@noy-db/hub 0.2.0-pre.16 → 0.2.0-pre.17

package/dist/{strategy-BtW8fAjz.d.cts → errors-Dz64FA65.d.ts}

@@ -1,364 +1,3 @@
-/**
- * Aggregation reducers for the query DSL.
- *
- * the reducer protocol plus five built-in factories
- * (`count`, `sum`, `avg`, `min`, `max`) consumed by `Query.aggregate()`
- * and, in the future, `Scan.aggregate()`. Every factory accepts
- * an optional `{ seed }` parameter that is plumbed through the
- * protocol but unused by the executor — that's the load-bearing
- * half of  constraint #2. When partition-aware aggregation
- * lands, the seed carries the previous partition's running total into
- * the next partition without requiring a protocol change.
- *
- * Reducers are intentionally generic over their internal state type
- * `S` so compound reducers (avg keeps `{sum, count}`, min/max keep a
- * value bag) can model internal bookkeeping without leaking the
- * implementation through the accumulator's public shape. `finalize`
- * collapses `S` back into the user-visible `R`.
- *
- * Reducers are pure data — `init` / `step` / `finalize` / optional
- * `remove` are stateless functions that receive and return `S`. This
- * is the shape that admits O(1) incremental maintenance in a future
- * optimization (delta-aware `LiveAggregation` applies `step` or
- * `remove` per delta), without blocking the simpler "full re-run on
- * source change" that ships.
- */
-/**
- * A single reducer: factory-produced, ready to plug into an
- * `.aggregate()` spec.
- *
- * Type parameters:
- *   - `R` — user-visible result type (what the aggregation returns
- *     for this slot, e.g. `number` for `sum()`)
- *   - `S` — internal state type, defaults to `R` for simple reducers
- *     that don't need compound bookkeeping
- *
- * A reducer is stateless: every method is pure over `S`. `init()` is
- * called once per aggregation run to build the initial state; `step()`
- * folds a record into the state; `remove()` (optional) un-folds a
- * record, enabling incremental live maintenance; `finalize()` reads
- * the final answer out of the state at the end of the run.
- */
-interface Reducer<R, S = R> {
-    /** Build the initial state for a fresh aggregation run. */
-    init(): S;
-    /** Fold a record into the state. Returns the new state. */
-    step(state: S, record: unknown): S;
-    /**
-     * Un-fold a record from the state. Returns the new state.
-     *
-     * Optional — reducers without `remove` cannot be maintained
-     * incrementally and must be re-run from scratch when the underlying
-     * record set changes. `sum`, `count`, `avg` implement `remove` in
-     * O(1); `min` and `max` implement it in O(N) worst case (when the
-     * extremum itself is removed and the next extremum must be
-     * recomputed from the remaining contributing values).
-     */
-    remove?(state: S, record: unknown): S;
-    /** Collapse the internal state into the user-visible result. */
-    finalize(state: S): R;
-    /**
-     * Combine two independent partial states into one (then `finalize` once).
-     * Optional. MUST be associative + commutative with `init()` as identity.
-     * Never merge finalized results — only states. Enables parallel /
-     * hierarchical aggregation (e.g. cross-shard or advisor→firm rollup).
-     */
-    merge?(a: S, b: S): S;
-    /**
-     * Identifying operation tag stamped by each built-in factory.
-     * Used by `summariseAggregateOp` in the introspection walker to
-     * render human-readable aggregate descriptors in `dumpSchema()`.
-     * Optional so third-party custom reducers are unaffected.
-     */
-    readonly op?: 'count' | 'sum' | 'avg' | 'min' | 'max';
-    /**
-     * Field name for field-based reducers (`sum`, `avg`, `min`, `max`).
-     * Absent on `count` which aggregates over record count, not a field.
-     */
-    readonly field?: string;
-    /**
-     * Money-only: target currency for `sum` over a multi-currency money
-     * field. Consumed by `wrapMoneyReducers` to convert per-currency
-     * subtotals to one figure. Ignored for non-money fields.
-     */
-    readonly convertTo?: string;
-    /**
-     * Money-only: FX rate map (`'USD->EUR' → rate`) used with `convertTo`.
-     */
-    readonly fx?: Record<string, number | string>;
-}
-/**
- * Common options accepted by every reducer factory.
- *
- * `seed` — optional initial value for the internal state. **Unused by
- * the executor**, plumbed through the protocol for  constraint
- * #2 (partition-aware aggregation seam). In, partitioned
- * aggregations will pass the previous partition's carry as `seed` so
- * a long time series can be rolled forward one partition at a time
- * without re-aggregating closed partitions.
- *
- * always uses `init()` with the factory's zero value, regardless
- * of whether `seed` was passed. Do not remove the parameter — that's
- * the whole point of having it exist now.
- */
-interface ReducerOptions<TSeed = unknown> {
-    /**  constraint #2 — seed is plumbed through but unused in. */
-    readonly seed?: TSeed;
-    /**
-     * Money-only (honored by `sum` over a multi-currency money field):
-     * convert per-currency subtotals to this currency for a single figure.
-     */
-    readonly convertTo?: string;
-    /** Money-only: FX rate map (`'USD->EUR' → rate`) used with `convertTo`. */
-    readonly fx?: Record<string, number | string>;
-}
-/**
- * Count the number of records that match the query. Ignores field
- * values entirely — the count is over the number of records, not over
- * the number of non-null field values in any column.
- */
-declare function count(opts?: ReducerOptions<number>): Reducer<number>;
-/**
- * Sum a numeric field across all matching records. Non-number values
- * at the field path are coerced to 0 — consumers who want a different
- * behavior (throw, skip, treat as NaN) should filter upstream via
- * `.where()` or write a custom reducer.
- */
-declare function sum(field: string, opts?: ReducerOptions<number>): Reducer<number>;
-/**
- * Arithmetic mean of a numeric field across all matching records.
- *
- * Returns `null` for an empty result set (zero records is not a
- * well-defined denominator — returning NaN would poison downstream
- * arithmetic, and throwing would force every consumer to wrap in
- * try/catch just to handle "no matches"). Consumers who want an
- * explicit zero should coalesce with `?? 0`.
- *
- * Internal state is `{sum, count}` so the running average can be
- * maintained incrementally — on each delta, both fields update in
- * O(1) and `finalize` divides. Directly storing `avg` as state would
- * not admit incremental removal without also tracking count.
- */
-declare function avg(field: string, opts?: ReducerOptions<{
-    sum: number;
-    count: number;
-}>): Reducer<number | null, {
-    sum: number;
-    count: number;
-}>;
-interface MinMaxState {
-    /**
-     * Multiset of contributing field values. Stored as a plain array
-     * because we need to support `remove` and a plain array gives us
-     * O(1) push + O(N) worst-case removal — which matches the
-     * documented min/max removal complexity. A sorted structure would
-     * let us drop the O(N) rescan but adds complexity that doesn't
-     * need; consumers hitting the O(N) ceiling should file an issue.
-     */
-    readonly values: number[];
-}
-/**
- * Smallest numeric value of a field across all matching records.
- * Returns `null` for an empty result set. See `avg()` for the
- * reasoning on `null` vs NaN vs throwing.
- *
- * Incremental complexity: O(1) for `step`, O(N) worst case for
- * `remove` when the current minimum is removed (the state holds the
- * full multiset of contributing values and `finalize` scans for the
- * new minimum). Consumers with very large result sets and frequent
- * removals of the current extremum should either accept the cost or
- * wait for a future optimization.
- */
-declare function min(field: string, opts?: ReducerOptions<number>): Reducer<number | null, MinMaxState>;
-/**
- * Largest numeric value of a field across all matching records.
- * Mirror of `min()` — see that doc for semantics, null-on-empty
- * behavior, and the O(N) removal caveat.
- */
-declare function max(field: string, opts?: ReducerOptions<number>): Reducer<number | null, MinMaxState>;
-
-/**
- * Aggregate execution — the runtime behind `Query.aggregate()`.
- *
- * takes an `AggregateSpec` (a record of named reducers
- * built from `reducers.ts`) and runs every reducer over the records
- * produced by the underlying query. Two terminal surfaces:
- *
- *   - `.run(): R` — synchronous one-shot reduction. Matches the
- *     existing `Query.toArray()` / `.first()` / `.count()` style.
- *   - `.live(): LiveAggregation<R>` — reactive primitive that
- *     re-runs the reduction whenever the query's source notifies of
- *     a change. uses naive full re-run; incremental delta
- *     maintenance is admitted by the reducer protocol (`remove()`)
- *     but not wired to the executor yet — a follow-up optimization
- *     can switch from full re-run to delta-based without breaking
- *     the public API. Consumers get correct, reactive values today.
- *
- * The `Aggregation<R>` wrapper is deliberately tiny — it exists so
- * `.aggregate(spec)` can be chained with either `.run()` or `.live()`
- * without the builder needing two separate terminal methods. It
- * holds the closure over the query execution (produces the current
- * matching record set) and the spec, and stitches them together in
- * either mode.
- *
- * This file depends ONLY on `reducers.ts` — it has no knowledge of
- * the `Query` class. Tests can therefore exercise the reduction
- * surface with plain record arrays, without spinning up a Collection.
- */
-
-/**
- * A named set of reducers, keyed by output field name. Each key
- * becomes a field on the aggregated result.
- *
- * ```ts
- * const spec = {
- *   total: sum('amount'),
- *   n:     count(),
- *   avgAmount: avg('amount'),
- * }
- * ```
- */
-type AggregateSpec = Readonly<Record<string, Reducer<unknown, unknown>>>;
-/**
- * Map an `AggregateSpec` to its reduced result shape — each key
- * carries the finalized result type from its reducer. A spec built
- * from `{ total: sum('amount'), n: count() }` yields a result of
- * `{ total: number, n: number }`.
- *
- * This uses a mapped type with a conditional to extract `R` from
- * each `Reducer<R, _>`. The `infer` captures the user-visible result
- * type, discarding the internal state type `S`.
- */
-type AggregateResult<Spec extends AggregateSpec> = {
-    [K in keyof Spec]: Spec[K] extends Reducer<infer R, unknown> ? R : never;
-};
-/**
- * Pure reduction over a record array. Runs every reducer's
- * `init → step* → finalize` pipeline exactly once over the records.
- *
- * Called by `Aggregation.run()` and by the live-mode refresh path.
- * Exported for tests and for future `scan().aggregate()` reuse
- * — the streaming path will call the same reducer protocol with a
- * per-page loop instead of a single array.
- */
-declare function reduceRecords<Spec extends AggregateSpec>(records: readonly unknown[], spec: Spec): AggregateResult<Spec>;
-/**
- * A minimal reactive primitive for aggregation results.
- *
- * Same spirit as the `LiveQuery` in : frame-agnostic, a plain
- * object with `value` / `error` fields and a `subscribe(cb)`
- * notification channel that Vue / React / Solid adapters wrap in
- * their own primitive. Intentionally NOT a Promise — aggregations
- * have a well-defined "current value" at every instant, and the
- * reactive consumer wants to read that value synchronously.
- *
- * Error semantics mirror `LiveQuery`: if a re-run throws, the
- * previous successful `value` is preserved and the error is stored
- * in `error` so consumers can render an error state without losing
- * the last-known-good result. The throw does NOT propagate out of
- * the source's change handler (which would tear down the upstream
- * emitter).
- *
- * `stop()` tears down the upstream subscription. It is idempotent —
- * calling it multiple times is safe — and subscribe calls after
- * stop are no-ops (they immediately return a no-op unsubscribe).
- * Always call `stop()` when done; Vue's `onUnmounted` is the
- * canonical place. Raw consumers must do it themselves.
- */
-interface LiveAggregation<R> {
-    /** Current reduced value. Undefined only if the first compute threw. */
-    readonly value: R | undefined;
-    /** Last execution error, if any. Cleared on the next successful run. */
-    readonly error: unknown;
-    /** Notify on every recomputation (success or error). Returns unsubscribe. */
-    subscribe(cb: () => void): () => void;
-    /** Tear down the upstream subscription. Idempotent. */
-    stop(): void;
-}
-/**
- * Upstream change-notification hook for live aggregation.
- *
- * Matches the shape that `QuerySource.subscribe` already uses — a
- * single method that accepts a callback and returns an unsubscribe
- * function. The `Aggregation` wrapper collects upstreams from the
- * query's source and wires them into a single re-run trigger.
- */
-interface AggregationUpstream {
-    subscribe(cb: () => void): () => void;
-}
-/**
- * Chainable wrapper returned by `Query.aggregate(spec)`. Holds the
- * execute-records closure and the spec; terminal methods (`run`,
- * `live`) stitch them together in either mode.
- *
- * Why a wrapper instead of two terminal methods on `Query` directly?
- *
- * The `.aggregate(spec)` call is where the spec is bound — both
- * `.run()` and `.live()` need the same spec, and the consumer's
- * fluent style is `query.where(...).aggregate(spec).run()` or
- * `.aggregate(spec).live()`. Wrapping lets the spec be named once
- * and reused for either terminal, and keeps the `Query` class
- * from growing a pair of near-duplicate method overloads
- * (`aggregateRun` / `aggregateLive`) that would be harder to
- * discover.
- */
-declare class Aggregation<R> {
-    private readonly executeRecords;
-    private readonly spec;
-    private readonly upstreams;
-    constructor(executeRecords: () => readonly unknown[], spec: AggregateSpec, upstreams: readonly AggregationUpstream[]);
-    /**
-     * Execute the query and reduce the results synchronously.
-     * Returns the reduced shape matching the spec — e.g. a spec of
-     * `{ total: sum('amount'), n: count() }` returns
-     * `{ total: number, n: number }`.
-     */
-    run(): R;
-    /**
-     * Build a reactive `LiveAggregation<R>` that re-runs the reduction
-     * whenever any upstream source notifies of a change. The initial
-     * value is computed eagerly in the constructor, so consumers can
-     * read `live.value` immediately after calling `.live()`.
-     *
-     * Always call `live.stop()` when finished — it tears down the
-     * upstream subscriptions. Vue's `onUnmounted` is the canonical
-     * place.
-     *
-     * **Implementation note:** every upstream change triggers a full
-     * re-reduction. Incremental maintenance (O(1) per delta for
-     * sum/count/avg via the reducer protocol's `remove()` method) is a
-     * planned follow-up optimization — the protocol already supports
-     * it, but the executor doesn't drive it yet. Consumers get
-     * correct, reactive values today; future PRs can switch to
-     * delta-based maintenance without changing this API.
-     */
-    live(): LiveAggregation<R>;
-}
-/**
- * Build a `LiveAggregation<V>` from a recompute closure and a list
- * of upstreams. Exposed so sibling files in the query DSL
- * (currently `groupby.ts`) can reuse the reactive primitive
- * without reaching into `LiveAggregationImpl` directly. This keeps
- * the implementation class private while still allowing planned
- * composition with `.groupBy().aggregate().live()`.
- */
-declare function buildLiveAggregation<V>(recompute: () => V, upstreams: readonly AggregationUpstream[]): LiveAggregation<V>;
-
-/**
- * Pure fixed-point decimal core for the money descriptor.
- *
- * All conversion goes decimal-string ⇄ scaled `BigInt`. There is no
- * floating-point arithmetic anywhere: a value like `123.45` becomes
- * `12345n` purely by string manipulation, never by `value * 100` (which
- * would reintroduce the very drift money() exists to eliminate). BigInt
- * has no magnitude ceiling, so values past `Number.MAX_SAFE_INTEGER`
- * stay exact end-to-end.
- *
- * This module knows nothing about currencies, descriptors, or storage —
- * it is the isolated, exhaustively-tested arithmetic kernel.
- */
-type RoundingMode = 'half-up' | 'half-even' | 'half-down' | 'up' | 'down' | 'ceil' | 'floor';
-
 /**
  * All NOYDB error classes — a single import surface for `catch` blocks and
  * `instanceof` checks.
@@ -402,6 +41,9 @@ type RoundingMode = 'half-up' | 'half-even' | 'half-down' | 'up' | 'down' | 'cei
  *       │    ├─ DictKeyInUseError
  *       │    ├─ MissingTranslationError
  *       │    ├─ LocaleNotSpecifiedError
+ *       │    ├─ ScriptViolationError
+ *       │    ├─ StaticDictReadonlyError
+ *       │    ├─ UnknownDictCodeError
  *       │    └─ TranslatorNotConfiguredError
  *       ├─ Backup errors
  *       │    ├─ BackupLedgerError      — hash-chain verification failed
@@ -416,6 +58,12 @@ type RoundingMode = 'half-up' | 'half-even' | 'half-down' | 'up' | 'down' | 'cei
  *       │    └─ SnapshotNotFoundError  — snapshot key absent from snapshot store
  *       └─ Computed field errors
  *            └─ ComputedFieldError     — computed function threw during a write
+ *       └─ Erasure errors
+ *            └─ ForgetStrategyNotConfiguredError — vault.forget() with no withForgetCascade
+ *       └─ Sealed-record errors (record-scoped CEK sealing, #306)
+ *            ├─ SealedRecordExpiredError  — sealed CEK binding past expiresAt
+ *            ├─ SealedRecordMismatchError — CEK sealed for record A used on record B
+ *            └─ RecordCekNotFoundError    — record missing or no per-record `_cek`
  * ```
  *
  * ## Catching all NOYDB errors
@@ -1260,6 +908,40 @@ declare class ScriptViolationError extends NoydbError {
     readonly sample: string;
     constructor(field: string, locale: string, expected: readonly string[], sample: string, message?: string);
 }
+/**
+ * Thrown when a mutation (`put`/`putAll`/`rename`/`delete`) is attempted
+ * against a dictionary name that is backed by a `staticDict()` descriptor.
+ *
+ * A static dict's labels are code constants with no per-vault storage and no
+ * mutation surface — a label change is a code deploy, not a runtime write.
+ * Distinct from the other dictionary errors so callers can tell a
+ * "this dict is read-only by construction" refusal from a missing-key or
+ * key-in-use failure. (#291)
+ */
+declare class StaticDictReadonlyError extends NoydbError {
+    /** The static dictionary name that was the target of the mutation. */
+    readonly dictionaryName: string;
+    constructor(dictionaryName: string);
+}
+/**
+ * Thrown at put-time when a record stores a code for a `staticDict()` field
+ * that is not in the descriptor's declared `keys` (a typo or a stale code).
+ *
+ * Codes are closed by construction, so an unknown code is treated as a bug by
+ * default. Opt out per descriptor with `{ validateCodes: false }`.
+ *
+ * Distinct from {@link LocaleNotSpecifiedError} (a read-hole) — this is a
+ * write-shape error. (#291)
+ */
+declare class UnknownDictCodeError extends NoydbError {
+    /** The static dictionary name. */
+    readonly dictionaryName: string;
+    /** The field that carried the unknown code. */
+    readonly field: string;
+    /** The offending code value. */
+    readonly code: string;
+    constructor(dictionaryName: string, field: string, code: string);
+}
 /**
  * Thrown when a collection has an `i18nText` field with
  * `autoTranslate: true` but no `plaintextTranslator` was configured
@@ -1669,380 +1351,69 @@ declare class VaultTemplateNotFoundError extends NoydbError {
     readonly templateName: string;
     constructor(templateName: string);
 }
-
 /**
- * The `money()` field descriptor — a branded schema-layer descriptor, a
- * sibling of `i18nText()` / `dictKey()`. It owns currency, scale, and
- * rounding policy for a field; the pure arithmetic lives in
- * {@link ./fixed-point} and default scale resolution in
- * {@link ./iso4217}.
- *
- * Two modes:
- *   - **fixed**  `money({ currency: 'EUR' })` — one currency for the
- *     field; the value stores a bare scaled-integer string.
- *   - **multi**  `money({ currencies: 'any' | [...] })` — currency travels
- *     per record; the value stores `{ amount, currency }`.
- *
- * `currency` and `currencies` are mutually exclusive.
+ * Thrown when `vault.forget(subjectId)` is called on a vault whose
+ * `createNoydb({ forgetStrategy })` declared no subject fields (the
+ * default `NO_FORGET`). GDPR crypto-shred needs a declared subject →
+ * record index to know which records belong to a data subject; without
+ * one there is nothing to erase and a silent no-op would be a dangerous
+ * false "erased" signal. Configure with
+ * `forgetStrategy: withForgetCascade({ subjects: { invoices: 'buyerId' } })`.
  */
-
-interface MoneyOptionsFixed {
-    currency: string;
-    /** Override the ISO-4217 default scale (required for unlisted codes). */
-    scale?: number;
-    rounding?: RoundingMode;
-}
-interface MoneyOptionsMulti {
-    currencies: 'any' | readonly string[];
-    /** Per-currency scale overrides (required for unlisted codes). */
-    scaleOverrides?: Record<string, number>;
-    rounding?: RoundingMode;
-}
-type MoneyOptions = MoneyOptionsFixed | MoneyOptionsMulti;
-interface MoneyDescriptor {
-    readonly _noydbMoney: true;
-    readonly mode: 'fixed' | 'multi';
-    readonly options: MoneyOptions;
-    readonly rounding: RoundingMode | undefined;
-    /** The currency for fixed mode; `undefined` in multi mode. */
-    readonly fixedCurrency: string | undefined;
-    /** Resolve the scale for a currency, throwing if not allowed / unknown. */
-    scaleFor(currency: string): number;
-    /** Whether this descriptor permits the given currency. */
-    allows(currency: string): boolean;
-    /**
-     * The single currency this descriptor implies, if any — fixed mode, or
-     * multi mode with exactly one allow-listed currency. Lets a multi field
-     * accept a bare amount unambiguously. `undefined` otherwise.
-     */
-    soleCurrency(): string | undefined;
-}
-/** Raised when a written value carries more precision than `scale` allows. */
-declare class MoneyPrecisionError extends NoydbError {
-    readonly field: string;
-    readonly value: unknown;
-    readonly scale: number;
-    constructor(field: string, value: unknown, scale: number);
-}
-/** Raised when a currency is disallowed or has no resolvable scale. */
-declare class MoneyCurrencyError extends NoydbError {
-    readonly currency: string;
-    readonly reason: 'not-allowed' | 'unknown-scale';
-    readonly field?: string | undefined;
-    constructor(currency: string, reason: 'not-allowed' | 'unknown-scale', field?: string | undefined);
-}
-/** Raised when an aggregate operation is not supported on a money field. */
-declare class MoneyUnsupportedError extends NoydbError {
-    readonly field: string;
-    constructor(field: string, message?: string);
+declare class ForgetStrategyNotConfiguredError extends NoydbError {
+    constructor(message?: string);
 }
-/** Create a {@link MoneyDescriptor}. */
-declare function money(options: MoneyOptions): MoneyDescriptor;
-/** Runtime predicate for detecting a {@link MoneyDescriptor}. */
-declare function isMoneyDescriptor(x: unknown): x is MoneyDescriptor;
-
 /**
- * Query DSL `.groupBy()` —.
- *
- * Chains after `.where()` / `.filter()` / `.or()` / `.and()` on a
- * Query and before a reducer spec, so consumers can compute
- * per-bucket aggregates without folding in userland:
- *
- * ```ts
- * const byClient = invoices.query()
- *   .where('status', '==', 'open')
- *   .groupBy('clientId')
- *   .aggregate({ total: sum('amount'), n: count() })
- *   .run()
- * // → [ { clientId: 'c1', total: 5250, n: 3 }, … ]
- * ```
- *
- * Execution pipeline:
- *
- *   1. Run the query's where/filter clauses (same candidate /
- *      filter pipeline as `.aggregate()` directly on Query).
- *   2. Partition the matching records into buckets keyed by
- *      `readPath(record, field)`. JS `Map` preserves insertion
- *      order, so the first-seen key for a bucket determines its
- *      position in the result array — consumers who want a
- *      specific ordering should `.sort()` downstream.
- *   3. Enforce cardinality: warn once per field at 10% of the cap
- *      (10_000 buckets), throw `GroupCardinalityError` at 100% of
- *      the cap (100_000 buckets).
- *   4. For each bucket, build a per-group reducer state and
- *      step every record in the bucket through it.
- *   5. Emit one result row per bucket, shaped as
- *      `{ [field]: key, ...reduced }`.
- *
- * **Null / undefined keys:** `Map` distinguishes `null` from
- * `undefined`, so records with a missing group field get their own
- * bucket, and records with an explicit `null` value get a separate
- * bucket from that. Consumers who want them merged can coalesce
- * upstream with `.filter()`.
- *
- * **Live mode:** `.groupBy().aggregate().live()` re-runs the full
- * grouping pipeline on every source change. Per-bucket incremental
- * delta maintenance is a future optimization — the reducer
- * protocol's `remove()` hook admits it, but ships naive
- * re-grouping for simplicity.
- *
- * **Type-level stable-key narrowing:** when
- * `dictKey` lands, `groupBy<DictField>()` will narrow the group key
- * type to the stable dictionary key rather than the resolved locale
- * label. That prevents grouping by the locale-resolved label,
- * which would produce different buckets per reader. types the
- * key as `unknown` at the result shape; the dictKey narrowing
- * layers on top without an API break.
- *
- * Partition-awareness seam: when partitioned collections land,
- * per-partition grouping will need to merge sub-results across
- * partitions. The reducer protocol's `{ seed }` parameter
- * (already plumbed through in `reducers.ts`) is the mechanism —
- * groupBy doesn't need its own seam for the moment, because it
- * delegates to the reducer protocol for all per-bucket state.
+ * Thrown by `openSealedRecord()` when the sealed CEK's binding has passed its
+ * `expiresAt`. Surfaced on two checks: a cheap fast-path check on the delivery
+ * envelope's clear-text `expiresAt`, and the AUTHORITATIVE check on the
+ * `expiresAt` inside the sealed binding (the latter cannot be forged by editing
+ * the delivery envelope). Distinct from {@link KeyringExpiredError} (bundle-slot
+ * expiry) so a host can tell "this single-record grant lapsed" from a keyring-
+ * level expiry.
  */
-
-/**
- * Cardinality thresholds for `.groupBy()`. The warn threshold gives
- * consumers a heads-up before the hard error; the cap is a fixed
- * constant in (not overridable). A `{ maxGroups }` override
- * can be added later without a break if a real consumer asks.
- */
-declare const GROUPBY_WARN_CARDINALITY = 10000;
-declare const GROUPBY_MAX_CARDINALITY = 100000;
-/**
- * Test-only: clear the per-field cardinality warning dedup between
- * tests. Production code never calls this — matching the
- * `resetJoinWarnings` pattern in `join.ts`.
- */
-declare function resetGroupByWarnings(): void;
-/**
- * Result row shape for a grouped aggregation. Each row carries the
- * group key value under the grouping field name plus every reducer
- * output from the spec.
- *
- * types the group key as `unknown` at the result shape — the
- * runtime read via `readPath` can return any value, and narrowing
- * to a specific type would require the caller to assert at the
- * call site. `dictKey` narrowing layers on top of this by
- * adding an overload that constrains `F` when the grouping field
- * is a `dictKey`.
- */
-type GroupedRow<F extends string, R> = {
-    [K in F]: unknown;
-} & R;
-/**
- * Multi-key variant — result-row shape for variadic
- * `.groupBy(...fields)`. Every grouped field name appears on the row
- * (typed as `unknown` for the same reason as `GroupedRow`), plus the
- * reducer outputs from the spec.
- */
-type GroupedRowN<F extends readonly string[], R> = {
-    [K in F[number]]: unknown;
-} & R;
-/**
- * Shared base class for the chainable grouped-query wrappers. Holds
- * the constructor + protected fields that both single-key
- * `GroupedQuery<T, F>` and variadic `GroupedQueryN<T, F>` need; each
- * subclass only overrides `aggregate()` with its own result-row
- * generic.
- *
- * Not exported — implementation detail. Adding `.having()` /
- * `.live()` / `.orderByGroup()` etc. in the future lands here once
- * and both subclasses pick it up automatically.
- *
- * @internal
- */
-declare abstract class GroupedQueryBase {
-    protected readonly executeRecords: () => readonly unknown[];
-    protected readonly upstreams: readonly AggregationUpstream[];
-    /**
-     * Optional dict label resolver attached by the query builder when
-     * the grouping field is a dictKey. Variadic groupings always pass
-     * `undefined` — `<field>Label` projection has no meaningful shape
-     * for composite keys.
-     */
-    protected readonly dictLabelResolver?: ((key: string, locale: string, fallback?: string | readonly string[]) => Promise<string | undefined>) | undefined;
-    /**
-     * Money field descriptors for the backing collection — used to
-     * rewrite `sum`/`min`/`max` over money fields into exact BigInt
-     * reducers when `.aggregate(spec)` is terminated.
-     */
-    protected readonly moneyFields?: Record<string, MoneyDescriptor> | undefined;
-    /**
-     * Field set this grouped query buckets on. Stored in declaration
-     * order — the same order is preserved on every result row by
-     * `groupAndReduce`. For the single-field constructor, this is
-     * `[field]`.
-     */
-    protected readonly fields: readonly string[];
-    constructor(executeRecords: () => readonly unknown[], fieldOrFields: string | readonly string[], upstreams: readonly AggregationUpstream[], 
-    /**
-     * Optional dict label resolver attached by the query builder when
-     * the grouping field is a dictKey. Variadic groupings always pass
-     * `undefined` — `<field>Label` projection has no meaningful shape
-     * for composite keys.
-     */
-    dictLabelResolver?: ((key: string, locale: string, fallback?: string | readonly string[]) => Promise<string | undefined>) | undefined, 
-    /**
-     * Money field descriptors for the backing collection — used to
-     * rewrite `sum`/`min`/`max` over money fields into exact BigInt
-     * reducers when `.aggregate(spec)` is terminated.
-     */
-    moneyFields?: Record<string, MoneyDescriptor> | undefined);
-    /** Apply money-aware reducer rewriting when money fields are declared. */
-    protected wrapSpec<Spec extends AggregateSpec>(spec: Spec): Spec;
-}
-/**
- * Chainable wrapper returned by `Query.groupBy(field)`. Terminates
- * with `.aggregate(spec)` which returns a `GroupedAggregation`.
- *
- * Kept minimal — the only operation on a grouped query is
- * aggregation. Ordering, limiting, and further filtering belong on
- * the underlying `Query` before `.groupBy()` is called; applying
- * them post-group would be a different operation (`having` /
- * `groupOrderBy`), out of scope for.
- */
-declare class GroupedQuery<T, F extends string> extends GroupedQueryBase {
-    /**
-     * Build a grouped aggregation. Returns a `GroupedAggregation`
-     * with `.run()`, `.runAsync()`, and `.live()` terminals — same shape
-     * as the non-grouped `.aggregate()` wrapper, just with an array
-     * result (one row per bucket) instead of a single reduced object.
-     */
-    aggregate<Spec extends AggregateSpec>(spec: Spec): GroupedAggregation<GroupedRow<F, AggregateResult<Spec>>>;
-}
-/**
- * Variadic-keyed sibling of `GroupedQuery<T, F>`. Constructed by the
- * multi-arg `Query.groupBy(...fields)` overload. The runtime shape is
- * identical — only the type-level result-row narrowing differs.
- */
-declare class GroupedQueryN<T, F extends readonly string[]> extends GroupedQueryBase {
-    aggregate<Spec extends AggregateSpec>(spec: Spec): GroupedAggregation<GroupedRowN<F, AggregateResult<Spec>>>;
-}
-/**
- * Execute the group-and-reduce pipeline. Pure function over a
- * record array and a spec — shared by `GroupedAggregation.run()`
- * and the live-mode refresh path. Exported for tests and for any
- * future `scan().groupBy().aggregate()` reuse.
- *
- * Enforces the cardinality cap incrementally during the partition
- * loop, so a runaway grouping throws at the moment the 100_001st
- * bucket would be created — the consumer doesn't have to wait for
- * the full partition to materialize before the error fires.
- */
-declare function groupAndReduce<R>(records: readonly unknown[], fieldOrFields: string | readonly string[], spec: AggregateSpec, moneyFields?: Record<string, MoneyDescriptor>): R[];
-/**
- * Grouped aggregation wrapper — the `.groupBy(field).aggregate(spec)`
- * terminal. Shape mirrors `Aggregation<R>` from aggregate.ts: two
- * terminals (`.run()` and `.live()`), spec bound at construction
- * time, upstreams collected for live mode.
- *
- * The generic `R` is the per-row result shape (i.e. a single
- * grouped row), and the terminals return `R[]` — one row per
- * bucket.
- */
-declare class GroupedAggregation<R> {
-    private readonly executeRecords;
-    private readonly spec;
-    private readonly upstreams;
-    /**
-     * Optional dict label resolver for `<field>Label` projection
-     *. Present when the grouping field is a dictKey.
-     */
-    private readonly dictLabelResolver?;
-    private readonly fields;
-    constructor(executeRecords: () => readonly unknown[], fields: string | readonly string[], spec: AggregateSpec, upstreams: readonly AggregationUpstream[], 
-    /**
-     * Optional dict label resolver for `<field>Label` projection
-     *. Present when the grouping field is a dictKey.
-     */
-    dictLabelResolver?: ((key: string, locale: string, fallback?: string | readonly string[]) => Promise<string | undefined>) | undefined);
-    /** Execute the query, group, reduce, and return an array of rows. */
-    run(): R[];
-    /**
-     * Execute the query, group, reduce, and resolve `<field>Label` for
-     * each result row when the grouping field is a `dictKey` and a
-     * `locale` is provided. Returns `R[]` synchronously when
-     * no locale is specified (identical to `.run()`).
-     *
-     * The `<field>Label` field is appended to each row. Rows whose group
-     * key has no dictionary entry get `<field>Label: undefined`.
-     *
-     * Dict-label resolution is single-field only — multi-key groupings
-     * do not produce a `<field>Label`. The resolver is only attached
-     * by the builder when `fields.length === 1`.
-     */
-    runAsync(opts?: {
-        locale?: string;
-        fallback?: string | readonly string[];
-    }): Promise<R[]>;
-    /**
-     * Build a reactive `LiveAggregation<R[]>` that re-runs the full
-     * group-and-reduce pipeline whenever any upstream source notifies
-     * of a change. Same error-isolation and idempotent-stop contract
-     * as `Aggregation.live()` — the implementation delegates to the
-     * same `LiveAggregationImpl` class by threading a fresh
-     * recompute closure through the existing constructor.
-     *
-     * uses naive full re-run on every change. Incremental
-     * per-bucket maintenance (apply `step` on inserted records,
-     * `remove` on deleted records, route by bucket key) is a future
-     * optimization — the reducer protocol admits it, but wiring
-     * delta-aware source subscriptions is a separate PR.
-     *
-     * Always call `live.stop()` when finished.
-     */
-    live(): LiveAggregation<R[]>;
+declare class SealedRecordExpiredError extends NoydbError {
+    readonly expiresAt: string;
+    constructor(expiresAt: string);
 }
-
 /**
- * Strategy seam between the core Query / ScanBuilder chain and the
- * optional aggregate / groupBy subsystem. Core imports
- * `AggregateStrategy` as a TYPE-ONLY symbol and `NO_AGGREGATE` as a
- * tiny runtime stub.
- *
- * The heavy machinery — `Aggregation`, `GroupedQuery`, the
- * reducer-step logic — is only reachable from `withAggregate()` in
- * `./active.ts`, which is only exported through the
- * `@noy-db/hub/aggregate` subpath. Consumers that don't import the
- * subpath ship none of the ~886 LOC.
- *
- * @internal
+ * Thrown by `openSealedRecord()` when the sealed binding's
+ * `{collection, id}` does not match the record envelope the host is trying to
+ * decrypt. This is the host-denial boundary: a CEK sealed for record A cannot
+ * be replayed against record B's envelope. (A CEK sealed for a PRE-rotation
+ * version of a record, applied to the POST-rotation live envelope, is a
+ * different failure — the binding still matches `{collection, id}` so it gets
+ * past this check, and the AES-GCM auth-tag failure surfaces as
+ * {@link TamperedError} instead.)
  */
-
+declare class SealedRecordMismatchError extends NoydbError {
+    readonly expected: {
+        collection: string;
+        id: string;
+    };
+    readonly actual: {
+        collection: string;
+        id: string;
+    };
+    constructor(expected: {
+        collection: string;
+        id: string;
+    }, actual: {
+        collection: string;
+        id: string;
+    });
+}
 /**
- * Seam interface. `@internal` — will promote to public only when the
- * aggregate subsystem is extracted into its own package.
- *
- * @internal
- */
-interface AggregateStrategy {
-    /**
-     * Build an `Aggregation<R>` for `Query.aggregate(spec)`. `executeRecords`
-     * is a closure that produces the matching record set when the
-     * aggregation runs. NO_AGGREGATE throws; the active strategy
-     * constructs a real `Aggregation`.
-     */
-    aggregate<Spec extends AggregateSpec>(executeRecords: () => readonly unknown[], spec: Spec, upstreams: readonly AggregationUpstream[]): Aggregation<AggregateResult<Spec>>;
-    /**
-     * Build a `GroupedQuery<T, F>` for `Query.groupBy(field)`. Same
-     * closure / upstream inputs as `aggregate` plus the group key field.
-     */
-    groupBy<T, F extends string>(executeRecords: () => readonly unknown[], field: F, upstreams: readonly AggregationUpstream[], dictLabelResolver?: (key: string, locale: string, fallback?: string | readonly string[]) => Promise<string | undefined>, moneyFields?: Record<string, MoneyDescriptor>): GroupedQuery<T, F>;
-    /**
-     * Variadic-keyed sibling — builds a `GroupedQueryN<T, F>` for
-     * `Query.groupBy(...fields)`. No dictLabelResolver — `<field>Label`
-     * projection only applies to single-field groupings, which dispatch
-     * through `groupBy` above.
-     */
-    groupByN<T, F extends readonly string[]>(executeRecords: () => readonly unknown[], fields: F, upstreams: readonly AggregationUpstream[], moneyFields?: Record<string, MoneyDescriptor>): GroupedQueryN<T, F>;
-    /**
-     * Terminal streaming aggregator for `ScanBuilder.aggregate(spec)`.
-     * Takes an async iterable of decrypted records + the spec and
-     * returns the reduced result.
-     */
-    scanAggregate<Spec extends AggregateSpec>(iter: AsyncIterable<unknown>, spec: Spec): Promise<AggregateResult<Spec>>;
+ * Thrown by `vault.sealRecordToHost()` / `vault.rotateRecordCek()` when the
+ * target record has no live envelope, or its live envelope carries no `_cek`
+ * (a legacy / non-`perRecordKeys` collection has nothing record-scoped to
+ * seal — its body is keyed off the shared collection DEK, which sealing
+ * deliberately never exposes).
+ */
+declare class RecordCekNotFoundError extends NoydbError {
+    readonly collection: string;
+    readonly id: string;
+    constructor(collection: string, id: string);
 }
 
-export { BundleSealMismatchError as $, type AggregateStrategy as A, AmendmentForbiddenError as B, RecordLockedError as C, DictKeyInUseError as D, SnapshotNotFoundError as E, FieldFrozenError as F, GROUPBY_MAX_CARDINALITY as G, DerivationCapExceededError as H, InvariantError as I, DerivationCycleError as J, DerivationDepthError as K, LocaleNotSpecifiedError as L, MissingTranslationError as M, DerivationOutputShapeError as N, DerivationOutputUnknownError as O, OverlayBaseIsVirtualError as P, OverlayCollectionUnavailableError as Q, ReservedCollectionNameError as R, ScriptViolationError as S, TranslatorNotConfiguredError as T, OverlayIdMismatchError as U, OverlayNameCollisionError as V, AttestationError as W, AdoptionStateError as X, BackupCorruptedError as Y, BackupLedgerError as Z, BundleIntegrityError as _, DictKeyMissingError as a, UnknownShardError as a$, BundleVersionConflictError as a0, PartitionExtractionError as a1, TransferSealError as a2, MaterializedViewConfigError as a3, MaterializedViewCycleError as a4, MaterializedViewSourceUnknownError as a5, MaterializedViewTooLargeError as a6, NoydbError as a7, type RoundingMode as a8, AlreadyElevatedError as a9, MoneyUnsupportedError as aA, NetworkError as aB, NoAccessError as aC, NonAdditiveSchemaChangeError as aD, NotFoundError as aE, NumberingUncertaintyError as aF, PathEscapeError as aG, PeriodClosedError as aH, PermissionDeniedError as aI, PrivilegeEscalationError as aJ, QuiesceTimeoutError as aK, ReadOnlyAtInstantError as aL, ReadOnlyError as aM, ReadOnlyFrameError as aN, ReservedVaultNameError as aO, SchemaFenceError as aP, SchemaLockedError as aQ, SchemaUpdateError as aR, SchemaValidationError as aS, SequenceContentionError as aT, SequenceOfflineError as aU, ShardProvisioningError as aV, StoreCapabilityError as aW, TamperedError as aX, TierDemoteDeniedError as aY, TierNotGrantedError as aZ, UniqueConstraintError as a_, ConflictError as aa, CrossJoinSourceUnknownError as ab, CrossJoinTooLargeError as ac, DanglingReferenceError as ad, DecryptionError as ae, DelegationTargetMissingError as af, DirectoryDisabledError as ag, ElevationExpiredError as ah, ExportCapabilityError as ai, FilenameSanitizationError as aj, GroupCardinalityError as ak, ImportCapabilityError as al, IndexRequiredError as am, IndexWriteFailureError as an, InvalidKeyError as ao, JoinTooLargeError as ap, KeyringCorruptError as aq, KeyringExpiredError as ar, LedgerContentionError as as, MigrationRequiredError as at, MoneyCurrencyError as au, type MoneyDescriptor as av, type MoneyOptions as aw, type MoneyOptionsFixed as ax, type MoneyOptionsMulti as ay, MoneyPrecisionError as az, SessionExpiredError as b, UnsupportedIndexOptionError as b0, ValidationError as b1, VaultTemplateNotFoundError as b2, isMoneyDescriptor as b3, money as b4, SessionNotFoundError as c, SessionPolicyError as d, type AggregateResult as e, type AggregateSpec as f, Aggregation as g, type AggregationUpstream as h, GROUPBY_WARN_CARDINALITY as i, GroupedAggregation as j, GroupedQuery as k, GroupedQueryN as l, type GroupedRow as m, type GroupedRowN as n, type LiveAggregation as o, type Reducer as p, type ReducerOptions as q, avg as r, buildLiveAggregation as s, count as t, groupAndReduce as u, max as v, min as w, reduceRecords as x, resetGroupByWarnings as y, sum as z };
+export { ForgetStrategyNotConfiguredError as $, AmendmentForbiddenError as A, BackupCorruptedError as B, MaterializedViewSourceUnknownError as C, DictKeyInUseError as D, MaterializedViewTooLargeError as E, FieldFrozenError as F, AlreadyElevatedError as G, ConflictError as H, InvariantError as I, CrossJoinSourceUnknownError as J, CrossJoinTooLargeError as K, LocaleNotSpecifiedError as L, MissingTranslationError as M, NoydbError as N, OverlayBaseIsVirtualError as O, PartitionExtractionError as P, DanglingReferenceError as Q, ReservedCollectionNameError as R, ScriptViolationError as S, TranslatorNotConfiguredError as T, UnknownDictCodeError as U, DecryptionError as V, DelegationTargetMissingError as W, DirectoryDisabledError as X, ElevationExpiredError as Y, ExportCapabilityError as Z, FilenameSanitizationError as _, DictKeyMissingError as a, GroupCardinalityError as a0, ImportCapabilityError as a1, IndexRequiredError as a2, IndexWriteFailureError as a3, InvalidKeyError as a4, JoinTooLargeError as a5, KeyringCorruptError as a6, KeyringExpiredError as a7, LedgerContentionError as a8, MigrationRequiredError as a9, UniqueConstraintError as aA, UnknownShardError as aB, UnsupportedIndexOptionError as aC, ValidationError as aD, VaultTemplateNotFoundError as aE, NetworkError as aa, NoAccessError as ab, NonAdditiveSchemaChangeError as ac, NotFoundError as ad, NumberingUncertaintyError as ae, PathEscapeError as af, PeriodClosedError as ag, PermissionDeniedError as ah, PrivilegeEscalationError as ai, QuiesceTimeoutError as aj, ReadOnlyAtInstantError as ak, ReadOnlyError as al, ReadOnlyFrameError as am, RecordCekNotFoundError as an, ReservedVaultNameError as ao, SchemaFenceError as ap, SchemaLockedError as aq, SchemaUpdateError as ar, SchemaValidationError as as, SequenceContentionError as at, SequenceOfflineError as au, ShardProvisioningError as av, StoreCapabilityError as aw, TamperedError as ax, TierDemoteDeniedError as ay, TierNotGrantedError as az, StaticDictReadonlyError as b, SessionExpiredError as c, SessionNotFoundError as d, SessionPolicyError as e, RecordLockedError as f, SnapshotNotFoundError as g, DerivationCapExceededError as h, DerivationCycleError as i, DerivationDepthError as j, DerivationOutputShapeError as k, DerivationOutputUnknownError as l, OverlayCollectionUnavailableError as m, OverlayIdMismatchError as n, OverlayNameCollisionError as o, SealedRecordExpiredError as p, SealedRecordMismatchError as q, AttestationError as r, AdoptionStateError as s, BackupLedgerError as t, BundleIntegrityError as u, BundleSealMismatchError as v, BundleVersionConflictError as w, TransferSealError as x, MaterializedViewConfigError as y, MaterializedViewCycleError as z };