@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.20

package/dist/with-formula/materialized-views/types.d.ts

@@ -4,6 +4,7 @@ import type { ReduceSpec, Reduction } from '../../with-lookup/reduce/reduction.j
 import type { GroupedReduction } from '../../with-lookup/reduce/groupby.js';
 import type { JoinStrategy } from '../../kernel/query/join.js';
 import type { MoneyDescriptor } from '../../via/money/descriptor.js';
+import type { ExactMath } from '../../via/money/exact.js';
 import type { I18nTextDescriptor } from '../../via/i18n/core.js';
 /**
  * Minimal vault-shaped accessor passed to the MV `query()` callback.
@@ -269,6 +270,57 @@ export interface MaterializedViewSpec<TRow extends Record<string, unknown>> {
      * UNION-mode only. Ignored if {@link query} is set.
      */
     aggregate?: ReduceSpec;
+    /**
+     * Post-aggregate projection over ONE finished row (#1007).
+     *
+     * `aggregate` accepts reducers only, so a row can carry every input a
+     * derived value needs and still not express it — `max(0, netTotal - paid)`
+     * is not a reduction. `derive` closes that gap: it receives the row the
+     * grouping/aggregation pipeline just produced and returns a patch merged
+     * onto it, immediately before materialisation.
+     *
+     * ```ts
+     * aggregate: { paid: sum('paid'), netTotal: sum('netTotal') },
+     * derive: (row) => ({ toPay: Math.max(0, row.netTotal - row.paid) }),
+     * ```
+     *
+     * Deliberately narrow, and the narrowness is what keeps it safe under
+     * incremental recompute: **pure, single-row, no cross-row access, no second
+     * aggregation pass.** It only ever sees the row the reducer just produced,
+     * so a refresh triggered by one source write recomputes it correctly without
+     * the engine needing to know anything about the function.
+     *
+     * Returning `null` / `undefined` leaves the row unchanged. Returned keys
+     * that collide with a {@link groupBy} field throw
+     * `MaterializedViewConfigError` — a group key is the row's identity and
+     * feeds {@link rowKey}, so rewriting it would silently re-home the row.
+     *
+     * **Money:** money leaves a reducer as an exact decimal string, and
+     * `Number(a) - Number(b)` would put it straight back through binary floating
+     * point — `10.05 - 0.10` becomes `9.950000000000001`, which the money
+     * quantiser then refuses rather than storing drift. So `derive` receives
+     * {@link ExactMath} as its second argument; it works in scaled BigInt and
+     * cannot introduce a representation error:
+     *
+     * ```ts
+     * moneyFields: { netTotal: THB, paid: THB, toPay: THB },
+     * derive: (row, exact) => ({ toPay: exact.max(0, exact.sub(row.netTotal, row.paid)) }),
+     * ```
+     *
+     * Declare the derived field in {@link moneyFields} and the result is
+     * quantised through that descriptor before storage, exact at its scale.
+     *
+     * Note the one place `TRow` under-describes what arrives: a field declared
+     * in {@link moneyFields} reaches `derive` DECODED — the decimal string a
+     * reader would see, not the scaled integer the reducer left behind — even
+     * where `TRow` types it as `number` (which is what the arms' `map` emits).
+     * `ExactMath` accepts both, which is why its operations are the right tool
+     * here and why no cast is needed.
+     *
+     * Applies to every MV form (union, projection, and query), always as the
+     * last step before rows are materialised.
+     */
+    derive?: (row: TRow, exact: ExactMath) => Record<string, unknown> | null | undefined;
     /**
      * Money descriptors for the UNION-mode aggregate, keyed by the
      * OUTPUT/intermediate field name as it appears in the mapped row and

package/dist/with-party/directory/cover/storage.d.ts

@@ -1,11 +1,3 @@
-/**
- * Persistence helpers for `_meta/public-envelope` — the cover's
- * frozen wire location. Mirrors the bypass-AES pattern used by
- * `_meta/handle` and `_meta/policy` — the document is plaintext
- * JSON, the envelope's `_iv` field is left empty.
- *
- * @module
- */
 import type { NoydbStore } from '../../../kernel/types.js';
 import type { Cover } from './types.js';
 /**

package/dist/with-party/directory/storage.d.ts

@@ -1,14 +1,3 @@
-/**
- * Persistence helpers for the vault-level user-directory toggle
- * (`_meta/directory`). Mirrors the bypass-AES pattern used by
- * `_meta/policy` — the directory document is plain JSON, the
- * envelope's `_iv` field is left empty.
- *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/plaintext-bypass.md — every `_iv: ''` write site
- *
- * @module
- */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { DirectoryConfig } from './types.js';
 /** Reserved collection name for vault-level metadata documents. */

package/dist/with-party/directory/visibility.d.ts

@@ -1,24 +1,3 @@
-/**
- * Persistence helpers for the per-user visibility flag
- * (`_meta/visibility/<keyringId>`). Mirrors the bypass-AES pattern used
- * by `_meta/policy` — the visibility document is plain JSON, the
- * envelope's `_iv` field is left empty.
- *
- * Stored alongside the keyring file rather than inside the encrypted
- * user envelope (`_users/<keyringId>`) because:
- *
- *  - `UserEnvelope<T>.data` is opaque-to-hub by contract — hub does not
- *    introspect or reserve any keys inside it. Adding `hidden` there
- *    would violate that contract.
- *  - `listUsersWithEnvelopes` filters by the flag, and the filter must
- *    work even when decryption fails (legacy keyrings predating the
- *    envelope feature, or a corrupted envelope).
- *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/plaintext-bypass.md — every `_iv: ''` write site
- *
- * @module
- */
 import type { NoydbStore } from '../../kernel/types.js';
 import type { UserVisibility } from './types.js';
 /** Prefix for per-user visibility records inside `_meta`. */

package/dist/with-party/policy/storage.d.ts

@@ -1,13 +1,3 @@
-/**
- * Persistence helpers for the vault-level policy document
- * (`_meta/policy`). Mirrors the bypass-AES pattern used by
- * `_meta/handle` — the policy document is plain JSON, the envelope's
- * `_iv` field is left empty.
- *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Storage location
- *
- * @module
- */
 import type { NoydbStore, VaultPolicy } from '../../kernel/types.js';
 /** Reserved collection name for vault-level metadata documents. */
 export declare const META_COLLECTION = "_meta";

package/dist/with-party/team/index.d.ts

@@ -17,7 +17,7 @@ export { NO_TEAM, type TeamStrategy } from './strategy.js';
 export { TeamNotEnabledError } from '../../kernel/errors.js';
 export type { UnlockedKeyring } from './keyring.js';
 export { loadKeyring, createOwnerKeyring, grant, revoke, changeSecret, listUsers, listUsersWithEnvelopes, ensureCollectionDEK, persistKeyring, updateKeyringIdentity, buildRecipientKeyringFile, } from './keyring.js';
-export type { BundleRecipient, ListUsersOptions } from './keyring.js';
+export type { PodRecipient, ListUsersOptions } from './keyring.js';
 export type { LoadKeyringOptions, CreateOwnerKeyringOptions, RotateKeysOptions, ChangeSecretOptions, } from './keyring.js';
 export { enrollAuthenticator, removeAuthenticator, updateAuthenticator, findAuthenticator, } from './authenticators.js';
 export type { EnrollAuthenticatorOptions, EnrollAuthenticatorWrappingKEKOptions, EnrollAuthenticatorWrappingDEKsOptions, UpdateAuthenticatorOptions, } from './authenticators.js';

package/dist/with-party/team/keyring.d.ts

@@ -9,6 +9,11 @@ export interface UnlockedKeyring {
     readonly role: Role;
     readonly permissions: Permissions;
     readonly deks: Map<string, EnclaveKey>;
+    /**
+     * Unwrapped counterpart of {@link KeyringFile.pending_deks} — an
+     * uncommitted rotation (#1074). Empty in the normal state.
+     */
+    readonly pendingDeks?: Map<string, EnclaveKey> | undefined;
     /**
      * The KEK, when this keyring was unlocked via tier 1 (secret) or
      * a wrap-KEK tier-2 method (WebAuthn / OIDC). `null` when the
@@ -261,7 +266,7 @@ export interface EchoRecipientSecret extends EchoSecretParts {
  *
  * @public
  */
-export interface BundleRecipient {
+export interface PodRecipient {
     /** User id stamped onto the keyring file in the bundle. */
     readonly id: string;
     /** Optional display name. Defaults to `id`. */
@@ -312,7 +317,7 @@ export interface BundleRecipient {
  *
  * @internal
  */
-export declare function buildRecipientKeyringFile(callerKeyring: UnlockedKeyring, recipient: BundleRecipient): Promise<KeyringFile>;
+export declare function buildRecipientKeyringFile(callerKeyring: UnlockedKeyring, recipient: PodRecipient): Promise<KeyringFile>;
 /** List all users with access to a vault. */
 export declare function listUsers(store: NoydbStore, vault: string): Promise<UserInfo[]>;
 /**
@@ -368,8 +373,17 @@ export declare function listUsersWithEnvelopes<T = unknown>(store: NoydbStore, v
     user: UserInfo;
     envelope: UserEnvelope<T> | null;
 }>>;
-/** Ensure a DEK exists for a collection. Generates one if new. */
 export declare function ensureCollectionDEK(store: NoydbStore, vault: string, keyring: UnlockedKeyring): Promise<(collectionName: string) => Promise<EnclaveKey>>;
+/**
+ * The `Permissions` catch-all key (#1010). `Permissions` has always documented
+ * `'*'` as "the wildcard collection matching all collections in the vault", but
+ * nothing expanded it — a grantee handed the documented catch-all got no keys
+ * at all. It is honoured in three places, and they must agree: the DEK wrapping
+ * in `grant()`, and both permission checks below.
+ */
+export declare const PERMISSION_WILDCARD = "*";
+/** Does this permission map hand over the whole vault? */
+export declare function permissionsAreWildcard(permissions: Permissions | undefined): boolean;
 /** Check if a user has write permission for a collection. */
 export declare function hasWritePermission(keyring: UnlockedKeyring, collectionName: string): boolean;
 /** Check if a user has any access to a collection. */

package/dist/with-party/team/tiers.d.ts

@@ -18,7 +18,8 @@
  */
 import type { UnlockedKeyring } from './keyring.js';
 /** Canonical DEK key for a given collection + tier. Tier 0 → bare name. */
-export declare function dekKey(collection: string, tier: number): string;
+import { dekKey } from '../../kernel/tier-visibility.js';
+export { dekKey };
 /**
  * Returns the user's effective clearance for a given collection: the
  * maximum tier for which their keyring holds a DEK. Falls back to 0

package/dist/with-pod/format.d.ts

@@ -47,14 +47,14 @@
  */
 import type { Cover } from '../with-party/directory/cover/types.js';
 import type { Redirect } from './redirect.js';
-/** Magic bytes 'NDB1' (ASCII), identifying a NOYDB bundle. */
-export declare const NOYDB_BUNDLE_MAGIC: Uint8Array<ArrayBuffer>;
+/** Magic bytes 'NDB1' (ASCII) — `NoyDB 1` — identifying a NOYDB pod (`.noydb` container). */
+export declare const NOYDB_POD_MAGIC: Uint8Array<ArrayBuffer>;
 /** Total fixed prefix before the header JSON: 4+1+1+4 bytes. */
-export declare const NOYDB_BUNDLE_PREFIX_BYTES = 10;
+export declare const NOYDB_POD_PREFIX_BYTES = 10;
 /** Current bundle format version. Bumped on layout changes. Default for unsigned pods. */
-export declare const NOYDB_BUNDLE_FORMAT_VERSION = 1;
+export declare const NOYDB_POD_FORMAT_VERSION = 1;
 /** Format version for pods carrying a header signature (`sig`/`keyId`/`sigAlg`). */
-export declare const NOYDB_BUNDLE_FORMAT_VERSION_SIGNED = 2;
+export declare const NOYDB_POD_FORMAT_VERSION_SIGNED = 2;
 /**
  * Bitfield interpretation of the flags byte.
  *
@@ -85,7 +85,7 @@ export type CompressionAlgo = 0 | 1 | 2;
  *
  * **Minimum-disclosure rules:** these are the ONLY allowed keys.
  * Any other key in a parsed header causes
- * `validateBundleHeader` to throw. The set is kept short to
+ * `validatePodHeaderFields` to throw. The set is kept short to
  * minimize attack surface from cloud-storage metadata indexing —
  * see the file-level doc comment for the rationale.
  *
@@ -249,8 +249,6 @@ export interface NoydbPodHeader {
  * family (see `unlockMethods` doc comment on `NoydbPodHeader`).
  */
 export type UnlockMethod = 'password' | 'webauthn' | 'oidc' | 'totp' | 'email-otp' | 'magic-link' | 'pin' | 'recovery' | 'shamir';
-/** @deprecated Use `NoydbPodHeader`. */
-export type NoydbBundleHeader = NoydbPodHeader;
 /**
  * Validate a parsed bundle header. Throws on any deviation from
  * the minimum-disclosure schema:
@@ -266,18 +264,18 @@ export type NoydbBundleHeader = NoydbPodHeader;
  * The error messages name the offending field so consumers can
  * fix the producer rather than the reader.
  */
-export declare function validateBundleHeader(parsed: unknown): asserts parsed is NoydbPodHeader;
+export declare function validatePodHeaderFields(parsed: unknown): asserts parsed is NoydbPodHeader;
 /**
  * Encode a header object to UTF-8 JSON bytes after validating
  * minimum disclosure. Used by the writer to serialize the header
  * region of the container.
  */
-export declare function encodeBundleHeader(header: NoydbPodHeader): Uint8Array;
+export declare function encodePodHeader(header: NoydbPodHeader): Uint8Array;
 /**
  * Parse a bundle header from its UTF-8 JSON bytes. Throws on
  * invalid JSON or any minimum-disclosure violation.
  */
-export declare function decodeBundleHeader(bytes: Uint8Array): NoydbPodHeader;
+export declare function decodePodHeader(bytes: Uint8Array): NoydbPodHeader;
 /**
  * Read a uint32 from `bytes` at `offset` in big-endian byte order.
  * No bounds check — callers must guarantee `offset + 4 <= bytes.length`.
@@ -295,4 +293,4 @@ export declare function writeUint32BE(bytes: Uint8Array, offset: number, value:
  * 4 bytes match `NDB1`. Used by readers as a fast file-type check
  * before any further parsing.
  */
-export declare function hasNoydbBundleMagic(bytes: Uint8Array): boolean;
+export declare function hasNoydbPodMagic(bytes: Uint8Array): boolean;

package/dist/with-pod/index.d.ts

@@ -11,19 +11,19 @@
  * omit this subpath and save ~805 LOC of format code + Brotli/gzip
  * wiring.
  */
-export { writePod, readPod, readPodHeader, readPodCover, writeNoydbBundle, readNoydbBundle, readNoydbBundleHeader, resetBrotliSupportCache, } from './bundle.js';
+export { writePod, readPod, readPodHeader, readPodCover, resetBrotliSupportCache, } from './pod.js';
 export type { Cover } from '../with-party/directory/cover/types.js';
-export type { WritePodOptions, WriteNoydbBundleOptions, ReadNoydbBundleOptions, NoydbBundleReadResult, } from './bundle.js';
-export { verifyPodHeader } from './bundle.js';
-export type { PodVerifyResult } from './bundle.js';
+export type { WritePodOptions, ReadPodOptions, PodReadResult, } from './pod.js';
+export { verifyPodHeader } from './pod.js';
+export type { PodVerifyResult } from './pod.js';
 export { signRecord, verifyRecord, signedBytes, POD_SIG_ALG } from './signature.js';
-export { NOYDB_BUNDLE_MAGIC, NOYDB_BUNDLE_PREFIX_BYTES, NOYDB_BUNDLE_FORMAT_VERSION, FLAG_COMPRESSED, FLAG_HAS_INTEGRITY_HASH, COMPRESSION_NONE, COMPRESSION_GZIP, COMPRESSION_BROTLI, validateBundleHeader, encodeBundleHeader, hasNoydbBundleMagic, } from './format.js';
-export type { CompressionAlgo, NoydbPodHeader, NoydbBundleHeader, UnlockMethod, } from './format.js';
+export { NOYDB_POD_MAGIC, NOYDB_POD_PREFIX_BYTES, NOYDB_POD_FORMAT_VERSION, FLAG_COMPRESSED, FLAG_HAS_INTEGRITY_HASH, COMPRESSION_NONE, COMPRESSION_GZIP, COMPRESSION_BROTLI, validatePodHeaderFields, encodePodHeader, hasNoydbPodMagic, } from './format.js';
+export type { CompressionAlgo, NoydbPodHeader, UnlockMethod, } from './format.js';
 export { generateULID, isULID } from './ulid.js';
-export { wrapPodStore, createPodStore, wrapBundleStore, createBundleStore } from './pod-store.js';
-export type { WrappedPodNoydbStore, WrapPodStoreOptions, WrappedBundleNoydbStore, WrapBundleStoreOptions, } from './pod-store.js';
-export { BundleIntegrityError, BundleSealMismatchError, PodVersionConflictError, BundleVersionConflictError, BackupLedgerError, BackupCorruptedError, } from '../kernel/errors.js';
-export { readPodRedirect } from './bundle.js';
+export { wrapPodStore, createPodStore } from './pod-store.js';
+export type { WrappedPodNoydbStore, WrapPodStoreOptions, } from './pod-store.js';
+export { PodIntegrityError, PodSealMismatchError, PodVersionConflictError, BackupLedgerError, BackupCorruptedError, } from '../kernel/errors.js';
+export { readPodRedirect } from './pod.js';
 export { signRedirect, verifyRedirect, followRedirects } from './redirect.js';
 export type { Redirect, RedirectHop, FollowRedirectsResult } from './redirect.js';
 export type { DocSigner } from '../with-audit/attestation/signer.js';

package/dist/with-pod/open.d.ts

@@ -6,7 +6,7 @@
  * reachable through published seams). Composes, in order:
  *
  *   1. `readPod` — parse + integrity-check the container (throws
- *      `BundleIntegrityError` on a corrupted/truncated pod).
+ *      `PodIntegrityError` on a corrupted/truncated pod).
  *   2. `verifyPodHeader` — only when `opts.trustedKeys` is supplied.
  *      `'unsigned'` is benign (legacy pod, or `writePod({ sign: false })`)
  *      and open() proceeds; `'untrusted'` / `'tampered'` are fail-closed —
@@ -63,7 +63,7 @@
  * @module
  */
 import type { NoydbPodHeader } from './format.js';
-import type { PodVerifyResult } from './bundle.js';
+import type { PodVerifyResult } from './pod.js';
 import type { Noydb } from '../kernel/noydb.js';
 import type { Vault } from '../kernel/vault.js';
 import type { NoydbOptions, NoydbStore, EchoSecretParts } from '../kernel/types.js';

package/dist/with-pod/pod-handle.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Vault bundle handle — the stable opaque ULID identifying a vault
+ * across `.noydb` exports.
+ *
+ * Behaviour is byte-identical to the inline `Vault.getPodHandle`
+ * method this function replaced. `Vault` keeps the public method as
+ * a thin delegator.
+ *
+ * Internal — reached through `vault.getPodHandle()`.
+ */
+import type { NoydbStore } from '../kernel/types.js';
+/**
+ * Return the stable opaque bundle handle for the given vault adapter,
+ * generating and persisting a fresh ULID on first call.
+ *
+ * See {@link import('../kernel/vault.js').Vault.getPodHandle} for
+ * the full rationale and storage-path documentation.
+ */
+export declare function buildPodHandle(adapter: NoydbStore, name: string): Promise<string>;

package/dist/with-pod/pod-store.d.ts

@@ -44,11 +44,3 @@ export declare function wrapPodStore(bundle: NoydbPodStore, options?: WrapPodSto
  * analogous to `createStore` for KV stores.
  */
 export declare function createPodStore<TOptions>(factory: (options: TOptions) => NoydbPodStore): (options: TOptions) => NoydbPodStore;
-/** @deprecated Use wrapPodStore. */
-export declare const wrapBundleStore: typeof wrapPodStore;
-/** @deprecated Use createPodStore. */
-export declare const createBundleStore: typeof createPodStore;
-/** @deprecated Use WrappedPodNoydbStore. */
-export type WrappedBundleNoydbStore = WrappedPodNoydbStore;
-/** @deprecated Use WrapPodStoreOptions. */
-export type WrapBundleStoreOptions = WrapPodStoreOptions;

package/dist/with-pod/{bundle.d.ts → pod.d.ts}

@@ -36,7 +36,7 @@ import { type NoydbPodHeader, type UnlockMethod } from './format.js';
 import type { Redirect } from './redirect.js';
 import type { DocSigner } from '../with-audit/attestation/signer.js';
 import type { Vault } from '../kernel/vault.js';
-import type { BundleRecipient } from '../with-party/team/keyring.js';
+import type { PodRecipient } from '../with-party/team/keyring.js';
 import type { Cover } from '../with-party/directory/cover/types.js';
 import type { SealingKeyProvider, RecipientSealer, RecipientHint } from '../with-party/team/managed-secret.js';
 /**
@@ -128,7 +128,7 @@ export interface WritePodOptions {
      * the bundle inherits the source keyring as-is (today's behaviour,
      * suited to personal backup-and-restore).
      */
-    readonly recipients?: readonly BundleRecipient[];
+    readonly recipients?: readonly PodRecipient[];
     /**
      * Auto-unlock — unsealed per-user credentials.
      *
@@ -266,15 +266,28 @@ export interface WritePodOptions {
      */
     readonly redirect?: Redirect;
 }
-/** @deprecated Use `WritePodOptions`. */
-export type WriteNoydbBundleOptions = WritePodOptions;
+/**
+ * Every key `writePod` reads, in declaration order (#991).
+ *
+ * A pod is a wire artifact, so an option this list doesn't name is refused
+ * rather than ignored: a dropped write option produces a structurally valid
+ * bundle that is missing something, and the defect surfaces later — in
+ * whoever imports it — with nothing left to trace it back to.
+ *
+ * `bundle-option-keys.test.ts` parses `WritePodOptions` out of this file and
+ * fails if the two ever drift, so adding an option is enough; you do not have
+ * to remember to update this list, only to keep the interface shape parseable.
+ *
+ * @internal
+ */
+export declare const WRITE_POD_OPTION_KEYS: readonly ["compression", "collections", "since", "where", "tierAtMost", "exportSecret", "recipients", "autoCredentials", "sealedCredentials", "autoSecrets", "sealedSecrets", "sign", "engineRange", "unlockMethods", "hasApp", "species", "pointerMode", "redirect"];
 /**
  * Result returned by `readPod`. The caller is expected to
  * pass `dumpJson` into `vault.load(json, secret)` to
  * actually restore a vault. Splitting the layers keeps the
  * bundle module free of crypto concerns — see file-level docs.
  */
-export interface NoydbBundleReadResult {
+export interface PodReadResult {
     readonly header: NoydbPodHeader;
     readonly dumpJson: string;
     /**
@@ -302,7 +315,7 @@ export interface NoydbBundleReadResult {
  * auto-unlock paths. Without these the reader behaves exactly as before
  * (header parsed; body returned as `dumpJson`).
  */
-export interface ReadNoydbBundleOptions {
+export interface ReadPodOptions {
     /**
      * Recipient-side sealing providers used to unseal entries from
      * `sealedSecrets`. The reader picks the one whose `.id`
@@ -358,7 +371,7 @@ export declare function resetBrotliSupportCache(): void;
  *
  * Pipeline:
  *   1. Resolve or create the compartment's stable bundle handle
- *      via `vault.getBundleHandle()` — same handle on
+ *      via `vault.getPodHandle()` — same handle on
  *      every export from the same vault instance, so cloud
  *      adapters can use it as a primary key.
  *   2. `vault.dump()` → JSON string with encrypted records
@@ -383,7 +396,7 @@ export declare function resetBrotliSupportCache(): void;
  *
  * @internal
  */
-export declare function assembleBundleContainer(opts: {
+export declare function assemblePodContainer(opts: {
     handle: string;
     bodyJsonStr: string;
     compression: WritePodOptions['compression'];
@@ -398,8 +411,6 @@ export declare function assembleBundleContainer(opts: {
     signer?: DocSigner;
 }): Promise<Uint8Array>;
 export declare function writePod(vault: Vault, opts?: WritePodOptions): Promise<Uint8Array>;
-/** @deprecated Use `writePod`. */
-export declare const writeNoydbBundle: typeof writePod;
 /**
  * Read just the bundle header — no body decompression, no
  * integrity verification. Intended for cloud-listing UIs that want
@@ -415,8 +426,6 @@ export declare const writeNoydbBundle: typeof writePod;
  * range requests against bundles that may carry icons.
  */
 export declare function readPodHeader(bytes: Uint8Array): NoydbPodHeader;
-/** @deprecated Use `readPodHeader`. */
-export declare const readNoydbBundleHeader: typeof readPodHeader;
 /**
  * Outcome of {@link verifyPodHeader}.
  *
@@ -442,7 +451,7 @@ export interface PodVerifyResult {
  * (`keyId → publicKeyB64` the caller already trusts), it reports whether the
  * header was signed by a trusted document signer.
  *
- * Pairs with the signing half in `assembleBundleContainer`/`writePod`: the
+ * Pairs with the signing half in `assemblePodContainer`/`writePod`: the
  * signed payload is the final wire header with `sig` removed, so verification
  * reconstructs it by stripping EXACTLY the `sig` field — `keyId`, `sigAlg`,
  * and every other header field stay in the verified payload.
@@ -454,7 +463,7 @@ export interface PodVerifyResult {
  * header (which includes the *claimed* `bodySha256`) is signed by a trusted
  * key; it does NOT prove the body matches that hash. To trust the pod's
  * BODY you MUST also confirm the body hashes to `header.bodySha256` — call
- * `readPod`, which throws `BundleIntegrityError` on mismatch. A `verified`
+ * `readPod`, which throws `PodIntegrityError` on mismatch. A `verified`
  * header paired with a swapped body is caught only by that integrity check.
  * This function stays body-free by design so a static page can authenticate a
  * header without decompressing the body; composing the two checks is the
@@ -483,7 +492,7 @@ export declare function readPodCover(bytes: Uint8Array, opts?: {
  * the header's `redirect` field or `undefined` if the bundle was written
  * without one.
  *
- * The record is returned UNVERIFIED: `validateBundleHeader` only checks
+ * The record is returned UNVERIFIED: `validatePodHeaderFields` only checks
  * its shape at parse time (a parser has no `trustedKeys`). Callers that
  * intend to follow the redirect MUST separately call `verifyRedirect`
  * (`redirect.js`) before trusting `target`.
@@ -495,7 +504,7 @@ export declare function readPodRedirect(bytes: Uint8Array): Redirect | undefined
  * original `vault.dump()` JSON string ready to pass to
  * `vault.load()`.
  *
- * Throws `BundleIntegrityError` if the body's actual SHA-256 does
+ * Throws `PodIntegrityError` if the body's actual SHA-256 does
  * not match the value declared in the header. Distinct from a
  * format error so consumers can pattern-match in catch blocks
  * (corrupted-in-transit vs malformed-by-producer).
@@ -507,6 +516,4 @@ export declare function readPodRedirect(bytes: Uint8Array): Redirect | undefined
  * free of crypto concerns and lets the same code feed format
  * inspectors that never decrypt anything.
  */
-export declare function readPod(bytes: Uint8Array, opts?: ReadNoydbBundleOptions): Promise<NoydbBundleReadResult>;
-/** @deprecated Use `readPod`. */
-export declare const readNoydbBundle: typeof readPod;
+export declare function readPod(bytes: Uint8Array, opts?: ReadPodOptions): Promise<PodReadResult>;

package/dist/with-pod/ulid.d.ts

@@ -39,7 +39,7 @@
  *
  * If a future use case needs timestamp-free handles, a v2 of the
  * format could specify "use the random portion only" without a
- * format break — `validateBundleHeader` only checks the regex
+ * format break — `validatePodHeaderFields` only checks the regex
  * shape, not the encoded timestamp.
  */
 /**

package/dist/with-shape/introspection/index.d.ts

@@ -14,6 +14,7 @@ export { jsonSchemaToFields } from './fields.js';
 export type { SchemaIntrospection } from './types.js';
 export type { FieldMeta, SemanticType } from './field-meta.js';
 export type { CollectionDescription, DescribedField, DescribeOptions } from './describe.js';
+export type { StandardSchemaV1Issue } from '../../kernel/schema.js';
 export { applyListProjection } from './projection.js';
 export type { ListProjectionOptions } from './projection.js';
 export type { BehaviorSummary, GuardBehaviorEntry, DerivationBehaviorEntry, DerivationOutputEntry, MaterializedViewBehaviorEntry, OverlayBehaviorEntry, SatelliteBehaviorEntry, } from './behaviors.js';

package/dist/with-sync/engine.d.ts

@@ -1,4 +1,5 @@
 import type { NoydbStore, DirtyEntry, ConflictStrategy, CollectionConflictResolver, PushOptions, PullOptions, PushResult, PullResult, SyncStatus, SyncTargetRole } from '../kernel/types.js';
+import type { MergeAuthority } from '../port/with/merge-authority.js';
 import { type PeriodPullSource } from './period-scope.js';
 import type { NoydbEventEmitter } from '../kernel/events.js';
 import type { SyncPolicy } from '../kernel/sync-policy.js';
@@ -12,6 +13,7 @@ export interface ReservedLookupSource {
 }
 /** Sync engine: dirty tracking, push, pull, conflict resolution, scheduling. */
 export declare class SyncEngine {
+    private readonly mergeAuthority;
     private readonly local;
     private readonly remote;
     private readonly strategy;
@@ -24,8 +26,17 @@ export declare class SyncEngine {
      *  into the scheduler below. */
     readonly policy: SyncPolicy | undefined;
     private dirty;
+    /** #1036 — last SUCCESSFUL push/pull. Never advanced by a failed attempt. */
     private lastPush;
     private lastPull;
+    /**
+     * #1036 — the failure that ended the most recent attempt, cleared by the next
+     * success. Live state only: deliberately NOT persisted in `_sync/meta`, since a
+     * reload cannot know whether the target is still failing. It exists so a poller
+     * can separate "never synced" (both null) from "synced a while ago, failing
+     * since" (`lastPush` set, `lastError` set).
+     */
+    private lastError;
     private loaded;
     private autoSyncInterval;
     private isOnline;
@@ -92,6 +103,15 @@ export declare class SyncEngine {
         syncPolicy?: SyncPolicy;
         role?: SyncTargetRole;
         label?: string;
+        /**
+         * #1042 — the merge's verify/re-stamp capability. Optional so an engine
+         * built without one behaves exactly as before; the Vault supplies it.
+         *
+         * A closure, not an import: `with-sync` is DEK-free and
+         * `check:architecture` enforces that, so the capability arrives already
+         * bound to the keys rather than the engine reaching for them.
+         */
+        mergeAuthority?: MergeAuthority;
     });
     /** Start the sync scheduler. Called after vault is fully opened. */
     startScheduler(): void;
@@ -148,6 +168,18 @@ export declare class SyncEngine {
      * are removed from the dirty log on success.
      */
     pushFiltered(predicate: (entry: DirtyEntry) => boolean): Promise<PushResult>;
+    /**
+     * #1036 — close out a push/pull. `push()` and `pull()` collect per-record
+     * failures into their result's `errors` rather than throwing, and the clock used
+     * to be stamped regardless — so an unreachable store still reported a fresh
+     * `lastPush`, and a UI rendered "Last synced: just now" over a sync that moved
+     * nothing. An attempt only advances the clock when it had no errors.
+     *
+     * An empty dirty log is a success, not a failure: nothing to send is not the
+     * same as failing to send, and treating it otherwise would leave a quiet vault
+     * looking permanently unsynced.
+     */
+    private recordOutcome;
     /** Get current sync status. */
     status(): SyncStatus;
     /** Start auto-sync: listen for online/offline events, optional periodic sync. */
@@ -168,11 +200,28 @@ export declare class SyncEngine {
      * the remote's (the same-`_v` push tie), re-stamp it at `remote._v + 1`.
      * Without this the loser's next pull sees no delta (`_v`-based
      * detection) and the peers stay silently diverged at the same version.
-     * `_v` is envelope metadata — AEAD-unbound, and `_vdig` is deliberately
-     * `_v`-independent — so the engine may restamp ciphertext. Callers must
-     * mirror the advanced envelope locally (`applyRemote`) so both sides
-     * agree. The 'merged' branch needs none of this: resolver output is
-     * already stamped `max(local, remote) + 1`.
+     * ## Why this is async, and why it goes through `MergeAuthority` (#1093)
+     *
+     * It used to be `{ ...winner, _v: remote._v + 1 }` — a metadata restamp on
+     * ciphertext the engine cannot decrypt. That spread was the SOLE reason `_v`
+     * could not be bound into the AAD: a version rewritten onto a body sealed at
+     * a different one produces a record no reader can open.
+     *
+     * `with-sync` is DEK-free by design and `check:architecture` enforces it, so
+     * the re-seal cannot happen here. It happens in the injected authority, which
+     * holds the keys. The engine still decides WHICH version to advance to; it
+     * simply no longer pretends it can rewrite a sealed body.
+     *
+     * The authority is ALWAYS present in the product — `kernel/noydb.ts` builds
+     * one from the keyring and passes it at both engine-construction sites, and
+     * `with-sync/active.ts` is the only place an engine is constructed. The
+     * fallback below is reachable only by constructing `SyncEngine` directly,
+     * which tests do. It restamps, as before — and would produce an unreadable
+     * record if such a test ever held AEAD-sealed envelopes. None do; the
+     * fixtures that reach it build their own plaintext ones.
+     *
+     * The 'merged' branch needs none of this: resolver output is already stamped
+     * `max(local, remote) + 1` by whoever built it.
      */
     private advancePastRemote;
     private applyRemote;

package/dist/with-sync/strategy.d.ts

@@ -25,6 +25,7 @@
  * @internal
  */
 import type { NoydbStore, ConflictStrategy, SyncTargetRole } from '../kernel/types.js';
+import type { MergeAuthority } from '../port/with/merge-authority.js';
 import type { NoydbEventEmitter } from '../kernel/events.js';
 import type { SyncPolicy } from '../kernel/sync-policy.js';
 import type { SyncEngine } from './engine.js';
@@ -47,6 +48,8 @@ export interface BuildSyncEngineOptions {
     syncPolicy?: SyncPolicy;
     role?: SyncTargetRole;
     label?: string;
+    /** #1042 — the merge's verify/re-stamp capability, bound to the keys by the caller. */
+    mergeAuthority?: MergeAuthority;
 }
 /**
  * @internal