@noy-db/hub 0.6.0-pre.16 → 0.6.0-pre.18

package/dist/vault-head/index.js

@@ -0,0 +1,111 @@
+import {
+  DEFAULT_HEAD_BUCKETS,
+  NO_VAULT_HEAD,
+  VAULT_HEAD_COLLECTION
+} from "../chunk-HK67PX4J.js";
+import {
+  buildRecordAad,
+  openEnvelopeJson
+} from "../chunk-X3AXSYBL.js";
+import {
+  buildRecordEnvelope
+} from "../chunk-ZVAFJQZB.js";
+import "../chunk-FSZPQCDR.js";
+import "../chunk-HVR74IBG.js";
+import "../chunk-RBTZLXZJ.js";
+import "../chunk-LP7BEXCT.js";
+import {
+  encrypt
+} from "../chunk-QTDAPDDV.js";
+import "../chunk-3Y4OFWQJ.js";
+import "../chunk-I64WQSN3.js";
+import "../chunk-PZ5AY32C.js";
+
+// src/with-commit/vault-head/head.ts
+function bucketIndex(collection, id, buckets) {
+  let h = 2166136261;
+  const s = `${collection}/${id}`;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return h % buckets;
+}
+function bucketId(collection, id, buckets) {
+  return `${collection}::${String(bucketIndex(collection, id, buckets))}`;
+}
+async function readBucket(store, vault, dek, bucket) {
+  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket);
+  if (!env) return { body: {}, version: 0 };
+  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek);
+  return { body: JSON.parse(json), version: env._v };
+}
+async function writeBucket(store, vault, dek, bucket, body, expectedVersion) {
+  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 };
+  const json = JSON.stringify(body);
+  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+  const env = buildRecordEnvelope(identity, { iv, data });
+  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || void 0);
+}
+
+// src/with-commit/vault-head/active.ts
+function withVaultHead(opts = {}) {
+  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS;
+  const dekFor = (getDEK) => getDEK(VAULT_HEAD_COLLECTION);
+  return {
+    enabled: true,
+    bucketFor: (collection, id) => bucketId(collection, id, buckets),
+    async note(store, vault, getDEK, entry) {
+      const dek = await dekFor(getDEK);
+      const bucket = bucketId(entry.collection, entry.id, buckets);
+      const { body, version } = await readBucket(store, vault, dek, bucket);
+      const key = `${entry.collection}/${entry.id}`;
+      if ((body[key] ?? -1) >= entry.version) return;
+      body[key] = entry.version;
+      await writeBucket(store, vault, dek, bucket, body, version);
+    },
+    async expected(store, vault, getDEK, collection, id) {
+      const dek = await dekFor(getDEK);
+      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets));
+      return body[`${collection}/${id}`] ?? null;
+    },
+    async knownIn(store, vault, getDEK, collection) {
+      const dek = await dekFor(getDEK);
+      const out = /* @__PURE__ */ new Map();
+      const prefix = `${collection}/`;
+      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {
+        if (!bucket.startsWith(`${collection}::`)) continue;
+        const { body } = await readBucket(store, vault, dek, bucket);
+        for (const [k, v] of Object.entries(body)) {
+          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v);
+        }
+      }
+      return out;
+    }
+  };
+}
+
+// src/with-commit/vault-head/verify.ts
+async function verifyVaultHead(head, store, vault, getDEK, collection) {
+  const known = await head.knownIn(store, vault, getDEK, collection);
+  const discrepancies = [];
+  for (const [id, expected] of known) {
+    const env = await store.get(vault, collection, id);
+    if (env === null) {
+      discrepancies.push({ collection, id, expected, actual: null, kind: "withheld" });
+      continue;
+    }
+    if (env._v < expected) {
+      discrepancies.push({ collection, id, expected, actual: env._v, kind: "rolled-back" });
+    }
+  }
+  return { checked: known.size, discrepancies, clean: discrepancies.length === 0 };
+}
+export {
+  DEFAULT_HEAD_BUCKETS,
+  NO_VAULT_HEAD,
+  VAULT_HEAD_COLLECTION,
+  verifyVaultHead,
+  withVaultHead
+};
+//# sourceMappingURL=index.js.map

package/dist/vault-head/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/with-commit/vault-head/head.ts","../../src/with-commit/vault-head/active.ts","../../src/with-commit/vault-head/verify.ts"],"sourcesContent":["/**\n * The vault head's storage layer (#1044).\n *\n * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it\n * inherits #1041's identity binding for free: the store cannot relocate a\n * bucket, re-author it, or serve one bucket's bytes as another's. What it can\n * still do is serve an OLD bucket, which is why {@link readBucket} enforces\n * monotonicity against the caller's own record of what it last wrote.\n *\n * @packageDocumentation\n */\nimport { encrypt, buildRecordAad, openEnvelopeJson, buildRecordEnvelope, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { VAULT_HEAD_COLLECTION } from './strategy.js'\n\n/** `{ recordId → version }` for one bucket. */\nexport type BucketBody = Record<string, number>\n\n/**\n * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands\n * in is not secret — the store already sees which bucket was written, and it\n * already saw the record's own address. Choosing something stronger would buy\n * nothing and cost every write.\n */\nexport function bucketIndex(collection: string, id: string, buckets: number): number {\n  let h = 0x811c9dc5\n  const s = `${collection}/${id}`\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  return h % buckets\n}\n\nexport function bucketId(collection: string, id: string, buckets: number): string {\n  return `${collection}::${String(bucketIndex(collection, id, buckets))}`\n}\n\nexport async function readBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n): Promise<{ body: BucketBody; version: number }> {\n  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket)\n  if (!env) return { body: {}, version: 0 }\n  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek)\n  return { body: JSON.parse(json) as BucketBody, version: env._v }\n}\n\nexport async function writeBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n  body: BucketBody,\n  expectedVersion: number,\n): Promise<void> {\n  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 }\n  const json = JSON.stringify(body)\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(identity, { iv, data })\n  // CAS: two writers racing on one bucket must not silently lose an entry.\n  // A lost head entry is a record the sweep stops expecting — a false clean.\n  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || undefined)\n}\n","/**\n * The real {@link VaultHeadStrategy} (#1044).\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport {\n  DEFAULT_HEAD_BUCKETS,\n  VAULT_HEAD_COLLECTION,\n  type HeadEntry,\n  type VaultHeadStrategy,\n  type WithVaultHeadOptions,\n} from './strategy.js'\nimport { bucketId, readBucket, writeBucket } from './head.js'\n\nexport function withVaultHead(opts: WithVaultHeadOptions = {}): VaultHeadStrategy {\n  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS\n\n  const dekFor = (getDEK: (c: string) => Promise<EnclaveKey>) => getDEK(VAULT_HEAD_COLLECTION)\n\n  return {\n    enabled: true,\n    bucketFor: (collection, id) => bucketId(collection, id, buckets),\n\n    async note(store: NoydbStore, vault, getDEK, entry: HeadEntry) {\n      const dek = await dekFor(getDEK)\n      const bucket = bucketId(entry.collection, entry.id, buckets)\n      const { body, version } = await readBucket(store, vault, dek, bucket)\n      const key = `${entry.collection}/${entry.id}`\n      // Monotonic: a head entry never moves BACKWARD. A write that would lower\n      // it is either a stale retry or a rollback being laundered through the\n      // client's own head, and neither should be recorded.\n      if ((body[key] ?? -1) >= entry.version) return\n      body[key] = entry.version\n      await writeBucket(store, vault, dek, bucket, body, version)\n    },\n\n    async expected(store, vault, getDEK, collection, id) {\n      const dek = await dekFor(getDEK)\n      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets))\n      return body[`${collection}/${id}`] ?? null\n    },\n\n    async knownIn(store, vault, getDEK, collection) {\n      const dek = await dekFor(getDEK)\n      const out = new Map<string, number>()\n      const prefix = `${collection}/`\n      // Sweep every bucket: a record's bucket is a function of its id, so the\n      // set for one collection is spread across all of them.\n      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {\n        if (!bucket.startsWith(`${collection}::`)) continue\n        const { body } = await readBucket(store, vault, dek, bucket)\n        for (const [k, v] of Object.entries(body)) {\n          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v)\n        }\n      }\n      return out\n    },\n  }\n}\n","/**\n * The sweep — comparing what the head expects against what the store serves (#1044).\n *\n * This is the only place absence becomes visible. #1041 and #1042 can reject a\n * record that lies about itself; neither can notice one that never arrived, or\n * one served at an older version than the client wrote. Both are indistinguishable\n * from the truth without an independent record of what should be there.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { VaultHeadStrategy } from './strategy.js'\n\n/** One record the store is not serving faithfully. */\nexport interface HeadDiscrepancy {\n  readonly collection: string\n  readonly id: string\n  /** What the client last committed. */\n  readonly expected: number\n  /**\n   * What the store serves now — or `null` when it serves nothing.\n   *\n   * The two are different attacks wearing the same result. `null` is\n   * **suppression**: the record is gone. A lower number is **rollback**: an\n   * authentic older version served in place of the current one, which is the\n   * case no amount of per-envelope authentication can see.\n   */\n  readonly actual: number | null\n  readonly kind: 'withheld' | 'rolled-back'\n}\n\nexport interface HeadVerifyResult {\n  readonly checked: number\n  readonly discrepancies: readonly HeadDiscrepancy[]\n  /** `true` when every record the head knows about is served at or above its expected version. */\n  readonly clean: boolean\n}\n\n/**\n * Sweep one collection.\n *\n * **A record the store serves that the head does NOT know is not reported.**\n * That is not an oversight: the head can be enabled on an existing vault, and\n * every pre-existing record would otherwise read as an anomaly. The head's\n * claim is one-directional — *what I wrote must still be there* — and an\n * unknown record simply falls outside it.\n *\n * **A HIGHER version than expected is also not reported**, for the same reason:\n * another device legitimately advanced it. The head detects going backwards, not\n * moving forwards.\n */\nexport async function verifyVaultHead(\n  head: VaultHeadStrategy,\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  collection: string,\n): Promise<HeadVerifyResult> {\n  const known = await head.knownIn(store, vault, getDEK, collection)\n  const discrepancies: HeadDiscrepancy[] = []\n\n  for (const [id, expected] of known) {\n    const env = await store.get(vault, collection, id)\n    if (env === null) {\n      discrepancies.push({ collection, id, expected, actual: null, kind: 'withheld' })\n      continue\n    }\n    if (env._v < expected) {\n      discrepancies.push({ collection, id, expected, actual: env._v, kind: 'rolled-back' })\n    }\n  }\n\n  return { checked: known.size, discrepancies, clean: discrepancies.length === 0 }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBO,SAAS,YAAY,YAAoB,IAAY,SAAyB;AACnF,MAAI,IAAI;AACR,QAAM,IAAI,GAAG,UAAU,IAAI,EAAE;AAC7B,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AACA,SAAO,IAAI;AACb;AAEO,SAAS,SAAS,YAAoB,IAAY,SAAyB;AAChF,SAAO,GAAG,UAAU,KAAK,OAAO,YAAY,YAAY,IAAI,OAAO,CAAC,CAAC;AACvE;AAEA,eAAsB,WACpB,OACA,OACA,KACA,QACgD;AAChD,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,uBAAuB,MAAM;AAChE,MAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE;AACxC,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,OAAO,GAAG,KAAK,GAAG;AAC/F,SAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,IAAI,GAAG;AACjE;AAEA,eAAsB,YACpB,OACA,OACA,KACA,QACA,MACA,iBACe;AACf,QAAM,WAAW,EAAE,YAAY,uBAAuB,IAAI,QAAQ,SAAS,kBAAkB,EAAE;AAC/F,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,MAAM,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAGtD,QAAM,MAAM,IAAI,OAAO,uBAAuB,QAAQ,KAAK,mBAAmB,MAAS;AACzF;;;ACjDO,SAAS,cAAc,OAA6B,CAAC,GAAsB;AAChF,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,SAAS,CAAC,WAA+C,OAAO,qBAAqB;AAE3F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,YAAY,OAAO,SAAS,YAAY,IAAI,OAAO;AAAA,IAE/D,MAAM,KAAK,OAAmB,OAAO,QAAQ,OAAkB;AAC7D,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,SAAS,SAAS,MAAM,YAAY,MAAM,IAAI,OAAO;AAC3D,YAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AACpE,YAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAI3C,WAAK,KAAK,GAAG,KAAK,OAAO,MAAM,QAAS;AACxC,WAAK,GAAG,IAAI,MAAM;AAClB,YAAM,YAAY,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO;AAAA,IAC5D;AAAA,IAEA,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,IAAI;AACnD,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,CAAC;AACtF,aAAO,KAAK,GAAG,UAAU,IAAI,EAAE,EAAE,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,QAAQ,YAAY;AAC9C,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,MAAM,oBAAI,IAAoB;AACpC,YAAM,SAAS,GAAG,UAAU;AAG5B,iBAAW,UAAU,MAAM,MAAM,KAAK,OAAO,qBAAqB,GAAG;AACnE,YAAI,CAAC,OAAO,WAAW,GAAG,UAAU,IAAI,EAAG;AAC3C,cAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,cAAI,EAAE,WAAW,MAAM,EAAG,KAAI,IAAI,EAAE,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,QAC7D;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACRA,eAAsB,gBACpB,MACA,OACA,OACA,QACA,YAC2B;AAC3B,QAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,UAAU;AACjE,QAAM,gBAAmC,CAAC;AAE1C,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,QAAI,QAAQ,MAAM;AAChB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,MAAM,MAAM,WAAW,CAAC;AAC/E;AAAA,IACF;AACA,QAAI,IAAI,KAAK,UAAU;AACrB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,IAAI,IAAI,MAAM,cAAc,CAAC;AAAA,IACtF;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,MAAM,MAAM,eAAe,OAAO,cAAc,WAAW,EAAE;AACjF;","names":[]}

package/dist/{walk-B4YFJJ7S.js → walk-HSS3NLQ3.js}

@@ -1,21 +1,21 @@
 import {
   dumpVaultSchema
-} from "./chunk-MKV2KYRV.js";
+} from "./chunk-ER3BQCCE.js";
 import "./chunk-KHKKD62N.js";
 import "./chunk-HNOBRU24.js";
 import "./chunk-Y2NBBT6K.js";
-import "./chunk-A3WHDOWI.js";
-import "./chunk-LTVETWDH.js";
-import "./chunk-6E2JZRBD.js";
+import "./chunk-IN5EZWYQ.js";
+import "./chunk-X3AXSYBL.js";
+import "./chunk-ZVAFJQZB.js";
 import "./chunk-FSZPQCDR.js";
 import "./chunk-HVR74IBG.js";
 import "./chunk-RBTZLXZJ.js";
 import "./chunk-LP7BEXCT.js";
 import "./chunk-QTDAPDDV.js";
-import "./chunk-SFY6NT7D.js";
+import "./chunk-3Y4OFWQJ.js";
 import "./chunk-I64WQSN3.js";
 import "./chunk-PZ5AY32C.js";
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=walk-B4YFJJ7S.js.map
+//# sourceMappingURL=walk-HSS3NLQ3.js.map

package/dist/with-audit/periods/periods.d.ts

@@ -501,7 +501,7 @@ export interface ReadOnlyCollection<T> {
  * @internal — called by Vault methods that need the closed-period
  * cache. Not part of the public API surface.
  */
-export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt: (envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
+export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
 /**
  * Given the current ordered period list, pick the last entry that
  * belongs to the hash chain — used as the `priorPeriodHash` anchor

package/dist/with-audit/periods/strategy.d.ts

@@ -17,7 +17,7 @@ import type { PeriodRecord, PeriodPartition, PartitionResolver } from './periods
  * @internal
  */
 export interface PeriodsStrategy {
-    loadPeriods(adapter: NoydbStore, vault: string, decrypt: (envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
+    loadPeriods(adapter: NoydbStore, vault: string, decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
     chainAnchor(records: readonly PeriodRecord[], partition?: PeriodPartition): Promise<{
         priorPeriodName?: string;
         priorPeriodHash: string;

package/dist/with-audit/sealed-record/index.d.ts

@@ -46,10 +46,23 @@ export { SealedRecordNotEnabledError } from '../../kernel/errors.js';
  * @param expectedCollection Collection the caller believes `recordEnvelope` is in.
  * @param expectedId         Record id the caller believes `recordEnvelope` is.
  * @returns The decrypted record body as a JSON string.
+ *
+ * ⚠️ **`recordEnvelope` must carry `_tier` and `_by`, not just the body**
+ * (#1041). They are plaintext metadata rather than secrets, but they are bound
+ * into the record's AAD, so a host handed only `{_iv, _data}` cannot
+ * reconstruct the identity the body was sealed against.
+ *
+ * That is a feature, not a tax: it means a host cannot be fed a body with its
+ * tags stripped or rewritten — a re-tiered or re-authored envelope no longer
+ * opens, even with a valid sealed CEK.
  */
 export declare function openSealedRecord(sealedCekEnvelope: SealedCekDeliveryEnvelope, recordEnvelope: {
     readonly _iv: string;
     readonly _data: string;
+    /** Bound into the AAD since #1093 — a rewound body no longer opens. */
+    readonly _v: number;
+    readonly _tier?: number | undefined;
+    readonly _by?: string | undefined;
 }, recipientSealer: {
     unseal(bytes: Uint8Array): Promise<Uint8Array>;
 }, expectedCollection: string, expectedId: string): Promise<string>;

package/dist/with-audit/tiers/index.d.ts

@@ -23,7 +23,7 @@
 export { withTiers } from './active.js';
 export { NO_TIERS, type TiersStrategy } from './strategy.js';
 export { TiersNotEnabledError } from '../../kernel/errors.js';
-import { type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js';
+import { type RecordIdentity, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
 import type { Lru } from '../../kernel/cache/index.js';
 import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
@@ -123,7 +123,22 @@ export interface TiersContext<T> {
      * pre-move body whenever `fromTier > 0`. No-op when history is disabled
      * (folds the `historyConfig.enabled` gate so `tiers/index.ts` stays simple).
      */
-    saveHistorySnapshot(id: string, envelope: EncryptedEnvelope): Promise<void>;
+    /**
+     * Persist a `_history` snapshot of `version`, sealed against the address it
+     * will be STORED at (#1041).
+     *
+     * Takes a **sealer**, not a finished envelope, because the destination
+     * identity is not knowable here: only the history strategy owns the
+     * `_history` layout. It hands the address in; the caller seals to it.
+     *
+     * ⚠️ The identity passed to `rewrapBodyToDek` must be what a READER will
+     * recompute — `recordAadFor(address, finalEnvelope)`. A tier-move snapshot
+     * strips `_tier`/`_elevatedBy` but KEEPS `_by`, so the destination is
+     * `{...address, by: envelope._by}` with no tier. Sealing against the bare
+     * address would produce history nothing can open, and the failure would
+     * surface only when someone reads it.
+     */
+    saveHistorySnapshot(id: string, version: number, seal: (address: RecordIdentity) => Promise<EncryptedEnvelope>): Promise<void>;
     /**
      * `true` iff a real history strategy is wired (not `NO_HISTORY`) AND not
      * explicitly disabled via `historyConfig.enabled`. `putAtTier` checks this

package/dist/with-commit/history/history.d.ts

@@ -1,5 +1,31 @@
+import type { RecordIdentity } from '../../kernel/enclave/index.js';
 import type { NoydbStore, EncryptedEnvelope, HistoryOptions, PruneOptions } from '../../kernel/types.js';
 import { type EnclaveKey } from '../../kernel/enclave/index.js';
+/**
+ * The identity a history snapshot is **sealed against** — its STORAGE location,
+ * not the live record it is a copy of (#1041).
+ *
+ * ## Why storage, and why this is a decision rather than a detail
+ *
+ * A snapshot is a copy, so two identities are available: the live record
+ * (`collection`/`recordId`) or where the bytes actually land
+ * (`_history`/`historyId(...)`). They are not equivalent under attack.
+ *
+ * Binding the LIVE identity makes a snapshot's AAD **indistinguishable from the
+ * live record's at the same version** — so an untrusted store could serve a
+ * history entry *as the current record* and the client would accept it. It also
+ * leaves entries relocatable within `_history`.
+ *
+ * Binding STORAGE identity closes both. The cost is that the id must be known
+ * *before* the envelope is sealed, where `saveHistory` previously derived it
+ * *after* (from `envelope._v`) — which is precisely the restructure this
+ * function exists to make possible.
+ *
+ * `saveHistory` uses this too, so the sealed identity and the put location have
+ * **one definition** and cannot drift apart. Changing the layout here changes
+ * both at once, by construction.
+ */
+export declare function historyIdentity(collection: string, recordId: string, version: number): RecordIdentity;
 /** Save a history entry (a complete encrypted envelope snapshot). */
 export declare function saveHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, envelope: EncryptedEnvelope): Promise<void>;
 /** Get history entries for a record, sorted newest-first. */

package/dist/with-commit/history/index.d.ts

@@ -17,7 +17,7 @@
  */
 export { withHistory } from './active.js';
 export type { HistoryStrategy } from './strategy.js';
-export { saveHistory, getHistory, getVersionEnvelope, pruneHistory, clearHistory, } from './history.js';
+export { saveHistory, historyIdentity, getHistory, getVersionEnvelope, pruneHistory, clearHistory, } from './history.js';
 export { diff, formatDiff } from './diff.js';
 export type { ChangeType, DiffEntry } from './diff.js';
 export { LedgerStore, LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, envelopePayloadHash, } from './ledger/store.js';
@@ -30,3 +30,4 @@ export { VaultInstant, CollectionInstant } from './time-machine.js';
 export type { VaultEngine } from './time-machine.js';
 /** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
 export { NO_HISTORY } from './strategy.js';
+export type { RecordIdentity } from '../../kernel/enclave/index.js';

package/dist/with-commit/history/ledger/store.d.ts

@@ -237,7 +237,13 @@ export declare class LedgerStore {
      * version/timestamp/actor) fully intact for audit purposes.
      */
     purgeRecordDeltas(collection: string, id: string): Promise<number>;
-    /** Encrypt a JSON Patch into an envelope for storage. Mirrors encryptEntry. */
+    /**
+     * Encrypt a JSON Patch into an envelope for storage. Mirrors encryptEntry.
+     *
+     * `index` is the ledger index this delta will be stored under — the caller
+     * knows it before the entry exists, and it is what makes the envelope's
+     * identity bindable (#1051).
+     */
     private encryptDelta;
     /**
      * Read all entries in ascending-index order. Used internally by

package/dist/with-commit/history/strategy.d.ts

@@ -33,7 +33,7 @@ import type { LedgerStore } from './ledger/store.js';
 import type { JsonPatch } from './ledger/patch.js';
 import type { DiffEntry } from './diff.js';
 import type { VaultInstant, VaultEngine } from './time-machine.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey, RecordIdentity } from '../../kernel/enclave/index.js';
 /**
  * Options accepted by `HistoryStrategy.buildLedger`. Mirrors the
  * `LedgerStore` constructor verbatim — kept in this file so `core`
@@ -58,6 +58,16 @@ export interface HistoryStrategy {
      * `NO_HISTORY`.
      */
     saveHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, envelope: EncryptedEnvelope): Promise<void>;
+    /**
+     * The identity a snapshot of `collection/recordId@version` must be **sealed
+     * against** — its `_history` storage location (#1041).
+     *
+     * On the port because the kernel writes history snapshots but must not import
+     * `with-commit` to learn its layout. Exposing it here keeps the derivation in
+     * the module that owns the layout, and `saveHistory` uses the same function,
+     * so the sealed identity and the put location cannot drift.
+     */
+    historyIdentity(collection: string, recordId: string, version: number): RecordIdentity;
     /**
      * List history envelopes for a record, newest first. Throws under
      * `NO_HISTORY` — callers reach this via `collection.history()` /

package/dist/with-commit/vault-head/active.d.ts

@@ -0,0 +1,2 @@
+import { type VaultHeadStrategy, type WithVaultHeadOptions } from './strategy.js';
+export declare function withVaultHead(opts?: WithVaultHeadOptions): VaultHeadStrategy;

package/dist/with-commit/vault-head/head.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The vault head's storage layer (#1044).
+ *
+ * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it
+ * inherits #1041's identity binding for free: the store cannot relocate a
+ * bucket, re-author it, or serve one bucket's bytes as another's. What it can
+ * still do is serve an OLD bucket, which is why {@link readBucket} enforces
+ * monotonicity against the caller's own record of what it last wrote.
+ *
+ * @packageDocumentation
+ */
+import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import type { NoydbStore } from '../../kernel/types.js';
+/** `{ recordId → version }` for one bucket. */
+export type BucketBody = Record<string, number>;
+/**
+ * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands
+ * in is not secret — the store already sees which bucket was written, and it
+ * already saw the record's own address. Choosing something stronger would buy
+ * nothing and cost every write.
+ */
+export declare function bucketIndex(collection: string, id: string, buckets: number): number;
+export declare function bucketId(collection: string, id: string, buckets: number): string;
+export declare function readBucket(store: NoydbStore, vault: string, dek: EnclaveKey, bucket: string): Promise<{
+    body: BucketBody;
+    version: number;
+}>;
+export declare function writeBucket(store: NoydbStore, vault: string, dek: EnclaveKey, bucket: string, body: BucketBody, expectedVersion: number): Promise<void>;

package/dist/with-commit/vault-head/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `@noy-db/hub/vault-head` — detect a store that WITHHOLDS (#1044).
+ *
+ * @packageDocumentation
+ */
+export { withVaultHead } from './active.js';
+export { verifyVaultHead, type HeadDiscrepancy, type HeadVerifyResult } from './verify.js';
+export { NO_VAULT_HEAD, VAULT_HEAD_COLLECTION, DEFAULT_HEAD_BUCKETS, type VaultHeadStrategy, type WithVaultHeadOptions, type HeadEntry, } from './strategy.js';
+export type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
+export type { EnclaveKey } from '../../kernel/enclave/index.js';

package/dist/with-commit/vault-head/strategy.d.ts

@@ -0,0 +1,127 @@
+/**
+ * `withVaultHead()` — the opt-in detector for **omission** (#1044).
+ *
+ * ## What it is for, and what it deliberately is not
+ *
+ * #1041 made every envelope self-authenticating at its identity, and #1042
+ * made the merge reject one that is not. What neither can catch is **absence**:
+ * a store that serves a genuine, unmodified `v1` when `v7` exists, or serves
+ * nothing at all. An authentic old envelope is indistinguishable from an
+ * authentic current one without external knowledge of what *should* be there.
+ *
+ * The head is that external knowledge: an authenticated `{id → version}`
+ * manifest the client writes and the store cannot forge. It is **not** a Merkle
+ * chain over content — content integrity is already handled, so the head needs
+ * only versions.
+ *
+ * ## Why it is opt-in when AAD is not
+ *
+ * AAD costs nothing to coordinate and closes *alteration*, so it is kernel. The
+ * head costs a write per commit and needs anti-entropy; on a single-device
+ * offline vault it defends against nothing. Making it kernel would tax every
+ * user for a multi-writer property. ADR 0003, Decision 3.
+ *
+ * `SECURITY.md` states the split exactly: a store cannot alter, relocate,
+ * re-tier, re-author or rewind a record; **without `withVaultHead()` it can
+ * still withhold or omit.**
+ *
+ * ## Bucketed, and why that is not a compromise
+ *
+ * ADR 0003 left head granularity open and asked for it to be sized early.
+ * Measured, at the documented 50K-record vault ceiling:
+ *
+ * | shape | write cost per commit | detection |
+ * |---|---|---|
+ * | one per-vault manifest | **1.1 MiB** | per-record |
+ * | one per collection | the same problem, renamed | per-record |
+ * | **bucketed, 256 buckets** | **~4.4 KiB** | per-record |
+ *
+ * Bucketing changes *only* write amplification. Each bucket still lists every
+ * one of its records' versions, so detection stays per-record — which is why
+ * this is not a trade-off between cost and strength. Verifying one pulled
+ * record reads one bucket rather than a megabyte.
+ *
+ * ## Wired as a bus OBSERVER, not a call in `collection.ts`
+ *
+ * That is what `kernel-surface` means by "register on the ServiceBus instead of
+ * growing this file", and it keeps the hot write path untouched for anyone who
+ * has not opted in: nothing is registered at all, so `hasHandlers` stays false
+ * and the dispatch never happens.
+ *
+ * Both `afterPut` AND `afterDelete`, because a delete is a version bump like
+ * any other. A head that stopped tracking deleted records would let a store
+ * resurrect one by withholding the tombstone — precisely the omission this
+ * exists to catch.
+ *
+ * ⚠️ The registration must be UNCONDITIONAL on anything but `enabled`. Its first
+ * draft sat inside `#registerForgetHooks()`, which returns early when no forget
+ * subjects are declared, so the head silently recorded nothing unless the vault
+ * happened to use an unrelated feature. The tests caught it only because they
+ * asserted a COUNT rather than "no error" — a head that records nothing raises
+ * no errors and sweeps perfectly clean.
+ *
+ * @packageDocumentation
+ */
+import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
+import type { EnclaveKey } from '../../kernel/enclave/index.js';
+/** Reserved collection the head's buckets live in. */
+export declare const VAULT_HEAD_COLLECTION: "_head";
+/** Default bucket count — see the sizing table above. */
+export declare const DEFAULT_HEAD_BUCKETS = 256;
+export interface WithVaultHeadOptions {
+    /**
+     * How many buckets the manifest is split across. Higher means smaller writes
+     * and more reads to sweep the whole vault; lower means the opposite.
+     * Changing it on an existing vault re-homes every entry, so treat it as a
+     * layout decision rather than a tuning knob.
+     */
+    readonly buckets?: number;
+}
+/** One record's expected state, as the client last committed it. */
+export interface HeadEntry {
+    readonly collection: string;
+    readonly id: string;
+    readonly version: number;
+}
+export interface VaultHeadStrategy {
+    /**
+     * Is the head actually keeping a manifest?
+     *
+     * An explicit flag rather than an identity check against the stub: the kernel
+     * decides whether to register the write-path observer at all, and
+     * `port-layering` forbids it importing `NO_VAULT_HEAD` to compare. Without
+     * this, every write in a vault that never opted in would still pay a cache
+     * lookup and a no-op call.
+     */
+    readonly enabled: boolean;
+    /** Bucket a record id lands in — pure, so callers can pre-group a batch. */
+    bucketFor(collection: string, id: string): string;
+    /**
+     * Record `entry` as the client's expectation for that record.
+     *
+     * Called on every committed write, INSIDE the same logical operation, so
+     * there is no window where the record exists and the head does not know it.
+     */
+    note(store: NoydbStore, vault: string, getDEK: (collection: string) => Promise<EnclaveKey>, entry: HeadEntry): Promise<void>;
+    /**
+     * What the client expects for `collection/id`, or `null` if the head has
+     * never seen it.
+     */
+    expected(store: NoydbStore, vault: string, getDEK: (collection: string) => Promise<EnclaveKey>, collection: string, id: string): Promise<number | null>;
+    /**
+     * Every record the head knows about in `collection` — the set a sweep
+     * compares against what the store actually serves, which is how DELETION
+     * SUPPRESSION is caught. A withheld record is absent from the store but
+     * present here.
+     */
+    knownIn(store: NoydbStore, vault: string, getDEK: (collection: string) => Promise<EnclaveKey>, collection: string): Promise<ReadonlyMap<string, number>>;
+}
+/**
+ * The un-opted-in stub. `note` is a NO-OP rather than a throw: the write path
+ * calls it unconditionally, and a vault without the head must simply not keep
+ * one. The READ side throws, because asking what the head expects when there is
+ * no head is a caller error, not a silent "nothing to report" — the latter
+ * would look exactly like a clean sweep.
+ */
+export declare const NO_VAULT_HEAD: VaultHeadStrategy;
+export type { EncryptedEnvelope };

package/dist/with-commit/vault-head/verify.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The sweep — comparing what the head expects against what the store serves (#1044).
+ *
+ * This is the only place absence becomes visible. #1041 and #1042 can reject a
+ * record that lies about itself; neither can notice one that never arrived, or
+ * one served at an older version than the client wrote. Both are indistinguishable
+ * from the truth without an independent record of what should be there.
+ *
+ * @packageDocumentation
+ */
+import type { NoydbStore } from '../../kernel/types.js';
+import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { VaultHeadStrategy } from './strategy.js';
+/** One record the store is not serving faithfully. */
+export interface HeadDiscrepancy {
+    readonly collection: string;
+    readonly id: string;
+    /** What the client last committed. */
+    readonly expected: number;
+    /**
+     * What the store serves now — or `null` when it serves nothing.
+     *
+     * The two are different attacks wearing the same result. `null` is
+     * **suppression**: the record is gone. A lower number is **rollback**: an
+     * authentic older version served in place of the current one, which is the
+     * case no amount of per-envelope authentication can see.
+     */
+    readonly actual: number | null;
+    readonly kind: 'withheld' | 'rolled-back';
+}
+export interface HeadVerifyResult {
+    readonly checked: number;
+    readonly discrepancies: readonly HeadDiscrepancy[];
+    /** `true` when every record the head knows about is served at or above its expected version. */
+    readonly clean: boolean;
+}
+/**
+ * Sweep one collection.
+ *
+ * **A record the store serves that the head does NOT know is not reported.**
+ * That is not an oversight: the head can be enabled on an existing vault, and
+ * every pre-existing record would otherwise read as an anomaly. The head's
+ * claim is one-directional — *what I wrote must still be there* — and an
+ * unknown record simply falls outside it.
+ *
+ * **A HIGHER version than expected is also not reported**, for the same reason:
+ * another device legitimately advanced it. The head detects going backwards, not
+ * moving forwards.
+ */
+export declare function verifyVaultHead(head: VaultHeadStrategy, store: NoydbStore, vault: string, getDEK: (collection: string) => Promise<EnclaveKey>, collection: string): Promise<HeadVerifyResult>;

package/dist/with-party/directory/cover/storage.d.ts

@@ -1,11 +1,3 @@
-/**
- * Persistence helpers for `_meta/public-envelope` — the cover's
- * frozen wire location. Mirrors the bypass-AES pattern used by
- * `_meta/handle` and `_meta/policy` — the document is plaintext
- * JSON, the envelope's `_iv` field is left empty.
- *
- * @module
- */
 import type { NoydbStore } from '../../../kernel/types.js';
 import type { Cover } from './types.js';
 /**

package/dist/with-party/directory/storage.d.ts

@@ -1,14 +1,3 @@
-/**
- * Persistence helpers for the vault-level user-directory toggle
- * (`_meta/directory`). Mirrors the bypass-AES pattern used by
- * `_meta/policy` — the directory document is plain JSON, the
- * envelope's `_iv` field is left empty.
- *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/plaintext-bypass.md — every `_iv: ''` write site
- *
- * @module
- */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { DirectoryConfig } from './types.js';
 /** Reserved collection name for vault-level metadata documents. */

package/dist/with-party/directory/visibility.d.ts

@@ -1,24 +1,3 @@
-/**
- * Persistence helpers for the per-user visibility flag
- * (`_meta/visibility/<keyringId>`). Mirrors the bypass-AES pattern used
- * by `_meta/policy` — the visibility document is plain JSON, the
- * envelope's `_iv` field is left empty.
- *
- * Stored alongside the keyring file rather than inside the encrypted
- * user envelope (`_users/<keyringId>`) because:
- *
- *  - `UserEnvelope<T>.data` is opaque-to-hub by contract — hub does not
- *    introspect or reserve any keys inside it. Adding `hidden` there
- *    would violate that contract.
- *  - `listUsersWithEnvelopes` filters by the flag, and the filter must
- *    work even when decryption fails (legacy keyrings predating the
- *    envelope feature, or a corrupted envelope).
- *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/plaintext-bypass.md — every `_iv: ''` write site
- *
- * @module
- */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { UserVisibility } from './types.js';
 /** Prefix for per-user visibility records inside `_meta`. */

package/dist/with-party/policy/storage.d.ts

@@ -1,13 +1,3 @@
-/**
- * Persistence helpers for the vault-level policy document
- * (`_meta/policy`). Mirrors the bypass-AES pattern used by
- * `_meta/handle` — the policy document is plain JSON, the envelope's
- * `_iv` field is left empty.
- *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Storage location
- *
- * @module
- */
 import type { NoydbStore, VaultPolicy } from '../../kernel/types.js';
 /** Reserved collection name for vault-level metadata documents. */
 export declare const META_COLLECTION = "_meta";

package/dist/with-party/team/keyring.d.ts

@@ -9,6 +9,11 @@ export interface UnlockedKeyring {
     readonly role: Role;
     readonly permissions: Permissions;
     readonly deks: Map<string, EnclaveKey>;
+    /**
+     * Unwrapped counterpart of {@link KeyringFile.pending_deks} — an
+     * uncommitted rotation (#1074). Empty in the normal state.
+     */
+    readonly pendingDeks?: Map<string, EnclaveKey> | undefined;
     /**
      * The KEK, when this keyring was unlocked via tier 1 (secret) or
      * a wrap-KEK tier-2 method (WebAuthn / OIDC). `null` when the