@noy-db/hub 0.1.0-pre.5 → 0.1.0-pre.7

package/dist/index.d.cts

@@ -1,18 +1,72 @@
-import { at as NoydbStore, aR as PublicEnvelope, aS as GateName, aT as GatePolicy, aU as VaultPolicy, aV as ActiveTier, aW as FactorProof, ar as UnlockedKeyring, aX as Vault, aA as DiffEntry } from './types-BpyE4o_n.cjs';
-export { aY as AccessibleVault, ax as AppendInput, p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, aZ as BUNDLE_STORE_POLICY, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, a_ as BuiltInGateName, a$ as BundleRecipient, _ as CONSENT_AUDIT_COLLECTION, b0 as CacheOptions, b1 as CacheStats, b2 as ChangeEvent, ay as ChangeType, a7 as ClosePeriodOptions, b3 as Collection, b4 as CollectionChangeEvent, b5 as CollectionConflictResolver, ai as CollectionFrame, az as CollectionInstant, b6 as Conflict, b7 as ConflictPolicy, b8 as ConflictStrategy, $ as ConsentAuditEntry, a0 as ConsentAuditFilter, a1 as ConsentContext, a2 as ConsentOp, b9 as CrossTierAccessEvent, L as DEFAULT_CHUNK_SIZE, ba as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, bb as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, bc as DelegationToken, bd as DeleteManyResult, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, be as DirtyEntry, bf as ELEVATION_AUDIT_COLLECTION, bg as ElevatedHandle, av as EncryptedEnvelope, bh as EnrollAuthenticatorOptions, bi as ExportCapability, bj as ExportChunk, bk as ExportFormat, bl as ExportStreamOptions, bm as FactorKind, bn as FactorRequirement, bo as GhostRecord, bp as GrantOptions, bq as HistoryConfig, br as HistoryEntry, au as HistoryOptions, e as I18nTextDescriptor, f as I18nTextOptions, bs as INDEXED_STORE_POLICY, bt as ImportCapability, bu as InferOutput, bv as IssueDelegationOptions, bw as IssueMagicLinkGrantOptions, aB as JsonPatch, aC as JsonPatchOp, bx as KeyringAuthenticator, by as KeyringFile, aD as LedgerEntry, aE as LedgerStore, bz as ListAccessibleVaultsOptions, bA as ListPageResult, bB as LocaleReadOptions, bC as Lru, bD as LruOptions, bE as LruStats, bF as MAGIC_LINK_CONTENT_INFO_PREFIX, bG as MAGIC_LINK_GRANTS_COLLECTION, bH as MAGIC_LINK_KEK_INFO_PREFIX, bI as MagicLinkGrantPayload, bJ as MagicLinkGrantRecord, bK as NOYDB_BACKUP_VERSION, bL as NOYDB_FORMAT_VERSION, bM as NOYDB_KEYRING_VERSION, bN as NOYDB_SYNC_VERSION, bO as Noydb, bP as NoydbBundleStore, bQ as NoydbEventMap, bR as NoydbOptions, a8 as OpenPeriodOptions, a9 as PERIODS_COLLECTION, bS as PUBLIC_ENVELOPE_FIELDS, bT as PaperRecoveryDoc, bU as PaperRecoveryEntry, bV as PassphrasePolicy, bW as PassphraseValidationResult, aa as PeriodRecord, bX as Permission, bY as Permissions, bZ as PlaintextTranslatorContext, b_ as PlaintextTranslatorFn, P as PolicyEnforcer, b$ as PresenceHandle, c0 as PresencePeer, aw as PruneOptions, c1 as PublicEnvelopeField, c2 as PublicEnvelopeSchema, c3 as PublicEnvelopeText, c4 as PullMode, c5 as PullOptions, c6 as PullPolicy, c7 as PullResult, c8 as PushMode, c9 as PushOptions, ca as PushPolicy, cb as PushResult, cc as PutManyItemOptions, cd as PutManyOptions, ce as PutManyResult, cf as QueryAcrossOptions, cg as QueryAcrossResult, ch as QuickUnlockState, ci as QuickUnlockStore, cj as ReAuthOperation, ck as RecoverPassphraseInput, cl as RecoveryProof, cm as ResolvedPublicEnvelopeSchema, cn as RevokeOptions, aq as Role, co as RotatePassphraseInput, cp as SessionPolicy, cq as SetPublicEnvelopeInput, U as SlotInfo, V as SlotRecord, cr as StandardSchemaV1, cs as StandardSchemaV1Issue, ct as StandardSchemaV1SyncResult, cu as StoreAuth, cv as StoreAuthKind, cw as StoreCapabilities, cx as SyncEngine, cy as SyncMetadata, cz as SyncPolicy, cA as SyncScheduler, cB as SyncSchedulerStatus, cC as SyncStatus, cD as SyncTarget, cE as SyncTargetRole, cF as SyncTransaction, cG as SyncTransactionResult, cH as TierMode, cI as TranslatorAuditEntry, al as TxCollection, am as TxContext, cJ as TxOp, an as TxVault, cK as UserInfo, cL as VaultBackup, aF as VaultEngine, aj as VaultFrame, aG as VaultInstant, cM as VaultPolicyOnDisk, cN as VaultSnapshot, aH as VerifyResult, W as VersionRecord, cO as WarningRules, cP as WeakPassphraseError, cQ as WeakPassphraseReason, g as applyI18nLocale, aI as applyPatch, cR as assertStrongPassphrase, cS as buildRecipientKeyringFile, cT as burnPaperRecoveryEntry, aJ as canonicalJson, aK as computePatch, n as createEnforcer, cU as createNoydb, cV as createStore, cW as deriveMagicLinkContentKey, h as dictCollectionName, i as dictKey, aL as diff, cX as enrollAuthenticator, cY as estimateEntropy, cZ as evaluateExportCapability, c_ as evaluateImportCapability, c$ as findAuthenticator, aM as formatDiff, d0 as hasExportCapability, d1 as hasImportCapability, d2 as hasRecoveryEnrolled, aN as hashEntry, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, d3 as isMagicLinkGrantExpired, d4 as isPublicEnvelope, d5 as issueDelegation, d6 as keyringRecoverPassphrase, d7 as keyringRotatePassphrase, d8 as listMagicLinkGrants, d9 as loadActiveDelegations, da as loadPaperRecoveryEntries, db as magicLinkGrantRecordId, aO as paddedIndex, aP as parseIndex, dc as readMagicLinkGrantRecord, dd as removeAuthenticator, r as resolveI18nText, de as resolvePublicEnvelopeSchema, df as revokeDelegation, dg as revokeMagicLinkGrant, ao as runTransaction, dh as savePaperRecoveryEntries, aQ as sha256Hex, di as unwrapMagicLinkGrant, v as validateI18nTextValue, dj as validatePassphrase, dk as validatePublicEnvelopeInput, dl as validateSchemaInput, dm as validateSchemaOutput, o as validateSessionPolicy, dn as writeMagicLinkGrant } from './types-BpyE4o_n.cjs';
+import { at as NoydbStore, aR as UserEnvelope, aS as PublicEnvelope, aT as GateName, aU as GatePolicy, aV as VaultPolicy, aW as ActiveTier, aX as FactorProof, ar as UnlockedKeyring, aY as Vault, aA as DiffEntry } from './types-D3QLmhlk.cjs';
+export { aZ as AccessibleVault, ax as AppendInput, p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, a_ as BUNDLE_STORE_POLICY, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, a$ as BuiltInGateName, b0 as BundleRecipient, _ as CONSENT_AUDIT_COLLECTION, b1 as CacheOptions, b2 as CacheStats, b3 as ChangeEvent, ay as ChangeType, a7 as ClosePeriodOptions, b4 as Collection, b5 as CollectionChangeEvent, b6 as CollectionConflictResolver, ai as CollectionFrame, az as CollectionInstant, b7 as Conflict, b8 as ConflictPolicy, b9 as ConflictStrategy, $ as ConsentAuditEntry, a0 as ConsentAuditFilter, a1 as ConsentContext, a2 as ConsentOp, ba as CrossTierAccessEvent, L as DEFAULT_CHUNK_SIZE, bb as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, bc as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, bd as DeepPartial, be as DelegationToken, bf as DeleteManyResult, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, bg as DirtyEntry, bh as ELEVATION_AUDIT_COLLECTION, bi as ElevatedHandle, av as EncryptedEnvelope, bj as EnrollAuthenticatorOptions, bk as ExportCapability, bl as ExportChunk, bm as ExportFormat, bn as ExportStreamOptions, bo as FactorKind, bp as FactorRequirement, bq as GhostRecord, br as GrantOptions, bs as HistoryConfig, bt as HistoryEntry, au as HistoryOptions, e as I18nTextDescriptor, f as I18nTextOptions, bu as INDEXED_STORE_POLICY, bv as ImportCapability, bw as InferOutput, bx as IssueDelegationOptions, by as IssueMagicLinkGrantOptions, aB as JsonPatch, aC as JsonPatchOp, bz as KeyringAuthenticator, bA as KeyringFile, aD as LedgerEntry, aE as LedgerStore, bB as ListAccessibleVaultsOptions, bC as ListPageResult, bD as LiveUserEnvelope, bE as LocaleReadOptions, bF as Lru, bG as LruOptions, bH as LruStats, bI as MAGIC_LINK_CONTENT_INFO_PREFIX, bJ as MAGIC_LINK_GRANTS_COLLECTION, bK as MAGIC_LINK_KEK_INFO_PREFIX, bL as MagicLinkGrantPayload, bM as MagicLinkGrantRecord, bN as NOYDB_BACKUP_VERSION, bO as NOYDB_FORMAT_VERSION, bP as NOYDB_KEYRING_VERSION, bQ as NOYDB_SYNC_VERSION, bR as Noydb, bS as NoydbBundleStore, bT as NoydbEventMap, bU as NoydbOptions, a8 as OpenPeriodOptions, a9 as PERIODS_COLLECTION, bV as PUBLIC_ENVELOPE_FIELDS, bW as PaperRecoveryDoc, bX as PaperRecoveryEntry, bY as PassphrasePolicy, bZ as PassphraseValidationResult, aa as PeriodRecord, b_ as Permission, b$ as Permissions, c0 as PlaintextTranslatorContext, c1 as PlaintextTranslatorFn, P as PolicyEnforcer, c2 as PresenceHandle, c3 as PresencePeer, aw as PruneOptions, c4 as PublicEnvelopeField, c5 as PublicEnvelopeSchema, c6 as PublicEnvelopeText, c7 as PullMode, c8 as PullOptions, c9 as PullPolicy, ca as PullResult, cb as PushMode, cc as PushOptions, cd as PushPolicy, ce as PushResult, cf as PutManyItemOptions, cg as PutManyOptions, ch as PutManyResult, ci as QueryAcrossOptions, cj as QueryAcrossResult, ck as QuickUnlockState, cl as QuickUnlockStore, cm as ReAuthOperation, cn as RecoverPassphraseInput, co as RecoveryProof, cp as ResolvedPublicEnvelopeSchema, cq as RevokeOptions, aq as Role, cr as RotatePassphraseInput, cs as SessionPolicy, ct as SetPublicEnvelopeInput, U as SlotInfo, V as SlotRecord, cu as StandardSchemaV1, cv as StandardSchemaV1Issue, cw as StandardSchemaV1SyncResult, cx as StoreAuth, cy as StoreAuthKind, cz as StoreCapabilities, cA as SyncEngine, cB as SyncMetadata, cC as SyncPolicy, cD as SyncScheduler, cE as SyncSchedulerStatus, cF as SyncStatus, cG as SyncTarget, cH as SyncTargetRole, cI as SyncTransaction, cJ as SyncTransactionResult, cK as TierMode, cL as TranslatorAuditEntry, al as TxCollection, am as TxContext, cM as TxOp, an as TxVault, cN as USER_ENVELOPE_COLLECTION, cO as USER_ENVELOPE_MAX_BYTES, cP as Unsubscribe, cQ as UserApi, cR as UserEnvelopeCheckGate, cS as UserEnvelopeOversizedError, cT as UserEnvelopePresented, cU as UserInfo, cV as VaultBackup, aF as VaultEngine, aj as VaultFrame, aG as VaultInstant, cW as VaultPolicyOnDisk, cX as VaultSnapshot, aH as VerifyResult, W as VersionRecord, cY as WarningRules, cZ as WeakPassphraseError, c_ as WeakPassphraseReason, g as applyI18nLocale, aI as applyPatch, c$ as assertStrongPassphrase, d0 as buildRecipientKeyringFile, d1 as burnPaperRecoveryEntry, aJ as canonicalJson, aK as computePatch, n as createEnforcer, d2 as createNoydb, d3 as createStore, d4 as deriveMagicLinkContentKey, h as dictCollectionName, i as dictKey, aL as diff, d5 as enrollAuthenticator, d6 as estimateEntropy, d7 as evaluateExportCapability, d8 as evaluateImportCapability, d9 as findAuthenticator, aM as formatDiff, da as hasExportCapability, db as hasImportCapability, dc as hasRecoveryEnrolled, aN as hashEntry, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, dd as isMagicLinkGrantExpired, de as isPublicEnvelope, df as issueDelegation, dg as keyringRecoverPassphrase, dh as keyringRotatePassphrase, di as listMagicLinkGrants, dj as listUsers, dk as listUsersWithEnvelopes, dl as loadActiveDelegations, dm as loadPaperRecoveryEntries, dn as magicLinkGrantRecordId, aO as paddedIndex, aP as parseIndex, dp as readMagicLinkGrantRecord, dq as removeAuthenticator, r as resolveI18nText, dr as resolvePublicEnvelopeSchema, ds as revokeDelegation, dt as revokeMagicLinkGrant, ao as runTransaction, du as savePaperRecoveryEntries, aQ as sha256Hex, dv as unwrapMagicLinkGrant, v as validateI18nTextValue, dw as validatePassphrase, dx as validatePublicEnvelopeInput, dy as validateSchemaInput, dz as validateSchemaOutput, o as validateSessionPolicy, dA as writeMagicLinkGrant } from './types-D3QLmhlk.cjs';
 export { d as detectMagic, a as detectMimeType, i as isPreCompressed } from './mime-magic-CBBSOkjm.cjs';
 export { AgeRoute, BlobLifecyclePolicy, BlobStoreRoute, CircuitBreakerOptions, HealthCheckOptions, LogLevel, LoggingOptions, MetricsOptions, OverrideOptions, OverrideTarget, RetryOptions, RouteStatus, RouteStoreOptions, RoutedNoydbStore, StoreCacheOptions, StoreMiddleware, StoreOperation, SuspendOptions, WrapBundleStoreOptions, WrappedBundleNoydbStore, createBundleStore, routeStore, withCache, withCircuitBreaker, withHealthCheck, withLogging, withMetrics, withRetry, wrapBundleStore, wrapStore } from './store/index.cjs';
 import { N as NoydbError } from './index-6xNpPsxR.cjs';
 export { A as AlreadyElevatedError, B as BackupCorruptedError, a as BackupLedgerError, b as BundleIntegrityError, c as BundleVersionConflictError, C as ConflictError, D as DEFAULT_JOIN_MAX_ROWS, d as DanglingReferenceError, e as DecryptionError, f as DelegationTargetMissingError, g as DictKeyInUseError, h as DictKeyMissingError, E as ElevationExpiredError, i as ExportCapabilityError, F as FilenameSanitizationError, G as GroupCardinalityError, I as ImportCapabilityError, j as IndexRequiredError, k as IndexWriteFailureError, l as InvalidKeyError, J as JoinContext, m as JoinLeg, n as JoinStrategy, o as JoinTooLargeError, p as JoinableSource, K as KeyringExpiredError, L as LedgerContentionError, q as LiveQuery, r as LiveUpstream, s as LocaleNotSpecifiedError, M as MissingTranslationError, t as NetworkError, u as NoAccessError, v as NotFoundError, O as OrderBy, P as PathEscapeError, w as PeriodClosedError, x as PermissionDeniedError, y as PrivilegeEscalationError, Q as Query, z as QueryPlan, H as QuerySource, R as ReadOnlyAtInstantError, S as ReadOnlyError, T as ReadOnlyFrameError, U as RefDescriptor, V as RefIntegrityError, W as RefMode, X as RefRegistry, Y as RefScopeError, Z as RefViolation, _ as ReservedCollectionNameError, $ as ScanBuilder, a0 as ScanPageProvider, a1 as SchemaValidationError, a2 as SessionExpiredError, a3 as SessionNotFoundError, a4 as SessionPolicyError, a5 as StoreCapabilityError, a6 as TamperedError, a7 as TierDemoteDeniedError, a8 as TierNotGrantedError, a9 as TranslatorNotConfiguredError, aa as ValidationError, ab as applyJoins, ac as buildLiveQuery, ad as executePlan, ae as ref, af as resetJoinWarnings } from './index-6xNpPsxR.cjs';
-export { C as CompressionAlgo, N as NOYDB_BUNDLE_FORMAT_VERSION, a as NOYDB_BUNDLE_MAGIC, b as NOYDB_BUNDLE_PREFIX_BYTES, c as NoydbBundleHeader, d as NoydbBundleReadResult, W as WriteNoydbBundleOptions, g as generateULID, h as hasNoydbBundleMagic, i as isULID, r as readNoydbBundle, e as readNoydbBundleHeader, f as readNoydbBundlePublicEnvelope, j as resetBrotliSupportCache, w as writeNoydbBundle } from './index-DyRt_5vM.cjs';
+export { C as CompressionAlgo, N as NOYDB_BUNDLE_FORMAT_VERSION, a as NOYDB_BUNDLE_MAGIC, b as NOYDB_BUNDLE_PREFIX_BYTES, c as NoydbBundleHeader, d as NoydbBundleReadResult, W as WriteNoydbBundleOptions, g as generateULID, h as hasNoydbBundleMagic, i as isULID, r as readNoydbBundle, e as readNoydbBundleHeader, f as readNoydbBundlePublicEnvelope, j as resetBrotliSupportCache, w as writeNoydbBundle } from './index-Cvb0efA_.cjs';
 export { a as CrdtMode, b as CrdtState, L as LwwMapState, R as RgaState, Y as YjsState, m as mergeCrdtStates, r as resolveCrdtSnapshot } from './strategy-BSxFXGzb.cjs';
 export { SYNC_CREDENTIALS_COLLECTION, SyncCredential, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential } from './team/index.cjs';
-export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-qVMxG2Je.cjs';
+export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-Dk14V6lX.cjs';
 export { a as Clause, C as CollectionIndexes, F as FieldClause, b as FilterClause, G as GroupClause, H as HashIndex, I as IndexDef, O as Operator, e as evaluateClause, c as evaluateFieldClause, r as readPath } from './predicate-SBHmi6D0.cjs';
 export { a as AggregateResult, b as AggregateSpec, c as Aggregation, d as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, e as GROUPBY_WARN_CARDINALITY, f as GroupedAggregation, g as GroupedQuery, h as GroupedRow, L as LiveAggregation, R as Reducer, i as ReducerOptions, j as avg, l as count, m as groupAndReduce, n as max, o as min, r as reduceRecords, s as sum } from './strategy-D-SrOLCl.cjs';
-export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-Bpvl2eSe.cjs';
+export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-h_2U3TFb.cjs';
 import './lazy-builder-CZVLKh0Z.cjs';
 
+/**
+ * Persistence helpers for per-principal user envelopes stored at
+ * `_users/<keyringId>` (logically: `_meta/user/<keyringId>`).
+ *
+ * Unlike `_meta/policy` and `_meta/handle` which are plaintext, user
+ * envelopes carry user data and are encrypted with a dedicated
+ * {@link USER_ENVELOPE_COLLECTION} DEK (provisioned at vault open and
+ * propagated to every keyring via the system-collection DEK path in
+ * `team/keyring.ts`).
+ *
+ * This module is the **storage primitive** layer. The public API
+ * (`vault.user.*`) sits on top of this; permission gates, own-only
+ * write enforcement, and presence-channel propagation live there.
+ *
+ * @see docs/superpowers/specs/2026-05-05-user-envelope-design.md
+ *
+ * @module
+ */
+
+/**
+ * Read and decrypt the user envelope for `keyringId`. Returns `null`
+ * when no envelope has been persisted (either the principal has never
+ * called `updateMe`, or the keyring predates this feature).
+ *
+ * Decryption errors propagate — a tampered or wrong-keyed envelope
+ * surfaces as the underlying crypto error rather than masquerading as
+ * "not found".
+ */
+declare function loadUserEnvelope<T = unknown>(store: NoydbStore, vault: string, keyringId: string, dek: CryptoKey): Promise<UserEnvelope<T> | null>;
+/**
+ * Encrypt and persist the user envelope for `keyringId`. The new
+ * version is `(prior._v ?? 0) + 1`. Pass `expectedVersion` to enable
+ * optimistic-concurrency checks: a mismatch with the stored version
+ * throws {@link ConflictError} with the actual stored version.
+ *
+ * `expectedVersion: 0` means "expect no prior envelope"; the write
+ * succeeds only if no envelope exists yet.
+ *
+ * Soft-caps the JSON-serialized payload at {@link USER_ENVELOPE_MAX_BYTES};
+ * larger payloads throw {@link UserEnvelopeOversizedError}.
+ */
+declare function saveUserEnvelope<T>(store: NoydbStore, vault: string, keyringId: string, payload: T, dek: CryptoKey, expectedVersion?: number): Promise<UserEnvelope<T>>;
+/**
+ * Delete the user envelope for `keyringId`. Idempotent — no error if
+ * the envelope is already absent. Called from the keyring revoke path
+ * (cascade-delete) and is a no-op for keyrings that never wrote.
+ */
+declare function deleteUserEnvelope(store: NoydbStore, vault: string, keyringId: string): Promise<void>;
+/**
+ * List the keyring ids that have a user envelope persisted in `vault`.
+ * Order is store-defined — callers that need a stable order should sort.
+ */
+declare function listUserEnvelopeIds(store: NoydbStore, vault: string): Promise<string[]>;
+
 /**
  * Cache policy helpers — parse human-friendly byte budgets into raw numbers.
  *
@@ -508,4 +562,4 @@ type DiffCandidate<T = unknown> = Vault | Record<string, readonly T[]> | string;
  */
 declare function diffVault<T = unknown>(vault: Vault, candidate: DiffCandidate<T>, options?: DiffOptions): Promise<VaultDiff<T>>;
 
-export { ActiveTier, type CheckGateContext, DEFAULT_FRESHNESS_MS, type DiffCandidate, DiffEntry, type DiffOptions, FactorProof, GateName, GatePolicy, META_COLLECTION, NoydbError, NoydbStore, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, PolicyDeniedError, type PolicyDenyReason, PublicEnvelope, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, STRICT_POLICY, UnlockedKeyring, Vault, type VaultDiff, type VaultDiffEntry, type VaultDiffModifiedEntry, VaultPolicy, assertTierAccess, base64ToBuffer, bufferToBase64, checkGate, decryptBytes, decryptDeterministic, dekKey, derivePresenceKey, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, diffVault, effectiveClearance, encryptBytes, encryptDeterministic, estimateRecordBytes, loadPublicEnvelope, loadVaultPolicy, mergePolicy, parseBytes, readPublicEnvelope, savePublicEnvelope, saveVaultPolicy };
+export { ActiveTier, type CheckGateContext, DEFAULT_FRESHNESS_MS, type DiffCandidate, DiffEntry, type DiffOptions, FactorProof, GateName, GatePolicy, META_COLLECTION, NoydbError, NoydbStore, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, PolicyDeniedError, type PolicyDenyReason, PublicEnvelope, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, STRICT_POLICY, UnlockedKeyring, UserEnvelope, Vault, type VaultDiff, type VaultDiffEntry, type VaultDiffModifiedEntry, VaultPolicy, assertTierAccess, base64ToBuffer, bufferToBase64, checkGate, decryptBytes, decryptDeterministic, dekKey, deleteUserEnvelope, derivePresenceKey, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, diffVault, effectiveClearance, encryptBytes, encryptDeterministic, estimateRecordBytes, listUserEnvelopeIds, loadPublicEnvelope, loadUserEnvelope, loadVaultPolicy, mergePolicy, parseBytes, readPublicEnvelope, savePublicEnvelope, saveUserEnvelope, saveVaultPolicy };

package/dist/index.d.ts

@@ -1,18 +1,72 @@
-import { at as NoydbStore, aR as PublicEnvelope, aS as GateName, aT as GatePolicy, aU as VaultPolicy, aV as ActiveTier, aW as FactorProof, ar as UnlockedKeyring, aX as Vault, aA as DiffEntry } from './types-Df72wWCC.js';
-export { aY as AccessibleVault, ax as AppendInput, p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, aZ as BUNDLE_STORE_POLICY, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, a_ as BuiltInGateName, a$ as BundleRecipient, _ as CONSENT_AUDIT_COLLECTION, b0 as CacheOptions, b1 as CacheStats, b2 as ChangeEvent, ay as ChangeType, a7 as ClosePeriodOptions, b3 as Collection, b4 as CollectionChangeEvent, b5 as CollectionConflictResolver, ai as CollectionFrame, az as CollectionInstant, b6 as Conflict, b7 as ConflictPolicy, b8 as ConflictStrategy, $ as ConsentAuditEntry, a0 as ConsentAuditFilter, a1 as ConsentContext, a2 as ConsentOp, b9 as CrossTierAccessEvent, L as DEFAULT_CHUNK_SIZE, ba as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, bb as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, bc as DelegationToken, bd as DeleteManyResult, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, be as DirtyEntry, bf as ELEVATION_AUDIT_COLLECTION, bg as ElevatedHandle, av as EncryptedEnvelope, bh as EnrollAuthenticatorOptions, bi as ExportCapability, bj as ExportChunk, bk as ExportFormat, bl as ExportStreamOptions, bm as FactorKind, bn as FactorRequirement, bo as GhostRecord, bp as GrantOptions, bq as HistoryConfig, br as HistoryEntry, au as HistoryOptions, e as I18nTextDescriptor, f as I18nTextOptions, bs as INDEXED_STORE_POLICY, bt as ImportCapability, bu as InferOutput, bv as IssueDelegationOptions, bw as IssueMagicLinkGrantOptions, aB as JsonPatch, aC as JsonPatchOp, bx as KeyringAuthenticator, by as KeyringFile, aD as LedgerEntry, aE as LedgerStore, bz as ListAccessibleVaultsOptions, bA as ListPageResult, bB as LocaleReadOptions, bC as Lru, bD as LruOptions, bE as LruStats, bF as MAGIC_LINK_CONTENT_INFO_PREFIX, bG as MAGIC_LINK_GRANTS_COLLECTION, bH as MAGIC_LINK_KEK_INFO_PREFIX, bI as MagicLinkGrantPayload, bJ as MagicLinkGrantRecord, bK as NOYDB_BACKUP_VERSION, bL as NOYDB_FORMAT_VERSION, bM as NOYDB_KEYRING_VERSION, bN as NOYDB_SYNC_VERSION, bO as Noydb, bP as NoydbBundleStore, bQ as NoydbEventMap, bR as NoydbOptions, a8 as OpenPeriodOptions, a9 as PERIODS_COLLECTION, bS as PUBLIC_ENVELOPE_FIELDS, bT as PaperRecoveryDoc, bU as PaperRecoveryEntry, bV as PassphrasePolicy, bW as PassphraseValidationResult, aa as PeriodRecord, bX as Permission, bY as Permissions, bZ as PlaintextTranslatorContext, b_ as PlaintextTranslatorFn, P as PolicyEnforcer, b$ as PresenceHandle, c0 as PresencePeer, aw as PruneOptions, c1 as PublicEnvelopeField, c2 as PublicEnvelopeSchema, c3 as PublicEnvelopeText, c4 as PullMode, c5 as PullOptions, c6 as PullPolicy, c7 as PullResult, c8 as PushMode, c9 as PushOptions, ca as PushPolicy, cb as PushResult, cc as PutManyItemOptions, cd as PutManyOptions, ce as PutManyResult, cf as QueryAcrossOptions, cg as QueryAcrossResult, ch as QuickUnlockState, ci as QuickUnlockStore, cj as ReAuthOperation, ck as RecoverPassphraseInput, cl as RecoveryProof, cm as ResolvedPublicEnvelopeSchema, cn as RevokeOptions, aq as Role, co as RotatePassphraseInput, cp as SessionPolicy, cq as SetPublicEnvelopeInput, U as SlotInfo, V as SlotRecord, cr as StandardSchemaV1, cs as StandardSchemaV1Issue, ct as StandardSchemaV1SyncResult, cu as StoreAuth, cv as StoreAuthKind, cw as StoreCapabilities, cx as SyncEngine, cy as SyncMetadata, cz as SyncPolicy, cA as SyncScheduler, cB as SyncSchedulerStatus, cC as SyncStatus, cD as SyncTarget, cE as SyncTargetRole, cF as SyncTransaction, cG as SyncTransactionResult, cH as TierMode, cI as TranslatorAuditEntry, al as TxCollection, am as TxContext, cJ as TxOp, an as TxVault, cK as UserInfo, cL as VaultBackup, aF as VaultEngine, aj as VaultFrame, aG as VaultInstant, cM as VaultPolicyOnDisk, cN as VaultSnapshot, aH as VerifyResult, W as VersionRecord, cO as WarningRules, cP as WeakPassphraseError, cQ as WeakPassphraseReason, g as applyI18nLocale, aI as applyPatch, cR as assertStrongPassphrase, cS as buildRecipientKeyringFile, cT as burnPaperRecoveryEntry, aJ as canonicalJson, aK as computePatch, n as createEnforcer, cU as createNoydb, cV as createStore, cW as deriveMagicLinkContentKey, h as dictCollectionName, i as dictKey, aL as diff, cX as enrollAuthenticator, cY as estimateEntropy, cZ as evaluateExportCapability, c_ as evaluateImportCapability, c$ as findAuthenticator, aM as formatDiff, d0 as hasExportCapability, d1 as hasImportCapability, d2 as hasRecoveryEnrolled, aN as hashEntry, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, d3 as isMagicLinkGrantExpired, d4 as isPublicEnvelope, d5 as issueDelegation, d6 as keyringRecoverPassphrase, d7 as keyringRotatePassphrase, d8 as listMagicLinkGrants, d9 as loadActiveDelegations, da as loadPaperRecoveryEntries, db as magicLinkGrantRecordId, aO as paddedIndex, aP as parseIndex, dc as readMagicLinkGrantRecord, dd as removeAuthenticator, r as resolveI18nText, de as resolvePublicEnvelopeSchema, df as revokeDelegation, dg as revokeMagicLinkGrant, ao as runTransaction, dh as savePaperRecoveryEntries, aQ as sha256Hex, di as unwrapMagicLinkGrant, v as validateI18nTextValue, dj as validatePassphrase, dk as validatePublicEnvelopeInput, dl as validateSchemaInput, dm as validateSchemaOutput, o as validateSessionPolicy, dn as writeMagicLinkGrant } from './types-Df72wWCC.js';
+import { at as NoydbStore, aR as UserEnvelope, aS as PublicEnvelope, aT as GateName, aU as GatePolicy, aV as VaultPolicy, aW as ActiveTier, aX as FactorProof, ar as UnlockedKeyring, aY as Vault, aA as DiffEntry } from './types-D-6bmD2c.js';
+export { aZ as AccessibleVault, ax as AppendInput, p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, a_ as BUNDLE_STORE_POLICY, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, a$ as BuiltInGateName, b0 as BundleRecipient, _ as CONSENT_AUDIT_COLLECTION, b1 as CacheOptions, b2 as CacheStats, b3 as ChangeEvent, ay as ChangeType, a7 as ClosePeriodOptions, b4 as Collection, b5 as CollectionChangeEvent, b6 as CollectionConflictResolver, ai as CollectionFrame, az as CollectionInstant, b7 as Conflict, b8 as ConflictPolicy, b9 as ConflictStrategy, $ as ConsentAuditEntry, a0 as ConsentAuditFilter, a1 as ConsentContext, a2 as ConsentOp, ba as CrossTierAccessEvent, L as DEFAULT_CHUNK_SIZE, bb as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, bc as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, bd as DeepPartial, be as DelegationToken, bf as DeleteManyResult, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, bg as DirtyEntry, bh as ELEVATION_AUDIT_COLLECTION, bi as ElevatedHandle, av as EncryptedEnvelope, bj as EnrollAuthenticatorOptions, bk as ExportCapability, bl as ExportChunk, bm as ExportFormat, bn as ExportStreamOptions, bo as FactorKind, bp as FactorRequirement, bq as GhostRecord, br as GrantOptions, bs as HistoryConfig, bt as HistoryEntry, au as HistoryOptions, e as I18nTextDescriptor, f as I18nTextOptions, bu as INDEXED_STORE_POLICY, bv as ImportCapability, bw as InferOutput, bx as IssueDelegationOptions, by as IssueMagicLinkGrantOptions, aB as JsonPatch, aC as JsonPatchOp, bz as KeyringAuthenticator, bA as KeyringFile, aD as LedgerEntry, aE as LedgerStore, bB as ListAccessibleVaultsOptions, bC as ListPageResult, bD as LiveUserEnvelope, bE as LocaleReadOptions, bF as Lru, bG as LruOptions, bH as LruStats, bI as MAGIC_LINK_CONTENT_INFO_PREFIX, bJ as MAGIC_LINK_GRANTS_COLLECTION, bK as MAGIC_LINK_KEK_INFO_PREFIX, bL as MagicLinkGrantPayload, bM as MagicLinkGrantRecord, bN as NOYDB_BACKUP_VERSION, bO as NOYDB_FORMAT_VERSION, bP as NOYDB_KEYRING_VERSION, bQ as NOYDB_SYNC_VERSION, bR as Noydb, bS as NoydbBundleStore, bT as NoydbEventMap, bU as NoydbOptions, a8 as OpenPeriodOptions, a9 as PERIODS_COLLECTION, bV as PUBLIC_ENVELOPE_FIELDS, bW as PaperRecoveryDoc, bX as PaperRecoveryEntry, bY as PassphrasePolicy, bZ as PassphraseValidationResult, aa as PeriodRecord, b_ as Permission, b$ as Permissions, c0 as PlaintextTranslatorContext, c1 as PlaintextTranslatorFn, P as PolicyEnforcer, c2 as PresenceHandle, c3 as PresencePeer, aw as PruneOptions, c4 as PublicEnvelopeField, c5 as PublicEnvelopeSchema, c6 as PublicEnvelopeText, c7 as PullMode, c8 as PullOptions, c9 as PullPolicy, ca as PullResult, cb as PushMode, cc as PushOptions, cd as PushPolicy, ce as PushResult, cf as PutManyItemOptions, cg as PutManyOptions, ch as PutManyResult, ci as QueryAcrossOptions, cj as QueryAcrossResult, ck as QuickUnlockState, cl as QuickUnlockStore, cm as ReAuthOperation, cn as RecoverPassphraseInput, co as RecoveryProof, cp as ResolvedPublicEnvelopeSchema, cq as RevokeOptions, aq as Role, cr as RotatePassphraseInput, cs as SessionPolicy, ct as SetPublicEnvelopeInput, U as SlotInfo, V as SlotRecord, cu as StandardSchemaV1, cv as StandardSchemaV1Issue, cw as StandardSchemaV1SyncResult, cx as StoreAuth, cy as StoreAuthKind, cz as StoreCapabilities, cA as SyncEngine, cB as SyncMetadata, cC as SyncPolicy, cD as SyncScheduler, cE as SyncSchedulerStatus, cF as SyncStatus, cG as SyncTarget, cH as SyncTargetRole, cI as SyncTransaction, cJ as SyncTransactionResult, cK as TierMode, cL as TranslatorAuditEntry, al as TxCollection, am as TxContext, cM as TxOp, an as TxVault, cN as USER_ENVELOPE_COLLECTION, cO as USER_ENVELOPE_MAX_BYTES, cP as Unsubscribe, cQ as UserApi, cR as UserEnvelopeCheckGate, cS as UserEnvelopeOversizedError, cT as UserEnvelopePresented, cU as UserInfo, cV as VaultBackup, aF as VaultEngine, aj as VaultFrame, aG as VaultInstant, cW as VaultPolicyOnDisk, cX as VaultSnapshot, aH as VerifyResult, W as VersionRecord, cY as WarningRules, cZ as WeakPassphraseError, c_ as WeakPassphraseReason, g as applyI18nLocale, aI as applyPatch, c$ as assertStrongPassphrase, d0 as buildRecipientKeyringFile, d1 as burnPaperRecoveryEntry, aJ as canonicalJson, aK as computePatch, n as createEnforcer, d2 as createNoydb, d3 as createStore, d4 as deriveMagicLinkContentKey, h as dictCollectionName, i as dictKey, aL as diff, d5 as enrollAuthenticator, d6 as estimateEntropy, d7 as evaluateExportCapability, d8 as evaluateImportCapability, d9 as findAuthenticator, aM as formatDiff, da as hasExportCapability, db as hasImportCapability, dc as hasRecoveryEnrolled, aN as hashEntry, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, dd as isMagicLinkGrantExpired, de as isPublicEnvelope, df as issueDelegation, dg as keyringRecoverPassphrase, dh as keyringRotatePassphrase, di as listMagicLinkGrants, dj as listUsers, dk as listUsersWithEnvelopes, dl as loadActiveDelegations, dm as loadPaperRecoveryEntries, dn as magicLinkGrantRecordId, aO as paddedIndex, aP as parseIndex, dp as readMagicLinkGrantRecord, dq as removeAuthenticator, r as resolveI18nText, dr as resolvePublicEnvelopeSchema, ds as revokeDelegation, dt as revokeMagicLinkGrant, ao as runTransaction, du as savePaperRecoveryEntries, aQ as sha256Hex, dv as unwrapMagicLinkGrant, v as validateI18nTextValue, dw as validatePassphrase, dx as validatePublicEnvelopeInput, dy as validateSchemaInput, dz as validateSchemaOutput, o as validateSessionPolicy, dA as writeMagicLinkGrant } from './types-D-6bmD2c.js';
 export { d as detectMagic, a as detectMimeType, i as isPreCompressed } from './mime-magic-CBBSOkjm.js';
 export { AgeRoute, BlobLifecyclePolicy, BlobStoreRoute, CircuitBreakerOptions, HealthCheckOptions, LogLevel, LoggingOptions, MetricsOptions, OverrideOptions, OverrideTarget, RetryOptions, RouteStatus, RouteStoreOptions, RoutedNoydbStore, StoreCacheOptions, StoreMiddleware, StoreOperation, SuspendOptions, WrapBundleStoreOptions, WrappedBundleNoydbStore, createBundleStore, routeStore, withCache, withCircuitBreaker, withHealthCheck, withLogging, withMetrics, withRetry, wrapBundleStore, wrapStore } from './store/index.js';
 import { N as NoydbError } from './index-DJTf9yxn.js';
 export { A as AlreadyElevatedError, B as BackupCorruptedError, a as BackupLedgerError, b as BundleIntegrityError, c as BundleVersionConflictError, C as ConflictError, D as DEFAULT_JOIN_MAX_ROWS, d as DanglingReferenceError, e as DecryptionError, f as DelegationTargetMissingError, g as DictKeyInUseError, h as DictKeyMissingError, E as ElevationExpiredError, i as ExportCapabilityError, F as FilenameSanitizationError, G as GroupCardinalityError, I as ImportCapabilityError, j as IndexRequiredError, k as IndexWriteFailureError, l as InvalidKeyError, J as JoinContext, m as JoinLeg, n as JoinStrategy, o as JoinTooLargeError, p as JoinableSource, K as KeyringExpiredError, L as LedgerContentionError, q as LiveQuery, r as LiveUpstream, s as LocaleNotSpecifiedError, M as MissingTranslationError, t as NetworkError, u as NoAccessError, v as NotFoundError, O as OrderBy, P as PathEscapeError, w as PeriodClosedError, x as PermissionDeniedError, y as PrivilegeEscalationError, Q as Query, z as QueryPlan, H as QuerySource, R as ReadOnlyAtInstantError, S as ReadOnlyError, T as ReadOnlyFrameError, U as RefDescriptor, V as RefIntegrityError, W as RefMode, X as RefRegistry, Y as RefScopeError, Z as RefViolation, _ as ReservedCollectionNameError, $ as ScanBuilder, a0 as ScanPageProvider, a1 as SchemaValidationError, a2 as SessionExpiredError, a3 as SessionNotFoundError, a4 as SessionPolicyError, a5 as StoreCapabilityError, a6 as TamperedError, a7 as TierDemoteDeniedError, a8 as TierNotGrantedError, a9 as TranslatorNotConfiguredError, aa as ValidationError, ab as applyJoins, ac as buildLiveQuery, ad as executePlan, ae as ref, af as resetJoinWarnings } from './index-DJTf9yxn.js';
-export { C as CompressionAlgo, N as NOYDB_BUNDLE_FORMAT_VERSION, a as NOYDB_BUNDLE_MAGIC, b as NOYDB_BUNDLE_PREFIX_BYTES, c as NoydbBundleHeader, d as NoydbBundleReadResult, W as WriteNoydbBundleOptions, g as generateULID, h as hasNoydbBundleMagic, i as isULID, r as readNoydbBundle, e as readNoydbBundleHeader, f as readNoydbBundlePublicEnvelope, j as resetBrotliSupportCache, w as writeNoydbBundle } from './index-DhK_zqOO.js';
+export { C as CompressionAlgo, N as NOYDB_BUNDLE_FORMAT_VERSION, a as NOYDB_BUNDLE_MAGIC, b as NOYDB_BUNDLE_PREFIX_BYTES, c as NoydbBundleHeader, d as NoydbBundleReadResult, W as WriteNoydbBundleOptions, g as generateULID, h as hasNoydbBundleMagic, i as isULID, r as readNoydbBundle, e as readNoydbBundleHeader, f as readNoydbBundlePublicEnvelope, j as resetBrotliSupportCache, w as writeNoydbBundle } from './index-DZn6Yick.js';
 export { a as CrdtMode, b as CrdtState, L as LwwMapState, R as RgaState, Y as YjsState, m as mergeCrdtStates, r as resolveCrdtSnapshot } from './strategy-BSxFXGzb.js';
 export { SYNC_CREDENTIALS_COLLECTION, SyncCredential, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential } from './team/index.js';
-export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-BgFqShBi.js';
+export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-CcJ1qIi7.js';
 export { a as Clause, C as CollectionIndexes, F as FieldClause, b as FilterClause, G as GroupClause, H as HashIndex, I as IndexDef, O as Operator, e as evaluateClause, c as evaluateFieldClause, r as readPath } from './predicate-SBHmi6D0.js';
 export { a as AggregateResult, b as AggregateSpec, c as Aggregation, d as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, e as GROUPBY_WARN_CARDINALITY, f as GroupedAggregation, g as GroupedQuery, h as GroupedRow, L as LiveAggregation, R as Reducer, i as ReducerOptions, j as avg, l as count, m as groupAndReduce, n as max, o as min, r as reduceRecords, s as sum } from './strategy-D-SrOLCl.js';
-export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-BhoL7iUE.js';
+export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-1Xsqx1jl.js';
 import './lazy-builder-BwEoBQZ9.js';
 
+/**
+ * Persistence helpers for per-principal user envelopes stored at
+ * `_users/<keyringId>` (logically: `_meta/user/<keyringId>`).
+ *
+ * Unlike `_meta/policy` and `_meta/handle` which are plaintext, user
+ * envelopes carry user data and are encrypted with a dedicated
+ * {@link USER_ENVELOPE_COLLECTION} DEK (provisioned at vault open and
+ * propagated to every keyring via the system-collection DEK path in
+ * `team/keyring.ts`).
+ *
+ * This module is the **storage primitive** layer. The public API
+ * (`vault.user.*`) sits on top of this; permission gates, own-only
+ * write enforcement, and presence-channel propagation live there.
+ *
+ * @see docs/superpowers/specs/2026-05-05-user-envelope-design.md
+ *
+ * @module
+ */
+
+/**
+ * Read and decrypt the user envelope for `keyringId`. Returns `null`
+ * when no envelope has been persisted (either the principal has never
+ * called `updateMe`, or the keyring predates this feature).
+ *
+ * Decryption errors propagate — a tampered or wrong-keyed envelope
+ * surfaces as the underlying crypto error rather than masquerading as
+ * "not found".
+ */
+declare function loadUserEnvelope<T = unknown>(store: NoydbStore, vault: string, keyringId: string, dek: CryptoKey): Promise<UserEnvelope<T> | null>;
+/**
+ * Encrypt and persist the user envelope for `keyringId`. The new
+ * version is `(prior._v ?? 0) + 1`. Pass `expectedVersion` to enable
+ * optimistic-concurrency checks: a mismatch with the stored version
+ * throws {@link ConflictError} with the actual stored version.
+ *
+ * `expectedVersion: 0` means "expect no prior envelope"; the write
+ * succeeds only if no envelope exists yet.
+ *
+ * Soft-caps the JSON-serialized payload at {@link USER_ENVELOPE_MAX_BYTES};
+ * larger payloads throw {@link UserEnvelopeOversizedError}.
+ */
+declare function saveUserEnvelope<T>(store: NoydbStore, vault: string, keyringId: string, payload: T, dek: CryptoKey, expectedVersion?: number): Promise<UserEnvelope<T>>;
+/**
+ * Delete the user envelope for `keyringId`. Idempotent — no error if
+ * the envelope is already absent. Called from the keyring revoke path
+ * (cascade-delete) and is a no-op for keyrings that never wrote.
+ */
+declare function deleteUserEnvelope(store: NoydbStore, vault: string, keyringId: string): Promise<void>;
+/**
+ * List the keyring ids that have a user envelope persisted in `vault`.
+ * Order is store-defined — callers that need a stable order should sort.
+ */
+declare function listUserEnvelopeIds(store: NoydbStore, vault: string): Promise<string[]>;
+
 /**
  * Cache policy helpers — parse human-friendly byte budgets into raw numbers.
  *
@@ -508,4 +562,4 @@ type DiffCandidate<T = unknown> = Vault | Record<string, readonly T[]> | string;
  */
 declare function diffVault<T = unknown>(vault: Vault, candidate: DiffCandidate<T>, options?: DiffOptions): Promise<VaultDiff<T>>;
 
-export { ActiveTier, type CheckGateContext, DEFAULT_FRESHNESS_MS, type DiffCandidate, DiffEntry, type DiffOptions, FactorProof, GateName, GatePolicy, META_COLLECTION, NoydbError, NoydbStore, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, PolicyDeniedError, type PolicyDenyReason, PublicEnvelope, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, STRICT_POLICY, UnlockedKeyring, Vault, type VaultDiff, type VaultDiffEntry, type VaultDiffModifiedEntry, VaultPolicy, assertTierAccess, base64ToBuffer, bufferToBase64, checkGate, decryptBytes, decryptDeterministic, dekKey, derivePresenceKey, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, diffVault, effectiveClearance, encryptBytes, encryptDeterministic, estimateRecordBytes, loadPublicEnvelope, loadVaultPolicy, mergePolicy, parseBytes, readPublicEnvelope, savePublicEnvelope, saveVaultPolicy };
+export { ActiveTier, type CheckGateContext, DEFAULT_FRESHNESS_MS, type DiffCandidate, DiffEntry, type DiffOptions, FactorProof, GateName, GatePolicy, META_COLLECTION, NoydbError, NoydbStore, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, PolicyDeniedError, type PolicyDenyReason, PublicEnvelope, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, STRICT_POLICY, UnlockedKeyring, UserEnvelope, Vault, type VaultDiff, type VaultDiffEntry, type VaultDiffModifiedEntry, VaultPolicy, assertTierAccess, base64ToBuffer, bufferToBase64, checkGate, decryptBytes, decryptDeterministic, dekKey, deleteUserEnvelope, derivePresenceKey, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, diffVault, effectiveClearance, encryptBytes, encryptDeterministic, estimateRecordBytes, listUserEnvelopeIds, loadPublicEnvelope, loadUserEnvelope, loadVaultPolicy, mergePolicy, parseBytes, readPublicEnvelope, savePublicEnvelope, saveUserEnvelope, saveVaultPolicy };