@noy-db/hub 0.2.0-pre.3 → 0.2.0-pre.31

package/dist/index.d.ts

@@ -1,21 +1,28 @@
-import { aO as NoydbStore, bo as UserEnvelope, ba as PublicEnvelope, bp as GateName, bq as GatePolicy, br as VaultPolicy, bs as ActiveTier, bt as FactorProof, bu as SchemaUpdateStrategy, bv as TransformFn, bw as PersistedSchemaEnvelope, bx as UpdateDecision, by as DirectoryConfig, bz as UserVisibility, aM as UnlockedKeyring, bf as Vault, aV as DiffEntry } from './types-D9eB0Rvh.js';
-export { bA as AccessibleVault, bB as AffectedDocument, aS as AppendInput, ay as ArrayOutputSpec, p as BLOB_CHUNKS_COLLECTION, q as BLOB_COLLECTION, t as BLOB_INDEX_COLLECTION, u as BLOB_SLOTS_PREFIX, w as BLOB_VERSIONS_PREFIX, bC as BUNDLE_STORE_POLICY, A as BlobObject, C as BlobPutOptions, E as BlobResponseOptions, F as BlobSet, bD as BuiltInGateName, bc as BundleRecipient, _ as CONSENT_AUDIT_COLLECTION, bE as CacheOptions, bF as CacheStats, bG as ChangeEvent, aT as ChangeType, a7 as ClosePeriodOptions, aH as Collection, bH as CollectionChangeEvent, bI as CollectionConflictResolver, bJ as CollectionDescriptor, ao as CollectionFrame, aU as CollectionInstant, bK as CollectionStats, bL as Conflict, bM as ConflictPolicy, bN as ConflictStrategy, $ as ConsentAuditEntry, a0 as ConsentAuditFilter, a1 as ConsentContext, a2 as ConsentOp, bO as CrossTierAccessEvent, L as DEFAULT_CHUNK_SIZE, bP as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, bQ as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, bR as DeepPartial, bS as DeepPartialOrNull, bT as DelegationToken, bU as DeleteManyResult, bV as DerivationDescriptor, aw as DerivationStrategy, aA as DerivationStrategyHandle, aB as DerivedFromMeta, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, bW as DirtyEntry, bX as DryRunResult, bY as DumpSchemaOptions, bZ as ELEVATION_AUDIT_COLLECTION, b_ as ElevatedHandle, aQ as EncryptedEnvelope, b$ as EnrollAuthenticatorOptions, c0 as EnrollAuthenticatorWrappingDEKsOptions, c1 as EnrollAuthenticatorWrappingKEKOptions, c2 as EnrollRecoveryResult, c3 as ExportCapability, c4 as ExportChunk, c5 as ExportFormat, c6 as ExportStreamOptions, c7 as FactorKind, c8 as FactorProofBundle, c9 as FactorRequirement, ca as FenceDoc, cb as FenceState, cc as FieldChange, cd as FieldDescriptor, ce as FieldSource, cf as GhostRecord, cg as GrantOptions, ai as GuardChange, aj as GuardContext, ah as GuardStrategy, al as GuardStrategyHandle, ch as GuardViolation, ci as HistoryConfig, cj as HistoryEntry, aP as HistoryOptions, e as I18nTextDescriptor, f as I18nTextOptions, ck as INDEXED_STORE_POLICY, cl as ImportCapability, cm as InferOutput, cn as InternalCollectionStats, co as IssueDelegationOptions, cp as IssueMagicLinkGrantOptions, aW as JsonPatch, aX as JsonPatchOp, cq as KeyringAuthenticator, cr as KeyringAuthenticatorWrappingDEKs, cs as KeyringAuthenticatorWrappingKEK, ct as KeyringFile, aY as LedgerEntry, aZ as LedgerStore, cu as ListAccessibleVaultsOptions, cv as ListPageResult, cw as ListUsersOptions, cx as LiveUserEnvelope, cy as LocaleReadOptions, cz as Lru, cA as LruOptions, cB as LruStats, cC as MAGIC_LINK_CONTENT_INFO_PREFIX, cD as MAGIC_LINK_GRANTS_COLLECTION, cE as MAGIC_LINK_KEK_INFO_PREFIX, cF as MagicLinkGrantPayload, cG as MagicLinkGrantRecord, bl as MaterializedFromMeta, cH as MaterializedViewDescriptor, bm as MaterializedViewOutput, aE as MaterializedViewStrategy, aF as MaterializedViewStrategyHandle, cI as MemoryRecipientSealer, cJ as MemorySealingKeyProvider, cK as NOYDB_BACKUP_VERSION, cL as NOYDB_FORMAT_VERSION, cM as NOYDB_KEYRING_VERSION, cN as NOYDB_SYNC_VERSION, cO as Noydb, cP as NoydbBundleStore, cQ as NoydbEventMap, cR as NoydbOptions, a8 as OpenPeriodOptions, aC as OutputSpec, cS as OverlayViewDescriptor, aG as OverlayedViewStrategy, aJ as OverlayedViewStrategyHandle, a9 as PERIODS_COLLECTION, cT as PUBLIC_ENVELOPE_FIELDS, cU as PaperRecoveryDoc, cV as PaperRecoveryEntry, cW as PassphrasePolicy, cX as PassphraseValidationResult, aa as PeriodRecord, cY as Permission, cZ as Permissions, c_ as PersistedSchemaKind, c$ as PlaintextTranslatorContext, d0 as PlaintextTranslatorFn, P as PolicyEnforcer, d1 as PresenceHandle, d2 as PresencePeer, aR as PruneOptions, d3 as PublicEnvelopeField, d4 as PublicEnvelopeSchema, d5 as PublicEnvelopeText, d6 as PullMode, d7 as PullOptions, d8 as PullPolicy, d9 as PullResult, da as PushMode, db as PushOptions, dc as PushPolicy, dd as PushResult, de as PutManyItemOptions, df as PutManyOptions, dg as PutManyResult, dh as QueryAcrossOptions, di as QueryAcrossResult, dj as QuickUnlockState, dk as QuickUnlockStore, dl as ReAuthOperation, be as RecipientHint, bd as RecipientSealer, aD as RecordOutputSpec, dm as RecoverPassphraseInput, dn as RecoverPassphraseResult, dp as RecoverUserOptions, dq as RecoveryProof, dr as ResolvedPublicEnvelopeSchema, ds as RevokeOptions, aL as Role, dt as RotatePassphraseInput, du as RotateRecoveryOptions, dv as RotateRecoveryResult, dw as SEALED_PASSPHRASE_RECORD_ID, dx as SchemaDelta, dy as SchemaIntrospection, dz as SealedEnvelope, dA as SealedPassphrase, bb as SealingKeyProvider, dB as SessionPolicy, dC as SetPublicEnvelopeInput, dD as ShamirRecoveryDoc, dE as ShamirRecoveryEntry, bh as ShamirRecoveryProvider, U as SlotInfo, V as SlotRecord, dF as SlotRewrapCeremony, dG as SlotRewrapContext, dH as StandardSchemaV1, dI as StandardSchemaV1Issue, dJ as StandardSchemaV1SyncResult, dK as StoreAuth, dL as StoreAuthKind, dM as StoreCapabilities, dN as SyncEngine, dO as SyncMetadata, dP as SyncPolicy, dQ as SyncScheduler, dR as SyncSchedulerStatus, dS as SyncStatus, dT as SyncTarget, dU as SyncTargetRole, dV as SyncTransaction, dW as SyncTransactionResult, dX as TabChannel, dY as TabCoordinationOptions, dZ as TabLockManager, d_ as TabPresence, d$ as TabRole, e0 as TierMode, e1 as TranslatorAuditEntry, as as TxCollection, at as TxContext, e2 as TxOp, au as TxVault, e3 as USER_ENVELOPE_COLLECTION, e4 as USER_ENVELOPE_MAX_BYTES, bn as UnionSource, e5 as Unsubscribe, e6 as UpdateAuthenticatorOptions, e7 as UpdateContext, e8 as UpdateUserOptions, e9 as UserApi, ea as UserEnvelopeCheckGate, eb as UserEnvelopeOversizedError, ec as UserEnvelopePresented, ed as UserInfo, ee as VaultBackup, a_ as VaultEngine, ap as VaultFrame, a$ as VaultInstant, ef as VaultPolicyOnDisk, eg as VaultSchemaSnapshot, eh as VaultSnapshot, b0 as VerifyResult, W as VersionRecord, ei as WarningRules, ej as WeakPassphraseError, ek as WeakPassphraseReason, el as WrappedDeksBlob, em as WriteConflict, en as WriteEvent, eo as WriteHook, ep as WriteQueue, g as applyI18nLocale, b1 as applyPatch, eq as assertStrongPassphrase, er as buildRecipientKeyringFile, es as burnPaperRecoveryEntry, b2 as canonicalJson, b3 as computePatch, n as createEnforcer, et as createNoydb, eu as createStore, ev as deriveMagicLinkContentKey, h as dictCollectionName, i as dictKey, b4 as diff, ew as enrollAuthenticator, ex as estimateEntropy, ey as evaluateExportCapability, ez as evaluateImportCapability, eA as findAuthenticator, b5 as formatDiff, eB as hasExportCapability, eC as hasImportCapability, eD as hasRecoveryEnrolled, b6 as hashEntry, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, eE as isMagicLinkGrantExpired, eF as isPublicEnvelope, eG as issueDelegation, eH as keyringRecoverPassphrase, eI as keyringRotatePassphrase, eJ as listMagicLinkGrants, eK as listUsers, eL as listUsersWithEnvelopes, eM as loadActiveDelegations, eN as loadPaperRecoveryEntries, eO as loadSealedPassphrase, eP as loadShamirRecoveryEntries, eQ as magicLinkGrantRecordId, eR as mintPaperRecoveryEntry, eS as mintShamirRecoveryEntry, eT as mintWrappedDeksBlob, b7 as paddedIndex, b8 as parseIndex, eU as parseSealedEnvelope, eV as readMagicLinkGrantRecord, eW as recoverUser, eX as removeAuthenticator, r as resolveI18nText, eY as resolvePublicEnvelopeSchema, eZ as revokeDelegation, e_ as revokeMagicLinkGrant, av as runTransaction, e$ as savePaperRecoveryEntries, f0 as saveSealedPassphrase, f1 as saveShamirRecoveryEntries, b9 as sha256Hex, f2 as unwrapDeksFromBlob, f3 as unwrapDeksFromPaperEntry, f4 as unwrapDeksFromShamirEntry, f5 as unwrapMagicLinkGrant, v as validateI18nTextValue, f6 as validatePassphrase, f7 as validatePublicEnvelopeInput, f8 as validateSchemaInput, f9 as validateSchemaOutput, o as validateSessionPolicy, fa as writeMagicLinkGrant } from './types-D9eB0Rvh.js';
-export { d as detectMagic, a as detectMimeType, i as isPreCompressed } from './mime-magic-CBBSOkjm.js';
+import { aW as NoydbStore, bs as UserEnvelope, bc as PublicEnvelope, bt as GateName, bu as GatePolicy, bv as VaultPolicy, bw as ActiveTier, bx as FactorProof, aY as EncryptedEnvelope, by as SchemaUpdateStrategy, bz as TransformFn, bA as PersistedSchemaEnvelope, bB as UpdateDecision, bd as SealingKeyProvider, aU as UnlockedKeyring, bC as DirectoryConfig, bD as UserVisibility, bh as Vault, b1 as DiffEntry } from './index-DHn9lEP0.js';
+export { bE as AccessibleVault, bF as AffectedDocument, a_ as AppendInput, bG as ApproveWithdrawalOptions, bH as ArchivePolicy, bI as ArchiveResult, bJ as ArchiveRunOptions, bK as ArchiveStrategy, aE as ArrayOutputSpec, o as BLOB_CHUNKS_COLLECTION, p as BLOB_COLLECTION, r as BLOB_INDEX_COLLECTION, t as BLOB_SLOTS_PREFIX, u as BLOB_VERSIONS_PREFIX, bL as BUNDLE_STORE_POLICY, z as BlobObject, A as BlobPutOptions, C as BlobResponseOptions, E as BlobSet, bM as BuiltInGateName, be as BundleRecipient, a4 as CONSENT_AUDIT_COLLECTION, bN as CacheOptions, bO as CacheStats, bP as ChangeEvent, a$ as ChangeType, ad as ClosePeriodOptions, aN as Collection, bQ as CollectionChangeEvent, bR as CollectionConfig, bS as CollectionConflictResolver, bT as CollectionDescription, bU as CollectionDescriptor, au as CollectionFrame, b0 as CollectionInstant, bV as CollectionMeta, bW as CollectionStats, bX as ComputedFieldError, bY as ComputedFields, bZ as ComputedFn, b_ as Conflict, b$ as ConflictPolicy, c0 as ConflictStrategy, a5 as ConsentAuditEntry, a6 as ConsentAuditFilter, a7 as ConsentContext, a8 as ConsentOp, c1 as CrossTierAccessEvent, c2 as CustodyApi, K as DEFAULT_CHUNK_SIZE, c3 as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, c4 as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, c5 as DeepPartial, c6 as DeepPartialOrNull, c7 as DeferredNumberingConfig, c8 as DelegationToken, c9 as DeleteManyResult, ca as DerivationDescriptor, aC as DerivationStrategy, aG as DerivationStrategyHandle, aH as DerivedFromMeta, cb as DescribeOptions, cc as DescribedField, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, cd as DirtyEntry, ce as DryRunResult, cf as DumpSchemaOptions, cg as ELEVATION_AUDIT_COLLECTION, ch as ElevatedHandle, ci as EmbeddingDescriptor, cj as EnrollAuthenticatorOptions, ck as EnrollAuthenticatorWrappingDEKsOptions, cl as EnrollAuthenticatorWrappingKEKOptions, cm as EnrollRecoveryResult, cn as ExportAccessibleOptions, co as ExportCapability, cp as ExportChunk, cq as ExportFormat, cr as ExportStreamOptions, cs as FactorKind, ct as FactorProofBundle, cu as FactorRequirement, cv as FenceDoc, cw as FenceState, cx as FieldChange, cy as FieldDescriptor, cz as FieldMeta, cA as FieldSource, cB as FormattedSequenceHandle, cC as FrozenSnapshotRef, cD as GhostRecord, cE as GrantCustodianOptions, cF as GrantOptions, ao as GuardChange, ap as GuardContext, an as GuardStrategy, ar as GuardStrategyHandle, cG as GuardViolation, cH as HistoryConfig, cI as HistoryEntry, aX as HistoryOptions, cJ as INDEXED_STORE_POLICY, cK as ImportCapability, cL as InferOutput, cM as InternalCollectionStats, cN as IssueDelegationOptions, cO as IssueMagicLinkGrantOptions, b2 as JsonPatch, b3 as JsonPatchOp, cP as KeyringAuthenticator, cQ as KeyringAuthenticatorWrappingDEKs, cR as KeyringAuthenticatorWrappingKEK, cS as KeyringFile, b4 as LedgerStore, cT as LiberateOptions, cU as LiberateResult, cV as LinkEndpointError, cW as LinkIntegrityError, cX as LinkOnDelete, cY as LinkRow, cZ as LinkSetHandle, c_ as LinkSpec, c$ as ListAccessibleVaultsOptions, d0 as ListPageResult, d1 as ListUsersOptions, d2 as LiveUserEnvelope, d3 as LocaleReadOptions, d4 as Lru, d5 as LruOptions, d6 as LruStats, d7 as MAGIC_LINK_CONTENT_INFO_PREFIX, d8 as MAGIC_LINK_GRANTS_COLLECTION, d9 as MAGIC_LINK_KEK_INFO_PREFIX, da as MagicLinkGrantPayload, db as MagicLinkGrantRecord, bo as MaterializedFromMeta, dc as MaterializedViewDescriptor, bp as MaterializedViewOutput, aK as MaterializedViewStrategy, aL as MaterializedViewStrategyHandle, dd as MemoryRecipientSealer, de as MemorySealingKeyProvider, df as NOYDB_BACKUP_VERSION, dg as NOYDB_FORMAT_VERSION, dh as NOYDB_KEYRING_VERSION, di as NOYDB_SYNC_VERSION, dj as NextOptions, dk as Noydb, aw as NoydbBundleStore, dl as NoydbEventMap, dm as NoydbOptions, dn as NumberingAssignment, T as ObjectListEntry, U as ObjectMeta, V as ObjectProjection, W as ObjectUrlOptions, ae as OpenPeriodOptions, aI as OutputSpec, aO as OverlayFieldMergeMode, aP as OverlayFieldMergeRule, dp as OverlayViewDescriptor, aM as OverlayedViewStrategy, aR as OverlayedViewStrategyHandle, af as PERIODS_COLLECTION, dq as PUBLIC_ENVELOPE_FIELDS, dr as PaperRecoveryDoc, ds as PaperRecoveryEntry, dt as PassphrasePolicy, du as PassphraseValidationResult, ag as PeriodRecord, dv as Permission, dw as Permissions, dx as PersistedSchemaKind, dy as PlaintextTranslatorContext, dz as PlaintextTranslatorFn, P as PolicyEnforcer, dA as PresenceHandle, dB as PresencePeer, aZ as PruneOptions, dC as PublicEnvelopeField, dD as PublicEnvelopeSchema, dE as PublicEnvelopeText, dF as PullMode, dG as PullOptions, dH as PullPolicy, dI as PullResult, dJ as PushMode, dK as PushOptions, dL as PushPolicy, dM as PushResult, dN as PutManyItemOptions, dO as PutManyOptions, dP as PutManyResult, X as PutObjectOptions, Y as PutUrlOptions, dQ as QueryAcrossOptions, dR as QueryAcrossResult, dS as QuickUnlockState, dT as QuickUnlockStore, dU as ReAuthOperation, bg as RecipientHint, bf as RecipientSealer, aJ as RecordOutputSpec, dV as RecoverPassphraseInput, dW as RecoverPassphraseResult, dX as RecoverUserOptions, dY as RecoveryProof, dZ as RejectWithdrawalOptions, d_ as RequestWithdrawalOptions, d$ as RequestWithdrawalResult, e0 as ResolvedPublicEnvelopeSchema, ax as RetentionPolicy, e1 as RetrieveHit, e2 as RetrieveOptions, e3 as RevokeOptions, aT as Role, e4 as RotatePassphraseInput, e5 as RotateRecoveryOptions, e6 as RotateRecoveryResult, e7 as SEALED_PASSPHRASE_RECORD_ID, e8 as SchemaDelta, e9 as SchemaIntrospection, S as ScriptWarning, ea as SealedEnvelope, eb as SealedPassphrase, ec as SearchEntry, ed as SearchOptions, ee as SearchResult, ef as SemanticType, eg as SequenceHandle, eh as SequenceOptions, ei as SequenceStore, ej as SessionPolicy, ek as SetPublicEnvelopeInput, el as ShamirRecoveryDoc, em as ShamirRecoveryEntry, bj as ShamirRecoveryProvider, Z as SlotInfo, _ as SlotRecord, en as SlotRewrapCeremony, eo as SlotRewrapContext, aA as SnapshotMeta, ep as StandardSchemaV1, eq as StandardSchemaV1Issue, er as StandardSchemaV1SyncResult, e as StaticDictDescriptor, es as StoreAuth, et as StoreAuthKind, eu as StoreCapabilities, ev as StoreTime, ew as SyncEngine, ex as SyncMetadata, ey as SyncPolicy, ez as SyncScheduler, eA as SyncSchedulerStatus, eB as SyncStatus, eC as SyncTarget, eD as SyncTargetRole, eE as SyncTransaction, eF as SyncTransactionResult, eG as TabChannel, eH as TabCoordinationOptions, eI as TabLockManager, eJ as TabPresence, eK as TabRole, eL as TierMode, eM as TransactionInvariant, eN as TranslatorAuditEntry, eO as TxCollection, bk as TxContext, eP as TxOp, eQ as TxVault, eR as USER_ENVELOPE_COLLECTION, eS as USER_ENVELOPE_MAX_BYTES, bq as UnionArmJoin, br as UnionSource, eT as Unsubscribe, eU as UpdateAuthenticatorOptions, eV as UpdateContext, eW as UpdateUserOptions, eX as UserApi, eY as UserEnvelopeCheckGate, eZ as UserEnvelopeOversizedError, e_ as UserEnvelopePresented, e$ as UserInfo, f0 as VaultBackup, b5 as VaultEngine, av as VaultFrame, b6 as VaultInstant, f1 as VaultMeta, f2 as VaultPolicyOnDisk, f3 as VaultSchemaSnapshot, f4 as VaultSnapshot, b7 as VerifyResult, $ as VersionRecord, f5 as WarningRules, f6 as WeakPassphraseError, f7 as WeakPassphraseReason, f8 as WithArchiveOptions, f9 as WithdrawAccessibleOptions, fa as WithdrawResult, fb as WithdrawalRequest, fc as WithdrawalRequestError, fd as WithdrawalRequestStatus, fe as WrappedDeksBlob, ff as WriteConflict, fg as WriteEvent, fh as WriteHook, fi as WriteQueue, fj as aesGcmOpen, b8 as applyPatch, fk as approveWithdrawal, fl as assertStrongPassphrase, fm as buildRecipientKeyringFile, fn as burnPaperRecoveryEntry, fo as compileSequenceFormat, b9 as computePatch, n as createEnforcer, fp as createNoydb, fq as createStore, fr as deriveMagicLinkContentKey, f as dictCollectionName, g as dictKey, ba as diff, h as enforceScript, fs as enrollAuthenticator, ft as estimateEntropy, fu as evalComputedFields, fv as evaluateExportCapability, fw as evaluateImportCapability, fx as exportAccessibleData, fy as findAuthenticator, bb as formatDiff, fz as hasExportCapability, fA as hasImportCapability, fB as hasRecoveryEnrolled, i as inferScripts, j as isDictCollectionName, k as isDictKeyDescriptor, fC as isLinkCollectionName, fD as isMagicLinkGrantExpired, fE as isPublicEnvelope, l as isStaticDictDescriptor, fF as issueDelegation, fG as keyringRecoverPassphrase, fH as keyringRotatePassphrase, fI as liberateVault, fJ as listMagicLinkGrants, fK as listUsers, fL as listUsersWithEnvelopes, fM as listWithdrawalRequests, fN as loadActiveDelegations, fO as loadPaperRecoveryEntries, fP as loadSealedPassphrase, fQ as loadShamirRecoveryEntries, fR as magicLinkGrantRecordId, a1 as memoryObjectProjection, fS as mintPaperRecoveryEntry, fT as mintShamirRecoveryEntry, fU as mintWrappedDeksBlob, fV as parseRsaOaepTlv, fW as parseSealedEnvelope, fX as readMagicLinkGrantRecord, fY as recoverUser, fZ as rejectWithdrawal, f_ as removeAuthenticator, f$ as requestWithdrawal, g0 as resolvePublicEnvelopeSchema, g1 as resolveSequenceKey, g2 as revokeDelegation, g3 as revokeMagicLinkGrant, g4 as runTransaction, g5 as savePaperRecoveryEntries, g6 as saveSealedPassphrase, g7 as saveShamirRecoveryEntries, g8 as sealRsaOaepTlv, s as staticDict, g9 as unwrapDeksFromBlob, ga as unwrapDeksFromPaperEntry, gb as unwrapDeksFromShamirEntry, gc as unwrapMagicLinkGrant, gd as validatePassphrase, ge as validatePublicEnvelopeInput, gf as validateSchemaInput, gg as validateSchemaOutput, v as validateSessionPolicy, gh as withArchive, gi as withDeferredNumbering, gj as withdrawAccessibleData, gk as writeMagicLinkGrant } from './index-DHn9lEP0.js';
+export { I as ImportExternalOptions, a as ImportExternalResult, b as ImportableCollection, d as detectMagic, c as detectMimeType, i as importExternalObjects, e as isPreCompressed } from './mime-magic-JeLKHRng.js';
 export { AgeRoute, BlobLifecyclePolicy, BlobStoreRoute, CircuitBreakerOptions, HealthCheckOptions, LogLevel, LoggingOptions, MetricsOptions, OverrideOptions, OverrideTarget, RetryOptions, RouteStatus, RouteStoreOptions, RoutedNoydbStore, StoreCacheOptions, StoreMiddleware, StoreOperation, SuspendOptions, WrapBundleStoreOptions, WrappedBundleNoydbStore, createBundleStore, routeStore, withCache, withCircuitBreaker, withHealthCheck, withLogging, withMetrics, withRetry, wrapBundleStore, wrapStore } from './store/index.js';
-import { N as NoydbError } from './index-BF1B2HB9.js';
-export { x as AlreadyElevatedError, A as AmendmentForbiddenError, m as AttestationError, B as BackupCorruptedError, o as BackupLedgerError, p as BundleIntegrityError, q as BundleSealMismatchError, r as BundleVersionConflictError, C as ConflictError, y as DEFAULT_JOIN_MAX_ROWS, z as DanglingReferenceError, E as DecryptionError, G as DelegationTargetMissingError, e as DerivationCapExceededError, f as DerivationCycleError, g as DerivationDepthError, h as DerivationOutputShapeError, i as DerivationOutputUnknownError, D as DictKeyInUseError, a as DictKeyMissingError, H as DirectoryDisabledError, J as ElevationExpiredError, K as ExportCapabilityError, F as FieldFrozenError, U as FilenameSanitizationError, V as GroupCardinalityError, W as ImportCapabilityError, X as IndexRequiredError, Y as IndexWriteFailureError, Z as InvalidKeyError, I as InvariantError, _ as JoinContext, $ as JoinLeg, a0 as JoinStrategy, a1 as JoinTooLargeError, a2 as JoinableSource, a3 as KeyringCorruptError, a4 as KeyringExpiredError, a5 as LedgerContentionError, a6 as LiveQuery, a7 as LiveUpstream, L as LocaleNotSpecifiedError, t as MaterializedViewConfigError, u as MaterializedViewCycleError, v as MaterializedViewSourceUnknownError, w as MaterializedViewTooLargeError, a8 as MigrationRequiredError, M as MissingTranslationError, a9 as NetworkError, aa as NoAccessError, ab as NonAdditiveSchemaChangeError, ac as NotFoundError, ad as OrderBy, O as OverlayBaseIsVirtualError, j as OverlayCollectionUnavailableError, k as OverlayIdMismatchError, l as OverlayNameCollisionError, ae as PathEscapeError, af as PeriodClosedError, ag as PermissionDeniedError, ah as PrivilegeEscalationError, Q as Query, ai as QueryPlan, aj as QuerySource, ak as QuiesceTimeoutError, al as ReadOnlyAtInstantError, am as ReadOnlyError, an as ReadOnlyFrameError, d as RecordLockedError, ao as RefDescriptor, ap as RefIntegrityError, aq as RefMode, ar as RefRegistry, as as RefScopeError, at as RefViolation, R as ReservedCollectionNameError, au as ScanBuilder, av as ScanPageProvider, aw as SchemaFenceError, ax as SchemaLockedError, ay as SchemaUpdateError, az as SchemaValidationError, S as SessionExpiredError, b as SessionNotFoundError, c as SessionPolicyError, aA as StoreCapabilityError, aB as TamperedError, aC as TierDemoteDeniedError, aD as TierNotGrantedError, T as TranslatorNotConfiguredError, aE as ValidationError, aF as applyJoins, aG as buildLiveQuery, aH as executePlan, aI as ref, aJ as resetJoinWarnings } from './index-BF1B2HB9.js';
-export { A as AutoCredential, n as AutoCredentialKind, c as CompressionAlgo, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, j as generateULID, o as hasNoydbBundleMagic, k as isULID, r as readNoydbBundle, l as readNoydbBundleHeader, p as readNoydbBundlePublicEnvelope, m as resetBrotliSupportCache, w as writeNoydbBundle } from './ulid-CiM2OAeM.js';
+import { N as NoydbError } from './errors-BAWO5Z5a.js';
+export { H as AlreadyElevatedError, A as AmendmentForbiddenError, s as AttestationError, B as BackupCorruptedError, u as BackupLedgerError, v as BundleIntegrityError, w as BundleSealMismatchError, x as BundleVersionConflictError, J as ConflictError, K as CrossJoinSourceUnknownError, Q as CrossJoinTooLargeError, V as DanglingReferenceError, W as DataResidencyError, X as DebugPlaintextError, Y as DebugReservedFieldError, Z as DecryptionError, _ as DelegationTargetMissingError, i as DerivationCapExceededError, j as DerivationCycleError, k as DerivationDepthError, l as DerivationOutputShapeError, m as DerivationOutputUnknownError, D as DictKeyInUseError, a as DictKeyMissingError, $ as DirectoryDisabledError, a0 as ElevationExpiredError, a1 as EmbeddingDimMismatchError, a2 as EmbeddingModelMismatchError, a3 as ExportCapabilityError, F as FieldFrozenError, a4 as FilenameSanitizationError, a5 as ForgetStrategyNotConfiguredError, a6 as GroupCardinalityError, I as IllegalTransitionError, a7 as ImportCapabilityError, a8 as IndexRequiredError, a9 as IndexWriteFailureError, aa as InvalidKeyError, f as InvariantError, ab as JoinTooLargeError, ac as KeyringCorruptError, ad as KeyringExpiredError, ae as LedgerContentionError, L as LocaleNotSpecifiedError, z as MaterializedViewConfigError, C as MaterializedViewCycleError, E as MaterializedViewSourceUnknownError, G as MaterializedViewTooLargeError, af as MigrationRequiredError, M as MissingTranslationError, ag as NetworkError, ah as NoAccessError, ai as NonAdditiveSchemaChangeError, aj as NotFoundError, ak as NumberingUncertaintyError, O as OverlayBaseIsVirtualError, n as OverlayCollectionUnavailableError, o as OverlayIdMismatchError, p as OverlayNameCollisionError, al as PathEscapeError, am as PeriodClosedError, an as PermissionDeniedError, ao as PrivilegeEscalationError, ap as QuiesceTimeoutError, aq as ReadOnlyAtInstantError, ar as ReadOnlyError, as as ReadOnlyFrameError, at as RecordCekNotFoundError, g as RecordLockedError, R as ReservedCollectionNameError, au as ReservedVaultNameError, av as SchemaFenceError, aw as SchemaLockedError, ax as SchemaUpdateError, ay as SchemaValidationError, S as ScriptViolationError, q as SealedRecordExpiredError, r as SealedRecordMismatchError, az as SequenceContentionError, aA as SequenceOfflineError, c as SessionExpiredError, d as SessionNotFoundError, e as SessionPolicyError, aB as ShardProvisioningError, h as SnapshotNotFoundError, b as StaticDictReadonlyError, aC as StoreCapabilityError, aD as TamperedError, aE as TierDemoteDeniedError, aF as TierNotGrantedError, T as TranslatorNotConfiguredError, aG as UniqueConstraintError, U as UnknownDictCodeError, aH as UnknownShardError, aI as UnsupportedIndexOptionError, aJ as ValidationError, aK as VaultTemplateNotFoundError } from './errors-BAWO5Z5a.js';
+export { A as AutoCredential, m as AutoCredentialKind, c as CompressionAlgo, D as DecryptedRecord, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, i as decryptExtractedPartition, n as hasNoydbBundleMagic, r as readNoydbBundle, k as readNoydbBundleHeader, o as readNoydbBundlePublicEnvelope, l as resetBrotliSupportCache, w as writeNoydbBundle } from './decrypt-partition-CXS5KopB.js';
+export { g as generateULID, i as isULID } from './ulid-DRH25k3y.js';
+export { D as DEFAULT_CROSS_JOIN_MAX_ROWS, a as DEFAULT_JOIN_MAX_ROWS, J as JoinContext, b as JoinLeg, c as JoinStrategy, d as JoinableSource, L as LiveQuery, e as LiveUpstream, O as OrderBy, Q as Query, f as QueryPlan, g as QuerySource, R as RefDescriptor, h as RefIntegrityError, i as RefMode, j as RefRegistry, k as RefScopeError, l as RefViolation, S as ScanBuilder, m as ScanPageProvider, n as applyJoins, o as buildLiveQuery, p as executePlan, q as isRefArray, r as ref, s as refArray, t as resetJoinWarnings } from './index-Ddm8D3Oo.js';
+export { L as LedgerEntry, c as canonicalJson, h as hashEntry, p as paddedIndex, a as parseIndex, s as sha256Hex } from './index-BMmajblo.js';
 export { a as CrdtMode, b as CrdtState, L as LwwMapState, R as RgaState, Y as YjsState, m as mergeCrdtStates, r as resolveCrdtSnapshot } from './strategy-BSxFXGzb.js';
-export { w as withGuard } from './with-guard-DR7U-l4v.js';
-export { w as withDerivation } from './with-derivation-Bzpj6UTv.js';
-export { w as withMaterializedView } from './with-materialized-view-qtoJ3xKJ.js';
-export { a as Clause, C as CollectionIndexes, F as FieldClause, b as FilterClause, G as GroupClause, H as HashIndex, I as IndexDef, O as Operator, e as evaluateClause, c as evaluateFieldClause, r as readPath } from './predicate-Dnu81tsS.js';
-export { w as withOverlayedView } from './with-overlayed-view-DFaRfgMr.js';
+export { F as FuseOptions, b as base64ToBuffer, a as bufferToBase64, d as decryptBytes, c as decryptDeterministic, e as derivePresenceKey, f as encryptBytes, g as encryptDeterministic, h as fuseRetrieval } from './index-BmhGztUi.js';
+export { TransactionStrategyOptions } from './tx/index.js';
+export { I as ImmutableGuardConfig, T as TransitionGuardConfig, i as immutableGuard, t as transitionGuard, w as withGuard } from './transition-guard-Dy3NioQr.js';
+import { M as RoundingMode } from './strategy-8QGs5KQE.js';
+export { j as AggregateResult, k as AggregateSpec, l as Aggregation, m as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, n as GROUPBY_WARN_CARDINALITY, o as GroupedAggregation, p as GroupedQuery, q as GroupedQueryN, t as GroupedRow, u as GroupedRowN, I as I18nMap, a as I18nTextDescriptor, b as I18nTextOptions, L as Layer, w as LiveAggregation, N as MoneyCurrencyError, P as MoneyDescriptor, Q as MoneyOptions, S as MoneyOptionsFixed, T as MoneyOptionsMulti, U as MoneyPrecisionError, V as MoneyUnsupportedError, O as OnMissing, c as OnMissingPolicy, x as Reducer, y as ReducerOptions, R as ResolveI18nOptions, d as applyI18nLocale, z as avg, C as count, D as groupAndReduce, i as i18nText, e as isI18nTextDescriptor, W as isMoneyDescriptor, E as max, F as min, X as money, H as reduceRecords, r as resolveI18nText, f as resolvePolicy, K as sum, v as validateI18nTextValue } from './strategy-8QGs5KQE.js';
+export { w as withDerivation, a as withRollup } from './with-rollup-CbU-O4wP.js';
+export { w as withMaterializedView } from './with-materialized-view-DIVeez0W.js';
+export { a as Clause, C as CollectionIndexes, F as FieldClause, b as FilterClause, G as GroupClause, H as HashIndex, I as IndexDef, O as Operator, e as evaluateClause, c as evaluateFieldClause, r as readPath } from './predicate-BmhBSPCH.js';
+export { w as withOverlayedView } from './with-overlayed-view-DVZrc5Hb.js';
 export { SYNC_CREDENTIALS_COLLECTION, SyncCredential, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential } from './team/index.js';
-export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-Cf2B7Kih.js';
-export { a as AggregateResult, b as AggregateSpec, c as Aggregation, d as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, e as GROUPBY_WARN_CARDINALITY, f as GroupedAggregation, g as GroupedQuery, h as GroupedQueryN, i as GroupedRow, j as GroupedRowN, L as LiveAggregation, R as Reducer, k as ReducerOptions, l as avg, n as count, o as groupAndReduce, p as max, q as min, r as reduceRecords, t as sum } from './strategy-DSTrsZ8t.js';
-export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-gVn_uKhp.js';
-import './lazy-builder-Rpd-V3jP.js';
+export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-CnHTTVea.js';
+export { i as isDiscriminant } from './discriminant-BN9REW3o.js';
+export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-oc5paYl0.js';
+import './lazy-builder-ChSqcF5t.js';
 import '@noy-db/attestation';
 
 /**
@@ -72,6 +79,19 @@ declare function deleteUserEnvelope(store: NoydbStore, vault: string, keyringId:
  */
 declare function listUserEnvelopeIds(store: NoydbStore, vault: string): Promise<string[]>;
 
+/**
+ * Default text tokenizer for scan-mode search (#308).
+ *
+ * NFKC-normalize → lowercase → split on Unicode letter/number runs. This is a
+ * word-boundary tokenizer: it does **not** segment scripts written without
+ * inter-word spaces (Thai, Lao, Khmer, CJK) — those collapse to one token per
+ * run. For such data, a dictionary/ICU segmenter is the right `tokenizer`
+ * (the engine takes one as a parameter); substring/`contains` matching is the
+ * pragmatic fallback until then. See the #308 design note.
+ */
+type Tokenizer = (text: string) => string[];
+declare const tokenize: Tokenizer;
+
 /**
  * Cache policy helpers — parse human-friendly byte budgets into raw numbers.
  *
@@ -162,15 +182,14 @@ declare class PolicyDeniedError extends NoydbError {
  * MUST have at least one recovery path enrolled before being
  * production-ready (paper, shamir, multi-channel, or admin-mediated).
  *
- * The error references issue #10 in its message so a developer hitting
- * it gets a one-line pointer to the design.
+ * The error message carries a pointer to the recovery design docs.
  */
 declare class RecoveryNotEnrolledError extends NoydbError {
     constructor(message?: string);
 }
 /**
  * Raised by `openVault` when a managed-passphrase-mode vault has no
- * STRONG recovery profile enrolled (#195).
+ * STRONG recovery profile enrolled.
  *
  * Managed mode means the user never types a passphrase — the unlock
  * material lives in a `SealingKeyProvider` (`at-*` package). If that
@@ -196,9 +215,8 @@ declare class ManagedRecoveryNotEnrolledError extends NoydbError {
  * `db.rotateRecovery` when the developer requests a recovery profile
  * not yet wired in this hub release.
  *
- * Implemented: `paper` (#10, pre.5) and `shamir` (#196 slice 1, pre.16).
- * Pending: `multi-channel` and `admin-mediated` (tracked under #196
- * follow-up slices).
+ * Implemented: `paper` and `shamir`.
+ * Pending: `multi-channel` and `admin-mediated` (follow-up slices).
  *
  * The carried `profile` and `tracking` fields let consumers steer the
  * UI ("multi-channel recovery is not yet wired up — open issue #N to follow").
@@ -339,6 +357,32 @@ declare function loadVaultPolicy(store: NoydbStore, vault: string): Promise<Vaul
  */
 declare function saveVaultPolicy(store: NoydbStore, vault: string, policy: VaultPolicy): Promise<void>;
 
+/**
+ * Helpers for reading records out of a *plaintext* store (`encrypt: false`)
+ * with native tooling — the programmatic core of a `noydb cat`-style unwrap.
+ * See the plaintext/debug-store-mode design.
+ */
+
+/**
+ * Extract the record from a plaintext stored envelope, handling both layouts:
+ *
+ *   - **classic plaintext** (`encrypt: false`): the record is JSON in `_data`.
+ *   - **debugPlaintext**: the record's fields are inlined beside the
+ *     `_`-prefixed metadata (marked by `_debug`).
+ *
+ * Returns `null` for an empty/absent body. Throws if handed an **encrypted**
+ * envelope (non-empty `_iv`) — there is no key here; decrypt through the vault
+ * instead. Intended for record envelopes, not blob chunks.
+ *
+ * @example
+ * ```ts
+ * // node script over a to-file store, no vault needed:
+ * const env = JSON.parse(readFileSync('data/acme/invoices/inv-1.json', 'utf8'))
+ * console.log(readPlaintextRecord(env)) // → { id: 'inv-1', total: '120.00', … }
+ * ```
+ */
+declare function readPlaintextRecord<T = Record<string, unknown>>(envelope: EncryptedEnvelope): T | null;
+
 /** Allow any schema change. Explicit blind / back-compat. */
 declare function blindUpdate(): SchemaUpdateStrategy;
 /** Allow additive changes; reject non-additive ones. The safety backstop. */
@@ -351,16 +395,25 @@ declare function lockSchema(opts?: {
     readonly fields?: readonly string[];
 }): SchemaUpdateStrategy;
 
-/** The coordinatedCutover update strategy (#232, single-step — no from/to). */
+/** The coordinatedCutover update strategy (single-step — no from/to). */
 
 declare function coordinatedCutover(opts: {
     readonly transform: TransformFn;
 }): SchemaUpdateStrategy;
 
+/**
+ * Hub-core constants that must be referenceable without pulling any
+ * subsystem chunk. Kept import-free.
+ */
+/** Reserved fleet-wide control-plane vault name. Hub reserves it for an outward orchestration framework's state/control-plane vault. */
+declare const STATE_VAULT_NAME = "__noydb_state__";
+
 /**
  * Derive a {@link PersistedSchemaEnvelope} from a Standard Schema v1
- * validator. v0 supports Zod via `zod-to-json-schema` (optional peer-dep);
- * other families write a stub envelope flagging the kind.
+ * validator. Supports zod 3 (via the optional `zod-to-json-schema` peer-dep)
+ * and zod 4 (via its native `z.toJSONSchema()`); both are loaded lazily so
+ * hub never statically imports zod. Other validator families write a stub
+ * envelope flagging the kind.
  *
  * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
  *
@@ -368,9 +421,10 @@ declare function coordinatedCutover(opts: {
  */
 
 /**
- * Heuristic Zod detection — Zod schemas carry a `_def.typeName` property
- * starting with `Zod` (e.g. `ZodObject`, `ZodString`). This survives Zod's
- * minor-version bumps because the typeName naming is stable across v3.
+ * Heuristic Zod detection — uses the Standard Schema v1 `~standard.vendor`
+ * property (present in Zod v3.23+ and Zod v4+). Falls back to the
+ * `_def.typeName` heuristic for older Zod v3 builds that predate Standard
+ * Schema support.
  */
 declare function isZodSchema(value: unknown): boolean;
 declare function derivePersistedSchema(validator: unknown): Promise<PersistedSchemaEnvelope>;
@@ -431,7 +485,7 @@ interface PersistSchemaResult {
     readonly skipped: boolean;
     /** The envelope that was either written or matched. */
     readonly envelope: PersistedSchemaEnvelope;
-    /** The update-strategy decision, present when strategies ran (#245). */
+    /** The update-strategy decision, present when strategies ran. */
     readonly decision?: UpdateDecision;
 }
 declare function persistSchemaIfNeeded(opts: {
@@ -444,7 +498,91 @@ declare function persistSchemaIfNeeded(opts: {
 }): Promise<PersistSchemaResult>;
 
 /**
- * Authentication introspection — issue #13.
+ * FR-6 — Deed: sealed / hidden-owner provisioning.
+ *
+ * A **Deed** is a vault owned by a *latent* principal who never
+ * authenticates. The owner credential (the random passphrase that
+ * derives `KEK_owner`) is minted machine-side and sealed under a
+ * **non-firm** {@link SealingKeyProvider} — that sealing boundary is
+ * the cryptographic *inalienability anchor*: whoever holds the
+ * provider (the client / their KMS) is the only party that can ever
+ * re-derive `KEK_owner`. A firm-side custodian operates the vault
+ * fully but can never reach the owner key — there is deliberately NO
+ * firm-controlled fallback.
+ *
+ * Provisioning reuses the managed-mode seam:
+ *   - {@link resolveManagedSecret} mints + seals + persists the random
+ *     passphrase at `_meta/sealed-passphrase` (and unseals it on every
+ *     subsequent open through the same provider).
+ *   - {@link createOwnerKeyring} derives `KEK_owner` from that
+ *     passphrase and writes the `_keyring/<ownerUserId>` file.
+ *
+ * On top of that, a Deed writes a `_meta/deed` **marker**. The marker
+ * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH
+ * sealing boundary protects them, so it must be readable without
+ * unlocking the vault (a custodian or auditor inspecting the vault must
+ * be able to see "this is a Deed vault, owner = X, sealed under Y"
+ * without any key). The marker itself is therefore never sealed; only
+ * the owner *credential* is.
+ *
+ * @module
+ */
+
+/** Reserved id for the Deed marker under `_meta`. */
+declare const DEED_RECORD_ID: "deed";
+/**
+ * Plaintext metadata recording a vault's latent-owner Deed. Persisted
+ * at `_meta/deed`. Readable without unlocking the vault by design — it
+ * carries no secret material, only the identity of the latent owner
+ * and the sealing boundary that anchors inalienability.
+ */
+interface DeedMarker {
+    /** The latent owner principal — the user id of the `_keyring/<id>` owner file. */
+    readonly ownerUserId: string;
+    /**
+     * The `SealingKeyProvider.id` the owner credential is sealed under.
+     * The inalienability anchor: only the holder of this (non-firm)
+     * provider can re-derive `KEK_owner`. Audit metadata — never secret.
+     */
+    readonly sealedUnder: string;
+    /** Always `true` for a Deed — the owner never authenticates interactively. */
+    readonly latent: true;
+    /** ISO-8601 timestamp the Deed was issued. */
+    readonly issuedAt: string;
+    /**
+     * ISO-8601 timestamp the vault was liberated (a new owner claimed it
+     * via the audited Liberate ceremony), if any. Absent until liberation.
+     */
+    readonly liberatedAt?: string;
+}
+/**
+ * Provision a Deed: a latent owner whose credential is sealed under
+ * `sealing` (a NON-firm provider). Mints + seals the owner passphrase
+ * via {@link resolveManagedSecret}, derives the owner keyring via
+ * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`
+ * marker. Returns the unlocked owner keyring.
+ *
+ * The returned keyring is the only in-memory window onto `KEK_owner`
+ * for this call; the persistent re-entry point is the sealing provider
+ * (re-run {@link resolveManagedSecret} with the same provider to
+ * re-resolve the passphrase, then {@link createOwnerKeyring}/load to
+ * unlock — no interactive passphrase is ever required).
+ *
+ * There is deliberately no firm-controlled fallback: the marker's
+ * `sealedUnder` is the single cryptographic anchor of ownership.
+ */
+declare function createDeedOwner(store: NoydbStore, vault: string, ownerUserId: string, sealing: SealingKeyProvider): Promise<UnlockedKeyring>;
+/**
+ * Read the {@link DeedMarker} from `_meta/deed`, or `null` if the vault
+ * has no Deed marker (i.e. it is not a Deed vault). Plaintext read — no
+ * unlocking required.
+ */
+declare function loadDeedMarker(store: NoydbStore, vault: string): Promise<DeedMarker | null>;
+/** Whether `vault` carries a Deed marker (a sealed/latent owner). */
+declare function isDeedVault(store: NoydbStore, vault: string): Promise<boolean>;
+
+/**
+ * Authentication introspection.
  *
  * Three surfaces over the configured tier model and the actual
  * per-user enrollment state:
@@ -566,60 +704,168 @@ declare function persistUserVisibility(store: NoydbStore, vault: string, keyring
  */
 declare function deleteUserVisibility(store: NoydbStore, vault: string, keyringId: string): Promise<void>;
 
-interface EncryptResult {
-    iv: string;
-    data: string;
-}
 /**
- * Encrypt raw bytes with AES-256-GCM using a fresh random IV.
- * Used by the attachment store so binary blobs avoid double base64 encoding
- * (the existing `encrypt()` function calls `TextEncoder` on a string — here
- * we pass the `Uint8Array` directly to `subtle.encrypt`).
+ * Return the ISO-4217 minor-unit scale for a currency code, or `null`
+ * when the code is not in the known set (caller must supply an explicit
+ * scale).
  */
-declare function encryptBytes(data: Uint8Array, dek: CryptoKey): Promise<EncryptResult>;
+declare function scaleForCurrency(code: string): number | null;
+
 /**
- * Decrypt AES-256-GCM ciphertext back to raw bytes.
- * Counterpart to `encryptBytes`. Throws `TamperedError` on auth-tag failure.
+ * Money-aware aggregation: exact `sum` / `min` / `max` over money
+ * fields.
+ *
+ * The generic reducers (`aggregate/reducers.ts`) read a field via
+ * `readNumber`, which coerces a string (the stored scaled-integer form
+ * of money, e.g. `'12345'`) to `0` — so an un-wrapped money `sum` would
+ * silently return zero. {@link wrapMoneyReducers} rewrites any `sum` /
+ * `min` / `max` over a declared money field into a reducer that
+ * accumulates per-currency `BigInt` totals of the stored integers, so
+ * the result is exact for any magnitude (past `Number.MAX_SAFE_INTEGER`
+ * included).
+ *
+ * Results are currency-aware and never silently mix currencies:
+ *   - **fixed** mode → a single exact decimal string.
+ *   - **multi** mode → an exact `Record<currency, string>` map.
+ *   - **`sum` with `convertTo` + `fx`** → a single exact string, with
+ *     each currency converted via BigInt arithmetic (no float).
+ *
+ * `remove()` is implemented for every money reducer so they participate
+ * in incremental live-aggregation and materialized-view maintenance
+ * exactly like the generic reducers they replace.
  */
-declare function decryptBytes(ivBase64: string, dataBase64: string, dek: CryptoKey): Promise<Uint8Array>;
+
+type FxRates = Record<string, number | string>;
+
+/**
+ * Exact money arithmetic helpers (#337) — `mulRate` and `allocate`.
+ *
+ * Both operate on the canonical decoded string form that `get()`
+ * returns (`'10000.00'`), entirely in scaled-`BigInt` space — no
+ * floating-point step anywhere, exact past 2^53. They are pure
+ * functions with no vault or descriptor dependency: the working scale
+ * is inferred from the amount's fractional digits (a canonical money
+ * string always carries exactly the field's scale) or pinned with
+ * `opts.scale`.
+ *
+ * Why these two: app-side invariants of the form
+ * `Σ parts === whole` (receipt totals, net-zero WHT pairs, proration)
+ * carry ±0.01 tolerances ONLY because the math is major-unit floats +
+ * round2. `mulRate` (VAT-style rate application with explicit
+ * rounding) and `allocate` (largest-remainder split — parts sum to the
+ * input EXACTLY, by construction) make those tolerances zero.
+ */
+
+interface MulRateOptions {
+    /**
+     * Output scale (fraction digits). Defaults to the amount's own
+     * fractional digits — for a canonical money string that IS the
+     * field's scale.
+     */
+    readonly scale?: number;
+    /** Rounding for the final re-scale. Default `'half-up'`. */
+    readonly rounding?: RoundingMode;
+}
+interface AllocateOptions {
+    /** Working scale. Defaults to the amount's own fractional digits. */
+    readonly scale?: number;
+}
+/**
+ * Multiply a money amount by a decimal rate, exactly.
+ *
+ * The rate is parsed at its OWN full precision (`0.07` → `7` at scale
+ * 2), the product computed in `BigInt` at `amountScale + rateScale`,
+ * then re-scaled back to the output scale with the requested rounding —
+ * one rounding step, at the very end.
+ *
+ * ```ts
+ * mulRate('10000.00', 0.07)                       // '700.00'  (VAT)
+ * mulRate('33.33', '0.07')                        // '2.33'    (half-up)
+ * mulRate('33.33', 0.07, { rounding: 'floor' })   // '2.33'
+ * mulRate(100, 0.07, { scale: 2 })                // '7.00'
+ * ```
+ */
+declare function mulRate(amount: number | string, rate: number | string, opts?: MulRateOptions): string;
 /**
- * Derive an AES-256-GCM presence key from a collection DEK using HKDF-SHA256.
+ * Split a money amount across weighted buckets with ZERO drift: the
+ * returned parts sum to the input exactly, by construction
+ * (largest-remainder method).
  *
- * The presence key is domain-separated from the data DEK by the fixed salt
- * `'noydb-presence'` and the `info` = collection name. This means:
- *  - The adapter never sees the presence key.
- *  - Presence payloads rotate automatically when the collection DEK is rotated.
- *  - Revoked users cannot derive the new presence key after a DEK rotation.
+ * Each bucket gets `floor(amount × weightᵢ / Σweights)`; the leftover
+ * minor units (always fewer than the bucket count) go one each to the
+ * buckets with the largest truncated remainders — ties broken by
+ * position, earlier bucket first. Weights are parsed as exact decimals
+ * (no float division anywhere); they must be non-negative with a
+ * positive sum.
  *
- * @param dek            The collection's AES-256-GCM DEK (extractable).
- * @param collectionName Used as the HKDF `info` parameter for domain separation.
- * @returns A non-extractable AES-256-GCM key suitable for presence payload encryption.
+ * ```ts
+ * allocate('100.00', [1, 1, 1])   // ['33.34', '33.33', '33.33']
+ * allocate('0.05', [3, 7])        // ['0.02', '0.03']
+ * allocate('-100.00', [1, 1, 1])  // ['-33.34', '-33.33', '-33.33']
+ * ```
  */
-declare function derivePresenceKey(dek: CryptoKey, collectionName: string): Promise<CryptoKey>;
+declare function allocate(amount: number | string, weights: ReadonlyArray<number | string>, opts?: AllocateOptions): string[];
+
 /**
- * Encrypt a plaintext string with AES-256-GCM and a deterministic,
- * HKDF-derived IV.
+ * Branded money output type (#338).
+ *
+ * The decoded read shape of a money field is an exact decimal STRING
+ * (`'10000.00'`) — but a hand-written schema types it `string | number`,
+ * which is honest about the input side and unhelpful on the output
+ * side: every read site hand-coerces, and a missed coercion passes
+ * typecheck silently (then surfaces as a runtime template warning, or
+ * worse, as `'10000.00' * 100` arithmetic).
  *
- * The same `{ dek, context, plaintext }` triple always produces the
- * same `{ iv, data }` — call this twice and you can string-compare the
- * ciphertexts to check equality of the inputs without decrypting them.
+ * {@link MoneyString} is the output-side brand: a `string` that has
+ * been through noy-db's decode (or {@link asMoney}'s guard). Branding
+ * is type-level only — zero runtime cost on the read path.
  *
- * @param context  Domain-separation string — by convention
- *                 `'<collection>/<field>'`. Different contexts encrypt
- *                 the same plaintext to different ciphertexts, so
- *                 `email` in collection `users` does not collide with
- *                 `email` in collection `customers`.
+ * ## Wiring the brand through a validator (the input/output asymmetry)
+ *
+ * Keep the permissive `string | number` on the INPUT side so write
+ * sites are untouched, and brand the OUTPUT side. With Zod:
+ *
+ * ```ts
+ * import type { MoneyString } from '@noy-db/hub'
+ *
+ * const moneyValue = z.union([z.number(), z.string()]) as unknown as
+ *   z.ZodType<MoneyString, z.ZodTypeDef, string | number>
+ *
+ * const Invoice = z.object({ id: z.string(), total: moneyValue })
+ * type InvoiceOut = z.output<typeof Invoice> // total: MoneyString
+ * type InvoiceIn  = z.input<typeof Invoice>  // total: string | number
+ * ```
+ *
+ * The cast is sound for fields declared in `moneyFields`: reads pass
+ * through `decodeMoneyFields`, which always produces the canonical
+ * decimal string.
+ */
+declare const MONEY_BRAND: unique symbol;
+/**
+ * An exact decimal string produced by noy-db's money decode
+ * (`'10000.00'`). The brand exists only at the type level — at runtime
+ * a `MoneyString` is a plain string.
  */
-declare function encryptDeterministic(plaintext: string, dek: CryptoKey, context: string): Promise<EncryptResult>;
+type MoneyString = string & {
+    readonly [MONEY_BRAND]: true;
+};
 /**
- * Counterpart to {@link encryptDeterministic}. The IV is stored
- * alongside the ciphertext (exactly like the randomized path), so
- * decrypt uses the stored IV and verifies the GCM auth tag — a tampered
- * ciphertext throws `TamperedError` just like randomized AES-GCM.
+ * Runtime-guarded cast to {@link MoneyString}. Accepts a decimal string
+ * or a number, returns the canonical decimal string branded — throws
+ * `MoneyUnsupportedError` on anything non-finite / non-decimal. Use at
+ * trust boundaries (deserialized JSON, route params); values read
+ * through `get()`/`list()` are already canonical.
  */
-declare function decryptDeterministic(ivBase64: string, dataBase64: string, dek: CryptoKey): Promise<string>;
-declare function bufferToBase64(buffer: ArrayBuffer | Uint8Array): string;
-declare function base64ToBuffer(base64: string): Uint8Array<ArrayBuffer>;
+declare function asMoney(value: string | number): MoneyString;
+/** Type guard: is `value` a decimal string acceptable as money? */
+declare function isMoneyString(value: unknown): value is MoneyString;
+/**
+ * The ONE sanctioned escape hatch to a JS `number` — explicit because
+ * the conversion is lossy past 2^53. For display math and chart axes;
+ * never feed the result back into stored amounts (use `mulRate` /
+ * `allocate` for exact arithmetic).
+ */
+declare function moneyNumber(value: MoneyString | string | number): number;
 
 /**
  * Hierarchical access — tier-aware keyring helpers.
@@ -708,6 +954,23 @@ interface VaultDiffEntry<T = unknown> {
     readonly collection: string;
     readonly id: string;
     readonly record: T;
+    /**
+     * Unencrypted envelope metadata for the RECEIVER-side record.
+     * Populated only when `diffVault` is called with `{includeMetadata: true}`.
+     * Default: `undefined` (zero extra reads, no behavior change).
+     *
+     * Populated for `modified` (the CURRENT receiver state, before the candidate
+     * is applied) and `deleted` (the receiver envelope of the record being
+     * removed). `added` entries have no receiver envelope at diff time, so their
+     * `metadata` is always absent.
+     */
+    readonly metadata?: {
+        readonly version: number;
+        readonly timestamp: string;
+        readonly by?: string;
+        readonly source?: string;
+        readonly sourceTs?: string;
+    };
 }
 /** Modified records carry both halves of the diff plus the field-level breakdown. */
 interface VaultDiffModifiedEntry<T = unknown> extends VaultDiffEntry<T> {
@@ -754,6 +1017,15 @@ interface DiffOptions {
     readonly compareFn?: (a: unknown, b: unknown) => boolean;
     /** If true, include unchanged records in the diff (off by default to save memory). */
     readonly includeUnchanged?: boolean;
+    /**
+     * When `true`, each entry in `added`, `modified`, and `deleted` will carry a
+     * `metadata` field with the RECEIVER-side envelope metadata
+     * (`version`, `timestamp`, `by?`, `source?`, `sourceTs?`).
+     *
+     * Off by default — no extra adapter reads, no behavior change for existing callers.
+     * (FR-5 read surface, #445)
+     */
+    readonly includeMetadata?: boolean;
 }
 /**
  * Candidate state to diff the vault against:
@@ -775,4 +1047,4 @@ type DiffCandidate<T = unknown> = Vault | Record<string, readonly T[]> | string;
  */
 declare function diffVault<T = unknown>(vault: Vault, candidate: DiffCandidate<T>, options?: DiffOptions): Promise<VaultDiff<T>>;
 
-export { ActiveTier, type CheckGateContext, DEFAULT_FRESHNESS_MS, DIRECTORY_RECORD_ID, type DiffCandidate, DiffEntry, type DiffOptions, DirectoryConfig, FactorProof, GateName, GatePolicy, META_COLLECTION, ManagedRecoveryNotEnrolledError, NoydbError, NoydbStore, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, type PersistSchemaResult, PersistedSchemaEnvelope, PolicyDeniedError, type PolicyDenyReason, PublicEnvelope, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, SCHEMAS_COLLECTION, STRICT_POLICY, SchemaUpdateStrategy, UnlockedKeyring, UpdateDecision, UserEnvelope, UserVisibility, VISIBILITY_RECORD_PREFIX, Vault, type VaultDiff, type VaultDiffEntry, type VaultDiffModifiedEntry, VaultPolicy, additiveOnly, assertTierAccess, base64ToBuffer, blindUpdate, bufferToBase64, checkGate, coordinatedCutover, decryptBytes, decryptDeterministic, dekKey, deleteUserEnvelope, deleteUserVisibility, derivePersistedSchema, derivePresenceKey, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, diffVault, effectiveClearance, encryptBytes, encryptDeterministic, estimateRecordBytes, isZodSchema, listUserEnvelopeIds, loadPersistedSchema, loadPublicEnvelope, loadUserEnvelope, loadVaultPolicy, lockSchema, mergePolicy, parseBytes, persistDirectoryConfig, persistSchemaIfNeeded, persistUserVisibility, readDirectoryConfig, readPublicEnvelope, readUserVisibility, savePersistedSchema, savePublicEnvelope, saveUserEnvelope, saveVaultPolicy, visibilityRecordId };
+export { ActiveTier, type AllocateOptions, type CheckGateContext, DEED_RECORD_ID, DEFAULT_FRESHNESS_MS, DIRECTORY_RECORD_ID, type DeedMarker, type DiffCandidate, DiffEntry, type DiffOptions, DirectoryConfig, EncryptedEnvelope, FactorProof, type FxRates, GateName, GatePolicy, META_COLLECTION, ManagedRecoveryNotEnrolledError, type MoneyString, type MulRateOptions, NoydbError, NoydbStore, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, type PersistSchemaResult, PersistedSchemaEnvelope, PolicyDeniedError, type PolicyDenyReason, PublicEnvelope, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, RoundingMode, SCHEMAS_COLLECTION, STATE_VAULT_NAME, STRICT_POLICY, SchemaUpdateStrategy, SealingKeyProvider, type Tokenizer, UnlockedKeyring, UpdateDecision, UserEnvelope, UserVisibility, VISIBILITY_RECORD_PREFIX, Vault, type VaultDiff, type VaultDiffEntry, type VaultDiffModifiedEntry, VaultPolicy, additiveOnly, allocate, asMoney, assertTierAccess, blindUpdate, checkGate, coordinatedCutover, createDeedOwner, dekKey, deleteUserEnvelope, deleteUserVisibility, derivePersistedSchema, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, diffVault, effectiveClearance, estimateRecordBytes, isDeedVault, isMoneyString, isZodSchema, listUserEnvelopeIds, loadDeedMarker, loadPersistedSchema, loadPublicEnvelope, loadUserEnvelope, loadVaultPolicy, lockSchema, mergePolicy, moneyNumber, mulRate, parseBytes, persistDirectoryConfig, persistSchemaIfNeeded, persistUserVisibility, readDirectoryConfig, readPlaintextRecord, readPublicEnvelope, readUserVisibility, savePersistedSchema, savePublicEnvelope, saveUserEnvelope, saveVaultPolicy, scaleForCurrency, tokenize, visibilityRecordId };