@noy-db/hub 0.2.0-pre.2 → 0.2.0-pre.20

package/dist/index.d.ts

@@ -1,21 +1,26 @@
-import { aO as NoydbStore, bo as UserEnvelope, ba as PublicEnvelope, bp as GateName, bq as GatePolicy, br as VaultPolicy, bs as ActiveTier, bt as FactorProof, bu as PersistedSchemaEnvelope, bv as DirectoryConfig, bw as UserVisibility, aM as UnlockedKeyring, bf as Vault, aV as DiffEntry } from './types-BoFFiskX.js';
-export { bx as AccessibleVault, aS as AppendInput, ay as ArrayOutputSpec, p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, by as BUNDLE_STORE_POLICY, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, bz as BuiltInGateName, bc as BundleRecipient, _ as CONSENT_AUDIT_COLLECTION, bA as CacheOptions, bB as CacheStats, bC as ChangeEvent, aT as ChangeType, a7 as ClosePeriodOptions, aH as Collection, bD as CollectionChangeEvent, bE as CollectionConflictResolver, bF as CollectionDescriptor, ao as CollectionFrame, aU as CollectionInstant, bG as CollectionStats, bH as Conflict, bI as ConflictPolicy, bJ as ConflictStrategy, $ as ConsentAuditEntry, a0 as ConsentAuditFilter, a1 as ConsentContext, a2 as ConsentOp, bK as CrossTierAccessEvent, L as DEFAULT_CHUNK_SIZE, bL as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, bM as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, bN as DeepPartial, bO as DeepPartialOrNull, bP as DelegationToken, bQ as DeleteManyResult, bR as DerivationDescriptor, aw as DerivationStrategy, aA as DerivationStrategyHandle, aB as DerivedFromMeta, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, bS as DirtyEntry, bT as DumpSchemaOptions, bU as ELEVATION_AUDIT_COLLECTION, bV as ElevatedHandle, aQ as EncryptedEnvelope, bW as EnrollAuthenticatorOptions, bX as EnrollAuthenticatorWrappingDEKsOptions, bY as EnrollAuthenticatorWrappingKEKOptions, bZ as EnrollRecoveryResult, b_ as ExportCapability, b$ as ExportChunk, c0 as ExportFormat, c1 as ExportStreamOptions, c2 as FactorKind, c3 as FactorProofBundle, c4 as FactorRequirement, c5 as FieldDescriptor, c6 as FieldSource, c7 as GhostRecord, c8 as GrantOptions, ai as GuardChange, aj as GuardContext, ah as GuardStrategy, al as GuardStrategyHandle, c9 as HistoryConfig, ca as HistoryEntry, aP as HistoryOptions, e as I18nTextDescriptor, f as I18nTextOptions, cb as INDEXED_STORE_POLICY, cc as ImportCapability, cd as InferOutput, ce as InternalCollectionStats, cf as IssueDelegationOptions, cg as IssueMagicLinkGrantOptions, aW as JsonPatch, aX as JsonPatchOp, ch as KeyringAuthenticator, ci as KeyringAuthenticatorWrappingDEKs, cj as KeyringAuthenticatorWrappingKEK, ck as KeyringFile, aY as LedgerEntry, aZ as LedgerStore, cl as ListAccessibleVaultsOptions, cm as ListPageResult, cn as ListUsersOptions, co as LiveUserEnvelope, cp as LocaleReadOptions, cq as Lru, cr as LruOptions, cs as LruStats, ct as MAGIC_LINK_CONTENT_INFO_PREFIX, cu as MAGIC_LINK_GRANTS_COLLECTION, cv as MAGIC_LINK_KEK_INFO_PREFIX, cw as MagicLinkGrantPayload, cx as MagicLinkGrantRecord, bl as MaterializedFromMeta, cy as MaterializedViewDescriptor, bm as MaterializedViewOutput, aE as MaterializedViewStrategy, aF as MaterializedViewStrategyHandle, cz as MemoryRecipientSealer, cA as MemorySealingKeyProvider, cB as NOYDB_BACKUP_VERSION, cC as NOYDB_FORMAT_VERSION, cD as NOYDB_KEYRING_VERSION, cE as NOYDB_SYNC_VERSION, cF as Noydb, cG as NoydbBundleStore, cH as NoydbEventMap, cI as NoydbOptions, a8 as OpenPeriodOptions, aC as OutputSpec, cJ as OverlayViewDescriptor, aG as OverlayedViewStrategy, aJ as OverlayedViewStrategyHandle, a9 as PERIODS_COLLECTION, cK as PUBLIC_ENVELOPE_FIELDS, cL as PaperRecoveryDoc, cM as PaperRecoveryEntry, cN as PassphrasePolicy, cO as PassphraseValidationResult, aa as PeriodRecord, cP as Permission, cQ as Permissions, cR as PersistedSchemaKind, cS as PlaintextTranslatorContext, cT as PlaintextTranslatorFn, P as PolicyEnforcer, cU as PresenceHandle, cV as PresencePeer, aR as PruneOptions, cW as PublicEnvelopeField, cX as PublicEnvelopeSchema, cY as PublicEnvelopeText, cZ as PullMode, c_ as PullOptions, c$ as PullPolicy, d0 as PullResult, d1 as PushMode, d2 as PushOptions, d3 as PushPolicy, d4 as PushResult, d5 as PutManyItemOptions, d6 as PutManyOptions, d7 as PutManyResult, d8 as QueryAcrossOptions, d9 as QueryAcrossResult, da as QuickUnlockState, db as QuickUnlockStore, dc as ReAuthOperation, be as RecipientHint, bd as RecipientSealer, aD as RecordOutputSpec, dd as RecoverPassphraseInput, de as RecoverPassphraseResult, df as RecoverUserOptions, dg as RecoveryProof, dh as ResolvedPublicEnvelopeSchema, di as RevokeOptions, aL as Role, dj as RotatePassphraseInput, dk as RotateRecoveryOptions, dl as RotateRecoveryResult, dm as SEALED_PASSPHRASE_RECORD_ID, dn as SealedEnvelope, dp as SealedPassphrase, bb as SealingKeyProvider, dq as SessionPolicy, dr as SetPublicEnvelopeInput, ds as ShamirRecoveryDoc, dt as ShamirRecoveryEntry, bh as ShamirRecoveryProvider, U as SlotInfo, V as SlotRecord, du as SlotRewrapCeremony, dv as SlotRewrapContext, dw as StandardSchemaV1, dx as StandardSchemaV1Issue, dy as StandardSchemaV1SyncResult, dz as StoreAuth, dA as StoreAuthKind, dB as StoreCapabilities, dC as SyncEngine, dD as SyncMetadata, dE as SyncPolicy, dF as SyncScheduler, dG as SyncSchedulerStatus, dH as SyncStatus, dI as SyncTarget, dJ as SyncTargetRole, dK as SyncTransaction, dL as SyncTransactionResult, dM as TierMode, dN as TranslatorAuditEntry, as as TxCollection, at as TxContext, dO as TxOp, au as TxVault, dP as USER_ENVELOPE_COLLECTION, dQ as USER_ENVELOPE_MAX_BYTES, bn as UnionSource, dR as Unsubscribe, dS as UpdateAuthenticatorOptions, dT as UpdateUserOptions, dU as UserApi, dV as UserEnvelopeCheckGate, dW as UserEnvelopeOversizedError, dX as UserEnvelopePresented, dY as UserInfo, dZ as VaultBackup, a_ as VaultEngine, ap as VaultFrame, a$ as VaultInstant, d_ as VaultPolicyOnDisk, d$ as VaultSchemaSnapshot, e0 as VaultSnapshot, b0 as VerifyResult, W as VersionRecord, e1 as WarningRules, e2 as WeakPassphraseError, e3 as WeakPassphraseReason, e4 as WrappedDeksBlob, g as applyI18nLocale, b1 as applyPatch, e5 as assertStrongPassphrase, e6 as buildRecipientKeyringFile, e7 as burnPaperRecoveryEntry, b2 as canonicalJson, b3 as computePatch, n as createEnforcer, e8 as createNoydb, e9 as createStore, ea as deriveMagicLinkContentKey, h as dictCollectionName, i as dictKey, b4 as diff, eb as enrollAuthenticator, ec as estimateEntropy, ed as evaluateExportCapability, ee as evaluateImportCapability, ef as findAuthenticator, b5 as formatDiff, eg as hasExportCapability, eh as hasImportCapability, ei as hasRecoveryEnrolled, b6 as hashEntry, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, ej as isMagicLinkGrantExpired, ek as isPublicEnvelope, el as issueDelegation, em as keyringRecoverPassphrase, en as keyringRotatePassphrase, eo as listMagicLinkGrants, ep as listUsers, eq as listUsersWithEnvelopes, er as loadActiveDelegations, es as loadPaperRecoveryEntries, et as loadSealedPassphrase, eu as loadShamirRecoveryEntries, ev as magicLinkGrantRecordId, ew as mintPaperRecoveryEntry, ex as mintShamirRecoveryEntry, ey as mintWrappedDeksBlob, b7 as paddedIndex, b8 as parseIndex, ez as parseSealedEnvelope, eA as readMagicLinkGrantRecord, eB as recoverUser, eC as removeAuthenticator, r as resolveI18nText, eD as resolvePublicEnvelopeSchema, eE as revokeDelegation, eF as revokeMagicLinkGrant, av as runTransaction, eG as savePaperRecoveryEntries, eH as saveSealedPassphrase, eI as saveShamirRecoveryEntries, b9 as sha256Hex, eJ as unwrapDeksFromBlob, eK as unwrapDeksFromPaperEntry, eL as unwrapDeksFromShamirEntry, eM as unwrapMagicLinkGrant, v as validateI18nTextValue, eN as validatePassphrase, eO as validatePublicEnvelopeInput, eP as validateSchemaInput, eQ as validateSchemaOutput, o as validateSessionPolicy, eR as writeMagicLinkGrant } from './types-BoFFiskX.js';
-export { d as detectMagic, a as detectMimeType, i as isPreCompressed } from './mime-magic-CBBSOkjm.js';
+import { aW as NoydbStore, bs as UserEnvelope, bc as PublicEnvelope, bt as GateName, bu as GatePolicy, bv as VaultPolicy, bw as ActiveTier, bx as FactorProof, aY as EncryptedEnvelope, by as SchemaUpdateStrategy, bz as TransformFn, bA as PersistedSchemaEnvelope, bB as UpdateDecision, bC as DirectoryConfig, bD as UserVisibility, aU as UnlockedKeyring, bh as Vault, b1 as DiffEntry } from './types-DLfWFr6U.js';
+export { bE as AccessibleVault, bF as AffectedDocument, a_ as AppendInput, bG as ArchivePolicy, bH as ArchiveResult, bI as ArchiveRunOptions, bJ as ArchiveStrategy, aE as ArrayOutputSpec, o as BLOB_CHUNKS_COLLECTION, p as BLOB_COLLECTION, r as BLOB_INDEX_COLLECTION, t as BLOB_SLOTS_PREFIX, u as BLOB_VERSIONS_PREFIX, bK as BUNDLE_STORE_POLICY, z as BlobObject, A as BlobPutOptions, C as BlobResponseOptions, E as BlobSet, bL as BuiltInGateName, be as BundleRecipient, a4 as CONSENT_AUDIT_COLLECTION, bM as CacheOptions, bN as CacheStats, bO as CapturedBlueprint, bP as ChangeEvent, a$ as ChangeType, ad as ClosePeriodOptions, aN as Collection, bQ as CollectionChangeEvent, bR as CollectionConflictResolver, bS as CollectionDescriptor, au as CollectionFrame, b0 as CollectionInstant, bT as CollectionStats, bU as ComputedFieldError, bV as ComputedFields, bW as ComputedFn, bX as Conflict, bY as ConflictPolicy, bZ as ConflictStrategy, a5 as ConsentAuditEntry, a6 as ConsentAuditFilter, a7 as ConsentContext, a8 as ConsentOp, b_ as CrossTierAccessEvent, b$ as CrossVaultAggregation, c0 as CrossVaultDerivationContext, c1 as CrossVaultDerivationSpec, c2 as CrossVaultGroupedAggregation, c3 as CrossVaultGroupedRow, c4 as CrossVaultLiveAggregation, c5 as CrossVaultLiveQuery, K as DEFAULT_CHUNK_SIZE, c6 as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, c7 as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, c8 as DeepPartial, c9 as DeepPartialOrNull, ca as DeferredNumberingConfig, cb as DelegationToken, cc as DeleteManyResult, cd as DeploymentEvent, ce as DerivationDescriptor, aC as DerivationStrategy, aG as DerivationStrategyHandle, aH as DerivedFromMeta, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, cf as DirtyEntry, cg as DryRunResult, ch as DumpSchemaOptions, ci as ELEVATION_AUDIT_COLLECTION, cj as ElevatedHandle, ck as EnrollAuthenticatorOptions, cl as EnrollAuthenticatorWrappingDEKsOptions, cm as EnrollAuthenticatorWrappingKEKOptions, cn as EnrollRecoveryResult, co as ExportCapability, cp as ExportChunk, cq as ExportFormat, cr as ExportStreamOptions, cs as FactorKind, ct as FactorProofBundle, cu as FactorRequirement, cv as FanoutQueryOptions, cw as FanoutResult, cx as FenceDoc, cy as FenceState, cz as FieldChange, cA as FieldDescriptor, cB as FieldSource, cC as FleetMigrationResult, cD as FormattedSequenceHandle, cE as GhostRecord, cF as GrantOptions, ao as GuardChange, ap as GuardContext, an as GuardStrategy, ar as GuardStrategyHandle, cG as GuardViolation, cH as HistoryConfig, cI as HistoryEntry, aX as HistoryOptions, cJ as INDEXED_STORE_POLICY, cK as ImportCapability, cL as InferOutput, cM as InternalCollectionStats, cN as IssueDelegationOptions, cO as IssueMagicLinkGrantOptions, b2 as JsonPatch, b3 as JsonPatchOp, cP as KeyringAuthenticator, cQ as KeyringAuthenticatorWrappingDEKs, cR as KeyringAuthenticatorWrappingKEK, cS as KeyringFile, b4 as LedgerStore, cT as LinkEndpointError, cU as LinkIntegrityError, cV as LinkOnDelete, cW as LinkRow, cX as LinkSetHandle, cY as LinkSpec, cZ as ListAccessibleVaultsOptions, c_ as ListPageResult, c$ as ListUsersOptions, d0 as LiveQueryOptions, d1 as LiveUserEnvelope, d2 as LocaleReadOptions, d3 as Lru, d4 as LruOptions, d5 as LruStats, d6 as MAGIC_LINK_CONTENT_INFO_PREFIX, d7 as MAGIC_LINK_GRANTS_COLLECTION, d8 as MAGIC_LINK_KEK_INFO_PREFIX, d9 as MagicLinkGrantPayload, da as MagicLinkGrantRecord, bo as MaterializedFromMeta, db as MaterializedViewDescriptor, bp as MaterializedViewOutput, aK as MaterializedViewStrategy, aL as MaterializedViewStrategyHandle, dc as MemoryRecipientSealer, dd as MemorySealingKeyProvider, de as MigrationStatusRow, df as NOYDB_BACKUP_VERSION, dg as NOYDB_FORMAT_VERSION, dh as NOYDB_KEYRING_VERSION, di as NOYDB_SYNC_VERSION, dj as NextOptions, dk as Noydb, aw as NoydbBundleStore, dl as NoydbEventMap, dm as NoydbOptions, dn as NumberingAssignment, T as ObjectListEntry, U as ObjectMeta, V as ObjectProjection, W as ObjectUrlOptions, ae as OpenPeriodOptions, aI as OutputSpec, aO as OverlayFieldMergeMode, aP as OverlayFieldMergeRule, dp as OverlayViewDescriptor, aM as OverlayedViewStrategy, aR as OverlayedViewStrategyHandle, af as PERIODS_COLLECTION, dq as PUBLIC_ENVELOPE_FIELDS, dr as PaperRecoveryDoc, ds as PaperRecoveryEntry, dt as PassphrasePolicy, du as PassphraseValidationResult, ag as PeriodRecord, dv as Permission, dw as Permissions, dx as PersistedSchemaKind, dy as PlaintextTranslatorContext, dz as PlaintextTranslatorFn, P as PolicyEnforcer, dA as PresenceHandle, dB as PresencePeer, aZ as PruneOptions, dC as PublicEnvelopeField, dD as PublicEnvelopeSchema, dE as PublicEnvelopeText, dF as PullMode, dG as PullOptions, dH as PullPolicy, dI as PullResult, dJ as PushMode, dK as PushOptions, dL as PushPolicy, dM as PushResult, dN as PutManyItemOptions, dO as PutManyOptions, dP as PutManyResult, X as PutObjectOptions, Y as PutUrlOptions, dQ as QueryAcrossOptions, dR as QueryAcrossResult, dS as QuickUnlockState, dT as QuickUnlockStore, dU as ReAuthOperation, bg as RecipientHint, bf as RecipientSealer, aJ as RecordOutputSpec, dV as RecoverPassphraseInput, dW as RecoverPassphraseResult, dX as RecoverUserOptions, dY as RecoveryProof, dZ as RefreshInsightsResult, d_ as ResolvedPublicEnvelopeSchema, ax as RetentionPolicy, d$ as RevokeOptions, aT as Role, e0 as RotatePassphraseInput, e1 as RotateRecoveryOptions, e2 as RotateRecoveryResult, e3 as SEALED_PASSPHRASE_RECORD_ID, e4 as SchemaDelta, e5 as SchemaIntrospection, e6 as SchemaManifestRow, S as ScriptWarning, e7 as SealedEnvelope, e8 as SealedPassphrase, bd as SealingKeyProvider, e9 as SearchEntry, ea as SearchOptions, eb as SearchResult, ec as SequenceHandle, ed as SequenceOptions, ee as SequenceStore, ef as SessionPolicy, eg as SetPublicEnvelopeInput, eh as ShamirRecoveryDoc, ei as ShamirRecoveryEntry, bj as ShamirRecoveryProvider, ej as ShardedCollection, ek as ShardedGroupedQuery, el as ShardedQuery, em as ShardingConfig, en as SkippedVault, Z as SlotInfo, _ as SlotRecord, eo as SlotRewrapCeremony, ep as SlotRewrapContext, aA as SnapshotMeta, eq as StandardSchemaV1, er as StandardSchemaV1Issue, es as StandardSchemaV1SyncResult, et as StateManagementVault, e as StaticDictDescriptor, eu as StoreAuth, ev as StoreAuthKind, ew as StoreCapabilities, ex as StoreTime, ey as SyncEngine, ez as SyncMetadata, eA as SyncPolicy, eB as SyncScheduler, eC as SyncSchedulerStatus, eD as SyncStatus, eE as SyncTarget, eF as SyncTargetRole, eG as SyncTransaction, eH as SyncTransactionResult, eI as TabChannel, eJ as TabCoordinationOptions, eK as TabLockManager, eL as TabPresence, eM as TabRole, eN as TierMode, eO as TransactionInvariant, eP as TranslatorAuditEntry, eQ as TxCollection, bk as TxContext, eR as TxOp, eS as TxVault, eT as USER_ENVELOPE_COLLECTION, eU as USER_ENVELOPE_MAX_BYTES, bq as UnionArmJoin, br as UnionSource, eV as Unsubscribe, eW as UpdateAuthenticatorOptions, eX as UpdateContext, eY as UpdateUserOptions, eZ as UserApi, e_ as UserEnvelopeCheckGate, e$ as UserEnvelopeOversizedError, f0 as UserEnvelopePresented, f1 as UserInfo, f2 as VaultBackup, b5 as VaultEngine, av as VaultFrame, f3 as VaultGroup, f4 as VaultGroupOptions, b6 as VaultInstant, f5 as VaultPolicyOnDisk, f6 as VaultRegistryRow, f7 as VaultSchemaSnapshot, f8 as VaultSnapshot, f9 as VaultTemplate, b7 as VerifyResult, $ as VersionRecord, fa as WarningRules, fb as WeakPassphraseError, fc as WeakPassphraseReason, fd as WithArchiveOptions, fe as WrappedDeksBlob, ff as WriteConflict, fg as WriteEvent, fh as WriteHook, fi as WriteQueue, fj as aesGcmOpen, b8 as applyPatch, fk as assertStrongPassphrase, fl as buildRecipientKeyringFile, fm as burnPaperRecoveryEntry, fn as compileSequenceFormat, b9 as computePatch, n as createEnforcer, fo as createNoydb, fp as createStore, fq as deriveMagicLinkContentKey, f as dictCollectionName, g as dictKey, ba as diff, h as enforceScript, fr as enrollAuthenticator, fs as estimateEntropy, ft as evalComputedFields, fu as evaluateExportCapability, fv as evaluateImportCapability, fw as findAuthenticator, bb as formatDiff, fx as hasExportCapability, fy as hasImportCapability, fz as hasRecoveryEnrolled, i as inferScripts, j as isDictCollectionName, k as isDictKeyDescriptor, fA as isLinkCollectionName, fB as isMagicLinkGrantExpired, fC as isPublicEnvelope, l as isStaticDictDescriptor, fD as issueDelegation, fE as keyringRecoverPassphrase, fF as keyringRotatePassphrase, fG as listMagicLinkGrants, fH as listUsers, fI as listUsersWithEnvelopes, fJ as loadActiveDelegations, fK as loadPaperRecoveryEntries, fL as loadSealedPassphrase, fM as loadShamirRecoveryEntries, fN as magicLinkGrantRecordId, a1 as memoryObjectProjection, fO as mintPaperRecoveryEntry, fP as mintShamirRecoveryEntry, fQ as mintWrappedDeksBlob, fR as parseRsaOaepTlv, fS as parseSealedEnvelope, fT as readMagicLinkGrantRecord, fU as recoverUser, fV as removeAuthenticator, fW as resolvePublicEnvelopeSchema, fX as resolveSequenceKey, fY as revokeDelegation, fZ as revokeMagicLinkGrant, f_ as runTransaction, f$ as savePaperRecoveryEntries, g0 as saveSealedPassphrase, g1 as saveShamirRecoveryEntries, g2 as sealRsaOaepTlv, s as staticDict, g3 as unwrapDeksFromBlob, g4 as unwrapDeksFromPaperEntry, g5 as unwrapDeksFromShamirEntry, g6 as unwrapMagicLinkGrant, g7 as validatePassphrase, g8 as validatePublicEnvelopeInput, g9 as validateSchemaInput, ga as validateSchemaOutput, v as validateSessionPolicy, gb as withArchive, gc as withDeferredNumbering, gd as writeMagicLinkGrant } from './types-DLfWFr6U.js';
+export { I as ImportExternalOptions, a as ImportExternalResult, b as ImportableCollection, d as detectMagic, c as detectMimeType, i as importExternalObjects, e as isPreCompressed } from './mime-magic-CjSyakO4.js';
 export { AgeRoute, BlobLifecyclePolicy, BlobStoreRoute, CircuitBreakerOptions, HealthCheckOptions, LogLevel, LoggingOptions, MetricsOptions, OverrideOptions, OverrideTarget, RetryOptions, RouteStatus, RouteStoreOptions, RoutedNoydbStore, StoreCacheOptions, StoreMiddleware, StoreOperation, SuspendOptions, WrapBundleStoreOptions, WrappedBundleNoydbStore, createBundleStore, routeStore, withCache, withCircuitBreaker, withHealthCheck, withLogging, withMetrics, withRetry, wrapBundleStore, wrapStore } from './store/index.js';
-import { N as NoydbError } from './index-BCKdioeh.js';
-export { x as AlreadyElevatedError, A as AmendmentForbiddenError, m as AttestationError, B as BackupCorruptedError, o as BackupLedgerError, p as BundleIntegrityError, q as BundleSealMismatchError, r as BundleVersionConflictError, C as ConflictError, y as DEFAULT_JOIN_MAX_ROWS, z as DanglingReferenceError, E as DecryptionError, G as DelegationTargetMissingError, e as DerivationCapExceededError, f as DerivationCycleError, g as DerivationDepthError, h as DerivationOutputShapeError, i as DerivationOutputUnknownError, D as DictKeyInUseError, a as DictKeyMissingError, H as DirectoryDisabledError, J as ElevationExpiredError, K as ExportCapabilityError, F as FieldFrozenError, U as FilenameSanitizationError, V as GroupCardinalityError, W as ImportCapabilityError, X as IndexRequiredError, Y as IndexWriteFailureError, Z as InvalidKeyError, I as InvariantError, _ as JoinContext, $ as JoinLeg, a0 as JoinStrategy, a1 as JoinTooLargeError, a2 as JoinableSource, a3 as KeyringCorruptError, a4 as KeyringExpiredError, a5 as LedgerContentionError, a6 as LiveQuery, a7 as LiveUpstream, L as LocaleNotSpecifiedError, t as MaterializedViewConfigError, u as MaterializedViewCycleError, v as MaterializedViewSourceUnknownError, w as MaterializedViewTooLargeError, M as MissingTranslationError, a8 as NetworkError, a9 as NoAccessError, aa as NotFoundError, ab as OrderBy, O as OverlayBaseIsVirtualError, j as OverlayCollectionUnavailableError, k as OverlayIdMismatchError, l as OverlayNameCollisionError, ac as PathEscapeError, ad as PeriodClosedError, ae as PermissionDeniedError, af as PrivilegeEscalationError, Q as Query, ag as QueryPlan, ah as QuerySource, ai as ReadOnlyAtInstantError, aj as ReadOnlyError, ak as ReadOnlyFrameError, d as RecordLockedError, al as RefDescriptor, am as RefIntegrityError, an as RefMode, ao as RefRegistry, ap as RefScopeError, aq as RefViolation, R as ReservedCollectionNameError, ar as ScanBuilder, as as ScanPageProvider, at as SchemaValidationError, S as SessionExpiredError, b as SessionNotFoundError, c as SessionPolicyError, au as StoreCapabilityError, av as TamperedError, aw as TierDemoteDeniedError, ax as TierNotGrantedError, T as TranslatorNotConfiguredError, ay as ValidationError, az as applyJoins, aA as buildLiveQuery, aB as executePlan, aC as ref, aD as resetJoinWarnings } from './index-BCKdioeh.js';
-export { A as AutoCredential, n as AutoCredentialKind, c as CompressionAlgo, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, j as generateULID, o as hasNoydbBundleMagic, k as isULID, r as readNoydbBundle, l as readNoydbBundleHeader, p as readNoydbBundlePublicEnvelope, m as resetBrotliSupportCache, w as writeNoydbBundle } from './ulid-BmBgooGm.js';
+import { N as NoydbError } from './errors-Dkc_fi-S.js';
+export { H as AlreadyElevatedError, A as AmendmentForbiddenError, s as AttestationError, B as BackupCorruptedError, u as BackupLedgerError, v as BundleIntegrityError, w as BundleSealMismatchError, x as BundleVersionConflictError, J as ConflictError, K as CrossJoinSourceUnknownError, Q as CrossJoinTooLargeError, V as DanglingReferenceError, W as DataResidencyError, X as DebugPlaintextError, Y as DebugReservedFieldError, Z as DecryptionError, _ as DelegationTargetMissingError, i as DerivationCapExceededError, j as DerivationCycleError, k as DerivationDepthError, l as DerivationOutputShapeError, m as DerivationOutputUnknownError, D as DictKeyInUseError, a as DictKeyMissingError, $ as DirectoryDisabledError, a0 as ElevationExpiredError, a1 as ExportCapabilityError, F as FieldFrozenError, a2 as FilenameSanitizationError, a3 as ForgetStrategyNotConfiguredError, a4 as GroupCardinalityError, I as IllegalTransitionError, a5 as ImportCapabilityError, a6 as IndexRequiredError, a7 as IndexWriteFailureError, a8 as InvalidKeyError, f as InvariantError, a9 as JoinTooLargeError, aa as KeyringCorruptError, ab as KeyringExpiredError, ac as LedgerContentionError, L as LocaleNotSpecifiedError, z as MaterializedViewConfigError, C as MaterializedViewCycleError, E as MaterializedViewSourceUnknownError, G as MaterializedViewTooLargeError, ad as MigrationRequiredError, M as MissingTranslationError, ae as NetworkError, af as NoAccessError, ag as NonAdditiveSchemaChangeError, ah as NotFoundError, ai as NumberingUncertaintyError, O as OverlayBaseIsVirtualError, n as OverlayCollectionUnavailableError, o as OverlayIdMismatchError, p as OverlayNameCollisionError, aj as PathEscapeError, ak as PeriodClosedError, al as PermissionDeniedError, am as PrivilegeEscalationError, an as QuiesceTimeoutError, ao as ReadOnlyAtInstantError, ap as ReadOnlyError, aq as ReadOnlyFrameError, ar as RecordCekNotFoundError, g as RecordLockedError, R as ReservedCollectionNameError, as as ReservedVaultNameError, at as SchemaFenceError, au as SchemaLockedError, av as SchemaUpdateError, aw as SchemaValidationError, S as ScriptViolationError, q as SealedRecordExpiredError, r as SealedRecordMismatchError, ax as SequenceContentionError, ay as SequenceOfflineError, c as SessionExpiredError, d as SessionNotFoundError, e as SessionPolicyError, az as ShardProvisioningError, h as SnapshotNotFoundError, b as StaticDictReadonlyError, aA as StoreCapabilityError, aB as TamperedError, aC as TierDemoteDeniedError, aD as TierNotGrantedError, T as TranslatorNotConfiguredError, aE as UniqueConstraintError, U as UnknownDictCodeError, aF as UnknownShardError, aG as UnsupportedIndexOptionError, aH as ValidationError, aI as VaultTemplateNotFoundError } from './errors-Dkc_fi-S.js';
+export { D as DEFAULT_CROSS_JOIN_MAX_ROWS, a as DEFAULT_JOIN_MAX_ROWS, J as JoinContext, b as JoinLeg, c as JoinStrategy, d as JoinableSource, L as LiveQuery, e as LiveUpstream, O as OrderBy, Q as Query, f as QueryPlan, g as QuerySource, R as RefDescriptor, h as RefIntegrityError, i as RefMode, j as RefRegistry, k as RefScopeError, l as RefViolation, S as ScanBuilder, m as ScanPageProvider, n as applyJoins, o as buildLiveQuery, p as executePlan, q as isRefArray, r as ref, s as refArray, t as resetJoinWarnings } from './index-Bm9hIY7t.js';
+export { A as AutoCredential, n as AutoCredentialKind, c as CompressionAlgo, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, j as generateULID, o as hasNoydbBundleMagic, k as isULID, r as readNoydbBundle, l as readNoydbBundleHeader, p as readNoydbBundlePublicEnvelope, m as resetBrotliSupportCache, w as writeNoydbBundle } from './ulid-B2L_aqVA.js';
+export { L as LedgerEntry, c as canonicalJson, h as hashEntry, p as paddedIndex, a as parseIndex, s as sha256Hex } from './index-BMmajblo.js';
 export { a as CrdtMode, b as CrdtState, L as LwwMapState, R as RgaState, Y as YjsState, m as mergeCrdtStates, r as resolveCrdtSnapshot } from './strategy-BSxFXGzb.js';
-export { w as withGuard } from './with-guard-C25yNjzd.js';
-export { w as withDerivation } from './with-derivation-BKXXa8Vt.js';
-export { w as withMaterializedView } from './with-materialized-view-CqnRwI2S.js';
-export { a as Clause, C as CollectionIndexes, F as FieldClause, b as FilterClause, G as GroupClause, H as HashIndex, I as IndexDef, O as Operator, e as evaluateClause, c as evaluateFieldClause, r as readPath } from './predicate-Dnu81tsS.js';
-export { w as withOverlayedView } from './with-overlayed-view-Ct1fSJt-.js';
+export { TransactionStrategyOptions } from './tx/index.js';
+export { I as ImmutableGuardConfig, T as TransitionGuardConfig, i as immutableGuard, t as transitionGuard, w as withGuard } from './transition-guard-D4bfIAiW.js';
+import { K as RoundingMode } from './strategy-54eIwox5.js';
+export { h as AggregateResult, j as AggregateSpec, k as Aggregation, l as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, m as GROUPBY_WARN_CARDINALITY, n as GroupedAggregation, o as GroupedQuery, p as GroupedQueryN, q as GroupedRow, t as GroupedRowN, I as I18nMap, a as I18nTextDescriptor, b as I18nTextOptions, L as Layer, u as LiveAggregation, M as MoneyCurrencyError, N as MoneyDescriptor, P as MoneyOptions, Q as MoneyOptionsFixed, S as MoneyOptionsMulti, T as MoneyPrecisionError, U as MoneyUnsupportedError, O as OnMissing, c as OnMissingPolicy, w as Reducer, x as ReducerOptions, R as ResolveI18nOptions, d as applyI18nLocale, y as avg, B as count, C as groupAndReduce, i as i18nText, e as isI18nTextDescriptor, V as isMoneyDescriptor, D as max, E as min, W as money, F as reduceRecords, r as resolveI18nText, f as resolvePolicy, J as sum, v as validateI18nTextValue } from './strategy-54eIwox5.js';
+export { w as withDerivation, a as withRollup } from './with-rollup-DJDbrxjf.js';
+export { w as withMaterializedView } from './with-materialized-view-DNULSxoP.js';
+export { a as Clause, C as CollectionIndexes, F as FieldClause, b as FilterClause, G as GroupClause, H as HashIndex, I as IndexDef, O as Operator, e as evaluateClause, c as evaluateFieldClause, r as readPath } from './predicate-BmhBSPCH.js';
+export { w as withOverlayedView } from './with-overlayed-view-C9joG7UZ.js';
 export { SYNC_CREDENTIALS_COLLECTION, SyncCredential, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential } from './team/index.js';
-export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-utkybTKb.js';
-export { a as AggregateResult, b as AggregateSpec, c as Aggregation, d as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, e as GROUPBY_WARN_CARDINALITY, f as GroupedAggregation, g as GroupedQuery, h as GroupedQueryN, i as GroupedRow, j as GroupedRowN, L as LiveAggregation, R as Reducer, k as ReducerOptions, l as avg, n as count, o as groupAndReduce, p as max, q as min, r as reduceRecords, t as sum } from './strategy-DSTrsZ8t.js';
-export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-DcoYWfJ_.js';
-import './lazy-builder-Rpd-V3jP.js';
+export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-CpKSkl2c.js';
+export { i as isDiscriminant } from './discriminant-BN9REW3o.js';
+export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-BnBQx39y.js';
+import './lazy-builder-ChSqcF5t.js';
 import '@noy-db/attestation';
 
 /**
@@ -72,6 +77,19 @@ declare function deleteUserEnvelope(store: NoydbStore, vault: string, keyringId:
  */
 declare function listUserEnvelopeIds(store: NoydbStore, vault: string): Promise<string[]>;
 
+/**
+ * Default text tokenizer for scan-mode search (#308).
+ *
+ * NFKC-normalize → lowercase → split on Unicode letter/number runs. This is a
+ * word-boundary tokenizer: it does **not** segment scripts written without
+ * inter-word spaces (Thai, Lao, Khmer, CJK) — those collapse to one token per
+ * run. For such data, a dictionary/ICU segmenter is the right `tokenizer`
+ * (the engine takes one as a parameter); substring/`contains` matching is the
+ * pragmatic fallback until then. See the #308 design note.
+ */
+type Tokenizer = (text: string) => string[];
+declare const tokenize: Tokenizer;
+
 /**
  * Cache policy helpers — parse human-friendly byte budgets into raw numbers.
  *
@@ -105,6 +123,15 @@ declare function parseBytes(input: number | string): number;
  */
 declare function estimateRecordBytes(record: unknown): number;
 
+/**
+ * @category capability
+ * Zero-dependency federation constants. Kept import-free so the core
+ * graph can reference reserved names without pulling the (dynamically
+ * imported) federation chunk. See the StateManagement Vault design spec.
+ */
+/** Reserved fleet-wide control-plane vault name. */
+declare const STATE_VAULT_NAME = "__noydb_state__";
+
 /**
  * Persistence helpers for `_meta/public-envelope`. Mirrors the
  * bypass-AES pattern used by `_meta/handle` and `_meta/policy` —
@@ -162,15 +189,14 @@ declare class PolicyDeniedError extends NoydbError {
  * MUST have at least one recovery path enrolled before being
  * production-ready (paper, shamir, multi-channel, or admin-mediated).
  *
- * The error references issue #10 in its message so a developer hitting
- * it gets a one-line pointer to the design.
+ * The error message carries a pointer to the recovery design docs.
  */
 declare class RecoveryNotEnrolledError extends NoydbError {
     constructor(message?: string);
 }
 /**
  * Raised by `openVault` when a managed-passphrase-mode vault has no
- * STRONG recovery profile enrolled (#195).
+ * STRONG recovery profile enrolled.
  *
  * Managed mode means the user never types a passphrase — the unlock
  * material lives in a `SealingKeyProvider` (`at-*` package). If that
@@ -196,9 +222,8 @@ declare class ManagedRecoveryNotEnrolledError extends NoydbError {
  * `db.rotateRecovery` when the developer requests a recovery profile
  * not yet wired in this hub release.
  *
- * Implemented: `paper` (#10, pre.5) and `shamir` (#196 slice 1, pre.16).
- * Pending: `multi-channel` and `admin-mediated` (tracked under #196
- * follow-up slices).
+ * Implemented: `paper` and `shamir`.
+ * Pending: `multi-channel` and `admin-mediated` (follow-up slices).
  *
  * The carried `profile` and `tracking` fields let consumers steer the
  * UI ("multi-channel recovery is not yet wired up — open issue #N to follow").
@@ -339,6 +364,50 @@ declare function loadVaultPolicy(store: NoydbStore, vault: string): Promise<Vaul
  */
 declare function saveVaultPolicy(store: NoydbStore, vault: string, policy: VaultPolicy): Promise<void>;
 
+/**
+ * Helpers for reading records out of a *plaintext* store (`encrypt: false`)
+ * with native tooling — the programmatic core of a `noydb cat`-style unwrap.
+ * See the plaintext/debug-store-mode design.
+ */
+
+/**
+ * Extract the record from a plaintext stored envelope, handling both layouts:
+ *
+ *   - **classic plaintext** (`encrypt: false`): the record is JSON in `_data`.
+ *   - **debugPlaintext**: the record's fields are inlined beside the
+ *     `_`-prefixed metadata (marked by `_debug`).
+ *
+ * Returns `null` for an empty/absent body. Throws if handed an **encrypted**
+ * envelope (non-empty `_iv`) — there is no key here; decrypt through the vault
+ * instead. Intended for record envelopes, not blob chunks.
+ *
+ * @example
+ * ```ts
+ * // node script over a to-file store, no vault needed:
+ * const env = JSON.parse(readFileSync('data/acme/invoices/inv-1.json', 'utf8'))
+ * console.log(readPlaintextRecord(env)) // → { id: 'inv-1', total: '120.00', … }
+ * ```
+ */
+declare function readPlaintextRecord<T = Record<string, unknown>>(envelope: EncryptedEnvelope): T | null;
+
+/** Allow any schema change. Explicit blind / back-compat. */
+declare function blindUpdate(): SchemaUpdateStrategy;
+/** Allow additive changes; reject non-additive ones. The safety backstop. */
+declare function additiveOnly(): SchemaUpdateStrategy;
+/**
+ * Reject schema changes. With `fields`, reject only when one of those
+ * fields is added/removed/changed; otherwise reject any non-`none` delta.
+ */
+declare function lockSchema(opts?: {
+    readonly fields?: readonly string[];
+}): SchemaUpdateStrategy;
+
+/** The coordinatedCutover update strategy (single-step — no from/to). */
+
+declare function coordinatedCutover(opts: {
+    readonly transform: TransformFn;
+}): SchemaUpdateStrategy;
+
 /**
  * Derive a {@link PersistedSchemaEnvelope} from a Standard Schema v1
  * validator. v0 supports Zod via `zod-to-json-schema` (optional peer-dep);
@@ -413,6 +482,8 @@ interface PersistSchemaResult {
     readonly skipped: boolean;
     /** The envelope that was either written or matched. */
     readonly envelope: PersistedSchemaEnvelope;
+    /** The update-strategy decision, present when strategies ran. */
+    readonly decision?: UpdateDecision;
 }
 declare function persistSchemaIfNeeded(opts: {
     readonly store: NoydbStore;
@@ -420,10 +491,11 @@ declare function persistSchemaIfNeeded(opts: {
     readonly collectionName: string;
     readonly validator: unknown;
     readonly dek: CryptoKey;
+    readonly strategies?: readonly SchemaUpdateStrategy[];
 }): Promise<PersistSchemaResult>;
 
 /**
- * Authentication introspection — issue #13.
+ * Authentication introspection.
  *
  * Three surfaces over the configured tier model and the actual
  * per-user enrollment state:
@@ -600,6 +672,169 @@ declare function decryptDeterministic(ivBase64: string, dataBase64: string, dek:
 declare function bufferToBase64(buffer: ArrayBuffer | Uint8Array): string;
 declare function base64ToBuffer(base64: string): Uint8Array<ArrayBuffer>;
 
+/**
+ * Return the ISO-4217 minor-unit scale for a currency code, or `null`
+ * when the code is not in the known set (caller must supply an explicit
+ * scale).
+ */
+declare function scaleForCurrency(code: string): number | null;
+
+/**
+ * Money-aware aggregation: exact `sum` / `min` / `max` over money
+ * fields.
+ *
+ * The generic reducers (`aggregate/reducers.ts`) read a field via
+ * `readNumber`, which coerces a string (the stored scaled-integer form
+ * of money, e.g. `'12345'`) to `0` — so an un-wrapped money `sum` would
+ * silently return zero. {@link wrapMoneyReducers} rewrites any `sum` /
+ * `min` / `max` over a declared money field into a reducer that
+ * accumulates per-currency `BigInt` totals of the stored integers, so
+ * the result is exact for any magnitude (past `Number.MAX_SAFE_INTEGER`
+ * included).
+ *
+ * Results are currency-aware and never silently mix currencies:
+ *   - **fixed** mode → a single exact decimal string.
+ *   - **multi** mode → an exact `Record<currency, string>` map.
+ *   - **`sum` with `convertTo` + `fx`** → a single exact string, with
+ *     each currency converted via BigInt arithmetic (no float).
+ *
+ * `remove()` is implemented for every money reducer so they participate
+ * in incremental live-aggregation and materialized-view maintenance
+ * exactly like the generic reducers they replace.
+ */
+
+type FxRates = Record<string, number | string>;
+
+/**
+ * Exact money arithmetic helpers (#337) — `mulRate` and `allocate`.
+ *
+ * Both operate on the canonical decoded string form that `get()`
+ * returns (`'10000.00'`), entirely in scaled-`BigInt` space — no
+ * floating-point step anywhere, exact past 2^53. They are pure
+ * functions with no vault or descriptor dependency: the working scale
+ * is inferred from the amount's fractional digits (a canonical money
+ * string always carries exactly the field's scale) or pinned with
+ * `opts.scale`.
+ *
+ * Why these two: app-side invariants of the form
+ * `Σ parts === whole` (receipt totals, net-zero WHT pairs, proration)
+ * carry ±0.01 tolerances ONLY because the math is major-unit floats +
+ * round2. `mulRate` (VAT-style rate application with explicit
+ * rounding) and `allocate` (largest-remainder split — parts sum to the
+ * input EXACTLY, by construction) make those tolerances zero.
+ */
+
+interface MulRateOptions {
+    /**
+     * Output scale (fraction digits). Defaults to the amount's own
+     * fractional digits — for a canonical money string that IS the
+     * field's scale.
+     */
+    readonly scale?: number;
+    /** Rounding for the final re-scale. Default `'half-up'`. */
+    readonly rounding?: RoundingMode;
+}
+interface AllocateOptions {
+    /** Working scale. Defaults to the amount's own fractional digits. */
+    readonly scale?: number;
+}
+/**
+ * Multiply a money amount by a decimal rate, exactly.
+ *
+ * The rate is parsed at its OWN full precision (`0.07` → `7` at scale
+ * 2), the product computed in `BigInt` at `amountScale + rateScale`,
+ * then re-scaled back to the output scale with the requested rounding —
+ * one rounding step, at the very end.
+ *
+ * ```ts
+ * mulRate('10000.00', 0.07)                       // '700.00'  (VAT)
+ * mulRate('33.33', '0.07')                        // '2.33'    (half-up)
+ * mulRate('33.33', 0.07, { rounding: 'floor' })   // '2.33'
+ * mulRate(100, 0.07, { scale: 2 })                // '7.00'
+ * ```
+ */
+declare function mulRate(amount: number | string, rate: number | string, opts?: MulRateOptions): string;
+/**
+ * Split a money amount across weighted buckets with ZERO drift: the
+ * returned parts sum to the input exactly, by construction
+ * (largest-remainder method).
+ *
+ * Each bucket gets `floor(amount × weightᵢ / Σweights)`; the leftover
+ * minor units (always fewer than the bucket count) go one each to the
+ * buckets with the largest truncated remainders — ties broken by
+ * position, earlier bucket first. Weights are parsed as exact decimals
+ * (no float division anywhere); they must be non-negative with a
+ * positive sum.
+ *
+ * ```ts
+ * allocate('100.00', [1, 1, 1])   // ['33.34', '33.33', '33.33']
+ * allocate('0.05', [3, 7])        // ['0.02', '0.03']
+ * allocate('-100.00', [1, 1, 1])  // ['-33.34', '-33.33', '-33.33']
+ * ```
+ */
+declare function allocate(amount: number | string, weights: ReadonlyArray<number | string>, opts?: AllocateOptions): string[];
+
+/**
+ * Branded money output type (#338).
+ *
+ * The decoded read shape of a money field is an exact decimal STRING
+ * (`'10000.00'`) — but a hand-written schema types it `string | number`,
+ * which is honest about the input side and unhelpful on the output
+ * side: every read site hand-coerces, and a missed coercion passes
+ * typecheck silently (then surfaces as a runtime template warning, or
+ * worse, as `'10000.00' * 100` arithmetic).
+ *
+ * {@link MoneyString} is the output-side brand: a `string` that has
+ * been through noy-db's decode (or {@link asMoney}'s guard). Branding
+ * is type-level only — zero runtime cost on the read path.
+ *
+ * ## Wiring the brand through a validator (the input/output asymmetry)
+ *
+ * Keep the permissive `string | number` on the INPUT side so write
+ * sites are untouched, and brand the OUTPUT side. With Zod:
+ *
+ * ```ts
+ * import type { MoneyString } from '@noy-db/hub'
+ *
+ * const moneyValue = z.union([z.number(), z.string()]) as unknown as
+ *   z.ZodType<MoneyString, z.ZodTypeDef, string | number>
+ *
+ * const Invoice = z.object({ id: z.string(), total: moneyValue })
+ * type InvoiceOut = z.output<typeof Invoice> // total: MoneyString
+ * type InvoiceIn  = z.input<typeof Invoice>  // total: string | number
+ * ```
+ *
+ * The cast is sound for fields declared in `moneyFields`: reads pass
+ * through `decodeMoneyFields`, which always produces the canonical
+ * decimal string.
+ */
+declare const MONEY_BRAND: unique symbol;
+/**
+ * An exact decimal string produced by noy-db's money decode
+ * (`'10000.00'`). The brand exists only at the type level — at runtime
+ * a `MoneyString` is a plain string.
+ */
+type MoneyString = string & {
+    readonly [MONEY_BRAND]: true;
+};
+/**
+ * Runtime-guarded cast to {@link MoneyString}. Accepts a decimal string
+ * or a number, returns the canonical decimal string branded — throws
+ * `MoneyUnsupportedError` on anything non-finite / non-decimal. Use at
+ * trust boundaries (deserialized JSON, route params); values read
+ * through `get()`/`list()` are already canonical.
+ */
+declare function asMoney(value: string | number): MoneyString;
+/** Type guard: is `value` a decimal string acceptable as money? */
+declare function isMoneyString(value: unknown): value is MoneyString;
+/**
+ * The ONE sanctioned escape hatch to a JS `number` — explicit because
+ * the conversion is lossy past 2^53. For display math and chart axes;
+ * never feed the result back into stored amounts (use `mulRate` /
+ * `allocate` for exact arithmetic).
+ */
+declare function moneyNumber(value: MoneyString | string | number): number;
+
 /**
  * Hierarchical access — tier-aware keyring helpers.
  *
@@ -754,4 +989,4 @@ type DiffCandidate<T = unknown> = Vault | Record<string, readonly T[]> | string;
  */
 declare function diffVault<T = unknown>(vault: Vault, candidate: DiffCandidate<T>, options?: DiffOptions): Promise<VaultDiff<T>>;
 
-export { ActiveTier, type CheckGateContext, DEFAULT_FRESHNESS_MS, DIRECTORY_RECORD_ID, type DiffCandidate, DiffEntry, type DiffOptions, DirectoryConfig, FactorProof, GateName, GatePolicy, META_COLLECTION, ManagedRecoveryNotEnrolledError, NoydbError, NoydbStore, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, type PersistSchemaResult, PersistedSchemaEnvelope, PolicyDeniedError, type PolicyDenyReason, PublicEnvelope, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, SCHEMAS_COLLECTION, STRICT_POLICY, UnlockedKeyring, UserEnvelope, UserVisibility, VISIBILITY_RECORD_PREFIX, Vault, type VaultDiff, type VaultDiffEntry, type VaultDiffModifiedEntry, VaultPolicy, assertTierAccess, base64ToBuffer, bufferToBase64, checkGate, decryptBytes, decryptDeterministic, dekKey, deleteUserEnvelope, deleteUserVisibility, derivePersistedSchema, derivePresenceKey, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, diffVault, effectiveClearance, encryptBytes, encryptDeterministic, estimateRecordBytes, isZodSchema, listUserEnvelopeIds, loadPersistedSchema, loadPublicEnvelope, loadUserEnvelope, loadVaultPolicy, mergePolicy, parseBytes, persistDirectoryConfig, persistSchemaIfNeeded, persistUserVisibility, readDirectoryConfig, readPublicEnvelope, readUserVisibility, savePersistedSchema, savePublicEnvelope, saveUserEnvelope, saveVaultPolicy, visibilityRecordId };
+export { ActiveTier, type AllocateOptions, type CheckGateContext, DEFAULT_FRESHNESS_MS, DIRECTORY_RECORD_ID, type DiffCandidate, DiffEntry, type DiffOptions, DirectoryConfig, EncryptedEnvelope, FactorProof, type FxRates, GateName, GatePolicy, META_COLLECTION, ManagedRecoveryNotEnrolledError, type MoneyString, type MulRateOptions, NoydbError, NoydbStore, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, type PersistSchemaResult, PersistedSchemaEnvelope, PolicyDeniedError, type PolicyDenyReason, PublicEnvelope, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, RoundingMode, SCHEMAS_COLLECTION, STATE_VAULT_NAME, STRICT_POLICY, SchemaUpdateStrategy, type Tokenizer, UnlockedKeyring, UpdateDecision, UserEnvelope, UserVisibility, VISIBILITY_RECORD_PREFIX, Vault, type VaultDiff, type VaultDiffEntry, type VaultDiffModifiedEntry, VaultPolicy, additiveOnly, allocate, asMoney, assertTierAccess, base64ToBuffer, blindUpdate, bufferToBase64, checkGate, coordinatedCutover, decryptBytes, decryptDeterministic, dekKey, deleteUserEnvelope, deleteUserVisibility, derivePersistedSchema, derivePresenceKey, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, diffVault, effectiveClearance, encryptBytes, encryptDeterministic, estimateRecordBytes, isMoneyString, isZodSchema, listUserEnvelopeIds, loadPersistedSchema, loadPublicEnvelope, loadUserEnvelope, loadVaultPolicy, lockSchema, mergePolicy, moneyNumber, mulRate, parseBytes, persistDirectoryConfig, persistSchemaIfNeeded, persistUserVisibility, readDirectoryConfig, readPlaintextRecord, readPublicEnvelope, readUserVisibility, savePersistedSchema, savePublicEnvelope, saveUserEnvelope, saveVaultPolicy, scaleForCurrency, tokenize, visibilityRecordId };