@noy-db/hub 0.4.0-pre.0 → 0.4.0-pre.10

package/dist/kernel/lazy.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Memoized module loader for the S4 lazy-import seam (#846c).
+ *
+ * The spine and the services reach optional machinery through a dynamic
+ * `import()` — that is what keeps a service out of the floor bundle for
+ * consumers who never opt into it, and `check-architecture`'s `port-layering`
+ * rule requires it for any spine→service edge. The pattern stays; this only
+ * removes the ceremony that grew around it.
+ *
+ * Call sites had each re-invented the same shape: a `let mod = null` cache
+ * declared *inside* the function (so it cached for one invocation and no
+ * longer), plus in several places an `as { … }` cast, because destructuring a
+ * dynamic import inline gave up the module's type.
+ *
+ * ```ts
+ * const loadExecutor = lazy(() => import('./executor.js'))
+ * // …
+ * const { DerivationExecutor } = await loadExecutor()
+ * ```
+ *
+ * Note this is about clarity, not speed: the ES module system already caches a
+ * resolved module, so the win is one named binding per module instead of a
+ * hand-rolled cache and a cast at every call site.
+ *
+ * Concurrent first calls share a single in-flight promise rather than each
+ * starting their own `import()`.
+ *
+ * @internal
+ */
+export declare function lazy<T>(load: () => Promise<T>): () => Promise<T>;

package/dist/kernel/noydb.d.ts

@@ -1,8 +1,6 @@
+import type { RotateResult } from '../with-party/team/keyring.js';
 import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, PushOptions, PullOptions, SyncStatus, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy } from './types.js';
-import type { PassphrasePolicy } from './validation.js';
-import { type RotatePassphraseInput, type RecoverPassphraseInput, type RecoverPassphraseResult, type RotateRecoveryOptions, type RotateRecoveryResult, type EnrollRecoveryResult, type RecoveryEnrollmentInput, type RecoveryProof } from '../with-party/team/rotate-recover.js';
-import type { RecoverUserOptions } from '../with-party/team/peer-recover.js';
-import { type PaperRecoveryEntry, type ShamirRecoveryEntry } from '../with-party/team/recovery.js';
+import type { SecretPolicy } from './validation.js';
 import { type CoordinationProvider } from '../port/by/default-provider.js';
 import type { Cover } from '../with-party/directory/cover/types.js';
 import type { SetCoverInput } from '../with-party/directory/cover/schema.js';
@@ -11,19 +9,17 @@ import type { VaultMeta } from '../with-shape/introspection/meta.js';
 import { WriteQueueTracker, type WriteQueue } from './write-queue.js';
 import { WriteHookRegistry, type WriteHook, type Unsubscribe } from '../port/with/write-hooks.js';
 import { ServiceBus } from '../port/with/service-bus.js';
-import { type TabCoordinationOptions, type TabRole, type TabPresence } from '../with-party/tab-coordination.js';
+import { type TabCoordinationOptions, type TabRole, type TabPresence } from '../with-sync/tab-coordination.js';
 import type { UnlockedKeyring } from '../with-party/team/keyring.js';
-import { type EnrollAuthenticatorOptions, type UpdateAuthenticatorOptions } from '../with-party/team/authenticators.js';
-import { type QuickUnlockState } from '../with-party/session/unlock-state.js';
-import type { KeyringAuthenticator } from './types.js';
-import type { SyncEngine } from '../with-party/team/sync.js';
-import type { SyncTransaction } from '../with-party/team/sync-transaction.js';
+import type { SyncEngine } from '../with-sync/engine.js';
+import type { SyncTransaction } from '../with-sync/transaction.js';
 import { type SnapshotMeta } from '../with-fork/snapshots/strategy.js';
 import type { AmendmentTxOptions } from '../with-commit/tx/transaction.js';
 import { TxContext } from '../with-commit/tx/transaction.js';
 import type { DryRunResult } from '../with-commit/tx/dry-run.js';
 import { type ForgetStrategy } from '../with-audit/forget/strategy.js';
 import { type CustodyStrategy } from '../with-party/custody/strategy.js';
+import { TeamFacade } from '../with-party/team/noydb-facade.js';
 /** NoydbOptions with the store resolved to a non-optional value (internal use only). */
 type ResolvedNoydbOptions = NoydbOptions & {
     readonly store: NoydbStore;
@@ -56,7 +52,7 @@ export declare class Noydb {
     private readonly keyringCache;
     private readonly syncEngines;
     /**
-     * Per-vault active session tier — defaults to `1` after a passphrase
+     * Per-vault active session tier — defaults to `1` after a secret
      * unlock; tier-2 / tier-3 unlocks downgrade it. Used by
      * {@link checkGate} to evaluate `gate.minTier`.
      */
@@ -84,26 +80,38 @@ export declare class Noydb {
     private writeRelay;
     /** Per-vault policy enforcers. */
     private readonly policyEnforcers;
-    private readonly txStrategy;
-    private readonly forgetStrategy;
     /**
-     * Opt-in sovereign-custody (FR-6) strategy — `NO_CUSTODY` (throwing) unless
-     * `withCustody()` was passed. Public so `Vault` routes `vault.custody.liberate`
-     * through it; grant/revoke route through it from this class. @internal
+     * Every opt-in service, resolved once (#838). Shared by reference with each
+     * `Vault` this instance opens and, through them, every `Collection` — so
+     * there is exactly one resolution and no construction path can disagree
+     * about which services are enabled (the #834 bug class).
      */
-    readonly custodyStrategy: CustodyStrategy;
+    private readonly strategies;
     /**
-     * Opt-in multi-user team strategy (#267 keyring-grant → team split) —
-     * `NO_TEAM` (throwing) unless `withTeam()` was passed; the keyring
-     * engines are linked only by the active strategy, not by this file. */
-    private readonly teamStrategy;
-    private readonly sessionStrategy;
-    private readonly syncStrategy;
+     * Opt-in sovereign-custody (FR-6) strategy — `NO_CUSTODY` (throwing) unless
+     * `withCustody()` was passed. Kept as a public accessor because `Vault`
+     * routes `vault.custody.liberate` through `this.noydb.custodyStrategy`.
+     * @internal
+     */
+    get custodyStrategy(): CustodyStrategy;
     private readonly snapshots;
     private readonly policyManager;
     /** Pre-resolved policy-gate engine function (mirrors `coordinationProvider`/`userApiFactory` above). */
     private readonly policyCheckGate;
-    private readonly team;
+    /**
+     * Credential and multi-user operations — enrolment, secret rotation,
+     * recovery, quick-unlock (#846).
+     *
+     * Public because 23 methods on this class did nothing but restate a
+     * TeamFacade signature and forward to it, so every signature had to be
+     * hand-kept in sync with its counterpart. `db.team.rotateSecret(…)`
+     * reads the same and has one source of truth.
+     *
+     * A getter, not a field, so it appears in the prototype-based kernel API
+     * manifest — an instance field is invisible to it (the same reason
+     * `custodyStrategy` became one in #838).
+     */
+    get team(): TeamFacade;
     /**
      * Currently-running multi-record transaction, set by
      * `runTransaction` at the start of Phase 2 (commit) and cleared in
@@ -151,7 +159,19 @@ export declare class Noydb {
         create?: boolean;
         meta?: VaultMeta;
     }): Promise<Vault>;
-    /** Synchronous vault access (must call openVault first, or auto-opens). */
+    /**
+     * Synchronous access to an ALREADY-OPEN vault.
+     *
+     * Returns the instance `openVault()` produced, or throws — it never
+     * constructs. It used to fall back to building a Vault itself (once for
+     * plaintext, once for encrypted-with-cached-keyring), and those copies
+     * drifted from the real open path: the encrypted one silently omitted six
+     * strategies, so a vault reached this way threw `*NotEnabledError` for
+     * services the caller had configured (#834). Both fallbacks also skipped
+     * the async registry init and schema-fence snapshot that `openVault`
+     * performs, which a synchronous method cannot await. One construction
+     * path is the only way that divergence stays fixed.
+     */
     vault(name: string): Vault;
     /**
      * Grant access to a user for a vault.
@@ -245,23 +265,33 @@ export declare class Noydb {
     /**
      * Rotate the DEKs for the given collections in a vault.
      *
-     * Generates fresh DEKs, re-encrypts every record in each collection,
-     * and re-wraps the new DEKs into every remaining user's keyring. The
-     * old DEKs become unreachable — useful as a defense-in-depth measure
-     * after a suspected key leak, or as the scheduled half of a
-     * key-rotation policy.
+     * Generates fresh DEKs and re-encrypts every record in each collection.
+     * The old DEKs become unreachable — useful as a defense-in-depth measure
+     * after a suspected key leak, or as the scheduled half of a key-rotation
+     * policy.
      *
-     * Unlike `revoke({ rotateKeys: true })`, this call does NOT remove
-     * any users — every current member keeps access, but with fresh
-     * keys. This is the "just rotate" path; the "revoke and rotate"
-     * path still lives in `revoke()`.
+     * ## Other members LOSE access to the rotated collections (#854)
+     *
+     * A member's DEKs are wrapped under that member's KEK, and a KEK derives
+     * only from that member's secret. The caller cannot derive anyone else's
+     * KEK, so re-wrapping a fresh DEK for them is impossible — that is the
+     * zero-knowledge property working as designed. Rotation therefore DROPS
+     * the rotated collections from every other member's keyring.
+     *
+     * The returned {@link RotateResult.needsRegrant} names each (member,
+     * collection) pair that was dropped. Re-run `grant()` for those pairs, or
+     * they stay locked out.
+     *
+     * Unlike `revoke({ rotateKeys: true })`, this call does not REMOVE any
+     * user from the vault — they keep membership and their other collections.
+     * This is the "just rotate" path; "revoke and rotate" lives in `revoke()`.
      *
      * Exposed on Noydb (rather than only on the lower-level keyring
      * module) so CLI and admin tooling can trigger rotation without
      * reaching into internals. See `noy-db rotate` for the CLI wrapper.
      * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
      */
-    rotate(vault: string, collections: string[]): Promise<void>;
+    rotate(vault: string, collections: string[]): Promise<RotateResult>;
     /** List all users with access to a vault. */
     listUsers(vault: string): Promise<UserInfo[]>;
     /**
@@ -270,9 +300,9 @@ export declare class Noydb {
      *
      * The walk is a two-step pipeline: first ask the adapter for the
      * universe of compartments it stores, then for each one attempt to
-     * load the calling user's keyring with the in-memory passphrase.
+     * load the calling user's keyring with the in-memory secret.
      * Compartments where the user has no keyring file (`NoAccessError`)
-     * or where the passphrase doesn't unwrap (`InvalidKeyError`) are
+     * or where the secret doesn't unwrap (`InvalidKeyError`) are
      * silently dropped from the result — the existence of those
      * compartments is **not** confirmed in the return value.
      *
@@ -293,15 +323,15 @@ export declare class Noydb {
      * **Known edge case.** A vault whose keyring file
      * happens to have an empty wrapped-DEKs map (because the owner
      * granted access before any collection was created) will pass the
-     * `loadKeyring` probe with *any* passphrase — there are no DEKs to
+     * `loadKeyring` probe with *any* secret — there are no DEKs to
      * unwrap, so the integrity-checked unwrap that normally rejects
-     * wrong passphrases never runs. The result is that an unrelated
+     * wrong secrets never runs. The result is that an unrelated
      * principal who happens to know the user-id and the vault
      * name can show up in `listAccessibleVaults()` as having
      * access to that empty vault. They cannot read any actual
      * data (their DEK set is empty), so this is a metadata leak
      * (vault name + user-id), not a content leak. Hardening this
-     * via a passphrase canary in the keyring file is a deferred
+     * via a secret canary in the keyring file is a deferred
      * follow-up.
      *
      * **Cost.** O(compartments × keyring-load) — one `loadKeyring`
@@ -394,15 +424,15 @@ export declare class Noydb {
      */
     _resolveBackend(vaultId: string): NoydbStore;
     /**
-     * Change the current user's passphrase for a vault.
+     * Change the current user's secret for a vault.
      *
-     * Validates the new passphrase against the strength rules. Pass
-     * `{ allowWeakPassphrase: true }` to skip — typically only useful for
-     * fixtures and migrations. Pass a `PassphrasePolicy` to override the
+     * Validates the new secret against the strength rules. Pass
+     * `{ allowWeakSecret: true }` to skip — typically only useful for
+     * fixtures and migrations. Pass a `SecretPolicy` to override the
      * default rules (e.g. consumer-tunable `pattern` / `customValidator`).
      */
-    changeSecret(vault: string, newPassphrase: string, options?: PassphrasePolicy & {
-        allowWeakPassphrase?: boolean;
+    changeSecret(vault: string, newSecret: string, options?: SecretPolicy & {
+        allowWeakSecret?: boolean;
     }): Promise<void>;
     /** Push local changes to remote for a vault. */
     push(vault: string, options?: PushOptions): Promise<PushResult>;
@@ -660,7 +690,7 @@ export declare class Noydb {
      * denial; resolves with `void` on success.
      *
      * @param vault    The vault whose policy applies.
-     * @param gate     Gate name — built-in (e.g. `'rotate-passphrase'`)
+     * @param gate     Gate name — built-in (e.g. `'rotate-secret'`)
      *                 or app-defined (`app:*`).
      * @param presented Caller-supplied factor proofs.
      */
@@ -675,12 +705,12 @@ export declare class Noydb {
      * Two enforcement modes:
      *
      * 1. **Managed-mode mandatory strong-recovery.** When
-     *    `passphraseMode === 'managed'`, the vault MUST have at least
+     *    `secretMode === 'managed'`, the vault MUST have at least
      *    one **strong** recovery profile (Shamir today). Paper alone is
      *    rejected because under managed mode the user has no memorized
-     *    passphrase, so losing the paper sheet = losing every record.
+     *    secret, so losing the paper sheet = losing every record.
      *    This check is unconditional — independent of `requireRecovery`
-     *    and the `recover-passphrase` gate.
+     *    and the `recover-secret` gate.
      *
      * 2. **Opt-in strict mandatory-recovery.** When
      *    `requireRecovery: true` is set on createNoydb (and the gate is
@@ -699,26 +729,6 @@ export declare class Noydb {
      * @internal
      */
     _setActiveTier(vault: string, tier: ActiveTier): void;
-    /** Add a tier-2 authenticator slot — see {@link TeamFacade.enrollAuthenticator}. */
-    enrollAuthenticator(vault: string, options: EnrollAuthenticatorOptions, factors?: FactorProofBundle): Promise<void>;
-    /** Remove a tier-2 authenticator slot — see {@link TeamFacade.removeAuthenticator}. */
-    removeAuthenticator(vault: string, slotId: string, factors?: FactorProofBundle): Promise<void>;
-    /** Read the slot list for a vault — see {@link TeamFacade.listAuthenticators}. */
-    listAuthenticators(vault: string): Promise<ReadonlyArray<KeyringAuthenticator>>;
-    /** Mutate an authenticator slot's `meta` — see {@link TeamFacade.updateAuthenticator}. */
-    updateAuthenticator(vault: string, slotId: string, options: UpdateAuthenticatorOptions, factors?: FactorProofBundle): Promise<void>;
-    /** Native WebAuthn enrollment — see {@link TeamFacade.enrollWebAuthn}. */
-    enrollWebAuthn(vault: string, ceremony: (keyring: UnlockedKeyring) => Promise<EnrollAuthenticatorOptions>, factors?: FactorProofBundle): Promise<{
-        credentialId: string;
-    }>;
-    /** List webauthn-method slots — see {@link TeamFacade.listWebAuthnSlots}. */
-    listWebAuthnSlots(vault: string): Promise<ReadonlyArray<{
-        id: string;
-        enrolledAt: string;
-        credentialId: string;
-    }>>;
-    /** Unlock via a tier-2 authenticator slot — see {@link TeamFacade.unlockViaAuthenticator}. */
-    unlockViaAuthenticator(vault: string, slotId: string, verify: (slot: KeyringAuthenticator) => Promise<UnlockedKeyring>): Promise<UnlockedKeyring>;
     /**
      * Set the owner-curated cover for a vault. Throws
      * `ValidationError` if the developer did not opt the hub into
@@ -748,59 +758,6 @@ export declare class Noydb {
     getCover(vault: string, opts?: {
         readonly locale?: string;
     }): Promise<Cover | undefined>;
-    /** @deprecated Use {@link Noydb.setCover} (#799 rename). */
-    setPublicEnvelope(vault: string, input: SetCoverInput): Promise<Cover>;
-    /** @deprecated Use {@link Noydb.getCover} (#799 rename). */
-    getPublicEnvelope(vault: string, opts?: {
-        readonly locale?: string;
-    }): Promise<Cover | undefined>;
-    /** English summary of the configured auth model — see {@link TeamFacade.describeAuthConfig}. */
-    describeAuthConfig(vault: string): Promise<string>;
-    /** Mermaid `flowchart TB` source for the auth graph — see {@link TeamFacade.diagramAuthConfig}. */
-    diagramAuthConfig(vault: string): Promise<string>;
-    /** Per-user enrollment summary — see {@link TeamFacade.describeUserAuth}. */
-    describeUserAuth(vault: string, userId: string, factors?: FactorProofBundle): Promise<string>;
-    /** Bulk per-user enrollment summary — see {@link TeamFacade.describeAllUsersAuth}. */
-    describeAllUsersAuth(vault: string, factors?: FactorProofBundle): Promise<Array<{
-        userId: string;
-        description: string;
-    }>>;
-    /** Rotate the user's passphrase (user remembers old) — see {@link TeamFacade.rotatePassphrase}. */
-    rotatePassphrase(vault: string, input: RotatePassphraseInput, factors?: FactorProofBundle): Promise<void>;
-    /** Reset the passphrase using a recovery proof — see {@link TeamFacade.recoverPassphrase}. */
-    recoverPassphrase(vault: string, input: RecoverPassphraseInput, factors?: FactorProofBundle): Promise<RecoverPassphraseResult>;
-    /** Deliberate paper/Shamir recovery-code regeneration — see {@link TeamFacade.rotateRecovery}. */
-    rotateRecovery(vault: string, options: RotateRecoveryOptions, factors?: FactorProofBundle): Promise<RotateRecoveryResult>;
-    /** Atomic create-and-enroll for managed-mode vaults — see {@link TeamFacade.openVaultAndEnrollRecovery}. */
-    openVaultAndEnrollRecovery(vault: string, opts: {
-        readonly recovery: ReadonlyArray<RecoveryEnrollmentInput>;
-        readonly locale?: string;
-    }): Promise<{
-        readonly vault: Vault;
-        readonly recoveryEnrollments: ReadonlyArray<EnrollRecoveryResult>;
-    }>;
-    /** Recovery flow under managed-passphrase mode — see {@link TeamFacade.recoverManagedPassphrase}. */
-    recoverManagedPassphrase(vault: string, options: {
-        readonly recoveryProof: RecoveryProof;
-        readonly passphrasePolicy?: PassphrasePolicy;
-    }): Promise<void>;
-    /** Atomic peer-recovery of an existing user's keyring — see {@link TeamFacade.recoverUser}. */
-    recoverUser(vault: string, options: RecoverUserOptions, factors?: FactorProofBundle): Promise<void>;
-    /** Persist a recovery enrollment (paper or Shamir) — see {@link TeamFacade.enrollRecovery}. */
-    enrollRecovery(vault: string, enrollment: RecoveryEnrollmentInput): Promise<EnrollRecoveryResult>;
-    /** Read the persisted recovery entries (paper + Shamir) — see {@link TeamFacade.listRecoveryEntries}. */
-    listRecoveryEntries(vault: string): Promise<{
-        paper: ReadonlyArray<PaperRecoveryEntry>;
-        shamir: ReadonlyArray<ShamirRecoveryEntry>;
-    }>;
-    /** Register a tier-3 quick-unlock state — see {@link TeamFacade.enrollUnlock}. */
-    enrollUnlock(vault: string, state: QuickUnlockState, factors?: FactorProofBundle): Promise<void>;
-    /** Resume a session via the registered tier-3 state — see {@link TeamFacade.unlockViaPin}. */
-    unlockViaPin(vault: string, resume: (state: QuickUnlockState) => Promise<UnlockedKeyring>): Promise<UnlockedKeyring | undefined>;
-    /** Drop the tier-3 state for a vault — see {@link TeamFacade.clearQuickUnlock}. */
-    clearQuickUnlock(vault: string): void;
-    /** Public defensive-copy accessor for the unlocked keyring — see {@link TeamFacade.getKeyring}. */
-    getKeyring(vault: string): Promise<UnlockedKeyring>;
     /**
      * Live-reference variant used by the hub's own code paths. Internal
      * mutations on `deks` (e.g. {@link ensureCollectionDEK} adding a
@@ -811,7 +768,7 @@ export declare class Noydb {
     private _getKeyringInternal;
     /**
      * Take an on-demand checkpoint of the given vault.
-     * Requires `snapshotStrategy: withSnapshots({ store })` in `createNoydb`.
+     * Requires `snapshotsStrategy: withSnapshots({ store })` in `createNoydb`.
      * @throws ValidationError when the vault is not open
      */
     snapshot(vault: string, opts?: {

package/dist/kernel/query/builder.d.ts

@@ -9,10 +9,10 @@ import type { Clause, Operator } from './predicate.js';
 import type { CollectionIndexes } from '../../with-lookup/indexing/eager-indexes.js';
 import type { JoinContext, JoinLeg, JoinStrategy } from './join.js';
 import type { LiveQuery } from './live.js';
-import type { AggregateSpec, AggregateResult, Aggregation } from '../../with-lookup/aggregate/aggregation.js';
-import type { ReducerBuilder } from '../../with-lookup/aggregate/reducers.js';
-import type { GroupedQuery, GroupedQueryN } from '../../with-lookup/aggregate/groupby.js';
-import { type AggregateStrategy } from '../../with-lookup/aggregate/strategy.js';
+import type { ReduceSpec, ReduceResult, Reduction } from '../../with-lookup/reduce/reduction.js';
+import type { ReducerBuilder } from '../../with-lookup/reduce/reducers.js';
+import type { GroupedQuery, GroupedQueryN } from '../../with-lookup/reduce/groupby.js';
+import { type ReduceStrategy } from '../../with-lookup/reduce/strategy.js';
 import type { ViaPipeline } from '../via/pipeline.js';
 export interface OrderBy {
     readonly field: string;
@@ -114,9 +114,9 @@ export declare class Query<T, S extends keyof T = never, Q extends keyof T & str
     private readonly source;
     private readonly plan;
     private readonly joinContext;
-    private readonly aggregateStrategy;
+    private readonly reduceStrategy;
     private readonly predicates;
-    constructor(source: QuerySource<T>, plan?: QueryPlan, joinContext?: JoinContext, aggregateStrategy?: AggregateStrategy, predicates?: ReadonlyMap<string, DeclaredPredicate>);
+    constructor(source: QuerySource<T>, plan?: QueryPlan, joinContext?: JoinContext, reduceStrategy?: ReduceStrategy, predicates?: ReadonlyMap<string, DeclaredPredicate>);
     /**
      * @internal — accessor for the materialized-view dependency
      * analyzer. Not part of the public API; consumers should use the
@@ -353,9 +353,9 @@ export declare class Query<T, S extends keyof T = never, Q extends keyof T & str
      *   .run()
      * ```
      *
-     * Returns an `Aggregation<R>` wrapper with two terminals:
+     * Returns an `Reduction<R>` wrapper with two terminals:
      *   - `.run(): R` — synchronous one-shot reduction
-     *   - `.live(): LiveAggregation<R>` — reactive primitive that
+     *   - `.live(): LiveReduction<R>` — reactive primitive that
      *     re-runs the reduction whenever the source notifies of a
      *     change. Always call `live.stop()` when finished.
      *
@@ -391,8 +391,8 @@ export declare class Query<T, S extends keyof T = never, Q extends keyof T & str
      * aggregates over a collection with sensitive fields.
      *
      */
-    aggregate<Spec extends AggregateSpec>(spec: Spec): Aggregation<AggregateResult<Spec>>;
-    aggregate<Spec extends AggregateSpec>(build: (b: ReducerBuilder<T, S, M>) => Spec): Aggregation<AggregateResult<Spec>>;
+    aggregate<Spec extends ReduceSpec>(spec: Spec): Reduction<ReduceResult<Spec>>;
+    aggregate<Spec extends ReduceSpec>(build: (b: ReducerBuilder<T, S, M>) => Spec): Reduction<ReduceResult<Spec>>;
     /**
      * Partition matching records into buckets keyed by a field, then
      * terminate with `.aggregate(spec)` to compute per-bucket

package/dist/kernel/query/index.d.ts

@@ -20,12 +20,6 @@ export { applyJoins, DEFAULT_JOIN_MAX_ROWS, resetJoinWarnings } from './join.js'
 export type { JoinLeg, JoinContext, JoinableSource, JoinStrategy } from './join.js';
 export { buildLiveQuery } from './live.js';
 export type { LiveQuery, LiveUpstream } from './live.js';
-export { count, sum, avg, min, max, moneySum, moneyMin, moneyMax, reducerBuilder } from '../../with-lookup/aggregate/reducers.js';
-export type { Reducer, ReducerOptions, ReducerBuilder } from '../../with-lookup/aggregate/reducers.js';
-export { Aggregation, reduceRecords, buildLiveAggregation } from '../../with-lookup/aggregate/aggregation.js';
-export type { AggregateSpec, AggregateResult, AggregationUpstream, LiveAggregation, } from '../../with-lookup/aggregate/aggregation.js';
-export { GroupedQuery, GroupedQueryN, GroupedAggregation, groupAndReduce, resetGroupByWarnings, GROUPBY_WARN_CARDINALITY, GROUPBY_MAX_CARDINALITY, } from '../../with-lookup/aggregate/groupby.js';
-export type { GroupedRow, GroupedRowN } from '../../with-lookup/aggregate/groupby.js';
 export { ScanBuilder } from './scan-builder.js';
 export type { ScanPageProvider } from './scan-builder.js';
 export { GroupCardinalityError, IndexRequiredError, IndexWriteFailureError, JoinTooLargeError, DanglingReferenceError, CrossJoinTooLargeError, CrossJoinSourceUnknownError, FieldNotQueryableError, } from '../errors.js';

package/dist/kernel/query/scan-builder.d.ts

@@ -58,9 +58,9 @@
  *   - `scan().join(...)` — tracked under  (streaming join)
  */
 import type { QueryField } from '../types.js';
-import type { ReducerBuilder } from '../../with-lookup/aggregate/reducers.js';
+import type { ReducerBuilder } from '../../with-lookup/reduce/reducers.js';
 import type { Clause, Operator } from './predicate.js';
-import type { AggregateSpec, AggregateResult } from '../../with-lookup/aggregate/aggregation.js';
+import type { ReduceSpec, ReduceResult } from '../../with-lookup/reduce/reduction.js';
 import type { JoinContext, JoinLeg } from './join.js';
 import type { ViaPipeline } from '../via/pipeline.js';
 /**
@@ -321,8 +321,8 @@ export declare class ScanBuilder<T, S extends keyof T = never, M extends keyof T
      * method has never run and must not start running as a side effect of
      * this gate).
      */
-    aggregate<Spec extends AggregateSpec>(spec: Spec): Promise<AggregateResult<Spec>>;
-    aggregate<Spec extends AggregateSpec>(build: (b: ReducerBuilder<T, S, M>) => Spec): Promise<AggregateResult<Spec>>;
+    aggregate<Spec extends ReduceSpec>(spec: Spec): Promise<ReduceResult<Spec>>;
+    aggregate<Spec extends ReduceSpec>(build: (b: ReducerBuilder<T, S, M>) => Spec): Promise<ReduceResult<Spec>>;
     /**
      * Evaluate the clause list against a single record. Linear in
      * the clause count; short-circuits on first false. Clauses on a

package/dist/kernel/sync-policy.d.ts

@@ -20,7 +20,7 @@
  *
  * ```ts
  * const db = await createNoydb({
- *   store: jsonFile({ dir: './data' }),
+ *   store: toFile({ dir: './data' }),
  *   syncPolicy: {
  *     push: { mode: 'debounce', debounceMs: 5_000 },
  *     pull: { mode: 'on-focus' },
@@ -53,8 +53,11 @@ export type PushMode = 'manual' | 'on-change' | 'debounce' | 'interval';
  * - `'manual'` — only on explicit `sync.pull()` calls.
  * - `'interval'` — on a fixed `intervalMs` timer.
  * - `'on-focus'` — when the browser tab regains visibility.
+ * - `'phased'` — pull the collections named in `sequence`, in order, one at a
+ *   time, then settle into steady state. For thin clients that need their
+ *   navigation-critical collections before bulk history.
  */
-export type PullMode = 'manual' | 'interval' | 'on-focus';
+export type PullMode = 'manual' | 'interval' | 'on-focus' | 'phased';
 /**
  * Push half of a sync policy. Controls the trigger mode and timing guards
  * for outbound sync operations.
@@ -84,8 +87,22 @@ export interface PushPolicy {
 export interface PullPolicy {
     /** Pull trigger mode. */
     readonly mode: PullMode;
-    /** Interval in ms between automatic pulls. Used by `'interval'` mode. Default: 60_000. */
+    /**
+     * Interval in ms between automatic pulls. Used by `'interval'` mode. Default: 60_000.
+     * Under `'phased'` it is the steady-state cadence adopted *after* the sequence
+     * completes; omit it to go idle instead.
+     */
     readonly intervalMs?: number;
+    /**
+     * Collection names to pull in order, one at a time. Required when
+     * `mode: 'phased'` and rejected otherwise. Entries must be non-empty and
+     * unique — without period narrowing a repeated collection can only be a
+     * mistake, so it is rejected rather than silently merged.
+     *
+     * Period-scoped phases (`collection@period`) are deferred to `partitions`;
+     * use `db.pull(vault, { periods })` explicitly meanwhile.
+     */
+    readonly sequence?: readonly string[];
 }
 /**
  * Combined push + pull sync scheduling policy for a vault.
@@ -114,6 +131,25 @@ export declare const BUNDLE_STORE_POLICY: SyncPolicy;
  * - `'error'` — last sync operation failed; `lastError` holds the cause.
  */
 export type SyncSchedulerState = 'idle' | 'pending' | 'pushing' | 'pulling' | 'error';
+/**
+ * How much of a collection a caller may rely on, under a `'phased'` pull.
+ *
+ * - `'cold'` — not pulled yet, or its phase did not complete cleanly. A miss
+ *   from `get()` proves nothing.
+ * - `'pulling'` — its phase is in flight. Never terminal: a phase always ends
+ *   in `'live'` or back in `'cold'`, because a stuck `'pulling'` would leave a
+ *   permanent skeleton in the UI.
+ * - `'live'` — its phase completed cleanly, so a miss is a real absence.
+ */
+export type ReadinessState = 'cold' | 'pulling' | 'live';
+/**
+ * What a scheduler-initiated pull achieved, as reported by the callback.
+ *
+ * `'incomplete'` covers both a pull that reported errors (`PullResult.errors`
+ * accumulates without throwing) and one that was skipped — e.g. role-gated on a
+ * backup target. Either way nothing may be claimed about completeness.
+ */
+export type PullPhaseOutcome = 'complete' | 'incomplete';
 /**
  * Snapshot of the sync scheduler's state, returned by `SyncScheduler.status`.
  * Safe to expose in a reactive UI status indicator.
@@ -124,6 +160,18 @@ export interface SyncSchedulerStatus {
     readonly lastPullAt: string | null;
     readonly lastError: Error | null;
     readonly pendingWrites: number;
+    /**
+     * Per-collection readiness. Empty unless `pull.mode === 'phased'`.
+     *
+     * A collection the sequence never names is **absent** from the map, and
+     * `undefined` means *"no claim made"* — never a reason to gate a UI.
+     */
+    readonly readiness: ReadonlyMap<string, ReadinessState>;
+    /** 1-based position in the sequence, or `null` outside a phased run. */
+    readonly phase: {
+        readonly index: number;
+        readonly total: number;
+    } | null;
 }
 /**
  * Callbacks injected into `SyncScheduler` by the SyncEngine.
@@ -133,7 +181,13 @@ export interface SyncSchedulerStatus {
  */
 export interface SyncSchedulerCallbacks {
     push(): Promise<void>;
-    pull(): Promise<void>;
+    /**
+     * @param collections - Narrow the pull to these collections. Passed by a
+     * `'phased'` sequence, one collection per phase; omitted for a whole-vault pull.
+     * @returns Whether the pull may be treated as complete. Returning `void` reads
+     * as `'complete'`, so callers with nothing to report need not opt in.
+     */
+    pull(collections?: readonly string[]): Promise<PullPhaseOutcome | void>;
     getDirtyCount(): number;
 }
 /**
@@ -150,6 +204,8 @@ export declare class SyncScheduler {
     private _lastPullAt;
     private _lastError;
     private _lastPushTime;
+    private readonly _readiness;
+    private _phase;
     private debounceTimer;
     private pushIntervalTimer;
     private pullIntervalTimer;
@@ -175,6 +231,22 @@ export declare class SyncScheduler {
     forcePush(): Promise<void>;
     /** Force an immediate pull, bypassing the scheduler. */
     forcePull(): Promise<void>;
+    /**
+     * Arm the steady-state pull timer, if the policy specifies a cadence.
+     * Shared by `'interval'` mode and by `'phased'` once its sequence drains.
+     */
+    private startPullInterval;
+    /**
+     * Pull each collection in turn, then hand over to steady state.
+     *
+     * Strictly sequential — running phases concurrently would defeat the
+     * prioritisation that is the entire point of a sequence. Each phase is an
+     * ordinary scoped pull, so a phase that reports errors does not abort the
+     * ones behind it; `executePull` records the failure and the walk continues.
+     * `started` is re-checked between phases so `stop()` cuts a sequence short
+     * instead of letting it run on against a closed vault.
+     */
+    private runSequence;
     private executePush;
     private executePull;
     private resetDebounce;