@noy-db/hub 0.3.0-pre.3 → 0.3.0-pre.4

package/dist/{index-D05bV0_g.d.ts → index-D4GQe1Rx.d.ts}

@@ -1,5 +1,5 @@
 import { L as LedgerEntry, F as ForgetStrategy, c as SubjectRef, a as ForgetResult } from './subject-index-O75wKshW.js';
-import { V as VaultMeta, a as CollectionMeta, F as FieldMeta, C as CollectionDescription, D as DescribeOptions } from './describe-0tiXAjoO.js';
+import { V as VaultMeta, a as CollectionMeta, F as FieldMeta, C as CollectionDescription, D as DescribeOptions } from './describe-C6iHNlqJ.js';
 import { C as CoordinationProvider, W as WriteEvent, a as WriteHook, U as Unsubscribe$3, b as WriteHookRegistry } from './index-B9QdHytu.js';
 import { AttestationFieldSchema, QrPayload, RevocationList } from '@noy-db/attestation';
 
@@ -630,6 +630,17 @@ declare class Lru<K, V> {
  * Internal service — not exported as a `@noy-db/hub/*` subpath.
  */
 
+/**
+ * One classified per-slot verdict from {@link RecordCodec.classifySealedShred}.
+ * `shreddable` — CEK-only, tombstone makes it undecryptable. `dekResidue` —
+ * collection-DEK-keyed, survives in synced/backup copies. The third class is
+ * BOTH: a `_bidx` blind-index tag is live-dropped by the tombstone yet retained
+ * under the surviving DEK in any pre-forget backup (honest dual accounting).
+ */
+type SealedShredSlot = {
+    readonly field: string;
+    readonly class: 'shreddable' | 'dekResidue' | 'live-shreddable+dekResidue-in-backups';
+};
 /** Everything the moving crypto methods touched on `this.*`, as a flat context. */
 interface RecordCodecContext<T> {
     /** Collection name — the crypto AAD scope and schema-error context. */
@@ -648,6 +659,16 @@ interface RecordCodecContext<T> {
     readonly deterministicFields: ReadonlySet<string> | null;
     /** Digest-only classified fields → verify policy (stage 2). Null when none. */
     readonly vdigFields: ReadonlyMap<string, VdigFieldPolicy> | null;
+    /**
+     * C-A / R10 config-drift signal: the persisted `x-classified` marker's
+     * declared digest-only field set (empty when the collection carries no
+     * marker). Lazy, memoized (O(1) per handle after the first call). The R10
+     * superset guard refuses whenever a field in this set is absent from
+     * `vdigFields`. Consulted once per handle on any encrypted write path — the
+     * cross-session, prev-free signal a fully-naive create has no `prev` for.
+     * Undefined on codecs with no store access (direct-construction tests).
+     */
+    classifiedMarkerDigestOnly?(): Promise<readonly string[]>;
     /** CRDT mode (decrypt resolves CrdtState→snapshot when set). */
     readonly crdtMode: CrdtMode | undefined;
     /** CRDT strategy seam (resolveCrdtSnapshot). */
@@ -760,8 +781,7 @@ declare class RecordCodec<T> {
      * `_cek` (pure legacy collection-DEK sealing) ALL slots are residue.
      */
     classifySealedShred(live: EncryptedEnvelope): Promise<{
-        shreddable: string[];
-        dekResidue: string[];
+        readonly slots: readonly SealedShredSlot[];
     }>;
     /**
      * Build a non-leaking {@link Sealed} handle over a sealed field's ciphertext.
@@ -3437,6 +3457,18 @@ declare class PortabilityNotEnabledError extends NoydbError {
 declare class CustodyNotEnabledError extends NoydbError {
     constructor(message?: string);
 }
+/**
+ * Thrown when a multi-user team operation — `db.grant`, `db.revoke`, or
+ * `db.rotate` — is called without opting into the team capability (the
+ * default `NO_TEAM` stub). The always-on floor is single-user by design
+ * (#267 keyring-grant → team split): enable multi-user grant/revoke/rotate
+ * with `teamStrategy: withTeam()` from "@noy-db/hub/team" in createNoydb().
+ * Single-user primitives (owner keyring, unlock, `listUsers`, `updateUser`,
+ * passphrase rotate/recover) stay ungated.
+ */
+declare class TeamNotEnabledError extends NoydbError {
+    constructor(message?: string);
+}
 /**
  * Thrown when a search / retrieval capability method — `collection.search`,
  * `collection.retrieve`, `collection.similarTo`, `collection.warmIndex`,
@@ -4909,8 +4941,17 @@ interface ConsentContext {
      */
     readonly consentHash: string;
 }
-/** Access operation recorded in an audit entry. */
-type ConsentOp = 'get' | 'put' | 'delete' | 'reveal' | 'verify';
+/**
+ * Access operation recorded in an audit entry.
+ *
+ * Union-widening checklist (I-2) — these three sites widen together or a
+ * downstream exhaustive switch breaks at its next in-range minor:
+ *   1. `ConsentOp` here (public, re-exported at `index.ts`).
+ *   2. `onAccess` op union on `kernel/collection-config.ts`.
+ *   3. classified ctx `onAccess` op union on `with-shape/classified/strategy.ts`
+ *      (the `ClassifiedVerifyCtx` one — the `ClassifiedRevealCtx` one stays `'reveal'`-only).
+ */
+type ConsentOp = 'get' | 'put' | 'delete' | 'reveal' | 'verify' | 'find';
 /** One consent-audit record, as decrypted for the caller. */
 interface ConsentAuditEntry {
     /** ULID — stable insertion-order key. */
@@ -5719,6 +5760,14 @@ interface ClassifiedFieldSpec {
     readonly notLastN?: number;
     /** Member of the collection's matchGroup (secretAnswer preset). */
     readonly verifyGroupMember?: true;
+    /**
+     * Opt into a store-visible blind-index (`_bidx`) tag so equal values become
+     * queryable/joinable while staying digest-only. Digest-only knob (R7); gated
+     * behind the collection's `acknowledgeEquatableRisk` door (R8). Equal values
+     * produce equal tags — a partition leak a DEK holder can offline-dictionary
+     * at the PBKDF2 floor. Absent/false ⇒ refused-by-default.
+     */
+    readonly equatable?: true;
 }
 interface ClassifiedGroup {
     readonly _noydbClassifiedGroup: true;
@@ -8363,6 +8412,7 @@ declare const NO_SEARCH: SearchStrategy;
  *
  * @module
  */
+
 /** Family of Standard Schema v1 validator the persisted snapshot was derived from. */
 type PersistedSchemaKind = 'Zod' | 'Valibot' | 'ArkType' | 'Effect' | 'Unknown';
 /**
@@ -8387,6 +8437,15 @@ interface PersistedSchemaEnvelope {
     readonly reason?: string;
     /** ISO-8601 timestamp of the most recent derivation write. */
     readonly derivedAt: string;
+    /**
+     * C-A / R10 config-drift marker. Present when the collection declares
+     * classified digest-only fields. A handle opened WITHOUT `classifiedFields`
+     * (a naive handle, whose codec has `vdigFields === null`) reads this back and
+     * refuses to write — a silent plaintext/tag-drop write would corrupt the
+     * classified record. Independent of `persistJsonSchema`: a classified
+     * collection that never opts into schema persistence still writes this marker.
+     */
+    readonly classified?: ClassifiedMarker;
 }
 
 /**
@@ -10921,6 +10980,48 @@ interface Assignment {
     serial: number;
 }
 
+/**
+ * Lazy-mode capability contract (#267 Track A tail — lazy-mode promoted out
+ * of `routing` into its own `lazy` service). Lives on the `/with` port (the
+ * one seam the kernel spine may import statically) so `Collection` can hold
+ * the back-compat default without a spine→service static import.
+ *
+ * Lazy mode (`prefetch: false`) skips bulk hydration: reads go per-id
+ * against the store and land in a bounded LRU working set. The strategy owns
+ * constructing that LRU:
+ *
+ *  - `withLazy()` (`with-store/lazy/active.ts`, subpath `@noy-db/hub/lazy`)
+ *    is the explicit catalog opt-in — silent, forward-stable.
+ *  - {@link IMPLICIT_LAZY} is the floor default reached when a collection
+ *    declares `prefetch: false` WITHOUT `lazyStrategy: withLazy()`. It keeps
+ *    the pre-#267 behavior byte-for-byte (back-compat delegation, pre-1.0)
+ *    but emits a one-time deprecation warn outside test env. It will become
+ *    a throwing stub at 1.0, letting the LRU leave the floor bundle
+ *    entirely once the per-record-CEK cache stops pinning `Lru` there.
+ *
+ * The on-demand read/write branches themselves stay kernel-resident (they
+ * are `if (this.lazy)` forks on the hot get/put/scan paths); the service
+ * seam owns cache construction + budget validation, which is where the
+ * opt-in and the future tree-shake win live.
+ * @internal
+ */
+
+interface LazyStrategy {
+    /**
+     * Build the bounded LRU working-set cache for a lazy collection.
+     * MUST throw when `cache` declares neither `maxRecords` nor `maxBytes` —
+     * an unbounded lazy cache defeats the purpose.
+     */
+    createCache<V>(collection: string, cache: CacheOptions | undefined): Lru<string, V>;
+}
+/**
+ * Back-compat default (deprecated): `prefetch: false` without
+ * `lazyStrategy: withLazy()`. Identical behavior to the explicit opt-in,
+ * plus a one-time deprecation warn (suppressed under NODE_ENV=test,
+ * mirroring the listPage fallback warn). @internal
+ */
+declare const IMPLICIT_LAZY: LazyStrategy;
+
 /**
  * Enable the hierarchical-tiers capability.
  * Pass to `createNoydb({ tiersStrategy: withTiers() })` to make a collection's
@@ -11045,8 +11146,7 @@ declare function demote<T>(ctx: TiersContext<T>, id: string, toTier: number): Pr
  * here because `vault.ts` forget() reaches in via `collection._classifySealedShred`.
  */
 declare function classifySealedShred<T>(ctx: TiersContext<T>, live: EncryptedEnvelope): Promise<{
-    shreddable: string[];
-    dekResidue: string[];
+    readonly slots: readonly SealedShredSlot[];
 }>;
 
 /**
@@ -11746,23 +11846,15 @@ interface HistoryStrategy {
 }
 
 /**
- * `_links_*` reserved collections — managed bidirectional many-to-many
- * junctions (design B).
- *
- * Where `refArray` (design A) stores an id-array on one owning record,
- * `vault.link()` creates a first-class junction: a dedicated encrypted
- * `_links_<name>` collection whose rows are `{ a, b, meta? }` link tuples.
- * It is queryable from BOTH sides (`of(id)`), carries optional per-link
- * metadata, and cascades on endpoint delete.
- *
- * Each link is slot-typed: `a` is an id in the `a` endpoint collection,
- * `b` an id in the `b` endpoint collection (they may be the same
- * collection for self-links). A link's identity is the ordered pair
- * `(a, b)`; `of(id)` matches either slot.
+ * Link-set naming helpers, declaration types, and errors — the tiny,
+ * always-loadable slice of the links feature (#553).
  *
- * Rows are encrypted under a dedicated `_links_<name>` DEK — same
- * zero-knowledge stack as every other collection (the store sees only
- * ciphertext). Backup/restore rides the normal `loadAll` path.
+ * Split out of `link-set.ts` so the kernel floor (reserved-name guard in
+ * `vault.collection()`, the lazy `vault.links()` handle) and the ref/link
+ * enforcement facade can bind these few lines WITHOUT statically pulling
+ * the `LinkSet` storage engine; that class now loads via dynamic import
+ * on first link I/O. `link-set.ts` re-exports everything here, so import
+ * paths and class identities are unchanged for existing consumers.
  */
 
 /** True for any reserved link-collection name. */
@@ -11801,13 +11893,6 @@ interface LinkSetHandle {
     /** All links in the set. */
     list(): Promise<LinkRow[]>;
 }
-/** Thrown by `connect()` when an endpoint record does not exist. */
-declare class LinkEndpointError extends NoydbError {
-    readonly link: string;
-    readonly endpoint: string;
-    readonly missingId: string;
-    constructor(link: string, endpoint: string, missingId: string);
-}
 /** Thrown when a `strict` link blocks deletion of an endpoint that still has links. */
 declare class LinkIntegrityError extends NoydbError {
     readonly link: string;
@@ -12558,11 +12643,13 @@ declare function liberateVault(vault: Vault, opts: LiberateOptions): Promise<Lib
  * The grant/revoke engine the strategy runs when opted in — implemented by
  * `Noydb` (`_grantCustodianImpl` / `_revokeCustodianImpl` hold the gate +
  * keyring logic; the public `grantCustodian` / `revokeCustodian` route through
- * the strategy).
+ * the strategy). Since the #267 team split the keyring grant/revoke engines
+ * are passed IN by `withCustody()` (statically linked there, not in the
+ * kernel) so the single-user floor never carries them.
  */
 interface CustodyHost {
-    _grantCustodianImpl(vault: string, options: GrantCustodianOptions, factors?: FactorProofBundle): Promise<void>;
-    _revokeCustodianImpl(vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
+    _grantCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions) => Promise<void>, vault: string, options: GrantCustodianOptions, factors?: FactorProofBundle): Promise<void>;
+    _revokeCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
 }
 interface CustodyStrategy {
     grantCustodian(host: CustodyHost, vault: string, options: GrantCustodianOptions, factors?: FactorProofBundle): Promise<void>;
@@ -12950,7 +13037,7 @@ interface ClassifiedVerifyCtx {
         readonly field: string;
         readonly spec: ClassifiedFieldSpec;
     }>;
-    readonly onAccess?: ((op: 'verify', id: string) => Promise<void>) | undefined;
+    readonly onAccess?: ((op: 'verify' | 'find', id: string) => Promise<void>) | undefined;
 }
 interface ClassifiedStrategy {
     reveal(ctx: ClassifiedRevealCtx, id: string, field: string): Promise<unknown>;
@@ -12961,6 +13048,7 @@ interface ClassifiedStrategy {
     }): Promise<{
         readonly passed: boolean;
     }>;
+    computeTarget(ctx: ClassifiedVerifyCtx, field: string, candidate: string, costByte?: number): Promise<string | null>;
 }
 declare const NO_CLASSIFIED: ClassifiedStrategy;
 
@@ -13004,6 +13092,7 @@ declare class Vault {
     /** Per-collection record archival policies. Indexed by collection name. */
     private readonly archiveRegistry;
     private readonly indexStrategy;
+    private readonly lazyStrategy;
     private readonly aggregateStrategy;
     private readonly crdtStrategy;
     private readonly tiersStrategy;
@@ -13218,7 +13307,7 @@ declare class Vault {
     private readonly dictionaryCache;
     /** Registered link specs, keyed by link name; set by `vault.link()`. */
     private readonly linkRegistry;
-    /** Cache of LinkSet handles, one per link name. */
+    /** Cache of link-set handles, one per link name (lazy -- see links()). */
     private readonly linkSetCache;
     /** — subscribers for cross-tier access events. */
     private readonly crossTierSubs;
@@ -13260,6 +13349,7 @@ declare class Vault {
         objectStore?: ObjectProjection | undefined;
         archiveStrategy?: ArchiveStrategy | undefined;
         indexStrategy?: IndexStrategy | undefined;
+        lazyStrategy?: LazyStrategy | undefined;
         aggregateStrategy?: AggregateStrategy | undefined;
         crdtStrategy?: CrdtStrategy | undefined;
         tiersStrategy?: TiersStrategy | undefined;
@@ -13362,6 +13452,9 @@ declare class Vault {
         deterministicFields?: readonly IndexFieldName<T, S>[];
         /** — explicit ack that deterministic encryption leaks equality. */
         acknowledgeDeterministicRisk?: boolean;
+        /** — explicit ack for the classified `equatable` knob (R8 door). Required
+         *  when any classified field declares `equatable: true`. */
+        acknowledgeEquatableRisk?: boolean;
         /**
          * — structural group-encryption. Fields sealed into their own
          * `_sealed[field]` envelope slot (per-field key), kept out of the open
@@ -13472,8 +13565,8 @@ declare class Vault {
     abortSchemaCutover(): Promise<void>;
     /** Current schema-cutover fence state for this vault. Thin live read. */
     schemaFenceState(): Promise<FenceDoc>;
-    /** @internal Start the per-client heartbeat + fence watcher once a cutover is registered. */
-    _ensureFenceCoordination(): void;
+    /** @internal Start heartbeat + fence watcher once a cutover is registered. Async since #553: FenceWatcher dynamic-imports on demand. */
+    _ensureFenceCoordination(): Promise<void>;
     /** @internal Stop the heartbeat/watcher (vault lock/close). */
     _stopFenceCoordination(): void;
     /** @internal Best-effort flush of all open collections' persisted
@@ -14699,6 +14792,23 @@ interface GateEventMap {
 }
 type GatePoint = keyof GateEventMap;
 type GateHandler<P extends GatePoint> = (event: GateEventMap[P]) => void | Promise<void>;
+/**
+ * Registration options for a gate handler.
+ *
+ * `needsPrior` (default `true`) declares whether the handler reads the
+ * prior-derived event fields — `existing`, `existingVersion`, `existingTs`,
+ * and (on `beforePut`) `op`. When EVERY handler registered at a point set
+ * `needsPrior: false`, the write path skips the prior-read (store get +
+ * decrypt) entirely and dispatches the event with `existing: null`,
+ * `existingVersion: 0`, `existingTs: undefined` (and `op: 'create'` on
+ * `beforePut`; a `beforeDelete` gate then also fires for delete-of-absent).
+ * A handler that opts out MUST NOT rely on those fields. (#267 prior-read
+ * elision — pure perf; one prior-needing handler restores the old behavior
+ * for the whole point.)
+ */
+interface GateRegisterOptions {
+    readonly needsPrior?: boolean;
+}
 declare class ServiceBus {
     #private;
     /** Register a handler for an observe point. Returns an unsubscribe fn. */
@@ -14724,10 +14834,21 @@ declare class ServiceBus {
      * cannot loop (same rationale as WriteHookRegistry.#suppressed).
      */
     dispatch<P extends LifecyclePoint>(point: P, event: LifecycleEventMap[P]): Promise<void>;
-    /** Register a write-gating handler. A throw from the handler ABORTS the write. Returns an unsubscribe fn. */
-    registerGate<P extends GatePoint>(point: P, handler: GateHandler<P>): Unsubscribe$2;
+    /**
+     * Register a write-gating handler. A throw from the handler ABORTS the
+     * write. Returns an unsubscribe fn. See {@link GateRegisterOptions} for
+     * the `needsPrior` prior-read declaration (#267).
+     */
+    registerGate<P extends GatePoint>(point: P, handler: GateHandler<P>, opts?: GateRegisterOptions): Unsubscribe$2;
     /** Cheap gate for the write path — true when any gate handler is registered for the point. */
     hasGateHandlers(point: GatePoint): boolean;
+    /**
+     * True when at least one gate handler at `point` needs the prior record
+     * (the default). False when the point has no handlers or every handler
+     * registered with `needsPrior: false` — the write path then skips the
+     * prior-read before dispatching (#267 prior-read elision).
+     */
+    gateNeedsPrior(point: GatePoint): boolean;
     /**
      * Run gate handlers in registration order, awaited. Unlike `dispatch`
      * (observe), a handler throw is NOT swallowed — it PROPAGATES, aborting the
@@ -14944,7 +15065,7 @@ interface DryRunResult {
 }
 
 /** NoydbOptions with the store resolved to a non-optional value (internal use only). */
-type ResolvedNoydbOptions = NoydbOptions & {
+type ResolvedNoydbOptions$1 = NoydbOptions & {
     readonly store: NoydbStore;
 };
 /** The top-level NOYDB instance. */
@@ -14963,6 +15084,15 @@ declare class Noydb {
     /** Pre-resolved `vault.user` API factory (mirrors `coordinationProvider` above). Public so `Vault` can call it. */
     readonly userApiFactory: UserApiFactory;
     private readonly vaultCache;
+    /**
+     * In-flight `openVault` promise per name — concurrent opens of the same
+     * vault must converge on ONE Vault instance. Without this, two callers
+     * racing past the `vaultCache` miss each construct a Vault (and later two
+     * Collections with independent DEKs for the same store slice), so a record
+     * written through one fails decryption through the other with a spurious
+     * `TamperedError` (#564).
+     */
+    private readonly vaultOpening;
     private readonly keyringCache;
     private readonly syncEngines;
     /**
@@ -15002,6 +15132,11 @@ declare class Noydb {
      * through it; grant/revoke route through it from this class. @internal
      */
     readonly custodyStrategy: CustodyStrategy;
+    /**
+     * Opt-in multi-user team strategy (#267 keyring-grant → team split) —
+     * `NO_TEAM` (throwing) unless `withTeam()` was passed; the keyring
+     * engines are linked only by the active strategy, not by this file. */
+    private readonly teamStrategy;
     private readonly sessionStrategy;
     private readonly syncStrategy;
     private readonly snapshots;
@@ -15027,7 +15162,7 @@ declare class Noydb {
     private readonly translatorCache;
     /** Audit log for all translator invocations in this session. Cleared on `close()`. */
     private readonly _translatorAuditLog;
-    constructor(options: ResolvedNoydbOptions);
+    constructor(options: ResolvedNoydbOptions$1);
     /** @internal — resolved forget strategy (NO_FORGET when not configured). */
     get _forgetStrategy(): ForgetStrategy;
     private resetSessionTimer;
@@ -15067,6 +15202,7 @@ declare class Noydb {
      *
      * The legacy `requireReAuthFor: ['grant']` session-policy check still
      * fires on top — both are independent opt-ins.
+     * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
      */
     grant(vault: string, options: GrantOptions, factors?: FactorProofBundle): Promise<void>;
     /**
@@ -15077,6 +15213,7 @@ declare class Noydb {
      *
      * The legacy `requireReAuthFor: ['revoke']` session-policy check still
      * fires on top — both are independent opt-ins.
+     * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
      */
     revoke(vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
     /**
@@ -15090,8 +15227,9 @@ declare class Noydb {
      * owner-only invariant even if a host mis-configures the gate.
      */
     grantCustodian(vault: string, options: Omit<GrantOptions, 'role'>, factors?: FactorProofBundle): Promise<void>;
-    /** @internal — the grant-custodian engine, reached only when withCustody() is opted in. */
-    _grantCustodianImpl(vault: string, options: Omit<GrantOptions, 'role'>, factors?: FactorProofBundle): Promise<void>;
+    /** @internal — grant-custodian engine, reached only via withCustody(); the
+     * keyring engine arrives as an argument so the floor never carries it (#267). */
+    _grantCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions) => Promise<void>, vault: string, options: Omit<GrantOptions, 'role'>, factors?: FactorProofBundle): Promise<void>;
     /**
      * Revoke a custodian (owner-only custody API).
      *
@@ -15100,8 +15238,9 @@ declare class Noydb {
      * 'owner'` check, so an admin cannot unwind a custodianship.
      */
     revokeCustodian(vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
-    /** @internal — the revoke-custodian engine, reached only when withCustody() is opted in. */
-    _revokeCustodianImpl(vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
+    /** @internal — revoke-custodian engine, reached only via withCustody().
+     * Mirrors `_grantCustodianImpl` (#267: engine passed in). */
+    _revokeCustodianImpl(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
     /**
      * Mutate post-grant identity fields on an existing keyring — `role`,
      * `displayName`, and/or `permissions`. Pure plaintext-header rewrite:
@@ -15160,6 +15299,7 @@ declare class Noydb {
      * Exposed on Noydb (rather than only on the lower-level keyring
      * module) so CLI and admin tooling can trigger rotation without
      * reaching into internals. See `noy-db rotate` for the CLI wrapper.
+     * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
      */
     rotate(vault: string, collections: string[]): Promise<void>;
     /** List all users with access to a vault. */
@@ -16107,6 +16247,12 @@ interface CollectionOpts<T> {
      * unbounded lazy cache defeats the purpose.
      */
     cache?: CacheOptions | undefined;
+    /**
+     * Lazy service seam (#267) — supplies the bounded-LRU working-set cache
+     * when `prefetch: false`. Omitted → the deprecated IMPLICIT_LAZY
+     * back-compat default (identical behavior + one-time warn).
+     */
+    lazyStrategy?: LazyStrategy | undefined;
     /**
      * Optional Standard Schema v1 validator (Zod, Valibot, ArkType,
      * Effect Schema, etc.). When set, every `put()` is validated before
@@ -16234,7 +16380,7 @@ interface CollectionOpts<T> {
      * outside a consent scope the callback is a no-op. Awaited so a
      * thrown audit write surfaces to the caller.
      */
-    onAccess?: (op: 'get' | 'put' | 'delete' | 'reveal' | 'verify', id: string) => Promise<void>;
+    onAccess?: (op: 'get' | 'put' | 'delete' | 'reveal' | 'verify' | 'find', id: string) => Promise<void>;
     /**
      * invoked by `put`/`delete` before any adapter
      * write. Receives the prior envelope timestamp + decrypted
@@ -16264,6 +16410,13 @@ interface CollectionOpts<T> {
      * any deterministic field is declared. Any other value throws.
      */
     acknowledgeDeterministicRisk?: boolean | undefined;
+    /**
+     * gate for the classified `equatable` knob (R8 double door). Must be `true`
+     * when any classified field declares `equatable: true`; otherwise construction
+     * throws. One-directional — setting it with zero equatable members is a
+     * silent no-op (mirrors `acknowledgeDeterministicRisk`).
+     */
+    acknowledgeEquatableRisk?: boolean | undefined;
     /**
      * Structural group-encryption. Fields listed here are
      * encrypted into their own `_sealed[field]` envelope slot — each under
@@ -16636,6 +16789,9 @@ declare class Collection<T, S extends keyof T = never, Q extends keyof T & strin
      * `_vdig` forward under (C6). `null` when the collection declares none.
      */
     private readonly vdigFields;
+    /** C-A/R10 memoization: marker declared-set lookup (undefined=unresolved) + classified-handle persist-once flag. */
+    private _markerDigestOnlyCache;
+    private _markerPersisted;
     /**
      * Tree-shake seam for `reveal()` — defaults to `NO_CLASSIFIED`, which
      * throws `ClassifiedNotEnabledError`. Set via the `classifiedStrategy`
@@ -16858,6 +17014,59 @@ declare class Collection<T, S extends keyof T = never, Q extends keyof T & strin
         readonly passed: boolean;
     }>;
     private _classifiedVerifyCtx;
+    /**
+     * Equatable blind-index lookup: the ids whose classified digest-only
+     * `equatable` field carries a `_bidx` tag matching `candidate` AND whose
+     * `_vdig` payload confirms it. Requires the field to be declared
+     * `classified.password({ equatable: true })` (or `secretAnswer`) and the
+     * collection to have opened its `acknowledgeEquatableRisk` door.
+     *
+     * The algorithm order is load-bearing (spec §3):
+     *  1. Caller-bug refusals thrown at ~0 elapsed, BEFORE any PBKDF2 (R9 /
+     *     Oracle #6): the three field mis-declarations share ONE constant,
+     *     field-name-free message so the refusal text cannot enumerate which
+     *     fields are classified / digest-only / equatable.
+     *  2. Derive the ONE blind-index target UNCONDITIONALLY (I-1 / F1): an empty
+     *     collection still pays exactly one 600K PBKDF2, so wall-time can never
+     *     distinguish "no records" from "no match". No early return may precede
+     *     this line.
+     *  3. Scan `list + one get` per id, string-comparing the stored `_bidx` tag —
+     *     decrypting NOTHING — and retain each hit's already-fetched envelope.
+     *  4. Emit the single sweep consent op (`onAccess('find', '*')`) now — after
+     *     the scan, before confirm (Oracle #5) — fixing its store-write timestamp
+     *     independent of hit count.
+     *  5. Confirm-by-verify against the ALREADY-FETCHED envelope (C-B): run the
+     *     enclave `verifyDigestField` on an in-memory `getEnvelope` closure so the
+     *     confirm reads ZERO additional envelopes. A tag-hit whose `_vdig` fails
+     *     to confirm is dropped silently (a splice is indistinguishable from a
+     *     stale tag). Store-shape law: the only store calls are `list + N get`.
+     */
+    findByDigest(field: string, candidate: string): Promise<readonly string[]>;
+    /**
+     * Retire a field's equatable blind-index (`_bidx`) coverage across every
+     * live record — the SOLE lazy-write-independent drop-path for a still-live
+     * record's tag (besides clear / `forget()` / DEK-rotation). For each envelope
+     * carrying `_bidx[field]`, rewrite it WITHOUT that slot (dropping the whole
+     * `_bidx` map when it becomes empty), leaving `_vdig[field]` and everything
+     * else INTACT — the field stays `digest-only`, only the index coverage is
+     * retired. NO crypto, NO re-mint, NO re-encrypt: a targeted envelope rewrite.
+     * Returns the count of records scrubbed.
+     *
+     * This is a maintenance write, not a read-egress: it emits NO `'find'` op and
+     * no consent. The field is validated to a declared equatable digest-only
+     * classified field (only such a field ever carries `_bidx`).
+     *
+     * **Ledger consistency**: dropping `_bidx[field]` changes the envelope's
+     * payload hash (`_bidx` is bound into `envelopeBodyForHash`), so a raw
+     * `adapter.put` of the scrubbed envelope WITHOUT a matching ledger entry would
+     * desync the chain and make a future integrity cross-check flag false
+     * tampering. After each rewrite we therefore append an `op:'migration'` entry
+     * recording the NEW payloadHash at the SAME version — this is index retirement,
+     * not a new record version, so `_v` is NOT bumped; the migration op is
+     * reverse-delta-inert (`ledger.reconstruct` skips non-put/delete ops) yet
+     * keeps the hash chain and the record's latest recorded payloadHash correct.
+     */
+    scrubEquatableTags(field: string): Promise<number>;
     /**
      * @internal — attach money descriptors post-construction. MV dependency
      * analysis auto-creates a source collection (without options) during
@@ -17000,6 +17209,8 @@ declare class Collection<T, S extends keyof T = never, Q extends keyof T & strin
      * cache directly (no extra I/O), matching the previous behaviour exactly.
      */
     private resolvePriorValues;
+    /** Resolves the prior envelope/record for a gate event; elides the read (#267) when no handler at `point` needs it (`elided: true`, `env`/`record` null). */
+    private resolveGatePrior;
     /**
      * Wraps {@link RecordCodec.toCacheRecord} with an additional strip for
      * digest-only classified fields: the codec already omits them from `_data`
@@ -17731,6 +17942,10 @@ declare class Collection<T, S extends keyof T = never, Q extends keyof T & strin
      * CEK cache, live-envelope reader, and DEK resolver.
      */
     private resolveRecordCek;
+    /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
+    private _ensureClassifiedMarker;
+    /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
+    private _classifiedMarkerDigestOnly;
     /**
      * find the first record whose deterministic field matches
      * the given plaintext. Returns `null` when no match exists.
@@ -17785,8 +18000,7 @@ declare class Collection<T, S extends keyof T = never, Q extends keyof T & strin
      * Collection because `vault.ts` forget() reaches in via this name.
      */
     _classifySealedShred(live: EncryptedEnvelope): Promise<{
-        shreddable: string[];
-        dekResidue: string[];
+        readonly slots: readonly SealedShredSlot[];
     }>;
     /**
      * Bind the {@link TiersContext} the tier ops need. The `cekCache` is passed
@@ -17935,6 +18149,517 @@ interface TxStrategy {
     runDryRun(db: Noydb, fn: (tx: TxContext) => unknown): Promise<DryRunResult>;
 }
 
+/**
+ * Noydb-side auth / recovery / enrollment facade.
+ *
+ * Holds the tier-2 authenticator enrollment/unlock wrappers, WebAuthn
+ * enrollment, auth-config introspection, the tier-1 passphrase
+ * rotate/recover flows, the paper/Shamir recovery rotate/enroll flows,
+ * managed-passphrase recovery, peer-recovery, tier-3 PIN unlock, and the
+ * public `getKeyring` accessor.
+ *
+ * The near-parallel rotate/recover variants (managed vs user vs paper vs
+ * Shamir) are deliberately NOT consolidated. The
+ * keyring/active-tier/quick-unlock/policy caches stay `Noydb`-resident
+ * (shared by the kernel's unlock path) and arrive **by reference** through
+ * {@link TeamFacadeDeps}; the keyring-unlock path (`getKeyringInternal`),
+ * the policy gate (`checkGate`), the managed-recovery enrolment check
+ * (`assertRecoveryEnrolled`), `openVault`, and the one-shot
+ * managed-recovery skip flag stay kernel-resident and arrive as callbacks.
+ *
+ * Internal service — reached through `noydb.rotatePassphrase(...)` etc.
+ */
+
+/** NoydbOptions with the store resolved to a non-optional value (internal use only). */
+type ResolvedNoydbOptions = NoydbOptions & {
+    readonly store: NoydbStore;
+};
+/** Everything the moving auth/recovery/enrollment methods touched on the Noydb instance's `this.*`. */
+interface TeamFacadeDeps {
+    /** Resolved Noydb options (store, user, passphraseMode, sealingKey, shamirRecovery, …). */
+    readonly options: ResolvedNoydbOptions;
+    /** Live unlocked-keyring cache (Noydb-resident; read/written by reference). */
+    readonly keyringCache: Map<string, UnlockedKeyring>;
+    /** Per-vault active session tier (Noydb-resident; read/written by reference). */
+    readonly activeTier: Map<string, ActiveTier>;
+    /** Per-vault tier-3 quick-unlock state (Noydb-resident; read/written by reference). */
+    readonly quickUnlock: QuickUnlockStore;
+    /** Per-vault loaded policy cache (Noydb-resident; read/written by reference). */
+    readonly policyCache: Map<string, VaultPolicy>;
+    /** Evaluate the policy gate for an operation (kernel-resident). */
+    checkGate(vault: string, gate: GateName, factors?: FactorProofBundle): Promise<void>;
+    /** Legacy `requireReAuthFor` session-policy check (kernel-resident). */
+    checkPolicyOperation(vault: string, op: ReAuthOperation): void;
+    /** Live-reference keyring unlock path (kernel-resident). */
+    getKeyringInternal(vault: string, opts?: {
+        create: boolean;
+    }): Promise<UnlockedKeyring>;
+    /** Managed-recovery enrolment check (kernel-resident). */
+    assertRecoveryEnrolled(vault: string, policy: VaultPolicy, opts?: {
+        skipManagedCheck?: boolean;
+    }): Promise<void>;
+    /** Open (or create) a vault (kernel-resident). */
+    openVault(vault: string, opts?: {
+        locale?: string;
+    }): Promise<Vault>;
+    /** Toggle the one-shot managed-mode strong-recovery bypass flag (kernel-resident). */
+    setSkipNextManagedRecoveryCheck(value: boolean): void;
+}
+declare class TeamFacade {
+    private readonly deps;
+    constructor(deps: TeamFacadeDeps);
+    private requireShamirProvider;
+    /** Gate + run a `grant` engine. See `Noydb.grant` for the public contract. */
+    runGrant(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: GrantOptions) => Promise<void>, vault: string, options: GrantOptions, factors?: FactorProofBundle): Promise<void>;
+    /** Gate + run a `revoke` engine. See `Noydb.revoke` for the public contract. */
+    runRevoke(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, options: RevokeOptions) => Promise<void>, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
+    /** Gate + run a `rotateKeys` engine. See `Noydb.rotate` for the public contract. */
+    runRotate(engine: (adapter: NoydbStore, vault: string, callerKeyring: UnlockedKeyring, collections: string[]) => Promise<void>, vault: string, collections: string[]): Promise<void>;
+    /**
+     * Add a tier-2 authenticator slot to the calling user's keyring.
+     * Each slot independently wraps the SAME KEK under a method-specific
+     * key — adding a slot is a constant-time keyring write.
+     *
+     * The wrapping ciphertext is produced by the corresponding
+     * `@noy-db/on-*` package (e.g. `enrollPasswordAuthenticator` from
+     * `@noy-db/on-password`); the hub persists the result.
+     *
+     * Gated by `enroll-authenticator`; `presented` carries any factor
+     * proofs the active policy demands.
+     */
+    enrollAuthenticator(vault: string, options: EnrollAuthenticatorOptions, factors?: FactorProofBundle): Promise<void>;
+    /**
+     * Remove a tier-2 authenticator slot. Idempotent — removing a
+     * non-existent slot is a successful no-op. Gated by
+     * `remove-authenticator`.
+     */
+    removeAuthenticator(vault: string, slotId: string, factors?: FactorProofBundle): Promise<void>;
+    /** Read the slot list for a vault. Internal — `describeAuthConfig` consumes this. */
+    listAuthenticators(vault: string): Promise<ReadonlyArray<KeyringAuthenticator>>;
+    /**
+     * Mutate the `meta` blob on an existing authenticator slot — slot
+     * rename, label change, attachment of UI hints. The slot's `id`,
+     * `method`, and wrap material (`wrapped_kek` / `wrapped_deks` + `iv`)
+     * are immutable through this method. Anti-slot-swap is structural,
+     * not gate-driven.
+     *
+     * `meta` patch semantics (top-level merge):
+     *   - Top-level merge — absent keys preserved
+     *   - `null` value — delete that meta key
+     *   - Other values — replace verbatim
+     *
+     * Use case: per-slot nickname for "iPhone Touch ID" vs "MacBook
+     * Touch ID" disambiguation in admin UIs. The slot id (auto-derived
+     * from credentialId prefix) is not human-friendly; `meta.nickname`
+     * is.
+     *
+     * Gated by `update-authenticator`. PERSONAL_POLICY: tier-1 unlock
+     * alone (matches enroll/remove). STRICT_POLICY: tier-1 +
+     * TOTP/email-OTP factor proof — a malicious rename on a shared
+     * workstation could mislead the user about which device a slot
+     * corresponds to, so STRICT requires fresh factor binding.
+     *
+     * @throws `NoAccessError` when no slot with the given id exists.
+     * @throws `ValidationError` when no patch field is provided.
+     */
+    updateAuthenticator(vault: string, slotId: string, options: UpdateAuthenticatorOptions, factors?: FactorProofBundle): Promise<void>;
+    /**
+     * Native WebAuthn enrollment using the **real** internal keyring.
+     *
+     * Why this exists: when a consumer is using `createNoydb({ secret })`,
+     * they cannot reach the live `UnlockedKeyring` to feed it to
+     * `enrollWebAuthn(keyring, vault, opts)` from `@noy-db/on-webauthn`.
+     * Constructing a synthetic keyring (the previous workaround) produces
+     * a slot whose `wrapped_kek` references the synthetic payload, not
+     * the live session — so `unlockViaAuthenticator()` later replaces the
+     * live DEK map with stale wrapped DEKs and every decrypt fails.
+     *
+     * This method runs `ceremony` with the REAL keyring (still in
+     * `keyringCache`). The ceremony performs the WebAuthn enrollment and
+     * returns the slot options that hub then persists via the standard
+     * tier-2 enrollAuthenticator path.
+     *
+     * Layering note: hub does not import `@noy-db/on-webauthn` (that
+     * would invert the dep graph). The consumer wires it in:
+     *
+     * ```ts
+     * import { enrollWebAuthn } from '@noy-db/on-webauthn'
+     *
+     * await db.enrollWebAuthn('demo', async (keyring) => {
+     *   const e = await enrollWebAuthn(keyring, 'demo', { rp: {...} })
+     *   return {
+     *     id: `webauthn-${e.credentialId.slice(0, 8)}`,
+     *     method: 'webauthn',
+     *     wrapped_kek: e.wrappedPayload,
+     *     meta: {
+     *       credentialId: e.credentialId,
+     *       wrapIv: e.wrapIv,
+     *       prfUsed: e.prfUsed,
+     *       beFlag: e.beFlag,
+     *       requireSingleDevice: e.requireSingleDevice,
+     *     },
+     *   }
+     * })
+     * ```
+     *
+     * Returns the WebAuthn `credentialId` (extracted from `meta.credentialId`)
+     * for the caller's lookup index (a bootstrap vault, a PublicEnvelope,
+     * a server-side allowlist).
+     *
+     * Gated by `enroll-authenticator` like `enrollAuthenticator()` itself.
+     */
+    enrollWebAuthn(vault: string, ceremony: (keyring: UnlockedKeyring) => Promise<EnrollAuthenticatorOptions>, factors?: FactorProofBundle): Promise<{
+        credentialId: string;
+    }>;
+    /**
+     * Filter the slot list to webauthn-method slots only. Useful for
+     * "you have N WebAuthn credentials enrolled" UI surfaces and for
+     * deciding when a new device prompt should appear. Identity is
+     * `id` + `enrolled_at`; the `meta.credentialId` (base64) is used by
+     * `allowCredentials` at unlock time.
+     */
+    listWebAuthnSlots(vault: string): Promise<ReadonlyArray<{
+        id: string;
+        enrolledAt: string;
+        credentialId: string;
+    }>>;
+    /**
+     * Resolve a slot by id, then hand the wrapped-KEK ciphertext + meta
+     * to the caller-supplied verifier. The verifier is the
+     * `unlockWith*` function from the corresponding `@noy-db/on-*`
+     * package, e.g. `unlockWithPassword(slot, password)`.
+     *
+     * On success, mark the active session tier as 2 — subsequent
+     * `checkGate` calls see a tier-2 unlock.
+     */
+    unlockViaAuthenticator(vault: string, slotId: string, verify: (slot: KeyringAuthenticator) => Promise<UnlockedKeyring>): Promise<UnlockedKeyring>;
+    /** English summary of the configured auth model. */
+    describeAuthConfig(vault: string): Promise<string>;
+    /** Mermaid `flowchart TB` source for the auth graph. */
+    diagramAuthConfig(vault: string): Promise<string>;
+    /**
+     * Per-user enrollment summary. Gated by `view-user-auth` (default:
+     * disabled). Sanitization is allowlist-based — never renders cred
+     * ids, password hashes, secrets, or any field outside the allowlist.
+     */
+    describeUserAuth(vault: string, userId: string, factors?: FactorProofBundle): Promise<string>;
+    /** Bulk variant for owner dashboards. Gated by `view-user-auth`. */
+    describeAllUsersAuth(vault: string, factors?: FactorProofBundle): Promise<Array<{
+        userId: string;
+        description: string;
+    }>>;
+    /**
+     * Rotate the user's passphrase (user remembers old). Validates the
+     * new phrase against the configured `passphrase` policy, runs the
+     * `rotate-passphrase` gate, then re-derives + re-wraps every DEK.
+     *
+     * Tier-2 authenticator slots are dropped — each slot wraps the old
+     * KEK and would need its derivation key to be re-presented. Re-enrol
+     * via `db.enrollAuthenticator` after rotation.
+     *
+     * @throws `WeakPassphraseError` on a weak new phrase.
+     * @throws `PolicyDeniedError` when the gate denies (missing factor, …).
+     * @throws `InvalidKeyError` when `oldPassphrase` is wrong.
+     */
+    rotatePassphrase(vault: string, input: RotatePassphraseInput, factors?: FactorProofBundle): Promise<void>;
+    /**
+     * Reset the passphrase using a recovery proof (user forgot the old).
+     * Currently supports the `'paper'` profile end-to-end; the
+     * other profiles throw {@link RecoveryProfileNotImplementedError}.
+     *
+     * Burns the used recovery entry on success.
+     */
+    recoverPassphrase(vault: string, input: RecoverPassphraseInput, factors?: FactorProofBundle): Promise<RecoverPassphraseResult>;
+    /**
+     * Deliberate paper-recovery-code regeneration. User knows their
+     * passphrase but wants a fresh sheet — they lost the printout or
+     * suspect compromise of the off-site copy.
+     *
+     * Symmetric to {@link rotatePassphrase} for the recovery profile:
+     * gated, audit-trackable, ergonomic. Replaces (not appends) the
+     * paper sheet under `_meta/recovery-paper` in a single envelope `put`.
+     *
+     * Gated by the `rotate-recovery` policy gate:
+     *   - PERSONAL_POLICY: `{ minTier: 1 }` — knowing the passphrase
+     *     suffices, matching the lower-level flow's bar.
+     *   - STRICT_POLICY: `{ minTier: 1, factors: [{ anyOf: ['totp',
+     *     'email-otp', 'webauthn-roaming'] }] }` — rotation is an
+     *     off-site-trust event; require an off-device factor so a
+     *     stolen unlocked laptop cannot silently mint a sheet for the
+     *     attacker.
+     *
+     * Defaults `count` to the existing sheet size so consumers aren't
+     * surprised by a different code count. Explicit `count` overrides.
+     *
+     * @throws {@link RecoveryProfileNotImplementedError} when `profile`
+     *         is anything other than `'paper'` (v1 dispatch limit).
+     * @throws {@link PolicyDeniedError} when the gate denies (missing
+     *         factor, tier mismatch, ...).
+     * @throws on missing paper sheet — "nothing to rotate" surfaces as
+     *         an error rather than silently minting an entire new sheet.
+     *
+     * @example Default count + show-once UI
+     * ```ts
+     * const { newCodes } = await db.rotateRecovery('acme', { profile: 'paper' })
+     * showCodesToUser(newCodes)
+     * ```
+     *
+     * @example STRICT-policy site with TOTP factor proof
+     * ```ts
+     * await db.rotateRecovery(
+     *   'acme',
+     *   { profile: 'paper', count: 10 },
+     *   { factors: [{ kind: 'totp', proof: '123456' }] },
+     * )
+     * ```
+     */
+    rotateRecovery(vault: string, options: RotateRecoveryOptions, factors?: FactorProofBundle): Promise<RotateRecoveryResult>;
+    private rotateRecoveryPaper;
+    private rotateRecoveryShamir;
+    /**
+     * **Atomic create-and-enroll for managed-mode vaults.**
+     *
+     * Bootstraps a managed-mode vault and enrolls strong recovery in
+     * a single ceremony. Under `passphraseMode: 'managed'`, every
+     * `openVault` call requires a strong recovery profile (Shamir
+     * today) to be enrolled — otherwise it throws
+     * {@link ManagedRecoveryNotEnrolledError}. This method bypasses
+     * the check temporarily so the keyring can be created, enrolls
+     * the supplied recovery profile(s), then returns the vault.
+     *
+     * For Shamir enrollments, the show-once share strings come back
+     * in `recoveryEnrollments[i].shares`. The hub never retains them
+     * — the caller MUST display them to the user (once) before any
+     * subsequent operation.
+     *
+     * Paper alone is NOT a strong profile under managed mode; passing
+     * `{ profile: 'paper', ... }` without an accompanying shamir entry
+     * is rejected at validation time.
+     *
+     * ```ts
+     * const db = await createNoydb({
+     *   store, user: 'alice',
+     *   passphraseMode: 'managed',
+     *   sealingKey: macosKeychainSealingProvider({ ... }),
+     * })
+     *
+     * const { vault, recoveryEnrollments } = await db.openVaultAndEnrollRecovery('acme', {
+     *   recovery: [{ profile: 'shamir', k: 2, n: 3 }],
+     * })
+     * for (const r of recoveryEnrollments) {
+     *   if (r.shares) showSharesToUser(r.shares)  // ONCE
+     * }
+     * ```
+     *
+     * @throws ValidationError if recovery is empty, or contains no
+     *   strong profile under managed mode.
+     */
+    openVaultAndEnrollRecovery(vault: string, opts: {
+        readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>;
+        readonly locale?: string;
+    }): Promise<{
+        readonly vault: Vault;
+        readonly recoveryEnrollments: ReadonlyArray<EnrollRecoveryResult>;
+    }>;
+    /**
+     * **Recovery flow under managed-passphrase mode.**
+     *
+     * Replaces the sealed passphrase of a managed-mode vault with a
+     * fresh 256-bit random, sealed under the configured
+     * `SealingKeyProvider`. The user never sees the new passphrase.
+     *
+     * Internally:
+     *   1. Verify the recovery proof (Shamir today) and unwrap the
+     *      DEK set.
+     *   2. Mint a fresh 256-bit random as the new effective passphrase.
+     *   3. Rewrap the DEK set under a fresh KEK derived from the new
+     *      passphrase (via the existing `recoverPassphrase` path).
+     *   4. Seal the random bytes under the provider and overwrite
+     *      `_meta/sealed-passphrase`.
+     *   5. Drop the keyring cache so the next operation re-derives.
+     *
+     * The vault's strong-recovery enrollment is preserved across
+     * recovery (Shamir entries are not burned on use).
+     *
+     * @throws ValidationError if the Noydb instance is not in managed mode.
+     */
+    recoverManagedPassphrase(vault: string, options: {
+        readonly recoveryProof: RecoveryProof;
+        readonly passphrasePolicy?: PassphrasePolicy;
+    }): Promise<void>;
+    /**
+     * Atomic peer-recovery — re-wraps an EXISTING user's keyring under
+     * a fresh temp passphrase in a single store write. Closes the
+     * partial-failure window (the previous compose-from-primitives
+     * pattern was `db.revoke + db.grant`, two writes — if the issuer
+     * cancelled between them the target was locked out entirely).
+     *
+     * Different from `db.revoke + db.grant`:
+     *
+     *   - Same `userId`, role, permissions, capabilities preserved.
+     *   - DEKs unchanged → every other principal in the vault keeps
+     *     access. No key rotation.
+     *   - Allows owner→owner natively. The existing
+     *     `db.revoke` retains its block — peer-recovery is a separate,
+     *     intentionally-named operation.
+     *   - Tier-2 slots dropped (they wrap the old KEK).
+     *
+     * Gated by `peer-recover-user`; `STRICT_POLICY` requires a
+     * recovery / TOTP / email-OTP factor proof at the moment of
+     * recovery, so the issuer affirmatively re-asserts identity.
+     *
+     * The recipient should call `db.rotatePassphrase` on first session
+     * to choose their own phrase — the temp acts as a single-use
+     * bridge.
+     *
+     * ```ts
+     * await db.recoverUser('acme', {
+     *   userId: 'bob',
+     *   passphrase: 'temporary-correct-horse-battery-staple-printer',
+     * }, { factors: [{ kind: 'recovery' }] })
+     * // Bob opens createNoydb({ user: 'bob', secret: tempPhrase })
+     * // and immediately calls db.rotatePassphrase to set his own.
+     * ```
+     *
+     * @throws `NoAccessError` when no keyring exists for the target.
+     * @throws `PermissionDeniedError` when the caller's role can't
+     *         recover the target's role (admin→owner is blocked even
+     *         under recovery).
+     * @throws `PrivilegeEscalationError` when the caller lacks a DEK
+     *         the target previously had access to.
+     *
+     */
+    recoverUser(vault: string, options: RecoverUserOptions, factors?: FactorProofBundle): Promise<void>;
+    /**
+     * Persist a recovery enrollment. Accepts the `'paper'`
+     * profile.
+     *
+     * The hub wraps the user's DEK set (not the KEK) under a code-derived
+     * AES-GCM key — see `team/recovery.ts` for the rationale. The mint
+     * helper {@link mintPaperRecoveryEntry} is the canonical primitive;
+     * pair it with `db.getKeyring(vault)` to obtain the live DEK set:
+     *
+     * ```ts
+     * import { mintPaperRecoveryEntry } from '@noy-db/hub'
+     *
+     * const keyring = await db.getKeyring('acme')
+     * const codes: string[] = ['CORRECT-HORSE-1', 'BATTERY-STAPLE-2', ...]
+     * const entries = await Promise.all(
+     *   codes.map((code, i) => mintPaperRecoveryEntry(keyring.deks, code, `code-${i}`)),
+     * )
+     * await db.enrollRecovery('acme', { profile: 'paper', entries })
+     * showCodesToUser(codes)
+     * ```
+     *
+     * `@noy-db/on-recovery`'s `generateRecoveryCodeSet`
+     * delegates to `mintPaperRecoveryEntry` internally — its output is
+     * fed directly to this API. Pick whichever fits your code-gen layer:
+     *
+     * ```ts
+     * import { generateRecoveryCodeSet } from '@noy-db/on-recovery'
+     * const { codes, entries } = await generateRecoveryCodeSet({ deks: keyring.deks, count: 8 })
+     * await db.enrollRecovery('acme', { profile: 'paper', entries })
+     * ```
+     */
+    enrollRecovery(vault: string, enrollment: RecoveryEnrollmentInput): Promise<EnrollRecoveryResult>;
+    /** Read the persisted recovery entries (paper + Shamir). Used by `describeAuthConfig`. */
+    listRecoveryEntries(vault: string): Promise<{
+        paper: ReadonlyArray<PaperRecoveryEntry>;
+        shamir: ReadonlyArray<ShamirRecoveryEntry>;
+    }>;
+    /**
+     * Register a tier-3 quick-unlock state for the vault. The state is
+     * an opaque blob produced by `@noy-db/on-pin/enrollPin` (or any
+     * compatible primitive). It is held in memory only — never persisted
+     * — and auto-clears when its `expiresAt` elapses.
+     *
+     * Gated by `rotate-unlock` (the same gate covers "set" and "rotate"
+     * because tier-3 is a single-slot rolling secret).
+     */
+    enrollUnlock(vault: string, state: QuickUnlockState, factors?: FactorProofBundle): Promise<void>;
+    /**
+     * Resume a session via the registered tier-3 state. The verifier is
+     * `@noy-db/on-pin/resumePin` (or compatible). On success, mark the
+     * active session tier as 3 — every operation must re-authenticate at
+     * tier 2 to elevate.
+     *
+     * Returns `undefined` (caller should fall back to tier 2) when no
+     * tier-3 state is registered.
+     */
+    unlockViaPin(vault: string, resume: (state: QuickUnlockState) => Promise<UnlockedKeyring>): Promise<UnlockedKeyring | undefined>;
+    /** Drop the tier-3 state for a vault — explicit logout. */
+    clearQuickUnlock(vault: string): void;
+    /**
+     * Public accessor for the unlocked keyring of a vault.
+     *
+     * Returns a **defensive shallow copy** so consumers can read the DEK
+     * map and authenticator list without the risk of mutating the hub's
+     * internal cache. Internal hub code paths use a live reference
+     * via `getKeyringInternal`; ceremonies and external consumers always
+     * get a snapshot.
+     *
+     * The CryptoKey values inside `deks` are not cloned — Web Crypto
+     * keys are opaque handles, and a shared handle is intentional
+     * (encrypt / decrypt go through the same key the cache holds).
+     * Only the container Map / authenticator array is fresh.
+     *
+     * Used by `@noy-db/on-*` ceremonies that need the live DEK set
+     * (paper recovery via {@link mintPaperRecoveryEntry}, tier-3 PIN
+     * enrolment via on-pin's `enrollPin`, custom on-* ceremonies that
+     * don't have a hub-side wrapper).
+     *
+     * No new permission gate — this is an accessor over already-unlocked
+     * state. The keyring is materialized only after the calling session
+     * has unlocked the vault at tier 1, 2, or 3, so exposing it does not
+     * widen access. Throws `ValidationError` when encryption is enabled
+     * and no `secret` / `getKeyring` is configured.
+     *
+     * ```ts
+     * const keyring = await db.getKeyring('acme')
+     * // keyring.deks: Map<collection, CryptoKey>
+     * // keyring.kek:  CryptoKey | null   (null for tier-3 / wrap-DEKs sessions)
+     * // keyring.role / .permissions / .authenticators
+     * ```
+     */
+    getKeyring(vault: string): Promise<UnlockedKeyring>;
+}
+
+/**
+ * Multi-user team capability contract (#267 Track A tail — the
+ * keyring-grant → team split). Lives on the `/with` port (the one seam the
+ * kernel spine may import statically) so `Noydb` can hold the `NO_TEAM`
+ * floor default without a spine→service static import.
+ *
+ * The active engine (`withTeam()` in `with-party/team/active.ts`)
+ * statically links the grant/revoke/rotate keyring engines from
+ * `keyring.ts` — bundle-charged to consumers of the `@noy-db/hub/team`
+ * subpath, never to the single-user floor. {@link NO_TEAM} (the floor
+ * default) throws {@link TeamNotEnabledError}.
+ *
+ * `Noydb.grant` / `Noydb.revoke` / `Noydb.rotate` delegate here, passing
+ * their `TeamFacade` — the facade owns the policy-gate + keyring plumbing
+ * (`runGrant` / `runRevoke` / `runRotate`) and receives the engine as an
+ * argument from the strategy.
+ *
+ * Deliberately NOT gated (single-user primitives): owner keyring creation,
+ * unlock, `listUsers`, `updateUser`, passphrase rotate/recover, and the
+ * `createDeedOwner` free function (no createNoydb instance to gate against —
+ * the same carve-out as `liberateVault`).
+ * @internal
+ */
+
+interface TeamStrategy {
+    grant(team: TeamFacade, vault: string, options: GrantOptions, factors?: FactorProofBundle): Promise<void>;
+    revoke(team: TeamFacade, vault: string, options: RevokeOptions, factors?: FactorProofBundle): Promise<void>;
+    rotate(team: TeamFacade, vault: string, collections: string[]): Promise<void>;
+}
+/**
+ * No-op stub — the floor default. Every multi-user team operation throws
+ * {@link TeamNotEnabledError}; opt in with `teamStrategy: withTeam()` in
+ * createNoydb. @internal
+ */
+declare const NO_TEAM: TeamStrategy;
+
 /**
  * Session policies —
  *
@@ -18197,6 +18922,16 @@ interface EncryptedEnvelope {
      * one of `_sealed[field]` / `_vdig[field]` exists per field (I4).
      */
     readonly _vdig?: Record<string, string>;
+    /**
+     * Equatable blind-index tags (classified slice 2b). Map of digest-only field
+     * name → base64 33-byte tag (1-byte cost/version discriminator ‖ 32-byte keyed
+     * MAC), CURRENT VALUE ONLY (the _vdig ring is never indexed). This is the ONLY
+     * store-visible classified artifact: a keyed MAC, comparable without a key
+     * ceremony, with NO inline cryptographic integrity by construction. Invariant:
+     * _bidx[field] present ⇒ _vdig[field] present. Confirm-by-verify (findByDigest)
+     * makes any read-side orphan/splice unreturnable.
+     */
+    readonly _bidx?: Record<string, string>;
     /**
      * Per-record content-encryption key (CEK), base64 AES-KW-wrapped under
      * the collection (or tier) DEK. Present only on records written by a
@@ -18236,6 +18971,19 @@ interface VdigFieldPolicy {
     /** Ring size for reuse refusal; 0 = no ring. Cap 8 (spec Q4). */
     readonly notLastN: number;
     readonly rotateDays?: number;
+    /** default false — refused unless the double door is open (R8) */
+    readonly equatable: boolean;
+}
+/**
+ * The persisted classified-fields config marker (C-A / R10). Reuses the
+ * stage-2 persisted-schema record; this is the shape of the marker stored
+ * there.
+ */
+interface ClassifiedMarker {
+    /** field names declared digest-only (have _vdig); non-empty ⇒ writes need the classified codec */
+    readonly digestOnly: readonly string[];
+    /** field names additionally declared equatable (have _bidx when covered) */
+    readonly equatable: readonly string[];
 }
 /** Verdict-only egress of the enclave oracle (spec §3). */
 interface ClassifiedVerdict {
@@ -20092,6 +20840,27 @@ interface NoydbOptions {
      * stays ungated (it has no createNoydb instance to gate against).
      */
     readonly custodyStrategy?: CustodyStrategy;
+    /**
+     * Tree-shake seam — optional multi-user team capability (#267
+     * keyring-grant → team split). Pass `withTeam()` from `@noy-db/hub/team`
+     * to enable `db.grant` / `db.revoke` / `db.rotate`. When omitted, those
+     * throw `TeamNotEnabledError` and the keyring grant/revoke/rotate engines
+     * are reached only via opt-in — the always-on floor is single-user.
+     * Single-user primitives (owner keyring, unlock, `listUsers`,
+     * `updateUser`, passphrase rotate/recover) stay ungated, as does the
+     * `createDeedOwner` free function (no createNoydb instance to gate
+     * against).
+     */
+    readonly teamStrategy?: TeamStrategy;
+    /**
+     * Opt-in seam — the `lazy` service (#267). Pass `withLazy()` from
+     * `@noy-db/hub/lazy` to explicitly enable lazy mode's bounded-LRU
+     * working set for collections declared with `prefetch: false`. When
+     * omitted, `prefetch: false` still works via the deprecated implicit
+     * back-compat path (identical behavior, one-time deprecation warn);
+     * the implicit path will be removed at 1.0.
+     */
+    readonly lazyStrategy?: LazyStrategy;
     /**
      * Tree-shake seam — optional search / retrieval capability. Pass
      * `withSearch()` from `@noy-db/hub` to enable a collection's `search`
@@ -20967,4 +21736,4 @@ interface NoydbPolicyDeps {
  */
 type NoydbPolicyFactory = (deps: NoydbPolicyDeps) => NoydbPolicyApi;
 
-export { BLOB_INDEX_COLLECTION as $, resolveI18nText as A, resolvePolicy as B, setAtPathInPlace as C, DICT_COLLECTION_PREFIX as D, staticDict as E, stripI18nFilled as F, validateI18nTextValue as G, type SessionStrategy as H, type I18nStrategy as I, SessionExpiredError as J, SessionNotFoundError as K, type Layer as L, MissingTranslationError as M, SessionPolicyError as N, type OnMissing as O, PolicyEnforcer as P, createEnforcer as Q, ReservedCollectionNameError as R, ScriptViolationError as S, TranslatorNotConfiguredError as T, UnknownDictCodeError as U, Vault as V, validateSessionPolicy as W, type BlobStrategy as X, BLOB_CHUNKS_COLLECTION as Y, BLOB_COLLECTION as Z, BLOB_EVICTION_AUDIT_COLLECTION as _, type DictEntry as a, type Reducer as a$, BLOB_SLOTS_PREFIX as a0, BLOB_VERSIONS_PREFIX as a1, type BlobEvictionEntry as a2, type BlobFieldPolicy as a3, type BlobFieldsConfig as a4, type BlobObject as a5, type BlobPutOptions as a6, type BlobResponseOptions as a7, BlobSet as a8, type BlobStrategyOpenArgs as a9, IDX_PREFIX as aA, type IndexDef as aB, type IndexState as aC, type IngestRow as aD, type LazyOrderBy as aE, LazyQuery as aF, type LazyQuerySource as aG, type OrderedEntry as aH, PersistedCollectionIndex as aI, type PersistedIndexDef as aJ, compositeKey as aK, decodeIdxId as aL, encodeIdxId as aM, isIdxId as aN, type AggregateStrategy as aO, type AggregateResult as aP, type AggregateSpec as aQ, Aggregation as aR, type AggregationUpstream as aS, GROUPBY_MAX_CARDINALITY as aT, GROUPBY_WARN_CARDINALITY as aU, GroupedAggregation as aV, GroupedQuery as aW, GroupedQueryN as aX, type GroupedRow as aY, type GroupedRowN as aZ, type LiveAggregation as a_, type CompactRunOptions as aa, type CompactionContext as ab, type CompactionResult as ac, DEFAULT_CHUNK_SIZE as ad, EXPORT_AUDIT_COLLECTION as ae, ExportBlobsAbortedError as af, type ExportBlobsAuditEntry as ag, type ExportBlobsHandle as ah, type ExportBlobsOptions as ai, type ExportedBlob as aj, type ObjectListEntry as ak, type ObjectMeta as al, type ObjectProjection as am, type ObjectUrlOptions as an, type PutObjectOptions as ao, type PutUrlOptions as ap, type SlotInfo as aq, type SlotRecord as ar, type VersionRecord as as, createExportBlobsHandle as at, memoryObjectProjection as au, runCompaction as av, type IndexStrategy as aw, COMPOSITE_DELIMITER as ax, CollectionIndexes as ay, type HashIndex as az, type DictKeyDescriptor as b, type SnapshotMeta as b$, type ReducerBuilder as b0, type ReducerOptions as b1, avg as b2, buildLiveAggregation as b3, count as b4, groupAndReduce as b5, max as b6, min as b7, moneyMax as b8, moneyMin as b9, type OpenPeriodOptions as bA, PERIODS_COLLECTION as bB, type PeriodRecord as bC, type ReadOnlyCollection as bD, appendPeriodLedgerEntry as bE, assertTsWritable as bF, chainAnchor as bG, loadPeriods as bH, validatePeriodName as bI, type GuardStrategy as bJ, type GuardChange as bK, type GuardContext as bL, AmendmentForbiddenError as bM, FieldFrozenError as bN, GuardRegistry as bO, type GuardStrategyHandle as bP, IllegalTransitionError as bQ, InvariantError as bR, ReadOnlyVaultFacade as bS, RecordLockedError as bT, type ShadowStrategy as bU, CollectionFrame as bV, VaultFrame as bW, type NoydbPodStore as bX, type RetentionPolicy as bY, type SnapshotPolicy as bZ, type SnapshotStrategy as b_, moneySum as ba, reduceRecords as bb, reducerBuilder as bc, resetGroupByWarnings as bd, sum as be, type CrdtStrategy as bf, type CrdtMode as bg, type CrdtState as bh, type LwwMapState as bi, type RgaState as bj, type YjsState as bk, buildLwwMapState as bl, buildRgaState as bm, mergeCrdtStates as bn, resolveCrdtSnapshot as bo, type ConsentStrategy as bp, CONSENT_AUDIT_COLLECTION as bq, type ConsentAuditEntry as br, type ConsentAuditFilter as bs, type ConsentContext as bt, type ConsentOp as bu, loadConsentEntries as bv, writeConsentEntry as bw, type PeriodsStrategy as bx, type CarryForwardContext as by, type ClosePeriodOptions as bz, DictKeyInUseError as c, type JsonPatchOp as c$, type SnapshotMode as c0, SnapshotNotFoundError as c1, type DerivationStrategy as c2, type DerivationContext as c3, type ArrayOutputSpec as c4, DerivationCapExceededError as c5, DerivationCycleError as c6, DerivationDepthError as c7, DerivationOutputShapeError as c8, DerivationOutputUnknownError as c9, type WithdrawAccessibleOptions as cA, type WithdrawResult as cB, type WithdrawalRequest as cC, type WithdrawalRequestStatus as cD, type DiffEntry as cE, type UnlockedKeyring as cF, type ExportFormat as cG, type BusHandler as cH, type GateDeleteEvent as cI, type GateEventMap as cJ, type GateHandler as cK, type GatePoint as cL, type GatePutEvent as cM, type LifecycleEventMap as cN, type LifecyclePoint as cO, ServiceBus as cP, SubsystemBus as cQ, type Role as cR, type HistoryStrategy as cS, type NoydbStore as cT, type HistoryOptions as cU, type EncryptedEnvelope as cV, type PruneOptions as cW, type AppendInput as cX, type ChangeType as cY, CollectionInstant as cZ, type JsonPatch as c_, DerivationRegistry as ca, type DerivationStrategyHandle as cb, type DerivedFromMeta as cc, type OutputSpec as cd, type RecordOutputSpec as ce, type MaterializedViewStrategy as cf, type MaterializedViewStrategyHandle as cg, type OverlayedViewStrategy as ch, Collection as ci, OverlayBaseIsVirtualError as cj, OverlayCollectionUnavailableError as ck, type OverlayFieldMergeMode as cl, type OverlayFieldMergeRule as cm, OverlayIdMismatchError as cn, OverlayNameCollisionError as co, OverlayedViewRegistry as cp, type OverlayedViewStrategyHandle as cq, type SyncStrategy as cr, type PortabilityStrategy as cs, type ApproveWithdrawalOptions as ct, type ExportAccessibleOptions as cu, NO_PORTABILITY as cv, PortabilityNotEnabledError as cw, type RejectWithdrawalOptions as cx, type RequestWithdrawalOptions as cy, type RequestWithdrawalResult as cz, DictKeyMissingError as d, isClassifiedGroup as d$, LedgerStore as d0, type VaultEngine as d1, VaultInstant as d2, type VerifyResult as d3, applyPatch as d4, computePatch as d5, diff as d6, formatDiff as d7, type SealedRecordStrategy as d8, type SealedCekDeliveryEnvelope as d9, AttestationNotEnabledError as dA, type IssueArgs as dB, type IssueContext as dC, type IssueResult as dD, NO_ATTESTATION as dE, type RevokeContext as dF, getRevokedDocIdsCore as dG, issueAttestationCore as dH, publishRevocationListCore as dI, revokeDocCore as dJ, unrevokeDocCore as dK, type ClassifiedFieldSpec as dL, type ClassifiedStrategy as dM, ClassifiedConfigError as dN, type ClassifiedEntry as dO, type ClassifiedGroup as dP, type ClassifiedList as dQ, type ClassifiedRevealCtx as dR, ClassifiedRevealError as dS, type ClassifiedRider as dT, ClassifiedRotationError as dU, type ClassifiedStorage as dV, type ClassifiedVerdict as dW, type ClassifiedVerifyCtx as dX, ClassifiedVerifyError as dY, NO_CLASSIFIED as dZ, isClassifiedFieldSpec as d_, NO_SEALED_RECORD as da, type SealedCekBinding as db, SealedRecordExpiredError as dc, SealedRecordMismatchError as dd, SealedRecordNotEnabledError as de, type WalkClosureOptions as df, type SealingKeyProvider as dg, type RecoveryEnrollmentInput as dh, type ShamirRecoveryProvider as di, type EnclaveKey as dj, AdoptionStateError as dk, BackupCorruptedError as dl, BackupLedgerError as dm, BundleIntegrityError as dn, BundleSealMismatchError as dp, BundleVersionConflictError as dq, type ClosureResult as dr, type ExtractPartitionResult as ds, PartitionExtractionError as dt, PodVersionConflictError as du, TransferSealError as dv, extractPartition as dw, walkClosure as dx, type AttestationStrategy as dy, AttestationError as dz, DictionaryHandle as e, ConflictError as e$, type PublicEnvelope as e0, type BundleRecipient as e1, type RecipientSealer as e2, type RecipientHint as e3, TxContext as e4, type MVQueryContext as e5, type RegisteredMV as e6, Query as e7, MaterializedViewRegistry as e8, type MaterializedFromMeta as e9, type PolicyDenyReason as eA, type GatePolicy as eB, type AccessibleVault as eC, type AffectedDocument as eD, AlreadyElevatedError as eE, type ArchivePolicy as eF, type ArchiveResult as eG, type ArchiveRunOptions as eH, type ArchiveStrategy as eI, BUNDLE_STORE_POLICY as eJ, type BuiltInGateName as eK, type CacheOptions as eL, type CacheStats as eM, CargoNotEnabledError as eN, type CargoStrategy as eO, type ChangeEvent as eP, ClassifiedNotEnabledError as eQ, type Clause as eR, type CollectionChangeEvent as eS, type CollectionConfig as eT, type CollectionConflictResolver as eU, type CollectionDescriptor as eV, type CollectionStats as eW, ComputedFieldError as eX, type ComputedFields as eY, type ComputedFn as eZ, type Conflict as e_, MaterializedViewConfigError as ea, MaterializedViewCycleError as eb, type MaterializedViewOutput as ec, MaterializedViewSourceUnknownError as ed, MaterializedViewTooLargeError as ee, type UnionArmJoin as ef, type UnionSource as eg, type SearchStrategy as eh, type SequenceStrategy as ei, type CustodyStrategy as ej, type SchemaUpdateStrategy as ek, type TransformFn as el, type PersistedSchemaEnvelope as em, type UpdateDecision as en, type UserEnvelope as eo, type VaultUserApi as ep, type UserApiDeps as eq, type DeepPartialOrNull as er, type UserEnvelopePresented as es, type Unsubscribe as et, type LiveUserEnvelope as eu, type RoundingMode as ev, type VaultPolicy as ew, type ActiveTier as ex, type FactorProof as ey, type GateName as ez, type DictionaryOptions as f, type HistoryEntry as f$, type ConflictPolicy as f0, type ConflictStrategy as f1, CrossJoinSourceUnknownError as f2, CrossJoinTooLargeError as f3, type CrossTierAccessEvent as f4, CustodyApi as f5, type CustodyHost as f6, CustodyNotEnabledError as f7, DEFAULT_CROSS_JOIN_MAX_ROWS as f8, DEFAULT_JOIN_MAX_ROWS as f9, type EnrollAuthenticatorWrappingKEKOptions as fA, type EnrollRecoveryResult as fB, type ExportCapability as fC, ExportCapabilityError as fD, type ExportChunk as fE, type ExportStreamOptions as fF, type FactorKind as fG, type FactorProofBundle as fH, type FactorRequirement as fI, type FenceDoc as fJ, type FenceState as fK, type FieldChange as fL, type FieldClause as fM, type FieldDescriptor as fN, type FieldSource as fO, FilenameSanitizationError as fP, type FilterClause as fQ, ForgetStrategyNotConfiguredError as fR, type FormattedSequenceHandle as fS, type FrozenSnapshotRef as fT, type GhostRecord as fU, type GrantCustodianOptions as fV, type GrantOptions as fW, GroupCardinalityError as fX, type GroupClause as fY, type GuardViolation as fZ, type HistoryConfig as f_, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as fa, DELEGATIONS_COLLECTION as fb, DanglingReferenceError as fc, DataResidencyError as fd, DebugPlaintextError as fe, DebugReservedFieldError as ff, DecryptionError as fg, type DeepPartial as fh, type DeferredNumberingConfig as fi, DelegationTargetMissingError as fj, type DelegationToken as fk, type DeleteManyResult as fl, type DerivationDescriptor as fm, DirectoryDisabledError as fn, type DirtyEntry as fo, type DryRunResult as fp, type DumpSchemaOptions as fq, ELEVATION_AUDIT_COLLECTION as fr, ElevatedHandle as fs, ElevationExpiredError as ft, type EmbeddingDescriptor as fu, EmbeddingDimMismatchError as fv, EmbeddingModelMismatchError as fw, EnclaveNotSupportedError as fx, type EnrollAuthenticatorOptions as fy, type EnrollAuthenticatorWrappingDEKsOptions as fz, type I18nMap as g, NO_CUSTODY as g$, INDEXED_STORE_POLICY as g0, type ImportCapability as g1, ImportCapabilityError as g2, type IndexFieldName as g3, IndexRequiredError as g4, IndexWriteFailureError as g5, type InferOutput as g6, type InternalCollectionStats as g7, InvalidKeyError as g8, type IssueDelegationOptions as g9, type LocaleReadOptions as gA, Lru as gB, type LruOptions as gC, type LruStats as gD, MAGIC_LINK_CONTENT_INFO_PREFIX as gE, MAGIC_LINK_GRANTS_COLLECTION as gF, MAGIC_LINK_KEK_INFO_PREFIX as gG, type MagicLinkGrantPayload as gH, type MagicLinkGrantRecord as gI, ManagedRecoveryNotEnrolledError as gJ, type MaterializedViewDescriptor as gK, MemoryRecipientSealer as gL, MemorySealingKeyProvider as gM, MigrationRequiredError as gN, MoneyCurrencyError as gO, type MoneyDescriptor as gP, type MoneyOptions as gQ, type MoneyOptionsFixed as gR, type MoneyOptionsMulti as gS, MoneyPrecisionError as gT, type MoneyString as gU, MoneyUnsupportedError as gV, NOYDB_BACKUP_VERSION as gW, NOYDB_FORMAT_VERSION as gX, NOYDB_KEYRING_VERSION as gY, NOYDB_SYNC_VERSION as gZ, NO_CARGO as g_, type IssueMagicLinkGrantOptions as ga, type JoinContext as gb, type JoinLeg as gc, type JoinStrategy as gd, JoinTooLargeError as ge, type JoinableSource as gf, type KeyringAuthenticator as gg, type KeyringAuthenticatorWrappingDEKs as gh, type KeyringAuthenticatorWrappingKEK as gi, KeyringCorruptError as gj, KeyringExpiredError as gk, type KeyringFile as gl, LedgerContentionError as gm, type LiberateOptions as gn, type LiberateResult as go, LinkEndpointError as gp, LinkIntegrityError as gq, type LinkOnDelete as gr, type LinkRow as gs, type LinkSetHandle as gt, type LinkSpec as gu, type ListAccessibleVaultsOptions as gv, type ListPageResult as gw, type ListUsersOptions as gx, type LiveQuery as gy, type LiveUpstream as gz, type I18nTextDescriptor as h, type RecoverPassphraseResult as h$, NO_SEARCH as h0, NO_SEQUENCE as h1, NetworkError as h2, type NextOptions as h3, NoAccessError as h4, NonAdditiveSchemaChangeError as h5, NotFoundError as h6, Noydb as h7, type NoydbBundleStore as h8, NoydbError as h9, type PublicEnvelopeSchema as hA, type PublicEnvelopeText as hB, type PullMode as hC, type PullOptions as hD, type PullPolicy as hE, type PullResult as hF, type PushMode as hG, type PushOptions as hH, type PushPolicy as hI, type PushResult as hJ, type PutManyItemOptions as hK, type PutManyOptions as hL, type PutManyResult as hM, type QueryAcrossOptions as hN, type QueryAcrossResult as hO, type QueryField as hP, type QueryPlan as hQ, type QuerySource as hR, type QuickUnlockState as hS, QuickUnlockStore as hT, QuiesceTimeoutError as hU, type ReAuthOperation as hV, ReadOnlyAtInstantError as hW, ReadOnlyError as hX, ReadOnlyFrameError as hY, RecordCekNotFoundError as hZ, type RecoverPassphraseInput as h_, type NoydbEventMap as ha, type NoydbOptions as hb, type Assignment as hc, NumberingUncertaintyError as hd, type Operator as he, type OrderBy as hf, type OverlayViewDescriptor as hg, POD_STORE_POLICY as hh, PUBLIC_ENVELOPE_FIELDS as hi, type PaperRecoveryDoc as hj, type PaperRecoveryEntry as hk, type PassphrasePolicy as hl, type PassphraseValidationResult as hm, PathEscapeError as hn, PeriodClosedError as ho, type Permission as hp, PermissionDeniedError as hq, type Permissions as hr, type PersistedSchemaKind as hs, type PlaintextTranslatorContext as ht, type PlaintextTranslatorFn as hu, PolicyDeniedError as hv, PresenceHandle as hw, type PresencePeer as hx, PrivilegeEscalationError as hy, type PublicEnvelopeField as hz, type I18nTextOptions as i, SyncScheduler as i$, type RecoverUserOptions as i0, RecoveryNotEnrolledError as i1, RecoveryProfileNotImplementedError as i2, type RecoveryProof as i3, type RefDescriptor as i4, RefIntegrityError as i5, type RefMode as i6, RefRegistry as i7, RefScopeError as i8, type RefViolation as i9, type SearchOptions as iA, type SearchResult as iB, SequenceContentionError as iC, type SequenceHandle as iD, SequenceNotEnabledError as iE, SequenceOfflineError as iF, type SequenceOptions as iG, SequenceStore as iH, type SequenceStoreOptions as iI, type SessionPolicy as iJ, type SetPublicEnvelopeInput as iK, type ShamirRecoveryDoc as iL, type ShamirRecoveryEntry as iM, ShardProvisioningError as iN, type SlotRewrapCeremony as iO, type SlotRewrapContext as iP, type StandardSchemaV1 as iQ, type StandardSchemaV1Issue as iR, type StandardSchemaV1SyncResult as iS, type StoreAuth as iT, type StoreAuthKind as iU, type StoreCapabilities as iV, StoreCapabilityError as iW, type StoreTime as iX, SyncEngine as iY, type SyncMetadata as iZ, type SyncPolicy as i_, ReservedVaultNameError as ia, type ResolvedPublicEnvelopeSchema as ib, type RetrieveHit as ic, type RetrieveOptions as id, type RevokeOptions as ie, type RotatePassphraseInput as ig, type RotateRecoveryOptions as ih, type RotateRecoveryResult as ii, SEALED_PASSPHRASE_RECORD_ID as ij, ScanBuilder as ik, type ScanPageProvider as il, type SchemaDelta as im, SchemaFenceError as io, type SchemaIntrospection as ip, SchemaLockedError as iq, SchemaUpdateError as ir, SchemaValidationError as is, type Sealed as it, type SealedEnvelope as iu, SealedHandle as iv, type SealedPassphrase as iw, type SealedView as ix, type SearchEntry as iy, SearchNotEnabledError as iz, LocaleNotSpecifiedError as j, enrollAuthenticator as j$, type SyncSchedulerStatus as j0, type SyncStatus as j1, type SyncTarget as j2, type SyncTargetRole as j3, SyncTransaction as j4, type SyncTransactionResult as j5, type TabChannel as j6, type TabCoordinationOptions as j7, type TabLockManager as j8, type TabPresence as j9, type WarningRules as jA, WeakPassphraseError as jB, type WeakPassphraseReason as jC, type WithArchiveOptions as jD, WithdrawalRequestError as jE, type WrappedDeksBlob as jF, type WriteConflict as jG, type WriteQueue as jH, aesGcmOpen as jI, applyJoins as jJ, approveWithdrawal as jK, asMoney as jL, assertStrongPassphrase as jM, base64ToBuffer as jN, bufferToBase64 as jO, buildLiveQuery as jP, buildRecipientKeyringFile as jQ, burnPaperRecoveryEntry as jR, compileSequenceFormat as jS, createNoydb as jT, createStore as jU, decryptBytes as jV, decryptDeterministic as jW, deriveMagicLinkContentKey as jX, derivePresenceKey as jY, encryptBytes as jZ, encryptDeterministic as j_, type TabRole as ja, TamperedError as jb, TierDemoteDeniedError as jc, type TierMode as jd, TierNotGrantedError as je, TiersNotEnabledError as jf, type TransactionInvariant as jg, type TranslatorAuditEntry as jh, TxCollection as ji, type TxOp as jj, TxVault as jk, UniqueConstraintError as jl, UnknownShardError as jm, UnsupportedIndexOptionError as jn, type UpdateAuthenticatorOptions as jo, type UpdateContext as jp, type UpdateUserOptions as jq, type UserEnvelopeCheckGate as jr, UserEnvelopeOversizedError as js, type UserInfo as jt, ValidationError as ju, type VaultBackup as jv, type VaultPolicyOnDisk as jw, type VaultSchemaSnapshot as jx, type VaultSnapshot as jy, VaultTemplateNotFoundError as jz, type OnMissingPolicy as k, validateSchemaOutput as k$, estimateEntropy as k0, evalComputedFields as k1, evaluateClause as k2, evaluateExportCapability as k3, evaluateFieldClause as k4, evaluateImportCapability as k5, executePlan as k6, exportAccessibleData as k7, findAuthenticator as k8, hasExportCapability as k9, parseRsaOaepTlv as kA, parseSealedEnvelope as kB, readMagicLinkGrantRecord as kC, readPath as kD, recoverUser as kE, ref as kF, refArray as kG, rejectWithdrawal as kH, removeAuthenticator as kI, requestWithdrawal as kJ, resetJoinWarnings as kK, resolveSchema as kL, resolveSequenceKey as kM, revokeDelegation as kN, revokeMagicLinkGrant as kO, runTransaction as kP, savePaperRecoveryEntries as kQ, saveSealedPassphrase as kR, saveShamirRecoveryEntries as kS, sealRsaOaepTlv as kT, unwrapDeksFromBlob as kU, unwrapDeksFromPaperEntry as kV, unwrapDeksFromShamirEntry as kW, unwrapMagicLinkGrant as kX, validatePassphrase as kY, validatePublicEnvelopeInput as kZ, validateSchemaInput as k_, hasImportCapability as ka, hasRecoveryEnrolled as kb, isLinkCollectionName as kc, isMagicLinkGrantExpired as kd, isMoneyDescriptor as ke, isMoneyString as kf, isPublicEnvelope as kg, isRefArray as kh, issueDelegation as ki, recoverPassphrase as kj, rotatePassphrase as kk, liberateVault as kl, listMagicLinkGrants as km, listUsers as kn, listUsersWithEnvelopes as ko, listWithdrawalRequests as kp, loadActiveDelegations as kq, loadPaperRecoveryEntries as kr, loadSealedPassphrase as ks, loadShamirRecoveryEntries as kt, magicLinkGrantRecordId as ku, mintPaperRecoveryEntry as kv, mintShamirRecoveryEntry as kw, mintWrappedDeksBlob as kx, money as ky, moneyNumber as kz, type ResolveI18nOptions as l, withArchive as l0, withDeferredNumbering as l1, withdrawAccessibleData as l2, writeMagicLinkGrant as l3, changeSecret as l4, createOwnerKeyring as l5, ensureCollectionDEK as l6, grant as l7, loadKeyring as l8, persistKeyring as l9, revoke as la, updateAuthenticator as lb, updateKeyringIdentity as lc, type TxStrategy as ld, type AmendmentTxOptions as le, CrossShardJoinError as lf, sha256Hex as lg, type CrossJoinClause as lh, NO_TIERS as li, type TiersContext as lj, type TiersStrategy as lk, assertDeclaredTier as ll, assertTiersEnabled as lm, classifySealedShred as ln, demote as lo, elevate as lp, getAtTier as lq, listAtTier as lr, putAtTier as ls, withTiers as lt, type ScriptWarning as m, type StaticDictDescriptor as n, StaticDictReadonlyError as o, applyI18nLocale as p, dictCollectionName as q, dictKey as r, enforceScript as s, getAtPath as t, i18nText as u, inferScripts as v, isDictCollectionName as w, isDictKeyDescriptor as x, isI18nTextDescriptor as y, isStaticDictDescriptor as z };
+export { BLOB_INDEX_COLLECTION as $, resolveI18nText as A, resolvePolicy as B, setAtPathInPlace as C, DICT_COLLECTION_PREFIX as D, staticDict as E, stripI18nFilled as F, validateI18nTextValue as G, type SessionStrategy as H, type I18nStrategy as I, SessionExpiredError as J, SessionNotFoundError as K, type Layer as L, MissingTranslationError as M, SessionPolicyError as N, type OnMissing as O, PolicyEnforcer as P, createEnforcer as Q, ReservedCollectionNameError as R, ScriptViolationError as S, TranslatorNotConfiguredError as T, UnknownDictCodeError as U, Vault as V, validateSessionPolicy as W, type BlobStrategy as X, BLOB_CHUNKS_COLLECTION as Y, BLOB_COLLECTION as Z, BLOB_EVICTION_AUDIT_COLLECTION as _, type DictEntry as a, type Reducer as a$, BLOB_SLOTS_PREFIX as a0, BLOB_VERSIONS_PREFIX as a1, type BlobEvictionEntry as a2, type BlobFieldPolicy as a3, type BlobFieldsConfig as a4, type BlobObject as a5, type BlobPutOptions as a6, type BlobResponseOptions as a7, BlobSet as a8, type BlobStrategyOpenArgs as a9, IDX_PREFIX as aA, type IndexDef as aB, type IndexState as aC, type IngestRow as aD, type LazyOrderBy as aE, LazyQuery as aF, type LazyQuerySource as aG, type OrderedEntry as aH, PersistedCollectionIndex as aI, type PersistedIndexDef as aJ, compositeKey as aK, decodeIdxId as aL, encodeIdxId as aM, isIdxId as aN, type AggregateStrategy as aO, type AggregateResult as aP, type AggregateSpec as aQ, Aggregation as aR, type AggregationUpstream as aS, GROUPBY_MAX_CARDINALITY as aT, GROUPBY_WARN_CARDINALITY as aU, GroupedAggregation as aV, GroupedQuery as aW, GroupedQueryN as aX, type GroupedRow as aY, type GroupedRowN as aZ, type LiveAggregation as a_, type CompactRunOptions as aa, type CompactionContext as ab, type CompactionResult as ac, DEFAULT_CHUNK_SIZE as ad, EXPORT_AUDIT_COLLECTION as ae, ExportBlobsAbortedError as af, type ExportBlobsAuditEntry as ag, type ExportBlobsHandle as ah, type ExportBlobsOptions as ai, type ExportedBlob as aj, type ObjectListEntry as ak, type ObjectMeta as al, type ObjectProjection as am, type ObjectUrlOptions as an, type PutObjectOptions as ao, type PutUrlOptions as ap, type SlotInfo as aq, type SlotRecord as ar, type VersionRecord as as, createExportBlobsHandle as at, memoryObjectProjection as au, runCompaction as av, type IndexStrategy as aw, COMPOSITE_DELIMITER as ax, CollectionIndexes as ay, type HashIndex as az, type DictKeyDescriptor as b, type SnapshotMeta as b$, type ReducerBuilder as b0, type ReducerOptions as b1, avg as b2, buildLiveAggregation as b3, count as b4, groupAndReduce as b5, max as b6, min as b7, moneyMax as b8, moneyMin as b9, type OpenPeriodOptions as bA, PERIODS_COLLECTION as bB, type PeriodRecord as bC, type ReadOnlyCollection as bD, appendPeriodLedgerEntry as bE, assertTsWritable as bF, chainAnchor as bG, loadPeriods as bH, validatePeriodName as bI, type GuardStrategy as bJ, type GuardChange as bK, type GuardContext as bL, AmendmentForbiddenError as bM, FieldFrozenError as bN, GuardRegistry as bO, type GuardStrategyHandle as bP, IllegalTransitionError as bQ, InvariantError as bR, ReadOnlyVaultFacade as bS, RecordLockedError as bT, type ShadowStrategy as bU, CollectionFrame as bV, VaultFrame as bW, type NoydbPodStore as bX, type RetentionPolicy as bY, type SnapshotPolicy as bZ, type SnapshotStrategy as b_, moneySum as ba, reduceRecords as bb, reducerBuilder as bc, resetGroupByWarnings as bd, sum as be, type CrdtStrategy as bf, type CrdtMode as bg, type CrdtState as bh, type LwwMapState as bi, type RgaState as bj, type YjsState as bk, buildLwwMapState as bl, buildRgaState as bm, mergeCrdtStates as bn, resolveCrdtSnapshot as bo, type ConsentStrategy as bp, CONSENT_AUDIT_COLLECTION as bq, type ConsentAuditEntry as br, type ConsentAuditFilter as bs, type ConsentContext as bt, type ConsentOp as bu, loadConsentEntries as bv, writeConsentEntry as bw, type PeriodsStrategy as bx, type CarryForwardContext as by, type ClosePeriodOptions as bz, DictKeyInUseError as c, type JsonPatchOp as c$, type SnapshotMode as c0, SnapshotNotFoundError as c1, type DerivationStrategy as c2, type DerivationContext as c3, type ArrayOutputSpec as c4, DerivationCapExceededError as c5, DerivationCycleError as c6, DerivationDepthError as c7, DerivationOutputShapeError as c8, DerivationOutputUnknownError as c9, type WithdrawAccessibleOptions as cA, type WithdrawResult as cB, type WithdrawalRequest as cC, type WithdrawalRequestStatus as cD, type DiffEntry as cE, type UnlockedKeyring as cF, type ExportFormat as cG, type BusHandler as cH, type GateDeleteEvent as cI, type GateEventMap as cJ, type GateHandler as cK, type GatePoint as cL, type GatePutEvent as cM, type LifecycleEventMap as cN, type LifecyclePoint as cO, ServiceBus as cP, SubsystemBus as cQ, type Role as cR, type HistoryStrategy as cS, type NoydbStore as cT, type HistoryOptions as cU, type EncryptedEnvelope as cV, type PruneOptions as cW, type AppendInput as cX, type ChangeType as cY, CollectionInstant as cZ, type JsonPatch as c_, DerivationRegistry as ca, type DerivationStrategyHandle as cb, type DerivedFromMeta as cc, type OutputSpec as cd, type RecordOutputSpec as ce, type MaterializedViewStrategy as cf, type MaterializedViewStrategyHandle as cg, type OverlayedViewStrategy as ch, Collection as ci, OverlayBaseIsVirtualError as cj, OverlayCollectionUnavailableError as ck, type OverlayFieldMergeMode as cl, type OverlayFieldMergeRule as cm, OverlayIdMismatchError as cn, OverlayNameCollisionError as co, OverlayedViewRegistry as cp, type OverlayedViewStrategyHandle as cq, type SyncStrategy as cr, type PortabilityStrategy as cs, type ApproveWithdrawalOptions as ct, type ExportAccessibleOptions as cu, NO_PORTABILITY as cv, PortabilityNotEnabledError as cw, type RejectWithdrawalOptions as cx, type RequestWithdrawalOptions as cy, type RequestWithdrawalResult as cz, DictKeyMissingError as d, isClassifiedGroup as d$, LedgerStore as d0, type VaultEngine as d1, VaultInstant as d2, type VerifyResult as d3, applyPatch as d4, computePatch as d5, diff as d6, formatDiff as d7, type SealedRecordStrategy as d8, type SealedCekDeliveryEnvelope as d9, AttestationNotEnabledError as dA, type IssueArgs as dB, type IssueContext as dC, type IssueResult as dD, NO_ATTESTATION as dE, type RevokeContext as dF, getRevokedDocIdsCore as dG, issueAttestationCore as dH, publishRevocationListCore as dI, revokeDocCore as dJ, unrevokeDocCore as dK, type ClassifiedFieldSpec as dL, type ClassifiedStrategy as dM, ClassifiedConfigError as dN, type ClassifiedEntry as dO, type ClassifiedGroup as dP, type ClassifiedList as dQ, type ClassifiedRevealCtx as dR, ClassifiedRevealError as dS, type ClassifiedRider as dT, ClassifiedRotationError as dU, type ClassifiedStorage as dV, type ClassifiedVerdict as dW, type ClassifiedVerifyCtx as dX, ClassifiedVerifyError as dY, NO_CLASSIFIED as dZ, isClassifiedFieldSpec as d_, NO_SEALED_RECORD as da, type SealedCekBinding as db, SealedRecordExpiredError as dc, SealedRecordMismatchError as dd, SealedRecordNotEnabledError as de, type WalkClosureOptions as df, type SealingKeyProvider as dg, type RecoveryEnrollmentInput as dh, type ShamirRecoveryProvider as di, type EnclaveKey as dj, AdoptionStateError as dk, BackupCorruptedError as dl, BackupLedgerError as dm, BundleIntegrityError as dn, BundleSealMismatchError as dp, BundleVersionConflictError as dq, type ClosureResult as dr, type ExtractPartitionResult as ds, PartitionExtractionError as dt, PodVersionConflictError as du, TransferSealError as dv, extractPartition as dw, walkClosure as dx, type AttestationStrategy as dy, AttestationError as dz, DictionaryHandle as e, type Conflict as e$, type PublicEnvelope as e0, type BundleRecipient as e1, type RecipientSealer as e2, type RecipientHint as e3, TxContext as e4, type MVQueryContext as e5, type RegisteredMV as e6, Query as e7, MaterializedViewRegistry as e8, type MaterializedFromMeta as e9, type GateName as eA, type PolicyDenyReason as eB, type GatePolicy as eC, type AccessibleVault as eD, type AffectedDocument as eE, AlreadyElevatedError as eF, type ArchivePolicy as eG, type ArchiveResult as eH, type ArchiveRunOptions as eI, type ArchiveStrategy as eJ, BUNDLE_STORE_POLICY as eK, type BuiltInGateName as eL, type CacheOptions as eM, type CacheStats as eN, CargoNotEnabledError as eO, type CargoStrategy as eP, type ChangeEvent as eQ, ClassifiedNotEnabledError as eR, type Clause as eS, type CollectionChangeEvent as eT, type CollectionConfig as eU, type CollectionConflictResolver as eV, type CollectionDescriptor as eW, type CollectionStats as eX, ComputedFieldError as eY, type ComputedFields as eZ, type ComputedFn as e_, MaterializedViewConfigError as ea, MaterializedViewCycleError as eb, type MaterializedViewOutput as ec, MaterializedViewSourceUnknownError as ed, MaterializedViewTooLargeError as ee, type UnionArmJoin as ef, type UnionSource as eg, type SearchStrategy as eh, type SequenceStrategy as ei, type CustodyStrategy as ej, type SchemaUpdateStrategy as ek, type TransformFn as el, type PersistedSchemaEnvelope as em, type UpdateDecision as en, NoydbError as eo, type UserEnvelope as ep, type VaultUserApi as eq, type UserApiDeps as er, type DeepPartialOrNull as es, type UserEnvelopePresented as et, type Unsubscribe as eu, type LiveUserEnvelope as ev, type RoundingMode as ew, type VaultPolicy as ex, type ActiveTier as ey, type FactorProof as ez, type DictionaryOptions as f, type HistoryConfig as f$, ConflictError as f0, type ConflictPolicy as f1, type ConflictStrategy as f2, CrossJoinSourceUnknownError as f3, CrossJoinTooLargeError as f4, type CrossTierAccessEvent as f5, CustodyApi as f6, type CustodyHost as f7, CustodyNotEnabledError as f8, DEFAULT_CROSS_JOIN_MAX_ROWS as f9, type EnrollAuthenticatorWrappingDEKsOptions as fA, type EnrollAuthenticatorWrappingKEKOptions as fB, type EnrollRecoveryResult as fC, type ExportCapability as fD, ExportCapabilityError as fE, type ExportChunk as fF, type ExportStreamOptions as fG, type FactorKind as fH, type FactorProofBundle as fI, type FactorRequirement as fJ, type FenceDoc as fK, type FenceState as fL, type FieldChange as fM, type FieldClause as fN, type FieldDescriptor as fO, type FieldSource as fP, FilenameSanitizationError as fQ, type FilterClause as fR, ForgetStrategyNotConfiguredError as fS, type FormattedSequenceHandle as fT, type FrozenSnapshotRef as fU, type GhostRecord as fV, type GrantCustodianOptions as fW, type GrantOptions as fX, GroupCardinalityError as fY, type GroupClause as fZ, type GuardViolation as f_, DEFAULT_JOIN_MAX_ROWS as fa, DEFAULT_PUBLIC_ENVELOPE_SCHEMA as fb, DELEGATIONS_COLLECTION as fc, DanglingReferenceError as fd, DataResidencyError as fe, DebugPlaintextError as ff, DebugReservedFieldError as fg, DecryptionError as fh, type DeepPartial as fi, type DeferredNumberingConfig as fj, DelegationTargetMissingError as fk, type DelegationToken as fl, type DeleteManyResult as fm, type DerivationDescriptor as fn, DirectoryDisabledError as fo, type DirtyEntry as fp, type DryRunResult as fq, type DumpSchemaOptions as fr, ELEVATION_AUDIT_COLLECTION as fs, ElevatedHandle as ft, ElevationExpiredError as fu, type EmbeddingDescriptor as fv, EmbeddingDimMismatchError as fw, EmbeddingModelMismatchError as fx, EnclaveNotSupportedError as fy, type EnrollAuthenticatorOptions as fz, type I18nMap as g, NO_CARGO as g$, type HistoryEntry as g0, INDEXED_STORE_POLICY as g1, type ImportCapability as g2, ImportCapabilityError as g3, type IndexFieldName as g4, IndexRequiredError as g5, IndexWriteFailureError as g6, type InferOutput as g7, type InternalCollectionStats as g8, InvalidKeyError as g9, type LiveUpstream as gA, type LocaleReadOptions as gB, Lru as gC, type LruOptions as gD, type LruStats as gE, MAGIC_LINK_CONTENT_INFO_PREFIX as gF, MAGIC_LINK_GRANTS_COLLECTION as gG, MAGIC_LINK_KEK_INFO_PREFIX as gH, type MagicLinkGrantPayload as gI, type MagicLinkGrantRecord as gJ, ManagedRecoveryNotEnrolledError as gK, type MaterializedViewDescriptor as gL, MemoryRecipientSealer as gM, MemorySealingKeyProvider as gN, MigrationRequiredError as gO, MoneyCurrencyError as gP, type MoneyDescriptor as gQ, type MoneyOptions as gR, type MoneyOptionsFixed as gS, type MoneyOptionsMulti as gT, MoneyPrecisionError as gU, type MoneyString as gV, MoneyUnsupportedError as gW, NOYDB_BACKUP_VERSION as gX, NOYDB_FORMAT_VERSION as gY, NOYDB_KEYRING_VERSION as gZ, NOYDB_SYNC_VERSION as g_, type IssueDelegationOptions as ga, type IssueMagicLinkGrantOptions as gb, type JoinContext as gc, type JoinLeg as gd, type JoinStrategy as ge, JoinTooLargeError as gf, type JoinableSource as gg, type KeyringAuthenticator as gh, type KeyringAuthenticatorWrappingDEKs as gi, type KeyringAuthenticatorWrappingKEK as gj, KeyringCorruptError as gk, KeyringExpiredError as gl, type KeyringFile as gm, type LazyStrategy as gn, LedgerContentionError as go, type LiberateOptions as gp, type LiberateResult as gq, LinkIntegrityError as gr, type LinkOnDelete as gs, type LinkRow as gt, type LinkSetHandle as gu, type LinkSpec as gv, type ListAccessibleVaultsOptions as gw, type ListPageResult as gx, type ListUsersOptions as gy, type LiveQuery as gz, type I18nTextDescriptor as h, type RecoverPassphraseInput as h$, NO_CUSTODY as h0, NO_SEARCH as h1, NO_SEQUENCE as h2, NO_TEAM as h3, NetworkError as h4, type NextOptions as h5, NoAccessError as h6, NonAdditiveSchemaChangeError as h7, NotFoundError as h8, Noydb as h9, type PublicEnvelopeField as hA, type PublicEnvelopeSchema as hB, type PublicEnvelopeText as hC, type PullMode as hD, type PullOptions as hE, type PullPolicy as hF, type PullResult as hG, type PushMode as hH, type PushOptions as hI, type PushPolicy as hJ, type PushResult as hK, type PutManyItemOptions as hL, type PutManyOptions as hM, type PutManyResult as hN, type QueryAcrossOptions as hO, type QueryAcrossResult as hP, type QueryField as hQ, type QueryPlan as hR, type QuerySource as hS, type QuickUnlockState as hT, QuickUnlockStore as hU, QuiesceTimeoutError as hV, type ReAuthOperation as hW, ReadOnlyAtInstantError as hX, ReadOnlyError as hY, ReadOnlyFrameError as hZ, RecordCekNotFoundError as h_, type NoydbBundleStore as ha, type NoydbEventMap as hb, type NoydbOptions as hc, type Assignment as hd, NumberingUncertaintyError as he, type Operator as hf, type OrderBy as hg, type OverlayViewDescriptor as hh, POD_STORE_POLICY as hi, PUBLIC_ENVELOPE_FIELDS as hj, type PaperRecoveryDoc as hk, type PaperRecoveryEntry as hl, type PassphrasePolicy as hm, type PassphraseValidationResult as hn, PathEscapeError as ho, PeriodClosedError as hp, type Permission as hq, PermissionDeniedError as hr, type Permissions as hs, type PersistedSchemaKind as ht, type PlaintextTranslatorContext as hu, type PlaintextTranslatorFn as hv, PolicyDeniedError as hw, PresenceHandle as hx, type PresencePeer as hy, PrivilegeEscalationError as hz, type I18nTextOptions as i, type SyncPolicy as i$, type RecoverPassphraseResult as i0, type RecoverUserOptions as i1, RecoveryNotEnrolledError as i2, RecoveryProfileNotImplementedError as i3, type RecoveryProof as i4, type RefDescriptor as i5, RefIntegrityError as i6, type RefMode as i7, RefRegistry as i8, RefScopeError as i9, SearchNotEnabledError as iA, type SearchOptions as iB, type SearchResult as iC, SequenceContentionError as iD, type SequenceHandle as iE, SequenceNotEnabledError as iF, SequenceOfflineError as iG, type SequenceOptions as iH, SequenceStore as iI, type SequenceStoreOptions as iJ, type SessionPolicy as iK, type SetPublicEnvelopeInput as iL, type ShamirRecoveryDoc as iM, type ShamirRecoveryEntry as iN, ShardProvisioningError as iO, type SlotRewrapCeremony as iP, type SlotRewrapContext as iQ, type StandardSchemaV1 as iR, type StandardSchemaV1Issue as iS, type StandardSchemaV1SyncResult as iT, type StoreAuth as iU, type StoreAuthKind as iV, type StoreCapabilities as iW, StoreCapabilityError as iX, type StoreTime as iY, SyncEngine as iZ, type SyncMetadata as i_, type RefViolation as ia, ReservedVaultNameError as ib, type ResolvedPublicEnvelopeSchema as ic, type RetrieveHit as id, type RetrieveOptions as ie, type RevokeOptions as ig, type RotatePassphraseInput as ih, type RotateRecoveryOptions as ii, type RotateRecoveryResult as ij, SEALED_PASSPHRASE_RECORD_ID as ik, ScanBuilder as il, type ScanPageProvider as im, type SchemaDelta as io, SchemaFenceError as ip, type SchemaIntrospection as iq, SchemaLockedError as ir, SchemaUpdateError as is, SchemaValidationError as it, type Sealed as iu, type SealedEnvelope as iv, SealedHandle as iw, type SealedPassphrase as ix, type SealedView as iy, type SearchEntry as iz, LocaleNotSpecifiedError as j, derivePresenceKey as j$, SyncScheduler as j0, type SyncSchedulerStatus as j1, type SyncStatus as j2, type SyncTarget as j3, type SyncTargetRole as j4, SyncTransaction as j5, type SyncTransactionResult as j6, type TabChannel as j7, type TabCoordinationOptions as j8, type TabLockManager as j9, type VaultSchemaSnapshot as jA, type VaultSnapshot as jB, VaultTemplateNotFoundError as jC, type WarningRules as jD, WeakPassphraseError as jE, type WeakPassphraseReason as jF, type WithArchiveOptions as jG, WithdrawalRequestError as jH, type WrappedDeksBlob as jI, type WriteConflict as jJ, type WriteQueue as jK, aesGcmOpen as jL, applyJoins as jM, approveWithdrawal as jN, asMoney as jO, assertStrongPassphrase as jP, base64ToBuffer as jQ, bufferToBase64 as jR, buildLiveQuery as jS, buildRecipientKeyringFile as jT, burnPaperRecoveryEntry as jU, compileSequenceFormat as jV, createNoydb as jW, createStore as jX, decryptBytes as jY, decryptDeterministic as jZ, deriveMagicLinkContentKey as j_, type TabPresence as ja, type TabRole as jb, TamperedError as jc, TeamNotEnabledError as jd, type TeamStrategy as je, TierDemoteDeniedError as jf, type TierMode as jg, TierNotGrantedError as jh, TiersNotEnabledError as ji, type TransactionInvariant as jj, type TranslatorAuditEntry as jk, TxCollection as jl, type TxOp as jm, TxVault as jn, UniqueConstraintError as jo, UnknownShardError as jp, UnsupportedIndexOptionError as jq, type UpdateAuthenticatorOptions as jr, type UpdateContext as js, type UpdateUserOptions as jt, type UserEnvelopeCheckGate as ju, UserEnvelopeOversizedError as jv, type UserInfo as jw, ValidationError as jx, type VaultBackup as jy, type VaultPolicyOnDisk as jz, type OnMissingPolicy as k, validatePassphrase as k$, encryptBytes as k0, encryptDeterministic as k1, enrollAuthenticator as k2, estimateEntropy as k3, evalComputedFields as k4, evaluateClause as k5, evaluateExportCapability as k6, evaluateFieldClause as k7, evaluateImportCapability as k8, executePlan as k9, mintWrappedDeksBlob as kA, money as kB, moneyNumber as kC, parseRsaOaepTlv as kD, parseSealedEnvelope as kE, readMagicLinkGrantRecord as kF, readPath as kG, recoverUser as kH, ref as kI, refArray as kJ, rejectWithdrawal as kK, removeAuthenticator as kL, requestWithdrawal as kM, resetJoinWarnings as kN, resolveSchema as kO, resolveSequenceKey as kP, revokeDelegation as kQ, revokeMagicLinkGrant as kR, runTransaction as kS, savePaperRecoveryEntries as kT, saveSealedPassphrase as kU, saveShamirRecoveryEntries as kV, sealRsaOaepTlv as kW, unwrapDeksFromBlob as kX, unwrapDeksFromPaperEntry as kY, unwrapDeksFromShamirEntry as kZ, unwrapMagicLinkGrant as k_, exportAccessibleData as ka, findAuthenticator as kb, hasExportCapability as kc, hasImportCapability as kd, hasRecoveryEnrolled as ke, isLinkCollectionName as kf, isMagicLinkGrantExpired as kg, isMoneyDescriptor as kh, isMoneyString as ki, isPublicEnvelope as kj, isRefArray as kk, issueDelegation as kl, recoverPassphrase as km, rotatePassphrase as kn, liberateVault as ko, listMagicLinkGrants as kp, listUsers as kq, listUsersWithEnvelopes as kr, listWithdrawalRequests as ks, loadActiveDelegations as kt, loadPaperRecoveryEntries as ku, loadSealedPassphrase as kv, loadShamirRecoveryEntries as kw, magicLinkGrantRecordId as kx, mintPaperRecoveryEntry as ky, mintShamirRecoveryEntry as kz, type ResolveI18nOptions as l, validatePublicEnvelopeInput as l0, validateSchemaInput as l1, validateSchemaOutput as l2, withArchive as l3, withDeferredNumbering as l4, withdrawAccessibleData as l5, writeMagicLinkGrant as l6, changeSecret as l7, createOwnerKeyring as l8, ensureCollectionDEK as l9, grant as la, loadKeyring as lb, persistKeyring as lc, revoke as ld, updateAuthenticator as le, updateKeyringIdentity as lf, IMPLICIT_LAZY as lg, type TxStrategy as lh, type AmendmentTxOptions as li, CrossShardJoinError as lj, sha256Hex as lk, type CrossJoinClause as ll, NO_TIERS as lm, type TiersContext as ln, type TiersStrategy as lo, assertDeclaredTier as lp, assertTiersEnabled as lq, classifySealedShred as lr, demote as ls, elevate as lt, getAtTier as lu, listAtTier as lv, putAtTier as lw, withTiers as lx, type ScriptWarning as m, type StaticDictDescriptor as n, StaticDictReadonlyError as o, applyI18nLocale as p, dictCollectionName as q, dictKey as r, enforceScript as s, getAtPath as t, i18nText as u, inferScripts as v, isDictCollectionName as w, isDictKeyDescriptor as x, isI18nTextDescriptor as y, isStaticDictDescriptor as z };