@noy-db/hub 0.3.0-pre.9 → 0.3.0

package/dist/chunk-BIOUI4HL.js

@@ -0,0 +1,1554 @@
+// src/kernel/constants.ts
+var STATE_VAULT_NAME = "__noydb_state__";
+var USER_ENVELOPE_MAX_BYTES = 64 * 1024;
+var USER_ENVELOPE_COLLECTION = "_users";
+
+// src/kernel/errors.ts
+var NoydbError = class extends Error {
+  /** Machine-readable error code. Stable across library versions. */
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "NoydbError";
+    this.code = code;
+  }
+};
+var DebugPlaintextError = class extends NoydbError {
+  constructor(message = "debugPlaintext requires encrypt: false") {
+    super("DEBUG_PLAINTEXT_REQUIRES_UNENCRYPTED", message);
+    this.name = "DebugPlaintextError";
+  }
+};
+var DebugReservedFieldError = class extends NoydbError {
+  constructor(collection, field) {
+    super(
+      "DEBUG_RESERVED_FIELD",
+      `Record in "${collection}" has reserved field "${field}": the _ prefix is reserved under debugPlaintext mode`
+    );
+    this.name = "DebugReservedFieldError";
+  }
+};
+var DecryptionError = class extends NoydbError {
+  constructor(message = "Decryption failed") {
+    super("DECRYPTION_FAILED", message);
+    this.name = "DecryptionError";
+  }
+};
+var TamperedError = class extends NoydbError {
+  constructor(message = "Data integrity check failed \u2014 record may have been tampered with") {
+    super("TAMPERED", message);
+    this.name = "TamperedError";
+  }
+};
+var InvalidKeyError = class extends NoydbError {
+  constructor(message = "Invalid key \u2014 wrong passphrase or corrupted keyring") {
+    super("INVALID_KEY", message);
+    this.name = "InvalidKeyError";
+  }
+};
+var KeyringCorruptError = class extends NoydbError {
+  failedCollections;
+  intactCount;
+  constructor(opts) {
+    super(
+      "KEYRING_CORRUPT",
+      opts.message ?? `Keyring has ${opts.failedCollections.length} corrupted wrapped DEK(s) (${opts.failedCollections.join(", ")}); ${opts.intactCount} other DEK(s) unwrapped successfully \u2014 the passphrase is correct, the entries are damaged. Do NOT use onInvalidKey: 'reset' here \u2014 that would destroy the intact DEKs.`
+    );
+    this.name = "KeyringCorruptError";
+    this.failedCollections = opts.failedCollections;
+    this.intactCount = opts.intactCount;
+  }
+};
+var NoAccessError = class extends NoydbError {
+  constructor(message = "No access \u2014 user does not have a key for this collection") {
+    super("NO_ACCESS", message);
+    this.name = "NoAccessError";
+  }
+};
+var ReadOnlyError = class extends NoydbError {
+  constructor(message = "Read-only \u2014 user has ro permission on this collection") {
+    super("READ_ONLY", message);
+    this.name = "ReadOnlyError";
+  }
+};
+var ReadOnlyAtInstantError = class extends NoydbError {
+  constructor(operation, timestamp) {
+    super(
+      "READ_ONLY_AT_INSTANT",
+      `Cannot ${operation}() on a vault view anchored at ${timestamp} \u2014 time-machine views are read-only`
+    );
+    this.name = "ReadOnlyAtInstantError";
+  }
+};
+var ReadOnlyFrameError = class extends NoydbError {
+  constructor(operation) {
+    super(
+      "READ_ONLY_FRAME",
+      `Cannot ${operation}() on a vault frame \u2014 frames are read-only presentations of the current vault`
+    );
+    this.name = "ReadOnlyFrameError";
+  }
+};
+var PermissionDeniedError = class extends NoydbError {
+  constructor(message = "Permission denied \u2014 insufficient role for this operation") {
+    super("PERMISSION_DENIED", message);
+    this.name = "PermissionDeniedError";
+  }
+};
+var ExportCapabilityError = class extends NoydbError {
+  tier;
+  format;
+  userId;
+  constructor(opts) {
+    const msg = opts.message ?? (opts.tier === "plaintext" ? `Export capability denied \u2014 keyring "${opts.userId}" is not granted plaintext-export capability for format "${opts.format ?? "<unknown>"}". Ask a vault owner or admin to grant it via vault.grant({ exportCapability: { plaintext: ['${opts.format ?? "<format>"}'] } }).` : `Export capability denied \u2014 keyring "${opts.userId}" is not granted encrypted-bundle export capability. Ask a vault owner or admin to grant it via vault.grant({ exportCapability: { bundle: true } }).`);
+    super("EXPORT_CAPABILITY", msg);
+    this.name = "ExportCapabilityError";
+    this.tier = opts.tier;
+    this.userId = opts.userId;
+    if (opts.format !== void 0) this.format = opts.format;
+  }
+};
+var KeyringExpiredError = class extends NoydbError {
+  userId;
+  expiresAt;
+  constructor(opts) {
+    super(
+      "KEYRING_EXPIRED",
+      `Keyring "${opts.userId}" expired at ${opts.expiresAt}. The slot refuses to unlock past its expiry timestamp.`
+    );
+    this.name = "KeyringExpiredError";
+    this.userId = opts.userId;
+    this.expiresAt = opts.expiresAt;
+  }
+};
+var ImportCapabilityError = class extends NoydbError {
+  tier;
+  format;
+  userId;
+  constructor(opts) {
+    const msg = opts.message ?? (opts.tier === "plaintext" ? `Import capability denied \u2014 keyring "${opts.userId}" is not granted plaintext-import capability for format "${opts.format ?? "<unknown>"}". Ask a vault owner or admin to grant it via vault.grant({ importCapability: { plaintext: ['${opts.format ?? "<format>"}'] } }).` : `Import capability denied \u2014 keyring "${opts.userId}" is not granted encrypted-bundle import capability. Ask a vault owner or admin to grant it via vault.grant({ importCapability: { bundle: true } }).`);
+    super("IMPORT_CAPABILITY", msg);
+    this.name = "ImportCapabilityError";
+    this.tier = opts.tier;
+    this.userId = opts.userId;
+    if (opts.format !== void 0) this.format = opts.format;
+  }
+};
+var StoreCapabilityError = class extends NoydbError {
+  /** The store method/capability that was missing. */
+  capability;
+  constructor(capability, callerApi, storeName) {
+    super(
+      "STORE_CAPABILITY",
+      `${callerApi} requires the optional store capability "${capability}" but the active store${storeName ? ` (${storeName})` : ""} does not implement it. Use a store that supports "${capability}" (store-memory, store-file) or pass an explicit vault list to bypass enumeration.`
+    );
+    this.name = "StoreCapabilityError";
+    this.capability = capability;
+  }
+};
+var PrivilegeEscalationError = class extends NoydbError {
+  offendingCollection;
+  constructor(offendingCollection, message) {
+    super(
+      "PRIVILEGE_ESCALATION",
+      message ?? `Privilege escalation: grantor has no DEK for collection "${offendingCollection}" and cannot grant access to it.`
+    );
+    this.name = "PrivilegeEscalationError";
+    this.offendingCollection = offendingCollection;
+  }
+};
+var ReservedVaultNameError = class extends NoydbError {
+  /** The rejected vault name. */
+  vaultName;
+  constructor(vaultName) {
+    super(
+      "RESERVED_VAULT_NAME",
+      `"${vaultName}" is a reserved internal vault name and cannot be used as a group name or partition key`
+    );
+    this.name = "ReservedVaultNameError";
+    this.vaultName = vaultName;
+  }
+};
+var PeriodClosedError = class extends NoydbError {
+  periodName;
+  endDate;
+  recordTs;
+  constructor(periodName, endDate, recordTs) {
+    super(
+      "PERIOD_CLOSED",
+      `Cannot modify record (last written ${recordTs}) \u2014 sealed by closed period "${periodName}" (endDate: ${endDate}). Post a compensating entry in a new period instead.`
+    );
+    this.name = "PeriodClosedError";
+    this.periodName = periodName;
+    this.endDate = endDate;
+    this.recordTs = recordTs;
+  }
+};
+var RecordLockedError = class extends NoydbError {
+  collection;
+  id;
+  reason;
+  constructor(collection, id, reason) {
+    super(
+      "RECORD_LOCKED",
+      `Cannot modify ${collection}/${id} \u2014 locked by guard: ${reason}. Use withTransactions({ amendment: true, reason }) with admin/owner role to override.`
+    );
+    this.name = "RecordLockedError";
+    this.collection = collection;
+    this.id = id;
+    this.reason = reason;
+  }
+};
+var FieldFrozenError = class extends NoydbError {
+  collection;
+  id;
+  fields;
+  constructor(collection, id, fields) {
+    super(
+      "FIELD_FROZEN",
+      `Cannot change frozen field(s) on ${collection}/${id}: ${fields.join(", ")}. Use withTransactions({ amendment: true, reason }) with admin/owner role to override.`
+    );
+    this.name = "FieldFrozenError";
+    this.collection = collection;
+    this.id = id;
+    this.fields = fields;
+  }
+};
+var IllegalTransitionError = class extends NoydbError {
+  collection;
+  id;
+  from;
+  to;
+  constructor(collection, id, from, to) {
+    super(
+      "ILLEGAL_TRANSITION",
+      `Cannot transition ${collection}/${id} from "${from}" to "${to}" \u2014 not a declared arc. Use withTransactions({ amendment: true, reason }) with admin/owner role to override.`
+    );
+    this.name = "IllegalTransitionError";
+    this.collection = collection;
+    this.id = id;
+    this.from = from;
+    this.to = to;
+  }
+};
+var InvariantError = class extends NoydbError {
+  constructor(message) {
+    super("INVARIANT_VIOLATED", message);
+    this.name = "InvariantError";
+  }
+};
+var AmendmentForbiddenError = class extends NoydbError {
+  userId;
+  role;
+  constructor(userId, role) {
+    super(
+      "AMENDMENT_FORBIDDEN",
+      `User "${userId}" with role "${role}" cannot open an amendment transaction. Amendments require admin or owner role.`
+    );
+    this.name = "AmendmentForbiddenError";
+    this.userId = userId;
+    this.role = role;
+  }
+};
+var DirectoryDisabledError = class extends NoydbError {
+  vault;
+  constructor(vault) {
+    super(
+      "DIRECTORY_DISABLED",
+      `Vault "${vault}" has its user directory disabled. Only owners and admins can call listUsersWithEnvelopes() here. Use db.setDirectoryEnabled(vault, true) to re-enable.`
+    );
+    this.name = "DirectoryDisabledError";
+    this.vault = vault;
+  }
+};
+var TierNotGrantedError = class extends NoydbError {
+  tier;
+  collection;
+  constructor(collection, tier) {
+    super(
+      "TIER_NOT_GRANTED",
+      `User has no DEK for tier ${tier} in collection "${collection}"`
+    );
+    this.name = "TierNotGrantedError";
+    this.collection = collection;
+    this.tier = tier;
+  }
+};
+var TierWriteRefusedError = class extends NoydbError {
+  tier;
+  collection;
+  constructor(collection, tier, detail) {
+    super(
+      "TIER_WRITE_REFUSED",
+      detail ?? `put()/delete() cannot write to record in collection "${collection}" \u2014 it is elevated to tier ${tier}. Use putAtTier()/elevate()/demote() instead.`
+    );
+    this.name = "TierWriteRefusedError";
+    this.collection = collection;
+    this.tier = tier;
+  }
+};
+var UnsupportedTierCompositionError = class extends NoydbError {
+  feature;
+  constructor(feature, message) {
+    super("UNSUPPORTED_TIER_COMPOSITION", message);
+    this.name = "UnsupportedTierCompositionError";
+    this.feature = feature;
+  }
+};
+var BlobIntentPendingError = class extends NoydbError {
+  collection;
+  recordId;
+  constructor(collection, recordId) {
+    super(
+      "BLOB_INTENT_PENDING",
+      `A blob durability marker is already pending for "${collection}::${recordId}" \u2014 resume it before starting a new shred/rehome.`
+    );
+    this.name = "BlobIntentPendingError";
+    this.collection = collection;
+    this.recordId = recordId;
+  }
+};
+var ElevationExpiredError = class extends NoydbError {
+  tier;
+  expiresAt;
+  constructor(opts) {
+    super(
+      "ELEVATION_EXPIRED",
+      `Elevation to tier ${opts.tier} expired at ${new Date(opts.expiresAt).toISOString()}`
+    );
+    this.name = "ElevationExpiredError";
+    this.tier = opts.tier;
+    this.expiresAt = opts.expiresAt;
+  }
+};
+var AlreadyElevatedError = class extends NoydbError {
+  activeTier;
+  constructor(activeTier) {
+    super(
+      "ALREADY_ELEVATED",
+      `Vault is already elevated to tier ${activeTier}; release the existing handle first`
+    );
+    this.name = "AlreadyElevatedError";
+    this.activeTier = activeTier;
+  }
+};
+var TierDemoteDeniedError = class extends NoydbError {
+  constructor(id, tier) {
+    super(
+      "TIER_DEMOTE_DENIED",
+      `Only the original elevator or an owner can demote record "${id}" from tier ${tier}`
+    );
+    this.name = "TierDemoteDeniedError";
+  }
+};
+var DelegationTargetMissingError = class extends NoydbError {
+  toUser;
+  constructor(toUser) {
+    super(
+      "DELEGATION_TARGET_MISSING",
+      `Delegation target user "${toUser}" has no keyring in this vault`
+    );
+    this.name = "DelegationTargetMissingError";
+    this.toUser = toUser;
+  }
+};
+var ConflictError = class extends NoydbError {
+  /** The actual stored version at the time of conflict. */
+  version;
+  constructor(version, message = "Version conflict") {
+    super("CONFLICT", message);
+    this.name = "ConflictError";
+    this.version = version;
+  }
+};
+var LedgerContentionError = class extends NoydbError {
+  attempts;
+  constructor(attempts) {
+    super(
+      "LEDGER_CONTENTION",
+      `LedgerStore.append: failed to claim a chain slot after ${attempts} optimistic-CAS retries`
+    );
+    this.name = "LedgerContentionError";
+    this.attempts = attempts;
+  }
+};
+var SequenceContentionError = class extends NoydbError {
+  sequence;
+  attempts;
+  constructor(sequence, attempts) {
+    super(
+      "SEQUENCE_CONTENTION",
+      `vault.sequence("${sequence}").next(): failed to allocate after ${attempts} optimistic-CAS retries`
+    );
+    this.name = "SequenceContentionError";
+    this.sequence = sequence;
+    this.attempts = attempts;
+  }
+};
+var SequenceOfflineError = class extends NoydbError {
+  constructor() {
+    super(
+      "SEQUENCE_OFFLINE",
+      "vault.sequence().next() requires an online CAS-capable store (capabilities.casAtomic). Gap-free numbering cannot be serialized offline."
+    );
+    this.name = "SequenceOfflineError";
+  }
+};
+var SequenceNotEnabledError = class extends NoydbError {
+  constructor(message = "vault.sequence() requires the sequence capability. Pass `sequenceStrategy: withSequence()` to createNoydb().") {
+    super("SEQUENCE_NOT_ENABLED", message);
+    this.name = "SequenceNotEnabledError";
+  }
+};
+var NumberingUncertaintyError = class extends NoydbError {
+  series;
+  constructor(series) {
+    super(
+      "NUMBERING_UNCERTAINTY",
+      `Deferred numbering for series "${series}" cannot run: the store does not expose getStoreTime() (capabilities.serverWriteTime). Use a CAS sequence or a store with serverWriteTime.`
+    );
+    this.name = "NumberingUncertaintyError";
+    this.series = series;
+  }
+};
+var PodVersionConflictError = class extends NoydbError {
+  /** The bundle handle of the newer remote version that rejected the push. */
+  remoteVersion;
+  constructor(remoteVersion, message = "Bundle version conflict \u2014 remote has been updated") {
+    super("BUNDLE_VERSION_CONFLICT", message);
+    this.name = "PodVersionConflictError";
+    this.remoteVersion = remoteVersion;
+  }
+};
+var BundleVersionConflictError = PodVersionConflictError;
+var NetworkError = class extends NoydbError {
+  constructor(message = "Network error") {
+    super("NETWORK_ERROR", message);
+    this.name = "NetworkError";
+  }
+};
+var NotFoundError = class extends NoydbError {
+  constructor(message = "Record not found") {
+    super("NOT_FOUND", message);
+    this.name = "NotFoundError";
+  }
+};
+var ValidationError = class extends NoydbError {
+  constructor(message = "Validation error") {
+    super("VALIDATION_ERROR", message);
+    this.name = "ValidationError";
+  }
+};
+var SchemaValidationError = class extends NoydbError {
+  issues;
+  direction;
+  constructor(message, issues, direction) {
+    super("SCHEMA_VALIDATION_FAILED", message);
+    this.name = "SchemaValidationError";
+    this.issues = issues;
+    this.direction = direction;
+  }
+};
+var SchemaUpdateError = class extends NoydbError {
+  constructor(code, message) {
+    super(code, message);
+    this.name = "SchemaUpdateError";
+  }
+};
+var NonAdditiveSchemaChangeError = class extends SchemaUpdateError {
+  constructor(message) {
+    super("NON_ADDITIVE_SCHEMA_CHANGE", message);
+    this.name = "NonAdditiveSchemaChangeError";
+  }
+};
+var SchemaLockedError = class extends SchemaUpdateError {
+  constructor(message) {
+    super("SCHEMA_LOCKED", message);
+    this.name = "SchemaLockedError";
+  }
+};
+var SchemaFenceError = class extends SchemaUpdateError {
+  constructor(message) {
+    super("SCHEMA_FENCE", message);
+    this.name = "SchemaFenceError";
+  }
+};
+var MigrationRequiredError = class extends SchemaUpdateError {
+  constructor(message) {
+    super("MIGRATION_REQUIRED", message);
+    this.name = "MigrationRequiredError";
+  }
+};
+var QuiesceTimeoutError = class extends SchemaUpdateError {
+  constructor(message) {
+    super("QUIESCE_TIMEOUT", message);
+    this.name = "QuiesceTimeoutError";
+  }
+};
+var GroupCardinalityError = class extends NoydbError {
+  /** The field being grouped on. */
+  field;
+  /** Observed number of distinct groups at the moment the cap tripped. */
+  cardinality;
+  /** The cap that was exceeded. */
+  maxGroups;
+  constructor(field, cardinality, maxGroups) {
+    super(
+      "GROUP_CARDINALITY",
+      `.groupBy("${field}") produced ${cardinality} distinct groups, exceeding the ${maxGroups}-group ceiling. This is almost always a query mistake \u2014 grouping on a high-uniqueness field like "id" or "createdAt" produces one bucket per record. Narrow the query with .where() before grouping, or group on a lower-cardinality field (status, category, clientId). If you genuinely need high-cardinality grouping, file an issue with your use case.`
+    );
+    this.name = "GroupCardinalityError";
+    this.field = field;
+    this.cardinality = cardinality;
+    this.maxGroups = maxGroups;
+  }
+};
+var IndexRequiredError = class extends NoydbError {
+  collection;
+  touchedFields;
+  missingFields;
+  constructor(args) {
+    super(
+      "INDEX_REQUIRED",
+      `Collection "${args.collection}": query references unindexed fields in lazy mode (missing: ${args.missingFields.join(", ")}). Declare an index on each field, or use collection.scan() for non-indexed iteration.`
+    );
+    this.name = "IndexRequiredError";
+    this.collection = args.collection;
+    this.touchedFields = [...args.touchedFields];
+    this.missingFields = [...args.missingFields];
+  }
+};
+var UniqueConstraintError = class extends NoydbError {
+  collection;
+  recordId;
+  fields;
+  conflictingId;
+  constructor(collection, recordId, fields, conflictingId) {
+    super(
+      "UNIQUE_CONSTRAINT",
+      `Unique constraint on ${collection}.[${fields.join(", ")}] violated: record "${recordId}" duplicates a value already held by "${conflictingId}".`
+    );
+    this.name = "UniqueConstraintError";
+    this.collection = collection;
+    this.recordId = recordId;
+    this.fields = fields;
+    this.conflictingId = conflictingId;
+  }
+};
+var UnsupportedIndexOptionError = class extends NoydbError {
+  option;
+  constructor(option, message) {
+    super("UNSUPPORTED_INDEX_OPTION", message);
+    this.name = "UnsupportedIndexOptionError";
+    this.option = option;
+  }
+};
+var IndexWriteFailureError = class extends NoydbError {
+  recordId;
+  field;
+  op;
+  cause;
+  constructor(args) {
+    super(
+      "INDEX_WRITE_FAILURE",
+      `Index side-car ${args.op} failed for field "${args.field}" on record "${args.recordId}"`
+    );
+    this.name = "IndexWriteFailureError";
+    this.recordId = args.recordId;
+    this.field = args.field;
+    this.op = args.op;
+    this.cause = args.cause;
+  }
+};
+var PersistedIndexCompensationError = class extends NoydbError {
+  cause;
+  constructor(cause) {
+    super(
+      "PERSISTED_INDEX_COMPENSATION_STUCK",
+      "Persisted search-index compensation is stuck \u2014 a compensating remove() of a stale _ftindex blob failed and is being retried by every subsequent store call."
+    );
+    this.name = "PersistedIndexCompensationError";
+    this.cause = cause;
+  }
+};
+var FieldNotQueryableError = class extends NoydbError {
+  field;
+  constructor(field) {
+    super(
+      "FIELD_NOT_QUERYABLE",
+      `Field "${field}" is not queryable \u2014 its Via feature declares queryable: 'none'.`
+    );
+    this.name = "FieldNotQueryableError";
+    this.field = field;
+  }
+};
+var BundleIntegrityError = class extends NoydbError {
+  constructor(message) {
+    super("BUNDLE_INTEGRITY", `.noydb bundle integrity check failed: ${message}`);
+    this.name = "BundleIntegrityError";
+  }
+};
+var BundleSealMismatchError = class extends NoydbError {
+  userId;
+  pid;
+  constructor(userId, pid) {
+    super(
+      "BUNDLE_SEAL_MISMATCH",
+      `bundle carries sealed passphrase for user "${userId}" under provider "${pid}", but no registered provider matches that pid.
+
+Resolutions:
+  1. Configure a provider matching the pid and retry import.
+  2. Pass \`attemptUnsealAcrossProviders: true\` to try each registered
+     provider regardless of pid (extra credential prompts may surface).
+  3. Inspect the bundle without unsealing \u2014 pass no \`sealingProviders\`
+     to receive the sealed entries unmodified for offline analysis.`
+    );
+    this.name = "BundleSealMismatchError";
+    this.userId = userId;
+    this.pid = pid;
+  }
+};
+var ReservedCollectionNameError = class extends NoydbError {
+  /** The rejected collection name. */
+  collectionName;
+  constructor(collectionName) {
+    super(
+      "RESERVED_COLLECTION_NAME",
+      `"${collectionName}" is a reserved collection name. Use vault.dictionary("${collectionName.replace(/^_dict_/, "")}") to access dictionary collections.`
+    );
+    this.name = "ReservedCollectionNameError";
+    this.collectionName = collectionName;
+  }
+};
+var DictKeyMissingError = class extends NoydbError {
+  /** The dictionary name. */
+  dictionaryName;
+  /** The key that was not found. */
+  key;
+  constructor(dictionaryName, key) {
+    super(
+      "DICT_KEY_MISSING",
+      `Dictionary "${dictionaryName}" has no entry for key "${key}".`
+    );
+    this.name = "DictKeyMissingError";
+    this.dictionaryName = dictionaryName;
+    this.key = key;
+  }
+};
+var DictKeyInUseError = class extends NoydbError {
+  /** The dictionary name. */
+  dictionaryName;
+  /** The key that is still referenced. */
+  key;
+  /** Name of the first collection found to reference this key. */
+  usedBy;
+  /** Number of records in `usedBy` that reference this key. */
+  count;
+  constructor(dictionaryName, key, usedBy, count) {
+    super(
+      "DICT_KEY_IN_USE",
+      `Cannot delete key "${key}" from dictionary "${dictionaryName}": ${count} record(s) in "${usedBy}" still reference it. Use dictionary.rename("${key}", newKey) to rewrite references first.`
+    );
+    this.name = "DictKeyInUseError";
+    this.dictionaryName = dictionaryName;
+    this.key = key;
+    this.usedBy = usedBy;
+    this.count = count;
+  }
+};
+var RestrictRefUnresolvableError = class extends NoydbError {
+  /** The dimension (backing collection/dictionary) whose row's compare-key was unresolvable. */
+  dimension;
+  /** The backing row's key (its PUT-id) that was being deleted/forgotten. */
+  key;
+  /** The unresolvable restrict edge, formatted `"collection.field"`. */
+  referencing;
+  constructor(dimension, key, referencing) {
+    super(
+      "RESTRICT_REF_UNRESOLVABLE",
+      `Cannot delete "${dimension}" key "${key}": the restrict-mode reference from "${referencing}" could not be resolved (its compare-key is unreadable on the backing row). Refusing to delete \u2014 cannot prove no references exist.`
+    );
+    this.name = "RestrictRefUnresolvableError";
+    this.dimension = dimension;
+    this.key = key;
+    this.referencing = referencing;
+  }
+};
+var MissingTranslationError = class extends NoydbError {
+  /** The field name whose translation(s) are missing. */
+  field;
+  /** Locale codes that were required but absent. */
+  missing;
+  constructor(field, missing, message) {
+    super(
+      "MISSING_TRANSLATION",
+      message ?? `Field "${field}": missing required translation(s): ${missing.join(", ")}.`
+    );
+    this.name = "MissingTranslationError";
+    this.field = field;
+    this.missing = missing;
+  }
+};
+var LocaleNotSpecifiedError = class extends NoydbError {
+  /** The field name that required a locale. */
+  field;
+  constructor(field, message) {
+    super(
+      "LOCALE_NOT_SPECIFIED",
+      message ?? `Cannot read i18nText field "${field}" without a locale. Pass { locale } to get()/list()/query() or set a default via openVault(name, { locale }).`
+    );
+    this.name = "LocaleNotSpecifiedError";
+    this.field = field;
+  }
+};
+var ScriptViolationError = class extends NoydbError {
+  /** The field whose value violated its script constraint. */
+  field;
+  /** The locale slot (e.g. `'en'`) that was checked. */
+  locale;
+  /** The Unicode scripts allowed for this slot. */
+  expected;
+  /** A short sample of the offending characters, for diagnostics. */
+  sample;
+  constructor(field, locale, expected, sample, message) {
+    super(
+      "SCRIPT_VIOLATION",
+      message ?? `Field "${field}" slot "${locale}" expects script(s) [${expected.join(", ")}] but contains disallowed character(s): "${sample}".`
+    );
+    this.name = "ScriptViolationError";
+    this.field = field;
+    this.locale = locale;
+    this.expected = expected;
+    this.sample = sample;
+  }
+};
+var StaticDictReadonlyError = class extends NoydbError {
+  /** The static dictionary name that was the target of the mutation. */
+  dictionaryName;
+  constructor(dictionaryName) {
+    super(
+      "STATIC_DICT_READONLY",
+      `Dictionary "${dictionaryName}" is a staticDict \u2014 its labels are code constants with no mutation surface. put/putAll/rename/delete are not supported; change the label in the staticDict() table and redeploy.`
+    );
+    this.name = "StaticDictReadonlyError";
+    this.dictionaryName = dictionaryName;
+  }
+};
+var UnknownDictCodeError = class extends NoydbError {
+  /** The static dictionary name. */
+  dictionaryName;
+  /** The field that carried the unknown code. */
+  field;
+  /** The offending code value. */
+  code;
+  constructor(dictionaryName, field, code) {
+    super(
+      "UNKNOWN_DICT_CODE",
+      `Field "${field}": code "${code}" is not a known key of staticDict "${dictionaryName}". Use a declared code, or pass { validateCodes: false } on the descriptor to allow open codes.`
+    );
+    this.name = "UnknownDictCodeError";
+    this.dictionaryName = dictionaryName;
+    this.field = field;
+    this.code = code;
+  }
+};
+var UnknownLookupKeyError = class extends NoydbError {
+  /** The dimension (dictionary/target collection) name. */
+  dimension;
+  /** The field that carried the unknown key. */
+  field;
+  /** The offending key value. */
+  key;
+  constructor(dimension, field, key) {
+    super(
+      "UNKNOWN_LOOKUP_KEY",
+      `Field "${field}": key "${key}" is not a known member of the "${dimension}" lookup vocabulary (closed). Use a declared/existing key, or declare { vocabulary: 'open' } to allow unknown keys.`
+    );
+    this.name = "UnknownLookupKeyError";
+    this.dimension = dimension;
+    this.field = field;
+    this.key = key;
+  }
+};
+var TranslatorNotConfiguredError = class extends NoydbError {
+  /** The field that requested auto-translation. */
+  field;
+  /** The collection the put was targeting. */
+  collection;
+  constructor(field, collection) {
+    super(
+      "TRANSLATOR_NOT_CONFIGURED",
+      `Field "${field}" in collection "${collection}" has autoTranslate: true, but no plaintextTranslator was configured on createNoydb(). Either configure a plaintextTranslator or remove autoTranslate from the schema.`
+    );
+    this.name = "TranslatorNotConfiguredError";
+    this.field = field;
+    this.collection = collection;
+  }
+};
+var BackupLedgerError = class extends NoydbError {
+  /** First-broken-entry index, if known. */
+  divergedAt;
+  constructor(message, divergedAt) {
+    super("BACKUP_LEDGER", message);
+    this.name = "BackupLedgerError";
+    if (divergedAt !== void 0) this.divergedAt = divergedAt;
+  }
+};
+var BackupCorruptedError = class extends NoydbError {
+  /** The (collection, id) pair whose envelope failed the hash check. */
+  collection;
+  id;
+  constructor(collection, id, message) {
+    super("BACKUP_CORRUPTED", message);
+    this.name = "BackupCorruptedError";
+    this.collection = collection;
+    this.id = id;
+  }
+};
+var PartitionExtractionError = class extends NoydbError {
+  constructor(message) {
+    super("PARTITION_EXTRACTION", message);
+    this.name = "PartitionExtractionError";
+  }
+};
+var TransferSealError = class extends NoydbError {
+  constructor(message) {
+    super("TRANSFER_SEAL", message);
+    this.name = "TransferSealError";
+  }
+};
+var AdoptionStateError = class extends NoydbError {
+  constructor(message) {
+    super("ADOPTION_STATE", message);
+    this.name = "AdoptionStateError";
+  }
+};
+var AttestationError = class extends NoydbError {
+  constructor(message) {
+    super("ATTESTATION", message);
+    this.name = "AttestationError";
+  }
+};
+var AttestationNotEnabledError = class extends NoydbError {
+  constructor(message = 'Attestation requires the attestation capability. Pass `attestationStrategy: withAttestation()` from "@noy-db/hub/attestation" to createNoydb().') {
+    super("ATTESTATION_NOT_ENABLED", message);
+    this.name = "AttestationNotEnabledError";
+  }
+};
+var ClassifiedNotEnabledError = class extends NoydbError {
+  constructor(message = 'reveal() requires the classified capability. Pass `classifiedStrategy: withClassified()` from "@noy-db/hub/classified" to createNoydb().') {
+    super("CLASSIFIED_NOT_ENABLED", message);
+    this.name = "ClassifiedNotEnabledError";
+  }
+};
+var TiersNotEnabledError = class extends NoydbError {
+  constructor(message = 'Hierarchical tiers require the tiers capability. Pass `tiersStrategy: withTiers()` from "@noy-db/hub/tiers" to createNoydb().') {
+    super("TIERS_NOT_ENABLED", message);
+    this.name = "TiersNotEnabledError";
+  }
+};
+var SealedRecordNotEnabledError = class extends NoydbError {
+  constructor(message = 'Record-scoped CEK sealing requires the sealed-record capability. Pass `sealedRecordStrategy: withSealedRecord()` from "@noy-db/hub/sealed-record" to createNoydb().') {
+    super("SEALED_RECORD_NOT_ENABLED", message);
+    this.name = "SealedRecordNotEnabledError";
+  }
+};
+var PortabilityNotEnabledError = class extends NoydbError {
+  constructor(message = 'Data portability (export/withdrawal) requires the portability capability. Pass `portabilityStrategy: withPortability()` from "@noy-db/hub/portability" to createNoydb().') {
+    super("PORTABILITY_NOT_ENABLED", message);
+    this.name = "PortabilityNotEnabledError";
+  }
+};
+var CustodyNotEnabledError = class extends NoydbError {
+  constructor(message = "Sovereign custody (grant/revoke custodian, liberate) requires the custody capability. Pass `custodyStrategy: withCustody()` to createNoydb().") {
+    super("CUSTODY_NOT_ENABLED", message);
+    this.name = "CustodyNotEnabledError";
+  }
+};
+var TeamNotEnabledError = class extends NoydbError {
+  constructor(message = 'Multi-user grant/revoke/rotate requires the team capability. Pass `teamStrategy: withTeam()` (from "@noy-db/hub/team") to createNoydb().') {
+    super("TEAM_NOT_ENABLED", message);
+    this.name = "TeamNotEnabledError";
+  }
+};
+var SearchNotEnabledError = class extends NoydbError {
+  constructor(message = "Search / retrieval (search, retrieve, similarTo, warmIndex, flushIndex, and embedding compute) requires the search capability. Pass `searchStrategy: withSearch()` to createNoydb().") {
+    super("SEARCH_NOT_ENABLED", message);
+    this.name = "SearchNotEnabledError";
+  }
+};
+var CargoNotEnabledError = class extends NoydbError {
+  constructor(message = 'Partition extraction (extractPartition) requires the cargo capability. Pass `cargoStrategy: withCargo()` from "@noy-db/hub/cargo" to createNoydb().') {
+    super("CARGO_NOT_ENABLED", message);
+    this.name = "CargoNotEnabledError";
+  }
+};
+var BrokerNotEnabledError = class extends NoydbError {
+  constructor(message = 'Credential-broker operations require the broker capability. Pass `brokerStrategy: withBroker(config)` (from "@noy-db/hub/broker") to createNoydb().') {
+    super("BROKER_NOT_ENABLED", message);
+    this.name = "BrokerNotEnabledError";
+  }
+};
+var BrokerEnrolmentError = class extends NoydbError {
+  constructor(message = "Credential-broker enrolment failed") {
+    super("BROKER_ENROLMENT_ERROR", message);
+    this.name = "BrokerEnrolmentError";
+  }
+};
+var BrokerProofError = class extends NoydbError {
+  constructor(message = "Broker rejected the challenge proof") {
+    super("BROKER_PROOF_ERROR", message);
+    this.name = "BrokerProofError";
+  }
+};
+var SessionExpiredError = class extends NoydbError {
+  sessionId;
+  constructor(sessionId) {
+    super("SESSION_EXPIRED", `Session "${sessionId}" has expired. Re-unlock to continue.`);
+    this.name = "SessionExpiredError";
+    this.sessionId = sessionId;
+  }
+};
+var SessionNotFoundError = class extends NoydbError {
+  sessionId;
+  constructor(sessionId) {
+    super("SESSION_NOT_FOUND", `Session key for "${sessionId}" not found. The session may have been revoked or the page reloaded.`);
+    this.name = "SessionNotFoundError";
+    this.sessionId = sessionId;
+  }
+};
+var SessionPolicyError = class extends NoydbError {
+  operation;
+  constructor(operation, message) {
+    super(
+      "SESSION_POLICY",
+      message ?? `Operation "${operation}" requires re-authentication per the active session policy.`
+    );
+    this.name = "SessionPolicyError";
+    this.operation = operation;
+  }
+};
+var JoinTooLargeError = class extends NoydbError {
+  leftRows;
+  rightRows;
+  maxRows;
+  side;
+  constructor(opts) {
+    super("JOIN_TOO_LARGE", opts.message);
+    this.name = "JoinTooLargeError";
+    this.leftRows = opts.leftRows;
+    this.rightRows = opts.rightRows;
+    this.maxRows = opts.maxRows;
+    this.side = opts.side;
+  }
+};
+var CrossJoinTooLargeError = class extends NoydbError {
+  target;
+  expected;
+  limit;
+  constructor(opts) {
+    super(
+      "CROSS_JOIN_TOO_LARGE",
+      `crossJoin("${opts.target}"): would produce ${opts.expected} rows, exceeding the limit of ${opts.limit}. Narrow the left side with .where() first, or raise the ceiling with crossJoin("${opts.target}", { ..., maxRows: ${opts.expected} }).`
+    );
+    this.name = "CrossJoinTooLargeError";
+    this.target = opts.target;
+    this.expected = opts.expected;
+    this.limit = opts.limit;
+  }
+};
+var CrossJoinSourceUnknownError = class extends NoydbError {
+  target;
+  leftCollection;
+  constructor(target, leftCollection) {
+    super(
+      "CROSS_JOIN_SOURCE_UNKNOWN",
+      `crossJoin("${target}"): collection "${target}" is not known in the vault (cross-joining from "${leftCollection}"). Make sure "${target}" is open in the same vault before executing this query.`
+    );
+    this.name = "CrossJoinSourceUnknownError";
+    this.target = target;
+    this.leftCollection = leftCollection;
+  }
+};
+var DanglingReferenceError = class extends NoydbError {
+  field;
+  target;
+  refId;
+  constructor(opts) {
+    super("DANGLING_REFERENCE", opts.message);
+    this.name = "DanglingReferenceError";
+    this.field = opts.field;
+    this.target = opts.target;
+    this.refId = opts.refId;
+  }
+};
+var FilenameSanitizationError = class extends NoydbError {
+  constructor(message) {
+    super("FILENAME_SANITIZATION", message);
+    this.name = "FilenameSanitizationError";
+  }
+};
+var PathEscapeError = class extends NoydbError {
+  attempted;
+  targetDir;
+  constructor(opts) {
+    super(
+      "PATH_ESCAPE",
+      `Sanitized filename "${opts.attempted}" resolves outside target dir "${opts.targetDir}"`
+    );
+    this.name = "PathEscapeError";
+    this.attempted = opts.attempted;
+    this.targetDir = opts.targetDir;
+  }
+};
+var DerivationCycleError = class extends NoydbError {
+  path;
+  constructor(path) {
+    super(
+      "DERIVATION_CYCLE",
+      `Derivation graph contains a cycle: ${path.join(" \u2192 ")}. Refusing to open vault \u2014 break the cycle before retrying.`
+    );
+    this.name = "DerivationCycleError";
+    this.path = path;
+  }
+};
+var DerivationDepthError = class extends NoydbError {
+  limit;
+  attempted;
+  constructor(limit, attempted) {
+    super(
+      "DERIVATION_DEPTH",
+      `Derivation cascade exceeded max depth ${limit} (attempted ${attempted}). Pass lifecycle: { maxDepth: N } to raise the limit if intentional.`
+    );
+    this.name = "DerivationDepthError";
+    this.limit = limit;
+    this.attempted = attempted;
+  }
+};
+var DerivationOutputUnknownError = class extends NoydbError {
+  collection;
+  constructor(collection) {
+    super(
+      "DERIVATION_OUTPUT_UNKNOWN",
+      `Derivation output collection "${collection}" is not declared on the vault. Register the collection (e.g. via schema) before registering a derivation that writes to it.`
+    );
+    this.name = "DerivationOutputUnknownError";
+    this.collection = collection;
+  }
+};
+var DerivationOutputShapeError = class extends NoydbError {
+  outputKey;
+  constructor(outputKey, detail) {
+    super(
+      "DERIVATION_OUTPUT_SHAPE",
+      `Derivation output "${outputKey}" has invalid shape: ${detail}.`
+    );
+    this.name = "DerivationOutputShapeError";
+    this.outputKey = outputKey;
+  }
+};
+var DerivationCapExceededError = class extends NoydbError {
+  outputKey;
+  returned;
+  maxFanout;
+  constructor(outputKey, returned, maxFanout) {
+    super(
+      "DERIVATION_CAP_EXCEEDED",
+      `Derivation array output "${outputKey}" returned ${returned} rows, exceeding maxFanout=${maxFanout}. Raise \`maxFanout\` on the OutputSpec if this fanout is intended (the cap exists to keep dispatch cost bounded).`
+    );
+    this.name = "DerivationCapExceededError";
+    this.outputKey = outputKey;
+    this.returned = returned;
+    this.maxFanout = maxFanout;
+  }
+};
+var MaterializedViewCycleError = class extends NoydbError {
+  path;
+  constructor(path) {
+    super(
+      "MATERIALIZED_VIEW_CYCLE",
+      `Materialized-view graph contains a cycle: ${path.join(" \u2192 ")}. Refusing to open vault \u2014 break the cycle before retrying.`
+    );
+    this.name = "MaterializedViewCycleError";
+    this.path = path;
+  }
+};
+var MaterializedViewSourceUnknownError = class extends NoydbError {
+  mvName;
+  collection;
+  constructor(mvName, collection) {
+    super(
+      "MATERIALIZED_VIEW_SOURCE_UNKNOWN",
+      `Materialized view "${mvName}" references unknown source collection "${collection}". Declare the collection (e.g. via schema or by writing to it once) before registering the MV.`
+    );
+    this.name = "MaterializedViewSourceUnknownError";
+    this.mvName = mvName;
+    this.collection = collection;
+  }
+};
+var MaterializedViewTooLargeError = class extends NoydbError {
+  mvName;
+  expected;
+  limit;
+  constructor(mvName, expected, limit) {
+    super(
+      "MATERIALIZED_VIEW_TOO_LARGE",
+      `Materialized view "${mvName}" would emit ${expected} rows, exceeding the configured limit of ${limit}. Override via { maxRows: N } on the MV strategy if intentional, or tighten the query's filter/groupBy.`
+    );
+    this.name = "MaterializedViewTooLargeError";
+    this.mvName = mvName;
+    this.expected = expected;
+    this.limit = limit;
+  }
+};
+var MaterializedViewConfigError = class extends NoydbError {
+  constructor(message) {
+    super(
+      "MATERIALIZED_VIEW_CONFIG",
+      `[noy-db] withMaterializedView: ${message}`
+    );
+    this.name = "MaterializedViewConfigError";
+  }
+};
+var OverlayBaseIsVirtualError = class extends NoydbError {
+  overlayName;
+  base;
+  constructor(overlayName, base) {
+    super(
+      "OVERLAY_BASE_IS_VIRTUAL",
+      `withOverlayedView "${overlayName}": base "${base}" is another overlay's virtual name. Multi-overlay stacking is a v3 feature; base must reference a concrete collection (a real source or an MV output).`
+    );
+    this.name = "OverlayBaseIsVirtualError";
+    this.overlayName = overlayName;
+    this.base = base;
+  }
+};
+var OverlayCollectionUnavailableError = class extends NoydbError {
+  overlayName;
+  overlay;
+  constructor(overlayName, overlay) {
+    super(
+      "OVERLAY_COLLECTION_UNAVAILABLE",
+      `withOverlayedView "${overlayName}": overlay collection "${overlay}" is unavailable. It must be a real vault-known collection that is NOT itself an MV output collection.`
+    );
+    this.name = "OverlayCollectionUnavailableError";
+    this.overlayName = overlayName;
+    this.overlay = overlay;
+  }
+};
+var OverlayNameCollisionError = class extends NoydbError {
+  overlayName;
+  constructor(overlayName) {
+    super(
+      "OVERLAY_NAME_COLLISION",
+      `withOverlayedView "${overlayName}": virtual name collides with an MV output or a concrete source collection. Pick a unique name for the virtual collection.`
+    );
+    this.name = "OverlayNameCollisionError";
+    this.overlayName = overlayName;
+  }
+};
+var OverlayIdMismatchError = class extends NoydbError {
+  actual;
+  expected;
+  constructor(actual, expected) {
+    super(
+      "OVERLAY_ID_MISMATCH",
+      `Overlay put(id, record): id "${actual}" does not match the base MV's rowKey(record) \u2192 "${expected}". Pass the row directly via .put(record) to derive the id, or fix the id to match the base MV's rowKey output.`
+    );
+    this.name = "OverlayIdMismatchError";
+    this.actual = actual;
+    this.expected = expected;
+  }
+};
+var SnapshotNotFoundError = class extends NoydbError {
+  version;
+  constructor(version) {
+    super(
+      "SNAPSHOT_NOT_FOUND",
+      `Snapshot not found: "${version}" does not exist in the snapshot store. It may have been pruned by the retention policy or deleted manually.`
+    );
+    this.name = "SnapshotNotFoundError";
+    this.version = version;
+  }
+};
+var UnknownShardError = class extends NoydbError {
+  partitionKey;
+  constructor(partitionKey, groupName) {
+    super(
+      "SHARD_UNKNOWN",
+      `No shard for partition key "${partitionKey}" in vault group "${groupName}" and autoCreate is disabled. Call group.createShard(${JSON.stringify(partitionKey)}) first, or enable sharding.autoCreate.`
+    );
+    this.name = "UnknownShardError";
+    this.partitionKey = partitionKey;
+  }
+};
+var ShardProvisioningError = class extends NoydbError {
+  vaultId;
+  constructor(vaultId, partitionKey) {
+    super(
+      "SHARD_PROVISIONING",
+      `Registry has a row for partition "${partitionKey}" (vault "${vaultId}") but that vault is not provisioned in the store. Refusing to recreate it \u2014 the registry and store have diverged. Investigate before retrying.`
+    );
+    this.name = "ShardProvisioningError";
+    this.vaultId = vaultId;
+  }
+};
+var DataResidencyError = class extends NoydbError {
+  vaultId;
+  requiredRegion;
+  backendRegion;
+  constructor(vaultId, requiredRegion, backendRegion) {
+    super(
+      "DATA_RESIDENCY",
+      `Shard "${vaultId}" requires region "${requiredRegion}" but its placement backend declares region ${backendRegion === void 0 ? "(none)" : `"${backendRegion}"`}. Refusing to provision \u2014 route this shard to a region-correct backend via routeStore({ vaultRoutes }) (e.g. a region-encoded partition key) before retrying.`
+    );
+    this.name = "DataResidencyError";
+    this.vaultId = vaultId;
+    this.requiredRegion = requiredRegion;
+    this.backendRegion = backendRegion;
+  }
+};
+var CrossShardJoinError = class extends NoydbError {
+  constructor(message) {
+    super("CROSS_SHARD_JOIN", message);
+    this.name = "CrossShardJoinError";
+  }
+};
+var VaultTemplateNotFoundError = class extends NoydbError {
+  templateName;
+  constructor(templateName) {
+    super(
+      "VAULT_TEMPLATE_NOT_FOUND",
+      `No vault template registered under "${templateName}". Register the template before opening the vault group.`
+    );
+    this.name = "VaultTemplateNotFoundError";
+    this.templateName = templateName;
+  }
+};
+var ForgetStrategyNotConfiguredError = class extends NoydbError {
+  constructor(message = 'vault.forget() requires a forget strategy. Pass `forgetStrategy: withForgetCascade({ subjects: { <collection>: <subjectField> } })` from "@noy-db/hub/forget" to createNoydb().') {
+    super("FORGET_NOT_CONFIGURED", message);
+    this.name = "ForgetStrategyNotConfiguredError";
+  }
+};
+var SealedRecordExpiredError = class extends NoydbError {
+  expiresAt;
+  constructor(expiresAt) {
+    super(
+      "SEALED_RECORD_EXPIRED",
+      `Sealed record CEK expired at ${expiresAt}. The grantor must re-seal the record with a later expiresAt.`
+    );
+    this.name = "SealedRecordExpiredError";
+    this.expiresAt = expiresAt;
+  }
+};
+var SealedRecordMismatchError = class extends NoydbError {
+  expected;
+  actual;
+  constructor(expected, actual) {
+    super(
+      "SEALED_RECORD_MISMATCH",
+      `Sealed CEK binding is for ${actual.collection}/${actual.id} but was presented against ${expected.collection}/${expected.id}. A CEK sealed for one record cannot decrypt another.`
+    );
+    this.name = "SealedRecordMismatchError";
+    this.expected = expected;
+    this.actual = actual;
+  }
+};
+var RecordCekNotFoundError = class extends NoydbError {
+  collection;
+  id;
+  constructor(collection, id) {
+    super(
+      "RECORD_CEK_NOT_FOUND",
+      `No per-record CEK for ${collection}/${id}. The record is missing, or its collection was not opened with { perRecordKeys: true } \u2014 only per-record-key records carry a sealable CEK.`
+    );
+    this.name = "RecordCekNotFoundError";
+    this.collection = collection;
+    this.id = id;
+  }
+};
+var EmbeddingDimMismatchError = class extends NoydbError {
+  field;
+  expected;
+  actual;
+  constructor(field, expected, actual) {
+    super(
+      "EMBEDDING_DIM_MISMATCH",
+      `Embedding for "${field}" has dim ${actual}, expected ${expected}.`
+    );
+    this.name = "EmbeddingDimMismatchError";
+    this.field = field;
+    this.expected = expected;
+    this.actual = actual;
+  }
+};
+var EmbeddingModelMismatchError = class extends NoydbError {
+  expected;
+  found;
+  constructor(expected, found) {
+    super(
+      "EMBEDDING_MODEL_MISMATCH",
+      `Embedding model mismatch: collection uses "${expected}" but a stored vector is "${found}". Run vault.embeddings.reindex() after changing the encoder.`
+    );
+    this.name = "EmbeddingModelMismatchError";
+    this.expected = expected;
+    this.found = found;
+  }
+};
+var UserEnvelopeOversizedError = class extends NoydbError {
+  bytes;
+  limit;
+  constructor(bytes, limit = USER_ENVELOPE_MAX_BYTES) {
+    super(
+      "USER_ENVELOPE_OVERSIZED",
+      `User envelope payload is ${bytes} bytes; soft cap is ${limit} bytes. Move large data into the vault's regular collections.`
+    );
+    this.name = "UserEnvelopeOversizedError";
+    this.bytes = bytes;
+    this.limit = limit;
+  }
+};
+var PolicyDeniedError = class extends NoydbError {
+  gate;
+  reason;
+  required;
+  constructor(gate, reason, required, message) {
+    super(
+      "POLICY_DENIED",
+      message ?? `Gate "${gate}" denied: ${reason}.`
+    );
+    this.name = "PolicyDeniedError";
+    this.gate = gate;
+    this.reason = reason;
+    this.required = required;
+  }
+};
+var RecoveryNotEnrolledError = class extends NoydbError {
+  constructor(message = 'Recovery profile not enrolled. Pass `recovery: [{ profile: "paper", codes: 10 }]` to `createNoydb()`, or set `policy.gates["recover-passphrase"].enabled = false` to opt out of recovery (passphrase loss = data loss). See https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md.') {
+    super("RECOVERY_NOT_ENROLLED", message);
+    this.name = "RecoveryNotEnrolledError";
+  }
+};
+var ManagedRecoveryNotEnrolledError = class extends NoydbError {
+  vault;
+  constructor(vault) {
+    super(
+      "MANAGED_RECOVERY_NOT_ENROLLED",
+      `Managed-mode vault "${vault}" requires at least one strong recovery profile (Shamir today; multi-channel / admin-mediated when they ship). Paper alone is NOT strong under managed mode \u2014 losing the paper sheet would mean losing every record permanently. Bootstrap with \`db.openVaultAndEnrollRecovery("${vault}", { recovery: [{ profile: "shamir", k: 2, n: 3 }] })\`, or call \`db.enrollRecovery(vault, { profile: "shamir", k, n })\` separately, then re-attempt \`openVault\`.`
+    );
+    this.name = "ManagedRecoveryNotEnrolledError";
+    this.vault = vault;
+  }
+};
+var RecoveryProfileNotImplementedError = class extends NoydbError {
+  profile;
+  tracking;
+  constructor(profile, tracking) {
+    super(
+      "RECOVERY_PROFILE_NOT_IMPLEMENTED",
+      `Recovery profile "${profile}" is not yet implemented in this hub release. Tracking: ${tracking}. Use the "paper" profile via @noy-db/on-recovery in the meantime.`
+    );
+    this.name = "RecoveryProfileNotImplementedError";
+    this.profile = profile;
+    this.tracking = tracking;
+  }
+};
+var EnclaveNotSupportedError = class extends NoydbError {
+  /** The optional group that is not supported by this enclave. */
+  group;
+  constructor(group, detail) {
+    super(
+      "ENCLAVE_NOT_SUPPORTED",
+      `enclave: ${group} is not supported by this enclave${detail ? ` \u2014 ${detail}` : ""}`
+    );
+    this.name = "EnclaveNotSupportedError";
+    this.group = group;
+  }
+};
+var ClassifiedConfigError = class extends Error {
+  constructor(collection, message) {
+    super(`classifiedFields for collection "${collection}": ${message}`);
+    this.collection = collection;
+    this.name = "ClassifiedConfigError";
+  }
+  collection;
+};
+var ClassifiedRevealError = class extends Error {
+  constructor(collection, field, detail) {
+    super(`Cannot reveal field "${field}" in collection "${collection}": ${detail}`);
+    this.collection = collection;
+    this.field = field;
+    this.name = "ClassifiedRevealError";
+  }
+  collection;
+  field;
+};
+var ClassifiedVerifyError = class extends Error {
+  constructor(collection, field, detail) {
+    super(`Cannot verify field "${field}" in collection "${collection}": ${detail}`);
+    this.collection = collection;
+    this.field = field;
+    this.name = "ClassifiedVerifyError";
+  }
+  collection;
+  field;
+};
+var ClassifiedRotationError = class extends Error {
+  constructor(collection, field, detail) {
+    super(`Rotation refused for field "${field}" in collection "${collection}": ${detail}`);
+    this.collection = collection;
+    this.field = field;
+    this.name = "ClassifiedRotationError";
+  }
+  collection;
+  field;
+};
+var SatelliteConfigError = class extends NoydbError {
+  constructor(message, options) {
+    super("SATELLITE_CONFIG_ERROR", message);
+    this.name = "SatelliteConfigError";
+    if (options?.cause !== void 0) this.cause = options.cause;
+  }
+};
+
+export {
+  STATE_VAULT_NAME,
+  USER_ENVELOPE_MAX_BYTES,
+  USER_ENVELOPE_COLLECTION,
+  NoydbError,
+  DebugPlaintextError,
+  DebugReservedFieldError,
+  DecryptionError,
+  TamperedError,
+  InvalidKeyError,
+  KeyringCorruptError,
+  NoAccessError,
+  ReadOnlyError,
+  ReadOnlyAtInstantError,
+  ReadOnlyFrameError,
+  PermissionDeniedError,
+  ExportCapabilityError,
+  KeyringExpiredError,
+  ImportCapabilityError,
+  StoreCapabilityError,
+  PrivilegeEscalationError,
+  ReservedVaultNameError,
+  PeriodClosedError,
+  RecordLockedError,
+  FieldFrozenError,
+  IllegalTransitionError,
+  InvariantError,
+  AmendmentForbiddenError,
+  DirectoryDisabledError,
+  TierNotGrantedError,
+  TierWriteRefusedError,
+  UnsupportedTierCompositionError,
+  BlobIntentPendingError,
+  ElevationExpiredError,
+  AlreadyElevatedError,
+  TierDemoteDeniedError,
+  DelegationTargetMissingError,
+  ConflictError,
+  LedgerContentionError,
+  SequenceContentionError,
+  SequenceOfflineError,
+  SequenceNotEnabledError,
+  NumberingUncertaintyError,
+  PodVersionConflictError,
+  BundleVersionConflictError,
+  NetworkError,
+  NotFoundError,
+  ValidationError,
+  SchemaValidationError,
+  SchemaUpdateError,
+  NonAdditiveSchemaChangeError,
+  SchemaLockedError,
+  SchemaFenceError,
+  MigrationRequiredError,
+  QuiesceTimeoutError,
+  GroupCardinalityError,
+  IndexRequiredError,
+  UniqueConstraintError,
+  UnsupportedIndexOptionError,
+  IndexWriteFailureError,
+  PersistedIndexCompensationError,
+  FieldNotQueryableError,
+  BundleIntegrityError,
+  BundleSealMismatchError,
+  ReservedCollectionNameError,
+  DictKeyMissingError,
+  DictKeyInUseError,
+  RestrictRefUnresolvableError,
+  MissingTranslationError,
+  LocaleNotSpecifiedError,
+  ScriptViolationError,
+  StaticDictReadonlyError,
+  UnknownDictCodeError,
+  UnknownLookupKeyError,
+  TranslatorNotConfiguredError,
+  BackupLedgerError,
+  BackupCorruptedError,
+  PartitionExtractionError,
+  TransferSealError,
+  AdoptionStateError,
+  AttestationError,
+  AttestationNotEnabledError,
+  ClassifiedNotEnabledError,
+  TiersNotEnabledError,
+  SealedRecordNotEnabledError,
+  PortabilityNotEnabledError,
+  CustodyNotEnabledError,
+  TeamNotEnabledError,
+  SearchNotEnabledError,
+  CargoNotEnabledError,
+  BrokerNotEnabledError,
+  BrokerEnrolmentError,
+  BrokerProofError,
+  SessionExpiredError,
+  SessionNotFoundError,
+  SessionPolicyError,
+  JoinTooLargeError,
+  CrossJoinTooLargeError,
+  CrossJoinSourceUnknownError,
+  DanglingReferenceError,
+  FilenameSanitizationError,
+  PathEscapeError,
+  DerivationCycleError,
+  DerivationDepthError,
+  DerivationOutputUnknownError,
+  DerivationOutputShapeError,
+  DerivationCapExceededError,
+  MaterializedViewCycleError,
+  MaterializedViewSourceUnknownError,
+  MaterializedViewTooLargeError,
+  MaterializedViewConfigError,
+  OverlayBaseIsVirtualError,
+  OverlayCollectionUnavailableError,
+  OverlayNameCollisionError,
+  OverlayIdMismatchError,
+  SnapshotNotFoundError,
+  UnknownShardError,
+  ShardProvisioningError,
+  DataResidencyError,
+  CrossShardJoinError,
+  VaultTemplateNotFoundError,
+  ForgetStrategyNotConfiguredError,
+  SealedRecordExpiredError,
+  SealedRecordMismatchError,
+  RecordCekNotFoundError,
+  EmbeddingDimMismatchError,
+  EmbeddingModelMismatchError,
+  UserEnvelopeOversizedError,
+  PolicyDeniedError,
+  RecoveryNotEnrolledError,
+  ManagedRecoveryNotEnrolledError,
+  RecoveryProfileNotImplementedError,
+  EnclaveNotSupportedError,
+  ClassifiedConfigError,
+  ClassifiedRevealError,
+  ClassifiedVerifyError,
+  ClassifiedRotationError,
+  SatelliteConfigError
+};
+//# sourceMappingURL=chunk-BIOUI4HL.js.map