@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.11

package/dist/index.d.ts

@@ -1,1414 +1,317 @@
-import { e0 as SearchStrategy, e1 as SequenceStrategy, e2 as CustodyStrategy, cV as EncryptedEnvelope, e3 as SchemaUpdateStrategy, e4 as TransformFn, cT as NoydbStore, e5 as PersistedSchemaEnvelope, dj as EnclaveKey, e6 as UpdateDecision, dL as PublicEnvelope, e7 as UserEnvelope, e8 as VaultUserApi, e9 as UserApiDeps, cy as RequestWithdrawalOptions, cz as RequestWithdrawalResult, cD as WithdrawalRequestStatus, cC as WithdrawalRequest, ct as ApproveWithdrawalOptions, cB as WithdrawResult, cx as RejectWithdrawalOptions, cA as WithdrawAccessibleOptions, cu as ExportAccessibleOptions, ea as DeepPartialOrNull, eb as UserEnvelopePresented, ec as Unsubscribe, ed as LiveUserEnvelope, ee as RoundingMode, cF as UnlockedKeyring, ef as VaultPolicy, eg as ActiveTier, eh as FactorProof, ei as GateName, ej as PolicyDenyReason, ek as GatePolicy } from './index-BzUo1B6n.js';
-export { el as AccessibleVault, em as AffectedDocument, aP as AggregateResult, aQ as AggregateSpec, aR as Aggregation, aS as AggregationUpstream, en as AlreadyElevatedError, bM as AmendmentForbiddenError, cX as AppendInput, eo as ArchivePolicy, ep as ArchiveResult, eq as ArchiveRunOptions, er as ArchiveStrategy, c4 as ArrayOutputSpec, dz as AttestationError, dA as AttestationNotEnabledError, Y as BLOB_CHUNKS_COLLECTION, Z as BLOB_COLLECTION, $ as BLOB_INDEX_COLLECTION, a0 as BLOB_SLOTS_PREFIX, a1 as BLOB_VERSIONS_PREFIX, es as BUNDLE_STORE_POLICY, dl as BackupCorruptedError, dm as BackupLedgerError, a5 as BlobObject, a6 as BlobPutOptions, a7 as BlobResponseOptions, a8 as BlobSet, et as BuiltInGateName, dn as BundleIntegrityError, dM as BundleRecipient, dp as BundleSealMismatchError, dq as BundleVersionConflictError, bq as CONSENT_AUDIT_COLLECTION, eu as CacheOptions, ev as CacheStats, ew as CargoNotEnabledError, ex as CargoStrategy, ey as ChangeEvent, cY as ChangeType, ez as Clause, bz as ClosePeriodOptions, ci as Collection, eA as CollectionChangeEvent, eB as CollectionConfig, eC as CollectionConflictResolver, eD as CollectionDescriptor, bV as CollectionFrame, ay as CollectionIndexes, cZ as CollectionInstant, eE as CollectionStats, eF as ComputedFieldError, eG as ComputedFields, eH as ComputedFn, eI as Conflict, eJ as ConflictError, eK as ConflictPolicy, eL as ConflictStrategy, br as ConsentAuditEntry, bs as ConsentAuditFilter, bt as ConsentContext, bu as ConsentOp, bg as CrdtMode, bh as CrdtState, eM as CrossJoinSourceUnknownError, eN as CrossJoinTooLargeError, eO as CrossTierAccessEvent, eP as CustodyApi, eQ as CustodyHost, eR as CustodyNotEnabledError, ad as DEFAULT_CHUNK_SIZE, eS as DEFAULT_CROSS_JOIN_MAX_ROWS, eT as DEFAULT_JOIN_MAX_ROWS, eU as DEFAULT_PUBLIC_ENVELOPE_SCHEMA, eV as DELEGATIONS_COLLECTION, D as DICT_COLLECTION_PREFIX, eW as DanglingReferenceError, eX as DataResidencyError, eY as DebugPlaintextError, eZ as DebugReservedFieldError, e_ as DecryptionError, e$ as DeepPartial, f0 as DeferredNumberingConfig, f1 as DelegationTargetMissingError, f2 as DelegationToken, f3 as DeleteManyResult, c5 as DerivationCapExceededError, c6 as DerivationCycleError, c7 as DerivationDepthError, f4 as DerivationDescriptor, c8 as DerivationOutputShapeError, c9 as DerivationOutputUnknownError, c2 as DerivationStrategy, cb as DerivationStrategyHandle, cc as DerivedFromMeta, a as DictEntry, b as DictKeyDescriptor, c as DictKeyInUseError, d as DictKeyMissingError, e as DictionaryHandle, f as DictionaryOptions, cE as DiffEntry, f5 as DirectoryDisabledError, f6 as DirtyEntry, f7 as DryRunResult, f8 as DumpSchemaOptions, f9 as ELEVATION_AUDIT_COLLECTION, fa as ElevatedHandle, fb as ElevationExpiredError, fc as EmbeddingDescriptor, fd as EmbeddingDimMismatchError, fe as EmbeddingModelMismatchError, ff as EnclaveNotSupportedError, fg as EnrollAuthenticatorOptions, fh as EnrollAuthenticatorWrappingDEKsOptions, fi as EnrollAuthenticatorWrappingKEKOptions, fj as EnrollRecoveryResult, fk as ExportCapability, fl as ExportCapabilityError, fm as ExportChunk, cG as ExportFormat, fn as ExportStreamOptions, fo as FactorKind, fp as FactorProofBundle, fq as FactorRequirement, fr as FenceDoc, fs as FenceState, ft as FieldChange, fu as FieldClause, fv as FieldDescriptor, bN as FieldFrozenError, fw as FieldSource, fx as FilenameSanitizationError, fy as FilterClause, fz as ForgetStrategyNotConfiguredError, fA as FormattedSequenceHandle, fB as FrozenSnapshotRef, aT as GROUPBY_MAX_CARDINALITY, aU as GROUPBY_WARN_CARDINALITY, fC as GhostRecord, fD as GrantCustodianOptions, fE as GrantOptions, fF as GroupCardinalityError, fG as GroupClause, aV as GroupedAggregation, aW as GroupedQuery, aX as GroupedQueryN, aY as GroupedRow, aZ as GroupedRowN, bK as GuardChange, bL as GuardContext, bJ as GuardStrategy, bP as GuardStrategyHandle, fH as GuardViolation, az as HashIndex, fI as HistoryConfig, fJ as HistoryEntry, cU as HistoryOptions, g as I18nMap, h as I18nTextDescriptor, i as I18nTextOptions, fK as INDEXED_STORE_POLICY, bQ as IllegalTransitionError, fL as ImportCapability, fM as ImportCapabilityError, aB as IndexDef, fN as IndexFieldName, fO as IndexRequiredError, fP as IndexWriteFailureError, fQ as InferOutput, fR as InternalCollectionStats, fS as InvalidKeyError, bR as InvariantError, fT as IssueDelegationOptions, fU as IssueMagicLinkGrantOptions, fV as JoinContext, fW as JoinLeg, fX as JoinStrategy, fY as JoinTooLargeError, fZ as JoinableSource, c_ as JsonPatch, c$ as JsonPatchOp, f_ as KeyringAuthenticator, f$ as KeyringAuthenticatorWrappingDEKs, g0 as KeyringAuthenticatorWrappingKEK, g1 as KeyringCorruptError, g2 as KeyringExpiredError, g3 as KeyringFile, L as Layer, g4 as LedgerContentionError, d0 as LedgerStore, g5 as LiberateOptions, g6 as LiberateResult, g7 as LinkEndpointError, g8 as LinkIntegrityError, g9 as LinkOnDelete, ga as LinkRow, gb as LinkSetHandle, gc as LinkSpec, gd as ListAccessibleVaultsOptions, ge as ListPageResult, gf as ListUsersOptions, a_ as LiveAggregation, gg as LiveQuery, gh as LiveUpstream, j as LocaleNotSpecifiedError, gi as LocaleReadOptions, gj as Lru, gk as LruOptions, gl as LruStats, bi as LwwMapState, gm as MAGIC_LINK_CONTENT_INFO_PREFIX, gn as MAGIC_LINK_GRANTS_COLLECTION, go as MAGIC_LINK_KEK_INFO_PREFIX, gp as MagicLinkGrantPayload, gq as MagicLinkGrantRecord, gr as ManagedRecoveryNotEnrolledError, dU as MaterializedFromMeta, dV as MaterializedViewConfigError, dW as MaterializedViewCycleError, gs as MaterializedViewDescriptor, dX as MaterializedViewOutput, dY as MaterializedViewSourceUnknownError, cf as MaterializedViewStrategy, cg as MaterializedViewStrategyHandle, dZ as MaterializedViewTooLargeError, gt as MemoryRecipientSealer, gu as MemorySealingKeyProvider, gv as MigrationRequiredError, M as MissingTranslationError, gw as MoneyCurrencyError, gx as MoneyDescriptor, gy as MoneyOptions, gz as MoneyOptionsFixed, gA as MoneyOptionsMulti, gB as MoneyPrecisionError, gC as MoneyString, gD as MoneyUnsupportedError, gE as NOYDB_BACKUP_VERSION, gF as NOYDB_FORMAT_VERSION, gG as NOYDB_KEYRING_VERSION, gH as NOYDB_SYNC_VERSION, gI as NO_CARGO, gJ as NO_CUSTODY, gK as NO_SEARCH, gL as NO_SEQUENCE, gM as NetworkError, gN as NextOptions, gO as NoAccessError, gP as NonAdditiveSchemaChangeError, gQ as NotFoundError, gR as Noydb, gS as NoydbBundleStore, gT as NoydbError, gU as NoydbEventMap, gV as NoydbOptions, bX as NoydbPodStore, gW as NumberingAssignment, gX as NumberingUncertaintyError, ak as ObjectListEntry, al as ObjectMeta, am as ObjectProjection, an as ObjectUrlOptions, O as OnMissing, k as OnMissingPolicy, bA as OpenPeriodOptions, gY as Operator, gZ as OrderBy, cd as OutputSpec, cj as OverlayBaseIsVirtualError, ck as OverlayCollectionUnavailableError, cl as OverlayFieldMergeMode, cm as OverlayFieldMergeRule, cn as OverlayIdMismatchError, co as OverlayNameCollisionError, g_ as OverlayViewDescriptor, ch as OverlayedViewStrategy, cq as OverlayedViewStrategyHandle, bB as PERIODS_COLLECTION, g$ as POD_STORE_POLICY, h0 as PUBLIC_ENVELOPE_FIELDS, h1 as PaperRecoveryDoc, h2 as PaperRecoveryEntry, h3 as PassphrasePolicy, h4 as PassphraseValidationResult, h5 as PathEscapeError, h6 as PeriodClosedError, bC as PeriodRecord, h7 as Permission, h8 as PermissionDeniedError, h9 as Permissions, ha as PersistedSchemaKind, hb as PlaintextTranslatorContext, hc as PlaintextTranslatorFn, du as PodVersionConflictError, hd as PolicyDeniedError, P as PolicyEnforcer, cw as PortabilityNotEnabledError, he as PresenceHandle, hf as PresencePeer, hg as PrivilegeEscalationError, cW as PruneOptions, hh as PublicEnvelopeField, hi as PublicEnvelopeSchema, hj as PublicEnvelopeText, hk as PullMode, hl as PullOptions, hm as PullPolicy, hn as PullResult, ho as PushMode, hp as PushOptions, hq as PushPolicy, hr as PushResult, hs as PutManyItemOptions, ht as PutManyOptions, hu as PutManyResult, ao as PutObjectOptions, ap as PutUrlOptions, dS as Query, hv as QueryAcrossOptions, hw as QueryAcrossResult, hx as QueryField, hy as QueryPlan, hz as QuerySource, hA as QuickUnlockState, hB as QuickUnlockStore, hC as QuiesceTimeoutError, hD as ReAuthOperation, hE as ReadOnlyAtInstantError, hF as ReadOnlyError, hG as ReadOnlyFrameError, dO as RecipientHint, dN as RecipientSealer, hH as RecordCekNotFoundError, bT as RecordLockedError, ce as RecordOutputSpec, hI as RecoverPassphraseInput, hJ as RecoverPassphraseResult, hK as RecoverUserOptions, hL as RecoveryNotEnrolledError, hM as RecoveryProfileNotImplementedError, hN as RecoveryProof, a$ as Reducer, b0 as ReducerBuilder, b1 as ReducerOptions, hO as RefDescriptor, hP as RefIntegrityError, hQ as RefMode, hR as RefRegistry, hS as RefScopeError, hT as RefViolation, R as ReservedCollectionNameError, hU as ReservedVaultNameError, l as ResolveI18nOptions, hV as ResolvedPublicEnvelopeSchema, bY as RetentionPolicy, hW as RetrieveHit, hX as RetrieveOptions, hY as RevokeOptions, bj as RgaState, cR as Role, hZ as RotatePassphraseInput, h_ as RotateRecoveryOptions, h$ as RotateRecoveryResult, i0 as SEALED_PASSPHRASE_RECORD_ID, i1 as ScanBuilder, i2 as ScanPageProvider, i3 as SchemaDelta, i4 as SchemaFenceError, i5 as SchemaIntrospection, i6 as SchemaLockedError, i7 as SchemaUpdateError, i8 as SchemaValidationError, S as ScriptViolationError, m as ScriptWarning, i9 as Sealed, ia as SealedEnvelope, ib as SealedHandle, ic as SealedPassphrase, dc as SealedRecordExpiredError, dd as SealedRecordMismatchError, de as SealedRecordNotEnabledError, id as SealedView, dg as SealingKeyProvider, ie as SearchEntry, ig as SearchNotEnabledError, ih as SearchOptions, ii as SearchResult, ij as SequenceContentionError, ik as SequenceHandle, il as SequenceNotEnabledError, im as SequenceOfflineError, io as SequenceOptions, ip as SequenceStore, iq as SequenceStoreOptions, J as SessionExpiredError, K as SessionNotFoundError, ir as SessionPolicy, N as SessionPolicyError, is as SetPublicEnvelopeInput, it as ShamirRecoveryDoc, iu as ShamirRecoveryEntry, di as ShamirRecoveryProvider, iv as ShardProvisioningError, aq as SlotInfo, ar as SlotRecord, iw as SlotRewrapCeremony, ix as SlotRewrapContext, b$ as SnapshotMeta, c1 as SnapshotNotFoundError, iy as StandardSchemaV1, iz as StandardSchemaV1Issue, iA as StandardSchemaV1SyncResult, n as StaticDictDescriptor, o as StaticDictReadonlyError, iB as StoreAuth, iC as StoreAuthKind, iD as StoreCapabilities, iE as StoreCapabilityError, iF as StoreTime, iG as SyncEngine, iH as SyncMetadata, iI as SyncPolicy, iJ as SyncScheduler, iK as SyncSchedulerStatus, iL as SyncStatus, iM as SyncTarget, iN as SyncTargetRole, iO as SyncTransaction, iP as SyncTransactionResult, iQ as TabChannel, iR as TabCoordinationOptions, iS as TabLockManager, iT as TabPresence, iU as TabRole, iV as TamperedError, iW as TierDemoteDeniedError, iX as TierMode, iY as TierNotGrantedError, iZ as TiersNotEnabledError, i_ as TransactionInvariant, i$ as TranslatorAuditEntry, T as TranslatorNotConfiguredError, j0 as TxCollection, dP as TxContext, j1 as TxOp, j2 as TxVault, d_ as UnionArmJoin, d$ as UnionSource, j3 as UniqueConstraintError, U as UnknownDictCodeError, j4 as UnknownShardError, j5 as UnsupportedIndexOptionError, j6 as UpdateAuthenticatorOptions, j7 as UpdateContext, j8 as UpdateUserOptions, j9 as UserEnvelopeCheckGate, ja as UserEnvelopeOversizedError, jb as UserInfo, jc as ValidationError, V as Vault, jd as VaultBackup, d1 as VaultEngine, bW as VaultFrame, d2 as VaultInstant, je as VaultPolicyOnDisk, jf as VaultSchemaSnapshot, jg as VaultSnapshot, jh as VaultTemplateNotFoundError, d3 as VerifyResult, as as VersionRecord, ji as WarningRules, jj as WeakPassphraseError, jk as WeakPassphraseReason, jl as WithArchiveOptions, jm as WithdrawalRequestError, jn as WrappedDeksBlob, jo as WriteConflict, jp as WriteQueue, bk as YjsState, jq as aesGcmOpen, p as applyI18nLocale, jr as applyJoins, d4 as applyPatch, js as approveWithdrawal, jt as asMoney, ju as assertStrongPassphrase, b2 as avg, jv as base64ToBuffer, jw as bufferToBase64, jx as buildLiveQuery, jy as buildRecipientKeyringFile, jz as burnPaperRecoveryEntry, jA as compileSequenceFormat, d5 as computePatch, b4 as count, Q as createEnforcer, jB as createNoydb, jC as createStore, jD as decryptBytes, jE as decryptDeterministic, jF as deriveMagicLinkContentKey, jG as derivePresenceKey, q as dictCollectionName, r as dictKey, d6 as diff, jH as encryptBytes, jI as encryptDeterministic, s as enforceScript, jJ as enrollAuthenticator, jK as estimateEntropy, jL as evalComputedFields, jM as evaluateClause, jN as evaluateExportCapability, jO as evaluateFieldClause, jP as evaluateImportCapability, jQ as executePlan, jR as exportAccessibleData, jS as findAuthenticator, d7 as formatDiff, b5 as groupAndReduce, jT as hasExportCapability, jU as hasImportCapability, jV as hasRecoveryEnrolled, u as i18nText, v as inferScripts, w as isDictCollectionName, x as isDictKeyDescriptor, y as isI18nTextDescriptor, jW as isLinkCollectionName, jX as isMagicLinkGrantExpired, jY as isMoneyDescriptor, jZ as isMoneyString, j_ as isPublicEnvelope, j$ as isRefArray, z as isStaticDictDescriptor, k0 as issueDelegation, k1 as keyringRecoverPassphrase, k2 as keyringRotatePassphrase, k3 as liberateVault, k4 as listMagicLinkGrants, k5 as listUsers, k6 as listUsersWithEnvelopes, k7 as listWithdrawalRequests, k8 as loadActiveDelegations, k9 as loadPaperRecoveryEntries, ka as loadSealedPassphrase, kb as loadShamirRecoveryEntries, kc as magicLinkGrantRecordId, b6 as max, au as memoryObjectProjection, bn as mergeCrdtStates, b7 as min, kd as mintPaperRecoveryEntry, ke as mintShamirRecoveryEntry, kf as mintWrappedDeksBlob, kg as money, b8 as moneyMax, b9 as moneyMin, kh as moneyNumber, ba as moneySum, ki as parseRsaOaepTlv, kj as parseSealedEnvelope, kk as readMagicLinkGrantRecord, kl as readPath, km as recoverUser, bb as reduceRecords, bc as reducerBuilder, kn as ref, ko as refArray, kp as rejectWithdrawal, kq as removeAuthenticator, kr as requestWithdrawal, ks as resetJoinWarnings, bo as resolveCrdtSnapshot, A as resolveI18nText, B as resolvePolicy, kt as resolvePublicEnvelopeSchema, ku as resolveSequenceKey, kv as revokeDelegation, kw as revokeMagicLinkGrant, kx as runTransaction, ky as savePaperRecoveryEntries, kz as saveSealedPassphrase, kA as saveShamirRecoveryEntries, kB as sealRsaOaepTlv, E as staticDict, be as sum, kC as unwrapDeksFromBlob, kD as unwrapDeksFromPaperEntry, kE as unwrapDeksFromShamirEntry, kF as unwrapMagicLinkGrant, G as validateI18nTextValue, kG as validatePassphrase, kH as validatePublicEnvelopeInput, kI as validateSchemaInput, kJ as validateSchemaOutput, W as validateSessionPolicy, kK as withArchive, kL as withDeferredNumbering, kM as withdrawAccessibleData, kN as writeMagicLinkGrant } from './index-BzUo1B6n.js';
-export { I as ImportExternalOptions, a as ImportExternalResult, b as ImportableCollection, d as detectMagic, c as detectMimeType, i as importExternalObjects, e as isPreCompressed } from './mime-magic-CGhw37_E.js';
-export { WrapBundleStoreOptions, WrapPodStoreOptions, WrappedBundleNoydbStore, WrappedPodNoydbStore, createBundleStore, createPodStore, wrapBundleStore, wrapPodStore } from './pod/index.js';
-export { W as WriteEvent, a as WriteHook } from './index-B9QdHytu.js';
-export { C as CollectionDescription, a as CollectionMeta, D as DescribeOptions, b as DescribedField, F as FieldMeta, S as SemanticType, V as VaultMeta } from './describe-aBkJR2sd.js';
-export { D as DEED_RECORD_ID, a as DeedMarker, S as STATE_VAULT_NAME, U as USER_ENVELOPE_COLLECTION, b as USER_ENVELOPE_MAX_BYTES, c as createDeedOwner, i as isDeedVault, l as loadDeedMarker, w as withCargo } from './index-BF9_96A5.js';
-export { A as AutoCredential, q as AutoCredentialKind, d as CompressionAlgo, f as NOYDB_BUNDLE_FORMAT_VERSION, g as NOYDB_BUNDLE_MAGIC, h as NOYDB_BUNDLE_PREFIX_BYTES, i as NoydbBundleHeader, j as NoydbBundleReadResult, N as NoydbPodHeader, R as ReadNoydbBundleOptions, k as WriteNoydbBundleOptions, W as WritePodOptions, s as hasNoydbBundleMagic, m as readNoydbBundle, n as readNoydbBundleHeader, t as readNoydbBundlePublicEnvelope, r as readPod, a as readPodHeader, o as resetBrotliSupportCache, p as writeNoydbBundle, w as writePod } from './bundle-CH-H06dp.js';
-export { g as generateULID, i as isULID } from './ulid-DRH25k3y.js';
-export { D as DecryptedRecord, d as decryptExtractedPartition } from './decrypt-partition-IHtxEnTi.js';
-export { L as LedgerEntry, d as canonicalJson, h as hashEntry, p as paddedIndex, e as parseIndex, s as sha256Hex } from './subject-index-O75wKshW.js';
-export { TransactionStrategyOptions } from './tx/index.js';
-export { I as ImmutableGuardConfig, T as TransitionGuardConfig, i as immutableGuard, t as transitionGuard, w as withGuard } from './transition-guard-C7ol6oPw.js';
-export { w as withDerivation, a as withRollup } from './with-rollup-BvQo3ROo.js';
-export { w as withMaterializedView } from './with-materialized-view-6p0Fk8bL.js';
-export { w as withOverlayedView } from './with-overlayed-view-BJ6mXGMd.js';
-export { SYNC_CREDENTIALS_COLLECTION, SyncCredential, credentialStatus, deleteCredential, getCredential, listCredentials, putCredential } from './team/index.js';
-export { C as CreateSessionOptions, a as CreateSessionResult, D as DevUnlockOptions, S as SessionToken, b as activeSessionCount, c as clearDevUnlock, d as createSession, e as enableDevUnlock, i as isDevUnlockActive, f as isSessionAlive, l as loadDevUnlock, r as resolveSession, g as revokeAllSessions, h as revokeSession } from './dev-unlock-C9Ro3v_O.js';
-export { i as isDiscriminant } from './discriminant-BN9REW3o.js';
-export { FuseOptions, fuseRetrieval } from './kernel/index.js';
-export { D as DiffCandidate, a as DiffOptions, V as VaultDiff, b as VaultDiffEntry, c as VaultDiffModifiedEntry, d as diffVault } from './vault-diff-B5fYNBL7.js';
-export { L as LEDGER_COLLECTION, a as LEDGER_DELTAS_COLLECTION, e as envelopePayloadHash } from './hash-Cp5uwiox.js';
-import '@noy-db/attestation';
-
 /**
- * Cache policy helpers — parse human-friendly byte budgets into raw numbers.
+ * **@noy-db/hub** — zero-knowledge, offline-first, encrypted document store.
  *
- * Accepted shapes (case-insensitive on suffix):
- *   number       — interpreted as raw bytes
- *   '1024'       — string of digits, raw bytes
- *   '50KB'       — kilobytes (×1024)
- *   '50MB'       — megabytes (×1024²)
- *   '1GB'        — gigabytes (×1024³)
+ * ## What it is
  *
- * Decimals are accepted (`'1.5GB'` → 1610612736 bytes).
+ * A TypeScript library that encrypts every record with AES-256-GCM before it
+ * reaches any storage backend. The store (file, DynamoDB, S3, IndexedDB, …)
+ * only ever sees ciphertext — it has no way to read or tamper with your data
+ * without the user's passphrase.
  *
- * Anything else throws — better to fail loud at construction time than
- * to silently treat a typo as 0 bytes (which would evict everything).
- */
-/** Parse a byte budget into a positive integer number of bytes. */
-declare function parseBytes(input: number | string): number;
-/**
- * Estimate the in-memory byte size of a decrypted record.
- *
- * Uses `JSON.stringify().length` as a stand-in for actual heap usage.
- * It's a deliberate approximation: real V8 heap size includes pointer
- * overhead, hidden classes, and string interning that we can't measure
- * from JavaScript. The JSON length is a stable, monotonic proxy that
- * costs O(record size) per insert — fine when records are typically
- * < 1 KB and the cache eviction is the slow path anyway.
- *
- * Returns `0` (and the caller must treat it as 1 for accounting) if
- * stringification throws on circular references; this is documented
- * but in practice records always come from JSON-decoded envelopes.
- */
-declare function estimateRecordBytes(record: unknown): number;
-
-/**
- * Default text tokenizer for scan-mode search.
- *
- * NFKC-normalize → lowercase → split on Unicode letter/number runs. This is a
- * word-boundary tokenizer: it does **not** segment scripts written without
- * inter-word spaces (Thai, Lao, Khmer, CJK) — those collapse to one token per
- * run. For such data, a dictionary/ICU segmenter is the right `tokenizer`
- * (the engine takes one as a parameter); substring/`contains` matching is the
- * pragmatic fallback until then.
- */
-type Tokenizer = (text: string) => string[];
-declare const tokenize: Tokenizer;
-
-/**
- * Enable the search / retrieval capability.
- * Pass to `createNoydb({ searchStrategy: withSearch() })` to make a collection's
- * `search` / `retrieve` / `similarTo` / `warmIndex` / `flushIndex` methods live,
- * and to enable the put()-time embedding-vector compute for collections that
- * declare an `embeddings` config. The search/retrieval engine is dynamically
- * imported here, so it stays out of the floor bundle until opted in.
- */
-
-declare function withSearch(): SearchStrategy;
-
-/**
- * Enable the atomic-sequence capability.
- * Pass to `createNoydb({ sequenceStrategy: withSequence() })` to make
- * `vault.sequence('name').next()` / `.peek()` / `.seedTo()` live. The
- * {@link SequenceStore} CAS engine is statically imported here, so it is pulled
- * into the bundle only when `withSequence()` is referenced (the floor never
- * imports it).
- */
-
-declare function withSequence(): SequenceStrategy;
-
-/**
- * Enable the sovereign-custody (FR-6) capability.
- * Pass to `createNoydb({ custodyStrategy: withCustody() })` to make
- * `db.grantCustodian` / `db.revokeCustodian` (and the `vault.custody.*` facade
- * that delegates to them) plus `vault.custody.liberate()` live. The heavy
- * `liberateVault` ceremony is dynamically imported here, so it is reached only
- * via opt-in; grant/revoke run the host's own gate + keyring engine.
- */
-
-declare function withCustody(): CustodyStrategy;
-
-/**
- * Helpers for reading records out of a *plaintext* store (`encrypt: false`)
- * with native tooling — the programmatic core of a `noydb cat`-style unwrap.
- * See the plaintext/debug-store-mode design.
- */
-
-/**
- * Extract the record from a plaintext stored envelope, handling both layouts:
+ * ## Architecture in one diagram
  *
- *   - **classic plaintext** (`encrypt: false`): the record is JSON in `_data`.
- *   - **debugPlaintext**: the record's fields are inlined beside the
- *     `_`-prefixed metadata (marked by `_debug`).
- *
- * Returns `null` for an empty/absent body. Throws if handed an **encrypted**
- * envelope (non-empty `_iv`) — there is no key here; decrypt through the vault
- * instead. Intended for record envelopes, not blob chunks.
- *
- * @example
- * ```ts
- * // node script over a to-file store, no vault needed:
- * const env = JSON.parse(readFileSync('data/acme/invoices/inv-1.json', 'utf8'))
- * console.log(readPlaintextRecord(env)) // → { id: 'inv-1', total: '120.00', … }
  * ```
- */
-declare function readPlaintextRecord<T = Record<string, unknown>>(envelope: EncryptedEnvelope): T | null;
-
-/** Allow any schema change. Explicit blind / back-compat. */
-declare function blindUpdate(): SchemaUpdateStrategy;
-/** Allow additive changes; reject non-additive ones. The safety backstop. */
-declare function additiveOnly(): SchemaUpdateStrategy;
-/**
- * Reject schema changes. With `fields`, reject only when one of those
- * fields is added/removed/changed; otherwise reject any non-`none` delta.
- */
-declare function lockSchema(opts?: {
-    readonly fields?: readonly string[];
-}): SchemaUpdateStrategy;
-
-/** The coordinatedCutover update strategy (single-step — no from/to). */
-
-declare function coordinatedCutover(opts: {
-    readonly transform: TransformFn;
-}): SchemaUpdateStrategy;
-
-/**
- * Built-in in-memory store — the kernel's zero-config default.
- *
- * Nested `Map`s: `vault → collection → id → envelope`. Non-persistent
- * (data is lost on process exit). A conformant 6-method {@link NoydbStore}
- * with CAS atomicity and a monotonic store clock — the kernel version of
- * `@noy-db/to-memory`'s core, so `createNoydb()` works with no store package.
- *
- * Portable: imports only `types` + `errors` (no crypto primitive) — passes
- * the `stores-ciphertext-only` architecture guard.
- *
- * Implements the 6-method core only (no optional `listVaults`/`ping`/`tx`),
- * so `Noydb.listAccessibleVaults()` throws its documented capability error
- * rather than enumerating vaults under the default store.
- */
-declare function memoryStore(): NoydbStore;
-
-/**
- * Store router / multiplexer.
- *
- * Dispatches `NoydbStore` operations to different backends based on
- * collection type, record size, record age, collection name, or vault name.
- *
- * ```ts
- * const db = await createNoydb({
- *   store: routeStore({
- *     default: dynamo({ table: 'myapp' }),
- *     blobs: s3Store({ bucket: 'myapp-blobs' }),
- *   }),
- * })
+ * Passphrase
+ *   └─► PBKDF2-SHA256 (600K iterations) → KEK  [memory only]
+ *         └─► AES-KW unwrap → DEK per collection  [memory only]
+ *               └─► AES-256-GCM encrypt/decrypt
+ *                     └─► NoydbStore  [sees only ciphertext envelopes]
  * ```
  *
- * @module
- */
-
-/**
- * Size-tiered blob routing configuration.
- *
- * Routes blob chunks to different stores based on byte size. Small blobs
- * (under `threshold`) stay in the primary or `small` store; large blobs
- * go to `large`. This lets you keep DynamoDB as the default while sending
- * large binary objects to S3.
- */
-interface BlobStoreRoute {
-    /** Store for small blobs (under threshold). Falls back to `default`. */
-    readonly small?: NoydbStore;
-    /** Store for large blobs (over threshold). */
-    readonly large: NoydbStore;
-    /** Size threshold in bytes. Default: `400 * 1024` (DynamoDB item limit). */
-    readonly threshold?: number;
-}
-/**
- * Blob lifecycle management policies evaluated during `compact()`.
- *
- * Controls orphan cleanup, cold-tier archival, and hard deletion of
- * blobs that are no longer referenced by any record.
- */
-interface BlobLifecyclePolicy {
-    /** Delete orphan blobs (refCount: 0) after this many days. Default: 7. */
-    readonly orphanRetentionDays?: number;
-    /** Move blobs not accessed in this many days to the cold blob store. */
-    readonly archiveAfterDays?: number;
-    /** Store for archived blobs. Required if archiveAfterDays is set. */
-    readonly archiveStore?: NoydbStore;
-    /** Hard-delete archived blobs after this many days. */
-    readonly expireAfterDays?: number;
-}
-/**
- * Age-based hot/cold tiering configuration.
- *
- * Records whose `_ts` timestamp is older than `coldAfterDays` are migrated
- * to the `cold` store during `compact()`. Reads transparently fall through
- * to the cold store when the hot store returns null, so callers don't need
- * to know which tier a record lives in.
- */
-interface AgeRoute {
-    /** Store for records older than the cutoff. */
-    readonly cold: NoydbStore;
-    /** Days after last modification before a record is cold-eligible. */
-    readonly coldAfterDays: number;
-    /**
-     * Collections that participate in age tiering.
-     * Empty array or omitted = all user collections (excluding `_` prefixed).
-     */
-    readonly collections?: string[];
-}
-/**
- * Options for `routeStore()` — the store multiplexer.
- *
- * At minimum, provide a `default` store. All other fields are optional
- * extensions for specific routing scenarios (blobs → S3, geographic sharding,
- * age-based tiering, etc.).
- */
-interface RouteStoreOptions {
-    /** Default store for all unmatched operations. */
-    readonly default: NoydbStore;
-    /**
-     * Route blob chunk data to a separate store.
-     * - Pass a `NoydbStore` for simple prefix routing (all chunks → that store).
-     * - Pass `{ small?, large, threshold? }` for size-tiered routing.
-     */
-    readonly blobs?: NoydbStore | BlobStoreRoute;
-    /** Route all blob metadata (index, slots, versions) to the blobs store too. Default: false. */
-    readonly routeBlobMeta?: boolean;
-    /** Route specific user collections to dedicated stores. */
-    readonly routes?: Record<string, NoydbStore>;
-    /** Route by vault name (prefix patterns, e.g. `'EU-'`). */
-    readonly vaultRoutes?: Record<string, NoydbStore>;
-    /**
-     * Age-based tiering: records older than `coldAfterDays` are read from
-     * the cold store. A background `compact()` method migrates them.
-     */
-    readonly age?: AgeRoute;
-    /**
-     * Content-aware blob routing.
-     * Route blob chunks by MIME type glob pattern. The MIME type is stored
-     * in `BlobObject` and matched at read time via `storeHint`.
-     */
-    readonly blobRoutes?: Record<string, NoydbStore>;
-    /**
-     * Blob lifecycle policies.
-     * Evaluated during `compact()`.
-     */
-    readonly blobLifecycle?: BlobLifecyclePolicy;
-    /**
-     * Quota-aware overflow.
-     * When the default store's usage exceeds the threshold, new writes
-     * overflow to the specified store.
-     */
-    readonly overflow?: NoydbStore;
-    /**
-     * Quota threshold (0-1). Default: 0.8 (overflow at 80% usage).
-     * Only effective when `overflow` is set.
-     */
-    readonly quotaThreshold?: number;
-}
-/**
- * Named route that can be overridden or suspended at runtime.
- *
- * Built-in names: `'default'`, `'blobs'`, `'cold'`.
- * Custom names: any collection name from `routes`, any vault prefix from
- * `vaultRoutes`, or any sync target label.
- */
-type OverrideTarget = 'default' | 'blobs' | 'cold' | (string & {});
-/**
- * Options for `RoutedNoydbStore.override()`.
- *
- * Controls whether the new store is pre-populated with data from the
- * original store before the switch takes effect.
- */
-interface OverrideOptions {
-    /**
-     * Hydrate the override store from the original before activating.
-     * - `true` — copy all data for all vaults.
-     * - `string[]` — copy only named collections.
-     * Makes `override()` async — returns a Promise.
-     */
-    hydrate?: boolean | string[];
-}
-/**
- * Options for `RoutedNoydbStore.suspend()`.
- *
- * A suspended route becomes a null store: reads return null/[], writes
- * are dropped (or buffered if `queue: true`). Useful for maintenance
- * windows or restricted-network scenarios.
- */
-interface SuspendOptions {
-    /**
-     * Buffer write operations during suspension. On `resume()`, queued
-     * writes are replayed against the restored store.
-     */
-    queue?: boolean;
-    /**
-     * Maximum queued operations. When exceeded, oldest entries are dropped.
-     * Default: 10_000.
-     */
-    maxQueueSize?: number;
-}
-/**
- * Snapshot of the current override and suspend state of a `RoutedNoydbStore`.
- * Returned by `routeStatus()` for diagnostics and health dashboards.
- */
-interface RouteStatus {
-    /** Active overrides: route name → override store name. */
-    readonly overrides: Record<string, string>;
-    /** Currently suspended routes. */
-    readonly suspended: string[];
-    /** Queued writes per suspended route (only for routes suspended with `queue: true`). */
-    readonly queued: Record<string, number>;
-}
-/**
- * Extended `NoydbStore` returned by `routeStore()`.
- *
- * Satisfies the full `NoydbStore` contract plus adds runtime control
- * methods for overriding, suspending, and inspecting routes.
- */
-interface RoutedNoydbStore extends NoydbStore {
-    /**
-     * Migrate records older than the age cutoff from the hot store to the
-     * cold store. Only applies when `age` is configured. Returns the number
-     * of records migrated.
-     */
-    compact(vault: string): Promise<number>;
-    /**
-     * Override a named route at runtime.
-     *
-     * The override persists until `clearOverride()` is called or the
-     * instance is closed. In-flight operations complete on the original
-     * store; new operations use the override.
-     *
-     * Options:
-     * - `hydrate: true` — async: copies all data from the original store
-     *   into the override before activating the switch.
-     * - `hydrate: ['invoices', 'clients']` — copies only named collections.
-     *
-     * Use cases:
-     * - Shared device: `await store.override('default', memory(), { hydrate: true })`
-     * - Restricted network: `store.override('blobs', localFile(...))`
-     */
-    override(route: OverrideTarget, store: NoydbStore, opts?: OverrideOptions): void | Promise<void>;
-    /** Clear a runtime override, reverting to the original store. */
-    clearOverride(route: OverrideTarget): void;
-    /**
-     * Suspend a route entirely. Operations to suspended stores become
-     * no-ops (puts silently dropped, gets return null, lists return []).
-     *
-     * Options:
-     * - `queue: true` — buffer write operations (put/delete) during
-     *   suspension. When `resume()` is called, queued writes are replayed
-     *   against the restored store.
-     *
-     * Returns a `SuspendHandle` when `queue: true`, for inspecting queue state.
-     */
-    suspend(route: OverrideTarget, opts?: SuspendOptions): void;
-    /**
-     * Resume a previously suspended route.
-     * If the route was suspended with `queue: true`, replays queued writes.
-     * Returns the number of replayed operations.
-     */
-    resume(route: OverrideTarget): Promise<number>;
-    /** Snapshot the current override/suspend state for diagnostics. */
-    routeStatus(): RouteStatus;
-    /**
-     * Resolve the physical backend a vault id maps to via the geographic
-     * `vaultRoutes` prefix routing (collection-independent), falling back to
-     * the `default` store. Used by the federation data-residency guard
-     * to read the placement backend's `capabilities.region`.
-     */
-    resolveBackend(vaultId: string): NoydbStore;
-}
-/**
- * Create a store multiplexer that dispatches operations to different backends
- * based on collection type, record size, record age, vault prefix, or
- * runtime overrides.
- *
- * ```ts
- * const store = routeStore({
- *   default: dynamo({ table: 'myapp' }),
- *   blobs: s3({ bucket: 'myapp-blobs' }),
- *   routes: { auditLog: s3({ bucket: 'myapp-audit' }) },
- * })
- * ```
- *
- * The returned store satisfies `NoydbStore` and can be passed directly to
- * `createNoydb({ store })`. It also exposes additional methods
- * (`override`, `suspend`, `resume`, `routeStatus`, `compact`) for runtime
- * control and maintenance.
- */
-declare function routeStore(opts: RouteStoreOptions): RoutedNoydbStore;
-
-/**
- * Store middleware — composable interceptors for NoydbStore.
+ * ## Getting started
  *
  * ```ts
- * const resilient = wrapStore(
- *   dynamo({ table: 'myapp' }),
- *   withRetry({ maxRetries: 3 }),
- *   withLogging({ level: 'debug' }),
- *   withCache({ ttlMs: 60_000 }),
- * )
- * ```
- *
- * Each middleware is `(next: NoydbStore) => NoydbStore`. They compose
- * left-to-right: first middleware is outermost (processes requests first,
- * responses last).
+ * import { createNoydb } from '@noy-db/hub'
+ * import { jsonFile } from '@noy-db/to-file'
  *
- * @module
- */
-
-/**
- * A store middleware function.
+ * const db = await createNoydb({ store: jsonFile({ dir: './data' }) })
+ * const acme = await db.openVault('acme', { passphrase: 'hunter2' })
+ * const invoices = acme.collection<Invoice>('invoices')
  *
- * Takes the next store in the chain and returns a wrapped store. Middlewares
- * compose left-to-right via `wrapStore()`: the first argument is outermost
- * (first to intercept requests, last to process responses).
- *
- * ```ts
- * const mw: StoreMiddleware = (next) => ({
- *   ...next,
- *   async get(vault, collection, id) {
- *     console.log('get', id)
- *     return next.get(vault, collection, id)
- *   },
- * })
+ * await invoices.put('inv-001', { amount: 1200, client: 'Acme Corp' })
+ * const all = await invoices.query().toArray()
  * ```
- */
-type StoreMiddleware = (next: NoydbStore) => NoydbStore;
-/**
- * Wrap a store with one or more middlewares. Middlewares compose left-to-right.
- */
-declare function wrapStore(store: NoydbStore, ...middlewares: StoreMiddleware[]): NoydbStore;
-/** Options for `withRetry()`. */
-interface RetryOptions {
-    /** Maximum retry attempts. Default: 3. */
-    maxRetries?: number;
-    /** Base backoff delay in ms. Default: 500. */
-    backoffMs?: number;
-    /** Jitter factor (0-1). Adds random delay up to `backoffMs * jitter`. Default: 0.3. */
-    jitter?: number;
-    /** Only retry on these error codes. Default: retry all errors. */
-    retryOn?: string[];
-}
-/**
- * Middleware that retries failed store operations with exponential backoff
- * and optional jitter. Useful for transient network errors on DynamoDB/S3.
- *
- * ```ts
- * wrapStore(dynamo({ table: 'myapp' }), withRetry({ maxRetries: 5, retryOn: ['NETWORK_ERROR'] }))
- * ```
- */
-declare function withRetry(opts?: RetryOptions): StoreMiddleware;
-/** Log level for `withLogging()`. Maps to standard console method names. */
-type LogLevel = 'debug' | 'info' | 'warn' | 'error';
-/** Options for `withLogging()`. */
-interface LoggingOptions {
-    /** Minimum log level. Default: 'info'. */
-    level?: LogLevel;
-    /** Custom logger. Default: console. */
-    logger?: {
-        debug(msg: string, ...args: unknown[]): void;
-        info(msg: string, ...args: unknown[]): void;
-        warn(msg: string, ...args: unknown[]): void;
-        error(msg: string, ...args: unknown[]): void;
-    };
-    /** Log the data payload (envelope contents). Default: false (privacy). */
-    logData?: boolean;
-}
-/**
- * Middleware that logs every store operation with its method name, arguments,
- * and elapsed duration. Privacy-safe by default: envelope payloads are not
- * logged unless `logData: true` is set.
- */
-declare function withLogging(opts?: LoggingOptions): StoreMiddleware;
-/**
- * Data emitted to `MetricsOptions.onOperation` after every store call.
- *
- * Carries method name, vault/collection/id context, elapsed duration,
- * and success/failure status. Wire this into your metrics pipeline
- * (DataDog, Prometheus, CloudWatch) to get per-operation latency histograms.
- */
-interface StoreOperation {
-    method: 'get' | 'put' | 'delete' | 'list' | 'loadAll' | 'saveAll';
-    vault: string;
-    collection?: string;
-    id?: string;
-    durationMs: number;
-    success: boolean;
-    error?: Error;
-}
-/** Options for `withMetrics()`. */
-interface MetricsOptions {
-    /** Called after every store operation. */
-    onOperation: (op: StoreOperation) => void;
-}
-/**
- * Middleware that calls `onOperation` after every store method with timing
- * and success/failure data. Designed for low-overhead integration with
- * metrics systems — the callback is synchronous and fire-and-forget.
- */
-declare function withMetrics(opts: MetricsOptions): StoreMiddleware;
-/**
- * Options for `withCircuitBreaker()`.
- *
- * The circuit breaker moves through three states:
- * - `closed`: normal operation.
- * - `open`: store is failing; all calls return fallback values immediately.
- * - `half-open`: one probe call after `resetTimeoutMs` — success closes, failure re-opens.
- */
-interface CircuitBreakerOptions {
-    /** Number of consecutive failures before opening the circuit. Default: 5. */
-    failureThreshold?: number;
-    /** Time in ms before attempting to half-open the circuit. Default: 30_000. */
-    resetTimeoutMs?: number;
-    /** Called when the circuit opens (store becomes unavailable). */
-    onOpen?: () => void;
-    /** Called when the circuit closes (store recovers). */
-    onClose?: () => void;
-}
-/**
- * Middleware that implements the circuit-breaker pattern.
- *
- * When the wrapped store fails `failureThreshold` consecutive times, the
- * circuit opens: subsequent calls return safe fallback values (`null`, `[]`,
- * `{}`) without hitting the store. After `resetTimeoutMs` the circuit
- * half-opens and allows one probe — success closes the circuit, failure
- * keeps it open. Pair with `withRetry` to handle transient errors before
- * they trip the circuit.
- */
-declare function withCircuitBreaker(opts?: CircuitBreakerOptions): StoreMiddleware;
-/**
- * Options for `withCache()`.
- *
- * The cache is a read-through LRU that caches individual record fetches
- * (`get`). Writes (`put`, `delete`) invalidate the relevant cache entry
- * immediately. `list`, `loadAll`, and `saveAll` bypass the cache.
- *
- * Named `StoreCacheOptions` to distinguish from `CacheOptions` in
- * `@noy-db/hub/collection`, which controls the in-memory decrypted-record LRU.
- */
-interface StoreCacheOptions {
-    /** Maximum cached entries. Default: 500. */
-    maxEntries?: number;
-    /** Cache TTL in ms. Default: 60_000 (1 minute). 0 = no expiry. */
-    ttlMs?: number;
-}
-/**
- * Middleware that adds a read-through LRU cache for `get()` calls.
- *
- * Reduces latency for frequently-read records (e.g. lookup tables, user
- * profiles) by serving repeat reads from memory. Because NOYDB records are
- * encrypted at rest, caching envelopes is safe — the cache holds ciphertext,
- * not plaintext. For write-heavy workloads, the cache provides little benefit
- * and should be omitted to avoid the invalidation overhead.
- */
-declare function withCache(opts?: StoreCacheOptions): StoreMiddleware;
-interface HealthCheckOptions {
-    /** Ping interval in ms. Default: 30_000. */
-    checkIntervalMs?: number;
-    /** Suspend after N consecutive ping failures. Default: 3. */
-    suspendAfterFailures?: number;
-    /** Resume after N consecutive ping successes. Default: 1. */
-    resumeAfterSuccess?: number;
-    /** Called when the store is auto-suspended. */
-    onSuspend?: () => void;
-    /** Called when the store is auto-resumed. */
-    onResume?: () => void;
-    /**
-     * Custom health check. Default: calls `store.ping()` if available,
-     * otherwise attempts a `list()` on a sentinel collection.
-     */
-    check?: () => Promise<boolean>;
-}
-/**
- * Auto-suspends a store when health checks fail, auto-resumes when they recover.
- *
- * When suspended, `get` returns null, `put`/`delete` are no-ops, `list` returns [].
- * This is identical to the `NullStore` behavior from `routeStore.suspend()`.
- */
-declare function withHealthCheck(opts?: HealthCheckOptions): StoreMiddleware;
-
-/**
- * Derive a {@link PersistedSchemaEnvelope} from a Standard Schema v1
- * validator. Supports zod 3 (via the optional `zod-to-json-schema` peer-dep)
- * and zod 4 (via its native `z.toJSONSchema()`); both are loaded lazily so
- * hub never statically imports zod. Other validator families write a stub
- * envelope flagging the kind.
- *
- * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
- *
- * @module
- */
-
-/**
- * Heuristic Zod detection — uses the Standard Schema v1 `~standard.vendor`
- * property (present in Zod v3.23+ and Zod v4+). Falls back to the
- * `_def.typeName` heuristic for older Zod v3 builds that predate Standard
- * Schema support.
- */
-declare function isZodSchema(value: unknown): boolean;
-declare function derivePersistedSchema(validator: unknown): Promise<PersistedSchemaEnvelope>;
-
-/**
- * Read / write the per-collection persisted-schema envelope. Mirrors the
- * standard noy-db record envelope shape and is **AES-GCM encrypted with
- * the collection's DEK** — the schema body (field names, enum values,
- * constraints) is sensitive metadata, so it gets the same encryption
- * envelope as the records it describes.
- *
- * Storage layout:
- *
- *   <vault>/_schemas/<collection>   →   EncryptedEnvelope
- *
- * The DEK passed to {@link savePersistedSchema} / {@link loadPersistedSchema}
- * is the same key the collection uses for its records.
- *
- * @module
- */
-
-/** Reserved collection name where persisted schemas live. */
-declare const SCHEMAS_COLLECTION: "_schemas";
-/**
- * Read and decrypt the persisted-schema envelope for one collection.
- * Returns `undefined` when no envelope has been written or when decryption
- * fails (e.g. wrong DEK passed). Tolerates corrupted records — JSON parse
- * failures surface as `undefined`, mirroring `_meta/handle`'s contract.
- */
-declare function loadPersistedSchema(store: NoydbStore, vault: string, collection: string, dek: EnclaveKey): Promise<PersistedSchemaEnvelope | undefined>;
-/**
- * Encrypt and persist a schema envelope for one collection. Always
- * overwrites any prior write (callers gate on hash equality before calling
- * to avoid no-op writes).
- */
-declare function savePersistedSchema(store: NoydbStore, vault: string, collection: string, dek: EnclaveKey, payload: PersistedSchemaEnvelope): Promise<void>;
-
-/**
- * Orchestrate the derive → hash → skip-or-write cycle for a collection's
- * persisted JSON Schema. Called by the Vault at collection-registration
- * time when the developer opts in via `collection({ persistJsonSchema:
- * true })`.
- *
- * Skip semantics:
- *
- *   - Zod validators: skip when the new hash equals the stored hash.
- *   - Non-Zod (stub envelopes have hash=null): skip when the stored
- *     envelope's `kind` matches the freshly-detected kind (since there's
- *     no body to compare yet — a kind change is the only signal).
- *
- * @module
- */
-
-interface PersistSchemaResult {
-    /** True when a fresh envelope was written to storage. */
-    readonly written: boolean;
-    /** True when an existing envelope matched and the write was skipped. */
-    readonly skipped: boolean;
-    /** The envelope that was either written or matched. */
-    readonly envelope: PersistedSchemaEnvelope;
-    /** The update-strategy decision, present when strategies ran. */
-    readonly decision?: UpdateDecision;
-}
-declare function persistSchemaIfNeeded(opts: {
-    readonly store: NoydbStore;
-    readonly vault: string;
-    readonly collectionName: string;
-    readonly validator: unknown;
-    readonly dek: EnclaveKey;
-    readonly strategies?: readonly SchemaUpdateStrategy[];
-}): Promise<PersistSchemaResult>;
-
-/**
- * Persistence helpers for `_meta/public-envelope`. Mirrors the
- * bypass-AES pattern used by `_meta/handle` and `_meta/policy` —
- * the document is plaintext JSON, the envelope's `_iv` field is
- * left empty.
- *
- * @module
- */
-
-/** Reserved id for the vault-level public envelope record. */
-declare const PUBLIC_ENVELOPE_RECORD_ID = "public-envelope";
-/**
- * Read the public envelope from `_meta/public-envelope`. Returns
- * `undefined` when no envelope has been persisted (fresh vault, or
- * a vault written before the feature was enabled). Tolerates
- * corrupted documents — a JSON parse failure surfaces as `undefined`,
- * not a thrown error, mirroring `_meta/handle`'s contract.
- */
-declare function loadPublicEnvelope(store: NoydbStore, vault: string): Promise<PublicEnvelope | undefined>;
-/** Persist the public envelope. Idempotent — overwrites any prior write. */
-declare function savePublicEnvelope(store: NoydbStore, vault: string, envelope: PublicEnvelope): Promise<void>;
-/**
- * Public, no-key reader. Plain function, not a method on `Noydb` —
- * the whole point is it works without an authenticated session, so
- * a UI can show "Acme 2026 Tax Records" before unlocking.
  *
- * Resolves any `name` / `description` locale map through the supplied
- * `locale` (when provided). Omitting `locale` returns the raw
- * envelope, which a multilingual picker can render as it pleases.
- */
-declare function readPublicEnvelope(store: NoydbStore, vault: string, opts?: {
-    readonly locale?: string;
-}): Promise<PublicEnvelope | undefined>;
-
-/**
- * Persistence helpers for per-principal user envelopes stored at
- * `_users/<keyringId>` (logically: `_meta/user/<keyringId>`).
- *
- * Unlike `_meta/policy` and `_meta/handle` which are plaintext, user
- * envelopes carry user data and are encrypted with a dedicated
- * {@link USER_ENVELOPE_COLLECTION} DEK (provisioned at vault open and
- * propagated to every keyring via the system-collection DEK path in
- * `team/keyring.ts`).
- *
- * This module is the **storage primitive** layer. The public API
- * (`vault.user.*`) sits on top of this; permission gates, own-only
- * write enforcement, and presence-channel propagation live there.
- *
- * @see docs/superpowers/specs/2026-05-05-user-envelope-design.md
- *
- * @module
- */
-
-/**
- * Read and decrypt the user envelope for `keyringId`. Returns `null`
- * when no envelope has been persisted (either the principal has never
- * called `updateMe`, or the keyring predates this feature).
- *
- * Decryption errors propagate — a tampered or wrong-keyed envelope
- * surfaces as the underlying crypto error rather than masquerading as
- * "not found".
- */
-declare function loadUserEnvelope<T = unknown>(store: NoydbStore, vault: string, keyringId: string, dek: EnclaveKey): Promise<UserEnvelope<T> | null>;
-/**
- * Encrypt and persist the user envelope for `keyringId`. The new
- * version is `(prior._v ?? 0) + 1`. Pass `expectedVersion` to enable
- * optimistic-concurrency checks: a mismatch with the stored version
- * throws {@link ConflictError} with the actual stored version.
- *
- * `expectedVersion: 0` means "expect no prior envelope"; the write
- * succeeds only if no envelope exists yet.
- *
- * Soft-caps the JSON-serialized payload at {@link USER_ENVELOPE_MAX_BYTES};
- * larger payloads throw {@link UserEnvelopeOversizedError}.
- */
-declare function saveUserEnvelope<T>(store: NoydbStore, vault: string, keyringId: string, payload: T, dek: EnclaveKey, expectedVersion?: number): Promise<UserEnvelope<T>>;
-/**
- * Delete the user envelope for `keyringId`. Idempotent — no error if
- * the envelope is already absent. Called from the keyring revoke path
- * (cascade-delete) and is a no-op for keyrings that never wrote.
- */
-declare function deleteUserEnvelope(store: NoydbStore, vault: string, keyringId: string): Promise<void>;
-/**
- * List the keyring ids that have a user envelope persisted in `vault`.
- * Order is store-defined — callers that need a stable order should sort.
- */
-declare function listUserEnvelopeIds(store: NoydbStore, vault: string): Promise<string[]>;
-
-/**
- * Type surface for the user-list visibility service.
- *
- * Two complementary flags:
- *  - {@link DirectoryConfig} — vault-level "is the directory listing
- *    enabled at all?" toggle. Owner-only mutation.
- *  - {@link UserVisibility} — per-user "hide me from teammate listings"
- *    opt-out. Self-mutation via `vault.user.setMyVisibility`.
- *
- * Both flags live in the existing `_meta` collection as plaintext-bypass
- * sidecars (`_iv: ''`). Neither is a security boundary — the keyring
- * file is still observable at `_keyring/*` and the envelope ciphertext
- * is still at `_users/*` to anyone with direct store read access. The
- * flags exist to keep admin-UI listings tidy, not to hide principals
- * from a determined attacker.
- *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility
- *
- * @module
- */
-/**
- * Vault-level directory toggle. Persisted at `_meta/directory`.
- *
- * - `enabled: true` (default when no document exists) — every authenticated
- *   caller can enumerate users via `listUsersWithEnvelopes`.
- * - `enabled: false` — only `owner` and `admin` callers can enumerate;
- *   anyone else gets {@link import('../../kernel/errors.js').DirectoryDisabledError}.
- */
-interface DirectoryConfig {
-    readonly enabled: boolean;
-}
-/**
- * Per-user visibility flag. Persisted at `_meta/visibility/<keyringId>`.
- *
- * - `hidden: false` (default when no document exists) — the user shows up
- *   in `listUsersWithEnvelopes` like any other principal.
- * - `hidden: true` — the user is filtered out of the default listing.
- *   `owner`/`admin` callers can still see them by passing
- *   `{ includeHidden: true }`.
- */
-interface UserVisibility {
-    readonly hidden: boolean;
-}
-
-/**
- * Implementation behind `vault.user`. Constructed once per Vault via
- * {@link createUserApi}, holds the writer's keyringId in closure so
- * `updateMe`/`setMe` cannot target any other principal — the own-only
- * rule is enforced at the type level (no `set(otherKeyringId, …)`
- * method) AND at runtime (the keyringId argument simply doesn't exist
- * on the write path).
- */
-declare class UserApi implements VaultUserApi {
-    /** keyringId → set of listeners. Wildcard '*' fires on every change. */
-    private readonly listeners;
-    private readonly adapter;
-    private readonly vaultName;
-    /** The writer's own keyringId. Frozen at construction time. */
-    private readonly writerKeyringId;
-    private readonly getDek;
-    /**
-     * Policy-gate validator. When omitted, gates are skipped — useful
-     * for low-level tests that exercise the storage layer directly.
-     * Production paths always wire the Noydb-backed implementation.
-     */
-    private readonly checkGate?;
-    /**
-     * Noydb-backed `exportMyAccessibleData`, injected by the Vault
-     * (which holds the keyring + bundle machinery). Omitted in low-level tests.
-     */
-    private readonly exportAccessible?;
-    /**
-     * Noydb-backed `unilateralWithdrawal`, injected by the Vault.
-     * Destructive — extract + dispose (delete | freeze). Omitted in low-level tests.
-     */
-    private readonly unilateralWithdraw?;
-    /**
-     * Noydb-backed two-party withdrawal ceremony, injected by the
-     * Vault. requestWithdraw = requester side; the rest = owner side.
-     */
-    private readonly requestWithdraw?;
-    private readonly listWithdrawals?;
-    private readonly approveWithdraw?;
-    private readonly rejectWithdraw?;
-    constructor(deps: UserApiDeps);
-    /**
-     * File a two-party withdrawal request for the caller's accessible
-     * scope. Non-destructive (writes a pending request); an owner later approves
-     * or rejects. This is the path for read-only roles (`client`/`viewer`) that
-     * cannot self-serve a destructive `unilateralWithdrawal`. Gated by
-     * `user-request-withdrawal` (enabled by default).
-     */
-    requestWithdrawal(opts?: RequestWithdrawalOptions): Promise<RequestWithdrawalResult>;
-    /** Owner side: list filed withdrawal requests (optionally by status). */
-    listWithdrawalRequests(opts?: {
-        status?: WithdrawalRequestStatus;
-    }): Promise<WithdrawalRequest[]>;
-    /**
-     * Owner side: approve a pending request. Extracts the requester's
-     * recorded scope under firm authority, disposes of the source per the
-     * request's disposition, and returns the re-keyed bundle to hand back. Gated
-     * by `approve-user-withdrawal` (tier-2 default) + owner/admin role.
-     */
-    approveWithdrawal(requestId: string, opts?: ApproveWithdrawalOptions): Promise<WithdrawResult>;
-    /** Owner side: reject a pending request (no data is touched). */
-    rejectWithdrawal(requestId: string, opts?: RejectWithdrawalOptions): Promise<WithdrawalRequest>;
-    /**
-     * Single-party withdrawal: export the caller's accessible scope
-     * (re-keyed) and dispose of the source (`delete` or `freeze`). Gated by the
-     * fail-closed built-in `client-unilateral-withdraw` policy — undefined or
-     * disabled → throws (use `requestWithdrawal`). The firm enables it at vault
-     * creation.
-     */
-    unilateralWithdrawal(opts: WithdrawAccessibleOptions): Promise<WithdrawResult>;
-    /**
-     * Export the calling user's accessible scope as a portable, re-keyed
-     * `.noydb` bundle. Non-destructive and **always allowed** (data sovereignty
-     * by construction) but audited. Scope = the caller's DEK access set.
-     */
-    exportMyAccessibleData(opts?: ExportAccessibleOptions): Promise<Uint8Array>;
-    /** Read the writer's own envelope. Returns null if never written. */
-    me<T = unknown>(): Promise<UserEnvelope<T> | null>;
-    /**
-     * Deep-merge a partial patch into the writer's own envelope. Creates
-     * the envelope on first call. Optimistic-concurrency safe — a stale
-     * `_v` (parallel writer on another device) throws `ConflictError`.
-     *
-     * Patch semantics:
-     *   - `undefined` (or omitted key) — skip; existing value preserved
-     *   - `null` — delete the field from the merged result
-     *   - any other value — overwrite (deep-merge for plain objects,
-     *     replace for primitives / arrays)
-     *
-     * To clear a field, pass `null` rather than `undefined`. Callers
-     * with shape `T = string | null` where `null` is a meaningful value
-     * should use `setMe` for that specific field instead — `null` here
-     * always means delete.
-     *
-     * Gated by the `edit-own-profile` policy gate (default `minTier: 3`).
-     * Pass `presented` to satisfy tightened policies that require a
-     * factor proof (e.g. STRICT_POLICY's TOTP requirement).
-     */
-    updateMe<T extends object = Record<string, unknown>>(patch: DeepPartialOrNull<T>, presented?: UserEnvelopePresented): Promise<UserEnvelope<T>>;
-    /**
-     * Replace the writer's own envelope with `payload`. Use sparingly —
-     * `updateMe` is the canonical mutation. No `expectedVersion` check;
-     * callers explicitly take last-write-wins semantics.
-     *
-     * Gated by `edit-own-profile`. See `updateMe` for `presented` usage.
-     */
-    setMe<T = unknown>(payload: T, presented?: UserEnvelopePresented): Promise<UserEnvelope<T>>;
-    /**
-     * Read the current user's visibility flag from
-     * `_meta/visibility/<keyringId>`. Returns `{ hidden: false }` when no
-     * document has been persisted (the default-visible case).
-     */
-    getMyVisibility(): Promise<UserVisibility>;
-    /**
-     * Update the current user's visibility in the team directory.
-     *
-     * - `hidden: true` — opt out of the default `listUsersWithEnvelopes`
-     *   listing. `owner`/`admin` callers can still see the user by passing
-     *   `{ includeHidden: true }`.
-     * - `hidden: false` — opt back in.
-     *
-     * Own-only by construction: the keyringId argument doesn't exist on
-     * this method, so no caller can hide or unhide another principal.
-     *
-     * Honest caveat: this is a UX flag, not a privacy guarantee. The
-     * envelope ciphertext at `_users/<keyringId>` and the keyring file at
-     * `_keyring/<userId>` are both still observable to anyone with direct
-     * store read access. See `https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md` →
-     * "Directory visibility".
-     */
-    setMyVisibility(visibility: UserVisibility): Promise<void>;
-    /**
-     * Read another principal's envelope by their keyringId. Returns null
-     * if the principal exists but has no envelope yet, or if the
-     * keyringId does not exist at all.
-     *
-     * Gated by `view-team-profiles` (default `minTier: 2`) — but ONLY for
-     * cross-principal reads. Reading your own envelope (`keyringId ===
-     * self`) is never gated; that's just `me()` written long-form.
-     */
-    get<T = unknown>(keyringId: string, presented?: UserEnvelopePresented): Promise<UserEnvelope<T> | null>;
-    /**
-     * Read every persisted envelope in the vault. Order is store-defined.
-     *
-     * Gated by `view-team-profiles`. Default policy (`minTier: 2`) lets
-     * any authenticated session read all envelopes. Two privacy-strict
-     * opt-outs:
-     *
-     *  - `view-team-profiles.enabled: false` → list() returns only the
-     *    caller's own envelope (silent self-fallback, no thrown error).
-     *  - `view-team-profiles.minTier: 1` + insufficient tier → throws
-     *    `PolicyDeniedError` with `reason: 'insufficient-tier'`. The
-     *    caller is expected to elevate, not silently degrade.
-     *
-     * The asymmetry is deliberate: `enabled: false` is a deliberate
-     * design choice ("nobody sees teammate profiles in this app");
-     * `insufficient-tier` is "you need to authenticate further". Different
-     * UX prompts for different intents.
-     */
-    list<T = unknown>(presented?: UserEnvelopePresented): Promise<UserEnvelope<T>[]>;
-    /**
-     * Listen for changes to a specific keyringId's envelope. The callback
-     * fires synchronously after every successful local `updateMe` /
-     * `setMe` for that principal.
-     *
-     * Cross-instance changes (a teammate edits their profile on their
-     * device, the sync engine pulls the diff onto this device) will fire
-     * subscribers when the sync layer replays the write through this API.
-     * In v1, subscribers do NOT fire on raw store changes — wire your sync
-     * layer to call back through `vault.user.setMe` / `updateMe` if you
-     * need that.
-     *
-     * Pass keyringId `'*'` to fire on every change in the vault.
-     */
-    subscribe<T = unknown>(keyringId: string, cb: (env: UserEnvelope<T> | null) => void): Unsubscribe;
-    /**
-     * Reactive handle that caches the current value and re-reads on every
-     * change for the given keyringId. Convenient for framework bindings:
-     *
-     *   const live = vault.user.live<UserShape>(vault.userId)
-     *   live.subscribe(env => render(env?.data))
-     *
-     * Initial value is `null` until the first `current()` call materializes
-     * it via `vault.user.get()`. Call `stop()` when done to release the
-     * subscription.
-     */
-    live<T = unknown>(keyringId: string): LiveUserEnvelope<T>;
-    private fireChange;
-}
-
-/**
- * Authentication introspection.
- *
- * Three surfaces over the configured tier model and the actual
- * per-user enrollment state:
- *
- * 1. **Vault-wide English summary** — {@link describeAuthConfig}.
- * 2. **Vault-wide Mermaid diagram** — {@link diagramAuthConfig}.
- * 3. **Per-user introspection** — {@link describeUserAuth}, gated by
- *    the `view-user-auth` policy gate (off by default).
- *
- * The per-user surface is held to a strict allowlist — fields not on
- * the allowlist are dropped, never rendered. The negative test in
- * `auth-introspection.test.ts` exercises the allowlist by feeding a
- * contrived keyring with fake "secret" fields and asserting that none
- * of them appear in the output.
- *
- * @module
- */
-
-/** Vault-wide English summary of the configured authentication graph. */
-declare function describeAuthConfig(store: NoydbStore, vault: string): Promise<string>;
-/**
- * Render the vault's auth graph as Mermaid `flowchart TB` source. The
- * caller pipes this through Mermaid (CLI or browser) to get an SVG.
- */
-declare function diagramAuthConfig(store: NoydbStore, vault: string): Promise<string>;
-/**
- * Render the per-user enrollment summary. Returns an empty
- * (non-throwing) string when the user has no keyring file — never
- * confirms or denies the existence of the user from the document
- * alone.
- *
- * Sanitization is strict: only the slot list, enrollment dates, and
- * recovery-profile counts are rendered. WebAuthn cred ids, OIDC
- * subject ids, password hashes, recovery codes, TOTP secrets — all
- * dropped at the allowlist boundary, not redacted.
- */
-declare function describeUserAuth(store: NoydbStore, vault: string, userId: string): Promise<string>;
-/** Bulk variant for owner dashboards. */
-declare function describeAllUsersAuth(store: NoydbStore, vault: string): Promise<Array<{
-    userId: string;
-    description: string;
-}>>;
-
-/**
- * Persistence helpers for the vault-level user-directory toggle
- * (`_meta/directory`). Mirrors the bypass-AES pattern used by
- * `_meta/policy` — the directory document is plain JSON, the
- * envelope's `_iv` field is left empty.
- *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/plaintext-bypass.md — every `_iv: ''` write site
- *
- * @module
- */
-
-/** Reserved id for the vault-level directory document. */
-declare const DIRECTORY_RECORD_ID = "directory";
-/**
- * Read the directory toggle from `_meta/directory`. Returns `undefined`
- * when no document has been persisted — callers treat that as the
- * default-on case (`{ enabled: true }`).
- *
- * Tolerates corrupted documents the same way `_meta/policy` does: a
- * JSON parse failure surfaces as `undefined`, not a thrown error, so a
- * bad write never permanently breaks team enumeration.
- */
-declare function readDirectoryConfig(store: NoydbStore, vault: string): Promise<DirectoryConfig | undefined>;
-/**
- * Persist the directory toggle at `_meta/directory`. Idempotent — call
- * on every `db.setDirectoryEnabled()` invocation. Owner-only at the
- * caller site; this primitive does not check roles.
- */
-declare function persistDirectoryConfig(store: NoydbStore, vault: string, config: DirectoryConfig): Promise<void>;
-
-/**
- * Persistence helpers for the per-user visibility flag
- * (`_meta/visibility/<keyringId>`). Mirrors the bypass-AES pattern used
- * by `_meta/policy` — the visibility document is plain JSON, the
- * envelope's `_iv` field is left empty.
- *
- * Stored alongside the keyring file rather than inside the encrypted
- * user envelope (`_users/<keyringId>`) because:
- *
- *  - `UserEnvelope<T>.data` is opaque-to-hub by contract — hub does not
- *    introspect or reserve any keys inside it. Adding `hidden` there
- *    would violate that contract.
- *  - `listUsersWithEnvelopes` filters by the flag, and the filter must
- *    work even when decryption fails (legacy keyrings predating the
- *    envelope feature, or a corrupted envelope).
- *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/user-envelope.md → Directory visibility
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/plaintext-bypass.md — every `_iv: ''` write site
- *
- * @module
- */
-
-/** Prefix for per-user visibility records inside `_meta`. */
-declare const VISIBILITY_RECORD_PREFIX = "visibility/";
-/** Compose the `_meta` record id for a keyring's visibility doc. */
-declare function visibilityRecordId(keyringId: string): string;
-/**
- * Read the visibility flag for `keyringId`. Returns `undefined` when no
- * document has been persisted — callers treat that as the default-visible
- * case (`{ hidden: false }`).
- */
-declare function readUserVisibility(store: NoydbStore, vault: string, keyringId: string): Promise<UserVisibility | undefined>;
-/**
- * Persist the visibility flag for `keyringId` at
- * `_meta/visibility/<keyringId>`. Idempotent — call on every
- * `vault.user.setMyVisibility()` invocation. Own-only at the caller
- * site; this primitive does not enforce keyring ownership.
- */
-declare function persistUserVisibility(store: NoydbStore, vault: string, keyringId: string, visibility: UserVisibility): Promise<void>;
-/**
- * Delete the visibility flag for `keyringId`. Called from `revoke()`
- * alongside `deleteUserEnvelope` so the sidecar does not leak to a
- * re-granted principal with the same `userId`. Idempotent — the store's
- * `delete()` is already a no-op when the record is absent.
- */
-declare function deleteUserVisibility(store: NoydbStore, vault: string, keyringId: string): Promise<void>;
-
-/**
- * Return the ISO-4217 minor-unit scale for a currency code, or `null`
- * when the code is not in the known set (caller must supply an explicit
- * scale).
- */
-declare function scaleForCurrency(code: string): number | null;
-
-/**
- * Money-aware aggregation: exact `sum` / `min` / `max` over money
- * fields.
- *
- * The generic reducers (`aggregate/reducers.ts`) read a field via
- * `readNumber`, which coerces a string (the stored scaled-integer form
- * of money, e.g. `'12345'`) to `0` — so an un-wrapped money `sum` would
- * silently return zero. {@link wrapMoneyReducers} rewrites any `sum` /
- * `min` / `max` over a declared money field into a reducer that
- * accumulates per-currency `BigInt` totals of the stored integers, so
- * the result is exact for any magnitude (past `Number.MAX_SAFE_INTEGER`
- * included).
- *
- * Results are currency-aware and never silently mix currencies:
- *   - **fixed** mode → a single exact decimal string.
- *   - **multi** mode → an exact `Record<currency, string>` map.
- *   - **`sum` with `convertTo` + `fx`** → a single exact string, with
- *     each currency converted via BigInt arithmetic (no float).
- *
- * `remove()` is implemented for every money reducer so they participate
- * in incremental live-aggregation and materialized-view maintenance
- * exactly like the generic reducers they replace.
- */
-
-type FxRates = Record<string, number | string>;
-
-/**
- * Exact money arithmetic helpers — `mulRate` and `allocate`.
- *
- * Both operate on the canonical decoded string form that `get()`
- * returns (`'10000.00'`), entirely in scaled-`BigInt` space — no
- * floating-point step anywhere, exact past 2^53. They are pure
- * functions with no vault or descriptor dependency: the working scale
- * is inferred from the amount's fractional digits (a canonical money
- * string always carries exactly the field's scale) or pinned with
- * `opts.scale`.
- *
- * Why these two: app-side invariants of the form
- * `Σ parts === whole` (receipt totals, net-zero WHT pairs, proration)
- * carry ±0.01 tolerances ONLY because the math is major-unit floats +
- * round2. `mulRate` (VAT-style rate application with explicit
- * rounding) and `allocate` (largest-remainder split — parts sum to the
- * input EXACTLY, by construction) make those tolerances zero.
- */
-
-interface MulRateOptions {
-    /**
-     * Output scale (fraction digits). Defaults to the amount's own
-     * fractional digits — for a canonical money string that IS the
-     * field's scale.
-     */
-    readonly scale?: number;
-    /** Rounding for the final re-scale. Default `'half-up'`. */
-    readonly rounding?: RoundingMode;
-}
-interface AllocateOptions {
-    /** Working scale. Defaults to the amount's own fractional digits. */
-    readonly scale?: number;
-}
-/**
- * Multiply a money amount by a decimal rate, exactly.
- *
- * The rate is parsed at its OWN full precision (`0.07` → `7` at scale
- * 2), the product computed in `BigInt` at `amountScale + rateScale`,
- * then re-scaled back to the output scale with the requested rounding —
- * one rounding step, at the very end.
- *
- * ```ts
- * mulRate('10000.00', 0.07)                       // '700.00'  (VAT)
- * mulRate('33.33', '0.07')                        // '2.33'    (half-up)
- * mulRate('33.33', 0.07, { rounding: 'floor' })   // '2.33'
- * mulRate(100, 0.07, { scale: 2 })                // '7.00'
- * ```
- */
-declare function mulRate(amount: number | string, rate: number | string, opts?: MulRateOptions): string;
-/**
- * Split a money amount across weighted buckets with ZERO drift: the
- * returned parts sum to the input exactly, by construction
- * (largest-remainder method).
- *
- * Each bucket gets `floor(amount × weightᵢ / Σweights)`; the leftover
- * minor units (always fewer than the bucket count) go one each to the
- * buckets with the largest truncated remainders — ties broken by
- * position, earlier bucket first. Weights are parsed as exact decimals
- * (no float division anywhere); they must be non-negative with a
- * positive sum.
- *
- * ```ts
- * allocate('100.00', [1, 1, 1])   // ['33.34', '33.33', '33.33']
- * allocate('0.05', [3, 7])        // ['0.02', '0.03']
- * allocate('-100.00', [1, 1, 1])  // ['-33.34', '-33.33', '-33.33']
- * ```
- */
-declare function allocate(amount: number | string, weights: ReadonlyArray<number | string>, opts?: AllocateOptions): string[];
-
-/**
- * Hierarchical access — tier-aware keyring helpers.
- *
- * The keyring's existing `deks: Map<string, CryptoKey>` is keyed by
- * collection name. extends the key space:
- *
- *   `'invoices'`      — tier-0 DEK (unchanged from v0.x)
- *   `'invoices#1'`    — tier-1 DEK
- *   `'invoices#2'`    — tier-2 DEK
- *
- * Tier 0 keeps the bare collection name so any keyring written
- * before tiers existed loads without migration. Tiers ≥ 1 use `#N`
- * suffixes that
- * would be invalid as user-supplied collection names (see
- * `ReservedCollectionNameError` — `#` is reserved).
- *
- * @module
- */
-
-/** Canonical DEK key for a given collection + tier. Tier 0 → bare name. */
-declare function dekKey(collection: string, tier: number): string;
-/**
- * Returns the user's effective clearance for a given collection: the
- * maximum tier for which their keyring holds a DEK. Falls back to 0
- * when the user has only the tier-0 DEK (or none — the getDEK caller
- * will raise separately).
- */
-declare function effectiveClearance(keyring: UnlockedKeyring, collection: string): number;
-/**
- * Assert the caller is cleared for the requested tier. Owners and
- * admins always pass (they can mint any new tier DEK on demand);
- * other roles must already hold the tier DEK — via a prior grant or
- * an active delegation — otherwise this throws `TierNotGrantedError`.
- *
- * This gate runs BEFORE `getDEK()` on the mutation path so a
- * non-cleared operator never has the opportunity to silently
- * auto-create a tier DEK they shouldn't have.
- */
-declare function assertTierAccess(keyring: UnlockedKeyring, collection: string, tier: number): void;
-
-/**
- * Default policy for personal vaults and SMB deployments — the gates
- * that need an off-device factor get one (TOTP / email-OTP / paper
- * recovery), the rest take a tier-1 unlock alone. Tier-3 (PIN) is the
- * floor only for `rotate-unlock` because that's the
- * "change my PIN" flow.
- *
- * The unspecified gates (e.g. `view-user-auth`) inherit the engine
- * default of `{ enabled: false, minTier: 1 }` — they fail closed.
- *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Built-in gates
- */
-declare const PERSONAL_POLICY: VaultPolicy;
-/**
- * Strict policy for regulated deployments and shared workstations —
- * raises the phrase floor to 8 words, demands two distinct factors for
- * exports, and blocks export-on-shared-device. Use as a base for
- * `policy: { ...STRICT_POLICY, gates: { ...STRICT_POLICY.gates, ... } }`
- * tweaks.
- */
-declare const STRICT_POLICY: VaultPolicy;
-/**
- * Merge a developer override onto a preset. Unspecified gates inherit;
- * specified gates fully replace the preset's entry for that gate.
- *
- * Example:
- *
- * ```ts
- * mergePolicy(PERSONAL_POLICY, {
- *   gates: {
- *     'app:approve-large-payment': { minTier: 2, factors: [{ anyOf: ['totp'] }] },
- *   },
- * })
- * // → PERSONAL_POLICY plus the new app gate; existing gates intact.
- * ```
- */
-declare function mergePolicy(base: VaultPolicy, override?: Partial<VaultPolicy>): VaultPolicy;
-
-/**
- * Policy gate engine — the {@link checkGate} entry point.
- *
- * Given a configured {@link VaultPolicy}, an active session tier, and
- * the factor proofs an actor is presenting, decide whether the gate
- * permits the action. On denial, throws {@link PolicyDeniedError} with
- * a stable {@link PolicyDenyReason} so consumers can branch in error
- * UIs.
- *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → checkGate() API
- *
- * @module
- */
-
-/** Default freshness window — 5 minutes. */
-declare const DEFAULT_FRESHNESS_MS: number;
-/** Caller-supplied context for one `checkGate` invocation. */
-interface CheckGateContext {
-    /** Tier the active session currently holds. */
-    readonly activeTier: ActiveTier;
-    /** Proofs the actor is presenting for this gate. */
-    readonly factors?: ReadonlyArray<FactorProof>;
-    /**
-     * If the host knows the actor is on a shared device, set this to
-     * `true` so the engine can apply `warn.sharedDevice` rules. Defaults
-     * to `false`.
-     */
-    readonly sharedDevice?: boolean;
-    /**
-     * Override `now()` for tests. Defaults to `Date.now()`.
-     * @internal
-     */
-    readonly now?: number;
-}
-/**
- * Decide whether `gate` permits the action under `context`. Throws
- * {@link PolicyDeniedError} on denial; resolves with `void` on success.
- *
- * Lookup rules:
- * - **Built-in gates** without a configured policy fail closed
- *   (`enabled: false`).
- * - **App-defined gates** (`app:*`) without a configured policy are
- *   treated as no-op (allow). The developer registered the policy if
- *   they wanted enforcement; absence means the gate is informational.
- */
-declare function checkGate(policy: VaultPolicy, gate: GateName, context: CheckGateContext): Promise<void>;
-/**
- * Same as {@link checkGate} but returns a structured verdict instead
- * of throwing. Useful when an error UI wants to show the user
- * "you'll need TOTP plus a recovery code to do that" without first
- * triggering the action.
- */
-declare function describeGate(policy: VaultPolicy, gate: GateName, context: CheckGateContext): Promise<{
-    ok: true;
-} | {
-    ok: false;
-    reason: PolicyDenyReason;
-    required: GatePolicy;
-}>;
-
-/**
- * Persistence helpers for the vault-level policy document
- * (`_meta/policy`). Mirrors the bypass-AES pattern used by
- * `_meta/handle` — the policy document is plain JSON, the envelope's
- * `_iv` field is left empty.
- *
- * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → Storage location
- *
- * @module
- */
-
-/** Reserved collection name for vault-level metadata documents. */
-declare const META_COLLECTION = "_meta";
-/** Reserved id for the vault-level policy document. */
-declare const POLICY_RECORD_ID = "policy";
-/**
- * Read the vault-level policy from `_meta/policy`. Returns `undefined`
- * when no policy has been persisted (fresh vault, or a vault written
- * before the policy module landed). The caller falls back to the
- * default preset.
- *
- * Tolerates corrupted documents the same way `_meta/handle` does: a
- * JSON parse failure surfaces as `undefined`, not a thrown error, so
- * a bad write never permanently locks a vault.
- */
-declare function loadVaultPolicy(store: NoydbStore, vault: string): Promise<VaultPolicy | undefined>;
-/**
- * Persist the vault-level policy at `_meta/policy`. Idempotent — call
- * once at vault creation and again on `db.updatePolicy()` invocations.
- */
-declare function saveVaultPolicy(store: NoydbStore, vault: string, policy: VaultPolicy): Promise<void>;
-
-export { ActiveTier, type AgeRoute, type AllocateOptions, ApproveWithdrawalOptions, type BlobLifecyclePolicy, type BlobStoreRoute, type CheckGateContext, type CircuitBreakerOptions, CustodyStrategy, DEFAULT_FRESHNESS_MS, DIRECTORY_RECORD_ID, DeepPartialOrNull, type DirectoryConfig, EncryptedEnvelope, ExportAccessibleOptions, FactorProof, type FxRates, GateName, GatePolicy, type HealthCheckOptions, LiveUserEnvelope, type LogLevel, type LoggingOptions, META_COLLECTION, type MetricsOptions, type MulRateOptions, NoydbStore, type OverrideOptions, type OverrideTarget, PERSONAL_POLICY, POLICY_RECORD_ID, PUBLIC_ENVELOPE_RECORD_ID, type PersistSchemaResult, PersistedSchemaEnvelope, PolicyDenyReason, PublicEnvelope, RejectWithdrawalOptions, RequestWithdrawalOptions, RequestWithdrawalResult, type RetryOptions, RoundingMode, type RouteStatus, type RouteStoreOptions, type RoutedNoydbStore, SCHEMAS_COLLECTION, STRICT_POLICY, SchemaUpdateStrategy, SearchStrategy, SequenceStrategy, type StoreCacheOptions, type StoreMiddleware, type StoreOperation, type SuspendOptions, type Tokenizer, UnlockedKeyring, Unsubscribe, UpdateDecision, UserApi, UserEnvelope, UserEnvelopePresented, type UserVisibility, VISIBILITY_RECORD_PREFIX, VaultPolicy, WithdrawAccessibleOptions, WithdrawResult, WithdrawalRequest, WithdrawalRequestStatus, additiveOnly, allocate, assertTierAccess, blindUpdate, checkGate, coordinatedCutover, dekKey, deleteUserEnvelope, deleteUserVisibility, derivePersistedSchema, describeAllUsersAuth, describeAuthConfig, describeGate, describeUserAuth, diagramAuthConfig, effectiveClearance, estimateRecordBytes, isZodSchema, listUserEnvelopeIds, loadPersistedSchema, loadPublicEnvelope, loadUserEnvelope, loadVaultPolicy, lockSchema, memoryStore, mergePolicy, mulRate, parseBytes, persistDirectoryConfig, persistSchemaIfNeeded, persistUserVisibility, readDirectoryConfig, readPlaintextRecord, readPublicEnvelope, readUserVisibility, routeStore, savePersistedSchema, savePublicEnvelope, saveUserEnvelope, saveVaultPolicy, scaleForCurrency, tokenize, visibilityRecordId, withCache, withCircuitBreaker, withCustody, withHealthCheck, withLogging, withMetrics, withRetry, withSearch, withSequence, wrapStore };
+ * ## Key concepts
+ *
+ * | Concept | Type | Description |
+ * |---------|------|-------------|
+ * | Instance | {@link Noydb} | Top-level handle from {@link createNoydb} |
+ * | Vault | {@link Vault} | Tenant namespace; has its own keyrings |
+ * | Collection | {@link Collection} | Typed record set; has its own DEK |
+ * | Store | {@link NoydbStore} | 6-method backend interface |
+ * | Envelope | {@link EncryptedEnvelope} | What the store actually persists |
+ *
+ * ## Security invariants
+ *
+ * - **Zero crypto dependencies.** All cryptography uses `crypto.subtle` (Web
+ *   Crypto API). No npm crypto packages.
+ * - **KEK never persisted.** The key-encryption key lives only in memory for
+ *   the duration of an open session.
+ * - **Fresh IV per write.** Every `put()` generates a new random 12-byte IV.
+ * - **Stores see only ciphertext.** Encryption happens in core before any
+ *   store method is called.
+ *
+ * ## Related packages
+ *
+ * | Package | Purpose |
+ * |---------|---------|
+ * | `@noy-db/to-file` | JSON file store (USB / local disk) |
+ * | `@noy-db/to-browser-idb` | IndexedDB store (atomic CAS) |
+ * | `@noy-db/to-memory` | In-memory store (testing) |
+ * | `@noy-db/to-aws-dynamo` | DynamoDB single-table store *(noy-db-to)* |
+ * | `@noy-db/to-aws-s3` | S3 object store *(noy-db-to)* |
+ * | `@noy-db/to-postgres` | PostgreSQL store *(noy-db-to)* |
+ * | `@noy-db/in-vue` | Vue 3 composables |
+ * | `@noy-db/in-pinia` | Pinia store integration |
+ * | `@noy-db/in-nuxt` | Nuxt 4 module |
+ * | `@noy-db/on-webauthn` | Hardware-key / passkey unlock |
+ * | `@noy-db/on-oidc` | OIDC / federated login unlock |
+ *
+ * @packageDocumentation
+ */
+import './kernel/env-check.js';
+export type { Role, Permission, Permissions, EncryptedEnvelope, KeyringAuthenticator, KeyringAuthenticatorWrappingKEK, KeyringAuthenticatorWrappingDEKs, VaultPolicyOnDisk, VaultSnapshot, NoydbStore, ListPageResult, KeyringFile, VaultBackup, DirtyEntry, SyncMetadata, Conflict, ErasureEnforcement, ConflictStrategy, ConflictPolicy, CollectionConflictResolver, PushOptions, PullOptions, PushResult, PullResult, SyncTransactionResult, SyncStatus, ChangeEvent, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, NoydbOptions, HistoryConfig, HistoryOptions, HistoryEntry, PruneOptions, PutManyItemOptions, PutManyOptions, PutManyResult, DeleteManyResult, ExportStreamOptions, ExportChunk, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, SessionPolicy, ReAuthOperation, PlaintextTranslatorContext, PlaintextTranslatorFn, TranslatorAuditEntry, ExportCapability, ExportFormat, ImportCapability, } from './kernel/types.js';
+export { NOYDB_FORMAT_VERSION, NOYDB_KEYRING_VERSION, NOYDB_BACKUP_VERSION, NOYDB_SYNC_VERSION, createStore, } from './kernel/types.js';
+export type { StoreAuthKind, StoreAuth, StoreCapabilities, StoreCredentials, StoreCredentialSource, } from './kernel/types.js';
+export type { NoydbPodStore, NoydbBundleStore, BlobObject, SlotRecord, SlotInfo, VersionRecord, BlobPutOptions, BlobResponseOptions, } from './kernel/types.js';
+export { BlobSet } from './with-shape/blobs/blob-set.js';
+export { memoryObjectProjection } from './with-shape/blobs/object-projection.js';
+export type { ObjectProjection, ObjectMeta, ObjectListEntry, PutObjectOptions, ObjectUrlOptions, PutUrlOptions, } from './with-shape/blobs/object-projection.js';
+export { importExternalObjects } from './with-shape/blobs/import-external.js';
+export type { ImportableCollection, ImportExternalOptions, ImportExternalResult, } from './with-shape/blobs/import-external.js';
+export { BLOB_COLLECTION, BLOB_INDEX_COLLECTION, BLOB_CHUNKS_COLLECTION, BLOB_SLOTS_PREFIX, BLOB_VERSIONS_PREFIX, DEFAULT_CHUNK_SIZE, } from './with-shape/blobs/blob-set.js';
+export { detectMimeType, detectMagic, isPreCompressed } from './with-shape/blobs/mime-magic.js';
+export { wrapPodStore, createPodStore, wrapBundleStore, createBundleStore } from './with-pod/pod-store.js';
+export type { WrappedPodNoydbStore, WrapPodStoreOptions, WrappedBundleNoydbStore, WrapBundleStoreOptions, } from './with-pod/pod-store.js';
+export { readPlaintextRecord } from './kernel/debug.js';
+export type { WriteQueue } from './kernel/write-queue.js';
+export type { WriteEvent, WriteHook } from './port/with/write-hooks.js';
+export type { SchemaIntrospection } from './with-shape/introspection/types.js';
+export type { FieldMeta, SemanticType } from './with-shape/introspection/field-meta.js';
+export type { CollectionMeta, VaultMeta } from './with-shape/introspection/meta.js';
+export type { CollectionDescription, DescribedField, DescribeOptions } from './with-shape/introspection/describe.js';
+export { applyListProjection, type ListProjectionOptions } from './with-shape/introspection/projection.js';
+export type { DryRunResult, AffectedDocument, GuardViolation } from './with-commit/tx/dry-run.js';
+export type { TabRole, TabPresence, TabCoordinationOptions, TabLockManager, TabChannel } from './with-party/tab-coordination.js';
+export type { WriteConflict } from './kernel/types.js';
+export type { SchemaDelta, FieldChange, UpdateContext, UpdateDecision, SchemaUpdateStrategy, } from './with-shape/schema-update/index.js';
+export { blindUpdate, additiveOnly, lockSchema, coordinatedCutover } from './with-shape/schema-update/index.js';
+export type { FenceState, FenceDoc } from './with-shape/schema-update/fence.js';
+export type { SyncPolicy, PushPolicy, PullPolicy, PushMode, PullMode, SyncSchedulerStatus } from './kernel/sync-policy.js';
+export { SyncScheduler, INDEXED_STORE_POLICY, POD_STORE_POLICY, BUNDLE_STORE_POLICY } from './kernel/sync-policy.js';
+export type { SyncTarget, SyncTargetRole } from './kernel/types.js';
+export { memoryStore } from './kernel/memory-store.js';
+export { routeStore } from './with-store/route-store.js';
+export type { RouteStoreOptions, RoutedNoydbStore, BlobStoreRoute, AgeRoute, BlobLifecyclePolicy, OverrideTarget, OverrideOptions, SuspendOptions, RouteStatus, } from './with-store/route-store.js';
+export { wrapStore, withRetry, withLogging, withMetrics, withCircuitBreaker, withCache, withHealthCheck } from './with-store/store-middleware.js';
+export type { StoreMiddleware, RetryOptions, LoggingOptions, LogLevel, MetricsOptions, StoreOperation, CircuitBreakerOptions, StoreCacheOptions, HealthCheckOptions, } from './with-store/store-middleware.js';
+export { NoydbError, DecryptionError, TamperedError, InvalidKeyError, KeyringCorruptError, NoAccessError, ReadOnlyError, PermissionDeniedError, PrivilegeEscalationError, StoreCapabilityError, ConflictError, NetworkError, NotFoundError, ValidationError, SchemaValidationError, GroupCardinalityError, BackupLedgerError, BackupCorruptedError, JoinTooLargeError, CrossJoinTooLargeError, CrossJoinSourceUnknownError, DanglingReferenceError, FilenameSanitizationError, PathEscapeError, ElevationExpiredError, AlreadyElevatedError, LedgerContentionError, SequenceContentionError, SequenceOfflineError, SequenceNotEnabledError, BundleIntegrityError, BundleSealMismatchError, PodVersionConflictError, BundleVersionConflictError, SessionExpiredError, SessionNotFoundError, SessionPolicyError, ExportCapabilityError, ImportCapabilityError, KeyringExpiredError, ReadOnlyAtInstantError, ReadOnlyFrameError, RecordLockedError, FieldFrozenError, IllegalTransitionError, InvariantError, AmendmentForbiddenError, AttestationError, AttestationNotEnabledError, ClassifiedNotEnabledError, TiersNotEnabledError, PortabilityNotEnabledError, SchemaUpdateError, NonAdditiveSchemaChangeError, SchemaLockedError, SchemaFenceError, MigrationRequiredError, QuiesceTimeoutError, } from './kernel/errors.js';
+export { SnapshotNotFoundError } from './kernel/errors.js';
+export type { SnapshotMeta, RetentionPolicy } from './with-fork/snapshots/strategy.js';
+export { withArchive } from './with-fork/archive/index.js';
+export type { ArchiveStrategy, WithArchiveOptions, ArchivePolicy, ArchiveResult, ArchiveRunOptions, } from './with-fork/archive/index.js';
+export { SequenceStore, resolveSequenceKey, compileSequenceFormat } from './with-commit/sequence/index.js';
+export type { SequenceHandle, FormattedSequenceHandle, NextOptions, SequenceOptions, SequenceStoreOptions } from './with-commit/sequence/index.js';
+export { withSequence, NO_SEQUENCE } from './with-commit/sequence/index.js';
+export type { SequenceStrategy } from './with-commit/sequence/index.js';
+export { withDeferredNumbering } from './with-commit/numbering/descriptor.js';
+export type { DeferredNumberingConfig } from './with-commit/numbering/descriptor.js';
+export type { Assignment as NumberingAssignment } from './with-commit/numbering/index.js';
+export { NumberingUncertaintyError } from './kernel/errors.js';
+export type { StoreTime } from './kernel/types.js';
+export { STATE_VAULT_NAME } from './kernel/constants.js';
+export { UnknownShardError, ShardProvisioningError, VaultTemplateNotFoundError, ReservedVaultNameError, DataResidencyError } from './kernel/errors.js';
+export { ForgetStrategyNotConfiguredError } from './kernel/errors.js';
+export { SealedRecordExpiredError, SealedRecordMismatchError, RecordCekNotFoundError, SealedRecordNotEnabledError } from './kernel/errors.js';
+export { DebugPlaintextError, DebugReservedFieldError } from './kernel/errors.js';
+export { writePod, readPod, readPodHeader, writeNoydbBundle, readNoydbBundle, readNoydbBundleHeader, resetBrotliSupportCache, } from './with-pod/bundle.js';
+export { exportAccessibleData } from './with-audit/portability/export-accessible.js';
+export type { ExportAccessibleOptions } from './with-audit/portability/export-accessible.js';
+export { withdrawAccessibleData } from './with-audit/portability/withdraw-accessible.js';
+export type { WithdrawAccessibleOptions, WithdrawResult, FrozenSnapshotRef } from './with-audit/portability/withdraw-accessible.js';
+export { requestWithdrawal, listWithdrawalRequests, approveWithdrawal, rejectWithdrawal, WithdrawalRequestError, } from './with-audit/portability/request-withdrawal.js';
+export type { RequestWithdrawalOptions, RequestWithdrawalResult, WithdrawalRequest, WithdrawalRequestStatus, ApproveWithdrawalOptions, RejectWithdrawalOptions, } from './with-audit/portability/request-withdrawal.js';
+export type { NoydbPodHeader, NoydbBundleHeader, CompressionAlgo, } from './with-pod/format.js';
+export type { WritePodOptions, WriteNoydbBundleOptions, ReadNoydbBundleOptions, NoydbBundleReadResult, AutoCredentialKind, AutoCredential, } from './with-pod/bundle.js';
+export { NOYDB_BUNDLE_MAGIC, NOYDB_BUNDLE_PREFIX_BYTES, NOYDB_BUNDLE_FORMAT_VERSION, hasNoydbBundleMagic, } from './with-pod/format.js';
+export { generateULID, isULID } from './with-pod/ulid.js';
+export { decryptExtractedPartition } from './with-cargo/decrypt-partition.js';
+export type { DecryptedRecord } from './with-cargo/decrypt-partition.js';
+export type { StandardSchemaV1, StandardSchemaV1SyncResult, StandardSchemaV1Issue, InferOutput, } from './kernel/schema.js';
+export { validateSchemaInput, validateSchemaOutput } from './kernel/schema.js';
+export type { VaultSchemaSnapshot, DumpSchemaOptions, CollectionDescriptor, CollectionConfig, CollectionStats, FieldDescriptor, FieldSource, MaterializedViewDescriptor, OverlayViewDescriptor, DerivationDescriptor, InternalCollectionStats, } from './with-shape/introspection/index.js';
+export type { PersistedSchemaEnvelope, PersistedSchemaKind, PersistSchemaResult, } from './with-shape/persisted-schemas/index.js';
+export { SCHEMAS_COLLECTION, derivePersistedSchema, isZodSchema, loadPersistedSchema, savePersistedSchema, persistSchemaIfNeeded, } from './with-shape/persisted-schemas/index.js';
+export { VaultInstant, CollectionInstant } from './with-commit/history/time-machine.js';
+export type { VaultEngine } from './with-commit/history/time-machine.js';
+export { VaultFrame, CollectionFrame } from './with-fork/shadow/vault-frame.js';
+export { CONSENT_AUDIT_COLLECTION } from './with-audit/consent/consent.js';
+export type { ConsentContext, ConsentOp, ConsentAuditEntry, ConsentAuditFilter, } from './with-audit/consent/consent.js';
+export { LedgerStore, LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, envelopePayloadHash, canonicalJson, sha256Hex, hashEntry, paddedIndex, parseIndex, computePatch, applyPatch, } from './with-commit/history/ledger/index.js';
+export type { LedgerEntry, AppendInput, VerifyResult, JsonPatch, JsonPatchOp, } from './with-commit/history/ledger/index.js';
+export { ref, refArray, isRefArray, RefRegistry, RefIntegrityError, RefScopeError, } from './kernel/refs.js';
+export type { RefMode, RefDescriptor, RefViolation, } from './kernel/refs.js';
+export { isLinkCollectionName, LinkEndpointError, LinkIntegrityError, } from './with-shape/links/link-set.js';
+export type { LinkSpec, LinkRow, LinkOnDelete, LinkSetHandle, } from './with-shape/links/link-set.js';
+export type { UnlockedKeyring } from './with-party/team/keyring.js';
+export { enrollAuthenticator, removeAuthenticator, findAuthenticator, } from './with-party/team/authenticators.js';
+export type { EnrollAuthenticatorOptions, EnrollAuthenticatorWrappingKEKOptions, EnrollAuthenticatorWrappingDEKsOptions, UpdateAuthenticatorOptions, } from './with-party/team/authenticators.js';
+export { QuickUnlockStore } from './with-party/session/unlock-state.js';
+export type { QuickUnlockState } from './with-party/session/unlock-state.js';
+export { rotatePassphrase as keyringRotatePassphrase, recoverPassphrase as keyringRecoverPassphrase, } from './with-party/team/rotate-recover.js';
+export type { RotatePassphraseInput, RecoverPassphraseInput, RecoverPassphraseResult, RecoveryProof, SlotRewrapContext, SlotRewrapCeremony, } from './with-party/team/rotate-recover.js';
+export { loadPublicEnvelope, savePublicEnvelope, readPublicEnvelope, resolveSchema as resolvePublicEnvelopeSchema, validatePublicEnvelopeInput, isPublicEnvelope, PUBLIC_ENVELOPE_FIELDS, DEFAULT_PUBLIC_ENVELOPE_SCHEMA, PUBLIC_ENVELOPE_RECORD_ID, } from './with-party/directory/public-envelope/index.js';
+export type { PublicEnvelope, PublicEnvelopeText, PublicEnvelopeSchema, PublicEnvelopeField, ResolvedPublicEnvelopeSchema, SetPublicEnvelopeInput, } from './with-party/directory/public-envelope/index.js';
+export { readNoydbBundlePublicEnvelope } from './with-pod/bundle.js';
+export { USER_ENVELOPE_COLLECTION, USER_ENVELOPE_MAX_BYTES, } from './kernel/constants.js';
+export { UserEnvelopeOversizedError } from './kernel/errors.js';
+export { loadUserEnvelope, saveUserEnvelope, deleteUserEnvelope, listUserEnvelopeIds, } from './with-party/directory/user-envelope/index.js';
+export type { UserEnvelope, DeepPartial, DeepPartialOrNull, Unsubscribe, LiveUserEnvelope, UserEnvelopePresented, UserEnvelopeCheckGate, } from './kernel/types.js';
+export { UserApi } from './with-party/directory/user-envelope/api.js';
+export { CustodyApi } from './with-party/custody/index.js';
+export type { GrantCustodianOptions } from './with-party/custody/index.js';
+export { liberateVault } from './with-party/custody/liberate.js';
+export type { LiberateOptions, LiberateResult } from './with-party/custody/liberate.js';
+export { withCustody, NO_CUSTODY } from './with-party/custody/index.js';
+export type { CustodyStrategy, CustodyHost } from './with-party/custody/index.js';
+export { CustodyNotEnabledError } from './kernel/errors.js';
+export { createDeedOwner, loadDeedMarker, isDeedVault, DEED_RECORD_ID } from './with-party/team/deed.js';
+export type { DeedMarker } from './with-party/team/deed.js';
+export { withTeam } from './with-party/team/active.js';
+export { NO_TEAM } from './with-party/team/strategy.js';
+export type { TeamStrategy } from './with-party/team/strategy.js';
+export { TeamNotEnabledError } from './kernel/errors.js';
+export { withLazy } from './with-store/lazy/active.js';
+export type { LazyStrategy } from './with-store/lazy/strategy.js';
+export { describeAuthConfig, diagramAuthConfig, describeUserAuth, describeAllUsersAuth, } from './with-party/auth-introspection/index.js';
+export { loadPaperRecoveryEntries, savePaperRecoveryEntries, burnPaperRecoveryEntry, hasRecoveryEnrolled, mintPaperRecoveryEntry, unwrapDeksFromPaperEntry, loadShamirRecoveryEntries, saveShamirRecoveryEntries, mintShamirRecoveryEntry, unwrapDeksFromShamirEntry, } from './with-party/team/recovery.js';
+export type { PaperRecoveryEntry, PaperRecoveryDoc, ShamirRecoveryEntry, ShamirRecoveryDoc, } from './with-party/team/recovery.js';
+export type { EnrollRecoveryResult, RotateRecoveryOptions, RotateRecoveryResult, } from './with-party/team/rotate-recover.js';
+export { mintWrappedDeksBlob, unwrapDeksFromBlob } from './with-party/team/wrapped-deks.js';
+export type { WrappedDeksBlob } from './with-party/team/wrapped-deks.js';
+export type { SealingKeyProvider, SealedPassphrase, SealedEnvelope, RecipientHint, RecipientSealer } from './with-party/team/managed-passphrase.js';
+export type { ShamirRecoveryProvider } from './with-party/team/shamir-recovery-provider.js';
+export { MemorySealingKeyProvider, MemoryRecipientSealer, sealRsaOaepTlv, parseRsaOaepTlv, aesGcmOpen, loadSealedPassphrase, saveSealedPassphrase, parseSealedEnvelope, SEALED_PASSPHRASE_RECORD_ID, } from './with-party/team/managed-passphrase.js';
+export { recoverUser } from './with-party/team/peer-recover.js';
+export type { RecoverUserOptions } from './with-party/team/peer-recover.js';
+export { hasExportCapability, evaluateExportCapability } from './with-party/team/keyring.js';
+export { hasImportCapability, evaluateImportCapability } from './with-party/team/keyring.js';
+export type { BundleRecipient } from './with-party/team/keyring.js';
+export { buildRecipientKeyringFile } from './with-party/team/keyring.js';
+export { listUsers, listUsersWithEnvelopes } from './with-party/team/keyring.js';
+export type { ListUsersOptions } from './with-party/team/keyring.js';
+export { readDirectoryConfig, persistDirectoryConfig, readUserVisibility, persistUserVisibility, deleteUserVisibility, visibilityRecordId, DIRECTORY_RECORD_ID, VISIBILITY_RECORD_PREFIX, } from './with-party/directory/index.js';
+export type { DirectoryConfig, UserVisibility } from './with-party/directory/index.js';
+export { DirectoryDisabledError } from './kernel/errors.js';
+export { Noydb, createNoydb } from './kernel/noydb.js';
+export { Vault } from './kernel/vault.js';
+export { ElevatedHandle, ELEVATION_AUDIT_COLLECTION } from './with-commit/tx/elevated-handle.js';
+export { Collection } from './kernel/collection.js';
+export type { CacheOptions, CacheStats, CollectionChangeEvent } from './kernel/collection.js';
+export type { CrdtMode, CrdtState, LwwMapState, RgaState, YjsState } from './with-commit/crdt/crdt.js';
+export { resolveCrdtSnapshot, mergeCrdtStates } from './with-commit/crdt/crdt.js';
+export { PresenceHandle } from './with-party/team/presence.js';
+export type { PresencePeer } from './kernel/types.js';
+export { derivePresenceKey } from './kernel/enclave/index.js';
+export { SyncEngine } from './with-party/team/sync.js';
+export { SyncTransaction } from './with-party/team/sync-transaction.js';
+export { TxContext, TxVault, TxCollection, runTransaction } from './with-commit/tx/transaction.js';
+export type { TxOp } from './kernel/types.js';
+export type { TransactionInvariant } from './with-commit/tx/invariants.js';
+export type { TransactionStrategyOptions } from './with-commit/tx/active.js';
+export { withGuard } from './with-audit/guards/index.js';
+export { immutableGuard } from './with-audit/guards/index.js';
+export type { ImmutableGuardConfig } from './with-audit/guards/index.js';
+export { transitionGuard } from './with-audit/guards/index.js';
+export type { TransitionGuardConfig } from './with-audit/guards/index.js';
+export type { GuardStrategy, GuardStrategyHandle, GuardContext, GuardChange, } from './with-audit/guards/index.js';
+export { withDerivation } from './with-formula/derivations/index.js';
+export { withRollup } from './with-formula/derivations/index.js';
+export type { DerivationStrategy, DerivationStrategyHandle, DerivedFromMeta, OutputSpec, RecordOutputSpec, ArrayOutputSpec, } from './with-formula/derivations/index.js';
+export { DerivationCycleError, DerivationDepthError, DerivationOutputUnknownError, DerivationOutputShapeError, DerivationCapExceededError, } from './kernel/errors.js';
+export { withMaterializedView } from './with-formula/materialized-views/index.js';
+export type { MaterializedViewStrategy, MaterializedViewStrategyHandle, MaterializedViewOutput, MaterializedFromMeta, UnionSource, UnionArmJoin, } from './with-formula/materialized-views/index.js';
+export { MaterializedViewCycleError, MaterializedViewConfigError, MaterializedViewSourceUnknownError, MaterializedViewTooLargeError, } from './kernel/errors.js';
+export { withOverlayedView } from './with-formula/overlay-views/index.js';
+export type { OverlayedViewStrategy, OverlayedViewStrategyHandle, OverlayFieldMergeRule, OverlayFieldMergeMode, } from './with-formula/overlay-views/index.js';
+export { OverlayBaseIsVirtualError, OverlayCollectionUnavailableError, OverlayNameCollisionError, OverlayIdMismatchError, } from './kernel/errors.js';
+export { PERIODS_COLLECTION } from './with-audit/periods/index.js';
+export type { PeriodRecord, ClosePeriodOptions, OpenPeriodOptions, } from './with-audit/periods/index.js';
+export { PeriodClosedError } from './kernel/errors.js';
+export { Lru, parseBytes, estimateRecordBytes } from './kernel/cache/index.js';
+export type { LruOptions, LruStats } from './kernel/cache/index.js';
+export { dictKey, isDictKeyDescriptor, staticDict, isStaticDictDescriptor, isDictCollectionName, dictCollectionName, DictionaryHandle, DICT_COLLECTION_PREFIX, } from './via/i18n/dictionary.js';
+export type { DictKeyDescriptor, StaticDictDescriptor, DictEntry, DictionaryOptions, } from './via/i18n/dictionary.js';
+export { i18nText, isI18nTextDescriptor, validateI18nTextValue, resolveI18nText, applyI18nLocale, } from './via/i18n/core.js';
+export type { I18nTextOptions, I18nTextDescriptor, ResolveI18nOptions, I18nMap } from './via/i18n/core.js';
+export { money, isMoneyDescriptor, MoneyPrecisionError, MoneyCurrencyError, MoneyUnsupportedError, scaleForCurrency, mulRate, allocate, asMoney, isMoneyString, moneyNumber, } from './via/money/index.js';
+export type { MoneyDescriptor, MoneyOptions, MoneyOptionsFixed, MoneyOptionsMulti, RoundingMode, FxRates, MulRateOptions, AllocateOptions, MoneyString, } from './via/money/index.js';
+export { via, isViaFieldSpec } from './kernel/via/compose.js';
+export type { ViaFieldSpec } from './kernel/via/compose.js';
+export type { ViaPosture, ViaDescriptor } from './kernel/via/index.js';
+export type { DerivationSkippedFrozen } from './kernel/via/dispatch.js';
+export { classified, luhnCheck, isClassifiedFieldSpec, isClassifiedGroup, resolveClassifiedFields, ClassifiedConfigError, ClassifiedNeverStoredError, ClassifiedValidationError, ClassifiedRevealError, ClassifiedVerifyError, ClassifiedRotationError } from './via/classified/index.js';
+export type { ClassifiedFieldSpec, ClassifiedGroup, ClassifiedEntry, ClassifiedList, ClassifiedStorage, ClassifiedVerdict } from './via/classified/index.js';
+export { evalComputedFields, ComputedFieldError } from './with-formula/computed/index.js';
+export type { ComputedFields, ComputedFn, ComputedFieldEntry } from './with-formula/computed/index.js';
+export { computed, isComputedDescriptor } from './via/computed/descriptor.js';
+export type { ComputedDescriptor } from './via/computed/descriptor.js';
+export { resolvePolicy } from './via/i18n/policy.js';
+export type { OnMissing, Layer, OnMissingPolicy } from './via/i18n/policy.js';
+export { inferScripts, enforceScript } from './via/i18n/script.js';
+export type { ScriptWarning } from './via/i18n/script.js';
+export { ReservedCollectionNameError, DictKeyMissingError, DictKeyInUseError, MissingTranslationError, LocaleNotSpecifiedError, TranslatorNotConfiguredError, ScriptViolationError, StaticDictReadonlyError, UnknownDictCodeError, } from './kernel/errors.js';
+export { lookup, dict, enumOf, enum } from './via/lookup/index.js';
+export { UnknownLookupKeyError, RestrictRefUnresolvableError } from './kernel/errors.js';
+export type { LookupDescriptor, Vocabulary, OnDelete } from './via/lookup/index.js';
+export type { LocaleReadOptions } from './kernel/types.js';
+export { putCredential, getCredential, deleteCredential, listCredentials, credentialStatus, SYNC_CREDENTIALS_COLLECTION, } from './with-party/team/sync-credentials.js';
+export type { SyncCredential } from './with-party/team/sync-credentials.js';
+export { PolicyEnforcer, createEnforcer, validateSessionPolicy } from './with-party/session/session-policy.js';
+export { createSession, resolveSession, revokeSession, revokeAllSessions, isSessionAlive, activeSessionCount, } from './with-party/session/session.js';
+export type { SessionToken, CreateSessionResult, CreateSessionOptions, } from './with-party/session/session.js';
+export { enableDevUnlock, loadDevUnlock, clearDevUnlock, isDevUnlockActive, } from './with-party/session/dev-unlock.js';
+export type { DevUnlockOptions } from './with-party/session/dev-unlock.js';
+export { isDiscriminant } from './kernel/util/discriminant.js';
+export { bufferToBase64, base64ToBuffer, encryptBytes, decryptBytes } from './kernel/enclave/index.js';
+export { encryptDeterministic, decryptDeterministic } from './kernel/enclave/index.js';
+export { EnclaveNotSupportedError } from './kernel/errors.js';
+export type { GhostRecord, TierMode, CrossTierAccessEvent } from './kernel/types.js';
+export { TierNotGrantedError, TierDemoteDeniedError, DelegationTargetMissingError } from './kernel/errors.js';
+export { IndexRequiredError, IndexWriteFailureError } from './kernel/errors.js';
+export { FieldNotQueryableError } from './kernel/errors.js';
+export { fuseRetrieval, type FuseOptions } from './with-lookup/search/fuse.js';
+export { UniqueConstraintError, UnsupportedIndexOptionError } from './kernel/errors.js';
+export { EmbeddingDimMismatchError, EmbeddingModelMismatchError } from './kernel/errors.js';
+export type { EmbeddingDescriptor } from './with-lookup/embeddings/index.js';
+export { dekKey, effectiveClearance, assertTierAccess } from './with-party/team/tiers.js';
+export type { DelegationToken, IssueDelegationOptions } from './with-party/team/delegation.js';
+export { DELEGATIONS_COLLECTION, issueDelegation, loadActiveDelegations, revokeDelegation } from './with-party/team/delegation.js';
+export type { MagicLinkGrantPayload, MagicLinkGrantRecord, IssueMagicLinkGrantOptions, } from './with-party/team/magic-link-grant.js';
+export { MAGIC_LINK_GRANTS_COLLECTION, MAGIC_LINK_CONTENT_INFO_PREFIX, MAGIC_LINK_KEK_INFO_PREFIX, deriveMagicLinkContentKey, writeMagicLinkGrant, readMagicLinkGrantRecord, listMagicLinkGrants, unwrapMagicLinkGrant, revokeMagicLinkGrant, magicLinkGrantRecordId, isMagicLinkGrantExpired, } from './with-party/team/magic-link-grant.js';
+export { diff, formatDiff } from './with-commit/history/diff.js';
+export type { DiffEntry, ChangeType } from './with-commit/history/diff.js';
+export { diffVault } from './with-cargo/vault-diff.js';
+export type { VaultDiff, VaultDiffEntry, VaultDiffModifiedEntry, DiffOptions, DiffCandidate, } from './with-cargo/vault-diff.js';
+export { withCargo, NO_CARGO } from './with-cargo/index.js';
+export type { CargoStrategy } from './with-cargo/index.js';
+export { CargoNotEnabledError } from './kernel/errors.js';
+export { PERSONAL_POLICY, STRICT_POLICY, mergePolicy, checkGate, describeGate, DEFAULT_FRESHNESS_MS, loadVaultPolicy, saveVaultPolicy, META_COLLECTION, POLICY_RECORD_ID, } from './with-party/policy/index.js';
+export { PolicyDeniedError, RecoveryNotEnrolledError, RecoveryProfileNotImplementedError, ManagedRecoveryNotEnrolledError, } from './kernel/errors.js';
+export type { VaultPolicy, GatePolicy, GateName, BuiltInGateName, FactorKind, FactorRequirement, FactorProof, FactorProofBundle, WarningRules, ActiveTier, } from './kernel/types.js';
+export type { PolicyDenyReason } from './kernel/errors.js';
+export type { CheckGateContext } from './with-party/policy/index.js';
+export { validatePassphrase, assertStrongPassphrase, estimateEntropy, WeakPassphraseError, } from './kernel/validation.js';
+export type { PassphrasePolicy, PassphraseValidationResult, WeakPassphraseReason, } from './kernel/validation.js';
+export { Query, executePlan, evaluateClause, evaluateFieldClause, readPath, CollectionIndexes, applyJoins, DEFAULT_JOIN_MAX_ROWS, DEFAULT_CROSS_JOIN_MAX_ROWS, resetJoinWarnings, buildLiveQuery, count, sum, avg, min, max, moneySum, moneyMin, moneyMax, reducerBuilder, Aggregation, reduceRecords, GroupedQuery, GroupedQueryN, GroupedAggregation, groupAndReduce, GROUPBY_WARN_CARDINALITY, GROUPBY_MAX_CARDINALITY, ScanBuilder, } from './kernel/query/index.js';
+export type { QueryPlan, QuerySource, OrderBy, Operator, Clause, FieldClause, FilterClause, GroupClause, IndexDef, HashIndex, JoinLeg, JoinContext, JoinableSource, JoinStrategy, LiveQuery, LiveUpstream, Reducer, ReducerOptions, ReducerBuilder, AggregateSpec, AggregateResult, AggregationUpstream, LiveAggregation, GroupedRow, GroupedRowN, ScanPageProvider, } from './kernel/query/index.js';
+export type { QueryField, IndexFieldName } from './kernel/types.js';
+export type { Sealed, SealedView } from './kernel/types.js';
+export { SealedHandle } from './kernel/types.js';
+export { tokenize } from './with-lookup/search/index.js';
+export type { Tokenizer, SearchOptions, SearchResult, SearchEntry } from './with-lookup/search/index.js';
+export type { RetrieveOptions, RetrieveHit } from './with-lookup/search/index.js';
+export { withSearch, NO_SEARCH } from './with-lookup/search/index.js';
+export type { SearchStrategy } from './with-lookup/search/index.js';
+export { SearchNotEnabledError } from './kernel/errors.js';