@noy-db/hub 0.6.0-pre.16 → 0.6.0-pre.18

package/dist/kernel/enclave/record-keys/envelope-body.d.ts

@@ -13,6 +13,7 @@
  * per-function doc for its oracle call site) — this file introduces no new
  * crypto or semantics, only a narrower door onto what already runs.
  */
+import { type RecordIdentity, type RecordRef } from '../record-aad.js';
 import { type EnclaveKey } from '../crypto.js';
 import type { EncryptedEnvelope } from '../../types.js';
 /**
@@ -27,7 +28,7 @@ import type { EncryptedEnvelope } from '../../types.js';
  *    (the collection DEK), decrypt the body under the unwrapped CEK.
  *  - `env._cek` absent → legacy path, decrypt the body directly under `key`.
  */
-export declare function openEnvelopeJson(env: EncryptedEnvelope, key: EnclaveKey, opts?: {
+export declare function openEnvelopeJson(ref: RecordRef, env: EncryptedEnvelope, key: EnclaveKey, opts?: {
     encrypted?: boolean;
 }): Promise<string>;
 /**
@@ -43,7 +44,7 @@ export declare function openEnvelopeJson(env: EncryptedEnvelope, key: EnclaveKey
  *    generated here rather than supplied by the caller).
  *  - otherwise → legacy path, body encrypted directly under `key`.
  */
-export declare function writeEnvelopeBody(json: string, key: EnclaveKey, opts?: {
+export declare function writeEnvelopeBody(identity: RecordIdentity, json: string, key: EnclaveKey, opts?: {
     encrypted?: boolean;
     perRecordKey?: boolean;
 }): Promise<Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>>;
@@ -85,3 +86,34 @@ export declare function hasPerRecordKey(env: EncryptedEnvelope): boolean;
  * `envelope-body.test.ts`).
  */
 export declare function envelopeBodyForHash(env: EncryptedEnvelope): string;
+/**
+ * Does `env` carry an AEAD-sealed body at all?
+ *
+ * The one question callers outside the enclave legitimately need to ask about
+ * `_iv` — a tombstone and a plaintext-collection record have none, so there is
+ * nothing to authenticate and nothing to re-seal. Both {@link
+ * verifyRecordIdentity} (which treats them as vacuously authentic) and the
+ * merge authority's `advance` (which stamps them without re-sealing) turn on
+ * it, and asking it here keeps `_iv` from leaking back out to the callers —
+ * which `enclave-body-only` refused, correctly, when `advance` tested it inline.
+ */
+export declare function hasSealedBody(env: Pick<EncryptedEnvelope, '_iv'>): boolean;
+/**
+ * Does `env` authenticate at the identity `ref` claims, under `key`? (#1042)
+ *
+ * The merge's fail-closed check, living here because it is envelope surgery:
+ * deciding "is there a sealed body at all" reads `_iv`, which
+ * `enclave-body-only` reserves to this folder. An earlier draft did that test
+ * in `kernel/noydb.ts` and the guard refused it — correctly, since a caller
+ * outside the enclave inspecting protected fields is how envelope knowledge
+ * leaks back out.
+ *
+ * Returns a boolean rather than throwing: `applyRemote` must be able to reject
+ * one poisoned record without halting an entire sync, and a hostile store
+ * would very much like the opposite.
+ *
+ * **A record with no sealed body is vacuously authentic** — a tombstone carries
+ * none, and a plaintext collection has no AEAD to verify. Those are pass-through
+ * by construction, not by omission.
+ */
+export declare function verifyRecordIdentity(ref: RecordRef, env: EncryptedEnvelope, key: EnclaveKey): Promise<boolean>;

package/dist/kernel/enclave/record-keys/lifecycle.d.ts

@@ -21,6 +21,7 @@
  */
 import { type EnclaveKey } from '../crypto.js';
 import type { EncryptedEnvelope } from '../../types.js';
+import { type RecordIdentity } from '../record-aad.js';
 import type { Lru } from '../../cache/index.js';
 /** Dependencies {@link resolveStableCek} needs from its collection. */
 export interface StableCekDeps {
@@ -46,15 +47,31 @@ export interface RewrappedBody {
     readonly cek: EnclaveKey | null;
 }
 /**
- * Move a record body from `fromDek` to `toDek`.
+ * Move a record body from `fromDek`/`from` to `toDek`/`to`.
  *
  * - Per-record-key record (`_cek` present): unwrap the CEK under `fromDek`,
  *   re-encrypt the body under the SAME CEK, re-wrap the CEK under `toDek`. The
  *   body key is unchanged → history-chain identity preserved.
  * - Legacy record (no `_cek`): decrypt under `fromDek`, re-encrypt under `toDek`
- *   directly — byte-for-byte the pre-CEK behaviour.
+ *   directly.
+ *
+ * ## Why it takes TWO identities (#1041)
+ *
+ * A rewrap is the one operation where the identity genuinely **changes**. A
+ * tier move rewrites `_tier`; a history snapshot lands at a different
+ * `(collection, id)` entirely. Since AAD binds both, the body must be opened
+ * under the identity it currently has and re-sealed under the one it is moving
+ * to. A single identity would be wrong for one end or the other.
+ *
+ * ⚠️ **This retires an optimisation, deliberately.** Callers used to compute
+ * ONE rewrap and reuse the bytes for both a tier move's live write and its
+ * `_history` snapshot (#728). Those now have different destination identities,
+ * so they need different AAD and therefore different ciphertext — the same
+ * bytes cannot satisfy both. Reusing one rewrap for two destinations is now a
+ * silent corruption, not a saving: it produces a record that opens at one
+ * address and not the other.
  */
-export declare function rewrapBodyToDek(envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<RewrappedBody>;
+export declare function rewrapBodyToDek(from: RecordIdentity, to: RecordIdentity, envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek' | '_tier' | '_by'>, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<RewrappedBody>;
 /**
  * Merge an ALREADY-rewrapped {@link RewrappedBody} into `envelope`, keeping
  * every field but the re-keyed body (`_iv`/`_data`/`_cek`) unchanged.
@@ -76,7 +93,7 @@ export declare function applyRewrappedBody(envelope: EncryptedEnvelope, body: Re
  * envelope, generalized to any envelope shape (history callers don't bump
  * `_v`/`_ts`/`_tier` the way a tier move does).
  */
-export declare function rewrapEnvelope(envelope: EncryptedEnvelope, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<EncryptedEnvelope>;
+export declare function rewrapEnvelope(identity: RecordIdentity, envelope: EncryptedEnvelope, fromDek: EnclaveKey, toDek: EnclaveKey): Promise<EncryptedEnvelope>;
 /**
  * Is `envelope` ALREADY wrapped under `dek` (a per-record CEK wrapped under
  * `dek`, or — legacy, no `_cek` — the body itself decryptable under `dek`)?
@@ -104,4 +121,4 @@ export declare function rewrapEnvelope(envelope: EncryptedEnvelope, fromDek: Enc
  * those fields themselves, preserving the check-architecture body-access
  * ratchet.
  */
-export declare function isRewrappedUnder(envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>, dek: EnclaveKey): Promise<boolean>;
+export declare function isRewrappedUnder(identity: RecordIdentity, envelope: Pick<EncryptedEnvelope, '_iv' | '_data' | '_cek'>, dek: EnclaveKey): Promise<boolean>;

package/dist/kernel/enclave/record-keys/record-codec.d.ts

@@ -18,6 +18,7 @@
  */
 import { type EnclaveKey } from '../crypto.js';
 import { type EncryptedEnvelope, type CrdtMode, type CrdtStrategy, type VdigFieldPolicy, type SealedHandle } from '../../types.js';
+import { type RecordIdentity, type RecordRef } from '../record-aad.js';
 import { type StandardSchemaV1 } from '../../schema.js';
 import type { Lru } from '../../cache/index.js';
 import type { ViaCryptoCtx } from '../../via/index.js';
@@ -127,11 +128,9 @@ export declare class RecordCodec<T> {
      * parts. Pure, no crypto. Each call stamps its own `_ts` — provenance carries
      * a SEPARATE timestamp (computed by the caller), so the two never share one.
      */
-    static buildEnvelope(p: {
-        version: number;
+    static buildEnvelope(identity: RecordIdentity, p: {
         iv: string;
         data: string;
-        by?: string;
         cek?: string;
         provenance?: {
             source: string;
@@ -140,10 +139,8 @@ export declare class RecordCodec<T> {
         extra?: Partial<Pick<EncryptedEnvelope, '_tier' | '_det' | '_sealed'>>;
     }): EncryptedEnvelope;
     /** Plaintext (`_iv:''`) body envelope — the `!storeCiphertext` shape. */
-    static buildPlaintextEnvelope(p: {
-        version: number;
+    static buildPlaintextEnvelope(identity: RecordIdentity, p: {
         data: string;
-        by?: string;
         provenance?: {
             source: string;
             sourceTs: string;
@@ -157,7 +154,7 @@ export declare class RecordCodec<T> {
      * (see {@link encryptRecord}). Rejects `_`-prefixed record fields, which
      * would collide with the reserved metadata namespace.
      */
-    buildDebugEnvelope(record: T, version: number, source?: string, sourceTs?: string): EncryptedEnvelope;
+    buildDebugEnvelope(id: string, record: T, version: number, source?: string, sourceTs?: string): EncryptedEnvelope;
     /**
      * Encrypt a JSON body into an envelope.
      *
@@ -167,11 +164,41 @@ export declare class RecordCodec<T> {
      * path encrypts the body directly under the collection DEK — byte-identical
      * to pre-CEK behaviour, so non-adopting collections pay nothing.
      */
-    encryptJsonString(json: string, version: number, cek?: EnclaveKey, source?: string, sourceTs?: string): Promise<EncryptedEnvelope>;
-    encryptRecord(record: T, version: number, cek?: EnclaveKey, source?: string, sourceTs?: string, vdig?: {
+    /**
+     * `ref` is the identity the envelope is sealed against, and it is **the
+     * location the bytes are stored at** — not necessarily this codec's own
+     * collection (#1051).
+     *
+     * That distinction was discovered here rather than assumed. Several callers
+     * put the result somewhere else entirely: search's vector sidecar lands in
+     * `_vec` under `encodeVecId(name, id)`, the lexical index under `_ft/<name>`,
+     * indexing's entries under a synthetic `idxId`. A codec that supplied
+     * `this.ctx.name` for those would seal them against a collection they are not
+     * in, and once AAD binds identity every one of them would fail to verify.
+     *
+     * ⚠️ **`_history` is the open case, and it is #1041's to settle.** Snapshots
+     * are produced with the LIVE record's identity here and then re-homed by
+     * `saveHistory` into `_history/<historyId(collection,id,_v)>`. Both readings
+     * are defensible — bind where it lives, or bind what it is a copy of — and
+     * the choice must be made before AAD is switched on, not inferred from this
+     * migration.
+     */
+    encryptJsonString(ref: RecordRef, json: string, version: number, cek?: EnclaveKey, source?: string, sourceTs?: string): Promise<EncryptedEnvelope>;
+    /**
+     * `ref` is FIRST and required (#1051). It was previously a trailing optional
+     * `id?: string`, which TypeScript cannot promote to required because it sits
+     * after other optionals — so the migration would have needed an `id ?? ''`
+     * fallback. That is exactly the silent default this issue exists to remove:
+     * once identity is bound into the AEAD, every record written with an empty id
+     * binds to the SAME identity and becomes interchangeable with the others.
+     * An object, not a bare string, so a swap with `version`/`source` cannot
+     * compile on the hottest write path. Carries the collection too — see
+     * {@link encryptJsonString} for why the codec must not assume its own.
+     */
+    encryptRecord(ref: RecordRef, record: T, version: number, cek?: EnclaveKey, source?: string, sourceTs?: string, vdig?: {
         readonly id: string;
         readonly prev: EncryptedEnvelope | null;
-    }, id?: string): Promise<EncryptedEnvelope>;
+    }): Promise<EncryptedEnvelope>;
     /**
      * Resolve the per-record CEK for a stored envelope, or `undefined` for a
      * legacy (`_cek`-absent) envelope. Unwraps `_cek` under the collection DEK and
@@ -195,7 +222,14 @@ export declare class RecordCodec<T> {
      * The optional `id` lets reads populate the CEK cache; it is omitted by
      * callers (history, conflict merge) that have only the envelope.
      */
-    decryptJsonString(envelope: EncryptedEnvelope, id?: string): Promise<string | null>;
+    /**
+     * `ref` must be the SAME identity the writer sealed against — which is the
+     * storage address, not necessarily this codec's own collection. Search's
+     * vector sidecar lives in `_vec`, its lexical index in `_ft`; passing
+     * `this.ctx.name` for those would recompute the wrong AAD and fail to open a
+     * perfectly good record (#1041).
+     */
+    decryptJsonString(ref: RecordRef, envelope: EncryptedEnvelope): Promise<string | null>;
     /**
      * Unseal a single `_sealed[field]` slot to its plaintext value: derive the
      * per-field key off the collection DEK, AES-GCM-decrypt the `iv:data` blob,
@@ -304,7 +338,7 @@ export declare class RecordCodec<T> {
      * output-recompute path, not the public per-record read surface schema
      * validation guards.
      */
-    decryptRecordAtDek(envelope: EncryptedEnvelope, dek: EnclaveKey, id?: string): Promise<T | null>;
+    decryptRecordAtDek(ref: RecordRef, envelope: EncryptedEnvelope, dek: EnclaveKey): Promise<T | null>;
     /**
      * Decrypt an envelope into a record of type `T`.
      *
@@ -320,9 +354,8 @@ export declare class RecordCodec<T> {
      * that may predate a schema change, so validating it would be a
      * false positive. Every non-history read leaves this flag `false`.
      */
-    decryptRecord(envelope: EncryptedEnvelope, opts?: {
+    decryptRecord(ref: RecordRef, envelope: EncryptedEnvelope, opts?: {
         skipValidation?: boolean;
-        id?: string;
         sealedAsHandles?: boolean;
     }): Promise<T | null>;
 }

package/dist/kernel/enclave/record-keys/rekey.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Re-key one envelope from an old collection DEK to a new one (#1074).
+ *
+ * Lives in the enclave because it is envelope surgery: it reads and writes the
+ * protected body slots (`_iv`/`_data`/`_cek`), which `enclave-body-only`
+ * reserves to `kernel/enclave/**`. `rotateKeys` previously did this inline in
+ * `with-party/team/keyring.ts` and got it wrong in two ways that the guard
+ * would have caught had the code lived here.
+ *
+ * @packageDocumentation
+ */
+import { type EnclaveKey } from '../crypto.js';
+import type { EncryptedEnvelope } from '../../types.js';
+/**
+ * Produce the envelope `envelope` becomes once its collection's DEK rotates
+ * from `oldDek` to `newDek`.
+ *
+ * **Every slot is carried forward except `_bidx`.** The previous inline version
+ * built a fresh literal holding only `_noydb/_v/_ts/_iv/_data`, silently
+ * discarding `_by`, `_tier`, `_cek`, `_sealed`, `_vdig` and `_source`. Losing
+ * `_tier` was the worst of those: tier-0 reads treat elevated as missing, so an
+ * elevated record did not error after a rotation — it simply disappeared.
+ *
+ * `_bidx` is dropped deliberately. It is a DEK-rooted equality tag, so a tag
+ * carried across a DEK rotation can never be re-derived to match a query again
+ * while still leaking the old equality partition. Index coverage regrows
+ * per-record on the next `put()` under the new DEK.
+ *
+ * Two shapes, and picking the wrong one is why this needed a helper:
+ *
+ * - **per-record CEK** (`_cek` present) — the body is sealed under the CEK and
+ *   the CEK is wrapped under the collection DEK, so rotation re-wraps the CEK
+ *   and leaves the body **untouched**. The old inline code instead ran
+ *   `decrypt(body, oldDek)` on these, which throws: rotation could not complete
+ *   on a collection containing any CEK record.
+ * - **bare** — body sealed directly under the DEK, so decrypt and re-encrypt.
+ *
+ * Idempotence is the caller's problem, not this function's: it assumes
+ * `envelope` is still under `oldDek`. A resumable rotation must know which side
+ * of the migration each record is on before calling.
+ */
+export declare function rekeyEnvelopeToDek(ref: {
+    readonly collection: string;
+    readonly id: string;
+}, envelope: EncryptedEnvelope, oldDek: EnclaveKey, newDek: EnclaveKey): Promise<EncryptedEnvelope>;
+/**
+ * Resumable variant: returns the re-keyed envelope, or `null` when `envelope`
+ * is **already** under `newDek` and needs no work (#1074 part 2).
+ *
+ * A rotation interrupted mid-collection leaves records on both sides of the
+ * migration. Resuming means re-running the rotation with the *same* new DEK,
+ * which requires distinguishing "not yet moved" from "already moved" without
+ * the caller touching protected slots.
+ *
+ * Detection is by trial decryption under `oldDek`. There is no metadata that
+ * says which DEK sealed a record — deliberately, since such a marker would be
+ * store-writable and therefore a downgrade lever (the same reasoning that
+ * keeps the reader from branching on `_noydb`).
+ *
+ * A record that opens under *neither* key is genuinely damaged and rethrows,
+ * rather than being silently skipped: a rotation that quietly walked past
+ * unreadable records would convert a loud failure into permanent silent loss,
+ * which is the defect this whole issue is about.
+ */
+export declare function rekeyEnvelopeIfNeeded(ref: {
+    readonly collection: string;
+    readonly id: string;
+}, envelope: EncryptedEnvelope, oldDek: EnclaveKey, newDek: EnclaveKey): Promise<EncryptedEnvelope | null>;

package/dist/kernel/enclave/record-keys/tombstone.d.ts

@@ -16,7 +16,7 @@
  * vault; it calls into these.
  */
 import { type EncryptedEnvelope } from '../../types.js';
-import type { RecordIdentity } from '../record-aad.js';
+import type { RecordRef } from '../record-aad.js';
 /**
  * Shape-only tombstone recognition for layers that have no per-collection
  * context (the sync engine, #590): a tombstone carries an empty `_data` and
@@ -46,7 +46,7 @@ export declare function isTombstone(envelope: EncryptedEnvelope, encrypted: bool
  * Deliberately omits `_iv`/`_data`/`_cek`/`_det` — that omission *is* the
  * erasure.
  */
-export declare function buildTombstone(identity: RecordIdentity, version: number, actor: string): EncryptedEnvelope;
+export declare function buildTombstone(ref: RecordRef, version: number, actor: string): EncryptedEnvelope;
 /** #589: is this envelope an ordinary-delete marker (version-ordered, reads as absent)? */
 export declare function isDeleteMarker(envelope: EncryptedEnvelope): boolean;
 /**
@@ -55,4 +55,4 @@ export declare function isDeleteMarker(envelope: EncryptedEnvelope): boolean;
  * keeps the displaced `_v` — so it wins convergence over the pre-delete copy and a
  * re-create can still win over it at a higher version.
  */
-export declare function buildDeleteMarker(identity: RecordIdentity, version: number, actor: string): EncryptedEnvelope;
+export declare function buildDeleteMarker(ref: RecordRef, version: number, actor: string): EncryptedEnvelope;

package/dist/kernel/merge-authority.d.ts

@@ -0,0 +1,25 @@
+import type { MergeAuthority } from '../port/with/merge-authority.js';
+import type { EnclaveKey } from './enclave/index.js';
+/**
+ * ⚠️ **A client cannot verify what it cannot decrypt** — and that boundary is
+ * stated here rather than hidden.
+ *
+ * A record at a tier this caller holds no key for is accepted **unverified**.
+ * Rejecting it would break replication of data the peer legitimately holds but
+ * this client is not cleared to read, converting a confidentiality boundary
+ * into a replication failure. The residue is narrow: envelopes whose key the
+ * client lacks are pass-through, exactly as every envelope was before #1042.
+ *
+ * Closing that residue needs the vault head (#1044), which can detect absence
+ * and substitution without holding the key.
+ */
+export declare function buildMergeAuthority(
+/**
+ * Just the DEK map, not the whole keyring. `port-layering` refused a type
+ * import of `UnlockedKeyring` from `with-party` — correctly, and the narrower
+ * shape is better anyway: this needs to look up keys, not to know what a
+ * keyring is.
+ */
+keyring: {
+    readonly deks: ReadonlyMap<string, EnclaveKey>;
+}): MergeAuthority;

package/dist/kernel/tier-visibility.d.ts

@@ -52,3 +52,18 @@ export declare function assertTierWritable(adapter: NoydbStore, vault: string, n
  * explicit for concurrent writes generally.
  */
 export declare function assertCutoverTierSafe(adapter: NoydbStore, vault: string, name: string, tiersEnabled: boolean): Promise<void>;
+/**
+ * The key a collection's DEK is stored under in `UnlockedKeyring.deks` for a
+ * given tier: `collection` at tier 0, `collection#N` above it.
+ *
+ * Lives in the kernel because the `deks` map is a kernel type and the kernel
+ * reads it — `noydb.ts` needs this to resolve the right DEK when verifying a
+ * pulled envelope (#1042). `with-party/team/tiers.ts` re-exports it, so every
+ * existing importer is unchanged; the definition simply moved to the layer that
+ * owns the map rather than one that happens to use it.
+ *
+ * This move was forced by `port-layering`, and rightly: the alternative was the
+ * kernel spine statically importing a `with-*` service, or duplicating the
+ * naming convention in two places where it could drift.
+ */
+export declare function dekKey(collection: string, tier: number): string;

package/dist/kernel/types.d.ts

@@ -34,6 +34,7 @@ import type { PeriodsStrategy } from '../with-audit/periods/strategy.js';
 import type { ShadowStrategy } from '../with-fork/shadow/strategy.js';
 import type { TransactionsStrategy } from '../with-commit/tx/strategy.js';
 import type { HistoryStrategy } from '../with-commit/history/strategy.js';
+import type { VaultHeadStrategy } from '../with-commit/vault-head/strategy.js';
 import type { ForgetStrategy } from '../with-audit/forget/strategy.js';
 import type { SnapshotsStrategy } from '../with-fork/snapshots/strategy.js';
 import type { DerivationSkippedFrozen } from './via/dispatch.js';
@@ -908,6 +909,21 @@ export interface KeyringFile {
     readonly role: Role;
     readonly permissions: Permissions;
     readonly deks: Record<string, string>;
+    /**
+     * DEKs for a rotation that has STARTED but not committed (#1074).
+     *
+     * `rotateKeys` persists the new DEK here *before* rewriting any record, so an
+     * interruption can never strand records under a key that was only ever in
+     * memory. On commit these move into `deks` and this is cleared.
+     *
+     * Present on disk ⇒ a rotation was interrupted and the collection may hold
+     * records on both sides of the migration. Re-running `rotateKeys` resumes
+     * with this key rather than minting a fresh one.
+     *
+     * Optional: absent on every keyring written before this existed, and absent
+     * in the normal committed state.
+     */
+    readonly pending_deks?: Record<string, string>;
     readonly salt: string;
     readonly created_at: string;
     readonly granted_by: string;
@@ -2415,6 +2431,13 @@ export interface NoydbOptions {
      * @internal
      */
     readonly historyStrategy?: HistoryStrategy;
+    /**
+     * #1044 — opt in to the vault head, which detects a store that WITHHOLDS.
+     * `withVaultHead()` from `@noy-db/hub/vault-head`. Costs one small write per
+     * commit; on a single-device offline vault it defends against nothing, which
+     * is why it is opt-in while AAD is not.
+     */
+    readonly vaultHeadStrategy?: VaultHeadStrategy;
     /**
      * GDPR right-to-erasure. Pass `withForget({ subjects })`
      * from `@noy-db/hub/forget` to declare which collections carry erasable

package/dist/kernel/vault.d.ts

@@ -745,7 +745,7 @@ export declare class Vault {
      *
      * @internal
      */
-    _decryptEnvelopeForBundleFilter(env: EncryptedEnvelope, collectionName: string): Promise<unknown>;
+    _decryptEnvelopeForBundleFilter(env: EncryptedEnvelope, collectionName: string, recordId: string): Promise<unknown>;
     /**
      * Read-only accessor for the invoking keyring's import capability
      * (issue ). UI affordance — returns false in every default-closed

package/dist/kernel/via/index.d.ts

@@ -47,8 +47,17 @@ export interface ViaCryptoCtx {
         delete(field: string): Promise<void>;
     };
     reservedEnvelopes(prefix: string): {
-        encrypt(collection: string, json: string, v: number): Promise<EncryptedEnvelope>;
-        decrypt(collection: string, env: EncryptedEnvelope): Promise<string>;
+        /**
+         * `id` is the record id the envelope will be stored under. Required
+         * (#1051) because this function holds the DEK, so it is where record-identity
+         * AAD is applied — a caller that cannot name the id cannot be bound.
+         */
+        encrypt(identity: {
+            readonly collection: string;
+            readonly id: string;
+            readonly by?: string;
+        }, json: string, v: number): Promise<EncryptedEnvelope>;
+        decrypt(collection: string, id: string, env: EncryptedEnvelope): Promise<string>;
     };
 }
 /** Per-call erase context — `forget()`'s per-ref participation door (phase C). */

package/dist/{ledger-6IHXJHDD.js → ledger-KQAJPEMZ.js}

@@ -3,7 +3,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-5TF5DUQ5.js";
+} from "./chunk-FDIZHZ3C.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -15,15 +15,15 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-53PWELSC.js";
-import "./chunk-LTVETWDH.js";
-import "./chunk-6E2JZRBD.js";
+} from "./chunk-FY33DKPH.js";
+import "./chunk-X3AXSYBL.js";
+import "./chunk-ZVAFJQZB.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
 import "./chunk-LP7BEXCT.js";
 import "./chunk-QTDAPDDV.js";
-import "./chunk-SFY6NT7D.js";
+import "./chunk-3Y4OFWQJ.js";
 import "./chunk-I64WQSN3.js";
 import "./chunk-PZ5AY32C.js";
 export {
@@ -39,4 +39,4 @@ export {
   parseIndex,
   sha256Hex
 };
-//# sourceMappingURL=ledger-6IHXJHDD.js.map
+//# sourceMappingURL=ledger-KQAJPEMZ.js.map

package/dist/liberate-Z2EXJY2S.js

@@ -0,0 +1,24 @@
+import {
+  liberateVault
+} from "./chunk-FRGF56PD.js";
+import "./chunk-TXDOMADN.js";
+import "./chunk-BBU3OD3D.js";
+import "./chunk-NRNTXBHT.js";
+import "./chunk-TNOQNU3R.js";
+import "./chunk-O4QDBAB6.js";
+import "./chunk-ZSOTZ2RZ.js";
+import "./chunk-ITXPKEDP.js";
+import "./chunk-X3AXSYBL.js";
+import "./chunk-ZVAFJQZB.js";
+import "./chunk-FSZPQCDR.js";
+import "./chunk-HVR74IBG.js";
+import "./chunk-RBTZLXZJ.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-QTDAPDDV.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-I64WQSN3.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  liberateVault
+};
+//# sourceMappingURL=liberate-Z2EXJY2S.js.map

package/dist/{link-set-XRVHGYWC.js → link-set-XKN5V7VM.js}

@@ -1,7 +1,7 @@
 import {
   LinkEndpointError,
   LinkSet
-} from "./chunk-4CSG6KBX.js";
+} from "./chunk-2ION5ZRH.js";
 import {
   LINK_COLLECTION_PREFIX,
   LinkIntegrityError,
@@ -9,14 +9,14 @@ import {
   linkCollectionName,
   linkRowKey
 } from "./chunk-S6CP5FWF.js";
-import "./chunk-LTVETWDH.js";
-import "./chunk-6E2JZRBD.js";
+import "./chunk-X3AXSYBL.js";
+import "./chunk-ZVAFJQZB.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
 import "./chunk-LP7BEXCT.js";
 import "./chunk-QTDAPDDV.js";
-import "./chunk-SFY6NT7D.js";
+import "./chunk-3Y4OFWQJ.js";
 import "./chunk-I64WQSN3.js";
 import "./chunk-PZ5AY32C.js";
 export {
@@ -28,4 +28,4 @@ export {
   linkCollectionName,
   linkRowKey
 };
-//# sourceMappingURL=link-set-XRVHGYWC.js.map
+//# sourceMappingURL=link-set-XKN5V7VM.js.map

package/dist/{managed-secret-IDAOXSSX.js → managed-secret-7WIIVMJ5.js}

@@ -9,8 +9,16 @@ import {
   resolveManagedSecret,
   saveSealedSecret,
   sealRsaOaepTlv
-} from "./chunk-55B3KHZW.js";
-import "./chunk-SFY6NT7D.js";
+} from "./chunk-NRNTXBHT.js";
+import "./chunk-X3AXSYBL.js";
+import "./chunk-ZVAFJQZB.js";
+import "./chunk-FSZPQCDR.js";
+import "./chunk-HVR74IBG.js";
+import "./chunk-RBTZLXZJ.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-QTDAPDDV.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-I64WQSN3.js";
 import "./chunk-PZ5AY32C.js";
 export {
   MemoryRecipientSealer,
@@ -24,4 +32,4 @@ export {
   saveSealedSecret,
   sealRsaOaepTlv
 };
-//# sourceMappingURL=managed-secret-IDAOXSSX.js.map
+//# sourceMappingURL=managed-secret-7WIIVMJ5.js.map

package/dist/materialized-views/index.js

@@ -1,15 +1,15 @@
 import {
   withMaterializedView
 } from "../chunk-K2MR7ROB.js";
+import {
+  MaterializedViewExecutor
+} from "../chunk-OCCNYGKG.js";
 import {
   clearMVStale,
   isMVStale,
   markMVStale,
   resolveStaleMVOnRead
-} from "../chunk-PJGMBELR.js";
-import {
-  MaterializedViewExecutor
-} from "../chunk-4DJQU3PH.js";
+} from "../chunk-AIZNLHKN.js";
 import {
   MaterializedViewRegistry,
   analyzeDependencies,
@@ -17,26 +17,26 @@ import {
   computeQueryHash,
   summarizeQueryPlan
 } from "../chunk-C66T4W5P.js";
-import "../chunk-JU3JKOY5.js";
-import "../chunk-3JQVA527.js";
-import "../chunk-OPGKH5RD.js";
+import "../chunk-EWAGI3EM.js";
+import "../chunk-NFPSC2HL.js";
 import "../chunk-5D2ALSM5.js";
 import "../chunk-QI2KXQOM.js";
+import "../chunk-LU6NPJWN.js";
 import "../chunk-XZHEOSQ2.js";
 import "../chunk-CADUYBQD.js";
 import "../chunk-IGJCYUT5.js";
-import "../chunk-IQGIPRSE.js";
-import "../chunk-7LLKPODL.js";
-import "../chunk-RVTOCAHQ.js";
-import "../chunk-53PWELSC.js";
-import "../chunk-LTVETWDH.js";
-import "../chunk-6E2JZRBD.js";
+import "../chunk-CFTPERGL.js";
+import "../chunk-LPAGIMXJ.js";
+import "../chunk-SQSZRCYT.js";
+import "../chunk-FY33DKPH.js";
+import "../chunk-X3AXSYBL.js";
+import "../chunk-ZVAFJQZB.js";
 import "../chunk-FSZPQCDR.js";
 import "../chunk-HVR74IBG.js";
 import "../chunk-RBTZLXZJ.js";
 import "../chunk-LP7BEXCT.js";
 import "../chunk-QTDAPDDV.js";
-import "../chunk-SFY6NT7D.js";
+import "../chunk-3Y4OFWQJ.js";
 import {
   MaterializedViewConfigError,
   MaterializedViewCycleError,

package/dist/money/index.js

@@ -4,7 +4,7 @@ import {
   isMoneyString,
   moneyNumber,
   mulRate
-} from "../chunk-466KGOQB.js";
+} from "../chunk-2NE7ILO7.js";
 import {
   MoneyCurrencyError,
   MoneyPrecisionError,
@@ -13,9 +13,9 @@ import {
   isMoneyDescriptor,
   money,
   scaleForCurrency
-} from "../chunk-JU3JKOY5.js";
+} from "../chunk-EWAGI3EM.js";
 import "../chunk-IGJCYUT5.js";
-import "../chunk-RVTOCAHQ.js";
+import "../chunk-SQSZRCYT.js";
 import "../chunk-I64WQSN3.js";
 import "../chunk-PZ5AY32C.js";
 export {