@noy-db/hub 0.4.0-pre.0 → 0.4.0-pre.10

package/dist/index.js

@@ -9,10 +9,6 @@ import {
   RefScopeError,
   Vault,
   createNoydb,
-  describeAllUsersAuth,
-  describeAuthConfig,
-  describeUserAuth,
-  diagramAuthConfig,
   isRefArray,
   isViaFieldSpec,
   memoryStore,
@@ -20,190 +16,253 @@ import {
   refArray,
   via,
   withArchive
-} from "./chunk-PK6JIDQ4.js";
-import {
-  DELEGATIONS_COLLECTION,
-  issueDelegation,
-  loadActiveDelegations,
-  revokeDelegation
-} from "./chunk-OCVM6KDH.js";
-import "./chunk-VYYM3MEN.js";
-import {
-  COVER_FIELDS,
-  DEFAULT_COVER_SCHEMA,
-  DEFAULT_PUBLIC_ENVELOPE_SCHEMA,
-  PUBLIC_ENVELOPE_FIELDS,
-  resolveSchema
-} from "./chunk-FH52K7EG.js";
-import {
-  NO_SEQUENCE,
-  SequenceStore,
-  compileSequenceFormat,
-  resolveSequenceKey,
-  withSequence
-} from "./chunk-DSBQODMZ.js";
+} from "./chunk-NFIBXF4V.js";
+import "./chunk-NJ4DYYO5.js";
 import {
-  UserApi
-} from "./chunk-EO43ANYJ.js";
-import {
-  DEFAULT_FRESHNESS_MS,
-  PERSONAL_POLICY,
-  STRICT_POLICY,
-  checkGate,
-  describeGate,
-  mergePolicy
-} from "./chunk-T3GY65MA.js";
-import {
-  META_COLLECTION,
-  POLICY_RECORD_ID,
-  loadVaultPolicy,
-  saveVaultPolicy
-} from "./chunk-XDIAFPUM.js";
+  persistSchemaIfNeeded
+} from "./chunk-NZ24MX4J.js";
 import {
   LinkEndpointError
-} from "./chunk-R3BLCFD2.js";
+} from "./chunk-MBKVNOJS.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName
-} from "./chunk-RTEK4C4I.js";
-import "./chunk-2PCAVW2I.js";
-import {
-  persistSchemaIfNeeded
-} from "./chunk-GDG5VVYG.js";
-import "./chunk-XJMBYYQK.js";
-import {
-  NO_SEARCH,
-  tokenize,
-  withSearch
-} from "./chunk-IK43HLDQ.js";
-import {
-  derivePersistedSchema,
-  isZodSchema
-} from "./chunk-BOKIKJJB.js";
+} from "./chunk-4JQK3L4V.js";
+import "./chunk-SHEEBRZ4.js";
 import {
   ComputedFieldError,
   evalComputedFields
-} from "./chunk-6HPG2YNX.js";
-import "./chunk-GYGLAVCX.js";
+} from "./chunk-5DRROK5W.js";
 import {
   WithdrawalRequestError,
   approveWithdrawal,
   listWithdrawalRequests,
   rejectWithdrawal,
   requestWithdrawal
-} from "./chunk-H2KSZMIX.js";
+} from "./chunk-HMU5P6RL.js";
+import "./chunk-LNZKOUJR.js";
+import "./chunk-7YVBQJ7K.js";
+import {
+  COVER_FIELDS,
+  DEFAULT_COVER_SCHEMA,
+  resolveSchema
+} from "./chunk-CUZLNGD5.js";
+import {
+  additiveOnly,
+  blindUpdate,
+  coordinatedCutover,
+  lockSchema
+} from "./chunk-E23UGFVC.js";
+import "./chunk-6LJY7X5A.js";
+import "./chunk-DSDXAKIP.js";
 import {
+  DEFAULT_FRESHNESS_MS,
+  PERSONAL_POLICY,
+  STRICT_POLICY,
+  checkGate,
+  describeGate,
+  mergePolicy
+} from "./chunk-G6WWZNJP.js";
+import "./chunk-GJW4HX2O.js";
+import {
+  UserApi
+} from "./chunk-DABACXEF.js";
+import "./chunk-GYGLAVCX.js";
+import "./chunk-Y2NJBNX3.js";
+import "./chunk-BLBAQRBM.js";
+import {
+  decryptExtractedPartition,
+  diffVault,
   withCargo
-} from "./chunk-TIGPQDYP.js";
+} from "./chunk-YZJSJOUI.js";
 import {
-  CustodyApi,
-  NO_CARGO,
-  NO_CUSTODY,
-  withCustody
-} from "./chunk-SV6EAJEP.js";
+  NO_CARGO
+} from "./chunk-TG634KCO.js";
+import "./chunk-PEATRIYJ.js";
 import {
-  DEED_RECORD_ID,
   createDeedOwner,
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "./chunk-5PFOMHTB.js";
+} from "./chunk-H2GPHUZD.js";
 import {
-  fuseRetrieval
-} from "./chunk-AURFOK3D.js";
-import {
-  diffVault
-} from "./chunk-LB7FD65R.js";
+  MemoryRecipientSealer,
+  MemorySealingKeyProvider,
+  aesGcmOpen,
+  parseRsaOaepTlv,
+  sealRsaOaepTlv
+} from "./chunk-FQZ6XTQ7.js";
 import {
   withdrawAccessibleData
-} from "./chunk-JFCV5QIK.js";
+} from "./chunk-I5GEJX3R.js";
 import {
   exportAccessibleData
-} from "./chunk-WKGF2TJR.js";
-import "./chunk-EWPOHMN2.js";
-import "./chunk-ISMV2QVG.js";
+} from "./chunk-X45JYIAY.js";
+import {
+  routeStore,
+  withCache,
+  withCircuitBreaker,
+  withHealthCheck,
+  withLogging,
+  withMetrics,
+  withRetry,
+  wrapStore
+} from "./chunk-EIPVYUEP.js";
+import {
+  applyListProjection
+} from "./chunk-VG2ZSFYD.js";
+import "./chunk-VYYM3MEN.js";
+import {
+  derivePersistedSchema,
+  isZodSchema
+} from "./chunk-6ZNSB3H6.js";
+import "./chunk-Y2NBBT6K.js";
+import {
+  SCHEMAS_COLLECTION,
+  loadPersistedSchema,
+  savePersistedSchema
+} from "./chunk-DMH3VZU5.js";
+import {
+  MoneyCurrencyError,
+  MoneyPrecisionError,
+  MoneyUnsupportedError,
+  allocate,
+  asMoney,
+  isMoneyDescriptor,
+  isMoneyString,
+  money,
+  moneyNumber,
+  mulRate,
+  scaleForCurrency
+} from "./chunk-SGDPRCC4.js";
+import {
+  withDerivation,
+  withRollup
+} from "./chunk-NYEFP7DY.js";
+import "./chunk-AT2JJEKJ.js";
+import "./chunk-4ZKNC6A6.js";
+import "./chunk-MHMLXJ3I.js";
+import {
+  withMaterializedView
+} from "./chunk-MXUT7FTE.js";
+import "./chunk-N4BBNYIB.js";
+import {
+  buildLookupSnapshot
+} from "./chunk-IPUG56GJ.js";
+import "./chunk-3HUYRN24.js";
+import "./chunk-IYZISPGD.js";
 import {
   withOverlayedView
-} from "./chunk-WNGGJWF7.js";
-import "./chunk-5WZXVULX.js";
-import "./chunk-GWKAVKHI.js";
+} from "./chunk-MSMJJB4J.js";
+import "./chunk-ZTLOXFPB.js";
+import "./chunk-IG6KUWBX.js";
+import {
+  PresenceHandle,
+  SyncEngine,
+  SyncTransaction
+} from "./chunk-JDOMW53O.js";
+import {
+  BUNDLE_STORE_POLICY,
+  INDEXED_STORE_POLICY,
+  POD_STORE_POLICY,
+  SyncScheduler
+} from "./chunk-55LKVALY.js";
 import {
   isDiscriminant
 } from "./chunk-PY4KJPYU.js";
-import "./chunk-S6Q37VGE.js";
+import "./chunk-5GQEU4DN.js";
 import {
   classified,
   luhnCheck
-} from "./chunk-KS6SAVCZ.js";
+} from "./chunk-GU3IP74F.js";
 import {
   ClassifiedNeverStoredError,
   ClassifiedValidationError,
   isClassifiedFieldSpec,
   isClassifiedGroup,
   resolveClassifiedFields
-} from "./chunk-Z4PD65VQ.js";
-import "./chunk-CZTLE22N.js";
-import "./chunk-M75ZZHSR.js";
-import {
-  CONSENT_AUDIT_COLLECTION
-} from "./chunk-RNG4VRP4.js";
-import "./chunk-YZQOGE2L.js";
+} from "./chunk-EE7UHLKH.js";
+import "./chunk-QDIH2744.js";
+import "./chunk-UDHBXYGG.js";
+import "./chunk-GHVIKOHT.js";
 import {
   PERIODS_COLLECTION
-} from "./chunk-XTHCN77N.js";
-import "./chunk-GHVIKOHT.js";
+} from "./chunk-NM5UYF6Q.js";
 import {
   immutableGuard,
   transitionGuard,
   withGuard
-} from "./chunk-6NQMXTYC.js";
-import "./chunk-YMUGBZN2.js";
+} from "./chunk-RO5NM6UI.js";
+import "./chunk-FQ5CHJR7.js";
 import "./chunk-JK733I5V.js";
-import "./chunk-ONTBCHCP.js";
+import "./chunk-W66AM5IB.js";
 import {
   CollectionFrame,
   VaultFrame
-} from "./chunk-VAIS3SOM.js";
+} from "./chunk-55LX6FSX.js";
+import "./chunk-SMY5X46Z.js";
+import "./chunk-DZFQVICS.js";
 import {
   TxCollection,
   TxContext,
   TxVault,
   runTransaction
-} from "./chunk-JRBNCUNT.js";
+} from "./chunk-NGSJZFGL.js";
+import "./chunk-5D2ALSM5.js";
 import {
-  withDerivation,
-  withRollup
-} from "./chunk-JBBSYJHP.js";
-import "./chunk-DDHM2TLX.js";
-import "./chunk-3ELCWU56.js";
-import "./chunk-VCBHAE4R.js";
+  NO_SEARCH,
+  tokenize,
+  withSearch
+} from "./chunk-MCHBCNCE.js";
 import {
-  withMaterializedView
-} from "./chunk-T36RFODW.js";
-import "./chunk-WG4QBZDN.js";
+  fuseRetrieval
+} from "./chunk-AURFOK3D.js";
 import {
-  buildLookupSnapshot
-} from "./chunk-LVGTA624.js";
-import "./chunk-S3BFKGET.js";
-import "./chunk-WHXXI3W5.js";
+  NO_SEQUENCE,
+  SequenceStore,
+  compileSequenceFormat,
+  resolveSequenceKey,
+  withSequence
+} from "./chunk-L2DGWBCT.js";
+import {
+  CustodyApi,
+  NO_CUSTODY,
+  withCustody
+} from "./chunk-YWWQM7KP.js";
 import {
   DEFAULT_CROSS_JOIN_MAX_ROWS,
   Query,
   ScanBuilder,
   buildLiveQuery,
   executePlan
-} from "./chunk-A5BDDEXK.js";
+} from "./chunk-WBKZUO5V.js";
 import {
   DEFAULT_JOIN_MAX_ROWS,
-  applyJoins,
-  resetJoinWarnings
-} from "./chunk-RA5VTXXG.js";
+  applyJoins
+} from "./chunk-V6UQZA2H.js";
 import {
   importExternalObjects,
   memoryObjectProjection
 } from "./chunk-4Q6HSHHL.js";
-import "./chunk-U6JMEH2P.js";
-import "./chunk-VEALDPHW.js";
+import "./chunk-CXQW2NWO.js";
+import {
+  BLOB_CHUNKS_COLLECTION,
+  BLOB_COLLECTION,
+  BLOB_INDEX_COLLECTION,
+  BLOB_INTENT_COLLECTION,
+  BLOB_SLOTS_PREFIX,
+  BLOB_VERSIONS_PREFIX,
+  BlobSet,
+  DEFAULT_CHUNK_SIZE,
+  createIntent,
+  deleteIntent,
+  detectMagic,
+  detectMimeType,
+  getIntent,
+  isPreCompressed,
+  sweepBlobIntents
+} from "./chunk-GWWOGNBK.js";
+import "./chunk-L3YYLT4E.js";
 import {
   CollectionIndexes
 } from "./chunk-KPZS5QAQ.js";
@@ -215,25 +274,10 @@ import {
   estimateRecordBytes,
   parseBytes
 } from "./chunk-NO272T7Q.js";
-import {
-  Aggregation,
-  GROUPBY_MAX_CARDINALITY,
-  GROUPBY_WARN_CARDINALITY,
-  GroupedAggregation,
-  GroupedQuery,
-  GroupedQueryN,
-  avg,
-  count,
-  groupAndReduce,
-  max,
-  min,
-  moneyMax,
-  moneyMin,
-  moneySum,
-  reduceRecords,
-  reducerBuilder,
-  sum
-} from "./chunk-TAGR72IR.js";
+import "./chunk-KRCBZYTZ.js";
+import "./chunk-XZHEOSQ2.js";
+import "./chunk-YMUFFJCO.js";
+import "./chunk-CADUYBQD.js";
 import {
   evaluateClause,
   evaluateFieldClause,
@@ -243,48 +287,13 @@ import {
   mergeCrdtStates,
   resolveCrdtSnapshot
 } from "./chunk-4GPE63GU.js";
-import {
-  decryptExtractedPartition
-} from "./chunk-UDSR4X4L.js";
-import {
-  SCHEMAS_COLLECTION,
-  loadPersistedSchema,
-  savePersistedSchema
-} from "./chunk-CJ5KKU6X.js";
-import {
-  MemoryRecipientSealer,
-  MemorySealingKeyProvider,
-  SEALED_PASSPHRASE_RECORD_ID,
-  aesGcmOpen,
-  loadSealedPassphrase,
-  parseRsaOaepTlv,
-  parseSealedEnvelope,
-  saveSealedPassphrase,
-  sealRsaOaepTlv
-} from "./chunk-RFI7GGFO.js";
-import {
-  BLOB_CHUNKS_COLLECTION,
-  BLOB_COLLECTION,
-  BLOB_INDEX_COLLECTION,
-  BLOB_INTENT_COLLECTION,
-  BLOB_SLOTS_PREFIX,
-  BLOB_VERSIONS_PREFIX,
-  BlobSet,
-  DEFAULT_CHUNK_SIZE,
-  createIntent,
-  deleteIntent,
-  detectMagic,
-  detectMimeType,
-  getIntent,
-  isPreCompressed,
-  sweepBlobIntents
-} from "./chunk-UHNGNKLV.js";
+import "./chunk-PVEWA2DU.js";
 import {
   createBundleStore,
   createPodStore,
   wrapBundleStore,
   wrapPodStore
-} from "./chunk-YTGDPCPW.js";
+} from "./chunk-Y6B6HVKC.js";
 import {
   NOYDB_BUNDLE_FORMAT_VERSION,
   NOYDB_BUNDLE_MAGIC,
@@ -292,38 +301,34 @@ import {
   hasNoydbBundleMagic,
   readNoydbBundle,
   readNoydbBundleHeader,
-  readNoydbBundlePublicEnvelope,
   readPod,
   readPodCover,
   readPodHeader,
-  resetBrotliSupportCache,
   writeNoydbBundle,
   writePod
-} from "./chunk-FXZDAV62.js";
+} from "./chunk-LNPUSMZL.js";
 import {
   COVER_RECORD_ID,
-  PUBLIC_ENVELOPE_RECORD_ID,
   isCover,
-  isPublicEnvelope,
   loadCover,
-  loadPublicEnvelope,
   readCover,
-  readPublicEnvelope,
   saveCover,
-  savePublicEnvelope,
-  validateCoverInput,
-  validatePublicEnvelopeInput
-} from "./chunk-XUW3PXHU.js";
-import "./chunk-RJ6K6K5M.js";
+  validateCoverInput
+} from "./chunk-TUXQSFHZ.js";
+import {
+  CONSENT_AUDIT_COLLECTION
+} from "./chunk-EKRSCRNM.js";
+import "./chunk-PEOZ34EM.js";
+import "./chunk-X3F5YJG2.js";
 import {
   dictKey,
   staticDict
-} from "./chunk-QDPZWTN2.js";
+} from "./chunk-W3G5REIU.js";
 import {
   DICT_COLLECTION_PREFIX,
   LookupHandle,
   dictCollectionName
-} from "./chunk-MT62YSPZ.js";
+} from "./chunk-FRMPM7WG.js";
 import {
   applyI18nLocale,
   enforceScript,
@@ -338,68 +343,53 @@ import {
   resolvePolicy,
   setAtPathInPlace,
   validateI18nTextValue
-} from "./chunk-GULTLPFB.js";
+} from "./chunk-UADPR6F4.js";
 import {
   installViaBinder
-} from "./chunk-JVBO4SZL.js";
+} from "./chunk-6UBZ6I5Z.js";
 import {
-  credentialStatus,
-  deleteCredential,
-  getCredential,
-  listCredentials,
-  putCredential,
   withTeam
-} from "./chunk-YCH5GBN6.js";
+} from "./chunk-5JOFWL4G.js";
 import {
-  MAGIC_LINK_CONTENT_INFO_PREFIX,
   MAGIC_LINK_GRANTS_COLLECTION,
-  MAGIC_LINK_KEK_INFO_PREFIX,
   NO_TEAM,
+  burnPaperRecoveryEntry,
   deriveMagicLinkContentKey,
+  describeAllUsersAuth,
+  describeAuthConfig,
+  describeUserAuth,
+  diagramAuthConfig,
   enrollAuthenticator,
   findAuthenticator,
   isMagicLinkGrantExpired,
   listMagicLinkGrants,
+  loadPaperRecoveryEntries,
   magicLinkGrantRecordId,
+  mintPaperRecoveryEntry,
+  mintWrappedDeksBlob,
   readMagicLinkGrantRecord,
-  recoverPassphrase,
   recoverUser,
   removeAuthenticator,
   revokeMagicLinkGrant,
-  rotatePassphrase,
-  unwrapMagicLinkGrant,
-  writeMagicLinkGrant
-} from "./chunk-VKCADNMR.js";
-import {
-  burnPaperRecoveryEntry,
-  hasRecoveryEnrolled,
-  loadPaperRecoveryEntries,
-  loadShamirRecoveryEntries,
-  mintPaperRecoveryEntry,
-  mintShamirRecoveryEntry,
-  mintWrappedDeksBlob,
+  rotateSecret,
   savePaperRecoveryEntries,
-  saveShamirRecoveryEntries,
   unwrapDeksFromBlob,
   unwrapDeksFromPaperEntry,
-  unwrapDeksFromShamirEntry
-} from "./chunk-ANATMTOA.js";
-import {
-  PresenceHandle,
-  SyncEngine,
-  SyncTransaction
-} from "./chunk-HQBM64EE.js";
+  unwrapMagicLinkGrant,
+  writeMagicLinkGrant
+} from "./chunk-NFNJLRY7.js";
 import {
-  BUNDLE_STORE_POLICY,
-  INDEXED_STORE_POLICY,
-  POD_STORE_POLICY,
-  SyncScheduler
-} from "./chunk-VQNJ7UZL.js";
+  META_COLLECTION,
+  POLICY_RECORD_ID,
+  loadVaultPolicy,
+  saveVaultPolicy
+} from "./chunk-WLXMTYGO.js";
 import {
   SYNC_CREDENTIALS_COLLECTION,
-  WeakPassphraseError,
-  assertStrongPassphrase,
+  WeakSecretError,
+  assertStrongSecret,
   buildRecipientKeyringFile,
+  ensureCollectionDEK,
   estimateEntropy,
   evaluateExportCapability,
   evaluateImportCapability,
@@ -407,8 +397,8 @@ import {
   hasImportCapability,
   listUsers,
   listUsersWithEnvelopes,
-  validatePassphrase
-} from "./chunk-554KLAAN.js";
+  validateSecret
+} from "./chunk-BLCWSJLN.js";
 import {
   DIRECTORY_RECORD_ID,
   VISIBILITY_RECORD_PREFIX,
@@ -422,13 +412,9 @@ import {
   readUserVisibility,
   saveUserEnvelope,
   visibilityRecordId
-} from "./chunk-NCCBLYEB.js";
-import {
-  assertTierAccess,
-  dekKey,
-  effectiveClearance
-} from "./chunk-UC2ETWF3.js";
-import "./chunk-SMIRGMS7.js";
+} from "./chunk-JJZGIE4U.js";
+import "./chunk-PTHKZWEH.js";
+import "./chunk-IXNCZTWA.js";
 import {
   PolicyEnforcer,
   activeSessionCount,
@@ -443,7 +429,8 @@ import {
   revokeAllSessions,
   revokeSession,
   validateSessionPolicy
-} from "./chunk-6XE5TMPR.js";
+} from "./chunk-X4MVWPHV.js";
+import "./chunk-VKQCVU2Z.js";
 import {
   generateULID,
   isULID
@@ -451,7 +438,8 @@ import {
 import {
   CollectionInstant,
   VaultInstant
-} from "./chunk-IAO54J4R.js";
+} from "./chunk-QX76XVQH.js";
+import "./chunk-AFHQATY4.js";
 import {
   diff,
   formatDiff
@@ -460,12 +448,12 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-VRBTNCM4.js";
+} from "./chunk-ABS7FMMD.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
-import "./chunk-DRWBEDYO.js";
+import "./chunk-JYJFGD2H.js";
 import {
   canonicalJson,
   envelopePayloadHash,
@@ -473,17 +461,18 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-WQIYTNJV.js";
-import "./chunk-IFJTPAQQ.js";
-import "./chunk-RDXW3OBQ.js";
+} from "./chunk-IXTSNGYY.js";
+import "./chunk-OLEPKFTW.js";
+import "./chunk-QD46HPZG.js";
 import {
+  openEnvelopeJson,
   validateSchemaInput,
   validateSchemaOutput
-} from "./chunk-W4TCUGQR.js";
-import "./chunk-A4FXFAKF.js";
-import "./chunk-IY23KFNZ.js";
-import "./chunk-N6WF5PKC.js";
-import "./chunk-6HY2X62D.js";
+} from "./chunk-G2JUIDFA.js";
+import "./chunk-W3L64Y3J.js";
+import "./chunk-35NMVJ7I.js";
+import "./chunk-NFZGZ4AK.js";
+import "./chunk-QJNCB5SK.js";
 import "./chunk-LP7BEXCT.js";
 import {
   base64ToBuffer,
@@ -491,9 +480,10 @@ import {
   decryptBytes,
   decryptDeterministic,
   derivePresenceKey,
+  encrypt,
   encryptBytes,
   encryptDeterministic
-} from "./chunk-HOONYZY2.js";
+} from "./chunk-AKKRXT23.js";
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION,
@@ -501,7 +491,7 @@ import {
   NOYDB_SYNC_VERSION,
   SealedHandle,
   createStore
-} from "./chunk-VCTXU4AT.js";
+} from "./chunk-QBAC3GXA.js";
 import {
   AlreadyElevatedError,
   AmendmentForbiddenError,
@@ -510,6 +500,7 @@ import {
   BackupCorruptedError,
   BackupLedgerError,
   BlobIntentPendingError,
+  BlobOfflineError,
   BundleIntegrityError,
   BundleSealMismatchError,
   BundleVersionConflictError,
@@ -525,8 +516,6 @@ import {
   CustodyNotEnabledError,
   DanglingReferenceError,
   DataResidencyError,
-  DebugPlaintextError,
-  DebugReservedFieldError,
   DecryptionError,
   DelegationTargetMissingError,
   DerivationCapExceededError,
@@ -632,1820 +621,53 @@ import {
   UserEnvelopeOversizedError,
   ValidationError,
   VaultTemplateNotFoundError
-} from "./chunk-W2OG6JOL.js";
+} from "./chunk-QZWTRENR.js";
 import "./chunk-PZ5AY32C.js";
 
-// src/kernel/debug.ts
-function readPlaintextRecord(envelope) {
-  if (envelope._iv !== "") {
-    throw new Error(
-      "readPlaintextRecord: envelope is encrypted (non-empty _iv) \u2014 decrypt via the vault, not this helper"
-    );
-  }
-  if (envelope._debug !== void 0) {
-    const record = {};
-    for (const [key, value] of Object.entries(envelope)) {
-      if (!key.startsWith("_")) record[key] = value;
-    }
-    return record;
-  }
-  if (!envelope._data) return null;
-  return JSON.parse(envelope._data);
-}
-
-// src/with-shape/introspection/projection.ts
-function applyListProjection(desc, record, opts) {
-  const out = { ...record };
-  for (const f of desc.fields) {
-    if (f.classified !== void 0) {
-      const list = f.classified.list;
-      if (list === "omit") {
-        delete out[f.key];
-        continue;
-      }
-      if ("mask" in list) {
-        out[f.key] = list.mask.replace(/\$\{(\w+)\}/g, (_m, rider) => {
-          const v = record[`${f.key}_${rider}`];
-          return v === void 0 || v === null ? "\u2022" : `${v}`;
-        });
-        continue;
-      }
-      out[f.key] = record[`${f.key}_${list.rider}`];
-      continue;
-    }
-    if (opts?.sensitivity !== void 0 && (f.sensitivity === "pii" || f.sensitivity === "secret")) {
-      if (opts.sensitivity === "omit") delete out[f.key];
-      else out[f.key] = "\u2022\u2022\u2022";
-    }
-  }
-  return out;
+// src/with-commit/numbering/descriptor.ts
+function withDeferredNumbering(opts) {
+  return {
+    series: opts.series,
+    collection: opts.collection,
+    field: opts.field,
+    settleWindowMs: opts.settleWindowMs ?? 0
+  };
 }
 
-// src/with-shape/schema-update/strategies.ts
-function blindUpdate() {
-  return { name: "blindUpdate", onSchemaDelta: () => ({ action: "allow" }) };
-}
-function additiveOnly() {
+// src/via/computed/binding.ts
+var VIRTUAL_POSTURE = { encryptedAtRest: "envelope", queryable: "none", exportable: true, forgettable: false };
+function computedBinding(cfg) {
+  const fields = cfg.virtualFields;
   return {
-    name: "additiveOnly",
-    onSchemaDelta(delta) {
-      if (delta.kind === "non-additive") {
-        return {
-          action: "reject",
-          error: new NonAdditiveSchemaChangeError(
-            `Non-additive schema change to "${delta.collection}" (added: [${delta.added.join(", ")}], removed: [${delta.removed.join(", ")}], changed: [${delta.changed.map((c) => c.field).join(", ")}]). Register a coordinatedCutover() strategy to migrate, or revert the change.`
-          )
-        };
+    brand: "computed",
+    posture: VIRTUAL_POSTURE,
+    covers: (field) => fields.has(field),
+    present: (record) => {
+      let r = record;
+      for (const [field, desc] of fields) {
+        if (r === record) r = { ...record };
+        r[field] = desc.fn(r);
       }
-      return { action: "allow" };
+      return r;
     }
   };
 }
-function lockSchema(opts) {
-  const fields = opts?.fields;
-  return {
-    name: "lockSchema",
-    onSchemaDelta(delta) {
-      if (delta.kind === "none") return { action: "allow" };
-      const touched = fields ? [...delta.added, ...delta.removed, ...delta.changed.map((c) => c.field)].filter((f) => fields.includes(f)) : ["<any>"];
-      if (touched.length === 0) return { action: "allow" };
-      return {
-        action: "reject",
-        error: new SchemaLockedError(
-          `Schema for "${delta.collection}" is locked` + (fields ? ` on fields [${fields.join(", ")}] (touched: [${touched.join(", ")}])` : "") + `; the change was refused.`
-        )
-      };
-    }
-  };
+function linkComputedVia() {
+  installViaBinder("computed", (cfg) => computedBinding(cfg));
 }
 
-// src/with-shape/schema-update/cutover.ts
-function coordinatedCutover(opts) {
+// src/via/computed/descriptor.ts
+function computed(fn, opts) {
+  linkComputedVia();
   return {
-    name: "coordinatedCutover",
-    onSchemaDelta(delta) {
-      if (delta.kind === "non-additive") {
-        return { action: "cutover", transform: opts.transform };
-      }
-      return { action: "allow" };
-    }
+    _viaBrand: "computed",
+    fn,
+    ...opts?.deps !== void 0 ? { deps: opts.deps } : {},
+    mode: opts?.mode ?? "materialized"
   };
-}
-
-// src/with-store/route-store.ts
-var BLOB_CHUNKS = "_blob_chunks";
-var BLOB_INDEX = "_blob_index";
-var BLOB_SLOTS = "_blob_slots_";
-var BLOB_VERSIONS = "_blob_versions_";
-function routeStore(opts) {
-  const primary = opts.default;
-  const blobsIsSimple = opts.blobs && "get" in opts.blobs;
-  const simpleBlobStore = blobsIsSimple ? opts.blobs : void 0;
-  const tieredBlobs = !blobsIsSimple ? opts.blobs : void 0;
-  const blobThreshold = tieredBlobs?.threshold ?? 400 * 1024;
-  const allStores = /* @__PURE__ */ new Set([primary]);
-  if (simpleBlobStore) allStores.add(simpleBlobStore);
-  if (tieredBlobs?.large) allStores.add(tieredBlobs.large);
-  if (tieredBlobs?.small) allStores.add(tieredBlobs.small);
-  if (opts.age?.cold) allStores.add(opts.age.cold);
-  if (opts.routes) for (const s of Object.values(opts.routes)) allStores.add(s);
-  if (opts.vaultRoutes) for (const s of Object.values(opts.vaultRoutes)) allStores.add(s);
-  if (opts.blobRoutes) for (const s of Object.values(opts.blobRoutes)) allStores.add(s);
-  if (opts.overflow) allStores.add(opts.overflow);
-  if (opts.blobLifecycle?.archiveStore) allStores.add(opts.blobLifecycle.archiveStore);
-  const overrides = /* @__PURE__ */ new Map();
-  const suspended = /* @__PURE__ */ new Set();
-  const writeQueues = /* @__PURE__ */ new Map();
-  const NULL_STORE = {
-    name: "suspended",
-    async get() {
-      return null;
-    },
-    async put() {
-    },
-    async delete() {
-    },
-    async list() {
-      return [];
-    },
-    async loadAll() {
-      return {};
-    },
-    async saveAll() {
-    }
-  };
-  function routeNameFor(vault, collection) {
-    if (opts.vaultRoutes) {
-      for (const prefix of Object.keys(opts.vaultRoutes)) {
-        if (vault.startsWith(prefix)) return prefix;
-      }
-    }
-    if (opts.routes && !collection.startsWith("_") && opts.routes[collection]) {
-      return collection;
-    }
-    if (isBlobChunks(collection) && (simpleBlobStore || tieredBlobs)) return "blobs";
-    if (opts.routeBlobMeta && isBlobMeta(collection) && (simpleBlobStore || tieredBlobs)) return "blobs";
-    if (opts.age && !collection.startsWith("_")) {
-    }
-    return "default";
-  }
-  const quotaExceeded = false;
-  function resolveOriginalStore(route) {
-    if (route === "blobs") return simpleBlobStore ?? tieredBlobs?.large ?? primary;
-    if (route === "cold") return opts.age?.cold ?? primary;
-    if (opts.routes?.[route]) return opts.routes[route];
-    if (opts.vaultRoutes?.[route]) return opts.vaultRoutes[route];
-    return primary;
-  }
-  function maybeQueueWrite(routeName, method, vault, collection, id, envelope, expectedVersion) {
-    if (!suspended.has(routeName)) return false;
-    const queue = writeQueues.get(routeName);
-    if (!queue) return false;
-    if (queue.writes.length >= queue.maxSize) {
-      queue.writes.shift();
-    }
-    queue.writes.push({
-      method,
-      vault,
-      collection,
-      id,
-      ...envelope !== void 0 ? { envelope } : {},
-      ...expectedVersion !== void 0 ? { expectedVersion } : {}
-    });
-    return true;
-  }
-  function isBlobChunks(collection) {
-    return collection === BLOB_CHUNKS;
-  }
-  function isBlobMeta(collection) {
-    return collection === BLOB_INDEX || collection.startsWith(BLOB_SLOTS) || collection.startsWith(BLOB_VERSIONS);
-  }
-  function isInternal(collection) {
-    return collection.startsWith("_");
-  }
-  function storeFor(vault, collection) {
-    const rName = routeNameFor(vault, collection);
-    if (suspended.has(rName)) return NULL_STORE;
-    if (overrides.has(rName)) return overrides.get(rName);
-    if (opts.vaultRoutes) {
-      for (const [prefix, store2] of Object.entries(opts.vaultRoutes)) {
-        if (vault.startsWith(prefix)) return store2;
-      }
-    }
-    if (opts.routes && !isInternal(collection) && opts.routes[collection]) {
-      return opts.routes[collection];
-    }
-    if (isBlobChunks(collection)) {
-      if (simpleBlobStore) return simpleBlobStore;
-      if (tieredBlobs) return tieredBlobs.large;
-    }
-    if (opts.routeBlobMeta && isBlobMeta(collection)) {
-      if (simpleBlobStore) return simpleBlobStore;
-      if (tieredBlobs) return tieredBlobs.large;
-    }
-    if (quotaExceeded && opts.overflow) return opts.overflow;
-    return primary;
-  }
-  function blobStoreForSize(dataSize) {
-    if (!tieredBlobs) return simpleBlobStore ?? primary;
-    if (dataSize <= blobThreshold) {
-      return tieredBlobs.small ?? primary;
-    }
-    return tieredBlobs.large;
-  }
-  function isCold(collection, envelope, before) {
-    if (!opts.age) return false;
-    if (isInternal(collection)) return false;
-    if (opts.age.collections && opts.age.collections.length > 0) {
-      if (!opts.age.collections.includes(collection)) return false;
-    }
-    const cutoffIso = before ?? (opts.age.coldAfterDays != null ? new Date(Date.now() - opts.age.coldAfterDays * 24 * 60 * 60 * 1e3).toISOString() : void 0);
-    if (cutoffIso === void 0) return false;
-    return envelope._ts < cutoffIso;
-  }
-  const store = {
-    name: buildName(),
-    ...opts.age?.cold ? { capabilities: { ...primary.capabilities, coldArchival: true } } : primary.capabilities ? { capabilities: { ...primary.capabilities, coldArchival: false } } : {},
-    async get(vault, collection, id) {
-      const s = storeFor(vault, collection);
-      const result = await s.get(vault, collection, id);
-      if (result === null && opts.age && !isInternal(collection)) {
-        if (!opts.age.collections?.length || opts.age.collections.includes(collection)) {
-          return opts.age.cold.get(vault, collection, id);
-        }
-      }
-      return result;
-    },
-    async put(vault, collection, id, envelope, expectedVersion) {
-      const rn = routeNameFor(vault, collection);
-      if (maybeQueueWrite(rn, "put", vault, collection, id, envelope, expectedVersion)) return;
-      if (isBlobChunks(collection) && tieredBlobs) {
-        const dataSize = envelope._data.length;
-        const s2 = blobStoreForSize(dataSize);
-        return s2.put(vault, collection, id, envelope, expectedVersion);
-      }
-      const s = storeFor(vault, collection);
-      if (opts.age && !isInternal(collection)) {
-        opts.age.cold.delete(vault, collection, id).catch(() => {
-        });
-      }
-      return s.put(vault, collection, id, envelope, expectedVersion);
-    },
-    async delete(vault, collection, id) {
-      const rn = routeNameFor(vault, collection);
-      if (maybeQueueWrite(rn, "delete", vault, collection, id)) return;
-      const s = storeFor(vault, collection);
-      await s.delete(vault, collection, id);
-      if (opts.age && !isInternal(collection)) {
-        await opts.age.cold.delete(vault, collection, id).catch(() => {
-        });
-      }
-    },
-    async list(vault, collection) {
-      const s = storeFor(vault, collection);
-      const ids = await s.list(vault, collection);
-      if (opts.age && !isInternal(collection)) {
-        if (!opts.age.collections?.length || opts.age.collections.includes(collection)) {
-          const coldIds = await opts.age.cold.list(vault, collection).catch(() => []);
-          if (coldIds.length > 0) {
-            const merged = new Set(ids);
-            for (const id of coldIds) merged.add(id);
-            return [...merged];
-          }
-        }
-      }
-      return ids;
-    },
-    async loadAll(vault) {
-      const stores = getStoresForVault(vault);
-      const snapshots = await Promise.all(
-        stores.map((s) => s.loadAll(vault).catch(() => ({})))
-      );
-      return mergeSnapshots(snapshots);
-    },
-    async saveAll(vault, data) {
-      const partitioned = /* @__PURE__ */ new Map();
-      for (const [collection, records] of Object.entries(data)) {
-        const s = storeFor(vault, collection);
-        if (!partitioned.has(s)) partitioned.set(s, {});
-        partitioned.get(s)[collection] = records;
-      }
-      await Promise.all(
-        [...partitioned.entries()].map(([s, snap]) => s.saveAll(vault, snap))
-      );
-    },
-    async compact(vault, compactOpts) {
-      if (!opts.age) return 0;
-      let migrated = 0;
-      const collections = opts.age.collections?.length ? opts.age.collections : Object.keys(await primary.loadAll(vault).catch(() => ({})));
-      for (const collection of collections) {
-        const ids = await primary.list(vault, collection).catch(() => []);
-        for (const id of ids) {
-          const envelope = await primary.get(vault, collection, id);
-          if (!envelope) continue;
-          if (isCold(collection, envelope, compactOpts?.before)) {
-            await opts.age.cold.put(vault, collection, id, envelope);
-            await primary.delete(vault, collection, id);
-            migrated++;
-          }
-        }
-      }
-      return migrated;
-    },
-    // ── Runtime override / suspend ──────────────────────
-    override(route, overrideStore, overrideOpts) {
-      if (overrideOpts?.hydrate) {
-        return (async () => {
-          overrides.set(route, overrideStore);
-        })();
-      }
-      overrides.set(route, overrideStore);
-    },
-    clearOverride(route) {
-      overrides.delete(route);
-    },
-    suspend(route, suspendOpts) {
-      suspended.add(route);
-      if (suspendOpts?.queue) {
-        writeQueues.set(route, {
-          writes: [],
-          maxSize: suspendOpts.maxQueueSize ?? 1e4
-        });
-      }
-    },
-    async resume(route) {
-      suspended.delete(route);
-      const queue = writeQueues.get(route);
-      if (!queue || queue.writes.length === 0) {
-        writeQueues.delete(route);
-        return 0;
-      }
-      let replayed = 0;
-      const target = overrides.get(route) ?? resolveOriginalStore(route);
-      for (const write of queue.writes) {
-        try {
-          if (write.method === "put" && write.envelope) {
-            await target.put(write.vault, write.collection, write.id, write.envelope, write.expectedVersion);
-          } else if (write.method === "delete") {
-            await target.delete(write.vault, write.collection, write.id);
-          }
-          replayed++;
-        } catch {
-        }
-      }
-      writeQueues.delete(route);
-      return replayed;
-    },
-    routeStatus() {
-      const ov = {};
-      for (const [k, v] of overrides) ov[k] = v.name ?? "unnamed";
-      const q = {};
-      for (const [k, v] of writeQueues) q[k] = v.writes.length;
-      return { overrides: ov, suspended: [...suspended], queued: q };
-    },
-    resolveBackend(vaultId) {
-      if (opts.vaultRoutes) {
-        for (const [prefix, s] of Object.entries(opts.vaultRoutes)) {
-          if (vaultId.startsWith(prefix)) return s;
-        }
-      }
-      return primary;
-    }
-  };
-  if (anyHas("listVaults")) {
-    store.listVaults = async () => {
-      const results = await Promise.all(
-        [...allStores].filter((s) => s.listVaults !== void 0).map((s) => s.listVaults().catch(() => []))
-      );
-      return [...new Set(results.flat())];
-    };
-  }
-  if (anyHas("ping")) {
-    store.ping = async () => {
-      const results = await Promise.all(
-        [...allStores].filter((s) => s.ping !== void 0).map((s) => s.ping().catch(() => false))
-      );
-      return results.some(Boolean);
-    };
-  }
-  return store;
-  function buildName() {
-    const names = [...allStores].map((s) => s.name ?? "?").join("+");
-    return `route(${names})`;
-  }
-  function anyHas(method) {
-    return [...allStores].some((s) => s[method]);
-  }
-  function getStoresForVault(vault) {
-    const stores = /* @__PURE__ */ new Set();
-    if (opts.vaultRoutes) {
-      for (const [prefix, s] of Object.entries(opts.vaultRoutes)) {
-        if (vault.startsWith(prefix)) {
-          stores.add(s);
-          return [...stores];
-        }
-      }
-    }
-    stores.add(primary);
-    if (simpleBlobStore) stores.add(simpleBlobStore);
-    if (tieredBlobs?.large) stores.add(tieredBlobs.large);
-    if (tieredBlobs?.small && tieredBlobs.small !== primary) stores.add(tieredBlobs.small);
-    if (opts.age?.cold) stores.add(opts.age.cold);
-    if (opts.routes) {
-      for (const s of Object.values(opts.routes)) stores.add(s);
-    }
-    return [...stores];
-  }
-}
-function mergeSnapshots(snapshots) {
-  const merged = {};
-  for (const snap of snapshots) {
-    for (const [collection, records] of Object.entries(snap)) {
-      if (!merged[collection]) {
-        merged[collection] = { ...records };
-        continue;
-      }
-      for (const [id, envelope] of Object.entries(records)) {
-        const existing = merged[collection][id];
-        if (!existing || envelope._ts >= existing._ts) {
-          merged[collection][id] = envelope;
-        }
-      }
-    }
-  }
-  return merged;
-}
-
-// src/with-store/store-middleware.ts
-function wrapStore(store, ...middlewares) {
-  let result = store;
-  for (let i = middlewares.length - 1; i >= 0; i--) {
-    result = middlewares[i](result);
-  }
-  return result;
-}
-function withRetry(opts = {}) {
-  const maxRetries = opts.maxRetries ?? 3;
-  const backoffMs = opts.backoffMs ?? 500;
-  const jitter = opts.jitter ?? 0.3;
-  const retryOn = opts.retryOn ? new Set(opts.retryOn) : null;
-  function shouldRetry(err) {
-    if (!retryOn) return true;
-    if (err && typeof err === "object" && "code" in err) {
-      return retryOn.has(err.code);
-    }
-    return true;
-  }
-  async function retryable(fn) {
-    let lastError;
-    for (let attempt = 0; attempt <= maxRetries; attempt++) {
-      try {
-        return await fn();
-      } catch (err) {
-        lastError = err;
-        if (attempt >= maxRetries || !shouldRetry(err)) throw err;
-        const delay = backoffMs * Math.pow(2, attempt) * (1 + Math.random() * jitter);
-        await new Promise((r) => setTimeout(r, delay));
-      }
-    }
-    throw lastError;
-  }
-  return (next) => ({
-    ...next,
-    name: next.name ? `retry(${next.name})` : "retry",
-    get: (v, c, id) => retryable(() => next.get(v, c, id)),
-    put: (v, c, id, env, ev) => retryable(() => next.put(v, c, id, env, ev)),
-    delete: (v, c, id) => retryable(() => next.delete(v, c, id)),
-    list: (v, c) => retryable(() => next.list(v, c)),
-    loadAll: (v) => retryable(() => next.loadAll(v)),
-    saveAll: (v, d) => retryable(() => next.saveAll(v, d))
-  });
-}
-var LOG_LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
-function withLogging(opts = {}) {
-  const minLevel = LOG_LEVELS[opts.level ?? "info"];
-  const logger = opts.logger ?? console;
-  const logData = opts.logData ?? false;
-  function log(level, method, args, durationMs) {
-    if (LOG_LEVELS[level] < minLevel) return;
-    const parts = [`[noydb:${method}]`, ...Object.entries(args).map(([k, v]) => `${k}=${String(v)}`)];
-    if (durationMs !== void 0) parts.push(`${durationMs}ms`);
-    logger[level](parts.join(" "));
-  }
-  function timed(method, args, fn) {
-    const start = Date.now();
-    return fn().then(
-      (result) => {
-        log("debug", method, args, Date.now() - start);
-        return result;
-      },
-      (err) => {
-        log("error", method, { ...args, error: err.message }, Date.now() - start);
-        throw err;
-      }
-    );
-  }
-  return (next) => ({
-    ...next,
-    name: next.name ? `log(${next.name})` : "log",
-    get: (v, c, id) => timed("get", { vault: v, collection: c, id }, () => next.get(v, c, id)),
-    put: (v, c, id, env, ev) => timed("put", {
-      vault: v,
-      collection: c,
-      id,
-      version: env._v,
-      ...logData ? { data: env._data.slice(0, 40) + "..." } : {}
-    }, () => next.put(v, c, id, env, ev)),
-    delete: (v, c, id) => timed("delete", { vault: v, collection: c, id }, () => next.delete(v, c, id)),
-    list: (v, c) => timed("list", { vault: v, collection: c }, () => next.list(v, c)),
-    loadAll: (v) => timed("loadAll", { vault: v }, () => next.loadAll(v)),
-    saveAll: (v, d) => timed("saveAll", { vault: v }, () => next.saveAll(v, d))
-  });
-}
-function withMetrics(opts) {
-  function tracked(method, vault, fn, collection, id) {
-    const start = Date.now();
-    return fn().then(
-      (result) => {
-        opts.onOperation({
-          method,
-          vault,
-          ...collection !== void 0 ? { collection } : {},
-          ...id !== void 0 ? { id } : {},
-          durationMs: Date.now() - start,
-          success: true
-        });
-        return result;
-      },
-      (err) => {
-        opts.onOperation({
-          method,
-          vault,
-          ...collection !== void 0 ? { collection } : {},
-          ...id !== void 0 ? { id } : {},
-          durationMs: Date.now() - start,
-          success: false,
-          error: err
-        });
-        throw err;
-      }
-    );
-  }
-  return (next) => ({
-    ...next,
-    name: next.name ? `metrics(${next.name})` : "metrics",
-    get: (v, c, id) => tracked("get", v, () => next.get(v, c, id), c, id),
-    put: (v, c, id, env, ev) => tracked("put", v, () => next.put(v, c, id, env, ev), c, id),
-    delete: (v, c, id) => tracked("delete", v, () => next.delete(v, c, id), c, id),
-    list: (v, c) => tracked("list", v, () => next.list(v, c), c),
-    loadAll: (v) => tracked("loadAll", v, () => next.loadAll(v)),
-    saveAll: (v, d) => tracked("saveAll", v, () => next.saveAll(v, d))
-  });
-}
-function withCircuitBreaker(opts = {}) {
-  const threshold = opts.failureThreshold ?? 5;
-  const resetMs = opts.resetTimeoutMs ?? 3e4;
-  let state = "closed";
-  let failures = 0;
-  let lastFailureTime = 0;
-  function recordSuccess() {
-    if (state === "half-open") {
-      state = "closed";
-      failures = 0;
-      opts.onClose?.();
-    }
-    failures = 0;
-  }
-  function recordFailure() {
-    failures++;
-    lastFailureTime = Date.now();
-    if (failures >= threshold && state === "closed") {
-      state = "open";
-      opts.onOpen?.();
-    }
-  }
-  function canAttempt() {
-    if (state === "closed") return true;
-    if (state === "open") {
-      if (Date.now() - lastFailureTime >= resetMs) {
-        state = "half-open";
-        return true;
-      }
-      return false;
-    }
-    return true;
-  }
-  async function guarded(fn, fallback) {
-    if (!canAttempt()) return fallback;
-    try {
-      const result = await fn();
-      recordSuccess();
-      return result;
-    } catch (err) {
-      recordFailure();
-      throw err;
-    }
-  }
-  return (next) => ({
-    ...next,
-    name: next.name ? `cb(${next.name})` : "cb",
-    get: (v, c, id) => guarded(() => next.get(v, c, id), null),
-    put: (v, c, id, env, ev) => guarded(() => next.put(v, c, id, env, ev), void 0),
-    delete: (v, c, id) => guarded(() => next.delete(v, c, id), void 0),
-    list: (v, c) => guarded(() => next.list(v, c), []),
-    loadAll: (v) => guarded(() => next.loadAll(v), {}),
-    saveAll: (v, d) => guarded(() => next.saveAll(v, d), void 0)
-  });
-}
-function withCache(opts = {}) {
-  const maxEntries = opts.maxEntries ?? 500;
-  const ttlMs = opts.ttlMs ?? 6e4;
-  const cache = /* @__PURE__ */ new Map();
-  function cacheKey(vault, collection, id) {
-    return `${vault}\0${collection}\0${id}`;
-  }
-  function getFromCache(key) {
-    const entry = cache.get(key);
-    if (!entry) return void 0;
-    if (ttlMs > 0 && Date.now() - entry.cachedAt > ttlMs) {
-      cache.delete(key);
-      return void 0;
-    }
-    cache.delete(key);
-    cache.set(key, entry);
-    return entry.envelope;
-  }
-  function setInCache(key, envelope) {
-    if (cache.size >= maxEntries) {
-      const oldest = cache.keys().next().value;
-      if (oldest !== void 0) cache.delete(oldest);
-    }
-    cache.set(key, { envelope, cachedAt: Date.now() });
-  }
-  function invalidate(key) {
-    cache.delete(key);
-  }
-  return (next) => ({
-    ...next,
-    name: next.name ? `cache(${next.name})` : "cache",
-    async get(vault, collection, id) {
-      const key = cacheKey(vault, collection, id);
-      const cached = getFromCache(key);
-      if (cached !== void 0) return cached;
-      const result = await next.get(vault, collection, id);
-      setInCache(key, result);
-      return result;
-    },
-    async put(vault, collection, id, env, ev) {
-      invalidate(cacheKey(vault, collection, id));
-      await next.put(vault, collection, id, env, ev);
-      setInCache(cacheKey(vault, collection, id), env);
-    },
-    async delete(vault, collection, id) {
-      invalidate(cacheKey(vault, collection, id));
-      await next.delete(vault, collection, id);
-    },
-    list: (v, c) => next.list(v, c),
-    loadAll: (v) => next.loadAll(v),
-    saveAll: (v, d) => next.saveAll(v, d)
-  });
-}
-function withHealthCheck(opts = {}) {
-  const intervalMs = opts.checkIntervalMs ?? 3e4;
-  const failThreshold = opts.suspendAfterFailures ?? 3;
-  const successThreshold = opts.resumeAfterSuccess ?? 1;
-  let isSuspended = false;
-  let consecutiveFailures = 0;
-  let consecutiveSuccesses = 0;
-  return (next) => {
-    const checkFn = opts.check ?? (next.ping ? () => next.ping() : async () => {
-      await next.list("__health__", "__ping__");
-      return true;
-    });
-    async function doCheck() {
-      try {
-        const ok = await checkFn();
-        if (ok) {
-          consecutiveFailures = 0;
-          consecutiveSuccesses++;
-          if (isSuspended && consecutiveSuccesses >= successThreshold) {
-            isSuspended = false;
-            consecutiveSuccesses = 0;
-            opts.onResume?.();
-          }
-        } else {
-          throw new Error("Health check returned false");
-        }
-      } catch {
-        consecutiveSuccesses = 0;
-        consecutiveFailures++;
-        if (!isSuspended && consecutiveFailures >= failThreshold) {
-          isSuspended = true;
-          consecutiveFailures = 0;
-          opts.onSuspend?.();
-        }
-      }
-    }
-    setInterval(() => {
-      void doCheck();
-    }, intervalMs);
-    const wrapped = {
-      ...next,
-      name: next.name ? `health(${next.name})` : "health",
-      async get(v, c, id) {
-        return isSuspended ? null : next.get(v, c, id);
-      },
-      async put(v, c, id, env, ev) {
-        if (!isSuspended) await next.put(v, c, id, env, ev);
-      },
-      async delete(v, c, id) {
-        if (!isSuspended) await next.delete(v, c, id);
-      },
-      async list(v, c) {
-        return isSuspended ? [] : next.list(v, c);
-      },
-      async loadAll(v) {
-        return isSuspended ? {} : next.loadAll(v);
-      },
-      async saveAll(v, d) {
-        if (!isSuspended) await next.saveAll(v, d);
-      }
-    };
-    return wrapped;
-  };
-}
-
-// src/with-commit/numbering/descriptor.ts
-function withDeferredNumbering(config) {
-  return {
-    series: config.series,
-    collection: config.collection,
-    field: config.field,
-    settleWindowMs: config.settleWindowMs ?? 0
-  };
-}
-
-// src/via/money/iso4217.ts
-var MINOR_UNITS = {
-  // 2-decimal majors
-  EUR: 2,
-  USD: 2,
-  GBP: 2,
-  CHF: 2,
-  CAD: 2,
-  AUD: 2,
-  NZD: 2,
-  SGD: 2,
-  HKD: 2,
-  CNY: 2,
-  INR: 2,
-  BRL: 2,
-  MXN: 2,
-  ZAR: 2,
-  RUB: 2,
-  TRY: 2,
-  PLN: 2,
-  SEK: 2,
-  NOK: 2,
-  DKK: 2,
-  CZK: 2,
-  HUF: 2,
-  RON: 2,
-  ILS: 2,
-  THB: 2,
-  PHP: 2,
-  MYR: 2,
-  IDR: 2,
-  AED: 2,
-  SAR: 2,
-  QAR: 2,
-  EGP: 2,
-  // 0-decimal
-  JPY: 0,
-  KRW: 0,
-  ISK: 0,
-  CLP: 0,
-  VND: 0,
-  XOF: 0,
-  XAF: 0,
-  PYG: 0,
-  // 3-decimal
-  BHD: 3,
-  KWD: 3,
-  OMR: 3,
-  TND: 3,
-  JOD: 3,
-  IQD: 3,
-  LYD: 3
-};
-function scaleForCurrency(code) {
-  const v = MINOR_UNITS[code];
-  return v === void 0 ? null : v;
-}
-
-// src/via/money/fixed-point.ts
-function expandExponent(s) {
-  const m = /^([+-]?)(\d+)(?:\.(\d+))?[eE]([+-]?\d+)$/.exec(s);
-  if (!m) return s;
-  const sign = m[1] === "-" ? "-" : "";
-  const intp = m[2];
-  const frac = m[3] ?? "";
-  const exp = Number(m[4]);
-  const digits = intp + frac;
-  const pointPos = intp.length + exp;
-  let body;
-  if (pointPos <= 0) {
-    body = "0." + "0".repeat(-pointPos) + digits;
-  } else if (pointPos >= digits.length) {
-    body = digits + "0".repeat(pointPos - digits.length);
-  } else {
-    body = digits.slice(0, pointPos) + "." + digits.slice(pointPos);
-  }
-  return sign + body;
-}
-function toCanonicalDecimalString(input) {
-  let s;
-  if (typeof input === "number") {
-    if (!Number.isFinite(input)) return null;
-    s = String(input);
-  } else {
-    s = input.trim();
-  }
-  s = expandExponent(s);
-  if (s.startsWith("+")) s = s.slice(1);
-  if (!/^-?(\d+(\.\d*)?|\.\d+)$/.test(s)) return null;
-  return s;
-}
-function shouldRoundUp(negative, lastKeptDigit, firstDiscarded, hasMoreNonZeroAfterFirst, mode) {
-  switch (mode) {
-    case "up":
-      return true;
-    case "down":
-      return false;
-    case "ceil":
-      return !negative;
-    case "floor":
-      return negative;
-    case "half-up":
-      return firstDiscarded >= 5;
-    case "half-down":
-      return firstDiscarded > 5 || firstDiscarded === 5 && hasMoreNonZeroAfterFirst;
-    case "half-even":
-      if (firstDiscarded > 5) return true;
-      if (firstDiscarded < 5) return false;
-      return hasMoreNonZeroAfterFirst || lastKeptDigit % 2 === 1;
-  }
-}
-function parseToScaledInt(input, scale, rounding) {
-  const canonical = toCanonicalDecimalString(input);
-  if (canonical === null) return { ok: false, reason: "nonfinite" };
-  const negative = canonical.startsWith("-");
-  const unsigned = negative ? canonical.slice(1) : canonical;
-  const dot = unsigned.indexOf(".");
-  const intPart = dot === -1 ? unsigned : unsigned.slice(0, dot);
-  const fracPart = dot === -1 ? "" : unsigned.slice(dot + 1);
-  const intDigits = intPart === "" ? "0" : intPart;
-  if (fracPart.length <= scale) {
-    const keep2 = fracPart.padEnd(scale, "0");
-    const magnitude2 = BigInt(intDigits + keep2);
-    return { ok: true, value: negative && magnitude2 !== 0n ? -magnitude2 : magnitude2 };
-  }
-  const keep = fracPart.slice(0, scale);
-  const tail = fracPart.slice(scale);
-  const magnitudeDigits = intDigits + keep;
-  let magnitude = BigInt(magnitudeDigits);
-  if (/^0+$/.test(tail)) {
-    return { ok: true, value: negative && magnitude !== 0n ? -magnitude : magnitude };
-  }
-  if (rounding === void 0) return { ok: false, reason: "precision" };
-  const lastKeptDigit = Number(magnitudeDigits[magnitudeDigits.length - 1]);
-  const firstDiscarded = Number(tail[0]);
-  const hasMoreNonZeroAfterFirst = /[1-9]/.test(tail.slice(1));
-  if (shouldRoundUp(negative, lastKeptDigit, firstDiscarded, hasMoreNonZeroAfterFirst, rounding)) {
-    magnitude += 1n;
-  }
-  return { ok: true, value: negative && magnitude !== 0n ? -magnitude : magnitude };
-}
-function decimalScaleOf(input) {
-  const s = toCanonicalDecimalString(input);
-  if (s === null) return null;
-  const dot = s.indexOf(".");
-  return dot === -1 ? 0 : s.length - dot - 1;
-}
-function rescaleScaledInt(value, fromScale, toScale, rounding = "half-up") {
-  if (toScale >= fromScale) return value * 10n ** BigInt(toScale - fromScale);
-  const drop = fromScale - toScale;
-  const negative = value < 0n;
-  const absStr = (negative ? -value : value).toString().padStart(drop + 1, "0");
-  const keptStr = absStr.slice(0, absStr.length - drop);
-  const tail = absStr.slice(absStr.length - drop);
-  let magnitude = BigInt(keptStr);
-  if (!/^0+$/.test(tail)) {
-    const lastKeptDigit = Number(keptStr[keptStr.length - 1]);
-    const firstDiscarded = Number(tail[0]);
-    const hasMoreNonZeroAfterFirst = /[1-9]/.test(tail.slice(1));
-    if (shouldRoundUp(negative, lastKeptDigit, firstDiscarded, hasMoreNonZeroAfterFirst, rounding)) {
-      magnitude += 1n;
-    }
-  }
-  return negative && magnitude !== 0n ? -magnitude : magnitude;
-}
-function formatScaledInt(value, scale) {
-  const negative = value < 0n;
-  const abs = (negative ? -value : value).toString();
-  if (scale === 0) return (negative ? "-" : "") + abs;
-  const padded = abs.padStart(scale + 1, "0");
-  const cut = padded.length - scale;
-  const intPart = padded.slice(0, cut);
-  const fracPart = padded.slice(cut);
-  return (negative ? "-" : "") + intPart + "." + fracPart;
-}
-
-// src/via/money/paths.ts
-var SEGMENT_RE = /^(\*|[^.[\]*]+)(\[\])?$/;
-var parseCache = /* @__PURE__ */ new Map();
-function parseMoneyPath(path) {
-  const cached = parseCache.get(path);
-  if (cached) return cached;
-  if (typeof path !== "string" || path.length === 0) {
-    throw new ValidationError("moneyFields: path must be a non-empty string");
-  }
-  const segments = [];
-  for (const part of path.split(".")) {
-    const m = SEGMENT_RE.exec(part);
-    if (!m) {
-      throw new ValidationError(
-        `moneyFields: invalid path "${path}" \u2014 segment "${part}" must be a key, "key[]", "*", or "*[]"`
-      );
-    }
-    const array = m[2] === "[]";
-    segments.push(
-      m[1] === "*" ? { kind: "wildcard", array } : { kind: "key", key: m[1], array }
-    );
-  }
-  parseCache.set(path, segments);
-  return segments;
-}
-function isSimpleMoneyPath(path) {
-  return !path.includes(".") && !path.includes("[") && !path.includes("*");
-}
-function validateMoneyFieldPaths(moneyFields) {
-  for (const path of Object.keys(moneyFields)) parseMoneyPath(path);
-}
-function transformAtMoneyPath(node, path, segments, index, visit, lenient) {
-  if (node === null || node === void 0) return node;
-  const seg = segments[index];
-  const last = index === segments.length - 1;
-  if (seg.kind === "key") {
-    if (typeof node !== "object" || Array.isArray(node)) {
-      if (lenient) return node;
-      throw new ValidationError(
-        `moneyFields: path "${path}" expected an object at segment "${seg.key}", got ${Array.isArray(node) ? "an array" : typeof node}`
-      );
-    }
-    const obj2 = node;
-    if (!(seg.key in obj2) || obj2[seg.key] === null || obj2[seg.key] === void 0) return node;
-    if (seg.array) {
-      const arr = obj2[seg.key];
-      if (!Array.isArray(arr)) {
-        if (lenient) return node;
-        throw new ValidationError(
-          `moneyFields: path "${path}" declares "${seg.key}[]" but the value is not an array`
-        );
-      }
-      const cloned = [...arr];
-      if (last) {
-        for (let i = 0; i < cloned.length; i++) visit(cloned, i);
-      } else {
-        for (let i = 0; i < cloned.length; i++) {
-          cloned[i] = transformAtMoneyPath(cloned[i], path, segments, index + 1, visit, lenient);
-        }
-      }
-      return { ...obj2, [seg.key]: cloned };
-    }
-    const clone2 = { ...obj2 };
-    if (last) {
-      visit(clone2, seg.key);
-    } else {
-      clone2[seg.key] = transformAtMoneyPath(clone2[seg.key], path, segments, index + 1, visit, lenient);
-    }
-    return clone2;
-  }
-  if (seg.array) {
-    if (!Array.isArray(node)) {
-      if (lenient) return node;
-      throw new ValidationError(`moneyFields: path "${path}" declares "*[]" but the value is not an array`);
-    }
-    const cloned = [...node];
-    if (last) {
-      for (let i = 0; i < cloned.length; i++) visit(cloned, i);
-    } else {
-      for (let i = 0; i < cloned.length; i++) {
-        cloned[i] = transformAtMoneyPath(cloned[i], path, segments, index + 1, visit, lenient);
-      }
-    }
-    return cloned;
-  }
-  if (typeof node !== "object" || Array.isArray(node)) {
-    if (lenient) return node;
-    throw new ValidationError(
-      `moneyFields: path "${path}" applies "*" to a non-object (${Array.isArray(node) ? 'array \u2014 use "*[]"' : typeof node})`
-    );
-  }
-  const obj = node;
-  const clone = { ...obj };
-  for (const key of Object.keys(obj)) {
-    const v = clone[key];
-    if (v === null || v === void 0) continue;
-    if (last) visit(clone, key);
-    else clone[key] = transformAtMoneyPath(v, path, segments, index + 1, visit, lenient);
-  }
-  return clone;
-}
-
-// src/via/money/normalize.ts
-function isMoneyValueObject(v) {
-  return typeof v === "object" && v !== null && "currency" in v;
-}
-function quantizeAmount(field, input, scale, rounding) {
-  const r = parseToScaledInt(input, scale, rounding);
-  if (!r.ok) {
-    if (r.reason === "precision") throw new MoneyPrecisionError(field, input, scale);
-    throw new TypeError(`money: field "${field}" value ${JSON.stringify(input)} is not a finite decimal`);
-  }
-  return r.value.toString();
-}
-function canonicalizeStoredMoney(record, moneyFields) {
-  if (record === null || record === void 0) return record;
-  if (!moneyFields || Object.keys(moneyFields).length === 0) return record;
-  return decodeMoneyFields(record, moneyFields, "raw");
-}
-function canonicalizeIncomingMoney(record, moneyFields) {
-  if (!moneyFields || Object.keys(moneyFields).length === 0) return record;
-  try {
-    return decodeMoneyFields(
-      quantizeMoneyFields(record, moneyFields),
-      moneyFields,
-      "raw"
-    );
-  } catch {
-    return record;
-  }
-}
-function quantizeValue(field, raw, desc) {
-  if (desc.mode === "fixed") {
-    const currency2 = desc.fixedCurrency;
-    return quantizeAmount(field, raw, desc.scaleFor(currency2), desc.rounding);
-  }
-  let amount;
-  let currency;
-  if (isMoneyValueObject(raw)) {
-    currency = String(raw.currency);
-    amount = raw.amount;
-  } else {
-    const sole = desc.soleCurrency();
-    if (sole === void 0) {
-      throw new TypeError(
-        `money: field "${field}" is multi-currency \u2014 write { amount, currency }, not a bare amount`
-      );
-    }
-    currency = sole;
-    amount = raw;
-  }
-  const scale = desc.scaleFor(currency);
-  return { amount: quantizeAmount(field, amount, scale, desc.rounding), currency };
-}
-function quantizeMoneyFields(record, moneyFields) {
-  let out = { ...record };
-  for (const [path, desc] of Object.entries(moneyFields)) {
-    if (isSimpleMoneyPath(path)) {
-      const raw = out[path];
-      if (raw === null || raw === void 0) continue;
-      out[path] = quantizeValue(path, raw, desc);
-      continue;
-    }
-    out = transformAtMoneyPath(
-      out,
-      path,
-      parseMoneyPath(path),
-      0,
-      (container, key) => {
-        const raw = container[key];
-        if (raw === null || raw === void 0) return;
-        container[key] = quantizeValue(path, raw, desc);
-      },
-      /* lenient */
-      false
-    );
-  }
-  return out;
-}
-function formatCurrency(decimal, currency, scale, locale) {
-  const fmt = new Intl.NumberFormat(locale, {
-    style: "currency",
-    currency,
-    minimumFractionDigits: scale,
-    maximumFractionDigits: scale
-  });
-  return fmt.format(decimal);
-}
-function moneyScaledValue(stored, desc) {
-  let raw;
-  if (desc.mode === "fixed") {
-    raw = stored;
-  } else {
-    if (!isMoneyValueObject(stored)) return null;
-    raw = stored.amount;
-  }
-  if (typeof raw !== "string" && typeof raw !== "number") return null;
-  try {
-    return BigInt(String(raw));
-  } catch {
-    return null;
-  }
-}
-function canonicalizeMoneyIndexKey(field, rawValue, moneyFields) {
-  const desc = moneyFields[field];
-  if (!desc || desc.mode !== "fixed") return void 0;
-  return moneyScaledValue(rawValue, desc)?.toString();
-}
-function decodeValue(stored, desc) {
-  let currency;
-  let scaledIntString;
-  if (desc.mode === "fixed") {
-    if (typeof stored !== "string" && typeof stored !== "number") return null;
-    currency = desc.fixedCurrency;
-    scaledIntString = String(stored);
-  } else {
-    if (!isMoneyValueObject(stored)) return null;
-    const amount = stored.amount;
-    if (typeof stored.currency !== "string" || typeof amount !== "string" && typeof amount !== "number") return null;
-    currency = stored.currency;
-    scaledIntString = String(amount);
-  }
-  const scale = desc.scaleFor(currency);
-  let decimal;
-  try {
-    decimal = formatScaledInt(BigInt(scaledIntString), scale);
-  } catch {
-    return null;
-  }
-  return {
-    decoded: desc.mode === "fixed" ? decimal : { amount: decimal, currency },
-    decimal,
-    currency,
-    scale
-  };
-}
-function presentVirtualMoneyFields(record, moneyFields, virtualMoney, locale) {
-  let out = record;
-  const format = locale !== "raw";
-  const fmtLocale = typeof locale === "string" && locale !== "raw" ? locale : "en-US";
-  for (const field of virtualMoney) {
-    const desc = moneyFields[field];
-    if (!desc || desc.mode !== "fixed") continue;
-    const raw = out[field];
-    if (raw === null || raw === void 0) continue;
-    if (typeof raw !== "number" && typeof raw !== "string") continue;
-    const currency = desc.fixedCurrency;
-    const scale = desc.scaleFor(currency);
-    const r = parseToScaledInt(raw, scale, desc.rounding);
-    if (!r.ok) continue;
-    if (out === record) out = { ...record };
-    const decimal = formatScaledInt(r.value, scale);
-    out[field] = decimal;
-    if (format) {
-      out[`${field}Formatted`] = formatCurrency(decimal, currency, scale, fmtLocale);
-      out[`${field}Number`] = Number(decimal);
-    }
-  }
-  return out;
-}
-function decodeMoneyFields(record, moneyFields, locale) {
-  let out = { ...record };
-  const format = locale !== "raw";
-  const fmtLocale = typeof locale === "string" && locale !== "raw" ? locale : "en-US";
-  for (const [path, desc] of Object.entries(moneyFields)) {
-    if (isSimpleMoneyPath(path)) {
-      const stored = out[path];
-      if (stored === null || stored === void 0) continue;
-      const r = decodeValue(stored, desc);
-      if (r === null) continue;
-      out[path] = r.decoded;
-      if (format) {
-        out[`${path}Formatted`] = formatCurrency(r.decimal, r.currency, r.scale, fmtLocale);
-        out[`${path}Number`] = Number(r.decimal);
-      }
-      continue;
-    }
-    out = transformAtMoneyPath(
-      out,
-      path,
-      parseMoneyPath(path),
-      0,
-      (container, key) => {
-        const stored = container[key];
-        if (stored === null || stored === void 0) return;
-        const r = decodeValue(stored, desc);
-        if (r === null) return;
-        container[key] = r.decoded;
-        if (format && typeof key === "string" && !Array.isArray(container)) {
-          container[`${key}Formatted`] = formatCurrency(r.decimal, r.currency, r.scale, fmtLocale);
-          container[`${key}Number`] = Number(r.decimal);
-        }
-      },
-      /* lenient */
-      true
-    );
-  }
-  return out;
-}
-
-// src/via/money/where.ts
-function isMoneyValueObject2(v) {
-  return typeof v === "object" && v !== null && "currency" in v;
-}
-function parseOperand(field, raw, desc) {
-  let amount;
-  let currency;
-  if (desc.mode === "fixed") {
-    currency = desc.fixedCurrency;
-    amount = raw;
-  } else if (isMoneyValueObject2(raw)) {
-    currency = String(raw.currency);
-    amount = raw.amount;
-  } else {
-    const sole = desc.soleCurrency();
-    if (sole === void 0) {
-      throw new MoneyUnsupportedError(
-        `where("${field}"): field is multi-currency \u2014 compare against { amount, currency }, not a bare amount`
-      );
-    }
-    currency = sole;
-    amount = raw;
-  }
-  if (typeof amount !== "number" && typeof amount !== "string") {
-    throw new MoneyUnsupportedError(
-      `where("${field}"): operand ${JSON.stringify(raw)} is not a money amount`
-    );
-  }
-  const r = parseToScaledInt(amount, desc.scaleFor(currency), desc.rounding);
-  if (!r.ok) {
-    throw new MoneyUnsupportedError(
-      `where("${field}"): operand ${JSON.stringify(amount)} is not a finite decimal`
-    );
-  }
-  return { scaled: r.value.toString(), currency };
-}
-function moneyFieldClause(field, op, value, desc) {
-  switch (op) {
-    case "==":
-    case "!=":
-    case "<":
-    case "<=":
-    case ">":
-    case ">=": {
-      const e = parseOperand(field, value, desc);
-      return { mode: desc.mode, entries: [e] };
-    }
-    case "between": {
-      if (!Array.isArray(value) || value.length !== 2) {
-        throw new MoneyUnsupportedError(`where("${field}"): 'between' needs a [lo, hi] tuple`);
-      }
-      const lo = parseOperand(field, value[0], desc);
-      const hi = parseOperand(field, value[1], desc);
-      if (lo.currency !== hi.currency) {
-        throw new MoneyUnsupportedError(
-          `where("${field}"): 'between' bounds mix currencies (${lo.currency} vs ${hi.currency})`
-        );
-      }
-      return { mode: desc.mode, entries: [lo, hi] };
-    }
-    case "in": {
-      if (!Array.isArray(value)) {
-        throw new MoneyUnsupportedError(`where("${field}"): 'in' needs an array of amounts`);
-      }
-      return { mode: desc.mode, entries: value.map((v) => parseOperand(field, v, desc)) };
-    }
-    default:
-      throw new MoneyUnsupportedError(
-        `where("${field}"): operator '${op}' is not supported on a money field`
-      );
-  }
-}
-function moneyIndexProbe(op, payload) {
-  if (payload.mode !== "fixed") return void 0;
-  if (op === "==") return payload.entries[0]?.scaled;
-  if (op === "in") return payload.entries.map((e) => e.scaled);
-  return void 0;
-}
-function readStored(actual, operand) {
-  let amount;
-  let currency;
-  if (operand.mode === "fixed") {
-    if (typeof actual !== "string" && typeof actual !== "number") return null;
-    amount = actual;
-    currency = operand.entries[0]?.currency ?? "";
-  } else {
-    if (!isMoneyValueObject2(actual)) return null;
-    if (typeof actual.currency !== "string") return null;
-    amount = actual.amount;
-    currency = actual.currency;
-  }
-  if (typeof amount !== "string" && typeof amount !== "number") return null;
-  try {
-    return { scaled: BigInt(amount).toString(), currency };
-  } catch {
-    return null;
-  }
-}
-function evaluateMoneyClause(actual, op, operand) {
-  const stored = readStored(actual, operand);
-  if (stored === null) return op === "!=";
-  const a = BigInt(stored.scaled);
-  if (op === "in") {
-    return operand.entries.some(
-      (e2) => e2.currency === stored.currency && BigInt(e2.scaled) === a
-    );
-  }
-  if (op === "between") {
-    const [lo, hi] = operand.entries;
-    if (!lo || !hi || lo.currency !== stored.currency) return false;
-    return a >= BigInt(lo.scaled) && a <= BigInt(hi.scaled);
-  }
-  const e = operand.entries[0];
-  if (!e) return false;
-  if (e.currency !== stored.currency) return op === "!=";
-  const b = BigInt(e.scaled);
-  switch (op) {
-    case "==":
-      return a === b;
-    case "!=":
-      return a !== b;
-    case "<":
-      return a < b;
-    case "<=":
-      return a <= b;
-    case ">":
-      return a > b;
-    case ">=":
-      return a >= b;
-    default:
-      return false;
-  }
-}
-
-// src/via/money/money-reducer.ts
-function toScaledIntFromAny(v, scale) {
-  if (typeof v === "bigint") return v;
-  if (typeof v === "number") {
-    const r = parseToScaledInt(v, scale);
-    return r.ok ? r.value : null;
-  }
-  if (typeof v === "string") {
-    if (!v.includes(".")) {
-      try {
-        return BigInt(v);
-      } catch {
-        return null;
-      }
-    }
-    const r = parseToScaledInt(v, scale);
-    return r.ok ? r.value : null;
-  }
-  return null;
-}
-function readMoney(record, field, desc) {
-  const raw = readPath(record, field);
-  if (raw === null || raw === void 0) return null;
-  if (desc.mode === "fixed") {
-    const cur = desc.fixedCurrency;
-    const value2 = toScaledIntFromAny(raw, desc.scaleFor(cur));
-    return value2 === null ? null : { currency: cur, value: value2 };
-  }
-  if (typeof raw !== "object") return null;
-  const o = raw;
-  if (typeof o.currency !== "string") return null;
-  const scale = desc.allows(o.currency) ? desc.scaleFor(o.currency) : 0;
-  const value = toScaledIntFromAny(o.amount, scale);
-  return value === null ? null : { currency: o.currency, value };
-}
-function targetScaleFor(desc, currency) {
-  if (desc.allows(currency)) return desc.scaleFor(currency);
-  const s = scaleForCurrency(currency);
-  if (s === null) {
-    throw new Error(`money: cannot determine scale for conversion target "${currency}"`);
-  }
-  return s;
-}
-function parseRate(rate) {
-  const s = String(rate).trim();
-  const neg = s.startsWith("-");
-  const body = neg ? s.slice(1) : s;
-  const dot = body.indexOf(".");
-  const intPart = dot === -1 ? body : body.slice(0, dot);
-  const fracPart = dot === -1 ? "" : body.slice(dot + 1);
-  const int = BigInt((intPart === "" ? "0" : intPart) + fracPart);
-  return { int: neg ? -int : int, scale: fracPart.length };
-}
-function divRoundHalfEven(n, d) {
-  const q = n / d;
-  const r = n % d;
-  const twiceR = (r < 0n ? -r : r) * 2n;
-  if (twiceR < d) return q;
-  if (twiceR > d) return q + (n < 0n ? -1n : 1n);
-  return q % 2n === 0n ? q : q + (n < 0n ? -1n : 1n);
-}
-function convertScaled(value, srcScale, rate, targetScale) {
-  const { int: rateInt, scale: rateScale } = parseRate(rate);
-  const product = value * rateInt;
-  const curScale = srcScale + rateScale;
-  if (curScale === targetScale) return product;
-  if (curScale < targetScale) return product * 10n ** BigInt(targetScale - curScale);
-  return divRoundHalfEven(product, 10n ** BigInt(curScale - targetScale));
-}
-function finalizeSum(state, desc, convertTo, fx) {
-  if (convertTo !== void 0) {
-    if (fx === void 0) {
-      throw new Error(`money: sum convertTo "${convertTo}" requires an fx rate map`);
-    }
-    const targetScale = targetScaleFor(desc, convertTo);
-    let total = 0n;
-    for (const [cur, v] of state) {
-      if (cur === convertTo) {
-        total += convertScaled(v, desc.scaleFor(cur), 1, targetScale);
-        continue;
-      }
-      const rate = fx[`${cur}->${convertTo}`];
-      if (rate === void 0) {
-        throw new Error(`money: no fx rate for "${cur}->${convertTo}"`);
-      }
-      total += convertScaled(v, desc.scaleFor(cur), rate, targetScale);
-    }
-    return formatScaledInt(total, targetScale);
-  }
-  if (desc.mode === "fixed") {
-    const cur = desc.fixedCurrency;
-    return formatScaledInt(state.get(cur) ?? 0n, desc.scaleFor(cur));
-  }
-  const out = {};
-  for (const [cur, v] of state) out[cur] = formatScaledInt(v, desc.scaleFor(cur));
-  return out;
-}
-function moneySumReducer(field, desc, convertTo, fx) {
-  return {
-    op: "sum",
-    field,
-    init: () => /* @__PURE__ */ new Map(),
-    step: (state, record) => {
-      const m = readMoney(record, field, desc);
-      if (m) state.set(m.currency, (state.get(m.currency) ?? 0n) + m.value);
-      return state;
-    },
-    remove: (state, record) => {
-      const m = readMoney(record, field, desc);
-      if (m) state.set(m.currency, (state.get(m.currency) ?? 0n) - m.value);
-      return state;
-    },
-    finalize: (state) => finalizeSum(state, desc, convertTo, fx)
-  };
-}
-function extremum(values, op) {
-  let out = values[0];
-  for (let i = 1; i < values.length; i++) {
-    const v = values[i];
-    if (op === "min" ? v < out : v > out) out = v;
-  }
-  return out;
-}
-function moneyMinMaxReducer(op, field, desc) {
-  return {
-    op,
-    field,
-    init: () => /* @__PURE__ */ new Map(),
-    step: (state, record) => {
-      const m = readMoney(record, field, desc);
-      if (m) {
-        const arr = state.get(m.currency);
-        if (arr) arr.push(m.value);
-        else state.set(m.currency, [m.value]);
-      }
-      return state;
-    },
-    remove: (state, record) => {
-      const m = readMoney(record, field, desc);
-      if (m) {
-        const arr = state.get(m.currency);
-        if (arr) {
-          const idx = arr.indexOf(m.value);
-          if (idx >= 0) arr.splice(idx, 1);
-        }
-      }
-      return state;
-    },
-    finalize: (state) => {
-      if (desc.mode === "fixed") {
-        const cur = desc.fixedCurrency;
-        const arr = state.get(cur);
-        if (!arr || arr.length === 0) return null;
-        return formatScaledInt(extremum(arr, op), desc.scaleFor(cur));
-      }
-      const out = {};
-      for (const [cur, arr] of state) {
-        if (arr.length > 0) out[cur] = formatScaledInt(extremum(arr, op), desc.scaleFor(cur));
-      }
-      return out;
-    }
-  };
-}
-function wrapMoneyReducers(spec, moneyFields) {
-  let changed = false;
-  const out = {};
-  for (const [key, reducer] of Object.entries(spec)) {
-    const field = reducer.field;
-    const desc = field ? moneyFields[field] : void 0;
-    if (desc && reducer.op === "avg") {
-      throw new MoneyUnsupportedError(
-        field,
-        `avg() is not supported on money field "${field}" in v1 \u2014 use sum() and count() and divide at the boundary.`
-      );
-    }
-    if (desc && (reducer.op === "sum" || reducer.op === "min" || reducer.op === "max")) {
-      changed = true;
-      out[key] = reducer.op === "sum" ? moneySumReducer(field, desc, reducer.convertTo, reducer.fx) : moneyMinMaxReducer(reducer.op, field, desc);
-    } else {
-      out[key] = reducer;
-    }
-  }
-  return changed ? out : spec;
-}
-
-// src/via/money/binding.ts
-function moneyBinding(moneyFields, virtualMoneyFields) {
-  validateMoneyFieldPaths(moneyFields);
-  const hasVirtualMoney = virtualMoneyFields !== void 0 && virtualMoneyFields.size > 0;
-  const ordinaryPresentFields = hasVirtualMoney ? Object.fromEntries(Object.entries(moneyFields).filter(([f]) => !virtualMoneyFields.has(f))) : moneyFields;
-  return {
-    brand: "money",
-    posture: { encryptedAtRest: "envelope", queryable: "ordered", exportable: true, forgettable: true },
-    covers: (field) => field in moneyFields,
-    ingest: (r) => canonicalizeIncomingMoney(r, moneyFields),
-    canonicalizeStored: (r) => canonicalizeStoredMoney(r, moneyFields),
-    encodeWrite: (r) => quantizeMoneyFields(r, moneyFields),
-    present: (r, ctx) => decodeMoneyFields(r, ordinaryPresentFields, typeof ctx.locale === "string" ? ctx.locale : void 0),
-    ...hasVirtualMoney ? {
-      presentLate: (r, ctx) => presentVirtualMoneyFields(r, moneyFields, virtualMoneyFields, typeof ctx.locale === "string" ? ctx.locale : void 0)
-    } : {},
-    buildClause: (field, op, value) => {
-      const desc = moneyFields[field];
-      if (!desc) return void 0;
-      return moneyFieldClause(field, op, value, desc);
-    },
-    evaluateClause: (actual, op, payload) => evaluateMoneyClause(actual, op, payload),
-    indexProbe: (op, payload) => moneyIndexProbe(op, payload),
-    canonicalizeIndexKey: (field, rawValue) => canonicalizeMoneyIndexKey(field, rawValue, moneyFields),
-    decodeResults: (r) => decodeMoneyFields(r, moneyFields, "raw"),
-    compareForOrder: (field, a, b) => {
-      const desc = moneyFields[field];
-      if (!desc) return void 0;
-      const av = moneyScaledValue(a, desc);
-      const bv = moneyScaledValue(b, desc);
-      if (av === null) return bv === null ? 0 : 1;
-      if (bv === null) return -1;
-      return av < bv ? -1 : av > bv ? 1 : 0;
-    },
-    wrapReducers: (spec) => wrapMoneyReducers(spec, moneyFields)
-  };
-}
-function linkMoneyVia() {
-  installViaBinder("money", (cfg) => {
-    const c = cfg;
-    return moneyBinding(c.moneyFields, c.virtualMoneyFields);
-  });
-}
-
-// src/via/money/descriptor.ts
-var MoneyPrecisionError = class extends NoydbError {
-  constructor(field, value, scale) {
-    super(
-      "MONEY_PRECISION",
-      `money: value ${JSON.stringify(value)} for field "${field}" exceeds scale ${scale} and no rounding mode is configured`
-    );
-    this.field = field;
-    this.value = value;
-    this.scale = scale;
-    this.name = "MoneyPrecisionError";
-  }
-  field;
-  value;
-  scale;
-};
-var MoneyCurrencyError = class extends NoydbError {
-  constructor(currency, reason, field) {
-    super(
-      "MONEY_CURRENCY",
-      reason === "not-allowed" ? `money: currency "${currency}" is not allowed${field ? ` for field "${field}"` : ""}` : `money: no scale known for currency "${currency}"${field ? ` (field "${field}")` : ""} \u2014 pass an explicit scale / scaleOverrides`
-    );
-    this.currency = currency;
-    this.reason = reason;
-    this.field = field;
-    this.name = "MoneyCurrencyError";
-  }
-  currency;
-  reason;
-  field;
-};
-var MoneyUnsupportedError = class extends NoydbError {
-  constructor(field, message) {
-    super(
-      "MONEY_UNSUPPORTED",
-      message ?? `money: operation is not supported on field "${field}" \u2014 use sum() and count() and divide at the boundary`
-    );
-    this.field = field;
-    this.name = "MoneyUnsupportedError";
-  }
-  field;
-};
-function isMultiOptions(o) {
-  return "currencies" in o;
-}
-function money(options) {
-  linkMoneyVia();
-  const hasFixed = "currency" in options;
-  const hasMulti = "currencies" in options;
-  if (hasFixed && hasMulti) {
-    throw new TypeError("money: `currency` and `currencies` are mutually exclusive");
-  }
-  if (!hasFixed && !hasMulti) {
-    throw new TypeError("money: one of `currency` or `currencies` is required");
-  }
-  const rounding = options.rounding;
-  if (isMultiOptions(options)) {
-    const overrides = options.scaleOverrides ?? {};
-    const allowList = options.currencies;
-    const allows = (c) => allowList === "any" ? true : allowList.includes(c);
-    const scaleFor = (c) => {
-      if (!allows(c)) throw new MoneyCurrencyError(c, "not-allowed");
-      const s = overrides[c] ?? scaleForCurrency(c);
-      if (s === null || s === void 0) throw new MoneyCurrencyError(c, "unknown-scale");
-      return s;
-    };
-    if (allowList !== "any") for (const c of allowList) scaleFor(c);
-    const soleCurrency = () => allowList !== "any" && allowList.length === 1 ? allowList[0] : void 0;
-    return {
-      _noydbMoney: true,
-      _viaBrand: "money",
-      mode: "multi",
-      options,
-      rounding,
-      fixedCurrency: void 0,
-      scaleFor,
-      allows,
-      soleCurrency
-    };
-  }
-  const currency = options.currency;
-  const resolvedScale = options.scale ?? scaleForCurrency(currency);
-  if (resolvedScale === null || resolvedScale === void 0) {
-    throw new MoneyCurrencyError(currency, "unknown-scale");
-  }
-  return {
-    _noydbMoney: true,
-    _viaBrand: "money",
-    mode: "fixed",
-    options,
-    rounding,
-    fixedCurrency: currency,
-    scaleFor(c) {
-      if (c !== currency) throw new MoneyCurrencyError(c, "not-allowed");
-      return resolvedScale;
-    },
-    allows: (c) => c === currency,
-    soleCurrency: () => currency
-  };
-}
-function isMoneyDescriptor(x) {
-  return typeof x === "object" && x !== null && x._noydbMoney === true;
-}
-
-// src/via/money/arith.ts
-function parseAmount(label, amount, scale, rounding) {
-  const r = parseToScaledInt(amount, scale, rounding);
-  if (!r.ok) {
-    throw new MoneyUnsupportedError(
-      r.reason === "precision" ? `${label}: amount ${JSON.stringify(amount)} has more precision than scale ${scale} and no rounding mode is configured` : `${label}: amount ${JSON.stringify(amount)} is not a finite decimal`
-    );
-  }
-  return r.value;
-}
-function resolveScale(label, amount, explicit) {
-  if (explicit !== void 0) {
-    if (!Number.isInteger(explicit) || explicit < 0) {
-      throw new MoneyUnsupportedError(`${label}: scale must be a non-negative integer`);
-    }
-    return explicit;
-  }
-  const inferred = decimalScaleOf(amount);
-  if (inferred === null) {
-    throw new MoneyUnsupportedError(`${label}: amount ${JSON.stringify(amount)} is not a finite decimal`);
-  }
-  return inferred;
-}
-function mulRate(amount, rate, opts = {}) {
-  const scale = resolveScale("mulRate", amount, opts.scale);
-  const rounding = opts.rounding ?? "half-up";
-  const a = parseAmount("mulRate", amount, scale, rounding);
-  const rateScale = decimalScaleOf(rate);
-  if (rateScale === null) {
-    throw new MoneyUnsupportedError(`mulRate: rate ${JSON.stringify(rate)} is not a finite decimal`);
-  }
-  const r = parseToScaledInt(rate, rateScale);
-  if (!r.ok) {
-    throw new MoneyUnsupportedError(`mulRate: rate ${JSON.stringify(rate)} is not a finite decimal`);
-  }
-  const product = a * r.value;
-  return formatScaledInt(rescaleScaledInt(product, scale + rateScale, scale, rounding), scale);
-}
-function allocate(amount, weights, opts = {}) {
-  if (weights.length === 0) {
-    throw new MoneyUnsupportedError("allocate: weights must not be empty");
-  }
-  const scale = resolveScale("allocate", amount, opts.scale);
-  const a = parseAmount("allocate", amount, scale);
-  let weightScale = 0;
-  for (const w of weights) {
-    const s = decimalScaleOf(w);
-    if (s === null) {
-      throw new MoneyUnsupportedError(`allocate: weight ${JSON.stringify(w)} is not a finite decimal`);
-    }
-    if (s > weightScale) weightScale = s;
-  }
-  const scaledWeights = weights.map((w) => {
-    const r = parseToScaledInt(w, weightScale);
-    if (!r.ok || r.value < 0n) {
-      throw new MoneyUnsupportedError(`allocate: weight ${JSON.stringify(w)} must be a non-negative decimal`);
-    }
-    return r.value;
-  });
-  const sumW = scaledWeights.reduce((acc, w) => acc + w, 0n);
-  if (sumW === 0n) {
-    throw new MoneyUnsupportedError("allocate: weights must not all be zero");
-  }
-  const negative = a < 0n;
-  const mag = negative ? -a : a;
-  const base = [];
-  const remainders = [];
-  let distributed = 0n;
-  for (let i = 0; i < scaledWeights.length; i++) {
-    const product = mag * scaledWeights[i];
-    const share = product / sumW;
-    base.push(share);
-    distributed += share;
-    remainders.push({ index: i, rem: product % sumW });
-  }
-  let leftover = mag - distributed;
-  remainders.sort((x, y) => y.rem > x.rem ? 1 : y.rem < x.rem ? -1 : x.index - y.index);
-  for (const { index } of remainders) {
-    if (leftover === 0n) break;
-    base[index] = base[index] + 1n;
-    leftover -= 1n;
-  }
-  return base.map((p) => formatScaledInt(negative && p !== 0n ? -p : p, scale));
-}
-
-// src/via/money/branded.ts
-function asMoney(value) {
-  if (!isMoneyLike(value)) {
-    throw new MoneyUnsupportedError(`asMoney: ${JSON.stringify(value)} is not a finite decimal`);
-  }
-  return String(value).trim();
-}
-function isMoneyString(value) {
-  return typeof value === "string" && isMoneyLike(value);
-}
-function moneyNumber(value) {
-  if (!isMoneyLike(value)) {
-    throw new MoneyUnsupportedError(`moneyNumber: ${JSON.stringify(value)} is not a finite decimal`);
-  }
-  return Number(value);
-}
-function isMoneyLike(value) {
-  if (typeof value === "number") return Number.isFinite(value);
-  if (typeof value !== "string") return false;
-  return decimalScaleOf(value) !== null;
-}
-
-// src/via/computed/descriptor.ts
-function computed(fn, opts) {
-  return {
-    _viaBrand: "computed",
-    fn,
-    ...opts?.deps !== void 0 ? { deps: opts.deps } : {},
-    mode: opts?.mode ?? "materialized"
-  };
-}
-function isComputedDescriptor(x) {
-  return typeof x === "object" && x !== null && x._viaBrand === "computed";
+}
+function isComputedDescriptor(x) {
+  return typeof x === "object" && x !== null && x._viaBrand === "computed";
 }
 
 // src/via/lookup/binding.ts
@@ -2724,8 +946,62 @@ function dict(dimension, opts) {
     ...opts?.substitute !== void 0 ? { substitute: opts.substitute } : {}
   };
 }
+
+// src/with-sync/credentials.ts
+function requireAdminAccess(keyring) {
+  if (keyring.role !== "owner" && keyring.role !== "admin") {
+    throw new PermissionDeniedError(
+      `Sync credentials require owner or admin role. Current role: "${keyring.role}"`
+    );
+  }
+}
+async function putCredential(adapter, vault, keyring, credential) {
+  requireAdminAccess(keyring);
+  const getDek = await ensureCollectionDEK(adapter, vault, keyring);
+  const dek = await getDek(SYNC_CREDENTIALS_COLLECTION);
+  const { iv, data } = await encrypt(JSON.stringify(credential), dek);
+  const existing = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, credential.adapterId);
+  const version = existing ? existing._v + 1 : 1;
+  const envelope = {
+    _noydb: NOYDB_FORMAT_VERSION,
+    _v: version,
+    _ts: (/* @__PURE__ */ new Date()).toISOString(),
+    _iv: iv,
+    _data: data,
+    _by: keyring.userId
+  };
+  await adapter.put(
+    vault,
+    SYNC_CREDENTIALS_COLLECTION,
+    credential.adapterId,
+    envelope,
+    existing ? existing._v : void 0
+  );
+}
+async function getCredential(adapter, vault, keyring, adapterId) {
+  requireAdminAccess(keyring);
+  const getDek = await ensureCollectionDEK(adapter, vault, keyring);
+  const dek = await getDek(SYNC_CREDENTIALS_COLLECTION);
+  const envelope = await adapter.get(vault, SYNC_CREDENTIALS_COLLECTION, adapterId);
+  if (!envelope) return null;
+  const plaintext = await openEnvelopeJson(envelope, dek);
+  return JSON.parse(plaintext);
+}
+async function deleteCredential(adapter, vault, keyring, adapterId) {
+  requireAdminAccess(keyring);
+  await adapter.delete(vault, SYNC_CREDENTIALS_COLLECTION, adapterId);
+}
+async function listCredentials(adapter, vault, keyring) {
+  requireAdminAccess(keyring);
+  return adapter.list(vault, SYNC_CREDENTIALS_COLLECTION);
+}
+async function credentialStatus(adapter, vault, keyring, adapterId) {
+  const credential = await getCredential(adapter, vault, keyring, adapterId);
+  if (!credential) return { exists: false };
+  const expired = credential.expiresAt ? Date.now() > new Date(credential.expiresAt).getTime() : false;
+  return { exists: true, expired };
+}
 export {
-  Aggregation,
   AlreadyElevatedError,
   AmendmentForbiddenError,
   AttestationError,
@@ -2740,6 +1016,7 @@ export {
   BackupCorruptedError,
   BackupLedgerError,
   BlobIntentPendingError,
+  BlobOfflineError,
   BlobSet,
   BundleIntegrityError,
   BundleSealMismatchError,
@@ -2765,20 +1042,15 @@ export {
   CrossJoinTooLargeError,
   CustodyApi,
   CustodyNotEnabledError,
-  DEED_RECORD_ID,
   DEFAULT_CHUNK_SIZE,
   DEFAULT_COVER_SCHEMA,
   DEFAULT_CROSS_JOIN_MAX_ROWS,
   DEFAULT_FRESHNESS_MS,
   DEFAULT_JOIN_MAX_ROWS,
-  DEFAULT_PUBLIC_ENVELOPE_SCHEMA,
-  DELEGATIONS_COLLECTION,
   DICT_COLLECTION_PREFIX,
   DIRECTORY_RECORD_ID,
   DanglingReferenceError,
   DataResidencyError,
-  DebugPlaintextError,
-  DebugReservedFieldError,
   DecryptionError,
   DelegationTargetMissingError,
   DerivationCapExceededError,
@@ -2801,12 +1073,7 @@ export {
   FieldNotQueryableError,
   FilenameSanitizationError,
   ForgetStrategyNotConfiguredError,
-  GROUPBY_MAX_CARDINALITY,
-  GROUPBY_WARN_CARDINALITY,
   GroupCardinalityError,
-  GroupedAggregation,
-  GroupedQuery,
-  GroupedQueryN,
   INDEXED_STORE_POLICY,
   IllegalTransitionError,
   ImportCapabilityError,
@@ -2825,9 +1092,7 @@ export {
   LinkIntegrityError,
   LocaleNotSpecifiedError,
   Lru,
-  MAGIC_LINK_CONTENT_INFO_PREFIX,
   MAGIC_LINK_GRANTS_COLLECTION,
-  MAGIC_LINK_KEK_INFO_PREFIX,
   META_COLLECTION,
   ManagedRecoveryNotEnrolledError,
   MaterializedViewConfigError,
@@ -2868,8 +1133,6 @@ export {
   PERSONAL_POLICY,
   POD_STORE_POLICY,
   POLICY_RECORD_ID,
-  PUBLIC_ENVELOPE_FIELDS,
-  PUBLIC_ENVELOPE_RECORD_ID,
   PathEscapeError,
   PeriodClosedError,
   PermissionDeniedError,
@@ -2897,7 +1160,6 @@ export {
   ReservedVaultNameError,
   RestrictRefUnresolvableError,
   SCHEMAS_COLLECTION,
-  SEALED_PASSPHRASE_RECORD_ID,
   STATE_VAULT_NAME,
   STRICT_POLICY,
   SYNC_CREDENTIALS_COLLECTION,
@@ -2952,7 +1214,7 @@ export {
   VaultFrame,
   VaultInstant,
   VaultTemplateNotFoundError,
-  WeakPassphraseError,
+  WeakSecretError,
   WithdrawalRequestError,
   activeSessionCount,
   additiveOnly,
@@ -2964,9 +1226,7 @@ export {
   applyPatch,
   approveWithdrawal,
   asMoney,
-  assertStrongPassphrase,
-  assertTierAccess,
-  avg,
+  assertStrongSecret,
   base64ToBuffer,
   blindUpdate,
   bufferToBase64,
@@ -2981,7 +1241,6 @@ export {
   computePatch,
   computed,
   coordinatedCutover,
-  count,
   createBundleStore,
   createDeedOwner,
   createEnforcer,
@@ -2994,7 +1253,6 @@ export {
   decryptBytes,
   decryptDeterministic,
   decryptExtractedPartition,
-  dekKey,
   deleteCredential,
   deleteIntent,
   deleteUserEnvelope,
@@ -3014,7 +1272,6 @@ export {
   dictKey,
   diff,
   diffVault,
-  effectiveClearance,
   enableDevUnlock,
   encryptBytes,
   encryptDeterministic,
@@ -3038,11 +1295,9 @@ export {
   generateULID,
   getCredential,
   getIntent,
-  groupAndReduce,
   hasExportCapability,
   hasImportCapability,
   hasNoydbBundleMagic,
-  hasRecoveryEnrolled,
   hashEntry,
   i18nText,
   immutableGuard,
@@ -3063,16 +1318,13 @@ export {
   isMoneyDescriptor,
   isMoneyString,
   isPreCompressed,
-  isPublicEnvelope,
   isRefArray,
   isSessionAlive,
   isStaticDictDescriptor,
   isULID,
   isViaFieldSpec,
   isZodSchema,
-  issueDelegation,
-  recoverPassphrase as keyringRecoverPassphrase,
-  rotatePassphrase as keyringRotatePassphrase,
+  rotateSecret as keyringRotateSecret,
   liberateVault,
   listCredentials,
   listMagicLinkGrants,
@@ -3080,41 +1332,30 @@ export {
   listUsers,
   listUsersWithEnvelopes,
   listWithdrawalRequests,
-  loadActiveDelegations,
   loadCover,
   loadDeedMarker,
   loadDevUnlock,
   loadPaperRecoveryEntries,
   loadPersistedSchema,
-  loadPublicEnvelope,
-  loadSealedPassphrase,
-  loadShamirRecoveryEntries,
   loadUserEnvelope,
   loadVaultPolicy,
   lockSchema,
   lookup,
   luhnCheck,
   magicLinkGrantRecordId,
-  max,
   memoryObjectProjection,
   memoryStore,
   mergeCrdtStates,
   mergePolicy,
-  min,
   mintPaperRecoveryEntry,
-  mintShamirRecoveryEntry,
   mintWrappedDeksBlob,
   money,
-  moneyMax,
-  moneyMin,
   moneyNumber,
-  moneySum,
   mulRate,
   paddedIndex,
   parseBytes,
   parseIndex,
   parseRsaOaepTlv,
-  parseSealedEnvelope,
   persistDirectoryConfig,
   persistSchemaIfNeeded,
   persistUserVisibility,
@@ -3124,34 +1365,25 @@ export {
   readMagicLinkGrantRecord,
   readNoydbBundle,
   readNoydbBundleHeader,
-  readNoydbBundlePublicEnvelope,
   readPath,
-  readPlaintextRecord,
   readPod,
   readPodCover,
   readPodHeader,
-  readPublicEnvelope,
   readUserVisibility,
   recoverUser,
-  reduceRecords,
-  reducerBuilder,
   ref,
   refArray,
   rejectWithdrawal,
   removeAuthenticator,
   requestWithdrawal,
-  resetBrotliSupportCache,
-  resetJoinWarnings,
   resolveClassifiedFields,
   resolveSchema as resolveCoverSchema,
   resolveCrdtSnapshot,
   resolveI18nText,
   resolvePolicy,
-  resolveSchema as resolvePublicEnvelopeSchema,
   resolveSequenceKey,
   resolveSession,
   revokeAllSessions,
-  revokeDelegation,
   revokeMagicLinkGrant,
   revokeSession,
   routeStore,
@@ -3159,29 +1391,23 @@ export {
   saveCover,
   savePaperRecoveryEntries,
   savePersistedSchema,
-  savePublicEnvelope,
-  saveSealedPassphrase,
-  saveShamirRecoveryEntries,
   saveUserEnvelope,
   saveVaultPolicy,
   scaleForCurrency,
   sealRsaOaepTlv,
   sha256Hex,
   staticDict,
-  sum,
   sweepBlobIntents,
   tokenize,
   transitionGuard,
   unwrapDeksFromBlob,
   unwrapDeksFromPaperEntry,
-  unwrapDeksFromShamirEntry,
   unwrapMagicLinkGrant,
   validateCoverInput,
   validateI18nTextValue,
-  validatePassphrase,
-  validatePublicEnvelopeInput,
   validateSchemaInput,
   validateSchemaOutput,
+  validateSecret,
   validateSessionPolicy,
   via,
   visibilityRecordId,