@noy-db/hub 0.2.0-pre.10 → 0.2.0-pre.12

package/dist/index.cjs

@@ -46,7 +46,7 @@ var init_types = __esm({
 });
 
 // src/errors.ts
-var NoydbError, DecryptionError, TamperedError, InvalidKeyError, KeyringCorruptError, NoAccessError, ReadOnlyError, ReadOnlyAtInstantError, ReadOnlyFrameError, PermissionDeniedError, ExportCapabilityError, KeyringExpiredError, ImportCapabilityError, StoreCapabilityError, PrivilegeEscalationError, PeriodClosedError, RecordLockedError, FieldFrozenError, InvariantError, AmendmentForbiddenError, DirectoryDisabledError, TierNotGrantedError, ElevationExpiredError, AlreadyElevatedError, TierDemoteDeniedError, DelegationTargetMissingError, ConflictError, LedgerContentionError, BundleVersionConflictError, NetworkError, NotFoundError, ValidationError, SchemaValidationError, SchemaUpdateError, NonAdditiveSchemaChangeError, SchemaLockedError, SchemaFenceError, MigrationRequiredError, QuiesceTimeoutError, GroupCardinalityError, IndexRequiredError, UniqueConstraintError, UnsupportedIndexOptionError, IndexWriteFailureError, BundleIntegrityError, BundleSealMismatchError, ReservedCollectionNameError, DictKeyMissingError, DictKeyInUseError, MissingTranslationError, LocaleNotSpecifiedError, ScriptViolationError, TranslatorNotConfiguredError, BackupLedgerError, BackupCorruptedError, AttestationError, SessionExpiredError, SessionNotFoundError, SessionPolicyError, JoinTooLargeError, CrossJoinTooLargeError, CrossJoinSourceUnknownError, DanglingReferenceError, FilenameSanitizationError, PathEscapeError, DerivationCycleError, DerivationDepthError, DerivationOutputUnknownError, DerivationOutputShapeError, DerivationCapExceededError, MaterializedViewCycleError, MaterializedViewSourceUnknownError, MaterializedViewTooLargeError, MaterializedViewConfigError, OverlayBaseIsVirtualError, OverlayCollectionUnavailableError, OverlayNameCollisionError, OverlayIdMismatchError, SnapshotNotFoundError;
+var NoydbError, DecryptionError, TamperedError, InvalidKeyError, KeyringCorruptError, NoAccessError, ReadOnlyError, ReadOnlyAtInstantError, ReadOnlyFrameError, PermissionDeniedError, ExportCapabilityError, KeyringExpiredError, ImportCapabilityError, StoreCapabilityError, PrivilegeEscalationError, PeriodClosedError, RecordLockedError, FieldFrozenError, InvariantError, AmendmentForbiddenError, DirectoryDisabledError, TierNotGrantedError, ElevationExpiredError, AlreadyElevatedError, TierDemoteDeniedError, DelegationTargetMissingError, ConflictError, LedgerContentionError, SequenceContentionError, SequenceOfflineError, BundleVersionConflictError, NetworkError, NotFoundError, ValidationError, SchemaValidationError, SchemaUpdateError, NonAdditiveSchemaChangeError, SchemaLockedError, SchemaFenceError, MigrationRequiredError, QuiesceTimeoutError, GroupCardinalityError, IndexRequiredError, UniqueConstraintError, UnsupportedIndexOptionError, IndexWriteFailureError, BundleIntegrityError, BundleSealMismatchError, ReservedCollectionNameError, DictKeyMissingError, DictKeyInUseError, MissingTranslationError, LocaleNotSpecifiedError, ScriptViolationError, TranslatorNotConfiguredError, BackupLedgerError, BackupCorruptedError, AttestationError, SessionExpiredError, SessionNotFoundError, SessionPolicyError, JoinTooLargeError, CrossJoinTooLargeError, CrossJoinSourceUnknownError, DanglingReferenceError, FilenameSanitizationError, PathEscapeError, DerivationCycleError, DerivationDepthError, DerivationOutputUnknownError, DerivationOutputShapeError, DerivationCapExceededError, MaterializedViewCycleError, MaterializedViewSourceUnknownError, MaterializedViewTooLargeError, MaterializedViewConfigError, OverlayBaseIsVirtualError, OverlayCollectionUnavailableError, OverlayNameCollisionError, OverlayIdMismatchError, SnapshotNotFoundError, UnknownShardError, ShardProvisioningError, VaultTemplateNotFoundError;
 var init_errors = __esm({
   "src/errors.ts"() {
     "use strict";
@@ -340,6 +340,28 @@ var init_errors = __esm({
         this.attempts = attempts;
       }
     };
+    SequenceContentionError = class extends NoydbError {
+      sequence;
+      attempts;
+      constructor(sequence, attempts) {
+        super(
+          "SEQUENCE_CONTENTION",
+          `vault.sequence("${sequence}").next(): failed to allocate after ${attempts} optimistic-CAS retries`
+        );
+        this.name = "SequenceContentionError";
+        this.sequence = sequence;
+        this.attempts = attempts;
+      }
+    };
+    SequenceOfflineError = class extends NoydbError {
+      constructor() {
+        super(
+          "SEQUENCE_OFFLINE",
+          "vault.sequence().next() requires an online CAS-capable store (capabilities.casAtomic). Gap-free numbering cannot be serialized offline."
+        );
+        this.name = "SequenceOfflineError";
+      }
+    };
     BundleVersionConflictError = class extends NoydbError {
       /** The bundle handle of the newer remote version that rejected the push. */
       remoteVersion;
@@ -451,14 +473,14 @@ var init_errors = __esm({
       recordId;
       fields;
       conflictingId;
-      constructor(collection, recordId2, fields, conflictingId) {
+      constructor(collection, recordId3, fields, conflictingId) {
         super(
           "UNIQUE_CONSTRAINT",
-          `Unique constraint on ${collection}.[${fields.join(", ")}] violated: record "${recordId2}" duplicates a value already held by "${conflictingId}".`
+          `Unique constraint on ${collection}.[${fields.join(", ")}] violated: record "${recordId3}" duplicates a value already held by "${conflictingId}".`
         );
         this.name = "UniqueConstraintError";
         this.collection = collection;
-        this.recordId = recordId2;
+        this.recordId = recordId3;
         this.fields = fields;
         this.conflictingId = conflictingId;
       }
@@ -921,6 +943,39 @@ Resolutions:
         this.version = version;
       }
     };
+    UnknownShardError = class extends NoydbError {
+      partitionKey;
+      constructor(partitionKey, groupName) {
+        super(
+          "SHARD_UNKNOWN",
+          `No shard for partition key "${partitionKey}" in vault group "${groupName}" and autoCreate is disabled. Call group.createShard(${JSON.stringify(partitionKey)}) first, or enable sharding.autoCreate.`
+        );
+        this.name = "UnknownShardError";
+        this.partitionKey = partitionKey;
+      }
+    };
+    ShardProvisioningError = class extends NoydbError {
+      vaultId;
+      constructor(vaultId, partitionKey) {
+        super(
+          "SHARD_PROVISIONING",
+          `Registry has a row for partition "${partitionKey}" (vault "${vaultId}") but that vault is not provisioned in the store. Refusing to recreate it \u2014 the registry and store have diverged. Investigate before retrying.`
+        );
+        this.name = "ShardProvisioningError";
+        this.vaultId = vaultId;
+      }
+    };
+    VaultTemplateNotFoundError = class extends NoydbError {
+      templateName;
+      constructor(templateName) {
+        super(
+          "VAULT_TEMPLATE_NOT_FOUND",
+          `No vault template registered under "${templateName}". Register it with db.withVaultTemplate(${JSON.stringify(templateName)}, { version, configure }) before opening the vault group.`
+        );
+        this.name = "VaultTemplateNotFoundError";
+        this.templateName = templateName;
+      }
+    };
   }
 });
 
@@ -1685,7 +1740,7 @@ var init_hash = __esm({
 });
 
 // src/history/ledger/store.ts
-function sleepBackoff(attempt) {
+function sleepBackoff2(attempt) {
   const base = 5 * Math.pow(2, attempt);
   const jitter = Math.random() * base;
   return new Promise((resolve) => setTimeout(resolve, base + jitter));
@@ -1807,7 +1862,7 @@ var init_store = __esm({
             if (err instanceof ConflictError) {
               lastConflict = err;
               if (attempt < MAX_APPEND_ATTEMPTS - 1) {
-                await sleepBackoff(attempt);
+                await sleepBackoff2(attempt);
               }
               continue;
             }
@@ -2221,6 +2276,278 @@ var init_public_envelope = __esm({
   }
 });
 
+// src/money/fixed-point.ts
+function expandExponent(s) {
+  const m = /^([+-]?)(\d+)(?:\.(\d+))?[eE]([+-]?\d+)$/.exec(s);
+  if (!m) return s;
+  const sign = m[1] === "-" ? "-" : "";
+  const intp = m[2];
+  const frac = m[3] ?? "";
+  const exp = Number(m[4]);
+  const digits = intp + frac;
+  const pointPos = intp.length + exp;
+  let body;
+  if (pointPos <= 0) {
+    body = "0." + "0".repeat(-pointPos) + digits;
+  } else if (pointPos >= digits.length) {
+    body = digits + "0".repeat(pointPos - digits.length);
+  } else {
+    body = digits.slice(0, pointPos) + "." + digits.slice(pointPos);
+  }
+  return sign + body;
+}
+function toCanonicalDecimalString(input) {
+  let s;
+  if (typeof input === "number") {
+    if (!Number.isFinite(input)) return null;
+    s = String(input);
+  } else {
+    s = input.trim();
+  }
+  s = expandExponent(s);
+  if (s.startsWith("+")) s = s.slice(1);
+  if (!/^-?(\d+(\.\d*)?|\.\d+)$/.test(s)) return null;
+  return s;
+}
+function shouldRoundUp(negative, lastKeptDigit, firstDiscarded, hasMoreNonZeroAfterFirst, mode) {
+  switch (mode) {
+    case "up":
+      return true;
+    case "down":
+      return false;
+    case "ceil":
+      return !negative;
+    case "floor":
+      return negative;
+    case "half-up":
+      return firstDiscarded >= 5;
+    case "half-down":
+      return firstDiscarded > 5 || firstDiscarded === 5 && hasMoreNonZeroAfterFirst;
+    case "half-even":
+      if (firstDiscarded > 5) return true;
+      if (firstDiscarded < 5) return false;
+      return hasMoreNonZeroAfterFirst || lastKeptDigit % 2 === 1;
+  }
+}
+function parseToScaledInt(input, scale, rounding) {
+  const canonical = toCanonicalDecimalString(input);
+  if (canonical === null) return { ok: false, reason: "nonfinite" };
+  const negative = canonical.startsWith("-");
+  const unsigned = negative ? canonical.slice(1) : canonical;
+  const dot = unsigned.indexOf(".");
+  const intPart = dot === -1 ? unsigned : unsigned.slice(0, dot);
+  const fracPart = dot === -1 ? "" : unsigned.slice(dot + 1);
+  const intDigits = intPart === "" ? "0" : intPart;
+  if (fracPart.length <= scale) {
+    const keep2 = fracPart.padEnd(scale, "0");
+    const magnitude2 = BigInt(intDigits + keep2);
+    return { ok: true, value: negative && magnitude2 !== 0n ? -magnitude2 : magnitude2 };
+  }
+  const keep = fracPart.slice(0, scale);
+  const tail = fracPart.slice(scale);
+  const magnitudeDigits = intDigits + keep;
+  let magnitude = BigInt(magnitudeDigits);
+  if (/^0+$/.test(tail)) {
+    return { ok: true, value: negative && magnitude !== 0n ? -magnitude : magnitude };
+  }
+  if (rounding === void 0) return { ok: false, reason: "precision" };
+  const lastKeptDigit = Number(magnitudeDigits[magnitudeDigits.length - 1]);
+  const firstDiscarded = Number(tail[0]);
+  const hasMoreNonZeroAfterFirst = /[1-9]/.test(tail.slice(1));
+  if (shouldRoundUp(negative, lastKeptDigit, firstDiscarded, hasMoreNonZeroAfterFirst, rounding)) {
+    magnitude += 1n;
+  }
+  return { ok: true, value: negative && magnitude !== 0n ? -magnitude : magnitude };
+}
+function formatScaledInt(value, scale) {
+  const negative = value < 0n;
+  const abs = (negative ? -value : value).toString();
+  if (scale === 0) return (negative ? "-" : "") + abs;
+  const padded = abs.padStart(scale + 1, "0");
+  const cut = padded.length - scale;
+  const intPart = padded.slice(0, cut);
+  const fracPart = padded.slice(cut);
+  return (negative ? "-" : "") + intPart + "." + fracPart;
+}
+var init_fixed_point = __esm({
+  "src/money/fixed-point.ts"() {
+    "use strict";
+  }
+});
+
+// src/money/iso4217.ts
+function scaleForCurrency(code) {
+  const v = MINOR_UNITS[code];
+  return v === void 0 ? null : v;
+}
+var MINOR_UNITS;
+var init_iso4217 = __esm({
+  "src/money/iso4217.ts"() {
+    "use strict";
+    MINOR_UNITS = {
+      // 2-decimal majors
+      EUR: 2,
+      USD: 2,
+      GBP: 2,
+      CHF: 2,
+      CAD: 2,
+      AUD: 2,
+      NZD: 2,
+      SGD: 2,
+      HKD: 2,
+      CNY: 2,
+      INR: 2,
+      BRL: 2,
+      MXN: 2,
+      ZAR: 2,
+      RUB: 2,
+      TRY: 2,
+      PLN: 2,
+      SEK: 2,
+      NOK: 2,
+      DKK: 2,
+      CZK: 2,
+      HUF: 2,
+      RON: 2,
+      ILS: 2,
+      THB: 2,
+      PHP: 2,
+      MYR: 2,
+      IDR: 2,
+      AED: 2,
+      SAR: 2,
+      QAR: 2,
+      EGP: 2,
+      // 0-decimal
+      JPY: 0,
+      KRW: 0,
+      ISK: 0,
+      CLP: 0,
+      VND: 0,
+      XOF: 0,
+      XAF: 0,
+      PYG: 0,
+      // 3-decimal
+      BHD: 3,
+      KWD: 3,
+      OMR: 3,
+      TND: 3,
+      JOD: 3,
+      IQD: 3,
+      LYD: 3
+    };
+  }
+});
+
+// src/money/descriptor.ts
+function isMultiOptions(o) {
+  return "currencies" in o;
+}
+function money(options) {
+  const hasFixed = "currency" in options;
+  const hasMulti = "currencies" in options;
+  if (hasFixed && hasMulti) {
+    throw new TypeError("money: `currency` and `currencies` are mutually exclusive");
+  }
+  if (!hasFixed && !hasMulti) {
+    throw new TypeError("money: one of `currency` or `currencies` is required");
+  }
+  const rounding = options.rounding;
+  if (isMultiOptions(options)) {
+    const overrides = options.scaleOverrides ?? {};
+    const allowList = options.currencies;
+    const allows = (c) => allowList === "any" ? true : allowList.includes(c);
+    const scaleFor = (c) => {
+      if (!allows(c)) throw new MoneyCurrencyError(c, "not-allowed");
+      const s = overrides[c] ?? scaleForCurrency(c);
+      if (s === null || s === void 0) throw new MoneyCurrencyError(c, "unknown-scale");
+      return s;
+    };
+    if (allowList !== "any") for (const c of allowList) scaleFor(c);
+    const soleCurrency = () => allowList !== "any" && allowList.length === 1 ? allowList[0] : void 0;
+    return {
+      _noydbMoney: true,
+      mode: "multi",
+      options,
+      rounding,
+      fixedCurrency: void 0,
+      scaleFor,
+      allows,
+      soleCurrency
+    };
+  }
+  const currency = options.currency;
+  const resolvedScale = options.scale ?? scaleForCurrency(currency);
+  if (resolvedScale === null || resolvedScale === void 0) {
+    throw new MoneyCurrencyError(currency, "unknown-scale");
+  }
+  return {
+    _noydbMoney: true,
+    mode: "fixed",
+    options,
+    rounding,
+    fixedCurrency: currency,
+    scaleFor(c) {
+      if (c !== currency) throw new MoneyCurrencyError(c, "not-allowed");
+      return resolvedScale;
+    },
+    allows: (c) => c === currency,
+    soleCurrency: () => currency
+  };
+}
+function isMoneyDescriptor(x) {
+  return typeof x === "object" && x !== null && x._noydbMoney === true;
+}
+var MoneyPrecisionError, MoneyCurrencyError, MoneyUnsupportedError;
+var init_descriptor = __esm({
+  "src/money/descriptor.ts"() {
+    "use strict";
+    init_iso4217();
+    init_errors();
+    MoneyPrecisionError = class extends NoydbError {
+      constructor(field, value, scale) {
+        super(
+          "MONEY_PRECISION",
+          `money: value ${JSON.stringify(value)} for field "${field}" exceeds scale ${scale} and no rounding mode is configured`
+        );
+        this.field = field;
+        this.value = value;
+        this.scale = scale;
+        this.name = "MoneyPrecisionError";
+      }
+      field;
+      value;
+      scale;
+    };
+    MoneyCurrencyError = class extends NoydbError {
+      constructor(currency, reason, field) {
+        super(
+          "MONEY_CURRENCY",
+          reason === "not-allowed" ? `money: currency "${currency}" is not allowed${field ? ` for field "${field}"` : ""}` : `money: no scale known for currency "${currency}"${field ? ` (field "${field}")` : ""} \u2014 pass an explicit scale / scaleOverrides`
+        );
+        this.currency = currency;
+        this.reason = reason;
+        this.field = field;
+        this.name = "MoneyCurrencyError";
+      }
+      currency;
+      reason;
+      field;
+    };
+    MoneyUnsupportedError = class extends NoydbError {
+      constructor(field, message) {
+        super(
+          "MONEY_UNSUPPORTED",
+          message ?? `money: operation is not supported on field "${field}" \u2014 use sum() and count() and divide at the boundary`
+        );
+        this.field = field;
+        this.name = "MoneyUnsupportedError";
+      }
+      field;
+    };
+  }
+});
+
 // src/team/tiers.ts
 function dekKey(collection, tier) {
   if (tier <= 0) return collection;
@@ -2340,6 +2667,189 @@ var init_predicate = __esm({
   }
 });
 
+// src/money/money-reducer.ts
+function toScaledInt(v) {
+  if (typeof v === "string" || typeof v === "number" || typeof v === "bigint") {
+    try {
+      return BigInt(v);
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function readMoney(record, field, desc) {
+  const raw = readPath(record, field);
+  if (raw === null || raw === void 0) return null;
+  if (desc.mode === "fixed") {
+    const value2 = toScaledInt(raw);
+    return value2 === null ? null : { currency: desc.fixedCurrency, value: value2 };
+  }
+  if (typeof raw !== "object") return null;
+  const o = raw;
+  if (typeof o.currency !== "string") return null;
+  const value = toScaledInt(o.amount);
+  return value === null ? null : { currency: o.currency, value };
+}
+function targetScaleFor(desc, currency) {
+  if (desc.allows(currency)) return desc.scaleFor(currency);
+  const s = scaleForCurrency(currency);
+  if (s === null) {
+    throw new Error(`money: cannot determine scale for conversion target "${currency}"`);
+  }
+  return s;
+}
+function parseRate(rate) {
+  const s = String(rate).trim();
+  const neg = s.startsWith("-");
+  const body = neg ? s.slice(1) : s;
+  const dot = body.indexOf(".");
+  const intPart = dot === -1 ? body : body.slice(0, dot);
+  const fracPart = dot === -1 ? "" : body.slice(dot + 1);
+  const int = BigInt((intPart === "" ? "0" : intPart) + fracPart);
+  return { int: neg ? -int : int, scale: fracPart.length };
+}
+function divRoundHalfEven(n, d) {
+  const q = n / d;
+  const r = n % d;
+  const twiceR = (r < 0n ? -r : r) * 2n;
+  if (twiceR < d) return q;
+  if (twiceR > d) return q + (n < 0n ? -1n : 1n);
+  return q % 2n === 0n ? q : q + (n < 0n ? -1n : 1n);
+}
+function convertScaled(value, srcScale, rate, targetScale) {
+  const { int: rateInt, scale: rateScale } = parseRate(rate);
+  const product = value * rateInt;
+  const curScale = srcScale + rateScale;
+  if (curScale === targetScale) return product;
+  if (curScale < targetScale) return product * 10n ** BigInt(targetScale - curScale);
+  return divRoundHalfEven(product, 10n ** BigInt(curScale - targetScale));
+}
+function finalizeSum(state, desc, convertTo, fx) {
+  if (convertTo !== void 0) {
+    if (fx === void 0) {
+      throw new Error(`money: sum convertTo "${convertTo}" requires an fx rate map`);
+    }
+    const targetScale = targetScaleFor(desc, convertTo);
+    let total = 0n;
+    for (const [cur, v] of state) {
+      if (cur === convertTo) {
+        total += convertScaled(v, desc.scaleFor(cur), 1, targetScale);
+        continue;
+      }
+      const rate = fx[`${cur}->${convertTo}`];
+      if (rate === void 0) {
+        throw new Error(`money: no fx rate for "${cur}->${convertTo}"`);
+      }
+      total += convertScaled(v, desc.scaleFor(cur), rate, targetScale);
+    }
+    return formatScaledInt(total, targetScale);
+  }
+  if (desc.mode === "fixed") {
+    const cur = desc.fixedCurrency;
+    return formatScaledInt(state.get(cur) ?? 0n, desc.scaleFor(cur));
+  }
+  const out = {};
+  for (const [cur, v] of state) out[cur] = formatScaledInt(v, desc.scaleFor(cur));
+  return out;
+}
+function moneySumReducer(field, desc, convertTo, fx) {
+  return {
+    op: "sum",
+    field,
+    init: () => /* @__PURE__ */ new Map(),
+    step: (state, record) => {
+      const m = readMoney(record, field, desc);
+      if (m) state.set(m.currency, (state.get(m.currency) ?? 0n) + m.value);
+      return state;
+    },
+    remove: (state, record) => {
+      const m = readMoney(record, field, desc);
+      if (m) state.set(m.currency, (state.get(m.currency) ?? 0n) - m.value);
+      return state;
+    },
+    finalize: (state) => finalizeSum(state, desc, convertTo, fx)
+  };
+}
+function extremum(values, op) {
+  let out = values[0];
+  for (let i = 1; i < values.length; i++) {
+    const v = values[i];
+    if (op === "min" ? v < out : v > out) out = v;
+  }
+  return out;
+}
+function moneyMinMaxReducer(op, field, desc) {
+  return {
+    op,
+    field,
+    init: () => /* @__PURE__ */ new Map(),
+    step: (state, record) => {
+      const m = readMoney(record, field, desc);
+      if (m) {
+        const arr = state.get(m.currency);
+        if (arr) arr.push(m.value);
+        else state.set(m.currency, [m.value]);
+      }
+      return state;
+    },
+    remove: (state, record) => {
+      const m = readMoney(record, field, desc);
+      if (m) {
+        const arr = state.get(m.currency);
+        if (arr) {
+          const idx = arr.indexOf(m.value);
+          if (idx >= 0) arr.splice(idx, 1);
+        }
+      }
+      return state;
+    },
+    finalize: (state) => {
+      if (desc.mode === "fixed") {
+        const cur = desc.fixedCurrency;
+        const arr = state.get(cur);
+        if (!arr || arr.length === 0) return null;
+        return formatScaledInt(extremum(arr, op), desc.scaleFor(cur));
+      }
+      const out = {};
+      for (const [cur, arr] of state) {
+        if (arr.length > 0) out[cur] = formatScaledInt(extremum(arr, op), desc.scaleFor(cur));
+      }
+      return out;
+    }
+  };
+}
+function wrapMoneyReducers(spec, moneyFields) {
+  let changed = false;
+  const out = {};
+  for (const [key, reducer] of Object.entries(spec)) {
+    const field = reducer.field;
+    const desc = field ? moneyFields[field] : void 0;
+    if (desc && reducer.op === "avg") {
+      throw new MoneyUnsupportedError(
+        field,
+        `avg() is not supported on money field "${field}" in v1 \u2014 use sum() and count() and divide at the boundary.`
+      );
+    }
+    if (desc && (reducer.op === "sum" || reducer.op === "min" || reducer.op === "max")) {
+      changed = true;
+      out[key] = reducer.op === "sum" ? moneySumReducer(field, desc, reducer.convertTo, reducer.fx) : moneyMinMaxReducer(reducer.op, field, desc);
+    } else {
+      out[key] = reducer;
+    }
+  }
+  return changed ? out : spec;
+}
+var init_money_reducer = __esm({
+  "src/money/money-reducer.ts"() {
+    "use strict";
+    init_predicate();
+    init_fixed_point();
+    init_iso4217();
+    init_descriptor();
+  }
+});
+
 // src/aggregate/aggregation.ts
 function reduceRecords(records, spec) {
   const state = {};
@@ -2557,19 +3067,22 @@ var init_groupby = __esm({
     init_aggregation();
     init_canonical_key();
     init_errors();
+    init_money_reducer();
     GROUPBY_WARN_CARDINALITY = 1e4;
     GROUPBY_MAX_CARDINALITY = 1e5;
     warnedCardinalityFields = /* @__PURE__ */ new Set();
     GroupedQueryBase = class {
-      constructor(executeRecords, fieldOrFields, upstreams, dictLabelResolver) {
+      constructor(executeRecords, fieldOrFields, upstreams, dictLabelResolver, moneyFields) {
         this.executeRecords = executeRecords;
         this.upstreams = upstreams;
         this.dictLabelResolver = dictLabelResolver;
+        this.moneyFields = moneyFields;
         this.fields = typeof fieldOrFields === "string" ? [fieldOrFields] : [...fieldOrFields];
       }
       executeRecords;
       upstreams;
       dictLabelResolver;
+      moneyFields;
       /**
        * Field set this grouped query buckets on. Stored in declaration
        * order — the same order is preserved on every result row by
@@ -2577,6 +3090,10 @@ var init_groupby = __esm({
        * `[field]`.
        */
       fields;
+      /** Apply money-aware reducer rewriting when money fields are declared. */
+      wrapSpec(spec) {
+        return this.moneyFields ? wrapMoneyReducers(spec, this.moneyFields) : spec;
+      }
     };
     GroupedQuery = class extends GroupedQueryBase {
       /**
@@ -2589,7 +3106,7 @@ var init_groupby = __esm({
         return new GroupedAggregation(
           this.executeRecords,
           this.fields,
-          spec,
+          this.wrapSpec(spec),
           this.upstreams,
           this.dictLabelResolver
         );
@@ -2600,7 +3117,7 @@ var init_groupby = __esm({
         return new GroupedAggregation(
           this.executeRecords,
           this.fields,
-          spec,
+          this.wrapSpec(spec),
           this.upstreams,
           this.dictLabelResolver
         );
@@ -2716,14 +3233,21 @@ var init_executor = __esm({
        * Compare existing vs incoming for each `frozenFields.fields` entry
        * when `frozenFields.when(existing)` is true. Throws
        * `FieldFrozenError` listing every changed frozen field.
+       *
+       * @param skipFields — field names that are schema-owned computed fields.
+       *   These are excluded from the comparison because `incoming` carries the
+       *   raw user input (computed fields not yet evaluated), so comparing
+       *   `existing[field]` vs `incoming[field]` would always look like a
+       *   change even when the computed result is unchanged.
        */
-      async checkFrozenFields(guard, id, existing, incoming) {
+      async checkFrozenFields(guard, id, existing, incoming, skipFields) {
         const ff = guard.frozenFields;
         if (!ff) return;
         if (existing === null) return;
         if (!ff.when(existing)) return;
         const changed = [];
         for (const f of ff.fields) {
+          if (skipFields?.has(String(f))) continue;
           if (existing[f] !== incoming[f]) {
             if (!deepEqual2(existing[f], incoming[f])) changed.push(String(f));
           }
@@ -4052,6 +4576,476 @@ var init_delegation = __esm({
   }
 });
 
+// src/federation/classify-skip.ts
+function classifyShardSkip(err) {
+  return err instanceof NoAccessError ? "no-grant" : "error";
+}
+var init_classify_skip = __esm({
+  "src/federation/classify-skip.ts"() {
+    "use strict";
+    init_errors();
+  }
+});
+
+// src/federation/cross-vault-live.ts
+var CrossVaultLive;
+var init_cross_vault_live = __esm({
+  "src/federation/cross-vault-live.ts"() {
+    "use strict";
+    CrossVaultLive = class {
+      snapshot;
+      error = null;
+      ready;
+      subs = /* @__PURE__ */ new Set();
+      unsubChange;
+      opts;
+      stopped = false;
+      computing = false;
+      dirty = false;
+      scheduled = false;
+      timer = null;
+      resolveReady;
+      settledOnce = false;
+      constructor(opts) {
+        this.opts = opts;
+        this.snapshot = opts.initialSnapshot;
+        this.ready = new Promise((res) => {
+          this.resolveReady = res;
+        });
+        this.unsubChange = opts.subscribeToChanges((e) => {
+          if (this.stopped || !opts.isRelevant(e)) return;
+          this.schedule();
+        });
+        this.schedule();
+      }
+      subscribe(cb) {
+        if (this.stopped) return () => {
+        };
+        this.subs.add(cb);
+        return () => this.subs.delete(cb);
+      }
+      stop() {
+        if (this.stopped) return;
+        this.stopped = true;
+        this.unsubChange();
+        if (this.timer !== null) clearTimeout(this.timer);
+        this.subs.clear();
+        if (!this.settledOnce) this.resolveReady();
+      }
+      schedule() {
+        if (this.stopped) return;
+        if (this.computing) {
+          this.dirty = true;
+          return;
+        }
+        if (this.scheduled) return;
+        this.scheduled = true;
+        const run = () => {
+          this.scheduled = false;
+          void this.runCompute();
+        };
+        const ms = this.opts.debounceMs ?? 0;
+        if (ms > 0) this.timer = setTimeout(run, ms);
+        else queueMicrotask(run);
+      }
+      async runCompute() {
+        if (this.stopped) return;
+        this.computing = true;
+        this.dirty = false;
+        try {
+          const next = await this.opts.compute();
+          if (this.stopped) return;
+          this.snapshot = next;
+          this.error = null;
+        } catch (err) {
+          if (this.stopped) return;
+          this.error = err instanceof Error ? err : new Error(String(err));
+        } finally {
+          this.computing = false;
+          if (!this.stopped) {
+            if (!this.settledOnce) {
+              this.settledOnce = true;
+              this.resolveReady();
+            }
+            for (const cb of this.subs) cb();
+            if (this.dirty) this.schedule();
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/federation/aggregate-across.ts
+var CrossVaultAggregation, CrossVaultGroupedAggregation;
+var init_aggregate_across = __esm({
+  "src/federation/aggregate-across.ts"() {
+    "use strict";
+    init_aggregation();
+    init_groupby();
+    init_cross_vault_live();
+    CrossVaultAggregation = class {
+      constructor(src, spec, bind) {
+        this.src = src;
+        this.spec = spec;
+        this.bind = bind;
+      }
+      src;
+      spec;
+      bind;
+      async run(options = {}) {
+        const { records, skippedVaults } = await this.src.fanoutRecords(options);
+        return { result: reduceRecords(records, this.spec), skippedVaults };
+      }
+      live(options = {}) {
+        if (!this.bind) throw new Error("CrossVaultAggregation: live() requires a LiveBinding \u2014 use ShardedQuery.aggregate()");
+        const spec = this.spec;
+        const src = this.src;
+        const core = new CrossVaultLive({
+          subscribeToChanges: this.bind.subscribeToChanges,
+          isRelevant: this.bind.isRelevant,
+          compute: async () => {
+            const { records, skippedVaults } = await src.fanoutRecords(options);
+            return { value: reduceRecords(records, spec), skipped: skippedVaults };
+          },
+          initialSnapshot: { value: void 0, skipped: [] },
+          ...options.debounceMs !== void 0 ? { debounceMs: options.debounceMs } : {}
+        });
+        return {
+          get value() {
+            return core.snapshot.value;
+          },
+          get skippedVaults() {
+            return core.snapshot.skipped;
+          },
+          get error() {
+            return core.error;
+          },
+          ready: core.ready,
+          subscribe: (cb) => core.subscribe(cb),
+          stop: () => core.stop()
+        };
+      }
+    };
+    CrossVaultGroupedAggregation = class {
+      constructor(src, field, spec, bind) {
+        this.src = src;
+        this.field = field;
+        this.spec = spec;
+        this.bind = bind;
+      }
+      src;
+      field;
+      spec;
+      bind;
+      async run(options = {}) {
+        const { records, skippedVaults } = await this.src.fanoutRecords(options);
+        return {
+          results: groupAndReduce(records, this.field, this.spec),
+          skippedVaults
+        };
+      }
+      live(options = {}) {
+        if (!this.bind) throw new Error("CrossVaultGroupedAggregation: live() requires a LiveBinding \u2014 use ShardedQuery.groupBy().aggregate()");
+        const field = this.field;
+        const spec = this.spec;
+        const src = this.src;
+        const core = new CrossVaultLive({
+          subscribeToChanges: this.bind.subscribeToChanges,
+          isRelevant: this.bind.isRelevant,
+          compute: async () => {
+            const { records, skippedVaults } = await src.fanoutRecords(options);
+            return {
+              records: groupAndReduce(records, field, spec),
+              skipped: skippedVaults
+            };
+          },
+          initialSnapshot: { records: [], skipped: [] },
+          ...options.debounceMs !== void 0 ? { debounceMs: options.debounceMs } : {}
+        });
+        return {
+          get value() {
+            return core.snapshot.records;
+          },
+          get skippedVaults() {
+            return core.snapshot.skipped;
+          },
+          get error() {
+            return core.error;
+          },
+          ready: core.ready,
+          subscribe: (cb) => core.subscribe(cb),
+          stop: () => core.stop()
+        };
+      }
+    };
+  }
+});
+
+// src/federation/vault-group.ts
+var vault_group_exports = {};
+__export(vault_group_exports, {
+  ShardedCollection: () => ShardedCollection,
+  ShardedGroupedQuery: () => ShardedGroupedQuery,
+  ShardedQuery: () => ShardedQuery,
+  VaultGroup: () => VaultGroup
+});
+function assertSafePartitionKey(partitionKey) {
+  if (partitionKey.length === 0) {
+    throw new ValidationError("partitionKey must be a non-empty string");
+  }
+  if (!SAFE_PARTITION_KEY.test(partitionKey)) {
+    throw new ValidationError(
+      `partitionKey "${partitionKey}" contains characters outside [A-Za-z0-9._-]. Map your records to a store-safe key in sharding.keyOf.`
+    );
+  }
+  if (partitionKey.includes(SHARD_SEPARATOR)) {
+    throw new ValidationError(
+      `partitionKey "${partitionKey}" must not contain "--" \u2014 it is reserved as the shard vault-id separator and would risk shard-id collisions.`
+    );
+  }
+}
+var SHARD_SEPARATOR, SAFE_PARTITION_KEY, VaultGroup, ShardedCollection, ShardedQuery, ShardedGroupedQuery;
+var init_vault_group = __esm({
+  "src/federation/vault-group.ts"() {
+    "use strict";
+    init_errors();
+    init_classify_skip();
+    init_cross_vault_live();
+    init_aggregate_across();
+    SHARD_SEPARATOR = "--";
+    SAFE_PARTITION_KEY = /^[A-Za-z0-9._-]+$/;
+    VaultGroup = class {
+      constructor(db, name, registry, sharding, template) {
+        this.db = db;
+        this.name = name;
+        this.registry = registry;
+        this.sharding = sharding;
+        this.template = template;
+        if (name.includes(SHARD_SEPARATOR)) {
+          throw new ValidationError(
+            `VaultGroup name "${name}" must not contain "--" (reserved shard vault-id separator).`
+          );
+        }
+      }
+      db;
+      name;
+      registry;
+      sharding;
+      template;
+      /** Deterministic vault name for a partition key, namespaced by the group. */
+      shardVaultId(partitionKey) {
+        assertSafePartitionKey(partitionKey);
+        return `${this.name}${SHARD_SEPARATOR}${partitionKey}`;
+      }
+      /** All registry rows (hydrates the registry collection first). */
+      async allRows() {
+        await this.registry.list();
+        return this.registry.query().toArray();
+      }
+      /** Open an existing shard and apply the template. */
+      async openShard(partitionKey) {
+        const vault = await this.db.openVault(this.shardVaultId(partitionKey), { create: false });
+        this.template.configure(vault);
+        return vault;
+      }
+      /**
+       * Idempotently provision a shard for `partitionKey`. Returns the
+       * configured vault handle.
+       *
+       * - row + vault present → no-op, return handle
+       * - row present, vault gone → ShardProvisioningError
+       * - row absent (vault present or not) → open-or-create, configure, write row
+       */
+      async createShard(partitionKey) {
+        const vaultId = this.shardVaultId(partitionKey);
+        const row = await this.registry.get(partitionKey);
+        const provisioned = await this.db._shardVaultProvisioned(vaultId);
+        if (row && !provisioned) throw new ShardProvisioningError(vaultId, partitionKey);
+        if (row && provisioned) return this.openShard(partitionKey);
+        const vault = await this.db.openVault(vaultId);
+        this.template.configure(vault);
+        await this.registry.put(partitionKey, {
+          vaultId,
+          partitionKey,
+          templateName: this.sharding.vaultTemplate,
+          schemaVersion: this.template.version,
+          createdAt: Date.now()
+        });
+        return vault;
+      }
+      /**
+       * Drill down to a single shard's full Collection API. Throws if the shard is unknown.
+       * Also throws ShardProvisioningError if the registry row exists but the vault has been deleted
+       * (registry/store divergence).
+       */
+      async shard(partitionKey) {
+        const vaultId = this.shardVaultId(partitionKey);
+        const row = await this.registry.get(partitionKey);
+        if (!row) throw new UnknownShardError(partitionKey, this.name);
+        const provisioned = await this.db._shardVaultProvisioned(vaultId);
+        if (!provisioned) throw new ShardProvisioningError(vaultId, partitionKey);
+        return this.openShard(partitionKey);
+      }
+      /** A sharded view over one logical collection across all shards. */
+      collection(collectionName) {
+        return new ShardedCollection(this, collectionName);
+      }
+      /** @internal — eligible (openable-candidate) rows + drift/divergence skips. */
+      async resolveEligible(options = {}) {
+        const rows = await this.allRows();
+        const skipped = [];
+        const versionOk = [];
+        for (const row of rows) {
+          if (options.minVersion !== void 0 && row.schemaVersion < options.minVersion) {
+            skipped.push({ vaultId: row.vaultId, reason: "schema-drift" });
+          } else versionOk.push(row);
+        }
+        const provisioned = await Promise.all(versionOk.map((r) => this.db._shardVaultProvisioned(r.vaultId)));
+        const eligible = [];
+        versionOk.forEach((row, i) => {
+          if (provisioned[i]) eligible.push(row);
+          else skipped.push({ vaultId: row.vaultId, reason: "error", error: new ShardProvisioningError(row.vaultId, row.partitionKey) });
+        });
+        return { eligible, skipped };
+      }
+    };
+    ShardedCollection = class {
+      constructor(group, collectionName) {
+        this.group = group;
+        this.collectionName = collectionName;
+      }
+      group;
+      collectionName;
+      /** Route a write to the shard owning `keyOf(record)`. */
+      async put(id, record) {
+        const key = this.group.sharding.keyOf(record);
+        const row = await this.group.registry.get(key);
+        let vault;
+        if (!row) {
+          if (this.group.sharding.autoCreate === false) {
+            throw new UnknownShardError(key, this.group.name);
+          }
+          vault = await this.group.createShard(key);
+        } else {
+          vault = await this.group.openShard(key);
+        }
+        await vault.collection(this.collectionName).put(id, record);
+      }
+      /** Begin a cross-shard fan-out query. */
+      query() {
+        return new ShardedQuery(this.group, this.collectionName, []);
+      }
+    };
+    ShardedQuery = class _ShardedQuery {
+      constructor(group, collectionName, clauses) {
+        this.group = group;
+        this.collectionName = collectionName;
+        this.clauses = clauses;
+      }
+      group;
+      collectionName;
+      clauses;
+      where(field, op, value) {
+        return new _ShardedQuery(this.group, this.collectionName, [
+          ...this.clauses,
+          { field, op, value }
+        ]);
+      }
+      /** @internal — fan out the where-filtered records across eligible shards. */
+      async fanoutRecords(options = {}) {
+        const { eligible, skipped } = await this.group.resolveEligible(options);
+        const across = await this.group.db.queryAcross(
+          eligible.map((r) => r.vaultId),
+          async (vault) => {
+            this.group.template.configure(vault);
+            const coll = vault.collection(this.collectionName);
+            await coll.list();
+            let q = coll.query();
+            for (const c of this.clauses) q = q.where(c.field, c.op, c.value);
+            return q.toArray();
+          },
+          { concurrency: options.concurrency ?? 1, create: false }
+        );
+        const results = [];
+        for (const r of across) {
+          if (r.error) skipped.push({ vaultId: r.vault, reason: classifyShardSkip(r.error), error: r.error });
+          else for (const item of r.result) results.push(item);
+        }
+        return { records: results, skippedVaults: skipped };
+      }
+      /** Fan out across eligible shards and merge results. */
+      async toArray(options = {}) {
+        const { records, skippedVaults } = await this.fanoutRecords(options);
+        return { results: records, skippedVaults };
+      }
+      /** @internal — build the change-subscription + relevance binding for this query's group+collection. */
+      liveBinding() {
+        const group = this.group;
+        const collectionName = this.collectionName;
+        return {
+          subscribeToChanges: (h) => {
+            group.db.on("change", h);
+            return () => group.db.off("change", h);
+          },
+          isRelevant: (e) => e.collection === collectionName && e.vault.startsWith(`${group.name}--`)
+        };
+      }
+      /** Returns a reactive cross-shard live query — a facade over CrossVaultLive. */
+      live(options = {}) {
+        const bind = this.liveBinding();
+        const core = new CrossVaultLive({
+          ...bind,
+          compute: async () => {
+            const { records, skippedVaults } = await this.fanoutRecords(options);
+            return { records, skipped: skippedVaults };
+          },
+          initialSnapshot: { records: [], skipped: [] },
+          ...options.debounceMs !== void 0 ? { debounceMs: options.debounceMs } : {}
+        });
+        return {
+          get value() {
+            return core.snapshot.records;
+          },
+          get skippedVaults() {
+            return core.snapshot.skipped;
+          },
+          get error() {
+            return core.error;
+          },
+          ready: core.ready,
+          subscribe: (cb) => core.subscribe(cb),
+          stop: () => core.stop()
+        };
+      }
+      /** One-shot distributed aggregate — central reduce over all shard records. */
+      aggregate(spec) {
+        return new CrossVaultAggregation(this, spec, this.liveBinding());
+      }
+      /** Begin a grouped cross-shard aggregate. */
+      groupBy(field) {
+        return new ShardedGroupedQuery(this, field);
+      }
+    };
+    ShardedGroupedQuery = class {
+      constructor(query, field) {
+        this.query = query;
+        this.field = field;
+      }
+      query;
+      field;
+      aggregate(spec) {
+        return new CrossVaultGroupedAggregation(
+          { fanoutRecords: (o) => this.query.fanoutRecords(o) },
+          this.field,
+          spec,
+          this.query.liveBinding()
+        );
+      }
+    };
+  }
+});
+
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
@@ -4076,6 +5070,7 @@ __export(src_exports, {
   CollectionFrame: () => CollectionFrame,
   CollectionIndexes: () => CollectionIndexes,
   CollectionInstant: () => CollectionInstant,
+  ComputedFieldError: () => ComputedFieldError,
   ConflictError: () => ConflictError,
   CrossJoinSourceUnknownError: () => CrossJoinSourceUnknownError,
   CrossJoinTooLargeError: () => CrossJoinTooLargeError,
@@ -4139,6 +5134,9 @@ __export(src_exports, {
   MemorySealingKeyProvider: () => MemorySealingKeyProvider,
   MigrationRequiredError: () => MigrationRequiredError,
   MissingTranslationError: () => MissingTranslationError,
+  MoneyCurrencyError: () => MoneyCurrencyError,
+  MoneyPrecisionError: () => MoneyPrecisionError,
+  MoneyUnsupportedError: () => MoneyUnsupportedError,
   NOYDB_BACKUP_VERSION: () => NOYDB_BACKUP_VERSION,
   NOYDB_BUNDLE_FORMAT_VERSION: () => NOYDB_BUNDLE_FORMAT_VERSION,
   NOYDB_BUNDLE_MAGIC: () => NOYDB_BUNDLE_MAGIC,
@@ -4191,9 +5189,13 @@ __export(src_exports, {
   SchemaUpdateError: () => SchemaUpdateError,
   SchemaValidationError: () => SchemaValidationError,
   ScriptViolationError: () => ScriptViolationError,
+  SequenceContentionError: () => SequenceContentionError,
+  SequenceOfflineError: () => SequenceOfflineError,
+  SequenceStore: () => SequenceStore,
   SessionExpiredError: () => SessionExpiredError,
   SessionNotFoundError: () => SessionNotFoundError,
   SessionPolicyError: () => SessionPolicyError,
+  ShardProvisioningError: () => ShardProvisioningError,
   SnapshotNotFoundError: () => SnapshotNotFoundError,
   StoreCapabilityError: () => StoreCapabilityError,
   SyncEngine: () => SyncEngine,
@@ -4209,6 +5211,7 @@ __export(src_exports, {
   USER_ENVELOPE_COLLECTION: () => USER_ENVELOPE_COLLECTION,
   USER_ENVELOPE_MAX_BYTES: () => USER_ENVELOPE_MAX_BYTES,
   UniqueConstraintError: () => UniqueConstraintError,
+  UnknownShardError: () => UnknownShardError,
   UnsupportedIndexOptionError: () => UnsupportedIndexOptionError,
   UserApi: () => UserApi,
   UserEnvelopeOversizedError: () => UserEnvelopeOversizedError,
@@ -4217,6 +5220,7 @@ __export(src_exports, {
   Vault: () => Vault,
   VaultFrame: () => VaultFrame,
   VaultInstant: () => VaultInstant,
+  VaultTemplateNotFoundError: () => VaultTemplateNotFoundError,
   WeakPassphraseError: () => WeakPassphraseError,
   activeSessionCount: () => activeSessionCount,
   additiveOnly: () => additiveOnly,
@@ -4273,6 +5277,7 @@ __export(src_exports, {
   envelopePayloadHash: () => envelopePayloadHash,
   estimateEntropy: () => estimateEntropy,
   estimateRecordBytes: () => estimateRecordBytes,
+  evalComputedFields: () => evalComputedFields,
   evaluateClause: () => evaluateClause,
   evaluateExportCapability: () => evaluateExportCapability,
   evaluateFieldClause: () => evaluateFieldClause,
@@ -4289,6 +5294,7 @@ __export(src_exports, {
   hasRecoveryEnrolled: () => hasRecoveryEnrolled,
   hashEntry: () => hashEntry,
   i18nText: () => i18nText,
+  immutableGuard: () => immutableGuard,
   inferScripts: () => inferScripts,
   isDevUnlockActive: () => isDevUnlockActive,
   isDictCollectionName: () => isDictCollectionName,
@@ -4296,6 +5302,7 @@ __export(src_exports, {
   isDiscriminant: () => isDiscriminant,
   isI18nTextDescriptor: () => isI18nTextDescriptor,
   isMagicLinkGrantExpired: () => isMagicLinkGrantExpired,
+  isMoneyDescriptor: () => isMoneyDescriptor,
   isPreCompressed: () => isPreCompressed,
   isPublicEnvelope: () => isPublicEnvelope,
   isSessionAlive: () => isSessionAlive,
@@ -4327,6 +5334,7 @@ __export(src_exports, {
   mintPaperRecoveryEntry: () => mintPaperRecoveryEntry,
   mintShamirRecoveryEntry: () => mintShamirRecoveryEntry,
   mintWrappedDeksBlob: () => mintWrappedDeksBlob,
+  money: () => money,
   paddedIndex: () => paddedIndex,
   parseBytes: () => parseBytes,
   parseIndex: () => parseIndex,
@@ -4367,6 +5375,7 @@ __export(src_exports, {
   saveShamirRecoveryEntries: () => saveShamirRecoveryEntries,
   saveUserEnvelope: () => saveUserEnvelope,
   saveVaultPolicy: () => saveVaultPolicy,
+  scaleForCurrency: () => scaleForCurrency,
   sha256Hex: () => sha256Hex3,
   sum: () => sum,
   unwrapDeksFromBlob: () => unwrapDeksFromBlob,
@@ -4380,6 +5389,7 @@ __export(src_exports, {
   validateSchemaOutput: () => validateSchemaOutput,
   validateSessionPolicy: () => validateSessionPolicy,
   visibilityRecordId: () => visibilityRecordId,
+  withArchive: () => withArchive,
   withCache: () => withCache,
   withCircuitBreaker: () => withCircuitBreaker,
   withDerivation: () => withDerivation,
@@ -6371,6 +7381,171 @@ function withHealthCheck(opts = {}) {
 init_errors();
 init_errors();
 
+// src/archive/engine.ts
+function isHeld(policy, record) {
+  if (!policy.legalHold) return false;
+  try {
+    return policy.legalHold(record);
+  } catch {
+    return true;
+  }
+}
+async function runArchive(ctx, options = {}) {
+  const maxArchives = options.maxArchives ?? Infinity;
+  const dryRun = options.dryRun === true;
+  let archived = 0;
+  let held = 0;
+  let scanned = 0;
+  const byCollection = {};
+  outer: for (const collection of ctx.collectionsWithPolicy()) {
+    const policy = ctx.getPolicy(collection);
+    if (!policy) continue;
+    byCollection[collection] = { archived: 0, held: 0 };
+    for (const id of await ctx.listRecordIds(collection)) {
+      if (archived >= maxArchives) break outer;
+      const record = await ctx.getRecord(collection, id).catch(() => null);
+      if (record === null) continue;
+      scanned += 1;
+      let eligible = false;
+      try {
+        eligible = policy.archiveWhen(record);
+      } catch {
+        eligible = false;
+      }
+      if (!eligible) continue;
+      if (isHeld(policy, record)) {
+        held += 1;
+        byCollection[collection].held += 1;
+        continue;
+      }
+      if (!dryRun) {
+        const env = await ctx.getEnvelope(collection, id);
+        if (!env) continue;
+        await ctx.archiveStore.put(ctx.vaultId, collection, id, env);
+        await ctx.removeFromPrimary(collection, id);
+      }
+      archived += 1;
+      byCollection[collection].archived += 1;
+    }
+  }
+  return { archived, held, scanned, byCollection };
+}
+async function runRestore(ctx, collection, id) {
+  const env = await ctx.archiveStore.get(ctx.vaultId, collection, id);
+  if (!env) return false;
+  await ctx.restoreToPrimary(collection, id, env);
+  await ctx.archiveStore.delete(ctx.vaultId, collection, id);
+  return true;
+}
+async function runListArchived(ctx, collection) {
+  const collections = collection ? [collection] : ctx.collectionsWithPolicy();
+  const out = [];
+  for (const c of collections) {
+    const ids = await ctx.archiveStore.list(ctx.vaultId, c);
+    for (const id of ids) out.push({ collection: c, id });
+  }
+  return out;
+}
+
+// src/archive/index.ts
+function withArchive(opts) {
+  return { store: opts.store };
+}
+
+// src/sequence/index.ts
+init_types();
+init_crypto();
+init_errors();
+var SEQUENCE_COLLECTION = "_sequences";
+var MAX_NEXT_ATTEMPTS = 16;
+async function sleepBackoff(attempt) {
+  const ceil = Math.min(2 ** attempt, 32);
+  const ms = Math.floor(Math.random() * ceil);
+  await new Promise((r) => setTimeout(r, ms));
+}
+var SequenceStore = class {
+  adapter;
+  vault;
+  encrypted;
+  getDEK;
+  actor;
+  /**
+   * Memoized DEK promise. The `_sequences` collection DEK is created on
+   * first access; without sharing one promise, a burst of concurrent
+   * `next()` calls would each trigger DEK creation and diverge (one
+   * writer's ciphertext unreadable by another). One shared promise → one
+   * DEK.
+   */
+  dekPromise = null;
+  constructor(opts) {
+    this.adapter = opts.adapter;
+    this.vault = opts.vault;
+    this.encrypted = opts.encrypted;
+    this.getDEK = opts.getDEK;
+    this.actor = opts.actor;
+  }
+  /** A handle bound to one sequence name. */
+  handle(name) {
+    return {
+      next: () => this.next(name),
+      peek: () => this.peek(name)
+    };
+  }
+  assertOnline() {
+    if (this.adapter.capabilities?.casAtomic !== true) {
+      throw new SequenceOfflineError();
+    }
+  }
+  dek() {
+    if (!this.dekPromise) this.dekPromise = this.getDEK(SEQUENCE_COLLECTION);
+    return this.dekPromise;
+  }
+  async read(name) {
+    const env = await this.adapter.get(this.vault, SEQUENCE_COLLECTION, name);
+    if (!env) return { env: null, value: 0 };
+    const json = this.encrypted ? await decrypt(env._iv, env._data, await this.dek()) : env._data;
+    const state = JSON.parse(json);
+    return { env, value: state.value };
+  }
+  async encryptState(state, version) {
+    const json = JSON.stringify(state);
+    if (!this.encrypted) {
+      return { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: "", _data: json, _by: this.actor };
+    }
+    const { iv, data } = await encrypt(json, await this.dek());
+    return { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: iv, _data: data, _by: this.actor };
+  }
+  async peek(name) {
+    return (await this.read(name)).value;
+  }
+  async next(name) {
+    this.assertOnline();
+    let lastConflict;
+    for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {
+      const { env, value } = await this.read(name);
+      const nextValue = value + 1;
+      const expectedVersion = env?._v ?? 0;
+      const envelope = await this.encryptState({ value: nextValue }, expectedVersion + 1);
+      try {
+        await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion);
+        return nextValue;
+      } catch (err) {
+        if (err instanceof ConflictError) {
+          lastConflict = err;
+          if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff(attempt);
+          continue;
+        }
+        throw err;
+      }
+    }
+    void lastConflict;
+    throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS);
+  }
+};
+
+// src/index.ts
+init_errors();
+
 // src/bundle/format.ts
 var NOYDB_BUNDLE_MAGIC = new Uint8Array([78, 68, 66, 49]);
 var NOYDB_BUNDLE_PREFIX_BYTES = 10;
@@ -7251,15 +8426,15 @@ function isEquivalent(a, b) {
 
 // src/history/history.ts
 var HISTORY_COLLECTION = "_history";
-function matchesPrefix(id, collection, recordId2) {
-  if (recordId2) {
-    return id.startsWith(`${collection}:${recordId2}:`);
+function matchesPrefix(id, collection, recordId3) {
+  if (recordId3) {
+    return id.startsWith(`${collection}:${recordId3}:`);
   }
   return id.startsWith(`${collection}:`);
 }
-async function getHistory(adapter, vault, collection, recordId2, options) {
+async function getHistory(adapter, vault, collection, recordId3, options) {
   const allIds = await adapter.list(vault, HISTORY_COLLECTION);
-  const matchingIds = allIds.filter((id) => matchesPrefix(id, collection, recordId2)).sort().reverse();
+  const matchingIds = allIds.filter((id) => matchesPrefix(id, collection, recordId3)).sort().reverse();
   const entries = [];
   for (const id of matchingIds) {
     const envelope = await adapter.get(vault, HISTORY_COLLECTION, id);
@@ -7940,6 +9115,18 @@ async function loadKeyring(adapter, vault, userId, passphrase) {
     ...keyringFile.policy !== void 0 && { policy: keyringFile.policy }
   };
 }
+async function assertKeyringOpenAllowed(store, vault, userId, create) {
+  const keyringUsers = await store.list(vault, "_keyring");
+  if (keyringUsers.includes(userId)) return;
+  if (!create) {
+    throw new NoAccessError(`Vault "${vault}" not opened: create disabled and no keyring for "${userId}".`);
+  }
+  if (keyringUsers.length > 0) {
+    throw new NoAccessError(
+      `No keyring for user "${userId}" in vault "${vault}" (held by other principals) \u2014 refusing to self-provision.`
+    );
+  }
+}
 async function createOwnerKeyring(adapter, vault, userId, passphrase, passphraseOpts) {
   if (passphraseOpts?.validate && !passphraseOpts.allowWeakPassphrase) {
     assertStrongPassphrase(passphrase, passphraseOpts);
@@ -10022,6 +11209,119 @@ function applyI18nLocale(record, i18nFields, locale, fallback, layer = "read") {
   return result;
 }
 
+// src/money/normalize.ts
+init_fixed_point();
+init_descriptor();
+function isMoneyValueObject(v) {
+  return typeof v === "object" && v !== null && "currency" in v;
+}
+function quantizeAmount(field, input, scale, rounding) {
+  const r = parseToScaledInt(input, scale, rounding);
+  if (!r.ok) {
+    if (r.reason === "precision") throw new MoneyPrecisionError(field, input, scale);
+    throw new TypeError(`money: field "${field}" value ${JSON.stringify(input)} is not a finite decimal`);
+  }
+  return r.value.toString();
+}
+function quantizeMoneyFields(record, moneyFields) {
+  const out = { ...record };
+  for (const [field, desc] of Object.entries(moneyFields)) {
+    const raw = out[field];
+    if (raw === null || raw === void 0) continue;
+    if (desc.mode === "fixed") {
+      const currency2 = desc.fixedCurrency;
+      out[field] = quantizeAmount(field, raw, desc.scaleFor(currency2), desc.rounding);
+      continue;
+    }
+    let amount;
+    let currency;
+    if (isMoneyValueObject(raw)) {
+      currency = String(raw.currency);
+      amount = raw.amount;
+    } else {
+      const sole = desc.soleCurrency();
+      if (sole === void 0) {
+        throw new TypeError(
+          `money: field "${field}" is multi-currency \u2014 write { amount, currency }, not a bare amount`
+        );
+      }
+      currency = sole;
+      amount = raw;
+    }
+    const scale = desc.scaleFor(currency);
+    out[field] = { amount: quantizeAmount(field, amount, scale, desc.rounding), currency };
+  }
+  return out;
+}
+function formatCurrency(decimal, currency, scale, locale) {
+  const fmt = new Intl.NumberFormat(locale, {
+    style: "currency",
+    currency,
+    minimumFractionDigits: scale,
+    maximumFractionDigits: scale
+  });
+  return fmt.format(decimal);
+}
+function decodeMoneyFields(record, moneyFields, locale) {
+  const out = { ...record };
+  const format = locale !== "raw";
+  const fmtLocale = typeof locale === "string" && locale !== "raw" ? locale : "en-US";
+  for (const [field, desc] of Object.entries(moneyFields)) {
+    const stored = out[field];
+    if (stored === null || stored === void 0) continue;
+    let currency;
+    let scaledIntString;
+    if (desc.mode === "fixed") {
+      if (typeof stored !== "string" && typeof stored !== "number") continue;
+      currency = desc.fixedCurrency;
+      scaledIntString = String(stored);
+    } else {
+      if (!isMoneyValueObject(stored)) continue;
+      const amount = stored.amount;
+      if (typeof stored.currency !== "string" || typeof amount !== "string" && typeof amount !== "number") continue;
+      currency = stored.currency;
+      scaledIntString = String(amount);
+    }
+    const scale = desc.scaleFor(currency);
+    const decimal = formatScaledInt(BigInt(scaledIntString), scale);
+    out[field] = desc.mode === "fixed" ? decimal : { amount: decimal, currency };
+    if (format) {
+      out[`${field}Formatted`] = formatCurrency(decimal, currency, scale, fmtLocale);
+      out[`${field}Number`] = Number(decimal);
+    }
+  }
+  return out;
+}
+
+// src/computed/index.ts
+init_errors();
+var ComputedFieldError = class extends NoydbError {
+  constructor(field, id, cause) {
+    super(
+      "COMPUTED_FIELD",
+      `computed field "${field}" threw for record "${id}": ` + (cause instanceof Error ? cause.message : String(cause))
+    );
+    this.field = field;
+    this.id = id;
+    this.cause = cause;
+    this.name = "ComputedFieldError";
+  }
+  field;
+  id;
+  cause;
+};
+function evalComputedFields(record, computed, id) {
+  const out = { ...record };
+  for (const [field, fn] of Object.entries(computed)) {
+    try {
+      out[field] = fn(out);
+    } catch (cause) {
+      throw new ComputedFieldError(field, id, cause);
+    }
+  }
+  return out;
+}
+
 // src/i18n/strategy.ts
 function notEnabled(op) {
   return new Error(
@@ -10340,6 +11640,7 @@ var NO_AGGREGATE = {
 };
 
 // src/query/builder.ts
+init_money_reducer();
 var EMPTY_PLAN = {
   clauses: [],
   orderBy: [],
@@ -10785,6 +12086,10 @@ var Query = class _Query {
    * partition boundaries without an API break.
    */
   aggregate(spec) {
+    const moneyFields = this.source.moneyFields;
+    if (moneyFields) {
+      spec = wrapMoneyReducers(spec, moneyFields);
+    }
     const source = this.source;
     const clauses = this.plan.clauses;
     const joinCtx = this.joinContext;
@@ -10832,13 +12137,15 @@ var Query = class _Query {
         executeRecords,
         field,
         upstreams,
-        dictLabelResolver
+        dictLabelResolver,
+        this.source.moneyFields
       );
     }
     return this.aggregateStrategy.groupByN(
       executeRecords,
       fields,
-      upstreams
+      upstreams,
+      this.source.moneyFields
     );
   }
   /**
@@ -11379,7 +12686,8 @@ function count(opts) {
     init: () => 0,
     step: (state) => state + 1,
     remove: (state) => state - 1,
-    finalize: (state) => state
+    finalize: (state) => state,
+    merge: (a, b) => a + b
   };
 }
 function sum(field, opts) {
@@ -11388,10 +12696,15 @@ function sum(field, opts) {
   return {
     op: "sum",
     field,
+    // Money-only metadata, read by `wrapMoneyReducers`. No effect on a
+    // generic numeric sum.
+    ...opts?.convertTo !== void 0 ? { convertTo: opts.convertTo } : {},
+    ...opts?.fx !== void 0 ? { fx: opts.fx } : {},
     init: () => 0,
     step: (state, record) => state + readNumber(record, field),
     remove: (state, record) => state - readNumber(record, field),
-    finalize: (state) => state
+    finalize: (state) => state,
+    merge: (a, b) => a + b
   };
 }
 function avg(field, opts) {
@@ -11409,7 +12722,8 @@ function avg(field, opts) {
       sum: state.sum - readNumber(record, field),
       count: state.count - 1
     }),
-    finalize: (state) => state.count === 0 ? null : state.sum / state.count
+    finalize: (state) => state.count === 0 ? null : state.sum / state.count,
+    merge: (a, b) => ({ sum: a.sum + b.sum, count: a.count + b.count })
   };
 }
 function pushValue(state, value) {
@@ -11439,7 +12753,8 @@ function min(field, opts) {
         if (v < out) out = v;
       }
       return out;
-    }
+    },
+    merge: (a, b) => ({ values: [...a.values, ...b.values] })
   };
 }
 function max(field, opts) {
@@ -11459,11 +12774,17 @@ function max(field, opts) {
         if (v > out) out = v;
       }
       return out;
-    }
+    },
+    merge: (a, b) => ({ values: [...a.values, ...b.values] })
   };
 }
 function readNumber(record, field) {
   const value = readPath(record, field);
+  if (typeof value === "object" && value !== null && "amount" in value && "currency" in value) {
+    throw new Error(
+      `aggregate: field "${field}" holds a money value but was not money-aware \u2014 declare it in the collection's moneyFields so sum/min/max stay exact`
+    );
+  }
   return typeof value === "number" && Number.isFinite(value) ? value : 0;
 }
 
@@ -11877,8 +13198,8 @@ function coerceRefKey2(value) {
 
 // src/indexing/persisted-indexes.ts
 var IDX_PREFIX = "_idx/";
-function encodeIdxId(field, recordId2) {
-  return `${IDX_PREFIX}${field}/${recordId2}`;
+function encodeIdxId(field, recordId3) {
+  return `${IDX_PREFIX}${field}/${recordId3}`;
 }
 function decodeIdxId(id) {
   if (!id.startsWith(IDX_PREFIX)) return null;
@@ -11886,9 +13207,9 @@ function decodeIdxId(id) {
   const firstSlash = rest.indexOf("/");
   if (firstSlash <= 0) return null;
   const field = rest.slice(0, firstSlash);
-  const recordId2 = rest.slice(firstSlash + 1);
-  if (recordId2.length === 0) return null;
-  return { field, recordId: recordId2 };
+  const recordId3 = rest.slice(firstSlash + 1);
+  if (recordId3.length === 0) return null;
+  return { field, recordId: recordId3 };
 }
 
 // src/indexing/lazy-builder.ts
@@ -12874,6 +14195,18 @@ var Collection = class {
    * fields when a locale is requested.
    */
   dictKeyFields;
+  /**
+   * Money field descriptors keyed by field path. Declared via the
+   * `moneyFields` collection option: `put()` quantizes to a scaled-int
+   * string, `get()`/`list()` decode back. Mutable so {@link _applyMoneyFields}
+   * can attach descriptors to a collection MV-analysis pre-created.
+   */
+  moneyFields;
+  /**
+   * Computed scalar fields, evaluated first on every `put()`. Mutable for
+   * the same MV-pre-creation reconcile as {@link moneyFields}.
+   */
+  computed;
   /**
    * Async callback provided by the Vault that resolves a dict key
    * to its label for a given locale. Used by the locale-read path for
@@ -13015,6 +14348,8 @@ var Collection = class {
     this.joinResolver = opts.joinResolver;
     this.i18nFields = opts.i18nFields;
     this.dictKeyFields = opts.dictKeyFields;
+    this.moneyFields = opts.moneyFields;
+    this.computed = opts.computed;
     this.dictLabelResolver = opts.dictLabelResolver;
     this.i18nPutValidator = opts.i18nPutValidator;
     this.autoTranslateHook = opts.autoTranslateHook;
@@ -13139,6 +14474,19 @@ var Collection = class {
   getSchema() {
     return this.schema;
   }
+  /**
+   * @internal — attach money descriptors post-construction. MV dependency
+   * analysis auto-creates a source collection (without options) during
+   * `openVault`, before the user's `collection(name, { moneyFields })`
+   * declaration; this reconciles that ordering. First-wins. Not public.
+   */
+  _applyMoneyFields(moneyFields) {
+    if (this.moneyFields === void 0) this.moneyFields = moneyFields;
+  }
+  /** @internal — attach computed fields post-construction. See {@link _applyMoneyFields}. */
+  _applyComputed(computed) {
+    if (this.computed === void 0) this.computed = computed;
+  }
   /**
    * Get a single record by ID.
    *
@@ -13310,7 +14658,7 @@ var Collection = class {
           existingRecord = null;
         }
       }
-      await this.subsystemBus.dispatchGate("beforePut", {
+      const gateEvent = {
         op: existingEnv ? "update" : "create",
         vault: this.vault,
         collection: this.name,
@@ -13320,12 +14668,20 @@ var Collection = class {
         existingVersion: existingEnv?._v ?? 0,
         existingTs: existingEnv?._ts,
         userId: this.keyring.userId,
-        role: this.keyring.role
-      });
+        role: this.keyring.role,
+        ...this.computed !== void 0 ? { computedFieldNames: new Set(Object.keys(this.computed)) } : {}
+      };
+      await this.subsystemBus.dispatchGate("beforePut", gateEvent);
+    }
+    if (this.computed !== void 0) {
+      record = evalComputedFields(record, this.computed, id);
     }
     if (this.schema !== void 0) {
       record = await validateSchemaInput(this.schema, record, `put(${id})`);
     }
+    if (this.moneyFields) {
+      record = quantizeMoneyFields(record, this.moneyFields);
+    }
     if (this.i18nFields) {
       const obj = record;
       for (const [field, descriptor] of Object.entries(this.i18nFields)) {
@@ -14147,7 +15503,8 @@ var Collection = class {
       // fields. The Query builder consults these when present and falls
       // back to a linear scan otherwise.
       getIndexes: () => this.getIndexes(),
-      lookupById: (id) => this.cache.get(id)?.record
+      lookupById: (id) => this.cache.get(id)?.record,
+      ...this.moneyFields ? { moneyFields: this.moneyFields } : {}
     };
     const resolver = this.joinResolver;
     const leftCollection = this.name;
@@ -14649,11 +16006,11 @@ var Collection = class {
       }
     }
     persisted.clear();
-    for (const recordId2 of canonicalIds) {
-      const envelope = await this.adapter.get(this.vault, this.name, recordId2);
+    for (const recordId3 of canonicalIds) {
+      const envelope = await this.adapter.get(this.vault, this.name, recordId3);
       if (!envelope) continue;
       const record = await this.decryptRecord(envelope, { skipValidation: true });
-      await this.maintainPersistedIndexesOnPut(recordId2, record, null, envelope._v);
+      await this.maintainPersistedIndexesOnPut(recordId3, record, null, envelope._v);
     }
     this.persistedIndexesLoaded = true;
   }
@@ -14829,10 +16186,14 @@ var Collection = class {
   async applyLocaleToRecord(record, localeOpts) {
     const hasI18n = this.i18nFields && Object.keys(this.i18nFields).length > 0;
     const hasDict = this.dictKeyFields && Object.keys(this.dictKeyFields).length > 0;
-    if (!hasI18n && !hasDict) return record;
+    const hasMoney = this.moneyFields && Object.keys(this.moneyFields).length > 0;
+    if (!hasI18n && !hasDict && !hasMoney) return record;
     const locale = localeOpts?.locale ?? this.defaultLocale;
-    if (!locale) return record;
     let result = record;
+    if (hasMoney && this.moneyFields) {
+      result = decodeMoneyFields(result, this.moneyFields, typeof locale === "string" ? locale : void 0);
+    }
+    if (!locale) return result;
     if (hasI18n && this.i18nFields) {
       result = this.i18nStrategy.applyI18nLocale(result, this.i18nFields, locale, localeOpts?.fallback);
     }
@@ -16231,6 +17592,7 @@ async function runCompaction(ctx, options = {}) {
   let evicted = 0;
   let records = 0;
   let auditEntries = 0;
+  let held = 0;
   let collectionsWithPolicy = 0;
   outer: for (const collectionName of allCollections) {
     if (collectionName.startsWith("_")) continue;
@@ -16241,25 +17603,29 @@ async function runCompaction(ctx, options = {}) {
     collectionsWithPolicy += 1;
     byCollection[collectionName] = { records: 0, evicted: 0 };
     const ids = await ctx.listRecords(collectionName);
-    for (const recordId2 of ids) {
+    for (const recordId3 of ids) {
       if (evicted >= maxEvictions) break outer;
-      const record = await ctx.getRecord(collectionName, recordId2).catch(() => null);
+      const record = await ctx.getRecord(collectionName, recordId3).catch(() => null);
       if (record === null) continue;
       records += 1;
       byCollection[collectionName].records += 1;
-      const slots = await ctx.listSlots(collectionName, recordId2).catch(() => []);
+      const slots = await ctx.listSlots(collectionName, recordId3).catch(() => []);
       for (const slot of slots) {
         if (evicted >= maxEvictions) break outer;
         const policy = config[slot.name];
         if (!policy) continue;
         const reason = evaluatePolicy(policy, record, slot, now);
         if (!reason) continue;
+        if (isHeld2(policy, record, now)) {
+          held += 1;
+          continue;
+        }
         if (!dryRun) {
-          await ctx.deleteSlot(collectionName, recordId2, slot.name);
+          await ctx.deleteSlot(collectionName, recordId3, slot.name);
           await writeAuditEntry(ctx, {
-            id: generateEvictionId(collectionName, recordId2, slot.name),
+            id: generateEvictionId(collectionName, recordId3, slot.name),
             collection: collectionName,
-            recordId: recordId2,
+            recordId: recordId3,
             slotName: slot.name,
             blobHash: slot.eTag,
             reason,
@@ -16278,9 +17644,32 @@ async function runCompaction(ctx, options = {}) {
     records,
     collections: collectionsWithPolicy,
     auditEntries,
+    held,
     byCollection
   };
 }
+function isHeld2(policy, record, now) {
+  if (policy.legalHold) {
+    try {
+      if (policy.legalHold(record)) return true;
+    } catch {
+      return true;
+    }
+  }
+  if (policy.retainUntil) {
+    try {
+      const until = policy.retainUntil(record);
+      if (until !== null && until !== void 0) {
+        const t = until instanceof Date ? until.getTime() : typeof until === "number" ? until : Date.parse(String(until));
+        if (!Number.isFinite(t)) return true;
+        if (t > now.getTime()) return true;
+      }
+    } catch {
+      return true;
+    }
+  }
+  return false;
+}
 function evaluatePolicy(policy, record, slot, now) {
   let ttlTriggered = false;
   let predicateTriggered = false;
@@ -16303,11 +17692,11 @@ function evaluatePolicy(policy, record, slot, now) {
   if (predicateTriggered) return "predicate";
   return null;
 }
-function generateEvictionId(collection, recordId2, slotName) {
+function generateEvictionId(collection, recordId3, slotName) {
   const rand = globalThis.crypto.getRandomValues(new Uint8Array(8));
   let suffix = "";
   for (const b of rand) suffix += b.toString(16).padStart(2, "0");
-  return `${collection}__${recordId2}__${slotName}__${suffix}`;
+  return `${collection}__${recordId3}__${slotName}__${suffix}`;
 }
 async function writeAuditEntry(ctx, entry) {
   const json = JSON.stringify(entry);
@@ -16358,7 +17747,7 @@ async function deriveMagicLinkContentKey(serverSecret, token, vault) {
     ["encrypt", "decrypt"]
   );
 }
-async function writeMagicLinkGrant(store, vault, grantor, contentKey, grantKek, recordId2, opts) {
+async function writeMagicLinkGrant(store, vault, grantor, contentKey, grantKek, recordId3, opts) {
   const collectionName = opts.collection ?? null;
   const sourceKey = collectionName ? dekKey(collectionName, opts.tier) : `__any#${opts.tier}`;
   const sourceDek = grantor.deks.get(sourceKey);
@@ -16371,7 +17760,7 @@ async function writeMagicLinkGrant(store, vault, grantor, contentKey, grantKek,
   const until = typeof opts.until === "string" ? opts.until : opts.until.toISOString();
   const createdAt = (/* @__PURE__ */ new Date()).toISOString();
   const payload = {
-    id: recordId2,
+    id: recordId3,
     toUser: opts.toUser,
     fromUser: grantor.userId,
     tier: opts.tier,
@@ -16391,11 +17780,11 @@ async function writeMagicLinkGrant(store, vault, grantor, contentKey, grantKek,
     _data: data,
     _by: grantor.userId
   };
-  await store.put(vault, MAGIC_LINK_GRANTS_COLLECTION, recordId2, envelope);
-  return { recordId: recordId2, payload };
+  await store.put(vault, MAGIC_LINK_GRANTS_COLLECTION, recordId3, envelope);
+  return { recordId: recordId3, payload };
 }
-async function readMagicLinkGrantRecord(store, vault, contentKey, recordId2) {
-  const env = await store.get(vault, MAGIC_LINK_GRANTS_COLLECTION, recordId2);
+async function readMagicLinkGrantRecord(store, vault, contentKey, recordId3) {
+  const env = await store.get(vault, MAGIC_LINK_GRANTS_COLLECTION, recordId3);
   if (!env) return null;
   try {
     const json = await decrypt(env._iv, env._data, contentKey);
@@ -16997,6 +18386,10 @@ var Vault = class {
    * call throws with a pointer at `@noy-db/hub/blobs`.
    */
   blobStrategy;
+  /** Cold-storage archival strategy (the archive target store). */
+  archiveStrategy;
+  /** Per-collection record archival policies. Indexed by collection name. */
+  archiveRegistry = /* @__PURE__ */ new Map();
   indexStrategy;
   aggregateStrategy;
   crdtStrategy;
@@ -17100,6 +18493,8 @@ var Vault = class {
    * docstring.
    */
   ledgerStore = null;
+  /** Lazily-built atomic-sequence store. See {@link sequence}. */
+  sequenceStore = null;
   /**
    * Background writes for persisted-schema envelopes (#schema-dump v0
    * slice 1). One promise per `collection({ persistJsonSchema: true })`
@@ -17201,6 +18596,7 @@ var Vault = class {
     this.onRegisterConflictResolver = opts.onRegisterConflictResolver;
     this.syncAdapter = opts.syncAdapter;
     this.blobStrategy = opts.blobStrategy;
+    this.archiveStrategy = opts.archiveStrategy;
     this.indexStrategy = opts.indexStrategy;
     this.aggregateStrategy = opts.aggregateStrategy;
     this.crdtStrategy = opts.crdtStrategy;
@@ -17263,8 +18659,9 @@ var Vault = class {
    *. `put()` validates keys against the declared set; reads
    *   with `{ locale }` add `<field>Label` virtual fields.
    *
-   * Throws `ReservedCollectionNameError` for names starting with `_dict_`.
-   * Use `vault.dictionary(name)` to access dictionary collections.
+   * Throws `ReservedCollectionNameError` for names starting with `_dict_` or
+   * equal to `_sequences`. Use `vault.dictionary(name)` for dict collections
+   * and `vault.sequence(name)` for sequence counters.
    *
    * Lazy mode + indexes is rejected at construction time — see the
    * Collection constructor for the rationale.
@@ -17283,7 +18680,16 @@ var Vault = class {
     if (isDictCollectionName(collectionName)) {
       throw new ReservedCollectionNameError(collectionName);
     }
+    if (collectionName === SEQUENCE_COLLECTION) {
+      throw new ReservedCollectionNameError(collectionName);
+    }
     let coll = this.collectionCache.get(collectionName);
+    if (coll && options?.moneyFields) {
+      coll._applyMoneyFields(options.moneyFields);
+    }
+    if (coll && options?.computed) {
+      coll._applyComputed(options.computed);
+    }
     if (!coll) {
       if (options?.refs) {
         this.refRegistry.register(collectionName, options.refs);
@@ -17294,6 +18700,9 @@ var Vault = class {
       if (options?.blobFields) {
         this.blobFieldsRegistry.set(collectionName, options.blobFields);
       }
+      if (options?.archive) {
+        this.archiveRegistry.set(collectionName, options.archive);
+      }
       if (options?.attestation !== void 0) {
         this.attestationRegistry.set(collectionName, options.attestation);
       }
@@ -17409,6 +18818,8 @@ var Vault = class {
       collOpts.onCrossTierAccess = (event) => this.emitCrossTier(event);
       if (this.syncAdapter !== void 0) collOpts.syncAdapter = this.syncAdapter;
       if (options?.i18nFields !== void 0) collOpts.i18nFields = options.i18nFields;
+      if (options?.moneyFields !== void 0) collOpts.moneyFields = options.moneyFields;
+      if (options?.computed !== void 0) collOpts.computed = options.computed;
       if (options?.dictKeyFields !== void 0) {
         collOpts.dictLabelResolver = async (dictName, key, locale, fallback) => {
           const handle = this.dictionary(dictName);
@@ -17828,6 +19239,33 @@ var Vault = class {
    * await vault.compact({ maxEvictions: 1000 })             // cap batch
    * ```
    */
+  /**
+   * Atomic, gap-free numbering. `vault.sequence('invoice-2026').next()`
+   * returns 1, 2, 3, … with no gaps or duplicates under concurrency, via
+   * an optimistic-CAS counter at `_sequences/<name>`. Each name is an
+   * independent sequence.
+   *
+   * **Online-only:** `next()` throws `SequenceOfflineError` unless the
+   * store advertises `capabilities.casAtomic` — gap-free numbering cannot
+   * be serialized by an offline / non-CAS writer.
+   *
+   * ```ts
+   * const n = await vault.sequence('invoice-2026').next()   // 1, then 2, …
+   * const cur = await vault.sequence('invoice-2026').peek()  // current value, no allocation
+   * ```
+   */
+  sequence(name) {
+    if (!this.sequenceStore) {
+      this.sequenceStore = new SequenceStore({
+        adapter: this.adapter,
+        vault: this.name,
+        encrypted: this.encrypted,
+        getDEK: this.getDEK,
+        actor: this.keyring.userId
+      });
+    }
+    return this.sequenceStore.handle(name);
+  }
   async compact(options = {}) {
     return runCompaction({
       adapter: this.adapter,
@@ -17852,6 +19290,48 @@ var Vault = class {
       }
     }, options);
   }
+  /**
+   * Sweep records eligible by their collection's `archive` policy into the
+   * cold archive store. Relocation is envelope-level (no re-encryption) and
+   * bypasses guards + materialized-view dispatch, so issued/immutable
+   * records over a sealed period can be archived without recomputing
+   * finalized aggregates. A `legalHold` predicate blocks archival.
+   * Requires `archiveStrategy: withArchive({ store })` in `createNoydb`.
+   */
+  async archive(options = {}) {
+    return runArchive(this._archiveContext(), options);
+  }
+  /** Relocate one archived record back to the primary store. Returns false if it was not archived. */
+  async restore(collection, id) {
+    return runRestore(this._archiveContext(), collection, id);
+  }
+  /** List archived record ids for a collection (or all collections with an archive policy). */
+  async listArchived(collection) {
+    return runListArchived(this._archiveContext(), collection);
+  }
+  _archiveContext() {
+    const strategy = this.archiveStrategy;
+    if (!strategy) {
+      throw new Error(
+        "vault.archive/restore/listArchived require `archiveStrategy: withArchive({ store })` in createNoydb"
+      );
+    }
+    const archiveStore = strategy.store;
+    return {
+      vaultId: this.name,
+      archiveStore,
+      collectionsWithPolicy: () => [...this.archiveRegistry.keys()],
+      getPolicy: (c) => this.archiveRegistry.get(c) ?? null,
+      listRecordIds: (c) => this.adapter.list(this.name, c),
+      getRecord: async (c, id) => await this.collection(c).get(id, { locale: "raw" }),
+      getEnvelope: (c, id) => this.adapter.get(this.name, c, id),
+      removeFromPrimary: (c, id) => this.collection(c)._internalDelete(id),
+      restoreToPrimary: async (c, id, env) => {
+        await this.adapter.put(this.name, c, id, env);
+        await this.collection(c)._invalidateCacheEntry(id);
+      }
+    };
+  }
   exportBlobs(options = {}) {
     this.assertCanExport("plaintext", "blob");
     return createExportBlobsHandle(
@@ -18550,7 +20030,7 @@ var Vault = class {
    *
    * @internal
    */
-  async _logConsent(op, collection, recordId2) {
+  async _logConsent(op, collection, recordId3) {
     const ctx = this.consentContext;
     if (!ctx) return;
     await this.consentStrategy.write(
@@ -18563,7 +20043,7 @@ var Vault = class {
         consentHash: ctx.consentHash,
         op,
         collection,
-        recordId: recordId2
+        recordId: recordId3
       },
       this.getDEK
     );
@@ -18746,14 +20226,14 @@ var Vault = class {
    * the HKDF derivation, record-id composition, and batch logic so the
    * grantor doesn't touch this method directly.
    */
-  async writeMagicLinkGrant(contentKey, grantKek, recordId2, opts) {
+  async writeMagicLinkGrant(contentKey, grantKek, recordId3, opts) {
     return writeMagicLinkGrant(
       this.adapter,
       this.name,
       this.keyring,
       contentKey,
       grantKek,
-      recordId2,
+      recordId3,
       opts
     );
   }
@@ -19113,7 +20593,7 @@ var Vault = class {
       }
     }
     const internalSnapshot = {};
-    for (const internalName of [LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, SCHEMAS_COLLECTION]) {
+    for (const internalName of [LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, SCHEMAS_COLLECTION, SEQUENCE_COLLECTION]) {
       const ids = await this.adapter.list(this.name, internalName);
       if (ids.length === 0) continue;
       const records = {};
@@ -20589,6 +22069,7 @@ var Noydb = class {
   writeRelay;
   /** Per-vault policy enforcers. */
   policyEnforcers = /* @__PURE__ */ new Map();
+  vaultTemplates = /* @__PURE__ */ new Map();
   txStrategy;
   sessionStrategy;
   syncStrategy;
@@ -20658,7 +22139,7 @@ var Noydb = class {
       await registry.runChecks(e.collection, incoming, ctx);
       const { GuardExecutor: GuardExecutor2 } = await Promise.resolve().then(() => (init_executor(), executor_exports));
       for (const g of guards) {
-        await GuardExecutor2.checkFrozenFields(g, e.docId, existing, incoming);
+        await GuardExecutor2.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
     });
     this.subsystemBus.registerGate("beforeDelete", async (e) => {
@@ -20779,7 +22260,7 @@ var Noydb = class {
       }
       return comp;
     }
-    const keyring = await this.getKeyringInternal(name);
+    const keyring = await this.getKeyringInternal(name, { create: opts?.create !== false });
     if (!this.activeTier.has(name)) {
       this.activeTier.set(name, 1);
     }
@@ -20837,6 +22318,7 @@ var Noydb = class {
       syncAdapter: targets.length > 0 ? targets[0].store : void 0,
       historyConfig: this.options.history,
       ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
+      ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
       ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
       ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
       ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
@@ -20890,6 +22372,7 @@ var Noydb = class {
         emitter: this.emitter,
         historyConfig: this.options.history,
         ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
+        ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
         ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
         ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
         ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
@@ -20918,6 +22401,7 @@ var Noydb = class {
       encrypted: true,
       historyConfig: this.options.history,
       ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
+      ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
       ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
       ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
       ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
@@ -21207,7 +22691,7 @@ var Noydb = class {
       const vaultId = vaultIds[idx];
       const task = (async () => {
         try {
-          const comp = await this.openVault(vaultId);
+          const comp = await this.openVault(vaultId, { create: options.create !== false });
           const result = await fn(comp);
           results[idx] = { vault: vaultId, result };
         } catch (err) {
@@ -21232,6 +22716,32 @@ var Noydb = class {
     }
     return results;
   }
+  /**
+   * Register a shard schema blueprint. `createShard` / `openVaultGroup`
+   * stamp shards from the named template. See the MVF design spec.
+   */
+  withVaultTemplate(name, template) {
+    this.vaultTemplates.set(name, template);
+  }
+  /**
+   * Open a VaultGroup — transparent routing over per-partition shard
+   * vaults, with shard discovery backed by the supplied `vault-registry`
+   * collection.
+   */
+  async openVaultGroup(name, opts) {
+    if (this.closed) throw new ValidationError("Instance is closed");
+    const template = this.vaultTemplates.get(opts.sharding.vaultTemplate);
+    if (!template) throw new VaultTemplateNotFoundError(opts.sharding.vaultTemplate);
+    const { VaultGroup: VaultGroup2 } = await Promise.resolve().then(() => (init_vault_group(), vault_group_exports));
+    return new VaultGroup2(this, name, opts.registry, opts.sharding, template);
+  }
+  /**
+   * @internal — true when an encrypted shard vault is provisioned
+   * (its keyring exists in the store).
+   */
+  async _shardVaultProvisioned(vaultId) {
+    return (await this.options.store.list(vaultId, "_keyring")).length > 0;
+  }
   /**
    * Change the current user's passphrase for a vault.
    *
@@ -22549,7 +24059,7 @@ var Noydb = class {
    * accesses see them. Not exposed publicly — callers outside hub
    * should use {@link getKeyring}, which returns a defensive copy.
    */
-  async getKeyringInternal(vault) {
+  async getKeyringInternal(vault, opts = { create: true }) {
     if (this.options.encrypt === false) {
       return createPlaintextKeyring(this.options.user);
     }
@@ -22560,6 +24070,7 @@ var Noydb = class {
       this.keyringCache.set(vault, keyring2);
       return keyring2;
     }
+    await assertKeyringOpenAllowed(this.options.store, vault, this.options.user, opts.create);
     let effectiveSecret;
     if (this.options.passphraseMode === "managed") {
       effectiveSecret = await resolveManagedSecret(
@@ -23493,6 +25004,50 @@ function withGuard(strategy) {
   };
 }
 
+// src/guards/immutable-guard.ts
+init_errors();
+function recordId2(record) {
+  const id = record?.id;
+  return typeof id === "string" ? id : "";
+}
+function immutableGuard(config) {
+  const { collection, after, appendOnly, amendmentRoles } = config;
+  if (appendOnly && after !== void 0) {
+    throw new ValidationError("immutableGuard: `after` and `appendOnly` are mutually exclusive");
+  }
+  if (!appendOnly && after === void 0) {
+    throw new ValidationError("immutableGuard: provide `after` or `appendOnly: true`");
+  }
+  const isImmutable = appendOnly ? () => true : after;
+  const reason = appendOnly ? "append-only collection" : "record is immutable after issue";
+  const spec = {
+    collection,
+    // Block updates to an already-immutable record. Inserts (existing
+    // null) and the transition write that first makes the record
+    // immutable are allowed — `after` reads the prior state.
+    check: (incoming, ctx) => {
+      if (ctx.existing !== null && isImmutable(ctx.existing)) {
+        throw new RecordLockedError(collection, recordId2(incoming), reason);
+      }
+    },
+    // Block deletes of an immutable record.
+    onDelete: (existing) => {
+      if (isImmutable(existing)) {
+        throw new RecordLockedError(collection, recordId2(existing), reason);
+      }
+    },
+    // The authorized override: inside an amendment transaction the
+    // check/onDelete are skipped and the change is ledgered. No extra
+    // invariant — the amendment itself is the sanctioned exception.
+    amendment: {
+      roles: amendmentRoles ?? ["admin", "owner"],
+      invariant: () => {
+      }
+    }
+  };
+  return withGuard(spec);
+}
+
 // src/derivations/with-derivation.ts
 init_errors();
 function withDerivation(spec) {
@@ -23650,6 +25205,10 @@ function withOverlayedView(spec) {
 init_errors();
 init_errors();
 
+// src/money/index.ts
+init_descriptor();
+init_iso4217();
+
 // src/i18n/script.ts
 init_errors();
 var LATIN_BASE = /* @__PURE__ */ new Set([
@@ -24435,6 +25994,7 @@ function shortJSON(value) {
   CollectionFrame,
   CollectionIndexes,
   CollectionInstant,
+  ComputedFieldError,
   ConflictError,
   CrossJoinSourceUnknownError,
   CrossJoinTooLargeError,
@@ -24498,6 +26058,9 @@ function shortJSON(value) {
   MemorySealingKeyProvider,
   MigrationRequiredError,
   MissingTranslationError,
+  MoneyCurrencyError,
+  MoneyPrecisionError,
+  MoneyUnsupportedError,
   NOYDB_BACKUP_VERSION,
   NOYDB_BUNDLE_FORMAT_VERSION,
   NOYDB_BUNDLE_MAGIC,
@@ -24550,9 +26113,13 @@ function shortJSON(value) {
   SchemaUpdateError,
   SchemaValidationError,
   ScriptViolationError,
+  SequenceContentionError,
+  SequenceOfflineError,
+  SequenceStore,
   SessionExpiredError,
   SessionNotFoundError,
   SessionPolicyError,
+  ShardProvisioningError,
   SnapshotNotFoundError,
   StoreCapabilityError,
   SyncEngine,
@@ -24568,6 +26135,7 @@ function shortJSON(value) {
   USER_ENVELOPE_COLLECTION,
   USER_ENVELOPE_MAX_BYTES,
   UniqueConstraintError,
+  UnknownShardError,
   UnsupportedIndexOptionError,
   UserApi,
   UserEnvelopeOversizedError,
@@ -24576,6 +26144,7 @@ function shortJSON(value) {
   Vault,
   VaultFrame,
   VaultInstant,
+  VaultTemplateNotFoundError,
   WeakPassphraseError,
   activeSessionCount,
   additiveOnly,
@@ -24632,6 +26201,7 @@ function shortJSON(value) {
   envelopePayloadHash,
   estimateEntropy,
   estimateRecordBytes,
+  evalComputedFields,
   evaluateClause,
   evaluateExportCapability,
   evaluateFieldClause,
@@ -24648,6 +26218,7 @@ function shortJSON(value) {
   hasRecoveryEnrolled,
   hashEntry,
   i18nText,
+  immutableGuard,
   inferScripts,
   isDevUnlockActive,
   isDictCollectionName,
@@ -24655,6 +26226,7 @@ function shortJSON(value) {
   isDiscriminant,
   isI18nTextDescriptor,
   isMagicLinkGrantExpired,
+  isMoneyDescriptor,
   isPreCompressed,
   isPublicEnvelope,
   isSessionAlive,
@@ -24686,6 +26258,7 @@ function shortJSON(value) {
   mintPaperRecoveryEntry,
   mintShamirRecoveryEntry,
   mintWrappedDeksBlob,
+  money,
   paddedIndex,
   parseBytes,
   parseIndex,
@@ -24726,6 +26299,7 @@ function shortJSON(value) {
   saveShamirRecoveryEntries,
   saveUserEnvelope,
   saveVaultPolicy,
+  scaleForCurrency,
   sha256Hex,
   sum,
   unwrapDeksFromBlob,
@@ -24739,6 +26313,7 @@ function shortJSON(value) {
   validateSchemaOutput,
   validateSessionPolicy,
   visibilityRecordId,
+  withArchive,
   withCache,
   withCircuitBreaker,
   withDerivation,