@noy-db/hub 0.6.0-pre.9 → 0.7.0-pre.0

package/dist/kernel/query/predicate.d.ts

@@ -106,6 +106,15 @@ export interface CrossJoinClause {
     readonly onPredicateName?: string;
     /** Per-clause row ceiling override. `undefined` → `DEFAULT_CROSS_JOIN_MAX_ROWS`. */
     readonly maxRows?: number;
+    /**
+     * Left-outer mode (#1130). When the `on:` subset for a left row is empty,
+     * emit that row once with `null` under `as` instead of dropping it.
+     *
+     * Applies to both call shapes. With `on:` the empty thing is that left
+     * row's subset; without it, an empty TARGET collection is what would
+     * otherwise drop every left row.
+     */
+    readonly outer?: boolean;
 }
 export type Clause = FieldClause | FilterClause | WherePredicateClause | GroupClause | CrossJoinClause;
 /**

package/dist/kernel/refs.d.ts

@@ -2,7 +2,9 @@
  * Foreign-key references — the soft-FK mechanism.
  *
  * A collection declares its references as metadata at construction
- * time:
+ * time. A declaration made on an already-constructed collection is
+ * late-attached rather than dropped (#1141) — an identical redeclaration is a
+ * no-op, a conflicting one throws:
  *
  * ```ts
  * import { ref } from '@noy-db/hub'

package/dist/kernel/secret-mode.d.ts

@@ -52,7 +52,7 @@ export declare function resolveEffectiveSecret(options: NoydbOptions, store: Noy
 export declare function ownerKeyringOptions(options: NoydbOptions, secret: string | EchoSecretParts): {
     echoMaskHint?: string;
     echoSecretPolicy?: import("./validation.js").EchoSecretPolicy;
-    deviceSeal?: import("../index.js").DeviceSealProvider;
+    deviceSeal?: import("../index.js").NoydbDeviceSeal;
     userId: string;
     secret: string | EchoSecretParts;
     validate: boolean;

package/dist/kernel/sync-policy.d.ts

@@ -119,8 +119,6 @@ export interface SyncPolicy {
 export declare const INDEXED_STORE_POLICY: SyncPolicy;
 /** Default for bundle stores (Drive, WebDAV, Git). */
 export declare const POD_STORE_POLICY: SyncPolicy;
-/** @deprecated Use `POD_STORE_POLICY`. */
-export declare const BUNDLE_STORE_POLICY: SyncPolicy;
 /**
  * Current operational state of the `SyncScheduler`.
  *

package/dist/kernel/tier-visibility.d.ts

@@ -52,3 +52,37 @@ export declare function assertTierWritable(adapter: NoydbStore, vault: string, n
  * explicit for concurrent writes generally.
  */
 export declare function assertCutoverTierSafe(adapter: NoydbStore, vault: string, name: string, tiersEnabled: boolean): Promise<void>;
+/**
+ * The key a collection's DEK is stored under in `UnlockedKeyring.deks` for a
+ * given tier: `collection` at tier 0, `collection#N` above it.
+ *
+ * Lives in the kernel because the `deks` map is a kernel type and the kernel
+ * reads it — `noydb.ts` needs this to resolve the right DEK when verifying a
+ * pulled envelope (#1042). `with-party/team/tiers.ts` re-exports it, so every
+ * existing importer is unchanged; the definition simply moved to the layer that
+ * owns the map rather than one that happens to use it.
+ *
+ * This move was forced by `port-layering`, and rightly: the alternative was the
+ * kernel spine statically importing a `with-*` service, or duplicating the
+ * naming convention in two places where it could drift.
+ */
+export declare function dekKey(collection: string, tier: number): string;
+/**
+ * Inverse of {@link dekKey}: split a DEK slot name back into the collection it
+ * belongs to and the tier it covers.
+ *
+ * Needed because a tier slot **names a key, not a collection** (#1125).
+ * `store.list(vault, "docs#1")` is empty — elevated records live in `docs`
+ * alongside their tier-0 siblings, distinguished by the envelope `_tier` field.
+ * Anything that walks a slot's data must walk `collection` and select within it,
+ * never list the slot name.
+ *
+ * Parsed from the RIGHT, requiring an all-digit positive suffix. A name that
+ * does not fit that shape is a plain collection at tier 0 — including one that
+ * merely contains a `#`, which round-trips correctly precisely because `dekKey`
+ * never produces `#0`.
+ */
+export declare function parseDekKey(slot: string): {
+    collection: string;
+    tier: number;
+};

package/dist/kernel/types.d.ts

@@ -34,6 +34,7 @@ import type { PeriodsStrategy } from '../with-audit/periods/strategy.js';
 import type { ShadowStrategy } from '../with-fork/shadow/strategy.js';
 import type { TransactionsStrategy } from '../with-commit/tx/strategy.js';
 import type { HistoryStrategy } from '../with-commit/history/strategy.js';
+import type { VaultHeadStrategy } from '../with-commit/vault-head/strategy.js';
 import type { ForgetStrategy } from '../with-audit/forget/strategy.js';
 import type { SnapshotsStrategy } from '../with-fork/snapshots/strategy.js';
 import type { DerivationSkippedFrozen } from './via/dispatch.js';
@@ -59,19 +60,20 @@ import type { SecretPolicy, EchoSecretPolicy } from './validation.js';
 import type { CoverSchema } from '../with-party/directory/cover/types.js';
 import type { MaterializedViewStrategy } from '../with-formula/materialized-views/types.js';
 import type { OverlayedViewStrategy } from '../with-formula/overlay-views/types.js';
-import type { SealingKeyProvider, RecipientHint } from '../with-party/team/managed-secret.js';
-import type { ShamirRecoveryProvider } from '../with-party/team/shamir-recovery-provider.js';
+import type { NoydbSealer, RecipientHint } from '../with-party/team/managed-secret.js';
+import type { NoydbShamir } from '../with-party/team/noydb-shamir.js';
 import type { ObjectProjection } from '../with-shape/blobs/object-projection.js';
-import type { CoordinationProvider } from '../port/by/types.js';
+import type { FormatsStrategy } from '../port/with/formats-strategy.js';
+import type { NoydbMesh } from '../port/by/types.js';
 import type { ScriptWarning } from '../port/with/i18n-strategy.js';
 import type { ViaDescriptor } from './via/index.js';
 import type { EnclaveKey, EchoSecretParts } from './enclave/index.js';
-import type { DeviceSealProvider } from '../port/with/device-seal-strategy.js';
+import type { NoydbDeviceSeal } from '../port/with/device-seal-strategy.js';
 export type { EchoSecretParts };
 /** Format version for encrypted record envelopes. */
 export declare const NOYDB_FORMAT_VERSION: 1;
 /** Format version for keyring files. */
-export declare const NOYDB_KEYRING_VERSION: 1;
+export declare const NOYDB_KEYRING_VERSION: 2;
 /** Format version for backup files. */
 export declare const NOYDB_BACKUP_VERSION: 1;
 /** Format version for sync metadata. */
@@ -403,7 +405,7 @@ export declare class SealedHandle<V> implements Sealed<V> {
  * implement this — the §11.2 capability matrix lives in the type system.
  *
  * Per foundation §11.4. A function that requires recipient-target sealing
- * takes `RecipientSealer`, not `SealingKeyProvider` — the compiler rejects
+ * takes `RecipientSealer`, not `NoydbSealer` — the compiler rejects
  * passing a self-only provider at the spec site.
  */
 export interface RecipientSealer {
@@ -412,7 +414,7 @@ export interface RecipientSealer {
     publishRecipientHint(): Promise<RecipientHint>;
     /**
      * Seal plaintext for the recipient described by `hint`. Returns opaque
-     * bytes — same contract as `SealingKeyProvider.seal()`. The bundle
+     * bytes — same contract as `NoydbSealer.seal()`. The bundle
      * layer base64-encodes the bytes into `SealedAutoUnlockEntry.sealed`
      * without inspecting them.
      */
@@ -704,8 +706,20 @@ export declare function createStore<TOptions>(factory: (options: TOptions) => No
 /**
  * Interchange formats `@noy-db/as-*` packages can produce. `'*'` is a
  * wildcard granting every current + future plaintext format.
+ *
+ * OPEN, not closed. The literals below are the formats hub ships bindings
+ * for and exist so editors autocomplete them; `(string & {})` admits any
+ * other `NoydbFormat.id`, including one from a third-party package hub has
+ * never heard of. Closing this union would mean a third-party format could
+ * be *checked* by `assertCanExport` but never *granted* — forcing owners
+ * onto the `'*'` wildcard, which is strictly worse than a name hub does
+ * not recognise.
+ *
+ * The cost, stated: a typo in a grant (`'csvv'`) typechecks. It then fails
+ * closed at runtime, because the gate is an exact-match lookup — the safe
+ * direction for a security capability.
  */
-export type ExportFormat = 'xlsx' | 'csv' | 'json' | 'ndjson' | 'xml' | 'sql' | 'pdf' | 'blob' | 'zip' | '*';
+export type ExportFormat = 'xlsx' | 'csv' | 'json' | 'ndjson' | 'xml' | 'sql' | 'pdf' | 'blob' | 'zip' | '*' | (string & {});
 /**
  * Owner-granted export capability on a keyring.
  *
@@ -908,6 +922,21 @@ export interface KeyringFile {
     readonly role: Role;
     readonly permissions: Permissions;
     readonly deks: Record<string, string>;
+    /**
+     * DEKs for a rotation that has STARTED but not committed (#1074).
+     *
+     * `rotateKeys` persists the new DEK here *before* rewriting any record, so an
+     * interruption can never strand records under a key that was only ever in
+     * memory. On commit these move into `deks` and this is cleared.
+     *
+     * Present on disk ⇒ a rotation was interrupted and the collection may hold
+     * records on both sides of the migration. Re-running `rotateKeys` resumes
+     * with this key rather than minting a fresh one.
+     *
+     * Optional: absent on every keyring written before this existed, and absent
+     * in the normal committed state.
+     */
+    readonly pending_deks?: Record<string, string>;
     readonly salt: string;
     readonly created_at: string;
     readonly granted_by: string;
@@ -915,17 +944,31 @@ export interface KeyringFile {
      * Secret canary — base64 AES-KW-wrapped form of a known constant
      * 256-bit value, wrapped under the keyring's KEK.
      *
-     * Optional: older keyrings load with no canary and fall back to
-     * the multi-DEK corruption heuristic. Newer keyrings
-     * carry one and let `loadKeyring` distinguish wrong-secret
-     * from corruption even when ALL DEKs (including a single-DEK keyring's
-     * sole DEK) are corrupted.
+     * Lets `loadKeyring` distinguish wrong-secret from corruption even when
+     * ALL DEKs (including a single-DEK keyring's sole DEK) are corrupted: the
+     * canary unwrapping proves the KEK correct independent of any DEK byte.
      *
      * AES-KW is deterministic — every write site mints fresh on each
      * persist; same KEK + same constant input always produces the same
      * ciphertext, so this round-trips without state.
+     *
+     * REQUIRED as of #1096 (no-legacy policy): the pre-canary fallback
+     * heuristic is deleted, so an absent canary is not an old file, it is a
+     * store that stripped the field — `KeyringTamperedError('canary-missing')`.
+     */
+    readonly canary: string;
+    /**
+     * #1096 — AES-GCM({iv,data}) of the canonical authority fields
+     * (user_id, role, permissions, granted_by, expires_at, capabilities)
+     * under the vault roster key (carried as `deks[ROSTER_KEY_ID]`).
+     * Required: a valid canary with a missing or mismatching tag is refused
+     * as KeyringTamperedError — absence must itself be an error, or a store
+     * opts out of verification by deleting a plaintext field.
      */
-    readonly canary?: string;
+    readonly roster_tag: {
+        readonly iv: string;
+        readonly data: string;
+    };
     /**
      * Tier-2 authenticator slots (multi-slot keyring extension).
      * Optional / append-only: keyring files written before the
@@ -956,7 +999,7 @@ export interface KeyringFile {
      * "this slot works for 30 days then becomes opaque to its holder."
      *
      * Absent on live keyrings written via `db.grant()` — the field is
-     * meaningful for `BundleRecipient` slots produced by
+     * meaningful for `PodRecipient` slots produced by
      * `writePod({ recipients: [...] })`. Setting it on a live
      * keyring is allowed but unusual.
      */
@@ -1284,9 +1327,38 @@ export interface SyncTransactionResult {
 }
 export interface SyncStatus {
     readonly dirty: number;
+    /**
+     * ISO 8601 timestamp of the last push that completed with **no errors**, or
+     * `null` if none ever has (#1036). A failed attempt does not advance it — so
+     * this answers "when did my data last reach the remote?", which is the reading
+     * the name invites and the one the field previously did not honour.
+     */
     readonly lastPush: string | null;
+    /** As {@link SyncStatus.lastPush}, for pulls: last pull that had no errors. */
     readonly lastPull: string | null;
+    /**
+     * Whether the **browser** reports network connectivity — driven solely by the
+     * global `online`/`offline` events (#1034). It is NOT target reachability: an
+     * unreachable store never flips it, and losing Wi-Fi flips it for every target
+     * at once. To detect a failing target, read {@link SyncStatus.lastError}.
+     */
     readonly online: boolean;
+    /**
+     * The failure that ended the most recent push/pull, cleared by the next
+     * success (#1036). **Absent** when nothing has failed since the last success —
+     * so `lastPush: null` with no `lastError` means "never synced", while
+     * `lastPush` set plus a `lastError` means "synced then, failing since".
+     *
+     * Live state, not persisted: a reload cannot know whether the target still
+     * fails, so it starts absent until the next attempt says otherwise.
+     */
+    readonly lastError?: {
+        /** ISO 8601 timestamp of the failed attempt. */
+        readonly at: string;
+        readonly op: 'push' | 'pull';
+        /** Message of the first error the attempt collected. */
+        readonly message: string;
+    };
     /**
      * Per-collection readiness under a `'phased'` pull policy (#809). **Absent**
      * for every other policy, and a collection the sequence never names is absent
@@ -1329,6 +1401,41 @@ export interface SyncTarget {
  * (#948). Deliberately omits any preset *name* — a resolved `SyncPolicy` doesn't
  * retain which preset (if any) it came from, so only its push/pull mode is surfaced.
  */
+/**
+ * Per-target sync state (#1034). `syncStatus()` answers for the vault as a
+ * whole; this answers per target, which is what a redundant topology needs in
+ * order to say "the LAN store is unavailable — syncing via the cloud" rather
+ * than just "something is wrong".
+ *
+ * Deliberately carries **no `online` flag.** `SyncStatus.online` reflects the
+ * *browser's* global connectivity — it is set only by the `online`/`offline`
+ * window events and no store outcome ever changes it, so every engine flips at
+ * once for the same reason. Exposing it per target would make a global signal
+ * look per-target: a status list would appear to update row by row while every
+ * row actually moved together. Per-target *reachability* derived from real
+ * store outcomes is a separate, still-unbuilt thing.
+ */
+export interface SyncTargetStatus {
+    /** As registered. `undefined` when the target was declared without one. */
+    readonly label: string | undefined;
+    readonly role: SyncTargetRole;
+    /** Pending local writes for this target. */
+    readonly dirty: number;
+    /** Last push that completed with no errors, or `null`. See {@link SyncStatus.lastPush}. */
+    readonly lastPush: string | null;
+    /** Last pull that completed with no errors, or `null`. */
+    readonly lastPull: string | null;
+    /**
+     * Nothing queued for this target — `dirty === 0`.
+     *
+     * Well-defined for every role: for a `sync-peer` it means the two sides
+     * agree as of the last exchange; for a push-only `backup` it means every
+     * local write has reached it. It is a statement about the *outbound* queue
+     * only, and says nothing about whether the target holds data this client has
+     * not pulled.
+     */
+    readonly caughtUp: boolean;
+}
 export interface SyncTargetInfo {
     readonly label: string | undefined;
     readonly role: SyncTargetRole;
@@ -1544,7 +1651,6 @@ export interface UpdateUserOptions {
 }
 export interface RevokeOptions {
     readonly userId: string;
-    readonly rotateKeys?: boolean;
     /**
      * Cascade behavior when the revoked user is an admin who has granted
      * other admins.
@@ -1868,10 +1974,10 @@ export interface CrdtStrategy {
  * that operate on whole-vault bundles rather than per-record KV.
  *
  * Implement `readBundle` / `writeBundle` instead of the six-method KV
- * contract. Use `wrapBundleStore()` from `@noy-db/hub` to convert to a
+ * contract. Use `wrapPodStore()` from `@noy-db/hub` to convert to a
  * `NoydbStore` that the rest of the API consumes transparently.
  *
- * Named `NoydbPodStore` (not `NoydbBundleAdapter`) for consistency
+ * Named `NoydbPodStore` for consistency
  * with the hub / to-* / in-* rename. Concrete implementations ship
  * in `@noy-db/to-*` packages starting in.
  */
@@ -1907,8 +2013,6 @@ export interface NoydbPodStore {
         size: number;
     }>>;
 }
-/** @deprecated Use `NoydbPodStore`. */
-export type NoydbBundleStore = NoydbPodStore;
 /**
  * Content-addressed blob object stored in the vault-level blob index.
  * Identified by HMAC-SHA-256(blobDEK, plaintext) — opaque to the store.
@@ -2354,6 +2458,13 @@ export interface NoydbOptions {
      * @internal
      */
     readonly historyStrategy?: HistoryStrategy;
+    /**
+     * #1044 — opt in to the vault head, which detects a store that WITHHOLDS.
+     * `withVaultHead()` from `@noy-db/hub/vault-head`. Costs one small write per
+     * commit; on a single-device offline vault it defends against nothing, which
+     * is why it is opt-in while AAD is not.
+     */
+    readonly vaultHeadStrategy?: VaultHeadStrategy;
     /**
      * GDPR right-to-erasure. Pass `withForget({ subjects })`
      * from `@noy-db/hub/forget` to declare which collections carry erasable
@@ -2663,13 +2774,13 @@ export interface NoydbOptions {
      * (`@noy-db/seal-macos-keychain`, `@noy-db/seal-wincred`,
      * `@noy-db/seal-libsecret`, `@noy-db/seal-aws-kms`, …).
      */
-    readonly sealingKey?: SealingKeyProvider;
+    readonly sealingKey?: NoydbSealer;
     /**
      * Device-local sealer for the echo reveal-blob. Echo mode only.
      * Absent ⇒ live keyrings enroll `reveal: 'portable'`; present ⇒
      * `sealed` (attacker-B resistance). Spec resolved question 4.
      */
-    readonly deviceSeal?: DeviceSealProvider;
+    readonly deviceSeal?: NoydbDeviceSeal;
     /**
      * Echo enrollment only: optional display hint for the masked echo,
      * threaded to the owner keyring's `KeyringEchoBlock.mask_hint` (surfaced
@@ -2683,7 +2794,7 @@ export interface NoydbOptions {
     readonly echoMaskHint?: string;
     /** Required to use `profile: 'shamir'` recovery. Pass
      *  `shamirRecoveryProvider()` from `@noy-db/on-shamir`. */
-    readonly shamirRecovery?: ShamirRecoveryProvider;
+    readonly shamirRecovery?: NoydbShamir;
     /** Enable encryption. Default: true. */
     readonly encrypt?: boolean;
     /**
@@ -2832,20 +2943,26 @@ export interface NoydbOptions {
     readonly plaintextTranslatorName?: string;
     /**
      * Drain-barrier coordination transport for the schema fence.
-     * When omitted, the kernel uses a {@link CoordinationProvider} backed by the
-     * primary store (`StoreCoordinationProvider`), reproducing today's
+     * When omitted, the kernel uses a {@link NoydbMesh} backed by the
+     * primary store (`StoreMesh`), reproducing today's
      * store-polling fence behavior byte-for-byte. `@noy-db/by-tabs` /
      * `@noy-db/by-peer` inject a real-time push transport here; an external
      * orchestrator (`@klum-db/lobby`) drives it through the `Noydb` handle.
      *
      * @internal
      */
-    readonly coordinationStrategy?: CoordinationProvider;
+    /**
+     * Enables `vault.export(format)` / `vault.import(format, input)` — the
+     * `as-*` format port. Opt-in: a vault that never exports ships none of it.
+     * `withFormats()` from `@noy-db/hub/as`.
+     */
+    readonly formatsStrategy?: FormatsStrategy;
+    readonly mesh?: NoydbMesh;
     /**
      * Pre-resolved factory for the `vault.user` per-principal user-envelope
      * API. `createNoydb()` always resolves this itself (dynamically
      * importing `with-party/directory/user-envelope/api.js`) before
-     * constructing `Noydb` — mirrors the {@link coordinationStrategy}
+     * constructing `Noydb` — mirrors the {@link mesh}
      * pre-resolve above. There is no supported way to override it; it exists
      * as an options-bag field only so `createNoydb()` can thread the
      * pre-resolved value into the constructor without a second parameter.
@@ -2858,7 +2975,7 @@ export interface NoydbOptions {
      * read/update/bootstrap + session-policy enforcer wiring).
      * `createNoydb()` always resolves this itself (dynamically importing
      * `with-party/policy/index.js`) before constructing `Noydb` — mirrors the
-     * {@link coordinationStrategy} / {@link userApiFactory} pre-resolves
+     * {@link mesh} / {@link userApiFactory} pre-resolves
      * above. There is no supported way to override it.
      *
      * @internal

package/dist/kernel/vault.d.ts

@@ -1,12 +1,13 @@
 import type { OpenCollectionOptions } from '../port/with/collection-options.js';
 import type { StrategyBag } from '../port/with/strategies.js';
+import type { NoydbFormat, ImportPlan, FormatExportOptions, FormatImportOptions } from '../port/with/formats-strategy.js';
 import type { NoydbStore, EncryptedEnvelope, HistoryConfig, ExportStreamOptions, ExportChunk, CollectionConflictResolver, CrossTierAccessEvent, Role, VaultUserApi, CollectionShape, SensitiveOf, IndexedOf, MoneyOf } from './types.js';
 import type { Noydb } from './noydb.js';
 import type { IssueDelegationOptions, DelegationToken } from '../with-party/team/delegation.js';
 import { Collection } from './collection.js';
 import type { JoinableSource } from './query/index.js';
 import type { OnDirtyCallback } from './collection.js';
-import type { UnlockedKeyring, BundleRecipient } from '../with-party/team/keyring.js';
+import type { UnlockedKeyring, PodRecipient } from '../with-party/team/keyring.js';
 import type { MaterializedViewRegistry } from '../with-formula/materialized-views/registry.js';
 import type { MaterializedViewStrategy } from '../with-formula/materialized-views/types.js';
 import type { OverlayedViewRegistry } from '../with-formula/overlay-views/registry.js';
@@ -336,7 +337,7 @@ export declare class Vault {
      * unblocks R-S7 when a base gains forget coverage after its satellite was
      * already declared without `perRecordKeys`. Call BEFORE re-declaring with
      * `{ satelliteOf, perRecordKeys: true }` AND before this collection serves
-     * writes (unfenced walk — see {@link migrateSatelliteCek}); resumable.
+     * writes (unfenced walk — see `with-shape/satellites/migrate-cek.ts`); resumable.
      */
     migrateSatellitePerRecordKeys(satelliteName: string): Promise<{
         migrated: number;
@@ -574,7 +575,7 @@ export declare class Vault {
      *
      * @public
      */
-    buildBundleRecipientKeyrings(recipients: readonly BundleRecipient[]): Promise<Record<string, KeyringFile>>;
+    buildBundleRecipientKeyrings(recipients: readonly PodRecipient[]): Promise<Record<string, KeyringFile>>;
     /**
      * Authorize an `@noy-db/as-*` export against the current keyring's
      * `exportCapability`. Throws `ExportCapabilityError` if
@@ -745,7 +746,7 @@ export declare class Vault {
      *
      * @internal
      */
-    _decryptEnvelopeForBundleFilter(env: EncryptedEnvelope, collectionName: string): Promise<unknown>;
+    _decryptEnvelopeForBundleFilter(env: EncryptedEnvelope, collectionName: string, recordId: string): Promise<unknown>;
     /**
      * Read-only accessor for the invoking keyring's import capability
      * (issue ). UI affordance — returns false in every default-closed
@@ -1164,7 +1165,7 @@ export declare class Vault {
      *   - The keyring must already carry a wrap for the target tier on
      *     at least one collection (or be `owner` / `admin`, who can
      *     auto-mint). Otherwise throws {@link TierNotGrantedError}.
-     *   - Per-collection capability gates (`canExportPlaintext`,
+     *   - Per-collection capability gates (`assertCanExport`,
      *     `canExportBundle`) are NOT bypassed — elevation is a tier
      *     projection, not a privilege escalation path.
      *   - Only one elevation can be active per vault at a time.
@@ -1348,12 +1349,12 @@ export declare class Vault {
      * distinct handles, which is the right behavior — they're
      * separate vault instances now.
      */
-    getBundleHandle(): Promise<string>;
+    getPodHandle(): Promise<string>;
     /**
      * Read the owner-curated cover for this vault (or `undefined` if
      * none is persisted). The cover lives in `_meta/public-envelope`
      * (the frozen wire name) as plaintext — readable without any KEK
-     * — so `getBundleHandle`-style callers can label a vault before
+     * — so `getPodHandle`-style callers can label a vault before
      * unlock.
      *
      * Mirrors `Noydb.getCover(vault, opts)` but scoped to a
@@ -1498,6 +1499,14 @@ export declare class Vault {
      * }
      * ```
      */
+    /**
+     * Serialise this vault through an `as-*` format. The gate runs before a
+     * record is read and the format never receives a vault — see
+     * `docs/adr/0004-as-format-port.md` and `port/as/active.ts`.
+     */
+    export<Out extends string | Uint8Array>(format: NoydbFormat<Out>, options?: FormatExportOptions): Promise<Out>;
+    /** Plan an import from an `as-*` format. Nothing is written until `apply()`. */
+    import<Out extends string | Uint8Array>(format: NoydbFormat<Out>, input: Out, options?: FormatImportOptions): Promise<ImportPlan>;
     exportStream(opts?: ExportStreamOptions): AsyncIterableIterator<ExportChunk>;
     /**
      * Convenience wrapper that consumes `exportStream()` and serializes the

package/dist/kernel/via/compose.d.ts

@@ -47,7 +47,7 @@ export interface MergedViaFields {
 /**
  * Merge `viaFields` (the {@link via} composer) with the money/i18n sugar
  * keys into the effective maps every consumer reads — the kernel's
- * `compileViaBindings` (the `ViaPipeline` bindings) and `vault.ts`'s own
+ * `compileVias` (the `ViaPipeline` bindings) and `vault.ts`'s own
  * i18n/dict registries (put-time validation, dict-join/search resolution)
  * both call this so a field declared via `viaFields` behaves identically to
  * one declared under its feature's sugar key.
@@ -65,7 +65,7 @@ export declare function mergeViaFields(sources: ViaFieldSources): MergedViaField
  * `blobFields`) resolves silently by compile-order first-wins in `ViaPipeline`'s per-field
  * posture/clause lookup — undefined pipeline behavior for a config that is almost certainly a
  * mistake. `mergeViaFields` already guards sugar-vs-`viaFields` and `dictKeyFields`-vs-
- * `lookupFields` collisions (#623 Task 9); this runs one step later, in `compileViaBindings`
+ * `lookupFields` collisions (#623 Task 9); this runs one step later, in `compileVias`
  * (fresh construction) or {@link guardReconcileCollisions} (late-attach reconcile), because
  * those are the only seams that also see `classifiedFields`/`blobFields` — neither is part of
  * `ViaFieldSources`, so `mergeViaFields` never sees them.
@@ -127,7 +127,7 @@ export declare function guardCrossBindingFieldCollisions(fieldMaps: Readonly<Rec
  *    THIS call's incoming family map claims the SAME field for a DIFFERENT family (e.g. call-1
  *    `classifiedFields:['ssn']`, call-2 `moneyFields:{ssn}`) — undetectable by (a) alone since
  *    the collision spans two calls. Read via the LIVE collection's compiled bindings
- *    (`coll._via.bindings`): each `ViaBinding.covers(field)` (`via/index.ts`) plus its `brand` tells us
+ *    (`coll._via.bindings`): each `NoydbVia.covers(field)` (`via/index.ts`) plus its `brand` tells us
  *    which family already owns the field, mapped through the SAME {@link VIA_FIELD_MAP_FAMILY}
  *    the incoming side uses — no new collection.ts surface needed.
  *

package/dist/kernel/via/index.d.ts

@@ -47,8 +47,17 @@ export interface ViaCryptoCtx {
         delete(field: string): Promise<void>;
     };
     reservedEnvelopes(prefix: string): {
-        encrypt(collection: string, json: string, v: number): Promise<EncryptedEnvelope>;
-        decrypt(collection: string, env: EncryptedEnvelope): Promise<string>;
+        /**
+         * `id` is the record id the envelope will be stored under. Required
+         * (#1051) because this function holds the DEK, so it is where record-identity
+         * AAD is applied — a caller that cannot name the id cannot be bound.
+         */
+        encrypt(identity: {
+            readonly collection: string;
+            readonly id: string;
+            readonly by?: string;
+        }, json: string, v: number): Promise<EncryptedEnvelope>;
+        decrypt(collection: string, id: string, env: EncryptedEnvelope): Promise<string>;
     };
 }
 /** Per-call erase context — `forget()`'s per-ref participation door (phase C). */
@@ -76,15 +85,15 @@ export interface ViaEraseReport {
  * e.g. quantizeMoneyFields(record, moneyFields)). All hooks optional;
  * absent = passthrough. Query-participation hooks are SYNC (#553).
  */
-export interface ViaBinding {
+export interface NoydbVia {
     readonly brand: string;
     readonly posture: ViaPosture;
     /** Declared dependencies (field paths / cross-record specs). MANDATORY for any future
      *  derive-bearing binding — phase C validates well-formedness (strings, non-empty,
      *  reference declared fields) and graph-registers a derived edge for each covered
-     *  field at declare time, right after `compileViaBindings` builds the bindings
+     *  field at declare time, right after `compileVias` builds the bindings
      *  (unknown source field throws `ValidationError`). See
-     *  `kernel/collection-config.ts`'s `resolveViaBindingDepsEdges`. */
+     *  `kernel/collection-config.ts`'s `resolveViaDepsEdges`. */
     readonly deps?: readonly string[];
     /** Collection-name prefixes this binding's `reservedEnvelopes` capability may address (e.g. `_dict_`). */
     readonly reservedPrefixes?: readonly string[];
@@ -190,7 +199,7 @@ export interface ViaBinding {
     describeFragment?(): Record<string, unknown>;
 }
 /** Binder: constructs a binding from a collection's declared config. Installed by the feature's declaration factory. */
-export type ViaBinder = (config: unknown) => ViaBinding;
+export type ViaBinder = (config: unknown) => NoydbVia;
 /** @internal — called (idempotently, first-wins) by a feature's declaration factory, e.g. money(). */
 export declare function installViaBinder(brand: string, binder: ViaBinder): void;
 /** @internal — registry presence check. Used by tests (mirrors isMoneyEngineInstalled) and by vault's i18n validator delegators as a no-i18n-ever-declared fast path. */

package/dist/kernel/via/pipeline.d.ts

@@ -1,4 +1,4 @@
-import type { ViaBinding, ViaPosture, ViaWriteCtx, ViaReadCtx, ViaCryptoCtx, SealedSlotRef, ViaEraseCtx, ViaEraseReport } from './index.js';
+import type { NoydbVia, ViaPosture, ViaWriteCtx, ViaReadCtx, ViaCryptoCtx, SealedSlotRef, ViaEraseCtx, ViaEraseReport } from './index.js';
 /** Opaque per-clause query payload carried on FieldClause (replaces the money-only slot). */
 export interface ViaClause {
     readonly brand: string;
@@ -23,7 +23,7 @@ export interface ViaTaintOverlay {
     readonly defaultPosture?: ViaPosture;
 }
 export declare class ViaPipeline {
-    readonly bindings: readonly ViaBinding[];
+    readonly bindings: readonly NoydbVia[];
     readonly taint?: ViaTaintOverlay | undefined;
     /**
      * Present-phase-ONLY order (#665, corrected under #665 review) — a stable
@@ -33,7 +33,7 @@ export declare class ViaPipeline {
      * everything else (existing relative order). `present()` folds over this
      * instead of `bindings` so a `mode: 'virtual'` computed field's value
      * exists before i18n/lookup's dressing `present()` hooks run on it
-     * (today's `compileViaBindings` order is money→i18n→lookup→classified→
+     * (today's `compileVias` order is money→i18n→lookup→classified→
      * blob→computed, `collection-config.ts:554`, so dressing unconditionally
      * ran BEFORE the value it dresses existed). This reorder is binding-level,
      * not conditioned on any particular field composition — it applies to
@@ -72,7 +72,7 @@ export declare class ViaPipeline {
      * Money-dressing a virtual computed field's OWN output (the composed
      * `computed(virtual) + money` case) is NOT resolved by this partition
      * alone — #669 resolves it with a separate mid-fold hook instead:
-     * `ViaBinding.presentLate` runs after every binding's `present()` in this
+     * `NoydbVia.presentLate` runs after every binding's `present()` in this
      * money+computed segment, before the "everything else" segment below, so
      * money can quantize/reinterpret a virtual field's fresh MAJOR-UNITS
      * output as if it were a stored value, without perturbing this ordering
@@ -81,7 +81,7 @@ export declare class ViaPipeline {
      */
     private readonly _presentOrder;
     /** #669 — index into `_presentOrder` where the money+computed segment ends and the
-     *  "everything else" segment begins (`moneyBindings.length + computedBindings.length`);
+     *  "everything else" segment begins (`moneyVias.length + computedVias.length`);
      *  `present()` runs every binding's `presentLate` at exactly this boundary. */
     private readonly _presentLateBoundary;
     private constructor();
@@ -89,7 +89,7 @@ export declare class ViaPipeline {
      *  `this.via === undefined` (#553: keeps an all-plain collection sync). A
      *  `'*'`-defaulted output collection (#642) counts as "something to enforce"
      *  even with zero field-specific postures and zero bindings. */
-    static build(bindings: readonly ViaBinding[], taint?: ViaTaintOverlay): ViaPipeline | undefined;
+    static build(bindings: readonly NoydbVia[], taint?: ViaTaintOverlay): ViaPipeline | undefined;
     /** Refuse a write before crypto runs: awaits each binding's `enforceWrite` in order — first throw wins. */
     enforceWrite(record: Record<string, unknown>, ctx: ViaWriteCtx): Promise<void>;
     ingest(record: Record<string, unknown>): Record<string, unknown>;