@noy-db/hub 0.2.0-pre.11 → 0.2.0-pre.13

package/dist/{types-CD8mc8zR.d.ts → types-pax34sec.d.ts}

@@ -1,8 +1,8 @@
 import { I as IndexStrategy, d as LazyQuery } from './lazy-builder-D5GU14TS.js';
-import { b as AggregateSpec, A as AggregateStrategy } from './strategy-CT2LCKAX.js';
+import { a7 as NoydbError, o as LiveAggregation, f as AggregateSpec, e as AggregateResult, A as AggregateStrategy, au as MoneyDescriptor } from './strategy-CrS7PnbE.js';
 import { C as CrdtStrategy, a as CrdtMode, b as CrdtState } from './strategy-BSxFXGzb.js';
-import { N as NoydbError, Q as Query, aw as RefRegistry, at as RefDescriptor, a7 as JoinableSource, ay as RefViolation, az as ScanBuilder } from './index-DfUbNad8.js';
-import { F as FieldClause, I as IndexDef, C as CollectionIndexes } from './predicate-Bt5ft-9c.js';
+import { L as LiveQuery, Q as Query, j as RefRegistry, R as RefDescriptor, d as JoinableSource, l as RefViolation, S as ScanBuilder } from './index-Cqzp4tt9.js';
+import { I as IndexDef, O as Operator, F as FieldClause, C as CollectionIndexes } from './predicate-Bt5ft-9c.js';
 import { AttestationFieldSchema, RevocationList } from '@noy-db/attestation';
 
 /**
@@ -140,6 +140,34 @@ declare function validateSchemaInput<Output>(schema: StandardSchemaV1<unknown, O
  */
 declare function validateSchemaOutput<Output>(schema: StandardSchemaV1<unknown, Output>, value: unknown, context: string): Promise<Output>;
 
+/**
+ * @category capability
+ * Deferred-numbering config descriptor. See
+ * docs/superpowers/specs/2026-06-08-sealed-numbering-and-store-clock-design.md.
+ */
+/** A registered deferred-numbering series. */
+interface DeferredNumberingConfig {
+    /** Series name — the key passed to `vault.sequence(series)`. */
+    readonly series: string;
+    /** Collection holding the records to number. */
+    readonly collection: string;
+    /** Field on each record where the assigned serial is written. */
+    readonly field: string;
+    /**
+     * Minimum wall-clock age (ms) before an entry is eligible at a pass, in
+     * addition to the interval commit-wait. Default 0 — the store-clock
+     * interval (`storeLatest ≤ now.earliest`) is the correctness mechanism.
+     */
+    readonly settleWindowMs: number;
+}
+/** Declare a deferred-numbering series. Pass the result in `createNoydb({ numbering: [...] })`. */
+declare function withDeferredNumbering(config: {
+    series: string;
+    collection: string;
+    field: string;
+    settleWindowMs?: number;
+}): DeferredNumberingConfig;
+
 /**
  * Sync scheduling policy.
  *
@@ -582,6 +610,71 @@ interface BlobStrategy {
     openSlot(args: BlobStrategyOpenArgs): BlobSet;
 }
 
+/**
+ * Record cold-storage archival engine.
+ *
+ * Archival relocates a sealed record's **encrypted envelope** from the
+ * primary store to a cold archive store — no re-encryption, the envelope
+ * is opaque ciphertext. Because relocation goes through low-level store
+ * ops (and the collection's `_internalDelete`), it bypasses guards (an
+ * issued/immutable record can still be archived) and never fires
+ * materialized-view dispatch (finalized aggregates over a sealed period
+ * don't recompute). The archive store's contents are themselves the
+ * archived-set index — `listArchived` lists it; `restore` relocates an
+ * envelope back to the primary store.
+ *
+ * A `legalHold` predicate blocks archival; `archiveWhen` (typically
+ * derived from the record's fiscal period / business date) selects
+ * eligible records.
+ */
+
+interface ArchivePolicy<T = unknown> {
+    /** Select records eligible for archival — typically a business-date / period test. */
+    readonly archiveWhen: (record: T) => boolean;
+    /** Block archival while true (litigation / audit hold). Fail-closed on throw. */
+    readonly legalHold?: (record: T) => boolean;
+}
+interface ArchiveResult {
+    /** Records relocated to the archive store. */
+    readonly archived: number;
+    /** Records eligible by `archiveWhen` but retained by a `legalHold`. */
+    readonly held: number;
+    /** Records scanned across policy collections. */
+    readonly scanned: number;
+    readonly byCollection: Record<string, {
+        archived: number;
+        held: number;
+    }>;
+}
+interface ArchiveRunOptions {
+    /** Stop after this many archivals. `undefined` = unbounded. */
+    readonly maxArchives?: number;
+    /** Preview without relocating. */
+    readonly dryRun?: boolean;
+}
+
+/**
+ * `@noy-db/hub` record cold-storage archival subsystem.
+ *
+ * `withArchive({ store })` designates a cold {@link NoydbStore} as the
+ * archive target. Declare a per-collection `archive` policy, then call
+ * `vault.archive()` to relocate eligible sealed records there,
+ * `vault.restore(collection, id)` to pull one back, and
+ * `vault.listArchived()` to enumerate the cold set.
+ *
+ * @see ./engine for the relocation logic.
+ */
+
+interface WithArchiveOptions {
+    /** The cold store that holds archived record envelopes. */
+    store: NoydbStore;
+}
+interface ArchiveStrategy {
+    readonly store: NoydbStore;
+}
+/** Enable record cold-storage archival against the given cold store. */
+declare function withArchive(opts: WithArchiveOptions): ArchiveStrategy;
+
 /**
  * Consent boundaries — per-access audit log.
  *
@@ -2620,6 +2713,41 @@ declare class DictionaryHandle<Keys extends string = string> {
     resolveLabel(key: string, locale: string, fallback?: string | readonly string[]): Promise<string | undefined>;
 }
 
+/**
+ * Computed scalar fields — schema-owned derived values evaluated on
+ * write and materialized onto the record.
+ *
+ * A `computed` map declares pure, synchronous functions keyed by field
+ * path. {@link evalComputedFields} runs them in declaration order — each
+ * function sees the record with all prior computed fields already
+ * injected, so a later field can read an earlier one (`total` reads
+ * `netAmount`). The result is stored like any field: queryable,
+ * indexable, and `aggregate(sum())`-able (exactly, when the field is also
+ * a `money()` field).
+ *
+ * Computed evaluation is the FIRST stage of the write pipeline (before
+ * schema validation), so the user need not supply computed fields and the
+ * schema validates the computed result. Cross-record / async derivation
+ * is out of scope here — see the validation subsystem (#299).
+ */
+
+type ComputedFn<T = Record<string, unknown>> = (record: T) => unknown;
+type ComputedFields<T = Record<string, unknown>> = Record<string, ComputedFn<T>>;
+/** Raised when a computed function throws during a write. */
+declare class ComputedFieldError extends NoydbError {
+    readonly field: string;
+    readonly id: string;
+    readonly cause: unknown;
+    constructor(field: string, id: string, cause: unknown);
+}
+/**
+ * Evaluate every computed field in declaration order, injecting each
+ * result into a shallow clone. A computed field overwrites any
+ * user-supplied value of the same name — the field is schema-owned.
+ * Returns the new record; the input is not mutated.
+ */
+declare function evalComputedFields<T extends Record<string, unknown>>(record: T, computed: ComputedFields, id: string): T;
+
 /**
  * Infer the allowed Unicode scripts for a BCP-47 locale, with asymmetric
  * Latin tolerance. A script subtag (`th-Latn`) wins over the base
@@ -2854,6 +2982,14 @@ interface GatePutEvent {
     readonly existingTs: string | undefined;
     readonly userId: string;
     readonly role: Role;
+    /**
+     * Names of fields whose values are schema-owned computed fields for this
+     * collection. Gate handlers (e.g. `frozenFields`) must skip these: the
+     * incoming record is the raw user input (computed fields not yet evaluated),
+     * so comparing `existing[computedField]` vs `incoming[computedField]`
+     * would always see a change even when the computed result is unchanged.
+     */
+    readonly computedFieldNames?: ReadonlySet<string>;
 }
 /** Payload for a `beforeDelete` gate. Like {@link GatePutEvent} without `incoming`. */
 interface GateDeleteEvent {
@@ -3600,6 +3736,170 @@ declare class SyncEngine {
     private persistMeta;
 }
 
+/**
+ * @category capability
+ * Multi-vault partition federation (MVF) — public types for VaultGroup
+ * transparent shard routing. See
+ * docs/superpowers/specs/2026-06-07-mvf-vaultgroup-routing-mvp-design.md.
+ */
+
+/**
+ * A schema blueprint for a class of shard vaults. `configure` is
+ * re-applied to every shard handle so all shards are configured
+ * identically (collections, indexes, schemas). `version` is recorded
+ * into each shard's registry row and drives the fan-out
+ * `minVersion` guard.
+ */
+interface VaultTemplate {
+    readonly version: number;
+    readonly configure: (vault: Vault) => void;
+}
+/** One row in the StateManagement `vault-registry` collection. */
+interface VaultRegistryRow {
+    readonly vaultId: string;
+    readonly partitionKey: string;
+    readonly templateName: string;
+    readonly schemaVersion: number;
+    readonly createdAt: number;
+    /** Which VaultGroup this shard belongs to (registry is shared across groups). */
+    readonly group: string;
+}
+/** How a VaultGroup maps records to shards. */
+interface ShardingConfig<T> {
+    /** Extract the partition key from a record. */
+    readonly keyOf: (record: T) => string;
+    /** Name of the template (registered via `withVaultTemplate`) shards are stamped from. */
+    readonly vaultTemplate: string;
+    /** When a write targets an unknown partition key, stamp a shard inline. Default `true`. */
+    readonly autoCreate?: boolean;
+}
+/** Options for `Noydb.openVaultGroup`. */
+interface VaultGroupOptions<T> {
+    /**
+     * The `vault-registry` collection (source of truth for shard discovery).
+     * Optional: when omitted, the reserved StateManagement vault's registry
+     * is auto-opened and used.
+     */
+    readonly registry?: Collection<VaultRegistryRow>;
+    readonly sharding: ShardingConfig<T>;
+}
+/** Options for a cross-shard fan-out read. */
+interface FanoutQueryOptions {
+    /** Skip shards whose registry `schemaVersion` is below this. */
+    readonly minVersion?: number;
+    /** Max shards queried in parallel (passed to queryAcross). Default 1. */
+    readonly concurrency?: number;
+}
+/** A shard excluded from a fan-out result, with the reason. */
+interface SkippedVault {
+    readonly vaultId: string;
+    readonly reason: 'schema-drift' | 'error' | 'no-grant';
+    readonly error?: Error;
+}
+/** The result of a cross-shard fan-out read. */
+interface FanoutResult<R> {
+    readonly results: R[];
+    readonly skippedVaults: SkippedVault[];
+}
+/** A single captured where-clause, replayed inside each shard. */
+interface WhereClause {
+    readonly field: string;
+    readonly op: Operator;
+    readonly value: unknown;
+}
+/** Options for the live/aggregate fan-out (extends the one-shot opts). */
+interface LiveQueryOptions extends FanoutQueryOptions {
+    /** Coalesce window before recompute. Default 0 (microtask). */
+    readonly debounceMs?: number;
+}
+/** A grouped aggregate output row: the grouped field + the reduced spec result. */
+type GroupedRow<F extends string, Spec extends AggregateSpec> = {
+    readonly [K in F]: unknown;
+} & AggregateResult<Spec>;
+/** Reactive cross-shard record (or grouped-row) query — array-shaped, mirrors LiveQuery<T>. */
+interface CrossVaultLiveQuery<T> extends LiveQuery<T> {
+    readonly skippedVaults: readonly SkippedVault[];
+    readonly ready: Promise<void>;
+}
+/** Reactive cross-shard scalar aggregate — mirrors LiveAggregation<R>. */
+interface CrossVaultLiveAggregation<R> extends LiveAggregation<R> {
+    readonly skippedVaults: readonly SkippedVault[];
+    readonly ready: Promise<void>;
+}
+/** A serializable blueprint captured from a VaultTemplate.configure run. */
+interface CapturedBlueprint {
+    /** Sorted collection names declared by the template. */
+    readonly collections: string[];
+    /** Per-collection index defs (key order canonicalized). */
+    readonly indexes: Record<string, IndexDef[]>;
+    /** Collections that declared `persistJsonSchema: true`. */
+    readonly persistJsonSchema: string[];
+}
+/** One row in the StateManagement `schema-manifest` collection, keyed by `${templateName}:${version}`. */
+interface SchemaManifestRow {
+    readonly templateName: string;
+    readonly version: number;
+    readonly collections: string[];
+    readonly indexes: Record<string, IndexDef[]>;
+    readonly persistJsonSchema: string[];
+    /** sha256 over the canonicalized serializable blueprint. */
+    readonly fingerprint: string;
+    readonly recordedAt: number;
+}
+/** One row in the append-only StateManagement `deployment-events` collection. */
+interface DeploymentEvent {
+    readonly id: string;
+    readonly ts: number;
+    readonly type: 'shard-created' | 'manifest-recorded' | 'group-opened';
+    readonly group: string;
+    readonly vaultId?: string;
+    readonly templateName?: string;
+    readonly version?: number;
+    readonly actor?: string;
+}
+
+/**
+ * @category capability
+ * StateManagement Vault — federation control plane (registry +
+ * schema-manifest + append-only deployment-events). See
+ * docs/superpowers/specs/2026-06-08-statemanagement-vault-design.md.
+ */
+
+declare class StateManagementVault {
+    #private;
+    readonly registry: Collection<VaultRegistryRow>;
+    readonly schemaManifest: Collection<SchemaManifestRow>;
+    private constructor();
+    /** Idempotently open the reserved state vault and bind the three control-plane collections. */
+    static open(db: Noydb): Promise<StateManagementVault>;
+    /** Read-only query over the append-only deployment-events log. */
+    queryEvents(): Query<DeploymentEvent>;
+    /**
+     * Append a deployment event with a fresh unique (ULID) id. This is the
+     * only write path to the events log; no update/delete is exposed.
+     * Callers should treat failures as non-fatal — this method does not
+     * swallow errors, so wrap the call site in try/catch where appropriate.
+     */
+    appendEvent(event: Omit<DeploymentEvent, 'id' | 'ts'> & {
+        ts?: number;
+    }): Promise<void>;
+    /**
+     * Ensure a manifest row exists for `(templateName, template.version)`.
+     * Safe to call repeatedly: the `fingerprint` is a deterministic hash of
+     * the template's declared shape (stable across calls), though each call
+     * refreshes `recordedAt`.
+     */
+    recordManifest(templateName: string, template: VaultTemplate): Promise<string>;
+    /**
+     * True when `template`'s current declared shape does not match the recorded
+     * manifest for `(templateName, template.version)`. Because shards carry no
+     * schema state independent of their template, this catches "a template's
+     * shape changed without bumping `version`" — not independent per-shard drift.
+     * A missing manifest is treated as drift (nothing to verify against).
+     */
+    detectDrift(templateName: string, template: VaultTemplate): Promise<boolean>;
+}
+
 /**
  * **Wrap-DEKs primitive** — a single canonical shape for the
  * pattern of "serialize a DEK set, encrypt it under a credential-derived
@@ -4972,6 +5272,157 @@ interface FactorProofBundle {
 /** Active session tier — what the engine compares against `gate.minTier`. */
 type ActiveTier = 1 | 2 | 3;
 
+/** A source that can fan out records across shards. Satisfied by ShardedQuery. */
+interface FanoutRecordSource<R> {
+    fanoutRecords(options: FanoutQueryOptions): Promise<{
+        records: R[];
+        skippedVaults: SkippedVault[];
+    }>;
+}
+/** Live-binding hooks (change subscription + relevance) threaded from ShardedQuery. */
+interface LiveBinding {
+    subscribeToChanges: (handler: (e: ChangeEvent) => void) => () => void;
+    isRelevant: (e: ChangeEvent) => boolean;
+}
+/**
+ * One-shot cross-vault aggregate. Concatenates all shard records and runs a
+ * single central reduce, ensuring correct avg/mean values.
+ */
+declare class CrossVaultAggregation<R, Spec extends AggregateSpec> {
+    private readonly src;
+    private readonly spec;
+    private readonly bind?;
+    constructor(src: FanoutRecordSource<R>, spec: Spec, bind?: LiveBinding | undefined);
+    run(options?: FanoutQueryOptions): Promise<{
+        result: AggregateResult<Spec>;
+        skippedVaults: SkippedVault[];
+    }>;
+    live(options?: LiveQueryOptions): CrossVaultLiveAggregation<AggregateResult<Spec>>;
+}
+/**
+ * One-shot cross-vault grouped aggregate. Concatenates all shard records and
+ * runs a single central group-and-reduce, emitting one row per bucket.
+ */
+declare class CrossVaultGroupedAggregation<R, F extends string, Spec extends AggregateSpec> {
+    private readonly src;
+    private readonly field;
+    private readonly spec;
+    private readonly bind?;
+    constructor(src: FanoutRecordSource<R>, field: F, spec: Spec, bind?: LiveBinding | undefined);
+    run(options?: FanoutQueryOptions): Promise<{
+        results: GroupedRow<F, Spec>[];
+        skippedVaults: SkippedVault[];
+    }>;
+    live(options?: LiveQueryOptions): CrossVaultLiveQuery<GroupedRow<F, Spec>>;
+}
+
+/**
+ * @category capability
+ * Multi-vault partition federation — VaultGroup transparent shard
+ * routing. Spec:
+ * docs/superpowers/specs/2026-06-07-mvf-vaultgroup-routing-mvp-design.md.
+ */
+
+declare class VaultGroup<T> {
+    /** @internal */ readonly db: Noydb;
+    /** @internal */ readonly name: string;
+    /** @internal */ readonly registry: Collection<VaultRegistryRow>;
+    /** @internal */ readonly sharding: ShardingConfig<T>;
+    /** @internal */ readonly template: VaultTemplate;
+    constructor(
+    /** @internal */ db: Noydb, 
+    /** @internal */ name: string, 
+    /** @internal */ registry: Collection<VaultRegistryRow>, 
+    /** @internal */ sharding: ShardingConfig<T>, 
+    /** @internal */ template: VaultTemplate);
+    /** @internal — set when the group is managed (no explicit registry). */
+    private stateVault;
+    /** @internal */
+    _attachStateVault(sv: StateManagementVault): void;
+    /** Deterministic vault name for a partition key, namespaced by the group. */
+    shardVaultId(partitionKey: string): string;
+    /**
+     * @internal — group-qualified registry record key (avoids cross-group key
+     * collisions). Identical to the shard vault id by design — the registry row
+     * for a shard is keyed by that shard's vault id — so it delegates to
+     * `shardVaultId`, reusing its partition-key validation.
+     */
+    registryId(partitionKey: string): string;
+    /**
+     * Registry rows for THIS group (hydrates the registry collection first).
+     * The registry may be shared across groups (the auto-wired StateManagement
+     * vault holds one `vaultRegistry` for the whole instance), so rows are
+     * filtered by `group` — without this, a group's fan-out reads would leak
+     * across into other groups' shards. Mirrors the `${group}--` scoping that
+     * `liveBinding().isRelevant` already applies to the reactive path.
+     */
+    allRows(): Promise<VaultRegistryRow[]>;
+    /** Open an existing shard and apply the template. */
+    openShard(partitionKey: string): Promise<Vault>;
+    /**
+     * Idempotently provision a shard for `partitionKey`. Returns the
+     * configured vault handle.
+     *
+     * - row + vault present → no-op, return handle
+     * - row present, vault gone → ShardProvisioningError
+     * - row absent (vault present or not) → open-or-create, configure, write row
+     */
+    createShard(partitionKey: string): Promise<Vault>;
+    /**
+     * Drill down to a single shard's full Collection API. Throws if the shard is unknown.
+     * Also throws ShardProvisioningError if the registry row exists but the vault has been deleted
+     * (registry/store divergence).
+     */
+    shard(partitionKey: string): Promise<Vault>;
+    /** A sharded view over one logical collection across all shards. */
+    collection<R = T>(collectionName: string): ShardedCollection<T, R>;
+    /** @internal — eligible (openable-candidate) rows + drift/divergence skips. */
+    resolveEligible(options?: {
+        minVersion?: number;
+    }): Promise<{
+        eligible: VaultRegistryRow[];
+        skipped: SkippedVault[];
+    }>;
+}
+declare class ShardedCollection<T, R = T> {
+    private readonly group;
+    private readonly collectionName;
+    constructor(group: VaultGroup<T>, collectionName: string);
+    /** Route a write to the shard owning `keyOf(record)`. */
+    put(id: string, record: T): Promise<void>;
+    /** Begin a cross-shard fan-out query. */
+    query(): ShardedQuery<T, R>;
+}
+declare class ShardedQuery<T, R = T> {
+    private readonly group;
+    private readonly collectionName;
+    private readonly clauses;
+    constructor(group: VaultGroup<T>, collectionName: string, clauses: readonly WhereClause[]);
+    where(field: string, op: WhereClause['op'], value: unknown): ShardedQuery<T, R>;
+    /** @internal — fan out the where-filtered records across eligible shards. */
+    fanoutRecords(options?: FanoutQueryOptions): Promise<{
+        records: R[];
+        skippedVaults: SkippedVault[];
+    }>;
+    /** Fan out across eligible shards and merge results. */
+    toArray(options?: FanoutQueryOptions): Promise<FanoutResult<R>>;
+    /** @internal — build the change-subscription + relevance binding for this query's group+collection. */
+    liveBinding(): LiveBinding;
+    /** Returns a reactive cross-shard live query — a facade over CrossVaultLive. */
+    live(options?: LiveQueryOptions): CrossVaultLiveQuery<R>;
+    /** One-shot distributed aggregate — central reduce over all shard records. */
+    aggregate<Spec extends AggregateSpec>(spec: Spec): CrossVaultAggregation<R, Spec>;
+    /** Begin a grouped cross-shard aggregate. */
+    groupBy<F extends string>(field: F): ShardedGroupedQuery<T, R, F>;
+}
+/** Grouped cross-shard query — intermediate after `.groupBy(field)`, terminates with `.aggregate(spec)`. */
+declare class ShardedGroupedQuery<T, R, F extends string> {
+    private readonly query;
+    private readonly field;
+    constructor(query: ShardedQuery<T, R>, field: F);
+    aggregate<Spec extends AggregateSpec>(spec: Spec): CrossVaultGroupedAggregation<R, F, Spec>;
+}
+
 /** The top-level NOYDB instance. */
 declare class Noydb {
     #private;
@@ -5019,6 +5470,7 @@ declare class Noydb {
     private writeRelay;
     /** Per-vault policy enforcers. */
     private readonly policyEnforcers;
+    private readonly vaultTemplates;
     private readonly txStrategy;
     private readonly sessionStrategy;
     private readonly syncStrategy;
@@ -5270,6 +5722,28 @@ declare class Noydb {
      * ```
      */
     queryAcross<T>(vaultIds: string[], fn: (vault: Vault) => Promise<T>, options?: QueryAcrossOptions): Promise<QueryAcrossResult<T>[]>;
+    /**
+     * Register a shard schema blueprint. `createShard` / `openVaultGroup`
+     * stamp shards from the named template. See the MVF design spec.
+     */
+    withVaultTemplate(name: string, template: VaultTemplate): void;
+    /**
+     * Open a VaultGroup — transparent routing over per-partition shard
+     * vaults, with shard discovery backed by the supplied `vault-registry`
+     * collection.
+     */
+    openVaultGroup<T>(name: string, opts: VaultGroupOptions<T>): Promise<VaultGroup<T>>;
+    /**
+     * Open the reserved StateManagement control-plane vault (registry +
+     * schema-manifest + deployment-events). Lazy-loaded so the federation
+     * chunk stays out of the core graph until used.
+     */
+    openStateManagementVault(): Promise<StateManagementVault>;
+    /**
+     * @internal — true when an encrypted shard vault is provisioned
+     * (its keyring exists in the store).
+     */
+    _shardVaultProvisioned(vaultId: string): Promise<boolean>;
     /**
      * Change the current user's passphrase for a vault.
      *
@@ -6828,6 +7302,82 @@ declare class OverlayedViewRegistry {
     resolveBaseRowKey(name: string, mvRegistry: MaterializedViewRegistry | null): ((row: Record<string, unknown>) => string) | undefined;
 }
 
+/**
+ * Atomic sequence primitive — online-coordinated gap-free numbering.
+ *
+ * `vault.sequence('invoice-2026').next()` returns 1, 2, 3, … with no
+ * gaps and no duplicates, even under concurrent callers. Each named
+ * sequence is an independent counter record at `_sequences/<name>`,
+ * incremented with an optimistic compare-and-swap retry loop — the same
+ * proven pattern as the ledger head (`history/ledger/store.ts`).
+ *
+ * **Explicitly online-only.** Gap-free numbering requires single-authority
+ * serialization, which an offline / non-CAS store cannot provide. `next()`
+ * throws {@link SequenceOfflineError} unless the backing store advertises
+ * `capabilities.casAtomic`. This is a deliberate, honest wall — an offline
+ * writer cannot safely allocate a global sequence number.
+ *
+ * Note on "gap-free": the *sequence* is gap-free (each `next()` yields a
+ * unique, +1 value). If a caller discards a value without using it, that
+ * is a gap in *usage*, not in the sequence — assign each `next()` result
+ * to its record in the same operation.
+ */
+
+/** Options for `SequenceHandle.next`. Deferred-numbering series use `for`; the CAS counter ignores all of these. */
+interface NextOptions {
+    /** Deferred mode: the record id to number. Ignored by the CAS counter. */
+    readonly for?: string;
+    /** Deferred mode: reject after this many ms if still unsealed (reserved; not yet enforced in this slice). */
+    readonly timeoutMs?: number;
+}
+interface SequenceHandle {
+    /** Atomically allocate and return the next value (1, 2, 3, …). Deferred series resolve at the next pass. */
+    next(opts?: NextOptions): Promise<number>;
+    /** Read the current value without allocating. Returns 0 if never used. */
+    peek(): Promise<number>;
+}
+declare class SequenceStore {
+    private readonly adapter;
+    private readonly vault;
+    private readonly encrypted;
+    private readonly getDEK;
+    private readonly actor;
+    /**
+     * Memoized DEK promise. The `_sequences` collection DEK is created on
+     * first access; without sharing one promise, a burst of concurrent
+     * `next()` calls would each trigger DEK creation and diverge (one
+     * writer's ciphertext unreadable by another). One shared promise → one
+     * DEK.
+     */
+    private dekPromise;
+    constructor(opts: {
+        adapter: NoydbStore;
+        vault: string;
+        encrypted: boolean;
+        getDEK: (collectionName: string) => Promise<CryptoKey>;
+        actor: string;
+    });
+    /** A handle bound to one sequence name. */
+    handle(name: string): SequenceHandle;
+    private assertOnline;
+    private dek;
+    private read;
+    private encryptState;
+    peek(name: string): Promise<number>;
+    next(name: string): Promise<number>;
+}
+
+/**
+ * @category capability
+ * Deferred numbering engine — store-clock-ordered, gap-free serials assigned
+ * at an explicit numbering pass. See the design spec.
+ */
+
+interface Assignment {
+    recordId: string;
+    serial: number;
+}
+
 /**
  * Vault-internal singleton that holds the guard graph and dispatches
  * per-collection guard execution. Owned by `Vault`; not exported.
@@ -7065,6 +7615,23 @@ interface BlobFieldPolicy<T = unknown> {
      * disable predicate-based eviction.
      */
     readonly evictWhen?: (record: T) => boolean;
+    /**
+     * **Legal hold.** When this predicate returns `true`, the slot is
+     * never evicted — `retainDays`/`evictWhen` are overridden. Use for a
+     * litigation / audit hold on a fiscal document: the blob stays until
+     * the predicate returns `false` (the hold is released). Fail-closed:
+     * if the predicate throws, the slot is treated as held.
+     */
+    readonly legalHold?: (record: T) => boolean;
+    /**
+     * **Period-bound retention.** Returns the date (Date / ISO string /
+     * epoch ms) until which the slot must be retained — typically derived
+     * from the record's fiscal period (e.g. period end + 10 years). While
+     * `now < retainUntil`, the slot is never evicted, regardless of
+     * `retainDays`. Return `null`/`undefined` to impose no floor.
+     * Fail-closed: a throwing function holds the slot.
+     */
+    readonly retainUntil?: (record: T) => Date | string | number | null | undefined;
 }
 type BlobFieldsConfig<T = unknown> = Record<string, BlobFieldPolicy<T>>;
 declare const BLOB_EVICTION_AUDIT_COLLECTION = "_blob_eviction_audit";
@@ -7087,6 +7654,11 @@ interface CompactionResult {
     readonly collections: number;
     /** Number of audit entries written. Equal to `evicted`. */
     readonly auditEntries: number;
+    /**
+     * Number of slots that would have evicted (TTL/predicate triggered)
+     * but were retained by a `legalHold` or `retainUntil` floor.
+     */
+    readonly held: number;
     /** Per-collection breakdown for diagnostics. */
     readonly byCollection: Record<string, {
         records: number;
@@ -7755,6 +8327,10 @@ declare class Vault {
      * call throws with a pointer at `@noy-db/hub/blobs`.
      */
     private readonly blobStrategy;
+    /** Cold-storage archival strategy (the archive target store). */
+    private readonly archiveStrategy;
+    /** Per-collection record archival policies. Indexed by collection name. */
+    private readonly archiveRegistry;
     private readonly indexStrategy;
     private readonly aggregateStrategy;
     private readonly crdtStrategy;
@@ -7853,6 +8429,12 @@ declare class Vault {
      * docstring.
      */
     private ledgerStore;
+    /** Lazily-built atomic-sequence store. See {@link sequence}. */
+    private sequenceStore;
+    /** Lazily-built deferred-numbering engine. See {@link runNumberingPass}. */
+    private deferredNumbering;
+    /** Registered deferred-numbering series, keyed by series name. */
+    private readonly numberingConfigs;
     /**
      * Background writes for persisted-schema envelopes (#schema-dump v0
      * slice 1). One promise per `collection({ persistJsonSchema: true })`
@@ -7964,6 +8546,7 @@ declare class Vault {
          * at `@noy-db/hub/blobs`.
          */
         blobStrategy?: BlobStrategy | undefined;
+        archiveStrategy?: ArchiveStrategy | undefined;
         indexStrategy?: IndexStrategy | undefined;
         aggregateStrategy?: AggregateStrategy | undefined;
         crdtStrategy?: CrdtStrategy | undefined;
@@ -7974,6 +8557,7 @@ declare class Vault {
         i18nStrategy?: I18nStrategy | undefined;
         syncStrategy?: SyncStrategy | undefined;
         guardStrategies?: ReadonlyArray<GuardStrategyHandleAny> | undefined;
+        numberingConfigs?: ReadonlyArray<DeferredNumberingConfig> | undefined;
     });
     /**
      * Construct (or reconstruct) the lazy DEK resolver. Captures the
@@ -8006,8 +8590,9 @@ declare class Vault {
      *. `put()` validates keys against the declared set; reads
      *   with `{ locale }` add `<field>Label` virtual fields.
      *
-     * Throws `ReservedCollectionNameError` for names starting with `_dict_`.
-     * Use `vault.dictionary(name)` to access dictionary collections.
+     * Throws `ReservedCollectionNameError` for names starting with `_dict_` or
+     * equal to `_sequences`. Use `vault.dictionary(name)` for dict collections
+     * and `vault.sequence(name)` for sequence counters.
      *
      * Lazy mode + indexes is rejected at construction time — see the
      * Collection constructor for the rationale.
@@ -8024,6 +8609,10 @@ declare class Vault {
         i18nFields?: Record<string, I18nTextDescriptor>;
         /** — declare dictKey fields for label resolution on reads. */
         dictKeyFields?: Record<string, DictKeyDescriptor>;
+        /** — declare money() fields for currency-safe decimal storage/formatting. */
+        moneyFields?: Record<string, MoneyDescriptor>;
+        /** — declare computed scalar fields, evaluated on write (schema-owned). */
+        computed?: ComputedFields<T>;
         /** — per-collection conflict resolution policy. */
         conflictPolicy?: ConflictPolicy<T>;
         /** — CRDT mode for collaborative editing without conflicts. */
@@ -8042,6 +8631,8 @@ declare class Vault {
          * when `vault.compact()` runs.
          */
         blobFields?: BlobFieldsConfig<T>;
+        /** — declarative record archival policy: `{ archiveWhen, legalHold? }`. Evaluated when `vault.archive()` runs. */
+        archive?: ArchivePolicy<T>;
         /** — declared tiers for this collection. */
         tiers?: readonly number[];
         /**  — how lower-tier reads see above-tier records. */
@@ -8287,7 +8878,48 @@ declare class Vault {
      * await vault.compact({ maxEvictions: 1000 })             // cap batch
      * ```
      */
+    /**
+     * Atomic, gap-free numbering. `vault.sequence('invoice-2026').next()`
+     * returns 1, 2, 3, … with no gaps or duplicates under concurrency, via
+     * an optimistic-CAS counter at `_sequences/<name>`. Each name is an
+     * independent sequence.
+     *
+     * **Online-only:** `next()` throws `SequenceOfflineError` unless the
+     * store advertises `capabilities.casAtomic` — gap-free numbering cannot
+     * be serialized by an offline / non-CAS writer.
+     *
+     * ```ts
+     * const n = await vault.sequence('invoice-2026').next()   // 1, then 2, …
+     * const cur = await vault.sequence('invoice-2026').peek()  // current value, no allocation
+     * ```
+     */
+    sequence(name: string): SequenceHandle;
+    /** @internal — lazily build the deferred-numbering engine with a cache-coherent stamp. */
+    private deferred;
+    /**
+     * Run a deferred-numbering pass for `series`: assign gap-free serials to all
+     * records whose store-commit-time interval has settled, in store-time order.
+     * Returns the assignments made. See {@link sequence} / `withDeferredNumbering`.
+     */
+    runNumberingPass(series: string): Promise<Assignment[]>;
     compact(options?: CompactRunOptions): Promise<CompactionResult>;
+    /**
+     * Sweep records eligible by their collection's `archive` policy into the
+     * cold archive store. Relocation is envelope-level (no re-encryption) and
+     * bypasses guards + materialized-view dispatch, so issued/immutable
+     * records over a sealed period can be archived without recomputing
+     * finalized aggregates. A `legalHold` predicate blocks archival.
+     * Requires `archiveStrategy: withArchive({ store })` in `createNoydb`.
+     */
+    archive(options?: ArchiveRunOptions): Promise<ArchiveResult>;
+    /** Relocate one archived record back to the primary store. Returns false if it was not archived. */
+    restore(collection: string, id: string): Promise<boolean>;
+    /** List archived record ids for a collection (or all collections with an archive policy). */
+    listArchived(collection?: string): Promise<Array<{
+        collection: string;
+        id: string;
+    }>>;
+    private _archiveContext;
     exportBlobs(options?: ExportBlobsOptions): ExportBlobsHandle;
     issueAttestation(collectionName: string, id: string): Promise<{
         docId: string;
@@ -9379,6 +10011,18 @@ declare class Collection<T> {
      * fields when a locale is requested.
      */
     private readonly dictKeyFields;
+    /**
+     * Money field descriptors keyed by field path. Declared via the
+     * `moneyFields` collection option: `put()` quantizes to a scaled-int
+     * string, `get()`/`list()` decode back. Mutable so {@link _applyMoneyFields}
+     * can attach descriptors to a collection MV-analysis pre-created.
+     */
+    private moneyFields;
+    /**
+     * Computed scalar fields, evaluated first on every `put()`. Mutable for
+     * the same MV-pre-creation reconcile as {@link moneyFields}.
+     */
+    private computed;
     /**
      * Async callback provided by the Vault that resolves a dict key
      * to its label for a given locale. Used by the locale-read path for
@@ -9620,6 +10264,8 @@ declare class Collection<T> {
         i18nFields?: Record<string, I18nTextDescriptor> | undefined;
         /** — dictKey field descriptors for label resolution on reads. */
         dictKeyFields?: Record<string, DictKeyDescriptor> | undefined;
+        moneyFields?: Record<string, MoneyDescriptor> | undefined;
+        computed?: ComputedFields | undefined;
         /**
          * async callback that resolves a dict key to its label
          * for a given locale. Provided by the Vault.
@@ -9778,6 +10424,15 @@ declare class Collection<T> {
      * reference — callers must treat it as immutable.
      */
     getSchema(): StandardSchemaV1<unknown, T> | undefined;
+    /**
+     * @internal — attach money descriptors post-construction. MV dependency
+     * analysis auto-creates a source collection (without options) during
+     * `openVault`, before the user's `collection(name, { moneyFields })`
+     * declaration; this reconciles that ordering. First-wins. Not public.
+     */
+    _applyMoneyFields(moneyFields: Record<string, MoneyDescriptor>): void;
+    /** @internal — attach computed fields post-construction. See {@link _applyMoneyFields}. */
+    _applyComputed(computed: ComputedFields): void;
     /**
      * Get a single record by ID.
      *
@@ -9943,6 +10598,12 @@ declare class Collection<T> {
      *                each record is locale-resolved before being returned.
      */
     list(locale?: LocaleReadOptions): Promise<T[]>;
+    /**
+     * @internal — whether any read-side record transform is registered
+     * (money decode, i18nText resolution, dictKey labels). Gates the
+     * no-transform fast path in {@link list}.
+     */
+    private hasReadTransforms;
     /**
      * Put many records in one call. Each item is processed sequentially
      * through the normal `put()` path — meaning per-item validation,
@@ -11180,6 +11841,12 @@ interface NoydbStore {
      * involved when something goes wrong.
      */
     name?: string;
+    /**
+     * Optional declared store capabilities (CAS atomicity, native tx, blob
+     * size limits, auth). Consumers that require a capability — e.g.
+     * `vault.sequence().next()` needs `casAtomic` — read it here.
+     */
+    capabilities?: StoreCapabilities;
     /** Get a single record. Returns null if not found. */
     get(vault: string, collection: string, id: string): Promise<EncryptedEnvelope | null>;
     /** Put a record. Throws ConflictError if expectedVersion doesn't match. */
@@ -11194,6 +11861,12 @@ interface NoydbStore {
     saveAll(vault: string, data: VaultSnapshot): Promise<void>;
     /** Optional connectivity check for sync engine. */
     ping?(): Promise<boolean>;
+    /**
+     * The store's authoritative time as a bounded-uncertainty interval.
+     * Present iff `capabilities.serverWriteTime` is true. Monotonic
+     * non-decreasing across calls on a single store.
+     */
+    getStoreTime?(): Promise<StoreTime>;
     /**
      * Optional: list record IDs in a collection that have `_ts` after `since`.
      * Used by partial sync (`pull({ modifiedSince })`). Stores that omit this
@@ -12397,6 +13070,17 @@ interface StoreAuth {
     required: boolean;
     flow: 'static' | 'oauth' | 'kerberos' | 'implicit';
 }
+/**
+ * The store's authoritative clock as a bounded-uncertainty interval
+ * (Spanner TrueTime model). True time is provably within [earliest, latest];
+ * `latest - earliest` is the clock-uncertainty bound ε. Used by deferred
+ * numbering to order records by store-commit-time and to commit-wait. Never
+ * the client wall clock.
+ */
+interface StoreTime {
+    readonly earliest: number;
+    readonly latest: number;
+}
 interface StoreCapabilities {
     /**
      * true — the store's expectedVersion check and write are atomic at the
@@ -12405,6 +13089,13 @@ interface StoreCapabilities {
      * false — check and write are separate operations with a race window.
      */
     casAtomic: boolean;
+    /**
+     * true — the store exposes an authoritative {@link NoydbStore.getStoreTime}
+     * clock and records are ordered by store-commit-time. Required for
+     * `withDeferredNumbering`. Absent/false — the store cannot back deferred
+     * numbering (use CAS `sequence().next()` or per-series).
+     */
+    serverWriteTime?: boolean;
     auth: StoreAuth;
     /**
      * true — the store implements {@link NoydbStore.tx} and commits
@@ -12437,6 +13128,12 @@ interface NoydbOptions {
      * @internal
      */
     readonly blobStrategy?: BlobStrategy;
+    /**
+     * Cold-storage archival target. `withArchive({ store })` designates a
+     * second store that holds archived record envelopes. Enables
+     * `vault.archive()` / `vault.restore()` / `vault.listArchived()`.
+     */
+    readonly archiveStrategy?: ArchiveStrategy;
     /**
      * tree-shake seam — optional indexing strategy. Pass
      * `withIndexing()` from `@noy-db/hub/indexing` to enable eager-mode
@@ -12573,6 +13270,12 @@ interface NoydbOptions {
      * in registration order on `collection.put()`.
      */
     readonly guardStrategies?: ReadonlyArray<GuardStrategyHandleAny>;
+    /**
+     * Deferred-numbering series declared via `withDeferredNumbering(...)`.
+     * `vault.sequence(series).next({ for })` then assigns gap-free serials at a
+     * numbering pass (`vault.runNumberingPass(series)`) instead of via CAS.
+     */
+    readonly numbering?: ReadonlyArray<DeferredNumberingConfig>;
     /**
      * Optional derivation strategies — source-to-output projections that
      * fire on `collection.put()`. Each handle is the output of
@@ -12871,4 +13574,4 @@ interface DeleteManyResult {
     }>;
 }
 
-export { type ExportBlobsAuditEntry as $, BLOB_COLLECTION as A, type BlobStrategy as B, BLOB_EVICTION_AUDIT_COLLECTION as C, DICT_COLLECTION_PREFIX as D, BLOB_INDEX_COLLECTION as E, BLOB_SLOTS_PREFIX as F, BLOB_VERSIONS_PREFIX as G, type BlobEvictionEntry as H, type I18nStrategy as I, type BlobFieldPolicy as J, type BlobFieldsConfig as K, type Layer as L, type BlobObject as M, type BlobPutOptions as N, type OnMissing as O, PolicyEnforcer as P, type BlobResponseOptions as Q, type ResolveI18nOptions as R, type ScriptWarning as S, BlobSet as T, type BlobStrategyOpenArgs as U, type CompactRunOptions as V, type CompactionContext as W, type CompactionResult as X, DEFAULT_CHUNK_SIZE as Y, EXPORT_AUDIT_COLLECTION as Z, ExportBlobsAbortedError as _, type DictEntry as a, type SyncStrategy as a$, type ExportBlobsHandle as a0, type ExportBlobsOptions as a1, type ExportedBlob as a2, type SlotInfo as a3, type SlotRecord as a4, type VersionRecord as a5, createExportBlobsHandle as a6, runCompaction as a7, type ConsentStrategy as a8, CONSENT_AUDIT_COLLECTION as a9, VaultFrame as aA, type NoydbBundleStore as aB, type RetentionPolicy as aC, type SnapshotPolicy as aD, type SnapshotStrategy as aE, type SnapshotMeta as aF, type SnapshotMode as aG, type TxStrategy as aH, type AmendmentTxOptions as aI, TxCollection as aJ, TxContext as aK, TxVault as aL, runTransaction as aM, type DerivationStrategy as aN, type DerivationContext as aO, type ArrayOutputSpec as aP, DerivationRegistry as aQ, type DerivationStrategyHandle as aR, type DerivedFromMeta as aS, type OutputSpec as aT, type RecordOutputSpec as aU, type MaterializedViewStrategy as aV, type MaterializedViewStrategyHandle as aW, type OverlayedViewStrategy as aX, Collection as aY, OverlayedViewRegistry as aZ, type OverlayedViewStrategyHandle as a_, type ConsentAuditEntry as aa, type ConsentAuditFilter as ab, type ConsentContext as ac, type ConsentOp as ad, loadConsentEntries as ae, writeConsentEntry as af, type PeriodsStrategy as ag, type CarryForwardContext as ah, type ClosePeriodOptions as ai, type OpenPeriodOptions as aj, PERIODS_COLLECTION as ak, type PeriodRecord as al, type ReadOnlyCollection as am, appendPeriodLedgerEntry as an, assertTsWritable as ao, chainAnchor as ap, loadPeriods as aq, validatePeriodName as ar, type GuardStrategy as as, type GuardChange as at, type GuardContext as au, GuardRegistry as av, type GuardStrategyHandle as aw, ReadOnlyVaultFacade as ax, type ShadowStrategy as ay, CollectionFrame as az, type DictKeyDescriptor as b, type CollectionStats as b$, type Role as b0, type UnlockedKeyring as b1, type HistoryStrategy as b2, type NoydbStore as b3, type HistoryOptions as b4, type EncryptedEnvelope as b5, type PruneOptions as b6, type AppendInput as b7, type ChangeType as b8, CollectionInstant as b9, type RegisteredMV as bA, MaterializedViewRegistry as bB, type MaterializedFromMeta as bC, type MaterializedViewOutput as bD, type UnionSource as bE, type UserEnvelope as bF, type GateName as bG, type GatePolicy as bH, type VaultPolicy as bI, type ActiveTier as bJ, type FactorProof as bK, type SchemaUpdateStrategy as bL, type TransformFn as bM, type PersistedSchemaEnvelope as bN, type UpdateDecision as bO, type DirectoryConfig as bP, type UserVisibility as bQ, type AccessibleVault as bR, type AffectedDocument as bS, BUNDLE_STORE_POLICY as bT, type BuiltInGateName as bU, type CacheOptions as bV, type CacheStats as bW, type ChangeEvent as bX, type CollectionChangeEvent as bY, type CollectionConflictResolver as bZ, type CollectionDescriptor as b_, type DiffEntry as ba, type JsonPatch as bb, type JsonPatchOp as bc, type LedgerEntry as bd, LedgerStore as be, type VaultEngine as bf, VaultInstant as bg, type VerifyResult as bh, applyPatch as bi, canonicalJson as bj, computePatch as bk, diff as bl, formatDiff as bm, hashEntry as bn, paddedIndex as bo, parseIndex as bp, sha256Hex as bq, type PublicEnvelope as br, type SealingKeyProvider as bs, type BundleRecipient as bt, type RecipientSealer as bu, type RecipientHint as bv, Vault as bw, type RecoveryEnrollmentInput as bx, type ShamirRecoveryProvider as by, type MVQueryContext as bz, DictionaryHandle as c, NOYDB_BACKUP_VERSION as c$, type Conflict as c0, type ConflictPolicy as c1, type ConflictStrategy as c2, type CrossTierAccessEvent as c3, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as c4, DELEGATIONS_COLLECTION as c5, type DeepPartial as c6, type DeepPartialOrNull as c7, type DelegationToken as c8, type DeleteManyResult as c9, type HistoryEntry as cA, INDEXED_STORE_POLICY as cB, type ImportCapability as cC, type InferOutput as cD, type InternalCollectionStats as cE, type IssueDelegationOptions as cF, type IssueMagicLinkGrantOptions as cG, type KeyringAuthenticator as cH, type KeyringAuthenticatorWrappingDEKs as cI, type KeyringAuthenticatorWrappingKEK as cJ, type KeyringFile as cK, type ListAccessibleVaultsOptions as cL, type ListPageResult as cM, type ListUsersOptions as cN, type LiveUserEnvelope as cO, type LocaleReadOptions as cP, Lru as cQ, type LruOptions as cR, type LruStats as cS, MAGIC_LINK_CONTENT_INFO_PREFIX as cT, MAGIC_LINK_GRANTS_COLLECTION as cU, MAGIC_LINK_KEK_INFO_PREFIX as cV, type MagicLinkGrantPayload as cW, type MagicLinkGrantRecord as cX, type MaterializedViewDescriptor as cY, MemoryRecipientSealer as cZ, MemorySealingKeyProvider as c_, type DerivationDescriptor as ca, type DirtyEntry as cb, type DryRunResult as cc, type DumpSchemaOptions as cd, ELEVATION_AUDIT_COLLECTION as ce, ElevatedHandle as cf, type EnrollAuthenticatorOptions as cg, type EnrollAuthenticatorWrappingDEKsOptions as ch, type EnrollAuthenticatorWrappingKEKOptions as ci, type EnrollRecoveryResult as cj, type ExportCapability as ck, type ExportChunk as cl, type ExportFormat as cm, type ExportStreamOptions as cn, type FactorKind as co, type FactorProofBundle as cp, type FactorRequirement as cq, type FenceDoc as cr, type FenceState as cs, type FieldChange as ct, type FieldDescriptor as cu, type FieldSource as cv, type GhostRecord as cw, type GrantOptions as cx, type GuardViolation as cy, type HistoryConfig as cz, type DictionaryOptions as d, type StoreAuthKind as d$, NOYDB_FORMAT_VERSION as d0, NOYDB_KEYRING_VERSION as d1, NOYDB_SYNC_VERSION as d2, Noydb as d3, type NoydbEventMap as d4, type NoydbOptions as d5, type OverlayViewDescriptor as d6, PUBLIC_ENVELOPE_FIELDS as d7, type PaperRecoveryDoc as d8, type PaperRecoveryEntry as d9, type QuickUnlockState as dA, QuickUnlockStore as dB, type ReAuthOperation as dC, type RecoverPassphraseInput as dD, type RecoverPassphraseResult as dE, type RecoverUserOptions as dF, type RecoveryProof as dG, type ResolvedPublicEnvelopeSchema as dH, type RevokeOptions as dI, type RotatePassphraseInput as dJ, type RotateRecoveryOptions as dK, type RotateRecoveryResult as dL, SEALED_PASSPHRASE_RECORD_ID as dM, type SchemaDelta as dN, type SchemaIntrospection as dO, type SealedEnvelope as dP, type SealedPassphrase as dQ, type SessionPolicy as dR, type SetPublicEnvelopeInput as dS, type ShamirRecoveryDoc as dT, type ShamirRecoveryEntry as dU, type SlotRewrapCeremony as dV, type SlotRewrapContext as dW, type StandardSchemaV1 as dX, type StandardSchemaV1Issue as dY, type StandardSchemaV1SyncResult as dZ, type StoreAuth as d_, type PassphrasePolicy as da, type PassphraseValidationResult as db, type Permission as dc, type Permissions as dd, type PersistedSchemaKind as de, type PlaintextTranslatorContext as df, type PlaintextTranslatorFn as dg, PresenceHandle as dh, type PresencePeer as di, type PublicEnvelopeField as dj, type PublicEnvelopeSchema as dk, type PublicEnvelopeText as dl, type PullMode as dm, type PullOptions as dn, type PullPolicy as dp, type PullResult as dq, type PushMode as dr, type PushOptions as ds, type PushPolicy as dt, type PushResult as du, type PutManyItemOptions as dv, type PutManyOptions as dw, type PutManyResult as dx, type QueryAcrossOptions as dy, type QueryAcrossResult as dz, type I18nMap as e, listUsersWithEnvelopes as e$, type StoreCapabilities as e0, SyncEngine as e1, type SyncMetadata as e2, type SyncPolicy as e3, SyncScheduler as e4, type SyncSchedulerStatus as e5, type SyncStatus as e6, type SyncTarget as e7, type SyncTargetRole as e8, SyncTransaction as e9, type WeakPassphraseReason as eA, type WrappedDeksBlob as eB, type WriteConflict as eC, type WriteEvent as eD, type WriteHook as eE, type WriteQueue as eF, assertStrongPassphrase as eG, buildRecipientKeyringFile as eH, burnPaperRecoveryEntry as eI, createNoydb as eJ, createStore as eK, deriveMagicLinkContentKey as eL, enrollAuthenticator as eM, estimateEntropy as eN, evaluateExportCapability as eO, evaluateImportCapability as eP, findAuthenticator as eQ, hasExportCapability as eR, hasImportCapability as eS, hasRecoveryEnrolled as eT, isMagicLinkGrantExpired as eU, isPublicEnvelope as eV, issueDelegation as eW, recoverPassphrase as eX, rotatePassphrase as eY, listMagicLinkGrants as eZ, listUsers as e_, type SyncTransactionResult as ea, type TabChannel as eb, type TabCoordinationOptions as ec, type TabLockManager as ed, type TabPresence as ee, type TabRole as ef, type TierMode as eg, type TranslatorAuditEntry as eh, type TxOp as ei, USER_ENVELOPE_COLLECTION as ej, USER_ENVELOPE_MAX_BYTES as ek, type Unsubscribe as el, type UpdateAuthenticatorOptions as em, type UpdateContext as en, type UpdateUserOptions as eo, UserApi as ep, type UserEnvelopeCheckGate as eq, UserEnvelopeOversizedError as er, type UserEnvelopePresented as es, type UserInfo as et, type VaultBackup as eu, type VaultPolicyOnDisk as ev, type VaultSchemaSnapshot as ew, type VaultSnapshot as ex, type WarningRules as ey, WeakPassphraseError as ez, type I18nTextDescriptor as f, loadActiveDelegations as f0, loadPaperRecoveryEntries as f1, loadSealedPassphrase as f2, loadShamirRecoveryEntries as f3, magicLinkGrantRecordId as f4, mintPaperRecoveryEntry as f5, mintShamirRecoveryEntry as f6, mintWrappedDeksBlob as f7, parseSealedEnvelope as f8, readMagicLinkGrantRecord as f9, recoverUser as fa, removeAuthenticator as fb, resolveSchema as fc, revokeDelegation as fd, revokeMagicLinkGrant as fe, savePaperRecoveryEntries as ff, saveSealedPassphrase as fg, saveShamirRecoveryEntries as fh, unwrapDeksFromBlob as fi, unwrapDeksFromPaperEntry as fj, unwrapDeksFromShamirEntry as fk, unwrapMagicLinkGrant as fl, validatePassphrase as fm, validatePublicEnvelopeInput as fn, validateSchemaInput as fo, validateSchemaOutput as fp, writeMagicLinkGrant as fq, changeSecret as fr, createOwnerKeyring as fs, ensureCollectionDEK as ft, grant as fu, loadKeyring as fv, persistKeyring as fw, revoke as fx, updateAuthenticator as fy, updateKeyringIdentity as fz, type I18nTextOptions as g, type OnMissingPolicy as h, applyI18nLocale as i, dictCollectionName as j, dictKey as k, enforceScript as l, getAtPath as m, i18nText as n, inferScripts as o, isDictCollectionName as p, isDictKeyDescriptor as q, isI18nTextDescriptor as r, resolveI18nText as s, resolvePolicy as t, setAtPathInPlace as u, validateI18nTextValue as v, type SessionStrategy as w, createEnforcer as x, validateSessionPolicy as y, BLOB_CHUNKS_COLLECTION as z };
+export { type ExportBlobsAuditEntry as $, BLOB_COLLECTION as A, type BlobStrategy as B, BLOB_EVICTION_AUDIT_COLLECTION as C, DICT_COLLECTION_PREFIX as D, BLOB_INDEX_COLLECTION as E, BLOB_SLOTS_PREFIX as F, BLOB_VERSIONS_PREFIX as G, type BlobEvictionEntry as H, type I18nStrategy as I, type BlobFieldPolicy as J, type BlobFieldsConfig as K, type Layer as L, type BlobObject as M, type BlobPutOptions as N, type OnMissing as O, PolicyEnforcer as P, type BlobResponseOptions as Q, type ResolveI18nOptions as R, type ScriptWarning as S, BlobSet as T, type BlobStrategyOpenArgs as U, type CompactRunOptions as V, type CompactionContext as W, type CompactionResult as X, DEFAULT_CHUNK_SIZE as Y, EXPORT_AUDIT_COLLECTION as Z, ExportBlobsAbortedError as _, type DictEntry as a, type SyncStrategy as a$, type ExportBlobsHandle as a0, type ExportBlobsOptions as a1, type ExportedBlob as a2, type SlotInfo as a3, type SlotRecord as a4, type VersionRecord as a5, createExportBlobsHandle as a6, runCompaction as a7, type ConsentStrategy as a8, CONSENT_AUDIT_COLLECTION as a9, VaultFrame as aA, type NoydbBundleStore as aB, type RetentionPolicy as aC, type SnapshotPolicy as aD, type SnapshotStrategy as aE, type SnapshotMeta as aF, type SnapshotMode as aG, type TxStrategy as aH, type AmendmentTxOptions as aI, TxCollection as aJ, TxContext as aK, TxVault as aL, runTransaction as aM, type DerivationStrategy as aN, type DerivationContext as aO, type ArrayOutputSpec as aP, DerivationRegistry as aQ, type DerivationStrategyHandle as aR, type DerivedFromMeta as aS, type OutputSpec as aT, type RecordOutputSpec as aU, type MaterializedViewStrategy as aV, type MaterializedViewStrategyHandle as aW, type OverlayedViewStrategy as aX, Collection as aY, OverlayedViewRegistry as aZ, type OverlayedViewStrategyHandle as a_, type ConsentAuditEntry as aa, type ConsentAuditFilter as ab, type ConsentContext as ac, type ConsentOp as ad, loadConsentEntries as ae, writeConsentEntry as af, type PeriodsStrategy as ag, type CarryForwardContext as ah, type ClosePeriodOptions as ai, type OpenPeriodOptions as aj, PERIODS_COLLECTION as ak, type PeriodRecord as al, type ReadOnlyCollection as am, appendPeriodLedgerEntry as an, assertTsWritable as ao, chainAnchor as ap, loadPeriods as aq, validatePeriodName as ar, type GuardStrategy as as, type GuardChange as at, type GuardContext as au, GuardRegistry as av, type GuardStrategyHandle as aw, ReadOnlyVaultFacade as ax, type ShadowStrategy as ay, CollectionFrame as az, type DictKeyDescriptor as b, type CapturedBlueprint as b$, type Role as b0, type UnlockedKeyring as b1, type HistoryStrategy as b2, type NoydbStore as b3, type HistoryOptions as b4, type EncryptedEnvelope as b5, type PruneOptions as b6, type AppendInput as b7, type ChangeType as b8, CollectionInstant as b9, type RegisteredMV as bA, MaterializedViewRegistry as bB, type MaterializedFromMeta as bC, type MaterializedViewOutput as bD, type UnionSource as bE, type UserEnvelope as bF, type GateName as bG, type GatePolicy as bH, type VaultPolicy as bI, type ActiveTier as bJ, type FactorProof as bK, type SchemaUpdateStrategy as bL, type TransformFn as bM, type PersistedSchemaEnvelope as bN, type UpdateDecision as bO, type DirectoryConfig as bP, type UserVisibility as bQ, type AccessibleVault as bR, type AffectedDocument as bS, type ArchivePolicy as bT, type ArchiveResult as bU, type ArchiveRunOptions as bV, type ArchiveStrategy as bW, BUNDLE_STORE_POLICY as bX, type BuiltInGateName as bY, type CacheOptions as bZ, type CacheStats as b_, type DiffEntry as ba, type JsonPatch as bb, type JsonPatchOp as bc, type LedgerEntry as bd, LedgerStore as be, type VaultEngine as bf, VaultInstant as bg, type VerifyResult as bh, applyPatch as bi, canonicalJson as bj, computePatch as bk, diff as bl, formatDiff as bm, hashEntry as bn, paddedIndex as bo, parseIndex as bp, sha256Hex as bq, type PublicEnvelope as br, type SealingKeyProvider as bs, type BundleRecipient as bt, type RecipientSealer as bu, type RecipientHint as bv, Vault as bw, type RecoveryEnrollmentInput as bx, type ShamirRecoveryProvider as by, type MVQueryContext as bz, DictionaryHandle as c, type KeyringFile as c$, type ChangeEvent as c0, type CollectionChangeEvent as c1, type CollectionConflictResolver as c2, type CollectionDescriptor as c3, type CollectionStats as c4, ComputedFieldError as c5, type ComputedFields as c6, type ComputedFn as c7, type Conflict as c8, type ConflictPolicy as c9, type ExportChunk as cA, type ExportFormat as cB, type ExportStreamOptions as cC, type FactorKind as cD, type FactorProofBundle as cE, type FactorRequirement as cF, type FanoutQueryOptions as cG, type FanoutResult as cH, type FenceDoc as cI, type FenceState as cJ, type FieldChange as cK, type FieldDescriptor as cL, type FieldSource as cM, type GhostRecord as cN, type GrantOptions as cO, type GuardViolation as cP, type HistoryConfig as cQ, type HistoryEntry as cR, INDEXED_STORE_POLICY as cS, type ImportCapability as cT, type InferOutput as cU, type InternalCollectionStats as cV, type IssueDelegationOptions as cW, type IssueMagicLinkGrantOptions as cX, type KeyringAuthenticator as cY, type KeyringAuthenticatorWrappingDEKs as cZ, type KeyringAuthenticatorWrappingKEK as c_, type ConflictStrategy as ca, type CrossTierAccessEvent as cb, CrossVaultAggregation as cc, CrossVaultGroupedAggregation as cd, type GroupedRow as ce, type CrossVaultLiveAggregation as cf, type CrossVaultLiveQuery as cg, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as ch, DELEGATIONS_COLLECTION as ci, type DeepPartial as cj, type DeepPartialOrNull as ck, type DeferredNumberingConfig as cl, type DelegationToken as cm, type DeleteManyResult as cn, type DeploymentEvent as co, type DerivationDescriptor as cp, type DirtyEntry as cq, type DryRunResult as cr, type DumpSchemaOptions as cs, ELEVATION_AUDIT_COLLECTION as ct, ElevatedHandle as cu, type EnrollAuthenticatorOptions as cv, type EnrollAuthenticatorWrappingDEKsOptions as cw, type EnrollAuthenticatorWrappingKEKOptions as cx, type EnrollRecoveryResult as cy, type ExportCapability as cz, type DictionaryOptions as d, type ResolvedPublicEnvelopeSchema as d$, type ListAccessibleVaultsOptions as d0, type ListPageResult as d1, type ListUsersOptions as d2, type LiveQueryOptions as d3, type LiveUserEnvelope as d4, type LocaleReadOptions as d5, Lru as d6, type LruOptions as d7, type LruStats as d8, MAGIC_LINK_CONTENT_INFO_PREFIX as d9, type PlaintextTranslatorContext as dA, type PlaintextTranslatorFn as dB, PresenceHandle as dC, type PresencePeer as dD, type PublicEnvelopeField as dE, type PublicEnvelopeSchema as dF, type PublicEnvelopeText as dG, type PullMode as dH, type PullOptions as dI, type PullPolicy as dJ, type PullResult as dK, type PushMode as dL, type PushOptions as dM, type PushPolicy as dN, type PushResult as dO, type PutManyItemOptions as dP, type PutManyOptions as dQ, type PutManyResult as dR, type QueryAcrossOptions as dS, type QueryAcrossResult as dT, type QuickUnlockState as dU, QuickUnlockStore as dV, type ReAuthOperation as dW, type RecoverPassphraseInput as dX, type RecoverPassphraseResult as dY, type RecoverUserOptions as dZ, type RecoveryProof as d_, MAGIC_LINK_GRANTS_COLLECTION as da, MAGIC_LINK_KEK_INFO_PREFIX as db, type MagicLinkGrantPayload as dc, type MagicLinkGrantRecord as dd, type MaterializedViewDescriptor as de, MemoryRecipientSealer as df, MemorySealingKeyProvider as dg, NOYDB_BACKUP_VERSION as dh, NOYDB_FORMAT_VERSION as di, NOYDB_KEYRING_VERSION as dj, NOYDB_SYNC_VERSION as dk, type NextOptions as dl, Noydb as dm, type NoydbEventMap as dn, type NoydbOptions as dp, type Assignment as dq, type OverlayViewDescriptor as dr, PUBLIC_ENVELOPE_FIELDS as ds, type PaperRecoveryDoc as dt, type PaperRecoveryEntry as du, type PassphrasePolicy as dv, type PassphraseValidationResult as dw, type Permission as dx, type Permissions as dy, type PersistedSchemaKind as dz, type I18nMap as e, type VaultPolicyOnDisk as e$, type RevokeOptions as e0, type RotatePassphraseInput as e1, type RotateRecoveryOptions as e2, type RotateRecoveryResult as e3, SEALED_PASSPHRASE_RECORD_ID as e4, type SchemaDelta as e5, type SchemaIntrospection as e6, type SchemaManifestRow as e7, type SealedEnvelope as e8, type SealedPassphrase as e9, type SyncStatus as eA, type SyncTarget as eB, type SyncTargetRole as eC, SyncTransaction as eD, type SyncTransactionResult as eE, type TabChannel as eF, type TabCoordinationOptions as eG, type TabLockManager as eH, type TabPresence as eI, type TabRole as eJ, type TierMode as eK, type TranslatorAuditEntry as eL, type TxOp as eM, USER_ENVELOPE_COLLECTION as eN, USER_ENVELOPE_MAX_BYTES as eO, type Unsubscribe as eP, type UpdateAuthenticatorOptions as eQ, type UpdateContext as eR, type UpdateUserOptions as eS, UserApi as eT, type UserEnvelopeCheckGate as eU, UserEnvelopeOversizedError as eV, type UserEnvelopePresented as eW, type UserInfo as eX, type VaultBackup as eY, VaultGroup as eZ, type VaultGroupOptions as e_, type SequenceHandle as ea, SequenceStore as eb, type SessionPolicy as ec, type SetPublicEnvelopeInput as ed, type ShamirRecoveryDoc as ee, type ShamirRecoveryEntry as ef, ShardedCollection as eg, ShardedGroupedQuery as eh, ShardedQuery as ei, type ShardingConfig as ej, type SkippedVault as ek, type SlotRewrapCeremony as el, type SlotRewrapContext as em, type StandardSchemaV1 as en, type StandardSchemaV1Issue as eo, type StandardSchemaV1SyncResult as ep, StateManagementVault as eq, type StoreAuth as er, type StoreAuthKind as es, type StoreCapabilities as et, type StoreTime as eu, SyncEngine as ev, type SyncMetadata as ew, type SyncPolicy as ex, SyncScheduler as ey, type SyncSchedulerStatus as ez, type I18nTextDescriptor as f, withDeferredNumbering as f$, type VaultRegistryRow as f0, type VaultSchemaSnapshot as f1, type VaultSnapshot as f2, type VaultTemplate as f3, type WarningRules as f4, WeakPassphraseError as f5, type WeakPassphraseReason as f6, type WithArchiveOptions as f7, type WrappedDeksBlob as f8, type WriteConflict as f9, loadActiveDelegations as fA, loadPaperRecoveryEntries as fB, loadSealedPassphrase as fC, loadShamirRecoveryEntries as fD, magicLinkGrantRecordId as fE, mintPaperRecoveryEntry as fF, mintShamirRecoveryEntry as fG, mintWrappedDeksBlob as fH, parseSealedEnvelope as fI, readMagicLinkGrantRecord as fJ, recoverUser as fK, removeAuthenticator as fL, resolveSchema as fM, revokeDelegation as fN, revokeMagicLinkGrant as fO, savePaperRecoveryEntries as fP, saveSealedPassphrase as fQ, saveShamirRecoveryEntries as fR, unwrapDeksFromBlob as fS, unwrapDeksFromPaperEntry as fT, unwrapDeksFromShamirEntry as fU, unwrapMagicLinkGrant as fV, validatePassphrase as fW, validatePublicEnvelopeInput as fX, validateSchemaInput as fY, validateSchemaOutput as fZ, withArchive as f_, type WriteEvent as fa, type WriteHook as fb, type WriteQueue as fc, assertStrongPassphrase as fd, buildRecipientKeyringFile as fe, burnPaperRecoveryEntry as ff, createNoydb as fg, createStore as fh, deriveMagicLinkContentKey as fi, enrollAuthenticator as fj, estimateEntropy as fk, evalComputedFields as fl, evaluateExportCapability as fm, evaluateImportCapability as fn, findAuthenticator as fo, hasExportCapability as fp, hasImportCapability as fq, hasRecoveryEnrolled as fr, isMagicLinkGrantExpired as fs, isPublicEnvelope as ft, issueDelegation as fu, recoverPassphrase as fv, rotatePassphrase as fw, listMagicLinkGrants as fx, listUsers as fy, listUsersWithEnvelopes as fz, type I18nTextOptions as g, writeMagicLinkGrant as g0, changeSecret as g1, createOwnerKeyring as g2, ensureCollectionDEK as g3, grant as g4, loadKeyring as g5, persistKeyring as g6, revoke as g7, updateAuthenticator as g8, updateKeyringIdentity as g9, type OnMissingPolicy as h, applyI18nLocale as i, dictCollectionName as j, dictKey as k, enforceScript as l, getAtPath as m, i18nText as n, inferScripts as o, isDictCollectionName as p, isDictKeyDescriptor as q, isI18nTextDescriptor as r, resolveI18nText as s, resolvePolicy as t, setAtPathInPlace as u, validateI18nTextValue as v, type SessionStrategy as w, createEnforcer as x, validateSessionPolicy as y, BLOB_CHUNKS_COLLECTION as z };