@noy-db/hub 0.1.0-pre.5 → 0.1.0-pre.7

package/dist/team/index.d.cts

@@ -1,5 +1,5 @@
-import { at as NoydbStore, ar as UnlockedKeyring } from '../types-BpyE4o_n.cjs';
-export { b$ as PresenceHandle, cx as SyncEngine, cF as SyncTransaction, cZ as evaluateExportCapability, c_ as evaluateImportCapability, d0 as hasExportCapability, d1 as hasImportCapability } from '../types-BpyE4o_n.cjs';
+import { at as NoydbStore, ar as UnlockedKeyring } from '../types-D3QLmhlk.cjs';
+export { c2 as PresenceHandle, cA as SyncEngine, cI as SyncTransaction, d7 as evaluateExportCapability, d8 as evaluateImportCapability, da as hasExportCapability, db as hasImportCapability } from '../types-D3QLmhlk.cjs';
 import '../lazy-builder-CZVLKh0Z.cjs';
 import '../predicate-SBHmi6D0.cjs';
 import '../strategy-D-SrOLCl.cjs';

package/dist/team/index.d.ts

@@ -1,5 +1,5 @@
-import { at as NoydbStore, ar as UnlockedKeyring } from '../types-Df72wWCC.js';
-export { b$ as PresenceHandle, cx as SyncEngine, cF as SyncTransaction, cZ as evaluateExportCapability, c_ as evaluateImportCapability, d0 as hasExportCapability, d1 as hasImportCapability } from '../types-Df72wWCC.js';
+import { at as NoydbStore, ar as UnlockedKeyring } from '../types-D-6bmD2c.js';
+export { c2 as PresenceHandle, cA as SyncEngine, cI as SyncTransaction, d7 as evaluateExportCapability, d8 as evaluateImportCapability, da as hasExportCapability, db as hasImportCapability } from '../types-D-6bmD2c.js';
 import '../lazy-builder-BwEoBQZ9.js';
 import '../predicate-SBHmi6D0.js';
 import '../strategy-D-SrOLCl.js';

package/dist/team/index.js

@@ -5,20 +5,20 @@ import {
   getCredential,
   listCredentials,
   putCredential
-} from "../chunk-MIRZMUSQ.js";
+} from "../chunk-INSJBB5W.js";
 import {
   PresenceHandle,
   SyncEngine,
   SyncTransaction
-} from "../chunk-H3DV46AQ.js";
+} from "../chunk-CL37QSND.js";
 import {
   evaluateExportCapability,
   evaluateImportCapability,
   hasExportCapability,
   hasImportCapability
-} from "../chunk-6NPQTBZN.js";
+} from "../chunk-6IJQ27XN.js";
 import "../chunk-2QR2PQTT.js";
-import "../chunk-NXUVITPB.js";
+import "../chunk-B6HF6NTZ.js";
 import "../chunk-MR4424N3.js";
 import "../chunk-ACLDOTNQ.js";
 export {

package/dist/tx/index.d.cts

@@ -1,5 +1,5 @@
-import { ak as TxStrategy } from '../types-BpyE4o_n.cjs';
-export { al as TxCollection, am as TxContext, an as TxVault, ao as runTransaction } from '../types-BpyE4o_n.cjs';
+import { ak as TxStrategy } from '../types-D3QLmhlk.cjs';
+export { al as TxCollection, am as TxContext, an as TxVault, ao as runTransaction } from '../types-D3QLmhlk.cjs';
 import '../lazy-builder-CZVLKh0Z.cjs';
 import '../predicate-SBHmi6D0.cjs';
 import '../strategy-D-SrOLCl.cjs';

package/dist/tx/index.d.ts

@@ -1,5 +1,5 @@
-import { ak as TxStrategy } from '../types-Df72wWCC.js';
-export { al as TxCollection, am as TxContext, an as TxVault, ao as runTransaction } from '../types-Df72wWCC.js';
+import { ak as TxStrategy } from '../types-D-6bmD2c.js';
+export { al as TxCollection, am as TxContext, an as TxVault, ao as runTransaction } from '../types-D-6bmD2c.js';
 import '../lazy-builder-BwEoBQZ9.js';
 import '../predicate-SBHmi6D0.js';
 import '../strategy-D-SrOLCl.js';

package/dist/{types-Df72wWCC.d.ts → types-D-6bmD2c.d.ts}

@@ -1819,6 +1819,56 @@ declare function assertStrongPassphrase(s: string, opts?: PassphrasePolicy & {
  */
 declare function estimateEntropy(passphrase: string): number;
 
+/**
+ * Type surface for the per-principal user envelope subsystem.
+ *
+ * @see docs/superpowers/specs/2026-05-05-user-envelope-design.md
+ *
+ * @module
+ */
+
+/**
+ * Thin reader view of a user envelope. The on-disk shape is the standard
+ * {@link import('../../types.js').EncryptedEnvelope}; this is what callers
+ * see after the storage layer has decrypted the payload.
+ *
+ * Hub commits to the `keyringId` ⇔ `userId` identity and the `_v` / `_ts`
+ * envelope metadata. The `data` payload is fully app-defined — hub does
+ * not introspect, validate, or reserve any keys inside it.
+ */
+interface UserEnvelope<T> {
+    /** The principal id this envelope belongs to. Equals the keyring `user_id`. */
+    readonly keyringId: string;
+    /** App-owned payload. Opaque to hub. */
+    readonly data: T;
+    /** Optimistic-concurrency version. Increments on every write. */
+    readonly _v: number;
+    /** ISO timestamp of the last write. */
+    readonly _ts: string;
+}
+/**
+ * Soft cap on the JSON-serialized payload size. Generous (a typical
+ * profile + preferences + small app annex is ~1 KiB); rejects accidental
+ * "stuff app state in here" anti-patterns.
+ */
+declare const USER_ENVELOPE_MAX_BYTES: number;
+/**
+ * Reserved store collection name for user envelopes. Starts with `_` so the
+ * keyring grant machinery propagates the DEK to every granted user via the
+ * existing system-collection DEK propagation path in `team/keyring.ts`.
+ */
+declare const USER_ENVELOPE_COLLECTION = "_users";
+/**
+ * Thrown when a user-envelope payload exceeds {@link USER_ENVELOPE_MAX_BYTES}
+ * after JSON-serialization. The error carries the actual size so callers
+ * can decide whether to trim or split.
+ */
+declare class UserEnvelopeOversizedError extends NoydbError {
+    readonly bytes: number;
+    readonly limit: number;
+    constructor(bytes: number, limit?: number);
+}
+
 /** In-memory representation of an unlocked keyring. */
 interface UnlockedKeyring {
     readonly userId: string;
@@ -1911,6 +1961,29 @@ interface BundleRecipient {
  * @internal
  */
 declare function buildRecipientKeyringFile(callerKeyring: UnlockedKeyring, recipient: BundleRecipient): Promise<KeyringFile>;
+/** List all users with access to a vault. */
+declare function listUsers(adapter: NoydbStore, vault: string): Promise<UserInfo[]>;
+/**
+ * Joined enumeration: every keyring + its `_users/<keyringId>`
+ * envelope side by side. Convenience for admin UIs that want to
+ * render team-member lists with profile data ("Bob — operator —
+ * 'Bob the Auditor' avatar X locale fr-FR") in a single pass.
+ *
+ * `userEnvelopeDek` is the vault's `_users` collection DEK
+ * (`vault.getDEK('_users')`); used to decrypt every envelope.
+ *
+ * Principals without a persisted envelope (legacy keyrings predating
+ * the user-envelope feature) come back with `envelope: null`. The
+ * caller chooses how to render — usually "fall back to keyring's
+ * `displayName`".
+ *
+ * Order matches `listUsers()` (store-defined; sort if you need a
+ * stable display order).
+ */
+declare function listUsersWithEnvelopes<T = unknown>(adapter: NoydbStore, vault: string, userEnvelopeDek: CryptoKey): Promise<Array<{
+    user: UserInfo;
+    envelope: UserEnvelope<T> | null;
+}>>;
 /**
  * Check whether a keyring is authorised for a given `@noy-db/as-*`
  * export tier.
@@ -3342,7 +3415,11 @@ interface GatePolicy {
  * and use the same engine; the engine treats unknown names with no
  * configured policy as "no gate" (no-op).
  */
-type BuiltInGateName = 'rotate-passphrase' | 'recover-passphrase' | 'enroll-authenticator' | 'remove-authenticator' | 'rotate-unlock' | 'enroll-user' | 'revoke-user' | 'export-bundle' | 'export-plaintext' | 'view-user-auth';
+type BuiltInGateName = 'rotate-passphrase' | 'recover-passphrase' | 'enroll-authenticator' | 'remove-authenticator' | 'rotate-unlock' | 'enroll-user' | 'revoke-user' | 'export-bundle' | 'export-plaintext' | 'view-user-auth'
+/** Authorize a write to one's own user envelope (#22). */
+ | 'edit-own-profile'
+/** Authorize reading other principals' user envelopes (#22). */
+ | 'view-team-profiles';
 /** Either a built-in gate name or an `app:*` custom gate. */
 type GateName = BuiltInGateName | `app:${string}`;
 /**
@@ -3627,6 +3704,28 @@ declare class Noydb {
     private getSyncEngine;
     on<K extends keyof NoydbEventMap>(event: K, handler: (data: NoydbEventMap[K]) => void): void;
     off<K extends keyof NoydbEventMap>(event: K, handler: (data: NoydbEventMap[K]) => void): void;
+    /**
+     * Soft-lock a single vault: clear its in-memory keyring, DEKs, vault
+     * instance, sync engine, policy enforcer, and active-tier entry —
+     * WITHOUT destroying the `Noydb` instance.
+     *
+     * Designed for "lock screen" UX: the user taps **Lock** and DEKs are
+     * scrubbed from memory immediately, but the same `Noydb` instance can
+     * be re-unlocked via {@link unlockViaAuthenticator} (tier 2) or
+     * {@link unlockViaPin} (tier 3) without re-running `createNoydb`.
+     *
+     * **QuickUnlock state is preserved.** That's the whole point — the
+     * user can still resume via PIN without a full credential re-prompt.
+     * The on-disk `_meta/policy` document is also kept in cache (it
+     * survives lock; nothing about it changes when DEKs are scrubbed).
+     *
+     * No-op when `vault` is not currently in cache (idempotent).
+     *
+     * Unblocks vLannaAi/niwat#33.
+     *
+     * @see #17
+     */
+    lockVault(vault: string): void;
     close(): void;
     /**
      * Returns a snapshot of all translator invocations since the last
@@ -3718,6 +3817,73 @@ declare class Noydb {
     }): Promise<void>;
     /** Read the slot list for a vault. Internal — `describeAuthConfig` (#13) consumes this. */
     listAuthenticators(vault: string): Promise<ReadonlyArray<KeyringAuthenticator>>;
+    /**
+     * Native WebAuthn enrollment using the **real** internal keyring (#16).
+     *
+     * Why this exists: when a consumer is using `createNoydb({ secret })`,
+     * they cannot reach the live `UnlockedKeyring` to feed it to
+     * `enrollWebAuthn(keyring, vault, opts)` from `@noy-db/on-webauthn`.
+     * Constructing a synthetic keyring (the previous workaround) produces
+     * a slot whose `wrapped_kek` references the synthetic payload, not
+     * the live session — so `unlockViaAuthenticator()` later replaces the
+     * live DEK map with stale wrapped DEKs and every decrypt fails.
+     *
+     * This method runs `ceremony` with the REAL keyring (still in
+     * `keyringCache`). The ceremony performs the WebAuthn enrollment and
+     * returns the slot options that hub then persists via the standard
+     * tier-2 enrollAuthenticator path.
+     *
+     * Layering note: hub does not import `@noy-db/on-webauthn` (that
+     * would invert the dep graph). The consumer wires it in:
+     *
+     * ```ts
+     * import { enrollWebAuthn } from '@noy-db/on-webauthn'
+     *
+     * await db.enrollWebAuthn('demo', async (keyring) => {
+     *   const e = await enrollWebAuthn(keyring, 'demo', { rp: {...} })
+     *   return {
+     *     id: `webauthn-${e.credentialId.slice(0, 8)}`,
+     *     method: 'webauthn',
+     *     wrapped_kek: e.wrappedPayload,
+     *     meta: {
+     *       credentialId: e.credentialId,
+     *       wrapIv: e.wrapIv,
+     *       prfUsed: e.prfUsed,
+     *       beFlag: e.beFlag,
+     *       requireSingleDevice: e.requireSingleDevice,
+     *     },
+     *   }
+     * })
+     * ```
+     *
+     * Returns the WebAuthn `credentialId` (extracted from `meta.credentialId`)
+     * for the caller's lookup index (a bootstrap vault, a PublicEnvelope,
+     * a server-side allowlist).
+     *
+     * Gated by `enroll-authenticator` like `enrollAuthenticator()` itself.
+     *
+     * @see #16
+     */
+    enrollWebAuthn(vault: string, ceremony: (keyring: UnlockedKeyring) => Promise<EnrollAuthenticatorOptions>, presented?: {
+        factors?: ReadonlyArray<FactorProof>;
+        sharedDevice?: boolean;
+    }): Promise<{
+        credentialId: string;
+    }>;
+    /**
+     * Filter the slot list to webauthn-method slots only. Useful for
+     * "you have N WebAuthn credentials enrolled" UI surfaces and for
+     * deciding when a new device prompt should appear. Identity is
+     * `id` + `enrolled_at`; the `meta.credentialId` (base64) is used by
+     * `allowCredentials` at unlock time.
+     *
+     * @see #16
+     */
+    listWebAuthnSlots(vault: string): Promise<ReadonlyArray<{
+        id: string;
+        enrolledAt: string;
+        credentialId: string;
+    }>>;
     /**
      * Resolve a slot by id, then hand the wrapped-KEK ciphertext + meta
      * to the caller-supplied verifier. The verifier is the
@@ -4317,6 +4483,170 @@ declare function magicLinkGrantRecordId(token: string, index: number): string;
  */
 declare function isMagicLinkGrantExpired(payload: MagicLinkGrantPayload, now?: Date): boolean;
 
+/**
+ * Public `vault.user.*` API surface.
+ *
+ * Three families:
+ *  - Write-self: `me` / `updateMe` / `setMe` — always target the writer's
+ *    own keyringId. **Own-only write rule** is structural — no method
+ *    exists to write someone else's envelope.
+ *  - Read-anyone: `get` / `list` — read other principals' envelopes
+ *    (subject to `view-team-profiles` policy gate, wired in #22).
+ *  - Reactive: `subscribe` / `live` — in-process event emission on local
+ *    writes. Cross-instance updates land via the team/sync engine and
+ *    surface to subscribers when the sync diff replays through this API.
+ *
+ * @see docs/superpowers/specs/2026-05-05-user-envelope-design.md
+ *
+ * @module
+ */
+
+/**
+ * Recursive partial. Used for `updateMe(patch)` so callers can hand in
+ * deeply-nested partial shapes and have them deep-merged onto the
+ * current envelope.
+ */
+type DeepPartial<T> = T extends object ? {
+    [P in keyof T]?: DeepPartial<T[P]>;
+} : T;
+/** Cancel a previously-registered subscription. */
+type Unsubscribe = () => void;
+/**
+ * Optional factor-proof bundle threaded into gated user-envelope
+ * operations. Same shape as `Noydb.checkGate(vault, gate, presented)`
+ * accepts elsewhere — apps that have already presented a TOTP/email-OTP
+ * for this session pass it here to satisfy tightened policies.
+ */
+interface UserEnvelopePresented {
+    readonly factors?: readonly FactorProof[];
+    readonly sharedDevice?: boolean;
+}
+/**
+ * Callback used by `UserApi` to validate the active session against a
+ * policy gate. Provided by the `Vault` constructor; in production this
+ * delegates to `Noydb.checkGate(vault, gate, presented)`. In tests, a
+ * no-op stub is fine.
+ */
+type UserEnvelopeCheckGate = (gate: 'edit-own-profile' | 'view-team-profiles', presented?: UserEnvelopePresented) => Promise<void>;
+/**
+ * Reactive handle returned by `live()`. `current` is the most recently
+ * observed value; `subscribe(cb)` fires on subsequent local writes.
+ * `stop()` releases the underlying subscription.
+ */
+interface LiveUserEnvelope<T> {
+    current(): UserEnvelope<T> | null;
+    subscribe(cb: (env: UserEnvelope<T> | null) => void): Unsubscribe;
+    stop(): void;
+}
+/**
+ * Implementation behind `vault.user`. Constructed once per Vault, holds
+ * the writer's keyringId in closure so `updateMe`/`setMe` cannot target
+ * any other principal — the own-only rule is enforced at the type level
+ * (no `set(otherKeyringId, …)` method) AND at runtime (the
+ * keyringId argument simply doesn't exist on the write path).
+ */
+declare class UserApi {
+    private readonly adapter;
+    private readonly vaultName;
+    /** The writer's own keyringId. Frozen at construction time. */
+    private readonly writerKeyringId;
+    private readonly getDek;
+    /**
+     * Policy-gate validator. When omitted, gates are skipped — useful
+     * for low-level tests that exercise the storage layer directly.
+     * Production paths always wire the Noydb-backed implementation.
+     */
+    private readonly checkGate?;
+    /** keyringId → set of listeners. Wildcard '*' fires on every change. */
+    private readonly listeners;
+    constructor(adapter: NoydbStore, vaultName: string, 
+    /** The writer's own keyringId. Frozen at construction time. */
+    writerKeyringId: string, getDek: () => Promise<CryptoKey>, 
+    /**
+     * Policy-gate validator. When omitted, gates are skipped — useful
+     * for low-level tests that exercise the storage layer directly.
+     * Production paths always wire the Noydb-backed implementation.
+     */
+    checkGate?: UserEnvelopeCheckGate | undefined);
+    /** Read the writer's own envelope. Returns null if never written. */
+    me<T = unknown>(): Promise<UserEnvelope<T> | null>;
+    /**
+     * Deep-merge a partial patch into the writer's own envelope. Creates
+     * the envelope on first call. Optimistic-concurrency safe — a stale
+     * `_v` (parallel writer on another device) throws `ConflictError`.
+     *
+     * Gated by the `edit-own-profile` policy gate (default `minTier: 3`).
+     * Pass `presented` to satisfy tightened policies that require a
+     * factor proof (e.g. STRICT_POLICY's TOTP requirement).
+     */
+    updateMe<T extends object = Record<string, unknown>>(patch: DeepPartial<T>, presented?: UserEnvelopePresented): Promise<UserEnvelope<T>>;
+    /**
+     * Replace the writer's own envelope with `payload`. Use sparingly —
+     * `updateMe` is the canonical mutation. No `expectedVersion` check;
+     * callers explicitly take last-write-wins semantics.
+     *
+     * Gated by `edit-own-profile`. See `updateMe` for `presented` usage.
+     */
+    setMe<T = unknown>(payload: T, presented?: UserEnvelopePresented): Promise<UserEnvelope<T>>;
+    /**
+     * Read another principal's envelope by their keyringId. Returns null
+     * if the principal exists but has no envelope yet, or if the
+     * keyringId does not exist at all.
+     *
+     * Gated by `view-team-profiles` (default `minTier: 2`) — but ONLY for
+     * cross-principal reads. Reading your own envelope (`keyringId ===
+     * self`) is never gated; that's just `me()` written long-form.
+     */
+    get<T = unknown>(keyringId: string, presented?: UserEnvelopePresented): Promise<UserEnvelope<T> | null>;
+    /**
+     * Read every persisted envelope in the vault. Order is store-defined.
+     *
+     * Gated by `view-team-profiles`. Default policy (`minTier: 2`) lets
+     * any authenticated session read all envelopes. Two privacy-strict
+     * opt-outs:
+     *
+     *  - `view-team-profiles.enabled: false` → list() returns only the
+     *    caller's own envelope (silent self-fallback, no thrown error).
+     *  - `view-team-profiles.minTier: 1` + insufficient tier → throws
+     *    `PolicyDeniedError` with `reason: 'insufficient-tier'`. The
+     *    caller is expected to elevate, not silently degrade.
+     *
+     * The asymmetry is deliberate: `enabled: false` is a deliberate
+     * design choice ("nobody sees teammate profiles in this app");
+     * `insufficient-tier` is "you need to authenticate further". Different
+     * UX prompts for different intents.
+     */
+    list<T = unknown>(presented?: UserEnvelopePresented): Promise<UserEnvelope<T>[]>;
+    /**
+     * Listen for changes to a specific keyringId's envelope. The callback
+     * fires synchronously after every successful local `updateMe` /
+     * `setMe` for that principal.
+     *
+     * Cross-instance changes (a teammate edits their profile on their
+     * device, the sync engine pulls the diff onto this device) will fire
+     * subscribers when the sync layer replays the write through this API.
+     * In v1, subscribers do NOT fire on raw store changes — wire your sync
+     * layer to call back through `vault.user.setMe` / `updateMe` if you
+     * need that.
+     *
+     * Pass keyringId `'*'` to fire on every change in the vault.
+     */
+    subscribe<T = unknown>(keyringId: string, cb: (env: UserEnvelope<T> | null) => void): Unsubscribe;
+    /**
+     * Reactive handle that caches the current value and re-reads on every
+     * change for the given keyringId. Convenient for framework bindings:
+     *
+     *   const live = vault.user.live<UserShape>(vault.userId)
+     *   live.subscribe(env => render(env?.data))
+     *
+     * Initial value is `null` until the first `current()` call materializes
+     * it via `vault.user.get()`. Call `stop()` when done to release the
+     * subscription.
+     */
+    live<T = unknown>(keyringId: string): LiveUserEnvelope<T>;
+    private fireChange;
+}
+
 /** A vault (tenant namespace) containing collections. */
 declare class Vault {
     private readonly adapter;
@@ -4360,6 +4690,19 @@ declare class Vault {
     private readonly i18nStrategy;
     private readonly syncStrategy;
     private getDEK;
+    /**
+     * Per-principal user envelope API.
+     *
+     * - Write-self: `me()`, `updateMe(patch)`, `setMe(payload)` — always
+     *   target this vault session's keyringId. There is no method to write
+     *   another principal's envelope (own-only write rule, structural).
+     * - Read-anyone: `get(keyringId)`, `list()` — read other principals'
+     *   envelopes, subject to the `view-team-profiles` policy gate (#22).
+     * - Reactive: `subscribe(id, cb)`, `live(id)` — fire on local writes.
+     *
+     * @see docs/superpowers/specs/2026-05-05-user-envelope-design.md
+     */
+    readonly user: UserApi;
     /**
      * Optional callback that re-derives an UnlockedKeyring from the
      * adapter using the active user's passphrase. Called by `load()`
@@ -7653,6 +7996,23 @@ interface GrantOptions {
      * `PassphrasePolicy`. Test fixtures and CLI scripts pass `true`.
      */
     readonly allowWeakPassphrase?: boolean;
+    /**
+     * Initial user-envelope payload for the new principal. Sealed under
+     * the same vault DEK (the reserved `_users` collection's DEK) and
+     * persisted alongside the keyring during grant.
+     *
+     * **Bootstrap-only.** Once the new user activates and writes their
+     * own envelope, the own-only write rule kicks in — admins cannot
+     * edit a teammate's envelope after activation. Use this field for
+     * pre-fill at invite time (e.g. "displayName: Bob, locale: en-US")
+     * and let the user take over from there.
+     *
+     * Hub does not introspect the payload; it is JSON-serialized and
+     * encrypted opaquely. Apps own the schema.
+     *
+     * @see docs/superpowers/specs/2026-05-05-user-envelope-design.md → Lifecycle
+     */
+    readonly initialProfile?: unknown;
 }
 interface RevokeOptions {
     readonly userId: string;
@@ -8346,6 +8706,22 @@ interface NoydbOptions {
      * turn this on now.
      */
     readonly requireRecovery?: boolean;
+    /**
+     * What to do when `openVault` finds an existing keyring in the store that
+     * cannot be decrypted with the supplied credentials (`InvalidKeyError`).
+     *
+     * - `'error'` (default) — propagate the error. The app must prompt the user
+     *   to supply the correct credentials or clear both the data and auth stores.
+     * - `'reset'` — delete the stale keyring and re-initialise the vault from
+     *   scratch using the current credentials. Use this when the data store can
+     *   become detached from the auth store (e.g. the user cleared the IndexedDB
+     *   data records but not the keyring row, or a WebAuthn credential was rotated).
+     *   **All previously encrypted data is unrecoverable after a reset.**
+     *
+     * Only applies to the passphrase (`secret`) path. When `getKeyring` is used,
+     * the callback is responsible for handling stale-keyring detection itself.
+     */
+    readonly onInvalidKey?: 'error' | 'reset';
     /**
      * Enable the public envelope subsystem (`docs/subsystems/public-envelope.md`).
      * Pass `true` for the default schema (every standard field, 256 KB
@@ -8454,4 +8830,4 @@ interface DeleteManyResult {
     }>;
 }
 
-export { type ConsentAuditEntry as $, type BlobObject as A, type BlobStrategy as B, type BlobPutOptions as C, DICT_COLLECTION_PREFIX as D, type BlobResponseOptions as E, BlobSet as F, type BlobStrategyOpenArgs as G, type CompactRunOptions as H, type I18nStrategy as I, type CompactionContext as J, type CompactionResult as K, DEFAULT_CHUNK_SIZE as L, EXPORT_AUDIT_COLLECTION as M, ExportBlobsAbortedError as N, type ExportBlobsAuditEntry as O, PolicyEnforcer as P, type ExportBlobsHandle as Q, type ExportBlobsOptions as R, type SessionStrategy as S, type ExportedBlob as T, type SlotInfo as U, type SlotRecord as V, type VersionRecord as W, createExportBlobsHandle as X, runCompaction as Y, type ConsentStrategy as Z, CONSENT_AUDIT_COLLECTION as _, type DictEntry as a, type BundleRecipient as a$, type ConsentAuditFilter as a0, type ConsentContext as a1, type ConsentOp as a2, loadConsentEntries as a3, writeConsentEntry as a4, type PeriodsStrategy as a5, type CarryForwardContext as a6, type ClosePeriodOptions as a7, type OpenPeriodOptions as a8, PERIODS_COLLECTION as a9, type DiffEntry as aA, type JsonPatch as aB, type JsonPatchOp as aC, type LedgerEntry as aD, LedgerStore as aE, type VaultEngine as aF, VaultInstant as aG, type VerifyResult as aH, applyPatch as aI, canonicalJson as aJ, computePatch as aK, diff as aL, formatDiff as aM, hashEntry as aN, paddedIndex as aO, parseIndex as aP, sha256Hex as aQ, type PublicEnvelope as aR, type GateName as aS, type GatePolicy as aT, type VaultPolicy as aU, type ActiveTier as aV, type FactorProof as aW, Vault as aX, type AccessibleVault as aY, BUNDLE_STORE_POLICY as aZ, type BuiltInGateName as a_, type PeriodRecord as aa, type ReadOnlyCollection as ab, appendPeriodLedgerEntry as ac, assertTsWritable as ad, chainAnchor as ae, loadPeriods as af, validatePeriodName as ag, type ShadowStrategy as ah, CollectionFrame as ai, VaultFrame as aj, type TxStrategy as ak, TxCollection as al, TxContext as am, TxVault as an, runTransaction as ao, type SyncStrategy as ap, type Role as aq, type UnlockedKeyring as ar, type HistoryStrategy as as, type NoydbStore as at, type HistoryOptions as au, type EncryptedEnvelope as av, type PruneOptions as aw, type AppendInput as ax, type ChangeType as ay, CollectionInstant as az, type DictKeyDescriptor as b, PresenceHandle as b$, type CacheOptions as b0, type CacheStats as b1, type ChangeEvent as b2, Collection as b3, type CollectionChangeEvent as b4, type CollectionConflictResolver as b5, type Conflict as b6, type ConflictPolicy as b7, type ConflictStrategy as b8, type CrossTierAccessEvent as b9, type ListPageResult as bA, type LocaleReadOptions as bB, Lru as bC, type LruOptions as bD, type LruStats as bE, MAGIC_LINK_CONTENT_INFO_PREFIX as bF, MAGIC_LINK_GRANTS_COLLECTION as bG, MAGIC_LINK_KEK_INFO_PREFIX as bH, type MagicLinkGrantPayload as bI, type MagicLinkGrantRecord as bJ, NOYDB_BACKUP_VERSION as bK, NOYDB_FORMAT_VERSION as bL, NOYDB_KEYRING_VERSION as bM, NOYDB_SYNC_VERSION as bN, Noydb as bO, type NoydbBundleStore as bP, type NoydbEventMap as bQ, type NoydbOptions as bR, PUBLIC_ENVELOPE_FIELDS as bS, type PaperRecoveryDoc as bT, type PaperRecoveryEntry as bU, type PassphrasePolicy as bV, type PassphraseValidationResult as bW, type Permission as bX, type Permissions as bY, type PlaintextTranslatorContext as bZ, type PlaintextTranslatorFn as b_, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as ba, DELEGATIONS_COLLECTION as bb, type DelegationToken as bc, type DeleteManyResult as bd, type DirtyEntry as be, ELEVATION_AUDIT_COLLECTION as bf, ElevatedHandle as bg, type EnrollAuthenticatorOptions as bh, type ExportCapability as bi, type ExportChunk as bj, type ExportFormat as bk, type ExportStreamOptions as bl, type FactorKind as bm, type FactorRequirement as bn, type GhostRecord as bo, type GrantOptions as bp, type HistoryConfig as bq, type HistoryEntry as br, INDEXED_STORE_POLICY as bs, type ImportCapability as bt, type InferOutput as bu, type IssueDelegationOptions as bv, type IssueMagicLinkGrantOptions as bw, type KeyringAuthenticator as bx, type KeyringFile as by, type ListAccessibleVaultsOptions as bz, DictionaryHandle as c, findAuthenticator as c$, type PresencePeer as c0, type PublicEnvelopeField as c1, type PublicEnvelopeSchema as c2, type PublicEnvelopeText as c3, type PullMode as c4, type PullOptions as c5, type PullPolicy as c6, type PullResult as c7, type PushMode as c8, type PushOptions as c9, SyncScheduler as cA, type SyncSchedulerStatus as cB, type SyncStatus as cC, type SyncTarget as cD, type SyncTargetRole as cE, SyncTransaction as cF, type SyncTransactionResult as cG, type TierMode as cH, type TranslatorAuditEntry as cI, type TxOp as cJ, type UserInfo as cK, type VaultBackup as cL, type VaultPolicyOnDisk as cM, type VaultSnapshot as cN, type WarningRules as cO, WeakPassphraseError as cP, type WeakPassphraseReason as cQ, assertStrongPassphrase as cR, buildRecipientKeyringFile as cS, burnPaperRecoveryEntry as cT, createNoydb as cU, createStore as cV, deriveMagicLinkContentKey as cW, enrollAuthenticator as cX, estimateEntropy as cY, evaluateExportCapability as cZ, evaluateImportCapability as c_, type PushPolicy as ca, type PushResult as cb, type PutManyItemOptions as cc, type PutManyOptions as cd, type PutManyResult as ce, type QueryAcrossOptions as cf, type QueryAcrossResult as cg, type QuickUnlockState as ch, QuickUnlockStore as ci, type ReAuthOperation as cj, type RecoverPassphraseInput as ck, type RecoveryProof as cl, type ResolvedPublicEnvelopeSchema as cm, type RevokeOptions as cn, type RotatePassphraseInput as co, type SessionPolicy as cp, type SetPublicEnvelopeInput as cq, type StandardSchemaV1 as cr, type StandardSchemaV1Issue as cs, type StandardSchemaV1SyncResult as ct, type StoreAuth as cu, type StoreAuthKind as cv, type StoreCapabilities as cw, SyncEngine as cx, type SyncMetadata as cy, type SyncPolicy as cz, type DictionaryOptions as d, hasExportCapability as d0, hasImportCapability as d1, hasRecoveryEnrolled as d2, isMagicLinkGrantExpired as d3, isPublicEnvelope as d4, issueDelegation as d5, recoverPassphrase as d6, rotatePassphrase as d7, listMagicLinkGrants as d8, loadActiveDelegations as d9, loadPaperRecoveryEntries as da, magicLinkGrantRecordId as db, readMagicLinkGrantRecord as dc, removeAuthenticator as dd, resolveSchema as de, revokeDelegation as df, revokeMagicLinkGrant as dg, savePaperRecoveryEntries as dh, unwrapMagicLinkGrant as di, validatePassphrase as dj, validatePublicEnvelopeInput as dk, validateSchemaInput as dl, validateSchemaOutput as dm, writeMagicLinkGrant as dn, type I18nTextDescriptor as e, type I18nTextOptions as f, applyI18nLocale as g, dictCollectionName as h, dictKey as i, i18nText as j, isDictCollectionName as k, isDictKeyDescriptor as l, isI18nTextDescriptor as m, createEnforcer as n, validateSessionPolicy as o, BLOB_CHUNKS_COLLECTION as p, BLOB_COLLECTION as q, resolveI18nText as r, BLOB_EVICTION_AUDIT_COLLECTION as s, BLOB_INDEX_COLLECTION as t, BLOB_SLOTS_PREFIX as u, validateI18nTextValue as v, BLOB_VERSIONS_PREFIX as w, type BlobEvictionEntry as x, type BlobFieldPolicy as y, type BlobFieldsConfig as z };
+export { type ConsentAuditEntry as $, type BlobObject as A, type BlobStrategy as B, type BlobPutOptions as C, DICT_COLLECTION_PREFIX as D, type BlobResponseOptions as E, BlobSet as F, type BlobStrategyOpenArgs as G, type CompactRunOptions as H, type I18nStrategy as I, type CompactionContext as J, type CompactionResult as K, DEFAULT_CHUNK_SIZE as L, EXPORT_AUDIT_COLLECTION as M, ExportBlobsAbortedError as N, type ExportBlobsAuditEntry as O, PolicyEnforcer as P, type ExportBlobsHandle as Q, type ExportBlobsOptions as R, type SessionStrategy as S, type ExportedBlob as T, type SlotInfo as U, type SlotRecord as V, type VersionRecord as W, createExportBlobsHandle as X, runCompaction as Y, type ConsentStrategy as Z, CONSENT_AUDIT_COLLECTION as _, type DictEntry as a, type BuiltInGateName as a$, type ConsentAuditFilter as a0, type ConsentContext as a1, type ConsentOp as a2, loadConsentEntries as a3, writeConsentEntry as a4, type PeriodsStrategy as a5, type CarryForwardContext as a6, type ClosePeriodOptions as a7, type OpenPeriodOptions as a8, PERIODS_COLLECTION as a9, type DiffEntry as aA, type JsonPatch as aB, type JsonPatchOp as aC, type LedgerEntry as aD, LedgerStore as aE, type VaultEngine as aF, VaultInstant as aG, type VerifyResult as aH, applyPatch as aI, canonicalJson as aJ, computePatch as aK, diff as aL, formatDiff as aM, hashEntry as aN, paddedIndex as aO, parseIndex as aP, sha256Hex as aQ, type UserEnvelope as aR, type PublicEnvelope as aS, type GateName as aT, type GatePolicy as aU, type VaultPolicy as aV, type ActiveTier as aW, type FactorProof as aX, Vault as aY, type AccessibleVault as aZ, BUNDLE_STORE_POLICY as a_, type PeriodRecord as aa, type ReadOnlyCollection as ab, appendPeriodLedgerEntry as ac, assertTsWritable as ad, chainAnchor as ae, loadPeriods as af, validatePeriodName as ag, type ShadowStrategy as ah, CollectionFrame as ai, VaultFrame as aj, type TxStrategy as ak, TxCollection as al, TxContext as am, TxVault as an, runTransaction as ao, type SyncStrategy as ap, type Role as aq, type UnlockedKeyring as ar, type HistoryStrategy as as, type NoydbStore as at, type HistoryOptions as au, type EncryptedEnvelope as av, type PruneOptions as aw, type AppendInput as ax, type ChangeType as ay, CollectionInstant as az, type DictKeyDescriptor as b, type Permissions as b$, type BundleRecipient as b0, type CacheOptions as b1, type CacheStats as b2, type ChangeEvent as b3, Collection as b4, type CollectionChangeEvent as b5, type CollectionConflictResolver as b6, type Conflict as b7, type ConflictPolicy as b8, type ConflictStrategy as b9, type KeyringFile as bA, type ListAccessibleVaultsOptions as bB, type ListPageResult as bC, type LiveUserEnvelope as bD, type LocaleReadOptions as bE, Lru as bF, type LruOptions as bG, type LruStats as bH, MAGIC_LINK_CONTENT_INFO_PREFIX as bI, MAGIC_LINK_GRANTS_COLLECTION as bJ, MAGIC_LINK_KEK_INFO_PREFIX as bK, type MagicLinkGrantPayload as bL, type MagicLinkGrantRecord as bM, NOYDB_BACKUP_VERSION as bN, NOYDB_FORMAT_VERSION as bO, NOYDB_KEYRING_VERSION as bP, NOYDB_SYNC_VERSION as bQ, Noydb as bR, type NoydbBundleStore as bS, type NoydbEventMap as bT, type NoydbOptions as bU, PUBLIC_ENVELOPE_FIELDS as bV, type PaperRecoveryDoc as bW, type PaperRecoveryEntry as bX, type PassphrasePolicy as bY, type PassphraseValidationResult as bZ, type Permission as b_, type CrossTierAccessEvent as ba, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as bb, DELEGATIONS_COLLECTION as bc, type DeepPartial as bd, type DelegationToken as be, type DeleteManyResult as bf, type DirtyEntry as bg, ELEVATION_AUDIT_COLLECTION as bh, ElevatedHandle as bi, type EnrollAuthenticatorOptions as bj, type ExportCapability as bk, type ExportChunk as bl, type ExportFormat as bm, type ExportStreamOptions as bn, type FactorKind as bo, type FactorRequirement as bp, type GhostRecord as bq, type GrantOptions as br, type HistoryConfig as bs, type HistoryEntry as bt, INDEXED_STORE_POLICY as bu, type ImportCapability as bv, type InferOutput as bw, type IssueDelegationOptions as bx, type IssueMagicLinkGrantOptions as by, type KeyringAuthenticator as bz, DictionaryHandle as c, assertStrongPassphrase as c$, type PlaintextTranslatorContext as c0, type PlaintextTranslatorFn as c1, PresenceHandle as c2, type PresencePeer as c3, type PublicEnvelopeField as c4, type PublicEnvelopeSchema as c5, type PublicEnvelopeText as c6, type PullMode as c7, type PullOptions as c8, type PullPolicy as c9, SyncEngine as cA, type SyncMetadata as cB, type SyncPolicy as cC, SyncScheduler as cD, type SyncSchedulerStatus as cE, type SyncStatus as cF, type SyncTarget as cG, type SyncTargetRole as cH, SyncTransaction as cI, type SyncTransactionResult as cJ, type TierMode as cK, type TranslatorAuditEntry as cL, type TxOp as cM, USER_ENVELOPE_COLLECTION as cN, USER_ENVELOPE_MAX_BYTES as cO, type Unsubscribe as cP, UserApi as cQ, type UserEnvelopeCheckGate as cR, UserEnvelopeOversizedError as cS, type UserEnvelopePresented as cT, type UserInfo as cU, type VaultBackup as cV, type VaultPolicyOnDisk as cW, type VaultSnapshot as cX, type WarningRules as cY, WeakPassphraseError as cZ, type WeakPassphraseReason as c_, type PullResult as ca, type PushMode as cb, type PushOptions as cc, type PushPolicy as cd, type PushResult as ce, type PutManyItemOptions as cf, type PutManyOptions as cg, type PutManyResult as ch, type QueryAcrossOptions as ci, type QueryAcrossResult as cj, type QuickUnlockState as ck, QuickUnlockStore as cl, type ReAuthOperation as cm, type RecoverPassphraseInput as cn, type RecoveryProof as co, type ResolvedPublicEnvelopeSchema as cp, type RevokeOptions as cq, type RotatePassphraseInput as cr, type SessionPolicy as cs, type SetPublicEnvelopeInput as ct, type StandardSchemaV1 as cu, type StandardSchemaV1Issue as cv, type StandardSchemaV1SyncResult as cw, type StoreAuth as cx, type StoreAuthKind as cy, type StoreCapabilities as cz, type DictionaryOptions as d, buildRecipientKeyringFile as d0, burnPaperRecoveryEntry as d1, createNoydb as d2, createStore as d3, deriveMagicLinkContentKey as d4, enrollAuthenticator as d5, estimateEntropy as d6, evaluateExportCapability as d7, evaluateImportCapability as d8, findAuthenticator as d9, writeMagicLinkGrant as dA, hasExportCapability as da, hasImportCapability as db, hasRecoveryEnrolled as dc, isMagicLinkGrantExpired as dd, isPublicEnvelope as de, issueDelegation as df, recoverPassphrase as dg, rotatePassphrase as dh, listMagicLinkGrants as di, listUsers as dj, listUsersWithEnvelopes as dk, loadActiveDelegations as dl, loadPaperRecoveryEntries as dm, magicLinkGrantRecordId as dn, readMagicLinkGrantRecord as dp, removeAuthenticator as dq, resolveSchema as dr, revokeDelegation as ds, revokeMagicLinkGrant as dt, savePaperRecoveryEntries as du, unwrapMagicLinkGrant as dv, validatePassphrase as dw, validatePublicEnvelopeInput as dx, validateSchemaInput as dy, validateSchemaOutput as dz, type I18nTextDescriptor as e, type I18nTextOptions as f, applyI18nLocale as g, dictCollectionName as h, dictKey as i, i18nText as j, isDictCollectionName as k, isDictKeyDescriptor as l, isI18nTextDescriptor as m, createEnforcer as n, validateSessionPolicy as o, BLOB_CHUNKS_COLLECTION as p, BLOB_COLLECTION as q, resolveI18nText as r, BLOB_EVICTION_AUDIT_COLLECTION as s, BLOB_INDEX_COLLECTION as t, BLOB_SLOTS_PREFIX as u, validateI18nTextValue as v, BLOB_VERSIONS_PREFIX as w, type BlobEvictionEntry as x, type BlobFieldPolicy as y, type BlobFieldsConfig as z };