@noy-db/hub 0.6.0-pre.17 → 0.6.0-pre.19

package/dist/{chunk-BKYQNNO3.js → chunk-D5UDZANO.js}

@@ -2,19 +2,19 @@ import {
   buildRecordEnvelope,
   isDeleteMarker,
   isTombstone
-} from "./chunk-RGPB25DB.js";
+} from "./chunk-ZVAFJQZB.js";
 import {
   blindedEqual,
   openVdigPayload,
   sealVdigPayload
-} from "./chunk-FSZPQCDR.js";
+} from "./chunk-OQLYMBJI.js";
 import {
   dualReadSealedSlot,
   parseSealedSlot
-} from "./chunk-HVR74IBG.js";
+} from "./chunk-DJ23QZIN.js";
 import {
   mintBidxTag
-} from "./chunk-RBTZLXZJ.js";
+} from "./chunk-SFD2LL7G.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -33,11 +33,11 @@ import {
   generateSalt,
   unwrapCek,
   wrapCek
-} from "./chunk-QTDAPDDV.js";
+} from "./chunk-VJ4B3ZXY.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-5UGEGEIJ.js";
+} from "./chunk-3Y4OFWQJ.js";
 import {
   ClassifiedConfigError,
   ClassifiedRotationError,
@@ -46,7 +46,48 @@ import {
   SchemaValidationError,
   TamperedError,
   ValidationError
-} from "./chunk-I64WQSN3.js";
+} from "./chunk-P7L3OQLL.js";
+
+// src/kernel/enclave/record-aad.ts
+var SCHEME = "noydb-aad/2";
+var encoder = new TextEncoder();
+function buildRecordAad(identity) {
+  if (!Number.isFinite(identity.version)) {
+    throw new TypeError(
+      `record AAD: version must be a finite number for "${identity.collection}/${identity.id}", received ${String(identity.version)}. Sealing without one produces a record no reader can open.`
+    );
+  }
+  const parts = [encoder.encode(SCHEME)];
+  const pushField = (value) => {
+    const bytes = encoder.encode(value);
+    const len = new Uint8Array(4);
+    new DataView(len.buffer).setUint32(0, bytes.length, false);
+    parts.push(len, bytes);
+  };
+  pushField(identity.collection);
+  pushField(identity.id);
+  pushField(String(identity.tier ?? 0));
+  parts.push(new Uint8Array([identity.by === void 0 ? 0 : 1]));
+  if (identity.by !== void 0) pushField(identity.by);
+  pushField(String(identity.version));
+  const total = parts.reduce((n, p) => n + p.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const p of parts) {
+    out.set(p, offset);
+    offset += p.length;
+  }
+  return out;
+}
+function recordAadFor(ref, envelope) {
+  return buildRecordAad({
+    collection: ref.collection,
+    id: ref.id,
+    version: envelope._v,
+    tier: envelope._tier,
+    by: envelope._by
+  });
+}
 
 // src/kernel/enclave/record-keys/lifecycle.ts
 async function resolveStableCek(deps, id) {
@@ -62,15 +103,17 @@ async function resolveStableCek(deps, id) {
   deps.cache?.set(id, fresh, 1);
   return fresh;
 }
-async function rewrapBodyToDek(envelope, fromDek, toDek) {
+async function rewrapBodyToDek(from, to, envelope, fromDek, toDek) {
+  const openAad = buildRecordAad(from);
+  const sealAad = buildRecordAad(to);
   if (envelope._cek !== void 0) {
     const cek = await unwrapCek(envelope._cek, fromDek);
-    const plaintext2 = await decrypt(envelope._iv, envelope._data, cek);
-    const { iv: iv2, data: data2 } = await encrypt(plaintext2, cek);
+    const plaintext2 = await decrypt(envelope._iv, envelope._data, cek, openAad);
+    const { iv: iv2, data: data2 } = await encrypt(plaintext2, cek, sealAad);
     return { _iv: iv2, _data: data2, _cek: await wrapCek(cek, toDek), cek };
   }
-  const plaintext = await decrypt(envelope._iv, envelope._data, fromDek);
-  const { iv, data } = await encrypt(plaintext, toDek);
+  const plaintext = await decrypt(envelope._iv, envelope._data, fromDek, openAad);
+  const { iv, data } = await encrypt(plaintext, toDek, sealAad);
   return { _iv: iv, _data: data, cek: null };
 }
 function applyRewrappedBody(envelope, body) {
@@ -85,15 +128,15 @@ function applyRewrappedBody(envelope, body) {
   }
   return next;
 }
-async function rewrapEnvelope(envelope, fromDek, toDek) {
-  return applyRewrappedBody(envelope, await rewrapBodyToDek(envelope, fromDek, toDek));
+async function rewrapEnvelope(identity, envelope, fromDek, toDek) {
+  return applyRewrappedBody(envelope, await rewrapBodyToDek(identity, identity, envelope, fromDek, toDek));
 }
-async function isRewrappedUnder(envelope, dek) {
+async function isRewrappedUnder(identity, envelope, dek) {
   try {
     if (envelope._cek !== void 0) {
       await unwrapCek(envelope._cek, dek);
     } else {
-      await decrypt(envelope._iv, envelope._data, dek);
+      await decrypt(envelope._iv, envelope._data, dek, buildRecordAad(identity));
     }
     return true;
   } catch {
@@ -102,24 +145,25 @@ async function isRewrappedUnder(envelope, dek) {
 }
 
 // src/kernel/enclave/record-keys/rekey.ts
-async function rekeyEnvelopeToDek(envelope, oldDek, newDek) {
+async function rekeyEnvelopeToDek(ref, envelope, oldDek, newDek) {
+  const aad = recordAadFor(ref, envelope);
   const { _bidx, ...carried } = envelope;
   void _bidx;
   if (envelope._cek !== void 0) {
     const cek = await unwrapCek(envelope._cek, oldDek);
     return { ...carried, _cek: await wrapCek(cek, newDek) };
   }
-  const plaintext = await decrypt(envelope._iv, envelope._data, oldDek);
-  const { iv, data } = await encrypt(plaintext, newDek);
+  const plaintext = await decrypt(envelope._iv, envelope._data, oldDek, aad);
+  const { iv, data } = await encrypt(plaintext, newDek, aad);
   return { ...carried, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: iv, _data: data };
 }
-async function rekeyEnvelopeIfNeeded(envelope, oldDek, newDek) {
+async function rekeyEnvelopeIfNeeded(ref, envelope, oldDek, newDek) {
   try {
-    return await rekeyEnvelopeToDek(envelope, oldDek, newDek);
+    return await rekeyEnvelopeToDek(ref, envelope, oldDek, newDek);
   } catch (errUnderOld) {
     try {
       if (envelope._cek !== void 0) await unwrapCek(envelope._cek, newDek);
-      else await decrypt(envelope._iv, envelope._data, newDek);
+      else await decrypt(envelope._iv, envelope._data, newDek, recordAadFor(ref, envelope));
       return null;
     } catch {
       throw errUnderOld;
@@ -127,32 +171,6 @@ async function rekeyEnvelopeIfNeeded(envelope, oldDek, newDek) {
   }
 }
 
-// src/kernel/enclave/record-aad.ts
-var SCHEME = "noydb-aad/1";
-var encoder = new TextEncoder();
-function buildRecordAad(identity) {
-  const parts = [encoder.encode(SCHEME)];
-  const pushField = (value) => {
-    const bytes = encoder.encode(value);
-    const len = new Uint8Array(4);
-    new DataView(len.buffer).setUint32(0, bytes.length, false);
-    parts.push(len, bytes);
-  };
-  pushField(identity.collection);
-  pushField(identity.id);
-  pushField(String(identity.tier ?? 0));
-  parts.push(new Uint8Array([identity.by === void 0 ? 0 : 1]));
-  if (identity.by !== void 0) pushField(identity.by);
-  const total = parts.reduce((n, p) => n + p.length, 0);
-  const out = new Uint8Array(total);
-  let offset = 0;
-  for (const p of parts) {
-    out.set(p, offset);
-    offset += p.length;
-  }
-  return out;
-}
-
 // src/kernel/enclave/record-keys/sealed-slots.ts
 async function sealOneFieldWithDek(field, value, dek, keyMaterial) {
   const fieldKey = keyMaterial.cek !== void 0 ? await deriveSealedFieldKeyFromCek(keyMaterial.cek, keyMaterial.collection, field) : await deriveSealedFieldKey(dek, keyMaterial.collection, field);
@@ -228,22 +246,17 @@ function makeReservedEnvelopes(dekResolver, declaredPrefixes) {
         );
       }
     };
-    const encryptForPrefix = async (collection, json, v) => {
-      assertPrefixed(collection, "encrypt");
-      const dek = await dekResolver(collection);
-      const { iv, data } = await encrypt(json, dek);
-      return {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: v,
-        _ts: (/* @__PURE__ */ new Date()).toISOString(),
-        _iv: iv,
-        _data: data
-      };
+    const encryptForPrefix = async (ref, json, v) => {
+      assertPrefixed(ref.collection, "encrypt");
+      const dek = await dekResolver(ref.collection);
+      const identity = { ...ref, version: v };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+      return buildRecordEnvelope(identity, { iv, data });
     };
-    const decryptForPrefix = async (collection, env) => {
+    const decryptForPrefix = async (collection, id, env) => {
       assertPrefixed(collection, "decrypt");
       const dek = await dekResolver(collection);
-      return decrypt(env._iv, env._data, dek);
+      return decrypt(env._iv, env._data, dek, recordAadFor({ collection, id }, env));
     };
     return { encrypt: encryptForPrefix, decrypt: decryptForPrefix };
   };
@@ -373,30 +386,12 @@ var RecordCodec = class _RecordCodec {
    * parts. Pure, no crypto. Each call stamps its own `_ts` — provenance carries
    * a SEPARATE timestamp (computed by the caller), so the two never share one.
    */
-  static buildEnvelope(p) {
-    return {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: p.version,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: p.iv,
-      _data: p.data,
-      ...p.by !== void 0 ? { _by: p.by } : {},
-      ...p.cek !== void 0 ? { _cek: p.cek } : {},
-      ...p.provenance !== void 0 ? { _source: p.provenance.source, _sourceTs: p.provenance.sourceTs } : {},
-      ...p.extra ?? {}
-    };
+  static buildEnvelope(identity, p) {
+    return buildRecordEnvelope(identity, p);
   }
   /** Plaintext (`_iv:''`) body envelope — the `!storeCiphertext` shape. */
-  static buildPlaintextEnvelope(p) {
-    return {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: p.version,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: "",
-      _data: p.data,
-      ...p.by !== void 0 ? { _by: p.by } : {},
-      ...p.provenance !== void 0 ? { _source: p.provenance.source, _sourceTs: p.provenance.sourceTs } : {}
-    };
+  static buildPlaintextEnvelope(identity, p) {
+    return buildRecordEnvelope(identity, { ...p, iv: "" });
   }
   // ──────────────────────────────────────────────────────────────────────
   // Write path
@@ -409,22 +404,20 @@ var RecordCodec = class _RecordCodec {
    * (see {@link encryptRecord}). Rejects `_`-prefixed record fields, which
    * would collide with the reserved metadata namespace.
    */
-  buildDebugEnvelope(record, version, source, sourceTs) {
+  buildDebugEnvelope(id, record, version, source, sourceTs) {
     const rec = record;
     for (const key of Object.keys(rec)) {
       if (key.startsWith("_")) throw new DebugReservedFieldError(this.ctx.name, key);
     }
-    return {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: version,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: "",
-      _data: "",
-      _by: this.ctx.actor,
-      _debug: NOYDB_FORMAT_VERSION,
-      ...this.ctx.provenance && source !== void 0 ? { _source: source, _sourceTs: sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : {},
-      ...rec
-    };
+    const base = buildRecordEnvelope(
+      { collection: this.ctx.name, id, by: this.ctx.actor, version },
+      {
+        iv: "",
+        data: "",
+        ...this.ctx.provenance && source !== void 0 ? { provenance: { source, sourceTs: sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } } : {}
+      }
+    );
+    return { ...base, _debug: NOYDB_FORMAT_VERSION, ...rec };
   }
   /**
    * Encrypt a JSON body into an envelope.
@@ -435,24 +428,56 @@ var RecordCodec = class _RecordCodec {
    * path encrypts the body directly under the collection DEK — byte-identical
    * to pre-CEK behaviour, so non-adopting collections pay nothing.
    */
-  async encryptJsonString(json, version, cek, source, sourceTs) {
-    const by = this.ctx.actor;
+  /**
+   * `ref` is the identity the envelope is sealed against, and it is **the
+   * location the bytes are stored at** — not necessarily this codec's own
+   * collection (#1051).
+   *
+   * That distinction was discovered here rather than assumed. Several callers
+   * put the result somewhere else entirely: search's vector sidecar lands in
+   * `_vec` under `encodeVecId(name, id)`, the lexical index under `_ft/<name>`,
+   * indexing's entries under a synthetic `idxId`. A codec that supplied
+   * `this.ctx.name` for those would seal them against a collection they are not
+   * in, and once AAD binds identity every one of them would fail to verify.
+   *
+   * ⚠️ **`_history` is the open case, and it is #1041's to settle.** Snapshots
+   * are produced with the LIVE record's identity here and then re-homed by
+   * `saveHistory` into `_history/<historyId(collection,id,_v)>`. Both readings
+   * are defensible — bind where it lives, or bind what it is a copy of — and
+   * the choice must be made before AAD is switched on, not inferred from this
+   * migration.
+   */
+  async encryptJsonString(ref, json, version, cek, source, sourceTs) {
+    const identity = { ...ref, version, by: this.ctx.actor };
     const provenance = this.ctx.provenance && source !== void 0 ? { source, sourceTs: sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : void 0;
     if (!this.ctx.storeCiphertext) {
-      return _RecordCodec.buildPlaintextEnvelope({ version, data: json, by, provenance });
+      return _RecordCodec.buildPlaintextEnvelope(identity, { data: json, provenance });
     }
     const dek = await this.ctx.getDEK();
+    const aad = buildRecordAad(identity);
     if (cek !== void 0) {
-      const { iv: iv2, data: data2 } = await encrypt(json, cek);
+      const { iv: iv2, data: data2 } = await encrypt(json, cek, aad);
       const wrapped = await wrapCek(cek, dek);
-      return _RecordCodec.buildEnvelope({ version, iv: iv2, data: data2, by, cek: wrapped, provenance });
+      return _RecordCodec.buildEnvelope(identity, { iv: iv2, data: data2, cek: wrapped, provenance });
     }
-    const { iv, data } = await encrypt(json, dek);
-    return _RecordCodec.buildEnvelope({ version, iv, data, by, provenance });
+    const { iv, data } = await encrypt(json, dek, aad);
+    return _RecordCodec.buildEnvelope(identity, { iv, data, provenance });
   }
-  async encryptRecord(record, version, cek, source, sourceTs, vdig, id) {
+  /**
+   * `ref` is FIRST and required (#1051). It was previously a trailing optional
+   * `id?: string`, which TypeScript cannot promote to required because it sits
+   * after other optionals — so the migration would have needed an `id ?? ''`
+   * fallback. That is exactly the silent default this issue exists to remove:
+   * once identity is bound into the AEAD, every record written with an empty id
+   * binds to the SAME identity and becomes interchangeable with the others.
+   * An object, not a bare string, so a swap with `version`/`source` cannot
+   * compile on the hottest write path. Carries the collection too — see
+   * {@link encryptJsonString} for why the codec must not assume its own.
+   */
+  async encryptRecord(ref, record, version, cek, source, sourceTs, vdig) {
+    const id = ref.id;
     if (!this.ctx.storeCiphertext && this.ctx.debugPlaintext && !this.ctx.name.startsWith("_")) {
-      return this.buildDebugEnvelope(record, version, source, sourceTs);
+      return this.buildDebugEnvelope(id, record, version, source, sourceTs);
     }
     if (this.ctx.storeCiphertext) {
       const declared = this.ctx.vdigFields;
@@ -479,9 +504,9 @@ var RecordCodec = class _RecordCodec {
     let openRecord = record;
     let sealed;
     if (this.ctx.storeCiphertext && this.ctx.via?.hasAtRestHooks) {
-      if (id === void 0) {
+      if (id === "") {
         throw new Error(
-          `RecordCodec.encryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this write path supplied no record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
+          `RecordCodec.encryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this write path supplied an empty record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
         );
       }
       const src = record;
@@ -489,7 +514,7 @@ var RecordCodec = class _RecordCodec {
       openRecord = result.record;
       if (result.sealed !== void 0) {
         sealed = {};
-        for (const [field, ref] of Object.entries(result.sealed)) sealed[field] = `${ref.iv}:${ref.data}`;
+        for (const [field, ref2] of Object.entries(result.sealed)) sealed[field] = `${ref2.iv}:${ref2.data}`;
       }
     } else if (this.ctx.storeCiphertext && this.ctx.sensitiveFields.size > 0) {
       const src = record;
@@ -554,7 +579,7 @@ var RecordCodec = class _RecordCodec {
       if (Object.keys(out).length > 0) vdigOut = out;
       if (Object.keys(bidxOut).length > 0) bidxOutMap = bidxOut;
     }
-    const base = await this.encryptJsonString(JSON.stringify(openRecord), version, cek, source, sourceTs);
+    const base = await this.encryptJsonString(ref, JSON.stringify(openRecord), version, cek, source, sourceTs);
     const withSealed = sealed ? { ...base, _sealed: sealed } : base;
     const withVdig = vdigOut ? { ...withSealed, _vdig: vdigOut } : withSealed;
     const withBidx = bidxOutMap ? { ...withVdig, _bidx: bidxOutMap } : withVdig;
@@ -609,7 +634,15 @@ var RecordCodec = class _RecordCodec {
    * The optional `id` lets reads populate the CEK cache; it is omitted by
    * callers (history, conflict merge) that have only the envelope.
    */
-  async decryptJsonString(envelope, id) {
+  /**
+   * `ref` must be the SAME identity the writer sealed against — which is the
+   * storage address, not necessarily this codec's own collection. Search's
+   * vector sidecar lives in `_vec`, its lexical index in `_ft`; passing
+   * `this.ctx.name` for those would recompute the wrong AAD and fail to open a
+   * perfectly good record (#1041).
+   */
+  async decryptJsonString(ref, envelope) {
+    const id = ref.id;
     if (isTombstone(envelope, this.ctx.storeCiphertext) || isDeleteMarker(envelope)) return null;
     if (!this.ctx.storeCiphertext) {
       if (envelope._debug !== void 0) {
@@ -621,10 +654,11 @@ var RecordCodec = class _RecordCodec {
       }
       return envelope._data === "" ? null : envelope._data;
     }
+    const aad = recordAadFor(ref, envelope);
     const cek = await this.resolveEnvelopeCek(envelope, id);
-    if (cek !== void 0) return decrypt(envelope._iv, envelope._data, cek);
+    if (cek !== void 0) return decrypt(envelope._iv, envelope._data, cek, aad);
     const dek = await this.ctx.getDEK();
-    return decrypt(envelope._iv, envelope._data, dek);
+    return decrypt(envelope._iv, envelope._data, dek, aad);
   }
   /**
    * Unseal a single `_sealed[field]` slot to its plaintext value: derive the
@@ -748,7 +782,7 @@ var RecordCodec = class _RecordCodec {
    */
   async applySealedSlots(record, sealed, cek, opts = {}) {
     if (this.ctx.via?.hasAtRestHooks) {
-      if (opts.id === void 0) {
+      if (opts.id === void 0 || opts.id === "") {
         throw new Error(
           `RecordCodec.decryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this read path supplied no record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
         );
@@ -798,15 +832,17 @@ var RecordCodec = class _RecordCodec {
    * output-recompute path, not the public per-record read surface schema
    * validation guards.
    */
-  async decryptRecordAtDek(envelope, dek, id) {
+  async decryptRecordAtDek(ref, envelope, dek) {
+    const id = ref.id;
     if (isTombstone(envelope, this.ctx.storeCiphertext) || isDeleteMarker(envelope)) return null;
     let plaintext;
     let cek;
+    const aad = recordAadFor(ref, envelope);
     if (envelope._cek !== void 0) {
       cek = await unwrapCek(envelope._cek, dek);
-      plaintext = await decrypt(envelope._iv, envelope._data, cek);
+      plaintext = await decrypt(envelope._iv, envelope._data, cek, aad);
     } else {
-      plaintext = await decrypt(envelope._iv, envelope._data, dek);
+      plaintext = await decrypt(envelope._iv, envelope._data, dek, aad);
     }
     let record = JSON.parse(plaintext);
     if (envelope._sealed !== void 0 && this.ctx.storeCiphertext) {
@@ -829,8 +865,8 @@ var RecordCodec = class _RecordCodec {
    * that may predate a schema change, so validating it would be a
    * false positive. Every non-history read leaves this flag `false`.
    */
-  async decryptRecord(envelope, opts = {}) {
-    const json = await this.decryptJsonString(envelope, opts.id);
+  async decryptRecord(ref, envelope, opts = {}) {
+    const json = await this.decryptJsonString(ref, envelope);
     if (json === null) return null;
     let parsed = JSON.parse(json);
     if (this.ctx.crdtMode && parsed !== null && typeof parsed === "object" && "_crdt" in parsed) {
@@ -838,9 +874,9 @@ var RecordCodec = class _RecordCodec {
     }
     let record = parsed;
     if (envelope._sealed !== void 0 && this.ctx.storeCiphertext) {
-      const sealedCek = await this.resolveEnvelopeCek(envelope, opts.id);
+      const sealedCek = await this.resolveEnvelopeCek(envelope, ref.id);
       record = await this.applySealedSlots(record, envelope._sealed, sealedCek, {
-        ...opts.id !== void 0 ? { id: opts.id } : {},
+        id: ref.id,
         ...opts.sealedAsHandles !== void 0 ? { sealedAsHandles: opts.sealedAsHandles } : {}
       });
     }
@@ -895,9 +931,8 @@ async function sealRecordToHost(ctx, collection, id, hostSealer, opts) {
   const envelopeKey = `${collection}/${id}/${hint.pid}`;
   const prior = await ctx.adapter.get(ctx.vault, SEALED_CEK_NS, envelopeKey);
   const env = buildRecordEnvelope(
-    { collection: SEALED_CEK_NS, id: envelopeKey },
+    { collection: SEALED_CEK_NS, id: envelopeKey, version: (prior?._v ?? 0) + 1 },
     {
-      version: (prior?._v ?? 0) + 1,
       // AES-GCM bypassed — the sealing layer is the security boundary, exactly
       // like the managed-secret `_meta/sealed-secret` envelope.
       iv: "",
@@ -922,9 +957,26 @@ async function rotateRecordCek(ctx, collection, id) {
   }
   const dek = await ctx.getDEK(collection);
   const oldCek = await unwrapCek(live._cek, dek);
-  const json = await decrypt(live._iv, live._data, oldCek);
+  const openAad = recordAadFor({ collection, id }, live);
+  const json = await decrypt(live._iv, live._data, oldCek, openAad);
+  const rotatedIdentity = {
+    // A CEK rotation DOES bump `_v` (asserted in `record-scoped-cek-sealing`:
+    // "the live envelope was re-keyed — new `_cek`, bumped `_v`"), so it seals
+    // at the new version, not the one it just opened.
+    //
+    // ⚠️ Do not confuse this with `rekeyEnvelopeToDek`, the DEK-rotation helper,
+    // which PRESERVES `_v` (#1074) because it re-keys a record without writing
+    // one. Two rotations, opposite answers — and with `_v` bound (#1093) getting
+    // it backwards no longer produces a wrong number, it produces an
+    // unreadable record.
+    collection,
+    id,
+    version: live._v + 1,
+    ...live._tier !== void 0 ? { tier: live._tier } : {},
+    ...ctx.actor ? { by: ctx.actor } : live._by !== void 0 ? { by: live._by } : {}
+  };
   const newCek = await generateDEK();
-  const { iv, data } = await encrypt(json, newCek);
+  const { iv, data } = await encrypt(json, newCek, buildRecordAad(rotatedIdentity));
   let sealedOut;
   if (live._sealed !== void 0) {
     const out = {};
@@ -944,14 +996,11 @@ async function rotateRecordCek(ctx, collection, id) {
     }
     vdigOut = out;
   }
-  const env = buildRecordEnvelope({ collection, id }, {
-    version: live._v + 1,
+  const env = buildRecordEnvelope(rotatedIdentity, {
     iv,
     data,
     cek: await wrapCek(newCek, dek),
-    ...ctx.actor ? { by: ctx.actor } : {},
     extra: {
-      ...live._tier !== void 0 ? { _tier: live._tier } : {},
       ...live._det !== void 0 ? { _det: live._det } : {},
       // `_bidx` (equality-index tag) is DEK-rooted and CEK-independent, so it is
       // carried forward VERBATIM — not recomputed — unlike `_vdig`/`_sealed`
@@ -1011,7 +1060,7 @@ async function findByDet(ctx, field, value) {
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env || !env._det || (env._tier ?? 0) > 0) continue;
     if (env._det[field] === target || env._det[field] === legacyTarget) {
-      return ctx.codec.decryptRecord(env, { id });
+      return ctx.codec.decryptRecord({ collection: ctx.name, id }, env);
     }
   }
   return null;
@@ -1025,7 +1074,7 @@ async function queryByDet(ctx, field, value) {
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env || !env._det || (env._tier ?? 0) > 0) continue;
     if (env._det[field] === target || env._det[field] === legacyTarget) {
-      const rec = await ctx.codec.decryptRecord(env, { id });
+      const rec = await ctx.codec.decryptRecord({ collection: ctx.name, id }, env);
       if (rec !== null) matches.push(rec);
     }
   }
@@ -1033,23 +1082,25 @@ async function queryByDet(ctx, field, value) {
 }
 
 // src/kernel/enclave/record-keys/envelope-body.ts
-async function openEnvelopeJson(env, key, opts) {
+async function openEnvelopeJson(ref, env, key, opts) {
   if (opts?.encrypted === false) return env._data;
+  const aad = recordAadFor(ref, env);
   if (env._cek !== void 0) {
     const cek = await unwrapCek(env._cek, key);
-    return decrypt(env._iv, env._data, cek);
+    return decrypt(env._iv, env._data, cek, aad);
   }
-  return decrypt(env._iv, env._data, key);
+  return decrypt(env._iv, env._data, key, aad);
 }
-async function writeEnvelopeBody(json, key, opts) {
+async function writeEnvelopeBody(identity, json, key, opts) {
   if (opts?.encrypted === false) return { _iv: "", _data: json };
+  const aad = buildRecordAad(identity);
   if (opts?.perRecordKey === true) {
     const cek = await generateDEK();
-    const { iv: iv2, data: data2 } = await encrypt(json, cek);
+    const { iv: iv2, data: data2 } = await encrypt(json, cek, aad);
     const wrapped = await wrapCek(cek, key);
     return { _iv: iv2, _data: data2, _cek: wrapped };
   }
-  const { iv, data } = await encrypt(json, key);
+  const { iv, data } = await encrypt(json, key, aad);
   return { _iv: iv, _data: data };
 }
 function envelopeBodySize(env) {
@@ -1072,6 +1123,18 @@ function envelopeBodyForHash(env) {
   if (env._bidx !== void 0) segments.push(mapPart("_bidx", env._bidx));
   return `{${segments.join(",")}}`;
 }
+function hasSealedBody(env) {
+  return env._iv !== "";
+}
+async function verifyRecordIdentity(ref, env, key) {
+  if (!hasSealedBody(env)) return true;
+  try {
+    await openEnvelopeJson(ref, env, key);
+    return true;
+  } catch {
+    return false;
+  }
+}
 
 // src/kernel/enclave/broker/proof.ts
 var subtle2 = globalThis.crypto.subtle;
@@ -1157,6 +1220,8 @@ async function verifyBrokerProof(args) {
 }
 
 export {
+  buildRecordAad,
+  recordAadFor,
   resolveStableCek,
   rewrapBodyToDek,
   applyRewrappedBody,
@@ -1164,7 +1229,6 @@ export {
   isRewrappedUnder,
   rekeyEnvelopeToDek,
   rekeyEnvelopeIfNeeded,
-  buildRecordAad,
   makeReservedEnvelopes,
   validateSchemaInput,
   validateSchemaOutput,
@@ -1180,10 +1244,12 @@ export {
   envelopeBodySize,
   hasPerRecordKey,
   envelopeBodyForHash,
+  hasSealedBody,
+  verifyRecordIdentity,
   deriveBrokerProofBits,
   deriveBrokerProofKey,
   computeBrokerProof,
   issueChallenge,
   verifyBrokerProof
 };
-//# sourceMappingURL=chunk-BKYQNNO3.js.map
+//# sourceMappingURL=chunk-D5UDZANO.js.map