@noy-db/hub 0.2.0-pre.2 → 0.2.0-pre.3

package/dist/{types-BoFFiskX.d.ts → types-D9eB0Rvh.d.ts}

@@ -1,7 +1,7 @@
 import { I as IndexStrategy, d as LazyQuery } from './lazy-builder-Rpd-V3jP.js';
 import { b as AggregateSpec, A as AggregateStrategy } from './strategy-DSTrsZ8t.js';
 import { C as CrdtStrategy, a as CrdtMode, b as CrdtState } from './strategy-BSxFXGzb.js';
-import { N as NoydbError, Q as Query, ao as RefRegistry, al as RefDescriptor, a2 as JoinableSource, aq as RefViolation, ar as ScanBuilder } from './index-BCKdioeh.js';
+import { N as NoydbError, Q as Query, ar as RefRegistry, ao as RefDescriptor, a2 as JoinableSource, at as RefViolation, au as ScanBuilder } from './index-BF1B2HB9.js';
 import { F as FieldClause, I as IndexDef, C as CollectionIndexes } from './predicate-Dnu81tsS.js';
 import { AttestationFieldSchema, RevocationList } from '@noy-db/attestation';
 
@@ -803,7 +803,7 @@ interface LedgerEntry {
      * skips it in the data cross-check (it still participates in the
      * tamper-evident chain).
      */
-    readonly op: 'put' | 'delete' | 'amendment' | 'lifecycle';
+    readonly op: 'put' | 'delete' | 'amendment' | 'lifecycle' | 'migration';
     /** The collection the mutation targeted. */
     readonly collection: string;
     /** The record id the mutation targeted. */
@@ -2549,6 +2549,220 @@ interface I18nStrategy {
     buildDictionaryHandle<Keys extends string = string>(opts: BuildDictionaryHandleOptions<Keys>): DictionaryHandle<Keys>;
 }
 
+/**
+ * Observable write-queue (#227, M12 Slice 1).
+ *
+ * Tracks outstanding in-flight *logical* writes (a full Collection.put /
+ * delete, including ledger + cache + derivation + MV dispatch — not just
+ * the adapter call). The hub holds one tracker per instance; it is
+ * framework-agnostic (no Vue/React dependency). UI layers subscribe via
+ * onChange(); the migration drain (Slice 2) quiesces via onFlush().
+ */
+/** Public, read-only view of the hub's write-queue. */
+interface WriteQueue {
+    /** True while one or more writes are in flight (`depth > 0`). */
+    readonly pending: boolean;
+    /** Count of outstanding write operations. */
+    readonly depth: number;
+    /**
+     * Subscribe to depth changes (fires on every begin and settle).
+     * Returns an unsubscribe function. Intended for reactive wrappers
+     * (e.g. `@noy-db/in-vue` turns this into a `ref`).
+     */
+    onChange(handler: () => void): () => void;
+    /**
+     * Resolves once `depth` reaches 0. If a write settled with an error
+     * while this flush was waiting, the returned promise REJECTS with that
+     * error instead — so a drain caller surfaces the failure rather than
+     * hanging. Resolves immediately when already idle and error-free.
+     */
+    onFlush(): Promise<void>;
+}
+declare class WriteQueueTracker implements WriteQueue {
+    #private;
+    get pending(): boolean;
+    get depth(): number;
+    /** Mark one write as started. */
+    begin(): void;
+    /** Mark one write as finished. Pass the error if it failed. */
+    settle(error?: Error): void;
+    onChange(handler: () => void): () => void;
+    onFlush(): Promise<void>;
+    /**
+     * Run `fn` as a tracked write: depth++ on entry, depth-- on settle
+     * (success or failure). The fn's resolved value is returned; a thrown
+     * error is re-thrown after the queue is decremented.
+     */
+    track<R>(fn: () => Promise<R>): Promise<R>;
+}
+
+/**
+ * Hub-level write lifecycle hooks (#230). `onBeforeWrite` may abort (throw);
+ * `onAfterWrite` is awaited and its errors are warned, not thrown. A
+ * re-entrancy flag suppresses nested firing so a handler that writes can't
+ * loop. Held on the Noydb instance, threaded into every Collection.
+ */
+interface WriteEvent {
+    readonly op: 'create' | 'update' | 'delete';
+    readonly vault: string;
+    readonly collection: string;
+    readonly docId: string;
+    readonly before: unknown;
+    readonly after: unknown;
+    readonly baseVersion: number;
+    readonly version: number;
+    readonly userId: string;
+    readonly timestamp: number;
+    readonly txId: string;
+}
+type WriteHook = (event: WriteEvent) => void | Promise<void>;
+type Unsubscribe$2 = () => void;
+declare class WriteHookRegistry {
+    #private;
+    /** True while handlers are running — used by the write path to skip nested firing. */
+    get suppressed(): boolean;
+    /** True when any hook is registered (cheap gate for the write path). */
+    get hasHandlers(): boolean;
+    onBeforeWrite(handler: WriteHook): Unsubscribe$2;
+    onAfterWrite(handler: WriteHook): Unsubscribe$2;
+    /** Run before-hooks (awaited, in order). A throw propagates and aborts the write. */
+    runBefore(event: WriteEvent): Promise<void>;
+    /** Run after-hooks (awaited, in order). Per-handler errors are warned, not thrown. */
+    runAfter(event: WriteEvent): Promise<void>;
+}
+
+/**
+ * Schema-update strategy framework types (#245, M12 §3a).
+ *
+ * The hub core detects a schema change (SchemaDelta) and dispatches it
+ * through a collection's ordered strategy list. Strategies decide what
+ * happens; the core only knows this interface.
+ */
+/** A single changed top-level property in a schema delta. */
+interface FieldChange {
+    readonly field: string;
+    /** True when the field's required-ness flipped. */
+    readonly requiredChanged: boolean;
+    /** True when the field's subschema shape changed. */
+    readonly shapeChanged: boolean;
+}
+/** The classified difference between a stored and a freshly-derived schema. */
+interface SchemaDelta {
+    readonly collection: string;
+    readonly kind: 'none' | 'additive' | 'non-additive';
+    /** Top-level properties present in the new schema but not the old. */
+    readonly added: readonly string[];
+    /** Top-level properties present in the old schema but not the new. */
+    readonly removed: readonly string[];
+    /** Top-level properties present in both but altered. */
+    readonly changed: readonly FieldChange[];
+}
+/** Context handed to a strategy alongside the delta. */
+interface UpdateContext {
+    readonly collection: string;
+}
+/** Bulk transform run by the coordinatedCutover strategy (#232). */
+type TransformFn = (doc: Record<string, unknown>) => Record<string, unknown>;
+/**
+ * A strategy's verdict on a detected schema change.
+ * - `allow`   — no objection; the dispatcher falls through to the next strategy.
+ * - `reject`  — terminal: refuse the change; `error` is thrown at the write path.
+ * - `cutover` — terminal: run a coordinated drain-barrier (handled by #232).
+ * New terminal actions may be added without breaking existing strategies.
+ */
+type UpdateDecision = {
+    readonly action: 'allow';
+} | {
+    readonly action: 'reject';
+    readonly error: Error;
+} | {
+    readonly action: 'cutover';
+    readonly transform: TransformFn;
+};
+/** A pluggable schema-evolution policy. */
+interface SchemaUpdateStrategy {
+    readonly name: string;
+    onSchemaDelta(delta: SchemaDelta, ctx: UpdateContext): UpdateDecision | Promise<UpdateDecision>;
+}
+
+/**
+ * Per-collection write gate (#245). Holds the (async) update decision
+ * computed at registration; `Collection.put`/`delete` await it before
+ * writing and throw the strategy's rejection error.
+ *
+ * Detection FAILURE (the promise rejecting) is deliberately NOT a write
+ * block — schema detection is a fingerprint safety net, not a correctness
+ * invariant (matches how persisted-schema write failures are swallowed).
+ * Only an explicit `reject` decision blocks writes.
+ */
+
+declare class SchemaUpdateGate {
+    #private;
+    constructor(decision: Promise<UpdateDecision>);
+    assertWritable(): Promise<void>;
+}
+
+/**
+ * Schema-fence document (#232). Vault-level generation counter + drain
+ * state, stored at `_meta/schema-fence` using the plaintext-envelope
+ * pattern of `_meta/policy` (no PII — a counter + a state enum).
+ */
+
+type FenceState = 'normal' | 'draining' | 'migrating' | 'complete';
+interface FenceDoc {
+    readonly currentSchemaVersion: number;
+    readonly fenceState: FenceState;
+}
+
+/**
+ * Vault-level schema-fence controller (#232).
+ *
+ * Owns the open-time generation snapshot, the pending-cutover registry,
+ * and the cutover orchestration. 3a: single-client (the caller is the
+ * migrator). 3b: a cooperative ack-barrier — after `draining`, the
+ * migrator waits for the active client set (registry heartbeats) to ack
+ * the draining generation before transforming. No leader election.
+ */
+
+/** Runs one collection's transform; supplied by the Vault (binds to a Collection). */
+type RunTransform = (collection: string, transform: TransformFn) => Promise<void>;
+declare class SchemaFenceController {
+    #private;
+    constructor(opts: {
+        store: NoydbStore;
+        vault: string;
+        onFlush: () => Promise<void>;
+        clientId?: string;
+        now?: () => number;
+        staleMs?: number;
+        quiesceTimeoutMs?: number;
+        emit?: (e: {
+            currentSchemaVersion: number;
+            fenceState: FenceState;
+        }) => void;
+    });
+    /** Capture the generation snapshot at vault-open. */
+    init(): Promise<void>;
+    /** Record a per-collection pending cutover (from a registration `cutover` decision). */
+    registerPendingCutover(collection: string, transform: TransformFn): void;
+    /** Write-path gate. Throws when behind, fenced, or this collection is cutover-pending. */
+    assertWritable(collection: string): Promise<void>;
+    /**
+     * Admin trigger. Drain → wait for the active set to quiesce (or time out)
+     * → migrate each pending transform → bump → complete → normal. The
+     * migrator excludes itself from the barrier (it drained synchronously
+     * here). `onPoll` (tests) advances other clients between barrier checks;
+     * production falls back to a short real delay.
+     */
+    runCutover(run: RunTransform, opts?: {
+        onPoll?: () => Promise<void>;
+    }): Promise<{
+        migrated: number;
+    }>;
+    /** Recover a stuck drain: reset fenceState to normal at the current version (no bump). */
+    abort(): Promise<void>;
+}
+
 /**
  * Zero-dependency JSON diff.
  * Produces a flat list of changes between two plain objects.
@@ -3927,6 +4141,63 @@ declare function validatePublicEnvelopeInput(input: SetPublicEnvelopeInput, sche
  */
 declare function isPublicEnvelope(x: unknown): x is PublicEnvelope;
 
+/**
+ * Multi-tab coordination (#228a): primary/secondary election (Web Locks)
+ * + presence heartbeat (BroadcastChannel). Browser-only; opt-in; no-op
+ * when the APIs are absent. The lock/channel interfaces are hub-local
+ * (structurally compatible with @noy-db/by-peer + @noy-db/by-tabs, but
+ * not imported — those packages depend on hub).
+ */
+type TabRole = 'primary' | 'secondary' | 'unknown';
+interface TabPresence {
+    readonly tabId: string;
+    readonly lastSeen: number;
+    readonly role: TabRole;
+}
+type Unsubscribe$1 = () => void;
+/** Structural subset of the Web Locks API / by-peer's MinimalLockManager. */
+interface TabLockManager {
+    request<T>(name: string, options: {
+        mode?: 'exclusive' | 'shared';
+        signal?: AbortSignal;
+    }, callback: (lock: unknown) => Promise<T>): Promise<T>;
+}
+/** Structural subset of by-peer's PeerChannel / a BroadcastChannel wrapper. */
+interface TabChannel {
+    send(payload: string): void;
+    on(event: 'message', listener: (payload: string) => void): Unsubscribe$1;
+    on(event: 'close', listener: () => void): Unsubscribe$1;
+    close(): void;
+    readonly isOpen: boolean;
+}
+interface TabCoordinationOptions {
+    readonly lockManager?: TabLockManager;
+    readonly channel?: TabChannel;
+    readonly tabId?: string;
+    readonly lockName?: string;
+    readonly heartbeatMs?: number;
+    readonly staleMs?: number;
+    readonly now?: () => number;
+    /**
+     * Close the channel on `dispose()`. Set this only for a channel the
+     * coordinator owns (e.g. the one `defaultChannel()` created); leave it
+     * false for a caller-injected channel so the coordinator never closes a
+     * channel it didn't create. Default: false.
+     */
+    readonly closeChannelOnDispose?: boolean;
+    /**
+     * Also propagate committed writes to other tabs (#228b). Default true:
+     * when tab coordination is enabled and a channel is available, a write in
+     * one tab refreshes that document in every other tab. Set false to opt out.
+     */
+    readonly propagateWrites?: boolean;
+    /**
+     * Channel for write propagation (#228b) — distinct from the presence
+     * channel. Default: an inline BroadcastChannel on `noydb:tab-writes`.
+     */
+    readonly writeChannel?: TabChannel;
+}
+
 /**
  * Per-vault tier-3 (PIN / quick-resume) state — issue #11.
  *
@@ -4076,6 +4347,8 @@ interface AmendmentTxOptions {
  * facade; its `put`/`delete`/`get` calls stage ops against the tx.
  */
 declare class TxContext {
+    /** Stable id for this transaction; shared by all writes it performs (#230). */
+    readonly txId: string;
     /** @internal */
     readonly _ops: StagedOp[];
     /**
@@ -4160,6 +4433,34 @@ declare class TxCollection<T> {
  */
 declare function runTransaction<T>(db: Noydb, fn: (tx: TxContext) => Promise<T> | T, options?: AmendmentTxOptions): Promise<T>;
 
+/**
+ * Dry-run transactions (#231). Runs the tx body to STAGE ops, then builds
+ * the directly-affected diff (before = current committed via collection.get,
+ * after = staged record) and collects guard violations — without executing
+ * phase 2. No adapter writes, no write-hooks, no commit. MV/derivation
+ * cascade is NOT simulated (v2). Mirrors the guard loop in
+ * `Collection.putInternal` — keep the two in sync.
+ */
+
+interface AffectedDocument {
+    readonly vault: string;
+    readonly op: 'create' | 'update' | 'delete';
+    readonly collection: string;
+    readonly docId: string;
+    readonly before: unknown;
+    readonly after: unknown;
+}
+interface GuardViolation {
+    readonly vault: string;
+    readonly collection: string;
+    readonly docId: string;
+    readonly message: string;
+}
+interface DryRunResult {
+    readonly affected: ReadonlyArray<AffectedDocument>;
+    readonly guardViolations: ReadonlyArray<GuardViolation>;
+}
+
 /**
  * Policy gate DSL types — issue #9.
  *
@@ -4328,8 +4629,12 @@ type ActiveTier = 1 | 2 | 3;
 
 /** The top-level NOYDB instance. */
 declare class Noydb {
+    #private;
     private readonly options;
     private readonly emitter;
+    private readonly writeQueueTracker;
+    private readonly writeHooks;
+    private readonly clientId;
     private readonly vaultCache;
     private readonly keyringCache;
     private readonly syncEngines;
@@ -4362,6 +4667,10 @@ declare class Noydb {
     private readonly publicEnvelopeSchema;
     private closed;
     private sessionTimer;
+    /** Same-device multi-tab coordinator (#228); created on `enableTabCoordination()`. */
+    private tabCoordinator;
+    /** Cross-tab write relay (#228b); created on `enableTabCoordination()`. */
+    private writeRelay;
     /** Per-vault policy enforcers. */
     private readonly policyEnforcers;
     private readonly txStrategy;
@@ -4665,6 +4974,15 @@ declare class Noydb {
      * to the vault's ledger as `op: 'amendment'`.
      */
     transaction<T>(options: AmendmentTxOptions, fn: (tx: TxContext) => Promise<T> | T): Promise<T>;
+    /**
+     * Dry-run a transaction (#231): run the body to stage ops, then return
+     * the directly-affected diff + collected guard violations WITHOUT
+     * committing (no adapter writes, no write hooks). MV/derivation cascade
+     * is not simulated. Requires `withTransactions()`.
+     */
+    transaction(options: {
+        readonly dryRun: true;
+    }, fn: (tx: TxContext) => unknown): Promise<DryRunResult>;
     /**
      * Create a sync transaction for the given vault.
      * The vault must already be open via `openVault()`.
@@ -4729,6 +5047,52 @@ declare class Noydb {
     private getSyncEngine;
     on<K extends keyof NoydbEventMap>(event: K, handler: (data: NoydbEventMap[K]) => void): void;
     off<K extends keyof NoydbEventMap>(event: K, handler: (data: NoydbEventMap[K]) => void): void;
+    /**
+     * Observable write-queue for this hub instance. Reflects outstanding
+     * in-flight writes across all collections. See {@link WriteQueue}.
+     *
+     * @example
+     * window.addEventListener('beforeunload', (e) => {
+     *   if (db.writeQueue.pending) { e.preventDefault(); e.returnValue = '' }
+     * })
+     */
+    get writeQueue(): WriteQueue;
+    /**
+     * @internal Mutable tracker behind {@link writeQueue}. Threaded into
+     * each Collection (via Vault) so `put`/`delete` can `track()` writes.
+     * Not part of the public surface — consumers use `writeQueue`.
+     */
+    get _writeQueueTracker(): WriteQueueTracker;
+    /**
+     * Register a hook that runs before each write (#230). Awaited; a throw
+     * aborts the write. Returns an unsubscribe function.
+     */
+    onBeforeWrite(handler: WriteHook): Unsubscribe$2;
+    /**
+     * Register a hook that runs after each committed write (#230). Awaited;
+     * a handler error is warned, never rolled back. Returns an unsubscribe fn.
+     */
+    onAfterWrite(handler: WriteHook): Unsubscribe$2;
+    /** Subscribe to cross-tab write conflicts (#228c). Returns an unsubscribe. */
+    onWriteConflict(fn: (c: WriteConflict) => void): Unsubscribe$2;
+    /**
+     * Enable same-device multi-tab coordination (#228): primary/secondary
+     * election + presence. Browser-only — a graceful no-op (role 'unknown')
+     * when Web Locks / BroadcastChannel are unavailable and nothing is
+     * injected. Idempotent; returns a disposer.
+     */
+    enableTabCoordination(opts?: TabCoordinationOptions): {
+        dispose: () => void;
+    };
+    private disableTabCoordination;
+    get tabRole(): TabRole;
+    activeTabs(): TabPresence[];
+    onTabRoleChange(fn: (r: TabRole) => void): Unsubscribe$2;
+    onActiveTabsChange(fn: (t: TabPresence[]) => void): Unsubscribe$2;
+    /** @internal The write-hook registry, threaded into each Collection. */
+    get _writeHooks(): WriteHookRegistry;
+    /** @internal Stable per-instance id for schema-cutover coordination (#232). */
+    get _clientId(): string;
     /**
      * Soft-lock a single vault: clear its in-memory keyring, DEKs, vault
      * instance, sync engine, policy enforcer, and active-tier entry —
@@ -6078,6 +6442,11 @@ declare class GuardRegistry {
     register<T extends Record<string, unknown>>(spec: GuardStrategy<T>): void;
     /** All guards registered against `collection` in registration order. */
     guardsFor(collection: string): ReadonlyArray<AnyGuard>;
+    /** Per-collection guard counts, for introspection (#229). */
+    summary(): {
+        collection: string;
+        count: number;
+    }[];
     /**
      * Run every guard's `check` for this collection. First throw wins —
      * remaining guards are not invoked. Guards without a `check` skip.
@@ -6821,6 +7190,29 @@ interface PersistedSchemaEnvelope {
  * @module
  */
 
+/** Flat snapshot of a vault's registered schema (#229). */
+interface SchemaIntrospection {
+    readonly collections: ReadonlyArray<{
+        name: string;
+        docCount: number;
+    }>;
+    readonly guards: ReadonlyArray<{
+        collection: string;
+        count: number;
+    }>;
+    readonly materializedViews: ReadonlyArray<{
+        name: string;
+        sourceCollections: string[];
+    }>;
+    readonly schemaUpdate: ReadonlyArray<{
+        collection: string;
+        strategies: string[];
+    }>;
+    readonly grants: ReadonlyArray<{
+        collection: string;
+        permission: Permission;
+    }>;
+}
 /** Where the field-level info in the snapshot came from. */
 type FieldSource = 'persisted' | 'live-validator' | 'sampled' | 'unknown';
 interface FieldDescriptor {
@@ -6929,6 +7321,7 @@ interface VaultIntrospectState {
 
 /** A vault (tenant namespace) containing collections. */
 declare class Vault {
+    #private;
     private readonly adapter;
     /** The vault's name as passed to `openVault()`. Stable for the instance lifetime. */
     readonly name: string;
@@ -7031,6 +7424,8 @@ declare class Vault {
      */
     private readonly reloadKeyring;
     private readonly collectionCache;
+    /** #232 — vault-level schema cutover fence/controller. */
+    readonly schemaFence: SchemaFenceController;
     /**
      * per-collection `blobFields` retention/TTL config.
      * Populated on `collection({ blobFields })` and read by
@@ -7263,6 +7658,13 @@ declare class Vault {
          * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
          */
         persistJsonSchema?: boolean;
+        /**
+         * Ordered schema-update strategies (#245). On a detected schema
+         * change, evaluated in order; the first non-`allow` decision wins.
+         * A `reject` is enforced at the write path (`put`/`delete` throw).
+         * Requires `persistJsonSchema: true` (detection needs the baseline).
+         */
+        schemaUpdate?: readonly SchemaUpdateStrategy[];
         /** — declare the per-field schema for document attestation (issue side). */
         attestation?: AttestationFieldSchema;
     }): Collection<T>;
@@ -7272,6 +7674,45 @@ declare class Vault {
      * Used in tests; production code does not need to call this.
      */
     _drainPendingSchemaWrites(): Promise<void>;
+    /**
+     * Run a coordinated schema cutover (#232). Drains pending writes, waits
+     * for the active client set to quiesce (the ack-barrier), applies every
+     * pending collection transform in bulk, bumps the vault schema generation,
+     * and clears the fence. Returns the count of collections migrated.
+     * `opts.onPoll` (tests) advances other clients between barrier checks.
+     */
+    runSchemaCutover(opts?: {
+        onPoll?: () => Promise<void>;
+    }): Promise<{
+        migrated: number;
+    }>;
+    /**
+     * #228b — refresh a loaded collection's view of one document from a peer
+     * tab's broadcast. No-op when the collection isn't loaded in this tab
+     * (it will read fresh on next open). Mirrors #runCutoverTransform's guard.
+     */
+    _applyRemoteWrite(collectionName: string, docId: string, action: 'put' | 'delete'): Promise<void>;
+    /**
+     * #228c — for a detected conflict: capture this tab's clobbered record,
+     * read the common ancestor from history, converge the cache to the store's
+     * authoritative value (the (b) re-read), and return all three for the
+     * WriteConflict payload. Returns null when the collection isn't loaded.
+     */
+    _captureAndConverge(collectionName: string, docId: string, action: 'put' | 'delete', baseV: number): Promise<{
+        local: unknown;
+        remote: unknown;
+        base: unknown;
+    } | null>;
+    /** Recover a stuck cutover fence (#232) — reset to normal without bumping. */
+    abortSchemaCutover(): Promise<void>;
+    /** Current schema-cutover fence state for this vault (#232/#233). Thin live read. */
+    schemaFenceState(): Promise<FenceDoc>;
+    /** @internal Start the per-client heartbeat + fence watcher once a cutover is registered (#232). */
+    _ensureFenceCoordination(): void;
+    /** @internal Stop the heartbeat/watcher (vault lock/close). */
+    _stopFenceCoordination(): void;
+    /** @internal Drive one heartbeat + watch cycle deterministically (tests). */
+    _fenceTick(): Promise<void>;
     /**
      * Validate i18nText fields on a `put()`. Called by Collection just
      * before the adapter write, after schema validation. Throws
@@ -7918,6 +8359,14 @@ declare class Vault {
      * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
      */
     dumpSchema(opts?: DumpSchemaOptions): Promise<VaultSchemaSnapshot>;
+    /**
+     * Lightweight read of the vault's registered schema (#229): collections
+     * (+ doc counts), guards, materialized views, schema-update strategies,
+     * and the unlocked user's grants. Cheap — one `adapter.list` per
+     * collection, no decryption. For a full snapshot + stats use dumpSchema().
+     * Post-unlock by construction (a Vault only exists with an unlocked keyring).
+     */
+    introspect(): Promise<SchemaIntrospection>;
     /**
      * Internal accessor for {@link dumpVaultSchema}. Exposes the structural
      * state the walker needs (collection cache, registries, ref registry,
@@ -8394,12 +8843,18 @@ interface CacheStats extends LruStats {
 }
 /** A typed collection of records within a vault. */
 declare class Collection<T> {
+    #private;
     private readonly adapter;
     private readonly vault;
     private readonly name;
     private readonly keyring;
     private readonly encrypted;
     private readonly emitter;
+    private readonly writeQueue;
+    private readonly schemaUpdateGate;
+    private readonly schemaFence;
+    private readonly writeHooks;
+    private readonly activeTxId;
     private readonly getDEK;
     private readonly onDirty;
     private readonly historyConfig;
@@ -8667,6 +9122,21 @@ declare class Collection<T> {
         keyring: UnlockedKeyring;
         encrypted: boolean;
         emitter: NoydbEventEmitter;
+        /**
+         * Vault-level in-flight write tracker (#227). When present,
+         * `put`/`delete` run inside `writeQueue.track()` so `hub.writeQueue`
+         * reflects outstanding writes. Optional so direct Collection
+         * construction in tests still works untracked.
+         */
+        writeQueue?: WriteQueueTracker | undefined;
+        /** #245 — per-collection schema-update gate; `put`/`delete` await it. */
+        schemaUpdateGate?: SchemaUpdateGate | undefined;
+        /** #232 — vault-level fence controller; `put`/`delete` consult it. */
+        schemaFence?: SchemaFenceController | undefined;
+        /** #230 — hub-level write-hook registry; fired around put/delete. */
+        writeHooks?: WriteHookRegistry | undefined;
+        /** #230 — active transaction id supplier (null outside a transaction). */
+        activeTxId?: (() => string | null) | undefined;
         getDEK: (collectionName: string) => Promise<CryptoKey>;
         historyConfig?: HistoryConfig | undefined;
         onDirty?: OnDirtyCallback | undefined;
@@ -8982,7 +9452,8 @@ declare class Collection<T> {
         pollIntervalMs?: number;
     }): PresenceHandle<P>;
     /**
-     * Create or update a record.
+     * Create or update a record. Runs inside the hub's write-queue tracker
+     * (#227) so `hub.writeQueue.pending` reflects this write.
      *
      * @param id      Record identifier.
      * @param record  The record body (validated by the collection's schema
@@ -8995,6 +9466,8 @@ declare class Collection<T> {
     put(id: string, record: T, options?: {
         readonly reason?: string;
     }): Promise<void>;
+    /** @internal Untracked put body — call {@link put}, not this. */
+    private putInternal;
     /**
      * Fire registered MV strategies whose dependency set includes this
      * collection. Eager-mode MVs re-materialize inline via
@@ -9020,8 +9493,20 @@ declare class Collection<T> {
      * cycle detection.
      */
     private dispatchDerivations;
-    /** Delete a record by ID. */
+    /**
+     * Delete a record by ID. Runs inside the hub's write-queue tracker
+     * (#227) so `hub.writeQueue.pending` reflects this write.
+     */
     delete(id: string): Promise<void>;
+    /**
+     * @internal #232 — bulk-rewrite every record through a cutover transform.
+     * Raw adapter path (bypasses the write gate + guards — the transform is
+     * trusted and runs only during the `migrating` phase). Bumps each
+     * record's `_v` and appends a ledger `op:'migration'` entry.
+     */
+    _applyCutoverTransform(transform: (doc: Record<string, unknown>) => Record<string, unknown>): Promise<number>;
+    /** @internal Untracked delete body — call {@link delete}, not this. */
+    private deleteInternal;
     /**
      * @internal — system-internal delete that bypasses user-facing
      * delete hooks (`onDelete`, accounting-period guard, FK ref
@@ -9358,6 +9843,15 @@ declare class Collection<T> {
      * gone before the tx and the revert deleted it again).
      */
     _invalidateCacheEntry(id: string): Promise<void>;
+    /**
+     * #228b — apply a peer tab's committed write to THIS tab's in-memory view:
+     * re-read the (already-persisted) envelope from the shared store + refresh
+     * cache/indexes, then emit a `change` event so reactive consumers re-render.
+     * Never writes to the store and never fires write hooks, so it cannot loop.
+     */
+    _applyRemoteChange(id: string, action: 'put' | 'delete'): Promise<void>;
+    /** @internal #228c — the current in-memory record without a store read (for conflict capture). */
+    _peekCached(id: string): T | null;
     private ensureHydrated;
     /** Hydrate from a pre-loaded snapshot (used by Vault). */
     hydrateFromSnapshot(records: Record<string, EncryptedEnvelope>): Promise<void>;
@@ -9783,6 +10277,7 @@ interface ShadowStrategy {
  */
 interface TxStrategy {
     runTransaction<T>(db: Noydb, fn: (tx: TxContext) => Promise<T> | T, options?: AmendmentTxOptions): Promise<T>;
+    runDryRun(db: Noydb, fn: (tx: TxContext) => unknown): Promise<DryRunResult>;
 }
 
 /**
@@ -10874,6 +11369,23 @@ interface Conflict {
      */
     readonly resolve?: (winner: EncryptedEnvelope | null) => void;
 }
+/**
+ * #228c — a same-device cross-tab write conflict: another tab overwrote a
+ * document this tab had written, having diverged from an older base. Records
+ * are decrypted (cross-tab handlers reconcile in plaintext). `base` is the
+ * common ancestor from history, or null when history is unavailable.
+ */
+interface WriteConflict {
+    readonly vault: string;
+    readonly collection: string;
+    readonly docId: string;
+    readonly local: unknown;
+    readonly remote: unknown;
+    readonly base: unknown;
+    readonly localVersion: number;
+    readonly remoteVersion: number;
+    readonly baseVersion: number;
+}
 type ConflictStrategy = 'local-wins' | 'remote-wins' | 'version' | ((conflict: Conflict) => 'local' | 'remote');
 /**
  * Collection-level conflict policy.
@@ -10960,9 +11472,20 @@ interface ChangeEvent {
 interface NoydbEventMap {
     'change': ChangeEvent;
     'error': Error;
+    /**
+     * Same-instance signal that this vault's schema-fence state changed
+     * (#232). For UI integration (#233). Cross-client coordination goes
+     * through the store, not this event.
+     */
+    'schema:fence-changed': {
+        vault: string;
+        currentSchemaVersion: number;
+        fenceState: 'normal' | 'draining' | 'migrating' | 'complete';
+    };
     'sync:push': PushResult;
     'sync:pull': PullResult;
     'sync:conflict': Conflict;
+    'write:conflict': WriteConflict;
     'sync:online': void;
     'sync:offline': void;
     'sync:backup-error': {
@@ -11967,4 +12490,4 @@ interface DeleteManyResult {
     }>;
 }
 
-export { type ConsentAuditEntry as $, type BlobObject as A, type BlobStrategy as B, type BlobPutOptions as C, DICT_COLLECTION_PREFIX as D, type BlobResponseOptions as E, BlobSet as F, type BlobStrategyOpenArgs as G, type CompactRunOptions as H, type I18nStrategy as I, type CompactionContext as J, type CompactionResult as K, DEFAULT_CHUNK_SIZE as L, EXPORT_AUDIT_COLLECTION as M, ExportBlobsAbortedError as N, type ExportBlobsAuditEntry as O, PolicyEnforcer as P, type ExportBlobsHandle as Q, type ExportBlobsOptions as R, type SessionStrategy as S, type ExportedBlob as T, type SlotInfo as U, type SlotRecord as V, type VersionRecord as W, createExportBlobsHandle as X, runCompaction as Y, type ConsentStrategy as Z, CONSENT_AUDIT_COLLECTION as _, type DictEntry as a, VaultInstant as a$, type ConsentAuditFilter as a0, type ConsentContext as a1, type ConsentOp as a2, loadConsentEntries as a3, writeConsentEntry as a4, type PeriodsStrategy as a5, type CarryForwardContext as a6, type ClosePeriodOptions as a7, type OpenPeriodOptions as a8, PERIODS_COLLECTION as a9, type DerivationStrategyHandle as aA, type DerivedFromMeta as aB, type OutputSpec as aC, type RecordOutputSpec as aD, type MaterializedViewStrategy as aE, type MaterializedViewStrategyHandle as aF, type OverlayedViewStrategy as aG, Collection as aH, OverlayedViewRegistry as aI, type OverlayedViewStrategyHandle as aJ, type SyncStrategy as aK, type Role as aL, type UnlockedKeyring as aM, type HistoryStrategy as aN, type NoydbStore as aO, type HistoryOptions as aP, type EncryptedEnvelope as aQ, type PruneOptions as aR, type AppendInput as aS, type ChangeType as aT, CollectionInstant as aU, type DiffEntry as aV, type JsonPatch as aW, type JsonPatchOp as aX, type LedgerEntry as aY, LedgerStore as aZ, type VaultEngine as a_, type PeriodRecord as aa, type ReadOnlyCollection as ab, appendPeriodLedgerEntry as ac, assertTsWritable as ad, chainAnchor as ae, loadPeriods as af, validatePeriodName as ag, type GuardStrategy as ah, type GuardChange as ai, type GuardContext as aj, GuardRegistry as ak, type GuardStrategyHandle as al, ReadOnlyVaultFacade as am, type ShadowStrategy as an, CollectionFrame as ao, VaultFrame as ap, type TxStrategy as aq, type AmendmentTxOptions as ar, TxCollection as as, TxContext as at, TxVault as au, runTransaction as av, type DerivationStrategy as aw, type DerivationContext as ax, type ArrayOutputSpec as ay, DerivationRegistry as az, type DictKeyDescriptor as b, type ExportChunk as b$, type VerifyResult as b0, applyPatch as b1, canonicalJson as b2, computePatch as b3, diff as b4, formatDiff as b5, hashEntry as b6, paddedIndex as b7, parseIndex as b8, sha256Hex as b9, type CacheOptions as bA, type CacheStats as bB, type ChangeEvent as bC, type CollectionChangeEvent as bD, type CollectionConflictResolver as bE, type CollectionDescriptor as bF, type CollectionStats as bG, type Conflict as bH, type ConflictPolicy as bI, type ConflictStrategy as bJ, type CrossTierAccessEvent as bK, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as bL, DELEGATIONS_COLLECTION as bM, type DeepPartial as bN, type DeepPartialOrNull as bO, type DelegationToken as bP, type DeleteManyResult as bQ, type DerivationDescriptor as bR, type DirtyEntry as bS, type DumpSchemaOptions as bT, ELEVATION_AUDIT_COLLECTION as bU, ElevatedHandle as bV, type EnrollAuthenticatorOptions as bW, type EnrollAuthenticatorWrappingDEKsOptions as bX, type EnrollAuthenticatorWrappingKEKOptions as bY, type EnrollRecoveryResult as bZ, type ExportCapability as b_, type PublicEnvelope as ba, type SealingKeyProvider as bb, type BundleRecipient as bc, type RecipientSealer as bd, type RecipientHint as be, Vault as bf, type RecoveryEnrollmentInput as bg, type ShamirRecoveryProvider as bh, type MVQueryContext as bi, type RegisteredMV as bj, MaterializedViewRegistry as bk, type MaterializedFromMeta as bl, type MaterializedViewOutput as bm, type UnionSource as bn, type UserEnvelope as bo, type GateName as bp, type GatePolicy as bq, type VaultPolicy as br, type ActiveTier as bs, type FactorProof as bt, type PersistedSchemaEnvelope as bu, type DirectoryConfig as bv, type UserVisibility as bw, type AccessibleVault as bx, BUNDLE_STORE_POLICY as by, type BuiltInGateName as bz, DictionaryHandle as c, type PullPolicy as c$, type ExportFormat as c0, type ExportStreamOptions as c1, type FactorKind as c2, type FactorProofBundle as c3, type FactorRequirement as c4, type FieldDescriptor as c5, type FieldSource as c6, type GhostRecord as c7, type GrantOptions as c8, type HistoryConfig as c9, MemorySealingKeyProvider as cA, NOYDB_BACKUP_VERSION as cB, NOYDB_FORMAT_VERSION as cC, NOYDB_KEYRING_VERSION as cD, NOYDB_SYNC_VERSION as cE, Noydb as cF, type NoydbBundleStore as cG, type NoydbEventMap as cH, type NoydbOptions as cI, type OverlayViewDescriptor as cJ, PUBLIC_ENVELOPE_FIELDS as cK, type PaperRecoveryDoc as cL, type PaperRecoveryEntry as cM, type PassphrasePolicy as cN, type PassphraseValidationResult as cO, type Permission as cP, type Permissions as cQ, type PersistedSchemaKind as cR, type PlaintextTranslatorContext as cS, type PlaintextTranslatorFn as cT, PresenceHandle as cU, type PresencePeer as cV, type PublicEnvelopeField as cW, type PublicEnvelopeSchema as cX, type PublicEnvelopeText as cY, type PullMode as cZ, type PullOptions as c_, type HistoryEntry as ca, INDEXED_STORE_POLICY as cb, type ImportCapability as cc, type InferOutput as cd, type InternalCollectionStats as ce, type IssueDelegationOptions as cf, type IssueMagicLinkGrantOptions as cg, type KeyringAuthenticator as ch, type KeyringAuthenticatorWrappingDEKs as ci, type KeyringAuthenticatorWrappingKEK as cj, type KeyringFile as ck, type ListAccessibleVaultsOptions as cl, type ListPageResult as cm, type ListUsersOptions as cn, type LiveUserEnvelope as co, type LocaleReadOptions as cp, Lru as cq, type LruOptions as cr, type LruStats as cs, MAGIC_LINK_CONTENT_INFO_PREFIX as ct, MAGIC_LINK_GRANTS_COLLECTION as cu, MAGIC_LINK_KEK_INFO_PREFIX as cv, type MagicLinkGrantPayload as cw, type MagicLinkGrantRecord as cx, type MaterializedViewDescriptor as cy, MemoryRecipientSealer as cz, type DictionaryOptions as d, type VaultSchemaSnapshot as d$, type PullResult as d0, type PushMode as d1, type PushOptions as d2, type PushPolicy as d3, type PushResult as d4, type PutManyItemOptions as d5, type PutManyOptions as d6, type PutManyResult as d7, type QueryAcrossOptions as d8, type QueryAcrossResult as d9, type StoreAuthKind as dA, type StoreCapabilities as dB, SyncEngine as dC, type SyncMetadata as dD, type SyncPolicy as dE, SyncScheduler as dF, type SyncSchedulerStatus as dG, type SyncStatus as dH, type SyncTarget as dI, type SyncTargetRole as dJ, SyncTransaction as dK, type SyncTransactionResult as dL, type TierMode as dM, type TranslatorAuditEntry as dN, type TxOp as dO, USER_ENVELOPE_COLLECTION as dP, USER_ENVELOPE_MAX_BYTES as dQ, type Unsubscribe as dR, type UpdateAuthenticatorOptions as dS, type UpdateUserOptions as dT, UserApi as dU, type UserEnvelopeCheckGate as dV, UserEnvelopeOversizedError as dW, type UserEnvelopePresented as dX, type UserInfo as dY, type VaultBackup as dZ, type VaultPolicyOnDisk as d_, type QuickUnlockState as da, QuickUnlockStore as db, type ReAuthOperation as dc, type RecoverPassphraseInput as dd, type RecoverPassphraseResult as de, type RecoverUserOptions as df, type RecoveryProof as dg, type ResolvedPublicEnvelopeSchema as dh, type RevokeOptions as di, type RotatePassphraseInput as dj, type RotateRecoveryOptions as dk, type RotateRecoveryResult as dl, SEALED_PASSPHRASE_RECORD_ID as dm, type SealedEnvelope as dn, type SealedPassphrase as dp, type SessionPolicy as dq, type SetPublicEnvelopeInput as dr, type ShamirRecoveryDoc as ds, type ShamirRecoveryEntry as dt, type SlotRewrapCeremony as du, type SlotRewrapContext as dv, type StandardSchemaV1 as dw, type StandardSchemaV1Issue as dx, type StandardSchemaV1SyncResult as dy, type StoreAuth as dz, type I18nTextDescriptor as e, type VaultSnapshot as e0, type WarningRules as e1, WeakPassphraseError as e2, type WeakPassphraseReason as e3, type WrappedDeksBlob as e4, assertStrongPassphrase as e5, buildRecipientKeyringFile as e6, burnPaperRecoveryEntry as e7, createNoydb as e8, createStore as e9, readMagicLinkGrantRecord as eA, recoverUser as eB, removeAuthenticator as eC, resolveSchema as eD, revokeDelegation as eE, revokeMagicLinkGrant as eF, savePaperRecoveryEntries as eG, saveSealedPassphrase as eH, saveShamirRecoveryEntries as eI, unwrapDeksFromBlob as eJ, unwrapDeksFromPaperEntry as eK, unwrapDeksFromShamirEntry as eL, unwrapMagicLinkGrant as eM, validatePassphrase as eN, validatePublicEnvelopeInput as eO, validateSchemaInput as eP, validateSchemaOutput as eQ, writeMagicLinkGrant as eR, changeSecret as eS, createOwnerKeyring as eT, ensureCollectionDEK as eU, grant as eV, loadKeyring as eW, persistKeyring as eX, revoke as eY, updateAuthenticator as eZ, updateKeyringIdentity as e_, deriveMagicLinkContentKey as ea, enrollAuthenticator as eb, estimateEntropy as ec, evaluateExportCapability as ed, evaluateImportCapability as ee, findAuthenticator as ef, hasExportCapability as eg, hasImportCapability as eh, hasRecoveryEnrolled as ei, isMagicLinkGrantExpired as ej, isPublicEnvelope as ek, issueDelegation as el, recoverPassphrase as em, rotatePassphrase as en, listMagicLinkGrants as eo, listUsers as ep, listUsersWithEnvelopes as eq, loadActiveDelegations as er, loadPaperRecoveryEntries as es, loadSealedPassphrase as et, loadShamirRecoveryEntries as eu, magicLinkGrantRecordId as ev, mintPaperRecoveryEntry as ew, mintShamirRecoveryEntry as ex, mintWrappedDeksBlob as ey, parseSealedEnvelope as ez, type I18nTextOptions as f, applyI18nLocale as g, dictCollectionName as h, dictKey as i, i18nText as j, isDictCollectionName as k, isDictKeyDescriptor as l, isI18nTextDescriptor as m, createEnforcer as n, validateSessionPolicy as o, BLOB_CHUNKS_COLLECTION as p, BLOB_COLLECTION as q, resolveI18nText as r, BLOB_EVICTION_AUDIT_COLLECTION as s, BLOB_INDEX_COLLECTION as t, BLOB_SLOTS_PREFIX as u, validateI18nTextValue as v, BLOB_VERSIONS_PREFIX as w, type BlobEvictionEntry as x, type BlobFieldPolicy as y, type BlobFieldsConfig as z };
+export { type ConsentAuditEntry as $, type BlobObject as A, type BlobStrategy as B, type BlobPutOptions as C, DICT_COLLECTION_PREFIX as D, type BlobResponseOptions as E, BlobSet as F, type BlobStrategyOpenArgs as G, type CompactRunOptions as H, type I18nStrategy as I, type CompactionContext as J, type CompactionResult as K, DEFAULT_CHUNK_SIZE as L, EXPORT_AUDIT_COLLECTION as M, ExportBlobsAbortedError as N, type ExportBlobsAuditEntry as O, PolicyEnforcer as P, type ExportBlobsHandle as Q, type ExportBlobsOptions as R, type SessionStrategy as S, type ExportedBlob as T, type SlotInfo as U, type SlotRecord as V, type VersionRecord as W, createExportBlobsHandle as X, runCompaction as Y, type ConsentStrategy as Z, CONSENT_AUDIT_COLLECTION as _, type DictEntry as a, VaultInstant as a$, type ConsentAuditFilter as a0, type ConsentContext as a1, type ConsentOp as a2, loadConsentEntries as a3, writeConsentEntry as a4, type PeriodsStrategy as a5, type CarryForwardContext as a6, type ClosePeriodOptions as a7, type OpenPeriodOptions as a8, PERIODS_COLLECTION as a9, type DerivationStrategyHandle as aA, type DerivedFromMeta as aB, type OutputSpec as aC, type RecordOutputSpec as aD, type MaterializedViewStrategy as aE, type MaterializedViewStrategyHandle as aF, type OverlayedViewStrategy as aG, Collection as aH, OverlayedViewRegistry as aI, type OverlayedViewStrategyHandle as aJ, type SyncStrategy as aK, type Role as aL, type UnlockedKeyring as aM, type HistoryStrategy as aN, type NoydbStore as aO, type HistoryOptions as aP, type EncryptedEnvelope as aQ, type PruneOptions as aR, type AppendInput as aS, type ChangeType as aT, CollectionInstant as aU, type DiffEntry as aV, type JsonPatch as aW, type JsonPatchOp as aX, type LedgerEntry as aY, LedgerStore as aZ, type VaultEngine as a_, type PeriodRecord as aa, type ReadOnlyCollection as ab, appendPeriodLedgerEntry as ac, assertTsWritable as ad, chainAnchor as ae, loadPeriods as af, validatePeriodName as ag, type GuardStrategy as ah, type GuardChange as ai, type GuardContext as aj, GuardRegistry as ak, type GuardStrategyHandle as al, ReadOnlyVaultFacade as am, type ShadowStrategy as an, CollectionFrame as ao, VaultFrame as ap, type TxStrategy as aq, type AmendmentTxOptions as ar, TxCollection as as, TxContext as at, TxVault as au, runTransaction as av, type DerivationStrategy as aw, type DerivationContext as ax, type ArrayOutputSpec as ay, DerivationRegistry as az, type DictKeyDescriptor as b, type EnrollAuthenticatorOptions as b$, type VerifyResult as b0, applyPatch as b1, canonicalJson as b2, computePatch as b3, diff as b4, formatDiff as b5, hashEntry as b6, paddedIndex as b7, parseIndex as b8, sha256Hex as b9, type AccessibleVault as bA, type AffectedDocument as bB, BUNDLE_STORE_POLICY as bC, type BuiltInGateName as bD, type CacheOptions as bE, type CacheStats as bF, type ChangeEvent as bG, type CollectionChangeEvent as bH, type CollectionConflictResolver as bI, type CollectionDescriptor as bJ, type CollectionStats as bK, type Conflict as bL, type ConflictPolicy as bM, type ConflictStrategy as bN, type CrossTierAccessEvent as bO, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as bP, DELEGATIONS_COLLECTION as bQ, type DeepPartial as bR, type DeepPartialOrNull as bS, type DelegationToken as bT, type DeleteManyResult as bU, type DerivationDescriptor as bV, type DirtyEntry as bW, type DryRunResult as bX, type DumpSchemaOptions as bY, ELEVATION_AUDIT_COLLECTION as bZ, ElevatedHandle as b_, type PublicEnvelope as ba, type SealingKeyProvider as bb, type BundleRecipient as bc, type RecipientSealer as bd, type RecipientHint as be, Vault as bf, type RecoveryEnrollmentInput as bg, type ShamirRecoveryProvider as bh, type MVQueryContext as bi, type RegisteredMV as bj, MaterializedViewRegistry as bk, type MaterializedFromMeta as bl, type MaterializedViewOutput as bm, type UnionSource as bn, type UserEnvelope as bo, type GateName as bp, type GatePolicy as bq, type VaultPolicy as br, type ActiveTier as bs, type FactorProof as bt, type SchemaUpdateStrategy as bu, type TransformFn as bv, type PersistedSchemaEnvelope as bw, type UpdateDecision as bx, type DirectoryConfig as by, type UserVisibility as bz, DictionaryHandle as c, type PlaintextTranslatorContext as c$, type EnrollAuthenticatorWrappingDEKsOptions as c0, type EnrollAuthenticatorWrappingKEKOptions as c1, type EnrollRecoveryResult as c2, type ExportCapability as c3, type ExportChunk as c4, type ExportFormat as c5, type ExportStreamOptions as c6, type FactorKind as c7, type FactorProofBundle as c8, type FactorRequirement as c9, type LruOptions as cA, type LruStats as cB, MAGIC_LINK_CONTENT_INFO_PREFIX as cC, MAGIC_LINK_GRANTS_COLLECTION as cD, MAGIC_LINK_KEK_INFO_PREFIX as cE, type MagicLinkGrantPayload as cF, type MagicLinkGrantRecord as cG, type MaterializedViewDescriptor as cH, MemoryRecipientSealer as cI, MemorySealingKeyProvider as cJ, NOYDB_BACKUP_VERSION as cK, NOYDB_FORMAT_VERSION as cL, NOYDB_KEYRING_VERSION as cM, NOYDB_SYNC_VERSION as cN, Noydb as cO, type NoydbBundleStore as cP, type NoydbEventMap as cQ, type NoydbOptions as cR, type OverlayViewDescriptor as cS, PUBLIC_ENVELOPE_FIELDS as cT, type PaperRecoveryDoc as cU, type PaperRecoveryEntry as cV, type PassphrasePolicy as cW, type PassphraseValidationResult as cX, type Permission as cY, type Permissions as cZ, type PersistedSchemaKind as c_, type FenceDoc as ca, type FenceState as cb, type FieldChange as cc, type FieldDescriptor as cd, type FieldSource as ce, type GhostRecord as cf, type GrantOptions as cg, type GuardViolation as ch, type HistoryConfig as ci, type HistoryEntry as cj, INDEXED_STORE_POLICY as ck, type ImportCapability as cl, type InferOutput as cm, type InternalCollectionStats as cn, type IssueDelegationOptions as co, type IssueMagicLinkGrantOptions as cp, type KeyringAuthenticator as cq, type KeyringAuthenticatorWrappingDEKs as cr, type KeyringAuthenticatorWrappingKEK as cs, type KeyringFile as ct, type ListAccessibleVaultsOptions as cu, type ListPageResult as cv, type ListUsersOptions as cw, type LiveUserEnvelope as cx, type LocaleReadOptions as cy, Lru as cz, type DictionaryOptions as d, type TabRole as d$, type PlaintextTranslatorFn as d0, PresenceHandle as d1, type PresencePeer as d2, type PublicEnvelopeField as d3, type PublicEnvelopeSchema as d4, type PublicEnvelopeText as d5, type PullMode as d6, type PullOptions as d7, type PullPolicy as d8, type PullResult as d9, type SealedPassphrase as dA, type SessionPolicy as dB, type SetPublicEnvelopeInput as dC, type ShamirRecoveryDoc as dD, type ShamirRecoveryEntry as dE, type SlotRewrapCeremony as dF, type SlotRewrapContext as dG, type StandardSchemaV1 as dH, type StandardSchemaV1Issue as dI, type StandardSchemaV1SyncResult as dJ, type StoreAuth as dK, type StoreAuthKind as dL, type StoreCapabilities as dM, SyncEngine as dN, type SyncMetadata as dO, type SyncPolicy as dP, SyncScheduler as dQ, type SyncSchedulerStatus as dR, type SyncStatus as dS, type SyncTarget as dT, type SyncTargetRole as dU, SyncTransaction as dV, type SyncTransactionResult as dW, type TabChannel as dX, type TabCoordinationOptions as dY, type TabLockManager as dZ, type TabPresence as d_, type PushMode as da, type PushOptions as db, type PushPolicy as dc, type PushResult as dd, type PutManyItemOptions as de, type PutManyOptions as df, type PutManyResult as dg, type QueryAcrossOptions as dh, type QueryAcrossResult as di, type QuickUnlockState as dj, QuickUnlockStore as dk, type ReAuthOperation as dl, type RecoverPassphraseInput as dm, type RecoverPassphraseResult as dn, type RecoverUserOptions as dp, type RecoveryProof as dq, type ResolvedPublicEnvelopeSchema as dr, type RevokeOptions as ds, type RotatePassphraseInput as dt, type RotateRecoveryOptions as du, type RotateRecoveryResult as dv, SEALED_PASSPHRASE_RECORD_ID as dw, type SchemaDelta as dx, type SchemaIntrospection as dy, type SealedEnvelope as dz, type I18nTextDescriptor as e, savePaperRecoveryEntries as e$, type TierMode as e0, type TranslatorAuditEntry as e1, type TxOp as e2, USER_ENVELOPE_COLLECTION as e3, USER_ENVELOPE_MAX_BYTES as e4, type Unsubscribe as e5, type UpdateAuthenticatorOptions as e6, type UpdateContext as e7, type UpdateUserOptions as e8, UserApi as e9, findAuthenticator as eA, hasExportCapability as eB, hasImportCapability as eC, hasRecoveryEnrolled as eD, isMagicLinkGrantExpired as eE, isPublicEnvelope as eF, issueDelegation as eG, recoverPassphrase as eH, rotatePassphrase as eI, listMagicLinkGrants as eJ, listUsers as eK, listUsersWithEnvelopes as eL, loadActiveDelegations as eM, loadPaperRecoveryEntries as eN, loadSealedPassphrase as eO, loadShamirRecoveryEntries as eP, magicLinkGrantRecordId as eQ, mintPaperRecoveryEntry as eR, mintShamirRecoveryEntry as eS, mintWrappedDeksBlob as eT, parseSealedEnvelope as eU, readMagicLinkGrantRecord as eV, recoverUser as eW, removeAuthenticator as eX, resolveSchema as eY, revokeDelegation as eZ, revokeMagicLinkGrant as e_, type UserEnvelopeCheckGate as ea, UserEnvelopeOversizedError as eb, type UserEnvelopePresented as ec, type UserInfo as ed, type VaultBackup as ee, type VaultPolicyOnDisk as ef, type VaultSchemaSnapshot as eg, type VaultSnapshot as eh, type WarningRules as ei, WeakPassphraseError as ej, type WeakPassphraseReason as ek, type WrappedDeksBlob as el, type WriteConflict as em, type WriteEvent as en, type WriteHook as eo, type WriteQueue as ep, assertStrongPassphrase as eq, buildRecipientKeyringFile as er, burnPaperRecoveryEntry as es, createNoydb as et, createStore as eu, deriveMagicLinkContentKey as ev, enrollAuthenticator as ew, estimateEntropy as ex, evaluateExportCapability as ey, evaluateImportCapability as ez, type I18nTextOptions as f, saveSealedPassphrase as f0, saveShamirRecoveryEntries as f1, unwrapDeksFromBlob as f2, unwrapDeksFromPaperEntry as f3, unwrapDeksFromShamirEntry as f4, unwrapMagicLinkGrant as f5, validatePassphrase as f6, validatePublicEnvelopeInput as f7, validateSchemaInput as f8, validateSchemaOutput as f9, writeMagicLinkGrant as fa, changeSecret as fb, createOwnerKeyring as fc, ensureCollectionDEK as fd, grant as fe, loadKeyring as ff, persistKeyring as fg, revoke as fh, updateAuthenticator as fi, updateKeyringIdentity as fj, applyI18nLocale as g, dictCollectionName as h, dictKey as i, i18nText as j, isDictCollectionName as k, isDictKeyDescriptor as l, isI18nTextDescriptor as m, createEnforcer as n, validateSessionPolicy as o, BLOB_CHUNKS_COLLECTION as p, BLOB_COLLECTION as q, resolveI18nText as r, BLOB_EVICTION_AUDIT_COLLECTION as s, BLOB_INDEX_COLLECTION as t, BLOB_SLOTS_PREFIX as u, validateI18nTextValue as v, BLOB_VERSIONS_PREFIX as w, type BlobEvictionEntry as x, type BlobFieldPolicy as y, type BlobFieldsConfig as z };