@noy-db/hub 0.3.0-pre.9 → 0.3.0

package/dist/transition-guard-BOUkzQU4.d.ts

@@ -1,165 +0,0 @@
-import { bc as GuardStrategy, bi as GuardStrategyHandle, bd as GuardChange, be as GuardContext } from './index-DzhNI2vE.js';
-
-/**
- * Register a guard for a collection. Guards run on every `put()` /
- * `delete()` for the named collection (after permissions, before
- * encryption) and may:
- *
- *   - `check` — block writes by throwing (typically `RecordLockedError`)
- *   - `frozenFields` — freeze specific fields once a condition is true
- *   - `amendment` — declare an authorized-override path with invariant
- *
- * Pass the returned handle to `createNoydb({ strategies: [...] })`.
- *
- * @see docs/superpowers/specs/2026-05-18-guards-design.md
- */
-declare function withGuard<T extends Record<string, unknown>>(strategy: GuardStrategy<T>): GuardStrategyHandle<T>;
-
-/**
- * `immutableGuard` — declarative WORM / append-only sugar over the guard
- * service.
- *
- * Issued fiscal documents (invoices, DDTs) must be immutable after issue.
- * That is expressible today with a hand-rolled `withGuard` (block on
- * `check`/`onDelete`, allow an admin `amendment`), but the boilerplate is
- * repetitive and easy to get subtly wrong. `immutableGuard` generates
- * exactly that guard from a declarative config, reusing the guard
- * machinery wholesale — `check`/`onDelete` rejection, the ledgered
- * `amendment` override, and composition with `periods`/`history`.
- *
- * ```ts
- * createNoydb({ guardStrategies: [
- *   immutableGuard({
- *     collection: 'invoices',
- *     after: (r) => r.status === 'issued',   // immutable once issued
- *   }),
- * ] })
- * ```
- *
- * A record is mutable until `after(record)` holds; from then on, updates
- * and deletes throw `RecordLockedError` unless performed inside an
- * `amendment` transaction by an authorized role (the override is
- * ledgered by the guard amendment mechanism). `appendOnly: true` is
- * shorthand for `after: () => true` — immutable from creation.
- */
-
-interface ImmutableGuardConfig<T extends Record<string, unknown>> {
-    /** The collection to make WORM. */
-    collection: string;
-    /**
-     * A record becomes immutable once this predicate holds. Evaluated on
-     * the *existing* (already-persisted) record, so the write that first
-     * makes it true is still allowed; subsequent writes are blocked.
-     * Mutually exclusive with `appendOnly`.
-     */
-    after?: (record: T) => boolean;
-    /** Shorthand for `after: () => true` — immutable from creation. */
-    appendOnly?: boolean;
-    /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */
-    amendmentRoles?: ReadonlyArray<'admin' | 'owner'>;
-    /**
-     * Optional set-level invariant run over the amendment change-set after
-     * the writes execute. Signature matches `GuardStrategy.amendment.invariant`
-     * exactly: it receives every {before, after} pair touching this
-     * collection in the amendment plus the guard context; throwing reverts
-     * the whole amendment and surfaces as `InvariantError`.
-     *
-     * Use this to keep a constraint inviolable EVEN under amendment — e.g.
-     * forbid deleting an issued document by re-throwing on any
-     * `before !== null && after === null` change, or assert a cross-record
-     * sum is preserved. When omitted the amendment is unconditionally
-     * allowed (the amendment itself is the sanctioned, ledgered override) —
-     * this is the backward-compatible default.
-     */
-    amendmentInvariant?: (changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>) => Promise<void> | void;
-}
-/**
- * Build an immutability guard. Pass the returned handle to
- * `createNoydb({ guardStrategies: [...] })`.
- */
-declare function immutableGuard<T extends Record<string, unknown>>(config: ImmutableGuardConfig<T>): GuardStrategyHandle<T>;
-
-/**
- * `transitionGuard` — declarative state-machine sugar over the guard
- * service.
- *
- * Any record with a lifecycle field (invoice `status`, order state,
- * ticket workflow, subscription phase) needs transition validation: a
- * write may only move the field along a declared arc. That is expressible
- * with a hand-rolled `withGuard({ check })`, but every consumer
- * re-implements the same graph lookup + error. `transitionGuard`
- * generates exactly that guard from a state graph, reusing the guard
- * machinery wholesale — `check` rejection, the ledgered `amendment`
- * override, and composition with `periods`/`history`.
- *
- * It generalizes {@link immutableGuard}: WORM is the special case "every
- * state has no outgoing arcs", i.e. `transitions` mapping each state to `[]`.
- *
- * ```ts
- * createNoydb({ guardStrategies: [
- *   transitionGuard<Sale>({
- *     collection: 'sales', field: 'status',
- *     transitions: {                          // absence of an arc = forbidden
- *       draft: ['to_verify', 'cancelled'],
- *       to_verify: ['proforma', 'draft', 'cancelled'],
- *       proforma: ['invoiced', 'cancelled'],
- *       invoiced: ['paid'], paid: [], cancelled: [],
- *     },
- *     initial: ['draft', 'to_verify'],        // allowed status on insert
- *   }),
- * ] })
- * ```
- *
- * Semantics:
- * - **Insert** (`ctx.existing === null`): `incoming[field]` must be in
- *   `initial`. When `initial` is omitted, any value is allowed on insert.
- * - **Update**: the arc `(existing[field] → incoming[field])` must be
- *   listed in `transitions[from]`, else `IllegalTransitionError`. A
- *   same-value write (`from === to`) is allowed when `allowIdempotent`
- *   (default `true`) — so writes that touch other fields without moving
- *   state pass.
- * - **Override**: inside an `amendment` transaction by an authorized role
- *   the check is skipped and the change is ledgered (mirrors every guard).
- *
- * The status graph is caller-supplied data — no UI, no domain logic.
- */
-
-interface TransitionGuardConfig<T extends Record<string, unknown>> {
-    /** The collection whose state field is governed. */
-    collection: string;
-    /** The state field on the record (e.g. `'status'`). */
-    field: keyof T & string;
-    /**
-     * The transition graph: each state maps to the states it may move to.
-     * A state absent from the map (or mapped to `[]`) is terminal — no
-     * outgoing arc, so any non-idempotent write from it is rejected.
-     */
-    transitions: Readonly<Record<string, readonly string[]>>;
-    /**
-     * States allowed as the initial value on insert (`existing === null`).
-     * Omit to allow any value on insert.
-     */
-    initial?: readonly string[];
-    /**
-     * Allow a same-value write (`from === to`) on update. Default `true` —
-     * lets a put that changes other fields, but not the state, through.
-     */
-    allowIdempotent?: boolean;
-    /** Roles permitted to override via an amendment transaction. Default `['admin', 'owner']`. */
-    amendmentRoles?: ReadonlyArray<'admin' | 'owner'>;
-    /**
-     * Optional set-level invariant run over the amendment change-set after
-     * the writes execute. Signature matches `GuardStrategy.amendment.invariant`
-     * exactly. When omitted the amendment is unconditionally allowed (the
-     * amendment itself is the sanctioned, ledgered override) — the
-     * backward-compatible default. Mirrors {@link immutableGuard}.
-     */
-    amendmentInvariant?: (changes: ReadonlyArray<GuardChange<T>>, ctx: GuardContext<T>) => Promise<void> | void;
-}
-/**
- * Build a state-machine transition guard. Pass the returned handle to
- * `createNoydb({ guardStrategies: [...] })`.
- */
-declare function transitionGuard<T extends Record<string, unknown>>(config: TransitionGuardConfig<T>): GuardStrategyHandle<T>;
-
-export { type ImmutableGuardConfig as I, type TransitionGuardConfig as T, immutableGuard as i, transitionGuard as t, withGuard as w };

package/dist/tx/index.d.ts

@@ -1,34 +0,0 @@
-import { jE as TransactionInvariant, lM as TxStrategy } from '../index-DzhNI2vE.js';
-export { lN as AmendmentTxOptions, jG as TxCollection, eb as TxContext, jI as TxVault, lk as runTransaction } from '../index-DzhNI2vE.js';
-import '../subject-index-CyOgGMJL.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';
-
-/**
- * Active transactions strategy. Only reachable via `@noy-db/hub/tx`.
- */
-
-/**
- * Options for {@link withTransactions}. Currently only commit-time
- * changeset `invariants` (see {@link TransactionInvariant}).
- */
-interface TransactionStrategyOptions {
-    /**
-     * Commit-time set-level invariants run over the changeset on every
-     * commit (ordinary AND amendment). See {@link TransactionInvariant}.
-     */
-    invariants?: ReadonlyArray<TransactionInvariant>;
-}
-/**
- * Build the default transactions strategy. Pass into
- * `createNoydb({ txStrategy: withTransactions() })` to enable
- * `db.transaction(fn)` (and `db.transaction({ dryRun: true }, fn)`).
- *
- * Supply `{ invariants }` to register commit-time changeset invariants —
- * set-level constraints that fire after the writes commit and revert the
- * transaction on a throw. Unlike `amendment.invariant`, these run for
- * ordinary `db.transaction(fn)` calls (and amendments) with no role gate.
- */
-declare function withTransactions(opts?: TransactionStrategyOptions): TxStrategy;
-
-export { TransactionInvariant, type TransactionStrategyOptions, TxStrategy, withTransactions };

package/dist/ui/index.d.ts

@@ -1,4 +0,0 @@
-export { et as CollectionDescription, f5 as CollectionMeta, fB as DescribeOptions, fC as DescribedField, g3 as FieldMeta, iX as SemanticType } from '../index-DzhNI2vE.js';
-import '../subject-index-CyOgGMJL.js';
-import '../index-B9QdHytu.js';
-import '@noy-db/attestation';

package/dist/ulid-DRH25k3y.d.ts

@@ -1,66 +0,0 @@
-/**
- * Minimal ULID generator — zero dependencies, Web Crypto API only.
- *
- *. Used by the bundle writer to generate stable opaque
- * handles for `.noydb` containers.
- *
- * **What's a ULID?** A 128-bit identifier encoded as 26 Crockford
- * base32 characters. Layout:
- *
- * ```
- *   01HYABCDEFGHJKMNPQRSTVWXYZ
- *   |--------||---------------|
- *    48-bit     80-bit
- *    timestamp  randomness
- * ```
- *
- * The first 10 chars encode a millisecond Unix timestamp (so ULIDs
- * sort lexicographically by creation time), and the remaining 16
- * chars are random. Crockford base32 omits I/L/O/U to avoid
- * ambiguity in handwriting and URLs.
- *
- * **Why hand-roll instead of pulling in `ulid`?** The package adds
- * a dep, the implementation is ~30 lines, and the bundle module
- * is the only consumer. Adding `ulid` would also drag in its own
- * crypto polyfill that we don't need on Node 18+ or modern
- * browsers.
- *
- * **Privacy consideration:** the timestamp prefix is observable in
- * the bundle header. This is a deliberate trade-off:
- *   - Pro: lexicographic sortability lets bundle adapters list
- *     newest-first without an extra index.
- *   - Con: a casual observer can read the bundle's creation time
- *     from the handle. They cannot read it from any OTHER field
- *     (the header explicitly forbids `_exported_at`), and a
- *     creation timestamp is the same kind of metadata that
- *     filesystem mtime would already expose for a downloaded
- *     bundle. The leak is therefore equivalent to what's already
- *     visible from the file's mtime — not a new exposure.
- *
- * If a future use case needs timestamp-free handles, a v2 of the
- * format could specify "use the random portion only" without a
- * format break — `validateBundleHeader` only checks the regex
- * shape, not the encoded timestamp.
- */
-/**
- * Generate a fresh ULID. Uses `crypto.getRandomValues` for the
- * randomness portion — same Web Crypto API the rest of the
- * codebase uses for IVs and salt.
- *
- * Returns a 26-character string. Calling twice in the same
- * millisecond produces two distinct ULIDs (the random portion
- * differs); ULIDs from the same millisecond are NOT guaranteed
- * to be monotonically ordered relative to each other, only
- * relative to ULIDs from a different millisecond. The bundle
- * format never relies on intra-millisecond ordering.
- */
-declare function generateULID(): string;
-/**
- * Validate that a string is a syntactically well-formed ULID. Used
- * by the bundle header validator. Does NOT verify that the
- * timestamp portion decodes to a sensible date — the format only
- * cares about the encoding shape.
- */
-declare function isULID(value: string): boolean;
-
-export { generateULID as g, isULID as i };

package/dist/util/index.d.ts

@@ -1,79 +0,0 @@
-export { i as isDiscriminant } from '../discriminant-BN9REW3o.js';
-
-/**
- * Target-profile aware filename sanitizer.
- *
- * Pure string in / string out. No filesystem access, no I/O. Use this
- * at the boundary where a user-supplied filename meets a storage
- * destination — local FS, ZIP archive, S3 key, URL path, SMB share —
- * to defuse the canonical 14-class footgun before it reaches that
- * destination.
- *
- * ## Threat model
- *
- *   1. Path injection — `..`, NUL bytes, `\` on POSIX, absolute paths.
- *   2. Windows reserved names — `CON`, `PRN`, `AUX`, `NUL`,
- *      `COM1-9`, `LPT1-9`, with or without an extension.
- *   3. Windows reserved chars — `< > : " / \ | ? *` plus ASCII 0-31.
- *   4. Trailing `.` and ` ` on Windows / SMB.
- *   5. Unicode normalization drift — same display, different bytes →
- *      "two files with the same name" sync ghosts.
- *   6. Bidi override spoofing — U+202E reversing `harmless.exe.txt`
- *      into `harmless.txt.exe`.
- *   7. URL `+` ambiguity in S3 presigned URLs.
- *   8. ZIP general-purpose-flag bit 11 (UTF-8 filename) optional in
- *      pre-2006 readers.
- *   9-14. Length caps, leading/trailing whitespace + controls,
- *      `.DS_Store`-style hidden noise, etc.
- *
- * ## Always-on transforms (every profile)
- *
- *   - NFC normalize (`String.prototype.normalize('NFC')`).
- *   - Reject NUL — hard fail, not strip. Silent strip enables a
- *     classic truncation bypass (`safe.txt\0.exe` → `safe.txt`).
- *   - Strip bidi overrides (`U+202A..U+202E`, `U+2066..U+2069`).
- *   - Trim leading/trailing whitespace and ASCII control chars.
- *
- * ## Non-goals (i18n boundary policy, )
- *
- *   - No transliteration.
- *   - No locale-aware slugging.
- *   - No script-specific segmentation.
- *
- * @module
- */
-/**
- * One of seven storage destinations the sanitizer knows how to defang
- * for. Pick the most restrictive that covers your write site:
- * `'macos-smb'` is the safe default for "I don't know where these
- * files end up but they're going to a real filesystem somewhere."
- */
-type FilenameProfile = 'posix' | 'windows' | 'macos-smb' | 'zip' | 'url-path' | 's3-key' | 'opaque';
-interface SanitizeFilenameOptions {
-    /** Target-destination profile. */
-    readonly profile: FilenameProfile;
-    /**
-     * Override the per-profile length cap. Useful when leaving headroom
-     * for a collision suffix — e.g. `maxBytes: 240` on a `posix` write
-     * site that wants 15 bytes of slack for `-1`, `-2`, …
-     */
-    readonly maxBytes?: number;
-    /**
-     * Required when `profile === 'opaque'`. The opaque profile replaces
-     * the entire input with `${opaqueId}.${ext}` (extension preserved
-     * from the input when present).
-     */
-    readonly opaqueId?: string;
-}
-/**
- * Sanitize a filename for a target-destination profile. Pure: same
- * input + options always returns the same output, no I/O.
- *
- * Returns the sanitized name. Throws {@link FilenameSanitizationError}
- * when the input cannot be made safe at all (NUL byte, empty after
- * normalization, missing `opaqueId` for the opaque profile,
- * `..` segment that would fall out of any reasonable target).
- */
-declare function sanitizeFilename(name: string, opts: SanitizeFilenameOptions): string;
-
-export { type FilenameProfile, type SanitizeFilenameOptions, sanitizeFilename };

package/dist/validators-B3SalxlJ.d.ts

@@ -1,101 +0,0 @@
-import { dV as ClassifiedEntry, dS as ClassifiedFieldSpec, dW as ClassifiedGroup } from './index-DzhNI2vE.js';
-
-/**
- * Configuration/write errors for classified fields. @module
- *
- * `ClassifiedConfigError` / `ClassifiedRevealError` moved to `kernel/errors.ts`
- * (stage 2) so `kernel/enclave/classify/*` can throw them without importing
- * with-*. Re-exported here under the same names so existing import paths
- * keep working.
- */
-
-declare class ClassifiedNeverStoredError extends Error {
-    readonly collection: string;
-    readonly field: string;
-    constructor(collection: string, field: string);
-}
-declare class ClassifiedValidationError extends Error {
-    readonly collection: string;
-    readonly field: string;
-    constructor(collection: string, field: string, detail: string);
-}
-
-/** Flatten a classifiedFields config into a per-field map + rider computed entries. @module */
-
-interface ResolvedClassified {
-    readonly byField: Record<string, ClassifiedFieldSpec>;
-    readonly riderComputed: Record<string, (record: Record<string, unknown>) => unknown>;
-}
-declare function resolveClassifiedFields(collection: string, config: Record<string, ClassifiedEntry>): ResolvedClassified;
-
-/** The preset catalog (stage 1). Presets are hub-owned; devs get declarative
- *  knobs, not read-side callbacks (design law D2/D3). @module */
-
-declare const classified: {
-    /** Composite card type. PAN sealed + last4/bin riders; CVC is storage:'never' (PCI-aware). */
-    creditCard(fields: {
-        pan: string;
-        expiry?: string;
-        cvc?: string;
-    }): ClassifiedGroup;
-    birthDate(): ClassifiedFieldSpec;
-    email(): ClassifiedFieldSpec;
-    phone(): ClassifiedFieldSpec;
-    /** Digest-only password: verify-without-reveal; never listed, never revealed.
-     *  Enumeration math is on the caller for low-entropy values — see the
-     *  per-preset docs; the hub ships no rate limiter in this slice (spec §5).
-     *
-     *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables
-     *  `findByDigest`). Cost band you are accepting:
-     *
-     *  equal values produce equal store-visible tags: anyone with store access
-     *  learns which records share this secret and how many share each value —
-     *  never the value itself. A collection-DEK holder can additionally test
-     *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),
-     *  which is GPU/ASIC-friendly — an offline attacker runs on the order of
-     *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret
-     *  answers) offline recovery of the equality partition is seconds-to-hours, not
-     *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the
-     *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the
-     *  hardest primitive available; the iteration count raises the price but does
-     *  not make a low-entropy field safe. The real control for low-entropy fields
-     *  is the DOOR — do not enable `equatable` for them unless the partition being
-     *  learnable is acceptable — not the iteration count. Pre-forget backups retain
-     *  tags. */
-    password(opts?: {
-        minLength?: number;
-        rotateDays?: number;
-        notLastN?: number;
-        equatable?: true;
-    }): ClassifiedFieldSpec;
-    /** Digest-only secret answer: normalized (casefold/trim/collapse), groupable
-     *  into k-of-n matchGroup challenges. Low-entropy by nature — document the
-     *  enumeration math to your users; add app-side rate limiting.
-     *
-     *  @param opts.equatable — emit a store-visible `_bidx` equality tag (enables
-     *  `findByDigest`). Cost band you are accepting:
-     *
-     *  equal values produce equal store-visible tags: anyone with store access
-     *  learns which records share this secret and how many share each value —
-     *  never the value itself. A collection-DEK holder can additionally test
-     *  candidate values offline: the tag's inner digest is PBKDF2-SHA256 (600K),
-     *  which is GPU/ASIC-friendly — an offline attacker runs on the order of
-     *  10⁴–10⁸ guesses/second, so for low-entropy secrets (PINs, casefolded secret
-     *  answers) offline recovery of the equality partition is seconds-to-hours, not
-     *  years. `crypto.subtle` exposes no memory-hard KDF (no scrypt/argon2) and the
-     *  family's no-crypto-deps law forbids adding one, so PBKDF2-SHA256 is the
-     *  hardest primitive available; the iteration count raises the price but does
-     *  not make a low-entropy field safe. The real control for low-entropy fields
-     *  is the DOOR — do not enable `equatable` for them unless the partition being
-     *  learnable is acceptable — not the iteration count. Pre-forget backups retain
-     *  tags. */
-    secretAnswer(opts?: {
-        equatable?: true;
-    }): ClassifiedFieldSpec;
-};
-
-/** Pure write-time validators. Exported so userland can validate storage:'never'
- *  fields (e.g. CVC) at capture, before dropping them. @module */
-declare function luhnCheck(pan: string): boolean;
-
-export { ClassifiedNeverStoredError as C, type ResolvedClassified as R, ClassifiedValidationError as a, classified as c, luhnCheck as l, resolveClassifiedFields as r };

package/dist/vault-diff-Dt9NkLzw.d.ts

@@ -1,147 +0,0 @@
-import { V as Vault, c7 as DiffEntry } from './index-DzhNI2vE.js';
-
-/**
- * Vault-level diff orchestrator.
- *
- * Compares a live `Vault`'s plaintext state against a candidate state
- * (another vault, a plain `{ collection: records[] }` map, or a vault
- * dump JSON) and returns a structured `VaultDiff` plan listing the
- * records that would be added, modified, or deleted to bring the live
- * vault into the candidate's shape.
- *
- * Builds on two existing record-level helpers:
- *
- *   1. `diff(a, b)` from `./history/diff.ts` — emits dot-pathed
- *      `DiffEntry[]` with `type: 'added' | 'removed' | 'changed'` for
- *      each changed field of two records. Used here for the
- *      `fieldDiffs` of every `modified` entry, and (with empty result)
- *      as the default deep-equal check.
- *
- *   2. `Vault.exportStream()` from `./vault.ts` — the canonical
- *      decrypt-and-stream-records iterator. Used to walk both sides
- *      when the candidate is itself a `Vault`. ACL-scoped: collections
- *      the caller can't read silently drop out, the same way every
- *      other plaintext-emitting export pipeline filters them.
- *
- * The new orchestration is the **vault-level** enumeration: bucket
- * each record id into added (only in candidate), deleted (only in
- * vault), or modified (in both with field changes); leave the
- * field-level granularity to the existing `diff()`.
- *
- * Use cases:
- *
- *   - Import preview (`@noy-db/as-*` `fromString` returns a plan
- *     whose body is a `VaultDiff`).
- *   - Backup verification ("does this `.noydb` bundle from yesterday
- *     match the current vault?").
- *   - Two-vault reconciliation ("what's different between Office A
- *     and Office B before we sync?").
- *   - Test assertions (golden-file testing with one-liner
- *     `expect(plan.summary).toEqual(...)`).
- *
- * @module
- */
-
-/** Per-record entry shape — added and deleted records carry only the record value. */
-interface VaultDiffEntry<T = unknown> {
-    readonly collection: string;
-    readonly id: string;
-    readonly record: T;
-    /**
-     * Unencrypted envelope metadata for the RECEIVER-side record.
-     * Populated only when `diffVault` is called with `{includeMetadata: true}`.
-     * Default: `undefined` (zero extra reads, no behavior change).
-     *
-     * Populated for `modified` (the CURRENT receiver state, before the candidate
-     * is applied) and `deleted` (the receiver envelope of the record being
-     * removed). `added` entries have no receiver envelope at diff time, so their
-     * `metadata` is always absent.
-     */
-    readonly metadata?: {
-        readonly version: number;
-        readonly timestamp: string;
-        readonly by?: string;
-        readonly source?: string;
-        readonly sourceTs?: string;
-    };
-}
-/** Modified records carry both halves of the diff plus the field-level breakdown. */
-interface VaultDiffModifiedEntry<T = unknown> extends VaultDiffEntry<T> {
-    /** The record as it stands in the live vault. */
-    readonly before: T;
-    /** Top-level keys whose values differ between `before` and `record`. */
-    readonly fieldsChanged: readonly string[];
-    /**
-     * Field-level diff entries from `diff(before, record)`. Reuses the
-     * existing per-record diff helper so consumers can render git-style
-     * `path: from → to` rows without re-walking the records.
-     */
-    readonly fieldDiffs: readonly DiffEntry[];
-}
-interface VaultDiff<T = unknown> {
-    readonly added: readonly VaultDiffEntry<T>[];
-    readonly modified: readonly VaultDiffModifiedEntry<T>[];
-    readonly deleted: readonly VaultDiffEntry<T>[];
-    /** Only populated when `options.includeUnchanged: true`. */
-    readonly unchanged: readonly VaultDiffEntry<T>[] | undefined;
-    readonly summary: {
-        readonly add: number;
-        readonly modify: number;
-        readonly delete: number;
-        readonly total: number;
-    };
-    /**
-     * Format the diff as a human-readable string.
-     *
-     *   - `'count'`   — one line, just the numbers (`12 added · 3 modified · 0 deleted`)
-     *   - `'one-line'` — count plus a single overview line
-     *   - `'full'`    — count + one row per added/modified/deleted record (default)
-     */
-    format(opts?: {
-        detail?: 'count' | 'one-line' | 'full';
-    }): string;
-}
-interface DiffOptions {
-    /** Restrict the diff to a subset of collections. */
-    readonly collections?: readonly string[];
-    /** Field on each record that carries its id. Defaults to `'id'`. */
-    readonly idKey?: string;
-    /** Override the default deep-equal check for "modified vs unchanged". */
-    readonly compareFn?: (a: unknown, b: unknown) => boolean;
-    /** If true, include unchanged records in the diff (off by default to save memory). */
-    readonly includeUnchanged?: boolean;
-    /**
-     * When `true`, each entry in `added`, `modified`, and `deleted` will carry a
-     * `metadata` field with the RECEIVER-side envelope metadata
-     * (`version`, `timestamp`, `by?`, `source?`, `sourceTs?`).
-     *
-     * Off by default — no extra adapter reads, no behavior change for existing callers.
-     */
-    readonly includeMetadata?: boolean;
-}
-/**
- * Candidate state to diff the vault against:
- *
- *   - A `Vault` instance — both sides are walked via `exportStream()`.
- *   - A `Record<collection, records[]>` map — same shape `as-json.toObject()`
- *     produces. Useful for diffing parsed file content against the live vault.
- *   - A `VaultDump` (output of `vault.dump()`) — a JSON string carrying the
- *     full vault state. Parsed and reduced to the map shape above.
- */
-type DiffCandidate<T = unknown> = Vault | Record<string, readonly T[]> | string;
-/**
- * Compute the diff between a live vault and a candidate state.
- *
- * Ungated shared import/merge infrastructure: the `as-*` exporters call this
- * internally from their `fromString`/import merge logic, so it is always
- * available (not behind `withCargo()`). Only `extractPartition` is a gated
- * cargo capability.
- *
- * Returns a fully buffered `VaultDiff` — no streaming. Memory cost is
- * O(n + m) in the row count of vault + candidate. For documented
- * 1K-50K-record vaults this is fine; a streaming variant lands as a
- * follow-up if a > 100K-record consumer arrives.
- */
-declare function diffVault<T = unknown>(vault: Vault, candidate: DiffCandidate<T>, options?: DiffOptions): Promise<VaultDiff<T>>;
-
-export { type DiffCandidate as D, type VaultDiff as V, type DiffOptions as a, type VaultDiffEntry as b, type VaultDiffModifiedEntry as c, diffVault as d };