@noy-db/hub 0.3.0-pre.2 → 0.3.0-pre.4

package/dist/{index-_6At2_9_.d.ts → index-D4GQe1Rx.d.ts}

@@ -1,5 +1,5 @@
 import { L as LedgerEntry, F as ForgetStrategy, c as SubjectRef, a as ForgetResult } from './subject-index-O75wKshW.js';
-import { V as VaultMeta, a as CollectionMeta, F as FieldMeta, C as CollectionDescription, D as DescribeOptions } from './describe-Ccd1hS7a.js';
+import { V as VaultMeta, a as CollectionMeta, F as FieldMeta, C as CollectionDescription, D as DescribeOptions } from './describe-C6iHNlqJ.js';
 import { C as CoordinationProvider, W as WriteEvent, a as WriteHook, U as Unsubscribe$3, b as WriteHookRegistry } from './index-B9QdHytu.js';
 import { AttestationFieldSchema, QrPayload, RevocationList } from '@noy-db/attestation';
 
@@ -630,6 +630,17 @@ declare class Lru<K, V> {
  * Internal service — not exported as a `@noy-db/hub/*` subpath.
  */
 
+/**
+ * One classified per-slot verdict from {@link RecordCodec.classifySealedShred}.
+ * `shreddable` — CEK-only, tombstone makes it undecryptable. `dekResidue` —
+ * collection-DEK-keyed, survives in synced/backup copies. The third class is
+ * BOTH: a `_bidx` blind-index tag is live-dropped by the tombstone yet retained
+ * under the surviving DEK in any pre-forget backup (honest dual accounting).
+ */
+type SealedShredSlot = {
+    readonly field: string;
+    readonly class: 'shreddable' | 'dekResidue' | 'live-shreddable+dekResidue-in-backups';
+};
 /** Everything the moving crypto methods touched on `this.*`, as a flat context. */
 interface RecordCodecContext<T> {
     /** Collection name — the crypto AAD scope and schema-error context. */
@@ -646,6 +657,18 @@ interface RecordCodecContext<T> {
     readonly sensitiveFields: ReadonlySet<string>;
     /** Declared deterministic-index fields, or null. */
     readonly deterministicFields: ReadonlySet<string> | null;
+    /** Digest-only classified fields → verify policy (stage 2). Null when none. */
+    readonly vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null;
+    /**
+     * C-A / R10 config-drift signal: the persisted `x-classified` marker's
+     * declared digest-only field set (empty when the collection carries no
+     * marker). Lazy, memoized (O(1) per handle after the first call). The R10
+     * superset guard refuses whenever a field in this set is absent from
+     * `vdigFields`. Consulted once per handle on any encrypted write path — the
+     * cross-session, prev-free signal a fully-naive create has no `prev` for.
+     * Undefined on codecs with no store access (direct-construction tests).
+     */
+    classifiedMarkerDigestOnly?(): Promise<readonly string[]>;
     /** CRDT mode (decrypt resolves CrdtState→snapshot when set). */
     readonly crdtMode: CrdtMode | undefined;
     /** CRDT strategy seam (resolveCrdtSnapshot). */
@@ -710,7 +733,10 @@ declare class RecordCodec<T> {
      * to pre-CEK behaviour, so non-adopting collections pay nothing.
      */
     encryptJsonString(json: string, version: number, cek?: EnclaveKey, source?: string, sourceTs?: string): Promise<EncryptedEnvelope>;
-    encryptRecord(record: T, version: number, cek?: EnclaveKey, source?: string, sourceTs?: string): Promise<EncryptedEnvelope>;
+    encryptRecord(record: T, version: number, cek?: EnclaveKey, source?: string, sourceTs?: string, vdig?: {
+        readonly id: string;
+        readonly prev: EncryptedEnvelope | null;
+    }): Promise<EncryptedEnvelope>;
     /**
      * Resolve the per-record CEK for a stored envelope, or `undefined` for a
      * legacy (`_cek`-absent) envelope. Unwraps `_cek` under the collection DEK and
@@ -755,8 +781,7 @@ declare class RecordCodec<T> {
      * `_cek` (pure legacy collection-DEK sealing) ALL slots are residue.
      */
     classifySealedShred(live: EncryptedEnvelope): Promise<{
-        shreddable: string[];
-        dekResidue: string[];
+        readonly slots: readonly SealedShredSlot[];
     }>;
     /**
      * Build a non-leaking {@link Sealed} handle over a sealed field's ciphertext.
@@ -3377,6 +3402,16 @@ declare class AttestationError extends NoydbError {
 declare class AttestationNotEnabledError extends NoydbError {
     constructor(message?: string);
 }
+/**
+ * Thrown when `collection.reveal()` is called without opting into the
+ * classified capability (the default `NO_CLASSIFIED` stub). Classified reveal
+ * is an opt-in, tree-shakeable capability: enable it with
+ * `classifiedStrategy: withClassified()` from "@noy-db/hub/classified" in
+ * createNoydb().
+ */
+declare class ClassifiedNotEnabledError extends NoydbError {
+    constructor(message?: string);
+}
 /**
  * Thrown when a hierarchical-tiers capability method (`putAtTier`, `getAtTier`,
  * `listAtTier`, `elevate`, `demote`) is called without opting into the tiers
@@ -3422,6 +3457,18 @@ declare class PortabilityNotEnabledError extends NoydbError {
 declare class CustodyNotEnabledError extends NoydbError {
     constructor(message?: string);
 }
+/**
+ * Thrown when a multi-user team operation — `db.grant`, `db.revoke`, or
+ * `db.rotate` — is called without opting into the team capability (the
+ * default `NO_TEAM` stub). The always-on floor is single-user by design
+ * (#267 keyring-grant → team split): enable multi-user grant/revoke/rotate
+ * with `teamStrategy: withTeam()` from "@noy-db/hub/team" in createNoydb().
+ * Single-user primitives (owner keyring, unlock, `listUsers`, `updateUser`,
+ * passphrase rotate/recover) stay ungated.
+ */
+declare class TeamNotEnabledError extends NoydbError {
+    constructor(message?: string);
+}
 /**
  * Thrown when a search / retrieval capability method — `collection.search`,
  * `collection.retrieve`, `collection.similarTo`, `collection.warmIndex`,
@@ -3988,6 +4035,47 @@ declare class EnclaveNotSupportedError extends NoydbError {
     readonly group: 'sealing' | 'deterministic' | 'per-record-keys';
     constructor(group: 'sealing' | 'deterministic' | 'per-record-keys', detail?: string);
 }
+/**
+ * Raised when a collection's `classifiedFields` configuration is invalid
+ * (e.g. a claimed field name collides with a rider companion or another
+ * classified field). Homed in `kernel/errors.ts` (rather than
+ * `with-shape/classified/errors.ts`) so `kernel/enclave/classify/*` can throw
+ * it without importing with-*; `with-shape/classified/errors.ts` re-exports
+ * it under the same name for backward-compatible import paths.
+ */
+declare class ClassifiedConfigError extends Error {
+    readonly collection: string;
+    constructor(collection: string, message: string);
+}
+/**
+ * Raised by `collection.reveal()` when a field cannot be revealed — unknown
+ * field, `storage:'never'`, or missing record. See {@link ClassifiedConfigError}
+ * for why this lives in `kernel/errors.ts`.
+ */
+declare class ClassifiedRevealError extends Error {
+    readonly collection: string;
+    readonly field: string;
+    constructor(collection: string, field: string, detail: string);
+}
+/**
+ * Raised by the classified verify path (`storage:'digest-only'`, stage 2)
+ * when a field cannot be verified — unknown field, not digest-only, or no
+ * digest stored yet.
+ */
+declare class ClassifiedVerifyError extends Error {
+    readonly collection: string;
+    readonly field: string;
+    constructor(collection: string, field: string, detail: string);
+}
+/**
+ * Raised by the classified rotation path (stage 2) when a new value is
+ * refused — e.g. reuse of one of the last N values (`notLastN`).
+ */
+declare class ClassifiedRotationError extends Error {
+    readonly collection: string;
+    readonly field: string;
+    constructor(collection: string, field: string, detail: string);
+}
 
 /**
  * The `money()` field descriptor — a branded schema-layer descriptor, a
@@ -4853,8 +4941,17 @@ interface ConsentContext {
      */
     readonly consentHash: string;
 }
-/** Access operation recorded in an audit entry. */
-type ConsentOp = 'get' | 'put' | 'delete';
+/**
+ * Access operation recorded in an audit entry.
+ *
+ * Union-widening checklist (I-2) — these three sites widen together or a
+ * downstream exhaustive switch breaks at its next in-range minor:
+ *   1. `ConsentOp` here (public, re-exported at `index.ts`).
+ *   2. `onAccess` op union on `kernel/collection-config.ts`.
+ *   3. classified ctx `onAccess` op union on `with-shape/classified/strategy.ts`
+ *      (the `ClassifiedVerifyCtx` one — the `ClassifiedRevealCtx` one stays `'reveal'`-only).
+ */
+type ConsentOp = 'get' | 'put' | 'delete' | 'reveal' | 'verify' | 'find';
 /** One consent-audit record, as decrypted for the caller. */
 interface ConsentAuditEntry {
     /** ULID — stable insertion-order key. */
@@ -5627,6 +5724,61 @@ interface PeriodsStrategy {
     appendPeriodLedgerEntry(ledger: LedgerStore | null, actor: string, envelope: EncryptedEnvelope, periodName: string): Promise<void>;
 }
 
+/**
+ * Classified fields — behavioral sensitive-field descriptors (stage 1).
+ * Design: docs/superpowers/specs/2026-07-04-classified-fields-design.md
+ * Law: open on write, declarative on read — read-side behavior is this
+ * closed vocabulary; there are no read-side callbacks.
+ * @module
+ */
+type ClassifiedStorage = 'recoverable' | 'never' | 'digest-only';
+type ClassifiedList = {
+    readonly kind: 'omit';
+} | {
+    readonly kind: 'mask';
+    readonly pattern: string;
+} | {
+    readonly kind: 'rider';
+    readonly rider: string;
+};
+type ClassifiedRider = (value: unknown) => unknown;
+interface ClassifiedFieldSpec {
+    readonly _noydbClassified: true;
+    readonly preset: string;
+    readonly storage: ClassifiedStorage;
+    readonly list: ClassifiedList;
+    readonly sensitivity: 'pii' | 'secret';
+    /** Write-time safe projections; companion field name is `<field>_<rider>`. */
+    readonly riders?: Record<string, ClassifiedRider>;
+    /** Write-time validator: error message, or null when valid. */
+    readonly validate?: (value: unknown) => string | null;
+    /** Digest-only verify policy (stage 2). Mode both sides normalize under. */
+    readonly verifyNormalize?: 'password' | 'secret-answer';
+    /** Decorate ok:true verdicts with mustRotate after this many days (I1). */
+    readonly rotateDays?: number;
+    /** Refuse reuse of the last N values on rotate (cap 8, spec Q4). */
+    readonly notLastN?: number;
+    /** Member of the collection's matchGroup (secretAnswer preset). */
+    readonly verifyGroupMember?: true;
+    /**
+     * Opt into a store-visible blind-index (`_bidx`) tag so equal values become
+     * queryable/joinable while staying digest-only. Digest-only knob (R7); gated
+     * behind the collection's `acknowledgeEquatableRisk` door (R8). Equal values
+     * produce equal tags — a partition leak a DEK holder can offline-dictionary
+     * at the PBKDF2 floor. Absent/false ⇒ refused-by-default.
+     */
+    readonly equatable?: true;
+}
+interface ClassifiedGroup {
+    readonly _noydbClassifiedGroup: true;
+    readonly preset: string;
+    /** member record-field name -> spec (differential per-member policy). */
+    readonly members: Record<string, ClassifiedFieldSpec>;
+}
+type ClassifiedEntry = ClassifiedFieldSpec | ClassifiedGroup;
+declare function isClassifiedFieldSpec(x: unknown): x is ClassifiedFieldSpec;
+declare function isClassifiedGroup(x: unknown): x is ClassifiedGroup;
+
 /**
  * Computed scalar fields — schema-owned derived values evaluated on
  * write and materialized onto the record.
@@ -8260,6 +8412,7 @@ declare const NO_SEARCH: SearchStrategy;
  *
  * @module
  */
+
 /** Family of Standard Schema v1 validator the persisted snapshot was derived from. */
 type PersistedSchemaKind = 'Zod' | 'Valibot' | 'ArkType' | 'Effect' | 'Unknown';
 /**
@@ -8284,6 +8437,15 @@ interface PersistedSchemaEnvelope {
     readonly reason?: string;
     /** ISO-8601 timestamp of the most recent derivation write. */
     readonly derivedAt: string;
+    /**
+     * C-A / R10 config-drift marker. Present when the collection declares
+     * classified digest-only fields. A handle opened WITHOUT `classifiedFields`
+     * (a naive handle, whose codec has `vdigFields === null`) reads this back and
+     * refuses to write — a silent plaintext/tag-drop write would corrupt the
+     * classified record. Independent of `persistJsonSchema`: a classified
+     * collection that never opts into schema persistence still writes this marker.
+     */
+    readonly classified?: ClassifiedMarker;
 }
 
 /**
@@ -10818,6 +10980,48 @@ interface Assignment {
     serial: number;
 }
 
+/**
+ * Lazy-mode capability contract (#267 Track A tail — lazy-mode promoted out
+ * of `routing` into its own `lazy` service). Lives on the `/with` port (the
+ * one seam the kernel spine may import statically) so `Collection` can hold
+ * the back-compat default without a spine→service static import.
+ *
+ * Lazy mode (`prefetch: false`) skips bulk hydration: reads go per-id
+ * against the store and land in a bounded LRU working set. The strategy owns
+ * constructing that LRU:
+ *
+ *  - `withLazy()` (`with-store/lazy/active.ts`, subpath `@noy-db/hub/lazy`)
+ *    is the explicit catalog opt-in — silent, forward-stable.
+ *  - {@link IMPLICIT_LAZY} is the floor default reached when a collection
+ *    declares `prefetch: false` WITHOUT `lazyStrategy: withLazy()`. It keeps
+ *    the pre-#267 behavior byte-for-byte (back-compat delegation, pre-1.0)
+ *    but emits a one-time deprecation warn outside test env. It will become
+ *    a throwing stub at 1.0, letting the LRU leave the floor bundle
+ *    entirely once the per-record-CEK cache stops pinning `Lru` there.
+ *
+ * The on-demand read/write branches themselves stay kernel-resident (they
+ * are `if (this.lazy)` forks on the hot get/put/scan paths); the service
+ * seam owns cache construction + budget validation, which is where the
+ * opt-in and the future tree-shake win live.
+ * @internal
+ */
+
+interface LazyStrategy {
+    /**
+     * Build the bounded LRU working-set cache for a lazy collection.
+     * MUST throw when `cache` declares neither `maxRecords` nor `maxBytes` —
+     * an unbounded lazy cache defeats the purpose.
+     */
+    createCache<V>(collection: string, cache: CacheOptions | undefined): Lru<string, V>;
+}
+/**
+ * Back-compat default (deprecated): `prefetch: false` without
+ * `lazyStrategy: withLazy()`. Identical behavior to the explicit opt-in,
+ * plus a one-time deprecation warn (suppressed under NODE_ENV=test,
+ * mirroring the listPage fallback warn). @internal
+ */
+declare const IMPLICIT_LAZY: LazyStrategy;
+
 /**
  * Enable the hierarchical-tiers capability.
  * Pass to `createNoydb({ tiersStrategy: withTiers() })` to make a collection's
@@ -10942,8 +11146,7 @@ declare function demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Pr
  * here because `vault.ts` forget() reaches in via `collection._classifySealedShred`.
  */
 declare function classifySealedShred<T>(ctx: TiersContext<T>, live: EncryptedEnvelope): Promise<{
-    shreddable: string[];
-    dekResidue: string[];
+    readonly slots: readonly SealedShredSlot[];
 }>;
 
 /**
@@ -11643,23 +11846,15 @@ interface HistoryStrategy {
 }
 
 /**
- * `_links_*` reserved collections — managed bidirectional many-to-many
- * junctions (design B).
- *
- * Where `refArray` (design A) stores an id-array on one owning record,
- * `vault.link()` creates a first-class junction: a dedicated encrypted
- * `_links_<name>` collection whose rows are `{ a, b, meta? }` link tuples.
- * It is queryable from BOTH sides (`of(id)`), carries optional per-link
- * metadata, and cascades on endpoint delete.
- *
- * Each link is slot-typed: `a` is an id in the `a` endpoint collection,
- * `b` an id in the `b` endpoint collection (they may be the same
- * collection for self-links). A link's identity is the ordered pair
- * `(a, b)`; `of(id)` matches either slot.
+ * Link-set naming helpers, declaration types, and errors — the tiny,
+ * always-loadable slice of the links feature (#553).
  *
- * Rows are encrypted under a dedicated `_links_<name>` DEK — same
- * zero-knowledge stack as every other collection (the store sees only
- * ciphertext). Backup/restore rides the normal `loadAll` path.
+ * Split out of `link-set.ts` so the kernel floor (reserved-name guard in
+ * `vault.collection()`, the lazy `vault.links()` handle) and the ref/link
+ * enforcement facade can bind these few lines WITHOUT statically pulling
+ * the `LinkSet` storage engine; that class now loads via dynamic import
+ * on first link I/O. `link-set.ts` re-exports everything here, so import
+ * paths and class identities are unchanged for existing consumers.
  */
 
 /** True for any reserved link-collection name. */
@@ -11698,13 +11893,6 @@ interface LinkSetHandle {
     /** All links in the set. */
     list(): Promise<LinkRow[]>;
 }
-/** Thrown by `connect()` when an endpoint record does not exist. */
-declare class LinkEndpointError extends NoydbError {
-    readonly link: string;
-    readonly endpoint: string;
-    readonly missingId: string;
-    constructor(link: string, endpoint: string, missingId: string);
-}
 /** Thrown when a `strict` link blocks deletion of an endpoint that still has links. */
 declare class LinkIntegrityError extends NoydbError {
     readonly link: string;
@@ -12455,11 +12643,13 @@ declare function liberateVault(vault: Vault, opts: LiberateOptions): Promise<Lib
  * The grant/revoke engine the strategy runs when opted in — implemented by
  * `Noydb` (`_grantCustodianImpl` / `_revokeCustodianImpl` hold the gate +
  * keyring logic; the public `grantCustodian` / `revokeCustodian` route through
- * the strategy).
+ * the strategy). Since the #267 team split the keyring grant/revoke engines
+ * are passed IN by `withCustody()` (statically linked there, not in the
+ * kernel) so the single-user floor never carries them.
  */
 interface CustodyHost {
-    _grantCustodianImpl(vault: string, options: GrantCustodianOptions, factors?: FactorProofBundle): Promise<void>;
-    _revokeCustodianImpl(vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
+    _grantCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions) => Promise<void>, vault: string, options: GrantCustodianOptions, factors?: FactorProofBundle): Promise<void>;
+    _revokeCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
 }
 interface CustodyStrategy {
     grantCustodian(host: CustodyHost, vault: string, options: GrantCustodianOptions, factors?: FactorProofBundle): Promise<void>;
@@ -12823,6 +13013,45 @@ interface VaultIntrospectState {
     readonly hasCollectionArchive?: (col: string) => boolean;
 }
 
+/** The ② capability seam for classified read-egress ops (stage 1: reveal; stage 2: verify). @module */
+
+interface ClassifiedRevealCtx {
+    readonly collection: string;
+    readonly spec: ClassifiedFieldSpec;
+    /** True on an encrypted collection — false selects the plaintext-body read. */
+    readonly encrypted: boolean;
+    readonly getEnvelope: (id: string) => Promise<EncryptedEnvelope | null>;
+    readonly resolveCek: (env: EncryptedEnvelope) => Promise<EnclaveKey | undefined>;
+    readonly getDEK: () => Promise<EnclaveKey>;
+    readonly onAccess?: ((op: 'reveal', id: string) => Promise<void>) | undefined;
+}
+interface ClassifiedVerifyCtx {
+    readonly collection: string;
+    readonly spec: ClassifiedFieldSpec;
+    readonly getEnvelope: (id: string) => Promise<EncryptedEnvelope | null>;
+    readonly resolveCek: (env: EncryptedEnvelope) => Promise<EnclaveKey | undefined>;
+    readonly getDEK: () => Promise<EnclaveKey>;
+    readonly now: () => number;
+    /** Group members resolved by the collection (matchGroup only). */
+    readonly groupMembers?: ReadonlyArray<{
+        readonly field: string;
+        readonly spec: ClassifiedFieldSpec;
+    }>;
+    readonly onAccess?: ((op: 'verify' | 'find', id: string) => Promise<void>) | undefined;
+}
+interface ClassifiedStrategy {
+    reveal(ctx: ClassifiedRevealCtx, id: string, field: string): Promise<unknown>;
+    verify(ctx: ClassifiedVerifyCtx, id: string, field: string, candidate: string): Promise<ClassifiedVerdict>;
+    verifyText(ctx: ClassifiedVerifyCtx, id: string, field: string, candidate: string): Promise<ClassifiedVerdict>;
+    matchGroup(ctx: ClassifiedVerifyCtx, id: string, answers: Record<string, string>, opts: {
+        readonly min: number;
+    }): Promise<{
+        readonly passed: boolean;
+    }>;
+    computeTarget(ctx: ClassifiedVerifyCtx, field: string, candidate: string, costByte?: number): Promise<string | null>;
+}
+declare const NO_CLASSIFIED: ClassifiedStrategy;
+
 /** A vault (tenant namespace) containing collections. */
 declare class Vault {
     #private;
@@ -12863,6 +13092,7 @@ declare class Vault {
     /** Per-collection record archival policies. Indexed by collection name. */
     private readonly archiveRegistry;
     private readonly indexStrategy;
+    private readonly lazyStrategy;
     private readonly aggregateStrategy;
     private readonly crdtStrategy;
     private readonly tiersStrategy;
@@ -12884,6 +13114,7 @@ declare class Vault {
     private readonly forgetStrategy;
     private readonly i18nStrategy;
     private readonly syncStrategy;
+    private readonly classifiedStrategy;
     /**
      * Per-vault guard registry. `null` until `_initGuards()` runs; stays
      * `null` for vaults that never register any guard strategy. The
@@ -13076,7 +13307,7 @@ declare class Vault {
     private readonly dictionaryCache;
     /** Registered link specs, keyed by link name; set by `vault.link()`. */
     private readonly linkRegistry;
-    /** Cache of LinkSet handles, one per link name. */
+    /** Cache of link-set handles, one per link name (lazy -- see links()). */
     private readonly linkSetCache;
     /** — subscribers for cross-tier access events. */
     private readonly crossTierSubs;
@@ -13118,6 +13349,7 @@ declare class Vault {
         objectStore?: ObjectProjection | undefined;
         archiveStrategy?: ArchiveStrategy | undefined;
         indexStrategy?: IndexStrategy | undefined;
+        lazyStrategy?: LazyStrategy | undefined;
         aggregateStrategy?: AggregateStrategy | undefined;
         crdtStrategy?: CrdtStrategy | undefined;
         tiersStrategy?: TiersStrategy | undefined;
@@ -13133,6 +13365,7 @@ declare class Vault {
         numberingConfigs?: ReadonlyArray<DeferredNumberingConfig> | undefined;
         forgetStrategy?: ForgetStrategy | undefined;
         attestationStrategy?: AttestationStrategy | undefined;
+        classifiedStrategy?: ClassifiedStrategy | undefined;
         sealedRecordStrategy?: SealedRecordStrategy | undefined;
         portabilityStrategy?: PortabilityStrategy | undefined;
         sequenceStrategy?: SequenceStrategy | undefined;
@@ -13205,6 +13438,8 @@ declare class Vault {
         moneyFields?: MoneyFieldsOpt<T, M>;
         /** — declare computed scalar fields, evaluated on write (schema-owned). */
         computed?: ComputedFields<T>;
+        /** — declare classified() sensitive-field descriptors. See the classified-fields spec. */
+        classifiedFields?: Record<string, ClassifiedEntry>;
         /** — per-collection conflict resolution policy. */
         conflictPolicy?: ConflictPolicy<T>;
         /** — CRDT mode for collaborative editing without conflicts. */
@@ -13217,6 +13452,9 @@ declare class Vault {
         deterministicFields?: readonly IndexFieldName<T, S>[];
         /** — explicit ack that deterministic encryption leaks equality. */
         acknowledgeDeterministicRisk?: boolean;
+        /** — explicit ack for the classified `equatable` knob (R8 door). Required
+         *  when any classified field declares `equatable: true`. */
+        acknowledgeEquatableRisk?: boolean;
         /**
          * — structural group-encryption. Fields sealed into their own
          * `_sealed[field]` envelope slot (per-field key), kept out of the open
@@ -13327,8 +13565,8 @@ declare class Vault {
     abortSchemaCutover(): Promise<void>;
     /** Current schema-cutover fence state for this vault. Thin live read. */
     schemaFenceState(): Promise<FenceDoc>;
-    /** @internal Start the per-client heartbeat + fence watcher once a cutover is registered. */
-    _ensureFenceCoordination(): void;
+    /** @internal Start heartbeat + fence watcher once a cutover is registered. Async since #553: FenceWatcher dynamic-imports on demand. */
+    _ensureFenceCoordination(): Promise<void>;
     /** @internal Stop the heartbeat/watcher (vault lock/close). */
     _stopFenceCoordination(): void;
     /** @internal Best-effort flush of all open collections' persisted
@@ -14554,6 +14792,23 @@ interface GateEventMap {
 }
 type GatePoint = keyof GateEventMap;
 type GateHandler<P extends GatePoint> = (event: GateEventMap[P]) => void | Promise<void>;
+/**
+ * Registration options for a gate handler.
+ *
+ * `needsPrior` (default `true`) declares whether the handler reads the
+ * prior-derived event fields — `existing`, `existingVersion`, `existingTs`,
+ * and (on `beforePut`) `op`. When EVERY handler registered at a point set
+ * `needsPrior: false`, the write path skips the prior-read (store get +
+ * decrypt) entirely and dispatches the event with `existing: null`,
+ * `existingVersion: 0`, `existingTs: undefined` (and `op: 'create'` on
+ * `beforePut`; a `beforeDelete` gate then also fires for delete-of-absent).
+ * A handler that opts out MUST NOT rely on those fields. (#267 prior-read
+ * elision — pure perf; one prior-needing handler restores the old behavior
+ * for the whole point.)
+ */
+interface GateRegisterOptions {
+    readonly needsPrior?: boolean;
+}
 declare class ServiceBus {
     #private;
     /** Register a handler for an observe point. Returns an unsubscribe fn. */
@@ -14579,10 +14834,21 @@ declare class ServiceBus {
      * cannot loop (same rationale as WriteHookRegistry.#suppressed).
      */
     dispatch<P extends LifecyclePoint>(point: P, event: LifecycleEventMap[P]): Promise<void>;
-    /** Register a write-gating handler. A throw from the handler ABORTS the write. Returns an unsubscribe fn. */
-    registerGate<P extends GatePoint>(point: P, handler: GateHandler<P>): Unsubscribe$2;
+    /**
+     * Register a write-gating handler. A throw from the handler ABORTS the
+     * write. Returns an unsubscribe fn. See {@link GateRegisterOptions} for
+     * the `needsPrior` prior-read declaration (#267).
+     */
+    registerGate<P extends GatePoint>(point: P, handler: GateHandler<P>, opts?: GateRegisterOptions): Unsubscribe$2;
     /** Cheap gate for the write path — true when any gate handler is registered for the point. */
     hasGateHandlers(point: GatePoint): boolean;
+    /**
+     * True when at least one gate handler at `point` needs the prior record
+     * (the default). False when the point has no handlers or every handler
+     * registered with `needsPrior: false` — the write path then skips the
+     * prior-read before dispatching (#267 prior-read elision).
+     */
+    gateNeedsPrior(point: GatePoint): boolean;
     /**
      * Run gate handlers in registration order, awaited. Unlike `dispatch`
      * (observe), a handler throw is NOT swallowed — it PROPAGATES, aborting the
@@ -14799,7 +15065,7 @@ interface DryRunResult {
 }
 
 /** NoydbOptions with the store resolved to a non-optional value (internal use only). */
-type ResolvedNoydbOptions = NoydbOptions & {
+type ResolvedNoydbOptions$1 = NoydbOptions & {
     readonly store: NoydbStore;
 };
 /** The top-level NOYDB instance. */
@@ -14818,6 +15084,15 @@ declare class Noydb {
     /** Pre-resolved `vault.user` API factory (mirrors `coordinationProvider` above). Public so `Vault` can call it. */
     readonly userApiFactory: UserApiFactory;
     private readonly vaultCache;
+    /**
+     * In-flight `openVault` promise per name — concurrent opens of the same
+     * vault must converge on ONE Vault instance. Without this, two callers
+     * racing past the `vaultCache` miss each construct a Vault (and later two
+     * Collections with independent DEKs for the same store slice), so a record
+     * written through one fails decryption through the other with a spurious
+     * `TamperedError` (#564).
+     */
+    private readonly vaultOpening;
     private readonly keyringCache;
     private readonly syncEngines;
     /**
@@ -14857,6 +15132,11 @@ declare class Noydb {
      * through it; grant/revoke route through it from this class. @internal
      */
     readonly custodyStrategy: CustodyStrategy;
+    /**
+     * Opt-in multi-user team strategy (#267 keyring-grant → team split) —
+     * `NO_TEAM` (throwing) unless `withTeam()` was passed; the keyring
+     * engines are linked only by the active strategy, not by this file. */
+    private readonly teamStrategy;
     private readonly sessionStrategy;
     private readonly syncStrategy;
     private readonly snapshots;
@@ -14882,7 +15162,7 @@ declare class Noydb {
     private readonly translatorCache;
     /** Audit log for all translator invocations in this session. Cleared on `close()`. */
     private readonly _translatorAuditLog;
-    constructor(options: ResolvedNoydbOptions);
+    constructor(options: ResolvedNoydbOptions$1);
     /** @internal — resolved forget strategy (NO_FORGET when not configured). */
     get _forgetStrategy(): ForgetStrategy;
     private resetSessionTimer;
@@ -14922,6 +15202,7 @@ declare class Noydb {
      *
      * The legacy `requireReAuthFor: ['grant']` session-policy check still
      * fires on top — both are independent opt-ins.
+     * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
      */
     grant(vault: string, options: GrantOptions, factors?: FactorProofBundle): Promise<void>;
     /**
@@ -14932,6 +15213,7 @@ declare class Noydb {
      *
      * The legacy `requireReAuthFor: ['revoke']` session-policy check still
      * fires on top — both are independent opt-ins.
+     * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
      */
     revoke(vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
     /**
@@ -14945,8 +15227,9 @@ declare class Noydb {
      * owner-only invariant even if a host mis-configures the gate.
      */
     grantCustodian(vault: string, options: Omit<GrantOptions, 'role'>, factors?: FactorProofBundle): Promise<void>;
-    /** @internal — the grant-custodian engine, reached only when withCustody() is opted in. */
-    _grantCustodianImpl(vault: string, options: Omit<GrantOptions, 'role'>, factors?: FactorProofBundle): Promise<void>;
+    /** @internal — grant-custodian engine, reached only via withCustody(); the
+     * keyring engine arrives as an argument so the floor never carries it (#267). */
+    _grantCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions) => Promise<void>, vault: string, options: Omit<GrantOptions, 'role'>, factors?: FactorProofBundle): Promise<void>;
     /**
      * Revoke a custodian (owner-only custody API).
      *
@@ -14955,8 +15238,9 @@ declare class Noydb {
      * 'owner'` check, so an admin cannot unwind a custodianship.
      */
     revokeCustodian(vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
-    /** @internal — the revoke-custodian engine, reached only when withCustody() is opted in. */
-    _revokeCustodianImpl(vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
+    /** @internal — revoke-custodian engine, reached only via withCustody().
+     * Mirrors `_grantCustodianImpl` (#267: engine passed in). */
+    _revokeCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
     /**
      * Mutate post-grant identity fields on an existing keyring — `role`,
      * `displayName`, and/or `permissions`. Pure plaintext-header rewrite:
@@ -15015,6 +15299,7 @@ declare class Noydb {
      * Exposed on Noydb (rather than only on the lower-level keyring
      * module) so CLI and admin tooling can trigger rotation without
      * reaching into internals. See `noy-db rotate` for the CLI wrapper.
+     * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
      */
     rotate(vault: string, collections: string[]): Promise<void>;
     /** List all users with access to a vault. */
@@ -15962,6 +16247,12 @@ interface CollectionOpts<T> {
      * unbounded lazy cache defeats the purpose.
      */
     cache?: CacheOptions | undefined;
+    /**
+     * Lazy service seam (#267) — supplies the bounded-LRU working-set cache
+     * when `prefetch: false`. Omitted → the deprecated IMPLICIT_LAZY
+     * back-compat default (identical behavior + one-time warn).
+     */
+    lazyStrategy?: LazyStrategy | undefined;
     /**
      * Optional Standard Schema v1 validator (Zod, Valibot, ArkType,
      * Effect Schema, etc.). When set, every `put()` is validated before
@@ -16023,6 +16314,16 @@ interface CollectionOpts<T> {
     /** — outbound ref declarations (snapshot from vault refRegistry). Used by describe(). */
     declaredRefs?: Record<string, RefDescriptor> | undefined;
     computed?: ComputedFields | undefined;
+    /** — declare classified() sensitive-field descriptors (sealed + riders + projections). */
+    classifiedFields?: Record<string, ClassifiedEntry> | undefined;
+    /**
+     * The forget-cascade subject key for this collection (from
+     * `withForgetCascade({ subjects })`), plumbed by the Vault. Consumed by the
+     * classified refusal matrix (R4: a digest-only field cannot be the subject key).
+     */
+    subjectKeyField?: string | undefined;
+    /** — tree-shake seam for `collection.reveal()`. Defaults to `NO_CLASSIFIED`. */
+    classifiedStrategy?: ClassifiedStrategy | undefined;
     /**
      * async callback that resolves a dict key to its label
      * for a given locale. Provided by the Vault.
@@ -16079,7 +16380,7 @@ interface CollectionOpts<T> {
      * outside a consent scope the callback is a no-op. Awaited so a
      * thrown audit write surfaces to the caller.
      */
-    onAccess?: (op: 'get' | 'put' | 'delete', id: string) => Promise<void>;
+    onAccess?: (op: 'get' | 'put' | 'delete' | 'reveal' | 'verify' | 'find', id: string) => Promise<void>;
     /**
      * invoked by `put`/`delete` before any adapter
      * write. Receives the prior envelope timestamp + decrypted
@@ -16109,6 +16410,13 @@ interface CollectionOpts<T> {
      * any deterministic field is declared. Any other value throws.
      */
     acknowledgeDeterministicRisk?: boolean | undefined;
+    /**
+     * gate for the classified `equatable` knob (R8 double door). Must be `true`
+     * when any classified field declares `equatable: true`; otherwise construction
+     * throws. One-directional — setting it with zero equatable members is a
+     * silent no-op (mirrors `acknowledgeDeterministicRisk`).
+     */
+    acknowledgeEquatableRisk?: boolean | undefined;
     /**
      * Structural group-encryption. Fields listed here are
      * encrypted into their own `_sealed[field]` envelope slot — each under
@@ -16461,6 +16769,35 @@ declare class Collection<T, S extends keyof T = never, Q extends keyof T & strin
      * the same MV-pre-creation reconcile as {@link moneyFields}.
      */
     private computed;
+    /**
+     * Resolved classified() sensitive-field descriptors, declared via the
+     * `classifiedFields` collection option. Mutable so {@link _applyClassifiedFields}
+     * can attach a declaration to a collection MV-analysis pre-created.
+     */
+    private classified;
+    /**
+     * Frozen construction-time facts the refusal matrix (R1-R5) checks against.
+     * Stored so {@link _applyClassifiedFields} — door 2, the reconcile seam —
+     * can re-run the SAME guard the config resolver ran at door 1 (C5's lesson:
+     * crdt/conflictPolicy/perRecordKeys are construction-only but
+     * classifiedFields can attach later).
+     */
+    private readonly classifiedGuardCtx;
+    /**
+     * Digest-only classified fields (`storage: 'digest-only'`), keyed by field
+     * name — the enclave-consumable policy map the codec's write path carries
+     * `_vdig` forward under (C6). `null` when the collection declares none.
+     */
+    private readonly vdigFields;
+    /** C-A/R10 memoization: marker declared-set lookup (undefined=unresolved) + classified-handle persist-once flag. */
+    private _markerDigestOnlyCache;
+    private _markerPersisted;
+    /**
+     * Tree-shake seam for `reveal()` — defaults to `NO_CLASSIFIED`, which
+     * throws `ClassifiedNotEnabledError`. Set via the `classifiedStrategy`
+     * `createNoydb()` option (opt in with `withClassified()`).
+     */
+    private readonly classifiedStrategy;
     /**
      * Async callback provided by the Vault that resolves a dict key
      * to its label for a given locale. Used by the locale-read path for
@@ -16666,6 +17003,70 @@ declare class Collection<T, S extends keyof T = never, Q extends keyof T & strin
     private describeAsync;
     /** JSON Schema for this collection with describe() metadata as x- extensions. */
     toJSONSchema(): Promise<object>;
+    /** Single-point audited reveal of one classified field. Requires withClassified(). */
+    reveal(id: string, field: string): Promise<unknown>;
+    /** Verify-without-reveal: verdict-only oracle for one classified field. Requires withClassified(). */
+    verify(id: string, field: string, candidate: string): Promise<ClassifiedVerdict>;
+    /** k-of-n challenge over the collection's secretAnswer members. Requires withClassified(). */
+    verifyGroup(id: string, answers: Record<string, string>, opts: {
+        readonly min: number;
+    }): Promise<{
+        readonly passed: boolean;
+    }>;
+    private _classifiedVerifyCtx;
+    /**
+     * Equatable blind-index lookup: the ids whose classified digest-only
+     * `equatable` field carries a `_bidx` tag matching `candidate` AND whose
+     * `_vdig` payload confirms it. Requires the field to be declared
+     * `classified.password({ equatable: true })` (or `secretAnswer`) and the
+     * collection to have opened its `acknowledgeEquatableRisk` door.
+     *
+     * The algorithm order is load-bearing (spec §3):
+     *  1. Caller-bug refusals thrown at ~0 elapsed, BEFORE any PBKDF2 (R9 /
+     *     Oracle #6): the three field mis-declarations share ONE constant,
+     *     field-name-free message so the refusal text cannot enumerate which
+     *     fields are classified / digest-only / equatable.
+     *  2. Derive the ONE blind-index target UNCONDITIONALLY (I-1 / F1): an empty
+     *     collection still pays exactly one 600K PBKDF2, so wall-time can never
+     *     distinguish "no records" from "no match". No early return may precede
+     *     this line.
+     *  3. Scan `list + one get` per id, string-comparing the stored `_bidx` tag —
+     *     decrypting NOTHING — and retain each hit's already-fetched envelope.
+     *  4. Emit the single sweep consent op (`onAccess('find', '*')`) now — after
+     *     the scan, before confirm (Oracle #5) — fixing its store-write timestamp
+     *     independent of hit count.
+     *  5. Confirm-by-verify against the ALREADY-FETCHED envelope (C-B): run the
+     *     enclave `verifyDigestField` on an in-memory `getEnvelope` closure so the
+     *     confirm reads ZERO additional envelopes. A tag-hit whose `_vdig` fails
+     *     to confirm is dropped silently (a splice is indistinguishable from a
+     *     stale tag). Store-shape law: the only store calls are `list + N get`.
+     */
+    findByDigest(field: string, candidate: string): Promise<readonly string[]>;
+    /**
+     * Retire a field's equatable blind-index (`_bidx`) coverage across every
+     * live record — the SOLE lazy-write-independent drop-path for a still-live
+     * record's tag (besides clear / `forget()` / DEK-rotation). For each envelope
+     * carrying `_bidx[field]`, rewrite it WITHOUT that slot (dropping the whole
+     * `_bidx` map when it becomes empty), leaving `_vdig[field]` and everything
+     * else INTACT — the field stays `digest-only`, only the index coverage is
+     * retired. NO crypto, NO re-mint, NO re-encrypt: a targeted envelope rewrite.
+     * Returns the count of records scrubbed.
+     *
+     * This is a maintenance write, not a read-egress: it emits NO `'find'` op and
+     * no consent. The field is validated to a declared equatable digest-only
+     * classified field (only such a field ever carries `_bidx`).
+     *
+     * **Ledger consistency**: dropping `_bidx[field]` changes the envelope's
+     * payload hash (`_bidx` is bound into `envelopeBodyForHash`), so a raw
+     * `adapter.put` of the scrubbed envelope WITHOUT a matching ledger entry would
+     * desync the chain and make a future integrity cross-check flag false
+     * tampering. After each rewrite we therefore append an `op:'migration'` entry
+     * recording the NEW payloadHash at the SAME version — this is index retirement,
+     * not a new record version, so `_v` is NOT bumped; the migration op is
+     * reverse-delta-inert (`ledger.reconstruct` skips non-put/delete ops) yet
+     * keeps the hash chain and the record's latest recorded payloadHash correct.
+     */
+    scrubEquatableTags(field: string): Promise<number>;
     /**
      * @internal — attach money descriptors post-construction. MV dependency
      * analysis auto-creates a source collection (without options) during
@@ -16679,6 +17080,16 @@ declare class Collection<T, S extends keyof T = never, Q extends keyof T & strin
     _applyFieldMeta(fieldMeta: Record<string, FieldMeta>): void;
     /** @internal — attach collection-level meta post-construction. See {@link _applyMoneyFields}. First-wins. */
     _applyMeta(meta: CollectionMeta): void;
+    /**
+     * @internal — attach classified fields post-construction. See {@link _applyMoneyFields}.
+     * First-wins. Note: unlike money/computed/meta, this cannot retro-seal a
+     * collection that was already auto-created — `sensitiveFields` is frozen at
+     * construction time. A reconciled declaration is only accepted when none of
+     * its members are `storage: 'recoverable'` (those require sealing at first
+     * open); otherwise this throws rather than silently persisting the value as
+     * inline plaintext while `describe()` advertises protection.
+     */
+    _applyClassifiedFields(classifiedFields: Record<string, ClassifiedEntry>): void;
     /** @internal — used only in tests; do not read in production code. */
     get _ramCiphertext(): boolean;
     /**
@@ -16798,6 +17209,17 @@ declare class Collection<T, S extends keyof T = never, Q extends keyof T & strin
      * cache directly (no extra I/O), matching the previous behaviour exactly.
      */
     private resolvePriorValues;
+    /** Resolves the prior envelope/record for a gate event; elides the read (#267) when no handler at `point` needs it (`elided: true`, `env`/`record` null). */
+    private resolveGatePrior;
+    /**
+     * Wraps {@link RecordCodec.toCacheRecord} with an additional strip for
+     * digest-only classified fields: the codec already omits them from `_data`
+     * on write, but the write path caches the pre-encrypt `record` object
+     * directly (to skip a redundant decrypt) — without this, a vdig field's
+     * plaintext would sit in the working-set cache and `get()` would leak it
+     * right back out, defeating C6.
+     */
+    private _toCacheableRecord;
     /** @internal Untracked put body — call {@link put}, not this. */
     private _putInternal;
     /**
@@ -17520,6 +17942,10 @@ declare class Collection<T, S extends keyof T = never, Q extends keyof T & strin
      * CEK cache, live-envelope reader, and DEK resolver.
      */
     private resolveRecordCek;
+    /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
+    private _ensureClassifiedMarker;
+    /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
+    private _classifiedMarkerDigestOnly;
     /**
      * find the first record whose deterministic field matches
      * the given plaintext. Returns `null` when no match exists.
@@ -17574,8 +18000,7 @@ declare class Collection<T, S extends keyof T = never, Q extends keyof T & strin
      * Collection because `vault.ts` forget() reaches in via this name.
      */
     _classifySealedShred(live: EncryptedEnvelope): Promise<{
-        shreddable: string[];
-        dekResidue: string[];
+        readonly slots: readonly SealedShredSlot[];
     }>;
     /**
      * Bind the {@link TiersContext} the tier ops need. The `cekCache` is passed
@@ -17724,6 +18149,517 @@ interface TxStrategy {
     runDryRun(db: Noydb, fn: (tx: TxContext) => unknown): Promise<DryRunResult>;
 }
 
+/**
+ * Noydb-side auth / recovery / enrollment facade.
+ *
+ * Holds the tier-2 authenticator enrollment/unlock wrappers, WebAuthn
+ * enrollment, auth-config introspection, the tier-1 passphrase
+ * rotate/recover flows, the paper/Shamir recovery rotate/enroll flows,
+ * managed-passphrase recovery, peer-recovery, tier-3 PIN unlock, and the
+ * public `getKeyring` accessor.
+ *
+ * The near-parallel rotate/recover variants (managed vs user vs paper vs
+ * Shamir) are deliberately NOT consolidated. The
+ * keyring/active-tier/quick-unlock/policy caches stay `Noydb`-resident
+ * (shared by the kernel's unlock path) and arrive **by reference** through
+ * {@link TeamFacadeDeps}; the keyring-unlock path (`getKeyringInternal`),
+ * the policy gate (`checkGate`), the managed-recovery enrolment check
+ * (`assertRecoveryEnrolled`), `openVault`, and the one-shot
+ * managed-recovery skip flag stay kernel-resident and arrive as callbacks.
+ *
+ * Internal service — reached through `noydb.rotatePassphrase(...)` etc.
+ */
+
+/** NoydbOptions with the store resolved to a non-optional value (internal use only). */
+type ResolvedNoydbOptions = NoydbOptions & {
+    readonly store: NoydbStore;
+};
+/** Everything the moving auth/recovery/enrollment methods touched on the Noydb instance's `this.*`. */
+interface TeamFacadeDeps {
+    /** Resolved Noydb options (store, user, passphraseMode, sealingKey, shamirRecovery, …). */
+    readonly options: ResolvedNoydbOptions;
+    /** Live unlocked-keyring cache (Noydb-resident; read/written by reference). */
+    readonly keyringCache: Map<string, UnlockedKeyring>;
+    /** Per-vault active session tier (Noydb-resident; read/written by reference). */
+    readonly activeTier: Map<string, ActiveTier>;
+    /** Per-vault tier-3 quick-unlock state (Noydb-resident; read/written by reference). */
+    readonly quickUnlock: QuickUnlockStore;
+    /** Per-vault loaded policy cache (Noydb-resident; read/written by reference). */
+    readonly policyCache: Map<string, VaultPolicy>;
+    /** Evaluate the policy gate for an operation (kernel-resident). */
+    checkGate(vault: string, gate: GateName, factors?: FactorProofBundle): Promise<void>;
+    /** Legacy `requireReAuthFor` session-policy check (kernel-resident). */
+    checkPolicyOperation(vault: string, op: ReAuthOperation): void;
+    /** Live-reference keyring unlock path (kernel-resident). */
+    getKeyringInternal(vault: string, opts?: {
+        create: boolean;
+    }): Promise<UnlockedKeyring>;
+    /** Managed-recovery enrolment check (kernel-resident). */
+    assertRecoveryEnrolled(vault: string, policy: VaultPolicy, opts?: {
+        skipManagedCheck?: boolean;
+    }): Promise<void>;
+    /** Open (or create) a vault (kernel-resident). */
+    openVault(vault: string, opts?: {
+        locale?: string;
+    }): Promise<Vault>;
+    /** Toggle the one-shot managed-mode strong-recovery bypass flag (kernel-resident). */
+    setSkipNextManagedRecoveryCheck(value: boolean): void;
+}
+declare class TeamFacade {
+    private readonly deps;
+    constructor(deps: TeamFacadeDeps);
+    private requireShamirProvider;
+    /** Gate + run a `grant` engine. See `Noydb.grant` for the public contract. */
+    runGrant(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions) => Promise<void>, vault: string, options: GrantOptions, factors?: FactorProofBundle): Promise<void>;
+    /** Gate + run a `revoke` engine. See `Noydb.revoke` for the public contract. */
+    runRevoke(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
+    /** Gate + run a `rotateKeys` engine. See `Noydb.rotate` for the public contract. */
+    runRotate(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, collections: string[]) => Promise<void>, vault: string, collections: string[]): Promise<void>;
+    /**
+     * Add a tier-2 authenticator slot to the calling user's keyring.
+     * Each slot independently wraps the SAME KEK under a method-specific
+     * key — adding a slot is a constant-time keyring write.
+     *
+     * The wrapping ciphertext is produced by the corresponding
+     * `@noy-db/on-*` package (e.g. `enrollPasswordAuthenticator` from
+     * `@noy-db/on-password`); the hub persists the result.
+     *
+     * Gated by `enroll-authenticator`; `presented` carries any factor
+     * proofs the active policy demands.
+     */
+    enrollAuthenticator(vault: string, options: EnrollAuthenticatorOptions, factors?: FactorProofBundle): Promise<void>;
+    /**
+     * Remove a tier-2 authenticator slot. Idempotent — removing a
+     * non-existent slot is a successful no-op. Gated by
+     * `remove-authenticator`.
+     */
+    removeAuthenticator(vault: string, slotId: string, factors?: FactorProofBundle): Promise<void>;
+    /** Read the slot list for a vault. Internal — `describeAuthConfig` consumes this. */
+    listAuthenticators(vault: string): Promise<ReadonlyArray<KeyringAuthenticator>>;
+    /**
+     * Mutate the `meta` blob on an existing authenticator slot — slot
+     * rename, label change, attachment of UI hints. The slot's `id`,
+     * `method`, and wrap material (`wrapped_kek` / `wrapped_deks` + `iv`)
+     * are immutable through this method. Anti-slot-swap is structural,
+     * not gate-driven.
+     *
+     * `meta` patch semantics (top-level merge):
+     *   - Top-level merge — absent keys preserved
+     *   - `null` value — delete that meta key
+     *   - Other values — replace verbatim
+     *
+     * Use case: per-slot nickname for "iPhone Touch ID" vs "MacBook
+     * Touch ID" disambiguation in admin UIs. The slot id (auto-derived
+     * from credentialId prefix) is not human-friendly; `meta.nickname`
+     * is.
+     *
+     * Gated by `update-authenticator`. PERSONAL_POLICY: tier-1 unlock
+     * alone (matches enroll/remove). STRICT_POLICY: tier-1 +
+     * TOTP/email-OTP factor proof — a malicious rename on a shared
+     * workstation could mislead the user about which device a slot
+     * corresponds to, so STRICT requires fresh factor binding.
+     *
+     * @throws `NoAccessError` when no slot with the given id exists.
+     * @throws `ValidationError` when no patch field is provided.
+     */
+    updateAuthenticator(vault: string, slotId: string, options: UpdateAuthenticatorOptions, factors?: FactorProofBundle): Promise<void>;
+    /**
+     * Native WebAuthn enrollment using the **real** internal keyring.
+     *
+     * Why this exists: when a consumer is using `createNoydb({ secret })`,
+     * they cannot reach the live `UnlockedKeyring` to feed it to
+     * `enrollWebAuthn(keyring, vault, opts)` from `@noy-db/on-webauthn`.
+     * Constructing a synthetic keyring (the previous workaround) produces
+     * a slot whose `wrapped_kek` references the synthetic payload, not
+     * the live session — so `unlockViaAuthenticator()` later replaces the
+     * live DEK map with stale wrapped DEKs and every decrypt fails.
+     *
+     * This method runs `ceremony` with the REAL keyring (still in
+     * `keyringCache`). The ceremony performs the WebAuthn enrollment and
+     * returns the slot options that hub then persists via the standard
+     * tier-2 enrollAuthenticator path.
+     *
+     * Layering note: hub does not import `@noy-db/on-webauthn` (that
+     * would invert the dep graph). The consumer wires it in:
+     *
+     * ```ts
+     * import { enrollWebAuthn } from '@noy-db/on-webauthn'
+     *
+     * await db.enrollWebAuthn('demo', async (keyring) => {
+     *   const e = await enrollWebAuthn(keyring, 'demo', { rp: {...} })
+     *   return {
+     *     id: `webauthn-${e.credentialId.slice(0, 8)}`,
+     *     method: 'webauthn',
+     *     wrapped_kek: e.wrappedPayload,
+     *     meta: {
+     *       credentialId: e.credentialId,
+     *       wrapIv: e.wrapIv,
+     *       prfUsed: e.prfUsed,
+     *       beFlag: e.beFlag,
+     *       requireSingleDevice: e.requireSingleDevice,
+     *     },
+     *   }
+     * })
+     * ```
+     *
+     * Returns the WebAuthn `credentialId` (extracted from `meta.credentialId`)
+     * for the caller's lookup index (a bootstrap vault, a PublicEnvelope,
+     * a server-side allowlist).
+     *
+     * Gated by `enroll-authenticator` like `enrollAuthenticator()` itself.
+     */
+    enrollWebAuthn(vault: string, ceremony: (keyring: UnlockedKeyring) => Promise<EnrollAuthenticatorOptions>, factors?: FactorProofBundle): Promise<{
+        credentialId: string;
+    }>;
+    /**
+     * Filter the slot list to webauthn-method slots only. Useful for
+     * "you have N WebAuthn credentials enrolled" UI surfaces and for
+     * deciding when a new device prompt should appear. Identity is
+     * `id` + `enrolled_at`; the `meta.credentialId` (base64) is used by
+     * `allowCredentials` at unlock time.
+     */
+    listWebAuthnSlots(vault: string): Promise<ReadonlyArray<{
+        id: string;
+        enrolledAt: string;
+        credentialId: string;
+    }>>;
+    /**
+     * Resolve a slot by id, then hand the wrapped-KEK ciphertext + meta
+     * to the caller-supplied verifier. The verifier is the
+     * `unlockWith*` function from the corresponding `@noy-db/on-*`
+     * package, e.g. `unlockWithPassword(slot, password)`.
+     *
+     * On success, mark the active session tier as 2 — subsequent
+     * `checkGate` calls see a tier-2 unlock.
+     */
+    unlockViaAuthenticator(vault: string, slotId: string, verify: (slot: KeyringAuthenticator) => Promise<UnlockedKeyring>): Promise<UnlockedKeyring>;
+    /** English summary of the configured auth model. */
+    describeAuthConfig(vault: string): Promise<string>;
+    /** Mermaid `flowchart TB` source for the auth graph. */
+    diagramAuthConfig(vault: string): Promise<string>;
+    /**
+     * Per-user enrollment summary. Gated by `view-user-auth` (default:
+     * disabled). Sanitization is allowlist-based — never renders cred
+     * ids, password hashes, secrets, or any field outside the allowlist.
+     */
+    describeUserAuth(vault: string, userId: string, factors?: FactorProofBundle): Promise<string>;
+    /** Bulk variant for owner dashboards. Gated by `view-user-auth`. */
+    describeAllUsersAuth(vault: string, factors?: FactorProofBundle): Promise<Array<{
+        userId: string;
+        description: string;
+    }>>;
+    /**
+     * Rotate the user's passphrase (user remembers old). Validates the
+     * new phrase against the configured `passphrase` policy, runs the
+     * `rotate-passphrase` gate, then re-derives + re-wraps every DEK.
+     *
+     * Tier-2 authenticator slots are dropped — each slot wraps the old
+     * KEK and would need its derivation key to be re-presented. Re-enrol
+     * via `db.enrollAuthenticator` after rotation.
+     *
+     * @throws `WeakPassphraseError` on a weak new phrase.
+     * @throws `PolicyDeniedError` when the gate denies (missing factor, …).
+     * @throws `InvalidKeyError` when `oldPassphrase` is wrong.
+     */
+    rotatePassphrase(vault: string, input: RotatePassphraseInput, factors?: FactorProofBundle): Promise<void>;
+    /**
+     * Reset the passphrase using a recovery proof (user forgot the old).
+     * Currently supports the `'paper'` profile end-to-end; the
+     * other profiles throw {@link RecoveryProfileNotImplementedError}.
+     *
+     * Burns the used recovery entry on success.
+     */
+    recoverPassphrase(vault: string, input: RecoverPassphraseInput, factors?: FactorProofBundle): Promise<RecoverPassphraseResult>;
+    /**
+     * Deliberate paper-recovery-code regeneration. User knows their
+     * passphrase but wants a fresh sheet — they lost the printout or
+     * suspect compromise of the off-site copy.
+     *
+     * Symmetric to {@link rotatePassphrase} for the recovery profile:
+     * gated, audit-trackable, ergonomic. Replaces (not appends) the
+     * paper sheet under `_meta/recovery-paper` in a single envelope `put`.
+     *
+     * Gated by the `rotate-recovery` policy gate:
+     *   - PERSONAL_POLICY: `{ minTier: 1 }` — knowing the passphrase
+     *     suffices, matching the lower-level flow's bar.
+     *   - STRICT_POLICY: `{ minTier: 1, factors: [{ anyOf: ['totp',
+     *     'email-otp', 'webauthn-roaming'] }] }` — rotation is an
+     *     off-site-trust event; require an off-device factor so a
+     *     stolen unlocked laptop cannot silently mint a sheet for the
+     *     attacker.
+     *
+     * Defaults `count` to the existing sheet size so consumers aren't
+     * surprised by a different code count. Explicit `count` overrides.
+     *
+     * @throws {@link RecoveryProfileNotImplementedError} when `profile`
+     *         is anything other than `'paper'` (v1 dispatch limit).
+     * @throws {@link PolicyDeniedError} when the gate denies (missing
+     *         factor, tier mismatch, ...).
+     * @throws on missing paper sheet — "nothing to rotate" surfaces as
+     *         an error rather than silently minting an entire new sheet.
+     *
+     * @example Default count + show-once UI
+     * ```ts
+     * const { newCodes } = await db.rotateRecovery('acme', { profile: 'paper' })
+     * showCodesToUser(newCodes)
+     * ```
+     *
+     * @example STRICT-policy site with TOTP factor proof
+     * ```ts
+     * await db.rotateRecovery(
+     *   'acme',
+     *   { profile: 'paper', count: 10 },
+     *   { factors: [{ kind: 'totp', proof: '123456' }] },
+     * )
+     * ```
+     */
+    rotateRecovery(vault: string, options: RotateRecoveryOptions, factors?: FactorProofBundle): Promise<RotateRecoveryResult>;
+    private rotateRecoveryPaper;
+    private rotateRecoveryShamir;
+    /**
+     * **Atomic create-and-enroll for managed-mode vaults.**
+     *
+     * Bootstraps a managed-mode vault and enrolls strong recovery in
+     * a single ceremony. Under `passphraseMode: 'managed'`, every
+     * `openVault` call requires a strong recovery profile (Shamir
+     * today) to be enrolled — otherwise it throws
+     * {@link ManagedRecoveryNotEnrolledError}. This method bypasses
+     * the check temporarily so the keyring can be created, enrolls
+     * the supplied recovery profile(s), then returns the vault.
+     *
+     * For Shamir enrollments, the show-once share strings come back
+     * in `recoveryEnrollments[i].shares`. The hub never retains them
+     * — the caller MUST display them to the user (once) before any
+     * subsequent operation.
+     *
+     * Paper alone is NOT a strong profile under managed mode; passing
+     * `{ profile: 'paper', ... }` without an accompanying shamir entry
+     * is rejected at validation time.
+     *
+     * ```ts
+     * const db = await createNoydb({
+     *   store, user: 'alice',
+     *   passphraseMode: 'managed',
+     *   sealingKey: macosKeychainSealingProvider({ ... }),
+     * })
+     *
+     * const { vault, recoveryEnrollments } = await db.openVaultAndEnrollRecovery('acme', {
+     *   recovery: [{ profile: 'shamir', k: 2, n: 3 }],
+     * })
+     * for (const r of recoveryEnrollments) {
+     *   if (r.shares) showSharesToUser(r.shares)  // ONCE
+     * }
+     * ```
+     *
+     * @throws ValidationError if recovery is empty, or contains no
+     *   strong profile under managed mode.
+     */
+    openVaultAndEnrollRecovery(vault: string, opts: {
+        readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>;
+        readonly locale?: string;
+    }): Promise<{
+        readonly vault: Vault;
+        readonly recoveryEnrollments: ReadonlyArray<EnrollRecoveryResult>;
+    }>;
+    /**
+     * **Recovery flow under managed-passphrase mode.**
+     *
+     * Replaces the sealed passphrase of a managed-mode vault with a
+     * fresh 256-bit random, sealed under the configured
+     * `SealingKeyProvider`. The user never sees the new passphrase.
+     *
+     * Internally:
+     *   1. Verify the recovery proof (Shamir today) and unwrap the
+     *      DEK set.
+     *   2. Mint a fresh 256-bit random as the new effective passphrase.
+     *   3. Rewrap the DEK set under a fresh KEK derived from the new
+     *      passphrase (via the existing `recoverPassphrase` path).
+     *   4. Seal the random bytes under the provider and overwrite
+     *      `_meta/sealed-passphrase`.
+     *   5. Drop the keyring cache so the next operation re-derives.
+     *
+     * The vault's strong-recovery enrollment is preserved across
+     * recovery (Shamir entries are not burned on use).
+     *
+     * @throws ValidationError if the Noydb instance is not in managed mode.
+     */
+    recoverManagedPassphrase(vault: string, options: {
+        readonly recoveryProof: RecoveryProof;
+        readonly passphrasePolicy?: PassphrasePolicy;
+    }): Promise<void>;
+    /**
+     * Atomic peer-recovery — re-wraps an EXISTING user's keyring under
+     * a fresh temp passphrase in a single store write. Closes the
+     * partial-failure window (the previous compose-from-primitives
+     * pattern was `db.revoke + db.grant`, two writes — if the issuer
+     * cancelled between them the target was locked out entirely).
+     *
+     * Different from `db.revoke + db.grant`:
+     *
+     *   - Same `userId`, role, permissions, capabilities preserved.
+     *   - DEKs unchanged → every other principal in the vault keeps
+     *     access. No key rotation.
+     *   - Allows owner→owner natively. The existing
+     *     `db.revoke` retains its block — peer-recovery is a separate,
+     *     intentionally-named operation.
+     *   - Tier-2 slots dropped (they wrap the old KEK).
+     *
+     * Gated by `peer-recover-user`; `STRICT_POLICY` requires a
+     * recovery / TOTP / email-OTP factor proof at the moment of
+     * recovery, so the issuer affirmatively re-asserts identity.
+     *
+     * The recipient should call `db.rotatePassphrase` on first session
+     * to choose their own phrase — the temp acts as a single-use
+     * bridge.
+     *
+     * ```ts
+     * await db.recoverUser('acme', {
+     *   userId: 'bob',
+     *   passphrase: 'temporary-correct-horse-battery-staple-printer',
+     * }, { factors: [{ kind: 'recovery' }] })
+     * // Bob opens createNoydb({ user: 'bob', secret: tempPhrase })
+     * // and immediately calls db.rotatePassphrase to set his own.
+     * ```
+     *
+     * @throws `NoAccessError` when no keyring exists for the target.
+     * @throws `PermissionDeniedError` when the caller's role can't
+     *         recover the target's role (admin→owner is blocked even
+     *         under recovery).
+     * @throws `PrivilegeEscalationError` when the caller lacks a DEK
+     *         the target previously had access to.
+     *
+     */
+    recoverUser(vault: string, options: RecoverUserOptions, factors?: FactorProofBundle): Promise<void>;
+    /**
+     * Persist a recovery enrollment. Accepts the `'paper'`
+     * profile.
+     *
+     * The hub wraps the user's DEK set (not the KEK) under a code-derived
+     * AES-GCM key — see `team/recovery.ts` for the rationale. The mint
+     * helper {@link mintPaperRecoveryEntry} is the canonical primitive;
+     * pair it with `db.getKeyring(vault)` to obtain the live DEK set:
+     *
+     * ```ts
+     * import { mintPaperRecoveryEntry } from '@noy-db/hub'
+     *
+     * const keyring = await db.getKeyring('acme')
+     * const codes: string[] = ['CORRECT-HORSE-1', 'BATTERY-STAPLE-2', ...]
+     * const entries = await Promise.all(
+     *   codes.map((code, i) => mintPaperRecoveryEntry(keyring.deks, code, `code-${i}`)),
+     * )
+     * await db.enrollRecovery('acme', { profile: 'paper', entries })
+     * showCodesToUser(codes)
+     * ```
+     *
+     * `@noy-db/on-recovery`'s `generateRecoveryCodeSet`
+     * delegates to `mintPaperRecoveryEntry` internally — its output is
+     * fed directly to this API. Pick whichever fits your code-gen layer:
+     *
+     * ```ts
+     * import { generateRecoveryCodeSet } from '@noy-db/on-recovery'
+     * const { codes, entries } = await generateRecoveryCodeSet({ deks: keyring.deks, count: 8 })
+     * await db.enrollRecovery('acme', { profile: 'paper', entries })
+     * ```
+     */
+    enrollRecovery(vault: string, enrollment: RecoveryEnrollmentInput): Promise<EnrollRecoveryResult>;
+    /** Read the persisted recovery entries (paper + Shamir). Used by `describeAuthConfig`. */
+    listRecoveryEntries(vault: string): Promise<{
+        paper: ReadonlyArray<PaperRecoveryEntry>;
+        shamir: ReadonlyArray<ShamirRecoveryEntry>;
+    }>;
+    /**
+     * Register a tier-3 quick-unlock state for the vault. The state is
+     * an opaque blob produced by `@noy-db/on-pin/enrollPin` (or any
+     * compatible primitive). It is held in memory only — never persisted
+     * — and auto-clears when its `expiresAt` elapses.
+     *
+     * Gated by `rotate-unlock` (the same gate covers "set" and "rotate"
+     * because tier-3 is a single-slot rolling secret).
+     */
+    enrollUnlock(vault: string, state: QuickUnlockState, factors?: FactorProofBundle): Promise<void>;
+    /**
+     * Resume a session via the registered tier-3 state. The verifier is
+     * `@noy-db/on-pin/resumePin` (or compatible). On success, mark the
+     * active session tier as 3 — every operation must re-authenticate at
+     * tier 2 to elevate.
+     *
+     * Returns `undefined` (caller should fall back to tier 2) when no
+     * tier-3 state is registered.
+     */
+    unlockViaPin(vault: string, resume: (state: QuickUnlockState) => Promise<UnlockedKeyring>): Promise<UnlockedKeyring | undefined>;
+    /** Drop the tier-3 state for a vault — explicit logout. */
+    clearQuickUnlock(vault: string): void;
+    /**
+     * Public accessor for the unlocked keyring of a vault.
+     *
+     * Returns a **defensive shallow copy** so consumers can read the DEK
+     * map and authenticator list without the risk of mutating the hub's
+     * internal cache. Internal hub code paths use a live reference
+     * via `getKeyringInternal`; ceremonies and external consumers always
+     * get a snapshot.
+     *
+     * The CryptoKey values inside `deks` are not cloned — Web Crypto
+     * keys are opaque handles, and a shared handle is intentional
+     * (encrypt / decrypt go through the same key the cache holds).
+     * Only the container Map / authenticator array is fresh.
+     *
+     * Used by `@noy-db/on-*` ceremonies that need the live DEK set
+     * (paper recovery via {@link mintPaperRecoveryEntry}, tier-3 PIN
+     * enrolment via on-pin's `enrollPin`, custom on-* ceremonies that
+     * don't have a hub-side wrapper).
+     *
+     * No new permission gate — this is an accessor over already-unlocked
+     * state. The keyring is materialized only after the calling session
+     * has unlocked the vault at tier 1, 2, or 3, so exposing it does not
+     * widen access. Throws `ValidationError` when encryption is enabled
+     * and no `secret` / `getKeyring` is configured.
+     *
+     * ```ts
+     * const keyring = await db.getKeyring('acme')
+     * // keyring.deks: Map<collection, CryptoKey>
+     * // keyring.kek:  CryptoKey | null   (null for tier-3 / wrap-DEKs sessions)
+     * // keyring.role / .permissions / .authenticators
+     * ```
+     */
+    getKeyring(vault: string): Promise<UnlockedKeyring>;
+}
+
+/**
+ * Multi-user team capability contract (#267 Track A tail — the
+ * keyring-grant → team split). Lives on the `/with` port (the one seam the
+ * kernel spine may import statically) so `Noydb` can hold the `NO_TEAM`
+ * floor default without a spine→service static import.
+ *
+ * The active engine (`withTeam()` in `with-party/team/active.ts`)
+ * statically links the grant/revoke/rotate keyring engines from
+ * `keyring.ts` — bundle-charged to consumers of the `@noy-db/hub/team`
+ * subpath, never to the single-user floor. {@link NO_TEAM} (the floor
+ * default) throws {@link TeamNotEnabledError}.
+ *
+ * `Noydb.grant` / `Noydb.revoke` / `Noydb.rotate` delegate here, passing
+ * their `TeamFacade` — the facade owns the policy-gate + keyring plumbing
+ * (`runGrant` / `runRevoke` / `runRotate`) and receives the engine as an
+ * argument from the strategy.
+ *
+ * Deliberately NOT gated (single-user primitives): owner keyring creation,
+ * unlock, `listUsers`, `updateUser`, passphrase rotate/recover, and the
+ * `createDeedOwner` free function (no createNoydb instance to gate against —
+ * the same carve-out as `liberateVault`).
+ * @internal
+ */
+
+interface TeamStrategy {
+    grant(team: TeamFacade, vault: string, options: GrantOptions, factors?: FactorProofBundle): Promise<void>;
+    revoke(team: TeamFacade, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
+    rotate(team: TeamFacade, vault: string, collections: string[]): Promise<void>;
+}
+/**
+ * No-op stub — the floor default. Every multi-user team operation throws
+ * {@link TeamNotEnabledError}; opt in with `teamStrategy: withTeam()` in
+ * createNoydb. @internal
+ */
+declare const NO_TEAM: TeamStrategy;
+
 /**
  * Session policies —
  *
@@ -17978,6 +18914,24 @@ interface EncryptedEnvelope {
      * map is absent and `_data` is unchanged (byte-identical to legacy output).
      */
     readonly _sealed?: Record<string, string>;
+    /**
+     * Verify-digest slots (classified stage 2). Map of digest-only field name →
+     * AES-256-GCM `iv:data` blob sealed under the HKDF(CEK) vdig slot key with
+     * AAD ['noydb-classify-vdig', collection, recordId, field]. The store sees
+     * only ciphertext; only the enclave verify path can read the digest. At most
+     * one of `_sealed[field]` / `_vdig[field]` exists per field (I4).
+     */
+    readonly _vdig?: Record<string, string>;
+    /**
+     * Equatable blind-index tags (classified slice 2b). Map of digest-only field
+     * name → base64 33-byte tag (1-byte cost/version discriminator ‖ 32-byte keyed
+     * MAC), CURRENT VALUE ONLY (the _vdig ring is never indexed). This is the ONLY
+     * store-visible classified artifact: a keyed MAC, comparable without a key
+     * ceremony, with NO inline cryptographic integrity by construction. Invariant:
+     * _bidx[field] present ⇒ _vdig[field] present. Confirm-by-verify (findByDigest)
+     * makes any read-side orphan/splice unreturnable.
+     */
+    readonly _bidx?: Record<string, string>;
     /**
      * Per-record content-encryption key (CEK), base64 AES-KW-wrapped under
      * the collection (or tier) DEK. Present only on records written by a
@@ -18010,6 +18964,33 @@ interface EncryptedEnvelope {
      */
     readonly _debug?: typeof NOYDB_FORMAT_VERSION;
 }
+/** Spine policy for one digest-only classified field — the enclave-consumable
+ *  projection of a ClassifiedFieldSpec (the enclave never imports with-*). */
+interface VdigFieldPolicy {
+    readonly normalize: 'password' | 'secret-answer';
+    /** Ring size for reuse refusal; 0 = no ring. Cap 8 (spec Q4). */
+    readonly notLastN: number;
+    readonly rotateDays?: number;
+    /** default false — refused unless the double door is open (R8) */
+    readonly equatable: boolean;
+}
+/**
+ * The persisted classified-fields config marker (C-A / R10). Reuses the
+ * stage-2 persisted-schema record; this is the shape of the marker stored
+ * there.
+ */
+interface ClassifiedMarker {
+    /** field names declared digest-only (have _vdig); non-empty ⇒ writes need the classified codec */
+    readonly digestOnly: readonly string[];
+    /** field names additionally declared equatable (have _bidx when covered) */
+    readonly equatable: readonly string[];
+}
+/** Verdict-only egress of the enclave oracle (spec §3). */
+interface ClassifiedVerdict {
+    readonly ok: boolean;
+    /** I1: present ONLY when ok === true — never computed for a false verdict. */
+    readonly mustRotate?: true;
+}
 /**
  * Opaque access gate for a sealed (`sensitive`) field returned by a public
  * read (the access layer). The handle carries only the per-field
@@ -19814,6 +20795,13 @@ interface NoydbOptions {
      * signer engines are tree-shaken out.
      */
     readonly attestationStrategy?: AttestationStrategy;
+    /**
+     * Tree-shake seam — optional classified-field capability. Pass
+     * `withClassified()` from `@noy-db/hub/classified` to enable
+     * `collection.reveal()`. When omitted, `reveal()` throws
+     * `ClassifiedNotEnabledError` and the reveal engine is tree-shaken out.
+     */
+    readonly classifiedStrategy?: ClassifiedStrategy;
     /**
      * Tree-shake seam — optional sealed-record (grantor-side) capability. Pass
      * `withSealedRecord()` from `@noy-db/hub/sealed-record` to enable
@@ -19852,6 +20840,27 @@ interface NoydbOptions {
      * stays ungated (it has no createNoydb instance to gate against).
      */
     readonly custodyStrategy?: CustodyStrategy;
+    /**
+     * Tree-shake seam — optional multi-user team capability (#267
+     * keyring-grant → team split). Pass `withTeam()` from `@noy-db/hub/team`
+     * to enable `db.grant` / `db.revoke` / `db.rotate`. When omitted, those
+     * throw `TeamNotEnabledError` and the keyring grant/revoke/rotate engines
+     * are reached only via opt-in — the always-on floor is single-user.
+     * Single-user primitives (owner keyring, unlock, `listUsers`,
+     * `updateUser`, passphrase rotate/recover) stay ungated, as does the
+     * `createDeedOwner` free function (no createNoydb instance to gate
+     * against).
+     */
+    readonly teamStrategy?: TeamStrategy;
+    /**
+     * Opt-in seam — the `lazy` service (#267). Pass `withLazy()` from
+     * `@noy-db/hub/lazy` to explicitly enable lazy mode's bounded-LRU
+     * working set for collections declared with `prefetch: false`. When
+     * omitted, `prefetch: false` still works via the deprecated implicit
+     * back-compat path (identical behavior, one-time deprecation warn);
+     * the implicit path will be removed at 1.0.
+     */
+    readonly lazyStrategy?: LazyStrategy;
     /**
      * Tree-shake seam — optional search / retrieval capability. Pass
      * `withSearch()` from `@noy-db/hub` to enable a collection's `search`
@@ -20727,4 +21736,4 @@ interface NoydbPolicyDeps {
  */
 type NoydbPolicyFactory = (deps: NoydbPolicyDeps) => NoydbPolicyApi;
 
-export { BLOB_INDEX_COLLECTION as $, resolveI18nText as A, resolvePolicy as B, setAtPathInPlace as C, DICT_COLLECTION_PREFIX as D, staticDict as E, stripI18nFilled as F, validateI18nTextValue as G, type SessionStrategy as H, type I18nStrategy as I, SessionExpiredError as J, SessionNotFoundError as K, type Layer as L, MissingTranslationError as M, SessionPolicyError as N, type OnMissing as O, PolicyEnforcer as P, createEnforcer as Q, ReservedCollectionNameError as R, ScriptViolationError as S, TranslatorNotConfiguredError as T, UnknownDictCodeError as U, Vault as V, validateSessionPolicy as W, type BlobStrategy as X, BLOB_CHUNKS_COLLECTION as Y, BLOB_COLLECTION as Z, BLOB_EVICTION_AUDIT_COLLECTION as _, type DictEntry as a, type Reducer as a$, BLOB_SLOTS_PREFIX as a0, BLOB_VERSIONS_PREFIX as a1, type BlobEvictionEntry as a2, type BlobFieldPolicy as a3, type BlobFieldsConfig as a4, type BlobObject as a5, type BlobPutOptions as a6, type BlobResponseOptions as a7, BlobSet as a8, type BlobStrategyOpenArgs as a9, IDX_PREFIX as aA, type IndexDef as aB, type IndexState as aC, type IngestRow as aD, type LazyOrderBy as aE, LazyQuery as aF, type LazyQuerySource as aG, type OrderedEntry as aH, PersistedCollectionIndex as aI, type PersistedIndexDef as aJ, compositeKey as aK, decodeIdxId as aL, encodeIdxId as aM, isIdxId as aN, type AggregateStrategy as aO, type AggregateResult as aP, type AggregateSpec as aQ, Aggregation as aR, type AggregationUpstream as aS, GROUPBY_MAX_CARDINALITY as aT, GROUPBY_WARN_CARDINALITY as aU, GroupedAggregation as aV, GroupedQuery as aW, GroupedQueryN as aX, type GroupedRow as aY, type GroupedRowN as aZ, type LiveAggregation as a_, type CompactRunOptions as aa, type CompactionContext as ab, type CompactionResult as ac, DEFAULT_CHUNK_SIZE as ad, EXPORT_AUDIT_COLLECTION as ae, ExportBlobsAbortedError as af, type ExportBlobsAuditEntry as ag, type ExportBlobsHandle as ah, type ExportBlobsOptions as ai, type ExportedBlob as aj, type ObjectListEntry as ak, type ObjectMeta as al, type ObjectProjection as am, type ObjectUrlOptions as an, type PutObjectOptions as ao, type PutUrlOptions as ap, type SlotInfo as aq, type SlotRecord as ar, type VersionRecord as as, createExportBlobsHandle as at, memoryObjectProjection as au, runCompaction as av, type IndexStrategy as aw, COMPOSITE_DELIMITER as ax, CollectionIndexes as ay, type HashIndex as az, type DictKeyDescriptor as b, type SnapshotMeta as b$, type ReducerBuilder as b0, type ReducerOptions as b1, avg as b2, buildLiveAggregation as b3, count as b4, groupAndReduce as b5, max as b6, min as b7, moneyMax as b8, moneyMin as b9, type OpenPeriodOptions as bA, PERIODS_COLLECTION as bB, type PeriodRecord as bC, type ReadOnlyCollection as bD, appendPeriodLedgerEntry as bE, assertTsWritable as bF, chainAnchor as bG, loadPeriods as bH, validatePeriodName as bI, type GuardStrategy as bJ, type GuardChange as bK, type GuardContext as bL, AmendmentForbiddenError as bM, FieldFrozenError as bN, GuardRegistry as bO, type GuardStrategyHandle as bP, IllegalTransitionError as bQ, InvariantError as bR, ReadOnlyVaultFacade as bS, RecordLockedError as bT, type ShadowStrategy as bU, CollectionFrame as bV, VaultFrame as bW, type NoydbPodStore as bX, type RetentionPolicy as bY, type SnapshotPolicy as bZ, type SnapshotStrategy as b_, moneySum as ba, reduceRecords as bb, reducerBuilder as bc, resetGroupByWarnings as bd, sum as be, type CrdtStrategy as bf, type CrdtMode as bg, type CrdtState as bh, type LwwMapState as bi, type RgaState as bj, type YjsState as bk, buildLwwMapState as bl, buildRgaState as bm, mergeCrdtStates as bn, resolveCrdtSnapshot as bo, type ConsentStrategy as bp, CONSENT_AUDIT_COLLECTION as bq, type ConsentAuditEntry as br, type ConsentAuditFilter as bs, type ConsentContext as bt, type ConsentOp as bu, loadConsentEntries as bv, writeConsentEntry as bw, type PeriodsStrategy as bx, type CarryForwardContext as by, type ClosePeriodOptions as bz, DictKeyInUseError as c, type JsonPatchOp as c$, type SnapshotMode as c0, SnapshotNotFoundError as c1, type DerivationStrategy as c2, type DerivationContext as c3, type ArrayOutputSpec as c4, DerivationCapExceededError as c5, DerivationCycleError as c6, DerivationDepthError as c7, DerivationOutputShapeError as c8, DerivationOutputUnknownError as c9, type WithdrawAccessibleOptions as cA, type WithdrawResult as cB, type WithdrawalRequest as cC, type WithdrawalRequestStatus as cD, type DiffEntry as cE, type UnlockedKeyring as cF, type ExportFormat as cG, type BusHandler as cH, type GateDeleteEvent as cI, type GateEventMap as cJ, type GateHandler as cK, type GatePoint as cL, type GatePutEvent as cM, type LifecycleEventMap as cN, type LifecyclePoint as cO, ServiceBus as cP, SubsystemBus as cQ, type Role as cR, type HistoryStrategy as cS, type NoydbStore as cT, type HistoryOptions as cU, type EncryptedEnvelope as cV, type PruneOptions as cW, type AppendInput as cX, type ChangeType as cY, CollectionInstant as cZ, type JsonPatch as c_, DerivationRegistry as ca, type DerivationStrategyHandle as cb, type DerivedFromMeta as cc, type OutputSpec as cd, type RecordOutputSpec as ce, type MaterializedViewStrategy as cf, type MaterializedViewStrategyHandle as cg, type OverlayedViewStrategy as ch, Collection as ci, OverlayBaseIsVirtualError as cj, OverlayCollectionUnavailableError as ck, type OverlayFieldMergeMode as cl, type OverlayFieldMergeRule as cm, OverlayIdMismatchError as cn, OverlayNameCollisionError as co, OverlayedViewRegistry as cp, type OverlayedViewStrategyHandle as cq, type SyncStrategy as cr, type PortabilityStrategy as cs, type ApproveWithdrawalOptions as ct, type ExportAccessibleOptions as cu, NO_PORTABILITY as cv, PortabilityNotEnabledError as cw, type RejectWithdrawalOptions as cx, type RequestWithdrawalOptions as cy, type RequestWithdrawalResult as cz, DictKeyMissingError as d, type UnionSource as d$, LedgerStore as d0, type VaultEngine as d1, VaultInstant as d2, type VerifyResult as d3, applyPatch as d4, computePatch as d5, diff as d6, formatDiff as d7, type SealedRecordStrategy as d8, type SealedCekDeliveryEnvelope as d9, AttestationNotEnabledError as dA, type IssueArgs as dB, type IssueContext as dC, type IssueResult as dD, NO_ATTESTATION as dE, type RevokeContext as dF, getRevokedDocIdsCore as dG, issueAttestationCore as dH, publishRevocationListCore as dI, revokeDocCore as dJ, unrevokeDocCore as dK, type PublicEnvelope as dL, type BundleRecipient as dM, type RecipientSealer as dN, type RecipientHint as dO, TxContext as dP, type MVQueryContext as dQ, type RegisteredMV as dR, Query as dS, MaterializedViewRegistry as dT, type MaterializedFromMeta as dU, MaterializedViewConfigError as dV, MaterializedViewCycleError as dW, type MaterializedViewOutput as dX, MaterializedViewSourceUnknownError as dY, MaterializedViewTooLargeError as dZ, type UnionArmJoin as d_, NO_SEALED_RECORD as da, type SealedCekBinding as db, SealedRecordExpiredError as dc, SealedRecordMismatchError as dd, SealedRecordNotEnabledError as de, type WalkClosureOptions as df, type SealingKeyProvider as dg, type RecoveryEnrollmentInput as dh, type ShamirRecoveryProvider as di, type EnclaveKey as dj, AdoptionStateError as dk, BackupCorruptedError as dl, BackupLedgerError as dm, BundleIntegrityError as dn, BundleSealMismatchError as dp, BundleVersionConflictError as dq, type ClosureResult as dr, type ExtractPartitionResult as ds, PartitionExtractionError as dt, PodVersionConflictError as du, TransferSealError as dv, extractPartition as dw, walkClosure as dx, type AttestationStrategy as dy, AttestationError as dz, DictionaryHandle as e, type DeepPartial as e$, type SearchStrategy as e0, type SequenceStrategy as e1, type CustodyStrategy as e2, type SchemaUpdateStrategy as e3, type TransformFn as e4, type PersistedSchemaEnvelope as e5, type UpdateDecision as e6, type UserEnvelope as e7, type VaultUserApi as e8, type UserApiDeps as e9, type CollectionChangeEvent as eA, type CollectionConfig as eB, type CollectionConflictResolver as eC, type CollectionDescriptor as eD, type CollectionStats as eE, ComputedFieldError as eF, type ComputedFields as eG, type ComputedFn as eH, type Conflict as eI, ConflictError as eJ, type ConflictPolicy as eK, type ConflictStrategy as eL, CrossJoinSourceUnknownError as eM, CrossJoinTooLargeError as eN, type CrossTierAccessEvent as eO, CustodyApi as eP, type CustodyHost as eQ, CustodyNotEnabledError as eR, DEFAULT_CROSS_JOIN_MAX_ROWS as eS, DEFAULT_JOIN_MAX_ROWS as eT, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as eU, DELEGATIONS_COLLECTION as eV, DanglingReferenceError as eW, DataResidencyError as eX, DebugPlaintextError as eY, DebugReservedFieldError as eZ, DecryptionError as e_, type DeepPartialOrNull as ea, type UserEnvelopePresented as eb, type Unsubscribe as ec, type LiveUserEnvelope as ed, type RoundingMode as ee, type VaultPolicy as ef, type ActiveTier as eg, type FactorProof as eh, type GateName as ei, type PolicyDenyReason as ej, type GatePolicy as ek, type AccessibleVault as el, type AffectedDocument as em, AlreadyElevatedError as en, type ArchivePolicy as eo, type ArchiveResult as ep, type ArchiveRunOptions as eq, type ArchiveStrategy as er, BUNDLE_STORE_POLICY as es, type BuiltInGateName as et, type CacheOptions as eu, type CacheStats as ev, CargoNotEnabledError as ew, type CargoStrategy as ex, type ChangeEvent as ey, type Clause as ez, type DictionaryOptions as f, type KeyringAuthenticatorWrappingDEKs as f$, type DeferredNumberingConfig as f0, DelegationTargetMissingError as f1, type DelegationToken as f2, type DeleteManyResult as f3, type DerivationDescriptor as f4, DirectoryDisabledError as f5, type DirtyEntry as f6, type DryRunResult as f7, type DumpSchemaOptions as f8, ELEVATION_AUDIT_COLLECTION as f9, type FormattedSequenceHandle as fA, type FrozenSnapshotRef as fB, type GhostRecord as fC, type GrantCustodianOptions as fD, type GrantOptions as fE, GroupCardinalityError as fF, type GroupClause as fG, type GuardViolation as fH, type HistoryConfig as fI, type HistoryEntry as fJ, INDEXED_STORE_POLICY as fK, type ImportCapability as fL, ImportCapabilityError as fM, type IndexFieldName as fN, IndexRequiredError as fO, IndexWriteFailureError as fP, type InferOutput as fQ, type InternalCollectionStats as fR, InvalidKeyError as fS, type IssueDelegationOptions as fT, type IssueMagicLinkGrantOptions as fU, type JoinContext as fV, type JoinLeg as fW, type JoinStrategy as fX, JoinTooLargeError as fY, type JoinableSource as fZ, type KeyringAuthenticator as f_, ElevatedHandle as fa, ElevationExpiredError as fb, type EmbeddingDescriptor as fc, EmbeddingDimMismatchError as fd, EmbeddingModelMismatchError as fe, EnclaveNotSupportedError as ff, type EnrollAuthenticatorOptions as fg, type EnrollAuthenticatorWrappingDEKsOptions as fh, type EnrollAuthenticatorWrappingKEKOptions as fi, type EnrollRecoveryResult as fj, type ExportCapability as fk, ExportCapabilityError as fl, type ExportChunk as fm, type ExportStreamOptions as fn, type FactorKind as fo, type FactorProofBundle as fp, type FactorRequirement as fq, type FenceDoc as fr, type FenceState as fs, type FieldChange as ft, type FieldClause as fu, type FieldDescriptor as fv, type FieldSource as fw, FilenameSanitizationError as fx, type FilterClause as fy, ForgetStrategyNotConfiguredError as fz, type I18nMap as g, POD_STORE_POLICY as g$, type KeyringAuthenticatorWrappingKEK as g0, KeyringCorruptError as g1, KeyringExpiredError as g2, type KeyringFile as g3, LedgerContentionError as g4, type LiberateOptions as g5, type LiberateResult as g6, LinkEndpointError as g7, LinkIntegrityError as g8, type LinkOnDelete as g9, type MoneyOptionsMulti as gA, MoneyPrecisionError as gB, type MoneyString as gC, MoneyUnsupportedError as gD, NOYDB_BACKUP_VERSION as gE, NOYDB_FORMAT_VERSION as gF, NOYDB_KEYRING_VERSION as gG, NOYDB_SYNC_VERSION as gH, NO_CARGO as gI, NO_CUSTODY as gJ, NO_SEARCH as gK, NO_SEQUENCE as gL, NetworkError as gM, type NextOptions as gN, NoAccessError as gO, NonAdditiveSchemaChangeError as gP, NotFoundError as gQ, Noydb as gR, type NoydbBundleStore as gS, NoydbError as gT, type NoydbEventMap as gU, type NoydbOptions as gV, type Assignment as gW, NumberingUncertaintyError as gX, type Operator as gY, type OrderBy as gZ, type OverlayViewDescriptor as g_, type LinkRow as ga, type LinkSetHandle as gb, type LinkSpec as gc, type ListAccessibleVaultsOptions as gd, type ListPageResult as ge, type ListUsersOptions as gf, type LiveQuery as gg, type LiveUpstream as gh, type LocaleReadOptions as gi, Lru as gj, type LruOptions as gk, type LruStats as gl, MAGIC_LINK_CONTENT_INFO_PREFIX as gm, MAGIC_LINK_GRANTS_COLLECTION as gn, MAGIC_LINK_KEK_INFO_PREFIX as go, type MagicLinkGrantPayload as gp, type MagicLinkGrantRecord as gq, ManagedRecoveryNotEnrolledError as gr, type MaterializedViewDescriptor as gs, MemoryRecipientSealer as gt, MemorySealingKeyProvider as gu, MigrationRequiredError as gv, MoneyCurrencyError as gw, type MoneyDescriptor as gx, type MoneyOptions as gy, type MoneyOptionsFixed as gz, type I18nTextDescriptor as h, type RotateRecoveryResult as h$, PUBLIC_ENVELOPE_FIELDS as h0, type PaperRecoveryDoc as h1, type PaperRecoveryEntry as h2, type PassphrasePolicy as h3, type PassphraseValidationResult as h4, PathEscapeError as h5, PeriodClosedError as h6, type Permission as h7, PermissionDeniedError as h8, type Permissions as h9, type QuickUnlockState as hA, QuickUnlockStore as hB, QuiesceTimeoutError as hC, type ReAuthOperation as hD, ReadOnlyAtInstantError as hE, ReadOnlyError as hF, ReadOnlyFrameError as hG, RecordCekNotFoundError as hH, type RecoverPassphraseInput as hI, type RecoverPassphraseResult as hJ, type RecoverUserOptions as hK, RecoveryNotEnrolledError as hL, RecoveryProfileNotImplementedError as hM, type RecoveryProof as hN, type RefDescriptor as hO, RefIntegrityError as hP, type RefMode as hQ, RefRegistry as hR, RefScopeError as hS, type RefViolation as hT, ReservedVaultNameError as hU, type ResolvedPublicEnvelopeSchema as hV, type RetrieveHit as hW, type RetrieveOptions as hX, type RevokeOptions as hY, type RotatePassphraseInput as hZ, type RotateRecoveryOptions as h_, type PersistedSchemaKind as ha, type PlaintextTranslatorContext as hb, type PlaintextTranslatorFn as hc, PolicyDeniedError as hd, PresenceHandle as he, type PresencePeer as hf, PrivilegeEscalationError as hg, type PublicEnvelopeField as hh, type PublicEnvelopeSchema as hi, type PublicEnvelopeText as hj, type PullMode as hk, type PullOptions as hl, type PullPolicy as hm, type PullResult as hn, type PushMode as ho, type PushOptions as hp, type PushPolicy as hq, type PushResult as hr, type PutManyItemOptions as hs, type PutManyOptions as ht, type PutManyResult as hu, type QueryAcrossOptions as hv, type QueryAcrossResult as hw, type QueryField as hx, type QueryPlan as hy, type QuerySource as hz, type I18nTextOptions as i, type TranslatorAuditEntry as i$, SEALED_PASSPHRASE_RECORD_ID as i0, ScanBuilder as i1, type ScanPageProvider as i2, type SchemaDelta as i3, SchemaFenceError as i4, type SchemaIntrospection as i5, SchemaLockedError as i6, SchemaUpdateError as i7, SchemaValidationError as i8, type Sealed as i9, type StandardSchemaV1SyncResult as iA, type StoreAuth as iB, type StoreAuthKind as iC, type StoreCapabilities as iD, StoreCapabilityError as iE, type StoreTime as iF, SyncEngine as iG, type SyncMetadata as iH, type SyncPolicy as iI, SyncScheduler as iJ, type SyncSchedulerStatus as iK, type SyncStatus as iL, type SyncTarget as iM, type SyncTargetRole as iN, SyncTransaction as iO, type SyncTransactionResult as iP, type TabChannel as iQ, type TabCoordinationOptions as iR, type TabLockManager as iS, type TabPresence as iT, type TabRole as iU, TamperedError as iV, TierDemoteDeniedError as iW, type TierMode as iX, TierNotGrantedError as iY, TiersNotEnabledError as iZ, type TransactionInvariant as i_, type SealedEnvelope as ia, SealedHandle as ib, type SealedPassphrase as ic, type SealedView as id, type SearchEntry as ie, SearchNotEnabledError as ig, type SearchOptions as ih, type SearchResult as ii, SequenceContentionError as ij, type SequenceHandle as ik, SequenceNotEnabledError as il, SequenceOfflineError as im, type SequenceOptions as io, SequenceStore as ip, type SequenceStoreOptions as iq, type SessionPolicy as ir, type SetPublicEnvelopeInput as is, type ShamirRecoveryDoc as it, type ShamirRecoveryEntry as iu, ShardProvisioningError as iv, type SlotRewrapCeremony as iw, type SlotRewrapContext as ix, type StandardSchemaV1 as iy, type StandardSchemaV1Issue as iz, LocaleNotSpecifiedError as j, isRefArray as j$, TxCollection as j0, type TxOp as j1, TxVault as j2, UniqueConstraintError as j3, UnknownShardError as j4, UnsupportedIndexOptionError as j5, type UpdateAuthenticatorOptions as j6, type UpdateContext as j7, type UpdateUserOptions as j8, type UserEnvelopeCheckGate as j9, compileSequenceFormat as jA, createNoydb as jB, createStore as jC, decryptBytes as jD, decryptDeterministic as jE, deriveMagicLinkContentKey as jF, derivePresenceKey as jG, encryptBytes as jH, encryptDeterministic as jI, enrollAuthenticator as jJ, estimateEntropy as jK, evalComputedFields as jL, evaluateClause as jM, evaluateExportCapability as jN, evaluateFieldClause as jO, evaluateImportCapability as jP, executePlan as jQ, exportAccessibleData as jR, findAuthenticator as jS, hasExportCapability as jT, hasImportCapability as jU, hasRecoveryEnrolled as jV, isLinkCollectionName as jW, isMagicLinkGrantExpired as jX, isMoneyDescriptor as jY, isMoneyString as jZ, isPublicEnvelope as j_, UserEnvelopeOversizedError as ja, type UserInfo as jb, ValidationError as jc, type VaultBackup as jd, type VaultPolicyOnDisk as je, type VaultSchemaSnapshot as jf, type VaultSnapshot as jg, VaultTemplateNotFoundError as jh, type WarningRules as ji, WeakPassphraseError as jj, type WeakPassphraseReason as jk, type WithArchiveOptions as jl, WithdrawalRequestError as jm, type WrappedDeksBlob as jn, type WriteConflict as jo, type WriteQueue as jp, aesGcmOpen as jq, applyJoins as jr, approveWithdrawal as js, asMoney as jt, assertStrongPassphrase as ju, base64ToBuffer as jv, bufferToBase64 as jw, buildLiveQuery as jx, buildRecipientKeyringFile as jy, burnPaperRecoveryEntry as jz, type OnMissingPolicy as k, type CrossJoinClause as k$, issueDelegation as k0, recoverPassphrase as k1, rotatePassphrase as k2, liberateVault as k3, listMagicLinkGrants as k4, listUsers as k5, listUsersWithEnvelopes as k6, listWithdrawalRequests as k7, loadActiveDelegations as k8, loadPaperRecoveryEntries as k9, saveShamirRecoveryEntries as kA, sealRsaOaepTlv as kB, unwrapDeksFromBlob as kC, unwrapDeksFromPaperEntry as kD, unwrapDeksFromShamirEntry as kE, unwrapMagicLinkGrant as kF, validatePassphrase as kG, validatePublicEnvelopeInput as kH, validateSchemaInput as kI, validateSchemaOutput as kJ, withArchive as kK, withDeferredNumbering as kL, withdrawAccessibleData as kM, writeMagicLinkGrant as kN, changeSecret as kO, createOwnerKeyring as kP, ensureCollectionDEK as kQ, grant as kR, loadKeyring as kS, persistKeyring as kT, revoke as kU, updateAuthenticator as kV, updateKeyringIdentity as kW, type TxStrategy as kX, type AmendmentTxOptions as kY, CrossShardJoinError as kZ, sha256Hex as k_, loadSealedPassphrase as ka, loadShamirRecoveryEntries as kb, magicLinkGrantRecordId as kc, mintPaperRecoveryEntry as kd, mintShamirRecoveryEntry as ke, mintWrappedDeksBlob as kf, money as kg, moneyNumber as kh, parseRsaOaepTlv as ki, parseSealedEnvelope as kj, readMagicLinkGrantRecord as kk, readPath as kl, recoverUser as km, ref as kn, refArray as ko, rejectWithdrawal as kp, removeAuthenticator as kq, requestWithdrawal as kr, resetJoinWarnings as ks, resolveSchema as kt, resolveSequenceKey as ku, revokeDelegation as kv, revokeMagicLinkGrant as kw, runTransaction as kx, savePaperRecoveryEntries as ky, saveSealedPassphrase as kz, type ResolveI18nOptions as l, NO_TIERS as l0, type TiersContext as l1, type TiersStrategy as l2, assertDeclaredTier as l3, assertTiersEnabled as l4, classifySealedShred as l5, demote as l6, elevate as l7, getAtTier as l8, listAtTier as l9, putAtTier as la, withTiers as lb, type ScriptWarning as m, type StaticDictDescriptor as n, StaticDictReadonlyError as o, applyI18nLocale as p, dictCollectionName as q, dictKey as r, enforceScript as s, getAtPath as t, i18nText as u, inferScripts as v, isDictCollectionName as w, isDictKeyDescriptor as x, isI18nTextDescriptor as y, isStaticDictDescriptor as z };
+export { BLOB_INDEX_COLLECTION as $, resolveI18nText as A, resolvePolicy as B, setAtPathInPlace as C, DICT_COLLECTION_PREFIX as D, staticDict as E, stripI18nFilled as F, validateI18nTextValue as G, type SessionStrategy as H, type I18nStrategy as I, SessionExpiredError as J, SessionNotFoundError as K, type Layer as L, MissingTranslationError as M, SessionPolicyError as N, type OnMissing as O, PolicyEnforcer as P, createEnforcer as Q, ReservedCollectionNameError as R, ScriptViolationError as S, TranslatorNotConfiguredError as T, UnknownDictCodeError as U, Vault as V, validateSessionPolicy as W, type BlobStrategy as X, BLOB_CHUNKS_COLLECTION as Y, BLOB_COLLECTION as Z, BLOB_EVICTION_AUDIT_COLLECTION as _, type DictEntry as a, type Reducer as a$, BLOB_SLOTS_PREFIX as a0, BLOB_VERSIONS_PREFIX as a1, type BlobEvictionEntry as a2, type BlobFieldPolicy as a3, type BlobFieldsConfig as a4, type BlobObject as a5, type BlobPutOptions as a6, type BlobResponseOptions as a7, BlobSet as a8, type BlobStrategyOpenArgs as a9, IDX_PREFIX as aA, type IndexDef as aB, type IndexState as aC, type IngestRow as aD, type LazyOrderBy as aE, LazyQuery as aF, type LazyQuerySource as aG, type OrderedEntry as aH, PersistedCollectionIndex as aI, type PersistedIndexDef as aJ, compositeKey as aK, decodeIdxId as aL, encodeIdxId as aM, isIdxId as aN, type AggregateStrategy as aO, type AggregateResult as aP, type AggregateSpec as aQ, Aggregation as aR, type AggregationUpstream as aS, GROUPBY_MAX_CARDINALITY as aT, GROUPBY_WARN_CARDINALITY as aU, GroupedAggregation as aV, GroupedQuery as aW, GroupedQueryN as aX, type GroupedRow as aY, type GroupedRowN as aZ, type LiveAggregation as a_, type CompactRunOptions as aa, type CompactionContext as ab, type CompactionResult as ac, DEFAULT_CHUNK_SIZE as ad, EXPORT_AUDIT_COLLECTION as ae, ExportBlobsAbortedError as af, type ExportBlobsAuditEntry as ag, type ExportBlobsHandle as ah, type ExportBlobsOptions as ai, type ExportedBlob as aj, type ObjectListEntry as ak, type ObjectMeta as al, type ObjectProjection as am, type ObjectUrlOptions as an, type PutObjectOptions as ao, type PutUrlOptions as ap, type SlotInfo as aq, type SlotRecord as ar, type VersionRecord as as, createExportBlobsHandle as at, memoryObjectProjection as au, runCompaction as av, type IndexStrategy as aw, COMPOSITE_DELIMITER as ax, CollectionIndexes as ay, type HashIndex as az, type DictKeyDescriptor as b, type SnapshotMeta as b$, type ReducerBuilder as b0, type ReducerOptions as b1, avg as b2, buildLiveAggregation as b3, count as b4, groupAndReduce as b5, max as b6, min as b7, moneyMax as b8, moneyMin as b9, type OpenPeriodOptions as bA, PERIODS_COLLECTION as bB, type PeriodRecord as bC, type ReadOnlyCollection as bD, appendPeriodLedgerEntry as bE, assertTsWritable as bF, chainAnchor as bG, loadPeriods as bH, validatePeriodName as bI, type GuardStrategy as bJ, type GuardChange as bK, type GuardContext as bL, AmendmentForbiddenError as bM, FieldFrozenError as bN, GuardRegistry as bO, type GuardStrategyHandle as bP, IllegalTransitionError as bQ, InvariantError as bR, ReadOnlyVaultFacade as bS, RecordLockedError as bT, type ShadowStrategy as bU, CollectionFrame as bV, VaultFrame as bW, type NoydbPodStore as bX, type RetentionPolicy as bY, type SnapshotPolicy as bZ, type SnapshotStrategy as b_, moneySum as ba, reduceRecords as bb, reducerBuilder as bc, resetGroupByWarnings as bd, sum as be, type CrdtStrategy as bf, type CrdtMode as bg, type CrdtState as bh, type LwwMapState as bi, type RgaState as bj, type YjsState as bk, buildLwwMapState as bl, buildRgaState as bm, mergeCrdtStates as bn, resolveCrdtSnapshot as bo, type ConsentStrategy as bp, CONSENT_AUDIT_COLLECTION as bq, type ConsentAuditEntry as br, type ConsentAuditFilter as bs, type ConsentContext as bt, type ConsentOp as bu, loadConsentEntries as bv, writeConsentEntry as bw, type PeriodsStrategy as bx, type CarryForwardContext as by, type ClosePeriodOptions as bz, DictKeyInUseError as c, type JsonPatchOp as c$, type SnapshotMode as c0, SnapshotNotFoundError as c1, type DerivationStrategy as c2, type DerivationContext as c3, type ArrayOutputSpec as c4, DerivationCapExceededError as c5, DerivationCycleError as c6, DerivationDepthError as c7, DerivationOutputShapeError as c8, DerivationOutputUnknownError as c9, type WithdrawAccessibleOptions as cA, type WithdrawResult as cB, type WithdrawalRequest as cC, type WithdrawalRequestStatus as cD, type DiffEntry as cE, type UnlockedKeyring as cF, type ExportFormat as cG, type BusHandler as cH, type GateDeleteEvent as cI, type GateEventMap as cJ, type GateHandler as cK, type GatePoint as cL, type GatePutEvent as cM, type LifecycleEventMap as cN, type LifecyclePoint as cO, ServiceBus as cP, SubsystemBus as cQ, type Role as cR, type HistoryStrategy as cS, type NoydbStore as cT, type HistoryOptions as cU, type EncryptedEnvelope as cV, type PruneOptions as cW, type AppendInput as cX, type ChangeType as cY, CollectionInstant as cZ, type JsonPatch as c_, DerivationRegistry as ca, type DerivationStrategyHandle as cb, type DerivedFromMeta as cc, type OutputSpec as cd, type RecordOutputSpec as ce, type MaterializedViewStrategy as cf, type MaterializedViewStrategyHandle as cg, type OverlayedViewStrategy as ch, Collection as ci, OverlayBaseIsVirtualError as cj, OverlayCollectionUnavailableError as ck, type OverlayFieldMergeMode as cl, type OverlayFieldMergeRule as cm, OverlayIdMismatchError as cn, OverlayNameCollisionError as co, OverlayedViewRegistry as cp, type OverlayedViewStrategyHandle as cq, type SyncStrategy as cr, type PortabilityStrategy as cs, type ApproveWithdrawalOptions as ct, type ExportAccessibleOptions as cu, NO_PORTABILITY as cv, PortabilityNotEnabledError as cw, type RejectWithdrawalOptions as cx, type RequestWithdrawalOptions as cy, type RequestWithdrawalResult as cz, DictKeyMissingError as d, isClassifiedGroup as d$, LedgerStore as d0, type VaultEngine as d1, VaultInstant as d2, type VerifyResult as d3, applyPatch as d4, computePatch as d5, diff as d6, formatDiff as d7, type SealedRecordStrategy as d8, type SealedCekDeliveryEnvelope as d9, AttestationNotEnabledError as dA, type IssueArgs as dB, type IssueContext as dC, type IssueResult as dD, NO_ATTESTATION as dE, type RevokeContext as dF, getRevokedDocIdsCore as dG, issueAttestationCore as dH, publishRevocationListCore as dI, revokeDocCore as dJ, unrevokeDocCore as dK, type ClassifiedFieldSpec as dL, type ClassifiedStrategy as dM, ClassifiedConfigError as dN, type ClassifiedEntry as dO, type ClassifiedGroup as dP, type ClassifiedList as dQ, type ClassifiedRevealCtx as dR, ClassifiedRevealError as dS, type ClassifiedRider as dT, ClassifiedRotationError as dU, type ClassifiedStorage as dV, type ClassifiedVerdict as dW, type ClassifiedVerifyCtx as dX, ClassifiedVerifyError as dY, NO_CLASSIFIED as dZ, isClassifiedFieldSpec as d_, NO_SEALED_RECORD as da, type SealedCekBinding as db, SealedRecordExpiredError as dc, SealedRecordMismatchError as dd, SealedRecordNotEnabledError as de, type WalkClosureOptions as df, type SealingKeyProvider as dg, type RecoveryEnrollmentInput as dh, type ShamirRecoveryProvider as di, type EnclaveKey as dj, AdoptionStateError as dk, BackupCorruptedError as dl, BackupLedgerError as dm, BundleIntegrityError as dn, BundleSealMismatchError as dp, BundleVersionConflictError as dq, type ClosureResult as dr, type ExtractPartitionResult as ds, PartitionExtractionError as dt, PodVersionConflictError as du, TransferSealError as dv, extractPartition as dw, walkClosure as dx, type AttestationStrategy as dy, AttestationError as dz, DictionaryHandle as e, type Conflict as e$, type PublicEnvelope as e0, type BundleRecipient as e1, type RecipientSealer as e2, type RecipientHint as e3, TxContext as e4, type MVQueryContext as e5, type RegisteredMV as e6, Query as e7, MaterializedViewRegistry as e8, type MaterializedFromMeta as e9, type GateName as eA, type PolicyDenyReason as eB, type GatePolicy as eC, type AccessibleVault as eD, type AffectedDocument as eE, AlreadyElevatedError as eF, type ArchivePolicy as eG, type ArchiveResult as eH, type ArchiveRunOptions as eI, type ArchiveStrategy as eJ, BUNDLE_STORE_POLICY as eK, type BuiltInGateName as eL, type CacheOptions as eM, type CacheStats as eN, CargoNotEnabledError as eO, type CargoStrategy as eP, type ChangeEvent as eQ, ClassifiedNotEnabledError as eR, type Clause as eS, type CollectionChangeEvent as eT, type CollectionConfig as eU, type CollectionConflictResolver as eV, type CollectionDescriptor as eW, type CollectionStats as eX, ComputedFieldError as eY, type ComputedFields as eZ, type ComputedFn as e_, MaterializedViewConfigError as ea, MaterializedViewCycleError as eb, type MaterializedViewOutput as ec, MaterializedViewSourceUnknownError as ed, MaterializedViewTooLargeError as ee, type UnionArmJoin as ef, type UnionSource as eg, type SearchStrategy as eh, type SequenceStrategy as ei, type CustodyStrategy as ej, type SchemaUpdateStrategy as ek, type TransformFn as el, type PersistedSchemaEnvelope as em, type UpdateDecision as en, NoydbError as eo, type UserEnvelope as ep, type VaultUserApi as eq, type UserApiDeps as er, type DeepPartialOrNull as es, type UserEnvelopePresented as et, type Unsubscribe as eu, type LiveUserEnvelope as ev, type RoundingMode as ew, type VaultPolicy as ex, type ActiveTier as ey, type FactorProof as ez, type DictionaryOptions as f, type HistoryConfig as f$, ConflictError as f0, type ConflictPolicy as f1, type ConflictStrategy as f2, CrossJoinSourceUnknownError as f3, CrossJoinTooLargeError as f4, type CrossTierAccessEvent as f5, CustodyApi as f6, type CustodyHost as f7, CustodyNotEnabledError as f8, DEFAULT_CROSS_JOIN_MAX_ROWS as f9, type EnrollAuthenticatorWrappingDEKsOptions as fA, type EnrollAuthenticatorWrappingKEKOptions as fB, type EnrollRecoveryResult as fC, type ExportCapability as fD, ExportCapabilityError as fE, type ExportChunk as fF, type ExportStreamOptions as fG, type FactorKind as fH, type FactorProofBundle as fI, type FactorRequirement as fJ, type FenceDoc as fK, type FenceState as fL, type FieldChange as fM, type FieldClause as fN, type FieldDescriptor as fO, type FieldSource as fP, FilenameSanitizationError as fQ, type FilterClause as fR, ForgetStrategyNotConfiguredError as fS, type FormattedSequenceHandle as fT, type FrozenSnapshotRef as fU, type GhostRecord as fV, type GrantCustodianOptions as fW, type GrantOptions as fX, GroupCardinalityError as fY, type GroupClause as fZ, type GuardViolation as f_, DEFAULT_JOIN_MAX_ROWS as fa, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as fb, DELEGATIONS_COLLECTION as fc, DanglingReferenceError as fd, DataResidencyError as fe, DebugPlaintextError as ff, DebugReservedFieldError as fg, DecryptionError as fh, type DeepPartial as fi, type DeferredNumberingConfig as fj, DelegationTargetMissingError as fk, type DelegationToken as fl, type DeleteManyResult as fm, type DerivationDescriptor as fn, DirectoryDisabledError as fo, type DirtyEntry as fp, type DryRunResult as fq, type DumpSchemaOptions as fr, ELEVATION_AUDIT_COLLECTION as fs, ElevatedHandle as ft, ElevationExpiredError as fu, type EmbeddingDescriptor as fv, EmbeddingDimMismatchError as fw, EmbeddingModelMismatchError as fx, EnclaveNotSupportedError as fy, type EnrollAuthenticatorOptions as fz, type I18nMap as g, NO_CARGO as g$, type HistoryEntry as g0, INDEXED_STORE_POLICY as g1, type ImportCapability as g2, ImportCapabilityError as g3, type IndexFieldName as g4, IndexRequiredError as g5, IndexWriteFailureError as g6, type InferOutput as g7, type InternalCollectionStats as g8, InvalidKeyError as g9, type LiveUpstream as gA, type LocaleReadOptions as gB, Lru as gC, type LruOptions as gD, type LruStats as gE, MAGIC_LINK_CONTENT_INFO_PREFIX as gF, MAGIC_LINK_GRANTS_COLLECTION as gG, MAGIC_LINK_KEK_INFO_PREFIX as gH, type MagicLinkGrantPayload as gI, type MagicLinkGrantRecord as gJ, ManagedRecoveryNotEnrolledError as gK, type MaterializedViewDescriptor as gL, MemoryRecipientSealer as gM, MemorySealingKeyProvider as gN, MigrationRequiredError as gO, MoneyCurrencyError as gP, type MoneyDescriptor as gQ, type MoneyOptions as gR, type MoneyOptionsFixed as gS, type MoneyOptionsMulti as gT, MoneyPrecisionError as gU, type MoneyString as gV, MoneyUnsupportedError as gW, NOYDB_BACKUP_VERSION as gX, NOYDB_FORMAT_VERSION as gY, NOYDB_KEYRING_VERSION as gZ, NOYDB_SYNC_VERSION as g_, type IssueDelegationOptions as ga, type IssueMagicLinkGrantOptions as gb, type JoinContext as gc, type JoinLeg as gd, type JoinStrategy as ge, JoinTooLargeError as gf, type JoinableSource as gg, type KeyringAuthenticator as gh, type KeyringAuthenticatorWrappingDEKs as gi, type KeyringAuthenticatorWrappingKEK as gj, KeyringCorruptError as gk, KeyringExpiredError as gl, type KeyringFile as gm, type LazyStrategy as gn, LedgerContentionError as go, type LiberateOptions as gp, type LiberateResult as gq, LinkIntegrityError as gr, type LinkOnDelete as gs, type LinkRow as gt, type LinkSetHandle as gu, type LinkSpec as gv, type ListAccessibleVaultsOptions as gw, type ListPageResult as gx, type ListUsersOptions as gy, type LiveQuery as gz, type I18nTextDescriptor as h, type RecoverPassphraseInput as h$, NO_CUSTODY as h0, NO_SEARCH as h1, NO_SEQUENCE as h2, NO_TEAM as h3, NetworkError as h4, type NextOptions as h5, NoAccessError as h6, NonAdditiveSchemaChangeError as h7, NotFoundError as h8, Noydb as h9, type PublicEnvelopeField as hA, type PublicEnvelopeSchema as hB, type PublicEnvelopeText as hC, type PullMode as hD, type PullOptions as hE, type PullPolicy as hF, type PullResult as hG, type PushMode as hH, type PushOptions as hI, type PushPolicy as hJ, type PushResult as hK, type PutManyItemOptions as hL, type PutManyOptions as hM, type PutManyResult as hN, type QueryAcrossOptions as hO, type QueryAcrossResult as hP, type QueryField as hQ, type QueryPlan as hR, type QuerySource as hS, type QuickUnlockState as hT, QuickUnlockStore as hU, QuiesceTimeoutError as hV, type ReAuthOperation as hW, ReadOnlyAtInstantError as hX, ReadOnlyError as hY, ReadOnlyFrameError as hZ, RecordCekNotFoundError as h_, type NoydbBundleStore as ha, type NoydbEventMap as hb, type NoydbOptions as hc, type Assignment as hd, NumberingUncertaintyError as he, type Operator as hf, type OrderBy as hg, type OverlayViewDescriptor as hh, POD_STORE_POLICY as hi, PUBLIC_ENVELOPE_FIELDS as hj, type PaperRecoveryDoc as hk, type PaperRecoveryEntry as hl, type PassphrasePolicy as hm, type PassphraseValidationResult as hn, PathEscapeError as ho, PeriodClosedError as hp, type Permission as hq, PermissionDeniedError as hr, type Permissions as hs, type PersistedSchemaKind as ht, type PlaintextTranslatorContext as hu, type PlaintextTranslatorFn as hv, PolicyDeniedError as hw, PresenceHandle as hx, type PresencePeer as hy, PrivilegeEscalationError as hz, type I18nTextOptions as i, type SyncPolicy as i$, type RecoverPassphraseResult as i0, type RecoverUserOptions as i1, RecoveryNotEnrolledError as i2, RecoveryProfileNotImplementedError as i3, type RecoveryProof as i4, type RefDescriptor as i5, RefIntegrityError as i6, type RefMode as i7, RefRegistry as i8, RefScopeError as i9, SearchNotEnabledError as iA, type SearchOptions as iB, type SearchResult as iC, SequenceContentionError as iD, type SequenceHandle as iE, SequenceNotEnabledError as iF, SequenceOfflineError as iG, type SequenceOptions as iH, SequenceStore as iI, type SequenceStoreOptions as iJ, type SessionPolicy as iK, type SetPublicEnvelopeInput as iL, type ShamirRecoveryDoc as iM, type ShamirRecoveryEntry as iN, ShardProvisioningError as iO, type SlotRewrapCeremony as iP, type SlotRewrapContext as iQ, type StandardSchemaV1 as iR, type StandardSchemaV1Issue as iS, type StandardSchemaV1SyncResult as iT, type StoreAuth as iU, type StoreAuthKind as iV, type StoreCapabilities as iW, StoreCapabilityError as iX, type StoreTime as iY, SyncEngine as iZ, type SyncMetadata as i_, type RefViolation as ia, ReservedVaultNameError as ib, type ResolvedPublicEnvelopeSchema as ic, type RetrieveHit as id, type RetrieveOptions as ie, type RevokeOptions as ig, type RotatePassphraseInput as ih, type RotateRecoveryOptions as ii, type RotateRecoveryResult as ij, SEALED_PASSPHRASE_RECORD_ID as ik, ScanBuilder as il, type ScanPageProvider as im, type SchemaDelta as io, SchemaFenceError as ip, type SchemaIntrospection as iq, SchemaLockedError as ir, SchemaUpdateError as is, SchemaValidationError as it, type Sealed as iu, type SealedEnvelope as iv, SealedHandle as iw, type SealedPassphrase as ix, type SealedView as iy, type SearchEntry as iz, LocaleNotSpecifiedError as j, derivePresenceKey as j$, SyncScheduler as j0, type SyncSchedulerStatus as j1, type SyncStatus as j2, type SyncTarget as j3, type SyncTargetRole as j4, SyncTransaction as j5, type SyncTransactionResult as j6, type TabChannel as j7, type TabCoordinationOptions as j8, type TabLockManager as j9, type VaultSchemaSnapshot as jA, type VaultSnapshot as jB, VaultTemplateNotFoundError as jC, type WarningRules as jD, WeakPassphraseError as jE, type WeakPassphraseReason as jF, type WithArchiveOptions as jG, WithdrawalRequestError as jH, type WrappedDeksBlob as jI, type WriteConflict as jJ, type WriteQueue as jK, aesGcmOpen as jL, applyJoins as jM, approveWithdrawal as jN, asMoney as jO, assertStrongPassphrase as jP, base64ToBuffer as jQ, bufferToBase64 as jR, buildLiveQuery as jS, buildRecipientKeyringFile as jT, burnPaperRecoveryEntry as jU, compileSequenceFormat as jV, createNoydb as jW, createStore as jX, decryptBytes as jY, decryptDeterministic as jZ, deriveMagicLinkContentKey as j_, type TabPresence as ja, type TabRole as jb, TamperedError as jc, TeamNotEnabledError as jd, type TeamStrategy as je, TierDemoteDeniedError as jf, type TierMode as jg, TierNotGrantedError as jh, TiersNotEnabledError as ji, type TransactionInvariant as jj, type TranslatorAuditEntry as jk, TxCollection as jl, type TxOp as jm, TxVault as jn, UniqueConstraintError as jo, UnknownShardError as jp, UnsupportedIndexOptionError as jq, type UpdateAuthenticatorOptions as jr, type UpdateContext as js, type UpdateUserOptions as jt, type UserEnvelopeCheckGate as ju, UserEnvelopeOversizedError as jv, type UserInfo as jw, ValidationError as jx, type VaultBackup as jy, type VaultPolicyOnDisk as jz, type OnMissingPolicy as k, validatePassphrase as k$, encryptBytes as k0, encryptDeterministic as k1, enrollAuthenticator as k2, estimateEntropy as k3, evalComputedFields as k4, evaluateClause as k5, evaluateExportCapability as k6, evaluateFieldClause as k7, evaluateImportCapability as k8, executePlan as k9, mintWrappedDeksBlob as kA, money as kB, moneyNumber as kC, parseRsaOaepTlv as kD, parseSealedEnvelope as kE, readMagicLinkGrantRecord as kF, readPath as kG, recoverUser as kH, ref as kI, refArray as kJ, rejectWithdrawal as kK, removeAuthenticator as kL, requestWithdrawal as kM, resetJoinWarnings as kN, resolveSchema as kO, resolveSequenceKey as kP, revokeDelegation as kQ, revokeMagicLinkGrant as kR, runTransaction as kS, savePaperRecoveryEntries as kT, saveSealedPassphrase as kU, saveShamirRecoveryEntries as kV, sealRsaOaepTlv as kW, unwrapDeksFromBlob as kX, unwrapDeksFromPaperEntry as kY, unwrapDeksFromShamirEntry as kZ, unwrapMagicLinkGrant as k_, exportAccessibleData as ka, findAuthenticator as kb, hasExportCapability as kc, hasImportCapability as kd, hasRecoveryEnrolled as ke, isLinkCollectionName as kf, isMagicLinkGrantExpired as kg, isMoneyDescriptor as kh, isMoneyString as ki, isPublicEnvelope as kj, isRefArray as kk, issueDelegation as kl, recoverPassphrase as km, rotatePassphrase as kn, liberateVault as ko, listMagicLinkGrants as kp, listUsers as kq, listUsersWithEnvelopes as kr, listWithdrawalRequests as ks, loadActiveDelegations as kt, loadPaperRecoveryEntries as ku, loadSealedPassphrase as kv, loadShamirRecoveryEntries as kw, magicLinkGrantRecordId as kx, mintPaperRecoveryEntry as ky, mintShamirRecoveryEntry as kz, type ResolveI18nOptions as l, validatePublicEnvelopeInput as l0, validateSchemaInput as l1, validateSchemaOutput as l2, withArchive as l3, withDeferredNumbering as l4, withdrawAccessibleData as l5, writeMagicLinkGrant as l6, changeSecret as l7, createOwnerKeyring as l8, ensureCollectionDEK as l9, grant as la, loadKeyring as lb, persistKeyring as lc, revoke as ld, updateAuthenticator as le, updateKeyringIdentity as lf, IMPLICIT_LAZY as lg, type TxStrategy as lh, type AmendmentTxOptions as li, CrossShardJoinError as lj, sha256Hex as lk, type CrossJoinClause as ll, NO_TIERS as lm, type TiersContext as ln, type TiersStrategy as lo, assertDeclaredTier as lp, assertTiersEnabled as lq, classifySealedShred as lr, demote as ls, elevate as lt, getAtTier as lu, listAtTier as lv, putAtTier as lw, withTiers as lx, type ScriptWarning as m, type StaticDictDescriptor as n, StaticDictReadonlyError as o, applyI18nLocale as p, dictCollectionName as q, dictKey as r, enforceScript as s, getAtPath as t, i18nText as u, inferScripts as v, isDictCollectionName as w, isDictKeyDescriptor as x, isI18nTextDescriptor as y, isStaticDictDescriptor as z };