@noy-db/hub 0.2.0-pre.1 → 0.2.0-pre.3

package/dist/index.d.cts

@@ -1,21 +1,22 @@
-import { aO as NoydbStore, bg as UserEnvelope, bh as PublicEnvelope, bi as GateName, bj as GatePolicy, bk as VaultPolicy, bl as ActiveTier, bm as FactorProof, bn as PersistedSchemaEnvelope, bo as DirectoryConfig, bp as UserVisibility, aM as UnlockedKeyring, bq as Vault, aV as DiffEntry } from './types-C4lwMKKF.cjs';
-export { br as AccessibleVault, aS as AppendInput, ay as ArrayOutputSpec, p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, bs as BUNDLE_STORE_POLICY, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, bt as BuiltInGateName, bu as BundleRecipient, _ as CONSENT_AUDIT_COLLECTION, bv as CacheOptions, bw as CacheStats, bx as ChangeEvent, aT as ChangeType, a7 as ClosePeriodOptions, aH as Collection, by as CollectionChangeEvent, bz as CollectionConflictResolver, bA as CollectionDescriptor, ao as CollectionFrame, aU as CollectionInstant, bB as CollectionStats, bC as Conflict, bD as ConflictPolicy, bE as ConflictStrategy, $ as ConsentAuditEntry, a0 as ConsentAuditFilter, a1 as ConsentContext, a2 as ConsentOp, bF as CrossTierAccessEvent, L as DEFAULT_CHUNK_SIZE, bG as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, bH as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, bI as DeepPartial, bJ as DeepPartialOrNull, bK as DelegationToken, bL as DeleteManyResult, bM as DerivationDescriptor, aw as DerivationStrategy, aA as DerivationStrategyHandle, aB as DerivedFromMeta, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, bN as DirtyEntry, bO as DumpSchemaOptions, bP as ELEVATION_AUDIT_COLLECTION, bQ as ElevatedHandle, aQ as EncryptedEnvelope, bR as EnrollAuthenticatorOptions, bS as EnrollAuthenticatorWrappingDEKsOptions, bT as EnrollAuthenticatorWrappingKEKOptions, bU as EnrollRecoveryResult, bV as ExportCapability, bW as ExportChunk, bX as ExportFormat, bY as ExportStreamOptions, bZ as FactorKind, b_ as FactorProofBundle, b$ as FactorRequirement, c0 as FieldDescriptor, c1 as FieldSource, c2 as GhostRecord, c3 as GrantOptions, ai as GuardChange, aj as GuardContext, ah as GuardStrategy, al as GuardStrategyHandle, c4 as HistoryConfig, c5 as HistoryEntry, aP as HistoryOptions, e as I18nTextDescriptor, f as I18nTextOptions, c6 as INDEXED_STORE_POLICY, c7 as ImportCapability, c8 as InferOutput, c9 as InternalCollectionStats, ca as IssueDelegationOptions, cb as IssueMagicLinkGrantOptions, aW as JsonPatch, aX as JsonPatchOp, cc as KeyringAuthenticator, cd as KeyringAuthenticatorWrappingDEKs, ce as KeyringAuthenticatorWrappingKEK, cf as KeyringFile, aY as LedgerEntry, aZ as LedgerStore, cg as ListAccessibleVaultsOptions, ch as ListPageResult, ci as ListUsersOptions, cj as LiveUserEnvelope, ck as LocaleReadOptions, cl as Lru, cm as LruOptions, cn as LruStats, co as MAGIC_LINK_CONTENT_INFO_PREFIX, cp as MAGIC_LINK_GRANTS_COLLECTION, cq as MAGIC_LINK_KEK_INFO_PREFIX, cr as MagicLinkGrantPayload, cs as MagicLinkGrantRecord, bd as MaterializedFromMeta, ct as MaterializedViewDescriptor, be as MaterializedViewOutput, aE as MaterializedViewStrategy, aF as MaterializedViewStrategyHandle, cu as MemorySealingKeyProvider, cv as NOYDB_BACKUP_VERSION, cw as NOYDB_FORMAT_VERSION, cx as NOYDB_KEYRING_VERSION, cy as NOYDB_SYNC_VERSION, cz as Noydb, cA as NoydbBundleStore, cB as NoydbEventMap, cC as NoydbOptions, a8 as OpenPeriodOptions, aC as OutputSpec, cD as OverlayViewDescriptor, aG as OverlayedViewStrategy, aJ as OverlayedViewStrategyHandle, a9 as PERIODS_COLLECTION, cE as PUBLIC_ENVELOPE_FIELDS, cF as PaperRecoveryDoc, cG as PaperRecoveryEntry, cH as PassphrasePolicy, cI as PassphraseValidationResult, aa as PeriodRecord, cJ as Permission, cK as Permissions, cL as PersistedSchemaKind, cM as PlaintextTranslatorContext, cN as PlaintextTranslatorFn, P as PolicyEnforcer, cO as PresenceHandle, cP as PresencePeer, aR as PruneOptions, cQ as PublicEnvelopeField, cR as PublicEnvelopeSchema, cS as PublicEnvelopeText, cT as PullMode, cU as PullOptions, cV as PullPolicy, cW as PullResult, cX as PushMode, cY as PushOptions, cZ as PushPolicy, c_ as PushResult, c$ as PutManyItemOptions, d0 as PutManyOptions, d1 as PutManyResult, d2 as QueryAcrossOptions, d3 as QueryAcrossResult, d4 as QuickUnlockState, d5 as QuickUnlockStore, d6 as ReAuthOperation, aD as RecordOutputSpec, d7 as RecoverPassphraseInput, d8 as RecoverPassphraseResult, d9 as RecoverUserOptions, da as RecoveryProof, db as ResolvedPublicEnvelopeSchema, dc as RevokeOptions, aL as Role, dd as RotatePassphraseInput, de as RotateRecoveryOptions, df as RotateRecoveryResult, dg as SEALED_PASSPHRASE_RECORD_ID, dh as SealedEnvelope, di as SealedPassphrase, dj as SealingKeyProvider, dk as SessionPolicy, dl as SetPublicEnvelopeInput, dm as ShamirRecoveryDoc, dn as ShamirRecoveryEntry, dp as ShamirRecoveryProvider, U as SlotInfo, V as SlotRecord, dq as SlotRewrapCeremony, dr as SlotRewrapContext, ds as StandardSchemaV1, dt as StandardSchemaV1Issue, du as StandardSchemaV1SyncResult, dv as StoreAuth, dw as StoreAuthKind, dx as StoreCapabilities, dy as SyncEngine, dz as SyncMetadata, dA as SyncPolicy, dB as SyncScheduler, dC as SyncSchedulerStatus, dD as SyncStatus, dE as SyncTarget, dF as SyncTargetRole, dG as SyncTransaction, dH as SyncTransactionResult, dI as TierMode, dJ as TranslatorAuditEntry, as as TxCollection, at as TxContext, dK as TxOp, au as TxVault, dL as USER_ENVELOPE_COLLECTION, dM as USER_ENVELOPE_MAX_BYTES, bf as UnionSource, dN as Unsubscribe, dO as UpdateAuthenticatorOptions, dP as UpdateUserOptions, dQ as UserApi, dR as UserEnvelopeCheckGate, dS as UserEnvelopeOversizedError, dT as UserEnvelopePresented, dU as UserInfo, dV as VaultBackup, a_ as VaultEngine, ap as VaultFrame, a$ as VaultInstant, dW as VaultPolicyOnDisk, dX as VaultSchemaSnapshot, dY as VaultSnapshot, b0 as VerifyResult, W as VersionRecord, dZ as WarningRules, d_ as WeakPassphraseError, d$ as WeakPassphraseReason, e0 as WrappedDeksBlob, g as applyI18nLocale, b1 as applyPatch, e1 as assertStrongPassphrase, e2 as buildRecipientKeyringFile, e3 as burnPaperRecoveryEntry, b2 as canonicalJson, b3 as computePatch, n as createEnforcer, e4 as createNoydb, e5 as createStore, e6 as deriveMagicLinkContentKey, h as dictCollectionName, i as dictKey, b4 as diff, e7 as enrollAuthenticator, e8 as estimateEntropy, e9 as evaluateExportCapability, ea as evaluateImportCapability, eb as findAuthenticator, b5 as formatDiff, ec as hasExportCapability, ed as hasImportCapability, ee as hasRecoveryEnrolled, b6 as hashEntry, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, ef as isMagicLinkGrantExpired, eg as isPublicEnvelope, eh as issueDelegation, ei as keyringRecoverPassphrase, ej as keyringRotatePassphrase, ek as listMagicLinkGrants, el as listUsers, em as listUsersWithEnvelopes, en as loadActiveDelegations, eo as loadPaperRecoveryEntries, ep as loadSealedPassphrase, eq as loadShamirRecoveryEntries, er as magicLinkGrantRecordId, es as mintPaperRecoveryEntry, et as mintShamirRecoveryEntry, eu as mintWrappedDeksBlob, b7 as paddedIndex, b8 as parseIndex, ev as parseSealedEnvelope, ew as readMagicLinkGrantRecord, ex as recoverUser, ey as removeAuthenticator, r as resolveI18nText, ez as resolvePublicEnvelopeSchema, eA as revokeDelegation, eB as revokeMagicLinkGrant, av as runTransaction, eC as savePaperRecoveryEntries, eD as saveSealedPassphrase, eE as saveShamirRecoveryEntries, b9 as sha256Hex, eF as unwrapDeksFromBlob, eG as unwrapDeksFromPaperEntry, eH as unwrapDeksFromShamirEntry, eI as unwrapMagicLinkGrant, v as validateI18nTextValue, eJ as validatePassphrase, eK as validatePublicEnvelopeInput, eL as validateSchemaInput, eM as validateSchemaOutput, o as validateSessionPolicy, eN as writeMagicLinkGrant } from './types-C4lwMKKF.cjs';
+import { aO as NoydbStore, bo as UserEnvelope, ba as PublicEnvelope, bp as GateName, bq as GatePolicy, br as VaultPolicy, bs as ActiveTier, bt as FactorProof, bu as SchemaUpdateStrategy, bv as TransformFn, bw as PersistedSchemaEnvelope, bx as UpdateDecision, by as DirectoryConfig, bz as UserVisibility, aM as UnlockedKeyring, bf as Vault, aV as DiffEntry } from './types-CSLcfytP.cjs';
+export { bA as AccessibleVault, bB as AffectedDocument, aS as AppendInput, ay as ArrayOutputSpec, p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, bC as BUNDLE_STORE_POLICY, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, bD as BuiltInGateName, bc as BundleRecipient, _ as CONSENT_AUDIT_COLLECTION, bE as CacheOptions, bF as CacheStats, bG as ChangeEvent, aT as ChangeType, a7 as ClosePeriodOptions, aH as Collection, bH as CollectionChangeEvent, bI as CollectionConflictResolver, bJ as CollectionDescriptor, ao as CollectionFrame, aU as CollectionInstant, bK as CollectionStats, bL as Conflict, bM as ConflictPolicy, bN as ConflictStrategy, $ as ConsentAuditEntry, a0 as ConsentAuditFilter, a1 as ConsentContext, a2 as ConsentOp, bO as CrossTierAccessEvent, L as DEFAULT_CHUNK_SIZE, bP as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, bQ as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, bR as DeepPartial, bS as DeepPartialOrNull, bT as DelegationToken, bU as DeleteManyResult, bV as DerivationDescriptor, aw as DerivationStrategy, aA as DerivationStrategyHandle, aB as DerivedFromMeta, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, bW as DirtyEntry, bX as DryRunResult, bY as DumpSchemaOptions, bZ as ELEVATION_AUDIT_COLLECTION, b_ as ElevatedHandle, aQ as EncryptedEnvelope, b$ as EnrollAuthenticatorOptions, c0 as EnrollAuthenticatorWrappingDEKsOptions, c1 as EnrollAuthenticatorWrappingKEKOptions, c2 as EnrollRecoveryResult, c3 as ExportCapability, c4 as ExportChunk, c5 as ExportFormat, c6 as ExportStreamOptions, c7 as FactorKind, c8 as FactorProofBundle, c9 as FactorRequirement, ca as FenceDoc, cb as FenceState, cc as FieldChange, cd as FieldDescriptor, ce as FieldSource, cf as GhostRecord, cg as GrantOptions, ai as GuardChange, aj as GuardContext, ah as GuardStrategy, al as GuardStrategyHandle, ch as GuardViolation, ci as HistoryConfig, cj as HistoryEntry, aP as HistoryOptions, e as I18nTextDescriptor, f as I18nTextOptions, ck as INDEXED_STORE_POLICY, cl as ImportCapability, cm as InferOutput, cn as InternalCollectionStats, co as IssueDelegationOptions, cp as IssueMagicLinkGrantOptions, aW as JsonPatch, aX as JsonPatchOp, cq as KeyringAuthenticator, cr as KeyringAuthenticatorWrappingDEKs, cs as KeyringAuthenticatorWrappingKEK, ct as KeyringFile, aY as LedgerEntry, aZ as LedgerStore, cu as ListAccessibleVaultsOptions, cv as ListPageResult, cw as ListUsersOptions, cx as LiveUserEnvelope, cy as LocaleReadOptions, cz as Lru, cA as LruOptions, cB as LruStats, cC as MAGIC_LINK_CONTENT_INFO_PREFIX, cD as MAGIC_LINK_GRANTS_COLLECTION, cE as MAGIC_LINK_KEK_INFO_PREFIX, cF as MagicLinkGrantPayload, cG as MagicLinkGrantRecord, bl as MaterializedFromMeta, cH as MaterializedViewDescriptor, bm as MaterializedViewOutput, aE as MaterializedViewStrategy, aF as MaterializedViewStrategyHandle, cI as MemoryRecipientSealer, cJ as MemorySealingKeyProvider, cK as NOYDB_BACKUP_VERSION, cL as NOYDB_FORMAT_VERSION, cM as NOYDB_KEYRING_VERSION, cN as NOYDB_SYNC_VERSION, cO as Noydb, cP as NoydbBundleStore, cQ as NoydbEventMap, cR as NoydbOptions, a8 as OpenPeriodOptions, aC as OutputSpec, cS as OverlayViewDescriptor, aG as OverlayedViewStrategy, aJ as OverlayedViewStrategyHandle, a9 as PERIODS_COLLECTION, cT as PUBLIC_ENVELOPE_FIELDS, cU as PaperRecoveryDoc, cV as PaperRecoveryEntry, cW as PassphrasePolicy, cX as PassphraseValidationResult, aa as PeriodRecord, cY as Permission, cZ as Permissions, c_ as PersistedSchemaKind, c$ as PlaintextTranslatorContext, d0 as PlaintextTranslatorFn, P as PolicyEnforcer, d1 as PresenceHandle, d2 as PresencePeer, aR as PruneOptions, d3 as PublicEnvelopeField, d4 as PublicEnvelopeSchema, d5 as PublicEnvelopeText, d6 as PullMode, d7 as PullOptions, d8 as PullPolicy, d9 as PullResult, da as PushMode, db as PushOptions, dc as PushPolicy, dd as PushResult, de as PutManyItemOptions, df as PutManyOptions, dg as PutManyResult, dh as QueryAcrossOptions, di as QueryAcrossResult, dj as QuickUnlockState, dk as QuickUnlockStore, dl as ReAuthOperation, be as RecipientHint, bd as RecipientSealer, aD as RecordOutputSpec, dm as RecoverPassphraseInput, dn as RecoverPassphraseResult, dp as RecoverUserOptions, dq as RecoveryProof, dr as ResolvedPublicEnvelopeSchema, ds as RevokeOptions, aL as Role, dt as RotatePassphraseInput, du as RotateRecoveryOptions, dv as RotateRecoveryResult, dw as SEALED_PASSPHRASE_RECORD_ID, dx as SchemaDelta, dy as SchemaIntrospection, dz as SealedEnvelope, dA as SealedPassphrase, bb as SealingKeyProvider, dB as SessionPolicy, dC as SetPublicEnvelopeInput, dD as ShamirRecoveryDoc, dE as ShamirRecoveryEntry, bh as ShamirRecoveryProvider, U as SlotInfo, V as SlotRecord, dF as SlotRewrapCeremony, dG as SlotRewrapContext, dH as StandardSchemaV1, dI as StandardSchemaV1Issue, dJ as StandardSchemaV1SyncResult, dK as StoreAuth, dL as StoreAuthKind, dM as StoreCapabilities, dN as SyncEngine, dO as SyncMetadata, dP as SyncPolicy, dQ as SyncScheduler, dR as SyncSchedulerStatus, dS as SyncStatus, dT as SyncTarget, dU as SyncTargetRole, dV as SyncTransaction, dW as SyncTransactionResult, dX as TabChannel, dY as TabCoordinationOptions, dZ as TabLockManager, d_ as TabPresence, d$ as TabRole, e0 as TierMode, e1 as TranslatorAuditEntry, as as TxCollection, at as TxContext, e2 as TxOp, au as TxVault, e3 as USER_ENVELOPE_COLLECTION, e4 as USER_ENVELOPE_MAX_BYTES, bn as UnionSource, e5 as Unsubscribe, e6 as UpdateAuthenticatorOptions, e7 as UpdateContext, e8 as UpdateUserOptions, e9 as UserApi, ea as UserEnvelopeCheckGate, eb as UserEnvelopeOversizedError, ec as UserEnvelopePresented, ed as UserInfo, ee as VaultBackup, a_ as VaultEngine, ap as VaultFrame, a$ as VaultInstant, ef as VaultPolicyOnDisk, eg as VaultSchemaSnapshot, eh as VaultSnapshot, b0 as VerifyResult, W as VersionRecord, ei as WarningRules, ej as WeakPassphraseError, ek as WeakPassphraseReason, el as WrappedDeksBlob, em as WriteConflict, en as WriteEvent, eo as WriteHook, ep as WriteQueue, g as applyI18nLocale, b1 as applyPatch, eq as assertStrongPassphrase, er as buildRecipientKeyringFile, es as burnPaperRecoveryEntry, b2 as canonicalJson, b3 as computePatch, n as createEnforcer, et as createNoydb, eu as createStore, ev as deriveMagicLinkContentKey, h as dictCollectionName, i as dictKey, b4 as diff, ew as enrollAuthenticator, ex as estimateEntropy, ey as evaluateExportCapability, ez as evaluateImportCapability, eA as findAuthenticator, b5 as formatDiff, eB as hasExportCapability, eC as hasImportCapability, eD as hasRecoveryEnrolled, b6 as hashEntry, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, eE as isMagicLinkGrantExpired, eF as isPublicEnvelope, eG as issueDelegation, eH as keyringRecoverPassphrase, eI as keyringRotatePassphrase, eJ as listMagicLinkGrants, eK as listUsers, eL as listUsersWithEnvelopes, eM as loadActiveDelegations, eN as loadPaperRecoveryEntries, eO as loadSealedPassphrase, eP as loadShamirRecoveryEntries, eQ as magicLinkGrantRecordId, eR as mintPaperRecoveryEntry, eS as mintShamirRecoveryEntry, eT as mintWrappedDeksBlob, b7 as paddedIndex, b8 as parseIndex, eU as parseSealedEnvelope, eV as readMagicLinkGrantRecord, eW as recoverUser, eX as removeAuthenticator, r as resolveI18nText, eY as resolvePublicEnvelopeSchema, eZ as revokeDelegation, e_ as revokeMagicLinkGrant, av as runTransaction, e$ as savePaperRecoveryEntries, f0 as saveSealedPassphrase, f1 as saveShamirRecoveryEntries, b9 as sha256Hex, f2 as unwrapDeksFromBlob, f3 as unwrapDeksFromPaperEntry, f4 as unwrapDeksFromShamirEntry, f5 as unwrapMagicLinkGrant, v as validateI18nTextValue, f6 as validatePassphrase, f7 as validatePublicEnvelopeInput, f8 as validateSchemaInput, f9 as validateSchemaOutput, o as validateSessionPolicy, fa as writeMagicLinkGrant } from './types-CSLcfytP.cjs';
 export { d as detectMagic, a as detectMimeType, i as isPreCompressed } from './mime-magic-CBBSOkjm.cjs';
 export { AgeRoute, BlobLifecyclePolicy, BlobStoreRoute, CircuitBreakerOptions, HealthCheckOptions, LogLevel, LoggingOptions, MetricsOptions, OverrideOptions, OverrideTarget, RetryOptions, RouteStatus, RouteStoreOptions, RoutedNoydbStore, StoreCacheOptions, StoreMiddleware, StoreOperation, SuspendOptions, WrapBundleStoreOptions, WrappedBundleNoydbStore, createBundleStore, routeStore, withCache, withCircuitBreaker, withHealthCheck, withLogging, withMetrics, withRetry, wrapBundleStore, wrapStore } from './store/index.cjs';
-import { N as NoydbError } from './index-CmVgTkqk.cjs';
-export { q as AlreadyElevatedError, A as AmendmentForbiddenError, B as BackupCorruptedError, r as BackupLedgerError, s as BundleIntegrityError, t as BundleSealMismatchError, u as BundleVersionConflictError, C as ConflictError, v as DEFAULT_JOIN_MAX_ROWS, w as DanglingReferenceError, x as DecryptionError, y as DelegationTargetMissingError, e as DerivationCapExceededError, f as DerivationCycleError, g as DerivationDepthError, h as DerivationOutputShapeError, i as DerivationOutputUnknownError, D as DictKeyInUseError, a as DictKeyMissingError, z as DirectoryDisabledError, E as ElevationExpiredError, G as ExportCapabilityError, F as FieldFrozenError, H as FilenameSanitizationError, J as GroupCardinalityError, K as ImportCapabilityError, P as IndexRequiredError, U as IndexWriteFailureError, V as InvalidKeyError, I as InvariantError, W as JoinContext, X as JoinLeg, Y as JoinStrategy, Z as JoinTooLargeError, _ as JoinableSource, $ as KeyringCorruptError, a0 as KeyringExpiredError, a1 as LedgerContentionError, a2 as LiveQuery, a3 as LiveUpstream, L as LocaleNotSpecifiedError, m as MaterializedViewConfigError, n as MaterializedViewCycleError, o as MaterializedViewSourceUnknownError, p as MaterializedViewTooLargeError, M as MissingTranslationError, a4 as NetworkError, a5 as NoAccessError, a6 as NotFoundError, a7 as OrderBy, O as OverlayBaseIsVirtualError, j as OverlayCollectionUnavailableError, k as OverlayIdMismatchError, l as OverlayNameCollisionError, a8 as PathEscapeError, a9 as PeriodClosedError, aa as PermissionDeniedError, ab as PrivilegeEscalationError, Q as Query, ac as QueryPlan, ad as QuerySource, ae as ReadOnlyAtInstantError, af as ReadOnlyError, ag as ReadOnlyFrameError, d as RecordLockedError, ah as RefDescriptor, ai as RefIntegrityError, aj as RefMode, ak as RefRegistry, al as RefScopeError, am as RefViolation, R as ReservedCollectionNameError, an as ScanBuilder, ao as ScanPageProvider, ap as SchemaValidationError, S as SessionExpiredError, b as SessionNotFoundError, c as SessionPolicyError, aq as StoreCapabilityError, ar as TamperedError, as as TierDemoteDeniedError, at as TierNotGrantedError, T as TranslatorNotConfiguredError, au as ValidationError, av as applyJoins, aw as buildLiveQuery, ax as executePlan, ay as ref, az as resetJoinWarnings } from './index-CmVgTkqk.cjs';
-export { A as AutoCredential, a as AutoCredentialKind, C as CompressionAlgo, N as NOYDB_BUNDLE_FORMAT_VERSION, b as NOYDB_BUNDLE_MAGIC, c as NOYDB_BUNDLE_PREFIX_BYTES, d as NoydbBundleHeader, e as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, g as generateULID, h as hasNoydbBundleMagic, i as isULID, r as readNoydbBundle, f as readNoydbBundleHeader, j as readNoydbBundlePublicEnvelope, k as resetBrotliSupportCache, w as writeNoydbBundle } from './index-hdFvZkBP.cjs';
+import { N as NoydbError } from './index-DVkvrgpm.cjs';
+export { x as AlreadyElevatedError, A as AmendmentForbiddenError, m as AttestationError, B as BackupCorruptedError, o as BackupLedgerError, p as BundleIntegrityError, q as BundleSealMismatchError, r as BundleVersionConflictError, C as ConflictError, y as DEFAULT_JOIN_MAX_ROWS, z as DanglingReferenceError, E as DecryptionError, G as DelegationTargetMissingError, e as DerivationCapExceededError, f as DerivationCycleError, g as DerivationDepthError, h as DerivationOutputShapeError, i as DerivationOutputUnknownError, D as DictKeyInUseError, a as DictKeyMissingError, H as DirectoryDisabledError, J as ElevationExpiredError, K as ExportCapabilityError, F as FieldFrozenError, U as FilenameSanitizationError, V as GroupCardinalityError, W as ImportCapabilityError, X as IndexRequiredError, Y as IndexWriteFailureError, Z as InvalidKeyError, I as InvariantError, _ as JoinContext, $ as JoinLeg, a0 as JoinStrategy, a1 as JoinTooLargeError, a2 as JoinableSource, a3 as KeyringCorruptError, a4 as KeyringExpiredError, a5 as LedgerContentionError, a6 as LiveQuery, a7 as LiveUpstream, L as LocaleNotSpecifiedError, t as MaterializedViewConfigError, u as MaterializedViewCycleError, v as MaterializedViewSourceUnknownError, w as MaterializedViewTooLargeError, a8 as MigrationRequiredError, M as MissingTranslationError, a9 as NetworkError, aa as NoAccessError, ab as NonAdditiveSchemaChangeError, ac as NotFoundError, ad as OrderBy, O as OverlayBaseIsVirtualError, j as OverlayCollectionUnavailableError, k as OverlayIdMismatchError, l as OverlayNameCollisionError, ae as PathEscapeError, af as PeriodClosedError, ag as PermissionDeniedError, ah as PrivilegeEscalationError, Q as Query, ai as QueryPlan, aj as QuerySource, ak as QuiesceTimeoutError, al as ReadOnlyAtInstantError, am as ReadOnlyError, an as ReadOnlyFrameError, d as RecordLockedError, ao as RefDescriptor, ap as RefIntegrityError, aq as RefMode, ar as RefRegistry, as as RefScopeError, at as RefViolation, R as ReservedCollectionNameError, au as ScanBuilder, av as ScanPageProvider, aw as SchemaFenceError, ax as SchemaLockedError, ay as SchemaUpdateError, az as SchemaValidationError, S as SessionExpiredError, b as SessionNotFoundError, c as SessionPolicyError, aA as StoreCapabilityError, aB as TamperedError, aC as TierDemoteDeniedError, aD as TierNotGrantedError, T as TranslatorNotConfiguredError, aE as ValidationError, aF as applyJoins, aG as buildLiveQuery, aH as executePlan, aI as ref, aJ as resetJoinWarnings } from './index-DVkvrgpm.cjs';
+export { A as AutoCredential, n as AutoCredentialKind, c as CompressionAlgo, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, j as generateULID, o as hasNoydbBundleMagic, k as isULID, r as readNoydbBundle, l as readNoydbBundleHeader, p as readNoydbBundlePublicEnvelope, m as resetBrotliSupportCache, w as writeNoydbBundle } from './ulid-CG2YvAbg.cjs';
 export { a as CrdtMode, b as CrdtState, L as LwwMapState, R as RgaState, Y as YjsState, m as mergeCrdtStates, r as resolveCrdtSnapshot } from './strategy-BSxFXGzb.cjs';
-export { w as withGuard } from './with-guard-jI1x9Z3k.cjs';
-export { w as withDerivation } from './with-derivation-C8LDlV7t.cjs';
-export { w as withMaterializedView } from './with-materialized-view-DcTx4H3j.cjs';
+export { w as withGuard } from './with-guard-DF_Ul3DT.cjs';
+export { w as withDerivation } from './with-derivation-DWajFh4K.cjs';
+export { w as withMaterializedView } from './with-materialized-view-_piodoIz.cjs';
 export { a as Clause, C as CollectionIndexes, F as FieldClause, b as FilterClause, G as GroupClause, H as HashIndex, I as IndexDef, O as Operator, e as evaluateClause, c as evaluateFieldClause, r as readPath } from './predicate-Dnu81tsS.cjs';
-export { w as withOverlayedView } from './with-overlayed-view-D-6oWAgM.cjs';
+export { w as withOverlayedView } from './with-overlayed-view-DwzCKxn2.cjs';
 export { SYNC_CREDENTIALS_COLLECTION, SyncCredential, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential } from './team/index.cjs';
-export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-DRwVSy2S.cjs';
+export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-De3mjQWv.cjs';
 export { a as AggregateResult, b as AggregateSpec, c as Aggregation, d as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, e as GROUPBY_WARN_CARDINALITY, f as GroupedAggregation, g as GroupedQuery, h as GroupedQueryN, i as GroupedRow, j as GroupedRowN, L as LiveAggregation, R as Reducer, k as ReducerOptions, l as avg, n as count, o as groupAndReduce, p as max, q as min, r as reduceRecords, t as sum } from './strategy-DSTrsZ8t.cjs';
-export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-DtRih9MQ.cjs';
+export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-vBCB0-Ps.cjs';
 import './lazy-builder-C-rPfWG0.cjs';
+import '@noy-db/attestation';
 
 /**
  * Persistence helpers for per-principal user envelopes stored at
@@ -338,6 +339,24 @@ declare function loadVaultPolicy(store: NoydbStore, vault: string): Promise<Vaul
  */
 declare function saveVaultPolicy(store: NoydbStore, vault: string, policy: VaultPolicy): Promise<void>;
 
+/** Allow any schema change. Explicit blind / back-compat. */
+declare function blindUpdate(): SchemaUpdateStrategy;
+/** Allow additive changes; reject non-additive ones. The safety backstop. */
+declare function additiveOnly(): SchemaUpdateStrategy;
+/**
+ * Reject schema changes. With `fields`, reject only when one of those
+ * fields is added/removed/changed; otherwise reject any non-`none` delta.
+ */
+declare function lockSchema(opts?: {
+    readonly fields?: readonly string[];
+}): SchemaUpdateStrategy;
+
+/** The coordinatedCutover update strategy (#232, single-step — no from/to). */
+
+declare function coordinatedCutover(opts: {
+    readonly transform: TransformFn;
+}): SchemaUpdateStrategy;
+
 /**
  * Derive a {@link PersistedSchemaEnvelope} from a Standard Schema v1
  * validator. v0 supports Zod via `zod-to-json-schema` (optional peer-dep);
@@ -412,6 +431,8 @@ interface PersistSchemaResult {
     readonly skipped: boolean;
     /** The envelope that was either written or matched. */
     readonly envelope: PersistedSchemaEnvelope;
+    /** The update-strategy decision, present when strategies ran (#245). */
+    readonly decision?: UpdateDecision;
 }
 declare function persistSchemaIfNeeded(opts: {
     readonly store: NoydbStore;
@@ -419,6 +440,7 @@ declare function persistSchemaIfNeeded(opts: {
     readonly collectionName: string;
     readonly validator: unknown;
     readonly dek: CryptoKey;
+    readonly strategies?: readonly SchemaUpdateStrategy[];
 }): Promise<PersistSchemaResult>;
 
 /**
@@ -753,4 +775,4 @@ type DiffCandidate<T = unknown> = Vault | Record<string, readonly T[]> | string;
  */
 declare function diffVault<T = unknown>(vault: Vault, candidate: DiffCandidate<T>, options?: DiffOptions): Promise<VaultDiff<T>>;
 
-export { ActiveTier, type CheckGateContext, DEFAULT_FRESHNESS_MS, DIRECTORY_RECORD_ID, type DiffCandidate, DiffEntry, type DiffOptions, DirectoryConfig, FactorProof, GateName, GatePolicy, META_COLLECTION, ManagedRecoveryNotEnrolledError, NoydbError, NoydbStore, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, type PersistSchemaResult, PersistedSchemaEnvelope, PolicyDeniedError, type PolicyDenyReason, PublicEnvelope, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, SCHEMAS_COLLECTION, STRICT_POLICY, UnlockedKeyring, UserEnvelope, UserVisibility, VISIBILITY_RECORD_PREFIX, Vault, type VaultDiff, type VaultDiffEntry, type VaultDiffModifiedEntry, VaultPolicy, assertTierAccess, base64ToBuffer, bufferToBase64, checkGate, decryptBytes, decryptDeterministic, dekKey, deleteUserEnvelope, deleteUserVisibility, derivePersistedSchema, derivePresenceKey, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, diffVault, effectiveClearance, encryptBytes, encryptDeterministic, estimateRecordBytes, isZodSchema, listUserEnvelopeIds, loadPersistedSchema, loadPublicEnvelope, loadUserEnvelope, loadVaultPolicy, mergePolicy, parseBytes, persistDirectoryConfig, persistSchemaIfNeeded, persistUserVisibility, readDirectoryConfig, readPublicEnvelope, readUserVisibility, savePersistedSchema, savePublicEnvelope, saveUserEnvelope, saveVaultPolicy, visibilityRecordId };
+export { ActiveTier, type CheckGateContext, DEFAULT_FRESHNESS_MS, DIRECTORY_RECORD_ID, type DiffCandidate, DiffEntry, type DiffOptions, DirectoryConfig, FactorProof, GateName, GatePolicy, META_COLLECTION, ManagedRecoveryNotEnrolledError, NoydbError, NoydbStore, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, type PersistSchemaResult, PersistedSchemaEnvelope, PolicyDeniedError, type PolicyDenyReason, PublicEnvelope, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, SCHEMAS_COLLECTION, STRICT_POLICY, SchemaUpdateStrategy, UnlockedKeyring, UpdateDecision, UserEnvelope, UserVisibility, VISIBILITY_RECORD_PREFIX, Vault, type VaultDiff, type VaultDiffEntry, type VaultDiffModifiedEntry, VaultPolicy, additiveOnly, assertTierAccess, base64ToBuffer, blindUpdate, bufferToBase64, checkGate, coordinatedCutover, decryptBytes, decryptDeterministic, dekKey, deleteUserEnvelope, deleteUserVisibility, derivePersistedSchema, derivePresenceKey, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, diffVault, effectiveClearance, encryptBytes, encryptDeterministic, estimateRecordBytes, isZodSchema, listUserEnvelopeIds, loadPersistedSchema, loadPublicEnvelope, loadUserEnvelope, loadVaultPolicy, lockSchema, mergePolicy, parseBytes, persistDirectoryConfig, persistSchemaIfNeeded, persistUserVisibility, readDirectoryConfig, readPublicEnvelope, readUserVisibility, savePersistedSchema, savePublicEnvelope, saveUserEnvelope, saveVaultPolicy, visibilityRecordId };

package/dist/index.d.ts

@@ -1,21 +1,22 @@
-import { aO as NoydbStore, bg as UserEnvelope, bh as PublicEnvelope, bi as GateName, bj as GatePolicy, bk as VaultPolicy, bl as ActiveTier, bm as FactorProof, bn as PersistedSchemaEnvelope, bo as DirectoryConfig, bp as UserVisibility, aM as UnlockedKeyring, bq as Vault, aV as DiffEntry } from './types-DW9RGSSs.js';
-export { br as AccessibleVault, aS as AppendInput, ay as ArrayOutputSpec, p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, bs as BUNDLE_STORE_POLICY, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, bt as BuiltInGateName, bu as BundleRecipient, _ as CONSENT_AUDIT_COLLECTION, bv as CacheOptions, bw as CacheStats, bx as ChangeEvent, aT as ChangeType, a7 as ClosePeriodOptions, aH as Collection, by as CollectionChangeEvent, bz as CollectionConflictResolver, bA as CollectionDescriptor, ao as CollectionFrame, aU as CollectionInstant, bB as CollectionStats, bC as Conflict, bD as ConflictPolicy, bE as ConflictStrategy, $ as ConsentAuditEntry, a0 as ConsentAuditFilter, a1 as ConsentContext, a2 as ConsentOp, bF as CrossTierAccessEvent, L as DEFAULT_CHUNK_SIZE, bG as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, bH as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, bI as DeepPartial, bJ as DeepPartialOrNull, bK as DelegationToken, bL as DeleteManyResult, bM as DerivationDescriptor, aw as DerivationStrategy, aA as DerivationStrategyHandle, aB as DerivedFromMeta, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, bN as DirtyEntry, bO as DumpSchemaOptions, bP as ELEVATION_AUDIT_COLLECTION, bQ as ElevatedHandle, aQ as EncryptedEnvelope, bR as EnrollAuthenticatorOptions, bS as EnrollAuthenticatorWrappingDEKsOptions, bT as EnrollAuthenticatorWrappingKEKOptions, bU as EnrollRecoveryResult, bV as ExportCapability, bW as ExportChunk, bX as ExportFormat, bY as ExportStreamOptions, bZ as FactorKind, b_ as FactorProofBundle, b$ as FactorRequirement, c0 as FieldDescriptor, c1 as FieldSource, c2 as GhostRecord, c3 as GrantOptions, ai as GuardChange, aj as GuardContext, ah as GuardStrategy, al as GuardStrategyHandle, c4 as HistoryConfig, c5 as HistoryEntry, aP as HistoryOptions, e as I18nTextDescriptor, f as I18nTextOptions, c6 as INDEXED_STORE_POLICY, c7 as ImportCapability, c8 as InferOutput, c9 as InternalCollectionStats, ca as IssueDelegationOptions, cb as IssueMagicLinkGrantOptions, aW as JsonPatch, aX as JsonPatchOp, cc as KeyringAuthenticator, cd as KeyringAuthenticatorWrappingDEKs, ce as KeyringAuthenticatorWrappingKEK, cf as KeyringFile, aY as LedgerEntry, aZ as LedgerStore, cg as ListAccessibleVaultsOptions, ch as ListPageResult, ci as ListUsersOptions, cj as LiveUserEnvelope, ck as LocaleReadOptions, cl as Lru, cm as LruOptions, cn as LruStats, co as MAGIC_LINK_CONTENT_INFO_PREFIX, cp as MAGIC_LINK_GRANTS_COLLECTION, cq as MAGIC_LINK_KEK_INFO_PREFIX, cr as MagicLinkGrantPayload, cs as MagicLinkGrantRecord, bd as MaterializedFromMeta, ct as MaterializedViewDescriptor, be as MaterializedViewOutput, aE as MaterializedViewStrategy, aF as MaterializedViewStrategyHandle, cu as MemorySealingKeyProvider, cv as NOYDB_BACKUP_VERSION, cw as NOYDB_FORMAT_VERSION, cx as NOYDB_KEYRING_VERSION, cy as NOYDB_SYNC_VERSION, cz as Noydb, cA as NoydbBundleStore, cB as NoydbEventMap, cC as NoydbOptions, a8 as OpenPeriodOptions, aC as OutputSpec, cD as OverlayViewDescriptor, aG as OverlayedViewStrategy, aJ as OverlayedViewStrategyHandle, a9 as PERIODS_COLLECTION, cE as PUBLIC_ENVELOPE_FIELDS, cF as PaperRecoveryDoc, cG as PaperRecoveryEntry, cH as PassphrasePolicy, cI as PassphraseValidationResult, aa as PeriodRecord, cJ as Permission, cK as Permissions, cL as PersistedSchemaKind, cM as PlaintextTranslatorContext, cN as PlaintextTranslatorFn, P as PolicyEnforcer, cO as PresenceHandle, cP as PresencePeer, aR as PruneOptions, cQ as PublicEnvelopeField, cR as PublicEnvelopeSchema, cS as PublicEnvelopeText, cT as PullMode, cU as PullOptions, cV as PullPolicy, cW as PullResult, cX as PushMode, cY as PushOptions, cZ as PushPolicy, c_ as PushResult, c$ as PutManyItemOptions, d0 as PutManyOptions, d1 as PutManyResult, d2 as QueryAcrossOptions, d3 as QueryAcrossResult, d4 as QuickUnlockState, d5 as QuickUnlockStore, d6 as ReAuthOperation, aD as RecordOutputSpec, d7 as RecoverPassphraseInput, d8 as RecoverPassphraseResult, d9 as RecoverUserOptions, da as RecoveryProof, db as ResolvedPublicEnvelopeSchema, dc as RevokeOptions, aL as Role, dd as RotatePassphraseInput, de as RotateRecoveryOptions, df as RotateRecoveryResult, dg as SEALED_PASSPHRASE_RECORD_ID, dh as SealedEnvelope, di as SealedPassphrase, dj as SealingKeyProvider, dk as SessionPolicy, dl as SetPublicEnvelopeInput, dm as ShamirRecoveryDoc, dn as ShamirRecoveryEntry, dp as ShamirRecoveryProvider, U as SlotInfo, V as SlotRecord, dq as SlotRewrapCeremony, dr as SlotRewrapContext, ds as StandardSchemaV1, dt as StandardSchemaV1Issue, du as StandardSchemaV1SyncResult, dv as StoreAuth, dw as StoreAuthKind, dx as StoreCapabilities, dy as SyncEngine, dz as SyncMetadata, dA as SyncPolicy, dB as SyncScheduler, dC as SyncSchedulerStatus, dD as SyncStatus, dE as SyncTarget, dF as SyncTargetRole, dG as SyncTransaction, dH as SyncTransactionResult, dI as TierMode, dJ as TranslatorAuditEntry, as as TxCollection, at as TxContext, dK as TxOp, au as TxVault, dL as USER_ENVELOPE_COLLECTION, dM as USER_ENVELOPE_MAX_BYTES, bf as UnionSource, dN as Unsubscribe, dO as UpdateAuthenticatorOptions, dP as UpdateUserOptions, dQ as UserApi, dR as UserEnvelopeCheckGate, dS as UserEnvelopeOversizedError, dT as UserEnvelopePresented, dU as UserInfo, dV as VaultBackup, a_ as VaultEngine, ap as VaultFrame, a$ as VaultInstant, dW as VaultPolicyOnDisk, dX as VaultSchemaSnapshot, dY as VaultSnapshot, b0 as VerifyResult, W as VersionRecord, dZ as WarningRules, d_ as WeakPassphraseError, d$ as WeakPassphraseReason, e0 as WrappedDeksBlob, g as applyI18nLocale, b1 as applyPatch, e1 as assertStrongPassphrase, e2 as buildRecipientKeyringFile, e3 as burnPaperRecoveryEntry, b2 as canonicalJson, b3 as computePatch, n as createEnforcer, e4 as createNoydb, e5 as createStore, e6 as deriveMagicLinkContentKey, h as dictCollectionName, i as dictKey, b4 as diff, e7 as enrollAuthenticator, e8 as estimateEntropy, e9 as evaluateExportCapability, ea as evaluateImportCapability, eb as findAuthenticator, b5 as formatDiff, ec as hasExportCapability, ed as hasImportCapability, ee as hasRecoveryEnrolled, b6 as hashEntry, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, ef as isMagicLinkGrantExpired, eg as isPublicEnvelope, eh as issueDelegation, ei as keyringRecoverPassphrase, ej as keyringRotatePassphrase, ek as listMagicLinkGrants, el as listUsers, em as listUsersWithEnvelopes, en as loadActiveDelegations, eo as loadPaperRecoveryEntries, ep as loadSealedPassphrase, eq as loadShamirRecoveryEntries, er as magicLinkGrantRecordId, es as mintPaperRecoveryEntry, et as mintShamirRecoveryEntry, eu as mintWrappedDeksBlob, b7 as paddedIndex, b8 as parseIndex, ev as parseSealedEnvelope, ew as readMagicLinkGrantRecord, ex as recoverUser, ey as removeAuthenticator, r as resolveI18nText, ez as resolvePublicEnvelopeSchema, eA as revokeDelegation, eB as revokeMagicLinkGrant, av as runTransaction, eC as savePaperRecoveryEntries, eD as saveSealedPassphrase, eE as saveShamirRecoveryEntries, b9 as sha256Hex, eF as unwrapDeksFromBlob, eG as unwrapDeksFromPaperEntry, eH as unwrapDeksFromShamirEntry, eI as unwrapMagicLinkGrant, v as validateI18nTextValue, eJ as validatePassphrase, eK as validatePublicEnvelopeInput, eL as validateSchemaInput, eM as validateSchemaOutput, o as validateSessionPolicy, eN as writeMagicLinkGrant } from './types-DW9RGSSs.js';
+import { aO as NoydbStore, bo as UserEnvelope, ba as PublicEnvelope, bp as GateName, bq as GatePolicy, br as VaultPolicy, bs as ActiveTier, bt as FactorProof, bu as SchemaUpdateStrategy, bv as TransformFn, bw as PersistedSchemaEnvelope, bx as UpdateDecision, by as DirectoryConfig, bz as UserVisibility, aM as UnlockedKeyring, bf as Vault, aV as DiffEntry } from './types-D9eB0Rvh.js';
+export { bA as AccessibleVault, bB as AffectedDocument, aS as AppendInput, ay as ArrayOutputSpec, p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, bC as BUNDLE_STORE_POLICY, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, bD as BuiltInGateName, bc as BundleRecipient, _ as CONSENT_AUDIT_COLLECTION, bE as CacheOptions, bF as CacheStats, bG as ChangeEvent, aT as ChangeType, a7 as ClosePeriodOptions, aH as Collection, bH as CollectionChangeEvent, bI as CollectionConflictResolver, bJ as CollectionDescriptor, ao as CollectionFrame, aU as CollectionInstant, bK as CollectionStats, bL as Conflict, bM as ConflictPolicy, bN as ConflictStrategy, $ as ConsentAuditEntry, a0 as ConsentAuditFilter, a1 as ConsentContext, a2 as ConsentOp, bO as CrossTierAccessEvent, L as DEFAULT_CHUNK_SIZE, bP as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, bQ as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, bR as DeepPartial, bS as DeepPartialOrNull, bT as DelegationToken, bU as DeleteManyResult, bV as DerivationDescriptor, aw as DerivationStrategy, aA as DerivationStrategyHandle, aB as DerivedFromMeta, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, bW as DirtyEntry, bX as DryRunResult, bY as DumpSchemaOptions, bZ as ELEVATION_AUDIT_COLLECTION, b_ as ElevatedHandle, aQ as EncryptedEnvelope, b$ as EnrollAuthenticatorOptions, c0 as EnrollAuthenticatorWrappingDEKsOptions, c1 as EnrollAuthenticatorWrappingKEKOptions, c2 as EnrollRecoveryResult, c3 as ExportCapability, c4 as ExportChunk, c5 as ExportFormat, c6 as ExportStreamOptions, c7 as FactorKind, c8 as FactorProofBundle, c9 as FactorRequirement, ca as FenceDoc, cb as FenceState, cc as FieldChange, cd as FieldDescriptor, ce as FieldSource, cf as GhostRecord, cg as GrantOptions, ai as GuardChange, aj as GuardContext, ah as GuardStrategy, al as GuardStrategyHandle, ch as GuardViolation, ci as HistoryConfig, cj as HistoryEntry, aP as HistoryOptions, e as I18nTextDescriptor, f as I18nTextOptions, ck as INDEXED_STORE_POLICY, cl as ImportCapability, cm as InferOutput, cn as InternalCollectionStats, co as IssueDelegationOptions, cp as IssueMagicLinkGrantOptions, aW as JsonPatch, aX as JsonPatchOp, cq as KeyringAuthenticator, cr as KeyringAuthenticatorWrappingDEKs, cs as KeyringAuthenticatorWrappingKEK, ct as KeyringFile, aY as LedgerEntry, aZ as LedgerStore, cu as ListAccessibleVaultsOptions, cv as ListPageResult, cw as ListUsersOptions, cx as LiveUserEnvelope, cy as LocaleReadOptions, cz as Lru, cA as LruOptions, cB as LruStats, cC as MAGIC_LINK_CONTENT_INFO_PREFIX, cD as MAGIC_LINK_GRANTS_COLLECTION, cE as MAGIC_LINK_KEK_INFO_PREFIX, cF as MagicLinkGrantPayload, cG as MagicLinkGrantRecord, bl as MaterializedFromMeta, cH as MaterializedViewDescriptor, bm as MaterializedViewOutput, aE as MaterializedViewStrategy, aF as MaterializedViewStrategyHandle, cI as MemoryRecipientSealer, cJ as MemorySealingKeyProvider, cK as NOYDB_BACKUP_VERSION, cL as NOYDB_FORMAT_VERSION, cM as NOYDB_KEYRING_VERSION, cN as NOYDB_SYNC_VERSION, cO as Noydb, cP as NoydbBundleStore, cQ as NoydbEventMap, cR as NoydbOptions, a8 as OpenPeriodOptions, aC as OutputSpec, cS as OverlayViewDescriptor, aG as OverlayedViewStrategy, aJ as OverlayedViewStrategyHandle, a9 as PERIODS_COLLECTION, cT as PUBLIC_ENVELOPE_FIELDS, cU as PaperRecoveryDoc, cV as PaperRecoveryEntry, cW as PassphrasePolicy, cX as PassphraseValidationResult, aa as PeriodRecord, cY as Permission, cZ as Permissions, c_ as PersistedSchemaKind, c$ as PlaintextTranslatorContext, d0 as PlaintextTranslatorFn, P as PolicyEnforcer, d1 as PresenceHandle, d2 as PresencePeer, aR as PruneOptions, d3 as PublicEnvelopeField, d4 as PublicEnvelopeSchema, d5 as PublicEnvelopeText, d6 as PullMode, d7 as PullOptions, d8 as PullPolicy, d9 as PullResult, da as PushMode, db as PushOptions, dc as PushPolicy, dd as PushResult, de as PutManyItemOptions, df as PutManyOptions, dg as PutManyResult, dh as QueryAcrossOptions, di as QueryAcrossResult, dj as QuickUnlockState, dk as QuickUnlockStore, dl as ReAuthOperation, be as RecipientHint, bd as RecipientSealer, aD as RecordOutputSpec, dm as RecoverPassphraseInput, dn as RecoverPassphraseResult, dp as RecoverUserOptions, dq as RecoveryProof, dr as ResolvedPublicEnvelopeSchema, ds as RevokeOptions, aL as Role, dt as RotatePassphraseInput, du as RotateRecoveryOptions, dv as RotateRecoveryResult, dw as SEALED_PASSPHRASE_RECORD_ID, dx as SchemaDelta, dy as SchemaIntrospection, dz as SealedEnvelope, dA as SealedPassphrase, bb as SealingKeyProvider, dB as SessionPolicy, dC as SetPublicEnvelopeInput, dD as ShamirRecoveryDoc, dE as ShamirRecoveryEntry, bh as ShamirRecoveryProvider, U as SlotInfo, V as SlotRecord, dF as SlotRewrapCeremony, dG as SlotRewrapContext, dH as StandardSchemaV1, dI as StandardSchemaV1Issue, dJ as StandardSchemaV1SyncResult, dK as StoreAuth, dL as StoreAuthKind, dM as StoreCapabilities, dN as SyncEngine, dO as SyncMetadata, dP as SyncPolicy, dQ as SyncScheduler, dR as SyncSchedulerStatus, dS as SyncStatus, dT as SyncTarget, dU as SyncTargetRole, dV as SyncTransaction, dW as SyncTransactionResult, dX as TabChannel, dY as TabCoordinationOptions, dZ as TabLockManager, d_ as TabPresence, d$ as TabRole, e0 as TierMode, e1 as TranslatorAuditEntry, as as TxCollection, at as TxContext, e2 as TxOp, au as TxVault, e3 as USER_ENVELOPE_COLLECTION, e4 as USER_ENVELOPE_MAX_BYTES, bn as UnionSource, e5 as Unsubscribe, e6 as UpdateAuthenticatorOptions, e7 as UpdateContext, e8 as UpdateUserOptions, e9 as UserApi, ea as UserEnvelopeCheckGate, eb as UserEnvelopeOversizedError, ec as UserEnvelopePresented, ed as UserInfo, ee as VaultBackup, a_ as VaultEngine, ap as VaultFrame, a$ as VaultInstant, ef as VaultPolicyOnDisk, eg as VaultSchemaSnapshot, eh as VaultSnapshot, b0 as VerifyResult, W as VersionRecord, ei as WarningRules, ej as WeakPassphraseError, ek as WeakPassphraseReason, el as WrappedDeksBlob, em as WriteConflict, en as WriteEvent, eo as WriteHook, ep as WriteQueue, g as applyI18nLocale, b1 as applyPatch, eq as assertStrongPassphrase, er as buildRecipientKeyringFile, es as burnPaperRecoveryEntry, b2 as canonicalJson, b3 as computePatch, n as createEnforcer, et as createNoydb, eu as createStore, ev as deriveMagicLinkContentKey, h as dictCollectionName, i as dictKey, b4 as diff, ew as enrollAuthenticator, ex as estimateEntropy, ey as evaluateExportCapability, ez as evaluateImportCapability, eA as findAuthenticator, b5 as formatDiff, eB as hasExportCapability, eC as hasImportCapability, eD as hasRecoveryEnrolled, b6 as hashEntry, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, eE as isMagicLinkGrantExpired, eF as isPublicEnvelope, eG as issueDelegation, eH as keyringRecoverPassphrase, eI as keyringRotatePassphrase, eJ as listMagicLinkGrants, eK as listUsers, eL as listUsersWithEnvelopes, eM as loadActiveDelegations, eN as loadPaperRecoveryEntries, eO as loadSealedPassphrase, eP as loadShamirRecoveryEntries, eQ as magicLinkGrantRecordId, eR as mintPaperRecoveryEntry, eS as mintShamirRecoveryEntry, eT as mintWrappedDeksBlob, b7 as paddedIndex, b8 as parseIndex, eU as parseSealedEnvelope, eV as readMagicLinkGrantRecord, eW as recoverUser, eX as removeAuthenticator, r as resolveI18nText, eY as resolvePublicEnvelopeSchema, eZ as revokeDelegation, e_ as revokeMagicLinkGrant, av as runTransaction, e$ as savePaperRecoveryEntries, f0 as saveSealedPassphrase, f1 as saveShamirRecoveryEntries, b9 as sha256Hex, f2 as unwrapDeksFromBlob, f3 as unwrapDeksFromPaperEntry, f4 as unwrapDeksFromShamirEntry, f5 as unwrapMagicLinkGrant, v as validateI18nTextValue, f6 as validatePassphrase, f7 as validatePublicEnvelopeInput, f8 as validateSchemaInput, f9 as validateSchemaOutput, o as validateSessionPolicy, fa as writeMagicLinkGrant } from './types-D9eB0Rvh.js';
 export { d as detectMagic, a as detectMimeType, i as isPreCompressed } from './mime-magic-CBBSOkjm.js';
 export { AgeRoute, BlobLifecyclePolicy, BlobStoreRoute, CircuitBreakerOptions, HealthCheckOptions, LogLevel, LoggingOptions, MetricsOptions, OverrideOptions, OverrideTarget, RetryOptions, RouteStatus, RouteStoreOptions, RoutedNoydbStore, StoreCacheOptions, StoreMiddleware, StoreOperation, SuspendOptions, WrapBundleStoreOptions, WrappedBundleNoydbStore, createBundleStore, routeStore, withCache, withCircuitBreaker, withHealthCheck, withLogging, withMetrics, withRetry, wrapBundleStore, wrapStore } from './store/index.js';
-import { N as NoydbError } from './index-CNwA-B6-.js';
-export { q as AlreadyElevatedError, A as AmendmentForbiddenError, B as BackupCorruptedError, r as BackupLedgerError, s as BundleIntegrityError, t as BundleSealMismatchError, u as BundleVersionConflictError, C as ConflictError, v as DEFAULT_JOIN_MAX_ROWS, w as DanglingReferenceError, x as DecryptionError, y as DelegationTargetMissingError, e as DerivationCapExceededError, f as DerivationCycleError, g as DerivationDepthError, h as DerivationOutputShapeError, i as DerivationOutputUnknownError, D as DictKeyInUseError, a as DictKeyMissingError, z as DirectoryDisabledError, E as ElevationExpiredError, G as ExportCapabilityError, F as FieldFrozenError, H as FilenameSanitizationError, J as GroupCardinalityError, K as ImportCapabilityError, P as IndexRequiredError, U as IndexWriteFailureError, V as InvalidKeyError, I as InvariantError, W as JoinContext, X as JoinLeg, Y as JoinStrategy, Z as JoinTooLargeError, _ as JoinableSource, $ as KeyringCorruptError, a0 as KeyringExpiredError, a1 as LedgerContentionError, a2 as LiveQuery, a3 as LiveUpstream, L as LocaleNotSpecifiedError, m as MaterializedViewConfigError, n as MaterializedViewCycleError, o as MaterializedViewSourceUnknownError, p as MaterializedViewTooLargeError, M as MissingTranslationError, a4 as NetworkError, a5 as NoAccessError, a6 as NotFoundError, a7 as OrderBy, O as OverlayBaseIsVirtualError, j as OverlayCollectionUnavailableError, k as OverlayIdMismatchError, l as OverlayNameCollisionError, a8 as PathEscapeError, a9 as PeriodClosedError, aa as PermissionDeniedError, ab as PrivilegeEscalationError, Q as Query, ac as QueryPlan, ad as QuerySource, ae as ReadOnlyAtInstantError, af as ReadOnlyError, ag as ReadOnlyFrameError, d as RecordLockedError, ah as RefDescriptor, ai as RefIntegrityError, aj as RefMode, ak as RefRegistry, al as RefScopeError, am as RefViolation, R as ReservedCollectionNameError, an as ScanBuilder, ao as ScanPageProvider, ap as SchemaValidationError, S as SessionExpiredError, b as SessionNotFoundError, c as SessionPolicyError, aq as StoreCapabilityError, ar as TamperedError, as as TierDemoteDeniedError, at as TierNotGrantedError, T as TranslatorNotConfiguredError, au as ValidationError, av as applyJoins, aw as buildLiveQuery, ax as executePlan, ay as ref, az as resetJoinWarnings } from './index-CNwA-B6-.js';
-export { A as AutoCredential, a as AutoCredentialKind, C as CompressionAlgo, N as NOYDB_BUNDLE_FORMAT_VERSION, b as NOYDB_BUNDLE_MAGIC, c as NOYDB_BUNDLE_PREFIX_BYTES, d as NoydbBundleHeader, e as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, g as generateULID, h as hasNoydbBundleMagic, i as isULID, r as readNoydbBundle, f as readNoydbBundleHeader, j as readNoydbBundlePublicEnvelope, k as resetBrotliSupportCache, w as writeNoydbBundle } from './index-4agOpzqd.js';
+import { N as NoydbError } from './index-BF1B2HB9.js';
+export { x as AlreadyElevatedError, A as AmendmentForbiddenError, m as AttestationError, B as BackupCorruptedError, o as BackupLedgerError, p as BundleIntegrityError, q as BundleSealMismatchError, r as BundleVersionConflictError, C as ConflictError, y as DEFAULT_JOIN_MAX_ROWS, z as DanglingReferenceError, E as DecryptionError, G as DelegationTargetMissingError, e as DerivationCapExceededError, f as DerivationCycleError, g as DerivationDepthError, h as DerivationOutputShapeError, i as DerivationOutputUnknownError, D as DictKeyInUseError, a as DictKeyMissingError, H as DirectoryDisabledError, J as ElevationExpiredError, K as ExportCapabilityError, F as FieldFrozenError, U as FilenameSanitizationError, V as GroupCardinalityError, W as ImportCapabilityError, X as IndexRequiredError, Y as IndexWriteFailureError, Z as InvalidKeyError, I as InvariantError, _ as JoinContext, $ as JoinLeg, a0 as JoinStrategy, a1 as JoinTooLargeError, a2 as JoinableSource, a3 as KeyringCorruptError, a4 as KeyringExpiredError, a5 as LedgerContentionError, a6 as LiveQuery, a7 as LiveUpstream, L as LocaleNotSpecifiedError, t as MaterializedViewConfigError, u as MaterializedViewCycleError, v as MaterializedViewSourceUnknownError, w as MaterializedViewTooLargeError, a8 as MigrationRequiredError, M as MissingTranslationError, a9 as NetworkError, aa as NoAccessError, ab as NonAdditiveSchemaChangeError, ac as NotFoundError, ad as OrderBy, O as OverlayBaseIsVirtualError, j as OverlayCollectionUnavailableError, k as OverlayIdMismatchError, l as OverlayNameCollisionError, ae as PathEscapeError, af as PeriodClosedError, ag as PermissionDeniedError, ah as PrivilegeEscalationError, Q as Query, ai as QueryPlan, aj as QuerySource, ak as QuiesceTimeoutError, al as ReadOnlyAtInstantError, am as ReadOnlyError, an as ReadOnlyFrameError, d as RecordLockedError, ao as RefDescriptor, ap as RefIntegrityError, aq as RefMode, ar as RefRegistry, as as RefScopeError, at as RefViolation, R as ReservedCollectionNameError, au as ScanBuilder, av as ScanPageProvider, aw as SchemaFenceError, ax as SchemaLockedError, ay as SchemaUpdateError, az as SchemaValidationError, S as SessionExpiredError, b as SessionNotFoundError, c as SessionPolicyError, aA as StoreCapabilityError, aB as TamperedError, aC as TierDemoteDeniedError, aD as TierNotGrantedError, T as TranslatorNotConfiguredError, aE as ValidationError, aF as applyJoins, aG as buildLiveQuery, aH as executePlan, aI as ref, aJ as resetJoinWarnings } from './index-BF1B2HB9.js';
+export { A as AutoCredential, n as AutoCredentialKind, c as CompressionAlgo, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, j as generateULID, o as hasNoydbBundleMagic, k as isULID, r as readNoydbBundle, l as readNoydbBundleHeader, p as readNoydbBundlePublicEnvelope, m as resetBrotliSupportCache, w as writeNoydbBundle } from './ulid-CiM2OAeM.js';
 export { a as CrdtMode, b as CrdtState, L as LwwMapState, R as RgaState, Y as YjsState, m as mergeCrdtStates, r as resolveCrdtSnapshot } from './strategy-BSxFXGzb.js';
-export { w as withGuard } from './with-guard-DWOCK4Ca.js';
-export { w as withDerivation } from './with-derivation-g-pGoMzL.js';
-export { w as withMaterializedView } from './with-materialized-view-DaKR-N6J.js';
+export { w as withGuard } from './with-guard-DR7U-l4v.js';
+export { w as withDerivation } from './with-derivation-Bzpj6UTv.js';
+export { w as withMaterializedView } from './with-materialized-view-qtoJ3xKJ.js';
 export { a as Clause, C as CollectionIndexes, F as FieldClause, b as FilterClause, G as GroupClause, H as HashIndex, I as IndexDef, O as Operator, e as evaluateClause, c as evaluateFieldClause, r as readPath } from './predicate-Dnu81tsS.js';
-export { w as withOverlayedView } from './with-overlayed-view-N7jYuNOS.js';
+export { w as withOverlayedView } from './with-overlayed-view-DFaRfgMr.js';
 export { SYNC_CREDENTIALS_COLLECTION, SyncCredential, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential } from './team/index.js';
-export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-D9s-loPr.js';
+export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-Cf2B7Kih.js';
 export { a as AggregateResult, b as AggregateSpec, c as Aggregation, d as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, e as GROUPBY_WARN_CARDINALITY, f as GroupedAggregation, g as GroupedQuery, h as GroupedQueryN, i as GroupedRow, j as GroupedRowN, L as LiveAggregation, R as Reducer, k as ReducerOptions, l as avg, n as count, o as groupAndReduce, p as max, q as min, r as reduceRecords, t as sum } from './strategy-DSTrsZ8t.js';
-export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-DXXXusyk.js';
+export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-gVn_uKhp.js';
 import './lazy-builder-Rpd-V3jP.js';
+import '@noy-db/attestation';
 
 /**
  * Persistence helpers for per-principal user envelopes stored at
@@ -338,6 +339,24 @@ declare function loadVaultPolicy(store: NoydbStore, vault: string): Promise<Vaul
  */
 declare function saveVaultPolicy(store: NoydbStore, vault: string, policy: VaultPolicy): Promise<void>;
 
+/** Allow any schema change. Explicit blind / back-compat. */
+declare function blindUpdate(): SchemaUpdateStrategy;
+/** Allow additive changes; reject non-additive ones. The safety backstop. */
+declare function additiveOnly(): SchemaUpdateStrategy;
+/**
+ * Reject schema changes. With `fields`, reject only when one of those
+ * fields is added/removed/changed; otherwise reject any non-`none` delta.
+ */
+declare function lockSchema(opts?: {
+    readonly fields?: readonly string[];
+}): SchemaUpdateStrategy;
+
+/** The coordinatedCutover update strategy (#232, single-step — no from/to). */
+
+declare function coordinatedCutover(opts: {
+    readonly transform: TransformFn;
+}): SchemaUpdateStrategy;
+
 /**
  * Derive a {@link PersistedSchemaEnvelope} from a Standard Schema v1
  * validator. v0 supports Zod via `zod-to-json-schema` (optional peer-dep);
@@ -412,6 +431,8 @@ interface PersistSchemaResult {
     readonly skipped: boolean;
     /** The envelope that was either written or matched. */
     readonly envelope: PersistedSchemaEnvelope;
+    /** The update-strategy decision, present when strategies ran (#245). */
+    readonly decision?: UpdateDecision;
 }
 declare function persistSchemaIfNeeded(opts: {
     readonly store: NoydbStore;
@@ -419,6 +440,7 @@ declare function persistSchemaIfNeeded(opts: {
     readonly collectionName: string;
     readonly validator: unknown;
     readonly dek: CryptoKey;
+    readonly strategies?: readonly SchemaUpdateStrategy[];
 }): Promise<PersistSchemaResult>;
 
 /**
@@ -753,4 +775,4 @@ type DiffCandidate<T = unknown> = Vault | Record<string, readonly T[]> | string;
  */
 declare function diffVault<T = unknown>(vault: Vault, candidate: DiffCandidate<T>, options?: DiffOptions): Promise<VaultDiff<T>>;
 
-export { ActiveTier, type CheckGateContext, DEFAULT_FRESHNESS_MS, DIRECTORY_RECORD_ID, type DiffCandidate, DiffEntry, type DiffOptions, DirectoryConfig, FactorProof, GateName, GatePolicy, META_COLLECTION, ManagedRecoveryNotEnrolledError, NoydbError, NoydbStore, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, type PersistSchemaResult, PersistedSchemaEnvelope, PolicyDeniedError, type PolicyDenyReason, PublicEnvelope, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, SCHEMAS_COLLECTION, STRICT_POLICY, UnlockedKeyring, UserEnvelope, UserVisibility, VISIBILITY_RECORD_PREFIX, Vault, type VaultDiff, type VaultDiffEntry, type VaultDiffModifiedEntry, VaultPolicy, assertTierAccess, base64ToBuffer, bufferToBase64, checkGate, decryptBytes, decryptDeterministic, dekKey, deleteUserEnvelope, deleteUserVisibility, derivePersistedSchema, derivePresenceKey, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, diffVault, effectiveClearance, encryptBytes, encryptDeterministic, estimateRecordBytes, isZodSchema, listUserEnvelopeIds, loadPersistedSchema, loadPublicEnvelope, loadUserEnvelope, loadVaultPolicy, mergePolicy, parseBytes, persistDirectoryConfig, persistSchemaIfNeeded, persistUserVisibility, readDirectoryConfig, readPublicEnvelope, readUserVisibility, savePersistedSchema, savePublicEnvelope, saveUserEnvelope, saveVaultPolicy, visibilityRecordId };
+export { ActiveTier, type CheckGateContext, DEFAULT_FRESHNESS_MS, DIRECTORY_RECORD_ID, type DiffCandidate, DiffEntry, type DiffOptions, DirectoryConfig, FactorProof, GateName, GatePolicy, META_COLLECTION, ManagedRecoveryNotEnrolledError, NoydbError, NoydbStore, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, type PersistSchemaResult, PersistedSchemaEnvelope, PolicyDeniedError, type PolicyDenyReason, PublicEnvelope, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, SCHEMAS_COLLECTION, STRICT_POLICY, SchemaUpdateStrategy, UnlockedKeyring, UpdateDecision, UserEnvelope, UserVisibility, VISIBILITY_RECORD_PREFIX, Vault, type VaultDiff, type VaultDiffEntry, type VaultDiffModifiedEntry, VaultPolicy, additiveOnly, assertTierAccess, base64ToBuffer, blindUpdate, bufferToBase64, checkGate, coordinatedCutover, decryptBytes, decryptDeterministic, dekKey, deleteUserEnvelope, deleteUserVisibility, derivePersistedSchema, derivePresenceKey, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, diffVault, effectiveClearance, encryptBytes, encryptDeterministic, estimateRecordBytes, isZodSchema, listUserEnvelopeIds, loadPersistedSchema, loadPublicEnvelope, loadUserEnvelope, loadVaultPolicy, lockSchema, mergePolicy, parseBytes, persistDirectoryConfig, persistSchemaIfNeeded, persistUserVisibility, readDirectoryConfig, readPublicEnvelope, readUserVisibility, savePersistedSchema, savePublicEnvelope, saveUserEnvelope, saveVaultPolicy, visibilityRecordId };