@noy-db/hub 0.2.0-pre.17 → 0.2.0-pre.18

package/dist/{types-CljIHm_J.d.ts → types-Diqc2caK.d.ts}

@@ -1,9 +1,9 @@
 import { I as IndexStrategy, d as LazyQuery } from './lazy-builder-ChSqcF5t.js';
-import { L as LiveAggregation, b as AggregateSpec, a as AggregateResult, v as MoneyDescriptor, A as AggregateStrategy } from './strategy-4M9jo172.js';
+import { L as LiveAggregation, b as AggregateSpec, a as AggregateResult, v as MoneyDescriptor, A as AggregateStrategy } from './strategy-Diwh5lzS.js';
 import { C as CrdtStrategy, a as CrdtMode, b as CrdtState } from './strategy-BSxFXGzb.js';
 import { L as LedgerEntry, F as ForgetStrategy, S as SubjectRef, b as ForgetResult } from './index-C-SSRIxP.js';
-import { N as NoydbError } from './errors-Dz64FA65.js';
-import { L as LiveQuery, Q as Query, c as JoinStrategy, j as RefRegistry, R as RefDescriptor, d as JoinableSource, l as RefViolation, S as ScanBuilder } from './index-DpU6KWof.js';
+import { N as NoydbError } from './errors-DUTlAt3Y.js';
+import { L as LiveQuery, Q as Query, c as JoinStrategy, j as RefRegistry, R as RefDescriptor, d as JoinableSource, l as RefViolation, S as ScanBuilder } from './index-DP1JTWHZ.js';
 import { I as IndexDef, O as Operator, F as FieldClause, C as CollectionIndexes } from './predicate-BmhBSPCH.js';
 import { AttestationFieldSchema, RevocationList } from '@noy-db/attestation';
 
@@ -1758,12 +1758,14 @@ interface I18nTextOptions {
      * export). Default `'throw'` — today's behavior, zero breaking change.
      * See {@link OnMissingPolicy}.
      *
-     * NOTE (current wiring): the `read` layer (`get`/`list`) is enforced.
-     * Guard, derivation, mv, join and export reads currently resolve
-     * through the same read path and so observe the `read`/scalar policy;
-     * dedicated per-layer enforcement for those contexts is a tracked
-     * follow-up (mv/join additionally require resolution to be injected
-     * into the query/aggregate pipeline, which today reads raw maps).
+     * NOTE (current wiring): the `read` (`get`/`list`), `guard` and
+     * `derivation` layers are enforced — guard / derivation `ctx.vault`
+     * reads resolve under their own layer policy (`guard` defaults to the
+     * lenient `'substitute'`). The `mv`, `join` and `export` layers are NOT
+     * yet wired: mv/join read raw `{locale}` maps in the query/aggregate
+     * pipeline (no resolution call site), so injecting resolution there is a
+     * tracked follow-up (#285 D2/D3). Until then those reads observe the raw
+     * map, not this policy.
      */
     readonly onMissing?: OnMissingPolicy;
     /**
@@ -3750,6 +3752,25 @@ interface VaultGroupOptions<T> {
      */
     readonly registry?: Collection<VaultRegistryRow>;
     readonly sharding: ShardingConfig<T>;
+    /**
+     * Lazy migrate-on-open (#271 fleet migration). When `true`, opening a shard
+     * whose registry `schemaVersion` is behind the template's version runs that
+     * shard's cutover inline (via `migrateShard`) before surfacing the handle.
+     * Zero cost for shards never opened. Default `false` (use `migrateFleet`).
+     */
+    readonly migrateOnOpen?: boolean;
+}
+/** Result of `VaultGroup.migrateFleet` (#271 active batch runner). */
+interface FleetMigrationResult {
+    /** The version migrated toward (the template's current version). */
+    readonly target: number;
+    /** vaultIds successfully migrated (or already current). */
+    readonly migrated: string[];
+    /** vaultIds whose cutover failed, with the error message. */
+    readonly failed: {
+        readonly vaultId: string;
+        readonly error: string;
+    }[];
 }
 /** Options for a cross-shard fan-out read. */
 interface FanoutQueryOptions {
@@ -3794,6 +3815,48 @@ interface CrossVaultLiveAggregation<R> extends LiveAggregation<R> {
     readonly skippedVaults: readonly SkippedVault[];
     readonly ready: Promise<void>;
 }
+/**
+ * Context passed to a cross-vault `derive` callback (#271 Insight Vault).
+ * One call per shard; identifies which shard the records came from.
+ */
+interface CrossVaultDerivationContext {
+    /** The shard's vault id (e.g. `firm-clients--acme`). */
+    readonly vaultId: string;
+    /** The shard's partition key (e.g. `acme`). */
+    readonly partitionKey: string;
+    /** The shard's schema/template version, from its registry row. */
+    readonly schemaVersion: number;
+}
+/**
+ * A push-model cross-vault derivation (#271, Insight Vault — Layer 4).
+ *
+ * For each eligible shard, `refreshInsights()` reads the shard's `source`
+ * collection, runs `derive` on that shard's records, and writes the returned
+ * summary row into a separate analytics ("Insight") vault — keyed by partition
+ * key, one row per shard. The summary is re-encrypted under the Insight Vault's
+ * own DEK; the shard's ciphertext never leaves its DEK boundary (the push model
+ * that resolves the cross-vault DEK conflict). See the ZK note in the spec —
+ * the Insight Vault backend sees aggregated structure across shards, a weaker
+ * profile than per-shard vaults; opt-in.
+ */
+interface CrossVaultDerivationSpec<R = Record<string, unknown>, S = Record<string, unknown>> {
+    /** Collection read from each shard. */
+    readonly source: string;
+    /** Destination Insight Vault + collection for the per-shard summary rows. */
+    readonly target: {
+        readonly vault: string;
+        readonly collection: string;
+    };
+    /** Per-shard reducer: that shard's source records + context → one summary row. */
+    readonly derive: (records: R[], ctx: CrossVaultDerivationContext) => S;
+}
+/** The result of `refreshInsights()`. */
+interface RefreshInsightsResult {
+    /** Number of summary rows written (one per eligible shard × registered derivation). */
+    readonly written: number;
+    /** Shards excluded (schema-drift, unprovisioned, or read error). */
+    readonly skippedVaults: SkippedVault[];
+}
 /** A serializable blueprint captured from a VaultTemplate.configure run. */
 interface CapturedBlueprint {
     /** Sorted collection names declared by the template. */
@@ -3818,12 +3881,34 @@ interface SchemaManifestRow {
 interface DeploymentEvent {
     readonly id: string;
     readonly ts: number;
-    readonly type: 'shard-created' | 'manifest-recorded' | 'group-opened';
+    readonly type: 'shard-created' | 'manifest-recorded' | 'group-opened' | 'migration-started' | 'migration-completed' | 'migration-failed';
     readonly group: string;
     readonly vaultId?: string;
     readonly templateName?: string;
     readonly version?: number;
     readonly actor?: string;
+    /** Free-form detail (e.g. migration error message). */
+    readonly detail?: string;
+}
+/**
+ * One row in the StateManagement `migration-status` collection (#271 fleet
+ * schema-migration runner), keyed by `vaultId`. Tracks each shard's progress
+ * toward the template's current version so the active batch runner is
+ * resumable and the staged rollout can verify a cohort before proceeding.
+ */
+interface MigrationStatusRow {
+    readonly vaultId: string;
+    readonly group: string;
+    /** The shard's registry schemaVersion at the time of this status. */
+    readonly currentVersion: number;
+    /** The version the runner is moving this shard to (the template's version). */
+    readonly targetVersion: number;
+    readonly status: 'pending' | 'running' | 'done' | 'failed';
+    readonly startedAt?: number;
+    readonly finishedAt?: number;
+    /** Records migrated by the per-shard cutover (when status `done`). */
+    readonly migrated?: number;
+    readonly error?: string;
 }
 
 /**
@@ -3838,8 +3923,14 @@ declare class StateManagementVault {
     readonly registry: Collection<VaultRegistryRow>;
     readonly schemaManifest: Collection<SchemaManifestRow>;
     private constructor();
-    /** Idempotently open the reserved state vault and bind the three control-plane collections. */
+    /** Idempotently open the reserved state vault and bind the control-plane collections. */
     static open(db: Noydb): Promise<StateManagementVault>;
+    /** Read one shard's migration status (or null). */
+    getMigrationStatus(vaultId: string): Promise<MigrationStatusRow | null>;
+    /** All migration-status rows (hydrates first). */
+    listMigrationStatus(): Promise<MigrationStatusRow[]>;
+    /** Upsert one shard's migration status (keyed by vaultId). */
+    upsertMigrationStatus(row: MigrationStatusRow): Promise<void>;
     /** Read-only query over the append-only deployment-events log. */
     queryEvents(): Query<DeploymentEvent>;
     /**
@@ -5544,12 +5635,14 @@ declare class VaultGroup<T> {
     /** @internal */ readonly registry: Collection<VaultRegistryRow>;
     /** @internal */ readonly sharding: ShardingConfig<T>;
     /** @internal */ readonly template: VaultTemplate;
+    /** @internal — lazy migrate-on-open (#271). */ readonly migrateOnOpen: boolean;
     constructor(
     /** @internal */ db: Noydb, 
     /** @internal */ name: string, 
     /** @internal */ registry: Collection<VaultRegistryRow>, 
     /** @internal */ sharding: ShardingConfig<T>, 
-    /** @internal */ template: VaultTemplate);
+    /** @internal */ template: VaultTemplate, 
+    /** @internal — lazy migrate-on-open (#271). */ migrateOnOpen?: boolean);
     /** @internal — set when the group is managed (no explicit registry). */
     private stateVault;
     /** @internal */
@@ -5572,8 +5665,14 @@ declare class VaultGroup<T> {
      * `liveBinding().isRelevant` already applies to the reactive path.
      */
     allRows(): Promise<VaultRegistryRow[]>;
-    /** Open an existing shard and apply the template. */
+    /**
+     * Open an existing shard and apply the template. When `migrateOnOpen` is set
+     * (#271) and the shard's registry version is behind the template, its cutover
+     * runs inline first — so a behind shard never surfaces a stale handle.
+     */
     openShard(partitionKey: string): Promise<Vault>;
+    /** @internal — open + configure with no migrate-on-open hook (used by the migration path itself to avoid recursion). */
+    private _openShardRaw;
     /**
      * Idempotently provision a shard for `partitionKey`. Returns the
      * configured vault handle.
@@ -5598,6 +5697,69 @@ declare class VaultGroup<T> {
         eligible: VaultRegistryRow[];
         skipped: SkippedVault[];
     }>;
+    /** @internal — registered push-model cross-vault derivations (#271 Insight Vault). */
+    private readonly crossVaultDerivations;
+    /**
+     * Register a push-model cross-vault derivation — the Insight Vault pattern
+     * (#271, Layer 4). Drive it with {@link refreshInsights}.
+     *
+     * For each shard, `derive(records, ctx)` runs on that shard's `source`
+     * records and its return value is written into the analytics
+     * (`target.vault` / `target.collection`) vault, keyed by partition key —
+     * one summary row per shard. The derivation runs in-process under THIS
+     * group's `Noydb` (which already holds both the shard and Insight Vault
+     * keyrings); the shard's decrypted records are reduced to a summary that is
+     * re-encrypted under the Insight Vault's own DEK, so no shard ciphertext
+     * crosses a DEK boundary.
+     *
+     * **Zero-knowledge note:** the Insight Vault backend sees aggregated
+     * structure (totals, counts, timestamps) drawn from many shards — a weaker
+     * ZK profile than the per-shard vaults. Opt-in; keep summaries to aggregate
+     * scalars (no embeddings / no raw records).
+     *
+     * v1 is explicit-refresh (no write-path push); call `refreshInsights()`
+     * after a batch of writes, or on a schedule.
+     */
+    withCrossVaultDerivation<R = Record<string, unknown>, S = Record<string, unknown>>(spec: CrossVaultDerivationSpec<R, S>): void;
+    /**
+     * Run every registered {@link withCrossVaultDerivation}: read each eligible
+     * shard's source records, derive a per-shard summary, and write it into the
+     * Insight Vault keyed by partition key. Shards behind `minVersion`,
+     * unprovisioned, or whose read errors are reported in `skippedVaults` and
+     * are not written (a stale summary is never left behind for a failed shard).
+     */
+    refreshInsights(options?: {
+        minVersion?: number;
+        concurrency?: number;
+    }): Promise<RefreshInsightsResult>;
+    /** @internal — the control-plane vault for migration status; lazily opened. */
+    private ensureStateVault;
+    /**
+     * Migrate ONE shard to the template's current version (#271 fleet runner,
+     * per-shard step). Opens the shard (applying the template, which arms the
+     * M12 cutover), drains schema-write detection, runs `vault.runSchemaCutover()`
+     * (the per-vault drain-barrier-transform protocol), then advances the
+     * registry row's `schemaVersion` and records `migration-status`. A shard
+     * already at the template version is a no-op (`status: 'done'`, migrated 0).
+     * Never throws on a cutover failure — it records `status: 'failed'` and
+     * returns the row, so a fleet run continues past a bad shard.
+     */
+    migrateShard(partitionKey: string): Promise<MigrationStatusRow>;
+    /**
+     * Active batch runner (#271): migrate every shard behind the template version
+     * to it, in controlled batches. **Resumable + crash-safe** — shards already at
+     * the target are skipped (the registry version is the source of truth), so a
+     * re-run after a crash only picks up the unfinished + previously-failed shards.
+     *
+     * - `cohort` — restrict to these partition keys (the staged / canary rollout:
+     *   migrate a small cohort, verify the Insight Vault, then run the rest).
+     * - `batchSize` — max shards migrated concurrently per batch (back-pressure).
+     *   Default 4. Batches run sequentially; shards within a batch run in parallel.
+     */
+    migrateFleet(options?: {
+        cohort?: readonly string[];
+        batchSize?: number;
+    }): Promise<FleetMigrationResult>;
 }
 declare class ShardedCollection<T, R = T> {
     private readonly group;
@@ -6862,6 +7024,27 @@ interface RecordOutputSpec {
      * `DerivationOutputShapeError` — same as v1.
      */
     optional?: boolean;
+    /**
+     * Field-level provenance for a **self-write** output (#376) — an output
+     * whose `collection` equals the strategy's `source`, used by
+     * reverse-denormalization (`triggerBy`) to patch a denormalized field
+     * back onto the source record.
+     *
+     * `denorm` names the ONLY top-level fields the derivation owns on that
+     * record. The engine merges just those fields from the `derive` return
+     * value onto the current stored record (`{ ...current, ...pick(out, denorm) }`)
+     * — the rest of the user's record is never clobbered by a stale snapshot.
+     * The whole-record `_derivedFrom` provenance tag is NOT applied (the
+     * record stays user-owned); the derivation only claims `denorm`.
+     *
+     * Cycle break is value-level: if the patch changes nothing, no write is
+     * issued — so the self-write that re-fires the source-path derivation
+     * terminates after one idempotent pass.
+     *
+     * REQUIRED when `collection === source` (validated at construction);
+     * ignored for outputs to a different collection.
+     */
+    denorm?: readonly string[];
 }
 /**
  * Array-shape output — one source row produces a variable-length
@@ -6942,6 +7125,52 @@ interface DerivationStrategy<TSource extends Record<string, unknown>, TOutputs e
      * (validated at `withDerivation()` construction time).
      */
     sources?: ReadonlyArray<string>;
+    /**
+     * Foreign-key-keyed triggers for reverse-denormalization (#376). Unlike
+     * `sources[]` (which re-fires at the SAME id), a `triggerBy` entry fans a
+     * write to a PARENT collection OUT to every source record whose FK matches
+     * the written parent's id.
+     *
+     * `{ collection, on }`: a write to `collection` (the parent, e.g.
+     * `'buyers'`) re-fires this derivation once per source record where
+     * `source[on] === writtenParentId` (`on` is the FK field ON the source,
+     * e.g. `'buyerId'`). The matched source record — not the parent — is
+     * passed to `derive`.
+     *
+     * Typical use: keep a denormalized field on the source in sync with a
+     * parent change (a buyer rename → refresh `buyerName` on all their sales),
+     * via a self-write output (`collection === source`) declaring `denorm`.
+     *
+     * Fan-out runs through `ctx.vault.collection(source).query().where(on,'==',id)`,
+     * which uses the FK index when the source declares `withIndexing()` on
+     * `on` (O(children)) and otherwise scans (O(N) — fine for small child
+     * sets). Set `maxFanout` as a safety rail; exceeding it throws
+     * `DerivationCapExceededError` before any write. `triggerBy` collections
+     * participate in cycle detection like `source`/`sources`.
+     *
+     * Each `collection` must be non-empty and not equal `source`; `on` must
+     * be a non-empty field name (validated at construction).
+     */
+    triggerBy?: ReadonlyArray<{
+        collection: string;
+        on: string;
+        maxFanout?: number;
+    }>;
+    /**
+     * @internal — set by `withRollup()` (#376 slice 2). Marks this strategy as
+     * an aggregate-onto-parent rollup: a write OR delete of a `from` (child)
+     * record recomputes `compute(children where child[key] === parentId)` and
+     * patches it onto `source[field]` of the parent at `parentId` (= child[key]).
+     * `source` is the parent (`into`) collection; the synthetic self-write
+     * output carries `denorm: [field]`. Dispatch handles rollup specially (it
+     * does not run the executor). Eager-only in this slice.
+     */
+    rollup?: {
+        readonly from: string;
+        readonly key: string;
+        readonly field: string;
+        readonly compute: (children: any[]) => unknown;
+    };
     /** v1: only deterministic derivations supported. */
     deterministic: true;
     /**
@@ -7563,7 +7792,43 @@ interface NextOptions {
 interface SequenceOptions {
     /** Partition tuple. Each component is URI-encoded and `'/'`-joined. */
     readonly partition?: readonly (string | number)[];
+    /**
+     * Render template for the serial string (#375). When set, `vault.sequence`
+     * returns a {@link FormattedSequenceHandle} whose `next()` resolves to
+     * `{ serial, formatted }`. Tokens:
+     * - `{seq}` — the allocated integer
+     * - `{seq:0N}` — zero-padded to width N (e.g. `{seq:04}` → `0001`)
+     * - `{partition.i}` — the i-th `partition` component (original value)
+     *
+     * Any other token, or a `{partition.i}` index beyond the supplied
+     * `partition`, throws `ValidationError` at `vault.sequence()` construction.
+     * Per-partition reset is inherent: a new partition tuple starts at 1.
+     */
+    readonly format?: string;
+}
+/**
+ * A formatted sequence handle (#375). Identical to {@link SequenceHandle}
+ * except `next()` also returns the rendered `formatted` string. `peek()` /
+ * `seedTo()` operate on the underlying integer counter, unchanged.
+ */
+interface FormattedSequenceHandle {
+    /** Allocate the next value and return it with its rendered serial string. */
+    next(opts?: NextOptions): Promise<{
+        serial: number;
+        formatted: string;
+    }>;
+    /** Read the current integer value without allocating. Returns 0 if never used. */
+    peek(): Promise<number>;
+    /** Set-if-greater on the underlying integer counter. See {@link SequenceHandle.seedTo}. */
+    seedTo(n: number): Promise<void>;
 }
+/**
+ * Validate a sequence `format` against the supplied partition and return a
+ * pure `(serial) => string` renderer. Eager validation: every token is
+ * checked now, so a bad pattern throws `ValidationError` at construction —
+ * never at `next()` time.
+ */
+declare function compileSequenceFormat(format: string, series: string, partition: readonly (string | number)[] | undefined): (serial: number) => string;
 /**
  * Resolve the CAS storage key for a (series, partition) pair.
  *
@@ -7639,6 +7904,78 @@ interface Assignment {
     serial: number;
 }
 
+/**
+ * `_links_*` reserved collections — managed bidirectional many-to-many
+ * junctions (#377 design B).
+ *
+ * Where `refArray` (design A) stores an id-array on one owning record,
+ * `vault.link()` creates a first-class junction: a dedicated encrypted
+ * `_links_<name>` collection whose rows are `{ a, b, meta? }` link tuples.
+ * It is queryable from BOTH sides (`of(id)`), carries optional per-link
+ * metadata, and cascades on endpoint delete.
+ *
+ * Each link is slot-typed: `a` is an id in the `a` endpoint collection,
+ * `b` an id in the `b` endpoint collection (they may be the same
+ * collection for self-links). A link's identity is the ordered pair
+ * `(a, b)`; `of(id)` matches either slot.
+ *
+ * Rows are encrypted under a dedicated `_links_<name>` DEK — same
+ * zero-knowledge stack as every other collection (the store sees only
+ * ciphertext). Backup/restore rides the normal `loadAll` path.
+ */
+
+/** True for any reserved link-collection name. */
+declare function isLinkCollectionName(name: string): boolean;
+/** What happens to a link's rows when one of its endpoint records is deleted. */
+type LinkOnDelete = 'cascade' | 'strict' | 'warn';
+/**
+ * Declaration for a link set, passed to `vault.link(name, spec)`. `a` and
+ * `b` are the endpoint collection names (slot-typed). `onDelete` governs
+ * what happens to link rows when an endpoint record is deleted:
+ * `'cascade'` (default) removes the touching link rows, `'strict'` blocks
+ * the endpoint delete while links exist, `'warn'` leaves orphan rows
+ * (surfaced by `vault.checkIntegrity()`).
+ */
+interface LinkSpec {
+    readonly a: string;
+    readonly b: string;
+    readonly onDelete?: LinkOnDelete;
+}
+/** One link tuple as returned by `of()` / `list()`. */
+interface LinkRow {
+    readonly a: string;
+    readonly b: string;
+    readonly meta?: Record<string, unknown>;
+}
+/** Public handle returned by `vault.links(name)`. */
+interface LinkSetHandle {
+    /** Create (or overwrite the metadata of) the link `(aId, bId)`. Validates both endpoints exist. */
+    connect(aId: string, bId: string, meta?: Record<string, unknown>): Promise<void>;
+    /** Remove the link `(aId, bId)`. Idempotent — a no-op if it doesn't exist. */
+    disconnect(aId: string, bId: string): Promise<void>;
+    /** Whether the link `(aId, bId)` exists. */
+    has(aId: string, bId: string): Promise<boolean>;
+    /** All links touching `id` on EITHER endpoint. */
+    of(id: string): Promise<LinkRow[]>;
+    /** All links in the set. */
+    list(): Promise<LinkRow[]>;
+}
+/** Thrown by `connect()` when an endpoint record does not exist. */
+declare class LinkEndpointError extends NoydbError {
+    readonly link: string;
+    readonly endpoint: string;
+    readonly missingId: string;
+    constructor(link: string, endpoint: string, missingId: string);
+}
+/** Thrown when a `strict` link blocks deletion of an endpoint that still has links. */
+declare class LinkIntegrityError extends NoydbError {
+    readonly link: string;
+    readonly endpoint: string;
+    readonly id: string;
+    readonly count: number;
+    constructor(link: string, endpoint: string, id: string, count: number);
+}
+
 /**
  * Vault-internal singleton that holds the guard graph and dispatches
  * per-collection guard execution. Owned by `Vault`; not exported.
@@ -7708,12 +8045,25 @@ declare class GuardRegistry {
 
 /**
  * Minimal read-only wrapper over a `Vault`. Used as `ctx.vault` inside
- * guard callbacks so they can fetch related records without acquiring
- * any write capability.
+ * guard / derivation callbacks so they can fetch related records without
+ * acquiring any write capability.
+ *
+ * The `layer` tags every `get`/`list` read with the resolution layer it
+ * belongs to (#285). A guard-seeded facade reads at `'guard'`, a
+ * derivation-seeded one at `'derivation'`, so i18nText / dictKey fields
+ * resolve under that layer's `onMissing` policy instead of the `'read'`
+ * policy — e.g. a guard read can `substitute` a missing locale (lenient
+ * default) while the same field `throw`s on an ordinary app read.
+ *
+ * `query()` is left untagged: the query/aggregate pipeline reads raw
+ * `{locale}` maps (no resolution call site), so a layer tag there would be
+ * inert. Routing `mv`/`join` resolution through the pipeline is tracked
+ * separately (#285 D2/D3).
  */
 declare class ReadOnlyVaultFacade implements ReadOnlyVaultFacade$1 {
     private readonly _vault;
-    constructor(vault: Vault);
+    private readonly _layer;
+    constructor(vault: Vault, layer?: Layer);
     collection<T = unknown>(name: string): {
         get(id: string): Promise<T | null>;
         list(): Promise<T[]>;
@@ -8910,13 +9260,17 @@ declare class Vault {
      */
     private overlayedViewRegistry;
     /**
-     * Cached read-only facade handed to guard callbacks via `ctx.vault`,
-     * and to derivation callbacks via `derive(source, ctx)`. Allocated
-     * eagerly inside `_initGuards()` and/or `_initDerivations()` so read
+     * Cached read-only facades handed to guard callbacks via `ctx.vault`
+     * and to derivation callbacks via `derive(source, ctx)`. Split by
+     * resolution layer (#285): the guard facade reads at `layer:'guard'`,
+     * the derivation facade at `layer:'derivation'`, so i18nText / dictKey
+     * fields resolve under that layer's `onMissing` policy. Allocated
+     * eagerly inside `_initGuards()` / `_initDerivations()` so read
      * accessors stay synchronous (callers in `tx/transaction.ts` rely on
-     * that). Stays `null` for vaults with neither subsystem configured.
+     * that). Each stays `null` for vaults without that subsystem.
      */
-    private readOnlyFacade;
+    private guardFacade;
+    private derivationFacade;
     private getDEK;
     /**
      * Per-principal user envelope API.
@@ -9073,6 +9427,10 @@ declare class Vault {
     private readonly i18nFieldRegistry;
     /** Cache of DictionaryHandle instances, one per dictionary name. */
     private readonly dictionaryCache;
+    /** Registered link specs (#377-B), keyed by link name; set by `vault.link()`. */
+    private readonly linkRegistry;
+    /** Cache of LinkSet handles, one per link name. */
+    private readonly linkSetCache;
     /** — subscribers for cross-tier access events. */
     private readonly crossTierSubs;
     /** — currently-active elevation, or null. One per vault. */
@@ -9232,6 +9590,17 @@ declare class Vault {
         schemaUpdate?: readonly SchemaUpdateStrategy[];
         /** — declare the per-field schema for document attestation (issue side). */
         attestation?: AttestationFieldSchema;
+        /**
+         * Per-collection history & tamper-ledger scoping. Overrides the
+         * vault-wide `history` config for THIS collection only (wholesale, not
+         * merged). `enabled: false` suppresses per-record snapshots for this
+         * collection; `ledger: false` excludes its writes from the vault-wide
+         * hash-chained tamper ledger. Lets you confine version snapshots +
+         * tamper-evidence to the few collections where they carry legal weight,
+         * without paying snapshot + ledger-entry-per-write across operational /
+         * derived collections. Defaults to the vault-wide `history` config. See #361.
+         */
+        historyConfig?: HistoryConfig;
     }): Collection<T>;
     /**
      * Await all background persisted-schema writes triggered by
@@ -9318,6 +9687,32 @@ declare class Vault {
      * ```
      */
     dictionary<Keys extends string = string>(name: string, options?: DictionaryOptions): DictionaryHandle<Keys>;
+    /**
+     * Declare a managed many-to-many link set (#377-B). Registers a
+     * `_links_<name>` junction between two endpoint collections; access its
+     * rows via `vault.links(name)`. Idempotent for an identical re-declaration;
+     * a conflicting one throws. See {@link links}.
+     *
+     * ```ts
+     * vault.link('saleLineLinks', { a: ref('saleLines'), b: ref('purchaseLines'), onDelete: 'cascade' })
+     * ```
+     *
+     * `a` / `b` accept either a collection name or a `ref(target)` descriptor
+     * (only its `target` is used — links manage their own integrity). `onDelete`
+     * governs what happens to link rows when an endpoint record is deleted
+     * (`'cascade'` default, `'strict'`, `'warn'`).
+     */
+    link(name: string, spec: {
+        a: string | RefDescriptor;
+        b: string | RefDescriptor;
+        onDelete?: LinkSpec['onDelete'];
+    }): void;
+    /**
+     * Access a declared link set (#377-B). Throws if `name` was not first
+     * declared via {@link link}. Returns a cached {@link LinkSetHandle}:
+     * `connect(a, b, meta?)`, `disconnect(a, b)`, `has(a, b)`, `of(id)`, `list()`.
+     */
+    links(name: string): LinkSetHandle;
     /**
      * Build a `JoinableSource` for a dictKey field, for use in dict joins
      *. Returns a source whose snapshot contains `{ key, ...labels }`
@@ -9473,7 +9868,19 @@ declare class Vault {
      * const n = await vault.sequence('invoice-2026').next()   // 1, then 2, …
      * const cur = await vault.sequence('invoice-2026').peek()  // current value, no allocation
      * ```
+     *
+     * Pass a `format` (#375) to emit a serial string instead of a bare
+     * integer — `next()` then returns `{ serial, formatted }`. Per-partition
+     * reset is inherent (a new partition tuple starts at 1):
+     *
+     * ```ts
+     * const seq = vault.sequence('fatture', { partition: [2026], format: '{partition.0}/{seq:04}' })
+     * await seq.next()   // { serial: 1, formatted: '2026/0001' }
+     * ```
      */
+    sequence(series: string, opts: SequenceOptions & {
+        format: string;
+    }): FormattedSequenceHandle;
     sequence(series: string, opts?: SequenceOptions): SequenceHandle;
     /** @internal — lazily build the deferred-numbering engine with a cache-coherent stamp. */
     private deferred;
@@ -9566,6 +9973,13 @@ declare class Vault {
      * mutually-cascading collections don't recurse forever.
      */
     enforceRefsOnDelete(collectionName: string, id: string): Promise<void>;
+    /**
+     * @internal — apply link `onDelete` policy when an endpoint record is
+     * deleted (#377-B). `'strict'` throws (blocks the delete), `'cascade'`
+     * removes the touching link rows (tx-atomic when a transaction is active),
+     * `'warn'` leaves orphans for `checkIntegrity()`.
+     */
+    private enforceLinksOnDelete;
     /**
      * Look up the `RefDescriptor` the left collection declared for a
      * given field name. Returns `null` when the field has no ref
@@ -9826,9 +10240,10 @@ declare class Vault {
      */
     _getReadOnlyFacade(): ReadOnlyVaultFacade | null;
     /**
-     * Internal lazy-allocator for the read-only facade. Used as a
-     * defensive fallback; in practice `_initGuards()` eagerly
-     * instantiates this, so the lazy path is a no-op.
+     * Internal lazy-allocator for the derivation read-only facade
+     * (`layer:'derivation'`). Used as a defensive fallback; in practice
+     * `_initDerivations()` eagerly instantiates this, so the lazy path is
+     * a no-op.
      */
     private _ensureReadOnlyFacade;
     /**
@@ -11216,6 +11631,34 @@ declare class Collection<T> {
      * output (carries `_derivedFrom`) — defensive guard against missed
      * cycle detection.
      */
+    /**
+     * @internal #376 — the RAW stored record (canonical-money form, i18n maps
+     * intact), WITHOUT the locale resolution `get()` applies. Used as the
+     * patch base for self-write reverse-denorm so writing back never clobbers
+     * an i18n map or re-quantizes money incorrectly. Returns null for
+     * missing / tombstoned records.
+     */
+    _getStoredRecord(id: string): Promise<T | null>;
+    /**
+     * @internal #376 — ids of records whose top-level `field` equals `value`.
+     * Uses the FK index when the field is indexed (O(matches)); otherwise a
+     * linear scan (O(N) — fine for small child sets; index the FK to scale).
+     */
+    _findMatchingIds(field: string, value: unknown): Promise<string[]>;
+    /**
+     * @internal #376 slice 2 — recompute a rollup aggregate onto the parent.
+     * Gathers every child of `parentId`, runs `compute`, and patches only the
+     * rollup `field` onto the parent's raw stored record (value-equality
+     * guarded). No-op when the parent record does not exist.
+     */
+    private recomputeRollup;
+    /**
+     * @internal #376 slice 2 — fire any rollups for which THIS collection is the
+     * child `from`, recomputing the affected parent after a child delete. Called
+     * from the delete path with the just-removed record's key value. Other
+     * derivation kinds do not react to deletes (unchanged).
+     */
+    private dispatchRollupsOnDelete;
     private dispatchDerivations;
     /**
      * Delete a record by ID. Runs inside the hub's write-queue tracker
@@ -13403,6 +13846,15 @@ interface LocaleReadOptions {
      * element to fall back to any present translation.
      */
     readonly fallback?: string | readonly string[];
+    /**
+     * @internal — the resolution layer this read belongs to (`'read'` by
+     * default). Threaded by layer-tagged read facades (guard / derivation)
+     * so `applyI18nLocale` and dictKey `resolvePolicy` select that layer's
+     * `onMissing` policy instead of the `'read'` policy. Not part of the
+     * public read API — callers select policy via the field's `onMissing`
+     * map, not by setting this. See #285.
+     */
+    readonly _layer?: Layer;
 }
 /**
  * Context passed to the consumer-supplied `plaintextTranslator` function.
@@ -14095,6 +14547,16 @@ interface HistoryConfig {
     readonly enabled?: boolean;
     /** Maximum history entries per record. Oldest pruned on overflow. Default: unlimited. */
     readonly maxVersions?: number;
+    /**
+     * Participate in the vault-wide hash-chained tamper ledger. Default:
+     * `true` (every write of this collection appends a ledger entry when
+     * `withHistory()` is active). Set `false` to exclude this collection's
+     * writes from the chain — its puts/deletes leave no ledger entry,
+     * confining tamper-evidence to the collections where it carries weight.
+     * Independent of `enabled`, which gates per-record snapshots. Has no
+     * effect when `withHistory()` is not active (there is no ledger). See #361.
+     */
+    readonly ledger?: boolean;
 }
 /** Options for querying history. */
 interface HistoryOptions {
@@ -14163,4 +14625,4 @@ interface DeleteManyResult {
     }>;
 }
 
-export { DEFAULT_CHUNK_SIZE as $, createEnforcer as A, validateSessionPolicy as B, type BlobStrategy as C, DICT_COLLECTION_PREFIX as D, BLOB_CHUNKS_COLLECTION as E, BLOB_COLLECTION as F, BLOB_EVICTION_AUDIT_COLLECTION as G, BLOB_INDEX_COLLECTION as H, type I18nStrategy as I, BLOB_SLOTS_PREFIX as J, BLOB_VERSIONS_PREFIX as K, type Layer as L, type BlobEvictionEntry as M, type BlobFieldPolicy as N, type OnMissing as O, PolicyEnforcer as P, type BlobFieldsConfig as Q, type ResolveI18nOptions as R, type ScriptWarning as S, type BlobObject as T, type BlobPutOptions as U, type BlobResponseOptions as V, BlobSet as W, type BlobStrategyOpenArgs as X, type CompactRunOptions as Y, type CompactionContext as Z, type CompactionResult as _, type DictEntry as a, type Role as a$, EXPORT_AUDIT_COLLECTION as a0, ExportBlobsAbortedError as a1, type ExportBlobsAuditEntry as a2, type ExportBlobsHandle as a3, type ExportBlobsOptions as a4, type ExportedBlob as a5, type SlotInfo as a6, type SlotRecord as a7, type VersionRecord as a8, createExportBlobsHandle as a9, ReadOnlyVaultFacade as aA, type ShadowStrategy as aB, CollectionFrame as aC, VaultFrame as aD, type NoydbBundleStore as aE, type RetentionPolicy as aF, type SnapshotPolicy as aG, type SnapshotStrategy as aH, type SnapshotMeta as aI, type SnapshotMode as aJ, type DerivationStrategy as aK, type DerivationContext as aL, type ArrayOutputSpec as aM, DerivationRegistry as aN, type DerivationStrategyHandle as aO, type DerivedFromMeta as aP, type OutputSpec as aQ, type RecordOutputSpec as aR, type MaterializedViewStrategy as aS, type MaterializedViewStrategyHandle as aT, type OverlayedViewStrategy as aU, Collection as aV, type OverlayFieldMergeMode as aW, type OverlayFieldMergeRule as aX, OverlayedViewRegistry as aY, type OverlayedViewStrategyHandle as aZ, type SyncStrategy as a_, runCompaction as aa, type ConsentStrategy as ab, CONSENT_AUDIT_COLLECTION as ac, type ConsentAuditEntry as ad, type ConsentAuditFilter as ae, type ConsentContext as af, type ConsentOp as ag, loadConsentEntries as ah, writeConsentEntry as ai, type PeriodsStrategy as aj, type CarryForwardContext as ak, type ClosePeriodOptions as al, type OpenPeriodOptions as am, PERIODS_COLLECTION as an, type PeriodRecord as ao, type ReadOnlyCollection as ap, appendPeriodLedgerEntry as aq, assertTsWritable as ar, chainAnchor as as, loadPeriods as at, validatePeriodName as au, type GuardStrategy as av, type GuardChange as aw, type GuardContext as ax, GuardRegistry as ay, type GuardStrategyHandle as az, type DictKeyDescriptor as b, type CollectionStats as b$, type UnlockedKeyring as b0, type HistoryStrategy as b1, type NoydbStore as b2, type HistoryOptions as b3, type EncryptedEnvelope as b4, type PruneOptions as b5, type AppendInput as b6, type ChangeType as b7, CollectionInstant as b8, type DiffEntry as b9, type UserEnvelope as bA, type GateName as bB, type GatePolicy as bC, type VaultPolicy as bD, type ActiveTier as bE, type FactorProof as bF, type SchemaUpdateStrategy as bG, type TransformFn as bH, type PersistedSchemaEnvelope as bI, type UpdateDecision as bJ, type DirectoryConfig as bK, type UserVisibility as bL, type AccessibleVault as bM, type AffectedDocument as bN, type ArchivePolicy as bO, type ArchiveResult as bP, type ArchiveRunOptions as bQ, type ArchiveStrategy as bR, BUNDLE_STORE_POLICY as bS, type BuiltInGateName as bT, type CacheOptions as bU, type CacheStats as bV, type CapturedBlueprint as bW, type ChangeEvent as bX, type CollectionChangeEvent as bY, type CollectionConflictResolver as bZ, type CollectionDescriptor as b_, type JsonPatch as ba, type JsonPatchOp as bb, LedgerStore as bc, type VaultEngine as bd, VaultInstant as be, type VerifyResult as bf, applyPatch as bg, computePatch as bh, diff as bi, formatDiff as bj, type PublicEnvelope as bk, type SealingKeyProvider as bl, type BundleRecipient as bm, type RecipientSealer as bn, type RecipientHint as bo, Vault as bp, type RecoveryEnrollmentInput as bq, type ShamirRecoveryProvider as br, TxContext as bs, type MVQueryContext as bt, type RegisteredMV as bu, MaterializedViewRegistry as bv, type MaterializedFromMeta as bw, type MaterializedViewOutput as bx, type UnionArmJoin as by, type UnionSource as bz, DictionaryHandle as c, type LiveUserEnvelope as c$, ComputedFieldError as c0, type ComputedFields as c1, type ComputedFn as c2, type Conflict as c3, type ConflictPolicy as c4, type ConflictStrategy as c5, type CrossTierAccessEvent as c6, CrossVaultAggregation as c7, CrossVaultGroupedAggregation as c8, type GroupedRow as c9, type FactorRequirement as cA, type FanoutQueryOptions as cB, type FanoutResult as cC, type FenceDoc as cD, type FenceState as cE, type FieldChange as cF, type FieldDescriptor as cG, type FieldSource as cH, type GhostRecord as cI, type GrantOptions as cJ, type GuardViolation as cK, type HistoryConfig as cL, type HistoryEntry as cM, INDEXED_STORE_POLICY as cN, type ImportCapability as cO, type InferOutput as cP, type InternalCollectionStats as cQ, type IssueDelegationOptions as cR, type IssueMagicLinkGrantOptions as cS, type KeyringAuthenticator as cT, type KeyringAuthenticatorWrappingDEKs as cU, type KeyringAuthenticatorWrappingKEK as cV, type KeyringFile as cW, type ListAccessibleVaultsOptions as cX, type ListPageResult as cY, type ListUsersOptions as cZ, type LiveQueryOptions as c_, type CrossVaultLiveAggregation as ca, type CrossVaultLiveQuery as cb, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as cc, DELEGATIONS_COLLECTION as cd, type DeepPartial as ce, type DeepPartialOrNull as cf, type DeferredNumberingConfig as cg, type DelegationToken as ch, type DeleteManyResult as ci, type DeploymentEvent as cj, type DerivationDescriptor as ck, type DirtyEntry as cl, type DryRunResult as cm, type DumpSchemaOptions as cn, ELEVATION_AUDIT_COLLECTION as co, ElevatedHandle as cp, type EnrollAuthenticatorOptions as cq, type EnrollAuthenticatorWrappingDEKsOptions as cr, type EnrollAuthenticatorWrappingKEKOptions as cs, type EnrollRecoveryResult as ct, type ExportCapability as cu, type ExportChunk as cv, type ExportFormat as cw, type ExportStreamOptions as cx, type FactorKind as cy, type FactorProofBundle as cz, type DictionaryOptions as d, SEALED_PASSPHRASE_RECORD_ID as d$, type LocaleReadOptions as d0, Lru as d1, type LruOptions as d2, type LruStats as d3, MAGIC_LINK_CONTENT_INFO_PREFIX as d4, MAGIC_LINK_GRANTS_COLLECTION as d5, MAGIC_LINK_KEK_INFO_PREFIX as d6, type MagicLinkGrantPayload as d7, type MagicLinkGrantRecord as d8, type MaterializedViewDescriptor as d9, type PublicEnvelopeSchema as dA, type PublicEnvelopeText as dB, type PullMode as dC, type PullOptions as dD, type PullPolicy as dE, type PullResult as dF, type PushMode as dG, type PushOptions as dH, type PushPolicy as dI, type PushResult as dJ, type PutManyItemOptions as dK, type PutManyOptions as dL, type PutManyResult as dM, type QueryAcrossOptions as dN, type QueryAcrossResult as dO, type QuickUnlockState as dP, QuickUnlockStore as dQ, type ReAuthOperation as dR, type RecoverPassphraseInput as dS, type RecoverPassphraseResult as dT, type RecoverUserOptions as dU, type RecoveryProof as dV, type ResolvedPublicEnvelopeSchema as dW, type RevokeOptions as dX, type RotatePassphraseInput as dY, type RotateRecoveryOptions as dZ, type RotateRecoveryResult as d_, MemoryRecipientSealer as da, MemorySealingKeyProvider as db, NOYDB_BACKUP_VERSION as dc, NOYDB_FORMAT_VERSION as dd, NOYDB_KEYRING_VERSION as de, NOYDB_SYNC_VERSION as df, type NextOptions as dg, Noydb as dh, type NoydbEventMap as di, type NoydbOptions as dj, type Assignment as dk, type OverlayViewDescriptor as dl, PUBLIC_ENVELOPE_FIELDS as dm, type PaperRecoveryDoc as dn, type PaperRecoveryEntry as dp, type PassphrasePolicy as dq, type PassphraseValidationResult as dr, type Permission as ds, type Permissions as dt, type PersistedSchemaKind as du, type PlaintextTranslatorContext as dv, type PlaintextTranslatorFn as dw, PresenceHandle as dx, type PresencePeer as dy, type PublicEnvelopeField as dz, type I18nMap as e, type VaultRegistryRow as e$, type SchemaDelta as e0, type SchemaIntrospection as e1, type SchemaManifestRow as e2, type SealedEnvelope as e3, type SealedPassphrase as e4, type SequenceHandle as e5, type SequenceOptions as e6, SequenceStore as e7, type SessionPolicy as e8, type SetPublicEnvelopeInput as e9, type SyncTransactionResult as eA, type TabChannel as eB, type TabCoordinationOptions as eC, type TabLockManager as eD, type TabPresence as eE, type TabRole as eF, type TierMode as eG, type TransactionInvariant as eH, type TranslatorAuditEntry as eI, TxCollection as eJ, type TxOp as eK, TxVault as eL, USER_ENVELOPE_COLLECTION as eM, USER_ENVELOPE_MAX_BYTES as eN, type Unsubscribe as eO, type UpdateAuthenticatorOptions as eP, type UpdateContext as eQ, type UpdateUserOptions as eR, UserApi as eS, type UserEnvelopeCheckGate as eT, UserEnvelopeOversizedError as eU, type UserEnvelopePresented as eV, type UserInfo as eW, type VaultBackup as eX, VaultGroup as eY, type VaultGroupOptions as eZ, type VaultPolicyOnDisk as e_, type ShamirRecoveryDoc as ea, type ShamirRecoveryEntry as eb, ShardedCollection as ec, ShardedGroupedQuery as ed, ShardedQuery as ee, type ShardingConfig as ef, type SkippedVault as eg, type SlotRewrapCeremony as eh, type SlotRewrapContext as ei, type StandardSchemaV1 as ej, type StandardSchemaV1Issue as ek, type StandardSchemaV1SyncResult as el, StateManagementVault as em, type StoreAuth as en, type StoreAuthKind as eo, type StoreCapabilities as ep, type StoreTime as eq, SyncEngine as er, type SyncMetadata as es, type SyncPolicy as et, SyncScheduler as eu, type SyncSchedulerStatus as ev, type SyncStatus as ew, type SyncTarget as ex, type SyncTargetRole as ey, SyncTransaction as ez, type I18nTextDescriptor as f, validatePublicEnvelopeInput as f$, type VaultSchemaSnapshot as f0, type VaultSnapshot as f1, type VaultTemplate as f2, type WarningRules as f3, WeakPassphraseError as f4, type WeakPassphraseReason as f5, type WithArchiveOptions as f6, type WrappedDeksBlob as f7, type WriteConflict as f8, type WriteEvent as f9, loadActiveDelegations as fA, loadPaperRecoveryEntries as fB, loadSealedPassphrase as fC, loadShamirRecoveryEntries as fD, magicLinkGrantRecordId as fE, mintPaperRecoveryEntry as fF, mintShamirRecoveryEntry as fG, mintWrappedDeksBlob as fH, parseRsaOaepTlv as fI, parseSealedEnvelope as fJ, readMagicLinkGrantRecord as fK, recoverUser as fL, removeAuthenticator as fM, resolveSchema as fN, resolveSequenceKey as fO, revokeDelegation as fP, revokeMagicLinkGrant as fQ, runTransaction as fR, savePaperRecoveryEntries as fS, saveSealedPassphrase as fT, saveShamirRecoveryEntries as fU, sealRsaOaepTlv as fV, unwrapDeksFromBlob as fW, unwrapDeksFromPaperEntry as fX, unwrapDeksFromShamirEntry as fY, unwrapMagicLinkGrant as fZ, validatePassphrase as f_, type WriteHook as fa, type WriteQueue as fb, aesGcmOpen as fc, assertStrongPassphrase as fd, buildRecipientKeyringFile as fe, burnPaperRecoveryEntry as ff, createNoydb as fg, createStore as fh, deriveMagicLinkContentKey as fi, enrollAuthenticator as fj, estimateEntropy as fk, evalComputedFields as fl, evaluateExportCapability as fm, evaluateImportCapability as fn, findAuthenticator as fo, hasExportCapability as fp, hasImportCapability as fq, hasRecoveryEnrolled as fr, isMagicLinkGrantExpired as fs, isPublicEnvelope as ft, issueDelegation as fu, recoverPassphrase as fv, rotatePassphrase as fw, listMagicLinkGrants as fx, listUsers as fy, listUsersWithEnvelopes as fz, type I18nTextOptions as g, validateSchemaInput as g0, validateSchemaOutput as g1, withArchive as g2, withDeferredNumbering as g3, writeMagicLinkGrant as g4, changeSecret as g5, createOwnerKeyring as g6, ensureCollectionDEK as g7, grant as g8, loadKeyring as g9, persistKeyring as ga, revoke as gb, updateAuthenticator as gc, updateKeyringIdentity as gd, type TxStrategy as ge, type AmendmentTxOptions as gf, type OnMissingPolicy as h, type StaticDictDescriptor as i, applyI18nLocale as j, dictCollectionName as k, dictKey as l, enforceScript as m, getAtPath as n, i18nText as o, inferScripts as p, isDictCollectionName as q, isDictKeyDescriptor as r, isI18nTextDescriptor as s, isStaticDictDescriptor as t, resolveI18nText as u, resolvePolicy as v, setAtPathInPlace as w, staticDict as x, validateI18nTextValue as y, type SessionStrategy as z };
+export { DEFAULT_CHUNK_SIZE as $, createEnforcer as A, validateSessionPolicy as B, type BlobStrategy as C, DICT_COLLECTION_PREFIX as D, BLOB_CHUNKS_COLLECTION as E, BLOB_COLLECTION as F, BLOB_EVICTION_AUDIT_COLLECTION as G, BLOB_INDEX_COLLECTION as H, type I18nStrategy as I, BLOB_SLOTS_PREFIX as J, BLOB_VERSIONS_PREFIX as K, type Layer as L, type BlobEvictionEntry as M, type BlobFieldPolicy as N, type OnMissing as O, PolicyEnforcer as P, type BlobFieldsConfig as Q, type ResolveI18nOptions as R, type ScriptWarning as S, type BlobObject as T, type BlobPutOptions as U, type BlobResponseOptions as V, BlobSet as W, type BlobStrategyOpenArgs as X, type CompactRunOptions as Y, type CompactionContext as Z, type CompactionResult as _, type DictEntry as a, type Role as a$, EXPORT_AUDIT_COLLECTION as a0, ExportBlobsAbortedError as a1, type ExportBlobsAuditEntry as a2, type ExportBlobsHandle as a3, type ExportBlobsOptions as a4, type ExportedBlob as a5, type SlotInfo as a6, type SlotRecord as a7, type VersionRecord as a8, createExportBlobsHandle as a9, ReadOnlyVaultFacade as aA, type ShadowStrategy as aB, CollectionFrame as aC, VaultFrame as aD, type NoydbBundleStore as aE, type RetentionPolicy as aF, type SnapshotPolicy as aG, type SnapshotStrategy as aH, type SnapshotMeta as aI, type SnapshotMode as aJ, type DerivationStrategy as aK, type DerivationContext as aL, type ArrayOutputSpec as aM, DerivationRegistry as aN, type DerivationStrategyHandle as aO, type DerivedFromMeta as aP, type OutputSpec as aQ, type RecordOutputSpec as aR, type MaterializedViewStrategy as aS, type MaterializedViewStrategyHandle as aT, type OverlayedViewStrategy as aU, Collection as aV, type OverlayFieldMergeMode as aW, type OverlayFieldMergeRule as aX, OverlayedViewRegistry as aY, type OverlayedViewStrategyHandle as aZ, type SyncStrategy as a_, runCompaction as aa, type ConsentStrategy as ab, CONSENT_AUDIT_COLLECTION as ac, type ConsentAuditEntry as ad, type ConsentAuditFilter as ae, type ConsentContext as af, type ConsentOp as ag, loadConsentEntries as ah, writeConsentEntry as ai, type PeriodsStrategy as aj, type CarryForwardContext as ak, type ClosePeriodOptions as al, type OpenPeriodOptions as am, PERIODS_COLLECTION as an, type PeriodRecord as ao, type ReadOnlyCollection as ap, appendPeriodLedgerEntry as aq, assertTsWritable as ar, chainAnchor as as, loadPeriods as at, validatePeriodName as au, type GuardStrategy as av, type GuardChange as aw, type GuardContext as ax, GuardRegistry as ay, type GuardStrategyHandle as az, type DictKeyDescriptor as b, type CollectionStats as b$, type UnlockedKeyring as b0, type HistoryStrategy as b1, type NoydbStore as b2, type HistoryOptions as b3, type EncryptedEnvelope as b4, type PruneOptions as b5, type AppendInput as b6, type ChangeType as b7, CollectionInstant as b8, type DiffEntry as b9, type UserEnvelope as bA, type GateName as bB, type GatePolicy as bC, type VaultPolicy as bD, type ActiveTier as bE, type FactorProof as bF, type SchemaUpdateStrategy as bG, type TransformFn as bH, type PersistedSchemaEnvelope as bI, type UpdateDecision as bJ, type DirectoryConfig as bK, type UserVisibility as bL, type AccessibleVault as bM, type AffectedDocument as bN, type ArchivePolicy as bO, type ArchiveResult as bP, type ArchiveRunOptions as bQ, type ArchiveStrategy as bR, BUNDLE_STORE_POLICY as bS, type BuiltInGateName as bT, type CacheOptions as bU, type CacheStats as bV, type CapturedBlueprint as bW, type ChangeEvent as bX, type CollectionChangeEvent as bY, type CollectionConflictResolver as bZ, type CollectionDescriptor as b_, type JsonPatch as ba, type JsonPatchOp as bb, LedgerStore as bc, type VaultEngine as bd, VaultInstant as be, type VerifyResult as bf, applyPatch as bg, computePatch as bh, diff as bi, formatDiff as bj, type PublicEnvelope as bk, type SealingKeyProvider as bl, type BundleRecipient as bm, type RecipientSealer as bn, type RecipientHint as bo, Vault as bp, type RecoveryEnrollmentInput as bq, type ShamirRecoveryProvider as br, TxContext as bs, type MVQueryContext as bt, type RegisteredMV as bu, MaterializedViewRegistry as bv, type MaterializedFromMeta as bw, type MaterializedViewOutput as bx, type UnionArmJoin as by, type UnionSource as bz, DictionaryHandle as c, LinkEndpointError as c$, ComputedFieldError as c0, type ComputedFields as c1, type ComputedFn as c2, type Conflict as c3, type ConflictPolicy as c4, type ConflictStrategy as c5, type CrossTierAccessEvent as c6, CrossVaultAggregation as c7, type CrossVaultDerivationContext as c8, type CrossVaultDerivationSpec as c9, type FactorKind as cA, type FactorProofBundle as cB, type FactorRequirement as cC, type FanoutQueryOptions as cD, type FanoutResult as cE, type FenceDoc as cF, type FenceState as cG, type FieldChange as cH, type FieldDescriptor as cI, type FieldSource as cJ, type FleetMigrationResult as cK, type FormattedSequenceHandle as cL, type GhostRecord as cM, type GrantOptions as cN, type GuardViolation as cO, type HistoryConfig as cP, type HistoryEntry as cQ, INDEXED_STORE_POLICY as cR, type ImportCapability as cS, type InferOutput as cT, type InternalCollectionStats as cU, type IssueDelegationOptions as cV, type IssueMagicLinkGrantOptions as cW, type KeyringAuthenticator as cX, type KeyringAuthenticatorWrappingDEKs as cY, type KeyringAuthenticatorWrappingKEK as cZ, type KeyringFile as c_, CrossVaultGroupedAggregation as ca, type GroupedRow as cb, type CrossVaultLiveAggregation as cc, type CrossVaultLiveQuery as cd, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as ce, DELEGATIONS_COLLECTION as cf, type DeepPartial as cg, type DeepPartialOrNull as ch, type DeferredNumberingConfig as ci, type DelegationToken as cj, type DeleteManyResult as ck, type DeploymentEvent as cl, type DerivationDescriptor as cm, type DirtyEntry as cn, type DryRunResult as co, type DumpSchemaOptions as cp, ELEVATION_AUDIT_COLLECTION as cq, ElevatedHandle as cr, type EnrollAuthenticatorOptions as cs, type EnrollAuthenticatorWrappingDEKsOptions as ct, type EnrollAuthenticatorWrappingKEKOptions as cu, type EnrollRecoveryResult as cv, type ExportCapability as cw, type ExportChunk as cx, type ExportFormat as cy, type ExportStreamOptions as cz, type DictionaryOptions as d, QuickUnlockStore as d$, LinkIntegrityError as d0, type LinkOnDelete as d1, type LinkRow as d2, type LinkSetHandle as d3, type LinkSpec as d4, type ListAccessibleVaultsOptions as d5, type ListPageResult as d6, type ListUsersOptions as d7, type LiveQueryOptions as d8, type LiveUserEnvelope as d9, type PaperRecoveryEntry as dA, type PassphrasePolicy as dB, type PassphraseValidationResult as dC, type Permission as dD, type Permissions as dE, type PersistedSchemaKind as dF, type PlaintextTranslatorContext as dG, type PlaintextTranslatorFn as dH, PresenceHandle as dI, type PresencePeer as dJ, type PublicEnvelopeField as dK, type PublicEnvelopeSchema as dL, type PublicEnvelopeText as dM, type PullMode as dN, type PullOptions as dO, type PullPolicy as dP, type PullResult as dQ, type PushMode as dR, type PushOptions as dS, type PushPolicy as dT, type PushResult as dU, type PutManyItemOptions as dV, type PutManyOptions as dW, type PutManyResult as dX, type QueryAcrossOptions as dY, type QueryAcrossResult as dZ, type QuickUnlockState as d_, type LocaleReadOptions as da, Lru as db, type LruOptions as dc, type LruStats as dd, MAGIC_LINK_CONTENT_INFO_PREFIX as de, MAGIC_LINK_GRANTS_COLLECTION as df, MAGIC_LINK_KEK_INFO_PREFIX as dg, type MagicLinkGrantPayload as dh, type MagicLinkGrantRecord as di, type MaterializedViewDescriptor as dj, MemoryRecipientSealer as dk, MemorySealingKeyProvider as dl, type MigrationStatusRow as dm, NOYDB_BACKUP_VERSION as dn, NOYDB_FORMAT_VERSION as dp, NOYDB_KEYRING_VERSION as dq, NOYDB_SYNC_VERSION as dr, type NextOptions as ds, Noydb as dt, type NoydbEventMap as du, type NoydbOptions as dv, type Assignment as dw, type OverlayViewDescriptor as dx, PUBLIC_ENVELOPE_FIELDS as dy, type PaperRecoveryDoc as dz, type I18nMap as e, type UpdateAuthenticatorOptions as e$, type ReAuthOperation as e0, type RecoverPassphraseInput as e1, type RecoverPassphraseResult as e2, type RecoverUserOptions as e3, type RecoveryProof as e4, type RefreshInsightsResult as e5, type ResolvedPublicEnvelopeSchema as e6, type RevokeOptions as e7, type RotatePassphraseInput as e8, type RotateRecoveryOptions as e9, type StoreAuthKind as eA, type StoreCapabilities as eB, type StoreTime as eC, SyncEngine as eD, type SyncMetadata as eE, type SyncPolicy as eF, SyncScheduler as eG, type SyncSchedulerStatus as eH, type SyncStatus as eI, type SyncTarget as eJ, type SyncTargetRole as eK, SyncTransaction as eL, type SyncTransactionResult as eM, type TabChannel as eN, type TabCoordinationOptions as eO, type TabLockManager as eP, type TabPresence as eQ, type TabRole as eR, type TierMode as eS, type TransactionInvariant as eT, type TranslatorAuditEntry as eU, TxCollection as eV, type TxOp as eW, TxVault as eX, USER_ENVELOPE_COLLECTION as eY, USER_ENVELOPE_MAX_BYTES as eZ, type Unsubscribe as e_, type RotateRecoveryResult as ea, SEALED_PASSPHRASE_RECORD_ID as eb, type SchemaDelta as ec, type SchemaIntrospection as ed, type SchemaManifestRow as ee, type SealedEnvelope as ef, type SealedPassphrase as eg, type SequenceHandle as eh, type SequenceOptions as ei, SequenceStore as ej, type SessionPolicy as ek, type SetPublicEnvelopeInput as el, type ShamirRecoveryDoc as em, type ShamirRecoveryEntry as en, ShardedCollection as eo, ShardedGroupedQuery as ep, ShardedQuery as eq, type ShardingConfig as er, type SkippedVault as es, type SlotRewrapCeremony as et, type SlotRewrapContext as eu, type StandardSchemaV1 as ev, type StandardSchemaV1Issue as ew, type StandardSchemaV1SyncResult as ex, StateManagementVault as ey, type StoreAuth as ez, type I18nTextDescriptor as f, resolveSchema as f$, type UpdateContext as f0, type UpdateUserOptions as f1, UserApi as f2, type UserEnvelopeCheckGate as f3, UserEnvelopeOversizedError as f4, type UserEnvelopePresented as f5, type UserInfo as f6, type VaultBackup as f7, VaultGroup as f8, type VaultGroupOptions as f9, evaluateImportCapability as fA, findAuthenticator as fB, hasExportCapability as fC, hasImportCapability as fD, hasRecoveryEnrolled as fE, isLinkCollectionName as fF, isMagicLinkGrantExpired as fG, isPublicEnvelope as fH, issueDelegation as fI, recoverPassphrase as fJ, rotatePassphrase as fK, listMagicLinkGrants as fL, listUsers as fM, listUsersWithEnvelopes as fN, loadActiveDelegations as fO, loadPaperRecoveryEntries as fP, loadSealedPassphrase as fQ, loadShamirRecoveryEntries as fR, magicLinkGrantRecordId as fS, mintPaperRecoveryEntry as fT, mintShamirRecoveryEntry as fU, mintWrappedDeksBlob as fV, parseRsaOaepTlv as fW, parseSealedEnvelope as fX, readMagicLinkGrantRecord as fY, recoverUser as fZ, removeAuthenticator as f_, type VaultPolicyOnDisk as fa, type VaultRegistryRow as fb, type VaultSchemaSnapshot as fc, type VaultSnapshot as fd, type VaultTemplate as fe, type WarningRules as ff, WeakPassphraseError as fg, type WeakPassphraseReason as fh, type WithArchiveOptions as fi, type WrappedDeksBlob as fj, type WriteConflict as fk, type WriteEvent as fl, type WriteHook as fm, type WriteQueue as fn, aesGcmOpen as fo, assertStrongPassphrase as fp, buildRecipientKeyringFile as fq, burnPaperRecoveryEntry as fr, compileSequenceFormat as fs, createNoydb as ft, createStore as fu, deriveMagicLinkContentKey as fv, enrollAuthenticator as fw, estimateEntropy as fx, evalComputedFields as fy, evaluateExportCapability as fz, type I18nTextOptions as g, resolveSequenceKey as g0, revokeDelegation as g1, revokeMagicLinkGrant as g2, runTransaction as g3, savePaperRecoveryEntries as g4, saveSealedPassphrase as g5, saveShamirRecoveryEntries as g6, sealRsaOaepTlv as g7, unwrapDeksFromBlob as g8, unwrapDeksFromPaperEntry as g9, unwrapDeksFromShamirEntry as ga, unwrapMagicLinkGrant as gb, validatePassphrase as gc, validatePublicEnvelopeInput as gd, validateSchemaInput as ge, validateSchemaOutput as gf, withArchive as gg, withDeferredNumbering as gh, writeMagicLinkGrant as gi, changeSecret as gj, createOwnerKeyring as gk, ensureCollectionDEK as gl, grant as gm, loadKeyring as gn, persistKeyring as go, revoke as gp, updateAuthenticator as gq, updateKeyringIdentity as gr, type TxStrategy as gs, type AmendmentTxOptions as gt, type OnMissingPolicy as h, type StaticDictDescriptor as i, applyI18nLocale as j, dictCollectionName as k, dictKey as l, enforceScript as m, getAtPath as n, i18nText as o, inferScripts as p, isDictCollectionName as q, isDictKeyDescriptor as r, isI18nTextDescriptor as s, isStaticDictDescriptor as t, resolveI18nText as u, resolvePolicy as v, setAtPathInPlace as w, staticDict as x, validateI18nTextValue as y, type SessionStrategy as z };