@noy-db/hub 0.6.0-pre.17 → 0.6.0-pre.19

package/dist/{chunk-SGEI3IJK.js → chunk-HGJC7I5F.js}

@@ -1,6 +1,6 @@
 import {
   ReadOnlyFrameError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-fork/shadow/vault-frame.ts
 var VaultFrame = class {
@@ -71,4 +71,4 @@ export {
   VaultFrame,
   CollectionFrame
 };
-//# sourceMappingURL=chunk-SGEI3IJK.js.map
+//# sourceMappingURL=chunk-HGJC7I5F.js.map

package/dist/{chunk-C52CJDFO.js → chunk-HJRTFXAA.js}

@@ -1,6 +1,6 @@
 import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-5UGEGEIJ.js";
+  buildRecordEnvelope
+} from "./chunk-ZVAFJQZB.js";
 
 // src/with-shape/schema-update/fence.ts
 var FENCE_RECORD_ID = "schema-fence";
@@ -18,13 +18,10 @@ async function loadFence(store, vault) {
   }
 }
 async function saveFence(store, vault, fence) {
-  const envelope = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: "",
-    _data: JSON.stringify(fence)
-  };
+  const envelope = buildRecordEnvelope(
+    { collection: META_COLLECTION, id: FENCE_RECORD_ID, version: 1 },
+    { iv: "", data: JSON.stringify(fence) }
+  );
   await store.put(vault, META_COLLECTION, FENCE_RECORD_ID, envelope);
 }
 function isFenceDoc(x) {
@@ -39,4 +36,4 @@ export {
   loadFence,
   saveFence
 };
-//# sourceMappingURL=chunk-C52CJDFO.js.map
+//# sourceMappingURL=chunk-HJRTFXAA.js.map

package/dist/chunk-HJRTFXAA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/schema-update/fence.ts"],"sourcesContent":["/**\n * Schema-fence document. Vault-level generation counter + drain\n * state, stored at `_meta/schema-fence` using the plaintext-envelope\n * pattern of `_meta/policy` (no PII — a counter + a state enum).\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { buildRecordEnvelope } from '../../kernel/enclave/index.js'\n\nexport type FenceState = 'normal' | 'draining' | 'migrating' | 'complete'\n\nexport interface FenceDoc {\n  readonly currentSchemaVersion: number\n  readonly fenceState: FenceState\n  /**\n   * Content hash (`PersistedSchemaEnvelope.hash`) of the schema most\n   * recently persisted while the vault sat at `currentSchemaVersion` —\n   * binds \"generation N\" to a concrete schema-content hash (#946), so\n   * \"which schema is generation N\" is answerable from `schemaFenceState()`\n   * alone. Optional: absent on a fresh vault (generation 0, nothing\n   * persisted yet) and on a fence document written before #946.\n   */\n  readonly schemaHash?: string\n}\n\nexport const FENCE_RECORD_ID = 'schema-fence'\nconst META_COLLECTION = '_meta'\n\nexport const DEFAULT_FENCE: FenceDoc = { currentSchemaVersion: 0, fenceState: 'normal' }\n\nexport async function loadFence(store: NoydbStore, vault: string): Promise<FenceDoc> {\n  const envelope = await store.get(vault, META_COLLECTION, FENCE_RECORD_ID)\n  if (!envelope) return DEFAULT_FENCE\n  try {\n    const parsed = JSON.parse(envelope._data) as unknown\n    if (!isFenceDoc(parsed)) return DEFAULT_FENCE\n    return parsed\n  } catch {\n    return DEFAULT_FENCE\n  }\n}\n\nexport async function saveFence(store: NoydbStore, vault: string, fence: FenceDoc): Promise<void> {\n  const envelope = buildRecordEnvelope(\n    { collection: META_COLLECTION, id: FENCE_RECORD_ID, version: 1 },\n    { iv: '', data: JSON.stringify(fence) },\n  )\n  await store.put(vault, META_COLLECTION, FENCE_RECORD_ID, envelope)\n}\n\nfunction isFenceDoc(x: unknown): x is FenceDoc {\n  if (x === null || typeof x !== 'object') return false\n  const o = x as Record<string, unknown>\n  if (typeof o['currentSchemaVersion'] !== 'number') return false\n  if (o['fenceState'] !== 'normal' && o['fenceState'] !== 'draining'\n    && o['fenceState'] !== 'migrating' && o['fenceState'] !== 'complete') return false\n  // schemaHash is optional (#946) — a legacy fence doc without it is still valid.\n  return o['schemaHash'] === undefined || typeof o['schemaHash'] === 'string'\n}\n"],"mappings":";;;;;AAwBO,IAAM,kBAAkB;AAC/B,IAAM,kBAAkB;AAEjB,IAAM,gBAA0B,EAAE,sBAAsB,GAAG,YAAY,SAAS;AAEvF,eAAsB,UAAU,OAAmB,OAAkC;AACnF,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,iBAAiB,eAAe;AACxE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,QAAI,CAAC,WAAW,MAAM,EAAG,QAAO;AAChC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,UAAU,OAAmB,OAAe,OAAgC;AAChG,QAAM,WAAW;AAAA,IACf,EAAE,YAAY,iBAAiB,IAAI,iBAAiB,SAAS,EAAE;AAAA,IAC/D,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,KAAK,EAAE;AAAA,EACxC;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,iBAAiB,QAAQ;AACnE;AAEA,SAAS,WAAW,GAA2B;AAC7C,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,sBAAsB,MAAM,SAAU,QAAO;AAC1D,MAAI,EAAE,YAAY,MAAM,YAAY,EAAE,YAAY,MAAM,cACnD,EAAE,YAAY,MAAM,eAAe,EAAE,YAAY,MAAM,WAAY,QAAO;AAE/E,SAAO,EAAE,YAAY,MAAM,UAAa,OAAO,EAAE,YAAY,MAAM;AACrE;","names":[]}

package/dist/chunk-HK67PX4J.js

@@ -0,0 +1,27 @@
+// src/with-commit/vault-head/strategy.ts
+var VAULT_HEAD_COLLECTION = "_head";
+var DEFAULT_HEAD_BUCKETS = 256;
+function notEnabled(op) {
+  return new Error(
+    `${op} requires the vault-head capability. Pass \`vaultHeadStrategy: withVaultHead()\` from "@noy-db/hub/vault-head" to createNoydb().`
+  );
+}
+var NO_VAULT_HEAD = {
+  enabled: false,
+  bucketFor: () => "",
+  async note() {
+  },
+  async expected() {
+    throw notEnabled("vault.verifyHead()");
+  },
+  async knownIn() {
+    throw notEnabled("vault.verifyHead()");
+  }
+};
+
+export {
+  VAULT_HEAD_COLLECTION,
+  DEFAULT_HEAD_BUCKETS,
+  NO_VAULT_HEAD
+};
+//# sourceMappingURL=chunk-HK67PX4J.js.map

package/dist/chunk-HK67PX4J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/vault-head/strategy.ts"],"sourcesContent":["/**\n * `withVaultHead()` — the opt-in detector for **omission** (#1044).\n *\n * ## What it is for, and what it deliberately is not\n *\n * #1041 made every envelope self-authenticating at its identity, and #1042\n * made the merge reject one that is not. What neither can catch is **absence**:\n * a store that serves a genuine, unmodified `v1` when `v7` exists, or serves\n * nothing at all. An authentic old envelope is indistinguishable from an\n * authentic current one without external knowledge of what *should* be there.\n *\n * The head is that external knowledge: an authenticated `{id → version}`\n * manifest the client writes and the store cannot forge. It is **not** a Merkle\n * chain over content — content integrity is already handled, so the head needs\n * only versions.\n *\n * ## Why it is opt-in when AAD is not\n *\n * AAD costs nothing to coordinate and closes *alteration*, so it is kernel. The\n * head costs a write per commit and needs anti-entropy; on a single-device\n * offline vault it defends against nothing. Making it kernel would tax every\n * user for a multi-writer property. ADR 0003, Decision 3.\n *\n * `SECURITY.md` states the split exactly: a store cannot alter, relocate,\n * re-tier, re-author or rewind a record; **without `withVaultHead()` it can\n * still withhold or omit.**\n *\n * ## Bucketed, and why that is not a compromise\n *\n * ADR 0003 left head granularity open and asked for it to be sized early.\n * Measured, at the documented 50K-record vault ceiling:\n *\n * | shape | write cost per commit | detection |\n * |---|---|---|\n * | one per-vault manifest | **1.1 MiB** | per-record |\n * | one per collection | the same problem, renamed | per-record |\n * | **bucketed, 256 buckets** | **~4.4 KiB** | per-record |\n *\n * Bucketing changes *only* write amplification. Each bucket still lists every\n * one of its records' versions, so detection stays per-record — which is why\n * this is not a trade-off between cost and strength. Verifying one pulled\n * record reads one bucket rather than a megabyte.\n *\n * ## Wired as a bus OBSERVER, not a call in `collection.ts`\n *\n * That is what `kernel-surface` means by \"register on the ServiceBus instead of\n * growing this file\", and it keeps the hot write path untouched for anyone who\n * has not opted in: nothing is registered at all, so `hasHandlers` stays false\n * and the dispatch never happens.\n *\n * Both `afterPut` AND `afterDelete`, because a delete is a version bump like\n * any other. A head that stopped tracking deleted records would let a store\n * resurrect one by withholding the tombstone — precisely the omission this\n * exists to catch.\n *\n * ⚠️ The registration must be UNCONDITIONAL on anything but `enabled`. Its first\n * draft sat inside `#registerForgetHooks()`, which returns early when no forget\n * subjects are declared, so the head silently recorded nothing unless the vault\n * happened to use an unrelated feature. The tests caught it only because they\n * asserted a COUNT rather than \"no error\" — a head that records nothing raises\n * no errors and sweeps perfectly clean.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\n\n/** Reserved collection the head's buckets live in. */\nexport const VAULT_HEAD_COLLECTION = '_head' as const\n\n/** Default bucket count — see the sizing table above. */\nexport const DEFAULT_HEAD_BUCKETS = 256\n\nexport interface WithVaultHeadOptions {\n  /**\n   * How many buckets the manifest is split across. Higher means smaller writes\n   * and more reads to sweep the whole vault; lower means the opposite.\n   * Changing it on an existing vault re-homes every entry, so treat it as a\n   * layout decision rather than a tuning knob.\n   */\n  readonly buckets?: number\n}\n\n/** One record's expected state, as the client last committed it. */\nexport interface HeadEntry {\n  readonly collection: string\n  readonly id: string\n  readonly version: number\n}\n\nexport interface VaultHeadStrategy {\n  /**\n   * Is the head actually keeping a manifest?\n   *\n   * An explicit flag rather than an identity check against the stub: the kernel\n   * decides whether to register the write-path observer at all, and\n   * `port-layering` forbids it importing `NO_VAULT_HEAD` to compare. Without\n   * this, every write in a vault that never opted in would still pay a cache\n   * lookup and a no-op call.\n   */\n  readonly enabled: boolean\n\n  /** Bucket a record id lands in — pure, so callers can pre-group a batch. */\n  bucketFor(collection: string, id: string): string\n\n  /**\n   * Record `entry` as the client's expectation for that record.\n   *\n   * Called on every committed write, INSIDE the same logical operation, so\n   * there is no window where the record exists and the head does not know it.\n   */\n  note(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    entry: HeadEntry,\n  ): Promise<void>\n\n  /**\n   * What the client expects for `collection/id`, or `null` if the head has\n   * never seen it.\n   */\n  expected(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    collection: string,\n    id: string,\n  ): Promise<number | null>\n\n  /**\n   * Every record the head knows about in `collection` — the set a sweep\n   * compares against what the store actually serves, which is how DELETION\n   * SUPPRESSION is caught. A withheld record is absent from the store but\n   * present here.\n   */\n  knownIn(\n    store: NoydbStore,\n    vault: string,\n    getDEK: (collection: string) => Promise<EnclaveKey>,\n    collection: string,\n  ): Promise<ReadonlyMap<string, number>>\n}\n\nfunction notEnabled(op: string): Error {\n  return new Error(\n    `${op} requires the vault-head capability. Pass \\`vaultHeadStrategy: withVaultHead()\\` ` +\n    'from \"@noy-db/hub/vault-head\" to createNoydb().',\n  )\n}\n\n/**\n * The un-opted-in stub. `note` is a NO-OP rather than a throw: the write path\n * calls it unconditionally, and a vault without the head must simply not keep\n * one. The READ side throws, because asking what the head expects when there is\n * no head is a caller error, not a silent \"nothing to report\" — the latter\n * would look exactly like a clean sweep.\n */\nexport const NO_VAULT_HEAD: VaultHeadStrategy = {\n  enabled: false,\n  bucketFor: () => '',\n  async note() {},\n  async expected() { throw notEnabled('vault.verifyHead()') },\n  async knownIn() { throw notEnabled('vault.verifyHead()') },\n}\n\nexport type { EncryptedEnvelope }\n"],"mappings":";AAoEO,IAAM,wBAAwB;AAG9B,IAAM,uBAAuB;AAyEpC,SAAS,WAAW,IAAmB;AACrC,SAAO,IAAI;AAAA,IACT,GAAG,EAAE;AAAA,EAEP;AACF;AASO,IAAM,gBAAmC;AAAA,EAC9C,SAAS;AAAA,EACT,WAAW,MAAM;AAAA,EACjB,MAAM,OAAO;AAAA,EAAC;AAAA,EACd,MAAM,WAAW;AAAE,UAAM,WAAW,oBAAoB;AAAA,EAAE;AAAA,EAC1D,MAAM,UAAU;AAAE,UAAM,WAAW,oBAAoB;AAAA,EAAE;AAC3D;","names":[]}

package/dist/{chunk-V4M4BZNW.js → chunk-HTHRCGWP.js}

@@ -1,6 +1,6 @@
 import {
   ValidationError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-audit/periods/window.ts
 var PERIODS_COLLECTION = "_periods";
@@ -23,4 +23,4 @@ export {
   PERIOD_REOPENS_COLLECTION,
   periodExclusiveUpperBound
 };
-//# sourceMappingURL=chunk-V4M4BZNW.js.map
+//# sourceMappingURL=chunk-HTHRCGWP.js.map

package/dist/{chunk-YVOW35HH.js → chunk-HTMQBBF3.js}

@@ -1,12 +1,11 @@
+import {
+  dekKey
+} from "./chunk-47ZFULEZ.js";
 import {
   TierNotGrantedError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-party/team/tiers.ts
-function dekKey(collection, tier) {
-  if (tier <= 0) return collection;
-  return `${collection}#${tier}`;
-}
 function assertTierAccess(keyring, collection, tier) {
   if (tier <= 0) return;
   if (keyring.role === "owner" || keyring.role === "admin" || keyring.role === "custodian") return;
@@ -16,7 +15,6 @@ function assertTierAccess(keyring, collection, tier) {
 }
 
 export {
-  dekKey,
   assertTierAccess
 };
-//# sourceMappingURL=chunk-YVOW35HH.js.map
+//# sourceMappingURL=chunk-HTMQBBF3.js.map

package/dist/chunk-HTMQBBF3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-party/team/tiers.ts"],"sourcesContent":["/**\n * Hierarchical access — tier-aware keyring helpers.\n *\n * The keyring's existing `deks: Map<string, CryptoKey>` is keyed by\n * collection name. extends the key space:\n *\n *   `'invoices'`      — tier-0 DEK (unchanged from v0.x)\n *   `'invoices#1'`    — tier-1 DEK\n *   `'invoices#2'`    — tier-2 DEK\n *\n * Tier 0 keeps the bare collection name so any keyring written\n * before tiers existed loads without migration. Tiers ≥ 1 use `#N`\n * suffixes that\n * would be invalid as user-supplied collection names (see\n * `ReservedCollectionNameError` — `#` is reserved).\n *\n * @module\n */\n\nimport type { UnlockedKeyring } from './keyring.js'\nimport { TierNotGrantedError } from '../../kernel/errors.js'\n\n/** Canonical DEK key for a given collection + tier. Tier 0 → bare name. */\n// Moved to `kernel/tier-visibility.ts` (#1042): the kernel needs it to resolve\n// a pulled envelope's DEK, and `port-layering` forbids the spine importing a\n// `with-*` service. Re-exported so every existing importer is unchanged.\nimport { dekKey } from '../../kernel/tier-visibility.js'\nexport { dekKey }\n\n/**\n * Returns the user's effective clearance for a given collection: the\n * maximum tier for which their keyring holds a DEK. Falls back to 0\n * when the user has only the tier-0 DEK (or none — the getDEK caller\n * will raise separately).\n */\nexport function effectiveClearance(keyring: UnlockedKeyring, collection: string): number {\n  let max = 0\n  const prefix = `${collection}#`\n  for (const key of keyring.deks.keys()) {\n    if (!key.startsWith(prefix)) continue\n    const suffix = key.slice(prefix.length)\n    const n = Number.parseInt(suffix, 10)\n    if (Number.isFinite(n) && n > max) max = n\n  }\n  return max\n}\n\n/**\n * Assert the caller is cleared for the requested tier. Owners and\n * admins always pass (they can mint any new tier DEK on demand);\n * other roles must already hold the tier DEK — via a prior grant or\n * an active delegation — otherwise this throws `TierNotGrantedError`.\n *\n * This gate runs BEFORE `getDEK()` on the mutation path so a\n * non-cleared operator never has the opportunity to silently\n * auto-create a tier DEK they shouldn't have.\n */\nexport function assertTierAccess(\n  keyring: UnlockedKeyring,\n  collection: string,\n  tier: number,\n): void {\n  if (tier <= 0) return\n  // FR-6: custodian operates every collection at every tier (admin-level\n  // operational authority), so it may mint a tier DEK on demand like admin.\n  if (keyring.role === 'owner' || keyring.role === 'admin' || keyring.role === 'custodian') return\n  if (!keyring.deks.has(dekKey(collection, tier))) {\n    throw new TierNotGrantedError(collection, tier)\n  }\n}\n"],"mappings":";;;;;;;;AAyDO,SAAS,iBACd,SACA,YACA,MACM;AACN,MAAI,QAAQ,EAAG;AAGf,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,WAAW,QAAQ,SAAS,YAAa;AAC1F,MAAI,CAAC,QAAQ,KAAK,IAAI,OAAO,YAAY,IAAI,CAAC,GAAG;AAC/C,UAAM,IAAI,oBAAoB,YAAY,IAAI;AAAA,EAChD;AACF;","names":[]}

package/dist/{chunk-QC2HGYFX.js → chunk-HUYNPLTT.js}

@@ -1,10 +1,10 @@
 import {
   grant,
   revoke
-} from "./chunk-WBHQX6ME.js";
+} from "./chunk-E6WANBD6.js";
 import {
   CustodyNotEnabledError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-party/custody/active.ts
 function withCustody() {
@@ -16,7 +16,7 @@ function withCustody() {
       return host._revokeCustodianImpl(revoke, vault, options, factors);
     },
     async liberate(vault, opts) {
-      const { liberateVault } = await import("./liberate-2DNJ7AJ7.js");
+      const { liberateVault } = await import("./liberate-7QY7TULB.js");
       return liberateVault(vault, opts);
     }
   };
@@ -74,4 +74,4 @@ export {
   withCustody,
   CustodyApi
 };
-//# sourceMappingURL=chunk-QC2HGYFX.js.map
+//# sourceMappingURL=chunk-HUYNPLTT.js.map

package/dist/{chunk-APUP2J5M.js → chunk-I26TE27S.js}

@@ -1,22 +1,22 @@
 import {
   createNoydb
-} from "./chunk-JV2CNEX2.js";
+} from "./chunk-HGAR7H5M.js";
 import {
   deriveSchemaManifest
-} from "./chunk-OAWVM5L6.js";
+} from "./chunk-E6VDPBE3.js";
 import {
   loadFence
-} from "./chunk-C52CJDFO.js";
+} from "./chunk-HJRTFXAA.js";
 import {
   readPod,
   readPodRedirect,
   signRecord,
   verifyPodHeader,
   verifyRecord
-} from "./chunk-SDEHNGWW.js";
+} from "./chunk-2IK6AC6A.js";
 import {
   loadKeyring
-} from "./chunk-WBHQX6ME.js";
+} from "./chunk-E6WANBD6.js";
 import {
   ConflictError,
   MigrationRequiredError,
@@ -26,7 +26,7 @@ import {
   RedirectDepthExceededError,
   RedirectLoopError,
   RedirectUnreachableError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-pod/pod-store.ts
 var BUNDLE_STORE_VERSION = 1;
@@ -286,4 +286,4 @@ export {
   followRedirects,
   open
 };
-//# sourceMappingURL=chunk-APUP2J5M.js.map
+//# sourceMappingURL=chunk-I26TE27S.js.map

package/dist/{chunk-DEP24EE3.js → chunk-ICCRAPWD.js}

@@ -1,15 +1,15 @@
 import {
   dictCollectionName
-} from "./chunk-OXRPH6AR.js";
+} from "./chunk-GYUCRDAU.js";
 import {
   getAtPath,
   presentI18nForJoin
-} from "./chunk-7LLKPODL.js";
+} from "./chunk-437FDIHO.js";
 import {
   PeriodClosedError,
   UnknownDictCodeError,
   ValidationError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/via/lookup/registry.ts
 function enforceStaticDictOnPut(staticFields, record) {
@@ -487,4 +487,4 @@ export {
   forgetDerivedFanout,
   selfWriteFieldEqual
 };
-//# sourceMappingURL=chunk-DEP24EE3.js.map
+//# sourceMappingURL=chunk-ICCRAPWD.js.map

package/dist/{chunk-ES36R3U2.js → chunk-IOURTXTM.js}

@@ -1,15 +1,20 @@
 import {
-  assertTierAccess,
-  dekKey
-} from "./chunk-YVOW35HH.js";
+  assertTierAccess
+} from "./chunk-HTMQBBF3.js";
 import {
+  dekKey,
   liveRecordIsElevated,
   liveRecordTier
-} from "./chunk-AMKCY454.js";
+} from "./chunk-47ZFULEZ.js";
 import {
+  buildRecordAad,
   openEnvelopeJson,
   writeEnvelopeBody
-} from "./chunk-BKYQNNO3.js";
+} from "./chunk-D5UDZANO.js";
+import {
+  buildRecordEnvelope,
+  buildSealedRecordEnvelope
+} from "./chunk-ZVAFJQZB.js";
 import {
   base64ToBuffer,
   bufferToBase64,
@@ -21,10 +26,7 @@ import {
   sha256Hex,
   unwrapCek,
   wrapCek
-} from "./chunk-QTDAPDDV.js";
-import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-5UGEGEIJ.js";
+} from "./chunk-VJ4B3ZXY.js";
 import {
   BlobIntentPendingError,
   BlobOfflineError,
@@ -35,7 +37,7 @@ import {
   UnsupportedTierCompositionError,
   ValidationError,
   isConflictError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 
 // src/with-shape/blobs/blob-pinning.ts
 function memoryBlobPinStore() {
@@ -301,30 +303,28 @@ function parseIntentKey(key) {
   if (idx === -1) return null;
   return { collection: key.slice(0, idx), recordId: key.slice(idx + 2) };
 }
-async function encodeIntentEnvelope(intent, dek, newVersion = 1) {
+async function encodeIntentEnvelope(intent, dek, key, newVersion = 1) {
   const json = JSON.stringify(intent);
-  const body = await writeEnvelopeBody(json, dek);
-  return {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: newVersion,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    ...body
-  };
+  return buildSealedRecordEnvelope(
+    { collection: BLOB_INTENT_COLLECTION, id: key, version: newVersion },
+    (identity) => writeEnvelopeBody(identity, json, dek),
+    {}
+  );
 }
-async function decodeIntentEnvelope(envelope, dek) {
-  const json = await openEnvelopeJson(envelope, dek);
+async function decodeIntentEnvelope(key, envelope, dek) {
+  const json = await openEnvelopeJson({ collection: BLOB_INTENT_COLLECTION, id: key }, envelope, dek);
   return JSON.parse(json);
 }
 async function getIntent(adapter, vault, collection, recordId, getDEK) {
   const envelope = await adapter.get(vault, BLOB_INTENT_COLLECTION, intentKey(collection, recordId));
   if (!envelope) return null;
   const dek = await getDEK(collection);
-  return decodeIntentEnvelope(envelope, dek);
+  return decodeIntentEnvelope(intentKey(collection, recordId), envelope, dek);
 }
 async function createIntent(adapter, vault, collection, recordId, getDEK, intent) {
   const key = intentKey(collection, recordId);
   const dek = await getDEK(collection);
-  const envelope = await encodeIntentEnvelope(intent, dek);
+  const envelope = await encodeIntentEnvelope(intent, dek, key);
   try {
     await adapter.put(vault, BLOB_INTENT_COLLECTION, key, envelope, 0);
   } catch (err) {
@@ -344,10 +344,10 @@ async function recordAppliedStamp(adapter, vault, collection, recordId, getDEK,
   for (let attempt = 0; attempt < MAX_APPLIED_STAMP_RETRIES; attempt++) {
     const envelope = await adapter.get(vault, BLOB_INTENT_COLLECTION, key);
     if (!envelope) return;
-    const intent = await decodeIntentEnvelope(envelope, dek);
+    const intent = await decodeIntentEnvelope(key, envelope, dek);
     if (intent.op !== "rehome" || intent.appliedStamps?.includes(stamp)) return;
     const updated = { ...intent, appliedStamps: [...intent.appliedStamps ?? [], stamp] };
-    const newEnvelope = await encodeIntentEnvelope(updated, dek, envelope._v + 1);
+    const newEnvelope = await encodeIntentEnvelope(updated, dek, key, envelope._v + 1);
     try {
       await adapter.put(vault, BLOB_INTENT_COLLECTION, key, newEnvelope, envelope._v);
       return;
@@ -366,7 +366,7 @@ async function sweepBlobIntents(adapter, vault, getDEK, resume, onResumeError) {
       const envelope = await adapter.get(vault, BLOB_INTENT_COLLECTION, key);
       if (!envelope) continue;
       const dek = await getDEK(parsed.collection);
-      const intent = await decodeIntentEnvelope(envelope, dek);
+      const intent = await decodeIntentEnvelope(key, envelope, dek);
       await resume(parsed.collection, parsed.recordId, intent);
     } catch (err) {
       onResumeError?.(parsed.collection, parsed.recordId, err);
@@ -654,7 +654,7 @@ var BlobSet = class _BlobSet {
       };
     }
     const dek = await this.getDEK(dekKey(this.collection, tier ?? await this.ownerTier()));
-    const json = await openEnvelopeJson(envelope, dek);
+    const json = await openEnvelopeJson({ collection: this.slotsCollection, id: this.recordId }, envelope, dek);
     return {
       slots: JSON.parse(json),
       version: envelope._v
@@ -678,38 +678,28 @@ var BlobSet = class _BlobSet {
     }
     const fromDek = await this.getDEK(dekKey(this.collection, fromTier));
     try {
-      const json2 = await openEnvelopeJson(envelope, fromDek);
+      const json2 = await openEnvelopeJson({ collection: this.slotsCollection, id: this.recordId }, envelope, fromDek);
       return { slots: JSON.parse(json2), version: envelope._v, atTier: fromTier };
     } catch (err) {
       if (!(err instanceof TamperedError) || fromTier === toTier) throw err;
     }
     const toDek = await this.getDEK(dekKey(this.collection, toTier));
-    const json = await openEnvelopeJson(envelope, toDek);
+    const json = await openEnvelopeJson({ collection: this.slotsCollection, id: this.recordId }, envelope, toDek);
     return { slots: JSON.parse(json), version: envelope._v, atTier: toTier };
   }
   /** @param tier See {@link loadSlots}'s `tier` param — same resolution. */
   async saveSlots(slots, currentVersion, tier) {
     const json = JSON.stringify(slots);
     const now = (/* @__PURE__ */ new Date()).toISOString();
+    const identity = { collection: this.slotsCollection, id: this.recordId, version: currentVersion + 1 };
+    const body = { ts: now };
     let envelope;
     if (this.encrypted) {
       const dek = await this.getDEK(dekKey(this.collection, tier ?? await this.ownerTier()));
-      const { iv, data } = await encrypt(json, dek);
-      envelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: currentVersion + 1,
-        _ts: now,
-        _iv: iv,
-        _data: data
-      };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+      envelope = buildRecordEnvelope(identity, { ...body, iv, data });
     } else {
-      envelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: currentVersion + 1,
-        _ts: now,
-        _iv: "",
-        _data: json
-      };
+      envelope = buildRecordEnvelope(identity, { ...body, iv: "", data: json });
     }
     await this.store.put(
       this.vault,
@@ -844,14 +834,14 @@ var BlobSet = class _BlobSet {
     const fallbackTier = alsoTryTier ?? (t > 0 ? 0 : void 0);
     const primaryDek = await this.getDEK(dekKey(BLOB_COLLECTION, t));
     try {
-      const json2 = await openEnvelopeJson(envelope, primaryDek);
+      const json2 = await openEnvelopeJson({ collection: BLOB_INDEX_COLLECTION, id: eTag }, envelope, primaryDek);
       return { blob: JSON.parse(json2), version: envelope._v, atTier: t };
     } catch (err) {
       if (!(err instanceof TamperedError)) throw err;
       if (fallbackTier === void 0 || fallbackTier === t) throw err;
     }
     const fallbackDek = await this.getDEK(dekKey(BLOB_COLLECTION, fallbackTier));
-    const json = await openEnvelopeJson(envelope, fallbackDek);
+    const json = await openEnvelopeJson({ collection: BLOB_INDEX_COLLECTION, id: eTag }, envelope, fallbackDek);
     return { blob: JSON.parse(json), version: envelope._v, atTier: fallbackTier };
   }
   /**
@@ -891,12 +881,13 @@ var BlobSet = class _BlobSet {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const newVersion = (expectedVersion ?? 0) + 1;
     let envelope;
+    const identity = { collection: BLOB_INDEX_COLLECTION, id: blob.eTag, version: newVersion };
     if (this.encrypted) {
       const dek = await this.getDEK(dekKey(BLOB_COLLECTION, tier ?? await this.ownerTier()));
-      const { iv, data } = await encrypt(json, dek);
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: newVersion, _ts: now, _iv: iv, _data: data };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+      envelope = buildRecordEnvelope(identity, { ts: now, iv, data });
     } else {
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: newVersion, _ts: now, _iv: "", _data: json };
+      envelope = buildRecordEnvelope(identity, { ts: now, iv: "", data: json });
     }
     await this.store.put(
       this.vault,
@@ -1449,7 +1440,7 @@ var BlobSet = class _BlobSet {
       const envelope = await this.store.get(this.vault, this.versionsCollection, key);
       if (!envelope) continue;
       try {
-        const record = this.encrypted ? JSON.parse(await openEnvelopeJson(envelope, dek)) : JSON.parse(envelope._data);
+        const record = this.encrypted ? JSON.parse(await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek)) : JSON.parse(envelope._data);
         holds.set(record.eTag, (holds.get(record.eTag) ?? 0) + 1);
         readable.push(key);
       } catch {
@@ -1733,13 +1724,13 @@ var BlobSet = class _BlobSet {
     if (!this.encrypted) return { record: JSON.parse(envelope._data), atTier: fromTier };
     const fromDek = await this.getDEK(dekKey(this.collection, fromTier));
     try {
-      const json2 = await openEnvelopeJson(envelope, fromDek);
+      const json2 = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, fromDek);
       return { record: JSON.parse(json2), atTier: fromTier };
     } catch (err) {
       if (!(err instanceof TamperedError) || fromTier === toTier) throw err;
     }
     const toDek = await this.getDEK(dekKey(this.collection, toTier));
-    const json = await openEnvelopeJson(envelope, toDek);
+    const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, toDek);
     return { record: JSON.parse(json), atTier: toTier };
   }
   /**
@@ -1901,18 +1892,13 @@ var BlobSet = class _BlobSet {
     const id = `${eTag}_${index}`;
     const now = (/* @__PURE__ */ new Date()).toISOString();
     let envelope;
+    const identity = { collection: BLOB_CHUNKS_COLLECTION, id, version: 1 };
     if (dek) {
       const aad = chunkAAD(eTag, index, chunkCount);
       const { iv, data } = await encryptBytesWithAAD(chunk, dek, aad);
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: iv, _data: data };
+      envelope = buildRecordEnvelope(identity, { ts: now, iv, data });
     } else {
-      envelope = {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: 1,
-        _ts: now,
-        _iv: "",
-        _data: bufferToBase64(chunk)
-      };
+      envelope = buildRecordEnvelope(identity, { ts: now, iv: "", data: bufferToBase64(chunk) });
     }
     await this.store.put(this.vault, BLOB_CHUNKS_COLLECTION, id, envelope);
   }
@@ -1962,7 +1948,7 @@ var BlobSet = class _BlobSet {
       return JSON.parse(envelope._data);
     }
     const dek = await this.getDEK(dekKey(this.collection, tier ?? await this.ownerTier()));
-    const json = await openEnvelopeJson(envelope, dek);
+    const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek);
     return JSON.parse(json);
   }
   /** @param tier See {@link loadVersionRecord}'s `tier` param — same resolution. */
@@ -1983,12 +1969,13 @@ var BlobSet = class _BlobSet {
     const json = JSON.stringify(record);
     const now = (/* @__PURE__ */ new Date()).toISOString();
     let envelope;
+    const identity = { collection: this.versionsCollection, id: key, version: 1 };
     if (this.encrypted) {
       const dek = await this.getDEK(dekKey(this.collection, tier));
-      const { iv, data } = await encrypt(json, dek);
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: iv, _data: data };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+      envelope = buildRecordEnvelope(identity, { ts: now, iv, data });
     } else {
-      envelope = { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: now, _iv: "", _data: json };
+      envelope = buildRecordEnvelope(identity, { ts: now, iv: "", data: json });
     }
     await this.store.put(this.vault, this.versionsCollection, key, envelope);
   }
@@ -2887,7 +2874,7 @@ var BlobSet = class _BlobSet {
         versions.push(JSON.parse(envelope._data));
       } else {
         const dek = await this.getDEK(this.collection);
-        const json = await openEnvelopeJson(envelope, dek);
+        const json = await openEnvelopeJson({ collection: this.versionsCollection, id: key }, envelope, dek);
         versions.push(JSON.parse(json));
       }
     }
@@ -3070,4 +3057,4 @@ export {
   DEFAULT_CHUNK_SIZE,
   BlobSet
 };
-//# sourceMappingURL=chunk-ES36R3U2.js.map
+//# sourceMappingURL=chunk-IOURTXTM.js.map