@noy-db/hub 0.1.0-pre.14 → 0.1.0-pre.16

package/dist/i18n/index.d.cts

@@ -1,10 +1,11 @@
-import { I as I18nStrategy } from '../types-2JGVRzO2.cjs';
-export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, e as I18nTextDescriptor, f as I18nTextOptions, g as applyI18nLocale, h as dictCollectionName, i as dictKey, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, r as resolveI18nText, v as validateI18nTextValue } from '../types-2JGVRzO2.cjs';
-export { D as DictKeyInUseError, a as DictKeyMissingError, L as LocaleNotSpecifiedError, M as MissingTranslationError, R as ReservedCollectionNameError, T as TranslatorNotConfiguredError } from '../index-CFJKJXWa.cjs';
+import { I as I18nStrategy } from '../types-DDy02bWN.cjs';
+export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, e as I18nTextDescriptor, f as I18nTextOptions, g as applyI18nLocale, h as dictCollectionName, i as dictKey, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, r as resolveI18nText, v as validateI18nTextValue } from '../types-DDy02bWN.cjs';
+export { D as DictKeyInUseError, a as DictKeyMissingError, L as LocaleNotSpecifiedError, M as MissingTranslationError, R as ReservedCollectionNameError, T as TranslatorNotConfiguredError } from '../index-CmVgTkqk.cjs';
 import '../lazy-builder-C-rPfWG0.cjs';
 import '../predicate-Dnu81tsS.cjs';
-import '../strategy-D-SrOLCl.cjs';
+import '../strategy-DSTrsZ8t.cjs';
 import '../strategy-BSxFXGzb.cjs';
+import '@noy-db/on-shamir';
 
 /**
  * Active i18n strategy — `withI18n()` returns the real implementation

package/dist/i18n/index.d.ts

@@ -1,10 +1,11 @@
-import { I as I18nStrategy } from '../types-DIOLYPUq.js';
-export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, e as I18nTextDescriptor, f as I18nTextOptions, g as applyI18nLocale, h as dictCollectionName, i as dictKey, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, r as resolveI18nText, v as validateI18nTextValue } from '../types-DIOLYPUq.js';
-export { D as DictKeyInUseError, a as DictKeyMissingError, L as LocaleNotSpecifiedError, M as MissingTranslationError, R as ReservedCollectionNameError, T as TranslatorNotConfiguredError } from '../index-7nd15fgy.js';
+import { I as I18nStrategy } from '../types-DImsOlJe.js';
+export { D as DICT_COLLECTION_PREFIX, a as DictEntry, b as DictKeyDescriptor, c as DictionaryHandle, d as DictionaryOptions, e as I18nTextDescriptor, f as I18nTextOptions, g as applyI18nLocale, h as dictCollectionName, i as dictKey, j as i18nText, k as isDictCollectionName, l as isDictKeyDescriptor, m as isI18nTextDescriptor, r as resolveI18nText, v as validateI18nTextValue } from '../types-DImsOlJe.js';
+export { D as DictKeyInUseError, a as DictKeyMissingError, L as LocaleNotSpecifiedError, M as MissingTranslationError, R as ReservedCollectionNameError, T as TranslatorNotConfiguredError } from '../index-CNwA-B6-.js';
 import '../lazy-builder-Rpd-V3jP.js';
 import '../predicate-Dnu81tsS.js';
-import '../strategy-D-SrOLCl.js';
+import '../strategy-DSTrsZ8t.js';
 import '../strategy-BSxFXGzb.js';
+import '@noy-db/on-shamir';
 
 /**
  * Active i18n strategy — `withI18n()` returns the real implementation

package/dist/i18n/index.js

@@ -10,11 +10,11 @@ import {
   isI18nTextDescriptor,
   resolveI18nText,
   validateI18nTextValue
-} from "../chunk-XFVOTOYQ.js";
-import "../chunk-7QGJ7RTL.js";
-import "../chunk-WLZWITX3.js";
-import "../chunk-PMMNH7VZ.js";
-import "../chunk-7AQKLLI5.js";
+} from "../chunk-O4RHR7FV.js";
+import "../chunk-RRMDLTIL.js";
+import "../chunk-2AXFIYHT.js";
+import "../chunk-H7XROQJM.js";
+import "../chunk-WCA2NROQ.js";
 import {
   DictKeyInUseError,
   DictKeyMissingError,
@@ -22,7 +22,7 @@ import {
   MissingTranslationError,
   ReservedCollectionNameError,
   TranslatorNotConfiguredError
-} from "../chunk-W7M3E5M5.js";
+} from "../chunk-ADQ5MQ54.js";
 
 // src/i18n/active.ts
 function withI18n() {

package/dist/{index-s31g3m-D.d.cts → index-BA7A-MJs.d.cts}

@@ -1,5 +1,5 @@
-import { be as PublicEnvelope, bq as BundleRecipient, bm as Vault } from './types-2JGVRzO2.cjs';
-import './index-CFJKJXWa.cjs';
+import { bh as PublicEnvelope, dj as SealingKeyProvider, bu as BundleRecipient, bq as Vault } from './types-DDy02bWN.cjs';
+import './index-CmVgTkqk.cjs';
 
 /**
  * `.noydb` container format — byte layout, header schema, validators.
@@ -124,6 +124,22 @@ interface NoydbBundleHeader {
      * other unknown header key still rejects at parse time.
      */
     readonly publicEnvelope?: PublicEnvelope;
+    /**
+     * Auto-unlock material indicator (#197). When present, the bundle
+     * body wraps the dump JSON in a structure carrying per-user
+     * passphrases — either plaintext (`'unsealed'`, public-by-design)
+     * or sealed under a `SealingKeyProvider` (`'sealed'`, requires
+     * matching provider on the recipient side).
+     *
+     * Visible pre-decompression so cloud listing UIs can warn before
+     * download: "this bundle opens itself for anyone holding the file"
+     * (unsealed) or "this bundle is sealed for a specific provider"
+     * (sealed).
+     *
+     * Absent → the body is a raw `vault.dump()` JSON string (the
+     * pre-#197 shape; back-compatible).
+     */
+    readonly autoUnlock?: 'unsealed' | 'sealed';
 }
 /**
  * Validate a parsed bundle header. Throws on any deviation from
@@ -259,6 +275,45 @@ interface WriteNoydbBundleOptions {
      * suited to personal backup-and-restore).
      */
     readonly recipients?: readonly BundleRecipient[];
+    /**
+     * Auto-unlock — unsealed per-user passphrases (#197 slice 1).
+     *
+     * Public-by-design: anyone holding the bundle bytes can read these
+     * plaintext credentials. Use for demo data, sample vaults,
+     * prospect onboarding.
+     *
+     * The `policy: 'public-by-design'` discriminant is mandatory. A
+     * bare `{ perUser }` without it is rejected at write time — the
+     * safety net against a careless call against a production vault.
+     *
+     * Mutually exclusive with `sealedPassphrases`.
+     */
+    readonly autoPassphrases?: {
+        readonly policy: 'public-by-design';
+        readonly perUser: Record<string, string>;
+    };
+    /**
+     * Auto-unlock — per-user passphrases sealed under a
+     * {@link SealingKeyProvider} (#197 slice 1, self-target only).
+     *
+     * The hub seals each user's plaintext passphrase under `provider`
+     * and embeds the resulting sealed envelopes in the bundle. The
+     * recipient must hold a provider with a matching `pid` (i.e.,
+     * `provider.id`) to auto-unseal on import.
+     *
+     * `mode: 'self-target'` is the only mode in slice 1 — sender and
+     * recipient share the same provider identity (same iCloud Keychain
+     * entry, same MDM-provisioned bundle id, same KMS account, etc.).
+     * Recipient-target sealing via the `RecipientSealer` interface
+     * (foundation §11.4) is deferred to a follow-up slice.
+     *
+     * Mutually exclusive with `autoPassphrases`.
+     */
+    readonly sealedPassphrases?: {
+        readonly mode: 'self-target';
+        readonly provider: SealingKeyProvider;
+        readonly perUser: Record<string, string>;
+    };
 }
 /**
  * Result returned by `readNoydbBundle`. The caller is expected to
@@ -269,6 +324,43 @@ interface WriteNoydbBundleOptions {
 interface NoydbBundleReadResult {
     readonly header: NoydbBundleHeader;
     readonly dumpJson: string;
+    /**
+     * Auto-unlock material (#197). Present only when the header's
+     * `autoUnlock` flag is set AND the body's wrapped structure
+     * survived parsing. Values are **plaintext** passphrases ready to
+     * pass to `createNoydb({ secret })` — either delivered plain
+     * (`kind: 'unsealed'`) or unsealed at read time using one of the
+     * supplied `sealingProviders` (`kind: 'sealed'`).
+     */
+    readonly autoUnlock?: {
+        readonly kind: 'unsealed' | 'sealed';
+        readonly perUser: Record<string, string>;
+    };
+}
+/**
+ * Options accepted by {@link readNoydbBundle} for the #197
+ * auto-unlock paths. Without these the reader behaves exactly as
+ * pre-#197 (header parsed; body returned as `dumpJson`).
+ */
+interface ReadNoydbBundleOptions {
+    /**
+     * Recipient-side sealing providers used to unseal entries from
+     * `sealedPassphrases`. The reader picks the one whose `.id`
+     * matches each entry's `pid`. Multiple providers may be supplied
+     * (different users may seal under different identities).
+     *
+     * When unset and the bundle carries sealed envelopes, the
+     * `autoUnlock.perUser` map remains the SEALED entries unmodified
+     * — callers can inspect them or unseal elsewhere.
+     */
+    readonly sealingProviders?: readonly SealingKeyProvider[];
+    /**
+     * Opt-in trial mode for unsealing — when an entry's `pid` doesn't
+     * match a registered provider, try each provider whose alg
+     * matches. Default `false` (strict-pid dispatch per foundation
+     * §11.9.2). Surfaces extra credential prompts; use deliberately.
+     */
+    readonly attemptUnsealAcrossProviders?: boolean;
 }
 /** Test-only: reset the brotli detection cache between tests. */
 declare function resetBrotliSupportCache(): void;
@@ -345,7 +437,7 @@ declare function readNoydbBundlePublicEnvelope(bytes: Uint8Array, opts?: {
  * free of crypto concerns and lets the same code feed format
  * inspectors that never decrypt anything.
  */
-declare function readNoydbBundle(bytes: Uint8Array): Promise<NoydbBundleReadResult>;
+declare function readNoydbBundle(bytes: Uint8Array, opts?: ReadNoydbBundleOptions): Promise<NoydbBundleReadResult>;
 
 /**
  * Minimal ULID generator — zero dependencies, Web Crypto API only.
@@ -412,4 +504,4 @@ declare function generateULID(): string;
  */
 declare function isULID(value: string): boolean;
 
-export { type CompressionAlgo as C, FLAG_COMPRESSED as F, NOYDB_BUNDLE_FORMAT_VERSION as N, type WriteNoydbBundleOptions as W, NOYDB_BUNDLE_MAGIC as a, NOYDB_BUNDLE_PREFIX_BYTES as b, type NoydbBundleHeader as c, type NoydbBundleReadResult as d, readNoydbBundleHeader as e, readNoydbBundlePublicEnvelope as f, generateULID as g, hasNoydbBundleMagic as h, isULID as i, resetBrotliSupportCache as j, COMPRESSION_BROTLI as k, COMPRESSION_GZIP as l, COMPRESSION_NONE as m, FLAG_HAS_INTEGRITY_HASH as n, encodeBundleHeader as o, readNoydbBundle as r, validateBundleHeader as v, writeNoydbBundle as w };
+export { type CompressionAlgo as C, FLAG_COMPRESSED as F, NOYDB_BUNDLE_FORMAT_VERSION as N, type ReadNoydbBundleOptions as R, type WriteNoydbBundleOptions as W, NOYDB_BUNDLE_MAGIC as a, NOYDB_BUNDLE_PREFIX_BYTES as b, type NoydbBundleHeader as c, type NoydbBundleReadResult as d, readNoydbBundleHeader as e, readNoydbBundlePublicEnvelope as f, generateULID as g, hasNoydbBundleMagic as h, isULID as i, resetBrotliSupportCache as j, COMPRESSION_BROTLI as k, COMPRESSION_GZIP as l, COMPRESSION_NONE as m, FLAG_HAS_INTEGRITY_HASH as n, encodeBundleHeader as o, readNoydbBundle as r, validateBundleHeader as v, writeNoydbBundle as w };

package/dist/{index-BWAXR9tV.d.ts → index-CLK67MZE.d.ts}

@@ -1,5 +1,5 @@
-import { be as PublicEnvelope, bq as BundleRecipient, bm as Vault } from './types-DIOLYPUq.js';
-import './index-7nd15fgy.js';
+import { bh as PublicEnvelope, dj as SealingKeyProvider, bu as BundleRecipient, bq as Vault } from './types-DImsOlJe.js';
+import './index-CNwA-B6-.js';
 
 /**
  * `.noydb` container format — byte layout, header schema, validators.
@@ -124,6 +124,22 @@ interface NoydbBundleHeader {
      * other unknown header key still rejects at parse time.
      */
     readonly publicEnvelope?: PublicEnvelope;
+    /**
+     * Auto-unlock material indicator (#197). When present, the bundle
+     * body wraps the dump JSON in a structure carrying per-user
+     * passphrases — either plaintext (`'unsealed'`, public-by-design)
+     * or sealed under a `SealingKeyProvider` (`'sealed'`, requires
+     * matching provider on the recipient side).
+     *
+     * Visible pre-decompression so cloud listing UIs can warn before
+     * download: "this bundle opens itself for anyone holding the file"
+     * (unsealed) or "this bundle is sealed for a specific provider"
+     * (sealed).
+     *
+     * Absent → the body is a raw `vault.dump()` JSON string (the
+     * pre-#197 shape; back-compatible).
+     */
+    readonly autoUnlock?: 'unsealed' | 'sealed';
 }
 /**
  * Validate a parsed bundle header. Throws on any deviation from
@@ -259,6 +275,45 @@ interface WriteNoydbBundleOptions {
      * suited to personal backup-and-restore).
      */
     readonly recipients?: readonly BundleRecipient[];
+    /**
+     * Auto-unlock — unsealed per-user passphrases (#197 slice 1).
+     *
+     * Public-by-design: anyone holding the bundle bytes can read these
+     * plaintext credentials. Use for demo data, sample vaults,
+     * prospect onboarding.
+     *
+     * The `policy: 'public-by-design'` discriminant is mandatory. A
+     * bare `{ perUser }` without it is rejected at write time — the
+     * safety net against a careless call against a production vault.
+     *
+     * Mutually exclusive with `sealedPassphrases`.
+     */
+    readonly autoPassphrases?: {
+        readonly policy: 'public-by-design';
+        readonly perUser: Record<string, string>;
+    };
+    /**
+     * Auto-unlock — per-user passphrases sealed under a
+     * {@link SealingKeyProvider} (#197 slice 1, self-target only).
+     *
+     * The hub seals each user's plaintext passphrase under `provider`
+     * and embeds the resulting sealed envelopes in the bundle. The
+     * recipient must hold a provider with a matching `pid` (i.e.,
+     * `provider.id`) to auto-unseal on import.
+     *
+     * `mode: 'self-target'` is the only mode in slice 1 — sender and
+     * recipient share the same provider identity (same iCloud Keychain
+     * entry, same MDM-provisioned bundle id, same KMS account, etc.).
+     * Recipient-target sealing via the `RecipientSealer` interface
+     * (foundation §11.4) is deferred to a follow-up slice.
+     *
+     * Mutually exclusive with `autoPassphrases`.
+     */
+    readonly sealedPassphrases?: {
+        readonly mode: 'self-target';
+        readonly provider: SealingKeyProvider;
+        readonly perUser: Record<string, string>;
+    };
 }
 /**
  * Result returned by `readNoydbBundle`. The caller is expected to
@@ -269,6 +324,43 @@ interface WriteNoydbBundleOptions {
 interface NoydbBundleReadResult {
     readonly header: NoydbBundleHeader;
     readonly dumpJson: string;
+    /**
+     * Auto-unlock material (#197). Present only when the header's
+     * `autoUnlock` flag is set AND the body's wrapped structure
+     * survived parsing. Values are **plaintext** passphrases ready to
+     * pass to `createNoydb({ secret })` — either delivered plain
+     * (`kind: 'unsealed'`) or unsealed at read time using one of the
+     * supplied `sealingProviders` (`kind: 'sealed'`).
+     */
+    readonly autoUnlock?: {
+        readonly kind: 'unsealed' | 'sealed';
+        readonly perUser: Record<string, string>;
+    };
+}
+/**
+ * Options accepted by {@link readNoydbBundle} for the #197
+ * auto-unlock paths. Without these the reader behaves exactly as
+ * pre-#197 (header parsed; body returned as `dumpJson`).
+ */
+interface ReadNoydbBundleOptions {
+    /**
+     * Recipient-side sealing providers used to unseal entries from
+     * `sealedPassphrases`. The reader picks the one whose `.id`
+     * matches each entry's `pid`. Multiple providers may be supplied
+     * (different users may seal under different identities).
+     *
+     * When unset and the bundle carries sealed envelopes, the
+     * `autoUnlock.perUser` map remains the SEALED entries unmodified
+     * — callers can inspect them or unseal elsewhere.
+     */
+    readonly sealingProviders?: readonly SealingKeyProvider[];
+    /**
+     * Opt-in trial mode for unsealing — when an entry's `pid` doesn't
+     * match a registered provider, try each provider whose alg
+     * matches. Default `false` (strict-pid dispatch per foundation
+     * §11.9.2). Surfaces extra credential prompts; use deliberately.
+     */
+    readonly attemptUnsealAcrossProviders?: boolean;
 }
 /** Test-only: reset the brotli detection cache between tests. */
 declare function resetBrotliSupportCache(): void;
@@ -345,7 +437,7 @@ declare function readNoydbBundlePublicEnvelope(bytes: Uint8Array, opts?: {
  * free of crypto concerns and lets the same code feed format
  * inspectors that never decrypt anything.
  */
-declare function readNoydbBundle(bytes: Uint8Array): Promise<NoydbBundleReadResult>;
+declare function readNoydbBundle(bytes: Uint8Array, opts?: ReadNoydbBundleOptions): Promise<NoydbBundleReadResult>;
 
 /**
  * Minimal ULID generator — zero dependencies, Web Crypto API only.
@@ -412,4 +504,4 @@ declare function generateULID(): string;
  */
 declare function isULID(value: string): boolean;
 
-export { type CompressionAlgo as C, FLAG_COMPRESSED as F, NOYDB_BUNDLE_FORMAT_VERSION as N, type WriteNoydbBundleOptions as W, NOYDB_BUNDLE_MAGIC as a, NOYDB_BUNDLE_PREFIX_BYTES as b, type NoydbBundleHeader as c, type NoydbBundleReadResult as d, readNoydbBundleHeader as e, readNoydbBundlePublicEnvelope as f, generateULID as g, hasNoydbBundleMagic as h, isULID as i, resetBrotliSupportCache as j, COMPRESSION_BROTLI as k, COMPRESSION_GZIP as l, COMPRESSION_NONE as m, FLAG_HAS_INTEGRITY_HASH as n, encodeBundleHeader as o, readNoydbBundle as r, validateBundleHeader as v, writeNoydbBundle as w };
+export { type CompressionAlgo as C, FLAG_COMPRESSED as F, NOYDB_BUNDLE_FORMAT_VERSION as N, type ReadNoydbBundleOptions as R, type WriteNoydbBundleOptions as W, NOYDB_BUNDLE_MAGIC as a, NOYDB_BUNDLE_PREFIX_BYTES as b, type NoydbBundleHeader as c, type NoydbBundleReadResult as d, readNoydbBundleHeader as e, readNoydbBundlePublicEnvelope as f, generateULID as g, hasNoydbBundleMagic as h, isULID as i, resetBrotliSupportCache as j, COMPRESSION_BROTLI as k, COMPRESSION_GZIP as l, COMPRESSION_NONE as m, FLAG_HAS_INTEGRITY_HASH as n, encodeBundleHeader as o, readNoydbBundle as r, validateBundleHeader as v, writeNoydbBundle as w };

package/dist/{index-7nd15fgy.d.ts → index-CNwA-B6-.d.ts}

@@ -1,5 +1,5 @@
 import { C as CollectionIndexes, a as Clause, O as Operator } from './predicate-Dnu81tsS.js';
-import { A as AggregateStrategy, b as AggregateSpec, c as Aggregation, a as AggregateResult, g as GroupedQuery } from './strategy-D-SrOLCl.js';
+import { A as AggregateStrategy, b as AggregateSpec, c as Aggregation, a as AggregateResult, g as GroupedQuery, h as GroupedQueryN } from './strategy-DSTrsZ8t.js';
 
 /**
  * All NOYDB error classes — a single import surface for `catch` blocks and
@@ -662,6 +662,33 @@ declare class IndexWriteFailureError extends NoydbError {
 declare class BundleIntegrityError extends NoydbError {
     constructor(message: string);
 }
+/**
+ * Thrown by `readNoydbBundle` (#197) when the bundle carries
+ * sealed per-user passphrases but no supplied `SealingKeyProvider`
+ * has a `.id` (= `pid`) matching the sealed entry's `pid`.
+ *
+ * Carries the failing pid + the user id so the recipient can
+ * surface an actionable prompt:
+ *
+ * ```
+ * BundleSealMismatchError: bundle carries sealed passphrase for user "alice"
+ *   under provider "macos-keychain:com.acme.app/alice@acme.example",
+ *   but no registered provider matches that pid.
+ * ```
+ *
+ * Three resolution paths the message names (per foundation §11.9.4):
+ *
+ * 1. Configure a provider matching the pid and retry import.
+ * 2. Pass `attemptUnsealAcrossProviders: true` to try each
+ *    registered provider regardless of pid.
+ * 3. Inspect without unsealing — pass no `sealingProviders` to
+ *    receive the sealed entries unmodified for offline analysis.
+ */
+declare class BundleSealMismatchError extends NoydbError {
+    readonly userId: string;
+    readonly pid: string;
+    constructor(userId: string, pid: string);
+}
 /**
  * Thrown when `vault.collection()` is called with a name that is
  * reserved for NOYDB internal use (any name starting with `_dict_`).
@@ -942,6 +969,23 @@ declare class DerivationOutputShapeError extends NoydbError {
     readonly outputKey: string;
     constructor(outputKey: string, detail: string);
 }
+/**
+ * Thrown by array-shape derivations (#200) when the `derive` function
+ * returns more rows than the output's `maxFanout` cap. The cap exists
+ * to keep dispatch cost bounded — without it a single source-row
+ * update could fan out to thousands of derived rows, dominating the
+ * write path.
+ *
+ * Defaults to `maxFanout: 64`. Raise on the output spec for
+ * carry-forward expansion cases (e.g. monthly rows across multi-year
+ * contracts).
+ */
+declare class DerivationCapExceededError extends NoydbError {
+    readonly outputKey: string;
+    readonly returned: number;
+    readonly maxFanout: number;
+    constructor(outputKey: string, returned: number, maxFanout: number);
+}
 /**
  * Thrown at vault open if the materialized-view graph contains a
  * cycle. `path` is the offending chain (e.g. `['a-mv', 'b-mv', 'a-mv']`).
@@ -976,6 +1020,29 @@ declare class MaterializedViewTooLargeError extends NoydbError {
     readonly limit: number;
     constructor(mvName: string, expected: number, limit: number);
 }
+/**
+ * Thrown by `withMaterializedView()` at registration time when the
+ * strategy is structurally malformed. Distinct from
+ * `MaterializedViewSourceUnknownError` (the source list is well-formed
+ * but names a collection the vault doesn't know) and
+ * `MaterializedViewCycleError` (the source graph has a cycle): this
+ * error fires before either check, at the moment the spec is being
+ * normalized.
+ *
+ * Today the trigger cases are all about the `query` / `unionSources`
+ * dichotomy introduced by #165:
+ *   - both `query` and `unionSources` were set (mutually exclusive),
+ *   - neither `query` nor `unionSources` was set,
+ *   - `unionSources` has fewer than 2 arms,
+ *   - two arms in `unionSources` reference the same `collection`.
+ *
+ * The error message is prefixed with `[noy-db] withMaterializedView:`
+ * so it's grep-friendly in logs and looks consistent with the existing
+ * `ValidationError` messages from the same factory.
+ */
+declare class MaterializedViewConfigError extends NoydbError {
+    constructor(message: string);
+}
 /**
  * Thrown at vault open when a `withOverlayedView` declaration uses
  * another virtual-overlay name as its `base`. Multi-overlay stacking
@@ -1788,6 +1855,7 @@ declare class Query<T> {
      * per record and can't be index-accelerated.
      */
     groupBy<F extends string>(field: F): GroupedQuery<T, F>;
+    groupBy<F extends readonly [string, string, ...string[]]>(...fields: F): GroupedQueryN<T, F>;
     /**
      * Re-run the query whenever the source notifies of changes.
      * Returns an unsubscribe function. The callback receives the latest result.
@@ -2167,4 +2235,4 @@ declare class ScanBuilder<T> implements AsyncIterable<T> {
     private recordMatches;
 }
 
-export { type LiveQuery as $, AmendmentForbiddenError as A, BackupCorruptedError as B, ConflictError as C, DictKeyInUseError as D, ElevationExpiredError as E, FieldFrozenError as F, GroupCardinalityError as G, IndexRequiredError as H, InvariantError as I, IndexWriteFailureError as J, InvalidKeyError as K, LocaleNotSpecifiedError as L, MissingTranslationError as M, NoydbError as N, OverlayBaseIsVirtualError as O, type JoinContext as P, Query as Q, ReservedCollectionNameError as R, SessionExpiredError as S, TranslatorNotConfiguredError as T, type JoinLeg as U, type JoinStrategy as V, JoinTooLargeError as W, type JoinableSource as X, KeyringCorruptError as Y, KeyringExpiredError as Z, LedgerContentionError as _, DictKeyMissingError as a, type LiveUpstream as a0, NetworkError as a1, NoAccessError as a2, NotFoundError as a3, type OrderBy as a4, PathEscapeError as a5, PeriodClosedError as a6, PermissionDeniedError as a7, PrivilegeEscalationError as a8, type QueryPlan as a9, type QuerySource as aa, ReadOnlyAtInstantError as ab, ReadOnlyError as ac, ReadOnlyFrameError as ad, type RefDescriptor as ae, RefIntegrityError as af, type RefMode as ag, RefRegistry as ah, RefScopeError as ai, type RefViolation as aj, ScanBuilder as ak, type ScanPageProvider as al, SchemaValidationError as am, StoreCapabilityError as an, TamperedError as ao, TierDemoteDeniedError as ap, TierNotGrantedError as aq, ValidationError as ar, applyJoins as as, buildLiveQuery as at, executePlan as au, ref as av, resetJoinWarnings as aw, SessionNotFoundError as b, SessionPolicyError as c, RecordLockedError as d, DerivationCycleError as e, DerivationDepthError as f, DerivationOutputShapeError as g, DerivationOutputUnknownError as h, OverlayCollectionUnavailableError as i, OverlayIdMismatchError as j, OverlayNameCollisionError as k, MaterializedViewCycleError as l, MaterializedViewSourceUnknownError as m, MaterializedViewTooLargeError as n, AlreadyElevatedError as o, BackupLedgerError as p, BundleIntegrityError as q, BundleVersionConflictError as r, DEFAULT_JOIN_MAX_ROWS as s, DanglingReferenceError as t, DecryptionError as u, DelegationTargetMissingError as v, DirectoryDisabledError as w, ExportCapabilityError as x, FilenameSanitizationError as y, ImportCapabilityError as z };
+export { KeyringCorruptError as $, AmendmentForbiddenError as A, BackupCorruptedError as B, ConflictError as C, DictKeyInUseError as D, ElevationExpiredError as E, FieldFrozenError as F, ExportCapabilityError as G, FilenameSanitizationError as H, InvariantError as I, GroupCardinalityError as J, ImportCapabilityError as K, LocaleNotSpecifiedError as L, MissingTranslationError as M, NoydbError as N, OverlayBaseIsVirtualError as O, IndexRequiredError as P, Query as Q, ReservedCollectionNameError as R, SessionExpiredError as S, TranslatorNotConfiguredError as T, IndexWriteFailureError as U, InvalidKeyError as V, type JoinContext as W, type JoinLeg as X, type JoinStrategy as Y, JoinTooLargeError as Z, type JoinableSource as _, DictKeyMissingError as a, KeyringExpiredError as a0, LedgerContentionError as a1, type LiveQuery as a2, type LiveUpstream as a3, NetworkError as a4, NoAccessError as a5, NotFoundError as a6, type OrderBy as a7, PathEscapeError as a8, PeriodClosedError as a9, PermissionDeniedError as aa, PrivilegeEscalationError as ab, type QueryPlan as ac, type QuerySource as ad, ReadOnlyAtInstantError as ae, ReadOnlyError as af, ReadOnlyFrameError as ag, type RefDescriptor as ah, RefIntegrityError as ai, type RefMode as aj, RefRegistry as ak, RefScopeError as al, type RefViolation as am, ScanBuilder as an, type ScanPageProvider as ao, SchemaValidationError as ap, StoreCapabilityError as aq, TamperedError as ar, TierDemoteDeniedError as as, TierNotGrantedError as at, ValidationError as au, applyJoins as av, buildLiveQuery as aw, executePlan as ax, ref as ay, resetJoinWarnings as az, SessionNotFoundError as b, SessionPolicyError as c, RecordLockedError as d, DerivationCapExceededError as e, DerivationCycleError as f, DerivationDepthError as g, DerivationOutputShapeError as h, DerivationOutputUnknownError as i, OverlayCollectionUnavailableError as j, OverlayIdMismatchError as k, OverlayNameCollisionError as l, MaterializedViewConfigError as m, MaterializedViewCycleError as n, MaterializedViewSourceUnknownError as o, MaterializedViewTooLargeError as p, AlreadyElevatedError as q, BackupLedgerError as r, BundleIntegrityError as s, BundleSealMismatchError as t, BundleVersionConflictError as u, DEFAULT_JOIN_MAX_ROWS as v, DanglingReferenceError as w, DecryptionError as x, DelegationTargetMissingError as y, DirectoryDisabledError as z };

package/dist/{index-CFJKJXWa.d.cts → index-CmVgTkqk.d.cts}

@@ -1,5 +1,5 @@
 import { C as CollectionIndexes, a as Clause, O as Operator } from './predicate-Dnu81tsS.cjs';
-import { A as AggregateStrategy, b as AggregateSpec, c as Aggregation, a as AggregateResult, g as GroupedQuery } from './strategy-D-SrOLCl.cjs';
+import { A as AggregateStrategy, b as AggregateSpec, c as Aggregation, a as AggregateResult, g as GroupedQuery, h as GroupedQueryN } from './strategy-DSTrsZ8t.cjs';
 
 /**
  * All NOYDB error classes — a single import surface for `catch` blocks and
@@ -662,6 +662,33 @@ declare class IndexWriteFailureError extends NoydbError {
 declare class BundleIntegrityError extends NoydbError {
     constructor(message: string);
 }
+/**
+ * Thrown by `readNoydbBundle` (#197) when the bundle carries
+ * sealed per-user passphrases but no supplied `SealingKeyProvider`
+ * has a `.id` (= `pid`) matching the sealed entry's `pid`.
+ *
+ * Carries the failing pid + the user id so the recipient can
+ * surface an actionable prompt:
+ *
+ * ```
+ * BundleSealMismatchError: bundle carries sealed passphrase for user "alice"
+ *   under provider "macos-keychain:com.acme.app/alice@acme.example",
+ *   but no registered provider matches that pid.
+ * ```
+ *
+ * Three resolution paths the message names (per foundation §11.9.4):
+ *
+ * 1. Configure a provider matching the pid and retry import.
+ * 2. Pass `attemptUnsealAcrossProviders: true` to try each
+ *    registered provider regardless of pid.
+ * 3. Inspect without unsealing — pass no `sealingProviders` to
+ *    receive the sealed entries unmodified for offline analysis.
+ */
+declare class BundleSealMismatchError extends NoydbError {
+    readonly userId: string;
+    readonly pid: string;
+    constructor(userId: string, pid: string);
+}
 /**
  * Thrown when `vault.collection()` is called with a name that is
  * reserved for NOYDB internal use (any name starting with `_dict_`).
@@ -942,6 +969,23 @@ declare class DerivationOutputShapeError extends NoydbError {
     readonly outputKey: string;
     constructor(outputKey: string, detail: string);
 }
+/**
+ * Thrown by array-shape derivations (#200) when the `derive` function
+ * returns more rows than the output's `maxFanout` cap. The cap exists
+ * to keep dispatch cost bounded — without it a single source-row
+ * update could fan out to thousands of derived rows, dominating the
+ * write path.
+ *
+ * Defaults to `maxFanout: 64`. Raise on the output spec for
+ * carry-forward expansion cases (e.g. monthly rows across multi-year
+ * contracts).
+ */
+declare class DerivationCapExceededError extends NoydbError {
+    readonly outputKey: string;
+    readonly returned: number;
+    readonly maxFanout: number;
+    constructor(outputKey: string, returned: number, maxFanout: number);
+}
 /**
  * Thrown at vault open if the materialized-view graph contains a
  * cycle. `path` is the offending chain (e.g. `['a-mv', 'b-mv', 'a-mv']`).
@@ -976,6 +1020,29 @@ declare class MaterializedViewTooLargeError extends NoydbError {
     readonly limit: number;
     constructor(mvName: string, expected: number, limit: number);
 }
+/**
+ * Thrown by `withMaterializedView()` at registration time when the
+ * strategy is structurally malformed. Distinct from
+ * `MaterializedViewSourceUnknownError` (the source list is well-formed
+ * but names a collection the vault doesn't know) and
+ * `MaterializedViewCycleError` (the source graph has a cycle): this
+ * error fires before either check, at the moment the spec is being
+ * normalized.
+ *
+ * Today the trigger cases are all about the `query` / `unionSources`
+ * dichotomy introduced by #165:
+ *   - both `query` and `unionSources` were set (mutually exclusive),
+ *   - neither `query` nor `unionSources` was set,
+ *   - `unionSources` has fewer than 2 arms,
+ *   - two arms in `unionSources` reference the same `collection`.
+ *
+ * The error message is prefixed with `[noy-db] withMaterializedView:`
+ * so it's grep-friendly in logs and looks consistent with the existing
+ * `ValidationError` messages from the same factory.
+ */
+declare class MaterializedViewConfigError extends NoydbError {
+    constructor(message: string);
+}
 /**
  * Thrown at vault open when a `withOverlayedView` declaration uses
  * another virtual-overlay name as its `base`. Multi-overlay stacking
@@ -1788,6 +1855,7 @@ declare class Query<T> {
      * per record and can't be index-accelerated.
      */
     groupBy<F extends string>(field: F): GroupedQuery<T, F>;
+    groupBy<F extends readonly [string, string, ...string[]]>(...fields: F): GroupedQueryN<T, F>;
     /**
      * Re-run the query whenever the source notifies of changes.
      * Returns an unsubscribe function. The callback receives the latest result.
@@ -2167,4 +2235,4 @@ declare class ScanBuilder<T> implements AsyncIterable<T> {
     private recordMatches;
 }
 
-export { type LiveQuery as $, AmendmentForbiddenError as A, BackupCorruptedError as B, ConflictError as C, DictKeyInUseError as D, ElevationExpiredError as E, FieldFrozenError as F, GroupCardinalityError as G, IndexRequiredError as H, InvariantError as I, IndexWriteFailureError as J, InvalidKeyError as K, LocaleNotSpecifiedError as L, MissingTranslationError as M, NoydbError as N, OverlayBaseIsVirtualError as O, type JoinContext as P, Query as Q, ReservedCollectionNameError as R, SessionExpiredError as S, TranslatorNotConfiguredError as T, type JoinLeg as U, type JoinStrategy as V, JoinTooLargeError as W, type JoinableSource as X, KeyringCorruptError as Y, KeyringExpiredError as Z, LedgerContentionError as _, DictKeyMissingError as a, type LiveUpstream as a0, NetworkError as a1, NoAccessError as a2, NotFoundError as a3, type OrderBy as a4, PathEscapeError as a5, PeriodClosedError as a6, PermissionDeniedError as a7, PrivilegeEscalationError as a8, type QueryPlan as a9, type QuerySource as aa, ReadOnlyAtInstantError as ab, ReadOnlyError as ac, ReadOnlyFrameError as ad, type RefDescriptor as ae, RefIntegrityError as af, type RefMode as ag, RefRegistry as ah, RefScopeError as ai, type RefViolation as aj, ScanBuilder as ak, type ScanPageProvider as al, SchemaValidationError as am, StoreCapabilityError as an, TamperedError as ao, TierDemoteDeniedError as ap, TierNotGrantedError as aq, ValidationError as ar, applyJoins as as, buildLiveQuery as at, executePlan as au, ref as av, resetJoinWarnings as aw, SessionNotFoundError as b, SessionPolicyError as c, RecordLockedError as d, DerivationCycleError as e, DerivationDepthError as f, DerivationOutputShapeError as g, DerivationOutputUnknownError as h, OverlayCollectionUnavailableError as i, OverlayIdMismatchError as j, OverlayNameCollisionError as k, MaterializedViewCycleError as l, MaterializedViewSourceUnknownError as m, MaterializedViewTooLargeError as n, AlreadyElevatedError as o, BackupLedgerError as p, BundleIntegrityError as q, BundleVersionConflictError as r, DEFAULT_JOIN_MAX_ROWS as s, DanglingReferenceError as t, DecryptionError as u, DelegationTargetMissingError as v, DirectoryDisabledError as w, ExportCapabilityError as x, FilenameSanitizationError as y, ImportCapabilityError as z };
+export { KeyringCorruptError as $, AmendmentForbiddenError as A, BackupCorruptedError as B, ConflictError as C, DictKeyInUseError as D, ElevationExpiredError as E, FieldFrozenError as F, ExportCapabilityError as G, FilenameSanitizationError as H, InvariantError as I, GroupCardinalityError as J, ImportCapabilityError as K, LocaleNotSpecifiedError as L, MissingTranslationError as M, NoydbError as N, OverlayBaseIsVirtualError as O, IndexRequiredError as P, Query as Q, ReservedCollectionNameError as R, SessionExpiredError as S, TranslatorNotConfiguredError as T, IndexWriteFailureError as U, InvalidKeyError as V, type JoinContext as W, type JoinLeg as X, type JoinStrategy as Y, JoinTooLargeError as Z, type JoinableSource as _, DictKeyMissingError as a, KeyringExpiredError as a0, LedgerContentionError as a1, type LiveQuery as a2, type LiveUpstream as a3, NetworkError as a4, NoAccessError as a5, NotFoundError as a6, type OrderBy as a7, PathEscapeError as a8, PeriodClosedError as a9, PermissionDeniedError as aa, PrivilegeEscalationError as ab, type QueryPlan as ac, type QuerySource as ad, ReadOnlyAtInstantError as ae, ReadOnlyError as af, ReadOnlyFrameError as ag, type RefDescriptor as ah, RefIntegrityError as ai, type RefMode as aj, RefRegistry as ak, RefScopeError as al, type RefViolation as am, ScanBuilder as an, type ScanPageProvider as ao, SchemaValidationError as ap, StoreCapabilityError as aq, TamperedError as ar, TierDemoteDeniedError as as, TierNotGrantedError as at, ValidationError as au, applyJoins as av, buildLiveQuery as aw, executePlan as ax, ref as ay, resetJoinWarnings as az, SessionNotFoundError as b, SessionPolicyError as c, RecordLockedError as d, DerivationCapExceededError as e, DerivationCycleError as f, DerivationDepthError as g, DerivationOutputShapeError as h, DerivationOutputUnknownError as i, OverlayCollectionUnavailableError as j, OverlayIdMismatchError as k, OverlayNameCollisionError as l, MaterializedViewConfigError as m, MaterializedViewCycleError as n, MaterializedViewSourceUnknownError as o, MaterializedViewTooLargeError as p, AlreadyElevatedError as q, BackupLedgerError as r, BundleIntegrityError as s, BundleSealMismatchError as t, BundleVersionConflictError as u, DEFAULT_JOIN_MAX_ROWS as v, DanglingReferenceError as w, DecryptionError as x, DelegationTargetMissingError as y, DirectoryDisabledError as z };