@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.21

package/dist/{chunk-3FSX6LDG.js → chunk-PPCOKVFA.js}

@@ -1,6 +1,6 @@
 import {
   TierWriteRefusedError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/kernel/tier-visibility.ts
 async function peekLiveTier(adapter, vault, name, id) {
@@ -27,11 +27,16 @@ async function assertCutoverTierSafe(adapter, vault, name, tiersEnabled) {
     }
   }
 }
+function dekKey(collection, tier) {
+  if (tier <= 0) return collection;
+  return `${collection}#${tier}`;
+}
 
 export {
   liveRecordIsElevated,
   liveRecordTier,
   assertTierWritable,
-  assertCutoverTierSafe
+  assertCutoverTierSafe,
+  dekKey
 };
-//# sourceMappingURL=chunk-3FSX6LDG.js.map
+//# sourceMappingURL=chunk-PPCOKVFA.js.map

package/dist/{chunk-3FSX6LDG.js.map → chunk-PPCOKVFA.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/kernel/tier-visibility.ts"],"sourcesContent":["/**\n * Tier visibility helper (#712/#707): a tier-0 code path treats an elevated\n * (_tier > 0) record as invisible. History reads gate on the LIVE record's\n * tier — history snapshots keep their tier-0-wrapped CEKs and carry no _tier\n * of their own, so an elevated record's prior versions would otherwise stay\n * tier-0-decryptable (the read-gate closes the API surface; #712's at-rest\n * arc rewraps the snapshot keys). Envelope inspection only — no decryption.\n *\n * #715/#716: the write ring. Invisibility on the read side is exactly what\n * makes a tier-0 write path treat an elevated record as absent — a put()\n * believes it's a create (demotion) and a delete() writes a marker with no\n * _tier (erasing the elevation signal). `assertTierWritable` closes that by\n * refusing the write outright. Both helpers share a single envelope peek\n * (`peekLiveTier`) — no duplicated `adapter.get` per write.\n */\nimport type { NoydbStore } from './types.js'\nimport { TierWriteRefusedError } from './errors.js'\n\nasync function peekLiveTier(\n  adapter: NoydbStore, vault: string, name: string, id: string,\n): Promise<number> {\n  const env = await adapter.get(vault, name, id)\n  return env?._tier ?? 0\n}\n\nexport async function liveRecordIsElevated(\n  adapter: NoydbStore, vault: string, name: string, id: string,\n): Promise<boolean> {\n  return (await peekLiveTier(adapter, vault, name, id)) > 0\n}\n\n/**\n * The tier a record's LIVE envelope currently carries (0 if untiered or\n * never moved). #724 Task 4: `BlobSet.loadSlots`/`saveSlots` use this to\n * resolve the per-record slot map's collection DEK at the record's current\n * tier by default, so the slot map's physical location follows the record\n * after `rehomeForTier` re-keys it.\n */\nexport async function liveRecordTier(\n  adapter: NoydbStore, vault: string, name: string, id: string,\n): Promise<number> {\n  return peekLiveTier(adapter, vault, name, id)\n}\n\n/**\n * Refuses a tier-0 `put()`/`delete()` targeting an elevated record.\n * No-op when `tiersEnabled` is false (the cost gate — collections that\n * never declare tiers pay nothing). Throws `TierWriteRefusedError` with\n * the record's ACTUAL live tier when elevated — holders included, since\n * `put()`/`delete()` are the tier-0 APIs and `putAtTier`/`elevate`/`demote`\n * are the sanctioned tier-aware paths.\n */\nexport async function assertTierWritable(\n  adapter: NoydbStore, vault: string, name: string, id: string, tiersEnabled: boolean,\n): Promise<void> {\n  if (!tiersEnabled) return\n  const tier = await peekLiveTier(adapter, vault, name, id)\n  if (tier > 0) throw new TierWriteRefusedError(name, tier)\n}\n\n/**\n * #708: ALL-OR-NOTHING pre-check for a coordinated-cutover bulk-rewrite —\n * scans every id's live tier BEFORE any record is transformed and refuses\n * on the first elevated one found. `_applyCutoverTransform` re-encrypts at\n * tier 0 with no gate of its own; without this, it would silently demote\n * an elevated record. Same cost gate as `assertTierWritable` (no-op, no\n * adapter call, when `tiersEnabled` is false).\n *\n * This pre-check guards against an ordinary `put()`/`delete()` racing the\n * cutover, because those go through the schema fence (`SchemaFenceController`\n * blocks concurrent writes during a coordinated cutover). It does NOT guard\n * against `elevate()`/`demote()`/`putAtTier()` — those tier-move paths bypass\n * the fence, so a tier move landing between this scan and the rewrite it\n * gates is not excluded. Cutover callers are expected to hold the vault\n * quiescent for tier moves on this collection for the duration of the call,\n * the same tier-quiescence assumption the documented CAS-less caller\n * (`with-shape/satellites/migrate-cek.ts`'s \"No-quiesce precondition\") makes\n * explicit for concurrent writes generally.\n */\nexport async function assertCutoverTierSafe(\n  adapter: NoydbStore, vault: string, name: string, tiersEnabled: boolean,\n): Promise<void> {\n  if (!tiersEnabled) return\n  for (const id of await adapter.list(vault, name)) {\n    const tier = await peekLiveTier(adapter, vault, name, id)\n    if (tier > 0) {\n      throw new TierWriteRefusedError(name, tier, `Coordinated cutover on collection \"${name}\" refused — record \"${id}\" is elevated to tier ${tier}. Demote it before a coordinated cutover.`)\n    }\n  }\n}\n"],"mappings":";;;;;AAkBA,eAAe,aACb,SAAqB,OAAe,MAAc,IACjC;AACjB,QAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,MAAM,EAAE;AAC7C,SAAO,KAAK,SAAS;AACvB;AAEA,eAAsB,qBACpB,SAAqB,OAAe,MAAc,IAChC;AAClB,SAAQ,MAAM,aAAa,SAAS,OAAO,MAAM,EAAE,IAAK;AAC1D;AASA,eAAsB,eACpB,SAAqB,OAAe,MAAc,IACjC;AACjB,SAAO,aAAa,SAAS,OAAO,MAAM,EAAE;AAC9C;AAUA,eAAsB,mBACpB,SAAqB,OAAe,MAAc,IAAY,cAC/C;AACf,MAAI,CAAC,aAAc;AACnB,QAAM,OAAO,MAAM,aAAa,SAAS,OAAO,MAAM,EAAE;AACxD,MAAI,OAAO,EAAG,OAAM,IAAI,sBAAsB,MAAM,IAAI;AAC1D;AAqBA,eAAsB,sBACpB,SAAqB,OAAe,MAAc,cACnC;AACf,MAAI,CAAC,aAAc;AACnB,aAAW,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI,GAAG;AAChD,UAAM,OAAO,MAAM,aAAa,SAAS,OAAO,MAAM,EAAE;AACxD,QAAI,OAAO,GAAG;AACZ,YAAM,IAAI,sBAAsB,MAAM,MAAM,sCAAsC,IAAI,4BAAuB,EAAE,yBAAyB,IAAI,2CAA2C;AAAA,IACzL;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/kernel/tier-visibility.ts"],"sourcesContent":["/**\n * Tier visibility helper (#712/#707): a tier-0 code path treats an elevated\n * (_tier > 0) record as invisible. History reads gate on the LIVE record's\n * tier — history snapshots keep their tier-0-wrapped CEKs and carry no _tier\n * of their own, so an elevated record's prior versions would otherwise stay\n * tier-0-decryptable (the read-gate closes the API surface; #712's at-rest\n * arc rewraps the snapshot keys). Envelope inspection only — no decryption.\n *\n * #715/#716: the write ring. Invisibility on the read side is exactly what\n * makes a tier-0 write path treat an elevated record as absent — a put()\n * believes it's a create (demotion) and a delete() writes a marker with no\n * _tier (erasing the elevation signal). `assertTierWritable` closes that by\n * refusing the write outright. Both helpers share a single envelope peek\n * (`peekLiveTier`) — no duplicated `adapter.get` per write.\n */\nimport type { NoydbStore } from './types.js'\nimport { TierWriteRefusedError } from './errors.js'\n\nasync function peekLiveTier(\n  adapter: NoydbStore, vault: string, name: string, id: string,\n): Promise<number> {\n  const env = await adapter.get(vault, name, id)\n  return env?._tier ?? 0\n}\n\nexport async function liveRecordIsElevated(\n  adapter: NoydbStore, vault: string, name: string, id: string,\n): Promise<boolean> {\n  return (await peekLiveTier(adapter, vault, name, id)) > 0\n}\n\n/**\n * The tier a record's LIVE envelope currently carries (0 if untiered or\n * never moved). #724 Task 4: `BlobSet.loadSlots`/`saveSlots` use this to\n * resolve the per-record slot map's collection DEK at the record's current\n * tier by default, so the slot map's physical location follows the record\n * after `rehomeForTier` re-keys it.\n */\nexport async function liveRecordTier(\n  adapter: NoydbStore, vault: string, name: string, id: string,\n): Promise<number> {\n  return peekLiveTier(adapter, vault, name, id)\n}\n\n/**\n * Refuses a tier-0 `put()`/`delete()` targeting an elevated record.\n * No-op when `tiersEnabled` is false (the cost gate — collections that\n * never declare tiers pay nothing). Throws `TierWriteRefusedError` with\n * the record's ACTUAL live tier when elevated — holders included, since\n * `put()`/`delete()` are the tier-0 APIs and `putAtTier`/`elevate`/`demote`\n * are the sanctioned tier-aware paths.\n */\nexport async function assertTierWritable(\n  adapter: NoydbStore, vault: string, name: string, id: string, tiersEnabled: boolean,\n): Promise<void> {\n  if (!tiersEnabled) return\n  const tier = await peekLiveTier(adapter, vault, name, id)\n  if (tier > 0) throw new TierWriteRefusedError(name, tier)\n}\n\n/**\n * #708: ALL-OR-NOTHING pre-check for a coordinated-cutover bulk-rewrite —\n * scans every id's live tier BEFORE any record is transformed and refuses\n * on the first elevated one found. `_applyCutoverTransform` re-encrypts at\n * tier 0 with no gate of its own; without this, it would silently demote\n * an elevated record. Same cost gate as `assertTierWritable` (no-op, no\n * adapter call, when `tiersEnabled` is false).\n *\n * This pre-check guards against an ordinary `put()`/`delete()` racing the\n * cutover, because those go through the schema fence (`SchemaFenceController`\n * blocks concurrent writes during a coordinated cutover). It does NOT guard\n * against `elevate()`/`demote()`/`putAtTier()` — those tier-move paths bypass\n * the fence, so a tier move landing between this scan and the rewrite it\n * gates is not excluded. Cutover callers are expected to hold the vault\n * quiescent for tier moves on this collection for the duration of the call,\n * the same tier-quiescence assumption the documented CAS-less caller\n * (`with-shape/satellites/migrate-cek.ts`'s \"No-quiesce precondition\") makes\n * explicit for concurrent writes generally.\n */\nexport async function assertCutoverTierSafe(\n  adapter: NoydbStore, vault: string, name: string, tiersEnabled: boolean,\n): Promise<void> {\n  if (!tiersEnabled) return\n  for (const id of await adapter.list(vault, name)) {\n    const tier = await peekLiveTier(adapter, vault, name, id)\n    if (tier > 0) {\n      throw new TierWriteRefusedError(name, tier, `Coordinated cutover on collection \"${name}\" refused — record \"${id}\" is elevated to tier ${tier}. Demote it before a coordinated cutover.`)\n    }\n  }\n}\n\n/**\n * The key a collection's DEK is stored under in `UnlockedKeyring.deks` for a\n * given tier: `collection` at tier 0, `collection#N` above it.\n *\n * Lives in the kernel because the `deks` map is a kernel type and the kernel\n * reads it — `noydb.ts` needs this to resolve the right DEK when verifying a\n * pulled envelope (#1042). `with-party/team/tiers.ts` re-exports it, so every\n * existing importer is unchanged; the definition simply moved to the layer that\n * owns the map rather than one that happens to use it.\n *\n * This move was forced by `port-layering`, and rightly: the alternative was the\n * kernel spine statically importing a `with-*` service, or duplicating the\n * naming convention in two places where it could drift.\n */\nexport function dekKey(collection: string, tier: number): string {\n  if (tier <= 0) return collection\n  return `${collection}#${tier}`\n}\n"],"mappings":";;;;;AAkBA,eAAe,aACb,SAAqB,OAAe,MAAc,IACjC;AACjB,QAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,MAAM,EAAE;AAC7C,SAAO,KAAK,SAAS;AACvB;AAEA,eAAsB,qBACpB,SAAqB,OAAe,MAAc,IAChC;AAClB,SAAQ,MAAM,aAAa,SAAS,OAAO,MAAM,EAAE,IAAK;AAC1D;AASA,eAAsB,eACpB,SAAqB,OAAe,MAAc,IACjC;AACjB,SAAO,aAAa,SAAS,OAAO,MAAM,EAAE;AAC9C;AAUA,eAAsB,mBACpB,SAAqB,OAAe,MAAc,IAAY,cAC/C;AACf,MAAI,CAAC,aAAc;AACnB,QAAM,OAAO,MAAM,aAAa,SAAS,OAAO,MAAM,EAAE;AACxD,MAAI,OAAO,EAAG,OAAM,IAAI,sBAAsB,MAAM,IAAI;AAC1D;AAqBA,eAAsB,sBACpB,SAAqB,OAAe,MAAc,cACnC;AACf,MAAI,CAAC,aAAc;AACnB,aAAW,MAAM,MAAM,QAAQ,KAAK,OAAO,IAAI,GAAG;AAChD,UAAM,OAAO,MAAM,aAAa,SAAS,OAAO,MAAM,EAAE;AACxD,QAAI,OAAO,GAAG;AACZ,YAAM,IAAI,sBAAsB,MAAM,MAAM,sCAAsC,IAAI,4BAAuB,EAAE,yBAAyB,IAAI,2CAA2C;AAAA,IACzL;AAAA,EACF;AACF;AAgBO,SAAS,OAAO,YAAoB,MAAsB;AAC/D,MAAI,QAAQ,EAAG,QAAO;AACtB,SAAO,GAAG,UAAU,IAAI,IAAI;AAC9B;","names":[]}

package/dist/{chunk-VOQW5LAM.js → chunk-QSIEL6TL.js}

@@ -1,20 +1,20 @@
 import {
   pickLocale
-} from "./chunk-SZ2K3MHL.js";
+} from "./chunk-S56VYR4Q.js";
 import {
   sha256Hex
-} from "./chunk-VCETL77O.js";
+} from "./chunk-AU3AUJIZ.js";
 import {
-  BundleIntegrityError,
-  BundleSealMismatchError,
+  PodIntegrityError,
+  PodSealMismatchError,
   ValidationError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-CWM4GQD2.js";
 
 // src/with-pod/format.ts
-var NOYDB_BUNDLE_MAGIC = new Uint8Array([78, 68, 66, 49]);
-var NOYDB_BUNDLE_PREFIX_BYTES = 10;
-var NOYDB_BUNDLE_FORMAT_VERSION = 1;
-var NOYDB_BUNDLE_FORMAT_VERSION_SIGNED = 2;
+var NOYDB_POD_MAGIC = new Uint8Array([78, 68, 66, 49]);
+var NOYDB_POD_PREFIX_BYTES = 10;
+var NOYDB_POD_FORMAT_VERSION = 1;
+var NOYDB_POD_FORMAT_VERSION_SIGNED = 2;
 var FLAG_COMPRESSED = 1;
 var FLAG_HAS_INTEGRITY_HASH = 2;
 var COMPRESSION_NONE = 0;
@@ -63,7 +63,7 @@ var REDIRECT_REASONS = /* @__PURE__ */ new Set([
   "tombstone",
   "repoint"
 ]);
-function validateBundleHeader(parsed) {
+function validatePodHeaderFields(parsed) {
   if (parsed === null || typeof parsed !== "object") {
     throw new Error(
       `.noydb bundle header must be a JSON object, got ${parsed === null ? "null" : typeof parsed}`
@@ -77,9 +77,9 @@ function validateBundleHeader(parsed) {
     }
   }
   const h = parsed;
-  if (typeof h["formatVersion"] !== "number" || h["formatVersion"] !== NOYDB_BUNDLE_FORMAT_VERSION && h["formatVersion"] !== NOYDB_BUNDLE_FORMAT_VERSION_SIGNED) {
+  if (typeof h["formatVersion"] !== "number" || h["formatVersion"] !== NOYDB_POD_FORMAT_VERSION && h["formatVersion"] !== NOYDB_POD_FORMAT_VERSION_SIGNED) {
     throw new Error(
-      `.noydb bundle header.formatVersion must be ${NOYDB_BUNDLE_FORMAT_VERSION} or ${NOYDB_BUNDLE_FORMAT_VERSION_SIGNED}, got ${String(h["formatVersion"])}. The reader does not support forward-compat versions; upgrade the reader to handle newer bundles.`
+      `.noydb bundle header.formatVersion must be ${NOYDB_POD_FORMAT_VERSION} or ${NOYDB_POD_FORMAT_VERSION_SIGNED}, got ${String(h["formatVersion"])}. The reader does not support forward-compat versions; upgrade the reader to handle newer bundles.`
     );
   }
   if (typeof h["handle"] !== "string" || !/^[0-9A-HJKMNP-TV-Z]{26}$/.test(h["handle"])) {
@@ -264,14 +264,14 @@ function validateBundleHeader(parsed) {
       `.noydb bundle header.sig, .keyId, and .sigAlg must be present together or not at all (got ${sigFieldsPresent} of 3).`
     );
   }
-  if (sigFieldsPresent === 3 && h["formatVersion"] !== NOYDB_BUNDLE_FORMAT_VERSION_SIGNED) {
+  if (sigFieldsPresent === 3 && h["formatVersion"] !== NOYDB_POD_FORMAT_VERSION_SIGNED) {
     throw new Error(
-      `.noydb bundle header with sig/keyId/sigAlg must have formatVersion === ${NOYDB_BUNDLE_FORMAT_VERSION_SIGNED}, got ${String(h["formatVersion"])}.`
+      `.noydb bundle header with sig/keyId/sigAlg must have formatVersion === ${NOYDB_POD_FORMAT_VERSION_SIGNED}, got ${String(h["formatVersion"])}.`
     );
   }
 }
-function encodeBundleHeader(header) {
-  validateBundleHeader(header);
+function encodePodHeader(header) {
+  validatePodHeaderFields(header);
   const json = JSON.stringify({
     formatVersion: header.formatVersion,
     handle: header.handle,
@@ -297,7 +297,7 @@ function encodeBundleHeader(header) {
   });
   return new TextEncoder().encode(json);
 }
-function decodeBundleHeader(bytes) {
+function decodePodHeader(bytes) {
   const json = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
   let parsed;
   try {
@@ -307,7 +307,7 @@ function decodeBundleHeader(bytes) {
       `.noydb bundle header is not valid JSON: ${err.message}`
     );
   }
-  validateBundleHeader(parsed);
+  validatePodHeaderFields(parsed);
   return parsed;
 }
 function readUint32BE(bytes, offset) {
@@ -319,10 +319,10 @@ function writeUint32BE(bytes, offset, value) {
   bytes[offset + 2] = value >>> 8 & 255;
   bytes[offset + 3] = value & 255;
 }
-function hasNoydbBundleMagic(bytes) {
-  if (bytes.length < NOYDB_BUNDLE_MAGIC.length) return false;
-  for (let i = 0; i < NOYDB_BUNDLE_MAGIC.length; i++) {
-    if (bytes[i] !== NOYDB_BUNDLE_MAGIC[i]) return false;
+function hasNoydbPodMagic(bytes) {
+  if (bytes.length < NOYDB_POD_MAGIC.length) return false;
+  for (let i = 0; i < NOYDB_POD_MAGIC.length; i++) {
+    if (bytes[i] !== NOYDB_POD_MAGIC[i]) return false;
   }
   return true;
 }
@@ -340,7 +340,42 @@ async function verifyRecord(publicKeyB64, sig, payload) {
   return ed25519Verify(publicKeyB64, sig, signedBytes(payload));
 }
 
-// src/with-pod/bundle.ts
+// src/with-pod/pod.ts
+var WRITE_POD_OPTION_KEYS = [
+  "compression",
+  "collections",
+  "since",
+  "where",
+  "tierAtMost",
+  "exportSecret",
+  "recipients",
+  "autoCredentials",
+  "sealedCredentials",
+  "autoSecrets",
+  "sealedSecrets",
+  "sign",
+  "engineRange",
+  "unlockMethods",
+  "hasApp",
+  "species",
+  "pointerMode",
+  "redirect"
+];
+var RETIRED_WRITE_POD_OPTIONS = {
+  autoPassphrases: "autoCredentials",
+  sealedPassphrases: "sealedCredentials",
+  exportPassphrase: "exportSecret"
+};
+function assertKnownWritePodOptions(opts) {
+  const known = new Set(WRITE_POD_OPTION_KEYS);
+  for (const [key, value] of Object.entries(opts)) {
+    if (value === void 0 || known.has(key)) continue;
+    const replacement = RETIRED_WRITE_POD_OPTIONS[key];
+    throw new Error(
+      replacement !== void 0 ? `writePod: \`${key}\` was renamed to \`${replacement}\`. Passing the old key would have written a pod without that slot \u2014 see the 0.4.0-pre migration note.` : `writePod: unknown option \`${key}\`. Options are not ignored \u2014 a dropped write option produces a pod that is silently missing something. Known keys: ${WRITE_POD_OPTION_KEYS.join(", ")}.`
+    );
+  }
+}
 function toAutoCredentials(m) {
   return Object.fromEntries(
     Object.entries(m).map(([u, value]) => [u, { kind: "secret", value }])
@@ -527,30 +562,30 @@ function parseAutoUnlockBody(bodyString) {
   try {
     parsed = JSON.parse(bodyString);
   } catch (err) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       "header declared autoUnlock but body could not be parsed as JSON wrapper: " + (err instanceof Error ? err.message : String(err))
     );
   }
   if (typeof parsed !== "object" || parsed === null) {
-    throw new BundleIntegrityError("autoUnlock body is not a JSON object");
+    throw new PodIntegrityError("autoUnlock body is not a JSON object");
   }
   const obj = parsed;
   if (obj["_noydb_bundle_body"] !== 1) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       "autoUnlock body missing `_noydb_bundle_body: 1` discriminator"
     );
   }
   if (typeof obj["dump"] !== "string") {
-    throw new BundleIntegrityError("autoUnlock body must carry a string `dump` field");
+    throw new PodIntegrityError("autoUnlock body must carry a string `dump` field");
   }
   const blob = obj["_autoUnlock"];
   if (typeof blob !== "object" || blob === null) {
-    throw new BundleIntegrityError("autoUnlock body missing `_autoUnlock` blob");
+    throw new PodIntegrityError("autoUnlock body missing `_autoUnlock` blob");
   }
   const blobObj = blob;
   const kind = blobObj["kind"];
   if (kind !== "unsealed" && kind !== "sealed") {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       `autoUnlock blob has invalid kind ${String(kind)}; expected 'unsealed' or 'sealed'`
     );
   }
@@ -567,29 +602,29 @@ function parseExtractedPartitionBody(bodyString) {
   try {
     parsed = JSON.parse(bodyString);
   } catch (err) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       "header declared extracted-partition but body could not be parsed as JSON wrapper: " + (err instanceof Error ? err.message : String(err))
     );
   }
   if (typeof parsed !== "object" || parsed === null) {
-    throw new BundleIntegrityError("extracted-partition body is not a JSON object");
+    throw new PodIntegrityError("extracted-partition body is not a JSON object");
   }
   const obj = parsed;
   if (obj["_noydb_bundle_body"] !== 1) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       "extracted-partition body missing `_noydb_bundle_body: 1` discriminator"
     );
   }
   if (typeof obj["dump"] !== "string") {
-    throw new BundleIntegrityError("extracted-partition body must carry a string `dump` field");
+    throw new PodIntegrityError("extracted-partition body must carry a string `dump` field");
   }
   const seal = obj["_transferSeal"];
   if (typeof seal !== "object" || seal === null) {
-    throw new BundleIntegrityError("extracted-partition body missing `_transferSeal` blob");
+    throw new PodIntegrityError("extracted-partition body missing `_transferSeal` blob");
   }
   const s = seal;
   if (s["v"] !== 1 || s["alg"] !== "aes-256-gcm-pre-shared" || typeof s["sealId"] !== "string" || typeof s["payload"] !== "string") {
-    throw new BundleIntegrityError("extracted-partition `_transferSeal` blob is malformed");
+    throw new PodIntegrityError("extracted-partition `_transferSeal` blob is malformed");
   }
   return { dump: obj["dump"], seal };
 }
@@ -635,7 +670,7 @@ async function resolveAutoUnlock(blob, opts) {
             unsealedMap[userId] = { kind: credKind, value: entry.sealed };
             continue;
           }
-          throw new BundleSealMismatchError(userId, entry.pid);
+          throw new PodSealMismatchError(userId, entry.pid);
         }
         unsealedMap[userId] = { kind: credKind, value: opened };
         continue;
@@ -644,7 +679,7 @@ async function resolveAutoUnlock(blob, opts) {
         unsealedMap[userId] = { kind: credKind, value: entry.sealed };
         continue;
       }
-      throw new BundleSealMismatchError(userId, entry.pid);
+      throw new PodSealMismatchError(userId, entry.pid);
     }
     const plaintextBytes = await provider.unseal(base64ToBytes(entry.sealed));
     unsealedMap[userId] = { kind: credKind, value: decoder.decode(plaintextBytes) };
@@ -777,7 +812,7 @@ async function applySatelliteLivenessFilter(vault, dumpJson) {
   if (!backup.collections || typeof backup.collections !== "object") return dumpJson;
   if (typeof vault._introspectState !== "function") return dumpJson;
   const { adapter, name, getDEK } = vault._introspectState();
-  const { liveBaseIdSetsForBundle } = await import("./dead-filter-ENRIOQIE.js");
+  const { liveBaseIdSetsForBundle } = await import("./dead-filter-UALP5DJX.js");
   const satLive = await liveBaseIdSetsForBundle(adapter, name, Object.keys(backup.collections), getDEK);
   if (satLive.size === 0) return dumpJson;
   const next = {};
@@ -817,7 +852,8 @@ async function applyPlaintextFilters(vault, dumpJson, opts) {
       if (where !== void 0) {
         const record = await vault._decryptEnvelopeForBundleFilter(
           env,
-          collName
+          collName,
+          id
         );
         const ok = await where(record, { collection: collName, id });
         if (!ok) continue;
@@ -829,13 +865,13 @@ async function applyPlaintextFilters(vault, dumpJson, opts) {
   backup.collections = next;
   return JSON.stringify(backup);
 }
-async function assembleBundleContainer(opts) {
+async function assemblePodContainer(opts) {
   const dumpBytes = new TextEncoder().encode(opts.bodyJsonStr);
   const { format, streamFormat } = selectCompression(opts.compression);
   const body = streamFormat === null ? dumpBytes : await pumpThroughStream(dumpBytes, new CompressionStream(streamFormat));
   const bodySha256 = await sha256Hex2(body);
   const header = {
-    formatVersion: NOYDB_BUNDLE_FORMAT_VERSION,
+    formatVersion: NOYDB_POD_FORMAT_VERSION,
     handle: opts.handle,
     bodyBytes: body.length,
     bodySha256,
@@ -851,19 +887,20 @@ async function assembleBundleContainer(opts) {
     ...opts.headerExtras?.redirect !== void 0 ? { redirect: opts.headerExtras.redirect } : {}
   };
   const signed = opts.signer === void 0 ? header : await (async (s) => {
-    const toSign = { ...header, formatVersion: NOYDB_BUNDLE_FORMAT_VERSION_SIGNED, keyId: s.keyId, sigAlg: "ed25519" };
+    const toSign = { ...header, formatVersion: NOYDB_POD_FORMAT_VERSION_SIGNED, keyId: s.keyId, sigAlg: "ed25519" };
     const sig = await signRecord(s.privateKeyPkcs8B64, toSign);
     return { ...toSign, sig };
   })(opts.signer);
-  const headerBytes = encodeBundleHeader(signed);
-  const prefix = new Uint8Array(NOYDB_BUNDLE_PREFIX_BYTES);
-  prefix.set(NOYDB_BUNDLE_MAGIC, 0);
+  const headerBytes = encodePodHeader(signed);
+  const prefix = new Uint8Array(NOYDB_POD_PREFIX_BYTES);
+  prefix.set(NOYDB_POD_MAGIC, 0);
   prefix[4] = (streamFormat === null ? 0 : FLAG_COMPRESSED) | FLAG_HAS_INTEGRITY_HASH;
   prefix[5] = format;
   writeUint32BE(prefix, 6, headerBytes.length);
   return concatBytes([prefix, headerBytes, body]);
 }
 async function writePod(vault, opts = {}) {
+  assertKnownWritePodOptions(opts);
   if (opts.exportSecret !== void 0 && opts.recipients !== void 0) {
     throw new Error(
       "writePod: pass either exportSecret or recipients, not both"
@@ -871,7 +908,7 @@ async function writePod(vault, opts = {}) {
   }
   const normalizedAutoUnlock = normalizeAutoUnlock(opts);
   const autoUnlockMode = validateAutoUnlockOptions(opts, normalizedAutoUnlock);
-  const handle = await vault.getBundleHandle();
+  const handle = await vault.getPodHandle();
   const dumpJson = await vault.dump();
   const satelliteFiltered = await applySatelliteLivenessFilter(vault, dumpJson);
   const rekeyed = await applyRecipientRewrap(vault, satelliteFiltered, opts);
@@ -880,7 +917,7 @@ async function writePod(vault, opts = {}) {
   const bodyJsonStr = normalizedAutoUnlock === null ? filtered : JSON.stringify(await buildAutoUnlockWrapper(filtered, normalizedAutoUnlock));
   const cover = await vault.getCover();
   const signer = opts.sign === false ? void 0 : opts.sign !== void 0 ? opts.sign : await vault._loadPodSigner() ?? void 0;
-  return assembleBundleContainer({
+  return assemblePodContainer({
     handle,
     bodyJsonStr,
     compression: opts.compression,
@@ -899,16 +936,15 @@ async function writePod(vault, opts = {}) {
     ...signer !== void 0 ? { signer } : {}
   });
 }
-var writeNoydbBundle = writePod;
 function parsePrefixAndHeader(bytes) {
-  if (!hasNoydbBundleMagic(bytes)) {
+  if (!hasNoydbPodMagic(bytes)) {
     throw new Error(
       `Not a .noydb bundle: missing 'NDB1' magic prefix. The first 4 bytes are ${[...bytes.slice(0, 4)].map((b) => b.toString(16).padStart(2, "0")).join(" ")}.`
     );
   }
-  if (bytes.length < NOYDB_BUNDLE_PREFIX_BYTES) {
+  if (bytes.length < NOYDB_POD_PREFIX_BYTES) {
     throw new Error(
-      `Truncated .noydb bundle: file is only ${bytes.length} bytes, which is less than the ${NOYDB_BUNDLE_PREFIX_BYTES}-byte fixed prefix.`
+      `Truncated .noydb bundle: file is only ${bytes.length} bytes, which is less than the ${NOYDB_POD_PREFIX_BYTES}-byte fixed prefix.`
     );
   }
   const flags = bytes[4];
@@ -919,20 +955,19 @@ function parsePrefixAndHeader(bytes) {
     );
   }
   const headerLength = readUint32BE(bytes, 6);
-  const bodyOffset = NOYDB_BUNDLE_PREFIX_BYTES + headerLength;
+  const bodyOffset = NOYDB_POD_PREFIX_BYTES + headerLength;
   if (bodyOffset > bytes.length) {
     throw new Error(
       `Truncated .noydb bundle: declared header length ${headerLength} would extend past end of file (${bytes.length} bytes).`
     );
   }
-  const headerBytes = bytes.slice(NOYDB_BUNDLE_PREFIX_BYTES, bodyOffset);
-  const header = decodeBundleHeader(headerBytes);
+  const headerBytes = bytes.slice(NOYDB_POD_PREFIX_BYTES, bodyOffset);
+  const header = decodePodHeader(headerBytes);
   return { header, bodyOffset, algo, flags };
 }
 function readPodHeader(bytes) {
   return parsePrefixAndHeader(bytes).header;
 }
-var readNoydbBundleHeader = readPodHeader;
 async function verifyPodHeader(bytes, trustedKeys) {
   const { header } = parsePrefixAndHeader(bytes);
   if (header.sig === void 0 || header.keyId === void 0 || header.sigAlg === void 0) {
@@ -965,13 +1000,13 @@ async function readPod(bytes, opts = {}) {
   const { header, bodyOffset, algo } = parsePrefixAndHeader(bytes);
   const body = bytes.slice(bodyOffset);
   if (body.length !== header.bodyBytes) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       `body length ${body.length} does not match header.bodyBytes ${header.bodyBytes}. The bundle was truncated or padded between write and read.`
     );
   }
   const actualSha = await sha256Hex2(body);
   if (actualSha !== header.bodySha256) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       `body sha256 ${actualSha} does not match header.bodySha256 ${header.bodySha256}. The bundle bytes were modified between write and read \u2014 refuse to decompress.`
     );
   }
@@ -983,7 +1018,7 @@ async function readPod(bytes, opts = {}) {
     try {
       dumpBytes = await pumpThroughStream(body, new DecompressionStream(streamFormat));
     } catch (err) {
-      throw new BundleIntegrityError(
+      throw new PodIntegrityError(
         `decompression failed: ${err.message}. The bundle passed the integrity hash but the body is not valid ${streamFormat} data \u2014 likely a producer bug.`
       );
     }
@@ -996,20 +1031,19 @@ async function readPod(bytes, opts = {}) {
   const autoUnlock = await resolveAutoUnlock(blob, opts);
   return { header, dumpJson: dump, autoUnlock };
 }
-var readNoydbBundle = readPod;
 
 export {
-  NOYDB_BUNDLE_MAGIC,
-  NOYDB_BUNDLE_PREFIX_BYTES,
-  NOYDB_BUNDLE_FORMAT_VERSION,
+  NOYDB_POD_MAGIC,
+  NOYDB_POD_PREFIX_BYTES,
+  NOYDB_POD_FORMAT_VERSION,
   FLAG_COMPRESSED,
   FLAG_HAS_INTEGRITY_HASH,
   COMPRESSION_NONE,
   COMPRESSION_GZIP,
   COMPRESSION_BROTLI,
-  validateBundleHeader,
-  encodeBundleHeader,
-  hasNoydbBundleMagic,
+  validatePodHeaderFields,
+  encodePodHeader,
+  hasNoydbPodMagic,
   POD_SIG_ALG,
   signedBytes,
   signRecord,
@@ -1017,15 +1051,12 @@ export {
   buildExtractedPartitionWrapper,
   parseExtractedPartitionBody,
   resetBrotliSupportCache,
-  assembleBundleContainer,
+  assemblePodContainer,
   writePod,
-  writeNoydbBundle,
   readPodHeader,
-  readNoydbBundleHeader,
   verifyPodHeader,
   readPodCover,
   readPodRedirect,
-  readPod,
-  readNoydbBundle
+  readPod
 };
-//# sourceMappingURL=chunk-VOQW5LAM.js.map
+//# sourceMappingURL=chunk-QSIEL6TL.js.map