@noy-db/hub 0.2.0-pre.9 → 0.3.0-pre.1

package/dist/index.d.ts

@@ -1,77 +1,27 @@
-import { b3 as NoydbStore, bF as UserEnvelope, br as PublicEnvelope, bG as GateName, bH as GatePolicy, bI as VaultPolicy, bJ as ActiveTier, bK as FactorProof, bL as SchemaUpdateStrategy, bM as TransformFn, bN as PersistedSchemaEnvelope, bO as UpdateDecision, bP as DirectoryConfig, bQ as UserVisibility, b1 as UnlockedKeyring, bw as Vault, ba as DiffEntry } from './types-Df28QFKb.js';
-export { bR as AccessibleVault, bS as AffectedDocument, b7 as AppendInput, aP as ArrayOutputSpec, z as BLOB_CHUNKS_COLLECTION, A as BLOB_COLLECTION, E as BLOB_INDEX_COLLECTION, F as BLOB_SLOTS_PREFIX, G as BLOB_VERSIONS_PREFIX, bT as BUNDLE_STORE_POLICY, M as BlobObject, N as BlobPutOptions, Q as BlobResponseOptions, T as BlobSet, bU as BuiltInGateName, bt as BundleRecipient, a9 as CONSENT_AUDIT_COLLECTION, bV as CacheOptions, bW as CacheStats, bX as ChangeEvent, b8 as ChangeType, ai as ClosePeriodOptions, aY as Collection, bY as CollectionChangeEvent, bZ as CollectionConflictResolver, b_ as CollectionDescriptor, az as CollectionFrame, b9 as CollectionInstant, b$ as CollectionStats, c0 as Conflict, c1 as ConflictPolicy, c2 as ConflictStrategy, aa as ConsentAuditEntry, ab as ConsentAuditFilter, ac as ConsentContext, ad as ConsentOp, c3 as CrossTierAccessEvent, Y as DEFAULT_CHUNK_SIZE, c4 as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, c5 as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, c6 as DeepPartial, c7 as DeepPartialOrNull, c8 as DelegationToken, c9 as DeleteManyResult, ca as DerivationDescriptor, aN as DerivationStrategy, aR as DerivationStrategyHandle, aS as DerivedFromMeta, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, cb as DirtyEntry, cc as DryRunResult, cd as DumpSchemaOptions, ce as ELEVATION_AUDIT_COLLECTION, cf as ElevatedHandle, b5 as EncryptedEnvelope, cg as EnrollAuthenticatorOptions, ch as EnrollAuthenticatorWrappingDEKsOptions, ci as EnrollAuthenticatorWrappingKEKOptions, cj as EnrollRecoveryResult, ck as ExportCapability, cl as ExportChunk, cm as ExportFormat, cn as ExportStreamOptions, co as FactorKind, cp as FactorProofBundle, cq as FactorRequirement, cr as FenceDoc, cs as FenceState, ct as FieldChange, cu as FieldDescriptor, cv as FieldSource, cw as GhostRecord, cx as GrantOptions, at as GuardChange, au as GuardContext, as as GuardStrategy, aw as GuardStrategyHandle, cy as GuardViolation, cz as HistoryConfig, cA as HistoryEntry, b4 as HistoryOptions, e as I18nMap, f as I18nTextDescriptor, g as I18nTextOptions, cB as INDEXED_STORE_POLICY, cC as ImportCapability, cD as InferOutput, cE as InternalCollectionStats, cF as IssueDelegationOptions, cG as IssueMagicLinkGrantOptions, bb as JsonPatch, bc as JsonPatchOp, cH as KeyringAuthenticator, cI as KeyringAuthenticatorWrappingDEKs, cJ as KeyringAuthenticatorWrappingKEK, cK as KeyringFile, L as Layer, bd as LedgerEntry, be as LedgerStore, cL as ListAccessibleVaultsOptions, cM as ListPageResult, cN as ListUsersOptions, cO as LiveUserEnvelope, cP as LocaleReadOptions, cQ as Lru, cR as LruOptions, cS as LruStats, cT as MAGIC_LINK_CONTENT_INFO_PREFIX, cU as MAGIC_LINK_GRANTS_COLLECTION, cV as MAGIC_LINK_KEK_INFO_PREFIX, cW as MagicLinkGrantPayload, cX as MagicLinkGrantRecord, bC as MaterializedFromMeta, cY as MaterializedViewDescriptor, bD as MaterializedViewOutput, aV as MaterializedViewStrategy, aW as MaterializedViewStrategyHandle, cZ as MemoryRecipientSealer, c_ as MemorySealingKeyProvider, c$ as NOYDB_BACKUP_VERSION, d0 as NOYDB_FORMAT_VERSION, d1 as NOYDB_KEYRING_VERSION, d2 as NOYDB_SYNC_VERSION, d3 as Noydb, aB as NoydbBundleStore, d4 as NoydbEventMap, d5 as NoydbOptions, O as OnMissing, h as OnMissingPolicy, aj as OpenPeriodOptions, aT as OutputSpec, d6 as OverlayViewDescriptor, aX as OverlayedViewStrategy, a_ as OverlayedViewStrategyHandle, ak as PERIODS_COLLECTION, d7 as PUBLIC_ENVELOPE_FIELDS, d8 as PaperRecoveryDoc, d9 as PaperRecoveryEntry, da as PassphrasePolicy, db as PassphraseValidationResult, al as PeriodRecord, dc as Permission, dd as Permissions, de as PersistedSchemaKind, df as PlaintextTranslatorContext, dg as PlaintextTranslatorFn, P as PolicyEnforcer, dh as PresenceHandle, di as PresencePeer, b6 as PruneOptions, dj as PublicEnvelopeField, dk as PublicEnvelopeSchema, dl as PublicEnvelopeText, dm as PullMode, dn as PullOptions, dp as PullPolicy, dq as PullResult, dr as PushMode, ds as PushOptions, dt as PushPolicy, du as PushResult, dv as PutManyItemOptions, dw as PutManyOptions, dx as PutManyResult, dy as QueryAcrossOptions, dz as QueryAcrossResult, dA as QuickUnlockState, dB as QuickUnlockStore, dC as ReAuthOperation, bv as RecipientHint, bu as RecipientSealer, aU as RecordOutputSpec, dD as RecoverPassphraseInput, dE as RecoverPassphraseResult, dF as RecoverUserOptions, dG as RecoveryProof, R as ResolveI18nOptions, dH as ResolvedPublicEnvelopeSchema, aC as RetentionPolicy, dI as RevokeOptions, b0 as Role, dJ as RotatePassphraseInput, dK as RotateRecoveryOptions, dL as RotateRecoveryResult, dM as SEALED_PASSPHRASE_RECORD_ID, dN as SchemaDelta, dO as SchemaIntrospection, S as ScriptWarning, dP as SealedEnvelope, dQ as SealedPassphrase, bs as SealingKeyProvider, dR as SessionPolicy, dS as SetPublicEnvelopeInput, dT as ShamirRecoveryDoc, dU as ShamirRecoveryEntry, by as ShamirRecoveryProvider, a3 as SlotInfo, a4 as SlotRecord, dV as SlotRewrapCeremony, dW as SlotRewrapContext, aF as SnapshotMeta, dX as StandardSchemaV1, dY as StandardSchemaV1Issue, dZ as StandardSchemaV1SyncResult, d_ as StoreAuth, d$ as StoreAuthKind, e0 as StoreCapabilities, e1 as SyncEngine, e2 as SyncMetadata, e3 as SyncPolicy, e4 as SyncScheduler, e5 as SyncSchedulerStatus, e6 as SyncStatus, e7 as SyncTarget, e8 as SyncTargetRole, e9 as SyncTransaction, ea as SyncTransactionResult, eb as TabChannel, ec as TabCoordinationOptions, ed as TabLockManager, ee as TabPresence, ef as TabRole, eg as TierMode, eh as TranslatorAuditEntry, aJ as TxCollection, aK as TxContext, ei as TxOp, aL as TxVault, ej as USER_ENVELOPE_COLLECTION, ek as USER_ENVELOPE_MAX_BYTES, bE as UnionSource, el as Unsubscribe, em as UpdateAuthenticatorOptions, en as UpdateContext, eo as UpdateUserOptions, ep as UserApi, eq as UserEnvelopeCheckGate, er as UserEnvelopeOversizedError, es as UserEnvelopePresented, et as UserInfo, eu as VaultBackup, bf as VaultEngine, aA as VaultFrame, bg as VaultInstant, ev as VaultPolicyOnDisk, ew as VaultSchemaSnapshot, ex as VaultSnapshot, bh as VerifyResult, a5 as VersionRecord, ey as WarningRules, ez as WeakPassphraseError, eA as WeakPassphraseReason, eB as WrappedDeksBlob, eC as WriteConflict, eD as WriteEvent, eE as WriteHook, eF as WriteQueue, i as applyI18nLocale, bi as applyPatch, eG as assertStrongPassphrase, eH as buildRecipientKeyringFile, eI as burnPaperRecoveryEntry, bj as canonicalJson, bk as computePatch, x as createEnforcer, eJ as createNoydb, eK as createStore, eL as deriveMagicLinkContentKey, j as dictCollectionName, k as dictKey, bl as diff, l as enforceScript, eM as enrollAuthenticator, eN as estimateEntropy, eO as evaluateExportCapability, eP as evaluateImportCapability, eQ as findAuthenticator, bm as formatDiff, eR as hasExportCapability, eS as hasImportCapability, eT as hasRecoveryEnrolled, bn as hashEntry, n as i18nText, o as inferScripts, p as isDictCollectionName, q as isDictKeyDescriptor, r as isI18nTextDescriptor, eU as isMagicLinkGrantExpired, eV as isPublicEnvelope, eW as issueDelegation, eX as keyringRecoverPassphrase, eY as keyringRotatePassphrase, eZ as listMagicLinkGrants, e_ as listUsers, e$ as listUsersWithEnvelopes, f0 as loadActiveDelegations, f1 as loadPaperRecoveryEntries, f2 as loadSealedPassphrase, f3 as loadShamirRecoveryEntries, f4 as magicLinkGrantRecordId, f5 as mintPaperRecoveryEntry, f6 as mintShamirRecoveryEntry, f7 as mintWrappedDeksBlob, bo as paddedIndex, bp as parseIndex, f8 as parseSealedEnvelope, f9 as readMagicLinkGrantRecord, fa as recoverUser, fb as removeAuthenticator, s as resolveI18nText, t as resolvePolicy, fc as resolvePublicEnvelopeSchema, fd as revokeDelegation, fe as revokeMagicLinkGrant, aM as runTransaction, ff as savePaperRecoveryEntries, fg as saveSealedPassphrase, fh as saveShamirRecoveryEntries, bq as sha256Hex, fi as unwrapDeksFromBlob, fj as unwrapDeksFromPaperEntry, fk as unwrapDeksFromShamirEntry, fl as unwrapMagicLinkGrant, v as validateI18nTextValue, fm as validatePassphrase, fn as validatePublicEnvelopeInput, fo as validateSchemaInput, fp as validateSchemaOutput, y as validateSessionPolicy, fq as writeMagicLinkGrant } from './types-Df28QFKb.js';
-export { d as detectMagic, a as detectMimeType, i as isPreCompressed } from './mime-magic-CBBSOkjm.js';
-export { AgeRoute, BlobLifecyclePolicy, BlobStoreRoute, CircuitBreakerOptions, HealthCheckOptions, LogLevel, LoggingOptions, MetricsOptions, OverrideOptions, OverrideTarget, RetryOptions, RouteStatus, RouteStoreOptions, RoutedNoydbStore, StoreCacheOptions, StoreMiddleware, StoreOperation, SuspendOptions, WrapBundleStoreOptions, WrappedBundleNoydbStore, createBundleStore, routeStore, withCache, withCircuitBreaker, withHealthCheck, withLogging, withMetrics, withRetry, wrapBundleStore, wrapStore } from './store/index.js';
-import { N as NoydbError } from './index-D8I_pyJD.js';
-export { z as AlreadyElevatedError, A as AmendmentForbiddenError, o as AttestationError, B as BackupCorruptedError, q as BackupLedgerError, r as BundleIntegrityError, s as BundleSealMismatchError, t as BundleVersionConflictError, C as ConflictError, E as CrossJoinSourceUnknownError, G as CrossJoinTooLargeError, H as DEFAULT_CROSS_JOIN_MAX_ROWS, J as DEFAULT_JOIN_MAX_ROWS, K as DanglingReferenceError, U as DecryptionError, V as DelegationTargetMissingError, g as DerivationCapExceededError, h as DerivationCycleError, i as DerivationDepthError, j as DerivationOutputShapeError, k as DerivationOutputUnknownError, D as DictKeyInUseError, a as DictKeyMissingError, W as DirectoryDisabledError, X as ElevationExpiredError, Y as ExportCapabilityError, F as FieldFrozenError, Z as FilenameSanitizationError, _ as GroupCardinalityError, $ as ImportCapabilityError, a0 as IndexRequiredError, a1 as IndexWriteFailureError, a2 as InvalidKeyError, I as InvariantError, a3 as JoinContext, a4 as JoinLeg, a5 as JoinStrategy, a6 as JoinTooLargeError, a7 as JoinableSource, a8 as KeyringCorruptError, a9 as KeyringExpiredError, aa as LedgerContentionError, ab as LiveQuery, ac as LiveUpstream, L as LocaleNotSpecifiedError, v as MaterializedViewConfigError, w as MaterializedViewCycleError, x as MaterializedViewSourceUnknownError, y as MaterializedViewTooLargeError, ad as MigrationRequiredError, M as MissingTranslationError, ae as NetworkError, af as NoAccessError, ag as NonAdditiveSchemaChangeError, ah as NotFoundError, ai as OrderBy, O as OverlayBaseIsVirtualError, l as OverlayCollectionUnavailableError, m as OverlayIdMismatchError, n as OverlayNameCollisionError, aj as PathEscapeError, ak as PeriodClosedError, al as PermissionDeniedError, am as PrivilegeEscalationError, Q as Query, an as QueryPlan, ao as QuerySource, ap as QuiesceTimeoutError, aq as ReadOnlyAtInstantError, ar as ReadOnlyError, as as ReadOnlyFrameError, e as RecordLockedError, at as RefDescriptor, au as RefIntegrityError, av as RefMode, aw as RefRegistry, ax as RefScopeError, ay as RefViolation, R as ReservedCollectionNameError, az as ScanBuilder, aA as ScanPageProvider, aB as SchemaFenceError, aC as SchemaLockedError, aD as SchemaUpdateError, aE as SchemaValidationError, S as ScriptViolationError, b as SessionExpiredError, c as SessionNotFoundError, d as SessionPolicyError, f as SnapshotNotFoundError, aF as StoreCapabilityError, aG as TamperedError, aH as TierDemoteDeniedError, aI as TierNotGrantedError, T as TranslatorNotConfiguredError, aJ as ValidationError, aK as applyJoins, aL as buildLiveQuery, aM as executePlan, aN as ref, aO as resetJoinWarnings } from './index-D8I_pyJD.js';
-export { A as AutoCredential, n as AutoCredentialKind, c as CompressionAlgo, N as NOYDB_BUNDLE_FORMAT_VERSION, e as NOYDB_BUNDLE_MAGIC, f as NOYDB_BUNDLE_PREFIX_BYTES, g as NoydbBundleHeader, h as NoydbBundleReadResult, R as ReadNoydbBundleOptions, W as WriteNoydbBundleOptions, j as generateULID, o as hasNoydbBundleMagic, k as isULID, r as readNoydbBundle, l as readNoydbBundleHeader, p as readNoydbBundlePublicEnvelope, m as resetBrotliSupportCache, w as writeNoydbBundle } from './ulid-CJ8RzRrm.js';
-export { a as CrdtMode, b as CrdtState, L as LwwMapState, R as RgaState, Y as YjsState, m as mergeCrdtStates, r as resolveCrdtSnapshot } from './strategy-BSxFXGzb.js';
-export { w as withGuard } from './with-guard-qube6BMI.js';
-export { w as withDerivation } from './with-derivation-DFnFByiQ.js';
-export { w as withMaterializedView } from './with-materialized-view-BLkQxoQN.js';
-export { a as Clause, C as CollectionIndexes, F as FieldClause, b as FilterClause, G as GroupClause, H as HashIndex, I as IndexDef, O as Operator, e as evaluateClause, c as evaluateFieldClause, r as readPath } from './predicate-BSAGEyu5.js';
-export { w as withOverlayedView } from './with-overlayed-view-CRsSEwHR.js';
+import { e0 as SearchStrategy, e1 as SequenceStrategy, e2 as CustodyStrategy, cV as EncryptedEnvelope, e3 as SchemaUpdateStrategy, e4 as TransformFn, cT as NoydbStore, e5 as PersistedSchemaEnvelope, dj as EnclaveKey, e6 as UpdateDecision, dL as PublicEnvelope, e7 as UserEnvelope, e8 as VaultUserApi, e9 as UserApiDeps, cy as RequestWithdrawalOptions, cz as RequestWithdrawalResult, cD as WithdrawalRequestStatus, cC as WithdrawalRequest, ct as ApproveWithdrawalOptions, cB as WithdrawResult, cx as RejectWithdrawalOptions, cA as WithdrawAccessibleOptions, cu as ExportAccessibleOptions, ea as DeepPartialOrNull, eb as UserEnvelopePresented, ec as Unsubscribe, ed as LiveUserEnvelope, ee as RoundingMode, cF as UnlockedKeyring, ef as VaultPolicy, eg as ActiveTier, eh as FactorProof, ei as GateName, ej as PolicyDenyReason, ek as GatePolicy } from './index-BzUo1B6n.js';
+export { el as AccessibleVault, em as AffectedDocument, aP as AggregateResult, aQ as AggregateSpec, aR as Aggregation, aS as AggregationUpstream, en as AlreadyElevatedError, bM as AmendmentForbiddenError, cX as AppendInput, eo as ArchivePolicy, ep as ArchiveResult, eq as ArchiveRunOptions, er as ArchiveStrategy, c4 as ArrayOutputSpec, dz as AttestationError, dA as AttestationNotEnabledError, Y as BLOB_CHUNKS_COLLECTION, Z as BLOB_COLLECTION, $ as BLOB_INDEX_COLLECTION, a0 as BLOB_SLOTS_PREFIX, a1 as BLOB_VERSIONS_PREFIX, es as BUNDLE_STORE_POLICY, dl as BackupCorruptedError, dm as BackupLedgerError, a5 as BlobObject, a6 as BlobPutOptions, a7 as BlobResponseOptions, a8 as BlobSet, et as BuiltInGateName, dn as BundleIntegrityError, dM as BundleRecipient, dp as BundleSealMismatchError, dq as BundleVersionConflictError, bq as CONSENT_AUDIT_COLLECTION, eu as CacheOptions, ev as CacheStats, ew as CargoNotEnabledError, ex as CargoStrategy, ey as ChangeEvent, cY as ChangeType, ez as Clause, bz as ClosePeriodOptions, ci as Collection, eA as CollectionChangeEvent, eB as CollectionConfig, eC as CollectionConflictResolver, eD as CollectionDescriptor, bV as CollectionFrame, ay as CollectionIndexes, cZ as CollectionInstant, eE as CollectionStats, eF as ComputedFieldError, eG as ComputedFields, eH as ComputedFn, eI as Conflict, eJ as ConflictError, eK as ConflictPolicy, eL as ConflictStrategy, br as ConsentAuditEntry, bs as ConsentAuditFilter, bt as ConsentContext, bu as ConsentOp, bg as CrdtMode, bh as CrdtState, eM as CrossJoinSourceUnknownError, eN as CrossJoinTooLargeError, eO as CrossTierAccessEvent, eP as CustodyApi, eQ as CustodyHost, eR as CustodyNotEnabledError, ad as DEFAULT_CHUNK_SIZE, eS as DEFAULT_CROSS_JOIN_MAX_ROWS, eT as DEFAULT_JOIN_MAX_ROWS, eU as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, eV as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, eW as DanglingReferenceError, eX as DataResidencyError, eY as DebugPlaintextError, eZ as DebugReservedFieldError, e_ as DecryptionError, e$ as DeepPartial, f0 as DeferredNumberingConfig, f1 as DelegationTargetMissingError, f2 as DelegationToken, f3 as DeleteManyResult, c5 as DerivationCapExceededError, c6 as DerivationCycleError, c7 as DerivationDepthError, f4 as DerivationDescriptor, c8 as DerivationOutputShapeError, c9 as DerivationOutputUnknownError, c2 as DerivationStrategy, cb as DerivationStrategyHandle, cc as DerivedFromMeta, a as DictEntry, b as DictKeyDescriptor, c as DictKeyInUseError, d as DictKeyMissingError, e as DictionaryHandle, f as DictionaryOptions, cE as DiffEntry, f5 as DirectoryDisabledError, f6 as DirtyEntry, f7 as DryRunResult, f8 as DumpSchemaOptions, f9 as ELEVATION_AUDIT_COLLECTION, fa as ElevatedHandle, fb as ElevationExpiredError, fc as EmbeddingDescriptor, fd as EmbeddingDimMismatchError, fe as EmbeddingModelMismatchError, ff as EnclaveNotSupportedError, fg as EnrollAuthenticatorOptions, fh as EnrollAuthenticatorWrappingDEKsOptions, fi as EnrollAuthenticatorWrappingKEKOptions, fj as EnrollRecoveryResult, fk as ExportCapability, fl as ExportCapabilityError, fm as ExportChunk, cG as ExportFormat, fn as ExportStreamOptions, fo as FactorKind, fp as FactorProofBundle, fq as FactorRequirement, fr as FenceDoc, fs as FenceState, ft as FieldChange, fu as FieldClause, fv as FieldDescriptor, bN as FieldFrozenError, fw as FieldSource, fx as FilenameSanitizationError, fy as FilterClause, fz as ForgetStrategyNotConfiguredError, fA as FormattedSequenceHandle, fB as FrozenSnapshotRef, aT as GROUPBY_MAX_CARDINALITY, aU as GROUPBY_WARN_CARDINALITY, fC as GhostRecord, fD as GrantCustodianOptions, fE as GrantOptions, fF as GroupCardinalityError, fG as GroupClause, aV as GroupedAggregation, aW as GroupedQuery, aX as GroupedQueryN, aY as GroupedRow, aZ as GroupedRowN, bK as GuardChange, bL as GuardContext, bJ as GuardStrategy, bP as GuardStrategyHandle, fH as GuardViolation, az as HashIndex, fI as HistoryConfig, fJ as HistoryEntry, cU as HistoryOptions, g as I18nMap, h as I18nTextDescriptor, i as I18nTextOptions, fK as INDEXED_STORE_POLICY, bQ as IllegalTransitionError, fL as ImportCapability, fM as ImportCapabilityError, aB as IndexDef, fN as IndexFieldName, fO as IndexRequiredError, fP as IndexWriteFailureError, fQ as InferOutput, fR as InternalCollectionStats, fS as InvalidKeyError, bR as InvariantError, fT as IssueDelegationOptions, fU as IssueMagicLinkGrantOptions, fV as JoinContext, fW as JoinLeg, fX as JoinStrategy, fY as JoinTooLargeError, fZ as JoinableSource, c_ as JsonPatch, c$ as JsonPatchOp, f_ as KeyringAuthenticator, f$ as KeyringAuthenticatorWrappingDEKs, g0 as KeyringAuthenticatorWrappingKEK, g1 as KeyringCorruptError, g2 as KeyringExpiredError, g3 as KeyringFile, L as Layer, g4 as LedgerContentionError, d0 as LedgerStore, g5 as LiberateOptions, g6 as LiberateResult, g7 as LinkEndpointError, g8 as LinkIntegrityError, g9 as LinkOnDelete, ga as LinkRow, gb as LinkSetHandle, gc as LinkSpec, gd as ListAccessibleVaultsOptions, ge as ListPageResult, gf as ListUsersOptions, a_ as LiveAggregation, gg as LiveQuery, gh as LiveUpstream, j as LocaleNotSpecifiedError, gi as LocaleReadOptions, gj as Lru, gk as LruOptions, gl as LruStats, bi as LwwMapState, gm as MAGIC_LINK_CONTENT_INFO_PREFIX, gn as MAGIC_LINK_GRANTS_COLLECTION, go as MAGIC_LINK_KEK_INFO_PREFIX, gp as MagicLinkGrantPayload, gq as MagicLinkGrantRecord, gr as ManagedRecoveryNotEnrolledError, dU as MaterializedFromMeta, dV as MaterializedViewConfigError, dW as MaterializedViewCycleError, gs as MaterializedViewDescriptor, dX as MaterializedViewOutput, dY as MaterializedViewSourceUnknownError, cf as MaterializedViewStrategy, cg as MaterializedViewStrategyHandle, dZ as MaterializedViewTooLargeError, gt as MemoryRecipientSealer, gu as MemorySealingKeyProvider, gv as MigrationRequiredError, M as MissingTranslationError, gw as MoneyCurrencyError, gx as MoneyDescriptor, gy as MoneyOptions, gz as MoneyOptionsFixed, gA as MoneyOptionsMulti, gB as MoneyPrecisionError, gC as MoneyString, gD as MoneyUnsupportedError, gE as NOYDB_BACKUP_VERSION, gF as NOYDB_FORMAT_VERSION, gG as NOYDB_KEYRING_VERSION, gH as NOYDB_SYNC_VERSION, gI as NO_CARGO, gJ as NO_CUSTODY, gK as NO_SEARCH, gL as NO_SEQUENCE, gM as NetworkError, gN as NextOptions, gO as NoAccessError, gP as NonAdditiveSchemaChangeError, gQ as NotFoundError, gR as Noydb, gS as NoydbBundleStore, gT as NoydbError, gU as NoydbEventMap, gV as NoydbOptions, bX as NoydbPodStore, gW as NumberingAssignment, gX as NumberingUncertaintyError, ak as ObjectListEntry, al as ObjectMeta, am as ObjectProjection, an as ObjectUrlOptions, O as OnMissing, k as OnMissingPolicy, bA as OpenPeriodOptions, gY as Operator, gZ as OrderBy, cd as OutputSpec, cj as OverlayBaseIsVirtualError, ck as OverlayCollectionUnavailableError, cl as OverlayFieldMergeMode, cm as OverlayFieldMergeRule, cn as OverlayIdMismatchError, co as OverlayNameCollisionError, g_ as OverlayViewDescriptor, ch as OverlayedViewStrategy, cq as OverlayedViewStrategyHandle, bB as PERIODS_COLLECTION, g$ as POD_STORE_POLICY, h0 as PUBLIC_ENVELOPE_FIELDS, h1 as PaperRecoveryDoc, h2 as PaperRecoveryEntry, h3 as PassphrasePolicy, h4 as PassphraseValidationResult, h5 as PathEscapeError, h6 as PeriodClosedError, bC as PeriodRecord, h7 as Permission, h8 as PermissionDeniedError, h9 as Permissions, ha as PersistedSchemaKind, hb as PlaintextTranslatorContext, hc as PlaintextTranslatorFn, du as PodVersionConflictError, hd as PolicyDeniedError, P as PolicyEnforcer, cw as PortabilityNotEnabledError, he as PresenceHandle, hf as PresencePeer, hg as PrivilegeEscalationError, cW as PruneOptions, hh as PublicEnvelopeField, hi as PublicEnvelopeSchema, hj as PublicEnvelopeText, hk as PullMode, hl as PullOptions, hm as PullPolicy, hn as PullResult, ho as PushMode, hp as PushOptions, hq as PushPolicy, hr as PushResult, hs as PutManyItemOptions, ht as PutManyOptions, hu as PutManyResult, ao as PutObjectOptions, ap as PutUrlOptions, dS as Query, hv as QueryAcrossOptions, hw as QueryAcrossResult, hx as QueryField, hy as QueryPlan, hz as QuerySource, hA as QuickUnlockState, hB as QuickUnlockStore, hC as QuiesceTimeoutError, hD as ReAuthOperation, hE as ReadOnlyAtInstantError, hF as ReadOnlyError, hG as ReadOnlyFrameError, dO as RecipientHint, dN as RecipientSealer, hH as RecordCekNotFoundError, bT as RecordLockedError, ce as RecordOutputSpec, hI as RecoverPassphraseInput, hJ as RecoverPassphraseResult, hK as RecoverUserOptions, hL as RecoveryNotEnrolledError, hM as RecoveryProfileNotImplementedError, hN as RecoveryProof, a$ as Reducer, b0 as ReducerBuilder, b1 as ReducerOptions, hO as RefDescriptor, hP as RefIntegrityError, hQ as RefMode, hR as RefRegistry, hS as RefScopeError, hT as RefViolation, R as ReservedCollectionNameError, hU as ReservedVaultNameError, l as ResolveI18nOptions, hV as ResolvedPublicEnvelopeSchema, bY as RetentionPolicy, hW as RetrieveHit, hX as RetrieveOptions, hY as RevokeOptions, bj as RgaState, cR as Role, hZ as RotatePassphraseInput, h_ as RotateRecoveryOptions, h$ as RotateRecoveryResult, i0 as SEALED_PASSPHRASE_RECORD_ID, i1 as ScanBuilder, i2 as ScanPageProvider, i3 as SchemaDelta, i4 as SchemaFenceError, i5 as SchemaIntrospection, i6 as SchemaLockedError, i7 as SchemaUpdateError, i8 as SchemaValidationError, S as ScriptViolationError, m as ScriptWarning, i9 as Sealed, ia as SealedEnvelope, ib as SealedHandle, ic as SealedPassphrase, dc as SealedRecordExpiredError, dd as SealedRecordMismatchError, de as SealedRecordNotEnabledError, id as SealedView, dg as SealingKeyProvider, ie as SearchEntry, ig as SearchNotEnabledError, ih as SearchOptions, ii as SearchResult, ij as SequenceContentionError, ik as SequenceHandle, il as SequenceNotEnabledError, im as SequenceOfflineError, io as SequenceOptions, ip as SequenceStore, iq as SequenceStoreOptions, J as SessionExpiredError, K as SessionNotFoundError, ir as SessionPolicy, N as SessionPolicyError, is as SetPublicEnvelopeInput, it as ShamirRecoveryDoc, iu as ShamirRecoveryEntry, di as ShamirRecoveryProvider, iv as ShardProvisioningError, aq as SlotInfo, ar as SlotRecord, iw as SlotRewrapCeremony, ix as SlotRewrapContext, b$ as SnapshotMeta, c1 as SnapshotNotFoundError, iy as StandardSchemaV1, iz as StandardSchemaV1Issue, iA as StandardSchemaV1SyncResult, n as StaticDictDescriptor, o as StaticDictReadonlyError, iB as StoreAuth, iC as StoreAuthKind, iD as StoreCapabilities, iE as StoreCapabilityError, iF as StoreTime, iG as SyncEngine, iH as SyncMetadata, iI as SyncPolicy, iJ as SyncScheduler, iK as SyncSchedulerStatus, iL as SyncStatus, iM as SyncTarget, iN as SyncTargetRole, iO as SyncTransaction, iP as SyncTransactionResult, iQ as TabChannel, iR as TabCoordinationOptions, iS as TabLockManager, iT as TabPresence, iU as TabRole, iV as TamperedError, iW as TierDemoteDeniedError, iX as TierMode, iY as TierNotGrantedError, iZ as TiersNotEnabledError, i_ as TransactionInvariant, i$ as TranslatorAuditEntry, T as TranslatorNotConfiguredError, j0 as TxCollection, dP as TxContext, j1 as TxOp, j2 as TxVault, d_ as UnionArmJoin, d$ as UnionSource, j3 as UniqueConstraintError, U as UnknownDictCodeError, j4 as UnknownShardError, j5 as UnsupportedIndexOptionError, j6 as UpdateAuthenticatorOptions, j7 as UpdateContext, j8 as UpdateUserOptions, j9 as UserEnvelopeCheckGate, ja as UserEnvelopeOversizedError, jb as UserInfo, jc as ValidationError, V as Vault, jd as VaultBackup, d1 as VaultEngine, bW as VaultFrame, d2 as VaultInstant, je as VaultPolicyOnDisk, jf as VaultSchemaSnapshot, jg as VaultSnapshot, jh as VaultTemplateNotFoundError, d3 as VerifyResult, as as VersionRecord, ji as WarningRules, jj as WeakPassphraseError, jk as WeakPassphraseReason, jl as WithArchiveOptions, jm as WithdrawalRequestError, jn as WrappedDeksBlob, jo as WriteConflict, jp as WriteQueue, bk as YjsState, jq as aesGcmOpen, p as applyI18nLocale, jr as applyJoins, d4 as applyPatch, js as approveWithdrawal, jt as asMoney, ju as assertStrongPassphrase, b2 as avg, jv as base64ToBuffer, jw as bufferToBase64, jx as buildLiveQuery, jy as buildRecipientKeyringFile, jz as burnPaperRecoveryEntry, jA as compileSequenceFormat, d5 as computePatch, b4 as count, Q as createEnforcer, jB as createNoydb, jC as createStore, jD as decryptBytes, jE as decryptDeterministic, jF as deriveMagicLinkContentKey, jG as derivePresenceKey, q as dictCollectionName, r as dictKey, d6 as diff, jH as encryptBytes, jI as encryptDeterministic, s as enforceScript, jJ as enrollAuthenticator, jK as estimateEntropy, jL as evalComputedFields, jM as evaluateClause, jN as evaluateExportCapability, jO as evaluateFieldClause, jP as evaluateImportCapability, jQ as executePlan, jR as exportAccessibleData, jS as findAuthenticator, d7 as formatDiff, b5 as groupAndReduce, jT as hasExportCapability, jU as hasImportCapability, jV as hasRecoveryEnrolled, u as i18nText, v as inferScripts, w as isDictCollectionName, x as isDictKeyDescriptor, y as isI18nTextDescriptor, jW as isLinkCollectionName, jX as isMagicLinkGrantExpired, jY as isMoneyDescriptor, jZ as isMoneyString, j_ as isPublicEnvelope, j$ as isRefArray, z as isStaticDictDescriptor, k0 as issueDelegation, k1 as keyringRecoverPassphrase, k2 as keyringRotatePassphrase, k3 as liberateVault, k4 as listMagicLinkGrants, k5 as listUsers, k6 as listUsersWithEnvelopes, k7 as listWithdrawalRequests, k8 as loadActiveDelegations, k9 as loadPaperRecoveryEntries, ka as loadSealedPassphrase, kb as loadShamirRecoveryEntries, kc as magicLinkGrantRecordId, b6 as max, au as memoryObjectProjection, bn as mergeCrdtStates, b7 as min, kd as mintPaperRecoveryEntry, ke as mintShamirRecoveryEntry, kf as mintWrappedDeksBlob, kg as money, b8 as moneyMax, b9 as moneyMin, kh as moneyNumber, ba as moneySum, ki as parseRsaOaepTlv, kj as parseSealedEnvelope, kk as readMagicLinkGrantRecord, kl as readPath, km as recoverUser, bb as reduceRecords, bc as reducerBuilder, kn as ref, ko as refArray, kp as rejectWithdrawal, kq as removeAuthenticator, kr as requestWithdrawal, ks as resetJoinWarnings, bo as resolveCrdtSnapshot, A as resolveI18nText, B as resolvePolicy, kt as resolvePublicEnvelopeSchema, ku as resolveSequenceKey, kv as revokeDelegation, kw as revokeMagicLinkGrant, kx as runTransaction, ky as savePaperRecoveryEntries, kz as saveSealedPassphrase, kA as saveShamirRecoveryEntries, kB as sealRsaOaepTlv, E as staticDict, be as sum, kC as unwrapDeksFromBlob, kD as unwrapDeksFromPaperEntry, kE as unwrapDeksFromShamirEntry, kF as unwrapMagicLinkGrant, G as validateI18nTextValue, kG as validatePassphrase, kH as validatePublicEnvelopeInput, kI as validateSchemaInput, kJ as validateSchemaOutput, W as validateSessionPolicy, kK as withArchive, kL as withDeferredNumbering, kM as withdrawAccessibleData, kN as writeMagicLinkGrant } from './index-BzUo1B6n.js';
+export { I as ImportExternalOptions, a as ImportExternalResult, b as ImportableCollection, d as detectMagic, c as detectMimeType, i as importExternalObjects, e as isPreCompressed } from './mime-magic-CGhw37_E.js';
+export { WrapBundleStoreOptions, WrapPodStoreOptions, WrappedBundleNoydbStore, WrappedPodNoydbStore, createBundleStore, createPodStore, wrapBundleStore, wrapPodStore } from './pod/index.js';
+export { W as WriteEvent, a as WriteHook } from './index-B9QdHytu.js';
+export { C as CollectionDescription, a as CollectionMeta, D as DescribeOptions, b as DescribedField, F as FieldMeta, S as SemanticType, V as VaultMeta } from './describe-aBkJR2sd.js';
+export { D as DEED_RECORD_ID, a as DeedMarker, S as STATE_VAULT_NAME, U as USER_ENVELOPE_COLLECTION, b as USER_ENVELOPE_MAX_BYTES, c as createDeedOwner, i as isDeedVault, l as loadDeedMarker, w as withCargo } from './index-BF9_96A5.js';
+export { A as AutoCredential, q as AutoCredentialKind, d as CompressionAlgo, f as NOYDB_BUNDLE_FORMAT_VERSION, g as NOYDB_BUNDLE_MAGIC, h as NOYDB_BUNDLE_PREFIX_BYTES, i as NoydbBundleHeader, j as NoydbBundleReadResult, N as NoydbPodHeader, R as ReadNoydbBundleOptions, k as WriteNoydbBundleOptions, W as WritePodOptions, s as hasNoydbBundleMagic, m as readNoydbBundle, n as readNoydbBundleHeader, t as readNoydbBundlePublicEnvelope, r as readPod, a as readPodHeader, o as resetBrotliSupportCache, p as writeNoydbBundle, w as writePod } from './bundle-CH-H06dp.js';
+export { g as generateULID, i as isULID } from './ulid-DRH25k3y.js';
+export { D as DecryptedRecord, d as decryptExtractedPartition } from './decrypt-partition-IHtxEnTi.js';
+export { L as LedgerEntry, d as canonicalJson, h as hashEntry, p as paddedIndex, e as parseIndex, s as sha256Hex } from './subject-index-O75wKshW.js';
+export { TransactionStrategyOptions } from './tx/index.js';
+export { I as ImmutableGuardConfig, T as TransitionGuardConfig, i as immutableGuard, t as transitionGuard, w as withGuard } from './transition-guard-C7ol6oPw.js';
+export { w as withDerivation, a as withRollup } from './with-rollup-BvQo3ROo.js';
+export { w as withMaterializedView } from './with-materialized-view-6p0Fk8bL.js';
+export { w as withOverlayedView } from './with-overlayed-view-BJ6mXGMd.js';
 export { SYNC_CREDENTIALS_COLLECTION, SyncCredential, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential } from './team/index.js';
-export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-B4kDxep_.js';
-export { a as AggregateResult, b as AggregateSpec, c as Aggregation, d as AggregationUpstream, G as GROUPBY_MAX_CARDINALITY, e as GROUPBY_WARN_CARDINALITY, f as GroupedAggregation, g as GroupedQuery, h as GroupedQueryN, i as GroupedRow, j as GroupedRowN, L as LiveAggregation, R as Reducer, k as ReducerOptions, l as avg, n as count, o as groupAndReduce, p as max, q as min, r as reduceRecords, t as sum } from './strategy-DSTrsZ8t.js';
-export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-HJqD14vS.js';
-import './lazy-builder-7tIpFyWN.js';
+export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-C9Ro3v_O.js';
+export { i as isDiscriminant } from './discriminant-BN9REW3o.js';
+export { FuseOptions, fuseRetrieval } from './kernel/index.js';
+export { D as DiffCandidate, a as DiffOptions, V as VaultDiff, b as VaultDiffEntry, c as VaultDiffModifiedEntry, d as diffVault } from './vault-diff-B5fYNBL7.js';
+export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-Cp5uwiox.js';
 import '@noy-db/attestation';
 
-/**
- * Persistence helpers for per-principal user envelopes stored at
- * `_users/<keyringId>` (logically: `_meta/user/<keyringId>`).
- *
- * Unlike `_meta/policy` and `_meta/handle` which are plaintext, user
- * envelopes carry user data and are encrypted with a dedicated
- * {@link USER_ENVELOPE_COLLECTION} DEK (provisioned at vault open and
- * propagated to every keyring via the system-collection DEK path in
- * `team/keyring.ts`).
- *
- * This module is the **storage primitive** layer. The public API
- * (`vault.user.*`) sits on top of this; permission gates, own-only
- * write enforcement, and presence-channel propagation live there.
- *
- * @see docs/superpowers/specs/2026-05-05-user-envelope-design.md
- *
- * @module
- */
-
-/**
- * Read and decrypt the user envelope for `keyringId`. Returns `null`
- * when no envelope has been persisted (either the principal has never
- * called `updateMe`, or the keyring predates this feature).
- *
- * Decryption errors propagate — a tampered or wrong-keyed envelope
- * surfaces as the underlying crypto error rather than masquerading as
- * "not found".
- */
-declare function loadUserEnvelope<T = unknown>(store: NoydbStore, vault: string, keyringId: string, dek: CryptoKey): Promise<UserEnvelope<T> | null>;
-/**
- * Encrypt and persist the user envelope for `keyringId`. The new
- * version is `(prior._v ?? 0) + 1`. Pass `expectedVersion` to enable
- * optimistic-concurrency checks: a mismatch with the stored version
- * throws {@link ConflictError} with the actual stored version.
- *
- * `expectedVersion: 0` means "expect no prior envelope"; the write
- * succeeds only if no envelope exists yet.
- *
- * Soft-caps the JSON-serialized payload at {@link USER_ENVELOPE_MAX_BYTES};
- * larger payloads throw {@link UserEnvelopeOversizedError}.
- */
-declare function saveUserEnvelope<T>(store: NoydbStore, vault: string, keyringId: string, payload: T, dek: CryptoKey, expectedVersion?: number): Promise<UserEnvelope<T>>;
-/**
- * Delete the user envelope for `keyringId`. Idempotent — no error if
- * the envelope is already absent. Called from the keyring revoke path
- * (cascade-delete) and is a no-op for keyrings that never wrote.
- */
-declare function deleteUserEnvelope(store: NoydbStore, vault: string, keyringId: string): Promise<void>;
-/**
- * List the keyring ids that have a user envelope persisted in `vault`.
- * Order is store-defined — callers that need a stable order should sort.
- */
-declare function listUserEnvelopeIds(store: NoydbStore, vault: string): Promise<string[]>;
-
 /**
  * Cache policy helpers — parse human-friendly byte budgets into raw numbers.
  *
@@ -106,340 +56,965 @@ declare function parseBytes(input: number | string): number;
 declare function estimateRecordBytes(record: unknown): number;
 
 /**
- * Persistence helpers for `_meta/public-envelope`. Mirrors the
- * bypass-AES pattern used by `_meta/handle` and `_meta/policy` —
- * the document is plaintext JSON, the envelope's `_iv` field is
- * left empty.
+ * Default text tokenizer for scan-mode search.
+ *
+ * NFKC-normalize → lowercase → split on Unicode letter/number runs. This is a
+ * word-boundary tokenizer: it does **not** segment scripts written without
+ * inter-word spaces (Thai, Lao, Khmer, CJK) — those collapse to one token per
+ * run. For such data, a dictionary/ICU segmenter is the right `tokenizer`
+ * (the engine takes one as a parameter); substring/`contains` matching is the
+ * pragmatic fallback until then.
+ */
+type Tokenizer = (text: string) => string[];
+declare const tokenize: Tokenizer;
+
+/**
+ * Enable the search / retrieval capability.
+ * Pass to `createNoydb({ searchStrategy: withSearch() })` to make a collection's
+ * `search` / `retrieve` / `similarTo` / `warmIndex` / `flushIndex` methods live,
+ * and to enable the put()-time embedding-vector compute for collections that
+ * declare an `embeddings` config. The search/retrieval engine is dynamically
+ * imported here, so it stays out of the floor bundle until opted in.
+ */
+
+declare function withSearch(): SearchStrategy;
+
+/**
+ * Enable the atomic-sequence capability.
+ * Pass to `createNoydb({ sequenceStrategy: withSequence() })` to make
+ * `vault.sequence('name').next()` / `.peek()` / `.seedTo()` live. The
+ * {@link SequenceStore} CAS engine is statically imported here, so it is pulled
+ * into the bundle only when `withSequence()` is referenced (the floor never
+ * imports it).
+ */
+
+declare function withSequence(): SequenceStrategy;
+
+/**
+ * Enable the sovereign-custody (FR-6) capability.
+ * Pass to `createNoydb({ custodyStrategy: withCustody() })` to make
+ * `db.grantCustodian` / `db.revokeCustodian` (and the `vault.custody.*` facade
+ * that delegates to them) plus `vault.custody.liberate()` live. The heavy
+ * `liberateVault` ceremony is dynamically imported here, so it is reached only
+ * via opt-in; grant/revoke run the host's own gate + keyring engine.
+ */
+
+declare function withCustody(): CustodyStrategy;
+
+/**
+ * Helpers for reading records out of a *plaintext* store (`encrypt: false`)
+ * with native tooling — the programmatic core of a `noydb cat`-style unwrap.
+ * See the plaintext/debug-store-mode design.
+ */
+
+/**
+ * Extract the record from a plaintext stored envelope, handling both layouts:
  *
- * @module
+ *   - **classic plaintext** (`encrypt: false`): the record is JSON in `_data`.
+ *   - **debugPlaintext**: the record's fields are inlined beside the
+ *     `_`-prefixed metadata (marked by `_debug`).
+ *
+ * Returns `null` for an empty/absent body. Throws if handed an **encrypted**
+ * envelope (non-empty `_iv`) — there is no key here; decrypt through the vault
+ * instead. Intended for record envelopes, not blob chunks.
+ *
+ * @example
+ * ```ts
+ * // node script over a to-file store, no vault needed:
+ * const env = JSON.parse(readFileSync('data/acme/invoices/inv-1.json', 'utf8'))
+ * console.log(readPlaintextRecord(env)) // → { id: 'inv-1', total: '120.00', … }
+ * ```
  */
+declare function readPlaintextRecord<T = Record<string, unknown>>(envelope: EncryptedEnvelope): T | null;
 
-/** Reserved id for the vault-level public envelope record. */
-declare const PUBLIC_ENVELOPE_RECORD_ID = "public-envelope";
+/** Allow any schema change. Explicit blind / back-compat. */
+declare function blindUpdate(): SchemaUpdateStrategy;
+/** Allow additive changes; reject non-additive ones. The safety backstop. */
+declare function additiveOnly(): SchemaUpdateStrategy;
 /**
- * Read the public envelope from `_meta/public-envelope`. Returns
- * `undefined` when no envelope has been persisted (fresh vault, or
- * a vault written before the feature was enabled). Tolerates
- * corrupted documents — a JSON parse failure surfaces as `undefined`,
- * not a thrown error, mirroring `_meta/handle`'s contract.
+ * Reject schema changes. With `fields`, reject only when one of those
+ * fields is added/removed/changed; otherwise reject any non-`none` delta.
  */
-declare function loadPublicEnvelope(store: NoydbStore, vault: string): Promise<PublicEnvelope | undefined>;
-/** Persist the public envelope. Idempotent — overwrites any prior write. */
-declare function savePublicEnvelope(store: NoydbStore, vault: string, envelope: PublicEnvelope): Promise<void>;
+declare function lockSchema(opts?: {
+    readonly fields?: readonly string[];
+}): SchemaUpdateStrategy;
+
+/** The coordinatedCutover update strategy (single-step — no from/to). */
+
+declare function coordinatedCutover(opts: {
+    readonly transform: TransformFn;
+}): SchemaUpdateStrategy;
+
 /**
- * Public, no-key reader. Plain function, not a method on `Noydb` —
- * the whole point is it works without an authenticated session, so
- * a UI can show "Acme 2026 Tax Records" before unlocking.
+ * Built-in in-memory store — the kernel's zero-config default.
  *
- * Resolves any `name` / `description` locale map through the supplied
- * `locale` (when provided). Omitting `locale` returns the raw
- * envelope, which a multilingual picker can render as it pleases.
+ * Nested `Map`s: `vault → collection → id → envelope`. Non-persistent
+ * (data is lost on process exit). A conformant 6-method {@link NoydbStore}
+ * with CAS atomicity and a monotonic store clock — the kernel version of
+ * `@noy-db/to-memory`'s core, so `createNoydb()` works with no store package.
+ *
+ * Portable: imports only `types` + `errors` (no crypto primitive) — passes
+ * the `stores-ciphertext-only` architecture guard.
+ *
+ * Implements the 6-method core only (no optional `listVaults`/`ping`/`tx`),
+ * so `Noydb.listAccessibleVaults()` throws its documented capability error
+ * rather than enumerating vaults under the default store.
  */
-declare function readPublicEnvelope(store: NoydbStore, vault: string, opts?: {
-    readonly locale?: string;
-}): Promise<PublicEnvelope | undefined>;
+declare function memoryStore(): NoydbStore;
 
 /**
- * Why a gate denied a request. Stable across hub versions so consumers
- * can switch on the value in error UIs.
+ * Store router / multiplexer.
+ *
+ * Dispatches `NoydbStore` operations to different backends based on
+ * collection type, record size, record age, collection name, or vault name.
+ *
+ * ```ts
+ * const db = await createNoydb({
+ *   store: routeStore({
+ *     default: dynamo({ table: 'myapp' }),
+ *     blobs: s3Store({ bucket: 'myapp-blobs' }),
+ *   }),
+ * })
+ * ```
+ *
+ * @module
  */
-type PolicyDenyReason = 'insufficient-tier' | 'missing-factor' | 'stale-proof' | 'disabled' | 'shared-device-blocked';
+
 /**
- * Thrown by {@link checkGate} when the active session does not meet
- * the gate's requirements. Carries the gate name, the reason, and the
- * full required {@link GatePolicy} so error UIs can prompt the user
- * for the missing factor without re-reading the policy document.
+ * Size-tiered blob routing configuration.
+ *
+ * Routes blob chunks to different stores based on byte size. Small blobs
+ * (under `threshold`) stay in the primary or `small` store; large blobs
+ * go to `large`. This lets you keep DynamoDB as the default while sending
+ * large binary objects to S3.
  */
-declare class PolicyDeniedError extends NoydbError {
-    readonly gate: GateName;
-    readonly reason: PolicyDenyReason;
-    readonly required: GatePolicy;
-    constructor(gate: GateName, reason: PolicyDenyReason, required: GatePolicy, message?: string);
+interface BlobStoreRoute {
+    /** Store for small blobs (under threshold). Falls back to `default`. */
+    readonly small?: NoydbStore;
+    /** Store for large blobs (over threshold). */
+    readonly large: NoydbStore;
+    /** Size threshold in bytes. Default: `400 * 1024` (DynamoDB item limit). */
+    readonly threshold?: number;
 }
 /**
- * Raised by `createNoydb({ ... })` when the developer omits a recovery
- * profile and `recover-passphrase` is not explicitly disabled. Vaults
- * MUST have at least one recovery path enrolled before being
- * production-ready (paper, shamir, multi-channel, or admin-mediated).
+ * Blob lifecycle management policies evaluated during `compact()`.
  *
- * The error message carries a pointer to the recovery design docs.
+ * Controls orphan cleanup, cold-tier archival, and hard deletion of
+ * blobs that are no longer referenced by any record.
  */
-declare class RecoveryNotEnrolledError extends NoydbError {
-    constructor(message?: string);
+interface BlobLifecyclePolicy {
+    /** Delete orphan blobs (refCount: 0) after this many days. Default: 7. */
+    readonly orphanRetentionDays?: number;
+    /** Move blobs not accessed in this many days to the cold blob store. */
+    readonly archiveAfterDays?: number;
+    /** Store for archived blobs. Required if archiveAfterDays is set. */
+    readonly archiveStore?: NoydbStore;
+    /** Hard-delete archived blobs after this many days. */
+    readonly expireAfterDays?: number;
 }
 /**
- * Raised by `openVault` when a managed-passphrase-mode vault has no
- * STRONG recovery profile enrolled.
+ * Age-based hot/cold tiering configuration.
  *
- * Managed mode means the user never types a passphrase — the unlock
- * material lives in a `SealingKeyProvider` (`at-*` package). If that
- * provider's key is lost AND no strong recovery is enrolled, the
- * vault is irrecoverable. To prevent that footgun, managed-mode vaults
- * require at least one strong recovery profile (Shamir today;
- * multi-channel / admin-mediated when those ship).
- *
- * Paper recovery alone is NOT strong under managed mode: the user has
- * no memorized passphrase to fall back on, so losing the paper sheet =
- * losing every record permanently.
+ * Records whose `_ts` timestamp is older than `coldAfterDays` are migrated
+ * to the `cold` store during `compact()`. Reads transparently fall through
+ * to the cold store when the hot store returns null, so callers don't need
+ * to know which tier a record lives in.
+ */
+interface AgeRoute {
+    /** Store for records older than the cutoff. */
+    readonly cold: NoydbStore;
+    /** Days after last modification before a record is cold-eligible. */
+    readonly coldAfterDays: number;
+    /**
+     * Collections that participate in age tiering.
+     * Empty array or omitted = all user collections (excluding `_` prefixed).
+     */
+    readonly collections?: string[];
+}
+/**
+ * Options for `routeStore()` — the store multiplexer.
  *
- * Bootstrap with `db.openVaultAndEnrollRecovery(vault, { recovery: [{ profile: "shamir", k, n }] })`
- * to atomically create-and-enroll, or call `db.enrollRecovery(vault, { profile: "shamir", ... })`
- * separately before re-attempting `openVault`.
+ * At minimum, provide a `default` store. All other fields are optional
+ * extensions for specific routing scenarios (blobs → S3, geographic sharding,
+ * age-based tiering, etc.).
  */
-declare class ManagedRecoveryNotEnrolledError extends NoydbError {
-    readonly vault: string;
-    constructor(vault: string);
+interface RouteStoreOptions {
+    /** Default store for all unmatched operations. */
+    readonly default: NoydbStore;
+    /**
+     * Route blob chunk data to a separate store.
+     * - Pass a `NoydbStore` for simple prefix routing (all chunks → that store).
+     * - Pass `{ small?, large, threshold? }` for size-tiered routing.
+     */
+    readonly blobs?: NoydbStore | BlobStoreRoute;
+    /** Route all blob metadata (index, slots, versions) to the blobs store too. Default: false. */
+    readonly routeBlobMeta?: boolean;
+    /** Route specific user collections to dedicated stores. */
+    readonly routes?: Record<string, NoydbStore>;
+    /** Route by vault name (prefix patterns, e.g. `'EU-'`). */
+    readonly vaultRoutes?: Record<string, NoydbStore>;
+    /**
+     * Age-based tiering: records older than `coldAfterDays` are read from
+     * the cold store. A background `compact()` method migrates them.
+     */
+    readonly age?: AgeRoute;
+    /**
+     * Content-aware blob routing.
+     * Route blob chunks by MIME type glob pattern. The MIME type is stored
+     * in `BlobObject` and matched at read time via `storeHint`.
+     */
+    readonly blobRoutes?: Record<string, NoydbStore>;
+    /**
+     * Blob lifecycle policies.
+     * Evaluated during `compact()`.
+     */
+    readonly blobLifecycle?: BlobLifecyclePolicy;
+    /**
+     * Quota-aware overflow.
+     * When the default store's usage exceeds the threshold, new writes
+     * overflow to the specified store.
+     */
+    readonly overflow?: NoydbStore;
+    /**
+     * Quota threshold (0-1). Default: 0.8 (overflow at 80% usage).
+     * Only effective when `overflow` is set.
+     */
+    readonly quotaThreshold?: number;
 }
 /**
- * Raised by `db.recoverPassphrase` / `db.enrollRecovery` /
- * `db.rotateRecovery` when the developer requests a recovery profile
- * not yet wired in this hub release.
+ * Named route that can be overridden or suspended at runtime.
  *
- * Implemented: `paper` and `shamir`.
- * Pending: `multi-channel` and `admin-mediated` (follow-up slices).
+ * Built-in names: `'default'`, `'blobs'`, `'cold'`.
+ * Custom names: any collection name from `routes`, any vault prefix from
+ * `vaultRoutes`, or any sync target label.
+ */
+type OverrideTarget = 'default' | 'blobs' | 'cold' | (string & {});
+/**
+ * Options for `RoutedNoydbStore.override()`.
  *
- * The carried `profile` and `tracking` fields let consumers steer the
- * UI ("multi-channel recovery is not yet wired up — open issue #N to follow").
+ * Controls whether the new store is pre-populated with data from the
+ * original store before the switch takes effect.
  */
-declare class RecoveryProfileNotImplementedError extends NoydbError {
-    readonly profile: string;
-    readonly tracking: string;
-    constructor(profile: string, tracking: string);
+interface OverrideOptions {
+    /**
+     * Hydrate the override store from the original before activating.
+     * - `true` — copy all data for all vaults.
+     * - `string[]` — copy only named collections.
+     * Makes `override()` async — returns a Promise.
+     */
+    hydrate?: boolean | string[];
 }
-
 /**
- * Default policy for personal vaults and SMB deployments — the gates
- * that need an off-device factor get one (TOTP / email-OTP / paper
- * recovery), the rest take a tier-1 unlock alone. Tier-3 (PIN) is the
- * floor only for `rotate-unlock` because that's the
- * "change my PIN" flow.
+ * Options for `RoutedNoydbStore.suspend()`.
  *
- * The unspecified gates (e.g. `view-user-auth`) inherit the engine
- * default of `{ enabled: false, minTier: 1 }` — they fail closed.
- *
- * @see docs/subsystems/session-tiers.md → Built-in gates
+ * A suspended route becomes a null store: reads return null/[], writes
+ * are dropped (or buffered if `queue: true`). Useful for maintenance
+ * windows or restricted-network scenarios.
  */
-declare const PERSONAL_POLICY: VaultPolicy;
+interface SuspendOptions {
+    /**
+     * Buffer write operations during suspension. On `resume()`, queued
+     * writes are replayed against the restored store.
+     */
+    queue?: boolean;
+    /**
+     * Maximum queued operations. When exceeded, oldest entries are dropped.
+     * Default: 10_000.
+     */
+    maxQueueSize?: number;
+}
 /**
- * Strict policy for regulated deployments and shared workstations —
- * raises the phrase floor to 8 words, demands two distinct factors for
- * exports, and blocks export-on-shared-device. Use as a base for
- * `policy: { ...STRICT_POLICY, gates: { ...STRICT_POLICY.gates, ... } }`
- * tweaks.
+ * Snapshot of the current override and suspend state of a `RoutedNoydbStore`.
+ * Returned by `routeStatus()` for diagnostics and health dashboards.
  */
-declare const STRICT_POLICY: VaultPolicy;
+interface RouteStatus {
+    /** Active overrides: route name → override store name. */
+    readonly overrides: Record<string, string>;
+    /** Currently suspended routes. */
+    readonly suspended: string[];
+    /** Queued writes per suspended route (only for routes suspended with `queue: true`). */
+    readonly queued: Record<string, number>;
+}
 /**
- * Merge a developer override onto a preset. Unspecified gates inherit;
- * specified gates fully replace the preset's entry for that gate.
+ * Extended `NoydbStore` returned by `routeStore()`.
  *
- * Example:
+ * Satisfies the full `NoydbStore` contract plus adds runtime control
+ * methods for overriding, suspending, and inspecting routes.
+ */
+interface RoutedNoydbStore extends NoydbStore {
+    /**
+     * Migrate records older than the age cutoff from the hot store to the
+     * cold store. Only applies when `age` is configured. Returns the number
+     * of records migrated.
+     */
+    compact(vault: string): Promise<number>;
+    /**
+     * Override a named route at runtime.
+     *
+     * The override persists until `clearOverride()` is called or the
+     * instance is closed. In-flight operations complete on the original
+     * store; new operations use the override.
+     *
+     * Options:
+     * - `hydrate: true` — async: copies all data from the original store
+     *   into the override before activating the switch.
+     * - `hydrate: ['invoices', 'clients']` — copies only named collections.
+     *
+     * Use cases:
+     * - Shared device: `await store.override('default', memory(), { hydrate: true })`
+     * - Restricted network: `store.override('blobs', localFile(...))`
+     */
+    override(route: OverrideTarget, store: NoydbStore, opts?: OverrideOptions): void | Promise<void>;
+    /** Clear a runtime override, reverting to the original store. */
+    clearOverride(route: OverrideTarget): void;
+    /**
+     * Suspend a route entirely. Operations to suspended stores become
+     * no-ops (puts silently dropped, gets return null, lists return []).
+     *
+     * Options:
+     * - `queue: true` — buffer write operations (put/delete) during
+     *   suspension. When `resume()` is called, queued writes are replayed
+     *   against the restored store.
+     *
+     * Returns a `SuspendHandle` when `queue: true`, for inspecting queue state.
+     */
+    suspend(route: OverrideTarget, opts?: SuspendOptions): void;
+    /**
+     * Resume a previously suspended route.
+     * If the route was suspended with `queue: true`, replays queued writes.
+     * Returns the number of replayed operations.
+     */
+    resume(route: OverrideTarget): Promise<number>;
+    /** Snapshot the current override/suspend state for diagnostics. */
+    routeStatus(): RouteStatus;
+    /**
+     * Resolve the physical backend a vault id maps to via the geographic
+     * `vaultRoutes` prefix routing (collection-independent), falling back to
+     * the `default` store. Used by the federation data-residency guard
+     * to read the placement backend's `capabilities.region`.
+     */
+    resolveBackend(vaultId: string): NoydbStore;
+}
+/**
+ * Create a store multiplexer that dispatches operations to different backends
+ * based on collection type, record size, record age, vault prefix, or
+ * runtime overrides.
  *
  * ```ts
- * mergePolicy(PERSONAL_POLICY, {
- *   gates: {
- *     'app:approve-large-payment': { minTier: 2, factors: [{ anyOf: ['totp'] }] },
- *   },
+ * const store = routeStore({
+ *   default: dynamo({ table: 'myapp' }),
+ *   blobs: s3({ bucket: 'myapp-blobs' }),
+ *   routes: { auditLog: s3({ bucket: 'myapp-audit' }) },
  * })
- * // → PERSONAL_POLICY plus the new app gate; existing gates intact.
  * ```
+ *
+ * The returned store satisfies `NoydbStore` and can be passed directly to
+ * `createNoydb({ store })`. It also exposes additional methods
+ * (`override`, `suspend`, `resume`, `routeStatus`, `compact`) for runtime
+ * control and maintenance.
  */
-declare function mergePolicy(base: VaultPolicy, override?: Partial<VaultPolicy>): VaultPolicy;
+declare function routeStore(opts: RouteStoreOptions): RoutedNoydbStore;
 
 /**
- * Policy gate engine — the {@link checkGate} entry point.
+ * Store middleware — composable interceptors for NoydbStore.
  *
- * Given a configured {@link VaultPolicy}, an active session tier, and
- * the factor proofs an actor is presenting, decide whether the gate
- * permits the action. On denial, throws {@link PolicyDeniedError} with
- * a stable {@link PolicyDenyReason} so consumers can branch in error
- * UIs.
+ * ```ts
+ * const resilient = wrapStore(
+ *   dynamo({ table: 'myapp' }),
+ *   withRetry({ maxRetries: 3 }),
+ *   withLogging({ level: 'debug' }),
+ *   withCache({ ttlMs: 60_000 }),
+ * )
+ * ```
  *
- * @see docs/subsystems/session-tiers.md → checkGate() API
+ * Each middleware is `(next: NoydbStore) => NoydbStore`. They compose
+ * left-to-right: first middleware is outermost (processes requests first,
+ * responses last).
  *
  * @module
  */
 
-/** Default freshness window — 5 minutes. */
-declare const DEFAULT_FRESHNESS_MS: number;
-/** Caller-supplied context for one `checkGate` invocation. */
-interface CheckGateContext {
-    /** Tier the active session currently holds. */
-    readonly activeTier: ActiveTier;
-    /** Proofs the actor is presenting for this gate. */
-    readonly factors?: ReadonlyArray<FactorProof>;
-    /**
-     * If the host knows the actor is on a shared device, set this to
-     * `true` so the engine can apply `warn.sharedDevice` rules. Defaults
-     * to `false`.
-     */
-    readonly sharedDevice?: boolean;
+/**
+ * A store middleware function.
+ *
+ * Takes the next store in the chain and returns a wrapped store. Middlewares
+ * compose left-to-right via `wrapStore()`: the first argument is outermost
+ * (first to intercept requests, last to process responses).
+ *
+ * ```ts
+ * const mw: StoreMiddleware = (next) => ({
+ *   ...next,
+ *   async get(vault, collection, id) {
+ *     console.log('get', id)
+ *     return next.get(vault, collection, id)
+ *   },
+ * })
+ * ```
+ */
+type StoreMiddleware = (next: NoydbStore) => NoydbStore;
+/**
+ * Wrap a store with one or more middlewares. Middlewares compose left-to-right.
+ */
+declare function wrapStore(store: NoydbStore, ...middlewares: StoreMiddleware[]): NoydbStore;
+/** Options for `withRetry()`. */
+interface RetryOptions {
+    /** Maximum retry attempts. Default: 3. */
+    maxRetries?: number;
+    /** Base backoff delay in ms. Default: 500. */
+    backoffMs?: number;
+    /** Jitter factor (0-1). Adds random delay up to `backoffMs * jitter`. Default: 0.3. */
+    jitter?: number;
+    /** Only retry on these error codes. Default: retry all errors. */
+    retryOn?: string[];
+}
+/**
+ * Middleware that retries failed store operations with exponential backoff
+ * and optional jitter. Useful for transient network errors on DynamoDB/S3.
+ *
+ * ```ts
+ * wrapStore(dynamo({ table: 'myapp' }), withRetry({ maxRetries: 5, retryOn: ['NETWORK_ERROR'] }))
+ * ```
+ */
+declare function withRetry(opts?: RetryOptions): StoreMiddleware;
+/** Log level for `withLogging()`. Maps to standard console method names. */
+type LogLevel = 'debug' | 'info' | 'warn' | 'error';
+/** Options for `withLogging()`. */
+interface LoggingOptions {
+    /** Minimum log level. Default: 'info'. */
+    level?: LogLevel;
+    /** Custom logger. Default: console. */
+    logger?: {
+        debug(msg: string, ...args: unknown[]): void;
+        info(msg: string, ...args: unknown[]): void;
+        warn(msg: string, ...args: unknown[]): void;
+        error(msg: string, ...args: unknown[]): void;
+    };
+    /** Log the data payload (envelope contents). Default: false (privacy). */
+    logData?: boolean;
+}
+/**
+ * Middleware that logs every store operation with its method name, arguments,
+ * and elapsed duration. Privacy-safe by default: envelope payloads are not
+ * logged unless `logData: true` is set.
+ */
+declare function withLogging(opts?: LoggingOptions): StoreMiddleware;
+/**
+ * Data emitted to `MetricsOptions.onOperation` after every store call.
+ *
+ * Carries method name, vault/collection/id context, elapsed duration,
+ * and success/failure status. Wire this into your metrics pipeline
+ * (DataDog, Prometheus, CloudWatch) to get per-operation latency histograms.
+ */
+interface StoreOperation {
+    method: 'get' | 'put' | 'delete' | 'list' | 'loadAll' | 'saveAll';
+    vault: string;
+    collection?: string;
+    id?: string;
+    durationMs: number;
+    success: boolean;
+    error?: Error;
+}
+/** Options for `withMetrics()`. */
+interface MetricsOptions {
+    /** Called after every store operation. */
+    onOperation: (op: StoreOperation) => void;
+}
+/**
+ * Middleware that calls `onOperation` after every store method with timing
+ * and success/failure data. Designed for low-overhead integration with
+ * metrics systems — the callback is synchronous and fire-and-forget.
+ */
+declare function withMetrics(opts: MetricsOptions): StoreMiddleware;
+/**
+ * Options for `withCircuitBreaker()`.
+ *
+ * The circuit breaker moves through three states:
+ * - `closed`: normal operation.
+ * - `open`: store is failing; all calls return fallback values immediately.
+ * - `half-open`: one probe call after `resetTimeoutMs` — success closes, failure re-opens.
+ */
+interface CircuitBreakerOptions {
+    /** Number of consecutive failures before opening the circuit. Default: 5. */
+    failureThreshold?: number;
+    /** Time in ms before attempting to half-open the circuit. Default: 30_000. */
+    resetTimeoutMs?: number;
+    /** Called when the circuit opens (store becomes unavailable). */
+    onOpen?: () => void;
+    /** Called when the circuit closes (store recovers). */
+    onClose?: () => void;
+}
+/**
+ * Middleware that implements the circuit-breaker pattern.
+ *
+ * When the wrapped store fails `failureThreshold` consecutive times, the
+ * circuit opens: subsequent calls return safe fallback values (`null`, `[]`,
+ * `{}`) without hitting the store. After `resetTimeoutMs` the circuit
+ * half-opens and allows one probe — success closes the circuit, failure
+ * keeps it open. Pair with `withRetry` to handle transient errors before
+ * they trip the circuit.
+ */
+declare function withCircuitBreaker(opts?: CircuitBreakerOptions): StoreMiddleware;
+/**
+ * Options for `withCache()`.
+ *
+ * The cache is a read-through LRU that caches individual record fetches
+ * (`get`). Writes (`put`, `delete`) invalidate the relevant cache entry
+ * immediately. `list`, `loadAll`, and `saveAll` bypass the cache.
+ *
+ * Named `StoreCacheOptions` to distinguish from `CacheOptions` in
+ * `@noy-db/hub/collection`, which controls the in-memory decrypted-record LRU.
+ */
+interface StoreCacheOptions {
+    /** Maximum cached entries. Default: 500. */
+    maxEntries?: number;
+    /** Cache TTL in ms. Default: 60_000 (1 minute). 0 = no expiry. */
+    ttlMs?: number;
+}
+/**
+ * Middleware that adds a read-through LRU cache for `get()` calls.
+ *
+ * Reduces latency for frequently-read records (e.g. lookup tables, user
+ * profiles) by serving repeat reads from memory. Because NOYDB records are
+ * encrypted at rest, caching envelopes is safe — the cache holds ciphertext,
+ * not plaintext. For write-heavy workloads, the cache provides little benefit
+ * and should be omitted to avoid the invalidation overhead.
+ */
+declare function withCache(opts?: StoreCacheOptions): StoreMiddleware;
+interface HealthCheckOptions {
+    /** Ping interval in ms. Default: 30_000. */
+    checkIntervalMs?: number;
+    /** Suspend after N consecutive ping failures. Default: 3. */
+    suspendAfterFailures?: number;
+    /** Resume after N consecutive ping successes. Default: 1. */
+    resumeAfterSuccess?: number;
+    /** Called when the store is auto-suspended. */
+    onSuspend?: () => void;
+    /** Called when the store is auto-resumed. */
+    onResume?: () => void;
     /**
-     * Override `now()` for tests. Defaults to `Date.now()`.
-     * @internal
+     * Custom health check. Default: calls `store.ping()` if available,
+     * otherwise attempts a `list()` on a sentinel collection.
      */
-    readonly now?: number;
+    check?: () => Promise<boolean>;
 }
 /**
- * Decide whether `gate` permits the action under `context`. Throws
- * {@link PolicyDeniedError} on denial; resolves with `void` on success.
+ * Auto-suspends a store when health checks fail, auto-resumes when they recover.
  *
- * Lookup rules:
- * - **Built-in gates** without a configured policy fail closed
- *   (`enabled: false`).
- * - **App-defined gates** (`app:*`) without a configured policy are
- *   treated as no-op (allow). The developer registered the policy if
- *   they wanted enforcement; absence means the gate is informational.
+ * When suspended, `get` returns null, `put`/`delete` are no-ops, `list` returns [].
+ * This is identical to the `NullStore` behavior from `routeStore.suspend()`.
  */
-declare function checkGate(policy: VaultPolicy, gate: GateName, context: CheckGateContext): Promise<void>;
+declare function withHealthCheck(opts?: HealthCheckOptions): StoreMiddleware;
+
 /**
- * Same as {@link checkGate} but returns a structured verdict instead
- * of throwing. Useful when an error UI wants to show the user
- * "you'll need TOTP plus a recovery code to do that" without first
- * triggering the action.
+ * Derive a {@link PersistedSchemaEnvelope} from a Standard Schema v1
+ * validator. Supports zod 3 (via the optional `zod-to-json-schema` peer-dep)
+ * and zod 4 (via its native `z.toJSONSchema()`); both are loaded lazily so
+ * hub never statically imports zod. Other validator families write a stub
+ * envelope flagging the kind.
+ *
+ * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
+ *
+ * @module
  */
-declare function describeGate(policy: VaultPolicy, gate: GateName, context: CheckGateContext): Promise<{
-    ok: true;
-} | {
-    ok: false;
-    reason: PolicyDenyReason;
-    required: GatePolicy;
-}>;
 
 /**
- * Persistence helpers for the vault-level policy document
- * (`_meta/policy`). Mirrors the bypass-AES pattern used by
- * `_meta/handle` — the policy document is plain JSON, the envelope's
- * `_iv` field is left empty.
+ * Heuristic Zod detection — uses the Standard Schema v1 `~standard.vendor`
+ * property (present in Zod v3.23+ and Zod v4+). Falls back to the
+ * `_def.typeName` heuristic for older Zod v3 builds that predate Standard
+ * Schema support.
+ */
+declare function isZodSchema(value: unknown): boolean;
+declare function derivePersistedSchema(validator: unknown): Promise<PersistedSchemaEnvelope>;
+
+/**
+ * Read / write the per-collection persisted-schema envelope. Mirrors the
+ * standard noy-db record envelope shape and is **AES-GCM encrypted with
+ * the collection's DEK** — the schema body (field names, enum values,
+ * constraints) is sensitive metadata, so it gets the same encryption
+ * envelope as the records it describes.
+ *
+ * Storage layout:
+ *
+ *   <vault>/_schemas/<collection>   →   EncryptedEnvelope
  *
- * @see docs/subsystems/session-tiers.md → Storage location
+ * The DEK passed to {@link savePersistedSchema} / {@link loadPersistedSchema}
+ * is the same key the collection uses for its records.
  *
  * @module
  */
 
-/** Reserved collection name for vault-level metadata documents. */
-declare const META_COLLECTION = "_meta";
-/** Reserved id for the vault-level policy document. */
-declare const POLICY_RECORD_ID = "policy";
+/** Reserved collection name where persisted schemas live. */
+declare const SCHEMAS_COLLECTION: "_schemas";
 /**
- * Read the vault-level policy from `_meta/policy`. Returns `undefined`
- * when no policy has been persisted (fresh vault, or a vault written
- * before the policy module landed). The caller falls back to the
- * default preset.
- *
- * Tolerates corrupted documents the same way `_meta/handle` does: a
- * JSON parse failure surfaces as `undefined`, not a thrown error, so
- * a bad write never permanently locks a vault.
+ * Read and decrypt the persisted-schema envelope for one collection.
+ * Returns `undefined` when no envelope has been written or when decryption
+ * fails (e.g. wrong DEK passed). Tolerates corrupted records — JSON parse
+ * failures surface as `undefined`, mirroring `_meta/handle`'s contract.
  */
-declare function loadVaultPolicy(store: NoydbStore, vault: string): Promise<VaultPolicy | undefined>;
+declare function loadPersistedSchema(store: NoydbStore, vault: string, collection: string, dek: EnclaveKey): Promise<PersistedSchemaEnvelope | undefined>;
 /**
- * Persist the vault-level policy at `_meta/policy`. Idempotent — call
- * once at vault creation and again on `db.updatePolicy()` invocations.
+ * Encrypt and persist a schema envelope for one collection. Always
+ * overwrites any prior write (callers gate on hash equality before calling
+ * to avoid no-op writes).
  */
-declare function saveVaultPolicy(store: NoydbStore, vault: string, policy: VaultPolicy): Promise<void>;
+declare function savePersistedSchema(store: NoydbStore, vault: string, collection: string, dek: EnclaveKey, payload: PersistedSchemaEnvelope): Promise<void>;
 
-/** Allow any schema change. Explicit blind / back-compat. */
-declare function blindUpdate(): SchemaUpdateStrategy;
-/** Allow additive changes; reject non-additive ones. The safety backstop. */
-declare function additiveOnly(): SchemaUpdateStrategy;
 /**
- * Reject schema changes. With `fields`, reject only when one of those
- * fields is added/removed/changed; otherwise reject any non-`none` delta.
+ * Orchestrate the derive → hash → skip-or-write cycle for a collection's
+ * persisted JSON Schema. Called by the Vault at collection-registration
+ * time when the developer opts in via `collection({ persistJsonSchema:
+ * true })`.
+ *
+ * Skip semantics:
+ *
+ *   - Zod validators: skip when the new hash equals the stored hash.
+ *   - Non-Zod (stub envelopes have hash=null): skip when the stored
+ *     envelope's `kind` matches the freshly-detected kind (since there's
+ *     no body to compare yet — a kind change is the only signal).
+ *
+ * @module
  */
-declare function lockSchema(opts?: {
-    readonly fields?: readonly string[];
-}): SchemaUpdateStrategy;
 
-/** The coordinatedCutover update strategy (single-step — no from/to). */
+interface PersistSchemaResult {
+    /** True when a fresh envelope was written to storage. */
+    readonly written: boolean;
+    /** True when an existing envelope matched and the write was skipped. */
+    readonly skipped: boolean;
+    /** The envelope that was either written or matched. */
+    readonly envelope: PersistedSchemaEnvelope;
+    /** The update-strategy decision, present when strategies ran. */
+    readonly decision?: UpdateDecision;
+}
+declare function persistSchemaIfNeeded(opts: {
+    readonly store: NoydbStore;
+    readonly vault: string;
+    readonly collectionName: string;
+    readonly validator: unknown;
+    readonly dek: EnclaveKey;
+    readonly strategies?: readonly SchemaUpdateStrategy[];
+}): Promise<PersistSchemaResult>;
 
-declare function coordinatedCutover(opts: {
-    readonly transform: TransformFn;
-}): SchemaUpdateStrategy;
+/**
+ * Persistence helpers for `_meta/public-envelope`. Mirrors the
+ * bypass-AES pattern used by `_meta/handle` and `_meta/policy` —
+ * the document is plaintext JSON, the envelope's `_iv` field is
+ * left empty.
+ *
+ * @module
+ */
+
+/** Reserved id for the vault-level public envelope record. */
+declare const PUBLIC_ENVELOPE_RECORD_ID = "public-envelope";
+/**
+ * Read the public envelope from `_meta/public-envelope`. Returns
+ * `undefined` when no envelope has been persisted (fresh vault, or
+ * a vault written before the feature was enabled). Tolerates
+ * corrupted documents — a JSON parse failure surfaces as `undefined`,
+ * not a thrown error, mirroring `_meta/handle`'s contract.
+ */
+declare function loadPublicEnvelope(store: NoydbStore, vault: string): Promise<PublicEnvelope | undefined>;
+/** Persist the public envelope. Idempotent — overwrites any prior write. */
+declare function savePublicEnvelope(store: NoydbStore, vault: string, envelope: PublicEnvelope): Promise<void>;
+/**
+ * Public, no-key reader. Plain function, not a method on `Noydb` —
+ * the whole point is it works without an authenticated session, so
+ * a UI can show "Acme 2026 Tax Records" before unlocking.
+ *
+ * Resolves any `name` / `description` locale map through the supplied
+ * `locale` (when provided). Omitting `locale` returns the raw
+ * envelope, which a multilingual picker can render as it pleases.
+ */
+declare function readPublicEnvelope(store: NoydbStore, vault: string, opts?: {
+    readonly locale?: string;
+}): Promise<PublicEnvelope | undefined>;
 
 /**
- * Derive a {@link PersistedSchemaEnvelope} from a Standard Schema v1
- * validator. v0 supports Zod via `zod-to-json-schema` (optional peer-dep);
- * other families write a stub envelope flagging the kind.
+ * Persistence helpers for per-principal user envelopes stored at
+ * `_users/<keyringId>` (logically: `_meta/user/<keyringId>`).
+ *
+ * Unlike `_meta/policy` and `_meta/handle` which are plaintext, user
+ * envelopes carry user data and are encrypted with a dedicated
+ * {@link USER_ENVELOPE_COLLECTION} DEK (provisioned at vault open and
+ * propagated to every keyring via the system-collection DEK path in
+ * `team/keyring.ts`).
+ *
+ * This module is the **storage primitive** layer. The public API
+ * (`vault.user.*`) sits on top of this; permission gates, own-only
+ * write enforcement, and presence-channel propagation live there.
+ *
+ * @see docs/superpowers/specs/2026-05-05-user-envelope-design.md
+ *
+ * @module
+ */
+
+/**
+ * Read and decrypt the user envelope for `keyringId`. Returns `null`
+ * when no envelope has been persisted (either the principal has never
+ * called `updateMe`, or the keyring predates this feature).
+ *
+ * Decryption errors propagate — a tampered or wrong-keyed envelope
+ * surfaces as the underlying crypto error rather than masquerading as
+ * "not found".
+ */
+declare function loadUserEnvelope<T = unknown>(store: NoydbStore, vault: string, keyringId: string, dek: EnclaveKey): Promise<UserEnvelope<T> | null>;
+/**
+ * Encrypt and persist the user envelope for `keyringId`. The new
+ * version is `(prior._v ?? 0) + 1`. Pass `expectedVersion` to enable
+ * optimistic-concurrency checks: a mismatch with the stored version
+ * throws {@link ConflictError} with the actual stored version.
  *
- * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
+ * `expectedVersion: 0` means "expect no prior envelope"; the write
+ * succeeds only if no envelope exists yet.
  *
- * @module
+ * Soft-caps the JSON-serialized payload at {@link USER_ENVELOPE_MAX_BYTES};
+ * larger payloads throw {@link UserEnvelopeOversizedError}.
  */
-
+declare function saveUserEnvelope<T>(store: NoydbStore, vault: string, keyringId: string, payload: T, dek: EnclaveKey, expectedVersion?: number): Promise<UserEnvelope<T>>;
 /**
- * Heuristic Zod detection — Zod schemas carry a `_def.typeName` property
- * starting with `Zod` (e.g. `ZodObject`, `ZodString`). This survives Zod's
- * minor-version bumps because the typeName naming is stable across v3.
+ * Delete the user envelope for `keyringId`. Idempotent — no error if
+ * the envelope is already absent. Called from the keyring revoke path
+ * (cascade-delete) and is a no-op for keyrings that never wrote.
  */
-declare function isZodSchema(value: unknown): boolean;
-declare function derivePersistedSchema(validator: unknown): Promise<PersistedSchemaEnvelope>;
+declare function deleteUserEnvelope(store: NoydbStore, vault: string, keyringId: string): Promise<void>;
+/**
+ * List the keyring ids that have a user envelope persisted in `vault`.
+ * Order is store-defined — callers that need a stable order should sort.
+ */
+declare function listUserEnvelopeIds(store: NoydbStore, vault: string): Promise<string[]>;
 
 /**
- * Read / write the per-collection persisted-schema envelope. Mirrors the
- * standard noy-db record envelope shape and is **AES-GCM encrypted with
- * the collection's DEK** — the schema body (field names, enum values,
- * constraints) is sensitive metadata, so it gets the same encryption
- * envelope as the records it describes.
+ * Type surface for the user-list visibility service.
  *
- * Storage layout:
+ * Two complementary flags:
+ *  - {@link DirectoryConfig} — vault-level "is the directory listing
+ *    enabled at all?" toggle. Owner-only mutation.
+ *  - {@link UserVisibility} — per-user "hide me from teammate listings"
+ *    opt-out. Self-mutation via `vault.user.setMyVisibility`.
  *
- *   <vault>/_schemas/<collection>   →   EncryptedEnvelope
+ * Both flags live in the existing `_meta` collection as plaintext-bypass
+ * sidecars (`_iv: ''`). Neither is a security boundary — the keyring
+ * file is still observable at `_keyring/*` and the envelope ciphertext
+ * is still at `_users/*` to anyone with direct store read access. The
+ * flags exist to keep admin-UI listings tidy, not to hide principals
+ * from a determined attacker.
  *
- * The DEK passed to {@link savePersistedSchema} / {@link loadPersistedSchema}
- * is the same key the collection uses for its records.
+ * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility
  *
  * @module
  */
-
-/** Reserved collection name where persisted schemas live. */
-declare const SCHEMAS_COLLECTION: "_schemas";
 /**
- * Read and decrypt the persisted-schema envelope for one collection.
- * Returns `undefined` when no envelope has been written or when decryption
- * fails (e.g. wrong DEK passed). Tolerates corrupted records — JSON parse
- * failures surface as `undefined`, mirroring `_meta/handle`'s contract.
+ * Vault-level directory toggle. Persisted at `_meta/directory`.
+ *
+ * - `enabled: true` (default when no document exists) — every authenticated
+ *   caller can enumerate users via `listUsersWithEnvelopes`.
+ * - `enabled: false` — only `owner` and `admin` callers can enumerate;
+ *   anyone else gets {@link import('../../kernel/errors.js').DirectoryDisabledError}.
  */
-declare function loadPersistedSchema(store: NoydbStore, vault: string, collection: string, dek: CryptoKey): Promise<PersistedSchemaEnvelope | undefined>;
+interface DirectoryConfig {
+    readonly enabled: boolean;
+}
 /**
- * Encrypt and persist a schema envelope for one collection. Always
- * overwrites any prior write (callers gate on hash equality before calling
- * to avoid no-op writes).
+ * Per-user visibility flag. Persisted at `_meta/visibility/<keyringId>`.
+ *
+ * - `hidden: false` (default when no document exists) — the user shows up
+ *   in `listUsersWithEnvelopes` like any other principal.
+ * - `hidden: true` — the user is filtered out of the default listing.
+ *   `owner`/`admin` callers can still see them by passing
+ *   `{ includeHidden: true }`.
  */
-declare function savePersistedSchema(store: NoydbStore, vault: string, collection: string, dek: CryptoKey, payload: PersistedSchemaEnvelope): Promise<void>;
+interface UserVisibility {
+    readonly hidden: boolean;
+}
 
 /**
- * Orchestrate the derive → hash → skip-or-write cycle for a collection's
- * persisted JSON Schema. Called by the Vault at collection-registration
- * time when the developer opts in via `collection({ persistJsonSchema:
- * true })`.
- *
- * Skip semantics:
- *
- *   - Zod validators: skip when the new hash equals the stored hash.
- *   - Non-Zod (stub envelopes have hash=null): skip when the stored
- *     envelope's `kind` matches the freshly-detected kind (since there's
- *     no body to compare yet — a kind change is the only signal).
- *
- * @module
+ * Implementation behind `vault.user`. Constructed once per Vault via
+ * {@link createUserApi}, holds the writer's keyringId in closure so
+ * `updateMe`/`setMe` cannot target any other principal — the own-only
+ * rule is enforced at the type level (no `set(otherKeyringId, …)`
+ * method) AND at runtime (the keyringId argument simply doesn't exist
+ * on the write path).
  */
-
-interface PersistSchemaResult {
-    /** True when a fresh envelope was written to storage. */
-    readonly written: boolean;
-    /** True when an existing envelope matched and the write was skipped. */
-    readonly skipped: boolean;
-    /** The envelope that was either written or matched. */
-    readonly envelope: PersistedSchemaEnvelope;
-    /** The update-strategy decision, present when strategies ran. */
-    readonly decision?: UpdateDecision;
+declare class UserApi implements VaultUserApi {
+    /** keyringId → set of listeners. Wildcard '*' fires on every change. */
+    private readonly listeners;
+    private readonly adapter;
+    private readonly vaultName;
+    /** The writer's own keyringId. Frozen at construction time. */
+    private readonly writerKeyringId;
+    private readonly getDek;
+    /**
+     * Policy-gate validator. When omitted, gates are skipped — useful
+     * for low-level tests that exercise the storage layer directly.
+     * Production paths always wire the Noydb-backed implementation.
+     */
+    private readonly checkGate?;
+    /**
+     * Noydb-backed `exportMyAccessibleData`, injected by the Vault
+     * (which holds the keyring + bundle machinery). Omitted in low-level tests.
+     */
+    private readonly exportAccessible?;
+    /**
+     * Noydb-backed `unilateralWithdrawal`, injected by the Vault.
+     * Destructive — extract + dispose (delete | freeze). Omitted in low-level tests.
+     */
+    private readonly unilateralWithdraw?;
+    /**
+     * Noydb-backed two-party withdrawal ceremony, injected by the
+     * Vault. requestWithdraw = requester side; the rest = owner side.
+     */
+    private readonly requestWithdraw?;
+    private readonly listWithdrawals?;
+    private readonly approveWithdraw?;
+    private readonly rejectWithdraw?;
+    constructor(deps: UserApiDeps);
+    /**
+     * File a two-party withdrawal request for the caller's accessible
+     * scope. Non-destructive (writes a pending request); an owner later approves
+     * or rejects. This is the path for read-only roles (`client`/`viewer`) that
+     * cannot self-serve a destructive `unilateralWithdrawal`. Gated by
+     * `user-request-withdrawal` (enabled by default).
+     */
+    requestWithdrawal(opts?: RequestWithdrawalOptions): Promise<RequestWithdrawalResult>;
+    /** Owner side: list filed withdrawal requests (optionally by status). */
+    listWithdrawalRequests(opts?: {
+        status?: WithdrawalRequestStatus;
+    }): Promise<WithdrawalRequest[]>;
+    /**
+     * Owner side: approve a pending request. Extracts the requester's
+     * recorded scope under firm authority, disposes of the source per the
+     * request's disposition, and returns the re-keyed bundle to hand back. Gated
+     * by `approve-user-withdrawal` (tier-2 default) + owner/admin role.
+     */
+    approveWithdrawal(requestId: string, opts?: ApproveWithdrawalOptions): Promise<WithdrawResult>;
+    /** Owner side: reject a pending request (no data is touched). */
+    rejectWithdrawal(requestId: string, opts?: RejectWithdrawalOptions): Promise<WithdrawalRequest>;
+    /**
+     * Single-party withdrawal: export the caller's accessible scope
+     * (re-keyed) and dispose of the source (`delete` or `freeze`). Gated by the
+     * fail-closed built-in `client-unilateral-withdraw` policy — undefined or
+     * disabled → throws (use `requestWithdrawal`). The firm enables it at vault
+     * creation.
+     */
+    unilateralWithdrawal(opts: WithdrawAccessibleOptions): Promise<WithdrawResult>;
+    /**
+     * Export the calling user's accessible scope as a portable, re-keyed
+     * `.noydb` bundle. Non-destructive and **always allowed** (data sovereignty
+     * by construction) but audited. Scope = the caller's DEK access set.
+     */
+    exportMyAccessibleData(opts?: ExportAccessibleOptions): Promise<Uint8Array>;
+    /** Read the writer's own envelope. Returns null if never written. */
+    me<T = unknown>(): Promise<UserEnvelope<T> | null>;
+    /**
+     * Deep-merge a partial patch into the writer's own envelope. Creates
+     * the envelope on first call. Optimistic-concurrency safe — a stale
+     * `_v` (parallel writer on another device) throws `ConflictError`.
+     *
+     * Patch semantics:
+     *   - `undefined` (or omitted key) — skip; existing value preserved
+     *   - `null` — delete the field from the merged result
+     *   - any other value — overwrite (deep-merge for plain objects,
+     *     replace for primitives / arrays)
+     *
+     * To clear a field, pass `null` rather than `undefined`. Callers
+     * with shape `T = string | null` where `null` is a meaningful value
+     * should use `setMe` for that specific field instead — `null` here
+     * always means delete.
+     *
+     * Gated by the `edit-own-profile` policy gate (default `minTier: 3`).
+     * Pass `presented` to satisfy tightened policies that require a
+     * factor proof (e.g. STRICT_POLICY's TOTP requirement).
+     */
+    updateMe<T extends object = Record<string, unknown>>(patch: DeepPartialOrNull<T>, presented?: UserEnvelopePresented): Promise<UserEnvelope<T>>;
+    /**
+     * Replace the writer's own envelope with `payload`. Use sparingly —
+     * `updateMe` is the canonical mutation. No `expectedVersion` check;
+     * callers explicitly take last-write-wins semantics.
+     *
+     * Gated by `edit-own-profile`. See `updateMe` for `presented` usage.
+     */
+    setMe<T = unknown>(payload: T, presented?: UserEnvelopePresented): Promise<UserEnvelope<T>>;
+    /**
+     * Read the current user's visibility flag from
+     * `_meta/visibility/<keyringId>`. Returns `{ hidden: false }` when no
+     * document has been persisted (the default-visible case).
+     */
+    getMyVisibility(): Promise<UserVisibility>;
+    /**
+     * Update the current user's visibility in the team directory.
+     *
+     * - `hidden: true` — opt out of the default `listUsersWithEnvelopes`
+     *   listing. `owner`/`admin` callers can still see the user by passing
+     *   `{ includeHidden: true }`.
+     * - `hidden: false` — opt back in.
+     *
+     * Own-only by construction: the keyringId argument doesn't exist on
+     * this method, so no caller can hide or unhide another principal.
+     *
+     * Honest caveat: this is a UX flag, not a privacy guarantee. The
+     * envelope ciphertext at `_users/<keyringId>` and the keyring file at
+     * `_keyring/<userId>` are both still observable to anyone with direct
+     * store read access. See `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md` →
+     * "Directory visibility".
+     */
+    setMyVisibility(visibility: UserVisibility): Promise<void>;
+    /**
+     * Read another principal's envelope by their keyringId. Returns null
+     * if the principal exists but has no envelope yet, or if the
+     * keyringId does not exist at all.
+     *
+     * Gated by `view-team-profiles` (default `minTier: 2`) — but ONLY for
+     * cross-principal reads. Reading your own envelope (`keyringId ===
+     * self`) is never gated; that's just `me()` written long-form.
+     */
+    get<T = unknown>(keyringId: string, presented?: UserEnvelopePresented): Promise<UserEnvelope<T> | null>;
+    /**
+     * Read every persisted envelope in the vault. Order is store-defined.
+     *
+     * Gated by `view-team-profiles`. Default policy (`minTier: 2`) lets
+     * any authenticated session read all envelopes. Two privacy-strict
+     * opt-outs:
+     *
+     *  - `view-team-profiles.enabled: false` → list() returns only the
+     *    caller's own envelope (silent self-fallback, no thrown error).
+     *  - `view-team-profiles.minTier: 1` + insufficient tier → throws
+     *    `PolicyDeniedError` with `reason: 'insufficient-tier'`. The
+     *    caller is expected to elevate, not silently degrade.
+     *
+     * The asymmetry is deliberate: `enabled: false` is a deliberate
+     * design choice ("nobody sees teammate profiles in this app");
+     * `insufficient-tier` is "you need to authenticate further". Different
+     * UX prompts for different intents.
+     */
+    list<T = unknown>(presented?: UserEnvelopePresented): Promise<UserEnvelope<T>[]>;
+    /**
+     * Listen for changes to a specific keyringId's envelope. The callback
+     * fires synchronously after every successful local `updateMe` /
+     * `setMe` for that principal.
+     *
+     * Cross-instance changes (a teammate edits their profile on their
+     * device, the sync engine pulls the diff onto this device) will fire
+     * subscribers when the sync layer replays the write through this API.
+     * In v1, subscribers do NOT fire on raw store changes — wire your sync
+     * layer to call back through `vault.user.setMe` / `updateMe` if you
+     * need that.
+     *
+     * Pass keyringId `'*'` to fire on every change in the vault.
+     */
+    subscribe<T = unknown>(keyringId: string, cb: (env: UserEnvelope<T> | null) => void): Unsubscribe;
+    /**
+     * Reactive handle that caches the current value and re-reads on every
+     * change for the given keyringId. Convenient for framework bindings:
+     *
+     *   const live = vault.user.live<UserShape>(vault.userId)
+     *   live.subscribe(env => render(env?.data))
+     *
+     * Initial value is `null` until the first `current()` call materializes
+     * it via `vault.user.get()`. Call `stop()` when done to release the
+     * subscription.
+     */
+    live<T = unknown>(keyringId: string): LiveUserEnvelope<T>;
+    private fireChange;
 }
-declare function persistSchemaIfNeeded(opts: {
-    readonly store: NoydbStore;
-    readonly vault: string;
-    readonly collectionName: string;
-    readonly validator: unknown;
-    readonly dek: CryptoKey;
-    readonly strategies?: readonly SchemaUpdateStrategy[];
-}): Promise<PersistSchemaResult>;
 
 /**
  * Authentication introspection.
@@ -492,8 +1067,8 @@ declare function describeAllUsersAuth(store: NoydbStore, vault: string): Promise
  * `_meta/policy` — the directory document is plain JSON, the
  * envelope's `_iv` field is left empty.
  *
- * @see docs/subsystems/user-envelope.md → Directory visibility
- * @see docs/subsystems/plaintext-bypass.md — every `_iv: ''` write site
+ * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility
+ * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/plaintext-bypass.md — every `_iv: ''` write site
  *
  * @module
  */
@@ -533,8 +1108,8 @@ declare function persistDirectoryConfig(store: NoydbStore, vault: string, config
  *    work even when decryption fails (legacy keyrings predating the
  *    envelope feature, or a corrupted envelope).
  *
- * @see docs/subsystems/user-envelope.md → Directory visibility
- * @see docs/subsystems/plaintext-bypass.md — every `_iv: ''` write site
+ * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility
+ * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/plaintext-bypass.md — every `_iv: ''` write site
  *
  * @module
  */
@@ -564,60 +1139,107 @@ declare function persistUserVisibility(store: NoydbStore, vault: string, keyring
  */
 declare function deleteUserVisibility(store: NoydbStore, vault: string, keyringId: string): Promise<void>;
 
-interface EncryptResult {
-    iv: string;
-    data: string;
-}
 /**
- * Encrypt raw bytes with AES-256-GCM using a fresh random IV.
- * Used by the attachment store so binary blobs avoid double base64 encoding
- * (the existing `encrypt()` function calls `TextEncoder` on a string — here
- * we pass the `Uint8Array` directly to `subtle.encrypt`).
+ * Return the ISO-4217 minor-unit scale for a currency code, or `null`
+ * when the code is not in the known set (caller must supply an explicit
+ * scale).
  */
-declare function encryptBytes(data: Uint8Array, dek: CryptoKey): Promise<EncryptResult>;
+declare function scaleForCurrency(code: string): number | null;
+
 /**
- * Decrypt AES-256-GCM ciphertext back to raw bytes.
- * Counterpart to `encryptBytes`. Throws `TamperedError` on auth-tag failure.
+ * Money-aware aggregation: exact `sum` / `min` / `max` over money
+ * fields.
+ *
+ * The generic reducers (`aggregate/reducers.ts`) read a field via
+ * `readNumber`, which coerces a string (the stored scaled-integer form
+ * of money, e.g. `'12345'`) to `0` — so an un-wrapped money `sum` would
+ * silently return zero. {@link wrapMoneyReducers} rewrites any `sum` /
+ * `min` / `max` over a declared money field into a reducer that
+ * accumulates per-currency `BigInt` totals of the stored integers, so
+ * the result is exact for any magnitude (past `Number.MAX_SAFE_INTEGER`
+ * included).
+ *
+ * Results are currency-aware and never silently mix currencies:
+ *   - **fixed** mode → a single exact decimal string.
+ *   - **multi** mode → an exact `Record<currency, string>` map.
+ *   - **`sum` with `convertTo` + `fx`** → a single exact string, with
+ *     each currency converted via BigInt arithmetic (no float).
+ *
+ * `remove()` is implemented for every money reducer so they participate
+ * in incremental live-aggregation and materialized-view maintenance
+ * exactly like the generic reducers they replace.
  */
-declare function decryptBytes(ivBase64: string, dataBase64: string, dek: CryptoKey): Promise<Uint8Array>;
+
+type FxRates = Record<string, number | string>;
+
 /**
- * Derive an AES-256-GCM presence key from a collection DEK using HKDF-SHA256.
- *
- * The presence key is domain-separated from the data DEK by the fixed salt
- * `'noydb-presence'` and the `info` = collection name. This means:
- *  - The adapter never sees the presence key.
- *  - Presence payloads rotate automatically when the collection DEK is rotated.
- *  - Revoked users cannot derive the new presence key after a DEK rotation.
- *
- * @param dek            The collection's AES-256-GCM DEK (extractable).
- * @param collectionName Used as the HKDF `info` parameter for domain separation.
- * @returns A non-extractable AES-256-GCM key suitable for presence payload encryption.
+ * Exact money arithmetic helpers — `mulRate` and `allocate`.
+ *
+ * Both operate on the canonical decoded string form that `get()`
+ * returns (`'10000.00'`), entirely in scaled-`BigInt` space — no
+ * floating-point step anywhere, exact past 2^53. They are pure
+ * functions with no vault or descriptor dependency: the working scale
+ * is inferred from the amount's fractional digits (a canonical money
+ * string always carries exactly the field's scale) or pinned with
+ * `opts.scale`.
+ *
+ * Why these two: app-side invariants of the form
+ * `Σ parts === whole` (receipt totals, net-zero WHT pairs, proration)
+ * carry ±0.01 tolerances ONLY because the math is major-unit floats +
+ * round2. `mulRate` (VAT-style rate application with explicit
+ * rounding) and `allocate` (largest-remainder split — parts sum to the
+ * input EXACTLY, by construction) make those tolerances zero.
  */
-declare function derivePresenceKey(dek: CryptoKey, collectionName: string): Promise<CryptoKey>;
+
+interface MulRateOptions {
+    /**
+     * Output scale (fraction digits). Defaults to the amount's own
+     * fractional digits — for a canonical money string that IS the
+     * field's scale.
+     */
+    readonly scale?: number;
+    /** Rounding for the final re-scale. Default `'half-up'`. */
+    readonly rounding?: RoundingMode;
+}
+interface AllocateOptions {
+    /** Working scale. Defaults to the amount's own fractional digits. */
+    readonly scale?: number;
+}
 /**
- * Encrypt a plaintext string with AES-256-GCM and a deterministic,
- * HKDF-derived IV.
+ * Multiply a money amount by a decimal rate, exactly.
  *
- * The same `{ dek, context, plaintext }` triple always produces the
- * same `{ iv, data }` — call this twice and you can string-compare the
- * ciphertexts to check equality of the inputs without decrypting them.
+ * The rate is parsed at its OWN full precision (`0.07` → `7` at scale
+ * 2), the product computed in `BigInt` at `amountScale + rateScale`,
+ * then re-scaled back to the output scale with the requested rounding —
+ * one rounding step, at the very end.
  *
- * @param context  Domain-separation string — by convention
- *                 `'<collection>/<field>'`. Different contexts encrypt
- *                 the same plaintext to different ciphertexts, so
- *                 `email` in collection `users` does not collide with
- *                 `email` in collection `customers`.
+ * ```ts
+ * mulRate('10000.00', 0.07)                       // '700.00'  (VAT)
+ * mulRate('33.33', '0.07')                        // '2.33'    (half-up)
+ * mulRate('33.33', 0.07, { rounding: 'floor' })   // '2.33'
+ * mulRate(100, 0.07, { scale: 2 })                // '7.00'
+ * ```
  */
-declare function encryptDeterministic(plaintext: string, dek: CryptoKey, context: string): Promise<EncryptResult>;
+declare function mulRate(amount: number | string, rate: number | string, opts?: MulRateOptions): string;
 /**
- * Counterpart to {@link encryptDeterministic}. The IV is stored
- * alongside the ciphertext (exactly like the randomized path), so
- * decrypt uses the stored IV and verifies the GCM auth tag — a tampered
- * ciphertext throws `TamperedError` just like randomized AES-GCM.
+ * Split a money amount across weighted buckets with ZERO drift: the
+ * returned parts sum to the input exactly, by construction
+ * (largest-remainder method).
+ *
+ * Each bucket gets `floor(amount × weightᵢ / Σweights)`; the leftover
+ * minor units (always fewer than the bucket count) go one each to the
+ * buckets with the largest truncated remainders — ties broken by
+ * position, earlier bucket first. Weights are parsed as exact decimals
+ * (no float division anywhere); they must be non-negative with a
+ * positive sum.
+ *
+ * ```ts
+ * allocate('100.00', [1, 1, 1])   // ['33.34', '33.33', '33.33']
+ * allocate('0.05', [3, 7])        // ['0.02', '0.03']
+ * allocate('-100.00', [1, 1, 1])  // ['-33.34', '-33.33', '-33.33']
+ * ```
  */
-declare function decryptDeterministic(ivBase64: string, dataBase64: string, dek: CryptoKey): Promise<string>;
-declare function bufferToBase64(buffer: ArrayBuffer | Uint8Array): string;
-declare function base64ToBuffer(base64: string): Uint8Array<ArrayBuffer>;
+declare function allocate(amount: number | string, weights: ReadonlyArray<number | string>, opts?: AllocateOptions): string[];
 
 /**
  * Hierarchical access — tier-aware keyring helpers.
@@ -660,117 +1282,133 @@ declare function effectiveClearance(keyring: UnlockedKeyring, collection: string
 declare function assertTierAccess(keyring: UnlockedKeyring, collection: string, tier: number): void;
 
 /**
- * Vault-level diff orchestrator.
- *
- * Compares a live `Vault`'s plaintext state against a candidate state
- * (another vault, a plain `{ collection: records[] }` map, or a vault
- * dump JSON) and returns a structured `VaultDiff` plan listing the
- * records that would be added, modified, or deleted to bring the live
- * vault into the candidate's shape.
+ * Default policy for personal vaults and SMB deployments — the gates
+ * that need an off-device factor get one (TOTP / email-OTP / paper
+ * recovery), the rest take a tier-1 unlock alone. Tier-3 (PIN) is the
+ * floor only for `rotate-unlock` because that's the
+ * "change my PIN" flow.
  *
- * Builds on two existing record-level helpers:
+ * The unspecified gates (e.g. `view-user-auth`) inherit the engine
+ * default of `{ enabled: false, minTier: 1 }` — they fail closed.
  *
- *   1. `diff(a, b)` from `./history/diff.ts` — emits dot-pathed
- *      `DiffEntry[]` with `type: 'added' | 'removed' | 'changed'` for
- *      each changed field of two records. Used here for the
- *      `fieldDiffs` of every `modified` entry, and (with empty result)
- *      as the default deep-equal check.
+ * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Built-in gates
+ */
+declare const PERSONAL_POLICY: VaultPolicy;
+/**
+ * Strict policy for regulated deployments and shared workstations —
+ * raises the phrase floor to 8 words, demands two distinct factors for
+ * exports, and blocks export-on-shared-device. Use as a base for
+ * `policy: { ...STRICT_POLICY, gates: { ...STRICT_POLICY.gates, ... } }`
+ * tweaks.
+ */
+declare const STRICT_POLICY: VaultPolicy;
+/**
+ * Merge a developer override onto a preset. Unspecified gates inherit;
+ * specified gates fully replace the preset's entry for that gate.
  *
- *   2. `Vault.exportStream()` from `./vault.ts` — the canonical
- *      decrypt-and-stream-records iterator. Used to walk both sides
- *      when the candidate is itself a `Vault`. ACL-scoped: collections
- *      the caller can't read silently drop out, the same way every
- *      other plaintext-emitting export pipeline filters them.
+ * Example:
  *
- * The new orchestration is the **vault-level** enumeration: bucket
- * each record id into added (only in candidate), deleted (only in
- * vault), or modified (in both with field changes); leave the
- * field-level granularity to the existing `diff()`.
+ * ```ts
+ * mergePolicy(PERSONAL_POLICY, {
+ *   gates: {
+ *     'app:approve-large-payment': { minTier: 2, factors: [{ anyOf: ['totp'] }] },
+ *   },
+ * })
+ * // → PERSONAL_POLICY plus the new app gate; existing gates intact.
+ * ```
+ */
+declare function mergePolicy(base: VaultPolicy, override?: Partial<VaultPolicy>): VaultPolicy;
+
+/**
+ * Policy gate engine — the {@link checkGate} entry point.
  *
- * Use cases:
+ * Given a configured {@link VaultPolicy}, an active session tier, and
+ * the factor proofs an actor is presenting, decide whether the gate
+ * permits the action. On denial, throws {@link PolicyDeniedError} with
+ * a stable {@link PolicyDenyReason} so consumers can branch in error
+ * UIs.
  *
- *   - Import preview (`@noy-db/as-*` `fromString` returns a plan
- *     whose body is a `VaultDiff`).
- *   - Backup verification ("does this `.noydb` bundle from yesterday
- *     match the current vault?").
- *   - Two-vault reconciliation ("what's different between Office A
- *     and Office B before we sync?").
- *   - Test assertions (golden-file testing with one-liner
- *     `expect(plan.summary).toEqual(...)`).
+ * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → checkGate() API
  *
  * @module
  */
 
-/** Per-record entry shape — added and deleted records carry only the record value. */
-interface VaultDiffEntry<T = unknown> {
-    readonly collection: string;
-    readonly id: string;
-    readonly record: T;
-}
-/** Modified records carry both halves of the diff plus the field-level breakdown. */
-interface VaultDiffModifiedEntry<T = unknown> extends VaultDiffEntry<T> {
-    /** The record as it stands in the live vault. */
-    readonly before: T;
-    /** Top-level keys whose values differ between `before` and `record`. */
-    readonly fieldsChanged: readonly string[];
-    /**
-     * Field-level diff entries from `diff(before, record)`. Reuses the
-     * existing per-record diff helper so consumers can render git-style
-     * `path: from → to` rows without re-walking the records.
-     */
-    readonly fieldDiffs: readonly DiffEntry[];
-}
-interface VaultDiff<T = unknown> {
-    readonly added: readonly VaultDiffEntry<T>[];
-    readonly modified: readonly VaultDiffModifiedEntry<T>[];
-    readonly deleted: readonly VaultDiffEntry<T>[];
-    /** Only populated when `options.includeUnchanged: true`. */
-    readonly unchanged: readonly VaultDiffEntry<T>[] | undefined;
-    readonly summary: {
-        readonly add: number;
-        readonly modify: number;
-        readonly delete: number;
-        readonly total: number;
-    };
+/** Default freshness window — 5 minutes. */
+declare const DEFAULT_FRESHNESS_MS: number;
+/** Caller-supplied context for one `checkGate` invocation. */
+interface CheckGateContext {
+    /** Tier the active session currently holds. */
+    readonly activeTier: ActiveTier;
+    /** Proofs the actor is presenting for this gate. */
+    readonly factors?: ReadonlyArray<FactorProof>;
     /**
-     * Format the diff as a human-readable string.
-     *
-     *   - `'count'`   — one line, just the numbers (`12 added · 3 modified · 0 deleted`)
-     *   - `'one-line'` — count plus a single overview line
-     *   - `'full'`    — count + one row per added/modified/deleted record (default)
+     * If the host knows the actor is on a shared device, set this to
+     * `true` so the engine can apply `warn.sharedDevice` rules. Defaults
+     * to `false`.
      */
-    format(opts?: {
-        detail?: 'count' | 'one-line' | 'full';
-    }): string;
-}
-interface DiffOptions {
-    /** Restrict the diff to a subset of collections. */
-    readonly collections?: readonly string[];
-    /** Field on each record that carries its id. Defaults to `'id'`. */
-    readonly idKey?: string;
-    /** Override the default deep-equal check for "modified vs unchanged". */
-    readonly compareFn?: (a: unknown, b: unknown) => boolean;
-    /** If true, include unchanged records in the diff (off by default to save memory). */
-    readonly includeUnchanged?: boolean;
+    readonly sharedDevice?: boolean;
+    /**
+     * Override `now()` for tests. Defaults to `Date.now()`.
+     * @internal
+     */
+    readonly now?: number;
 }
 /**
- * Candidate state to diff the vault against:
+ * Decide whether `gate` permits the action under `context`. Throws
+ * {@link PolicyDeniedError} on denial; resolves with `void` on success.
+ *
+ * Lookup rules:
+ * - **Built-in gates** without a configured policy fail closed
+ *   (`enabled: false`).
+ * - **App-defined gates** (`app:*`) without a configured policy are
+ *   treated as no-op (allow). The developer registered the policy if
+ *   they wanted enforcement; absence means the gate is informational.
+ */
+declare function checkGate(policy: VaultPolicy, gate: GateName, context: CheckGateContext): Promise<void>;
+/**
+ * Same as {@link checkGate} but returns a structured verdict instead
+ * of throwing. Useful when an error UI wants to show the user
+ * "you'll need TOTP plus a recovery code to do that" without first
+ * triggering the action.
+ */
+declare function describeGate(policy: VaultPolicy, gate: GateName, context: CheckGateContext): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    reason: PolicyDenyReason;
+    required: GatePolicy;
+}>;
+
+/**
+ * Persistence helpers for the vault-level policy document
+ * (`_meta/policy`). Mirrors the bypass-AES pattern used by
+ * `_meta/handle` — the policy document is plain JSON, the envelope's
+ * `_iv` field is left empty.
  *
- *   - A `Vault` instance — both sides are walked via `exportStream()`.
- *   - A `Record<collection, records[]>` map — same shape `as-json.toObject()`
- *     produces. Useful for diffing parsed file content against the live vault.
- *   - A `VaultDump` (output of `vault.dump()`) — a JSON string carrying the
- *     full vault state. Parsed and reduced to the map shape above.
+ * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Storage location
+ *
+ * @module
  */
-type DiffCandidate<T = unknown> = Vault | Record<string, readonly T[]> | string;
+
+/** Reserved collection name for vault-level metadata documents. */
+declare const META_COLLECTION = "_meta";
+/** Reserved id for the vault-level policy document. */
+declare const POLICY_RECORD_ID = "policy";
 /**
- * Compute the diff between a live vault and a candidate state.
+ * Read the vault-level policy from `_meta/policy`. Returns `undefined`
+ * when no policy has been persisted (fresh vault, or a vault written
+ * before the policy module landed). The caller falls back to the
+ * default preset.
  *
- * Returns a fully buffered `VaultDiff` — no streaming. Memory cost is
- * O(n + m) in the row count of vault + candidate. For documented
- * 1K-50K-record vaults this is fine; a streaming variant lands as a
- * follow-up if a > 100K-record consumer arrives.
+ * Tolerates corrupted documents the same way `_meta/handle` does: a
+ * JSON parse failure surfaces as `undefined`, not a thrown error, so
+ * a bad write never permanently locks a vault.
+ */
+declare function loadVaultPolicy(store: NoydbStore, vault: string): Promise<VaultPolicy | undefined>;
+/**
+ * Persist the vault-level policy at `_meta/policy`. Idempotent — call
+ * once at vault creation and again on `db.updatePolicy()` invocations.
  */
-declare function diffVault<T = unknown>(vault: Vault, candidate: DiffCandidate<T>, options?: DiffOptions): Promise<VaultDiff<T>>;
+declare function saveVaultPolicy(store: NoydbStore, vault: string, policy: VaultPolicy): Promise<void>;
 
-export { ActiveTier, type CheckGateContext, DEFAULT_FRESHNESS_MS, DIRECTORY_RECORD_ID, type DiffCandidate, DiffEntry, type DiffOptions, DirectoryConfig, FactorProof, GateName, GatePolicy, META_COLLECTION, ManagedRecoveryNotEnrolledError, NoydbError, NoydbStore, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, type PersistSchemaResult, PersistedSchemaEnvelope, PolicyDeniedError, type PolicyDenyReason, PublicEnvelope, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, SCHEMAS_COLLECTION, STRICT_POLICY, SchemaUpdateStrategy, UnlockedKeyring, UpdateDecision, UserEnvelope, UserVisibility, VISIBILITY_RECORD_PREFIX, Vault, type VaultDiff, type VaultDiffEntry, type VaultDiffModifiedEntry, VaultPolicy, additiveOnly, assertTierAccess, base64ToBuffer, blindUpdate, bufferToBase64, checkGate, coordinatedCutover, decryptBytes, decryptDeterministic, dekKey, deleteUserEnvelope, deleteUserVisibility, derivePersistedSchema, derivePresenceKey, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, diffVault, effectiveClearance, encryptBytes, encryptDeterministic, estimateRecordBytes, isZodSchema, listUserEnvelopeIds, loadPersistedSchema, loadPublicEnvelope, loadUserEnvelope, loadVaultPolicy, lockSchema, mergePolicy, parseBytes, persistDirectoryConfig, persistSchemaIfNeeded, persistUserVisibility, readDirectoryConfig, readPublicEnvelope, readUserVisibility, savePersistedSchema, savePublicEnvelope, saveUserEnvelope, saveVaultPolicy, visibilityRecordId };
+export { ActiveTier, type AgeRoute, type AllocateOptions, ApproveWithdrawalOptions, type BlobLifecyclePolicy, type BlobStoreRoute, type CheckGateContext, type CircuitBreakerOptions, CustodyStrategy, DEFAULT_FRESHNESS_MS, DIRECTORY_RECORD_ID, DeepPartialOrNull, type DirectoryConfig, EncryptedEnvelope, ExportAccessibleOptions, FactorProof, type FxRates, GateName, GatePolicy, type HealthCheckOptions, LiveUserEnvelope, type LogLevel, type LoggingOptions, META_COLLECTION, type MetricsOptions, type MulRateOptions, NoydbStore, type OverrideOptions, type OverrideTarget, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, type PersistSchemaResult, PersistedSchemaEnvelope, PolicyDenyReason, PublicEnvelope, RejectWithdrawalOptions, RequestWithdrawalOptions, RequestWithdrawalResult, type RetryOptions, RoundingMode, type RouteStatus, type RouteStoreOptions, type RoutedNoydbStore, SCHEMAS_COLLECTION, STRICT_POLICY, SchemaUpdateStrategy, SearchStrategy, SequenceStrategy, type StoreCacheOptions, type StoreMiddleware, type StoreOperation, type SuspendOptions, type Tokenizer, UnlockedKeyring, Unsubscribe, UpdateDecision, UserApi, UserEnvelope, UserEnvelopePresented, type UserVisibility, VISIBILITY_RECORD_PREFIX, VaultPolicy, WithdrawAccessibleOptions, WithdrawResult, WithdrawalRequest, WithdrawalRequestStatus, additiveOnly, allocate, assertTierAccess, blindUpdate, checkGate, coordinatedCutover, dekKey, deleteUserEnvelope, deleteUserVisibility, derivePersistedSchema, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, effectiveClearance, estimateRecordBytes, isZodSchema, listUserEnvelopeIds, loadPersistedSchema, loadPublicEnvelope, loadUserEnvelope, loadVaultPolicy, lockSchema, memoryStore, mergePolicy, mulRate, parseBytes, persistDirectoryConfig, persistSchemaIfNeeded, persistUserVisibility, readDirectoryConfig, readPlaintextRecord, readPublicEnvelope, readUserVisibility, routeStore, savePersistedSchema, savePublicEnvelope, saveUserEnvelope, saveVaultPolicy, scaleForCurrency, tokenize, visibilityRecordId, withCache, withCircuitBreaker, withCustody, withHealthCheck, withLogging, withMetrics, withRetry, withSearch, withSequence, wrapStore };