@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.21

package/dist/with-audit/periods/periods.d.ts

@@ -146,7 +146,7 @@
  */
 import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
 import type { LedgerStore } from '../../with-commit/history/ledger/index.js';
-export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, periodExclusiveUpperBound, } from './window.js';
+export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, PERIOD_REOPENS_COLLECTION, periodExclusiveUpperBound, } from './window.js';
 /**
  * Companion record recording that a closed period was frozen (its delete
  * markers physically purged). Stored in {@link PERIOD_FREEZES_COLLECTION},
@@ -177,6 +177,73 @@ export interface TargetPurgeCount {
     readonly role: 'backup' | 'archive';
     readonly purgedCount: number;
 }
+/**
+ * One entry in a period's append-only reopen/reclose log (#1022).
+ *
+ * Real accounting close is a three-state lifecycle — open / closed / reopened
+ * — not a one-way door. A month gets closed, a missing invoice arrives or a
+ * filing is rejected, the month is reopened, corrected, and reclosed. The audit
+ * value is not the ability to write again; it is the chain being able to say
+ * *closed at T1, reopened at T2 by U, reclosed at T3*.
+ */
+export interface PeriodReopenEvent {
+    readonly op: 'reopen' | 'reclose';
+    /** ISO timestamp the event was recorded. */
+    readonly at: string;
+    /** userId of the keyring that performed it. */
+    readonly by: string;
+    /**
+     * `reopen` only — ISO instant after which the period re-seals on its own,
+     * with nobody acting. Absent means the window stays open until an explicit
+     * `reclosePeriod`.
+     */
+    readonly until?: string;
+    /** Free-text justification, carried verbatim into the audit trail. */
+    readonly reason?: string;
+}
+/**
+ * Companion holding a period's reopen/reclose history (#1022). Stored in
+ * {@link PERIOD_REOPENS_COLLECTION}, keyed by the period's storage key — kept
+ * OFF the hash-chained `_periods/<name>` record for the same reason freeze and
+ * archive are: reopening must never rewrite the close, or the chain that proves
+ * the close happened is the very thing the reopen destroys.
+ *
+ * `events` is APPEND-ONLY. Where the other companions are single-shot and
+ * idempotent, this one accumulates, because the cycle repeats.
+ */
+export interface PeriodReopenRecord {
+    readonly period: string;
+    readonly partition?: PeriodPartition;
+    readonly events: readonly PeriodReopenEvent[];
+}
+/**
+ * Collapse an append-only reopen log into the return-only fields merged onto a
+ * {@link PeriodRecord} on read.
+ *
+ * Expiry is deliberately NOT resolved here: `reopenedUntil` is carried through
+ * verbatim and compared against the clock at write-guard time, so a bounded
+ * window re-seals on its own without anything having to run.
+ *
+ * @internal
+ */
+export declare function resolveReopenState(events: readonly PeriodReopenEvent[]): {
+    reopenedAt?: string;
+    reopenedBy?: string;
+    reopenedUntil?: string;
+    reopenReason?: string;
+    reclosedAt?: string;
+    reopenCount: number;
+};
+/**
+ * Is this period writable right now on account of a reopen? (#1022)
+ *
+ * Three ways to be sealed again: never reopened, explicitly reclosed after the
+ * last reopen, or a bounded window that has elapsed. The clock is read by the
+ * caller and passed in, so the guard and any diagnostic agree on one instant.
+ *
+ * @internal
+ */
+export declare function isEffectivelyReopened(period: PeriodRecord, nowIso: string): boolean;
 /**
  * Companion record noting that a closed+frozen period's delete markers were
  * swept off the vault's push-only sync targets (#615). Stored in
@@ -189,6 +256,46 @@ export interface PeriodTargetPurgeRecord {
     readonly purgedBy: string;
     readonly targets: readonly TargetPurgeCount[];
 }
+/**
+ * Scope tuple for a period timeline (#1005).
+ *
+ * Identical in shape and semantics to `SequenceOptions.partition`: a
+ * partitioned timeline is always disjoint from any unpartitioned one, and from
+ * every other tuple. `['acme', 'vat']` and `['acme', 'wht']` are two
+ * independent close calendars for the same subject — which is the whole point,
+ * since sub-ledgers for one legal entity and one month routinely close on
+ * different statutory deadlines.
+ */
+export type PeriodPartition = readonly (string | number)[];
+/**
+ * Resolve the `_periods` storage key for a (name, partition) pair.
+ *
+ * Deliberately the same encoding as `resolveSequenceKey`: `name` verbatim when
+ * unpartitioned, else `${name}\x00${parts}` with each component
+ * `encodeURIComponent`d and `'/'`-joined. The null-byte separator cannot occur
+ * in a period name, so a partitioned key never collides with an unpartitioned
+ * one; URI-encoding keeps `['a/b']` distinct from `['a','b']`.
+ *
+ * @throws {ValidationError} on an empty component or a non-finite number.
+ * @internal
+ */
+export declare function resolvePeriodKey(name: string, partition?: PeriodPartition): string;
+/**
+ * Do two partitions denote the same timeline? Absent and empty both mean "the
+ * unpartitioned timeline", so they compare equal.
+ *
+ * @internal
+ */
+export declare function samePartition(a?: PeriodPartition, b?: PeriodPartition): boolean;
+/**
+ * Resolves a record to the timeline that governs it. Supplied by
+ * `withPeriods({ subjects })`; returns `undefined` for any collection with no
+ * mapping, which is what keeps an unconfigured vault on the single vault-wide
+ * timeline it has always had.
+ *
+ * @internal
+ */
+export type PartitionResolver = (collection: string, record: Record<string, unknown>) => PeriodPartition | undefined;
 /**
  * Stored record for one closed or opened accounting period. One entry
  * per period, keyed by `name` in the reserved `_periods` collection.
@@ -199,8 +306,19 @@ export interface PeriodTargetPurgeRecord {
  * into the next one, the same way the ledger's `prevHash` works.
  */
 export interface PeriodRecord {
-    /** Human-readable name (e.g., `'FY2026-Q1'`). Unique per vault. */
+    /**
+     * Human-readable name (e.g., `'FY2026-Q1'`). Unique per PARTITION — two
+     * timelines may each carry a `'2026-06'`, which is the normal case when one
+     * vault serves several subjects (#1005). Unique per vault when unpartitioned.
+     */
     readonly name: string;
+    /**
+     * The timeline this period belongs to. Absent = the vault-wide timeline.
+     * Two periods with the same `name` and different `partition` are unrelated:
+     * separate hash chains, separate close state, and the write guard applies
+     * each only to records that resolve to its own tuple.
+     */
+    readonly partition?: PeriodPartition;
     /**
      * Role discriminator. A period is `'closed'` from the moment its
      * `closedAt` is recorded; `'opened'` marks a period whose opening
@@ -261,6 +379,19 @@ export interface PeriodRecord {
     readonly targetsPurgedAt?: string;
     readonly targetsPurgedBy?: string;
     readonly targetsPurged?: readonly TargetPurgeCount[];
+    /** #1022 return-only — collapsed from the `_period_reopens/<key>` append-only
+     *  log on read; NEVER written into the stored `_periods/<name>` record, so a
+     *  reopen cannot disturb the inter-period hash chain. Absent = never reopened.
+     *  `reclosedAt` present (and >= `reopenedAt`) means the window was closed
+     *  again explicitly; `reopenedUntil` in the past means it lapsed on its own.
+     *  Use {@link isEffectivelyReopened} rather than reading these directly. */
+    readonly reopenedAt?: string;
+    readonly reopenedBy?: string;
+    readonly reopenedUntil?: string;
+    readonly reopenReason?: string;
+    readonly reclosedAt?: string;
+    /** How many times this period has been reopened, ever. */
+    readonly reopenCount?: number;
 }
 /** Options for `vault.closePeriod()`. */
 export interface ClosePeriodOptions {
@@ -283,11 +414,32 @@ export interface ClosePeriodOptions {
      * an explicit `dateField`.
      */
     readonly dateField?: string;
+    /**
+     * Close only this timeline (#1005). Omit for the vault-wide timeline.
+     *
+     * ```ts
+     * vault.closePeriod({
+     *   name: '2026-06', endDate: '2026-06-30', dateField: 'issuedAt',
+     *   partition: [clientId, 'vat'],
+     * })
+     * ```
+     *
+     * Which records the resulting seal applies to is decided by the
+     * `subjects` map passed to `withPeriods()` — without one, no record ever
+     * resolves to a partition and a partitioned close seals nothing.
+     */
+    readonly partition?: PeriodPartition;
 }
 /** Options for `vault.openPeriod()`. */
 export interface OpenPeriodOptions<TCollections = Record<string, Record<string, unknown>>> {
     /** Human-readable name for the new period. Must be unique. */
     readonly name: string;
+    /**
+     * The timeline to open in. Must match the partition of `fromPeriod` — a
+     * period cannot chain across timelines, since each carries its own hash
+     * chain (#1005).
+     */
+    readonly partition?: PeriodPartition;
     /** ISO lower bound of the new period (usually prior `endDate + 1 day`). */
     readonly startDate: string;
     /**
@@ -349,7 +501,7 @@ export interface ReadOnlyCollection<T> {
  * @internal — called by Vault methods that need the closed-period
  * cache. Not part of the public API surface.
  */
-export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt: (envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
+export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
 /**
  * Given the current ordered period list, pick the last entry that
  * belongs to the hash chain — used as the `priorPeriodHash` anchor
@@ -357,7 +509,7 @@ export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt:
  *
  * @internal
  */
-export declare function chainAnchor(records: readonly PeriodRecord[]): Promise<{
+export declare function chainAnchor(records: readonly PeriodRecord[], partition?: PeriodPartition): Promise<{
     priorPeriodName?: string;
     priorPeriodHash: string;
 }>;
@@ -382,7 +534,10 @@ export declare function chainAnchor(records: readonly PeriodRecord[]): Promise<{
 export declare function assertTsWritable(existing: {
     ts: string | null;
     record: Record<string, unknown> | null;
-} | null, incomingRecord: Record<string, unknown> | null, closedPeriods: readonly PeriodRecord[]): void;
+} | null, incomingRecord: Record<string, unknown> | null, closedPeriods: readonly PeriodRecord[], scope?: {
+    collection: string;
+    resolve?: PartitionResolver;
+}): void;
 /**
  * Sanity-check a proposed period name + endDate against existing
  * records. Shared by closePeriod / openPeriod so the two pathways
@@ -390,7 +545,7 @@ export declare function assertTsWritable(existing: {
  *
  * @internal
  */
-export declare function validatePeriodName(name: string, existing: readonly PeriodRecord[]): void;
+export declare function validatePeriodName(name: string, existing: readonly PeriodRecord[], partition?: PeriodPartition): void;
 /**
  * Wire a reserved-collection ledger append for a period record. The
  * period itself is stored via the adapter as an encrypted envelope;

package/dist/with-audit/periods/strategy.d.ts

@@ -12,21 +12,30 @@
  */
 import type { EncryptedEnvelope, NoydbStore } from '../../kernel/types.js';
 import type { LedgerStore } from '../../with-commit/history/ledger/store.js';
-import type { PeriodRecord } from './periods.js';
+import type { PeriodRecord, PeriodPartition, PartitionResolver } from './periods.js';
 /**
  * @internal
  */
 export interface PeriodsStrategy {
-    loadPeriods(adapter: NoydbStore, vault: string, decrypt: (envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
-    chainAnchor(records: readonly PeriodRecord[]): Promise<{
+    loadPeriods(adapter: NoydbStore, vault: string, decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
+    chainAnchor(records: readonly PeriodRecord[], partition?: PeriodPartition): Promise<{
         priorPeriodName?: string;
         priorPeriodHash: string;
     }>;
     assertTsWritable(existing: {
         ts: string | null;
         record: Record<string, unknown> | null;
-    } | null, incoming: Record<string, unknown> | null, periods: readonly PeriodRecord[]): void;
-    validatePeriodName(name: string, existing: readonly PeriodRecord[]): void;
+    } | null, incoming: Record<string, unknown> | null, periods: readonly PeriodRecord[], scope?: {
+        collection: string;
+        resolve?: PartitionResolver;
+    }): void;
+    validatePeriodName(name: string, existing: readonly PeriodRecord[], partition?: PeriodPartition): void;
+    /**
+     * Record → timeline resolver built from `withPeriods({ subjects })` (#1005).
+     * `undefined` when the caller configured no subjects, which keeps every
+     * record on the vault-wide timeline.
+     */
+    readonly partitionOf?: PartitionResolver;
     appendPeriodLedgerEntry(ledger: LedgerStore | null, actor: string, envelope: EncryptedEnvelope, periodName: string, collection?: string): Promise<void>;
 }
 export declare const NO_PERIODS: PeriodsStrategy;

package/dist/with-audit/periods/vault-facade.d.ts

@@ -3,7 +3,31 @@ import type { NoydbStore } from '../../kernel/types.js';
 import type { LedgerStore } from '../../with-commit/history/ledger/store.js';
 import type { Collection } from '../../kernel/collection.js';
 import type { PeriodsStrategy } from './strategy.js';
-import { type PeriodRecord, type TargetPurgeCount, type ClosePeriodOptions, type OpenPeriodOptions } from './periods.js';
+import { type PeriodRecord, type TargetPurgeCount, type ClosePeriodOptions, type OpenPeriodOptions, type PeriodPartition, type PeriodReopenEvent } from './periods.js';
+/** Selects one period timeline. Omit — or pass an empty tuple — for the vault-wide one (#1005). */
+export interface PeriodScope {
+    readonly partition?: PeriodPartition;
+}
+/** A scoped operation that also records a free-text justification in the audit trail. */
+export interface PeriodScopeWithReason extends PeriodScope {
+    readonly reason?: string;
+}
+/** Options for `vault.reopenPeriod()` (#1022). */
+export interface ReopenPeriodOptions extends PeriodScopeWithReason {
+    /**
+     * ISO instant after which the period re-seals BY ITSELF, with nobody acting.
+     * Omit for a window that stays open until an explicit `reclosePeriod()`.
+     *
+     * Expiry is evaluated against the clock on every write check, so a lapsed
+     * window needs no sweep, no timer and no cache invalidation to take effect.
+     */
+    readonly until?: string;
+}
+/** The persisted side of a write, as the period write-guard sees it. */
+export interface PeriodGuardPrior {
+    readonly ts: string | null;
+    readonly record: Record<string, unknown> | null;
+}
 /** Everything the moving period methods touched on the vault's `this.*`. */
 export interface VaultPeriodsDeps {
     /** Resolved periods strategy (NO_PERIODS when not configured). */
@@ -56,7 +80,7 @@ export declare class VaultPeriods {
      * read only. Idempotent: a second call is a no-op that returns the
      * same merged record without re-purging or re-appending a ledger entry.
      */
-    freezePeriod(name: string): Promise<PeriodRecord>;
+    freezePeriod(name: string, options?: PeriodScope): Promise<PeriodRecord>;
     /**
      * Archive a closed period (#613): physically relocates its in-window
      * records (those with `_ts < periodExclusiveUpperBound(endDate)`) from the
@@ -66,7 +90,7 @@ export declare class VaultPeriods {
      * through to cold) and idempotent: a second call is a no-op returning the
      * same merged record.
      */
-    archivePeriod(name: string): Promise<PeriodRecord>;
+    archivePeriod(name: string, options?: PeriodScope): Promise<PeriodRecord>;
     /**
      * Target-purge a closed period (#615): sweeps delete markers off the vault's
      * PUSH-ONLY sync targets (`backup`/`archive`) via `purgeTargets`, recording a
@@ -76,22 +100,77 @@ export declare class VaultPeriods {
      * Idempotent once run; with no push-only targets it writes no companion and
      * is re-runnable.
      */
-    purgePeriodTargets(name: string): Promise<PeriodRecord>;
+    purgePeriodTargets(name: string, options?: PeriodScope): Promise<PeriodRecord>;
     /** Merge target-purge companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
     private mergeTargetPurge;
     /** Merge archive companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
     private mergeArchive;
     /** Merge freeze companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
     private mergeFreeze;
-    /** Return every closed / opened period in `closedAt` order, merged with any freeze + archive companions. */
-    listPeriods(): Promise<readonly PeriodRecord[]>;
-    /** Look up a single period by name, merged with its freeze + archive + target-purge companions if any. Returns `null` if not found. */
-    getPeriod(name: string): Promise<PeriodRecord | null>;
-    /** Called by the gate bus before put/delete. */
+    /**
+     * Return every closed / opened period in `closedAt` order, merged with any
+     * freeze + archive companions.
+     *
+     * With no argument this spans EVERY timeline — the pre-#1005 behaviour, and
+     * the right default for an audit sweep. Pass `{ partition }` to scope to one
+     * timeline; `{ partition: [] }` (or omitting it) means the vault-wide one.
+     */
+    listPeriods(options?: PeriodScope): Promise<readonly PeriodRecord[]>;
+    /**
+     * Look up a single period by name within one timeline, merged with its
+     * freeze + archive + target-purge companions if any. Returns `null` if not
+     * found.
+     *
+     * Names are only unique per partition (#1005), so this resolves against the
+     * VAULT-WIDE timeline unless `{ partition }` says otherwise — matching how
+     * every pre-partition period is stored.
+     */
+    getPeriod(name: string, options?: PeriodScope): Promise<PeriodRecord | null>;
+    /**
+     * The full append-only reopen/reclose log for one period (#1022) — the record
+     * an audit actually asks for, in order. `[]` when never reopened.
+     */
+    listPeriodReopens(name: string, options?: PeriodScope): Promise<readonly PeriodReopenEvent[]>;
+    /**
+     * Return a closed period to a writable state (#1022).
+     *
+     * Close is a three-state lifecycle in practice — open / closed / reopened —
+     * because a month gets closed and then a missing invoice arrives, or a filing
+     * is rejected and must be amended. That is routine, and it is supposed to
+     * leave a trail.
+     *
+     * The `_periods/<key>` record is NOT touched: the reopen is appended to a
+     * companion log, so the inter-period hash chain that proves the close
+     * happened survives the reopen intact. The chain reads *closed at T1,
+     * reopened at T2 by U, reclosed at T3*.
+     *
+     * A reopen withdraws the PERIOD's veto and nothing else. Record-level rules —
+     * an `immutableGuard` on a sent receipt, a frozen field — are separate gate
+     * handlers registered ahead of the period gate, so a reopened month cannot
+     * resurrect a document that is independently locked. Period state can only
+     * ever widen what the record-level rule already permits.
+     *
+     * Reopening an already-open window is allowed and appends another event: that
+     * is how a window gets extended, and the log keeps both.
+     */
+    reopenPeriod(name: string, options?: ReopenPeriodOptions): Promise<PeriodRecord>;
+    /**
+     * Seal a reopened period again (#1022), ending the window explicitly rather
+     * than waiting for an `until` to lapse. Appends to the same log, so the
+     * close → reopen → reclose sequence is recoverable in order.
+     */
+    reclosePeriod(name: string, options?: PeriodScopeWithReason): Promise<PeriodRecord>;
+    /** Append one entry to a period's reopen log, ledger it, and invalidate the guard's view. */
+    private appendReopenEvent;
+    /** Merge each period's reopen log onto it. One adapter listing, not one per period. */
+    private mergeReopenState;
+    /** Resolve one period within the timeline named by `options` (vault-wide when absent). */
+    private findPeriod;
+    /** Called by the gate bus before put/delete. `collection` selects the subject mapping (#1005). */
     assertTsWritable(existing: {
         ts: string | null;
         record: Record<string, unknown> | null;
-    } | null, incoming: Record<string, unknown> | null): Promise<void>;
+    } | null, incoming: Record<string, unknown> | null, collection?: string): Promise<void>;
     private loadPeriodsCache;
     /** Generic reserved-collection writer — serves `_periods` and `_period_freezes` alike. */
     private writeReserved;

package/dist/with-audit/periods/window.d.ts

@@ -6,6 +6,16 @@ export declare const PERIOD_FREEZES_COLLECTION = "_period_freezes";
 export declare const PERIOD_ARCHIVES_COLLECTION = "_period_archives";
 /** Sibling of {@link PERIODS_COLLECTION} holding target-purge companions (#615). */
 export declare const PERIOD_TARGET_PURGES_COLLECTION = "_period_target_purges";
+/**
+ * Sibling of {@link PERIODS_COLLECTION} holding reopen/reclose companions (#1022).
+ *
+ * Unlike the freeze / archive / target-purge companions — each a single,
+ * idempotent, once-only record — this one holds an APPEND-ONLY EVENT LIST,
+ * because reopening is a repeating cycle: a month can be closed, reopened,
+ * reclosed, and reopened again. The audit value is the sequence, not the
+ * latest state.
+ */
+export declare const PERIOD_REOPENS_COLLECTION = "_period_reopens";
 /**
  * Exclusive upper bound for a period's delete-marker purge window (#604).
  * Markers carry no business date (empty body), only write-time `_ts`, so freeze

package/dist/with-audit/sealed-record/index.d.ts

@@ -46,10 +46,23 @@ export { SealedRecordNotEnabledError } from '../../kernel/errors.js';
  * @param expectedCollection Collection the caller believes `recordEnvelope` is in.
  * @param expectedId         Record id the caller believes `recordEnvelope` is.
  * @returns The decrypted record body as a JSON string.
+ *
+ * ⚠️ **`recordEnvelope` must carry `_tier` and `_by`, not just the body**
+ * (#1041). They are plaintext metadata rather than secrets, but they are bound
+ * into the record's AAD, so a host handed only `{_iv, _data}` cannot
+ * reconstruct the identity the body was sealed against.
+ *
+ * That is a feature, not a tax: it means a host cannot be fed a body with its
+ * tags stripped or rewritten — a re-tiered or re-authored envelope no longer
+ * opens, even with a valid sealed CEK.
  */
 export declare function openSealedRecord(sealedCekEnvelope: SealedCekDeliveryEnvelope, recordEnvelope: {
     readonly _iv: string;
     readonly _data: string;
+    /** Bound into the AAD since #1093 — a rewound body no longer opens. */
+    readonly _v: number;
+    readonly _tier?: number | undefined;
+    readonly _by?: string | undefined;
 }, recipientSealer: {
     unseal(bytes: Uint8Array): Promise<Uint8Array>;
 }, expectedCollection: string, expectedId: string): Promise<string>;

package/dist/with-audit/tiers/index.d.ts

@@ -23,7 +23,7 @@
 export { withTiers } from './active.js';
 export { NO_TIERS, type TiersStrategy } from './strategy.js';
 export { TiersNotEnabledError } from '../../kernel/errors.js';
-import { type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js';
+import { type RecordIdentity, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
 import type { Lru } from '../../kernel/cache/index.js';
 import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
@@ -123,7 +123,22 @@ export interface TiersContext<T> {
      * pre-move body whenever `fromTier > 0`. No-op when history is disabled
      * (folds the `historyConfig.enabled` gate so `tiers/index.ts` stays simple).
      */
-    saveHistorySnapshot(id: string, envelope: EncryptedEnvelope): Promise<void>;
+    /**
+     * Persist a `_history` snapshot of `version`, sealed against the address it
+     * will be STORED at (#1041).
+     *
+     * Takes a **sealer**, not a finished envelope, because the destination
+     * identity is not knowable here: only the history strategy owns the
+     * `_history` layout. It hands the address in; the caller seals to it.
+     *
+     * ⚠️ The identity passed to `rewrapBodyToDek` must be what a READER will
+     * recompute — `recordAadFor(address, finalEnvelope)`. A tier-move snapshot
+     * strips `_tier`/`_elevatedBy` but KEEPS `_by`, so the destination is
+     * `{...address, by: envelope._by}` with no tier. Sealing against the bare
+     * address would produce history nothing can open, and the failure would
+     * surface only when someone reads it.
+     */
+    saveHistorySnapshot(id: string, version: number, seal: (address: RecordIdentity) => Promise<EncryptedEnvelope>): Promise<void>;
     /**
      * `true` iff a real history strategy is wired (not `NO_HISTORY`) AND not
      * explicitly disabled via `historyConfig.enabled`. `putAtTier` checks this

package/dist/with-cargo/adopt-partition.d.ts

@@ -12,7 +12,7 @@ import type { NoydbStore } from '../kernel/types.js';
 import type { SealingKeyProvider } from '../with-party/team/managed-secret.js';
 import type { ShamirRecoveryProvider } from '../with-party/team/shamir-recovery-provider.js';
 import type { RecoveryEnrollmentInput } from '../with-party/team/rotate-recover.js';
-import type { TransferSealPayload } from '../with-pod/bundle.js';
+import type { TransferSealPayload } from '../with-pod/pod.js';
 /**
  * Reverse of `sealDeks`. Imports the transfer key, decrypts the
  * sealed `{ collection: base64(rawDEK) }` map (layout iv(12)‖ct‖tag), and

package/dist/with-cargo/extract-partition.d.ts

@@ -10,7 +10,7 @@ import type { Vault } from '../kernel/vault.js';
 import type { EncryptedEnvelope } from '../kernel/types.js';
 import { type EnclaveKey } from '../kernel/enclave/index.js';
 import { type WalkClosureOptions, type DanglingRefNotice } from './walk-closure.js';
-import { type TransferSealPayload } from '../with-pod/bundle.js';
+import { type TransferSealPayload } from '../with-pod/pod.js';
 /** Re-keyed collections snapshot + the fresh DEKs used. */
 export interface ReKeyResult {
     readonly collections: Record<string, Record<string, EncryptedEnvelope>>;

package/dist/with-cargo/index.d.ts

@@ -37,10 +37,10 @@ export type { ExtractPartitionResult } from './extract-partition.js';
 export { adoptPartition, unsealDeks, createOwnerOnAdoptedPartition } from './adopt-partition.js';
 export type { AdoptPartitionOptions, AdoptPartitionResult, CreateOwnerResult, CreateOwnerOptions, CreateOwnerStandardOptions, CreateOwnerManagedOptions, } from './adopt-partition.js';
 export { TransferSealError, AdoptionStateError, PartitionExtractionError } from '../kernel/errors.js';
-export type { WriteHook } from '../port/with/write-hooks.js';
+export type { WriteHook, WriteEvent } from '../port/with/write-hooks.js';
 export type { WriteQueue } from '../kernel/write-queue.js';
 export type { WriteConflict } from '../kernel/types.js';
 export type { AccessibleVault } from '../kernel/types.js';
 export type { Unsubscribe } from '../kernel/types.js';
 export type { ExtractPartitionOptions } from './extract-partition.js';
-export type { TransferSealPayload } from '../with-pod/bundle.js';
+export type { TransferSealPayload } from '../with-pod/pod.js';

package/dist/with-commit/history/history.d.ts

@@ -1,5 +1,31 @@
+import type { RecordIdentity } from '../../kernel/enclave/index.js';
 import type { NoydbStore, EncryptedEnvelope, HistoryOptions, PruneOptions } from '../../kernel/types.js';
 import { type EnclaveKey } from '../../kernel/enclave/index.js';
+/**
+ * The identity a history snapshot is **sealed against** — its STORAGE location,
+ * not the live record it is a copy of (#1041).
+ *
+ * ## Why storage, and why this is a decision rather than a detail
+ *
+ * A snapshot is a copy, so two identities are available: the live record
+ * (`collection`/`recordId`) or where the bytes actually land
+ * (`_history`/`historyId(...)`). They are not equivalent under attack.
+ *
+ * Binding the LIVE identity makes a snapshot's AAD **indistinguishable from the
+ * live record's at the same version** — so an untrusted store could serve a
+ * history entry *as the current record* and the client would accept it. It also
+ * leaves entries relocatable within `_history`.
+ *
+ * Binding STORAGE identity closes both. The cost is that the id must be known
+ * *before* the envelope is sealed, where `saveHistory` previously derived it
+ * *after* (from `envelope._v`) — which is precisely the restructure this
+ * function exists to make possible.
+ *
+ * `saveHistory` uses this too, so the sealed identity and the put location have
+ * **one definition** and cannot drift apart. Changing the layout here changes
+ * both at once, by construction.
+ */
+export declare function historyIdentity(collection: string, recordId: string, version: number): RecordIdentity;
 /** Save a history entry (a complete encrypted envelope snapshot). */
 export declare function saveHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, envelope: EncryptedEnvelope): Promise<void>;
 /** Get history entries for a record, sorted newest-first. */

package/dist/with-commit/history/index.d.ts

@@ -17,7 +17,7 @@
  */
 export { withHistory } from './active.js';
 export type { HistoryStrategy } from './strategy.js';
-export { saveHistory, getHistory, getVersionEnvelope, pruneHistory, clearHistory, } from './history.js';
+export { saveHistory, historyIdentity, getHistory, getVersionEnvelope, pruneHistory, clearHistory, } from './history.js';
 export { diff, formatDiff } from './diff.js';
 export type { ChangeType, DiffEntry } from './diff.js';
 export { LedgerStore, LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, envelopePayloadHash, } from './ledger/store.js';
@@ -30,3 +30,4 @@ export { VaultInstant, CollectionInstant } from './time-machine.js';
 export type { VaultEngine } from './time-machine.js';
 /** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
 export { NO_HISTORY } from './strategy.js';
+export type { RecordIdentity } from '../../kernel/enclave/index.js';

package/dist/with-commit/history/ledger/store.d.ts

@@ -237,7 +237,13 @@ export declare class LedgerStore {
      * version/timestamp/actor) fully intact for audit purposes.
      */
     purgeRecordDeltas(collection: string, id: string): Promise<number>;
-    /** Encrypt a JSON Patch into an envelope for storage. Mirrors encryptEntry. */
+    /**
+     * Encrypt a JSON Patch into an envelope for storage. Mirrors encryptEntry.
+     *
+     * `index` is the ledger index this delta will be stored under — the caller
+     * knows it before the entry exists, and it is what makes the envelope's
+     * identity bindable (#1051).
+     */
     private encryptDelta;
     /**
      * Read all entries in ascending-index order. Used internally by

package/dist/with-commit/history/strategy.d.ts

@@ -33,7 +33,7 @@ import type { LedgerStore } from './ledger/store.js';
 import type { JsonPatch } from './ledger/patch.js';
 import type { DiffEntry } from './diff.js';
 import type { VaultInstant, VaultEngine } from './time-machine.js';
-import type { EnclaveKey } from '../../kernel/enclave/index.js';
+import type { EnclaveKey, RecordIdentity } from '../../kernel/enclave/index.js';
 /**
  * Options accepted by `HistoryStrategy.buildLedger`. Mirrors the
  * `LedgerStore` constructor verbatim — kept in this file so `core`
@@ -58,6 +58,16 @@ export interface HistoryStrategy {
      * `NO_HISTORY`.
      */
     saveHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, envelope: EncryptedEnvelope): Promise<void>;
+    /**
+     * The identity a snapshot of `collection/recordId@version` must be **sealed
+     * against** — its `_history` storage location (#1041).
+     *
+     * On the port because the kernel writes history snapshots but must not import
+     * `with-commit` to learn its layout. Exposing it here keeps the derivation in
+     * the module that owns the layout, and `saveHistory` uses the same function,
+     * so the sealed identity and the put location cannot drift.
+     */
+    historyIdentity(collection: string, recordId: string, version: number): RecordIdentity;
     /**
      * List history envelopes for a record, newest first. Throws under
      * `NO_HISTORY` — callers reach this via `collection.history()` /

package/dist/with-commit/numbering/index.d.ts

@@ -1,8 +1,3 @@
-/**
- * @category capability
- * Deferred numbering engine — store-clock-ordered, gap-free serials assigned
- * at an explicit numbering pass. See the design spec.
- */
 import type { NoydbStore } from '../../kernel/types.js';
 import { type EnclaveKey } from '../../kernel/enclave/index.js';
 import type { DeferredNumberingConfig } from './descriptor.js';

package/dist/with-commit/vault-head/active.d.ts

@@ -0,0 +1,2 @@
+import { type VaultHeadStrategy, type WithVaultHeadOptions } from './strategy.js';
+export declare function withVaultHead(opts?: WithVaultHeadOptions): VaultHeadStrategy;