@noy-db/hub 0.6.0-pre.9 → 0.7.0-pre.0

package/dist/vault-head/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/with-commit/vault-head/head.ts","../../src/with-commit/vault-head/active.ts","../../src/with-commit/vault-head/verify.ts"],"sourcesContent":["/**\n * The vault head's storage layer (#1044).\n *\n * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it\n * inherits #1041's identity binding for free: the store cannot relocate a\n * bucket, re-author it, or serve one bucket's bytes as another's. What it can\n * still do is serve an OLD bucket, which is why {@link readBucket} enforces\n * monotonicity against the caller's own record of what it last wrote.\n *\n * @packageDocumentation\n */\nimport { encrypt, buildRecordAad, openEnvelopeJson, buildRecordEnvelope, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { VAULT_HEAD_COLLECTION } from './strategy.js'\n\n/** `{ recordId → version }` for one bucket. */\nexport type BucketBody = Record<string, number>\n\n/**\n * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands\n * in is not secret — the store already sees which bucket was written, and it\n * already saw the record's own address. Choosing something stronger would buy\n * nothing and cost every write.\n */\nexport function bucketIndex(collection: string, id: string, buckets: number): number {\n  let h = 0x811c9dc5\n  const s = `${collection}/${id}`\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  return h % buckets\n}\n\nexport function bucketId(collection: string, id: string, buckets: number): string {\n  return `${collection}::${String(bucketIndex(collection, id, buckets))}`\n}\n\nexport async function readBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n): Promise<{ body: BucketBody; version: number }> {\n  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket)\n  if (!env) return { body: {}, version: 0 }\n  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek)\n  return { body: JSON.parse(json) as BucketBody, version: env._v }\n}\n\nexport async function writeBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n  body: BucketBody,\n  expectedVersion: number,\n): Promise<void> {\n  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 }\n  const json = JSON.stringify(body)\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(identity, { iv, data })\n  // CAS: two writers racing on one bucket must not silently lose an entry.\n  // A lost head entry is a record the sweep stops expecting — a false clean.\n  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || undefined)\n}\n","/**\n * The real {@link VaultHeadStrategy} (#1044).\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport {\n  DEFAULT_HEAD_BUCKETS,\n  VAULT_HEAD_COLLECTION,\n  type HeadEntry,\n  type VaultHeadStrategy,\n  type WithVaultHeadOptions,\n} from './strategy.js'\nimport { bucketId, readBucket, writeBucket } from './head.js'\n\nexport function withVaultHead(opts: WithVaultHeadOptions = {}): VaultHeadStrategy {\n  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS\n\n  const dekFor = (getDEK: (c: string) => Promise<EnclaveKey>) => getDEK(VAULT_HEAD_COLLECTION)\n\n  return {\n    enabled: true,\n    bucketFor: (collection, id) => bucketId(collection, id, buckets),\n\n    async note(store: NoydbStore, vault, getDEK, entry: HeadEntry) {\n      const dek = await dekFor(getDEK)\n      const bucket = bucketId(entry.collection, entry.id, buckets)\n      const { body, version } = await readBucket(store, vault, dek, bucket)\n      const key = `${entry.collection}/${entry.id}`\n      // Monotonic: a head entry never moves BACKWARD. A write that would lower\n      // it is either a stale retry or a rollback being laundered through the\n      // client's own head, and neither should be recorded.\n      if ((body[key] ?? -1) >= entry.version) return\n      body[key] = entry.version\n      await writeBucket(store, vault, dek, bucket, body, version)\n    },\n\n    async expected(store, vault, getDEK, collection, id) {\n      const dek = await dekFor(getDEK)\n      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets))\n      return body[`${collection}/${id}`] ?? null\n    },\n\n    async knownIn(store, vault, getDEK, collection) {\n      const dek = await dekFor(getDEK)\n      const out = new Map<string, number>()\n      const prefix = `${collection}/`\n      // Sweep every bucket: a record's bucket is a function of its id, so the\n      // set for one collection is spread across all of them.\n      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {\n        if (!bucket.startsWith(`${collection}::`)) continue\n        const { body } = await readBucket(store, vault, dek, bucket)\n        for (const [k, v] of Object.entries(body)) {\n          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v)\n        }\n      }\n      return out\n    },\n  }\n}\n","/**\n * The sweep — comparing what the head expects against what the store serves (#1044).\n *\n * This is the only place absence becomes visible. #1041 and #1042 can reject a\n * record that lies about itself; neither can notice one that never arrived, or\n * one served at an older version than the client wrote. Both are indistinguishable\n * from the truth without an independent record of what should be there.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { VaultHeadStrategy } from './strategy.js'\n\n/** One record the store is not serving faithfully. */\nexport interface HeadDiscrepancy {\n  readonly collection: string\n  readonly id: string\n  /** What the client last committed. */\n  readonly expected: number\n  /**\n   * What the store serves now — or `null` when it serves nothing.\n   *\n   * The two are different attacks wearing the same result. `null` is\n   * **suppression**: the record is gone. A lower number is **rollback**: an\n   * authentic older version served in place of the current one, which is the\n   * case no amount of per-envelope authentication can see.\n   */\n  readonly actual: number | null\n  readonly kind: 'withheld' | 'rolled-back'\n}\n\n/**\n * Why a sweep could not reach a conclusion.\n *\n * - `'no-expectations'` — the head holds nothing for this collection. A fresh\n *   vault, a head switched on after the fact, or a **restore from a snapshot**:\n *   `_head` is `_`-prefixed, so `loadAll` excludes it and a restored vault has\n *   no head to compare against.\n * - `'store-cannot-cas'` — the store does not advertise `capabilities.casAtomic`,\n *   so two writers racing on one bucket can silently lose an entry. A lost entry\n *   is a record the sweep stops expecting, which is a false clean.\n */\nexport type HeadUnverifiableReason = 'no-expectations' | 'store-cannot-cas'\n\n/**\n * ## Three-way, deliberately (#1101)\n *\n * - `'verified'` — the head held expectations, every one was met, and the store\n *   can serialize head writes.\n * - `'unverifiable'` — the sweep could not conclude. See `because`.\n * - `'tampered'` — at least one discrepancy. Positive evidence, so it wins over\n *   any `unverifiable` reason present at the same time.\n *\n * **The middle value is the point, and collapsing it is wrong in a different\n * direction each way:** folded into \"clean\" it hides withholding, which is the\n * one thing this service exists to catch; folded into \"tampered\" it cries wolf\n * on a vault that is merely unexamined.\n *\n * That is not hypothetical. #1044's own first bug was a head that recorded\n * nothing and swept **perfectly clean** — the degraded state rendered\n * identically to a healthy one, which is why its test asserts `checked` before\n * anything else. A two-way verdict makes that state a supported outcome.\n */\nexport type HeadVerdict = 'verified' | 'unverifiable' | 'tampered'\n\nexport interface HeadVerifyResult {\n  readonly verdict: HeadVerdict\n  readonly checked: number\n  readonly discrepancies: readonly HeadDiscrepancy[]\n  /**\n   * Non-empty only when `verdict === 'unverifiable'`.\n   *\n   * There is deliberately no `clean: boolean`. It could not distinguish \"no\n   * expectations\" from \"all expectations met\" — both rendered `true` — and that\n   * indistinguishability *was* the defect. Replacing it rather than keeping it\n   * alongside forces every caller to face the three-way.\n   */\n  readonly because: readonly HeadUnverifiableReason[]\n}\n\n/**\n * Sweep one collection.\n *\n * **A record the store serves that the head does NOT know is not reported.**\n * That is not an oversight: the head can be enabled on an existing vault, and\n * every pre-existing record would otherwise read as an anomaly. The head's\n * claim is one-directional — *what I wrote must still be there* — and an\n * unknown record simply falls outside it.\n *\n * **A HIGHER version than expected is also not reported**, for the same reason:\n * another device legitimately advanced it. The head detects going backwards, not\n * moving forwards.\n */\nexport async function verifyVaultHead(\n  head: VaultHeadStrategy,\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  collection: string,\n): Promise<HeadVerifyResult> {\n  const known = await head.knownIn(store, vault, getDEK, collection)\n  const discrepancies: HeadDiscrepancy[] = []\n\n  const because: HeadUnverifiableReason[] = []\n  if (known.size === 0) because.push('no-expectations')\n  // Read the store's OWN declared capability rather than probing: a store that\n  // cannot serialize head writes may have silently dropped an entry, and a\n  // dropped entry is invisible by construction — there is nothing left to find.\n  if (store.capabilities?.casAtomic !== true) because.push('store-cannot-cas')\n\n  for (const [id, expected] of known) {\n    const env = await store.get(vault, collection, id)\n    if (env === null) {\n      discrepancies.push({ collection, id, expected, actual: null, kind: 'withheld' })\n      continue\n    }\n    if (env._v < expected) {\n      discrepancies.push({ collection, id, expected, actual: env._v, kind: 'rolled-back' })\n    }\n  }\n\n  // A discrepancy is positive evidence, so it outranks any reason the sweep was\n  // also incomplete: a rolled-back record found by a head that may be missing\n  // OTHER entries is still a rolled-back record.\n  const verdict: HeadVerdict = discrepancies.length > 0\n    ? 'tampered'\n    : because.length > 0 ? 'unverifiable' : 'verified'\n\n  return { verdict, checked: known.size, discrepancies, because }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBO,SAAS,YAAY,YAAoB,IAAY,SAAyB;AACnF,MAAI,IAAI;AACR,QAAM,IAAI,GAAG,UAAU,IAAI,EAAE;AAC7B,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AACA,SAAO,IAAI;AACb;AAEO,SAAS,SAAS,YAAoB,IAAY,SAAyB;AAChF,SAAO,GAAG,UAAU,KAAK,OAAO,YAAY,YAAY,IAAI,OAAO,CAAC,CAAC;AACvE;AAEA,eAAsB,WACpB,OACA,OACA,KACA,QACgD;AAChD,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,uBAAuB,MAAM;AAChE,MAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE;AACxC,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,OAAO,GAAG,KAAK,GAAG;AAC/F,SAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,IAAI,GAAG;AACjE;AAEA,eAAsB,YACpB,OACA,OACA,KACA,QACA,MACA,iBACe;AACf,QAAM,WAAW,EAAE,YAAY,uBAAuB,IAAI,QAAQ,SAAS,kBAAkB,EAAE;AAC/F,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,MAAM,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAGtD,QAAM,MAAM,IAAI,OAAO,uBAAuB,QAAQ,KAAK,mBAAmB,MAAS;AACzF;;;ACjDO,SAAS,cAAc,OAA6B,CAAC,GAAsB;AAChF,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,SAAS,CAAC,WAA+C,OAAO,qBAAqB;AAE3F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,YAAY,OAAO,SAAS,YAAY,IAAI,OAAO;AAAA,IAE/D,MAAM,KAAK,OAAmB,OAAO,QAAQ,OAAkB;AAC7D,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,SAAS,SAAS,MAAM,YAAY,MAAM,IAAI,OAAO;AAC3D,YAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AACpE,YAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAI3C,WAAK,KAAK,GAAG,KAAK,OAAO,MAAM,QAAS;AACxC,WAAK,GAAG,IAAI,MAAM;AAClB,YAAM,YAAY,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO;AAAA,IAC5D;AAAA,IAEA,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,IAAI;AACnD,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,CAAC;AACtF,aAAO,KAAK,GAAG,UAAU,IAAI,EAAE,EAAE,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,QAAQ,YAAY;AAC9C,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,MAAM,oBAAI,IAAoB;AACpC,YAAM,SAAS,GAAG,UAAU;AAG5B,iBAAW,UAAU,MAAM,MAAM,KAAK,OAAO,qBAAqB,GAAG;AACnE,YAAI,CAAC,OAAO,WAAW,GAAG,UAAU,IAAI,EAAG;AAC3C,cAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,cAAI,EAAE,WAAW,MAAM,EAAG,KAAI,IAAI,EAAE,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,QAC7D;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACkCA,eAAsB,gBACpB,MACA,OACA,OACA,QACA,YAC2B;AAC3B,QAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,UAAU;AACjE,QAAM,gBAAmC,CAAC;AAE1C,QAAM,UAAoC,CAAC;AAC3C,MAAI,MAAM,SAAS,EAAG,SAAQ,KAAK,iBAAiB;AAIpD,MAAI,MAAM,cAAc,cAAc,KAAM,SAAQ,KAAK,kBAAkB;AAE3E,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,QAAI,QAAQ,MAAM;AAChB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,MAAM,MAAM,WAAW,CAAC;AAC/E;AAAA,IACF;AACA,QAAI,IAAI,KAAK,UAAU;AACrB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,IAAI,IAAI,MAAM,cAAc,CAAC;AAAA,IACtF;AAAA,EACF;AAKA,QAAM,UAAuB,cAAc,SAAS,IAChD,aACA,QAAQ,SAAS,IAAI,iBAAiB;AAE1C,SAAO,EAAE,SAAS,SAAS,MAAM,MAAM,eAAe,QAAQ;AAChE;","names":[]}

package/dist/{verify-RO5RTZOJ.js → verify-WYOFLSNA.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-HXGUIPQB.js";
+} from "./chunk-FOG7YEJP.js";
 import {
   dualReadSealedSlot
-} from "./chunk-AR2JDFAE.js";
+} from "./chunk-KDJGJR7F.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-VCETL77O.js";
+} from "./chunk-W5LHQXZU.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-JBIV4FLR.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -137,4 +137,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-RO5RTZOJ.js.map
+//# sourceMappingURL=verify-WYOFLSNA.js.map

package/dist/via/blob/binding.d.ts

@@ -1,5 +1,5 @@
 /**
- * The blob `ViaBinding` (#629 Task 7) — wires the `blobFields` declaration
+ * The blob `NoydbVia` (#629 Task 7) — wires the `blobFields` declaration
  * into the kernel's generic Via port as a deliberately THIN binding:
  * declaration + posture + `describeFragment` + `erase` glue, and nothing
  * else. Blob content is fully out-of-band (`collection.blob(id)` →
@@ -18,7 +18,7 @@
  * EAGER — `port/with/blob-strategy.ts` calls {@link linkBlobVia} at module
  * load. `blobFields` policies are plain object literals (there is no
  * `blob.*()` declaration factory to hang a lazy link on), so the binder
- * must be installed before `compileViaBindings` ever sees one.
+ * must be installed before `compileVias` ever sees one.
  *
  * There is no `declare`-time validation: `blobFields` has never had a
  * construction-time refusal matrix (policies are consulted lazily by
@@ -31,7 +31,7 @@
  * `queryable: 'none'`); it does not participate in clause building or
  * evaluation.
  */
-import type { ViaBinding, ViaEraseReport } from '../../kernel/via/index.js';
+import type { NoydbVia, ViaEraseReport } from '../../kernel/via/index.js';
 import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
 /**
  * Config a blob collection's `blobFields` declaration resolves to — the
@@ -42,7 +42,7 @@ import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js
  * `retainedShared` become counts, each residue eTag becomes a tagged
  * `{kind: 'blob-residue', eTag}` entry.
  *
- * DELIBERATELY left unwired by `compileViaBindings` (#629 Task 10, resolved
+ * DELIBERATELY left unwired by `compileVias` (#629 Task 10, resolved
  * within parity-first — see task-10-report.md "blob purge" section):
  * `per-blob-cek.test.ts`/`forget.test.ts` prove blob-shred-on-forget is
  * gated SOLELY on the vault's `blobsStrategy` being configured, never on a
@@ -62,7 +62,7 @@ export interface BlobViaConfig {
 }
 /**
  * One field's blob knobs as they appear on `describeFragment()`'s payload
- * (#657 — the second real `ViaBinding.describeFragment` consumer after
+ * (#657 — the second real `NoydbVia.describeFragment` consumer after
  * `lookup`'s; see `with-shape/introspection/describe.ts`'s `buildDescription`).
  * Declarative scalars (`retainDays`/`external`/`public`/`backlink`) verbatim;
  * predicate knobs (`evictWhen`/`legalHold`/`retainUntil` — functions over the
@@ -82,5 +82,5 @@ export interface BlobDescribeFragmentEntry {
 export interface BlobDescribeFragment {
     readonly blobFields: Record<string, BlobDescribeFragmentEntry>;
 }
-export declare function blobBinding(cfg: BlobViaConfig): ViaBinding;
+export declare function blobVia(cfg: BlobViaConfig): NoydbVia;
 export declare function linkBlobVia(): void;

package/dist/via/blob/index.d.ts

@@ -33,6 +33,9 @@ export { BLOB_COLLECTION, BLOB_INDEX_COLLECTION, BLOB_CHUNKS_COLLECTION, BLOB_SL
 export type { BlobObject, SlotRecord, SlotInfo, VersionRecord, BlobPutOptions, BlobResponseOptions, } from '../../kernel/types.js';
 export { detectMimeType, detectMagic, isPreCompressed } from '../../with-shape/blobs/mime-magic.js';
 export { runCompaction, BLOB_EVICTION_AUDIT_COLLECTION } from '../../with-shape/blobs/blob-compaction.js';
+export { reportOrphanBlobChunks } from '../../with-shape/blobs/orphan-report.js';
+export type { OrphanChunkReport } from '../../with-shape/blobs/orphan-report.js';
+export type { NoydbStore } from '../../kernel/types.js';
 export type { BlobFieldsConfig, BlobFieldPolicy, BlobEvictionEntry, CompactRunOptions, CompactionResult, CompactionContext, } from '../../with-shape/blobs/blob-compaction.js';
 export { createExportBlobsHandle, ExportBlobsAbortedError, EXPORT_AUDIT_COLLECTION, } from '../../with-shape/blobs/export-blobs.js';
 export type { ExportBlobsOptions, ExportedBlob, ExportBlobsHandle, ExportBlobsAuditEntry, } from '../../with-shape/blobs/export-blobs.js';

package/dist/via/classified/binding.d.ts

@@ -1,5 +1,5 @@
 /**
- * The classified `ViaBinding` (#629 Task 5, LIVE since Task 6) — wires
+ * The classified `NoydbVia` (#629 Task 5, LIVE since Task 6) — wires
  * classified-fields declaration/write-enforcement/at-rest sealing/erasure
  * into the kernel's generic Via port. Mirrors `via/money/binding.ts`'s
  * inline declaration-time validation and `via/i18n/binding.ts`'s
@@ -7,10 +7,10 @@
  * (`port/with/classified-strategy.ts` calls `linkClassifiedVia()` at module
  * load, not lazily from a `classified.*()` preset call): several fixtures
  * build a raw `ClassifiedFieldSpec` literal without ever calling a preset,
- * and the binder must be installed before `compileViaBindings` needs it
+ * and the binder must be installed before `compileVias` needs it
  * regardless.
  *
- * `compileViaBindings` (`kernel/collection-config.ts`) compiles this binding
+ * `compileVias` (`kernel/collection-config.ts`) compiles this binding
  * in whenever a collection declares `classifiedFields` — money then i18n
  * then classified, order pinned. `kernel/collection.ts`'s `_putInternal`
  * runs `enforceClassifiedWrite`'s effect via the pipeline's `enforceWrite`
@@ -18,13 +18,13 @@
  * replace the inline `sensitiveFields` seal path for any collection this
  * binding is compiled into.
  *
- * `declare` — `classifiedBinding(cfg)` runs `resolveClassifiedFields` +
+ * `declare` — `classifiedVia(cfg)` runs `resolveClassifiedFields` +
  * `guardClassifiedCompat` at CONSTRUCTION time (the same #553 pattern
- * `moneyBinding`'s `validateMoneyFieldPaths(moneyFields)` call uses) —
+ * `moneyVia`'s `validateMoneyFieldPaths(moneyFields)` call uses) —
  * mirrors today's "door 1" (`collection-config.ts`'s
  * `resolveCollectionConfig`). Both may throw `ClassifiedConfigError`.
  */
-import type { ViaBinding } from '../../kernel/via/index.js';
+import type { NoydbVia } from '../../kernel/via/index.js';
 import { type ClassifiedEntry } from './resolve.js';
 import { type ClassifiedGuardCtx } from './guards.js';
 /**
@@ -58,7 +58,7 @@ export interface ClassifiedViaConfig {
      * completeness (see that method's doc comment for the shreddable/
      * dekResidue/both-class semantics). `live` is `ViaEraseCtx.live`'s opaque
      * envelope, passed straight through. NOT `readonly` (#629 Task 10):
-     * `compileViaBindings` builds this cfg before the owning `Collection`'s
+     * `compileVias` builds this cfg before the owning `Collection`'s
      * `RecordCodec` exists, so `Collection`'s constructor mutates this field
      * in place once `this.codec` is available — the closure `eraseClassified`
      * reads is looked up at CALL time, not at binding-construction time, so
@@ -71,7 +71,7 @@ export interface ClassifiedViaConfig {
      * Vault-provided closure that purges every `_sealed_cek/<collection>/<id>/*`
      * host-delivery envelope for one record (mirrors `rotateRecordCek`'s own
      * prefix-delete) and returns the count purged. Deliberately left UNWIRED
-     * by `compileViaBindings` (#629 Task 10) — `forget-sealed-erasure.test.ts`
+     * by `compileVias` (#629 Task 10) — `forget-sealed-erasure.test.ts`
      * proves this purge is UNCONDITIONAL on `sealRecordToHost` usage alone,
      * independent of whether `classifiedFields` is declared (a bare
      * `sensitive: [...]` collection exercises it with no classified binding
@@ -79,5 +79,5 @@ export interface ClassifiedViaConfig {
      */
     readonly purgeSealedCekEnvelopes?: (id: string) => Promise<number>;
 }
-export declare function classifiedBinding(cfg: ClassifiedViaConfig): ViaBinding;
+export declare function classifiedVia(cfg: ClassifiedViaConfig): NoydbVia;
 export declare function linkClassifiedVia(): void;

package/dist/via/computed/binding.d.ts

@@ -24,11 +24,11 @@
  * `EXPORT_REDACTION_MARKER` on every present() — the one enforcement seam
  * every via feature's taint already routes through.
  */
-import type { ViaBinding } from '../../kernel/via/index.js';
+import type { NoydbVia } from '../../kernel/via/index.js';
 import type { ComputedDescriptor } from './descriptor.js';
 export interface ComputedViaConfig {
     /** field name -> its virtual-mode descriptor. Materialized entries are never present here. */
     readonly virtualFields: ReadonlyMap<string, ComputedDescriptor>;
 }
-export declare function computedBinding(cfg: ComputedViaConfig): ViaBinding;
+export declare function computedVia(cfg: ComputedViaConfig): NoydbVia;
 export declare function linkComputedVia(): void;

package/dist/via/i18n/binding.d.ts

@@ -1,10 +1,10 @@
 /**
- * The i18n `ViaBinding` — wires the i18n engine (auto-translate/script
+ * The i18n `NoydbVia` — wires the i18n engine (auto-translate/script
  * enforcement/validation/densify on write; locale + dict-label presentation
  * on read) into the kernel's generic Via port. Mirrors
  * `via/money/binding.ts`'s #553 static-link pattern.
  *
- * LIVE (#623 Task 8 wired the cutover): `i18nBinding()`/`linkI18nVia()` are
+ * LIVE (#623 Task 8 wired the cutover): `i18nVia()`/`linkI18nVia()` are
  * the real put/read path for every i18n-declaring collection —
  * `collection.ts`'s `_putInternal`/`applyLocaleToRecord` (the call sites
  * this file's bodies were moved/adapted from) now delegate their i18n
@@ -14,7 +14,7 @@
  * `i18nText()`, `dictKey()`, `staticDict()` each call {@link linkI18nVia}
  * first — the same #553 pattern `money()` uses.
  */
-import type { ViaBinding } from '../../kernel/via/index.js';
+import type { NoydbVia } from '../../kernel/via/index.js';
 /**
  * Config a collection's i18n declarations resolve to — the binding's
  * construction input. Fields are loosely typed (`unknown`) at this seam
@@ -32,5 +32,5 @@ export interface I18nViaConfig {
     i18nPutValidator?: (record: unknown) => void;
     collectionName: string;
 }
-export declare function i18nBinding(cfg: I18nViaConfig): ViaBinding;
+export declare function i18nVia(cfg: I18nViaConfig): NoydbVia;
 export declare function linkI18nVia(): void;

package/dist/via/lookup/binding.d.ts

@@ -1,5 +1,5 @@
 /**
- * The `'lookup'` `ViaBinding` — wires the lookup engine (present-time label
+ * The `'lookup'` `NoydbVia` — wires the lookup engine (present-time label
  * dressing across all three backing tiers) into the kernel's generic Via
  * port. Mirrors `via/i18n/binding.ts`'s #553 static-link pattern; the
  * present-time label-dressing algorithm below is adapted from
@@ -24,10 +24,10 @@
  * `hasStaticDisplay` branch already uses). `resolveOrderLabel` (#650 Task
  * 7) is the PER-CALL-locale sibling `orderBy(..., {by:'label'})` needs —
  * see its own doc comment below. `describeFragment` (#650 Task 7) is the
- * first-ever consumed `ViaBinding.describeFragment` implementation — see
+ * first-ever consumed `NoydbVia.describeFragment` implementation — see
  * `with-shape/introspection/describe.ts`'s `buildDescription`.
  */
-import type { ViaBinding } from '../../kernel/via/index.js';
+import type { NoydbVia } from '../../kernel/via/index.js';
 import type { LookupDescriptor, LookupBacking, Vocabulary, OnDelete } from './descriptor.js';
 import type { MaterializedBacking } from './registry.js';
 /**
@@ -66,7 +66,7 @@ export interface LookupViaConfig {
     readonly collectionName: string;
 }
 /**
- * One field's `lookup` descriptor as it appears on a `ViaBinding.
+ * One field's `lookup` descriptor as it appears on a `NoydbVia.
  * describeFragment()` payload (#650 Task 7 — the first real consumer,
  * `with-shape/introspection/describe.ts`'s `buildDescription`, imports this
  * type directly; `describe.ts` is NOT under `kernel/**`, so it's free to
@@ -95,5 +95,5 @@ export interface LookupDescribeFragmentEntry {
 export interface LookupDescribeFragment {
     readonly lookupFields: Record<string, LookupDescribeFragmentEntry>;
 }
-export declare function lookupBinding(cfg: LookupViaConfig): ViaBinding;
+export declare function lookupVia(cfg: LookupViaConfig): NoydbVia;
 export declare function linkLookupVia(): void;

package/dist/via/lookup/handle.d.ts

@@ -132,7 +132,10 @@ export declare class LookupHandle<Keys extends string = string> {
      * `enclave-body-only` / Check 15 `via-enclave-isolation`) — the Vault binds the real
      * `kernel/enclave` function at construction time, same pattern as `reservedEnvelopes` above.
      */
-    buildDeleteMarker: (version: number, actor: string) => EncryptedEnvelope, 
+    buildDeleteMarker: (identity: {
+        collection: string;
+        id: string;
+    }, version: number, actor: string) => EncryptedEnvelope, 
     /** #650 Task 4 (#647) — dirty-log participation hook (origin `local-write`), threaded from `BuildLookupHandleOptions`. */
     onDirty?: ((collection: string, id: string, action: "put" | "delete", version: number) => Promise<void>) | undefined, 
     /** #650 Task 4 — thin `graphDispatch.collect`-equivalent; opens/collects/flushes a one-shot wave for this touch. */

package/dist/via/lookup/index.d.ts

@@ -13,5 +13,5 @@ export { LookupHandle, DictionaryHandle, DICT_COLLECTION_PREFIX, dictCollectionN
 export { enforceStaticDictOnPut, resolveDictSource, updateReferencingRecords, type DictReferencingCollection } from './registry.js';
 export { withLookup } from './active.js';
 export { lookup, enumOf, enumOf as enum, dict, type LookupDescriptor, type Vocabulary, type LookupBacking, type OnDelete } from './descriptor.js';
-export { lookupBinding, linkLookupVia, type LookupViaConfig } from './binding.js';
+export { lookupVia, linkLookupVia, type LookupViaConfig } from './binding.js';
 export type { LookupDescribeFragment, LookupDescribeFragmentEntry } from './binding.js';

package/dist/via/lookup/snapshot.d.ts

@@ -19,7 +19,7 @@
  *   - join dressing (`presentForJoin`, consumed by `kernel/query/join.ts`
  *     via `JoinableSource.presentForJoin`)
  *   - dimension sort (`compareForOrder`, consumed by
- *     `via/lookup/binding.ts`'s `ViaBinding.compareForOrder` closure)
+ *     `via/lookup/binding.ts`'s `NoydbVia.compareForOrder` closure)
  *   - per-call-locale order-label resolution (`resolveOrderLabel`, #650
  *     Task 7 — the `orderBy(..., {by:'label'})` channel `compareForOrder`
  *     structurally can't serve, no locale param; consumed by

package/dist/via/money/binding.d.ts

@@ -1,12 +1,12 @@
 /**
- * The money `ViaBinding` — wires the money engine (normalize/paths/where/
+ * The money `NoydbVia` — wires the money engine (normalize/paths/where/
  * money-reducer) into the kernel's generic Via port. `money()`
  * (descriptor.ts) calls {@link linkMoneyVia} at declaration time — the
  * same #553 static-link pattern the retired `linkMoneyEngine()` /
  * `kernel/money-runtime.ts` seam used, now the only one (Task 6 cut the
  * query DSL over to this binding and deleted the legacy seam).
  */
-import type { ViaBinding } from '../../kernel/via/index.js';
+import type { NoydbVia } from '../../kernel/via/index.js';
 import type { MoneyDescriptor } from './descriptor.js';
 /** #669 — the money binder's config bag. `virtualMoneyFields` is the money∩virtual-mode-
  *  computed field-name intersection (`kernel/collection-config.ts#resolveVirtualMoneyFields`);
@@ -17,5 +17,5 @@ export interface MoneyBindingConfig {
     readonly moneyFields: Record<string, MoneyDescriptor>;
     readonly virtualMoneyFields?: ReadonlySet<string>;
 }
-export declare function moneyBinding(moneyFields: Record<string, MoneyDescriptor>, virtualMoneyFields?: ReadonlySet<string>): ViaBinding;
+export declare function moneyVia(moneyFields: Record<string, MoneyDescriptor>, virtualMoneyFields?: ReadonlySet<string>): NoydbVia;
 export declare function linkMoneyVia(): void;

package/dist/via/money/normalize.d.ts

@@ -78,7 +78,7 @@ export declare function quantizeMoneyFields<T extends Record<string, unknown>>(r
  */
 export declare function moneyScaledValue(stored: unknown, desc: MoneyDescriptor): bigint | null;
 /**
- * The `ViaBinding.canonicalizeIndexKey` implementation for money (#672) —
+ * The `NoydbVia.canonicalizeIndexKey` implementation for money (#672) —
  * bucket an eager index's money field entries by the BigInt-normalized
  * scaled-int string, not the raw stored bytes, so a pre-declaration /
  * non-canonical value (e.g. `'0100'`) lands under the SAME key a canonical

package/dist/via/money/where.d.ts

@@ -32,7 +32,7 @@ interface MoneyOperandEntry {
 }
 /**
  * The opaque `via` clause payload for a `where()` over a declared money
- * field (see `ViaBinding.buildClause` in kernel/via/index.ts). `entries` holds
+ * field (see `NoydbVia.buildClause` in kernel/via/index.ts). `entries` holds
  * one element for comparison ops, two for `between` (lo, hi — same
  * currency), N for `in`.
  */
@@ -42,14 +42,14 @@ export interface MoneyWhereOperand {
 }
 /**
  * Build the `via` clause payload ({@link MoneyWhereOperand}) for a
- * `where()` over a declared money field — the `ViaBinding.buildClause`
+ * `where()` over a declared money field — the `NoydbVia.buildClause`
  * implementation for money. The operand is quantized into stored
  * scaled-int space NOW — build time — so typos throw at the call site.
  */
 export declare function moneyFieldClause(field: string, op: Operator, value: unknown, desc: MoneyDescriptor): MoneyWhereOperand;
 /**
  * The `via` index-probe operand for a `where()` over a declared money
- * field (see `ViaBinding.indexProbe` in kernel/via/index.ts) — the STORED-form
+ * field (see `NoydbVia.indexProbe` in kernel/via/index.ts) — the STORED-form
  * value `CollectionIndexes.lookupEqual`/`lookupIn` (`with-lookup/indexing/
  * eager-indexes.ts`) can bucket directly.
  *

package/dist/walk-JNEOYCAU.js

@@ -0,0 +1,21 @@
+import {
+  dumpVaultSchema
+} from "./chunk-HM4JSXX2.js";
+import "./chunk-KHKKD62N.js";
+import "./chunk-P6ASQOZR.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-YXA2TCTZ.js";
+import "./chunk-2LPVI4PX.js";
+import "./chunk-N4CNVSUF.js";
+import "./chunk-FOG7YEJP.js";
+import "./chunk-KDJGJR7F.js";
+import "./chunk-LKFKXS5K.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-W5LHQXZU.js";
+import "./chunk-RK7N4OQ5.js";
+import "./chunk-JBIV4FLR.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-JNEOYCAU.js.map

package/dist/walk-JNEOYCAU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/with-audit/periods/periods.d.ts

@@ -501,7 +501,7 @@ export interface ReadOnlyCollection<T> {
  * @internal — called by Vault methods that need the closed-period
  * cache. Not part of the public API surface.
  */
-export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt: (envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
+export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
 /**
  * Given the current ordered period list, pick the last entry that
  * belongs to the hash chain — used as the `priorPeriodHash` anchor

package/dist/with-audit/periods/strategy.d.ts

@@ -17,7 +17,7 @@ import type { PeriodRecord, PeriodPartition, PartitionResolver } from './periods
  * @internal
  */
 export interface PeriodsStrategy {
-    loadPeriods(adapter: NoydbStore, vault: string, decrypt: (envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
+    loadPeriods(adapter: NoydbStore, vault: string, decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
     chainAnchor(records: readonly PeriodRecord[], partition?: PeriodPartition): Promise<{
         priorPeriodName?: string;
         priorPeriodHash: string;

package/dist/with-audit/sealed-record/index.d.ts

@@ -46,10 +46,23 @@ export { SealedRecordNotEnabledError } from '../../kernel/errors.js';
  * @param expectedCollection Collection the caller believes `recordEnvelope` is in.
  * @param expectedId         Record id the caller believes `recordEnvelope` is.
  * @returns The decrypted record body as a JSON string.
+ *
+ * ⚠️ **`recordEnvelope` must carry `_tier` and `_by`, not just the body**
+ * (#1041). They are plaintext metadata rather than secrets, but they are bound
+ * into the record's AAD, so a host handed only `{_iv, _data}` cannot
+ * reconstruct the identity the body was sealed against.
+ *
+ * That is a feature, not a tax: it means a host cannot be fed a body with its
+ * tags stripped or rewritten — a re-tiered or re-authored envelope no longer
+ * opens, even with a valid sealed CEK.
  */
 export declare function openSealedRecord(sealedCekEnvelope: SealedCekDeliveryEnvelope, recordEnvelope: {
     readonly _iv: string;
     readonly _data: string;
+    /** Bound into the AAD since #1093 — a rewound body no longer opens. */
+    readonly _v: number;
+    readonly _tier?: number | undefined;
+    readonly _by?: string | undefined;
 }, recipientSealer: {
     unseal(bytes: Uint8Array): Promise<Uint8Array>;
 }, expectedCollection: string, expectedId: string): Promise<string>;

package/dist/with-audit/tiers/index.d.ts

@@ -23,7 +23,7 @@
 export { withTiers } from './active.js';
 export { NO_TIERS, type TiersStrategy } from './strategy.js';
 export { TiersNotEnabledError } from '../../kernel/errors.js';
-import { type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js';
+import { type RecordIdentity, type RecordCodec, type EnclaveKey, type SealedShredSlot } from '../../kernel/enclave/index.js';
 import type { UnlockedKeyring } from '../../with-party/team/keyring.js';
 import type { Lru } from '../../kernel/cache/index.js';
 import type { BlobFieldsConfig } from '../../with-shape/blobs/blob-compaction.js';
@@ -123,7 +123,22 @@ export interface TiersContext<T> {
      * pre-move body whenever `fromTier > 0`. No-op when history is disabled
      * (folds the `historyConfig.enabled` gate so `tiers/index.ts` stays simple).
      */
-    saveHistorySnapshot(id: string, envelope: EncryptedEnvelope): Promise<void>;
+    /**
+     * Persist a `_history` snapshot of `version`, sealed against the address it
+     * will be STORED at (#1041).
+     *
+     * Takes a **sealer**, not a finished envelope, because the destination
+     * identity is not knowable here: only the history strategy owns the
+     * `_history` layout. It hands the address in; the caller seals to it.
+     *
+     * ⚠️ The identity passed to `rewrapBodyToDek` must be what a READER will
+     * recompute — `recordAadFor(address, finalEnvelope)`. A tier-move snapshot
+     * strips `_tier`/`_elevatedBy` but KEEPS `_by`, so the destination is
+     * `{...address, by: envelope._by}` with no tier. Sealing against the bare
+     * address would produce history nothing can open, and the failure would
+     * surface only when someone reads it.
+     */
+    saveHistorySnapshot(id: string, version: number, seal: (address: RecordIdentity) => Promise<EncryptedEnvelope>): Promise<void>;
     /**
      * `true` iff a real history strategy is wired (not `NO_HISTORY`) AND not
      * explicitly disabled via `historyConfig.enabled`. `putAtTier` checks this

package/dist/with-cargo/adopt-partition.d.ts

@@ -9,10 +9,10 @@
  */
 import { type EnclaveKey } from '../kernel/enclave/index.js';
 import type { NoydbStore } from '../kernel/types.js';
-import type { SealingKeyProvider } from '../with-party/team/managed-secret.js';
-import type { ShamirRecoveryProvider } from '../with-party/team/shamir-recovery-provider.js';
+import type { NoydbSealer } from '../with-party/team/managed-secret.js';
+import type { NoydbShamir } from '../with-party/team/noydb-shamir.js';
 import type { RecoveryEnrollmentInput } from '../with-party/team/rotate-recover.js';
-import type { TransferSealPayload } from '../with-pod/bundle.js';
+import type { TransferSealPayload } from '../with-pod/pod.js';
 /**
  * Reverse of `sealDeks`. Imports the transfer key, decrypts the
  * sealed `{ collection: base64(rawDEK) }` map (layout iv(12)‖ct‖tag), and
@@ -43,7 +43,7 @@ export interface CreateOwnerStandardOptions {
 }
 /**
  * Managed-mode owner: the secret is minted + sealed under
- * a `SealingKeyProvider` (e.g. an `at-*` OS keychain) so the partition
+ * a `NoydbSealer` (e.g. an `at-*` OS keychain) so the partition
  * auto-unlocks on the recipient's device. Managed mode mandates a strong
  * (Shamir) recovery profile at creation, which needs the
  * `shamirRecovery` provider injected.
@@ -51,9 +51,9 @@ export interface CreateOwnerStandardOptions {
 export interface CreateOwnerManagedOptions {
     readonly userId: string;
     readonly secretMode: 'managed';
-    readonly sealingKey: SealingKeyProvider;
+    readonly sealingKey: NoydbSealer;
     readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>;
-    readonly shamirRecovery: ShamirRecoveryProvider;
+    readonly shamirRecovery: NoydbShamir;
     readonly transferKey: Uint8Array;
 }
 export type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManagedOptions;
@@ -62,7 +62,7 @@ export type CreateOwnerOptions = CreateOwnerStandardOptions | CreateOwnerManaged
  * then destroy the transfer seal.
  *
  * Standard mode: the recipient supplies a secret. Managed mode: the
- * secret is minted + sealed under a `SealingKeyProvider` and a strong
+ * secret is minted + sealed under a `NoydbSealer` and a strong
  * (Shamir) recovery profile is enrolled — orchestrated via the existing
  * `openVaultAndEnrollRecovery` ceremony.
  *

package/dist/with-cargo/extract-partition.d.ts

@@ -10,7 +10,7 @@ import type { Vault } from '../kernel/vault.js';
 import type { EncryptedEnvelope } from '../kernel/types.js';
 import { type EnclaveKey } from '../kernel/enclave/index.js';
 import { type WalkClosureOptions, type DanglingRefNotice } from './walk-closure.js';
-import { type TransferSealPayload } from '../with-pod/bundle.js';
+import { type TransferSealPayload } from '../with-pod/pod.js';
 /** Re-keyed collections snapshot + the fresh DEKs used. */
 export interface ReKeyResult {
     readonly collections: Record<string, Record<string, EncryptedEnvelope>>;

package/dist/with-cargo/floor.d.ts

@@ -30,4 +30,4 @@ export type { ReduceResult, ReduceSpec, LiveReduction, } from '../with-lookup/re
 export type { IndexDef } from '../with-lookup/indexing/eager-indexes.js';
 export type { FuseOptions } from '../with-lookup/search/fuse.js';
 export type { RetrieveHit, RetrieveOptions } from '../with-lookup/search/retrieve-types.js';
-export type { CoordinationProvider, WriterPresence, FenceState, DrainBarrierOptions, } from '../port/by/index.js';
+export type { NoydbMesh, WriterPresence, FenceDoc, DrainBarrierOptions, } from '../port/by/index.js';

package/dist/with-cargo/index.d.ts

@@ -19,7 +19,7 @@ export { liberateVault } from '../with-party/custody/liberate.js';
 export type { LiberateOptions, LiberateResult } from '../with-party/custody/liberate.js';
 export { createDeedOwner, loadDeedMarker, isDeedVault } from '../with-party/team/deed.js';
 export type { DeedMarker } from '../with-party/team/deed.js';
-export type { SealingKeyProvider } from '../with-party/team/managed-secret.js';
+export type { NoydbSealer } from '../with-party/team/managed-secret.js';
 export { diffVault } from './vault-diff.js';
 export { STATE_VAULT_NAME } from '../kernel/constants.js';
 export { withCargo } from './active.js';
@@ -43,4 +43,4 @@ export type { WriteConflict } from '../kernel/types.js';
 export type { AccessibleVault } from '../kernel/types.js';
 export type { Unsubscribe } from '../kernel/types.js';
 export type { ExtractPartitionOptions } from './extract-partition.js';
-export type { TransferSealPayload } from '../with-pod/bundle.js';
+export type { TransferSealPayload } from '../with-pod/pod.js';

package/dist/with-commit/history/history.d.ts

@@ -1,5 +1,31 @@
+import type { RecordIdentity } from '../../kernel/enclave/index.js';
 import type { NoydbStore, EncryptedEnvelope, HistoryOptions, PruneOptions } from '../../kernel/types.js';
 import { type EnclaveKey } from '../../kernel/enclave/index.js';
+/**
+ * The identity a history snapshot is **sealed against** — its STORAGE location,
+ * not the live record it is a copy of (#1041).
+ *
+ * ## Why storage, and why this is a decision rather than a detail
+ *
+ * A snapshot is a copy, so two identities are available: the live record
+ * (`collection`/`recordId`) or where the bytes actually land
+ * (`_history`/`historyId(...)`). They are not equivalent under attack.
+ *
+ * Binding the LIVE identity makes a snapshot's AAD **indistinguishable from the
+ * live record's at the same version** — so an untrusted store could serve a
+ * history entry *as the current record* and the client would accept it. It also
+ * leaves entries relocatable within `_history`.
+ *
+ * Binding STORAGE identity closes both. The cost is that the id must be known
+ * *before* the envelope is sealed, where `saveHistory` previously derived it
+ * *after* (from `envelope._v`) — which is precisely the restructure this
+ * function exists to make possible.
+ *
+ * `saveHistory` uses this too, so the sealed identity and the put location have
+ * **one definition** and cannot drift apart. Changing the layout here changes
+ * both at once, by construction.
+ */
+export declare function historyIdentity(collection: string, recordId: string, version: number): RecordIdentity;
 /** Save a history entry (a complete encrypted envelope snapshot). */
 export declare function saveHistory(adapter: NoydbStore, vault: string, collection: string, recordId: string, envelope: EncryptedEnvelope): Promise<void>;
 /** Get history entries for a record, sorted newest-first. */

package/dist/with-commit/history/index.d.ts

@@ -17,7 +17,7 @@
  */
 export { withHistory } from './active.js';
 export type { HistoryStrategy } from './strategy.js';
-export { saveHistory, getHistory, getVersionEnvelope, pruneHistory, clearHistory, } from './history.js';
+export { saveHistory, historyIdentity, getHistory, getVersionEnvelope, pruneHistory, clearHistory, } from './history.js';
 export { diff, formatDiff } from './diff.js';
 export type { ChangeType, DiffEntry } from './diff.js';
 export { LedgerStore, LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, envelopePayloadHash, } from './ledger/store.js';
@@ -30,3 +30,4 @@ export { VaultInstant, CollectionInstant } from './time-machine.js';
 export type { VaultEngine } from './time-machine.js';
 /** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
 export { NO_HISTORY } from './strategy.js';
+export type { RecordIdentity } from '../../kernel/enclave/index.js';

package/dist/with-commit/history/ledger/store.d.ts

@@ -237,7 +237,13 @@ export declare class LedgerStore {
      * version/timestamp/actor) fully intact for audit purposes.
      */
     purgeRecordDeltas(collection: string, id: string): Promise<number>;
-    /** Encrypt a JSON Patch into an envelope for storage. Mirrors encryptEntry. */
+    /**
+     * Encrypt a JSON Patch into an envelope for storage. Mirrors encryptEntry.
+     *
+     * `index` is the ledger index this delta will be stored under — the caller
+     * knows it before the entry exists, and it is what makes the envelope's
+     * identity bindable (#1051).
+     */
     private encryptDelta;
     /**
      * Read all entries in ascending-index order. Used internally by