@noy-db/hub 0.6.0-pre.9 → 0.7.0-pre.0

package/dist/chunk-6EW2UCVF.js

@@ -0,0 +1,190 @@
+import {
+  isRewrappedUnder,
+  rewrapEnvelope
+} from "./chunk-2LPVI4PX.js";
+import {
+  buildRecordEnvelope,
+  isTombstone,
+  isTombstoneShape
+} from "./chunk-N4CNVSUF.js";
+
+// src/with-commit/history/history.ts
+var HISTORY_COLLECTION = "_history";
+var VERSION_PAD = 10;
+function historyId(collection, recordId, version) {
+  return `${collection}:${recordId}:${String(version).padStart(VERSION_PAD, "0")}`;
+}
+function historyIdentity(collection, recordId, version) {
+  return { collection: HISTORY_COLLECTION, id: historyId(collection, recordId, version), version };
+}
+function matchesPrefix(id, collection, recordId) {
+  if (recordId) {
+    return id.startsWith(`${collection}:${recordId}:`);
+  }
+  return id.startsWith(`${collection}:`);
+}
+async function saveHistory(adapter, vault, collection, recordId, envelope) {
+  const { id } = historyIdentity(collection, recordId, envelope._v);
+  await adapter.put(vault, HISTORY_COLLECTION, id, envelope);
+}
+async function getHistory(adapter, vault, collection, recordId, options) {
+  const allIds = await adapter.list(vault, HISTORY_COLLECTION);
+  const matchingIds = allIds.filter((id) => matchesPrefix(id, collection, recordId)).sort().reverse();
+  const entries = [];
+  for (const id of matchingIds) {
+    const envelope = await adapter.get(vault, HISTORY_COLLECTION, id);
+    if (!envelope) continue;
+    if (options?.from && envelope._ts < options.from) continue;
+    if (options?.to && envelope._ts > options.to) continue;
+    entries.push(envelope);
+    if (options?.limit && entries.length >= options.limit) break;
+  }
+  return entries;
+}
+async function getVersionEnvelope(adapter, vault, collection, recordId, version) {
+  const id = historyId(collection, recordId, version);
+  return adapter.get(vault, HISTORY_COLLECTION, id);
+}
+async function pruneHistory(adapter, vault, collection, recordId, options) {
+  const allIds = await adapter.list(vault, HISTORY_COLLECTION);
+  const matchingIds = allIds.filter((id) => recordId ? matchesPrefix(id, collection, recordId) : matchesPrefix(id, collection)).sort();
+  let toDelete = [];
+  if (options.keepVersions !== void 0) {
+    const keep = options.keepVersions;
+    if (matchingIds.length > keep) {
+      toDelete = matchingIds.slice(0, matchingIds.length - keep);
+    }
+  }
+  if (options.beforeDate) {
+    for (const id of matchingIds) {
+      if (toDelete.includes(id)) continue;
+      const envelope = await adapter.get(vault, HISTORY_COLLECTION, id);
+      if (envelope && envelope._ts < options.beforeDate) {
+        toDelete.push(id);
+      }
+    }
+  }
+  const uniqueDeletes = [...new Set(toDelete)];
+  for (const id of uniqueDeletes) {
+    await adapter.delete(vault, HISTORY_COLLECTION, id);
+  }
+  return uniqueDeletes.length;
+}
+async function clearHistory(adapter, vault, collection, recordId) {
+  const allIds = await adapter.list(vault, HISTORY_COLLECTION);
+  let toDelete;
+  if (collection && recordId) {
+    toDelete = allIds.filter((id) => matchesPrefix(id, collection, recordId));
+  } else if (collection) {
+    toDelete = allIds.filter((id) => matchesPrefix(id, collection));
+  } else {
+    toDelete = allIds;
+  }
+  for (const id of toDelete) {
+    await adapter.delete(vault, HISTORY_COLLECTION, id);
+  }
+  return toDelete.length;
+}
+async function tombstoneHistory(adapter, vault, collection, recordId, actor, encrypted) {
+  const allIds = await adapter.list(vault, HISTORY_COLLECTION);
+  const matchingIds = allIds.filter((id) => matchesPrefix(id, collection, recordId));
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  let count = 0;
+  for (const id of matchingIds) {
+    const env = await adapter.get(vault, HISTORY_COLLECTION, id);
+    if (!env) continue;
+    if (isTombstone(env, encrypted)) continue;
+    const tombstone = buildRecordEnvelope(
+      { collection: HISTORY_COLLECTION, id, ...actor ? { by: actor } : {}, version: env._v },
+      { ts: now, iv: "", data: "" }
+    );
+    await adapter.put(vault, HISTORY_COLLECTION, id, tombstone);
+    count++;
+  }
+  return count;
+}
+async function rewrapHistory(adapter, vault, collection, recordId, fromDek, toDek, tier0Dek) {
+  const allIds = await adapter.list(vault, HISTORY_COLLECTION);
+  const matchingIds = allIds.filter((id) => matchesPrefix(id, collection, recordId));
+  for (const id of matchingIds) {
+    const env = await adapter.get(vault, HISTORY_COLLECTION, id);
+    if (!env) continue;
+    if (isTombstoneShape(env)) continue;
+    const identity = {
+      collection: HISTORY_COLLECTION,
+      id,
+      version: env._v,
+      ...env._tier !== void 0 ? { tier: env._tier } : {},
+      ...env._by !== void 0 ? { by: env._by } : {}
+    };
+    if (await isRewrappedUnder(identity, env, toDek)) continue;
+    let next;
+    try {
+      next = await rewrapEnvelope(identity, env, fromDek, toDek);
+    } catch (err) {
+      if (!tier0Dek) throw err;
+      next = await rewrapEnvelope(identity, env, tier0Dek, toDek);
+    }
+    await adapter.put(vault, HISTORY_COLLECTION, id, next);
+  }
+}
+
+// src/with-commit/history/strategy.ts
+function notEnabled(op) {
+  return new Error(
+    `${op} requires the history strategy. Import \`{ withHistory }\` from "@noy-db/hub/history" and pass it to \`createNoydb({ historyStrategy: withHistory() })\`.`
+  );
+}
+var NO_HISTORY = {
+  async saveHistory() {
+  },
+  // Unreachable in practice — `saveHistory` above is a no-op, so nothing is
+  // ever sealed. Returns the real layout rather than a sentinel so a future
+  // caller that reads it without writing cannot be misled.
+  historyIdentity: (collection, recordId, version) => historyIdentity(collection, recordId, version),
+  async getHistoryEntries() {
+    throw notEnabled("collection.history()");
+  },
+  async getVersionEnvelope() {
+    throw notEnabled("collection.getVersion()");
+  },
+  async pruneHistory() {
+    return 0;
+  },
+  async clearHistory() {
+    return 0;
+  },
+  async tombstoneHistory() {
+    return 0;
+  },
+  async rewrapHistory() {
+  },
+  async envelopePayloadHash() {
+    return "";
+  },
+  computePatch() {
+    return [];
+  },
+  diff() {
+    throw notEnabled("collection.diff()");
+  },
+  buildLedger() {
+    return null;
+  },
+  buildVaultInstant() {
+    throw notEnabled("vault.at() / vault.timeMachine()");
+  }
+};
+
+export {
+  historyIdentity,
+  saveHistory,
+  getHistory,
+  getVersionEnvelope,
+  pruneHistory,
+  clearHistory,
+  tombstoneHistory,
+  rewrapHistory,
+  NO_HISTORY
+};
+//# sourceMappingURL=chunk-6EW2UCVF.js.map

package/dist/chunk-6EW2UCVF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/history/history.ts","../src/with-commit/history/strategy.ts"],"sourcesContent":["import { buildRecordEnvelope } from '../../kernel/enclave/index.js'\nimport type { RecordIdentity } from '../../kernel/enclave/index.js'\nimport type { NoydbStore, EncryptedEnvelope, HistoryOptions, PruneOptions } from '../../kernel/types.js'\nimport { isTombstone, isTombstoneShape, rewrapEnvelope, isRewrappedUnder, type EnclaveKey } from '../../kernel/enclave/index.js'\n\n/**\n * History storage convention:\n * Collection: `_history`\n * ID format: `{collection}:{recordId}:{paddedVersion}`\n * Version is zero-padded to 10 digits for lexicographic sorting.\n */\n\nconst HISTORY_COLLECTION = '_history'\nconst VERSION_PAD = 10\n\nfunction historyId(collection: string, recordId: string, version: number): string {\n  return `${collection}:${recordId}:${String(version).padStart(VERSION_PAD, '0')}`\n}\n\n/**\n * The identity a history snapshot is **sealed against** — its STORAGE location,\n * not the live record it is a copy of (#1041).\n *\n * ## Why storage, and why this is a decision rather than a detail\n *\n * A snapshot is a copy, so two identities are available: the live record\n * (`collection`/`recordId`) or where the bytes actually land\n * (`_history`/`historyId(...)`). They are not equivalent under attack.\n *\n * Binding the LIVE identity makes a snapshot's AAD **indistinguishable from the\n * live record's at the same version** — so an untrusted store could serve a\n * history entry *as the current record* and the client would accept it. It also\n * leaves entries relocatable within `_history`.\n *\n * Binding STORAGE identity closes both. The cost is that the id must be known\n * *before* the envelope is sealed, where `saveHistory` previously derived it\n * *after* (from `envelope._v`) — which is precisely the restructure this\n * function exists to make possible.\n *\n * `saveHistory` uses this too, so the sealed identity and the put location have\n * **one definition** and cannot drift apart. Changing the layout here changes\n * both at once, by construction.\n */\nexport function historyIdentity(collection: string, recordId: string, version: number): RecordIdentity {\n  // The snapshot's own `_v` IS the version it preserves — the same number that\n  // appears in its id. One argument feeds both, so they cannot disagree (#1093).\n  return { collection: HISTORY_COLLECTION, id: historyId(collection, recordId, version), version }\n}\n\n// Unused today, kept for future history-id parsing utilities.\n// eslint-disable-next-line @typescript-eslint/no-unused-vars\nfunction parseHistoryId(id: string): { collection: string; recordId: string; version: number } | null {\n  const lastColon = id.lastIndexOf(':')\n  if (lastColon < 0) return null\n  const versionStr = id.slice(lastColon + 1)\n  const rest = id.slice(0, lastColon)\n  const firstColon = rest.indexOf(':')\n  if (firstColon < 0) return null\n  return {\n    collection: rest.slice(0, firstColon),\n    recordId: rest.slice(firstColon + 1),\n    version: parseInt(versionStr, 10),\n  }\n}\n\nfunction matchesPrefix(id: string, collection: string, recordId?: string): boolean {\n  if (recordId) {\n    return id.startsWith(`${collection}:${recordId}:`)\n  }\n  return id.startsWith(`${collection}:`)\n}\n\n/** Save a history entry (a complete encrypted envelope snapshot). */\nexport async function saveHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  envelope: EncryptedEnvelope,\n): Promise<void> {\n  // Same derivation the caller sealed against — one definition, so the sealed\n  // identity and the put location cannot drift (#1041).\n  const { id } = historyIdentity(collection, recordId, envelope._v)\n  await adapter.put(vault, HISTORY_COLLECTION, id, envelope)\n}\n\n/** Get history entries for a record, sorted newest-first. */\nexport async function getHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  options?: HistoryOptions,\n): Promise<EncryptedEnvelope[]> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  const matchingIds = allIds\n    .filter(id => matchesPrefix(id, collection, recordId))\n    .sort()\n    .reverse() // newest first\n\n  const entries: EncryptedEnvelope[] = []\n\n  for (const id of matchingIds) {\n    const envelope = await adapter.get(vault, HISTORY_COLLECTION, id)\n    if (!envelope) continue\n\n    // Apply time filters\n    if (options?.from && envelope._ts < options.from) continue\n    if (options?.to && envelope._ts > options.to) continue\n\n    entries.push(envelope)\n\n    if (options?.limit && entries.length >= options.limit) break\n  }\n\n  return entries\n}\n\n/** Get a specific version's envelope from history. */\nexport async function getVersionEnvelope(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  version: number,\n): Promise<EncryptedEnvelope | null> {\n  const id = historyId(collection, recordId, version)\n  return adapter.get(vault, HISTORY_COLLECTION, id)\n}\n\n/** Prune history entries. Returns the number of entries deleted. */\nexport async function pruneHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string | undefined,\n  options: PruneOptions,\n): Promise<number> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  const matchingIds = allIds\n    .filter(id => recordId ? matchesPrefix(id, collection, recordId) : matchesPrefix(id, collection))\n    .sort()\n\n  let toDelete: string[] = []\n\n  if (options.keepVersions !== undefined) {\n    // Keep only the N most recent, delete the rest\n    const keep = options.keepVersions\n    if (matchingIds.length > keep) {\n      toDelete = matchingIds.slice(0, matchingIds.length - keep)\n    }\n  }\n\n  if (options.beforeDate) {\n    // Delete entries older than the specified date\n    for (const id of matchingIds) {\n      if (toDelete.includes(id)) continue\n      const envelope = await adapter.get(vault, HISTORY_COLLECTION, id)\n      if (envelope && envelope._ts < options.beforeDate) {\n        toDelete.push(id)\n      }\n    }\n  }\n\n  // Deduplicate\n  const uniqueDeletes = [...new Set(toDelete)]\n\n  for (const id of uniqueDeletes) {\n    await adapter.delete(vault, HISTORY_COLLECTION, id)\n  }\n\n  return uniqueDeletes.length\n}\n\n/** Clear all history for a vault, optionally scoped to a collection or record. */\nexport async function clearHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection?: string,\n  recordId?: string,\n): Promise<number> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  let toDelete: string[]\n\n  if (collection && recordId) {\n    toDelete = allIds.filter(id => matchesPrefix(id, collection, recordId))\n  } else if (collection) {\n    toDelete = allIds.filter(id => matchesPrefix(id, collection))\n  } else {\n    toDelete = allIds\n  }\n\n  for (const id of toDelete) {\n    await adapter.delete(vault, HISTORY_COLLECTION, id)\n  }\n\n  return toDelete.length\n}\n\n/**\n * Crypto-shred every `_history` version of a record. Each non-tombstone\n * history envelope is OVERWRITTEN in place with a tombstone\n * `{ _noydb, _v, _ts: now, _by: actor, _iv: '', _data: '' }` — dropping\n * `_iv`/`_data`/`_cek`/`_det`, so the prior ciphertext (and the wrapped CEK\n * that could decrypt it) is gone everywhere this store reaches. The version\n * counter (`_v`) is preserved so the audit trail still shows \"N versions\n * existed and were erased.\"\n *\n * Overwrite — NOT delete — so the history key itself survives as proof the\n * version existed. Already-tombstoned versions (re-run / idempotent forget)\n * are left untouched and not counted.\n *\n * Returns the number of history versions newly tombstoned.\n */\nexport async function tombstoneHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  actor: string,\n  encrypted: boolean,\n): Promise<number> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  const matchingIds = allIds.filter(id => matchesPrefix(id, collection, recordId))\n\n  const now = new Date().toISOString()\n  let count = 0\n  for (const id of matchingIds) {\n    const env = await adapter.get(vault, HISTORY_COLLECTION, id)\n    if (!env) continue\n    // Already a tombstone (no body and no wrapped CEK)? Skip — idempotent.\n    if (isTombstone(env, encrypted)) continue\n    // `by` rides on the IDENTITY — passing it in the body went through a\n    // conditional spread, which TypeScript does not excess-property-check, so\n    // it was silently dropped once `_by` moved to the identity (#1041).\n    const tombstone: EncryptedEnvelope = buildRecordEnvelope(\n      { collection: HISTORY_COLLECTION, id, ...(actor ? { by: actor } : {}), version: env._v },\n      { ts: now, iv: '', data: '' },\n    )\n    await adapter.put(vault, HISTORY_COLLECTION, id, tombstone)\n    count++\n  }\n  return count\n}\n\n/**\n * Re-key every `_history` snapshot of a record from `fromDek` to `toDek`.\n * Mirrors what `rewrapBodyToDek` already does for a record's LIVE body on a\n * tier move (elevate/demote/putAtTier) — each `_history` envelope also\n * carries its own `_cek`, wrapped under the collection's tier-0 DEK at write\n * time (`record-codec.ts`), so a tier move that rewraps only the live\n * envelope leaves prior versions decryptable at rest under the tier the\n * record left. This is defense-in-depth *beneath* the read-gate\n * (`history()`/`getVersion()` already return empty for an elevated record;\n * this protects the ciphertext even if that gate is bypassed).\n *\n * Rewraps content in place — unlike `tombstoneHistory`, it does NOT blank\n * `_iv`/`_data`/`_cek` — so a subsequent `demote()` restores tier-0\n * readability. Tombstone-shaped entries (a forgotten/shredded version —\n * blanked `_data`, no `_cek`) are skipped: there is no key material left to\n * rewrap.\n *\n * **Legacy fallback.** A snapshot written before this fix stays wrapped\n * under the tier-0 DEK even after its live record has since moved tiers, so\n * a rewrap attempted with a tier-N `fromDek` fails to unwrap/decrypt. When\n * the caller supplies `tier0Dek`, a failed rewrap is retried once with\n * `tier0Dek` as `fromDek` (the only other key a pre-fix snapshot can be\n * wrapped under — history is written only by tier-0 `put()`). The output is\n * always wrapped under `toDek` regardless of which `fromDek` succeeded. A\n * rewrap that fails under BOTH keys re-throws — that is real corruption, not\n * a tier mismatch, and must not be swallowed.\n *\n * **Crash-atomicity / idempotency (#712 whole-branch-fix-3).** This loop has\n * no transaction around it: a crash after some entries have been rewritten\n * under `toDek` but before the loop finishes leaves the record's history\n * split across two keys. A retry of the SAME call must not re-fail on the\n * entries that already made it — so each entry is probed with\n * `isRewrappedUnder(env, toDek)` FIRST; a match means it's already at the\n * target key and is skipped (put nothing). This makes same-target retries\n * and demote-after-crash fully self-healing. It does NOT close every crash\n * window: a crash that lands SOME entries under `toDek` while the record's\n * NEXT move target differs from this call's `toDek` (an intermediate-tier\n * crash — e.g. elevate 0→1 crashes mid-loop, then the record is moved 1→2)\n * still finds those entries unreadable under either `fromDek` or the\n * tier-0 fallback, since `toDek` is a third key the next call never probes\n * for. That residual window is an accepted, fail-closed limitation (see\n * `.changeset/history-at-rest.md` and the design doc) — availability is\n * lost, never confidentiality.\n */\nexport async function rewrapHistory(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n  recordId: string,\n  fromDek: EnclaveKey,\n  toDek: EnclaveKey,\n  tier0Dek?: EnclaveKey,\n): Promise<void> {\n  const allIds = await adapter.list(vault, HISTORY_COLLECTION)\n  const matchingIds = allIds.filter(id => matchesPrefix(id, collection, recordId))\n\n  for (const id of matchingIds) {\n    const env = await adapter.get(vault, HISTORY_COLLECTION, id)\n    if (!env) continue\n    // Already a tombstone (forgotten/shredded version)? Nothing to rewrap.\n    if (isTombstoneShape(env)) continue\n    // #712/whole-branch-fix-3: toDek-first idempotency skip — already at the\n    // target key (a same-target retry, or demote-after-crash landing back on\n    // a key it already reached)? Nothing to do; put nothing.\n    // In-place re-key of a `_history` entry: the address does not move, so the\n    // same identity opens and re-seals it (#1041). Built from the entry itself,\n    // exactly as a reader would via `recordAadFor`.\n    const identity = {\n      collection: HISTORY_COLLECTION, id, version: env._v,\n      ...(env._tier !== undefined ? { tier: env._tier } : {}),\n      ...(env._by !== undefined ? { by: env._by } : {}),\n    }\n    if (await isRewrappedUnder(identity, env, toDek)) continue\n\n    let next: EncryptedEnvelope\n    try {\n      next = await rewrapEnvelope(identity, env, fromDek, toDek)\n    } catch (err) {\n      if (!tier0Dek) throw err\n      // Legacy fallback: retry once under the tier-0 DEK. A failure here is\n      // real corruption, not a tier mismatch — let it propagate.\n      next = await rewrapEnvelope(identity, env, tier0Dek, toDek)\n    }\n\n    await adapter.put(vault, HISTORY_COLLECTION, id, next)\n  }\n}\n","/**\n * Strategy seam for the optional history + ledger + time-machine\n * service. Core imports `HistoryStrategy` type-only + `NO_HISTORY`\n * stub; real implementations of `saveHistory`, `LedgerStore`,\n * `VaultInstant`, `computePatch`, `diff` etc. are only reachable via\n * `withHistory()` in `./active.ts`.\n *\n * Applications that don't track per-record versioning, don't need the\n * hash-chained audit ledger, and don't restore to past instants ship\n * none of the ~1,880 LOC behind this seam.\n *\n * Strategy contract:\n *\n * - **saveHistory / pruneHistory / clearHistory** — no-ops under\n *   NO_HISTORY. Writes still succeed; no snapshot is captured.\n * - **getHistoryEntries / getVersionEnvelope / diff** — throw under\n *   NO_HISTORY. These are read APIs the consumer would only call\n *   after explicitly asking for history; the throw guides them to\n *   `@noy-db/hub/history`.\n * - **envelopePayloadHash / computePatch** — return empty / `[]`\n *   under NO_HISTORY. These are only used inside the\n *   `if (this.ledger)` branch, which is itself gated by\n *   `buildLedger()` returning null.\n * - **buildLedger** — returns `null` under NO_HISTORY. The Vault's\n *   public `vault.ledger()` accessor throws when null.\n * - **buildVaultInstant** — throws under NO_HISTORY. `vault.at()`\n *   propagates the throw.\n *\n * @internal\n */\n\nimport type {\n  EncryptedEnvelope,\n  NoydbStore,\n  HistoryOptions,\n  PruneOptions,\n} from '../../kernel/types.js'\nimport type { LedgerStore } from './ledger/store.js'\nimport type { JsonPatch } from './ledger/patch.js'\nimport type { DiffEntry } from './diff.js'\nimport type { VaultInstant, VaultEngine } from './time-machine.js'\nimport type { EnclaveKey, RecordIdentity } from '../../kernel/enclave/index.js'\nimport { historyIdentity } from './history.js'\n\n/**\n * Options accepted by `HistoryStrategy.buildLedger`. Mirrors the\n * `LedgerStore` constructor verbatim — kept in this file so `core`\n * code never imports the LedgerStore module at runtime.\n *\n * @internal\n */\nexport interface BuildLedgerOptions {\n  adapter: NoydbStore\n  vault: string\n  encrypted: boolean\n  getDEK: (collectionName: string) => Promise<EnclaveKey>\n  actor: string\n}\n\n/**\n * @internal\n */\nexport interface HistoryStrategy {\n  /**\n   * Persist a full encrypted envelope snapshot of the prior version\n   * under `_history/{collection}:{id}:{paddedVersion}`. No-op under\n   * `NO_HISTORY`.\n   */\n  saveHistory(\n    adapter: NoydbStore,\n    vault: string,\n    collection: string,\n    recordId: string,\n    envelope: EncryptedEnvelope,\n  ): Promise<void>\n\n  /**\n   * The identity a snapshot of `collection/recordId@version` must be **sealed\n   * against** — its `_history` storage location (#1041).\n   *\n   * On the port because the kernel writes history snapshots but must not import\n   * `with-commit` to learn its layout. Exposing it here keeps the derivation in\n   * the module that owns the layout, and `saveHistory` uses the same function,\n   * so the sealed identity and the put location cannot drift.\n   */\n  historyIdentity(collection: string, recordId: string, version: number): RecordIdentity\n\n  /**\n   * List history envelopes for a record, newest first. Throws under\n   * `NO_HISTORY` — callers reach this via `collection.history()` /\n   * `collection.getVersion()` / `collection.diff()`, which only work\n   * with the strategy enabled.\n   */\n  getHistoryEntries(\n    adapter: NoydbStore,\n    vault: string,\n    collection: string,\n    recordId: string,\n    options?: HistoryOptions,\n  ): Promise<EncryptedEnvelope[]>\n\n  /**\n   * Fetch a specific version's envelope. Throws under `NO_HISTORY`.\n   */\n  getVersionEnvelope(\n    adapter: NoydbStore,\n    vault: string,\n    collection: string,\n    recordId: string,\n    version: number,\n  ): Promise<EncryptedEnvelope | null>\n\n  /**\n   * Prune history entries by retention rule. Returns `0` under\n   * `NO_HISTORY`.\n   */\n  pruneHistory(\n    adapter: NoydbStore,\n    vault: string,\n    collection: string,\n    recordId: string | undefined,\n    options: PruneOptions,\n  ): Promise<number>\n\n  /**\n   * Clear all history for vault/collection/record. Returns `0` under\n   * `NO_HISTORY`.\n   */\n  clearHistory(\n    adapter: NoydbStore,\n    vault: string,\n    collection?: string,\n    recordId?: string,\n  ): Promise<number>\n\n  /**\n   * Crypto-shred (overwrite-to-tombstone) every `_history` version of a\n   * record for GDPR erasure. Returns the number of versions newly\n   * tombstoned, or `0` under `NO_HISTORY` (no history = nothing to shred).\n   */\n  tombstoneHistory(\n    adapter: NoydbStore,\n    vault: string,\n    collection: string,\n    recordId: string,\n    actor: string,\n    encrypted: boolean,\n  ): Promise<number>\n\n  /**\n   * Re-key every `_history` snapshot of a record from `fromDek` to `toDek`\n   * on a tier move (elevate/demote/putAtTier), mirroring the live-body\n   * rewrap so prior versions are not left decryptable at rest under a tier\n   * the record has moved away from. Optional `tier0Dek` enables the legacy\n   * fallback for snapshots written before this rewrap existed (see\n   * `history.ts` for the full contract). No-op under `NO_HISTORY` (no\n   * history = nothing to rewrap).\n   */\n  rewrapHistory(\n    adapter: NoydbStore,\n    vault: string,\n    collection: string,\n    recordId: string,\n    fromDek: EnclaveKey,\n    toDek: EnclaveKey,\n    tier0Dek?: EnclaveKey,\n  ): Promise<void>\n\n  /**\n   * Compute the SHA-256 hash of an envelope's encrypted payload, used\n   * by `LedgerStore.append` to track tamper-evidence. Returns the\n   * empty string under `NO_HISTORY` (the call site is gated by\n   * `if (this.ledger)`, so the value is never observed).\n   */\n  envelopePayloadHash(envelope: EncryptedEnvelope | null): Promise<string>\n\n  /**\n   * Compute the JSON patch from `from` → `to`. Returns `[]` under\n   * `NO_HISTORY`.\n   */\n  computePatch(from: unknown, to: unknown): JsonPatch\n\n  /**\n   * Compute the typed diff between two records. Throws under\n   * `NO_HISTORY` — `collection.diff()` is a history-read API.\n   */\n  diff(recordA: unknown, recordB: unknown): DiffEntry[]\n\n  /**\n   * Construct (or return null) a `LedgerStore` for the vault. Returns\n   * `null` under `NO_HISTORY`; the Vault treats null as \"no ledger\n   * attached\" — collection write paths skip the append branch and the\n   * public `vault.ledger()` accessor throws.\n   */\n  buildLedger(opts: BuildLedgerOptions): LedgerStore | null\n\n  /**\n   * Construct a `VaultInstant` for time-machine reads. Throws under\n   * `NO_HISTORY`.\n   */\n  buildVaultInstant(engine: VaultEngine, timestamp: string): VaultInstant\n}\n\n/**\n * Error thrown when the consumer reaches a history-gated surface\n * without opting into the strategy. The message names the offending\n * operation and points to the subpath import.\n *\n * @internal\n */\nfunction notEnabled(op: string): Error {\n  return new Error(\n    `${op} requires the history strategy. Import ` +\n    '`{ withHistory }` from \"@noy-db/hub/history\" and pass it to ' +\n    '`createNoydb({ historyStrategy: withHistory() })`.',\n  )\n}\n\n/**\n * No-history stub. Snapshots and prune/clear are no-ops; reads and\n * time-machine throw with an actionable message; ledger construction\n * returns null so the write-path's `if (this.ledger)` branch is dead\n * code in the bundle.\n *\n * @internal\n */\nexport const NO_HISTORY: HistoryStrategy = {\n  async saveHistory() {},\n  // Unreachable in practice — `saveHistory` above is a no-op, so nothing is\n  // ever sealed. Returns the real layout rather than a sentinel so a future\n  // caller that reads it without writing cannot be misled.\n  historyIdentity: (collection, recordId, version) => historyIdentity(collection, recordId, version),\n  async getHistoryEntries() { throw notEnabled('collection.history()') },\n  async getVersionEnvelope() { throw notEnabled('collection.getVersion()') },\n  async pruneHistory() { return 0 },\n  async clearHistory() { return 0 },\n  async tombstoneHistory() { return 0 },\n  async rewrapHistory() {},\n  async envelopePayloadHash() { return '' },\n  computePatch() { return [] },\n  diff() { throw notEnabled('collection.diff()') },\n  buildLedger() { return null },\n  buildVaultInstant() { throw notEnabled('vault.at() / vault.timeMachine()') },\n}\n"],"mappings":";;;;;;;;;;;AAYA,IAAM,qBAAqB;AAC3B,IAAM,cAAc;AAEpB,SAAS,UAAU,YAAoB,UAAkB,SAAyB;AAChF,SAAO,GAAG,UAAU,IAAI,QAAQ,IAAI,OAAO,OAAO,EAAE,SAAS,aAAa,GAAG,CAAC;AAChF;AA0BO,SAAS,gBAAgB,YAAoB,UAAkB,SAAiC;AAGrG,SAAO,EAAE,YAAY,oBAAoB,IAAI,UAAU,YAAY,UAAU,OAAO,GAAG,QAAQ;AACjG;AAkBA,SAAS,cAAc,IAAY,YAAoB,UAA4B;AACjF,MAAI,UAAU;AACZ,WAAO,GAAG,WAAW,GAAG,UAAU,IAAI,QAAQ,GAAG;AAAA,EACnD;AACA,SAAO,GAAG,WAAW,GAAG,UAAU,GAAG;AACvC;AAGA,eAAsB,YACpB,SACA,OACA,YACA,UACA,UACe;AAGf,QAAM,EAAE,GAAG,IAAI,gBAAgB,YAAY,UAAU,SAAS,EAAE;AAChE,QAAM,QAAQ,IAAI,OAAO,oBAAoB,IAAI,QAAQ;AAC3D;AAGA,eAAsB,WACpB,SACA,OACA,YACA,UACA,SAC8B;AAC9B,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,QAAM,cAAc,OACjB,OAAO,QAAM,cAAc,IAAI,YAAY,QAAQ,CAAC,EACpD,KAAK,EACL,QAAQ;AAEX,QAAM,UAA+B,CAAC;AAEtC,aAAW,MAAM,aAAa;AAC5B,UAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAChE,QAAI,CAAC,SAAU;AAGf,QAAI,SAAS,QAAQ,SAAS,MAAM,QAAQ,KAAM;AAClD,QAAI,SAAS,MAAM,SAAS,MAAM,QAAQ,GAAI;AAE9C,YAAQ,KAAK,QAAQ;AAErB,QAAI,SAAS,SAAS,QAAQ,UAAU,QAAQ,MAAO;AAAA,EACzD;AAEA,SAAO;AACT;AAGA,eAAsB,mBACpB,SACA,OACA,YACA,UACA,SACmC;AACnC,QAAM,KAAK,UAAU,YAAY,UAAU,OAAO;AAClD,SAAO,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAClD;AAGA,eAAsB,aACpB,SACA,OACA,YACA,UACA,SACiB;AACjB,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,QAAM,cAAc,OACjB,OAAO,QAAM,WAAW,cAAc,IAAI,YAAY,QAAQ,IAAI,cAAc,IAAI,UAAU,CAAC,EAC/F,KAAK;AAER,MAAI,WAAqB,CAAC;AAE1B,MAAI,QAAQ,iBAAiB,QAAW;AAEtC,UAAM,OAAO,QAAQ;AACrB,QAAI,YAAY,SAAS,MAAM;AAC7B,iBAAW,YAAY,MAAM,GAAG,YAAY,SAAS,IAAI;AAAA,IAC3D;AAAA,EACF;AAEA,MAAI,QAAQ,YAAY;AAEtB,eAAW,MAAM,aAAa;AAC5B,UAAI,SAAS,SAAS,EAAE,EAAG;AAC3B,YAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAChE,UAAI,YAAY,SAAS,MAAM,QAAQ,YAAY;AACjD,iBAAS,KAAK,EAAE;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAGA,QAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC;AAE3C,aAAW,MAAM,eAAe;AAC9B,UAAM,QAAQ,OAAO,OAAO,oBAAoB,EAAE;AAAA,EACpD;AAEA,SAAO,cAAc;AACvB;AAGA,eAAsB,aACpB,SACA,OACA,YACA,UACiB;AACjB,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,MAAI;AAEJ,MAAI,cAAc,UAAU;AAC1B,eAAW,OAAO,OAAO,QAAM,cAAc,IAAI,YAAY,QAAQ,CAAC;AAAA,EACxE,WAAW,YAAY;AACrB,eAAW,OAAO,OAAO,QAAM,cAAc,IAAI,UAAU,CAAC;AAAA,EAC9D,OAAO;AACL,eAAW;AAAA,EACb;AAEA,aAAW,MAAM,UAAU;AACzB,UAAM,QAAQ,OAAO,OAAO,oBAAoB,EAAE;AAAA,EACpD;AAEA,SAAO,SAAS;AAClB;AAiBA,eAAsB,iBACpB,SACA,OACA,YACA,UACA,OACA,WACiB;AACjB,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,QAAM,cAAc,OAAO,OAAO,QAAM,cAAc,IAAI,YAAY,QAAQ,CAAC;AAE/E,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,MAAI,QAAQ;AACZ,aAAW,MAAM,aAAa;AAC5B,UAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAC3D,QAAI,CAAC,IAAK;AAEV,QAAI,YAAY,KAAK,SAAS,EAAG;AAIjC,UAAM,YAA+B;AAAA,MACnC,EAAE,YAAY,oBAAoB,IAAI,GAAI,QAAQ,EAAE,IAAI,MAAM,IAAI,CAAC,GAAI,SAAS,IAAI,GAAG;AAAA,MACvF,EAAE,IAAI,KAAK,IAAI,IAAI,MAAM,GAAG;AAAA,IAC9B;AACA,UAAM,QAAQ,IAAI,OAAO,oBAAoB,IAAI,SAAS;AAC1D;AAAA,EACF;AACA,SAAO;AACT;AA8CA,eAAsB,cACpB,SACA,OACA,YACA,UACA,SACA,OACA,UACe;AACf,QAAM,SAAS,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AAC3D,QAAM,cAAc,OAAO,OAAO,QAAM,cAAc,IAAI,YAAY,QAAQ,CAAC;AAE/E,aAAW,MAAM,aAAa;AAC5B,UAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAC3D,QAAI,CAAC,IAAK;AAEV,QAAI,iBAAiB,GAAG,EAAG;AAO3B,UAAM,WAAW;AAAA,MACf,YAAY;AAAA,MAAoB;AAAA,MAAI,SAAS,IAAI;AAAA,MACjD,GAAI,IAAI,UAAU,SAAY,EAAE,MAAM,IAAI,MAAM,IAAI,CAAC;AAAA,MACrD,GAAI,IAAI,QAAQ,SAAY,EAAE,IAAI,IAAI,IAAI,IAAI,CAAC;AAAA,IACjD;AACA,QAAI,MAAM,iBAAiB,UAAU,KAAK,KAAK,EAAG;AAElD,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,eAAe,UAAU,KAAK,SAAS,KAAK;AAAA,IAC3D,SAAS,KAAK;AACZ,UAAI,CAAC,SAAU,OAAM;AAGrB,aAAO,MAAM,eAAe,UAAU,KAAK,UAAU,KAAK;AAAA,IAC5D;AAEA,UAAM,QAAQ,IAAI,OAAO,oBAAoB,IAAI,IAAI;AAAA,EACvD;AACF;;;ACzHA,SAAS,WAAW,IAAmB;AACrC,SAAO,IAAI;AAAA,IACT,GAAG,EAAE;AAAA,EAGP;AACF;AAUO,IAAM,aAA8B;AAAA,EACzC,MAAM,cAAc;AAAA,EAAC;AAAA;AAAA;AAAA;AAAA,EAIrB,iBAAiB,CAAC,YAAY,UAAU,YAAY,gBAAgB,YAAY,UAAU,OAAO;AAAA,EACjG,MAAM,oBAAoB;AAAE,UAAM,WAAW,sBAAsB;AAAA,EAAE;AAAA,EACrE,MAAM,qBAAqB;AAAE,UAAM,WAAW,yBAAyB;AAAA,EAAE;AAAA,EACzE,MAAM,eAAe;AAAE,WAAO;AAAA,EAAE;AAAA,EAChC,MAAM,eAAe;AAAE,WAAO;AAAA,EAAE;AAAA,EAChC,MAAM,mBAAmB;AAAE,WAAO;AAAA,EAAE;AAAA,EACpC,MAAM,gBAAgB;AAAA,EAAC;AAAA,EACvB,MAAM,sBAAsB;AAAE,WAAO;AAAA,EAAG;AAAA,EACxC,eAAe;AAAE,WAAO,CAAC;AAAA,EAAE;AAAA,EAC3B,OAAO;AAAE,UAAM,WAAW,mBAAmB;AAAA,EAAE;AAAA,EAC/C,cAAc;AAAE,WAAO;AAAA,EAAK;AAAA,EAC5B,oBAAoB;AAAE,UAAM,WAAW,kCAAkC;AAAA,EAAE;AAC7E;","names":[]}

package/dist/{chunk-4VUPLMZ6.js → chunk-6FOGTKBY.js}

@@ -1,20 +1,20 @@
 import {
   pickLocale
-} from "./chunk-2BMRJ6LQ.js";
+} from "./chunk-LF6DMX4C.js";
 import {
   sha256Hex
-} from "./chunk-VCETL77O.js";
+} from "./chunk-W5LHQXZU.js";
 import {
-  BundleIntegrityError,
-  BundleSealMismatchError,
+  PodIntegrityError,
+  PodSealMismatchError,
   ValidationError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-JBIV4FLR.js";
 
 // src/with-pod/format.ts
-var NOYDB_BUNDLE_MAGIC = new Uint8Array([78, 68, 66, 49]);
-var NOYDB_BUNDLE_PREFIX_BYTES = 10;
-var NOYDB_BUNDLE_FORMAT_VERSION = 1;
-var NOYDB_BUNDLE_FORMAT_VERSION_SIGNED = 2;
+var NOYDB_POD_MAGIC = new Uint8Array([78, 68, 66, 49]);
+var NOYDB_POD_PREFIX_BYTES = 10;
+var NOYDB_POD_FORMAT_VERSION = 1;
+var NOYDB_POD_FORMAT_VERSION_SIGNED = 2;
 var FLAG_COMPRESSED = 1;
 var FLAG_HAS_INTEGRITY_HASH = 2;
 var COMPRESSION_NONE = 0;
@@ -63,7 +63,7 @@ var REDIRECT_REASONS = /* @__PURE__ */ new Set([
   "tombstone",
   "repoint"
 ]);
-function validateBundleHeader(parsed) {
+function validatePodHeaderFields(parsed) {
   if (parsed === null || typeof parsed !== "object") {
     throw new Error(
       `.noydb bundle header must be a JSON object, got ${parsed === null ? "null" : typeof parsed}`
@@ -77,9 +77,9 @@ function validateBundleHeader(parsed) {
     }
   }
   const h = parsed;
-  if (typeof h["formatVersion"] !== "number" || h["formatVersion"] !== NOYDB_BUNDLE_FORMAT_VERSION && h["formatVersion"] !== NOYDB_BUNDLE_FORMAT_VERSION_SIGNED) {
+  if (typeof h["formatVersion"] !== "number" || h["formatVersion"] !== NOYDB_POD_FORMAT_VERSION && h["formatVersion"] !== NOYDB_POD_FORMAT_VERSION_SIGNED) {
     throw new Error(
-      `.noydb bundle header.formatVersion must be ${NOYDB_BUNDLE_FORMAT_VERSION} or ${NOYDB_BUNDLE_FORMAT_VERSION_SIGNED}, got ${String(h["formatVersion"])}. The reader does not support forward-compat versions; upgrade the reader to handle newer bundles.`
+      `.noydb bundle header.formatVersion must be ${NOYDB_POD_FORMAT_VERSION} or ${NOYDB_POD_FORMAT_VERSION_SIGNED}, got ${String(h["formatVersion"])}. The reader does not support forward-compat versions; upgrade the reader to handle newer bundles.`
     );
   }
   if (typeof h["handle"] !== "string" || !/^[0-9A-HJKMNP-TV-Z]{26}$/.test(h["handle"])) {
@@ -264,14 +264,14 @@ function validateBundleHeader(parsed) {
       `.noydb bundle header.sig, .keyId, and .sigAlg must be present together or not at all (got ${sigFieldsPresent} of 3).`
     );
   }
-  if (sigFieldsPresent === 3 && h["formatVersion"] !== NOYDB_BUNDLE_FORMAT_VERSION_SIGNED) {
+  if (sigFieldsPresent === 3 && h["formatVersion"] !== NOYDB_POD_FORMAT_VERSION_SIGNED) {
     throw new Error(
-      `.noydb bundle header with sig/keyId/sigAlg must have formatVersion === ${NOYDB_BUNDLE_FORMAT_VERSION_SIGNED}, got ${String(h["formatVersion"])}.`
+      `.noydb bundle header with sig/keyId/sigAlg must have formatVersion === ${NOYDB_POD_FORMAT_VERSION_SIGNED}, got ${String(h["formatVersion"])}.`
     );
   }
 }
-function encodeBundleHeader(header) {
-  validateBundleHeader(header);
+function encodePodHeader(header) {
+  validatePodHeaderFields(header);
   const json = JSON.stringify({
     formatVersion: header.formatVersion,
     handle: header.handle,
@@ -297,7 +297,7 @@ function encodeBundleHeader(header) {
   });
   return new TextEncoder().encode(json);
 }
-function decodeBundleHeader(bytes) {
+function decodePodHeader(bytes) {
   const json = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
   let parsed;
   try {
@@ -307,7 +307,7 @@ function decodeBundleHeader(bytes) {
       `.noydb bundle header is not valid JSON: ${err.message}`
     );
   }
-  validateBundleHeader(parsed);
+  validatePodHeaderFields(parsed);
   return parsed;
 }
 function readUint32BE(bytes, offset) {
@@ -319,10 +319,10 @@ function writeUint32BE(bytes, offset, value) {
   bytes[offset + 2] = value >>> 8 & 255;
   bytes[offset + 3] = value & 255;
 }
-function hasNoydbBundleMagic(bytes) {
-  if (bytes.length < NOYDB_BUNDLE_MAGIC.length) return false;
-  for (let i = 0; i < NOYDB_BUNDLE_MAGIC.length; i++) {
-    if (bytes[i] !== NOYDB_BUNDLE_MAGIC[i]) return false;
+function hasNoydbPodMagic(bytes) {
+  if (bytes.length < NOYDB_POD_MAGIC.length) return false;
+  for (let i = 0; i < NOYDB_POD_MAGIC.length; i++) {
+    if (bytes[i] !== NOYDB_POD_MAGIC[i]) return false;
   }
   return true;
 }
@@ -340,7 +340,7 @@ async function verifyRecord(publicKeyB64, sig, payload) {
   return ed25519Verify(publicKeyB64, sig, signedBytes(payload));
 }
 
-// src/with-pod/bundle.ts
+// src/with-pod/pod.ts
 var WRITE_POD_OPTION_KEYS = [
   "compression",
   "collections",
@@ -447,7 +447,7 @@ function validateAutoUnlockOptions(opts, normalized) {
     const provider = normalized.provider;
     if (provider === void 0 || typeof provider.publishRecipientHint !== "function" || typeof provider.sealForRecipient !== "function") {
       throw new ValidationError(
-        "writePod: `sealedCredentials.provider` for mode 'recipient-target' must be a RecipientSealer (publishRecipientHint + sealForRecipient). Self-only providers (MemorySealingKeyProvider, at-macos-keychain, etc.) do not satisfy this contract."
+        "writePod: `sealedCredentials.provider` for mode 'recipient-target' must be a RecipientSealer (publishRecipientHint + sealForRecipient). Self-only providers (MemorySealer, at-macos-keychain, etc.) do not satisfy this contract."
       );
     }
     const hints = normalized.hints;
@@ -493,7 +493,7 @@ function validateAutoUnlockOptions(opts, normalized) {
   }
   if (normalized.provider === void 0) {
     throw new ValidationError(
-      "writePod: `sealedCredentials.provider` (or `sealedSecrets.provider`) is required (a `SealingKeyProvider`)."
+      "writePod: `sealedCredentials.provider` (or `sealedSecrets.provider`) is required (a `NoydbSealer`)."
     );
   }
   const userCount = Object.keys(normalized.perUser).length;
@@ -562,30 +562,30 @@ function parseAutoUnlockBody(bodyString) {
   try {
     parsed = JSON.parse(bodyString);
   } catch (err) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       "header declared autoUnlock but body could not be parsed as JSON wrapper: " + (err instanceof Error ? err.message : String(err))
     );
   }
   if (typeof parsed !== "object" || parsed === null) {
-    throw new BundleIntegrityError("autoUnlock body is not a JSON object");
+    throw new PodIntegrityError("autoUnlock body is not a JSON object");
   }
   const obj = parsed;
   if (obj["_noydb_bundle_body"] !== 1) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       "autoUnlock body missing `_noydb_bundle_body: 1` discriminator"
     );
   }
   if (typeof obj["dump"] !== "string") {
-    throw new BundleIntegrityError("autoUnlock body must carry a string `dump` field");
+    throw new PodIntegrityError("autoUnlock body must carry a string `dump` field");
   }
   const blob = obj["_autoUnlock"];
   if (typeof blob !== "object" || blob === null) {
-    throw new BundleIntegrityError("autoUnlock body missing `_autoUnlock` blob");
+    throw new PodIntegrityError("autoUnlock body missing `_autoUnlock` blob");
   }
   const blobObj = blob;
   const kind = blobObj["kind"];
   if (kind !== "unsealed" && kind !== "sealed") {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       `autoUnlock blob has invalid kind ${String(kind)}; expected 'unsealed' or 'sealed'`
     );
   }
@@ -602,29 +602,29 @@ function parseExtractedPartitionBody(bodyString) {
   try {
     parsed = JSON.parse(bodyString);
   } catch (err) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       "header declared extracted-partition but body could not be parsed as JSON wrapper: " + (err instanceof Error ? err.message : String(err))
     );
   }
   if (typeof parsed !== "object" || parsed === null) {
-    throw new BundleIntegrityError("extracted-partition body is not a JSON object");
+    throw new PodIntegrityError("extracted-partition body is not a JSON object");
   }
   const obj = parsed;
   if (obj["_noydb_bundle_body"] !== 1) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       "extracted-partition body missing `_noydb_bundle_body: 1` discriminator"
     );
   }
   if (typeof obj["dump"] !== "string") {
-    throw new BundleIntegrityError("extracted-partition body must carry a string `dump` field");
+    throw new PodIntegrityError("extracted-partition body must carry a string `dump` field");
   }
   const seal = obj["_transferSeal"];
   if (typeof seal !== "object" || seal === null) {
-    throw new BundleIntegrityError("extracted-partition body missing `_transferSeal` blob");
+    throw new PodIntegrityError("extracted-partition body missing `_transferSeal` blob");
   }
   const s = seal;
   if (s["v"] !== 1 || s["alg"] !== "aes-256-gcm-pre-shared" || typeof s["sealId"] !== "string" || typeof s["payload"] !== "string") {
-    throw new BundleIntegrityError("extracted-partition `_transferSeal` blob is malformed");
+    throw new PodIntegrityError("extracted-partition `_transferSeal` blob is malformed");
   }
   return { dump: obj["dump"], seal };
 }
@@ -670,7 +670,7 @@ async function resolveAutoUnlock(blob, opts) {
             unsealedMap[userId] = { kind: credKind, value: entry.sealed };
             continue;
           }
-          throw new BundleSealMismatchError(userId, entry.pid);
+          throw new PodSealMismatchError(userId, entry.pid);
         }
         unsealedMap[userId] = { kind: credKind, value: opened };
         continue;
@@ -679,7 +679,7 @@ async function resolveAutoUnlock(blob, opts) {
         unsealedMap[userId] = { kind: credKind, value: entry.sealed };
         continue;
       }
-      throw new BundleSealMismatchError(userId, entry.pid);
+      throw new PodSealMismatchError(userId, entry.pid);
     }
     const plaintextBytes = await provider.unseal(base64ToBytes(entry.sealed));
     unsealedMap[userId] = { kind: credKind, value: decoder.decode(plaintextBytes) };
@@ -812,7 +812,7 @@ async function applySatelliteLivenessFilter(vault, dumpJson) {
   if (!backup.collections || typeof backup.collections !== "object") return dumpJson;
   if (typeof vault._introspectState !== "function") return dumpJson;
   const { adapter, name, getDEK } = vault._introspectState();
-  const { liveBaseIdSetsForBundle } = await import("./dead-filter-DCB62VWW.js");
+  const { liveBaseIdSetsForBundle } = await import("./dead-filter-QKU56XTQ.js");
   const satLive = await liveBaseIdSetsForBundle(adapter, name, Object.keys(backup.collections), getDEK);
   if (satLive.size === 0) return dumpJson;
   const next = {};
@@ -852,7 +852,8 @@ async function applyPlaintextFilters(vault, dumpJson, opts) {
       if (where !== void 0) {
         const record = await vault._decryptEnvelopeForBundleFilter(
           env,
-          collName
+          collName,
+          id
         );
         const ok = await where(record, { collection: collName, id });
         if (!ok) continue;
@@ -864,13 +865,13 @@ async function applyPlaintextFilters(vault, dumpJson, opts) {
   backup.collections = next;
   return JSON.stringify(backup);
 }
-async function assembleBundleContainer(opts) {
+async function assemblePodContainer(opts) {
   const dumpBytes = new TextEncoder().encode(opts.bodyJsonStr);
   const { format, streamFormat } = selectCompression(opts.compression);
   const body = streamFormat === null ? dumpBytes : await pumpThroughStream(dumpBytes, new CompressionStream(streamFormat));
   const bodySha256 = await sha256Hex2(body);
   const header = {
-    formatVersion: NOYDB_BUNDLE_FORMAT_VERSION,
+    formatVersion: NOYDB_POD_FORMAT_VERSION,
     handle: opts.handle,
     bodyBytes: body.length,
     bodySha256,
@@ -886,13 +887,13 @@ async function assembleBundleContainer(opts) {
     ...opts.headerExtras?.redirect !== void 0 ? { redirect: opts.headerExtras.redirect } : {}
   };
   const signed = opts.signer === void 0 ? header : await (async (s) => {
-    const toSign = { ...header, formatVersion: NOYDB_BUNDLE_FORMAT_VERSION_SIGNED, keyId: s.keyId, sigAlg: "ed25519" };
+    const toSign = { ...header, formatVersion: NOYDB_POD_FORMAT_VERSION_SIGNED, keyId: s.keyId, sigAlg: "ed25519" };
     const sig = await signRecord(s.privateKeyPkcs8B64, toSign);
     return { ...toSign, sig };
   })(opts.signer);
-  const headerBytes = encodeBundleHeader(signed);
-  const prefix = new Uint8Array(NOYDB_BUNDLE_PREFIX_BYTES);
-  prefix.set(NOYDB_BUNDLE_MAGIC, 0);
+  const headerBytes = encodePodHeader(signed);
+  const prefix = new Uint8Array(NOYDB_POD_PREFIX_BYTES);
+  prefix.set(NOYDB_POD_MAGIC, 0);
   prefix[4] = (streamFormat === null ? 0 : FLAG_COMPRESSED) | FLAG_HAS_INTEGRITY_HASH;
   prefix[5] = format;
   writeUint32BE(prefix, 6, headerBytes.length);
@@ -907,7 +908,7 @@ async function writePod(vault, opts = {}) {
   }
   const normalizedAutoUnlock = normalizeAutoUnlock(opts);
   const autoUnlockMode = validateAutoUnlockOptions(opts, normalizedAutoUnlock);
-  const handle = await vault.getBundleHandle();
+  const handle = await vault.getPodHandle();
   const dumpJson = await vault.dump();
   const satelliteFiltered = await applySatelliteLivenessFilter(vault, dumpJson);
   const rekeyed = await applyRecipientRewrap(vault, satelliteFiltered, opts);
@@ -916,7 +917,7 @@ async function writePod(vault, opts = {}) {
   const bodyJsonStr = normalizedAutoUnlock === null ? filtered : JSON.stringify(await buildAutoUnlockWrapper(filtered, normalizedAutoUnlock));
   const cover = await vault.getCover();
   const signer = opts.sign === false ? void 0 : opts.sign !== void 0 ? opts.sign : await vault._loadPodSigner() ?? void 0;
-  return assembleBundleContainer({
+  return assemblePodContainer({
     handle,
     bodyJsonStr,
     compression: opts.compression,
@@ -935,16 +936,15 @@ async function writePod(vault, opts = {}) {
     ...signer !== void 0 ? { signer } : {}
   });
 }
-var writeNoydbBundle = writePod;
 function parsePrefixAndHeader(bytes) {
-  if (!hasNoydbBundleMagic(bytes)) {
+  if (!hasNoydbPodMagic(bytes)) {
     throw new Error(
       `Not a .noydb bundle: missing 'NDB1' magic prefix. The first 4 bytes are ${[...bytes.slice(0, 4)].map((b) => b.toString(16).padStart(2, "0")).join(" ")}.`
     );
   }
-  if (bytes.length < NOYDB_BUNDLE_PREFIX_BYTES) {
+  if (bytes.length < NOYDB_POD_PREFIX_BYTES) {
     throw new Error(
-      `Truncated .noydb bundle: file is only ${bytes.length} bytes, which is less than the ${NOYDB_BUNDLE_PREFIX_BYTES}-byte fixed prefix.`
+      `Truncated .noydb bundle: file is only ${bytes.length} bytes, which is less than the ${NOYDB_POD_PREFIX_BYTES}-byte fixed prefix.`
     );
   }
   const flags = bytes[4];
@@ -955,20 +955,19 @@ function parsePrefixAndHeader(bytes) {
     );
   }
   const headerLength = readUint32BE(bytes, 6);
-  const bodyOffset = NOYDB_BUNDLE_PREFIX_BYTES + headerLength;
+  const bodyOffset = NOYDB_POD_PREFIX_BYTES + headerLength;
   if (bodyOffset > bytes.length) {
     throw new Error(
       `Truncated .noydb bundle: declared header length ${headerLength} would extend past end of file (${bytes.length} bytes).`
     );
   }
-  const headerBytes = bytes.slice(NOYDB_BUNDLE_PREFIX_BYTES, bodyOffset);
-  const header = decodeBundleHeader(headerBytes);
+  const headerBytes = bytes.slice(NOYDB_POD_PREFIX_BYTES, bodyOffset);
+  const header = decodePodHeader(headerBytes);
   return { header, bodyOffset, algo, flags };
 }
 function readPodHeader(bytes) {
   return parsePrefixAndHeader(bytes).header;
 }
-var readNoydbBundleHeader = readPodHeader;
 async function verifyPodHeader(bytes, trustedKeys) {
   const { header } = parsePrefixAndHeader(bytes);
   if (header.sig === void 0 || header.keyId === void 0 || header.sigAlg === void 0) {
@@ -1001,13 +1000,13 @@ async function readPod(bytes, opts = {}) {
   const { header, bodyOffset, algo } = parsePrefixAndHeader(bytes);
   const body = bytes.slice(bodyOffset);
   if (body.length !== header.bodyBytes) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       `body length ${body.length} does not match header.bodyBytes ${header.bodyBytes}. The bundle was truncated or padded between write and read.`
     );
   }
   const actualSha = await sha256Hex2(body);
   if (actualSha !== header.bodySha256) {
-    throw new BundleIntegrityError(
+    throw new PodIntegrityError(
       `body sha256 ${actualSha} does not match header.bodySha256 ${header.bodySha256}. The bundle bytes were modified between write and read \u2014 refuse to decompress.`
     );
   }
@@ -1019,7 +1018,7 @@ async function readPod(bytes, opts = {}) {
     try {
       dumpBytes = await pumpThroughStream(body, new DecompressionStream(streamFormat));
     } catch (err) {
-      throw new BundleIntegrityError(
+      throw new PodIntegrityError(
         `decompression failed: ${err.message}. The bundle passed the integrity hash but the body is not valid ${streamFormat} data \u2014 likely a producer bug.`
       );
     }
@@ -1032,20 +1031,19 @@ async function readPod(bytes, opts = {}) {
   const autoUnlock = await resolveAutoUnlock(blob, opts);
   return { header, dumpJson: dump, autoUnlock };
 }
-var readNoydbBundle = readPod;
 
 export {
-  NOYDB_BUNDLE_MAGIC,
-  NOYDB_BUNDLE_PREFIX_BYTES,
-  NOYDB_BUNDLE_FORMAT_VERSION,
+  NOYDB_POD_MAGIC,
+  NOYDB_POD_PREFIX_BYTES,
+  NOYDB_POD_FORMAT_VERSION,
   FLAG_COMPRESSED,
   FLAG_HAS_INTEGRITY_HASH,
   COMPRESSION_NONE,
   COMPRESSION_GZIP,
   COMPRESSION_BROTLI,
-  validateBundleHeader,
-  encodeBundleHeader,
-  hasNoydbBundleMagic,
+  validatePodHeaderFields,
+  encodePodHeader,
+  hasNoydbPodMagic,
   POD_SIG_ALG,
   signedBytes,
   signRecord,
@@ -1053,15 +1051,12 @@ export {
   buildExtractedPartitionWrapper,
   parseExtractedPartitionBody,
   resetBrotliSupportCache,
-  assembleBundleContainer,
+  assemblePodContainer,
   writePod,
-  writeNoydbBundle,
   readPodHeader,
-  readNoydbBundleHeader,
   verifyPodHeader,
   readPodCover,
   readPodRedirect,
-  readPod,
-  readNoydbBundle
+  readPod
 };
-//# sourceMappingURL=chunk-4VUPLMZ6.js.map
+//# sourceMappingURL=chunk-6FOGTKBY.js.map