@noy-db/hub 0.2.0-pre.30 → 0.2.0-pre.31

package/dist/index.d.cts

@@ -1,1050 +0,0 @@
-import { aW as NoydbStore, bs as UserEnvelope, bc as PublicEnvelope, bt as GateName, bu as GatePolicy, bv as VaultPolicy, bw as ActiveTier, bx as FactorProof, aY as EncryptedEnvelope, by as SchemaUpdateStrategy, bz as TransformFn, bA as PersistedSchemaEnvelope, bB as UpdateDecision, bd as SealingKeyProvider, aU as UnlockedKeyring, bC as DirectoryConfig, bD as UserVisibility, bh as Vault, b1 as DiffEntry } from './types-CdVfiQgt.cjs';
-export { bE as AccessibleVault, bF as AffectedDocument, a_ as AppendInput, bG as ApproveWithdrawalOptions, bH as ArchivePolicy, bI as ArchiveResult, bJ as ArchiveRunOptions, bK as ArchiveStrategy, aE as ArrayOutputSpec, o as BLOB_CHUNKS_COLLECTION, p as BLOB_COLLECTION, r as BLOB_INDEX_COLLECTION, t as BLOB_SLOTS_PREFIX, u as BLOB_VERSIONS_PREFIX, bL as BUNDLE_STORE_POLICY, z as BlobObject, A as BlobPutOptions, C as BlobResponseOptions, E as BlobSet, bM as BuiltInGateName, be as BundleRecipient, a4 as CONSENT_AUDIT_COLLECTION, bN as CacheOptions, bO as CacheStats, bP as ChangeEvent, a$ as ChangeType, ad as ClosePeriodOptions, aN as Collection, bQ as CollectionChangeEvent, bR as CollectionConfig, bS as CollectionConflictResolver, bT as CollectionDescription, bU as CollectionDescriptor, au as CollectionFrame, b0 as CollectionInstant, bV as CollectionMeta, bW as CollectionStats, bX as ComputedFieldError, bY as ComputedFields, bZ as ComputedFn, b_ as Conflict, b$ as ConflictPolicy, c0 as ConflictStrategy, a5 as ConsentAuditEntry, a6 as ConsentAuditFilter, a7 as ConsentContext, a8 as ConsentOp, c1 as CrossTierAccessEvent, c2 as CustodyApi, K as DEFAULT_CHUNK_SIZE, c3 as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, c4 as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, c5 as DeepPartial, c6 as DeepPartialOrNull, c7 as DeferredNumberingConfig, c8 as DelegationToken, c9 as DeleteManyResult, ca as DerivationDescriptor, aC as DerivationStrategy, aG as DerivationStrategyHandle, aH as DerivedFromMeta, cb as DescribeOptions, cc as DescribedField, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, cd as DirtyEntry, ce as DryRunResult, cf as DumpSchemaOptions, cg as ELEVATION_AUDIT_COLLECTION, ch as ElevatedHandle, ci as EmbeddingDescriptor, cj as EnrollAuthenticatorOptions, ck as EnrollAuthenticatorWrappingDEKsOptions, cl as EnrollAuthenticatorWrappingKEKOptions, cm as EnrollRecoveryResult, cn as ExportAccessibleOptions, co as ExportCapability, cp as ExportChunk, cq as ExportFormat, cr as ExportStreamOptions, cs as FactorKind, ct as FactorProofBundle, cu as FactorRequirement, cv as FenceDoc, cw as FenceState, cx as FieldChange, cy as FieldDescriptor, cz as FieldMeta, cA as FieldSource, cB as FormattedSequenceHandle, cC as FrozenSnapshotRef, cD as GhostRecord, cE as GrantCustodianOptions, cF as GrantOptions, ao as GuardChange, ap as GuardContext, an as GuardStrategy, ar as GuardStrategyHandle, cG as GuardViolation, cH as HistoryConfig, cI as HistoryEntry, aX as HistoryOptions, cJ as INDEXED_STORE_POLICY, cK as ImportCapability, cL as InferOutput, cM as InternalCollectionStats, cN as IssueDelegationOptions, cO as IssueMagicLinkGrantOptions, b2 as JsonPatch, b3 as JsonPatchOp, cP as KeyringAuthenticator, cQ as KeyringAuthenticatorWrappingDEKs, cR as KeyringAuthenticatorWrappingKEK, cS as KeyringFile, b4 as LedgerStore, cT as LiberateOptions, cU as LiberateResult, cV as LinkEndpointError, cW as LinkIntegrityError, cX as LinkOnDelete, cY as LinkRow, cZ as LinkSetHandle, c_ as LinkSpec, c$ as ListAccessibleVaultsOptions, d0 as ListPageResult, d1 as ListUsersOptions, d2 as LiveUserEnvelope, d3 as LocaleReadOptions, d4 as Lru, d5 as LruOptions, d6 as LruStats, d7 as MAGIC_LINK_CONTENT_INFO_PREFIX, d8 as MAGIC_LINK_GRANTS_COLLECTION, d9 as MAGIC_LINK_KEK_INFO_PREFIX, da as MagicLinkGrantPayload, db as MagicLinkGrantRecord, bo as MaterializedFromMeta, dc as MaterializedViewDescriptor, bp as MaterializedViewOutput, aK as MaterializedViewStrategy, aL as MaterializedViewStrategyHandle, dd as MemoryRecipientSealer, de as MemorySealingKeyProvider, df as NOYDB_BACKUP_VERSION, dg as NOYDB_FORMAT_VERSION, dh as NOYDB_KEYRING_VERSION, di as NOYDB_SYNC_VERSION, dj as NextOptions, dk as Noydb, aw as NoydbBundleStore, dl as NoydbEventMap, dm as NoydbOptions, dn as NumberingAssignment, T as ObjectListEntry, U as ObjectMeta, V as ObjectProjection, W as ObjectUrlOptions, ae as OpenPeriodOptions, aI as OutputSpec, aO as OverlayFieldMergeMode, aP as OverlayFieldMergeRule, dp as OverlayViewDescriptor, aM as OverlayedViewStrategy, aR as OverlayedViewStrategyHandle, af as PERIODS_COLLECTION, dq as PUBLIC_ENVELOPE_FIELDS, dr as PaperRecoveryDoc, ds as PaperRecoveryEntry, dt as PassphrasePolicy, du as PassphraseValidationResult, ag as PeriodRecord, dv as Permission, dw as Permissions, dx as PersistedSchemaKind, dy as PlaintextTranslatorContext, dz as PlaintextTranslatorFn, P as PolicyEnforcer, dA as PresenceHandle, dB as PresencePeer, aZ as PruneOptions, dC as PublicEnvelopeField, dD as PublicEnvelopeSchema, dE as PublicEnvelopeText, dF as PullMode, dG as PullOptions, dH as PullPolicy, dI as PullResult, dJ as PushMode, dK as PushOptions, dL as PushPolicy, dM as PushResult, dN as PutManyItemOptions, dO as PutManyOptions, dP as PutManyResult, X as PutObjectOptions, Y as PutUrlOptions, dQ as QueryAcrossOptions, dR as QueryAcrossResult, dS as QuickUnlockState, dT as QuickUnlockStore, dU as ReAuthOperation, bg as RecipientHint, bf as RecipientSealer, aJ as RecordOutputSpec, dV as RecoverPassphraseInput, dW as RecoverPassphraseResult, dX as RecoverUserOptions, dY as RecoveryProof, dZ as RejectWithdrawalOptions, d_ as RequestWithdrawalOptions, d$ as RequestWithdrawalResult, e0 as ResolvedPublicEnvelopeSchema, ax as RetentionPolicy, e1 as RetrieveHit, e2 as RetrieveOptions, e3 as RevokeOptions, aT as Role, e4 as RotatePassphraseInput, e5 as RotateRecoveryOptions, e6 as RotateRecoveryResult, e7 as SEALED_PASSPHRASE_RECORD_ID, e8 as SchemaDelta, e9 as SchemaIntrospection, S as ScriptWarning, ea as SealedEnvelope, eb as SealedPassphrase, ec as SearchEntry, ed as SearchOptions, ee as SearchResult, ef as SemanticType, eg as SequenceHandle, eh as SequenceOptions, ei as SequenceStore, ej as SessionPolicy, ek as SetPublicEnvelopeInput, el as ShamirRecoveryDoc, em as ShamirRecoveryEntry, bj as ShamirRecoveryProvider, Z as SlotInfo, _ as SlotRecord, en as SlotRewrapCeremony, eo as SlotRewrapContext, aA as SnapshotMeta, ep as StandardSchemaV1, eq as StandardSchemaV1Issue, er as StandardSchemaV1SyncResult, e as StaticDictDescriptor, es as StoreAuth, et as StoreAuthKind, eu as StoreCapabilities, ev as StoreTime, ew as SyncEngine, ex as SyncMetadata, ey as SyncPolicy, ez as SyncScheduler, eA as SyncSchedulerStatus, eB as SyncStatus, eC as SyncTarget, eD as SyncTargetRole, eE as SyncTransaction, eF as SyncTransactionResult, eG as TabChannel, eH as TabCoordinationOptions, eI as TabLockManager, eJ as TabPresence, eK as TabRole, eL as TierMode, eM as TransactionInvariant, eN as TranslatorAuditEntry, eO as TxCollection, bk as TxContext, eP as TxOp, eQ as TxVault, eR as USER_ENVELOPE_COLLECTION, eS as USER_ENVELOPE_MAX_BYTES, bq as UnionArmJoin, br as UnionSource, eT as Unsubscribe, eU as UpdateAuthenticatorOptions, eV as UpdateContext, eW as UpdateUserOptions, eX as UserApi, eY as UserEnvelopeCheckGate, eZ as UserEnvelopeOversizedError, e_ as UserEnvelopePresented, e$ as UserInfo, f0 as VaultBackup, b5 as VaultEngine, av as VaultFrame, b6 as VaultInstant, f1 as VaultMeta, f2 as VaultPolicyOnDisk, f3 as VaultSchemaSnapshot, f4 as VaultSnapshot, b7 as VerifyResult, $ as VersionRecord, f5 as WarningRules, f6 as WeakPassphraseError, f7 as WeakPassphraseReason, f8 as WithArchiveOptions, f9 as WithdrawAccessibleOptions, fa as WithdrawResult, fb as WithdrawalRequest, fc as WithdrawalRequestError, fd as WithdrawalRequestStatus, fe as WrappedDeksBlob, ff as WriteConflict, fg as WriteEvent, fh as WriteHook, fi as WriteQueue, fj as aesGcmOpen, b8 as applyPatch, fk as approveWithdrawal, fl as assertStrongPassphrase, fm as buildRecipientKeyringFile, fn as burnPaperRecoveryEntry, fo as compileSequenceFormat, b9 as computePatch, n as createEnforcer, fp as createNoydb, fq as createStore, fr as deriveMagicLinkContentKey, f as dictCollectionName, g as dictKey, ba as diff, h as enforceScript, fs as enrollAuthenticator, ft as estimateEntropy, fu as evalComputedFields, fv as evaluateExportCapability, fw as evaluateImportCapability, fx as exportAccessibleData, fy as findAuthenticator, bb as formatDiff, fz as hasExportCapability, fA as hasImportCapability, fB as hasRecoveryEnrolled, i as inferScripts, j as isDictCollectionName, k as isDictKeyDescriptor, fC as isLinkCollectionName, fD as isMagicLinkGrantExpired, fE as isPublicEnvelope, l as isStaticDictDescriptor, fF as issueDelegation, fG as keyringRecoverPassphrase, fH as keyringRotatePassphrase, fI as liberateVault, fJ as listMagicLinkGrants, fK as listUsers, fL as listUsersWithEnvelopes, fM as listWithdrawalRequests, fN as loadActiveDelegations, fO as loadPaperRecoveryEntries, fP as loadSealedPassphrase, fQ as loadShamirRecoveryEntries, fR as magicLinkGrantRecordId, a1 as memoryObjectProjection, fS as mintPaperRecoveryEntry, fT as mintShamirRecoveryEntry, fU as mintWrappedDeksBlob, fV as parseRsaOaepTlv, fW as parseSealedEnvelope, fX as readMagicLinkGrantRecord, fY as recoverUser, fZ as rejectWithdrawal, f_ as removeAuthenticator, f$ as requestWithdrawal, g0 as resolvePublicEnvelopeSchema, g1 as resolveSequenceKey, g2 as revokeDelegation, g3 as revokeMagicLinkGrant, g4 as runTransaction, g5 as savePaperRecoveryEntries, g6 as saveSealedPassphrase, g7 as saveShamirRecoveryEntries, g8 as sealRsaOaepTlv, s as staticDict, g9 as unwrapDeksFromBlob, ga as unwrapDeksFromPaperEntry, gb as unwrapDeksFromShamirEntry, gc as unwrapMagicLinkGrant, gd as validatePassphrase, ge as validatePublicEnvelopeInput, gf as validateSchemaInput, gg as validateSchemaOutput, v as validateSessionPolicy, gh as withArchive, gi as withDeferredNumbering, gj as withdrawAccessibleData, gk as writeMagicLinkGrant } from './types-CdVfiQgt.cjs';
-export { I as ImportExternalOptions, a as ImportExternalResult, b as ImportableCollection, d as detectMagic, c as detectMimeType, i as importExternalObjects, e as isPreCompressed } from './mime-magic-sdMzsfVK.cjs';
-export { AgeRoute, BlobLifecyclePolicy, BlobStoreRoute, CircuitBreakerOptions, HealthCheckOptions, LogLevel, LoggingOptions, MetricsOptions, OverrideOptions, OverrideTarget, RetryOptions, RouteStatus, RouteStoreOptions, RoutedNoydbStore, StoreCacheOptions, StoreMiddleware, StoreOperation, SuspendOptions, WrapBundleStoreOptions, WrappedBundleNoydbStore, createBundleStore, routeStore, withCache, withCircuitBreaker, withHealthCheck, withLogging, withMetrics, withRetry, wrapBundleStore, wrapStore } from './store/index.cjs';
-import { N as NoydbError } from './errors-BAWO5Z5a.cjs';
-export { H as AlreadyElevatedError, A as AmendmentForbiddenError, s as AttestationError, B as BackupCorruptedError, u as BackupLedgerError, v as BundleIntegrityError, w as BundleSealMismatchError, x as BundleVersionConflictError, J as ConflictError, K as CrossJoinSourceUnknownError, Q as CrossJoinTooLargeError, V as DanglingReferenceError, W as DataResidencyError, X as DebugPlaintextError, Y as DebugReservedFieldError, Z as DecryptionError, _ as DelegationTargetMissingError, i as DerivationCapExceededError, j as DerivationCycleError, k as DerivationDepthError, l as DerivationOutputShapeError, m as DerivationOutputUnknownError, D as DictKeyInUseError, a as DictKeyMissingError, $ as DirectoryDisabledError, a0 as ElevationExpiredError, a1 as EmbeddingDimMismatchError, a2 as EmbeddingModelMismatchError, a3 as ExportCapabilityError, F as FieldFrozenError, a4 as FilenameSanitizationError, a5 as ForgetStrategyNotConfiguredError, a6 as GroupCardinalityError, I as IllegalTransitionError, a7 as ImportCapabilityError, a8 as IndexRequiredError, a9 as IndexWriteFailureError, aa as InvalidKeyError, f as InvariantError, ab as JoinTooLargeError, ac as KeyringCorruptError, ad as KeyringExpiredError, ae as LedgerContentionError, L as LocaleNotSpecifiedError, z as MaterializedViewConfigError, C as MaterializedViewCycleError, E as MaterializedViewSourceUnknownError, G as MaterializedViewTooLargeError, af as MigrationRequiredError, M as MissingTranslationError, ag as NetworkError, ah as NoAccessError, ai as NonAdditiveSchemaChangeError, aj as NotFoundError, ak as NumberingUncertaintyError, O as OverlayBaseIsVirtualError, n as OverlayCollectionUnavailableError, o as OverlayIdMismatchError, p as OverlayNameCollisionError, al as PathEscapeError, am as PeriodClosedError, an as PermissionDeniedError, ao as PrivilegeEscalationError, ap as QuiesceTimeoutError, aq as ReadOnlyAtInstantError, ar as ReadOnlyError, as as ReadOnlyFrameError, at as RecordCekNotFoundError, g as RecordLockedError, R as ReservedCollectionNameError, au as ReservedVaultNameError, av as SchemaFenceError, aw as SchemaLockedError, ax as SchemaUpdateError, ay as SchemaValidationError, S as ScriptViolationError, q as SealedRecordExpiredError, r as SealedRecordMismatchError, az as SequenceContentionError, aA as SequenceOfflineError, c as SessionExpiredError, d as SessionNotFoundError, e as SessionPolicyError, aB as ShardProvisioningError, h as SnapshotNotFoundError, b as StaticDictReadonlyError, aC as StoreCapabilityError, aD as TamperedError, aE as TierDemoteDeniedError, aF as TierNotGrantedError, T as TranslatorNotConfiguredError, aG as UniqueConstraintError, U as UnknownDictCodeError, aH as UnknownShardError, aI as UnsupportedIndexOptionError, aJ as ValidationError, aK as VaultTemplateNotFoundError } from './errors-BAWO5Z5a.cjs';
-export { A as AutoCredential, m as AutoCredentialKind, c as CompressionAlgo, D as DecryptedRecord, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, i as decryptExtractedPartition, n as hasNoydbBundleMagic, r as readNoydbBundle, k as readNoydbBundleHeader, o as readNoydbBundlePublicEnvelope, l as resetBrotliSupportCache, w as writeNoydbBundle } from './decrypt-partition-C0iDpbSd.cjs';
-export { g as generateULID, i as isULID } from './ulid-DRH25k3y.cjs';
-export { D as DEFAULT_CROSS_JOIN_MAX_ROWS, a as DEFAULT_JOIN_MAX_ROWS, J as JoinContext, b as JoinLeg, c as JoinStrategy, d as JoinableSource, L as LiveQuery, e as LiveUpstream, O as OrderBy, Q as Query, f as QueryPlan, g as QuerySource, R as RefDescriptor, h as RefIntegrityError, i as RefMode, j as RefRegistry, k as RefScopeError, l as RefViolation, S as ScanBuilder, m as ScanPageProvider, n as applyJoins, o as buildLiveQuery, p as executePlan, q as isRefArray, r as ref, s as refArray, t as resetJoinWarnings } from './index-C1SC1EPe.cjs';
-export { L as LedgerEntry, c as canonicalJson, h as hashEntry, p as paddedIndex, a as parseIndex, s as sha256Hex } from './index-BMmajblo.cjs';
-export { a as CrdtMode, b as CrdtState, L as LwwMapState, R as RgaState, Y as YjsState, m as mergeCrdtStates, r as resolveCrdtSnapshot } from './strategy-BSxFXGzb.cjs';
-export { F as FuseOptions, b as base64ToBuffer, a as bufferToBase64, d as decryptBytes, c as decryptDeterministic, e as derivePresenceKey, f as encryptBytes, g as encryptDeterministic, h as fuseRetrieval } from './index-xJEPkvMb.cjs';
-export { TransactionStrategyOptions } from './tx/index.cjs';
-export { I as ImmutableGuardConfig, T as TransitionGuardConfig, i as immutableGuard, t as transitionGuard, w as withGuard } from './transition-guard-tWZIsaXe.cjs';
-import { M as RoundingMode } from './strategy-mJExw4LQ.cjs';
-export { j as AggregateResult, k as AggregateSpec, l as Aggregation, m as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, n as GROUPBY_WARN_CARDINALITY, o as GroupedAggregation, p as GroupedQuery, q as GroupedQueryN, t as GroupedRow, u as GroupedRowN, I as I18nMap, a as I18nTextDescriptor, b as I18nTextOptions, L as Layer, w as LiveAggregation, N as MoneyCurrencyError, P as MoneyDescriptor, Q as MoneyOptions, S as MoneyOptionsFixed, T as MoneyOptionsMulti, U as MoneyPrecisionError, V as MoneyUnsupportedError, O as OnMissing, c as OnMissingPolicy, x as Reducer, y as ReducerOptions, R as ResolveI18nOptions, d as applyI18nLocale, z as avg, C as count, D as groupAndReduce, i as i18nText, e as isI18nTextDescriptor, W as isMoneyDescriptor, E as max, F as min, X as money, H as reduceRecords, r as resolveI18nText, f as resolvePolicy, K as sum, v as validateI18nTextValue } from './strategy-mJExw4LQ.cjs';
-export { w as withDerivation, a as withRollup } from './with-rollup-nIxo7h9z.cjs';
-export { w as withMaterializedView } from './with-materialized-view-DfgPcvi9.cjs';
-export { a as Clause, C as CollectionIndexes, F as FieldClause, b as FilterClause, G as GroupClause, H as HashIndex, I as IndexDef, O as Operator, e as evaluateClause, c as evaluateFieldClause, r as readPath } from './predicate-BmhBSPCH.cjs';
-export { w as withOverlayedView } from './with-overlayed-view-Cvfkx1lg.cjs';
-export { SYNC_CREDENTIALS_COLLECTION, SyncCredential, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential } from './team/index.cjs';
-export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-0Z6yxfS7.cjs';
-export { i as isDiscriminant } from './discriminant-BN9REW3o.cjs';
-export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-Db8ncXGr.cjs';
-import './lazy-builder-eYZzLEL1.cjs';
-import '@noy-db/attestation';
-
-/**
- * Persistence helpers for per-principal user envelopes stored at
- * `_users/<keyringId>` (logically: `_meta/user/<keyringId>`).
- *
- * Unlike `_meta/policy` and `_meta/handle` which are plaintext, user
- * envelopes carry user data and are encrypted with a dedicated
- * {@link USER_ENVELOPE_COLLECTION} DEK (provisioned at vault open and
- * propagated to every keyring via the system-collection DEK path in
- * `team/keyring.ts`).
- *
- * This module is the **storage primitive** layer. The public API
- * (`vault.user.*`) sits on top of this; permission gates, own-only
- * write enforcement, and presence-channel propagation live there.
- *
- * @see docs/superpowers/specs/2026-05-05-user-envelope-design.md
- *
- * @module
- */
-
-/**
- * Read and decrypt the user envelope for `keyringId`. Returns `null`
- * when no envelope has been persisted (either the principal has never
- * called `updateMe`, or the keyring predates this feature).
- *
- * Decryption errors propagate — a tampered or wrong-keyed envelope
- * surfaces as the underlying crypto error rather than masquerading as
- * "not found".
- */
-declare function loadUserEnvelope<T = unknown>(store: NoydbStore, vault: string, keyringId: string, dek: CryptoKey): Promise<UserEnvelope<T> | null>;
-/**
- * Encrypt and persist the user envelope for `keyringId`. The new
- * version is `(prior._v ?? 0) + 1`. Pass `expectedVersion` to enable
- * optimistic-concurrency checks: a mismatch with the stored version
- * throws {@link ConflictError} with the actual stored version.
- *
- * `expectedVersion: 0` means "expect no prior envelope"; the write
- * succeeds only if no envelope exists yet.
- *
- * Soft-caps the JSON-serialized payload at {@link USER_ENVELOPE_MAX_BYTES};
- * larger payloads throw {@link UserEnvelopeOversizedError}.
- */
-declare function saveUserEnvelope<T>(store: NoydbStore, vault: string, keyringId: string, payload: T, dek: CryptoKey, expectedVersion?: number): Promise<UserEnvelope<T>>;
-/**
- * Delete the user envelope for `keyringId`. Idempotent — no error if
- * the envelope is already absent. Called from the keyring revoke path
- * (cascade-delete) and is a no-op for keyrings that never wrote.
- */
-declare function deleteUserEnvelope(store: NoydbStore, vault: string, keyringId: string): Promise<void>;
-/**
- * List the keyring ids that have a user envelope persisted in `vault`.
- * Order is store-defined — callers that need a stable order should sort.
- */
-declare function listUserEnvelopeIds(store: NoydbStore, vault: string): Promise<string[]>;
-
-/**
- * Default text tokenizer for scan-mode search (#308).
- *
- * NFKC-normalize → lowercase → split on Unicode letter/number runs. This is a
- * word-boundary tokenizer: it does **not** segment scripts written without
- * inter-word spaces (Thai, Lao, Khmer, CJK) — those collapse to one token per
- * run. For such data, a dictionary/ICU segmenter is the right `tokenizer`
- * (the engine takes one as a parameter); substring/`contains` matching is the
- * pragmatic fallback until then. See the #308 design note.
- */
-type Tokenizer = (text: string) => string[];
-declare const tokenize: Tokenizer;
-
-/**
- * Cache policy helpers — parse human-friendly byte budgets into raw numbers.
- *
- * Accepted shapes (case-insensitive on suffix):
- *   number       — interpreted as raw bytes
- *   '1024'       — string of digits, raw bytes
- *   '50KB'       — kilobytes (×1024)
- *   '50MB'       — megabytes (×1024²)
- *   '1GB'        — gigabytes (×1024³)
- *
- * Decimals are accepted (`'1.5GB'` → 1610612736 bytes).
- *
- * Anything else throws — better to fail loud at construction time than
- * to silently treat a typo as 0 bytes (which would evict everything).
- */
-/** Parse a byte budget into a positive integer number of bytes. */
-declare function parseBytes(input: number | string): number;
-/**
- * Estimate the in-memory byte size of a decrypted record.
- *
- * Uses `JSON.stringify().length` as a stand-in for actual heap usage.
- * It's a deliberate approximation: real V8 heap size includes pointer
- * overhead, hidden classes, and string interning that we can't measure
- * from JavaScript. The JSON length is a stable, monotonic proxy that
- * costs O(record size) per insert — fine when records are typically
- * < 1 KB and the cache eviction is the slow path anyway.
- *
- * Returns `0` (and the caller must treat it as 1 for accounting) if
- * stringification throws on circular references; this is documented
- * but in practice records always come from JSON-decoded envelopes.
- */
-declare function estimateRecordBytes(record: unknown): number;
-
-/**
- * Persistence helpers for `_meta/public-envelope`. Mirrors the
- * bypass-AES pattern used by `_meta/handle` and `_meta/policy` —
- * the document is plaintext JSON, the envelope's `_iv` field is
- * left empty.
- *
- * @module
- */
-
-/** Reserved id for the vault-level public envelope record. */
-declare const PUBLIC_ENVELOPE_RECORD_ID = "public-envelope";
-/**
- * Read the public envelope from `_meta/public-envelope`. Returns
- * `undefined` when no envelope has been persisted (fresh vault, or
- * a vault written before the feature was enabled). Tolerates
- * corrupted documents — a JSON parse failure surfaces as `undefined`,
- * not a thrown error, mirroring `_meta/handle`'s contract.
- */
-declare function loadPublicEnvelope(store: NoydbStore, vault: string): Promise<PublicEnvelope | undefined>;
-/** Persist the public envelope. Idempotent — overwrites any prior write. */
-declare function savePublicEnvelope(store: NoydbStore, vault: string, envelope: PublicEnvelope): Promise<void>;
-/**
- * Public, no-key reader. Plain function, not a method on `Noydb` —
- * the whole point is it works without an authenticated session, so
- * a UI can show "Acme 2026 Tax Records" before unlocking.
- *
- * Resolves any `name` / `description` locale map through the supplied
- * `locale` (when provided). Omitting `locale` returns the raw
- * envelope, which a multilingual picker can render as it pleases.
- */
-declare function readPublicEnvelope(store: NoydbStore, vault: string, opts?: {
-    readonly locale?: string;
-}): Promise<PublicEnvelope | undefined>;
-
-/**
- * Why a gate denied a request. Stable across hub versions so consumers
- * can switch on the value in error UIs.
- */
-type PolicyDenyReason = 'insufficient-tier' | 'missing-factor' | 'stale-proof' | 'disabled' | 'shared-device-blocked';
-/**
- * Thrown by {@link checkGate} when the active session does not meet
- * the gate's requirements. Carries the gate name, the reason, and the
- * full required {@link GatePolicy} so error UIs can prompt the user
- * for the missing factor without re-reading the policy document.
- */
-declare class PolicyDeniedError extends NoydbError {
-    readonly gate: GateName;
-    readonly reason: PolicyDenyReason;
-    readonly required: GatePolicy;
-    constructor(gate: GateName, reason: PolicyDenyReason, required: GatePolicy, message?: string);
-}
-/**
- * Raised by `createNoydb({ ... })` when the developer omits a recovery
- * profile and `recover-passphrase` is not explicitly disabled. Vaults
- * MUST have at least one recovery path enrolled before being
- * production-ready (paper, shamir, multi-channel, or admin-mediated).
- *
- * The error message carries a pointer to the recovery design docs.
- */
-declare class RecoveryNotEnrolledError extends NoydbError {
-    constructor(message?: string);
-}
-/**
- * Raised by `openVault` when a managed-passphrase-mode vault has no
- * STRONG recovery profile enrolled.
- *
- * Managed mode means the user never types a passphrase — the unlock
- * material lives in a `SealingKeyProvider` (`at-*` package). If that
- * provider's key is lost AND no strong recovery is enrolled, the
- * vault is irrecoverable. To prevent that footgun, managed-mode vaults
- * require at least one strong recovery profile (Shamir today;
- * multi-channel / admin-mediated when those ship).
- *
- * Paper recovery alone is NOT strong under managed mode: the user has
- * no memorized passphrase to fall back on, so losing the paper sheet =
- * losing every record permanently.
- *
- * Bootstrap with `db.openVaultAndEnrollRecovery(vault, { recovery: [{ profile: "shamir", k, n }] })`
- * to atomically create-and-enroll, or call `db.enrollRecovery(vault, { profile: "shamir", ... })`
- * separately before re-attempting `openVault`.
- */
-declare class ManagedRecoveryNotEnrolledError extends NoydbError {
-    readonly vault: string;
-    constructor(vault: string);
-}
-/**
- * Raised by `db.recoverPassphrase` / `db.enrollRecovery` /
- * `db.rotateRecovery` when the developer requests a recovery profile
- * not yet wired in this hub release.
- *
- * Implemented: `paper` and `shamir`.
- * Pending: `multi-channel` and `admin-mediated` (follow-up slices).
- *
- * The carried `profile` and `tracking` fields let consumers steer the
- * UI ("multi-channel recovery is not yet wired up — open issue #N to follow").
- */
-declare class RecoveryProfileNotImplementedError extends NoydbError {
-    readonly profile: string;
-    readonly tracking: string;
-    constructor(profile: string, tracking: string);
-}
-
-/**
- * Default policy for personal vaults and SMB deployments — the gates
- * that need an off-device factor get one (TOTP / email-OTP / paper
- * recovery), the rest take a tier-1 unlock alone. Tier-3 (PIN) is the
- * floor only for `rotate-unlock` because that's the
- * "change my PIN" flow.
- *
- * The unspecified gates (e.g. `view-user-auth`) inherit the engine
- * default of `{ enabled: false, minTier: 1 }` — they fail closed.
- *
- * @see docs/subsystems/session-tiers.md → Built-in gates
- */
-declare const PERSONAL_POLICY: VaultPolicy;
-/**
- * Strict policy for regulated deployments and shared workstations —
- * raises the phrase floor to 8 words, demands two distinct factors for
- * exports, and blocks export-on-shared-device. Use as a base for
- * `policy: { ...STRICT_POLICY, gates: { ...STRICT_POLICY.gates, ... } }`
- * tweaks.
- */
-declare const STRICT_POLICY: VaultPolicy;
-/**
- * Merge a developer override onto a preset. Unspecified gates inherit;
- * specified gates fully replace the preset's entry for that gate.
- *
- * Example:
- *
- * ```ts
- * mergePolicy(PERSONAL_POLICY, {
- *   gates: {
- *     'app:approve-large-payment': { minTier: 2, factors: [{ anyOf: ['totp'] }] },
- *   },
- * })
- * // → PERSONAL_POLICY plus the new app gate; existing gates intact.
- * ```
- */
-declare function mergePolicy(base: VaultPolicy, override?: Partial<VaultPolicy>): VaultPolicy;
-
-/**
- * Policy gate engine — the {@link checkGate} entry point.
- *
- * Given a configured {@link VaultPolicy}, an active session tier, and
- * the factor proofs an actor is presenting, decide whether the gate
- * permits the action. On denial, throws {@link PolicyDeniedError} with
- * a stable {@link PolicyDenyReason} so consumers can branch in error
- * UIs.
- *
- * @see docs/subsystems/session-tiers.md → checkGate() API
- *
- * @module
- */
-
-/** Default freshness window — 5 minutes. */
-declare const DEFAULT_FRESHNESS_MS: number;
-/** Caller-supplied context for one `checkGate` invocation. */
-interface CheckGateContext {
-    /** Tier the active session currently holds. */
-    readonly activeTier: ActiveTier;
-    /** Proofs the actor is presenting for this gate. */
-    readonly factors?: ReadonlyArray<FactorProof>;
-    /**
-     * If the host knows the actor is on a shared device, set this to
-     * `true` so the engine can apply `warn.sharedDevice` rules. Defaults
-     * to `false`.
-     */
-    readonly sharedDevice?: boolean;
-    /**
-     * Override `now()` for tests. Defaults to `Date.now()`.
-     * @internal
-     */
-    readonly now?: number;
-}
-/**
- * Decide whether `gate` permits the action under `context`. Throws
- * {@link PolicyDeniedError} on denial; resolves with `void` on success.
- *
- * Lookup rules:
- * - **Built-in gates** without a configured policy fail closed
- *   (`enabled: false`).
- * - **App-defined gates** (`app:*`) without a configured policy are
- *   treated as no-op (allow). The developer registered the policy if
- *   they wanted enforcement; absence means the gate is informational.
- */
-declare function checkGate(policy: VaultPolicy, gate: GateName, context: CheckGateContext): Promise<void>;
-/**
- * Same as {@link checkGate} but returns a structured verdict instead
- * of throwing. Useful when an error UI wants to show the user
- * "you'll need TOTP plus a recovery code to do that" without first
- * triggering the action.
- */
-declare function describeGate(policy: VaultPolicy, gate: GateName, context: CheckGateContext): Promise<{
-    ok: true;
-} | {
-    ok: false;
-    reason: PolicyDenyReason;
-    required: GatePolicy;
-}>;
-
-/**
- * Persistence helpers for the vault-level policy document
- * (`_meta/policy`). Mirrors the bypass-AES pattern used by
- * `_meta/handle` — the policy document is plain JSON, the envelope's
- * `_iv` field is left empty.
- *
- * @see docs/subsystems/session-tiers.md → Storage location
- *
- * @module
- */
-
-/** Reserved collection name for vault-level metadata documents. */
-declare const META_COLLECTION = "_meta";
-/** Reserved id for the vault-level policy document. */
-declare const POLICY_RECORD_ID = "policy";
-/**
- * Read the vault-level policy from `_meta/policy`. Returns `undefined`
- * when no policy has been persisted (fresh vault, or a vault written
- * before the policy module landed). The caller falls back to the
- * default preset.
- *
- * Tolerates corrupted documents the same way `_meta/handle` does: a
- * JSON parse failure surfaces as `undefined`, not a thrown error, so
- * a bad write never permanently locks a vault.
- */
-declare function loadVaultPolicy(store: NoydbStore, vault: string): Promise<VaultPolicy | undefined>;
-/**
- * Persist the vault-level policy at `_meta/policy`. Idempotent — call
- * once at vault creation and again on `db.updatePolicy()` invocations.
- */
-declare function saveVaultPolicy(store: NoydbStore, vault: string, policy: VaultPolicy): Promise<void>;
-
-/**
- * Helpers for reading records out of a *plaintext* store (`encrypt: false`)
- * with native tooling — the programmatic core of a `noydb cat`-style unwrap.
- * See the plaintext/debug-store-mode design.
- */
-
-/**
- * Extract the record from a plaintext stored envelope, handling both layouts:
- *
- *   - **classic plaintext** (`encrypt: false`): the record is JSON in `_data`.
- *   - **debugPlaintext**: the record's fields are inlined beside the
- *     `_`-prefixed metadata (marked by `_debug`).
- *
- * Returns `null` for an empty/absent body. Throws if handed an **encrypted**
- * envelope (non-empty `_iv`) — there is no key here; decrypt through the vault
- * instead. Intended for record envelopes, not blob chunks.
- *
- * @example
- * ```ts
- * // node script over a to-file store, no vault needed:
- * const env = JSON.parse(readFileSync('data/acme/invoices/inv-1.json', 'utf8'))
- * console.log(readPlaintextRecord(env)) // → { id: 'inv-1', total: '120.00', … }
- * ```
- */
-declare function readPlaintextRecord<T = Record<string, unknown>>(envelope: EncryptedEnvelope): T | null;
-
-/** Allow any schema change. Explicit blind / back-compat. */
-declare function blindUpdate(): SchemaUpdateStrategy;
-/** Allow additive changes; reject non-additive ones. The safety backstop. */
-declare function additiveOnly(): SchemaUpdateStrategy;
-/**
- * Reject schema changes. With `fields`, reject only when one of those
- * fields is added/removed/changed; otherwise reject any non-`none` delta.
- */
-declare function lockSchema(opts?: {
-    readonly fields?: readonly string[];
-}): SchemaUpdateStrategy;
-
-/** The coordinatedCutover update strategy (single-step — no from/to). */
-
-declare function coordinatedCutover(opts: {
-    readonly transform: TransformFn;
-}): SchemaUpdateStrategy;
-
-/**
- * Hub-core constants that must be referenceable without pulling any
- * subsystem chunk. Kept import-free.
- */
-/** Reserved fleet-wide control-plane vault name. Hub reserves it for an outward orchestration framework's state/control-plane vault. */
-declare const STATE_VAULT_NAME = "__noydb_state__";
-
-/**
- * Derive a {@link PersistedSchemaEnvelope} from a Standard Schema v1
- * validator. Supports zod 3 (via the optional `zod-to-json-schema` peer-dep)
- * and zod 4 (via its native `z.toJSONSchema()`); both are loaded lazily so
- * hub never statically imports zod. Other validator families write a stub
- * envelope flagging the kind.
- *
- * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
- *
- * @module
- */
-
-/**
- * Heuristic Zod detection — uses the Standard Schema v1 `~standard.vendor`
- * property (present in Zod v3.23+ and Zod v4+). Falls back to the
- * `_def.typeName` heuristic for older Zod v3 builds that predate Standard
- * Schema support.
- */
-declare function isZodSchema(value: unknown): boolean;
-declare function derivePersistedSchema(validator: unknown): Promise<PersistedSchemaEnvelope>;
-
-/**
- * Read / write the per-collection persisted-schema envelope. Mirrors the
- * standard noy-db record envelope shape and is **AES-GCM encrypted with
- * the collection's DEK** — the schema body (field names, enum values,
- * constraints) is sensitive metadata, so it gets the same encryption
- * envelope as the records it describes.
- *
- * Storage layout:
- *
- *   <vault>/_schemas/<collection>   →   EncryptedEnvelope
- *
- * The DEK passed to {@link savePersistedSchema} / {@link loadPersistedSchema}
- * is the same key the collection uses for its records.
- *
- * @module
- */
-
-/** Reserved collection name where persisted schemas live. */
-declare const SCHEMAS_COLLECTION: "_schemas";
-/**
- * Read and decrypt the persisted-schema envelope for one collection.
- * Returns `undefined` when no envelope has been written or when decryption
- * fails (e.g. wrong DEK passed). Tolerates corrupted records — JSON parse
- * failures surface as `undefined`, mirroring `_meta/handle`'s contract.
- */
-declare function loadPersistedSchema(store: NoydbStore, vault: string, collection: string, dek: CryptoKey): Promise<PersistedSchemaEnvelope | undefined>;
-/**
- * Encrypt and persist a schema envelope for one collection. Always
- * overwrites any prior write (callers gate on hash equality before calling
- * to avoid no-op writes).
- */
-declare function savePersistedSchema(store: NoydbStore, vault: string, collection: string, dek: CryptoKey, payload: PersistedSchemaEnvelope): Promise<void>;
-
-/**
- * Orchestrate the derive → hash → skip-or-write cycle for a collection's
- * persisted JSON Schema. Called by the Vault at collection-registration
- * time when the developer opts in via `collection({ persistJsonSchema:
- * true })`.
- *
- * Skip semantics:
- *
- *   - Zod validators: skip when the new hash equals the stored hash.
- *   - Non-Zod (stub envelopes have hash=null): skip when the stored
- *     envelope's `kind` matches the freshly-detected kind (since there's
- *     no body to compare yet — a kind change is the only signal).
- *
- * @module
- */
-
-interface PersistSchemaResult {
-    /** True when a fresh envelope was written to storage. */
-    readonly written: boolean;
-    /** True when an existing envelope matched and the write was skipped. */
-    readonly skipped: boolean;
-    /** The envelope that was either written or matched. */
-    readonly envelope: PersistedSchemaEnvelope;
-    /** The update-strategy decision, present when strategies ran. */
-    readonly decision?: UpdateDecision;
-}
-declare function persistSchemaIfNeeded(opts: {
-    readonly store: NoydbStore;
-    readonly vault: string;
-    readonly collectionName: string;
-    readonly validator: unknown;
-    readonly dek: CryptoKey;
-    readonly strategies?: readonly SchemaUpdateStrategy[];
-}): Promise<PersistSchemaResult>;
-
-/**
- * FR-6 — Deed: sealed / hidden-owner provisioning.
- *
- * A **Deed** is a vault owned by a *latent* principal who never
- * authenticates. The owner credential (the random passphrase that
- * derives `KEK_owner`) is minted machine-side and sealed under a
- * **non-firm** {@link SealingKeyProvider} — that sealing boundary is
- * the cryptographic *inalienability anchor*: whoever holds the
- * provider (the client / their KMS) is the only party that can ever
- * re-derive `KEK_owner`. A firm-side custodian operates the vault
- * fully but can never reach the owner key — there is deliberately NO
- * firm-controlled fallback.
- *
- * Provisioning reuses the managed-mode seam:
- *   - {@link resolveManagedSecret} mints + seals + persists the random
- *     passphrase at `_meta/sealed-passphrase` (and unseals it on every
- *     subsequent open through the same provider).
- *   - {@link createOwnerKeyring} derives `KEK_owner` from that
- *     passphrase and writes the `_keyring/<ownerUserId>` file.
- *
- * On top of that, a Deed writes a `_meta/deed` **marker**. The marker
- * is PLAINTEXT metadata — it records WHO the latent owner is and WHICH
- * sealing boundary protects them, so it must be readable without
- * unlocking the vault (a custodian or auditor inspecting the vault must
- * be able to see "this is a Deed vault, owner = X, sealed under Y"
- * without any key). The marker itself is therefore never sealed; only
- * the owner *credential* is.
- *
- * @module
- */
-
-/** Reserved id for the Deed marker under `_meta`. */
-declare const DEED_RECORD_ID: "deed";
-/**
- * Plaintext metadata recording a vault's latent-owner Deed. Persisted
- * at `_meta/deed`. Readable without unlocking the vault by design — it
- * carries no secret material, only the identity of the latent owner
- * and the sealing boundary that anchors inalienability.
- */
-interface DeedMarker {
-    /** The latent owner principal — the user id of the `_keyring/<id>` owner file. */
-    readonly ownerUserId: string;
-    /**
-     * The `SealingKeyProvider.id` the owner credential is sealed under.
-     * The inalienability anchor: only the holder of this (non-firm)
-     * provider can re-derive `KEK_owner`. Audit metadata — never secret.
-     */
-    readonly sealedUnder: string;
-    /** Always `true` for a Deed — the owner never authenticates interactively. */
-    readonly latent: true;
-    /** ISO-8601 timestamp the Deed was issued. */
-    readonly issuedAt: string;
-    /**
-     * ISO-8601 timestamp the vault was liberated (a new owner claimed it
-     * via the audited Liberate ceremony), if any. Absent until liberation.
-     */
-    readonly liberatedAt?: string;
-}
-/**
- * Provision a Deed: a latent owner whose credential is sealed under
- * `sealing` (a NON-firm provider). Mints + seals the owner passphrase
- * via {@link resolveManagedSecret}, derives the owner keyring via
- * {@link createOwnerKeyring}, then writes the plaintext `_meta/deed`
- * marker. Returns the unlocked owner keyring.
- *
- * The returned keyring is the only in-memory window onto `KEK_owner`
- * for this call; the persistent re-entry point is the sealing provider
- * (re-run {@link resolveManagedSecret} with the same provider to
- * re-resolve the passphrase, then {@link createOwnerKeyring}/load to
- * unlock — no interactive passphrase is ever required).
- *
- * There is deliberately no firm-controlled fallback: the marker's
- * `sealedUnder` is the single cryptographic anchor of ownership.
- */
-declare function createDeedOwner(store: NoydbStore, vault: string, ownerUserId: string, sealing: SealingKeyProvider): Promise<UnlockedKeyring>;
-/**
- * Read the {@link DeedMarker} from `_meta/deed`, or `null` if the vault
- * has no Deed marker (i.e. it is not a Deed vault). Plaintext read — no
- * unlocking required.
- */
-declare function loadDeedMarker(store: NoydbStore, vault: string): Promise<DeedMarker | null>;
-/** Whether `vault` carries a Deed marker (a sealed/latent owner). */
-declare function isDeedVault(store: NoydbStore, vault: string): Promise<boolean>;
-
-/**
- * Authentication introspection.
- *
- * Three surfaces over the configured tier model and the actual
- * per-user enrollment state:
- *
- * 1. **Vault-wide English summary** — {@link describeAuthConfig}.
- * 2. **Vault-wide Mermaid diagram** — {@link diagramAuthConfig}.
- * 3. **Per-user introspection** — {@link describeUserAuth}, gated by
- *    the `view-user-auth` policy gate (off by default).
- *
- * The per-user surface is held to a strict allowlist — fields not on
- * the allowlist are dropped, never rendered. The negative test in
- * `auth-introspection.test.ts` exercises the allowlist by feeding a
- * contrived keyring with fake "secret" fields and asserting that none
- * of them appear in the output.
- *
- * @module
- */
-
-/** Vault-wide English summary of the configured authentication graph. */
-declare function describeAuthConfig(store: NoydbStore, vault: string): Promise<string>;
-/**
- * Render the vault's auth graph as Mermaid `flowchart TB` source. The
- * caller pipes this through Mermaid (CLI or browser) to get an SVG.
- */
-declare function diagramAuthConfig(store: NoydbStore, vault: string): Promise<string>;
-/**
- * Render the per-user enrollment summary. Returns an empty
- * (non-throwing) string when the user has no keyring file — never
- * confirms or denies the existence of the user from the document
- * alone.
- *
- * Sanitization is strict: only the slot list, enrollment dates, and
- * recovery-profile counts are rendered. WebAuthn cred ids, OIDC
- * subject ids, password hashes, recovery codes, TOTP secrets — all
- * dropped at the allowlist boundary, not redacted.
- */
-declare function describeUserAuth(store: NoydbStore, vault: string, userId: string): Promise<string>;
-/** Bulk variant for owner dashboards. */
-declare function describeAllUsersAuth(store: NoydbStore, vault: string): Promise<Array<{
-    userId: string;
-    description: string;
-}>>;
-
-/**
- * Persistence helpers for the vault-level user-directory toggle
- * (`_meta/directory`). Mirrors the bypass-AES pattern used by
- * `_meta/policy` — the directory document is plain JSON, the
- * envelope's `_iv` field is left empty.
- *
- * @see docs/subsystems/user-envelope.md → Directory visibility
- * @see docs/subsystems/plaintext-bypass.md — every `_iv: ''` write site
- *
- * @module
- */
-
-/** Reserved id for the vault-level directory document. */
-declare const DIRECTORY_RECORD_ID = "directory";
-/**
- * Read the directory toggle from `_meta/directory`. Returns `undefined`
- * when no document has been persisted — callers treat that as the
- * default-on case (`{ enabled: true }`).
- *
- * Tolerates corrupted documents the same way `_meta/policy` does: a
- * JSON parse failure surfaces as `undefined`, not a thrown error, so a
- * bad write never permanently breaks team enumeration.
- */
-declare function readDirectoryConfig(store: NoydbStore, vault: string): Promise<DirectoryConfig | undefined>;
-/**
- * Persist the directory toggle at `_meta/directory`. Idempotent — call
- * on every `db.setDirectoryEnabled()` invocation. Owner-only at the
- * caller site; this primitive does not check roles.
- */
-declare function persistDirectoryConfig(store: NoydbStore, vault: string, config: DirectoryConfig): Promise<void>;
-
-/**
- * Persistence helpers for the per-user visibility flag
- * (`_meta/visibility/<keyringId>`). Mirrors the bypass-AES pattern used
- * by `_meta/policy` — the visibility document is plain JSON, the
- * envelope's `_iv` field is left empty.
- *
- * Stored alongside the keyring file rather than inside the encrypted
- * user envelope (`_users/<keyringId>`) because:
- *
- *  - `UserEnvelope<T>.data` is opaque-to-hub by contract — hub does not
- *    introspect or reserve any keys inside it. Adding `hidden` there
- *    would violate that contract.
- *  - `listUsersWithEnvelopes` filters by the flag, and the filter must
- *    work even when decryption fails (legacy keyrings predating the
- *    envelope feature, or a corrupted envelope).
- *
- * @see docs/subsystems/user-envelope.md → Directory visibility
- * @see docs/subsystems/plaintext-bypass.md — every `_iv: ''` write site
- *
- * @module
- */
-
-/** Prefix for per-user visibility records inside `_meta`. */
-declare const VISIBILITY_RECORD_PREFIX = "visibility/";
-/** Compose the `_meta` record id for a keyring's visibility doc. */
-declare function visibilityRecordId(keyringId: string): string;
-/**
- * Read the visibility flag for `keyringId`. Returns `undefined` when no
- * document has been persisted — callers treat that as the default-visible
- * case (`{ hidden: false }`).
- */
-declare function readUserVisibility(store: NoydbStore, vault: string, keyringId: string): Promise<UserVisibility | undefined>;
-/**
- * Persist the visibility flag for `keyringId` at
- * `_meta/visibility/<keyringId>`. Idempotent — call on every
- * `vault.user.setMyVisibility()` invocation. Own-only at the caller
- * site; this primitive does not enforce keyring ownership.
- */
-declare function persistUserVisibility(store: NoydbStore, vault: string, keyringId: string, visibility: UserVisibility): Promise<void>;
-/**
- * Delete the visibility flag for `keyringId`. Called from `revoke()`
- * alongside `deleteUserEnvelope` so the sidecar does not leak to a
- * re-granted principal with the same `userId`. Idempotent — the store's
- * `delete()` is already a no-op when the record is absent.
- */
-declare function deleteUserVisibility(store: NoydbStore, vault: string, keyringId: string): Promise<void>;
-
-/**
- * Return the ISO-4217 minor-unit scale for a currency code, or `null`
- * when the code is not in the known set (caller must supply an explicit
- * scale).
- */
-declare function scaleForCurrency(code: string): number | null;
-
-/**
- * Money-aware aggregation: exact `sum` / `min` / `max` over money
- * fields.
- *
- * The generic reducers (`aggregate/reducers.ts`) read a field via
- * `readNumber`, which coerces a string (the stored scaled-integer form
- * of money, e.g. `'12345'`) to `0` — so an un-wrapped money `sum` would
- * silently return zero. {@link wrapMoneyReducers} rewrites any `sum` /
- * `min` / `max` over a declared money field into a reducer that
- * accumulates per-currency `BigInt` totals of the stored integers, so
- * the result is exact for any magnitude (past `Number.MAX_SAFE_INTEGER`
- * included).
- *
- * Results are currency-aware and never silently mix currencies:
- *   - **fixed** mode → a single exact decimal string.
- *   - **multi** mode → an exact `Record<currency, string>` map.
- *   - **`sum` with `convertTo` + `fx`** → a single exact string, with
- *     each currency converted via BigInt arithmetic (no float).
- *
- * `remove()` is implemented for every money reducer so they participate
- * in incremental live-aggregation and materialized-view maintenance
- * exactly like the generic reducers they replace.
- */
-
-type FxRates = Record<string, number | string>;
-
-/**
- * Exact money arithmetic helpers (#337) — `mulRate` and `allocate`.
- *
- * Both operate on the canonical decoded string form that `get()`
- * returns (`'10000.00'`), entirely in scaled-`BigInt` space — no
- * floating-point step anywhere, exact past 2^53. They are pure
- * functions with no vault or descriptor dependency: the working scale
- * is inferred from the amount's fractional digits (a canonical money
- * string always carries exactly the field's scale) or pinned with
- * `opts.scale`.
- *
- * Why these two: app-side invariants of the form
- * `Σ parts === whole` (receipt totals, net-zero WHT pairs, proration)
- * carry ±0.01 tolerances ONLY because the math is major-unit floats +
- * round2. `mulRate` (VAT-style rate application with explicit
- * rounding) and `allocate` (largest-remainder split — parts sum to the
- * input EXACTLY, by construction) make those tolerances zero.
- */
-
-interface MulRateOptions {
-    /**
-     * Output scale (fraction digits). Defaults to the amount's own
-     * fractional digits — for a canonical money string that IS the
-     * field's scale.
-     */
-    readonly scale?: number;
-    /** Rounding for the final re-scale. Default `'half-up'`. */
-    readonly rounding?: RoundingMode;
-}
-interface AllocateOptions {
-    /** Working scale. Defaults to the amount's own fractional digits. */
-    readonly scale?: number;
-}
-/**
- * Multiply a money amount by a decimal rate, exactly.
- *
- * The rate is parsed at its OWN full precision (`0.07` → `7` at scale
- * 2), the product computed in `BigInt` at `amountScale + rateScale`,
- * then re-scaled back to the output scale with the requested rounding —
- * one rounding step, at the very end.
- *
- * ```ts
- * mulRate('10000.00', 0.07)                       // '700.00'  (VAT)
- * mulRate('33.33', '0.07')                        // '2.33'    (half-up)
- * mulRate('33.33', 0.07, { rounding: 'floor' })   // '2.33'
- * mulRate(100, 0.07, { scale: 2 })                // '7.00'
- * ```
- */
-declare function mulRate(amount: number | string, rate: number | string, opts?: MulRateOptions): string;
-/**
- * Split a money amount across weighted buckets with ZERO drift: the
- * returned parts sum to the input exactly, by construction
- * (largest-remainder method).
- *
- * Each bucket gets `floor(amount × weightᵢ / Σweights)`; the leftover
- * minor units (always fewer than the bucket count) go one each to the
- * buckets with the largest truncated remainders — ties broken by
- * position, earlier bucket first. Weights are parsed as exact decimals
- * (no float division anywhere); they must be non-negative with a
- * positive sum.
- *
- * ```ts
- * allocate('100.00', [1, 1, 1])   // ['33.34', '33.33', '33.33']
- * allocate('0.05', [3, 7])        // ['0.02', '0.03']
- * allocate('-100.00', [1, 1, 1])  // ['-33.34', '-33.33', '-33.33']
- * ```
- */
-declare function allocate(amount: number | string, weights: ReadonlyArray<number | string>, opts?: AllocateOptions): string[];
-
-/**
- * Branded money output type (#338).
- *
- * The decoded read shape of a money field is an exact decimal STRING
- * (`'10000.00'`) — but a hand-written schema types it `string | number`,
- * which is honest about the input side and unhelpful on the output
- * side: every read site hand-coerces, and a missed coercion passes
- * typecheck silently (then surfaces as a runtime template warning, or
- * worse, as `'10000.00' * 100` arithmetic).
- *
- * {@link MoneyString} is the output-side brand: a `string` that has
- * been through noy-db's decode (or {@link asMoney}'s guard). Branding
- * is type-level only — zero runtime cost on the read path.
- *
- * ## Wiring the brand through a validator (the input/output asymmetry)
- *
- * Keep the permissive `string | number` on the INPUT side so write
- * sites are untouched, and brand the OUTPUT side. With Zod:
- *
- * ```ts
- * import type { MoneyString } from '@noy-db/hub'
- *
- * const moneyValue = z.union([z.number(), z.string()]) as unknown as
- *   z.ZodType<MoneyString, z.ZodTypeDef, string | number>
- *
- * const Invoice = z.object({ id: z.string(), total: moneyValue })
- * type InvoiceOut = z.output<typeof Invoice> // total: MoneyString
- * type InvoiceIn  = z.input<typeof Invoice>  // total: string | number
- * ```
- *
- * The cast is sound for fields declared in `moneyFields`: reads pass
- * through `decodeMoneyFields`, which always produces the canonical
- * decimal string.
- */
-declare const MONEY_BRAND: unique symbol;
-/**
- * An exact decimal string produced by noy-db's money decode
- * (`'10000.00'`). The brand exists only at the type level — at runtime
- * a `MoneyString` is a plain string.
- */
-type MoneyString = string & {
-    readonly [MONEY_BRAND]: true;
-};
-/**
- * Runtime-guarded cast to {@link MoneyString}. Accepts a decimal string
- * or a number, returns the canonical decimal string branded — throws
- * `MoneyUnsupportedError` on anything non-finite / non-decimal. Use at
- * trust boundaries (deserialized JSON, route params); values read
- * through `get()`/`list()` are already canonical.
- */
-declare function asMoney(value: string | number): MoneyString;
-/** Type guard: is `value` a decimal string acceptable as money? */
-declare function isMoneyString(value: unknown): value is MoneyString;
-/**
- * The ONE sanctioned escape hatch to a JS `number` — explicit because
- * the conversion is lossy past 2^53. For display math and chart axes;
- * never feed the result back into stored amounts (use `mulRate` /
- * `allocate` for exact arithmetic).
- */
-declare function moneyNumber(value: MoneyString | string | number): number;
-
-/**
- * Hierarchical access — tier-aware keyring helpers.
- *
- * The keyring's existing `deks: Map<string, CryptoKey>` is keyed by
- * collection name. extends the key space:
- *
- *   `'invoices'`      — tier-0 DEK (unchanged from v0.x)
- *   `'invoices#1'`    — tier-1 DEK
- *   `'invoices#2'`    — tier-2 DEK
- *
- * Tier 0 keeps the bare collection name so any keyring written
- * before tiers existed loads without migration. Tiers ≥ 1 use `#N`
- * suffixes that
- * would be invalid as user-supplied collection names (see
- * `ReservedCollectionNameError` — `#` is reserved).
- *
- * @module
- */
-
-/** Canonical DEK key for a given collection + tier. Tier 0 → bare name. */
-declare function dekKey(collection: string, tier: number): string;
-/**
- * Returns the user's effective clearance for a given collection: the
- * maximum tier for which their keyring holds a DEK. Falls back to 0
- * when the user has only the tier-0 DEK (or none — the getDEK caller
- * will raise separately).
- */
-declare function effectiveClearance(keyring: UnlockedKeyring, collection: string): number;
-/**
- * Assert the caller is cleared for the requested tier. Owners and
- * admins always pass (they can mint any new tier DEK on demand);
- * other roles must already hold the tier DEK — via a prior grant or
- * an active delegation — otherwise this throws `TierNotGrantedError`.
- *
- * This gate runs BEFORE `getDEK()` on the mutation path so a
- * non-cleared operator never has the opportunity to silently
- * auto-create a tier DEK they shouldn't have.
- */
-declare function assertTierAccess(keyring: UnlockedKeyring, collection: string, tier: number): void;
-
-/**
- * Vault-level diff orchestrator.
- *
- * Compares a live `Vault`'s plaintext state against a candidate state
- * (another vault, a plain `{ collection: records[] }` map, or a vault
- * dump JSON) and returns a structured `VaultDiff` plan listing the
- * records that would be added, modified, or deleted to bring the live
- * vault into the candidate's shape.
- *
- * Builds on two existing record-level helpers:
- *
- *   1. `diff(a, b)` from `./history/diff.ts` — emits dot-pathed
- *      `DiffEntry[]` with `type: 'added' | 'removed' | 'changed'` for
- *      each changed field of two records. Used here for the
- *      `fieldDiffs` of every `modified` entry, and (with empty result)
- *      as the default deep-equal check.
- *
- *   2. `Vault.exportStream()` from `./vault.ts` — the canonical
- *      decrypt-and-stream-records iterator. Used to walk both sides
- *      when the candidate is itself a `Vault`. ACL-scoped: collections
- *      the caller can't read silently drop out, the same way every
- *      other plaintext-emitting export pipeline filters them.
- *
- * The new orchestration is the **vault-level** enumeration: bucket
- * each record id into added (only in candidate), deleted (only in
- * vault), or modified (in both with field changes); leave the
- * field-level granularity to the existing `diff()`.
- *
- * Use cases:
- *
- *   - Import preview (`@noy-db/as-*` `fromString` returns a plan
- *     whose body is a `VaultDiff`).
- *   - Backup verification ("does this `.noydb` bundle from yesterday
- *     match the current vault?").
- *   - Two-vault reconciliation ("what's different between Office A
- *     and Office B before we sync?").
- *   - Test assertions (golden-file testing with one-liner
- *     `expect(plan.summary).toEqual(...)`).
- *
- * @module
- */
-
-/** Per-record entry shape — added and deleted records carry only the record value. */
-interface VaultDiffEntry<T = unknown> {
-    readonly collection: string;
-    readonly id: string;
-    readonly record: T;
-    /**
-     * Unencrypted envelope metadata for the RECEIVER-side record.
-     * Populated only when `diffVault` is called with `{includeMetadata: true}`.
-     * Default: `undefined` (zero extra reads, no behavior change).
-     *
-     * Populated for `modified` (the CURRENT receiver state, before the candidate
-     * is applied) and `deleted` (the receiver envelope of the record being
-     * removed). `added` entries have no receiver envelope at diff time, so their
-     * `metadata` is always absent.
-     */
-    readonly metadata?: {
-        readonly version: number;
-        readonly timestamp: string;
-        readonly by?: string;
-        readonly source?: string;
-        readonly sourceTs?: string;
-    };
-}
-/** Modified records carry both halves of the diff plus the field-level breakdown. */
-interface VaultDiffModifiedEntry<T = unknown> extends VaultDiffEntry<T> {
-    /** The record as it stands in the live vault. */
-    readonly before: T;
-    /** Top-level keys whose values differ between `before` and `record`. */
-    readonly fieldsChanged: readonly string[];
-    /**
-     * Field-level diff entries from `diff(before, record)`. Reuses the
-     * existing per-record diff helper so consumers can render git-style
-     * `path: from → to` rows without re-walking the records.
-     */
-    readonly fieldDiffs: readonly DiffEntry[];
-}
-interface VaultDiff<T = unknown> {
-    readonly added: readonly VaultDiffEntry<T>[];
-    readonly modified: readonly VaultDiffModifiedEntry<T>[];
-    readonly deleted: readonly VaultDiffEntry<T>[];
-    /** Only populated when `options.includeUnchanged: true`. */
-    readonly unchanged: readonly VaultDiffEntry<T>[] | undefined;
-    readonly summary: {
-        readonly add: number;
-        readonly modify: number;
-        readonly delete: number;
-        readonly total: number;
-    };
-    /**
-     * Format the diff as a human-readable string.
-     *
-     *   - `'count'`   — one line, just the numbers (`12 added · 3 modified · 0 deleted`)
-     *   - `'one-line'` — count plus a single overview line
-     *   - `'full'`    — count + one row per added/modified/deleted record (default)
-     */
-    format(opts?: {
-        detail?: 'count' | 'one-line' | 'full';
-    }): string;
-}
-interface DiffOptions {
-    /** Restrict the diff to a subset of collections. */
-    readonly collections?: readonly string[];
-    /** Field on each record that carries its id. Defaults to `'id'`. */
-    readonly idKey?: string;
-    /** Override the default deep-equal check for "modified vs unchanged". */
-    readonly compareFn?: (a: unknown, b: unknown) => boolean;
-    /** If true, include unchanged records in the diff (off by default to save memory). */
-    readonly includeUnchanged?: boolean;
-    /**
-     * When `true`, each entry in `added`, `modified`, and `deleted` will carry a
-     * `metadata` field with the RECEIVER-side envelope metadata
-     * (`version`, `timestamp`, `by?`, `source?`, `sourceTs?`).
-     *
-     * Off by default — no extra adapter reads, no behavior change for existing callers.
-     * (FR-5 read surface, #445)
-     */
-    readonly includeMetadata?: boolean;
-}
-/**
- * Candidate state to diff the vault against:
- *
- *   - A `Vault` instance — both sides are walked via `exportStream()`.
- *   - A `Record<collection, records[]>` map — same shape `as-json.toObject()`
- *     produces. Useful for diffing parsed file content against the live vault.
- *   - A `VaultDump` (output of `vault.dump()`) — a JSON string carrying the
- *     full vault state. Parsed and reduced to the map shape above.
- */
-type DiffCandidate<T = unknown> = Vault | Record<string, readonly T[]> | string;
-/**
- * Compute the diff between a live vault and a candidate state.
- *
- * Returns a fully buffered `VaultDiff` — no streaming. Memory cost is
- * O(n + m) in the row count of vault + candidate. For documented
- * 1K-50K-record vaults this is fine; a streaming variant lands as a
- * follow-up if a > 100K-record consumer arrives.
- */
-declare function diffVault<T = unknown>(vault: Vault, candidate: DiffCandidate<T>, options?: DiffOptions): Promise<VaultDiff<T>>;
-
-export { ActiveTier, type AllocateOptions, type CheckGateContext, DEED_RECORD_ID, DEFAULT_FRESHNESS_MS, DIRECTORY_RECORD_ID, type DeedMarker, type DiffCandidate, DiffEntry, type DiffOptions, DirectoryConfig, EncryptedEnvelope, FactorProof, type FxRates, GateName, GatePolicy, META_COLLECTION, ManagedRecoveryNotEnrolledError, type MoneyString, type MulRateOptions, NoydbError, NoydbStore, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, type PersistSchemaResult, PersistedSchemaEnvelope, PolicyDeniedError, type PolicyDenyReason, PublicEnvelope, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, RoundingMode, SCHEMAS_COLLECTION, STATE_VAULT_NAME, STRICT_POLICY, SchemaUpdateStrategy, SealingKeyProvider, type Tokenizer, UnlockedKeyring, UpdateDecision, UserEnvelope, UserVisibility, VISIBILITY_RECORD_PREFIX, Vault, type VaultDiff, type VaultDiffEntry, type VaultDiffModifiedEntry, VaultPolicy, additiveOnly, allocate, asMoney, assertTierAccess, blindUpdate, checkGate, coordinatedCutover, createDeedOwner, dekKey, deleteUserEnvelope, deleteUserVisibility, derivePersistedSchema, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, diffVault, effectiveClearance, estimateRecordBytes, isDeedVault, isMoneyString, isZodSchema, listUserEnvelopeIds, loadDeedMarker, loadPersistedSchema, loadPublicEnvelope, loadUserEnvelope, loadVaultPolicy, lockSchema, mergePolicy, moneyNumber, mulRate, parseBytes, persistDirectoryConfig, persistSchemaIfNeeded, persistUserVisibility, readDirectoryConfig, readPlaintextRecord, readPublicEnvelope, readUserVisibility, savePersistedSchema, savePublicEnvelope, saveUserEnvelope, saveVaultPolicy, scaleForCurrency, tokenize, visibilityRecordId };