@noy-db/hub 0.2.0-pre.3 → 0.2.0-pre.31

package/dist/{index-BF1B2HB9.d.ts → index-Ddm8D3Oo.d.ts}

@@ -1,1142 +1,6 @@
-import { C as CollectionIndexes, a as Clause, O as Operator } from './predicate-Dnu81tsS.js';
-import { A as AggregateStrategy, b as AggregateSpec, c as Aggregation, a as AggregateResult, g as GroupedQuery, h as GroupedQueryN } from './strategy-DSTrsZ8t.js';
-
-/**
- * All NOYDB error classes — a single import surface for `catch` blocks and
- * `instanceof` checks.
- *
- * ## Class hierarchy
- *
- * ```
- * Error
- *  └─ NoydbError (code: string)
- *       ├─ Crypto errors
- *       │    ├─ DecryptionError        — AES-GCM tag failure
- *       │    ├─ TamperedError          — ciphertext modified after write
- *       │    └─ InvalidKeyError        — wrong passphrase / corrupt keyring
- *       ├─ Access errors
- *       │    ├─ NoAccessError          — no DEK for this collection
- *       │    ├─ ReadOnlyError          — ro permission, write attempted
- *       │    ├─ PermissionDeniedError  — role too low for operation
- *       │    ├─ PrivilegeEscalationError — grant wider than grantor holds
- *       │    └─ StoreCapabilityError   — optional store method missing
- *       ├─ Sync errors
- *       │    ├─ ConflictError          — optimistic-lock version mismatch
- *       │    ├─ BundleVersionConflictError — bundle push rejected by remote
- *       │    └─ NetworkError           — push/pull network failure
- *       ├─ Data errors
- *       │    ├─ NotFoundError          — get(id) on missing record
- *       │    ├─ ValidationError        — application-level guard failed
- *       │    └─ SchemaValidationError  — Standard Schema v1 rejection
- *       ├─ Query errors
- *       │    ├─ JoinTooLargeError      — join row ceiling exceeded
- *       │    ├─ DanglingReferenceError — strict ref() points at nothing
- *       │    ├─ GroupCardinalityError  — groupBy bucket cap exceeded
- *       │    ├─ IndexRequiredError      — lazy-mode query touches unindexed field
- *       │    └─ IndexWriteFailureError       — index side-car put/delete failed post-main
- *       ├─ i18n / Dictionary errors
- *       │    ├─ ReservedCollectionNameError
- *       │    ├─ DictKeyMissingError
- *       │    ├─ DictKeyInUseError
- *       │    ├─ MissingTranslationError
- *       │    ├─ LocaleNotSpecifiedError
- *       │    └─ TranslatorNotConfiguredError
- *       ├─ Backup errors
- *       │    ├─ BackupLedgerError      — hash-chain verification failed
- *       │    └─ BackupCorruptedError   — envelope hash mismatch in dump
- *       ├─ Bundle errors
- *       │    └─ BundleIntegrityError   — .noydb body sha256 mismatch
- *       └─ Session errors
- *            ├─ SessionExpiredError
- *            ├─ SessionNotFoundError
- *            └─ SessionPolicyError
- * ```
- *
- * ## Catching all NOYDB errors
- *
- * ```ts
- * import { NoydbError, InvalidKeyError, ConflictError } from '@noy-db/hub'
- *
- * try {
- *   await vault.unlock(passphrase)
- * } catch (e) {
- *   if (e instanceof InvalidKeyError) { showBadPassphraseUI(); return }
- *   if (e instanceof NoydbError) { logToSentry(e.code, e); return }
- *   throw e  // unexpected — re-throw
- * }
- * ```
- *
- * @module
- */
-/**
- * Base class for all NOYDB errors.
- *
- * Every error thrown by `@noy-db/hub` extends this class, so consumers can
- * catch all NOYDB errors in a single `catch (e) { if (e instanceof NoydbError) ... }`
- * block. The `code` field is a machine-readable string (e.g. `'DECRYPTION_FAILED'`)
- * suitable for `switch` statements and logging pipelines.
- */
-declare class NoydbError extends Error {
-    /** Machine-readable error code. Stable across library versions. */
-    readonly code: string;
-    constructor(code: string, message: string);
-}
-/**
- * Thrown when AES-GCM decryption fails.
- *
- * The most common cause is a wrong passphrase or a corrupted ciphertext.
- * A `DecryptionError` at the wrong passphrase level is caught internally
- * and re-thrown as `InvalidKeyError` — so in practice this surfaces for
- * per-record corruption rather than authentication failures.
- */
-declare class DecryptionError extends NoydbError {
-    constructor(message?: string);
-}
-/**
- * Thrown when GCM tag verification fails, indicating the ciphertext was
- * modified after encryption.
- *
- * AES-256-GCM is authenticated encryption — the tag over the ciphertext
- * is checked on every decrypt. If any byte was flipped (accidental
- * corruption or deliberate tampering), decryption throws this error.
- * Treat it as a security alert: the stored bytes are not what NOYDB wrote.
- */
-declare class TamperedError extends NoydbError {
-    constructor(message?: string);
-}
-/**
- * Thrown when key unwrapping fails, typically because the passphrase is wrong
- * or the keyring file is corrupted.
- *
- * NOYDB uses AES-KW (RFC 3394) to wrap DEKs with the KEK. If AES-KW
- * unwrapping fails, it means either the KEK was derived from the wrong
- * passphrase (PBKDF2 with 600K iterations) or the keyring bytes are
- * corrupted. This is the error shown to the user on a failed unlock attempt.
- */
-declare class InvalidKeyError extends NoydbError {
-    constructor(message?: string);
-}
-/**
- * Thrown when a keyring's wrapped-DEK set unwraps partially — at least
- * one DEK succeeds (proving the KEK is correct) but at least one fails.
- * The passphrase is right; the failed entries are corrupted.
- *
- * This is distinct from {@link InvalidKeyError} so that
- * `NoydbOptions.onInvalidKey: 'reset'` does NOT fire — resetting on
- * partial corruption would destroy the still-valid DEKs and the data
- * they protect, which is silent data loss in response to a feature
- * designed for stale-credential recovery.
- */
-declare class KeyringCorruptError extends NoydbError {
-    readonly failedCollections: readonly string[];
-    readonly intactCount: number;
-    constructor(opts: {
-        failedCollections: readonly string[];
-        intactCount: number;
-        message?: string;
-    });
-}
-/**
- * Thrown when the authenticated user does not have a DEK for the requested
- * collection — i.e. the collection is not in their keyring at all.
- *
- * This is the "no key for this door" error. It is different from
- * `ReadOnlyError` (user has a key but it only grants ro) and from
- * `PermissionDeniedError` (user's role doesn't allow the operation).
- */
-declare class NoAccessError extends NoydbError {
-    constructor(message?: string);
-}
-/**
- * Thrown when a user with read-only (`ro`) permission attempts a write
- * operation (`put` or `delete`) on a collection.
- *
- * The user has a DEK for the collection (they can decrypt and read), but
- * their keyring grants only `ro`. To fix: re-grant the user with `rw`
- * permission, or do not attempt writes as a viewer/client role.
- */
-declare class ReadOnlyError extends NoydbError {
-    constructor(message?: string);
-}
-/**
- * Thrown when a write is attempted against a historical view produced
- * by `vault.at(timestamp)`. Time-machine views are read-only by
- * contract — mutating the past would require either the shadow-vault
- * mechanism or a ledger-history rewrite (which breaks
- * the tamper-evidence guarantee).
- *
- * Distinct from {@link ReadOnlyError} (keyring-level) and
- * {@link PermissionDeniedError} (role-level): this error is about the
- * *view* being historical, independent of the caller's permissions.
- */
-declare class ReadOnlyAtInstantError extends NoydbError {
-    constructor(operation: string, timestamp: string);
-}
-/**
- * Thrown when a write is attempted against a shadow-vault frame
- * produced by `vault.frame()`. Frames are read-only by contract —
- * the use case is screen-sharing / demos / compliance review where
- * the operator wants to prevent accidental edits.
- *
- * Behavioural enforcement only — the underlying keyring still holds
- * write-capable DEKs. See {@link VaultFrame} for the full caveat.
- */
-declare class ReadOnlyFrameError extends NoydbError {
-    constructor(operation: string);
-}
-/**
- * Thrown when the authenticated user's role does not permit the requested
- * operation — e.g. a `viewer` calling `grantAccess()`, or an `operator`
- * calling `rotateKeys()`.
- *
- * This is a role-level check (what the user's role allows), distinct from
- * `NoAccessError` (collection not in keyring) and `ReadOnlyError` (in
- * keyring, but write not allowed).
- */
-declare class PermissionDeniedError extends NoydbError {
-    constructor(message?: string);
-}
-/**
- * Thrown when an `@noy-db/as-*` export is attempted without the
- * required capability bit on the invoking keyring.
- *
- * Two sub-cases discriminated by the `tier` field:
- *
- * - `tier: 'plaintext'` — a plaintext-tier export (`as-xlsx`,
- *   `as-csv`, `as-blob`, `as-zip`, …) was attempted but the
- *   keyring's `exportCapability.plaintext` does not include the
- *   requested `format` (nor the `'*'` wildcard). Default for every
- *   role is `plaintext: []` — the owner must positively grant.
- * - `tier: 'bundle'` — an encrypted `as-noydb` bundle export was
- *   attempted but the keyring's `exportCapability.bundle` is
- *   `false`. Default for `owner`/`admin` is `true`; for
- *   `operator`/`viewer`/`client` it is `false`.
- *
- * Distinct from `PermissionDeniedError` (role-level check) and
- * `NoAccessError` (collection not readable). Surfaces separately so
- * UI layers can show a "request the export capability from your
- * admin" flow rather than a generic permission error.
- */
-declare class ExportCapabilityError extends NoydbError {
-    readonly tier: 'plaintext' | 'bundle';
-    readonly format?: string;
-    readonly userId: string;
-    constructor(opts: {
-        tier: 'plaintext' | 'bundle';
-        userId: string;
-        format?: string;
-        message?: string;
-    });
-}
-/**
- * Thrown when a keyring file's `expires_at` cutoff has passed.
- * Surfaced by `loadKeyring` before any DEK unwrap is attempted —
- * past the cutoff the slot refuses to open even with the right
- * passphrase. Distinct from PBKDF2 / unwrap errors so consumer code
- * can show a precise "this bundle slot has expired" message instead
- * of the generic decryption-failure UX.
- *
- * Used predominantly on `BundleRecipient` slots produced by
- * `writeNoydbBundle({ recipients: [...] })` to time-box audit access.
- */
-declare class KeyringExpiredError extends NoydbError {
-    readonly userId: string;
-    readonly expiresAt: string;
-    constructor(opts: {
-        userId: string;
-        expiresAt: string;
-    });
-}
-/**
- * Thrown when an `@noy-db/as-*` import is attempted but the invoking
- * keyring lacks the required import-capability bit.
- *
- * - `tier: 'plaintext'` — a plaintext-tier import (`as-csv`, `as-json`,
- *   `as-ndjson`, `as-zip`, …) was attempted but the keyring's
- *   `importCapability.plaintext` does not include the requested
- *   `format` (nor the `'*'` wildcard).
- * - `tier: 'bundle'` — a `.noydb` bundle import was attempted but the
- *   keyring's `importCapability.bundle` is not `true`.
- *
- * Default for every role on every dimension is closed — owners and
- * admins must positively grant the capability. Distinct from
- * `PermissionDeniedError` and `NoAccessError` so UI layers can show a
- * specific "request the import capability" flow.
- */
-declare class ImportCapabilityError extends NoydbError {
-    readonly tier: 'plaintext' | 'bundle';
-    readonly format?: string;
-    readonly userId: string;
-    constructor(opts: {
-        tier: 'plaintext' | 'bundle';
-        userId: string;
-        format?: string;
-        message?: string;
-    });
-}
-/**
- * Thrown when a grant would give the grantee a permission the grantor
- * does not themselves hold — the "admin cannot grant what admin cannot
- * do" rule from the admin-delegation work.
- *
- * Distinct from `PermissionDeniedError` so callers can tell the two
- * cases apart in logs and tests:
- *
- *   - `PermissionDeniedError` — "you are not allowed to perform this
- *     operation at all" (wrong role).
- *   - `PrivilegeEscalationError` — "you are allowed to grant, but not
- *     with these specific permissions" (widening attempt).
- *
- * Under the admin model the grantee of an admin-grants-admin call
- * inherits the caller's entire DEK set by construction, so this error
- * is structurally unreachable in typical flows. The check and error
- * class exist so that future per-collection admin scoping cannot
- * accidentally bypass the subset rule — the guard is already wired in.
- *
- * `offendingCollection` carries the first collection name that failed
- * the subset check, to make the violation actionable in error output.
- */
-/**
- * Thrown when a caller invokes an API that requires an optional
- * store capability the active store does not implement.
- *
- * Today the only call site is `Noydb.listAccessibleVaults()`,
- * which depends on the optional `NoydbStore.listVaults()`
- * method. The error message names the missing method and the calling
- * API so consumers know exactly which combination is unsupported,
- * and the `capability` field is machine-readable so library code can
- * pattern-match in catch blocks (e.g. fall back to a candidate-list
- * shape).
- *
- * The class lives in `errors.ts` rather than as a generic
- * `ValidationError` because the diagnostic shape is different: a
- * `ValidationError` says "the inputs you passed are wrong"; this
- * error says "the inputs are fine, but the store you wired up
- * doesn't support what you're asking for." Different fix, different
- * documentation.
- */
-declare class StoreCapabilityError extends NoydbError {
-    /** The store method/capability that was missing. */
-    readonly capability: string;
-    constructor(capability: string, callerApi: string, storeName?: string);
-}
-declare class PrivilegeEscalationError extends NoydbError {
-    readonly offendingCollection: string;
-    constructor(offendingCollection: string, message?: string);
-}
-/**
- * Thrown by `Collection.put` / `.delete` when the target record's
- * envelope `_ts` falls within a closed accounting period.
- *
- * Distinct from `ReadOnlyError` (keyring-level), `ReadOnlyAtInstantError`
- * (historical view), and `ReadOnlyFrameError` (shadow vault): this
- * error is about the STORED RECORD being sealed by an operator call
- * to `vault.closePeriod()`, independent of caller permissions or
- * view type. The `periodName` and `endDate` fields name the sealing
- * period so audit UIs can surface a "this record is locked in
- * FY2026-Q1 (closed 2026-03-31)" message without parsing the error
- * string.
- *
- * To apply a correction after close, book a compensating entry in a
- * new period rather than unlocking the old one. Re-opening a closed
- * period is deliberately unsupported.
- */
-declare class PeriodClosedError extends NoydbError {
-    readonly periodName: string;
-    readonly endDate: string;
-    readonly recordTs: string;
-    constructor(periodName: string, endDate: string, recordTs: string);
-}
-/**
- * Thrown when a `put()` or `delete()` is rejected by a guard's `check`
- * function. The `reason` is the message the guard supplied — typically a
- * short business description (e.g. "invoice is issued"). The full
- * collection + id are surfaced so audit UIs can link back to the record.
- */
-declare class RecordLockedError extends NoydbError {
-    readonly collection: string;
-    readonly id: string;
-    readonly reason: string;
-    constructor(collection: string, id: string, reason: string);
-}
-/**
- * Thrown when a `put()` changes one or more fields that are frozen by a
- * `frozenFields` guard. The `fields` list contains the specific paths
- * that were detected as changed.
- */
-declare class FieldFrozenError extends NoydbError {
-    readonly collection: string;
-    readonly id: string;
-    readonly fields: readonly string[];
-    constructor(collection: string, id: string, fields: readonly string[]);
-}
-/**
- * Thrown by an amendment invariant when the proposed change-set violates
- * the declared business rule (e.g. disbursement total not preserved).
- * Triggers a full transaction rollback via the existing revert pass.
- */
-declare class InvariantError extends NoydbError {
-    constructor(message: string);
-}
-/**
- * Thrown at `withTransactions({ amendment: true })` open if the caller's
- * role is not in the guard's allowed amendment roles. Fail-fast: thrown
- * before any writes are attempted.
- */
-declare class AmendmentForbiddenError extends NoydbError {
-    readonly userId: string;
-    readonly role: string;
-    constructor(userId: string, role: string);
-}
-/**
- * Thrown by `listUsersWithEnvelopes` when the vault's user directory
- * has been disabled (via `db.setDirectoryEnabled(vault, false)`) and
- * the caller's role is neither `owner` nor `admin`. Owner/admin can
- * still enumerate users — the toggle is a UX privacy switch, not a
- * security boundary.
- *
- * Honest caveat: this is a UX flag, not a privacy guarantee. The
- * envelope ciphertext is still in the store, the keyring file is
- * still listed at `_keyring/*`, and anyone with direct store read
- * access can count keyrings without going through the hub. See
- * `docs/subsystems/user-envelope.md` → "Directory visibility".
- */
-declare class DirectoryDisabledError extends NoydbError {
-    readonly vault: string;
-    constructor(vault: string);
-}
-/**
- * Thrown when a user tries to act at a tier they are not cleared for.
- *
- * This is the umbrella error for tier write refusals:
- *   - `put({ tier: N })` when the user's keyring lacks tier-N DEK.
- *   - `elevate(id, N)` when the caller cannot reach tier N.
- *
- * Distinct from `TierAccessDeniedError` which covers *read* refusals on
- * the invisibility/ghost path.
- */
-declare class TierNotGrantedError extends NoydbError {
-    readonly tier: number;
-    readonly collection: string;
-    constructor(collection: string, tier: number);
-}
-/**
- * Thrown when an elevated-handle operation runs after the elevation's
- * TTL expired. Reads continue at the original tier; only writes
- * through the scoped handle flip to throwing once expired.
- */
-declare class ElevationExpiredError extends NoydbError {
-    readonly tier: number;
-    readonly expiresAt: number;
-    constructor(opts: {
-        tier: number;
-        expiresAt: number;
-    });
-}
-/**
- * Thrown by `vault.elevate(...)` when an elevation is already active
- * on the vault. Adopters must `release()` the existing handle before
- * starting a new elevation.
- */
-declare class AlreadyElevatedError extends NoydbError {
-    readonly activeTier: number;
-    constructor(activeTier: number);
-}
-/**
- * Thrown when `demote()` is called by someone who is not the original
- * elevator and not an owner.
- */
-declare class TierDemoteDeniedError extends NoydbError {
-    constructor(id: string, tier: number);
-}
-/**
- * Thrown when `db.delegate()` is called against a user that has no
- * keyring in the target vault — the delegation token cannot be
- * constructed without the target user's KEK wrap.
- */
-declare class DelegationTargetMissingError extends NoydbError {
-    readonly toUser: string;
-    constructor(toUser: string);
-}
-/**
- * Thrown when a `put()` detects an optimistic concurrency conflict.
- *
- * NOYDB uses version numbers (`_v`) for optimistic locking. If a `put()`
- * is called with `expectedVersion: N` but the stored record is at version
- * `M ≠ N`, the write is rejected and the caller must re-read, re-apply their
- * change, and retry. The `version` field carries the actual stored version
- * so callers can decide whether to retry or surface the conflict to the user.
- */
-declare class ConflictError extends NoydbError {
-    /** The actual stored version at the time of conflict. */
-    readonly version: number;
-    constructor(version: number, message?: string);
-}
-/**
- * Thrown by `LedgerStore.append()` after exhausting its CAS retry
- * budget under multi-writer contention. Two browser tabs, a
- * web app + an offline mobile peer, or a server worker pool all
- * producing ledger entries against the same vault can race on the
- * "read head, write head+1" cycle; the optimistic-CAS retry loop
- * resolves the race for `casAtomic: true` stores, but pathological
- * contention (or a buggy peer) can still exhaust the budget. When
- * that happens, the chain is intact — the failed writer simply
- * couldn't claim a slot. Caller's choice whether to retry, queue,
- * or surface the failure to the user.
- */
-declare class LedgerContentionError extends NoydbError {
-    readonly attempts: number;
-    constructor(attempts: number);
-}
-/**
- * Thrown when a bundle push is rejected because the remote has been updated
- * since the local bundle was last pulled.
- *
- * Unlike `ConflictError` (per-record), this is a whole-bundle conflict —
- * the remote's bundle handle has changed. The caller must pull the new
- * bundle, merge, and re-push. `remoteVersion` is the handle of the newer
- * remote bundle for use in diagnostics.
- */
-declare class BundleVersionConflictError extends NoydbError {
-    /** The bundle handle of the newer remote version that rejected the push. */
-    readonly remoteVersion: string;
-    constructor(remoteVersion: string, message?: string);
-}
-/**
- * Thrown when a sync operation (push or pull) fails due to a network error.
- *
- * NOYDB's offline-first design means network errors are expected during sync.
- * Callers should catch `NetworkError`, surface connectivity status in the UI,
- * and rely on the `SyncScheduler` to retry when connectivity is restored.
- */
-declare class NetworkError extends NoydbError {
-    constructor(message?: string);
-}
-/**
- * Thrown when `collection.get(id)` is called with an ID that does not exist.
- *
- * NOYDB collections are memory-first, so this error is synchronous and cheap —
- * it does not make a network round-trip. Callers that expect the record to be
- * absent should use `collection.getOrNull(id)` instead.
- */
-declare class NotFoundError extends NoydbError {
-    constructor(message?: string);
-}
-/**
- * Thrown when application-level validation fails before encryption.
- *
- * Distinct from `SchemaValidationError` (Standard Schema v1 validator)
- * and `MissingTranslationError` (i18nText). `ValidationError` is the
- * general-purpose validation base — use it for custom guards in `put()`
- * hooks or store middleware.
- */
-declare class ValidationError extends NoydbError {
-    constructor(message?: string);
-}
-/**
- * Thrown when a Standard Schema v1 validator rejects a record on
- * `put()` (input validation) or on read (output validation). Carries
- * the raw issue list so callers can render field-level errors.
- *
- * `direction` distinguishes the two cases:
- *   - `'input'`: the user passed bad data into `put()`. This is a
- *     normal error case that application code should handle — typically
- *     by showing validation messages in the UI.
- *   - `'output'`: stored data does not match the current schema. This
- *     indicates a schema drift (the schema was changed without
- *     migrating the existing records) and should be treated as a bug
- *     — the application should not swallow it silently.
- *
- * The `issues` type is deliberately `readonly unknown[]` on this class
- * so that `errors.ts` doesn't need to import from `schema.ts` (and
- * create a dependency cycle). Callers who know they're holding a
- * `SchemaValidationError` can cast to the more precise
- * `readonly StandardSchemaV1Issue[]` from `schema.ts`.
- */
-declare class SchemaValidationError extends NoydbError {
-    readonly issues: readonly unknown[];
-    readonly direction: 'input' | 'output';
-    constructor(message: string, issues: readonly unknown[], direction: 'input' | 'output');
-}
-/** Base for schema-evolution strategy rejections (#245). */
-declare class SchemaUpdateError extends NoydbError {
-    constructor(code: string, message: string);
-}
-/** A non-additive schema change was rejected by the `additiveOnly()` strategy. */
-declare class NonAdditiveSchemaChangeError extends SchemaUpdateError {
-    constructor(message: string);
-}
-/** A schema change was rejected by the `lockSchema()` strategy. */
-declare class SchemaLockedError extends SchemaUpdateError {
-    constructor(message: string);
-}
-/** Write attempted while a schema cutover fence is up (draining/migrating, or this collection has a pending cutover). */
-declare class SchemaFenceError extends SchemaUpdateError {
-    constructor(message: string);
-}
-/** Write attempted by a client whose generation snapshot is behind the live fence — reload required. */
-declare class MigrationRequiredError extends SchemaUpdateError {
-    constructor(message: string);
-}
-/** A coordinated cutover timed out waiting for active clients to quiesce. */
-declare class QuiesceTimeoutError extends SchemaUpdateError {
-    constructor(message: string);
-}
-/**
- * Thrown when `.groupBy().aggregate()` produces more than the hard
- * cardinality cap (default 100_000 groups)..
- *
- * The cap exists because `.groupBy()` materializes one bucket per
- * distinct key value in memory, and runaway cardinality — a groupBy
- * on a high-uniqueness field like `id` or `createdAt` — is almost
- * always a query mistake rather than legitimate use. A hard error is
- * better than silent OOM: the consumer sees an actionable message
- * naming the field and the observed cardinality, with guidance to
- * either narrow the query with `.where()` or accept the ceiling
- * override.
- *
- * A separate one-shot warning fires at 10% of the cap (10_000
- * groups) so consumers get a heads-up before the hard error — same
- * pattern as `JoinTooLargeError` and the `.join()` row ceiling.
- *
- * **Not overridable in.** The 100k cap is a fixed constant so
- * the failure mode is consistent across the codebase; a
- * `{ maxGroups }` override can be added later without a break if a
- * real consumer asks.
- */
-declare class GroupCardinalityError extends NoydbError {
-    /** The field being grouped on. */
-    readonly field: string;
-    /** Observed number of distinct groups at the moment the cap tripped. */
-    readonly cardinality: number;
-    /** The cap that was exceeded. */
-    readonly maxGroups: number;
-    constructor(field: string, cardinality: number, maxGroups: number);
-}
-/**
- * Thrown in lazy mode when a `.query()` / `.where()` / `.orderBy()` clause
- * references a field that does not have a declared index.
- *
- * Lazy-mode queries only work when every touched field is indexed.
- * This is deliberate — silent scan-fallback would hide the performance
- * cliff that lazy-mode indexes exist to prevent.
- *
- * Payload:
- * - `collection` — name of the collection queried
- * - `touchedFields` — every field referenced by the query (filter + order)
- * - `missingFields` — subset of `touchedFields` that have no declared index
- */
-declare class IndexRequiredError extends NoydbError {
-    readonly collection: string;
-    readonly touchedFields: readonly string[];
-    readonly missingFields: readonly string[];
-    constructor(args: {
-        collection: string;
-        touchedFields: readonly string[];
-        missingFields: readonly string[];
-    });
-}
-/**
- * Thrown (or surfaced via the `index:write-partial` event) when one or more
- * per-indexed-field side-car writes fail after the main record write has
- * already succeeded.
- *
- * Not thrown out of `.put()` / `.delete()` directly — those succeed when the
- * main record succeeds. Instead, `IndexWriteFailureError` instances are collected
- * into the session-scoped reconcile queue and emitted on the Collection
- * emitter as `index:write-partial`.
- *
- * Payload:
- * - `recordId` — the id of the main record whose side-car writes failed
- * - `field` — the indexed field whose side-car write failed
- * - `op` — `'put'` or `'delete'`, indicating which mutation was in flight
- * - `cause` — the underlying error from the store
- */
-declare class IndexWriteFailureError extends NoydbError {
-    readonly recordId: string;
-    readonly field: string;
-    readonly op: 'put' | 'delete';
-    readonly cause: unknown;
-    constructor(args: {
-        recordId: string;
-        field: string;
-        op: 'put' | 'delete';
-        cause: unknown;
-    });
-}
-/**
- * Thrown by `readNoydbBundle()` when the body bytes don't match
- * the integrity hash declared in the bundle header — i.e. someone
- * modified the bytes between write and read.
- *
- * Distinct from a generic `Error` (which would be thrown for
- * format violations like a missing magic prefix or malformed
- * header JSON) so consumers can pattern-match the corruption case
- * and handle it differently from a producer bug. A
- * `BundleIntegrityError` indicates "the bytes you got are not
- * what was written"; a plain `Error` from `parsePrefixAndHeader`
- * indicates "what was written wasn't a valid bundle in the first
- * place."
- *
- * Also thrown when decompression fails after the integrity hash
- * passed — that's a producer bug (the wrong algorithm byte was
- * written) but it surfaces with the same error class because the
- * end result is "the body cannot be turned back into a dump."
- */
-declare class BundleIntegrityError extends NoydbError {
-    constructor(message: string);
-}
-/**
- * Thrown by `readNoydbBundle` (#197) when the bundle carries
- * sealed per-user passphrases but no supplied `SealingKeyProvider`
- * has a `.id` (= `pid`) matching the sealed entry's `pid`.
- *
- * Carries the failing pid + the user id so the recipient can
- * surface an actionable prompt:
- *
- * ```
- * BundleSealMismatchError: bundle carries sealed passphrase for user "alice"
- *   under provider "macos-keychain:com.acme.app/alice@acme.example",
- *   but no registered provider matches that pid.
- * ```
- *
- * Three resolution paths the message names (per foundation §11.9.4):
- *
- * 1. Configure a provider matching the pid and retry import.
- * 2. Pass `attemptUnsealAcrossProviders: true` to try each
- *    registered provider regardless of pid.
- * 3. Inspect without unsealing — pass no `sealingProviders` to
- *    receive the sealed entries unmodified for offline analysis.
- */
-declare class BundleSealMismatchError extends NoydbError {
-    readonly userId: string;
-    readonly pid: string;
-    constructor(userId: string, pid: string);
-}
-/**
- * Thrown when `vault.collection()` is called with a name that is
- * reserved for NOYDB internal use (any name starting with `_dict_`).
- *
- * Dictionary collections are accessed exclusively via
- * `vault.dictionary(name)` — attempting to open one as a regular
- * collection would bypass the dictionary invariants (ACL, rename
- * tracking, reserved-name policy).
- */
-declare class ReservedCollectionNameError extends NoydbError {
-    /** The rejected collection name. */
-    readonly collectionName: string;
-    constructor(collectionName: string);
-}
-/**
- * Thrown by `DictionaryHandle.get()` and `DictionaryHandle.delete()` when
- * the requested key does not exist in the dictionary.
- *
- * Distinct from `NotFoundError` (which is for data records) so callers
- * can distinguish "data record missing" from "dictionary key missing"
- * without inspecting error messages.
- */
-declare class DictKeyMissingError extends NoydbError {
-    /** The dictionary name. */
-    readonly dictionaryName: string;
-    /** The key that was not found. */
-    readonly key: string;
-    constructor(dictionaryName: string, key: string);
-}
-/**
- * Thrown by `DictionaryHandle.delete()` in strict mode when the key to
- * be deleted is still referenced by one or more records.
- *
- * The caller must either rename the key first (the only sanctioned
- * mass-mutation path) or pass `{ mode: 'warn' }` to skip the check
- * (development only).
- */
-declare class DictKeyInUseError extends NoydbError {
-    /** The dictionary name. */
-    readonly dictionaryName: string;
-    /** The key that is still referenced. */
-    readonly key: string;
-    /** Name of the first collection found to reference this key. */
-    readonly usedBy: string;
-    /** Number of records in `usedBy` that reference this key. */
-    readonly count: number;
-    constructor(dictionaryName: string, key: string, usedBy: string, count: number);
-}
-/**
- * Thrown by `Collection.put()` when an `i18nText` field is missing one
- * or more required translations.
- *
- * The `missing` array names each locale code that was absent from the
- * field value. The `field` property names the field so callers can
- * render a field-level error message without parsing the string.
- */
-declare class MissingTranslationError extends NoydbError {
-    /** The field name whose translation(s) are missing. */
-    readonly field: string;
-    /** Locale codes that were required but absent. */
-    readonly missing: readonly string[];
-    constructor(field: string, missing: readonly string[], message?: string);
-}
-/**
- * Thrown when reading an `i18nText` field without specifying a locale —
- * either at the call site (`get(id, { locale })`) or on the vault
- * (`openVault(name, { locale })`).
- *
- * Also thrown when `resolveI18nText()` exhausts the fallback chain and
- * no translation is available for the requested locale.
- *
- * The `field` property names the field that triggered the error so the
- * caller can surface it in the UI.
- */
-declare class LocaleNotSpecifiedError extends NoydbError {
-    /** The field name that required a locale. */
-    readonly field: string;
-    constructor(field: string, message?: string);
-}
-/**
- * Thrown when a collection has an `i18nText` field with
- * `autoTranslate: true` but no `plaintextTranslator` was configured
- * on `createNoydb()`.
- *
- * The error is raised at `put()` time (not at schema construction) so
- * the mis-configuration is surfaced by the first write rather than
- * silently at startup.
- */
-declare class TranslatorNotConfiguredError extends NoydbError {
-    /** The field that requested auto-translation. */
-    readonly field: string;
-    /** The collection the put was targeting. */
-    readonly collection: string;
-    constructor(field: string, collection: string);
-}
-/**
- * Thrown when `Vault.load()` finds that a backup's hash chain
- * doesn't verify, or that its embedded `ledgerHead.hash` doesn't
- * match the chain head reconstructed from the loaded entries.
- *
- * Distinct from `BackupCorruptedError` so callers can choose to
- * recover from one but not the other (e.g., a corrupted JSON file is
- * unrecoverable; a chain mismatch might mean the backup is from an
- * incompatible noy-db version).
- */
-declare class BackupLedgerError extends NoydbError {
-    /** First-broken-entry index, if known. */
-    readonly divergedAt?: number;
-    constructor(message: string, divergedAt?: number);
-}
-/**
- * Thrown when `Vault.load()` finds that the backup's data
- * collection content doesn't match the ledger's recorded
- * `payloadHash`es. This is the "envelope was tampered with after
- * dump" detection — the chain itself can be intact, but if any
- * encrypted record bytes were swapped, this check catches it.
- */
-declare class BackupCorruptedError extends NoydbError {
-    /** The (collection, id) pair whose envelope failed the hash check. */
-    readonly collection: string;
-    readonly id: string;
-    constructor(collection: string, id: string, message: string);
-}
-/**
- * Thrown by partition-extraction primitives (#198 epic) when the
- * transitive-closure walk fails — e.g. the FK graph is deeper than
- * `maxDepth`, signalling a runaway or unexpectedly cyclic graph.
- */
-declare class PartitionExtractionError extends NoydbError {
-    constructor(message: string);
-}
-/**
- * Thrown by `adoptPartition` (#207) when the transfer seal can't be
- * opened — a wrong/short transfer key (AES-GCM auth-tag failure) or a
- * malformed sealed payload.
- */
-declare class TransferSealError extends NoydbError {
-    constructor(message: string);
-}
-/**
- * Thrown when an adoption-lifecycle precondition fails — re-adopting a
- * partition already consumed in this store (#207), or owner-creation on a
- * vault that isn't in the adopted-unowned state (#208).
- */
-declare class AdoptionStateError extends NoydbError {
-    constructor(message: string);
-}
-/** Document-attestation failures: undeclared field-schema, non-owner issue, missing field, signer failure. */
-declare class AttestationError extends NoydbError {
-    constructor(message: string);
-}
-/**
- * Thrown by `resolveSession()` when the session token's `expiresAt`
- * timestamp is in the past. The session key is also removed from the
- * in-memory store when this is thrown, so retrying with the same sessionId
- * will produce `SessionNotFoundError`.
- *
- * Separate from `SessionNotFoundError` so callers can distinguish between
- * "session is gone" (key store cleared, tab reloaded) and "session is
- * still in the store but has exceeded its lifetime" (idle timeout, absolute
- * timeout, policy-driven expiry). The remediation differs: expired sessions
- * should prompt a fresh unlock; not-found sessions may indicate a bug or a
- * cross-tab scenario where the session was never established.
- */
-declare class SessionExpiredError extends NoydbError {
-    readonly sessionId: string;
-    constructor(sessionId: string);
-}
-/**
- * Thrown by `resolveSession()` when the session key cannot be found in
- * the module-level store. This happens when:
- *   - The session was explicitly revoked via `revokeSession()`.
- *   - The JS context was reloaded (tab navigation, page refresh, worker restart).
- *   - `Noydb.close()` was called (which calls `revokeAllSessions()`).
- *   - The sessionId is wrong or was generated by a different JS context.
- *
- * The session token (if the caller holds it) is permanently useless after
- * this error — the key is gone and cannot be recovered.
- */
-declare class SessionNotFoundError extends NoydbError {
-    readonly sessionId: string;
-    constructor(sessionId: string);
-}
-/**
- * Thrown when a session policy blocks an operation — for example,
- * `requireReAuthFor: ['export']` is set and the caller attempts to
- * call `exportStream()` without re-authenticating for this session.
- *
- * The `operation` field names the specific operation that was blocked
- * (e.g. `'export'`, `'grant'`, `'rotate'`) so the caller can surface
- * a targeted prompt ("Please re-enter your passphrase to export data").
- */
-declare class SessionPolicyError extends NoydbError {
-    readonly operation: string;
-    constructor(operation: string, message?: string);
-}
-/**
- * Thrown when a `.join()` would exceed its configured row ceiling on
- * either side. The ceiling defaults to 50,000 per side and can be
- * overridden via the `{ maxRows }` option on `.join()`.
- *
- * Carries both row counts so the error message can show which side
- * tripped the limit (e.g. "left had 60,000 rows, right had 1,200,
- * max was 50,000"). The `side` field is machine-readable so test
- * code and devtools can match on it without regex-parsing the
- * message.
- *
- * The row ceiling exists because joins are bounded in-memory
- * operations over materialized record sets. Consumers whose
- * collections genuinely exceed the ceiling should track
- * (streaming joins over `scan()`) or filter the left side further
- * with `where()` / `limit()` before joining.
- */
-declare class JoinTooLargeError extends NoydbError {
-    readonly leftRows: number;
-    readonly rightRows: number;
-    readonly maxRows: number;
-    readonly side: 'left' | 'right';
-    constructor(opts: {
-        leftRows: number;
-        rightRows: number;
-        maxRows: number;
-        side: 'left' | 'right';
-        message: string;
-    });
-}
-/**
- * Thrown by `.join()` in strict `ref()` mode when a left-side record
- * points at a right-side id that does not exist in the target
- * collection.
- *
- * Distinct from `RefIntegrityError` so test code can pattern-match
- * on the *read-time* dangling case without catching *write-time*
- * integrity violations. Both indicate "ref points at nothing" but
- * happen at different lifecycle phases and deserve different
- * remediation in documentation: a RefIntegrityError on `put()`
- * means the input is invalid; a DanglingReferenceError on `.join()`
- * means stored data has drifted and `vault.checkIntegrity()`
- * is the right tool to find the full set of orphans.
- */
-declare class DanglingReferenceError extends NoydbError {
-    readonly field: string;
-    readonly target: string;
-    readonly refId: string;
-    constructor(opts: {
-        field: string;
-        target: string;
-        refId: string;
-        message: string;
-    });
-}
-/**
- * Thrown by {@link sanitizeFilename} when an input filename cannot be
- * made safe — NUL byte, empty after normalization, missing
- * `opaqueId` for the opaque profile, `..` segment, or a `maxBytes`
- * cap too small to hold a single code point.
- */
-declare class FilenameSanitizationError extends NoydbError {
-    constructor(message: string);
-}
-/**
- * Thrown when a write target resolves OUTSIDE the requested
- * directory after sanitization — the canonical Zip-Slip class. The
- * sanitizer's job is to strip path-traversal segments; this error
- * is the defense-in-depth fallback at the FS write site.
- */
-declare class PathEscapeError extends NoydbError {
-    readonly attempted: string;
-    readonly targetDir: string;
-    constructor(opts: {
-        attempted: string;
-        targetDir: string;
-    });
-}
-/**
- * Thrown at vault open if the derivation graph contains a cycle.
- * `path` is the offending chain (e.g. `['a', 'b', 'c', 'a']`).
- */
-declare class DerivationCycleError extends NoydbError {
-    readonly path: readonly string[];
-    constructor(path: readonly string[]);
-}
-/**
- * Thrown when a cascade of source → output → source → … exceeds the
- * configured `maxDepth` (default 5).
- */
-declare class DerivationDepthError extends NoydbError {
-    readonly limit: number;
-    readonly attempted: number;
-    constructor(limit: number, attempted: number);
-}
-/**
- * Thrown at registration if a `withDerivation` strategy references an
- * output `collection` that isn't otherwise declared (no schema, no use
- * elsewhere). Surfacing this early catches typos in collection names.
- */
-declare class DerivationOutputUnknownError extends NoydbError {
-    readonly collection: string;
-    constructor(collection: string);
-}
-/**
- * Thrown when the user's `derive` function returns a value that doesn't
- * match the declared output spec (e.g. wrong shape, wrong key set).
- */
-declare class DerivationOutputShapeError extends NoydbError {
-    readonly outputKey: string;
-    constructor(outputKey: string, detail: string);
-}
-/**
- * Thrown by array-shape derivations (#200) when the `derive` function
- * returns more rows than the output's `maxFanout` cap. The cap exists
- * to keep dispatch cost bounded — without it a single source-row
- * update could fan out to thousands of derived rows, dominating the
- * write path.
- *
- * Defaults to `maxFanout: 64`. Raise on the output spec for
- * carry-forward expansion cases (e.g. monthly rows across multi-year
- * contracts).
- */
-declare class DerivationCapExceededError extends NoydbError {
-    readonly outputKey: string;
-    readonly returned: number;
-    readonly maxFanout: number;
-    constructor(outputKey: string, returned: number, maxFanout: number);
-}
-/**
- * Thrown at vault open if the materialized-view graph contains a
- * cycle. `path` is the offending chain (e.g. `['a-mv', 'b-mv', 'a-mv']`).
- * Detected by the same shared DFS that catches `DerivationCycleError`;
- * surfaces with a distinct error type so consumers can disambiguate.
- */
-declare class MaterializedViewCycleError extends NoydbError {
-    readonly path: readonly string[];
-    constructor(path: readonly string[]);
-}
-/**
- * Thrown at MV registration if the query references a source
- * collection that isn't declared on the vault. Surfacing this early
- * catches typos in collection names.
- */
-declare class MaterializedViewSourceUnknownError extends NoydbError {
-    readonly mvName: string;
-    readonly collection: string;
-    constructor(mvName: string, collection: string);
-}
-/**
- * Thrown by the MV executor when a refresh produces more rows than
- * the configured ceiling. Default ceiling is 100k rows; override
- * per-MV via `maxRows`. Mirrors `JoinTooLargeError` /
- * `GroupCardinalityError` from the query DSL — the explosion is
- * detected BEFORE writes hit the store, so the source-write
- * transaction can roll back cleanly via strict-mode.
- */
-declare class MaterializedViewTooLargeError extends NoydbError {
-    readonly mvName: string;
-    readonly expected: number;
-    readonly limit: number;
-    constructor(mvName: string, expected: number, limit: number);
-}
-/**
- * Thrown by `withMaterializedView()` at registration time when the
- * strategy is structurally malformed. Distinct from
- * `MaterializedViewSourceUnknownError` (the source list is well-formed
- * but names a collection the vault doesn't know) and
- * `MaterializedViewCycleError` (the source graph has a cycle): this
- * error fires before either check, at the moment the spec is being
- * normalized.
- *
- * Today the trigger cases are all about the `query` / `unionSources`
- * dichotomy introduced by #165:
- *   - both `query` and `unionSources` were set (mutually exclusive),
- *   - neither `query` nor `unionSources` was set,
- *   - `unionSources` has fewer than 2 arms,
- *   - two arms in `unionSources` reference the same `collection`.
- *
- * The error message is prefixed with `[noy-db] withMaterializedView:`
- * so it's grep-friendly in logs and looks consistent with the existing
- * `ValidationError` messages from the same factory.
- */
-declare class MaterializedViewConfigError extends NoydbError {
-    constructor(message: string);
-}
-/**
- * Thrown at vault open when a `withOverlayedView` declaration uses
- * another virtual-overlay name as its `base`. Multi-overlay stacking
- * is a v2 non-goal — the shallow expansion in
- * `QueryDependencyAnalyzer` would truncate at the inner overlay
- * name, leaving downstream MVs silently stale.
- */
-declare class OverlayBaseIsVirtualError extends NoydbError {
-    readonly overlayName: string;
-    readonly base: string;
-    constructor(overlayName: string, base: string);
-}
-/**
- * Thrown at vault open when a `withOverlayedView`'s `overlay`
- * references an unknown collection or an MV-owned collection. The
- * overlay collection is user-writable; MV-owned collections aren't.
- */
-declare class OverlayCollectionUnavailableError extends NoydbError {
-    readonly overlayName: string;
-    readonly overlay: string;
-    constructor(overlayName: string, overlay: string);
-}
-/**
- * Thrown at vault open when a `withOverlayedView`'s virtual `name`
- * collides with an MV output or a concrete source collection.
- */
-declare class OverlayNameCollisionError extends NoydbError {
-    readonly overlayName: string;
-    constructor(overlayName: string);
-}
-/**
- * Thrown by the virtual overlay's `put(id, record)` when the
- * consumer-supplied `id` doesn't match `rowKey(record)`. Catches
- * fat-finger separator typos that would otherwise silently produce
- * orphaned overlay rows. Direct writes to the underlying overlay
- * collection (bypass the virtual layer) skip this validation.
- */
-declare class OverlayIdMismatchError extends NoydbError {
-    readonly actual: string;
-    readonly expected: string;
-    constructor(actual: string, expected: string);
-}
+import { C as CollectionIndexes, a as Clause, O as Operator } from './predicate-BmhBSPCH.js';
+import { N as NoydbError } from './errors-BAWO5Z5a.js';
+import { a as I18nTextDescriptor, P as MoneyDescriptor, A as AggregateStrategy, k as AggregateSpec, l as Aggregation, j as AggregateResult, p as GroupedQuery, q as GroupedQueryN } from './strategy-8QGs5KQE.js';
 
 /**
  * Foreign-key references — the soft-FK mechanism.
@@ -1195,7 +59,19 @@ type RefMode = 'strict' | 'warn' | 'cascade';
 interface RefDescriptor {
     readonly target: string;
     readonly mode: RefMode;
+    /**
+     * Present and `true` only for an array ref (#377-A, `refArray()`): the
+     * field holds an ARRAY of ids, each validated against `target`
+     * independently (M:N). Absent for a scalar `ref()`. The same `mode`
+     * semantics apply per element — strict rejects on a missing element at
+     * put + blocks delete of a referenced target; cascade deletes every
+     * record whose array contains the deleted id; warn surfaces orphans
+     * only via `checkIntegrity()`.
+     */
+    readonly isArray?: true;
 }
+/** Runtime predicate: is this an array ref (`refArray()`) vs a scalar `ref()`? */
+declare function isRefArray(desc: RefDescriptor): boolean;
 /**
  * Thrown when a strict reference is violated — either `put()` with a
  * missing target id, or `delete()` of a target that still has
@@ -1238,6 +114,30 @@ declare class RefScopeError extends NoydbError {
  * fails at collection construction time, not at the first put.
  */
 declare function ref(target: string, mode?: RefMode): RefDescriptor;
+/**
+ * Array reference (#377-A) — the many-to-many soft-FK. The field holds an
+ * array of ids; each element is validated against `target` independently.
+ *
+ * ```ts
+ * const orders = company.collection<Order>('orders', {
+ *   refs: { productIds: refArray('products', 'warn') },
+ * })
+ * ```
+ *
+ * Same three `mode` semantics as `ref()`, applied per element:
+ *   - **strict** — `put()` rejects if ANY element's target is missing;
+ *     `delete()` of a target is blocked while any record's array still
+ *     contains its id.
+ *   - **warn** — both succeed; orphaned elements surface via
+ *     `vault.checkIntegrity()` (one violation per dangling element).
+ *   - **cascade** — `delete()` of a target deletes every record whose
+ *     array contains its id (cycle-safe, like scalar cascade).
+ *
+ * A `null`/`undefined` field is allowed (no links). Non-array values, or
+ * non-string/number elements, are an integrity error. Cross-vault targets
+ * are rejected exactly as in `ref()`.
+ */
+declare function refArray(target: string, mode?: RefMode): RefDescriptor;
 /**
  * Per-vault registry of reference declarations.
  *
@@ -1280,6 +180,7 @@ declare class RefRegistry {
         collection: string;
         field: string;
         mode: RefMode;
+        isArray?: true;
     }>;
     /**
      * Iterate every (collection → refs) pair that has at least one
@@ -1414,6 +315,23 @@ interface JoinLeg {
 interface JoinableSource {
     snapshot(): readonly unknown[];
     lookupById?(id: string): unknown;
+    /**
+     * Default locale a label-resolving query falls back to when the query
+     * itself is locale-less. Set by a `staticDict()`-backed source from its
+     * `displayLocale` so `{ by: 'label' }` resolves under a locale-less read
+     * (#291). Plain `_dict_*`-backed sources omit it.
+     */
+    readonly displayLocale?: string;
+    /**
+     * i18nText descriptors of the right-side collection (#285 §3, `join`
+     * layer). When present and the query carries a locale, each joined
+     * right-side record's i18n fields resolve to that locale at the `join`
+     * layer (`resolvePolicy(onMissing, 'join')`) BEFORE it is attached under
+     * the leg's alias — so a joined `i18nText` field is a resolved string, not
+     * a raw `{ locale }` map. Locale-less queries leave joined fields raw
+     * (consistent with a locale-less read).
+     */
+    readonly i18nFields?: Record<string, I18nTextDescriptor>;
     /**
      * Subscribe to mutations on this source. The callback fires
      * AFTER the underlying record set has been updated. Returns an
@@ -1436,6 +354,13 @@ interface JoinableSource {
 interface JoinContext {
     /** Name of the left-side (owning) collection. */
     readonly leftCollection: string;
+    /**
+     * The owning collection's default locale (#285 §3). Used to resolve joined
+     * i18n fields at the `join` layer when a terminal call doesn't pass an
+     * explicit locale — so `openVault({ locale })` flows to joins like it does
+     * to `get`/`list`. A per-call `toArray({ locale })` overrides it.
+     */
+    readonly defaultLocale?: string;
     /** Look up a `RefDescriptor` by field name on the left collection. */
     resolveRef(field: string): RefDescriptor | null;
     /** Resolve a right-side source by target collection name. */
@@ -1477,7 +402,7 @@ interface JoinContext {
  * query like `.join('a', { maxRows: 100_000 }).join('b', { maxRows: 50 })`,
  * which should throw on the second leg if the left set exceeds 50.
  */
-declare function applyJoins(rows: readonly unknown[], joins: readonly JoinLeg[], context: JoinContext): unknown[];
+declare function applyJoins(rows: readonly unknown[], joins: readonly JoinLeg[], context: JoinContext, locale?: string): unknown[];
 /**
  * Test-only: reset the join warning deduplication state between
  * tests. Production code never calls this — the dedup state is
@@ -1608,6 +533,13 @@ declare function buildLiveQuery<T>(recompute: () => T[], upstreams: readonly Liv
 interface OrderBy {
     readonly field: string;
     readonly direction: 'asc' | 'desc';
+    /**
+     * Sort key for a `dictKey`/`staticDict` field (#285): `'value'` (default)
+     * sorts by the stored code; `'label'` sorts by the code's resolved label at
+     * the query locale (`toArray({ locale })`, or a `staticDict` `displayLocale`).
+     * Falls back to the code when no label resolves.
+     */
+    readonly by?: 'value' | 'label';
 }
 /**
  * A complete query plan: zero-or-more clauses, optional ordering, pagination,
@@ -1632,6 +564,8 @@ interface QueryPlan {
      */
     readonly joins: readonly JoinLeg[];
 }
+/** Default row ceiling for cross-join expansion. Matches JoinTooLargeError's ceiling. */
+declare const DEFAULT_CROSS_JOIN_MAX_ROWS = 50000;
 /**
  * Source of records that a query executes against.
  *
@@ -1652,6 +586,19 @@ interface QuerySource<T> {
     getIndexes?(): CollectionIndexes | null;
     /** O(1) record lookup by id, used to materialize index hits. */
     lookupById?(id: string): T | undefined;
+    /**
+     * Money field descriptors for the backing collection, used to rewrite
+     * `sum`/`min`/`max` over money fields into exact BigInt reducers.
+     */
+    moneyFields?: Record<string, MoneyDescriptor>;
+    /**
+     * #308 L3 — id-paired snapshot for `Query._idArray()` (the `retrieve({within})`
+     * id projection). Optional: only collection-backed queries supply it.
+     */
+    snapshotEntries?(): readonly {
+        id: string;
+        record: T;
+    }[];
 }
 /**
  * The chainable builder. All methods return a new Query — the original
@@ -1669,7 +616,7 @@ interface QuerySource<T> {
  * error. See `query/join.ts` for the full design.
  */
 /**
- * Declared deterministic predicate (#153). Carries the consumer's
+ * Declared deterministic predicate. Carries the consumer's
  * stable `hash` (for function-body identity), the function itself,
  * and is keyed by name when registered on a `Query<T>` via
  * `_withPredicates()`.
@@ -1700,12 +647,21 @@ declare class Query<T> {
     /**
      * @internal — clone this Query with a declared-predicate map
      * attached. Used by the materialized-view registry to enable
-     * `.wherePredicate(name, ctx?)` for the MV's query callback (#153).
+     * `.wherePredicate(name, ctx?)` for the MV's query callback.
      * Consumers don't call this directly.
      */
     _withPredicates(predicates: ReadonlyMap<string, DeclaredPredicate>): Query<T>;
     /**
-     * Filter by a registered deterministic predicate (#153). Requires
+     * @internal — #308 L3. The ids of records matching this query's plan,
+     * recovered by reference identity: `executePlanWithSource` returns the
+     * ORIGINAL snapshot record references (money-decode and joins are applied
+     * later, in `toArray`), so each matched record is found in the id-paired
+     * `snapshotEntries()` map. Used by `collection.retrieve({ within })`.
+     * Throws if the source is not collection-backed (no `snapshotEntries`).
+     */
+    _idArray(): string[];
+    /**
+     * Filter by a registered deterministic predicate. Requires
      * the Query to have been augmented with a predicates map (typically
      * via the materialized-view registry — bare Queries constructed
      * outside an MV throw on `.wherePredicate()`).
@@ -1716,7 +672,15 @@ declare class Query<T> {
      * either changing forces refresh on next visit.
      */
     wherePredicate(name: string, ctx?: unknown): Query<T>;
-    /** Add a field comparison. Multiple where() calls are AND-combined. */
+    /**
+     * Add a field comparison. Multiple where() calls are AND-combined.
+     *
+     * A declared money field compares in MAJOR units (#336): the operand
+     * (`10000`, `'10000.00'`, or `{ amount, currency }` in multi mode) is
+     * quantized into stored scaled-int space at build time and evaluated
+     * BigInt-exact per record. A malformed operand or a string operator
+     * (`contains`/`startsWith`) throws here, at the call site.
+     */
     where(field: string, op: Operator, value: unknown): Query<T>;
     /**
      * Logical OR group. Pass a callback that builds a sub-query.
@@ -1731,8 +695,14 @@ declare class Query<T> {
     and(builder: (q: Query<T>) => Query<T>): Query<T>;
     /** Escape hatch: add an arbitrary predicate function. Not serializable. */
     filter(fn: (record: T) => boolean): Query<T>;
-    /** Sort by a field. Subsequent calls are tie-breakers. */
-    orderBy(field: string, direction?: 'asc' | 'desc'): Query<T>;
+    /**
+     * Sort by a field. Subsequent calls are tie-breakers. Pass
+     * `{ by: 'label' }` to sort a `dictKey`/`staticDict` field by its resolved
+     * label at the query locale instead of the stored code (#285).
+     */
+    orderBy(field: string, direction?: 'asc' | 'desc', opts?: {
+        by?: 'value' | 'label';
+    }): Query<T>;
     /** Cap the result size. */
     limit(n: number): Query<T>;
     /** Skip the first N matching records (after ordering). */
@@ -1800,15 +770,67 @@ declare class Query<T> {
         strategy?: JoinStrategy;
         maxRows?: number;
     }): Query<T & Record<As, R | null>>;
+    /**
+     * Cartesian-product cross-join against `target` collection. Each result row
+     * carries the original `T` fields plus `result[as]` populated from every
+     * right-side row (or the filtered subset when `on:` is supplied).
+     *
+     * **Order matters:** `.where().crossJoin()` filters BEFORE expanding (cheaper);
+     * `.crossJoin().where('alias.field', ...)` filters AFTER (required when the
+     * where clause references the aliased fields).
+     *
+     * **Cost ceiling:** `CrossJoinTooLargeError` fires before allocation when
+     * `leftRows × rightRows` (or the cumulative lateral count) exceeds the limit.
+     * Default: 50,000 rows. Override per-clause with `{ maxRows: N }`.
+     *
+     * **`on:` shapes:**
+     *   - `on: (left) => TTarget[]`              — subset form (most efficient)
+     *   - `on: (left) => (right) => boolean`     — predicate form
+     *   - `on: { predicate: 'name' }`            — MV-safe, hash-tracked form
+     *     (requires the Query to have been augmented via `_withPredicates`)
+     *
+     * Requires a JoinContext (constructed via `collection.query()`).
+     */
+    crossJoin<TTarget = unknown, As extends string = string>(target: string, opts: {
+        as: As;
+        on?: ((left: T) => unknown[] | ((right: TTarget) => boolean)) | {
+            readonly predicate: string;
+        };
+        maxRows?: number;
+    }): Query<T & {
+        [K in As]: TTarget;
+    }>;
     /**
      * Execute the plan and return the matching records. When the plan
      * carries any join legs, they are applied after `where` / `orderBy`
      * / `limit` / `offset` narrow the left set. See the `.join()` doc
      * for the ordering rationale.
+     *
+     * `opts.locale` (#285 §3) resolves JOINED right-side i18n fields at the
+     * `join` layer to that locale; without it, the owning collection's default
+     * locale applies, and a locale-less query leaves joined i18n fields raw.
+     * (Left/base i18n fields are resolved by `get`/`list`, not here.)
      */
-    toArray(): T[];
-    /** Return the first matching record, or null. Joins are applied. */
-    first(): T | null;
+    toArray(opts?: {
+        locale?: string;
+    }): T[];
+    /**
+     * Decode this source's money fields on read (stored scaled-int → canonical
+     * decimal), so `query().toArray()` agrees with `get()`/`sum()` on the value.
+     * No-op when the source declares no money fields.
+     *
+     * The query layer carries no locale context, so we decode with `'raw'` —
+     * canonical decimal, WITHOUT fabricating locale-formatted `<field>Formatted`
+     * / `<field>Number` virtuals. Producing a guessed-locale string here would
+     * just reintroduce #322's "two read paths disagree" failure on the virtual
+     * field (e.g. it-IT via `get()` vs en-US here). Consumers who need formatted
+     * money read through `get()`/`list()` with a locale.
+     */
+    private decodeMoney;
+    /** Return the first matching record, or null. Joins are applied. `opts.locale` resolves joined i18n fields (#285 §3). */
+    first(opts?: {
+        locale?: string;
+    }): T | null;
     /**
      * Return the number of matching records (after where/filter,
      * before limit). **Joins are NOT applied** — count() reports the
@@ -2096,7 +1118,20 @@ declare class ScanBuilder<T> implements AsyncIterable<T> {
      * context throws with an actionable error.
      */
     private readonly joinContext;
-    constructor(pageProvider: ScanPageProvider<T>, pageSize?: number, clauses?: readonly Clause[], joins?: readonly JoinLeg[], joinContext?: JoinContext);
+    /**
+     * Money field descriptors for the backing collection. When present, yielded
+     * records are decoded (stored scaled-int → canonical decimal) so `scan()`
+     * agrees with `get()`/`list()`/`query().toArray()` — #322. Decoded with
+     * `'raw'` (canonical decimal, no locale-formatted virtuals) since the scan
+     * stream carries no locale context, mirroring `Query.toArray()`.
+     */
+    private readonly moneyFields;
+    constructor(pageProvider: ScanPageProvider<T>, pageSize?: number, clauses?: readonly Clause[], joins?: readonly JoinLeg[], joinContext?: JoinContext, moneyFields?: Record<string, MoneyDescriptor>);
+    /**
+     * Decode this scan's money fields on a record (stored scaled-int → canonical
+     * decimal). No-op when no money fields are declared. See {@link moneyFields}.
+     */
+    private decodeMoney;
     /**
      * Add a field comparison. Runs per record as the scan stream
      * flows through, so non-matching records are dropped before they
@@ -2287,4 +1322,4 @@ declare class ScanBuilder<T> implements AsyncIterable<T> {
     private recordMatches;
 }
 
-export { type JoinLeg as $, AmendmentForbiddenError as A, BackupCorruptedError as B, ConflictError as C, DictKeyInUseError as D, DecryptionError as E, FieldFrozenError as F, DelegationTargetMissingError as G, DirectoryDisabledError as H, InvariantError as I, ElevationExpiredError as J, ExportCapabilityError as K, LocaleNotSpecifiedError as L, MissingTranslationError as M, NoydbError as N, OverlayBaseIsVirtualError as O, PartitionExtractionError as P, Query as Q, ReservedCollectionNameError as R, SessionExpiredError as S, TranslatorNotConfiguredError as T, FilenameSanitizationError as U, GroupCardinalityError as V, ImportCapabilityError as W, IndexRequiredError as X, IndexWriteFailureError as Y, InvalidKeyError as Z, type JoinContext as _, DictKeyMissingError as a, type JoinStrategy as a0, JoinTooLargeError as a1, type JoinableSource as a2, KeyringCorruptError as a3, KeyringExpiredError as a4, LedgerContentionError as a5, type LiveQuery as a6, type LiveUpstream as a7, MigrationRequiredError as a8, NetworkError as a9, StoreCapabilityError as aA, TamperedError as aB, TierDemoteDeniedError as aC, TierNotGrantedError as aD, ValidationError as aE, applyJoins as aF, buildLiveQuery as aG, executePlan as aH, ref as aI, resetJoinWarnings as aJ, NoAccessError as aa, NonAdditiveSchemaChangeError as ab, NotFoundError as ac, type OrderBy as ad, PathEscapeError as ae, PeriodClosedError as af, PermissionDeniedError as ag, PrivilegeEscalationError as ah, type QueryPlan as ai, type QuerySource as aj, QuiesceTimeoutError as ak, ReadOnlyAtInstantError as al, ReadOnlyError as am, ReadOnlyFrameError as an, type RefDescriptor as ao, RefIntegrityError as ap, type RefMode as aq, RefRegistry as ar, RefScopeError as as, type RefViolation as at, ScanBuilder as au, type ScanPageProvider as av, SchemaFenceError as aw, SchemaLockedError as ax, SchemaUpdateError as ay, SchemaValidationError as az, SessionNotFoundError as b, SessionPolicyError as c, RecordLockedError as d, DerivationCapExceededError as e, DerivationCycleError as f, DerivationDepthError as g, DerivationOutputShapeError as h, DerivationOutputUnknownError as i, OverlayCollectionUnavailableError as j, OverlayIdMismatchError as k, OverlayNameCollisionError as l, AttestationError as m, AdoptionStateError as n, BackupLedgerError as o, BundleIntegrityError as p, BundleSealMismatchError as q, BundleVersionConflictError as r, TransferSealError as s, MaterializedViewConfigError as t, MaterializedViewCycleError as u, MaterializedViewSourceUnknownError as v, MaterializedViewTooLargeError as w, AlreadyElevatedError as x, DEFAULT_JOIN_MAX_ROWS as y, DanglingReferenceError as z };
+export { DEFAULT_CROSS_JOIN_MAX_ROWS as D, type JoinContext as J, type LiveQuery as L, type OrderBy as O, Query as Q, type RefDescriptor as R, ScanBuilder as S, DEFAULT_JOIN_MAX_ROWS as a, type JoinLeg as b, type JoinStrategy as c, type JoinableSource as d, type LiveUpstream as e, type QueryPlan as f, type QuerySource as g, RefIntegrityError as h, type RefMode as i, RefRegistry as j, RefScopeError as k, type RefViolation as l, type ScanPageProvider as m, applyJoins as n, buildLiveQuery as o, executePlan as p, isRefArray as q, ref as r, refArray as s, resetJoinWarnings as t };