
-  '@clerk/nextjs@6.39.4':
-    resolution: {integrity: sha512-bGImOTf6OBAUqKVJ3UIXNhKwetT0G68k96If9u/nLXroimsjfGAxZzx7MaW/xUYTunfaCKtM36tPO1MKVW2YLg==}
+  '@clerk/nextjs@6.39.5':
+    resolution: {integrity: sha512-hvdvpiuHXPhlx3iaNfoXO1joZkNP4Lzw83teUNPrzsbOX0rT9QE0uSxS2J/UEAeqoPK6JhNK7dZGvZ9knsB/mg==}
     engines: {node: '>=18.17.0'}
     peerDependencies:
       next: ^13.5.7 || ^14.2.25 || ^15.2.3 || ^16
       react: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
       react-dom: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
 
-  '@clerk/shared@3.47.6':
-    resolution: {integrity: sha512-hg2UFiwmSb3FnAciMxZZZculRN08NrlajXbBhT+nylMG6ljZoic0OlIGs+Rtp49scVMkX3Ytz5EUUj9pgVvcWQ==}
+  '@clerk/shared@3.47.7':
+    resolution: {integrity: sha512-9Yv4MJFEaC7BzV0whxa4txQ4SoMu/3j1LBnI85EBykb5CcfXxIKvNX/9sjMUUySHlTOjsj7XZa5i3W5Dx02K/Q==}
     engines: {node: '>=18.17.0'}
     peerDependencies:
       react: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
@@ -732,8 +716,8 @@ packages:
       react-dom:
         optional: true
 
-  '@clerk/testing@1.14.7':
-    resolution: {integrity: sha512-9MHFGMTw0oX9UOM3g4aPh9GA4LA+UuWoYI2abJ242YfK8lQUMXA4XFJpuk/RhlGA+J0b4krSCxIZkiKNfGousA==}
+  '@clerk/testing@1.14.8':
+    resolution: {integrity: sha512-w6HxhMrza3fD6XB0yy7TEHkAERPYYzpQ79bEvW8sJeCPcLIJ7nF/yaDzDpiLdn97yFW4i1YHKJIlD6J7Exi9Tw==}
     engines: {node: '>=18.17.0'}
     peerDependencies:
       '@playwright/test': ^1
@@ -744,8 +728,8 @@ packages:
       cypress:
         optional: true
 
-  '@clerk/types@4.101.24':
-    resolution: {integrity: sha512-QMxfO7kGng2sJyUTwejRFSxTbVqJXVbr9rkI5Ow8sLEa+HHc+33D9KVJDjMQeJ6XIxwOk7d86X9gLnGFHxnncg==}
+  '@clerk/types@4.101.25':
+    resolution: {integrity: sha512-gPxm3hlBkP7B9EfKyp3/UDonNOjg7Z0UvqfrMj5u8gA8nyzvC1UFYtSTTmTfgSY82+5Yo38YV0DYu9vNf6t9CQ==}
     engines: {node: '>=18.17.0'}
 
   '@csstools/postcss-cascade-layers@5.0.2':
@@ -1123,11 +1107,6 @@ packages:
     resolution: {integrity: sha512-sDBWI3yLy8EcDzgobvJTWq1MJYzAkQdpjXuPukga9wXonhpMRvd1Izuo2Qgwey2OiEoRIBr35RMU9HJRoOHzpw==}
     engines: {node: ^20.19.0 || ^22.13.0 || ^23.5.0 || >=24.0.0, npm: '>=10'}
 
-  '@fastify/otel@0.18.0':
-    resolution: {integrity: sha512-3TASCATfw+ctICSb4ymrv7iCm0qJ0N9CarB+CZ7zIJ7KqNbwI5JjyDL1/sxoC0ccTO1Zyd1iQ+oqncPg5FJXaA==}
-    peerDependencies:
-      '@opentelemetry/api': ^1.9.0
-
   '@floating-ui/core@1.7.5':
     resolution: {integrity: sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ==}
 
@@ -1516,66 +1495,66 @@ packages:
       '@emnapi/core': ^1.7.1
       '@emnapi/runtime': ^1.7.1
 
-  '@next/env@16.2.6':
-    resolution: {integrity: sha512-gd8HoHN4ufj73WmR3JmVolrpJR47ILK6LouP5xElPglaVxir6e1a7VzvTvDWkOoPXT9rkkTzyCxBu4yeZfZwcw==}
+  '@next/env@16.2.7':
+    resolution: {integrity: sha512-tMJizPlj6ZYpBMMdK8S0LJufrP4QTdR6pcv9KQ/bVETPAmg0j1mlHE9G2c38UyGHxoBapgwuj7XjbGJ2RcDFOg==}
 
   '@next/eslint-plugin-next@16.1.6':
     resolution: {integrity: sha512-/Qq3PTagA6+nYVfryAtQ7/9FEr/6YVyvOtl6rZnGsbReGLf0jZU6gkpr1FuChAQpvV46a78p4cmHOVP8mbfSMQ==}
 
-  '@next/swc-darwin-arm64@16.2.6':
-    resolution: {integrity: sha512-ZJGkkcNfYgrrMkqOdZ7zoLa1TOy0qpcMfk/z4Mh/FKUz40gVO+HNQWqmLxf67Z5WB64DRp0dhEbyHfel+6sJUg==}
+  '@next/swc-darwin-arm64@16.2.7':
+    resolution: {integrity: sha512-vm1EDI/pVaBNNiychmxk3fft+OhQPVD9cIM/tReLZIQ3TfQ4kqI9DwKk00dzuS1ulC7icbrzCFrmRRlk9PfNdw==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@next/swc-darwin-x64@16.2.6':
-    resolution: {integrity: sha512-v/YLBHIY132Ced3puBJ7YJKw1lqsCrgcNo2aRJlCEyQrrCeRJlvGlnmxhPxNQI3KE3N1DN5r9TPNPvka3nq5RQ==}
+  '@next/swc-darwin-x64@16.2.7':
+    resolution: {integrity: sha512-O3IRSv1ZBL1zs0WrIgefTEcTKFVn+ryxBNe54erJ6KsD+2f/Mmt7g2jOYh8PSBdUwPtKQJuCsTMlZ7tIu2AcsQ==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [darwin]
 
-  '@next/swc-linux-arm64-gnu@16.2.6':
-    resolution: {integrity: sha512-RPOvqlYBbcQjkz9VQQDZ2T2bARIjXZV1KFlt+V2Mr6SW/e4I9fcKsaA0hdyf2FHoTlsV2xnBd5Y912rP/1Ce6w==}
+  '@next/swc-linux-arm64-gnu@16.2.7':
+    resolution: {integrity: sha512-Re6PZtjBDd0aMU+VcZcC/PrIvj4WhrjDYtMhhCVQamWN4L90EVP0pcEOBQD25prSlw7OzNw5QpHLWMilRLsRNw==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@next/swc-linux-arm64-musl@16.2.6':
-    resolution: {integrity: sha512-URUTu1+dMkxJsPFgm+OeEvq9wf5sujw0EvgYy80TDGHTSLTnIHeqb0Eu8A3sC95IRgjejQL+kC4mw+4yPxiAXA==}
+  '@next/swc-linux-arm64-musl@16.2.7':
+    resolution: {integrity: sha512-qyogG9QtBzWxgJfeGBvOEHI3851gTfCF3wLZ5RDLTBJGAmE9p1qDwKCOdrBrvBzRvYDT+gUDp72pzlSEfAXgNA==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@next/swc-linux-x64-gnu@16.2.6':
-    resolution: {integrity: sha512-DOj182mPV8G3UkrayLoREM5YEYI+Dk5wv7Ox9xl1fFibAELEsFD0lDPfHIeILlutMMfdyhlzYPELG3peuKaurw==}
+  '@next/swc-linux-x64-gnu@16.2.7':
+    resolution: {integrity: sha512-Vhe4ZDuBpmMogrGi5D4R2Kq4JAQlj6+wvgaFYy31zfES0zPmt6TLA+cuYpM/OLrPZjo2MYQTHVqNUSCR6+fDZQ==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@next/swc-linux-x64-musl@16.2.6':
-    resolution: {integrity: sha512-HKQ5SP/V/ub73UvF7n/zeJlxk2kLmtL7Wzrg4WfmkjmNos5onJ2tKu7yZOPdL18A6Svfn3max29ym+ry7NkK4g==}
+  '@next/swc-linux-x64-musl@16.2.7':
+    resolution: {integrity: sha512-srvian89JahFLw1YLBEuhvPJ0DO5lpUeJQMXy4xYo7g628ZlNgXdNkqoxSAv9OYrBfByh6vxISMwW/mRbzCY+g==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@next/swc-win32-arm64-msvc@16.2.6':
-    resolution: {integrity: sha512-LZXpTlPyS5v7HhSmnvsLGP3iIYgYOBnc8r8ArlT55sGHV89bR2HlDdBjWQ+PY6SJMmk8TuVGFuxalnP3k/0Dwg==}
+  '@next/swc-win32-arm64-msvc@16.2.7':
+    resolution: {integrity: sha512-GX3wvLpULFuRFJzwHaKfm7QZJ18F4ZSuxlPJ96BoBglCzBmdSjyeBKF+ZhWhvL/ckxNfLnNa7bsObO2ipYpszw==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [win32]
 
-  '@next/swc-win32-x64-msvc@16.2.6':
-    resolution: {integrity: sha512-F0+4i0h9J6C4eE3EAPWsoCk7UW/dbzOjyzxY0qnDUOYFu6FFmdZ6l97/XdV3/Nz3VYyO7UWjyEJUXkGqcoXfMA==}
+  '@next/swc-win32-x64-msvc@16.2.7':
+    resolution: {integrity: sha512-J4WlM72NMk076Qsg0jTdK3SNXatlSdnjW7L7oNGLst1tAGjHrJh/FYi+pw9wyIjEtGRKDNzD0zuiY16oWYWVaw==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [win32]
 
-  '@nodable/entities@2.1.0':
-    resolution: {integrity: sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA==}
+  '@nodable/entities@2.1.1':
+    resolution: {integrity: sha512-Pig3HxDIoMgjdEH8OCf/dkcTmLFjJRjWuq8jSnklu284/TKOPibSRERmOykiwmyXTtv61mP+44f3GMx0tLAyjg==}
 
   '@nodelib/fs.scandir@2.1.5':
     resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
@@ -1630,8 +1609,8 @@ packages:
     resolution: {integrity: sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==}
     engines: {node: '>= 20'}
 
-  '@octokit/request@10.0.9':
-    resolution: {integrity: sha512-o8Bi3f608eyM+7BmBiUWxFsdjLb3/ym1cQek5LZOv9KkZcxRrHCPhhRzm6xjO6HVZ85ItD6+sTsjxo821SVa/A==}
+  '@octokit/request@10.0.10':
+    resolution: {integrity: sha512-KxNC2pTqqhszMNrf12ZRd4PonRgyJdsM4F/jySiddQK+DsRcfBtUvqn8t7UsyZhnRJHvX46OohDt5N3VqIWC2w==}
     engines: {node: '>= 20'}
 
   '@octokit/rest@22.0.1':
@@ -1641,14 +1620,6 @@ packages:
   '@octokit/types@16.0.0':
     resolution: {integrity: sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==}
 
-  '@opentelemetry/api-logs@0.207.0':
-    resolution: {integrity: sha512-lAb0jQRVyleQQGiuuvCOTDVspc14nx6XJjP4FspJ1sNARo3Regq4ZZbrc3rN4b1TYSuUCvgH+UXUPug4SLOqEQ==}
-    engines: {node: '>=8.0.0'}
-
-  '@opentelemetry/api-logs@0.212.0':
-    resolution: {integrity: sha512-TEEVrLbNROUkYY51sBJGk7lO/OLjuepch8+hmpM6ffMJQ2z/KVCjdHuCFX6fJj8OkJP2zckPjrJzQtXU3IAsFg==}
-    engines: {node: '>=8.0.0'}
-
   '@opentelemetry/api-logs@0.214.0':
     resolution: {integrity: sha512-40lSJeqYO8Uz2Yj7u94/SJWE/wONa7rmMKjI1ZcIjgf3MHNHv1OZUCrCETGuaRF62d5pQD1wKIW+L4lmSMTzZA==}
     engines: {node: '>=8.0.0'}
@@ -1657,138 +1628,12 @@ packages:
     resolution: {integrity: sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q==}
     engines: {node: '>=8.0.0'}
 
-  '@opentelemetry/core@2.6.1':
-    resolution: {integrity: sha512-8xHSGWpJP9wBxgBpnqGL0R3PbdWQndL1Qp50qrg71+B28zK5OQmUgcDKLJgzyAAV38t4tOyLMGDD60LneR5W8g==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': '>=1.0.0 <1.10.0'
-
   '@opentelemetry/core@2.7.1':
     resolution: {integrity: sha512-QAqIj32AtK6+pEVNG7EOVxHdE06RP+FM5qpiEJ4RtDcFIqKUZHYhl7/7UY5efhwmwNAg7j8QbJVBLxMerc0+gw==}
     engines: {node: ^18.19.0 || >=20.6.0}
     peerDependencies:
       '@opentelemetry/api': '>=1.0.0 <1.10.0'
 
-  '@opentelemetry/instrumentation-amqplib@0.61.0':
-    resolution: {integrity: sha512-mCKoyTGfRNisge4br0NpOFSy2Z1NnEW8hbCJdUDdJFHrPqVzc4IIBPA/vX0U+LUcQqrQvJX+HMIU0dbDRe0i0Q==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-connect@0.57.0':
-    resolution: {integrity: sha512-FMEBChnI4FLN5TE9DHwfH7QpNir1JzXno1uz/TAucVdLCyrG0jTrKIcNHt/i30A0M2AunNBCkcd8Ei26dIPKdg==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-dataloader@0.31.0':
-    resolution: {integrity: sha512-f654tZFQXS5YeLDNb9KySrwtg7SnqZN119FauD7acBoTzuLduaiGTNz88ixcVSOOMGZ+EjJu/RFtx5klObC95g==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-fs@0.33.0':
-    resolution: {integrity: sha512-sCZWXGalQ01wr3tAhSR9ucqFJ0phidpAle6/17HVjD6gN8FLmZMK/8sKxdXYHy3PbnlV1P4zeiSVFNKpbFMNLA==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-generic-pool@0.57.0':
-    resolution: {integrity: sha512-orhmlaK+ZIW9hKU+nHTbXrCSXZcH83AescTqmpamHRobRmYSQwRbD0a1odc0yAzuzOtxYiHiXAnpnIpaSSY7Ow==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-graphql@0.62.0':
-    resolution: {integrity: sha512-3YNuLVPUxafXkH1jBAbGsKNsP3XVzcFDhCDCE3OqBwCwShlqQbLMRMFh1T/d5jaVZiGVmSsfof+ICKD2iOV8xg==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-hapi@0.60.0':
-    resolution: {integrity: sha512-aNljZKYrEa7obLAxd1bCEDxF7kzCLGXTuTJZ8lMR9rIVEjmuKBXN1gfqpm/OB//Zc2zP4iIve1jBp7sr3mQV6w==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-http@0.214.0':
-    resolution: {integrity: sha512-FlkDhZDRjDJDcO2LcSCtjRpkal1NJ8y0fBqBhTvfAR3JSYY2jAIj1kSS5IjmEBt4c3aWv+u/lqLuoCDrrKCSKg==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-kafkajs@0.23.0':
-    resolution: {integrity: sha512-4K+nVo+zI+aDz0Z85SObwbdixIbzS9moIuKJaYsdlzcHYnKOPtB7ya8r8Ezivy/GVIBHiKJVq4tv+BEkgOMLaQ==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-knex@0.58.0':
-    resolution: {integrity: sha512-Hc/o8fSsaWxZ8r1Yw4rNDLwTpUopTf4X32y4W6UhlHmW8Wizz8wfhgOKIelSeqFVTKBBPIDUOsQWuIMxBmu8Bw==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-koa@0.62.0':
-    resolution: {integrity: sha512-uVip0VuGUQXZ+vFxkKxAUNq8qNl+VFlyHDh/U6IQ8COOEDfbEchdaHnpFrMYF3psZRUuoSIgb7xOeXj00RdwDA==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.9.0
-
-  '@opentelemetry/instrumentation-lru-memoizer@0.58.0':
-    resolution: {integrity: sha512-6grM3TdMyHzlGY1cUA+mwoPueB1F3dYKgKtZIH6jOFXqfHAByyLTc+6PFjGM9tKh52CFBJaDwodNlL/Td39z7Q==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-mongodb@0.67.0':
-    resolution: {integrity: sha512-1WJp5N1lYfHq2IhECOTewFs5Tf2NfUOwQRqs/rZdXKTezArMlucxgzAaqcgp3A3YREXopXTpXHsxZTGHjNhMdQ==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-mongoose@0.60.0':
-    resolution: {integrity: sha512-8BahAZpKsOoc+lrZGb7Ofn4g3z8qtp5IxDfvAVpKXsEheQN7ONMH5djT5ihy6yf8yyeQJGS0gXFfpEAEeEHqQg==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-mysql2@0.60.0':
-    resolution: {integrity: sha512-m/5d3bxQALllCzezYDk/6vajh0tj5OijMMvOZGr+qN1NMXm1dzMNwyJ0gNZW7Fo3YFRyj/jJMxIw+W7d525dlw==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-mysql@0.60.0':
-    resolution: {integrity: sha512-08pO8GFPEIz2zquKDGteBZDNmwketdgH8hTe9rVYgW9kCJXq1Psj3wPQGx+VaX4ZJKCfPeoLMYup9+cxHvZyVQ==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-pg@0.66.0':
-    resolution: {integrity: sha512-KxfLGXBb7k2ueaPJfq2GXBDXBly8P+SpR/4Mj410hhNgmQF3sCqwXvUBQxZQkDAmsdBAoenM+yV1LhtsMRamcA==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation-tedious@0.33.0':
-    resolution: {integrity: sha512-Q6WQwAD01MMTub31GlejoiFACYNw26J426wyjvU7by7fDIr2nZXNW4vhTGs7i7F0TnXBO3xN688g1tdUgYwJ5w==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation@0.207.0':
-    resolution: {integrity: sha512-y6eeli9+TLKnznrR8AZlQMSJT7wILpXH+6EYq5Vf/4Ao+huI7EedxQHwRgVUOMLFbe7VFDvHJrX9/f4lcwnJsA==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
-  '@opentelemetry/instrumentation@0.212.0':
-    resolution: {integrity: sha512-IyXmpNnifNouMOe0I/gX7ENfv2ZCNdYTF0FpCsoBcpbIHzk81Ww9rQTYTnvghszCg7qGrIhNvWC8dhEifgX9Jg==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.3.0
-
   '@opentelemetry/instrumentation@0.214.0':
     resolution: {integrity: sha512-MHqEX5Dk59cqVah5LiARMACku7jXSVk9iVDWOea4x3cr7VfdByeDCURK6o1lntT1JS/Tsovw01UJrBhN3/uC5w==}
     engines: {node: ^18.19.0 || >=20.6.0}
@@ -1811,75 +1656,89 @@ packages:
     resolution: {integrity: sha512-/UhIkaZgPutTFmQ7RnIJGgDXZmtEJ7Dvi86xNTFWcnRxVRNk/aotsqDJYeEvDP+FSMB2SdW+pQzNMcWP0rwuNA==}
     engines: {node: '>=14'}
 
-  '@opentelemetry/sql-common@0.41.2':
-    resolution: {integrity: sha512-4mhWm3Z8z+i508zQJ7r6Xi7y4mmoJpdvH0fZPFRkWrdp5fq7hhZ2HhYokEOLkfqSMgPR4Z9EyB3DBkbKGOqZiQ==}
-    engines: {node: ^18.19.0 || >=20.6.0}
-    peerDependencies:
-      '@opentelemetry/api': ^1.1.0
-
-  '@oxc-project/types@0.130.0':
-    resolution: {integrity: sha512-ibD2usx9JRu7f5pu2tMKMI4cpA4NgXJQoYRP4pQ7Pxmn1l6k/53qWtQWZayhYy3X4QZkt90Ot+mJEaeXouio6Q==}
+  '@oxc-project/types@0.133.0':
+    resolution: {integrity: sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==}
 
-  '@pandacss/config@1.11.1':
-    resolution: {integrity: sha512-8f+pJfwDBlTgXqDKoTa3UFmiIZ4YYQvt5BPYQfD93xjvBPJBwdQl7P49obhSp/nkt13nl2MZRW+dtmrVQfz6OQ==}
+  '@pandacss/config@1.11.3':
+    resolution: {integrity: sha512-f0Bu1rY0AO7fpLCaAt/yyPSZ4dmgzKBnsZZwoUsAeh/lN1fQq/GZ6L/0gvMh2oPPOEfV8oHhYpfBzxdgDRabig==}
+    engines: {node: '>=20'}
 
-  '@pandacss/core@1.11.1':
-    resolution: {integrity: sha512-yUmCJ2cBkfcfx+4w4ZO+hrAkDtDXIm6NoU8iYRC70GHsTm6T+vlEs7jRxYqK9C2sW+mJx+zKFqjD+THSAZhF+g==}
+  '@pandacss/core@1.11.3':
+    resolution: {integrity: sha512-yE3limkJMQp0lJOMvIyD+XMwQGnrBD/oTY4bOh3qEEgtq7D5qzIhYo+Otb04Dl5TQ06TtXirsmcQEx9sV/TPHA==}
+    engines: {node: '>=20'}
 
-  '@pandacss/dev@1.11.1':
-    resolution: {integrity: sha512-Xf2wfdnYqPdCu1X+bdwTRGFvtcI9mivqRhWzmmO7JRn4KOKmvLuQY95iJZFwUNyscg8dgKbWcZJOpqnrJaEUYw==}
+  '@pandacss/dev@1.11.3':
+    resolution: {integrity: sha512-4uKImSjreO1IRwmsZ8bV1KdjatWdK0GxdYXY720hDiY9+4CrH0UnxjEI/thpQTnYGi9RvZ8b19x2sthmljZDzQ==}
+    engines: {node: '>=20'}
     hasBin: true
 
-  '@pandacss/extractor@1.11.1':
-    resolution: {integrity: sha512-WF+Te/azc9TE5l+dt93E9qOhgnXFKv875SFF02mHWtaLmAgA0pwxY1s63EeWAG8EzIyhqlxFRGVomTz4VDtHYA==}
+  '@pandacss/extractor@1.11.3':
+    resolution: {integrity: sha512-BRVpiGQc0MvmQZD3XKxUkrPsnEdZjZjX8L0azb2KCr/0Ti6AKTY4LsRNOw00G0z9vG8YEy7/ltHV7EgYxKy22A==}
+    engines: {node: '>=20'}
 
-  '@pandacss/generator@1.11.1':
-    resolution: {integrity: sha512-83Zeshx5w+KElhW0cm6T4ZjqxMueSh6/2wmnQM5ioNv3Mk0c0UZWusvl38DZDnP1Yrp9Dd8BT8c4Zu/kIzir0w==}
+  '@pandacss/generator@1.11.3':
+    resolution: {integrity: sha512-EJVsQ9XRx+yABpE+NuXevG4HtGJVJLZzFE10rS7iO7qvIq9NnNtPI/JH6Uiy7PY1KJ72k01aOOYgEmqWBALm+w==}
+    engines: {node: '>=20'}
 
-  '@pandacss/is-valid-prop@1.11.1':
-    resolution: {integrity: sha512-tvfThJmSw88Lgk5qVYzVckZ2FY8T376mGvP1cWUC5SR58AYm82ZKEFciDbGOQKcyN70rF9qqJBB5JVWgJo3JmA==}
+  '@pandacss/is-valid-prop@1.11.3':
+    resolution: {integrity: sha512-YaHK+p5DaN8AUpsRx5OqqGxaZzn8uNIdVhP+K1cjvjv3+Qa9D/75/A1dPyLmfKrSRJc8UoR9WN9fxQX0rVzhzQ==}
+    engines: {node: '>=20'}
 
-  '@pandacss/logger@1.11.1':
-    resolution: {integrity: sha512-uFA8Wi+dOqrns6ENsdV5KpU7wQEchb8GL2NqdH+UqyvCnfIRiAs/CldXRzFd8Dh7Q5PJXIYSEmrn2SMOqaA7eg==}
+  '@pandacss/logger@1.11.3':
+    resolution: {integrity: sha512-mrsHlU4VtzZK0Gg+fkBHxqMGQ+++TcLmuFVP5rMZcJ5TdOSy6WEfJbfCz8+qdUWJQAfSJkBsK4yVvlbbOV5o9Q==}
+    engines: {node: '>=20'}
 
-  '@pandacss/mcp@1.11.1':
-    resolution: {integrity: sha512-sfAewHwDy+XWk9SFRSNVtTEwKb9KMLlzM0MDgzio/ZBxZK6MZiSskrRSqSeHWJOdw52IdQWQlFLGPakV5p30Zw==}
+  '@pandacss/mcp@1.11.3':
+    resolution: {integrity: sha512-Z+ehm2F5/nBiZh2WmQCQZkMzzbtIbl/OtxeanvHO/ZY2ls5ozRoGaOQDPqeRbf9XRMtfvWPHe5R3LeRQ3tXqaw==}
+    engines: {node: '>=20'}
 
-  '@pandacss/node@1.11.1':
-    resolution: {integrity: sha512-NqJ6YYtFifS4JOgLGHuxM9vdKMKefg6UA9MFup+gaGiO5bjblJhn7l/AFRjYJHNGb9G76l44CzMREEfOe+gm8w==}
+  '@pandacss/node@1.11.3':
+    resolution: {integrity: sha512-tiJz0VZnLTvYnBPb8i4XZdLJrHObZJBZjpn+RbR6/Ipv9AGGpzv8fgNpfB2gM0/eUWDxPHtcteEhHKTvdaQS5A==}
+    engines: {node: '>=20'}
 
-  '@pandacss/parser@1.11.1':
-    resolution: {integrity: sha512-ZerJISWnw8FAnTSRwyNevErUEd1GV/Ui/RUaolbm09Zb9Xvlfti1N6ylH4KBVhUBAjO1HGQAzhhXP1SZwy5tkQ==}
+  '@pandacss/parser@1.11.3':
+    resolution: {integrity: sha512-4oF76jUKiCnsy5tmi5vv1eiM4SNEAN3+y3wfX/b8YzTBvz60JVdolF0TsrZCee+01D6oChJwx/N8kh2HrQh4Ag==}
+    engines: {node: '>=20'}
 
-  '@pandacss/plugin-lightningcss@1.11.1':
-    resolution: {integrity: sha512-tV+4lW1zmRG+cKKKj6x6bSmjm11Ou3ffjtIzBXy6Y9R+MkZhZbqjARSZte10EtxW1irlRpy4Wo5CKtPJF/YbNQ==}
+  '@pandacss/plugin-lightningcss@1.11.3':
+    resolution: {integrity: sha512-8OwqGVQNjflm/6Yywq4CLQj2Ltx485NrKqHV7TDmO/zhYmSNfIaQu8nOt6QPuNI6/O5WZZzJ2XoAoVwiS//RKw==}
+    engines: {node: '>=20'}
 
-  '@pandacss/plugin-svelte@1.11.1':
-    resolution: {integrity: sha512-W3oOoaO/bXsHLcsrlMyBM+Vi3R5T/ZGc6JqEE4l8qazliu0MRN879pceekj7pOZkF06WyG6eMs4Y1Uqxhpv7vA==}
+  '@pandacss/plugin-svelte@1.11.3':
+    resolution: {integrity: sha512-gj2HtXM/By/eUdzGN7BMD4al76lw/FmuTqVxFrO3d0x9IDYqu7PmeFhVeama4its4rHzKi5rIhPIIJFMtGk22A==}
+    engines: {node: '>=20'}
 
-  '@pandacss/plugin-vue@1.11.1':
-    resolution: {integrity: sha512-gpyHBaS646ac81dfywP7C8bCl4IugXBDSKk8Y++GsnfKYS8tTTrNlPyEAMMTNM2jx021Br/UDu5Ld7gCOD5XbQ==}
+  '@pandacss/plugin-vue@1.11.3':
+    resolution: {integrity: sha512-I84aGump8jaY3LQc9jdiHurR5L2wJhxdYuz+In1rMXiyJmdm1EMXg+9p7pBszQUQimh0gz9GvQvrVgs8hgegAA==}
+    engines: {node: '>=20'}
 
-  '@pandacss/postcss@1.11.1':
-    resolution: {integrity: sha512-1lvuVneRZE2juPmT12SWf5mBzxbOnIMukbhaBdVxct4J03KxnW71PMaj3bDxAAIN77IxXgpA5lI2hIWz5pwJRA==}
+  '@pandacss/postcss@1.11.3':
+    resolution: {integrity: sha512-tphhHtH46sRQwFhtfNQDj9Jy6gAR7YXKVh7sbp9Zk5wySawHb5Sqo/FgopQjD2JwVhKTdHgRQ2W8jnXMv/lkeA==}
+    engines: {node: '>=20'}
 
-  '@pandacss/preset-base@1.11.1':
-    resolution: {integrity: sha512-KWMUiJl2/QEoT2Ck2RUZByzUVyP8hfnYKA0ioL7iEDlNVrX2z/MZISTT6ph9UNVlbPP+PhYBmjdATkmAzQNqBw==}
+  '@pandacss/preset-base@1.11.3':
+    resolution: {integrity: sha512-FlwZ/QaoxFxjlzuVJk4JLlwcXuy1m0BLMPLqGeqe/+YPuIKBDTsJBFhhgAN1jBms7E8QOtMsXBcjU9kL6+CbJw==}
+    engines: {node: '>=20'}
 
-  '@pandacss/preset-panda@1.11.1':
-    resolution: {integrity: sha512-+0ZV4d5TZIqbXLh4xRIptuOd/VOc7YncOfeHZn9uWzGKi04uob9I/8mQ/hgSSRWCKmaLpRzsBDuijr2ODD59iA==}
+  '@pandacss/preset-panda@1.11.3':
+    resolution: {integrity: sha512-IHeRQyIYeGKpQl78A/oI9fGg8MHQiOX/HttH+iQNaRU/MbGN6JsPe/N0ekQC6QY8iiKtLhqR+SRc455SN6JVWw==}
+    engines: {node: '>=20'}
 
-  '@pandacss/reporter@1.11.1':
-    resolution: {integrity: sha512-8F/A7o0MeqYW6ElocfzRvSdja4cs4LXIMQrriHH3c1k8BerLmIs9/sdf2KAwV8fo3CeNmb4blEM8dsrxa6vTrg==}
+  '@pandacss/reporter@1.11.3':
+    resolution: {integrity: sha512-TnvzPV+6oig20CfC8C065L38FtFVafex8Ncvrj1DA+GiiNv2cMiSo1nIXR+gM2YKcMH0nu0vXMo6WA5ECEOK3Q==}
+    engines: {node: '>=20'}
 
-  '@pandacss/shared@1.11.1':
-    resolution: {integrity: sha512-5GvoUY2fgjTGDzXgc9joVwUCe6w54QbvgFP96Nnri77QYGmv14VQ5MAH3uS42BylUZ4kxfN9jokmO7vPgMRLBA==}
+  '@pandacss/shared@1.11.3':
+    resolution: {integrity: sha512-rKIjtTmzUsXsG8fD+VtbJ4Y6eSdPzjvV0nhkTPFiCfPL6JR5HCc0pw7ja6WuiLkAKAXYJQbCAv/EvobqJMgnZw==}
+    engines: {node: '>=20'}
 
-  '@pandacss/token-dictionary@1.11.1':
-    resolution: {integrity: sha512-qyHe1xMb+KMatuoT6KGl+2qK93qr59puGFHw05nRJ0Ty3QP0oqMGsIzVXOAdYKei1Y/20JOh7y+FJbhDlrQcTw==}
+  '@pandacss/token-dictionary@1.11.3':
+    resolution: {integrity: sha512-hHRhHRlFnrTvFxDp88oW0n86gXcu6nmGW+RlhH/OFOv9Y19HuLNPGOhACL3+L7e4UxYFUGzrXdIR3G4yHvX9hg==}
+    engines: {node: '>=20'}
 
-  '@pandacss/types@1.11.1':
-    resolution: {integrity: sha512-VkigbeCwlDyyMBlQeRwOMLshSRjNB/2HqvfZvaVXT4+5miAYUAKeQDR88UqUL2aqPWkltTxMVEwBnqSQdC8+jw==}
+  '@pandacss/types@1.11.3':
+    resolution: {integrity: sha512-tUbxa3WzoCuulP6kcMn7f0uNgLBvu81JAg4sfoUpz6PZE36VHA3k9n6ROEwziTbr7vqgeCj5DYQCUldrVNbEGQ==}
+    engines: {node: '>=20'}
 
   '@phosphor-icons/react@2.1.10':
     resolution: {integrity: sha512-vt8Tvq8GLjheAZZYa+YG/pW7HDbov8El/MANW8pOAz4eGxrwhnbfrQZq0Cp4q8zBEu8NIhHdnr+r8thnfRSNYA==}
@@ -1896,102 +1755,97 @@ packages:
   '@preact/signals-core@1.14.2':
     resolution: {integrity: sha512-RZHdBj9ZF4n40Rp4jS052EHHjBWf96P9oNdXPfhQTovCuWY9iQn3Gq+gOTJSgBO9A/JBuPfMOWsSX/lIU9Pc/A==}
 
-  '@prisma/instrumentation@7.6.0':
-    resolution: {integrity: sha512-ZPW2gRiwpPzEfgeZgaekhqXrbW+Y2RJKHVqUmlhZhKzRNCcvR6DykzylDrynpArKKRQtLxoZy36fK7U0p3pdgQ==}
-    peerDependencies:
-      '@opentelemetry/api': ^1.8
-
-  '@rolldown/binding-android-arm64@1.0.1':
-    resolution: {integrity: sha512-fJI3I0r3C3Oj/zdBCpaCmBRZYf07xpaq4yCfDDoSFm+beWNzbIl26puW8RraUdugoJw/95zerNOn6jasAhzSmg==}
+  '@rolldown/binding-android-arm64@1.0.3':
+    resolution: {integrity: sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [android]
 
-  '@rolldown/binding-darwin-arm64@1.0.1':
-    resolution: {integrity: sha512-cKnAhWEsV7TPcA/5EAteDp6KcJZBQ2G+BqE7zayMMi7kMvwRsbv7WT9aOnn0WNl4SKEIf43vjS31iUPu80nzXg==}
+  '@rolldown/binding-darwin-arm64@1.0.3':
+    resolution: {integrity: sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [darwin]
 
-  '@rolldown/binding-darwin-x64@1.0.1':
-    resolution: {integrity: sha512-YKrVwQjIRBPo+5G/u03wGjbdy4q7pyzCe93DK9VJ7zkVmeg8LJ7GbgsiHWdR4xSoe4CAXRD7Bcjgbtr64bkXNg==}
+  '@rolldown/binding-darwin-x64@1.0.3':
+    resolution: {integrity: sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [darwin]
 
-  '@rolldown/binding-freebsd-x64@1.0.1':
-    resolution: {integrity: sha512-z/oBsREo46SsFqBwYtFe0kpJeBijAT48O/WXLI4suiCLBkr03RTtTJMCzSdDd2znlh8VJizL09XVkQgk8IZonw==}
+  '@rolldown/binding-freebsd-x64@1.0.3':
+    resolution: {integrity: sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [freebsd]
 
-  '@rolldown/binding-linux-arm-gnueabihf@1.0.1':
-    resolution: {integrity: sha512-ik8q7GM11zxvYxFc2PeDcT6TBvhCQMaUxfph/M5l9sKuTs/Sjg3L+Byw0F7w0ZVLBZmx30P+gG0ECzzN+MFcmQ==}
+  '@rolldown/binding-linux-arm-gnueabihf@1.0.3':
+    resolution: {integrity: sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm]
     os: [linux]
 
-  '@rolldown/binding-linux-arm64-gnu@1.0.1':
-    resolution: {integrity: sha512-QoSx2EkyrrdZ6kcyE8stqZ62t0Yra8Fs5ia9lOxJrh6TMQJK7gQKmscdTHf7pOXKREKrVwOtJcQG3qVSfc866A==}
+  '@rolldown/binding-linux-arm64-gnu@1.0.3':
+    resolution: {integrity: sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-arm64-musl@1.0.1':
-    resolution: {integrity: sha512-uwNwFpwKeNiZawfAWBgg0VIztPTV3ihhh1vV334h9ivnNLorxnQMU6Fz8wG1Zb4Qh9LC1/MkcyT3YlDXG3Rsgg==}
+  '@rolldown/binding-linux-arm64-musl@1.0.3':
+    resolution: {integrity: sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@rolldown/binding-linux-ppc64-gnu@1.0.1':
-    resolution: {integrity: sha512-zY1bul7OWr7DFBiJ++wofXvnr8B45ce3QsQUhKrIhXsygAh7bTkwyeM1bi1a2g5C/yC/N8TZyGDEoMfm/l9mpg==}
+  '@rolldown/binding-linux-ppc64-gnu@1.0.3':
+    resolution: {integrity: sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-s390x-gnu@1.0.1':
-    resolution: {integrity: sha512-0frlsT/f4Ft6I7SMESTKnF3cZsdicQn1dCMkF/jT9wDLE+gGoiQfv1nmT9e+s7s/fekvvy6tZM2jHvI2tkbJDQ==}
+  '@rolldown/binding-linux-s390x-gnu@1.0.3':
+    resolution: {integrity: sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-x64-gnu@1.0.1':
-    resolution: {integrity: sha512-XABVmGp9Tg0WspTVvwduTc4fpqy6JnAUrSQe6OuyqD/03nI7r0O9OWUkMIwFrjKAIqolvqoA4ZrJppgwE0Gxmw==}
+  '@rolldown/binding-linux-x64-gnu@1.0.3':
+    resolution: {integrity: sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@rolldown/binding-linux-x64-musl@1.0.1':
-    resolution: {integrity: sha512-bV4fzswuzVcKD90o/VM6QqKxnxlDq0g2BISDLNVmxrnhpv1DDbyPhCIjYfvzYLV+MvkKKnQt2Q6AO86SEBULUQ==}
+  '@rolldown/binding-linux-x64-musl@1.0.3':
+    resolution: {integrity: sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@rolldown/binding-openharmony-arm64@1.0.1':
-    resolution: {integrity: sha512-/Mh0Zhq3OP7fVs0kcQHZP6lZEthMGTaSf8UBQYSFEZDWGXXlEC+nJ6EqenaK2t4LBXMe3A+K/G2BVXXdtOr4PQ==}
+  '@rolldown/binding-openharmony-arm64@1.0.3':
+    resolution: {integrity: sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [openharmony]
 
-  '@rolldown/binding-wasm32-wasi@1.0.1':
-    resolution: {integrity: sha512-+1xc9X45l8ufsBAm6Gjvx2qDRIY9lTVt0cgWNcJ+1gdhXvkbxePA60yRTwSTuXL09CMhyJmjpV7E3NoyxbqFQQ==}
+  '@rolldown/binding-wasm32-wasi@1.0.3':
+    resolution: {integrity: sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [wasm32]
 
-  '@rolldown/binding-win32-arm64-msvc@1.0.1':
-    resolution: {integrity: sha512-1D+UqZdfnuR+Jy1GgMJwi85bD40H21uNmOPRWQhw4oRSuolZ/B5rixZ45DK2KXOTCvmVCecauWgEhbw8bI7tOw==}
+  '@rolldown/binding-win32-arm64-msvc@1.0.3':
+    resolution: {integrity: sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [arm64]
     os: [win32]
 
-  '@rolldown/binding-win32-x64-msvc@1.0.1':
-    resolution: {integrity: sha512-INAycaWuhlOK3wk4mRHGsdgwYWmd9cChdPdE9bwWmy6rn9VqVNYNFGhOdXrofXUxwHIncSiPNb8tNm8knDVIeQ==}
+  '@rolldown/binding-win32-x64-msvc@1.0.3':
+    resolution: {integrity: sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     cpu: [x64]
     os: [win32]
@@ -2011,8 +1865,8 @@ packages:
       rollup:
         optional: true
 
-  '@rollup/pluginutils@5.3.0':
-    resolution: {integrity: sha512-5EdhGZtnu3V88ces7s53hhfK5KSASnJZv8Lulpc04cWO3REESroJXg73DFsOmgbU2BhwV0E20bu2IDZb3VKW4Q==}
+  '@rollup/pluginutils@5.4.0':
+    resolution: {integrity: sha512-MfPp06CjRLfXQ3wY0R8vJDYBy/MvVcc9OulEfR0B8Iv9ko+GCNaRZ+EpJYFl27LhKsZK0o420sYCRHCjfCgeUg==}
     engines: {node: '>=14.0.0'}
     peerDependencies:
       rollup: ^1.20.0||^2.0.0||^3.0.0||^4.0.0
@@ -2020,239 +1874,243 @@ packages:
       rollup:
         optional: true
 
-  '@rollup/rollup-android-arm-eabi@4.60.4':
-    resolution: {integrity: sha512-F5QXMSiFebS9hKZj02XhWLLnRpJ3B3AROP0tWbFBSj+6kCbg5m9j5JoHKd4mmSVy5mS/IMQloYgYxCuJC0fxEQ==}
+  '@rollup/rollup-android-arm-eabi@4.61.1':
+    resolution: {integrity: sha512-JnBB8MdXj45cajvTuO5FmPlvFVJRQgvrz1uSEl3NwqFnReAPGwb8EanbGi4z2nRaqLzjJSv5/JmycoTKlRZxHA==}
     cpu: [arm]
     os: [android]
 
-  '@rollup/rollup-android-arm64@4.60.4':
-    resolution: {integrity: sha512-GxxTKApUpzRhof7poWvCJHRF51C67u1R7D6DiluBE8wKU1u5GWE8t+v81JvJYtbawoBFX1hLv5Ei4eVjkWokaw==}
+  '@rollup/rollup-android-arm64@4.61.1':
+    resolution: {integrity: sha512-Jx2g7iSjw4AOT0HDPHM9RV3GNjRXwybWtSFZiZAYUTjUwjVrYIwq3kBf+LnhqJlzXFAqTAh2F7IGI+O568exPw==}
     cpu: [arm64]
     os: [android]
 
-  '@rollup/rollup-darwin-arm64@4.60.4':
-    resolution: {integrity: sha512-tua0TaJxMOB1R0V0RS1jFZ/RpURFDJIOR2A6jWwQeawuFyS4gBW+rntLRaQd0EQ4bd6Vp44Z2rXW+YYDBsj6IA==}
+  '@rollup/rollup-darwin-arm64@4.61.1':
+    resolution: {integrity: sha512-0F1L/Z3Eqv8mT2n3dCpeO8GcTvHvVqkP5/t6DMsn0KzhYVcg+s7Ncl5DS8qjKYEeio6Az0Gt6nyBORay5qIlCA==}
     cpu: [arm64]
     os: [darwin]
 
-  '@rollup/rollup-darwin-x64@4.60.4':
-    resolution: {integrity: sha512-CSKq7MsP+5PFIcydhAiR1K0UhEI1A2jWXVKHPCBZ151yOutENwvnPocgVHkivu2kviURtCEB6zUQw0vs8RrhMg==}
+  '@rollup/rollup-darwin-x64@4.61.1':
+    resolution: {integrity: sha512-qLttcH871ujY4YcVfUSShhOw+CsoTatYz8gRbHO7Bb92QH059/P0y5do1KMs41fY0BpD2x4AJH/gID0zFiqVKQ==}
     cpu: [x64]
     os: [darwin]
 
-  '@rollup/rollup-freebsd-arm64@4.60.4':
-    resolution: {integrity: sha512-+O8OkVdyvXMtJEciu2wS/pzm1IxntEEQx3z5TAVy4l32G0etZn+RsA48ARRrFm6Ri8fvqPQfgrvNxSjKAbnd3g==}
+  '@rollup/rollup-freebsd-arm64@4.61.1':
+    resolution: {integrity: sha512-fUI4RapGE0Oh3mb8mgfvC1O2nU1RpDZUKnDQm3xB1Ipg7C2wTs5Kstz7G2uWK99a8S2yTMq8/P4uycwNa0nJyw==}
     cpu: [arm64]
     os: [freebsd]
 
-  '@rollup/rollup-freebsd-x64@4.60.4':
-    resolution: {integrity: sha512-Iw3oMskH3AfNuhU0MSN7vNbdi4me/NiYo2azqPz/Le16zHSa+3RRmliCMWWQmh4lcndccU40xcJuTYJZxNo/lw==}
+  '@rollup/rollup-freebsd-x64@4.61.1':
+    resolution: {integrity: sha512-H5YrdvJaDtI/U9/emrD4b++xkvp3y/JvOe4rizHbxvkyMfRS/CiRYdji+Pl8D0brEaNFWUh1drQxgAGIl6Xudw==}
     cpu: [x64]
     os: [freebsd]
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.60.4':
-    resolution: {integrity: sha512-EIPRXTVQpHyF8WOo219AD2yEltPehLTcTMz2fn6JsatLYSzQf00hj3rulF+yauOlF9/FtM2WpkT/hJh/KJFGhA==}
+  '@rollup/rollup-linux-arm-gnueabihf@4.61.1':
+    resolution: {integrity: sha512-Q8CBCCQtDFrYtXoeUXSrnFXKOnyUhx6bz+SkL6A0E7V8kAiCJ5pamq1WtbfpVGhR5TSpXY6ak3avmDc5fHTyJA==}
     cpu: [arm]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-arm-musleabihf@4.60.4':
-    resolution: {integrity: sha512-J3Yh9PzzF1Ovah2At+lHiGQdsYgArxBbXv/zHfSyaiFQEqvNv7DcW98pCrmdjCZBrqBiKrKKe2V+aaSGWuBe/w==}
+  '@rollup/rollup-linux-arm-musleabihf@4.61.1':
+    resolution: {integrity: sha512-nwnhk1581l0FBVellGcVCAT0Oi06onEA3WB53sf01VO3I0UPBkMH9sXONYME2K0ovXcNayJfNtHfm6mpJElatQ==}
     cpu: [arm]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-arm64-gnu@4.60.4':
-    resolution: {integrity: sha512-BFDEZMYfUvLn37ONE1yMBojPxnMlTFsdyNoqncT0qFq1mAfllL+ATMMJd8TeuVMiX84s1KbcxcZbXInmcO2mRg==}
+  '@rollup/rollup-linux-arm64-gnu@4.61.1':
+    resolution: {integrity: sha512-x5Xr49hwt3hdW75UOZm3395YwwzPyauktslv29KpWL/T+vVAzoT3azLcTWv0eMciBNrx+DYjH4paehHoLpPvpg==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-arm64-musl@4.60.4':
-    resolution: {integrity: sha512-pc9EYOSlOgdQ2uPl1o9PF6/kLSgaUosia7gOuS8mB69IxJvlclko1MECXysjs5ryez1/5zjYqx3+xYU0TU6R1A==}
+  '@rollup/rollup-linux-arm64-musl@4.61.1':
+    resolution: {integrity: sha512-unMS3H73DpaoPyyEVPjGKleM/s0mkmsauTENpw4INQY8y4+IuLNjkueQ5QCtC0D3N38Y38yhAU8OoZ20S2Tm6w==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-loong64-gnu@4.60.4':
-    resolution: {integrity: sha512-NxnomyxYerDh5n4iLrNa+sH+Z+U4BMEE46V2PgQ/hoB909i8gV1M5wPojWg9fk1jWpO3IQnOs20K4wyZuFLEFQ==}
+  '@rollup/rollup-linux-loong64-gnu@4.61.1':
+    resolution: {integrity: sha512-zNZzGRnAhwjFEYmvphJRV5XaQGjs62cCmeYYHUT//NbvEnHauw+I85nGG+SiVg5ld4GX8D1IbKIX+ozITQnhMQ==}
     cpu: [loong64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-loong64-musl@4.60.4':
-    resolution: {integrity: sha512-nbJnQ8a3z1mtmrwImCYhc6BGpThAyYVRQxw9uKSKG4wR6aAYno9sVjJ0zaZcW9BPJX1GbrDPf+SvdWjgTuDmnw==}
+  '@rollup/rollup-linux-loong64-musl@4.61.1':
+    resolution: {integrity: sha512-LdpWGL8X209B2SIvWjqlc8VZgM6PKfontSerGepuldQmHYrAOtnMCXeJkxXGbC+PPZVOuu5czJo7fNV6aeW8rQ==}
     cpu: [loong64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-ppc64-gnu@4.60.4':
-    resolution: {integrity: sha512-2EU6acNrQLd8tYvo/LXW535wupT3m6fo7HKo6lr7ktQoItxTyOL1ZCR/GfGCuXl2vR+zmfI6eRXkSemafv+iVg==}
+  '@rollup/rollup-linux-ppc64-gnu@4.61.1':
+    resolution: {integrity: sha512-EC5kTtNaNGOmbMGqar8dvJy6y/hg99GAwjfBz++pxZhQATXGcRjd6c5en5wcbru0vkRmiMGsQKdMJOOf6sza4g==}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-ppc64-musl@4.60.4':
-    resolution: {integrity: sha512-WeBtoMuaMxiiIrO2IYP3xs6GMWkJP2C0EoT8beTLkUPmzV1i/UcOSVw1d5r9KBODtHKilG5yFxsGRnBbK3wJ4A==}
+  '@rollup/rollup-linux-ppc64-musl@4.61.1':
+    resolution: {integrity: sha512-8hiwp6D4acEcNK78I4rP0/XtS1sknWIAMJBPdR4l6zUtyTm5KiTDr5bXmWt4foY7nAN7AThDHgkLIEZOWKbzWw==}
     cpu: [ppc64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-riscv64-gnu@4.60.4':
-    resolution: {integrity: sha512-FJHFfqpKUI3A10WrWKiFbBZ7yVbGT4q4B5o1qKFFojqpaYoh9LrQgqWCmmcxQzVSXYtyB5bzkXrYzlHTs21MYA==}
+  '@rollup/rollup-linux-riscv64-gnu@4.61.1':
+    resolution: {integrity: sha512-10dh/h/BqA7DuMPWSxkR8uks18FRwnwOEqr5zOTEl+NOwP/OMzKX8OFR/Of9xxDA7D5qef1Nzar5WDD2kCCr1g==}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-riscv64-musl@4.60.4':
-    resolution: {integrity: sha512-mcEl6CUT5IAUmQf1m9FYSmVqCJlpQ8r8eyftFUHG8i9OhY7BkBXSUdnLH5DOf0wCOjcP9v/QO93zpmF1SptCCw==}
+  '@rollup/rollup-linux-riscv64-musl@4.61.1':
+    resolution: {integrity: sha512-YKJ5lg35DP17gcAOggnihe+APw9HLyj1Xn7gsmGumBJAUDa6NGXNixJzmkWLhcK9TOuuyQjdamzvJefkO7qHZQ==}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-s390x-gnu@4.60.4':
-    resolution: {integrity: sha512-ynt3JxVd2w2buzoKDWIyiV1pJW93xlQic1THVLXilz429oijRpSHivZAgp65KBu+cMcgf1eVVjdnTLvPxgCuoQ==}
+  '@rollup/rollup-linux-s390x-gnu@4.61.1':
+    resolution: {integrity: sha512-Mlil5G2Jj6a7B3LWGctg+XPL9vdXYuzCtNXfxOQ0nPjc2m6ueUktocPGH9bnAM0bNRKb/bAWTujUU7IJQdQA+g==}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-x64-gnu@4.60.4':
-    resolution: {integrity: sha512-Boiz5+MsaROEWDf+GGEwF8VMHGhlUoQMtIPjOgA5fv4osupqTVnJteQNKJwUcnUog2G55jYXH7KZFFiJe0TEzQ==}
+  '@rollup/rollup-linux-x64-gnu@4.61.1':
+    resolution: {integrity: sha512-bVWIOIk6pV01p4CdUbPP7CJ/434z+OooYjDuFcR+44N35YvKUC66G8MGnvcWx5mWKW3g61J+t74l3Kj15Kwn2Q==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-x64-musl@4.60.4':
-    resolution: {integrity: sha512-+qfSY27qIrFfI/Hom04KYFw3GKZSGU4lXus51wsb5EuySfFlWRwjkKWoE9emgRw/ukoT4Udsj4W/+xxG8VbPKg==}
+  '@rollup/rollup-linux-x64-musl@4.61.1':
+    resolution: {integrity: sha512-qy5pBvZbqNFheBz61R1rzsezjm0J7O2oNGoWtGoY89SZYLUfxAJTBAqDChqAIdB4rCiIbi9nF7yZ83GnNiLwSw==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-openbsd-x64@4.60.4':
-    resolution: {integrity: sha512-VpTfOPHgVXEBeeR8hZ2O0F3aSso+JDWqTWmTmzcQKted54IAdUVbxE+j/MVxUsKa8L20HJhv3vUezVPoquqWjA==}
+  '@rollup/rollup-openbsd-x64@4.61.1':
+    resolution: {integrity: sha512-E83TXjI4zm0+5f2qO+UOudaCYIhYwpJ5jq6YCZNIZ+6CbfhKrkAGezeiASBL9ElxAxFsRS9ZhESv8mfnj6TKeg==}
     cpu: [x64]
     os: [openbsd]
 
-  '@rollup/rollup-openharmony-arm64@4.60.4':
-    resolution: {integrity: sha512-IPOsh5aRYuLv/nkU51X10Bf75Bsf6+gZdx1X+QP5QM6lIJFHHqbHLG0uJn/hWthzo13UAc2umiUorqZy3axoZg==}
+  '@rollup/rollup-openharmony-arm64@4.61.1':
+    resolution: {integrity: sha512-fbWnKqVkjrJN38vNe3ahkbk6iejS/3b0Nt7EEtPpE6RBacZcGXNKbzfHN3GUUlXOPghUg0j6XUGrtjX9z1sIvA==}
     cpu: [arm64]
     os: [openharmony]
 
-  '@rollup/rollup-win32-arm64-msvc@4.60.4':
-    resolution: {integrity: sha512-4QzE9E81OohJ/HKzHhsqU+zcYYojVOXlFMs1DdyMT6qXl/niOH7AVElmmEdUNHHS/oRkc++d5k6Vy85zFs0DEw==}
+  '@rollup/rollup-win32-arm64-msvc@4.61.1':
+    resolution: {integrity: sha512-ArMl38iVAbk0New1ogihQNY6iphLi4ZaRsa037gUzv5yeKPY8TD3Dmy4x2RNC1VztU/uqm+G+/RwFrSka3Oy2g==}
     cpu: [arm64]
     os: [win32]
 
-  '@rollup/rollup-win32-ia32-msvc@4.60.4':
-    resolution: {integrity: sha512-zTPgT1YuHHcd+Tmx7h8aml0FWFVelV5N54oHow9SLj+GfoDy/huQ+UV396N/C7KpMDMiPspRktzM1/0r1usYEA==}
+  '@rollup/rollup-win32-ia32-msvc@4.61.1':
+    resolution: {integrity: sha512-0mYtjHS9ucAbcATycCNK9IGBk/cCe/ma7EmSLGZdsxnOA8cjRIyU04wDpVAD9NiOfLUR9KTxdiO53uOkherqjQ==}
     cpu: [ia32]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-gnu@4.60.4':
-    resolution: {integrity: sha512-DRS4G7mi9lJxqEDezIkKCaUIKCrLUUDCUaCsTPCi/rtqaC6D/jjwslMQyiDU50Ka0JKpeXeRBFBAXwArY52vBw==}
+  '@rollup/rollup-win32-x64-gnu@4.61.1':
+    resolution: {integrity: sha512-gK1iCEPfpoSG9wfBihXxvBMi8ZfcWffYkEsC/Eih+iFENTaewvNcrEQ69lIOWYO5pePHKLHHO7nq5AILGO/HQQ==}
     cpu: [x64]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-msvc@4.60.4':
-    resolution: {integrity: sha512-QVTUovf40zgTqlFVrKA1uXMVvU2QWEFWfAH8Wdc48IxLvrJMQVMBRjuQyUpzZCDkakImib9eVazbWlC6ksWtJw==}
+  '@rollup/rollup-win32-x64-msvc@4.61.1':
+    resolution: {integrity: sha512-X+zaP2x+j4RXGfbp/seSoRHWnPxzApilDszisZxbYH5C/jTxFhCtDNdPGZb9lJyYPs24wGxruPF7Y+sIXt9Gzw==}
     cpu: [x64]
     os: [win32]
 
   '@rtsao/scc@1.1.0':
     resolution: {integrity: sha512-zt6OdqaDoOnJ1ZYsCYGt9YmWzDXl4vQdKTyJev62gFhRGKdx7mcT54V9KIjg+d2wi9EXsPvAPKe7i7WjfVWB8g==}
 
-  '@sentry-internal/browser-utils@10.53.1':
-    resolution: {integrity: sha512-X4d6y8sBMjmNhcDW4eMBU3ASsNIMz8dqaFkhyIMN/dkYr/yZKnbRZPaVuVUGvHKjnlficPpIH0/HK9KBjrYxPw==}
+  '@sentry-internal/browser-utils@10.56.0':
+    resolution: {integrity: sha512-I8tZWAFg8SZpD8BFUpglEtSTzhZjacmcThB5/Mlq/iFiiT8mBPG4ZWDWssSfmIBKvZywJZJ83uDA0+uiJU73Tw==}
+    engines: {node: '>=18'}
+
+  '@sentry-internal/feedback@10.56.0':
+    resolution: {integrity: sha512-fkRR9JroESTIlErkht3OrH4DXKd/DbPozr2KLdX7boMo31hPu4cL9fuqzwOrwyDPRq9B4j+qEgIWB8JrTbgvmg==}
     engines: {node: '>=18'}
 
-  '@sentry-internal/feedback@10.53.1':
-    resolution: {integrity: sha512-vVpTI/aEYN5d9IgZeYJWMqVaN0+iFgidSrYNAsZTh1US5sJUzF/wrl+68KdpmCtFROrN3jiAn1oPSwL5CKvEJA==}
+  '@sentry-internal/replay-canvas@10.56.0':
+    resolution: {integrity: sha512-SDg2K0CAZT/TnhrixQGwXoi6ZsWUB+DQy3UUk0bSQm6c/5k5zFBpGOiughQN+DYsDilKREfPKmUEEnqvUjm1HQ==}
     engines: {node: '>=18'}
 
-  '@sentry-internal/replay-canvas@10.53.1':
-    resolution: {integrity: sha512-aueLaf/2prExwA76BGU5/bOXCKWqtt6jQXWA6WJQNrmKpPEtZJB4ypnpsou0McXQCF8tur2Y8U0TEkwQP13yJQ==}
+  '@sentry-internal/replay@10.56.0':
+    resolution: {integrity: sha512-DjF09hpy3TF7Km/kOZc73YJmBqcbPCxuZ5rtRs+KtVHu3Vq48xeW83qKUcFEZv20ur9UD99OAJ/gaEt//1Qbwg==}
     engines: {node: '>=18'}
 
-  '@sentry-internal/replay@10.53.1':
-    resolution: {integrity: sha512-wZNzTBYkgGUPWMuUQv7L64+OJmoCnz7GQNiTrTFK6EVAjJXFBCSsPp/nhif0bLhbk8+0g4xz633uOhpXuQbFdw==}
+  '@sentry-internal/server-utils@10.56.0':
+    resolution: {integrity: sha512-6kuZI/vAjyVKMm1cTzc2pdUmVR4Px4etMG6wnCPyFnwEaGbUKQnTynUBFpTuo/q6Js6QBQvhLNoAnO4YsOfW4w==}
     engines: {node: '>=18'}
 
   '@sentry/babel-plugin-component-annotate@5.3.0':
     resolution: {integrity: sha512-p4q8gn8wcFqZGP/s2MnJCAAd8fTikaU6A0mM97RDHQgStcrYiaS0Sc5zUNfb1V+UOLPuvdEdL6MwyxfzjYJQTA==}
     engines: {node: '>= 18'}
 
-  '@sentry/browser@10.53.1':
-    resolution: {integrity: sha512-zXF373hzUOGzUOrqd8xb1U3LQi5uYC3mwv+z5OMKUUinQlu30tTWBs7ypy6YTchtix9QlYaHWlayUF8vBZ5UjA==}
+  '@sentry/browser@10.56.0':
+    resolution: {integrity: sha512-80X3NmsGB6tLmfzXYdjzWWdVAdL5CRukGKLcRWIcNhgGjtskOmnzaGb93egEZGI5bUTbtONJ0oyscQ3Z9yoAtQ==}
     engines: {node: '>=18'}
 
   '@sentry/bundler-plugin-core@5.3.0':
     resolution: {integrity: sha512-L5T60sWdAI3qWwdg3Ptwek/0TY59PERrxyqp4XMUkroayQvGd9r5dIW9Q1kSeXX9iJ442nXbFZKAOyCKV4Z13Q==}
     engines: {node: '>= 18'}
 
-  '@sentry/cli-darwin@2.58.5':
-    resolution: {integrity: sha512-lYrNzenZFJftfwSya7gwrHGxtE+Kob/e1sr9lmHMFOd4utDlmq0XFDllmdZAMf21fxcPRI1GL28ejZ3bId01fQ==}
+  '@sentry/cli-darwin@2.58.6':
+    resolution: {integrity: sha512-udAVvcyfNa0R+95GvPz/+43/N3TC0TYKdkQ7D7jhPSzbcMc7l2fxRNN5yB3UpCA5fWFnW4toeaqwDBhb/Wh3LA==}
     engines: {node: '>=10'}
     os: [darwin]
 
-  '@sentry/cli-linux-arm64@2.58.5':
-    resolution: {integrity: sha512-/4gywFeBqRB6tR/iGMRAJ3HRqY6Z7Yp4l8ZCbl0TDLAfHNxu7schEw4tSnm2/Hh9eNMiOVy4z58uzAWlZXAYBQ==}
+  '@sentry/cli-linux-arm64@2.58.6':
+    resolution: {integrity: sha512-q8mEcNNmeXMy5i+jWT30TVpH7LcP4HD21CD5XRSPAd/a912HF6EpK0ybf/1USO14WOhoXbAGi9txwaWabSe33g==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux, freebsd, android]
 
-  '@sentry/cli-linux-arm@2.58.5':
-    resolution: {integrity: sha512-KtHweSIomYL4WVDrBrYSYJricKAAzxUgX86kc6OnlikbyOhoK6Fy8Vs6vwd52P6dvWPjgrMpUYjW2M5pYXQDUw==}
+  '@sentry/cli-linux-arm@2.58.6':
+    resolution: {integrity: sha512-pD0LAt5PcUzAinBwvDqc66x9+2CabHEv486yP0gRjWO7SakbaxmfVq/EXd8VLq/Tzi39LAu422UYK1lpW3MILw==}
     engines: {node: '>=10'}
     cpu: [arm]
     os: [linux, freebsd, android]
 
-  '@sentry/cli-linux-i686@2.58.5':
-    resolution: {integrity: sha512-G7261dkmyxqlMdyvyP06b+RTIVzp1gZNgglj5UksxSouSUqRd/46W/2pQeOMPhloDYo9yLtCN2YFb3Mw4aUsWw==}
+  '@sentry/cli-linux-i686@2.58.6':
+    resolution: {integrity: sha512-q8vNJi1eOV/4vxAFWBsEwLHoSYapaZHIf4j76KJGJXFKTkEbsjCOOsKbwUIBTQQhRgV4DFWh3ryfsPS/que4Kg==}
     engines: {node: '>=10'}
     cpu: [x86, ia32]
     os: [linux, freebsd, android]
 
-  '@sentry/cli-linux-x64@2.58.5':
-    resolution: {integrity: sha512-rP04494RSmt86xChkQ+ecBNRYSPbyXc4u0IA7R7N1pSLCyO74e5w5Al+LnAq35cMfVbZgz5Sm0iGLjyiUu4I1g==}
+  '@sentry/cli-linux-x64@2.58.6':
+    resolution: {integrity: sha512-DZu956Mhi3ZRjTBe1WdbGV46ldVbA8d2rgp/fh51GsI25zjBHah4wZnPTSzpc+YqxU6pJpg579B/r3jrIK530Q==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux, freebsd, android]
 
-  '@sentry/cli-win32-arm64@2.58.5':
-    resolution: {integrity: sha512-AOJ2nCXlQL1KBaCzv38m3i2VmSHNurUpm7xVKd6yAHX+ZoVBI8VT0EgvwmtJR2TY2N2hNCC7UrgRmdUsQ152bA==}
+  '@sentry/cli-win32-arm64@2.58.6':
+    resolution: {integrity: sha512-nj0Ff/kmAB73EPDhR8B4O9r+NUHK5GkPCkGWC+kXVemqAJWL5jcJ5KdxG0l/S0z6RoEoltID8/43/B+TaMlT7A==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [win32]
 
-  '@sentry/cli-win32-i686@2.58.5':
-    resolution: {integrity: sha512-EsuboLSOnlrN7MMPJ1eFvfMDm+BnzOaSWl8eYhNo8W/BIrmNgpRUdBwnWn9Q2UOjJj5ZopukmsiMYtU/D7ml9g==}
+  '@sentry/cli-win32-i686@2.58.6':
+    resolution: {integrity: sha512-WNZiDzPbgsEMQWq4avsQ391v/xWKJDIWWWo9GYl+N/w5qcYKkoDW7wQG7T9FasI6ENn68phChTOAPXXxbfAdOg==}
     engines: {node: '>=10'}
     cpu: [x86, ia32]
     os: [win32]
 
-  '@sentry/cli-win32-x64@2.58.5':
-    resolution: {integrity: sha512-IZf+XIMiQwj+5NzqbOQfywlOitmCV424Vtf9c+ep61AaVScUFD1TSrQbOcJJv5xGxhlxNOMNgMeZhdexdzrKZg==}
+  '@sentry/cli-win32-x64@2.58.6':
+    resolution: {integrity: sha512-R35WJ17oF4D2eqI1DR2sQQqr0fjRTt5xoP16WrTu91XM2lndRMFsnjh+/GttbxapLCBNlrjzia99MJ0PZHZpgA==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [win32]
 
-  '@sentry/cli@2.58.5':
-    resolution: {integrity: sha512-tavJ7yGUZV+z3Ct2/ZB6mg339i08sAk6HDkgqmSRuQEu2iLS5sl9HIvuXfM6xjv8fwlgFOSy++WNABNAcGHUbg==}
+  '@sentry/cli@2.58.6':
+    resolution: {integrity: sha512-baBcNPLLfUi9WuL+Tpri9BFaAdvugZIKelC5X0tt0Zdy+K0K+PCVSrnNmwMWU/HyaF/SEv6b6UHnXIdqanBlcg==}
     engines: {node: '>= 10'}
     hasBin: true
 
-  '@sentry/core@10.53.1':
-    resolution: {integrity: sha512-XG4ezlkyuAPjBC5+9kXC94rXXuqYTw9NRhfaDHssbTFaGnqBR8vQX2UUgZfY7ucbeelRDGfBu1sywoU+mB04uA==}
+  '@sentry/core@10.56.0':
+    resolution: {integrity: sha512-L+u1dIz5SANrmST5jhIwETtt4apILgKrylv12X4hKJU0PvZl+NorjeV/ty3MwzpKQPg6b6q6qMOSLc1rLpy3iQ==}
     engines: {node: '>=18'}
 
-  '@sentry/nextjs@10.53.1':
-    resolution: {integrity: sha512-pkwqrpAG//LtW5W1Odud0PLLT+rnjDjodUEbScULHVaZE6/Gt+WGBMZmtzpNM+UwhsN19/4PyO7ocLTx/IFrkQ==}
+  '@sentry/nextjs@10.56.0':
+    resolution: {integrity: sha512-63zg6UawJwW4pE+rpVj+pqy08TsaQUEfYXLITNGBmPdk4ZO7mrosYeMZ+efI1LlCmaEu0/78M/kvzPIdk33SYA==}
     engines: {node: '>=18'}
     peerDependencies:
       next: ^13.2.0 || ^14.0 || ^15.0.0-rc.0 || ^16.0.0-0
 
-  '@sentry/node-core@10.53.1':
-    resolution: {integrity: sha512-iH7SMcM/7jPbN+t7+7ussQOiIqI4BMOGt4VYWlV71/z7k0pY+YPaSvlfVkNXfISiDzFAKv0ecCY3BmsLMu1xDQ==}
+  '@sentry/node-core@10.56.0':
+    resolution: {integrity: sha512-61lD2Wjtv5Lw2F3lJarcD0ORjR4GlVxrEd6w6Of/uF3DH73dD6K3n/3wXEeCIRfV/kgiCFIrCIq76nz0LVgE5g==}
     engines: {node: '>=18'}
     peerDependencies:
       '@opentelemetry/api': ^1.9.0
@@ -2275,12 +2133,12 @@ packages:
       '@opentelemetry/semantic-conventions':
         optional: true
 
-  '@sentry/node@10.53.1':
-    resolution: {integrity: sha512-rxHVil0tJAmz+keFcZCj1LaUdgdkK66E/l0gqh2p1209PNCGoD3lnClFr6vusy1aF3zF8O9JPtuMEJzXOKhs+w==}
+  '@sentry/node@10.56.0':
+    resolution: {integrity: sha512-qvgtXHkcR4CH3fh0VEVyw4Ysc6MMiAnm727NdTTm0yU5e53erCeo2521+yfJkqmRTGiOSgwA7B5Bs+ot9j0vFQ==}
     engines: {node: '>=18'}
 
-  '@sentry/opentelemetry@10.53.1':
-    resolution: {integrity: sha512-Zok6UXla0mFOjd1YnVb1TZtQNOry9v93fXUqx8jmDaygwWM2BwvP8rBQabLz0/OZXo8+35oge+Vmw+QY5aesnA==}
+  '@sentry/opentelemetry@10.56.0':
+    resolution: {integrity: sha512-PtMudApHMHvttjos3b7JZ2gJ+nstHAOYE3vKPYB5o0WQO95ldiaYnpLKMCRIGZWF3Dk7ynrqqnBpn8LZLt+Mrg==}
     engines: {node: '>=18'}
     peerDependencies:
       '@opentelemetry/api': ^1.9.0
@@ -2288,14 +2146,14 @@ packages:
       '@opentelemetry/sdk-trace-base': ^1.30.1 || ^2.1.0
       '@opentelemetry/semantic-conventions': ^1.39.0
 
-  '@sentry/react@10.53.1':
-    resolution: {integrity: sha512-lrwNq5T/zW84l60894TpKHPcvFuc1I/Hnohecc0TfYVpIcYYuw2orCHoU4v4wgkFaJUpegVetbgdOphViyLVjA==}
+  '@sentry/react@10.56.0':
+    resolution: {integrity: sha512-HfPLyvnrydfyjRXw9Q0GMzj7w2YtEwuC9z5RrPUfarA2qpA0/J8cfGLzyFX2v0jBmA/kkj6J1uBUoSVhCTxFHg==}
     engines: {node: '>=18'}
     peerDependencies:
       react: ^16.14.0 || 17.x || 18.x || 19.x
 
-  '@sentry/vercel-edge@10.53.1':
-    resolution: {integrity: sha512-waIOoLfhi1V3xEBJ1s1hpmvvgvcorYfsfm7fQGye0PgVjcBsZUqz32N5iEwkZ2Gz3n4ZOQYibDUqARJi9tOBcw==}
+  '@sentry/vercel-edge@10.56.0':
+    resolution: {integrity: sha512-2e5rtVjLpIVYKssFcTuKsNWYJeLAnNsQCcq7Mscw1rQal5UdBgxwclw7K2SN+QHDZlKradRBdhwOU0svENOnQw==}
     engines: {node: '>=18'}
 
   '@sentry/webpack-plugin@5.3.0':
@@ -2316,32 +2174,32 @@ packages:
   '@sinonjs/samsam@8.0.3':
     resolution: {integrity: sha512-hw6HbX+GyVZzmaYNh82Ecj1vdGZrqVIn/keDTg63IgAwiQPO+xCz99uG6Woqgb4tM0mUiFENKZ4cqd7IX94AXQ==}
 
-  '@smithy/core@3.24.3':
-    resolution: {integrity: sha512-Ep/7tPamGY8mgESE3LyLKtxJyy6U52WWAqr/3wial47Sj4u3PiIF73AOGI27UyLy9duTkhZbgzodOfLV4TduZg==}
+  '@smithy/core@3.24.6':
+    resolution: {integrity: sha512-wBXDRup6UU97VKyaiRo8AssnfStPtG0oAAfpq/bC0a1YYau8pM86YB4kM6ccoVi1mS8l/UHbn9oDM+7uozr/ug==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/credential-provider-imds@4.3.3':
-    resolution: {integrity: sha512-I2Bti0DKFo2IJyN28ijCsx51BAumEYR4/1yZ1FXyBygy9MqbnMqCev4JPth/MbpRfBSRAX35hITSnAdJRo1u5w==}
+  '@smithy/credential-provider-imds@4.3.8':
+    resolution: {integrity: sha512-5cAM+KZC02sTqDt6NaLXyu50M/GNMd1eTzDVR8Lb0BBsVtu7RWHo47VPPEEv1vt3Yub6uzr+M5FHC+GtoT0USg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/fetch-http-handler@5.4.3':
-    resolution: {integrity: sha512-F+DRf8IJazRJgYog2A/yJK7eYVc0rqTlRzO+5ZxjJd4WkZoKz0IJRncf7G6t1pdVT3kryJcwuTFhN1c5m6N47A==}
+  '@smithy/fetch-http-handler@5.4.6':
+    resolution: {integrity: sha512-FEwEYJ1jlBKdhe9TPzfghEi1bP55ZeEImlDkEa62bBBYzUcnB6RUCyuiS2mqKt6ZVjUbBgcNhzfIctH+Hevx9g==}
     engines: {node: '>=18.0.0'}
 
   '@smithy/is-array-buffer@2.2.0':
     resolution: {integrity: sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==}
     engines: {node: '>=14.0.0'}
 
-  '@smithy/node-http-handler@4.7.3':
-    resolution: {integrity: sha512-/jPhevcTFPMVl6KNjbaI47iOg1zxC7IsnX4PQDGVZKMFceOXtB8IEYaB7a9VvkP/3oC60WzTeKocvSI7vLT0vA==}
+  '@smithy/node-http-handler@4.7.7':
+    resolution: {integrity: sha512-ZAFvHXrEk6K180EVhmZVg8GU5pUH5BSFqRs27JW3j1qEFx9YyYwWFx17x/MHcjALYimGAji7qEOlF1++be+G5A==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/signature-v4@5.4.3':
-    resolution: {integrity: sha512-53+75QuPl6DL+ct6vVEB51FDO5oulXr20TPV46VvJZg76lIlXNWfxi8j+G2V/t0I2qxCBOa3vX/8bmjrpFVo9g==}
+  '@smithy/signature-v4@5.4.6':
+    resolution: {integrity: sha512-Ojg4B6oIDlIr1R86xCDJt1zJWnYa0VINmqdjfe9qxWjdRivHalZ3iSlQgVqYbW0MdpFOC5XfHEWsnbmdnpIILQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/types@4.14.2':
-    resolution: {integrity: sha512-P+otAxbV4CqBybp7EkcJCrig63yE2E7PuNVOmilVMRcx/O+QDzGULTrKsq4DV13gSfak9ObPrWaHl/9bL5YcWw==}
+  '@smithy/types@4.14.3':
+    resolution: {integrity: sha512-YupL0ZWmFtJexUN2cHzkvvF/b9pKrtAIfT1o7/oY/Ppu8IYeZ+lDPM5vZdQJaSeA132dJCqojjGC9NhXeF71VQ==}
     engines: {node: '>=18.0.0'}
 
   '@smithy/util-buffer-from@2.2.0':
@@ -2361,11 +2219,11 @@ packages:
   '@swc/helpers@0.5.15':
     resolution: {integrity: sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==}
 
-  '@tanstack/query-core@5.100.11':
-    resolution: {integrity: sha512-lmE0994apShXPj8CUxgx4ch5yUJhE9k/+tVwihBvPOyerACWdBocfFg24t8+0RhtlTd7tEgchDkhlCxNssvDxw==}
+  '@tanstack/query-core@5.101.0':
+    resolution: {integrity: sha512-cQetA74EB+seWySv1TTKr828TnP0u39m6LykwDXIo84SNortpDkp30TMEjkqtYCNP9c40uT/iwl6MLiufEt0Ow==}
 
-  '@tanstack/react-query@5.100.11':
-    resolution: {integrity: sha512-J0f9s5x3LE1450nNNfYx+e/n0DMa0uOBdFJUy5r0RvmsXd4nB/n0rbHtHI1vYXhikNFan+wf51p6Tmp4c8ucrg==}
+  '@tanstack/react-query@5.101.0':
+    resolution: {integrity: sha512-rLlJXSpkqfizLWgkR5+eLeIk0MvTx/meEIR7LRjxic+qxiQP8zVjq7BqQkiCMNLQBlLfuOLqqr6KO5GtrDlmSg==}
     peerDependencies:
       react: ^18 || ^19
 
@@ -2422,24 +2280,12 @@ packages:
   '@types/chai@5.2.3':
     resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
 
-  '@types/connect@3.4.38':
-    resolution: {integrity: sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==}
-
   '@types/debug@4.1.13':
     resolution: {integrity: sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==}
 
   '@types/deep-eql@4.0.2':
     resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
 
-  '@types/eslint-scope@3.7.7':
-    resolution: {integrity: sha512-MzMFlSLBqNF2gcHWO0G1vP/YQyfvrxZ0bF+u7mzUdZ1/xK4A4sru+nraZz5i3iEIk1l1uyicaDVTB4QbbEkAYg==}
-
-  '@types/eslint@9.6.1':
-    resolution: {integrity: sha512-FXx2pKgId/WyYo2jXw63kk7/+TY7u7AziEJxJAnSFzHlqTAS3Ync6SvgYAN/k4/PQpnnVuzoMuVnByKK2qp0ag==}
-
-  '@types/estree@1.0.8':
-    resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
-
   '@types/estree@1.0.9':
     resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
 
@@ -2458,14 +2304,11 @@ packages:
   '@types/ms@2.1.0':
     resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
 
-  '@types/mysql@2.15.27':
-    resolution: {integrity: sha512-YfWiV16IY0OeBfBCk8+hXKmdTKrKlwKN1MNKAPBu5JYxLwBEZl7QzeEpGnlZb3VMGJrrGmB84gXiH+ofs/TezA==}
-
   '@types/node@17.0.45':
     resolution: {integrity: sha512-w+tIMs3rq2afQdsPJlODhoUEKzFP1ayaoyl1CcnwtIlsVe7K7bA1NGm4s3PraqTLlXnbIN84zuBlxBWo1u9BLw==}
 
-  '@types/node@25.9.1':
-    resolution: {integrity: sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg==}
+  '@types/node@25.9.2':
+    resolution: {integrity: sha512-G05zqtJhcDLb8uslf5EjCxXg9G1KQxiV8OS0R26IC//Eoyitzqe8z37I7cqvnZlrlSfgocQRfSn/AHBZJJFyGw==}
 
   '@types/normalize-package-data@2.4.4':
     resolution: {integrity: sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA==}
@@ -2473,11 +2316,8 @@ packages:
   '@types/papaparse@5.5.2':
     resolution: {integrity: sha512-gFnFp/JMzLHCwRf7tQHrNnfhN4eYBVYYI897CGX4MY1tzY9l2aLkVyx2IlKZ/SAqDbB3I1AOZW5gTMGGsqWliA==}
 
-  '@types/pg-pool@2.0.7':
-    resolution: {integrity: sha512-U4CwmGVQcbEuqpyju8/ptOKg6gEC+Tqsvj2xS9o1g71bUh8twxnC6ZL5rZKCsGN0iyH0CwgUyc9VR5owNQF9Ng==}
-
-  '@types/pg@8.15.6':
-    resolution: {integrity: sha512-NoaMtzhxOrubeL/7UZuNTrejB4MPAJ0RpxZqXQf2qXuVlTPuG6Y8p4u9dKRaue4yjmC7ZhzVO2/Yyyn25znrPQ==}
+  '@types/pg@8.20.0':
+    resolution: {integrity: sha512-bEPFOaMAHTEP1EzpvHTbmwR8UsFyHSKsRisLIHVMXnpNefSbGA1bD6CVy+qKjGSqmZqNqBDV2azOBo8TgkcVow==}
 
   '@types/prompts@2.4.9':
     resolution: {integrity: sha512-qTxFi6Buiu8+50/+3DGIWLHM6QuWsEKugJnnP6iv2Mc4ncxE4A/OJkjuVOA+5X0X1S/nq5VJRa8Lu+nwcvbrKA==}
@@ -2494,72 +2334,69 @@ packages:
   '@types/swagger-jsdoc@6.0.4':
     resolution: {integrity: sha512-W+Xw5epcOZrF/AooUM/PccNMSAFOKWZA5dasNyMujTwsBkU74njSJBpvCCJhHAJ95XRMzQrrW844Btu0uoetwQ==}
 
-  '@types/tedious@4.0.14':
-    resolution: {integrity: sha512-KHPsfX/FoVbUGbyYvk1q9MMQHLPeRZhRJZdO45Q4YjvFkv4hMNghCWTvy7rdKessBsmtz4euWCWAB6/tVpI1Iw==}
-
   '@types/whatwg-mimetype@3.0.2':
     resolution: {integrity: sha512-c2AKvDT8ToxLIOUlN51gTiHXflsfIFisS4pO7pDPoKouJCESkhZnEy623gwP9laCy5lnLDAw1vAzu2vM2YLOrA==}
 
   '@types/ws@8.18.1':
     resolution: {integrity: sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==}
 
-  '@typescript-eslint/eslint-plugin@8.59.4':
-    resolution: {integrity: sha512-PegsU+XfyJJNjd4+u/k6f9yTyp0lEXXiPopUNobZcIAUJFGICFLN+sP0Rb3JehVmiij1Ph0dFGYqODoRo/2+6A==}
+  '@typescript-eslint/eslint-plugin@8.60.1':
+    resolution: {integrity: sha512-JQ4S5GB0tfjO8BuJ4fcX+HodkzJjYBV+7OJ+wLygaX7OGQ7FudyHL4NSCA6ob+w3Yn+5MkKIozOwQhXeM7opVg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
-      '@typescript-eslint/parser': ^8.59.4
+      '@typescript-eslint/parser': ^8.60.1
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/parser@8.59.4':
-    resolution: {integrity: sha512-zORHqO/tuhxY1zWuTvMUqddRxpiFJ72xVfcNoWpqdLjs6lfPbuQBJuW4pk+49/uBMy7Ssr4bzgjiKmmDB1UbZQ==}
+  '@typescript-eslint/parser@8.60.1':
+    resolution: {integrity: sha512-A0M6ua6H252bVjPvvtSgl2QA4+ET9S5Mtkb2GDyTxIhH/C4qDItT7RQNO5PhMC6NXGYXOR9dIalcDDgBKT7oFA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/project-service@8.59.4':
-    resolution: {integrity: sha512-Ly00Vu4oAacfDeHp2Zg85ioNG6l8HG+tN1D7J+xTHSxu9y0awYKJ2zH1rFBn8ZSfuGK+7FxK3Cgl3uAz0aZZLg==}
+  '@typescript-eslint/project-service@8.60.1':
+    resolution: {integrity: sha512-eXkTH2bxmXlqD1RnOPmLZ9ZM9D3VwSx04JOwBnP9RQ+yUA5a2Mu7SfW8uaV2Aon53NJzZlZYuX7tn91Izf+xaw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/scope-manager@8.59.4':
-    resolution: {integrity: sha512-mUeR/3H1WrTAddJrwut8OoPjfauaztMQmRwV5fQTUyNVJCLiUXXe4lGEyYIL2oFDpP7UtgbGJXCt72wT0z2S3Q==}
+  '@typescript-eslint/scope-manager@8.60.1':
+    resolution: {integrity: sha512-gvI5OQoptnxQnchOirukCuQ55svJSTuD/4k5+pC267xyBtYry748R9/c3tYUzb/iE6RZfllRz2lVulLCHkTm4w==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript-eslint/tsconfig-utils@8.59.4':
-    resolution: {integrity: sha512-DLCpnKgD4alVxTBSKulK+gU1KCqOgUXfDRDXh2mZgzokQKa/70ax93I2uVO3m/LLvIAtWZIFoiifudmIqAxpMA==}
+  '@typescript-eslint/tsconfig-utils@8.60.1':
+    resolution: {integrity: sha512-nh8w4qAteiKuZu3pSSzG/yGKpw0OlkrKnzFmbVRenKaD4qc+7i1GrmZaLVkr8rk4uipiPGMOW4YsM6WmKZ5CvA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/type-utils@8.59.4':
-    resolution: {integrity: sha512-uonTuPAAKr9XaBGqJ3LjYTh72zy5DyGesljO9gtmk/eFW0W1fRHjnwVYKB35Lm8d5Q5CluEW3gPHjTvZTmgrfA==}
+  '@typescript-eslint/type-utils@8.60.1':
+    resolution: {integrity: sha512-sdwTrpjosW7ANQYJ39ZBF1ZyEMEGVB2UsikrserVM/30a/F1dTLnu9bGxEdosugyu5caigjLrR2qiD11asjI1A==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/types@8.59.4':
-    resolution: {integrity: sha512-F1o7WJcCq+bc8dwcO/YsSEOudAH8RDtaOhM6wcAQhcUsFhnWQl81JKy48q1hoxAU0qrzM89+31GYh1515Zde3Q==}
+  '@typescript-eslint/types@8.60.1':
+    resolution: {integrity: sha512-4h0tY8ppCkdCzcrl2YM5M3my0xsE1Tf8om3owEu5oPWmXwkKRmk0j0LGDzYBGUcAlesEbxBhazqu/K4cu3Ug7w==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript-eslint/typescript-estree@8.59.4':
-    resolution: {integrity: sha512-F+RuOmcDXo4+TPdfd/TCLS3m2nw8gE9XXyZLrA3JBfaA5tz9TtdkyD3YJFmPxulyc2cKbEok/CvFE3MgSLWnag==}
+  '@typescript-eslint/typescript-estree@8.60.1':
+    resolution: {integrity: sha512-alpRkfG8hlVE5kdJW2GkfgDgXxold3e8e4l6EnmhRmRLbekgAPCCGDVD++sABy9FcgPFroq+uFcCSM1vR57Cew==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/utils@8.59.4':
-    resolution: {integrity: sha512-cYXeNAUsG4lJo5dbc1FcKm+JwIWrj1/UpTORsC6tGMjEZ81DYcvIr9/ueikhMa/Y/gDQYGp+YX9/xQrXje5BJw==}
+  '@typescript-eslint/utils@8.60.1':
+    resolution: {integrity: sha512-h2MPBLoNtjc3qZWfY3Tl51yPorQ2McHn8pJfcMNTcIvrrZrr90Ykffit0yjrPFWQcRcUxzH20+6OcVdW4yHtUg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.1.0'
 
-  '@typescript-eslint/visitor-keys@8.59.4':
-    resolution: {integrity: sha512-U3gxVaDVnuZKhSspW/MzMxE1kq7zOdc072FcSNoqA1I9p8HyKbBFfEHoWckBAMgNMph4MamwS5iTVzFmrnt8TQ==}
+  '@typescript-eslint/visitor-keys@8.60.1':
+    resolution: {integrity: sha512-EbGRQg4FhrmwLodl+t3JNAnXHWVr9Vp+Zl1QBZVPY4ByfkzIT8cX3K6QWODHtkIZqqJVEWvhHSx3v5PDHsaQag==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
   '@ucast/core@1.10.2':
@@ -2700,25 +2537,25 @@ packages:
     peerDependencies:
       vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
 
-  '@vitest/coverage-istanbul@4.1.6':
-    resolution: {integrity: sha512-lOt/VDh+sihAx3OUxCE5CC0qZfAhIzE3Dxw75NJ3P0C6ruUgT9b/jZKECE1ctpbxSVic9OkLdXz5UEX39ks4Sw==}
+  '@vitest/coverage-istanbul@4.1.8':
+    resolution: {integrity: sha512-/h514nMZMKI6foh21mVgO1zlCH6pdDamwKMbla1uLU2GMxTlfp0PQMxovWozmzQdCIQYZ2XXEzg2zNZom2zAOg==}
     peerDependencies:
-      vitest: 4.1.6
+      vitest: 4.1.8
 
-  '@vitest/coverage-v8@4.1.6':
-    resolution: {integrity: sha512-36l628fQ/9a/8ihy97eOtEnvWQEdqULQOJtcaxtoNq0G1w3Mxd4szSahOaMM9/NGyZ+hyKcMtIW/WIxq0XQViQ==}
+  '@vitest/coverage-v8@4.1.8':
+    resolution: {integrity: sha512-lt3kovsyHwYe00wq4D1ti0Z974fWj4NLp6siqiyEufUpyFwK9Yhi7rBhac9JL5aA0zoMrJqc4vYPZRUnI7l7nw==}
     peerDependencies:
-      '@vitest/browser': 4.1.6
-      vitest: 4.1.6
+      '@vitest/browser': 4.1.8
+      vitest: 4.1.8
     peerDependenciesMeta:
       '@vitest/browser':
         optional: true
 
-  '@vitest/expect@4.1.6':
-    resolution: {integrity: sha512-7EHDquPthALSV0jhhjgEW8FXaviMx7rSqu8W6oqCoAuOhKov814P99QDV1pxMA3QPv21YudvJngIhjrNI4opLg==}
+  '@vitest/expect@4.1.8':
+    resolution: {integrity: sha512-h3nDO677RDLEGlBxyQ5CW8RlMThSKSRLUePLOx09gNIWRL40edgA1GCZSZgf1W55MFAG6/Sw14KeaAnqv0NKdQ==}
 
-  '@vitest/mocker@4.1.6':
-    resolution: {integrity: sha512-MCFc63czMjEInOlcY2cpQCvCN+KgbAn+60xu9cMgP4sKaLC5JNAKw7JH8QdAnoAC88hW1IiSNZ+GgVXlN1UcMQ==}
+  '@vitest/mocker@4.1.8':
+    resolution: {integrity: sha512-LEiN/xe4OSIbKe9HQIp5OC24agGD9J5CnmMgsLohVVoOPWL9a2sBoR6VBx43jQZb7Kr1l4RCuyCJzcAa0+dojw==}
     peerDependencies:
       msw: ^2.4.9
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -2728,20 +2565,20 @@ packages:
       vite:
         optional: true
 
-  '@vitest/pretty-format@4.1.6':
-    resolution: {integrity: sha512-h5SxD/IzNhZYnrSZRsUZQIC+vD0GY8cUvq0iwsmkFKixRCKLLWqCXa/FIQ4S1R+sI+PGoojkHsdNrbZiM9Qpgw==}
+  '@vitest/pretty-format@4.1.8':
+    resolution: {integrity: sha512-9GasEBxpZ1VYIpqHf/0+YGg121uSNwCKOJqIrTwWP/TB7DmFCiaBpNl3aPZzoLWfWkuqhbH8vJIVobZkvdo2cA==}
 
-  '@vitest/runner@4.1.6':
-    resolution: {integrity: sha512-nOPCmn2+yD0ZNmKdsXGv/UxMMWbMuKeD6GyYncNwdkYDxpQvrPSKYj2rWuDjC2Y4b6w6hjip5dBKFzEUuZe3vA==}
+  '@vitest/runner@4.1.8':
+    resolution: {integrity: sha512-EmVxeBAfMJvycdjd6Hm+RbFBbA9fKvo0Kx37hNpBYoYeavH3RNsBXWDooR1mgD52dCrxIIuP7UotpfiwOikvcg==}
 
-  '@vitest/snapshot@4.1.6':
-    resolution: {integrity: sha512-YhsdE6xAVfTDmzjxL2ZDUvjj+ZsgyOKe+TdQzqkD72wIOmHka8NuGQ6NpTNZv9D2Z63fbwWKJPeVpEw4EQgYxw==}
+  '@vitest/snapshot@4.1.8':
+    resolution: {integrity: sha512-acfZboRmAIf05DEKcBQy33VXojFJjtUdLyo7oOmV9kebb2xdU01UknNiPuPZoJZQyO7DF0gZdTGTpeAzET9QPQ==}
 
-  '@vitest/spy@4.1.6':
-    resolution: {integrity: sha512-JFKxMx6udhwKh/Ldo270e17QX710vgunMkuPAvXjHSvC6oqLWAHhVhjg/I71q0u0CBSErIODV1Kjv0FQNSWjdg==}
+  '@vitest/spy@4.1.8':
+    resolution: {integrity: sha512-6EevtBp6OZOPF7bmz36HrGMeP3txgVSrgebWxHOafDXGkhIzfXK14f8KF6MuFfgXXUeHxmpD3BQxkV00/3s5mA==}
 
-  '@vitest/utils@4.1.6':
-    resolution: {integrity: sha512-FxIY+U81R3LGKCxaHHFRQ5+g6/iRgGLmeHWdp2Amj4ljQRrEIWHmZyDfDYBRZlpyqA7qKxtS9DD1dhk8RnRIVQ==}
+  '@vitest/utils@4.1.8':
+    resolution: {integrity: sha512-uOJamYALNhfJ6iolExyQM40yIQwDqYnkKtQ5VCiSe17E33H0aQ/u+1GlRuz4LZBk6Mm3sg90G9hEbmEt37C1Zg==}
 
   '@vue/compiler-core@3.5.25':
     resolution: {integrity: sha512-vay5/oQJdsNHmliWoZfHPoVZZRmnSWhug0BYT34njkYTPqClh3DNWLkZNJBVSjsNMrg0CCrBfoKkjZQPM/QVUw==}
@@ -2909,8 +2746,8 @@ packages:
     resolution: {integrity: sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==}
     engines: {node: '>=12'}
 
-  anti-trojan-source@1.11.2:
-    resolution: {integrity: sha512-Nw5YUkfbMV8zgUO/I1ymqfXahO58AQfqBSBjbhBY+3+38TXepbfhE0Lxc7E9GgWc1Bxa/NulJH4eDmKRot6ejw==}
+  anti-trojan-source@1.11.3:
+    resolution: {integrity: sha512-BMib8rDunYnfIzFgBw9DIxfd3YtXYYWMMrgCQRJLdx+cyJg5/XSSEVNTpgfVn5/eBjtEfORBjPB6N7Somsr77w==}
     engines: {node: '>=14.0.0'}
     hasBin: true
 
@@ -2968,8 +2805,8 @@ packages:
     resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
     engines: {node: '>=12'}
 
-  ast-v8-to-istanbul@1.0.0:
-    resolution: {integrity: sha512-1fSfIwuDICFA4LKkCzRPO7F0hzFf0B7+Xqrl27ynQaa+Rh0e1Es0v6kWHPott3lU10AyAr7oKHa65OppjLn3Rg==}
+  ast-v8-to-istanbul@1.0.3:
+    resolution: {integrity: sha512-jCMQ6ZylLPudp0CDfBmQBZUsrh1/8psbmu9ibeVWKuHWD0YrH9YABwlKu5kVEFoT0GCQQW9Z/SxfuEbbkGQCRg==}
 
   astral-regex@2.0.0:
     resolution: {integrity: sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==}
@@ -3004,8 +2841,8 @@ packages:
   aws-sdk-client-mock@4.1.0:
     resolution: {integrity: sha512-h/tOYTkXEsAcV3//6C1/7U4ifSpKyJvb6auveAepqqNJl6TdZaPFEtKjBQNf8UxQdDP850knB2i/whq4zlsxJw==}
 
-  axios@1.16.1:
-    resolution: {integrity: sha512-caYkukvroVPO8KrzuJEb50Hm07KwfBZPEC3VeFHTsqWHvKTsy54hjJz9BS/cdaypROE2rH6xvm9mHX4fgWkr3A==}
+  axios@1.17.0:
+    resolution: {integrity: sha512-J8SwNxprqqpbfenehxWYXE7CW+wM1BB4w3+N+g+/Wx40xM4rsLrfPmHHxSWIxJLYDgSY/HqlFPIYb2/S3rxafw==}
 
   balanced-match@4.0.4:
     resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
@@ -3017,8 +2854,8 @@ packages:
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
-  baseline-browser-mapping@2.10.31:
-    resolution: {integrity: sha512-MujYO3eP72uvmSE0i4wltsodRfIpZATP3jvzRNRGGxgzId7aVocVJJV3nf01qnzzKFGxQVC9bpWxl5cjxTr/7Q==}
+  baseline-browser-mapping@2.10.34:
+    resolution: {integrity: sha512-IMDedajPifLnHNY0X9n8hKxRTQ6/eTHwr5bDo04WnuqxyKw6LYtQywCuuqPZwhl3aBXMvQpJov42GLCwRRdQzw==}
     engines: {node: '>=6.0.0'}
     hasBin: true
 
@@ -3056,12 +2893,13 @@ packages:
   buffer-from@1.1.2:
     resolution: {integrity: sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==}
 
+  buffer-image-size@0.6.4:
+    resolution: {integrity: sha512-nEh+kZOPY1w+gcCMobZ6ETUp9WfibndnosbpwB1iJk/8Gt5ZF2bhS6+B6bPYz424KtwsR6Rflc3tCz1/ghX2dQ==}
+    engines: {node: '>=4.0'}
+
   buffer@5.6.0:
     resolution: {integrity: sha512-/gDYp/UtU0eA1ys8bOs9J6a+E/KWIY+DZ+Q2WESNUA0jFRsJOc0SNUO6xJ5SGA1xueg3NL65W6s+NY5l9cunuw==}
 
-  bundle-n-require@1.1.2:
-    resolution: {integrity: sha512-bEk2jakVK1ytnZ9R2AAiZEeK/GxPUM8jvcRxHZXifZDMcjkI4EG/GlsJ2YGSVYT9y/p/gA9/0yDY8rCGsSU6Tg==}
-
   bytes@3.1.2:
     resolution: {integrity: sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==}
     engines: {node: '>= 0.8'}
@@ -3105,8 +2943,8 @@ packages:
     resolution: {integrity: sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==}
     engines: {node: '>=10'}
 
-  caniuse-lite@1.0.30001793:
-    resolution: {integrity: sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==}
+  caniuse-lite@1.0.30001797:
+    resolution: {integrity: sha512-l8xKG+gwAIExZGl9FrF7KUwuOmk6wbEPC9Xoy/RtnWv1XG0Q4LFlagaLpUv3Kiza3W/wm27zy0yWJEieYKAP6w==}
 
   chai@6.2.2:
     resolution: {integrity: sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==}
@@ -3296,8 +3134,8 @@ packages:
     resolution: {integrity: sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ==}
     engines: {node: '>= 0.4'}
 
-  dayjs@1.11.20:
-    resolution: {integrity: sha512-YbwwqR/uYpeoP4pu043q+LTDLFBLApUP6VxRihdfNTqu4ubqMlGDLd6ErXhEgsyvY0K6nCs7nggYumAN+9uEuQ==}
+  dayjs@1.11.21:
+    resolution: {integrity: sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA==}
 
   debug@3.2.7:
     resolution: {integrity: sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==}
@@ -3436,8 +3274,8 @@ packages:
   eight-colors@1.3.3:
     resolution: {integrity: sha512-4B54S2Qi4pJjeHmCbDIsveQZWQ/TSSQng4ixYJ9/SYHHpeS5nYK0pzcHvWzWUfRsvJQjwoIENhAwqg59thQceg==}
 
-  electron-to-chromium@1.5.359:
-    resolution: {integrity: sha512-8lPELWuYZIWk7NDvCNthtmMw/7Q5Wu25NpM4djFMHBmk8DubPAtL4YTOp7ou0e7HyJtwkVlWv8XMLURnrtgJQw==}
+  electron-to-chromium@1.5.368:
+    resolution: {integrity: sha512-7RckJJK4uESJF9PxvfMWd3TGqIiieUTG4HxnKaKuIpGbcr+r2ZEB3g2gAhCP3Fqm42vJSzLfgab9eva/C4/XVw==}
 
   emoji-regex@10.6.0:
     resolution: {integrity: sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==}
@@ -3449,8 +3287,8 @@ packages:
     resolution: {integrity: sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==}
     engines: {node: '>= 0.8'}
 
-  enhanced-resolve@5.22.0:
-    resolution: {integrity: sha512-xYcDWrpELkFzz9SpZ3PlI6Eu6eD93Yf0WLDRxikGhWJ3MAir2SNZTIVCVZqZ/NUyx8AdMc2gT9C0gPiw18kG+A==}
+  enhanced-resolve@5.23.0:
+    resolution: {integrity: sha512-yJN/BOOLxcOW2aQgeif9mSnaUB8KtvmMMp56oA1kx1CRfBKbhZm2pJ+NBY+3eOboHxix8lfjWpHE0Ei5U8RbSA==}
     engines: {node: '>=10.13.0'}
 
   entities@4.5.0:
@@ -3491,8 +3329,8 @@ packages:
   es-module-lexer@2.1.0:
     resolution: {integrity: sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==}
 
-  es-object-atoms@1.1.1:
-    resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
+  es-object-atoms@1.1.2:
+    resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
     engines: {node: '>= 0.4'}
 
   es-set-tostringtag@2.1.0:
@@ -3546,8 +3384,8 @@ packages:
   eslint-import-resolver-node@0.3.10:
     resolution: {integrity: sha512-tRrKqFyCaKict5hOd244sL6EQFNycnMQnBe+j8uqGNXYzsImGbGUU4ibtoaBmv5FLwJwcFJNeg1GeVjQfbMrDQ==}
 
-  eslint-import-resolver-typescript@4.4.4:
-    resolution: {integrity: sha512-1iM2zeBvrYmUNTj2vSC/90JTHDth+dfOfiNKkxApWRsTJYNrc8rOdxxIf5vazX+BiAXTeOT0UvWpGI/7qIWQOw==}
+  eslint-import-resolver-typescript@4.4.5:
+    resolution: {integrity: sha512-nbE5XLph6TLtGYcu/U6e6ZVXyKBhbDWK5cLGk76eJ7NdZpwf1P9EFkpt1Z01mNZNrrilsAYWKH6zUkL4reoXbw==}
     engines: {node: ^16.17.0 || >=18.6.0}
     peerDependencies:
       eslint: '*'
@@ -3559,8 +3397,8 @@ packages:
       eslint-plugin-import-x:
         optional: true
 
-  eslint-module-utils@2.12.1:
-    resolution: {integrity: sha512-L8jSWTze7K2mTg0vos/RuLRS5soomksDPoJLXIslC7c8Wmut3bx7CPpJijDcBZtxQ5lrbUdM+s0OlNbz0DCDNw==}
+  eslint-module-utils@2.13.0:
+    resolution: {integrity: sha512-bLohSkT6469rRs8czj0tLTD8vaeIS/whvPRJVjDr7IuoTT1k5DYDERlNycjDj/HkOlvQdYurmfZ/g3fG5bgeLQ==}
     engines: {node: '>=4'}
     peerDependencies:
       '@typescript-eslint/parser': '*'
@@ -3676,8 +3514,8 @@ packages:
     resolution: {integrity: sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==}
     engines: {node: '>=0.8.x'}
 
-  eventsource-parser@3.0.8:
-    resolution: {integrity: sha512-70QWGkr4snxr0OXLRWsFLeRBIRPuQOvt4s8QYjmUlmlkyTZkRqS7EDVRZtzU3TiyDbXSzaOeF0XUKy8PchzukQ==}
+  eventsource-parser@3.1.0:
+    resolution: {integrity: sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg==}
     engines: {node: '>=18.0.0'}
 
   eventsource@3.0.7:
@@ -3701,9 +3539,6 @@ packages:
   exsolve@1.0.8:
     resolution: {integrity: sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==}
 
-  fast-content-type-parse@3.0.0:
-    resolution: {integrity: sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==}
-
   fast-deep-equal@3.1.3:
     resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
 
@@ -3730,8 +3565,8 @@ packages:
   fast-xml-builder@1.2.0:
     resolution: {integrity: sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==}
 
-  fast-xml-parser@5.7.3:
-    resolution: {integrity: sha512-C0AaNuC+mscy6vrAQKAc/rMq+zAPHodfHGZu4sGVehvAQt/JLG1O5zEcYcXSY5zSqr4YVgxsB+pHXTq0i7eDlg==}
+  fast-xml-parser@5.8.0:
+    resolution: {integrity: sha512-6bIM7fsJxeo3uXv7OncQYsBAMPJ7V16Slahl/6M98C/i2q+vB1+4a0MtrvYwDFEUrwDSbAmeLDRXsOBwrL7yAg==}
     hasBin: true
 
   fastq@1.20.1:
@@ -3794,9 +3629,6 @@ packages:
     resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==}
     engines: {node: '>= 6'}
 
-  forwarded-parse@2.1.2:
-    resolution: {integrity: sha512-alTFZZQDKMporBH77856pXgzhEzaUVmLCDk+egLgIgHst3Tpndzz8MnKe+GzRJRfvVdn69HhpW7cmXzvtLvJAw==}
-
   forwarded@0.2.0:
     resolution: {integrity: sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==}
     engines: {node: '>= 0.6'}
@@ -3917,8 +3749,8 @@ packages:
   graceful-fs@4.2.11:
     resolution: {integrity: sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
 
-  happy-dom@20.9.0:
-    resolution: {integrity: sha512-GZZ9mKe8r646NUAf/zemnGbjYh4Bt8/MqASJY+pSm5ZDtc3YQox+4gsLI7yi1hba6o+eCsGxpHn5+iEVn31/FQ==}
+  happy-dom@20.10.1:
+    resolution: {integrity: sha512-awPoqPjx8CgjapJllyDlgzgVHjBExcitKK5ZJkxwhQJyQpHFkyS2bEcqCm7IeW20cQvuCI0cz2Ifq79CJKqtiw==}
     engines: {node: '>=20.0.0'}
 
   hard-rejection@2.1.0:
@@ -3948,8 +3780,8 @@ packages:
     resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
     engines: {node: '>= 0.4'}
 
-  hasown@2.0.3:
-    resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
     engines: {node: '>= 0.4'}
 
   hermes-estree@0.25.1:
@@ -3962,8 +3794,8 @@ packages:
     resolution: {integrity: sha512-Xwwo44whKBVCYoliBQwaPvtd/2tYFkRQtXDWj1nackaV2JPXx3L0+Jvd8/qCJ2p+ML0/XVkJ2q+Mr+UVdpJK5w==}
     engines: {node: '>=12.0.0'}
 
-  hono@4.12.21:
-    resolution: {integrity: sha512-uV63apnb0kyPtAUwoWgaGh9HyIFcv8lgmzPZSiTBQAFOFGIzka5EZ1dZocmGnn0XdX0+XTqJ6Tqv7selMuGLRQ==}
+  hono@4.12.23:
+    resolution: {integrity: sha512-eIaZ9qDgu7XV0pxOCrg7/WhnQ6Ivm22UcxhXx/A3dcbqbbYgBEkc6e/J/s7j2tS96zoB0S9VBdLwQNCWwUo4LA==}
     engines: {node: '>=16.9.0'}
 
   hosted-git-info@4.1.0:
@@ -4013,9 +3845,6 @@ packages:
     resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==}
     engines: {node: '>=6'}
 
-  import-in-the-middle@2.0.6:
-    resolution: {integrity: sha512-3vZV3jX0XRFW3EJDTwzWoZa+RH1b8eTTx6YOCjglrLyPuepwoBti1k3L2dKwdCUrnVEfc5CuRuGstaC/uQJJaw==}
-
   import-in-the-middle@3.0.1:
     resolution: {integrity: sha512-pYkiyXVL2Mf3pozdlDGV6NAObxQx13Ae8knZk1UJRJ6uRW/ZRmTGHlQYtrsSl7ubuE5F8CD1z+s1n4RHNuTtuA==}
     engines: {node: '>=18'}
@@ -4239,8 +4068,8 @@ packages:
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
-  js-yaml@4.1.1:
-    resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
+  js-yaml@4.2.0:
+    resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==}
     hasBin: true
 
   jsesc@3.1.0:
@@ -4331,8 +4160,8 @@ packages:
   koa-static-resolver@1.0.6:
     resolution: {integrity: sha512-ZX5RshSzH8nFn05/vUNQzqw32nEigsPa67AVUr6ZuQxuGdnCcTLcdgr4C81+YbJjpgqKHfacMBd7NmJIbj7fXw==}
 
-  koa@3.2.0:
-    resolution: {integrity: sha512-TrM4/tnNY7uJ1aW55sIIa+dqBvc4V14WRIAlGcWat9wV5pRS9Wr5Zk2ZTjQP1jtfIHDoHiSbPuV08P0fUZo2pg==}
+  koa@3.2.1:
+    resolution: {integrity: sha512-e7IpWJrnanNUroVK2taAgMxoEZvHLXdQiNjeExSu/DEIWm83jaKGBgb7tLmu2rMYpA027qFB3iLR/k3AVpFRnA==}
     engines: {node: '>= 18'}
 
   kysely-codegen@0.20.0:
@@ -4403,8 +4232,8 @@ packages:
     engines: {node: '>=16'}
     hasBin: true
 
-  libphonenumber-js@1.13.2:
-    resolution: {integrity: sha512-S3kmBrptp3yRTm83NUcHy9g1vbwiWMzI8WvY22+koBJ6zkRteLnedBL2VX0MIAGwx2yiyxX4J85pceZyQ6ffgg==}
+  libphonenumber-js@1.13.6:
+    resolution: {integrity: sha512-NdB6O6QvlGMCoG003m0YIKG2+Xw7DjmCZhmc1RH+K6HncADUbRf8TZeLegxBBN1VFyPHcNpPTKpIhYLXzJVy1Q==}
 
   lightningcss-android-arm64@1.31.1:
     resolution: {integrity: sha512-HXJF3x8w9nQ4jbXRiNppBCqeZPIAfUo8zE/kOEGbW5NZvGc/K7nMxbhIr+YlFlHW5mpbg/YFPdbnCh1wAXCKFg==}
@@ -4623,8 +4452,8 @@ packages:
     resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
     hasBin: true
 
-  lru-cache@11.4.0:
-    resolution: {integrity: sha512-W+R+kFL4HgVxONq2bhXPi3bGpzGe/yEhVOp233qw9wCRtgncJ15P3bC+e4zZMu4Cq7d+WAJjXGW0uUkifhcatA==}
+  lru-cache@11.5.1:
+    resolution: {integrity: sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==}
     engines: {node: 20 || >=22}
 
   lru-cache@5.1.1:
@@ -4751,8 +4580,8 @@ packages:
   module-details-from-path@1.0.4:
     resolution: {integrity: sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w==}
 
-  monocart-coverage-reports@2.12.11:
-    resolution: {integrity: sha512-yo4/FdUdFIWoc9OjhBZCNXM95tYHS4e8nov9Q3AGbpvteT/W5aQSc4B+Q0nhmedZFvjvm3BUH/Xu9GT2n/0wkw==}
+  monocart-coverage-reports@2.12.12:
+    resolution: {integrity: sha512-d9FdUr2dn58Crweon0IE0zVi8r/i4vLvfvb2G7eL5vL5LfrxCB2X6F6qzuiwV6RioA4zbAI//7CYi6LjCvN3zA==}
     hasBin: true
 
   monocart-locator@1.0.3:
@@ -4802,8 +4631,8 @@ packages:
     peerDependencies:
       next: '>=9'
 
-  next@16.2.6:
-    resolution: {integrity: sha512-qOVgKJg1+At15NpeUP+eJgCHvTCgXsogweq87Ri/Ix7PkqQHg4sdaXmSFqKlgaIXE4kW0g25LE68W87UANlHtw==}
+  next@16.2.7:
+    resolution: {integrity: sha512-eMJxgjRzBaj3olkP4cBamHDXL79A8FC6u1GcsO1D1Tsx8bw/LLXUJCaoajVxtnhD3A1IJqIT8IcRJjgBIPJq4w==}
     engines: {node: '>=20.9.0'}
     hasBin: true
     peerDependencies:
@@ -4826,10 +4655,6 @@ packages:
   nise@6.1.5:
     resolution: {integrity: sha512-SnRDPDBjxZZoU2n0+gzzLtSvo1OZo7j6jnbXsoh3AFxEGhaFU7ZF0TmefuKERq79wxR2U+MPn7ArW+Tl+clC3A==}
 
-  node-eval@2.0.0:
-    resolution: {integrity: sha512-Ap+L9HznXAVeJj3TJ1op6M6bg5xtTq8L5CU/PJxtkhea/DrIxdTknGKIECKd/v/Lgql95iuMAYvIzBNd0pmcMg==}
-    engines: {node: '>= 4'}
-
   node-exports-info@1.6.0:
     resolution: {integrity: sha512-pyFS63ptit/P5WqUkt+UUfe+4oevH+bFeIiPPdfb0pFeYEu/1ELnJu5l+5EcTKYL5M7zaAa7S8ddywgXypqKCw==}
     engines: {node: '>= 0.4'}
@@ -4846,11 +4671,12 @@ packages:
       encoding:
         optional: true
 
-  node-releases@2.0.44:
-    resolution: {integrity: sha512-5WUyunoPMsvvEhS8AxHtRzP+oA8UCkJ7YRxatWKjngndhDGLiqEVAQKWjFAiAiuL8zMRGzGSJxFnLetoa43qGQ==}
+  node-releases@2.0.47:
+    resolution: {integrity: sha512-Uzmd6LXpouKo8EUK68IjH4+E01w/hXyV3R3g/geCJo+rXLNfh1xucB+LOzYEOQPSiUK3h/xZf0cQGcSsmyL2Og==}
+    engines: {node: '>=18'}
 
-  nodemailer@8.0.7:
-    resolution: {integrity: sha512-pkjE4mkBzQjdJT4/UmlKl3pX0rC9fZmjh7c6C9o7lv66Ac6w9WCnzPzhbPNxwZAzlF4mdq4CSWB5+FbK6FWCow==}
+  nodemailer@8.0.10:
+    resolution: {integrity: sha512-BLFuSth7QtHOkBzyqTehWWyub0NTRDuK2Q2SQfnGLsrJnzyU+Yeh4WpV1eZGuARFj1xQJHIdnTuJZLP+b9R1GQ==}
     engines: {node: '>=6.0.0'}
 
   normalize-package-data@3.0.3:
@@ -4898,8 +4724,9 @@ packages:
     resolution: {integrity: sha512-gXah6aZrcUxjWg2zR2MwouP2eHlCBzdV4pygudehaKXSGW4v2AsRQUK+lwwXhii6KFZcunEnmSUoYp5CXibxtA==}
     engines: {node: '>= 0.4'}
 
-  obug@2.1.1:
-    resolution: {integrity: sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==}
+  obug@2.1.2:
+    resolution: {integrity: sha512-AWGB9WFcRXOQs48Z/udjI5ZcZMHXwX8XPByNpOydgcGsDLIzjGizhoMWJyKAWze7AVW/2W1i+/gPX4YtKe5cyg==}
+    engines: {node: '>=12.20.0'}
 
   ofetch@1.5.1:
     resolution: {integrity: sha512-2W4oUZlVaqAPAil6FUg/difl6YhqhUR7x2eZY4bQCko22UXg3hptq9KLQdqFClV+Wu85UX7hNtdGTngi/1BxcA==}
@@ -5221,8 +5048,8 @@ packages:
     peerDependencies:
       react: '>= 16.8 || 18.0.0'
 
-  react-error-boundary@6.1.1:
-    resolution: {integrity: sha512-BrYwPOdXi5mqkk5lw+Uvt0ThHx32rCt3BkukS4X23A2AIWDPSGX6iaWTc0y9TU/mHDA/6qOSGel+B2ERkOvD1w==}
+  react-error-boundary@6.1.2:
+    resolution: {integrity: sha512-3DpCr5HVdZ0caUjYE/kIHBEJN0mNP3ZCgf16c48uJ5TbWjorKVp+YG8W3XqlJ7vJAVNw6wNIImyPXmFydwmyng==}
     peerDependencies:
       react: ^18.0.0 || ^19.0.0
 
@@ -5243,8 +5070,8 @@ packages:
       react: ^0.14 || ^15.0.0 || ^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^0.14 || ^15.0.0 || ^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
-  react-phone-number-input@3.4.16:
-    resolution: {integrity: sha512-ix1+SIyGuLxnlAeW+XQNhwOmmDd4Zmr6Ng1eQl0E2XS8xIuue3gdZeBG4LGTMjTIFneOTO9pUPL+AEDhV6+r+A==}
+  react-phone-number-input@3.4.17:
+    resolution: {integrity: sha512-1wcjhBAWHgEBAGLi5/XbeZI7Q3aEHNb2z/dHY6R2Gz70TQvu0ZoOT28NTdwtZf4lyRKXWufnTzVhLPBUD8LfmQ==}
     peerDependencies:
       react: '>=16.8'
       react-dom: '>=16.8'
@@ -5335,8 +5162,9 @@ packages:
     resolution: {integrity: sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==}
     engines: {node: '>= 0.4'}
 
-  remeda@2.34.1:
-    resolution: {integrity: sha512-k5iIF3lHm2NQ+2bNGDvZTD5jZl/JZkCS6AQOfGjYBd7V4rbb3K5whHvab0/O7CqPI43vYzbnIVCQXQJqmOyI6w==}
+  remeda@2.37.0:
+    resolution: {integrity: sha512-wN6BXWua0t4o7vDamqc27J3VRxnokG9cDezsFN2nOnt2JD/IkJQHTYqM6UvmEctAZETAoviwEFQZJO3kZ4Ohew==}
+    engines: {node: '>=18.0.0'}
 
   require-directory@2.1.1:
     resolution: {integrity: sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==}
@@ -5373,13 +5201,13 @@ packages:
   rfdc@1.4.1:
     resolution: {integrity: sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==}
 
-  rolldown@1.0.1:
-    resolution: {integrity: sha512-X0KQHljNnEkWNqqiz9zJrGunh1B0HgOxLXvnFpCOcadzcy5qohZ3tqMEUg00vncoRovXuK3ZqCT9KnnKzoInFQ==}
+  rolldown@1.0.3:
+    resolution: {integrity: sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
 
-  rollup@4.60.4:
-    resolution: {integrity: sha512-WHeFSbZYsPu3+bLoNRUuAO+wavNlocOPf3wSHTP7hcFKVnJeWsYlCDbr3mTS14FCizf9ccIxXA8sGL8zKeQN3g==}
+  rollup@4.61.1:
+    resolution: {integrity: sha512-I4KW6iuRpuu2uHBLraZ1wNZe0DP7lnRha+VJ9tNaYVaVgKhW0aI3h4RYnoRPeql0flHm/Co55b7snEDcOfOJrA==}
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
@@ -5422,8 +5250,8 @@ packages:
     resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
     hasBin: true
 
-  semver@7.8.0:
-    resolution: {integrity: sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==}
+  semver@7.8.2:
+    resolution: {integrity: sha512-c8jsqUZm3omBOI66G90z1Dyw5z622G8oLG+omfsHBJf3CWQTlOcwOjvOG6wtiNfW6anKm/eA39LMwMtMez2TiQ==}
     engines: {node: '>=10'}
     hasBin: true
 
@@ -5469,8 +5297,8 @@ packages:
     resolution: {integrity: sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==}
     engines: {node: '>= 0.4'}
 
-  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/2e35d3bb56f02bfc0e6d5cd9d83c54637ed0ac20:
-    resolution: {gitHosted: true, integrity: sha512-P0G+iFlGfqxr8HaPNmYixChwfV99gEqDfuDN2Ft1AQ0DYABaBy32fncswHa0mxgQQRVpFwQzth7j0o8yWGgcCA==, tarball: https://codeload.github.com/safeinsights/encryption/tar.gz/2e35d3bb56f02bfc0e6d5cd9d83c54637ed0ac20}
+  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/2c495dae94942895a34e64d91f83809750867f4e:
+    resolution: {gitHosted: true, tarball: https://codeload.github.com/safeinsights/encryption/tar.gz/2c495dae94942895a34e64d91f83809750867f4e}
     version: 0.0.1
 
   side-channel-list@1.0.1:
@@ -5603,12 +5431,12 @@ packages:
   string.prototype.repeat@1.0.0:
     resolution: {integrity: sha512-0u/TldDbKD8bFCQ/4f5+mNRrXwZ8hg2w7ZR8wa16e8z9XpePWl3eGEcUD0OXpEH/VJH/2G3gjUtR3ZOiBe2S/w==}
 
-  string.prototype.trim@1.2.10:
-    resolution: {integrity: sha512-Rs66F0P/1kedk5lyYyH9uBzuiI/kNRmwJAR9quK6VOtIpZ2G+hMZd+HQbbv25MgCA6gEffoMZYxlTod4WcdrKA==}
+  string.prototype.trim@1.2.11:
+    resolution: {integrity: sha512-PwvK7BU+CMTJGYQCTZb5RWXIML92lftJLhQz1tBzgKiqGxJaMlBAa48POXaNAC2s4y8jr3EFqrkF9+44neS46w==}
     engines: {node: '>= 0.4'}
 
-  string.prototype.trimend@1.0.9:
-    resolution: {integrity: sha512-G7Ok5C6E/j4SGfyLCloXTrngQIQU3PWtXGst3yM7Bea9FRURf1S42ZHlZZtsNque2FN2PoUhfZXYLNWwEr4dLQ==}
+  string.prototype.trimend@1.0.10:
+    resolution: {integrity: sha512-2+3aDAOmPTmuFwjDnmJG2ctEkQKVki7vOSqaxkv42Mowj1V6PnvuwFCRrR5lChUux1TBskPjfkeTOhqczDMxTw==}
     engines: {node: '>= 0.4'}
 
   string.prototype.trimstart@1.0.8:
@@ -5698,8 +5526,8 @@ packages:
   terminal-columns@1.4.1:
     resolution: {integrity: sha512-IKVL/itiMy947XWVv4IHV7a0KQXvKjj4ptbi7Ew9MPMcOLzkiQeyx3Gyvh62hKrfJ0RZc4M1nbhzjNM39Kyujw==}
 
-  terser-webpack-plugin@5.6.0:
-    resolution: {integrity: sha512-Eum+5ajkaOhf5KbM26osvv21kLD7BaGqQ1UA4Ami4arYwylmGUQTgHFpHDdmJod1q4QXa66p0to/FBKID+J1vA==}
+  terser-webpack-plugin@5.6.1:
+    resolution: {integrity: sha512-201R5j+sJpK8nFWwKVyNfZot8FaJbLZDq5evriVzbV1wDtSXDjRUDRfJzHpAaxFDMEhsZL1QkeqM61wgsS3KaQ==}
     engines: {node: '>= 10.13.0'}
     peerDependencies:
       '@minify-html/node': '*'
@@ -5753,12 +5581,12 @@ packages:
   tinybench@2.9.0:
     resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
 
-  tinyexec@1.1.2:
-    resolution: {integrity: sha512-dAqSqE/RabpBKI8+h26GfLq6Vb3JVXs30XYQjdMjaj/c2tS8IYYMbIzP599KtRj7c57/wYApb3QjgRgXmrCukA==}
+  tinyexec@1.2.4:
+    resolution: {integrity: sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==}
     engines: {node: '>=18'}
 
-  tinyglobby@0.2.16:
-    resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==}
+  tinyglobby@0.2.17:
+    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
     engines: {node: '>=12.0.0'}
 
   tinyrainbow@3.1.0:
@@ -5877,12 +5705,12 @@ packages:
     resolution: {integrity: sha512-bTlAFB/FBYMcuX81gbL4OcpH5PmlFHqlCCpAl8AlEzMz5k53oNDvN8p1PNOWLEmI2x4orp3raOFB51tv9X+MFQ==}
     engines: {node: '>= 0.4'}
 
-  typed-array-length@1.0.7:
-    resolution: {integrity: sha512-3KS2b+kL7fsuk/eJZ7EQdnEmQoaho/r6KUef7hxvltNA5DR8NAUM+8wJMbJyZ4G9/7i3v5zPBIMN5aybAh2/Jg==}
+  typed-array-length@1.0.8:
+    resolution: {integrity: sha512-phPGCwqr2+Qo0fwniCE8e4pKnGu/yFb5nD5Y8bf0EEeiI5GklnACYA9GFy/DrAeRrKHXvHn+1SUsOWgJp6RO+g==}
     engines: {node: '>= 0.4'}
 
-  typescript-eslint@8.59.4:
-    resolution: {integrity: sha512-Rw6+44QNFaXtgHSjPy+Kw8hrJniMYzR85E9yLmOLcfZ91/rz+JXQbDTCmc6ccxMPY6K6PgAq26f0JCBfR7LIPQ==}
+  typescript-eslint@8.60.1:
+    resolution: {integrity: sha512-6m5hkkRAp8lKvhVpcprAIn5KkehQEh+47oHH2VGnExEh7dhNxXlg6GPAOIu6TxbVQxhebrJDvjl3020ooiWCMA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
@@ -6004,8 +5832,8 @@ packages:
     resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==}
     engines: {node: '>= 0.8'}
 
-  vite@8.0.13:
-    resolution: {integrity: sha512-MFtjBYgzmSxmgA4RAfjIyXWpGe1oALnjgUTzzV7QLx/TKxCzjtMH6Fd9/eVK+5Fg1qNoz5VAwsmMs/NofrmJvw==}
+  vite@8.0.16:
+    resolution: {integrity: sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -6050,20 +5878,20 @@ packages:
   vitest-monocart-coverage@4.0.2:
     resolution: {integrity: sha512-A/S4UosZ7FMrMYHF5V7OjTb5frhh8uUZVCEe9dlfX1q+isDcbp+fEUx5Ocl+VGop0g+lRbQsDk/XmquJrz/HUg==}
 
-  vitest@4.1.6:
-    resolution: {integrity: sha512-6lvjbS3p9b4CrdCmguzbh2/4uoXhGE2q71R4OX5sqF9R1bo9Xd6fGrMAfvp5wnCzlBnFVdCOp6onuTQVbo8iUQ==}
+  vitest@4.1.8:
+    resolution: {integrity: sha512-flY6ScbCIt9HThs+C5HS7jvGOB560DJtk/Z15IQROTA6zEy49Nh8T/dofWTQL+n3vswqn87sbJNiuqw1SDp5Ig==}
     engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
     hasBin: true
     peerDependencies:
       '@edge-runtime/vm': '*'
       '@opentelemetry/api': ^1.9.0
       '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
-      '@vitest/browser-playwright': 4.1.6
-      '@vitest/browser-preview': 4.1.6
-      '@vitest/browser-webdriverio': 4.1.6
-      '@vitest/coverage-istanbul': 4.1.6
-      '@vitest/coverage-v8': 4.1.6
-      '@vitest/ui': 4.1.6
+      '@vitest/browser-playwright': 4.1.8
+      '@vitest/browser-preview': 4.1.8
+      '@vitest/browser-webdriverio': 4.1.8
+      '@vitest/coverage-istanbul': 4.1.8
+      '@vitest/coverage-v8': 4.1.8
+      '@vitest/ui': 4.1.8
       happy-dom: '*'
       jsdom: '*'
       vite: ^6.0.0 || ^7.0.0 || ^8.0.0
@@ -6102,8 +5930,8 @@ packages:
     resolution: {integrity: sha512-HPuy+uuoTCaaoEoI1LQ3JN9+vrPBvEesnnX1jADHy728cHSMlq4wUc4afYqahq2B1mhQVZxCXOkNTnXltr+2vQ==}
     engines: {node: '>=10.13.0'}
 
-  webpack@5.106.2:
-    resolution: {integrity: sha512-wGN3qcrBQIFmQ/c0AiOAQBvrZ5lmY8vbbMv4Mxfgzqd/B6+9pXtLo73WuS1dSGXM5QYY3hZnIbvx+K1xxe6FyA==}
+  webpack@5.107.2:
+    resolution: {integrity: sha512-v7RhXaJbpMlV0D7hC7lb2EbnxkoeUqf9qhKr6lozx3Q48pmFrqqNRmZFUEGmi7pSwm6fCQ2H1IjvCkHqdpVdjQ==}
     engines: {node: '>=10.13.0'}
     hasBin: true
     peerDependencies:
@@ -6131,8 +5959,8 @@ packages:
     resolution: {integrity: sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==}
     engines: {node: '>= 0.4'}
 
-  which-typed-array@1.1.20:
-    resolution: {integrity: sha512-LYfpUkmqwl0h9A2HL09Mms427Q1RZWuOHsukfVcKRq9q95iQxdw0ix1JQrqbcDR9PH1QDwf5Qo8OZb5lksZ8Xg==}
+  which-typed-array@1.1.22:
+    resolution: {integrity: sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw==}
     engines: {node: '>= 0.4'}
 
   which@2.0.2:
@@ -6164,8 +5992,8 @@ packages:
   wrappy@1.0.2:
     resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
 
-  ws@8.20.1:
-    resolution: {integrity: sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==}
+  ws@8.21.0:
+    resolution: {integrity: sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==}
     engines: {node: '>=10.0.0'}
     peerDependencies:
       bufferutil: ^4.0.1
@@ -6221,8 +6049,8 @@ packages:
     resolution: {integrity: sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==}
     engines: {node: '>=12'}
 
-  yjs@13.6.30:
-    resolution: {integrity: sha512-vv/9h42eCMC81ZHDFswuu/MKzkl/vyq1BhaNGfHyOonwlG4CJbQF4oiBBJPvfdeCt/PlVDWh7Nov9D34YY09uQ==}
+  yjs@13.6.31:
+    resolution: {integrity: sha512-Eq+5BRfbeGyqGVrTJL3bEcr8gKkxPuyuoHmAwpk52fDb8kOVMrfVSTRPd6yiGgX5Fskb96qCRjzjbRjrL4YEnw==}
     engines: {node: '>=16.0.0', npm: '>=8.0.0'}
 
   yocto-queue@0.1.0:
@@ -6252,8 +6080,8 @@ packages:
   zod@4.4.3:
     resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
 
-  zustand@5.0.13:
-    resolution: {integrity: sha512-efI2tVaVQPqtOh114loML/Z80Y4NP3yc+Ff0fYiZJPauNeWZeIp/bRFD7I9bfmCOYBh/PHxlglQ9+wvlwnPikQ==}
+  zustand@5.0.14:
+    resolution: {integrity: sha512-/8tAspM5LMPr28b3fwLYrtdj77ECpfZviaP75CMTnwO8ISyaE4GDIG/9rDDYq/cH9D2Xw2A2RXglLInmVBQB/g==}
     engines: {node: '>=12.20.0'}
     peerDependencies:
       '@types/react': 19.2.14
@@ -6272,7 +6100,7 @@ packages:
 
 snapshots:
 
-  '@adobe/css-tools@4.4.4': {}
+  '@adobe/css-tools@4.5.0': {}
 
   '@anthropic-ai/sdk@0.95.2(zod@4.4.3)':
     dependencies:
@@ -6286,7 +6114,7 @@ snapshots:
       '@jsdevtools/ono': 7.1.3
       '@types/json-schema': 7.0.15
       call-me-maybe: 1.0.2
-      js-yaml: 4.1.1
+      js-yaml: 4.2.0
 
   '@apidevtools/openapi-schemas@2.1.0': {}
 
@@ -6305,21 +6133,21 @@ snapshots:
   '@aws-crypto/crc32@5.2.0':
     dependencies:
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.973.8
+      '@aws-sdk/types': 3.973.11
       tslib: 2.8.1
 
   '@aws-crypto/crc32c@5.2.0':
     dependencies:
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.973.8
+      '@aws-sdk/types': 3.973.11
       tslib: 2.8.1
 
   '@aws-crypto/sha1-browser@5.2.0':
     dependencies:
       '@aws-crypto/supports-web-crypto': 5.2.0
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.973.8
-      '@aws-sdk/util-locate-window': 3.965.5
+      '@aws-sdk/types': 3.973.11
+      '@aws-sdk/util-locate-window': 3.965.6
       '@smithy/util-utf8': 2.3.0
       tslib: 2.8.1
 
@@ -6328,15 +6156,15 @@ snapshots:
       '@aws-crypto/sha256-js': 5.2.0
       '@aws-crypto/supports-web-crypto': 5.2.0
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.973.8
-      '@aws-sdk/util-locate-window': 3.965.5
+      '@aws-sdk/types': 3.973.11
+      '@aws-sdk/util-locate-window': 3.965.6
       '@smithy/util-utf8': 2.3.0
       tslib: 2.8.1
 
   '@aws-crypto/sha256-js@5.2.0':
     dependencies:
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.973.8
+      '@aws-sdk/types': 3.973.11
       tslib: 2.8.1
 
   '@aws-crypto/supports-web-crypto@5.2.0':
@@ -6345,394 +6173,359 @@ snapshots:
 
   '@aws-crypto/util@5.2.0':
     dependencies:
-      '@aws-sdk/types': 3.973.8
+      '@aws-sdk/types': 3.973.11
       '@smithy/util-utf8': 2.3.0
       tslib: 2.8.1
 
-  '@aws-sdk/client-codebuild@3.1049.0':
+  '@aws-sdk/checksums@3.1000.2':
+    dependencies:
+      '@aws-crypto/crc32': 5.2.0
+      '@aws-crypto/crc32c': 5.2.0
+      '@aws-crypto/util': 5.2.0
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
+      tslib: 2.8.1
+
+  '@aws-sdk/client-codebuild@3.1063.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/credential-provider-node': 3.972.43
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/fetch-http-handler': 5.4.3
-      '@smithy/node-http-handler': 4.7.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/credential-provider-node': 3.972.52
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/fetch-http-handler': 5.4.6
+      '@smithy/node-http-handler': 4.7.7
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/client-cognito-identity@3.1049.0':
+  '@aws-sdk/client-cognito-identity@3.1063.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/credential-provider-node': 3.972.43
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/fetch-http-handler': 5.4.3
-      '@smithy/node-http-handler': 4.7.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/credential-provider-node': 3.972.52
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/fetch-http-handler': 5.4.6
+      '@smithy/node-http-handler': 4.7.7
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/client-ecr@3.1049.0':
+  '@aws-sdk/client-ecr@3.1063.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/credential-provider-node': 3.972.43
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/fetch-http-handler': 5.4.3
-      '@smithy/node-http-handler': 4.7.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/credential-provider-node': 3.972.52
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/fetch-http-handler': 5.4.6
+      '@smithy/node-http-handler': 4.7.7
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/client-glue@3.1049.0':
+  '@aws-sdk/client-glue@3.1063.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/credential-provider-node': 3.972.43
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/fetch-http-handler': 5.4.3
-      '@smithy/node-http-handler': 4.7.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/credential-provider-node': 3.972.52
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/fetch-http-handler': 5.4.6
+      '@smithy/node-http-handler': 4.7.7
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/client-s3@3.1049.0':
+  '@aws-sdk/client-s3@3.1063.0':
     dependencies:
       '@aws-crypto/sha1-browser': 5.2.0
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/credential-provider-node': 3.972.43
-      '@aws-sdk/middleware-bucket-endpoint': 3.972.14
-      '@aws-sdk/middleware-expect-continue': 3.972.12
-      '@aws-sdk/middleware-flexible-checksums': 3.974.20
-      '@aws-sdk/middleware-location-constraint': 3.972.10
-      '@aws-sdk/middleware-sdk-s3': 3.972.41
-      '@aws-sdk/middleware-ssec': 3.972.10
-      '@aws-sdk/signature-v4-multi-region': 3.996.27
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/fetch-http-handler': 5.4.3
-      '@smithy/node-http-handler': 4.7.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/credential-provider-node': 3.972.52
+      '@aws-sdk/middleware-flexible-checksums': 3.974.27
+      '@aws-sdk/middleware-sdk-s3': 3.972.48
+      '@aws-sdk/signature-v4-multi-region': 3.996.32
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/fetch-http-handler': 5.4.6
+      '@smithy/node-http-handler': 4.7.7
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/client-secrets-manager@3.1049.0':
+  '@aws-sdk/client-secrets-manager@3.1063.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/credential-provider-node': 3.972.43
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/fetch-http-handler': 5.4.3
-      '@smithy/node-http-handler': 4.7.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/credential-provider-node': 3.972.52
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/fetch-http-handler': 5.4.6
+      '@smithy/node-http-handler': 4.7.7
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/client-sts@3.1049.0':
+  '@aws-sdk/client-sts@3.1063.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/credential-provider-node': 3.972.43
-      '@aws-sdk/signature-v4-multi-region': 3.996.27
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/fetch-http-handler': 5.4.3
-      '@smithy/node-http-handler': 4.7.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/credential-provider-node': 3.972.52
+      '@aws-sdk/signature-v4-multi-region': 3.996.32
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/fetch-http-handler': 5.4.6
+      '@smithy/node-http-handler': 4.7.7
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/core@3.974.12':
+  '@aws-sdk/core@3.974.18':
     dependencies:
-      '@aws-sdk/types': 3.973.8
-      '@aws-sdk/xml-builder': 3.972.24
+      '@aws-sdk/types': 3.973.11
+      '@aws-sdk/xml-builder': 3.972.28
       '@aws/lambda-invoke-store': 0.2.4
-      '@smithy/core': 3.24.3
-      '@smithy/signature-v4': 5.4.3
-      '@smithy/types': 4.14.2
+      '@smithy/core': 3.24.6
+      '@smithy/signature-v4': 5.4.6
+      '@smithy/types': 4.14.3
       bowser: 2.14.1
       tslib: 2.8.1
 
-  '@aws-sdk/crc64-nvme@3.972.8':
-    dependencies:
-      '@smithy/types': 4.14.2
-      tslib: 2.8.1
-
-  '@aws-sdk/credential-provider-cognito-identity@3.972.35':
+  '@aws-sdk/credential-provider-cognito-identity@3.972.42':
     dependencies:
-      '@aws-sdk/nested-clients': 3.997.10
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/nested-clients': 3.997.17
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-env@3.972.38':
+  '@aws-sdk/credential-provider-env@3.972.44':
     dependencies:
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-http@3.972.40':
+  '@aws-sdk/credential-provider-http@3.972.46':
     dependencies:
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/fetch-http-handler': 5.4.3
-      '@smithy/node-http-handler': 4.7.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/fetch-http-handler': 5.4.6
+      '@smithy/node-http-handler': 4.7.7
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-ini@3.972.42':
-    dependencies:
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/credential-provider-env': 3.972.38
-      '@aws-sdk/credential-provider-http': 3.972.40
-      '@aws-sdk/credential-provider-login': 3.972.42
-      '@aws-sdk/credential-provider-process': 3.972.38
-      '@aws-sdk/credential-provider-sso': 3.972.42
-      '@aws-sdk/credential-provider-web-identity': 3.972.42
-      '@aws-sdk/nested-clients': 3.997.10
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/credential-provider-imds': 4.3.3
-      '@smithy/types': 4.14.2
+  '@aws-sdk/credential-provider-ini@3.972.50':
+    dependencies:
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/credential-provider-env': 3.972.44
+      '@aws-sdk/credential-provider-http': 3.972.46
+      '@aws-sdk/credential-provider-login': 3.972.49
+      '@aws-sdk/credential-provider-process': 3.972.44
+      '@aws-sdk/credential-provider-sso': 3.972.49
+      '@aws-sdk/credential-provider-web-identity': 3.972.49
+      '@aws-sdk/nested-clients': 3.997.17
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/credential-provider-imds': 4.3.8
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-login@3.972.42':
+  '@aws-sdk/credential-provider-login@3.972.49':
     dependencies:
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/nested-clients': 3.997.10
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/nested-clients': 3.997.17
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-node@3.972.43':
-    dependencies:
-      '@aws-sdk/credential-provider-env': 3.972.38
-      '@aws-sdk/credential-provider-http': 3.972.40
-      '@aws-sdk/credential-provider-ini': 3.972.42
-      '@aws-sdk/credential-provider-process': 3.972.38
-      '@aws-sdk/credential-provider-sso': 3.972.42
-      '@aws-sdk/credential-provider-web-identity': 3.972.42
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/credential-provider-imds': 4.3.3
-      '@smithy/types': 4.14.2
+  '@aws-sdk/credential-provider-node@3.972.52':
+    dependencies:
+      '@aws-sdk/credential-provider-env': 3.972.44
+      '@aws-sdk/credential-provider-http': 3.972.46
+      '@aws-sdk/credential-provider-ini': 3.972.50
+      '@aws-sdk/credential-provider-process': 3.972.44
+      '@aws-sdk/credential-provider-sso': 3.972.49
+      '@aws-sdk/credential-provider-web-identity': 3.972.49
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/credential-provider-imds': 4.3.8
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-process@3.972.38':
+  '@aws-sdk/credential-provider-process@3.972.44':
     dependencies:
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-sso@3.972.42':
+  '@aws-sdk/credential-provider-sso@3.972.49':
     dependencies:
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/nested-clients': 3.997.10
-      '@aws-sdk/token-providers': 3.1049.0
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/nested-clients': 3.997.17
+      '@aws-sdk/token-providers': 3.1063.0
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-web-identity@3.972.42':
+  '@aws-sdk/credential-provider-web-identity@3.972.49':
     dependencies:
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/nested-clients': 3.997.10
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/nested-clients': 3.997.17
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/credential-providers@3.1049.0':
-    dependencies:
-      '@aws-sdk/client-cognito-identity': 3.1049.0
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/credential-provider-cognito-identity': 3.972.35
-      '@aws-sdk/credential-provider-env': 3.972.38
-      '@aws-sdk/credential-provider-http': 3.972.40
-      '@aws-sdk/credential-provider-ini': 3.972.42
-      '@aws-sdk/credential-provider-login': 3.972.42
-      '@aws-sdk/credential-provider-node': 3.972.43
-      '@aws-sdk/credential-provider-process': 3.972.38
-      '@aws-sdk/credential-provider-sso': 3.972.42
-      '@aws-sdk/credential-provider-web-identity': 3.972.42
-      '@aws-sdk/nested-clients': 3.997.10
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/credential-provider-imds': 4.3.3
-      '@smithy/types': 4.14.2
+  '@aws-sdk/credential-providers@3.1063.0':
+    dependencies:
+      '@aws-sdk/client-cognito-identity': 3.1063.0
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/credential-provider-cognito-identity': 3.972.42
+      '@aws-sdk/credential-provider-env': 3.972.44
+      '@aws-sdk/credential-provider-http': 3.972.46
+      '@aws-sdk/credential-provider-ini': 3.972.50
+      '@aws-sdk/credential-provider-login': 3.972.49
+      '@aws-sdk/credential-provider-node': 3.972.52
+      '@aws-sdk/credential-provider-process': 3.972.44
+      '@aws-sdk/credential-provider-sso': 3.972.49
+      '@aws-sdk/credential-provider-web-identity': 3.972.49
+      '@aws-sdk/nested-clients': 3.997.17
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/credential-provider-imds': 4.3.8
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/lib-storage@3.1049.0(@aws-sdk/client-s3@3.1049.0)':
+  '@aws-sdk/lib-storage@3.1063.0(@aws-sdk/client-s3@3.1063.0)':
     dependencies:
-      '@aws-sdk/client-s3': 3.1049.0
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/client-s3': 3.1063.0
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
       buffer: 5.6.0
       events: 3.3.0
       stream-browserify: 3.0.0
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-bucket-endpoint@3.972.14':
-    dependencies:
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
-      tslib: 2.8.1
-
-  '@aws-sdk/middleware-expect-continue@3.972.12':
-    dependencies:
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
-      tslib: 2.8.1
-
-  '@aws-sdk/middleware-flexible-checksums@3.974.20':
+  '@aws-sdk/middleware-flexible-checksums@3.974.27':
     dependencies:
-      '@aws-crypto/crc32': 5.2.0
-      '@aws-crypto/crc32c': 5.2.0
-      '@aws-crypto/util': 5.2.0
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/crc64-nvme': 3.972.8
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/checksums': 3.1000.2
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-location-constraint@3.972.10':
+  '@aws-sdk/middleware-sdk-s3@3.972.48':
     dependencies:
-      '@aws-sdk/types': 3.973.8
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/signature-v4-multi-region': 3.996.32
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-sdk-s3@3.972.41':
-    dependencies:
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/signature-v4-multi-region': 3.996.27
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/signature-v4': 5.4.3
-      '@smithy/types': 4.14.2
-      tslib: 2.8.1
-
-  '@aws-sdk/middleware-ssec@3.972.10':
-    dependencies:
-      '@aws-sdk/types': 3.973.8
-      '@smithy/types': 4.14.2
-      tslib: 2.8.1
-
-  '@aws-sdk/nested-clients@3.997.10':
+  '@aws-sdk/nested-clients@3.997.17':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/signature-v4-multi-region': 3.996.27
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/fetch-http-handler': 5.4.3
-      '@smithy/node-http-handler': 4.7.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/signature-v4-multi-region': 3.996.32
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/fetch-http-handler': 5.4.6
+      '@smithy/node-http-handler': 4.7.7
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/rds-signer@3.1049.0':
+  '@aws-sdk/rds-signer@3.1063.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/credential-providers': 3.1049.0
-      '@smithy/core': 3.24.3
-      '@smithy/signature-v4': 5.4.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/credential-providers': 3.1063.0
+      '@smithy/core': 3.24.6
+      '@smithy/signature-v4': 5.4.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/s3-presigned-post@3.1049.0':
+  '@aws-sdk/s3-presigned-post@3.1063.0':
     dependencies:
-      '@aws-sdk/client-s3': 3.1049.0
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/signature-v4': 5.4.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/client-s3': 3.1063.0
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/signature-v4': 5.4.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/s3-request-presigner@3.1049.0':
+  '@aws-sdk/s3-request-presigner@3.1063.0':
     dependencies:
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/signature-v4-multi-region': 3.996.27
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/signature-v4-multi-region': 3.996.32
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/signature-v4-multi-region@3.996.27':
+  '@aws-sdk/signature-v4-multi-region@3.996.32':
     dependencies:
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/signature-v4': 5.4.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/types': 3.973.11
+      '@smithy/signature-v4': 5.4.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/token-providers@3.1049.0':
+  '@aws-sdk/token-providers@3.1063.0':
     dependencies:
-      '@aws-sdk/core': 3.974.12
-      '@aws-sdk/nested-clients': 3.997.10
-      '@aws-sdk/types': 3.973.8
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
+      '@aws-sdk/core': 3.974.18
+      '@aws-sdk/nested-clients': 3.997.17
+      '@aws-sdk/types': 3.973.11
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/types@3.973.8':
+  '@aws-sdk/types@3.973.11':
     dependencies:
-      '@smithy/types': 4.14.2
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@aws-sdk/util-locate-window@3.965.5':
+  '@aws-sdk/util-locate-window@3.965.6':
     dependencies:
       tslib: 2.8.1
 
-  '@aws-sdk/xml-builder@3.972.24':
+  '@aws-sdk/xml-builder@3.972.28':
     dependencies:
-      '@nodable/entities': 2.1.0
-      '@smithy/types': 4.14.2
-      fast-xml-parser: 5.7.3
+      '@smithy/types': 4.14.3
+      fast-xml-parser: 5.8.0
       tslib: 2.8.1
 
   '@aws/lambda-invoke-store@0.2.4': {}
 
-  '@babel/code-frame@7.29.0':
+  '@babel/code-frame@7.29.7':
     dependencies:
-      '@babel/helper-validator-identifier': 7.28.5
+      '@babel/helper-validator-identifier': 7.29.7
       js-tokens: 4.0.0
       picocolors: 1.1.1
 
-  '@babel/compat-data@7.29.3': {}
+  '@babel/compat-data@7.29.7': {}
 
-  '@babel/core@7.29.0':
+  '@babel/core@7.29.7':
     dependencies:
-      '@babel/code-frame': 7.29.0
-      '@babel/generator': 7.29.1
-      '@babel/helper-compilation-targets': 7.28.6
-      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
-      '@babel/helpers': 7.29.2
-      '@babel/parser': 7.29.3
-      '@babel/template': 7.28.6
-      '@babel/traverse': 7.29.0
-      '@babel/types': 7.29.0
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.7
+      '@babel/helper-compilation-targets': 7.29.7
+      '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7)
+      '@babel/helpers': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/template': 7.29.7
+      '@babel/traverse': 7.29.7
+      '@babel/types': 7.29.7
       '@jridgewell/remapping': 2.3.5
       convert-source-map: 2.0.0
       debug: 4.4.3
@@ -6742,91 +6535,91 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/generator@7.29.1':
+  '@babel/generator@7.29.7':
     dependencies:
-      '@babel/parser': 7.29.3
-      '@babel/types': 7.29.0
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
       '@jridgewell/gen-mapping': 0.3.13
       '@jridgewell/trace-mapping': 0.3.31
       jsesc: 3.1.0
 
-  '@babel/helper-compilation-targets@7.28.6':
+  '@babel/helper-compilation-targets@7.29.7':
     dependencies:
-      '@babel/compat-data': 7.29.3
-      '@babel/helper-validator-option': 7.27.1
+      '@babel/compat-data': 7.29.7
+      '@babel/helper-validator-option': 7.29.7
       browserslist: 4.28.2
       lru-cache: 5.1.1
       semver: 6.3.1
 
-  '@babel/helper-globals@7.28.0': {}
+  '@babel/helper-globals@7.29.7': {}
 
-  '@babel/helper-module-imports@7.28.6':
+  '@babel/helper-module-imports@7.29.7':
     dependencies:
-      '@babel/traverse': 7.29.0
-      '@babel/types': 7.29.0
+      '@babel/traverse': 7.29.7
+      '@babel/types': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/helper-module-transforms@7.28.6(@babel/core@7.29.0)':
+  '@babel/helper-module-transforms@7.29.7(@babel/core@7.29.7)':
     dependencies:
-      '@babel/core': 7.29.0
-      '@babel/helper-module-imports': 7.28.6
-      '@babel/helper-validator-identifier': 7.28.5
-      '@babel/traverse': 7.29.0
+      '@babel/core': 7.29.7
+      '@babel/helper-module-imports': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
+      '@babel/traverse': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/helper-plugin-utils@7.28.6': {}
+  '@babel/helper-plugin-utils@7.29.7': {}
 
-  '@babel/helper-string-parser@7.27.1': {}
+  '@babel/helper-string-parser@7.29.7': {}
 
-  '@babel/helper-validator-identifier@7.28.5': {}
+  '@babel/helper-validator-identifier@7.29.7': {}
 
-  '@babel/helper-validator-option@7.27.1': {}
+  '@babel/helper-validator-option@7.29.7': {}
 
-  '@babel/helpers@7.29.2':
+  '@babel/helpers@7.29.7':
     dependencies:
-      '@babel/template': 7.28.6
-      '@babel/types': 7.29.0
+      '@babel/template': 7.29.7
+      '@babel/types': 7.29.7
 
-  '@babel/parser@7.29.3':
+  '@babel/parser@7.29.7':
     dependencies:
-      '@babel/types': 7.29.0
+      '@babel/types': 7.29.7
 
-  '@babel/plugin-transform-react-jsx-self@7.27.1(@babel/core@7.29.0)':
+  '@babel/plugin-transform-react-jsx-self@7.29.7(@babel/core@7.29.7)':
     dependencies:
-      '@babel/core': 7.29.0
-      '@babel/helper-plugin-utils': 7.28.6
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-react-jsx-source@7.27.1(@babel/core@7.29.0)':
+  '@babel/plugin-transform-react-jsx-source@7.29.7(@babel/core@7.29.7)':
     dependencies:
-      '@babel/core': 7.29.0
-      '@babel/helper-plugin-utils': 7.28.6
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/runtime@7.29.2': {}
+  '@babel/runtime@7.29.7': {}
 
-  '@babel/template@7.28.6':
+  '@babel/template@7.29.7':
     dependencies:
-      '@babel/code-frame': 7.29.0
-      '@babel/parser': 7.29.3
-      '@babel/types': 7.29.0
+      '@babel/code-frame': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
 
-  '@babel/traverse@7.29.0':
+  '@babel/traverse@7.29.7':
     dependencies:
-      '@babel/code-frame': 7.29.0
-      '@babel/generator': 7.29.1
-      '@babel/helper-globals': 7.28.0
-      '@babel/parser': 7.29.3
-      '@babel/template': 7.28.6
-      '@babel/types': 7.29.0
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.7
+      '@babel/helper-globals': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/template': 7.29.7
+      '@babel/types': 7.29.7
       debug: 4.4.3
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/types@7.29.0':
+  '@babel/types@7.29.7':
     dependencies:
-      '@babel/helper-string-parser': 7.27.1
-      '@babel/helper-validator-identifier': 7.28.5
+      '@babel/helper-string-parser': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
 
   '@bcoe/v8-coverage@1.0.2': {}
 
@@ -6845,36 +6638,36 @@ snapshots:
       picocolors: 1.1.1
       sisteransi: 1.0.5
 
-  '@clerk/backend@2.33.4(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+  '@clerk/backend@2.33.5(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@clerk/shared': 3.47.6(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
-      '@clerk/types': 4.101.24(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@clerk/shared': 3.47.7(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@clerk/types': 4.101.25(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       standardwebhooks: 1.0.0
       tslib: 2.8.1
     transitivePeerDependencies:
       - react
       - react-dom
 
-  '@clerk/clerk-react@5.61.7(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+  '@clerk/clerk-react@5.61.8(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@clerk/shared': 3.47.6(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@clerk/shared': 3.47.7(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       react: 19.2.4
       react-dom: 19.2.4(react@19.2.4)
       tslib: 2.8.1
 
-  '@clerk/nextjs@6.39.4(next@16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+  '@clerk/nextjs@6.39.5(next@16.2.7(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@clerk/backend': 2.33.4(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
-      '@clerk/clerk-react': 5.61.7(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
-      '@clerk/shared': 3.47.6(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
-      '@clerk/types': 4.101.24(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
-      next: 16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@clerk/backend': 2.33.5(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@clerk/clerk-react': 5.61.8(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@clerk/shared': 3.47.7(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@clerk/types': 4.101.25(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      next: 16.2.7(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       react: 19.2.4
       react-dom: 19.2.4(react@19.2.4)
       server-only: 0.0.1
       tslib: 2.8.1
 
-  '@clerk/shared@3.47.6(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+  '@clerk/shared@3.47.7(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
       csstype: 3.1.3
       dequal: 2.0.3
@@ -6886,11 +6679,11 @@ snapshots:
       react: 19.2.4
       react-dom: 19.2.4(react@19.2.4)
 
-  '@clerk/testing@1.14.7(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+  '@clerk/testing@1.14.8(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@clerk/backend': 2.33.4(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
-      '@clerk/shared': 3.47.6(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
-      '@clerk/types': 4.101.24(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@clerk/backend': 2.33.5(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@clerk/shared': 3.47.7(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@clerk/types': 4.101.25(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       dotenv: 17.2.2
     optionalDependencies:
       '@playwright/test': 1.60.0
@@ -6898,9 +6691,9 @@ snapshots:
       - react
       - react-dom
 
-  '@clerk/types@4.101.24(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+  '@clerk/types@4.101.25(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@clerk/shared': 3.47.6(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@clerk/shared': 3.47.7(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
     transitivePeerDependencies:
       - react
       - react-dom
@@ -7118,7 +6911,7 @@ snapshots:
       globals: 14.0.0
       ignore: 5.3.2
       import-fresh: 3.3.1
-      js-yaml: 4.1.1
+      js-yaml: 4.2.0
       minimatch: 10.2.5
       strip-json-comments: 3.1.1
     transitivePeerDependencies:
@@ -7135,16 +6928,6 @@ snapshots:
 
   '@faker-js/faker@10.4.0': {}
 
-  '@fastify/otel@0.18.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation': 0.212.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-      minimatch: 10.2.5
-    transitivePeerDependencies:
-      - supports-color
-
   '@floating-ui/core@1.7.5':
     dependencies:
       '@floating-ui/utils': 0.2.11
@@ -7174,44 +6957,44 @@ snapshots:
     dependencies:
       lib0: 0.2.117
 
-  '@hocuspocus/extension-database@3.4.4(y-protocols@1.0.7(yjs@13.6.30))(yjs@13.6.30)':
+  '@hocuspocus/extension-database@3.4.4(y-protocols@1.0.7(yjs@13.6.31))(yjs@13.6.31)':
     dependencies:
-      '@hocuspocus/server': 3.4.4(y-protocols@1.0.7(yjs@13.6.30))(yjs@13.6.30)
-      yjs: 13.6.30
+      '@hocuspocus/server': 3.4.4(y-protocols@1.0.7(yjs@13.6.31))(yjs@13.6.31)
+      yjs: 13.6.31
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
       - y-protocols
 
-  '@hocuspocus/provider@3.4.4(y-protocols@1.0.7(yjs@13.6.30))(yjs@13.6.30)':
+  '@hocuspocus/provider@3.4.4(y-protocols@1.0.7(yjs@13.6.31))(yjs@13.6.31)':
     dependencies:
       '@hocuspocus/common': 3.4.4
       '@lifeomic/attempt': 3.1.0
       lib0: 0.2.117
-      ws: 8.20.1
-      y-protocols: 1.0.7(yjs@13.6.30)
-      yjs: 13.6.30
+      ws: 8.21.0
+      y-protocols: 1.0.7(yjs@13.6.31)
+      yjs: 13.6.31
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
 
-  '@hocuspocus/server@3.4.4(y-protocols@1.0.7(yjs@13.6.30))(yjs@13.6.30)':
+  '@hocuspocus/server@3.4.4(y-protocols@1.0.7(yjs@13.6.31))(yjs@13.6.31)':
     dependencies:
       '@hocuspocus/common': 3.4.4
       async-lock: 1.4.1
       async-mutex: 0.5.0
       kleur: 4.1.5
       lib0: 0.2.117
-      ws: 8.20.1
-      y-protocols: 1.0.7(yjs@13.6.30)
-      yjs: 13.6.30
+      ws: 8.21.0
+      y-protocols: 1.0.7(yjs@13.6.31)
+      yjs: 13.6.31
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
 
-  '@hono/node-server@1.19.14(hono@4.12.21)':
+  '@hono/node-server@1.19.14(hono@4.12.23)':
     dependencies:
-      hono: 4.12.21
+      hono: 4.12.23
 
   '@humanfs/core@0.19.2':
     dependencies:
@@ -7398,7 +7181,7 @@ snapshots:
 
   '@lexical/headless@0.41.0':
     dependencies:
-      happy-dom: 20.9.0
+      happy-dom: 20.10.1
       lexical: 0.41.0
     transitivePeerDependencies:
       - bufferutil
@@ -7460,7 +7243,7 @@ snapshots:
       '@lexical/utils': 0.41.0
       lexical: 0.41.0
 
-  '@lexical/react@0.41.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(yjs@13.6.30)':
+  '@lexical/react@0.41.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(yjs@13.6.31)':
     dependencies:
       '@floating-ui/react': 0.27.19(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       '@lexical/devtools-core': 0.41.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
@@ -7478,11 +7261,11 @@ snapshots:
       '@lexical/table': 0.41.0
       '@lexical/text': 0.41.0
       '@lexical/utils': 0.41.0
-      '@lexical/yjs': 0.41.0(yjs@13.6.30)
+      '@lexical/yjs': 0.41.0(yjs@13.6.31)
       lexical: 0.41.0
       react: 19.2.4
       react-dom: 19.2.4(react@19.2.4)
-      react-error-boundary: 6.1.1(react@19.2.4)
+      react-error-boundary: 6.1.2(react@19.2.4)
     transitivePeerDependencies:
       - yjs
 
@@ -7514,12 +7297,12 @@ snapshots:
       '@lexical/selection': 0.41.0
       lexical: 0.41.0
 
-  '@lexical/yjs@0.41.0(yjs@13.6.30)':
+  '@lexical/yjs@0.41.0(yjs@13.6.31)':
     dependencies:
       '@lexical/offset': 0.41.0
       '@lexical/selection': 0.41.0
       lexical: 0.41.0
-      yjs: 13.6.30
+      yjs: 13.6.31
 
   '@lifeomic/attempt@3.1.0': {}
 
@@ -7577,17 +7360,17 @@ snapshots:
 
   '@modelcontextprotocol/sdk@1.29.0(zod@4.4.3)':
     dependencies:
-      '@hono/node-server': 1.19.14(hono@4.12.21)
+      '@hono/node-server': 1.19.14(hono@4.12.23)
       ajv: 8.20.0
       ajv-formats: 3.0.1(ajv@8.20.0)
       content-type: 1.0.5
       cors: 2.8.6
       cross-spawn: 7.0.6
       eventsource: 3.0.7
-      eventsource-parser: 3.0.8
+      eventsource-parser: 3.1.0
       express: 5.2.1
       express-rate-limit: 8.5.2(express@5.2.1)
-      hono: 4.12.21
+      hono: 4.12.23
       jose: 6.2.3
       json-schema-typed: 8.0.2
       pkce-challenge: 5.0.1
@@ -7604,37 +7387,37 @@ snapshots:
       '@tybys/wasm-util': 0.10.2
     optional: true
 
-  '@next/env@16.2.6': {}
+  '@next/env@16.2.7': {}
 
   '@next/eslint-plugin-next@16.1.6':
     dependencies:
       fast-glob: 3.3.1
 
-  '@next/swc-darwin-arm64@16.2.6':
+  '@next/swc-darwin-arm64@16.2.7':
     optional: true
 
-  '@next/swc-darwin-x64@16.2.6':
+  '@next/swc-darwin-x64@16.2.7':
     optional: true
 
-  '@next/swc-linux-arm64-gnu@16.2.6':
+  '@next/swc-linux-arm64-gnu@16.2.7':
     optional: true
 
-  '@next/swc-linux-arm64-musl@16.2.6':
+  '@next/swc-linux-arm64-musl@16.2.7':
     optional: true
 
-  '@next/swc-linux-x64-gnu@16.2.6':
+  '@next/swc-linux-x64-gnu@16.2.7':
     optional: true
 
-  '@next/swc-linux-x64-musl@16.2.6':
+  '@next/swc-linux-x64-musl@16.2.7':
     optional: true
 
-  '@next/swc-win32-arm64-msvc@16.2.6':
+  '@next/swc-win32-arm64-msvc@16.2.7':
     optional: true
 
-  '@next/swc-win32-x64-msvc@16.2.6':
+  '@next/swc-win32-x64-msvc@16.2.7':
     optional: true
 
-  '@nodable/entities@2.1.0': {}
+  '@nodable/entities@2.1.1': {}
 
   '@nodelib/fs.scandir@2.1.5':
     dependencies:
@@ -7654,7 +7437,7 @@ snapshots:
     dependencies:
       '@octokit/auth-token': 6.0.0
       '@octokit/graphql': 9.0.3
-      '@octokit/request': 10.0.9
+      '@octokit/request': 10.0.10
       '@octokit/request-error': 7.1.0
       '@octokit/types': 16.0.0
       before-after-hook: 4.0.0
@@ -7667,7 +7450,7 @@ snapshots:
 
   '@octokit/graphql@9.0.3':
     dependencies:
-      '@octokit/request': 10.0.9
+      '@octokit/request': 10.0.10
       '@octokit/types': 16.0.0
       universal-user-agent: 7.0.3
 
@@ -7691,13 +7474,12 @@ snapshots:
     dependencies:
       '@octokit/types': 16.0.0
 
-  '@octokit/request@10.0.9':
+  '@octokit/request@10.0.10':
     dependencies:
       '@octokit/endpoint': 11.0.3
       '@octokit/request-error': 7.1.0
       '@octokit/types': 16.0.0
       content-type: 2.0.0
-      fast-content-type-parse: 3.0.0
       json-with-bigint: 3.5.8
       universal-user-agent: 7.0.3
 
@@ -7712,203 +7494,17 @@ snapshots:
     dependencies:
       '@octokit/openapi-types': 27.0.0
 
-  '@opentelemetry/api-logs@0.207.0':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-
-  '@opentelemetry/api-logs@0.212.0':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-
   '@opentelemetry/api-logs@0.214.0':
     dependencies:
       '@opentelemetry/api': 1.9.1
 
   '@opentelemetry/api@1.9.1': {}
 
-  '@opentelemetry/core@2.6.1(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/semantic-conventions': 1.41.1
-
   '@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1)':
     dependencies:
       '@opentelemetry/api': 1.9.1
       '@opentelemetry/semantic-conventions': 1.41.1
 
-  '@opentelemetry/instrumentation-amqplib@0.61.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-connect@0.57.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-      '@types/connect': 3.4.38
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-dataloader@0.31.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-fs@0.33.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-generic-pool@0.57.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-graphql@0.62.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-hapi@0.60.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-http@0.214.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/core': 2.6.1(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-      forwarded-parse: 2.1.2
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-kafkajs@0.23.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-knex@0.58.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-koa@0.62.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-lru-memoizer@0.58.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-mongodb@0.67.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-mongoose@0.60.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-mysql2@0.60.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-      '@opentelemetry/sql-common': 0.41.2(@opentelemetry/api@1.9.1)
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-mysql@0.60.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-      '@types/mysql': 2.15.27
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-pg@0.66.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-      '@opentelemetry/sql-common': 0.41.2(@opentelemetry/api@1.9.1)
-      '@types/pg': 8.15.6
-      '@types/pg-pool': 2.0.7
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation-tedious@0.33.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/semantic-conventions': 1.41.1
-      '@types/tedious': 4.0.14
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation@0.207.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/api-logs': 0.207.0
-      import-in-the-middle: 2.0.6
-      require-in-the-middle: 8.0.1
-    transitivePeerDependencies:
-      - supports-color
-
-  '@opentelemetry/instrumentation@0.212.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/api-logs': 0.212.0
-      import-in-the-middle: 2.0.6
-      require-in-the-middle: 8.0.1
-    transitivePeerDependencies:
-      - supports-color
-
   '@opentelemetry/instrumentation@0.214.0(@opentelemetry/api@1.9.1)':
     dependencies:
       '@opentelemetry/api': 1.9.1
@@ -7933,33 +7529,28 @@ snapshots:
 
   '@opentelemetry/semantic-conventions@1.41.1': {}
 
-  '@opentelemetry/sql-common@0.41.2(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1)
-
-  '@oxc-project/types@0.130.0': {}
+  '@oxc-project/types@0.133.0': {}
 
-  '@pandacss/config@1.11.1':
+  '@pandacss/config@1.11.3':
     dependencies:
-      '@pandacss/logger': 1.11.1
-      '@pandacss/preset-base': 1.11.1
-      '@pandacss/preset-panda': 1.11.1
-      '@pandacss/shared': 1.11.1
-      '@pandacss/types': 1.11.1
-      bundle-n-require: 1.1.2
+      '@pandacss/logger': 1.11.3
+      '@pandacss/preset-base': 1.11.3
+      '@pandacss/preset-panda': 1.11.3
+      '@pandacss/shared': 1.11.3
+      '@pandacss/types': 1.11.3
+      esbuild: 0.25.12
       escalade: 3.2.0
       microdiff: 1.5.0
       typescript: 6.0.2
 
-  '@pandacss/core@1.11.1':
+  '@pandacss/core@1.11.3':
     dependencies:
       '@csstools/postcss-cascade-layers': 5.0.2(postcss@8.5.15)
-      '@pandacss/is-valid-prop': 1.11.1
-      '@pandacss/logger': 1.11.1
-      '@pandacss/shared': 1.11.1
-      '@pandacss/token-dictionary': 1.11.1
-      '@pandacss/types': 1.11.1
+      '@pandacss/is-valid-prop': 1.11.3
+      '@pandacss/logger': 1.11.3
+      '@pandacss/shared': 1.11.3
+      '@pandacss/token-dictionary': 1.11.3
+      '@pandacss/types': 1.11.3
       browserslist: 4.28.1
       lodash.merge: 4.6.2
       outdent: 0.8.0
@@ -7972,19 +7563,19 @@ snapshots:
       postcss-selector-parser: 7.1.1
       ts-pattern: 5.9.0
 
-  '@pandacss/dev@1.11.1(typescript@5.9.3)':
+  '@pandacss/dev@1.11.3(typescript@5.9.3)':
     dependencies:
       '@clack/prompts': 0.11.0
-      '@pandacss/config': 1.11.1
-      '@pandacss/logger': 1.11.1
-      '@pandacss/mcp': 1.11.1(typescript@5.9.3)
-      '@pandacss/node': 1.11.1(typescript@5.9.3)
-      '@pandacss/postcss': 1.11.1(typescript@5.9.3)
-      '@pandacss/preset-base': 1.11.1
-      '@pandacss/preset-panda': 1.11.1
-      '@pandacss/shared': 1.11.1
-      '@pandacss/token-dictionary': 1.11.1
-      '@pandacss/types': 1.11.1
+      '@pandacss/config': 1.11.3
+      '@pandacss/logger': 1.11.3
+      '@pandacss/mcp': 1.11.3(typescript@5.9.3)
+      '@pandacss/node': 1.11.3(typescript@5.9.3)
+      '@pandacss/postcss': 1.11.3(typescript@5.9.3)
+      '@pandacss/preset-base': 1.11.3
+      '@pandacss/preset-panda': 1.11.3
+      '@pandacss/shared': 1.11.3
+      '@pandacss/token-dictionary': 1.11.3
+      '@pandacss/types': 1.11.3
       cac: 6.7.14
     transitivePeerDependencies:
       - '@cfworker/json-schema'
@@ -7992,44 +7583,44 @@ snapshots:
       - supports-color
       - typescript
 
-  '@pandacss/extractor@1.11.1(typescript@5.9.3)':
+  '@pandacss/extractor@1.11.3(typescript@5.9.3)':
     dependencies:
-      '@pandacss/shared': 1.11.1
+      '@pandacss/shared': 1.11.3
       ts-evaluator: 1.2.0(typescript@5.9.3)
       ts-morph: 28.0.0
     transitivePeerDependencies:
       - jsdom
       - typescript
 
-  '@pandacss/generator@1.11.1':
+  '@pandacss/generator@1.11.3':
     dependencies:
-      '@pandacss/core': 1.11.1
-      '@pandacss/is-valid-prop': 1.11.1
-      '@pandacss/logger': 1.11.1
-      '@pandacss/shared': 1.11.1
-      '@pandacss/token-dictionary': 1.11.1
-      '@pandacss/types': 1.11.1
+      '@pandacss/core': 1.11.3
+      '@pandacss/is-valid-prop': 1.11.3
+      '@pandacss/logger': 1.11.3
+      '@pandacss/shared': 1.11.3
+      '@pandacss/token-dictionary': 1.11.3
+      '@pandacss/types': 1.11.3
       javascript-stringify: 2.1.0
       outdent: 0.8.0
       pluralize: 8.0.0
       postcss: 8.5.15
       ts-pattern: 5.9.0
 
-  '@pandacss/is-valid-prop@1.11.1': {}
+  '@pandacss/is-valid-prop@1.11.3': {}
 
-  '@pandacss/logger@1.11.1':
+  '@pandacss/logger@1.11.3':
     dependencies:
-      '@pandacss/types': 1.11.1
+      '@pandacss/types': 1.11.3
       kleur: 4.1.5
 
-  '@pandacss/mcp@1.11.1(typescript@5.9.3)':
+  '@pandacss/mcp@1.11.3(typescript@5.9.3)':
     dependencies:
       '@clack/prompts': 0.11.0
       '@modelcontextprotocol/sdk': 1.29.0(zod@4.4.3)
-      '@pandacss/logger': 1.11.1
-      '@pandacss/node': 1.11.1(typescript@5.9.3)
-      '@pandacss/token-dictionary': 1.11.1
-      '@pandacss/types': 1.11.1
+      '@pandacss/logger': 1.11.3
+      '@pandacss/node': 1.11.3(typescript@5.9.3)
+      '@pandacss/token-dictionary': 1.11.3
+      '@pandacss/types': 1.11.3
       zod: 4.4.3
     transitivePeerDependencies:
       - '@cfworker/json-schema'
@@ -8037,20 +7628,20 @@ snapshots:
       - supports-color
       - typescript
 
-  '@pandacss/node@1.11.1(typescript@5.9.3)':
-    dependencies:
-      '@pandacss/config': 1.11.1
-      '@pandacss/core': 1.11.1
-      '@pandacss/generator': 1.11.1
-      '@pandacss/logger': 1.11.1
-      '@pandacss/parser': 1.11.1(typescript@5.9.3)
-      '@pandacss/plugin-lightningcss': 1.11.1
-      '@pandacss/plugin-svelte': 1.11.1
-      '@pandacss/plugin-vue': 1.11.1
-      '@pandacss/reporter': 1.11.1
-      '@pandacss/shared': 1.11.1
-      '@pandacss/token-dictionary': 1.11.1
-      '@pandacss/types': 1.11.1
+  '@pandacss/node@1.11.3(typescript@5.9.3)':
+    dependencies:
+      '@pandacss/config': 1.11.3
+      '@pandacss/core': 1.11.3
+      '@pandacss/generator': 1.11.3
+      '@pandacss/logger': 1.11.3
+      '@pandacss/parser': 1.11.3(typescript@5.9.3)
+      '@pandacss/plugin-lightningcss': 1.11.3
+      '@pandacss/plugin-svelte': 1.11.3
+      '@pandacss/plugin-vue': 1.11.3
+      '@pandacss/reporter': 1.11.3
+      '@pandacss/shared': 1.11.3
+      '@pandacss/token-dictionary': 1.11.3
+      '@pandacss/types': 1.11.3
       browserslist: 4.28.1
       chokidar: 4.0.3
       fast-glob: 3.3.3
@@ -8075,75 +7666,75 @@ snapshots:
       - jsdom
       - typescript
 
-  '@pandacss/parser@1.11.1(typescript@5.9.3)':
+  '@pandacss/parser@1.11.3(typescript@5.9.3)':
     dependencies:
-      '@pandacss/config': 1.11.1
-      '@pandacss/core': 1.11.1
-      '@pandacss/extractor': 1.11.1(typescript@5.9.3)
-      '@pandacss/logger': 1.11.1
-      '@pandacss/shared': 1.11.1
-      '@pandacss/types': 1.11.1
+      '@pandacss/config': 1.11.3
+      '@pandacss/core': 1.11.3
+      '@pandacss/extractor': 1.11.3(typescript@5.9.3)
+      '@pandacss/logger': 1.11.3
+      '@pandacss/shared': 1.11.3
+      '@pandacss/types': 1.11.3
       ts-morph: 28.0.0
       ts-pattern: 5.9.0
     transitivePeerDependencies:
       - jsdom
       - typescript
 
-  '@pandacss/plugin-lightningcss@1.11.1':
+  '@pandacss/plugin-lightningcss@1.11.3':
     dependencies:
-      '@pandacss/logger': 1.11.1
-      '@pandacss/types': 1.11.1
+      '@pandacss/logger': 1.11.3
+      '@pandacss/types': 1.11.3
       browserslist: 4.28.1
       lightningcss: 1.31.1
 
-  '@pandacss/plugin-svelte@1.11.1':
+  '@pandacss/plugin-svelte@1.11.3':
     dependencies:
-      '@pandacss/types': 1.11.1
+      '@pandacss/types': 1.11.3
       magic-string: 0.30.21
 
-  '@pandacss/plugin-vue@1.11.1':
+  '@pandacss/plugin-vue@1.11.3':
     dependencies:
-      '@pandacss/types': 1.11.1
+      '@pandacss/types': 1.11.3
       '@vue/compiler-sfc': 3.5.25
       magic-string: 0.30.21
 
-  '@pandacss/postcss@1.11.1(typescript@5.9.3)':
+  '@pandacss/postcss@1.11.3(typescript@5.9.3)':
     dependencies:
-      '@pandacss/node': 1.11.1(typescript@5.9.3)
+      '@pandacss/node': 1.11.3(typescript@5.9.3)
       postcss: 8.5.15
     transitivePeerDependencies:
       - jsdom
       - typescript
 
-  '@pandacss/preset-base@1.11.1':
+  '@pandacss/preset-base@1.11.3':
     dependencies:
-      '@pandacss/types': 1.11.1
+      '@pandacss/types': 1.11.3
 
-  '@pandacss/preset-panda@1.11.1':
+  '@pandacss/preset-panda@1.11.3':
     dependencies:
-      '@pandacss/types': 1.11.1
+      '@pandacss/types': 1.11.3
 
-  '@pandacss/reporter@1.11.1':
+  '@pandacss/reporter@1.11.3':
     dependencies:
-      '@pandacss/core': 1.11.1
-      '@pandacss/generator': 1.11.1
-      '@pandacss/logger': 1.11.1
-      '@pandacss/shared': 1.11.1
-      '@pandacss/types': 1.11.1
+      '@pandacss/core': 1.11.3
+      '@pandacss/generator': 1.11.3
+      '@pandacss/logger': 1.11.3
+      '@pandacss/shared': 1.11.3
+      '@pandacss/types': 1.11.3
       table: 6.9.0
       wordwrapjs: 5.1.1
 
-  '@pandacss/shared@1.11.1': {}
+  '@pandacss/shared@1.11.3': {}
 
-  '@pandacss/token-dictionary@1.11.1':
+  '@pandacss/token-dictionary@1.11.3':
     dependencies:
-      '@pandacss/logger': 1.11.1
-      '@pandacss/shared': 1.11.1
-      '@pandacss/types': 1.11.1
+      '@pandacss/logger': 1.11.3
+      '@pandacss/shared': 1.11.3
+      '@pandacss/types': 1.11.3
       picomatch: 4.0.4
       ts-pattern: 5.9.0
 
-  '@pandacss/types@1.11.1': {}
+  '@pandacss/types@1.11.3': {}
 
   '@phosphor-icons/react@2.1.10(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
@@ -8156,69 +7747,62 @@ snapshots:
 
   '@preact/signals-core@1.14.2': {}
 
-  '@prisma/instrumentation@7.6.0(@opentelemetry/api@1.9.1)':
-    dependencies:
-      '@opentelemetry/api': 1.9.1
-      '@opentelemetry/instrumentation': 0.207.0(@opentelemetry/api@1.9.1)
-    transitivePeerDependencies:
-      - supports-color
-
-  '@rolldown/binding-android-arm64@1.0.1':
+  '@rolldown/binding-android-arm64@1.0.3':
     optional: true
 
-  '@rolldown/binding-darwin-arm64@1.0.1':
+  '@rolldown/binding-darwin-arm64@1.0.3':
     optional: true
 
-  '@rolldown/binding-darwin-x64@1.0.1':
+  '@rolldown/binding-darwin-x64@1.0.3':
     optional: true
 
-  '@rolldown/binding-freebsd-x64@1.0.1':
+  '@rolldown/binding-freebsd-x64@1.0.3':
     optional: true
 
-  '@rolldown/binding-linux-arm-gnueabihf@1.0.1':
+  '@rolldown/binding-linux-arm-gnueabihf@1.0.3':
     optional: true
 
-  '@rolldown/binding-linux-arm64-gnu@1.0.1':
+  '@rolldown/binding-linux-arm64-gnu@1.0.3':
     optional: true
 
-  '@rolldown/binding-linux-arm64-musl@1.0.1':
+  '@rolldown/binding-linux-arm64-musl@1.0.3':
     optional: true
 
-  '@rolldown/binding-linux-ppc64-gnu@1.0.1':
+  '@rolldown/binding-linux-ppc64-gnu@1.0.3':
     optional: true
 
-  '@rolldown/binding-linux-s390x-gnu@1.0.1':
+  '@rolldown/binding-linux-s390x-gnu@1.0.3':
     optional: true
 
-  '@rolldown/binding-linux-x64-gnu@1.0.1':
+  '@rolldown/binding-linux-x64-gnu@1.0.3':
     optional: true
 
-  '@rolldown/binding-linux-x64-musl@1.0.1':
+  '@rolldown/binding-linux-x64-musl@1.0.3':
     optional: true
 
-  '@rolldown/binding-openharmony-arm64@1.0.1':
+  '@rolldown/binding-openharmony-arm64@1.0.3':
     optional: true
 
-  '@rolldown/binding-wasm32-wasi@1.0.1':
+  '@rolldown/binding-wasm32-wasi@1.0.3':
     dependencies:
       '@emnapi/core': 1.10.0
       '@emnapi/runtime': 1.10.0
       '@napi-rs/wasm-runtime': 1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
     optional: true
 
-  '@rolldown/binding-win32-arm64-msvc@1.0.1':
+  '@rolldown/binding-win32-arm64-msvc@1.0.3':
     optional: true
 
-  '@rolldown/binding-win32-x64-msvc@1.0.1':
+  '@rolldown/binding-win32-x64-msvc@1.0.3':
     optional: true
 
   '@rolldown/pluginutils@1.0.0-rc.3': {}
 
   '@rolldown/pluginutils@1.0.1': {}
 
-  '@rollup/plugin-commonjs@28.0.1(rollup@4.60.4)':
+  '@rollup/plugin-commonjs@28.0.1(rollup@4.61.1)':
     dependencies:
-      '@rollup/pluginutils': 5.3.0(rollup@4.60.4)
+      '@rollup/pluginutils': 5.4.0(rollup@4.61.1)
       commondir: 1.0.1
       estree-walker: 2.0.2
       fdir: 6.5.0(picomatch@4.0.4)
@@ -8226,126 +7810,130 @@ snapshots:
       magic-string: 0.30.21
       picomatch: 4.0.4
     optionalDependencies:
-      rollup: 4.60.4
+      rollup: 4.61.1
 
-  '@rollup/pluginutils@5.3.0(rollup@4.60.4)':
+  '@rollup/pluginutils@5.4.0(rollup@4.61.1)':
     dependencies:
       '@types/estree': 1.0.9
       estree-walker: 2.0.2
       picomatch: 4.0.4
     optionalDependencies:
-      rollup: 4.60.4
+      rollup: 4.61.1
 
-  '@rollup/rollup-android-arm-eabi@4.60.4':
+  '@rollup/rollup-android-arm-eabi@4.61.1':
     optional: true
 
-  '@rollup/rollup-android-arm64@4.60.4':
+  '@rollup/rollup-android-arm64@4.61.1':
     optional: true
 
-  '@rollup/rollup-darwin-arm64@4.60.4':
+  '@rollup/rollup-darwin-arm64@4.61.1':
     optional: true
 
-  '@rollup/rollup-darwin-x64@4.60.4':
+  '@rollup/rollup-darwin-x64@4.61.1':
     optional: true
 
-  '@rollup/rollup-freebsd-arm64@4.60.4':
+  '@rollup/rollup-freebsd-arm64@4.61.1':
     optional: true
 
-  '@rollup/rollup-freebsd-x64@4.60.4':
+  '@rollup/rollup-freebsd-x64@4.61.1':
     optional: true
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.60.4':
+  '@rollup/rollup-linux-arm-gnueabihf@4.61.1':
     optional: true
 
-  '@rollup/rollup-linux-arm-musleabihf@4.60.4':
+  '@rollup/rollup-linux-arm-musleabihf@4.61.1':
     optional: true
 
-  '@rollup/rollup-linux-arm64-gnu@4.60.4':
+  '@rollup/rollup-linux-arm64-gnu@4.61.1':
     optional: true
 
-  '@rollup/rollup-linux-arm64-musl@4.60.4':
+  '@rollup/rollup-linux-arm64-musl@4.61.1':
     optional: true
 
-  '@rollup/rollup-linux-loong64-gnu@4.60.4':
+  '@rollup/rollup-linux-loong64-gnu@4.61.1':
     optional: true
 
-  '@rollup/rollup-linux-loong64-musl@4.60.4':
+  '@rollup/rollup-linux-loong64-musl@4.61.1':
     optional: true
 
-  '@rollup/rollup-linux-ppc64-gnu@4.60.4':
+  '@rollup/rollup-linux-ppc64-gnu@4.61.1':
     optional: true
 
-  '@rollup/rollup-linux-ppc64-musl@4.60.4':
+  '@rollup/rollup-linux-ppc64-musl@4.61.1':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-gnu@4.60.4':
+  '@rollup/rollup-linux-riscv64-gnu@4.61.1':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-musl@4.60.4':
+  '@rollup/rollup-linux-riscv64-musl@4.61.1':
     optional: true
 
-  '@rollup/rollup-linux-s390x-gnu@4.60.4':
+  '@rollup/rollup-linux-s390x-gnu@4.61.1':
     optional: true
 
-  '@rollup/rollup-linux-x64-gnu@4.60.4':
+  '@rollup/rollup-linux-x64-gnu@4.61.1':
     optional: true
 
-  '@rollup/rollup-linux-x64-musl@4.60.4':
+  '@rollup/rollup-linux-x64-musl@4.61.1':
     optional: true
 
-  '@rollup/rollup-openbsd-x64@4.60.4':
+  '@rollup/rollup-openbsd-x64@4.61.1':
     optional: true
 
-  '@rollup/rollup-openharmony-arm64@4.60.4':
+  '@rollup/rollup-openharmony-arm64@4.61.1':
     optional: true
 
-  '@rollup/rollup-win32-arm64-msvc@4.60.4':
+  '@rollup/rollup-win32-arm64-msvc@4.61.1':
     optional: true
 
-  '@rollup/rollup-win32-ia32-msvc@4.60.4':
+  '@rollup/rollup-win32-ia32-msvc@4.61.1':
     optional: true
 
-  '@rollup/rollup-win32-x64-gnu@4.60.4':
+  '@rollup/rollup-win32-x64-gnu@4.61.1':
     optional: true
 
-  '@rollup/rollup-win32-x64-msvc@4.60.4':
+  '@rollup/rollup-win32-x64-msvc@4.61.1':
     optional: true
 
   '@rtsao/scc@1.1.0': {}
 
-  '@sentry-internal/browser-utils@10.53.1':
+  '@sentry-internal/browser-utils@10.56.0':
+    dependencies:
+      '@sentry/core': 10.56.0
+
+  '@sentry-internal/feedback@10.56.0':
     dependencies:
-      '@sentry/core': 10.53.1
+      '@sentry/core': 10.56.0
 
-  '@sentry-internal/feedback@10.53.1':
+  '@sentry-internal/replay-canvas@10.56.0':
     dependencies:
-      '@sentry/core': 10.53.1
+      '@sentry-internal/replay': 10.56.0
+      '@sentry/core': 10.56.0
 
-  '@sentry-internal/replay-canvas@10.53.1':
+  '@sentry-internal/replay@10.56.0':
     dependencies:
-      '@sentry-internal/replay': 10.53.1
-      '@sentry/core': 10.53.1
+      '@sentry-internal/browser-utils': 10.56.0
+      '@sentry/core': 10.56.0
 
-  '@sentry-internal/replay@10.53.1':
+  '@sentry-internal/server-utils@10.56.0':
     dependencies:
-      '@sentry-internal/browser-utils': 10.53.1
-      '@sentry/core': 10.53.1
+      '@sentry/core': 10.56.0
 
   '@sentry/babel-plugin-component-annotate@5.3.0': {}
 
-  '@sentry/browser@10.53.1':
+  '@sentry/browser@10.56.0':
     dependencies:
-      '@sentry-internal/browser-utils': 10.53.1
-      '@sentry-internal/feedback': 10.53.1
-      '@sentry-internal/replay': 10.53.1
-      '@sentry-internal/replay-canvas': 10.53.1
-      '@sentry/core': 10.53.1
+      '@sentry-internal/browser-utils': 10.56.0
+      '@sentry-internal/feedback': 10.56.0
+      '@sentry-internal/replay': 10.56.0
+      '@sentry-internal/replay-canvas': 10.56.0
+      '@sentry/core': 10.56.0
 
   '@sentry/bundler-plugin-core@5.3.0':
     dependencies:
-      '@babel/core': 7.29.0
+      '@babel/core': 7.29.7
       '@sentry/babel-plugin-component-annotate': 5.3.0
-      '@sentry/cli': 2.58.5
+      '@sentry/cli': 2.58.6
       dotenv: 16.6.1
       find-up: 5.0.0
       glob: 13.0.6
@@ -8354,31 +7942,31 @@ snapshots:
       - encoding
       - supports-color
 
-  '@sentry/cli-darwin@2.58.5':
+  '@sentry/cli-darwin@2.58.6':
     optional: true
 
-  '@sentry/cli-linux-arm64@2.58.5':
+  '@sentry/cli-linux-arm64@2.58.6':
     optional: true
 
-  '@sentry/cli-linux-arm@2.58.5':
+  '@sentry/cli-linux-arm@2.58.6':
     optional: true
 
-  '@sentry/cli-linux-i686@2.58.5':
+  '@sentry/cli-linux-i686@2.58.6':
     optional: true
 
-  '@sentry/cli-linux-x64@2.58.5':
+  '@sentry/cli-linux-x64@2.58.6':
     optional: true
 
-  '@sentry/cli-win32-arm64@2.58.5':
+  '@sentry/cli-win32-arm64@2.58.6':
     optional: true
 
-  '@sentry/cli-win32-i686@2.58.5':
+  '@sentry/cli-win32-i686@2.58.6':
     optional: true
 
-  '@sentry/cli-win32-x64@2.58.5':
+  '@sentry/cli-win32-x64@2.58.6':
     optional: true
 
-  '@sentry/cli@2.58.5':
+  '@sentry/cli@2.58.6':
     dependencies:
       https-proxy-agent: 5.0.1
       node-fetch: 2.7.0
@@ -8386,35 +7974,35 @@ snapshots:
       proxy-from-env: 1.1.0
       which: 2.0.2
     optionalDependencies:
-      '@sentry/cli-darwin': 2.58.5
-      '@sentry/cli-linux-arm': 2.58.5
-      '@sentry/cli-linux-arm64': 2.58.5
-      '@sentry/cli-linux-i686': 2.58.5
-      '@sentry/cli-linux-x64': 2.58.5
-      '@sentry/cli-win32-arm64': 2.58.5
-      '@sentry/cli-win32-i686': 2.58.5
-      '@sentry/cli-win32-x64': 2.58.5
+      '@sentry/cli-darwin': 2.58.6
+      '@sentry/cli-linux-arm': 2.58.6
+      '@sentry/cli-linux-arm64': 2.58.6
+      '@sentry/cli-linux-i686': 2.58.6
+      '@sentry/cli-linux-x64': 2.58.6
+      '@sentry/cli-win32-arm64': 2.58.6
+      '@sentry/cli-win32-i686': 2.58.6
+      '@sentry/cli-win32-x64': 2.58.6
     transitivePeerDependencies:
       - encoding
       - supports-color
 
-  '@sentry/core@10.53.1': {}
+  '@sentry/core@10.56.0': {}
 
-  '@sentry/nextjs@10.53.1(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(next@16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)(webpack@5.106.2(esbuild@0.27.7)(postcss@8.5.15))':
+  '@sentry/nextjs@10.56.0(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(next@16.2.7(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)(webpack@5.107.2(esbuild@0.27.7)(postcss@8.5.15))':
     dependencies:
       '@opentelemetry/api': 1.9.1
       '@opentelemetry/semantic-conventions': 1.41.1
-      '@rollup/plugin-commonjs': 28.0.1(rollup@4.60.4)
-      '@sentry-internal/browser-utils': 10.53.1
+      '@rollup/plugin-commonjs': 28.0.1(rollup@4.61.1)
+      '@sentry-internal/browser-utils': 10.56.0
       '@sentry/bundler-plugin-core': 5.3.0
-      '@sentry/core': 10.53.1
-      '@sentry/node': 10.53.1
-      '@sentry/opentelemetry': 10.53.1(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/semantic-conventions@1.41.1)
-      '@sentry/react': 10.53.1(react@19.2.4)
-      '@sentry/vercel-edge': 10.53.1
-      '@sentry/webpack-plugin': 5.3.0(webpack@5.106.2(esbuild@0.27.7)(postcss@8.5.15))
-      next: 16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
-      rollup: 4.60.4
+      '@sentry/core': 10.56.0
+      '@sentry/node': 10.56.0
+      '@sentry/opentelemetry': 10.56.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/semantic-conventions@1.41.1)
+      '@sentry/react': 10.56.0(react@19.2.4)
+      '@sentry/vercel-edge': 10.56.0
+      '@sentry/webpack-plugin': 5.3.0(webpack@5.107.2(esbuild@0.27.7)(postcss@8.5.15))
+      next: 16.2.7(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      rollup: 4.61.1
       stacktrace-parser: 0.1.11
     transitivePeerDependencies:
       - '@opentelemetry/core'
@@ -8425,10 +8013,10 @@ snapshots:
       - supports-color
       - webpack
 
-  '@sentry/node-core@10.53.1(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/instrumentation@0.214.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/semantic-conventions@1.41.1)':
+  '@sentry/node-core@10.56.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/instrumentation@0.214.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/semantic-conventions@1.41.1)':
     dependencies:
-      '@sentry/core': 10.53.1
-      '@sentry/opentelemetry': 10.53.1(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/semantic-conventions@1.41.1)
+      '@sentry/core': 10.56.0
+      '@sentry/opentelemetry': 10.56.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/semantic-conventions@1.41.1)
       import-in-the-middle: 3.0.1
     optionalDependencies:
       '@opentelemetry/api': 1.9.1
@@ -8437,65 +8025,46 @@ snapshots:
       '@opentelemetry/sdk-trace-base': 2.7.1(@opentelemetry/api@1.9.1)
       '@opentelemetry/semantic-conventions': 1.41.1
 
-  '@sentry/node@10.53.1':
+  '@sentry/node@10.56.0':
     dependencies:
-      '@fastify/otel': 0.18.0(@opentelemetry/api@1.9.1)
       '@opentelemetry/api': 1.9.1
       '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1)
       '@opentelemetry/instrumentation': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-amqplib': 0.61.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-connect': 0.57.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-dataloader': 0.31.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-fs': 0.33.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-generic-pool': 0.57.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-graphql': 0.62.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-hapi': 0.60.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-http': 0.214.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-kafkajs': 0.23.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-knex': 0.58.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-koa': 0.62.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-lru-memoizer': 0.58.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-mongodb': 0.67.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-mongoose': 0.60.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-mysql': 0.60.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-mysql2': 0.60.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-pg': 0.66.0(@opentelemetry/api@1.9.1)
-      '@opentelemetry/instrumentation-tedious': 0.33.0(@opentelemetry/api@1.9.1)
       '@opentelemetry/sdk-trace-base': 2.7.1(@opentelemetry/api@1.9.1)
       '@opentelemetry/semantic-conventions': 1.41.1
-      '@prisma/instrumentation': 7.6.0(@opentelemetry/api@1.9.1)
-      '@sentry/core': 10.53.1
-      '@sentry/node-core': 10.53.1(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/instrumentation@0.214.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/semantic-conventions@1.41.1)
-      '@sentry/opentelemetry': 10.53.1(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/semantic-conventions@1.41.1)
+      '@sentry-internal/server-utils': 10.56.0
+      '@sentry/core': 10.56.0
+      '@sentry/node-core': 10.56.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/instrumentation@0.214.0(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/semantic-conventions@1.41.1)
+      '@sentry/opentelemetry': 10.56.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/semantic-conventions@1.41.1)
       import-in-the-middle: 3.0.1
     transitivePeerDependencies:
       - '@opentelemetry/exporter-trace-otlp-http'
       - supports-color
 
-  '@sentry/opentelemetry@10.53.1(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/semantic-conventions@1.41.1)':
+  '@sentry/opentelemetry@10.56.0(@opentelemetry/api@1.9.1)(@opentelemetry/core@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/sdk-trace-base@2.7.1(@opentelemetry/api@1.9.1))(@opentelemetry/semantic-conventions@1.41.1)':
     dependencies:
       '@opentelemetry/api': 1.9.1
       '@opentelemetry/core': 2.7.1(@opentelemetry/api@1.9.1)
       '@opentelemetry/sdk-trace-base': 2.7.1(@opentelemetry/api@1.9.1)
       '@opentelemetry/semantic-conventions': 1.41.1
-      '@sentry/core': 10.53.1
+      '@sentry/core': 10.56.0
 
-  '@sentry/react@10.53.1(react@19.2.4)':
+  '@sentry/react@10.56.0(react@19.2.4)':
     dependencies:
-      '@sentry/browser': 10.53.1
-      '@sentry/core': 10.53.1
+      '@sentry/browser': 10.56.0
+      '@sentry/core': 10.56.0
       react: 19.2.4
 
-  '@sentry/vercel-edge@10.53.1':
+  '@sentry/vercel-edge@10.56.0':
     dependencies:
       '@opentelemetry/api': 1.9.1
       '@opentelemetry/resources': 2.7.1(@opentelemetry/api@1.9.1)
-      '@sentry/core': 10.53.1
+      '@sentry/core': 10.56.0
 
-  '@sentry/webpack-plugin@5.3.0(webpack@5.106.2(esbuild@0.27.7)(postcss@8.5.15))':
+  '@sentry/webpack-plugin@5.3.0(webpack@5.107.2(esbuild@0.27.7)(postcss@8.5.15))':
     dependencies:
       '@sentry/bundler-plugin-core': 5.3.0
-      webpack: 5.106.2(esbuild@0.27.7)(postcss@8.5.15)
+      webpack: 5.107.2(esbuild@0.27.7)(postcss@8.5.15)
     transitivePeerDependencies:
       - encoding
       - supports-color
@@ -8517,41 +8086,41 @@ snapshots:
       '@sinonjs/commons': 3.0.1
       type-detect: 4.1.0
 
-  '@smithy/core@3.24.3':
+  '@smithy/core@3.24.6':
     dependencies:
       '@aws-crypto/crc32': 5.2.0
-      '@smithy/types': 4.14.2
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@smithy/credential-provider-imds@4.3.3':
+  '@smithy/credential-provider-imds@4.3.8':
     dependencies:
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@smithy/fetch-http-handler@5.4.3':
+  '@smithy/fetch-http-handler@5.4.6':
     dependencies:
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
   '@smithy/is-array-buffer@2.2.0':
     dependencies:
       tslib: 2.8.1
 
-  '@smithy/node-http-handler@4.7.3':
+  '@smithy/node-http-handler@4.7.7':
     dependencies:
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@smithy/signature-v4@5.4.3':
+  '@smithy/signature-v4@5.4.6':
     dependencies:
-      '@smithy/core': 3.24.3
-      '@smithy/types': 4.14.2
+      '@smithy/core': 3.24.6
+      '@smithy/types': 4.14.3
       tslib: 2.8.1
 
-  '@smithy/types@4.14.2':
+  '@smithy/types@4.14.3':
     dependencies:
       tslib: 2.8.1
 
@@ -8573,17 +8142,17 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  '@tanstack/query-core@5.100.11': {}
+  '@tanstack/query-core@5.101.0': {}
 
-  '@tanstack/react-query@5.100.11(react@19.2.4)':
+  '@tanstack/react-query@5.101.0(react@19.2.4)':
     dependencies:
-      '@tanstack/query-core': 5.100.11
+      '@tanstack/query-core': 5.101.0
       react: 19.2.4
 
   '@testing-library/dom@10.4.1':
     dependencies:
-      '@babel/code-frame': 7.29.0
-      '@babel/runtime': 7.29.2
+      '@babel/code-frame': 7.29.7
+      '@babel/runtime': 7.29.7
       '@types/aria-query': 5.0.4
       aria-query: 5.3.0
       dom-accessibility-api: 0.5.16
@@ -8593,7 +8162,7 @@ snapshots:
 
   '@testing-library/jest-dom@6.9.1':
     dependencies:
-      '@adobe/css-tools': 4.4.4
+      '@adobe/css-tools': 4.5.0
       aria-query: 5.3.2
       css.escape: 1.5.1
       dom-accessibility-api: 0.6.3
@@ -8602,7 +8171,7 @@ snapshots:
 
   '@testing-library/react@16.3.2(@testing-library/dom@10.4.1)(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@babel/runtime': 7.29.2
+      '@babel/runtime': 7.29.7
       '@testing-library/dom': 10.4.1
       react: 19.2.4
       react-dom: 19.2.4(react@19.2.4)
@@ -8617,7 +8186,7 @@ snapshots:
     dependencies:
       minimatch: 10.2.5
       path-browserify: 1.0.1
-      tinyglobby: 0.2.16
+      tinyglobby: 0.2.17
 
   '@tybys/wasm-util@0.10.2':
     dependencies:
@@ -8628,52 +8197,36 @@ snapshots:
 
   '@types/babel__core@7.20.5':
     dependencies:
-      '@babel/parser': 7.29.3
-      '@babel/types': 7.29.0
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
       '@types/babel__generator': 7.27.0
       '@types/babel__template': 7.4.4
       '@types/babel__traverse': 7.28.0
 
   '@types/babel__generator@7.27.0':
     dependencies:
-      '@babel/types': 7.29.0
+      '@babel/types': 7.29.7
 
   '@types/babel__template@7.4.4':
     dependencies:
-      '@babel/parser': 7.29.3
-      '@babel/types': 7.29.0
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
 
   '@types/babel__traverse@7.28.0':
     dependencies:
-      '@babel/types': 7.29.0
+      '@babel/types': 7.29.7
 
   '@types/chai@5.2.3':
     dependencies:
       '@types/deep-eql': 4.0.2
       assertion-error: 2.0.1
 
-  '@types/connect@3.4.38':
-    dependencies:
-      '@types/node': 25.9.1
-
   '@types/debug@4.1.13':
     dependencies:
       '@types/ms': 2.1.0
 
   '@types/deep-eql@4.0.2': {}
 
-  '@types/eslint-scope@3.7.7':
-    dependencies:
-      '@types/eslint': 9.6.1
-      '@types/estree': 1.0.9
-
-  '@types/eslint@9.6.1':
-    dependencies:
-      '@types/estree': 1.0.9
-      '@types/json-schema': 7.0.15
-
-  '@types/estree@1.0.8': {}
-
   '@types/estree@1.0.9': {}
 
   '@types/json-schema@7.0.15': {}
@@ -8683,19 +8236,15 @@ snapshots:
   '@types/jsonwebtoken@9.0.10':
     dependencies:
       '@types/ms': 2.1.0
-      '@types/node': 25.9.1
+      '@types/node': 25.9.2
 
   '@types/minimist@1.2.5': {}
 
   '@types/ms@2.1.0': {}
 
-  '@types/mysql@2.15.27':
-    dependencies:
-      '@types/node': 25.9.1
-
   '@types/node@17.0.45': {}
 
-  '@types/node@25.9.1':
+  '@types/node@25.9.2':
     dependencies:
       undici-types: 7.24.6
 
@@ -8703,21 +8252,17 @@ snapshots:
 
   '@types/papaparse@5.5.2':
     dependencies:
-      '@types/node': 25.9.1
-
-  '@types/pg-pool@2.0.7':
-    dependencies:
-      '@types/pg': 8.15.6
+      '@types/node': 25.9.2
 
-  '@types/pg@8.15.6':
+  '@types/pg@8.20.0':
     dependencies:
-      '@types/node': 25.9.1
+      '@types/node': 25.9.2
       pg-protocol: 1.14.0
       pg-types: 2.2.0
 
   '@types/prompts@2.4.9':
     dependencies:
-      '@types/node': 25.9.1
+      '@types/node': 25.9.2
       kleur: 3.0.3
 
   '@types/react@19.2.14':
@@ -8732,24 +8277,20 @@ snapshots:
 
   '@types/swagger-jsdoc@6.0.4': {}
 
-  '@types/tedious@4.0.14':
-    dependencies:
-      '@types/node': 25.9.1
-
   '@types/whatwg-mimetype@3.0.2': {}
 
   '@types/ws@8.18.1':
     dependencies:
-      '@types/node': 25.9.1
+      '@types/node': 25.9.2
 
-  '@typescript-eslint/eslint-plugin@8.59.4(@typescript-eslint/parser@8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)':
+  '@typescript-eslint/eslint-plugin@8.60.1(@typescript-eslint/parser@8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)':
     dependencies:
       '@eslint-community/regexpp': 4.12.2
-      '@typescript-eslint/parser': 8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/scope-manager': 8.59.4
-      '@typescript-eslint/type-utils': 8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/utils': 8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/visitor-keys': 8.59.4
+      '@typescript-eslint/parser': 8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/scope-manager': 8.60.1
+      '@typescript-eslint/type-utils': 8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.60.1
       eslint: 9.39.4(jiti@2.7.0)
       ignore: 7.0.5
       natural-compare: 1.4.0
@@ -8758,41 +8299,41 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/parser@8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)':
+  '@typescript-eslint/parser@8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)':
     dependencies:
-      '@typescript-eslint/scope-manager': 8.59.4
-      '@typescript-eslint/types': 8.59.4
-      '@typescript-eslint/typescript-estree': 8.59.4(typescript@5.9.3)
-      '@typescript-eslint/visitor-keys': 8.59.4
+      '@typescript-eslint/scope-manager': 8.60.1
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/typescript-estree': 8.60.1(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.60.1
       debug: 4.4.3
       eslint: 9.39.4(jiti@2.7.0)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/project-service@8.59.4(typescript@5.9.3)':
+  '@typescript-eslint/project-service@8.60.1(typescript@5.9.3)':
     dependencies:
-      '@typescript-eslint/tsconfig-utils': 8.59.4(typescript@5.9.3)
-      '@typescript-eslint/types': 8.59.4
+      '@typescript-eslint/tsconfig-utils': 8.60.1(typescript@5.9.3)
+      '@typescript-eslint/types': 8.60.1
       debug: 4.4.3
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/scope-manager@8.59.4':
+  '@typescript-eslint/scope-manager@8.60.1':
     dependencies:
-      '@typescript-eslint/types': 8.59.4
-      '@typescript-eslint/visitor-keys': 8.59.4
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/visitor-keys': 8.60.1
 
-  '@typescript-eslint/tsconfig-utils@8.59.4(typescript@5.9.3)':
+  '@typescript-eslint/tsconfig-utils@8.60.1(typescript@5.9.3)':
     dependencies:
       typescript: 5.9.3
 
-  '@typescript-eslint/type-utils@8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)':
+  '@typescript-eslint/type-utils@8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)':
     dependencies:
-      '@typescript-eslint/types': 8.59.4
-      '@typescript-eslint/typescript-estree': 8.59.4(typescript@5.9.3)
-      '@typescript-eslint/utils': 8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/typescript-estree': 8.60.1(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
       debug: 4.4.3
       eslint: 9.39.4(jiti@2.7.0)
       ts-api-utils: 2.5.0(typescript@5.9.3)
@@ -8800,37 +8341,37 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/types@8.59.4': {}
+  '@typescript-eslint/types@8.60.1': {}
 
-  '@typescript-eslint/typescript-estree@8.59.4(typescript@5.9.3)':
+  '@typescript-eslint/typescript-estree@8.60.1(typescript@5.9.3)':
     dependencies:
-      '@typescript-eslint/project-service': 8.59.4(typescript@5.9.3)
-      '@typescript-eslint/tsconfig-utils': 8.59.4(typescript@5.9.3)
-      '@typescript-eslint/types': 8.59.4
-      '@typescript-eslint/visitor-keys': 8.59.4
+      '@typescript-eslint/project-service': 8.60.1(typescript@5.9.3)
+      '@typescript-eslint/tsconfig-utils': 8.60.1(typescript@5.9.3)
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/visitor-keys': 8.60.1
       debug: 4.4.3
       minimatch: 10.2.5
-      semver: 7.8.0
-      tinyglobby: 0.2.16
+      semver: 7.8.2
+      tinyglobby: 0.2.17
       ts-api-utils: 2.5.0(typescript@5.9.3)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/utils@8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)':
+  '@typescript-eslint/utils@8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)':
     dependencies:
       '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.4(jiti@2.7.0))
-      '@typescript-eslint/scope-manager': 8.59.4
-      '@typescript-eslint/types': 8.59.4
-      '@typescript-eslint/typescript-estree': 8.59.4(typescript@5.9.3)
+      '@typescript-eslint/scope-manager': 8.60.1
+      '@typescript-eslint/types': 8.60.1
+      '@typescript-eslint/typescript-estree': 8.60.1(typescript@5.9.3)
       eslint: 9.39.4(jiti@2.7.0)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/visitor-keys@8.59.4':
+  '@typescript-eslint/visitor-keys@8.60.1':
     dependencies:
-      '@typescript-eslint/types': 8.59.4
+      '@typescript-eslint/types': 8.60.1
       eslint-visitor-keys: 5.0.1
 
   '@ucast/core@1.10.2': {}
@@ -8919,21 +8460,21 @@ snapshots:
   '@unrs/resolver-binding-win32-x64-msvc@1.12.2':
     optional: true
 
-  '@vitejs/plugin-react@5.2.0(vite@8.0.13(@types/node@25.9.1)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0))':
+  '@vitejs/plugin-react@5.2.0(vite@8.0.16(@types/node@25.9.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0))':
     dependencies:
-      '@babel/core': 7.29.0
-      '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.29.0)
-      '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/core@7.29.0)
+      '@babel/core': 7.29.7
+      '@babel/plugin-transform-react-jsx-self': 7.29.7(@babel/core@7.29.7)
+      '@babel/plugin-transform-react-jsx-source': 7.29.7(@babel/core@7.29.7)
       '@rolldown/pluginutils': 1.0.0-rc.3
       '@types/babel__core': 7.20.5
       react-refresh: 0.18.0
-      vite: 8.0.13(@types/node@25.9.1)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0)
+      vite: 8.0.16(@types/node@25.9.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0)
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/coverage-istanbul@4.1.6(vitest@4.1.6)':
+  '@vitest/coverage-istanbul@4.1.8(vitest@4.1.8)':
     dependencies:
-      '@babel/core': 7.29.0
+      '@babel/core': 7.29.7
       '@istanbuljs/schema': 0.1.6
       '@jridgewell/gen-mapping': 0.3.13
       '@jridgewell/trace-mapping': 0.3.31
@@ -8941,70 +8482,70 @@ snapshots:
       istanbul-lib-report: 3.0.1
       istanbul-reports: 3.2.0
       magicast: 0.5.3
-      obug: 2.1.1
+      obug: 2.1.2
       tinyrainbow: 3.1.0
-      vitest: 4.1.6(@opentelemetry/api@1.9.1)(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.6)(@vitest/coverage-v8@4.1.6)(happy-dom@20.9.0)(vite@8.0.13(@types/node@25.9.1)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0))
+      vitest: 4.1.8(@opentelemetry/api@1.9.1)(@types/node@25.9.2)(@vitest/coverage-istanbul@4.1.8)(@vitest/coverage-v8@4.1.8)(happy-dom@20.10.1)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0))
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/coverage-v8@4.1.6(vitest@4.1.6)':
+  '@vitest/coverage-v8@4.1.8(vitest@4.1.8)':
     dependencies:
       '@bcoe/v8-coverage': 1.0.2
-      '@vitest/utils': 4.1.6
-      ast-v8-to-istanbul: 1.0.0
+      '@vitest/utils': 4.1.8
+      ast-v8-to-istanbul: 1.0.3
       istanbul-lib-coverage: 3.2.2
       istanbul-lib-report: 3.0.1
       istanbul-reports: 3.2.0
       magicast: 0.5.3
-      obug: 2.1.1
+      obug: 2.1.2
       std-env: 4.1.0
       tinyrainbow: 3.1.0
-      vitest: 4.1.6(@opentelemetry/api@1.9.1)(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.6)(@vitest/coverage-v8@4.1.6)(happy-dom@20.9.0)(vite@8.0.13(@types/node@25.9.1)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0))
+      vitest: 4.1.8(@opentelemetry/api@1.9.1)(@types/node@25.9.2)(@vitest/coverage-istanbul@4.1.8)(@vitest/coverage-v8@4.1.8)(happy-dom@20.10.1)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0))
 
-  '@vitest/expect@4.1.6':
+  '@vitest/expect@4.1.8':
     dependencies:
       '@standard-schema/spec': 1.1.0
       '@types/chai': 5.2.3
-      '@vitest/spy': 4.1.6
-      '@vitest/utils': 4.1.6
+      '@vitest/spy': 4.1.8
+      '@vitest/utils': 4.1.8
       chai: 6.2.2
       tinyrainbow: 3.1.0
 
-  '@vitest/mocker@4.1.6(vite@8.0.13(@types/node@25.9.1)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0))':
+  '@vitest/mocker@4.1.8(vite@8.0.16(@types/node@25.9.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0))':
     dependencies:
-      '@vitest/spy': 4.1.6
+      '@vitest/spy': 4.1.8
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 8.0.13(@types/node@25.9.1)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0)
+      vite: 8.0.16(@types/node@25.9.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0)
 
-  '@vitest/pretty-format@4.1.6':
+  '@vitest/pretty-format@4.1.8':
     dependencies:
       tinyrainbow: 3.1.0
 
-  '@vitest/runner@4.1.6':
+  '@vitest/runner@4.1.8':
     dependencies:
-      '@vitest/utils': 4.1.6
+      '@vitest/utils': 4.1.8
       pathe: 2.0.3
 
-  '@vitest/snapshot@4.1.6':
+  '@vitest/snapshot@4.1.8':
     dependencies:
-      '@vitest/pretty-format': 4.1.6
-      '@vitest/utils': 4.1.6
+      '@vitest/pretty-format': 4.1.8
+      '@vitest/utils': 4.1.8
       magic-string: 0.30.21
       pathe: 2.0.3
 
-  '@vitest/spy@4.1.6': {}
+  '@vitest/spy@4.1.8': {}
 
-  '@vitest/utils@4.1.6':
+  '@vitest/utils@4.1.8':
     dependencies:
-      '@vitest/pretty-format': 4.1.6
+      '@vitest/pretty-format': 4.1.8
       convert-source-map: 2.0.0
       tinyrainbow: 3.1.0
 
   '@vue/compiler-core@3.5.25':
     dependencies:
-      '@babel/parser': 7.29.3
+      '@babel/parser': 7.29.7
       '@vue/shared': 3.5.25
       entities: 4.5.0
       estree-walker: 2.0.2
@@ -9017,7 +8558,7 @@ snapshots:
 
   '@vue/compiler-sfc@3.5.25':
     dependencies:
-      '@babel/parser': 7.29.3
+      '@babel/parser': 7.29.7
       '@vue/compiler-core': 3.5.25
       '@vue/compiler-dom': 3.5.25
       '@vue/compiler-ssr': 3.5.25
@@ -9199,7 +8740,7 @@ snapshots:
 
   ansi-styles@6.2.3: {}
 
-  anti-trojan-source@1.11.2:
+  anti-trojan-source@1.11.3:
     dependencies:
       globby: 12.2.0
       meow: 10.1.5
@@ -9223,7 +8764,7 @@ snapshots:
       call-bound: 1.0.4
       define-properties: 1.2.1
       es-abstract: 1.24.2
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       get-intrinsic: 1.3.0
       is-string: 1.1.1
       math-intrinsics: 1.1.0
@@ -9236,7 +8777,7 @@ snapshots:
       define-properties: 1.2.1
       es-abstract: 1.24.2
       es-errors: 1.3.0
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       es-shim-unscopables: 1.1.0
 
   array.prototype.findlastindex@1.2.6:
@@ -9246,7 +8787,7 @@ snapshots:
       define-properties: 1.2.1
       es-abstract: 1.24.2
       es-errors: 1.3.0
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       es-shim-unscopables: 1.1.0
 
   array.prototype.flat@1.3.3:
@@ -9285,7 +8826,7 @@ snapshots:
 
   assertion-error@2.0.1: {}
 
-  ast-v8-to-istanbul@1.0.0:
+  ast-v8-to-istanbul@1.0.3:
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
       estree-walker: 3.0.3
@@ -9317,7 +8858,7 @@ snapshots:
       sinon: 18.0.1
       tslib: 2.8.1
 
-  axios@1.16.1(debug@4.4.3):
+  axios@1.17.0(debug@4.4.3):
     dependencies:
       follow-redirects: 1.16.0(debug@4.4.3)
       form-data: 4.0.5
@@ -9333,7 +8874,7 @@ snapshots:
 
   base64-js@1.5.1: {}
 
-  baseline-browser-mapping@2.10.31: {}
+  baseline-browser-mapping@2.10.34: {}
 
   before-after-hook@4.0.0: {}
 
@@ -9363,34 +8904,33 @@ snapshots:
 
   browserslist@4.28.1:
     dependencies:
-      baseline-browser-mapping: 2.10.31
-      caniuse-lite: 1.0.30001793
-      electron-to-chromium: 1.5.359
-      node-releases: 2.0.44
+      baseline-browser-mapping: 2.10.34
+      caniuse-lite: 1.0.30001797
+      electron-to-chromium: 1.5.368
+      node-releases: 2.0.47
       update-browserslist-db: 1.2.3(browserslist@4.28.1)
 
   browserslist@4.28.2:
     dependencies:
-      baseline-browser-mapping: 2.10.31
-      caniuse-lite: 1.0.30001793
-      electron-to-chromium: 1.5.359
-      node-releases: 2.0.44
+      baseline-browser-mapping: 2.10.34
+      caniuse-lite: 1.0.30001797
+      electron-to-chromium: 1.5.368
+      node-releases: 2.0.47
       update-browserslist-db: 1.2.3(browserslist@4.28.2)
 
   buffer-equal-constant-time@1.0.1: {}
 
   buffer-from@1.1.2: {}
 
+  buffer-image-size@0.6.4:
+    dependencies:
+      '@types/node': 25.9.2
+
   buffer@5.6.0:
     dependencies:
       base64-js: 1.5.1
       ieee754: 1.2.1
 
-  bundle-n-require@1.1.2:
-    dependencies:
-      esbuild: 0.25.12
-      node-eval: 2.0.0
-
   bytes@3.1.2: {}
 
   c12@3.3.4(magicast@0.5.3):
@@ -9442,7 +8982,7 @@ snapshots:
 
   camelcase@6.3.0: {}
 
-  caniuse-lite@1.0.30001793: {}
+  caniuse-lite@1.0.30001797: {}
 
   chai@6.2.2: {}
 
@@ -9565,7 +9105,7 @@ snapshots:
     dependencies:
       env-paths: 2.2.1
       import-fresh: 3.3.1
-      js-yaml: 4.1.1
+      js-yaml: 4.2.0
       parse-json: 5.2.0
     optionalDependencies:
       typescript: 5.9.3
@@ -9608,7 +9148,7 @@ snapshots:
       es-errors: 1.3.0
       is-data-view: 1.0.2
 
-  dayjs@1.11.20: {}
+  dayjs@1.11.21: {}
 
   debug@3.2.7:
     dependencies:
@@ -9685,7 +9225,7 @@ snapshots:
 
   dom-helpers@5.2.1:
     dependencies:
-      '@babel/runtime': 7.29.2
+      '@babel/runtime': 7.29.7
       csstype: 3.2.3
 
   dotenv-expand@12.0.3:
@@ -9712,7 +9252,7 @@ snapshots:
 
   eight-colors@1.3.3: {}
 
-  electron-to-chromium@1.5.359: {}
+  electron-to-chromium@1.5.368: {}
 
   emoji-regex@10.6.0: {}
 
@@ -9720,7 +9260,7 @@ snapshots:
 
   encodeurl@2.0.0: {}
 
-  enhanced-resolve@5.22.0:
+  enhanced-resolve@5.23.0:
     dependencies:
       graceful-fs: 4.2.11
       tapable: 2.3.3
@@ -9749,7 +9289,7 @@ snapshots:
       data-view-byte-offset: 1.0.1
       es-define-property: 1.0.1
       es-errors: 1.3.0
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       es-set-tostringtag: 2.1.0
       es-to-primitive: 1.3.0
       function.prototype.name: 1.1.8
@@ -9761,7 +9301,7 @@ snapshots:
       has-property-descriptors: 1.0.2
       has-proto: 1.2.0
       has-symbols: 1.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       internal-slot: 1.1.0
       is-array-buffer: 3.0.5
       is-callable: 1.2.7
@@ -9784,15 +9324,15 @@ snapshots:
       safe-regex-test: 1.1.0
       set-proto: 1.0.0
       stop-iteration-iterator: 1.1.0
-      string.prototype.trim: 1.2.10
-      string.prototype.trimend: 1.0.9
+      string.prototype.trim: 1.2.11
+      string.prototype.trimend: 1.0.10
       string.prototype.trimstart: 1.0.8
       typed-array-buffer: 1.0.3
       typed-array-byte-length: 1.0.3
       typed-array-byte-offset: 1.0.4
-      typed-array-length: 1.0.7
+      typed-array-length: 1.0.8
       unbox-primitive: 1.1.0
-      which-typed-array: 1.1.20
+      which-typed-array: 1.1.22
 
   es-define-property@1.0.1: {}
 
@@ -9819,7 +9359,7 @@ snapshots:
 
   es-module-lexer@2.1.0: {}
 
-  es-object-atoms@1.1.1:
+  es-object-atoms@1.1.2:
     dependencies:
       es-errors: 1.3.0
 
@@ -9828,11 +9368,11 @@ snapshots:
       es-errors: 1.3.0
       get-intrinsic: 1.3.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   es-shim-unscopables@1.1.0:
     dependencies:
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   es-to-primitive@1.3.0:
     dependencies:
@@ -9923,7 +9463,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  eslint-import-resolver-typescript@4.4.4(eslint-plugin-import@2.32.0)(eslint@9.39.4(jiti@2.7.0)):
+  eslint-import-resolver-typescript@4.4.5(eslint-plugin-import@2.32.0)(eslint@9.39.4(jiti@2.7.0)):
     dependencies:
       debug: 4.4.3
       eslint: 9.39.4(jiti@2.7.0)
@@ -9931,29 +9471,29 @@ snapshots:
       get-tsconfig: 4.14.0
       is-bun-module: 2.0.0
       stable-hash-x: 0.2.0
-      tinyglobby: 0.2.16
+      tinyglobby: 0.2.17
       unrs-resolver: 1.12.2
     optionalDependencies:
-      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.4)(eslint@9.39.4(jiti@2.7.0))
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.5)(eslint@9.39.4(jiti@2.7.0))
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.12.1(@typescript-eslint/parser@8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.4)(eslint@9.39.4(jiti@2.7.0)):
+  eslint-module-utils@2.13.0(@typescript-eslint/parser@8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.5)(eslint@9.39.4(jiti@2.7.0)):
     dependencies:
       debug: 3.2.7
     optionalDependencies:
-      '@typescript-eslint/parser': 8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/parser': 8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
       eslint: 9.39.4(jiti@2.7.0)
       eslint-import-resolver-node: 0.3.10
-      eslint-import-resolver-typescript: 4.4.4(eslint-plugin-import@2.32.0)(eslint@9.39.4(jiti@2.7.0))
+      eslint-import-resolver-typescript: 4.4.5(eslint-plugin-import@2.32.0)(eslint@9.39.4(jiti@2.7.0))
     transitivePeerDependencies:
       - supports-color
 
   eslint-plugin-anti-trojan-source@1.1.6:
     dependencies:
-      anti-trojan-source: 1.11.2
+      anti-trojan-source: 1.11.3
 
-  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.4)(eslint@9.39.4(jiti@2.7.0)):
+  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-typescript@4.4.5)(eslint@9.39.4(jiti@2.7.0)):
     dependencies:
       '@rtsao/scc': 1.1.0
       array-includes: 3.1.9
@@ -9964,8 +9504,8 @@ snapshots:
       doctrine: 2.1.0
       eslint: 9.39.4(jiti@2.7.0)
       eslint-import-resolver-node: 0.3.10
-      eslint-module-utils: 2.12.1(@typescript-eslint/parser@8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.4)(eslint@9.39.4(jiti@2.7.0))
-      hasown: 2.0.3
+      eslint-module-utils: 2.13.0(@typescript-eslint/parser@8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint-import-resolver-node@0.3.10)(eslint-import-resolver-typescript@4.4.5)(eslint@9.39.4(jiti@2.7.0))
+      hasown: 2.0.4
       is-core-module: 2.16.2
       is-glob: 4.0.3
       minimatch: 10.2.5
@@ -9973,10 +9513,10 @@ snapshots:
       object.groupby: 1.0.3
       object.values: 1.2.1
       semver: 6.3.1
-      string.prototype.trimend: 1.0.9
+      string.prototype.trimend: 1.0.10
       tsconfig-paths: 3.15.0
     optionalDependencies:
-      '@typescript-eslint/parser': 8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/parser': 8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
     transitivePeerDependencies:
       - eslint-import-resolver-typescript
       - eslint-import-resolver-webpack
@@ -9984,8 +9524,8 @@ snapshots:
 
   eslint-plugin-react-hooks@7.0.1(eslint@9.39.4(jiti@2.7.0)):
     dependencies:
-      '@babel/core': 7.29.0
-      '@babel/parser': 7.29.3
+      '@babel/core': 7.29.7
+      '@babel/parser': 7.29.7
       eslint: 9.39.4(jiti@2.7.0)
       hermes-parser: 0.25.1
       zod: 4.4.3
@@ -10003,7 +9543,7 @@ snapshots:
       es-iterator-helpers: 1.3.2
       eslint: 9.39.4(jiti@2.7.0)
       estraverse: 5.3.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       jsx-ast-utils: 3.3.5
       minimatch: 10.2.5
       object.entries: 1.1.9
@@ -10104,11 +9644,11 @@ snapshots:
 
   events@3.3.0: {}
 
-  eventsource-parser@3.0.8: {}
+  eventsource-parser@3.1.0: {}
 
   eventsource@3.0.7:
     dependencies:
-      eventsource-parser: 3.0.8
+      eventsource-parser: 3.1.0
 
   expect-type@1.3.0: {}
 
@@ -10152,8 +9692,6 @@ snapshots:
 
   exsolve@1.0.8: {}
 
-  fast-content-type-parse@3.0.0: {}
-
   fast-deep-equal@3.1.3: {}
 
   fast-glob@3.3.1:
@@ -10185,12 +9723,13 @@ snapshots:
       path-expression-matcher: 1.5.0
       xml-naming: 0.1.0
 
-  fast-xml-parser@5.7.3:
+  fast-xml-parser@5.8.0:
     dependencies:
-      '@nodable/entities': 2.1.0
+      '@nodable/entities': 2.1.1
       fast-xml-builder: 1.2.0
       path-expression-matcher: 1.5.0
       strnum: 2.3.0
+      xml-naming: 0.1.0
 
   fastq@1.20.1:
     dependencies:
@@ -10252,11 +9791,9 @@ snapshots:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       es-set-tostringtag: 2.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       mime-types: 2.1.35
 
-  forwarded-parse@2.1.2: {}
-
   forwarded@0.2.0: {}
 
   fresh@0.5.2: {}
@@ -10285,7 +9822,7 @@ snapshots:
       call-bound: 1.0.4
       define-properties: 1.2.1
       functions-have-names: 1.2.3
-      hasown: 2.0.3
+      hasown: 2.0.4
       is-callable: 1.2.7
 
   functions-have-names@1.2.3: {}
@@ -10303,12 +9840,12 @@ snapshots:
       call-bind-apply-helpers: 1.0.2
       es-define-property: 1.0.1
       es-errors: 1.3.0
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       function-bind: 1.1.2
       get-proto: 1.0.1
       gopd: 1.2.0
       has-symbols: 1.1.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       math-intrinsics: 1.1.0
 
   get-nonce@1.0.1: {}
@@ -10316,7 +9853,7 @@ snapshots:
   get-proto@1.0.1:
     dependencies:
       dunder-proto: 1.0.1
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
 
   get-symbol-description@1.1.0:
     dependencies:
@@ -10377,14 +9914,15 @@ snapshots:
 
   graceful-fs@4.2.11: {}
 
-  happy-dom@20.9.0:
+  happy-dom@20.10.1:
     dependencies:
-      '@types/node': 25.9.1
+      '@types/node': 25.9.2
       '@types/whatwg-mimetype': 3.0.2
       '@types/ws': 8.18.1
+      buffer-image-size: 0.6.4
       entities: 7.0.1
       whatwg-mimetype: 3.0.0
-      ws: 8.20.1
+      ws: 8.21.0
     transitivePeerDependencies:
       - bufferutil
       - utf-8-validate
@@ -10409,7 +9947,7 @@ snapshots:
     dependencies:
       has-symbols: 1.1.0
 
-  hasown@2.0.3:
+  hasown@2.0.4:
     dependencies:
       function-bind: 1.1.2
 
@@ -10421,7 +9959,7 @@ snapshots:
 
   highlight.js@11.11.1: {}
 
-  hono@4.12.21: {}
+  hono@4.12.23: {}
 
   hosted-git-info@4.1.0:
     dependencies:
@@ -10474,13 +10012,6 @@ snapshots:
       parent-module: 1.0.1
       resolve-from: 4.0.0
 
-  import-in-the-middle@2.0.6:
-    dependencies:
-      acorn: 8.16.0
-      acorn-import-attributes: 1.9.5(acorn@8.16.0)
-      cjs-module-lexer: 2.2.0
-      module-details-from-path: 1.0.4
-
   import-in-the-middle@3.0.1:
     dependencies:
       acorn: 8.16.0
@@ -10511,7 +10042,7 @@ snapshots:
   internal-slot@1.1.0:
     dependencies:
       es-errors: 1.3.0
-      hasown: 2.0.3
+      hasown: 2.0.4
       side-channel: 1.1.0
 
   ip-address@10.2.0: {}
@@ -10545,13 +10076,13 @@ snapshots:
 
   is-bun-module@2.0.0:
     dependencies:
-      semver: 7.8.0
+      semver: 7.8.2
 
   is-callable@1.2.7: {}
 
   is-core-module@2.16.2:
     dependencies:
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   is-data-view@1.0.2:
     dependencies:
@@ -10612,7 +10143,7 @@ snapshots:
       call-bound: 1.0.4
       gopd: 1.2.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.3
+      hasown: 2.0.4
 
   is-set@2.0.3: {}
 
@@ -10633,7 +10164,7 @@ snapshots:
 
   is-typed-array@1.1.15:
     dependencies:
-      which-typed-array: 1.1.20
+      which-typed-array: 1.1.22
 
   is-weakmap@2.0.2: {}
 
@@ -10656,11 +10187,11 @@ snapshots:
 
   istanbul-lib-instrument@6.0.3:
     dependencies:
-      '@babel/core': 7.29.0
-      '@babel/parser': 7.29.3
+      '@babel/core': 7.29.7
+      '@babel/parser': 7.29.7
       '@istanbuljs/schema': 0.1.6
       istanbul-lib-coverage: 3.2.2
-      semver: 7.8.0
+      semver: 7.8.2
     transitivePeerDependencies:
       - supports-color
 
@@ -10678,7 +10209,7 @@ snapshots:
   iterator.prototype@1.1.5:
     dependencies:
       define-data-property: 1.1.4
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       get-intrinsic: 1.3.0
       get-proto: 1.0.1
       has-symbols: 1.1.0
@@ -10688,7 +10219,7 @@ snapshots:
 
   jest-worker@27.5.1:
     dependencies:
-      '@types/node': 25.9.1
+      '@types/node': 25.9.2
       merge-stream: 2.0.0
       supports-color: 8.1.1
 
@@ -10702,7 +10233,7 @@ snapshots:
 
   js-tokens@4.0.0: {}
 
-  js-yaml@4.1.1:
+  js-yaml@4.2.0:
     dependencies:
       argparse: 2.0.1
 
@@ -10714,7 +10245,7 @@ snapshots:
 
   json-schema-to-ts@3.1.1:
     dependencies:
-      '@babel/runtime': 7.29.2
+      '@babel/runtime': 7.29.7
       ts-algebra: 2.0.0
 
   json-schema-traverse@0.4.1: {}
@@ -10750,7 +10281,7 @@ snapshots:
       lodash.isstring: 4.0.1
       lodash.once: 4.1.1
       ms: 2.1.3
-      semver: 7.8.0
+      semver: 7.8.2
 
   jsx-ast-utils@3.3.5:
     dependencies:
@@ -10792,7 +10323,7 @@ snapshots:
 
   koa-static-resolver@1.0.6: {}
 
-  koa@3.2.0:
+  koa@3.2.1:
     dependencies:
       accepts: 1.3.8
       content-disposition: 1.0.1
@@ -10861,7 +10392,7 @@ snapshots:
     dependencies:
       isomorphic.js: 0.2.5
 
-  libphonenumber-js@1.13.2: {}
+  libphonenumber-js@1.13.6: {}
 
   lightningcss-android-arm64@1.31.1:
     optional: true
@@ -10969,7 +10500,7 @@ snapshots:
       listr2: 9.0.5
       picomatch: 4.0.4
       string-argv: 0.3.2
-      tinyexec: 1.1.2
+      tinyexec: 1.2.4
       yaml: 2.9.0
 
   listr2@9.0.5:
@@ -11025,7 +10556,7 @@ snapshots:
     dependencies:
       js-tokens: 4.0.0
 
-  lru-cache@11.4.0: {}
+  lru-cache@11.5.1: {}
 
   lru-cache@5.1.1:
     dependencies:
@@ -11045,13 +10576,13 @@ snapshots:
 
   magicast@0.5.3:
     dependencies:
-      '@babel/parser': 7.29.3
-      '@babel/types': 7.29.0
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
       source-map-js: 1.2.1
 
   mailgun.js@12.9.0(debug@4.4.3):
     dependencies:
-      axios: 1.16.1(debug@4.4.3)
+      axios: 1.17.0(debug@4.4.3)
       base-64: 1.0.0
       url-join: 4.0.1
     transitivePeerDependencies:
@@ -11060,7 +10591,7 @@ snapshots:
 
   make-dir@4.0.0:
     dependencies:
-      semver: 7.8.0
+      semver: 7.8.2
 
   mantine-datatable@8.3.13(@mantine/core@8.3.18(@mantine/hooks@8.3.18(react@19.2.4))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(@mantine/hooks@8.3.18(react@19.2.4))(clsx@2.1.1)(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
     dependencies:
@@ -11143,7 +10674,7 @@ snapshots:
 
   module-details-from-path@1.0.4: {}
 
-  monocart-coverage-reports@2.12.11:
+  monocart-coverage-reports@2.12.12:
     dependencies:
       acorn: 8.16.0
       acorn-loose: 8.5.2
@@ -11164,12 +10695,12 @@ snapshots:
     dependencies:
       console-grid: 2.2.4
       eight-colors: 1.3.3
-      koa: 3.2.0
+      koa: 3.2.1
       koa-static-resolver: 1.0.6
       lz-utils: 2.1.1
-      monocart-coverage-reports: 2.12.11
+      monocart-coverage-reports: 2.12.12
       monocart-locator: 1.0.3
-      nodemailer: 8.0.7
+      nodemailer: 8.0.10
 
   ms@2.1.3: {}
 
@@ -11185,40 +10716,40 @@ snapshots:
 
   neo-async@2.6.2: {}
 
-  next-router-mock@1.0.5(next@16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4):
+  next-router-mock@1.0.5(next@16.2.7(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4):
     dependencies:
-      next: 16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      next: 16.2.7(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       react: 19.2.4
 
-  next-swagger-doc@0.4.1(next@16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(openapi-types@12.1.3):
+  next-swagger-doc@0.4.1(next@16.2.7(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(openapi-types@12.1.3):
     dependencies:
       '@types/swagger-jsdoc': 6.0.4
       cleye: 1.3.2
       isarray: 2.0.5
-      next: 16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      next: 16.2.7(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       swagger-jsdoc: 6.2.8(openapi-types@12.1.3)
     transitivePeerDependencies:
       - openapi-types
 
-  next@16.2.6(@babel/core@7.29.0)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
+  next@16.2.7(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@playwright/test@1.60.0)(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
     dependencies:
-      '@next/env': 16.2.6
+      '@next/env': 16.2.7
       '@swc/helpers': 0.5.15
-      baseline-browser-mapping: 2.10.31
-      caniuse-lite: 1.0.30001793
+      baseline-browser-mapping: 2.10.34
+      caniuse-lite: 1.0.30001797
       postcss: 8.5.15
       react: 19.2.4
       react-dom: 19.2.4(react@19.2.4)
-      styled-jsx: 5.1.6(@babel/core@7.29.0)(react@19.2.4)
+      styled-jsx: 5.1.6(@babel/core@7.29.7)(react@19.2.4)
     optionalDependencies:
-      '@next/swc-darwin-arm64': 16.2.6
-      '@next/swc-darwin-x64': 16.2.6
-      '@next/swc-linux-arm64-gnu': 16.2.6
-      '@next/swc-linux-arm64-musl': 16.2.6
-      '@next/swc-linux-x64-gnu': 16.2.6
-      '@next/swc-linux-x64-musl': 16.2.6
-      '@next/swc-win32-arm64-msvc': 16.2.6
-      '@next/swc-win32-x64-msvc': 16.2.6
+      '@next/swc-darwin-arm64': 16.2.7
+      '@next/swc-darwin-x64': 16.2.7
+      '@next/swc-linux-arm64-gnu': 16.2.7
+      '@next/swc-linux-arm64-musl': 16.2.7
+      '@next/swc-linux-x64-gnu': 16.2.7
+      '@next/swc-linux-x64-musl': 16.2.7
+      '@next/swc-win32-arm64-msvc': 16.2.7
+      '@next/swc-win32-x64-msvc': 16.2.7
       '@opentelemetry/api': 1.9.1
       '@playwright/test': 1.60.0
       sharp: 0.34.5
@@ -11233,10 +10764,6 @@ snapshots:
       just-extend: 6.2.0
       path-to-regexp: 8.4.2
 
-  node-eval@2.0.0:
-    dependencies:
-      path-is-absolute: 1.0.1
-
   node-exports-info@1.6.0:
     dependencies:
       array.prototype.flatmap: 1.3.3
@@ -11250,22 +10777,22 @@ snapshots:
     dependencies:
       whatwg-url: 5.0.0
 
-  node-releases@2.0.44: {}
+  node-releases@2.0.47: {}
 
-  nodemailer@8.0.7: {}
+  nodemailer@8.0.10: {}
 
   normalize-package-data@3.0.3:
     dependencies:
       hosted-git-info: 4.1.0
       is-core-module: 2.16.2
-      semver: 7.8.0
+      semver: 7.8.2
       validate-npm-package-license: 3.0.4
 
   nypm@0.6.6:
     dependencies:
       citty: 0.2.2
       pathe: 2.0.3
-      tinyexec: 1.1.2
+      tinyexec: 1.2.4
 
   object-assign@4.1.1: {}
 
@@ -11280,7 +10807,7 @@ snapshots:
       call-bind: 1.0.9
       call-bound: 1.0.4
       define-properties: 1.2.1
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       has-symbols: 1.1.0
       object-keys: 1.1.1
 
@@ -11289,14 +10816,14 @@ snapshots:
       call-bind: 1.0.9
       call-bound: 1.0.4
       define-properties: 1.2.1
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
 
   object.fromentries@2.0.8:
     dependencies:
       call-bind: 1.0.9
       define-properties: 1.2.1
       es-abstract: 1.24.2
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
 
   object.groupby@1.0.3:
     dependencies:
@@ -11309,9 +10836,9 @@ snapshots:
       call-bind: 1.0.9
       call-bound: 1.0.4
       define-properties: 1.2.1
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
 
-  obug@2.1.1: {}
+  obug@2.1.2: {}
 
   ofetch@1.5.1:
     dependencies:
@@ -11374,7 +10901,7 @@ snapshots:
 
   parse-json@5.2.0:
     dependencies:
-      '@babel/code-frame': 7.29.0
+      '@babel/code-frame': 7.29.7
       error-ex: 1.3.4
       json-parse-even-better-errors: 2.3.1
       lines-and-columns: 1.2.4
@@ -11395,7 +10922,7 @@ snapshots:
 
   path-scurry@2.0.2:
     dependencies:
-      lru-cache: 11.4.0
+      lru-cache: 11.5.1
       minipass: 7.1.3
 
   path-to-regexp@8.4.2: {}
@@ -11600,7 +11127,7 @@ snapshots:
       prop-types: 15.8.1
       react: 19.2.4
 
-  react-error-boundary@6.1.1(react@19.2.4):
+  react-error-boundary@6.1.2(react@19.2.4):
     dependencies:
       react: 19.2.4
 
@@ -11617,12 +11144,12 @@ snapshots:
       react: 19.2.4
       react-dom: 19.2.4(react@19.2.4)
 
-  react-phone-number-input@3.4.16(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
+  react-phone-number-input@3.4.17(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
     dependencies:
       classnames: 2.5.1
       country-flag-icons: 1.6.17
       input-format: 0.3.14(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
-      libphonenumber-js: 1.13.2
+      libphonenumber-js: 1.13.6
       prop-types: 15.8.1
       react: 19.2.4
       react-dom: 19.2.4(react@19.2.4)
@@ -11658,7 +11185,7 @@ snapshots:
 
   react-textarea-autosize@8.5.9(@types/react@19.2.14)(react@19.2.4):
     dependencies:
-      '@babel/runtime': 7.29.2
+      '@babel/runtime': 7.29.7
       react: 19.2.4
       use-composed-ref: 1.4.0(@types/react@19.2.14)(react@19.2.4)
       use-latest: 1.3.0(@types/react@19.2.14)(react@19.2.4)
@@ -11667,7 +11194,7 @@ snapshots:
 
   react-transition-group@4.4.5(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
     dependencies:
-      '@babel/runtime': 7.29.2
+      '@babel/runtime': 7.29.7
       dom-helpers: 5.2.1
       loose-envify: 1.4.0
       prop-types: 15.8.1
@@ -11715,7 +11242,7 @@ snapshots:
       define-properties: 1.2.1
       es-abstract: 1.24.2
       es-errors: 1.3.0
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       get-intrinsic: 1.3.0
       get-proto: 1.0.1
       which-builtin-type: 1.2.1
@@ -11729,7 +11256,7 @@ snapshots:
       gopd: 1.2.0
       set-function-name: 2.0.2
 
-  remeda@2.34.1: {}
+  remeda@2.37.0: {}
 
   require-directory@2.1.1: {}
 
@@ -11764,56 +11291,56 @@ snapshots:
 
   rfdc@1.4.1: {}
 
-  rolldown@1.0.1:
+  rolldown@1.0.3:
     dependencies:
-      '@oxc-project/types': 0.130.0
+      '@oxc-project/types': 0.133.0
       '@rolldown/pluginutils': 1.0.1
     optionalDependencies:
-      '@rolldown/binding-android-arm64': 1.0.1
-      '@rolldown/binding-darwin-arm64': 1.0.1
-      '@rolldown/binding-darwin-x64': 1.0.1
-      '@rolldown/binding-freebsd-x64': 1.0.1
-      '@rolldown/binding-linux-arm-gnueabihf': 1.0.1
-      '@rolldown/binding-linux-arm64-gnu': 1.0.1
-      '@rolldown/binding-linux-arm64-musl': 1.0.1
-      '@rolldown/binding-linux-ppc64-gnu': 1.0.1
-      '@rolldown/binding-linux-s390x-gnu': 1.0.1
-      '@rolldown/binding-linux-x64-gnu': 1.0.1
-      '@rolldown/binding-linux-x64-musl': 1.0.1
-      '@rolldown/binding-openharmony-arm64': 1.0.1
-      '@rolldown/binding-wasm32-wasi': 1.0.1
-      '@rolldown/binding-win32-arm64-msvc': 1.0.1
-      '@rolldown/binding-win32-x64-msvc': 1.0.1
-
-  rollup@4.60.4:
-    dependencies:
-      '@types/estree': 1.0.8
+      '@rolldown/binding-android-arm64': 1.0.3
+      '@rolldown/binding-darwin-arm64': 1.0.3
+      '@rolldown/binding-darwin-x64': 1.0.3
+      '@rolldown/binding-freebsd-x64': 1.0.3
+      '@rolldown/binding-linux-arm-gnueabihf': 1.0.3
+      '@rolldown/binding-linux-arm64-gnu': 1.0.3
+      '@rolldown/binding-linux-arm64-musl': 1.0.3
+      '@rolldown/binding-linux-ppc64-gnu': 1.0.3
+      '@rolldown/binding-linux-s390x-gnu': 1.0.3
+      '@rolldown/binding-linux-x64-gnu': 1.0.3
+      '@rolldown/binding-linux-x64-musl': 1.0.3
+      '@rolldown/binding-openharmony-arm64': 1.0.3
+      '@rolldown/binding-wasm32-wasi': 1.0.3
+      '@rolldown/binding-win32-arm64-msvc': 1.0.3
+      '@rolldown/binding-win32-x64-msvc': 1.0.3
+
+  rollup@4.61.1:
+    dependencies:
+      '@types/estree': 1.0.9
     optionalDependencies:
-      '@rollup/rollup-android-arm-eabi': 4.60.4
-      '@rollup/rollup-android-arm64': 4.60.4
-      '@rollup/rollup-darwin-arm64': 4.60.4
-      '@rollup/rollup-darwin-x64': 4.60.4
-      '@rollup/rollup-freebsd-arm64': 4.60.4
-      '@rollup/rollup-freebsd-x64': 4.60.4
-      '@rollup/rollup-linux-arm-gnueabihf': 4.60.4
-      '@rollup/rollup-linux-arm-musleabihf': 4.60.4
-      '@rollup/rollup-linux-arm64-gnu': 4.60.4
-      '@rollup/rollup-linux-arm64-musl': 4.60.4
-      '@rollup/rollup-linux-loong64-gnu': 4.60.4
-      '@rollup/rollup-linux-loong64-musl': 4.60.4
-      '@rollup/rollup-linux-ppc64-gnu': 4.60.4
-      '@rollup/rollup-linux-ppc64-musl': 4.60.4
-      '@rollup/rollup-linux-riscv64-gnu': 4.60.4
-      '@rollup/rollup-linux-riscv64-musl': 4.60.4
-      '@rollup/rollup-linux-s390x-gnu': 4.60.4
-      '@rollup/rollup-linux-x64-gnu': 4.60.4
-      '@rollup/rollup-linux-x64-musl': 4.60.4
-      '@rollup/rollup-openbsd-x64': 4.60.4
-      '@rollup/rollup-openharmony-arm64': 4.60.4
-      '@rollup/rollup-win32-arm64-msvc': 4.60.4
-      '@rollup/rollup-win32-ia32-msvc': 4.60.4
-      '@rollup/rollup-win32-x64-gnu': 4.60.4
-      '@rollup/rollup-win32-x64-msvc': 4.60.4
+      '@rollup/rollup-android-arm-eabi': 4.61.1
+      '@rollup/rollup-android-arm64': 4.61.1
+      '@rollup/rollup-darwin-arm64': 4.61.1
+      '@rollup/rollup-darwin-x64': 4.61.1
+      '@rollup/rollup-freebsd-arm64': 4.61.1
+      '@rollup/rollup-freebsd-x64': 4.61.1
+      '@rollup/rollup-linux-arm-gnueabihf': 4.61.1
+      '@rollup/rollup-linux-arm-musleabihf': 4.61.1
+      '@rollup/rollup-linux-arm64-gnu': 4.61.1
+      '@rollup/rollup-linux-arm64-musl': 4.61.1
+      '@rollup/rollup-linux-loong64-gnu': 4.61.1
+      '@rollup/rollup-linux-loong64-musl': 4.61.1
+      '@rollup/rollup-linux-ppc64-gnu': 4.61.1
+      '@rollup/rollup-linux-ppc64-musl': 4.61.1
+      '@rollup/rollup-linux-riscv64-gnu': 4.61.1
+      '@rollup/rollup-linux-riscv64-musl': 4.61.1
+      '@rollup/rollup-linux-s390x-gnu': 4.61.1
+      '@rollup/rollup-linux-x64-gnu': 4.61.1
+      '@rollup/rollup-linux-x64-musl': 4.61.1
+      '@rollup/rollup-openbsd-x64': 4.61.1
+      '@rollup/rollup-openharmony-arm64': 4.61.1
+      '@rollup/rollup-win32-arm64-msvc': 4.61.1
+      '@rollup/rollup-win32-ia32-msvc': 4.61.1
+      '@rollup/rollup-win32-x64-gnu': 4.61.1
+      '@rollup/rollup-win32-x64-msvc': 4.61.1
       fsevents: 2.3.3
 
   router@2.2.0:
@@ -11868,7 +11395,7 @@ snapshots:
 
   semver@6.3.1: {}
 
-  semver@7.8.0: {}
+  semver@7.8.2: {}
 
   send@1.2.1:
     dependencies:
@@ -11917,7 +11444,7 @@ snapshots:
     dependencies:
       dunder-proto: 1.0.1
       es-errors: 1.3.0
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
 
   setprototypeof@1.2.0: {}
 
@@ -11925,7 +11452,7 @@ snapshots:
     dependencies:
       '@img/colour': 1.1.0
       detect-libc: 2.1.2
-      semver: 7.8.0
+      semver: 7.8.2
     optionalDependencies:
       '@img/sharp-darwin-arm64': 0.34.5
       '@img/sharp-darwin-x64': 0.34.5
@@ -11961,7 +11488,7 @@ snapshots:
 
   shell-quote@1.8.3: {}
 
-  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/2e35d3bb56f02bfc0e6d5cd9d83c54637ed0ac20:
+  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/2c495dae94942895a34e64d91f83809750867f4e:
     dependencies:
       '@zip.js/zip.js': 2.8.26
       debug: 4.4.3
@@ -12111,7 +11638,7 @@ snapshots:
       define-properties: 1.2.1
       es-abstract: 1.24.2
       es-errors: 1.3.0
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       get-intrinsic: 1.3.0
       gopd: 1.2.0
       has-symbols: 1.1.0
@@ -12125,28 +11652,29 @@ snapshots:
       define-properties: 1.2.1
       es-abstract: 1.24.2
 
-  string.prototype.trim@1.2.10:
+  string.prototype.trim@1.2.11:
     dependencies:
       call-bind: 1.0.9
       call-bound: 1.0.4
       define-data-property: 1.1.4
       define-properties: 1.2.1
       es-abstract: 1.24.2
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
       has-property-descriptors: 1.0.2
+      safe-regex-test: 1.1.0
 
-  string.prototype.trimend@1.0.9:
+  string.prototype.trimend@1.0.10:
     dependencies:
       call-bind: 1.0.9
       call-bound: 1.0.4
       define-properties: 1.2.1
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
 
   string.prototype.trimstart@1.0.8:
     dependencies:
       call-bind: 1.0.9
       define-properties: 1.2.1
-      es-object-atoms: 1.1.1
+      es-object-atoms: 1.1.2
 
   string_decoder@1.3.0:
     dependencies:
@@ -12172,12 +11700,12 @@ snapshots:
 
   strnum@2.3.0: {}
 
-  styled-jsx@5.1.6(@babel/core@7.29.0)(react@19.2.4):
+  styled-jsx@5.1.6(@babel/core@7.29.7)(react@19.2.4):
     dependencies:
       client-only: 0.0.1
       react: 19.2.4
     optionalDependencies:
-      '@babel/core': 7.29.0
+      '@babel/core': 7.29.7
 
   supports-color@7.2.0:
     dependencies:
@@ -12226,13 +11754,13 @@ snapshots:
 
   terminal-columns@1.4.1: {}
 
-  terser-webpack-plugin@5.6.0(esbuild@0.27.7)(postcss@8.5.15)(webpack@5.106.2(esbuild@0.27.7)(postcss@8.5.15)):
+  terser-webpack-plugin@5.6.1(esbuild@0.27.7)(postcss@8.5.15)(webpack@5.107.2(esbuild@0.27.7)(postcss@8.5.15)):
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
       jest-worker: 27.5.1
       schema-utils: 4.3.3
       terser: 5.48.0
-      webpack: 5.106.2(esbuild@0.27.7)(postcss@8.5.15)
+      webpack: 5.107.2(esbuild@0.27.7)(postcss@8.5.15)
     optionalDependencies:
       esbuild: 0.27.7
       postcss: 8.5.15
@@ -12252,9 +11780,9 @@ snapshots:
 
   tinybench@2.9.0: {}
 
-  tinyexec@1.1.2: {}
+  tinyexec@1.2.4: {}
 
-  tinyglobby@0.2.16:
+  tinyglobby@0.2.17:
     dependencies:
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
@@ -12361,7 +11889,7 @@ snapshots:
       is-typed-array: 1.1.15
       reflect.getprototypeof: 1.0.10
 
-  typed-array-length@1.0.7:
+  typed-array-length@1.0.8:
     dependencies:
       call-bind: 1.0.9
       for-each: 0.3.5
@@ -12370,12 +11898,12 @@ snapshots:
       possible-typed-array-names: 1.1.0
       reflect.getprototypeof: 1.0.10
 
-  typescript-eslint@8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3):
+  typescript-eslint@8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3):
     dependencies:
-      '@typescript-eslint/eslint-plugin': 8.59.4(@typescript-eslint/parser@8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/parser': 8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/typescript-estree': 8.59.4(typescript@5.9.3)
-      '@typescript-eslint/utils': 8.59.4(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/eslint-plugin': 8.60.1(@typescript-eslint/parser@8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3))(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/parser': 8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/typescript-estree': 8.60.1(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.60.1(eslint@9.39.4(jiti@2.7.0))(typescript@5.9.3)
       eslint: 9.39.4(jiti@2.7.0)
       typescript: 5.9.3
     transitivePeerDependencies:
@@ -12498,15 +12026,15 @@ snapshots:
 
   vary@1.1.2: {}
 
-  vite@8.0.13(@types/node@25.9.1)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0):
+  vite@8.0.16(@types/node@25.9.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0):
     dependencies:
       lightningcss: 1.32.0
       picomatch: 4.0.4
       postcss: 8.5.15
-      rolldown: 1.0.1
-      tinyglobby: 0.2.16
+      rolldown: 1.0.3
+      tinyglobby: 0.2.17
     optionalDependencies:
-      '@types/node': 25.9.1
+      '@types/node': 25.9.2
       esbuild: 0.27.7
       fsevents: 2.3.3
       jiti: 2.7.0
@@ -12514,46 +12042,46 @@ snapshots:
       tsx: 4.21.0
       yaml: 2.9.0
 
-  vitest-monocart-coverage@4.0.2(vitest@4.1.6):
+  vitest-monocart-coverage@4.0.2(vitest@4.1.8):
     dependencies:
-      '@vitest/coverage-istanbul': 4.1.6(vitest@4.1.6)
-      '@vitest/coverage-v8': 4.1.6(vitest@4.1.6)
+      '@vitest/coverage-istanbul': 4.1.8(vitest@4.1.8)
+      '@vitest/coverage-v8': 4.1.8(vitest@4.1.8)
       istanbul-lib-instrument: 6.0.3
-      monocart-coverage-reports: 2.12.11
+      monocart-coverage-reports: 2.12.12
       test-exclude: 8.0.0
     transitivePeerDependencies:
       - '@vitest/browser'
       - supports-color
       - vitest
 
-  vitest@4.1.6(@opentelemetry/api@1.9.1)(@types/node@25.9.1)(@vitest/coverage-istanbul@4.1.6)(@vitest/coverage-v8@4.1.6)(happy-dom@20.9.0)(vite@8.0.13(@types/node@25.9.1)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0)):
+  vitest@4.1.8(@opentelemetry/api@1.9.1)(@types/node@25.9.2)(@vitest/coverage-istanbul@4.1.8)(@vitest/coverage-v8@4.1.8)(happy-dom@20.10.1)(vite@8.0.16(@types/node@25.9.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0)):
     dependencies:
-      '@vitest/expect': 4.1.6
-      '@vitest/mocker': 4.1.6(vite@8.0.13(@types/node@25.9.1)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0))
-      '@vitest/pretty-format': 4.1.6
-      '@vitest/runner': 4.1.6
-      '@vitest/snapshot': 4.1.6
-      '@vitest/spy': 4.1.6
-      '@vitest/utils': 4.1.6
+      '@vitest/expect': 4.1.8
+      '@vitest/mocker': 4.1.8(vite@8.0.16(@types/node@25.9.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0))
+      '@vitest/pretty-format': 4.1.8
+      '@vitest/runner': 4.1.8
+      '@vitest/snapshot': 4.1.8
+      '@vitest/spy': 4.1.8
+      '@vitest/utils': 4.1.8
       es-module-lexer: 2.1.0
       expect-type: 1.3.0
       magic-string: 0.30.21
-      obug: 2.1.1
+      obug: 2.1.2
       pathe: 2.0.3
       picomatch: 4.0.4
       std-env: 4.1.0
       tinybench: 2.9.0
-      tinyexec: 1.1.2
-      tinyglobby: 0.2.16
+      tinyexec: 1.2.4
+      tinyglobby: 0.2.17
       tinyrainbow: 3.1.0
-      vite: 8.0.13(@types/node@25.9.1)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0)
+      vite: 8.0.16(@types/node@25.9.2)(esbuild@0.27.7)(jiti@2.7.0)(terser@5.48.0)(tsx@4.21.0)(yaml@2.9.0)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@opentelemetry/api': 1.9.1
-      '@types/node': 25.9.1
-      '@vitest/coverage-istanbul': 4.1.6(vitest@4.1.6)
-      '@vitest/coverage-v8': 4.1.6(vitest@4.1.6)
-      happy-dom: 20.9.0
+      '@types/node': 25.9.2
+      '@vitest/coverage-istanbul': 4.1.8(vitest@4.1.8)
+      '@vitest/coverage-v8': 4.1.8(vitest@4.1.8)
+      happy-dom: 20.10.1
     transitivePeerDependencies:
       - msw
 
@@ -12566,9 +12094,8 @@ snapshots:
 
   webpack-sources@3.5.0: {}
 
-  webpack@5.106.2(esbuild@0.27.7)(postcss@8.5.15):
+  webpack@5.107.2(esbuild@0.27.7)(postcss@8.5.15):
     dependencies:
-      '@types/eslint-scope': 3.7.7
       '@types/estree': 1.0.9
       '@types/json-schema': 7.0.15
       '@webassemblyjs/ast': 1.14.1
@@ -12578,7 +12105,7 @@ snapshots:
       acorn-import-phases: 1.0.4(acorn@8.16.0)
       browserslist: 4.28.2
       chrome-trace-event: 1.0.4
-      enhanced-resolve: 5.22.0
+      enhanced-resolve: 5.23.0
       es-module-lexer: 2.1.0
       eslint-scope: 5.1.1
       events: 3.3.0
@@ -12589,7 +12116,7 @@ snapshots:
       neo-async: 2.6.2
       schema-utils: 4.3.3
       tapable: 2.3.3
-      terser-webpack-plugin: 5.6.0(esbuild@0.27.7)(postcss@8.5.15)(webpack@5.106.2(esbuild@0.27.7)(postcss@8.5.15))
+      terser-webpack-plugin: 5.6.1(esbuild@0.27.7)(postcss@8.5.15)(webpack@5.107.2(esbuild@0.27.7)(postcss@8.5.15))
       watchpack: 2.5.1
       webpack-sources: 3.5.0
     transitivePeerDependencies:
@@ -12635,7 +12162,7 @@ snapshots:
       isarray: 2.0.5
       which-boxed-primitive: 1.1.1
       which-collection: 1.0.2
-      which-typed-array: 1.1.20
+      which-typed-array: 1.1.22
 
   which-collection@1.0.2:
     dependencies:
@@ -12644,7 +12171,7 @@ snapshots:
       is-weakmap: 2.0.2
       is-weakset: 2.0.4
 
-  which-typed-array@1.1.20:
+  which-typed-array@1.1.22:
     dependencies:
       available-typed-arrays: 1.0.7
       call-bind: 1.0.9
@@ -12681,16 +12208,16 @@ snapshots:
 
   wrappy@1.0.2: {}
 
-  ws@8.20.1: {}
+  ws@8.21.0: {}
 
   xml-naming@0.1.0: {}
 
   xtend@4.0.2: {}
 
-  y-protocols@1.0.7(yjs@13.6.30):
+  y-protocols@1.0.7(yjs@13.6.31):
     dependencies:
       lib0: 0.2.117
-      yjs: 13.6.30
+      yjs: 13.6.31
 
   y18n@5.0.8: {}
 
@@ -12716,7 +12243,7 @@ snapshots:
       y18n: 5.0.8
       yargs-parser: 21.1.1
 
-  yjs@13.6.30:
+  yjs@13.6.31:
     dependencies:
       lib0: 0.2.117
 
@@ -12742,7 +12269,7 @@ snapshots:
 
   zod@4.4.3: {}
 
-  zustand@5.0.13(@types/react@19.2.14)(react@19.2.4)(use-sync-external-store@1.6.0(react@19.2.4)):
+  zustand@5.0.14(@types/react@19.2.14)(react@19.2.4)(use-sync-external-store@1.6.0(react@19.2.4)):
     optionalDependencies:
       '@types/react': 19.2.14
       react: 19.2.4
diff --git a/results-encryption-design-notes.md b/results-encryption-design-notes.md
index 1df81d231..a149d5ff1 100644
--- a/results-encryption-design-notes.md
+++ b/results-encryption-design-notes.md
@@ -4,14 +4,20 @@
 > Status: **draft for review.** Locked decisions marked ✅; open items in §8.
 > **Scope: Card 72 (prerequisite) → Card 71 only.** Happy path only. Cards 73/74 (regeneration, recovery) explicitly out of scope.
 > **All phases land on one branch/PR (`researcher-encrypted-results`).** Not split per-card.
-> **Progress: Card 72 code complete on branch (not yet merged to main). Card 71 in progress (re-encrypt approach).**
-> **Testing: local e2e unreliable — rely on CI for e2e coverage. Unit tests still run/pass locally.**
+> **Progress: Card 72 code complete on branch (not yet merged to main). Card 71 NOT YET built in current tree — see DECISION LOG.**
+> **Testing: local e2e unreliable — rely on CI. Unit tests are DB-backed: run inside the `mgmnt-app` docker container, one file at a time (see §12).**
 >
-> ## ⚠️ APPROACH PIVOT (supersedes §3–§5, §10 below)
+> ## ✅ FINAL DIRECTION: RE-WRAP (§4 is the plan). §11 re-encrypt = ABANDONED.
 >
-> The detailed "Proposed implementation" (decompose the post office into Postgres + **re-wrap** PO boxes for researchers — §4.2, §4.3, Option B) was **built and then reverted**. We pivoted to **re-encrypt at approve** (Phil + NS in the living doc). See **§11** for the chosen design. Sections §3–§5/§10 are kept for rationale/history but are NOT the implementation.
+> **Decision log (this session, newest last):**
+> 1. Original detailed plan (§4) = **re-wrap + decompose-on-ingest** (PO boxes in Postgres).
+> 2. Built re-wrap fully → unit tests green → **then reverted** (worried about lib change + scope).
+> 3. Pivoted to **re-encrypt at approve** (§11), built it, tests green, **not committed**.
+> 4. **Pivoted BACK to re-wrap (FINAL).** Reasons: (a) Phil (EM) verbally wants re-wrap; (b) re-wrap is the more correct long-term architecture — immutable ciphertext, add-a-box to share, **delete-a-box to revoke**; (c) it sets up Cards 73/74 (regen/recovery) cleanly; (d) the doc's "re-encrypt" wording was loose — the *detailed* plan was always re-wrap.
 >
-> **Why pivot:** re-wrap forced encryption-library changes + new schema (`study_job_file_key`, decompose-on-ingest) + a full read-path rewrite. Re-encrypt needs **zero lib changes, no schema** — the DO browser already holds plaintext at review time, so at approve it re-encrypts the approved files for reviewers+researchers using the existing `ResultsWriter`. It also matches the living doc's own Card 74 recovery mechanic ("remove old lock, put new lock" = re-encrypt), so it's the better foundation for the documented future work. The one thing re-wrap/boxes does better — granular **revocation** ("user leaves the lab") — is noted in code at the approve site as a future consideration.
+> **⚠️ MUST CONFIRM WITH PHIL BEFORE/AT START:** re-wrap **requires a small `si-encryption` library change** (expose the raw AES key + a zip-free decrypt primitive). This directly conflicts with Phil's "no lib change needed" comment — those two cannot both hold. The change is **small + additive** (~2 new functions, already prototyped this session). Get his explicit OK on the lib change, since it's the thing he thought we'd avoid.
+>
+> **Good news for the implementer:** the entire re-wrap build was already done + verified green earlier this session, then reverted. It is NOT in git, but the recipe is fully captured in §5 "Card 71 — re-wrap steps" (steps 0–5, each was ✅ before revert). This is a **proven recipe to re-apply**, not a green-field design.
 
 ---
 
@@ -145,7 +151,10 @@ Drop `storeApprovedJobFile` plaintext write. Researchers read encrypted body + t
 - e2e seed `src/database/seeds/1743608138837_test_users.ts` — seed placeholder `userPublicKey` for all test users. `RequireReviewerKey` now gates lab researchers too; key-less seeded users were redirected off dashboard, detaching `new-study` button mid-click → all study-flow specs timed out.
 - Unrelated pre-existing lint warning fixed to unblock CI: `studyId` added to `useEffect` dep array in `src/hooks/use-workspace-launcher.tsx:122`.
 
-### Card 71 — Option B steps
+### Card 71 — re-wrap steps (PROVEN RECIPE — built + green this session, then reverted; RE-APPLY)
+
+> Every step below was implemented and unit-tested green this session, then reverted on the (now-undone) pivot to re-encrypt. **None of it is in git** — both MA and the `../encryption` repo are back at baseline. Re-apply in order. The ✅ marks mean "proven works," not "currently in the tree."
+> The `si-encryption` change (step 0b) is the one that **needs Phil's OK** (see top).
 
 0. ✅ **Migration** (MA): extend `study_job_file` (`iv` text, `bytes` integer — both nullable; NO blob_location, redundant with `path`) + new `study_job_file_key(study_job_file_id, fingerprint, crypt, created_at)` UNIQUE(study_job_file_id, fingerprint). `1780000000000_study_job_file_keys.ts`. Types hand-stubbed in `src/database/types.ts` (CI regenerates — local DB/docker down).
    0b. ✅ **si-encryption primitives** (encryption repo): added zip-free `job-results/crypto.ts` (`unwrapAesKey` exposes raw AES bytes, `wrapAesKey` re-wrap, `decryptFileBody`, `decryptFile`) + `job-results/decompose.ts` (`decomposeResultsZip`). Reader/writer refactored to call primitives (no behavior change). 9/9 tests incl. re-wrap round-trip. **Needs push + MA `package.json` hash bump to consume.** (currently local `link:../encryption` override in `pnpm-workspace.yaml`.)
@@ -237,7 +246,9 @@ If product chooses **all-or-nothing** approve/reject, existing job-level status
 
 ---
 
-## 11. CHOSEN DESIGN — re-encrypt at approve (Card 71)
+## 11. ⛔ ABANDONED ALTERNATIVE — re-encrypt at approve
+
+> **NOT the chosen approach.** Kept only to record what was tried + why we rejected it. We went **re-wrap (§4/§5)**. This re-encrypt version was built this session (tests green, uncommitted) and is being discarded — see DECISION LOG at top. Rejected because: weak/no revocation, new ciphertext each approve, and it diverges from the team's documented re-wrap architecture + Phil's stated preference. Its only advantage (no lib change) wasn't worth losing the long-term-correct foundation for Cards 73/74.
 
 **Zero encryption-lib changes. No schema changes.** Reuses existing `ResultsWriter`/`ResultsReader`.
 
@@ -266,3 +277,27 @@ If product chooses **all-or-nothing** approve/reject, existing job-level status
 - **Round-trip test added:** `src/server/actions/results-reencryption.test.ts` — real crypto, no mocks. Enclave reviewer (test PEM key) + lab researcher (distinct generated key) on a cross-org study; calls the real `reEncryptApprovedFiles` and asserts both the researcher's own key AND the reviewer's key decrypt the re-encrypted output back to plaintext. (Gotcha: pass `researcherId` to `insertTestStudyJobData` so it doesn't seed a fake-key enclave user that breaks `ResultsWriter`.)
 
 Cross-repo: nothing — encryption lib untouched.
+
+---
+
+## 12. Running the unit tests (non-obvious)
+
+Unit tests are **DB-backed** and the Postgres container's port is **not published to the host** → `pnpm exec vitest` on the host fails with `missing ARN DB_SECRET_ARN`. Run **inside the `mgmnt-app` docker container** (repo bind-mounted at `/app`, `DATABASE_URL` set):
+
+```
+docker exec mgmnt-app pnpm exec vitest run <test-file>
+```
+
+- Run **one file at a time**. Batching suites or `CI=1` (turns on coverage) **OOM-kills the container** (exit 137).
+- Heavy React suites (e.g. study-results) may need `NODE_OPTIONS=--max-old-space-size=4096`, but for most files the default is fine and 4096 can itself trip the kill — try default first.
+- A `137` is often just the harness's 120s timeout on vitest cold start, not real OOM (container had ~6GB free). Give it a longer timeout / re-run.
+- User keeps the docker stack up (`mgmnt-app`, `management-app-postgres-1`, `editor-service`, seaweedfs, dbgate).
+
+## 13. Current git state + recommended clean start for re-wrap
+
+**As of handoff:** branch `researcher-encrypted-results`. A **merge of `main` is IN PROGRESS** (`.git/MERGE_HEAD` present); the one conflict — `src/hooks/use-workspace-launcher.tsx` — was **resolved (took main's refactor) and staged**. The **re-encrypt implementation is in the working tree, uncommitted** (it was never committed — that commit was interrupted). The earlier re-wrap build is **not** present (reverted).
+
+**Recommended clean start (re-wrap):**
+1. This doc's edits are uncommitted — the durable copy of the plan is the handoff in `/tmp` (and the design doc on disk). Don't lose them to a reset.
+2. Discard the abandoned re-encrypt working tree + finish the main merge cleanly. Either complete the in-progress merge then `git reset --hard` away the re-encrypt files, or `git merge --abort` and re-`git merge main` (resolve `use-workspace-launcher.tsx` = **take main's version**, drop the HEAD block).
+3. Build re-wrap fresh per §5 steps 0→5. Step 0b (the `si-encryption` lib change) needs **Phil's OK** first.
diff --git a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx
index 06b721f7d..54f479dfc 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx
@@ -1,5 +1,5 @@
 import { describe, expect, it, Mock, vi } from 'vitest'
-import { insertTestStudyJobData, mockSessionWithTestData, renderWithProviders } from '@/tests/unit.helpers'
+import { db, insertTestStudyJobData, mockSessionWithTestData, renderWithProviders } from '@/tests/unit.helpers'
 import { JobReviewButtons } from './job-review-buttons'
 import { act, fireEvent, screen, waitFor } from '@testing-library/react'
 import { latestJobForStudy } from '@/server/db/queries'
@@ -10,7 +10,7 @@ vi.spyOn(actions, 'approveStudyJobFilesAction')
 vi.spyOn(actions, 'rejectStudyJobFilesAction')
 
 vi.mock('@/server/storage', () => ({
-    storeApprovedJobFile: vi.fn(),
+    fetchFileContents: vi.fn(),
 }))
 
 describe('Study Results Approve/Reject buttons', async () => {
@@ -73,7 +73,59 @@ describe('Study Results Approve/Reject buttons', async () => {
     })
 
     it('can approve results', async () => {
-        await clickNTest('Approve', actions.approveStudyJobFilesAction as Mock, 'FILES-APPROVED')
+        // Approve re-wraps each file's AES key for the lab researchers. Use real keys (so
+        // wrapAesKey accepts the SPKI) and reuse the keyed session user as researcher so no
+        // fake-key user pollutes the recipient set. The selected file must be a real row.
+        const { org, user } = await mockSessionWithTestData({ orgType: 'enclave', useRealKeys: true })
+        const { latestJobWithStatus: job } = await insertTestStudyJobData({
+            org,
+            studyStatus: 'PENDING-REVIEW',
+            researcherId: user.id,
+        })
+
+        const row = await db
+            .insertInto('studyJobFile')
+            .values({
+                studyJobId: job.id,
+                name: 'test.csv',
+                path: `results/encrypted/test.csv`,
+                fileType: 'ENCRYPTED-RESULT',
+                iv: 'aXY=',
+            })
+            .returning('id')
+            .executeTakeFirstOrThrow()
+
+        const decryptedResults = [
+            {
+                path: 'test.csv',
+                contents: new TextEncoder().encode('test123').buffer,
+                sourceId: row.id,
+                fileType: 'APPROVED-RESULT' as FileType,
+                rawAesKey: new ArrayBuffer(32),
+            },
+        ]
+
+        await act(async () => {
+            renderWithProviders(<JobReviewButtons job={job} decryptedResults={decryptedResults} />)
+        })
+
+        await act(async () => {
+            fireEvent.click(screen.getByRole('button', { name: 'Approve' }))
+        })
+
+        await waitFor(async () => {
+            expect(actions.approveStudyJobFilesAction).toHaveBeenCalled()
+            const latestJob = await latestJobForStudy(job.studyId)
+            expect(latestJob.statusChanges.find((sc) => sc.status === 'FILES-APPROVED')).not.toBeUndefined()
+        })
+
+        // The re-wrapped researcher box was persisted against the real file row.
+        const boxes = await db
+            .selectFrom('studyJobFileKey')
+            .select('fingerprint')
+            .where('studyJobFileId', '=', row.id)
+            .execute()
+        expect(boxes.length).toBeGreaterThan(0)
     })
 
     it('can reject results', async () => {
diff --git a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx
index bbdf03897..a59ee277b 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx
@@ -8,7 +8,7 @@ import { Routes } from '@/lib/routes'
 import { JobFileInfo, MinimalJobInfo } from '@/lib/types'
 import { approveStudyJobFilesAction, rejectStudyJobFilesAction } from '@/server/actions/study-job.actions'
 import type { LatestJobForStudy } from '@/server/db/queries'
-import { reEncryptApprovedFiles } from '@/lib/re-encrypt-results'
+import { buildSharedFiles } from '@/lib/re-wrap-results'
 import { Button, Group, Text, useMantineTheme } from '@mantine/core'
 import { CheckCircleIcon, XCircleIcon } from '@phosphor-icons/react/dist/ssr'
 import dayjs from 'dayjs'
@@ -43,10 +43,10 @@ export const JobReviewButtons = ({
             }
 
             if (status === 'FILES-APPROVED') {
-                // Re-encrypt approved files for reviewers + researchers client-side; only
-                // ciphertext is sent to the server.
-                const jobFiles = await reEncryptApprovedFiles(job.studyId, decryptedResults)
-                await approveStudyJobFilesAction({ orgSlug, jobInfo, jobFiles })
+                // Re-wrap each approved file's AES key for the lab researchers, client-side.
+                // Only the new wrapped keys (PO boxes) are sent — never the raw key or plaintext.
+                const sharedFiles = await buildSharedFiles(job.studyId, decryptedResults)
+                await approveStudyJobFilesAction({ orgSlug, jobInfo, sharedFiles })
             }
 
             if (status === 'FILES-REJECTED') {
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
index bbf0fc664..73bb10b44 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
@@ -12,9 +12,9 @@ import { StudyResultsRedesign } from './study-results-redesign'
 import { fetchEncryptedJobFilesAction } from '@/server/actions/study-job.actions'
 import { latestJobForStudy } from '@/server/db/queries'
 import { ResultsWriter } from 'si-encryption/job-results/writer'
+import { decomposeResultsZip } from 'si-encryption/job-results/decompose'
 import { fingerprintKeyData, pemToArrayBuffer } from 'si-encryption/util'
 import { type FileType } from '@/database/types'
-import { type JobFile } from '@/lib/types'
 
 // OTTER-538: focused tests for the redesigned StudyResults panel.
 // The redesign (1) shows the RUN-COMPLETE secondary text on RUN-COMPLETE, (2) hides
@@ -23,13 +23,16 @@ import { type JobFile } from '@/lib/types'
 // JobStatusHelpText for terminal non-COMPLETE statuses so an errored or rejected
 // job doesn't claim it was "successfully processed".
 
-const mockedApprovedJobFiles: JobFile[] = []
-
 vi.mock('@/server/actions/study-job.actions', () => ({
-    fetchApprovedJobFilesAction: vi.fn(() => mockedApprovedJobFiles),
     fetchEncryptedJobFilesAction: vi.fn(() => []),
+    fetchSharedFileIdsAction: vi.fn(() => []),
 }))
 
+const toArrayBuffer = (str: string): ArrayBuffer => {
+    const buf = Buffer.from(str, 'utf-8')
+    return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength)
+}
+
 const RUN_COMPLETE_SECONDARY_TEXT =
     'The code was successfully processed! Review results and security logs (if available) to decide if these can be released to the researcher.'
 
@@ -99,32 +102,38 @@ describe('StudyResultsRedesign', () => {
         const writer = new ResultsWriter([{ publicKey, fingerprint }])
 
         const csv = `title\nhello world`
-        const csvBlob = Buffer.from(csv, 'utf-8')
-        const arrayBuf = csvBlob.buffer.slice(csvBlob.byteOffset, csvBlob.byteOffset + csvBlob.length)
-        await writer.addFile('test.data', arrayBuf)
-        const zip = await writer.generate()
-
-        const encryptedFile = {
-            blob: new Blob([zip as BlobPart]),
-            sourceId: '123',
-            fileType: 'ENCRYPTED-RESULT' as FileType,
-            metadata: [{ path: 'test.data', bytes: 4 }],
-        }
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([encryptedFile])
+        await writer.addFile('test.data', toArrayBuffer(csv))
+        const [decomposed] = await decomposeResultsZip(await writer.generate())
 
         const { study, job: rawJob } = await insertTestStudyJobData({
             org,
             jobStatus: 'RUN-COMPLETE',
         })
-        await db
+        const path = `test-org/${study.id}/${rawJob.id}/results/encrypted/test.data`
+        const row = await db
             .insertInto('studyJobFile')
             .values({
                 studyJobId: rawJob.id,
-                name: 'results.zip',
-                path: `test-org/${study.id}/${rawJob.id}/results/results.zip`,
+                name: 'test.data',
+                path,
                 fileType: 'ENCRYPTED-RESULT',
+                iv: decomposed.iv,
+                bytes: decomposed.bytes,
             })
-            .execute()
+            .returning('id')
+            .executeTakeFirstOrThrow()
+
+        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([
+            {
+                studyJobFileId: row.id,
+                fileType: 'ENCRYPTED-RESULT' as FileType,
+                path,
+                name: 'test.data',
+                iv: decomposed.iv,
+                crypt: decomposed.keys[fingerprint].crypt,
+                encryptedBody: decomposed.body,
+            },
+        ])
 
         const job = await latestJobForStudy(study.id)
         renderWithProviders(<StudyResultsRedesign job={job!} />)
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
index 9512a62e1..97dcb2a07 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
@@ -9,28 +9,67 @@ import {
 } from '@/tests/unit.helpers'
 import { fireEvent, waitFor, screen } from '@testing-library/react'
 import { StudyResults } from './study-results'
-import { fetchApprovedJobFilesAction, fetchEncryptedJobFilesAction } from '@/server/actions/study-job.actions'
+import { fetchEncryptedJobFilesAction, fetchSharedFileIdsAction } from '@/server/actions/study-job.actions'
 import { latestJobForStudy } from '@/server/db/queries'
 import { ResultsWriter } from 'si-encryption/job-results/writer'
+import { decomposeResultsZip } from 'si-encryption/job-results/decompose'
 import { fingerprintKeyData, pemToArrayBuffer } from 'si-encryption/util'
 import { type FileType, type StudyJobStatus, type StudyStatus } from '@/database/types'
 
-// Approved files are now re-encrypted (same shape as encrypted files); content is
-// viewed by decrypting, so the mock carries metadata, not plaintext contents.
-const mockedApprovedJobFiles = [
-    {
-        blob: new Blob(),
-        sourceId: 'approved-1',
-        fileType: 'APPROVED-RESULT' as FileType,
-        metadata: [{ path: 'approved.csv', bytes: 17 }],
-    },
-]
-
 vi.mock('@/server/actions/study-job.actions', () => ({
-    fetchApprovedJobFilesAction: vi.fn(() => mockedApprovedJobFiles),
     fetchEncryptedJobFilesAction: vi.fn(() => []),
+    fetchSharedFileIdsAction: vi.fn(() => []),
 }))
 
+const toArrayBuffer = (str: string): ArrayBuffer => {
+    const buf = Buffer.from(str, 'utf-8')
+    return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength)
+}
+
+type MinimalJob = { id: string }
+
+async function seedEncryptedFile(
+    job: MinimalJob,
+    { name, fileType, content }: { name: string; fileType: FileType; content: string },
+) {
+    const publicKey = pemToArrayBuffer(await readTestSupportFile('public_key.pem'))
+    const fingerprint = await fingerprintKeyData(publicKey)
+    const writer = new ResultsWriter([{ publicKey, fingerprint }])
+    await writer.addFile(name, toArrayBuffer(content))
+    const [decomposed] = await decomposeResultsZip(await writer.generate())
+
+    const path = `test-org/${job.id}/results/encrypted/${name}`
+    const row = await db
+        .insertInto('studyJobFile')
+        .values({ studyJobId: job.id, name, path, fileType, iv: decomposed.iv, bytes: decomposed.bytes })
+        .returning('id')
+        .executeTakeFirstOrThrow()
+
+    return {
+        studyJobFileId: row.id,
+        fileType,
+        path,
+        name,
+        iv: decomposed.iv,
+        crypt: decomposed.keys[fingerprint].crypt,
+        encryptedBody: decomposed.body,
+    }
+}
+
+async function insertEncryptedRow(job: MinimalJob, { name, fileType }: { name: string; fileType: FileType }) {
+    return db
+        .insertInto('studyJobFile')
+        .values({
+            studyJobId: job.id,
+            name,
+            path: `test-org/${job.id}/results/encrypted/${name}`,
+            fileType,
+            iv: 'aXY=',
+        })
+        .returning('id')
+        .executeTakeFirstOrThrow()
+}
+
 describe('View Study Results', () => {
     let org: Org
 
@@ -58,73 +97,36 @@ describe('View Study Results', () => {
         ).toBeDefined()
     })
 
-    it('renders the results if the job has been approved', async () => {
+    it('renders the shared result file once the job has been approved', async () => {
         const { study, latestJobWithStatus: rawJob } = await insertTestStudyJobData({
             org,
             studyStatus: 'APPROVED',
             jobStatus: 'FILES-APPROVED',
         })
 
-        await db
-            .insertInto('studyJobFile')
-            .values({
-                studyJobId: rawJob.id,
-                name: 'approved.csv',
-                path: `test-org/${study.id}/${rawJob.id}/results/approved/approved.csv`,
-                fileType: 'APPROVED-RESULT',
-            })
-            .execute()
+        const shared = await insertEncryptedRow(rawJob, { name: 'approved.csv', fileType: 'ENCRYPTED-RESULT' })
+        vi.mocked(fetchSharedFileIdsAction).mockResolvedValue([shared.id])
 
         const job = await latestJobForStudy(study.id)
         renderWithProviders(<StudyResults job={job} />)
 
-        // Approved files render once per file in the unified table (not duplicated). Content
-        // is encrypted now — the row lists by name; downloading requires decryption.
+        // One row per file; the shared file shows by name (content needs decryption).
         await waitFor(() => {
             expect(screen.getByText('approved.csv')).toBeDefined()
         })
         expect(screen.getAllByText('approved.csv')).toHaveLength(1)
     })
 
-    it('does not duplicate rows when multiple APPROVED-RESULT files share a fileType', async () => {
+    it('does not duplicate rows when multiple result files are shared', async () => {
         const { study, latestJobWithStatus: rawJob } = await insertTestStudyJobData({
             org,
             studyStatus: 'APPROVED',
             jobStatus: 'FILES-APPROVED',
         })
 
-        await db
-            .insertInto('studyJobFile')
-            .values([
-                {
-                    studyJobId: rawJob.id,
-                    name: 'results.csv',
-                    path: `test-org/${study.id}/${rawJob.id}/results/approved/results.csv`,
-                    fileType: 'APPROVED-RESULT',
-                },
-                {
-                    studyJobId: rawJob.id,
-                    name: 'results2.csv',
-                    path: `test-org/${study.id}/${rawJob.id}/results/approved/results2.csv`,
-                    fileType: 'APPROVED-RESULT',
-                },
-            ])
-            .execute()
-
-        vi.mocked(fetchApprovedJobFilesAction).mockResolvedValue([
-            {
-                blob: new Blob(),
-                sourceId: 'approved-1',
-                fileType: 'APPROVED-RESULT' as FileType,
-                metadata: [{ path: 'results.csv', bytes: 1 }],
-            },
-            {
-                blob: new Blob(),
-                sourceId: 'approved-2',
-                fileType: 'APPROVED-RESULT' as FileType,
-                metadata: [{ path: 'results2.csv', bytes: 1 }],
-            },
-        ])
+        const first = await insertEncryptedRow(rawJob, { name: 'results.csv', fileType: 'ENCRYPTED-RESULT' })
+        const second = await insertEncryptedRow(rawJob, { name: 'results2.csv', fileType: 'ENCRYPTED-RESULT' })
+        vi.mocked(fetchSharedFileIdsAction).mockResolvedValue([first.id, second.id])
 
         const job = await latestJobForStudy(study.id)
         renderWithProviders(<StudyResults job={job} />)
@@ -141,10 +143,7 @@ describe('View Study Results', () => {
     })
 
     it('shows no logs message and hides decrypt UI when JOB-ERRORED has no encrypted logs', async () => {
-        const { study } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'JOB-ERRORED',
-        })
+        const { study } = await insertTestStudyJobData({ org, jobStatus: 'JOB-ERRORED' })
         const job = await latestJobForStudy(study.id)
 
         renderWithProviders(<StudyResults job={job} />)
@@ -156,20 +155,8 @@ describe('View Study Results', () => {
     })
 
     it('shows error message and decrypt UI when JOB-ERRORED has encrypted logs', async () => {
-        const { study, job } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'JOB-ERRORED',
-        })
-
-        await db
-            .insertInto('studyJobFile')
-            .values({
-                studyJobId: job.id,
-                name: 'encrypted-logs.zip',
-                path: `test-org/${study.id}/${job.id}/results/encrypted-logs.zip`,
-                fileType: 'ENCRYPTED-PACKAGING-ERROR-LOG',
-            })
-            .execute()
+        const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'JOB-ERRORED' })
+        await insertEncryptedRow(job, { name: 'packaging-error.log', fileType: 'ENCRYPTED-PACKAGING-ERROR-LOG' })
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<StudyResults job={latestJob} />)
@@ -189,49 +176,17 @@ describe('View Study Results', () => {
             return originalCreateObjectURL ? originalCreateObjectURL.call(URL, blob) : 'blob://mock'
         })
 
-        const publicKey = pemToArrayBuffer(await readTestSupportFile('public_key.pem'))
-        const fingerprint = await fingerprintKeyData(publicKey)
-        const writer = new ResultsWriter([{ publicKey, fingerprint }])
-
         const csv = `title\nhello world`
-        const csvBlob = Buffer.from(csv, 'utf-8')
-        const arrayBuf = csvBlob.buffer.slice(csvBlob.byteOffset, csvBlob.byteOffset + csvBlob.length)
-
-        await writer.addFile('test.data', arrayBuf)
-        const zip = await writer.generate()
-
-        const file = {
-            blob: new Blob([zip as BlobPart]),
-            sourceId: '123',
-            fileType: 'ENCRYPTED-RESULT' as FileType,
-            metadata: [{ path: 'test.data', bytes: 4 }],
-        }
 
+        const { study, job: rawJob } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
+        const file = await seedEncryptedFile(rawJob, { name: 'test.data', fileType: 'ENCRYPTED-RESULT', content: csv })
         vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([file])
 
-        const { study, job: rawJob } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'RUN-COMPLETE',
-        })
-
-        await db
-            .insertInto('studyJobFile')
-            .values({
-                studyJobId: rawJob.id,
-                name: 'results.zip',
-                path: `test-org/${study.id}/${rawJob.id}/results/results.zip`,
-                fileType: 'ENCRYPTED-RESULT',
-            })
-            .execute()
-
         const job = await latestJobForStudy(study.id)
         renderWithProviders(<StudyResults job={job} />)
 
         const input = screen.getByPlaceholderText('Enter your Reviewer key to access encrypted content.')
-
-        const privateKey = await readTestSupportFile('private_key.pem')
-
-        fireEvent.change(input, { target: { value: privateKey } })
+        fireEvent.change(input, { target: { value: await readTestSupportFile('private_key.pem') } })
         fireEvent.click(screen.getByRole('button', { name: 'Decrypt Files' }))
 
         await waitFor(() => {
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
index 487592106..2ec8307a9 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
@@ -9,7 +9,7 @@ import {
     rejectStudyProposalAction,
     type SelectedStudy,
 } from '@/server/actions/study.actions'
-import { reEncryptApprovedFiles } from '@/lib/re-encrypt-results'
+import { buildSharedFiles } from '@/lib/re-wrap-results'
 import { Button, Group, Stack } from '@mantine/core'
 import { useRouter } from 'next/navigation'
 import { FC, useState } from 'react'
@@ -35,16 +35,16 @@ export const StudyReviewButtons: FC<{ study: SelectedStudy; approvedFiles?: JobF
     } = useMutation({
         mutationFn: async (status: StudyStatus) => {
             if (status === 'APPROVED') {
-                // Re-encrypt approved result files for reviewers + researchers client-side;
-                // the server stores only ciphertext (no plaintext approved copies).
-                const jobFiles = approvedFiles?.length
-                    ? await reEncryptApprovedFiles(study.id, approvedFiles)
+                // Re-wrap approved result files for the lab researchers client-side; the
+                // server receives only wrapped keys (PO boxes), never plaintext.
+                const sharedFiles = approvedFiles?.length
+                    ? await buildSharedFiles(study.id, approvedFiles)
                     : undefined
                 return approveStudyProposalAction({
                     orgSlug,
                     studyId: study.id,
                     useTestImage,
-                    jobFiles,
+                    sharedFiles,
                 })
             }
             return rejectStudyProposalAction({ orgSlug, studyId: study.id })
diff --git a/src/app/api/job/[jobId]/results/route.test.ts b/src/app/api/job/[jobId]/results/route.test.ts
index 4e7bc6cb7..9dfc970c4 100644
--- a/src/app/api/job/[jobId]/results/route.test.ts
+++ b/src/app/api/job/[jobId]/results/route.test.ts
@@ -1,10 +1,12 @@
 import { expect, test, vi } from 'vitest'
 import * as apiHandler from './route'
-import { insertTestOrg, insertTestStudyData } from '@/tests/unit.helpers'
+import { insertTestOrg, insertTestStudyData, readTestSupportFile } from '@/tests/unit.helpers'
 import { s3Available } from '@/tests/s3.helpers'
 import { db } from '@/database'
 import { sendResultsReadyForReviewEmail } from '@/server/mailer'
 import { fetchFileContents } from '@/server/storage'
+import { ResultsWriter } from 'si-encryption/job-results/writer'
+import { fingerprintKeyData, pemToArrayBuffer } from 'si-encryption/util'
 
 vi.mock('@/server/mailer', () => ({
     sendResultsReadyForReviewEmail: vi.fn(),
@@ -18,20 +20,26 @@ vi.mock('@/server/aws', () => ({
     signedUrlForFile: vi.fn(),
 }))
 
+// TOA uploads a ResultsWriter zip; ingest decomposes it into per-file rows + PO boxes.
+async function buildEncryptedZip(fileName: string, content: string): Promise<File> {
+    const publicKey = pemToArrayBuffer(await readTestSupportFile('public_key.pem'))
+    const fingerprint = await fingerprintKeyData(publicKey)
+    const writer = new ResultsWriter([{ publicKey, fingerprint }])
+    const buf = Buffer.from(content, 'utf-8')
+    await writer.addFile(fileName, buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength))
+    const zip = await writer.generate()
+    return new File([zip], 'encrypted.zip', { type: 'application/zip' })
+}
+
 // These exercise the real S3 round-trip (storeStudyEncrypted*/fetchFileContents),
 // so they skip when SeaweedFS isn't running locally; on CI s3.helpers throws instead.
 test.skipIf(!s3Available)('uploading results', async () => {
     const org = await insertTestOrg()
 
-    const file = new File([new Uint8Array([1, 2, 3])], 'testfile.txt', { type: 'text/plain' })
-
     const formData = new FormData()
-    formData.append('result', file)
+    formData.append('result', await buildEncryptedZip('output.csv', 'a,b\n1,2'))
 
-    const req = new Request('http://localhost', {
-        method: 'PUT',
-        body: formData,
-    })
+    const req = new Request('http://localhost', { method: 'PUT', body: formData })
 
     const { jobIds } = await insertTestStudyData({ org })
 
@@ -41,14 +49,16 @@ test.skipIf(!s3Available)('uploading results', async () => {
 
     const sr = await db
         .selectFrom('studyJobFile')
-        .select(['path', 'fileType'])
+        .select(['id', 'path', 'name', 'fileType', 'iv'])
         .where('studyJobFile.studyJobId', '=', jobIds[0])
         .executeTakeFirstOrThrow()
 
-    expect(sr).toMatchObject({
-        path: expect.any(String),
-        fileType: 'ENCRYPTED-RESULT',
-    })
+    expect(sr).toMatchObject({ name: 'output.csv', fileType: 'ENCRYPTED-RESULT' })
+    expect(sr.iv).toBeTruthy()
+
+    // The manifest's recipient key became a PO box row.
+    const boxes = await db.selectFrom('studyJobFileKey').select('crypt').where('studyJobFileId', '=', sr.id).execute()
+    expect(boxes.length).toBeGreaterThan(0)
 
     const contents = await fetchFileContents(sr.path)
     expect(contents).toBeInstanceOf(Blob)
@@ -56,17 +66,11 @@ test.skipIf(!s3Available)('uploading results', async () => {
 
 test.skipIf(!s3Available)('uploading logs', async () => {
     const org = await insertTestOrg()
-    const logContents = 'long line one\nlog line two\n'
-    const encoder = new TextEncoder()
-    const file = new File([encoder.encode(logContents)], 'testfile.log', { type: 'text/plain' })
 
     const formData = new FormData()
-    formData.append('log', file)
+    formData.append('log', await buildEncryptedZip('run.log', 'log line one\nlog line two\n'))
 
-    const req = new Request('http://localhost', {
-        method: 'PUT',
-        body: formData,
-    })
+    const req = new Request('http://localhost', { method: 'PUT', body: formData })
 
     const { jobIds } = await insertTestStudyData({ org })
 
@@ -76,14 +80,12 @@ test.skipIf(!s3Available)('uploading logs', async () => {
 
     const sr = await db
         .selectFrom('studyJobFile')
-        .select(['path', 'fileType'])
+        .select(['path', 'name', 'fileType', 'iv'])
         .where('studyJobFile.studyJobId', '=', jobIds[0])
         .executeTakeFirstOrThrow()
 
-    expect(sr).toMatchObject({
-        path: expect.any(String),
-        fileType: 'ENCRYPTED-CODE-RUN-LOG',
-    })
+    expect(sr).toMatchObject({ name: 'run.log', fileType: 'ENCRYPTED-CODE-RUN-LOG' })
+    expect(sr.iv).toBeTruthy()
 
     const contents = await fetchFileContents(sr.path)
     expect(contents).toBeInstanceOf(Blob)
diff --git a/src/components/encrypted-files-panel.test.tsx b/src/components/encrypted-files-panel.test.tsx
index f9be587ac..15b4cc233 100644
--- a/src/components/encrypted-files-panel.test.tsx
+++ b/src/components/encrypted-files-panel.test.tsx
@@ -9,17 +9,83 @@ import {
 } from '@/tests/unit.helpers'
 import { fireEvent, waitFor, screen } from '@testing-library/react'
 import { EncryptedFilesPanel } from './encrypted-files-panel'
-import { fetchApprovedJobFilesAction, fetchEncryptedJobFilesAction } from '@/server/actions/study-job.actions'
+import { fetchEncryptedJobFilesAction, fetchSharedFileIdsAction } from '@/server/actions/study-job.actions'
 import { latestJobForStudy } from '@/server/db/queries'
 import { ResultsWriter } from 'si-encryption/job-results/writer'
+import { decomposeResultsZip } from 'si-encryption/job-results/decompose'
 import { fingerprintKeyData, pemToArrayBuffer } from 'si-encryption/util'
 import { type FileType } from '@/database/types'
 
 vi.mock('@/server/actions/study-job.actions', () => ({
-    fetchApprovedJobFilesAction: vi.fn(() => []),
     fetchEncryptedJobFilesAction: vi.fn(() => []),
+    fetchSharedFileIdsAction: vi.fn(() => []),
 }))
 
+const toArrayBuffer = (str: string): ArrayBuffer => {
+    const buf = Buffer.from(str, 'utf-8')
+    return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength)
+}
+
+type MinimalJob = { id: string }
+
+// Insert one decomposed encrypted-file row, with a real (decryptable) body the
+// fetchEncryptedJobFilesAction mock will serve. Returns the row id so callers can
+// match it to the per-file fetch entry.
+async function seedEncryptedFile(
+    job: MinimalJob,
+    { name, fileType, content }: { name: string; fileType: FileType; content: string },
+) {
+    const publicKey = pemToArrayBuffer(await readTestSupportFile('public_key.pem'))
+    const fingerprint = await fingerprintKeyData(publicKey)
+    const writer = new ResultsWriter([{ publicKey, fingerprint }])
+    await writer.addFile(name, toArrayBuffer(content))
+    const [decomposed] = await decomposeResultsZip(await writer.generate())
+
+    const row = await db
+        .insertInto('studyJobFile')
+        .values({
+            studyJobId: job.id,
+            name,
+            path: `test-org/${job.id}/results/encrypted/${name}`,
+            fileType,
+            iv: decomposed.iv,
+            bytes: decomposed.bytes,
+        })
+        .returning('id')
+        .executeTakeFirstOrThrow()
+
+    return {
+        studyJobFileId: row.id,
+        fileType,
+        path: `test-org/${job.id}/results/encrypted/${name}`,
+        name,
+        iv: decomposed.iv,
+        crypt: decomposed.keys[fingerprint].crypt,
+        encryptedBody: decomposed.body,
+    }
+}
+
+// A display-only encrypted-file row (no real ciphertext) for lock/shared/withheld states.
+async function insertEncryptedRow(
+    job: MinimalJob,
+    { name, fileType, bytes }: { name: string; fileType: FileType; bytes?: number },
+) {
+    return db
+        .insertInto('studyJobFile')
+        .values({
+            studyJobId: job.id,
+            name,
+            path: `test-org/${job.id}/results/encrypted/${name}`,
+            fileType,
+            iv: 'aXY=',
+            bytes: bytes ?? null,
+        })
+        .returning('id')
+        .executeTakeFirstOrThrow()
+}
+
+const READER_KEY_PLACEHOLDER = 'Enter your Reviewer key to access encrypted content.'
+
 describe('EncryptedFilesPanel', () => {
     let org: Org
 
@@ -29,113 +95,36 @@ describe('EncryptedFilesPanel', () => {
     })
 
     it('returns null when no encrypted files exist', async () => {
-        const { latestJobWithStatus: job } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'RUN-COMPLETE',
-        })
+        const { latestJobWithStatus: job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
 
         const { container } = renderWithProviders(<EncryptedFilesPanel job={job} onFilesApproved={vi.fn()} />)
         expect(container.querySelector('form')).toBeNull()
         expect(screen.queryByText('Decrypt Files')).toBeNull()
     })
 
-    it('shows file rows with lock icon and decrypt form when encrypted files exist', async () => {
-        const { study, job } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'RUN-COMPLETE',
-        })
-
-        await db
-            .insertInto('studyJobFile')
-            .values({
-                studyJobId: job.id,
-                name: 'results.zip',
-                path: `test-org/${study.id}/${job.id}/results/results.zip`,
-                fileType: 'ENCRYPTED-RESULT',
-            })
-            .execute()
+    it('shows a file row with lock icon and the decrypt form when an encrypted file exists', async () => {
+        const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
+        await insertEncryptedRow(job, { name: 'results.csv', fileType: 'ENCRYPTED-RESULT', bytes: 2048 })
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
 
-        // File row is visible in the table
         expect(screen.getByText('Results')).toBeDefined()
-        expect(screen.getByText('results.zip')).toBeDefined()
+        expect(screen.getByText('results.csv')).toBeDefined()
+        expect(screen.getByText('2.0 KB')).toBeDefined()
 
-        // No View or Download actions for locked files
+        // Locked → no View/Download
         expect(screen.queryByRole('button', { name: 'View' })).toBeNull()
         expect(screen.queryByTestId('download-link')).toBeNull()
 
-        // Decrypt form is present
-        expect(screen.getByPlaceholderText('Enter your Reviewer key to access encrypted content.')).toBeDefined()
+        expect(screen.getByPlaceholderText(READER_KEY_PLACEHOLDER)).toBeDefined()
         expect(screen.getByRole('button', { name: 'Decrypt Files' })).toBeDefined()
     })
 
-    it('shows file names and sizes from metadata before decryption', async () => {
-        const { study, job } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'RUN-COMPLETE',
-        })
-
-        await db
-            .insertInto('studyJobFile')
-            .values({
-                studyJobId: job.id,
-                name: 'results.zip',
-                path: `test-org/${study.id}/${job.id}/results/results.zip`,
-                fileType: 'ENCRYPTED-RESULT',
-            })
-            .execute()
-
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([
-            {
-                blob: new Blob(),
-                sourceId: '123',
-                fileType: 'ENCRYPTED-RESULT',
-                metadata: [{ path: 'results.csv', bytes: 2048 }],
-            },
-        ])
-
-        const latestJob = await latestJobForStudy(study.id)
-        renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
-
-        await waitFor(() => {
-            expect(screen.getByText('results.csv')).toBeDefined()
-            expect(screen.getByText('2.0 KB')).toBeDefined()
-        })
-
-        // Still locked — no View or Download
-        expect(screen.queryByRole('button', { name: 'View' })).toBeNull()
-        expect(screen.queryByTestId('download-link')).toBeNull()
-    })
-
-    it('shows one row per file when an encrypted archive contains multiple files', async () => {
-        const { study, job } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'RUN-COMPLETE',
-        })
-
-        await db
-            .insertInto('studyJobFile')
-            .values({
-                studyJobId: job.id,
-                name: 'results.zip',
-                path: `test-org/${study.id}/${job.id}/results/results.zip`,
-                fileType: 'ENCRYPTED-RESULT',
-            })
-            .execute()
-
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([
-            {
-                blob: new Blob(),
-                sourceId: '123',
-                fileType: 'ENCRYPTED-RESULT',
-                metadata: [
-                    { path: 'first.csv', bytes: 1024 },
-                    { path: 'second.csv', bytes: 2048 },
-                ],
-            },
-        ])
+    it('shows one row per file when the job has multiple encrypted files', async () => {
+        const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
+        await insertEncryptedRow(job, { name: 'first.csv', fileType: 'ENCRYPTED-RESULT', bytes: 1024 })
+        await insertEncryptedRow(job, { name: 'second.csv', fileType: 'ENCRYPTED-RESULT', bytes: 2048 })
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
@@ -146,55 +135,24 @@ describe('EncryptedFilesPanel', () => {
             expect(screen.getByText('1.0 KB')).toBeDefined()
             expect(screen.getByText('2.0 KB')).toBeDefined()
         })
-
-        // Aggregated "N files" placeholder should not appear
-        expect(screen.queryByText('2 files')).toBeNull()
     })
 
-    it('decrypts and shows file table with View and Download', async () => {
-        const publicKey = pemToArrayBuffer(await readTestSupportFile('public_key.pem'))
-        const fingerprint = await fingerprintKeyData(publicKey)
-        const writer = new ResultsWriter([{ publicKey, fingerprint }])
-
-        const csv = 'name,age\nAlice,30'
-        const csvBuf = Buffer.from(csv, 'utf-8')
-        const arrayBuf = csvBuf.buffer.slice(csvBuf.byteOffset, csvBuf.byteOffset + csvBuf.length)
-
-        await writer.addFile('results.csv', arrayBuf)
-        const zip = await writer.generate()
-
-        const file = {
-            blob: new Blob([zip as BlobPart]),
-            sourceId: '123',
-            fileType: 'ENCRYPTED-RESULT' as FileType,
-            metadata: [{ path: 'results.csv', bytes: 15 }],
-        }
-
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([file])
-
-        const { study, job } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'RUN-COMPLETE',
+    it('decrypts and shows the file table with View and Download', async () => {
+        const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
+        const file = await seedEncryptedFile(job, {
+            name: 'results.csv',
+            fileType: 'ENCRYPTED-RESULT',
+            content: 'name,age\nAlice,30',
         })
-
-        await db
-            .insertInto('studyJobFile')
-            .values({
-                studyJobId: job.id,
-                name: 'results.zip',
-                path: `test-org/${study.id}/${job.id}/results/results.zip`,
-                fileType: 'ENCRYPTED-RESULT',
-            })
-            .execute()
+        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([file])
 
         const onFilesApproved = vi.fn()
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={onFilesApproved} />)
 
-        const input = screen.getByPlaceholderText('Enter your Reviewer key to access encrypted content.')
-        const privateKey = await readTestSupportFile('private_key.pem')
-
-        fireEvent.change(input, { target: { value: privateKey } })
+        fireEvent.change(screen.getByPlaceholderText(READER_KEY_PLACEHOLDER), {
+            target: { value: await readTestSupportFile('private_key.pem') },
+        })
         fireEvent.click(screen.getByRole('button', { name: 'Decrypt Files' }))
 
         await waitFor(() => {
@@ -205,64 +163,33 @@ describe('EncryptedFilesPanel', () => {
                 expect.objectContaining({
                     path: 'results.csv',
                     fileType: 'APPROVED-RESULT',
-                    sourceId: '123',
+                    sourceId: file.studyJobFileId,
                 }),
             ])
         })
     })
 
-    it('decrypts an archive with multiple files and shows one row per file', async () => {
-        const publicKey = pemToArrayBuffer(await readTestSupportFile('public_key.pem'))
-        const fingerprint = await fingerprintKeyData(publicKey)
-        const writer = new ResultsWriter([{ publicKey, fingerprint }])
-
-        const csvA = 'name,age\nAlice,30'
-        const csvABuf = Buffer.from(csvA, 'utf-8')
-        const arrayBufA = csvABuf.buffer.slice(csvABuf.byteOffset, csvABuf.byteOffset + csvABuf.length)
-
-        const csvB = 'city,state\nDenver,CO'
-        const csvBBuf = Buffer.from(csvB, 'utf-8')
-        const arrayBufB = csvBBuf.buffer.slice(csvBBuf.byteOffset, csvBBuf.byteOffset + csvBBuf.length)
-
-        await writer.addFile('first.csv', arrayBufA)
-        await writer.addFile('second.csv', arrayBufB)
-        const zip = await writer.generate()
-
-        const file = {
-            blob: new Blob([zip as BlobPart]),
-            sourceId: '123',
-            fileType: 'ENCRYPTED-RESULT' as FileType,
-            metadata: [
-                { path: 'first.csv', bytes: arrayBufA.byteLength },
-                { path: 'second.csv', bytes: arrayBufB.byteLength },
-            ],
-        }
-
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([file])
-
-        const { study, job } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'RUN-COMPLETE',
+    it('decrypts multiple files and shows one row per file', async () => {
+        const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
+        const first = await seedEncryptedFile(job, {
+            name: 'first.csv',
+            fileType: 'ENCRYPTED-RESULT',
+            content: 'name,age\nAlice,30',
         })
-
-        await db
-            .insertInto('studyJobFile')
-            .values({
-                studyJobId: job.id,
-                name: 'results.zip',
-                path: `test-org/${study.id}/${job.id}/results/results.zip`,
-                fileType: 'ENCRYPTED-RESULT',
-            })
-            .execute()
+        const second = await seedEncryptedFile(job, {
+            name: 'second.csv',
+            fileType: 'ENCRYPTED-RESULT',
+            content: 'city,state\nDenver,CO',
+        })
+        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([first, second])
 
         const onFilesApproved = vi.fn()
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={onFilesApproved} />)
 
-        const input = screen.getByPlaceholderText('Enter your Reviewer key to access encrypted content.')
-        const privateKey = await readTestSupportFile('private_key.pem')
-
-        fireEvent.change(input, { target: { value: privateKey } })
+        fireEvent.change(screen.getByPlaceholderText(READER_KEY_PLACEHOLDER), {
+            target: { value: await readTestSupportFile('private_key.pem') },
+        })
         fireEvent.click(screen.getByRole('button', { name: 'Decrypt Files' }))
 
         await waitFor(() => {
@@ -282,55 +209,24 @@ describe('EncryptedFilesPanel', () => {
         })
     })
 
-    it('opens modal with CSV content rendered as table', async () => {
-        const publicKey = pemToArrayBuffer(await readTestSupportFile('public_key.pem'))
-        const fingerprint = await fingerprintKeyData(publicKey)
-        const writer = new ResultsWriter([{ publicKey, fingerprint }])
-
-        const csv = 'name,age\nAlice,30'
-        const csvBuf = Buffer.from(csv, 'utf-8')
-        const arrayBuf = csvBuf.buffer.slice(csvBuf.byteOffset, csvBuf.byteOffset + csvBuf.length)
-
-        await writer.addFile('results.csv', arrayBuf)
-        const zip = await writer.generate()
-
-        const file = {
-            blob: new Blob([zip as BlobPart]),
-            sourceId: '123',
-            fileType: 'ENCRYPTED-RESULT' as FileType,
-            metadata: [{ path: 'results.csv', bytes: 15 }],
-        }
-
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([file])
-
-        const { study, job } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'RUN-COMPLETE',
+    it('opens a modal with CSV content rendered as a table', async () => {
+        const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
+        const file = await seedEncryptedFile(job, {
+            name: 'results.csv',
+            fileType: 'ENCRYPTED-RESULT',
+            content: 'name,age\nAlice,30',
         })
-
-        await db
-            .insertInto('studyJobFile')
-            .values({
-                studyJobId: job.id,
-                name: 'results.zip',
-                path: `test-org/${study.id}/${job.id}/results/results.zip`,
-                fileType: 'ENCRYPTED-RESULT',
-            })
-            .execute()
+        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([file])
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
 
-        const input = screen.getByPlaceholderText('Enter your Reviewer key to access encrypted content.')
-        const privateKey = await readTestSupportFile('private_key.pem')
-
-        fireEvent.change(input, { target: { value: privateKey } })
-        fireEvent.click(screen.getByRole('button', { name: 'Decrypt Files' }))
-
-        await waitFor(() => {
-            expect(screen.getByRole('button', { name: 'View' })).toBeDefined()
+        fireEvent.change(screen.getByPlaceholderText(READER_KEY_PLACEHOLDER), {
+            target: { value: await readTestSupportFile('private_key.pem') },
         })
+        fireEvent.click(screen.getByRole('button', { name: 'Decrypt Files' }))
 
+        await waitFor(() => expect(screen.getByRole('button', { name: 'View' })).toBeDefined())
         fireEvent.click(screen.getByRole('button', { name: 'View' }))
 
         await waitFor(() => {
@@ -341,55 +237,25 @@ describe('EncryptedFilesPanel', () => {
         })
     })
 
-    it('opens modal with text content rendered as code block for log files', async () => {
-        const publicKey = pemToArrayBuffer(await readTestSupportFile('public_key.pem'))
-        const fingerprint = await fingerprintKeyData(publicKey)
-        const writer = new ResultsWriter([{ publicKey, fingerprint }])
-
+    it('opens a modal with text content rendered as a code block for log files', async () => {
+        const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
         const logContent = 'Security scan complete: no issues found.'
-        const contentBuf = Buffer.from(logContent, 'utf-8')
-        const arrayBuf = contentBuf.buffer.slice(contentBuf.byteOffset, contentBuf.byteOffset + contentBuf.length)
-
-        await writer.addFile('scan-log.txt', arrayBuf)
-        const zip = await writer.generate()
-
-        const file = {
-            blob: new Blob([zip as BlobPart]),
-            sourceId: '123',
-            fileType: 'ENCRYPTED-SECURITY-SCAN-LOG' as FileType,
-            metadata: [{ path: 'scan-log.txt', bytes: 40 }],
-        }
-
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([file])
-
-        const { study, job } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'RUN-COMPLETE',
+        const file = await seedEncryptedFile(job, {
+            name: 'scan-log.txt',
+            fileType: 'ENCRYPTED-SECURITY-SCAN-LOG',
+            content: logContent,
         })
-
-        await db
-            .insertInto('studyJobFile')
-            .values({
-                studyJobId: job.id,
-                name: 'scan-log.zip',
-                path: `test-org/${study.id}/${job.id}/results/scan-log.zip`,
-                fileType: 'ENCRYPTED-SECURITY-SCAN-LOG',
-            })
-            .execute()
+        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([file])
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
 
-        const input = screen.getByPlaceholderText('Enter your Reviewer key to access encrypted content.')
-        const privateKey = await readTestSupportFile('private_key.pem')
-
-        fireEvent.change(input, { target: { value: privateKey } })
-        fireEvent.click(screen.getByRole('button', { name: 'Decrypt Files' }))
-
-        await waitFor(() => {
-            expect(screen.getByRole('button', { name: 'View' })).toBeDefined()
+        fireEvent.change(screen.getByPlaceholderText(READER_KEY_PLACEHOLDER), {
+            target: { value: await readTestSupportFile('private_key.pem') },
         })
+        fireEvent.click(screen.getByRole('button', { name: 'Decrypt Files' }))
 
+        await waitFor(() => expect(screen.getByRole('button', { name: 'View' })).toBeDefined())
         fireEvent.click(screen.getByRole('button', { name: 'View' }))
 
         await waitFor(() => {
@@ -399,108 +265,28 @@ describe('EncryptedFilesPanel', () => {
     })
 
     it('shows a green check for shared files and a red "not shared" X for withheld files after approval', async () => {
-        const { study, job } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'FILES-APPROVED',
-        })
+        const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'FILES-APPROVED' })
+        const shared = await insertEncryptedRow(job, { name: 'first.csv', fileType: 'ENCRYPTED-RESULT', bytes: 1024 })
+        await insertEncryptedRow(job, { name: 'second.csv', fileType: 'ENCRYPTED-RESULT', bytes: 2048 })
 
-        await db
-            .insertInto('studyJobFile')
-            .values([
-                {
-                    studyJobId: job.id,
-                    name: 'results.zip',
-                    path: `test-org/${study.id}/${job.id}/results/results.zip`,
-                    fileType: 'ENCRYPTED-RESULT',
-                },
-                {
-                    studyJobId: job.id,
-                    name: 'first.csv',
-                    path: `test-org/${study.id}/${job.id}/results/approved/first.csv`,
-                    fileType: 'APPROVED-RESULT',
-                },
-            ])
-            .execute()
-
-        // The original archive contained two files; only first.csv was shared.
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([
-            {
-                blob: new Blob(),
-                sourceId: '123',
-                fileType: 'ENCRYPTED-RESULT',
-                metadata: [
-                    { path: 'first.csv', bytes: 1024 },
-                    { path: 'second.csv', bytes: 2048 },
-                ],
-            },
-        ])
-
-        vi.mocked(fetchApprovedJobFilesAction).mockResolvedValue([
-            {
-                blob: new Blob(),
-                sourceId: 'approved-1',
-                fileType: 'APPROVED-RESULT',
-                metadata: [{ path: 'first.csv', bytes: 1024 }],
-            },
-        ])
+        // Only first.csv has a researcher PO box → it's the shared/approved one.
+        vi.mocked(fetchSharedFileIdsAction).mockResolvedValue([shared.id])
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
 
-        // Shared (green) and withheld (red X) states render from metadata without decrypting.
         await waitFor(() => {
             expect(screen.getByText('first.csv')).toBeDefined()
             expect(screen.getByLabelText('second.csv not shared with researcher')).toBeDefined()
         })
     })
 
-    it('shows a red "not shared" X (not a lock icon) for an entire log type withheld after approval', async () => {
-        const { study, job } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'FILES-APPROVED',
-        })
+    it('shows a red "not shared" X for a withheld log file after approval', async () => {
+        const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'FILES-APPROVED' })
+        const shared = await insertEncryptedRow(job, { name: 'first.csv', fileType: 'ENCRYPTED-RESULT', bytes: 1024 })
+        await insertEncryptedRow(job, { name: 'scan-log.txt', fileType: 'ENCRYPTED-SECURITY-SCAN-LOG', bytes: 40 })
 
-        await db
-            .insertInto('studyJobFile')
-            .values([
-                {
-                    studyJobId: job.id,
-                    name: 'first.csv',
-                    path: `test-org/${study.id}/${job.id}/results/approved/first.csv`,
-                    fileType: 'APPROVED-RESULT',
-                },
-                {
-                    studyJobId: job.id,
-                    name: 'scan-log.zip',
-                    path: `test-org/${study.id}/${job.id}/results/scan-log.zip`,
-                    fileType: 'ENCRYPTED-SECURITY-SCAN-LOG',
-                },
-            ])
-            .execute()
-
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([
-            {
-                blob: new Blob(),
-                sourceId: '123',
-                fileType: 'ENCRYPTED-RESULT',
-                metadata: [{ path: 'first.csv', bytes: 1024 }],
-            },
-            {
-                blob: new Blob(),
-                sourceId: '456',
-                fileType: 'ENCRYPTED-SECURITY-SCAN-LOG',
-                metadata: [{ path: 'scan-log.txt', bytes: 40 }],
-            },
-        ])
-
-        vi.mocked(fetchApprovedJobFilesAction).mockResolvedValue([
-            {
-                blob: new Blob(),
-                sourceId: 'approved-1',
-                fileType: 'APPROVED-RESULT',
-                metadata: [{ path: 'first.csv', bytes: 1024 }],
-            },
-        ])
+        vi.mocked(fetchSharedFileIdsAction).mockResolvedValue([shared.id])
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
@@ -510,62 +296,9 @@ describe('EncryptedFilesPanel', () => {
         })
     })
 
-    it('renders a placeholder row rather than silently dropping files when metadata is unavailable for an approved job', async () => {
-        const { study, job } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'FILES-APPROVED',
-        })
-
-        await db
-            .insertInto('studyJobFile')
-            .values({
-                studyJobId: job.id,
-                name: 'results.zip',
-                path: `test-org/${study.id}/${job.id}/results/results.zip`,
-                fileType: 'ENCRYPTED-RESULT',
-            })
-            .execute()
-
-        // Encrypted-file metadata never arrives (fetch in flight or failed and swallowed by Sentry),
-        // and there are no approved files yet — metaList and approvedFilesForType are both empty.
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([])
-        vi.mocked(fetchApprovedJobFilesAction).mockResolvedValue([])
-
-        const latestJob = await latestJobForStudy(study.id)
-        renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
-
-        // The group still renders a placeholder row instead of an empty table; without metadata we
-        // can't enumerate withheld files, so no "not shared" indicator is shown yet.
-        await waitFor(() => {
-            expect(screen.getByText('results.zip')).toBeDefined()
-        })
-        expect(screen.queryByLabelText(/not shared with researcher/)).toBeNull()
-    })
-
     it('does not show any "not shared" indicator while a job is still under review', async () => {
-        const { study, job } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'RUN-COMPLETE',
-        })
-
-        await db
-            .insertInto('studyJobFile')
-            .values({
-                studyJobId: job.id,
-                name: 'results.zip',
-                path: `test-org/${study.id}/${job.id}/results/results.zip`,
-                fileType: 'ENCRYPTED-RESULT',
-            })
-            .execute()
-
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([
-            {
-                blob: new Blob(),
-                sourceId: '123',
-                fileType: 'ENCRYPTED-RESULT',
-                metadata: [{ path: 'results.csv', bytes: 2048 }],
-            },
-        ])
+        const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
+        await insertEncryptedRow(job, { name: 'results.csv', fileType: 'ENCRYPTED-RESULT', bytes: 2048 })
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
@@ -573,7 +306,6 @@ describe('EncryptedFilesPanel', () => {
         await waitFor(() => {
             expect(screen.getByText('results.csv')).toBeDefined()
         })
-
         expect(screen.queryByLabelText(/not shared with researcher/)).toBeNull()
     })
 })
diff --git a/src/components/job-results.tsx b/src/components/job-results.tsx
index 000f253d5..cc5bf1d2b 100644
--- a/src/components/job-results.tsx
+++ b/src/components/job-results.tsx
@@ -8,7 +8,7 @@ import { ErrorAlert } from '@/components/errors'
 import { DownloadBlobLink } from '@/components/download-blob-link'
 import { isApprovedLogType, logLabel } from '@/lib/file-type-helpers'
 import { useDecryptFiles, type EncryptedJobFile } from '@/hooks/use-decrypt-files'
-import { fetchApprovedJobFilesAction } from '@/server/actions/study-job.actions'
+import { fetchEncryptedJobFilesAction } from '@/server/actions/study-job.actions'
 import { JobFile, JobFileInfo } from '@/lib/types'
 import { LatestJobForStudy } from '@/server/db/queries'
 
@@ -32,8 +32,9 @@ const ViewResultsLink: FC<{ content: ArrayBuffer }> = ({ content }) => {
 }
 
 // Researcher-facing view of shared results. There is no plaintext copy: the
-// researcher decrypts the re-encrypted approved files with their own key (they
-// are a recipient of the re-encryption done at approve time).
+// researcher decrypts the encrypted file bodies with their own key, using the PO box
+// the reviewer re-wrapped for them at approve time (the server only returns files the
+// researcher actually has a box for).
 export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
     const [decryptedFiles, setDecryptedFiles] = useState<JobFileInfo[]>()
 
@@ -43,8 +44,8 @@ export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
         isError,
         error,
     } = useQuery({
-        queryKey: ['approved-files', job.id],
-        queryFn: async () => await fetchApprovedJobFilesAction({ studyJobId: job.id }),
+        queryKey: ['encrypted-files', job.id],
+        queryFn: async () => await fetchEncryptedJobFilesAction({ jobId: job.id }),
     })
 
     const {
diff --git a/src/components/study/submitted-code-table.test.tsx b/src/components/study/submitted-code-table.test.tsx
index a0572506c..b8c0ca0e9 100644
--- a/src/components/study/submitted-code-table.test.tsx
+++ b/src/components/study/submitted-code-table.test.tsx
@@ -21,8 +21,12 @@ import { fetchStudyJobCodeFileAction } from '@/server/actions/study-job.actions'
 const mockFetch = fetchStudyJobCodeFileAction as unknown as Mock
 
 const buildFile = (overrides: Partial<LatestJobForStudy['files'][number]>): LatestJobForStudy['files'][number] => ({
+    id: 'file-1',
     name: 'main.py',
+    path: 'code/main.py',
     fileType: 'MAIN-CODE',
+    iv: null,
+    bytes: null,
     createdAt: '2026-01-01T12:00:00Z',
     ...overrides,
 })
diff --git a/src/database/migrations/1780000000000_study_job_file_keys.ts b/src/database/migrations/1780000000000_study_job_file_keys.ts
new file mode 100644
index 000000000..42a0f816c
--- /dev/null
+++ b/src/database/migrations/1780000000000_study_job_file_keys.ts
@@ -0,0 +1,36 @@
+import { type Kysely, sql } from 'kysely'
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+    await db.schema.alterTable('study_job_file').addColumn('iv', 'text').execute()
+    await db.schema.alterTable('study_job_file').addColumn('bytes', 'integer').execute()
+
+    // Records the durable fact that a reviewer approved (and shared) this file. The
+    // per-recipient `study_job_file_key` boxes are the *access* mechanism; approval is a
+    // historical event and must not be re-derived from current org membership (which can
+    // change). A file is approved iff approved_at is set.
+    await db.schema.alterTable('study_job_file').addColumn('approved_at', 'timestamptz').execute()
+    await db.schema
+        .alterTable('study_job_file')
+        .addColumn('approved_by_user_id', 'uuid', (col) => col.references('user.id').onDelete('set null'))
+        .execute()
+
+    await db.schema
+        .createTable('study_job_file_key')
+        .addColumn('id', 'uuid', (col) => col.defaultTo(sql`v7uuid()`).primaryKey())
+        .addColumn('study_job_file_id', 'uuid', (col) =>
+            col.notNull().references('study_job_file.id').onDelete('cascade'),
+        )
+        .addColumn('fingerprint', 'text', (col) => col.notNull())
+        .addColumn('crypt', 'text', (col) => col.notNull())
+        .addColumn('created_at', 'timestamptz', (col) => col.defaultTo(sql`now()`).notNull())
+        .addUniqueConstraint('study_job_file_key_file_fingerprint_unique', ['study_job_file_id', 'fingerprint'])
+        .execute()
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+    await db.schema.dropTable('study_job_file_key').execute()
+    await db.schema.alterTable('study_job_file').dropColumn('approved_by_user_id').execute()
+    await db.schema.alterTable('study_job_file').dropColumn('approved_at').execute()
+    await db.schema.alterTable('study_job_file').dropColumn('bytes').execute()
+    await db.schema.alterTable('study_job_file').dropColumn('iv').execute()
+}
diff --git a/src/database/types.ts b/src/database/types.ts
index 56674247a..163195f35 100644
--- a/src/database/types.ts
+++ b/src/database/types.ts
@@ -255,15 +255,27 @@ export interface StudyJob {
 }
 
 export interface StudyJobFile {
+    approvedAt: Timestamp | null
+    approvedByUserId: string | null
+    bytes: number | null
     createdAt: Generated<Timestamp>
     fileType: StudyJobFileType
     id: Generated<string>
+    iv: string | null
     name: string
     path: string
     sourceId: string | null
     studyJobId: string
 }
 
+export interface StudyJobFileKey {
+    createdAt: Generated<Timestamp>
+    crypt: string
+    fingerprint: string
+    id: Generated<string>
+    studyJobFileId: string
+}
+
 export interface StudyProposalComment {
     authorId: string
     authorRole: StudyProposalCommentAuthorRole
@@ -340,6 +352,7 @@ export interface DB {
     study: Study
     studyJob: StudyJob
     studyJobFile: StudyJobFile
+    studyJobFileKey: StudyJobFileKey
     studyProposalComment: StudyProposalComment
     studyReview: StudyReview
     studyReviewComment: StudyReviewComment
diff --git a/src/hooks/use-decrypt-files.ts b/src/hooks/use-decrypt-files.ts
index a1274f359..74aecc38b 100644
--- a/src/hooks/use-decrypt-files.ts
+++ b/src/hooks/use-decrypt-files.ts
@@ -3,47 +3,53 @@ import { ENCRYPTED_TO_APPROVED } from '@/lib/file-type-helpers'
 import type { JobFileInfo } from '@/lib/types'
 import { isNotEmpty, useForm } from '@mantine/form'
 import { useMutation } from '@/common'
-import { ResultsReader } from 'si-encryption/job-results/reader'
-import { fingerprintPublicKeyFromPrivateKey, pemToArrayBuffer, privateKeyFromBuffer } from 'si-encryption/util'
+import { decryptFile } from 'si-encryption/job-results/crypto'
+import { pemToArrayBuffer, privateKeyFromBuffer } from 'si-encryption/util'
 import type { FileType } from '@/database/types'
-import type { FileInfo } from 'si-encryption/job-results/types'
 
+// One decomposed encrypted file as returned by fetchEncryptedJobFilesAction: the
+// ciphertext body plus its iv and the requesting user's wrapped AES key (`crypt`).
 export type EncryptedJobFile = {
-    blob: Blob
-    sourceId: string
+    studyJobFileId: string
     fileType: FileType
-    metadata: FileInfo[]
+    path: string
+    name: string
+    iv: string
+    crypt: string
+    encryptedBody: ArrayBuffer
 }
 
 class KeyParseError extends Error {}
 class DecryptionError extends Error {}
 
 async function decryptFiles(encryptedFiles: EncryptedJobFile[], privateKey: string): Promise<JobFileInfo[]> {
-    let fingerprint = ''
-    let privateKeyBuffer: ArrayBuffer = new ArrayBuffer(0)
+    let privateKeyBuffer: ArrayBuffer
     try {
         privateKeyBuffer = pemToArrayBuffer(privateKey)
-        const key = await privateKeyFromBuffer(privateKeyBuffer)
-        fingerprint = await fingerprintPublicKeyFromPrivateKey(key)
+        await privateKeyFromBuffer(privateKeyBuffer)
     } catch (err) {
         throw new KeyParseError('Invalid key data, check that key was copied successfully', { cause: err })
     }
     try {
-        const decryptedFiles: JobFileInfo[] = []
-        for (const encryptedBlob of encryptedFiles) {
-            const reader = new ResultsReader(encryptedBlob.blob, privateKeyBuffer, fingerprint)
-            const extractedFiles = await reader.extractFiles()
-            for (const extractedFile of extractedFiles) {
-                decryptedFiles.push({
-                    ...extractedFile,
-                    sourceId: encryptedBlob.sourceId,
+        return await Promise.all(
+            encryptedFiles.map(async (file) => {
+                const { contents, rawAesKey } = await decryptFile({
+                    body: file.encryptedBody,
+                    iv: file.iv,
+                    crypt: file.crypt,
+                    privateKey: privateKeyBuffer,
+                })
+                return {
+                    path: file.name,
+                    contents,
+                    rawAesKey,
+                    sourceId: file.studyJobFileId,
                     // Map an encrypted type to its approved form; an already-approved input
                     // (researcher viewing shared results) keeps its type.
-                    fileType: ENCRYPTED_TO_APPROVED[encryptedBlob.fileType] ?? encryptedBlob.fileType,
-                })
-            }
-        }
-        return decryptedFiles
+                    fileType: ENCRYPTED_TO_APPROVED[file.fileType] ?? file.fileType,
+                }
+            }),
+        )
     } catch (err) {
         throw new DecryptionError('Private key is not valid for these results, check with your administrator', {
             cause: err,
diff --git a/src/hooks/use-encrypted-files-panel.ts b/src/hooks/use-encrypted-files-panel.ts
index 8fa85c9fb..109c3ab19 100644
--- a/src/hooks/use-encrypted-files-panel.ts
+++ b/src/hooks/use-encrypted-files-panel.ts
@@ -1,22 +1,14 @@
 import { useQuery } from '@/common'
 import { useDecryptFiles, type EncryptedJobFile } from '@/hooks/use-decrypt-files'
-import {
-    ENCRYPTED_TO_APPROVED,
-    encryptedTypeForApproved,
-    isApprovedLogType,
-    isEncryptedLogType,
-    isResultFile,
-    logLabel,
-} from '@/lib/file-type-helpers'
+import { isEncryptedLogType, isResultFile, logLabel } from '@/lib/file-type-helpers'
 import { toSentence } from '@/lib/string'
 import type { JobFile, JobFileInfo } from '@/lib/types'
-import { fetchApprovedJobFilesAction, fetchEncryptedJobFilesAction } from '@/server/actions/study-job.actions'
+import { fetchEncryptedJobFilesAction, fetchSharedFileIdsAction } from '@/server/actions/study-job.actions'
 import type { LatestJobForStudy } from '@/server/db/queries'
 import { notifications } from '@mantine/notifications'
 import * as Sentry from '@sentry/nextjs'
 import { useEffect, useMemo, useState } from 'react'
 import type { FileType } from '@/database/types'
-import type { FileInfo } from 'si-encryption/job-results/types'
 
 type Options = {
     job: LatestJobForStudy
@@ -35,26 +27,34 @@ export type UnifiedFileRow = {
     file: JobFile | null
 }
 
+function isEncryptedFile(fileType: FileType): boolean {
+    return isEncryptedLogType(fileType) || fileType === 'ENCRYPTED-RESULT'
+}
+
+// State precedence: shared (approved) wins as the durable signal; otherwise a freshly
+// decrypted file is selectable; an approved job with no box for this file means it was
+// withheld; everything else is still locked.
+function fileRowState(opts: { shared: boolean; decrypted: boolean; jobApproved: boolean }): FileRowState {
+    if (opts.shared) return 'approved'
+    if (opts.decrypted) return 'decrypted'
+    if (opts.jobApproved) return 'not-shared'
+    return 'locked'
+}
+
 export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
     const [decryptedFiles, setDecryptedFiles] = useState<JobFileInfo[]>([])
     const [selectedPaths, setSelectedPaths] = useState<Set<string>>(new Set())
     const [viewingFile, setViewingFile] = useState<JobFile | null>(null)
 
-    const approvedFileTypes = useMemo(() => new Set((job.files ?? []).map((f) => f.fileType)), [job.files])
-
-    const hasPreviouslyApprovedFiles = (job.files ?? []).some(
-        (f) => isApprovedLogType(f.fileType) || f.fileType === 'APPROVED-RESULT',
-    )
-
     // Once a job is approved, files the DO withheld are surfaced as "not shared" (red X) rather than hidden.
     const isJobApproved = (job.statusChanges ?? []).some((sc) => sc.status === 'FILES-APPROVED')
 
-    // Approved files are now re-encrypted (same shape as encrypted files). We use them
-    // to know *which* files were shared; their plaintext for display comes from decrypting.
-    const { data: previouslyApprovedFiles = [] } = useQuery({
-        queryKey: ['approved-files', job.id],
-        queryFn: () => fetchApprovedJobFilesAction({ studyJobId: job.id }),
-        enabled: hasPreviouslyApprovedFiles,
+    // Which files have been shared with researchers (a lab-org PO box exists). Existence
+    // of a box is the approval/shared signal — there is no plaintext approved copy.
+    const { data: sharedFileIds = [] } = useQuery({
+        queryKey: ['shared-file-ids', job.id],
+        queryFn: () => fetchSharedFileIdsAction({ jobId: job.id }),
+        enabled: isJobApproved,
     })
 
     const { isLoading: isLoadingBlob, data: encryptedFiles } = useQuery({
@@ -96,157 +96,54 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
         })
     }
 
-    const encryptedFileTypes = (job.files ?? [])
-        .filter((f) => isEncryptedLogType(f.fileType) || f.fileType === 'ENCRYPTED-RESULT')
-        .map((f) => f.fileType)
+    const encryptedRows = useMemo(() => (job.files ?? []).filter((f) => isEncryptedFile(f.fileType)), [job.files])
 
-    const hasUndecryptedFiles = encryptedFileTypes.some((ft) => !approvedFileTypes.has(ENCRYPTED_TO_APPROVED[ft]))
-    const shouldShowForm = hasUndecryptedFiles && decryptedFiles.length === 0
+    const shouldShowForm = encryptedRows.length > 0 && decryptedFiles.length === 0
 
-    const undecryptedFileTypes = encryptedFileTypes.filter((ft) => !approvedFileTypes.has(ENCRYPTED_TO_APPROVED[ft]))
     const encryptedFileTypesLabel = toSentence([
-        ...new Set(undecryptedFileTypes.map((ft) => logLabel(ft).toLowerCase())),
+        ...new Set(encryptedRows.map((f) => logLabel(f.fileType).toLowerCase())),
     ])
 
-    const handleSubmit = form.onSubmit(
-        (values) => decrypt(values.privateKey),
-        (errors) => {
-            if (errors.privateKey) {
-                notifications.show({ message: 'Invalid private key', color: 'red' })
-            }
-        },
-    )
-
-    const decryptedFilesByType = useMemo(() => {
-        const map = new Map<FileType, JobFileInfo[]>()
-        for (const f of decryptedFiles) {
-            const list = map.get(f.fileType) ?? []
-            list.push(f)
-            map.set(f.fileType, list)
-        }
+    const decryptedById = useMemo(() => {
+        const map = new Map<string, JobFileInfo>()
+        for (const f of decryptedFiles) map.set(f.sourceId, f)
         return map
     }, [decryptedFiles])
 
-    // Names + sizes of the files that were shared (approved), per approved fileType.
-    const approvedMetaByType = useMemo(() => {
-        const map = new Map<FileType, FileInfo[]>()
-        for (const file of previouslyApprovedFiles) {
-            const list = map.get(file.fileType) ?? []
-            list.push(...file.metadata)
-            map.set(file.fileType, list)
-        }
-        return map
-    }, [previouslyApprovedFiles])
-
-    const metadataByFileType = useMemo(() => {
-        const map = new Map<FileType, FileInfo[]>()
-        for (const file of encryptedFiles ?? []) {
-            map.set(file.fileType, file.metadata)
-        }
-        return map
-    }, [encryptedFiles])
+    const sharedIdSet = useMemo(() => new Set(sharedFileIds), [sharedFileIds])
 
+    // One row per decomposed encrypted file.
     const fileRows: UnifiedFileRow[] = useMemo(() => {
-        const rows: UnifiedFileRow[] = []
-        const seenApprovedTypes = new Set<FileType>()
-
-        for (const f of job.files ?? []) {
-            const isEncrypted = isEncryptedLogType(f.fileType) || f.fileType === 'ENCRYPTED-RESULT'
-            const isApproved = isApprovedLogType(f.fileType) || f.fileType === 'APPROVED-RESULT'
-
-            if (!isEncrypted && !isApproved) continue
-
-            const approvedType = isEncrypted ? ENCRYPTED_TO_APPROVED[f.fileType] : f.fileType
-
-            // skip if both encrypted and approved entries exist — we'll use the approved one
-            if (isEncrypted && approvedFileTypes.has(approvedType)) continue
-
-            // an archive can yield multiple per-file APPROVED-RESULT rows in studyJobFile;
-            // process each fileType once so rows aren't multiplied by N×N
-            if (seenApprovedTypes.has(approvedType)) continue
-            seenApprovedTypes.add(approvedType)
-
-            const encryptedType = isEncrypted ? f.fileType : encryptedTypeForApproved(f.fileType)
-            const approvedMeta = approvedMetaByType.get(approvedType) ?? []
-            const decryptedFilesForType = decryptedFilesByType.get(approvedType) ?? []
-            const metaList = metadataByFileType.get(encryptedType) ?? []
-            const label = logLabel(f.fileType)
-
-            // Approved (shared) files. Their plaintext for view/download comes from the
-            // decrypted originals (matched by name) once the DO has entered their key.
-            if (approvedMeta.length > 0) {
-                const approvedNames = new Set(approvedMeta.map((m) => m.path))
-                for (const meta of approvedMeta) {
-                    const decrypted = decryptedFilesForType.find((d) => d.path === meta.path) ?? null
-                    rows.push({
-                        key: `${f.fileType}-approved-${meta.path}`,
-                        label,
-                        name: meta.path,
-                        bytes: meta.bytes,
-                        fileType: f.fileType,
-                        state: 'approved',
-                        file: decrypted,
-                    })
-                }
-                // Withheld files are surfaced only once metadata is available to enumerate them.
-                for (const meta of metaList) {
-                    if (approvedNames.has(meta.path)) continue
-                    rows.push({
-                        key: `${f.fileType}-not-shared-${meta.path}`,
-                        label,
-                        name: meta.path,
-                        bytes: meta.bytes,
-                        fileType: f.fileType,
-                        state: 'not-shared',
-                        file: null,
-                    })
-                }
-            } else if (decryptedFilesForType.length > 0) {
-                for (const decryptedFile of decryptedFilesForType) {
-                    const meta = metaList.find((m) => m.path === decryptedFile.path)
-                    rows.push({
-                        key: `${f.fileType}-decrypted-${decryptedFile.path}`,
-                        label,
-                        name: decryptedFile.path,
-                        bytes: meta?.bytes ?? decryptedFile.contents.byteLength,
-                        fileType: f.fileType,
-                        state: 'decrypted',
-                        file: decryptedFile,
-                    })
-                }
-            } else if (metaList.length > 0) {
-                // A type with metadata but no approved files. If the job is approved and no APPROVED-*
-                // rows exist for it, the whole type was withheld → red X. Otherwise keep the lock icon.
-                const withheld = isJobApproved && !approvedFileTypes.has(approvedType)
-                for (const meta of metaList) {
-                    rows.push({
-                        key: `${f.fileType}-${withheld ? 'not-shared' : 'locked'}-${meta.path}`,
-                        label,
-                        name: meta.path,
-                        bytes: meta.bytes,
-                        fileType: f.fileType,
-                        state: withheld ? 'not-shared' : 'locked',
-                        file: null,
-                    })
-                }
-            } else {
-                rows.push({
-                    key: `${f.fileType}-${f.name}`,
-                    label,
-                    name: f.name,
-                    bytes: null,
-                    fileType: f.fileType,
-                    state: 'locked',
-                    file: null,
-                })
+        return encryptedRows.map((f) => {
+            const decrypted = decryptedById.get(f.id) ?? null
+            const state = fileRowState({
+                shared: sharedIdSet.has(f.id),
+                decrypted: !!decrypted,
+                jobApproved: isJobApproved,
+            })
+            return {
+                key: `${f.fileType}-${f.id}`,
+                label: logLabel(f.fileType),
+                name: f.name,
+                bytes: f.bytes,
+                fileType: f.fileType,
+                state,
+                file: decrypted,
             }
-        }
-
-        return rows
-    }, [job.files, isJobApproved, approvedFileTypes, approvedMetaByType, decryptedFilesByType, metadataByFileType])
+        })
+    }, [encryptedRows, decryptedById, sharedIdSet, isJobApproved])
 
     const hasFileRows = fileRows.length > 0
 
+    const handleSubmit = form.onSubmit(
+        (values) => decrypt(values.privateKey),
+        (errors) => {
+            if (errors.privateKey) {
+                notifications.show({ message: 'Invalid private key', color: 'red' })
+            }
+        },
+    )
+
     return {
         fileRows,
         hasFileRows,
diff --git a/src/lib/re-encrypt-results.ts b/src/lib/re-encrypt-results.ts
deleted file mode 100644
index d3c4c74dc..000000000
--- a/src/lib/re-encrypt-results.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-import { ResultsWriter } from 'si-encryption/job-results/writer'
-import { actionResult } from '@/lib/utils'
-import { fetchResultsRecipientKeysAction } from '@/server/actions/study-job.actions'
-import type { JobFileInfo, jobFileSchema } from '@/lib/types'
-import type { z } from 'zod'
-
-type ReEncryptedJobFile = z.infer<typeof jobFileSchema>
-
-// Re-encrypt approved (already-decrypted) files for the study's reviewers + researchers,
-// entirely client-side. The DO browser holds the plaintext from review; it wraps each
-// file for every recipient via ResultsWriter so the server only ever stores ciphertext.
-// Returned entries are jobFileSchema-shaped (contents = the re-encrypted zip bytes).
-export async function reEncryptApprovedFiles(studyId: string, files: JobFileInfo[]): Promise<ReEncryptedJobFile[]> {
-    const recipients = actionResult(await fetchResultsRecipientKeysAction({ studyId }))
-
-    return Promise.all(
-        files.map(async (file) => {
-            const writer = new ResultsWriter(recipients)
-            await writer.addFile(file.path, file.contents)
-            const zip = await writer.generate()
-            return {
-                path: file.path,
-                contents: await zip.arrayBuffer(),
-                sourceId: file.sourceId,
-                fileType: file.fileType,
-            }
-        }),
-    )
-}
diff --git a/src/lib/re-wrap-results.ts b/src/lib/re-wrap-results.ts
new file mode 100644
index 000000000..0e188bb52
--- /dev/null
+++ b/src/lib/re-wrap-results.ts
@@ -0,0 +1,33 @@
+import { wrapAesKey } from 'si-encryption/job-results/crypto'
+import { actionResult } from '@/lib/utils'
+import { fetchLabPublicKeysAction } from '@/server/actions/study-job.actions'
+import type { JobFileInfo } from '@/lib/types'
+
+export type SharedFileBox = { fingerprint: string; crypt: string }
+export type SharedFile = { studyJobFileId: string; boxes: SharedFileBox[] }
+
+/**
+ * Re-wrap (not re-encrypt) approved files for the study's lab researchers, client-side.
+ *
+ * The reviewer's browser already holds each file's raw AES key from decrypting to review.
+ * For every researcher public key we wrap that same key into a new "PO box" (`crypt`); the
+ * file ciphertext is never touched. The server only ever receives wrapped keys — never the
+ * raw AES key or plaintext.
+ */
+export async function buildSharedFiles(studyId: string, files: JobFileInfo[]): Promise<SharedFile[]> {
+    const labKeys = actionResult(await fetchLabPublicKeysAction({ studyId }))
+
+    return Promise.all(
+        files.map(async (file) => {
+            if (!file.rawAesKey) throw new Error(`missing raw AES key for file ${file.sourceId}`)
+            const rawAesKey = file.rawAesKey
+            const boxes = await Promise.all(
+                labKeys.map(async (key) => ({
+                    fingerprint: key.fingerprint,
+                    crypt: await wrapAesKey(rawAesKey, key.publicKey),
+                })),
+            )
+            return { studyJobFileId: file.sourceId, boxes }
+        }),
+    )
+}
diff --git a/src/lib/types.ts b/src/lib/types.ts
index fafe0df80..985d0afd0 100644
--- a/src/lib/types.ts
+++ b/src/lib/types.ts
@@ -216,9 +216,22 @@ export const jobFileSchema = z.object({
     fileType: fileTypeSchema,
 })
 
+// A re-wrapped AES key for one researcher recipient of one approved file.
+export const sharedFileBoxSchema = z.object({ fingerprint: z.string(), crypt: z.string() })
+export const sharedFileSchema = z.object({
+    studyJobFileId: z.string(),
+    boxes: z.array(sharedFileBoxSchema),
+})
+export type SharedFile = z.infer<typeof sharedFileSchema>
+
 export type JobFileInfo = FileEntry & {
-    sourceId: string
+    sourceId: string // the study_job_file row id this decrypted file came from
     fileType: FileType
+    // Raw AES key recovered while decrypting, kept in-memory so the reviewer's browser can
+    // re-wrap it for researchers at approve time without decrypting again. SECURITY: this
+    // unlocks the file body for any recipient — it must never be sent to the server or
+    // persisted. Only the client-side approve/re-wrap flow (buildSharedFiles) reads it.
+    rawAesKey?: ArrayBuffer
 }
 
 export type JobFile = {
diff --git a/src/server/actions/results-reencryption.test.ts b/src/server/actions/results-reencryption.test.ts
deleted file mode 100644
index aa966aaf3..000000000
--- a/src/server/actions/results-reencryption.test.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-import { describe, expect, test } from 'vitest'
-import {
-    db,
-    insertTestOrg,
-    insertTestStudyJobData,
-    insertTestUser,
-    mockSessionWithTestData,
-    readTestSupportFile,
-} from '@/tests/unit.helpers'
-import { reEncryptApprovedFiles } from '@/lib/re-encrypt-results'
-import { ResultsReader } from 'si-encryption/job-results/reader'
-import { fingerprintKeyData, generateKeyPair, pemToArrayBuffer } from 'si-encryption/util'
-
-// End-to-end re-encryption at approve: a reviewer's browser re-encrypts an approved
-// file for the enclave (reviewers) AND the submitting lab (researchers); the result
-// must decrypt with the researcher's own — distinct — private key, and still with the
-// reviewer's. Uses real crypto (no storage/reader mocks).
-describe('approve re-encryption round trip', () => {
-    test('re-encrypts an approved file so the researcher can decrypt it with their own key', async () => {
-        // Enclave reviewer seeded with the real test keypair (public_key.pem / private_key.pem).
-        const { org: enclave } = await mockSessionWithTestData({ orgType: 'enclave', useRealKeys: true })
-
-        // Submitting lab + a researcher holding a *different* keypair.
-        const lab = await insertTestOrg({ slug: 'lab-org', type: 'lab' })
-        const { user: researcher } = await insertTestUser({ org: { id: lab.id, slug: lab.slug, type: 'lab' } })
-        const researcherKeys = await generateKeyPair()
-        await db
-            .insertInto('userPublicKey')
-            .values({
-                userId: researcher.id,
-                publicKey: Buffer.from(researcherKeys.exportedPublicKey),
-                fingerprint: researcherKeys.fingerprint,
-            })
-            .executeTakeFirstOrThrow()
-
-        // Study reviewed by the enclave, submitted by the lab. Passing researcherId avoids
-        // seeding an extra (fake-key) enclave user, which would break ResultsWriter.
-        const { study } = await insertTestStudyJobData({ org: enclave, researcherId: researcher.id })
-        await db.updateTable('study').set({ submittedByOrgId: lab.id }).where('id', '=', study.id).execute()
-
-        // Mirror exactly what the approve buttons do client-side.
-        const plaintext = 'col1,col2\nsensitive,value'
-        const [jobFile] = await reEncryptApprovedFiles(study.id, [
-            {
-                path: 'results.csv',
-                contents: new TextEncoder().encode(plaintext).buffer as ArrayBuffer,
-                sourceId: 'source-1',
-                fileType: 'APPROVED-RESULT',
-            },
-        ])
-
-        const decryptWith = async (privateKey: ArrayBuffer, fingerprint: string) => {
-            const reader = new ResultsReader(new Blob([jobFile.contents]), privateKey, fingerprint)
-            const [file] = await reader.extractFiles()
-            return new TextDecoder().decode(new Uint8Array(file.contents))
-        }
-
-        // Researcher decrypts with their own key — the core Card 71 guarantee.
-        expect(await decryptWith(researcherKeys.exportedPrivateKey, researcherKeys.fingerprint)).toBe(plaintext)
-
-        // Reviewer retains access with the enclave (test) key.
-        const reviewerPrivateKey = pemToArrayBuffer(await readTestSupportFile('private_key.pem'))
-        const reviewerFingerprint = await fingerprintKeyData(
-            pemToArrayBuffer(await readTestSupportFile('public_key.pem')),
-        )
-        expect(await decryptWith(reviewerPrivateKey, reviewerFingerprint)).toBe(plaintext)
-    })
-})
diff --git a/src/server/actions/study-job.actions.test.ts b/src/server/actions/study-job.actions.test.ts
index 3a29501b6..4588c3835 100644
--- a/src/server/actions/study-job.actions.test.ts
+++ b/src/server/actions/study-job.actions.test.ts
@@ -2,7 +2,6 @@ import { describe, expect, test, vi } from 'vitest'
 import { db, insertTestStudyJobData, mockSessionWithTestData, actionResult } from '@/tests/unit.helpers'
 import {
     approveStudyJobFilesAction,
-    fetchApprovedJobFilesAction,
     fetchEncryptedJobFilesAction,
     loadStudyJobAction,
     rejectStudyJobFilesAction,
@@ -12,15 +11,6 @@ import { sendStudyResultsRejectedEmail } from '@/server/mailer'
 vi.mock('@/server/storage', () => ({
     fetchCodeManifest: vi.fn(() => ({})),
     fetchFileContents: vi.fn(() => new Blob()),
-    storeApprovedJobFile: vi.fn(),
-}))
-
-vi.mock('si-encryption/job-results/reader', () => ({
-    ResultsReader: class {
-        async listFiles() {
-            return [{ path: 'test.csv', bytes: 0 }]
-        }
-    },
 }))
 
 vi.mock('@/server/mailer', () => ({
@@ -43,41 +33,55 @@ describe('Study Job Actions', () => {
         })
     })
 
-    test('fetchApprovedJobFilesAction', async () => {
-        const { org } = await mockSessionWithTestData()
-        const { job } = await insertTestStudyJobData({
-            org,
-            jobStatus: 'FILES-APPROVED',
-        })
+    test('fetchEncryptedJobFilesAction returns only files the requesting user has a key box for', async () => {
+        // Enclave session users are seeded with fingerprint 'testFingerprint1'.
+        const { org } = await mockSessionWithTestData({ orgType: 'enclave' })
+        const { job } = await insertTestStudyJobData({ org })
 
-        await db
+        const file = await db
             .insertInto('studyJobFile')
-            .values({ path: 'bad/path', name: 'test.csv', studyJobId: job.id, fileType: 'APPROVED-CODE-RUN-LOG' })
+            .values({
+                path: 'results/encrypted/test.csv',
+                name: 'test.csv',
+                studyJobId: job.id,
+                fileType: 'ENCRYPTED-CODE-RUN-LOG',
+                iv: 'aXY=',
+            })
+            .returning('id')
             .executeTakeFirstOrThrow()
 
-        const result = actionResult(await fetchApprovedJobFilesAction({ studyJobId: job.id }))
+        await db
+            .insertInto('studyJobFileKey')
+            .values({ studyJobFileId: file.id, fingerprint: 'testFingerprint1', crypt: 'wrapped-key' })
+            .executeTakeFirstOrThrow()
+
+        const result = actionResult(await fetchEncryptedJobFilesAction({ jobId: job.id }))
 
         expect(result).toHaveLength(1)
-        expect(result[0].fileType).toBe('APPROVED-CODE-RUN-LOG')
-        expect(result[0].metadata).toEqual([{ path: 'test.csv', bytes: 0 }])
+        expect(result[0].fileType).toBe('ENCRYPTED-CODE-RUN-LOG')
+        expect(result[0].crypt).toBe('wrapped-key')
+        expect(result[0].iv).toBe('aXY=')
+        expect(result[0].studyJobFileId).toBe(file.id)
     })
 
-    test('fetchEncryptedJobFilesAction', async () => {
-        const { org } = await mockSessionWithTestData()
+    test('fetchEncryptedJobFilesAction omits files the user has no box for', async () => {
+        const { org } = await mockSessionWithTestData({ orgType: 'enclave' })
         const { job } = await insertTestStudyJobData({ org })
+
         await db
             .insertInto('studyJobFile')
-            .values({ path: 'bad/path', name: 'test.csv', studyJobId: job.id, fileType: 'ENCRYPTED-CODE-RUN-LOG' })
+            .values({
+                path: 'results/encrypted/secret.csv',
+                name: 'secret.csv',
+                studyJobId: job.id,
+                fileType: 'ENCRYPTED-RESULT',
+                iv: 'aXY=',
+            })
             .executeTakeFirstOrThrow()
 
-        const result = actionResult(
-            await fetchEncryptedJobFilesAction({
-                jobId: job.id,
-            }),
-        )
-
-        expect(result).toHaveLength(1)
-        expect(result[0].fileType).toBe('ENCRYPTED-CODE-RUN-LOG')
+        // No study_job_file_key row for this user → nothing they can decrypt.
+        const result = actionResult(await fetchEncryptedJobFilesAction({ jobId: job.id }))
+        expect(result).toHaveLength(0)
     })
 
     describe('rejectStudyJobFilesAction', () => {
@@ -116,7 +120,7 @@ describe('Study Job Actions', () => {
             await approveStudyJobFilesAction({
                 orgSlug: org.slug,
                 jobInfo: { studyId: study.id, studyJobId: job.id, orgSlug: org.slug },
-                jobFiles: [],
+                sharedFiles: [],
             })
 
             const statusChanges = await db
diff --git a/src/server/actions/study-job.actions.ts b/src/server/actions/study-job.actions.ts
index 0ed878394..1c443f11b 100644
--- a/src/server/actions/study-job.actions.ts
+++ b/src/server/actions/study-job.actions.ts
@@ -1,17 +1,19 @@
 'use server'
 
 import { ActionFailure } from '@/lib/errors'
-import { isApprovedLogType, isEncryptedLogType } from '@/lib/file-type-helpers'
-import { jobFileSchema, minimalJobInfoSchema } from '@/lib/types'
+import { isEncryptedLogType } from '@/lib/file-type-helpers'
+import { minimalJobInfoSchema, sharedFileSchema } from '@/lib/types'
 import {
-    getResultsRecipientPublicKeys,
+    getLabPublicKeysForStudy,
+    getReviewerPublicKey,
+    getSharedFileIdsForJob,
     getStudyJobInfo,
     getStudyReviewForJob,
     latestJobForStudy,
 } from '@/server/db/queries'
 import { onStudyResultsApproved, onStudyResultsRejected } from '@/server/events'
-import { fetchFileContents, storeApprovedJobFile } from '@/server/storage'
-import { ResultsReader } from 'si-encryption/job-results/reader'
+import { insertSharedFileBoxes } from '@/server/results-sharing'
+import { fetchFileContents } from '@/server/storage'
 import { Action, z } from './action'
 
 export const approveStudyJobFilesAction = new Action('approveStudyJobFilesAction', { performsMutations: true })
@@ -19,7 +21,7 @@ export const approveStudyJobFilesAction = new Action('approveStudyJobFilesAction
         z.object({
             orgSlug: z.string(),
             jobInfo: minimalJobInfoSchema,
-            jobFiles: z.array(jobFileSchema),
+            sharedFiles: z.array(sharedFileSchema),
         }),
     )
     .middleware(async ({ params: { jobInfo }, db }) => {
@@ -31,20 +33,13 @@ export const approveStudyJobFilesAction = new Action('approveStudyJobFilesAction
         return { orgId: study.orgId }
     })
     .requireAbilityTo('approve', 'Study')
-    .handler(async ({ params: { jobInfo: info, jobFiles }, session, db }) => {
-        // jobFiles.contents are now RE-ENCRYPTED zips (the reviewer's browser re-encrypted
-        // each approved file for reviewers + researchers using ResultsWriter). The server
-        // only persists ciphertext — plaintext never reaches it.
-        //
-        // NOTE (future / Card 74 — revocation): re-encryption cannot cleanly *revoke* a
-        // recipient who later leaves the lab; they were baked into this artifact's boxes and
-        // may already have decrypted. True per-recipient revocation would need the re-wrap /
-        // per-recipient PO-box model (a key box you can delete) instead of re-encryption.
-        // Out of scope for now; revisit if revocation becomes a hard requirement.
-        for (const jobFile of jobFiles) {
-            const file = new File([jobFile.contents], jobFile.path)
-            await storeApprovedJobFile(info, file, jobFile.fileType, jobFile.sourceId)
-        }
+    .handler(async ({ params: { jobInfo: info, sharedFiles }, session, db }) => {
+        // Re-wrap, not re-encrypt: the reviewer's browser unwrapped each file's AES key
+        // while reviewing and wrapped it for the lab researchers' public keys. Here we
+        // only persist those new "PO box" rows — the file ciphertext is never touched and
+        // the server never sees plaintext or the raw AES key. Adding a box = sharing;
+        // deleting one (future / Card 74) = revoking.
+        await insertSharedFileBoxes(db, info.studyJobId, sharedFiles, session.user.id)
 
         await db
             .insertInto('jobStatusChange')
@@ -64,9 +59,8 @@ export const approveStudyJobFilesAction = new Action('approveStudyJobFilesAction
         onStudyResultsApproved({ studyId: info.studyId, userId: session.user.id })
     })
 
-// Recipients for re-encrypting approved results: enclave reviewers (so the DO can
-// still view post-approval) + lab researchers (the new audience).
-export const fetchResultsRecipientKeysAction = new Action('fetchResultsRecipientKeysAction')
+// Lab (researcher) public keys the reviewer's browser re-wraps approved files for.
+export const fetchLabPublicKeysAction = new Action('fetchLabPublicKeysAction')
     .params(z.object({ studyId: z.string() }))
     .middleware(async ({ params: { studyId }, db }) => {
         const study = await db.selectFrom('study').select('orgId').where('id', '=', studyId).executeTakeFirstOrThrow()
@@ -74,7 +68,20 @@ export const fetchResultsRecipientKeysAction = new Action('fetchResultsRecipient
     })
     .requireAbilityTo('approve', 'Study')
     .handler(async ({ params: { studyId } }) => {
-        return await getResultsRecipientPublicKeys(studyId)
+        return await getLabPublicKeysForStudy(studyId)
+    })
+
+// IDs of files already shared with researchers (a lab-org PO box exists). The
+// existence of a box is the "approved & shared" signal — there is no plaintext copy.
+export const fetchSharedFileIdsAction = new Action('fetchSharedFileIdsAction')
+    .params(z.object({ jobId: z.string() }))
+    .middleware(async ({ params: { jobId } }) => {
+        const studyJob = await getStudyJobInfo(jobId)
+        return { studyJob, orgId: studyJob.orgId }
+    })
+    .requireAbilityTo('view', 'StudyJob')
+    .handler(async ({ params: { jobId } }) => {
+        return await getSharedFileIdsForJob(jobId)
     })
 
 export const rejectStudyJobFilesAction = new Action('rejectStudyJobFilesAction', { performsMutations: true })
@@ -141,38 +148,6 @@ export const getStudyReviewAction = new Action('getStudyReviewAction')
         return await getStudyReviewForJob(studyJobId)
     })
 
-export const fetchApprovedJobFilesAction = new Action('fetchApprovedJobFilesAction')
-    .params(z.object({ studyJobId: z.string() }))
-    .middleware(async ({ params: { studyJobId } }) => {
-        const studyJob = await getStudyJobInfo(studyJobId)
-        return { studyJob, orgId: studyJob.orgId, submittedByOrgId: studyJob.submittedByOrgId } // Return the jobInfo along with the orgId for validation in requireAbilityTo below
-    })
-    .requireAbilityTo('view', 'StudyJob')
-
-    .handler(async ({ studyJob }) => {
-        // Approved files are now re-encrypted zips (not plaintext). Return them in the
-        // same shape as encrypted files so the client decrypts them with the viewer's
-        // key (reviewer or researcher — both are recipients).
-        const approvedJobFiles = studyJob.files.filter(
-            (jobFile) => isApprovedLogType(jobFile.fileType) || jobFile.fileType === 'APPROVED-RESULT',
-        )
-
-        const encryptedJobFiles = []
-        for (const jobFile of approvedJobFiles) {
-            const blob = await fetchFileContents(jobFile.path)
-            const reader = new ResultsReader(blob, new ArrayBuffer(0), '')
-            const metadata = await reader.listFiles()
-            encryptedJobFiles.push({
-                fileType: jobFile.fileType,
-                sourceId: jobFile.id,
-                blob,
-                metadata,
-            })
-        }
-
-        return encryptedJobFiles
-    })
-
 export const fetchStudyJobCodeFileAction = new Action('fetchStudyJobCodeFileAction')
     .params(z.object({ studyJobId: z.string(), fileName: z.string() }))
     .middleware(async ({ params: { studyJobId } }) => {
@@ -203,23 +178,47 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
     })
     .requireAbilityTo('view', 'StudyJob')
 
-    .handler(async ({ studyJob }) => {
+    .handler(async ({ studyJob, session, db }) => {
+        // Per decomposed file (Option B): each row is one encrypted body in S3 + an `iv`,
+        // with the requesting user's wrapped AES key ("PO box") in study_job_file_key.
+        // We return only files this user actually has a box for — others stay opaque.
+        const userKey = await getReviewerPublicKey(session.user.id)
+        if (!userKey) return []
+
         const encryptedFiles = studyJob.files.filter(
             (file) => isEncryptedLogType(file.fileType) || file.fileType === 'ENCRYPTED-RESULT',
         )
-
-        const encryptedJobFiles = []
-        for (const encryptedFile of encryptedFiles) {
-            const blob = await fetchFileContents(encryptedFile.path)
-            const reader = new ResultsReader(blob, new ArrayBuffer(0), '')
-            const fileMetadata = await reader.listFiles()
-            encryptedJobFiles.push({
-                fileType: encryptedFile.fileType,
-                sourceId: encryptedFile.id,
-                blob,
-                metadata: fileMetadata,
-            })
-        }
-
-        return encryptedJobFiles
+        if (!encryptedFiles.length) return []
+
+        // One query for all of this user's boxes, then fetch the matching bodies in parallel —
+        // avoids a per-file round trip to both Postgres and S3.
+        const boxes = await db
+            .selectFrom('studyJobFileKey')
+            .select(['studyJobFileId', 'crypt'])
+            .where(
+                'studyJobFileId',
+                'in',
+                encryptedFiles.map((f) => f.id),
+            )
+            .where('fingerprint', '=', userKey.fingerprint)
+            .execute()
+        const cryptByFileId = new Map(boxes.map((b) => [b.studyJobFileId, b.crypt]))
+
+        const ready = encryptedFiles.flatMap((file) => {
+            const crypt = cryptByFileId.get(file.id)
+            // No box for this user, or no iv to decrypt with → stays opaque.
+            return crypt && file.iv ? [{ file, crypt, iv: file.iv }] : []
+        })
+
+        return Promise.all(
+            ready.map(async ({ file, crypt, iv }) => ({
+                studyJobFileId: file.id,
+                fileType: file.fileType,
+                path: file.path,
+                name: file.name,
+                iv,
+                crypt,
+                encryptedBody: await (await fetchFileContents(file.path)).arrayBuffer(),
+            })),
+        )
     })
diff --git a/src/server/actions/study.actions.ts b/src/server/actions/study.actions.ts
index e97f5a6d5..6a17b28cd 100644
--- a/src/server/actions/study.actions.ts
+++ b/src/server/actions/study.actions.ts
@@ -3,7 +3,7 @@
 import { db as database, type DBExecutor, jsonArrayFrom } from '@/database'
 import { sql } from 'kysely'
 import { ActionFailure, isPgUniqueViolation, throwNotFound } from '@/lib/errors'
-import { ActionSuccessType, jobFileSchema } from '@/lib/types'
+import { ActionSuccessType, sharedFileSchema, type SharedFile } from '@/lib/types'
 import type { StudyStatus } from '@/database/types'
 import { countWordsFromLexical, lexicalJson } from '@/lib/lexical'
 import { CODE_REVIEW_FEEDBACK_MAX_WORDS, FEEDBACK_MAX_WORDS, FEEDBACK_MIN_WORDS } from '@/lib/proposal-review'
@@ -31,7 +31,7 @@ import {
     onStudyNeedsClarification,
     onStudyRejected,
 } from '@/server/events'
-import { storeApprovedJobFile } from '@/server/storage'
+import { insertSharedFileBoxes } from '@/server/results-sharing'
 import { triggerBuildImageForJob } from '../aws'
 import { SIMULATE_CODE_BUILD } from '../config'
 import { bareExtension } from '@/lib/paths'
@@ -261,7 +261,7 @@ async function approveJobCode({
     studyId,
     orgSlug,
     useTestImage,
-    jobFiles,
+    sharedFiles,
 }: {
     db: DBExecutor
     job: LatestJobForStudy
@@ -270,7 +270,7 @@ async function approveJobCode({
     studyId: string
     orgSlug: string
     useTestImage?: boolean
-    jobFiles?: z.infer<typeof jobFileSchema>[]
+    sharedFiles?: SharedFile[]
 }) {
     await db
         .insertInto('jobStatusChange')
@@ -312,14 +312,10 @@ async function approveJobCode({
         })
     }
 
-    if (jobFiles?.length) {
-        const info = { studyId, studyJobId: job.id, orgSlug }
-        for (const jobFile of jobFiles) {
-            // jobFile.contents is a RE-ENCRYPTED zip (wrapped client-side for reviewers +
-            // researchers) — we persist ciphertext only, never plaintext.
-            const file = new File([jobFile.contents], jobFile.path)
-            await storeApprovedJobFile(info, file, jobFile.fileType, jobFile.sourceId)
-        }
+    if (sharedFiles?.length) {
+        // Re-wrap: persist only the per-researcher wrapped AES keys ("PO boxes") the
+        // reviewer's browser produced. Ciphertext is untouched; no plaintext is stored.
+        await insertSharedFileBoxes(db, job.id, sharedFiles, userId)
     }
 }
 
@@ -332,7 +328,7 @@ async function performStudyProposalApproval({
     userId,
     orgSlug,
     useTestImage,
-    jobFiles,
+    sharedFiles,
 }: {
     db: DBExecutor
     study: StudyForApproval
@@ -340,7 +336,7 @@ async function performStudyProposalApproval({
     userId: string
     orgSlug: string
     useTestImage?: boolean
-    jobFiles?: z.infer<typeof jobFileSchema>[]
+    sharedFiles?: SharedFile[]
 }) {
     const isFirstApproval = study.status !== 'APPROVED' && !study.approvedAt
     const isCodeReapproval = !isFirstApproval
@@ -377,7 +373,7 @@ async function performStudyProposalApproval({
         if (latestJobStatus !== 'CODE-SCANNED' && latestJobStatus !== 'CODE-SUBMITTED') return
     }
 
-    await approveJobCode({ db, job, study, userId, studyId, orgSlug, useTestImage, jobFiles })
+    await approveJobCode({ db, job, study, userId, studyId, orgSlug, useTestImage, sharedFiles })
 
     // Restore APPROVED status after code re-approval when study went back to PENDING-REVIEW
     if (isCodeReapproval && study.status === 'PENDING-REVIEW') {
@@ -445,7 +441,7 @@ export const approveStudyProposalAction = new Action('approveStudyProposalAction
             studyId: z.string(),
             orgSlug: z.string(),
             useTestImage: z.boolean().optional(),
-            jobFiles: z.array(jobFileSchema).optional(),
+            sharedFiles: z.array(sharedFileSchema).optional(),
         }),
     )
     .middleware(async ({ params: { studyId }, db }) => {
@@ -457,7 +453,7 @@ export const approveStudyProposalAction = new Action('approveStudyProposalAction
         return { study, orgId: study.orgId }
     })
     .requireAbilityTo('approve', 'Study')
-    .handler(async ({ params: { studyId, orgSlug, useTestImage, jobFiles }, study, session, db }) => {
+    .handler(async ({ params: { studyId, orgSlug, useTestImage, sharedFiles }, study, session, db }) => {
         await performStudyProposalApproval({
             db,
             study,
@@ -465,7 +461,7 @@ export const approveStudyProposalAction = new Action('approveStudyProposalAction
             userId: session.user.id,
             orgSlug,
             useTestImage,
-            jobFiles,
+            sharedFiles,
         })
     })
 
diff --git a/src/server/db/queries.ts b/src/server/db/queries.ts
index c6db58a40..0cb975da0 100644
--- a/src/server/db/queries.ts
+++ b/src/server/db/queries.ts
@@ -55,7 +55,7 @@ export async function getStudyJobInfo(studyJobId: string) {
             jsonArrayFrom(
                 eb
                     .selectFrom('studyJobFile')
-                    .select(['id', 'name', 'path', 'fileType'])
+                    .select(['id', 'name', 'path', 'fileType', 'iv', 'bytes'])
                     .whereRef('studyJobFile.studyJobId', '=', 'studyJob.id'),
             ).as('files'),
         ])
@@ -103,7 +103,7 @@ function latestJobForStudyQuery(studyId: string) {
             jsonArrayFrom(
                 eb
                     .selectFrom('studyJobFile')
-                    .select(['name', 'fileType', 'createdAt'])
+                    .select(['id', 'name', 'path', 'fileType', 'iv', 'bytes', 'createdAt'])
                     .whereRef('studyJobFile.studyJobId', '=', 'studyJob.id'),
             ).as('files'),
         ])
@@ -455,30 +455,48 @@ export async function getOrgPublicKeys(orgId: string): Promise<PublicKey[]> {
     })
 }
 
+const labOrgIdForJob = async (jobId: string) =>
+    await Action.db
+        .selectFrom('studyJob')
+        .innerJoin('study', 'study.id', 'studyJob.studyId')
+        .select('study.submittedByOrgId')
+        .where('studyJob.id', '=', jobId)
+        .executeTakeFirstOrThrow(throwNotFound(`job ${jobId}`))
+
 /**
- * Recipients for re-encrypting a study's approved results: the enclave org that
- * runs/reviews it (`study.orgId`, so reviewers keep access) plus the lab org that
- * submitted it (`study.submittedByOrgId`, the researchers). Deduped by fingerprint
- * since one person may belong to both orgs with a single key. si-encryption
- * (ArrayBuffer) format; empty if the study/users have no keys.
+ * Public keys of the lab org that submitted the study (`study.submittedByOrgId`) —
+ * the researchers. These are the recipients a reviewer re-wraps approved files for.
  */
-export async function getResultsRecipientPublicKeys(studyId: string): Promise<PublicKey[]> {
-    const study = await Action.db
+export async function getLabPublicKeysForJob(jobId: string): Promise<PublicKey[]> {
+    const { submittedByOrgId } = await labOrgIdForJob(jobId)
+    return getOrgPublicKeys(submittedByOrgId)
+}
+
+// Same lab (researcher) recipient keys, resolved from the study directly — used by the
+// client approve flow, which knows the study but not necessarily the job id.
+export async function getLabPublicKeysForStudy(studyId: string): Promise<PublicKey[]> {
+    const { submittedByOrgId } = await Action.db
         .selectFrom('study')
+        .select('submittedByOrgId')
         .where('id', '=', studyId)
-        .select(['orgId', 'submittedByOrgId'])
-        .executeTakeFirst()
-
-    if (!study) return []
+        .executeTakeFirstOrThrow(throwNotFound(`study ${studyId}`))
+    return getOrgPublicKeys(submittedByOrgId)
+}
 
-    const [reviewerKeys, researcherKeys] = await Promise.all([
-        getOrgPublicKeys(study.orgId),
-        getOrgPublicKeys(study.submittedByOrgId),
-    ])
+/**
+ * IDs of this job's files a reviewer approved & shared with researchers. Driven by the
+ * recorded `approved_at` fact, not by current org membership — removing a researcher from
+ * the lab must not retroactively un-approve files (see `insertSharedFileBoxes`).
+ */
+export async function getSharedFileIdsForJob(jobId: string): Promise<string[]> {
+    const rows = await Action.db
+        .selectFrom('studyJobFile')
+        .select('id')
+        .where('studyJobId', '=', jobId)
+        .where('approvedAt', 'is not', null)
+        .execute()
 
-    const byFingerprint = new Map<string, PublicKey>()
-    for (const key of [...reviewerKeys, ...researcherKeys]) byFingerprint.set(key.fingerprint, key)
-    return [...byFingerprint.values()]
+    return rows.map((r) => r.id)
 }
 
 export type StudyReviewWithMeta = {
diff --git a/src/server/results-sharing.ts b/src/server/results-sharing.ts
new file mode 100644
index 000000000..79c10e2a9
--- /dev/null
+++ b/src/server/results-sharing.ts
@@ -0,0 +1,53 @@
+import type { DBExecutor } from '@/database'
+import { ActionFailure } from '@/lib/errors'
+import type { SharedFile } from '@/lib/types'
+import { getLabPublicKeysForJob } from '@/server/db/queries'
+
+/**
+ * Persist re-wrapped AES keys ("PO boxes") that grant lab researchers access to approved
+ * files, and record the approval itself on each file. Each box is validated against the
+ * lab org's known public keys so a client can never share a file with an arbitrary
+ * fingerprint. Idempotent via the (study_job_file_id, fingerprint) unique constraint. The
+ * file ciphertext is untouched.
+ *
+ * Approval is recorded as `approved_at`/`approved_by_user_id` on the file row — the durable
+ * historical fact — rather than being inferred from box existence. The boxes are the access
+ * mechanism; revoking later (Card 74) by deleting a box is *prospective only*: a researcher
+ * who already unwrapped the AES key keeps it, so deleting a box stops future reads, not past
+ * ones.
+ */
+export async function insertSharedFileBoxes(
+    db: DBExecutor,
+    jobId: string,
+    sharedFiles: SharedFile[],
+    approvedByUserId: string,
+): Promise<void> {
+    const labKeys = await getLabPublicKeysForJob(jobId)
+    const labFingerprints = new Set(labKeys.map((k) => k.fingerprint))
+
+    const rows = sharedFiles.flatMap((file) =>
+        file.boxes.map((box) => {
+            if (!labFingerprints.has(box.fingerprint)) {
+                throw new ActionFailure({ file: `fingerprint ${box.fingerprint} is not a lab recipient` })
+            }
+            return { studyJobFileId: file.studyJobFileId, fingerprint: box.fingerprint, crypt: box.crypt }
+        }),
+    )
+
+    const approvedFileIds = sharedFiles.map((f) => f.studyJobFileId)
+    if (!approvedFileIds.length) return
+
+    if (rows.length) {
+        await db
+            .insertInto('studyJobFileKey')
+            .values(rows)
+            .onConflict((oc) => oc.columns(['studyJobFileId', 'fingerprint']).doNothing())
+            .execute()
+    }
+
+    await db
+        .updateTable('studyJobFile')
+        .set({ approvedAt: new Date(), approvedByUserId })
+        .where('id', 'in', approvedFileIds)
+        .execute()
+}
diff --git a/src/server/storage.ts b/src/server/storage.ts
index 6110d1437..374331446 100644
--- a/src/server/storage.ts
+++ b/src/server/storage.ts
@@ -1,8 +1,9 @@
-import { fetchS3File, signedUrlForFile, storeS3File } from './aws'
+import { deleteS3File, fetchS3File, signedUrlForFile, storeS3File } from './aws'
 import { MinimalJobInfo, MinimalStudyInfo, StudyDocumentType } from '@/lib/types'
 import { pathForStudyDocumentFile, pathForStudyJob, pathForStudyJobCodeFile } from '@/lib/paths'
 import { db } from '@/database'
 import { FileType } from '@/database/types'
+import { decomposeResultsZip } from 'si-encryption/job-results/decompose'
 
 export async function fetchFileContents(filePath: string) {
     const stream = await fetchS3File(filePath)
@@ -34,9 +35,61 @@ async function storeJobFile(info: MinimalJobInfo, path: string, file: File, file
         .executeTakeFirstOrThrow()
 }
 
+/**
+ * Decompose a ResultsWriter zip on ingest (Option B): each encrypted file body
+ * becomes its own S3 object, and its metadata (iv, bytes) + per-recipient wrapped
+ * keys (the DO/reviewer "PO boxes" from the manifest) are stored in Postgres.
+ *
+ * Touches no plaintext and needs no private key — the manifest is plaintext
+ * metadata and the bodies stay ciphertext. One row per decomposed file; sharing
+ * a file later = adding a `study_job_file_key` box, never re-encrypting.
+ */
+async function storeDecomposedEncryptedFiles(info: MinimalJobInfo, file: File, fileType: FileType, subdir: string) {
+    const decomposed = await decomposeResultsZip(file)
+    const items = decomposed.map((entry) => ({
+        entry,
+        path: `${pathForStudyJob(info)}/results/${subdir}/${entry.path}`,
+    }))
+
+    // Write the bodies to S3 first, in parallel. S3 is not part of the DB transaction
+    // below, so if the transaction fails we best-effort delete what we wrote — otherwise a
+    // rollback would leave orphaned objects with no row pointing at them.
+    await Promise.all(items.map(({ entry, path }) => storeS3File(info, new Blob([entry.body]).stream(), path)))
+
+    try {
+        return await db.transaction().execute(async (trx) => {
+            const rows = []
+            const boxes = []
+            for (const { entry, path } of items) {
+                const row = await trx
+                    .insertInto('studyJobFile')
+                    .values({
+                        path,
+                        name: entry.path,
+                        studyJobId: info.studyJobId,
+                        fileType,
+                        iv: entry.iv,
+                        bytes: entry.bytes,
+                    })
+                    .returning('id')
+                    .executeTakeFirstOrThrow()
+
+                for (const [fingerprint, { crypt }] of Object.entries(entry.keys)) {
+                    boxes.push({ studyJobFileId: row.id, fingerprint, crypt })
+                }
+                rows.push(row)
+            }
+            if (boxes.length) await trx.insertInto('studyJobFileKey').values(boxes).execute()
+            return rows
+        })
+    } catch (err) {
+        await Promise.allSettled(items.map(({ path }) => deleteS3File(path)))
+        throw err
+    }
+}
+
 export async function storeStudyEncryptedLogFile(info: MinimalJobInfo, file: File, fileType: FileType) {
-    const filename = fileType.toLowerCase()
-    return await storeJobFile(info, `${pathForStudyJob(info)}/results/${filename}.zip`, file, fileType)
+    return await storeDecomposedEncryptedFiles(info, file, fileType, 'encrypted-logs')
 }
 
 export async function storeStudyLogFile(info: MinimalJobInfo, file: File, fileType: FileType) {
@@ -45,11 +98,5 @@ export async function storeStudyLogFile(info: MinimalJobInfo, file: File, fileTy
 }
 
 export async function storeStudyEncryptedResultsFile(info: MinimalJobInfo, file: File) {
-    return await storeJobFile(info, `${pathForStudyJob(info)}/results/encrypted-results.zip`, file, 'ENCRYPTED-RESULT')
-}
-
-// Stores an approved results file. Its contents are now a re-encrypted zip (wrapped
-// for reviewers + researchers client-side) — ciphertext, never plaintext.
-export async function storeApprovedJobFile(info: MinimalJobInfo, file: File, fileType: FileType, sourceId: string) {
-    return await storeJobFile(info, `${pathForStudyJob(info)}/results/approved/${file.name}`, file, fileType, sourceId)
+    return await storeDecomposedEncryptedFiles(info, file, 'ENCRYPTED-RESULT', 'encrypted')
 }

From 918bfb6e836e110d94d6024a15f4c694381f0d98 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Mon, 8 Jun 2026 10:43:21 -0400
Subject: [PATCH 10/45] Lint

---
 results-encryption-design-notes.md                            | 4 +++-
 .../[orgSlug]/study/[studyId]/review/study-review-buttons.tsx | 4 +---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/results-encryption-design-notes.md b/results-encryption-design-notes.md
index a149d5ff1..22aa0e022 100644
--- a/results-encryption-design-notes.md
+++ b/results-encryption-design-notes.md
@@ -10,10 +10,11 @@
 > ## ✅ FINAL DIRECTION: RE-WRAP (§4 is the plan). §11 re-encrypt = ABANDONED.
 >
 > **Decision log (this session, newest last):**
+>
 > 1. Original detailed plan (§4) = **re-wrap + decompose-on-ingest** (PO boxes in Postgres).
 > 2. Built re-wrap fully → unit tests green → **then reverted** (worried about lib change + scope).
 > 3. Pivoted to **re-encrypt at approve** (§11), built it, tests green, **not committed**.
-> 4. **Pivoted BACK to re-wrap (FINAL).** Reasons: (a) Phil (EM) verbally wants re-wrap; (b) re-wrap is the more correct long-term architecture — immutable ciphertext, add-a-box to share, **delete-a-box to revoke**; (c) it sets up Cards 73/74 (regen/recovery) cleanly; (d) the doc's "re-encrypt" wording was loose — the *detailed* plan was always re-wrap.
+> 4. **Pivoted BACK to re-wrap (FINAL).** Reasons: (a) Phil (EM) verbally wants re-wrap; (b) re-wrap is the more correct long-term architecture — immutable ciphertext, add-a-box to share, **delete-a-box to revoke**; (c) it sets up Cards 73/74 (regen/recovery) cleanly; (d) the doc's "re-encrypt" wording was loose — the _detailed_ plan was always re-wrap.
 >
 > **⚠️ MUST CONFIRM WITH PHIL BEFORE/AT START:** re-wrap **requires a small `si-encryption` library change** (expose the raw AES key + a zip-free decrypt primitive). This directly conflicts with Phil's "no lib change needed" comment — those two cannot both hold. The change is **small + additive** (~2 new functions, already prototyped this session). Get his explicit OK on the lib change, since it's the thing he thought we'd avoid.
 >
@@ -298,6 +299,7 @@ docker exec mgmnt-app pnpm exec vitest run <test-file>
 **As of handoff:** branch `researcher-encrypted-results`. A **merge of `main` is IN PROGRESS** (`.git/MERGE_HEAD` present); the one conflict — `src/hooks/use-workspace-launcher.tsx` — was **resolved (took main's refactor) and staged**. The **re-encrypt implementation is in the working tree, uncommitted** (it was never committed — that commit was interrupted). The earlier re-wrap build is **not** present (reverted).
 
 **Recommended clean start (re-wrap):**
+
 1. This doc's edits are uncommitted — the durable copy of the plan is the handoff in `/tmp` (and the design doc on disk). Don't lose them to a reset.
 2. Discard the abandoned re-encrypt working tree + finish the main merge cleanly. Either complete the in-progress merge then `git reset --hard` away the re-encrypt files, or `git merge --abort` and re-`git merge main` (resolve `use-workspace-launcher.tsx` = **take main's version**, drop the HEAD block).
 3. Build re-wrap fresh per §5 steps 0→5. Step 0b (the `si-encryption` lib change) needs **Phil's OK** first.
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
index 2ec8307a9..84f18e1af 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
@@ -37,9 +37,7 @@ export const StudyReviewButtons: FC<{ study: SelectedStudy; approvedFiles?: JobF
             if (status === 'APPROVED') {
                 // Re-wrap approved result files for the lab researchers client-side; the
                 // server receives only wrapped keys (PO boxes), never plaintext.
-                const sharedFiles = approvedFiles?.length
-                    ? await buildSharedFiles(study.id, approvedFiles)
-                    : undefined
+                const sharedFiles = approvedFiles?.length ? await buildSharedFiles(study.id, approvedFiles) : undefined
                 return approveStudyProposalAction({
                     orgSlug,
                     studyId: study.id,

From 38b7fa2ccd6b63d3b3b9876812296a12062e22ed Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Mon, 8 Jun 2026 11:50:54 -0400
Subject: [PATCH 11/45] Temp testing results file

---
 bin/inject-encrypted-results.ts | 96 +++++++++++++++++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100644 bin/inject-encrypted-results.ts

diff --git a/bin/inject-encrypted-results.ts b/bin/inject-encrypted-results.ts
new file mode 100644
index 000000000..2646ecec9
--- /dev/null
+++ b/bin/inject-encrypted-results.ts
@@ -0,0 +1,96 @@
+/* eslint-disable no-console */
+/**
+ * DEV-ONLY: inject encrypted results into a job, mimicking what the Trusted Output App
+ * POSTs to /api/job/[jobId]/results — without the org-API auth dance. Lets you exercise
+ * the reviewer-decrypt → approve(re-wrap) → researcher-decrypt flow locally.
+ *
+ * Prereq: the job's reviewer(s) (enclave org users) must already have a key — generate it
+ * in the UI at /account/keys first, so getOrgPublicKeys returns a recipient to encrypt for.
+ *
+ * Run inside the container:
+ *   docker exec mgmnt-app pnpm exec tsx bin/inject-encrypted-results.ts <jobId>
+ */
+import { db } from '@/database'
+import { storeStudyEncryptedLogFile, storeStudyEncryptedResultsFile } from '@/server/storage'
+import { ResultsWriter } from 'si-encryption/job-results/writer'
+
+// Inline (not @/server/db/queries) — that module pulls in the Action framework → Clerk,
+// which tsx can't import standalone. Mirrors getOrgPublicKeys.
+async function orgPublicKeys(orgId: string): Promise<{ publicKey: ArrayBuffer; fingerprint: string }[]> {
+    const rows = await db
+        .selectFrom('orgUser')
+        .innerJoin('userPublicKey', 'userPublicKey.userId', 'orgUser.userId')
+        .select(['userPublicKey.publicKey', 'userPublicKey.fingerprint'])
+        .where('orgUser.orgId', '=', orgId)
+        .execute()
+    return rows.map(({ publicKey, fingerprint }) => {
+        const ab = new ArrayBuffer(publicKey.byteLength)
+        new Uint8Array(ab).set(publicKey)
+        return { publicKey: ab, fingerprint }
+    })
+}
+
+const toArrayBuffer = (s: string): ArrayBuffer => {
+    const buf = Buffer.from(s, 'utf-8')
+    return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength)
+}
+
+async function buildZip(files: Array<{ name: string; content: string }>, keys: { publicKey: ArrayBuffer; fingerprint: string }[]): Promise<File> {
+    const writer = new ResultsWriter(keys)
+    for (const f of files) await writer.addFile(f.name, toArrayBuffer(f.content))
+    const zip = await writer.generate()
+    return new File([zip], 'encrypted.zip', { type: 'application/zip' })
+}
+
+async function main() {
+    const jobId = process.argv[2]
+    if (!jobId) throw new Error('usage: tsx bin/inject-encrypted-results.ts <jobId>')
+
+    const info = await db
+        .selectFrom('studyJob')
+        .innerJoin('study', 'study.id', 'studyJob.studyId')
+        .innerJoin('org', 'org.id', 'study.orgId')
+        .select(['studyJob.id as studyJobId', 'study.id as studyId', 'study.orgId as orgId', 'org.slug as orgSlug'])
+        .where('studyJob.id', '=', jobId)
+        .executeTakeFirstOrThrow(() => new Error(`job ${jobId} not found`))
+
+    // Encrypt for the enclave org's reviewer keys — exactly what TOA does. The reviewer
+    // decrypts with their private key, then re-wraps for researchers at approve.
+    const reviewerKeys = await orgPublicKeys(info.orgId)
+    if (!reviewerKeys.length) {
+        throw new Error(
+            `org ${info.orgSlug} has no public keys — log in as the reviewer and generate one at /account/keys first`,
+        )
+    }
+    console.info(`Encrypting for ${reviewerKeys.length} reviewer key(s) in org ${info.orgSlug}`)
+
+    const resultsZip = await buildZip(
+        [
+            { name: 'results.csv', content: 'group,count\nA,42\nB,17\n' },
+            { name: 'summary.txt', content: 'analysis complete: 2 groups\n' },
+        ],
+        reviewerKeys,
+    )
+    const logZip = await buildZip([{ name: 'run.log', content: 'job started\njob finished ok\n' }], reviewerKeys)
+
+    await storeStudyEncryptedResultsFile(info, resultsZip)
+    await storeStudyEncryptedLogFile(info, logZip, 'ENCRYPTED-CODE-RUN-LOG')
+
+    const already = await db
+        .selectFrom('jobStatusChange')
+        .where('studyJobId', '=', jobId)
+        .where('status', '=', 'RUN-COMPLETE')
+        .executeTakeFirst()
+    if (!already) {
+        await db.insertInto('jobStatusChange').values({ status: 'RUN-COMPLETE', studyJobId: jobId }).execute()
+    }
+
+    console.info(`✓ injected encrypted results + logs for job ${jobId} (status RUN-COMPLETE)`)
+    console.info(`  Now: review the study as the reviewer, decrypt with the reviewer PEM, approve.`)
+    await db.destroy()
+}
+
+main().catch((err) => {
+    console.error(err)
+    process.exit(1)
+})

From 5f7c5be47a4ccd9b019ec07eee1b2cc671a68378 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Mon, 8 Jun 2026 12:03:41 -0400
Subject: [PATCH 12/45] Lint

---
 bin/inject-encrypted-results.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bin/inject-encrypted-results.ts b/bin/inject-encrypted-results.ts
index 2646ecec9..c75153986 100644
--- a/bin/inject-encrypted-results.ts
+++ b/bin/inject-encrypted-results.ts
@@ -35,7 +35,10 @@ const toArrayBuffer = (s: string): ArrayBuffer => {
     return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength)
 }
 
-async function buildZip(files: Array<{ name: string; content: string }>, keys: { publicKey: ArrayBuffer; fingerprint: string }[]): Promise<File> {
+async function buildZip(
+    files: Array<{ name: string; content: string }>,
+    keys: { publicKey: ArrayBuffer; fingerprint: string }[],
+): Promise<File> {
     const writer = new ResultsWriter(keys)
     for (const f of files) await writer.addFile(f.name, toArrayBuffer(f.content))
     const zip = await writer.generate()

From c0a8969ee773f0418596a6cb0cd6a384dfb57c8d Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Mon, 8 Jun 2026 13:57:59 -0400
Subject: [PATCH 13/45] Fix up UI, full e2e testing flow

---
 bin/inject-encrypted-results.ts               |  64 ++++++++---
 .../view/job-results-status-message.tsx       | 104 ++++++++++--------
 .../view/study-details-researcher.tsx         |  14 +--
 src/components/job-results.tsx                |   1 +
 src/server/actions/study-job.actions.ts       |   5 +-
 5 files changed, 116 insertions(+), 72 deletions(-)

diff --git a/bin/inject-encrypted-results.ts b/bin/inject-encrypted-results.ts
index c75153986..bb960795a 100644
--- a/bin/inject-encrypted-results.ts
+++ b/bin/inject-encrypted-results.ts
@@ -67,29 +67,61 @@ async function main() {
     }
     console.info(`Encrypting for ${reviewerKeys.length} reviewer key(s) in org ${info.orgSlug}`)
 
-    const resultsZip = await buildZip(
-        [
-            { name: 'results.csv', content: 'group,count\nA,42\nB,17\n' },
-            { name: 'summary.txt', content: 'analysis complete: 2 groups\n' },
-        ],
-        reviewerKeys,
-    )
-    const logZip = await buildZip([{ name: 'run.log', content: 'job started\njob finished ok\n' }], reviewerKeys)
+    // Idempotent: don't stack duplicate result rows if re-run against the same job.
+    const alreadyHasResults = await db
+        .selectFrom('studyJobFile')
+        .select('id')
+        .where('studyJobId', '=', jobId)
+        .where('fileType', '=', 'ENCRYPTED-RESULT')
+        .executeTakeFirst()
 
-    await storeStudyEncryptedResultsFile(info, resultsZip)
-    await storeStudyEncryptedLogFile(info, logZip, 'ENCRYPTED-CODE-RUN-LOG')
+    if (alreadyHasResults) {
+        console.info(`Job already has encrypted results — skipping store (delete study_job_file rows to re-inject).`)
+    } else {
+        const resultsZip = await buildZip(
+            [
+                { name: 'results.csv', content: 'group,count\nA,42\nB,17\n' },
+                { name: 'summary.txt', content: 'analysis complete: 2 groups\n' },
+            ],
+            reviewerKeys,
+        )
+        const logZip = await buildZip([{ name: 'run.log', content: 'job started\njob finished ok\n' }], reviewerKeys)
+        await storeStudyEncryptedResultsFile(info, resultsZip)
+        await storeStudyEncryptedLogFile(info, logZip, 'ENCRYPTED-CODE-RUN-LOG')
+    }
 
-    const already = await db
+    // Make the status chain realistic. A results-stage job must have had its code
+    // approved first — otherwise the proposal-level review buttons stay visible (they
+    // only hide once the study is APPROVED *and* the code was reviewed). Inject
+    // CODE-APPROVED before RUN-COMPLETE so the latest status stays RUN-COMPLETE and the
+    // page shows only the results Approve/Reject.
+    const statuses = await db
         .selectFrom('jobStatusChange')
+        .select(['status', 'createdAt'])
         .where('studyJobId', '=', jobId)
-        .where('status', '=', 'RUN-COMPLETE')
-        .executeTakeFirst()
-    if (!already) {
+        .execute()
+    const has = (s: string) => statuses.some((r) => r.status === s)
+    const runComplete = statuses.find((r) => r.status === 'RUN-COMPLETE')
+
+    if (!has('CODE-APPROVED')) {
+        // 1s before an existing RUN-COMPLETE, or 2s in the past on a fresh job so it
+        // reliably precedes the RUN-COMPLETE inserted just below.
+        const ts = runComplete
+            ? new Date(new Date(runComplete.createdAt).getTime() - 1000)
+            : new Date(Date.now() - 2000)
+        await db
+            .insertInto('jobStatusChange')
+            .values({ status: 'CODE-APPROVED', studyJobId: jobId, createdAt: ts })
+            .execute()
+    }
+    if (!runComplete) {
         await db.insertInto('jobStatusChange').values({ status: 'RUN-COMPLETE', studyJobId: jobId }).execute()
     }
+    // Code approved ⇒ proposal-level review is done; study is back to APPROVED.
+    await db.updateTable('study').set({ status: 'APPROVED' }).where('id', '=', info.studyId).execute()
 
-    console.info(`✓ injected encrypted results + logs for job ${jobId} (status RUN-COMPLETE)`)
-    console.info(`  Now: review the study as the reviewer, decrypt with the reviewer PEM, approve.`)
+    console.info(`✓ injected encrypted results + logs for job ${jobId} (CODE-APPROVED → RUN-COMPLETE, study APPROVED)`)
+    console.info(`  Now: review as the reviewer, decrypt with the reviewer PEM, Approve in the Study Status card.`)
     await db.destroy()
 }
 
diff --git a/src/app/[orgSlug]/study/[studyId]/view/job-results-status-message.tsx b/src/app/[orgSlug]/study/[studyId]/view/job-results-status-message.tsx
index a361b3fd2..5bee1cd6f 100644
--- a/src/app/[orgSlug]/study/[studyId]/view/job-results-status-message.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/view/job-results-status-message.tsx
@@ -4,7 +4,7 @@ import { CopyingInput } from '@/components/copying-input'
 import { useJobStatus } from '@/hooks/use-job-results-status'
 import { isLogType } from '@/lib/file-type-helpers'
 import { LatestJobForStudy } from '@/server/db/queries'
-import { Group, Stack, Text } from '@mantine/core'
+import { Divider, Group, Paper, Stack, Text, Title } from '@mantine/core'
 import { FC, ReactNode } from 'react'
 import { ResubmitButton } from '@/components/study/resubmit-button'
 import { JobResults } from '@/components/job-results'
@@ -16,57 +16,75 @@ export type JobResultsStatusMessageProps = {
     submittingOrgSlug: string
 }
 
+const Panel: FC<{ title: string; children: ReactNode }> = ({ title, children }) => (
+    <Paper bg="white" p="xxl">
+        <Stack>
+            <Group justify="space-between" align="center">
+                <Title order={4} size="xl">
+                    {title}
+                </Title>
+            </Group>
+            <Divider c="dimmed" />
+            {children}
+        </Stack>
+    </Paper>
+)
+
 export const JobResultsStatusMessage: FC<JobResultsStatusMessageProps> = ({ job, files, submittingOrgSlug }) => {
     const { isApproved, isRejected, isFilesRejected, isErrored } = useJobStatus(job.statusChanges)
 
+    if (!isApproved && !isRejected) {
+        return (
+            <Panel title="Study Status">
+                <Text>Study results will become available once the data organization reviews and approves them.</Text>
+            </Panel>
+        )
+    }
+
     let message: string
     let additionalContent: ReactNode = null
-    let hideResults = false
-
-    if (isApproved) {
-        if (isErrored) {
-            const hasLogs = files.some((file) => isLogType(file.fileType))
 
-            if (hasLogs) {
-                message = 'The code errored. Review error logs and consider re-submitting an updated study code.'
-            } else {
-                message =
-                    'The code errored. While logs are not available at this time, consider re-submitting an updated study code.'
-            }
-
-            additionalContent = (
-                <Group justify="flex-start" align="center">
-                    <Text size="sm" fw={600}>
-                        Job ID:
-                    </Text>
-                    <CopyingInput value={job.id} tooltipLabel="Copy" />
-                </Group>
-            )
-        } else {
-            message =
-                'The results of your study have been approved by the data organization and are now available to you. If you are not satisfied with them, you can resubmit your code to generate a new outcome.'
-        }
-    } else if (isRejected) {
-        if (isFilesRejected) {
-            message =
-                'The results of your study have not been released by the data organization, possibly due to the presence of personally identifiable information (PII). Consider resubmitting an updated study code.'
-        } else {
-            message =
-                'This study code has not been approved by the data organization. Consider resubmitting an updated study code.'
-        }
-        hideResults = true
+    if (isApproved && isErrored) {
+        const hasLogs = files.some((file) => isLogType(file.fileType))
+        message = hasLogs
+            ? 'The code errored. Review error logs and consider re-submitting an updated study code.'
+            : 'The code errored. While logs are not available at this time, consider re-submitting an updated study code.'
+        additionalContent = (
+            <Group justify="flex-start" align="center">
+                <Text size="sm" fw={600}>
+                    Job ID:
+                </Text>
+                <CopyingInput value={job.id} tooltipLabel="Copy" />
+            </Group>
+        )
+    } else if (isApproved) {
+        message =
+            'The results of your study have been approved by the data organization and are now available to you. If you are not satisfied with them, you can resubmit your code to generate a new outcome.'
+    } else if (isFilesRejected) {
+        message =
+            'The results of your study have not been released by the data organization, possibly due to the presence of personally identifiable information (PII). Consider resubmitting an updated study code.'
     } else {
-        return <Text>Study results will become available once the data organization reviews and approves them.</Text>
+        message =
+            'This study code has not been approved by the data organization. Consider resubmitting an updated study code.'
     }
 
     return (
-        <Stack>
-            <Text>{message}</Text>
-            {additionalContent}
-            {!hideResults && <JobResults job={job} />}
-            <Group>
-                <ResubmitButton studyId={job.studyId} orgSlug={submittingOrgSlug} />
-            </Group>
-        </Stack>
+        <>
+            <Panel title="Study Status">
+                <Text>{message}</Text>
+                {additionalContent}
+                {/* TODO(UX): the Resubmit button shows for approved results too. Confirm with UX
+                    whether a researcher should be able to resubmit code after results are approved,
+                    or only on error/rejection — then gate this accordingly. */}
+                <Group>
+                    <ResubmitButton studyId={job.studyId} orgSlug={submittingOrgSlug} />
+                </Group>
+            </Panel>
+            {isApproved && (
+                <Panel title="Results">
+                    <JobResults job={job} />
+                </Panel>
+            )}
+        </>
     )
 }
diff --git a/src/app/[orgSlug]/study/[studyId]/view/study-details-researcher.tsx b/src/app/[orgSlug]/study/[studyId]/view/study-details-researcher.tsx
index 1daa68d9a..2f6d8650c 100644
--- a/src/app/[orgSlug]/study/[studyId]/view/study-details-researcher.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/view/study-details-researcher.tsx
@@ -1,7 +1,7 @@
 import { ResearcherBreadcrumbs } from '@/components/page-breadcrumbs'
 import { ButtonLink } from '@/components/links'
 import { Routes } from '@/lib/routes'
-import { Divider, Group, Paper, Stack, Title } from '@mantine/core'
+import { Divider, Group, Stack, Title } from '@mantine/core'
 import { CaretLeftIcon } from '@phosphor-icons/react/dist/ssr'
 import type { Route } from 'next'
 import { JobResultsStatusMessage } from './job-results-status-message'
@@ -39,17 +39,7 @@ export function StudyDetailsResearcher({ orgSlug, study, job, dashboardHref, ret
                 Study Details
             </Title>
             <Divider />
-            <Paper bg="white" p="xxl">
-                <Stack>
-                    <Group justify="space-between" align="center">
-                        <Title order={4} size="xl">
-                            Study Status
-                        </Title>
-                    </Group>
-                    <Divider c="dimmed" />
-                    <JobResultsStatusMessage job={job} files={job.files} submittingOrgSlug={orgSlug} />
-                </Stack>
-            </Paper>
+            <JobResultsStatusMessage job={job} files={job.files} submittingOrgSlug={orgSlug} />
             <Group>
                 <ButtonLink href={previousHref} variant="subtle" leftSection={<CaretLeftIcon />}>
                     Previous
diff --git a/src/components/job-results.tsx b/src/components/job-results.tsx
index cc5bf1d2b..028b7243c 100644
--- a/src/components/job-results.tsx
+++ b/src/components/job-results.tsx
@@ -117,6 +117,7 @@ export const ViewFile: FC<{ file: JobFile }> = ({ file }) => {
             <Text size="sm" fw={600}>
                 {logLabel(file.fileType)}:
             </Text>
+            <Text size="sm">{file.path}</Text>
             <ViewResultsLink content={file.contents} />
             <span
                 style={{
diff --git a/src/server/actions/study-job.actions.ts b/src/server/actions/study-job.actions.ts
index 1c443f11b..982238c9d 100644
--- a/src/server/actions/study-job.actions.ts
+++ b/src/server/actions/study-job.actions.ts
@@ -174,7 +174,10 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
     )
     .middleware(async ({ params: { jobId } }) => {
         const studyJob = await getStudyJobInfo(jobId)
-        return { studyJob, orgId: studyJob.orgId } // Return the jobInfo along with the orgId for validation in requireAbilityTo below
+        // Include submittedByOrgId so the 'view StudyJob' ability matches lab researchers
+        // (permissions.ts permits view when submittedByOrgId ∈ the user's researcher orgs),
+        // not just enclave reviewers — researchers fetch their own re-wrapped result files here.
+        return { studyJob, orgId: studyJob.orgId, submittedByOrgId: studyJob.submittedByOrgId }
     })
     .requireAbilityTo('view', 'StudyJob')
 

From d038ed09fbda2eee36d733092a46e6bdbc80854f Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Mon, 8 Jun 2026 14:31:22 -0400
Subject: [PATCH 14/45] Tests

---
 src/app/account/keys/generate-keys.tsx        |  1 +
 src/app/reviewer-key/regenerate-key.tsx       |  1 +
 src/components/encrypted-files-panel.tsx      |  1 +
 src/components/layout/navbar-profile-menu.tsx |  1 +
 .../seeds/1743608138837_test_users.ts         | 19 ++++++++++++++-----
 5 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/src/app/account/keys/generate-keys.tsx b/src/app/account/keys/generate-keys.tsx
index 900784748..ea7007cab 100644
--- a/src/app/account/keys/generate-keys.tsx
+++ b/src/app/account/keys/generate-keys.tsx
@@ -63,6 +63,7 @@ export const GenerateKeys: FC<GenerateKeysProps> = ({ isRegenerating = false })
     if (keys) {
         return (
             <Paper p="xl" mx="sm" radius="sm" maw={900} my={{ base: '1rem', lg: 0 }}>
+                {/* TODO(UX): "Reviewer key" — researchers now generate/use this same key too; rename to a role-neutral term (e.g. "Encryption key") pending UX. */}
                 <Title mb="xxl">Reviewer key</Title>
                 <Paper shadow="xs" p="xl">
                     <Stack>
diff --git a/src/app/reviewer-key/regenerate-key.tsx b/src/app/reviewer-key/regenerate-key.tsx
index 3e9b40a70..872536b28 100644
--- a/src/app/reviewer-key/regenerate-key.tsx
+++ b/src/app/reviewer-key/regenerate-key.tsx
@@ -26,6 +26,7 @@ export const RegenerateKey: FC = () => {
             <PageBreadcrumbs
                 crumbs={[['Dashboard', enclaveOrg ? `/${enclaveOrg.slug}/dashboard` : '/dashboard'], ['Reviewer Key']]}
             />
+            {/* TODO(UX): "Reviewer key" — researchers now use this same key too; rename to a role-neutral term (e.g. "Encryption key") pending UX. */}
             <Title my="xxl">Reviewer key</Title>
             <Paper shadow="xs" p="xxl">
                 <Stack>
diff --git a/src/components/encrypted-files-panel.tsx b/src/components/encrypted-files-panel.tsx
index c144b2eaf..883b95d2e 100644
--- a/src/components/encrypted-files-panel.tsx
+++ b/src/components/encrypted-files-panel.tsx
@@ -61,6 +61,7 @@ export const EncryptedFilesPanel: FC<EncryptedFilesPanelProps> = ({
                         <Textarea
                             label={
                                 hideKeyLabel ? undefined : (
+                                    // TODO(UX): "Reviewer Key" — the same key now decrypts for researchers too; rename to a role-neutral term pending UX.
                                     <Text mb="sm">{`Enter Reviewer Key to view ${encryptedFileTypesLabel}`}</Text>
                                 )
                             }
diff --git a/src/components/layout/navbar-profile-menu.tsx b/src/components/layout/navbar-profile-menu.tsx
index 5cfc154c7..559d86af9 100644
--- a/src/components/layout/navbar-profile-menu.tsx
+++ b/src/components/layout/navbar-profile-menu.tsx
@@ -90,6 +90,7 @@ export function NavbarProfileMenu() {
                 />
 
                 <Protect role={AuthRole.Reviewer}>
+                    {/* TODO(UX): "Reviewer Key" — researchers use the same key; rename to a role-neutral term pending UX. */}
                     <NavLink
                         label="Reviewer Key"
                         leftSection={<LockIcon aria-hidden="true" />}
diff --git a/src/database/seeds/1743608138837_test_users.ts b/src/database/seeds/1743608138837_test_users.ts
index 3b8bf0f10..c662c2fc4 100644
--- a/src/database/seeds/1743608138837_test_users.ts
+++ b/src/database/seeds/1743608138837_test_users.ts
@@ -1,5 +1,8 @@
 import type { DB } from '@/database/types'
 import { sql, type Kysely } from 'kysely'
+import fs from 'node:fs'
+import path from 'node:path'
+import { pemToArrayBuffer, fingerprintKeyData } from 'si-encryption/util/keypair'
 
 const titleize = (str: string) => str.toLowerCase().replace(/\b\w/g, (s) => s.toUpperCase())
 
@@ -229,9 +232,15 @@ export async function seed(db: Kysely<DB>): Promise<void> {
     }
 
     // Every test user belongs to an org that requires an encryption key (enclave or lab), so the
-    // RequireReviewerKey gate redirects them to key generation until one exists. Seed a placeholder
-    // key so e2e flows land on the real dashboard; decryption isn't exercised here, so the bytes
-    // only need to exist.
+    // RequireReviewerKey gate redirects them to key generation until one exists. Seed the shared
+    // test public key (tests/support/public_key.pem) — NOT a placeholder — so results encrypted
+    // for it by the e2e (bin/debug/upload-results.ts) produce a PO box whose fingerprint matches
+    // the seeded user, and decrypt with tests/support/private_key.pem.
+    const publicKeyDer = pemToArrayBuffer(
+        fs.readFileSync(path.resolve(process.cwd(), 'tests/support/public_key.pem'), 'utf8'),
+    )
+    const fingerprint = await fingerprintKeyData(publicKeyDer)
+
     for (const user of TEST_USERS) {
         const userId = userIdByRole.get(user.role)!
 
@@ -246,8 +255,8 @@ export async function seed(db: Kysely<DB>): Promise<void> {
             .insertInto('userPublicKey')
             .values({
                 userId,
-                publicKey: Buffer.from(`e2e-test-public-key-${user.role}`),
-                fingerprint: `e2e-test-fingerprint-${user.role}`,
+                publicKey: Buffer.from(publicKeyDer),
+                fingerprint,
             })
             .execute()
     }

From 396652f2d422eb292f511ef1da62953e2ac7d5b7 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Mon, 8 Jun 2026 18:46:20 -0400
Subject: [PATCH 15/45] Tests

---
 src/components/job-results.tsx | 131 +++++++++++++++++----------------
 1 file changed, 66 insertions(+), 65 deletions(-)

diff --git a/src/components/job-results.tsx b/src/components/job-results.tsx
index 028b7243c..d969a7385 100644
--- a/src/components/job-results.tsx
+++ b/src/components/job-results.tsx
@@ -1,15 +1,15 @@
 'use client'
 
-import React, { FC, useMemo, useState } from 'react'
+import { FC, useMemo, useState } from 'react'
 import { Anchor, Button, Group, LoadingOverlay, Stack, Text, Textarea, useMantineTheme } from '@mantine/core'
 import { ArrowSquareOutIcon } from '@phosphor-icons/react/dist/ssr'
 import { useQuery } from '@/common'
 import { ErrorAlert } from '@/components/errors'
 import { DownloadBlobLink } from '@/components/download-blob-link'
-import { isApprovedLogType, logLabel } from '@/lib/file-type-helpers'
+import { isEncryptedLogType, isResultFile, logLabel } from '@/lib/file-type-helpers'
 import { useDecryptFiles, type EncryptedJobFile } from '@/hooks/use-decrypt-files'
 import { fetchEncryptedJobFilesAction } from '@/server/actions/study-job.actions'
-import { JobFile, JobFileInfo } from '@/lib/types'
+import { JobFileInfo } from '@/lib/types'
 import { LatestJobForStudy } from '@/server/db/queries'
 
 const ViewResultsLink: FC<{ content: ArrayBuffer }> = ({ content }) => {
@@ -31,15 +31,36 @@ const ViewResultsLink: FC<{ content: ArrayBuffer }> = ({ content }) => {
     )
 }
 
-// Researcher-facing view of shared results. There is no plaintext copy: the
-// researcher decrypts the encrypted file bodies with their own key, using the PO box
-// the reviewer re-wrapped for them at approve time (the server only returns files the
-// researcher actually has a box for).
+// One file row. Label + name come from the encrypted metadata so the researcher sees what's
+// available before decrypting; View/Download appear only once `decrypted` is set.
+const FileRow: FC<{ label: string; name: string; decrypted?: JobFileInfo }> = ({ label, name, decrypted }) => {
+    const theme = useMantineTheme()
+    return (
+        <Group gap="xs">
+            <Text size="sm" fw={600}>
+                {label}:
+            </Text>
+            <Text size="sm">{name}</Text>
+            {decrypted && (
+                <>
+                    <ViewResultsLink content={decrypted.contents} />
+                    <span style={{ height: 16, borderLeft: `1px solid ${theme.colors.charcoal[4]}` }}></span>
+                    <DownloadBlobLink target="_blank" filename={name} fileContent={decrypted.contents} />
+                </>
+            )}
+        </Group>
+    )
+}
+
+// Researcher-facing view of shared results. There is no plaintext copy: the researcher
+// decrypts the encrypted file bodies with their own key (the PO box the reviewer re-wrapped
+// for them at approve). The file list is shown before decryption — names aren't secret, and
+// the reviewer panel lists them too — and only View/Download are gated behind the key.
 export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
     const [decryptedFiles, setDecryptedFiles] = useState<JobFileInfo[]>()
 
     const {
-        data: approvedFiles,
+        data: encryptedFiles,
         isLoading,
         isError,
         error,
@@ -53,22 +74,23 @@ export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
         isPending: isDecrypting,
         form,
     } = useDecryptFiles({
-        encryptedFiles: approvedFiles as EncryptedJobFile[] | undefined,
+        encryptedFiles: encryptedFiles as EncryptedJobFile[] | undefined,
         onSuccess: setDecryptedFiles,
     })
 
-    const { resultsFiles, logFiles } = useMemo(() => {
-        const res: JobFileInfo[] = []
-        const logs: JobFileInfo[] = []
-
-        decryptedFiles?.forEach((f) => {
-            if (f.fileType === 'APPROVED-RESULT') res.push(f)
-            else if (isApprovedLogType(f.fileType)) logs.push(f)
-        })
-
-        return { resultsFiles: res, logFiles: logs }
+    // Decrypted content keyed by source row id, to attach View/Download to the matching row.
+    const decryptedBySourceId = useMemo(() => {
+        const map = new Map<string, JobFileInfo>()
+        for (const f of decryptedFiles ?? []) map.set(f.sourceId, f)
+        return map
     }, [decryptedFiles])
 
+    // Results first, then logs.
+    const orderedFiles = useMemo(() => {
+        const files = (encryptedFiles ?? []) as EncryptedJobFile[]
+        return [...files.filter(isResultFile), ...files.filter((f) => isEncryptedLogType(f.fileType))]
+    }, [encryptedFiles])
+
     if (isError) {
         return <ErrorAlert error={error} />
     }
@@ -77,55 +99,34 @@ export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
         return <LoadingOverlay />
     }
 
-    if (!decryptedFiles) {
-        return (
-            <form onSubmit={form.onSubmit((values) => decrypt(values.privateKey))}>
-                <Stack>
-                    <Textarea
-                        label={<Text mb="sm">Enter your key to view results</Text>}
-                        resize="vertical"
-                        placeholder="Enter your key to access encrypted results."
-                        {...form.getInputProps('privateKey')}
-                        key={form.key('privateKey')}
-                    />
-                    <Group>
-                        <Button type="submit" disabled={!form.isValid()} loading={isDecrypting}>
-                            View Results
-                        </Button>
-                    </Group>
-                </Stack>
-            </form>
-        )
-    }
-
     return (
         <Stack>
-            {resultsFiles.map((file) => (
-                <ViewFile file={file} key={file.path} />
-            ))}
-            {logFiles.map((file) => (
-                <ViewFile file={file} key={file.path} />
+            {orderedFiles.map((file) => (
+                <FileRow
+                    key={file.studyJobFileId}
+                    label={logLabel(file.fileType)}
+                    name={file.name}
+                    decrypted={decryptedBySourceId.get(file.studyJobFileId)}
+                />
             ))}
+            {!decryptedFiles && (
+                <form onSubmit={form.onSubmit((values) => decrypt(values.privateKey))}>
+                    <Stack>
+                        <Textarea
+                            label={<Text mb="sm">Enter your key to view results</Text>}
+                            resize="vertical"
+                            placeholder="Enter your key to access encrypted results."
+                            {...form.getInputProps('privateKey')}
+                            key={form.key('privateKey')}
+                        />
+                        <Group>
+                            <Button type="submit" disabled={!form.isValid()} loading={isDecrypting}>
+                                View Results
+                            </Button>
+                        </Group>
+                    </Stack>
+                </form>
+            )}
         </Stack>
     )
 }
-
-export const ViewFile: FC<{ file: JobFile }> = ({ file }) => {
-    const theme = useMantineTheme()
-    return (
-        <Group gap="xs">
-            <Text size="sm" fw={600}>
-                {logLabel(file.fileType)}:
-            </Text>
-            <Text size="sm">{file.path}</Text>
-            <ViewResultsLink content={file.contents} />
-            <span
-                style={{
-                    height: 16,
-                    borderLeft: `1px solid ${theme.colors.charcoal[4]}`,
-                }}
-            ></span>
-            <DownloadBlobLink target="_blank" filename={file.path} fileContent={file.contents} />
-        </Group>
-    )
-}

From 65a0466b98fef1938b5105afb976a6b3230027c2 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Tue, 9 Jun 2026 14:34:29 -0400
Subject: [PATCH 16/45] Self review, add more comments/followup notes

---
 src/app/dl/results/[jobId]/[fileName]/route.ts           | 6 ++++++
 src/components/encrypted-files-panel.tsx                 | 2 +-
 .../migrations/1780000000000_study_job_file_keys.ts      | 3 +++
 src/server/actions/study-job.actions.ts                  | 9 ++++++++-
 src/server/results-sharing.ts                            | 5 +++++
 src/server/storage.ts                                    | 9 +++++++++
 6 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/src/app/dl/results/[jobId]/[fileName]/route.ts b/src/app/dl/results/[jobId]/[fileName]/route.ts
index 4df307fe9..467e1e07d 100644
--- a/src/app/dl/results/[jobId]/[fileName]/route.ts
+++ b/src/app/dl/results/[jobId]/[fileName]/route.ts
@@ -3,6 +3,12 @@ import { urlForFile } from '@/server/storage'
 import { getStudyJobFileOfType, getInfoForStudyJobId } from '@/server/db/queries'
 import { canViewStudyJob } from '@/server/auth'
 
+// LEGACY ONLY: serves the plaintext APPROVED-RESULT copy from before results were
+// encrypted for researchers. New jobs no longer create APPROVED-RESULT rows (results are
+// decomposed + decrypted client-side), so this path is only reachable for pre-encryption
+// studies. It can be deleted — along with pathForStudyJobResults (src/lib/paths.ts) and any
+// remaining plaintext S3 objects — once legacy studies age out.
+// REVIEWER: please flag this during review so we track the eventual removal.
 export const GET = async (_: Request, { params }: { params: Promise<{ jobId: string; fileName: string }> }) => {
     const { jobId, fileName } = await params
 
diff --git a/src/components/encrypted-files-panel.tsx b/src/components/encrypted-files-panel.tsx
index 9b6589d6b..642e1ecc4 100644
--- a/src/components/encrypted-files-panel.tsx
+++ b/src/components/encrypted-files-panel.tsx
@@ -61,7 +61,7 @@ export const EncryptedFilesPanel: FC<EncryptedFilesPanelProps> = ({
                         <Textarea
                             label={
                                 hideKeyLabel ? undefined : (
-// TODO(UX): "Reviewer key" — the same key now decrypts for researchers too; rename to a role-neutral term pending UX.
+                                    // TODO(UX): "Reviewer key" — the same key now decrypts for researchers too; rename to a role-neutral term pending UX.
                                     <Text mb="sm">{`Enter Reviewer key to view ${encryptedFileTypesLabel}`}</Text>
                                 )
                             }
diff --git a/src/database/migrations/1780000000000_study_job_file_keys.ts b/src/database/migrations/1780000000000_study_job_file_keys.ts
index 42a0f816c..c324761f1 100644
--- a/src/database/migrations/1780000000000_study_job_file_keys.ts
+++ b/src/database/migrations/1780000000000_study_job_file_keys.ts
@@ -2,6 +2,9 @@ import { type Kysely, sql } from 'kysely'
 
 export async function up(db: Kysely<unknown>): Promise<void> {
     await db.schema.alterTable('study_job_file').addColumn('iv', 'text').execute()
+    // Display-only pre-encryption size. `integer` caps at ~2.15 GB; if result files ever
+    // exceed that, widen to `bigint` (note: pg returns int8 as a string, so add an int8 type
+    // parser or coerce at the read sites — `bytes` is currently typed `number`).
     await db.schema.alterTable('study_job_file').addColumn('bytes', 'integer').execute()
 
     // Records the durable fact that a reviewer approved (and shared) this file. The
diff --git a/src/server/actions/study-job.actions.ts b/src/server/actions/study-job.actions.ts
index 982238c9d..9f239918a 100644
--- a/src/server/actions/study-job.actions.ts
+++ b/src/server/actions/study-job.actions.ts
@@ -39,6 +39,11 @@ export const approveStudyJobFilesAction = new Action('approveStudyJobFilesAction
         // only persist those new "PO box" rows — the file ciphertext is never touched and
         // the server never sees plaintext or the raw AES key. Adding a box = sharing;
         // deleting one (future / Card 74) = revoking.
+        //
+        // BACKFILL GAP (Card 73/74): boxes are wrapped only for lab members who have a key
+        // *right now*. A researcher who joins the lab or generates their key after approval
+        // gets no box and cannot read already-approved results. Re-wrapping for late joiners
+        // (the reviewer no longer holds the raw AES key, so this needs a recovery flow) lands here.
         await insertSharedFileBoxes(db, info.studyJobId, sharedFiles, session.user.id)
 
         await db
@@ -209,7 +214,9 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
 
         const ready = encryptedFiles.flatMap((file) => {
             const crypt = cryptByFileId.get(file.id)
-            // No box for this user, or no iv to decrypt with → stays opaque.
+            // No box for this user, or no iv to decrypt with → stays opaque. A null `iv` means
+            // a legacy (pre-decompose) job; those have no encrypted body here and fall back to
+            // the legacy plaintext download route (src/app/dl/results/...). Intended, not a gap.
             return crypt && file.iv ? [{ file, crypt, iv: file.iv }] : []
         })
 
diff --git a/src/server/results-sharing.ts b/src/server/results-sharing.ts
index 79c10e2a9..952f575a1 100644
--- a/src/server/results-sharing.ts
+++ b/src/server/results-sharing.ts
@@ -25,6 +25,11 @@ export async function insertSharedFileBoxes(
     const labKeys = await getLabPublicKeysForJob(jobId)
     const labFingerprints = new Set(labKeys.map((k) => k.fingerprint))
 
+    // We validate that each box targets a real lab recipient, but — the server being blind —
+    // we cannot verify the `crypt` actually wraps the file's correct AES key. A buggy reviewer
+    // client could persist a box that unwraps to garbage; the researcher would just fail to
+    // decrypt downstream. The reviewer client is trusted (it wraps the same key it just used to
+    // review), so this is accepted by design rather than guarded here.
     const rows = sharedFiles.flatMap((file) =>
         file.boxes.map((box) => {
             if (!labFingerprints.has(box.fingerprint)) {
diff --git a/src/server/storage.ts b/src/server/storage.ts
index 374331446..2b5b70889 100644
--- a/src/server/storage.ts
+++ b/src/server/storage.ts
@@ -43,9 +43,18 @@ async function storeJobFile(info: MinimalJobInfo, path: string, file: File, file
  * Touches no plaintext and needs no private key — the manifest is plaintext
  * metadata and the bodies stay ciphertext. One row per decomposed file; sharing
  * a file later = adding a `study_job_file_key` box, never re-encrypting.
+ *
+ * Trust model is honest-but-curious: the server is the storage authority for the
+ * ciphertext bodies + IVs but is trusted not to tamper with them. The AES-CBC
+ * scheme gives confidentiality (the server can never read results), not integrity
+ * — there's no auth tag, so a *malicious* server could alter ciphertext undetected.
+ * If that ever becomes part of the threat model, move to AEAD (AES-GCM) or have the
+ * enclave sign (iv ‖ ciphertext) for client-side verification.
  */
 async function storeDecomposedEncryptedFiles(info: MinimalJobInfo, file: File, fileType: FileType, subdir: string) {
     const decomposed = await decomposeResultsZip(file)
+    // entry.path is the inner filename from TOA's manifest. TOA is trusted, so we use it
+    // directly as the S3 key suffix; if that trust ever weakens, sanitize for `..`/collisions.
     const items = decomposed.map((entry) => ({
         entry,
         path: `${pathForStudyJob(info)}/results/${subdir}/${entry.path}`,

From 783695f8d1264ece5de02e975733ad22fdc2ab7b Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Wed, 10 Jun 2026 13:47:06 -0400
Subject: [PATCH 17/45] Build?

---
 src/database/seeds/1743608138837_test_users.ts | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/database/seeds/1743608138837_test_users.ts b/src/database/seeds/1743608138837_test_users.ts
index c662c2fc4..f08079bb0 100644
--- a/src/database/seeds/1743608138837_test_users.ts
+++ b/src/database/seeds/1743608138837_test_users.ts
@@ -1,8 +1,8 @@
 import type { DB } from '@/database/types'
 import { sql, type Kysely } from 'kysely'
+import { createHash } from 'node:crypto'
 import fs from 'node:fs'
 import path from 'node:path'
-import { pemToArrayBuffer, fingerprintKeyData } from 'si-encryption/util/keypair'
 
 const titleize = (str: string) => str.toLowerCase().replace(/\b\w/g, (s) => s.toUpperCase())
 
@@ -236,10 +236,13 @@ export async function seed(db: Kysely<DB>): Promise<void> {
     // test public key (tests/support/public_key.pem) — NOT a placeholder — so results encrypted
     // for it by the e2e (bin/debug/upload-results.ts) produce a PO box whose fingerprint matches
     // the seeded user, and decrypt with tests/support/private_key.pem.
-    const publicKeyDer = pemToArrayBuffer(
-        fs.readFileSync(path.resolve(process.cwd(), 'tests/support/public_key.pem'), 'utf8'),
-    )
-    const fingerprint = await fingerprintKeyData(publicKeyDer)
+    // Inlined from si-encryption's pemToArrayBuffer/fingerprintKeyData: importing that package
+    // pulls in `debug`, whose CJS require('tty') crashes the esbuild ESM bundle the migrator
+    // Lambda runs seeds from. The fingerprint format (hex of SHA-256 over SPKI DER) must stay
+    // in sync with si-encryption, verified identical for this key.
+    const pem = fs.readFileSync(path.resolve(process.cwd(), 'tests/support/public_key.pem'), 'utf8')
+    const publicKeyDer = Buffer.from(pem.replace(/-----[^-]+-----/g, '').replace(/\s+/g, ''), 'base64')
+    const fingerprint = createHash('sha256').update(publicKeyDer).digest('hex')
 
     for (const user of TEST_USERS) {
         const userId = userIdByRole.get(user.role)!
@@ -255,7 +258,7 @@ export async function seed(db: Kysely<DB>): Promise<void> {
             .insertInto('userPublicKey')
             .values({
                 userId,
-                publicKey: Buffer.from(publicKeyDer),
+                publicKey: publicKeyDer,
                 fingerprint,
             })
             .execute()

From 7b650b3855348901cffb442aad9029a24038a0fd Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Wed, 10 Jun 2026 16:37:47 -0400
Subject: [PATCH 18/45] Fix test

---
 src/database/seed-test-public-key.test.ts     | 13 +++++++++++
 .../seeds/1743608138837_test_users.ts         | 22 +++++++++++++++----
 2 files changed, 31 insertions(+), 4 deletions(-)
 create mode 100644 src/database/seed-test-public-key.test.ts

diff --git a/src/database/seed-test-public-key.test.ts b/src/database/seed-test-public-key.test.ts
new file mode 100644
index 000000000..0e8406888
--- /dev/null
+++ b/src/database/seed-test-public-key.test.ts
@@ -0,0 +1,13 @@
+import { describe, expect, it } from '@/tests/unit.helpers'
+import fs from 'node:fs'
+import path from 'node:path'
+import { TEST_PUBLIC_KEY_PEM } from './seeds/1743608138837_test_users'
+
+// This test lives outside src/database/seeds because the deploy pipeline bundles
+// every *.ts file in that directory as a seed.
+describe('test users seed', () => {
+    it('embedded public key matches tests/support/public_key.pem', () => {
+        const filePem = fs.readFileSync(path.resolve(process.cwd(), 'tests/support/public_key.pem'), 'utf8')
+        expect(TEST_PUBLIC_KEY_PEM.trim()).toEqual(filePem.trim())
+    })
+})
diff --git a/src/database/seeds/1743608138837_test_users.ts b/src/database/seeds/1743608138837_test_users.ts
index f08079bb0..4038b0862 100644
--- a/src/database/seeds/1743608138837_test_users.ts
+++ b/src/database/seeds/1743608138837_test_users.ts
@@ -1,8 +1,23 @@
 import type { DB } from '@/database/types'
 import { sql, type Kysely } from 'kysely'
 import { createHash } from 'node:crypto'
-import fs from 'node:fs'
-import path from 'node:path'
+
+// Copy of tests/support/public_key.pem, embedded because the migrator Lambda runs this seed
+// without a repo checkout to read the file from. A unit test asserts it stays in sync.
+export const TEST_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAhwpt565psROI0lzRT1i6
+AzuENGyqK9MPnEJ4SZ+nZZeXYYm/PzxV/sovltwyOxgD4A/fAvi5hftcscuWpsYR
+yox0wx0wKECZ+4DHy8X4iLGdRh9KCM8pddgKHKXnb8/cLEKmzCR/gXSeMG8TkLIo
+LV3IjtkoPRj8GZIJxVqqQ/UVtiqcOj4FXbqBiQdydLER8jPhzQLdmXHoHkerxCRy
+8HfzjU1M289bGoqW6IAQ1+AIYCemdsrfWqQZEGOrOTJcaWIcdDnwCatr+TC6blCg
+WhhfiNGWRLf2Vhuu6uYRhIilo16wGb6woCCm+VsgL6xa5HLvcF5l6cdyerUmKzrB
+LMXXpPaO0sTsAR9/QTL8bjXK2DByKqeVQ53cK+FcKCrC+al3pl7Jj8VuFxcCjs3x
+7DKreBR8w6BunILrD/dVEYLslKHNTOVtHvFBjJDdX956OKyo7ZQchnbfWQrZyeor
+5c9ERtxPqp9Aq++k9aE5pqQ0u4BjgwsLhL9lzsEcBDBF4D3DEJapTKO0LsZLmn36
+Ssf4Huw9x9pCzj5jl8VFRfwY42BH/TYwTd6QtDO7cfelOLG/roX6vLP8+lZB8OUF
+Viiiv7pMXLecfrwuZZrfg+08UsF8H1vY9P4bw3dmzhHxwF3inIvYpHDAp7tnSFGp
+8lwX7mjUqudVA93y6z1U6hsCAwEAAQ==
+-----END PUBLIC KEY-----`
 
 const titleize = (str: string) => str.toLowerCase().replace(/\b\w/g, (s) => s.toUpperCase())
 
@@ -240,8 +255,7 @@ export async function seed(db: Kysely<DB>): Promise<void> {
     // pulls in `debug`, whose CJS require('tty') crashes the esbuild ESM bundle the migrator
     // Lambda runs seeds from. The fingerprint format (hex of SHA-256 over SPKI DER) must stay
     // in sync with si-encryption, verified identical for this key.
-    const pem = fs.readFileSync(path.resolve(process.cwd(), 'tests/support/public_key.pem'), 'utf8')
-    const publicKeyDer = Buffer.from(pem.replace(/-----[^-]+-----/g, '').replace(/\s+/g, ''), 'base64')
+    const publicKeyDer = Buffer.from(TEST_PUBLIC_KEY_PEM.replace(/-----[^-]+-----/g, '').replace(/\s+/g, ''), 'base64')
     const fingerprint = createHash('sha256').update(publicKeyDer).digest('hex')
 
     for (const user of TEST_USERS) {

From 076fe6d3324427bb1fd84d8b65e13bcf99fcd6bd Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Wed, 10 Jun 2026 17:03:51 -0400
Subject: [PATCH 19/45] Remove design file

---
 results-encryption-design-notes.md | 305 -----------------------------
 1 file changed, 305 deletions(-)
 delete mode 100644 results-encryption-design-notes.md

diff --git a/results-encryption-design-notes.md b/results-encryption-design-notes.md
deleted file mode 100644
index 22aa0e022..000000000
--- a/results-encryption-design-notes.md
+++ /dev/null
@@ -1,305 +0,0 @@
-# Results Encryption for Researchers — Design Notes
-
-> Working synthesis from grilling session against codebase (management-app + trusted-output-app).
-> Status: **draft for review.** Locked decisions marked ✅; open items in §8.
-> **Scope: Card 72 (prerequisite) → Card 71 only.** Happy path only. Cards 73/74 (regeneration, recovery) explicitly out of scope.
-> **All phases land on one branch/PR (`researcher-encrypted-results`).** Not split per-card.
-> **Progress: Card 72 code complete on branch (not yet merged to main). Card 71 NOT YET built in current tree — see DECISION LOG.**
-> **Testing: local e2e unreliable — rely on CI. Unit tests are DB-backed: run inside the `mgmnt-app` docker container, one file at a time (see §12).**
->
-> ## ✅ FINAL DIRECTION: RE-WRAP (§4 is the plan). §11 re-encrypt = ABANDONED.
->
-> **Decision log (this session, newest last):**
->
-> 1. Original detailed plan (§4) = **re-wrap + decompose-on-ingest** (PO boxes in Postgres).
-> 2. Built re-wrap fully → unit tests green → **then reverted** (worried about lib change + scope).
-> 3. Pivoted to **re-encrypt at approve** (§11), built it, tests green, **not committed**.
-> 4. **Pivoted BACK to re-wrap (FINAL).** Reasons: (a) Phil (EM) verbally wants re-wrap; (b) re-wrap is the more correct long-term architecture — immutable ciphertext, add-a-box to share, **delete-a-box to revoke**; (c) it sets up Cards 73/74 (regen/recovery) cleanly; (d) the doc's "re-encrypt" wording was loose — the _detailed_ plan was always re-wrap.
->
-> **⚠️ MUST CONFIRM WITH PHIL BEFORE/AT START:** re-wrap **requires a small `si-encryption` library change** (expose the raw AES key + a zip-free decrypt primitive). This directly conflicts with Phil's "no lib change needed" comment — those two cannot both hold. The change is **small + additive** (~2 new functions, already prototyped this session). Get his explicit OK on the lib change, since it's the thing he thought we'd avoid.
->
-> **Good news for the implementer:** the entire re-wrap build was already done + verified green earlier this session, then reverted. It is NOT in git, but the recipe is fully captured in §5 "Card 71 — re-wrap steps" (steps 0–5, each was ✅ before revert). This is a **proven recipe to re-apply**, not a green-field design.
-
----
-
-## 1. The problem
-
-Enclave output (result files + run logs) delivered to **DO reviewers** encrypted, but same output currently exposed to **researchers in plaintext**. Reviewers decrypt client-side with private key generated at signup; researchers get unencrypted copy.
-
-Goal: researchers must _also_ decrypt with own key, so output never available plaintext on researcher side.
-
----
-
-## 2. How encryption works today (the "post office" analogy)
-
-| Concept (analogy)                                              | Implementation                                                                                   | Where in code                                                |
-| -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------ |
-| **Results key** — padlock whose one key both locks and unlocks | Random **AES-256-CBC** symmetric key, generated **per file** (+ per-file random IV)              | `si-encryption/job-results/writer.ts:19,22`                  |
-| **Lock the results**                                           | Encrypt each file's bytes with its AES key                                                       | `writer.ts:25`                                               |
-| **PO box per person**                                          | AES key "wrapped" (encrypted) with each recipient's **RSA-OAEP-4096 public key**                 | `writer.ts:31-35,58-84`                                      |
-| **PO box number**                                              | Recipient's **fingerprint** = SHA-256 of public key                                              | `util/keypair.ts:105-111`                                    |
-| **Post office (directory of boxes)**                           | `manifest.json` — maps `fingerprint → { crypt }`, plus per-file `iv`, `path`, `bytes`            | `writer.ts:39-44`; types in `job-results/types.ts`           |
-| **Ship it**                                                    | TOA zips `manifest.json` + encrypted bodies, POSTs to MA                                         | TOA `src/app/api/job/encrypt-results.ts`                     |
-| **Open the box**                                               | Browser fetches zip, finds its PO box by fingerprint, unwraps AES key with private key, decrypts | `hooks/use-decrypt-files.ts`, `job-results/reader.ts:95-109` |
-
-**Key types, ELI5**
-
-- **RSA keypair (asymmetric)** — public key = mail slot anyone can drop into; private key = only physical key that opens box. Mathematically bound; can't edit one to fit other.
-- **AES key (symmetric)** — one key locks and unlocks. Fast; used for big file bodies. One per file.
-- **IV (initialization vector)** — per-file random value, **not secret**, but **required** to decrypt (AES-CBC). Must travel with ciphertext.
-- **Fingerprint** — nameplate on box; SHA-256 of public key.
-- **Envelope encryption** — lock big file once with fast AES padlock, then put _copy_ of that AES key into personal RSA-locked box per recipient. Manifest = directory of boxes.
-
-**Where keys live**
-
-- **Public key** → DB `user_public_key` (`public_key` bytea, `fingerprint` text, `UNIQUE(user_id)`). Schema already **role-agnostic**.
-- **Private key** → user downloads PEM; **never stored server-side**. Core guarantee: _server cannot read results._
-
----
-
-## 3. The fact that reframes the work
-
-Approve currently stores **plaintext**. `approveStudyJobFilesAction` (`src/server/actions/study-job.actions.ts:12-45`) takes DO's already-decrypted contents and writes them to `results/approved/` via `storeApprovedJobFile`. Researchers read those plaintext files. Project = _"stop writing decrypted copy, give researchers own PO boxes instead."_
-
----
-
-## 4. Architecture decisions (locked)
-
-### ✅ 4.1 One key per user, not per role (Card 72)
-
-Single keypair serves person as reviewer _and_ researcher. Encryption already takes all org public keys regardless of role (`writer.ts`), so same key works for both hats. Consequence: key handling is user-level, not role-level.
-
-### ✅ 4.2 Re-wrap, not re-encrypt (core mechanic)
-
-Granting researcher access does **not** re-encrypt file bodies. File's existing AES key **wrapped again** for researcher's public key → new PO box. Ciphertext and IV never change.
-
-- DO's browser already holds raw AES key (just decrypted to review), so it wraps that key for each researcher and uploads new boxes. **Server never sees plaintext.**
-- Regenerated key cannot open old boxes — that impossibility _is_ the security. (Recovery/regeneration = out of scope; see §8.)
-
-### ✅ 4.3 Option B — decompose on ingest
-
-When MA receives TOA's zip, **unzips once on server** and stores pieces separately:
-
-- each **encrypted body** → own S3 object
-- per-file **metadata (iv, path, bytes)** + per-recipient **wrapped keys** → Postgres
-
-Manifest is **plaintext metadata** (IVs/fingerprints/wrapped keys not secret), and server already parses it today with empty key to list files (`study-job.actions.ts:72-76`). Decompose-on-ingest needs **no private keys, touches no plaintext** — zero-plaintext-on-server guarantee holds.
-
-Postgres = **single source of truth for PO boxes** (DO and researcher). Zip reduced to transient ingest format; read path no longer unzips.
-
-**Schema (DECIDED: extend existing `study_job_file`, do NOT add a new `job_file` table).** `study_job_file` already models one-row-per-file with `source_id` linkage; reuse it to avoid duplicating the file concept and migrating references.
-
-```
-study_job_file      -- EXISTING (1750186286777). Add nullable: iv text
-                       path = S3 object key of the body (existing invariant across all 12 consumers)
-                       name = logical/inner filename
-                       (NO blob_location — would be redundant with path; dropped after consumer audit)
-study_job_file_key  (id, study_job_file_id → study_job_file.id, fingerprint, crypt, created_at)
-                       UNIQUE(study_job_file_id, fingerprint)   -- one row per recipient-per-file = a PO box
-```
-
-**Model inversion:** today 1 `study_job_file` row = 1 zip holding many files (client gets whole blob + `ResultsReader.listFiles()`). Option B: **1 row = 1 decomposed file** (`path`=S3 key of body, `iv` on row, wrapped keys in `study_job_file_key`).
-
-**Coupling:** ingest (writes decomposed rows) and `fetchEncryptedJobFilesAction` + `use-decrypt-files`/`use-encrypted-files-panel` share the row contract. They must change **together** — ingest cannot land alone without breaking the review read path.
-
-**Read path (DO and researcher, identical):** fetch encrypted body from S3 (`path`) + `iv` and row matching _my_ fingerprint from `study_job_file_key` → `decryptFile({encryptedBody, iv, crypt, privateKey})`. `SELECT crypt FROM study_job_file_key WHERE fingerprint = ? AND study_job_file_id IN (...)` (one box per file).
-
-### ✅ 4.4 Re-wrap at approve, client-side (Card 71)
-
-On **Approve**, DO's browser:
-
-1. Fetches **lab's** public keys — members of `study.submittedByOrgId` who have key.
-2. Wraps each approved file's AES key (already in memory from decrypting) to each researcher public key.
-3. POSTs new PO boxes; server inserts `job_file_key` rows in one transaction (atomic, idempotent via unique constraint).
-
-### ✅ 4.5 Remove plaintext storage
-
-Drop `storeApprovedJobFile` plaintext write. Researchers read encrypted body + their PO box and decrypt client-side, using **same** path as reviewers.
-
----
-
-## 5. Blast radius / implementation notes
-
-**Reassuring:** decompose-on-ingest and re-wrap both operate only on encrypted bytes + non-secret metadata. No server-side plaintext, no server-side private keys.
-
-**Hidden cost of Option B — shared library change.** Current decrypt path is zip-shaped end-to-end: `ResultsReader`'s constructor takes zip blob and reads `manifest.json` from inside it (`reader.ts:17,45-49`). Option B has no zip at read time, so must:
-
-- Add **zip-free decrypt primitive** to `si-encryption`, e.g. `decryptFile(encryptedBody, iv, wrappedKeyForMyFingerprint, privateKey) → plaintext`. Guts already exist (`readFile` does `decryptKeyWithPrivateKey` + `decryptData`, `reader.ts:95-109`) — just need unwelding from zip iteration.
-- Have reader **expose raw AES key** per file (today `readFile` computes it but returns only decrypted body) — **re-wrap needs that key**.
-- Rewrite client hook (`use-decrypt-files.ts` / `use-encrypted-files-panel.ts`) to fetch body-from-S3 + iv/crypt-from-PG instead of unzipping.
-
-**Shared-library change, not MA-only.**
-
-### Card 72 — researcher key generation (prerequisite) — ✅ DONE (PR #764)
-
-`user_public_key` schema already role-agnostic; only **gate** was enclave-scoped. Widened to include lab-org users.
-
-**What shipped:**
-
-- New predicate `orgNeedsKey(org)` in `src/lib/types.ts` = `isEnclaveOrg(org) || isLabOrg(org)`. One named concept, four call-sites — chosen over inlining `|| isLabOrg` (drift risk) and over coupling to reviewer-only concept (`usersReviewerOrgIds` stays enclave-only for approve/reject/review).
-- Four gates flipped `isEnclaveOrg` → `orgNeedsKey`:
-    - `src/lib/permissions.ts:67` — `if (orgs.some(orgNeedsKey))` permits view/update `ReviewerKey`
-    - `src/components/require-reviewer-key.tsx:17` — redirect guard
-    - `src/server/actions/user.actions.ts:17` — sign-in redirect
-    - `src/app/account/invitation/[inviteId]/create-account.action.ts:155` — invite `needsReviewerKey`
-- Names kept (`ReviewerKey` / `require-reviewer-key` / `set/updateReviewerPublicKeyAction`) — rename still out of scope.
-- Researcher now: generates keypair client-side at `/account/keys`, downloads PEM (server never stores private key), public key + fingerprint → `userPublicKey`. Reuses reviewer path entirely; zero new storage code.
-
-**Test fallout fixed (same PR):**
-
-- `user-keys.actions.test.ts` — flipped stale "lab user `cannot view ReviewerKey`" assertion to assert access.
-- `create-account.action.test.ts` — lab "needsReviewerKey true" case must seed user in **lab** org; `insertTestUser` auto-creates key only for **enclave**-org users (`tests/unit.helpers.tsx:215`), so enclave-seeded user already had key and broke assertion.
-- e2e seed `src/database/seeds/1743608138837_test_users.ts` — seed placeholder `userPublicKey` for all test users. `RequireReviewerKey` now gates lab researchers too; key-less seeded users were redirected off dashboard, detaching `new-study` button mid-click → all study-flow specs timed out.
-- Unrelated pre-existing lint warning fixed to unblock CI: `studyId` added to `useEffect` dep array in `src/hooks/use-workspace-launcher.tsx:122`.
-
-### Card 71 — re-wrap steps (PROVEN RECIPE — built + green this session, then reverted; RE-APPLY)
-
-> Every step below was implemented and unit-tested green this session, then reverted on the (now-undone) pivot to re-encrypt. **None of it is in git** — both MA and the `../encryption` repo are back at baseline. Re-apply in order. The ✅ marks mean "proven works," not "currently in the tree."
-> The `si-encryption` change (step 0b) is the one that **needs Phil's OK** (see top).
-
-0. ✅ **Migration** (MA): extend `study_job_file` (`iv` text, `bytes` integer — both nullable; NO blob_location, redundant with `path`) + new `study_job_file_key(study_job_file_id, fingerprint, crypt, created_at)` UNIQUE(study_job_file_id, fingerprint). `1780000000000_study_job_file_keys.ts`. Types hand-stubbed in `src/database/types.ts` (CI regenerates — local DB/docker down).
-   0b. ✅ **si-encryption primitives** (encryption repo): added zip-free `job-results/crypto.ts` (`unwrapAesKey` exposes raw AES bytes, `wrapAesKey` re-wrap, `decryptFileBody`, `decryptFile`) + `job-results/decompose.ts` (`decomposeResultsZip`). Reader/writer refactored to call primitives (no behavior change). 9/9 tests incl. re-wrap round-trip. **Needs push + MA `package.json` hash bump to consume.** (currently local `link:../encryption` override in `pnpm-workspace.yaml`.)
-1. ✅ **Ingest** (`storage.ts`): `storeDecomposedEncryptedFiles(info, file, fileType, subdir)` — `decomposeResultsZip` → per-file S3 bodies + `study_job_file`(+iv,bytes) + `study_job_file_key`(DO boxes) rows, one txn. **Results AND logs decomposed** (logs share ResultsWriter format; `results/encrypted/` vs `results/encrypted-logs/`). `storeStudyEncryptedResultsFiles` + `storeStudyEncryptedLogFile` both delegate. Route + `encrypt-and-store-log.ts` callers unchanged (same signatures).
-2. ✅ **Lab-pubkey query** `getLabPublicKeysForJob(jobId)` keyed on `study.submittedByOrgId` (queries.ts).
-3. ✅ **Decrypt/read path:** `fetchEncryptedJobFilesAction` → per-file shape `{studyJobFileId, fileType, path, iv, crypt(=my box), encryptedBody}` (resolves session fingerprint via `getReviewerPublicKey`, joins `study_job_file_key`). `getStudyJobInfo`/`latestJobForStudyQuery` selects gained `iv`/`bytes`/`id`. `use-decrypt-files` uses `decryptFile`, drops `ResultsReader`, carries `rawAesKey`+`sourceId` on `JobFileInfo`. `use-encrypted-files-panel` rewritten to per-file/option-(a) model (approved=has researcher box via new `fetchSharedFileIdsAction`/`getSharedFileIdsForJob`; one row per `job.files` entry).
-4. ✅ **Approve re-wrap:** `approveStudyJobFilesAction` now takes `sharedFiles:[{studyJobFileId, boxes:[{fingerprint,crypt}]}]`, inserts `study_job_file_key` (idempotent `onConflict doNothing`), server-validates fingerprints ∈ lab keys, no plaintext write. `job-review-buttons` fetches lab pubkeys (`fetchLabPublicKeysAction`) + `wrapAesKey` client-side per selected file. **Server never receives `rawAesKey`.** Old `fetchApprovedJobFilesAction` removed.
-5. ✅ **Researcher view:** `components/job-results.tsx` (rendered in `study/[studyId]/view/`) now fetches encrypted files + prompts for the researcher's key + decrypts (same `useDecryptFiles` path) instead of reading plaintext APPROVED-\* files.
-
-**Source compiles clean (`tsc`).** REMAINING:
-
-- **Tests** (~15 files): mocks still use the old `EncryptedJobFile` `{blob, metadata}` shape + `fetchApprovedJobFilesAction`; test `job.files` mocks need `id`/`bytes`. New unit tests for ingest decompose, re-wrap approve, shared-file signal, researcher decrypt view.
-- **Tangential cleanup:** `study.actions.ts:320` still writes plaintext via `storeApprovedJobFile` in the _proposal/code approval_ path (pre-existing "delete me" TODO). Separate from results encryption; evaluate whether it ever carries result files before removing. `storeApprovedJobFile` now used ONLY there.
-- **Cross-repo:** push encryption changes, bump MA `package.json` hash, remove `link:../encryption` override.
-
-## 10. Approval-signal model change (discovered while rewriting panel) — NEEDS DECISION
-
-Today "approved" is encoded by the existence of an `APPROVED-RESULT` plaintext `study_job_file` row (written by `storeApprovedJobFile`). Option B (§4.5) **deletes that write**, and the new approve only inserts **researcher key boxes**. ⇒ **No `APPROVED-*` rows are created anymore.** Consequences:
-
-- `fetchApprovedJobFilesAction` (filters `APPROVED-RESULT`) returns empty → dead.
-- Panel `use-encrypted-files-panel` state model (locked / decrypted / **approved** / not-shared) loses its "approved" + "not-shared" signal.
-- There is no plaintext approved copy to view — researcher & post-approval DO both **decrypt the encrypted body** via the same path.
-
-**This forces §6 option (a):** "file has a researcher PO box" = "approved & shared." No new `approved` column. Panel must derive approved/withheld from `study_job_file_key` rows whose fingerprint ∈ lab-org fingerprints (a new query). Per-file selection (already present) drives which files get boxes. **Decision-independent of per-file-vs-all** (boxes are per-file regardless).
-
-Remaining UI plane to build on this model: panel rewrite (iterate per-file `job.files` rows, approved=has-researcher-box), approve action rewrite (insert boxes, no plaintext), approved-file viewing (decrypt, no plaintext copy), lab-pubkey fetch action for client wrap.
-
----
-
-## 6. Per-file approve/reject (confirmed from code)
-
-Today's behavior **asymmetric**:
-
-- **Approve = per-file subset.** Checkbox per result file; all auto-selected on decrypt, reviewer can uncheck (`use-encrypted-files-panel.ts:39,85-86,94-101`). Action takes chosen subset: `approveStudyJobFilesAction.params({ jobFiles: z.array(...) })` (`study-job.actions.ts:12-45`); button passes `jobFiles: decryptedResults` (`job-review-buttons.tsx:45`).
-- **Reject = whole job.** `rejectStudyJobFilesAction` takes no file list — flips job to `FILES-REJECTED` (`study-job.actions.ts:47-70`).
-
-**Important catch:** **no per-file approval column.** Approval tracked only at **job level** (`jobStatusChange.status`). "This file is approved" encoded _implicitly_ today by existence of plaintext `APPROVED-*` copy — which Option B (§4.5) **deletes**. So if per-file approve kept, approval state needs new home:
-
-- **(a)** Researcher `job_file_key` rows _are_ the signal — re-wrap only approved files; "has researcher PO box" = "approved & shared." No new column. (Recommended — rows already per-file and already being inserted.)
-- **(b)** Explicit `approved` flag/status on `job_file`. Cleaner/queryable, decouples "approved" from "shared," but adds column.
-
-If product chooses **all-or-nothing** approve/reject, existing job-level status suffices, re-wrap covers all files, no per-file state needed.
-
-> **Open product decision (Phil):** support per-file approve/reject, or approve/reject whole artifact set together? Decides whether (a)/(b) needed. Re-wrap must only ever cover **approved** files — rejected outputs must never get researcher PO boxes.
->
-> **NON-BLOCKING for build.** Per-file is the superset: `approveStudyJobFilesAction` already takes a `jobFiles` subset today, so building for per-file matches current behavior; all-or-nothing falls out as "pass all files". Same re-wrap plumbing either way. Only option (b)'s explicit `approved` column is decision-dependent, and that's a cheap **additive** migration later. Everything upstream of approve (schema core, ingest/DO boxes, si-encryption primitive, lab-pubkey query, decrypt rewrite, researcher view) is fully decision-independent. → Build the spine now; defer only approve input-set semantics.
-
----
-
-## 7. The cards (this work = 72 → 71 only)
-
-- ✅ **Card 72 — researcher key generation (prerequisite for 71).** DONE — PR #764. Gate widened to lab orgs via `orgNeedsKey`; names kept.
-- ⬜ **Card 71 — enable encryption for researchers.** NOT STARTED (next session). Decompose on ingest (Option B); re-wrap approved files at approve; remove plaintext; researcher decrypts client-side.
-- ⛔ **Card 73 — key re-generation flow.** Out of scope.
-- ⛔ **Card 74 — user-led re-encryption / recovery.** Out of scope.
-
----
-
-## 8. Open questions
-
-1. **Per-file vs all-together approve/reject** (§6) — **NOTE FOR PHIL: finalize with team/PMs.** Should reviewers approve/reject result files individually (per-file subset, as approve works today) or approve/reject whole artifact set together? One open decision affecting implementation: per-file requires new home for approval state (§6 a/b) since Option B removes implicit plaintext-copy signal; all-together needs none. Re-wrap must only ever cover **approved** files.
-
-**Out of scope (recorded so not lost; UX/product decide later):**
-
-- Renaming "Reviewer key" → role-neutral.
-- Forced regeneration, key-loss responsibility, UX regeneration/access-split questions.
-- Legacy/beta data handling, concurrent-study key association.
-
----
-
-## 9. Key file references
-
-**TOA** — `src/app/api/job/encrypt-results.ts` (encryption), `src/app/management-app-requests.ts` (fetches org public keys).
-
-**MA**
-
-- `src/app/api/job/[jobId]/results/route.ts` — **ingest point** (decompose here)
-- `src/app/api/job/[jobId]/keys/route.ts` — public-keys endpoint
-- `src/server/storage.ts` — `storeStudyEncryptedResultsFile` (zip today), `storeApprovedJobFile` (plaintext — to remove)
-- `src/server/actions/study-job.actions.ts` — `approve/rejectStudyJobFilesAction`; server-side `ResultsReader.listFiles` precedent (:72-76)
-- `src/server/db/queries.ts` — `getOrgIdForJobId` (enclave org), `getOrgPublicKeys` (INNER JOIN = has-key filter); **needs new lab-org query keyed on `submittedByOrgId`**
-- `src/server/actions/user-keys.actions.ts` — public-key write path (role-agnostic)
-- `src/lib/permissions.ts:67-70` — key-gen gate (enclave-only today)
-- `src/components/require-reviewer-key.tsx`, `src/app/account/invitation/[inviteId]/create-account.action.ts:155`, `src/server/actions/user.actions.ts` — key-gen onboarding gates
-- `src/hooks/use-decrypt-files.ts`, `src/hooks/use-encrypted-files-panel.ts`, `src/components/encrypted-files-panel.tsx` — client decrypt + per-file selection
-- review views: `src/app/[orgSlug]/study/[studyId]/review/...`; researcher view: `.../study/[studyId]/view/...`
-
-**si-encryption** — `job-results/writer.ts` (envelope encryption), `job-results/reader.ts` (decryption — needs zip-free primitive + expose AES key), `job-results/types.ts`, `util/keypair.ts`.
-
----
-
-## 11. ⛔ ABANDONED ALTERNATIVE — re-encrypt at approve
-
-> **NOT the chosen approach.** Kept only to record what was tried + why we rejected it. We went **re-wrap (§4/§5)**. This re-encrypt version was built this session (tests green, uncommitted) and is being discarded — see DECISION LOG at top. Rejected because: weak/no revocation, new ciphertext each approve, and it diverges from the team's documented re-wrap architecture + Phil's stated preference. Its only advantage (no lib change) wasn't worth losing the long-term-correct foundation for Cards 73/74.
-
-**Zero encryption-lib changes. No schema changes.** Reuses existing `ResultsWriter`/`ResultsReader`.
-
-**Unchanged:** TOA ingest (stores `encrypted-results.zip` as-is), the DO **review** read path (`fetchEncryptedJobFilesAction` + `use-decrypt-files` + panel decrypt of the original zip with the reviewer key). Card 72 key-gen (researchers already generate keys).
-
-**Changes — the approve write + approved-file viewing become encrypted:**
-
-1. **Approve (client, `job-review-buttons`):** the DO browser already holds the decrypted plaintext from review. For each selected approved file it re-encrypts with the **existing `ResultsWriter([...reviewerKeys, ...researcherKeys])`** → an encrypted zip, and sends those to the server. **Plaintext never leaves the browser** (improvement over today, where approve POSTs plaintext).
-    - Recipients = enclave org keys (reviewers, so DO can still view post-approval) + lab org keys (researchers). New `fetchResultsRecipientKeysAction({jobId})`.
-2. **Approve (server, `approveStudyJobFilesAction`):** stores the re-encrypted zips via `storeApprovedJobFile` (now ciphertext, not plaintext). Sets `FILES-APPROVED` + `reviewerId`. No plaintext write.
-    - **Revocation note (future / Card 74):** re-encrypt cannot cleanly _revoke_ a recipient who has left the lab (they may have decrypted already, and the box model is needed for true per-recipient removal). A code comment flags this at the approve site. Out of scope now.
-3. **Approved viewing (`fetchApprovedJobFilesAction` → blob + metadata; researcher `components/job-results.tsx` + DO post-approval):** returns the encrypted approved zips; the client decrypts with the viewer's key via the **same** `use-decrypt-files` path. Researchers decrypt with their key; reviewers with theirs (both are recipients).
-
-**Kept from the reverted build:** `getLabPublicKeysForJob(jobId)` query (lab keys keyed on `study.submittedByOrgId`) — re-added; needed for recipient assembly.
-
-**Per-file / all-or-nothing (§6):** unaffected — re-encrypt only the selected files. Approval signal stays "APPROVED-\* row exists" (unchanged from today), just encrypted content.
-
-### Status (verified)
-
-- **Both** results-approve paths re-encrypt now (plaintext fully removed): `approveStudyJobFilesAction` (JobReviewButtons) **and** `approveStudyProposalAction`→`approveJobCode` (StudyReviewButtons / redesign). Shared client helper `src/lib/re-encrypt-results.ts`.
-- `tsc` 0 errors, eslint clean.
-- Unit tests **run in the `mgmnt-app` docker container** (host can't reach pg; port not published). Green: `encrypted-files-panel`, `study-job.actions`, `study-results`, `study-review-buttons`, `study.actions`, `study-results-redesign`. Run one-file-at-a-time with `NODE_OPTIONS=--max-old-space-size=4096` — running several suites together OOMs the container (exit 137).
-- Behavioral test change: approved files now require decryption to view, so panel/study-results tests assert approved **rows by name** (decrypt covered by the dedicated decrypt tests) rather than plaintext download links.
-- Revocation limitation (Card 74) noted in code at `approveStudyJobFilesAction` + `approveJobCode`.
-
-- **Round-trip test added:** `src/server/actions/results-reencryption.test.ts` — real crypto, no mocks. Enclave reviewer (test PEM key) + lab researcher (distinct generated key) on a cross-org study; calls the real `reEncryptApprovedFiles` and asserts both the researcher's own key AND the reviewer's key decrypt the re-encrypted output back to plaintext. (Gotcha: pass `researcherId` to `insertTestStudyJobData` so it doesn't seed a fake-key enclave user that breaks `ResultsWriter`.)
-
-Cross-repo: nothing — encryption lib untouched.
-
----
-
-## 12. Running the unit tests (non-obvious)
-
-Unit tests are **DB-backed** and the Postgres container's port is **not published to the host** → `pnpm exec vitest` on the host fails with `missing ARN DB_SECRET_ARN`. Run **inside the `mgmnt-app` docker container** (repo bind-mounted at `/app`, `DATABASE_URL` set):
-
-```
-docker exec mgmnt-app pnpm exec vitest run <test-file>
-```
-
-- Run **one file at a time**. Batching suites or `CI=1` (turns on coverage) **OOM-kills the container** (exit 137).
-- Heavy React suites (e.g. study-results) may need `NODE_OPTIONS=--max-old-space-size=4096`, but for most files the default is fine and 4096 can itself trip the kill — try default first.
-- A `137` is often just the harness's 120s timeout on vitest cold start, not real OOM (container had ~6GB free). Give it a longer timeout / re-run.
-- User keeps the docker stack up (`mgmnt-app`, `management-app-postgres-1`, `editor-service`, seaweedfs, dbgate).
-
-## 13. Current git state + recommended clean start for re-wrap
-
-**As of handoff:** branch `researcher-encrypted-results`. A **merge of `main` is IN PROGRESS** (`.git/MERGE_HEAD` present); the one conflict — `src/hooks/use-workspace-launcher.tsx` — was **resolved (took main's refactor) and staged**. The **re-encrypt implementation is in the working tree, uncommitted** (it was never committed — that commit was interrupted). The earlier re-wrap build is **not** present (reverted).
-
-**Recommended clean start (re-wrap):**
-
-1. This doc's edits are uncommitted — the durable copy of the plan is the handoff in `/tmp` (and the design doc on disk). Don't lose them to a reset.
-2. Discard the abandoned re-encrypt working tree + finish the main merge cleanly. Either complete the in-progress merge then `git reset --hard` away the re-encrypt files, or `git merge --abort` and re-`git merge main` (resolve `use-workspace-launcher.tsx` = **take main's version**, drop the HEAD block).
-3. Build re-wrap fresh per §5 steps 0→5. Step 0b (the `si-encryption` lib change) needs **Phil's OK** first.

From d8feec250e01f857515c0507c42f53397d522d27 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Thu, 11 Jun 2026 11:45:13 -0400
Subject: [PATCH 20/45] Update comments/verbiage to be more consistent

---
 .../review/job-review-buttons.test.tsx        |  6 +--
 .../[studyId]/review/job-review-buttons.tsx   |  2 +-
 .../[studyId]/review/study-review-buttons.tsx |  2 +-
 src/app/api/job/[jobId]/results/route.test.ts | 12 ++++--
 src/components/encrypted-files-panel.test.tsx |  2 +-
 src/components/job-results.tsx                |  7 ++--
 .../1780000000000_study_job_file_keys.ts      |  2 +-
 .../seeds/1743608138837_test_users.ts         |  2 +-
 src/hooks/use-encrypted-files-panel.ts        |  4 +-
 src/lib/re-wrap-results.ts                    | 11 ++---
 src/lib/types.ts                              |  7 ++--
 src/server/actions/study-job.actions.ts       | 33 +++++++--------
 src/server/actions/study.actions.ts           |  8 ++--
 src/server/db/queries.ts                      |  2 +-
 src/server/results-sharing.ts                 | 40 ++++++++++---------
 src/server/storage.ts                         | 10 ++---
 16 files changed, 78 insertions(+), 72 deletions(-)

diff --git a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx
index 54f479dfc..6a3398d10 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx
@@ -119,13 +119,13 @@ describe('Study Results Approve/Reject buttons', async () => {
             expect(latestJob.statusChanges.find((sc) => sc.status === 'FILES-APPROVED')).not.toBeUndefined()
         })
 
-        // The re-wrapped researcher box was persisted against the real file row.
-        const boxes = await db
+        // The re-wrapped researcher key was persisted against the real file row.
+        const wrappedKeys = await db
             .selectFrom('studyJobFileKey')
             .select('fingerprint')
             .where('studyJobFileId', '=', row.id)
             .execute()
-        expect(boxes.length).toBeGreaterThan(0)
+        expect(wrappedKeys.length).toBeGreaterThan(0)
     })
 
     it('can reject results', async () => {
diff --git a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx
index a59ee277b..0759f4c8b 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx
@@ -44,7 +44,7 @@ export const JobReviewButtons = ({
 
             if (status === 'FILES-APPROVED') {
                 // Re-wrap each approved file's AES key for the lab researchers, client-side.
-                // Only the new wrapped keys (PO boxes) are sent — never the raw key or plaintext.
+                // Only the new wrapped keys are sent — never the raw key or plaintext.
                 const sharedFiles = await buildSharedFiles(job.studyId, decryptedResults)
                 await approveStudyJobFilesAction({ orgSlug, jobInfo, sharedFiles })
             }
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
index 84f18e1af..c5346c641 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
@@ -36,7 +36,7 @@ export const StudyReviewButtons: FC<{ study: SelectedStudy; approvedFiles?: JobF
         mutationFn: async (status: StudyStatus) => {
             if (status === 'APPROVED') {
                 // Re-wrap approved result files for the lab researchers client-side; the
-                // server receives only wrapped keys (PO boxes), never plaintext.
+                // server receives only wrapped keys, never plaintext.
                 const sharedFiles = approvedFiles?.length ? await buildSharedFiles(study.id, approvedFiles) : undefined
                 return approveStudyProposalAction({
                     orgSlug,
diff --git a/src/app/api/job/[jobId]/results/route.test.ts b/src/app/api/job/[jobId]/results/route.test.ts
index 9dfc970c4..cf88c2b53 100644
--- a/src/app/api/job/[jobId]/results/route.test.ts
+++ b/src/app/api/job/[jobId]/results/route.test.ts
@@ -20,7 +20,7 @@ vi.mock('@/server/aws', () => ({
     signedUrlForFile: vi.fn(),
 }))
 
-// TOA uploads a ResultsWriter zip; ingest decomposes it into per-file rows + PO boxes.
+// TOA uploads a ResultsWriter zip; ingest decomposes it into per-file rows + wrapped keys.
 async function buildEncryptedZip(fileName: string, content: string): Promise<File> {
     const publicKey = pemToArrayBuffer(await readTestSupportFile('public_key.pem'))
     const fingerprint = await fingerprintKeyData(publicKey)
@@ -56,9 +56,13 @@ test.skipIf(!s3Available)('uploading results', async () => {
     expect(sr).toMatchObject({ name: 'output.csv', fileType: 'ENCRYPTED-RESULT' })
     expect(sr.iv).toBeTruthy()
 
-    // The manifest's recipient key became a PO box row.
-    const boxes = await db.selectFrom('studyJobFileKey').select('crypt').where('studyJobFileId', '=', sr.id).execute()
-    expect(boxes.length).toBeGreaterThan(0)
+    // The manifest's recipient key became a study_job_file_key row.
+    const wrappedKeys = await db
+        .selectFrom('studyJobFileKey')
+        .select('crypt')
+        .where('studyJobFileId', '=', sr.id)
+        .execute()
+    expect(wrappedKeys.length).toBeGreaterThan(0)
 
     const contents = await fetchFileContents(sr.path)
     expect(contents).toBeInstanceOf(Blob)
diff --git a/src/components/encrypted-files-panel.test.tsx b/src/components/encrypted-files-panel.test.tsx
index 15b4cc233..051528e99 100644
--- a/src/components/encrypted-files-panel.test.tsx
+++ b/src/components/encrypted-files-panel.test.tsx
@@ -269,7 +269,7 @@ describe('EncryptedFilesPanel', () => {
         const shared = await insertEncryptedRow(job, { name: 'first.csv', fileType: 'ENCRYPTED-RESULT', bytes: 1024 })
         await insertEncryptedRow(job, { name: 'second.csv', fileType: 'ENCRYPTED-RESULT', bytes: 2048 })
 
-        // Only first.csv has a researcher PO box → it's the shared/approved one.
+        // Only first.csv has a researcher wrapped key → it's the shared/approved one.
         vi.mocked(fetchSharedFileIdsAction).mockResolvedValue([shared.id])
 
         const latestJob = await latestJobForStudy(study.id)
diff --git a/src/components/job-results.tsx b/src/components/job-results.tsx
index d969a7385..40fa1386e 100644
--- a/src/components/job-results.tsx
+++ b/src/components/job-results.tsx
@@ -53,9 +53,10 @@ const FileRow: FC<{ label: string; name: string; decrypted?: JobFileInfo }> = ({
 }
 
 // Researcher-facing view of shared results. There is no plaintext copy: the researcher
-// decrypts the encrypted file bodies with their own key (the PO box the reviewer re-wrapped
-// for them at approve). The file list is shown before decryption — names aren't secret, and
-// the reviewer panel lists them too — and only View/Download are gated behind the key.
+// decrypts the encrypted file bodies with their own key (the wrapped key the reviewer
+// produced for them at approve). The file list is shown before decryption — names aren't
+// secret, and the reviewer panel lists them too — and only View/Download are gated behind
+// the key.
 export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
     const [decryptedFiles, setDecryptedFiles] = useState<JobFileInfo[]>()
 
diff --git a/src/database/migrations/1780000000000_study_job_file_keys.ts b/src/database/migrations/1780000000000_study_job_file_keys.ts
index c324761f1..abdd73a57 100644
--- a/src/database/migrations/1780000000000_study_job_file_keys.ts
+++ b/src/database/migrations/1780000000000_study_job_file_keys.ts
@@ -8,7 +8,7 @@ export async function up(db: Kysely<unknown>): Promise<void> {
     await db.schema.alterTable('study_job_file').addColumn('bytes', 'integer').execute()
 
     // Records the durable fact that a reviewer approved (and shared) this file. The
-    // per-recipient `study_job_file_key` boxes are the *access* mechanism; approval is a
+    // per-recipient `study_job_file_key` rows are the *access* mechanism; approval is a
     // historical event and must not be re-derived from current org membership (which can
     // change). A file is approved iff approved_at is set.
     await db.schema.alterTable('study_job_file').addColumn('approved_at', 'timestamptz').execute()
diff --git a/src/database/seeds/1743608138837_test_users.ts b/src/database/seeds/1743608138837_test_users.ts
index 4038b0862..7dea831fa 100644
--- a/src/database/seeds/1743608138837_test_users.ts
+++ b/src/database/seeds/1743608138837_test_users.ts
@@ -249,7 +249,7 @@ export async function seed(db: Kysely<DB>): Promise<void> {
     // Every test user belongs to an org that requires an encryption key (enclave or lab), so the
     // RequireReviewerKey gate redirects them to key generation until one exists. Seed the shared
     // test public key (tests/support/public_key.pem) — NOT a placeholder — so results encrypted
-    // for it by the e2e (bin/debug/upload-results.ts) produce a PO box whose fingerprint matches
+    // for it by the e2e (bin/debug/upload-results.ts) produce a wrapped key whose fingerprint matches
     // the seeded user, and decrypt with tests/support/private_key.pem.
     // Inlined from si-encryption's pemToArrayBuffer/fingerprintKeyData: importing that package
     // pulls in `debug`, whose CJS require('tty') crashes the esbuild ESM bundle the migrator
diff --git a/src/hooks/use-encrypted-files-panel.ts b/src/hooks/use-encrypted-files-panel.ts
index 109c3ab19..4cd975c92 100644
--- a/src/hooks/use-encrypted-files-panel.ts
+++ b/src/hooks/use-encrypted-files-panel.ts
@@ -49,8 +49,8 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
     // Once a job is approved, files the DO withheld are surfaced as "not shared" (red X) rather than hidden.
     const isJobApproved = (job.statusChanges ?? []).some((sc) => sc.status === 'FILES-APPROVED')
 
-    // Which files have been shared with researchers (a lab-org PO box exists). Existence
-    // of a box is the approval/shared signal — there is no plaintext approved copy.
+    // Which files have been shared with researchers (a lab-org wrapped key exists). Existence
+    // of a wrapped key is the approval/shared signal — there is no plaintext approved copy.
     const { data: sharedFileIds = [] } = useQuery({
         queryKey: ['shared-file-ids', job.id],
         queryFn: () => fetchSharedFileIdsAction({ jobId: job.id }),
diff --git a/src/lib/re-wrap-results.ts b/src/lib/re-wrap-results.ts
index 0e188bb52..31e2eecb3 100644
--- a/src/lib/re-wrap-results.ts
+++ b/src/lib/re-wrap-results.ts
@@ -1,16 +1,13 @@
 import { wrapAesKey } from 'si-encryption/job-results/crypto'
 import { actionResult } from '@/lib/utils'
 import { fetchLabPublicKeysAction } from '@/server/actions/study-job.actions'
-import type { JobFileInfo } from '@/lib/types'
-
-export type SharedFileBox = { fingerprint: string; crypt: string }
-export type SharedFile = { studyJobFileId: string; boxes: SharedFileBox[] }
+import type { JobFileInfo, SharedFile } from '@/lib/types'
 
 /**
  * Re-wrap (not re-encrypt) approved files for the study's lab researchers, client-side.
  *
  * The reviewer's browser already holds each file's raw AES key from decrypting to review.
- * For every researcher public key we wrap that same key into a new "PO box" (`crypt`); the
+ * For every researcher public key we wrap that same key into a new wrapped key (`crypt`); the
  * file ciphertext is never touched. The server only ever receives wrapped keys — never the
  * raw AES key or plaintext.
  */
@@ -21,13 +18,13 @@ export async function buildSharedFiles(studyId: string, files: JobFileInfo[]): P
         files.map(async (file) => {
             if (!file.rawAesKey) throw new Error(`missing raw AES key for file ${file.sourceId}`)
             const rawAesKey = file.rawAesKey
-            const boxes = await Promise.all(
+            const keys = await Promise.all(
                 labKeys.map(async (key) => ({
                     fingerprint: key.fingerprint,
                     crypt: await wrapAesKey(rawAesKey, key.publicKey),
                 })),
             )
-            return { studyJobFileId: file.sourceId, boxes }
+            return { studyJobFileId: file.sourceId, keys }
         }),
     )
 }
diff --git a/src/lib/types.ts b/src/lib/types.ts
index 985d0afd0..fbe23ffc2 100644
--- a/src/lib/types.ts
+++ b/src/lib/types.ts
@@ -216,11 +216,12 @@ export const jobFileSchema = z.object({
     fileType: fileTypeSchema,
 })
 
-// A re-wrapped AES key for one researcher recipient of one approved file.
-export const sharedFileBoxSchema = z.object({ fingerprint: z.string(), crypt: z.string() })
+// A re-wrapped AES key for one researcher recipient of one approved file
+// (a `study_job_file_key` row; see src/server/results-sharing.ts for the model).
+export const sharedFileKeySchema = z.object({ fingerprint: z.string(), crypt: z.string() })
 export const sharedFileSchema = z.object({
     studyJobFileId: z.string(),
-    boxes: z.array(sharedFileBoxSchema),
+    keys: z.array(sharedFileKeySchema),
 })
 export type SharedFile = z.infer<typeof sharedFileSchema>
 
diff --git a/src/server/actions/study-job.actions.ts b/src/server/actions/study-job.actions.ts
index 9f239918a..1cf14c1dd 100644
--- a/src/server/actions/study-job.actions.ts
+++ b/src/server/actions/study-job.actions.ts
@@ -12,7 +12,7 @@ import {
     latestJobForStudy,
 } from '@/server/db/queries'
 import { onStudyResultsApproved, onStudyResultsRejected } from '@/server/events'
-import { insertSharedFileBoxes } from '@/server/results-sharing'
+import { insertSharedFileKeys } from '@/server/results-sharing'
 import { fetchFileContents } from '@/server/storage'
 import { Action, z } from './action'
 
@@ -36,15 +36,16 @@ export const approveStudyJobFilesAction = new Action('approveStudyJobFilesAction
     .handler(async ({ params: { jobInfo: info, sharedFiles }, session, db }) => {
         // Re-wrap, not re-encrypt: the reviewer's browser unwrapped each file's AES key
         // while reviewing and wrapped it for the lab researchers' public keys. Here we
-        // only persist those new "PO box" rows — the file ciphertext is never touched and
-        // the server never sees plaintext or the raw AES key. Adding a box = sharing;
+        // only persist those new wrapped-key rows — the file ciphertext is never touched and
+        // the server never sees plaintext or the raw AES key. Adding a wrapped key = sharing;
         // deleting one (future / Card 74) = revoking.
         //
-        // BACKFILL GAP (Card 73/74): boxes are wrapped only for lab members who have a key
+        // BACKFILL GAP (Card 73/74): keys are wrapped only for lab members who have a key
         // *right now*. A researcher who joins the lab or generates their key after approval
-        // gets no box and cannot read already-approved results. Re-wrapping for late joiners
-        // (the reviewer no longer holds the raw AES key, so this needs a recovery flow) lands here.
-        await insertSharedFileBoxes(db, info.studyJobId, sharedFiles, session.user.id)
+        // gets no wrapped key and cannot read already-approved results. Re-wrapping for late
+        // joiners (the reviewer no longer holds the raw AES key, so this needs a recovery flow)
+        // lands here.
+        await insertSharedFileKeys(db, info.studyJobId, sharedFiles, session.user.id)
 
         await db
             .insertInto('jobStatusChange')
@@ -76,8 +77,8 @@ export const fetchLabPublicKeysAction = new Action('fetchLabPublicKeysAction')
         return await getLabPublicKeysForStudy(studyId)
     })
 
-// IDs of files already shared with researchers (a lab-org PO box exists). The
-// existence of a box is the "approved & shared" signal — there is no plaintext copy.
+// IDs of files already shared with researchers (a lab-org wrapped key exists). The
+// existence of a wrapped key is the "approved & shared" signal — there is no plaintext copy.
 export const fetchSharedFileIdsAction = new Action('fetchSharedFileIdsAction')
     .params(z.object({ jobId: z.string() }))
     .middleware(async ({ params: { jobId } }) => {
@@ -188,8 +189,8 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
 
     .handler(async ({ studyJob, session, db }) => {
         // Per decomposed file (Option B): each row is one encrypted body in S3 + an `iv`,
-        // with the requesting user's wrapped AES key ("PO box") in study_job_file_key.
-        // We return only files this user actually has a box for — others stay opaque.
+        // with the requesting user's wrapped AES key in study_job_file_key.
+        // We return only files this user actually has a wrapped key for — others stay opaque.
         const userKey = await getReviewerPublicKey(session.user.id)
         if (!userKey) return []
 
@@ -198,9 +199,9 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
         )
         if (!encryptedFiles.length) return []
 
-        // One query for all of this user's boxes, then fetch the matching bodies in parallel —
-        // avoids a per-file round trip to both Postgres and S3.
-        const boxes = await db
+        // One query for all of this user's wrapped keys, then fetch the matching bodies in
+        // parallel — avoids a per-file round trip to both Postgres and S3.
+        const wrappedKeys = await db
             .selectFrom('studyJobFileKey')
             .select(['studyJobFileId', 'crypt'])
             .where(
@@ -210,11 +211,11 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
             )
             .where('fingerprint', '=', userKey.fingerprint)
             .execute()
-        const cryptByFileId = new Map(boxes.map((b) => [b.studyJobFileId, b.crypt]))
+        const cryptByFileId = new Map(wrappedKeys.map((k) => [k.studyJobFileId, k.crypt]))
 
         const ready = encryptedFiles.flatMap((file) => {
             const crypt = cryptByFileId.get(file.id)
-            // No box for this user, or no iv to decrypt with → stays opaque. A null `iv` means
+            // No wrapped key for this user, or no iv to decrypt with → stays opaque. A null `iv` means
             // a legacy (pre-decompose) job; those have no encrypted body here and fall back to
             // the legacy plaintext download route (src/app/dl/results/...). Intended, not a gap.
             return crypt && file.iv ? [{ file, crypt, iv: file.iv }] : []
diff --git a/src/server/actions/study.actions.ts b/src/server/actions/study.actions.ts
index dea505b70..6895244d5 100644
--- a/src/server/actions/study.actions.ts
+++ b/src/server/actions/study.actions.ts
@@ -31,7 +31,7 @@ import {
     onStudyNeedsClarification,
     onStudyRejected,
 } from '@/server/events'
-import { insertSharedFileBoxes } from '@/server/results-sharing'
+import { insertSharedFileKeys } from '@/server/results-sharing'
 import { triggerBuildImageForJob } from '../aws'
 import { SIMULATE_CODE_BUILD } from '../config'
 import { bareExtension } from '@/lib/paths'
@@ -317,9 +317,9 @@ async function approveJobCode({
     }
 
     if (sharedFiles?.length) {
-        // Re-wrap: persist only the per-researcher wrapped AES keys ("PO boxes") the
-        // reviewer's browser produced. Ciphertext is untouched; no plaintext is stored.
-        await insertSharedFileBoxes(db, job.id, sharedFiles, userId)
+        // Re-wrap: persist only the per-researcher wrapped AES keys the reviewer's
+        // browser produced. Ciphertext is untouched; no plaintext is stored.
+        await insertSharedFileKeys(db, job.id, sharedFiles, userId)
     }
 }
 
diff --git a/src/server/db/queries.ts b/src/server/db/queries.ts
index f37280298..fb0b0a741 100644
--- a/src/server/db/queries.ts
+++ b/src/server/db/queries.ts
@@ -490,7 +490,7 @@ export async function getLabPublicKeysForStudy(studyId: string): Promise<PublicK
 /**
  * IDs of this job's files a reviewer approved & shared with researchers. Driven by the
  * recorded `approved_at` fact, not by current org membership — removing a researcher from
- * the lab must not retroactively un-approve files (see `insertSharedFileBoxes`).
+ * the lab must not retroactively un-approve files (see `insertSharedFileKeys`).
  */
 export async function getSharedFileIdsForJob(jobId: string): Promise<string[]> {
     const rows = await Action.db
diff --git a/src/server/results-sharing.ts b/src/server/results-sharing.ts
index 952f575a1..8f254241e 100644
--- a/src/server/results-sharing.ts
+++ b/src/server/results-sharing.ts
@@ -4,19 +4,21 @@ import type { SharedFile } from '@/lib/types'
 import { getLabPublicKeysForJob } from '@/server/db/queries'
 
 /**
- * Persist re-wrapped AES keys ("PO boxes") that grant lab researchers access to approved
- * files, and record the approval itself on each file. Each box is validated against the
- * lab org's known public keys so a client can never share a file with an arbitrary
- * fingerprint. Idempotent via the (study_job_file_id, fingerprint) unique constraint. The
- * file ciphertext is untouched.
+ * Persist re-wrapped AES keys that grant lab researchers access to approved files, and
+ * record the approval itself on each file. Each `study_job_file_key` row works like a PO
+ * box: anyone can deposit (the reviewer wraps the file's AES key to a recipient's public
+ * key), but only the holder of the matching private key can open it. Each wrapped key is
+ * validated against the lab org's known public keys so a client can never share a file with
+ * an arbitrary fingerprint. Idempotent via the (study_job_file_id, fingerprint) unique
+ * constraint. The file ciphertext is untouched.
  *
  * Approval is recorded as `approved_at`/`approved_by_user_id` on the file row — the durable
- * historical fact — rather than being inferred from box existence. The boxes are the access
- * mechanism; revoking later (Card 74) by deleting a box is *prospective only*: a researcher
- * who already unwrapped the AES key keeps it, so deleting a box stops future reads, not past
- * ones.
+ * historical fact — rather than being inferred from wrapped-key existence. The wrapped keys
+ * are the access mechanism; revoking later (Card 74) by deleting one is *prospective only*:
+ * a researcher who already unwrapped the AES key keeps it, so deletion stops future reads,
+ * not past ones.
  */
-export async function insertSharedFileBoxes(
+export async function insertSharedFileKeys(
     db: DBExecutor,
     jobId: string,
     sharedFiles: SharedFile[],
@@ -25,17 +27,17 @@ export async function insertSharedFileBoxes(
     const labKeys = await getLabPublicKeysForJob(jobId)
     const labFingerprints = new Set(labKeys.map((k) => k.fingerprint))
 
-    // We validate that each box targets a real lab recipient, but — the server being blind —
-    // we cannot verify the `crypt` actually wraps the file's correct AES key. A buggy reviewer
-    // client could persist a box that unwraps to garbage; the researcher would just fail to
-    // decrypt downstream. The reviewer client is trusted (it wraps the same key it just used to
-    // review), so this is accepted by design rather than guarded here.
+    // We validate that each wrapped key targets a real lab recipient, but — the server being
+    // blind — we cannot verify the `crypt` actually wraps the file's correct AES key. A buggy
+    // reviewer client could persist one that unwraps to garbage; the researcher would just fail
+    // to decrypt downstream. The reviewer client is trusted (it wraps the same key it just used
+    // to review), so this is accepted by design rather than guarded here.
     const rows = sharedFiles.flatMap((file) =>
-        file.boxes.map((box) => {
-            if (!labFingerprints.has(box.fingerprint)) {
-                throw new ActionFailure({ file: `fingerprint ${box.fingerprint} is not a lab recipient` })
+        file.keys.map((key) => {
+            if (!labFingerprints.has(key.fingerprint)) {
+                throw new ActionFailure({ file: `fingerprint ${key.fingerprint} is not a lab recipient` })
             }
-            return { studyJobFileId: file.studyJobFileId, fingerprint: box.fingerprint, crypt: box.crypt }
+            return { studyJobFileId: file.studyJobFileId, fingerprint: key.fingerprint, crypt: key.crypt }
         }),
     )
 
diff --git a/src/server/storage.ts b/src/server/storage.ts
index 2b5b70889..240b61295 100644
--- a/src/server/storage.ts
+++ b/src/server/storage.ts
@@ -38,11 +38,11 @@ async function storeJobFile(info: MinimalJobInfo, path: string, file: File, file
 /**
  * Decompose a ResultsWriter zip on ingest (Option B): each encrypted file body
  * becomes its own S3 object, and its metadata (iv, bytes) + per-recipient wrapped
- * keys (the DO/reviewer "PO boxes" from the manifest) are stored in Postgres.
+ * keys (the DO/reviewer recipients from the manifest) are stored in Postgres.
  *
  * Touches no plaintext and needs no private key — the manifest is plaintext
  * metadata and the bodies stay ciphertext. One row per decomposed file; sharing
- * a file later = adding a `study_job_file_key` box, never re-encrypting.
+ * a file later = adding a `study_job_file_key` row, never re-encrypting.
  *
  * Trust model is honest-but-curious: the server is the storage authority for the
  * ciphertext bodies + IVs but is trusted not to tamper with them. The AES-CBC
@@ -68,7 +68,7 @@ async function storeDecomposedEncryptedFiles(info: MinimalJobInfo, file: File, f
     try {
         return await db.transaction().execute(async (trx) => {
             const rows = []
-            const boxes = []
+            const wrappedKeys = []
             for (const { entry, path } of items) {
                 const row = await trx
                     .insertInto('studyJobFile')
@@ -84,11 +84,11 @@ async function storeDecomposedEncryptedFiles(info: MinimalJobInfo, file: File, f
                     .executeTakeFirstOrThrow()
 
                 for (const [fingerprint, { crypt }] of Object.entries(entry.keys)) {
-                    boxes.push({ studyJobFileId: row.id, fingerprint, crypt })
+                    wrappedKeys.push({ studyJobFileId: row.id, fingerprint, crypt })
                 }
                 rows.push(row)
             }
-            if (boxes.length) await trx.insertInto('studyJobFileKey').values(boxes).execute()
+            if (wrappedKeys.length) await trx.insertInto('studyJobFileKey').values(wrappedKeys).execute()
             return rows
         })
     } catch (err) {

From b8c009240d84f9ce3c181dcb6197faafc4d4c63b Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Thu, 11 Jun 2026 14:44:03 -0400
Subject: [PATCH 21/45] Update verbiage to reflect results key instead of
 reviewer key

---
 src/app/[orgSlug]/dashboard/page.test.tsx     |   1 -
 .../review/study-results-redesign.test.tsx    |   4 +-
 .../review/study-results-redesign.tsx         |   7 +-
 .../[studyId]/review/study-results.test.tsx   |   6 +-
 .../[inviteId]/create-account.action.test.ts  |  12 +-
 .../[inviteId]/create-account.action.ts       |   8 +-
 .../invitation/[inviteId]/join-team/page.tsx  |   2 +-
 src/app/account/keys/generate-keys.test.tsx   |  14 +--
 src/app/account/keys/generate-keys.tsx        |  31 +++--
 src/app/account/keys/page.tsx                 |   4 +-
 src/app/account/signin/mfa.tsx                |   4 +-
 src/app/account/signin/sign-in-form.tsx       |   2 +-
 .../dl/results/[jobId]/[fileName]/route.ts    |   1 -
 src/app/reviewer-key/layout.tsx               |   4 +-
 src/app/reviewer-key/regenerate-key.test.tsx  |   8 +-
 src/app/reviewer-key/regenerate-key.tsx       |  17 ++-
 src/components/encrypted-files-panel.test.tsx |   2 +-
 src/components/encrypted-files-panel.tsx      |  37 ++----
 src/components/job-results.tsx                |  36 +++---
 src/components/layout/app-shell.tsx           |   4 +-
 src/components/layout/navbar-profile-menu.tsx |   5 +-
 src/components/private-key-form.tsx           |  50 ++++++++
 src/components/require-mfa.test.tsx           |   6 +-
 ...key.test.tsx => require-user-key.test.tsx} |  20 ++--
 ...-reviewer-key.tsx => require-user-key.tsx} |  10 +-
 .../seeds/1743608138837_test_users.ts         |   2 +-
 src/hooks/use-encrypted-files-panel.ts        |  18 +--
 src/lib/file-type-helpers.ts                  |  16 ---
 src/lib/permission-types.ts                   |   7 +-
 src/lib/permissions.test.ts                   |   8 +-
 src/lib/permissions.ts                        |   4 +-
 src/lib/types.ts                              |   7 --
 src/server/actions/org.actions.ts             |   8 +-
 src/server/actions/study-job.actions.test.ts  |  36 ++++++
 src/server/actions/study-job.actions.ts       |  12 +-
 src/server/actions/user-keys.actions.test.ts  |  24 ++--
 src/server/actions/user-keys.actions.ts       |  26 ++---
 src/server/actions/user.actions.test.ts       |   4 +-
 src/server/actions/user.actions.ts            |   6 +-
 src/server/db/queries.test.ts                 |   8 +-
 src/server/db/queries.ts                      |  12 +-
 src/server/results-sharing.test.ts            | 110 ++++++++++++++++++
 src/server/results-sharing.ts                 |   3 +
 tests/study-flow.spec.ts                      |   2 +-
 44 files changed, 366 insertions(+), 242 deletions(-)
 create mode 100644 src/components/private-key-form.tsx
 rename src/components/{require-reviewer-key.test.tsx => require-user-key.test.tsx} (66%)
 rename src/components/{require-reviewer-key.tsx => require-user-key.tsx} (70%)
 create mode 100644 src/server/results-sharing.test.ts

diff --git a/src/app/[orgSlug]/dashboard/page.test.tsx b/src/app/[orgSlug]/dashboard/page.test.tsx
index 58454622b..47a9247cf 100644
--- a/src/app/[orgSlug]/dashboard/page.test.tsx
+++ b/src/app/[orgSlug]/dashboard/page.test.tsx
@@ -12,7 +12,6 @@ import OrgDashboardPage from './page'
 vi.mock('@/server/actions/org.actions', async () => {
     return {
         getOrgFromSlugAction: vi.fn(),
-        getReviewerPublicKeyAction: vi.fn(),
     }
 })
 
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
index 73bb10b44..b4e7625b2 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
@@ -69,7 +69,7 @@ describe('StudyResultsRedesign', () => {
         renderWithProviders(<StudyResultsRedesign job={job!} />)
 
         expect(screen.getByText(RUN_COMPLETE_SECONDARY_TEXT)).toBeInTheDocument()
-        expect(screen.getByPlaceholderText('Enter your Reviewer key to access encrypted content.')).toBeInTheDocument()
+        expect(screen.getByPlaceholderText('Enter your Results Key to access encrypted content.')).toBeInTheDocument()
         expect(screen.queryByText(/Enter Reviewer Key to view/i)).not.toBeInTheDocument()
     })
 
@@ -145,7 +145,7 @@ describe('StudyResultsRedesign', () => {
         expect(screen.queryByRole('button', { name: /^Reject$/ })).not.toBeInTheDocument()
 
         const privateKey = await readTestSupportFile('private_key.pem')
-        const input = screen.getByPlaceholderText('Enter your Reviewer key to access encrypted content.')
+        const input = screen.getByPlaceholderText('Enter your Results Key to access encrypted content.')
         fireEvent.change(input, { target: { value: privateKey } })
         fireEvent.click(screen.getByRole('button', { name: 'Decrypt Files' }))
 
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.tsx
index 79128c471..f0c0397a4 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.tsx
@@ -58,12 +58,7 @@ export const StudyResultsRedesign: FC<{
                 </Group>
                 <Divider c="dimmed" />
                 <StatusCopy job={job} />
-                <EncryptedFilesPanel
-                    job={job}
-                    onFilesApproved={handleFilesApproved}
-                    hideKeyLabel
-                    hideTableUntilDecrypted
-                />
+                <EncryptedFilesPanel job={job} onFilesApproved={handleFilesApproved} hideTableUntilDecrypted />
             </Stack>
         </Paper>
     )
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
index 97dcb2a07..fe53e5fde 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
@@ -149,7 +149,7 @@ describe('View Study Results', () => {
         renderWithProviders(<StudyResults job={job} />)
 
         expect(screen.getByText(/While logs are not available at this time/)).toBeDefined()
-        expect(screen.queryByPlaceholderText('Enter your Reviewer key to access encrypted content.')).toBeNull()
+        expect(screen.queryByPlaceholderText('Enter your Results Key to access encrypted content.')).toBeNull()
         expect(screen.queryByText(/Review the error logs/)).toBeNull()
         expect(screen.queryByText('Job ID:')).toBeNull()
     })
@@ -163,7 +163,7 @@ describe('View Study Results', () => {
 
         expect(screen.getByText(/Review the error logs before these can be shared with the researcher/)).toBeDefined()
         expect(screen.getByText('Job ID:')).toBeDefined()
-        expect(screen.getByPlaceholderText('Enter your Reviewer key to access encrypted content.')).toBeDefined()
+        expect(screen.getByPlaceholderText('Enter your Results Key to access encrypted content.')).toBeDefined()
         expect(screen.queryByText(/While logs are not available at this time/)).toBeNull()
     })
 
@@ -185,7 +185,7 @@ describe('View Study Results', () => {
         const job = await latestJobForStudy(study.id)
         renderWithProviders(<StudyResults job={job} />)
 
-        const input = screen.getByPlaceholderText('Enter your Reviewer key to access encrypted content.')
+        const input = screen.getByPlaceholderText('Enter your Results Key to access encrypted content.')
         fireEvent.change(input, { target: { value: await readTestSupportFile('private_key.pem') } })
         fireEvent.click(screen.getByRole('button', { name: 'Decrypt Files' }))
 
diff --git a/src/app/account/invitation/[inviteId]/create-account.action.test.ts b/src/app/account/invitation/[inviteId]/create-account.action.test.ts
index d4fb48ca6..1fc9323bb 100644
--- a/src/app/account/invitation/[inviteId]/create-account.action.test.ts
+++ b/src/app/account/invitation/[inviteId]/create-account.action.test.ts
@@ -187,7 +187,7 @@ describe('Create Account Actions', () => {
         )
     })
 
-    it('onJoinTeamAccountAction returns needsReviewerKey true for enclave org without existing key', async () => {
+    it('onJoinTeamAccountAction returns needsUserKey true for enclave org without existing key', async () => {
         const labOrg = await insertTestOrg({ slug: faker.string.alpha(10), type: 'lab' })
         const { user } = await insertTestUser({ org: labOrg })
 
@@ -205,10 +205,10 @@ describe('Create Account Actions', () => {
             .executeTakeFirstOrThrow()
 
         const result = actionResult(await onJoinTeamAccountAction({ inviteId: invite.id }))
-        expect(result.needsReviewerKey).toBe(true)
+        expect(result.needsUserKey).toBe(true)
     })
 
-    it('onJoinTeamAccountAction returns needsReviewerKey false for enclave org with existing key', async () => {
+    it('onJoinTeamAccountAction returns needsUserKey false for enclave org with existing key', async () => {
         const { user } = await insertTestUser({ org })
 
         const enclaveOrg = await insertTestOrg({ slug: faker.string.alpha(10) })
@@ -225,10 +225,10 @@ describe('Create Account Actions', () => {
             .executeTakeFirstOrThrow()
 
         const result = actionResult(await onJoinTeamAccountAction({ inviteId: invite.id }))
-        expect(result.needsReviewerKey).toBe(false)
+        expect(result.needsUserKey).toBe(false)
     })
 
-    it('onJoinTeamAccountAction returns needsReviewerKey true for lab org without existing key', async () => {
+    it('onJoinTeamAccountAction returns needsUserKey true for lab org without existing key', async () => {
         // insertTestUser only auto-creates a key for enclave-org users, so seed this user in a
         // lab org to keep them key-less and exercise the lab researcher gate.
         const existingLabOrg = await insertTestOrg({ slug: faker.string.alpha(10), type: 'lab' })
@@ -248,7 +248,7 @@ describe('Create Account Actions', () => {
             .executeTakeFirstOrThrow()
 
         const result = actionResult(await onJoinTeamAccountAction({ inviteId: invite.id }))
-        expect(result.needsReviewerKey).toBe(true)
+        expect(result.needsUserKey).toBe(true)
     })
 
     it('onRevokeInviteAction removes invite', async () => {
diff --git a/src/app/account/invitation/[inviteId]/create-account.action.ts b/src/app/account/invitation/[inviteId]/create-account.action.ts
index ba23c365a..190aead0b 100644
--- a/src/app/account/invitation/[inviteId]/create-account.action.ts
+++ b/src/app/account/invitation/[inviteId]/create-account.action.ts
@@ -2,7 +2,7 @@
 
 import { Action, ActionFailure, z } from '@/server/actions/action'
 import { updateClerkUserMetadata } from '@/server/clerk'
-import { getReviewerPublicKey } from '@/server/db/queries'
+import { getUserPublicKey } from '@/server/db/queries'
 import { onUserAcceptInvite } from '@/server/events'
 import { extractClerkCodeAndMessage, isClerkApiError } from '@/lib/errors'
 import { clerkClient } from '@clerk/nextjs/server'
@@ -145,7 +145,7 @@ export const onJoinTeamAccountAction = new Action('onJoinTeamAccountAction')
             .where('claimedByUserId', 'is', null)
             .executeTakeFirst()
 
-        // The client-side RequireReviewerKey guard depends on Clerk's useUser() metadata,
+        // The client-side RequireUserKey guard depends on Clerk's useUser() metadata,
         // which may be stale right after this server-side update. We check here so callers
         // can redirect to the key generation page immediately.
         const org = await db
@@ -154,9 +154,9 @@ export const onJoinTeamAccountAction = new Action('onJoinTeamAccountAction')
             .where('org.id', '=', invite.orgId)
             .executeTakeFirstOrThrow()
 
-        const needsReviewerKey = orgNeedsKey(org) && !(await getReviewerPublicKey(siUser.id))
+        const needsUserKey = orgNeedsKey(org) && !(await getUserPublicKey(siUser.id))
 
-        return { ...siUser, needsReviewerKey }
+        return { ...siUser, needsUserKey }
     })
 
 export const onCreateAccountAction = new Action('onCreateAccountAction')
diff --git a/src/app/account/invitation/[inviteId]/join-team/page.tsx b/src/app/account/invitation/[inviteId]/join-team/page.tsx
index fa53dfd0c..71230ec9e 100644
--- a/src/app/account/invitation/[inviteId]/join-team/page.tsx
+++ b/src/app/account/invitation/[inviteId]/join-team/page.tsx
@@ -60,7 +60,7 @@ const AddTeam: FC<InviteProps> = ({ params }) => {
             // short delay to ensure the token is propagated before navigation
             await new Promise((resolve) => setTimeout(resolve, 500))
 
-            if (result?.needsReviewerKey) {
+            if (result?.needsUserKey) {
                 router.push(Routes.accountKeys)
             } else {
                 router.push(Routes.orgDashboard({ orgSlug: org!.slug }))
diff --git a/src/app/account/keys/generate-keys.test.tsx b/src/app/account/keys/generate-keys.test.tsx
index 1b83c8a74..ccc73670d 100644
--- a/src/app/account/keys/generate-keys.test.tsx
+++ b/src/app/account/keys/generate-keys.test.tsx
@@ -1,4 +1,4 @@
-import { setReviewerPublicKeyAction } from '@/server/actions/user-keys.actions'
+import { setUserPublicKeyAction } from '@/server/actions/user-keys.actions'
 import { mockClerkSession, renderWithProviders } from '@/tests/unit.helpers'
 import { useUser } from '@clerk/nextjs'
 import { UseUserReturn } from '@clerk/types'
@@ -12,11 +12,11 @@ vi.mock('si-encryption/util/keypair', () => ({
 }))
 
 vi.mock('@/server/actions/user-keys.actions', () => ({
-    setReviewerPublicKeyAction: vi.fn(),
+    setUserPublicKeyAction: vi.fn(),
 }))
 
-describe('Reviewer keypair generation', () => {
-    it('should generate a reviewer key pair and display private key for copying', async () => {
+describe('Results Keypair generation', () => {
+    it('should generate a Results Key pair and display private key for copying', async () => {
         vi.mocked(useUser).mockReturnValue({
             user: {
                 firstName: 'Tester',
@@ -42,7 +42,7 @@ describe('Reviewer keypair generation', () => {
 
         await waitFor(() => {
             expect(vi.mocked(generateKeyPair)).toHaveBeenCalled()
-            expect(screen.getByText('Reviewer key', { selector: 'h1' })).toBeDefined()
+            expect(screen.getByText('Results Key', { selector: 'h1' })).toBeDefined()
         })
 
         // Simulate copy button click
@@ -58,7 +58,7 @@ describe('Reviewer keypair generation', () => {
         fireEvent.click(dashboardButton)
 
         await waitFor(() => {
-            expect(screen.getByText('Make sure you have securely saved your reviewer key.')).toBeDefined()
+            expect(screen.getByText('Make sure you have securely saved your Results Key.')).toBeDefined()
         })
 
         fireEvent.click(screen.getByRole('button', { name: 'Yes, go to dashboard' }))
@@ -66,7 +66,7 @@ describe('Reviewer keypair generation', () => {
         // Wait for state updates
         await waitFor(() => {
             // Verify that setMemberUserPublicKey was called
-            expect(setReviewerPublicKeyAction).toHaveBeenCalledWith(
+            expect(setUserPublicKeyAction).toHaveBeenCalledWith(
                 expect.objectContaining({
                     publicKey: mockKeys.exportedPublicKey,
                     fingerprint: mockKeys.fingerprint,
diff --git a/src/app/account/keys/generate-keys.tsx b/src/app/account/keys/generate-keys.tsx
index be67a6ef7..a75fa9153 100644
--- a/src/app/account/keys/generate-keys.tsx
+++ b/src/app/account/keys/generate-keys.tsx
@@ -3,7 +3,7 @@
 import { useMutation } from '@/common'
 import { reportMutationError } from '@/components/errors'
 import { AppModal } from '@/components/modals/app-modal'
-import { setReviewerPublicKeyAction, updateReviewerPublicKeyAction } from '@/server/actions/user-keys.actions'
+import { setUserPublicKeyAction, updateUserPublicKeyAction } from '@/server/actions/user-keys.actions'
 import {
     Button,
     Code,
@@ -63,20 +63,19 @@ export const GenerateKeys: FC<GenerateKeysProps> = ({ isRegenerating = false })
     if (keys) {
         return (
             <Paper p="xl" mx="sm" radius="sm" maw={900} my={{ base: '1rem', lg: 0 }}>
-                {/* TODO(UX): "Reviewer key" — researchers now generate/use this same key too; rename to a role-neutral term (e.g. "Encryption key") pending UX. */}
-                <Title mb="xxl">Reviewer key</Title>
+                <Title mb="xxl">Results Key</Title>
                 <Paper shadow="xs" p="xl">
                     <Stack>
-                        <Title size="xl">Store reviewer key</Title>
+                        <Title size="xl">Store Results Key</Title>
                         <Divider c="charcoal.1" />
                         <Stack>
                             <Text size="md" mb="xs">
-                                For security reasons, this role requires you to create a reviewer key that is unique to
-                                you. You will use this reviewer key to access encrypted results. Please copy and store
+                                For security reasons, this role requires you to create a Results Key that is unique to
+                                you. You will use this Results Key to access encrypted results. Please copy and store
                                 this key in a safe location.
                             </Text>
                             <Text size="sm" fw={600}>
-                                Copy and store your reviewer key
+                                Copy and store your Results Key
                             </Text>
                             <Code
                                 block
@@ -90,7 +89,7 @@ export const GenerateKeys: FC<GenerateKeysProps> = ({ isRegenerating = false })
                                 {keys.privateKey}
                             </Code>
                             <Text size="sm" mb="xs">
-                                Note: Please store your reviewer key securely, such as in your password manager.
+                                Note: Please store your Results Key securely, such as in your password manager.
                             </Text>
                         </Stack>
                         <Group>
@@ -146,32 +145,32 @@ const ConfirmationModal: FC<{ onClose: () => void; isOpen: boolean; keys: Keys;
     const router = useRouter()
     const searchParams = useSearchParams()
 
-    const { mutate: saveReviewerKey, isPending: isSavingKey } = useMutation({
+    const { mutate: saveUserKey, isPending: isSavingKey } = useMutation({
         mutationFn: () => {
             if (isRegenerating) {
-                return updateReviewerPublicKeyAction({
+                return updateUserPublicKeyAction({
                     publicKey: keys.binaryPublicKey,
                     fingerprint: keys.fingerprint,
                 })
             } else {
-                return setReviewerPublicKeyAction({
+                return setUserPublicKeyAction({
                     publicKey: keys.binaryPublicKey,
                     fingerprint: keys.fingerprint,
                 })
             }
         },
-        onError: reportMutationError('Failed to save reviewer key'),
+        onError: reportMutationError('Failed to save Results Key'),
         onSuccess() {
             router.push(safeRedirectUrl(searchParams.get('redirect_url'), Routes.home))
         },
     })
 
     return (
-        <AppModal isOpen={isOpen} onClose={onClose} title="Have you stored your reviewer key?">
+        <AppModal isOpen={isOpen} onClose={onClose} title="Have you stored your Results Key?">
             <Stack>
-                <Text size="md">Make sure you have securely saved your reviewer key. </Text>
+                <Text size="md">Make sure you have securely saved your Results Key. </Text>
                 <Text size="sm" c="red.9">
-                    <b>Note:</b> SafeInsights does not store your reviewer key. If you lose your key, you won’t be able
+                    <b>Note:</b> SafeInsights does not store your Results Key. If you lose your key, you won’t be able
                     to access study results and will need to generate a new key.
                 </Text>
                 <Text size="md" mb="md">
@@ -181,7 +180,7 @@ const ConfirmationModal: FC<{ onClose: () => void; isOpen: boolean; keys: Keys;
                     <Button variant="outline" onClick={onClose}>
                         Take me back
                     </Button>
-                    <Button onClick={() => saveReviewerKey()} loading={isSavingKey}>
+                    <Button onClick={() => saveUserKey()} loading={isSavingKey}>
                         Yes, go to dashboard
                     </Button>
                 </Group>
diff --git a/src/app/account/keys/page.tsx b/src/app/account/keys/page.tsx
index a8f8da2a5..3ad038845 100644
--- a/src/app/account/keys/page.tsx
+++ b/src/app/account/keys/page.tsx
@@ -1,11 +1,11 @@
 import { actionResult } from '@/lib/utils'
-import { reviewerKeyExistsAction } from '@/server/actions/user-keys.actions'
+import { userKeyExistsAction } from '@/server/actions/user-keys.actions'
 import { GenerateKeys } from './generate-keys'
 
 export const dynamic = 'force-dynamic'
 
 export default async function KeysPage() {
-    const hasKey = actionResult(await reviewerKeyExistsAction())
+    const hasKey = actionResult(await userKeyExistsAction())
 
     return <GenerateKeys isRegenerating={hasKey} />
 }
diff --git a/src/app/account/signin/mfa.tsx b/src/app/account/signin/mfa.tsx
index ba37ab0aa..c9f7069d3 100644
--- a/src/app/account/signin/mfa.tsx
+++ b/src/app/account/signin/mfa.tsx
@@ -68,7 +68,7 @@ export const RequestMFA: FC<{ mfa: MFAState }> = ({ mfa }) => {
                 try {
                     const result = actionResult(await onUserSignInAction())
                     await auth.getToken({ skipCache: true })
-                    if (result?.redirectToReviewerKey) {
+                    if (result?.redirectToKeyGeneration) {
                         router.push(Routes.accountKeys)
                     } else {
                         let redirectUrl = safeRedirectUrl(searchParams.get('redirect_url'), Routes.dashboard)
@@ -82,7 +82,7 @@ export const RequestMFA: FC<{ mfa: MFAState }> = ({ mfa }) => {
                                     }),
                                 )
 
-                                if (joinResult?.needsReviewerKey) {
+                                if (joinResult?.needsUserKey) {
                                     redirectUrl = Routes.accountKeys as Route
                                 } else {
                                     const { slug } = actionResult(await getOrgInfoForInviteAction({ inviteId }))
diff --git a/src/app/account/signin/sign-in-form.tsx b/src/app/account/signin/sign-in-form.tsx
index 1f8a2d6a5..fc10a06c5 100644
--- a/src/app/account/signin/sign-in-form.tsx
+++ b/src/app/account/signin/sign-in-form.tsx
@@ -88,7 +88,7 @@ export const SignInForm: FC<{
                 await onComplete(false)
                 const result = actionResult(await onUserSignInAction())
                 await getToken({ skipCache: true })
-                if (result?.redirectToReviewerKey) {
+                if (result?.redirectToKeyGeneration) {
                     router.push(Routes.accountKeys as Route)
                 } else {
                     router.push(validatedRedirect)
diff --git a/src/app/dl/results/[jobId]/[fileName]/route.ts b/src/app/dl/results/[jobId]/[fileName]/route.ts
index 467e1e07d..c868b7cd4 100644
--- a/src/app/dl/results/[jobId]/[fileName]/route.ts
+++ b/src/app/dl/results/[jobId]/[fileName]/route.ts
@@ -8,7 +8,6 @@ import { canViewStudyJob } from '@/server/auth'
 // decomposed + decrypted client-side), so this path is only reachable for pre-encryption
 // studies. It can be deleted — along with pathForStudyJobResults (src/lib/paths.ts) and any
 // remaining plaintext S3 objects — once legacy studies age out.
-// REVIEWER: please flag this during review so we track the eventual removal.
 export const GET = async (_: Request, { params }: { params: Promise<{ jobId: string; fileName: string }> }) => {
     const { jobId, fileName } = await params
 
diff --git a/src/app/reviewer-key/layout.tsx b/src/app/reviewer-key/layout.tsx
index b4bfed4ea..515614206 100644
--- a/src/app/reviewer-key/layout.tsx
+++ b/src/app/reviewer-key/layout.tsx
@@ -1,6 +1,6 @@
 import { UserLayout } from '@/components/layout/user-layout'
 import { actionResult } from '@/lib/utils'
-import { reviewerKeyExistsAction } from '@/server/actions/user-keys.actions'
+import { userKeyExistsAction } from '@/server/actions/user-keys.actions'
 import { redirect } from 'next/navigation'
 
 export const dynamic = 'force-dynamic'
@@ -8,7 +8,7 @@ export const dynamic = 'force-dynamic'
 type Props = { children: React.ReactNode }
 
 export default async function ReviewerLayout({ children }: Props) {
-    const hasKey = actionResult(await reviewerKeyExistsAction())
+    const hasKey = actionResult(await userKeyExistsAction())
 
     if (!hasKey) {
         redirect('/account/keys')
diff --git a/src/app/reviewer-key/regenerate-key.test.tsx b/src/app/reviewer-key/regenerate-key.test.tsx
index 67b73e96a..81e95de56 100644
--- a/src/app/reviewer-key/regenerate-key.test.tsx
+++ b/src/app/reviewer-key/regenerate-key.test.tsx
@@ -10,11 +10,11 @@ vi.mock('si-encryption/util/keypair', () => ({
 }))
 
 vi.mock('@/server/actions/user-keys.actions', () => ({
-    updateReviewerPublicKeyAction: vi.fn(),
+    updateUserPublicKeyAction: vi.fn(),
 }))
 
-describe('Reviewer keypair regeneration', () => {
-    it('should regenerate a reviewer key pair and update public key', async () => {
+describe('Results Keypair regeneration', () => {
+    it('should regenerate a Results Key pair and update public key', async () => {
         mockClerkSession({
             clerkUserId: 'user-id',
             orgSlug: 'dev',
@@ -32,7 +32,7 @@ describe('Reviewer keypair regeneration', () => {
         renderWithProviders(<RegenerateKey />)
 
         await waitFor(() => {
-            expect(screen.getByText('Reviewer key', { selector: 'h1' })).toBeDefined()
+            expect(screen.getByText('Results Key', { selector: 'h1' })).toBeDefined()
         })
 
         // Open the modal requesting regeneration
diff --git a/src/app/reviewer-key/regenerate-key.tsx b/src/app/reviewer-key/regenerate-key.tsx
index ccfb1634a..be656edc1 100644
--- a/src/app/reviewer-key/regenerate-key.tsx
+++ b/src/app/reviewer-key/regenerate-key.tsx
@@ -24,29 +24,28 @@ export const RegenerateKey: FC = () => {
     return (
         <Stack p="xl" mx="sm">
             <PageBreadcrumbs
-                crumbs={[['Dashboard', enclaveOrg ? `/${enclaveOrg.slug}/dashboard` : '/dashboard'], ['Reviewer Key']]}
+                crumbs={[['Dashboard', enclaveOrg ? `/${enclaveOrg.slug}/dashboard` : '/dashboard'], ['Results Key']]}
             />
-            {/* TODO(UX): "Reviewer key" — researchers now use this same key too; rename to a role-neutral term (e.g. "Encryption key") pending UX. */}
-            <Title my="xxl">Reviewer key</Title>
+            <Title my="xxl">Results Key</Title>
             <Paper shadow="xs" p="xxl">
                 <Stack>
-                    <Title size="xl">Reviewer key details</Title>
+                    <Title size="xl">Results Key details</Title>
                     <Divider c="charcoal.1" />
                     <Stack gap={8}>
                         <Text size="sm" fw={600}>
-                            Reviewer key already exists
+                            Results Key already exists
                         </Text>
                         <Text size="md" mb={16}>
-                            You have already generated a reviewer key. For security reasons, SafeInsights does not store
+                            You have already generated a Results Key. For security reasons, SafeInsights does not store
                             or display it again.
                         </Text>
                         <Text size="sm" fw={600}>
                             Lost key?
                         </Text>
 
-                        <Text size="md">If you have lost your reviewer key, you will need to generate a new one.</Text>
+                        <Text size="md">If you have lost your Results Key, you will need to generate a new one.</Text>
                         <Text size="md" c="red.9" mb={8}>
-                            Note: If you generate a new reviewer key, you will no longer have access to any study
+                            Note: If you generate a new Results Key, you will no longer have access to any study
                             results associated with your previous key. This action cannot be undone.
                         </Text>
                     </Stack>
@@ -79,7 +78,7 @@ const GenerateNewKeyModal: FC<{
         <AppModal isOpen={isOpen} onClose={onClose} title="Confirm key reset">
             <Stack>
                 <Text size="md">
-                    Generating a new reviewer key will permanently remove access to study results tied to your old key.
+                    Generating a new Results Key will permanently remove access to study results tied to your old key.
                 </Text>
                 <Text size="md" mb="md">
                     This action cannot be undone.
diff --git a/src/components/encrypted-files-panel.test.tsx b/src/components/encrypted-files-panel.test.tsx
index 051528e99..1940e7fd6 100644
--- a/src/components/encrypted-files-panel.test.tsx
+++ b/src/components/encrypted-files-panel.test.tsx
@@ -84,7 +84,7 @@ async function insertEncryptedRow(
         .executeTakeFirstOrThrow()
 }
 
-const READER_KEY_PLACEHOLDER = 'Enter your Reviewer key to access encrypted content.'
+const READER_KEY_PLACEHOLDER = 'Enter your Results Key to access encrypted content.'
 
 describe('EncryptedFilesPanel', () => {
     let org: Org
diff --git a/src/components/encrypted-files-panel.tsx b/src/components/encrypted-files-panel.tsx
index 642e1ecc4..72157d4ba 100644
--- a/src/components/encrypted-files-panel.tsx
+++ b/src/components/encrypted-files-panel.tsx
@@ -6,21 +6,20 @@ import { decodeFileContents } from '@/lib/file-content-helpers'
 import { formatBytes } from '@/lib/format'
 import type { JobFile, JobFileInfo } from '@/lib/types'
 import type { LatestJobForStudy } from '@/server/db/queries'
-import { Button, Checkbox, Group, Stack, Table, Text, Textarea } from '@mantine/core'
+import { PrivateKeyForm } from '@/components/private-key-form'
+import { Button, Checkbox, Stack, Table } from '@mantine/core'
 import { CheckCircleIcon, InfoIcon, LockIcon, XCircleIcon } from '@phosphor-icons/react/dist/ssr'
 import { FC } from 'react'
 
 type EncryptedFilesPanelProps = {
     job: LatestJobForStudy
     onFilesApproved: (files: JobFileInfo[]) => void
-    hideKeyLabel?: boolean
     hideTableUntilDecrypted?: boolean
 }
 
 export const EncryptedFilesPanel: FC<EncryptedFilesPanelProps> = ({
     job,
     onFilesApproved,
-    hideKeyLabel = false,
     hideTableUntilDecrypted = false,
 }) => {
     const {
@@ -34,7 +33,6 @@ export const EncryptedFilesPanel: FC<EncryptedFilesPanelProps> = ({
         viewingFile,
         openFileViewer,
         closeFileViewer,
-        encryptedFileTypesLabel,
         selectedPaths,
         toggleFile,
     } = useEncryptedFilesPanel({ job, onFilesApproved })
@@ -55,29 +53,14 @@ export const EncryptedFilesPanel: FC<EncryptedFilesPanelProps> = ({
                     onToggle={toggleFile}
                 />
             )}
-            {shouldShowForm && (
-                <form onSubmit={handleSubmit}>
-                    <Stack>
-                        <Textarea
-                            label={
-                                hideKeyLabel ? undefined : (
-                                    // TODO(UX): "Reviewer key" — the same key now decrypts for researchers too; rename to a role-neutral term pending UX.
-                                    <Text mb="sm">{`Enter Reviewer key to view ${encryptedFileTypesLabel}`}</Text>
-                                )
-                            }
-                            resize="vertical"
-                            {...form.getInputProps('privateKey')}
-                            placeholder="Enter your Reviewer key to access encrypted content."
-                            key={form.key('privateKey')}
-                        />
-                        <Group>
-                            <Button type="submit" disabled={!form.isValid() || isLoadingBlob} loading={isDecrypting}>
-                                Decrypt Files
-                            </Button>
-                        </Group>
-                    </Stack>
-                </form>
-            )}
+            <PrivateKeyForm
+                isVisible={shouldShowForm}
+                form={form}
+                onSubmit={handleSubmit}
+                isDecrypting={isDecrypting}
+                isDisabled={isLoadingBlob}
+                submitLabel="Decrypt Files"
+            />
             <DecryptedFilePreview file={viewingFile} onClose={closeFileViewer} />
         </Stack>
     )
diff --git a/src/components/job-results.tsx b/src/components/job-results.tsx
index 40fa1386e..397728aaa 100644
--- a/src/components/job-results.tsx
+++ b/src/components/job-results.tsx
@@ -1,13 +1,14 @@
 'use client'
 
 import { FC, useMemo, useState } from 'react'
-import { Anchor, Button, Group, LoadingOverlay, Stack, Text, Textarea, useMantineTheme } from '@mantine/core'
+import { Anchor, Group, LoadingOverlay, Stack, Text, useMantineTheme } from '@mantine/core'
 import { ArrowSquareOutIcon } from '@phosphor-icons/react/dist/ssr'
 import { useQuery } from '@/common'
 import { ErrorAlert } from '@/components/errors'
 import { DownloadBlobLink } from '@/components/download-blob-link'
+import { PrivateKeyForm } from '@/components/private-key-form'
 import { isEncryptedLogType, isResultFile, logLabel } from '@/lib/file-type-helpers'
-import { useDecryptFiles, type EncryptedJobFile } from '@/hooks/use-decrypt-files'
+import { useDecryptFiles } from '@/hooks/use-decrypt-files'
 import { fetchEncryptedJobFilesAction } from '@/server/actions/study-job.actions'
 import { JobFileInfo } from '@/lib/types'
 import { LatestJobForStudy } from '@/server/db/queries'
@@ -75,7 +76,7 @@ export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
         isPending: isDecrypting,
         form,
     } = useDecryptFiles({
-        encryptedFiles: encryptedFiles as EncryptedJobFile[] | undefined,
+        encryptedFiles,
         onSuccess: setDecryptedFiles,
     })
 
@@ -88,10 +89,12 @@ export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
 
     // Results first, then logs.
     const orderedFiles = useMemo(() => {
-        const files = (encryptedFiles ?? []) as EncryptedJobFile[]
+        const files = encryptedFiles ?? []
         return [...files.filter(isResultFile), ...files.filter((f) => isEncryptedLogType(f.fileType))]
     }, [encryptedFiles])
 
+    const handleSubmit = form.onSubmit((values) => decrypt(values.privateKey))
+
     if (isError) {
         return <ErrorAlert error={error} />
     }
@@ -110,24 +113,13 @@ export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
                     decrypted={decryptedBySourceId.get(file.studyJobFileId)}
                 />
             ))}
-            {!decryptedFiles && (
-                <form onSubmit={form.onSubmit((values) => decrypt(values.privateKey))}>
-                    <Stack>
-                        <Textarea
-                            label={<Text mb="sm">Enter your key to view results</Text>}
-                            resize="vertical"
-                            placeholder="Enter your key to access encrypted results."
-                            {...form.getInputProps('privateKey')}
-                            key={form.key('privateKey')}
-                        />
-                        <Group>
-                            <Button type="submit" disabled={!form.isValid()} loading={isDecrypting}>
-                                View Results
-                            </Button>
-                        </Group>
-                    </Stack>
-                </form>
-            )}
+            <PrivateKeyForm
+                isVisible={!decryptedFiles}
+                form={form}
+                onSubmit={handleSubmit}
+                isDecrypting={isDecrypting}
+                submitLabel="View Results"
+            />
         </Stack>
     )
 }
diff --git a/src/components/layout/app-shell.tsx b/src/components/layout/app-shell.tsx
index b2d9ab3af..7470f0d5a 100644
--- a/src/components/layout/app-shell.tsx
+++ b/src/components/layout/app-shell.tsx
@@ -22,7 +22,7 @@ import { RequireMFA } from '../require-mfa'
 import { RequireUser } from '../require-user'
 
 import { ActivityContext } from '../activity-context'
-import { RequireReviewerKey } from '../require-reviewer-key'
+import { RequireUserKey } from '../require-user-key'
 import { AppNav } from './app-nav'
 import { Routes } from '@/lib/routes'
 
@@ -52,7 +52,7 @@ export function AppShell({ children }: Props) {
         >
             <RequireUser />
             <RequireMFA />
-            <RequireReviewerKey />
+            <RequireUserKey />
             <Notifications position="top-right" autoClose={NOTIFICATION_DISPLAY_MS} />
             <ActivityContext />
 
diff --git a/src/components/layout/navbar-profile-menu.tsx b/src/components/layout/navbar-profile-menu.tsx
index 559d86af9..32b4ff40a 100644
--- a/src/components/layout/navbar-profile-menu.tsx
+++ b/src/components/layout/navbar-profile-menu.tsx
@@ -90,9 +90,8 @@ export function NavbarProfileMenu() {
                 />
 
                 <Protect role={AuthRole.Reviewer}>
-                    {/* TODO(UX): "Reviewer Key" — researchers use the same key; rename to a role-neutral term pending UX. */}
                     <NavLink
-                        label="Reviewer Key"
+                        label="Results Key"
                         leftSection={<LockIcon aria-hidden="true" />}
                         onClick={navigateTo(Routes.reviewerKey)}
                         c="white"
@@ -100,7 +99,7 @@ export function NavbarProfileMenu() {
                         color="blue.7"
                         variant="filled"
                         className={styles.navLinkProfileHover}
-                        aria-label="Reviewer Key"
+                        aria-label="Results Key"
                         role="menuitem"
                         component="button"
                     />
diff --git a/src/components/private-key-form.tsx b/src/components/private-key-form.tsx
new file mode 100644
index 000000000..1a1947f0b
--- /dev/null
+++ b/src/components/private-key-form.tsx
@@ -0,0 +1,50 @@
+'use client'
+
+import type { FC, FormEventHandler } from 'react'
+import { Button, Group, Stack, Text, Textarea } from '@mantine/core'
+import type { UseFormReturnType } from '@mantine/form'
+
+export type PrivateKeyFormValues = { privateKey: string }
+
+type PrivateKeyFormProps = {
+    isVisible?: boolean
+    form: UseFormReturnType<PrivateKeyFormValues>
+    onSubmit: FormEventHandler<HTMLFormElement>
+    isDecrypting: boolean
+    isDisabled?: boolean
+    submitLabel: string
+}
+
+// Private-key entry form shared by the reviewer decrypt panel (encrypted-files-panel.tsx)
+// and the researcher results view (job-results.tsx). The key never leaves the browser —
+// it only feeds useDecryptFiles. "Results Key" is the role-neutral term: the same kind of
+// key decrypts for reviewers and researchers alike.
+export const PrivateKeyForm: FC<PrivateKeyFormProps> = ({
+    isVisible = true,
+    form,
+    onSubmit,
+    isDecrypting,
+    isDisabled = false,
+    submitLabel,
+}) => {
+    if (!isVisible) return null
+
+    return (
+        <form onSubmit={onSubmit}>
+            <Stack>
+                <Textarea
+                    label={<Text mb="sm">Enter your Results Key</Text>}
+                    resize="vertical"
+                    placeholder="Enter your Results Key to access encrypted content."
+                    {...form.getInputProps('privateKey')}
+                    key={form.key('privateKey')}
+                />
+                <Group>
+                    <Button type="submit" disabled={!form.isValid() || isDisabled} loading={isDecrypting}>
+                        {submitLabel}
+                    </Button>
+                </Group>
+            </Stack>
+        </form>
+    )
+}
diff --git a/src/components/require-mfa.test.tsx b/src/components/require-mfa.test.tsx
index deb0d59a1..3700d4f91 100644
--- a/src/components/require-mfa.test.tsx
+++ b/src/components/require-mfa.test.tsx
@@ -1,15 +1,11 @@
 import { TestingProviders } from '@/tests/providers'
 import { render, act, waitFor } from '@testing-library/react'
 import router from 'next-router-mock'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { beforeEach, describe, expect, it } from 'vitest'
 import { RequireMFA } from './require-mfa'
 import { mockClerkSession } from '@/tests/unit.helpers'
 import { faker } from '@faker-js/faker'
 
-vi.mock('@/server/actions/org.actions', () => ({
-    getReviewerPublicKeyAction: vi.fn(() => Promise.resolve(null)),
-}))
-
 const mockSessionValues = {
     clerkUserId: faker.string.uuid(),
     userId: faker.string.uuid(),
diff --git a/src/components/require-reviewer-key.test.tsx b/src/components/require-user-key.test.tsx
similarity index 66%
rename from src/components/require-reviewer-key.test.tsx
rename to src/components/require-user-key.test.tsx
index c480cbddc..33c1201b9 100644
--- a/src/components/require-reviewer-key.test.tsx
+++ b/src/components/require-user-key.test.tsx
@@ -1,8 +1,8 @@
-import { reviewerKeyExistsAction } from '@/server/actions/user-keys.actions'
+import { userKeyExistsAction } from '@/server/actions/user-keys.actions'
 import { useSession } from '@/hooks/session'
 import { render, waitFor } from '@testing-library/react'
 import { describe, expect, it, Mock, vi } from 'vitest'
-import { RequireReviewerKey } from './require-reviewer-key'
+import { RequireUserKey } from './require-user-key'
 
 vi.mock('@/hooks/session', () => ({ useSession: vi.fn() }))
 
@@ -12,31 +12,31 @@ vi.mock('next/navigation', () => ({
 }))
 
 vi.mock('@/server/actions/user-keys.actions', () => ({
-    reviewerKeyExistsAction: vi.fn(),
+    userKeyExistsAction: vi.fn(),
 }))
 
 const mockSessionOrgs = (orgs: Record<string, { type: string }>) =>
     (useSession as Mock).mockReturnValue({ session: { orgs } })
 
-describe('RequireReviewerKey', () => {
+describe('RequireUserKey', () => {
     it('redirects when key is missing', async () => {
         mockSessionOrgs({ enclave: { type: 'enclave' } })
-        ;(reviewerKeyExistsAction as Mock).mockResolvedValue(false)
-        render(<RequireReviewerKey />)
+        ;(userKeyExistsAction as Mock).mockResolvedValue(false)
+        render(<RequireUserKey />)
         await waitFor(() => expect(push).toHaveBeenCalledWith('/account/keys'))
     })
 
     it('does nothing when key exists', async () => {
         mockSessionOrgs({ enclave: { type: 'enclave' } })
-        ;(reviewerKeyExistsAction as Mock).mockResolvedValue(true)
-        render(<RequireReviewerKey />)
+        ;(userKeyExistsAction as Mock).mockResolvedValue(true)
+        render(<RequireUserKey />)
         expect(push).not.toHaveBeenCalled()
     })
 
     it('redirects lab researchers without a key', async () => {
         mockSessionOrgs({ lab: { type: 'lab' } })
-        ;(reviewerKeyExistsAction as Mock).mockResolvedValue(false)
-        render(<RequireReviewerKey />)
+        ;(userKeyExistsAction as Mock).mockResolvedValue(false)
+        render(<RequireUserKey />)
         await waitFor(() => expect(push).toHaveBeenCalledWith('/account/keys'))
     })
 })
diff --git a/src/components/require-reviewer-key.tsx b/src/components/require-user-key.tsx
similarity index 70%
rename from src/components/require-reviewer-key.tsx
rename to src/components/require-user-key.tsx
index 1e744d11b..2cb9ae1ac 100644
--- a/src/components/require-reviewer-key.tsx
+++ b/src/components/require-user-key.tsx
@@ -2,28 +2,28 @@
 
 import { orgNeedsKey } from '@/lib/types'
 import { actionResult } from '@/lib/utils'
-import { reviewerKeyExistsAction } from '@/server/actions/user-keys.actions'
+import { userKeyExistsAction } from '@/server/actions/user-keys.actions'
 import { useRouter } from 'next/navigation'
 import { useLayoutEffect } from 'react'
 import { useSession } from '../hooks/session'
 import { Routes } from '@/lib/routes'
 
-export const RequireReviewerKey = () => {
+export const RequireUserKey = () => {
     const { session } = useSession()
     const router = useRouter()
 
     useLayoutEffect(() => {
-        const checkForReviewerKey = async () => {
+        const checkForUserKey = async () => {
             const needsKey = Object.values(session?.orgs || {}).some(orgNeedsKey)
             if (!session || !needsKey) return
 
-            const hasKey = actionResult(await reviewerKeyExistsAction())
+            const hasKey = actionResult(await userKeyExistsAction())
 
             if (!hasKey) {
                 router.push(Routes.accountKeys)
             }
         }
-        checkForReviewerKey()
+        checkForUserKey()
     }, [session, router])
 
     return null
diff --git a/src/database/seeds/1743608138837_test_users.ts b/src/database/seeds/1743608138837_test_users.ts
index 7dea831fa..f4ebebdab 100644
--- a/src/database/seeds/1743608138837_test_users.ts
+++ b/src/database/seeds/1743608138837_test_users.ts
@@ -247,7 +247,7 @@ export async function seed(db: Kysely<DB>): Promise<void> {
     }
 
     // Every test user belongs to an org that requires an encryption key (enclave or lab), so the
-    // RequireReviewerKey gate redirects them to key generation until one exists. Seed the shared
+    // RequireUserKey gate redirects them to key generation until one exists. Seed the shared
     // test public key (tests/support/public_key.pem) — NOT a placeholder — so results encrypted
     // for it by the e2e (bin/debug/upload-results.ts) produce a wrapped key whose fingerprint matches
     // the seeded user, and decrypt with tests/support/private_key.pem.
diff --git a/src/hooks/use-encrypted-files-panel.ts b/src/hooks/use-encrypted-files-panel.ts
index 4cd975c92..d91339f0f 100644
--- a/src/hooks/use-encrypted-files-panel.ts
+++ b/src/hooks/use-encrypted-files-panel.ts
@@ -1,7 +1,6 @@
 import { useQuery } from '@/common'
-import { useDecryptFiles, type EncryptedJobFile } from '@/hooks/use-decrypt-files'
+import { useDecryptFiles } from '@/hooks/use-decrypt-files'
 import { isEncryptedLogType, isResultFile, logLabel } from '@/lib/file-type-helpers'
-import { toSentence } from '@/lib/string'
 import type { JobFile, JobFileInfo } from '@/lib/types'
 import { fetchEncryptedJobFilesAction, fetchSharedFileIdsAction } from '@/server/actions/study-job.actions'
 import type { LatestJobForStudy } from '@/server/db/queries'
@@ -32,8 +31,8 @@ function isEncryptedFile(fileType: FileType): boolean {
 }
 
 // State precedence: shared (approved) wins as the durable signal; otherwise a freshly
-// decrypted file is selectable; an approved job with no box for this file means it was
-// withheld; everything else is still locked.
+// decrypted file is selectable; an approved job where this file was never approved means
+// it was withheld; everything else is still locked.
 function fileRowState(opts: { shared: boolean; decrypted: boolean; jobApproved: boolean }): FileRowState {
     if (opts.shared) return 'approved'
     if (opts.decrypted) return 'decrypted'
@@ -49,8 +48,8 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
     // Once a job is approved, files the DO withheld are surfaced as "not shared" (red X) rather than hidden.
     const isJobApproved = (job.statusChanges ?? []).some((sc) => sc.status === 'FILES-APPROVED')
 
-    // Which files have been shared with researchers (a lab-org wrapped key exists). Existence
-    // of a wrapped key is the approval/shared signal — there is no plaintext approved copy.
+    // Which files have been shared with researchers, per the recorded `approved_at` fact on
+    // each file row (see getSharedFileIdsForJob) — there is no plaintext approved copy.
     const { data: sharedFileIds = [] } = useQuery({
         queryKey: ['shared-file-ids', job.id],
         queryFn: () => fetchSharedFileIdsAction({ jobId: job.id }),
@@ -75,7 +74,7 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
         isPending: isDecrypting,
         form,
     } = useDecryptFiles({
-        encryptedFiles: encryptedFiles as EncryptedJobFile[] | undefined,
+        encryptedFiles,
         onSuccess: (files) => {
             setDecryptedFiles(files)
             setSelectedPaths(new Set(files.filter(isResultFile).map((f) => f.path)))
@@ -100,10 +99,6 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
 
     const shouldShowForm = encryptedRows.length > 0 && decryptedFiles.length === 0
 
-    const encryptedFileTypesLabel = toSentence([
-        ...new Set(encryptedRows.map((f) => logLabel(f.fileType).toLowerCase())),
-    ])
-
     const decryptedById = useMemo(() => {
         const map = new Map<string, JobFileInfo>()
         for (const f of decryptedFiles) map.set(f.sourceId, f)
@@ -149,7 +144,6 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
         hasFileRows,
         isLoadingBlob,
         shouldShowForm,
-        encryptedFileTypesLabel,
         selectedPaths,
         toggleFile,
         isDecrypting,
diff --git a/src/lib/file-type-helpers.ts b/src/lib/file-type-helpers.ts
index fb728510a..46ebe18d6 100644
--- a/src/lib/file-type-helpers.ts
+++ b/src/lib/file-type-helpers.ts
@@ -21,10 +21,6 @@ export const ENCRYPTED_TO_APPROVED: Record<string, FileType> = {
     'ENCRYPTED-PACKAGING-ERROR-LOG': 'APPROVED-PACKAGING-ERROR-LOG',
 }
 
-export const APPROVED_TO_ENCRYPTED: Record<string, FileType> = Object.fromEntries(
-    Object.entries(ENCRYPTED_TO_APPROVED).map(([encrypted, approved]) => [approved, encrypted as FileType]),
-)
-
 const LOG_LABELS: Partial<Record<FileType, string>> = {
     'APPROVED-CODE-RUN-LOG': 'Code Run Log',
     'APPROVED-SECURITY-SCAN-LOG': 'Security Scan Log',
@@ -36,18 +32,6 @@ const LOG_LABELS: Partial<Record<FileType, string>> = {
     'PACKAGING-ERROR-LOG': 'Packaging Error Log',
 }
 
-export function approvedTypeForFile(fileType: FileType): FileType {
-    const approved = ENCRYPTED_TO_APPROVED[fileType]
-    if (!approved) throw new Error(`Unknown file type ${fileType}`)
-    return approved
-}
-
-export function encryptedTypeForApproved(fileType: FileType): FileType {
-    const encrypted = APPROVED_TO_ENCRYPTED[fileType]
-    if (!encrypted) throw new Error(`Unknown file type ${fileType}`)
-    return encrypted
-}
-
 export function isEncryptedLogType(fileType: FileType): boolean {
     return ENCRYPTED_LOG_TYPES.includes(fileType)
 }
diff --git a/src/lib/permission-types.ts b/src/lib/permission-types.ts
index f662d19c5..36eaff94b 100644
--- a/src/lib/permission-types.ts
+++ b/src/lib/permission-types.ts
@@ -42,7 +42,12 @@ type Abilities =
     | Ability<'Study', 'view' | 'create', { orgId?: UUID; submittedByOrgId?: UUID }>
     | Ability<'Study', 'review' | 'approve' | 'reject' | 'update' | 'delete', { orgId?: UUID; submittedByOrgId?: UUID }>
     | Ability<'StudyJob', 'view' | 'create' | 'delete', { orgId?: UUID; submittedByOrgId?: UUID }>
-    | Ability<'ReviewerKey', 'view' | 'update', object>
+    // NOTE(reviewers): renamed from 'ReviewerKey' — the same encryption key is now held by
+    // enclave reviewers AND lab researchers (orgNeedsKey), so the old name was misleading.
+    // The /reviewer-key URL and Routes.reviewerKey are intentionally unchanged (route
+    // definition changes are gated); UI copy now says "Results Key". Flag if you'd rather
+    // keep the old subject name or rename the route too.
+    | Ability<'UserKey', 'view' | 'update', object>
     | Ability<'Org', 'view' | 'update' | 'create' | 'delete', { orgId?: UUID; orgSlug?: string }>
     | Ability<'OrgMembers', 'view', { orgId?: UUID; orgSlug?: string }>
     | Ability<'Orgs', 'view', object>
diff --git a/src/lib/permissions.test.ts b/src/lib/permissions.test.ts
index 926ebedf1..07eaca8f0 100644
--- a/src/lib/permissions.test.ts
+++ b/src/lib/permissions.test.ts
@@ -39,8 +39,8 @@ test('reviewer role', () => {
     expect(ability.can('update', toRecord('User', { id: faker.string.uuid() }))).toBe(false)
 
     // enclave members hold a key to decrypt results for review
-    expect(ability.can('view', 'ReviewerKey')).toBe(true)
-    expect(ability.can('update', 'ReviewerKey')).toBe(true)
+    expect(ability.can('view', 'UserKey')).toBe(true)
+    expect(ability.can('update', 'UserKey')).toBe(true)
 })
 
 test('researcher role', () => {
@@ -57,8 +57,8 @@ test('researcher role', () => {
     expect(ability.can('invite', toRecord('User', { orgId: session.orgs.test.id }))).toBe(false)
 
     // lab members also hold a key now, to decrypt approved results
-    expect(ability.can('view', 'ReviewerKey')).toBe(true)
-    expect(ability.can('update', 'ReviewerKey')).toBe(true)
+    expect(ability.can('view', 'UserKey')).toBe(true)
+    expect(ability.can('update', 'UserKey')).toBe(true)
 })
 
 test('admin role', () => {
diff --git a/src/lib/permissions.ts b/src/lib/permissions.ts
index b4646303b..fcd051091 100644
--- a/src/lib/permissions.ts
+++ b/src/lib/permissions.ts
@@ -65,8 +65,8 @@ export function defineAbilityFor(session: UserSession) {
 
     // users who belong to any key-holding org (enclave or lab) can view/create/update their keys
     if (orgs.some(orgNeedsKey)) {
-        permit('view', 'ReviewerKey')
-        permit('update', 'ReviewerKey')
+        permit('view', 'UserKey')
+        permit('update', 'UserKey')
     }
 
     // allow review of studies for enclave orgs that the user belongs to
diff --git a/src/lib/types.ts b/src/lib/types.ts
index fbe23ffc2..b0c775ae6 100644
--- a/src/lib/types.ts
+++ b/src/lib/types.ts
@@ -209,13 +209,6 @@ const FILE_TYPES = [
 
 export const fileTypeSchema = z.enum(FILE_TYPES)
 
-export const jobFileSchema = z.object({
-    path: z.string(),
-    contents: z.instanceof(ArrayBuffer),
-    sourceId: z.string(),
-    fileType: fileTypeSchema,
-})
-
 // A re-wrapped AES key for one researcher recipient of one approved file
 // (a `study_job_file_key` row; see src/server/results-sharing.ts for the model).
 export const sharedFileKeySchema = z.object({ fingerprint: z.string(), crypt: z.string() })
diff --git a/src/server/actions/org.actions.ts b/src/server/actions/org.actions.ts
index 949d0ad15..80a0113a2 100644
--- a/src/server/actions/org.actions.ts
+++ b/src/server/actions/org.actions.ts
@@ -3,7 +3,7 @@
 import { ActionSuccessType } from '@/lib/types'
 import { orgSchema, updateOrgSchema } from '@/schema/org'
 import { revalidatePath } from 'next/cache'
-import { getReviewerPublicKeyByUserId, orgIdFromSlug } from '../db/queries'
+import { orgIdFromSlug } from '../db/queries'
 import { Action, z } from './action'
 import { Language } from '@/database/types'
 
@@ -192,12 +192,6 @@ export const getOrgFromSlugAction = new Action('getOrgFromSlugAction')
     .requireAbilityTo('view', 'Org')
     .handler(async ({ org }) => org)
 
-// TODO: move this to a more appropriate place, likely a reviewers.actions.ts file
-// also all we really need is if they have a public key, so we can just return a boolean
-export const getReviewerPublicKeyAction = new Action('getReviewerPublicKeyAction')
-    .requireAbilityTo('view', 'ReviewerKey')
-    .handler(async ({ session }) => getReviewerPublicKeyByUserId(session.user.id))
-
 export type OrgUserReturn = ActionSuccessType<typeof getUsersForOrgAction>[number]
 
 export const updateOrgSettingsAction = new Action('updateOrgSettingsAction')
diff --git a/src/server/actions/study-job.actions.test.ts b/src/server/actions/study-job.actions.test.ts
index 4588c3835..5471863f6 100644
--- a/src/server/actions/study-job.actions.test.ts
+++ b/src/server/actions/study-job.actions.test.ts
@@ -64,6 +64,42 @@ describe('Study Job Actions', () => {
         expect(result[0].studyJobFileId).toBe(file.id)
     })
 
+    // Regression: the middleware must expose submittedByOrgId so the CASL 'view StudyJob'
+    // rule matches lab researchers, not just enclave reviewers — researchers fetch their
+    // re-wrapped result files through this same action.
+    test('fetchEncryptedJobFilesAction permits lab researchers to fetch their shared files', async () => {
+        const { org, user } = await mockSessionWithTestData({ orgType: 'lab' })
+        const { job } = await insertTestStudyJobData({ org })
+
+        // Lab test users are seeded without a key; give this researcher one plus a wrapped key.
+        await db
+            .insertInto('userPublicKey')
+            .values({ userId: user.id, publicKey: Buffer.from('labPublicKey'), fingerprint: 'labFingerprint1' })
+            .executeTakeFirstOrThrow()
+
+        const file = await db
+            .insertInto('studyJobFile')
+            .values({
+                path: 'results/encrypted/results.csv',
+                name: 'results.csv',
+                studyJobId: job.id,
+                fileType: 'ENCRYPTED-RESULT',
+                iv: 'aXY=',
+            })
+            .returning('id')
+            .executeTakeFirstOrThrow()
+
+        await db
+            .insertInto('studyJobFileKey')
+            .values({ studyJobFileId: file.id, fingerprint: 'labFingerprint1', crypt: 'wrapped-for-researcher' })
+            .executeTakeFirstOrThrow()
+
+        const result = actionResult(await fetchEncryptedJobFilesAction({ jobId: job.id }))
+
+        expect(result).toHaveLength(1)
+        expect(result[0].crypt).toBe('wrapped-for-researcher')
+    })
+
     test('fetchEncryptedJobFilesAction omits files the user has no box for', async () => {
         const { org } = await mockSessionWithTestData({ orgType: 'enclave' })
         const { job } = await insertTestStudyJobData({ org })
diff --git a/src/server/actions/study-job.actions.ts b/src/server/actions/study-job.actions.ts
index 1cf14c1dd..b92f397fb 100644
--- a/src/server/actions/study-job.actions.ts
+++ b/src/server/actions/study-job.actions.ts
@@ -5,7 +5,7 @@ import { isEncryptedLogType } from '@/lib/file-type-helpers'
 import { minimalJobInfoSchema, sharedFileSchema } from '@/lib/types'
 import {
     getLabPublicKeysForStudy,
-    getReviewerPublicKey,
+    getUserPublicKey,
     getSharedFileIdsForJob,
     getStudyJobInfo,
     getStudyReviewForJob,
@@ -77,8 +77,8 @@ export const fetchLabPublicKeysAction = new Action('fetchLabPublicKeysAction')
         return await getLabPublicKeysForStudy(studyId)
     })
 
-// IDs of files already shared with researchers (a lab-org wrapped key exists). The
-// existence of a wrapped key is the "approved & shared" signal — there is no plaintext copy.
+// IDs of files a reviewer approved & shared with researchers, per the recorded `approved_at`
+// fact on each file row (see getSharedFileIdsForJob). There is no plaintext approved copy.
 export const fetchSharedFileIdsAction = new Action('fetchSharedFileIdsAction')
     .params(z.object({ jobId: z.string() }))
     .middleware(async ({ params: { jobId } }) => {
@@ -191,7 +191,7 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
         // Per decomposed file (Option B): each row is one encrypted body in S3 + an `iv`,
         // with the requesting user's wrapped AES key in study_job_file_key.
         // We return only files this user actually has a wrapped key for — others stay opaque.
-        const userKey = await getReviewerPublicKey(session.user.id)
+        const userKey = await getUserPublicKey(session.user.id)
         if (!userKey) return []
 
         const encryptedFiles = studyJob.files.filter(
@@ -221,6 +221,10 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
             return crypt && file.iv ? [{ file, crypt, iv: file.iv }] : []
         })
 
+        // TODO(perf): every ciphertext body is buffered into server memory and serialized
+        // through the server-action layer. Fine at current result sizes; if results grow
+        // large, switch to returning signed S3 URLs and let the client fetch/decrypt as a
+        // stream (also relevant: `study_job_file.bytes` is `integer`, capping at ~2.15 GB).
         return Promise.all(
             ready.map(async ({ file, crypt, iv }) => ({
                 studyJobFileId: file.id,
diff --git a/src/server/actions/user-keys.actions.test.ts b/src/server/actions/user-keys.actions.test.ts
index 66dfd38bb..87c095fd8 100644
--- a/src/server/actions/user-keys.actions.test.ts
+++ b/src/server/actions/user-keys.actions.test.ts
@@ -1,9 +1,9 @@
 import { describe, expect, it, vi } from 'vitest'
 import { mockSessionWithTestData, actionResult } from '@/tests/unit.helpers'
 import {
-    getReviewerPublicKeyAction,
-    setReviewerPublicKeyAction,
-    updateReviewerPublicKeyAction,
+    getUserPublicKeyAction,
+    setUserPublicKeyAction,
+    updateUserPublicKeyAction,
 } from './user-keys.actions'
 import { db } from '@/database'
 
@@ -21,11 +21,11 @@ describe('User Keys Actions', () => {
         const fingerprint = 'lab-fingerprint'
         await db.insertInto('userPublicKey').values({ userId: user.id, publicKey, fingerprint }).execute()
 
-        const result = actionResult(await getReviewerPublicKeyAction())
+        const result = actionResult(await getUserPublicKeyAction())
         expect(result?.fingerprint).toEqual(fingerprint)
     })
 
-    it('getReviewerPublicKeyAction returns the public key for the current user', async () => {
+    it('getUserPublicKeyAction returns the public key for the current user', async () => {
         const { user } = await mockSessionWithTestData({ orgType: 'enclave' })
         await db.deleteFrom('userPublicKey').where('userId', '=', user.id).execute()
         const publicKey = Buffer.from('test-public-key')
@@ -33,25 +33,25 @@ describe('User Keys Actions', () => {
 
         await db.insertInto('userPublicKey').values({ userId: user.id, publicKey, fingerprint }).execute()
 
-        const result = actionResult(await getReviewerPublicKeyAction())
+        const result = actionResult(await getUserPublicKeyAction())
         expect(result).toBeDefined()
         expect(result?.fingerprint).toEqual(fingerprint)
     })
 
-    it('setReviewerPublicKeyAction sets the public key for the current user', async () => {
+    it('setUserPublicKeyAction sets the public key for the current user', async () => {
         const { user } = await mockSessionWithTestData({ orgType: 'enclave' })
         await db.deleteFrom('userPublicKey').where('userId', '=', user.id).execute()
         const publicKey = Buffer.from('new-public-key').buffer
         const fingerprint = 'new-fingerprint'
 
-        await setReviewerPublicKeyAction({ publicKey, fingerprint })
+        await setUserPublicKeyAction({ publicKey, fingerprint })
 
-        const newKeyResult = actionResult(await getReviewerPublicKeyAction())
+        const newKeyResult = actionResult(await getUserPublicKeyAction())
         expect(newKeyResult).toBeDefined()
         expect(newKeyResult?.fingerprint).toEqual(fingerprint)
     })
 
-    it('updateReviewerPublicKeyAction updates the public key for the current user', async () => {
+    it('updateUserPublicKeyAction updates the public key for the current user', async () => {
         const { user } = await mockSessionWithTestData()
         const oldPublicKey = Buffer.from('old-public-key')
         const oldFingerprint = 'old-fingerprint'
@@ -64,9 +64,9 @@ describe('User Keys Actions', () => {
         const newPublicKey = Buffer.from('new-public-key-for-update').buffer
         const newFingerprint = 'new-fingerprint-for-update'
 
-        await updateReviewerPublicKeyAction({ publicKey: newPublicKey, fingerprint: newFingerprint })
+        await updateUserPublicKeyAction({ publicKey: newPublicKey, fingerprint: newFingerprint })
 
-        const updatedKeyResult = actionResult(await getReviewerPublicKeyAction())
+        const updatedKeyResult = actionResult(await getUserPublicKeyAction())
         expect(updatedKeyResult).toBeDefined()
         expect(updatedKeyResult?.fingerprint).toEqual(newFingerprint)
     })
diff --git a/src/server/actions/user-keys.actions.ts b/src/server/actions/user-keys.actions.ts
index f98b425bd..a07470578 100644
--- a/src/server/actions/user-keys.actions.ts
+++ b/src/server/actions/user-keys.actions.ts
@@ -1,22 +1,22 @@
 'use server'
 
-import { getReviewerPublicKey } from '@/server/db/queries'
+import { getUserPublicKey } from '@/server/db/queries'
 import { onUserPublicKeyCreated, onUserPublicKeyUpdated } from '@/server/events'
 import { revalidatePath } from 'next/cache'
 import { Action, ActionFailure, z } from './action'
 
-export const getReviewerPublicKeyAction = new Action('getReviewerPublicKeyAction')
-    .requireAbilityTo('view', 'ReviewerKey')
+export const getUserPublicKeyAction = new Action('getUserPublicKeyAction')
+    .requireAbilityTo('view', 'UserKey')
     .handler(async ({ session }) => {
-        return await getReviewerPublicKey(session.user.id)
+        return await getUserPublicKey(session.user.id)
     })
 
 // Helper that returns a boolean instead of the full row so we can safely
 // pass the value to client components without serialization issues.
-export const reviewerKeyExistsAction = new Action('reviewerKeyExistsAction')
-    .requireAbilityTo('view', 'ReviewerKey')
+export const userKeyExistsAction = new Action('userKeyExistsAction')
+    .requireAbilityTo('view', 'UserKey')
     .handler(async ({ session }) => {
-        const key = await getReviewerPublicKey(session.user.id)
+        const key = await getUserPublicKey(session.user.id)
         return Boolean(key)
     })
 
@@ -25,9 +25,9 @@ const setOrgUserPublicKeySchema = z.object({
     fingerprint: z.string(),
 })
 
-export const setReviewerPublicKeyAction = new Action('setReviewerPublicKeyAction')
+export const setUserPublicKeyAction = new Action('setUserPublicKeyAction')
     .params(setOrgUserPublicKeySchema)
-    .requireAbilityTo('update', 'ReviewerKey')
+    .requireAbilityTo('update', 'UserKey')
     .handler(async ({ params: { publicKey, fingerprint }, session, db }) => {
         const userId = session.user.id
 
@@ -42,15 +42,15 @@ export const setReviewerPublicKeyAction = new Action('setReviewerPublicKeyAction
                 publicKey: Buffer.from(publicKey),
                 fingerprint,
             })
-            .executeTakeFirstOrThrow(() => new ActionFailure({ message: 'Failed to set reviewer public key' }))
+            .executeTakeFirstOrThrow(() => new ActionFailure({ message: 'Failed to set user public key' }))
 
         onUserPublicKeyCreated({ userId })
         revalidatePath('/reviewer')
     })
 
-export const updateReviewerPublicKeyAction = new Action('updateReviewerPublicKeyAction')
+export const updateUserPublicKeyAction = new Action('updateUserPublicKeyAction')
     .params(setOrgUserPublicKeySchema)
-    .requireAbilityTo('update', 'ReviewerKey')
+    .requireAbilityTo('update', 'UserKey')
     .handler(async ({ params: { publicKey, fingerprint }, session, db }) => {
         const userId = session.user.id
 
@@ -62,7 +62,7 @@ export const updateReviewerPublicKeyAction = new Action('updateReviewerPublicKey
                 updatedAt: new Date(),
             })
             .where('userId', '=', userId)
-            .executeTakeFirstOrThrow(() => new ActionFailure({ message: 'Failed to update reviewer public key.' }))
+            .executeTakeFirstOrThrow(() => new ActionFailure({ message: 'Failed to update user public key.' }))
 
         onUserPublicKeyUpdated({ userId })
     })
diff --git a/src/server/actions/user.actions.test.ts b/src/server/actions/user.actions.test.ts
index 53d54c9c6..5bc5d90e8 100644
--- a/src/server/actions/user.actions.test.ts
+++ b/src/server/actions/user.actions.test.ts
@@ -38,7 +38,7 @@ describe('User Actions', () => {
 
         const dbUser = await db.selectFrom('user').where('id', '=', user.id).selectAll('user').executeTakeFirstOrThrow()
         expect(dbUser.clerkId).toBe(user.clerkId)
-        expect(result).toEqual({ redirectToReviewerKey: true })
+        expect(result).toEqual({ redirectToKeyGeneration: true })
     })
 
     test('onUserSignInAction should not redirect if user has a public key', async () => {
@@ -52,7 +52,7 @@ describe('User Actions', () => {
         await db.deleteFrom('userPublicKey').where('userId', '=', user.id).execute()
 
         const result = await onUserSignInAction()
-        expect(result).toEqual({ redirectToReviewerKey: true })
+        expect(result).toEqual({ redirectToKeyGeneration: true })
     })
 
     test('syncUserMetadataAction should sync metadata', async () => {
diff --git a/src/server/actions/user.actions.ts b/src/server/actions/user.actions.ts
index b170caa60..78de5a012 100644
--- a/src/server/actions/user.actions.ts
+++ b/src/server/actions/user.actions.ts
@@ -2,7 +2,7 @@
 
 import { clerkClient } from '@clerk/nextjs/server'
 import { sessionFromClerk } from '../clerk'
-import { getReviewerPublicKey } from '../db/queries'
+import { getUserPublicKey } from '../db/queries'
 import { onUserLogIn, onUserResetPW, onUserRoleUpdate } from '../events'
 import { Action, z } from './action'
 import { orgNeedsKey } from '@/lib/types'
@@ -15,9 +15,9 @@ export const onUserSignInAction = new Action('onUserSignInAction').handler(async
     }
     onUserLogIn({ userId: session.user.id })
     if (Object.values(session.orgs).some(orgNeedsKey)) {
-        const publicKey = await getReviewerPublicKey(session.user.id)
+        const publicKey = await getUserPublicKey(session.user.id)
         if (!publicKey) {
-            return { redirectToReviewerKey: true }
+            return { redirectToKeyGeneration: true }
         }
     }
     return {}
diff --git a/src/server/db/queries.test.ts b/src/server/db/queries.test.ts
index 1c1ab1577..5b4d23467 100644
--- a/src/server/db/queries.test.ts
+++ b/src/server/db/queries.test.ts
@@ -14,7 +14,7 @@ import {
     getOrgIdForJobId,
     getOrgPublicKeys,
     getOrgPublicKeysRaw,
-    getReviewerPublicKey,
+    getUserPublicKey,
     getUsersForOrgId,
     jobInfoForJobId,
     studyInfoForStudyId,
@@ -54,15 +54,15 @@ async function insertRecords() {
     }
 }
 
-describe('getReviewerPublicKey', () => {
+describe('getUserPublicKey', () => {
     it('returns public key when userId is valid', async () => {
         const { org1User1 } = await insertRecords()
-        const publicKey = await getReviewerPublicKey(org1User1.id)
+        const publicKey = await getUserPublicKey(org1User1.id)
         expect(publicKey).not.toBeNull()
     })
 
     it('returns null when userId is invalid', async () => {
-        const publicKey = await getReviewerPublicKey(BLANK_UUID)
+        const publicKey = await getUserPublicKey(BLANK_UUID)
         expect(publicKey).toBeUndefined()
     })
 })
diff --git a/src/server/db/queries.ts b/src/server/db/queries.ts
index fb0b0a741..349f446f4 100644
--- a/src/server/db/queries.ts
+++ b/src/server/db/queries.ts
@@ -63,7 +63,7 @@ export async function getStudyJobInfo(studyJobId: string) {
         .executeTakeFirstOrThrow(throwNotFound(`job for study job id ${studyJobId}`))
 }
 
-export const getReviewerPublicKey = async (userId: string) => {
+export const getUserPublicKey = async (userId: string) => {
     const result = await Action.db
         .selectFrom('userPublicKey')
         .select(['userPublicKey.fingerprint', 'userPublicKey.publicKey'])
@@ -73,16 +73,6 @@ export const getReviewerPublicKey = async (userId: string) => {
     return result
 }
 
-export const getReviewerPublicKeyByUserId = async (userId: string) => {
-    const result = await Action.db
-        .selectFrom('userPublicKey')
-        .select(['userPublicKey.publicKey'])
-        .where('userPublicKey.userId', '=', userId)
-        .executeTakeFirst()
-
-    return result?.publicKey
-}
-
 export type LatestJobForStudy = ActionSuccessType<typeof latestJobForStudy>
 
 function latestJobForStudyQuery(studyId: string) {
diff --git a/src/server/results-sharing.test.ts b/src/server/results-sharing.test.ts
new file mode 100644
index 000000000..ac964b0ce
--- /dev/null
+++ b/src/server/results-sharing.test.ts
@@ -0,0 +1,110 @@
+import { describe, expect, test } from 'vitest'
+import { db, insertTestOrg, insertTestStudyJobData, insertTestUser } from '@/tests/unit.helpers'
+import { ActionFailure } from '@/lib/errors'
+import { insertSharedFileKeys } from './results-sharing'
+
+// Enclave test users are seeded with fingerprint 'testFingerprint1' (tests/unit.helpers.tsx),
+// and insertTestStudyJobData sets study.submittedByOrgId = org.id, so that fingerprint is a
+// valid lab recipient for the job.
+const LAB_FINGERPRINT = 'testFingerprint1'
+
+async function insertSharedFileScenario() {
+    const org = await insertTestOrg()
+    const { user: approver } = await insertTestUser({ org })
+    const { job } = await insertTestStudyJobData({ org })
+
+    const file = await db
+        .insertInto('studyJobFile')
+        .values({
+            path: 'results/encrypted/results.csv',
+            name: 'results.csv',
+            studyJobId: job.id,
+            fileType: 'ENCRYPTED-RESULT',
+            iv: 'aXY=',
+        })
+        .returning('id')
+        .executeTakeFirstOrThrow()
+
+    return { org, approver, job, file }
+}
+
+const selectKeyRows = (fileId: string) =>
+    db
+        .selectFrom('studyJobFileKey')
+        .select(['fingerprint', 'crypt'])
+        .where('studyJobFileId', '=', fileId)
+        .execute()
+
+const selectApproval = (fileId: string) =>
+    db
+        .selectFrom('studyJobFile')
+        .select(['approvedAt', 'approvedByUserId'])
+        .where('id', '=', fileId)
+        .executeTakeFirstOrThrow()
+
+describe('insertSharedFileKeys', () => {
+    test('persists wrapped keys and records the approval on the file', async () => {
+        const { approver, job, file } = await insertSharedFileScenario()
+
+        await insertSharedFileKeys(
+            db,
+            job.id,
+            [{ studyJobFileId: file.id, keys: [{ fingerprint: LAB_FINGERPRINT, crypt: 'wrapped-key' }] }],
+            approver.id,
+        )
+
+        const keyRows = await selectKeyRows(file.id)
+        expect(keyRows).toHaveLength(1)
+        expect(keyRows[0]).toMatchObject({ fingerprint: LAB_FINGERPRINT, crypt: 'wrapped-key' })
+
+        const approval = await selectApproval(file.id)
+        expect(approval.approvedAt).toBeInstanceOf(Date)
+        expect(approval.approvedByUserId).toBe(approver.id)
+    })
+
+    test('rejects a fingerprint that is not a lab recipient and writes nothing', async () => {
+        const { approver, job, file } = await insertSharedFileScenario()
+
+        await expect(
+            insertSharedFileKeys(
+                db,
+                job.id,
+                [{ studyJobFileId: file.id, keys: [{ fingerprint: 'not-a-lab-key', crypt: 'bogus' }] }],
+                approver.id,
+            ),
+        ).rejects.toThrow(ActionFailure)
+
+        expect(await selectKeyRows(file.id)).toHaveLength(0)
+        const approval = await selectApproval(file.id)
+        expect(approval.approvedAt).toBeNull()
+    })
+
+    test('is idempotent: re-running the same share does not duplicate key rows', async () => {
+        const { approver, job, file } = await insertSharedFileScenario()
+        const sharedFiles = [
+            { studyJobFileId: file.id, keys: [{ fingerprint: LAB_FINGERPRINT, crypt: 'wrapped-key' }] },
+        ]
+
+        await insertSharedFileKeys(db, job.id, sharedFiles, approver.id)
+        await insertSharedFileKeys(db, job.id, sharedFiles, approver.id)
+
+        expect(await selectKeyRows(file.id)).toHaveLength(1)
+    })
+
+    test('never overwrites an earlier approval timestamp or approver', async () => {
+        const { org, approver, job, file } = await insertSharedFileScenario()
+        const sharedFiles = [
+            { studyJobFileId: file.id, keys: [{ fingerprint: LAB_FINGERPRINT, crypt: 'wrapped-key' }] },
+        ]
+
+        await insertSharedFileKeys(db, job.id, sharedFiles, approver.id)
+        const first = await selectApproval(file.id)
+
+        const { user: secondApprover } = await insertTestUser({ org })
+        await insertSharedFileKeys(db, job.id, sharedFiles, secondApprover.id)
+
+        const second = await selectApproval(file.id)
+        expect(second.approvedAt?.getTime()).toBe(first.approvedAt?.getTime())
+        expect(second.approvedByUserId).toBe(approver.id)
+    })
+})
diff --git a/src/server/results-sharing.ts b/src/server/results-sharing.ts
index 8f254241e..e21922a2b 100644
--- a/src/server/results-sharing.ts
+++ b/src/server/results-sharing.ts
@@ -52,9 +52,12 @@ export async function insertSharedFileKeys(
             .execute()
     }
 
+    // `approved_at` is the durable historical fact — never overwrite an earlier approval
+    // if this runs again for the same file (e.g. a retried approve).
     await db
         .updateTable('studyJobFile')
         .set({ approvedAt: new Date(), approvedByUserId })
         .where('id', 'in', approvedFileIds)
+        .where('approvedAt', 'is', null)
         .execute()
 }
diff --git a/tests/study-flow.spec.ts b/tests/study-flow.spec.ts
index e16fa2d37..29d97afb0 100644
--- a/tests/study-flow.spec.ts
+++ b/tests/study-flow.spec.ts
@@ -401,7 +401,7 @@ async function reviewerApprovesErrorLogs(page: Page, studyTitle: string): Promis
 
     // Enter the private key to decrypt files
     const privateKey = await readTestSupportFile('private_key.pem')
-    const privateKeyTextarea = page.getByPlaceholder('Enter your Reviewer key to access encrypted content.')
+    const privateKeyTextarea = page.getByPlaceholder('Enter your Results Key to access encrypted content.')
     await expect(privateKeyTextarea).toBeVisible()
     await privateKeyTextarea.fill(privateKey)
 

From 6f408af6d69f003ae969cd261c7b72544d564535 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Fri, 12 Jun 2026 09:35:13 -0400
Subject: [PATCH 22/45] Fix key

---
 bin/inject-encrypted-results.ts              | 20 +++++++++++++++++++-
 src/app/reviewer-key/regenerate-key.tsx      |  4 ++--
 src/server/actions/user-keys.actions.test.ts |  6 +-----
 src/server/results-sharing.test.ts           |  6 +-----
 4 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/bin/inject-encrypted-results.ts b/bin/inject-encrypted-results.ts
index bb960795a..e066764f4 100644
--- a/bin/inject-encrypted-results.ts
+++ b/bin/inject-encrypted-results.ts
@@ -23,11 +23,29 @@ async function orgPublicKeys(orgId: string): Promise<{ publicKey: ArrayBuffer; f
         .select(['userPublicKey.publicKey', 'userPublicKey.fingerprint'])
         .where('orgUser.orgId', '=', orgId)
         .execute()
-    return rows.map(({ publicKey, fingerprint }) => {
+    const keys = rows.map(({ publicKey, fingerprint }) => {
         const ab = new ArrayBuffer(publicKey.byteLength)
         new Uint8Array(ab).set(publicKey)
         return { publicKey: ab, fingerprint }
     })
+    // Seed data contains placeholder keys (e.g. fingerprint "e2e-test-fingerprint-admin"
+    // with literal text bytes) that aren't real SPKI DER — wrapping for them throws
+    // deep inside ResultsWriter. Pre-validate with the same import params si-encryption
+    // uses and skip the duds.
+    const valid: typeof keys = []
+    for (const k of keys) {
+        try {
+            await crypto.subtle.importKey('spki', k.publicKey, { name: 'RSA-OAEP', hash: 'SHA-256' }, false, [
+                'encrypt',
+            ])
+            valid.push(k)
+        } catch {
+            console.warn(
+                `  skipping invalid public key (fingerprint ${k.fingerprint}) — not SPKI DER, likely seed placeholder`,
+            )
+        }
+    }
+    return valid
 }
 
 const toArrayBuffer = (s: string): ArrayBuffer => {
diff --git a/src/app/reviewer-key/regenerate-key.tsx b/src/app/reviewer-key/regenerate-key.tsx
index be656edc1..2da27fb9f 100644
--- a/src/app/reviewer-key/regenerate-key.tsx
+++ b/src/app/reviewer-key/regenerate-key.tsx
@@ -45,8 +45,8 @@ export const RegenerateKey: FC = () => {
 
                         <Text size="md">If you have lost your Results Key, you will need to generate a new one.</Text>
                         <Text size="md" c="red.9" mb={8}>
-                            Note: If you generate a new Results Key, you will no longer have access to any study
-                            results associated with your previous key. This action cannot be undone.
+                            Note: If you generate a new Results Key, you will no longer have access to any study results
+                            associated with your previous key. This action cannot be undone.
                         </Text>
                     </Stack>
                     <Group>
diff --git a/src/server/actions/user-keys.actions.test.ts b/src/server/actions/user-keys.actions.test.ts
index 87c095fd8..e01a723de 100644
--- a/src/server/actions/user-keys.actions.test.ts
+++ b/src/server/actions/user-keys.actions.test.ts
@@ -1,10 +1,6 @@
 import { describe, expect, it, vi } from 'vitest'
 import { mockSessionWithTestData, actionResult } from '@/tests/unit.helpers'
-import {
-    getUserPublicKeyAction,
-    setUserPublicKeyAction,
-    updateUserPublicKeyAction,
-} from './user-keys.actions'
+import { getUserPublicKeyAction, setUserPublicKeyAction, updateUserPublicKeyAction } from './user-keys.actions'
 import { db } from '@/database'
 
 vi.mock('@/server/events', async (importOriginal) => ({
diff --git a/src/server/results-sharing.test.ts b/src/server/results-sharing.test.ts
index ac964b0ce..c2e6f006c 100644
--- a/src/server/results-sharing.test.ts
+++ b/src/server/results-sharing.test.ts
@@ -29,11 +29,7 @@ async function insertSharedFileScenario() {
 }
 
 const selectKeyRows = (fileId: string) =>
-    db
-        .selectFrom('studyJobFileKey')
-        .select(['fingerprint', 'crypt'])
-        .where('studyJobFileId', '=', fileId)
-        .execute()
+    db.selectFrom('studyJobFileKey').select(['fingerprint', 'crypt']).where('studyJobFileId', '=', fileId).execute()
 
 const selectApproval = (fileId: string) =>
     db

From 7dd8aff111601617e0dc740e299d53c1b798f7e8 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Fri, 12 Jun 2026 09:50:12 -0400
Subject: [PATCH 23/45] Fix keys

---
 src/server/actions/user-keys.actions.test.ts | 51 +++++++++++++++++---
 src/server/actions/user-keys.actions.ts      | 18 +++++--
 2 files changed, 59 insertions(+), 10 deletions(-)

diff --git a/src/server/actions/user-keys.actions.test.ts b/src/server/actions/user-keys.actions.test.ts
index e01a723de..80d82f2e1 100644
--- a/src/server/actions/user-keys.actions.test.ts
+++ b/src/server/actions/user-keys.actions.test.ts
@@ -1,7 +1,14 @@
 import { describe, expect, it, vi } from 'vitest'
-import { mockSessionWithTestData, actionResult } from '@/tests/unit.helpers'
+import { mockSessionWithTestData, actionResult, readTestSupportFile } from '@/tests/unit.helpers'
 import { getUserPublicKeyAction, setUserPublicKeyAction, updateUserPublicKeyAction } from './user-keys.actions'
 import { db } from '@/database'
+import { isActionError } from '@/lib/errors'
+import { pemToArrayBuffer, fingerprintKeyData } from 'si-encryption/util'
+
+async function validTestKey() {
+    const publicKey = pemToArrayBuffer(await readTestSupportFile('public_key.pem'))
+    return { publicKey, fingerprint: await fingerprintKeyData(publicKey) }
+}
 
 vi.mock('@/server/events', async (importOriginal) => ({
     ...(await importOriginal<typeof import('@/server/events')>()),
@@ -37,8 +44,7 @@ describe('User Keys Actions', () => {
     it('setUserPublicKeyAction sets the public key for the current user', async () => {
         const { user } = await mockSessionWithTestData({ orgType: 'enclave' })
         await db.deleteFrom('userPublicKey').where('userId', '=', user.id).execute()
-        const publicKey = Buffer.from('new-public-key').buffer
-        const fingerprint = 'new-fingerprint'
+        const { publicKey, fingerprint } = await validTestKey()
 
         await setUserPublicKeyAction({ publicKey, fingerprint })
 
@@ -47,6 +53,20 @@ describe('User Keys Actions', () => {
         expect(newKeyResult?.fingerprint).toEqual(fingerprint)
     })
 
+    it('setUserPublicKeyAction rejects a key that is not valid SPKI DER', async () => {
+        const { user } = await mockSessionWithTestData({ orgType: 'enclave' })
+        await db.deleteFrom('userPublicKey').where('userId', '=', user.id).execute()
+
+        const result = await setUserPublicKeyAction({
+            publicKey: Buffer.from('not-a-real-key').buffer,
+            fingerprint: 'garbage-fingerprint',
+        })
+
+        expect(isActionError(result)).toBe(true)
+        const stored = actionResult(await getUserPublicKeyAction())
+        expect(stored).toBeFalsy()
+    })
+
     it('updateUserPublicKeyAction updates the public key for the current user', async () => {
         const { user } = await mockSessionWithTestData()
         const oldPublicKey = Buffer.from('old-public-key')
@@ -57,13 +77,30 @@ describe('User Keys Actions', () => {
             .values({ userId: user.id, publicKey: oldPublicKey, fingerprint: oldFingerprint })
             .execute()
 
-        const newPublicKey = Buffer.from('new-public-key-for-update').buffer
-        const newFingerprint = 'new-fingerprint-for-update'
+        const { publicKey, fingerprint } = await validTestKey()
 
-        await updateUserPublicKeyAction({ publicKey: newPublicKey, fingerprint: newFingerprint })
+        await updateUserPublicKeyAction({ publicKey, fingerprint })
 
         const updatedKeyResult = actionResult(await getUserPublicKeyAction())
         expect(updatedKeyResult).toBeDefined()
-        expect(updatedKeyResult?.fingerprint).toEqual(newFingerprint)
+        expect(updatedKeyResult?.fingerprint).toEqual(fingerprint)
+    })
+
+    it('updateUserPublicKeyAction rejects a key that is not valid SPKI DER', async () => {
+        const { user } = await mockSessionWithTestData()
+        await db.deleteFrom('userPublicKey').where('userId', '=', user.id).execute()
+        await db
+            .insertInto('userPublicKey')
+            .values({ userId: user.id, publicKey: Buffer.from('old-public-key'), fingerprint: 'old-fingerprint' })
+            .execute()
+
+        const result = await updateUserPublicKeyAction({
+            publicKey: Buffer.from('still-not-a-key').buffer,
+            fingerprint: 'garbage-fingerprint',
+        })
+
+        expect(isActionError(result)).toBe(true)
+        const stored = actionResult(await getUserPublicKeyAction())
+        expect(stored?.fingerprint).toEqual('old-fingerprint')
     })
 })
diff --git a/src/server/actions/user-keys.actions.ts b/src/server/actions/user-keys.actions.ts
index a07470578..aa4d09299 100644
--- a/src/server/actions/user-keys.actions.ts
+++ b/src/server/actions/user-keys.actions.ts
@@ -25,15 +25,25 @@ const setOrgUserPublicKeySchema = z.object({
     fingerprint: z.string(),
 })
 
+// Reject keys that aren't importable RSA SPKI DER. A single malformed key in an org breaks
+// encryption for every sender wrapping to that org's recipients (TOA results upload, the
+// reviewer's approve/re-wrap), so catch it at storage time. Import params mirror
+// si-encryption's wrapAesKey.
+async function assertValidPublicKey(publicKey: ArrayBuffer): Promise<void> {
+    try {
+        await crypto.subtle.importKey('spki', publicKey, { name: 'RSA-OAEP', hash: 'SHA-256' }, false, ['encrypt'])
+    } catch {
+        throw new ActionFailure({ publicKey: 'is not a valid RSA public key' })
+    }
+}
+
 export const setUserPublicKeyAction = new Action('setUserPublicKeyAction')
     .params(setOrgUserPublicKeySchema)
     .requireAbilityTo('update', 'UserKey')
     .handler(async ({ params: { publicKey, fingerprint }, session, db }) => {
         const userId = session.user.id
 
-        if (!publicKey.byteLength) {
-            throw new Error('Invalid public key format')
-        }
+        await assertValidPublicKey(publicKey)
 
         await db
             .insertInto('userPublicKey')
@@ -54,6 +64,8 @@ export const updateUserPublicKeyAction = new Action('updateUserPublicKeyAction')
     .handler(async ({ params: { publicKey, fingerprint }, session, db }) => {
         const userId = session.user.id
 
+        await assertValidPublicKey(publicKey)
+
         await db
             .updateTable('userPublicKey')
             .set({

From 2c46b5922f637551ec04ec6f2f4dc69e741e9803 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Mon, 15 Jun 2026 11:28:44 -0400
Subject: [PATCH 24/45] Update to pnpm 11.7

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 7967e0af7..4d950ff15 100644
--- a/package.json
+++ b/package.json
@@ -7,7 +7,7 @@
     "author": "Nathan Stitt",
     "main": "index.js",
     "type": "module",
-    "packageManager": "pnpm@11.3.0",
+    "packageManager": "pnpm@11.7.0+sha512.19cc852c120c7125760f2443ee6be0ca5b40f9f50598de1a09a1f177503e010e57c23c77646e01e761de59bf874fb22a3398c33ab9691fc13eb946b6f0f4d620",
     "engines": {
         "node": ">=22",
         "pnpm": ">=11"

From 7f906bd71d245e39b269b2e387274402032ac7e2 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Tue, 16 Jun 2026 08:28:47 -0400
Subject: [PATCH 25/45] Update approach for all/nothing

---
 package.json                                  |   2 +-
 pnpm-lock.yaml                                |  10 +-
 .../review/job-review-buttons.test.tsx        |   1 -
 .../review/study-results-redesign.test.tsx    |  13 +-
 .../[studyId]/review/study-results.test.tsx   |  14 +-
 src/app/api/job/[jobId]/results/route.test.ts |  58 +++---
 src/components/encrypted-files-panel.test.tsx | 178 +++++++-----------
 src/components/encrypted-files-panel.tsx      |  61 ++----
 src/components/job-results.tsx                |  40 ++--
 .../study/submitted-code-table.test.tsx       |   2 -
 .../1780000000000_study_job_file_keys.ts      |  37 ++--
 src/database/types.ts                         |   5 +-
 src/hooks/use-decrypt-files.ts                |  60 +++---
 src/hooks/use-encrypted-files-panel.ts        |  87 +++------
 src/lib/re-wrap-results.ts                    |  15 +-
 src/lib/types.ts                              |   3 +-
 src/server/actions/study-job.actions.test.ts  |  52 ++---
 src/server/actions/study-job.actions.ts       | 100 ++++++----
 src/server/actions/study.actions.ts           |   2 +-
 src/server/db/queries.ts                      |  23 ++-
 src/server/results-sharing.test.ts            |  81 +++-----
 src/server/results-sharing.ts                 |  57 +++---
 src/server/storage.ts                         |  82 ++------
 23 files changed, 410 insertions(+), 573 deletions(-)

diff --git a/package.json b/package.json
index 1779b5ea8..911159d78 100644
--- a/package.json
+++ b/package.json
@@ -109,7 +109,7 @@
         "react-phone-number-input": "^3.4.16",
         "remeda": "^2.33.6",
         "server-only": "^0.0.1",
-        "si-encryption": "github:safeinsights/encryption#2c495dae94942895a34e64d91f83809750867f4e",
+        "si-encryption": "github:safeinsights/encryption#0e892f0f38e8e92182fcf81d22c1760839e1d624",
         "uuid": "^14.0.0",
         "validator": "^13.15.26",
         "yjs": "^13.6.30",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 42b7983c4..8e8203fc9 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -221,8 +221,8 @@ importers:
         specifier: ^0.0.1
         version: 0.0.1
       si-encryption:
-        specifier: github:safeinsights/encryption#2c495dae94942895a34e64d91f83809750867f4e
-        version: https://codeload.github.com/safeinsights/encryption/tar.gz/2c495dae94942895a34e64d91f83809750867f4e
+        specifier: github:safeinsights/encryption#0e892f0f38e8e92182fcf81d22c1760839e1d624
+        version: https://codeload.github.com/safeinsights/encryption/tar.gz/0e892f0f38e8e92182fcf81d22c1760839e1d624
       uuid:
         specifier: ^14.0.0
         version: 14.0.0
@@ -5138,8 +5138,8 @@ packages:
     resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==}
     engines: {node: '>= 0.4'}
 
-  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/2c495dae94942895a34e64d91f83809750867f4e:
-    resolution: {gitHosted: true, tarball: https://codeload.github.com/safeinsights/encryption/tar.gz/2c495dae94942895a34e64d91f83809750867f4e}
+  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/0e892f0f38e8e92182fcf81d22c1760839e1d624:
+    resolution: {gitHosted: true, integrity: sha512-HqEZER7ad4UZPd/2GhAb6LKWEIArDolD2Th/C4o0Sw7Ua5wdrc+N65brMePCIlP/4xlZM95s2rHjxD1JbuSoHQ==, tarball: https://codeload.github.com/safeinsights/encryption/tar.gz/0e892f0f38e8e92182fcf81d22c1760839e1d624}
     version: 0.0.1
 
   side-channel-list@1.0.1:
@@ -11223,7 +11223,7 @@ snapshots:
 
   shell-quote@1.8.4: {}
 
-  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/2c495dae94942895a34e64d91f83809750867f4e:
+  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/0e892f0f38e8e92182fcf81d22c1760839e1d624:
     dependencies:
       '@zip.js/zip.js': 2.8.26
       debug: 4.4.3
diff --git a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx
index 6a3398d10..48cd31a22 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx
@@ -90,7 +90,6 @@ describe('Study Results Approve/Reject buttons', async () => {
                 name: 'test.csv',
                 path: `results/encrypted/test.csv`,
                 fileType: 'ENCRYPTED-RESULT',
-                iv: 'aXY=',
             })
             .returning('id')
             .executeTakeFirstOrThrow()
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
index b4e7625b2..ecdd93bc5 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
@@ -12,7 +12,6 @@ import { StudyResultsRedesign } from './study-results-redesign'
 import { fetchEncryptedJobFilesAction } from '@/server/actions/study-job.actions'
 import { latestJobForStudy } from '@/server/db/queries'
 import { ResultsWriter } from 'si-encryption/job-results/writer'
-import { decomposeResultsZip } from 'si-encryption/job-results/decompose'
 import { fingerprintKeyData, pemToArrayBuffer } from 'si-encryption/util'
 import { type FileType } from '@/database/types'
 
@@ -103,13 +102,13 @@ describe('StudyResultsRedesign', () => {
 
         const csv = `title\nhello world`
         await writer.addFile('test.data', toArrayBuffer(csv))
-        const [decomposed] = await decomposeResultsZip(await writer.generate())
+        const zip = await writer.generate()
 
         const { study, job: rawJob } = await insertTestStudyJobData({
             org,
             jobStatus: 'RUN-COMPLETE',
         })
-        const path = `test-org/${study.id}/${rawJob.id}/results/encrypted/test.data`
+        const path = `test-org/${study.id}/${rawJob.id}/results/encrypted-results.zip`
         const row = await db
             .insertInto('studyJobFile')
             .values({
@@ -117,8 +116,6 @@ describe('StudyResultsRedesign', () => {
                 name: 'test.data',
                 path,
                 fileType: 'ENCRYPTED-RESULT',
-                iv: decomposed.iv,
-                bytes: decomposed.bytes,
             })
             .returning('id')
             .executeTakeFirstOrThrow()
@@ -127,11 +124,9 @@ describe('StudyResultsRedesign', () => {
             {
                 studyJobFileId: row.id,
                 fileType: 'ENCRYPTED-RESULT' as FileType,
-                path,
                 name: 'test.data',
-                iv: decomposed.iv,
-                crypt: decomposed.keys[fingerprint].crypt,
-                encryptedBody: decomposed.body,
+                encryptedBody: await zip.arrayBuffer(),
+                overrideKeys: {} as Record<string, string>,
             },
         ])
 
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
index fe53e5fde..322ae9bba 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
@@ -12,7 +12,6 @@ import { StudyResults } from './study-results'
 import { fetchEncryptedJobFilesAction, fetchSharedFileIdsAction } from '@/server/actions/study-job.actions'
 import { latestJobForStudy } from '@/server/db/queries'
 import { ResultsWriter } from 'si-encryption/job-results/writer'
-import { decomposeResultsZip } from 'si-encryption/job-results/decompose'
 import { fingerprintKeyData, pemToArrayBuffer } from 'si-encryption/util'
 import { type FileType, type StudyJobStatus, type StudyStatus } from '@/database/types'
 
@@ -36,23 +35,21 @@ async function seedEncryptedFile(
     const fingerprint = await fingerprintKeyData(publicKey)
     const writer = new ResultsWriter([{ publicKey, fingerprint }])
     await writer.addFile(name, toArrayBuffer(content))
-    const [decomposed] = await decomposeResultsZip(await writer.generate())
+    const zip = await writer.generate()
 
-    const path = `test-org/${job.id}/results/encrypted/${name}`
+    const path = `test-org/${job.id}/results/encrypted-results.zip`
     const row = await db
         .insertInto('studyJobFile')
-        .values({ studyJobId: job.id, name, path, fileType, iv: decomposed.iv, bytes: decomposed.bytes })
+        .values({ studyJobId: job.id, name, path, fileType })
         .returning('id')
         .executeTakeFirstOrThrow()
 
     return {
         studyJobFileId: row.id,
         fileType,
-        path,
         name,
-        iv: decomposed.iv,
-        crypt: decomposed.keys[fingerprint].crypt,
-        encryptedBody: decomposed.body,
+        encryptedBody: await zip.arrayBuffer(),
+        overrideKeys: {} as Record<string, string>,
     }
 }
 
@@ -64,7 +61,6 @@ async function insertEncryptedRow(job: MinimalJob, { name, fileType }: { name: s
             name,
             path: `test-org/${job.id}/results/encrypted/${name}`,
             fileType,
-            iv: 'aXY=',
         })
         .returning('id')
         .executeTakeFirstOrThrow()
diff --git a/src/app/api/job/[jobId]/results/route.test.ts b/src/app/api/job/[jobId]/results/route.test.ts
index cf88c2b53..4e7bc6cb7 100644
--- a/src/app/api/job/[jobId]/results/route.test.ts
+++ b/src/app/api/job/[jobId]/results/route.test.ts
@@ -1,12 +1,10 @@
 import { expect, test, vi } from 'vitest'
 import * as apiHandler from './route'
-import { insertTestOrg, insertTestStudyData, readTestSupportFile } from '@/tests/unit.helpers'
+import { insertTestOrg, insertTestStudyData } from '@/tests/unit.helpers'
 import { s3Available } from '@/tests/s3.helpers'
 import { db } from '@/database'
 import { sendResultsReadyForReviewEmail } from '@/server/mailer'
 import { fetchFileContents } from '@/server/storage'
-import { ResultsWriter } from 'si-encryption/job-results/writer'
-import { fingerprintKeyData, pemToArrayBuffer } from 'si-encryption/util'
 
 vi.mock('@/server/mailer', () => ({
     sendResultsReadyForReviewEmail: vi.fn(),
@@ -20,26 +18,20 @@ vi.mock('@/server/aws', () => ({
     signedUrlForFile: vi.fn(),
 }))
 
-// TOA uploads a ResultsWriter zip; ingest decomposes it into per-file rows + wrapped keys.
-async function buildEncryptedZip(fileName: string, content: string): Promise<File> {
-    const publicKey = pemToArrayBuffer(await readTestSupportFile('public_key.pem'))
-    const fingerprint = await fingerprintKeyData(publicKey)
-    const writer = new ResultsWriter([{ publicKey, fingerprint }])
-    const buf = Buffer.from(content, 'utf-8')
-    await writer.addFile(fileName, buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength))
-    const zip = await writer.generate()
-    return new File([zip], 'encrypted.zip', { type: 'application/zip' })
-}
-
 // These exercise the real S3 round-trip (storeStudyEncrypted*/fetchFileContents),
 // so they skip when SeaweedFS isn't running locally; on CI s3.helpers throws instead.
 test.skipIf(!s3Available)('uploading results', async () => {
     const org = await insertTestOrg()
 
+    const file = new File([new Uint8Array([1, 2, 3])], 'testfile.txt', { type: 'text/plain' })
+
     const formData = new FormData()
-    formData.append('result', await buildEncryptedZip('output.csv', 'a,b\n1,2'))
+    formData.append('result', file)
 
-    const req = new Request('http://localhost', { method: 'PUT', body: formData })
+    const req = new Request('http://localhost', {
+        method: 'PUT',
+        body: formData,
+    })
 
     const { jobIds } = await insertTestStudyData({ org })
 
@@ -49,20 +41,14 @@ test.skipIf(!s3Available)('uploading results', async () => {
 
     const sr = await db
         .selectFrom('studyJobFile')
-        .select(['id', 'path', 'name', 'fileType', 'iv'])
+        .select(['path', 'fileType'])
         .where('studyJobFile.studyJobId', '=', jobIds[0])
         .executeTakeFirstOrThrow()
 
-    expect(sr).toMatchObject({ name: 'output.csv', fileType: 'ENCRYPTED-RESULT' })
-    expect(sr.iv).toBeTruthy()
-
-    // The manifest's recipient key became a study_job_file_key row.
-    const wrappedKeys = await db
-        .selectFrom('studyJobFileKey')
-        .select('crypt')
-        .where('studyJobFileId', '=', sr.id)
-        .execute()
-    expect(wrappedKeys.length).toBeGreaterThan(0)
+    expect(sr).toMatchObject({
+        path: expect.any(String),
+        fileType: 'ENCRYPTED-RESULT',
+    })
 
     const contents = await fetchFileContents(sr.path)
     expect(contents).toBeInstanceOf(Blob)
@@ -70,11 +56,17 @@ test.skipIf(!s3Available)('uploading results', async () => {
 
 test.skipIf(!s3Available)('uploading logs', async () => {
     const org = await insertTestOrg()
+    const logContents = 'long line one\nlog line two\n'
+    const encoder = new TextEncoder()
+    const file = new File([encoder.encode(logContents)], 'testfile.log', { type: 'text/plain' })
 
     const formData = new FormData()
-    formData.append('log', await buildEncryptedZip('run.log', 'log line one\nlog line two\n'))
+    formData.append('log', file)
 
-    const req = new Request('http://localhost', { method: 'PUT', body: formData })
+    const req = new Request('http://localhost', {
+        method: 'PUT',
+        body: formData,
+    })
 
     const { jobIds } = await insertTestStudyData({ org })
 
@@ -84,12 +76,14 @@ test.skipIf(!s3Available)('uploading logs', async () => {
 
     const sr = await db
         .selectFrom('studyJobFile')
-        .select(['path', 'name', 'fileType', 'iv'])
+        .select(['path', 'fileType'])
         .where('studyJobFile.studyJobId', '=', jobIds[0])
         .executeTakeFirstOrThrow()
 
-    expect(sr).toMatchObject({ name: 'run.log', fileType: 'ENCRYPTED-CODE-RUN-LOG' })
-    expect(sr.iv).toBeTruthy()
+    expect(sr).toMatchObject({
+        path: expect.any(String),
+        fileType: 'ENCRYPTED-CODE-RUN-LOG',
+    })
 
     const contents = await fetchFileContents(sr.path)
     expect(contents).toBeInstanceOf(Blob)
diff --git a/src/components/encrypted-files-panel.test.tsx b/src/components/encrypted-files-panel.test.tsx
index 1940e7fd6..84b685c32 100644
--- a/src/components/encrypted-files-panel.test.tsx
+++ b/src/components/encrypted-files-panel.test.tsx
@@ -12,7 +12,6 @@ import { EncryptedFilesPanel } from './encrypted-files-panel'
 import { fetchEncryptedJobFilesAction, fetchSharedFileIdsAction } from '@/server/actions/study-job.actions'
 import { latestJobForStudy } from '@/server/db/queries'
 import { ResultsWriter } from 'si-encryption/job-results/writer'
-import { decomposeResultsZip } from 'si-encryption/job-results/decompose'
 import { fingerprintKeyData, pemToArrayBuffer } from 'si-encryption/util'
 import { type FileType } from '@/database/types'
 
@@ -28,57 +27,45 @@ const toArrayBuffer = (str: string): ArrayBuffer => {
 
 type MinimalJob = { id: string }
 
-// Insert one decomposed encrypted-file row, with a real (decryptable) body the
-// fetchEncryptedJobFilesAction mock will serve. Returns the row id so callers can
-// match it to the per-file fetch entry.
-async function seedEncryptedFile(
+// Encrypt one results artifact the way TOA would (the prod whole-zip format with an embedded
+// manifest), persist the matching study_job_file row, and return the artifact entry the
+// fetchEncryptedJobFilesAction mock will serve. The reviewer is a manifest recipient, so the
+// override map is empty — they decrypt with their own key (no per-file re-wrapped keys needed).
+async function seedArtifact(
     job: MinimalJob,
-    { name, fileType, content }: { name: string; fileType: FileType; content: string },
+    { fileType, subdir, files }: { fileType: FileType; subdir: string; files: { name: string; content: string }[] },
 ) {
     const publicKey = pemToArrayBuffer(await readTestSupportFile('public_key.pem'))
     const fingerprint = await fingerprintKeyData(publicKey)
     const writer = new ResultsWriter([{ publicKey, fingerprint }])
-    await writer.addFile(name, toArrayBuffer(content))
-    const [decomposed] = await decomposeResultsZip(await writer.generate())
+    for (const f of files) await writer.addFile(f.name, toArrayBuffer(f.content))
+    const zip = await writer.generate()
 
+    const path = `test-org/${job.id}/results/${subdir}/encrypted-results.zip`
     const row = await db
         .insertInto('studyJobFile')
-        .values({
-            studyJobId: job.id,
-            name,
-            path: `test-org/${job.id}/results/encrypted/${name}`,
-            fileType,
-            iv: decomposed.iv,
-            bytes: decomposed.bytes,
-        })
+        .values({ studyJobId: job.id, name: 'encrypted-results.zip', path, fileType })
         .returning('id')
         .executeTakeFirstOrThrow()
 
     return {
         studyJobFileId: row.id,
         fileType,
-        path: `test-org/${job.id}/results/encrypted/${name}`,
-        name,
-        iv: decomposed.iv,
-        crypt: decomposed.keys[fingerprint].crypt,
-        encryptedBody: decomposed.body,
+        name: 'encrypted-results.zip',
+        encryptedBody: await zip.arrayBuffer(),
+        overrideKeys: {} as Record<string, string>,
     }
 }
 
-// A display-only encrypted-file row (no real ciphertext) for lock/shared/withheld states.
-async function insertEncryptedRow(
-    job: MinimalJob,
-    { name, fileType, bytes }: { name: string; fileType: FileType; bytes?: number },
-) {
+// A display-only encrypted-artifact row (no real ciphertext) for lock/shared states.
+async function insertEncryptedRow(job: MinimalJob, { fileType, subdir }: { fileType: FileType; subdir: string }) {
     return db
         .insertInto('studyJobFile')
         .values({
             studyJobId: job.id,
-            name,
-            path: `test-org/${job.id}/results/encrypted/${name}`,
+            name: 'encrypted-results.zip',
+            path: `test-org/${job.id}/results/${subdir}/encrypted-results.zip`,
             fileType,
-            iv: 'aXY=',
-            bytes: bytes ?? null,
         })
         .returning('id')
         .executeTakeFirstOrThrow()
@@ -86,6 +73,13 @@ async function insertEncryptedRow(
 
 const READER_KEY_PLACEHOLDER = 'Enter your Results Key to access encrypted content.'
 
+async function enterKeyAndDecrypt() {
+    fireEvent.change(screen.getByPlaceholderText(READER_KEY_PLACEHOLDER), {
+        target: { value: await readTestSupportFile('private_key.pem') },
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Decrypt Files' }))
+}
+
 describe('EncryptedFilesPanel', () => {
     let org: Org
 
@@ -102,16 +96,15 @@ describe('EncryptedFilesPanel', () => {
         expect(screen.queryByText('Decrypt Files')).toBeNull()
     })
 
-    it('shows a file row with lock icon and the decrypt form when an encrypted file exists', async () => {
+    it('shows a locked artifact row and the decrypt form when an encrypted artifact exists', async () => {
         const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
-        await insertEncryptedRow(job, { name: 'results.csv', fileType: 'ENCRYPTED-RESULT', bytes: 2048 })
+        await insertEncryptedRow(job, { fileType: 'ENCRYPTED-RESULT', subdir: 'encrypted' })
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
 
         expect(screen.getByText('Results')).toBeDefined()
-        expect(screen.getByText('results.csv')).toBeDefined()
-        expect(screen.getByText('2.0 KB')).toBeDefined()
+        expect(screen.getByLabelText('Encrypted')).toBeDefined()
 
         // Locked → no View/Download
         expect(screen.queryByRole('button', { name: 'View' })).toBeNull()
@@ -121,76 +114,66 @@ describe('EncryptedFilesPanel', () => {
         expect(screen.getByRole('button', { name: 'Decrypt Files' })).toBeDefined()
     })
 
-    it('shows one row per file when the job has multiple encrypted files', async () => {
+    it('shows one locked row per encrypted artifact (results + logs)', async () => {
         const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
-        await insertEncryptedRow(job, { name: 'first.csv', fileType: 'ENCRYPTED-RESULT', bytes: 1024 })
-        await insertEncryptedRow(job, { name: 'second.csv', fileType: 'ENCRYPTED-RESULT', bytes: 2048 })
+        await insertEncryptedRow(job, { fileType: 'ENCRYPTED-RESULT', subdir: 'encrypted' })
+        await insertEncryptedRow(job, { fileType: 'ENCRYPTED-SECURITY-SCAN-LOG', subdir: 'encrypted-logs' })
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
 
         await waitFor(() => {
-            expect(screen.getByText('first.csv')).toBeDefined()
-            expect(screen.getByText('second.csv')).toBeDefined()
-            expect(screen.getByText('1.0 KB')).toBeDefined()
-            expect(screen.getByText('2.0 KB')).toBeDefined()
+            expect(screen.getByText('Results')).toBeDefined()
+            expect(screen.getByText('Security Scan Log')).toBeDefined()
         })
     })
 
-    it('decrypts and shows the file table with View and Download', async () => {
+    it('decrypts the artifact and shows its inner files with View and Download', async () => {
         const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
-        const file = await seedEncryptedFile(job, {
-            name: 'results.csv',
+        const artifact = await seedArtifact(job, {
             fileType: 'ENCRYPTED-RESULT',
-            content: 'name,age\nAlice,30',
+            subdir: 'encrypted',
+            files: [{ name: 'results.csv', content: 'name,age\nAlice,30' }],
         })
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([file])
+        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([artifact])
 
         const onFilesApproved = vi.fn()
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={onFilesApproved} />)
 
-        fireEvent.change(screen.getByPlaceholderText(READER_KEY_PLACEHOLDER), {
-            target: { value: await readTestSupportFile('private_key.pem') },
-        })
-        fireEvent.click(screen.getByRole('button', { name: 'Decrypt Files' }))
+        await enterKeyAndDecrypt()
 
         await waitFor(() => {
-            expect(screen.getByText('Results')).toBeDefined()
+            expect(screen.getByText('results.csv')).toBeDefined()
             expect(screen.getByRole('button', { name: 'View' })).toBeDefined()
             expect(screen.getByTestId('download-link')).toBeDefined()
             expect(onFilesApproved).toHaveBeenLastCalledWith([
                 expect.objectContaining({
                     path: 'results.csv',
                     fileType: 'APPROVED-RESULT',
-                    sourceId: file.studyJobFileId,
+                    sourceId: artifact.studyJobFileId,
                 }),
             ])
         })
     })
 
-    it('decrypts multiple files and shows one row per file', async () => {
+    it('decrypts an artifact with multiple inner files and shows one row each', async () => {
         const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
-        const first = await seedEncryptedFile(job, {
-            name: 'first.csv',
-            fileType: 'ENCRYPTED-RESULT',
-            content: 'name,age\nAlice,30',
-        })
-        const second = await seedEncryptedFile(job, {
-            name: 'second.csv',
+        const artifact = await seedArtifact(job, {
             fileType: 'ENCRYPTED-RESULT',
-            content: 'city,state\nDenver,CO',
+            subdir: 'encrypted',
+            files: [
+                { name: 'first.csv', content: 'name,age\nAlice,30' },
+                { name: 'second.csv', content: 'city,state\nDenver,CO' },
+            ],
         })
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([first, second])
+        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([artifact])
 
         const onFilesApproved = vi.fn()
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={onFilesApproved} />)
 
-        fireEvent.change(screen.getByPlaceholderText(READER_KEY_PLACEHOLDER), {
-            target: { value: await readTestSupportFile('private_key.pem') },
-        })
-        fireEvent.click(screen.getByRole('button', { name: 'Decrypt Files' }))
+        await enterKeyAndDecrypt()
 
         await waitFor(() => {
             expect(screen.getByText('first.csv')).toBeDefined()
@@ -211,20 +194,17 @@ describe('EncryptedFilesPanel', () => {
 
     it('opens a modal with CSV content rendered as a table', async () => {
         const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
-        const file = await seedEncryptedFile(job, {
-            name: 'results.csv',
+        const artifact = await seedArtifact(job, {
             fileType: 'ENCRYPTED-RESULT',
-            content: 'name,age\nAlice,30',
+            subdir: 'encrypted',
+            files: [{ name: 'results.csv', content: 'name,age\nAlice,30' }],
         })
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([file])
+        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([artifact])
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
 
-        fireEvent.change(screen.getByPlaceholderText(READER_KEY_PLACEHOLDER), {
-            target: { value: await readTestSupportFile('private_key.pem') },
-        })
-        fireEvent.click(screen.getByRole('button', { name: 'Decrypt Files' }))
+        await enterKeyAndDecrypt()
 
         await waitFor(() => expect(screen.getByRole('button', { name: 'View' })).toBeDefined())
         fireEvent.click(screen.getByRole('button', { name: 'View' }))
@@ -240,20 +220,17 @@ describe('EncryptedFilesPanel', () => {
     it('opens a modal with text content rendered as a code block for log files', async () => {
         const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
         const logContent = 'Security scan complete: no issues found.'
-        const file = await seedEncryptedFile(job, {
-            name: 'scan-log.txt',
+        const artifact = await seedArtifact(job, {
             fileType: 'ENCRYPTED-SECURITY-SCAN-LOG',
-            content: logContent,
+            subdir: 'encrypted-logs',
+            files: [{ name: 'scan-log.txt', content: logContent }],
         })
-        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([file])
+        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([artifact])
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
 
-        fireEvent.change(screen.getByPlaceholderText(READER_KEY_PLACEHOLDER), {
-            target: { value: await readTestSupportFile('private_key.pem') },
-        })
-        fireEvent.click(screen.getByRole('button', { name: 'Decrypt Files' }))
+        await enterKeyAndDecrypt()
 
         await waitFor(() => expect(screen.getByRole('button', { name: 'View' })).toBeDefined())
         fireEvent.click(screen.getByRole('button', { name: 'View' }))
@@ -264,48 +241,31 @@ describe('EncryptedFilesPanel', () => {
         })
     })
 
-    it('shows a green check for shared files and a red "not shared" X for withheld files after approval', async () => {
-        const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'FILES-APPROVED' })
-        const shared = await insertEncryptedRow(job, { name: 'first.csv', fileType: 'ENCRYPTED-RESULT', bytes: 1024 })
-        await insertEncryptedRow(job, { name: 'second.csv', fileType: 'ENCRYPTED-RESULT', bytes: 2048 })
-
-        // Only first.csv has a researcher wrapped key → it's the shared/approved one.
-        vi.mocked(fetchSharedFileIdsAction).mockResolvedValue([shared.id])
-
-        const latestJob = await latestJobForStudy(study.id)
-        renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
-
-        await waitFor(() => {
-            expect(screen.getByText('first.csv')).toBeDefined()
-            expect(screen.getByLabelText('second.csv not shared with researcher')).toBeDefined()
-        })
-    })
-
-    it('shows a red "not shared" X for a withheld log file after approval', async () => {
+    it('shows a green "shared with researcher" check on an approved artifact', async () => {
         const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'FILES-APPROVED' })
-        const shared = await insertEncryptedRow(job, { name: 'first.csv', fileType: 'ENCRYPTED-RESULT', bytes: 1024 })
-        await insertEncryptedRow(job, { name: 'scan-log.txt', fileType: 'ENCRYPTED-SECURITY-SCAN-LOG', bytes: 40 })
+        const shared = await insertEncryptedRow(job, { fileType: 'ENCRYPTED-RESULT', subdir: 'encrypted' })
 
+        // All-or-nothing: once approved every artifact is shared (getSharedFileIdsForJob returns all).
         vi.mocked(fetchSharedFileIdsAction).mockResolvedValue([shared.id])
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
 
         await waitFor(() => {
-            expect(screen.getByLabelText('scan-log.txt not shared with researcher')).toBeDefined()
+            expect(screen.getByText('Results')).toBeDefined()
+            expect(screen.getByLabelText('Shared with researcher')).toBeDefined()
         })
     })
 
-    it('does not show any "not shared" indicator while a job is still under review', async () => {
+    it('shows a lock (no shared check) while a job is still under review', async () => {
         const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
-        await insertEncryptedRow(job, { name: 'results.csv', fileType: 'ENCRYPTED-RESULT', bytes: 2048 })
+        await insertEncryptedRow(job, { fileType: 'ENCRYPTED-RESULT', subdir: 'encrypted' })
 
         const latestJob = await latestJobForStudy(study.id)
         renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
 
-        await waitFor(() => {
-            expect(screen.getByText('results.csv')).toBeDefined()
-        })
-        expect(screen.queryByLabelText(/not shared with researcher/)).toBeNull()
+        await waitFor(() => expect(screen.getByText('Results')).toBeDefined())
+        expect(screen.queryByLabelText('Shared with researcher')).toBeNull()
+        expect(screen.getByLabelText('Encrypted')).toBeDefined()
     })
 })
diff --git a/src/components/encrypted-files-panel.tsx b/src/components/encrypted-files-panel.tsx
index 72157d4ba..2e614c025 100644
--- a/src/components/encrypted-files-panel.tsx
+++ b/src/components/encrypted-files-panel.tsx
@@ -1,5 +1,4 @@
 import { FilePreviewModal } from '@/components/modals/file-preview-modal'
-import { InfoTooltip } from '@/components/tooltip'
 import { DownloadBlobLink } from '@/components/download-blob-link'
 import { useEncryptedFilesPanel, type UnifiedFileRow } from '@/hooks/use-encrypted-files-panel'
 import { decodeFileContents } from '@/lib/file-content-helpers'
@@ -7,8 +6,8 @@ import { formatBytes } from '@/lib/format'
 import type { JobFile, JobFileInfo } from '@/lib/types'
 import type { LatestJobForStudy } from '@/server/db/queries'
 import { PrivateKeyForm } from '@/components/private-key-form'
-import { Button, Checkbox, Stack, Table } from '@mantine/core'
-import { CheckCircleIcon, InfoIcon, LockIcon, XCircleIcon } from '@phosphor-icons/react/dist/ssr'
+import { Button, Stack, Table } from '@mantine/core'
+import { CheckCircleIcon, LockIcon, LockOpenIcon } from '@phosphor-icons/react/dist/ssr'
 import { FC } from 'react'
 
 type EncryptedFilesPanelProps = {
@@ -33,8 +32,6 @@ export const EncryptedFilesPanel: FC<EncryptedFilesPanelProps> = ({
         viewingFile,
         openFileViewer,
         closeFileViewer,
-        selectedPaths,
-        toggleFile,
     } = useEncryptedFilesPanel({ job, onFilesApproved })
 
     if (!hasFileRows) {
@@ -45,14 +42,7 @@ export const EncryptedFilesPanel: FC<EncryptedFilesPanelProps> = ({
 
     return (
         <Stack>
-            {showTable && (
-                <UnifiedFileTable
-                    rows={fileRows}
-                    onView={openFileViewer}
-                    selectedPaths={selectedPaths}
-                    onToggle={toggleFile}
-                />
-            )}
+            {showTable && <UnifiedFileTable rows={fileRows} onView={openFileViewer} />}
             <PrivateKeyForm
                 isVisible={shouldShowForm}
                 form={form}
@@ -69,19 +59,13 @@ export const EncryptedFilesPanel: FC<EncryptedFilesPanelProps> = ({
 type UnifiedFileTableProps = {
     rows: UnifiedFileRow[]
     onView: (file: JobFile) => void
-    selectedPaths: Set<string>
-    onToggle: (path: string) => void
 }
 
-const UnifiedFileTable: FC<UnifiedFileTableProps> = ({ rows, onView, selectedPaths, onToggle }) => (
+const UnifiedFileTable: FC<UnifiedFileTableProps> = ({ rows, onView }) => (
     <Table>
         <Table.Thead>
             <Table.Tr>
-                <Table.Th w={40}>
-                    <InfoTooltip label="Selected files will be shared with the researcher" withArrow multiline w={200}>
-                        <InfoIcon size={16} color="var(--mantine-color-blue-6)" />
-                    </InfoTooltip>
-                </Table.Th>
+                <Table.Th w={40} />
                 <Table.Th>File Type</Table.Th>
                 <Table.Th>Name</Table.Th>
                 <Table.Th>Size</Table.Th>
@@ -91,13 +75,7 @@ const UnifiedFileTable: FC<UnifiedFileTableProps> = ({ rows, onView, selectedPat
         </Table.Thead>
         <Table.Tbody>
             {rows.map((row) => (
-                <UnifiedFileRow
-                    key={row.key}
-                    row={row}
-                    onView={onView}
-                    isSelected={selectedPaths.has(row.name)}
-                    onToggle={onToggle}
-                />
+                <UnifiedFileRow key={row.key} row={row} onView={onView} />
             ))}
         </Table.Tbody>
     </Table>
@@ -106,26 +84,19 @@ const UnifiedFileTable: FC<UnifiedFileTableProps> = ({ rows, onView, selectedPat
 type UnifiedFileRowProps = {
     row: UnifiedFileRow
     onView: (file: JobFile) => void
-    isSelected: boolean
-    onToggle: (path: string) => void
 }
 
-const UnifiedFileRow: FC<UnifiedFileRowProps> = ({ row, onView, isSelected, onToggle }) => {
+const UnifiedFileRow: FC<UnifiedFileRowProps> = ({ row, onView }) => {
     const statusCell = {
-        locked: <LockIcon size={18} color="var(--mantine-color-gray-5)" />,
-        approved: <CheckCircleIcon size={18} weight="fill" color="var(--mantine-color-green-6)" />,
-        decrypted: (
-            <Checkbox checked={isSelected} onChange={() => onToggle(row.name)} aria-label={`Select ${row.label}`} />
-        ),
-        'not-shared': (
-            <InfoTooltip label="Not shared with researcher" withArrow>
-                <XCircleIcon
-                    size={18}
-                    weight="fill"
-                    color="var(--mantine-color-red-6)"
-                    aria-label={`${row.name} not shared with researcher`}
-                />
-            </InfoTooltip>
+        locked: <LockIcon size={18} color="var(--mantine-color-gray-5)" aria-label="Encrypted" />,
+        decrypted: <LockOpenIcon size={18} color="var(--mantine-color-blue-6)" aria-label="Decrypted" />,
+        approved: (
+            <CheckCircleIcon
+                size={18}
+                weight="fill"
+                color="var(--mantine-color-green-6)"
+                aria-label="Shared with researcher"
+            />
         ),
     }[row.state]
 
diff --git a/src/components/job-results.tsx b/src/components/job-results.tsx
index 397728aaa..7b21d3f06 100644
--- a/src/components/job-results.tsx
+++ b/src/components/job-results.tsx
@@ -80,18 +80,27 @@ export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
         onSuccess: setDecryptedFiles,
     })
 
-    // Decrypted content keyed by source row id, to attach View/Download to the matching row.
-    const decryptedBySourceId = useMemo(() => {
-        const map = new Map<string, JobFileInfo>()
-        for (const f of decryptedFiles ?? []) map.set(f.sourceId, f)
-        return map
-    }, [decryptedFiles])
-
-    // Results first, then logs.
-    const orderedFiles = useMemo(() => {
+    // One row per decrypted inner file once decrypted (each artifact is a whole-zip that unpacks
+    // into many files); before that, one locked row per encrypted artifact. Researchers receive
+    // results only — logs are never re-wrapped for them (DO-internal).
+    const rows = useMemo(() => {
+        if (decryptedFiles) {
+            return decryptedFiles.map((f) => ({
+                key: `${f.sourceId}-${f.path}`,
+                label: logLabel(f.fileType),
+                name: f.path,
+                decrypted: f as JobFileInfo | undefined,
+            }))
+        }
         const files = encryptedFiles ?? []
-        return [...files.filter(isResultFile), ...files.filter((f) => isEncryptedLogType(f.fileType))]
-    }, [encryptedFiles])
+        const ordered = [...files.filter(isResultFile), ...files.filter((f) => isEncryptedLogType(f.fileType))]
+        return ordered.map((f) => ({
+            key: f.studyJobFileId,
+            label: logLabel(f.fileType),
+            name: f.name,
+            decrypted: undefined as JobFileInfo | undefined,
+        }))
+    }, [encryptedFiles, decryptedFiles])
 
     const handleSubmit = form.onSubmit((values) => decrypt(values.privateKey))
 
@@ -105,13 +114,8 @@ export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
 
     return (
         <Stack>
-            {orderedFiles.map((file) => (
-                <FileRow
-                    key={file.studyJobFileId}
-                    label={logLabel(file.fileType)}
-                    name={file.name}
-                    decrypted={decryptedBySourceId.get(file.studyJobFileId)}
-                />
+            {rows.map((row) => (
+                <FileRow key={row.key} label={row.label} name={row.name} decrypted={row.decrypted} />
             ))}
             <PrivateKeyForm
                 isVisible={!decryptedFiles}
diff --git a/src/components/study/submitted-code-table.test.tsx b/src/components/study/submitted-code-table.test.tsx
index b8c0ca0e9..4510020c8 100644
--- a/src/components/study/submitted-code-table.test.tsx
+++ b/src/components/study/submitted-code-table.test.tsx
@@ -25,8 +25,6 @@ const buildFile = (overrides: Partial<LatestJobForStudy['files'][number]>): Late
     name: 'main.py',
     path: 'code/main.py',
     fileType: 'MAIN-CODE',
-    iv: null,
-    bytes: null,
     createdAt: '2026-01-01T12:00:00Z',
     ...overrides,
 })
diff --git a/src/database/migrations/1780000000000_study_job_file_keys.ts b/src/database/migrations/1780000000000_study_job_file_keys.ts
index abdd73a57..381dac791 100644
--- a/src/database/migrations/1780000000000_study_job_file_keys.ts
+++ b/src/database/migrations/1780000000000_study_job_file_keys.ts
@@ -1,39 +1,34 @@
 import { type Kysely, sql } from 'kysely'
 
 export async function up(db: Kysely<unknown>): Promise<void> {
-    await db.schema.alterTable('study_job_file').addColumn('iv', 'text').execute()
-    // Display-only pre-encryption size. `integer` caps at ~2.15 GB; if result files ever
-    // exceed that, widen to `bigint` (note: pg returns int8 as a string, so add an int8 type
-    // parser or coerce at the read sites — `bytes` is currently typed `number`).
-    await db.schema.alterTable('study_job_file').addColumn('bytes', 'integer').execute()
-
-    // Records the durable fact that a reviewer approved (and shared) this file. The
-    // per-recipient `study_job_file_key` rows are the *access* mechanism; approval is a
-    // historical event and must not be re-derived from current org membership (which can
-    // change). A file is approved iff approved_at is set.
-    await db.schema.alterTable('study_job_file').addColumn('approved_at', 'timestamptz').execute()
-    await db.schema
-        .alterTable('study_job_file')
-        .addColumn('approved_by_user_id', 'uuid', (col) => col.references('user.id').onDelete('set null'))
-        .execute()
-
+    // Per-recipient wrapped AES keys that grant a lab researcher access to one inner file of an
+    // approved results archive. The encrypted artifact stays a single whole-zip `study_job_file`
+    // row whose embedded manifest already holds the enclave recipients' keys (unchanged, prod
+    // format); these rows ADD researcher recipients without re-encrypting. `study_job_file_id`
+    // points at the whole-zip row, `file_path` is the inner file within it.
+    //
+    // Approval is all-or-nothing at the job level (per Phil 2026-06): it lives in
+    // `job_status_change` as a FILES-APPROVED event, NOT per file. A file is "shared with
+    // researchers" iff the job is approved — derived from job status, never a per-file column.
+    // These rows are the *access* mechanism.
     await db.schema
         .createTable('study_job_file_key')
         .addColumn('id', 'uuid', (col) => col.defaultTo(sql`v7uuid()`).primaryKey())
         .addColumn('study_job_file_id', 'uuid', (col) =>
             col.notNull().references('study_job_file.id').onDelete('cascade'),
         )
+        .addColumn('file_path', 'text', (col) => col.notNull())
         .addColumn('fingerprint', 'text', (col) => col.notNull())
         .addColumn('crypt', 'text', (col) => col.notNull())
         .addColumn('created_at', 'timestamptz', (col) => col.defaultTo(sql`now()`).notNull())
-        .addUniqueConstraint('study_job_file_key_file_fingerprint_unique', ['study_job_file_id', 'fingerprint'])
+        .addUniqueConstraint('study_job_file_key_file_path_fingerprint_unique', [
+            'study_job_file_id',
+            'file_path',
+            'fingerprint',
+        ])
         .execute()
 }
 
 export async function down(db: Kysely<unknown>): Promise<void> {
     await db.schema.dropTable('study_job_file_key').execute()
-    await db.schema.alterTable('study_job_file').dropColumn('approved_by_user_id').execute()
-    await db.schema.alterTable('study_job_file').dropColumn('approved_at').execute()
-    await db.schema.alterTable('study_job_file').dropColumn('bytes').execute()
-    await db.schema.alterTable('study_job_file').dropColumn('iv').execute()
 }
diff --git a/src/database/types.ts b/src/database/types.ts
index 163195f35..76427bd17 100644
--- a/src/database/types.ts
+++ b/src/database/types.ts
@@ -255,13 +255,9 @@ export interface StudyJob {
 }
 
 export interface StudyJobFile {
-    approvedAt: Timestamp | null
-    approvedByUserId: string | null
-    bytes: number | null
     createdAt: Generated<Timestamp>
     fileType: StudyJobFileType
     id: Generated<string>
-    iv: string | null
     name: string
     path: string
     sourceId: string | null
@@ -271,6 +267,7 @@ export interface StudyJobFile {
 export interface StudyJobFileKey {
     createdAt: Generated<Timestamp>
     crypt: string
+    filePath: string
     fingerprint: string
     id: Generated<string>
     studyJobFileId: string
diff --git a/src/hooks/use-decrypt-files.ts b/src/hooks/use-decrypt-files.ts
index 74aecc38b..519118186 100644
--- a/src/hooks/use-decrypt-files.ts
+++ b/src/hooks/use-decrypt-files.ts
@@ -3,53 +3,63 @@ import { ENCRYPTED_TO_APPROVED } from '@/lib/file-type-helpers'
 import type { JobFileInfo } from '@/lib/types'
 import { isNotEmpty, useForm } from '@mantine/form'
 import { useMutation } from '@/common'
-import { decryptFile } from 'si-encryption/job-results/crypto'
-import { pemToArrayBuffer, privateKeyFromBuffer } from 'si-encryption/util'
+import { ResultsReader } from 'si-encryption/job-results/reader'
+import { fingerprintPublicKeyFromPrivateKey, pemToArrayBuffer, privateKeyFromBuffer } from 'si-encryption/util'
 import type { FileType } from '@/database/types'
 
-// One decomposed encrypted file as returned by fetchEncryptedJobFilesAction: the
-// ciphertext body plus its iv and the requesting user's wrapped AES key (`crypt`).
+// One encrypted artifact as returned by fetchEncryptedJobFilesAction: the whole-zip ciphertext
+// blob (prod format, embedded manifest). Decrypting it yields the inner plaintext files.
+//
+// `overrideKeys` (inner file path -> wrapped AES key) is set only for lab researchers, who are
+// NOT manifest recipients: their per-file re-wrapped keys come from study_job_file_key and are
+// passed to the reader to decrypt with. Empty for enclave reviewers, who decrypt via the
+// embedded manifest using their own key's fingerprint.
 export type EncryptedJobFile = {
     studyJobFileId: string
     fileType: FileType
-    path: string
     name: string
-    iv: string
-    crypt: string
     encryptedBody: ArrayBuffer
+    overrideKeys: Record<string, string>
 }
 
 class KeyParseError extends Error {}
 class DecryptionError extends Error {}
 
 async function decryptFiles(encryptedFiles: EncryptedJobFile[], privateKey: string): Promise<JobFileInfo[]> {
+    let fingerprint = ''
     let privateKeyBuffer: ArrayBuffer
     try {
         privateKeyBuffer = pemToArrayBuffer(privateKey)
-        await privateKeyFromBuffer(privateKeyBuffer)
+        const key = await privateKeyFromBuffer(privateKeyBuffer)
+        fingerprint = await fingerprintPublicKeyFromPrivateKey(key)
     } catch (err) {
         throw new KeyParseError('Invalid key data, check that key was copied successfully', { cause: err })
     }
     try {
-        return await Promise.all(
-            encryptedFiles.map(async (file) => {
-                const { contents, rawAesKey } = await decryptFile({
-                    body: file.encryptedBody,
-                    iv: file.iv,
-                    crypt: file.crypt,
-                    privateKey: privateKeyBuffer,
-                })
-                return {
-                    path: file.name,
-                    contents,
-                    rawAesKey,
-                    sourceId: file.studyJobFileId,
+        const files: JobFileInfo[] = []
+        for (const artifact of encryptedFiles) {
+            const reader = new ResultsReader(
+                new Blob([artifact.encryptedBody]),
+                privateKeyBuffer,
+                fingerprint,
+                artifact.overrideKeys,
+            )
+            // Per-file raw AES key: each inner file has its own key, so re-wrap at approval
+            // wraps each file's key for the researchers (see buildSharedFiles).
+            const entries = await reader.extractFilesWithKeys()
+            for (const entry of entries) {
+                files.push({
+                    path: entry.path,
+                    contents: entry.contents,
+                    rawAesKey: entry.rawAesKey,
+                    sourceId: artifact.studyJobFileId,
                     // Map an encrypted type to its approved form; an already-approved input
                     // (researcher viewing shared results) keeps its type.
-                    fileType: ENCRYPTED_TO_APPROVED[file.fileType] ?? file.fileType,
-                }
-            }),
-        )
+                    fileType: ENCRYPTED_TO_APPROVED[artifact.fileType] ?? artifact.fileType,
+                })
+            }
+        }
+        return files
     } catch (err) {
         throw new DecryptionError('Private key is not valid for these results, check with your administrator', {
             cause: err,
diff --git a/src/hooks/use-encrypted-files-panel.ts b/src/hooks/use-encrypted-files-panel.ts
index d91339f0f..ed7cb9c99 100644
--- a/src/hooks/use-encrypted-files-panel.ts
+++ b/src/hooks/use-encrypted-files-panel.ts
@@ -14,7 +14,7 @@ type Options = {
     onFilesApproved: (files: JobFileInfo[]) => void
 }
 
-export type FileRowState = 'locked' | 'decrypted' | 'approved' | 'not-shared'
+export type FileRowState = 'locked' | 'decrypted' | 'approved'
 
 export type UnifiedFileRow = {
     key: string
@@ -30,26 +30,14 @@ function isEncryptedFile(fileType: FileType): boolean {
     return isEncryptedLogType(fileType) || fileType === 'ENCRYPTED-RESULT'
 }
 
-// State precedence: shared (approved) wins as the durable signal; otherwise a freshly
-// decrypted file is selectable; an approved job where this file was never approved means
-// it was withheld; everything else is still locked.
-function fileRowState(opts: { shared: boolean; decrypted: boolean; jobApproved: boolean }): FileRowState {
-    if (opts.shared) return 'approved'
-    if (opts.decrypted) return 'decrypted'
-    if (opts.jobApproved) return 'not-shared'
-    return 'locked'
-}
-
 export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
     const [decryptedFiles, setDecryptedFiles] = useState<JobFileInfo[]>([])
-    const [selectedPaths, setSelectedPaths] = useState<Set<string>>(new Set())
     const [viewingFile, setViewingFile] = useState<JobFile | null>(null)
 
-    // Once a job is approved, files the DO withheld are surfaced as "not shared" (red X) rather than hidden.
     const isJobApproved = (job.statusChanges ?? []).some((sc) => sc.status === 'FILES-APPROVED')
 
-    // Which files have been shared with researchers, per the recorded `approved_at` fact on
-    // each file row (see getSharedFileIdsForJob) — there is no plaintext approved copy.
+    // Which files are shared with researchers — all of the job's files once it's FILES-APPROVED,
+    // none before (all-or-nothing; see getSharedFileIdsForJob). There is no plaintext approved copy.
     const { data: sharedFileIds = [] } = useQuery({
         queryKey: ['shared-file-ids', job.id],
         queryFn: () => fetchSharedFileIdsAction({ jobId: job.id }),
@@ -75,58 +63,47 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
         form,
     } = useDecryptFiles({
         encryptedFiles,
-        onSuccess: (files) => {
-            setDecryptedFiles(files)
-            setSelectedPaths(new Set(files.filter(isResultFile).map((f) => f.path)))
-        },
+        onSuccess: (files) => setDecryptedFiles(files),
     })
 
+    // All-or-nothing: approving shares the entire result package (no per-file selection).
+    // Logs are a separate DO-internal artifact and are not shared with researchers.
     useEffect(() => {
-        const approved = decryptedFiles.filter((f) => selectedPaths.has(f.path))
-        onFilesApproved(approved)
-    }, [selectedPaths]) // eslint-disable-line react-hooks/exhaustive-deps
-
-    const toggleFile = (path: string) => {
-        setSelectedPaths((prev) => {
-            const next = new Set(prev)
-            if (next.has(path)) next.delete(path)
-            else next.add(path)
-            return next
-        })
-    }
+        onFilesApproved(decryptedFiles.filter(isResultFile))
+    }, [decryptedFiles]) // eslint-disable-line react-hooks/exhaustive-deps
 
     const encryptedRows = useMemo(() => (job.files ?? []).filter((f) => isEncryptedFile(f.fileType)), [job.files])
 
     const shouldShowForm = encryptedRows.length > 0 && decryptedFiles.length === 0
 
-    const decryptedById = useMemo(() => {
-        const map = new Map<string, JobFileInfo>()
-        for (const f of decryptedFiles) map.set(f.sourceId, f)
-        return map
-    }, [decryptedFiles])
-
     const sharedIdSet = useMemo(() => new Set(sharedFileIds), [sharedFileIds])
 
-    // One row per decomposed encrypted file.
+    // Before decryption: one locked row per encrypted artifact (results, logs); size is unknown
+    // until decrypted (pre-encryption byte counts aren't stored). After: one row per decrypted
+    // inner file — each artifact is a whole-zip that unpacks into many files, all sharing the
+    // artifact's row id (sourceId), so "shared" is keyed on that id.
     const fileRows: UnifiedFileRow[] = useMemo(() => {
-        return encryptedRows.map((f) => {
-            const decrypted = decryptedById.get(f.id) ?? null
-            const state = fileRowState({
-                shared: sharedIdSet.has(f.id),
-                decrypted: !!decrypted,
-                jobApproved: isJobApproved,
-            })
-            return {
-                key: `${f.fileType}-${f.id}`,
+        if (decryptedFiles.length > 0) {
+            return decryptedFiles.map((f) => ({
+                key: `${f.sourceId}-${f.path}`,
                 label: logLabel(f.fileType),
-                name: f.name,
-                bytes: f.bytes,
+                name: f.path,
+                bytes: f.contents.byteLength,
                 fileType: f.fileType,
-                state,
-                file: decrypted,
-            }
-        })
-    }, [encryptedRows, decryptedById, sharedIdSet, isJobApproved])
+                state: sharedIdSet.has(f.sourceId) ? 'approved' : 'decrypted',
+                file: f,
+            }))
+        }
+        return encryptedRows.map((f) => ({
+            key: `${f.fileType}-${f.id}`,
+            label: logLabel(f.fileType),
+            name: f.name,
+            bytes: null,
+            fileType: f.fileType,
+            state: sharedIdSet.has(f.id) ? 'approved' : 'locked',
+            file: null,
+        }))
+    }, [encryptedRows, decryptedFiles, sharedIdSet])
 
     const hasFileRows = fileRows.length > 0
 
@@ -144,8 +121,6 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
         hasFileRows,
         isLoadingBlob,
         shouldShowForm,
-        selectedPaths,
-        toggleFile,
         isDecrypting,
         form,
         handleSubmit,
diff --git a/src/lib/re-wrap-results.ts b/src/lib/re-wrap-results.ts
index 31e2eecb3..68530c7ad 100644
--- a/src/lib/re-wrap-results.ts
+++ b/src/lib/re-wrap-results.ts
@@ -4,19 +4,20 @@ import { fetchLabPublicKeysAction } from '@/server/actions/study-job.actions'
 import type { JobFileInfo, SharedFile } from '@/lib/types'
 
 /**
- * Re-wrap (not re-encrypt) approved files for the study's lab researchers, client-side.
+ * Re-wrap (not re-encrypt) approved results for the study's lab researchers, client-side.
  *
- * The reviewer's browser already holds each file's raw AES key from decrypting to review.
- * For every researcher public key we wrap that same key into a new wrapped key (`crypt`); the
- * file ciphertext is never touched. The server only ever receives wrapped keys — never the
- * raw AES key or plaintext.
+ * The results archive keeps the prod whole-zip format: one AES key PER inner file, embedded in
+ * the manifest for the enclave recipients. While decrypting to review, the reviewer's browser
+ * recovered each file's raw AES key (see use-decrypt-files). Here, for every researcher public
+ * key, we wrap that file's raw key into a new wrapped key (`crypt`); the ciphertext is never
+ * touched. The server only ever receives wrapped keys — never the raw AES key or plaintext.
  */
 export async function buildSharedFiles(studyId: string, files: JobFileInfo[]): Promise<SharedFile[]> {
     const labKeys = actionResult(await fetchLabPublicKeysAction({ studyId }))
 
     return Promise.all(
         files.map(async (file) => {
-            if (!file.rawAesKey) throw new Error(`missing raw AES key for file ${file.sourceId}`)
+            if (!file.rawAesKey) throw new Error(`missing raw AES key for file ${file.path}`)
             const rawAesKey = file.rawAesKey
             const keys = await Promise.all(
                 labKeys.map(async (key) => ({
@@ -24,7 +25,7 @@ export async function buildSharedFiles(studyId: string, files: JobFileInfo[]): P
                     crypt: await wrapAesKey(rawAesKey, key.publicKey),
                 })),
             )
-            return { studyJobFileId: file.sourceId, keys }
+            return { studyJobFileId: file.sourceId, filePath: file.path, keys }
         }),
     )
 }
diff --git a/src/lib/types.ts b/src/lib/types.ts
index b0c775ae6..b38cf4fdc 100644
--- a/src/lib/types.ts
+++ b/src/lib/types.ts
@@ -213,7 +213,8 @@ export const fileTypeSchema = z.enum(FILE_TYPES)
 // (a `study_job_file_key` row; see src/server/results-sharing.ts for the model).
 export const sharedFileKeySchema = z.object({ fingerprint: z.string(), crypt: z.string() })
 export const sharedFileSchema = z.object({
-    studyJobFileId: z.string(),
+    studyJobFileId: z.string(), // the whole-zip study_job_file row
+    filePath: z.string(), // the inner file within that archive (one AES key per inner file)
     keys: z.array(sharedFileKeySchema),
 })
 export type SharedFile = z.infer<typeof sharedFileSchema>
diff --git a/src/server/actions/study-job.actions.test.ts b/src/server/actions/study-job.actions.test.ts
index 5471863f6..887b15d26 100644
--- a/src/server/actions/study-job.actions.test.ts
+++ b/src/server/actions/study-job.actions.test.ts
@@ -33,41 +33,35 @@ describe('Study Job Actions', () => {
         })
     })
 
-    test('fetchEncryptedJobFilesAction returns only files the requesting user has a key box for', async () => {
-        // Enclave session users are seeded with fingerprint 'testFingerprint1'.
+    test('fetchEncryptedJobFilesAction returns the whole-zip artifacts to an enclave reviewer', async () => {
+        // Enclave reviewers are recipients in the embedded manifest, so they get every encrypted
+        // artifact (results + logs) with no override keys — they decrypt with their own key.
         const { org } = await mockSessionWithTestData({ orgType: 'enclave' })
         const { job } = await insertTestStudyJobData({ org })
 
         const file = await db
             .insertInto('studyJobFile')
             .values({
-                path: 'results/encrypted/test.csv',
-                name: 'test.csv',
+                path: 'results/encrypted-results.zip',
+                name: 'encrypted-results.zip',
                 studyJobId: job.id,
                 fileType: 'ENCRYPTED-CODE-RUN-LOG',
-                iv: 'aXY=',
             })
             .returning('id')
             .executeTakeFirstOrThrow()
 
-        await db
-            .insertInto('studyJobFileKey')
-            .values({ studyJobFileId: file.id, fingerprint: 'testFingerprint1', crypt: 'wrapped-key' })
-            .executeTakeFirstOrThrow()
-
         const result = actionResult(await fetchEncryptedJobFilesAction({ jobId: job.id }))
 
         expect(result).toHaveLength(1)
         expect(result[0].fileType).toBe('ENCRYPTED-CODE-RUN-LOG')
-        expect(result[0].crypt).toBe('wrapped-key')
-        expect(result[0].iv).toBe('aXY=')
         expect(result[0].studyJobFileId).toBe(file.id)
+        expect(result[0].overrideKeys).toEqual({})
     })
 
     // Regression: the middleware must expose submittedByOrgId so the CASL 'view StudyJob'
     // rule matches lab researchers, not just enclave reviewers — researchers fetch their
-    // re-wrapped result files through this same action.
-    test('fetchEncryptedJobFilesAction permits lab researchers to fetch their shared files', async () => {
+    // re-wrapped result files through this same action, with their per-file override keys.
+    test('fetchEncryptedJobFilesAction returns researcher override keys for shared files', async () => {
         const { org, user } = await mockSessionWithTestData({ orgType: 'lab' })
         const { job } = await insertTestStudyJobData({ org })
 
@@ -80,42 +74,50 @@ describe('Study Job Actions', () => {
         const file = await db
             .insertInto('studyJobFile')
             .values({
-                path: 'results/encrypted/results.csv',
-                name: 'results.csv',
+                path: 'results/encrypted-results.zip',
+                name: 'encrypted-results.zip',
                 studyJobId: job.id,
                 fileType: 'ENCRYPTED-RESULT',
-                iv: 'aXY=',
             })
             .returning('id')
             .executeTakeFirstOrThrow()
 
         await db
             .insertInto('studyJobFileKey')
-            .values({ studyJobFileId: file.id, fingerprint: 'labFingerprint1', crypt: 'wrapped-for-researcher' })
+            .values({
+                studyJobFileId: file.id,
+                filePath: 'results.csv',
+                fingerprint: 'labFingerprint1',
+                crypt: 'wrapped-for-researcher',
+            })
             .executeTakeFirstOrThrow()
 
         const result = actionResult(await fetchEncryptedJobFilesAction({ jobId: job.id }))
 
         expect(result).toHaveLength(1)
-        expect(result[0].crypt).toBe('wrapped-for-researcher')
+        expect(result[0].overrideKeys).toEqual({ 'results.csv': 'wrapped-for-researcher' })
     })
 
-    test('fetchEncryptedJobFilesAction omits files the user has no box for', async () => {
-        const { org } = await mockSessionWithTestData({ orgType: 'enclave' })
+    test('fetchEncryptedJobFilesAction returns nothing to a researcher with no shared keys', async () => {
+        const { org, user } = await mockSessionWithTestData({ orgType: 'lab' })
         const { job } = await insertTestStudyJobData({ org })
 
+        await db
+            .insertInto('userPublicKey')
+            .values({ userId: user.id, publicKey: Buffer.from('labPublicKey'), fingerprint: 'labFingerprint1' })
+            .executeTakeFirstOrThrow()
+
         await db
             .insertInto('studyJobFile')
             .values({
-                path: 'results/encrypted/secret.csv',
-                name: 'secret.csv',
+                path: 'results/encrypted-results.zip',
+                name: 'encrypted-results.zip',
                 studyJobId: job.id,
                 fileType: 'ENCRYPTED-RESULT',
-                iv: 'aXY=',
             })
             .executeTakeFirstOrThrow()
 
-        // No study_job_file_key row for this user → nothing they can decrypt.
+        // No study_job_file_key row for this researcher → nothing they can decrypt.
         const result = actionResult(await fetchEncryptedJobFilesAction({ jobId: job.id }))
         expect(result).toHaveLength(0)
     })
diff --git a/src/server/actions/study-job.actions.ts b/src/server/actions/study-job.actions.ts
index b92f397fb..8fed04552 100644
--- a/src/server/actions/study-job.actions.ts
+++ b/src/server/actions/study-job.actions.ts
@@ -34,18 +34,21 @@ export const approveStudyJobFilesAction = new Action('approveStudyJobFilesAction
     })
     .requireAbilityTo('approve', 'Study')
     .handler(async ({ params: { jobInfo: info, sharedFiles }, session, db }) => {
-        // Re-wrap, not re-encrypt: the reviewer's browser unwrapped each file's AES key
+        // Re-wrap, not re-encrypt: the reviewer's browser unwrapped the results' AES key
         // while reviewing and wrapped it for the lab researchers' public keys. Here we
         // only persist those new wrapped-key rows — the file ciphertext is never touched and
-        // the server never sees plaintext or the raw AES key. Adding a wrapped key = sharing;
-        // deleting one (future / Card 74) = revoking.
+        // the server never sees plaintext or the raw AES key. Adding a wrapped key = sharing.
+        // The FILES-APPROVED status change below is the all-or-nothing approval fact itself.
         //
-        // BACKFILL GAP (Card 73/74): keys are wrapped only for lab members who have a key
-        // *right now*. A researcher who joins the lab or generates their key after approval
-        // gets no wrapped key and cannot read already-approved results. Re-wrapping for late
-        // joiners (the reviewer no longer holds the raw AES key, so this needs a recovery flow)
-        // lands here.
-        await insertSharedFileKeys(db, info.studyJobId, sharedFiles, session.user.id)
+        // KNOWN LIMITATION — late-joining researchers (OUT OF SCOPE, per Phil 2026-06):
+        // Keys are wrapped only for lab members who have a registered public key at the moment
+        // of approval. A researcher who joins the lab or generates their key *after* approval
+        // gets no wrapped key and cannot read already-approved results. There is intentionally
+        // NO backfill/recovery flow: once approved, the reviewer's browser no longer holds the
+        // raw AES key, so re-wrapping for a late joiner would require a reviewer to re-open and
+        // re-decrypt the results. Researchers must have their keys registered before approval.
+        // FLAG FOR PO: if backfill is ever required, a recovery flow would land here.
+        await insertSharedFileKeys(db, info.studyJobId, sharedFiles)
 
         await db
             .insertInto('jobStatusChange')
@@ -77,8 +80,8 @@ export const fetchLabPublicKeysAction = new Action('fetchLabPublicKeysAction')
         return await getLabPublicKeysForStudy(studyId)
     })
 
-// IDs of files a reviewer approved & shared with researchers, per the recorded `approved_at`
-// fact on each file row (see getSharedFileIdsForJob). There is no plaintext approved copy.
+// IDs of files shared with researchers — all of the job's files once it's FILES-APPROVED,
+// none before (all-or-nothing; see getSharedFileIdsForJob). There is no plaintext approved copy.
 export const fetchSharedFileIdsAction = new Action('fetchSharedFileIdsAction')
     .params(z.object({ jobId: z.string() }))
     .middleware(async ({ params: { jobId } }) => {
@@ -188,9 +191,6 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
     .requireAbilityTo('view', 'StudyJob')
 
     .handler(async ({ studyJob, session, db }) => {
-        // Per decomposed file (Option B): each row is one encrypted body in S3 + an `iv`,
-        // with the requesting user's wrapped AES key in study_job_file_key.
-        // We return only files this user actually has a wrapped key for — others stay opaque.
         const userKey = await getUserPublicKey(session.user.id)
         if (!userKey) return []
 
@@ -199,11 +199,36 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
         )
         if (!encryptedFiles.length) return []
 
-        // One query for all of this user's wrapped keys, then fetch the matching bodies in
-        // parallel — avoids a per-file round trip to both Postgres and S3.
+        // Each artifact is the prod whole-zip (embedded manifest). Enclave reviewers are manifest
+        // recipients and decrypt with their own key; lab researchers are not, so they decrypt with
+        // per-file re-wrapped keys (study_job_file_key) supplied as `overrideKeys`. A reviewer is a
+        // member of the study's enclave org (study.orgId); everyone else takes the researcher path.
+        const isEnclaveReviewer = Object.values(session.orgs).some(
+            (org) => org.id === studyJob.orgId && org.type === 'enclave',
+        )
+
+        // TODO(perf): every ciphertext body is buffered into server memory and serialized through
+        // the server-action layer. DEFERRED on purpose (Phil 2026-06) — fine at current result
+        // sizes. ESCAPE HATCH if we hit limits: hand the client a short-lived signed S3 URL and let
+        // it fetch ciphertext directly + decrypt, instead of proxying through here.
+        if (isEnclaveReviewer) {
+            return Promise.all(
+                encryptedFiles.map(async (file) => ({
+                    studyJobFileId: file.id,
+                    fileType: file.fileType,
+                    name: file.name,
+                    encryptedBody: await (await fetchFileContents(file.path)).arrayBuffer(),
+                    overrideKeys: {} as Record<string, string>,
+                })),
+            )
+        }
+
+        // Researcher: results only (logs are never re-wrapped — DO-internal). Return only artifacts
+        // this user has wrapped keys for; the keys exist only after approval, so this is naturally
+        // gated. Build the inner {file_path -> crypt} override map per artifact.
         const wrappedKeys = await db
             .selectFrom('studyJobFileKey')
-            .select(['studyJobFileId', 'crypt'])
+            .select(['studyJobFileId', 'filePath', 'crypt'])
             .where(
                 'studyJobFileId',
                 'in',
@@ -211,29 +236,24 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
             )
             .where('fingerprint', '=', userKey.fingerprint)
             .execute()
-        const cryptByFileId = new Map(wrappedKeys.map((k) => [k.studyJobFileId, k.crypt]))
-
-        const ready = encryptedFiles.flatMap((file) => {
-            const crypt = cryptByFileId.get(file.id)
-            // No wrapped key for this user, or no iv to decrypt with → stays opaque. A null `iv` means
-            // a legacy (pre-decompose) job; those have no encrypted body here and fall back to
-            // the legacy plaintext download route (src/app/dl/results/...). Intended, not a gap.
-            return crypt && file.iv ? [{ file, crypt, iv: file.iv }] : []
-        })
-
-        // TODO(perf): every ciphertext body is buffered into server memory and serialized
-        // through the server-action layer. Fine at current result sizes; if results grow
-        // large, switch to returning signed S3 URLs and let the client fetch/decrypt as a
-        // stream (also relevant: `study_job_file.bytes` is `integer`, capping at ~2.15 GB).
+        if (!wrappedKeys.length) return []
+
+        const overrideByFileId = new Map<string, Record<string, string>>()
+        for (const key of wrappedKeys) {
+            const map = overrideByFileId.get(key.studyJobFileId) ?? {}
+            map[key.filePath] = key.crypt
+            overrideByFileId.set(key.studyJobFileId, map)
+        }
+
         return Promise.all(
-            ready.map(async ({ file, crypt, iv }) => ({
-                studyJobFileId: file.id,
-                fileType: file.fileType,
-                path: file.path,
-                name: file.name,
-                iv,
-                crypt,
-                encryptedBody: await (await fetchFileContents(file.path)).arrayBuffer(),
-            })),
+            encryptedFiles
+                .filter((file) => overrideByFileId.has(file.id))
+                .map(async (file) => ({
+                    studyJobFileId: file.id,
+                    fileType: file.fileType,
+                    name: file.name,
+                    encryptedBody: await (await fetchFileContents(file.path)).arrayBuffer(),
+                    overrideKeys: overrideByFileId.get(file.id)!,
+                })),
         )
     })
diff --git a/src/server/actions/study.actions.ts b/src/server/actions/study.actions.ts
index 6895244d5..563006251 100644
--- a/src/server/actions/study.actions.ts
+++ b/src/server/actions/study.actions.ts
@@ -319,7 +319,7 @@ async function approveJobCode({
     if (sharedFiles?.length) {
         // Re-wrap: persist only the per-researcher wrapped AES keys the reviewer's
         // browser produced. Ciphertext is untouched; no plaintext is stored.
-        await insertSharedFileKeys(db, job.id, sharedFiles, userId)
+        await insertSharedFileKeys(db, job.id, sharedFiles)
     }
 }
 
diff --git a/src/server/db/queries.ts b/src/server/db/queries.ts
index 349f446f4..e5a65924f 100644
--- a/src/server/db/queries.ts
+++ b/src/server/db/queries.ts
@@ -55,7 +55,7 @@ export async function getStudyJobInfo(studyJobId: string) {
             jsonArrayFrom(
                 eb
                     .selectFrom('studyJobFile')
-                    .select(['id', 'name', 'path', 'fileType', 'iv', 'bytes'])
+                    .select(['id', 'name', 'path', 'fileType'])
                     .whereRef('studyJobFile.studyJobId', '=', 'studyJob.id'),
             ).as('files'),
         ])
@@ -93,7 +93,7 @@ function latestJobForStudyQuery(studyId: string) {
             jsonArrayFrom(
                 eb
                     .selectFrom('studyJobFile')
-                    .select(['id', 'name', 'path', 'fileType', 'iv', 'bytes', 'createdAt'])
+                    .select(['id', 'name', 'path', 'fileType', 'createdAt'])
                     .whereRef('studyJobFile.studyJobId', '=', 'studyJob.id'),
             ).as('files'),
         ])
@@ -478,17 +478,22 @@ export async function getLabPublicKeysForStudy(studyId: string): Promise<PublicK
 }
 
 /**
- * IDs of this job's files a reviewer approved & shared with researchers. Driven by the
- * recorded `approved_at` fact, not by current org membership — removing a researcher from
- * the lab must not retroactively un-approve files (see `insertSharedFileKeys`).
+ * IDs of this job's files shared with researchers. Approval is all-or-nothing at the job
+ * level (per Phil 2026-06): once a FILES-APPROVED event exists, every file of the job is
+ * shared. Driven by the recorded status event, not current org membership — removing a
+ * researcher from the lab must not retroactively un-approve files. Returns [] if not approved.
  */
 export async function getSharedFileIdsForJob(jobId: string): Promise<string[]> {
-    const rows = await Action.db
-        .selectFrom('studyJobFile')
+    const approved = await Action.db
+        .selectFrom('jobStatusChange')
         .select('id')
         .where('studyJobId', '=', jobId)
-        .where('approvedAt', 'is not', null)
-        .execute()
+        .where('status', '=', 'FILES-APPROVED')
+        .executeTakeFirst()
+
+    if (!approved) return []
+
+    const rows = await Action.db.selectFrom('studyJobFile').select('id').where('studyJobId', '=', jobId).execute()
 
     return rows.map((r) => r.id)
 }
diff --git a/src/server/results-sharing.test.ts b/src/server/results-sharing.test.ts
index c2e6f006c..3616175e2 100644
--- a/src/server/results-sharing.test.ts
+++ b/src/server/results-sharing.test.ts
@@ -16,11 +16,10 @@ async function insertSharedFileScenario() {
     const file = await db
         .insertInto('studyJobFile')
         .values({
-            path: 'results/encrypted/results.csv',
-            name: 'results.csv',
+            path: 'results/encrypted-results.zip',
+            name: 'encrypted-results.zip',
             studyJobId: job.id,
             fileType: 'ENCRYPTED-RESULT',
-            iv: 'aXY=',
         })
         .returning('id')
         .executeTakeFirstOrThrow()
@@ -31,76 +30,54 @@ async function insertSharedFileScenario() {
 const selectKeyRows = (fileId: string) =>
     db.selectFrom('studyJobFileKey').select(['fingerprint', 'crypt']).where('studyJobFileId', '=', fileId).execute()
 
-const selectApproval = (fileId: string) =>
-    db
-        .selectFrom('studyJobFile')
-        .select(['approvedAt', 'approvedByUserId'])
-        .where('id', '=', fileId)
-        .executeTakeFirstOrThrow()
-
+// Approval is recorded by the caller as a job-level FILES-APPROVED status change, not here.
+// These tests cover only the access mechanism: persisting validated wrapped-key rows.
 describe('insertSharedFileKeys', () => {
-    test('persists wrapped keys and records the approval on the file', async () => {
-        const { approver, job, file } = await insertSharedFileScenario()
+    test('persists wrapped keys for a valid lab recipient', async () => {
+        const { job, file } = await insertSharedFileScenario()
 
-        await insertSharedFileKeys(
-            db,
-            job.id,
-            [{ studyJobFileId: file.id, keys: [{ fingerprint: LAB_FINGERPRINT, crypt: 'wrapped-key' }] }],
-            approver.id,
-        )
+        await insertSharedFileKeys(db, job.id, [
+            {
+                studyJobFileId: file.id,
+                filePath: 'results.csv',
+                keys: [{ fingerprint: LAB_FINGERPRINT, crypt: 'wrapped-key' }],
+            },
+        ])
 
         const keyRows = await selectKeyRows(file.id)
         expect(keyRows).toHaveLength(1)
         expect(keyRows[0]).toMatchObject({ fingerprint: LAB_FINGERPRINT, crypt: 'wrapped-key' })
-
-        const approval = await selectApproval(file.id)
-        expect(approval.approvedAt).toBeInstanceOf(Date)
-        expect(approval.approvedByUserId).toBe(approver.id)
     })
 
     test('rejects a fingerprint that is not a lab recipient and writes nothing', async () => {
-        const { approver, job, file } = await insertSharedFileScenario()
+        const { job, file } = await insertSharedFileScenario()
 
         await expect(
-            insertSharedFileKeys(
-                db,
-                job.id,
-                [{ studyJobFileId: file.id, keys: [{ fingerprint: 'not-a-lab-key', crypt: 'bogus' }] }],
-                approver.id,
-            ),
+            insertSharedFileKeys(db, job.id, [
+                {
+                    studyJobFileId: file.id,
+                    filePath: 'results.csv',
+                    keys: [{ fingerprint: 'not-a-lab-key', crypt: 'bogus' }],
+                },
+            ]),
         ).rejects.toThrow(ActionFailure)
 
         expect(await selectKeyRows(file.id)).toHaveLength(0)
-        const approval = await selectApproval(file.id)
-        expect(approval.approvedAt).toBeNull()
     })
 
     test('is idempotent: re-running the same share does not duplicate key rows', async () => {
-        const { approver, job, file } = await insertSharedFileScenario()
+        const { job, file } = await insertSharedFileScenario()
         const sharedFiles = [
-            { studyJobFileId: file.id, keys: [{ fingerprint: LAB_FINGERPRINT, crypt: 'wrapped-key' }] },
+            {
+                studyJobFileId: file.id,
+                filePath: 'results.csv',
+                keys: [{ fingerprint: LAB_FINGERPRINT, crypt: 'wrapped-key' }],
+            },
         ]
 
-        await insertSharedFileKeys(db, job.id, sharedFiles, approver.id)
-        await insertSharedFileKeys(db, job.id, sharedFiles, approver.id)
+        await insertSharedFileKeys(db, job.id, sharedFiles)
+        await insertSharedFileKeys(db, job.id, sharedFiles)
 
         expect(await selectKeyRows(file.id)).toHaveLength(1)
     })
-
-    test('never overwrites an earlier approval timestamp or approver', async () => {
-        const { org, approver, job, file } = await insertSharedFileScenario()
-        const sharedFiles = [
-            { studyJobFileId: file.id, keys: [{ fingerprint: LAB_FINGERPRINT, crypt: 'wrapped-key' }] },
-        ]
-
-        await insertSharedFileKeys(db, job.id, sharedFiles, approver.id)
-        const first = await selectApproval(file.id)
-
-        const { user: secondApprover } = await insertTestUser({ org })
-        await insertSharedFileKeys(db, job.id, sharedFiles, secondApprover.id)
-
-        const second = await selectApproval(file.id)
-        expect(second.approvedAt?.getTime()).toBe(first.approvedAt?.getTime())
-        expect(second.approvedByUserId).toBe(approver.id)
-    })
 })
diff --git a/src/server/results-sharing.ts b/src/server/results-sharing.ts
index e21922a2b..af5ea8566 100644
--- a/src/server/results-sharing.ts
+++ b/src/server/results-sharing.ts
@@ -4,26 +4,20 @@ import type { SharedFile } from '@/lib/types'
 import { getLabPublicKeysForJob } from '@/server/db/queries'
 
 /**
- * Persist re-wrapped AES keys that grant lab researchers access to approved files, and
- * record the approval itself on each file. Each `study_job_file_key` row works like a PO
- * box: anyone can deposit (the reviewer wraps the file's AES key to a recipient's public
- * key), but only the holder of the matching private key can open it. Each wrapped key is
- * validated against the lab org's known public keys so a client can never share a file with
- * an arbitrary fingerprint. Idempotent via the (study_job_file_id, fingerprint) unique
- * constraint. The file ciphertext is untouched.
+ * Persist re-wrapped AES keys that grant lab researchers access to a job's files. Each
+ * `study_job_file_key` row works like a PO box: anyone can deposit (the reviewer wraps the
+ * file's AES key to a recipient's public key), but only the holder of the matching private
+ * key can open it. Each wrapped key is validated against the lab org's known public keys so a
+ * client can never share a file with an arbitrary fingerprint. Idempotent via the
+ * (study_job_file_id, file_path, fingerprint) unique constraint. The file ciphertext is untouched.
  *
- * Approval is recorded as `approved_at`/`approved_by_user_id` on the file row — the durable
- * historical fact — rather than being inferred from wrapped-key existence. The wrapped keys
- * are the access mechanism; revoking later (Card 74) by deleting one is *prospective only*:
- * a researcher who already unwrapped the AES key keeps it, so deletion stops future reads,
- * not past ones.
+ * Approval itself is recorded by the caller as a job-level FILES-APPROVED `job_status_change`
+ * event (all-or-nothing, per Phil 2026-06) — NOT as a per-file column. The wrapped keys are
+ * just the access mechanism; revoking later by deleting one is *prospective only*: a
+ * researcher who already unwrapped the AES key keeps it, so deletion stops future reads, not
+ * past ones.
  */
-export async function insertSharedFileKeys(
-    db: DBExecutor,
-    jobId: string,
-    sharedFiles: SharedFile[],
-    approvedByUserId: string,
-): Promise<void> {
+export async function insertSharedFileKeys(db: DBExecutor, jobId: string, sharedFiles: SharedFile[]): Promise<void> {
     const labKeys = await getLabPublicKeysForJob(jobId)
     const labFingerprints = new Set(labKeys.map((k) => k.fingerprint))
 
@@ -37,27 +31,20 @@ export async function insertSharedFileKeys(
             if (!labFingerprints.has(key.fingerprint)) {
                 throw new ActionFailure({ file: `fingerprint ${key.fingerprint} is not a lab recipient` })
             }
-            return { studyJobFileId: file.studyJobFileId, fingerprint: key.fingerprint, crypt: key.crypt }
+            return {
+                studyJobFileId: file.studyJobFileId,
+                filePath: file.filePath,
+                fingerprint: key.fingerprint,
+                crypt: key.crypt,
+            }
         }),
     )
 
-    const approvedFileIds = sharedFiles.map((f) => f.studyJobFileId)
-    if (!approvedFileIds.length) return
-
-    if (rows.length) {
-        await db
-            .insertInto('studyJobFileKey')
-            .values(rows)
-            .onConflict((oc) => oc.columns(['studyJobFileId', 'fingerprint']).doNothing())
-            .execute()
-    }
+    if (!rows.length) return
 
-    // `approved_at` is the durable historical fact — never overwrite an earlier approval
-    // if this runs again for the same file (e.g. a retried approve).
     await db
-        .updateTable('studyJobFile')
-        .set({ approvedAt: new Date(), approvedByUserId })
-        .where('id', 'in', approvedFileIds)
-        .where('approvedAt', 'is', null)
+        .insertInto('studyJobFileKey')
+        .values(rows)
+        .onConflict((oc) => oc.columns(['studyJobFileId', 'filePath', 'fingerprint']).doNothing())
         .execute()
 }
diff --git a/src/server/storage.ts b/src/server/storage.ts
index 240b61295..06d7fdfa3 100644
--- a/src/server/storage.ts
+++ b/src/server/storage.ts
@@ -1,9 +1,8 @@
-import { deleteS3File, fetchS3File, signedUrlForFile, storeS3File } from './aws'
+import { fetchS3File, signedUrlForFile, storeS3File } from './aws'
 import { MinimalJobInfo, MinimalStudyInfo, StudyDocumentType } from '@/lib/types'
 import { pathForStudyDocumentFile, pathForStudyJob, pathForStudyJobCodeFile } from '@/lib/paths'
 import { db } from '@/database'
 import { FileType } from '@/database/types'
-import { decomposeResultsZip } from 'si-encryption/job-results/decompose'
 
 export async function fetchFileContents(filePath: string) {
     const stream = await fetchS3File(filePath)
@@ -35,70 +34,9 @@ async function storeJobFile(info: MinimalJobInfo, path: string, file: File, file
         .executeTakeFirstOrThrow()
 }
 
-/**
- * Decompose a ResultsWriter zip on ingest (Option B): each encrypted file body
- * becomes its own S3 object, and its metadata (iv, bytes) + per-recipient wrapped
- * keys (the DO/reviewer recipients from the manifest) are stored in Postgres.
- *
- * Touches no plaintext and needs no private key — the manifest is plaintext
- * metadata and the bodies stay ciphertext. One row per decomposed file; sharing
- * a file later = adding a `study_job_file_key` row, never re-encrypting.
- *
- * Trust model is honest-but-curious: the server is the storage authority for the
- * ciphertext bodies + IVs but is trusted not to tamper with them. The AES-CBC
- * scheme gives confidentiality (the server can never read results), not integrity
- * — there's no auth tag, so a *malicious* server could alter ciphertext undetected.
- * If that ever becomes part of the threat model, move to AEAD (AES-GCM) or have the
- * enclave sign (iv ‖ ciphertext) for client-side verification.
- */
-async function storeDecomposedEncryptedFiles(info: MinimalJobInfo, file: File, fileType: FileType, subdir: string) {
-    const decomposed = await decomposeResultsZip(file)
-    // entry.path is the inner filename from TOA's manifest. TOA is trusted, so we use it
-    // directly as the S3 key suffix; if that trust ever weakens, sanitize for `..`/collisions.
-    const items = decomposed.map((entry) => ({
-        entry,
-        path: `${pathForStudyJob(info)}/results/${subdir}/${entry.path}`,
-    }))
-
-    // Write the bodies to S3 first, in parallel. S3 is not part of the DB transaction
-    // below, so if the transaction fails we best-effort delete what we wrote — otherwise a
-    // rollback would leave orphaned objects with no row pointing at them.
-    await Promise.all(items.map(({ entry, path }) => storeS3File(info, new Blob([entry.body]).stream(), path)))
-
-    try {
-        return await db.transaction().execute(async (trx) => {
-            const rows = []
-            const wrappedKeys = []
-            for (const { entry, path } of items) {
-                const row = await trx
-                    .insertInto('studyJobFile')
-                    .values({
-                        path,
-                        name: entry.path,
-                        studyJobId: info.studyJobId,
-                        fileType,
-                        iv: entry.iv,
-                        bytes: entry.bytes,
-                    })
-                    .returning('id')
-                    .executeTakeFirstOrThrow()
-
-                for (const [fingerprint, { crypt }] of Object.entries(entry.keys)) {
-                    wrappedKeys.push({ studyJobFileId: row.id, fingerprint, crypt })
-                }
-                rows.push(row)
-            }
-            if (wrappedKeys.length) await trx.insertInto('studyJobFileKey').values(wrappedKeys).execute()
-            return rows
-        })
-    } catch (err) {
-        await Promise.allSettled(items.map(({ path }) => deleteS3File(path)))
-        throw err
-    }
-}
-
 export async function storeStudyEncryptedLogFile(info: MinimalJobInfo, file: File, fileType: FileType) {
-    return await storeDecomposedEncryptedFiles(info, file, fileType, 'encrypted-logs')
+    const filename = fileType.toLowerCase()
+    return await storeJobFile(info, `${pathForStudyJob(info)}/results/${filename}.zip`, file, fileType)
 }
 
 export async function storeStudyLogFile(info: MinimalJobInfo, file: File, fileType: FileType) {
@@ -106,6 +44,18 @@ export async function storeStudyLogFile(info: MinimalJobInfo, file: File, fileTy
     return await storeJobFile(info, `${pathForStudyJob(info)}/results/${filename}.txt`, file, fileType)
 }
 
+// Encryption granularity vs storage granularity — two different levels, easy to conflate:
+//   - CRYPTO is PER FILE: TOA's ResultsWriter gives each inner file its own AES key + IV and
+//     encrypts it individually; the wrapped keys live in a manifest.json embedded in the zip.
+//   - STORAGE is the WHOLE ZIP: that manifest + all the per-file ciphertexts are one archive,
+//     persisted as a single S3 object / a single `study_job_file` row here.
+// So sharing with a researcher re-wraps EACH file's key (one `study_job_file_key` row per inner
+// file per researcher) — not one key for the whole archive. The format is unchanged from prod;
+// we deliberately do NOT re-encrypt or repackage on ingest.
 export async function storeStudyEncryptedResultsFile(info: MinimalJobInfo, file: File) {
-    return await storeDecomposedEncryptedFiles(info, file, 'ENCRYPTED-RESULT', 'encrypted')
+    return await storeJobFile(info, `${pathForStudyJob(info)}/results/encrypted-results.zip`, file, 'ENCRYPTED-RESULT')
+}
+
+export async function storeApprovedJobFile(info: MinimalJobInfo, file: File, fileType: FileType, sourceId: string) {
+    return await storeJobFile(info, `${pathForStudyJob(info)}/results/approved/${file.name}`, file, fileType, sourceId)
 }

From 6cd77e2bb74710bdfe26285ba4e54f986d93c8e9 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Tue, 16 Jun 2026 08:56:04 -0400
Subject: [PATCH 26/45] Review comment

---
 src/server/results-sharing.test.ts | 30 ++++++++++++++++++++++++++++++
 src/server/results-sharing.ts      | 13 +++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/src/server/results-sharing.test.ts b/src/server/results-sharing.test.ts
index 3616175e2..6b89399ec 100644
--- a/src/server/results-sharing.test.ts
+++ b/src/server/results-sharing.test.ts
@@ -49,6 +49,36 @@ describe('insertSharedFileKeys', () => {
         expect(keyRows[0]).toMatchObject({ fingerprint: LAB_FINGERPRINT, crypt: 'wrapped-key' })
     })
 
+    test('rejects a file that does not belong to the job and writes nothing', async () => {
+        const { job } = await insertSharedFileScenario()
+
+        // A file from a different job — even with a valid lab fingerprint — must not be shareable
+        // through this job's approval.
+        const { job: otherJob } = await insertTestStudyJobData({ org: await insertTestOrg() })
+        const foreign = await db
+            .insertInto('studyJobFile')
+            .values({
+                path: 'results/encrypted-results.zip',
+                name: 'encrypted-results.zip',
+                studyJobId: otherJob.id,
+                fileType: 'ENCRYPTED-RESULT',
+            })
+            .returning('id')
+            .executeTakeFirstOrThrow()
+
+        await expect(
+            insertSharedFileKeys(db, job.id, [
+                {
+                    studyJobFileId: foreign.id,
+                    filePath: 'results.csv',
+                    keys: [{ fingerprint: LAB_FINGERPRINT, crypt: 'wrapped-key' }],
+                },
+            ]),
+        ).rejects.toThrow(ActionFailure)
+
+        expect(await selectKeyRows(foreign.id)).toHaveLength(0)
+    })
+
     test('rejects a fingerprint that is not a lab recipient and writes nothing', async () => {
         const { job, file } = await insertSharedFileScenario()
 
diff --git a/src/server/results-sharing.ts b/src/server/results-sharing.ts
index af5ea8566..67be04aa2 100644
--- a/src/server/results-sharing.ts
+++ b/src/server/results-sharing.ts
@@ -21,6 +21,19 @@ export async function insertSharedFileKeys(db: DBExecutor, jobId: string, shared
     const labKeys = await getLabPublicKeysForJob(jobId)
     const labFingerprints = new Set(labKeys.map((k) => k.fingerprint))
 
+    // Ownership guard: `studyJobFileId` comes from the client payload, so confirm every file
+    // actually belongs to `jobId` before we mark it shared. Without this, a reviewer with
+    // approve rights on job A could pass file ids from job B and — if B's lab happens to share a
+    // fingerprint — grant access to another job's files. Fingerprint validation below does not
+    // cover this ownership check.
+    const jobFiles = await db.selectFrom('studyJobFile').select('id').where('studyJobId', '=', jobId).execute()
+    const jobFileIds = new Set(jobFiles.map((f) => f.id))
+    for (const file of sharedFiles) {
+        if (!jobFileIds.has(file.studyJobFileId)) {
+            throw new ActionFailure({ file: `file ${file.studyJobFileId} does not belong to job ${jobId}` })
+        }
+    }
+
     // We validate that each wrapped key targets a real lab recipient, but — the server being
     // blind — we cannot verify the `crypt` actually wraps the file's correct AES key. A buggy
     // reviewer client could persist one that unwraps to garbage; the researcher would just fail

From 4ee4a74ee9ca4e210ffdd1437e67b5a484d0ec6b Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Tue, 16 Jun 2026 09:17:11 -0400
Subject: [PATCH 27/45] Small fixes

---
 src/components/job-results.tsx |  2 +-
 src/server/db/queries.test.ts  | 31 +++++++++++++++++++++++++++++++
 src/server/db/queries.ts       | 17 ++++++++++++-----
 3 files changed, 44 insertions(+), 6 deletions(-)

diff --git a/src/components/job-results.tsx b/src/components/job-results.tsx
index 7b21d3f06..cac22616a 100644
--- a/src/components/job-results.tsx
+++ b/src/components/job-results.tsx
@@ -89,7 +89,7 @@ export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
                 key: `${f.sourceId}-${f.path}`,
                 label: logLabel(f.fileType),
                 name: f.path,
-                decrypted: f as JobFileInfo | undefined,
+                decrypted: f,
             }))
         }
         const files = encryptedFiles ?? []
diff --git a/src/server/db/queries.test.ts b/src/server/db/queries.test.ts
index 5b4d23467..dbe192088 100644
--- a/src/server/db/queries.test.ts
+++ b/src/server/db/queries.test.ts
@@ -19,6 +19,7 @@ import {
     jobInfoForJobId,
     studyInfoForStudyId,
     getDataSourcesForOrg,
+    getSharedFileIdsForJob,
 } from './queries'
 import { pemToArrayBuffer, fingerprintKeyData } from 'si-encryption/util'
 import { ResultsWriter } from 'si-encryption/job-results/writer'
@@ -264,6 +265,36 @@ describe('currentReviewVersion', () => {
     })
 })
 
+describe('getSharedFileIdsForJob', () => {
+    const insertFile = (jobId: string, fileType: 'ENCRYPTED-RESULT' | 'ENCRYPTED-CODE-RUN-LOG') =>
+        db
+            .insertInto('studyJobFile')
+            .values({
+                studyJobId: jobId,
+                name: 'encrypted-results.zip',
+                path: `results/${fileType}.zip`,
+                fileType,
+            })
+            .returning('id')
+            .executeTakeFirstOrThrow()
+
+    it('returns [] when the job is not approved', async () => {
+        const { job } = await insertTestStudyJobData()
+        await insertFile(job.id, 'ENCRYPTED-RESULT')
+        expect(await getSharedFileIdsForJob(job.id)).toEqual([])
+    })
+
+    it('returns result file ids but excludes logs once approved', async () => {
+        const { job } = await insertTestStudyJobData()
+        const result = await insertFile(job.id, 'ENCRYPTED-RESULT')
+        await insertFile(job.id, 'ENCRYPTED-CODE-RUN-LOG')
+        await db.insertInto('jobStatusChange').values({ studyJobId: job.id, status: 'FILES-APPROVED' }).execute()
+
+        const ids = await getSharedFileIdsForJob(job.id)
+        expect(ids).toEqual([result.id])
+    })
+})
+
 describe('getStudyReviewForJob', () => {
     it('returns null when no review exists for the job', async () => {
         const { job } = await insertTestStudyJobData()
diff --git a/src/server/db/queries.ts b/src/server/db/queries.ts
index e5a65924f..392265876 100644
--- a/src/server/db/queries.ts
+++ b/src/server/db/queries.ts
@@ -478,10 +478,12 @@ export async function getLabPublicKeysForStudy(studyId: string): Promise<PublicK
 }
 
 /**
- * IDs of this job's files shared with researchers. Approval is all-or-nothing at the job
- * level (per Phil 2026-06): once a FILES-APPROVED event exists, every file of the job is
- * shared. Driven by the recorded status event, not current org membership — removing a
- * researcher from the lab must not retroactively un-approve files. Returns [] if not approved.
+ * IDs of this job's RESULT files shared with researchers. Approval is all-or-nothing at the job
+ * level (per Phil 2026-06): once a FILES-APPROVED event exists, every result file of the job is
+ * shared. Logs are excluded — they are DO-internal and never re-wrapped for researchers, so they
+ * must not show as "shared" (the reviewer panel keys its shared indicator on this set). Driven by
+ * the recorded status event, not current org membership — removing a researcher from the lab must
+ * not retroactively un-approve files. Returns [] if not approved.
  */
 export async function getSharedFileIdsForJob(jobId: string): Promise<string[]> {
     const approved = await Action.db
@@ -493,7 +495,12 @@ export async function getSharedFileIdsForJob(jobId: string): Promise<string[]> {
 
     if (!approved) return []
 
-    const rows = await Action.db.selectFrom('studyJobFile').select('id').where('studyJobId', '=', jobId).execute()
+    const rows = await Action.db
+        .selectFrom('studyJobFile')
+        .select('id')
+        .where('studyJobId', '=', jobId)
+        .where('fileType', '=', 'ENCRYPTED-RESULT')
+        .execute()
 
     return rows.map((r) => r.id)
 }

From 48bc93df46486aa88d57f51118f9b368d30d5de7 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Tue, 16 Jun 2026 10:13:55 -0400
Subject: [PATCH 28/45] Tests and cleanup

---
 src/app/api/job/[jobId]/results/route.test.ts | 31 +++++++++++++++++++
 src/app/{reviewer-key => user-key}/layout.tsx |  0
 src/app/{reviewer-key => user-key}/page.tsx   |  0
 .../regenerate-key-view.stories.tsx           |  4 +--
 .../regenerate-key-view.tsx                   |  2 +-
 .../regenerate-key.test.tsx                   |  0
 .../regenerate-key.tsx                        |  0
 src/components/layout/navbar-profile-menu.tsx |  4 +--
 src/hooks/use-profile-menu-disclosure.ts      |  2 +-
 src/lib/paths.ts                              |  2 +-
 src/lib/permission-types.ts                   |  8 ++---
 src/lib/routes/definitions.ts                 |  2 +-
 src/server/db/queries.test.ts                 | 13 ++++++++
 src/server/storage.ts                         |  4 ---
 14 files changed, 55 insertions(+), 17 deletions(-)
 rename src/app/{reviewer-key => user-key}/layout.tsx (100%)
 rename src/app/{reviewer-key => user-key}/page.tsx (100%)
 rename src/app/{reviewer-key => user-key}/regenerate-key-view.stories.tsx (88%)
 rename src/app/{reviewer-key => user-key}/regenerate-key-view.tsx (97%)
 rename src/app/{reviewer-key => user-key}/regenerate-key.test.tsx (100%)
 rename src/app/{reviewer-key => user-key}/regenerate-key.tsx (100%)

diff --git a/src/app/api/job/[jobId]/results/route.test.ts b/src/app/api/job/[jobId]/results/route.test.ts
index 4e7bc6cb7..3b03530ab 100644
--- a/src/app/api/job/[jobId]/results/route.test.ts
+++ b/src/app/api/job/[jobId]/results/route.test.ts
@@ -54,6 +54,37 @@ test.skipIf(!s3Available)('uploading results', async () => {
     expect(contents).toBeInstanceOf(Blob)
 })
 
+// Guards the stale-shared-key case: once a job is RUN-COMPLETE its encrypted results (and the
+// AES keys the manifest/researcher rows are wrapped against) are frozen. A re-post must be
+// rejected rather than overwrite the blob under already-shared keys. Re-runs use a NEW job.
+test('rejects a second results upload once the job is already complete', async () => {
+    const org = await insertTestOrg()
+    const { jobIds } = await insertTestStudyData({ org })
+    const jobId = jobIds[0]
+
+    const post = () => {
+        const formData = new FormData()
+        formData.append('result', new File([new Uint8Array([1, 2, 3])], 'r.txt', { type: 'text/plain' }))
+        return apiHandler.POST(new Request('http://localhost', { method: 'POST', body: formData }), {
+            params: Promise.resolve({ jobId }),
+        })
+    }
+
+    expect((await post()).ok).toBe(true)
+
+    const second = await post()
+    expect(second.status).toBe(422)
+
+    // The rejected re-post must not have created a duplicate ENCRYPTED-RESULT row.
+    const rows = await db
+        .selectFrom('studyJobFile')
+        .select('id')
+        .where('studyJobId', '=', jobId)
+        .where('fileType', '=', 'ENCRYPTED-RESULT')
+        .execute()
+    expect(rows).toHaveLength(1)
+})
+
 test.skipIf(!s3Available)('uploading logs', async () => {
     const org = await insertTestOrg()
     const logContents = 'long line one\nlog line two\n'
diff --git a/src/app/reviewer-key/layout.tsx b/src/app/user-key/layout.tsx
similarity index 100%
rename from src/app/reviewer-key/layout.tsx
rename to src/app/user-key/layout.tsx
diff --git a/src/app/reviewer-key/page.tsx b/src/app/user-key/page.tsx
similarity index 100%
rename from src/app/reviewer-key/page.tsx
rename to src/app/user-key/page.tsx
diff --git a/src/app/reviewer-key/regenerate-key-view.stories.tsx b/src/app/user-key/regenerate-key-view.stories.tsx
similarity index 88%
rename from src/app/reviewer-key/regenerate-key-view.stories.tsx
rename to src/app/user-key/regenerate-key-view.stories.tsx
index bbf48d358..d59e816ca 100644
--- a/src/app/reviewer-key/regenerate-key-view.stories.tsx
+++ b/src/app/user-key/regenerate-key-view.stories.tsx
@@ -3,13 +3,13 @@ import { useDisclosure } from '@mantine/hooks'
 import { pageBackgroundArgTypes } from '~ladle/backgrounds'
 import { RegenerateKeyView } from './regenerate-key-view'
 
-// The reviewer-key page-view. RegenerateKeyView is presentational; the container derives the
+// The user-key page-view. RegenerateKeyView is presentational; the container derives the
 // dashboard crumb from the session and wires navigation. These stories supply inline crumb
 // targets and drive the confirm modal with a local useDisclosure (no router/session needed).
 //
 // Note: this screen only renders the "key already exists" state. The "no key yet" case never
 // reaches this component — the route layout redirects to /account/keys when no key exists.
-const meta = { title: 'Pages / Reviewer key', argTypes: pageBackgroundArgTypes }
+const meta = { title: 'Pages / Results Key', argTypes: pageBackgroundArgTypes }
 export default meta
 
 export const KeyAlreadyExists: Story = () => {
diff --git a/src/app/reviewer-key/regenerate-key-view.tsx b/src/app/user-key/regenerate-key-view.tsx
similarity index 97%
rename from src/app/reviewer-key/regenerate-key-view.tsx
rename to src/app/user-key/regenerate-key-view.tsx
index 6263c97c7..ad420eab7 100644
--- a/src/app/reviewer-key/regenerate-key-view.tsx
+++ b/src/app/user-key/regenerate-key-view.tsx
@@ -5,7 +5,7 @@ import { Button, Divider, Group, Paper, Stack, Text, Title } from '@mantine/core
 import { AppModal } from '@/components/modals/app-modal'
 import { PageBreadcrumbs } from '@/components/page-breadcrumbs'
 
-// Presentational reviewer-key screen. It owns the breadcrumbs + "Results Key details" card
+// Presentational user-key screen. It owns the breadcrumbs + "Results Key details" card
 // (lost-key copy, destructive note, regenerate button) and the confirm modal. Kept in its OWN
 // file — free of useSession (Clerk), useRouter and Routes navigation — so it renders in
 // isolation (e.g. Ladle). The RegenerateKey container (./regenerate-key) derives the dashboard
diff --git a/src/app/reviewer-key/regenerate-key.test.tsx b/src/app/user-key/regenerate-key.test.tsx
similarity index 100%
rename from src/app/reviewer-key/regenerate-key.test.tsx
rename to src/app/user-key/regenerate-key.test.tsx
diff --git a/src/app/reviewer-key/regenerate-key.tsx b/src/app/user-key/regenerate-key.tsx
similarity index 100%
rename from src/app/reviewer-key/regenerate-key.tsx
rename to src/app/user-key/regenerate-key.tsx
diff --git a/src/components/layout/navbar-profile-menu.tsx b/src/components/layout/navbar-profile-menu.tsx
index f123b5b25..22881ce67 100644
--- a/src/components/layout/navbar-profile-menu.tsx
+++ b/src/components/layout/navbar-profile-menu.tsx
@@ -92,9 +92,9 @@ export function NavbarProfileMenu() {
                 <NavLink
                     label="Results Key"
                     leftSection={<LockIcon aria-hidden="true" />}
-                    onClick={navigateTo(Routes.reviewerKey)}
+                    onClick={navigateTo(Routes.userKey)}
                     c="white"
-                    active={pathname === Routes.reviewerKey}
+                    active={pathname === Routes.userKey}
                     color="blue.7"
                     variant="filled"
                     className={styles.navLinkProfileHover}
diff --git a/src/hooks/use-profile-menu-disclosure.ts b/src/hooks/use-profile-menu-disclosure.ts
index 9db64acbe..5d06246ee 100644
--- a/src/hooks/use-profile-menu-disclosure.ts
+++ b/src/hooks/use-profile-menu-disclosure.ts
@@ -5,7 +5,7 @@ import { useDisclosure } from '@mantine/hooks'
 import { usePathname } from 'next/navigation'
 import { useEffect, useCallback } from 'react'
 
-const PINNED_ROUTES: string[] = [Routes.researcherProfile, Routes.reviewerKey, Routes.adminSafeinsights]
+const PINNED_ROUTES: string[] = [Routes.researcherProfile, Routes.userKey, Routes.adminSafeinsights]
 
 /**
  * Manages profile menu disclosure state with special behavior:
diff --git a/src/lib/paths.ts b/src/lib/paths.ts
index f880292a4..e05f9e267 100644
--- a/src/lib/paths.ts
+++ b/src/lib/paths.ts
@@ -56,7 +56,7 @@ export const coderWorkspaceDataPath = (username: string, workspaceName: string)
     `/api/v2/users/${username}/workspace/${workspaceName}`
 export const coderWorkspaceBuildPath = (workspaceId: string) => `/api/v2/workspaces/${workspaceId}/builds`
 
-const NON_ORG_PREFIXES = ['about', 'account', 'dl', 'error-demo', 'dashboard', 'researcher', 'reviewer-key', 'admin']
+const NON_ORG_PREFIXES = ['about', 'account', 'dl', 'error-demo', 'dashboard', 'researcher', 'user-key', 'admin']
 export function extractOrgSlugFromPath(pathname: string) {
     const parts = pathname.split('/').slice(1)
     if (NON_ORG_PREFIXES.includes(parts[0])) {
diff --git a/src/lib/permission-types.ts b/src/lib/permission-types.ts
index c577b423b..cc24fd23c 100644
--- a/src/lib/permission-types.ts
+++ b/src/lib/permission-types.ts
@@ -42,11 +42,9 @@ type Abilities =
     | Ability<'Study', 'view' | 'create', { orgId?: UUID; submittedByOrgId?: UUID }>
     | Ability<'Study', 'review' | 'approve' | 'reject' | 'update' | 'delete', { orgId?: UUID; submittedByOrgId?: UUID }>
     | Ability<'StudyJob', 'view' | 'create', { orgId?: UUID; submittedByOrgId?: UUID }>
-    // NOTE(reviewers): renamed from 'ReviewerKey' — the same encryption key is now held by
-    // enclave reviewers AND lab researchers (orgNeedsKey), so the old name was misleading.
-    // The /reviewer-key URL and Routes.reviewerKey are intentionally unchanged (route
-    // definition changes are gated); UI copy now says "Results Key". Flag if you'd rather
-    // keep the old subject name or rename the route too.
+    // Renamed from 'ReviewerKey' — the same encryption key is now held by enclave reviewers
+    // AND lab researchers (orgNeedsKey), so the old name was misleading. Route + UI copy match:
+    // /user-key (Routes.userKey), "Results Key" in copy.
     | Ability<'UserKey', 'view' | 'update', object>
     | Ability<'Org', 'view' | 'update' | 'create' | 'delete', { orgId?: UUID; orgSlug?: string }>
     | Ability<'OrgMembers', 'view', { orgId?: UUID; orgSlug?: string }>
diff --git a/src/lib/routes/definitions.ts b/src/lib/routes/definitions.ts
index ed090c58b..b4970693c 100644
--- a/src/lib/routes/definitions.ts
+++ b/src/lib/routes/definitions.ts
@@ -191,7 +191,7 @@ export const Routes = {
 
     researcherProfile: '/researcher/profile' as Route,
 
-    reviewerKey: '/reviewer-key' as Route,
+    userKey: '/user-key' as Route,
 
     // -------------------------------------------------------------------------
     // Admin Routes
diff --git a/src/server/db/queries.test.ts b/src/server/db/queries.test.ts
index dbe192088..cf51da5bc 100644
--- a/src/server/db/queries.test.ts
+++ b/src/server/db/queries.test.ts
@@ -293,6 +293,19 @@ describe('getSharedFileIdsForJob', () => {
         const ids = await getSharedFileIdsForJob(job.id)
         expect(ids).toEqual([result.id])
     })
+
+    // Approval is the durable historical fact (the FILES-APPROVED status event), independent of
+    // current org membership. Removing a researcher from the lab must NOT retroactively
+    // un-approve files. This guards against anyone reintroducing a membership join here.
+    it('stays approved after the lab researchers are removed from the org', async () => {
+        const { org, job } = await insertTestStudyJobData()
+        const result = await insertFile(job.id, 'ENCRYPTED-RESULT')
+        await db.insertInto('jobStatusChange').values({ studyJobId: job.id, status: 'FILES-APPROVED' }).execute()
+
+        await db.deleteFrom('orgUser').where('orgId', '=', org.id).execute()
+
+        expect(await getSharedFileIdsForJob(job.id)).toEqual([result.id])
+    })
 })
 
 describe('getStudyReviewForJob', () => {
diff --git a/src/server/storage.ts b/src/server/storage.ts
index 06d7fdfa3..606ac25ef 100644
--- a/src/server/storage.ts
+++ b/src/server/storage.ts
@@ -55,7 +55,3 @@ export async function storeStudyLogFile(info: MinimalJobInfo, file: File, fileTy
 export async function storeStudyEncryptedResultsFile(info: MinimalJobInfo, file: File) {
     return await storeJobFile(info, `${pathForStudyJob(info)}/results/encrypted-results.zip`, file, 'ENCRYPTED-RESULT')
 }
-
-export async function storeApprovedJobFile(info: MinimalJobInfo, file: File, fileType: FileType, sourceId: string) {
-    return await storeJobFile(info, `${pathForStudyJob(info)}/results/approved/${file.name}`, file, fileType, sourceId)
-}

From b5b5915e5c964da1bd0cab5f8ac690c7591ddf16 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Tue, 16 Jun 2026 18:12:34 -0400
Subject: [PATCH 29/45] Allow researcher to see logs

---
 bin/inject-encrypted-results.ts               | 13 +++----
 src/components/encrypted-files-panel.test.tsx | 38 +++++++++++++++++++
 src/hooks/use-encrypted-files-panel.ts        | 10 +++--
 src/lib/re-wrap-results.ts                    |  7 ++--
 src/server/actions/study-job.actions.ts       |  7 ++--
 src/server/db/queries.test.ts                 |  6 +--
 src/server/db/queries.ts                      | 16 ++++----
 7 files changed, 70 insertions(+), 27 deletions(-)

diff --git a/bin/inject-encrypted-results.ts b/bin/inject-encrypted-results.ts
index e066764f4..6f9f20e07 100644
--- a/bin/inject-encrypted-results.ts
+++ b/bin/inject-encrypted-results.ts
@@ -96,13 +96,12 @@ async function main() {
     if (alreadyHasResults) {
         console.info(`Job already has encrypted results — skipping store (delete study_job_file rows to re-inject).`)
     } else {
-        const resultsZip = await buildZip(
-            [
-                { name: 'results.csv', content: 'group,count\nA,42\nB,17\n' },
-                { name: 'summary.txt', content: 'analysis complete: 2 groups\n' },
-            ],
-            reviewerKeys,
-        )
+        // Mirror the real enclave helper (osenclave `toa_results_upload`): it posts exactly ONE
+        // results file and ONE logs file — each artifact's zip therefore holds a single encrypted
+        // inner entry. Do NOT add multiple result files here; that's not a shape the live helper
+        // can produce (one file per upload + MA's RUN-COMPLETE 422 guard), and faking it gave us a
+        // misleading multi-row picture in the DB.
+        const resultsZip = await buildZip([{ name: 'results.csv', content: 'group,count\nA,42\nB,17\n' }], reviewerKeys)
         const logZip = await buildZip([{ name: 'run.log', content: 'job started\njob finished ok\n' }], reviewerKeys)
         await storeStudyEncryptedResultsFile(info, resultsZip)
         await storeStudyEncryptedLogFile(info, logZip, 'ENCRYPTED-CODE-RUN-LOG')
diff --git a/src/components/encrypted-files-panel.test.tsx b/src/components/encrypted-files-panel.test.tsx
index 84b685c32..fc669add4 100644
--- a/src/components/encrypted-files-panel.test.tsx
+++ b/src/components/encrypted-files-panel.test.tsx
@@ -192,6 +192,44 @@ describe('EncryptedFilesPanel', () => {
         })
     })
 
+    it('shares decrypted logs alongside results (all-or-nothing)', async () => {
+        const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
+        const resultArtifact = await seedArtifact(job, {
+            fileType: 'ENCRYPTED-RESULT',
+            subdir: 'encrypted',
+            files: [{ name: 'results.csv', content: 'name,age\nAlice,30' }],
+        })
+        const logArtifact = await seedArtifact(job, {
+            fileType: 'ENCRYPTED-CODE-RUN-LOG',
+            subdir: 'encrypted-logs',
+            files: [{ name: 'run.log', content: 'job started\njob finished ok' }],
+        })
+        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([resultArtifact, logArtifact])
+
+        const onFilesApproved = vi.fn()
+        const latestJob = await latestJobForStudy(study.id)
+        renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={onFilesApproved} />)
+
+        await enterKeyAndDecrypt()
+
+        await waitFor(() => {
+            expect(onFilesApproved).toHaveBeenLastCalledWith(
+                expect.arrayContaining([
+                    expect.objectContaining({
+                        path: 'results.csv',
+                        fileType: 'APPROVED-RESULT',
+                        sourceId: resultArtifact.studyJobFileId,
+                    }),
+                    expect.objectContaining({
+                        path: 'run.log',
+                        fileType: 'APPROVED-CODE-RUN-LOG',
+                        sourceId: logArtifact.studyJobFileId,
+                    }),
+                ]),
+            )
+        })
+    })
+
     it('opens a modal with CSV content rendered as a table', async () => {
         const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
         const artifact = await seedArtifact(job, {
diff --git a/src/hooks/use-encrypted-files-panel.ts b/src/hooks/use-encrypted-files-panel.ts
index ed7cb9c99..25368e44a 100644
--- a/src/hooks/use-encrypted-files-panel.ts
+++ b/src/hooks/use-encrypted-files-panel.ts
@@ -1,6 +1,6 @@
 import { useQuery } from '@/common'
 import { useDecryptFiles } from '@/hooks/use-decrypt-files'
-import { isEncryptedLogType, isResultFile, logLabel } from '@/lib/file-type-helpers'
+import { isEncryptedLogType, logLabel } from '@/lib/file-type-helpers'
 import type { JobFile, JobFileInfo } from '@/lib/types'
 import { fetchEncryptedJobFilesAction, fetchSharedFileIdsAction } from '@/server/actions/study-job.actions'
 import type { LatestJobForStudy } from '@/server/db/queries'
@@ -66,10 +66,12 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
         onSuccess: (files) => setDecryptedFiles(files),
     })
 
-    // All-or-nothing: approving shares the entire result package (no per-file selection).
-    // Logs are a separate DO-internal artifact and are not shared with researchers.
+    // All-or-nothing: approving shares the entire decrypted package — results AND logs — with
+    // the researchers (no per-file selection). Every decrypted artifact carries its own rawAesKey,
+    // so buildSharedFiles re-wraps each for the lab keys. (Per-artifact selection may return if Phil
+    // wants logs individually withholdable; for now approval shares everything.)
     useEffect(() => {
-        onFilesApproved(decryptedFiles.filter(isResultFile))
+        onFilesApproved(decryptedFiles)
     }, [decryptedFiles]) // eslint-disable-line react-hooks/exhaustive-deps
 
     const encryptedRows = useMemo(() => (job.files ?? []).filter((f) => isEncryptedFile(f.fileType)), [job.files])
diff --git a/src/lib/re-wrap-results.ts b/src/lib/re-wrap-results.ts
index 68530c7ad..e2ff1d90b 100644
--- a/src/lib/re-wrap-results.ts
+++ b/src/lib/re-wrap-results.ts
@@ -4,10 +4,11 @@ import { fetchLabPublicKeysAction } from '@/server/actions/study-job.actions'
 import type { JobFileInfo, SharedFile } from '@/lib/types'
 
 /**
- * Re-wrap (not re-encrypt) approved results for the study's lab researchers, client-side.
+ * Re-wrap (not re-encrypt) approved files — results and logs — for the study's lab researchers,
+ * client-side.
  *
- * The results archive keeps the prod whole-zip format: one AES key PER inner file, embedded in
- * the manifest for the enclave recipients. While decrypting to review, the reviewer's browser
+ * Each archive keeps the prod whole-zip format: one AES key PER inner file, embedded in the
+ * manifest for the enclave recipients. While decrypting to review, the reviewer's browser
  * recovered each file's raw AES key (see use-decrypt-files). Here, for every researcher public
  * key, we wrap that file's raw key into a new wrapped key (`crypt`); the ciphertext is never
  * touched. The server only ever receives wrapped keys — never the raw AES key or plaintext.
diff --git a/src/server/actions/study-job.actions.ts b/src/server/actions/study-job.actions.ts
index 8fed04552..d432ff41a 100644
--- a/src/server/actions/study-job.actions.ts
+++ b/src/server/actions/study-job.actions.ts
@@ -223,9 +223,10 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
             )
         }
 
-        // Researcher: results only (logs are never re-wrapped — DO-internal). Return only artifacts
-        // this user has wrapped keys for; the keys exist only after approval, so this is naturally
-        // gated. Build the inner {file_path -> crypt} override map per artifact.
+        // Researcher: return only artifacts this user has wrapped keys for. Approval re-wraps both
+        // results and logs (all-or-nothing), so both can appear here; the keys exist only after
+        // approval, so this is naturally gated. Build the inner {file_path -> crypt} override map
+        // per artifact.
         const wrappedKeys = await db
             .selectFrom('studyJobFileKey')
             .select(['studyJobFileId', 'filePath', 'crypt'])
diff --git a/src/server/db/queries.test.ts b/src/server/db/queries.test.ts
index cf51da5bc..c67d0e72b 100644
--- a/src/server/db/queries.test.ts
+++ b/src/server/db/queries.test.ts
@@ -284,14 +284,14 @@ describe('getSharedFileIdsForJob', () => {
         expect(await getSharedFileIdsForJob(job.id)).toEqual([])
     })
 
-    it('returns result file ids but excludes logs once approved', async () => {
+    it('returns result AND log file ids once approved (all-or-nothing)', async () => {
         const { job } = await insertTestStudyJobData()
         const result = await insertFile(job.id, 'ENCRYPTED-RESULT')
-        await insertFile(job.id, 'ENCRYPTED-CODE-RUN-LOG')
+        const log = await insertFile(job.id, 'ENCRYPTED-CODE-RUN-LOG')
         await db.insertInto('jobStatusChange').values({ studyJobId: job.id, status: 'FILES-APPROVED' }).execute()
 
         const ids = await getSharedFileIdsForJob(job.id)
-        expect(ids).toEqual([result.id])
+        expect(ids.sort()).toEqual([result.id, log.id].sort())
     })
 
     // Approval is the durable historical fact (the FILES-APPROVED status event), independent of
diff --git a/src/server/db/queries.ts b/src/server/db/queries.ts
index 392265876..a2896e382 100644
--- a/src/server/db/queries.ts
+++ b/src/server/db/queries.ts
@@ -5,6 +5,7 @@ import { AccessDeniedError, throwNotFound } from '@/lib/errors'
 import { wasCalledFromAPI } from '../api-context'
 import { findOrCreateSiUserId } from './mutations'
 import { FileType } from '@/database/types'
+import { ENCRYPTED_LOG_TYPES } from '@/lib/file-type-helpers'
 import { Selectable } from 'kysely'
 import { Action } from '../actions/action'
 import { fetchFileContents } from '@/server/storage'
@@ -478,12 +479,13 @@ export async function getLabPublicKeysForStudy(studyId: string): Promise<PublicK
 }
 
 /**
- * IDs of this job's RESULT files shared with researchers. Approval is all-or-nothing at the job
- * level (per Phil 2026-06): once a FILES-APPROVED event exists, every result file of the job is
- * shared. Logs are excluded — they are DO-internal and never re-wrapped for researchers, so they
- * must not show as "shared" (the reviewer panel keys its shared indicator on this set). Driven by
- * the recorded status event, not current org membership — removing a researcher from the lab must
- * not retroactively un-approve files. Returns [] if not approved.
+ * IDs of this job's files shared with researchers. Approval is all-or-nothing at the job level
+ * (per Phil 2026-06): once a FILES-APPROVED event exists, every researcher-facing encrypted
+ * artifact of the job is shared — results AND logs (code-run, security-scan, packaging-error),
+ * matching what the reviewer's browser re-wrapped on approve. The reviewer panel keys its "shared"
+ * indicator on this set, so it must list every shared artifact, not just results. Driven by the
+ * recorded status event, not current org membership — removing a researcher from the lab must not
+ * retroactively un-approve files. Returns [] if not approved.
  */
 export async function getSharedFileIdsForJob(jobId: string): Promise<string[]> {
     const approved = await Action.db
@@ -499,7 +501,7 @@ export async function getSharedFileIdsForJob(jobId: string): Promise<string[]> {
         .selectFrom('studyJobFile')
         .select('id')
         .where('studyJobId', '=', jobId)
-        .where('fileType', '=', 'ENCRYPTED-RESULT')
+        .where('fileType', 'in', ['ENCRYPTED-RESULT', ...ENCRYPTED_LOG_TYPES])
         .execute()
 
     return rows.map((r) => r.id)

From 9c4e09032d75b3bd08ca53e7b1807f9450d100e6 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Tue, 16 Jun 2026 18:22:32 -0400
Subject: [PATCH 30/45] Package fileg

---
 package.json   |  2 +-
 pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/package.json b/package.json
index 83fc2a29b..59d122876 100644
--- a/package.json
+++ b/package.json
@@ -113,7 +113,7 @@
         "react-phone-number-input": "^3.4.16",
         "remeda": "^2.33.6",
         "server-only": "^0.0.1",
-        "si-encryption": "github:safeinsights/encryption#0e892f0f38e8e92182fcf81d22c1760839e1d624",
+        "si-encryption": "github:safeinsights/encryption#eb2228d5068013640f9bf97debbfccf0ee40eeef",
         "uuid": "^14.0.0",
         "validator": "^13.15.26",
         "yjs": "^13.6.30",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 26ecbae9a..511e5ff98 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -217,8 +217,8 @@ importers:
         specifier: ^0.0.1
         version: 0.0.1
       si-encryption:
-        specifier: github:safeinsights/encryption#0e892f0f38e8e92182fcf81d22c1760839e1d624
-        version: https://codeload.github.com/safeinsights/encryption/tar.gz/0e892f0f38e8e92182fcf81d22c1760839e1d624
+        specifier: github:safeinsights/encryption#eb2228d5068013640f9bf97debbfccf0ee40eeef
+        version: https://codeload.github.com/safeinsights/encryption/tar.gz/eb2228d5068013640f9bf97debbfccf0ee40eeef
       uuid:
         specifier: ^14.0.0
         version: 14.0.0
@@ -6087,8 +6087,8 @@ packages:
     resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==}
     engines: {node: '>= 0.4'}
 
-  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/0e892f0f38e8e92182fcf81d22c1760839e1d624:
-    resolution: {gitHosted: true, tarball: https://codeload.github.com/safeinsights/encryption/tar.gz/0e892f0f38e8e92182fcf81d22c1760839e1d624}
+  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/eb2228d5068013640f9bf97debbfccf0ee40eeef:
+    resolution: {gitHosted: true, integrity: sha512-IfMAYolRfnN/BmfL6wF2m/3W9IMMbGovjPj5Cb7wj0TcDw53aFLJ6v9gfg8hP6bbHCFgxO9PinVmOFd89+b2bg==, tarball: https://codeload.github.com/safeinsights/encryption/tar.gz/eb2228d5068013640f9bf97debbfccf0ee40eeef}
     version: 0.0.1
 
   side-channel-list@1.0.1:
@@ -13870,7 +13870,7 @@ snapshots:
 
   shell-quote@1.8.4: {}
 
-  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/0e892f0f38e8e92182fcf81d22c1760839e1d624:
+  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/eb2228d5068013640f9bf97debbfccf0ee40eeef:
     dependencies:
       '@zip.js/zip.js': 2.8.26
       debug: 4.4.3

From 99a63490b6a5019d98d2dce8dde380060907c13a Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Tue, 16 Jun 2026 18:29:34 -0400
Subject: [PATCH 31/45] Vulnerability

---
 pnpm-lock.yaml      | 17 +++++++++--------
 pnpm-workspace.yaml |  4 ++++
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 511e5ff98..aefea1a2c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -8,6 +8,7 @@ overrides:
   '@types/react': 19.2.14
   esbuild: ^0.28.1
   form-data: ^4.0.6
+  hono: ^4.12.25
   minimatch: ^10.2.1
   picomatch: ^4.0.4
   postcss: ^8.5.10
@@ -1021,7 +1022,7 @@ packages:
     resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==}
     engines: {node: '>=18.14.1'}
     peerDependencies:
-      hono: ^4
+      hono: ^4.12.25
 
   '@humanfs/core@0.19.2':
     resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==}
@@ -4251,8 +4252,8 @@ packages:
   history@5.3.0:
     resolution: {integrity: sha512-ZqaKwjjrAYUYfLG+htGaIIZ4nioX2L70ZUMIFysS3xvBsSG4x/n1V6TXV3N8ZYNuFGlDirFg32T7B6WOUPDYcQ==}
 
-  hono@4.12.21:
-    resolution: {integrity: sha512-uV63apnb0kyPtAUwoWgaGh9HyIFcv8lgmzPZSiTBQAFOFGIzka5EZ1dZocmGnn0XdX0+XTqJ6Tqv7selMuGLRQ==}
+  hono@4.12.25:
+    resolution: {integrity: sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==}
     engines: {node: '>=16.9.0'}
 
   hosted-git-info@4.1.0:
@@ -7895,9 +7896,9 @@ snapshots:
       - bufferutil
       - utf-8-validate
 
-  '@hono/node-server@1.19.14(hono@4.12.21)':
+  '@hono/node-server@1.19.14(hono@4.12.25)':
     dependencies:
-      hono: 4.12.21
+      hono: 4.12.25
 
   '@humanfs/core@0.19.2':
     dependencies:
@@ -8391,7 +8392,7 @@ snapshots:
 
   '@modelcontextprotocol/sdk@1.29.0(zod@4.4.3)':
     dependencies:
-      '@hono/node-server': 1.19.14(hono@4.12.21)
+      '@hono/node-server': 1.19.14(hono@4.12.25)
       ajv: 8.20.0
       ajv-formats: 3.0.1(ajv@8.20.0)
       content-type: 1.0.5
@@ -8401,7 +8402,7 @@ snapshots:
       eventsource-parser: 3.0.8
       express: 5.2.1
       express-rate-limit: 8.5.2(express@5.2.1)
-      hono: 4.12.21
+      hono: 4.12.25
       jose: 6.2.3
       json-schema-typed: 8.0.2
       pkce-challenge: 5.0.1
@@ -11651,7 +11652,7 @@ snapshots:
     dependencies:
       '@babel/runtime': 7.29.2
 
-  hono@4.12.21: {}
+  hono@4.12.25: {}
 
   hosted-git-info@4.1.0:
     dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 060283863..c3ee5e9dc 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -14,6 +14,10 @@ overrides:
     '@types/react': 19.2.14
     esbuild: ^0.28.1
     form-data: ^4.0.6
+    # hono <4.12.25: GHSA-88fw-hqm2-52qc (CVE-2026-54290, HIGH) — CORS middleware reflects any
+    # Origin with credentials when origin defaults to wildcard. Dev-only transitive (@pandacss/dev
+    # → @pandacss/mcp → @modelcontextprotocol/sdk → @hono/node-server), but Trivy scans dev deps.
+    hono: ^4.12.25
     minimatch: ^10.2.1
     picomatch: ^4.0.4
     postcss: ^8.5.10

From 8430816454b846fbaa3486b4a82687ee31b14cf0 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Tue, 16 Jun 2026 18:40:35 -0400
Subject: [PATCH 32/45] Update tests

---
 src/components/job-results.tsx | 3 ++-
 tests/study-flow.spec.ts       | 8 ++------
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/src/components/job-results.tsx b/src/components/job-results.tsx
index cac22616a..d0c63d858 100644
--- a/src/components/job-results.tsx
+++ b/src/components/job-results.tsx
@@ -82,7 +82,8 @@ export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
 
     // One row per decrypted inner file once decrypted (each artifact is a whole-zip that unpacks
     // into many files); before that, one locked row per encrypted artifact. Researchers receive
-    // results only — logs are never re-wrapped for them (DO-internal).
+    // both results and approved logs (re-wrapped at approval, all-or-nothing); results are
+    // listed first, then logs.
     const rows = useMemo(() => {
         if (decryptedFiles) {
             return decryptedFiles.map((f) => ({
diff --git a/tests/study-flow.spec.ts b/tests/study-flow.spec.ts
index 29d97afb0..fc494a760 100644
--- a/tests/study-flow.spec.ts
+++ b/tests/study-flow.spec.ts
@@ -413,12 +413,8 @@ async function reviewerApprovesErrorLogs(page: Page, studyTitle: string): Promis
     // Wait for decryption to complete — View buttons appear in the file table
     await expect(page.getByRole('button', { name: 'View' }).first()).toBeVisible()
 
-    // Select the error log file to share with the researcher
-    const checkbox = page.getByRole('checkbox', { name: /Select Code Run Log/i })
-    await expect(checkbox).toBeVisible()
-    await checkbox.check()
-
-    // Wait for approve button to be enabled and click it
+    // All-or-nothing: approving shares every decrypted artifact (results + logs) with the
+    // researcher — no per-file selection. Approve directly once decrypted.
     const approveButton = page.getByRole('button', { name: /approve/i }).last()
     await expect(approveButton).toBeEnabled()
     await approveButton.click()

From cd1387dac1e80ac244555b08ef40bea8ac716cec Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Wed, 17 Jun 2026 10:11:34 -0400
Subject: [PATCH 33/45] Prune comments, commit to all or nothing log + results

---
 bin/inject-encrypted-results.ts               | 17 +++----
 .../[studyId]/review/job-review-buttons.tsx   |  2 +-
 .../[studyId]/review/study-review-buttons.tsx |  4 +-
 .../dl/results/[jobId]/[fileName]/route.ts    | 10 ++--
 src/components/job-results.tsx                | 15 +++---
 src/components/private-key-form.tsx           |  8 +--
 .../1780000000000_study_job_file_keys.ts      |  7 ++-
 src/hooks/use-decrypt-files.ts                | 15 +++---
 src/hooks/use-encrypted-files-panel.ts        | 15 +++---
 src/lib/permission-types.ts                   |  2 +-
 src/lib/re-wrap-results.ts                    |  8 +--
 src/lib/types.ts                              | 22 ++++----
 src/server/actions/study-job.actions.ts       | 51 ++++++++++---------
 src/server/actions/study.actions.ts           |  4 +-
 src/server/actions/user-keys.actions.ts       |  4 +-
 src/server/db/queries.test.ts                 | 46 ++++++++++++++---
 src/server/db/queries.ts                      | 43 +++++++---------
 src/server/results-sharing.ts                 | 34 ++++++-------
 src/server/storage.ts                         | 14 ++---
 19 files changed, 169 insertions(+), 152 deletions(-)

diff --git a/bin/inject-encrypted-results.ts b/bin/inject-encrypted-results.ts
index 6f9f20e07..b149fdd11 100644
--- a/bin/inject-encrypted-results.ts
+++ b/bin/inject-encrypted-results.ts
@@ -97,21 +97,20 @@ async function main() {
         console.info(`Job already has encrypted results — skipping store (delete study_job_file rows to re-inject).`)
     } else {
         // Mirror the real enclave helper (osenclave `toa_results_upload`): it posts exactly ONE
-        // results file and ONE logs file — each artifact's zip therefore holds a single encrypted
-        // inner entry. Do NOT add multiple result files here; that's not a shape the live helper
-        // can produce (one file per upload + MA's RUN-COMPLETE 422 guard), and faking it gave us a
-        // misleading multi-row picture in the DB.
+        // results file and ONE logs file, so each artifact's zip holds a single encrypted inner
+        // entry. Do NOT add multiple result files here — the live helper can't produce that shape
+        // (one file per upload + MA's RUN-COMPLETE 422 guard), and faking it gave a misleading
+        // multi-row picture in the DB.
         const resultsZip = await buildZip([{ name: 'results.csv', content: 'group,count\nA,42\nB,17\n' }], reviewerKeys)
         const logZip = await buildZip([{ name: 'run.log', content: 'job started\njob finished ok\n' }], reviewerKeys)
         await storeStudyEncryptedResultsFile(info, resultsZip)
         await storeStudyEncryptedLogFile(info, logZip, 'ENCRYPTED-CODE-RUN-LOG')
     }
 
-    // Make the status chain realistic. A results-stage job must have had its code
-    // approved first — otherwise the proposal-level review buttons stay visible (they
-    // only hide once the study is APPROVED *and* the code was reviewed). Inject
-    // CODE-APPROVED before RUN-COMPLETE so the latest status stays RUN-COMPLETE and the
-    // page shows only the results Approve/Reject.
+    // Make the status chain realistic. A results-stage job must have had its code approved first,
+    // or the proposal-level review buttons stay visible (they only hide once the study is APPROVED
+    // *and* the code was reviewed). Inject CODE-APPROVED before RUN-COMPLETE so the latest status
+    // stays RUN-COMPLETE and the page shows only the results Approve/Reject.
     const statuses = await db
         .selectFrom('jobStatusChange')
         .select(['status', 'createdAt'])
diff --git a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx
index 0759f4c8b..35d54a691 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.tsx
@@ -44,7 +44,7 @@ export const JobReviewButtons = ({
 
             if (status === 'FILES-APPROVED') {
                 // Re-wrap each approved file's AES key for the lab researchers, client-side.
-                // Only the new wrapped keys are sent — never the raw key or plaintext.
+                // Only the wrapped keys are sent — never the raw key or plaintext.
                 const sharedFiles = await buildSharedFiles(job.studyId, decryptedResults)
                 await approveStudyJobFilesAction({ orgSlug, jobInfo, sharedFiles })
             }
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
index c5346c641..df85702bd 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-review-buttons.tsx
@@ -35,8 +35,8 @@ export const StudyReviewButtons: FC<{ study: SelectedStudy; approvedFiles?: JobF
     } = useMutation({
         mutationFn: async (status: StudyStatus) => {
             if (status === 'APPROVED') {
-                // Re-wrap approved result files for the lab researchers client-side; the
-                // server receives only wrapped keys, never plaintext.
+                // Re-wrap approved result files for the lab researchers, client-side; the server
+                // receives only wrapped keys, never plaintext.
                 const sharedFiles = approvedFiles?.length ? await buildSharedFiles(study.id, approvedFiles) : undefined
                 return approveStudyProposalAction({
                     orgSlug,
diff --git a/src/app/dl/results/[jobId]/[fileName]/route.ts b/src/app/dl/results/[jobId]/[fileName]/route.ts
index c868b7cd4..2136707b1 100644
--- a/src/app/dl/results/[jobId]/[fileName]/route.ts
+++ b/src/app/dl/results/[jobId]/[fileName]/route.ts
@@ -3,11 +3,11 @@ import { urlForFile } from '@/server/storage'
 import { getStudyJobFileOfType, getInfoForStudyJobId } from '@/server/db/queries'
 import { canViewStudyJob } from '@/server/auth'
 
-// LEGACY ONLY: serves the plaintext APPROVED-RESULT copy from before results were
-// encrypted for researchers. New jobs no longer create APPROVED-RESULT rows (results are
-// decomposed + decrypted client-side), so this path is only reachable for pre-encryption
-// studies. It can be deleted — along with pathForStudyJobResults (src/lib/paths.ts) and any
-// remaining plaintext S3 objects — once legacy studies age out.
+// LEGACY ONLY: serves the plaintext APPROVED-RESULT copy from before results were encrypted for
+// researchers. New jobs no longer create APPROVED-RESULT rows (results are decrypted client-side),
+// so this is only reachable for pre-encryption studies. Delete it — along with
+// pathForStudyJobResults (src/lib/paths.ts) and any remaining plaintext S3 objects — once legacy
+// studies age out.
 export const GET = async (_: Request, { params }: { params: Promise<{ jobId: string; fileName: string }> }) => {
     const { jobId, fileName } = await params
 
diff --git a/src/components/job-results.tsx b/src/components/job-results.tsx
index d0c63d858..17be4420a 100644
--- a/src/components/job-results.tsx
+++ b/src/components/job-results.tsx
@@ -53,11 +53,10 @@ const FileRow: FC<{ label: string; name: string; decrypted?: JobFileInfo }> = ({
     )
 }
 
-// Researcher-facing view of shared results. There is no plaintext copy: the researcher
-// decrypts the encrypted file bodies with their own key (the wrapped key the reviewer
-// produced for them at approve). The file list is shown before decryption — names aren't
-// secret, and the reviewer panel lists them too — and only View/Download are gated behind
-// the key.
+// Researcher-facing view of shared results. There is no plaintext copy: the researcher decrypts
+// the file bodies with their own key (the wrapped key the reviewer produced at approve). The file
+// list shows before decryption — names aren't secret, and the reviewer panel lists them too —
+// only View/Download are gated behind the key.
 export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
     const [decryptedFiles, setDecryptedFiles] = useState<JobFileInfo[]>()
 
@@ -80,10 +79,10 @@ export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
         onSuccess: setDecryptedFiles,
     })
 
-    // One row per decrypted inner file once decrypted (each artifact is a whole-zip that unpacks
+    // After decryption, one row per decrypted inner file (each artifact is a whole-zip unpacking
     // into many files); before that, one locked row per encrypted artifact. Researchers receive
-    // both results and approved logs (re-wrapped at approval, all-or-nothing); results are
-    // listed first, then logs.
+    // both results and approved logs (re-wrapped at approval, all-or-nothing); results listed
+    // first, then logs.
     const rows = useMemo(() => {
         if (decryptedFiles) {
             return decryptedFiles.map((f) => ({
diff --git a/src/components/private-key-form.tsx b/src/components/private-key-form.tsx
index 1a1947f0b..852177acd 100644
--- a/src/components/private-key-form.tsx
+++ b/src/components/private-key-form.tsx
@@ -15,10 +15,10 @@ type PrivateKeyFormProps = {
     submitLabel: string
 }
 
-// Private-key entry form shared by the reviewer decrypt panel (encrypted-files-panel.tsx)
-// and the researcher results view (job-results.tsx). The key never leaves the browser —
-// it only feeds useDecryptFiles. "Results Key" is the role-neutral term: the same kind of
-// key decrypts for reviewers and researchers alike.
+// Private-key entry form shared by the reviewer decrypt panel (encrypted-files-panel.tsx) and the
+// researcher results view (job-results.tsx). The key never leaves the browser — it only feeds
+// useDecryptFiles. "Results Key" is the role-neutral term: the same kind of key decrypts for
+// reviewers and researchers alike.
 export const PrivateKeyForm: FC<PrivateKeyFormProps> = ({
     isVisible = true,
     form,
diff --git a/src/database/migrations/1780000000000_study_job_file_keys.ts b/src/database/migrations/1780000000000_study_job_file_keys.ts
index 381dac791..5695fc202 100644
--- a/src/database/migrations/1780000000000_study_job_file_keys.ts
+++ b/src/database/migrations/1780000000000_study_job_file_keys.ts
@@ -1,16 +1,15 @@
 import { type Kysely, sql } from 'kysely'
 
 export async function up(db: Kysely<unknown>): Promise<void> {
-    // Per-recipient wrapped AES keys that grant a lab researcher access to one inner file of an
+    // Per-recipient wrapped AES keys granting a lab researcher access to one inner file of an
     // approved results archive. The encrypted artifact stays a single whole-zip `study_job_file`
     // row whose embedded manifest already holds the enclave recipients' keys (unchanged, prod
     // format); these rows ADD researcher recipients without re-encrypting. `study_job_file_id`
-    // points at the whole-zip row, `file_path` is the inner file within it.
+    // points at the whole-zip row, `file_path` is the inner file.
     //
     // Approval is all-or-nothing at the job level (per Phil 2026-06): it lives in
     // `job_status_change` as a FILES-APPROVED event, NOT per file. A file is "shared with
-    // researchers" iff the job is approved — derived from job status, never a per-file column.
-    // These rows are the *access* mechanism.
+    // researchers" iff the job is approved. These rows are the *access* mechanism.
     await db.schema
         .createTable('study_job_file_key')
         .addColumn('id', 'uuid', (col) => col.defaultTo(sql`v7uuid()`).primaryKey())
diff --git a/src/hooks/use-decrypt-files.ts b/src/hooks/use-decrypt-files.ts
index 519118186..4772d7858 100644
--- a/src/hooks/use-decrypt-files.ts
+++ b/src/hooks/use-decrypt-files.ts
@@ -7,13 +7,12 @@ import { ResultsReader } from 'si-encryption/job-results/reader'
 import { fingerprintPublicKeyFromPrivateKey, pemToArrayBuffer, privateKeyFromBuffer } from 'si-encryption/util'
 import type { FileType } from '@/database/types'
 
-// One encrypted artifact as returned by fetchEncryptedJobFilesAction: the whole-zip ciphertext
-// blob (prod format, embedded manifest). Decrypting it yields the inner plaintext files.
+// One encrypted artifact from fetchEncryptedJobFilesAction: the whole-zip ciphertext blob (prod
+// format, embedded manifest). Decrypting it yields the inner plaintext files.
 //
 // `overrideKeys` (inner file path -> wrapped AES key) is set only for lab researchers, who are
-// NOT manifest recipients: their per-file re-wrapped keys come from study_job_file_key and are
-// passed to the reader to decrypt with. Empty for enclave reviewers, who decrypt via the
-// embedded manifest using their own key's fingerprint.
+// NOT manifest recipients: their per-file re-wrapped keys come from study_job_file_key. Empty for
+// enclave reviewers, who decrypt via the embedded manifest using their own key's fingerprint.
 export type EncryptedJobFile = {
     studyJobFileId: string
     fileType: FileType
@@ -44,8 +43,8 @@ async function decryptFiles(encryptedFiles: EncryptedJobFile[], privateKey: stri
                 fingerprint,
                 artifact.overrideKeys,
             )
-            // Per-file raw AES key: each inner file has its own key, so re-wrap at approval
-            // wraps each file's key for the researchers (see buildSharedFiles).
+            // Per-file raw AES key: each inner file has its own key, so re-wrap at approval wraps
+            // each file's key for the researchers (see buildSharedFiles).
             const entries = await reader.extractFilesWithKeys()
             for (const entry of entries) {
                 files.push({
@@ -54,7 +53,7 @@ async function decryptFiles(encryptedFiles: EncryptedJobFile[], privateKey: stri
                     rawAesKey: entry.rawAesKey,
                     sourceId: artifact.studyJobFileId,
                     // Map an encrypted type to its approved form; an already-approved input
-                    // (researcher viewing shared results) keeps its type.
+                    // (researcher viewing shared results) keeps its own type.
                     fileType: ENCRYPTED_TO_APPROVED[artifact.fileType] ?? artifact.fileType,
                 })
             }
diff --git a/src/hooks/use-encrypted-files-panel.ts b/src/hooks/use-encrypted-files-panel.ts
index 25368e44a..c10d2926c 100644
--- a/src/hooks/use-encrypted-files-panel.ts
+++ b/src/hooks/use-encrypted-files-panel.ts
@@ -36,8 +36,9 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
 
     const isJobApproved = (job.statusChanges ?? []).some((sc) => sc.status === 'FILES-APPROVED')
 
-    // Which files are shared with researchers — all of the job's files once it's FILES-APPROVED,
-    // none before (all-or-nothing; see getSharedFileIdsForJob). There is no plaintext approved copy.
+    // Which artifacts are shared with researchers — derived from the re-wrapped key rows
+    // (getSharedFileIdsForJob), so it reflects exactly what was shared at any granularity. There
+    // is no plaintext approved copy.
     const { data: sharedFileIds = [] } = useQuery({
         queryKey: ['shared-file-ids', job.id],
         queryFn: () => fetchSharedFileIdsAction({ jobId: job.id }),
@@ -66,10 +67,10 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
         onSuccess: (files) => setDecryptedFiles(files),
     })
 
-    // All-or-nothing: approving shares the entire decrypted package — results AND logs — with
-    // the researchers (no per-file selection). Every decrypted artifact carries its own rawAesKey,
-    // so buildSharedFiles re-wraps each for the lab keys. (Per-artifact selection may return if Phil
-    // wants logs individually withholdable; for now approval shares everything.)
+    // All-or-nothing: approving shares the entire decrypted package — results AND logs — with the
+    // researchers (no per-file selection). Every decrypted artifact carries its own rawAesKey, so
+    // buildSharedFiles re-wraps each for the lab keys. (buildSharedFiles is already per-file, so
+    // splitting results vs logs later would be a UI change only.)
     useEffect(() => {
         onFilesApproved(decryptedFiles)
     }, [decryptedFiles]) // eslint-disable-line react-hooks/exhaustive-deps
@@ -82,7 +83,7 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
 
     // Before decryption: one locked row per encrypted artifact (results, logs); size is unknown
     // until decrypted (pre-encryption byte counts aren't stored). After: one row per decrypted
-    // inner file — each artifact is a whole-zip that unpacks into many files, all sharing the
+    // inner file — each artifact is a whole-zip unpacking into many files, all sharing the
     // artifact's row id (sourceId), so "shared" is keyed on that id.
     const fileRows: UnifiedFileRow[] = useMemo(() => {
         if (decryptedFiles.length > 0) {
diff --git a/src/lib/permission-types.ts b/src/lib/permission-types.ts
index cc24fd23c..5489917d0 100644
--- a/src/lib/permission-types.ts
+++ b/src/lib/permission-types.ts
@@ -42,7 +42,7 @@ type Abilities =
     | Ability<'Study', 'view' | 'create', { orgId?: UUID; submittedByOrgId?: UUID }>
     | Ability<'Study', 'review' | 'approve' | 'reject' | 'update' | 'delete', { orgId?: UUID; submittedByOrgId?: UUID }>
     | Ability<'StudyJob', 'view' | 'create', { orgId?: UUID; submittedByOrgId?: UUID }>
-    // Renamed from 'ReviewerKey' — the same encryption key is now held by enclave reviewers
+    // Renamed from 'ReviewerKey' — the same encryption key is now held by both enclave reviewers
     // AND lab researchers (orgNeedsKey), so the old name was misleading. Route + UI copy match:
     // /user-key (Routes.userKey), "Results Key" in copy.
     | Ability<'UserKey', 'view' | 'update', object>
diff --git a/src/lib/re-wrap-results.ts b/src/lib/re-wrap-results.ts
index e2ff1d90b..e02031f2c 100644
--- a/src/lib/re-wrap-results.ts
+++ b/src/lib/re-wrap-results.ts
@@ -8,10 +8,10 @@ import type { JobFileInfo, SharedFile } from '@/lib/types'
  * client-side.
  *
  * Each archive keeps the prod whole-zip format: one AES key PER inner file, embedded in the
- * manifest for the enclave recipients. While decrypting to review, the reviewer's browser
- * recovered each file's raw AES key (see use-decrypt-files). Here, for every researcher public
- * key, we wrap that file's raw key into a new wrapped key (`crypt`); the ciphertext is never
- * touched. The server only ever receives wrapped keys — never the raw AES key or plaintext.
+ * manifest for the enclave recipients. While reviewing, the reviewer's browser recovered each
+ * file's raw AES key (see use-decrypt-files). Here, for every researcher public key, we wrap that
+ * raw key into a new wrapped key (`crypt`); the ciphertext is never touched. The server only ever
+ * receives wrapped keys — never the raw AES key or plaintext.
  */
 export async function buildSharedFiles(studyId: string, files: JobFileInfo[]): Promise<SharedFile[]> {
     const labKeys = actionResult(await fetchLabPublicKeysAction({ studyId }))
diff --git a/src/lib/types.ts b/src/lib/types.ts
index b38cf4fdc..2c5de0379 100644
--- a/src/lib/types.ts
+++ b/src/lib/types.ts
@@ -38,9 +38,9 @@ export function isLabOrg(org: { type: OrgType }): org is LabOrg {
     return org.type === 'lab'
 }
 
-// Members of these org types hold an encryption key: enclave reviewers decrypt to
-// review, lab researchers decrypt approved results. A user without a key for one of
-// these orgs is gated into key generation.
+// Members of these org types hold an encryption key: enclave reviewers decrypt to review, lab
+// researchers decrypt approved results. A user without a key for one of these orgs is gated into
+// key generation.
 export function orgNeedsKey(org: { type: OrgType }): boolean {
     return isEnclaveOrg(org) || isLabOrg(org)
 }
@@ -209,23 +209,23 @@ const FILE_TYPES = [
 
 export const fileTypeSchema = z.enum(FILE_TYPES)
 
-// A re-wrapped AES key for one researcher recipient of one approved file
-// (a `study_job_file_key` row; see src/server/results-sharing.ts for the model).
+// A re-wrapped AES key for one researcher recipient of one approved file (a `study_job_file_key`
+// row; see src/server/results-sharing.ts for the model).
 export const sharedFileKeySchema = z.object({ fingerprint: z.string(), crypt: z.string() })
 export const sharedFileSchema = z.object({
     studyJobFileId: z.string(), // the whole-zip study_job_file row
-    filePath: z.string(), // the inner file within that archive (one AES key per inner file)
+    filePath: z.string(), // the inner file within the archive (one AES key per inner file)
     keys: z.array(sharedFileKeySchema),
 })
 export type SharedFile = z.infer<typeof sharedFileSchema>
 
 export type JobFileInfo = FileEntry & {
-    sourceId: string // the study_job_file row id this decrypted file came from
+    sourceId: string // the study_job_file row this decrypted file came from
     fileType: FileType
-    // Raw AES key recovered while decrypting, kept in-memory so the reviewer's browser can
-    // re-wrap it for researchers at approve time without decrypting again. SECURITY: this
-    // unlocks the file body for any recipient — it must never be sent to the server or
-    // persisted. Only the client-side approve/re-wrap flow (buildSharedFiles) reads it.
+    // Raw AES key recovered while decrypting, kept in-memory so the reviewer's browser can re-wrap
+    // it for researchers at approve time without decrypting again. SECURITY: this unlocks the file
+    // body for any recipient — it must never be sent to the server or persisted. Only the
+    // client-side approve/re-wrap flow (buildSharedFiles) reads it.
     rawAesKey?: ArrayBuffer
 }
 
diff --git a/src/server/actions/study-job.actions.ts b/src/server/actions/study-job.actions.ts
index d432ff41a..146f3c0f0 100644
--- a/src/server/actions/study-job.actions.ts
+++ b/src/server/actions/study-job.actions.ts
@@ -34,20 +34,19 @@ export const approveStudyJobFilesAction = new Action('approveStudyJobFilesAction
     })
     .requireAbilityTo('approve', 'Study')
     .handler(async ({ params: { jobInfo: info, sharedFiles }, session, db }) => {
-        // Re-wrap, not re-encrypt: the reviewer's browser unwrapped the results' AES key
-        // while reviewing and wrapped it for the lab researchers' public keys. Here we
-        // only persist those new wrapped-key rows — the file ciphertext is never touched and
-        // the server never sees plaintext or the raw AES key. Adding a wrapped key = sharing.
-        // The FILES-APPROVED status change below is the all-or-nothing approval fact itself.
+        // Re-wrap, not re-encrypt: the reviewer's browser unwrapped the results' AES key while
+        // reviewing and wrapped it for the lab researchers' public keys. We only persist those
+        // wrapped-key rows — the ciphertext is never touched and the server never sees plaintext
+        // or the raw AES key. Adding a wrapped key = sharing. The FILES-APPROVED status change
+        // below is the all-or-nothing approval fact itself.
         //
         // KNOWN LIMITATION — late-joining researchers (OUT OF SCOPE, per Phil 2026-06):
-        // Keys are wrapped only for lab members who have a registered public key at the moment
-        // of approval. A researcher who joins the lab or generates their key *after* approval
-        // gets no wrapped key and cannot read already-approved results. There is intentionally
-        // NO backfill/recovery flow: once approved, the reviewer's browser no longer holds the
-        // raw AES key, so re-wrapping for a late joiner would require a reviewer to re-open and
-        // re-decrypt the results. Researchers must have their keys registered before approval.
-        // FLAG FOR PO: if backfill is ever required, a recovery flow would land here.
+        // Keys are wrapped only for lab members with a registered public key at approval time. A
+        // researcher who joins or generates their key *after* approval gets no wrapped key and
+        // cannot read already-approved results. There is intentionally NO backfill: once approved,
+        // the reviewer's browser no longer holds the raw AES key, so re-wrapping for a late joiner
+        // would require re-opening and re-decrypting. Researchers must register keys before
+        // approval. FLAG FOR PO: if backfill is ever required, a recovery flow would land here.
         await insertSharedFileKeys(db, info.studyJobId, sharedFiles)
 
         await db
@@ -80,8 +79,9 @@ export const fetchLabPublicKeysAction = new Action('fetchLabPublicKeysAction')
         return await getLabPublicKeysForStudy(studyId)
     })
 
-// IDs of files shared with researchers — all of the job's files once it's FILES-APPROVED,
-// none before (all-or-nothing; see getSharedFileIdsForJob). There is no plaintext approved copy.
+// IDs of the job's artifacts shared with researchers — derived from the re-wrapped key rows (see
+// getSharedFileIdsForJob), so it reflects whatever was shared at approve time (results, or
+// results + logs). Empty before approval. There is no plaintext approved copy.
 export const fetchSharedFileIdsAction = new Action('fetchSharedFileIdsAction')
     .params(z.object({ jobId: z.string() }))
     .middleware(async ({ params: { jobId } }) => {
@@ -128,7 +128,7 @@ export const loadStudyJobAction = new Action('loadStudyJobAction')
     .params(z.object({ studyJobId: z.string() }))
     .middleware(async ({ params: { studyJobId } }) => {
         const studyJob = await getStudyJobInfo(studyJobId)
-        return { studyJob, orgId: studyJob.orgId, submittedByOrgId: studyJob.submittedByOrgId } // Return the jobInfo along with the orgId for validation in requireAbilityTo below
+        return { studyJob, orgId: studyJob.orgId, submittedByOrgId: studyJob.submittedByOrgId } // orgId is validated in requireAbilityTo below
     })
     .requireAbilityTo('view', 'StudyJob')
     .handler(async ({ studyJob }) => {
@@ -183,9 +183,9 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
     )
     .middleware(async ({ params: { jobId } }) => {
         const studyJob = await getStudyJobInfo(jobId)
-        // Include submittedByOrgId so the 'view StudyJob' ability matches lab researchers
-        // (permissions.ts permits view when submittedByOrgId ∈ the user's researcher orgs),
-        // not just enclave reviewers — researchers fetch their own re-wrapped result files here.
+        // Include submittedByOrgId so the 'view StudyJob' ability matches lab researchers, not
+        // just enclave reviewers (permissions.ts permits view when submittedByOrgId ∈ the user's
+        // researcher orgs) — researchers fetch their own re-wrapped result files here.
         return { studyJob, orgId: studyJob.orgId, submittedByOrgId: studyJob.submittedByOrgId }
     })
     .requireAbilityTo('view', 'StudyJob')
@@ -201,16 +201,17 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
 
         // Each artifact is the prod whole-zip (embedded manifest). Enclave reviewers are manifest
         // recipients and decrypt with their own key; lab researchers are not, so they decrypt with
-        // per-file re-wrapped keys (study_job_file_key) supplied as `overrideKeys`. A reviewer is a
-        // member of the study's enclave org (study.orgId); everyone else takes the researcher path.
+        // per-file re-wrapped keys (study_job_file_key) supplied as `overrideKeys`. A reviewer is
+        // a member of the study's enclave org (study.orgId); everyone else takes the researcher
+        // path.
         const isEnclaveReviewer = Object.values(session.orgs).some(
             (org) => org.id === studyJob.orgId && org.type === 'enclave',
         )
 
         // TODO(perf): every ciphertext body is buffered into server memory and serialized through
         // the server-action layer. DEFERRED on purpose (Phil 2026-06) — fine at current result
-        // sizes. ESCAPE HATCH if we hit limits: hand the client a short-lived signed S3 URL and let
-        // it fetch ciphertext directly + decrypt, instead of proxying through here.
+        // sizes. ESCAPE HATCH if we hit limits: hand the client a short-lived signed S3 URL to
+        // fetch + decrypt ciphertext directly, instead of proxying through here.
         if (isEnclaveReviewer) {
             return Promise.all(
                 encryptedFiles.map(async (file) => ({
@@ -224,9 +225,9 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
         }
 
         // Researcher: return only artifacts this user has wrapped keys for. Approval re-wraps both
-        // results and logs (all-or-nothing), so both can appear here; the keys exist only after
-        // approval, so this is naturally gated. Build the inner {file_path -> crypt} override map
-        // per artifact.
+        // results and logs (all-or-nothing), so both can appear here; keys exist only after
+        // approval, so this is naturally gated. Build the {file_path -> crypt} override map per
+        // artifact.
         const wrappedKeys = await db
             .selectFrom('studyJobFileKey')
             .select(['studyJobFileId', 'filePath', 'crypt'])
diff --git a/src/server/actions/study.actions.ts b/src/server/actions/study.actions.ts
index 563006251..884e3f4a5 100644
--- a/src/server/actions/study.actions.ts
+++ b/src/server/actions/study.actions.ts
@@ -317,8 +317,8 @@ async function approveJobCode({
     }
 
     if (sharedFiles?.length) {
-        // Re-wrap: persist only the per-researcher wrapped AES keys the reviewer's
-        // browser produced. Ciphertext is untouched; no plaintext is stored.
+        // Re-wrap: persist only the per-researcher wrapped AES keys the reviewer's browser
+        // produced. Ciphertext is untouched; no plaintext is stored.
         await insertSharedFileKeys(db, job.id, sharedFiles)
     }
 }
diff --git a/src/server/actions/user-keys.actions.ts b/src/server/actions/user-keys.actions.ts
index aa4d09299..cb1d9f343 100644
--- a/src/server/actions/user-keys.actions.ts
+++ b/src/server/actions/user-keys.actions.ts
@@ -27,8 +27,8 @@ const setOrgUserPublicKeySchema = z.object({
 
 // Reject keys that aren't importable RSA SPKI DER. A single malformed key in an org breaks
 // encryption for every sender wrapping to that org's recipients (TOA results upload, the
-// reviewer's approve/re-wrap), so catch it at storage time. Import params mirror
-// si-encryption's wrapAesKey.
+// reviewer's approve/re-wrap), so catch it at storage time. Import params mirror si-encryption's
+// wrapAesKey.
 async function assertValidPublicKey(publicKey: ArrayBuffer): Promise<void> {
     try {
         await crypto.subtle.importKey('spki', publicKey, { name: 'RSA-OAEP', hash: 'SHA-256' }, false, ['encrypt'])
diff --git a/src/server/db/queries.test.ts b/src/server/db/queries.test.ts
index c67d0e72b..fae1d5f8a 100644
--- a/src/server/db/queries.test.ts
+++ b/src/server/db/queries.test.ts
@@ -278,29 +278,59 @@ describe('getSharedFileIdsForJob', () => {
             .returning('id')
             .executeTakeFirstOrThrow()
 
-    it('returns [] when the job is not approved', async () => {
+    // Sharing = a re-wrapped key row for the artifact. This is what getSharedFileIdsForJob reads,
+    // so tests grant access by inserting these rows rather than flipping a status.
+    const shareFile = (studyJobFileId: string, filePath: string, fingerprint: string) =>
+        db
+            .insertInto('studyJobFileKey')
+            .values({ studyJobFileId, filePath, fingerprint, crypt: 'wrapped-key' })
+            .execute()
+
+    it('returns [] when nothing has been shared', async () => {
         const { job } = await insertTestStudyJobData()
         await insertFile(job.id, 'ENCRYPTED-RESULT')
         expect(await getSharedFileIdsForJob(job.id)).toEqual([])
     })
 
-    it('returns result AND log file ids once approved (all-or-nothing)', async () => {
+    it('returns each artifact that has a re-wrapped key, results and logs alike', async () => {
         const { job } = await insertTestStudyJobData()
         const result = await insertFile(job.id, 'ENCRYPTED-RESULT')
         const log = await insertFile(job.id, 'ENCRYPTED-CODE-RUN-LOG')
-        await db.insertInto('jobStatusChange').values({ studyJobId: job.id, status: 'FILES-APPROVED' }).execute()
+        await shareFile(result.id, 'results.csv', 'fp-researcher')
+        await shareFile(log.id, 'run.log', 'fp-researcher')
 
         const ids = await getSharedFileIdsForJob(job.id)
         expect(ids.sort()).toEqual([result.id, log.id].sort())
     })
 
-    // Approval is the durable historical fact (the FILES-APPROVED status event), independent of
-    // current org membership. Removing a researcher from the lab must NOT retroactively
-    // un-approve files. This guards against anyone reintroducing a membership join here.
-    it('stays approved after the lab researchers are removed from the org', async () => {
+    // The query reports exactly the artifacts with key rows, so a file that exists but was never
+    // re-wrapped is not "shared". (All-or-nothing approval shares results + logs together, but the
+    // query stays correct for any subset — keeping the door open to splitting them later.)
+    it('excludes artifacts that have no re-wrapped key', async () => {
+        const { job } = await insertTestStudyJobData()
+        const result = await insertFile(job.id, 'ENCRYPTED-RESULT')
+        await insertFile(job.id, 'ENCRYPTED-CODE-RUN-LOG') // present but not re-wrapped
+        await shareFile(result.id, 'results.csv', 'fp-researcher')
+
+        expect(await getSharedFileIdsForJob(job.id)).toEqual([result.id])
+    })
+
+    it('returns an artifact once even when shared with multiple researchers', async () => {
+        const { job } = await insertTestStudyJobData()
+        const result = await insertFile(job.id, 'ENCRYPTED-RESULT')
+        await shareFile(result.id, 'results.csv', 'fp-a')
+        await shareFile(result.id, 'results.csv', 'fp-b')
+
+        expect(await getSharedFileIdsForJob(job.id)).toEqual([result.id])
+    })
+
+    // Sharing is recorded by the key rows, independent of current org membership. Removing a
+    // researcher from the lab must NOT delete their key rows / retroactively un-share. This guards
+    // against anyone reintroducing a membership join here.
+    it('stays shared after the lab researchers are removed from the org', async () => {
         const { org, job } = await insertTestStudyJobData()
         const result = await insertFile(job.id, 'ENCRYPTED-RESULT')
-        await db.insertInto('jobStatusChange').values({ studyJobId: job.id, status: 'FILES-APPROVED' }).execute()
+        await shareFile(result.id, 'results.csv', 'fp-researcher')
 
         await db.deleteFrom('orgUser').where('orgId', '=', org.id).execute()
 
diff --git a/src/server/db/queries.ts b/src/server/db/queries.ts
index a2896e382..cf49ccac6 100644
--- a/src/server/db/queries.ts
+++ b/src/server/db/queries.ts
@@ -5,7 +5,6 @@ import { AccessDeniedError, throwNotFound } from '@/lib/errors'
 import { wasCalledFromAPI } from '../api-context'
 import { findOrCreateSiUserId } from './mutations'
 import { FileType } from '@/database/types'
-import { ENCRYPTED_LOG_TYPES } from '@/lib/file-type-helpers'
 import { Selectable } from 'kysely'
 import { Action } from '../actions/action'
 import { fetchFileContents } from '@/server/storage'
@@ -459,16 +458,16 @@ const labOrgIdForJob = async (jobId: string) =>
         .executeTakeFirstOrThrow(throwNotFound(`job ${jobId}`))
 
 /**
- * Public keys of the lab org that submitted the study (`study.submittedByOrgId`) —
- * the researchers. These are the recipients a reviewer re-wraps approved files for.
+ * Public keys of the lab org that submitted the study (`study.submittedByOrgId`) — the
+ * researchers. These are the recipients a reviewer re-wraps approved files for.
  */
 export async function getLabPublicKeysForJob(jobId: string): Promise<PublicKey[]> {
     const { submittedByOrgId } = await labOrgIdForJob(jobId)
     return getOrgPublicKeys(submittedByOrgId)
 }
 
-// Same lab (researcher) recipient keys, resolved from the study directly — used by the
-// client approve flow, which knows the study but not necessarily the job id.
+// Same lab (researcher) recipient keys, resolved from the study directly — used by the client
+// approve flow, which knows the study but not necessarily the job id.
 export async function getLabPublicKeysForStudy(studyId: string): Promise<PublicKey[]> {
     const { submittedByOrgId } = await Action.db
         .selectFrom('study')
@@ -479,32 +478,24 @@ export async function getLabPublicKeysForStudy(studyId: string): Promise<PublicK
 }
 
 /**
- * IDs of this job's files shared with researchers. Approval is all-or-nothing at the job level
- * (per Phil 2026-06): once a FILES-APPROVED event exists, every researcher-facing encrypted
- * artifact of the job is shared — results AND logs (code-run, security-scan, packaging-error),
- * matching what the reviewer's browser re-wrapped on approve. The reviewer panel keys its "shared"
- * indicator on this set, so it must list every shared artifact, not just results. Driven by the
- * recorded status event, not current org membership — removing a researcher from the lab must not
- * retroactively un-approve files. Returns [] if not approved.
+ * IDs of this job's artifacts shared with researchers — those with at least one re-wrapped key row
+ * in study_job_file_key. "Shared" is derived from the keys themselves (what the researcher decrypts
+ * with), so it is granularity-agnostic: all-or-nothing, results-only, or results+logs all fall out
+ * of which artifacts got wrapped at approve time — no status/file-type inference. Key rows only
+ * exist post-approval, so this is naturally empty before then. Independent of current org
+ * membership: removing a researcher from the lab does not delete their key rows, so it never
+ * retroactively un-shares. The reviewer panel keys its "shared" indicator on this set.
  */
 export async function getSharedFileIdsForJob(jobId: string): Promise<string[]> {
-    const approved = await Action.db
-        .selectFrom('jobStatusChange')
-        .select('id')
-        .where('studyJobId', '=', jobId)
-        .where('status', '=', 'FILES-APPROVED')
-        .executeTakeFirst()
-
-    if (!approved) return []
-
     const rows = await Action.db
-        .selectFrom('studyJobFile')
-        .select('id')
-        .where('studyJobId', '=', jobId)
-        .where('fileType', 'in', ['ENCRYPTED-RESULT', ...ENCRYPTED_LOG_TYPES])
+        .selectFrom('studyJobFileKey')
+        .innerJoin('studyJobFile', 'studyJobFile.id', 'studyJobFileKey.studyJobFileId')
+        .where('studyJobFile.studyJobId', '=', jobId)
+        .select('studyJobFileKey.studyJobFileId')
+        .distinct()
         .execute()
 
-    return rows.map((r) => r.id)
+    return rows.map((r) => r.studyJobFileId)
 }
 
 export type StudyReviewWithMeta = {
diff --git a/src/server/results-sharing.ts b/src/server/results-sharing.ts
index 67be04aa2..1e819fde6 100644
--- a/src/server/results-sharing.ts
+++ b/src/server/results-sharing.ts
@@ -5,27 +5,25 @@ import { getLabPublicKeysForJob } from '@/server/db/queries'
 
 /**
  * Persist re-wrapped AES keys that grant lab researchers access to a job's files. Each
- * `study_job_file_key` row works like a PO box: anyone can deposit (the reviewer wraps the
- * file's AES key to a recipient's public key), but only the holder of the matching private
- * key can open it. Each wrapped key is validated against the lab org's known public keys so a
- * client can never share a file with an arbitrary fingerprint. Idempotent via the
- * (study_job_file_id, file_path, fingerprint) unique constraint. The file ciphertext is untouched.
+ * `study_job_file_key` row holds a file's AES key wrapped to a recipient's public key; only the
+ * holder of the matching private key can unwrap it. Each wrapped key is validated against the lab
+ * org's known public keys so a client can never share a file with an arbitrary fingerprint.
+ * Idempotent via the (study_job_file_id, file_path, fingerprint) unique constraint. The file
+ * ciphertext is untouched.
  *
  * Approval itself is recorded by the caller as a job-level FILES-APPROVED `job_status_change`
- * event (all-or-nothing, per Phil 2026-06) — NOT as a per-file column. The wrapped keys are
- * just the access mechanism; revoking later by deleting one is *prospective only*: a
- * researcher who already unwrapped the AES key keeps it, so deletion stops future reads, not
- * past ones.
+ * event (all-or-nothing, per Phil 2026-06) — NOT as a per-file column. The wrapped keys are just
+ * the access mechanism; deleting one to revoke is *prospective only*: a researcher who already
+ * unwrapped the AES key keeps it, so deletion stops future reads, not past ones.
  */
 export async function insertSharedFileKeys(db: DBExecutor, jobId: string, sharedFiles: SharedFile[]): Promise<void> {
     const labKeys = await getLabPublicKeysForJob(jobId)
     const labFingerprints = new Set(labKeys.map((k) => k.fingerprint))
 
     // Ownership guard: `studyJobFileId` comes from the client payload, so confirm every file
-    // actually belongs to `jobId` before we mark it shared. Without this, a reviewer with
-    // approve rights on job A could pass file ids from job B and — if B's lab happens to share a
-    // fingerprint — grant access to another job's files. Fingerprint validation below does not
-    // cover this ownership check.
+    // belongs to `jobId` before marking it shared. Without this, a reviewer with approve rights on
+    // job A could pass job B's file ids and — if B's lab shares a fingerprint — grant access to
+    // another job's files. The fingerprint validation below does not cover this.
     const jobFiles = await db.selectFrom('studyJobFile').select('id').where('studyJobId', '=', jobId).execute()
     const jobFileIds = new Set(jobFiles.map((f) => f.id))
     for (const file of sharedFiles) {
@@ -34,11 +32,11 @@ export async function insertSharedFileKeys(db: DBExecutor, jobId: string, shared
         }
     }
 
-    // We validate that each wrapped key targets a real lab recipient, but — the server being
-    // blind — we cannot verify the `crypt` actually wraps the file's correct AES key. A buggy
-    // reviewer client could persist one that unwraps to garbage; the researcher would just fail
-    // to decrypt downstream. The reviewer client is trusted (it wraps the same key it just used
-    // to review), so this is accepted by design rather than guarded here.
+    // We validate that each wrapped key targets a real lab recipient, but the server is blind: it
+    // cannot verify the `crypt` actually wraps the file's correct AES key. A buggy reviewer client
+    // could persist one that unwraps to garbage, and the researcher would fail to decrypt
+    // downstream. The reviewer client is trusted (it wraps the same key it just reviewed with), so
+    // this is accepted by design rather than guarded here.
     const rows = sharedFiles.flatMap((file) =>
         file.keys.map((key) => {
             if (!labFingerprints.has(key.fingerprint)) {
diff --git a/src/server/storage.ts b/src/server/storage.ts
index 606ac25ef..b39850e63 100644
--- a/src/server/storage.ts
+++ b/src/server/storage.ts
@@ -44,14 +44,14 @@ export async function storeStudyLogFile(info: MinimalJobInfo, file: File, fileTy
     return await storeJobFile(info, `${pathForStudyJob(info)}/results/${filename}.txt`, file, fileType)
 }
 
-// Encryption granularity vs storage granularity — two different levels, easy to conflate:
-//   - CRYPTO is PER FILE: TOA's ResultsWriter gives each inner file its own AES key + IV and
-//     encrypts it individually; the wrapped keys live in a manifest.json embedded in the zip.
-//   - STORAGE is the WHOLE ZIP: that manifest + all the per-file ciphertexts are one archive,
-//     persisted as a single S3 object / a single `study_job_file` row here.
+// Crypto granularity vs storage granularity differ:
+//   - CRYPTO is PER FILE: TOA's ResultsWriter gives each inner file its own AES key + IV; the
+//     wrapped keys live in a manifest.json embedded in the zip.
+//   - STORAGE is the WHOLE ZIP: that manifest + all per-file ciphertexts are one archive,
+//     persisted as a single S3 object / `study_job_file` row.
 // So sharing with a researcher re-wraps EACH file's key (one `study_job_file_key` row per inner
-// file per researcher) — not one key for the whole archive. The format is unchanged from prod;
-// we deliberately do NOT re-encrypt or repackage on ingest.
+// file per researcher), not one key for the whole archive. Format is unchanged from prod; we
+// deliberately do NOT re-encrypt or repackage on ingest.
 export async function storeStudyEncryptedResultsFile(info: MinimalJobInfo, file: File) {
     return await storeJobFile(info, `${pathForStudyJob(info)}/results/encrypted-results.zip`, file, 'ENCRYPTED-RESULT')
 }

From 96eb6949e1f6198c7da366d49a7ebacf1411acc0 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Wed, 17 Jun 2026 11:24:41 -0400
Subject: [PATCH 34/45] More clear naming for researcher keys

---
 package.json                                     |  2 +-
 pnpm-lock.yaml                                   | 10 +++++-----
 .../review/study-results-redesign.test.tsx       |  2 +-
 .../[studyId]/review/study-results.test.tsx      |  2 +-
 src/components/encrypted-files-panel.test.tsx    |  2 +-
 src/hooks/use-decrypt-files.ts                   | 11 ++++++-----
 src/server/actions/study-job.actions.test.ts     |  4 ++--
 src/server/actions/study-job.actions.ts          | 16 ++++++++--------
 8 files changed, 25 insertions(+), 24 deletions(-)

diff --git a/package.json b/package.json
index 59d122876..c070980b1 100644
--- a/package.json
+++ b/package.json
@@ -113,7 +113,7 @@
         "react-phone-number-input": "^3.4.16",
         "remeda": "^2.33.6",
         "server-only": "^0.0.1",
-        "si-encryption": "github:safeinsights/encryption#eb2228d5068013640f9bf97debbfccf0ee40eeef",
+        "si-encryption": "github:safeinsights/encryption#4f31a899ba1e0ade8ebbbbb59609a7529343c2d4",
         "uuid": "^14.0.0",
         "validator": "^13.15.26",
         "yjs": "^13.6.30",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index aefea1a2c..20b25dd27 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -218,8 +218,8 @@ importers:
         specifier: ^0.0.1
         version: 0.0.1
       si-encryption:
-        specifier: github:safeinsights/encryption#eb2228d5068013640f9bf97debbfccf0ee40eeef
-        version: https://codeload.github.com/safeinsights/encryption/tar.gz/eb2228d5068013640f9bf97debbfccf0ee40eeef
+        specifier: github:safeinsights/encryption#4f31a899ba1e0ade8ebbbbb59609a7529343c2d4
+        version: https://codeload.github.com/safeinsights/encryption/tar.gz/4f31a899ba1e0ade8ebbbbb59609a7529343c2d4
       uuid:
         specifier: ^14.0.0
         version: 14.0.0
@@ -6088,8 +6088,8 @@ packages:
     resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==}
     engines: {node: '>= 0.4'}
 
-  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/eb2228d5068013640f9bf97debbfccf0ee40eeef:
-    resolution: {gitHosted: true, integrity: sha512-IfMAYolRfnN/BmfL6wF2m/3W9IMMbGovjPj5Cb7wj0TcDw53aFLJ6v9gfg8hP6bbHCFgxO9PinVmOFd89+b2bg==, tarball: https://codeload.github.com/safeinsights/encryption/tar.gz/eb2228d5068013640f9bf97debbfccf0ee40eeef}
+  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/4f31a899ba1e0ade8ebbbbb59609a7529343c2d4:
+    resolution: {gitHosted: true, integrity: sha512-bgYckt75tdXXVVyZweDrBdYJghbJyP4bBeF/0x9LnkFPhVt1AfN3p8OndWrJhFVfWs9PbAONUNt4ojRGgnMR9w==, tarball: https://codeload.github.com/safeinsights/encryption/tar.gz/4f31a899ba1e0ade8ebbbbb59609a7529343c2d4}
     version: 0.0.1
 
   side-channel-list@1.0.1:
@@ -13871,7 +13871,7 @@ snapshots:
 
   shell-quote@1.8.4: {}
 
-  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/eb2228d5068013640f9bf97debbfccf0ee40eeef:
+  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/4f31a899ba1e0ade8ebbbbb59609a7529343c2d4:
     dependencies:
       '@zip.js/zip.js': 2.8.26
       debug: 4.4.3
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
index ecdd93bc5..bc5b9b7b0 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
@@ -126,7 +126,7 @@ describe('StudyResultsRedesign', () => {
                 fileType: 'ENCRYPTED-RESULT' as FileType,
                 name: 'test.data',
                 encryptedBody: await zip.arrayBuffer(),
-                overrideKeys: {} as Record<string, string>,
+                researcherKeys: {} as Record<string, string>,
             },
         ])
 
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
index 322ae9bba..a1d20aaae 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
@@ -49,7 +49,7 @@ async function seedEncryptedFile(
         fileType,
         name,
         encryptedBody: await zip.arrayBuffer(),
-        overrideKeys: {} as Record<string, string>,
+        researcherKeys: {} as Record<string, string>,
     }
 }
 
diff --git a/src/components/encrypted-files-panel.test.tsx b/src/components/encrypted-files-panel.test.tsx
index fc669add4..a1294d53a 100644
--- a/src/components/encrypted-files-panel.test.tsx
+++ b/src/components/encrypted-files-panel.test.tsx
@@ -53,7 +53,7 @@ async function seedArtifact(
         fileType,
         name: 'encrypted-results.zip',
         encryptedBody: await zip.arrayBuffer(),
-        overrideKeys: {} as Record<string, string>,
+        researcherKeys: {} as Record<string, string>,
     }
 }
 
diff --git a/src/hooks/use-decrypt-files.ts b/src/hooks/use-decrypt-files.ts
index 4772d7858..ed0f38e4e 100644
--- a/src/hooks/use-decrypt-files.ts
+++ b/src/hooks/use-decrypt-files.ts
@@ -10,15 +10,16 @@ import type { FileType } from '@/database/types'
 // One encrypted artifact from fetchEncryptedJobFilesAction: the whole-zip ciphertext blob (prod
 // format, embedded manifest). Decrypting it yields the inner plaintext files.
 //
-// `overrideKeys` (inner file path -> wrapped AES key) is set only for lab researchers, who are
-// NOT manifest recipients: their per-file re-wrapped keys come from study_job_file_key. Empty for
-// enclave reviewers, who decrypt via the embedded manifest using their own key's fingerprint.
+// `researcherKeys` (inner file path -> wrapped AES key) is set only for lab researchers, who are
+// NOT manifest recipients: their per-file re-wrapped keys come from study_job_file_key and are
+// merged into the manifest under their fingerprint by ResultsReader. Empty for enclave reviewers,
+// who decrypt via the embedded manifest using their own key's fingerprint.
 export type EncryptedJobFile = {
     studyJobFileId: string
     fileType: FileType
     name: string
     encryptedBody: ArrayBuffer
-    overrideKeys: Record<string, string>
+    researcherKeys: Record<string, string>
 }
 
 class KeyParseError extends Error {}
@@ -41,7 +42,7 @@ async function decryptFiles(encryptedFiles: EncryptedJobFile[], privateKey: stri
                 new Blob([artifact.encryptedBody]),
                 privateKeyBuffer,
                 fingerprint,
-                artifact.overrideKeys,
+                artifact.researcherKeys,
             )
             // Per-file raw AES key: each inner file has its own key, so re-wrap at approval wraps
             // each file's key for the researchers (see buildSharedFiles).
diff --git a/src/server/actions/study-job.actions.test.ts b/src/server/actions/study-job.actions.test.ts
index 887b15d26..f60a00068 100644
--- a/src/server/actions/study-job.actions.test.ts
+++ b/src/server/actions/study-job.actions.test.ts
@@ -55,7 +55,7 @@ describe('Study Job Actions', () => {
         expect(result).toHaveLength(1)
         expect(result[0].fileType).toBe('ENCRYPTED-CODE-RUN-LOG')
         expect(result[0].studyJobFileId).toBe(file.id)
-        expect(result[0].overrideKeys).toEqual({})
+        expect(result[0].researcherKeys).toEqual({})
     })
 
     // Regression: the middleware must expose submittedByOrgId so the CASL 'view StudyJob'
@@ -95,7 +95,7 @@ describe('Study Job Actions', () => {
         const result = actionResult(await fetchEncryptedJobFilesAction({ jobId: job.id }))
 
         expect(result).toHaveLength(1)
-        expect(result[0].overrideKeys).toEqual({ 'results.csv': 'wrapped-for-researcher' })
+        expect(result[0].researcherKeys).toEqual({ 'results.csv': 'wrapped-for-researcher' })
     })
 
     test('fetchEncryptedJobFilesAction returns nothing to a researcher with no shared keys', async () => {
diff --git a/src/server/actions/study-job.actions.ts b/src/server/actions/study-job.actions.ts
index 146f3c0f0..3bfcd6d38 100644
--- a/src/server/actions/study-job.actions.ts
+++ b/src/server/actions/study-job.actions.ts
@@ -201,7 +201,7 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
 
         // Each artifact is the prod whole-zip (embedded manifest). Enclave reviewers are manifest
         // recipients and decrypt with their own key; lab researchers are not, so they decrypt with
-        // per-file re-wrapped keys (study_job_file_key) supplied as `overrideKeys`. A reviewer is
+        // per-file re-wrapped keys (study_job_file_key) supplied as `researcherKeys`. A reviewer is
         // a member of the study's enclave org (study.orgId); everyone else takes the researcher
         // path.
         const isEnclaveReviewer = Object.values(session.orgs).some(
@@ -219,14 +219,14 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
                     fileType: file.fileType,
                     name: file.name,
                     encryptedBody: await (await fetchFileContents(file.path)).arrayBuffer(),
-                    overrideKeys: {} as Record<string, string>,
+                    researcherKeys: {} as Record<string, string>,
                 })),
             )
         }
 
         // Researcher: return only artifacts this user has wrapped keys for. Approval re-wraps both
         // results and logs (all-or-nothing), so both can appear here; keys exist only after
-        // approval, so this is naturally gated. Build the {file_path -> crypt} override map per
+        // approval, so this is naturally gated. Build the {file_path -> crypt} key map per
         // artifact.
         const wrappedKeys = await db
             .selectFrom('studyJobFileKey')
@@ -240,22 +240,22 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
             .execute()
         if (!wrappedKeys.length) return []
 
-        const overrideByFileId = new Map<string, Record<string, string>>()
+        const keysByFileId = new Map<string, Record<string, string>>()
         for (const key of wrappedKeys) {
-            const map = overrideByFileId.get(key.studyJobFileId) ?? {}
+            const map = keysByFileId.get(key.studyJobFileId) ?? {}
             map[key.filePath] = key.crypt
-            overrideByFileId.set(key.studyJobFileId, map)
+            keysByFileId.set(key.studyJobFileId, map)
         }
 
         return Promise.all(
             encryptedFiles
-                .filter((file) => overrideByFileId.has(file.id))
+                .filter((file) => keysByFileId.has(file.id))
                 .map(async (file) => ({
                     studyJobFileId: file.id,
                     fileType: file.fileType,
                     name: file.name,
                     encryptedBody: await (await fetchFileContents(file.path)).arrayBuffer(),
-                    overrideKeys: overrideByFileId.get(file.id)!,
+                    researcherKeys: keysByFileId.get(file.id)!,
                 })),
         )
     })

From f93ec3da853b619660e2be16a8d84802a102367c Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Wed, 17 Jun 2026 11:36:44 -0400
Subject: [PATCH 35/45] Revalidate

---
 src/server/actions/user-keys.actions.ts | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/server/actions/user-keys.actions.ts b/src/server/actions/user-keys.actions.ts
index cb1d9f343..b6126d89e 100644
--- a/src/server/actions/user-keys.actions.ts
+++ b/src/server/actions/user-keys.actions.ts
@@ -3,8 +3,16 @@
 import { getUserPublicKey } from '@/server/db/queries'
 import { onUserPublicKeyCreated, onUserPublicKeyUpdated } from '@/server/events'
 import { revalidatePath } from 'next/cache'
+import { Routes } from '@/lib/routes'
 import { Action, ActionFailure, z } from './action'
 
+// Pages that render the user's key state — bust both after a key write so presence/fingerprint
+// don't read stale. Both reviewers and researchers use the same key now (orgNeedsKey).
+function revalidateKeyPages(): void {
+    revalidatePath(Routes.accountKeys)
+    revalidatePath(Routes.userKey)
+}
+
 export const getUserPublicKeyAction = new Action('getUserPublicKeyAction')
     .requireAbilityTo('view', 'UserKey')
     .handler(async ({ session }) => {
@@ -55,7 +63,7 @@ export const setUserPublicKeyAction = new Action('setUserPublicKeyAction')
             .executeTakeFirstOrThrow(() => new ActionFailure({ message: 'Failed to set user public key' }))
 
         onUserPublicKeyCreated({ userId })
-        revalidatePath('/reviewer')
+        revalidateKeyPages()
     })
 
 export const updateUserPublicKeyAction = new Action('updateUserPublicKeyAction')
@@ -77,4 +85,5 @@ export const updateUserPublicKeyAction = new Action('updateUserPublicKeyAction')
             .executeTakeFirstOrThrow(() => new ActionFailure({ message: 'Failed to update user public key.' }))
 
         onUserPublicKeyUpdated({ userId })
+        revalidateKeyPages()
     })

From 025834bdb74c3ad91433eb364b7c0a1d7583fae5 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Wed, 17 Jun 2026 12:55:27 -0400
Subject: [PATCH 36/45] Use consistent UI

---
 bin/inject-encrypted-results.ts               |  18 +--
 .../dl/results/[jobId]/[fileName]/route.ts    |   6 +-
 src/components/encrypted-files-panel.test.tsx |   7 +-
 src/components/job-results.tsx                | 131 ++----------------
 src/components/otp-input.tsx                  |   1 +
 .../1780000000000_study_job_file_keys.ts      |  14 +-
 src/hooks/use-decrypt-files.ts                |  17 +--
 src/hooks/use-encrypted-files-panel.ts        |  17 +--
 src/lib/re-wrap-results.ts                    |  11 +-
 src/lib/types.ts                              |  10 +-
 src/server/actions/study-job.actions.test.ts  |  12 +-
 src/server/actions/study-job.actions.ts       |  49 +++----
 src/server/db/queries.ts                      |  20 +--
 src/server/results-sharing.ts                 |  29 ++--
 src/server/storage.ts                         |  11 +-
 15 files changed, 85 insertions(+), 268 deletions(-)

diff --git a/bin/inject-encrypted-results.ts b/bin/inject-encrypted-results.ts
index b149fdd11..3ac262a0e 100644
--- a/bin/inject-encrypted-results.ts
+++ b/bin/inject-encrypted-results.ts
@@ -28,10 +28,8 @@ async function orgPublicKeys(orgId: string): Promise<{ publicKey: ArrayBuffer; f
         new Uint8Array(ab).set(publicKey)
         return { publicKey: ab, fingerprint }
     })
-    // Seed data contains placeholder keys (e.g. fingerprint "e2e-test-fingerprint-admin"
-    // with literal text bytes) that aren't real SPKI DER — wrapping for them throws
-    // deep inside ResultsWriter. Pre-validate with the same import params si-encryption
-    // uses and skip the duds.
+    // Seed data has placeholder keys (literal text bytes, not SPKI DER) that throw when wrapped.
+    // Pre-validate with si-encryption's import params and skip the duds.
     const valid: typeof keys = []
     for (const k of keys) {
         try {
@@ -96,21 +94,15 @@ async function main() {
     if (alreadyHasResults) {
         console.info(`Job already has encrypted results — skipping store (delete study_job_file rows to re-inject).`)
     } else {
-        // Mirror the real enclave helper (osenclave `toa_results_upload`): it posts exactly ONE
-        // results file and ONE logs file, so each artifact's zip holds a single encrypted inner
-        // entry. Do NOT add multiple result files here — the live helper can't produce that shape
-        // (one file per upload + MA's RUN-COMPLETE 422 guard), and faking it gave a misleading
-        // multi-row picture in the DB.
+        // One results file + one logs file, matching the real enclave helper (one file per upload).
         const resultsZip = await buildZip([{ name: 'results.csv', content: 'group,count\nA,42\nB,17\n' }], reviewerKeys)
         const logZip = await buildZip([{ name: 'run.log', content: 'job started\njob finished ok\n' }], reviewerKeys)
         await storeStudyEncryptedResultsFile(info, resultsZip)
         await storeStudyEncryptedLogFile(info, logZip, 'ENCRYPTED-CODE-RUN-LOG')
     }
 
-    // Make the status chain realistic. A results-stage job must have had its code approved first,
-    // or the proposal-level review buttons stay visible (they only hide once the study is APPROVED
-    // *and* the code was reviewed). Inject CODE-APPROVED before RUN-COMPLETE so the latest status
-    // stays RUN-COMPLETE and the page shows only the results Approve/Reject.
+    // A results-stage job needs code approved first, else the proposal review buttons stay visible.
+    // Inject CODE-APPROVED before RUN-COMPLETE so the latest status stays RUN-COMPLETE.
     const statuses = await db
         .selectFrom('jobStatusChange')
         .select(['status', 'createdAt'])
diff --git a/src/app/dl/results/[jobId]/[fileName]/route.ts b/src/app/dl/results/[jobId]/[fileName]/route.ts
index 2136707b1..4054918a9 100644
--- a/src/app/dl/results/[jobId]/[fileName]/route.ts
+++ b/src/app/dl/results/[jobId]/[fileName]/route.ts
@@ -4,10 +4,8 @@ import { getStudyJobFileOfType, getInfoForStudyJobId } from '@/server/db/queries
 import { canViewStudyJob } from '@/server/auth'
 
 // LEGACY ONLY: serves the plaintext APPROVED-RESULT copy from before results were encrypted for
-// researchers. New jobs no longer create APPROVED-RESULT rows (results are decrypted client-side),
-// so this is only reachable for pre-encryption studies. Delete it — along with
-// pathForStudyJobResults (src/lib/paths.ts) and any remaining plaintext S3 objects — once legacy
-// studies age out.
+// researchers. New jobs don't create APPROVED-RESULT rows, so only pre-encryption studies reach
+// this. Delete with pathForStudyJobResults + leftover plaintext S3 objects once legacy ages out.
 export const GET = async (_: Request, { params }: { params: Promise<{ jobId: string; fileName: string }> }) => {
     const { jobId, fileName } = await params
 
diff --git a/src/components/encrypted-files-panel.test.tsx b/src/components/encrypted-files-panel.test.tsx
index a1294d53a..064150188 100644
--- a/src/components/encrypted-files-panel.test.tsx
+++ b/src/components/encrypted-files-panel.test.tsx
@@ -27,10 +27,9 @@ const toArrayBuffer = (str: string): ArrayBuffer => {
 
 type MinimalJob = { id: string }
 
-// Encrypt one results artifact the way TOA would (the prod whole-zip format with an embedded
-// manifest), persist the matching study_job_file row, and return the artifact entry the
-// fetchEncryptedJobFilesAction mock will serve. The reviewer is a manifest recipient, so the
-// override map is empty — they decrypt with their own key (no per-file re-wrapped keys needed).
+// Encrypt one results artifact the way TOA would (prod whole-zip + embedded manifest), persist the
+// study_job_file row, and return the entry the fetchEncryptedJobFilesAction mock serves. The
+// reviewer is a manifest recipient, so researcherKeys is empty — they decrypt with their own key.
 async function seedArtifact(
     job: MinimalJob,
     { fileType, subdir, files }: { fileType: FileType; subdir: string; files: { name: string; content: string }[] },
diff --git a/src/components/job-results.tsx b/src/components/job-results.tsx
index 17be4420a..e3b7257da 100644
--- a/src/components/job-results.tsx
+++ b/src/components/job-results.tsx
@@ -1,129 +1,14 @@
 'use client'
 
-import { FC, useMemo, useState } from 'react'
-import { Anchor, Group, LoadingOverlay, Stack, Text, useMantineTheme } from '@mantine/core'
-import { ArrowSquareOutIcon } from '@phosphor-icons/react/dist/ssr'
-import { useQuery } from '@/common'
-import { ErrorAlert } from '@/components/errors'
-import { DownloadBlobLink } from '@/components/download-blob-link'
-import { PrivateKeyForm } from '@/components/private-key-form'
-import { isEncryptedLogType, isResultFile, logLabel } from '@/lib/file-type-helpers'
-import { useDecryptFiles } from '@/hooks/use-decrypt-files'
-import { fetchEncryptedJobFilesAction } from '@/server/actions/study-job.actions'
-import { JobFileInfo } from '@/lib/types'
-import { LatestJobForStudy } from '@/server/db/queries'
+import { FC } from 'react'
+import { EncryptedFilesPanel } from '@/components/encrypted-files-panel'
+import type { LatestJobForStudy } from '@/server/db/queries'
 
-const ViewResultsLink: FC<{ content: ArrayBuffer }> = ({ content }) => {
-    const handleClick = () => {
-        const decoder = new TextDecoder('utf-8')
-        const decodedString = decoder.decode(content)
-        const tab = window.open('about:blank', '_blank')
-        if (!tab) {
-            reportError('failed to open results window')
-        }
-        tab?.document.write(decodedString)
-        tab?.document.close()
-    }
+// Researcher-facing view of shared results. Reuses the reviewer's EncryptedFilesPanel (table +
+// status icons + modal preview + download) so both sides match. Researchers don't approve, so
+// onFilesApproved is a no-op; they decrypt the bodies with their own key.
+const noop = () => {}
 
-    return (
-        <Anchor role="button" onClick={handleClick} style={{ display: 'flex', alignItems: 'center' }}>
-            View <ArrowSquareOutIcon size={16} style={{ marginLeft: 4 }} />
-        </Anchor>
-    )
-}
-
-// One file row. Label + name come from the encrypted metadata so the researcher sees what's
-// available before decrypting; View/Download appear only once `decrypted` is set.
-const FileRow: FC<{ label: string; name: string; decrypted?: JobFileInfo }> = ({ label, name, decrypted }) => {
-    const theme = useMantineTheme()
-    return (
-        <Group gap="xs">
-            <Text size="sm" fw={600}>
-                {label}:
-            </Text>
-            <Text size="sm">{name}</Text>
-            {decrypted && (
-                <>
-                    <ViewResultsLink content={decrypted.contents} />
-                    <span style={{ height: 16, borderLeft: `1px solid ${theme.colors.charcoal[4]}` }}></span>
-                    <DownloadBlobLink target="_blank" filename={name} fileContent={decrypted.contents} />
-                </>
-            )}
-        </Group>
-    )
-}
-
-// Researcher-facing view of shared results. There is no plaintext copy: the researcher decrypts
-// the file bodies with their own key (the wrapped key the reviewer produced at approve). The file
-// list shows before decryption — names aren't secret, and the reviewer panel lists them too —
-// only View/Download are gated behind the key.
 export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
-    const [decryptedFiles, setDecryptedFiles] = useState<JobFileInfo[]>()
-
-    const {
-        data: encryptedFiles,
-        isLoading,
-        isError,
-        error,
-    } = useQuery({
-        queryKey: ['encrypted-files', job.id],
-        queryFn: async () => await fetchEncryptedJobFilesAction({ jobId: job.id }),
-    })
-
-    const {
-        decrypt,
-        isPending: isDecrypting,
-        form,
-    } = useDecryptFiles({
-        encryptedFiles,
-        onSuccess: setDecryptedFiles,
-    })
-
-    // After decryption, one row per decrypted inner file (each artifact is a whole-zip unpacking
-    // into many files); before that, one locked row per encrypted artifact. Researchers receive
-    // both results and approved logs (re-wrapped at approval, all-or-nothing); results listed
-    // first, then logs.
-    const rows = useMemo(() => {
-        if (decryptedFiles) {
-            return decryptedFiles.map((f) => ({
-                key: `${f.sourceId}-${f.path}`,
-                label: logLabel(f.fileType),
-                name: f.path,
-                decrypted: f,
-            }))
-        }
-        const files = encryptedFiles ?? []
-        const ordered = [...files.filter(isResultFile), ...files.filter((f) => isEncryptedLogType(f.fileType))]
-        return ordered.map((f) => ({
-            key: f.studyJobFileId,
-            label: logLabel(f.fileType),
-            name: f.name,
-            decrypted: undefined as JobFileInfo | undefined,
-        }))
-    }, [encryptedFiles, decryptedFiles])
-
-    const handleSubmit = form.onSubmit((values) => decrypt(values.privateKey))
-
-    if (isError) {
-        return <ErrorAlert error={error} />
-    }
-
-    if (isLoading) {
-        return <LoadingOverlay />
-    }
-
-    return (
-        <Stack>
-            {rows.map((row) => (
-                <FileRow key={row.key} label={row.label} name={row.name} decrypted={row.decrypted} />
-            ))}
-            <PrivateKeyForm
-                isVisible={!decryptedFiles}
-                form={form}
-                onSubmit={handleSubmit}
-                isDecrypting={isDecrypting}
-                submitLabel="View Results"
-            />
-        </Stack>
-    )
+    return <EncryptedFilesPanel job={job} onFilesApproved={noop} />
 }
diff --git a/src/components/otp-input.tsx b/src/components/otp-input.tsx
index aa9c989fd..d8c8ce82a 100644
--- a/src/components/otp-input.tsx
+++ b/src/components/otp-input.tsx
@@ -4,6 +4,7 @@ import { UseFormReturnType } from '@mantine/form'
 const OtpInput = ({ form }: { form: UseFormReturnType<{ code: string }> }) => {
     return (
         <PinInput
+            autoFocus
             length={6}
             size="lg"
             type="number"
diff --git a/src/database/migrations/1780000000000_study_job_file_keys.ts b/src/database/migrations/1780000000000_study_job_file_keys.ts
index 5695fc202..768d1f1c9 100644
--- a/src/database/migrations/1780000000000_study_job_file_keys.ts
+++ b/src/database/migrations/1780000000000_study_job_file_keys.ts
@@ -1,15 +1,11 @@
 import { type Kysely, sql } from 'kysely'
 
 export async function up(db: Kysely<unknown>): Promise<void> {
-    // Per-recipient wrapped AES keys granting a lab researcher access to one inner file of an
-    // approved results archive. The encrypted artifact stays a single whole-zip `study_job_file`
-    // row whose embedded manifest already holds the enclave recipients' keys (unchanged, prod
-    // format); these rows ADD researcher recipients without re-encrypting. `study_job_file_id`
-    // points at the whole-zip row, `file_path` is the inner file.
-    //
-    // Approval is all-or-nothing at the job level (per Phil 2026-06): it lives in
-    // `job_status_change` as a FILES-APPROVED event, NOT per file. A file is "shared with
-    // researchers" iff the job is approved. These rows are the *access* mechanism.
+    // Per-recipient wrapped AES key granting a lab researcher access to one inner file of an
+    // approved results archive. The artifact stays a single whole-zip `study_job_file` row (prod
+    // format, unchanged); these rows ADD researcher recipients without re-encrypting.
+    // `study_job_file_id` points at the whole-zip row, `file_path` is the inner file. Approval
+    // itself is the job-level FILES-APPROVED status; these rows are the access mechanism.
     await db.schema
         .createTable('study_job_file_key')
         .addColumn('id', 'uuid', (col) => col.defaultTo(sql`v7uuid()`).primaryKey())
diff --git a/src/hooks/use-decrypt-files.ts b/src/hooks/use-decrypt-files.ts
index ed0f38e4e..2f43b9b33 100644
--- a/src/hooks/use-decrypt-files.ts
+++ b/src/hooks/use-decrypt-files.ts
@@ -7,13 +7,10 @@ import { ResultsReader } from 'si-encryption/job-results/reader'
 import { fingerprintPublicKeyFromPrivateKey, pemToArrayBuffer, privateKeyFromBuffer } from 'si-encryption/util'
 import type { FileType } from '@/database/types'
 
-// One encrypted artifact from fetchEncryptedJobFilesAction: the whole-zip ciphertext blob (prod
-// format, embedded manifest). Decrypting it yields the inner plaintext files.
-//
-// `researcherKeys` (inner file path -> wrapped AES key) is set only for lab researchers, who are
-// NOT manifest recipients: their per-file re-wrapped keys come from study_job_file_key and are
-// merged into the manifest under their fingerprint by ResultsReader. Empty for enclave reviewers,
-// who decrypt via the embedded manifest using their own key's fingerprint.
+// One encrypted artifact from fetchEncryptedJobFilesAction: whole-zip ciphertext (embedded
+// manifest). `researcherKeys` (inner path -> wrapped AES key) is set only for lab researchers, who
+// aren't manifest recipients; ResultsReader merges them into the manifest under their fingerprint.
+// Empty for enclave reviewers, who decrypt with their own key.
 export type EncryptedJobFile = {
     studyJobFileId: string
     fileType: FileType
@@ -44,8 +41,7 @@ async function decryptFiles(encryptedFiles: EncryptedJobFile[], privateKey: stri
                 fingerprint,
                 artifact.researcherKeys,
             )
-            // Per-file raw AES key: each inner file has its own key, so re-wrap at approval wraps
-            // each file's key for the researchers (see buildSharedFiles).
+            // Capture each inner file's raw AES key so approval can re-wrap it per researcher.
             const entries = await reader.extractFilesWithKeys()
             for (const entry of entries) {
                 files.push({
@@ -53,8 +49,7 @@ async function decryptFiles(encryptedFiles: EncryptedJobFile[], privateKey: stri
                     contents: entry.contents,
                     rawAesKey: entry.rawAesKey,
                     sourceId: artifact.studyJobFileId,
-                    // Map an encrypted type to its approved form; an already-approved input
-                    // (researcher viewing shared results) keeps its own type.
+                    // Encrypted type -> approved form; an already-approved input keeps its type.
                     fileType: ENCRYPTED_TO_APPROVED[artifact.fileType] ?? artifact.fileType,
                 })
             }
diff --git a/src/hooks/use-encrypted-files-panel.ts b/src/hooks/use-encrypted-files-panel.ts
index c10d2926c..f75966d4f 100644
--- a/src/hooks/use-encrypted-files-panel.ts
+++ b/src/hooks/use-encrypted-files-panel.ts
@@ -36,9 +36,7 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
 
     const isJobApproved = (job.statusChanges ?? []).some((sc) => sc.status === 'FILES-APPROVED')
 
-    // Which artifacts are shared with researchers — derived from the re-wrapped key rows
-    // (getSharedFileIdsForJob), so it reflects exactly what was shared at any granularity. There
-    // is no plaintext approved copy.
+    // Which artifacts are shared with researchers, derived from the re-wrapped key rows.
     const { data: sharedFileIds = [] } = useQuery({
         queryKey: ['shared-file-ids', job.id],
         queryFn: () => fetchSharedFileIdsAction({ jobId: job.id }),
@@ -67,10 +65,8 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
         onSuccess: (files) => setDecryptedFiles(files),
     })
 
-    // All-or-nothing: approving shares the entire decrypted package — results AND logs — with the
-    // researchers (no per-file selection). Every decrypted artifact carries its own rawAesKey, so
-    // buildSharedFiles re-wraps each for the lab keys. (buildSharedFiles is already per-file, so
-    // splitting results vs logs later would be a UI change only.)
+    // All-or-nothing: approving shares the whole decrypted package (results AND logs). Each
+    // artifact carries its own rawAesKey, so buildSharedFiles re-wraps each for the lab keys.
     useEffect(() => {
         onFilesApproved(decryptedFiles)
     }, [decryptedFiles]) // eslint-disable-line react-hooks/exhaustive-deps
@@ -81,10 +77,9 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
 
     const sharedIdSet = useMemo(() => new Set(sharedFileIds), [sharedFileIds])
 
-    // Before decryption: one locked row per encrypted artifact (results, logs); size is unknown
-    // until decrypted (pre-encryption byte counts aren't stored). After: one row per decrypted
-    // inner file — each artifact is a whole-zip unpacking into many files, all sharing the
-    // artifact's row id (sourceId), so "shared" is keyed on that id.
+    // Before decryption: one locked row per encrypted artifact (size unknown until decrypted).
+    // After: one row per inner file, all sharing the artifact's row id (sourceId) that "shared" is
+    // keyed on.
     const fileRows: UnifiedFileRow[] = useMemo(() => {
         if (decryptedFiles.length > 0) {
             return decryptedFiles.map((f) => ({
diff --git a/src/lib/re-wrap-results.ts b/src/lib/re-wrap-results.ts
index e02031f2c..623010753 100644
--- a/src/lib/re-wrap-results.ts
+++ b/src/lib/re-wrap-results.ts
@@ -4,14 +4,9 @@ import { fetchLabPublicKeysAction } from '@/server/actions/study-job.actions'
 import type { JobFileInfo, SharedFile } from '@/lib/types'
 
 /**
- * Re-wrap (not re-encrypt) approved files — results and logs — for the study's lab researchers,
- * client-side.
- *
- * Each archive keeps the prod whole-zip format: one AES key PER inner file, embedded in the
- * manifest for the enclave recipients. While reviewing, the reviewer's browser recovered each
- * file's raw AES key (see use-decrypt-files). Here, for every researcher public key, we wrap that
- * raw key into a new wrapped key (`crypt`); the ciphertext is never touched. The server only ever
- * receives wrapped keys — never the raw AES key or plaintext.
+ * Re-wrap (not re-encrypt) approved files for the study's lab researchers, client-side. Each inner
+ * file has its own AES key; for every researcher key we wrap that raw key into a new `crypt`.
+ * Ciphertext is untouched — the server only ever receives wrapped keys, never plaintext.
  */
 export async function buildSharedFiles(studyId: string, files: JobFileInfo[]): Promise<SharedFile[]> {
     const labKeys = actionResult(await fetchLabPublicKeysAction({ studyId }))
diff --git a/src/lib/types.ts b/src/lib/types.ts
index 2c5de0379..7d3dba094 100644
--- a/src/lib/types.ts
+++ b/src/lib/types.ts
@@ -39,8 +39,7 @@ export function isLabOrg(org: { type: OrgType }): org is LabOrg {
 }
 
 // Members of these org types hold an encryption key: enclave reviewers decrypt to review, lab
-// researchers decrypt approved results. A user without a key for one of these orgs is gated into
-// key generation.
+// researchers decrypt approved results. Members without a key are gated into key generation.
 export function orgNeedsKey(org: { type: OrgType }): boolean {
     return isEnclaveOrg(org) || isLabOrg(org)
 }
@@ -222,10 +221,9 @@ export type SharedFile = z.infer<typeof sharedFileSchema>
 export type JobFileInfo = FileEntry & {
     sourceId: string // the study_job_file row this decrypted file came from
     fileType: FileType
-    // Raw AES key recovered while decrypting, kept in-memory so the reviewer's browser can re-wrap
-    // it for researchers at approve time without decrypting again. SECURITY: this unlocks the file
-    // body for any recipient — it must never be sent to the server or persisted. Only the
-    // client-side approve/re-wrap flow (buildSharedFiles) reads it.
+    // Raw AES key recovered while decrypting, kept in-memory so the browser can re-wrap for
+    // researchers at approve time. SECURITY: unlocks the file body — must never be sent to the
+    // server or persisted. Only the client-side re-wrap flow (buildSharedFiles) reads it.
     rawAesKey?: ArrayBuffer
 }
 
diff --git a/src/server/actions/study-job.actions.test.ts b/src/server/actions/study-job.actions.test.ts
index f60a00068..fa4b02c50 100644
--- a/src/server/actions/study-job.actions.test.ts
+++ b/src/server/actions/study-job.actions.test.ts
@@ -34,8 +34,8 @@ describe('Study Job Actions', () => {
     })
 
     test('fetchEncryptedJobFilesAction returns the whole-zip artifacts to an enclave reviewer', async () => {
-        // Enclave reviewers are recipients in the embedded manifest, so they get every encrypted
-        // artifact (results + logs) with no override keys — they decrypt with their own key.
+        // Enclave reviewers are manifest recipients, so they get every artifact with no
+        // researcherKeys — they decrypt with their own key.
         const { org } = await mockSessionWithTestData({ orgType: 'enclave' })
         const { job } = await insertTestStudyJobData({ org })
 
@@ -58,10 +58,10 @@ describe('Study Job Actions', () => {
         expect(result[0].researcherKeys).toEqual({})
     })
 
-    // Regression: the middleware must expose submittedByOrgId so the CASL 'view StudyJob'
-    // rule matches lab researchers, not just enclave reviewers — researchers fetch their
-    // re-wrapped result files through this same action, with their per-file override keys.
-    test('fetchEncryptedJobFilesAction returns researcher override keys for shared files', async () => {
+    // Regression: the middleware must expose submittedByOrgId so the CASL 'view StudyJob' rule
+    // matches lab researchers, not just enclave reviewers — researchers fetch their re-wrapped
+    // result files through this same action.
+    test('fetchEncryptedJobFilesAction returns researcher keys for shared files', async () => {
         const { org, user } = await mockSessionWithTestData({ orgType: 'lab' })
         const { job } = await insertTestStudyJobData({ org })
 
diff --git a/src/server/actions/study-job.actions.ts b/src/server/actions/study-job.actions.ts
index 3bfcd6d38..62e5944ca 100644
--- a/src/server/actions/study-job.actions.ts
+++ b/src/server/actions/study-job.actions.ts
@@ -34,19 +34,13 @@ export const approveStudyJobFilesAction = new Action('approveStudyJobFilesAction
     })
     .requireAbilityTo('approve', 'Study')
     .handler(async ({ params: { jobInfo: info, sharedFiles }, session, db }) => {
-        // Re-wrap, not re-encrypt: the reviewer's browser unwrapped the results' AES key while
-        // reviewing and wrapped it for the lab researchers' public keys. We only persist those
-        // wrapped-key rows — the ciphertext is never touched and the server never sees plaintext
-        // or the raw AES key. Adding a wrapped key = sharing. The FILES-APPROVED status change
-        // below is the all-or-nothing approval fact itself.
+        // Re-wrap, not re-encrypt: persist only the wrapped-key rows the reviewer's browser
+        // produced. Ciphertext untouched; server never sees plaintext. The FILES-APPROVED status
+        // below is the all-or-nothing approval fact.
         //
-        // KNOWN LIMITATION — late-joining researchers (OUT OF SCOPE, per Phil 2026-06):
-        // Keys are wrapped only for lab members with a registered public key at approval time. A
-        // researcher who joins or generates their key *after* approval gets no wrapped key and
-        // cannot read already-approved results. There is intentionally NO backfill: once approved,
-        // the reviewer's browser no longer holds the raw AES key, so re-wrapping for a late joiner
-        // would require re-opening and re-decrypting. Researchers must register keys before
-        // approval. FLAG FOR PO: if backfill is ever required, a recovery flow would land here.
+        // No backfill for late joiners: keys are wrapped only for lab members with a registered key
+        // at approval time. Registering a key later can't unlock already-approved results —
+        // re-wrapping needs the raw AES key, which the browser no longer holds.
         await insertSharedFileKeys(db, info.studyJobId, sharedFiles)
 
         await db
@@ -79,9 +73,8 @@ export const fetchLabPublicKeysAction = new Action('fetchLabPublicKeysAction')
         return await getLabPublicKeysForStudy(studyId)
     })
 
-// IDs of the job's artifacts shared with researchers — derived from the re-wrapped key rows (see
-// getSharedFileIdsForJob), so it reflects whatever was shared at approve time (results, or
-// results + logs). Empty before approval. There is no plaintext approved copy.
+// IDs of the job's artifacts shared with researchers, derived from the re-wrapped key rows. Empty
+// before approval.
 export const fetchSharedFileIdsAction = new Action('fetchSharedFileIdsAction')
     .params(z.object({ jobId: z.string() }))
     .middleware(async ({ params: { jobId } }) => {
@@ -183,9 +176,8 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
     )
     .middleware(async ({ params: { jobId } }) => {
         const studyJob = await getStudyJobInfo(jobId)
-        // Include submittedByOrgId so the 'view StudyJob' ability matches lab researchers, not
-        // just enclave reviewers (permissions.ts permits view when submittedByOrgId ∈ the user's
-        // researcher orgs) — researchers fetch their own re-wrapped result files here.
+        // Include submittedByOrgId so 'view StudyJob' matches lab researchers, not just enclave
+        // reviewers — researchers fetch their own re-wrapped result files here.
         return { studyJob, orgId: studyJob.orgId, submittedByOrgId: studyJob.submittedByOrgId }
     })
     .requireAbilityTo('view', 'StudyJob')
@@ -199,19 +191,16 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
         )
         if (!encryptedFiles.length) return []
 
-        // Each artifact is the prod whole-zip (embedded manifest). Enclave reviewers are manifest
-        // recipients and decrypt with their own key; lab researchers are not, so they decrypt with
-        // per-file re-wrapped keys (study_job_file_key) supplied as `researcherKeys`. A reviewer is
-        // a member of the study's enclave org (study.orgId); everyone else takes the researcher
-        // path.
+        // Enclave reviewers are manifest recipients and decrypt with their own key; lab researchers
+        // aren't, so they get per-file re-wrapped keys (study_job_file_key) as `researcherKeys`. A
+        // reviewer is a member of the study's enclave org; everyone else takes the researcher path.
         const isEnclaveReviewer = Object.values(session.orgs).some(
             (org) => org.id === studyJob.orgId && org.type === 'enclave',
         )
 
-        // TODO(perf): every ciphertext body is buffered into server memory and serialized through
-        // the server-action layer. DEFERRED on purpose (Phil 2026-06) — fine at current result
-        // sizes. ESCAPE HATCH if we hit limits: hand the client a short-lived signed S3 URL to
-        // fetch + decrypt ciphertext directly, instead of proxying through here.
+        // TODO(perf): ciphertext bodies are buffered into server memory and serialized through the
+        // action layer. Fine at current sizes; if it grows, hand the client a signed S3 URL to
+        // fetch + decrypt directly instead.
         if (isEnclaveReviewer) {
             return Promise.all(
                 encryptedFiles.map(async (file) => ({
@@ -224,10 +213,8 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
             )
         }
 
-        // Researcher: return only artifacts this user has wrapped keys for. Approval re-wraps both
-        // results and logs (all-or-nothing), so both can appear here; keys exist only after
-        // approval, so this is naturally gated. Build the {file_path -> crypt} key map per
-        // artifact.
+        // Researcher: only artifacts this user has wrapped keys for (exist only post-approval, so
+        // naturally gated). Build the {file_path -> crypt} map per artifact.
         const wrappedKeys = await db
             .selectFrom('studyJobFileKey')
             .select(['studyJobFileId', 'filePath', 'crypt'])
diff --git a/src/server/db/queries.ts b/src/server/db/queries.ts
index cf49ccac6..c7266b0ed 100644
--- a/src/server/db/queries.ts
+++ b/src/server/db/queries.ts
@@ -457,17 +457,13 @@ const labOrgIdForJob = async (jobId: string) =>
         .where('studyJob.id', '=', jobId)
         .executeTakeFirstOrThrow(throwNotFound(`job ${jobId}`))
 
-/**
- * Public keys of the lab org that submitted the study (`study.submittedByOrgId`) — the
- * researchers. These are the recipients a reviewer re-wraps approved files for.
- */
+// Public keys of the lab org that submitted the study — the researchers a reviewer re-wraps for.
 export async function getLabPublicKeysForJob(jobId: string): Promise<PublicKey[]> {
     const { submittedByOrgId } = await labOrgIdForJob(jobId)
     return getOrgPublicKeys(submittedByOrgId)
 }
 
-// Same lab (researcher) recipient keys, resolved from the study directly — used by the client
-// approve flow, which knows the study but not necessarily the job id.
+// Same lab keys, resolved from the study id — used by the client approve flow.
 export async function getLabPublicKeysForStudy(studyId: string): Promise<PublicKey[]> {
     const { submittedByOrgId } = await Action.db
         .selectFrom('study')
@@ -477,15 +473,9 @@ export async function getLabPublicKeysForStudy(studyId: string): Promise<PublicK
     return getOrgPublicKeys(submittedByOrgId)
 }
 
-/**
- * IDs of this job's artifacts shared with researchers — those with at least one re-wrapped key row
- * in study_job_file_key. "Shared" is derived from the keys themselves (what the researcher decrypts
- * with), so it is granularity-agnostic: all-or-nothing, results-only, or results+logs all fall out
- * of which artifacts got wrapped at approve time — no status/file-type inference. Key rows only
- * exist post-approval, so this is naturally empty before then. Independent of current org
- * membership: removing a researcher from the lab does not delete their key rows, so it never
- * retroactively un-shares. The reviewer panel keys its "shared" indicator on this set.
- */
+// IDs of this job's artifacts with at least one re-wrapped key row — i.e. shared with researchers.
+// Empty before approval (rows only exist post-approval). Removing a researcher from the lab leaves
+// their key rows, so this never retroactively un-shares.
 export async function getSharedFileIdsForJob(jobId: string): Promise<string[]> {
     const rows = await Action.db
         .selectFrom('studyJobFileKey')
diff --git a/src/server/results-sharing.ts b/src/server/results-sharing.ts
index 1e819fde6..fea0a64f7 100644
--- a/src/server/results-sharing.ts
+++ b/src/server/results-sharing.ts
@@ -4,26 +4,20 @@ import type { SharedFile } from '@/lib/types'
 import { getLabPublicKeysForJob } from '@/server/db/queries'
 
 /**
- * Persist re-wrapped AES keys that grant lab researchers access to a job's files. Each
- * `study_job_file_key` row holds a file's AES key wrapped to a recipient's public key; only the
- * holder of the matching private key can unwrap it. Each wrapped key is validated against the lab
- * org's known public keys so a client can never share a file with an arbitrary fingerprint.
- * Idempotent via the (study_job_file_id, file_path, fingerprint) unique constraint. The file
- * ciphertext is untouched.
+ * Persist re-wrapped AES keys granting lab researchers access to a job's files. Each
+ * `study_job_file_key` row holds a file's AES key wrapped to a recipient's public key. Validated
+ * against the lab org's known keys so a client can't share to an arbitrary fingerprint. Idempotent
+ * via the (study_job_file_id, file_path, fingerprint) unique constraint; ciphertext untouched.
  *
- * Approval itself is recorded by the caller as a job-level FILES-APPROVED `job_status_change`
- * event (all-or-nothing, per Phil 2026-06) — NOT as a per-file column. The wrapped keys are just
- * the access mechanism; deleting one to revoke is *prospective only*: a researcher who already
- * unwrapped the AES key keeps it, so deletion stops future reads, not past ones.
+ * Revocation is prospective only: a researcher who already unwrapped a key keeps it.
  */
 export async function insertSharedFileKeys(db: DBExecutor, jobId: string, sharedFiles: SharedFile[]): Promise<void> {
     const labKeys = await getLabPublicKeysForJob(jobId)
     const labFingerprints = new Set(labKeys.map((k) => k.fingerprint))
 
-    // Ownership guard: `studyJobFileId` comes from the client payload, so confirm every file
-    // belongs to `jobId` before marking it shared. Without this, a reviewer with approve rights on
-    // job A could pass job B's file ids and — if B's lab shares a fingerprint — grant access to
-    // another job's files. The fingerprint validation below does not cover this.
+    // Ownership guard: `studyJobFileId` is client-supplied, so confirm every file belongs to
+    // `jobId` — else a reviewer could share another job's files by passing its ids. The fingerprint
+    // check below doesn't cover this.
     const jobFiles = await db.selectFrom('studyJobFile').select('id').where('studyJobId', '=', jobId).execute()
     const jobFileIds = new Set(jobFiles.map((f) => f.id))
     for (const file of sharedFiles) {
@@ -32,11 +26,8 @@ export async function insertSharedFileKeys(db: DBExecutor, jobId: string, shared
         }
     }
 
-    // We validate that each wrapped key targets a real lab recipient, but the server is blind: it
-    // cannot verify the `crypt` actually wraps the file's correct AES key. A buggy reviewer client
-    // could persist one that unwraps to garbage, and the researcher would fail to decrypt
-    // downstream. The reviewer client is trusted (it wraps the same key it just reviewed with), so
-    // this is accepted by design rather than guarded here.
+    // Server can't verify `crypt` wraps the correct AES key — only that the fingerprint is a real
+    // lab recipient. The reviewer client is trusted (wraps the key it just reviewed with).
     const rows = sharedFiles.flatMap((file) =>
         file.keys.map((key) => {
             if (!labFingerprints.has(key.fingerprint)) {
diff --git a/src/server/storage.ts b/src/server/storage.ts
index b39850e63..51da4c17e 100644
--- a/src/server/storage.ts
+++ b/src/server/storage.ts
@@ -44,14 +44,9 @@ export async function storeStudyLogFile(info: MinimalJobInfo, file: File, fileTy
     return await storeJobFile(info, `${pathForStudyJob(info)}/results/${filename}.txt`, file, fileType)
 }
 
-// Crypto granularity vs storage granularity differ:
-//   - CRYPTO is PER FILE: TOA's ResultsWriter gives each inner file its own AES key + IV; the
-//     wrapped keys live in a manifest.json embedded in the zip.
-//   - STORAGE is the WHOLE ZIP: that manifest + all per-file ciphertexts are one archive,
-//     persisted as a single S3 object / `study_job_file` row.
-// So sharing with a researcher re-wraps EACH file's key (one `study_job_file_key` row per inner
-// file per researcher), not one key for the whole archive. Format is unchanged from prod; we
-// deliberately do NOT re-encrypt or repackage on ingest.
+// Stored as one whole-zip archive (manifest + all per-file ciphertexts) per `study_job_file` row,
+// but crypto is per inner file (own AES key + IV in the embedded manifest). So sharing re-wraps
+// each inner file's key separately. Format unchanged from prod — no re-encrypt or repackage.
 export async function storeStudyEncryptedResultsFile(info: MinimalJobInfo, file: File) {
     return await storeJobFile(info, `${pathForStudyJob(info)}/results/encrypted-results.zip`, file, 'ENCRYPTED-RESULT')
 }

From dfc56c41ae77231302bcbee04cbf95098d95585c Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Wed, 17 Jun 2026 16:51:09 -0400
Subject: [PATCH 37/45] Fix test

---
 tests/study-flow.spec.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tests/study-flow.spec.ts b/tests/study-flow.spec.ts
index fc494a760..0a5b44845 100644
--- a/tests/study-flow.spec.ts
+++ b/tests/study-flow.spec.ts
@@ -445,8 +445,9 @@ async function verifyFailedStatusDisplay(page: Page, studyTitle: string): Promis
     // Verify Job ID is displayed
     await expect(page.getByText(/Job ID/i)).toBeVisible()
 
-    // Verify logs section exists (async-loaded via JobResults)
-    await expect(page.getByText(/Code Run Log:/i)).toBeVisible()
+    // Verify logs row exists in the results table (JobResults now renders EncryptedFilesPanel,
+    // which lists the log artifact by its file-type label before decryption).
+    await expect(page.getByText('Code Run Log')).toBeVisible()
 }
 
 // ============================================================================

From 336b1c09a991b56a4d6fb0f83b6c6763c7242b4e Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Thu, 18 Jun 2026 10:10:31 -0400
Subject: [PATCH 38/45] Rename table to be more clear, address PR comments

---
 .../review/job-review-buttons.test.tsx        |  2 +-
 .../review/study-results-redesign.test.tsx    |  2 +-
 .../review/study-results-redesign.tsx         |  7 +-
 .../[studyId]/review/study-results.test.tsx   |  2 +-
 .../study/[studyId]/review/study-results.tsx  |  2 +
 src/app/account/keys/generate-keys.test.tsx   |  1 -
 src/app/account/keys/generate-keys.tsx        |  2 -
 src/components/encrypted-files-panel.test.tsx | 66 +++++++++++++++----
 src/components/encrypted-files-panel.tsx      |  7 +-
 src/components/job-results.tsx                |  2 +-
 src/components/layout/navbar-profile-menu.tsx |  4 ++
 .../1780000000000_study_job_file_keys.ts      | 17 ++---
 src/database/types.ts                         |  4 +-
 src/hooks/use-decrypt-files.ts                |  6 +-
 src/hooks/use-encrypted-files-panel.ts        | 33 ++++++++--
 src/lib/types.ts                              |  2 +-
 src/server/actions/study-job.actions.test.ts  | 10 +--
 src/server/actions/study-job.actions.ts       |  8 +--
 src/server/actions/user-keys.actions.test.ts  |  8 +--
 src/server/actions/user-keys.actions.ts       | 15 ++++-
 src/server/db/queries.test.ts                 |  2 +-
 src/server/db/queries.ts                      |  8 ++-
 src/server/results-sharing.test.ts            |  6 +-
 src/server/results-sharing.ts                 |  4 +-
 src/server/storage.ts                         |  2 +
 25 files changed, 157 insertions(+), 65 deletions(-)

diff --git a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx
index 48cd31a22..618dd147c 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/job-review-buttons.test.tsx
@@ -120,7 +120,7 @@ describe('Study Results Approve/Reject buttons', async () => {
 
         // The re-wrapped researcher key was persisted against the real file row.
         const wrappedKeys = await db
-            .selectFrom('studyJobFileKey')
+            .selectFrom('studyJobFileRecipientKey')
             .select('fingerprint')
             .where('studyJobFileId', '=', row.id)
             .execute()
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
index bc5b9b7b0..a7f0f7154 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.test.tsx
@@ -126,7 +126,7 @@ describe('StudyResultsRedesign', () => {
                 fileType: 'ENCRYPTED-RESULT' as FileType,
                 name: 'test.data',
                 encryptedBody: await zip.arrayBuffer(),
-                researcherKeys: {} as Record<string, string>,
+                recipientKeys: {} as Record<string, string>,
             },
         ])
 
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.tsx
index f0c0397a4..f4883e1a5 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-results-redesign.tsx
@@ -58,7 +58,12 @@ export const StudyResultsRedesign: FC<{
                 </Group>
                 <Divider c="dimmed" />
                 <StatusCopy job={job} />
-                <EncryptedFilesPanel job={job} onFilesApproved={handleFilesApproved} hideTableUntilDecrypted />
+                <EncryptedFilesPanel
+                    isReviewer
+                    job={job}
+                    onFilesApproved={handleFilesApproved}
+                    hideTableUntilDecrypted
+                />
             </Stack>
         </Paper>
     )
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
index a1d20aaae..398a8aa01 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-results.test.tsx
@@ -49,7 +49,7 @@ async function seedEncryptedFile(
         fileType,
         name,
         encryptedBody: await zip.arrayBuffer(),
-        researcherKeys: {} as Record<string, string>,
+        recipientKeys: {} as Record<string, string>,
     }
 }
 
diff --git a/src/app/[orgSlug]/study/[studyId]/review/study-results.tsx b/src/app/[orgSlug]/study/[studyId]/review/study-results.tsx
index 163d15d7f..8a4771a2f 100644
--- a/src/app/[orgSlug]/study/[studyId]/review/study-results.tsx
+++ b/src/app/[orgSlug]/study/[studyId]/review/study-results.tsx
@@ -40,6 +40,7 @@ export const StudyResults: FC<{
                     <Divider c="dimmed" />
                     {job && (
                         <EncryptedFilesPanel
+                            isReviewer
                             job={job}
                             onFilesApproved={(files) => {
                                 setDecryptedResults(files)
@@ -65,6 +66,7 @@ export const StudyResults: FC<{
                 <Divider c="dimmed" />
                 <JobStatusHelpText job={job} hasEncryptedLogs={hasEncryptedLogs} />
                 <EncryptedFilesPanel
+                    isReviewer
                     job={job}
                     onFilesApproved={(files) => {
                         setDecryptedResults(files)
diff --git a/src/app/account/keys/generate-keys.test.tsx b/src/app/account/keys/generate-keys.test.tsx
index ccc73670d..139229a72 100644
--- a/src/app/account/keys/generate-keys.test.tsx
+++ b/src/app/account/keys/generate-keys.test.tsx
@@ -69,7 +69,6 @@ describe('Results Keypair generation', () => {
             expect(setUserPublicKeyAction).toHaveBeenCalledWith(
                 expect.objectContaining({
                     publicKey: mockKeys.exportedPublicKey,
-                    fingerprint: mockKeys.fingerprint,
                 }),
             )
         })
diff --git a/src/app/account/keys/generate-keys.tsx b/src/app/account/keys/generate-keys.tsx
index a75fa9153..626719fad 100644
--- a/src/app/account/keys/generate-keys.tsx
+++ b/src/app/account/keys/generate-keys.tsx
@@ -150,12 +150,10 @@ const ConfirmationModal: FC<{ onClose: () => void; isOpen: boolean; keys: Keys;
             if (isRegenerating) {
                 return updateUserPublicKeyAction({
                     publicKey: keys.binaryPublicKey,
-                    fingerprint: keys.fingerprint,
                 })
             } else {
                 return setUserPublicKeyAction({
                     publicKey: keys.binaryPublicKey,
-                    fingerprint: keys.fingerprint,
                 })
             }
         },
diff --git a/src/components/encrypted-files-panel.test.tsx b/src/components/encrypted-files-panel.test.tsx
index 064150188..7254e84d4 100644
--- a/src/components/encrypted-files-panel.test.tsx
+++ b/src/components/encrypted-files-panel.test.tsx
@@ -29,7 +29,7 @@ type MinimalJob = { id: string }
 
 // Encrypt one results artifact the way TOA would (prod whole-zip + embedded manifest), persist the
 // study_job_file row, and return the entry the fetchEncryptedJobFilesAction mock serves. The
-// reviewer is a manifest recipient, so researcherKeys is empty — they decrypt with their own key.
+// reviewer is a manifest recipient, so recipientKeys is empty — they decrypt with their own key.
 async function seedArtifact(
     job: MinimalJob,
     { fileType, subdir, files }: { fileType: FileType; subdir: string; files: { name: string; content: string }[] },
@@ -52,7 +52,7 @@ async function seedArtifact(
         fileType,
         name: 'encrypted-results.zip',
         encryptedBody: await zip.arrayBuffer(),
-        researcherKeys: {} as Record<string, string>,
+        recipientKeys: {} as Record<string, string>,
     }
 }
 
@@ -90,7 +90,9 @@ describe('EncryptedFilesPanel', () => {
     it('returns null when no encrypted files exist', async () => {
         const { latestJobWithStatus: job } = await insertTestStudyJobData({ org, jobStatus: 'RUN-COMPLETE' })
 
-        const { container } = renderWithProviders(<EncryptedFilesPanel job={job} onFilesApproved={vi.fn()} />)
+        const { container } = renderWithProviders(
+            <EncryptedFilesPanel isReviewer job={job} onFilesApproved={vi.fn()} />,
+        )
         expect(container.querySelector('form')).toBeNull()
         expect(screen.queryByText('Decrypt Files')).toBeNull()
     })
@@ -100,7 +102,7 @@ describe('EncryptedFilesPanel', () => {
         await insertEncryptedRow(job, { fileType: 'ENCRYPTED-RESULT', subdir: 'encrypted' })
 
         const latestJob = await latestJobForStudy(study.id)
-        renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
+        renderWithProviders(<EncryptedFilesPanel isReviewer job={latestJob} onFilesApproved={vi.fn()} />)
 
         expect(screen.getByText('Results')).toBeDefined()
         expect(screen.getByLabelText('Encrypted')).toBeDefined()
@@ -119,7 +121,7 @@ describe('EncryptedFilesPanel', () => {
         await insertEncryptedRow(job, { fileType: 'ENCRYPTED-SECURITY-SCAN-LOG', subdir: 'encrypted-logs' })
 
         const latestJob = await latestJobForStudy(study.id)
-        renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
+        renderWithProviders(<EncryptedFilesPanel isReviewer job={latestJob} onFilesApproved={vi.fn()} />)
 
         await waitFor(() => {
             expect(screen.getByText('Results')).toBeDefined()
@@ -138,7 +140,7 @@ describe('EncryptedFilesPanel', () => {
 
         const onFilesApproved = vi.fn()
         const latestJob = await latestJobForStudy(study.id)
-        renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={onFilesApproved} />)
+        renderWithProviders(<EncryptedFilesPanel isReviewer job={latestJob} onFilesApproved={onFilesApproved} />)
 
         await enterKeyAndDecrypt()
 
@@ -170,7 +172,7 @@ describe('EncryptedFilesPanel', () => {
 
         const onFilesApproved = vi.fn()
         const latestJob = await latestJobForStudy(study.id)
-        renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={onFilesApproved} />)
+        renderWithProviders(<EncryptedFilesPanel isReviewer job={latestJob} onFilesApproved={onFilesApproved} />)
 
         await enterKeyAndDecrypt()
 
@@ -207,7 +209,7 @@ describe('EncryptedFilesPanel', () => {
 
         const onFilesApproved = vi.fn()
         const latestJob = await latestJobForStudy(study.id)
-        renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={onFilesApproved} />)
+        renderWithProviders(<EncryptedFilesPanel isReviewer job={latestJob} onFilesApproved={onFilesApproved} />)
 
         await enterKeyAndDecrypt()
 
@@ -239,7 +241,7 @@ describe('EncryptedFilesPanel', () => {
         vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([artifact])
 
         const latestJob = await latestJobForStudy(study.id)
-        renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
+        renderWithProviders(<EncryptedFilesPanel isReviewer job={latestJob} onFilesApproved={vi.fn()} />)
 
         await enterKeyAndDecrypt()
 
@@ -265,7 +267,7 @@ describe('EncryptedFilesPanel', () => {
         vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([artifact])
 
         const latestJob = await latestJobForStudy(study.id)
-        renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
+        renderWithProviders(<EncryptedFilesPanel isReviewer job={latestJob} onFilesApproved={vi.fn()} />)
 
         await enterKeyAndDecrypt()
 
@@ -286,7 +288,7 @@ describe('EncryptedFilesPanel', () => {
         vi.mocked(fetchSharedFileIdsAction).mockResolvedValue([shared.id])
 
         const latestJob = await latestJobForStudy(study.id)
-        renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
+        renderWithProviders(<EncryptedFilesPanel isReviewer job={latestJob} onFilesApproved={vi.fn()} />)
 
         await waitFor(() => {
             expect(screen.getByText('Results')).toBeDefined()
@@ -299,10 +301,50 @@ describe('EncryptedFilesPanel', () => {
         await insertEncryptedRow(job, { fileType: 'ENCRYPTED-RESULT', subdir: 'encrypted' })
 
         const latestJob = await latestJobForStudy(study.id)
-        renderWithProviders(<EncryptedFilesPanel job={latestJob} onFilesApproved={vi.fn()} />)
+        renderWithProviders(<EncryptedFilesPanel isReviewer job={latestJob} onFilesApproved={vi.fn()} />)
 
         await waitFor(() => expect(screen.getByText('Results')).toBeDefined())
         expect(screen.queryByLabelText('Shared with researcher')).toBeNull()
         expect(screen.getByLabelText('Encrypted')).toBeDefined()
     })
+
+    // Researcher path: visibility and the decrypt form are gated on the user's own wrapped-key set
+    // (what fetchEncryptedJobFilesAction returns), not the job-wide artifact list.
+    it('renders nothing for a researcher with no wrapped keys, even when the job has artifacts', async () => {
+        const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'FILES-APPROVED' })
+        const shared = await insertEncryptedRow(job, { fileType: 'ENCRYPTED-RESULT', subdir: 'encrypted' })
+        // Job is approved/shared at the job level, but this researcher holds no key for it.
+        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([])
+        vi.mocked(fetchSharedFileIdsAction).mockResolvedValue([shared.id])
+
+        const latestJob = await latestJobForStudy(study.id)
+        const { container } = renderWithProviders(
+            <EncryptedFilesPanel isReviewer={false} job={latestJob} onFilesApproved={vi.fn()} />,
+        )
+
+        await waitFor(() => expect(vi.mocked(fetchEncryptedJobFilesAction)).toHaveBeenCalled())
+        // No form to nowhere, and no false green "shared" check on an artifact they can't decrypt.
+        expect(container.querySelector('form')).toBeNull()
+        expect(screen.queryByLabelText('Shared with researcher')).toBeNull()
+        expect(screen.queryByText('Results')).toBeNull()
+    })
+
+    it('shows the decrypt form (no shared check) for a researcher who holds a wrapped key', async () => {
+        const { study, job } = await insertTestStudyJobData({ org, jobStatus: 'FILES-APPROVED' })
+        const artifact = await seedArtifact(job, {
+            fileType: 'ENCRYPTED-RESULT',
+            subdir: 'encrypted',
+            files: [{ name: 'results.csv', content: 'name,age\nAlice,30' }],
+        })
+        vi.mocked(fetchEncryptedJobFilesAction).mockResolvedValue([artifact])
+        vi.mocked(fetchSharedFileIdsAction).mockResolvedValue([artifact.studyJobFileId])
+
+        const latestJob = await latestJobForStudy(study.id)
+        renderWithProviders(<EncryptedFilesPanel isReviewer={false} job={latestJob} onFilesApproved={vi.fn()} />)
+
+        await waitFor(() => expect(screen.getByText('Results')).toBeDefined())
+        // Green "shared with researcher" is a reviewer-facing signal — researchers never see it.
+        expect(screen.queryByLabelText('Shared with researcher')).toBeNull()
+        expect(screen.getByPlaceholderText(READER_KEY_PLACEHOLDER)).toBeDefined()
+    })
 })
diff --git a/src/components/encrypted-files-panel.tsx b/src/components/encrypted-files-panel.tsx
index 2e614c025..f95ae227d 100644
--- a/src/components/encrypted-files-panel.tsx
+++ b/src/components/encrypted-files-panel.tsx
@@ -14,12 +14,14 @@ type EncryptedFilesPanelProps = {
     job: LatestJobForStudy
     onFilesApproved: (files: JobFileInfo[]) => void
     hideTableUntilDecrypted?: boolean
+    isReviewer: boolean
 }
 
 export const EncryptedFilesPanel: FC<EncryptedFilesPanelProps> = ({
     job,
     onFilesApproved,
     hideTableUntilDecrypted = false,
+    isReviewer,
 }) => {
     const {
         fileRows,
@@ -32,8 +34,11 @@ export const EncryptedFilesPanel: FC<EncryptedFilesPanelProps> = ({
         viewingFile,
         openFileViewer,
         closeFileViewer,
-    } = useEncryptedFilesPanel({ job, onFilesApproved })
+    } = useEncryptedFilesPanel({ job, onFilesApproved, isReviewer })
 
+    // No decryptable rows for this user (a researcher with no wrapped keys yet — late joiner, or
+    // pre-renewal). Render nothing rather than a form to nowhere. Future: an honest "no results
+    // shared with you yet" empty state + the renewal re-wrap request affordance lives here.
     if (!hasFileRows) {
         return null
     }
diff --git a/src/components/job-results.tsx b/src/components/job-results.tsx
index e3b7257da..89198b76c 100644
--- a/src/components/job-results.tsx
+++ b/src/components/job-results.tsx
@@ -10,5 +10,5 @@ import type { LatestJobForStudy } from '@/server/db/queries'
 const noop = () => {}
 
 export const JobResults: FC<{ job: LatestJobForStudy }> = ({ job }) => {
-    return <EncryptedFilesPanel job={job} onFilesApproved={noop} />
+    return <EncryptedFilesPanel isReviewer={false} job={job} onFilesApproved={noop} />
 }
diff --git a/src/components/layout/navbar-profile-menu.tsx b/src/components/layout/navbar-profile-menu.tsx
index 22881ce67..0310fe794 100644
--- a/src/components/layout/navbar-profile-menu.tsx
+++ b/src/components/layout/navbar-profile-menu.tsx
@@ -88,6 +88,10 @@ export function NavbarProfileMenu() {
                 component="button"
             />
 
+            {/* Reviewer-only on purpose: this is the self-rotate entry, and rotating orphans a
+                researcher's access to already-approved results with no recovery until the renewal
+                re-wrap flow ships. Researchers still reach first-time key generation via the
+                RequireUserKey redirect. Widen to researchers once renewal exists. */}
             <Protect role={AuthRole.Reviewer}>
                 <NavLink
                     label="Results Key"
diff --git a/src/database/migrations/1780000000000_study_job_file_keys.ts b/src/database/migrations/1780000000000_study_job_file_keys.ts
index 768d1f1c9..80477a8bf 100644
--- a/src/database/migrations/1780000000000_study_job_file_keys.ts
+++ b/src/database/migrations/1780000000000_study_job_file_keys.ts
@@ -1,13 +1,14 @@
 import { type Kysely, sql } from 'kysely'
 
 export async function up(db: Kysely<unknown>): Promise<void> {
-    // Per-recipient wrapped AES key granting a lab researcher access to one inner file of an
-    // approved results archive. The artifact stays a single whole-zip `study_job_file` row (prod
-    // format, unchanged); these rows ADD researcher recipients without re-encrypting.
-    // `study_job_file_id` points at the whole-zip row, `file_path` is the inner file. Approval
-    // itself is the job-level FILES-APPROVED status; these rows are the access mechanism.
+    // A per-recipient wrapped AES key granting one recipient access to one inner file of an approved
+    // results archive. Named by *timing*, not role: the zip manifest holds recipients present when
+    // the job ran in the enclave (reviewers); these rows hold everyone granted access AFTER run time
+    // (researchers today, renewals/new-hires later) without re-encrypting the immutable artifact.
+    // `study_job_file_id` points at the whole-zip `study_job_file` row, `file_path` is the inner
+    // file. Approval itself is the job-level FILES-APPROVED status; these rows are the access mechanism.
     await db.schema
-        .createTable('study_job_file_key')
+        .createTable('study_job_file_recipient_key')
         .addColumn('id', 'uuid', (col) => col.defaultTo(sql`v7uuid()`).primaryKey())
         .addColumn('study_job_file_id', 'uuid', (col) =>
             col.notNull().references('study_job_file.id').onDelete('cascade'),
@@ -16,7 +17,7 @@ export async function up(db: Kysely<unknown>): Promise<void> {
         .addColumn('fingerprint', 'text', (col) => col.notNull())
         .addColumn('crypt', 'text', (col) => col.notNull())
         .addColumn('created_at', 'timestamptz', (col) => col.defaultTo(sql`now()`).notNull())
-        .addUniqueConstraint('study_job_file_key_file_path_fingerprint_unique', [
+        .addUniqueConstraint('study_job_file_recipient_key_file_path_fingerprint_unique', [
             'study_job_file_id',
             'file_path',
             'fingerprint',
@@ -25,5 +26,5 @@ export async function up(db: Kysely<unknown>): Promise<void> {
 }
 
 export async function down(db: Kysely<unknown>): Promise<void> {
-    await db.schema.dropTable('study_job_file_key').execute()
+    await db.schema.dropTable('study_job_file_recipient_key').execute()
 }
diff --git a/src/database/types.ts b/src/database/types.ts
index 76427bd17..1a91893fb 100644
--- a/src/database/types.ts
+++ b/src/database/types.ts
@@ -264,7 +264,7 @@ export interface StudyJobFile {
     studyJobId: string
 }
 
-export interface StudyJobFileKey {
+export interface StudyJobFileRecipientKey {
     createdAt: Generated<Timestamp>
     crypt: string
     filePath: string
@@ -349,7 +349,7 @@ export interface DB {
     study: Study
     studyJob: StudyJob
     studyJobFile: StudyJobFile
-    studyJobFileKey: StudyJobFileKey
+    studyJobFileRecipientKey: StudyJobFileRecipientKey
     studyProposalComment: StudyProposalComment
     studyReview: StudyReview
     studyReviewComment: StudyReviewComment
diff --git a/src/hooks/use-decrypt-files.ts b/src/hooks/use-decrypt-files.ts
index 2f43b9b33..3376216a1 100644
--- a/src/hooks/use-decrypt-files.ts
+++ b/src/hooks/use-decrypt-files.ts
@@ -8,7 +8,7 @@ import { fingerprintPublicKeyFromPrivateKey, pemToArrayBuffer, privateKeyFromBuf
 import type { FileType } from '@/database/types'
 
 // One encrypted artifact from fetchEncryptedJobFilesAction: whole-zip ciphertext (embedded
-// manifest). `researcherKeys` (inner path -> wrapped AES key) is set only for lab researchers, who
+// manifest). `recipientKeys` (inner path -> wrapped AES key) is set only for lab researchers, who
 // aren't manifest recipients; ResultsReader merges them into the manifest under their fingerprint.
 // Empty for enclave reviewers, who decrypt with their own key.
 export type EncryptedJobFile = {
@@ -16,7 +16,7 @@ export type EncryptedJobFile = {
     fileType: FileType
     name: string
     encryptedBody: ArrayBuffer
-    researcherKeys: Record<string, string>
+    recipientKeys: Record<string, string>
 }
 
 class KeyParseError extends Error {}
@@ -39,7 +39,7 @@ async function decryptFiles(encryptedFiles: EncryptedJobFile[], privateKey: stri
                 new Blob([artifact.encryptedBody]),
                 privateKeyBuffer,
                 fingerprint,
-                artifact.researcherKeys,
+                artifact.recipientKeys,
             )
             // Capture each inner file's raw AES key so approval can re-wrap it per researcher.
             const entries = await reader.extractFilesWithKeys()
diff --git a/src/hooks/use-encrypted-files-panel.ts b/src/hooks/use-encrypted-files-panel.ts
index f75966d4f..2a33edeba 100644
--- a/src/hooks/use-encrypted-files-panel.ts
+++ b/src/hooks/use-encrypted-files-panel.ts
@@ -12,6 +12,10 @@ import type { FileType } from '@/database/types'
 type Options = {
     job: LatestJobForStudy
     onFilesApproved: (files: JobFileInfo[]) => void
+    // Reviewers are manifest recipients and see every artifact (and a job-wide "shared with lab"
+    // indicator). Researchers see only artifacts they hold a wrapped key for, so row visibility and
+    // state are driven off their own decryptable set, not the job-wide one.
+    isReviewer: boolean
 }
 
 export type FileRowState = 'locked' | 'decrypted' | 'approved'
@@ -30,7 +34,7 @@ function isEncryptedFile(fileType: FileType): boolean {
     return isEncryptedLogType(fileType) || fileType === 'ENCRYPTED-RESULT'
 }
 
-export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
+export function useEncryptedFilesPanel({ job, onFilesApproved, isReviewer }: Options) {
     const [decryptedFiles, setDecryptedFiles] = useState<JobFileInfo[]>([])
     const [viewingFile, setViewingFile] = useState<JobFile | null>(null)
 
@@ -73,13 +77,28 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
 
     const encryptedRows = useMemo(() => (job.files ?? []).filter((f) => isEncryptedFile(f.fileType)), [job.files])
 
-    const shouldShowForm = encryptedRows.length > 0 && decryptedFiles.length === 0
+    // A researcher's accessible set = artifacts they hold a wrapped key for (what the action
+    // returns). Reviewers can decrypt every artifact, so theirs is all encrypted rows.
+    const accessibleIdSet = useMemo(
+        () => new Set((encryptedFiles ?? []).map((f) => f.studyJobFileId)),
+        [encryptedFiles],
+    )
+    const visibleRows = useMemo(
+        () => (isReviewer ? encryptedRows : encryptedRows.filter((f) => accessibleIdSet.has(f.id))),
+        [isReviewer, encryptedRows, accessibleIdSet],
+    )
+
+    // Gate the decrypt form on what THIS user can actually decrypt: a researcher with no wrapped
+    // keys (e.g. late joiner, pre-renewal) has nothing to decrypt, so don't show a form to nowhere.
+    const accessibleCount = isReviewer ? encryptedRows.length : (encryptedFiles?.length ?? 0)
+    const shouldShowForm = accessibleCount > 0 && decryptedFiles.length === 0
 
     const sharedIdSet = useMemo(() => new Set(sharedFileIds), [sharedFileIds])
 
     // Before decryption: one locked row per encrypted artifact (size unknown until decrypted).
     // After: one row per inner file, all sharing the artifact's row id (sourceId) that "shared" is
-    // keyed on.
+    // keyed on. The green "shared" state is a reviewer-facing signal (job-wide sharedFileIds = "I've
+    // shared this with the lab"); a researcher only ever sees rows they can already decrypt.
     const fileRows: UnifiedFileRow[] = useMemo(() => {
         if (decryptedFiles.length > 0) {
             return decryptedFiles.map((f) => ({
@@ -88,20 +107,20 @@ export function useEncryptedFilesPanel({ job, onFilesApproved }: Options) {
                 name: f.path,
                 bytes: f.contents.byteLength,
                 fileType: f.fileType,
-                state: sharedIdSet.has(f.sourceId) ? 'approved' : 'decrypted',
+                state: isReviewer && sharedIdSet.has(f.sourceId) ? 'approved' : 'decrypted',
                 file: f,
             }))
         }
-        return encryptedRows.map((f) => ({
+        return visibleRows.map((f) => ({
             key: `${f.fileType}-${f.id}`,
             label: logLabel(f.fileType),
             name: f.name,
             bytes: null,
             fileType: f.fileType,
-            state: sharedIdSet.has(f.id) ? 'approved' : 'locked',
+            state: isReviewer && sharedIdSet.has(f.id) ? 'approved' : 'locked',
             file: null,
         }))
-    }, [encryptedRows, decryptedFiles, sharedIdSet])
+    }, [visibleRows, decryptedFiles, sharedIdSet, isReviewer])
 
     const hasFileRows = fileRows.length > 0
 
diff --git a/src/lib/types.ts b/src/lib/types.ts
index 7d3dba094..3282a9811 100644
--- a/src/lib/types.ts
+++ b/src/lib/types.ts
@@ -208,7 +208,7 @@ const FILE_TYPES = [
 
 export const fileTypeSchema = z.enum(FILE_TYPES)
 
-// A re-wrapped AES key for one researcher recipient of one approved file (a `study_job_file_key`
+// A re-wrapped AES key for one researcher recipient of one approved file (a `study_job_file_recipient_key`
 // row; see src/server/results-sharing.ts for the model).
 export const sharedFileKeySchema = z.object({ fingerprint: z.string(), crypt: z.string() })
 export const sharedFileSchema = z.object({
diff --git a/src/server/actions/study-job.actions.test.ts b/src/server/actions/study-job.actions.test.ts
index fa4b02c50..34c1e8827 100644
--- a/src/server/actions/study-job.actions.test.ts
+++ b/src/server/actions/study-job.actions.test.ts
@@ -35,7 +35,7 @@ describe('Study Job Actions', () => {
 
     test('fetchEncryptedJobFilesAction returns the whole-zip artifacts to an enclave reviewer', async () => {
         // Enclave reviewers are manifest recipients, so they get every artifact with no
-        // researcherKeys — they decrypt with their own key.
+        // recipientKeys — they decrypt with their own key.
         const { org } = await mockSessionWithTestData({ orgType: 'enclave' })
         const { job } = await insertTestStudyJobData({ org })
 
@@ -55,7 +55,7 @@ describe('Study Job Actions', () => {
         expect(result).toHaveLength(1)
         expect(result[0].fileType).toBe('ENCRYPTED-CODE-RUN-LOG')
         expect(result[0].studyJobFileId).toBe(file.id)
-        expect(result[0].researcherKeys).toEqual({})
+        expect(result[0].recipientKeys).toEqual({})
     })
 
     // Regression: the middleware must expose submittedByOrgId so the CASL 'view StudyJob' rule
@@ -83,7 +83,7 @@ describe('Study Job Actions', () => {
             .executeTakeFirstOrThrow()
 
         await db
-            .insertInto('studyJobFileKey')
+            .insertInto('studyJobFileRecipientKey')
             .values({
                 studyJobFileId: file.id,
                 filePath: 'results.csv',
@@ -95,7 +95,7 @@ describe('Study Job Actions', () => {
         const result = actionResult(await fetchEncryptedJobFilesAction({ jobId: job.id }))
 
         expect(result).toHaveLength(1)
-        expect(result[0].researcherKeys).toEqual({ 'results.csv': 'wrapped-for-researcher' })
+        expect(result[0].recipientKeys).toEqual({ 'results.csv': 'wrapped-for-researcher' })
     })
 
     test('fetchEncryptedJobFilesAction returns nothing to a researcher with no shared keys', async () => {
@@ -117,7 +117,7 @@ describe('Study Job Actions', () => {
             })
             .executeTakeFirstOrThrow()
 
-        // No study_job_file_key row for this researcher → nothing they can decrypt.
+        // No study_job_file_recipient_key row for this researcher → nothing they can decrypt.
         const result = actionResult(await fetchEncryptedJobFilesAction({ jobId: job.id }))
         expect(result).toHaveLength(0)
     })
diff --git a/src/server/actions/study-job.actions.ts b/src/server/actions/study-job.actions.ts
index 62e5944ca..827dafa7b 100644
--- a/src/server/actions/study-job.actions.ts
+++ b/src/server/actions/study-job.actions.ts
@@ -192,7 +192,7 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
         if (!encryptedFiles.length) return []
 
         // Enclave reviewers are manifest recipients and decrypt with their own key; lab researchers
-        // aren't, so they get per-file re-wrapped keys (study_job_file_key) as `researcherKeys`. A
+        // aren't, so they get per-file re-wrapped keys (study_job_file_recipient_key) as `recipientKeys`. A
         // reviewer is a member of the study's enclave org; everyone else takes the researcher path.
         const isEnclaveReviewer = Object.values(session.orgs).some(
             (org) => org.id === studyJob.orgId && org.type === 'enclave',
@@ -208,7 +208,7 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
                     fileType: file.fileType,
                     name: file.name,
                     encryptedBody: await (await fetchFileContents(file.path)).arrayBuffer(),
-                    researcherKeys: {} as Record<string, string>,
+                    recipientKeys: {} as Record<string, string>,
                 })),
             )
         }
@@ -216,7 +216,7 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
         // Researcher: only artifacts this user has wrapped keys for (exist only post-approval, so
         // naturally gated). Build the {file_path -> crypt} map per artifact.
         const wrappedKeys = await db
-            .selectFrom('studyJobFileKey')
+            .selectFrom('studyJobFileRecipientKey')
             .select(['studyJobFileId', 'filePath', 'crypt'])
             .where(
                 'studyJobFileId',
@@ -242,7 +242,7 @@ export const fetchEncryptedJobFilesAction = new Action('fetchEncryptedJobFilesAc
                     fileType: file.fileType,
                     name: file.name,
                     encryptedBody: await (await fetchFileContents(file.path)).arrayBuffer(),
-                    researcherKeys: keysByFileId.get(file.id)!,
+                    recipientKeys: keysByFileId.get(file.id)!,
                 })),
         )
     })
diff --git a/src/server/actions/user-keys.actions.test.ts b/src/server/actions/user-keys.actions.test.ts
index 80d82f2e1..3ccafb2b6 100644
--- a/src/server/actions/user-keys.actions.test.ts
+++ b/src/server/actions/user-keys.actions.test.ts
@@ -46,8 +46,10 @@ describe('User Keys Actions', () => {
         await db.deleteFrom('userPublicKey').where('userId', '=', user.id).execute()
         const { publicKey, fingerprint } = await validTestKey()
 
-        await setUserPublicKeyAction({ publicKey, fingerprint })
+        await setUserPublicKeyAction({ publicKey })
 
+        // Fingerprint is derived server-side from publicKey, not taken from the client. It must match
+        // an independent derivation of the same key.
         const newKeyResult = actionResult(await getUserPublicKeyAction())
         expect(newKeyResult).toBeDefined()
         expect(newKeyResult?.fingerprint).toEqual(fingerprint)
@@ -59,7 +61,6 @@ describe('User Keys Actions', () => {
 
         const result = await setUserPublicKeyAction({
             publicKey: Buffer.from('not-a-real-key').buffer,
-            fingerprint: 'garbage-fingerprint',
         })
 
         expect(isActionError(result)).toBe(true)
@@ -79,7 +80,7 @@ describe('User Keys Actions', () => {
 
         const { publicKey, fingerprint } = await validTestKey()
 
-        await updateUserPublicKeyAction({ publicKey, fingerprint })
+        await updateUserPublicKeyAction({ publicKey })
 
         const updatedKeyResult = actionResult(await getUserPublicKeyAction())
         expect(updatedKeyResult).toBeDefined()
@@ -96,7 +97,6 @@ describe('User Keys Actions', () => {
 
         const result = await updateUserPublicKeyAction({
             publicKey: Buffer.from('still-not-a-key').buffer,
-            fingerprint: 'garbage-fingerprint',
         })
 
         expect(isActionError(result)).toBe(true)
diff --git a/src/server/actions/user-keys.actions.ts b/src/server/actions/user-keys.actions.ts
index b6126d89e..643ebb73c 100644
--- a/src/server/actions/user-keys.actions.ts
+++ b/src/server/actions/user-keys.actions.ts
@@ -4,6 +4,7 @@ import { getUserPublicKey } from '@/server/db/queries'
 import { onUserPublicKeyCreated, onUserPublicKeyUpdated } from '@/server/events'
 import { revalidatePath } from 'next/cache'
 import { Routes } from '@/lib/routes'
+import { fingerprintKeyData } from 'si-encryption/util'
 import { Action, ActionFailure, z } from './action'
 
 // Pages that render the user's key state — bust both after a key write so presence/fingerprint
@@ -28,9 +29,11 @@ export const userKeyExistsAction = new Action('userKeyExistsAction')
         return Boolean(key)
     })
 
+// No `fingerprint` field: it's derived server-side from `publicKey` (deterministic SHA-256 over the
+// SPKI bytes). A client-supplied fingerprint that didn't match would make every sender wrap to a
+// key the owner can't unwrap — silent, permanent decrypt failure with no recourse until renewal.
 const setOrgUserPublicKeySchema = z.object({
     publicKey: z.instanceof(ArrayBuffer),
-    fingerprint: z.string(),
 })
 
 // Reject keys that aren't importable RSA SPKI DER. A single malformed key in an org breaks
@@ -48,10 +51,11 @@ async function assertValidPublicKey(publicKey: ArrayBuffer): Promise<void> {
 export const setUserPublicKeyAction = new Action('setUserPublicKeyAction')
     .params(setOrgUserPublicKeySchema)
     .requireAbilityTo('update', 'UserKey')
-    .handler(async ({ params: { publicKey, fingerprint }, session, db }) => {
+    .handler(async ({ params: { publicKey }, session, db }) => {
         const userId = session.user.id
 
         await assertValidPublicKey(publicKey)
+        const fingerprint = await fingerprintKeyData(publicKey)
 
         await db
             .insertInto('userPublicKey')
@@ -69,11 +73,16 @@ export const setUserPublicKeyAction = new Action('setUserPublicKeyAction')
 export const updateUserPublicKeyAction = new Action('updateUserPublicKeyAction')
     .params(setOrgUserPublicKeySchema)
     .requireAbilityTo('update', 'UserKey')
-    .handler(async ({ params: { publicKey, fingerprint }, session, db }) => {
+    .handler(async ({ params: { publicKey }, session, db }) => {
         const userId = session.user.id
 
         await assertValidPublicKey(publicKey)
+        const fingerprint = await fingerprintKeyData(publicKey)
 
+        // Rotation swaps the fingerprint, orphaning study_job_file_recipient_key rows wrapped to the
+        // old one — the researcher loses access to already-approved results. Recovery is the renewal
+        // re-wrap flow (a teammate re-wraps for the new key); until that ships, self-rotate is not
+        // surfaced to researchers. See renewal follow-up.
         await db
             .updateTable('userPublicKey')
             .set({
diff --git a/src/server/db/queries.test.ts b/src/server/db/queries.test.ts
index fae1d5f8a..848b31b94 100644
--- a/src/server/db/queries.test.ts
+++ b/src/server/db/queries.test.ts
@@ -282,7 +282,7 @@ describe('getSharedFileIdsForJob', () => {
     // so tests grant access by inserting these rows rather than flipping a status.
     const shareFile = (studyJobFileId: string, filePath: string, fingerprint: string) =>
         db
-            .insertInto('studyJobFileKey')
+            .insertInto('studyJobFileRecipientKey')
             .values({ studyJobFileId, filePath, fingerprint, crypt: 'wrapped-key' })
             .execute()
 
diff --git a/src/server/db/queries.ts b/src/server/db/queries.ts
index c7266b0ed..0885ce626 100644
--- a/src/server/db/queries.ts
+++ b/src/server/db/queries.ts
@@ -64,6 +64,8 @@ export async function getStudyJobInfo(studyJobId: string) {
 }
 
 export const getUserPublicKey = async (userId: string) => {
+    // executeTakeFirst is deterministic here: user_public_key has a unique constraint on user_id
+    // (migration 1742320602314), so there's at most one row per user. Rotation updates it in place.
     const result = await Action.db
         .selectFrom('userPublicKey')
         .select(['userPublicKey.fingerprint', 'userPublicKey.publicKey'])
@@ -478,10 +480,10 @@ export async function getLabPublicKeysForStudy(studyId: string): Promise<PublicK
 // their key rows, so this never retroactively un-shares.
 export async function getSharedFileIdsForJob(jobId: string): Promise<string[]> {
     const rows = await Action.db
-        .selectFrom('studyJobFileKey')
-        .innerJoin('studyJobFile', 'studyJobFile.id', 'studyJobFileKey.studyJobFileId')
+        .selectFrom('studyJobFileRecipientKey')
+        .innerJoin('studyJobFile', 'studyJobFile.id', 'studyJobFileRecipientKey.studyJobFileId')
         .where('studyJobFile.studyJobId', '=', jobId)
-        .select('studyJobFileKey.studyJobFileId')
+        .select('studyJobFileRecipientKey.studyJobFileId')
         .distinct()
         .execute()
 
diff --git a/src/server/results-sharing.test.ts b/src/server/results-sharing.test.ts
index 6b89399ec..c4ab549f9 100644
--- a/src/server/results-sharing.test.ts
+++ b/src/server/results-sharing.test.ts
@@ -28,7 +28,11 @@ async function insertSharedFileScenario() {
 }
 
 const selectKeyRows = (fileId: string) =>
-    db.selectFrom('studyJobFileKey').select(['fingerprint', 'crypt']).where('studyJobFileId', '=', fileId).execute()
+    db
+        .selectFrom('studyJobFileRecipientKey')
+        .select(['fingerprint', 'crypt'])
+        .where('studyJobFileId', '=', fileId)
+        .execute()
 
 // Approval is recorded by the caller as a job-level FILES-APPROVED status change, not here.
 // These tests cover only the access mechanism: persisting validated wrapped-key rows.
diff --git a/src/server/results-sharing.ts b/src/server/results-sharing.ts
index fea0a64f7..2a647b249 100644
--- a/src/server/results-sharing.ts
+++ b/src/server/results-sharing.ts
@@ -5,7 +5,7 @@ import { getLabPublicKeysForJob } from '@/server/db/queries'
 
 /**
  * Persist re-wrapped AES keys granting lab researchers access to a job's files. Each
- * `study_job_file_key` row holds a file's AES key wrapped to a recipient's public key. Validated
+ * `study_job_file_recipient_key` row holds a file's AES key wrapped to a recipient's public key. Validated
  * against the lab org's known keys so a client can't share to an arbitrary fingerprint. Idempotent
  * via the (study_job_file_id, file_path, fingerprint) unique constraint; ciphertext untouched.
  *
@@ -45,7 +45,7 @@ export async function insertSharedFileKeys(db: DBExecutor, jobId: string, shared
     if (!rows.length) return
 
     await db
-        .insertInto('studyJobFileKey')
+        .insertInto('studyJobFileRecipientKey')
         .values(rows)
         .onConflict((oc) => oc.columns(['studyJobFileId', 'filePath', 'fingerprint']).doNothing())
         .execute()
diff --git a/src/server/storage.ts b/src/server/storage.ts
index 51da4c17e..769a0c86d 100644
--- a/src/server/storage.ts
+++ b/src/server/storage.ts
@@ -26,6 +26,8 @@ export async function urlForStudyDocumentFile(info: MinimalStudyInfo, fileType:
 }
 
 async function storeJobFile(info: MinimalJobInfo, path: string, file: File, fileType: FileType, sourceId?: string) {
+    // If the insert below fails (or the process dies between these two writes), the S3 object is
+    // orphaned with no row pointing at it. Left to an S3 lifecycle/sweeper rather than a 2-phase commit.
     await storeS3File(info, file.stream(), path)
 
     return await db

From 530882b4c262db942922161673a8acd0e9b31178 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Thu, 18 Jun 2026 10:22:20 -0400
Subject: [PATCH 39/45] Add followup comment for future work

---
 src/server/results-sharing.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/server/results-sharing.ts b/src/server/results-sharing.ts
index 2a647b249..3b67b0768 100644
--- a/src/server/results-sharing.ts
+++ b/src/server/results-sharing.ts
@@ -10,6 +10,13 @@ import { getLabPublicKeysForJob } from '@/server/db/queries'
  * via the (study_job_file_id, file_path, fingerprint) unique constraint; ciphertext untouched.
  *
  * Revocation is prospective only: a researcher who already unwrapped a key keeps it.
+ *
+ * FOLLOW-UP (renewal re-wrap): today these rows are only written when a reviewer approves results,
+ * so a recipient added/changed afterward has no access. The committed direction is a "renew
+ * encryption" flow — any current recipient decrypts the artifact, re-wraps each file's AES key for
+ * the up-to-date recipient set, and writes new rows here — to cover key rotation (fingerprint
+ * changes, orphaning old rows), lost/compromised keys, new hires, and departed members without
+ * re-running the job. This insert path is the mechanism that flow will reuse/extend.
  */
 export async function insertSharedFileKeys(db: DBExecutor, jobId: string, sharedFiles: SharedFile[]): Promise<void> {
     const labKeys = await getLabPublicKeysForJob(jobId)

From e321501ab18e3d05c47d24b9249bd86df7ec02d3 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Thu, 18 Jun 2026 13:52:15 -0400
Subject: [PATCH 40/45] Fix CI

---
 src/database/resilient-pool.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/database/resilient-pool.ts b/src/database/resilient-pool.ts
index 92bddfe5b..3baa300aa 100644
--- a/src/database/resilient-pool.ts
+++ b/src/database/resilient-pool.ts
@@ -1,5 +1,5 @@
 import PG from 'pg'
-import { databaseURL, DEPLOYED_ENV } from '@/server/config'
+import { databaseURL, DEPLOYED_ENV } from '../server/config'
 
 // Postgres SQLSTATE for "password authentication failed". A connection that
 // fails with this code is the signal that the cached DB password may be stale.

From 76a8d9d2cb168d5626d77020050e2ef78e233955 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Thu, 18 Jun 2026 14:09:44 -0400
Subject: [PATCH 41/45] Fix?

---
 services/editor/db-credentials.ts | 10 +++++-----
 services/editor/db-pool.ts        | 12 +++++++-----
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/services/editor/db-credentials.ts b/services/editor/db-credentials.ts
index 78f82282c..5e465da36 100644
--- a/services/editor/db-credentials.ts
+++ b/services/editor/db-credentials.ts
@@ -61,13 +61,13 @@ export function isInvalidPasswordError(err: unknown): boolean {
 // Secrets Manager when a connection rejects the cached password.
 export class DbCredentials {
     private secret: ResolvedDbSecret
+    private readonly arn: string
+    private readonly client: SecretFetcher
 
-    private constructor(
-        secret: ResolvedDbSecret,
-        private readonly arn: string,
-        private readonly client: SecretFetcher,
-    ) {
+    private constructor(secret: ResolvedDbSecret, arn: string, client: SecretFetcher) {
         this.secret = secret
+        this.arn = arn
+        this.client = client
     }
 
     static async resolve(arn: string, client: SecretFetcher): Promise<DbCredentials> {
diff --git a/services/editor/db-pool.ts b/services/editor/db-pool.ts
index bedc794dc..297c89597 100644
--- a/services/editor/db-pool.ts
+++ b/services/editor/db-pool.ts
@@ -23,12 +23,14 @@ const defaultPoolFactory: PoolFactory = (settings) => new pg.Pool(settings)
 
 export class ResilientDbPool {
     private pool: pg.Pool
+    private readonly source: DbSource
+    private readonly log: Logger
+    private readonly makePool: PoolFactory
 
-    constructor(
-        private readonly source: DbSource,
-        private readonly log: Logger,
-        private readonly makePool: PoolFactory = defaultPoolFactory,
-    ) {
+    constructor(source: DbSource, log: Logger, makePool: PoolFactory = defaultPoolFactory) {
+        this.source = source
+        this.log = log
+        this.makePool = makePool
         this.pool = this.build()
     }
 

From ac41221f1e8447fdb726635a14400e34b8c8a3d1 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Mon, 22 Jun 2026 12:13:56 -0400
Subject: [PATCH 42/45] Fix local docker dev

---
 Dockerfile.dev     | 4 ++++
 docker-compose.yml | 5 ++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/Dockerfile.dev b/Dockerfile.dev
index 06e2f00d3..7e92fb163 100644
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@@ -14,6 +14,10 @@ RUN pnpm install --frozen-lockfile
 # Uncomment the following line to disable telemetry at run time
 ENV NEXT_TELEMETRY_DISABLED=1
 
+# Pre-create .next so the anonymous volume masking it (see docker-compose.yml)
+# initializes owned by node, not root — otherwise next dev hits EACCES on mkdir.
+RUN mkdir -p /app/.next
+
 # do not run as root user
 RUN chown -R node:node /app
 USER node
diff --git a/docker-compose.yml b/docker-compose.yml
index 321f25c23..9f1d11176 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -127,7 +127,10 @@ services:
         volumes:
             - ./:/app/
             - node_modules:/app/node_modules
-        restart: unless-stopped
+            # Mask the host's .next so the container owns its own Turbopack cache.
+            # Sharing it over the ./ bind mount poisons the cache across host/container.
+            - /app/.next
+        restart: 'no'
         networks:
             - mgmnt-app
         ports:

From b1db32931cf916d9ab9bc7001b6d338d5c82eb74 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Thu, 25 Jun 2026 13:00:13 -0400
Subject: [PATCH 43/45] Test

---
 tests/study-flow.spec.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/study-flow.spec.ts b/tests/study-flow.spec.ts
index bce9d24d9..746ce3d33 100644
--- a/tests/study-flow.spec.ts
+++ b/tests/study-flow.spec.ts
@@ -423,7 +423,7 @@ async function reviewerApprovesResults(page: Page, studyTitle: string): Promise<
 
     // Decrypt the encrypted result with the reviewer test key.
     const privateKey = await readTestSupportFile('private_key.pem')
-    const privateKeyTextarea = page.getByPlaceholder('Enter your Reviewer key to access encrypted content.')
+    const privateKeyTextarea = page.getByPlaceholder('Enter your Results Key to access encrypted content.')
     await expect(privateKeyTextarea).toBeVisible()
     await privateKeyTextarea.fill(privateKey)
 

From c7d3587b7a7f4add72839202d2fdb2466ceb933f Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Thu, 25 Jun 2026 13:33:30 -0400
Subject: [PATCH 44/45] Fix tests

---
 ...udy_job_file_keys.ts => 1780100000000_study_job_file_keys.ts} | 0
 src/server/actions/study-job.actions.test.ts                     | 1 +
 2 files changed, 1 insertion(+)
 rename src/database/migrations/{1780000000000_study_job_file_keys.ts => 1780100000000_study_job_file_keys.ts} (100%)

diff --git a/src/database/migrations/1780000000000_study_job_file_keys.ts b/src/database/migrations/1780100000000_study_job_file_keys.ts
similarity index 100%
rename from src/database/migrations/1780000000000_study_job_file_keys.ts
rename to src/database/migrations/1780100000000_study_job_file_keys.ts
diff --git a/src/server/actions/study-job.actions.test.ts b/src/server/actions/study-job.actions.test.ts
index 39f8cc38a..166d65d7d 100644
--- a/src/server/actions/study-job.actions.test.ts
+++ b/src/server/actions/study-job.actions.test.ts
@@ -17,6 +17,7 @@ vi.mock('@/server/storage', () => ({
 
 vi.mock('@/server/mailer', () => ({
     sendStudyResultsRejectedEmail: vi.fn(),
+    sendStudyResultsApprovedEmail: vi.fn(),
 }))
 
 // Spy on the generation trigger so the retry test asserts re-fire without

From e75cb76d3e2bc8f5ad4718a049777d0a4be37019 Mon Sep 17 00:00:00 2001
From: Chris Bendel <chrissbendel@gmail.com>
Date: Thu, 25 Jun 2026 14:54:21 -0400
Subject: [PATCH 45/45] Pin to new encryption version

---
 package.json   |  2 +-
 pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/package.json b/package.json
index c070980b1..9cceff708 100644
--- a/package.json
+++ b/package.json
@@ -113,7 +113,7 @@
         "react-phone-number-input": "^3.4.16",
         "remeda": "^2.33.6",
         "server-only": "^0.0.1",
-        "si-encryption": "github:safeinsights/encryption#4f31a899ba1e0ade8ebbbbb59609a7529343c2d4",
+        "si-encryption": "github:safeinsights/encryption#3cb802df301d02813f8f67261c34144686b8540a",
         "uuid": "^14.0.0",
         "validator": "^13.15.26",
         "yjs": "^13.6.30",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index dbd0449a6..3cfb65b81 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -224,8 +224,8 @@ importers:
         specifier: ^0.0.1
         version: 0.0.1
       si-encryption:
-        specifier: github:safeinsights/encryption#4f31a899ba1e0ade8ebbbbb59609a7529343c2d4
-        version: https://codeload.github.com/safeinsights/encryption/tar.gz/4f31a899ba1e0ade8ebbbbb59609a7529343c2d4
+        specifier: github:safeinsights/encryption#3cb802df301d02813f8f67261c34144686b8540a
+        version: https://codeload.github.com/safeinsights/encryption/tar.gz/3cb802df301d02813f8f67261c34144686b8540a
       uuid:
         specifier: ^14.0.0
         version: 14.0.0
@@ -6125,8 +6125,8 @@ packages:
     resolution: {integrity: sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==}
     engines: {node: '>= 0.4'}
 
-  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/4f31a899ba1e0ade8ebbbbb59609a7529343c2d4:
-    resolution: {gitHosted: true, integrity: sha512-bgYckt75tdXXVVyZweDrBdYJghbJyP4bBeF/0x9LnkFPhVt1AfN3p8OndWrJhFVfWs9PbAONUNt4ojRGgnMR9w==, tarball: https://codeload.github.com/safeinsights/encryption/tar.gz/4f31a899ba1e0ade8ebbbbb59609a7529343c2d4}
+  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/3cb802df301d02813f8f67261c34144686b8540a:
+    resolution: {gitHosted: true, integrity: sha512-0X/z+VaQP+vehyGBrrHUJHVFyjJO2687t3gKHnMZUqzLMBfUykpSRjVZ7CGoFGwtKcm270hhQ8gQyW6ABtMOsw==, tarball: https://codeload.github.com/safeinsights/encryption/tar.gz/3cb802df301d02813f8f67261c34144686b8540a}
     version: 0.0.1
 
   side-channel-list@1.0.1:
@@ -13950,7 +13950,7 @@ snapshots:
 
   shell-quote@1.8.4: {}
 
-  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/4f31a899ba1e0ade8ebbbbb59609a7529343c2d4:
+  si-encryption@https://codeload.github.com/safeinsights/encryption/tar.gz/3cb802df301d02813f8f67261c34144686b8540a:
     dependencies:
       '@zip.js/zip.js': 2.8.26
       debug: 4.4.3