@noy-db/hub 0.2.0-pre.17 → 0.2.0-pre.19

package/dist/{types-CljIHm_J.d.ts → types-CraiZOyO.d.ts}

@@ -1,9 +1,9 @@
 import { I as IndexStrategy, d as LazyQuery } from './lazy-builder-ChSqcF5t.js';
-import { L as LiveAggregation, b as AggregateSpec, a as AggregateResult, v as MoneyDescriptor, A as AggregateStrategy } from './strategy-4M9jo172.js';
+import { c as OnMissingPolicy, a as I18nTextDescriptor, L as Layer, u as LiveAggregation, j as AggregateSpec, h as AggregateResult, N as MoneyDescriptor, A as AggregateStrategy } from './strategy-BDxQnnTX.js';
 import { C as CrdtStrategy, a as CrdtMode, b as CrdtState } from './strategy-BSxFXGzb.js';
-import { L as LedgerEntry, F as ForgetStrategy, S as SubjectRef, b as ForgetResult } from './index-C-SSRIxP.js';
-import { N as NoydbError } from './errors-Dz64FA65.js';
-import { L as LiveQuery, Q as Query, c as JoinStrategy, j as RefRegistry, R as RefDescriptor, d as JoinableSource, l as RefViolation, S as ScanBuilder } from './index-DpU6KWof.js';
+import { L as LedgerEntry, F as ForgetStrategy, S as SubjectRef, b as ForgetResult } from './index-BMmajblo.js';
+import { N as NoydbError } from './errors-DL-zTrrF.js';
+import { L as LiveQuery, Q as Query, c as JoinStrategy, j as RefRegistry, R as RefDescriptor, d as JoinableSource, l as RefViolation, S as ScanBuilder } from './index-BelbyUwz.js';
 import { I as IndexDef, O as Operator, F as FieldClause, C as CollectionIndexes } from './predicate-BmhBSPCH.js';
 import { AttestationFieldSchema, RevocationList } from '@noy-db/attestation';
 
@@ -1607,284 +1607,6 @@ interface PeriodsStrategy {
     appendPeriodLedgerEntry(ledger: LedgerStore | null, actor: string, envelope: EncryptedEnvelope, periodName: string): Promise<void>;
 }
 
-/**
- * Per-layer i18n resolution policy.
- *
- * `onMissing` governs what happens when a multilingual field is resolved
- * to a target locale that is absent. It may be a single scalar policy or
- * a per-layer map, so a field can be lenient at the app read boundary but
- * strict inside a materialized view.
- *
- * Effective policy for layer `λ`:
- *
- * ```
- * explicit(λ) = typeof onMissing === 'object' ? onMissing[λ] : undefined
- * scalar      = typeof onMissing === 'string' ? onMissing : undefined
- * policy(λ)   = explicit(λ) ?? layerDefault(λ) ?? scalar ?? 'throw'
- * ```
- *
- * - `layerDefault('guard') = 'substitute'` — guards are lenient unless
- *   EXPLICITLY overridden; they never inherit a scalar policy (a guard
- *   reading a display value must not hard-fail on a missing locale).
- * - every other layer has no default, so it inherits the scalar, else
- *   falls back to `'throw'` (today's behavior — zero breaking change).
- *
- * @public
- */
-type OnMissing = 'substitute' | 'null' | 'throw';
-/**
- * The contexts in which a multilingual field is resolved. Each can carry
- * its own `onMissing` policy.
- *
- * - `read`       — ordinary app reads (`get`/`list`/query projection).
- * - `guard`      — a guard callback reading a value.
- * - `join`       — a joined record expanded onto a row.
- * - `mv`         — materialized-view input.
- * - `derivation` — derivation input.
- * - `export`     — bundle/public-envelope export.
- */
-type Layer = 'read' | 'guard' | 'join' | 'mv' | 'derivation' | 'export';
-/** Field-level policy: a single scalar, or a per-layer map. */
-type OnMissingPolicy = OnMissing | Partial<Record<Layer, OnMissing>>;
-/**
- * Resolve the effective `OnMissing` for a layer from a field's declared
- * policy. See module docs for the resolution rule.
- */
-declare function resolvePolicy(onMissing: OnMissingPolicy | undefined, layer: Layer): OnMissing;
-
-/**
- * i18nText schema type —
- *
- * `i18nText({ languages, required })` creates a descriptor for a
- * multi-language content field whose value is stored as a
- * `{ [locale]: string }` map (e.g. `{ en: 'Consulting', th: 'ที่ปรึกษา' }`).
- *
- * On put, the descriptor validates that required languages are present.
- * On read (when a `locale` option is passed), the map is collapsed to the
- * caller's locale string via the fallback chain.
- *
- * Design decisions
- * ────────────────
- *
- * **Descriptor pattern (not a Zod type).**
- * `i18nText()` returns a plain descriptor object used in the collection's
- * `i18nFields` option — same pattern as `ref()` / `dictKey()`. This keeps
- * `@noy-db/core` at zero runtime dependencies and avoids Zod v3 field-type
- * constraints. TypeScript inference is handled via the descriptor's type.
- *
- * **Enforcement at the collection boundary.**
- * The `required` option is checked by `Collection.put()` via the compartment's
- * registered `i18nFields`. Failed validation throws `MissingTranslationError`
- * — a distinct class from `SchemaValidationError` so callers can tell
- * "wrong shape" from "missing translations".
- *
- * **Resolution is post-decryption.**
- * Locale resolution happens AFTER `decryptRecord()`, as a pure in-memory
- * transform. No additional crypto work is needed. The resolved record is
- * returned in place of the stored one, with i18nText fields replaced by
- * their locale-resolved strings.
- *
- * **`locale: 'raw'`.**
- * Passing `{ locale: 'raw' }` skips resolution and returns the full
- * `{ [locale]: string }` map — useful for bilingual exports, admin UIs,
- * and any context where all translations must be visible at once.
- *
- * **Out of scope.**
- * Pluralization, RTL rendering, date/number formatting, per-locale CRDT
- * merging.
- */
-
-/** Flatten an intersection into a single object literal for nicer hovers. */
-type Prettify<T> = {
-    [K in keyof T]: T[K];
-} & {};
-/**
- * The stored shape of a multilingual field, inferred from its `required`
- * mode — so the compiler forces you to handle an absent optional locale
- * (`string | undefined`) instead of silently yielding `undefined`.
- *
- * Mirrors `i18nText({ languages, required })`:
- * - `'all'` (default) — every locale required: `{ th: string; en: string }`
- * - `'any'`           — every locale optional: `{ th?: string; en?: string }`
- *   (the "at least one present" guarantee is runtime-only — not expressible
- *   in TypeScript — so each key is optional)
- * - `readonly L[]`    — listed locales required, the rest optional:
- *   `I18nMap<'th'|'en', ['th']>` → `{ th: string; en?: string }`
- *
- * @example
- * ```ts
- * type Lang = 'th' | 'en'
- * interface Contact {
- *   name: I18nMap<Lang, 'any'>      // { th?: string; en?: string }
- *   legalName: I18nMap<Lang, ['th']> // { th: string; en?: string }
- *   slug: I18nMap<Lang>             // { th: string; en: string }
- * }
- * ```
- *
- * @public
- */
-type I18nMap<Langs extends string, Required extends 'all' | 'any' | readonly Langs[] = 'all'> = Required extends 'all' ? Record<Langs, string> : Required extends 'any' ? Partial<Record<Langs, string>> : Required extends readonly (infer R extends Langs)[] ? Prettify<Record<R, string> & Partial<Record<Exclude<Langs, R>, string>>> : never;
-/**
- * Options for `i18nText()`.
- *
- * `languages` declares the full set of supported locales. `required`
- * controls which must be present on every `put()`.
- *
- * `autoTranslate` is the per-field opt-in for the `plaintextTranslator`
- * hook. When `true` and a `plaintextTranslator` is configured
- * on `createNoydb()`, missing translations are generated before `put()`.
- * Default: `false`.
- */
-interface I18nTextOptions {
-    /** All supported locale codes (BCP 47). */
-    readonly languages: readonly string[];
-    /**
-     * Which locales must be present on every `put()`.
-     *
-     * - `'all'`       — every declared language must be present.
-     * - `'any'`       — at least one declared language must be present.
-     * - `string[]`    — listed locales are required; others are optional.
-     */
-    readonly required: 'all' | 'any' | readonly string[];
-    /**
-     * Per-field opt-in for the `plaintextTranslator` hook.
-     * When `true`, missing required translations are auto-generated
-     * before `put()` if a translator is configured. Default: `false`.
-     */
-    readonly autoTranslate?: boolean;
-    /**
-     * What to do when this field is resolved to a locale that is absent.
-     * A single policy, or a per-layer map (read/guard/join/mv/derivation/
-     * export). Default `'throw'` — today's behavior, zero breaking change.
-     * See {@link OnMissingPolicy}.
-     *
-     * NOTE (current wiring): the `read` layer (`get`/`list`) is enforced.
-     * Guard, derivation, mv, join and export reads currently resolve
-     * through the same read path and so observe the `read`/scalar policy;
-     * dedicated per-layer enforcement for those contexts is a tracked
-     * follow-up (mv/join additionally require resolution to be injected
-     * into the query/aggregate pipeline, which today reads raw maps).
-     */
-    readonly onMissing?: OnMissingPolicy;
-    /**
-     * Ordered preferred-substitute locales used when `onMissing` resolves
-     * to `'substitute'` and the target locale is absent. `'any'` as an
-     * element means "first non-empty value". A caller-supplied `fallback`
-     * at read time takes precedence over this declared list.
-     */
-    readonly substitute?: readonly string[];
-    /**
-     * Per-locale script enforcement (write-time). `'auto'` infers the
-     * allowed Unicode scripts per locale (asymmetric Latin tolerance); an
-     * object overrides per slot. Absent ⇒ no check. See `./script.ts`.
-     */
-    readonly script?: 'auto' | Partial<Record<string, readonly string[]>>;
-    /**
-     * What to do when a slot's value contains characters outside its
-     * allowed script set. Default `'reject'`.
-     */
-    readonly onScriptViolation?: 'reject' | 'filter' | 'warn';
-}
-/**
- * Descriptor returned by `i18nText()`. Attach to the collection's
- * `i18nFields` option:
- *
- * ```ts
- * const lineItems = company.collection<LineItem>('line-items', {
- *   i18nFields: {
- *     description: i18nText({ languages: ['en', 'th'], required: 'all' }),
- *   },
- * })
- * ```
- */
-interface I18nTextDescriptor {
-    readonly _noydbI18nText: true;
-    readonly options: I18nTextOptions;
-}
-/**
- * Create an `I18nTextDescriptor` for a multi-language content field.
- *
- * @param options  Language list + enforcement mode.
- *
- * @example
- * ```ts
- * i18nText({ languages: ['en', 'th'], required: 'all' })
- * i18nText({ languages: ['en', 'th'], required: ['th'], autoTranslate: true })
- * ```
- */
-declare function i18nText(options: I18nTextOptions): I18nTextDescriptor;
-/** Runtime predicate for detecting an `I18nTextDescriptor`. */
-declare function isI18nTextDescriptor(x: unknown): x is I18nTextDescriptor;
-/**
- * Validate that a value is a valid `{ [locale]: string }` map and that
- * all required locales are present. Throws `MissingTranslationError`
- * when the required constraint is violated.
- *
- * Called by `Collection.put()` for each registered `i18nField`.
- *
- * @param value       The raw field value from the record being put.
- * @param field       The field name (used in the thrown error message).
- * @param descriptor  The `i18nText()` descriptor for this field.
- */
-declare function validateI18nTextValue(value: unknown, field: string, descriptor: I18nTextDescriptor): void;
-/**
- * Resolve an i18nText value (`{ [locale]: string }` map) to a string
- * for the given locale.
- *
- * @param value    The stored locale map.
- * @param locale   The requested locale code, or `'raw'` to return the map.
- * @param fallback Single locale or ordered list; use `'any'` as the last
- *                 element to fall back to any available translation.
- * @param field    Field name used in `LocaleNotSpecifiedError` messages.
- * @returns The resolved string, OR the original map when `locale === 'raw'`.
- */
-/** Options for the policy-aware form of {@link resolveI18nText}. */
-interface ResolveI18nOptions {
-    /** Effective policy for the resolution layer. Default `'throw'`. */
-    readonly policy?: OnMissing;
-    /** Declared substitute chain; applied only under policy `'substitute'`. */
-    readonly substitute?: readonly string[];
-}
-declare function resolveI18nText(value: Record<string, string>, locale: string, fallback?: string | readonly string[], field?: string): string | Record<string, string>;
-declare function resolveI18nText(value: Record<string, string>, locale: string, fallback: string | readonly string[] | undefined, field: string | undefined, opts: ResolveI18nOptions): string | Record<string, string> | null;
-/**
- * Return all leaf values at `path`, expanding `[].` array wildcards.
- *
- * - `'name'`              → `[obj.name]`
- * - `'address.lineOne'`   → `[obj.address.lineOne]`
- * - `'contacts[].title'`  → `[obj.contacts[0].title, obj.contacts[1].title, …]`
- *
- * Returns an empty array when the path does not resolve (missing key,
- * wrong type, etc.). Used by `enforceI18nOnPut` to validate nested fields.
- */
-declare function getAtPath(obj: Record<string, unknown>, path: string): unknown[];
-/**
- * Mutate `obj` in-place, setting `value` at the nested `path`.
- * Supports dot notation (`'address.lineOne'`) but not array wildcards —
- * auto-translate on `contacts[].title` style paths is not supported.
- */
-declare function setAtPathInPlace(obj: Record<string, unknown>, path: string, value: unknown): void;
-/**
- * Apply locale resolution to a single record, returning a new copy.
- *
- * For each field registered as an `i18nText` descriptor:
- * - If `locale === 'raw'`, the field value is left as the stored map.
- * - Otherwise, the field value is replaced with the resolved string.
- *
- * Field paths support dot notation (`'address.lineOne'`) and array
- * wildcards (`'contacts[].title'`). Top-level fields work as before.
- *
- * @param record      The decrypted record.
- * @param i18nFields  Map of field path → `I18nTextDescriptor`.
- * @param locale      The requested locale (or `'raw'`).
- * @param fallback    Fallback chain (optional).
- * @param layer       Resolution layer (default `'read'`). Each field's
- *                    `onMissing` policy is resolved for this layer, so the
- *                    same record resolves leniently on a get but strictly
- *                    inside an mv/derivation.
- */
-declare function applyI18nLocale(record: Record<string, unknown>, i18nFields: Record<string, I18nTextDescriptor>, locale: string, fallback?: string | readonly string[], layer?: Layer): Record<string, unknown>;
-
 type EventHandler<T> = (data: T) => void;
 /** Typed event emitter for NOYDB events. */
 declare class NoydbEventEmitter {
@@ -3464,6 +3186,34 @@ interface HistoryStrategy {
     buildVaultInstant(engine: VaultEngine, timestamp: string): VaultInstant;
 }
 
+/**
+ * Scan-mode full-text search (#308) — ranks **already-decrypted** records by
+ * BM25 against a tokenized query. Pure client-side: nothing is written to the
+ * store, so this adds **zero** leakage (unlike a store-usable blind index,
+ * which is a separate, gated opt-in — see the #308 design note).
+ *
+ * O(n) over the collection; intended for small/medium collections (the pilot's
+ * scale) where moving the existing userland scan into the DB is the win.
+ */
+
+interface SearchOptions {
+    /** Top-N by score (default: all matches). */
+    readonly limit?: number;
+    /** `'any'` (default) = OR of query terms; `'all'` = every term must match. */
+    readonly match?: 'any' | 'all';
+    /** Treat the LAST query term as a prefix (typeahead). */
+    readonly prefix?: boolean;
+}
+interface SearchResult<T> {
+    readonly id: string;
+    readonly score: number;
+    readonly record: T;
+}
+interface SearchEntry<T> {
+    readonly id: string;
+    readonly record: T;
+}
+
 interface LruOptions {
     /** Maximum number of entries before eviction. Required if `maxBytes` is unset. */
     maxRecords?: number;
@@ -3740,6 +3490,16 @@ interface ShardingConfig<T> {
     readonly vaultTemplate: string;
     /** When a write targets an unknown partition key, stamp a shard inline. Default `true`. */
     readonly autoCreate?: boolean;
+    /**
+     * Data-residency guard (#271): the geographic region a record's shard must
+     * live in (e.g. `'eu'`). When set, `createShard` resolves the candidate
+     * backend (via `routeStore`'s vault-prefix routing) and throws
+     * `DataResidencyError` if its `capabilities.region` doesn't match — so a
+     * shard never lands on a non-compliant backend. Advisory until a region is
+     * declared on the backing store; pair with `routeStore({ vaultRoutes })`
+     * and a region-encoded partition key (e.g. `eu-acme` → `firm--eu-`).
+     */
+    readonly regionOf?: (record: T) => string;
 }
 /** Options for `Noydb.openVaultGroup`. */
 interface VaultGroupOptions<T> {
@@ -3750,6 +3510,25 @@ interface VaultGroupOptions<T> {
      */
     readonly registry?: Collection<VaultRegistryRow>;
     readonly sharding: ShardingConfig<T>;
+    /**
+     * Lazy migrate-on-open (#271 fleet migration). When `true`, opening a shard
+     * whose registry `schemaVersion` is behind the template's version runs that
+     * shard's cutover inline (via `migrateShard`) before surfacing the handle.
+     * Zero cost for shards never opened. Default `false` (use `migrateFleet`).
+     */
+    readonly migrateOnOpen?: boolean;
+}
+/** Result of `VaultGroup.migrateFleet` (#271 active batch runner). */
+interface FleetMigrationResult {
+    /** The version migrated toward (the template's current version). */
+    readonly target: number;
+    /** vaultIds successfully migrated (or already current). */
+    readonly migrated: string[];
+    /** vaultIds whose cutover failed, with the error message. */
+    readonly failed: {
+        readonly vaultId: string;
+        readonly error: string;
+    }[];
 }
 /** Options for a cross-shard fan-out read. */
 interface FanoutQueryOptions {
@@ -3794,6 +3573,48 @@ interface CrossVaultLiveAggregation<R> extends LiveAggregation<R> {
     readonly skippedVaults: readonly SkippedVault[];
     readonly ready: Promise<void>;
 }
+/**
+ * Context passed to a cross-vault `derive` callback (#271 Insight Vault).
+ * One call per shard; identifies which shard the records came from.
+ */
+interface CrossVaultDerivationContext {
+    /** The shard's vault id (e.g. `firm-clients--acme`). */
+    readonly vaultId: string;
+    /** The shard's partition key (e.g. `acme`). */
+    readonly partitionKey: string;
+    /** The shard's schema/template version, from its registry row. */
+    readonly schemaVersion: number;
+}
+/**
+ * A push-model cross-vault derivation (#271, Insight Vault — Layer 4).
+ *
+ * For each eligible shard, `refreshInsights()` reads the shard's `source`
+ * collection, runs `derive` on that shard's records, and writes the returned
+ * summary row into a separate analytics ("Insight") vault — keyed by partition
+ * key, one row per shard. The summary is re-encrypted under the Insight Vault's
+ * own DEK; the shard's ciphertext never leaves its DEK boundary (the push model
+ * that resolves the cross-vault DEK conflict). See the ZK note in the spec —
+ * the Insight Vault backend sees aggregated structure across shards, a weaker
+ * profile than per-shard vaults; opt-in.
+ */
+interface CrossVaultDerivationSpec<R = Record<string, unknown>, S = Record<string, unknown>> {
+    /** Collection read from each shard. */
+    readonly source: string;
+    /** Destination Insight Vault + collection for the per-shard summary rows. */
+    readonly target: {
+        readonly vault: string;
+        readonly collection: string;
+    };
+    /** Per-shard reducer: that shard's source records + context → one summary row. */
+    readonly derive: (records: R[], ctx: CrossVaultDerivationContext) => S;
+}
+/** The result of `refreshInsights()`. */
+interface RefreshInsightsResult {
+    /** Number of summary rows written (one per eligible shard × registered derivation). */
+    readonly written: number;
+    /** Shards excluded (schema-drift, unprovisioned, or read error). */
+    readonly skippedVaults: SkippedVault[];
+}
 /** A serializable blueprint captured from a VaultTemplate.configure run. */
 interface CapturedBlueprint {
     /** Sorted collection names declared by the template. */
@@ -3818,12 +3639,34 @@ interface SchemaManifestRow {
 interface DeploymentEvent {
     readonly id: string;
     readonly ts: number;
-    readonly type: 'shard-created' | 'manifest-recorded' | 'group-opened';
+    readonly type: 'shard-created' | 'manifest-recorded' | 'group-opened' | 'migration-started' | 'migration-completed' | 'migration-failed';
     readonly group: string;
     readonly vaultId?: string;
     readonly templateName?: string;
     readonly version?: number;
     readonly actor?: string;
+    /** Free-form detail (e.g. migration error message). */
+    readonly detail?: string;
+}
+/**
+ * One row in the StateManagement `migration-status` collection (#271 fleet
+ * schema-migration runner), keyed by `vaultId`. Tracks each shard's progress
+ * toward the template's current version so the active batch runner is
+ * resumable and the staged rollout can verify a cohort before proceeding.
+ */
+interface MigrationStatusRow {
+    readonly vaultId: string;
+    readonly group: string;
+    /** The shard's registry schemaVersion at the time of this status. */
+    readonly currentVersion: number;
+    /** The version the runner is moving this shard to (the template's version). */
+    readonly targetVersion: number;
+    readonly status: 'pending' | 'running' | 'done' | 'failed';
+    readonly startedAt?: number;
+    readonly finishedAt?: number;
+    /** Records migrated by the per-shard cutover (when status `done`). */
+    readonly migrated?: number;
+    readonly error?: string;
 }
 
 /**
@@ -3838,8 +3681,14 @@ declare class StateManagementVault {
     readonly registry: Collection<VaultRegistryRow>;
     readonly schemaManifest: Collection<SchemaManifestRow>;
     private constructor();
-    /** Idempotently open the reserved state vault and bind the three control-plane collections. */
+    /** Idempotently open the reserved state vault and bind the control-plane collections. */
     static open(db: Noydb): Promise<StateManagementVault>;
+    /** Read one shard's migration status (or null). */
+    getMigrationStatus(vaultId: string): Promise<MigrationStatusRow | null>;
+    /** All migration-status rows (hydrates first). */
+    listMigrationStatus(): Promise<MigrationStatusRow[]>;
+    /** Upsert one shard's migration status (keyed by vaultId). */
+    upsertMigrationStatus(row: MigrationStatusRow): Promise<void>;
     /** Read-only query over the append-only deployment-events log. */
     queryEvents(): Query<DeploymentEvent>;
     /**
@@ -5544,12 +5393,14 @@ declare class VaultGroup<T> {
     /** @internal */ readonly registry: Collection<VaultRegistryRow>;
     /** @internal */ readonly sharding: ShardingConfig<T>;
     /** @internal */ readonly template: VaultTemplate;
+    /** @internal — lazy migrate-on-open (#271). */ readonly migrateOnOpen: boolean;
     constructor(
     /** @internal */ db: Noydb, 
     /** @internal */ name: string, 
     /** @internal */ registry: Collection<VaultRegistryRow>, 
     /** @internal */ sharding: ShardingConfig<T>, 
-    /** @internal */ template: VaultTemplate);
+    /** @internal */ template: VaultTemplate, 
+    /** @internal — lazy migrate-on-open (#271). */ migrateOnOpen?: boolean);
     /** @internal — set when the group is managed (no explicit registry). */
     private stateVault;
     /** @internal */
@@ -5572,8 +5423,14 @@ declare class VaultGroup<T> {
      * `liveBinding().isRelevant` already applies to the reactive path.
      */
     allRows(): Promise<VaultRegistryRow[]>;
-    /** Open an existing shard and apply the template. */
+    /**
+     * Open an existing shard and apply the template. When `migrateOnOpen` is set
+     * (#271) and the shard's registry version is behind the template, its cutover
+     * runs inline first — so a behind shard never surfaces a stale handle.
+     */
     openShard(partitionKey: string): Promise<Vault>;
+    /** @internal — open + configure with no migrate-on-open hook (used by the migration path itself to avoid recursion). */
+    private _openShardRaw;
     /**
      * Idempotently provision a shard for `partitionKey`. Returns the
      * configured vault handle.
@@ -5581,8 +5438,12 @@ declare class VaultGroup<T> {
      * - row + vault present → no-op, return handle
      * - row present, vault gone → ShardProvisioningError
      * - row absent (vault present or not) → open-or-create, configure, write row
+     *
+     * When `region` is given (the routing `put` passes `sharding.regionOf(record)`),
+     * the candidate backend's `capabilities.region` must match or this throws
+     * `DataResidencyError` BEFORE provisioning (#271 data-residency guard).
      */
-    createShard(partitionKey: string): Promise<Vault>;
+    createShard(partitionKey: string, region?: string): Promise<Vault>;
     /**
      * Drill down to a single shard's full Collection API. Throws if the shard is unknown.
      * Also throws ShardProvisioningError if the registry row exists but the vault has been deleted
@@ -5598,6 +5459,74 @@ declare class VaultGroup<T> {
         eligible: VaultRegistryRow[];
         skipped: SkippedVault[];
     }>;
+    /** @internal — registered push-model cross-vault derivations (#271 Insight Vault). */
+    private readonly crossVaultDerivations;
+    /**
+     * Register a push-model cross-vault derivation — the Insight Vault pattern
+     * (#271, Layer 4). Drive it with {@link refreshInsights}.
+     *
+     * For each shard, `derive(records, ctx)` runs on that shard's `source`
+     * records and its return value is written into the analytics
+     * (`target.vault` / `target.collection`) vault, keyed by partition key —
+     * one summary row per shard. The derivation runs in-process under THIS
+     * group's `Noydb` (which already holds both the shard and Insight Vault
+     * keyrings); the shard's decrypted records are reduced to a summary that is
+     * re-encrypted under the Insight Vault's own DEK, so no shard ciphertext
+     * crosses a DEK boundary.
+     *
+     * **Zero-knowledge note:** the Insight Vault backend sees aggregated
+     * structure (totals, counts, timestamps) drawn from many shards — a weaker
+     * ZK profile than the per-shard vaults. Opt-in; keep summaries to aggregate
+     * scalars (no embeddings / no raw records).
+     *
+     * v1 is explicit-refresh (no write-path push); call `refreshInsights()`
+     * after a batch of writes, or on a schedule.
+     *
+     * The `target.vault` must NOT be the group itself or one of its shards —
+     * a summary writing back into client-shard data would breach the Insight
+     * Vault's separate-DEK-boundary contract. Such a target throws a
+     * `ValidationError` at registration (#271 Insight-write isolation).
+     */
+    withCrossVaultDerivation<R = Record<string, unknown>, S = Record<string, unknown>>(spec: CrossVaultDerivationSpec<R, S>): void;
+    /**
+     * Run every registered {@link withCrossVaultDerivation}: read each eligible
+     * shard's source records, derive a per-shard summary, and write it into the
+     * Insight Vault keyed by partition key. Shards behind `minVersion`,
+     * unprovisioned, or whose read errors are reported in `skippedVaults` and
+     * are not written (a stale summary is never left behind for a failed shard).
+     */
+    refreshInsights(options?: {
+        minVersion?: number;
+        concurrency?: number;
+    }): Promise<RefreshInsightsResult>;
+    /** @internal — the control-plane vault for migration status; lazily opened. */
+    private ensureStateVault;
+    /**
+     * Migrate ONE shard to the template's current version (#271 fleet runner,
+     * per-shard step). Opens the shard (applying the template, which arms the
+     * M12 cutover), drains schema-write detection, runs `vault.runSchemaCutover()`
+     * (the per-vault drain-barrier-transform protocol), then advances the
+     * registry row's `schemaVersion` and records `migration-status`. A shard
+     * already at the template version is a no-op (`status: 'done'`, migrated 0).
+     * Never throws on a cutover failure — it records `status: 'failed'` and
+     * returns the row, so a fleet run continues past a bad shard.
+     */
+    migrateShard(partitionKey: string): Promise<MigrationStatusRow>;
+    /**
+     * Active batch runner (#271): migrate every shard behind the template version
+     * to it, in controlled batches. **Resumable + crash-safe** — shards already at
+     * the target are skipped (the registry version is the source of truth), so a
+     * re-run after a crash only picks up the unfinished + previously-failed shards.
+     *
+     * - `cohort` — restrict to these partition keys (the staged / canary rollout:
+     *   migrate a small cohort, verify the Insight Vault, then run the rest).
+     * - `batchSize` — max shards migrated concurrently per batch (back-pressure).
+     *   Default 4. Batches run sequentially; shards within a batch run in parallel.
+     */
+    migrateFleet(options?: {
+        cohort?: readonly string[];
+        batchSize?: number;
+    }): Promise<FleetMigrationResult>;
 }
 declare class ShardedCollection<T, R = T> {
     private readonly group;
@@ -5970,6 +5899,13 @@ declare class Noydb {
      * (its keyring exists in the store).
      */
     _shardVaultProvisioned(vaultId: string): Promise<boolean>;
+    /**
+     * @internal — the physical backend store a vault id maps to. A
+     * `routeStore` resolves the vault-prefix route via its `resolveBackend`;
+     * a plain store is its own backend. Used by the federation data-residency
+     * guard to read the placement backend's `capabilities.region` (#271).
+     */
+    _resolveBackend(vaultId: string): NoydbStore;
     /**
      * Change the current user's passphrase for a vault.
      *
@@ -6862,6 +6798,27 @@ interface RecordOutputSpec {
      * `DerivationOutputShapeError` — same as v1.
      */
     optional?: boolean;
+    /**
+     * Field-level provenance for a **self-write** output (#376) — an output
+     * whose `collection` equals the strategy's `source`, used by
+     * reverse-denormalization (`triggerBy`) to patch a denormalized field
+     * back onto the source record.
+     *
+     * `denorm` names the ONLY top-level fields the derivation owns on that
+     * record. The engine merges just those fields from the `derive` return
+     * value onto the current stored record (`{ ...current, ...pick(out, denorm) }`)
+     * — the rest of the user's record is never clobbered by a stale snapshot.
+     * The whole-record `_derivedFrom` provenance tag is NOT applied (the
+     * record stays user-owned); the derivation only claims `denorm`.
+     *
+     * Cycle break is value-level: if the patch changes nothing, no write is
+     * issued — so the self-write that re-fires the source-path derivation
+     * terminates after one idempotent pass.
+     *
+     * REQUIRED when `collection === source` (validated at construction);
+     * ignored for outputs to a different collection.
+     */
+    denorm?: readonly string[];
 }
 /**
  * Array-shape output — one source row produces a variable-length
@@ -6942,6 +6899,52 @@ interface DerivationStrategy<TSource extends Record<string, unknown>, TOutputs e
      * (validated at `withDerivation()` construction time).
      */
     sources?: ReadonlyArray<string>;
+    /**
+     * Foreign-key-keyed triggers for reverse-denormalization (#376). Unlike
+     * `sources[]` (which re-fires at the SAME id), a `triggerBy` entry fans a
+     * write to a PARENT collection OUT to every source record whose FK matches
+     * the written parent's id.
+     *
+     * `{ collection, on }`: a write to `collection` (the parent, e.g.
+     * `'buyers'`) re-fires this derivation once per source record where
+     * `source[on] === writtenParentId` (`on` is the FK field ON the source,
+     * e.g. `'buyerId'`). The matched source record — not the parent — is
+     * passed to `derive`.
+     *
+     * Typical use: keep a denormalized field on the source in sync with a
+     * parent change (a buyer rename → refresh `buyerName` on all their sales),
+     * via a self-write output (`collection === source`) declaring `denorm`.
+     *
+     * Fan-out runs through `ctx.vault.collection(source).query().where(on,'==',id)`,
+     * which uses the FK index when the source declares `withIndexing()` on
+     * `on` (O(children)) and otherwise scans (O(N) — fine for small child
+     * sets). Set `maxFanout` as a safety rail; exceeding it throws
+     * `DerivationCapExceededError` before any write. `triggerBy` collections
+     * participate in cycle detection like `source`/`sources`.
+     *
+     * Each `collection` must be non-empty and not equal `source`; `on` must
+     * be a non-empty field name (validated at construction).
+     */
+    triggerBy?: ReadonlyArray<{
+        collection: string;
+        on: string;
+        maxFanout?: number;
+    }>;
+    /**
+     * @internal — set by `withRollup()` (#376 slice 2). Marks this strategy as
+     * an aggregate-onto-parent rollup: a write OR delete of a `from` (child)
+     * record recomputes `compute(children where child[key] === parentId)` and
+     * patches it onto `source[field]` of the parent at `parentId` (= child[key]).
+     * `source` is the parent (`into`) collection; the synthetic self-write
+     * output carries `denorm: [field]`. Dispatch handles rollup specially (it
+     * does not run the executor). Eager-only in this slice.
+     */
+    rollup?: {
+        readonly from: string;
+        readonly key: string;
+        readonly field: string;
+        readonly compute: (children: any[]) => unknown;
+    };
     /** v1: only deterministic derivations supported. */
     deterministic: true;
     /**
@@ -7232,6 +7235,35 @@ interface MaterializedViewStrategy<TRow extends Record<string, unknown>> {
      * if declared alone.
      */
     moneyFields?: Record<string, MoneyDescriptor>;
+    /**
+     * Compute-time i18n resolution locale (#285, `mv` layer). UNION-mode only.
+     *
+     * An MV that **groups by** an `i18nText` field would otherwise bucket on the
+     * raw `{ locale: string }` map — an unstable object key. Set `i18nLocale`
+     * (with {@link i18nFields} describing those fields) and, before grouping, the
+     * executor resolves each declared i18n group-key field to this locale at the
+     * `mv` layer (`resolvePolicy(onMissing, 'mv')`), so buckets are stable strings.
+     *
+     * This is the **compute** path only: i18n fields *carried through* for display
+     * stay raw — declare them on the OUTPUT collection and they resolve per-reader
+     * at read time (the resolve-at-output model). Without `i18nLocale`, grouping by
+     * a raw i18n field throws `LocaleNotSpecifiedError` (steer: group by a
+     * `dictKey`/`staticDict` code — the stable key — and label at read).
+     *
+     * Query-form MVs do their own `groupBy` inside the `Query`, which carries no
+     * locale yet (the join/query-locale slice, #285 §3) — so `i18nLocale` /
+     * `i18nFields` on a query-form MV throw `MaterializedViewConfigError`.
+     */
+    i18nLocale?: string;
+    /**
+     * i18n descriptors for UNION-mode compute (#285), keyed by the OUTPUT field
+     * name as it appears in the mapped row (NOT the source field). Mirrors
+     * {@link moneyFields}: the concatenated mapped stream is a plain array with no
+     * collection i18n context, so the descriptor (carrying `onMissing`/`substitute`
+     * /`fallback`) must be declared here for the `mv`-layer resolution that
+     * {@link i18nLocale} drives. Meaningless without `i18nLocale`.
+     */
+    i18nFields?: Record<string, I18nTextDescriptor>;
     /**
      * Pure function from a materialized row → stable id used in the
      * output collection. Required — explicit always beats default-with-pitfalls
@@ -7563,7 +7595,43 @@ interface NextOptions {
 interface SequenceOptions {
     /** Partition tuple. Each component is URI-encoded and `'/'`-joined. */
     readonly partition?: readonly (string | number)[];
+    /**
+     * Render template for the serial string (#375). When set, `vault.sequence`
+     * returns a {@link FormattedSequenceHandle} whose `next()` resolves to
+     * `{ serial, formatted }`. Tokens:
+     * - `{seq}` — the allocated integer
+     * - `{seq:0N}` — zero-padded to width N (e.g. `{seq:04}` → `0001`)
+     * - `{partition.i}` — the i-th `partition` component (original value)
+     *
+     * Any other token, or a `{partition.i}` index beyond the supplied
+     * `partition`, throws `ValidationError` at `vault.sequence()` construction.
+     * Per-partition reset is inherent: a new partition tuple starts at 1.
+     */
+    readonly format?: string;
 }
+/**
+ * A formatted sequence handle (#375). Identical to {@link SequenceHandle}
+ * except `next()` also returns the rendered `formatted` string. `peek()` /
+ * `seedTo()` operate on the underlying integer counter, unchanged.
+ */
+interface FormattedSequenceHandle {
+    /** Allocate the next value and return it with its rendered serial string. */
+    next(opts?: NextOptions): Promise<{
+        serial: number;
+        formatted: string;
+    }>;
+    /** Read the current integer value without allocating. Returns 0 if never used. */
+    peek(): Promise<number>;
+    /** Set-if-greater on the underlying integer counter. See {@link SequenceHandle.seedTo}. */
+    seedTo(n: number): Promise<void>;
+}
+/**
+ * Validate a sequence `format` against the supplied partition and return a
+ * pure `(serial) => string` renderer. Eager validation: every token is
+ * checked now, so a bad pattern throws `ValidationError` at construction —
+ * never at `next()` time.
+ */
+declare function compileSequenceFormat(format: string, series: string, partition: readonly (string | number)[] | undefined): (serial: number) => string;
 /**
  * Resolve the CAS storage key for a (series, partition) pair.
  *
@@ -7639,6 +7707,78 @@ interface Assignment {
     serial: number;
 }
 
+/**
+ * `_links_*` reserved collections — managed bidirectional many-to-many
+ * junctions (#377 design B).
+ *
+ * Where `refArray` (design A) stores an id-array on one owning record,
+ * `vault.link()` creates a first-class junction: a dedicated encrypted
+ * `_links_<name>` collection whose rows are `{ a, b, meta? }` link tuples.
+ * It is queryable from BOTH sides (`of(id)`), carries optional per-link
+ * metadata, and cascades on endpoint delete.
+ *
+ * Each link is slot-typed: `a` is an id in the `a` endpoint collection,
+ * `b` an id in the `b` endpoint collection (they may be the same
+ * collection for self-links). A link's identity is the ordered pair
+ * `(a, b)`; `of(id)` matches either slot.
+ *
+ * Rows are encrypted under a dedicated `_links_<name>` DEK — same
+ * zero-knowledge stack as every other collection (the store sees only
+ * ciphertext). Backup/restore rides the normal `loadAll` path.
+ */
+
+/** True for any reserved link-collection name. */
+declare function isLinkCollectionName(name: string): boolean;
+/** What happens to a link's rows when one of its endpoint records is deleted. */
+type LinkOnDelete = 'cascade' | 'strict' | 'warn';
+/**
+ * Declaration for a link set, passed to `vault.link(name, spec)`. `a` and
+ * `b` are the endpoint collection names (slot-typed). `onDelete` governs
+ * what happens to link rows when an endpoint record is deleted:
+ * `'cascade'` (default) removes the touching link rows, `'strict'` blocks
+ * the endpoint delete while links exist, `'warn'` leaves orphan rows
+ * (surfaced by `vault.checkIntegrity()`).
+ */
+interface LinkSpec {
+    readonly a: string;
+    readonly b: string;
+    readonly onDelete?: LinkOnDelete;
+}
+/** One link tuple as returned by `of()` / `list()`. */
+interface LinkRow {
+    readonly a: string;
+    readonly b: string;
+    readonly meta?: Record<string, unknown>;
+}
+/** Public handle returned by `vault.links(name)`. */
+interface LinkSetHandle {
+    /** Create (or overwrite the metadata of) the link `(aId, bId)`. Validates both endpoints exist. */
+    connect(aId: string, bId: string, meta?: Record<string, unknown>): Promise<void>;
+    /** Remove the link `(aId, bId)`. Idempotent — a no-op if it doesn't exist. */
+    disconnect(aId: string, bId: string): Promise<void>;
+    /** Whether the link `(aId, bId)` exists. */
+    has(aId: string, bId: string): Promise<boolean>;
+    /** All links touching `id` on EITHER endpoint. */
+    of(id: string): Promise<LinkRow[]>;
+    /** All links in the set. */
+    list(): Promise<LinkRow[]>;
+}
+/** Thrown by `connect()` when an endpoint record does not exist. */
+declare class LinkEndpointError extends NoydbError {
+    readonly link: string;
+    readonly endpoint: string;
+    readonly missingId: string;
+    constructor(link: string, endpoint: string, missingId: string);
+}
+/** Thrown when a `strict` link blocks deletion of an endpoint that still has links. */
+declare class LinkIntegrityError extends NoydbError {
+    readonly link: string;
+    readonly endpoint: string;
+    readonly id: string;
+    readonly count: number;
+    constructor(link: string, endpoint: string, id: string, count: number);
+}
+
 /**
  * Vault-internal singleton that holds the guard graph and dispatches
  * per-collection guard execution. Owned by `Vault`; not exported.
@@ -7708,12 +7848,25 @@ declare class GuardRegistry {
 
 /**
  * Minimal read-only wrapper over a `Vault`. Used as `ctx.vault` inside
- * guard callbacks so they can fetch related records without acquiring
- * any write capability.
+ * guard / derivation callbacks so they can fetch related records without
+ * acquiring any write capability.
+ *
+ * The `layer` tags every `get`/`list` read with the resolution layer it
+ * belongs to (#285). A guard-seeded facade reads at `'guard'`, a
+ * derivation-seeded one at `'derivation'`, so i18nText / dictKey fields
+ * resolve under that layer's `onMissing` policy instead of the `'read'`
+ * policy — e.g. a guard read can `substitute` a missing locale (lenient
+ * default) while the same field `throw`s on an ordinary app read.
+ *
+ * `query()` is left untagged: the query/aggregate pipeline reads raw
+ * `{locale}` maps (no resolution call site), so a layer tag there would be
+ * inert. Routing `mv`/`join` resolution through the pipeline is tracked
+ * separately (#285 D2/D3).
  */
 declare class ReadOnlyVaultFacade implements ReadOnlyVaultFacade$1 {
     private readonly _vault;
-    constructor(vault: Vault);
+    private readonly _layer;
+    constructor(vault: Vault, layer?: Layer);
     collection<T = unknown>(name: string): {
         get(id: string): Promise<T | null>;
         list(): Promise<T[]>;
@@ -8910,13 +9063,17 @@ declare class Vault {
      */
     private overlayedViewRegistry;
     /**
-     * Cached read-only facade handed to guard callbacks via `ctx.vault`,
-     * and to derivation callbacks via `derive(source, ctx)`. Allocated
-     * eagerly inside `_initGuards()` and/or `_initDerivations()` so read
+     * Cached read-only facades handed to guard callbacks via `ctx.vault`
+     * and to derivation callbacks via `derive(source, ctx)`. Split by
+     * resolution layer (#285): the guard facade reads at `layer:'guard'`,
+     * the derivation facade at `layer:'derivation'`, so i18nText / dictKey
+     * fields resolve under that layer's `onMissing` policy. Allocated
+     * eagerly inside `_initGuards()` / `_initDerivations()` so read
      * accessors stay synchronous (callers in `tx/transaction.ts` rely on
-     * that). Stays `null` for vaults with neither subsystem configured.
+     * that). Each stays `null` for vaults without that subsystem.
      */
-    private readOnlyFacade;
+    private guardFacade;
+    private derivationFacade;
     private getDEK;
     /**
      * Per-principal user envelope API.
@@ -9073,6 +9230,10 @@ declare class Vault {
     private readonly i18nFieldRegistry;
     /** Cache of DictionaryHandle instances, one per dictionary name. */
     private readonly dictionaryCache;
+    /** Registered link specs (#377-B), keyed by link name; set by `vault.link()`. */
+    private readonly linkRegistry;
+    /** Cache of LinkSet handles, one per link name. */
+    private readonly linkSetCache;
     /** — subscribers for cross-tier access events. */
     private readonly crossTierSubs;
     /** — currently-active elevation, or null. One per vault. */
@@ -9232,6 +9393,17 @@ declare class Vault {
         schemaUpdate?: readonly SchemaUpdateStrategy[];
         /** — declare the per-field schema for document attestation (issue side). */
         attestation?: AttestationFieldSchema;
+        /**
+         * Per-collection history & tamper-ledger scoping. Overrides the
+         * vault-wide `history` config for THIS collection only (wholesale, not
+         * merged). `enabled: false` suppresses per-record snapshots for this
+         * collection; `ledger: false` excludes its writes from the vault-wide
+         * hash-chained tamper ledger. Lets you confine version snapshots +
+         * tamper-evidence to the few collections where they carry legal weight,
+         * without paying snapshot + ledger-entry-per-write across operational /
+         * derived collections. Defaults to the vault-wide `history` config. See #361.
+         */
+        historyConfig?: HistoryConfig;
     }): Collection<T>;
     /**
      * Await all background persisted-schema writes triggered by
@@ -9318,6 +9490,32 @@ declare class Vault {
      * ```
      */
     dictionary<Keys extends string = string>(name: string, options?: DictionaryOptions): DictionaryHandle<Keys>;
+    /**
+     * Declare a managed many-to-many link set (#377-B). Registers a
+     * `_links_<name>` junction between two endpoint collections; access its
+     * rows via `vault.links(name)`. Idempotent for an identical re-declaration;
+     * a conflicting one throws. See {@link links}.
+     *
+     * ```ts
+     * vault.link('saleLineLinks', { a: ref('saleLines'), b: ref('purchaseLines'), onDelete: 'cascade' })
+     * ```
+     *
+     * `a` / `b` accept either a collection name or a `ref(target)` descriptor
+     * (only its `target` is used — links manage their own integrity). `onDelete`
+     * governs what happens to link rows when an endpoint record is deleted
+     * (`'cascade'` default, `'strict'`, `'warn'`).
+     */
+    link(name: string, spec: {
+        a: string | RefDescriptor;
+        b: string | RefDescriptor;
+        onDelete?: LinkSpec['onDelete'];
+    }): void;
+    /**
+     * Access a declared link set (#377-B). Throws if `name` was not first
+     * declared via {@link link}. Returns a cached {@link LinkSetHandle}:
+     * `connect(a, b, meta?)`, `disconnect(a, b)`, `has(a, b)`, `of(id)`, `list()`.
+     */
+    links(name: string): LinkSetHandle;
     /**
      * Build a `JoinableSource` for a dictKey field, for use in dict joins
      *. Returns a source whose snapshot contains `{ key, ...labels }`
@@ -9473,7 +9671,19 @@ declare class Vault {
      * const n = await vault.sequence('invoice-2026').next()   // 1, then 2, …
      * const cur = await vault.sequence('invoice-2026').peek()  // current value, no allocation
      * ```
+     *
+     * Pass a `format` (#375) to emit a serial string instead of a bare
+     * integer — `next()` then returns `{ serial, formatted }`. Per-partition
+     * reset is inherent (a new partition tuple starts at 1):
+     *
+     * ```ts
+     * const seq = vault.sequence('fatture', { partition: [2026], format: '{partition.0}/{seq:04}' })
+     * await seq.next()   // { serial: 1, formatted: '2026/0001' }
+     * ```
      */
+    sequence(series: string, opts: SequenceOptions & {
+        format: string;
+    }): FormattedSequenceHandle;
     sequence(series: string, opts?: SequenceOptions): SequenceHandle;
     /** @internal — lazily build the deferred-numbering engine with a cache-coherent stamp. */
     private deferred;
@@ -9566,6 +9776,13 @@ declare class Vault {
      * mutually-cascading collections don't recurse forever.
      */
     enforceRefsOnDelete(collectionName: string, id: string): Promise<void>;
+    /**
+     * @internal — apply link `onDelete` policy when an endpoint record is
+     * deleted (#377-B). `'strict'` throws (blocks the delete), `'cascade'`
+     * removes the touching link rows (tx-atomic when a transaction is active),
+     * `'warn'` leaves orphans for `checkIntegrity()`.
+     */
+    private enforceLinksOnDelete;
     /**
      * Look up the `RefDescriptor` the left collection declared for a
      * given field name. Returns `null` when the field has no ref
@@ -9826,9 +10043,10 @@ declare class Vault {
      */
     _getReadOnlyFacade(): ReadOnlyVaultFacade | null;
     /**
-     * Internal lazy-allocator for the read-only facade. Used as a
-     * defensive fallback; in practice `_initGuards()` eagerly
-     * instantiates this, so the lazy path is a no-op.
+     * Internal lazy-allocator for the derivation read-only facade
+     * (`layer:'derivation'`). Used as a defensive fallback; in practice
+     * `_initDerivations()` eagerly instantiates this, so the lazy path is
+     * a no-op.
      */
     private _ensureReadOnlyFacade;
     /**
@@ -11216,6 +11434,34 @@ declare class Collection<T> {
      * output (carries `_derivedFrom`) — defensive guard against missed
      * cycle detection.
      */
+    /**
+     * @internal #376 — the RAW stored record (canonical-money form, i18n maps
+     * intact), WITHOUT the locale resolution `get()` applies. Used as the
+     * patch base for self-write reverse-denorm so writing back never clobbers
+     * an i18n map or re-quantizes money incorrectly. Returns null for
+     * missing / tombstoned records.
+     */
+    _getStoredRecord(id: string): Promise<T | null>;
+    /**
+     * @internal #376 — ids of records whose top-level `field` equals `value`.
+     * Uses the FK index when the field is indexed (O(matches)); otherwise a
+     * linear scan (O(N) — fine for small child sets; index the FK to scale).
+     */
+    _findMatchingIds(field: string, value: unknown): Promise<string[]>;
+    /**
+     * @internal #376 slice 2 — recompute a rollup aggregate onto the parent.
+     * Gathers every child of `parentId`, runs `compute`, and patches only the
+     * rollup `field` onto the parent's raw stored record (value-equality
+     * guarded). No-op when the parent record does not exist.
+     */
+    private recomputeRollup;
+    /**
+     * @internal #376 slice 2 — fire any rollups for which THIS collection is the
+     * child `from`, recomputing the affected parent after a child delete. Called
+     * from the delete path with the just-removed record's key value. Other
+     * derivation kinds do not react to deletes (unchanged).
+     */
+    private dispatchRollupsOnDelete;
     private dispatchDerivations;
     /**
      * Delete a record by ID. Runs inside the hub's write-queue tracker
@@ -11340,6 +11586,19 @@ declare class Collection<T> {
      * no-transform fast path in {@link list}.
      */
     private hasReadTransforms;
+    /**
+     * Scan-mode full-text search over a plain-text `field` (#308). Decrypts the
+     * collection in memory and ranks records by BM25 against the tokenized query.
+     * **Zero added store leakage** — pure client-side scan; nothing searchable is
+     * written to the store. (A store-usable blind index for at-scale search is a
+     * separate, gated opt-in — see the #308 design note.) Eager mode only.
+     *
+     * `opts.match` (`'any'` default | `'all'`), `opts.prefix` (last query term as
+     * a prefix → typeahead), `opts.limit` (top-N). Returns `{ id, score, record }`
+     * ranked by descending score. The default tokenizer is word-boundary based —
+     * see `src/search/tokenize.ts` for the Thai/CJK caveat.
+     */
+    search(field: string, query: string, opts?: SearchOptions): Promise<SearchResult<T>[]>;
     /**
      * Put many records in one call. Each item is processed sequentially
      * through the normal `put()` path — meaning per-item validation,
@@ -11769,6 +12028,23 @@ declare class Collection<T> {
      * surface on `index:write-partial` the same way put does.
      */
     private maintainPersistedIndexesOnDelete;
+    /**
+     * @internal — hard-delete this record's persisted `_idx/<field>/<recordId>`
+     * side-cars for the erasure path (#401). `forget()` crypto-shreds the body but
+     * keeps the collection DEK, under which these side-cars are encrypted — so
+     * without this they leave the indexed field VALUES readable after a "forget".
+     *
+     * Content-free: the side-car id is `encodeIdxId(def.key, id)`, so it needs no
+     * body decode (the body is being shredded). Eager mode has no durable side-car
+     * → no-op. The in-memory mirror is left as-is: it is ephemeral (rebuilt from
+     * the now-deleted side-cars on reopen) and live reads skip the tombstone, so a
+     * stale mirror hit cannot surface the erased record. Returns the count deleted
+     * + the `def.key`s whose delete FAILED (residue that still leaks the value).
+     */
+    _purgePersistedIndexes(id: string): Promise<{
+        purged: number;
+        residue: string[];
+    }>;
     /**
      * Bulk-load the persisted-index mirror from `_idx/<field>/*` side-cars
      * on first lazy-mode query. Idempotent — subsequent calls short-circuit
@@ -12862,13 +13138,15 @@ interface ExportStreamOptions {
      */
     readonly withLedgerHead?: boolean;
     /**
-     * When set to a BCP 47 locale string (e.g. `'th'`), `exportJSON()`
-     * resolves all `dictKey` labels to that locale and omits the raw
-     * `dictionaries` snapshot from the output. Has no effect
-     * on `exportStream()` — format packages use the `chunk.dictionaries`
-     * snapshot directly and apply their own locale strategy.
+     * Export locale (BCP 47, e.g. `'th'`). When set, records are read at this
+     * locale through the **`export` layer** (#285): `i18nText` fields collapse to
+     * the locale string (honoring each field's `export`-layer `onMissing` policy)
+     * and `dictKey`/`staticDict` `<field>Label`s are resolved — a single-locale
+     * export. The raw `dictionaries` snapshot is then redundant and omitted. This
+     * applies to BOTH `exportStream()` and `exportJSON()`.
      *
-     * Default: `undefined` — embed the raw snapshot under `_dictionaries`.
+     * Default: `undefined` — raw `{locale}` maps + the `_dictionaries` snapshot
+     * (a full, all-locale backup; format packages apply their own locale strategy).
      */
     readonly resolveLabels?: string;
 }
@@ -13403,6 +13681,15 @@ interface LocaleReadOptions {
      * element to fall back to any present translation.
      */
     readonly fallback?: string | readonly string[];
+    /**
+     * @internal — the resolution layer this read belongs to (`'read'` by
+     * default). Threaded by layer-tagged read facades (guard / derivation)
+     * so `applyI18nLocale` and dictKey `resolvePolicy` select that layer's
+     * `onMissing` policy instead of the `'read'` policy. Not part of the
+     * public read API — callers select policy via the field's `onMissing`
+     * map, not by setting this. See #285.
+     */
+    readonly _layer?: Layer;
 }
 /**
  * Context passed to the consumer-supplied `plaintextTranslator` function.
@@ -13672,6 +13959,13 @@ interface StoreCapabilities {
      * numbering (use CAS `sequence().next()` or per-series).
      */
     serverWriteTime?: boolean;
+    /**
+     * Advisory geographic region this store serves (e.g. `'eu'`, `'us'`).
+     * Purely declarative — no behavior change for stores that omit it. The
+     * federation data-residency guard (#271) compares this against a
+     * `sharding.regionOf(record)` to refuse non-compliant shard placement.
+     */
+    region?: string;
     auth: StoreAuth;
     /**
      * true — the store implements {@link NoydbStore.tx} and commits
@@ -14095,6 +14389,16 @@ interface HistoryConfig {
     readonly enabled?: boolean;
     /** Maximum history entries per record. Oldest pruned on overflow. Default: unlimited. */
     readonly maxVersions?: number;
+    /**
+     * Participate in the vault-wide hash-chained tamper ledger. Default:
+     * `true` (every write of this collection appends a ledger entry when
+     * `withHistory()` is active). Set `false` to exclude this collection's
+     * writes from the chain — its puts/deletes leave no ledger entry,
+     * confining tamper-evidence to the collections where it carries weight.
+     * Independent of `enabled`, which gates per-record snapshots. Has no
+     * effect when `withHistory()` is not active (there is no ledger). See #361.
+     */
+    readonly ledger?: boolean;
 }
 /** Options for querying history. */
 interface HistoryOptions {
@@ -14163,4 +14467,4 @@ interface DeleteManyResult {
     }>;
 }
 
-export { DEFAULT_CHUNK_SIZE as $, createEnforcer as A, validateSessionPolicy as B, type BlobStrategy as C, DICT_COLLECTION_PREFIX as D, BLOB_CHUNKS_COLLECTION as E, BLOB_COLLECTION as F, BLOB_EVICTION_AUDIT_COLLECTION as G, BLOB_INDEX_COLLECTION as H, type I18nStrategy as I, BLOB_SLOTS_PREFIX as J, BLOB_VERSIONS_PREFIX as K, type Layer as L, type BlobEvictionEntry as M, type BlobFieldPolicy as N, type OnMissing as O, PolicyEnforcer as P, type BlobFieldsConfig as Q, type ResolveI18nOptions as R, type ScriptWarning as S, type BlobObject as T, type BlobPutOptions as U, type BlobResponseOptions as V, BlobSet as W, type BlobStrategyOpenArgs as X, type CompactRunOptions as Y, type CompactionContext as Z, type CompactionResult as _, type DictEntry as a, type Role as a$, EXPORT_AUDIT_COLLECTION as a0, ExportBlobsAbortedError as a1, type ExportBlobsAuditEntry as a2, type ExportBlobsHandle as a3, type ExportBlobsOptions as a4, type ExportedBlob as a5, type SlotInfo as a6, type SlotRecord as a7, type VersionRecord as a8, createExportBlobsHandle as a9, ReadOnlyVaultFacade as aA, type ShadowStrategy as aB, CollectionFrame as aC, VaultFrame as aD, type NoydbBundleStore as aE, type RetentionPolicy as aF, type SnapshotPolicy as aG, type SnapshotStrategy as aH, type SnapshotMeta as aI, type SnapshotMode as aJ, type DerivationStrategy as aK, type DerivationContext as aL, type ArrayOutputSpec as aM, DerivationRegistry as aN, type DerivationStrategyHandle as aO, type DerivedFromMeta as aP, type OutputSpec as aQ, type RecordOutputSpec as aR, type MaterializedViewStrategy as aS, type MaterializedViewStrategyHandle as aT, type OverlayedViewStrategy as aU, Collection as aV, type OverlayFieldMergeMode as aW, type OverlayFieldMergeRule as aX, OverlayedViewRegistry as aY, type OverlayedViewStrategyHandle as aZ, type SyncStrategy as a_, runCompaction as aa, type ConsentStrategy as ab, CONSENT_AUDIT_COLLECTION as ac, type ConsentAuditEntry as ad, type ConsentAuditFilter as ae, type ConsentContext as af, type ConsentOp as ag, loadConsentEntries as ah, writeConsentEntry as ai, type PeriodsStrategy as aj, type CarryForwardContext as ak, type ClosePeriodOptions as al, type OpenPeriodOptions as am, PERIODS_COLLECTION as an, type PeriodRecord as ao, type ReadOnlyCollection as ap, appendPeriodLedgerEntry as aq, assertTsWritable as ar, chainAnchor as as, loadPeriods as at, validatePeriodName as au, type GuardStrategy as av, type GuardChange as aw, type GuardContext as ax, GuardRegistry as ay, type GuardStrategyHandle as az, type DictKeyDescriptor as b, type CollectionStats as b$, type UnlockedKeyring as b0, type HistoryStrategy as b1, type NoydbStore as b2, type HistoryOptions as b3, type EncryptedEnvelope as b4, type PruneOptions as b5, type AppendInput as b6, type ChangeType as b7, CollectionInstant as b8, type DiffEntry as b9, type UserEnvelope as bA, type GateName as bB, type GatePolicy as bC, type VaultPolicy as bD, type ActiveTier as bE, type FactorProof as bF, type SchemaUpdateStrategy as bG, type TransformFn as bH, type PersistedSchemaEnvelope as bI, type UpdateDecision as bJ, type DirectoryConfig as bK, type UserVisibility as bL, type AccessibleVault as bM, type AffectedDocument as bN, type ArchivePolicy as bO, type ArchiveResult as bP, type ArchiveRunOptions as bQ, type ArchiveStrategy as bR, BUNDLE_STORE_POLICY as bS, type BuiltInGateName as bT, type CacheOptions as bU, type CacheStats as bV, type CapturedBlueprint as bW, type ChangeEvent as bX, type CollectionChangeEvent as bY, type CollectionConflictResolver as bZ, type CollectionDescriptor as b_, type JsonPatch as ba, type JsonPatchOp as bb, LedgerStore as bc, type VaultEngine as bd, VaultInstant as be, type VerifyResult as bf, applyPatch as bg, computePatch as bh, diff as bi, formatDiff as bj, type PublicEnvelope as bk, type SealingKeyProvider as bl, type BundleRecipient as bm, type RecipientSealer as bn, type RecipientHint as bo, Vault as bp, type RecoveryEnrollmentInput as bq, type ShamirRecoveryProvider as br, TxContext as bs, type MVQueryContext as bt, type RegisteredMV as bu, MaterializedViewRegistry as bv, type MaterializedFromMeta as bw, type MaterializedViewOutput as bx, type UnionArmJoin as by, type UnionSource as bz, DictionaryHandle as c, type LiveUserEnvelope as c$, ComputedFieldError as c0, type ComputedFields as c1, type ComputedFn as c2, type Conflict as c3, type ConflictPolicy as c4, type ConflictStrategy as c5, type CrossTierAccessEvent as c6, CrossVaultAggregation as c7, CrossVaultGroupedAggregation as c8, type GroupedRow as c9, type FactorRequirement as cA, type FanoutQueryOptions as cB, type FanoutResult as cC, type FenceDoc as cD, type FenceState as cE, type FieldChange as cF, type FieldDescriptor as cG, type FieldSource as cH, type GhostRecord as cI, type GrantOptions as cJ, type GuardViolation as cK, type HistoryConfig as cL, type HistoryEntry as cM, INDEXED_STORE_POLICY as cN, type ImportCapability as cO, type InferOutput as cP, type InternalCollectionStats as cQ, type IssueDelegationOptions as cR, type IssueMagicLinkGrantOptions as cS, type KeyringAuthenticator as cT, type KeyringAuthenticatorWrappingDEKs as cU, type KeyringAuthenticatorWrappingKEK as cV, type KeyringFile as cW, type ListAccessibleVaultsOptions as cX, type ListPageResult as cY, type ListUsersOptions as cZ, type LiveQueryOptions as c_, type CrossVaultLiveAggregation as ca, type CrossVaultLiveQuery as cb, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as cc, DELEGATIONS_COLLECTION as cd, type DeepPartial as ce, type DeepPartialOrNull as cf, type DeferredNumberingConfig as cg, type DelegationToken as ch, type DeleteManyResult as ci, type DeploymentEvent as cj, type DerivationDescriptor as ck, type DirtyEntry as cl, type DryRunResult as cm, type DumpSchemaOptions as cn, ELEVATION_AUDIT_COLLECTION as co, ElevatedHandle as cp, type EnrollAuthenticatorOptions as cq, type EnrollAuthenticatorWrappingDEKsOptions as cr, type EnrollAuthenticatorWrappingKEKOptions as cs, type EnrollRecoveryResult as ct, type ExportCapability as cu, type ExportChunk as cv, type ExportFormat as cw, type ExportStreamOptions as cx, type FactorKind as cy, type FactorProofBundle as cz, type DictionaryOptions as d, SEALED_PASSPHRASE_RECORD_ID as d$, type LocaleReadOptions as d0, Lru as d1, type LruOptions as d2, type LruStats as d3, MAGIC_LINK_CONTENT_INFO_PREFIX as d4, MAGIC_LINK_GRANTS_COLLECTION as d5, MAGIC_LINK_KEK_INFO_PREFIX as d6, type MagicLinkGrantPayload as d7, type MagicLinkGrantRecord as d8, type MaterializedViewDescriptor as d9, type PublicEnvelopeSchema as dA, type PublicEnvelopeText as dB, type PullMode as dC, type PullOptions as dD, type PullPolicy as dE, type PullResult as dF, type PushMode as dG, type PushOptions as dH, type PushPolicy as dI, type PushResult as dJ, type PutManyItemOptions as dK, type PutManyOptions as dL, type PutManyResult as dM, type QueryAcrossOptions as dN, type QueryAcrossResult as dO, type QuickUnlockState as dP, QuickUnlockStore as dQ, type ReAuthOperation as dR, type RecoverPassphraseInput as dS, type RecoverPassphraseResult as dT, type RecoverUserOptions as dU, type RecoveryProof as dV, type ResolvedPublicEnvelopeSchema as dW, type RevokeOptions as dX, type RotatePassphraseInput as dY, type RotateRecoveryOptions as dZ, type RotateRecoveryResult as d_, MemoryRecipientSealer as da, MemorySealingKeyProvider as db, NOYDB_BACKUP_VERSION as dc, NOYDB_FORMAT_VERSION as dd, NOYDB_KEYRING_VERSION as de, NOYDB_SYNC_VERSION as df, type NextOptions as dg, Noydb as dh, type NoydbEventMap as di, type NoydbOptions as dj, type Assignment as dk, type OverlayViewDescriptor as dl, PUBLIC_ENVELOPE_FIELDS as dm, type PaperRecoveryDoc as dn, type PaperRecoveryEntry as dp, type PassphrasePolicy as dq, type PassphraseValidationResult as dr, type Permission as ds, type Permissions as dt, type PersistedSchemaKind as du, type PlaintextTranslatorContext as dv, type PlaintextTranslatorFn as dw, PresenceHandle as dx, type PresencePeer as dy, type PublicEnvelopeField as dz, type I18nMap as e, type VaultRegistryRow as e$, type SchemaDelta as e0, type SchemaIntrospection as e1, type SchemaManifestRow as e2, type SealedEnvelope as e3, type SealedPassphrase as e4, type SequenceHandle as e5, type SequenceOptions as e6, SequenceStore as e7, type SessionPolicy as e8, type SetPublicEnvelopeInput as e9, type SyncTransactionResult as eA, type TabChannel as eB, type TabCoordinationOptions as eC, type TabLockManager as eD, type TabPresence as eE, type TabRole as eF, type TierMode as eG, type TransactionInvariant as eH, type TranslatorAuditEntry as eI, TxCollection as eJ, type TxOp as eK, TxVault as eL, USER_ENVELOPE_COLLECTION as eM, USER_ENVELOPE_MAX_BYTES as eN, type Unsubscribe as eO, type UpdateAuthenticatorOptions as eP, type UpdateContext as eQ, type UpdateUserOptions as eR, UserApi as eS, type UserEnvelopeCheckGate as eT, UserEnvelopeOversizedError as eU, type UserEnvelopePresented as eV, type UserInfo as eW, type VaultBackup as eX, VaultGroup as eY, type VaultGroupOptions as eZ, type VaultPolicyOnDisk as e_, type ShamirRecoveryDoc as ea, type ShamirRecoveryEntry as eb, ShardedCollection as ec, ShardedGroupedQuery as ed, ShardedQuery as ee, type ShardingConfig as ef, type SkippedVault as eg, type SlotRewrapCeremony as eh, type SlotRewrapContext as ei, type StandardSchemaV1 as ej, type StandardSchemaV1Issue as ek, type StandardSchemaV1SyncResult as el, StateManagementVault as em, type StoreAuth as en, type StoreAuthKind as eo, type StoreCapabilities as ep, type StoreTime as eq, SyncEngine as er, type SyncMetadata as es, type SyncPolicy as et, SyncScheduler as eu, type SyncSchedulerStatus as ev, type SyncStatus as ew, type SyncTarget as ex, type SyncTargetRole as ey, SyncTransaction as ez, type I18nTextDescriptor as f, validatePublicEnvelopeInput as f$, type VaultSchemaSnapshot as f0, type VaultSnapshot as f1, type VaultTemplate as f2, type WarningRules as f3, WeakPassphraseError as f4, type WeakPassphraseReason as f5, type WithArchiveOptions as f6, type WrappedDeksBlob as f7, type WriteConflict as f8, type WriteEvent as f9, loadActiveDelegations as fA, loadPaperRecoveryEntries as fB, loadSealedPassphrase as fC, loadShamirRecoveryEntries as fD, magicLinkGrantRecordId as fE, mintPaperRecoveryEntry as fF, mintShamirRecoveryEntry as fG, mintWrappedDeksBlob as fH, parseRsaOaepTlv as fI, parseSealedEnvelope as fJ, readMagicLinkGrantRecord as fK, recoverUser as fL, removeAuthenticator as fM, resolveSchema as fN, resolveSequenceKey as fO, revokeDelegation as fP, revokeMagicLinkGrant as fQ, runTransaction as fR, savePaperRecoveryEntries as fS, saveSealedPassphrase as fT, saveShamirRecoveryEntries as fU, sealRsaOaepTlv as fV, unwrapDeksFromBlob as fW, unwrapDeksFromPaperEntry as fX, unwrapDeksFromShamirEntry as fY, unwrapMagicLinkGrant as fZ, validatePassphrase as f_, type WriteHook as fa, type WriteQueue as fb, aesGcmOpen as fc, assertStrongPassphrase as fd, buildRecipientKeyringFile as fe, burnPaperRecoveryEntry as ff, createNoydb as fg, createStore as fh, deriveMagicLinkContentKey as fi, enrollAuthenticator as fj, estimateEntropy as fk, evalComputedFields as fl, evaluateExportCapability as fm, evaluateImportCapability as fn, findAuthenticator as fo, hasExportCapability as fp, hasImportCapability as fq, hasRecoveryEnrolled as fr, isMagicLinkGrantExpired as fs, isPublicEnvelope as ft, issueDelegation as fu, recoverPassphrase as fv, rotatePassphrase as fw, listMagicLinkGrants as fx, listUsers as fy, listUsersWithEnvelopes as fz, type I18nTextOptions as g, validateSchemaInput as g0, validateSchemaOutput as g1, withArchive as g2, withDeferredNumbering as g3, writeMagicLinkGrant as g4, changeSecret as g5, createOwnerKeyring as g6, ensureCollectionDEK as g7, grant as g8, loadKeyring as g9, persistKeyring as ga, revoke as gb, updateAuthenticator as gc, updateKeyringIdentity as gd, type TxStrategy as ge, type AmendmentTxOptions as gf, type OnMissingPolicy as h, type StaticDictDescriptor as i, applyI18nLocale as j, dictCollectionName as k, dictKey as l, enforceScript as m, getAtPath as n, i18nText as o, inferScripts as p, isDictCollectionName as q, isDictKeyDescriptor as r, isI18nTextDescriptor as s, isStaticDictDescriptor as t, resolveI18nText as u, resolvePolicy as v, setAtPathInPlace as w, staticDict as x, validateI18nTextValue as y, type SessionStrategy as z };
+export { type ConsentAuditFilter as $, type BlobPutOptions as A, type BlobStrategy as B, type BlobResponseOptions as C, DICT_COLLECTION_PREFIX as D, BlobSet as E, type BlobStrategyOpenArgs as F, type CompactRunOptions as G, type CompactionContext as H, type I18nStrategy as I, type CompactionResult as J, DEFAULT_CHUNK_SIZE as K, EXPORT_AUDIT_COLLECTION as L, ExportBlobsAbortedError as M, type ExportBlobsAuditEntry as N, type ExportBlobsHandle as O, PolicyEnforcer as P, type ExportBlobsOptions as Q, type ExportedBlob as R, type ScriptWarning as S, type SlotInfo as T, type SlotRecord as U, type VersionRecord as V, createExportBlobsHandle as W, runCompaction as X, type ConsentStrategy as Y, CONSENT_AUDIT_COLLECTION as Z, type ConsentAuditEntry as _, type DictEntry as a, VaultInstant as a$, type ConsentContext as a0, type ConsentOp as a1, loadConsentEntries as a2, writeConsentEntry as a3, type PeriodsStrategy as a4, type CarryForwardContext as a5, type ClosePeriodOptions as a6, type OpenPeriodOptions as a7, PERIODS_COLLECTION as a8, type PeriodRecord as a9, type DerivedFromMeta as aA, type OutputSpec as aB, type RecordOutputSpec as aC, type MaterializedViewStrategy as aD, type MaterializedViewStrategyHandle as aE, type OverlayedViewStrategy as aF, Collection as aG, type OverlayFieldMergeMode as aH, type OverlayFieldMergeRule as aI, OverlayedViewRegistry as aJ, type OverlayedViewStrategyHandle as aK, type SyncStrategy as aL, type Role as aM, type UnlockedKeyring as aN, type HistoryStrategy as aO, type NoydbStore as aP, type HistoryOptions as aQ, type EncryptedEnvelope as aR, type PruneOptions as aS, type AppendInput as aT, type ChangeType as aU, CollectionInstant as aV, type DiffEntry as aW, type JsonPatch as aX, type JsonPatchOp as aY, LedgerStore as aZ, type VaultEngine as a_, type ReadOnlyCollection as aa, appendPeriodLedgerEntry as ab, assertTsWritable as ac, chainAnchor as ad, loadPeriods as ae, validatePeriodName as af, type GuardStrategy as ag, type GuardChange as ah, type GuardContext as ai, GuardRegistry as aj, type GuardStrategyHandle as ak, ReadOnlyVaultFacade as al, type ShadowStrategy as am, CollectionFrame as an, VaultFrame as ao, type NoydbBundleStore as ap, type RetentionPolicy as aq, type SnapshotPolicy as ar, type SnapshotStrategy as as, type SnapshotMeta as at, type SnapshotMode as au, type DerivationStrategy as av, type DerivationContext as aw, type ArrayOutputSpec as ax, DerivationRegistry as ay, type DerivationStrategyHandle as az, type DictKeyDescriptor as b, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as b$, type VerifyResult as b0, applyPatch as b1, computePatch as b2, diff as b3, formatDiff as b4, type PublicEnvelope as b5, type SealingKeyProvider as b6, type BundleRecipient as b7, type RecipientSealer as b8, type RecipientHint as b9, type ArchiveResult as bA, type ArchiveRunOptions as bB, type ArchiveStrategy as bC, BUNDLE_STORE_POLICY as bD, type BuiltInGateName as bE, type CacheOptions as bF, type CacheStats as bG, type CapturedBlueprint as bH, type ChangeEvent as bI, type CollectionChangeEvent as bJ, type CollectionConflictResolver as bK, type CollectionDescriptor as bL, type CollectionStats as bM, ComputedFieldError as bN, type ComputedFields as bO, type ComputedFn as bP, type Conflict as bQ, type ConflictPolicy as bR, type ConflictStrategy as bS, type CrossTierAccessEvent as bT, CrossVaultAggregation as bU, type CrossVaultDerivationContext as bV, type CrossVaultDerivationSpec as bW, CrossVaultGroupedAggregation as bX, type GroupedRow as bY, type CrossVaultLiveAggregation as bZ, type CrossVaultLiveQuery as b_, Vault as ba, type RecoveryEnrollmentInput as bb, type ShamirRecoveryProvider as bc, TxContext as bd, type MVQueryContext as be, type RegisteredMV as bf, MaterializedViewRegistry as bg, type MaterializedFromMeta as bh, type MaterializedViewOutput as bi, type UnionArmJoin as bj, type UnionSource as bk, type UserEnvelope as bl, type GateName as bm, type GatePolicy as bn, type VaultPolicy as bo, type ActiveTier as bp, type FactorProof as bq, type SchemaUpdateStrategy as br, type TransformFn as bs, type PersistedSchemaEnvelope as bt, type UpdateDecision as bu, type DirectoryConfig as bv, type UserVisibility as bw, type AccessibleVault as bx, type AffectedDocument as by, type ArchivePolicy as bz, DictionaryHandle as c, MAGIC_LINK_CONTENT_INFO_PREFIX as c$, DELEGATIONS_COLLECTION as c0, type DeepPartial as c1, type DeepPartialOrNull as c2, type DeferredNumberingConfig as c3, type DelegationToken as c4, type DeleteManyResult as c5, type DeploymentEvent as c6, type DerivationDescriptor as c7, type DirtyEntry as c8, type DryRunResult as c9, type HistoryConfig as cA, type HistoryEntry as cB, INDEXED_STORE_POLICY as cC, type ImportCapability as cD, type InferOutput as cE, type InternalCollectionStats as cF, type IssueDelegationOptions as cG, type IssueMagicLinkGrantOptions as cH, type KeyringAuthenticator as cI, type KeyringAuthenticatorWrappingDEKs as cJ, type KeyringAuthenticatorWrappingKEK as cK, type KeyringFile as cL, LinkEndpointError as cM, LinkIntegrityError as cN, type LinkOnDelete as cO, type LinkRow as cP, type LinkSetHandle as cQ, type LinkSpec as cR, type ListAccessibleVaultsOptions as cS, type ListPageResult as cT, type ListUsersOptions as cU, type LiveQueryOptions as cV, type LiveUserEnvelope as cW, type LocaleReadOptions as cX, Lru as cY, type LruOptions as cZ, type LruStats as c_, type DumpSchemaOptions as ca, ELEVATION_AUDIT_COLLECTION as cb, ElevatedHandle as cc, type EnrollAuthenticatorOptions as cd, type EnrollAuthenticatorWrappingDEKsOptions as ce, type EnrollAuthenticatorWrappingKEKOptions as cf, type EnrollRecoveryResult as cg, type ExportCapability as ch, type ExportChunk as ci, type ExportFormat as cj, type ExportStreamOptions as ck, type FactorKind as cl, type FactorProofBundle as cm, type FactorRequirement as cn, type FanoutQueryOptions as co, type FanoutResult as cp, type FenceDoc as cq, type FenceState as cr, type FieldChange as cs, type FieldDescriptor as ct, type FieldSource as cu, type FleetMigrationResult as cv, type FormattedSequenceHandle as cw, type GhostRecord as cx, type GrantOptions as cy, type GuardViolation as cz, type DictionaryOptions as d, type SchemaManifestRow as d$, MAGIC_LINK_GRANTS_COLLECTION as d0, MAGIC_LINK_KEK_INFO_PREFIX as d1, type MagicLinkGrantPayload as d2, type MagicLinkGrantRecord as d3, type MaterializedViewDescriptor as d4, MemoryRecipientSealer as d5, MemorySealingKeyProvider as d6, type MigrationStatusRow as d7, NOYDB_BACKUP_VERSION as d8, NOYDB_FORMAT_VERSION as d9, type PullPolicy as dA, type PullResult as dB, type PushMode as dC, type PushOptions as dD, type PushPolicy as dE, type PushResult as dF, type PutManyItemOptions as dG, type PutManyOptions as dH, type PutManyResult as dI, type QueryAcrossOptions as dJ, type QueryAcrossResult as dK, type QuickUnlockState as dL, QuickUnlockStore as dM, type ReAuthOperation as dN, type RecoverPassphraseInput as dO, type RecoverPassphraseResult as dP, type RecoverUserOptions as dQ, type RecoveryProof as dR, type RefreshInsightsResult as dS, type ResolvedPublicEnvelopeSchema as dT, type RevokeOptions as dU, type RotatePassphraseInput as dV, type RotateRecoveryOptions as dW, type RotateRecoveryResult as dX, SEALED_PASSPHRASE_RECORD_ID as dY, type SchemaDelta as dZ, type SchemaIntrospection as d_, NOYDB_KEYRING_VERSION as da, NOYDB_SYNC_VERSION as db, type NextOptions as dc, Noydb as dd, type NoydbEventMap as de, type NoydbOptions as df, type Assignment as dg, type OverlayViewDescriptor as dh, PUBLIC_ENVELOPE_FIELDS as di, type PaperRecoveryDoc as dj, type PaperRecoveryEntry as dk, type PassphrasePolicy as dl, type PassphraseValidationResult as dm, type Permission as dn, type Permissions as dp, type PersistedSchemaKind as dq, type PlaintextTranslatorContext as dr, type PlaintextTranslatorFn as ds, PresenceHandle as dt, type PresencePeer as du, type PublicEnvelopeField as dv, type PublicEnvelopeSchema as dw, type PublicEnvelopeText as dx, type PullMode as dy, type PullOptions as dz, type StaticDictDescriptor as e, type VaultRegistryRow as e$, type SealedEnvelope as e0, type SealedPassphrase as e1, type SearchEntry as e2, type SearchOptions as e3, type SearchResult as e4, type SequenceHandle as e5, type SequenceOptions as e6, SequenceStore as e7, type SessionPolicy as e8, type SetPublicEnvelopeInput as e9, type SyncTransactionResult as eA, type TabChannel as eB, type TabCoordinationOptions as eC, type TabLockManager as eD, type TabPresence as eE, type TabRole as eF, type TierMode as eG, type TransactionInvariant as eH, type TranslatorAuditEntry as eI, TxCollection as eJ, type TxOp as eK, TxVault as eL, USER_ENVELOPE_COLLECTION as eM, USER_ENVELOPE_MAX_BYTES as eN, type Unsubscribe as eO, type UpdateAuthenticatorOptions as eP, type UpdateContext as eQ, type UpdateUserOptions as eR, UserApi as eS, type UserEnvelopeCheckGate as eT, UserEnvelopeOversizedError as eU, type UserEnvelopePresented as eV, type UserInfo as eW, type VaultBackup as eX, VaultGroup as eY, type VaultGroupOptions as eZ, type VaultPolicyOnDisk as e_, type ShamirRecoveryDoc as ea, type ShamirRecoveryEntry as eb, ShardedCollection as ec, ShardedGroupedQuery as ed, ShardedQuery as ee, type ShardingConfig as ef, type SkippedVault as eg, type SlotRewrapCeremony as eh, type SlotRewrapContext as ei, type StandardSchemaV1 as ej, type StandardSchemaV1Issue as ek, type StandardSchemaV1SyncResult as el, StateManagementVault as em, type StoreAuth as en, type StoreAuthKind as eo, type StoreCapabilities as ep, type StoreTime as eq, SyncEngine as er, type SyncMetadata as es, type SyncPolicy as et, SyncScheduler as eu, type SyncSchedulerStatus as ev, type SyncStatus as ew, type SyncTarget as ex, type SyncTargetRole as ey, SyncTransaction as ez, dictCollectionName as f, unwrapMagicLinkGrant as f$, type VaultSchemaSnapshot as f0, type VaultSnapshot as f1, type VaultTemplate as f2, type WarningRules as f3, WeakPassphraseError as f4, type WeakPassphraseReason as f5, type WithArchiveOptions as f6, type WrappedDeksBlob as f7, type WriteConflict as f8, type WriteEvent as f9, listUsers as fA, listUsersWithEnvelopes as fB, loadActiveDelegations as fC, loadPaperRecoveryEntries as fD, loadSealedPassphrase as fE, loadShamirRecoveryEntries as fF, magicLinkGrantRecordId as fG, mintPaperRecoveryEntry as fH, mintShamirRecoveryEntry as fI, mintWrappedDeksBlob as fJ, parseRsaOaepTlv as fK, parseSealedEnvelope as fL, readMagicLinkGrantRecord as fM, recoverUser as fN, removeAuthenticator as fO, resolveSchema as fP, resolveSequenceKey as fQ, revokeDelegation as fR, revokeMagicLinkGrant as fS, runTransaction as fT, savePaperRecoveryEntries as fU, saveSealedPassphrase as fV, saveShamirRecoveryEntries as fW, sealRsaOaepTlv as fX, unwrapDeksFromBlob as fY, unwrapDeksFromPaperEntry as fZ, unwrapDeksFromShamirEntry as f_, type WriteHook as fa, type WriteQueue as fb, aesGcmOpen as fc, assertStrongPassphrase as fd, buildRecipientKeyringFile as fe, burnPaperRecoveryEntry as ff, compileSequenceFormat as fg, createNoydb as fh, createStore as fi, deriveMagicLinkContentKey as fj, enrollAuthenticator as fk, estimateEntropy as fl, evalComputedFields as fm, evaluateExportCapability as fn, evaluateImportCapability as fo, findAuthenticator as fp, hasExportCapability as fq, hasImportCapability as fr, hasRecoveryEnrolled as fs, isLinkCollectionName as ft, isMagicLinkGrantExpired as fu, isPublicEnvelope as fv, issueDelegation as fw, recoverPassphrase as fx, rotatePassphrase as fy, listMagicLinkGrants as fz, dictKey as g, validatePassphrase as g0, validatePublicEnvelopeInput as g1, validateSchemaInput as g2, validateSchemaOutput as g3, withArchive as g4, withDeferredNumbering as g5, writeMagicLinkGrant as g6, changeSecret as g7, createOwnerKeyring as g8, ensureCollectionDEK as g9, grant as ga, loadKeyring as gb, persistKeyring as gc, revoke as gd, updateAuthenticator as ge, updateKeyringIdentity as gf, type TxStrategy as gg, type AmendmentTxOptions as gh, enforceScript as h, inferScripts as i, isDictCollectionName as j, isDictKeyDescriptor as k, isStaticDictDescriptor as l, type SessionStrategy as m, createEnforcer as n, BLOB_CHUNKS_COLLECTION as o, BLOB_COLLECTION as p, BLOB_EVICTION_AUDIT_COLLECTION as q, BLOB_INDEX_COLLECTION as r, staticDict as s, BLOB_SLOTS_PREFIX as t, BLOB_VERSIONS_PREFIX as u, validateSessionPolicy as v, type BlobEvictionEntry as w, type BlobFieldPolicy as x, type BlobFieldsConfig as y, type BlobObject as z };