@noy-db/hub 0.2.0-pre.19 → 0.2.0-pre.20

package/dist/{types-CraiZOyO.d.ts → types-DLfWFr6U.d.ts}

@@ -1,9 +1,9 @@
 import { I as IndexStrategy, d as LazyQuery } from './lazy-builder-ChSqcF5t.js';
-import { c as OnMissingPolicy, a as I18nTextDescriptor, L as Layer, u as LiveAggregation, j as AggregateSpec, h as AggregateResult, N as MoneyDescriptor, A as AggregateStrategy } from './strategy-BDxQnnTX.js';
+import { c as OnMissingPolicy, a as I18nTextDescriptor, L as Layer, u as LiveAggregation, j as AggregateSpec, h as AggregateResult, N as MoneyDescriptor, A as AggregateStrategy } from './strategy-54eIwox5.js';
 import { C as CrdtStrategy, a as CrdtMode, b as CrdtState } from './strategy-BSxFXGzb.js';
 import { L as LedgerEntry, F as ForgetStrategy, S as SubjectRef, b as ForgetResult } from './index-BMmajblo.js';
-import { N as NoydbError } from './errors-DL-zTrrF.js';
-import { L as LiveQuery, Q as Query, c as JoinStrategy, j as RefRegistry, R as RefDescriptor, d as JoinableSource, l as RefViolation, S as ScanBuilder } from './index-BelbyUwz.js';
+import { N as NoydbError } from './errors-Dkc_fi-S.js';
+import { L as LiveQuery, Q as Query, c as JoinStrategy, j as RefRegistry, R as RefDescriptor, d as JoinableSource, l as RefViolation, S as ScanBuilder } from './index-Bm9hIY7t.js';
 import { I as IndexDef, O as Operator, F as FieldClause, C as CollectionIndexes } from './predicate-BmhBSPCH.js';
 import { AttestationFieldSchema, RevocationList } from '@noy-db/attestation';
 
@@ -357,6 +357,239 @@ declare class SyncScheduler {
     private fireUnloadPush;
 }
 
+/**
+ * `ObjectProjection` — the capability an `as-*` projection store implements to
+ * hold blob bytes as native, directly-consumable objects (e.g. servable S3
+ * objects) rather than the encrypted-envelope chunks a `NoydbStore` holds.
+ *
+ * This is the shared seam behind **direct-serve blobs** (#412) and the
+ * **debug raw-object path** (#413): "write these bytes as one real object and
+ * give me a URL to it." See the as-aws-s3 design spec.
+ *
+ * Unlike `NoydbStore` (ciphertext in / ciphertext out), an `ObjectProjection`
+ * sees **raw bytes** — it is `as-*`, not `to-*`, and lives **outside** the
+ * zero-knowledge guarantee. Wiring it up is a deliberate, per-field opt-in.
+ */
+/** Metadata about a stored object, without its body. */
+interface ObjectMeta {
+    readonly size: number;
+    readonly contentType?: string;
+    readonly etag?: string;
+    readonly lastModified?: string;
+    /** S3-style user metadata (`x-amz-meta-*`). Small; see the design's
+     *  plain / encrypted / opaque-token modes. */
+    readonly userMeta?: Record<string, string>;
+}
+interface PutObjectOptions {
+    readonly contentType: string;
+    /** World-readable object (CDN origin) vs private (presigned-only). Default false. */
+    readonly public?: boolean;
+    /** User metadata mirrored onto the object (the "secondary store"). */
+    readonly userMeta?: Record<string, string>;
+}
+interface ObjectUrlOptions {
+    /** TTL for a presigned URL (ignored for a public object). */
+    readonly expiresInSeconds?: number;
+}
+interface PutUrlOptions {
+    readonly contentType: string;
+    readonly expiresInSeconds?: number;
+}
+/** One entry returned by {@link ObjectProjection.listPrefix}. */
+interface ObjectListEntry {
+    readonly key: string;
+    readonly meta: ObjectMeta;
+}
+interface ObjectProjection {
+    /** Diagnostic name (e.g. `'aws-s3'`, `'memory'`). */
+    readonly name?: string;
+    /** Write raw bytes as a single native object with a real content type. */
+    putObject(key: string, bytes: Uint8Array, opts: PutObjectOptions): Promise<void>;
+    /** Read the raw bytes back; `null` if absent. */
+    getObject(key: string): Promise<Uint8Array | null>;
+    /** Delete the object. Idempotent — absent is not an error. */
+    deleteObject(key: string): Promise<void>;
+    /** Object metadata without the body; `null` if absent. */
+    headObject(key: string): Promise<ObjectMeta | null>;
+    /** A URL to GET the object — presigned (time-limited) or stable public. */
+    objectUrl(key: string, opts?: ObjectUrlOptions): Promise<string>;
+    /** A presigned URL the client PUTs bytes to directly (large-file upload,
+     *  bytes bypass the hub). */
+    putUrl(key: string, opts: PutUrlOptions): Promise<string>;
+    /** List objects under a key prefix — for import / reconcile. */
+    listPrefix(prefix: string): Promise<ObjectListEntry[]>;
+}
+/**
+ * In-memory {@link ObjectProjection} — a reference implementation for tests,
+ * local development, and the hub's blob-wiring conformance. Holds bytes in a
+ * `Map`; URLs are synthetic (`memory://…`). Not for production.
+ */
+declare function memoryObjectProjection(opts?: {
+    baseUrl?: string;
+}): ObjectProjection;
+
+/**
+ * Blob retention + compaction.
+ *
+ * Declarative per-collection / per-slot eviction policy. Two
+ * triggers:
+ *
+ *   - **`retainDays`** — age-based TTL. A slot uploaded more than N
+ *     days ago is evicted.
+ *   - **`evictWhen(record)`** — predicate over the **decrypted**
+ *     record. Lets consumers express "the image is safe to drop once
+ *     the structured invoice has been reviewed and confirmed."
+ *
+ * Either trigger (or both) causes the slot to evict. Eviction removes
+ * the slot entry from `_blob_slots_{collection}`, decrements the
+ * blob's refCount (so unreferenced chunks can be GC'd by the next
+ * sweep), and writes one entry to the `_blob_eviction_audit`
+ * collection for tamper-evident record-keeping.
+ *
+ * The audit entry carries the eTag of the evicted blob (opaque HMAC
+ * of plaintext under the vault's `_blob` DEK) — no plaintext leakage,
+ * per the SPEC non-correlation invariant. Consumers reconstructing
+ * "what used to be attached" can look up the audit entry by record
+ * id.
+ *
+ * Compaction is **consumer-scheduled** — noy-db never runs a
+ * background daemon. Call `vault.compact()` whenever your workflow
+ * allows (cron, manual "tidy" button, cold-storage export prep, …).
+ *
+ * @module
+ */
+
+interface BlobFieldPolicy<T = unknown> {
+    /**
+     * Age-based TTL in days. A slot whose `uploadedAt` is older than
+     * `now - retainDays × 86400s` evicts on the next `vault.compact()`.
+     * Omit to disable age-based eviction.
+     */
+    readonly retainDays?: number;
+    /**
+     * Predicate evaluated against the decrypted record. When it returns
+     * `true`, every matching slot on that record evicts. Omit to
+     * disable predicate-based eviction.
+     */
+    readonly evictWhen?: (record: T) => boolean;
+    /**
+     * **Legal hold.** When this predicate returns `true`, the slot is
+     * never evicted — `retainDays`/`evictWhen` are overridden. Use for a
+     * litigation / audit hold on a fiscal document: the blob stays until
+     * the predicate returns `false` (the hold is released). Fail-closed:
+     * if the predicate throws, the slot is treated as held.
+     */
+    readonly legalHold?: (record: T) => boolean;
+    /**
+     * **Period-bound retention.** Returns the date (Date / ISO string /
+     * epoch ms) until which the slot must be retained — typically derived
+     * from the record's fiscal period (e.g. period end + 10 years). While
+     * `now < retainUntil`, the slot is never evicted, regardless of
+     * `retainDays`. Return `null`/`undefined` to impose no floor.
+     * Fail-closed: a throwing function holds the slot.
+     */
+    readonly retainUntil?: (record: T) => Date | string | number | null | undefined;
+    /**
+     * **External projection.** When `true`, this field's bytes are stored in the
+     * vault's `ObjectProjection` (`createNoydb({ objectStore })`) as a single raw,
+     * **unencrypted** object — servable directly from S3/CDN and processable by
+     * native tooling — instead of the encrypted-chunk path. The encrypted slot
+     * record remains the catalog (anchoring invariant). Requires an `objectStore`;
+     * **outside the zero-knowledge guarantee** — use only for assets meant to
+     * leave the vault. See the as-aws-s3 design spec.
+     */
+    readonly external?: boolean;
+    /**
+     * For an `external` field: make the object world-readable (CDN origin) rather
+     * than presigned-only. Default `false` (presigned). Ignored unless `external`.
+     */
+    readonly public?: boolean;
+    /**
+     * For an `external` field: how to stamp a **backlink** (this record's
+     * vault/collection/id/field) onto the object's metadata — the self-describing
+     * "secondary store" that powers reconcile / DR / import re-pairing.
+     * - `'opaque-token'` (default): a random id; preserves the opaque-bucket
+     *   property (no names leak); the token is also recorded on the slot.
+     * - `'encrypted'`: the reference encrypted under the blob DEK (ZK-preserving;
+     *   falls back to `'opaque-token'` on a plaintext vault).
+     * - `'plain'`: the reference in cleartext metadata — **leaks structure** to
+     *   bucket readers; only for non-sensitive deployments.
+     * - `'none'`: no backlink.
+     */
+    readonly backlink?: 'opaque-token' | 'encrypted' | 'plain' | 'none';
+}
+type BlobFieldsConfig<T = unknown> = Record<string, BlobFieldPolicy<T>>;
+declare const BLOB_EVICTION_AUDIT_COLLECTION = "_blob_eviction_audit";
+interface BlobEvictionEntry {
+    readonly id: string;
+    readonly collection: string;
+    readonly recordId: string;
+    readonly slotName: string;
+    readonly blobHash: string;
+    readonly reason: 'ttl' | 'predicate' | 'both';
+    readonly evictedAt: string;
+    readonly actor: string;
+}
+interface CompactionResult {
+    /** Number of blob slots evicted across all collections. */
+    readonly evicted: number;
+    /** Number of records touched (iterated + policy checked). */
+    readonly records: number;
+    /** Number of collections with `blobFields` configured. */
+    readonly collections: number;
+    /** Number of audit entries written. Equal to `evicted`. */
+    readonly auditEntries: number;
+    /**
+     * Number of slots that would have evicted (TTL/predicate triggered)
+     * but were retained by a `legalHold` or `retainUntil` floor.
+     */
+    readonly held: number;
+    /** Per-collection breakdown for diagnostics. */
+    readonly byCollection: Record<string, {
+        records: number;
+        evicted: number;
+    }>;
+}
+interface CompactRunOptions {
+    /** Override "now" for deterministic testing. */
+    readonly now?: Date;
+    /**
+     * Stop after this many evictions. Useful for capped batches / cron
+     * jobs that need to fit in a time window. `undefined` = unbounded.
+     */
+    readonly maxEvictions?: number;
+    /**
+     * Dry-run — evaluate policies and return the counts, but do NOT
+     * delete slots or write audit entries. Lets a consumer preview
+     * what would happen.
+     */
+    readonly dryRun?: boolean;
+}
+interface CompactionContext {
+    readonly adapter: NoydbStore;
+    readonly vault: string;
+    readonly actor: string;
+    readonly encrypted: boolean;
+    readonly getDEK: (collection: string) => Promise<CryptoKey>;
+    /**
+     * Resolve a collection's declared `blobFields` config. Returns an
+     * empty map for collections without the config — the walk skips
+     * those.
+     */
+    readonly getBlobFields: <T>(collection: string) => BlobFieldsConfig<T> | null;
+    /** List collection names in the vault. */
+    readonly listCollections: () => Promise<string[]>;
+    /** List record ids in a collection. */
+    readonly listRecords: (collection: string) => Promise<string[]>;
+    /** Decrypt and return the record. Null when absent. */
+    readonly getRecord: <T>(collection: string, id: string) => Promise<T | null>;
+    /** Return the BlobSet-like handle for a record's slots. */
+    readonly listSlots: (collection: string, id: string) => Promise<SlotInfo[]>;
+    /** Delete a slot and decrement its blob's refCount. */
+    readonly deleteSlot: (collection: string, id: string, slotName: string) => Promise<void>;
+}
+declare function runCompaction(ctx: CompactionContext, options?: CompactRunOptions): Promise<CompactionResult>;
+
 /**
  * DEK slot name for vault-shared blob data. Calling `getDEK('_blob')`
  * auto-creates a blob DEK the first time — same lazy-creation mechanism
@@ -418,6 +651,9 @@ declare class BlobSet {
     private readonly userId;
     private readonly maxBlobBytes;
     private readonly erasableBlobs;
+    private readonly debugPlaintext;
+    private readonly objectStore;
+    private readonly blobFields;
     constructor(opts: {
         store: NoydbStore;
         vault: string;
@@ -428,6 +664,9 @@ declare class BlobSet {
         userId?: string;
         maxBlobBytes?: number;
         erasableBlobs?: boolean;
+        debugPlaintext?: boolean;
+        objectStore?: ObjectProjection;
+        blobFields?: BlobFieldsConfig;
     });
     /**
      * Resolve the key the blob's CHUNKS are encrypted under.
@@ -551,6 +790,46 @@ declare class BlobSet {
      * Throws `NotFoundError` if the index entry exists but a chunk is missing.
      */
     get(slotName: string): Promise<Uint8Array | null>;
+    /**
+     * A URL to fetch an `external` slot's object directly — presigned
+     * (time-limited) or public, per the projection. Returns `null` if the slot
+     * does not exist. Throws for a non-external slot (use `get()`/`response()`).
+     */
+    url(slotName: string, opts?: {
+        expiresInSeconds?: number;
+    }): Promise<string | null>;
+    /**
+     * Build the backlink stamped onto an external object's metadata — the
+     * self-describing "secondary store" reference back to this record. See
+     * {@link BlobFieldPolicy.backlink}. Returns the `userMeta` to attach and, for
+     * `opaque-token`, the `token` to record on the slot.
+     */
+    private buildBacklink;
+    /**
+     * Adopt an EXISTING object in the projection into this slot **without
+     * re-uploading** — used by import/bootstrap to anchor objects already in the
+     * bucket. Writes the external slot record (the catalog entry).
+     */
+    adoptExternal(slotName: string, ref: {
+        key: string;
+        size?: number;
+        contentType?: string;
+        public?: boolean;
+        backlink?: string;
+        meta?: Record<string, unknown>;
+    }): Promise<void>;
+    /**
+     * Merge derived metadata (video `duration`, image `width`/`height`, arbitrary
+     * metatags) into an external slot's secondary metadata store. Typically called
+     * from an AWS-side processing callback (MediaConvert / ffprobe / Rekognition)
+     * once it has probed the object. No-op for a missing or non-external slot.
+     */
+    setExternalMeta(slotName: string, meta: Record<string, unknown>): Promise<void>;
+    /**
+     * Read an external slot's synced derived metadata (the secondary store).
+     * Returns `null` for a missing or non-external slot, `{}` if none synced yet.
+     */
+    externalMeta(slotName: string): Promise<Record<string, unknown> | null>;
     /**
      * List all slot entries for this record.
      * Returns metadata only — no chunk data is loaded.
@@ -686,6 +965,22 @@ interface BlobStrategyOpenArgs {
      * CEK design spec.
      */
     readonly erasableBlobs?: boolean;
+    /**
+     * Vault is in debug-plaintext mode (`encrypt: false` + `debugPlaintext: true`).
+     * Blobs are then written as a single un-gzipped object (one base64 chunk) so
+     * the stored object is directly recoverable with native tools (`base64 -d`),
+     * matching the directly-inspectable record layout. Dev-only — see the
+     * plaintext/debug-store-mode design.
+     */
+    readonly debugPlaintext?: boolean;
+    /**
+     * Object projection for `external` blob fields (`createNoydb({ objectStore })`).
+     * When present, fields declared `external` in `blobFields` route their raw
+     * bytes here instead of the encrypted-chunk path.
+     */
+    readonly objectStore?: ObjectProjection;
+    /** Per-collection blob field policies — used to resolve `external` / `public`. */
+    readonly blobFields?: BlobFieldsConfig;
 }
 /**
  * The seam interface. `@internal` — do not build public APIs on this
@@ -1817,6 +2112,16 @@ interface UnlockedKeyring {
      */
     readonly kek: CryptoKey | null;
     readonly salt: Uint8Array;
+    /**
+     * Debug-plaintext layout flag. Set only on the plaintext keyring created
+     * in `encrypt: false` + `debugPlaintext: true` mode — it lives here
+     * because its lifecycle is identical to the plaintext keyring's (no
+     * encrypted vault ever has it, so this never widens the encrypted surface).
+     * When true, user-collection records are written with their fields inlined
+     * beside the envelope metadata (`_debug: 1`) so native store tooling can
+     * read them without unwrapping `_data`.
+     */
+    readonly debugPlaintext?: boolean;
     /**
      * `@noy-db/as-*` export capability. Absent when the
      * keyring was written before this RFC landed — role-based defaults
@@ -8266,140 +8571,6 @@ interface ExportBlobsAuditEntry {
  */
 declare function createExportBlobsHandle(actor: string, listAccessibleCollections: () => Promise<string[]>, getCollection: <T>(name: string) => Collection<T>, writeAudit: (entry: ExportBlobsAuditEntry) => Promise<void>, options: ExportBlobsOptions): ExportBlobsHandle;
 
-/**
- * Blob retention + compaction.
- *
- * Declarative per-collection / per-slot eviction policy. Two
- * triggers:
- *
- *   - **`retainDays`** — age-based TTL. A slot uploaded more than N
- *     days ago is evicted.
- *   - **`evictWhen(record)`** — predicate over the **decrypted**
- *     record. Lets consumers express "the image is safe to drop once
- *     the structured invoice has been reviewed and confirmed."
- *
- * Either trigger (or both) causes the slot to evict. Eviction removes
- * the slot entry from `_blob_slots_{collection}`, decrements the
- * blob's refCount (so unreferenced chunks can be GC'd by the next
- * sweep), and writes one entry to the `_blob_eviction_audit`
- * collection for tamper-evident record-keeping.
- *
- * The audit entry carries the eTag of the evicted blob (opaque HMAC
- * of plaintext under the vault's `_blob` DEK) — no plaintext leakage,
- * per the SPEC non-correlation invariant. Consumers reconstructing
- * "what used to be attached" can look up the audit entry by record
- * id.
- *
- * Compaction is **consumer-scheduled** — noy-db never runs a
- * background daemon. Call `vault.compact()` whenever your workflow
- * allows (cron, manual "tidy" button, cold-storage export prep, …).
- *
- * @module
- */
-
-interface BlobFieldPolicy<T = unknown> {
-    /**
-     * Age-based TTL in days. A slot whose `uploadedAt` is older than
-     * `now - retainDays × 86400s` evicts on the next `vault.compact()`.
-     * Omit to disable age-based eviction.
-     */
-    readonly retainDays?: number;
-    /**
-     * Predicate evaluated against the decrypted record. When it returns
-     * `true`, every matching slot on that record evicts. Omit to
-     * disable predicate-based eviction.
-     */
-    readonly evictWhen?: (record: T) => boolean;
-    /**
-     * **Legal hold.** When this predicate returns `true`, the slot is
-     * never evicted — `retainDays`/`evictWhen` are overridden. Use for a
-     * litigation / audit hold on a fiscal document: the blob stays until
-     * the predicate returns `false` (the hold is released). Fail-closed:
-     * if the predicate throws, the slot is treated as held.
-     */
-    readonly legalHold?: (record: T) => boolean;
-    /**
-     * **Period-bound retention.** Returns the date (Date / ISO string /
-     * epoch ms) until which the slot must be retained — typically derived
-     * from the record's fiscal period (e.g. period end + 10 years). While
-     * `now < retainUntil`, the slot is never evicted, regardless of
-     * `retainDays`. Return `null`/`undefined` to impose no floor.
-     * Fail-closed: a throwing function holds the slot.
-     */
-    readonly retainUntil?: (record: T) => Date | string | number | null | undefined;
-}
-type BlobFieldsConfig<T = unknown> = Record<string, BlobFieldPolicy<T>>;
-declare const BLOB_EVICTION_AUDIT_COLLECTION = "_blob_eviction_audit";
-interface BlobEvictionEntry {
-    readonly id: string;
-    readonly collection: string;
-    readonly recordId: string;
-    readonly slotName: string;
-    readonly blobHash: string;
-    readonly reason: 'ttl' | 'predicate' | 'both';
-    readonly evictedAt: string;
-    readonly actor: string;
-}
-interface CompactionResult {
-    /** Number of blob slots evicted across all collections. */
-    readonly evicted: number;
-    /** Number of records touched (iterated + policy checked). */
-    readonly records: number;
-    /** Number of collections with `blobFields` configured. */
-    readonly collections: number;
-    /** Number of audit entries written. Equal to `evicted`. */
-    readonly auditEntries: number;
-    /**
-     * Number of slots that would have evicted (TTL/predicate triggered)
-     * but were retained by a `legalHold` or `retainUntil` floor.
-     */
-    readonly held: number;
-    /** Per-collection breakdown for diagnostics. */
-    readonly byCollection: Record<string, {
-        records: number;
-        evicted: number;
-    }>;
-}
-interface CompactRunOptions {
-    /** Override "now" for deterministic testing. */
-    readonly now?: Date;
-    /**
-     * Stop after this many evictions. Useful for capped batches / cron
-     * jobs that need to fit in a time window. `undefined` = unbounded.
-     */
-    readonly maxEvictions?: number;
-    /**
-     * Dry-run — evaluate policies and return the counts, but do NOT
-     * delete slots or write audit entries. Lets a consumer preview
-     * what would happen.
-     */
-    readonly dryRun?: boolean;
-}
-interface CompactionContext {
-    readonly adapter: NoydbStore;
-    readonly vault: string;
-    readonly actor: string;
-    readonly encrypted: boolean;
-    readonly getDEK: (collection: string) => Promise<CryptoKey>;
-    /**
-     * Resolve a collection's declared `blobFields` config. Returns an
-     * empty map for collections without the config — the walk skips
-     * those.
-     */
-    readonly getBlobFields: <T>(collection: string) => BlobFieldsConfig<T> | null;
-    /** List collection names in the vault. */
-    readonly listCollections: () => Promise<string[]>;
-    /** List record ids in a collection. */
-    readonly listRecords: (collection: string) => Promise<string[]>;
-    /** Decrypt and return the record. Null when absent. */
-    readonly getRecord: <T>(collection: string, id: string) => Promise<T | null>;
-    /** Return the BlobSet-like handle for a record's slots. */
-    readonly listSlots: (collection: string, id: string) => Promise<SlotInfo[]>;
-    /** Delete a slot and decrement its blob's refCount. */
-    readonly deleteSlot: (collection: string, id: string, slotName: string) => Promise<void>;
-}
-declare function runCompaction(ctx: CompactionContext, options?: CompactRunOptions): Promise<CompactionResult>;
-
 /**
  * Magic-link-bound cross-user delegation grants.
  *
@@ -9022,6 +9193,7 @@ declare class Vault {
      * call throws with a pointer at `@noy-db/hub/blobs`.
      */
     private readonly blobStrategy;
+    private readonly objectStore;
     /** Cold-storage archival strategy (the archive target store). */
     private readonly archiveStrategy;
     /** Per-collection record archival policies. Indexed by collection name. */
@@ -9271,6 +9443,7 @@ declare class Vault {
          * at `@noy-db/hub/blobs`.
          */
         blobStrategy?: BlobStrategy | undefined;
+        objectStore?: ObjectProjection | undefined;
         archiveStrategy?: ArchiveStrategy | undefined;
         indexStrategy?: IndexStrategy | undefined;
         aggregateStrategy?: AggregateStrategy | undefined;
@@ -10793,6 +10966,8 @@ declare class Collection<T> {
      * reaches the bundle.
      */
     private readonly blobStrategy;
+    private readonly objectStore;
+    private readonly blobFields;
     private readonly aggregateStrategy;
     private readonly crdtStrategy;
     private readonly historyStrategy;
@@ -11083,6 +11258,8 @@ declare class Collection<T> {
          * `@internal` by virtue of `BlobStrategy` being `@internal`.
          */
         blobStrategy?: BlobStrategy | undefined;
+        objectStore?: ObjectProjection | undefined;
+        blobFields?: BlobFieldsConfig | undefined;
         aggregateStrategy?: AggregateStrategy | undefined;
         crdtStrategy?: CrdtStrategy | undefined;
         /**
@@ -12115,6 +12292,15 @@ declare class Collection<T> {
      * path encrypts the body directly under the collection DEK — byte-identical
      * to pre-CEK behaviour, so non-adopting collections pay nothing.
      */
+    /**
+     * Build a debug-plaintext envelope: the record's own fields inlined as
+     * top-level keys beside the reserved `_`-metadata, with `_debug: 1` and an
+     * empty `_data`. Lets native store tooling read the record without
+     * unwrapping. Only reached for user collections under `debugPlaintext`
+     * (see {@link encryptRecord}). Rejects `_`-prefixed record fields, which
+     * would collide with the reserved metadata namespace.
+     */
+    private buildDebugEnvelope;
     private encryptJsonString;
     private encryptRecord;
     /**
@@ -12603,6 +12789,16 @@ interface EncryptedEnvelope {
      * across records.
      */
     readonly _cek?: string;
+    /**
+     * Debug-plaintext marker. Present only on records written by a vault opened
+     * with `debugPlaintext: true` (which requires `encrypt: false`). When set,
+     * the record's own fields are inlined as top-level keys on this envelope
+     * (beside the reserved `_`-prefixed metadata) and `_data` is empty — so
+     * native store tooling (jq, S3 console) reads the record directly. The read
+     * path reconstructs the record from the non-`_` keys; the marker makes a
+     * debug envelope self-describing, so a classic plaintext reader handles it too.
+     */
+    readonly _debug?: typeof NOYDB_FORMAT_VERSION;
 }
 /**
  * Placeholder returned by `getAtTier()` in `'ghost'` mode when a
@@ -13868,8 +14064,31 @@ interface BlobObject {
  * a new envelope version (`_v++`) while the blob data is unchanged.
  */
 interface SlotRecord {
-    /** Reference to the `BlobObject` in `_blob_index`. */
+    /**
+     * Reference to the `BlobObject` in `_blob_index` (chunk-based blobs).
+     * Empty string (`''`) for an `external` slot, whose bytes live in the
+     * `ObjectProjection` rather than `_blob_chunks` — read `external` instead.
+     */
     readonly eTag: string;
+    /**
+     * External-projection reference. Present when the blob field is declared
+     * `external`: the raw bytes live in the vault's `ObjectProjection` at `key`
+     * (unencrypted), not in `_blob_chunks`. This slot record (in the encrypted
+     * collection) remains the catalog entry — the anchoring invariant.
+     */
+    readonly external?: {
+        readonly key: string;
+        readonly contentType?: string;
+        readonly public?: boolean;
+        /** Opaque-token backlink stamped on the object (when `backlink:'opaque-token'`). */
+        readonly backlink?: string;
+        /**
+         * Secondary metadata store synced from the object / its processing pipeline
+         * (e.g. video `duration`, image `width`/`height`, arbitrary metatags).
+         * Populated via `BlobSet.setExternalMeta()` — typically an AWS-side callback.
+         */
+        readonly meta?: Record<string, unknown>;
+    };
     /** User-visible filename for the slot. */
     readonly filename: string;
     /** Original uncompressed size in bytes (denormalized from `BlobObject`). */
@@ -14258,6 +14477,22 @@ interface NoydbOptions {
     readonly auth?: 'passphrase' | 'biometric';
     /** Enable encryption. Default: true. */
     readonly encrypt?: boolean;
+    /**
+     * Debug-only: lay plaintext records out as directly-inspectable store
+     * objects (record fields inlined beside envelope metadata, `_debug: 1`) so
+     * native store tooling can read them without unwrapping `_data`. Requires
+     * `encrypt: false` — combining with encryption throws `DebugPlaintextError`
+     * at construction. NEVER enable for production or client data.
+     */
+    readonly debugPlaintext?: boolean;
+    /**
+     * Object projection for direct-serve / external blob fields (`as-*`, e.g.
+     * `@noy-db/as-aws-s3`). Blob fields declared `external` route their RAW bytes
+     * to this projection as a single native object (servable from S3/CDN) instead
+     * of the encrypted-chunk path; the encrypted record/slot stays the catalog.
+     * Sees plaintext bytes — outside the zero-knowledge guarantee.
+     */
+    readonly objectStore?: ObjectProjection;
     /** Conflict resolution strategy. Default: 'version'. */
     readonly conflict?: ConflictStrategy;
     /**
@@ -14467,4 +14702,4 @@ interface DeleteManyResult {
     }>;
 }
 
-export { type ConsentAuditFilter as $, type BlobPutOptions as A, type BlobStrategy as B, type BlobResponseOptions as C, DICT_COLLECTION_PREFIX as D, BlobSet as E, type BlobStrategyOpenArgs as F, type CompactRunOptions as G, type CompactionContext as H, type I18nStrategy as I, type CompactionResult as J, DEFAULT_CHUNK_SIZE as K, EXPORT_AUDIT_COLLECTION as L, ExportBlobsAbortedError as M, type ExportBlobsAuditEntry as N, type ExportBlobsHandle as O, PolicyEnforcer as P, type ExportBlobsOptions as Q, type ExportedBlob as R, type ScriptWarning as S, type SlotInfo as T, type SlotRecord as U, type VersionRecord as V, createExportBlobsHandle as W, runCompaction as X, type ConsentStrategy as Y, CONSENT_AUDIT_COLLECTION as Z, type ConsentAuditEntry as _, type DictEntry as a, VaultInstant as a$, type ConsentContext as a0, type ConsentOp as a1, loadConsentEntries as a2, writeConsentEntry as a3, type PeriodsStrategy as a4, type CarryForwardContext as a5, type ClosePeriodOptions as a6, type OpenPeriodOptions as a7, PERIODS_COLLECTION as a8, type PeriodRecord as a9, type DerivedFromMeta as aA, type OutputSpec as aB, type RecordOutputSpec as aC, type MaterializedViewStrategy as aD, type MaterializedViewStrategyHandle as aE, type OverlayedViewStrategy as aF, Collection as aG, type OverlayFieldMergeMode as aH, type OverlayFieldMergeRule as aI, OverlayedViewRegistry as aJ, type OverlayedViewStrategyHandle as aK, type SyncStrategy as aL, type Role as aM, type UnlockedKeyring as aN, type HistoryStrategy as aO, type NoydbStore as aP, type HistoryOptions as aQ, type EncryptedEnvelope as aR, type PruneOptions as aS, type AppendInput as aT, type ChangeType as aU, CollectionInstant as aV, type DiffEntry as aW, type JsonPatch as aX, type JsonPatchOp as aY, LedgerStore as aZ, type VaultEngine as a_, type ReadOnlyCollection as aa, appendPeriodLedgerEntry as ab, assertTsWritable as ac, chainAnchor as ad, loadPeriods as ae, validatePeriodName as af, type GuardStrategy as ag, type GuardChange as ah, type GuardContext as ai, GuardRegistry as aj, type GuardStrategyHandle as ak, ReadOnlyVaultFacade as al, type ShadowStrategy as am, CollectionFrame as an, VaultFrame as ao, type NoydbBundleStore as ap, type RetentionPolicy as aq, type SnapshotPolicy as ar, type SnapshotStrategy as as, type SnapshotMeta as at, type SnapshotMode as au, type DerivationStrategy as av, type DerivationContext as aw, type ArrayOutputSpec as ax, DerivationRegistry as ay, type DerivationStrategyHandle as az, type DictKeyDescriptor as b, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as b$, type VerifyResult as b0, applyPatch as b1, computePatch as b2, diff as b3, formatDiff as b4, type PublicEnvelope as b5, type SealingKeyProvider as b6, type BundleRecipient as b7, type RecipientSealer as b8, type RecipientHint as b9, type ArchiveResult as bA, type ArchiveRunOptions as bB, type ArchiveStrategy as bC, BUNDLE_STORE_POLICY as bD, type BuiltInGateName as bE, type CacheOptions as bF, type CacheStats as bG, type CapturedBlueprint as bH, type ChangeEvent as bI, type CollectionChangeEvent as bJ, type CollectionConflictResolver as bK, type CollectionDescriptor as bL, type CollectionStats as bM, ComputedFieldError as bN, type ComputedFields as bO, type ComputedFn as bP, type Conflict as bQ, type ConflictPolicy as bR, type ConflictStrategy as bS, type CrossTierAccessEvent as bT, CrossVaultAggregation as bU, type CrossVaultDerivationContext as bV, type CrossVaultDerivationSpec as bW, CrossVaultGroupedAggregation as bX, type GroupedRow as bY, type CrossVaultLiveAggregation as bZ, type CrossVaultLiveQuery as b_, Vault as ba, type RecoveryEnrollmentInput as bb, type ShamirRecoveryProvider as bc, TxContext as bd, type MVQueryContext as be, type RegisteredMV as bf, MaterializedViewRegistry as bg, type MaterializedFromMeta as bh, type MaterializedViewOutput as bi, type UnionArmJoin as bj, type UnionSource as bk, type UserEnvelope as bl, type GateName as bm, type GatePolicy as bn, type VaultPolicy as bo, type ActiveTier as bp, type FactorProof as bq, type SchemaUpdateStrategy as br, type TransformFn as bs, type PersistedSchemaEnvelope as bt, type UpdateDecision as bu, type DirectoryConfig as bv, type UserVisibility as bw, type AccessibleVault as bx, type AffectedDocument as by, type ArchivePolicy as bz, DictionaryHandle as c, MAGIC_LINK_CONTENT_INFO_PREFIX as c$, DELEGATIONS_COLLECTION as c0, type DeepPartial as c1, type DeepPartialOrNull as c2, type DeferredNumberingConfig as c3, type DelegationToken as c4, type DeleteManyResult as c5, type DeploymentEvent as c6, type DerivationDescriptor as c7, type DirtyEntry as c8, type DryRunResult as c9, type HistoryConfig as cA, type HistoryEntry as cB, INDEXED_STORE_POLICY as cC, type ImportCapability as cD, type InferOutput as cE, type InternalCollectionStats as cF, type IssueDelegationOptions as cG, type IssueMagicLinkGrantOptions as cH, type KeyringAuthenticator as cI, type KeyringAuthenticatorWrappingDEKs as cJ, type KeyringAuthenticatorWrappingKEK as cK, type KeyringFile as cL, LinkEndpointError as cM, LinkIntegrityError as cN, type LinkOnDelete as cO, type LinkRow as cP, type LinkSetHandle as cQ, type LinkSpec as cR, type ListAccessibleVaultsOptions as cS, type ListPageResult as cT, type ListUsersOptions as cU, type LiveQueryOptions as cV, type LiveUserEnvelope as cW, type LocaleReadOptions as cX, Lru as cY, type LruOptions as cZ, type LruStats as c_, type DumpSchemaOptions as ca, ELEVATION_AUDIT_COLLECTION as cb, ElevatedHandle as cc, type EnrollAuthenticatorOptions as cd, type EnrollAuthenticatorWrappingDEKsOptions as ce, type EnrollAuthenticatorWrappingKEKOptions as cf, type EnrollRecoveryResult as cg, type ExportCapability as ch, type ExportChunk as ci, type ExportFormat as cj, type ExportStreamOptions as ck, type FactorKind as cl, type FactorProofBundle as cm, type FactorRequirement as cn, type FanoutQueryOptions as co, type FanoutResult as cp, type FenceDoc as cq, type FenceState as cr, type FieldChange as cs, type FieldDescriptor as ct, type FieldSource as cu, type FleetMigrationResult as cv, type FormattedSequenceHandle as cw, type GhostRecord as cx, type GrantOptions as cy, type GuardViolation as cz, type DictionaryOptions as d, type SchemaManifestRow as d$, MAGIC_LINK_GRANTS_COLLECTION as d0, MAGIC_LINK_KEK_INFO_PREFIX as d1, type MagicLinkGrantPayload as d2, type MagicLinkGrantRecord as d3, type MaterializedViewDescriptor as d4, MemoryRecipientSealer as d5, MemorySealingKeyProvider as d6, type MigrationStatusRow as d7, NOYDB_BACKUP_VERSION as d8, NOYDB_FORMAT_VERSION as d9, type PullPolicy as dA, type PullResult as dB, type PushMode as dC, type PushOptions as dD, type PushPolicy as dE, type PushResult as dF, type PutManyItemOptions as dG, type PutManyOptions as dH, type PutManyResult as dI, type QueryAcrossOptions as dJ, type QueryAcrossResult as dK, type QuickUnlockState as dL, QuickUnlockStore as dM, type ReAuthOperation as dN, type RecoverPassphraseInput as dO, type RecoverPassphraseResult as dP, type RecoverUserOptions as dQ, type RecoveryProof as dR, type RefreshInsightsResult as dS, type ResolvedPublicEnvelopeSchema as dT, type RevokeOptions as dU, type RotatePassphraseInput as dV, type RotateRecoveryOptions as dW, type RotateRecoveryResult as dX, SEALED_PASSPHRASE_RECORD_ID as dY, type SchemaDelta as dZ, type SchemaIntrospection as d_, NOYDB_KEYRING_VERSION as da, NOYDB_SYNC_VERSION as db, type NextOptions as dc, Noydb as dd, type NoydbEventMap as de, type NoydbOptions as df, type Assignment as dg, type OverlayViewDescriptor as dh, PUBLIC_ENVELOPE_FIELDS as di, type PaperRecoveryDoc as dj, type PaperRecoveryEntry as dk, type PassphrasePolicy as dl, type PassphraseValidationResult as dm, type Permission as dn, type Permissions as dp, type PersistedSchemaKind as dq, type PlaintextTranslatorContext as dr, type PlaintextTranslatorFn as ds, PresenceHandle as dt, type PresencePeer as du, type PublicEnvelopeField as dv, type PublicEnvelopeSchema as dw, type PublicEnvelopeText as dx, type PullMode as dy, type PullOptions as dz, type StaticDictDescriptor as e, type VaultRegistryRow as e$, type SealedEnvelope as e0, type SealedPassphrase as e1, type SearchEntry as e2, type SearchOptions as e3, type SearchResult as e4, type SequenceHandle as e5, type SequenceOptions as e6, SequenceStore as e7, type SessionPolicy as e8, type SetPublicEnvelopeInput as e9, type SyncTransactionResult as eA, type TabChannel as eB, type TabCoordinationOptions as eC, type TabLockManager as eD, type TabPresence as eE, type TabRole as eF, type TierMode as eG, type TransactionInvariant as eH, type TranslatorAuditEntry as eI, TxCollection as eJ, type TxOp as eK, TxVault as eL, USER_ENVELOPE_COLLECTION as eM, USER_ENVELOPE_MAX_BYTES as eN, type Unsubscribe as eO, type UpdateAuthenticatorOptions as eP, type UpdateContext as eQ, type UpdateUserOptions as eR, UserApi as eS, type UserEnvelopeCheckGate as eT, UserEnvelopeOversizedError as eU, type UserEnvelopePresented as eV, type UserInfo as eW, type VaultBackup as eX, VaultGroup as eY, type VaultGroupOptions as eZ, type VaultPolicyOnDisk as e_, type ShamirRecoveryDoc as ea, type ShamirRecoveryEntry as eb, ShardedCollection as ec, ShardedGroupedQuery as ed, ShardedQuery as ee, type ShardingConfig as ef, type SkippedVault as eg, type SlotRewrapCeremony as eh, type SlotRewrapContext as ei, type StandardSchemaV1 as ej, type StandardSchemaV1Issue as ek, type StandardSchemaV1SyncResult as el, StateManagementVault as em, type StoreAuth as en, type StoreAuthKind as eo, type StoreCapabilities as ep, type StoreTime as eq, SyncEngine as er, type SyncMetadata as es, type SyncPolicy as et, SyncScheduler as eu, type SyncSchedulerStatus as ev, type SyncStatus as ew, type SyncTarget as ex, type SyncTargetRole as ey, SyncTransaction as ez, dictCollectionName as f, unwrapMagicLinkGrant as f$, type VaultSchemaSnapshot as f0, type VaultSnapshot as f1, type VaultTemplate as f2, type WarningRules as f3, WeakPassphraseError as f4, type WeakPassphraseReason as f5, type WithArchiveOptions as f6, type WrappedDeksBlob as f7, type WriteConflict as f8, type WriteEvent as f9, listUsers as fA, listUsersWithEnvelopes as fB, loadActiveDelegations as fC, loadPaperRecoveryEntries as fD, loadSealedPassphrase as fE, loadShamirRecoveryEntries as fF, magicLinkGrantRecordId as fG, mintPaperRecoveryEntry as fH, mintShamirRecoveryEntry as fI, mintWrappedDeksBlob as fJ, parseRsaOaepTlv as fK, parseSealedEnvelope as fL, readMagicLinkGrantRecord as fM, recoverUser as fN, removeAuthenticator as fO, resolveSchema as fP, resolveSequenceKey as fQ, revokeDelegation as fR, revokeMagicLinkGrant as fS, runTransaction as fT, savePaperRecoveryEntries as fU, saveSealedPassphrase as fV, saveShamirRecoveryEntries as fW, sealRsaOaepTlv as fX, unwrapDeksFromBlob as fY, unwrapDeksFromPaperEntry as fZ, unwrapDeksFromShamirEntry as f_, type WriteHook as fa, type WriteQueue as fb, aesGcmOpen as fc, assertStrongPassphrase as fd, buildRecipientKeyringFile as fe, burnPaperRecoveryEntry as ff, compileSequenceFormat as fg, createNoydb as fh, createStore as fi, deriveMagicLinkContentKey as fj, enrollAuthenticator as fk, estimateEntropy as fl, evalComputedFields as fm, evaluateExportCapability as fn, evaluateImportCapability as fo, findAuthenticator as fp, hasExportCapability as fq, hasImportCapability as fr, hasRecoveryEnrolled as fs, isLinkCollectionName as ft, isMagicLinkGrantExpired as fu, isPublicEnvelope as fv, issueDelegation as fw, recoverPassphrase as fx, rotatePassphrase as fy, listMagicLinkGrants as fz, dictKey as g, validatePassphrase as g0, validatePublicEnvelopeInput as g1, validateSchemaInput as g2, validateSchemaOutput as g3, withArchive as g4, withDeferredNumbering as g5, writeMagicLinkGrant as g6, changeSecret as g7, createOwnerKeyring as g8, ensureCollectionDEK as g9, grant as ga, loadKeyring as gb, persistKeyring as gc, revoke as gd, updateAuthenticator as ge, updateKeyringIdentity as gf, type TxStrategy as gg, type AmendmentTxOptions as gh, enforceScript as h, inferScripts as i, isDictCollectionName as j, isDictKeyDescriptor as k, isStaticDictDescriptor as l, type SessionStrategy as m, createEnforcer as n, BLOB_CHUNKS_COLLECTION as o, BLOB_COLLECTION as p, BLOB_EVICTION_AUDIT_COLLECTION as q, BLOB_INDEX_COLLECTION as r, staticDict as s, BLOB_SLOTS_PREFIX as t, BLOB_VERSIONS_PREFIX as u, validateSessionPolicy as v, type BlobEvictionEntry as w, type BlobFieldPolicy as x, type BlobFieldsConfig as y, type BlobObject as z };
+export { type VersionRecord as $, type BlobPutOptions as A, type BlobStrategy as B, type BlobResponseOptions as C, DICT_COLLECTION_PREFIX as D, BlobSet as E, type BlobStrategyOpenArgs as F, type CompactRunOptions as G, type CompactionContext as H, type I18nStrategy as I, type CompactionResult as J, DEFAULT_CHUNK_SIZE as K, EXPORT_AUDIT_COLLECTION as L, ExportBlobsAbortedError as M, type ExportBlobsAuditEntry as N, type ExportBlobsHandle as O, PolicyEnforcer as P, type ExportBlobsOptions as Q, type ExportedBlob as R, type ScriptWarning as S, type ObjectListEntry as T, type ObjectMeta as U, type ObjectProjection as V, type ObjectUrlOptions as W, type PutObjectOptions as X, type PutUrlOptions as Y, type SlotInfo as Z, type SlotRecord as _, type DictEntry as a, type ChangeType as a$, createExportBlobsHandle as a0, memoryObjectProjection as a1, runCompaction as a2, type ConsentStrategy as a3, CONSENT_AUDIT_COLLECTION as a4, type ConsentAuditEntry as a5, type ConsentAuditFilter as a6, type ConsentContext as a7, type ConsentOp as a8, loadConsentEntries as a9, type SnapshotMeta as aA, type SnapshotMode as aB, type DerivationStrategy as aC, type DerivationContext as aD, type ArrayOutputSpec as aE, DerivationRegistry as aF, type DerivationStrategyHandle as aG, type DerivedFromMeta as aH, type OutputSpec as aI, type RecordOutputSpec as aJ, type MaterializedViewStrategy as aK, type MaterializedViewStrategyHandle as aL, type OverlayedViewStrategy as aM, Collection as aN, type OverlayFieldMergeMode as aO, type OverlayFieldMergeRule as aP, OverlayedViewRegistry as aQ, type OverlayedViewStrategyHandle as aR, type SyncStrategy as aS, type Role as aT, type UnlockedKeyring as aU, type HistoryStrategy as aV, type NoydbStore as aW, type HistoryOptions as aX, type EncryptedEnvelope as aY, type PruneOptions as aZ, type AppendInput as a_, writeConsentEntry as aa, type PeriodsStrategy as ab, type CarryForwardContext as ac, type ClosePeriodOptions as ad, type OpenPeriodOptions as ae, PERIODS_COLLECTION as af, type PeriodRecord as ag, type ReadOnlyCollection as ah, appendPeriodLedgerEntry as ai, assertTsWritable as aj, chainAnchor as ak, loadPeriods as al, validatePeriodName as am, type GuardStrategy as an, type GuardChange as ao, type GuardContext as ap, GuardRegistry as aq, type GuardStrategyHandle as ar, ReadOnlyVaultFacade as as, type ShadowStrategy as at, CollectionFrame as au, VaultFrame as av, type NoydbBundleStore as aw, type RetentionPolicy as ax, type SnapshotPolicy as ay, type SnapshotStrategy as az, type DictKeyDescriptor as b, CrossVaultAggregation as b$, CollectionInstant as b0, type DiffEntry as b1, type JsonPatch as b2, type JsonPatchOp as b3, LedgerStore as b4, type VaultEngine as b5, VaultInstant as b6, type VerifyResult as b7, applyPatch as b8, computePatch as b9, type PersistedSchemaEnvelope as bA, type UpdateDecision as bB, type DirectoryConfig as bC, type UserVisibility as bD, type AccessibleVault as bE, type AffectedDocument as bF, type ArchivePolicy as bG, type ArchiveResult as bH, type ArchiveRunOptions as bI, type ArchiveStrategy as bJ, BUNDLE_STORE_POLICY as bK, type BuiltInGateName as bL, type CacheOptions as bM, type CacheStats as bN, type CapturedBlueprint as bO, type ChangeEvent as bP, type CollectionChangeEvent as bQ, type CollectionConflictResolver as bR, type CollectionDescriptor as bS, type CollectionStats as bT, ComputedFieldError as bU, type ComputedFields as bV, type ComputedFn as bW, type Conflict as bX, type ConflictPolicy as bY, type ConflictStrategy as bZ, type CrossTierAccessEvent as b_, diff as ba, formatDiff as bb, type PublicEnvelope as bc, type SealingKeyProvider as bd, type BundleRecipient as be, type RecipientSealer as bf, type RecipientHint as bg, Vault as bh, type RecoveryEnrollmentInput as bi, type ShamirRecoveryProvider as bj, TxContext as bk, type MVQueryContext as bl, type RegisteredMV as bm, MaterializedViewRegistry as bn, type MaterializedFromMeta as bo, type MaterializedViewOutput as bp, type UnionArmJoin as bq, type UnionSource as br, type UserEnvelope as bs, type GateName as bt, type GatePolicy as bu, type VaultPolicy as bv, type ActiveTier as bw, type FactorProof as bx, type SchemaUpdateStrategy as by, type TransformFn as bz, DictionaryHandle as c, type ListUsersOptions as c$, type CrossVaultDerivationContext as c0, type CrossVaultDerivationSpec as c1, CrossVaultGroupedAggregation as c2, type GroupedRow as c3, type CrossVaultLiveAggregation as c4, type CrossVaultLiveQuery as c5, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as c6, DELEGATIONS_COLLECTION as c7, type DeepPartial as c8, type DeepPartialOrNull as c9, type FieldDescriptor as cA, type FieldSource as cB, type FleetMigrationResult as cC, type FormattedSequenceHandle as cD, type GhostRecord as cE, type GrantOptions as cF, type GuardViolation as cG, type HistoryConfig as cH, type HistoryEntry as cI, INDEXED_STORE_POLICY as cJ, type ImportCapability as cK, type InferOutput as cL, type InternalCollectionStats as cM, type IssueDelegationOptions as cN, type IssueMagicLinkGrantOptions as cO, type KeyringAuthenticator as cP, type KeyringAuthenticatorWrappingDEKs as cQ, type KeyringAuthenticatorWrappingKEK as cR, type KeyringFile as cS, LinkEndpointError as cT, LinkIntegrityError as cU, type LinkOnDelete as cV, type LinkRow as cW, type LinkSetHandle as cX, type LinkSpec as cY, type ListAccessibleVaultsOptions as cZ, type ListPageResult as c_, type DeferredNumberingConfig as ca, type DelegationToken as cb, type DeleteManyResult as cc, type DeploymentEvent as cd, type DerivationDescriptor as ce, type DirtyEntry as cf, type DryRunResult as cg, type DumpSchemaOptions as ch, ELEVATION_AUDIT_COLLECTION as ci, ElevatedHandle as cj, type EnrollAuthenticatorOptions as ck, type EnrollAuthenticatorWrappingDEKsOptions as cl, type EnrollAuthenticatorWrappingKEKOptions as cm, type EnrollRecoveryResult as cn, type ExportCapability as co, type ExportChunk as cp, type ExportFormat as cq, type ExportStreamOptions as cr, type FactorKind as cs, type FactorProofBundle as ct, type FactorRequirement as cu, type FanoutQueryOptions as cv, type FanoutResult as cw, type FenceDoc as cx, type FenceState as cy, type FieldChange as cz, type DictionaryOptions as d, type RevokeOptions as d$, type LiveQueryOptions as d0, type LiveUserEnvelope as d1, type LocaleReadOptions as d2, Lru as d3, type LruOptions as d4, type LruStats as d5, MAGIC_LINK_CONTENT_INFO_PREFIX as d6, MAGIC_LINK_GRANTS_COLLECTION as d7, MAGIC_LINK_KEK_INFO_PREFIX as d8, type MagicLinkGrantPayload as d9, PresenceHandle as dA, type PresencePeer as dB, type PublicEnvelopeField as dC, type PublicEnvelopeSchema as dD, type PublicEnvelopeText as dE, type PullMode as dF, type PullOptions as dG, type PullPolicy as dH, type PullResult as dI, type PushMode as dJ, type PushOptions as dK, type PushPolicy as dL, type PushResult as dM, type PutManyItemOptions as dN, type PutManyOptions as dO, type PutManyResult as dP, type QueryAcrossOptions as dQ, type QueryAcrossResult as dR, type QuickUnlockState as dS, QuickUnlockStore as dT, type ReAuthOperation as dU, type RecoverPassphraseInput as dV, type RecoverPassphraseResult as dW, type RecoverUserOptions as dX, type RecoveryProof as dY, type RefreshInsightsResult as dZ, type ResolvedPublicEnvelopeSchema as d_, type MagicLinkGrantRecord as da, type MaterializedViewDescriptor as db, MemoryRecipientSealer as dc, MemorySealingKeyProvider as dd, type MigrationStatusRow as de, NOYDB_BACKUP_VERSION as df, NOYDB_FORMAT_VERSION as dg, NOYDB_KEYRING_VERSION as dh, NOYDB_SYNC_VERSION as di, type NextOptions as dj, Noydb as dk, type NoydbEventMap as dl, type NoydbOptions as dm, type Assignment as dn, type OverlayViewDescriptor as dp, PUBLIC_ENVELOPE_FIELDS as dq, type PaperRecoveryDoc as dr, type PaperRecoveryEntry as ds, type PassphrasePolicy as dt, type PassphraseValidationResult as du, type Permission as dv, type Permissions as dw, type PersistedSchemaKind as dx, type PlaintextTranslatorContext as dy, type PlaintextTranslatorFn as dz, type StaticDictDescriptor as e, UserEnvelopeOversizedError as e$, type RotatePassphraseInput as e0, type RotateRecoveryOptions as e1, type RotateRecoveryResult as e2, SEALED_PASSPHRASE_RECORD_ID as e3, type SchemaDelta as e4, type SchemaIntrospection as e5, type SchemaManifestRow as e6, type SealedEnvelope as e7, type SealedPassphrase as e8, type SearchEntry as e9, type SyncPolicy as eA, SyncScheduler as eB, type SyncSchedulerStatus as eC, type SyncStatus as eD, type SyncTarget as eE, type SyncTargetRole as eF, SyncTransaction as eG, type SyncTransactionResult as eH, type TabChannel as eI, type TabCoordinationOptions as eJ, type TabLockManager as eK, type TabPresence as eL, type TabRole as eM, type TierMode as eN, type TransactionInvariant as eO, type TranslatorAuditEntry as eP, TxCollection as eQ, type TxOp as eR, TxVault as eS, USER_ENVELOPE_COLLECTION as eT, USER_ENVELOPE_MAX_BYTES as eU, type Unsubscribe as eV, type UpdateAuthenticatorOptions as eW, type UpdateContext as eX, type UpdateUserOptions as eY, UserApi as eZ, type UserEnvelopeCheckGate as e_, type SearchOptions as ea, type SearchResult as eb, type SequenceHandle as ec, type SequenceOptions as ed, SequenceStore as ee, type SessionPolicy as ef, type SetPublicEnvelopeInput as eg, type ShamirRecoveryDoc as eh, type ShamirRecoveryEntry as ei, ShardedCollection as ej, ShardedGroupedQuery as ek, ShardedQuery as el, type ShardingConfig as em, type SkippedVault as en, type SlotRewrapCeremony as eo, type SlotRewrapContext as ep, type StandardSchemaV1 as eq, type StandardSchemaV1Issue as er, type StandardSchemaV1SyncResult as es, StateManagementVault as et, type StoreAuth as eu, type StoreAuthKind as ev, type StoreCapabilities as ew, type StoreTime as ex, SyncEngine as ey, type SyncMetadata as ez, dictCollectionName as f, savePaperRecoveryEntries as f$, type UserEnvelopePresented as f0, type UserInfo as f1, type VaultBackup as f2, VaultGroup as f3, type VaultGroupOptions as f4, type VaultPolicyOnDisk as f5, type VaultRegistryRow as f6, type VaultSchemaSnapshot as f7, type VaultSnapshot as f8, type VaultTemplate as f9, isLinkCollectionName as fA, isMagicLinkGrantExpired as fB, isPublicEnvelope as fC, issueDelegation as fD, recoverPassphrase as fE, rotatePassphrase as fF, listMagicLinkGrants as fG, listUsers as fH, listUsersWithEnvelopes as fI, loadActiveDelegations as fJ, loadPaperRecoveryEntries as fK, loadSealedPassphrase as fL, loadShamirRecoveryEntries as fM, magicLinkGrantRecordId as fN, mintPaperRecoveryEntry as fO, mintShamirRecoveryEntry as fP, mintWrappedDeksBlob as fQ, parseRsaOaepTlv as fR, parseSealedEnvelope as fS, readMagicLinkGrantRecord as fT, recoverUser as fU, removeAuthenticator as fV, resolveSchema as fW, resolveSequenceKey as fX, revokeDelegation as fY, revokeMagicLinkGrant as fZ, runTransaction as f_, type WarningRules as fa, WeakPassphraseError as fb, type WeakPassphraseReason as fc, type WithArchiveOptions as fd, type WrappedDeksBlob as fe, type WriteConflict as ff, type WriteEvent as fg, type WriteHook as fh, type WriteQueue as fi, aesGcmOpen as fj, assertStrongPassphrase as fk, buildRecipientKeyringFile as fl, burnPaperRecoveryEntry as fm, compileSequenceFormat as fn, createNoydb as fo, createStore as fp, deriveMagicLinkContentKey as fq, enrollAuthenticator as fr, estimateEntropy as fs, evalComputedFields as ft, evaluateExportCapability as fu, evaluateImportCapability as fv, findAuthenticator as fw, hasExportCapability as fx, hasImportCapability as fy, hasRecoveryEnrolled as fz, dictKey as g, saveSealedPassphrase as g0, saveShamirRecoveryEntries as g1, sealRsaOaepTlv as g2, unwrapDeksFromBlob as g3, unwrapDeksFromPaperEntry as g4, unwrapDeksFromShamirEntry as g5, unwrapMagicLinkGrant as g6, validatePassphrase as g7, validatePublicEnvelopeInput as g8, validateSchemaInput as g9, validateSchemaOutput as ga, withArchive as gb, withDeferredNumbering as gc, writeMagicLinkGrant as gd, changeSecret as ge, createOwnerKeyring as gf, ensureCollectionDEK as gg, grant as gh, loadKeyring as gi, persistKeyring as gj, revoke as gk, updateAuthenticator as gl, updateKeyringIdentity as gm, type TxStrategy as gn, type AmendmentTxOptions as go, enforceScript as h, inferScripts as i, isDictCollectionName as j, isDictKeyDescriptor as k, isStaticDictDescriptor as l, type SessionStrategy as m, createEnforcer as n, BLOB_CHUNKS_COLLECTION as o, BLOB_COLLECTION as p, BLOB_EVICTION_AUDIT_COLLECTION as q, BLOB_INDEX_COLLECTION as r, staticDict as s, BLOB_SLOTS_PREFIX as t, BLOB_VERSIONS_PREFIX as u, validateSessionPolicy as v, type BlobEvictionEntry as w, type BlobFieldPolicy as x, type BlobFieldsConfig as y, type BlobObject as z };