@noy-db/hub 0.6.0-pre.16 → 0.6.0-pre.18

package/dist/history/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n  rewrapHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    rewrapHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/with-commit/history/active.ts"],"sourcesContent":["/**\n * Active history strategy — `withHistory()` returns the real\n * implementation that wires per-record snapshots, the hash-chained\n * audit ledger, JSON-patch deltas, and time-machine reads into the\n * core write/read paths.\n *\n * Consumers opt in by:\n *\n * ```ts\n * import { createNoydb } from '@noy-db/hub'\n * import { withHistory } from '@noy-db/hub/history'\n *\n * const db = await createNoydb({\n *   store: ...,\n *   user: ...,\n *   historyStrategy: withHistory(),\n * })\n * ```\n *\n * The factory is a thin wrapper that delegates to the existing\n * `history.ts`, `diff.ts`, `ledger/store.ts`, `ledger/patch.ts`, and\n * `time-machine.ts` modules. Splitting the import chain through this\n * file is what lets `tsup` tree-shake the heavy modules out of the\n * default `@noy-db/hub` bundle when no `withHistory()` import is\n * present in the consumer.\n *\n * @public\n */\n\nimport type { HistoryStrategy, BuildLedgerOptions } from './strategy.js'\nimport {\n  saveHistory,\n  historyIdentity,\n  getHistory,\n  getVersionEnvelope,\n  pruneHistory,\n  clearHistory,\n  tombstoneHistory,\n  rewrapHistory,\n} from './history.js'\nimport { diff as computeDiff } from './diff.js'\nimport { LedgerStore, envelopePayloadHash } from './ledger/store.js'\nimport { computePatch } from './ledger/patch.js'\nimport { VaultInstant } from './time-machine.js'\n\n/**\n * Build the active history strategy. Today the factory takes no\n * options; per-collection retention tuning still flows through\n * `HistoryConfig` on `Vault.collection()` / `vault.openVault()`.\n *\n * Future option slots (kept off the LTS surface for now):\n *   - global maxVersions cap\n *   - global beforeDate prune cadence\n *   - ledger encryption toggle (today inferred from vault.encrypted)\n */\nexport function withHistory(): HistoryStrategy {\n  return {\n    saveHistory,\n    historyIdentity,\n    getHistoryEntries: getHistory,\n    getVersionEnvelope,\n    pruneHistory,\n    clearHistory,\n    tombstoneHistory,\n    rewrapHistory,\n    envelopePayloadHash,\n    computePatch,\n    diff: computeDiff,\n    buildLedger(opts: BuildLedgerOptions): LedgerStore {\n      return new LedgerStore({\n        adapter: opts.adapter,\n        vault: opts.vault,\n        encrypted: opts.encrypted,\n        getDEK: opts.getDEK,\n        actor: opts.actor,\n      })\n    },\n    buildVaultInstant(engine, timestamp): VaultInstant {\n      return new VaultInstant(engine, timestamp)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDO,SAAS,cAA+B;AAC7C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAuC;AACjD,aAAO,IAAI,YAAY;AAAA,QACrB,SAAS,KAAK;AAAA,QACd,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,QAAQ,KAAK;AAAA,QACb,OAAO,KAAK;AAAA,MACd,CAAC;AAAA,IACH;AAAA,IACA,kBAAkB,QAAQ,WAAyB;AACjD,aAAO,IAAI,aAAa,QAAQ,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;","names":[]}

package/dist/i18n/index.js

@@ -1,15 +1,15 @@
 import {
   withLookup
-} from "../chunk-YX6J3Z3Z.js";
+} from "../chunk-PBPYQZDW.js";
 import {
   dictKey,
   staticDict
-} from "../chunk-FZ2SSI5R.js";
+} from "../chunk-6AL6O4CS.js";
 import {
   DICT_COLLECTION_PREFIX,
   LookupHandle,
   dictCollectionName
-} from "../chunk-IQGIPRSE.js";
+} from "../chunk-CFTPERGL.js";
 import {
   NO_I18N,
   applyI18nLocale,
@@ -26,17 +26,17 @@ import {
   resolvePolicy,
   stripI18nFilled,
   validateI18nTextValue
-} from "../chunk-7LLKPODL.js";
-import "../chunk-RVTOCAHQ.js";
-import "../chunk-53PWELSC.js";
-import "../chunk-LTVETWDH.js";
-import "../chunk-6E2JZRBD.js";
+} from "../chunk-LPAGIMXJ.js";
+import "../chunk-SQSZRCYT.js";
+import "../chunk-FY33DKPH.js";
+import "../chunk-X3AXSYBL.js";
+import "../chunk-ZVAFJQZB.js";
 import "../chunk-FSZPQCDR.js";
 import "../chunk-HVR74IBG.js";
 import "../chunk-RBTZLXZJ.js";
 import "../chunk-LP7BEXCT.js";
 import "../chunk-QTDAPDDV.js";
-import "../chunk-SFY6NT7D.js";
+import "../chunk-3Y4OFWQJ.js";
 import {
   DictKeyInUseError,
   DictKeyMissingError,

package/dist/index.d.ts

@@ -306,6 +306,22 @@ export type { SessionToken, CreateSessionResult, CreateSessionOptions, } from '.
 export { enableDevUnlock, loadDevUnlock, clearDevUnlock, isDevUnlockActive, } from './with-party/session/dev-unlock.js';
 export type { DevUnlockOptions } from './with-party/session/dev-unlock.js';
 export { isDiscriminant } from './kernel/util/discriminant.js';
+/**
+ * Record-identity AAD (#1041) — **public because a raw DEK is no longer enough
+ * to read a record.**
+ *
+ * Every record body is sealed with additional authenticated data derived from
+ * `{collection, id, _tier, _by}`, so a holder of a delegated DEK — a magic-link
+ * grantee, an `at-*` host, external tooling reading a backup — must be able to
+ * reproduce it. Without this export a delegated key opens nothing, which would
+ * silently break delegation rather than merely inconvenience it.
+ *
+ * `recordAadFor(address, envelope)` is the reader's form: it takes the address
+ * the envelope was fetched from and reads `_tier`/`_by` off the envelope
+ * itself, so callers thread two fields rather than four.
+ */
+export { recordAadFor } from './kernel/enclave/index.js';
+export type { RecordIdentity, RecordRef } from './kernel/enclave/index.js';
 export { bufferToBase64, base64ToBuffer, encryptBytes, decryptBytes } from './kernel/enclave/index.js';
 export { encryptDeterministic, decryptDeterministic } from './kernel/enclave/index.js';
 export { EnclaveNotSupportedError } from './kernel/errors.js';

package/dist/index.js

@@ -1,9 +1,9 @@
-import {
-  persistSchemaIfNeeded
-} from "./chunk-3OEWD45V.js";
 import {
   LinkEndpointError
-} from "./chunk-4CSG6KBX.js";
+} from "./chunk-2ION5ZRH.js";
+import {
+  persistSchemaIfNeeded
+} from "./chunk-3RZ7QLJ4.js";
 import {
   ComputedFieldError,
   evalComputedFields
@@ -14,14 +14,17 @@ import {
   listWithdrawalRequests,
   rejectWithdrawal,
   requestWithdrawal
-} from "./chunk-76FBDG6M.js";
+} from "./chunk-OZD3D2DZ.js";
+import {
+  applyListProjection
+} from "./chunk-VG2ZSFYD.js";
 import {
   allocate,
   asMoney,
   isMoneyString,
   moneyNumber,
   mulRate
-} from "./chunk-466KGOQB.js";
+} from "./chunk-2NE7ILO7.js";
 import {
   COVER_FIELDS,
   DEFAULT_COVER_SCHEMA,
@@ -41,33 +44,33 @@ import {
   checkGate,
   describeGate,
   mergePolicy
-} from "./chunk-WMUN7ZUD.js";
+} from "./chunk-AA7LM2A3.js";
 import "./chunk-GJW4HX2O.js";
 import {
   UserApi
-} from "./chunk-4XEUSZWN.js";
+} from "./chunk-6D3CN2JR.js";
 import {
   classified,
   luhnCheck
-} from "./chunk-CZV57HHC.js";
+} from "./chunk-3KXIGMZ4.js";
 import {
   decryptExtractedPartition,
   diffVault,
   withCargo
-} from "./chunk-6EF3N2MH.js";
-import "./chunk-MKSTUVMJ.js";
+} from "./chunk-U6D5XTI5.js";
+import "./chunk-AMMYIT7F.js";
 import {
   createDeedOwner,
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "./chunk-H5U4T6JK.js";
+} from "./chunk-FRGF56PD.js";
 import {
   withdrawAccessibleData
-} from "./chunk-TY6N3PAC.js";
+} from "./chunk-TXDOMADN.js";
 import {
   exportAccessibleData
-} from "./chunk-TWPTRJEU.js";
+} from "./chunk-BBU3OD3D.js";
 import {
   routeStore,
   withCache,
@@ -78,9 +81,6 @@ import {
   withRetry,
   wrapStore
 } from "./chunk-EIPVYUEP.js";
-import {
-  applyListProjection
-} from "./chunk-VG2ZSFYD.js";
 import {
   withDerivation,
   withRollup
@@ -90,8 +90,8 @@ import "./chunk-YDJXGYYA.js";
 import {
   withMaterializedView
 } from "./chunk-K2MR7ROB.js";
-import "./chunk-PJGMBELR.js";
-import "./chunk-4DJQU3PH.js";
+import "./chunk-OCCNYGKG.js";
+import "./chunk-AIZNLHKN.js";
 import "./chunk-C66T4W5P.js";
 import {
   MoneyCurrencyError,
@@ -101,7 +101,7 @@ import {
   isMoneyDescriptor,
   money,
   scaleForCurrency
-} from "./chunk-JU3JKOY5.js";
+} from "./chunk-EWAGI3EM.js";
 import {
   withOverlayedView
 } from "./chunk-5SK5AFYH.js";
@@ -110,54 +110,10 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "./chunk-56W3T5O2.js";
+} from "./chunk-FOABWV7L.js";
 import {
   isDiscriminant
 } from "./chunk-PY4KJPYU.js";
-import {
-  CONSENT_AUDIT_COLLECTION
-} from "./chunk-VUUUIKRG.js";
-import {
-  immutableGuard,
-  transitionGuard,
-  withGuard
-} from "./chunk-QWNYUTI2.js";
-import "./chunk-RWPNRCK2.js";
-import "./chunk-VTTRWLOR.js";
-import "./chunk-JK733I5V.js";
-import {
-  CollectionFrame,
-  VaultFrame
-} from "./chunk-SGEI3IJK.js";
-import {
-  importExternalObjects,
-  memoryObjectProjection
-} from "./chunk-4Q6HSHHL.js";
-import {
-  BLOB_CHUNKS_COLLECTION,
-  BLOB_COLLECTION,
-  BLOB_INDEX_COLLECTION,
-  BLOB_INTENT_COLLECTION,
-  BLOB_SLOTS_PREFIX,
-  BLOB_VERSIONS_PREFIX,
-  BlobSet,
-  DEFAULT_CHUNK_SIZE,
-  createIntent,
-  deleteIntent,
-  detectMagic,
-  detectMimeType,
-  getIntent,
-  isPreCompressed,
-  sweepBlobIntents
-} from "./chunk-NY6RQBUN.js";
-import {
-  withLazy
-} from "./chunk-THNJ3IKU.js";
-import "./chunk-3JQVA527.js";
-import {
-  mergeCrdtStates,
-  resolveCrdtSnapshot
-} from "./chunk-4GPE63GU.js";
 import {
   createPodStore,
   followRedirects,
@@ -165,7 +121,7 @@ import {
   signRedirect,
   verifyRedirect,
   wrapPodStore
-} from "./chunk-HNX47VTC.js";
+} from "./chunk-UE72AQDZ.js";
 import {
   Collection,
   ELEVATION_AUDIT_COLLECTION,
@@ -184,33 +140,40 @@ import {
   refArray,
   via,
   withArchive
-} from "./chunk-KKRFL5E2.js";
+} from "./chunk-GSRW5MTU.js";
+import {
+  LinkIntegrityError,
+  isLinkCollectionName
+} from "./chunk-S6CP5FWF.js";
 import "./chunk-PCXAUC65.js";
 import "./chunk-MVG67SMN.js";
 import {
   deriveSchemaManifest,
   loadSchemaManifestEntry
-} from "./chunk-WMZQCXZ5.js";
+} from "./chunk-EZ3UHHND.js";
 import {
   MANIFEST_COLLECTION,
   isManifestReservedCollection
 } from "./chunk-EPFF7LOX.js";
-import {
-  LinkIntegrityError,
-  isLinkCollectionName
-} from "./chunk-S6CP5FWF.js";
+import "./chunk-JYFJNSTW.js";
 import "./chunk-GYGLAVCX.js";
-import "./chunk-4VRZDYRE.js";
-import "./chunk-343FH4S5.js";
+import "./chunk-HJRTFXAA.js";
+import "./chunk-KHKKD62N.js";
+import {
+  derivePersistedSchema,
+  isZodSchema
+} from "./chunk-HNOBRU24.js";
 import "./chunk-6LJY7X5A.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-TQLYMYOK.js";
 import {
   ClassifiedNeverStoredError,
   ClassifiedValidationError,
   isClassifiedFieldSpec,
   isClassifiedGroup,
   resolveClassifiedFields
-} from "./chunk-6UAVKAG6.js";
-import "./chunk-UVFO25FJ.js";
+} from "./chunk-6QCXMCLZ.js";
+import "./chunk-NAAPSNCS.js";
 import "./chunk-TQ7IRULX.js";
 import {
   NO_CARGO
@@ -221,40 +184,55 @@ import {
   aesGcmOpen,
   parseRsaOaepTlv,
   sealRsaOaepTlv
-} from "./chunk-55B3KHZW.js";
-import "./chunk-KHKKD62N.js";
-import {
-  derivePersistedSchema,
-  isZodSchema
-} from "./chunk-HNOBRU24.js";
-import "./chunk-Y2NBBT6K.js";
+} from "./chunk-NRNTXBHT.js";
 import {
   SCHEMAS_COLLECTION,
   loadPersistedSchema,
   savePersistedSchema
-} from "./chunk-A3WHDOWI.js";
+} from "./chunk-IN5EZWYQ.js";
+import {
+  NO_SEQUENCE,
+  SequenceStore,
+  compileSequenceFormat,
+  resolveSequenceKey,
+  withSequence
+} from "./chunk-AA2WWTS3.js";
 import {
   CustodyApi,
   NO_CUSTODY,
   withCustody
-} from "./chunk-IGE6XWKK.js";
+} from "./chunk-VXVKEWYC.js";
 import "./chunk-YH65A6WM.js";
 import {
   buildLookupSnapshot
-} from "./chunk-OPGKH5RD.js";
+} from "./chunk-NFPSC2HL.js";
 import "./chunk-RDPZMUCX.js";
 import {
   INDEXED_STORE_POLICY,
   POD_STORE_POLICY,
   SyncScheduler
-} from "./chunk-JN64WH3U.js";
-import "./chunk-TQLYMYOK.js";
+} from "./chunk-T7IR4N2S.js";
+import {
+  CONSENT_AUDIT_COLLECTION
+} from "./chunk-A5QQKWCK.js";
 import "./chunk-PEOZ34EM.js";
-import "./chunk-TTAND7MR.js";
+import "./chunk-PBRIHUQ5.js";
 import "./chunk-GHVIKOHT.js";
 import {
   PERIODS_COLLECTION
 } from "./chunk-V4M4BZNW.js";
+import {
+  immutableGuard,
+  transitionGuard,
+  withGuard
+} from "./chunk-QWNYUTI2.js";
+import "./chunk-RWPNRCK2.js";
+import "./chunk-VTTRWLOR.js";
+import "./chunk-JK733I5V.js";
+import {
+  CollectionFrame,
+  VaultFrame
+} from "./chunk-SGEI3IJK.js";
 import "./chunk-SMY5X46Z.js";
 import "./chunk-DZFQVICS.js";
 import {
@@ -272,7 +250,7 @@ import {
   verifyPodHeader,
   verifyRecord,
   writePod
-} from "./chunk-THUITYH7.js";
+} from "./chunk-TNOQNU3R.js";
 import {
   COVER_RECORD_ID,
   isCover,
@@ -280,7 +258,7 @@ import {
   readCover,
   saveCover,
   validateCoverInput
-} from "./chunk-I5OLA3H6.js";
+} from "./chunk-O4QDBAB6.js";
 import {
   TxCollection,
   TxContext,
@@ -292,17 +270,11 @@ import {
   NO_SEARCH,
   tokenize,
   withSearch
-} from "./chunk-4JDTLWUZ.js";
+} from "./chunk-DFFSCYIW.js";
 import {
   fuseRetrieval
 } from "./chunk-AURFOK3D.js";
-import {
-  NO_SEQUENCE,
-  SequenceStore,
-  compileSequenceFormat,
-  resolveSequenceKey,
-  withSequence
-} from "./chunk-RRMXMJUP.js";
+import "./chunk-QLMUW7OC.js";
 import {
   DEFAULT_CROSS_JOIN_MAX_ROWS,
   Query,
@@ -314,16 +286,41 @@ import {
   DEFAULT_JOIN_MAX_ROWS,
   applyJoins
 } from "./chunk-QI2KXQOM.js";
-import "./chunk-LGGLPURL.js";
+import {
+  importExternalObjects,
+  memoryObjectProjection
+} from "./chunk-4Q6HSHHL.js";
+import {
+  BLOB_CHUNKS_COLLECTION,
+  BLOB_COLLECTION,
+  BLOB_INDEX_COLLECTION,
+  BLOB_INTENT_COLLECTION,
+  BLOB_SLOTS_PREFIX,
+  BLOB_VERSIONS_PREFIX,
+  BlobSet,
+  DEFAULT_CHUNK_SIZE,
+  createIntent,
+  deleteIntent,
+  detectMagic,
+  detectMimeType,
+  getIntent,
+  isPreCompressed,
+  sweepBlobIntents
+} from "./chunk-RAYGDC4A.js";
+import "./chunk-DWO55ZWE.js";
 import "./chunk-RJTGXZT6.js";
 import {
   CollectionIndexes
 } from "./chunk-GQ3BX5EA.js";
+import {
+  withLazy
+} from "./chunk-THNJ3IKU.js";
 import {
   Lru,
   estimateRecordBytes,
   parseBytes
 } from "./chunk-NO272T7Q.js";
+import "./chunk-LU6NPJWN.js";
 import "./chunk-XZHEOSQ2.js";
 import "./chunk-YMUFFJCO.js";
 import "./chunk-CADUYBQD.js";
@@ -332,17 +329,21 @@ import {
   evaluateFieldClause,
   readPath
 } from "./chunk-IGJCYUT5.js";
+import {
+  mergeCrdtStates,
+  resolveCrdtSnapshot
+} from "./chunk-4GPE63GU.js";
 import "./chunk-PVEWA2DU.js";
-import "./chunk-YX6J3Z3Z.js";
+import "./chunk-PBPYQZDW.js";
 import {
   dictKey,
   staticDict
-} from "./chunk-FZ2SSI5R.js";
+} from "./chunk-6AL6O4CS.js";
 import {
   DICT_COLLECTION_PREFIX,
   LookupHandle,
   dictCollectionName
-} from "./chunk-IQGIPRSE.js";
+} from "./chunk-CFTPERGL.js";
 import {
   applyI18nLocale,
   enforceScript,
@@ -357,15 +358,15 @@ import {
   resolvePolicy,
   setAtPathInPlace,
   validateI18nTextValue
-} from "./chunk-7LLKPODL.js";
+} from "./chunk-LPAGIMXJ.js";
 import {
   installViaBinder
-} from "./chunk-RVTOCAHQ.js";
+} from "./chunk-SQSZRCYT.js";
 import {
   MemoryDeviceSealProvider,
   beginEchoUnlock,
   withTeam
-} from "./chunk-AD2PJGSS.js";
+} from "./chunk-ZDATYUYG.js";
 import {
   MAGIC_LINK_GRANTS_COLLECTION,
   NO_TEAM,
@@ -394,13 +395,13 @@ import {
   unwrapDeksFromPaperEntry,
   unwrapMagicLinkGrant,
   writeMagicLinkGrant
-} from "./chunk-OJEDR25M.js";
+} from "./chunk-BVIGGV6D.js";
 import {
   META_COLLECTION,
   POLICY_RECORD_ID,
   loadVaultPolicy,
   saveVaultPolicy
-} from "./chunk-JZVXGOJE.js";
+} from "./chunk-DKYEVHZH.js";
 import {
   DEFAULT_ECHO_MIN_WORD_LENGTH,
   DEFAULT_ECHO_PROMPT_MIN_WORDS,
@@ -423,7 +424,7 @@ import {
   validateSecret,
   verifyPrompt,
   verifyTypedEcho
-} from "./chunk-LJDW6LQJ.js";
+} from "./chunk-ZSOTZ2RZ.js";
 import {
   DIRECTORY_RECORD_ID,
   VISIBILITY_RECORD_PREFIX,
@@ -437,8 +438,8 @@ import {
   readUserVisibility,
   saveUserEnvelope,
   visibilityRecordId
-} from "./chunk-PZLIA5R3.js";
-import "./chunk-YVOW35HH.js";
+} from "./chunk-ITXPKEDP.js";
+import "./chunk-DL4GDOWL.js";
 import "./chunk-H545OIWE.js";
 import {
   PolicyEnforcer,
@@ -463,22 +464,21 @@ import {
 import {
   CollectionInstant,
   VaultInstant
-} from "./chunk-T6CCRXD3.js";
+} from "./chunk-CGQUSSW7.js";
 import {
   diff,
   formatDiff
 } from "./chunk-SVLR4POP.js";
-import "./chunk-AFHQATY4.js";
+import "./chunk-UIYZ5SOU.js";
 import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-5TF5DUQ5.js";
+} from "./chunk-FDIZHZ3C.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
-import "./chunk-AMKCY454.js";
 import {
   canonicalJson,
   envelopePayloadHash,
@@ -486,17 +486,20 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-53PWELSC.js";
-import "./chunk-35RIRCGW.js";
-import "./chunk-QLMUW7OC.js";
+} from "./chunk-FY33DKPH.js";
+import "./chunk-7WD2G6K4.js";
+import "./chunk-HK67PX4J.js";
+import "./chunk-KLVGF2D4.js";
 import {
+  buildRecordAad,
   openEnvelopeJson,
+  recordAadFor,
   validateSchemaInput,
   validateSchemaOutput
-} from "./chunk-LTVETWDH.js";
+} from "./chunk-X3AXSYBL.js";
 import {
   buildRecordEnvelope
-} from "./chunk-6E2JZRBD.js";
+} from "./chunk-ZVAFJQZB.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
@@ -518,7 +521,7 @@ import {
   NOYDB_SYNC_VERSION,
   SealedHandle,
   createStore
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-3Y4OFWQJ.js";
 import {
   AlreadyElevatedError,
   AmendmentForbiddenError,
@@ -998,13 +1001,11 @@ async function putCredential(adapter, vault, keyring, credential) {
   requireAdminAccess(keyring);
   const getDek = await ensureCollectionDEK(adapter, vault, keyring);
   const dek = await getDek(SYNC_CREDENTIALS_COLLECTION);
-  const { iv, data } = await encrypt(JSON.stringify(credential), dek);
   const existing = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, credential.adapterId);
   const version = existing ? existing._v + 1 : 1;
-  const envelope = buildRecordEnvelope(
-    { collection: SYNC_CREDENTIALS_COLLECTION, id: credential.adapterId },
-    { version, iv, data, by: keyring.userId }
-  );
+  const identity = { collection: SYNC_CREDENTIALS_COLLECTION, id: credential.adapterId, version };
+  const { iv, data } = await encrypt(JSON.stringify(credential), dek, buildRecordAad(identity));
+  const envelope = buildRecordEnvelope(identity, { iv, data });
   await adapter.put(
     vault,
     SYNC_CREDENTIALS_COLLECTION,
@@ -1019,7 +1020,7 @@ async function getCredential(adapter, vault, keyring, adapterId) {
   const dek = await getDek(SYNC_CREDENTIALS_COLLECTION);
   const envelope = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, adapterId);
   if (!envelope) return null;
-  const plaintext = await openEnvelopeJson(envelope, dek);
+  const plaintext = await openEnvelopeJson({ collection: SYNC_CREDENTIALS_COLLECTION, id: adapterId }, envelope, dek);
   return JSON.parse(plaintext);
 }
 async function deleteCredential(adapter, vault, keyring, adapterId) {
@@ -1429,6 +1430,7 @@ export {
   readPodHeader,
   readPodRedirect,
   readUserVisibility,
+  recordAadFor,
   recoverUser,
   ref,
   refArray,