@noy-db/hub 0.6.0-pre.16 → 0.6.0-pre.18

package/dist/{chunk-KKRFL5E2.js → chunk-GSRW5MTU.js}

@@ -1,3 +1,10 @@
+import {
+  LinkIntegrityError,
+  declareLink,
+  isLinkCollectionName,
+  linkCollectionName,
+  linkRowKey
+} from "./chunk-S6CP5FWF.js";
 import {
   hashFields,
   validateSatelliteDeclaration
@@ -9,38 +16,42 @@ import {
   isManifestReservedCollection
 } from "./chunk-EPFF7LOX.js";
 import {
-  LinkIntegrityError,
-  declareLink,
-  isLinkCollectionName,
-  linkCollectionName,
-  linkRowKey
-} from "./chunk-S6CP5FWF.js";
+  VectorSet,
+  buildPersistedIndexCallbacks,
+  encodeVecId,
+  syncTierSearch
+} from "./chunk-JYFJNSTW.js";
 import {
   isBaseLive,
   liveBaseIdSet
 } from "./chunk-GYGLAVCX.js";
 import {
   loadFence
-} from "./chunk-4VRZDYRE.js";
+} from "./chunk-HJRTFXAA.js";
 import {
-  VectorSet,
-  buildPersistedIndexCallbacks,
-  encodeVecId,
-  syncTierSearch
-} from "./chunk-343FH4S5.js";
+  fallbackDerivationName,
+  jsonSchemaToFields
+} from "./chunk-KHKKD62N.js";
+import {
+  derivePersistedSchema,
+  isZod4Schema
+} from "./chunk-HNOBRU24.js";
 import {
   SchemaUpdateGate
 } from "./chunk-6LJY7X5A.js";
+import {
+  NO_ATTESTATION
+} from "./chunk-TQLYMYOK.js";
 import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-6UAVKAG6.js";
+} from "./chunk-6QCXMCLZ.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-UVFO25FJ.js";
+} from "./chunk-NAAPSNCS.js";
 import {
   NO_PORTABILITY
 } from "./chunk-TQ7IRULX.js";
@@ -50,22 +61,20 @@ import {
 } from "./chunk-42IDLU5V.js";
 import {
   saveSealedSecret
-} from "./chunk-55B3KHZW.js";
-import {
-  fallbackDerivationName,
-  jsonSchemaToFields
-} from "./chunk-KHKKD62N.js";
-import {
-  derivePersistedSchema,
-  isZod4Schema
-} from "./chunk-HNOBRU24.js";
+} from "./chunk-NRNTXBHT.js";
 import {
   loadPersistedSchema
-} from "./chunk-A3WHDOWI.js";
+} from "./chunk-IN5EZWYQ.js";
+import {
+  NO_SEQUENCE,
+  SEQUENCE_COLLECTION,
+  compileSequenceFormat,
+  resolveSequenceKey
+} from "./chunk-AA2WWTS3.js";
 import {
   CustodyApi,
   NO_CUSTODY
-} from "./chunk-IGE6XWKK.js";
+} from "./chunk-VXVKEWYC.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
@@ -93,17 +102,14 @@ import {
   selfWriteFieldEqual,
   touchFor,
   updateReferencingRecords
-} from "./chunk-OPGKH5RD.js";
+} from "./chunk-NFPSC2HL.js";
 import {
   OverlayedCollection
 } from "./chunk-RDPZMUCX.js";
 import {
   INDEXED_STORE_POLICY,
   NO_SYNC
-} from "./chunk-JN64WH3U.js";
-import {
-  NO_ATTESTATION
-} from "./chunk-TQLYMYOK.js";
+} from "./chunk-T7IR4N2S.js";
 import {
   NO_CONSENT
 } from "./chunk-PEOZ34EM.js";
@@ -114,7 +120,7 @@ import {
   resolvePeriodKey,
   resolveReopenState,
   samePartition
-} from "./chunk-TTAND7MR.js";
+} from "./chunk-PBRIHUQ5.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
@@ -140,13 +146,10 @@ import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH
-} from "./chunk-4JDTLWUZ.js";
+} from "./chunk-DFFSCYIW.js";
 import {
-  NO_SEQUENCE,
-  SEQUENCE_COLLECTION,
-  compileSequenceFormat,
-  resolveSequenceKey
-} from "./chunk-RRMXMJUP.js";
+  NO_SEALED_RECORD
+} from "./chunk-QLMUW7OC.js";
 import {
   Query,
   ScanBuilder
@@ -156,7 +159,7 @@ import {
   NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-LGGLPURL.js";
+} from "./chunk-DWO55ZWE.js";
 import {
   LazyQuery,
   NO_INDEXING,
@@ -185,7 +188,7 @@ import {
 } from "./chunk-PVEWA2DU.js";
 import {
   dictCollectionName
-} from "./chunk-IQGIPRSE.js";
+} from "./chunk-CFTPERGL.js";
 import {
   NO_I18N,
   getAtPath,
@@ -193,11 +196,11 @@ import {
   isDictKeyDescriptor,
   isI18nTextDescriptor,
   isStaticDictDescriptor
-} from "./chunk-7LLKPODL.js";
+} from "./chunk-LPAGIMXJ.js";
 import {
   isViaInstalled,
   viaBinder
-} from "./chunk-RVTOCAHQ.js";
+} from "./chunk-SQSZRCYT.js";
 import {
   NO_TEAM,
   describeAllUsersAuth,
@@ -220,7 +223,7 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-OJEDR25M.js";
+} from "./chunk-BVIGGV6D.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -235,11 +238,11 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-LJDW6LQJ.js";
+} from "./chunk-ZSOTZ2RZ.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-PZLIA5R3.js";
+} from "./chunk-ITXPKEDP.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
@@ -252,15 +255,19 @@ import {
 } from "./chunk-4AOERLTV.js";
 import {
   NO_HISTORY
-} from "./chunk-AFHQATY4.js";
+} from "./chunk-UIYZ5SOU.js";
+import {
+  sha256Hex
+} from "./chunk-FY33DKPH.js";
 import {
   assertCutoverTierSafe,
   assertTierWritable,
+  dekKey,
   liveRecordIsElevated
-} from "./chunk-AMKCY454.js";
+} from "./chunk-7WD2G6K4.js";
 import {
-  sha256Hex
-} from "./chunk-53PWELSC.js";
+  NO_VAULT_HEAD
+} from "./chunk-HK67PX4J.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -269,35 +276,36 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-35RIRCGW.js";
-import {
-  NO_SEALED_RECORD
-} from "./chunk-QLMUW7OC.js";
+} from "./chunk-KLVGF2D4.js";
 import {
   RecordCodec,
   SEALED_CEK_NS,
+  applyRewrappedBody,
+  buildRecordAad,
   findByDet,
   hasPerRecordKey,
+  hasSealedBody,
   makeReservedEnvelopes,
   openEnvelopeJson,
   queryByDet,
   resolveStableCek,
-  validateSchemaInput
-} from "./chunk-LTVETWDH.js";
+  rewrapBodyToDek,
+  validateSchemaInput,
+  verifyRecordIdentity
+} from "./chunk-X3AXSYBL.js";
 import {
   buildDeleteMarker,
   buildRecordEnvelope,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-6E2JZRBD.js";
+} from "./chunk-ZVAFJQZB.js";
 import {
   encrypt
 } from "./chunk-QTDAPDDV.js";
 import {
-  NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-SFY6NT7D.js";
+} from "./chunk-3Y4OFWQJ.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -342,6 +350,35 @@ import {
   isConflictError
 } from "./chunk-I64WQSN3.js";
 
+// src/kernel/merge-authority.ts
+function buildMergeAuthority(keyring) {
+  return {
+    verify: async (collection, id, envelope) => {
+      const dek = keyring.deks.get(dekKey(collection, envelope._tier ?? 0));
+      if (dek === void 0) return true;
+      return verifyRecordIdentity({ collection, id }, envelope, dek);
+    },
+    advance: async (collection, id, envelope, toVersion) => {
+      if (!hasSealedBody(envelope)) return { ...envelope, _v: toVersion };
+      const dek = keyring.deks.get(dekKey(collection, envelope._tier ?? 0));
+      if (dek === void 0) {
+        throw new ValidationError(
+          `sync: cannot advance "${collection}/${id}" past the remote \u2014 no key for it, so its body cannot be re-sealed at the new version. The local copy is unchanged.`
+        );
+      }
+      const from = {
+        collection,
+        id,
+        version: envelope._v,
+        ...envelope._tier !== void 0 ? { tier: envelope._tier } : {},
+        ...envelope._by !== void 0 ? { by: envelope._by } : {}
+      };
+      const body = await rewrapBodyToDek(from, { ...from, version: toVersion }, envelope, dek, dek);
+      return { ...applyRewrappedBody(envelope, body), _v: toVersion };
+    }
+  };
+}
+
 // src/with-commit/tx/strategy.ts
 var NOT_ENABLED = new Error(
   'Multi-record transactions require the tx strategy. Import `{ withTransactions }` from "@noy-db/hub/transactions" and pass it to `createNoydb({ transactionsStrategy: withTransactions() })`.'
@@ -377,6 +414,7 @@ var STRATEGY_DEFAULTS = {
   custody: NO_CUSTODY,
   forget: NO_FORGET,
   history: NO_HISTORY,
+  vaultHead: NO_VAULT_HEAD,
   i18n: NO_I18N,
   indexing: NO_INDEXING,
   lazy: IMPLICIT_LAZY,
@@ -470,7 +508,7 @@ function validateSecretModeOptions(options) {
 }
 async function resolveEffectiveSecret(options, store, vault) {
   if (options.secretMode === "managed") {
-    const { resolveManagedSecret } = await import("./managed-secret-IDAOXSSX.js");
+    const { resolveManagedSecret } = await import("./managed-secret-7WIIVMJ5.js");
     return resolveManagedSecret(store, vault, options.sealingKey);
   }
   return options.secret;
@@ -488,7 +526,7 @@ function ownerKeyringOptions(options, secret) {
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-RGHCIRWV.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-7H62VO2C.js");
   return new StoreCoordinationProvider(store);
 }
 
@@ -943,13 +981,13 @@ async function applyCutoverTransform(ctx) {
   for (const id of ids) {
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env || isTombstone(env, ctx.storeCiphertext) || isDeleteMarker(env)) continue;
-    const decoded = await ctx.codec.decryptRecord(env, { skipValidation: true, id });
+    const decoded = await ctx.codec.decryptRecord({ collection: ctx.name, id }, env, { skipValidation: true });
     if (decoded === null) continue;
     const record = decoded;
     const next = ctx.transform(record);
     const nextVersion = (env._v ?? 0) + 1;
     const cek = ctx.perRecordCek ? await ctx.resolveRecordCek(id) : void 0;
-    const migEnvelope = await ctx.codec.encryptRecord(next, nextVersion, cek, void 0, void 0, ctx.vdigFields !== null ? { id, prev: env } : void 0, id);
+    const migEnvelope = await ctx.codec.encryptRecord({ collection: ctx.name, id }, next, nextVersion, cek, void 0, void 0, ctx.vdigFields !== null ? { id, prev: env } : void 0);
     await ctx.adapter.put(ctx.vault, ctx.name, id, migEnvelope);
     await ctx.onRecordMutated(id, "put", "cutover");
     if (ctx.ledger) {
@@ -1055,7 +1093,7 @@ async function rebuildIndexes(ctx) {
     const envelope = await ctx.adapter.get(ctx.vault, ctx.name, recordId);
     if (!envelope) continue;
     if ((envelope._tier ?? 0) > 0) continue;
-    const record = await ctx.codec.decryptRecord(envelope, { skipValidation: true, id: recordId });
+    const record = await ctx.codec.decryptRecord({ collection: ctx.name, id: recordId }, envelope, { skipValidation: true });
     if (record === null) continue;
     await maintainPersistedIndexesOnPut(ctx, recordId, record, null, envelope._v);
   }
@@ -1089,7 +1127,7 @@ async function reconcileIndex(ctx, field, opts = {}) {
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env) continue;
     try {
-      const sidecarJson = await ctx.codec.decryptJsonString(env);
+      const sidecarJson = await ctx.codec.decryptJsonString({ collection: ctx.name, id }, env);
       if (sidecarJson === null) {
         sidecar.set(decoded.recordId, void 0);
       } else {
@@ -1109,7 +1147,7 @@ async function reconcileIndex(ctx, field, opts = {}) {
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env) continue;
     if ((env._tier ?? 0) > 0) continue;
-    const record = await ctx.codec.decryptRecord(env, { skipValidation: true, id });
+    const record = await ctx.codec.decryptRecord({ collection: ctx.name, id }, env, { skipValidation: true });
     if (record === null) continue;
     const live = readPersistedValue(record, field);
     const stored = sidecar.get(id);
@@ -1170,7 +1208,7 @@ async function maintainPersistedIndexesOnPut(ctx, id, newRecord, previousRecord,
           recordId: id,
           writtenAt: (/* @__PURE__ */ new Date()).toISOString()
         });
-        const envelope = await ctx.codec.encryptJsonString(body, version);
+        const envelope = await ctx.codec.encryptJsonString({ collection: ctx.name, id: idxId }, body, version);
         await ctx.adapter.put(ctx.vault, ctx.name, idxId, envelope);
       }
     } catch (cause) {
@@ -1239,7 +1277,7 @@ async function resolveTierSyncPrior(ctx, id, priorEnvelope) {
   const cached = ctx.cache.get(id)?.record;
   if (cached !== void 0) return cached;
   if (!ctx.lazy || !priorEnvelope || (priorEnvelope._tier ?? 0) > 0) return null;
-  return await ctx.codec.decryptRecord(priorEnvelope, { skipValidation: true, id });
+  return await ctx.codec.decryptRecord({ collection: ctx.name, id }, priorEnvelope, { skipValidation: true });
 }
 
 // src/with-lookup/search/serialize.ts
@@ -2878,14 +2916,14 @@ var Collection = class {
         if (crdtMode === "yjs") {
           return local._v >= remote._v ? local : remote;
         }
-        const localJson = await this.codec.decryptJsonString(local, id);
-        const remoteJson = await this.codec.decryptJsonString(remote, id);
+        const localJson = await this.codec.decryptJsonString({ collection: this.name, id }, local);
+        const remoteJson = await this.codec.decryptJsonString({ collection: this.name, id }, remote);
         if (localJson === null) return local;
         if (remoteJson === null) return remote;
         const merged = this.strategies.crdt.mergeCrdtStates(JSON.parse(localJson), JSON.parse(remoteJson));
         const mergedVersion = Math.max(local._v, remote._v) + 1;
         const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-        return this.codec.encryptJsonString(JSON.stringify(merged), mergedVersion, cek);
+        return this.codec.encryptJsonString({ collection: this.name, id }, JSON.stringify(merged), mergedVersion, cek);
       };
       opts.onRegisterConflictResolver(this.name, crdtResolver);
     }
@@ -2926,14 +2964,14 @@ var Collection = class {
       } else {
         const mergeFn = policy;
         resolver = async (id, local, remote) => {
-          const localRecord = await this.codec.decryptRecord(local, { skipValidation: true, id });
-          const remoteRecord = await this.codec.decryptRecord(remote, { skipValidation: true, id });
+          const localRecord = await this.codec.decryptRecord({ collection: this.name, id }, local, { skipValidation: true });
+          const remoteRecord = await this.codec.decryptRecord({ collection: this.name, id }, remote, { skipValidation: true });
           if (localRecord === null) return local;
           if (remoteRecord === null) return remote;
           const merged = mergeFn(localRecord, remoteRecord);
           const mergedVersion = Math.max(local._v, remote._v) + 1;
           const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-          return this.codec.encryptRecord(merged, mergedVersion, cek, void 0, void 0, void 0, id);
+          return this.codec.encryptRecord({ collection: this.name, id }, merged, mergedVersion, cek);
         };
       }
       opts.onRegisterConflictResolver(collectionName, resolver);
@@ -3410,7 +3448,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-26ZJLNLG.js");
+      const { resolveStaleMVOnRead } = await import("./stale-ZWTKUVZX.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3422,7 +3460,7 @@ var Collection = class {
         const envelope = await this.adapter.get(this.vault, this.name, id);
         if (!envelope) return null;
         if (isTombstone(envelope, this.storeCiphertext) || isDeleteMarker(envelope) || (envelope._tier ?? 0) > 0) return null;
-        record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
+        record = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { sealedAsHandles: true });
         if (record === null) return null;
         this.lru.set(id, { record, version: envelope._v }, estimateRecordBytes(record));
       }
@@ -3449,7 +3487,7 @@ var Collection = class {
     }
     const envelope = await this.adapter.get(this.vault, this.name, id);
     if (!envelope || (envelope._tier ?? 0) > 0) return null;
-    const json = await this.codec.decryptJsonString(envelope);
+    const json = await this.codec.decryptJsonString({ collection: this.name, id }, envelope);
     if (json === null) return null;
     return JSON.parse(json);
   }
@@ -3566,7 +3604,7 @@ var Collection = class {
       if (cached) return cached.record;
       const env = await this.adapter.get(this.vault, this.name, id);
       if (!env || (env._tier ?? 0) > 0) return void 0;
-      const rec = await this.codec.decryptRecord(env, { id });
+      const rec = await this.codec.decryptRecord({ collection: this.name, id }, env, {});
       return rec === null ? void 0 : rec;
     }
     await this.ensureHydrated();
@@ -3614,7 +3652,7 @@ var Collection = class {
       if (cached2) return { record: cached2.record, version: cached2.version };
       const env = await this.adapter.get(this.vault, this.name, id);
       if (!env || (env._tier ?? 0) > 0) return { record: null, version: 0 };
-      return { record: await this.codec.decryptRecord(env, { skipValidation: true, id }) ?? null, version: env._v };
+      return { record: await this.codec.decryptRecord({ collection: this.name, id }, env, { skipValidation: true }) ?? null, version: env._v };
     }
     await this.ensureHydrated();
     const cached = this.cache.get(id);
@@ -3636,7 +3674,7 @@ var Collection = class {
     if (this.sensitiveFields.size > 0 || this.via?.hasAtRestHooks === true) {
       const env = await this.adapter.get(this.vault, this.name, id);
       if (!env || isTombstone(env, this.storeCiphertext) || (env._tier ?? 0) > 0) return void 0;
-      const rec = await this.codec.decryptRecord(env, { skipValidation: true, id });
+      const rec = await this.codec.decryptRecord({ collection: this.name, id }, env, { skipValidation: true });
       return rec === null ? void 0 : { record: rec, version: env._v };
     }
     const cached = this.cache.get(id);
@@ -3648,7 +3686,7 @@ var Collection = class {
     const env = await this.adapter.get(this.vault, this.name, id);
     if (!env) return { env: null, record: null, elided: false };
     if ((env._tier ?? 0) > 0) return { env, record: null, elided: false };
-    return { env, record: await this.codec.decryptRecord(env, { skipValidation: true, id }), elided: false };
+    return { env, record: await this.codec.decryptRecord({ collection: this.name, id }, env, { skipValidation: true }), elided: false };
   }
   /**
    * Wraps {@link RecordCodec.toCacheRecord} with an additional strip for
@@ -3672,9 +3710,9 @@ var Collection = class {
    * payload that is not a CRDT state. The `lww-map` and `rga` branches each
    * carried a copy, byte-identical apart from the cast (#842).
    */
-  async #decodePriorCrdtState(envelope) {
+  async #decodePriorCrdtState(id, envelope) {
     if (!envelope) return void 0;
-    const prevJson = await this.codec.decryptJsonString(envelope);
+    const prevJson = await this.codec.decryptJsonString({ collection: this.name, id }, envelope);
     if (prevJson === null) return void 0;
     const prevParsed = JSON.parse(prevJson);
     if (prevParsed === null || typeof prevParsed !== "object" || !("_crdt" in prevParsed)) {
@@ -3711,7 +3749,8 @@ var Collection = class {
       this.vault,
       this.name,
       id,
-      await this.codec.encryptRecord(prior.record, prior.version, cek, void 0, void 0, vdigCtx, id)
+      await this.codec.encryptRecord(this.strategies.history.historyIdentity(this.name, id, prior.version), prior.record, prior.version, cek, void 0, void 0, vdigCtx)
+      // sealed against its _history STORAGE identity (#1041)
     );
     this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: prior.version });
     if (this.historyConfig.maxVersions) {
@@ -3821,20 +3860,20 @@ var Collection = class {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       let crdtState;
       if (this.crdtMode === "lww-map") {
-        const existingState = await this.#decodePriorCrdtState(existingEnvelope);
+        const existingState = await this.#decodePriorCrdtState(id, existingEnvelope);
         crdtState = this.strategies.crdt.buildLwwMapState(record, existingState, now);
       } else if (this.crdtMode === "rga") {
-        const existingState = await this.#decodePriorCrdtState(existingEnvelope);
+        const existingState = await this.#decodePriorCrdtState(id, existingEnvelope);
         crdtState = this.strategies.crdt.buildRgaState(Array.isArray(record) ? record : [record], existingState, generateULID);
       } else {
         crdtState = { _crdt: "yjs", update: record };
       }
       const version = existingVersion + 1;
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
-      const envelope = await this.codec.encryptJsonString(JSON.stringify(crdtState), version, cek, options?.source, options?.sourceTs);
+      const envelope = await this.codec.encryptJsonString({ collection: this.name, id }, JSON.stringify(crdtState), version, cek, options?.source, options?.sourceTs);
       await this.adapter.put(this.vault, this.name, id, envelope);
       const resolvedRecord = this.strategies.crdt.resolveCrdtSnapshot(crdtState);
-      const existingResolvedRecord = existingEnvelope ? await this.codec.decryptRecord(existingEnvelope, { skipValidation: true }) : null;
+      const existingResolvedRecord = existingEnvelope ? await this.codec.decryptRecord({ collection: this.name, id }, existingEnvelope, { skipValidation: true }) : null;
       const existingResolved = existingResolvedRecord !== null ? { record: existingResolvedRecord, version: existingVersion } : void 0;
       if (existingResolved) {
         await this.#savePriorHistory(id, existingResolved, cek, this.vdigFields !== null ? { id, prev: existingEnvelope } : void 0);
@@ -3874,7 +3913,7 @@ var Collection = class {
       if (!existing) {
         priorRaw = await this.adapter.get(this.vault, this.name, id);
         if (priorRaw) {
-          const previousRecord = await this.codec.decryptRecord(priorRaw, { id });
+          const previousRecord = await this.codec.decryptRecord({ collection: this.name, id }, priorRaw, {});
           if (previousRecord !== null) {
             existing = { record: previousRecord, version: priorRaw._v };
           }
@@ -3894,7 +3933,7 @@ var Collection = class {
     this.uniqueConstraints?.check(id, record);
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
     const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
-    const envelope = await this.codec.encryptRecord(record, version, cek, options?.source, options?.sourceTs, vdigCtx, id);
+    const envelope = await this.codec.encryptRecord({ collection: this.name, id }, record, version, cek, options?.source, options?.sourceTs, vdigCtx);
     return { id, envelope, version, indexed: record, event: record, prior: existing, cek, vdigCtx, reason: options?.reason };
   }
   /**
@@ -3940,7 +3979,7 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-56T7VPGE.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-MG5KNMWG.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -3968,7 +4007,7 @@ var Collection = class {
         const cached = this.lru.get(id);
         const env = await this.adapter.get(this.vault, this.name, id);
         if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) return null;
-        raw = await this.codec.decryptRecord(env, { id });
+        raw = await this.codec.decryptRecord({ collection: this.name, id }, env, {});
         if (raw === null) return null;
         if (!cached) {
           this.lru.set(id, { record: await this.codec.toCacheRecord(raw, env, id), version: env._v }, estimateRecordBytes(raw));
@@ -3979,7 +4018,7 @@ var Collection = class {
         else {
           const env = await this.adapter.get(this.vault, this.name, id);
           if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) return null;
-          raw = await this.codec.decryptRecord(env, { id });
+          raw = await this.codec.decryptRecord({ collection: this.name, id }, env, {});
           if (raw === null) return null;
           this.lru.set(id, { record: raw, version: env._v }, estimateRecordBytes(raw));
         }
@@ -3996,7 +4035,7 @@ var Collection = class {
   async _getStoredRecordForDispatch(id) {
     const env = await this.adapter.get(this.vault, this.name, id);
     if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) return null;
-    const record = await this.codec.decryptRecord(env, { id });
+    const record = await this.codec.decryptRecord({ collection: this.name, id }, env, {});
     return record === null ? null : { record, version: env._v };
   }
   /**
@@ -4113,7 +4152,7 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-BM5GNCE2.js");
+    const { dispatchDerivations } = await import("./dispatch-RVJQ4BOL.js");
     return dispatchDerivations({
       ...this.#derivationDeleteCtx(this.derivationSource),
       via: this.via,
@@ -4296,7 +4335,7 @@ var Collection = class {
       if (!existing && this.historyConfig.enabled !== false) {
         const previousEnvelope2 = await this.adapter.get(this.vault, this.name, id);
         if (previousEnvelope2) {
-          const previousRecord = await this.codec.decryptRecord(previousEnvelope2, { id });
+          const previousRecord = await this.codec.decryptRecord({ collection: this.name, id }, previousEnvelope2, {});
           if (previousRecord !== null) {
             existing = { record: previousRecord, version: previousEnvelope2._v };
           }
@@ -4333,7 +4372,7 @@ var Collection = class {
   async _commitDelete(prepared, persist = true) {
     const { id, internal, existing, previousPayloadHash, marker, cek, vdigCtx } = prepared;
     if (existing && this.historyConfig.enabled !== false) {
-      await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(existing.record, existing.version, cek, void 0, void 0, vdigCtx, id));
+      await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, await this.codec.encryptRecord(this.strategies.history.historyIdentity(this.name, id, existing.version), existing.record, existing.version, cek, void 0, void 0, vdigCtx));
     }
     if (marker) {
       if (persist) await this.adapter.put(this.vault, this.name, id, marker);
@@ -4400,7 +4439,7 @@ var Collection = class {
    */
   async _decodeEnvelope(envelope, id) {
     try {
-      const rec = await this.codec.decryptRecord(envelope, { skipValidation: true, id });
+      const rec = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { skipValidation: true });
       return rec === null ? null : rec;
     } catch {
       return null;
@@ -4428,7 +4467,7 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-BM5GNCE2.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-RVJQ4BOL.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -4442,7 +4481,7 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-56T7VPGE.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-MG5KNMWG.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -4462,7 +4501,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-26ZJLNLG.js");
+      const { resolveStaleMVOnRead } = await import("./stale-ZWTKUVZX.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -4796,7 +4835,7 @@ var Collection = class {
     const entries = [];
     for (const env of envelopes) {
       if ((env._tier ?? 0) > 0) continue;
-      const record = await this.codec.decryptRecord(env, { skipValidation: true, id });
+      const record = await this.codec.decryptRecord(this.strategies.history.historyIdentity(this.name, id, env._v), env, { skipValidation: true });
       if (record === null) continue;
       entries.push({
         version: env._v,
@@ -4825,7 +4864,7 @@ var Collection = class {
       version
     );
     if (!envelope || (envelope._tier ?? 0) > 0 || await liveRecordIsElevated(this.adapter, this.vault, this.name, id)) return null;
-    return this.codec.decryptRecord(envelope, { skipValidation: true, id });
+    return this.codec.decryptRecord(this.strategies.history.historyIdentity(this.name, id, envelope._v), envelope, { skipValidation: true });
   }
   /** Revert a record to a past version. Creates a new version with the old content. */
   async revert(id, version) {
@@ -4931,7 +4970,7 @@ var Collection = class {
       const id = ids[i];
       const envelope = await this.adapter.get(this.vault, this.name, id);
       if (envelope && (envelope._tier ?? 0) === 0) {
-        const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
+        const record = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { sealedAsHandles: true });
         if (record === null) continue;
         items.push(record);
         if (!this.lazy && !this.cache.has(id)) {
@@ -5013,7 +5052,7 @@ var Collection = class {
     const out = [];
     for (const { id, envelope } of items) {
       if ((envelope._tier ?? 0) > 0) continue;
-      const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
+      const record = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { sealedAsHandles: true });
       if (record === null) continue;
       out.push({ id, record, version: envelope._v });
     }
@@ -5074,7 +5113,7 @@ var Collection = class {
       }
       return;
     }
-    const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
+    const record = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { sealedAsHandles: true });
     if (record === null) {
       this.cache.delete(id);
       if (previous) {
@@ -5170,7 +5209,7 @@ var Collection = class {
     for (const id of ids) {
       const envelope = await this.adapter.get(this.vault, this.name, id);
       if (envelope && !isTombstone(envelope, this.storeCiphertext) && !isDeleteMarker(envelope) && (envelope._tier ?? 0) === 0) {
-        const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
+        const record = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { sealedAsHandles: true });
         if (record === null) continue;
         this.cache.set(id, { record, version: envelope._v });
       } else if (envelope && isDeleteMarker(envelope)) {
@@ -5189,7 +5228,7 @@ var Collection = class {
         continue;
       }
       if (isTombstone(envelope, this.storeCiphertext) || (envelope._tier ?? 0) > 0) continue;
-      const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
+      const record = await this.codec.decryptRecord({ collection: this.name, id }, envelope, { sealedAsHandles: true });
       if (record === null) continue;
       this.cache.set(id, { record, version: envelope._v });
     }
@@ -5323,7 +5362,7 @@ var Collection = class {
     for (const [id, entry] of this.cache) {
       const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
       const prevForVdig = this.vdigFields !== null ? await this.adapter.get(this.vault, this.name, id) : null;
-      result[id] = await this.codec.encryptRecord(entry.record, entry.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0, id);
+      result[id] = await this.codec.encryptRecord({ collection: this.name, id }, entry.record, entry.version, cek, void 0, void 0, this.vdigFields !== null ? { id, prev: prevForVdig } : void 0);
     }
     return result;
   }
@@ -5438,7 +5477,7 @@ var Collection = class {
       const envelope = await this.adapter.get(this.vault, this.name, id);
       if (!envelope) continue;
       try {
-        const json = await this.codec.decryptJsonString(envelope);
+        const json = await this.codec.decryptJsonString({ collection: this.name, id }, envelope);
         if (json === null) continue;
         const body = JSON.parse(json);
         if (typeof body.recordId !== "string") continue;
@@ -5572,14 +5611,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-L7LXKS6Q.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-GWQTNDSL.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-L7LXKS6Q.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-GWQTNDSL.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5731,8 +5770,9 @@ var Collection = class {
       syncIndexes: (id, rec, version, priorEnvelope) => syncTierIndexes(this.indexingContext(), id, rec, version, priorEnvelope),
       syncSearch: (id, rec, version) => syncTierSearch(this.searchContext(), id, rec, version),
       syncHistory: async (id, fromDek, toDek) => this.strategies.history.rewrapHistory(this.adapter, this.vault, this.name, id, fromDek, toDek, await this.getDEK(this.name)),
-      saveHistorySnapshot: async (id, envelope) => {
+      saveHistorySnapshot: async (id, version, seal) => {
         if (this.historyConfig.enabled === false) return;
+        const envelope = await seal(this.strategies.history.historyIdentity(this.name, id, version));
         await this.strategies.history.saveHistory(this.adapter, this.vault, this.name, id, envelope);
         this.emitter.emit("history:save", { vault: this.vault, collection: this.name, id, version: envelope._v });
         if (this.historyConfig.maxVersions) await this.strategies.history.pruneHistory(this.adapter, this.vault, this.name, id, { keepVersions: this.historyConfig.maxVersions });
@@ -6016,17 +6056,18 @@ var DeferredNumberingStore = class {
   async readJson(collection, id) {
     const env = await this.adapter.get(this.vault, collection, id);
     if (!env) return { env: null, value: null };
-    const json = this.encrypted ? await openEnvelopeJson(env, await this.dek(collection)) : env._data;
+    const json = this.encrypted ? await openEnvelopeJson({ collection, id }, env, await this.dek(collection)) : env._data;
     return { env, value: JSON.parse(json) };
   }
   async writeJson(collection, id, value, expectedVersion) {
     const json = JSON.stringify(value);
     let env;
     if (!this.encrypted) {
-      env = buildRecordEnvelope({ collection, id }, { version: expectedVersion + 1, iv: "", data: json, by: this.actor });
+      env = buildRecordEnvelope({ collection, id, version: expectedVersion + 1 }, { iv: "", data: json });
     } else {
-      const { iv, data } = await encrypt(json, await this.dek(collection));
-      env = buildRecordEnvelope({ collection, id }, { version: expectedVersion + 1, iv, data, by: this.actor });
+      const identity = { collection, id, version: expectedVersion + 1 };
+      const { iv, data } = await encrypt(json, await this.dek(collection), buildRecordAad(identity));
+      env = buildRecordEnvelope(identity, { iv, data });
     }
     await this.adapter.put(this.vault, collection, id, env, expectedVersion);
   }
@@ -6576,7 +6617,7 @@ var VaultPeriods = class {
       const loaded = await this.deps.strategy.loadPeriods(
         this.deps.adapter,
         this.deps.vault,
-        (env) => this.decryptPeriodRecord(env)
+        (id, env) => this.decryptPeriodRecord(id, env)
       );
       this.periodCache = await this.mergeReopenState(loaded);
     }
@@ -6593,7 +6634,7 @@ var VaultPeriods = class {
     const loaded = await this.deps.strategy.loadPeriods(
       this.deps.adapter,
       this.deps.vault,
-      (env) => this.decryptPeriodRecord(env)
+      (id, env) => this.decryptPeriodRecord(id, env)
     );
     this.periodCache = loaded;
     return loaded;
@@ -6601,27 +6642,15 @@ var VaultPeriods = class {
   /** Generic reserved-collection writer — serves `_periods` and `_period_freezes` alike. */
   async writeReserved(collection, key, value) {
     const json = JSON.stringify(value);
+    const actor = this.deps.userId();
+    const identity = { collection, id: key, by: actor, version: 1 };
     let envelope;
     if (this.deps.encrypted) {
       const dek = await this.deps.getDEK(collection);
-      const { iv, data } = await encrypt(json, dek);
-      envelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: 1,
-        _ts: (/* @__PURE__ */ new Date()).toISOString(),
-        _iv: iv,
-        _data: data,
-        _by: this.deps.userId()
-      };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+      envelope = buildRecordEnvelope(identity, { iv, data });
     } else {
-      envelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: 1,
-        _ts: (/* @__PURE__ */ new Date()).toISOString(),
-        _iv: "",
-        _data: json,
-        _by: this.deps.userId()
-      };
+      envelope = buildRecordEnvelope(identity, { iv: "", data: json });
     }
     await this.deps.adapter.put(this.deps.vault, collection, key, envelope);
     if (collection === PERIODS_COLLECTION && this.deps.onDirty) {
@@ -6633,14 +6662,14 @@ var VaultPeriods = class {
   async readReserved(collection, key) {
     const env = await this.deps.adapter.get(this.deps.vault, collection, key);
     if (!env) return null;
-    const json = this.deps.encrypted ? await openEnvelopeJson(env, await this.deps.getDEK(collection)) : env._data;
+    const json = this.deps.encrypted ? await openEnvelopeJson({ collection, id: key }, env, await this.deps.getDEK(collection)) : env._data;
     return JSON.parse(json);
   }
-  async decryptPeriodRecord(envelope) {
+  async decryptPeriodRecord(periodId, envelope) {
     let json;
     if (this.deps.encrypted) {
       const dek = await this.deps.getDEK(PERIODS_COLLECTION);
-      json = await openEnvelopeJson(envelope, dek);
+      json = await openEnvelopeJson({ collection: PERIODS_COLLECTION, id: periodId }, envelope, dek);
     } else {
       json = envelope._data;
     }
@@ -7215,7 +7244,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-XRVHGYWC.js").then(
+  const load = () => engine ??= import("./link-set-XKN5V7VM.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7862,7 +7891,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-O3YW6CGS.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-CVS7CCJE.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -8845,7 +8874,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-XHOOX37G.js");
+          const { persistSchemaIfNeeded } = await import("./register-GJ6PW4KP.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8995,7 +9024,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-XHOOX37G.js")).persistSchemaIfNeeded({
+            await (await import("./register-GJ6PW4KP.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -9671,21 +9700,22 @@ var Vault = class {
    */
   // eslint-disable-next-line @typescript-eslint/consistent-type-imports
   async _loadPodSigner() {
-    const { loadSigner } = await import("./signer-SLOMB6HS.js");
+    const { loadSigner } = await import("./signer-JE6NEURY.js");
     return loadSigner(this.adapter, this.name, this.getDEK);
   }
   async writeExportAudit(entry) {
     const json = JSON.stringify(entry);
+    const exportAuditIdentity = { collection: EXPORT_AUDIT_COLLECTION, id: entry.id, by: entry.actor, version: 1 };
     const envelope = this.encrypted ? await (async () => {
       const dek = await this.getDEK(EXPORT_AUDIT_COLLECTION);
-      const { iv, data } = await encrypt(json, dek);
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(exportAuditIdentity));
       return buildRecordEnvelope(
-        { collection: EXPORT_AUDIT_COLLECTION, id: entry.id },
-        { version: 1, ts: entry.startedAt, iv, data, by: entry.actor }
+        exportAuditIdentity,
+        { ts: entry.startedAt, iv, data }
       );
     })() : buildRecordEnvelope(
-      { collection: EXPORT_AUDIT_COLLECTION, id: entry.id },
-      { version: 1, ts: entry.startedAt, iv: "", data: json, by: entry.actor }
+      exportAuditIdentity,
+      { ts: entry.startedAt, iv: "", data: json }
     );
     await this.adapter.put(this.name, EXPORT_AUDIT_COLLECTION, entry.id, envelope);
   }
@@ -9700,12 +9730,12 @@ var Vault = class {
    *
    * @internal
    */
-  async _decryptEnvelopeForBundleFilter(env, collectionName) {
+  async _decryptEnvelopeForBundleFilter(env, collectionName, recordId) {
     if (!this.encrypted) {
       return JSON.parse(env._data);
     }
     const dek = await this.getDEK(collectionName);
-    const json = await openEnvelopeJson(env, dek);
+    const json = await openEnvelopeJson({ collection: collectionName, id: recordId }, env, dek);
     return JSON.parse(json);
   }
   canImport(tier, format) {
@@ -10188,7 +10218,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-CYAFB35H.js"),
+      import("./registry-KI77RVK7.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -10220,7 +10250,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-OFMM4WAC.js");
+    const { MaterializedViewRegistry } = await import("./registry-6LUJ5IJW.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -10307,14 +10337,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-LFHRV6JH.js");
+    const { MaterializedViewExecutor } = await import("./executor-FRUVM36Q.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-26ZJLNLG.js");
+    const { clearMVStaleFully } = await import("./stale-ZWTKUVZX.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -10354,7 +10384,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-MT2OBMZB.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-NZA6J7QB.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10581,7 +10611,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-7EGBYBRN.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-Q3HEAVLA.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
@@ -10603,7 +10633,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-7EGBYBRN.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-Q3HEAVLA.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10699,16 +10729,17 @@ var Vault = class {
   async writeElevationAudit(entry) {
     const id = `elev-${Date.now().toString(36)}-${Math.random().toString(16).slice(2, 10)}`;
     const json = JSON.stringify({ id, ...entry });
+    const elevationAuditIdentity = { collection: ELEVATION_AUDIT_COLLECTION, id, by: entry.actor, version: 1 };
     const envelope = this.encrypted ? await (async () => {
       const dek = await this.getDEK(ELEVATION_AUDIT_COLLECTION);
-      const { iv, data } = await encrypt(json, dek);
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(elevationAuditIdentity));
       return buildRecordEnvelope(
-        { collection: ELEVATION_AUDIT_COLLECTION, id },
-        { version: 1, ts: entry.startedAt, iv, data, by: entry.actor }
+        elevationAuditIdentity,
+        { ts: entry.startedAt, iv, data }
       );
     })() : buildRecordEnvelope(
-      { collection: ELEVATION_AUDIT_COLLECTION, id },
-      { version: 1, ts: entry.startedAt, iv: "", data: json, by: entry.actor }
+      elevationAuditIdentity,
+      { ts: entry.startedAt, iv: "", data: json }
     );
     await this.adapter.put(this.name, ELEVATION_AUDIT_COLLECTION, id, envelope);
   }
@@ -10855,7 +10886,7 @@ var Vault = class {
    * @see design-history/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-B4YFJJ7S.js");
+    const { dumpVaultSchema } = await import("./walk-HSS3NLQ3.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10951,7 +10982,7 @@ var Vault = class {
    * separate vault instances now.
    */
   async getPodHandle() {
-    const { buildPodHandle } = await import("./pod-handle-BYUSBXCT.js");
+    const { buildPodHandle } = await import("./pod-handle-SKDKRPOR.js");
     return buildPodHandle(this.adapter, this.name);
   }
   /**
@@ -10983,7 +11014,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-M2VND2VS.js");
+    const { dumpVault } = await import("./backup-OLBRFYY7.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -11035,7 +11066,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-M2VND2VS.js");
+    const { loadVault } = await import("./backup-OLBRFYY7.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -11067,7 +11098,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-M2VND2VS.js");
+    const { verifyBackupIntegrity } = await import("./backup-OLBRFYY7.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -11285,7 +11316,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-M2VND2VS.js");
+    const { exportVaultJSON } = await import("./backup-OLBRFYY7.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -13101,6 +13132,7 @@ var Noydb = class {
     this.#registerGuardGate();
     this.#registerPeriodGate();
     this.#registerForgetHooks();
+    this.#registerVaultHeadObserver();
     this.resetSessionTimer();
   }
   /** @internal — resolved forget strategy (NO_FORGET when not configured). */
@@ -13117,6 +13149,22 @@ var Noydb = class {
   //   - the subsystemBus `afterDelete` observer fires on delete (onAfterWrite
   //     does NOT) — drop the ref so a deleted record never lingers in the
   //     index (RISK #2). Without it, forget() would try to shred a ghost.
+  /** #1044 — see `with-commit/vault-head/strategy.ts` for why this is an observer. */
+  #registerVaultHeadObserver() {
+    if (!this.strategies.vaultHead.enabled) return;
+    for (const point of ["afterPut", "afterDelete"]) {
+      this.subsystemBus.register(point, async (event) => {
+        const vault = this.vaultCache.get(event.vault);
+        if (!vault) return;
+        const { adapter, getDEK } = vault._introspectState();
+        await this.strategies.vaultHead.note(adapter, event.vault, getDEK, {
+          collection: event.collection,
+          id: event.docId,
+          version: event.version
+        });
+      });
+    }
+  }
   #registerForgetHooks() {
     const subjects = this.strategies.forget.subjects;
     if (Object.keys(subjects).length === 0) return;
@@ -13303,6 +13351,7 @@ var Noydb = class {
     if (this.options.encrypt !== false && !this.policyCache.has(name)) {
       await this.bootstrapPolicy(name);
     }
+    const mergeAuthority = buildMergeAuthority(keyring);
     let syncEngine;
     const targets = normalizeSyncTargets(this.options.sync);
     if (targets.length > 0) {
@@ -13317,6 +13366,7 @@ var Noydb = class {
         emitter: this.emitter,
         syncPolicy: effectivePolicy,
         role: primary.role,
+        mergeAuthority,
         ...primary.label !== void 0 ? { label: primary.label } : {}
       });
       this.syncEngines.set(name, syncEngine);
@@ -13332,6 +13382,7 @@ var Noydb = class {
           emitter: this.emitter,
           syncPolicy: targetPolicy,
           role: target.role,
+          mergeAuthority,
           ...target.label !== void 0 ? { label: target.label } : {}
         });
         this.syncEngines.set(`${name}::${index}`, engine);
@@ -14530,7 +14581,7 @@ async function createNoydb(options) {
   if (!options.store) options = { ...options, store: memoryStore() };
   validateSecretModeOptions(options);
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-NAY63UIE.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-FRFEJ6WR.js")).createUserApi };
   if (!options.policyFactory) {
     const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
@@ -14565,4 +14616,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-KKRFL5E2.js.map
+//# sourceMappingURL=chunk-GSRW5MTU.js.map