@noy-db/hub 0.2.0-pre.12 → 0.2.0-pre.14

package/dist/{chunk-TMHJEYW7.js → chunk-ACKFRSAH.js}

@@ -1,40 +1,43 @@
+import {
+  STATE_VAULT_NAME
+} from "./chunk-ZC7J6ZYV.js";
 import {
   resolveSchema
 } from "./chunk-EMIGCR7X.js";
 import {
   TxContext,
   revertExecuted
-} from "./chunk-M45IRXDM.js";
+} from "./chunk-YHPM5D7Y.js";
 import {
   OverlayedCollection
-} from "./chunk-4BHFNKTP.js";
+} from "./chunk-OHVFWCJP.js";
 import {
   LazyQuery,
   decodeIdxId,
   encodeIdxId
-} from "./chunk-P4EDT5ZP.js";
+} from "./chunk-YNTBADIY.js";
 import {
   SCHEMAS_COLLECTION,
   loadPersistedSchema,
   resolveManagedSecret,
   savePersistedSchema,
   saveSealedPassphrase
-} from "./chunk-XHM2SARW.js";
+} from "./chunk-WGHU7BLI.js";
 import {
   loadPublicEnvelope,
   readPublicEnvelope,
   savePublicEnvelope,
   validatePublicEnvelopeInput
-} from "./chunk-UA6G45ME.js";
+} from "./chunk-DKO2QFSA.js";
 import {
   PERIODS_COLLECTION
-} from "./chunk-RRDWXNBQ.js";
+} from "./chunk-KI6HAJWL.js";
 import {
   getAtPath,
   isDictCollectionName,
   resolvePolicy,
   setAtPathInPlace
-} from "./chunk-O53RIZCC.js";
+} from "./chunk-7HT2MEZ5.js";
 import {
   ManagedRecoveryNotEnrolledError,
   PolicyDeniedError,
@@ -56,11 +59,11 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-DLTU4M2I.js";
+} from "./chunk-COFPAMX6.js";
 import {
   assertTierAccess,
   dekKey
-} from "./chunk-ZC7MNVYN.js";
+} from "./chunk-4TBBMHVC.js";
 import {
   USER_ENVELOPE_COLLECTION,
   assertKeyringOpenAllowed,
@@ -85,7 +88,7 @@ import {
   rotateKeys,
   saveUserEnvelope,
   updateKeyringIdentity
-} from "./chunk-GFPR7VJS.js";
+} from "./chunk-A5ZOOZFB.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-2QR2PQTT.js";
@@ -95,21 +98,20 @@ import {
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
-} from "./chunk-SJJQKNMP.js";
+} from "./chunk-56DJ7JVK.js";
 import {
   sha256Hex as sha256Hex2
 } from "./chunk-Z6FNBOTC.js";
 import {
   NO_AGGREGATE,
   Query,
-  ScanBuilder
-} from "./chunk-UOC7JMZO.js";
+  ScanBuilder,
+  decodeMoneyFields,
+  quantizeMoneyFields
+} from "./chunk-KGCORI4L.js";
 import {
-  MoneyPrecisionError,
-  canonicalGroupKey,
-  formatScaledInt,
-  parseToScaledInt
-} from "./chunk-OPDTLHFA.js";
+  canonicalGroupKey
+} from "./chunk-3EWA37FV.js";
 import {
   readPath
 } from "./chunk-TV3YZ35S.js";
@@ -117,17 +119,17 @@ import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-6AD5TBF2.js";
+} from "./chunk-6AJBSQU4.js";
 import {
   NOYDB_BACKUP_VERSION,
   NOYDB_FORMAT_VERSION
-} from "./chunk-LYNNZEQD.js";
+} from "./chunk-GC4V7RU7.js";
 import {
   decrypt,
   encrypt,
   encryptDeterministic,
   sha256Hex
-} from "./chunk-IUBHXEPJ.js";
+} from "./chunk-YULZKK4F.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -144,10 +146,12 @@ import {
   MigrationRequiredError,
   NoAccessError,
   NoydbError,
+  NumberingUncertaintyError,
   PermissionDeniedError,
   QuiesceTimeoutError,
   ReadOnlyError,
   ReservedCollectionNameError,
+  ReservedVaultNameError,
   SchemaFenceError,
   SchemaValidationError,
   SequenceContentionError,
@@ -160,7 +164,7 @@ import {
   UnsupportedIndexOptionError,
   ValidationError,
   VaultTemplateNotFoundError
-} from "./chunk-AGRC7NQQ.js";
+} from "./chunk-535SSHBS.js";
 
 // src/policy/storage.ts
 var META_COLLECTION = "_meta";
@@ -335,88 +339,6 @@ var NO_CRDT = {
   }
 };
 
-// src/money/normalize.ts
-function isMoneyValueObject(v) {
-  return typeof v === "object" && v !== null && "currency" in v;
-}
-function quantizeAmount(field, input, scale, rounding) {
-  const r = parseToScaledInt(input, scale, rounding);
-  if (!r.ok) {
-    if (r.reason === "precision") throw new MoneyPrecisionError(field, input, scale);
-    throw new TypeError(`money: field "${field}" value ${JSON.stringify(input)} is not a finite decimal`);
-  }
-  return r.value.toString();
-}
-function quantizeMoneyFields(record, moneyFields) {
-  const out = { ...record };
-  for (const [field, desc] of Object.entries(moneyFields)) {
-    const raw = out[field];
-    if (raw === null || raw === void 0) continue;
-    if (desc.mode === "fixed") {
-      const currency2 = desc.fixedCurrency;
-      out[field] = quantizeAmount(field, raw, desc.scaleFor(currency2), desc.rounding);
-      continue;
-    }
-    let amount;
-    let currency;
-    if (isMoneyValueObject(raw)) {
-      currency = String(raw.currency);
-      amount = raw.amount;
-    } else {
-      const sole = desc.soleCurrency();
-      if (sole === void 0) {
-        throw new TypeError(
-          `money: field "${field}" is multi-currency \u2014 write { amount, currency }, not a bare amount`
-        );
-      }
-      currency = sole;
-      amount = raw;
-    }
-    const scale = desc.scaleFor(currency);
-    out[field] = { amount: quantizeAmount(field, amount, scale, desc.rounding), currency };
-  }
-  return out;
-}
-function formatCurrency(decimal, currency, scale, locale) {
-  const fmt = new Intl.NumberFormat(locale, {
-    style: "currency",
-    currency,
-    minimumFractionDigits: scale,
-    maximumFractionDigits: scale
-  });
-  return fmt.format(decimal);
-}
-function decodeMoneyFields(record, moneyFields, locale) {
-  const out = { ...record };
-  const format = locale !== "raw";
-  const fmtLocale = typeof locale === "string" && locale !== "raw" ? locale : "en-US";
-  for (const [field, desc] of Object.entries(moneyFields)) {
-    const stored = out[field];
-    if (stored === null || stored === void 0) continue;
-    let currency;
-    let scaledIntString;
-    if (desc.mode === "fixed") {
-      if (typeof stored !== "string" && typeof stored !== "number") continue;
-      currency = desc.fixedCurrency;
-      scaledIntString = String(stored);
-    } else {
-      if (!isMoneyValueObject(stored)) continue;
-      const amount = stored.amount;
-      if (typeof stored.currency !== "string" || typeof amount !== "string" && typeof amount !== "number") continue;
-      currency = stored.currency;
-      scaledIntString = String(amount);
-    }
-    const scale = desc.scaleFor(currency);
-    const decimal = formatScaledInt(BigInt(scaledIntString), scale);
-    out[field] = desc.mode === "fixed" ? decimal : { amount: decimal, currency };
-    if (format) {
-      out[`${field}Formatted`] = formatCurrency(decimal, currency, scale, fmtLocale);
-      out[`${field}Number`] = Number(decimal);
-    }
-  }
-  return out;
-}
-
 // src/computed/index.ts
 var ComputedFieldError = class extends NoydbError {
   constructor(field, id, cause) {
@@ -885,7 +807,7 @@ async function resolveStaleOnRead(accessor, outputCollection, id) {
     }
     const sourceWithId = { ...source, id };
     if (DerivationExecutor === null) {
-      ({ DerivationExecutor } = await import("./executor-D2QMNGRJ.js"));
+      ({ DerivationExecutor } = await import("./executor-6ZDSDZ6V.js"));
     }
     const ctx = { vault: accessor.getReadOnlyFacade() };
     const result = await DerivationExecutor.run(spec, sourceWithId, 0, strategyHash, ctx);
@@ -1391,7 +1313,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-UBLP3RJ3.js");
+      const { resolveStaleMVOnRead } = await import("./stale-7FRJVHN6.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     let record;
@@ -1788,7 +1710,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-O5AZK7UW.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-723ZP6TH.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -1797,7 +1719,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-UBLP3RJ3.js");
+          staleHelpers = await import("./stale-7FRJVHN6.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -1826,7 +1748,7 @@ var Collection = class {
       const mode = typeof spec.lifecycle === "string" ? spec.lifecycle : spec.lifecycle.mode;
       if (mode === "eager") {
         if (DerivationExecutor === null) {
-          ({ DerivationExecutor } = await import("./executor-D2QMNGRJ.js"));
+          ({ DerivationExecutor } = await import("./executor-6ZDSDZ6V.js"));
         }
         const sourceWithId = { ...incoming, id };
         const ctx = { vault: this.derivationSource.getReadOnlyFacade() };
@@ -1845,7 +1767,7 @@ var Collection = class {
           const outputCollection = this.derivationSource.getCollection(outSpec.collection);
           const txCtx = this.derivationSource.getActiveTxContext();
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-ZSKEQ6NI.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-N6OJX6QR.js");
             const prior = await loadFanoutSidecar(
               this.adapter,
               this.vault,
@@ -2138,7 +2060,7 @@ var Collection = class {
       for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
         if (outSpec.shape !== "array") continue;
         if (helpers === null) {
-          helpers = await import("./fanout-sidecar-ZSKEQ6NI.js");
+          helpers = await import("./fanout-sidecar-N6OJX6QR.js");
         }
         const sidecar = await helpers.loadFanoutSidecar(
           this.adapter,
@@ -2178,7 +2100,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-O5AZK7UW.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-723ZP6TH.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -2187,7 +2109,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-UBLP3RJ3.js");
+          staleHelpers = await import("./stale-7FRJVHN6.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -2210,14 +2132,22 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-UBLP3RJ3.js");
+      const { resolveStaleMVOnRead } = await import("./stale-7FRJVHN6.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     await this.ensureHydrated();
     const records = [...this.cache.values()].map((e) => e.record);
-    if (!locale) return records;
+    if (!this.hasReadTransforms()) return records;
     return Promise.all(records.map((r) => this.applyLocaleToRecord(r, locale)));
   }
+  /**
+   * @internal — whether any read-side record transform is registered
+   * (money decode, i18nText resolution, dictKey labels). Gates the
+   * no-transform fast path in {@link list}.
+   */
+  hasReadTransforms() {
+    return this.moneyFields !== void 0 && Object.keys(this.moneyFields).length > 0 || this.i18nFields !== void 0 && Object.keys(this.i18nFields).length > 0 || this.dictKeyFields !== void 0 && Object.keys(this.dictKeyFields).length > 0;
+  }
   // ─── Bulk operations ─────────────────────────────────────
   /**
    * Put many records in one call. Each item is processed sequentially
@@ -2723,7 +2653,8 @@ var Collection = class {
       pageSize,
       [],
       [],
-      joinContext
+      joinContext,
+      this.moneyFields
     );
   }
   /** Decrypt a page of envelopes returned by `adapter.listPage`. */
@@ -3931,6 +3862,159 @@ var SequenceStore = class {
   }
 };
 
+// src/numbering/index.ts
+var NUMBERING_HEAD_COLLECTION = "_numbering_head";
+var NUMBERING_PENDING_COLLECTION = "_numbering_pending";
+var DeferredNumberingStore = class {
+  adapter;
+  vault;
+  encrypted;
+  getDEK;
+  actor;
+  configs;
+  /**
+   * Stamp a serial onto a USER record THROUGH the Collection layer (so the
+   * cache, indexes, and MVs stay coherent — the engine must NOT write user
+   * collections at the raw adapter level). Returns false if the record is
+   * gone (the engine then skips it without burning a serial). Provided by the
+   * vault; unit tests pass a Map-backed double.
+   */
+  stamp;
+  /** In-process registry: `${series}::${recordId}` → resolver for the live next() Promise. */
+  waiters = /* @__PURE__ */ new Map();
+  dekCache = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.adapter = opts.adapter;
+    this.vault = opts.vault;
+    this.encrypted = opts.encrypted;
+    this.getDEK = opts.getDEK;
+    this.actor = opts.actor;
+    this.configs = opts.configs;
+    this.stamp = opts.stamp;
+  }
+  has(series) {
+    return this.configs.has(series);
+  }
+  dek(collection) {
+    let p = this.dekCache.get(collection);
+    if (!p) {
+      p = this.getDEK(collection);
+      this.dekCache.set(collection, p);
+    }
+    return p;
+  }
+  async readJson(collection, id) {
+    const env = await this.adapter.get(this.vault, collection, id);
+    if (!env) return { env: null, value: null };
+    const json = this.encrypted ? await decrypt(env._iv, env._data, await this.dek(collection)) : env._data;
+    return { env, value: JSON.parse(json) };
+  }
+  async writeJson(collection, id, value, expectedVersion) {
+    const json = JSON.stringify(value);
+    let env;
+    if (!this.encrypted) {
+      env = { _noydb: NOYDB_FORMAT_VERSION, _v: expectedVersion + 1, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: "", _data: json, _by: this.actor };
+    } else {
+      const { iv, data } = await encrypt(json, await this.dek(collection));
+      env = { _noydb: NOYDB_FORMAT_VERSION, _v: expectedVersion + 1, _ts: (/* @__PURE__ */ new Date()).toISOString(), _iv: iv, _data: data, _by: this.actor };
+    }
+    await this.adapter.put(this.vault, collection, id, env, expectedVersion);
+  }
+  pendingId(series, recordId) {
+    return `${series}::${recordId}`;
+  }
+  /** Current last-assigned serial for a series (0 if none). */
+  async peek(series) {
+    const { value } = await this.readJson(NUMBERING_HEAD_COLLECTION, series);
+    return value?.lastSerial ?? 0;
+  }
+  /**
+   * Enqueue a record for numbering: stamp it with the current store clock and
+   * durably write a pending entry. The returned Promise resolves once the
+   * record is durably enqueued; its `assigned` field resolves with the serial
+   * at the next pass (the record's `field` is the durable source of truth —
+   * `assigned` is an in-process convenience that a crash may drop).
+   */
+  async enqueue(series, recordId) {
+    const cfg = this.configs.get(series);
+    if (!cfg) throw new NumberingUncertaintyError(series);
+    if (typeof this.adapter.getStoreTime !== "function") throw new NumberingUncertaintyError(series);
+    const st = await this.adapter.getStoreTime();
+    const id = this.pendingId(series, recordId);
+    const { env } = await this.readJson(NUMBERING_PENDING_COLLECTION, id);
+    const entry = {
+      series,
+      recordId,
+      collection: cfg.collection,
+      field: cfg.field,
+      storeEarliest: st.earliest,
+      storeLatest: st.latest,
+      enqueuedAt: Date.now()
+    };
+    await this.writeJson(NUMBERING_PENDING_COLLECTION, id, entry, env?._v ?? 0);
+    const assigned = new Promise((resolve, reject) => {
+      this.waiters.set(id, { resolve, reject });
+    });
+    return { assigned };
+  }
+  async listPending(series) {
+    const ids = await this.adapter.list(this.vault, NUMBERING_PENDING_COLLECTION);
+    const prefix = `${series}::`;
+    const out = [];
+    for (const id of ids) {
+      if (!id.startsWith(prefix)) continue;
+      const { value } = await this.readJson(NUMBERING_PENDING_COLLECTION, id);
+      if (value) out.push({ id, entry: value });
+    }
+    return out;
+  }
+  /**
+   * Run a numbering pass for `series`: select entries provably settled
+   * (`storeLatest ≤ now.earliest` — commit-wait), order by
+   * `(storeEarliest, recordId)`, assign serials after the head, stamp each
+   * record's field, advance the head with one CAS, and consume the entries.
+   * Idempotent/convergent: a losing concurrent pass returns `[]` and the next
+   * pass reconciles. Resolves any in-process enqueue() `assigned` Promises.
+   */
+  async runPass(series) {
+    const cfg = this.configs.get(series);
+    if (!cfg) throw new NumberingUncertaintyError(series);
+    if (typeof this.adapter.getStoreTime !== "function") throw new NumberingUncertaintyError(series);
+    const now = await this.adapter.getStoreTime();
+    const settled = (await this.listPending(series)).filter((p) => p.entry.storeLatest <= now.earliest).sort(
+      (a, b) => a.entry.storeEarliest - b.entry.storeEarliest || (a.entry.recordId < b.entry.recordId ? -1 : a.entry.recordId > b.entry.recordId ? 1 : 0)
+    );
+    if (settled.length === 0) return [];
+    const { env: headEnv, value: head } = await this.readJson(NUMBERING_HEAD_COLLECTION, series);
+    let serial = head?.lastSerial ?? 0;
+    const assignments = [];
+    for (const { entry } of settled) {
+      serial += 1;
+      const ok = await this.stamp(entry.collection, entry.recordId, entry.field, serial);
+      if (!ok) {
+        serial -= 1;
+        continue;
+      }
+      assignments.push({ recordId: entry.recordId, serial });
+    }
+    try {
+      await this.writeJson(NUMBERING_HEAD_COLLECTION, series, { series, lastSerial: serial, watermark: now.earliest }, headEnv?._v ?? 0);
+    } catch (err) {
+      if (err instanceof ConflictError) return [];
+      throw err;
+    }
+    for (const { id, entry } of settled) {
+      await this.adapter.delete(this.vault, NUMBERING_PENDING_COLLECTION, id);
+      const a = assignments.find((x) => x.recordId === entry.recordId);
+      if (a) {
+        this.waiters.get(id)?.resolve(a.serial);
+        this.waiters.delete(id);
+      }
+    }
+    return assignments;
+  }
+};
+
 // src/shadow/strategy.ts
 var NOT_ENABLED2 = new Error(
   'VaultFrame requires the shadow strategy. Import `{ withShadow }` from "@noy-db/hub/shadow" and pass it to `createNoydb({ shadowStrategy: withShadow() })`.'
@@ -5150,6 +5234,10 @@ var Vault = class {
   ledgerStore = null;
   /** Lazily-built atomic-sequence store. See {@link sequence}. */
   sequenceStore = null;
+  /** Lazily-built deferred-numbering engine. See {@link runNumberingPass}. */
+  deferredNumbering = null;
+  /** Registered deferred-numbering series, keyed by series name. */
+  numberingConfigs;
   /**
    * Background writes for persisted-schema envelopes (#schema-dump v0
    * slice 1). One promise per `collection({ persistJsonSchema: true })`
@@ -5236,6 +5324,7 @@ var Vault = class {
   constructor(opts) {
     this.adapter = opts.adapter;
     this.name = opts.name;
+    this.numberingConfigs = new Map((opts.numberingConfigs ?? []).map((c) => [c.series, c]));
     this.noydb = opts.noydb;
     this.keyring = opts.keyring;
     this.encrypted = opts.encrypted;
@@ -5910,6 +5999,18 @@ var Vault = class {
    * ```
    */
   sequence(name) {
+    if (this.numberingConfigs.has(name)) {
+      const eng = this.deferred();
+      return {
+        next: async (opts) => {
+          if (!opts?.for) {
+            throw new ValidationError(`sequence("${name}") is a deferred-numbering series; call next({ for: recordId }).`);
+          }
+          return (await eng.enqueue(name, opts.for)).assigned;
+        },
+        peek: () => eng.peek(name)
+      };
+    }
     if (!this.sequenceStore) {
       this.sequenceStore = new SequenceStore({
         adapter: this.adapter,
@@ -5921,6 +6022,38 @@ var Vault = class {
     }
     return this.sequenceStore.handle(name);
   }
+  /** @internal — lazily build the deferred-numbering engine with a cache-coherent stamp. */
+  deferred() {
+    if (!this.deferredNumbering) {
+      this.deferredNumbering = new DeferredNumberingStore({
+        adapter: this.adapter,
+        vault: this.name,
+        encrypted: this.encrypted,
+        getDEK: this.getDEK,
+        actor: this.keyring.userId,
+        configs: this.numberingConfigs,
+        // Stamp THROUGH the Collection layer so cache/indexes/MVs stay coherent —
+        // `this.collection(name)` returns the shared cached instance, so a
+        // subsequent user `collection.get(id)` sees the assigned serial.
+        stamp: async (collection, recordId, field, serial) => {
+          const coll = this.collection(collection);
+          const rec = await coll.get(recordId);
+          if (!rec) return false;
+          await coll.put(recordId, { ...rec, [field]: serial });
+          return true;
+        }
+      });
+    }
+    return this.deferredNumbering;
+  }
+  /**
+   * Run a deferred-numbering pass for `series`: assign gap-free serials to all
+   * records whose store-commit-time interval has settled, in store-time order.
+   * Returns the assignments made. See {@link sequence} / `withDeferredNumbering`.
+   */
+  async runNumberingPass(series) {
+    return this.deferred().runPass(series);
+  }
   async compact(options = {}) {
     return runCompaction({
       adapter: this.adapter,
@@ -6002,12 +6135,12 @@ var Vault = class {
     if (!fieldSchema) {
       throw new AttestationError(`issueAttestation: collection '${collectionName}' has no attestation field-schema. Declare it via vault.collection('${collectionName}', { attestation: { fields: [...] } }).`);
     }
-    const { issueAttestationCore } = await import("./issue-YIYG4OW5.js");
+    const { issueAttestationCore } = await import("./issue-ADVS4OVP.js");
     const out = await issueAttestationCore(this.makeIssueContext(), { collection: collectionName, id, fieldSchema });
     return { docId: out.docId, qr: out.qr, keyId: out.keyId, publicKeyB64: out.publicKeyB64 };
   }
   async getDocumentSigningPublicKey() {
-    const { loadSigner, loadOrCreateSigner } = await import("./signer-6JF44I4A.js");
+    const { loadSigner, loadOrCreateSigner } = await import("./signer-P5D7Y72U.js");
     const existing = await loadSigner(this.adapter, this.name, this.getDEK);
     if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
     if (this.keyring.role !== "owner") {
@@ -6033,19 +6166,19 @@ var Vault = class {
     };
   }
   async revokeAttestation(docId) {
-    const { revokeDocCore } = await import("./revoke-7RLGQWZ7.js");
+    const { revokeDocCore } = await import("./revoke-ZDFKMR5E.js");
     await revokeDocCore(this.makeRevokeContext(), docId);
   }
   async unrevokeAttestation(docId) {
-    const { unrevokeDocCore } = await import("./revoke-7RLGQWZ7.js");
+    const { unrevokeDocCore } = await import("./revoke-ZDFKMR5E.js");
     await unrevokeDocCore(this.makeRevokeContext(), docId);
   }
   async getRevokedDocIds() {
-    const { getRevokedDocIdsCore } = await import("./revoke-7RLGQWZ7.js");
+    const { getRevokedDocIdsCore } = await import("./revoke-ZDFKMR5E.js");
     return getRevokedDocIdsCore(this.makeRevokeContext());
   }
   async publishRevocationList() {
-    const { publishRevocationListCore } = await import("./revoke-7RLGQWZ7.js");
+    const { publishRevocationListCore } = await import("./revoke-ZDFKMR5E.js");
     return publishRevocationListCore(this.makeRevokeContext());
   }
   makeRevokeContext() {
@@ -6362,7 +6495,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-JLP3QOLD.js"),
+      import("./registry-XGLNADIE.js"),
       import("./read-only-facade-ITU6L7BL.js")
     ]);
     const registry = new DerivationRegistry();
@@ -6393,7 +6526,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-NCY445U5.js");
+    const { MaterializedViewRegistry } = await import("./registry-DK5YWAAA.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -6417,7 +6550,7 @@ var Vault = class {
    */
   async _initOverlayedViews(handles) {
     if (handles.length === 0) return;
-    const { OverlayedViewRegistry } = await import("./registry-BVQ5ITMF.js");
+    const { OverlayedViewRegistry } = await import("./registry-IUZQVVBB.js");
     const registry = new OverlayedViewRegistry();
     const mvRegistry = this.materializedViewRegistry;
     const overlayNames = /* @__PURE__ */ new Set();
@@ -6464,13 +6597,13 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-O5AZK7UW.js");
+    const { MaterializedViewExecutor } = await import("./executor-723ZP6TH.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this
     });
-    const { clearMVStale } = await import("./stale-UBLP3RJ3.js");
+    const { clearMVStale } = await import("./stale-7FRJVHN6.js");
     clearMVStale(registry, name);
     return result;
   }
@@ -6486,7 +6619,7 @@ var Vault = class {
     if (registry === null) return { derived: 0, failed: 0 };
     const strategies = registry.strategiesForSource(sourceCollection);
     if (strategies.length === 0) return { derived: 0, failed: 0 };
-    const { DerivationExecutor } = await import("./executor-D2QMNGRJ.js");
+    const { DerivationExecutor } = await import("./executor-6ZDSDZ6V.js");
     const sourceColl = this.collection(sourceCollection);
     const records = await sourceColl.list();
     const ctx = { vault: this.readOnlyFacade ?? new (await import("./read-only-facade-ITU6L7BL.js")).ReadOnlyVaultFacade(this) };
@@ -6511,7 +6644,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-ZSKEQ6NI.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-N6OJX6QR.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -6732,7 +6865,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-6FCWDRUS.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-NIQ43IPU.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
@@ -6754,7 +6887,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-6FCWDRUS.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-NIQ43IPU.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -7223,7 +7356,7 @@ var Vault = class {
    * @see docs/subsystems/public-envelope.md
    */
   async getPublicEnvelope(opts = {}) {
-    const { readPublicEnvelope: readPublicEnvelope2 } = await import("./public-envelope-PFLZI5MO.js");
+    const { readPublicEnvelope: readPublicEnvelope2 } = await import("./public-envelope-SYHEYQ3X.js");
     return readPublicEnvelope2(this.adapter, this.name, opts);
   }
   /**
@@ -8833,7 +8966,7 @@ var Noydb = class {
       if (!facade) return;
       const ctx = { existing, vault: facade, userId: e.userId, role: e.role };
       await registry.runChecks(e.collection, incoming, ctx);
-      const { GuardExecutor } = await import("./executor-7KSCEIFA.js");
+      const { GuardExecutor } = await import("./executor-IDZDAFNH.js");
       for (const g of guards) {
         await GuardExecutor.checkFrozenFields(g, e.docId, existing, incoming, e.computedFieldNames);
       }
@@ -9025,6 +9158,7 @@ var Noydb = class {
       ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
       ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
       ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
+      ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
       locale: opts?.locale,
       // Thread the translator hook so Collection.put() can invoke it
       plaintextTranslator: this.options.plaintextTranslator ? (text, from, to, field, collection) => this.invokeTranslator(text, from, to, field, collection) : void 0,
@@ -9078,7 +9212,8 @@ var Noydb = class {
         ...this.options.historyStrategy !== void 0 ? { historyStrategy: this.options.historyStrategy } : {},
         ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
         ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
-        ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {}
+        ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
+        ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {}
       });
       this.vaultCache.set(name, comp2);
       return comp2;
@@ -9108,6 +9243,7 @@ var Noydb = class {
       ...this.options.i18nStrategy !== void 0 ? { i18nStrategy: this.options.i18nStrategy } : {},
       ...this.options.syncStrategy !== void 0 ? { syncStrategy: this.options.syncStrategy } : {},
       ...this.options.guardStrategies !== void 0 ? { guardStrategies: this.options.guardStrategies } : {},
+      ...this.options.numbering !== void 0 ? { numberingConfigs: this.options.numbering } : {},
       emitter: this.emitter
     });
     this.vaultCache.set(name, comp);
@@ -9426,10 +9562,39 @@ var Noydb = class {
    */
   async openVaultGroup(name, opts) {
     if (this.closed) throw new ValidationError("Instance is closed");
+    if (name === STATE_VAULT_NAME) throw new ReservedVaultNameError(name);
     const template = this.vaultTemplates.get(opts.sharding.vaultTemplate);
     if (!template) throw new VaultTemplateNotFoundError(opts.sharding.vaultTemplate);
-    const { VaultGroup } = await import("./vault-group-Z4KB75ZH.js");
-    return new VaultGroup(this, name, opts.registry, opts.sharding, template);
+    const { VaultGroup } = await import("./vault-group-W7QC4UYW.js");
+    const { StateManagementVault } = await import("./state-vault-TMXZRTY5.js");
+    const stateVault = opts.registry ? void 0 : await StateManagementVault.open(this);
+    const registry = opts.registry ?? stateVault.registry;
+    const group = new VaultGroup(this, name, registry, opts.sharding, template);
+    if (stateVault) {
+      group._attachStateVault(stateVault);
+      await stateVault.recordManifest(opts.sharding.vaultTemplate, template);
+      try {
+        await stateVault.appendEvent({
+          type: "manifest-recorded",
+          group: name,
+          templateName: opts.sharding.vaultTemplate,
+          version: template.version
+        });
+        await stateVault.appendEvent({ type: "group-opened", group: name });
+      } catch {
+      }
+    }
+    return group;
+  }
+  /**
+   * Open the reserved StateManagement control-plane vault (registry +
+   * schema-manifest + deployment-events). Lazy-loaded so the federation
+   * chunk stays out of the core graph until used.
+   */
+  async openStateManagementVault() {
+    if (this.closed) throw new ValidationError("Instance is closed");
+    const { StateManagementVault } = await import("./state-vault-TMXZRTY5.js");
+    return StateManagementVault.open(this);
   }
   /**
    * @internal — true when an encrypted shard vault is provisioned
@@ -10968,4 +11133,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-TMHJEYW7.js.map
+//# sourceMappingURL=chunk-ACKFRSAH.js.map