@noy-db/hub 0.2.0-pre.11 → 0.2.0-pre.13

package/dist/bundle/index.cjs

@@ -31,7 +31,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/errors.ts
-var NoydbError, DecryptionError, TamperedError, InvalidKeyError, KeyringCorruptError, NoAccessError, ReadOnlyError, PermissionDeniedError, ExportCapabilityError, KeyringExpiredError, ImportCapabilityError, StoreCapabilityError, PrivilegeEscalationError, FieldFrozenError, InvariantError, AmendmentForbiddenError, TierNotGrantedError, ElevationExpiredError, AlreadyElevatedError, TierDemoteDeniedError, DelegationTargetMissingError, ConflictError, LedgerContentionError, BundleVersionConflictError, ValidationError, SchemaValidationError, SchemaUpdateError, SchemaFenceError, MigrationRequiredError, QuiesceTimeoutError, GroupCardinalityError, IndexRequiredError, UniqueConstraintError, UnsupportedIndexOptionError, IndexWriteFailureError, BundleIntegrityError, BundleSealMismatchError, ReservedCollectionNameError, LocaleNotSpecifiedError, TranslatorNotConfiguredError, BackupLedgerError, BackupCorruptedError, PartitionExtractionError, TransferSealError, AdoptionStateError, AttestationError, JoinTooLargeError, CrossJoinTooLargeError, CrossJoinSourceUnknownError, DanglingReferenceError, DerivationCycleError, DerivationOutputShapeError, DerivationCapExceededError, MaterializedViewCycleError, MaterializedViewSourceUnknownError, MaterializedViewTooLargeError, OverlayBaseIsVirtualError, OverlayCollectionUnavailableError, OverlayNameCollisionError, OverlayIdMismatchError;
+var NoydbError, DecryptionError, TamperedError, InvalidKeyError, KeyringCorruptError, NoAccessError, ReadOnlyError, PermissionDeniedError, ExportCapabilityError, KeyringExpiredError, ImportCapabilityError, StoreCapabilityError, PrivilegeEscalationError, ReservedVaultNameError, FieldFrozenError, InvariantError, AmendmentForbiddenError, TierNotGrantedError, ElevationExpiredError, AlreadyElevatedError, TierDemoteDeniedError, DelegationTargetMissingError, ConflictError, LedgerContentionError, SequenceContentionError, SequenceOfflineError, NumberingUncertaintyError, BundleVersionConflictError, ValidationError, SchemaValidationError, SchemaUpdateError, SchemaFenceError, MigrationRequiredError, QuiesceTimeoutError, GroupCardinalityError, IndexRequiredError, UniqueConstraintError, UnsupportedIndexOptionError, IndexWriteFailureError, BundleIntegrityError, BundleSealMismatchError, ReservedCollectionNameError, LocaleNotSpecifiedError, TranslatorNotConfiguredError, BackupLedgerError, BackupCorruptedError, PartitionExtractionError, TransferSealError, AdoptionStateError, AttestationError, JoinTooLargeError, CrossJoinTooLargeError, CrossJoinSourceUnknownError, DanglingReferenceError, DerivationCycleError, DerivationOutputShapeError, DerivationCapExceededError, MaterializedViewCycleError, MaterializedViewSourceUnknownError, MaterializedViewTooLargeError, OverlayBaseIsVirtualError, OverlayCollectionUnavailableError, OverlayNameCollisionError, OverlayIdMismatchError, UnknownShardError, ShardProvisioningError, VaultTemplateNotFoundError;
 var init_errors = __esm({
   "src/errors.ts"() {
     "use strict";
@@ -155,6 +155,18 @@ var init_errors = __esm({
         this.offendingCollection = offendingCollection;
       }
     };
+    ReservedVaultNameError = class extends NoydbError {
+      /** The rejected vault name. */
+      vaultName;
+      constructor(vaultName) {
+        super(
+          "RESERVED_VAULT_NAME",
+          `"${vaultName}" is a reserved internal vault name and cannot be used as a group name or partition key`
+        );
+        this.name = "ReservedVaultNameError";
+        this.vaultName = vaultName;
+      }
+    };
     FieldFrozenError = class extends NoydbError {
       collection;
       id;
@@ -266,6 +278,39 @@ var init_errors = __esm({
         this.attempts = attempts;
       }
     };
+    SequenceContentionError = class extends NoydbError {
+      sequence;
+      attempts;
+      constructor(sequence, attempts) {
+        super(
+          "SEQUENCE_CONTENTION",
+          `vault.sequence("${sequence}").next(): failed to allocate after ${attempts} optimistic-CAS retries`
+        );
+        this.name = "SequenceContentionError";
+        this.sequence = sequence;
+        this.attempts = attempts;
+      }
+    };
+    SequenceOfflineError = class extends NoydbError {
+      constructor() {
+        super(
+          "SEQUENCE_OFFLINE",
+          "vault.sequence().next() requires an online CAS-capable store (capabilities.casAtomic). Gap-free numbering cannot be serialized offline."
+        );
+        this.name = "SequenceOfflineError";
+      }
+    };
+    NumberingUncertaintyError = class extends NoydbError {
+      series;
+      constructor(series) {
+        super(
+          "NUMBERING_UNCERTAINTY",
+          `Deferred numbering for series "${series}" cannot run: the store does not expose getStoreTime() (capabilities.serverWriteTime). Use a CAS sequence or a store with serverWriteTime.`
+        );
+        this.name = "NumberingUncertaintyError";
+        this.series = series;
+      }
+    };
     BundleVersionConflictError = class extends NoydbError {
       /** The bundle handle of the newer remote version that rejected the push. */
       remoteVersion;
@@ -679,6 +724,39 @@ Resolutions:
         this.expected = expected;
       }
     };
+    UnknownShardError = class extends NoydbError {
+      partitionKey;
+      constructor(partitionKey, groupName) {
+        super(
+          "SHARD_UNKNOWN",
+          `No shard for partition key "${partitionKey}" in vault group "${groupName}" and autoCreate is disabled. Call group.createShard(${JSON.stringify(partitionKey)}) first, or enable sharding.autoCreate.`
+        );
+        this.name = "UnknownShardError";
+        this.partitionKey = partitionKey;
+      }
+    };
+    ShardProvisioningError = class extends NoydbError {
+      vaultId;
+      constructor(vaultId, partitionKey) {
+        super(
+          "SHARD_PROVISIONING",
+          `Registry has a row for partition "${partitionKey}" (vault "${vaultId}") but that vault is not provisioned in the store. Refusing to recreate it \u2014 the registry and store have diverged. Investigate before retrying.`
+        );
+        this.name = "ShardProvisioningError";
+        this.vaultId = vaultId;
+      }
+    };
+    VaultTemplateNotFoundError = class extends NoydbError {
+      templateName;
+      constructor(templateName) {
+        super(
+          "VAULT_TEMPLATE_NOT_FOUND",
+          `No vault template registered under "${templateName}". Register it with db.withVaultTemplate(${JSON.stringify(templateName)}, { version, configure }) before opening the vault group.`
+        );
+        this.name = "VaultTemplateNotFoundError";
+        this.templateName = templateName;
+      }
+    };
   }
 });
 
@@ -2661,6 +2739,15 @@ var init_store = __esm({
   }
 });
 
+// src/federation/constants.ts
+var STATE_VAULT_NAME;
+var init_constants2 = __esm({
+  "src/federation/constants.ts"() {
+    "use strict";
+    STATE_VAULT_NAME = "__noydb_state__";
+  }
+});
+
 // src/policy/errors.ts
 var PolicyDeniedError, RecoveryNotEnrolledError, ManagedRecoveryNotEnrolledError, RecoveryProfileNotImplementedError;
 var init_errors2 = __esm({
@@ -3603,6 +3690,328 @@ var init_core = __esm({
   }
 });
 
+// src/money/fixed-point.ts
+function expandExponent(s) {
+  const m = /^([+-]?)(\d+)(?:\.(\d+))?[eE]([+-]?\d+)$/.exec(s);
+  if (!m) return s;
+  const sign = m[1] === "-" ? "-" : "";
+  const intp = m[2];
+  const frac = m[3] ?? "";
+  const exp = Number(m[4]);
+  const digits = intp + frac;
+  const pointPos = intp.length + exp;
+  let body;
+  if (pointPos <= 0) {
+    body = "0." + "0".repeat(-pointPos) + digits;
+  } else if (pointPos >= digits.length) {
+    body = digits + "0".repeat(pointPos - digits.length);
+  } else {
+    body = digits.slice(0, pointPos) + "." + digits.slice(pointPos);
+  }
+  return sign + body;
+}
+function toCanonicalDecimalString(input) {
+  let s;
+  if (typeof input === "number") {
+    if (!Number.isFinite(input)) return null;
+    s = String(input);
+  } else {
+    s = input.trim();
+  }
+  s = expandExponent(s);
+  if (s.startsWith("+")) s = s.slice(1);
+  if (!/^-?(\d+(\.\d*)?|\.\d+)$/.test(s)) return null;
+  return s;
+}
+function shouldRoundUp(negative, lastKeptDigit, firstDiscarded, hasMoreNonZeroAfterFirst, mode) {
+  switch (mode) {
+    case "up":
+      return true;
+    case "down":
+      return false;
+    case "ceil":
+      return !negative;
+    case "floor":
+      return negative;
+    case "half-up":
+      return firstDiscarded >= 5;
+    case "half-down":
+      return firstDiscarded > 5 || firstDiscarded === 5 && hasMoreNonZeroAfterFirst;
+    case "half-even":
+      if (firstDiscarded > 5) return true;
+      if (firstDiscarded < 5) return false;
+      return hasMoreNonZeroAfterFirst || lastKeptDigit % 2 === 1;
+  }
+}
+function parseToScaledInt(input, scale, rounding) {
+  const canonical2 = toCanonicalDecimalString(input);
+  if (canonical2 === null) return { ok: false, reason: "nonfinite" };
+  const negative = canonical2.startsWith("-");
+  const unsigned = negative ? canonical2.slice(1) : canonical2;
+  const dot = unsigned.indexOf(".");
+  const intPart = dot === -1 ? unsigned : unsigned.slice(0, dot);
+  const fracPart = dot === -1 ? "" : unsigned.slice(dot + 1);
+  const intDigits = intPart === "" ? "0" : intPart;
+  if (fracPart.length <= scale) {
+    const keep2 = fracPart.padEnd(scale, "0");
+    const magnitude2 = BigInt(intDigits + keep2);
+    return { ok: true, value: negative && magnitude2 !== 0n ? -magnitude2 : magnitude2 };
+  }
+  const keep = fracPart.slice(0, scale);
+  const tail = fracPart.slice(scale);
+  const magnitudeDigits = intDigits + keep;
+  let magnitude = BigInt(magnitudeDigits);
+  if (/^0+$/.test(tail)) {
+    return { ok: true, value: negative && magnitude !== 0n ? -magnitude : magnitude };
+  }
+  if (rounding === void 0) return { ok: false, reason: "precision" };
+  const lastKeptDigit = Number(magnitudeDigits[magnitudeDigits.length - 1]);
+  const firstDiscarded = Number(tail[0]);
+  const hasMoreNonZeroAfterFirst = /[1-9]/.test(tail.slice(1));
+  if (shouldRoundUp(negative, lastKeptDigit, firstDiscarded, hasMoreNonZeroAfterFirst, rounding)) {
+    magnitude += 1n;
+  }
+  return { ok: true, value: negative && magnitude !== 0n ? -magnitude : magnitude };
+}
+function formatScaledInt(value, scale) {
+  const negative = value < 0n;
+  const abs = (negative ? -value : value).toString();
+  if (scale === 0) return (negative ? "-" : "") + abs;
+  const padded = abs.padStart(scale + 1, "0");
+  const cut = padded.length - scale;
+  const intPart = padded.slice(0, cut);
+  const fracPart = padded.slice(cut);
+  return (negative ? "-" : "") + intPart + "." + fracPart;
+}
+var init_fixed_point = __esm({
+  "src/money/fixed-point.ts"() {
+    "use strict";
+  }
+});
+
+// src/money/iso4217.ts
+function scaleForCurrency(code) {
+  const v = MINOR_UNITS[code];
+  return v === void 0 ? null : v;
+}
+var MINOR_UNITS;
+var init_iso4217 = __esm({
+  "src/money/iso4217.ts"() {
+    "use strict";
+    MINOR_UNITS = {
+      // 2-decimal majors
+      EUR: 2,
+      USD: 2,
+      GBP: 2,
+      CHF: 2,
+      CAD: 2,
+      AUD: 2,
+      NZD: 2,
+      SGD: 2,
+      HKD: 2,
+      CNY: 2,
+      INR: 2,
+      BRL: 2,
+      MXN: 2,
+      ZAR: 2,
+      RUB: 2,
+      TRY: 2,
+      PLN: 2,
+      SEK: 2,
+      NOK: 2,
+      DKK: 2,
+      CZK: 2,
+      HUF: 2,
+      RON: 2,
+      ILS: 2,
+      THB: 2,
+      PHP: 2,
+      MYR: 2,
+      IDR: 2,
+      AED: 2,
+      SAR: 2,
+      QAR: 2,
+      EGP: 2,
+      // 0-decimal
+      JPY: 0,
+      KRW: 0,
+      ISK: 0,
+      CLP: 0,
+      VND: 0,
+      XOF: 0,
+      XAF: 0,
+      PYG: 0,
+      // 3-decimal
+      BHD: 3,
+      KWD: 3,
+      OMR: 3,
+      TND: 3,
+      JOD: 3,
+      IQD: 3,
+      LYD: 3
+    };
+  }
+});
+
+// src/money/descriptor.ts
+var MoneyPrecisionError, MoneyUnsupportedError;
+var init_descriptor = __esm({
+  "src/money/descriptor.ts"() {
+    "use strict";
+    init_errors();
+    MoneyPrecisionError = class extends NoydbError {
+      constructor(field, value, scale) {
+        super(
+          "MONEY_PRECISION",
+          `money: value ${JSON.stringify(value)} for field "${field}" exceeds scale ${scale} and no rounding mode is configured`
+        );
+        this.field = field;
+        this.value = value;
+        this.scale = scale;
+        this.name = "MoneyPrecisionError";
+      }
+      field;
+      value;
+      scale;
+    };
+    MoneyUnsupportedError = class extends NoydbError {
+      constructor(field, message) {
+        super(
+          "MONEY_UNSUPPORTED",
+          message ?? `money: operation is not supported on field "${field}" \u2014 use sum() and count() and divide at the boundary`
+        );
+        this.field = field;
+        this.name = "MoneyUnsupportedError";
+      }
+      field;
+    };
+  }
+});
+
+// src/money/normalize.ts
+function isMoneyValueObject(v) {
+  return typeof v === "object" && v !== null && "currency" in v;
+}
+function quantizeAmount(field, input, scale, rounding) {
+  const r = parseToScaledInt(input, scale, rounding);
+  if (!r.ok) {
+    if (r.reason === "precision") throw new MoneyPrecisionError(field, input, scale);
+    throw new TypeError(`money: field "${field}" value ${JSON.stringify(input)} is not a finite decimal`);
+  }
+  return r.value.toString();
+}
+function quantizeMoneyFields(record, moneyFields) {
+  const out = { ...record };
+  for (const [field, desc] of Object.entries(moneyFields)) {
+    const raw = out[field];
+    if (raw === null || raw === void 0) continue;
+    if (desc.mode === "fixed") {
+      const currency2 = desc.fixedCurrency;
+      out[field] = quantizeAmount(field, raw, desc.scaleFor(currency2), desc.rounding);
+      continue;
+    }
+    let amount;
+    let currency;
+    if (isMoneyValueObject(raw)) {
+      currency = String(raw.currency);
+      amount = raw.amount;
+    } else {
+      const sole = desc.soleCurrency();
+      if (sole === void 0) {
+        throw new TypeError(
+          `money: field "${field}" is multi-currency \u2014 write { amount, currency }, not a bare amount`
+        );
+      }
+      currency = sole;
+      amount = raw;
+    }
+    const scale = desc.scaleFor(currency);
+    out[field] = { amount: quantizeAmount(field, amount, scale, desc.rounding), currency };
+  }
+  return out;
+}
+function formatCurrency(decimal, currency, scale, locale) {
+  const fmt = new Intl.NumberFormat(locale, {
+    style: "currency",
+    currency,
+    minimumFractionDigits: scale,
+    maximumFractionDigits: scale
+  });
+  return fmt.format(decimal);
+}
+function decodeMoneyFields(record, moneyFields, locale) {
+  const out = { ...record };
+  const format = locale !== "raw";
+  const fmtLocale = typeof locale === "string" && locale !== "raw" ? locale : "en-US";
+  for (const [field, desc] of Object.entries(moneyFields)) {
+    const stored = out[field];
+    if (stored === null || stored === void 0) continue;
+    let currency;
+    let scaledIntString;
+    if (desc.mode === "fixed") {
+      if (typeof stored !== "string" && typeof stored !== "number") continue;
+      currency = desc.fixedCurrency;
+      scaledIntString = String(stored);
+    } else {
+      if (!isMoneyValueObject(stored)) continue;
+      const amount = stored.amount;
+      if (typeof stored.currency !== "string" || typeof amount !== "string" && typeof amount !== "number") continue;
+      currency = stored.currency;
+      scaledIntString = String(amount);
+    }
+    const scale = desc.scaleFor(currency);
+    const decimal = formatScaledInt(BigInt(scaledIntString), scale);
+    out[field] = desc.mode === "fixed" ? decimal : { amount: decimal, currency };
+    if (format) {
+      out[`${field}Formatted`] = formatCurrency(decimal, currency, scale, fmtLocale);
+      out[`${field}Number`] = Number(decimal);
+    }
+  }
+  return out;
+}
+var init_normalize = __esm({
+  "src/money/normalize.ts"() {
+    "use strict";
+    init_fixed_point();
+    init_descriptor();
+  }
+});
+
+// src/computed/index.ts
+function evalComputedFields(record, computed, id) {
+  const out = { ...record };
+  for (const [field, fn] of Object.entries(computed)) {
+    try {
+      out[field] = fn(out);
+    } catch (cause) {
+      throw new ComputedFieldError(field, id, cause);
+    }
+  }
+  return out;
+}
+var ComputedFieldError;
+var init_computed = __esm({
+  "src/computed/index.ts"() {
+    "use strict";
+    init_errors();
+    ComputedFieldError = class extends NoydbError {
+      constructor(field, id, cause) {
+        super(
+          "COMPUTED_FIELD",
+          `computed field "${field}" threw for record "${id}": ` + (cause instanceof Error ? cause.message : String(cause))
+        );
+        this.field = field;
+        this.id = id;
+        this.cause = cause;
+        this.name = "ComputedFieldError";
+      }
+      field;
+      id;
+      cause;
+    };
+  }
+});
+
 // src/i18n/strategy.ts
 function notEnabled(op) {
   return new Error(
@@ -4087,6 +4496,189 @@ var init_strategy4 = __esm({
   }
 });
 
+// src/money/money-reducer.ts
+function toScaledInt(v) {
+  if (typeof v === "string" || typeof v === "number" || typeof v === "bigint") {
+    try {
+      return BigInt(v);
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function readMoney(record, field, desc) {
+  const raw = readPath(record, field);
+  if (raw === null || raw === void 0) return null;
+  if (desc.mode === "fixed") {
+    const value2 = toScaledInt(raw);
+    return value2 === null ? null : { currency: desc.fixedCurrency, value: value2 };
+  }
+  if (typeof raw !== "object") return null;
+  const o = raw;
+  if (typeof o.currency !== "string") return null;
+  const value = toScaledInt(o.amount);
+  return value === null ? null : { currency: o.currency, value };
+}
+function targetScaleFor(desc, currency) {
+  if (desc.allows(currency)) return desc.scaleFor(currency);
+  const s = scaleForCurrency(currency);
+  if (s === null) {
+    throw new Error(`money: cannot determine scale for conversion target "${currency}"`);
+  }
+  return s;
+}
+function parseRate(rate) {
+  const s = String(rate).trim();
+  const neg = s.startsWith("-");
+  const body = neg ? s.slice(1) : s;
+  const dot = body.indexOf(".");
+  const intPart = dot === -1 ? body : body.slice(0, dot);
+  const fracPart = dot === -1 ? "" : body.slice(dot + 1);
+  const int = BigInt((intPart === "" ? "0" : intPart) + fracPart);
+  return { int: neg ? -int : int, scale: fracPart.length };
+}
+function divRoundHalfEven(n, d) {
+  const q = n / d;
+  const r = n % d;
+  const twiceR = (r < 0n ? -r : r) * 2n;
+  if (twiceR < d) return q;
+  if (twiceR > d) return q + (n < 0n ? -1n : 1n);
+  return q % 2n === 0n ? q : q + (n < 0n ? -1n : 1n);
+}
+function convertScaled(value, srcScale, rate, targetScale) {
+  const { int: rateInt, scale: rateScale } = parseRate(rate);
+  const product = value * rateInt;
+  const curScale = srcScale + rateScale;
+  if (curScale === targetScale) return product;
+  if (curScale < targetScale) return product * 10n ** BigInt(targetScale - curScale);
+  return divRoundHalfEven(product, 10n ** BigInt(curScale - targetScale));
+}
+function finalizeSum(state, desc, convertTo, fx) {
+  if (convertTo !== void 0) {
+    if (fx === void 0) {
+      throw new Error(`money: sum convertTo "${convertTo}" requires an fx rate map`);
+    }
+    const targetScale = targetScaleFor(desc, convertTo);
+    let total = 0n;
+    for (const [cur, v] of state) {
+      if (cur === convertTo) {
+        total += convertScaled(v, desc.scaleFor(cur), 1, targetScale);
+        continue;
+      }
+      const rate = fx[`${cur}->${convertTo}`];
+      if (rate === void 0) {
+        throw new Error(`money: no fx rate for "${cur}->${convertTo}"`);
+      }
+      total += convertScaled(v, desc.scaleFor(cur), rate, targetScale);
+    }
+    return formatScaledInt(total, targetScale);
+  }
+  if (desc.mode === "fixed") {
+    const cur = desc.fixedCurrency;
+    return formatScaledInt(state.get(cur) ?? 0n, desc.scaleFor(cur));
+  }
+  const out = {};
+  for (const [cur, v] of state) out[cur] = formatScaledInt(v, desc.scaleFor(cur));
+  return out;
+}
+function moneySumReducer(field, desc, convertTo, fx) {
+  return {
+    op: "sum",
+    field,
+    init: () => /* @__PURE__ */ new Map(),
+    step: (state, record) => {
+      const m = readMoney(record, field, desc);
+      if (m) state.set(m.currency, (state.get(m.currency) ?? 0n) + m.value);
+      return state;
+    },
+    remove: (state, record) => {
+      const m = readMoney(record, field, desc);
+      if (m) state.set(m.currency, (state.get(m.currency) ?? 0n) - m.value);
+      return state;
+    },
+    finalize: (state) => finalizeSum(state, desc, convertTo, fx)
+  };
+}
+function extremum(values, op) {
+  let out = values[0];
+  for (let i = 1; i < values.length; i++) {
+    const v = values[i];
+    if (op === "min" ? v < out : v > out) out = v;
+  }
+  return out;
+}
+function moneyMinMaxReducer(op, field, desc) {
+  return {
+    op,
+    field,
+    init: () => /* @__PURE__ */ new Map(),
+    step: (state, record) => {
+      const m = readMoney(record, field, desc);
+      if (m) {
+        const arr = state.get(m.currency);
+        if (arr) arr.push(m.value);
+        else state.set(m.currency, [m.value]);
+      }
+      return state;
+    },
+    remove: (state, record) => {
+      const m = readMoney(record, field, desc);
+      if (m) {
+        const arr = state.get(m.currency);
+        if (arr) {
+          const idx = arr.indexOf(m.value);
+          if (idx >= 0) arr.splice(idx, 1);
+        }
+      }
+      return state;
+    },
+    finalize: (state) => {
+      if (desc.mode === "fixed") {
+        const cur = desc.fixedCurrency;
+        const arr = state.get(cur);
+        if (!arr || arr.length === 0) return null;
+        return formatScaledInt(extremum(arr, op), desc.scaleFor(cur));
+      }
+      const out = {};
+      for (const [cur, arr] of state) {
+        if (arr.length > 0) out[cur] = formatScaledInt(extremum(arr, op), desc.scaleFor(cur));
+      }
+      return out;
+    }
+  };
+}
+function wrapMoneyReducers(spec, moneyFields) {
+  let changed = false;
+  const out = {};
+  for (const [key, reducer] of Object.entries(spec)) {
+    const field = reducer.field;
+    const desc = field ? moneyFields[field] : void 0;
+    if (desc && reducer.op === "avg") {
+      throw new MoneyUnsupportedError(
+        field,
+        `avg() is not supported on money field "${field}" in v1 \u2014 use sum() and count() and divide at the boundary.`
+      );
+    }
+    if (desc && (reducer.op === "sum" || reducer.op === "min" || reducer.op === "max")) {
+      changed = true;
+      out[key] = reducer.op === "sum" ? moneySumReducer(field, desc, reducer.convertTo, reducer.fx) : moneyMinMaxReducer(reducer.op, field, desc);
+    } else {
+      out[key] = reducer;
+    }
+  }
+  return changed ? out : spec;
+}
+var init_money_reducer = __esm({
+  "src/money/money-reducer.ts"() {
+    "use strict";
+    init_predicate();
+    init_fixed_point();
+    init_iso4217();
+    init_descriptor();
+  }
+});
+
 // src/query/builder.ts
 function executePlanWithSource(source, plan, joinContext) {
   const hasCrossJoins = plan.clauses.some((c) => c.type === "crossJoin");
@@ -4309,7 +4901,7 @@ function serializeClause(clause) {
 }
 function canonicalCtxHash(ctx) {
   if (ctx === void 0) return "";
-  const canonical = JSON.stringify(ctx, (_key, value) => {
+  const canonical2 = JSON.stringify(ctx, (_key, value) => {
     if (value && typeof value === "object" && !Array.isArray(value)) {
       const sorted = {};
       for (const k of Object.keys(value).sort()) {
@@ -4320,8 +4912,8 @@ function canonicalCtxHash(ctx) {
     return value;
   });
   let h = 5381;
-  for (let i = 0; i < canonical.length; i++) {
-    h = (h << 5) + h ^ canonical.charCodeAt(i);
+  for (let i = 0; i < canonical2.length; i++) {
+    h = (h << 5) + h ^ canonical2.charCodeAt(i);
   }
   return (h >>> 0).toString(16).padStart(8, "0");
 }
@@ -4363,6 +4955,8 @@ var init_builder = __esm({
     init_errors();
     init_live();
     init_strategy4();
+    init_money_reducer();
+    init_normalize();
     EMPTY_PLAN = {
       clauses: [],
       orderBy: [],
@@ -4731,7 +5325,7 @@ var init_builder = __esm({
        * for the ordering rationale.
        */
       toArray() {
-        const base = executePlanWithSource(this.source, this.plan, this.joinContext);
+        const base = this.decodeMoney(executePlanWithSource(this.source, this.plan, this.joinContext));
         if (this.plan.joins.length === 0) return base;
         if (!this.joinContext) {
           throw new Error(
@@ -4740,6 +5334,23 @@ var init_builder = __esm({
         }
         return applyJoins(base, this.plan.joins, this.joinContext);
       }
+      /**
+       * Decode this source's money fields on read (stored scaled-int → canonical
+       * decimal), so `query().toArray()` agrees with `get()`/`sum()` on the value.
+       * No-op when the source declares no money fields.
+       *
+       * The query layer carries no locale context, so we decode with `'raw'` —
+       * canonical decimal, WITHOUT fabricating locale-formatted `<field>Formatted`
+       * / `<field>Number` virtuals. Producing a guessed-locale string here would
+       * just reintroduce #322's "two read paths disagree" failure on the virtual
+       * field (e.g. it-IT via `get()` vs en-US here). Consumers who need formatted
+       * money read through `get()`/`list()` with a locale.
+       */
+      decodeMoney(records) {
+        const moneyFields = this.source.moneyFields;
+        if (!moneyFields || Object.keys(moneyFields).length === 0) return records;
+        return records.map((r) => decodeMoneyFields(r, moneyFields, "raw"));
+      }
       /** Return the first matching record, or null. Joins are applied. */
       first() {
         const arr = this.limit(1).toArray();
@@ -4808,6 +5419,10 @@ var init_builder = __esm({
        * partition boundaries without an API break.
        */
       aggregate(spec) {
+        const moneyFields = this.source.moneyFields;
+        if (moneyFields) {
+          spec = wrapMoneyReducers(spec, moneyFields);
+        }
         const source = this.source;
         const clauses = this.plan.clauses;
         const joinCtx = this.joinContext;
@@ -4855,13 +5470,15 @@ var init_builder = __esm({
             executeRecords,
             field,
             upstreams,
-            dictLabelResolver
+            dictLabelResolver,
+            this.source.moneyFields
           );
         }
         return this.aggregateStrategy.groupByN(
           executeRecords,
           fields,
-          upstreams
+          upstreams,
+          this.source.moneyFields
         );
       }
       /**
@@ -4982,6 +5599,29 @@ var init_builder = __esm({
   }
 });
 
+// src/aggregate/aggregation.ts
+function reduceRecords(records, spec) {
+  const state = {};
+  for (const key of Object.keys(spec)) {
+    state[key] = spec[key].init();
+  }
+  for (const record of records) {
+    for (const key of Object.keys(spec)) {
+      state[key] = spec[key].step(state[key], record);
+    }
+  }
+  const result = {};
+  for (const key of Object.keys(spec)) {
+    result[key] = spec[key].finalize(state[key]);
+  }
+  return result;
+}
+var init_aggregation = __esm({
+  "src/aggregate/aggregation.ts"() {
+    "use strict";
+  }
+});
+
 // src/aggregate/canonical-key.ts
 function canonicalGroupKey(fields, row) {
   const sorted = [...fields].sort();
@@ -5088,6 +5728,7 @@ var init_scan_builder = __esm({
     "use strict";
     init_predicate();
     init_errors();
+    init_normalize();
     DEFAULT_SCAN_PAGE_SIZE = 100;
     ScanBuilder = class _ScanBuilder {
       pageProvider;
@@ -5113,12 +5754,29 @@ var init_scan_builder = __esm({
        * context throws with an actionable error.
        */
       joinContext;
-      constructor(pageProvider, pageSize = DEFAULT_SCAN_PAGE_SIZE, clauses = [], joins = [], joinContext) {
+      /**
+       * Money field descriptors for the backing collection. When present, yielded
+       * records are decoded (stored scaled-int → canonical decimal) so `scan()`
+       * agrees with `get()`/`list()`/`query().toArray()` — #322. Decoded with
+       * `'raw'` (canonical decimal, no locale-formatted virtuals) since the scan
+       * stream carries no locale context, mirroring `Query.toArray()`.
+       */
+      moneyFields;
+      constructor(pageProvider, pageSize = DEFAULT_SCAN_PAGE_SIZE, clauses = [], joins = [], joinContext, moneyFields) {
         this.pageProvider = pageProvider;
         this.pageSize = pageSize;
         this.clauses = clauses;
         this.joins = joins;
         this.joinContext = joinContext;
+        this.moneyFields = moneyFields;
+      }
+      /**
+       * Decode this scan's money fields on a record (stored scaled-int → canonical
+       * decimal). No-op when no money fields are declared. See {@link moneyFields}.
+       */
+      decodeMoney(record) {
+        if (!this.moneyFields || Object.keys(this.moneyFields).length === 0) return record;
+        return decodeMoneyFields(record, this.moneyFields, "raw");
       }
       /**
        * Add a field comparison. Runs per record as the scan stream
@@ -5140,7 +5798,8 @@ var init_scan_builder = __esm({
           this.pageSize,
           [...this.clauses, clause],
           this.joins,
-          this.joinContext
+          this.joinContext,
+          this.moneyFields
         );
       }
       /**
@@ -5159,7 +5818,8 @@ var init_scan_builder = __esm({
           this.pageSize,
           [...this.clauses, clause],
           this.joins,
-          this.joinContext
+          this.joinContext,
+          this.moneyFields
         );
       }
       /**
@@ -5270,7 +5930,8 @@ var init_scan_builder = __esm({
           this.pageSize,
           this.clauses,
           [...this.joins, leg],
-          this.joinContext
+          this.joinContext,
+          this.moneyFields
         );
       }
       /**
@@ -5287,10 +5948,11 @@ var init_scan_builder = __esm({
         while (true) {
           for (const record of page.items) {
             if (!this.recordMatches(record)) continue;
+            const decoded = this.decodeMoney(record);
             if (joinResolvers === null) {
-              yield record;
+              yield decoded;
             } else {
-              let attached = record;
+              let attached = decoded;
               for (const resolver of joinResolvers) {
                 attached = this.applyOneJoinStreaming(attached, resolver);
               }
@@ -6458,12 +7120,12 @@ var init_dependency_analyzer = __esm({
 
 // src/materialized-views/query-hash.ts
 async function computeQueryHash(mvName, dependencies, queryPlanSummary) {
-  const canonical = JSON.stringify({
+  const canonical2 = JSON.stringify({
     mvName,
     dependencies: [...dependencies].sort(),
     queryPlanSummary
   });
-  const bytes = new TextEncoder().encode(canonical);
+  const bytes = new TextEncoder().encode(canonical2);
   const digest = await crypto.subtle.digest("SHA-256", bytes);
   return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
@@ -7017,6 +7679,8 @@ var init_collection = __esm({
     init_types();
     init_strategy();
     init_core();
+    init_normalize();
+    init_computed();
     init_strategy2();
     init_policy();
     init_crypto();
@@ -7185,6 +7849,18 @@ var init_collection = __esm({
        * fields when a locale is requested.
        */
       dictKeyFields;
+      /**
+       * Money field descriptors keyed by field path. Declared via the
+       * `moneyFields` collection option: `put()` quantizes to a scaled-int
+       * string, `get()`/`list()` decode back. Mutable so {@link _applyMoneyFields}
+       * can attach descriptors to a collection MV-analysis pre-created.
+       */
+      moneyFields;
+      /**
+       * Computed scalar fields, evaluated first on every `put()`. Mutable for
+       * the same MV-pre-creation reconcile as {@link moneyFields}.
+       */
+      computed;
       /**
        * Async callback provided by the Vault that resolves a dict key
        * to its label for a given locale. Used by the locale-read path for
@@ -7326,6 +8002,8 @@ var init_collection = __esm({
         this.joinResolver = opts.joinResolver;
         this.i18nFields = opts.i18nFields;
         this.dictKeyFields = opts.dictKeyFields;
+        this.moneyFields = opts.moneyFields;
+        this.computed = opts.computed;
         this.dictLabelResolver = opts.dictLabelResolver;
         this.i18nPutValidator = opts.i18nPutValidator;
         this.autoTranslateHook = opts.autoTranslateHook;
@@ -7450,6 +8128,19 @@ var init_collection = __esm({
       getSchema() {
         return this.schema;
       }
+      /**
+       * @internal — attach money descriptors post-construction. MV dependency
+       * analysis auto-creates a source collection (without options) during
+       * `openVault`, before the user's `collection(name, { moneyFields })`
+       * declaration; this reconciles that ordering. First-wins. Not public.
+       */
+      _applyMoneyFields(moneyFields) {
+        if (this.moneyFields === void 0) this.moneyFields = moneyFields;
+      }
+      /** @internal — attach computed fields post-construction. See {@link _applyMoneyFields}. */
+      _applyComputed(computed) {
+        if (this.computed === void 0) this.computed = computed;
+      }
       /**
        * Get a single record by ID.
        *
@@ -7621,7 +8312,7 @@ var init_collection = __esm({
               existingRecord = null;
             }
           }
-          await this.subsystemBus.dispatchGate("beforePut", {
+          const gateEvent = {
             op: existingEnv ? "update" : "create",
             vault: this.vault,
             collection: this.name,
@@ -7631,12 +8322,20 @@ var init_collection = __esm({
             existingVersion: existingEnv?._v ?? 0,
             existingTs: existingEnv?._ts,
             userId: this.keyring.userId,
-            role: this.keyring.role
-          });
+            role: this.keyring.role,
+            ...this.computed !== void 0 ? { computedFieldNames: new Set(Object.keys(this.computed)) } : {}
+          };
+          await this.subsystemBus.dispatchGate("beforePut", gateEvent);
+        }
+        if (this.computed !== void 0) {
+          record = evalComputedFields(record, this.computed, id);
         }
         if (this.schema !== void 0) {
           record = await validateSchemaInput(this.schema, record, `put(${id})`);
         }
+        if (this.moneyFields) {
+          record = quantizeMoneyFields(record, this.moneyFields);
+        }
         if (this.i18nFields) {
           const obj = record;
           for (const [field, descriptor] of Object.entries(this.i18nFields)) {
@@ -8287,9 +8986,17 @@ var init_collection = __esm({
         }
         await this.ensureHydrated();
         const records = [...this.cache.values()].map((e) => e.record);
-        if (!locale) return records;
+        if (!this.hasReadTransforms()) return records;
         return Promise.all(records.map((r) => this.applyLocaleToRecord(r, locale)));
       }
+      /**
+       * @internal — whether any read-side record transform is registered
+       * (money decode, i18nText resolution, dictKey labels). Gates the
+       * no-transform fast path in {@link list}.
+       */
+      hasReadTransforms() {
+        return this.moneyFields !== void 0 && Object.keys(this.moneyFields).length > 0 || this.i18nFields !== void 0 && Object.keys(this.i18nFields).length > 0 || this.dictKeyFields !== void 0 && Object.keys(this.dictKeyFields).length > 0;
+      }
       // ─── Bulk operations ─────────────────────────────────────
       /**
        * Put many records in one call. Each item is processed sequentially
@@ -8458,7 +9165,8 @@ var init_collection = __esm({
           // fields. The Query builder consults these when present and falls
           // back to a linear scan otherwise.
           getIndexes: () => this.getIndexes(),
-          lookupById: (id) => this.cache.get(id)?.record
+          lookupById: (id) => this.cache.get(id)?.record,
+          ...this.moneyFields ? { moneyFields: this.moneyFields } : {}
         };
         const resolver = this.joinResolver;
         const leftCollection = this.name;
@@ -8794,7 +9502,8 @@ var init_collection = __esm({
           pageSize,
           [],
           [],
-          joinContext
+          joinContext,
+          this.moneyFields
         );
       }
       /** Decrypt a page of envelopes returned by `adapter.listPage`. */
@@ -9140,10 +9849,14 @@ var init_collection = __esm({
       async applyLocaleToRecord(record, localeOpts) {
         const hasI18n = this.i18nFields && Object.keys(this.i18nFields).length > 0;
         const hasDict = this.dictKeyFields && Object.keys(this.dictKeyFields).length > 0;
-        if (!hasI18n && !hasDict) return record;
+        const hasMoney = this.moneyFields && Object.keys(this.moneyFields).length > 0;
+        if (!hasI18n && !hasDict && !hasMoney) return record;
         const locale = localeOpts?.locale ?? this.defaultLocale;
-        if (!locale) return record;
         let result = record;
+        if (hasMoney && this.moneyFields) {
+          result = decodeMoneyFields(result, this.moneyFields, typeof locale === "string" ? locale : void 0);
+        }
+        if (!locale) return result;
         if (hasI18n && this.i18nFields) {
           result = this.i18nStrategy.applyI18nLocale(result, this.i18nFields, locale, localeOpts?.fallback);
         }
@@ -9982,49 +10695,387 @@ var init_virtual_collection = __esm({
   }
 });
 
-// src/shadow/strategy.ts
-var NOT_ENABLED3, NO_SHADOW;
-var init_strategy7 = __esm({
-  "src/shadow/strategy.ts"() {
-    "use strict";
-    NOT_ENABLED3 = new Error(
-      'VaultFrame requires the shadow strategy. Import `{ withShadow }` from "@noy-db/hub/shadow" and pass it to `createNoydb({ shadowStrategy: withShadow() })`.'
-    );
-    NO_SHADOW = {
-      buildFrame() {
-        throw NOT_ENABLED3;
+// src/archive/engine.ts
+function isHeld(policy, record) {
+  if (!policy.legalHold) return false;
+  try {
+    return policy.legalHold(record);
+  } catch {
+    return true;
+  }
+}
+async function runArchive(ctx, options = {}) {
+  const maxArchives = options.maxArchives ?? Infinity;
+  const dryRun = options.dryRun === true;
+  let archived = 0;
+  let held = 0;
+  let scanned = 0;
+  const byCollection = {};
+  outer: for (const collection of ctx.collectionsWithPolicy()) {
+    const policy = ctx.getPolicy(collection);
+    if (!policy) continue;
+    byCollection[collection] = { archived: 0, held: 0 };
+    for (const id of await ctx.listRecordIds(collection)) {
+      if (archived >= maxArchives) break outer;
+      const record = await ctx.getRecord(collection, id).catch(() => null);
+      if (record === null) continue;
+      scanned += 1;
+      let eligible = false;
+      try {
+        eligible = policy.archiveWhen(record);
+      } catch {
+        eligible = false;
       }
-    };
+      if (!eligible) continue;
+      if (isHeld(policy, record)) {
+        held += 1;
+        byCollection[collection].held += 1;
+        continue;
+      }
+      if (!dryRun) {
+        const env = await ctx.getEnvelope(collection, id);
+        if (!env) continue;
+        await ctx.archiveStore.put(ctx.vaultId, collection, id, env);
+        await ctx.removeFromPrimary(collection, id);
+      }
+      archived += 1;
+      byCollection[collection].archived += 1;
+    }
+  }
+  return { archived, held, scanned, byCollection };
+}
+async function runRestore(ctx, collection, id) {
+  const env = await ctx.archiveStore.get(ctx.vaultId, collection, id);
+  if (!env) return false;
+  await ctx.restoreToPrimary(collection, id, env);
+  await ctx.archiveStore.delete(ctx.vaultId, collection, id);
+  return true;
+}
+async function runListArchived(ctx, collection) {
+  const collections = collection ? [collection] : ctx.collectionsWithPolicy();
+  const out = [];
+  for (const c of collections) {
+    const ids = await ctx.archiveStore.list(ctx.vaultId, c);
+    for (const id of ids) out.push({ collection: c, id });
+  }
+  return out;
+}
+var init_engine = __esm({
+  "src/archive/engine.ts"() {
+    "use strict";
   }
 });
 
-// src/consent/strategy.ts
-var NO_CONSENT;
-var init_strategy8 = __esm({
-  "src/consent/strategy.ts"() {
+// src/archive/index.ts
+var init_archive = __esm({
+  "src/archive/index.ts"() {
     "use strict";
-    NO_CONSENT = {
-      async write() {
-      },
-      async read() {
-        return [];
-      }
-    };
+    init_engine();
   }
 });
 
-// src/periods/strategy.ts
-var NOT_ENABLED4, NO_PERIODS;
-var init_strategy9 = __esm({
-  "src/periods/strategy.ts"() {
+// src/sequence/index.ts
+async function sleepBackoff2(attempt) {
+  const ceil = Math.min(2 ** attempt, 32);
+  const ms = Math.floor(Math.random() * ceil);
+  await new Promise((r) => setTimeout(r, ms));
+}
+var SEQUENCE_COLLECTION, MAX_NEXT_ATTEMPTS, SequenceStore;
+var init_sequence = __esm({
+  "src/sequence/index.ts"() {
     "use strict";
-    NOT_ENABLED4 = new Error(
-      'Accounting periods require the periods strategy. Import `{ withPeriods }` from "@noy-db/hub/periods" and pass it to `createNoydb({ periodsStrategy: withPeriods() })`.'
-    );
-    NO_PERIODS = {
-      async loadPeriods() {
-        return [];
-      },
+    init_types();
+    init_crypto();
+    init_errors();
+    SEQUENCE_COLLECTION = "_sequences";
+    MAX_NEXT_ATTEMPTS = 16;
+    SequenceStore = class {
+      adapter;
+      vault;
+      encrypted;
+      getDEK;
+      actor;
+      /**
+       * Memoized DEK promise. The `_sequences` collection DEK is created on
+       * first access; without sharing one promise, a burst of concurrent
+       * `next()` calls would each trigger DEK creation and diverge (one
+       * writer's ciphertext unreadable by another). One shared promise → one
+       * DEK.
+       */
+      dekPromise = null;
+      constructor(opts) {
+        this.adapter = opts.adapter;
+        this.vault = opts.vault;
+        this.encrypted = opts.encrypted;
+        this.getDEK = opts.getDEK;
+        this.actor = opts.actor;
+      }
+      /** A handle bound to one sequence name. */
+      handle(name) {
+        return {
+          next: () => this.next(name),
+          peek: () => this.peek(name)
+        };
+      }
+      assertOnline() {
+        if (this.adapter.capabilities?.casAtomic !== true) {
+          throw new SequenceOfflineError();
+        }
+      }
+      dek() {
+        if (!this.dekPromise) this.dekPromise = this.getDEK(SEQUENCE_COLLECTION);
+        return this.dekPromise;
+      }
+      async read(name) {
+        const env = await this.adapter.get(this.vault, SEQUENCE_COLLECTION, name);
+        if (!env) return { env: null, value: 0 };
+        const json = this.encrypted ? await decrypt(env._iv, env._data, await this.dek()) : env._data;
+        const state = JSON.parse(json);
+        return { env, value: state.value };
+      }
+      async encryptState(state, version) {
+        const json = JSON.stringify(state);
+        if (!this.encrypted) {
+          return { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: "", _data: json, _by: this.actor };
+        }
+        const { iv, data } = await encrypt(json, await this.dek());
+        return { _noydb: NOYDB_FORMAT_VERSION, _v: version, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: iv, _data: data, _by: this.actor };
+      }
+      async peek(name) {
+        return (await this.read(name)).value;
+      }
+      async next(name) {
+        this.assertOnline();
+        let lastConflict;
+        for (let attempt = 0; attempt < MAX_NEXT_ATTEMPTS; attempt++) {
+          const { env, value } = await this.read(name);
+          const nextValue = value + 1;
+          const expectedVersion = env?._v ?? 0;
+          const envelope = await this.encryptState({ value: nextValue }, expectedVersion + 1);
+          try {
+            await this.adapter.put(this.vault, SEQUENCE_COLLECTION, name, envelope, expectedVersion);
+            return nextValue;
+          } catch (err) {
+            if (err instanceof ConflictError) {
+              lastConflict = err;
+              if (attempt < MAX_NEXT_ATTEMPTS - 1) await sleepBackoff2(attempt);
+              continue;
+            }
+            throw err;
+          }
+        }
+        void lastConflict;
+        throw new SequenceContentionError(name, MAX_NEXT_ATTEMPTS);
+      }
+    };
+  }
+});
+
+// src/numbering/index.ts
+var NUMBERING_HEAD_COLLECTION, NUMBERING_PENDING_COLLECTION, DeferredNumberingStore;
+var init_numbering = __esm({
+  "src/numbering/index.ts"() {
+    "use strict";
+    init_types();
+    init_crypto();
+    init_errors();
+    NUMBERING_HEAD_COLLECTION = "_numbering_head";
+    NUMBERING_PENDING_COLLECTION = "_numbering_pending";
+    DeferredNumberingStore = class {
+      adapter;
+      vault;
+      encrypted;
+      getDEK;
+      actor;
+      configs;
+      /**
+       * Stamp a serial onto a USER record THROUGH the Collection layer (so the
+       * cache, indexes, and MVs stay coherent — the engine must NOT write user
+       * collections at the raw adapter level). Returns false if the record is
+       * gone (the engine then skips it without burning a serial). Provided by the
+       * vault; unit tests pass a Map-backed double.
+       */
+      stamp;
+      /** In-process registry: `${series}::${recordId}` → resolver for the live next() Promise. */
+      waiters = /* @__PURE__ */ new Map();
+      dekCache = /* @__PURE__ */ new Map();
+      constructor(opts) {
+        this.adapter = opts.adapter;
+        this.vault = opts.vault;
+        this.encrypted = opts.encrypted;
+        this.getDEK = opts.getDEK;
+        this.actor = opts.actor;
+        this.configs = opts.configs;
+        this.stamp = opts.stamp;
+      }
+      has(series) {
+        return this.configs.has(series);
+      }
+      dek(collection) {
+        let p = this.dekCache.get(collection);
+        if (!p) {
+          p = this.getDEK(collection);
+          this.dekCache.set(collection, p);
+        }
+        return p;
+      }
+      async readJson(collection, id) {
+        const env = await this.adapter.get(this.vault, collection, id);
+        if (!env) return { env: null, value: null };
+        const json = this.encrypted ? await decrypt(env._iv, env._data, await this.dek(collection)) : env._data;
+        return { env, value: JSON.parse(json) };
+      }
+      async writeJson(collection, id, value, expectedVersion) {
+        const json = JSON.stringify(value);
+        let env;
+        if (!this.encrypted) {
+          env = { _noydb: NOYDB_FORMAT_VERSION, _v: expectedVersion + 1, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: "", _data: json, _by: this.actor };
+        } else {
+          const { iv, data } = await encrypt(json, await this.dek(collection));
+          env = { _noydb: NOYDB_FORMAT_VERSION, _v: expectedVersion + 1, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: iv, _data: data, _by: this.actor };
+        }
+        await this.adapter.put(this.vault, collection, id, env, expectedVersion);
+      }
+      pendingId(series, recordId2) {
+        return `${series}::${recordId2}`;
+      }
+      /** Current last-assigned serial for a series (0 if none). */
+      async peek(series) {
+        const { value } = await this.readJson(NUMBERING_HEAD_COLLECTION, series);
+        return value?.lastSerial ?? 0;
+      }
+      /**
+       * Enqueue a record for numbering: stamp it with the current store clock and
+       * durably write a pending entry. The returned Promise resolves once the
+       * record is durably enqueued; its `assigned` field resolves with the serial
+       * at the next pass (the record's `field` is the durable source of truth —
+       * `assigned` is an in-process convenience that a crash may drop).
+       */
+      async enqueue(series, recordId2) {
+        const cfg = this.configs.get(series);
+        if (!cfg) throw new NumberingUncertaintyError(series);
+        if (typeof this.adapter.getStoreTime !== "function") throw new NumberingUncertaintyError(series);
+        const st = await this.adapter.getStoreTime();
+        const id = this.pendingId(series, recordId2);
+        const { env } = await this.readJson(NUMBERING_PENDING_COLLECTION, id);
+        const entry = {
+          series,
+          recordId: recordId2,
+          collection: cfg.collection,
+          field: cfg.field,
+          storeEarliest: st.earliest,
+          storeLatest: st.latest,
+          enqueuedAt: Date.now()
+        };
+        await this.writeJson(NUMBERING_PENDING_COLLECTION, id, entry, env?._v ?? 0);
+        const assigned = new Promise((resolve, reject) => {
+          this.waiters.set(id, { resolve, reject });
+        });
+        return { assigned };
+      }
+      async listPending(series) {
+        const ids = await this.adapter.list(this.vault, NUMBERING_PENDING_COLLECTION);
+        const prefix = `${series}::`;
+        const out = [];
+        for (const id of ids) {
+          if (!id.startsWith(prefix)) continue;
+          const { value } = await this.readJson(NUMBERING_PENDING_COLLECTION, id);
+          if (value) out.push({ id, entry: value });
+        }
+        return out;
+      }
+      /**
+       * Run a numbering pass for `series`: select entries provably settled
+       * (`storeLatest ≤ now.earliest` — commit-wait), order by
+       * `(storeEarliest, recordId)`, assign serials after the head, stamp each
+       * record's field, advance the head with one CAS, and consume the entries.
+       * Idempotent/convergent: a losing concurrent pass returns `[]` and the next
+       * pass reconciles. Resolves any in-process enqueue() `assigned` Promises.
+       */
+      async runPass(series) {
+        const cfg = this.configs.get(series);
+        if (!cfg) throw new NumberingUncertaintyError(series);
+        if (typeof this.adapter.getStoreTime !== "function") throw new NumberingUncertaintyError(series);
+        const now = await this.adapter.getStoreTime();
+        const settled = (await this.listPending(series)).filter((p) => p.entry.storeLatest <= now.earliest).sort(
+          (a, b) => a.entry.storeEarliest - b.entry.storeEarliest || (a.entry.recordId < b.entry.recordId ? -1 : a.entry.recordId > b.entry.recordId ? 1 : 0)
+        );
+        if (settled.length === 0) return [];
+        const { env: headEnv, value: head } = await this.readJson(NUMBERING_HEAD_COLLECTION, series);
+        let serial = head?.lastSerial ?? 0;
+        const assignments = [];
+        for (const { entry } of settled) {
+          serial += 1;
+          const ok = await this.stamp(entry.collection, entry.recordId, entry.field, serial);
+          if (!ok) {
+            serial -= 1;
+            continue;
+          }
+          assignments.push({ recordId: entry.recordId, serial });
+        }
+        try {
+          await this.writeJson(NUMBERING_HEAD_COLLECTION, series, { series, lastSerial: serial, watermark: now.earliest }, headEnv?._v ?? 0);
+        } catch (err) {
+          if (err instanceof ConflictError) return [];
+          throw err;
+        }
+        for (const { id, entry } of settled) {
+          await this.adapter.delete(this.vault, NUMBERING_PENDING_COLLECTION, id);
+          const a = assignments.find((x) => x.recordId === entry.recordId);
+          if (a) {
+            this.waiters.get(id)?.resolve(a.serial);
+            this.waiters.delete(id);
+          }
+        }
+        return assignments;
+      }
+    };
+  }
+});
+
+// src/shadow/strategy.ts
+var NOT_ENABLED3, NO_SHADOW;
+var init_strategy7 = __esm({
+  "src/shadow/strategy.ts"() {
+    "use strict";
+    NOT_ENABLED3 = new Error(
+      'VaultFrame requires the shadow strategy. Import `{ withShadow }` from "@noy-db/hub/shadow" and pass it to `createNoydb({ shadowStrategy: withShadow() })`.'
+    );
+    NO_SHADOW = {
+      buildFrame() {
+        throw NOT_ENABLED3;
+      }
+    };
+  }
+});
+
+// src/consent/strategy.ts
+var NO_CONSENT;
+var init_strategy8 = __esm({
+  "src/consent/strategy.ts"() {
+    "use strict";
+    NO_CONSENT = {
+      async write() {
+      },
+      async read() {
+        return [];
+      }
+    };
+  }
+});
+
+// src/periods/strategy.ts
+var NOT_ENABLED4, NO_PERIODS;
+var init_strategy9 = __esm({
+  "src/periods/strategy.ts"() {
+    "use strict";
+    NOT_ENABLED4 = new Error(
+      'Accounting periods require the periods strategy. Import `{ withPeriods }` from "@noy-db/hub/periods" and pass it to `createNoydb({ periodsStrategy: withPeriods() })`.'
+    );
+    NO_PERIODS = {
+      async loadPeriods() {
+        return [];
+      },
       async chainAnchor() {
         return { priorPeriodHash: "" };
       },
@@ -10274,6 +11325,7 @@ async function runCompaction(ctx, options = {}) {
   let evicted = 0;
   let records = 0;
   let auditEntries = 0;
+  let held = 0;
   let collectionsWithPolicy = 0;
   outer: for (const collectionName of allCollections) {
     if (collectionName.startsWith("_")) continue;
@@ -10297,6 +11349,10 @@ async function runCompaction(ctx, options = {}) {
         if (!policy) continue;
         const reason = evaluatePolicy(policy, record, slot, now);
         if (!reason) continue;
+        if (isHeld2(policy, record, now)) {
+          held += 1;
+          continue;
+        }
         if (!dryRun) {
           await ctx.deleteSlot(collectionName, recordId2, slot.name);
           await writeAuditEntry(ctx, {
@@ -10321,9 +11377,32 @@ async function runCompaction(ctx, options = {}) {
     records,
     collections: collectionsWithPolicy,
     auditEntries,
+    held,
     byCollection
   };
 }
+function isHeld2(policy, record, now) {
+  if (policy.legalHold) {
+    try {
+      if (policy.legalHold(record)) return true;
+    } catch {
+      return true;
+    }
+  }
+  if (policy.retainUntil) {
+    try {
+      const until = policy.retainUntil(record);
+      if (until !== null && until !== void 0) {
+        const t = until instanceof Date ? until.getTime() : typeof until === "number" ? until : Date.parse(String(until));
+        if (!Number.isFinite(t)) return true;
+        if (t > now.getTime()) return true;
+      }
+    } catch {
+      return true;
+    }
+  }
+  return false;
+}
 function evaluatePolicy(policy, record, slot, now) {
   let ttlTriggered = false;
   let predicateTriggered = false;
@@ -10762,8 +11841,8 @@ async function derivePersistedSchema(validator) {
   if (kind === "Zod") {
     const convert = await loadZodConverter();
     const jsonSchema = convert(validator);
-    const canonical = canonicalize(jsonSchema);
-    const hash = await sha256Hex2(new TextEncoder().encode(canonical));
+    const canonical2 = canonicalize(jsonSchema);
+    const hash = await sha256Hex2(new TextEncoder().encode(canonical2));
     return { _noydb_schema: 1, kind, jsonSchema, hash, derivedAt };
   }
   return {
@@ -11803,12 +12882,12 @@ var init_read_only_facade = __esm({
 
 // src/derivations/strategy-hash.ts
 async function computeStrategyHash(source, outputKeys, derive) {
-  const canonical = JSON.stringify({
+  const canonical2 = JSON.stringify({
     source,
     outputs: [...outputKeys].sort(),
     derive: derive.toString()
   });
-  const bytes = new TextEncoder().encode(canonical);
+  const bytes = new TextEncoder().encode(canonical2);
   const digest = await crypto.subtle.digest("SHA-256", bytes);
   return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
@@ -12081,6 +13160,9 @@ var init_vault = __esm({
     init_keyring();
     init_errors();
     init_errors();
+    init_archive();
+    init_sequence();
+    init_numbering();
     init_constants();
     init_entry();
     init_strategy3();
@@ -12139,6 +13221,10 @@ var init_vault = __esm({
        * call throws with a pointer at `@noy-db/hub/blobs`.
        */
       blobStrategy;
+      /** Cold-storage archival strategy (the archive target store). */
+      archiveStrategy;
+      /** Per-collection record archival policies. Indexed by collection name. */
+      archiveRegistry = /* @__PURE__ */ new Map();
       indexStrategy;
       aggregateStrategy;
       crdtStrategy;
@@ -12242,6 +13328,12 @@ var init_vault = __esm({
        * docstring.
        */
       ledgerStore = null;
+      /** Lazily-built atomic-sequence store. See {@link sequence}. */
+      sequenceStore = null;
+      /** Lazily-built deferred-numbering engine. See {@link runNumberingPass}. */
+      deferredNumbering = null;
+      /** Registered deferred-numbering series, keyed by series name. */
+      numberingConfigs;
       /**
        * Background writes for persisted-schema envelopes (#schema-dump v0
        * slice 1). One promise per `collection({ persistJsonSchema: true })`
@@ -12328,6 +13420,7 @@ var init_vault = __esm({
       constructor(opts) {
         this.adapter = opts.adapter;
         this.name = opts.name;
+        this.numberingConfigs = new Map((opts.numberingConfigs ?? []).map((c) => [c.series, c]));
         this.noydb = opts.noydb;
         this.keyring = opts.keyring;
         this.encrypted = opts.encrypted;
@@ -12343,6 +13436,7 @@ var init_vault = __esm({
         this.onRegisterConflictResolver = opts.onRegisterConflictResolver;
         this.syncAdapter = opts.syncAdapter;
         this.blobStrategy = opts.blobStrategy;
+        this.archiveStrategy = opts.archiveStrategy;
         this.indexStrategy = opts.indexStrategy;
         this.aggregateStrategy = opts.aggregateStrategy;
         this.crdtStrategy = opts.crdtStrategy;
@@ -12405,8 +13499,9 @@ var init_vault = __esm({
        *. `put()` validates keys against the declared set; reads
        *   with `{ locale }` add `<field>Label` virtual fields.
        *
-       * Throws `ReservedCollectionNameError` for names starting with `_dict_`.
-       * Use `vault.dictionary(name)` to access dictionary collections.
+       * Throws `ReservedCollectionNameError` for names starting with `_dict_` or
+       * equal to `_sequences`. Use `vault.dictionary(name)` for dict collections
+       * and `vault.sequence(name)` for sequence counters.
        *
        * Lazy mode + indexes is rejected at construction time — see the
        * Collection constructor for the rationale.
@@ -12425,7 +13520,16 @@ var init_vault = __esm({
         if (isDictCollectionName(collectionName)) {
           throw new ReservedCollectionNameError(collectionName);
         }
+        if (collectionName === SEQUENCE_COLLECTION) {
+          throw new ReservedCollectionNameError(collectionName);
+        }
         let coll = this.collectionCache.get(collectionName);
+        if (coll && options?.moneyFields) {
+          coll._applyMoneyFields(options.moneyFields);
+        }
+        if (coll && options?.computed) {
+          coll._applyComputed(options.computed);
+        }
         if (!coll) {
           if (options?.refs) {
             this.refRegistry.register(collectionName, options.refs);
@@ -12436,6 +13540,9 @@ var init_vault = __esm({
           if (options?.blobFields) {
             this.blobFieldsRegistry.set(collectionName, options.blobFields);
           }
+          if (options?.archive) {
+            this.archiveRegistry.set(collectionName, options.archive);
+          }
           if (options?.attestation !== void 0) {
             this.attestationRegistry.set(collectionName, options.attestation);
           }
@@ -12551,6 +13658,8 @@ var init_vault = __esm({
           collOpts.onCrossTierAccess = (event) => this.emitCrossTier(event);
           if (this.syncAdapter !== void 0) collOpts.syncAdapter = this.syncAdapter;
           if (options?.i18nFields !== void 0) collOpts.i18nFields = options.i18nFields;
+          if (options?.moneyFields !== void 0) collOpts.moneyFields = options.moneyFields;
+          if (options?.computed !== void 0) collOpts.computed = options.computed;
           if (options?.dictKeyFields !== void 0) {
             collOpts.dictLabelResolver = async (dictName, key, locale, fallback) => {
               const handle = this.dictionary(dictName);
@@ -12970,6 +14079,77 @@ var init_vault = __esm({
        * await vault.compact({ maxEvictions: 1000 })             // cap batch
        * ```
        */
+      /**
+       * Atomic, gap-free numbering. `vault.sequence('invoice-2026').next()`
+       * returns 1, 2, 3, … with no gaps or duplicates under concurrency, via
+       * an optimistic-CAS counter at `_sequences/<name>`. Each name is an
+       * independent sequence.
+       *
+       * **Online-only:** `next()` throws `SequenceOfflineError` unless the
+       * store advertises `capabilities.casAtomic` — gap-free numbering cannot
+       * be serialized by an offline / non-CAS writer.
+       *
+       * ```ts
+       * const n = await vault.sequence('invoice-2026').next()   // 1, then 2, …
+       * const cur = await vault.sequence('invoice-2026').peek()  // current value, no allocation
+       * ```
+       */
+      sequence(name) {
+        if (this.numberingConfigs.has(name)) {
+          const eng = this.deferred();
+          return {
+            next: async (opts) => {
+              if (!opts?.for) {
+                throw new ValidationError(`sequence("${name}") is a deferred-numbering series; call next({ for: recordId }).`);
+              }
+              return (await eng.enqueue(name, opts.for)).assigned;
+            },
+            peek: () => eng.peek(name)
+          };
+        }
+        if (!this.sequenceStore) {
+          this.sequenceStore = new SequenceStore({
+            adapter: this.adapter,
+            vault: this.name,
+            encrypted: this.encrypted,
+            getDEK: this.getDEK,
+            actor: this.keyring.userId
+          });
+        }
+        return this.sequenceStore.handle(name);
+      }
+      /** @internal — lazily build the deferred-numbering engine with a cache-coherent stamp. */
+      deferred() {
+        if (!this.deferredNumbering) {
+          this.deferredNumbering = new DeferredNumberingStore({
+            adapter: this.adapter,
+            vault: this.name,
+            encrypted: this.encrypted,
+            getDEK: this.getDEK,
+            actor: this.keyring.userId,
+            configs: this.numberingConfigs,
+            // Stamp THROUGH the Collection layer so cache/indexes/MVs stay coherent —
+            // `this.collection(name)` returns the shared cached instance, so a
+            // subsequent user `collection.get(id)` sees the assigned serial.
+            stamp: async (collection, recordId2, field, serial) => {
+              const coll = this.collection(collection);
+              const rec = await coll.get(recordId2);
+              if (!rec) return false;
+              await coll.put(recordId2, { ...rec, [field]: serial });
+              return true;
+            }
+          });
+        }
+        return this.deferredNumbering;
+      }
+      /**
+       * Run a deferred-numbering pass for `series`: assign gap-free serials to all
+       * records whose store-commit-time interval has settled, in store-time order.
+       * Returns the assignments made. See {@link sequence} / `withDeferredNumbering`.
+       */
+      async runNumberingPass(series) {
+        return this.deferred().runPass(series);
+      }
       async compact(options = {}) {
         return runCompaction({
           adapter: this.adapter,
@@ -12994,6 +14174,48 @@ var init_vault = __esm({
           }
         }, options);
       }
+      /**
+       * Sweep records eligible by their collection's `archive` policy into the
+       * cold archive store. Relocation is envelope-level (no re-encryption) and
+       * bypasses guards + materialized-view dispatch, so issued/immutable
+       * records over a sealed period can be archived without recomputing
+       * finalized aggregates. A `legalHold` predicate blocks archival.
+       * Requires `archiveStrategy: withArchive({ store })` in `createNoydb`.
+       */
+      async archive(options = {}) {
+        return runArchive(this._archiveContext(), options);
+      }
+      /** Relocate one archived record back to the primary store. Returns false if it was not archived. */
+      async restore(collection, id) {
+        return runRestore(this._archiveContext(), collection, id);
+      }
+      /** List archived record ids for a collection (or all collections with an archive policy). */
+      async listArchived(collection) {
+        return runListArchived(this._archiveContext(), collection);
+      }
+      _archiveContext() {
+        const strategy = this.archiveStrategy;
+        if (!strategy) {
+          throw new Error(
+            "vault.archive/restore/listArchived require `archiveStrategy: withArchive({ store })` in createNoydb"
+          );
+        }
+        const archiveStore = strategy.store;
+        return {
+          vaultId: this.name,
+          archiveStore,
+          collectionsWithPolicy: () => [...this.archiveRegistry.keys()],
+          getPolicy: (c) => this.archiveRegistry.get(c) ?? null,
+          listRecordIds: (c) => this.adapter.list(this.name, c),
+          getRecord: async (c, id) => await this.collection(c).get(id, { locale: "raw" }),
+          getEnvelope: (c, id) => this.adapter.get(this.name, c, id),
+          removeFromPrimary: (c, id) => this.collection(c)._internalDelete(id),
+          restoreToPrimary: async (c, id, env) => {
+            await this.adapter.put(this.name, c, id, env);
+            await this.collection(c)._invalidateCacheEntry(id);
+          }
+        };
+      }
       exportBlobs(options = {}) {
         this.assertCanExport("plaintext", "blob");
         return createExportBlobsHandle(
@@ -14255,7 +15477,7 @@ var init_vault = __esm({
           }
         }
         const internalSnapshot = {};
-        for (const internalName of [LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, SCHEMAS_COLLECTION]) {
+        for (const internalName of [LEDGER_COLLECTION, LEDGER_DELTAS_COLLECTION, SCHEMAS_COLLECTION, SEQUENCE_COLLECTION]) {
           const ids = await this.adapter.list(this.name, internalName);
           if (ids.length === 0) continue;
           const records = {};
@@ -15870,7 +17092,7 @@ function deny(gate, reason, required) {
   return new PolicyDeniedError(gate, reason, required);
 }
 var DEFAULT_FRESHNESS_MS;
-var init_engine = __esm({
+var init_engine2 = __esm({
   "src/policy/engine.ts"() {
     "use strict";
     init_errors2();
@@ -15883,7 +17105,7 @@ var init_policy3 = __esm({
   "src/policy/index.ts"() {
     "use strict";
     init_presets();
-    init_engine();
+    init_engine2();
     init_storage5();
   }
 });
@@ -15927,14 +17149,21 @@ var init_executor3 = __esm({
        * Compare existing vs incoming for each `frozenFields.fields` entry
        * when `frozenFields.when(existing)` is true. Throws
        * `FieldFrozenError` listing every changed frozen field.
+       *
+       * @param skipFields — field names that are schema-owned computed fields.
+       *   These are excluded from the comparison because `incoming` carries the
+       *   raw user input (computed fields not yet evaluated), so comparing
+       *   `existing[field]` vs `incoming[field]` would always look like a
+       *   change even when the computed result is unchanged.
        */
-      async checkFrozenFields(guard, id, existing, incoming) {
+      async checkFrozenFields(guard, id, existing, incoming, skipFields) {
         const ff = guard.frozenFields;
         if (!ff) return;
         if (existing === null) return;
         if (!ff.when(existing)) return;
         const changed = [];
         for (const f of ff.fields) {
+          if (skipFields?.has(String(f))) continue;
           if (existing[f] !== incoming[f]) {
             if (!deepEqual(existing[f], incoming[f])) changed.push(String(f));
           }
@@ -15963,6 +17192,669 @@ var init_executor3 = __esm({
   }
 });
 
+// src/federation/classify-skip.ts
+function classifyShardSkip(err) {
+  return err instanceof NoAccessError ? "no-grant" : "error";
+}
+var init_classify_skip = __esm({
+  "src/federation/classify-skip.ts"() {
+    "use strict";
+    init_errors();
+  }
+});
+
+// src/federation/cross-vault-live.ts
+var CrossVaultLive;
+var init_cross_vault_live = __esm({
+  "src/federation/cross-vault-live.ts"() {
+    "use strict";
+    CrossVaultLive = class {
+      snapshot;
+      error = null;
+      ready;
+      subs = /* @__PURE__ */ new Set();
+      unsubChange;
+      opts;
+      stopped = false;
+      computing = false;
+      dirty = false;
+      scheduled = false;
+      timer = null;
+      resolveReady;
+      settledOnce = false;
+      constructor(opts) {
+        this.opts = opts;
+        this.snapshot = opts.initialSnapshot;
+        this.ready = new Promise((res) => {
+          this.resolveReady = res;
+        });
+        this.unsubChange = opts.subscribeToChanges((e) => {
+          if (this.stopped || !opts.isRelevant(e)) return;
+          this.schedule();
+        });
+        this.schedule();
+      }
+      subscribe(cb) {
+        if (this.stopped) return () => {
+        };
+        this.subs.add(cb);
+        return () => this.subs.delete(cb);
+      }
+      stop() {
+        if (this.stopped) return;
+        this.stopped = true;
+        this.unsubChange();
+        if (this.timer !== null) clearTimeout(this.timer);
+        this.subs.clear();
+        if (!this.settledOnce) this.resolveReady();
+      }
+      schedule() {
+        if (this.stopped) return;
+        if (this.computing) {
+          this.dirty = true;
+          return;
+        }
+        if (this.scheduled) return;
+        this.scheduled = true;
+        const run = () => {
+          this.scheduled = false;
+          void this.runCompute();
+        };
+        const ms = this.opts.debounceMs ?? 0;
+        if (ms > 0) this.timer = setTimeout(run, ms);
+        else queueMicrotask(run);
+      }
+      async runCompute() {
+        if (this.stopped) return;
+        this.computing = true;
+        this.dirty = false;
+        try {
+          const next = await this.opts.compute();
+          if (this.stopped) return;
+          this.snapshot = next;
+          this.error = null;
+        } catch (err) {
+          if (this.stopped) return;
+          this.error = err instanceof Error ? err : new Error(String(err));
+        } finally {
+          this.computing = false;
+          if (!this.stopped) {
+            if (!this.settledOnce) {
+              this.settledOnce = true;
+              this.resolveReady();
+            }
+            for (const cb of this.subs) cb();
+            if (this.dirty) this.schedule();
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/federation/aggregate-across.ts
+var CrossVaultAggregation, CrossVaultGroupedAggregation;
+var init_aggregate_across = __esm({
+  "src/federation/aggregate-across.ts"() {
+    "use strict";
+    init_aggregation();
+    init_groupby();
+    init_cross_vault_live();
+    CrossVaultAggregation = class {
+      constructor(src, spec, bind) {
+        this.src = src;
+        this.spec = spec;
+        this.bind = bind;
+      }
+      src;
+      spec;
+      bind;
+      async run(options = {}) {
+        const { records, skippedVaults } = await this.src.fanoutRecords(options);
+        return { result: reduceRecords(records, this.spec), skippedVaults };
+      }
+      live(options = {}) {
+        if (!this.bind) throw new Error("CrossVaultAggregation: live() requires a LiveBinding \u2014 use ShardedQuery.aggregate()");
+        const spec = this.spec;
+        const src = this.src;
+        const core = new CrossVaultLive({
+          subscribeToChanges: this.bind.subscribeToChanges,
+          isRelevant: this.bind.isRelevant,
+          compute: async () => {
+            const { records, skippedVaults } = await src.fanoutRecords(options);
+            return { value: reduceRecords(records, spec), skipped: skippedVaults };
+          },
+          initialSnapshot: { value: void 0, skipped: [] },
+          ...options.debounceMs !== void 0 ? { debounceMs: options.debounceMs } : {}
+        });
+        return {
+          get value() {
+            return core.snapshot.value;
+          },
+          get skippedVaults() {
+            return core.snapshot.skipped;
+          },
+          get error() {
+            return core.error;
+          },
+          ready: core.ready,
+          subscribe: (cb) => core.subscribe(cb),
+          stop: () => core.stop()
+        };
+      }
+    };
+    CrossVaultGroupedAggregation = class {
+      constructor(src, field, spec, bind) {
+        this.src = src;
+        this.field = field;
+        this.spec = spec;
+        this.bind = bind;
+      }
+      src;
+      field;
+      spec;
+      bind;
+      async run(options = {}) {
+        const { records, skippedVaults } = await this.src.fanoutRecords(options);
+        return {
+          results: groupAndReduce(records, this.field, this.spec),
+          skippedVaults
+        };
+      }
+      live(options = {}) {
+        if (!this.bind) throw new Error("CrossVaultGroupedAggregation: live() requires a LiveBinding \u2014 use ShardedQuery.groupBy().aggregate()");
+        const field = this.field;
+        const spec = this.spec;
+        const src = this.src;
+        const core = new CrossVaultLive({
+          subscribeToChanges: this.bind.subscribeToChanges,
+          isRelevant: this.bind.isRelevant,
+          compute: async () => {
+            const { records, skippedVaults } = await src.fanoutRecords(options);
+            return {
+              records: groupAndReduce(records, field, spec),
+              skipped: skippedVaults
+            };
+          },
+          initialSnapshot: { records: [], skipped: [] },
+          ...options.debounceMs !== void 0 ? { debounceMs: options.debounceMs } : {}
+        });
+        return {
+          get value() {
+            return core.snapshot.records;
+          },
+          get skippedVaults() {
+            return core.snapshot.skipped;
+          },
+          get error() {
+            return core.error;
+          },
+          ready: core.ready,
+          subscribe: (cb) => core.subscribe(cb),
+          stop: () => core.stop()
+        };
+      }
+    };
+  }
+});
+
+// src/federation/vault-group.ts
+var vault_group_exports = {};
+__export(vault_group_exports, {
+  ShardedCollection: () => ShardedCollection,
+  ShardedGroupedQuery: () => ShardedGroupedQuery,
+  ShardedQuery: () => ShardedQuery,
+  VaultGroup: () => VaultGroup
+});
+function assertSafePartitionKey(partitionKey) {
+  if (partitionKey.length === 0) {
+    throw new ValidationError("partitionKey must be a non-empty string");
+  }
+  if (partitionKey === STATE_VAULT_NAME) {
+    throw new ReservedVaultNameError(partitionKey);
+  }
+  if (!SAFE_PARTITION_KEY.test(partitionKey)) {
+    throw new ValidationError(
+      `partitionKey "${partitionKey}" contains characters outside [A-Za-z0-9._-]. Map your records to a store-safe key in sharding.keyOf.`
+    );
+  }
+  if (partitionKey.includes(SHARD_SEPARATOR)) {
+    throw new ValidationError(
+      `partitionKey "${partitionKey}" must not contain "--" \u2014 it is reserved as the shard vault-id separator and would risk shard-id collisions.`
+    );
+  }
+}
+var SHARD_SEPARATOR, SAFE_PARTITION_KEY, VaultGroup, ShardedCollection, ShardedQuery, ShardedGroupedQuery;
+var init_vault_group = __esm({
+  "src/federation/vault-group.ts"() {
+    "use strict";
+    init_errors();
+    init_constants2();
+    init_classify_skip();
+    init_cross_vault_live();
+    init_aggregate_across();
+    SHARD_SEPARATOR = "--";
+    SAFE_PARTITION_KEY = /^[A-Za-z0-9._-]+$/;
+    VaultGroup = class {
+      constructor(db, name, registry, sharding, template) {
+        this.db = db;
+        this.name = name;
+        this.registry = registry;
+        this.sharding = sharding;
+        this.template = template;
+        if (name.includes(SHARD_SEPARATOR)) {
+          throw new ValidationError(
+            `VaultGroup name "${name}" must not contain "--" (reserved shard vault-id separator).`
+          );
+        }
+      }
+      db;
+      name;
+      registry;
+      sharding;
+      template;
+      /** @internal — set when the group is managed (no explicit registry). */
+      stateVault;
+      /** @internal */
+      _attachStateVault(sv) {
+        this.stateVault = sv;
+      }
+      /** Deterministic vault name for a partition key, namespaced by the group. */
+      shardVaultId(partitionKey) {
+        assertSafePartitionKey(partitionKey);
+        return `${this.name}${SHARD_SEPARATOR}${partitionKey}`;
+      }
+      /**
+       * @internal — group-qualified registry record key (avoids cross-group key
+       * collisions). Identical to the shard vault id by design — the registry row
+       * for a shard is keyed by that shard's vault id — so it delegates to
+       * `shardVaultId`, reusing its partition-key validation.
+       */
+      registryId(partitionKey) {
+        return this.shardVaultId(partitionKey);
+      }
+      /**
+       * Registry rows for THIS group (hydrates the registry collection first).
+       * The registry may be shared across groups (the auto-wired StateManagement
+       * vault holds one `vaultRegistry` for the whole instance), so rows are
+       * filtered by `group` — without this, a group's fan-out reads would leak
+       * across into other groups' shards. Mirrors the `${group}--` scoping that
+       * `liveBinding().isRelevant` already applies to the reactive path.
+       */
+      async allRows() {
+        await this.registry.list();
+        const rows = this.registry.query().toArray();
+        return rows.filter((r) => r.group === this.name);
+      }
+      /** Open an existing shard and apply the template. */
+      async openShard(partitionKey) {
+        const vault = await this.db.openVault(this.shardVaultId(partitionKey), { create: false });
+        this.template.configure(vault);
+        return vault;
+      }
+      /**
+       * Idempotently provision a shard for `partitionKey`. Returns the
+       * configured vault handle.
+       *
+       * - row + vault present → no-op, return handle
+       * - row present, vault gone → ShardProvisioningError
+       * - row absent (vault present or not) → open-or-create, configure, write row
+       */
+      async createShard(partitionKey) {
+        const vaultId = this.shardVaultId(partitionKey);
+        const row = await this.registry.get(this.registryId(partitionKey));
+        const provisioned = await this.db._shardVaultProvisioned(vaultId);
+        if (row && !provisioned) throw new ShardProvisioningError(vaultId, partitionKey);
+        if (row && provisioned) return this.openShard(partitionKey);
+        const vault = await this.db.openVault(vaultId);
+        this.template.configure(vault);
+        await this.registry.put(this.registryId(partitionKey), {
+          vaultId,
+          partitionKey,
+          templateName: this.sharding.vaultTemplate,
+          schemaVersion: this.template.version,
+          createdAt: Date.now(),
+          group: this.name
+        });
+        if (this.stateVault) {
+          try {
+            await this.stateVault.appendEvent({
+              type: "shard-created",
+              group: this.name,
+              vaultId,
+              templateName: this.sharding.vaultTemplate,
+              version: this.template.version
+            });
+          } catch {
+          }
+        }
+        return vault;
+      }
+      /**
+       * Drill down to a single shard's full Collection API. Throws if the shard is unknown.
+       * Also throws ShardProvisioningError if the registry row exists but the vault has been deleted
+       * (registry/store divergence).
+       */
+      async shard(partitionKey) {
+        const vaultId = this.shardVaultId(partitionKey);
+        const row = await this.registry.get(this.registryId(partitionKey));
+        if (!row) throw new UnknownShardError(partitionKey, this.name);
+        const provisioned = await this.db._shardVaultProvisioned(vaultId);
+        if (!provisioned) throw new ShardProvisioningError(vaultId, partitionKey);
+        return this.openShard(partitionKey);
+      }
+      /** A sharded view over one logical collection across all shards. */
+      collection(collectionName) {
+        return new ShardedCollection(this, collectionName);
+      }
+      /** @internal — eligible (openable-candidate) rows + drift/divergence skips. */
+      async resolveEligible(options = {}) {
+        const rows = await this.allRows();
+        const skipped = [];
+        const versionOk = [];
+        for (const row of rows) {
+          if (options.minVersion !== void 0 && row.schemaVersion < options.minVersion) {
+            skipped.push({ vaultId: row.vaultId, reason: "schema-drift" });
+          } else versionOk.push(row);
+        }
+        const provisioned = await Promise.all(versionOk.map((r) => this.db._shardVaultProvisioned(r.vaultId)));
+        const eligible = [];
+        versionOk.forEach((row, i) => {
+          if (provisioned[i]) eligible.push(row);
+          else skipped.push({ vaultId: row.vaultId, reason: "error", error: new ShardProvisioningError(row.vaultId, row.partitionKey) });
+        });
+        return { eligible, skipped };
+      }
+    };
+    ShardedCollection = class {
+      constructor(group, collectionName) {
+        this.group = group;
+        this.collectionName = collectionName;
+      }
+      group;
+      collectionName;
+      /** Route a write to the shard owning `keyOf(record)`. */
+      async put(id, record) {
+        const key = this.group.sharding.keyOf(record);
+        const row = await this.group.registry.get(this.group.registryId(key));
+        let vault;
+        if (!row) {
+          if (this.group.sharding.autoCreate === false) {
+            throw new UnknownShardError(key, this.group.name);
+          }
+          vault = await this.group.createShard(key);
+        } else {
+          vault = await this.group.openShard(key);
+        }
+        await vault.collection(this.collectionName).put(id, record);
+      }
+      /** Begin a cross-shard fan-out query. */
+      query() {
+        return new ShardedQuery(this.group, this.collectionName, []);
+      }
+    };
+    ShardedQuery = class _ShardedQuery {
+      constructor(group, collectionName, clauses) {
+        this.group = group;
+        this.collectionName = collectionName;
+        this.clauses = clauses;
+      }
+      group;
+      collectionName;
+      clauses;
+      where(field, op, value) {
+        return new _ShardedQuery(this.group, this.collectionName, [
+          ...this.clauses,
+          { field, op, value }
+        ]);
+      }
+      /** @internal — fan out the where-filtered records across eligible shards. */
+      async fanoutRecords(options = {}) {
+        const { eligible, skipped } = await this.group.resolveEligible(options);
+        const across = await this.group.db.queryAcross(
+          eligible.map((r) => r.vaultId),
+          async (vault) => {
+            this.group.template.configure(vault);
+            const coll = vault.collection(this.collectionName);
+            await coll.list();
+            let q = coll.query();
+            for (const c of this.clauses) q = q.where(c.field, c.op, c.value);
+            return q.toArray();
+          },
+          { concurrency: options.concurrency ?? 1, create: false }
+        );
+        const results = [];
+        for (const r of across) {
+          if (r.error) skipped.push({ vaultId: r.vault, reason: classifyShardSkip(r.error), error: r.error });
+          else for (const item of r.result) results.push(item);
+        }
+        return { records: results, skippedVaults: skipped };
+      }
+      /** Fan out across eligible shards and merge results. */
+      async toArray(options = {}) {
+        const { records, skippedVaults } = await this.fanoutRecords(options);
+        return { results: records, skippedVaults };
+      }
+      /** @internal — build the change-subscription + relevance binding for this query's group+collection. */
+      liveBinding() {
+        const group = this.group;
+        const collectionName = this.collectionName;
+        return {
+          subscribeToChanges: (h) => {
+            group.db.on("change", h);
+            return () => group.db.off("change", h);
+          },
+          isRelevant: (e) => e.collection === collectionName && e.vault.startsWith(`${group.name}--`)
+        };
+      }
+      /** Returns a reactive cross-shard live query — a facade over CrossVaultLive. */
+      live(options = {}) {
+        const bind = this.liveBinding();
+        const core = new CrossVaultLive({
+          ...bind,
+          compute: async () => {
+            const { records, skippedVaults } = await this.fanoutRecords(options);
+            return { records, skipped: skippedVaults };
+          },
+          initialSnapshot: { records: [], skipped: [] },
+          ...options.debounceMs !== void 0 ? { debounceMs: options.debounceMs } : {}
+        });
+        return {
+          get value() {
+            return core.snapshot.records;
+          },
+          get skippedVaults() {
+            return core.snapshot.skipped;
+          },
+          get error() {
+            return core.error;
+          },
+          ready: core.ready,
+          subscribe: (cb) => core.subscribe(cb),
+          stop: () => core.stop()
+        };
+      }
+      /** One-shot distributed aggregate — central reduce over all shard records. */
+      aggregate(spec) {
+        return new CrossVaultAggregation(this, spec, this.liveBinding());
+      }
+      /** Begin a grouped cross-shard aggregate. */
+      groupBy(field) {
+        return new ShardedGroupedQuery(this, field);
+      }
+    };
+    ShardedGroupedQuery = class {
+      constructor(query, field) {
+        this.query = query;
+        this.field = field;
+      }
+      query;
+      field;
+      aggregate(spec) {
+        return new CrossVaultGroupedAggregation(
+          { fanoutRecords: (o) => this.query.fanoutRecords(o) },
+          this.field,
+          spec,
+          this.query.liveBinding()
+        );
+      }
+    };
+  }
+});
+
+// src/federation/schema-manifest.ts
+function captureBlueprint(configure) {
+  const recorded = [];
+  const collectionStub = new Proxy(
+    {},
+    {
+      get: () => () => collectionStub
+    }
+  );
+  const proxy = new Proxy(
+    {},
+    {
+      get: (_t, prop) => {
+        if (prop === "collection") {
+          return (name, opts) => {
+            recorded.push({
+              name,
+              indexes: opts?.indexes ?? [],
+              persistJsonSchema: !!opts?.persistJsonSchema
+            });
+            return collectionStub;
+          };
+        }
+        return () => proxy;
+      }
+    }
+  );
+  configure(proxy);
+  const sorted = [...recorded].sort((a, b) => a.name.localeCompare(b.name));
+  const indexes = {};
+  const persistJsonSchema = [];
+  for (const c of sorted) {
+    indexes[c.name] = c.indexes;
+    if (c.persistJsonSchema) persistJsonSchema.push(c.name);
+  }
+  return {
+    // `persistJsonSchema` is already name-sorted: it is populated while
+    // iterating `sorted` (collections in name order).
+    collections: sorted.map((c) => c.name),
+    indexes,
+    persistJsonSchema
+  };
+}
+function canonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  const obj = value;
+  const keys = Object.keys(obj).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${canonical(obj[k])}`).join(",")}}`;
+}
+async function fingerprintBlueprint(bp) {
+  return sha256Hex2(new TextEncoder().encode(canonical(bp)));
+}
+var init_schema_manifest = __esm({
+  "src/federation/schema-manifest.ts"() {
+    "use strict";
+    init_crypto();
+  }
+});
+
+// src/federation/state-vault.ts
+var state_vault_exports = {};
+__export(state_vault_exports, {
+  STATE_VAULT_NAME: () => STATE_VAULT_NAME,
+  StateManagementVault: () => StateManagementVault
+});
+var REGISTRY, MANIFEST, EVENTS, StateManagementVault;
+var init_state_vault = __esm({
+  "src/federation/state-vault.ts"() {
+    "use strict";
+    init_schema_manifest();
+    init_constants2();
+    init_ulid();
+    init_constants2();
+    REGISTRY = "vaultRegistry";
+    MANIFEST = "schemaManifest";
+    EVENTS = "deploymentEvents";
+    StateManagementVault = class _StateManagementVault {
+      constructor(registry, schemaManifest, events) {
+        this.registry = registry;
+        this.schemaManifest = schemaManifest;
+        this.#events = events;
+      }
+      registry;
+      schemaManifest;
+      /**
+       * The append-only deployment-events log is kept truly private so the raw
+       * mutable Collection is never surfaced — events may only be written via
+       * `appendEvent` and read via `queryEvents`. (`registry` and
+       * `schemaManifest` are deliberately public: consumers read and write them.)
+       */
+      #events;
+      /** Idempotently open the reserved state vault and bind the three control-plane collections. */
+      static async open(db) {
+        const vault = await db.openVault(STATE_VAULT_NAME);
+        return new _StateManagementVault(
+          vault.collection(REGISTRY),
+          vault.collection(MANIFEST),
+          vault.collection(EVENTS)
+        );
+      }
+      /** Read-only query over the append-only deployment-events log. */
+      queryEvents() {
+        return this.#events.query();
+      }
+      /**
+       * Append a deployment event with a fresh unique (ULID) id. This is the
+       * only write path to the events log; no update/delete is exposed.
+       * Callers should treat failures as non-fatal — this method does not
+       * swallow errors, so wrap the call site in try/catch where appropriate.
+       */
+      async appendEvent(event) {
+        const ts = event.ts ?? Date.now();
+        const id = generateULID();
+        await this.#events.put(id, { ...event, id, ts });
+      }
+      /**
+       * Ensure a manifest row exists for `(templateName, template.version)`.
+       * Safe to call repeatedly: the `fingerprint` is a deterministic hash of
+       * the template's declared shape (stable across calls), though each call
+       * refreshes `recordedAt`.
+       */
+      async recordManifest(templateName, template) {
+        const bp = captureBlueprint(template.configure);
+        const fingerprint = await fingerprintBlueprint(bp);
+        await this.schemaManifest.put(`${templateName}:${template.version}`, {
+          templateName,
+          version: template.version,
+          collections: bp.collections,
+          indexes: bp.indexes,
+          persistJsonSchema: bp.persistJsonSchema,
+          fingerprint,
+          recordedAt: Date.now()
+        });
+        return fingerprint;
+      }
+      /**
+       * True when `template`'s current declared shape does not match the recorded
+       * manifest for `(templateName, template.version)`. Because shards carry no
+       * schema state independent of their template, this catches "a template's
+       * shape changed without bumping `version`" — not independent per-shard drift.
+       * A missing manifest is treated as drift (nothing to verify against).
+       */
+      async detectDrift(templateName, template) {
+        const row = await this.schemaManifest.get(`${templateName}:${template.version}`);
+        if (!row) return true;
+        const current = await fingerprintBlueprint(captureBlueprint(template.configure));
+        return current !== row.fingerprint;
+      }
+    };
+  }
+});
+
 // src/noydb.ts
 var noydb_exports = {};
 __export(noydb_exports, {
@@ -16022,6 +17914,7 @@ var init_noydb = __esm({
   "src/noydb.ts"() {
     "use strict";
     init_errors();
+    init_constants2();
     init_storage3();
     init_rotate_recover();
     init_peer_recover();
@@ -16101,6 +17994,7 @@ var init_noydb = __esm({
       writeRelay;
       /** Per-vault policy enforcers. */
       policyEnforcers = /* @__PURE__ */ new Map();
+      vaultTemplates = /* @__PURE__ */ new Map();
       txStrategy;
       sessionStrategy;
       syncStrategy;
@@ -16170,7 +18064,7 @@ var init_noydb = __esm({
           await registry.runChecks(e.collection, incoming, ctx);
           const { GuardExecutor: GuardExecutor2 } = await Promise.resolve().then(() => (init_executor3(), executor_exports3));
           for (const g of guards) {
-            await GuardExecutor2.checkFrozenFields(g, e.docId, existing, incoming);
+            await GuardExecutor2.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
           }
         });
         this.subsystemBus.registerGate("beforeDelete", async (e) => {
@@ -16349,6 +18243,7 @@ var init_noydb = __esm({
           syncAdapter: targets.length > 0 ? targets[0].store : void 0,
           historyConfig: this.options.history,
           ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
+          ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
           ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
           ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
           ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
@@ -16359,6 +18254,7 @@ var init_noydb = __esm({
           ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
           ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
           ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
+          ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
           locale: opts?.locale,
           // Thread the translator hook so Collection.put() can invoke it
           plaintextTranslator: this.options.plaintextTranslator ? (text, from, to, field, collection) => this.invokeTranslator(text, from, to, field, collection) : void 0,
@@ -16402,6 +18298,7 @@ var init_noydb = __esm({
             emitter: this.emitter,
             historyConfig: this.options.history,
             ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
+            ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
             ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
             ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
             ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
@@ -16411,7 +18308,8 @@ var init_noydb = __esm({
             ...this.options.historyStrategy !== void 0 ? { historyStrategy: this.options.historyStrategy } : {},
             ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
             ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
-            ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {}
+            ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
+            ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {}
           });
           this.vaultCache.set(name, comp2);
           return comp2;
@@ -16430,6 +18328,7 @@ var init_noydb = __esm({
           encrypted: true,
           historyConfig: this.options.history,
           ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
+          ...this.options.archiveStrategy !== void 0 ? { archiveStrategy: this.options.archiveStrategy } : {},
           ...this.options.indexStrategy !== void 0 ? { indexStrategy: this.options.indexStrategy } : {},
           ...this.options.aggregateStrategy !== void 0 ? { aggregateStrategy: this.options.aggregateStrategy } : {},
           ...this.options.crdtStrategy !== void 0 ? { crdtStrategy: this.options.crdtStrategy } : {},
@@ -16440,6 +18339,7 @@ var init_noydb = __esm({
           ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
           ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
           ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
+          ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
           emitter: this.emitter
         });
         this.vaultCache.set(name, comp);
@@ -16744,6 +18644,61 @@ var init_noydb = __esm({
         }
         return results;
       }
+      /**
+       * Register a shard schema blueprint. `createShard` / `openVaultGroup`
+       * stamp shards from the named template. See the MVF design spec.
+       */
+      withVaultTemplate(name, template) {
+        this.vaultTemplates.set(name, template);
+      }
+      /**
+       * Open a VaultGroup — transparent routing over per-partition shard
+       * vaults, with shard discovery backed by the supplied `vault-registry`
+       * collection.
+       */
+      async openVaultGroup(name, opts) {
+        if (this.closed) throw new ValidationError("Instance is closed");
+        if (name === STATE_VAULT_NAME) throw new ReservedVaultNameError(name);
+        const template = this.vaultTemplates.get(opts.sharding.vaultTemplate);
+        if (!template) throw new VaultTemplateNotFoundError(opts.sharding.vaultTemplate);
+        const { VaultGroup: VaultGroup2 } = await Promise.resolve().then(() => (init_vault_group(), vault_group_exports));
+        const { StateManagementVault: StateManagementVault2 } = await Promise.resolve().then(() => (init_state_vault(), state_vault_exports));
+        const stateVault = opts.registry ? void 0 : await StateManagementVault2.open(this);
+        const registry = opts.registry ?? stateVault.registry;
+        const group = new VaultGroup2(this, name, registry, opts.sharding, template);
+        if (stateVault) {
+          group._attachStateVault(stateVault);
+          await stateVault.recordManifest(opts.sharding.vaultTemplate, template);
+          try {
+            await stateVault.appendEvent({
+              type: "manifest-recorded",
+              group: name,
+              templateName: opts.sharding.vaultTemplate,
+              version: template.version
+            });
+            await stateVault.appendEvent({ type: "group-opened", group: name });
+          } catch {
+          }
+        }
+        return group;
+      }
+      /**
+       * Open the reserved StateManagement control-plane vault (registry +
+       * schema-manifest + deployment-events). Lazy-loaded so the federation
+       * chunk stays out of the core graph until used.
+       */
+      async openStateManagementVault() {
+        if (this.closed) throw new ValidationError("Instance is closed");
+        const { StateManagementVault: StateManagementVault2 } = await Promise.resolve().then(() => (init_state_vault(), state_vault_exports));
+        return StateManagementVault2.open(this);
+      }
+      /**
+       * @internal — true when an encrypted shard vault is provisioned
+       * (its keyring exists in the store).
+       */
+      async _shardVaultProvisioned(vaultId) {
+        return (await this.options.store.list(vaultId, "_keyring")).length > 0;
+      }
       /**
        * Change the current user's passphrase for a vault.
        *