@noy-db/hub 0.2.0-pre.14 → 0.2.0-pre.16

package/dist/{types-BFHQUjdy.d.ts → types-DrmBTscX.d.ts}

@@ -1,8 +1,8 @@
-import { I as IndexStrategy, d as LazyQuery } from './lazy-builder-D5GU14TS.js';
-import { a7 as NoydbError, o as LiveAggregation, f as AggregateSpec, e as AggregateResult, A as AggregateStrategy, au as MoneyDescriptor } from './strategy-CrS7PnbE.js';
+import { I as IndexStrategy, d as LazyQuery } from './lazy-builder-ChSqcF5t.js';
+import { a7 as NoydbError, o as LiveAggregation, f as AggregateSpec, e as AggregateResult, av as MoneyDescriptor, A as AggregateStrategy } from './strategy-BtW8fAjz.js';
 import { C as CrdtStrategy, a as CrdtMode, b as CrdtState } from './strategy-BSxFXGzb.js';
-import { L as LiveQuery, Q as Query, c as JoinStrategy, j as RefRegistry, R as RefDescriptor, d as JoinableSource, l as RefViolation, S as ScanBuilder } from './index-Cqzp4tt9.js';
-import { I as IndexDef, O as Operator, F as FieldClause, C as CollectionIndexes } from './predicate-Bt5ft-9c.js';
+import { L as LiveQuery, Q as Query, c as JoinStrategy, j as RefRegistry, R as RefDescriptor, d as JoinableSource, l as RefViolation, S as ScanBuilder } from './index-nP99bXLg.js';
+import { I as IndexDef, O as Operator, F as FieldClause, C as CollectionIndexes } from './predicate-BmhBSPCH.js';
 import { AttestationFieldSchema, RevocationList } from '@noy-db/attestation';
 
 /**
@@ -2972,9 +2972,18 @@ interface GatePutEvent {
     readonly vault: string;
     readonly collection: string;
     readonly docId: string;
-    /** The record about to be written (pre schema-validation). */
+    /**
+     * The record about to be written (pre schema-validation). Money fields
+     * are presented in their canonical decoded form (#332) — equal on both
+     * sides for an unchanged value, regardless of how the caller wrote them.
+     */
     readonly incoming: unknown;
-    /** Decrypted prior record, or null on create / when prior is unreadable. */
+    /**
+     * Decrypted prior record, or null on create / when prior is unreadable.
+     * Money fields are decoded to the canonical decimal `get()` shape, NOT
+     * the stored scaled-int (#332) — `incoming[f] === existing[f]` holds
+     * for an unchanged money field.
+     */
     readonly existing: unknown;
     /** Prior envelope version, or 0 when none. */
     readonly existingVersion: number;
@@ -2998,6 +3007,7 @@ interface GateDeleteEvent {
     readonly docId: string;
     /** True for system-internal (housekeeping) deletes — handlers branch on this. */
     readonly internal: boolean;
+    /** Decrypted prior record; money fields decoded to the canonical `get()` shape (#332). */
     readonly existing: unknown;
     readonly existingVersion: number;
     readonly existingTs: string | undefined;
@@ -4893,6 +4903,208 @@ interface SnapshotStrategy {
     readonly policy?: SnapshotPolicy;
 }
 
+/**
+ * Minimum read surface exposed to guard `check` functions. Intentionally
+ * narrow — guards can read other collections but never write.
+ *
+ * `query()` returns the same chainable builder used elsewhere. `Query<T>`
+ * has no write terminals (no `.update()` / `.delete()`) so exposing it
+ * here preserves the read-only contract while letting guards aggregate
+ * with `.where().aggregate()` / `.groupBy()` / `.join()` instead of
+ * decrypting every sibling row via `.list()`.
+ */
+interface ReadOnlyVaultFacade$1 {
+    collection<T = unknown>(name: string): {
+        get(id: string): Promise<T | null>;
+        list(): Promise<T[]>;
+        query(): Query<T>;
+    };
+}
+/**
+ * Runtime context passed to `check` and `invariant` callbacks.
+ * `existing` is the currently-persisted record (null for inserts).
+ */
+interface GuardContext<T> {
+    existing: T | null;
+    vault: ReadOnlyVaultFacade$1;
+    userId: string;
+    role: Role;
+}
+/**
+ * One {before, after} pair handed to an `invariant` function. `before`
+ * is null for inserts; `after` reflects the proposed post-commit record.
+ */
+interface GuardChange<T> {
+    before: T | null;
+    after: T;
+}
+/** @internal — output of {@link withGuard}. */
+interface GuardStrategyHandle<T extends Record<string, unknown>> {
+    readonly __noydb_strategy: 'guard';
+    readonly spec: GuardStrategy<T>;
+}
+/**
+ * Existential erasure of `GuardStrategyHandle<T>` — used as the
+ * element type of `ReadonlyArray<>` fields where the per-handle T
+ * differs (e.g. `guardStrategies: [invoiceGuard, disbursementGuard]`).
+ *
+ * Background: `GuardStrategyHandle<T>` is INVARIANT in T because T
+ * appears in callback positions on the spec (`check(incoming: T, ctx)`,
+ * `invariant(changes: ReadonlyArray<GuardChange<T>>, ctx)`). So
+ * `Handle<Invoice>` is not assignable to `Handle<Record<string, unknown>>`.
+ * A bounded existential ("there exists some T satisfying the constraint
+ * such that this is a Handle<T>") is the right shape; TypeScript has
+ * no first-class existentials, so we fake it with a structurally narrow
+ * interface that ERASES T from both the discriminant and the spec.
+ *
+ * Consumers continue to construct typed handles via `withGuard<T>(...)`
+ * which returns `GuardStrategyHandle<T>`. Both `Handle<Invoice>` and
+ * `Handle<Disbursement>` structurally assign to `GuardStrategyHandleAny`,
+ * so an array of them is `GuardStrategyHandleAny[]`.
+ *
+ * Internal code that needs T re-narrows via the runtime discriminant
+ * (`__noydb_strategy === 'guard'`) plus per-handle type information
+ * carried by the registry.
+ *
+ * NOT exported from the public barrel — keeping this internal
+ * discourages consumers from constructing it directly. Used only as
+ * the array-element type on `Vault` / `NoydbOptions.guardStrategies`.
+ *
+ * @internal
+ */
+interface GuardStrategyHandleAny {
+    readonly __noydb_strategy: 'guard';
+    readonly spec: GuardStrategy<any>;
+}
+/** Public registration shape. See `withGuard()`. */
+interface GuardStrategy<T extends Record<string, unknown>> {
+    collection: string;
+    /**
+     * Fires on `Collection.put` (insert + update). The `incoming` argument
+     * is the record being written. Throw to cancel the put.
+     *
+     * Does NOT fire on `Collection.delete` — use {@link onDelete} for
+     * delete-time validation. Skipped during an amendment transaction
+     * (`db.transaction({ amendment: true })`) — admin/owner override.
+     */
+    check?: (incoming: T, ctx: GuardContext<T>) => Promise<void> | void;
+    /**
+     * Fires on user-initiated `Collection.delete` before the adapter
+     * delete and before the ledger append. The `existing` argument is
+     * the currently-persisted record. Throw to cancel the delete — no
+     * partial state, no tombstone ledger entry.
+     *
+     * Skipped during an amendment transaction (admin/owner override) —
+     * amendments are the unlock primitive. To make a delete TRULY
+     * unconditional (e.g. legal-document immutability rules), pair
+     * `onDelete` with an `amendment.invariant` that re-throws on any
+     * `before !== null && after === null` change:
+     *
+     * ```ts
+     * withGuard<Receipt>({
+     *   collection: 'receipts',
+     *   onDelete: () => { throw new RecordLockedError(...) },
+     *   amendment: {
+     *     roles: ['admin', 'owner'],
+     *     invariant: (changes) => {
+     *       for (const c of changes) {
+     *         if (c.before !== null && c.after === null) {
+     *           throw new RecordLockedError(...) // wrapped as InvariantError
+     *         }
+     *       }
+     *     },
+     *   },
+     * })
+     * ```
+     *
+     * Also skipped on system-internal deletes (derivation tombstones,
+     * MV refresh from Dim 14 v2) — those use `_internalDelete`
+     * which bypasses every user-facing delete hook. Housekeeping ops are
+     * NOT user-initiated and should not trip user invariants.
+     *
+     * Delete of an absent record is a no-op and does not consult any
+     * guard, matching the idempotent-delete contract.
+     */
+    onDelete?: (existing: T, ctx: GuardContext<T>) => Promise<void> | void;
+    frozenFields?: {
+        when: (existing: T) => boolean;
+        fields: ReadonlyArray<keyof T>;
+    };
+    amendment?: {
+        roles: ReadonlyArray<'admin' | 'owner'>;
+        invariant: (changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>) => Promise<void> | void;
+    };
+}
+
+/**
+ * Commit-time changeset invariants for ordinary transactions.
+ *
+ * Today the only set-level invariant hook is `amendment.invariant`, which
+ * fires solely inside `db.transaction({ amendment: true }, …)` and requires
+ * an admin/owner role plus a registered guard. That is the right shape for
+ * the WORM-override path, but normal application transactions also need
+ * cross-record invariants that hold on every commit — e.g. niwat's
+ * `assertR1` ("every payment is 100% receipted").
+ *
+ * `withTransactions({ invariants: [...] })` registers such invariants. Each
+ * one names a `scope` (a collection) and a `check(changes, ctx)` callback
+ * that receives the commit's change-set for that collection.
+ *
+ * ## Semantics
+ *
+ * - **`scope`** is a collection name. An invariant fires only when the
+ *   committed transaction wrote at least one record in that collection.
+ * - **When** — at commit, AFTER Phase 2 has executed all staged ops (so
+ *   `after` reflects the written record), and after the amendment commit
+ *   phase. It runs for BOTH ordinary and amendment transactions — an
+ *   amendment is still a commit and is still subject to these invariants.
+ * - **`changes`** — one `{ before, after }` pair per touched id (deduped to
+ *   the last write per id, preserving write order). `before` is the
+ *   plaintext prior record (captured in Phase 1 before the overwrite),
+ *   `null` for an insert. `after` is the written record, `null` for a
+ *   delete.
+ * - **Throw → revert.** A throw reverts every executed op (via the shared
+ *   `revertExecuted` unwind) and is surfaced as `InvariantError` (an
+ *   `InvariantError` thrown by the check passes through unwrapped).
+ *
+ * ```ts
+ * createNoydb({ txStrategy: withTransactions({
+ *   invariants: [{
+ *     scope: 'payments',
+ *     check(changes) {
+ *       for (const { after } of changes) {
+ *         const p = after as Payment | null
+ *         if (p && p.receiptAmount !== p.amount) {
+ *           throw new InvariantError('R1: payment not fully receipted')
+ *         }
+ *       }
+ *     },
+ *   }],
+ * }) })
+ * ```
+ */
+
+/**
+ * A commit-time set-level invariant for ordinary (and amendment)
+ * transactions. See module docs for full semantics.
+ */
+interface TransactionInvariant {
+    /**
+     * The collection this invariant watches. The `check` fires only when the
+     * committed transaction wrote at least one record in this collection.
+     */
+    readonly scope: string;
+    /**
+     * Validate the change-set for {@link scope}. `changes` carries one
+     * `{ before, after }` pair per touched id (deduped to last-write,
+     * write-order preserved); `before` is the plaintext prior record (null
+     * on insert), `after` is the written record (null on delete). Throw to
+     * revert the whole transaction — the throw is surfaced as
+     * `InvariantError`.
+     */
+    check: (changes: ReadonlyArray<GuardChange<unknown>>, ctx: GuardContext<unknown>) => Promise<void> | void;
+}
+
 /**
  * Multi-record atomic transactions.
  *
@@ -5078,7 +5290,7 @@ declare class TxCollection<T> {
  * helper) so nested side-effect derivation writes get registered for
  * revert alongside the bulk-put source ops.
  */
-declare function runTransaction<T>(db: Noydb, fn: (tx: TxContext) => Promise<T> | T, options?: AmendmentTxOptions): Promise<T>;
+declare function runTransaction<T>(db: Noydb, fn: (tx: TxContext) => Promise<T> | T, options?: AmendmentTxOptions, txInvariants?: ReadonlyArray<TransactionInvariant>): Promise<T>;
 
 /**
  * Dry-run transactions. Runs the tx body to STAGE ops, then builds
@@ -6643,139 +6855,6 @@ declare function loadActiveDelegations(store: NoydbStore, vault: string, user: U
  */
 declare function revokeDelegation(store: NoydbStore, vault: string, id: string): Promise<void>;
 
-/**
- * Minimum read surface exposed to guard `check` functions. Intentionally
- * narrow — guards can read other collections but never write.
- *
- * `query()` returns the same chainable builder used elsewhere. `Query<T>`
- * has no write terminals (no `.update()` / `.delete()`) so exposing it
- * here preserves the read-only contract while letting guards aggregate
- * with `.where().aggregate()` / `.groupBy()` / `.join()` instead of
- * decrypting every sibling row via `.list()`.
- */
-interface ReadOnlyVaultFacade$1 {
-    collection<T = unknown>(name: string): {
-        get(id: string): Promise<T | null>;
-        list(): Promise<T[]>;
-        query(): Query<T>;
-    };
-}
-/**
- * Runtime context passed to `check` and `invariant` callbacks.
- * `existing` is the currently-persisted record (null for inserts).
- */
-interface GuardContext<T> {
-    existing: T | null;
-    vault: ReadOnlyVaultFacade$1;
-    userId: string;
-    role: Role;
-}
-/**
- * One {before, after} pair handed to an `invariant` function. `before`
- * is null for inserts; `after` reflects the proposed post-commit record.
- */
-interface GuardChange<T> {
-    before: T | null;
-    after: T;
-}
-/** @internal — output of {@link withGuard}. */
-interface GuardStrategyHandle<T extends Record<string, unknown>> {
-    readonly __noydb_strategy: 'guard';
-    readonly spec: GuardStrategy<T>;
-}
-/**
- * Existential erasure of `GuardStrategyHandle<T>` — used as the
- * element type of `ReadonlyArray<>` fields where the per-handle T
- * differs (e.g. `guardStrategies: [invoiceGuard, disbursementGuard]`).
- *
- * Background: `GuardStrategyHandle<T>` is INVARIANT in T because T
- * appears in callback positions on the spec (`check(incoming: T, ctx)`,
- * `invariant(changes: ReadonlyArray<GuardChange<T>>, ctx)`). So
- * `Handle<Invoice>` is not assignable to `Handle<Record<string, unknown>>`.
- * A bounded existential ("there exists some T satisfying the constraint
- * such that this is a Handle<T>") is the right shape; TypeScript has
- * no first-class existentials, so we fake it with a structurally narrow
- * interface that ERASES T from both the discriminant and the spec.
- *
- * Consumers continue to construct typed handles via `withGuard<T>(...)`
- * which returns `GuardStrategyHandle<T>`. Both `Handle<Invoice>` and
- * `Handle<Disbursement>` structurally assign to `GuardStrategyHandleAny`,
- * so an array of them is `GuardStrategyHandleAny[]`.
- *
- * Internal code that needs T re-narrows via the runtime discriminant
- * (`__noydb_strategy === 'guard'`) plus per-handle type information
- * carried by the registry.
- *
- * NOT exported from the public barrel — keeping this internal
- * discourages consumers from constructing it directly. Used only as
- * the array-element type on `Vault` / `NoydbOptions.guardStrategies`.
- *
- * @internal
- */
-interface GuardStrategyHandleAny {
-    readonly __noydb_strategy: 'guard';
-    readonly spec: GuardStrategy<any>;
-}
-/** Public registration shape. See `withGuard()`. */
-interface GuardStrategy<T extends Record<string, unknown>> {
-    collection: string;
-    /**
-     * Fires on `Collection.put` (insert + update). The `incoming` argument
-     * is the record being written. Throw to cancel the put.
-     *
-     * Does NOT fire on `Collection.delete` — use {@link onDelete} for
-     * delete-time validation. Skipped during an amendment transaction
-     * (`db.transaction({ amendment: true })`) — admin/owner override.
-     */
-    check?: (incoming: T, ctx: GuardContext<T>) => Promise<void> | void;
-    /**
-     * Fires on user-initiated `Collection.delete` before the adapter
-     * delete and before the ledger append. The `existing` argument is
-     * the currently-persisted record. Throw to cancel the delete — no
-     * partial state, no tombstone ledger entry.
-     *
-     * Skipped during an amendment transaction (admin/owner override) —
-     * amendments are the unlock primitive. To make a delete TRULY
-     * unconditional (e.g. legal-document immutability rules), pair
-     * `onDelete` with an `amendment.invariant` that re-throws on any
-     * `before !== null && after === null` change:
-     *
-     * ```ts
-     * withGuard<Receipt>({
-     *   collection: 'receipts',
-     *   onDelete: () => { throw new RecordLockedError(...) },
-     *   amendment: {
-     *     roles: ['admin', 'owner'],
-     *     invariant: (changes) => {
-     *       for (const c of changes) {
-     *         if (c.before !== null && c.after === null) {
-     *           throw new RecordLockedError(...) // wrapped as InvariantError
-     *         }
-     *       }
-     *     },
-     *   },
-     * })
-     * ```
-     *
-     * Also skipped on system-internal deletes (derivation tombstones,
-     * MV refresh from Dim 14 v2) — those use `_internalDelete`
-     * which bypasses every user-facing delete hook. Housekeeping ops are
-     * NOT user-initiated and should not trip user invariants.
-     *
-     * Delete of an absent record is a no-op and does not consult any
-     * guard, matching the idempotent-delete contract.
-     */
-    onDelete?: (existing: T, ctx: GuardContext<T>) => Promise<void> | void;
-    frozenFields?: {
-        when: (existing: T) => boolean;
-        fields: ReadonlyArray<keyof T>;
-    };
-    amendment?: {
-        roles: ReadonlyArray<'admin' | 'owner'>;
-        invariant: (changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>) => Promise<void> | void;
-    };
-}
-
 /**
  * Runtime context handed to `derive(source, ctx)`. Mirrors `GuardContext`'s
  * narrow shape: read-only vault access, no write capability, no
@@ -6876,6 +6955,32 @@ type OutputSpec = RecordOutputSpec | ArrayOutputSpec;
 interface DerivationStrategy<TSource extends Record<string, unknown>, TOutputs extends Record<string, Record<string, unknown>>> {
     /** Source collection name. */
     source: string;
+    /**
+     * Additional collections whose writes ALSO re-fire this derivation
+     * (issue #344). By default only writes to the single declared
+     * `source` re-trigger a derivation; a `derive` that reads sibling
+     * collections via `ctx.vault` therefore goes stale when those
+     * siblings change. Declare those sibling collections here to wire
+     * them as extra triggers.
+     *
+     * **SAME-ID assumption (load-bearing):** when a write lands on one of
+     * these declared collections, the derivation re-fires with the
+     * PRIMARY `source` record read at the SAME id as the written record
+     * — NOT the written sibling record itself. If no primary `source`
+     * record exists at that id, the re-fire is a silent no-op (no throw,
+     * no output mutation). Model your collections so the sibling and the
+     * primary share an id (the common money/accounting case: an
+     * `allocations` row and its `payments`/`bills` keyed by the same id),
+     * or trigger off a collection you control the id-space of.
+     *
+     * Declared collections participate in cycle detection and are indexed
+     * in the registry's `_bySource` exactly like `source`, so a sibling
+     * that is also a derivation output forms a detectable cycle.
+     *
+     * Each entry must be a non-empty string and must not equal `source`
+     * (validated at `withDerivation()` construction time).
+     */
+    sources?: ReadonlyArray<string>;
     /** v1: only deterministic derivations supported. */
     deterministic: true;
     /**
@@ -7043,8 +7148,39 @@ interface UnionSource<TRow extends Record<string, unknown>> {
      * unified stream and never reaches `groupBy` / `aggregate`. This
      * removes the need for sentinel rows (e.g. `{ amount: 0 }`) whose
      * sole purpose is to be aggregated away (#297).
+     *
+     * When this arm declares {@link join}, the aliased right-side
+     * record(s) are attached to the source row under each leg's `as`
+     * BEFORE `map` runs, so `map` can read `sourceRow[leg.as]`.
      */
     readonly map: (sourceRow: Record<string, unknown>) => TRow | null | undefined;
+    /**
+     * Optional FK joins to apply to this arm's rows before {@link map}.
+     * Each leg resolves a `ref()`-declared foreign key on the arm's
+     * source collection into an attached right-side record under
+     * `as` — the same machinery as the query-form `Query.join()`.
+     *
+     * The right-side collections must be listed in the strategy's
+     * {@link MaterializedViewStrategy.sources} so writes to them trigger
+     * MV refresh — registration throws `MaterializedViewConfigError`
+     * otherwise (the union dependency set comes from arm `collection`s
+     * alone, which would not include join targets).
+     */
+    readonly join?: ReadonlyArray<UnionArmJoin>;
+}
+/**
+ * One FK join leg on a UNION arm. Mirrors the option shape of the
+ * query-form `Query.join(field, { as, maxRows?, strategy? })`.
+ */
+interface UnionArmJoin {
+    /** FK field on the arm's source collection (must have a `ref()` declared). */
+    readonly field: string;
+    /** Alias under which the resolved right-side record attaches on the source row. */
+    readonly as: string;
+    /** Per-side row ceiling override. `undefined` → the join default. */
+    readonly maxRows?: number;
+    /** Planner strategy override. `undefined` → auto-select. */
+    readonly strategy?: JoinStrategy;
 }
 /**
  * Registration shape passed to `withMaterializedView()`.
@@ -7083,7 +7219,12 @@ interface MaterializedViewStrategy<TRow extends Record<string, unknown>> {
      *
      * Mutually exclusive with {@link query}. Registration throws
      * `MaterializedViewConfigError` if both are set, if `unionSources`
-     * has fewer than 2 arms, or if two arms name the same `collection`.
+     * is empty, or if two arms name the same `collection`.
+     *
+     * A SINGLE arm is valid (#331): it expresses map→group→aggregate
+     * over one collection with a COMPUTED bucket key (e.g. a month
+     * sliced from a date field). The query form's `.groupBy()` accepts
+     * stored field names only, so a derived key needs the arm's `map`.
      *
      * UNION mode replaces the dependency-analyzer path: the source
      * collections come directly from `unionSources[].collection`, and
@@ -7111,6 +7252,25 @@ interface MaterializedViewStrategy<TRow extends Record<string, unknown>> {
      * UNION-mode only. Ignored if {@link query} is set.
      */
     aggregate?: AggregateSpec;
+    /**
+     * Money descriptors for the UNION-mode aggregate, keyed by the
+     * OUTPUT/intermediate field name as it appears in the mapped row and
+     * in {@link aggregate} (NOT the source collection's field name). When
+     * declared, any `sum` / `min` / `max` over a keyed field is rewritten
+     * into an exact per-currency BigInt reducer — without this, money
+     * aggregation in UNION mode silently runs in float (since the
+     * concatenated mapped stream is a plain array with no collection
+     * money context to inherit).
+     *
+     * UNION-mode only — the query form inherits its money descriptors
+     * from the source collection automatically. The descriptor's
+     * currency/scale must match what the arms' `map()` emits for that
+     * field (each arm maps into the same unified shape, so one descriptor
+     * per output field covers all arms). Meaningless without
+     * {@link aggregate}; registration throws `MaterializedViewConfigError`
+     * if declared alone.
+     */
+    moneyFields?: Record<string, MoneyDescriptor>;
     /**
      * Pure function from a materialized row → stable id used in the
      * output collection. Required — explicit always beats default-with-pitfalls
@@ -7307,6 +7467,50 @@ interface OverlayedViewStrategy {
      */
     shadowField: string;
     shadowValue: unknown;
+    /**
+     * Optional field-level merge mode (AU+032 / #348). When present, a
+     * row whose `shadowField` does NOT equal `shadowValue` is no longer
+     * forced all-base: the rules below let an intermediate status pull a
+     * declared subset of fields from the overlay while every other field
+     * still comes from the base row.
+     *
+     * Absent `mergeMode` preserves the original binary behaviour
+     * exactly — overlay wins entirely iff `shadowField === shadowValue`,
+     * otherwise base wins.
+     */
+    mergeMode?: OverlayFieldMergeMode;
+}
+/**
+ * One field-level merge rule. When the overlay row's `shadowField`
+ * equals `whenStatus`, the merged row takes `overlayFields` from the
+ * overlay and every other field from the base row.
+ *
+ * Always include `shadowField` in `overlayFields` so the status value
+ * itself propagates to the merged read (otherwise the merged row would
+ * carry the base's status, which is usually `undefined`).
+ */
+interface OverlayFieldMergeRule {
+    /** The `overlay[shadowField]` value this rule matches. */
+    readonly whenStatus: unknown;
+    /**
+     * Field names pulled from the overlay row when this rule matches.
+     * Fields absent on the overlay row are skipped (base value kept).
+     */
+    readonly overlayFields: readonly string[];
+}
+/**
+ * Field-level merge configuration. `rules` are evaluated in
+ * declaration order and the FIRST rule whose `whenStatus` matches the
+ * overlay's `shadowField` wins; later rules are not consulted.
+ *
+ * The binary shadow check (`shadowField === shadowValue` → overlay
+ * wins entirely) is always the implicit, highest-priority rule applied
+ * BEFORE any `rules` entry, so adding `mergeMode` never changes the
+ * full-override path.
+ */
+interface OverlayFieldMergeMode {
+    readonly kind: 'field-merge';
+    readonly rules: readonly OverlayFieldMergeRule[];
 }
 /** Returned by `withOverlayedView()` and consumed by `createNoydb`. */
 interface OverlayedViewStrategyHandle {
@@ -7383,11 +7587,53 @@ interface NextOptions {
     /** Deferred mode: reject after this many ms if still unsealed (reserved; not yet enforced in this slice). */
     readonly timeoutMs?: number;
 }
+/**
+ * Partitioning for a CAS sequence (#345). A partitioned sequence is an
+ * independent counter scoped to one tuple of values — e.g.
+ * `sequence('invoice', { partition: [2026, 'EU'] })` numbers EU-2026 invoices
+ * separately from `[2026, 'US']` and from the bare `invoice` series.
+ *
+ * Partition components are URI-encoded (so `/`, null bytes and other
+ * separators in a value can never collide with the structural separators) and
+ * `'/'`-joined, then appended to the series with a null-byte (`\x00`)
+ * separator. The null byte is illegal in a plain series name, which guarantees
+ * a partitioned key is always disjoint from any unpartitioned series.
+ */
+interface SequenceOptions {
+    /** Partition tuple. Each component is URI-encoded and `'/'`-joined. */
+    readonly partition?: readonly (string | number)[];
+}
+/**
+ * Resolve the CAS storage key for a (series, partition) pair.
+ *
+ * With no partition the key is `series` verbatim. With a partition the key is
+ * `${series}\x00${parts}` where `parts` is each component passed through
+ * `encodeURIComponent(String(part))` and `'/'`-joined. The null-byte separator
+ * is illegal in a plain series name, so partitioned keys never collide with
+ * unpartitioned ones; URI-encoding keeps any component containing `/` distinct
+ * from a multi-component partition.
+ *
+ * @throws {ValidationError} if any partition component is empty after `String()`
+ *   or is a non-finite number (`NaN`, `±Infinity`).
+ */
+declare function resolveSequenceKey(series: string, opts?: SequenceOptions): string;
 interface SequenceHandle {
     /** Atomically allocate and return the next value (1, 2, 3, …). Deferred series resolve at the next pass. */
     next(opts?: NextOptions): Promise<number>;
     /** Read the current value without allocating. Returns 0 if never used. */
     peek(): Promise<number>;
+    /**
+     * Set-if-greater: advance the counter to at least `n`. A no-op if the
+     * current value is already `>= n` (so it never rewinds), and `seedTo(0)` is
+     * a no-op. Idempotent and CAS-safe under concurrent `next()` / `seedTo()`.
+     *
+     * Use after a bundle / CSV import to fast-forward the counter past the
+     * highest imported serial, so subsequent `next()` calls cannot re-use a
+     * number that is already on a record.
+     *
+     * Online-only: throws {@link SequenceOfflineError} on a non-CAS store.
+     */
+    seedTo(n: number): Promise<void>;
 }
 declare class SequenceStore {
     private readonly adapter;
@@ -7418,6 +7664,7 @@ declare class SequenceStore {
     private encryptState;
     peek(name: string): Promise<number>;
     next(name: string): Promise<number>;
+    seedTo(name: string, n: number): Promise<void>;
 }
 
 /**
@@ -8946,7 +9193,7 @@ declare class Vault {
      * const cur = await vault.sequence('invoice-2026').peek()  // current value, no allocation
      * ```
      */
-    sequence(name: string): SequenceHandle;
+    sequence(series: string, opts?: SequenceOptions): SequenceHandle;
     /** @internal — lazily build the deferred-numbering engine with a cache-coherent stamp. */
     private deferred;
     /**
@@ -11358,7 +11605,7 @@ interface ShadowStrategy {
  * @internal
  */
 interface TxStrategy {
-    runTransaction<T>(db: Noydb, fn: (tx: TxContext) => Promise<T> | T, options?: AmendmentTxOptions): Promise<T>;
+    runTransaction<T>(db: Noydb, fn: (tx: TxContext) => Promise<T> | T, options?: AmendmentTxOptions, txInvariants?: ReadonlyArray<TransactionInvariant>): Promise<T>;
     runDryRun(db: Noydb, fn: (tx: TxContext) => unknown): Promise<DryRunResult>;
 }
 
@@ -13627,4 +13874,4 @@ interface DeleteManyResult {
     }>;
 }
 
-export { type ExportBlobsAuditEntry as $, BLOB_COLLECTION as A, type BlobStrategy as B, BLOB_EVICTION_AUDIT_COLLECTION as C, DICT_COLLECTION_PREFIX as D, BLOB_INDEX_COLLECTION as E, BLOB_SLOTS_PREFIX as F, BLOB_VERSIONS_PREFIX as G, type BlobEvictionEntry as H, type I18nStrategy as I, type BlobFieldPolicy as J, type BlobFieldsConfig as K, type Layer as L, type BlobObject as M, type BlobPutOptions as N, type OnMissing as O, PolicyEnforcer as P, type BlobResponseOptions as Q, type ResolveI18nOptions as R, type ScriptWarning as S, BlobSet as T, type BlobStrategyOpenArgs as U, type CompactRunOptions as V, type CompactionContext as W, type CompactionResult as X, DEFAULT_CHUNK_SIZE as Y, EXPORT_AUDIT_COLLECTION as Z, ExportBlobsAbortedError as _, type DictEntry as a, type SyncStrategy as a$, type ExportBlobsHandle as a0, type ExportBlobsOptions as a1, type ExportedBlob as a2, type SlotInfo as a3, type SlotRecord as a4, type VersionRecord as a5, createExportBlobsHandle as a6, runCompaction as a7, type ConsentStrategy as a8, CONSENT_AUDIT_COLLECTION as a9, VaultFrame as aA, type NoydbBundleStore as aB, type RetentionPolicy as aC, type SnapshotPolicy as aD, type SnapshotStrategy as aE, type SnapshotMeta as aF, type SnapshotMode as aG, type TxStrategy as aH, type AmendmentTxOptions as aI, TxCollection as aJ, TxContext as aK, TxVault as aL, runTransaction as aM, type DerivationStrategy as aN, type DerivationContext as aO, type ArrayOutputSpec as aP, DerivationRegistry as aQ, type DerivationStrategyHandle as aR, type DerivedFromMeta as aS, type OutputSpec as aT, type RecordOutputSpec as aU, type MaterializedViewStrategy as aV, type MaterializedViewStrategyHandle as aW, type OverlayedViewStrategy as aX, Collection as aY, OverlayedViewRegistry as aZ, type OverlayedViewStrategyHandle as a_, type ConsentAuditEntry as aa, type ConsentAuditFilter as ab, type ConsentContext as ac, type ConsentOp as ad, loadConsentEntries as ae, writeConsentEntry as af, type PeriodsStrategy as ag, type CarryForwardContext as ah, type ClosePeriodOptions as ai, type OpenPeriodOptions as aj, PERIODS_COLLECTION as ak, type PeriodRecord as al, type ReadOnlyCollection as am, appendPeriodLedgerEntry as an, assertTsWritable as ao, chainAnchor as ap, loadPeriods as aq, validatePeriodName as ar, type GuardStrategy as as, type GuardChange as at, type GuardContext as au, GuardRegistry as av, type GuardStrategyHandle as aw, ReadOnlyVaultFacade as ax, type ShadowStrategy as ay, CollectionFrame as az, type DictKeyDescriptor as b, type CapturedBlueprint as b$, type Role as b0, type UnlockedKeyring as b1, type HistoryStrategy as b2, type NoydbStore as b3, type HistoryOptions as b4, type EncryptedEnvelope as b5, type PruneOptions as b6, type AppendInput as b7, type ChangeType as b8, CollectionInstant as b9, type RegisteredMV as bA, MaterializedViewRegistry as bB, type MaterializedFromMeta as bC, type MaterializedViewOutput as bD, type UnionSource as bE, type UserEnvelope as bF, type GateName as bG, type GatePolicy as bH, type VaultPolicy as bI, type ActiveTier as bJ, type FactorProof as bK, type SchemaUpdateStrategy as bL, type TransformFn as bM, type PersistedSchemaEnvelope as bN, type UpdateDecision as bO, type DirectoryConfig as bP, type UserVisibility as bQ, type AccessibleVault as bR, type AffectedDocument as bS, type ArchivePolicy as bT, type ArchiveResult as bU, type ArchiveRunOptions as bV, type ArchiveStrategy as bW, BUNDLE_STORE_POLICY as bX, type BuiltInGateName as bY, type CacheOptions as bZ, type CacheStats as b_, type DiffEntry as ba, type JsonPatch as bb, type JsonPatchOp as bc, type LedgerEntry as bd, LedgerStore as be, type VaultEngine as bf, VaultInstant as bg, type VerifyResult as bh, applyPatch as bi, canonicalJson as bj, computePatch as bk, diff as bl, formatDiff as bm, hashEntry as bn, paddedIndex as bo, parseIndex as bp, sha256Hex as bq, type PublicEnvelope as br, type SealingKeyProvider as bs, type BundleRecipient as bt, type RecipientSealer as bu, type RecipientHint as bv, Vault as bw, type RecoveryEnrollmentInput as bx, type ShamirRecoveryProvider as by, type MVQueryContext as bz, DictionaryHandle as c, type KeyringFile as c$, type ChangeEvent as c0, type CollectionChangeEvent as c1, type CollectionConflictResolver as c2, type CollectionDescriptor as c3, type CollectionStats as c4, ComputedFieldError as c5, type ComputedFields as c6, type ComputedFn as c7, type Conflict as c8, type ConflictPolicy as c9, type ExportChunk as cA, type ExportFormat as cB, type ExportStreamOptions as cC, type FactorKind as cD, type FactorProofBundle as cE, type FactorRequirement as cF, type FanoutQueryOptions as cG, type FanoutResult as cH, type FenceDoc as cI, type FenceState as cJ, type FieldChange as cK, type FieldDescriptor as cL, type FieldSource as cM, type GhostRecord as cN, type GrantOptions as cO, type GuardViolation as cP, type HistoryConfig as cQ, type HistoryEntry as cR, INDEXED_STORE_POLICY as cS, type ImportCapability as cT, type InferOutput as cU, type InternalCollectionStats as cV, type IssueDelegationOptions as cW, type IssueMagicLinkGrantOptions as cX, type KeyringAuthenticator as cY, type KeyringAuthenticatorWrappingDEKs as cZ, type KeyringAuthenticatorWrappingKEK as c_, type ConflictStrategy as ca, type CrossTierAccessEvent as cb, CrossVaultAggregation as cc, CrossVaultGroupedAggregation as cd, type GroupedRow as ce, type CrossVaultLiveAggregation as cf, type CrossVaultLiveQuery as cg, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as ch, DELEGATIONS_COLLECTION as ci, type DeepPartial as cj, type DeepPartialOrNull as ck, type DeferredNumberingConfig as cl, type DelegationToken as cm, type DeleteManyResult as cn, type DeploymentEvent as co, type DerivationDescriptor as cp, type DirtyEntry as cq, type DryRunResult as cr, type DumpSchemaOptions as cs, ELEVATION_AUDIT_COLLECTION as ct, ElevatedHandle as cu, type EnrollAuthenticatorOptions as cv, type EnrollAuthenticatorWrappingDEKsOptions as cw, type EnrollAuthenticatorWrappingKEKOptions as cx, type EnrollRecoveryResult as cy, type ExportCapability as cz, type DictionaryOptions as d, type ResolvedPublicEnvelopeSchema as d$, type ListAccessibleVaultsOptions as d0, type ListPageResult as d1, type ListUsersOptions as d2, type LiveQueryOptions as d3, type LiveUserEnvelope as d4, type LocaleReadOptions as d5, Lru as d6, type LruOptions as d7, type LruStats as d8, MAGIC_LINK_CONTENT_INFO_PREFIX as d9, type PlaintextTranslatorContext as dA, type PlaintextTranslatorFn as dB, PresenceHandle as dC, type PresencePeer as dD, type PublicEnvelopeField as dE, type PublicEnvelopeSchema as dF, type PublicEnvelopeText as dG, type PullMode as dH, type PullOptions as dI, type PullPolicy as dJ, type PullResult as dK, type PushMode as dL, type PushOptions as dM, type PushPolicy as dN, type PushResult as dO, type PutManyItemOptions as dP, type PutManyOptions as dQ, type PutManyResult as dR, type QueryAcrossOptions as dS, type QueryAcrossResult as dT, type QuickUnlockState as dU, QuickUnlockStore as dV, type ReAuthOperation as dW, type RecoverPassphraseInput as dX, type RecoverPassphraseResult as dY, type RecoverUserOptions as dZ, type RecoveryProof as d_, MAGIC_LINK_GRANTS_COLLECTION as da, MAGIC_LINK_KEK_INFO_PREFIX as db, type MagicLinkGrantPayload as dc, type MagicLinkGrantRecord as dd, type MaterializedViewDescriptor as de, MemoryRecipientSealer as df, MemorySealingKeyProvider as dg, NOYDB_BACKUP_VERSION as dh, NOYDB_FORMAT_VERSION as di, NOYDB_KEYRING_VERSION as dj, NOYDB_SYNC_VERSION as dk, type NextOptions as dl, Noydb as dm, type NoydbEventMap as dn, type NoydbOptions as dp, type Assignment as dq, type OverlayViewDescriptor as dr, PUBLIC_ENVELOPE_FIELDS as ds, type PaperRecoveryDoc as dt, type PaperRecoveryEntry as du, type PassphrasePolicy as dv, type PassphraseValidationResult as dw, type Permission as dx, type Permissions as dy, type PersistedSchemaKind as dz, type I18nMap as e, type VaultPolicyOnDisk as e$, type RevokeOptions as e0, type RotatePassphraseInput as e1, type RotateRecoveryOptions as e2, type RotateRecoveryResult as e3, SEALED_PASSPHRASE_RECORD_ID as e4, type SchemaDelta as e5, type SchemaIntrospection as e6, type SchemaManifestRow as e7, type SealedEnvelope as e8, type SealedPassphrase as e9, type SyncStatus as eA, type SyncTarget as eB, type SyncTargetRole as eC, SyncTransaction as eD, type SyncTransactionResult as eE, type TabChannel as eF, type TabCoordinationOptions as eG, type TabLockManager as eH, type TabPresence as eI, type TabRole as eJ, type TierMode as eK, type TranslatorAuditEntry as eL, type TxOp as eM, USER_ENVELOPE_COLLECTION as eN, USER_ENVELOPE_MAX_BYTES as eO, type Unsubscribe as eP, type UpdateAuthenticatorOptions as eQ, type UpdateContext as eR, type UpdateUserOptions as eS, UserApi as eT, type UserEnvelopeCheckGate as eU, UserEnvelopeOversizedError as eV, type UserEnvelopePresented as eW, type UserInfo as eX, type VaultBackup as eY, VaultGroup as eZ, type VaultGroupOptions as e_, type SequenceHandle as ea, SequenceStore as eb, type SessionPolicy as ec, type SetPublicEnvelopeInput as ed, type ShamirRecoveryDoc as ee, type ShamirRecoveryEntry as ef, ShardedCollection as eg, ShardedGroupedQuery as eh, ShardedQuery as ei, type ShardingConfig as ej, type SkippedVault as ek, type SlotRewrapCeremony as el, type SlotRewrapContext as em, type StandardSchemaV1 as en, type StandardSchemaV1Issue as eo, type StandardSchemaV1SyncResult as ep, StateManagementVault as eq, type StoreAuth as er, type StoreAuthKind as es, type StoreCapabilities as et, type StoreTime as eu, SyncEngine as ev, type SyncMetadata as ew, type SyncPolicy as ex, SyncScheduler as ey, type SyncSchedulerStatus as ez, type I18nTextDescriptor as f, withDeferredNumbering as f$, type VaultRegistryRow as f0, type VaultSchemaSnapshot as f1, type VaultSnapshot as f2, type VaultTemplate as f3, type WarningRules as f4, WeakPassphraseError as f5, type WeakPassphraseReason as f6, type WithArchiveOptions as f7, type WrappedDeksBlob as f8, type WriteConflict as f9, loadActiveDelegations as fA, loadPaperRecoveryEntries as fB, loadSealedPassphrase as fC, loadShamirRecoveryEntries as fD, magicLinkGrantRecordId as fE, mintPaperRecoveryEntry as fF, mintShamirRecoveryEntry as fG, mintWrappedDeksBlob as fH, parseSealedEnvelope as fI, readMagicLinkGrantRecord as fJ, recoverUser as fK, removeAuthenticator as fL, resolveSchema as fM, revokeDelegation as fN, revokeMagicLinkGrant as fO, savePaperRecoveryEntries as fP, saveSealedPassphrase as fQ, saveShamirRecoveryEntries as fR, unwrapDeksFromBlob as fS, unwrapDeksFromPaperEntry as fT, unwrapDeksFromShamirEntry as fU, unwrapMagicLinkGrant as fV, validatePassphrase as fW, validatePublicEnvelopeInput as fX, validateSchemaInput as fY, validateSchemaOutput as fZ, withArchive as f_, type WriteEvent as fa, type WriteHook as fb, type WriteQueue as fc, assertStrongPassphrase as fd, buildRecipientKeyringFile as fe, burnPaperRecoveryEntry as ff, createNoydb as fg, createStore as fh, deriveMagicLinkContentKey as fi, enrollAuthenticator as fj, estimateEntropy as fk, evalComputedFields as fl, evaluateExportCapability as fm, evaluateImportCapability as fn, findAuthenticator as fo, hasExportCapability as fp, hasImportCapability as fq, hasRecoveryEnrolled as fr, isMagicLinkGrantExpired as fs, isPublicEnvelope as ft, issueDelegation as fu, recoverPassphrase as fv, rotatePassphrase as fw, listMagicLinkGrants as fx, listUsers as fy, listUsersWithEnvelopes as fz, type I18nTextOptions as g, writeMagicLinkGrant as g0, changeSecret as g1, createOwnerKeyring as g2, ensureCollectionDEK as g3, grant as g4, loadKeyring as g5, persistKeyring as g6, revoke as g7, updateAuthenticator as g8, updateKeyringIdentity as g9, type OnMissingPolicy as h, applyI18nLocale as i, dictCollectionName as j, dictKey as k, enforceScript as l, getAtPath as m, i18nText as n, inferScripts as o, isDictCollectionName as p, isDictKeyDescriptor as q, isI18nTextDescriptor as r, resolveI18nText as s, resolvePolicy as t, setAtPathInPlace as u, validateI18nTextValue as v, type SessionStrategy as w, createEnforcer as x, validateSessionPolicy as y, BLOB_CHUNKS_COLLECTION as z };
+export { type ExportBlobsAuditEntry as $, BLOB_COLLECTION as A, type BlobStrategy as B, BLOB_EVICTION_AUDIT_COLLECTION as C, DICT_COLLECTION_PREFIX as D, BLOB_INDEX_COLLECTION as E, BLOB_SLOTS_PREFIX as F, BLOB_VERSIONS_PREFIX as G, type BlobEvictionEntry as H, type I18nStrategy as I, type BlobFieldPolicy as J, type BlobFieldsConfig as K, type Layer as L, type BlobObject as M, type BlobPutOptions as N, type OnMissing as O, PolicyEnforcer as P, type BlobResponseOptions as Q, type ResolveI18nOptions as R, type ScriptWarning as S, BlobSet as T, type BlobStrategyOpenArgs as U, type CompactRunOptions as V, type CompactionContext as W, type CompactionResult as X, DEFAULT_CHUNK_SIZE as Y, EXPORT_AUDIT_COLLECTION as Z, ExportBlobsAbortedError as _, type DictEntry as a, type NoydbStore as a$, type ExportBlobsHandle as a0, type ExportBlobsOptions as a1, type ExportedBlob as a2, type SlotInfo as a3, type SlotRecord as a4, type VersionRecord as a5, createExportBlobsHandle as a6, runCompaction as a7, type ConsentStrategy as a8, CONSENT_AUDIT_COLLECTION as a9, VaultFrame as aA, type NoydbBundleStore as aB, type RetentionPolicy as aC, type SnapshotPolicy as aD, type SnapshotStrategy as aE, type SnapshotMeta as aF, type SnapshotMode as aG, type DerivationStrategy as aH, type DerivationContext as aI, type ArrayOutputSpec as aJ, DerivationRegistry as aK, type DerivationStrategyHandle as aL, type DerivedFromMeta as aM, type OutputSpec as aN, type RecordOutputSpec as aO, type MaterializedViewStrategy as aP, type MaterializedViewStrategyHandle as aQ, type OverlayedViewStrategy as aR, Collection as aS, type OverlayFieldMergeMode as aT, type OverlayFieldMergeRule as aU, OverlayedViewRegistry as aV, type OverlayedViewStrategyHandle as aW, type SyncStrategy as aX, type Role as aY, type UnlockedKeyring as aZ, type HistoryStrategy as a_, type ConsentAuditEntry as aa, type ConsentAuditFilter as ab, type ConsentContext as ac, type ConsentOp as ad, loadConsentEntries as ae, writeConsentEntry as af, type PeriodsStrategy as ag, type CarryForwardContext as ah, type ClosePeriodOptions as ai, type OpenPeriodOptions as aj, PERIODS_COLLECTION as ak, type PeriodRecord as al, type ReadOnlyCollection as am, appendPeriodLedgerEntry as an, assertTsWritable as ao, chainAnchor as ap, loadPeriods as aq, validatePeriodName as ar, type GuardStrategy as as, type GuardChange as at, type GuardContext as au, GuardRegistry as av, type GuardStrategyHandle as aw, ReadOnlyVaultFacade as ax, type ShadowStrategy as ay, CollectionFrame as az, type DictKeyDescriptor as b, type CollectionChangeEvent as b$, type HistoryOptions as b0, type EncryptedEnvelope as b1, type PruneOptions as b2, type AppendInput as b3, type ChangeType as b4, CollectionInstant as b5, type DiffEntry as b6, type JsonPatch as b7, type JsonPatchOp as b8, type LedgerEntry as b9, type MaterializedViewOutput as bA, type UnionArmJoin as bB, type UnionSource as bC, type UserEnvelope as bD, type GateName as bE, type GatePolicy as bF, type VaultPolicy as bG, type ActiveTier as bH, type FactorProof as bI, type SchemaUpdateStrategy as bJ, type TransformFn as bK, type PersistedSchemaEnvelope as bL, type UpdateDecision as bM, type DirectoryConfig as bN, type UserVisibility as bO, type AccessibleVault as bP, type AffectedDocument as bQ, type ArchivePolicy as bR, type ArchiveResult as bS, type ArchiveRunOptions as bT, type ArchiveStrategy as bU, BUNDLE_STORE_POLICY as bV, type BuiltInGateName as bW, type CacheOptions as bX, type CacheStats as bY, type CapturedBlueprint as bZ, type ChangeEvent as b_, LedgerStore as ba, type VaultEngine as bb, VaultInstant as bc, type VerifyResult as bd, applyPatch as be, canonicalJson as bf, computePatch as bg, diff as bh, formatDiff as bi, hashEntry as bj, paddedIndex as bk, parseIndex as bl, sha256Hex as bm, type PublicEnvelope as bn, type SealingKeyProvider as bo, type BundleRecipient as bp, type RecipientSealer as bq, type RecipientHint as br, Vault as bs, type RecoveryEnrollmentInput as bt, type ShamirRecoveryProvider as bu, TxContext as bv, type MVQueryContext as bw, type RegisteredMV as bx, MaterializedViewRegistry as by, type MaterializedFromMeta as bz, DictionaryHandle as c, type ListPageResult as c$, type CollectionConflictResolver as c0, type CollectionDescriptor as c1, type CollectionStats as c2, ComputedFieldError as c3, type ComputedFields as c4, type ComputedFn as c5, type Conflict as c6, type ConflictPolicy as c7, type ConflictStrategy as c8, type CrossTierAccessEvent as c9, type ExportStreamOptions as cA, type FactorKind as cB, type FactorProofBundle as cC, type FactorRequirement as cD, type FanoutQueryOptions as cE, type FanoutResult as cF, type FenceDoc as cG, type FenceState as cH, type FieldChange as cI, type FieldDescriptor as cJ, type FieldSource as cK, type GhostRecord as cL, type GrantOptions as cM, type GuardViolation as cN, type HistoryConfig as cO, type HistoryEntry as cP, INDEXED_STORE_POLICY as cQ, type ImportCapability as cR, type InferOutput as cS, type InternalCollectionStats as cT, type IssueDelegationOptions as cU, type IssueMagicLinkGrantOptions as cV, type KeyringAuthenticator as cW, type KeyringAuthenticatorWrappingDEKs as cX, type KeyringAuthenticatorWrappingKEK as cY, type KeyringFile as cZ, type ListAccessibleVaultsOptions as c_, CrossVaultAggregation as ca, CrossVaultGroupedAggregation as cb, type GroupedRow as cc, type CrossVaultLiveAggregation as cd, type CrossVaultLiveQuery as ce, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as cf, DELEGATIONS_COLLECTION as cg, type DeepPartial as ch, type DeepPartialOrNull as ci, type DeferredNumberingConfig as cj, type DelegationToken as ck, type DeleteManyResult as cl, type DeploymentEvent as cm, type DerivationDescriptor as cn, type DirtyEntry as co, type DryRunResult as cp, type DumpSchemaOptions as cq, ELEVATION_AUDIT_COLLECTION as cr, ElevatedHandle as cs, type EnrollAuthenticatorOptions as ct, type EnrollAuthenticatorWrappingDEKsOptions as cu, type EnrollAuthenticatorWrappingKEKOptions as cv, type EnrollRecoveryResult as cw, type ExportCapability as cx, type ExportChunk as cy, type ExportFormat as cz, type DictionaryOptions as d, type RotatePassphraseInput as d$, type ListUsersOptions as d0, type LiveQueryOptions as d1, type LiveUserEnvelope as d2, type LocaleReadOptions as d3, Lru as d4, type LruOptions as d5, type LruStats as d6, MAGIC_LINK_CONTENT_INFO_PREFIX as d7, MAGIC_LINK_GRANTS_COLLECTION as d8, MAGIC_LINK_KEK_INFO_PREFIX as d9, PresenceHandle as dA, type PresencePeer as dB, type PublicEnvelopeField as dC, type PublicEnvelopeSchema as dD, type PublicEnvelopeText as dE, type PullMode as dF, type PullOptions as dG, type PullPolicy as dH, type PullResult as dI, type PushMode as dJ, type PushOptions as dK, type PushPolicy as dL, type PushResult as dM, type PutManyItemOptions as dN, type PutManyOptions as dO, type PutManyResult as dP, type QueryAcrossOptions as dQ, type QueryAcrossResult as dR, type QuickUnlockState as dS, QuickUnlockStore as dT, type ReAuthOperation as dU, type RecoverPassphraseInput as dV, type RecoverPassphraseResult as dW, type RecoverUserOptions as dX, type RecoveryProof as dY, type ResolvedPublicEnvelopeSchema as dZ, type RevokeOptions as d_, type MagicLinkGrantPayload as da, type MagicLinkGrantRecord as db, type MaterializedViewDescriptor as dc, MemoryRecipientSealer as dd, MemorySealingKeyProvider as de, NOYDB_BACKUP_VERSION as df, NOYDB_FORMAT_VERSION as dg, NOYDB_KEYRING_VERSION as dh, NOYDB_SYNC_VERSION as di, type NextOptions as dj, Noydb as dk, type NoydbEventMap as dl, type NoydbOptions as dm, type Assignment as dn, type OverlayViewDescriptor as dp, PUBLIC_ENVELOPE_FIELDS as dq, type PaperRecoveryDoc as dr, type PaperRecoveryEntry as ds, type PassphrasePolicy as dt, type PassphraseValidationResult as du, type Permission as dv, type Permissions as dw, type PersistedSchemaKind as dx, type PlaintextTranslatorContext as dy, type PlaintextTranslatorFn as dz, type I18nMap as e, VaultGroup as e$, type RotateRecoveryOptions as e0, type RotateRecoveryResult as e1, SEALED_PASSPHRASE_RECORD_ID as e2, type SchemaDelta as e3, type SchemaIntrospection as e4, type SchemaManifestRow as e5, type SealedEnvelope as e6, type SealedPassphrase as e7, type SequenceHandle as e8, type SequenceOptions as e9, type SyncTarget as eA, type SyncTargetRole as eB, SyncTransaction as eC, type SyncTransactionResult as eD, type TabChannel as eE, type TabCoordinationOptions as eF, type TabLockManager as eG, type TabPresence as eH, type TabRole as eI, type TierMode as eJ, type TransactionInvariant as eK, type TranslatorAuditEntry as eL, TxCollection as eM, type TxOp as eN, TxVault as eO, USER_ENVELOPE_COLLECTION as eP, USER_ENVELOPE_MAX_BYTES as eQ, type Unsubscribe as eR, type UpdateAuthenticatorOptions as eS, type UpdateContext as eT, type UpdateUserOptions as eU, UserApi as eV, type UserEnvelopeCheckGate as eW, UserEnvelopeOversizedError as eX, type UserEnvelopePresented as eY, type UserInfo as eZ, type VaultBackup as e_, SequenceStore as ea, type SessionPolicy as eb, type SetPublicEnvelopeInput as ec, type ShamirRecoveryDoc as ed, type ShamirRecoveryEntry as ee, ShardedCollection as ef, ShardedGroupedQuery as eg, ShardedQuery as eh, type ShardingConfig as ei, type SkippedVault as ej, type SlotRewrapCeremony as ek, type SlotRewrapContext as el, type StandardSchemaV1 as em, type StandardSchemaV1Issue as en, type StandardSchemaV1SyncResult as eo, StateManagementVault as ep, type StoreAuth as eq, type StoreAuthKind as er, type StoreCapabilities as es, type StoreTime as et, SyncEngine as eu, type SyncMetadata as ev, type SyncPolicy as ew, SyncScheduler as ex, type SyncSchedulerStatus as ey, type SyncStatus as ez, type I18nTextDescriptor as f, validatePublicEnvelopeInput as f$, type VaultGroupOptions as f0, type VaultPolicyOnDisk as f1, type VaultRegistryRow as f2, type VaultSchemaSnapshot as f3, type VaultSnapshot as f4, type VaultTemplate as f5, type WarningRules as f6, WeakPassphraseError as f7, type WeakPassphraseReason as f8, type WithArchiveOptions as f9, listUsers as fA, listUsersWithEnvelopes as fB, loadActiveDelegations as fC, loadPaperRecoveryEntries as fD, loadSealedPassphrase as fE, loadShamirRecoveryEntries as fF, magicLinkGrantRecordId as fG, mintPaperRecoveryEntry as fH, mintShamirRecoveryEntry as fI, mintWrappedDeksBlob as fJ, parseSealedEnvelope as fK, readMagicLinkGrantRecord as fL, recoverUser as fM, removeAuthenticator as fN, resolveSchema as fO, resolveSequenceKey as fP, revokeDelegation as fQ, revokeMagicLinkGrant as fR, runTransaction as fS, savePaperRecoveryEntries as fT, saveSealedPassphrase as fU, saveShamirRecoveryEntries as fV, unwrapDeksFromBlob as fW, unwrapDeksFromPaperEntry as fX, unwrapDeksFromShamirEntry as fY, unwrapMagicLinkGrant as fZ, validatePassphrase as f_, type WrappedDeksBlob as fa, type WriteConflict as fb, type WriteEvent as fc, type WriteHook as fd, type WriteQueue as fe, assertStrongPassphrase as ff, buildRecipientKeyringFile as fg, burnPaperRecoveryEntry as fh, createNoydb as fi, createStore as fj, deriveMagicLinkContentKey as fk, enrollAuthenticator as fl, estimateEntropy as fm, evalComputedFields as fn, evaluateExportCapability as fo, evaluateImportCapability as fp, findAuthenticator as fq, hasExportCapability as fr, hasImportCapability as fs, hasRecoveryEnrolled as ft, isMagicLinkGrantExpired as fu, isPublicEnvelope as fv, issueDelegation as fw, recoverPassphrase as fx, rotatePassphrase as fy, listMagicLinkGrants as fz, type I18nTextOptions as g, validateSchemaInput as g0, validateSchemaOutput as g1, withArchive as g2, withDeferredNumbering as g3, writeMagicLinkGrant as g4, changeSecret as g5, createOwnerKeyring as g6, ensureCollectionDEK as g7, grant as g8, loadKeyring as g9, persistKeyring as ga, revoke as gb, updateAuthenticator as gc, updateKeyringIdentity as gd, type TxStrategy as ge, type AmendmentTxOptions as gf, type OnMissingPolicy as h, applyI18nLocale as i, dictCollectionName as j, dictKey as k, enforceScript as l, getAtPath as m, i18nText as n, inferScripts as o, isDictCollectionName as p, isDictKeyDescriptor as q, isI18nTextDescriptor as r, resolveI18nText as s, resolvePolicy as t, setAtPathInPlace as u, validateI18nTextValue as v, type SessionStrategy as w, createEnforcer as x, validateSessionPolicy as y, BLOB_CHUNKS_COLLECTION as z };