@noy-db/hub 0.6.0-pre.8 → 0.6.0

package/dist/chunk-GANFIM2M.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-formula/materialized-views/dependency-analyzer.ts","../src/with-formula/materialized-views/query-hash.ts","../src/with-formula/materialized-views/projection-legs.ts","../src/with-formula/materialized-views/registry.ts"],"sourcesContent":["import type { Query, QueryPlan } from '../../kernel/query/builder.js'\nimport type { JoinContext } from '../../kernel/query/join.js'\nimport type { MaterializedViewSpec } from './types.js'\n\n/**\n * Walks a `Query<T>` plan and returns the set of source collection\n * names that any source-write should trigger a refresh on.\n *\n * Handles:\n *   - root collection (the one the query was built from)\n *   - FK join targets (`.join(field, { as })`)\n *\n * Also handles:\n *   - cross-join targets (`.crossJoin(target, { as })`) — v3\n *\n * Deferred:\n *   - `.wherePredicate(name)` — v2 predicate primitive\n *   - Overlay-name expansion to {base, overlay}\n *\n * The set is materialized at MV registration time. The MV registry\n * uses it to (a) dispatch `onSourceWrite` only to MVs that actually\n * care, and (b) contribute edges to the shared cycle-detection graph.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport function analyzeDependencies(query: Query<any>): Set<string> {\n  const deps = new Set<string>()\n  const plan = query._plan()\n  const ctx = query._joinContext()\n\n  // The root collection is always a dependency.\n  if (ctx?.leftCollection) {\n    deps.add(ctx.leftCollection)\n  }\n\n  // FK join targets contribute additional sources.\n  for (const leg of plan.joins) {\n    deps.add(leg.target)\n  }\n\n  // Cross-join targets are also dependency sources — writes to either side\n  // must trigger MV refresh. Symmetric with FK-join target handling above.\n  for (const clause of plan.clauses) {\n    if (clause.type === 'crossJoin') {\n      deps.add(clause.target)\n    }\n  }\n\n  // Sub-plans inside OR clauses can carry nested joins. Walk them.\n  // (Today only top-level `.join()` populates `plan.joins`, but the\n  // OR-group machinery permits sub-plans, so we recurse defensively.)\n  walkClausesForJoins(plan, deps, ctx)\n\n  return deps\n}\n\nfunction walkClausesForJoins(\n  plan: QueryPlan,\n  deps: Set<string>,\n  ctx: JoinContext | undefined,\n): void {\n  void ctx\n  // Today `plan.joins` carries all join legs at top level. Sub-plans\n  // inside OR groups don't currently support nested joins, so the loop\n  // below is a no-op safety net for future builder extensions.\n  for (const clause of plan.clauses) {\n    if (clause.type === 'group') {\n      // Group clauses don't (yet) carry their own joins; this is a\n      // forward-compat anchor for when OR-groups support nested\n      // sources.\n    }\n  }\n}\n\n/**\n * Convenience: produce a stable string summary of the query plan\n * suitable for `queryHash` derivation. Captures everything the\n * dependency analyzer reads + the where/orderBy/limit/offset\n * structure that affects materialized rows.\n *\n * `joinContext` is intentionally NOT included — the join-resolution\n * function references would defeat hash determinism. The set of join\n * TARGETS (collection names) IS included via the plan.joins legs.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport function summarizeQueryPlan(query: Query<any>): string {\n  const plan = query._plan()\n  const ctx = query._joinContext()\n  return JSON.stringify({\n    root: ctx?.leftCollection ?? null,\n    clauses: plan.clauses.map(c => {\n      if (c.type === 'crossJoin') {\n        return {\n          type: 'crossJoin',\n          target: c.target,\n          as: c.as,\n          // Inline on: callback: use sentinel — drift detection disabled for this MV\n          onPredicateName: c.onPredicateName ?? (c.on ? '[inline]' : null),\n          maxRows: c.maxRows ?? null,\n          // `outer` changes the row set, so it is part of the plan's identity\n          // for drift detection, not decoration (#1130).\n          outer: c.outer ?? false,\n        }\n      }\n      return c\n    }),\n    orderBy: plan.orderBy,\n    limit: plan.limit ?? null,\n    offset: plan.offset,\n    joins: plan.joins.map(j => ({ field: j.field, as: j.as, target: j.target, mode: j.mode })),\n  })\n}\n\n/**\n * Canonical string description of a UNION MV's plan, used as input to\n * `computeQueryHash`.\n *\n * Asymmetry note:\n *   - Arm collection names are NOT sorted. Declaration order is\n *     semantically meaningful for the dedup-only UNION path —\n *     `materializeUnionResult` iterates `spec.unionSources` in\n *     declaration order and keeps the first-seen row per composite key\n *     (tie-break precedence). If we sorted arms here, a consumer who\n *     reordered `unionSources` to change precedence would compute the\n *     same `queryHash`, refresh would be a no-op, and stale MV rows\n *     would persist. Hashing in declaration order makes any reorder\n *     trigger a refresh.\n *   - `groupBy` fields ARE sorted. Multi-key groupBy buckets are\n *     commutative (`canonicalGroupKey` produces the same composite key\n *     regardless of field order in the input spec).\n *   - `aggregate` keys ARE sorted. Reducer-spec keys are independent\n *     of each other — order of declaration doesn't change output.\n *\n * Per-arm `map` functions are NOT fingerprinted; consumers must bump\n * the MV's `name` (or rely on application-level cache busting) when\n * `map` semantics change non-equivalently.\n */\nexport function summarizeUnionPlan<T extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<T>,\n): string {\n  return `union(${summarizeUnionArms(spec)})${summarizeGroupingTail(spec)}`\n}\n\n/**\n * Canonical string description of a projection MV's plan (#810), used\n * as input to `computeQueryHash`.\n *\n * Leg descriptors ARE sorted (contrast with UNION arm order): every\n * leg attaches under a distinct `as` alias, forward legs are\n * one-to-one attachments and collect legs are independent\n * hash-grouped passes, so declaration order never changes the\n * materialized rows — a pure reorder must NOT force a refresh.\n * `from` (#1140) constrains the legal orderings (a leg must follow the\n * alias it attaches to) without making order meaningful: each descriptor\n * carries its own `@alias`, and aliases are unique, so the sorted set\n * still determines the leg graph exactly.\n *\n * The projection `map` is NOT fingerprinted (identical limitation as\n * the UNION arm `map`); consumers must bump the MV's `name` when\n * `map` semantics change non-equivalently.\n */\nexport function summarizeProjectionPlan<T extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<T>,\n): string {\n  const projection = spec.projection!\n  const legs = projection.joins\n    .map(leg => {\n      // #1140 — `from` changes which rows a leg attaches to, so it is part of\n      // the plan's identity. Omitting it would let two structurally different\n      // projections share a queryHash and silently skip a refresh.\n      const at = leg.from !== undefined ? `@${leg.from}` : ''\n      return 'collect' in leg\n        ? `collect${at}:${leg.collect}.${leg.on}→${leg.as}`\n        : `field${at}:${leg.field}→${leg.as}`\n    })\n    .sort()\n  const body = JSON.stringify({ source: projection.source, legs })\n  return `projection(${body})${summarizeGroupingTail(spec)}`\n}\n\n/** Arm descriptors for `summarizeUnionPlan` — declaration order preserved (see its doc). */\nfunction summarizeUnionArms<T extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<T>,\n): string {\n  return (spec.unionSources ?? [])\n    .map(s => {\n      // Fold each arm's join legs into the summary so adding or\n      // reordering joins (which changes the materialized rows) bumps\n      // queryHash. Leg order is declaration-significant (legs chain), so\n      // it is NOT sorted — same rationale as arm declaration order.\n      const joins = s.join?.length\n        ? `[${s.join.map(j => `${j.field}→${j.as}`).join(';')}]`\n        : ''\n      return `${s.collection}${joins}`\n    })\n    .join(',')\n}\n\n/**\n * Shared `|groupBy(…)|aggregate(…)|money(…)` tail for the UNION and\n * projection summaries — both feed the same post-map grouping pipeline,\n * so the same spec fields fold into both hashes with the same rules.\n */\nfunction summarizeGroupingTail<T extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<T>,\n): string {\n  const groupBy: string = Array.isArray(spec.groupBy)\n    ? [...spec.groupBy].sort().join(',')\n    : typeof spec.groupBy === 'string'\n      ? spec.groupBy\n      : ''\n  const aggKeys = spec.aggregate ? Object.keys(spec.aggregate).sort().join(',') : ''\n  // `moneyFields` changes reducer semantics (float → exact BigInt), so\n  // declaring / removing / re-keying it must bump queryHash. Keys are\n  // sorted — they're independent of each other (one descriptor per\n  // output field), same rationale as aggregate keys.\n  const moneyKeys = spec.moneyFields ? Object.keys(spec.moneyFields).sort().join(',') : ''\n  return `|groupBy(${groupBy})|aggregate(${aggKeys})|money(${moneyKeys})`\n}\n","/**\n * Deterministic hash of a materialized view strategy's \"shape\": MV\n * name + canonical query-plan summary + sorted dependency-set.\n *\n * Used to detect strategy drift: a row whose `_materializedFrom.queryHash`\n * doesn't match the current strategy is considered stale.\n *\n * Web Crypto SHA-256 — no extra deps. Mirrors the v1\n * `computeStrategyHash` pattern.\n */\nimport { sha256Hex } from '../../kernel/enclave/index.js'\n\nexport async function computeQueryHash(\n  mvName: string,\n  /**\n   * Source-collection set the query depends on. Sorted before\n   * canonicalization so set iteration order doesn't affect the hash.\n   */\n  dependencies: ReadonlySet<string>,\n  /**\n   * Stringified query-plan summary. The caller produces this from the\n   * `Query<T>` builder — concretely: a JSON serialization of clauses +\n   * orderBy + limit + offset + joins. Function bodies inside\n   * `wherePredicate` are NOT included here (those carry their own\n   * `predicateHash` to be folded in by a later sub-issue).\n   */\n  queryPlanSummary: string,\n): Promise<string> {\n  const canonical = JSON.stringify({\n    mvName,\n    dependencies: [...dependencies].sort(),\n    queryPlanSummary,\n  })\n  const bytes = new TextEncoder().encode(canonical)\n  return sha256Hex(bytes)\n}\n\n/**\n * Canonicalize a query plan for hashing. Walks the plan structure\n * with sorted keys so insertion order doesn't perturb the result.\n * Lives here rather than in `query/builder.ts` to keep that module\n * stable across MV-specific evolutions.\n *\n * @internal exported for testing\n */\nexport function canonicalizeQueryPlan(plan: unknown): string {\n  return JSON.stringify(plan, (_key, value) => {\n    if (value && typeof value === 'object' && !Array.isArray(value)) {\n      const sorted: Record<string, unknown> = {}\n      for (const k of Object.keys(value as Record<string, unknown>).sort()) {\n        sorted[k] = (value as Record<string, unknown>)[k]\n      }\n      return sorted\n    }\n    return value\n  })\n}\n","/**\n * Projection-leg topology (#810, extended by #1140).\n *\n * A projection MV's legs originally all attached to the PRIMARY row: a forward\n * leg named an FK field on `projection.source`, and a reverse `collect` leg's\n * `on` field had to `ref()` the source itself. Anything two FKs away was\n * therefore inexpressible — `bill → entity → client` has no leg shape, because\n * the bill has no `clientId` and `clients.entityId` refs `entities`, not\n * `bills`.\n *\n * `from` closes that: a leg may attach to a previously-declared ALIAS instead of\n * to the primary row. This module owns the two questions that follow from it —\n * *is this leg graph well-formed?* and *which collection does a leg's rows come\n * from?* — so neither the registry nor the executor has to re-derive them.\n *\n * **Why cycles are impossible by construction, and there is no depth cap.**\n * `from` may only name an alias declared EARLIER in `joins`. A leg can therefore\n * never reach forward, the graph is a forest rooted at the primary row, and its\n * depth is bounded by the number of legs. Validation refuses an unknown or\n * not-yet-declared alias, which is the same check.\n */\n\nimport { MaterializedViewConfigError } from '../../kernel/errors.js'\nimport type { ProjectionJoinLeg, ProjectionSpec } from './types.js'\n\n/** Reverse (one-to-many) leg — discriminated on `collect`, as the type is. */\nexport function isCollectLeg(\n  leg: ProjectionJoinLeg,\n): leg is Extract<ProjectionJoinLeg, { collect: string }> {\n  return 'collect' in leg\n}\n\n/**\n * Refuse a malformed leg graph where `withMaterializedView()` checks the rest of\n * the leg shape — at spec CONSTRUCTION, not at vault open and not at first\n * materialization. Alias wiring is pure configuration: it needs no refs, no\n * records and no store, so the earliest failure is the best one.\n * (Ref EXISTENCE still resolves at first materialization, unchanged — refs\n * cannot exist until after `openVault()` returns.)\n */\nexport function validateProjectionLegs<T extends Record<string, unknown>>(\n  mvName: string,\n  projection: ProjectionSpec<T>,\n): void {\n  // Non-empty and unique `as` are already refused by `withMaterializedView()`\n  // itself, earlier and with its own message — not re-checked here. This\n  // function owns the `from` wiring and nothing else.\n  const seen = new Map<string, ProjectionJoinLeg>()\n  for (const leg of projection.joins) {\n    if (leg.from !== undefined) {\n      const parent = seen.get(leg.from)\n      if (!parent) {\n        throw new MaterializedViewConfigError(\n          `\"${mvName}\": projection leg \"${leg.as}\" declares from: \"${leg.from}\", which is not an ` +\n            `alias declared EARLIER in \\`joins\\`. A leg may only attach to the primary row or to a ` +\n            `preceding leg — that ordering rule is what makes a cycle impossible. Known so far: ` +\n            `${[...seen.keys()].map(a => `\"${a}\"`).join(', ') || '(none)'}`,\n        )\n      }\n      if (isCollectLeg(parent)) {\n        throw new MaterializedViewConfigError(\n          `\"${mvName}\": projection leg \"${leg.as}\" declares from: \"${leg.from}\", but \"${leg.from}\" ` +\n            `is a collect leg and holds an ARRAY of rows, not one record. A leg can only hang off a ` +\n            `forward leg (record | null). Attach it to the primary row instead, or collect the ` +\n            `far side directly if its ref() reaches \"${projection.source}\".`,\n        )\n      }\n    }\n    seen.set(leg.as, leg)\n  }\n}\n\n/**\n * The collection a leg's rows come from — the primary source for a root leg, the\n * `from` leg's own target otherwise.\n *\n * Returns `null` when a forward `ref()` somewhere along the chain is not\n * declared yet, which at registration time is the normal case rather than an\n * error: refs are declared after `openVault()` returns, so the registry retries\n * this on every dispatch until it resolves (`_pendingForwardDeps`).\n *\n * `resolveRef` is passed in rather than imported so this module stays free of\n * vault wiring — the registry hands it the ref registry's `getOutbound`, the\n * executor hands it a join context lookup. Both answer the same question.\n */\nexport type RefLookup = (collection: string, field: string) => { target: string } | null\n\nexport function resolveLegOwner(\n  leg: ProjectionJoinLeg,\n  joins: ReadonlyArray<ProjectionJoinLeg>,\n  source: string,\n  resolveRef: RefLookup,\n): string | null {\n  if (leg.from === undefined) return source\n  const parent = joins.find(l => l.as === leg.from)\n  if (!parent) return null // refused by validateProjectionLegs; defensive here\n  if (isCollectLeg(parent)) return parent.collect // refused too, same reason\n  const parentOwner = resolveLegOwner(parent, joins, source, resolveRef)\n  if (parentOwner === null) return null\n  return resolveRef(parentOwner, parent.field)?.target ?? null\n}\n\n/**\n * The collection a FORWARD leg resolves INTO — i.e. its dependency. `null` while\n * any ref in the chain (including this leg's own) is still undeclared.\n */\nexport function resolveForwardLegTarget(\n  leg: Extract<ProjectionJoinLeg, { field: string }>,\n  joins: ReadonlyArray<ProjectionJoinLeg>,\n  source: string,\n  resolveRef: RefLookup,\n): string | null {\n  const owner = resolveLegOwner(leg, joins, source, resolveRef)\n  if (owner === null) return null\n  return resolveRef(owner, leg.field)?.target ?? null\n}\n","import { MaterializedViewSourceUnknownError, RefNotDeclaredError } from '../../kernel/errors.js'\nimport type { ViaGraph, FieldRef, EdgeKind, Grain } from '../../kernel/via/graph.js'\nimport type { Clause, FieldClause } from '../../kernel/query/predicate.js'\nimport type { DeclaredPredicate } from '../../kernel/query/builder.js'\nimport { analyzeDependencies, summarizeQueryPlan, summarizeUnionPlan, summarizeProjectionPlan } from './dependency-analyzer.js'\nimport { computeQueryHash } from './query-hash.js'\nimport { isCollectLeg, resolveForwardLegTarget } from './projection-legs.js'\nimport type { MaterializedViewSpec, MVQueryContext } from './types.js'\n\n/**\n * Whole-record artifact-grain field marker (#638 Task 2) — MUST match\n * `derivations/registry.ts`'s and `vault.ts`'s overlay-edge marker so\n * cross-registry edges (a derivation feeding an MV, or vice versa) resolve\n * to the SAME graph node. See that file's `WHOLE_RECORD` doc comment.\n */\nconst WHOLE_RECORD = '*'\n\n/**\n * One registered MV strategy alongside its derived metadata. Stored\n * type-erased on `TRow` so the registry can hold heterogeneous MVs.\n */\nexport interface RegisteredMV {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  readonly spec: MaterializedViewSpec<any>\n  /** Output collection name (`spec.output?.collection ?? spec.name`). */\n  readonly outputCollection: string\n  /** Set of source collections; populated at registration via the analyzer. */\n  readonly dependencies: ReadonlySet<string>\n  /** Canonical `queryHash` — `_materializedFrom.queryHash` for every emitted row. */\n  readonly queryHash: string\n  /**\n   * Top-level FieldClauses on the partition field, captured at\n   * registration time. Used by the cycle detector to resolve\n   * same-collection-as-source edges via the partition-discriminator\n   * check. Empty when `spec.output?.partition` is undefined.\n   */\n  readonly partitionClauses: readonly FieldClause[]\n  /**\n   * #638 Task 2 — `'record'` for a row-per-source-row Query<T> or\n   * `unionSources` MV, `'aggregate'` for a `.groupBy().aggregate()` MV\n   * (the shape that requires explicit `sources`, since the dependency\n   * analyzer can't walk an aggregate plan). Feeds `edges()`'s grain.\n   */\n  readonly grain: Grain\n}\n\n/**\n * Vault-internal registry of MV strategies. Owned by `Vault`; not\n * exported. Parallel to v1's `DerivationRegistry`; the two graphs share\n * a single cycle-detection pass at vault open (see `validate`).\n *\n * @internal\n */\nexport class MaterializedViewRegistry {\n  /** Keyed by `spec.name`. */\n  private readonly _byName = new Map<string, RegisteredMV>()\n  /** Keyed by dependency source-collection → MVs that depend on it. */\n  private readonly _bySource = new Map<string, RegisteredMV[]>()\n  /**\n   * Projection MVs (#810) whose forward-leg ref() targets could not be\n   * resolved at registration time. A forward leg names only the FK\n   * FIELD; its dependency is the field's ref() TARGET, declared on the\n   * source collection — but registration runs at vault open, BEFORE\n   * user code declares collections (and their refs). Constructing the\n   * source collection here to look them up would be worse: a later\n   * `vault.collection(source, { refs })` call only registers refs on a\n   * cache miss, so an early construction would silently drop them.\n   * Instead each entry carries a non-constructive ref-registry probe;\n   * `mvsForSource` retries on every dispatch until every forward\n   * target has resolved (see `_resolvePendingForwardDeps`).\n   */\n  private readonly _pendingForwardDeps: Array<{\n    reg: RegisteredMV\n    /** Forward-leg ALIASES still awaiting resolution (#1140 — a leg is identified\n     *  by its alias, not its field: with `from`, two legs may name the same FK\n     *  field on different collections). */\n    aliases: Set<string>\n    resolveTarget: (alias: string) => string | null\n  }> = []\n\n  /**\n   * Query-form strategies whose `query()` callback could not be planned at\n   * registration time because a `.join()` names a field whose `ref()` is not\n   * declared YET (#1139).\n   *\n   * Registration runs inside `openVault()`; a collection's refs can only be\n   * declared afterwards, so for a query-form MV that joins a declared FK there\n   * is NO call ordering the consumer can choose — the plan is simply built too\n   * early. Rather than failing the vault open, the strategy is parked here and\n   * replanned from {@link resolvePendingPlans}, which every write dispatch and\n   * `vault.refreshView()` call runs first. This is the query-form counterpart\n   * of `_pendingForwardDeps`, one level up: that defers a leg's TARGET, this\n   * defers the whole plan.\n   *\n   * Only `RefNotDeclaredError` parks a strategy. Every other planning failure\n   * still throws out of `openVault()` exactly as before, so a typo'd source or\n   * a malformed spec keeps its loud, early error.\n   *\n   * A parked strategy is invisible until it resolves: it contributes no\n   * `_bySource` entries and no cycle-detection edges (same caveat as a\n   * late-resolved forward target — `edges()` runs once at vault open). It also\n   * cannot be dispatched, which is why {@link hasPendingPlans} forces the\n   * conservative branch in `Collection._txAtomicSafe`: the atomic write path\n   * skips MV dispatch, and skipping it here would mean the write that was\n   * supposed to trigger the first replan is the one that gets missed.\n   */\n  private readonly _pendingPlans: Array<{\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    spec: MaterializedViewSpec<any>\n    db: MVQueryContext\n    options?: { knownCollections?: (name: string) => boolean }\n  }> = []\n\n  /**\n   * Register an MV. Invokes `spec.query()` once at registration time to\n   * read the plan + join context; the resulting `Query<T>` is discarded\n   * after dependency extraction. `vault.collection(...)` must therefore\n   * be functional by the time this runs — typically wired from\n   * `Vault._initMaterializedViews` after collection bootstrap.\n   *\n   * Throws `MaterializedViewSourceUnknownError` if the analyzer\n   * surfaces a dependency the vault doesn't know about (when a\n   * `knownCollections` checker is supplied).\n   */\n  async register(\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    spec: MaterializedViewSpec<any>,\n    db: MVQueryContext,\n    options?: { knownCollections?: (name: string) => boolean },\n  ): Promise<void> {\n    // Build a predicate-aware db wrapper. If `spec.predicates` is\n    // declared, the wrapper intercepts `.collection().query()` and\n    // attaches the predicates map to the resulting Query<T>. With no\n    // predicates declared, the wrapper is the original db unchanged.\n    const dbForQuery = spec.predicates ? wrapDbWithPredicates(db, spec.predicates) : db\n\n    // Invoke the query callback once to inspect its plan / dependencies.\n    // For Query<T> shapes the analyzer extracts deps + plan summary\n    // automatically. Reduction / GroupedReduction shapes don't\n    // expose the underlying Query, so the spec must declare `sources`\n    // explicitly. `partitionClauses` are only populated for Query<T>\n    // since same-collection-partition is a non-aggregate concern.\n    // UNION-form strategies: dependencies and plan summary come\n    // straight off the strategy — no `query` callback to introspect.\n    // The dependency-analyzer + summarizer are bypassed entirely; the\n    // executor handles materialization via `materializeUnionResult`.\n    let dependencies: Set<string>\n    let queryPlanSummary: string\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    let qAny: any = null\n    let isQuery = false\n    // Projection-form (#810): forward legs whose ref() target wasn't\n    // resolvable at registration time — folded in lazily, see\n    // `_pendingForwardDeps`.\n    const pendingForwardFields: string[] = []\n    if (spec.unionSources) {\n      dependencies = new Set(spec.unionSources.map(s => s.collection))\n      // Per-arm joins resolve right-side collections that aren't among\n      // the arm `collection`s. The consumer lists those in `sources`;\n      // fold them into the dependency set so a write to a join-target\n      // collection triggers MV refresh (and contributes a cycle edge).\n      if (spec.sources) for (const s of spec.sources) dependencies.add(s)\n      queryPlanSummary = summarizeUnionPlan(spec)\n    } else if (spec.projection) {\n      // Projection-form (#810): dependencies are all AUTO — the primary\n      // source, every collect leg's collection (both literal names), and\n      // every forward leg's ref() target. Forward targets usually can't\n      // resolve yet (refs are declared after vault open) — those go\n      // through the pending-resolution path below. Explicit `sources`\n      // remains additive, same as the other two forms.\n      const projection = spec.projection\n      dependencies = new Set([projection.source])\n      for (const leg of projection.joins) {\n        // A collect leg's dependency is its literal collection name, whatever it\n        // attaches to — which is why `from` needs no new dependency machinery on\n        // that side. A forward leg's dependency is a ref() target, still unknown.\n        if (isCollectLeg(leg)) dependencies.add(leg.collect)\n        else pendingForwardFields.push(leg.as)\n      }\n      if (spec.sources) for (const s of spec.sources) dependencies.add(s)\n      queryPlanSummary = summarizeProjectionPlan(spec)\n    } else {\n      // eslint-disable-next-line @typescript-eslint/no-explicit-any\n      let q: any\n      try {\n        q = spec.query!(dbForQuery)\n      } catch (e) {\n        // #1139 — a join on a ref that is not declared YET. Park and replan;\n        // see `_pendingPlans`. Anything else is a real registration failure.\n        if (!(e instanceof RefNotDeclaredError)) throw e\n        this._pendingPlans.push({ spec, db, ...(options !== undefined ? { options } : {}) })\n        return\n      }\n      qAny = q // already `any` — see the declaration above\n      isQuery = typeof qAny._plan === 'function'\n      if (isQuery) {\n        // `q` is the `Query` arm of the union here (runtime-confirmed via\n        // `qAny._plan` above); reuse the already-`any` `qAny` the block uses\n        // for `_plan()` rather than re-narrowing.\n        dependencies = analyzeDependencies(qAny)\n        queryPlanSummary = summarizeQueryPlan(qAny)\n        // Fold `.wherePredicate(name, ctx)` references into the plan\n        // summary so predicate function or ctx changes (signalled by\n        // bumping `hash` or supplying a different ctx) propagate into\n        // `queryHash` and force refresh on next visit.\n        const predicateRefs = extractPredicateRefs(qAny._plan())\n        if (predicateRefs.length > 0) {\n          queryPlanSummary = JSON.stringify({ plan: queryPlanSummary, predicates: predicateRefs })\n        }\n        // If `sources` is ALSO declared, take the union (consumer's\n        // explicit list extends the auto-analyzed set).\n        if (spec.sources) for (const s of spec.sources) dependencies.add(s)\n      } else {\n        // Aggregate shape: require explicit `sources`.\n        if (!spec.sources || spec.sources.length === 0) {\n          throw new Error(\n            `withMaterializedView \"${spec.name}\": query() returned an aggregate ` +\n              `(Reduction or GroupedReduction) but no \\`sources\\` field is declared. ` +\n              `The dependency analyzer cannot walk through groupBy().aggregate() ` +\n              `back to the source — declare sources: [...] explicitly.`,\n          )\n        }\n        dependencies = new Set(spec.sources)\n        // Aggregate plans don't carry a chainable query plan for summary\n        // purposes; the dep-set + spec.name serve as the queryHash inputs.\n        queryPlanSummary = JSON.stringify({ aggregate: true, sources: [...spec.sources].sort() })\n      }\n    }\n\n    // Sanity-check declared dependencies against the vault's known\n    // collections. Optional — when the checker isn't supplied (test\n    // wiring, in-process composition) the registration succeeds and\n    // any typo surfaces at first onSourceWrite as a no-op.\n    if (options?.knownCollections) {\n      for (const dep of dependencies) {\n        if (!options.knownCollections(dep)) {\n          throw new MaterializedViewSourceUnknownError(spec.name, dep)\n        }\n      }\n    }\n\n    const outputCollection = spec.output?.collection ?? spec.name\n    const queryHash = await computeQueryHash(spec.name, dependencies, queryPlanSummary)\n    // For same-collection-as-source MVs, capture the where-clauses on\n    // the partition field so cycle detection can prove disjointness.\n    // Only applicable to Query<T> shapes — aggregate MVs don't carry\n    // a chainable plan to inspect (and same-collection aggregation\n    // doesn't make sense for same-collection aggregation).\n    const partitionClauses: FieldClause[] = []\n    const partitionField = spec.output?.partition?.field\n    if (partitionField !== undefined && isQuery) {\n      const plan = qAny._plan()\n      for (const clause of plan.clauses) {\n        if (isFieldClauseOnField(clause, partitionField)) partitionClauses.push(clause)\n      }\n    }\n    // #638 Task 2 — 'aggregate' only for the explicit-sources aggregate shape\n    // (groupBy().aggregate() with no chainable plan); a row-per-source-row\n    // Query<T>, unionSources, or projection MV is 'record'.\n    const grain: Grain = spec.unionSources || spec.projection || isQuery ? 'record' : 'aggregate'\n    const reg: RegisteredMV = { spec, outputCollection, dependencies, queryHash, partitionClauses, grain }\n\n    this._byName.set(spec.name, reg)\n    for (const dep of dependencies) {\n      const arr = this._bySource.get(dep)\n      if (arr) arr.push(reg)\n      else this._bySource.set(dep, [reg])\n    }\n    if (pendingForwardFields.length > 0) {\n      // Non-constructive ref-registry probe: the Vault (the real\n      // MVQueryContext) carries its RefRegistry as a private field,\n      // reachable structurally at runtime. Test stubs without one simply\n      // never resolve — forward deps then come only from explicit `sources`.\n      const refRegistry = (db as unknown as {\n        refRegistry?: { getOutbound(collection: string): Record<string, { target: string }> }\n      }).refRegistry\n      const projectionSpec = spec.projection!\n      const resolveRef = (c: string, f: string): { target: string } | null =>\n        refRegistry?.getOutbound(c)[f] ?? null\n      this._pendingForwardDeps.push({\n        reg,\n        aliases: new Set(pendingForwardFields),\n        resolveTarget: (alias) => {\n          const leg = projectionSpec.joins.find(l => l.as === alias)\n          if (!leg || isCollectLeg(leg)) return null\n          // Walks the `from` chain — every hop needs its own ref declared, so a\n          // two-hop leg simply resolves one dispatch later than a one-hop one.\n          return resolveForwardLegTarget(leg, projectionSpec.joins, projectionSpec.source, resolveRef)\n        },\n      })\n      // Immediate attempt — covers refs already declared by the time\n      // this MV registers (re-registration flows, test wiring).\n      this._resolvePendingForwardDeps()\n    }\n  }\n\n  /**\n   * `true` while any query-form strategy is still unplanned (#1139). Read by\n   * `Collection._txAtomicSafe`, which must refuse the atomic write path while\n   * this holds — see the `_pendingPlans` doc comment for why.\n   */\n  hasPendingPlans(): boolean {\n    return this._pendingPlans.length > 0\n  }\n\n  /**\n   * Replan every parked query-form strategy (#1139). Called at the head of both\n   * write dispatchers and of `vault.refreshView()`, so a strategy resolves on the\n   * first write or refresh after its source collection's refs are declared —\n   * which is the earliest moment it could produce a correct plan, and strictly\n   * before the first moment it could have any output to produce.\n   *\n   * Each entry is handed straight back to {@link register}, so a strategy that\n   * is STILL unplannable simply re-parks itself and the next dispatch tries\n   * again. Idempotent and cheap: the array empties as strategies resolve, and\n   * both callers skip the await entirely once it is empty.\n   *\n   * A late-resolved strategy does NOT retro-feed `edges()` — the unified cycle\n   * pass runs once at vault open, before refs exist. Same caveat, and the same\n   * reason, as a late-resolved forward-leg target.\n   */\n  async resolvePendingPlans(): Promise<void> {\n    if (this._pendingPlans.length === 0) return\n    // Splice first: `register` re-parks anything still unplannable, and reading\n    // a live array it is concurrently pushing to would loop.\n    const parked = this._pendingPlans.splice(0)\n    for (const entry of parked) {\n      await this.register(entry.spec, entry.db, entry.options)\n    }\n  }\n\n  /** All MVs that depend on `source`, in registration order. */\n  mvsForSource(source: string): ReadonlyArray<RegisteredMV> {\n    if (this._pendingForwardDeps.length > 0) this._resolvePendingForwardDeps()\n    return this._bySource.get(source) ?? []\n  }\n\n  /**\n   * Retry ref() resolution for every pending projection forward leg\n   * (#810). A field resolves once its source collection's refs have\n   * been declared; the target then folds into the owning MV's\n   * dependency set and `_bySource`, so subsequent writes to it\n   * dispatch a refresh. Idempotent and cheap — the pending list\n   * empties as fields resolve, and `mvsForSource` skips the call\n   * entirely once it's empty.\n   *\n   * Late-resolved targets do NOT retro-feed `edges()` — the cycle\n   * pass runs once at vault open, before refs exist. A cycle routed\n   * exclusively through a forward leg is therefore not detected at\n   * open (collect + source edges, the literal names, are).\n   */\n  private _resolvePendingForwardDeps(): void {\n    for (let i = this._pendingForwardDeps.length - 1; i >= 0; i--) {\n      const entry = this._pendingForwardDeps[i]!\n      for (const alias of [...entry.aliases]) {\n        const target = entry.resolveTarget(alias)\n        if (target === null) continue\n        entry.aliases.delete(alias)\n        if (entry.reg.dependencies.has(target)) continue\n        // `dependencies` is declared ReadonlySet for consumers; the\n        // registry owns the underlying Set and is the one writer.\n        ;(entry.reg.dependencies as Set<string>).add(target)\n        const arr = this._bySource.get(target)\n        if (arr) arr.push(entry.reg)\n        else this._bySource.set(target, [entry.reg])\n      }\n      if (entry.aliases.size === 0) this._pendingForwardDeps.splice(i, 1)\n    }\n  }\n\n  /** Single MV by name, or `undefined`. */\n  byName(name: string): RegisteredMV | undefined {\n    return this._byName.get(name)\n  }\n\n  /** Iterate over every registered MV. */\n  all(): ReadonlyArray<RegisteredMV> {\n    return [...this._byName.values()]\n  }\n\n  /**\n   * Graph edges for #638 Task 2: one `'mv'` edge per registered MV — target\n   * = the output collection (a `WHOLE_RECORD` artifact node), sources =\n   * every dependency (also `WHOLE_RECORD` nodes). Same-collection edges\n   * (`dep === outputCollection`) are skipped IFF the MV declares an\n   * `output.partition` discriminator AND the query has a where-clause that\n   * provably excludes the partition value (`partitionDisjoint`) — the SAME\n   * condition the old local DFS used. Grain comes from the registration-time\n   * `RegisteredMV.grain`.\n   */\n  edges(): ReadonlyArray<{ readonly target: FieldRef; readonly sources: readonly FieldRef[]; readonly kind: EdgeKind; readonly grain: Grain }> {\n    const out: Array<{ target: FieldRef; sources: FieldRef[]; kind: EdgeKind; grain: Grain }> = []\n    for (const reg of this._byName.values()) {\n      const sources: FieldRef[] = []\n      for (const dep of reg.dependencies) {\n        if (dep === reg.outputCollection && partitionDisjoint(reg)) continue\n        sources.push({ collection: dep, field: WHOLE_RECORD })\n      }\n      if (sources.length === 0) continue\n      out.push({ target: { collection: reg.outputCollection, field: WHOLE_RECORD }, sources, kind: 'mv', grain: reg.grain })\n    }\n    return out\n  }\n\n  /**\n   * Cycle detection, delegated to `ViaGraph.assertAcyclic()` (#638 Task 2 —\n   * retires the local DFS). `graph` is the caller's shared per-vault graph,\n   * ALREADY carrying this registry's `edges()` AND `DerivationRegistry`'s\n   * (registered by the caller — see `Vault._initMaterializedViews`, which\n   * runs after `_initDerivations`, so a pure-derivation cycle already threw\n   * `DerivationCycleError` there; any cycle surfacing here necessarily\n   * touches an MV edge). Throws `MaterializedViewCycleError` — SAME class as\n   * before.\n   */\n  validate(graph: ViaGraph): void {\n    graph.assertAcyclic()\n  }\n}\n\n/**\n * Type guard: is the clause a top-level `FieldClause` on the given\n * field? Used by the partition-disjoint check.\n *\n * @internal\n */\nfunction isFieldClauseOnField(clause: Clause, field: string): clause is FieldClause {\n  return clause.type === 'field' && clause.field === field\n}\n\n/**\n * Wrap an `MVQueryContext` so its `.collection().query()` returns a\n * Query<T> with the MV's declared predicates attached. Bare Queries\n * (outside of any MV) don't gain `.wherePredicate()` — only Queries\n * obtained through this wrapped db do.\n *\n * @internal\n */\nexport function wrapDbWithPredicates(\n  db: MVQueryContext,\n  predicates: NonNullable<MaterializedViewSpec<Record<string, unknown>>['predicates']>,\n): MVQueryContext {\n  // Build the predicate map once — the fn signature in the MV spec\n  // is row-typed but the QueryBuilder casts to unknown, so we widen\n  // here for the Map.\n  const map = new Map<string, DeclaredPredicate>()\n  for (const [name, decl] of Object.entries(predicates)) {\n    map.set(name, {\n      hash: decl.hash,\n      fn: decl.fn as (record: unknown, ctx?: unknown) => boolean,\n    })\n  }\n  return {\n    // eslint-disable-next-line @typescript-eslint/no-explicit-any\n    collection<T extends Record<string, unknown>>(name: string): any {\n      const c = db.collection<T>(name)\n      // Return an object that delegates everything to `c` but\n      // overrides `.query()` to attach predicates via the new\n      // `Query._withPredicates()` accessor.\n      return new Proxy(c, {\n        get(target, prop, receiver) {\n          if (prop === 'query') {\n            return (...args: unknown[]) => {\n              // eslint-disable-next-line @typescript-eslint/no-explicit-any\n              const q = (target.query as any)(...args)\n              // For non-aggregate Query<T>, attach predicates. For\n              // legacy predicate-arg overload that returns T[] (sync\n              // filter), pass through unchanged.\n               \n              if (q && typeof q._withPredicates === 'function') {\n                return q._withPredicates(map)\n              }\n              return q\n            }\n          }\n          return Reflect.get(target, prop, receiver)\n        },\n      })\n    },\n  }\n}\n\n/**\n * Walk a QueryPlan's clauses and collect predicate-reference markers\n * for `queryHash` derivation. Returns a sorted array (deterministic\n * order) of `{ name, predicateHash, ctxHash }` tuples — these are the\n * hashable identity of each `.wherePredicate()` call site.\n *\n * @internal\n */\nfunction extractPredicateRefs(\n  plan: { clauses: readonly Clause[] },\n): Array<{ name: string; predicateHash: string; ctxHash: string }> {\n  const refs: Array<{ name: string; predicateHash: string; ctxHash: string }> = []\n  const walk = (clauses: readonly Clause[]): void => {\n    for (const c of clauses) {\n      if (c.type === 'wherePredicate') {\n        refs.push({ name: c.name, predicateHash: c.predicateHash, ctxHash: c.ctxHash })\n      } else if (c.type === 'group') {\n        walk(c.clauses)\n      }\n    }\n  }\n  walk(plan.clauses)\n  // Stable-sort by (name, predicateHash, ctxHash) — same predicate\n  // appearing twice with different ctx hashes both flow through.\n  refs.sort((a, b) => {\n    if (a.name !== b.name) return a.name < b.name ? -1 : 1\n    if (a.predicateHash !== b.predicateHash) return a.predicateHash < b.predicateHash ? -1 : 1\n    return a.ctxHash < b.ctxHash ? -1 : a.ctxHash > b.ctxHash ? 1 : 0\n  })\n  return refs\n}\n\n/**\n * Provability check for the same-collection partition-discriminator.\n * Returns `true` when\n * the captured partition clauses on the MV's query provably exclude\n * the partition's value — meaning the input filter and the output\n * partition are disjoint and the same-collection edge isn't really a\n * cycle.\n *\n * Supported provability shapes (narrow on purpose — DERIV-PP30-001\n * is the load-bearing case):\n *\n * - `.where(field, '==', X)` where X !== partition.value → disjoint\n * - `.where(field, '!=', partition.value)` → disjoint\n * - `.where(field, 'in', [...])` where partition.value NOT in list → disjoint\n *\n * Anything else (no clause on the partition field, an 'in' list that\n * contains partition.value, unsupported operators) → not disjoint,\n * the cycle detector surfaces `MaterializedViewCycleError`.\n *\n * @internal\n */\nfunction partitionDisjoint(reg: RegisteredMV): boolean {\n  const partition = reg.spec.output?.partition\n  if (partition === undefined) return false\n  const value = partition.value\n  // The OR-semantics of multiple where-clauses on the same field\n  // would muddy this check. v2 only treats AND-chained clauses;\n  // any clause that proves disjoint is sufficient.\n  for (const c of reg.partitionClauses) {\n    if (c.op === '==' && c.value !== value) return true\n    if (c.op === '!=' && c.value === value) return true\n    if (c.op === 'in' && Array.isArray(c.value)) {\n      const list = c.value as readonly unknown[]\n      if (!list.includes(value)) return true\n    }\n  }\n  return false\n}\n"],"mappings":";;;;;;;;;;AAwBO,SAAS,oBAAoB,OAAgC;AAClE,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,OAAO,MAAM,MAAM;AACzB,QAAM,MAAM,MAAM,aAAa;AAG/B,MAAI,KAAK,gBAAgB;AACvB,SAAK,IAAI,IAAI,cAAc;AAAA,EAC7B;AAGA,aAAW,OAAO,KAAK,OAAO;AAC5B,SAAK,IAAI,IAAI,MAAM;AAAA,EACrB;AAIA,aAAW,UAAU,KAAK,SAAS;AACjC,QAAI,OAAO,SAAS,aAAa;AAC/B,WAAK,IAAI,OAAO,MAAM;AAAA,IACxB;AAAA,EACF;AAKA,sBAAoB,MAAM,MAAM,GAAG;AAEnC,SAAO;AACT;AAEA,SAAS,oBACP,MACA,MACA,KACM;AACN,OAAK;AAIL,aAAW,UAAU,KAAK,SAAS;AACjC,QAAI,OAAO,SAAS,SAAS;AAAA,IAI7B;AAAA,EACF;AACF;AAaO,SAAS,mBAAmB,OAA2B;AAC5D,QAAM,OAAO,MAAM,MAAM;AACzB,QAAM,MAAM,MAAM,aAAa;AAC/B,SAAO,KAAK,UAAU;AAAA,IACpB,MAAM,KAAK,kBAAkB;AAAA,IAC7B,SAAS,KAAK,QAAQ,IAAI,OAAK;AAC7B,UAAI,EAAE,SAAS,aAAa;AAC1B,eAAO;AAAA,UACL,MAAM;AAAA,UACN,QAAQ,EAAE;AAAA,UACV,IAAI,EAAE;AAAA;AAAA,UAEN,iBAAiB,EAAE,oBAAoB,EAAE,KAAK,aAAa;AAAA,UAC3D,SAAS,EAAE,WAAW;AAAA;AAAA;AAAA,UAGtB,OAAO,EAAE,SAAS;AAAA,QACpB;AAAA,MACF;AACA,aAAO;AAAA,IACT,CAAC;AAAA,IACD,SAAS,KAAK;AAAA,IACd,OAAO,KAAK,SAAS;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK,MAAM,IAAI,QAAM,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,IAAI,QAAQ,EAAE,QAAQ,MAAM,EAAE,KAAK,EAAE;AAAA,EAC3F,CAAC;AACH;AA0BO,SAAS,mBACd,MACQ;AACR,SAAO,SAAS,mBAAmB,IAAI,CAAC,IAAI,sBAAsB,IAAI,CAAC;AACzE;AAoBO,SAAS,wBACd,MACQ;AACR,QAAM,aAAa,KAAK;AACxB,QAAM,OAAO,WAAW,MACrB,IAAI,SAAO;AAIV,UAAM,KAAK,IAAI,SAAS,SAAY,IAAI,IAAI,IAAI,KAAK;AACrD,WAAO,aAAa,MAChB,UAAU,EAAE,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,SAAI,IAAI,EAAE,KAC/C,QAAQ,EAAE,IAAI,IAAI,KAAK,SAAI,IAAI,EAAE;AAAA,EACvC,CAAC,EACA,KAAK;AACR,QAAM,OAAO,KAAK,UAAU,EAAE,QAAQ,WAAW,QAAQ,KAAK,CAAC;AAC/D,SAAO,cAAc,IAAI,IAAI,sBAAsB,IAAI,CAAC;AAC1D;AAGA,SAAS,mBACP,MACQ;AACR,UAAQ,KAAK,gBAAgB,CAAC,GAC3B,IAAI,OAAK;AAKR,UAAM,QAAQ,EAAE,MAAM,SAClB,IAAI,EAAE,KAAK,IAAI,OAAK,GAAG,EAAE,KAAK,SAAI,EAAE,EAAE,EAAE,EAAE,KAAK,GAAG,CAAC,MACnD;AACJ,WAAO,GAAG,EAAE,UAAU,GAAG,KAAK;AAAA,EAChC,CAAC,EACA,KAAK,GAAG;AACb;AAOA,SAAS,sBACP,MACQ;AACR,QAAM,UAAkB,MAAM,QAAQ,KAAK,OAAO,IAC9C,CAAC,GAAG,KAAK,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,IACjC,OAAO,KAAK,YAAY,WACtB,KAAK,UACL;AACN,QAAM,UAAU,KAAK,YAAY,OAAO,KAAK,KAAK,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI;AAKhF,QAAM,YAAY,KAAK,cAAc,OAAO,KAAK,KAAK,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI;AACtF,SAAO,YAAY,OAAO,eAAe,OAAO,WAAW,SAAS;AACtE;;;AC7MA,eAAsB,iBACpB,QAKA,cAQA,kBACiB;AACjB,QAAM,YAAY,KAAK,UAAU;AAAA,IAC/B;AAAA,IACA,cAAc,CAAC,GAAG,YAAY,EAAE,KAAK;AAAA,IACrC;AAAA,EACF,CAAC;AACD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,SAAS;AAChD,SAAO,UAAU,KAAK;AACxB;AAUO,SAAS,sBAAsB,MAAuB;AAC3D,SAAO,KAAK,UAAU,MAAM,CAAC,MAAM,UAAU;AAC3C,QAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AAC/D,YAAM,SAAkC,CAAC;AACzC,iBAAW,KAAK,OAAO,KAAK,KAAgC,EAAE,KAAK,GAAG;AACpE,eAAO,CAAC,IAAK,MAAkC,CAAC;AAAA,MAClD;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,CAAC;AACH;;;AC9BO,SAAS,aACd,KACwD;AACxD,SAAO,aAAa;AACtB;AAUO,SAAS,uBACd,QACA,YACM;AAIN,QAAM,OAAO,oBAAI,IAA+B;AAChD,aAAW,OAAO,WAAW,OAAO;AAClC,QAAI,IAAI,SAAS,QAAW;AAC1B,YAAM,SAAS,KAAK,IAAI,IAAI,IAAI;AAChC,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI;AAAA,UACR,IAAI,MAAM,sBAAsB,IAAI,EAAE,qBAAqB,IAAI,IAAI,oMAG9D,CAAC,GAAG,KAAK,KAAK,CAAC,EAAE,IAAI,OAAK,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,KAAK,QAAQ;AAAA,QACjE;AAAA,MACF;AACA,UAAI,aAAa,MAAM,GAAG;AACxB,cAAM,IAAI;AAAA,UACR,IAAI,MAAM,sBAAsB,IAAI,EAAE,qBAAqB,IAAI,IAAI,WAAW,IAAI,IAAI,sNAGzC,WAAW,MAAM;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AACA,SAAK,IAAI,IAAI,IAAI,GAAG;AAAA,EACtB;AACF;AAiBO,SAAS,gBACd,KACA,OACA,QACA,YACe;AACf,MAAI,IAAI,SAAS,OAAW,QAAO;AACnC,QAAM,SAAS,MAAM,KAAK,OAAK,EAAE,OAAO,IAAI,IAAI;AAChD,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,aAAa,MAAM,EAAG,QAAO,OAAO;AACxC,QAAM,cAAc,gBAAgB,QAAQ,OAAO,QAAQ,UAAU;AACrE,MAAI,gBAAgB,KAAM,QAAO;AACjC,SAAO,WAAW,aAAa,OAAO,KAAK,GAAG,UAAU;AAC1D;AAMO,SAAS,wBACd,KACA,OACA,QACA,YACe;AACf,QAAM,QAAQ,gBAAgB,KAAK,OAAO,QAAQ,UAAU;AAC5D,MAAI,UAAU,KAAM,QAAO;AAC3B,SAAO,WAAW,OAAO,IAAI,KAAK,GAAG,UAAU;AACjD;;;ACpGA,IAAM,eAAe;AAsCd,IAAM,2BAAN,MAA+B;AAAA;AAAA,EAEnB,UAAU,oBAAI,IAA0B;AAAA;AAAA,EAExC,YAAY,oBAAI,IAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAc5C,sBAOZ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BW,gBAKZ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaN,MAAM,SAEJ,MACA,IACA,SACe;AAKf,UAAM,aAAa,KAAK,aAAa,qBAAqB,IAAI,KAAK,UAAU,IAAI;AAYjF,QAAI;AACJ,QAAI;AAEJ,QAAI,OAAY;AAChB,QAAI,UAAU;AAId,UAAM,uBAAiC,CAAC;AACxC,QAAI,KAAK,cAAc;AACrB,qBAAe,IAAI,IAAI,KAAK,aAAa,IAAI,OAAK,EAAE,UAAU,CAAC;AAK/D,UAAI,KAAK,QAAS,YAAW,KAAK,KAAK,QAAS,cAAa,IAAI,CAAC;AAClE,yBAAmB,mBAAmB,IAAI;AAAA,IAC5C,WAAW,KAAK,YAAY;AAO1B,YAAM,aAAa,KAAK;AACxB,qBAAe,oBAAI,IAAI,CAAC,WAAW,MAAM,CAAC;AAC1C,iBAAW,OAAO,WAAW,OAAO;AAIlC,YAAI,aAAa,GAAG,EAAG,cAAa,IAAI,IAAI,OAAO;AAAA,YAC9C,sBAAqB,KAAK,IAAI,EAAE;AAAA,MACvC;AACA,UAAI,KAAK,QAAS,YAAW,KAAK,KAAK,QAAS,cAAa,IAAI,CAAC;AAClE,yBAAmB,wBAAwB,IAAI;AAAA,IACjD,OAAO;AAEL,UAAI;AACJ,UAAI;AACF,YAAI,KAAK,MAAO,UAAU;AAAA,MAC5B,SAAS,GAAG;AAGV,YAAI,EAAE,aAAa,qBAAsB,OAAM;AAC/C,aAAK,cAAc,KAAK,EAAE,MAAM,IAAI,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC,EAAG,CAAC;AACnF;AAAA,MACF;AACA,aAAO;AACP,gBAAU,OAAO,KAAK,UAAU;AAChC,UAAI,SAAS;AAIX,uBAAe,oBAAoB,IAAI;AACvC,2BAAmB,mBAAmB,IAAI;AAK1C,cAAM,gBAAgB,qBAAqB,KAAK,MAAM,CAAC;AACvD,YAAI,cAAc,SAAS,GAAG;AAC5B,6BAAmB,KAAK,UAAU,EAAE,MAAM,kBAAkB,YAAY,cAAc,CAAC;AAAA,QACzF;AAGA,YAAI,KAAK,QAAS,YAAW,KAAK,KAAK,QAAS,cAAa,IAAI,CAAC;AAAA,MACpE,OAAO;AAEL,YAAI,CAAC,KAAK,WAAW,KAAK,QAAQ,WAAW,GAAG;AAC9C,gBAAM,IAAI;AAAA,YACR,yBAAyB,KAAK,IAAI;AAAA,UAIpC;AAAA,QACF;AACA,uBAAe,IAAI,IAAI,KAAK,OAAO;AAGnC,2BAAmB,KAAK,UAAU,EAAE,WAAW,MAAM,SAAS,CAAC,GAAG,KAAK,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,MAC1F;AAAA,IACF;AAMA,QAAI,SAAS,kBAAkB;AAC7B,iBAAW,OAAO,cAAc;AAC9B,YAAI,CAAC,QAAQ,iBAAiB,GAAG,GAAG;AAClC,gBAAM,IAAI,mCAAmC,KAAK,MAAM,GAAG;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB,KAAK,QAAQ,cAAc,KAAK;AACzD,UAAM,YAAY,MAAM,iBAAiB,KAAK,MAAM,cAAc,gBAAgB;AAMlF,UAAM,mBAAkC,CAAC;AACzC,UAAM,iBAAiB,KAAK,QAAQ,WAAW;AAC/C,QAAI,mBAAmB,UAAa,SAAS;AAC3C,YAAM,OAAO,KAAK,MAAM;AACxB,iBAAW,UAAU,KAAK,SAAS;AACjC,YAAI,qBAAqB,QAAQ,cAAc,EAAG,kBAAiB,KAAK,MAAM;AAAA,MAChF;AAAA,IACF;AAIA,UAAM,QAAe,KAAK,gBAAgB,KAAK,cAAc,UAAU,WAAW;AAClF,UAAM,MAAoB,EAAE,MAAM,kBAAkB,cAAc,WAAW,kBAAkB,MAAM;AAErG,SAAK,QAAQ,IAAI,KAAK,MAAM,GAAG;AAC/B,eAAW,OAAO,cAAc;AAC9B,YAAM,MAAM,KAAK,UAAU,IAAI,GAAG;AAClC,UAAI,IAAK,KAAI,KAAK,GAAG;AAAA,UAChB,MAAK,UAAU,IAAI,KAAK,CAAC,GAAG,CAAC;AAAA,IACpC;AACA,QAAI,qBAAqB,SAAS,GAAG;AAKnC,YAAM,cAAe,GAElB;AACH,YAAM,iBAAiB,KAAK;AAC5B,YAAM,aAAa,CAAC,GAAW,MAC7B,aAAa,YAAY,CAAC,EAAE,CAAC,KAAK;AACpC,WAAK,oBAAoB,KAAK;AAAA,QAC5B;AAAA,QACA,SAAS,IAAI,IAAI,oBAAoB;AAAA,QACrC,eAAe,CAAC,UAAU;AACxB,gBAAM,MAAM,eAAe,MAAM,KAAK,OAAK,EAAE,OAAO,KAAK;AACzD,cAAI,CAAC,OAAO,aAAa,GAAG,EAAG,QAAO;AAGtC,iBAAO,wBAAwB,KAAK,eAAe,OAAO,eAAe,QAAQ,UAAU;AAAA,QAC7F;AAAA,MACF,CAAC;AAGD,WAAK,2BAA2B;AAAA,IAClC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAA2B;AACzB,WAAO,KAAK,cAAc,SAAS;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,sBAAqC;AACzC,QAAI,KAAK,cAAc,WAAW,EAAG;AAGrC,UAAM,SAAS,KAAK,cAAc,OAAO,CAAC;AAC1C,eAAW,SAAS,QAAQ;AAC1B,YAAM,KAAK,SAAS,MAAM,MAAM,MAAM,IAAI,MAAM,OAAO;AAAA,IACzD;AAAA,EACF;AAAA;AAAA,EAGA,aAAa,QAA6C;AACxD,QAAI,KAAK,oBAAoB,SAAS,EAAG,MAAK,2BAA2B;AACzE,WAAO,KAAK,UAAU,IAAI,MAAM,KAAK,CAAC;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBQ,6BAAmC;AACzC,aAAS,IAAI,KAAK,oBAAoB,SAAS,GAAG,KAAK,GAAG,KAAK;AAC7D,YAAM,QAAQ,KAAK,oBAAoB,CAAC;AACxC,iBAAW,SAAS,CAAC,GAAG,MAAM,OAAO,GAAG;AACtC,cAAM,SAAS,MAAM,cAAc,KAAK;AACxC,YAAI,WAAW,KAAM;AACrB,cAAM,QAAQ,OAAO,KAAK;AAC1B,YAAI,MAAM,IAAI,aAAa,IAAI,MAAM,EAAG;AAGvC,QAAC,MAAM,IAAI,aAA6B,IAAI,MAAM;AACnD,cAAM,MAAM,KAAK,UAAU,IAAI,MAAM;AACrC,YAAI,IAAK,KAAI,KAAK,MAAM,GAAG;AAAA,YACtB,MAAK,UAAU,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;AAAA,MAC7C;AACA,UAAI,MAAM,QAAQ,SAAS,EAAG,MAAK,oBAAoB,OAAO,GAAG,CAAC;AAAA,IACpE;AAAA,EACF;AAAA;AAAA,EAGA,OAAO,MAAwC;AAC7C,WAAO,KAAK,QAAQ,IAAI,IAAI;AAAA,EAC9B;AAAA;AAAA,EAGA,MAAmC;AACjC,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,QAA6I;AAC3I,UAAM,MAAsF,CAAC;AAC7F,eAAW,OAAO,KAAK,QAAQ,OAAO,GAAG;AACvC,YAAM,UAAsB,CAAC;AAC7B,iBAAW,OAAO,IAAI,cAAc;AAClC,YAAI,QAAQ,IAAI,oBAAoB,kBAAkB,GAAG,EAAG;AAC5D,gBAAQ,KAAK,EAAE,YAAY,KAAK,OAAO,aAAa,CAAC;AAAA,MACvD;AACA,UAAI,QAAQ,WAAW,EAAG;AAC1B,UAAI,KAAK,EAAE,QAAQ,EAAE,YAAY,IAAI,kBAAkB,OAAO,aAAa,GAAG,SAAS,MAAM,MAAM,OAAO,IAAI,MAAM,CAAC;AAAA,IACvH;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,SAAS,OAAuB;AAC9B,UAAM,cAAc;AAAA,EACtB;AACF;AAQA,SAAS,qBAAqB,QAAgB,OAAsC;AAClF,SAAO,OAAO,SAAS,WAAW,OAAO,UAAU;AACrD;AAUO,SAAS,qBACd,IACA,YACgB;AAIhB,QAAM,MAAM,oBAAI,IAA+B;AAC/C,aAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,QAAI,IAAI,MAAM;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,IAAI,KAAK;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO;AAAA;AAAA,IAEL,WAA8C,MAAmB;AAC/D,YAAM,IAAI,GAAG,WAAc,IAAI;AAI/B,aAAO,IAAI,MAAM,GAAG;AAAA,QAClB,IAAI,QAAQ,MAAM,UAAU;AAC1B,cAAI,SAAS,SAAS;AACpB,mBAAO,IAAI,SAAoB;AAE7B,oBAAM,IAAK,OAAO,MAAc,GAAG,IAAI;AAKvC,kBAAI,KAAK,OAAO,EAAE,oBAAoB,YAAY;AAChD,uBAAO,EAAE,gBAAgB,GAAG;AAAA,cAC9B;AACA,qBAAO;AAAA,YACT;AAAA,UACF;AACA,iBAAO,QAAQ,IAAI,QAAQ,MAAM,QAAQ;AAAA,QAC3C;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAUA,SAAS,qBACP,MACiE;AACjE,QAAM,OAAwE,CAAC;AAC/E,QAAM,OAAO,CAAC,YAAqC;AACjD,eAAW,KAAK,SAAS;AACvB,UAAI,EAAE,SAAS,kBAAkB;AAC/B,aAAK,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,EAAE,eAAe,SAAS,EAAE,QAAQ,CAAC;AAAA,MAChF,WAAW,EAAE,SAAS,SAAS;AAC7B,aAAK,EAAE,OAAO;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AACA,OAAK,KAAK,OAAO;AAGjB,OAAK,KAAK,CAAC,GAAG,MAAM;AAClB,QAAI,EAAE,SAAS,EAAE,KAAM,QAAO,EAAE,OAAO,EAAE,OAAO,KAAK;AACrD,QAAI,EAAE,kBAAkB,EAAE,cAAe,QAAO,EAAE,gBAAgB,EAAE,gBAAgB,KAAK;AACzF,WAAO,EAAE,UAAU,EAAE,UAAU,KAAK,EAAE,UAAU,EAAE,UAAU,IAAI;AAAA,EAClE,CAAC;AACD,SAAO;AACT;AAuBA,SAAS,kBAAkB,KAA4B;AACrD,QAAM,YAAY,IAAI,KAAK,QAAQ;AACnC,MAAI,cAAc,OAAW,QAAO;AACpC,QAAM,QAAQ,UAAU;AAIxB,aAAW,KAAK,IAAI,kBAAkB;AACpC,QAAI,EAAE,OAAO,QAAQ,EAAE,UAAU,MAAO,QAAO;AAC/C,QAAI,EAAE,OAAO,QAAQ,EAAE,UAAU,MAAO,QAAO;AAC/C,QAAI,EAAE,OAAO,QAAQ,MAAM,QAAQ,EAAE,KAAK,GAAG;AAC3C,YAAM,OAAO,EAAE;AACf,UAAI,CAAC,KAAK,SAAS,KAAK,EAAG,QAAO;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-4VUPLMZ6.js → chunk-GCU42IG7.js}

@@ -1,20 +1,20 @@
 import {
   pickLocale
-} from "./chunk-2BMRJ6LQ.js";
+} from "./chunk-2ZT4INZ4.js";
 import {
   sha256Hex
-} from "./chunk-VCETL77O.js";
+} from "./chunk-ONPVHX2Y.js";
 import {
-  BundleIntegrityError,
-  BundleSealMismatchError,
+  PodIntegrityError,
+  PodSealMismatchError,
   ValidationError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-Z3BZXPRO.js";
 
 // src/with-pod/format.ts
-var NOYDB_BUNDLE_MAGIC = new Uint8Array([78, 68, 66, 49]);
-var NOYDB_BUNDLE_PREFIX_BYTES = 10;
-var NOYDB_BUNDLE_FORMAT_VERSION = 1;
-var NOYDB_BUNDLE_FORMAT_VERSION_SIGNED = 2;
+var NOYDB_POD_MAGIC = new Uint8Array([78, 68, 66, 49]);
+var NOYDB_POD_PREFIX_BYTES = 10;
+var NOYDB_POD_FORMAT_VERSION = 1;
+var NOYDB_POD_FORMAT_VERSION_SIGNED = 2;
 var FLAG_COMPRESSED = 1;
 var FLAG_HAS_INTEGRITY_HASH = 2;
 var COMPRESSION_NONE = 0;
@@ -63,7 +63,7 @@ var REDIRECT_REASONS = /* @__PURE__ */ new Set([
   "tombstone",
   "repoint"
 ]);
-function validateBundleHeader(parsed) {
+function validatePodHeaderFields(parsed) {
   if (parsed === null || typeof parsed !== "object") {
     throw new Error(
       `.noydb bundle header must be a JSON object, got ${parsed === null ? "null" : typeof parsed}`
@@ -77,9 +77,9 @@ function validateBundleHeader(parsed) {
     }
   }
   const h = parsed;
-  if (typeof h["formatVersion"] !== "number" || h["formatVersion"] !== NOYDB_BUNDLE_FORMAT_VERSION && h["formatVersion"] !== NOYDB_BUNDLE_FORMAT_VERSION_SIGNED) {
+  if (typeof h["formatVersion"] !== "number" || h["formatVersion"] !== NOYDB_POD_FORMAT_VERSION && h["formatVersion"] !== NOYDB_POD_FORMAT_VERSION_SIGNED) {
     throw new Error(
-      `.noydb bundle header.formatVersion must be ${NOYDB_BUNDLE_FORMAT_VERSION} or ${NOYDB_BUNDLE_FORMAT_VERSION_SIGNED}, got ${String(h["formatVersion"])}. The reader does not support forward-compat versions; upgrade the reader to handle newer bundles.`
+      `.noydb bundle header.formatVersion must be ${NOYDB_POD_FORMAT_VERSION} or ${NOYDB_POD_FORMAT_VERSION_SIGNED}, got ${String(h["formatVersion"])}. The reader does not support forward-compat versions; upgrade the reader to handle newer bundles.`
     );
   }
   if (typeof h["handle"] !== "string" || !/^[0-9A-HJKMNP-TV-Z]{26}$/.test(h["handle"])) {
@@ -264,14 +264,14 @@ function validateBundleHeader(parsed) {
       `.noydb bundle header.sig, .keyId, and .sigAlg must be present together or not at all (got ${sigFieldsPresent} of 3).`
     );
   }
-  if (sigFieldsPresent === 3 && h["formatVersion"] !== NOYDB_BUNDLE_FORMAT_VERSION_SIGNED) {
+  if (sigFieldsPresent === 3 && h["formatVersion"] !== NOYDB_POD_FORMAT_VERSION_SIGNED) {
     throw new Error(
-      `.noydb bundle header with sig/keyId/sigAlg must have formatVersion === ${NOYDB_BUNDLE_FORMAT_VERSION_SIGNED}, got ${String(h["formatVersion"])}.`
+      `.noydb bundle header with sig/keyId/sigAlg must have formatVersion === ${NOYDB_POD_FORMAT_VERSION_SIGNED}, got ${String(h["formatVersion"])}.`
     );
   }
 }
-function encodeBundleHeader(header) {
-  validateBundleHeader(header);
+function encodePodHeader(header) {
+  validatePodHeaderFields(header);
   const json = JSON.stringify({
     formatVersion: header.formatVersion,
     handle: header.handle,
@@ -297,7 +297,7 @@ function encodeBundleHeader(header) {
   });
   return new TextEncoder().encode(json);
 }
-function decodeBundleHeader(bytes) {
+function decodePodHeader(bytes) {
   const json = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
   let parsed;
   try {
@@ -307,7 +307,7 @@ function decodeBundleHeader(bytes) {
       `.noydb bundle header is not valid JSON: ${err.message}`
     );
   }
-  validateBundleHeader(parsed);
+  validatePodHeaderFields(parsed);
   return parsed;
 }
 function readUint32BE(bytes, offset) {
@@ -319,10 +319,10 @@ function writeUint32BE(bytes, offset, value) {
   bytes[offset + 2] = value >>> 8 & 255;
   bytes[offset + 3] = value & 255;
 }
-function hasNoydbBundleMagic(bytes) {
-  if (bytes.length < NOYDB_BUNDLE_MAGIC.length) return false;
-  for (let i = 0; i < NOYDB_BUNDLE_MAGIC.length; i++) {
-    if (bytes[i] !== NOYDB_BUNDLE_MAGIC[i]) return false;
+function hasNoydbPodMagic(bytes) {
+  if (bytes.length < NOYDB_POD_MAGIC.length) return false;
+  for (let i = 0; i < NOYDB_POD_MAGIC.length; i++) {
+    if (bytes[i] !== NOYDB_POD_MAGIC[i]) return false;
   }
   return true;
 }
@@ -340,7 +340,7 @@ async function verifyRecord(publicKeyB64, sig, payload) {
   return ed25519Verify(publicKeyB64, sig, signedBytes(payload));
 }
 
-// src/with-pod/bundle.ts
+// src/with-pod/pod.ts
 var WRITE_POD_OPTION_KEYS = [
   "compression",
   "collections",
@@ -562,30 +562,30 @@ function parseAutoUnlockBody(bodyString) {
   try {
     parsed = JSON.parse(bodyString);
   } catch (err) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       "header declared autoUnlock but body could not be parsed as JSON wrapper: " + (err instanceof Error ? err.message : String(err))
     );
   }
   if (typeof parsed !== "object" || parsed === null) {
-    throw new BundleIntegrityError("autoUnlock body is not a JSON object");
+    throw new PodIntegrityError("autoUnlock body is not a JSON object");
   }
   const obj = parsed;
   if (obj["_noydb_bundle_body"] !== 1) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       "autoUnlock body missing `_noydb_bundle_body: 1` discriminator"
     );
   }
   if (typeof obj["dump"] !== "string") {
-    throw new BundleIntegrityError("autoUnlock body must carry a string `dump` field");
+    throw new PodIntegrityError("autoUnlock body must carry a string `dump` field");
   }
   const blob = obj["_autoUnlock"];
   if (typeof blob !== "object" || blob === null) {
-    throw new BundleIntegrityError("autoUnlock body missing `_autoUnlock` blob");
+    throw new PodIntegrityError("autoUnlock body missing `_autoUnlock` blob");
   }
   const blobObj = blob;
   const kind = blobObj["kind"];
   if (kind !== "unsealed" && kind !== "sealed") {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       `autoUnlock blob has invalid kind ${String(kind)}; expected 'unsealed' or 'sealed'`
     );
   }
@@ -602,29 +602,29 @@ function parseExtractedPartitionBody(bodyString) {
   try {
     parsed = JSON.parse(bodyString);
   } catch (err) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       "header declared extracted-partition but body could not be parsed as JSON wrapper: " + (err instanceof Error ? err.message : String(err))
     );
   }
   if (typeof parsed !== "object" || parsed === null) {
-    throw new BundleIntegrityError("extracted-partition body is not a JSON object");
+    throw new PodIntegrityError("extracted-partition body is not a JSON object");
   }
   const obj = parsed;
   if (obj["_noydb_bundle_body"] !== 1) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       "extracted-partition body missing `_noydb_bundle_body: 1` discriminator"
     );
   }
   if (typeof obj["dump"] !== "string") {
-    throw new BundleIntegrityError("extracted-partition body must carry a string `dump` field");
+    throw new PodIntegrityError("extracted-partition body must carry a string `dump` field");
   }
   const seal = obj["_transferSeal"];
   if (typeof seal !== "object" || seal === null) {
-    throw new BundleIntegrityError("extracted-partition body missing `_transferSeal` blob");
+    throw new PodIntegrityError("extracted-partition body missing `_transferSeal` blob");
   }
   const s = seal;
   if (s["v"] !== 1 || s["alg"] !== "aes-256-gcm-pre-shared" || typeof s["sealId"] !== "string" || typeof s["payload"] !== "string") {
-    throw new BundleIntegrityError("extracted-partition `_transferSeal` blob is malformed");
+    throw new PodIntegrityError("extracted-partition `_transferSeal` blob is malformed");
   }
   return { dump: obj["dump"], seal };
 }
@@ -670,7 +670,7 @@ async function resolveAutoUnlock(blob, opts) {
             unsealedMap[userId] = { kind: credKind, value: entry.sealed };
             continue;
           }
-          throw new BundleSealMismatchError(userId, entry.pid);
+          throw new PodSealMismatchError(userId, entry.pid);
         }
         unsealedMap[userId] = { kind: credKind, value: opened };
         continue;
@@ -679,7 +679,7 @@ async function resolveAutoUnlock(blob, opts) {
         unsealedMap[userId] = { kind: credKind, value: entry.sealed };
         continue;
       }
-      throw new BundleSealMismatchError(userId, entry.pid);
+      throw new PodSealMismatchError(userId, entry.pid);
     }
     const plaintextBytes = await provider.unseal(base64ToBytes(entry.sealed));
     unsealedMap[userId] = { kind: credKind, value: decoder.decode(plaintextBytes) };
@@ -812,7 +812,7 @@ async function applySatelliteLivenessFilter(vault, dumpJson) {
   if (!backup.collections || typeof backup.collections !== "object") return dumpJson;
   if (typeof vault._introspectState !== "function") return dumpJson;
   const { adapter, name, getDEK } = vault._introspectState();
-  const { liveBaseIdSetsForBundle } = await import("./dead-filter-DCB62VWW.js");
+  const { liveBaseIdSetsForBundle } = await import("./dead-filter-JNQNB3TA.js");
   const satLive = await liveBaseIdSetsForBundle(adapter, name, Object.keys(backup.collections), getDEK);
   if (satLive.size === 0) return dumpJson;
   const next = {};
@@ -852,7 +852,8 @@ async function applyPlaintextFilters(vault, dumpJson, opts) {
       if (where !== void 0) {
         const record = await vault._decryptEnvelopeForBundleFilter(
           env,
-          collName
+          collName,
+          id
         );
         const ok = await where(record, { collection: collName, id });
         if (!ok) continue;
@@ -864,13 +865,13 @@ async function applyPlaintextFilters(vault, dumpJson, opts) {
   backup.collections = next;
   return JSON.stringify(backup);
 }
-async function assembleBundleContainer(opts) {
+async function assemblePodContainer(opts) {
   const dumpBytes = new TextEncoder().encode(opts.bodyJsonStr);
   const { format, streamFormat } = selectCompression(opts.compression);
   const body = streamFormat === null ? dumpBytes : await pumpThroughStream(dumpBytes, new CompressionStream(streamFormat));
   const bodySha256 = await sha256Hex2(body);
   const header = {
-    formatVersion: NOYDB_BUNDLE_FORMAT_VERSION,
+    formatVersion: NOYDB_POD_FORMAT_VERSION,
     handle: opts.handle,
     bodyBytes: body.length,
     bodySha256,
@@ -886,13 +887,13 @@ async function assembleBundleContainer(opts) {
     ...opts.headerExtras?.redirect !== void 0 ? { redirect: opts.headerExtras.redirect } : {}
   };
   const signed = opts.signer === void 0 ? header : await (async (s) => {
-    const toSign = { ...header, formatVersion: NOYDB_BUNDLE_FORMAT_VERSION_SIGNED, keyId: s.keyId, sigAlg: "ed25519" };
+    const toSign = { ...header, formatVersion: NOYDB_POD_FORMAT_VERSION_SIGNED, keyId: s.keyId, sigAlg: "ed25519" };
     const sig = await signRecord(s.privateKeyPkcs8B64, toSign);
     return { ...toSign, sig };
   })(opts.signer);
-  const headerBytes = encodeBundleHeader(signed);
-  const prefix = new Uint8Array(NOYDB_BUNDLE_PREFIX_BYTES);
-  prefix.set(NOYDB_BUNDLE_MAGIC, 0);
+  const headerBytes = encodePodHeader(signed);
+  const prefix = new Uint8Array(NOYDB_POD_PREFIX_BYTES);
+  prefix.set(NOYDB_POD_MAGIC, 0);
   prefix[4] = (streamFormat === null ? 0 : FLAG_COMPRESSED) | FLAG_HAS_INTEGRITY_HASH;
   prefix[5] = format;
   writeUint32BE(prefix, 6, headerBytes.length);
@@ -907,7 +908,7 @@ async function writePod(vault, opts = {}) {
   }
   const normalizedAutoUnlock = normalizeAutoUnlock(opts);
   const autoUnlockMode = validateAutoUnlockOptions(opts, normalizedAutoUnlock);
-  const handle = await vault.getBundleHandle();
+  const handle = await vault.getPodHandle();
   const dumpJson = await vault.dump();
   const satelliteFiltered = await applySatelliteLivenessFilter(vault, dumpJson);
   const rekeyed = await applyRecipientRewrap(vault, satelliteFiltered, opts);
@@ -916,7 +917,7 @@ async function writePod(vault, opts = {}) {
   const bodyJsonStr = normalizedAutoUnlock === null ? filtered : JSON.stringify(await buildAutoUnlockWrapper(filtered, normalizedAutoUnlock));
   const cover = await vault.getCover();
   const signer = opts.sign === false ? void 0 : opts.sign !== void 0 ? opts.sign : await vault._loadPodSigner() ?? void 0;
-  return assembleBundleContainer({
+  return assemblePodContainer({
     handle,
     bodyJsonStr,
     compression: opts.compression,
@@ -935,16 +936,15 @@ async function writePod(vault, opts = {}) {
     ...signer !== void 0 ? { signer } : {}
   });
 }
-var writeNoydbBundle = writePod;
 function parsePrefixAndHeader(bytes) {
-  if (!hasNoydbBundleMagic(bytes)) {
+  if (!hasNoydbPodMagic(bytes)) {
     throw new Error(
       `Not a .noydb bundle: missing 'NDB1' magic prefix. The first 4 bytes are ${[...bytes.slice(0, 4)].map((b) => b.toString(16).padStart(2, "0")).join(" ")}.`
     );
   }
-  if (bytes.length < NOYDB_BUNDLE_PREFIX_BYTES) {
+  if (bytes.length < NOYDB_POD_PREFIX_BYTES) {
     throw new Error(
-      `Truncated .noydb bundle: file is only ${bytes.length} bytes, which is less than the ${NOYDB_BUNDLE_PREFIX_BYTES}-byte fixed prefix.`
+      `Truncated .noydb bundle: file is only ${bytes.length} bytes, which is less than the ${NOYDB_POD_PREFIX_BYTES}-byte fixed prefix.`
     );
   }
   const flags = bytes[4];
@@ -955,20 +955,19 @@ function parsePrefixAndHeader(bytes) {
     );
   }
   const headerLength = readUint32BE(bytes, 6);
-  const bodyOffset = NOYDB_BUNDLE_PREFIX_BYTES + headerLength;
+  const bodyOffset = NOYDB_POD_PREFIX_BYTES + headerLength;
   if (bodyOffset > bytes.length) {
     throw new Error(
       `Truncated .noydb bundle: declared header length ${headerLength} would extend past end of file (${bytes.length} bytes).`
     );
   }
-  const headerBytes = bytes.slice(NOYDB_BUNDLE_PREFIX_BYTES, bodyOffset);
-  const header = decodeBundleHeader(headerBytes);
+  const headerBytes = bytes.slice(NOYDB_POD_PREFIX_BYTES, bodyOffset);
+  const header = decodePodHeader(headerBytes);
   return { header, bodyOffset, algo, flags };
 }
 function readPodHeader(bytes) {
   return parsePrefixAndHeader(bytes).header;
 }
-var readNoydbBundleHeader = readPodHeader;
 async function verifyPodHeader(bytes, trustedKeys) {
   const { header } = parsePrefixAndHeader(bytes);
   if (header.sig === void 0 || header.keyId === void 0 || header.sigAlg === void 0) {
@@ -1001,13 +1000,13 @@ async function readPod(bytes, opts = {}) {
   const { header, bodyOffset, algo } = parsePrefixAndHeader(bytes);
   const body = bytes.slice(bodyOffset);
   if (body.length !== header.bodyBytes) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       `body length ${body.length} does not match header.bodyBytes ${header.bodyBytes}. The bundle was truncated or padded between write and read.`
     );
   }
   const actualSha = await sha256Hex2(body);
   if (actualSha !== header.bodySha256) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       `body sha256 ${actualSha} does not match header.bodySha256 ${header.bodySha256}. The bundle bytes were modified between write and read \u2014 refuse to decompress.`
     );
   }
@@ -1019,7 +1018,7 @@ async function readPod(bytes, opts = {}) {
     try {
       dumpBytes = await pumpThroughStream(body, new DecompressionStream(streamFormat));
     } catch (err) {
-      throw new BundleIntegrityError(
+      throw new PodIntegrityError(
         `decompression failed: ${err.message}. The bundle passed the integrity hash but the body is not valid ${streamFormat} data \u2014 likely a producer bug.`
       );
     }
@@ -1032,20 +1031,19 @@ async function readPod(bytes, opts = {}) {
   const autoUnlock = await resolveAutoUnlock(blob, opts);
   return { header, dumpJson: dump, autoUnlock };
 }
-var readNoydbBundle = readPod;
 
 export {
-  NOYDB_BUNDLE_MAGIC,
-  NOYDB_BUNDLE_PREFIX_BYTES,
-  NOYDB_BUNDLE_FORMAT_VERSION,
+  NOYDB_POD_MAGIC,
+  NOYDB_POD_PREFIX_BYTES,
+  NOYDB_POD_FORMAT_VERSION,
   FLAG_COMPRESSED,
   FLAG_HAS_INTEGRITY_HASH,
   COMPRESSION_NONE,
   COMPRESSION_GZIP,
   COMPRESSION_BROTLI,
-  validateBundleHeader,
-  encodeBundleHeader,
-  hasNoydbBundleMagic,
+  validatePodHeaderFields,
+  encodePodHeader,
+  hasNoydbPodMagic,
   POD_SIG_ALG,
   signedBytes,
   signRecord,
@@ -1053,15 +1051,12 @@ export {
   buildExtractedPartitionWrapper,
   parseExtractedPartitionBody,
   resetBrotliSupportCache,
-  assembleBundleContainer,
+  assemblePodContainer,
   writePod,
-  writeNoydbBundle,
   readPodHeader,
-  readNoydbBundleHeader,
   verifyPodHeader,
   readPodCover,
   readPodRedirect,
-  readPod,
-  readNoydbBundle
+  readPod
 };
-//# sourceMappingURL=chunk-4VUPLMZ6.js.map
+//# sourceMappingURL=chunk-GCU42IG7.js.map