@noy-db/hub 0.6.0-pre.8 → 0.6.0

package/dist/{chunk-3URQC7EH.js → chunk-CXPOG3ZY.js}

@@ -1,19 +1,20 @@
 import {
+  buildRecordEnvelope,
   isDeleteMarker,
   isTombstone
-} from "./chunk-7H73RIE3.js";
+} from "./chunk-FX3UIDCS.js";
 import {
   blindedEqual,
   openVdigPayload,
   sealVdigPayload
-} from "./chunk-HXGUIPQB.js";
+} from "./chunk-CKKN25P2.js";
 import {
   dualReadSealedSlot,
   parseSealedSlot
-} from "./chunk-AR2JDFAE.js";
+} from "./chunk-7Q3RHOA5.js";
 import {
   mintBidxTag
-} from "./chunk-747LRSOO.js";
+} from "./chunk-4K6BIMLF.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -23,20 +24,22 @@ import {
   base64ToBuffer,
   bufferToBase64,
   decrypt,
+  decryptBytesWithAAD,
   deriveDeterministicKey,
   deriveSealedFieldKey,
   deriveSealedFieldKeyFromCek,
   encrypt,
+  encryptBytesWithAAD,
   encryptDeterministic,
   generateDEK,
   generateSalt,
   unwrapCek,
   wrapCek
-} from "./chunk-VCETL77O.js";
+} from "./chunk-ONPVHX2Y.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-YPYHVOXP.js";
+} from "./chunk-UJ4Z67UQ.js";
 import {
   ClassifiedConfigError,
   ClassifiedRotationError,
@@ -45,7 +48,48 @@ import {
   SchemaValidationError,
   TamperedError,
   ValidationError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-Z3BZXPRO.js";
+
+// src/kernel/enclave/record-aad.ts
+var SCHEME = "noydb-aad/2";
+var encoder = new TextEncoder();
+function buildRecordAad(identity) {
+  if (!Number.isFinite(identity.version)) {
+    throw new TypeError(
+      `record AAD: version must be a finite number for "${identity.collection}/${identity.id}", received ${String(identity.version)}. Sealing without one produces a record no reader can open.`
+    );
+  }
+  const parts = [encoder.encode(SCHEME)];
+  const pushField = (value) => {
+    const bytes = encoder.encode(value);
+    const len = new Uint8Array(4);
+    new DataView(len.buffer).setUint32(0, bytes.length, false);
+    parts.push(len, bytes);
+  };
+  pushField(identity.collection);
+  pushField(identity.id);
+  pushField(String(identity.tier ?? 0));
+  parts.push(new Uint8Array([identity.by === void 0 ? 0 : 1]));
+  if (identity.by !== void 0) pushField(identity.by);
+  pushField(String(identity.version));
+  const total = parts.reduce((n, p) => n + p.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const p of parts) {
+    out.set(p, offset);
+    offset += p.length;
+  }
+  return out;
+}
+function recordAadFor(ref, envelope) {
+  return buildRecordAad({
+    collection: ref.collection,
+    id: ref.id,
+    version: envelope._v,
+    tier: envelope._tier,
+    by: envelope._by
+  });
+}
 
 // src/kernel/enclave/record-keys/lifecycle.ts
 async function resolveStableCek(deps, id) {
@@ -61,15 +105,17 @@ async function resolveStableCek(deps, id) {
   deps.cache?.set(id, fresh, 1);
   return fresh;
 }
-async function rewrapBodyToDek(envelope, fromDek, toDek) {
+async function rewrapBodyToDek(from, to, envelope, fromDek, toDek) {
+  const openAad = buildRecordAad(from);
+  const sealAad = buildRecordAad(to);
   if (envelope._cek !== void 0) {
     const cek = await unwrapCek(envelope._cek, fromDek);
-    const plaintext2 = await decrypt(envelope._iv, envelope._data, cek);
-    const { iv: iv2, data: data2 } = await encrypt(plaintext2, cek);
+    const plaintext2 = await decrypt(envelope._iv, envelope._data, cek, openAad);
+    const { iv: iv2, data: data2 } = await encrypt(plaintext2, cek, sealAad);
     return { _iv: iv2, _data: data2, _cek: await wrapCek(cek, toDek), cek };
   }
-  const plaintext = await decrypt(envelope._iv, envelope._data, fromDek);
-  const { iv, data } = await encrypt(plaintext, toDek);
+  const plaintext = await decrypt(envelope._iv, envelope._data, fromDek, openAad);
+  const { iv, data } = await encrypt(plaintext, toDek, sealAad);
   return { _iv: iv, _data: data, cek: null };
 }
 function applyRewrappedBody(envelope, body) {
@@ -84,15 +130,15 @@ function applyRewrappedBody(envelope, body) {
   }
   return next;
 }
-async function rewrapEnvelope(envelope, fromDek, toDek) {
-  return applyRewrappedBody(envelope, await rewrapBodyToDek(envelope, fromDek, toDek));
+async function rewrapEnvelope(identity, envelope, fromDek, toDek) {
+  return applyRewrappedBody(envelope, await rewrapBodyToDek(identity, identity, envelope, fromDek, toDek));
 }
-async function isRewrappedUnder(envelope, dek) {
+async function isRewrappedUnder(identity, envelope, dek) {
   try {
     if (envelope._cek !== void 0) {
       await unwrapCek(envelope._cek, dek);
     } else {
-      await decrypt(envelope._iv, envelope._data, dek);
+      await decrypt(envelope._iv, envelope._data, dek, buildRecordAad(identity));
     }
     return true;
   } catch {
@@ -100,6 +146,129 @@ async function isRewrappedUnder(envelope, dek) {
   }
 }
 
+// src/kernel/enclave/record-keys/rekey.ts
+async function rekeyEnvelopeToDek(ref, envelope, oldDek, newDek) {
+  const aad = recordAadFor(ref, envelope);
+  const { _bidx, ...carried } = envelope;
+  void _bidx;
+  if (envelope._cek !== void 0) {
+    const cek = await unwrapCek(envelope._cek, oldDek);
+    return { ...carried, _cek: await wrapCek(cek, newDek) };
+  }
+  const plaintext = await decrypt(envelope._iv, envelope._data, oldDek, aad);
+  const { iv, data } = await encrypt(plaintext, newDek, aad);
+  return { ...carried, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: iv, _data: data };
+}
+async function rekeyEnvelopeIfNeeded(ref, envelope, oldDek, newDek) {
+  try {
+    return await rekeyEnvelopeToDek(ref, envelope, oldDek, newDek);
+  } catch (errUnderOld) {
+    try {
+      if (envelope._cek !== void 0) await unwrapCek(envelope._cek, newDek);
+      else await decrypt(envelope._iv, envelope._data, newDek, recordAadFor(ref, envelope));
+      return null;
+    } catch {
+      throw errUnderOld;
+    }
+  }
+}
+async function envelopeOpensUnderAny(ref, envelope, keys) {
+  for (const key of keys) {
+    try {
+      if (envelope._cek !== void 0) await unwrapCek(envelope._cek, key);
+      else await decrypt(envelope._iv, envelope._data, key, recordAadFor(ref, envelope));
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+
+// src/kernel/enclave/record-keys/rekey-blob.ts
+var BLOB_INDEX_COLLECTION = "_blob_index";
+var BLOB_CHUNKS_COLLECTION = "_blob_chunks";
+function chunkAad(eTag, index, chunkCount) {
+  return new TextEncoder().encode(`${eTag}:${index}:${chunkCount}`);
+}
+async function opensJson(ref, env, key) {
+  try {
+    return await decrypt(env._iv, env._data, key, recordAadFor(ref, env));
+  } catch {
+    return null;
+  }
+}
+async function rekeyBlobSet(adapter, vault, oldDek, newDek, otherDeks = []) {
+  let blobs = 0;
+  let chunks = 0;
+  let foreign = 0;
+  let alreadyMoved = 0;
+  let eTags;
+  try {
+    eTags = await adapter.list(vault, BLOB_INDEX_COLLECTION);
+  } catch {
+    return { blobs, chunks, foreign, alreadyMoved };
+  }
+  for (const eTag of eTags) {
+    const idxEnv = await adapter.get(vault, BLOB_INDEX_COLLECTION, eTag);
+    if (!idxEnv || !idxEnv._iv) continue;
+    const ref = { collection: BLOB_INDEX_COLLECTION, id: eTag };
+    const json = await opensJson(ref, idxEnv, oldDek);
+    if (json === null) {
+      if (await opensJson(ref, idxEnv, newDek) !== null) {
+        alreadyMoved++;
+        continue;
+      }
+      let claimed = false;
+      for (const key of otherDeks) {
+        if (await opensJson(ref, idxEnv, key) !== null) {
+          claimed = true;
+          break;
+        }
+      }
+      if (claimed) {
+        foreign++;
+        continue;
+      }
+      throw new Error(
+        `[noy-db] rotateKeys: blob index entry "${eTag}" opens under neither the retiring nor the new \`_blob\` DEK, nor any other key this keyring holds. Rotation stopped rather than leaving it unreadable and unreported.`
+      );
+    }
+    const blob = JSON.parse(json);
+    for (let i = 0; i < blob.chunkCount; i++) {
+      const id = `${eTag}_${i}`;
+      const chunkEnv = await adapter.get(vault, BLOB_CHUNKS_COLLECTION, id);
+      if (!chunkEnv || !chunkEnv._iv) continue;
+      const aad = chunkAad(eTag, i, blob.chunkCount);
+      let plain;
+      try {
+        plain = await decryptBytesWithAAD(chunkEnv._iv, chunkEnv._data, oldDek, aad);
+      } catch {
+        if (blob._cek !== void 0 || blob._cekPending !== void 0) continue;
+        try {
+          await decryptBytesWithAAD(chunkEnv._iv, chunkEnv._data, newDek, aad);
+          continue;
+        } catch {
+          throw new Error(
+            `[noy-db] rotateKeys: blob chunk "${id}" (${i + 1}/${blob.chunkCount} of eTag "${eTag}") opens under neither the retiring nor the new \`_blob\` DEK, and its blob holds no content CEK that could explain it. Rotation stopped rather than leaving it unreadable and unreported.`
+          );
+        }
+      }
+      const { iv: iv2, data: data2 } = await encryptBytesWithAAD(plain, newDek, aad);
+      await adapter.put(vault, BLOB_CHUNKS_COLLECTION, id, { ...chunkEnv, _iv: iv2, _data: data2 });
+      chunks++;
+    }
+    const rewrapped = {
+      ...blob,
+      ...blob._cek !== void 0 ? { _cek: await wrapCek(await unwrapCek(blob._cek, oldDek), newDek) } : {},
+      ...blob._cekPending !== void 0 ? { _cekPending: await wrapCek(await unwrapCek(blob._cekPending, oldDek), newDek) } : {}
+    };
+    const { iv, data } = await encrypt(JSON.stringify(rewrapped), newDek, recordAadFor(ref, idxEnv));
+    await adapter.put(vault, BLOB_INDEX_COLLECTION, eTag, { ...idxEnv, _iv: iv, _data: data });
+    blobs++;
+  }
+  return { blobs, chunks, foreign, alreadyMoved };
+}
+
 // src/kernel/enclave/record-keys/sealed-slots.ts
 async function sealOneFieldWithDek(field, value, dek, keyMaterial) {
   const fieldKey = keyMaterial.cek !== void 0 ? await deriveSealedFieldKeyFromCek(keyMaterial.cek, keyMaterial.collection, field) : await deriveSealedFieldKey(dek, keyMaterial.collection, field);
@@ -175,22 +344,17 @@ function makeReservedEnvelopes(dekResolver, declaredPrefixes) {
         );
       }
     };
-    const encryptForPrefix = async (collection, json, v) => {
-      assertPrefixed(collection, "encrypt");
-      const dek = await dekResolver(collection);
-      const { iv, data } = await encrypt(json, dek);
-      return {
-        _noydb: NOYDB_FORMAT_VERSION,
-        _v: v,
-        _ts: (/* @__PURE__ */ new Date()).toISOString(),
-        _iv: iv,
-        _data: data
-      };
+    const encryptForPrefix = async (ref, json, v) => {
+      assertPrefixed(ref.collection, "encrypt");
+      const dek = await dekResolver(ref.collection);
+      const identity = { ...ref, version: v };
+      const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+      return buildRecordEnvelope(identity, { iv, data });
     };
-    const decryptForPrefix = async (collection, env) => {
+    const decryptForPrefix = async (collection, id, env) => {
       assertPrefixed(collection, "decrypt");
       const dek = await dekResolver(collection);
-      return decrypt(env._iv, env._data, dek);
+      return decrypt(env._iv, env._data, dek, recordAadFor({ collection, id }, env));
     };
     return { encrypt: encryptForPrefix, decrypt: decryptForPrefix };
   };
@@ -320,30 +484,12 @@ var RecordCodec = class _RecordCodec {
    * parts. Pure, no crypto. Each call stamps its own `_ts` — provenance carries
    * a SEPARATE timestamp (computed by the caller), so the two never share one.
    */
-  static buildEnvelope(p) {
-    return {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: p.version,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: p.iv,
-      _data: p.data,
-      ...p.by !== void 0 ? { _by: p.by } : {},
-      ...p.cek !== void 0 ? { _cek: p.cek } : {},
-      ...p.provenance !== void 0 ? { _source: p.provenance.source, _sourceTs: p.provenance.sourceTs } : {},
-      ...p.extra ?? {}
-    };
+  static buildEnvelope(identity, p) {
+    return buildRecordEnvelope(identity, p);
   }
   /** Plaintext (`_iv:''`) body envelope — the `!storeCiphertext` shape. */
-  static buildPlaintextEnvelope(p) {
-    return {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: p.version,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: "",
-      _data: p.data,
-      ...p.by !== void 0 ? { _by: p.by } : {},
-      ...p.provenance !== void 0 ? { _source: p.provenance.source, _sourceTs: p.provenance.sourceTs } : {}
-    };
+  static buildPlaintextEnvelope(identity, p) {
+    return buildRecordEnvelope(identity, { ...p, iv: "" });
   }
   // ──────────────────────────────────────────────────────────────────────
   // Write path
@@ -356,22 +502,20 @@ var RecordCodec = class _RecordCodec {
    * (see {@link encryptRecord}). Rejects `_`-prefixed record fields, which
    * would collide with the reserved metadata namespace.
    */
-  buildDebugEnvelope(record, version, source, sourceTs) {
+  buildDebugEnvelope(id, record, version, source, sourceTs) {
     const rec = record;
     for (const key of Object.keys(rec)) {
       if (key.startsWith("_")) throw new DebugReservedFieldError(this.ctx.name, key);
     }
-    return {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: version,
-      _ts: (/* @__PURE__ */ new Date()).toISOString(),
-      _iv: "",
-      _data: "",
-      _by: this.ctx.actor,
-      _debug: NOYDB_FORMAT_VERSION,
-      ...this.ctx.provenance && source !== void 0 ? { _source: source, _sourceTs: sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : {},
-      ...rec
-    };
+    const base = buildRecordEnvelope(
+      { collection: this.ctx.name, id, by: this.ctx.actor, version },
+      {
+        iv: "",
+        data: "",
+        ...this.ctx.provenance && source !== void 0 ? { provenance: { source, sourceTs: sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } } : {}
+      }
+    );
+    return { ...base, _debug: NOYDB_FORMAT_VERSION, ...rec };
   }
   /**
    * Encrypt a JSON body into an envelope.
@@ -382,24 +526,56 @@ var RecordCodec = class _RecordCodec {
    * path encrypts the body directly under the collection DEK — byte-identical
    * to pre-CEK behaviour, so non-adopting collections pay nothing.
    */
-  async encryptJsonString(json, version, cek, source, sourceTs) {
-    const by = this.ctx.actor;
+  /**
+   * `ref` is the identity the envelope is sealed against, and it is **the
+   * location the bytes are stored at** — not necessarily this codec's own
+   * collection (#1051).
+   *
+   * That distinction was discovered here rather than assumed. Several callers
+   * put the result somewhere else entirely: search's vector sidecar lands in
+   * `_vec` under `encodeVecId(name, id)`, the lexical index under `_ft/<name>`,
+   * indexing's entries under a synthetic `idxId`. A codec that supplied
+   * `this.ctx.name` for those would seal them against a collection they are not
+   * in, and once AAD binds identity every one of them would fail to verify.
+   *
+   * ⚠️ **`_history` is the open case, and it is #1041's to settle.** Snapshots
+   * are produced with the LIVE record's identity here and then re-homed by
+   * `saveHistory` into `_history/<historyId(collection,id,_v)>`. Both readings
+   * are defensible — bind where it lives, or bind what it is a copy of — and
+   * the choice must be made before AAD is switched on, not inferred from this
+   * migration.
+   */
+  async encryptJsonString(ref, json, version, cek, source, sourceTs) {
+    const identity = { ...ref, version, by: this.ctx.actor };
     const provenance = this.ctx.provenance && source !== void 0 ? { source, sourceTs: sourceTs ?? (/* @__PURE__ */ new Date()).toISOString() } : void 0;
     if (!this.ctx.storeCiphertext) {
-      return _RecordCodec.buildPlaintextEnvelope({ version, data: json, by, provenance });
+      return _RecordCodec.buildPlaintextEnvelope(identity, { data: json, provenance });
     }
     const dek = await this.ctx.getDEK();
+    const aad = buildRecordAad(identity);
     if (cek !== void 0) {
-      const { iv: iv2, data: data2 } = await encrypt(json, cek);
+      const { iv: iv2, data: data2 } = await encrypt(json, cek, aad);
       const wrapped = await wrapCek(cek, dek);
-      return _RecordCodec.buildEnvelope({ version, iv: iv2, data: data2, by, cek: wrapped, provenance });
+      return _RecordCodec.buildEnvelope(identity, { iv: iv2, data: data2, cek: wrapped, provenance });
     }
-    const { iv, data } = await encrypt(json, dek);
-    return _RecordCodec.buildEnvelope({ version, iv, data, by, provenance });
+    const { iv, data } = await encrypt(json, dek, aad);
+    return _RecordCodec.buildEnvelope(identity, { iv, data, provenance });
   }
-  async encryptRecord(record, version, cek, source, sourceTs, vdig, id) {
+  /**
+   * `ref` is FIRST and required (#1051). It was previously a trailing optional
+   * `id?: string`, which TypeScript cannot promote to required because it sits
+   * after other optionals — so the migration would have needed an `id ?? ''`
+   * fallback. That is exactly the silent default this issue exists to remove:
+   * once identity is bound into the AEAD, every record written with an empty id
+   * binds to the SAME identity and becomes interchangeable with the others.
+   * An object, not a bare string, so a swap with `version`/`source` cannot
+   * compile on the hottest write path. Carries the collection too — see
+   * {@link encryptJsonString} for why the codec must not assume its own.
+   */
+  async encryptRecord(ref, record, version, cek, source, sourceTs, vdig) {
+    const id = ref.id;
     if (!this.ctx.storeCiphertext && this.ctx.debugPlaintext && !this.ctx.name.startsWith("_")) {
-      return this.buildDebugEnvelope(record, version, source, sourceTs);
+      return this.buildDebugEnvelope(id, record, version, source, sourceTs);
     }
     if (this.ctx.storeCiphertext) {
       const declared = this.ctx.vdigFields;
@@ -426,9 +602,9 @@ var RecordCodec = class _RecordCodec {
     let openRecord = record;
     let sealed;
     if (this.ctx.storeCiphertext && this.ctx.via?.hasAtRestHooks) {
-      if (id === void 0) {
+      if (id === "") {
         throw new Error(
-          `RecordCodec.encryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this write path supplied no record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
+          `RecordCodec.encryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this write path supplied an empty record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
         );
       }
       const src = record;
@@ -436,7 +612,7 @@ var RecordCodec = class _RecordCodec {
       openRecord = result.record;
       if (result.sealed !== void 0) {
         sealed = {};
-        for (const [field, ref] of Object.entries(result.sealed)) sealed[field] = `${ref.iv}:${ref.data}`;
+        for (const [field, ref2] of Object.entries(result.sealed)) sealed[field] = `${ref2.iv}:${ref2.data}`;
       }
     } else if (this.ctx.storeCiphertext && this.ctx.sensitiveFields.size > 0) {
       const src = record;
@@ -501,7 +677,7 @@ var RecordCodec = class _RecordCodec {
       if (Object.keys(out).length > 0) vdigOut = out;
       if (Object.keys(bidxOut).length > 0) bidxOutMap = bidxOut;
     }
-    const base = await this.encryptJsonString(JSON.stringify(openRecord), version, cek, source, sourceTs);
+    const base = await this.encryptJsonString(ref, JSON.stringify(openRecord), version, cek, source, sourceTs);
     const withSealed = sealed ? { ...base, _sealed: sealed } : base;
     const withVdig = vdigOut ? { ...withSealed, _vdig: vdigOut } : withSealed;
     const withBidx = bidxOutMap ? { ...withVdig, _bidx: bidxOutMap } : withVdig;
@@ -556,7 +732,15 @@ var RecordCodec = class _RecordCodec {
    * The optional `id` lets reads populate the CEK cache; it is omitted by
    * callers (history, conflict merge) that have only the envelope.
    */
-  async decryptJsonString(envelope, id) {
+  /**
+   * `ref` must be the SAME identity the writer sealed against — which is the
+   * storage address, not necessarily this codec's own collection. Search's
+   * vector sidecar lives in `_vec`, its lexical index in `_ft`; passing
+   * `this.ctx.name` for those would recompute the wrong AAD and fail to open a
+   * perfectly good record (#1041).
+   */
+  async decryptJsonString(ref, envelope) {
+    const id = ref.id;
     if (isTombstone(envelope, this.ctx.storeCiphertext) || isDeleteMarker(envelope)) return null;
     if (!this.ctx.storeCiphertext) {
       if (envelope._debug !== void 0) {
@@ -568,10 +752,11 @@ var RecordCodec = class _RecordCodec {
       }
       return envelope._data === "" ? null : envelope._data;
     }
+    const aad = recordAadFor(ref, envelope);
     const cek = await this.resolveEnvelopeCek(envelope, id);
-    if (cek !== void 0) return decrypt(envelope._iv, envelope._data, cek);
+    if (cek !== void 0) return decrypt(envelope._iv, envelope._data, cek, aad);
     const dek = await this.ctx.getDEK();
-    return decrypt(envelope._iv, envelope._data, dek);
+    return decrypt(envelope._iv, envelope._data, dek, aad);
   }
   /**
    * Unseal a single `_sealed[field]` slot to its plaintext value: derive the
@@ -695,7 +880,7 @@ var RecordCodec = class _RecordCodec {
    */
   async applySealedSlots(record, sealed, cek, opts = {}) {
     if (this.ctx.via?.hasAtRestHooks) {
-      if (opts.id === void 0) {
+      if (opts.id === void 0 || opts.id === "") {
         throw new Error(
           `RecordCodec.decryptRecord: collection "${this.ctx.name}" has via at-rest hooks but this read path supplied no record id (needed to scope the sealed-slot capability) \u2014 caller bug.`
         );
@@ -745,15 +930,17 @@ var RecordCodec = class _RecordCodec {
    * output-recompute path, not the public per-record read surface schema
    * validation guards.
    */
-  async decryptRecordAtDek(envelope, dek, id) {
+  async decryptRecordAtDek(ref, envelope, dek) {
+    const id = ref.id;
     if (isTombstone(envelope, this.ctx.storeCiphertext) || isDeleteMarker(envelope)) return null;
     let plaintext;
     let cek;
+    const aad = recordAadFor(ref, envelope);
     if (envelope._cek !== void 0) {
       cek = await unwrapCek(envelope._cek, dek);
-      plaintext = await decrypt(envelope._iv, envelope._data, cek);
+      plaintext = await decrypt(envelope._iv, envelope._data, cek, aad);
     } else {
-      plaintext = await decrypt(envelope._iv, envelope._data, dek);
+      plaintext = await decrypt(envelope._iv, envelope._data, dek, aad);
     }
     let record = JSON.parse(plaintext);
     if (envelope._sealed !== void 0 && this.ctx.storeCiphertext) {
@@ -776,8 +963,8 @@ var RecordCodec = class _RecordCodec {
    * that may predate a schema change, so validating it would be a
    * false positive. Every non-history read leaves this flag `false`.
    */
-  async decryptRecord(envelope, opts = {}) {
-    const json = await this.decryptJsonString(envelope, opts.id);
+  async decryptRecord(ref, envelope, opts = {}) {
+    const json = await this.decryptJsonString(ref, envelope);
     if (json === null) return null;
     let parsed = JSON.parse(json);
     if (this.ctx.crdtMode && parsed !== null && typeof parsed === "object" && "_crdt" in parsed) {
@@ -785,9 +972,9 @@ var RecordCodec = class _RecordCodec {
     }
     let record = parsed;
     if (envelope._sealed !== void 0 && this.ctx.storeCiphertext) {
-      const sealedCek = await this.resolveEnvelopeCek(envelope, opts.id);
+      const sealedCek = await this.resolveEnvelopeCek(envelope, ref.id);
       record = await this.applySealedSlots(record, envelope._sealed, sealedCek, {
-        ...opts.id !== void 0 ? { id: opts.id } : {},
+        id: ref.id,
         ...opts.sealedAsHandles !== void 0 ? { sealedAsHandles: opts.sealedAsHandles } : {}
       });
     }
@@ -841,16 +1028,16 @@ async function sealRecordToHost(ctx, collection, id, hostSealer, opts) {
   };
   const envelopeKey = `${collection}/${id}/${hint.pid}`;
   const prior = await ctx.adapter.get(ctx.vault, SEALED_CEK_NS, envelopeKey);
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: (prior?._v ?? 0) + 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    // AES-GCM bypassed — the sealing layer is the security boundary, exactly
-    // like the managed-secret `_meta/sealed-secret` envelope.
-    _iv: "",
-    _data: JSON.stringify(delivery),
-    ...ctx.actor ? { _by: ctx.actor } : {}
-  };
+  const env = buildRecordEnvelope(
+    { collection: SEALED_CEK_NS, id: envelopeKey, version: (prior?._v ?? 0) + 1 },
+    {
+      // AES-GCM bypassed — the sealing layer is the security boundary, exactly
+      // like the managed-secret `_meta/sealed-secret` envelope.
+      iv: "",
+      data: JSON.stringify(delivery),
+      ...ctx.actor ? { by: ctx.actor } : {}
+    }
+  );
   await ctx.adapter.put(ctx.vault, SEALED_CEK_NS, envelopeKey, env);
   return { pid: hint.pid, envelopeKey };
 }
@@ -868,9 +1055,26 @@ async function rotateRecordCek(ctx, collection, id) {
   }
   const dek = await ctx.getDEK(collection);
   const oldCek = await unwrapCek(live._cek, dek);
-  const json = await decrypt(live._iv, live._data, oldCek);
+  const openAad = recordAadFor({ collection, id }, live);
+  const json = await decrypt(live._iv, live._data, oldCek, openAad);
+  const rotatedIdentity = {
+    // A CEK rotation DOES bump `_v` (asserted in `record-scoped-cek-sealing`:
+    // "the live envelope was re-keyed — new `_cek`, bumped `_v`"), so it seals
+    // at the new version, not the one it just opened.
+    //
+    // ⚠️ Do not confuse this with `rekeyEnvelopeToDek`, the DEK-rotation helper,
+    // which PRESERVES `_v` (#1074) because it re-keys a record without writing
+    // one. Two rotations, opposite answers — and with `_v` bound (#1093) getting
+    // it backwards no longer produces a wrong number, it produces an
+    // unreadable record.
+    collection,
+    id,
+    version: live._v + 1,
+    ...live._tier !== void 0 ? { tier: live._tier } : {},
+    ...ctx.actor ? { by: ctx.actor } : live._by !== void 0 ? { by: live._by } : {}
+  };
   const newCek = await generateDEK();
-  const { iv, data } = await encrypt(json, newCek);
+  const { iv, data } = await encrypt(json, newCek, buildRecordAad(rotatedIdentity));
   let sealedOut;
   if (live._sealed !== void 0) {
     const out = {};
@@ -890,30 +1094,27 @@ async function rotateRecordCek(ctx, collection, id) {
     }
     vdigOut = out;
   }
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: live._v + 1,
-    _ts: (/* @__PURE__ */ new Date()).toISOString(),
-    _iv: iv,
-    _data: data,
-    _cek: await wrapCek(newCek, dek),
-    ...ctx.actor ? { _by: ctx.actor } : {},
-    ...live._tier !== void 0 ? { _tier: live._tier } : {},
-    ...live._det !== void 0 ? { _det: live._det } : {},
-    // `_bidx` (equality-index tag) is DEK-rooted and CEK-independent, so it is
-    // carried forward VERBATIM — not recomputed — unlike `_vdig`/`_sealed`
-    // below, which are CEK-bound and must be re-sealed under the new CEK.
-    // Dropping this line would silently orphan the equality index on rotation
-    // (the #306 Slice-A data-loss bug, replayed on the index).
-    ...live._bidx !== void 0 ? { _bidx: live._bidx } : {},
-    // Re-encrypt sealed (`sensitive`) fields under the new CEK. Sealed
-    // keys derive off the per-record CEK, so the rotated record's old CEK is
-    // destroyed here — carrying the old `_sealed` slots forward verbatim would
-    // orphan them (unreadable under the new CEK). `sealedOut` holds the slots
-    // dual-read from the old CEK (or the legacy DEK) and re-sealed under newCek.
-    ...sealedOut !== void 0 ? { _sealed: sealedOut } : {},
-    ...vdigOut !== void 0 ? { _vdig: vdigOut } : {}
-  };
+  const env = buildRecordEnvelope(rotatedIdentity, {
+    iv,
+    data,
+    cek: await wrapCek(newCek, dek),
+    extra: {
+      ...live._det !== void 0 ? { _det: live._det } : {},
+      // `_bidx` (equality-index tag) is DEK-rooted and CEK-independent, so it is
+      // carried forward VERBATIM — not recomputed — unlike `_vdig`/`_sealed`
+      // below, which are CEK-bound and must be re-sealed under the new CEK.
+      // Dropping this line would silently orphan the equality index on rotation
+      // (the #306 Slice-A data-loss bug, replayed on the index).
+      ...live._bidx !== void 0 ? { _bidx: live._bidx } : {},
+      // Re-encrypt sealed (`sensitive`) fields under the new CEK. Sealed
+      // keys derive off the per-record CEK, so the rotated record's old CEK is
+      // destroyed here — carrying the old `_sealed` slots forward verbatim would
+      // orphan them (unreadable under the new CEK). `sealedOut` holds the slots
+      // dual-read from the old CEK (or the legacy DEK) and re-sealed under newCek.
+      ...sealedOut !== void 0 ? { _sealed: sealedOut } : {},
+      ...vdigOut !== void 0 ? { _vdig: vdigOut } : {}
+    }
+  });
   await ctx.adapter.put(ctx.vault, collection, id, env);
   await ctx.invalidateRecordCaches(collection, id);
   const prefix = `${collection}/${id}/`;
@@ -957,7 +1158,7 @@ async function findByDet(ctx, field, value) {
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env || !env._det || (env._tier ?? 0) > 0) continue;
     if (env._det[field] === target || env._det[field] === legacyTarget) {
-      return ctx.codec.decryptRecord(env, { id });
+      return ctx.codec.decryptRecord({ collection: ctx.name, id }, env);
     }
   }
   return null;
@@ -971,7 +1172,7 @@ async function queryByDet(ctx, field, value) {
     const env = await ctx.adapter.get(ctx.vault, ctx.name, id);
     if (!env || !env._det || (env._tier ?? 0) > 0) continue;
     if (env._det[field] === target || env._det[field] === legacyTarget) {
-      const rec = await ctx.codec.decryptRecord(env, { id });
+      const rec = await ctx.codec.decryptRecord({ collection: ctx.name, id }, env);
       if (rec !== null) matches.push(rec);
     }
   }
@@ -979,23 +1180,25 @@ async function queryByDet(ctx, field, value) {
 }
 
 // src/kernel/enclave/record-keys/envelope-body.ts
-async function openEnvelopeJson(env, key, opts) {
+async function openEnvelopeJson(ref, env, key, opts) {
   if (opts?.encrypted === false) return env._data;
+  const aad = recordAadFor(ref, env);
   if (env._cek !== void 0) {
     const cek = await unwrapCek(env._cek, key);
-    return decrypt(env._iv, env._data, cek);
+    return decrypt(env._iv, env._data, cek, aad);
   }
-  return decrypt(env._iv, env._data, key);
+  return decrypt(env._iv, env._data, key, aad);
 }
-async function writeEnvelopeBody(json, key, opts) {
+async function writeEnvelopeBody(identity, json, key, opts) {
   if (opts?.encrypted === false) return { _iv: "", _data: json };
+  const aad = buildRecordAad(identity);
   if (opts?.perRecordKey === true) {
     const cek = await generateDEK();
-    const { iv: iv2, data: data2 } = await encrypt(json, cek);
+    const { iv: iv2, data: data2 } = await encrypt(json, cek, aad);
     const wrapped = await wrapCek(cek, key);
     return { _iv: iv2, _data: data2, _cek: wrapped };
   }
-  const { iv, data } = await encrypt(json, key);
+  const { iv, data } = await encrypt(json, key, aad);
   return { _iv: iv, _data: data };
 }
 function envelopeBodySize(env) {
@@ -1018,6 +1221,18 @@ function envelopeBodyForHash(env) {
   if (env._bidx !== void 0) segments.push(mapPart("_bidx", env._bidx));
   return `{${segments.join(",")}}`;
 }
+function hasSealedBody(env) {
+  return env._iv !== "";
+}
+async function verifyRecordIdentity(ref, env, key) {
+  if (!hasSealedBody(env)) return true;
+  try {
+    await openEnvelopeJson(ref, env, key);
+    return true;
+  } catch {
+    return false;
+  }
+}
 
 // src/kernel/enclave/broker/proof.ts
 var subtle2 = globalThis.crypto.subtle;
@@ -1103,11 +1318,17 @@ async function verifyBrokerProof(args) {
 }
 
 export {
+  buildRecordAad,
+  recordAadFor,
   resolveStableCek,
   rewrapBodyToDek,
   applyRewrappedBody,
   rewrapEnvelope,
   isRewrappedUnder,
+  rekeyEnvelopeToDek,
+  rekeyEnvelopeIfNeeded,
+  envelopeOpensUnderAny,
+  rekeyBlobSet,
   makeReservedEnvelopes,
   validateSchemaInput,
   validateSchemaOutput,
@@ -1123,10 +1344,12 @@ export {
   envelopeBodySize,
   hasPerRecordKey,
   envelopeBodyForHash,
+  hasSealedBody,
+  verifyRecordIdentity,
   deriveBrokerProofBits,
   deriveBrokerProofKey,
   computeBrokerProof,
   issueChallenge,
   verifyBrokerProof
 };
-//# sourceMappingURL=chunk-3URQC7EH.js.map
+//# sourceMappingURL=chunk-CXPOG3ZY.js.map