@noy-db/hub 0.2.0-pre.18 → 0.2.0-pre.19

package/dist/tx/index.d.cts

@@ -1,12 +1,12 @@
-import { eT as TransactionInvariant, gs as TxStrategy } from '../types-BpLPqyaO.cjs';
-export { gt as AmendmentTxOptions, eV as TxCollection, bs as TxContext, eX as TxVault, g3 as runTransaction } from '../types-BpLPqyaO.cjs';
+import { eH as TransactionInvariant, gg as TxStrategy } from '../types-D-gr5t0G.cjs';
+export { gh as AmendmentTxOptions, eJ as TxCollection, bd as TxContext, eL as TxVault, fT as runTransaction } from '../types-D-gr5t0G.cjs';
 import '../lazy-builder-eYZzLEL1.cjs';
 import '../predicate-BmhBSPCH.cjs';
-import '../strategy-nuyN8K5N.cjs';
-import '../errors-DUTlAt3Y.cjs';
+import '../strategy-C5ol6NdV.cjs';
+import '../errors-DL-zTrrF.cjs';
 import '../strategy-BSxFXGzb.cjs';
-import '../index-C-SSRIxP.cjs';
-import '../index-C6lgoUhK.cjs';
+import '../index-BMmajblo.cjs';
+import '../index-BM7O48Ur.cjs';
 import '@noy-db/attestation';
 
 /**

package/dist/tx/index.d.ts

@@ -1,12 +1,12 @@
-import { eT as TransactionInvariant, gs as TxStrategy } from '../types-Diqc2caK.js';
-export { gt as AmendmentTxOptions, eV as TxCollection, bs as TxContext, eX as TxVault, g3 as runTransaction } from '../types-Diqc2caK.js';
+import { eH as TransactionInvariant, gg as TxStrategy } from '../types-CraiZOyO.js';
+export { gh as AmendmentTxOptions, eJ as TxCollection, bd as TxContext, eL as TxVault, fT as runTransaction } from '../types-CraiZOyO.js';
 import '../lazy-builder-ChSqcF5t.js';
 import '../predicate-BmhBSPCH.js';
-import '../strategy-Diwh5lzS.js';
-import '../errors-DUTlAt3Y.js';
+import '../strategy-BDxQnnTX.js';
+import '../errors-DL-zTrrF.js';
 import '../strategy-BSxFXGzb.js';
-import '../index-C-SSRIxP.js';
-import '../index-DP1JTWHZ.js';
+import '../index-BMmajblo.js';
+import '../index-BelbyUwz.js';
 import '@noy-db/attestation';
 
 /**

package/dist/tx/index.js

@@ -3,9 +3,9 @@ import {
   TxContext,
   TxVault,
   runTransaction
-} from "../chunk-TFAN3NFD.js";
+} from "../chunk-V3VIRTTE.js";
 import "../chunk-FZU343FL.js";
-import "../chunk-HMFC6M2G.js";
+import "../chunk-DJF3FXW5.js";
 
 // src/tx/dry-run.ts
 var SEP = " ";
@@ -43,7 +43,7 @@ async function runDryRun(db, fn) {
     const gctx = { existing: before, vault: facade, userId: v.userId, role: v.role };
     try {
       await registry.runChecks(op.collectionName, after, gctx);
-      const { GuardExecutor } = await import("../executor-THSEYEJG.js");
+      const { GuardExecutor } = await import("../executor-AOACUK7Z.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, op.id, before, after);
       }

package/dist/{types-Diqc2caK.d.ts → types-CraiZOyO.d.ts}

@@ -1,9 +1,9 @@
 import { I as IndexStrategy, d as LazyQuery } from './lazy-builder-ChSqcF5t.js';
-import { L as LiveAggregation, b as AggregateSpec, a as AggregateResult, v as MoneyDescriptor, A as AggregateStrategy } from './strategy-Diwh5lzS.js';
+import { c as OnMissingPolicy, a as I18nTextDescriptor, L as Layer, u as LiveAggregation, j as AggregateSpec, h as AggregateResult, N as MoneyDescriptor, A as AggregateStrategy } from './strategy-BDxQnnTX.js';
 import { C as CrdtStrategy, a as CrdtMode, b as CrdtState } from './strategy-BSxFXGzb.js';
-import { L as LedgerEntry, F as ForgetStrategy, S as SubjectRef, b as ForgetResult } from './index-C-SSRIxP.js';
-import { N as NoydbError } from './errors-DUTlAt3Y.js';
-import { L as LiveQuery, Q as Query, c as JoinStrategy, j as RefRegistry, R as RefDescriptor, d as JoinableSource, l as RefViolation, S as ScanBuilder } from './index-DP1JTWHZ.js';
+import { L as LedgerEntry, F as ForgetStrategy, S as SubjectRef, b as ForgetResult } from './index-BMmajblo.js';
+import { N as NoydbError } from './errors-DL-zTrrF.js';
+import { L as LiveQuery, Q as Query, c as JoinStrategy, j as RefRegistry, R as RefDescriptor, d as JoinableSource, l as RefViolation, S as ScanBuilder } from './index-BelbyUwz.js';
 import { I as IndexDef, O as Operator, F as FieldClause, C as CollectionIndexes } from './predicate-BmhBSPCH.js';
 import { AttestationFieldSchema, RevocationList } from '@noy-db/attestation';
 
@@ -1607,286 +1607,6 @@ interface PeriodsStrategy {
     appendPeriodLedgerEntry(ledger: LedgerStore | null, actor: string, envelope: EncryptedEnvelope, periodName: string): Promise<void>;
 }
 
-/**
- * Per-layer i18n resolution policy.
- *
- * `onMissing` governs what happens when a multilingual field is resolved
- * to a target locale that is absent. It may be a single scalar policy or
- * a per-layer map, so a field can be lenient at the app read boundary but
- * strict inside a materialized view.
- *
- * Effective policy for layer `λ`:
- *
- * ```
- * explicit(λ) = typeof onMissing === 'object' ? onMissing[λ] : undefined
- * scalar      = typeof onMissing === 'string' ? onMissing : undefined
- * policy(λ)   = explicit(λ) ?? layerDefault(λ) ?? scalar ?? 'throw'
- * ```
- *
- * - `layerDefault('guard') = 'substitute'` — guards are lenient unless
- *   EXPLICITLY overridden; they never inherit a scalar policy (a guard
- *   reading a display value must not hard-fail on a missing locale).
- * - every other layer has no default, so it inherits the scalar, else
- *   falls back to `'throw'` (today's behavior — zero breaking change).
- *
- * @public
- */
-type OnMissing = 'substitute' | 'null' | 'throw';
-/**
- * The contexts in which a multilingual field is resolved. Each can carry
- * its own `onMissing` policy.
- *
- * - `read`       — ordinary app reads (`get`/`list`/query projection).
- * - `guard`      — a guard callback reading a value.
- * - `join`       — a joined record expanded onto a row.
- * - `mv`         — materialized-view input.
- * - `derivation` — derivation input.
- * - `export`     — bundle/public-envelope export.
- */
-type Layer = 'read' | 'guard' | 'join' | 'mv' | 'derivation' | 'export';
-/** Field-level policy: a single scalar, or a per-layer map. */
-type OnMissingPolicy = OnMissing | Partial<Record<Layer, OnMissing>>;
-/**
- * Resolve the effective `OnMissing` for a layer from a field's declared
- * policy. See module docs for the resolution rule.
- */
-declare function resolvePolicy(onMissing: OnMissingPolicy | undefined, layer: Layer): OnMissing;
-
-/**
- * i18nText schema type —
- *
- * `i18nText({ languages, required })` creates a descriptor for a
- * multi-language content field whose value is stored as a
- * `{ [locale]: string }` map (e.g. `{ en: 'Consulting', th: 'ที่ปรึกษา' }`).
- *
- * On put, the descriptor validates that required languages are present.
- * On read (when a `locale` option is passed), the map is collapsed to the
- * caller's locale string via the fallback chain.
- *
- * Design decisions
- * ────────────────
- *
- * **Descriptor pattern (not a Zod type).**
- * `i18nText()` returns a plain descriptor object used in the collection's
- * `i18nFields` option — same pattern as `ref()` / `dictKey()`. This keeps
- * `@noy-db/core` at zero runtime dependencies and avoids Zod v3 field-type
- * constraints. TypeScript inference is handled via the descriptor's type.
- *
- * **Enforcement at the collection boundary.**
- * The `required` option is checked by `Collection.put()` via the compartment's
- * registered `i18nFields`. Failed validation throws `MissingTranslationError`
- * — a distinct class from `SchemaValidationError` so callers can tell
- * "wrong shape" from "missing translations".
- *
- * **Resolution is post-decryption.**
- * Locale resolution happens AFTER `decryptRecord()`, as a pure in-memory
- * transform. No additional crypto work is needed. The resolved record is
- * returned in place of the stored one, with i18nText fields replaced by
- * their locale-resolved strings.
- *
- * **`locale: 'raw'`.**
- * Passing `{ locale: 'raw' }` skips resolution and returns the full
- * `{ [locale]: string }` map — useful for bilingual exports, admin UIs,
- * and any context where all translations must be visible at once.
- *
- * **Out of scope.**
- * Pluralization, RTL rendering, date/number formatting, per-locale CRDT
- * merging.
- */
-
-/** Flatten an intersection into a single object literal for nicer hovers. */
-type Prettify<T> = {
-    [K in keyof T]: T[K];
-} & {};
-/**
- * The stored shape of a multilingual field, inferred from its `required`
- * mode — so the compiler forces you to handle an absent optional locale
- * (`string | undefined`) instead of silently yielding `undefined`.
- *
- * Mirrors `i18nText({ languages, required })`:
- * - `'all'` (default) — every locale required: `{ th: string; en: string }`
- * - `'any'`           — every locale optional: `{ th?: string; en?: string }`
- *   (the "at least one present" guarantee is runtime-only — not expressible
- *   in TypeScript — so each key is optional)
- * - `readonly L[]`    — listed locales required, the rest optional:
- *   `I18nMap<'th'|'en', ['th']>` → `{ th: string; en?: string }`
- *
- * @example
- * ```ts
- * type Lang = 'th' | 'en'
- * interface Contact {
- *   name: I18nMap<Lang, 'any'>      // { th?: string; en?: string }
- *   legalName: I18nMap<Lang, ['th']> // { th: string; en?: string }
- *   slug: I18nMap<Lang>             // { th: string; en: string }
- * }
- * ```
- *
- * @public
- */
-type I18nMap<Langs extends string, Required extends 'all' | 'any' | readonly Langs[] = 'all'> = Required extends 'all' ? Record<Langs, string> : Required extends 'any' ? Partial<Record<Langs, string>> : Required extends readonly (infer R extends Langs)[] ? Prettify<Record<R, string> & Partial<Record<Exclude<Langs, R>, string>>> : never;
-/**
- * Options for `i18nText()`.
- *
- * `languages` declares the full set of supported locales. `required`
- * controls which must be present on every `put()`.
- *
- * `autoTranslate` is the per-field opt-in for the `plaintextTranslator`
- * hook. When `true` and a `plaintextTranslator` is configured
- * on `createNoydb()`, missing translations are generated before `put()`.
- * Default: `false`.
- */
-interface I18nTextOptions {
-    /** All supported locale codes (BCP 47). */
-    readonly languages: readonly string[];
-    /**
-     * Which locales must be present on every `put()`.
-     *
-     * - `'all'`       — every declared language must be present.
-     * - `'any'`       — at least one declared language must be present.
-     * - `string[]`    — listed locales are required; others are optional.
-     */
-    readonly required: 'all' | 'any' | readonly string[];
-    /**
-     * Per-field opt-in for the `plaintextTranslator` hook.
-     * When `true`, missing required translations are auto-generated
-     * before `put()` if a translator is configured. Default: `false`.
-     */
-    readonly autoTranslate?: boolean;
-    /**
-     * What to do when this field is resolved to a locale that is absent.
-     * A single policy, or a per-layer map (read/guard/join/mv/derivation/
-     * export). Default `'throw'` — today's behavior, zero breaking change.
-     * See {@link OnMissingPolicy}.
-     *
-     * NOTE (current wiring): the `read` (`get`/`list`), `guard` and
-     * `derivation` layers are enforced — guard / derivation `ctx.vault`
-     * reads resolve under their own layer policy (`guard` defaults to the
-     * lenient `'substitute'`). The `mv`, `join` and `export` layers are NOT
-     * yet wired: mv/join read raw `{locale}` maps in the query/aggregate
-     * pipeline (no resolution call site), so injecting resolution there is a
-     * tracked follow-up (#285 D2/D3). Until then those reads observe the raw
-     * map, not this policy.
-     */
-    readonly onMissing?: OnMissingPolicy;
-    /**
-     * Ordered preferred-substitute locales used when `onMissing` resolves
-     * to `'substitute'` and the target locale is absent. `'any'` as an
-     * element means "first non-empty value". A caller-supplied `fallback`
-     * at read time takes precedence over this declared list.
-     */
-    readonly substitute?: readonly string[];
-    /**
-     * Per-locale script enforcement (write-time). `'auto'` infers the
-     * allowed Unicode scripts per locale (asymmetric Latin tolerance); an
-     * object overrides per slot. Absent ⇒ no check. See `./script.ts`.
-     */
-    readonly script?: 'auto' | Partial<Record<string, readonly string[]>>;
-    /**
-     * What to do when a slot's value contains characters outside its
-     * allowed script set. Default `'reject'`.
-     */
-    readonly onScriptViolation?: 'reject' | 'filter' | 'warn';
-}
-/**
- * Descriptor returned by `i18nText()`. Attach to the collection's
- * `i18nFields` option:
- *
- * ```ts
- * const lineItems = company.collection<LineItem>('line-items', {
- *   i18nFields: {
- *     description: i18nText({ languages: ['en', 'th'], required: 'all' }),
- *   },
- * })
- * ```
- */
-interface I18nTextDescriptor {
-    readonly _noydbI18nText: true;
-    readonly options: I18nTextOptions;
-}
-/**
- * Create an `I18nTextDescriptor` for a multi-language content field.
- *
- * @param options  Language list + enforcement mode.
- *
- * @example
- * ```ts
- * i18nText({ languages: ['en', 'th'], required: 'all' })
- * i18nText({ languages: ['en', 'th'], required: ['th'], autoTranslate: true })
- * ```
- */
-declare function i18nText(options: I18nTextOptions): I18nTextDescriptor;
-/** Runtime predicate for detecting an `I18nTextDescriptor`. */
-declare function isI18nTextDescriptor(x: unknown): x is I18nTextDescriptor;
-/**
- * Validate that a value is a valid `{ [locale]: string }` map and that
- * all required locales are present. Throws `MissingTranslationError`
- * when the required constraint is violated.
- *
- * Called by `Collection.put()` for each registered `i18nField`.
- *
- * @param value       The raw field value from the record being put.
- * @param field       The field name (used in the thrown error message).
- * @param descriptor  The `i18nText()` descriptor for this field.
- */
-declare function validateI18nTextValue(value: unknown, field: string, descriptor: I18nTextDescriptor): void;
-/**
- * Resolve an i18nText value (`{ [locale]: string }` map) to a string
- * for the given locale.
- *
- * @param value    The stored locale map.
- * @param locale   The requested locale code, or `'raw'` to return the map.
- * @param fallback Single locale or ordered list; use `'any'` as the last
- *                 element to fall back to any available translation.
- * @param field    Field name used in `LocaleNotSpecifiedError` messages.
- * @returns The resolved string, OR the original map when `locale === 'raw'`.
- */
-/** Options for the policy-aware form of {@link resolveI18nText}. */
-interface ResolveI18nOptions {
-    /** Effective policy for the resolution layer. Default `'throw'`. */
-    readonly policy?: OnMissing;
-    /** Declared substitute chain; applied only under policy `'substitute'`. */
-    readonly substitute?: readonly string[];
-}
-declare function resolveI18nText(value: Record<string, string>, locale: string, fallback?: string | readonly string[], field?: string): string | Record<string, string>;
-declare function resolveI18nText(value: Record<string, string>, locale: string, fallback: string | readonly string[] | undefined, field: string | undefined, opts: ResolveI18nOptions): string | Record<string, string> | null;
-/**
- * Return all leaf values at `path`, expanding `[].` array wildcards.
- *
- * - `'name'`              → `[obj.name]`
- * - `'address.lineOne'`   → `[obj.address.lineOne]`
- * - `'contacts[].title'`  → `[obj.contacts[0].title, obj.contacts[1].title, …]`
- *
- * Returns an empty array when the path does not resolve (missing key,
- * wrong type, etc.). Used by `enforceI18nOnPut` to validate nested fields.
- */
-declare function getAtPath(obj: Record<string, unknown>, path: string): unknown[];
-/**
- * Mutate `obj` in-place, setting `value` at the nested `path`.
- * Supports dot notation (`'address.lineOne'`) but not array wildcards —
- * auto-translate on `contacts[].title` style paths is not supported.
- */
-declare function setAtPathInPlace(obj: Record<string, unknown>, path: string, value: unknown): void;
-/**
- * Apply locale resolution to a single record, returning a new copy.
- *
- * For each field registered as an `i18nText` descriptor:
- * - If `locale === 'raw'`, the field value is left as the stored map.
- * - Otherwise, the field value is replaced with the resolved string.
- *
- * Field paths support dot notation (`'address.lineOne'`) and array
- * wildcards (`'contacts[].title'`). Top-level fields work as before.
- *
- * @param record      The decrypted record.
- * @param i18nFields  Map of field path → `I18nTextDescriptor`.
- * @param locale      The requested locale (or `'raw'`).
- * @param fallback    Fallback chain (optional).
- * @param layer       Resolution layer (default `'read'`). Each field's
- *                    `onMissing` policy is resolved for this layer, so the
- *                    same record resolves leniently on a get but strictly
- *                    inside an mv/derivation.
- */
-declare function applyI18nLocale(record: Record<string, unknown>, i18nFields: Record<string, I18nTextDescriptor>, locale: string, fallback?: string | readonly string[], layer?: Layer): Record<string, unknown>;
-
 type EventHandler<T> = (data: T) => void;
 /** Typed event emitter for NOYDB events. */
 declare class NoydbEventEmitter {
@@ -3466,6 +3186,34 @@ interface HistoryStrategy {
     buildVaultInstant(engine: VaultEngine, timestamp: string): VaultInstant;
 }
 
+/**
+ * Scan-mode full-text search (#308) — ranks **already-decrypted** records by
+ * BM25 against a tokenized query. Pure client-side: nothing is written to the
+ * store, so this adds **zero** leakage (unlike a store-usable blind index,
+ * which is a separate, gated opt-in — see the #308 design note).
+ *
+ * O(n) over the collection; intended for small/medium collections (the pilot's
+ * scale) where moving the existing userland scan into the DB is the win.
+ */
+
+interface SearchOptions {
+    /** Top-N by score (default: all matches). */
+    readonly limit?: number;
+    /** `'any'` (default) = OR of query terms; `'all'` = every term must match. */
+    readonly match?: 'any' | 'all';
+    /** Treat the LAST query term as a prefix (typeahead). */
+    readonly prefix?: boolean;
+}
+interface SearchResult<T> {
+    readonly id: string;
+    readonly score: number;
+    readonly record: T;
+}
+interface SearchEntry<T> {
+    readonly id: string;
+    readonly record: T;
+}
+
 interface LruOptions {
     /** Maximum number of entries before eviction. Required if `maxBytes` is unset. */
     maxRecords?: number;
@@ -3742,6 +3490,16 @@ interface ShardingConfig<T> {
     readonly vaultTemplate: string;
     /** When a write targets an unknown partition key, stamp a shard inline. Default `true`. */
     readonly autoCreate?: boolean;
+    /**
+     * Data-residency guard (#271): the geographic region a record's shard must
+     * live in (e.g. `'eu'`). When set, `createShard` resolves the candidate
+     * backend (via `routeStore`'s vault-prefix routing) and throws
+     * `DataResidencyError` if its `capabilities.region` doesn't match — so a
+     * shard never lands on a non-compliant backend. Advisory until a region is
+     * declared on the backing store; pair with `routeStore({ vaultRoutes })`
+     * and a region-encoded partition key (e.g. `eu-acme` → `firm--eu-`).
+     */
+    readonly regionOf?: (record: T) => string;
 }
 /** Options for `Noydb.openVaultGroup`. */
 interface VaultGroupOptions<T> {
@@ -5680,8 +5438,12 @@ declare class VaultGroup<T> {
      * - row + vault present → no-op, return handle
      * - row present, vault gone → ShardProvisioningError
      * - row absent (vault present or not) → open-or-create, configure, write row
+     *
+     * When `region` is given (the routing `put` passes `sharding.regionOf(record)`),
+     * the candidate backend's `capabilities.region` must match or this throws
+     * `DataResidencyError` BEFORE provisioning (#271 data-residency guard).
      */
-    createShard(partitionKey: string): Promise<Vault>;
+    createShard(partitionKey: string, region?: string): Promise<Vault>;
     /**
      * Drill down to a single shard's full Collection API. Throws if the shard is unknown.
      * Also throws ShardProvisioningError if the registry row exists but the vault has been deleted
@@ -5719,6 +5481,11 @@ declare class VaultGroup<T> {
      *
      * v1 is explicit-refresh (no write-path push); call `refreshInsights()`
      * after a batch of writes, or on a schedule.
+     *
+     * The `target.vault` must NOT be the group itself or one of its shards —
+     * a summary writing back into client-shard data would breach the Insight
+     * Vault's separate-DEK-boundary contract. Such a target throws a
+     * `ValidationError` at registration (#271 Insight-write isolation).
      */
     withCrossVaultDerivation<R = Record<string, unknown>, S = Record<string, unknown>>(spec: CrossVaultDerivationSpec<R, S>): void;
     /**
@@ -6132,6 +5899,13 @@ declare class Noydb {
      * (its keyring exists in the store).
      */
     _shardVaultProvisioned(vaultId: string): Promise<boolean>;
+    /**
+     * @internal — the physical backend store a vault id maps to. A
+     * `routeStore` resolves the vault-prefix route via its `resolveBackend`;
+     * a plain store is its own backend. Used by the federation data-residency
+     * guard to read the placement backend's `capabilities.region` (#271).
+     */
+    _resolveBackend(vaultId: string): NoydbStore;
     /**
      * Change the current user's passphrase for a vault.
      *
@@ -7461,6 +7235,35 @@ interface MaterializedViewStrategy<TRow extends Record<string, unknown>> {
      * if declared alone.
      */
     moneyFields?: Record<string, MoneyDescriptor>;
+    /**
+     * Compute-time i18n resolution locale (#285, `mv` layer). UNION-mode only.
+     *
+     * An MV that **groups by** an `i18nText` field would otherwise bucket on the
+     * raw `{ locale: string }` map — an unstable object key. Set `i18nLocale`
+     * (with {@link i18nFields} describing those fields) and, before grouping, the
+     * executor resolves each declared i18n group-key field to this locale at the
+     * `mv` layer (`resolvePolicy(onMissing, 'mv')`), so buckets are stable strings.
+     *
+     * This is the **compute** path only: i18n fields *carried through* for display
+     * stay raw — declare them on the OUTPUT collection and they resolve per-reader
+     * at read time (the resolve-at-output model). Without `i18nLocale`, grouping by
+     * a raw i18n field throws `LocaleNotSpecifiedError` (steer: group by a
+     * `dictKey`/`staticDict` code — the stable key — and label at read).
+     *
+     * Query-form MVs do their own `groupBy` inside the `Query`, which carries no
+     * locale yet (the join/query-locale slice, #285 §3) — so `i18nLocale` /
+     * `i18nFields` on a query-form MV throw `MaterializedViewConfigError`.
+     */
+    i18nLocale?: string;
+    /**
+     * i18n descriptors for UNION-mode compute (#285), keyed by the OUTPUT field
+     * name as it appears in the mapped row (NOT the source field). Mirrors
+     * {@link moneyFields}: the concatenated mapped stream is a plain array with no
+     * collection i18n context, so the descriptor (carrying `onMissing`/`substitute`
+     * /`fallback`) must be declared here for the `mv`-layer resolution that
+     * {@link i18nLocale} drives. Meaningless without `i18nLocale`.
+     */
+    i18nFields?: Record<string, I18nTextDescriptor>;
     /**
      * Pure function from a materialized row → stable id used in the
      * output collection. Required — explicit always beats default-with-pitfalls
@@ -11783,6 +11586,19 @@ declare class Collection<T> {
      * no-transform fast path in {@link list}.
      */
     private hasReadTransforms;
+    /**
+     * Scan-mode full-text search over a plain-text `field` (#308). Decrypts the
+     * collection in memory and ranks records by BM25 against the tokenized query.
+     * **Zero added store leakage** — pure client-side scan; nothing searchable is
+     * written to the store. (A store-usable blind index for at-scale search is a
+     * separate, gated opt-in — see the #308 design note.) Eager mode only.
+     *
+     * `opts.match` (`'any'` default | `'all'`), `opts.prefix` (last query term as
+     * a prefix → typeahead), `opts.limit` (top-N). Returns `{ id, score, record }`
+     * ranked by descending score. The default tokenizer is word-boundary based —
+     * see `src/search/tokenize.ts` for the Thai/CJK caveat.
+     */
+    search(field: string, query: string, opts?: SearchOptions): Promise<SearchResult<T>[]>;
     /**
      * Put many records in one call. Each item is processed sequentially
      * through the normal `put()` path — meaning per-item validation,
@@ -12212,6 +12028,23 @@ declare class Collection<T> {
      * surface on `index:write-partial` the same way put does.
      */
     private maintainPersistedIndexesOnDelete;
+    /**
+     * @internal — hard-delete this record's persisted `_idx/<field>/<recordId>`
+     * side-cars for the erasure path (#401). `forget()` crypto-shreds the body but
+     * keeps the collection DEK, under which these side-cars are encrypted — so
+     * without this they leave the indexed field VALUES readable after a "forget".
+     *
+     * Content-free: the side-car id is `encodeIdxId(def.key, id)`, so it needs no
+     * body decode (the body is being shredded). Eager mode has no durable side-car
+     * → no-op. The in-memory mirror is left as-is: it is ephemeral (rebuilt from
+     * the now-deleted side-cars on reopen) and live reads skip the tombstone, so a
+     * stale mirror hit cannot surface the erased record. Returns the count deleted
+     * + the `def.key`s whose delete FAILED (residue that still leaks the value).
+     */
+    _purgePersistedIndexes(id: string): Promise<{
+        purged: number;
+        residue: string[];
+    }>;
     /**
      * Bulk-load the persisted-index mirror from `_idx/<field>/*` side-cars
      * on first lazy-mode query. Idempotent — subsequent calls short-circuit
@@ -13305,13 +13138,15 @@ interface ExportStreamOptions {
      */
     readonly withLedgerHead?: boolean;
     /**
-     * When set to a BCP 47 locale string (e.g. `'th'`), `exportJSON()`
-     * resolves all `dictKey` labels to that locale and omits the raw
-     * `dictionaries` snapshot from the output. Has no effect
-     * on `exportStream()` — format packages use the `chunk.dictionaries`
-     * snapshot directly and apply their own locale strategy.
+     * Export locale (BCP 47, e.g. `'th'`). When set, records are read at this
+     * locale through the **`export` layer** (#285): `i18nText` fields collapse to
+     * the locale string (honoring each field's `export`-layer `onMissing` policy)
+     * and `dictKey`/`staticDict` `<field>Label`s are resolved — a single-locale
+     * export. The raw `dictionaries` snapshot is then redundant and omitted. This
+     * applies to BOTH `exportStream()` and `exportJSON()`.
      *
-     * Default: `undefined` — embed the raw snapshot under `_dictionaries`.
+     * Default: `undefined` — raw `{locale}` maps + the `_dictionaries` snapshot
+     * (a full, all-locale backup; format packages apply their own locale strategy).
      */
     readonly resolveLabels?: string;
 }
@@ -14124,6 +13959,13 @@ interface StoreCapabilities {
      * numbering (use CAS `sequence().next()` or per-series).
      */
     serverWriteTime?: boolean;
+    /**
+     * Advisory geographic region this store serves (e.g. `'eu'`, `'us'`).
+     * Purely declarative — no behavior change for stores that omit it. The
+     * federation data-residency guard (#271) compares this against a
+     * `sharding.regionOf(record)` to refuse non-compliant shard placement.
+     */
+    region?: string;
     auth: StoreAuth;
     /**
      * true — the store implements {@link NoydbStore.tx} and commits
@@ -14625,4 +14467,4 @@ interface DeleteManyResult {
     }>;
 }
 
-export { DEFAULT_CHUNK_SIZE as $, createEnforcer as A, validateSessionPolicy as B, type BlobStrategy as C, DICT_COLLECTION_PREFIX as D, BLOB_CHUNKS_COLLECTION as E, BLOB_COLLECTION as F, BLOB_EVICTION_AUDIT_COLLECTION as G, BLOB_INDEX_COLLECTION as H, type I18nStrategy as I, BLOB_SLOTS_PREFIX as J, BLOB_VERSIONS_PREFIX as K, type Layer as L, type BlobEvictionEntry as M, type BlobFieldPolicy as N, type OnMissing as O, PolicyEnforcer as P, type BlobFieldsConfig as Q, type ResolveI18nOptions as R, type ScriptWarning as S, type BlobObject as T, type BlobPutOptions as U, type BlobResponseOptions as V, BlobSet as W, type BlobStrategyOpenArgs as X, type CompactRunOptions as Y, type CompactionContext as Z, type CompactionResult as _, type DictEntry as a, type Role as a$, EXPORT_AUDIT_COLLECTION as a0, ExportBlobsAbortedError as a1, type ExportBlobsAuditEntry as a2, type ExportBlobsHandle as a3, type ExportBlobsOptions as a4, type ExportedBlob as a5, type SlotInfo as a6, type SlotRecord as a7, type VersionRecord as a8, createExportBlobsHandle as a9, ReadOnlyVaultFacade as aA, type ShadowStrategy as aB, CollectionFrame as aC, VaultFrame as aD, type NoydbBundleStore as aE, type RetentionPolicy as aF, type SnapshotPolicy as aG, type SnapshotStrategy as aH, type SnapshotMeta as aI, type SnapshotMode as aJ, type DerivationStrategy as aK, type DerivationContext as aL, type ArrayOutputSpec as aM, DerivationRegistry as aN, type DerivationStrategyHandle as aO, type DerivedFromMeta as aP, type OutputSpec as aQ, type RecordOutputSpec as aR, type MaterializedViewStrategy as aS, type MaterializedViewStrategyHandle as aT, type OverlayedViewStrategy as aU, Collection as aV, type OverlayFieldMergeMode as aW, type OverlayFieldMergeRule as aX, OverlayedViewRegistry as aY, type OverlayedViewStrategyHandle as aZ, type SyncStrategy as a_, runCompaction as aa, type ConsentStrategy as ab, CONSENT_AUDIT_COLLECTION as ac, type ConsentAuditEntry as ad, type ConsentAuditFilter as ae, type ConsentContext as af, type ConsentOp as ag, loadConsentEntries as ah, writeConsentEntry as ai, type PeriodsStrategy as aj, type CarryForwardContext as ak, type ClosePeriodOptions as al, type OpenPeriodOptions as am, PERIODS_COLLECTION as an, type PeriodRecord as ao, type ReadOnlyCollection as ap, appendPeriodLedgerEntry as aq, assertTsWritable as ar, chainAnchor as as, loadPeriods as at, validatePeriodName as au, type GuardStrategy as av, type GuardChange as aw, type GuardContext as ax, GuardRegistry as ay, type GuardStrategyHandle as az, type DictKeyDescriptor as b, type CollectionStats as b$, type UnlockedKeyring as b0, type HistoryStrategy as b1, type NoydbStore as b2, type HistoryOptions as b3, type EncryptedEnvelope as b4, type PruneOptions as b5, type AppendInput as b6, type ChangeType as b7, CollectionInstant as b8, type DiffEntry as b9, type UserEnvelope as bA, type GateName as bB, type GatePolicy as bC, type VaultPolicy as bD, type ActiveTier as bE, type FactorProof as bF, type SchemaUpdateStrategy as bG, type TransformFn as bH, type PersistedSchemaEnvelope as bI, type UpdateDecision as bJ, type DirectoryConfig as bK, type UserVisibility as bL, type AccessibleVault as bM, type AffectedDocument as bN, type ArchivePolicy as bO, type ArchiveResult as bP, type ArchiveRunOptions as bQ, type ArchiveStrategy as bR, BUNDLE_STORE_POLICY as bS, type BuiltInGateName as bT, type CacheOptions as bU, type CacheStats as bV, type CapturedBlueprint as bW, type ChangeEvent as bX, type CollectionChangeEvent as bY, type CollectionConflictResolver as bZ, type CollectionDescriptor as b_, type JsonPatch as ba, type JsonPatchOp as bb, LedgerStore as bc, type VaultEngine as bd, VaultInstant as be, type VerifyResult as bf, applyPatch as bg, computePatch as bh, diff as bi, formatDiff as bj, type PublicEnvelope as bk, type SealingKeyProvider as bl, type BundleRecipient as bm, type RecipientSealer as bn, type RecipientHint as bo, Vault as bp, type RecoveryEnrollmentInput as bq, type ShamirRecoveryProvider as br, TxContext as bs, type MVQueryContext as bt, type RegisteredMV as bu, MaterializedViewRegistry as bv, type MaterializedFromMeta as bw, type MaterializedViewOutput as bx, type UnionArmJoin as by, type UnionSource as bz, DictionaryHandle as c, LinkEndpointError as c$, ComputedFieldError as c0, type ComputedFields as c1, type ComputedFn as c2, type Conflict as c3, type ConflictPolicy as c4, type ConflictStrategy as c5, type CrossTierAccessEvent as c6, CrossVaultAggregation as c7, type CrossVaultDerivationContext as c8, type CrossVaultDerivationSpec as c9, type FactorKind as cA, type FactorProofBundle as cB, type FactorRequirement as cC, type FanoutQueryOptions as cD, type FanoutResult as cE, type FenceDoc as cF, type FenceState as cG, type FieldChange as cH, type FieldDescriptor as cI, type FieldSource as cJ, type FleetMigrationResult as cK, type FormattedSequenceHandle as cL, type GhostRecord as cM, type GrantOptions as cN, type GuardViolation as cO, type HistoryConfig as cP, type HistoryEntry as cQ, INDEXED_STORE_POLICY as cR, type ImportCapability as cS, type InferOutput as cT, type InternalCollectionStats as cU, type IssueDelegationOptions as cV, type IssueMagicLinkGrantOptions as cW, type KeyringAuthenticator as cX, type KeyringAuthenticatorWrappingDEKs as cY, type KeyringAuthenticatorWrappingKEK as cZ, type KeyringFile as c_, CrossVaultGroupedAggregation as ca, type GroupedRow as cb, type CrossVaultLiveAggregation as cc, type CrossVaultLiveQuery as cd, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as ce, DELEGATIONS_COLLECTION as cf, type DeepPartial as cg, type DeepPartialOrNull as ch, type DeferredNumberingConfig as ci, type DelegationToken as cj, type DeleteManyResult as ck, type DeploymentEvent as cl, type DerivationDescriptor as cm, type DirtyEntry as cn, type DryRunResult as co, type DumpSchemaOptions as cp, ELEVATION_AUDIT_COLLECTION as cq, ElevatedHandle as cr, type EnrollAuthenticatorOptions as cs, type EnrollAuthenticatorWrappingDEKsOptions as ct, type EnrollAuthenticatorWrappingKEKOptions as cu, type EnrollRecoveryResult as cv, type ExportCapability as cw, type ExportChunk as cx, type ExportFormat as cy, type ExportStreamOptions as cz, type DictionaryOptions as d, QuickUnlockStore as d$, LinkIntegrityError as d0, type LinkOnDelete as d1, type LinkRow as d2, type LinkSetHandle as d3, type LinkSpec as d4, type ListAccessibleVaultsOptions as d5, type ListPageResult as d6, type ListUsersOptions as d7, type LiveQueryOptions as d8, type LiveUserEnvelope as d9, type PaperRecoveryEntry as dA, type PassphrasePolicy as dB, type PassphraseValidationResult as dC, type Permission as dD, type Permissions as dE, type PersistedSchemaKind as dF, type PlaintextTranslatorContext as dG, type PlaintextTranslatorFn as dH, PresenceHandle as dI, type PresencePeer as dJ, type PublicEnvelopeField as dK, type PublicEnvelopeSchema as dL, type PublicEnvelopeText as dM, type PullMode as dN, type PullOptions as dO, type PullPolicy as dP, type PullResult as dQ, type PushMode as dR, type PushOptions as dS, type PushPolicy as dT, type PushResult as dU, type PutManyItemOptions as dV, type PutManyOptions as dW, type PutManyResult as dX, type QueryAcrossOptions as dY, type QueryAcrossResult as dZ, type QuickUnlockState as d_, type LocaleReadOptions as da, Lru as db, type LruOptions as dc, type LruStats as dd, MAGIC_LINK_CONTENT_INFO_PREFIX as de, MAGIC_LINK_GRANTS_COLLECTION as df, MAGIC_LINK_KEK_INFO_PREFIX as dg, type MagicLinkGrantPayload as dh, type MagicLinkGrantRecord as di, type MaterializedViewDescriptor as dj, MemoryRecipientSealer as dk, MemorySealingKeyProvider as dl, type MigrationStatusRow as dm, NOYDB_BACKUP_VERSION as dn, NOYDB_FORMAT_VERSION as dp, NOYDB_KEYRING_VERSION as dq, NOYDB_SYNC_VERSION as dr, type NextOptions as ds, Noydb as dt, type NoydbEventMap as du, type NoydbOptions as dv, type Assignment as dw, type OverlayViewDescriptor as dx, PUBLIC_ENVELOPE_FIELDS as dy, type PaperRecoveryDoc as dz, type I18nMap as e, type UpdateAuthenticatorOptions as e$, type ReAuthOperation as e0, type RecoverPassphraseInput as e1, type RecoverPassphraseResult as e2, type RecoverUserOptions as e3, type RecoveryProof as e4, type RefreshInsightsResult as e5, type ResolvedPublicEnvelopeSchema as e6, type RevokeOptions as e7, type RotatePassphraseInput as e8, type RotateRecoveryOptions as e9, type StoreAuthKind as eA, type StoreCapabilities as eB, type StoreTime as eC, SyncEngine as eD, type SyncMetadata as eE, type SyncPolicy as eF, SyncScheduler as eG, type SyncSchedulerStatus as eH, type SyncStatus as eI, type SyncTarget as eJ, type SyncTargetRole as eK, SyncTransaction as eL, type SyncTransactionResult as eM, type TabChannel as eN, type TabCoordinationOptions as eO, type TabLockManager as eP, type TabPresence as eQ, type TabRole as eR, type TierMode as eS, type TransactionInvariant as eT, type TranslatorAuditEntry as eU, TxCollection as eV, type TxOp as eW, TxVault as eX, USER_ENVELOPE_COLLECTION as eY, USER_ENVELOPE_MAX_BYTES as eZ, type Unsubscribe as e_, type RotateRecoveryResult as ea, SEALED_PASSPHRASE_RECORD_ID as eb, type SchemaDelta as ec, type SchemaIntrospection as ed, type SchemaManifestRow as ee, type SealedEnvelope as ef, type SealedPassphrase as eg, type SequenceHandle as eh, type SequenceOptions as ei, SequenceStore as ej, type SessionPolicy as ek, type SetPublicEnvelopeInput as el, type ShamirRecoveryDoc as em, type ShamirRecoveryEntry as en, ShardedCollection as eo, ShardedGroupedQuery as ep, ShardedQuery as eq, type ShardingConfig as er, type SkippedVault as es, type SlotRewrapCeremony as et, type SlotRewrapContext as eu, type StandardSchemaV1 as ev, type StandardSchemaV1Issue as ew, type StandardSchemaV1SyncResult as ex, StateManagementVault as ey, type StoreAuth as ez, type I18nTextDescriptor as f, resolveSchema as f$, type UpdateContext as f0, type UpdateUserOptions as f1, UserApi as f2, type UserEnvelopeCheckGate as f3, UserEnvelopeOversizedError as f4, type UserEnvelopePresented as f5, type UserInfo as f6, type VaultBackup as f7, VaultGroup as f8, type VaultGroupOptions as f9, evaluateImportCapability as fA, findAuthenticator as fB, hasExportCapability as fC, hasImportCapability as fD, hasRecoveryEnrolled as fE, isLinkCollectionName as fF, isMagicLinkGrantExpired as fG, isPublicEnvelope as fH, issueDelegation as fI, recoverPassphrase as fJ, rotatePassphrase as fK, listMagicLinkGrants as fL, listUsers as fM, listUsersWithEnvelopes as fN, loadActiveDelegations as fO, loadPaperRecoveryEntries as fP, loadSealedPassphrase as fQ, loadShamirRecoveryEntries as fR, magicLinkGrantRecordId as fS, mintPaperRecoveryEntry as fT, mintShamirRecoveryEntry as fU, mintWrappedDeksBlob as fV, parseRsaOaepTlv as fW, parseSealedEnvelope as fX, readMagicLinkGrantRecord as fY, recoverUser as fZ, removeAuthenticator as f_, type VaultPolicyOnDisk as fa, type VaultRegistryRow as fb, type VaultSchemaSnapshot as fc, type VaultSnapshot as fd, type VaultTemplate as fe, type WarningRules as ff, WeakPassphraseError as fg, type WeakPassphraseReason as fh, type WithArchiveOptions as fi, type WrappedDeksBlob as fj, type WriteConflict as fk, type WriteEvent as fl, type WriteHook as fm, type WriteQueue as fn, aesGcmOpen as fo, assertStrongPassphrase as fp, buildRecipientKeyringFile as fq, burnPaperRecoveryEntry as fr, compileSequenceFormat as fs, createNoydb as ft, createStore as fu, deriveMagicLinkContentKey as fv, enrollAuthenticator as fw, estimateEntropy as fx, evalComputedFields as fy, evaluateExportCapability as fz, type I18nTextOptions as g, resolveSequenceKey as g0, revokeDelegation as g1, revokeMagicLinkGrant as g2, runTransaction as g3, savePaperRecoveryEntries as g4, saveSealedPassphrase as g5, saveShamirRecoveryEntries as g6, sealRsaOaepTlv as g7, unwrapDeksFromBlob as g8, unwrapDeksFromPaperEntry as g9, unwrapDeksFromShamirEntry as ga, unwrapMagicLinkGrant as gb, validatePassphrase as gc, validatePublicEnvelopeInput as gd, validateSchemaInput as ge, validateSchemaOutput as gf, withArchive as gg, withDeferredNumbering as gh, writeMagicLinkGrant as gi, changeSecret as gj, createOwnerKeyring as gk, ensureCollectionDEK as gl, grant as gm, loadKeyring as gn, persistKeyring as go, revoke as gp, updateAuthenticator as gq, updateKeyringIdentity as gr, type TxStrategy as gs, type AmendmentTxOptions as gt, type OnMissingPolicy as h, type StaticDictDescriptor as i, applyI18nLocale as j, dictCollectionName as k, dictKey as l, enforceScript as m, getAtPath as n, i18nText as o, inferScripts as p, isDictCollectionName as q, isDictKeyDescriptor as r, isI18nTextDescriptor as s, isStaticDictDescriptor as t, resolveI18nText as u, resolvePolicy as v, setAtPathInPlace as w, staticDict as x, validateI18nTextValue as y, type SessionStrategy as z };
+export { type ConsentAuditFilter as $, type BlobPutOptions as A, type BlobStrategy as B, type BlobResponseOptions as C, DICT_COLLECTION_PREFIX as D, BlobSet as E, type BlobStrategyOpenArgs as F, type CompactRunOptions as G, type CompactionContext as H, type I18nStrategy as I, type CompactionResult as J, DEFAULT_CHUNK_SIZE as K, EXPORT_AUDIT_COLLECTION as L, ExportBlobsAbortedError as M, type ExportBlobsAuditEntry as N, type ExportBlobsHandle as O, PolicyEnforcer as P, type ExportBlobsOptions as Q, type ExportedBlob as R, type ScriptWarning as S, type SlotInfo as T, type SlotRecord as U, type VersionRecord as V, createExportBlobsHandle as W, runCompaction as X, type ConsentStrategy as Y, CONSENT_AUDIT_COLLECTION as Z, type ConsentAuditEntry as _, type DictEntry as a, VaultInstant as a$, type ConsentContext as a0, type ConsentOp as a1, loadConsentEntries as a2, writeConsentEntry as a3, type PeriodsStrategy as a4, type CarryForwardContext as a5, type ClosePeriodOptions as a6, type OpenPeriodOptions as a7, PERIODS_COLLECTION as a8, type PeriodRecord as a9, type DerivedFromMeta as aA, type OutputSpec as aB, type RecordOutputSpec as aC, type MaterializedViewStrategy as aD, type MaterializedViewStrategyHandle as aE, type OverlayedViewStrategy as aF, Collection as aG, type OverlayFieldMergeMode as aH, type OverlayFieldMergeRule as aI, OverlayedViewRegistry as aJ, type OverlayedViewStrategyHandle as aK, type SyncStrategy as aL, type Role as aM, type UnlockedKeyring as aN, type HistoryStrategy as aO, type NoydbStore as aP, type HistoryOptions as aQ, type EncryptedEnvelope as aR, type PruneOptions as aS, type AppendInput as aT, type ChangeType as aU, CollectionInstant as aV, type DiffEntry as aW, type JsonPatch as aX, type JsonPatchOp as aY, LedgerStore as aZ, type VaultEngine as a_, type ReadOnlyCollection as aa, appendPeriodLedgerEntry as ab, assertTsWritable as ac, chainAnchor as ad, loadPeriods as ae, validatePeriodName as af, type GuardStrategy as ag, type GuardChange as ah, type GuardContext as ai, GuardRegistry as aj, type GuardStrategyHandle as ak, ReadOnlyVaultFacade as al, type ShadowStrategy as am, CollectionFrame as an, VaultFrame as ao, type NoydbBundleStore as ap, type RetentionPolicy as aq, type SnapshotPolicy as ar, type SnapshotStrategy as as, type SnapshotMeta as at, type SnapshotMode as au, type DerivationStrategy as av, type DerivationContext as aw, type ArrayOutputSpec as ax, DerivationRegistry as ay, type DerivationStrategyHandle as az, type DictKeyDescriptor as b, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as b$, type VerifyResult as b0, applyPatch as b1, computePatch as b2, diff as b3, formatDiff as b4, type PublicEnvelope as b5, type SealingKeyProvider as b6, type BundleRecipient as b7, type RecipientSealer as b8, type RecipientHint as b9, type ArchiveResult as bA, type ArchiveRunOptions as bB, type ArchiveStrategy as bC, BUNDLE_STORE_POLICY as bD, type BuiltInGateName as bE, type CacheOptions as bF, type CacheStats as bG, type CapturedBlueprint as bH, type ChangeEvent as bI, type CollectionChangeEvent as bJ, type CollectionConflictResolver as bK, type CollectionDescriptor as bL, type CollectionStats as bM, ComputedFieldError as bN, type ComputedFields as bO, type ComputedFn as bP, type Conflict as bQ, type ConflictPolicy as bR, type ConflictStrategy as bS, type CrossTierAccessEvent as bT, CrossVaultAggregation as bU, type CrossVaultDerivationContext as bV, type CrossVaultDerivationSpec as bW, CrossVaultGroupedAggregation as bX, type GroupedRow as bY, type CrossVaultLiveAggregation as bZ, type CrossVaultLiveQuery as b_, Vault as ba, type RecoveryEnrollmentInput as bb, type ShamirRecoveryProvider as bc, TxContext as bd, type MVQueryContext as be, type RegisteredMV as bf, MaterializedViewRegistry as bg, type MaterializedFromMeta as bh, type MaterializedViewOutput as bi, type UnionArmJoin as bj, type UnionSource as bk, type UserEnvelope as bl, type GateName as bm, type GatePolicy as bn, type VaultPolicy as bo, type ActiveTier as bp, type FactorProof as bq, type SchemaUpdateStrategy as br, type TransformFn as bs, type PersistedSchemaEnvelope as bt, type UpdateDecision as bu, type DirectoryConfig as bv, type UserVisibility as bw, type AccessibleVault as bx, type AffectedDocument as by, type ArchivePolicy as bz, DictionaryHandle as c, MAGIC_LINK_CONTENT_INFO_PREFIX as c$, DELEGATIONS_COLLECTION as c0, type DeepPartial as c1, type DeepPartialOrNull as c2, type DeferredNumberingConfig as c3, type DelegationToken as c4, type DeleteManyResult as c5, type DeploymentEvent as c6, type DerivationDescriptor as c7, type DirtyEntry as c8, type DryRunResult as c9, type HistoryConfig as cA, type HistoryEntry as cB, INDEXED_STORE_POLICY as cC, type ImportCapability as cD, type InferOutput as cE, type InternalCollectionStats as cF, type IssueDelegationOptions as cG, type IssueMagicLinkGrantOptions as cH, type KeyringAuthenticator as cI, type KeyringAuthenticatorWrappingDEKs as cJ, type KeyringAuthenticatorWrappingKEK as cK, type KeyringFile as cL, LinkEndpointError as cM, LinkIntegrityError as cN, type LinkOnDelete as cO, type LinkRow as cP, type LinkSetHandle as cQ, type LinkSpec as cR, type ListAccessibleVaultsOptions as cS, type ListPageResult as cT, type ListUsersOptions as cU, type LiveQueryOptions as cV, type LiveUserEnvelope as cW, type LocaleReadOptions as cX, Lru as cY, type LruOptions as cZ, type LruStats as c_, type DumpSchemaOptions as ca, ELEVATION_AUDIT_COLLECTION as cb, ElevatedHandle as cc, type EnrollAuthenticatorOptions as cd, type EnrollAuthenticatorWrappingDEKsOptions as ce, type EnrollAuthenticatorWrappingKEKOptions as cf, type EnrollRecoveryResult as cg, type ExportCapability as ch, type ExportChunk as ci, type ExportFormat as cj, type ExportStreamOptions as ck, type FactorKind as cl, type FactorProofBundle as cm, type FactorRequirement as cn, type FanoutQueryOptions as co, type FanoutResult as cp, type FenceDoc as cq, type FenceState as cr, type FieldChange as cs, type FieldDescriptor as ct, type FieldSource as cu, type FleetMigrationResult as cv, type FormattedSequenceHandle as cw, type GhostRecord as cx, type GrantOptions as cy, type GuardViolation as cz, type DictionaryOptions as d, type SchemaManifestRow as d$, MAGIC_LINK_GRANTS_COLLECTION as d0, MAGIC_LINK_KEK_INFO_PREFIX as d1, type MagicLinkGrantPayload as d2, type MagicLinkGrantRecord as d3, type MaterializedViewDescriptor as d4, MemoryRecipientSealer as d5, MemorySealingKeyProvider as d6, type MigrationStatusRow as d7, NOYDB_BACKUP_VERSION as d8, NOYDB_FORMAT_VERSION as d9, type PullPolicy as dA, type PullResult as dB, type PushMode as dC, type PushOptions as dD, type PushPolicy as dE, type PushResult as dF, type PutManyItemOptions as dG, type PutManyOptions as dH, type PutManyResult as dI, type QueryAcrossOptions as dJ, type QueryAcrossResult as dK, type QuickUnlockState as dL, QuickUnlockStore as dM, type ReAuthOperation as dN, type RecoverPassphraseInput as dO, type RecoverPassphraseResult as dP, type RecoverUserOptions as dQ, type RecoveryProof as dR, type RefreshInsightsResult as dS, type ResolvedPublicEnvelopeSchema as dT, type RevokeOptions as dU, type RotatePassphraseInput as dV, type RotateRecoveryOptions as dW, type RotateRecoveryResult as dX, SEALED_PASSPHRASE_RECORD_ID as dY, type SchemaDelta as dZ, type SchemaIntrospection as d_, NOYDB_KEYRING_VERSION as da, NOYDB_SYNC_VERSION as db, type NextOptions as dc, Noydb as dd, type NoydbEventMap as de, type NoydbOptions as df, type Assignment as dg, type OverlayViewDescriptor as dh, PUBLIC_ENVELOPE_FIELDS as di, type PaperRecoveryDoc as dj, type PaperRecoveryEntry as dk, type PassphrasePolicy as dl, type PassphraseValidationResult as dm, type Permission as dn, type Permissions as dp, type PersistedSchemaKind as dq, type PlaintextTranslatorContext as dr, type PlaintextTranslatorFn as ds, PresenceHandle as dt, type PresencePeer as du, type PublicEnvelopeField as dv, type PublicEnvelopeSchema as dw, type PublicEnvelopeText as dx, type PullMode as dy, type PullOptions as dz, type StaticDictDescriptor as e, type VaultRegistryRow as e$, type SealedEnvelope as e0, type SealedPassphrase as e1, type SearchEntry as e2, type SearchOptions as e3, type SearchResult as e4, type SequenceHandle as e5, type SequenceOptions as e6, SequenceStore as e7, type SessionPolicy as e8, type SetPublicEnvelopeInput as e9, type SyncTransactionResult as eA, type TabChannel as eB, type TabCoordinationOptions as eC, type TabLockManager as eD, type TabPresence as eE, type TabRole as eF, type TierMode as eG, type TransactionInvariant as eH, type TranslatorAuditEntry as eI, TxCollection as eJ, type TxOp as eK, TxVault as eL, USER_ENVELOPE_COLLECTION as eM, USER_ENVELOPE_MAX_BYTES as eN, type Unsubscribe as eO, type UpdateAuthenticatorOptions as eP, type UpdateContext as eQ, type UpdateUserOptions as eR, UserApi as eS, type UserEnvelopeCheckGate as eT, UserEnvelopeOversizedError as eU, type UserEnvelopePresented as eV, type UserInfo as eW, type VaultBackup as eX, VaultGroup as eY, type VaultGroupOptions as eZ, type VaultPolicyOnDisk as e_, type ShamirRecoveryDoc as ea, type ShamirRecoveryEntry as eb, ShardedCollection as ec, ShardedGroupedQuery as ed, ShardedQuery as ee, type ShardingConfig as ef, type SkippedVault as eg, type SlotRewrapCeremony as eh, type SlotRewrapContext as ei, type StandardSchemaV1 as ej, type StandardSchemaV1Issue as ek, type StandardSchemaV1SyncResult as el, StateManagementVault as em, type StoreAuth as en, type StoreAuthKind as eo, type StoreCapabilities as ep, type StoreTime as eq, SyncEngine as er, type SyncMetadata as es, type SyncPolicy as et, SyncScheduler as eu, type SyncSchedulerStatus as ev, type SyncStatus as ew, type SyncTarget as ex, type SyncTargetRole as ey, SyncTransaction as ez, dictCollectionName as f, unwrapMagicLinkGrant as f$, type VaultSchemaSnapshot as f0, type VaultSnapshot as f1, type VaultTemplate as f2, type WarningRules as f3, WeakPassphraseError as f4, type WeakPassphraseReason as f5, type WithArchiveOptions as f6, type WrappedDeksBlob as f7, type WriteConflict as f8, type WriteEvent as f9, listUsers as fA, listUsersWithEnvelopes as fB, loadActiveDelegations as fC, loadPaperRecoveryEntries as fD, loadSealedPassphrase as fE, loadShamirRecoveryEntries as fF, magicLinkGrantRecordId as fG, mintPaperRecoveryEntry as fH, mintShamirRecoveryEntry as fI, mintWrappedDeksBlob as fJ, parseRsaOaepTlv as fK, parseSealedEnvelope as fL, readMagicLinkGrantRecord as fM, recoverUser as fN, removeAuthenticator as fO, resolveSchema as fP, resolveSequenceKey as fQ, revokeDelegation as fR, revokeMagicLinkGrant as fS, runTransaction as fT, savePaperRecoveryEntries as fU, saveSealedPassphrase as fV, saveShamirRecoveryEntries as fW, sealRsaOaepTlv as fX, unwrapDeksFromBlob as fY, unwrapDeksFromPaperEntry as fZ, unwrapDeksFromShamirEntry as f_, type WriteHook as fa, type WriteQueue as fb, aesGcmOpen as fc, assertStrongPassphrase as fd, buildRecipientKeyringFile as fe, burnPaperRecoveryEntry as ff, compileSequenceFormat as fg, createNoydb as fh, createStore as fi, deriveMagicLinkContentKey as fj, enrollAuthenticator as fk, estimateEntropy as fl, evalComputedFields as fm, evaluateExportCapability as fn, evaluateImportCapability as fo, findAuthenticator as fp, hasExportCapability as fq, hasImportCapability as fr, hasRecoveryEnrolled as fs, isLinkCollectionName as ft, isMagicLinkGrantExpired as fu, isPublicEnvelope as fv, issueDelegation as fw, recoverPassphrase as fx, rotatePassphrase as fy, listMagicLinkGrants as fz, dictKey as g, validatePassphrase as g0, validatePublicEnvelopeInput as g1, validateSchemaInput as g2, validateSchemaOutput as g3, withArchive as g4, withDeferredNumbering as g5, writeMagicLinkGrant as g6, changeSecret as g7, createOwnerKeyring as g8, ensureCollectionDEK as g9, grant as ga, loadKeyring as gb, persistKeyring as gc, revoke as gd, updateAuthenticator as ge, updateKeyringIdentity as gf, type TxStrategy as gg, type AmendmentTxOptions as gh, enforceScript as h, inferScripts as i, isDictCollectionName as j, isDictKeyDescriptor as k, isStaticDictDescriptor as l, type SessionStrategy as m, createEnforcer as n, BLOB_CHUNKS_COLLECTION as o, BLOB_COLLECTION as p, BLOB_EVICTION_AUDIT_COLLECTION as q, BLOB_INDEX_COLLECTION as r, staticDict as s, BLOB_SLOTS_PREFIX as t, BLOB_VERSIONS_PREFIX as u, validateSessionPolicy as v, type BlobEvictionEntry as w, type BlobFieldPolicy as x, type BlobFieldsConfig as y, type BlobObject as z };