@noy-db/hub 0.6.0-pre.17 → 0.6.0-pre.19

package/dist/{store-coordination-provider-Y3VXBHPL.js → store-coordination-provider-TFHZLKHG.js}

@@ -1,24 +1,30 @@
 import {
   loadFence,
   saveFence
-} from "./chunk-C52CJDFO.js";
+} from "./chunk-HJRTFXAA.js";
+import "./chunk-D5UDZANO.js";
 import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-5UGEGEIJ.js";
+  buildRecordEnvelope
+} from "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-P7L3OQLL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/with-shape/schema-update/client-registry.ts
 var META_COLLECTION = "_meta";
 var CLIENT_PREFIX = "schema-fence:client:";
 async function writeClientDoc(store, vault, clientId, doc) {
-  const envelope = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: "",
-    _data: JSON.stringify({ clientId, ...doc })
-  };
-  await store.put(vault, META_COLLECTION, `${CLIENT_PREFIX}${clientId}`, envelope);
+  const recordId = `${CLIENT_PREFIX}${clientId}`;
+  const envelope = buildRecordEnvelope(
+    { collection: META_COLLECTION, id: recordId, version: 1 },
+    { iv: "", data: JSON.stringify({ clientId, ...doc }) }
+  );
+  await store.put(vault, META_COLLECTION, recordId, envelope);
 }
 async function listClientDocs(store, vault) {
   const ids = await store.list(vault, META_COLLECTION);
@@ -139,4 +145,4 @@ function unref(timer) {
 export {
   StoreCoordinationProvider
 };
-//# sourceMappingURL=store-coordination-provider-Y3VXBHPL.js.map
+//# sourceMappingURL=store-coordination-provider-TFHZLKHG.js.map

package/dist/store-coordination-provider-TFHZLKHG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-shape/schema-update/client-registry.ts","../src/with-shape/schema-update/store-coordination-provider.ts"],"sourcesContent":["/**\n * Schema-cutover client registry. Each client keeps a\n * heartbeat doc at `_meta/schema-fence:client:<clientId>` carrying its\n * liveness (`lastSeen`) and the fence generation it has quiesced for\n * (`quiescedAtVersion`). Plaintext envelope, like the fence doc.\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { buildRecordEnvelope } from '../../kernel/enclave/index.js'\n\nconst META_COLLECTION = '_meta'\nconst CLIENT_PREFIX = 'schema-fence:client:'\n\nexport interface ClientDoc {\n  readonly clientId: string\n  readonly lastSeen: number\n  readonly quiescedAtVersion: number | null\n  /**\n   * Session that owns this writer (one user's writers across vaults). Additive\n   * and optional so legacy client docs (written without it) keep parsing;\n   * readers default it.\n   */\n  readonly sessionId?: string\n}\n\nexport async function writeClientDoc(\n  store: NoydbStore,\n  vault: string,\n  clientId: string,\n  doc: { lastSeen: number; quiescedAtVersion: number | null; sessionId?: string },\n): Promise<void> {\n  const recordId = `${CLIENT_PREFIX}${clientId}`\n  const envelope = buildRecordEnvelope(\n    { collection: META_COLLECTION, id: recordId, version: 1 },\n    { iv: '', data: JSON.stringify({ clientId, ...doc }) },\n  )\n  await store.put(vault, META_COLLECTION, recordId, envelope)\n}\n\nexport async function listClientDocs(store: NoydbStore, vault: string): Promise<ClientDoc[]> {\n  const ids = await store.list(vault, META_COLLECTION)\n  const out: ClientDoc[] = []\n  for (const id of ids) {\n    if (!id.startsWith(CLIENT_PREFIX)) continue\n    const env = await store.get(vault, META_COLLECTION, id)\n    if (!env) continue\n    try {\n      const parsed = JSON.parse(env._data) as unknown\n      if (isClientDoc(parsed)) out.push(parsed)\n    } catch { /* skip corrupt */ }\n  }\n  return out\n}\n\n/**\n * True when every *active* client (lastSeen within staleMs of now) has\n * `quiescedAtVersion === generation`. Stale clients are ignored. An empty\n * active set is vacuously quiesced.\n */\nexport async function activeQuiesced(\n  store: NoydbStore,\n  vault: string,\n  opts: { generation: number; now: number; staleMs: number; excludeClientId?: string },\n): Promise<boolean> {\n  const docs = await listClientDocs(store, vault)\n  const active = docs.filter(\n    d => d.lastSeen >= opts.now - opts.staleMs && d.clientId !== opts.excludeClientId,\n  )\n  return active.every(d => d.quiescedAtVersion === opts.generation)\n}\n\nfunction isClientDoc(x: unknown): x is ClientDoc {\n  if (x === null || typeof x !== 'object') return false\n  const o = x as Record<string, unknown>\n  return typeof o['clientId'] === 'string'\n    && typeof o['lastSeen'] === 'number'\n    && (o['quiescedAtVersion'] === null || typeof o['quiescedAtVersion'] === 'number')\n    && (o['sessionId'] === undefined || typeof o['sessionId'] === 'string')\n}\n","/**\n * Store-backed default {@link CoordinationProvider}.\n *\n * Maps the five coordination-port methods onto today's `_meta/schema-fence`\n * store ops so that, with no `by-*` provider injected, the fence service\n * reproduces its current store-polling behavior byte-for-byte. The `observe*`\n * methods are poll-emit (the legacy {@link FenceWatcher} model); `by-tabs` /\n * `by-peer` override them with real-time push.\n *\n * @module\n */\n\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { Unsubscribe } from '../../port/with/write-hooks.js'\nimport { loadFence, saveFence, type FenceDoc } from './fence.js'\nimport { writeClientDoc, listClientDocs, type ClientDoc } from './client-registry.js'\nimport type { CoordinationProvider, FenceState, WriterPresence } from '../../port/by/types.js'\n\n/**\n * Default poll cadence for the `observe*` fallbacks (ms). Matches the\n * store-poll granularity the fence-controller uses while waiting for quorum\n * (`delay(50)`); the same value the migration cutover falls back to when no\n * real-time provider is injected.\n */\nconst DEFAULT_POLL_INTERVAL_MS = 50\n\n/** Map a stored {@link ClientDoc} to the port's {@link WriterPresence}. */\nfunction toPresence(doc: ClientDoc): WriterPresence {\n  return {\n    writerId: doc.clientId,\n    // Legacy docs written without a sessionId (and explicit empty) have no\n    // session — fall back to the writerId so every presence is session-addressable.\n    sessionId: doc.sessionId && doc.sessionId.length > 0 ? doc.sessionId : doc.clientId,\n    lastSeen: doc.lastSeen,\n    quiescedAtVersion: doc.quiescedAtVersion,\n  }\n}\n\nfunction fenceEqual(a: FenceState, b: FenceState): boolean {\n  return a.currentSchemaVersion === b.currentSchemaVersion && a.fenceState === b.fenceState\n}\n\nfunction presenceListEqual(a: readonly WriterPresence[], b: readonly WriterPresence[]): boolean {\n  if (a.length !== b.length) return false\n  const key = (w: WriterPresence) => `${w.writerId}\\u0000${w.sessionId}\\u0000${w.lastSeen}\\u0000${String(w.quiescedAtVersion)}`\n  const bk = new Set(b.map(key))\n  return a.every((w) => bk.has(key(w)))\n}\n\nexport class StoreCoordinationProvider implements CoordinationProvider {\n  readonly #store: NoydbStore\n  readonly #pollIntervalMs: number\n\n  constructor(store: NoydbStore, opts?: { pollIntervalMs?: number }) {\n    this.#store = store\n    this.#pollIntervalMs = opts?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS\n  }\n\n  async setFence(vault: string, fence: FenceState): Promise<void> {\n    // FenceState is structurally FenceDoc (currentSchemaVersion + fenceState).\n    await saveFence(this.#store, vault, fence as FenceDoc)\n  }\n\n  async readFence(vault: string): Promise<FenceState> {\n    // FenceDoc is structurally FenceState (currentSchemaVersion + fenceState).\n    return loadFence(this.#store, vault)\n  }\n\n  observeFence(vault: string, onChange: (f: FenceState) => void): Unsubscribe {\n    let last: FenceState | null = null\n    let busy = false\n    const poll = async () => {\n      if (busy) return\n      busy = true\n      try {\n        const fence = await loadFence(this.#store, vault)\n        if (last === null || !fenceEqual(last, fence)) {\n          last = fence\n          onChange(fence)\n        }\n      } catch {\n        /* transient store error — retry next tick */\n      } finally {\n        busy = false\n      }\n    }\n    void poll() // emit current state once immediately\n    const timer = setInterval(() => void poll(), this.#pollIntervalMs)\n    unref(timer)\n    return () => clearInterval(timer)\n  }\n\n  async reportPresence(vault: string, p: WriterPresence): Promise<void> {\n    await writeClientDoc(this.#store, vault, p.writerId, {\n      lastSeen: p.lastSeen,\n      quiescedAtVersion: p.quiescedAtVersion,\n      sessionId: p.sessionId,\n    })\n  }\n\n  observePresence(vault: string, onChange: (writers: readonly WriterPresence[]) => void): Unsubscribe {\n    let last: readonly WriterPresence[] | null = null\n    let busy = false\n    const poll = async () => {\n      if (busy) return\n      busy = true\n      try {\n        const docs = await listClientDocs(this.#store, vault)\n        const writers = docs.map(toPresence)\n        if (last === null || !presenceListEqual(last, writers)) {\n          last = writers\n          onChange(writers)\n        }\n      } catch {\n        /* transient store error — retry next tick */\n      } finally {\n        busy = false\n      }\n    }\n    void poll() // emit current set once immediately\n    const timer = setInterval(() => void poll(), this.#pollIntervalMs)\n    unref(timer)\n    return () => clearInterval(timer)\n  }\n\n  async reachableWriters(vault: string, o: { staleMs: number; now: number }): Promise<readonly WriterPresence[]> {\n    const docs = await listClientDocs(this.#store, vault)\n    return docs.map(toPresence).filter((w) => o.now - w.lastSeen <= o.staleMs)\n  }\n}\n\n/** Best-effort `unref` so a poll timer never holds the process open (Node only). */\nfunction unref(timer: ReturnType<typeof setInterval>): void {\n  const t = timer as unknown as { unref?: () => void }\n  if (typeof t.unref === 'function') t.unref()\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AASA,IAAM,kBAAkB;AACxB,IAAM,gBAAgB;AActB,eAAsB,eACpB,OACA,OACA,UACA,KACe;AACf,QAAM,WAAW,GAAG,aAAa,GAAG,QAAQ;AAC5C,QAAM,WAAW;AAAA,IACf,EAAE,YAAY,iBAAiB,IAAI,UAAU,SAAS,EAAE;AAAA,IACxD,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC,EAAE;AAAA,EACvD;AACA,QAAM,MAAM,IAAI,OAAO,iBAAiB,UAAU,QAAQ;AAC5D;AAEA,eAAsB,eAAe,OAAmB,OAAqC;AAC3F,QAAM,MAAM,MAAM,MAAM,KAAK,OAAO,eAAe;AACnD,QAAM,MAAmB,CAAC;AAC1B,aAAW,MAAM,KAAK;AACpB,QAAI,CAAC,GAAG,WAAW,aAAa,EAAG;AACnC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,iBAAiB,EAAE;AACtD,QAAI,CAAC,IAAK;AACV,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,IAAI,KAAK;AACnC,UAAI,YAAY,MAAM,EAAG,KAAI,KAAK,MAAM;AAAA,IAC1C,QAAQ;AAAA,IAAqB;AAAA,EAC/B;AACA,SAAO;AACT;AAmBA,SAAS,YAAY,GAA4B;AAC/C,MAAI,MAAM,QAAQ,OAAO,MAAM,SAAU,QAAO;AAChD,QAAM,IAAI;AACV,SAAO,OAAO,EAAE,UAAU,MAAM,YAC3B,OAAO,EAAE,UAAU,MAAM,aACxB,EAAE,mBAAmB,MAAM,QAAQ,OAAO,EAAE,mBAAmB,MAAM,cACrE,EAAE,WAAW,MAAM,UAAa,OAAO,EAAE,WAAW,MAAM;AAClE;;;ACrDA,IAAM,2BAA2B;AAGjC,SAAS,WAAW,KAAgC;AAClD,SAAO;AAAA,IACL,UAAU,IAAI;AAAA;AAAA;AAAA,IAGd,WAAW,IAAI,aAAa,IAAI,UAAU,SAAS,IAAI,IAAI,YAAY,IAAI;AAAA,IAC3E,UAAU,IAAI;AAAA,IACd,mBAAmB,IAAI;AAAA,EACzB;AACF;AAEA,SAAS,WAAW,GAAe,GAAwB;AACzD,SAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,eAAe,EAAE;AACjF;AAEA,SAAS,kBAAkB,GAA8B,GAAuC;AAC9F,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,QAAM,MAAM,CAAC,MAAsB,GAAG,EAAE,QAAQ,KAAS,EAAE,SAAS,KAAS,EAAE,QAAQ,KAAS,OAAO,EAAE,iBAAiB,CAAC;AAC3H,QAAM,KAAK,IAAI,IAAI,EAAE,IAAI,GAAG,CAAC;AAC7B,SAAO,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;AACtC;AAEO,IAAM,4BAAN,MAAgE;AAAA,EAC5D;AAAA,EACA;AAAA,EAET,YAAY,OAAmB,MAAoC;AACjE,SAAK,SAAS;AACd,SAAK,kBAAkB,MAAM,kBAAkB;AAAA,EACjD;AAAA,EAEA,MAAM,SAAS,OAAe,OAAkC;AAE9D,UAAM,UAAU,KAAK,QAAQ,OAAO,KAAiB;AAAA,EACvD;AAAA,EAEA,MAAM,UAAU,OAAoC;AAElD,WAAO,UAAU,KAAK,QAAQ,KAAK;AAAA,EACrC;AAAA,EAEA,aAAa,OAAe,UAAgD;AAC1E,QAAI,OAA0B;AAC9B,QAAI,OAAO;AACX,UAAM,OAAO,YAAY;AACvB,UAAI,KAAM;AACV,aAAO;AACP,UAAI;AACF,cAAM,QAAQ,MAAM,UAAU,KAAK,QAAQ,KAAK;AAChD,YAAI,SAAS,QAAQ,CAAC,WAAW,MAAM,KAAK,GAAG;AAC7C,iBAAO;AACP,mBAAS,KAAK;AAAA,QAChB;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,SAAK,KAAK;AACV,UAAM,QAAQ,YAAY,MAAM,KAAK,KAAK,GAAG,KAAK,eAAe;AACjE,UAAM,KAAK;AACX,WAAO,MAAM,cAAc,KAAK;AAAA,EAClC;AAAA,EAEA,MAAM,eAAe,OAAe,GAAkC;AACpE,UAAM,eAAe,KAAK,QAAQ,OAAO,EAAE,UAAU;AAAA,MACnD,UAAU,EAAE;AAAA,MACZ,mBAAmB,EAAE;AAAA,MACrB,WAAW,EAAE;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,gBAAgB,OAAe,UAAqE;AAClG,QAAI,OAAyC;AAC7C,QAAI,OAAO;AACX,UAAM,OAAO,YAAY;AACvB,UAAI,KAAM;AACV,aAAO;AACP,UAAI;AACF,cAAM,OAAO,MAAM,eAAe,KAAK,QAAQ,KAAK;AACpD,cAAM,UAAU,KAAK,IAAI,UAAU;AACnC,YAAI,SAAS,QAAQ,CAAC,kBAAkB,MAAM,OAAO,GAAG;AACtD,iBAAO;AACP,mBAAS,OAAO;AAAA,QAClB;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,SAAK,KAAK;AACV,UAAM,QAAQ,YAAY,MAAM,KAAK,KAAK,GAAG,KAAK,eAAe;AACjE,UAAM,KAAK;AACX,WAAO,MAAM,cAAc,KAAK;AAAA,EAClC;AAAA,EAEA,MAAM,iBAAiB,OAAe,GAAyE;AAC7G,UAAM,OAAO,MAAM,eAAe,KAAK,QAAQ,KAAK;AACpD,WAAO,KAAK,IAAI,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO;AAAA,EAC3E;AACF;AAGA,SAAS,MAAM,OAA6C;AAC1D,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,UAAU,WAAY,GAAE,MAAM;AAC7C;","names":[]}

package/dist/sync/index.js

@@ -2,20 +2,20 @@ import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-7TZTQS4H.js";
+} from "../chunk-32O2N2CH.js";
 import {
   NO_SYNC
-} from "../chunk-JN64WH3U.js";
-import "../chunk-V4M4BZNW.js";
-import "../chunk-BKYQNNO3.js";
-import "../chunk-RGPB25DB.js";
-import "../chunk-FSZPQCDR.js";
-import "../chunk-HVR74IBG.js";
-import "../chunk-RBTZLXZJ.js";
+} from "../chunk-T7IR4N2S.js";
+import "../chunk-HTHRCGWP.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-QTDAPDDV.js";
-import "../chunk-5UGEGEIJ.js";
-import "../chunk-I64WQSN3.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
+import "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-sync/active.ts

package/dist/team/index.js

@@ -2,7 +2,7 @@ import {
   MemoryDeviceSealProvider,
   beginEchoUnlock,
   withTeam
-} from "../chunk-I7JF5TNL.js";
+} from "../chunk-LBDTQM3R.js";
 import {
   NO_TEAM,
   burnPaperRecoveryEntry,
@@ -31,8 +31,8 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-EEBMKMA7.js";
-import "../chunk-BMDF4TLU.js";
+} from "../chunk-LAFP5H5U.js";
+import "../chunk-DKYEVHZH.js";
 import {
   buildEchoBlock,
   buildRecipientKeyringFile,
@@ -53,20 +53,21 @@ import {
   updateKeyringIdentity,
   verifyPrompt,
   verifyTypedEcho
-} from "../chunk-WBHQX6ME.js";
-import "../chunk-QJBXB4WU.js";
-import "../chunk-YVOW35HH.js";
-import "../chunk-BKYQNNO3.js";
-import "../chunk-RGPB25DB.js";
-import "../chunk-FSZPQCDR.js";
-import "../chunk-HVR74IBG.js";
-import "../chunk-RBTZLXZJ.js";
+} from "../chunk-E6WANBD6.js";
+import "../chunk-JHO6FGZX.js";
+import "../chunk-HTMQBBF3.js";
+import "../chunk-47ZFULEZ.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-QTDAPDDV.js";
-import "../chunk-5UGEGEIJ.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
 import {
   TeamNotEnabledError
-} from "../chunk-I64WQSN3.js";
+} from "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   MemoryDeviceSealProvider,

package/dist/tiers/index.js

@@ -11,19 +11,20 @@ import {
   putAtTier,
   syncDerivedOutputs,
   withTiers
-} from "../chunk-VUQZYVYX.js";
-import "../chunk-YVOW35HH.js";
-import "../chunk-BKYQNNO3.js";
-import "../chunk-RGPB25DB.js";
-import "../chunk-FSZPQCDR.js";
-import "../chunk-HVR74IBG.js";
-import "../chunk-RBTZLXZJ.js";
+} from "../chunk-6S466CMQ.js";
+import "../chunk-HTMQBBF3.js";
+import "../chunk-47ZFULEZ.js";
+import "../chunk-D5UDZANO.js";
+import "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
 import "../chunk-LP7BEXCT.js";
-import "../chunk-QTDAPDDV.js";
-import "../chunk-5UGEGEIJ.js";
+import "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
 import {
   TiersNotEnabledError
-} from "../chunk-I64WQSN3.js";
+} from "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 export {
   NO_TIERS,

package/dist/to/index.js

@@ -5,7 +5,7 @@ import {
   PodVersionConflictError,
   StoreCapabilityError,
   UnknownStoreKindError
-} from "../chunk-I64WQSN3.js";
+} from "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/port/to/locator.ts

package/dist/transactions/index.js

@@ -3,16 +3,16 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-4444HN72.js";
+} from "../chunk-GT72D4FO.js";
 import {
   lazy
 } from "../chunk-5D2ALSM5.js";
 import "../chunk-4AOERLTV.js";
-import "../chunk-I64WQSN3.js";
+import "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/with-commit/tx/dry-run.ts
-var loadGuardExecutor = lazy(() => import("../executor-WFTHIDT7.js"));
+var loadGuardExecutor = lazy(() => import("../executor-LJSMZ4IB.js"));
 var SEP = " ";
 var keyOf = (op) => `${op.vaultName}${SEP}${op.collectionName}${SEP}${op.id}`;
 async function runDryRun(db, fn) {

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-I64WQSN3.js";
+} from "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/vault-head/index.js

@@ -0,0 +1,111 @@
+import {
+  DEFAULT_HEAD_BUCKETS,
+  NO_VAULT_HEAD,
+  VAULT_HEAD_COLLECTION
+} from "../chunk-HK67PX4J.js";
+import {
+  buildRecordAad,
+  openEnvelopeJson
+} from "../chunk-D5UDZANO.js";
+import {
+  buildRecordEnvelope
+} from "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
+import "../chunk-LP7BEXCT.js";
+import {
+  encrypt
+} from "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
+import "../chunk-P7L3OQLL.js";
+import "../chunk-PZ5AY32C.js";
+
+// src/with-commit/vault-head/head.ts
+function bucketIndex(collection, id, buckets) {
+  let h = 2166136261;
+  const s = `${collection}/${id}`;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return h % buckets;
+}
+function bucketId(collection, id, buckets) {
+  return `${collection}::${String(bucketIndex(collection, id, buckets))}`;
+}
+async function readBucket(store, vault, dek, bucket) {
+  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket);
+  if (!env) return { body: {}, version: 0 };
+  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek);
+  return { body: JSON.parse(json), version: env._v };
+}
+async function writeBucket(store, vault, dek, bucket, body, expectedVersion) {
+  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 };
+  const json = JSON.stringify(body);
+  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+  const env = buildRecordEnvelope(identity, { iv, data });
+  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || void 0);
+}
+
+// src/with-commit/vault-head/active.ts
+function withVaultHead(opts = {}) {
+  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS;
+  const dekFor = (getDEK) => getDEK(VAULT_HEAD_COLLECTION);
+  return {
+    enabled: true,
+    bucketFor: (collection, id) => bucketId(collection, id, buckets),
+    async note(store, vault, getDEK, entry) {
+      const dek = await dekFor(getDEK);
+      const bucket = bucketId(entry.collection, entry.id, buckets);
+      const { body, version } = await readBucket(store, vault, dek, bucket);
+      const key = `${entry.collection}/${entry.id}`;
+      if ((body[key] ?? -1) >= entry.version) return;
+      body[key] = entry.version;
+      await writeBucket(store, vault, dek, bucket, body, version);
+    },
+    async expected(store, vault, getDEK, collection, id) {
+      const dek = await dekFor(getDEK);
+      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets));
+      return body[`${collection}/${id}`] ?? null;
+    },
+    async knownIn(store, vault, getDEK, collection) {
+      const dek = await dekFor(getDEK);
+      const out = /* @__PURE__ */ new Map();
+      const prefix = `${collection}/`;
+      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {
+        if (!bucket.startsWith(`${collection}::`)) continue;
+        const { body } = await readBucket(store, vault, dek, bucket);
+        for (const [k, v] of Object.entries(body)) {
+          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v);
+        }
+      }
+      return out;
+    }
+  };
+}
+
+// src/with-commit/vault-head/verify.ts
+async function verifyVaultHead(head, store, vault, getDEK, collection) {
+  const known = await head.knownIn(store, vault, getDEK, collection);
+  const discrepancies = [];
+  for (const [id, expected] of known) {
+    const env = await store.get(vault, collection, id);
+    if (env === null) {
+      discrepancies.push({ collection, id, expected, actual: null, kind: "withheld" });
+      continue;
+    }
+    if (env._v < expected) {
+      discrepancies.push({ collection, id, expected, actual: env._v, kind: "rolled-back" });
+    }
+  }
+  return { checked: known.size, discrepancies, clean: discrepancies.length === 0 };
+}
+export {
+  DEFAULT_HEAD_BUCKETS,
+  NO_VAULT_HEAD,
+  VAULT_HEAD_COLLECTION,
+  verifyVaultHead,
+  withVaultHead
+};
+//# sourceMappingURL=index.js.map

package/dist/vault-head/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/with-commit/vault-head/head.ts","../../src/with-commit/vault-head/active.ts","../../src/with-commit/vault-head/verify.ts"],"sourcesContent":["/**\n * The vault head's storage layer (#1044).\n *\n * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it\n * inherits #1041's identity binding for free: the store cannot relocate a\n * bucket, re-author it, or serve one bucket's bytes as another's. What it can\n * still do is serve an OLD bucket, which is why {@link readBucket} enforces\n * monotonicity against the caller's own record of what it last wrote.\n *\n * @packageDocumentation\n */\nimport { encrypt, buildRecordAad, openEnvelopeJson, buildRecordEnvelope, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { VAULT_HEAD_COLLECTION } from './strategy.js'\n\n/** `{ recordId → version }` for one bucket. */\nexport type BucketBody = Record<string, number>\n\n/**\n * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands\n * in is not secret — the store already sees which bucket was written, and it\n * already saw the record's own address. Choosing something stronger would buy\n * nothing and cost every write.\n */\nexport function bucketIndex(collection: string, id: string, buckets: number): number {\n  let h = 0x811c9dc5\n  const s = `${collection}/${id}`\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  return h % buckets\n}\n\nexport function bucketId(collection: string, id: string, buckets: number): string {\n  return `${collection}::${String(bucketIndex(collection, id, buckets))}`\n}\n\nexport async function readBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n): Promise<{ body: BucketBody; version: number }> {\n  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket)\n  if (!env) return { body: {}, version: 0 }\n  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek)\n  return { body: JSON.parse(json) as BucketBody, version: env._v }\n}\n\nexport async function writeBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n  body: BucketBody,\n  expectedVersion: number,\n): Promise<void> {\n  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 }\n  const json = JSON.stringify(body)\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(identity, { iv, data })\n  // CAS: two writers racing on one bucket must not silently lose an entry.\n  // A lost head entry is a record the sweep stops expecting — a false clean.\n  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || undefined)\n}\n","/**\n * The real {@link VaultHeadStrategy} (#1044).\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport {\n  DEFAULT_HEAD_BUCKETS,\n  VAULT_HEAD_COLLECTION,\n  type HeadEntry,\n  type VaultHeadStrategy,\n  type WithVaultHeadOptions,\n} from './strategy.js'\nimport { bucketId, readBucket, writeBucket } from './head.js'\n\nexport function withVaultHead(opts: WithVaultHeadOptions = {}): VaultHeadStrategy {\n  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS\n\n  const dekFor = (getDEK: (c: string) => Promise<EnclaveKey>) => getDEK(VAULT_HEAD_COLLECTION)\n\n  return {\n    enabled: true,\n    bucketFor: (collection, id) => bucketId(collection, id, buckets),\n\n    async note(store: NoydbStore, vault, getDEK, entry: HeadEntry) {\n      const dek = await dekFor(getDEK)\n      const bucket = bucketId(entry.collection, entry.id, buckets)\n      const { body, version } = await readBucket(store, vault, dek, bucket)\n      const key = `${entry.collection}/${entry.id}`\n      // Monotonic: a head entry never moves BACKWARD. A write that would lower\n      // it is either a stale retry or a rollback being laundered through the\n      // client's own head, and neither should be recorded.\n      if ((body[key] ?? -1) >= entry.version) return\n      body[key] = entry.version\n      await writeBucket(store, vault, dek, bucket, body, version)\n    },\n\n    async expected(store, vault, getDEK, collection, id) {\n      const dek = await dekFor(getDEK)\n      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets))\n      return body[`${collection}/${id}`] ?? null\n    },\n\n    async knownIn(store, vault, getDEK, collection) {\n      const dek = await dekFor(getDEK)\n      const out = new Map<string, number>()\n      const prefix = `${collection}/`\n      // Sweep every bucket: a record's bucket is a function of its id, so the\n      // set for one collection is spread across all of them.\n      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {\n        if (!bucket.startsWith(`${collection}::`)) continue\n        const { body } = await readBucket(store, vault, dek, bucket)\n        for (const [k, v] of Object.entries(body)) {\n          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v)\n        }\n      }\n      return out\n    },\n  }\n}\n","/**\n * The sweep — comparing what the head expects against what the store serves (#1044).\n *\n * This is the only place absence becomes visible. #1041 and #1042 can reject a\n * record that lies about itself; neither can notice one that never arrived, or\n * one served at an older version than the client wrote. Both are indistinguishable\n * from the truth without an independent record of what should be there.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { VaultHeadStrategy } from './strategy.js'\n\n/** One record the store is not serving faithfully. */\nexport interface HeadDiscrepancy {\n  readonly collection: string\n  readonly id: string\n  /** What the client last committed. */\n  readonly expected: number\n  /**\n   * What the store serves now — or `null` when it serves nothing.\n   *\n   * The two are different attacks wearing the same result. `null` is\n   * **suppression**: the record is gone. A lower number is **rollback**: an\n   * authentic older version served in place of the current one, which is the\n   * case no amount of per-envelope authentication can see.\n   */\n  readonly actual: number | null\n  readonly kind: 'withheld' | 'rolled-back'\n}\n\nexport interface HeadVerifyResult {\n  readonly checked: number\n  readonly discrepancies: readonly HeadDiscrepancy[]\n  /** `true` when every record the head knows about is served at or above its expected version. */\n  readonly clean: boolean\n}\n\n/**\n * Sweep one collection.\n *\n * **A record the store serves that the head does NOT know is not reported.**\n * That is not an oversight: the head can be enabled on an existing vault, and\n * every pre-existing record would otherwise read as an anomaly. The head's\n * claim is one-directional — *what I wrote must still be there* — and an\n * unknown record simply falls outside it.\n *\n * **A HIGHER version than expected is also not reported**, for the same reason:\n * another device legitimately advanced it. The head detects going backwards, not\n * moving forwards.\n */\nexport async function verifyVaultHead(\n  head: VaultHeadStrategy,\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  collection: string,\n): Promise<HeadVerifyResult> {\n  const known = await head.knownIn(store, vault, getDEK, collection)\n  const discrepancies: HeadDiscrepancy[] = []\n\n  for (const [id, expected] of known) {\n    const env = await store.get(vault, collection, id)\n    if (env === null) {\n      discrepancies.push({ collection, id, expected, actual: null, kind: 'withheld' })\n      continue\n    }\n    if (env._v < expected) {\n      discrepancies.push({ collection, id, expected, actual: env._v, kind: 'rolled-back' })\n    }\n  }\n\n  return { checked: known.size, discrepancies, clean: discrepancies.length === 0 }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBO,SAAS,YAAY,YAAoB,IAAY,SAAyB;AACnF,MAAI,IAAI;AACR,QAAM,IAAI,GAAG,UAAU,IAAI,EAAE;AAC7B,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AACA,SAAO,IAAI;AACb;AAEO,SAAS,SAAS,YAAoB,IAAY,SAAyB;AAChF,SAAO,GAAG,UAAU,KAAK,OAAO,YAAY,YAAY,IAAI,OAAO,CAAC,CAAC;AACvE;AAEA,eAAsB,WACpB,OACA,OACA,KACA,QACgD;AAChD,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,uBAAuB,MAAM;AAChE,MAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE;AACxC,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,OAAO,GAAG,KAAK,GAAG;AAC/F,SAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,IAAI,GAAG;AACjE;AAEA,eAAsB,YACpB,OACA,OACA,KACA,QACA,MACA,iBACe;AACf,QAAM,WAAW,EAAE,YAAY,uBAAuB,IAAI,QAAQ,SAAS,kBAAkB,EAAE;AAC/F,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,MAAM,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAGtD,QAAM,MAAM,IAAI,OAAO,uBAAuB,QAAQ,KAAK,mBAAmB,MAAS;AACzF;;;ACjDO,SAAS,cAAc,OAA6B,CAAC,GAAsB;AAChF,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,SAAS,CAAC,WAA+C,OAAO,qBAAqB;AAE3F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,YAAY,OAAO,SAAS,YAAY,IAAI,OAAO;AAAA,IAE/D,MAAM,KAAK,OAAmB,OAAO,QAAQ,OAAkB;AAC7D,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,SAAS,SAAS,MAAM,YAAY,MAAM,IAAI,OAAO;AAC3D,YAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AACpE,YAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAI3C,WAAK,KAAK,GAAG,KAAK,OAAO,MAAM,QAAS;AACxC,WAAK,GAAG,IAAI,MAAM;AAClB,YAAM,YAAY,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO;AAAA,IAC5D;AAAA,IAEA,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,IAAI;AACnD,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,CAAC;AACtF,aAAO,KAAK,GAAG,UAAU,IAAI,EAAE,EAAE,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,QAAQ,YAAY;AAC9C,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,MAAM,oBAAI,IAAoB;AACpC,YAAM,SAAS,GAAG,UAAU;AAG5B,iBAAW,UAAU,MAAM,MAAM,KAAK,OAAO,qBAAqB,GAAG;AACnE,YAAI,CAAC,OAAO,WAAW,GAAG,UAAU,IAAI,EAAG;AAC3C,cAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,cAAI,EAAE,WAAW,MAAM,EAAG,KAAI,IAAI,EAAE,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,QAC7D;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACRA,eAAsB,gBACpB,MACA,OACA,OACA,QACA,YAC2B;AAC3B,QAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,UAAU;AACjE,QAAM,gBAAmC,CAAC;AAE1C,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,QAAI,QAAQ,MAAM;AAChB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,MAAM,MAAM,WAAW,CAAC;AAC/E;AAAA,IACF;AACA,QAAI,IAAI,KAAK,UAAU;AACrB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,IAAI,IAAI,MAAM,cAAc,CAAC;AAAA,IACtF;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,MAAM,MAAM,eAAe,OAAO,cAAc,WAAW,EAAE;AACjF;","names":[]}

package/dist/{verify-SHJXGZGM.js → verify-J6DEOXP3.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-FSZPQCDR.js";
+} from "./chunk-OQLYMBJI.js";
 import {
   dualReadSealedSlot
-} from "./chunk-HVR74IBG.js";
+} from "./chunk-DJ23QZIN.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-QTDAPDDV.js";
+} from "./chunk-VJ4B3ZXY.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -137,4 +137,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-SHJXGZGM.js.map
+//# sourceMappingURL=verify-J6DEOXP3.js.map

package/dist/walk-BX4NSB5L.js

@@ -0,0 +1,21 @@
+import {
+  dumpVaultSchema
+} from "./chunk-SG3OQCRG.js";
+import "./chunk-KHKKD62N.js";
+import "./chunk-N7YAQKAO.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-YVTADFTC.js";
+import "./chunk-D5UDZANO.js";
+import "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-P7L3OQLL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-BX4NSB5L.js.map

package/dist/with-audit/periods/periods.d.ts

@@ -501,7 +501,7 @@ export interface ReadOnlyCollection<T> {
  * @internal — called by Vault methods that need the closed-period
  * cache. Not part of the public API surface.
  */
-export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt: (envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
+export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
 /**
  * Given the current ordered period list, pick the last entry that
  * belongs to the hash chain — used as the `priorPeriodHash` anchor

package/dist/with-audit/periods/strategy.d.ts

@@ -17,7 +17,7 @@ import type { PeriodRecord, PeriodPartition, PartitionResolver } from './periods
  * @internal
  */
 export interface PeriodsStrategy {
-    loadPeriods(adapter: NoydbStore, vault: string, decrypt: (envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
+    loadPeriods(adapter: NoydbStore, vault: string, decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
     chainAnchor(records: readonly PeriodRecord[], partition?: PeriodPartition): Promise<{
         priorPeriodName?: string;
         priorPeriodHash: string;

package/dist/with-audit/sealed-record/index.d.ts

@@ -46,10 +46,23 @@ export { SealedRecordNotEnabledError } from '../../kernel/errors.js';
  * @param expectedCollection Collection the caller believes `recordEnvelope` is in.
  * @param expectedId         Record id the caller believes `recordEnvelope` is.
  * @returns The decrypted record body as a JSON string.
+ *
+ * ⚠️ **`recordEnvelope` must carry `_tier` and `_by`, not just the body**
+ * (#1041). They are plaintext metadata rather than secrets, but they are bound
+ * into the record's AAD, so a host handed only `{_iv, _data}` cannot
+ * reconstruct the identity the body was sealed against.
+ *
+ * That is a feature, not a tax: it means a host cannot be fed a body with its
+ * tags stripped or rewritten — a re-tiered or re-authored envelope no longer
+ * opens, even with a valid sealed CEK.
  */
 export declare function openSealedRecord(sealedCekEnvelope: SealedCekDeliveryEnvelope, recordEnvelope: {
     readonly _iv: string;
     readonly _data: string;
+    /** Bound into the AAD since #1093 — a rewound body no longer opens. */
+    readonly _v: number;
+    readonly _tier?: number | undefined;
+    readonly _by?: string | undefined;
 }, recipientSealer: {
     unseal(bytes: Uint8Array): Promise<Uint8Array>;
 }, expectedCollection: string, expectedId: string): Promise<string>;

package/dist/with-audit/tiers/index.d.ts

@@ -23,7 +23,7 @@
 export { withTiers } from './active.js';
 export { NO_TIERS, type TiersStrategy } from './strategy.js';
 export { TiersNotEnabledError } from '../../kernel/errors.js';
-import { type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js';
+import { type RecordIdentity, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
 import type { Lru } from '../../kernel/cache/index.js';
 import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
@@ -123,7 +123,22 @@ export interface TiersContext<T> {
      * pre-move body whenever `fromTier > 0`. No-op when history is disabled
      * (folds the `historyConfig.enabled` gate so `tiers/index.ts` stays simple).
      */
-    saveHistorySnapshot(id: string, envelope: EncryptedEnvelope): Promise<void>;
+    /**
+     * Persist a `_history` snapshot of `version`, sealed against the address it
+     * will be STORED at (#1041).
+     *
+     * Takes a **sealer**, not a finished envelope, because the destination
+     * identity is not knowable here: only the history strategy owns the
+     * `_history` layout. It hands the address in; the caller seals to it.
+     *
+     * ⚠️ The identity passed to `rewrapBodyToDek` must be what a READER will
+     * recompute — `recordAadFor(address, finalEnvelope)`. A tier-move snapshot
+     * strips `_tier`/`_elevatedBy` but KEEPS `_by`, so the destination is
+     * `{...address, by: envelope._by}` with no tier. Sealing against the bare
+     * address would produce history nothing can open, and the failure would
+     * surface only when someone reads it.
+     */
+    saveHistorySnapshot(id: string, version: number, seal: (address: RecordIdentity) => Promise<EncryptedEnvelope>): Promise<void>;
     /**
      * `true` iff a real history strategy is wired (not `NO_HISTORY`) AND not
      * explicitly disabled via `historyConfig.enabled`. `putAtTier` checks this

package/dist/with-commit/history/history.d.ts

@@ -1,5 +1,31 @@
+import type { RecordIdentity } from '../../kernel/enclave/index.js';
 import type { NoydbStore, EncryptedEnvelope, HistoryOptions, PruneOptions } from '../../kernel/types.js';
 import { type EnclaveKey } from '../../kernel/enclave/index.js';
+/**
+ * The identity a history snapshot is **sealed against** — its STORAGE location,
+ * not the live record it is a copy of (#1041).
+ *
+ * ## Why storage, and why this is a decision rather than a detail
+ *
+ * A snapshot is a copy, so two identities are available: the live record
+ * (`collection`/`recordId`) or where the bytes actually land
+ * (`_history`/`historyId(...)`). They are not equivalent under attack.
+ *
+ * Binding the LIVE identity makes a snapshot's AAD **indistinguishable from the
+ * live record's at the same version** — so an untrusted store could serve a
+ * history entry *as the current record* and the client would accept it. It also
+ * leaves entries relocatable within `_history`.
+ *
+ * Binding STORAGE identity closes both. The cost is that the id must be known
+ * *before* the envelope is sealed, where `saveHistory` previously derived it
+ * *after* (from `envelope._v`) — which is precisely the restructure this
+ * function exists to make possible.
+ *
+ * `saveHistory` uses this too, so the sealed identity and the put location have
+ * **one definition** and cannot drift apart. Changing the layout here changes
+ * both at once, by construction.
+ */
+export declare function historyIdentity(collection: string, recordId: string, version: number): RecordIdentity;
 /** Save a history entry (a complete encrypted envelope snapshot). */
 export declare function saveHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, envelope: EncryptedEnvelope): Promise<void>;
 /** Get history entries for a record, sorted newest-first. */

package/dist/with-commit/history/index.d.ts

@@ -17,7 +17,7 @@
  */
 export { withHistory } from './active.js';
 export type { HistoryStrategy } from './strategy.js';
-export { saveHistory, getHistory, getVersionEnvelope, pruneHistory, clearHistory, } from './history.js';
+export { saveHistory, historyIdentity, getHistory, getVersionEnvelope, pruneHistory, clearHistory, } from './history.js';
 export { diff, formatDiff } from './diff.js';
 export type { ChangeType, DiffEntry } from './diff.js';
 export { LedgerStore, LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, envelopePayloadHash, } from './ledger/store.js';
@@ -30,3 +30,4 @@ export { VaultInstant, CollectionInstant } from './time-machine.js';
 export type { VaultEngine } from './time-machine.js';
 /** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
 export { NO_HISTORY } from './strategy.js';
+export type { RecordIdentity } from '../../kernel/enclave/index.js';

package/dist/with-commit/history/ledger/store.d.ts

@@ -237,7 +237,13 @@ export declare class LedgerStore {
      * version/timestamp/actor) fully intact for audit purposes.
      */
     purgeRecordDeltas(collection: string, id: string): Promise<number>;
-    /** Encrypt a JSON Patch into an envelope for storage. Mirrors encryptEntry. */
+    /**
+     * Encrypt a JSON Patch into an envelope for storage. Mirrors encryptEntry.
+     *
+     * `index` is the ledger index this delta will be stored under — the caller
+     * knows it before the entry exists, and it is what makes the envelope's
+     * identity bindable (#1051).
+     */
     private encryptDelta;
     /**
      * Read all entries in ascending-index order. Used internally by

package/dist/with-commit/history/strategy.d.ts

@@ -33,7 +33,7 @@ import type { LedgerStore } from './ledger/store.js';
 import type { JsonPatch } from './ledger/patch.js';
 import type { DiffEntry } from './diff.js';
 import type { VaultInstant, VaultEngine } from './time-machine.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey, RecordIdentity } from '../../kernel/enclave/index.js';
 /**
  * Options accepted by `HistoryStrategy.buildLedger`. Mirrors the
  * `LedgerStore` constructor verbatim — kept in this file so `core`
@@ -58,6 +58,16 @@ export interface HistoryStrategy {
      * `NO_HISTORY`.
      */
     saveHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, envelope: EncryptedEnvelope): Promise<void>;
+    /**
+     * The identity a snapshot of `collection/recordId@version` must be **sealed
+     * against** — its `_history` storage location (#1041).
+     *
+     * On the port because the kernel writes history snapshots but must not import
+     * `with-commit` to learn its layout. Exposing it here keeps the derivation in
+     * the module that owns the layout, and `saveHistory` uses the same function,
+     * so the sealed identity and the put location cannot drift.
+     */
+    historyIdentity(collection: string, recordId: string, version: number): RecordIdentity;
     /**
      * List history envelopes for a record, newest first. Throws under
      * `NO_HISTORY` — callers reach this via `collection.history()` /

package/dist/with-commit/vault-head/active.d.ts

@@ -0,0 +1,2 @@
+import { type VaultHeadStrategy, type WithVaultHeadOptions } from './strategy.js';
+export declare function withVaultHead(opts?: WithVaultHeadOptions): VaultHeadStrategy;

package/dist/with-commit/vault-head/head.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The vault head's storage layer (#1044).
+ *
+ * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it
+ * inherits #1041's identity binding for free: the store cannot relocate a
+ * bucket, re-author it, or serve one bucket's bytes as another's. What it can
+ * still do is serve an OLD bucket, which is why {@link readBucket} enforces
+ * monotonicity against the caller's own record of what it last wrote.
+ *
+ * @packageDocumentation
+ */
+import { type EnclaveKey } from '../../kernel/enclave/index.js';
+import type { NoydbStore } from '../../kernel/types.js';
+/** `{ recordId → version }` for one bucket. */
+export type BucketBody = Record<string, number>;
+/**
+ * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands
+ * in is not secret — the store already sees which bucket was written, and it
+ * already saw the record's own address. Choosing something stronger would buy
+ * nothing and cost every write.
+ */
+export declare function bucketIndex(collection: string, id: string, buckets: number): number;
+export declare function bucketId(collection: string, id: string, buckets: number): string;
+export declare function readBucket(store: NoydbStore, vault: string, dek: EnclaveKey, bucket: string): Promise<{
+    body: BucketBody;
+    version: number;
+}>;
+export declare function writeBucket(store: NoydbStore, vault: string, dek: EnclaveKey, bucket: string, body: BucketBody, expectedVersion: number): Promise<void>;