@dereekb/firebase 13.43.0 → 14.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dereekb/firebase",
-  "version": "13.43.0",
+  "version": "14.0.1",
   "type": "module",
   "sideEffects": false,
   "exports": {
@@ -22,22 +22,22 @@
     }
   },
   "peerDependencies": {
-    "@dereekb/date": "13.43.0",
-    "@dereekb/model": "13.43.0",
-    "@dereekb/rxjs": "13.43.0",
-    "@dereekb/util": "13.43.0",
-    "@firebase/rules-unit-testing": "5.0.0",
-    "@marcbachmann/cel-js": "^7.6.1",
-    "@typescript-eslint/parser": "8.59.3",
+    "@dereekb/date": "14.0.1",
+    "@dereekb/model": "14.0.1",
+    "@dereekb/rxjs": "14.0.1",
+    "@dereekb/util": "14.0.1",
+    "@firebase/rules-unit-testing": "5.0.2",
+    "@marcbachmann/cel-js": "^8.0.0",
+    "@typescript-eslint/parser": "8.69.0",
     "arktype": "^2.2.0",
     "date-fns": "^4.1.0",
-    "firebase": "^12.12.1",
+    "firebase": "^12.18.0",
     "make-error": "^1.3.6",
     "rxjs": "^7.8.2",
     "ts-essentials": "^10.2.0"
   },
   "devDependencies": {
-    "eslint": "10.4.0"
+    "eslint": "10.9.1"
   },
   "module": "./index.esm.js",
   "main": "./index.esm.js",

package/src/lib/common/firestore/accessor/document.rxjs.d.ts

@@ -92,7 +92,3 @@ export declare function streamDocumentSnapshotDataPairs<D extends FirestoreDocum
  * @returns Observable emitting snapshot-data pairs for existing documents only, whenever any document changes.
  */
 export declare function streamDocumentSnapshotDataPairsWithData<D extends FirestoreDocument<any>>(documents: D[]): Observable<FirestoreDocumentSnapshotDataPairWithData<D>[]>;
-/**
- * @deprecated Use {@link streamDocumentSnapshotsData} instead.
- */
-export declare const latestDataFromDocuments: typeof streamDocumentSnapshotsData;

package/src/lib/common/firestore/query/accumulator.d.ts

@@ -1,4 +1,4 @@
-import { type ItemAccumulatorNextPageUntilResultsCountFunction, type ItemAccumulatorInstance, type ItemAccumulatorMapFunction, type PageItemIteration } from '@dereekb/rxjs';
+import { type ItemAccumulatorNextPageUntilResultsCountFunction, type ItemAccumulatorInstance, type ItemAccumulatorMapFunction, type PageItemIteration, type PageLoadingState } from '@dereekb/rxjs';
 import { type MapFunction } from '@dereekb/util';
 import { type DocumentDataWithIdAndKey, type QueryDocumentSnapshotArray } from '../types';
 import { type FirestoreItemPageIterationInstance } from './iterator';
@@ -11,7 +11,7 @@ import { type FirestoreItemPageIterationInstance } from './iterator';
  * @template O - The output type after mapping the query snapshots
  * @template T - The document data type in the snapshots
  */
-export type MappedFirebaseQuerySnapshotAccumulator<O, T> = ItemAccumulatorInstance<O, QueryDocumentSnapshotArray<T>, PageItemIteration<QueryDocumentSnapshotArray<T>>>;
+export type MappedFirebaseQuerySnapshotAccumulator<O, T> = ItemAccumulatorInstance<O, QueryDocumentSnapshotArray<T>, PageItemIteration<PageLoadingState<QueryDocumentSnapshotArray<T>>>>;
 /**
  * An accumulator that collects Firestore query snapshots without custom mapping.
  *

package/src/lib/common/firestore/query/iterator.d.ts

@@ -180,7 +180,7 @@ export declare const DEFAULT_FIRESTORE_ITEM_PAGE_ITERATOR_ITEMS_PER_PAGE = 50;
  * @__NO_SIDE_EFFECTS__
  */
 export declare function makeFirestoreItemPageIteratorDelegate<T>(): FirestoreItemPageIteratorDelegate<T>;
-export interface FirestoreItemPageIteration<T> extends MappedPageItemIterationInstance<QueryDocumentSnapshotArray<T>, FirestoreItemPageQueryResult<T>, PageLoadingState<QueryDocumentSnapshotArray<T>>, PageLoadingState<FirestoreItemPageQueryResult<T>>, InternalFirestoreItemPageIterationInstance<T>> {
+export interface FirestoreItemPageIteration<T> extends MappedPageItemIterationInstance<PageLoadingState<QueryDocumentSnapshotArray<T>>, PageLoadingState<FirestoreItemPageQueryResult<T>>, InternalFirestoreItemPageIterationInstance<T>> {
     /**
      * The underlying iteration instance that works with raw query snapshots.
      *

package/src/lib/common/model/function.d.ts

@@ -208,17 +208,3 @@ export declare function onCallCreateModelResultWithDocs(result: ArrayOrValue<Doc
  * @returns An {@link OnCallCreateModelResult} containing the keys as an array.
  */
 export declare function onCallCreateModelResult(modelKeys: ArrayOrValue<FirestoreModelKey>): OnCallCreateModelResult;
-/**
- * Creates OnCallTypedModelParams for the input.
- *
- * Convenience function for calling onCallTypedModelParamsFunction and executing it with the input.
- *
- * @param modelTypeInput - The model type string or ref.
- * @param data - The call payload.
- * @param specifier - Optional sub-function specifier.
- * @param call - The CRUD call type.
- * @returns The constructed {@link OnCallTypedModelParams}
- *
- * @deprecated Move towards using onCallTypedModelParamsFunction directly with the call type instead of using this function. Will not be removed in the future.
- */
-export declare function onCallTypedModelParams<T>(modelTypeInput: FirestoreModelType | FirestoreModelTypeRef, data: T, specifier?: string, call?: OnCallFunctionType): OnCallTypedModelParams<T>;

package/src/lib/model/formspace/formspace.api.d.ts

@@ -75,6 +75,26 @@ export interface SubmitFormSpaceResult {
      */
     readonly processingTaskCreated: boolean;
 }
+/**
+ * Parameters for reopening a submitted FormSpace back into an editable draft.
+ *
+ * No options: whether the space may be reopened is the type's policy plus the caller's `reopen` role, and
+ * neither is anything a client gets to say. The acting user is taken from the request, never the body,
+ * because it is what `rby` records.
+ *
+ * @dbxModelApiParams
+ */
+export interface ReopenFormSpaceParams extends TargetModelParams {
+}
+export declare const reopenFormSpaceParamsType: Type<ReopenFormSpaceParams>;
+/**
+ * Parameters for locking a submitted FormSpace's submission immediately.
+ *
+ * @dbxModelApiParams
+ */
+export interface LockFormSpaceParams extends TargetModelParams {
+}
+export declare const lockFormSpaceParamsType: Type<LockFormSpaceParams>;
 /**
  * Parameters for removing one uploaded file from a FormSpace slot.
  *
@@ -175,6 +195,8 @@ export type FormSpaceModelCrudFunctionsConfig = {
         update: {
             _: UpdateFormSpaceParams;
             submit: [SubmitFormSpaceParams, SubmitFormSpaceResult];
+            reopen: ReopenFormSpaceParams;
+            lock: LockFormSpaceParams;
             removeFile: RemoveFormSpaceFileParams;
         };
         delete: {
@@ -197,6 +219,8 @@ export declare abstract class FormSpaceFunctions implements ModelFirebaseFunctio
         updateFormSpace: {
             update: ModelFirebaseCrudFunction<UpdateFormSpaceParams>;
             submit: ModelFirebaseCrudFunction<SubmitFormSpaceParams, SubmitFormSpaceResult>;
+            reopen: ModelFirebaseCrudFunction<ReopenFormSpaceParams>;
+            lock: ModelFirebaseCrudFunction<LockFormSpaceParams>;
             removeFile: ModelFirebaseCrudFunction<RemoveFormSpaceFileParams>;
         };
         deleteFormSpace: {

package/src/lib/model/formspace/formspace.api.error.d.ts

@@ -15,6 +15,31 @@ export declare const FORM_SPACE_TYPE_NOT_REGISTERED_ERROR_CODE = "FORM_SPACE_TYP
  * Thrown when a FormSpace is edited, uploaded into, or submitted after it stopped being a draft.
  */
 export declare const FORM_SPACE_NOT_EDITABLE_ERROR_CODE = "FORM_SPACE_NOT_EDITABLE";
+/**
+ * Thrown when a FormSpace's submission is locked before the space was ever submitted.
+ *
+ * A lock ends a reopen window early, so there has to be a submission for it to be about. A space that was
+ * submitted and then reopened DOES qualify — locking a reopened draft is how a reviewer says "this next
+ * submission is the last one".
+ */
+export declare const FORM_SPACE_NOT_SUBMITTED_ERROR_CODE = "FORM_SPACE_NOT_SUBMITTED";
+/**
+ * Thrown when a submitted FormSpace is reopened after it stopped being reopenable.
+ *
+ * TERMINAL, unlike {@link FORM_SPACE_PROCESSING_IN_PROGRESS_ERROR_CODE}: the type never allowed reopening,
+ * the reopen window has closed, `lat` has passed, or `maxReopens` is spent. Retrying cannot help, so the
+ * caller should be told the submission is final rather than asked to wait.
+ */
+export declare const FORM_SPACE_NOT_REOPENABLE_ERROR_CODE = "FORM_SPACE_NOT_REOPENABLE";
+/**
+ * Thrown when a FormSpace is reopened while its submission is actively being processed.
+ *
+ * Transient by nature — the same reopen succeeds once the processor concludes — which is why it is not
+ * folded into {@link FORM_SPACE_NOT_REOPENABLE_ERROR_CODE}. Reopening under a running processor would race
+ * it: the task's cleanup writes `ps`/`cpat`/`pn` and would land them on a space already handed back as a
+ * draft.
+ */
+export declare const FORM_SPACE_PROCESSING_IN_PROGRESS_ERROR_CODE = "FORM_SPACE_PROCESSING_IN_PROGRESS";
 /**
  * Thrown when a FormSpace is submitted while one of its type's required slots is still empty.
  */

package/src/lib/model/formspace/formspace.d.ts

@@ -31,9 +31,11 @@ export declare const formSpaceIdentity: import("../..").RootFirestoreModelIdenti
 /**
  * Lifecycle state of a {@link FormSpace}.
  *
- * Only DRAFT is editable. The other three are terminal for the owner: SUBMITTED is awaiting or undergoing
- * processing, EXPIRED was retired by the sweep before it was ever submitted, and ARCHIVED is a space kept
- * for the record after its processing concluded.
+ * Only DRAFT is editable. SUBMITTED is awaiting or undergoing processing, and is the one state a space can
+ * come BACK from: a type declaring a reopen policy lets a caller holding the `reopen` role return the space
+ * to DRAFT until it is fully locked. EXPIRED (retired by the sweep before it was ever submitted) and
+ * ARCHIVED (kept for the record after processing concluded) stay terminal — {@link isFormSpaceReopenable}
+ * requires SUBMITTED, so neither is reachable by a reopen.
  */
 export declare enum FormSpaceState {
     DRAFT = 0,
@@ -295,11 +297,25 @@ export interface FormSpace<T extends FormSpaceData = FormSpaceData> {
      */
     uat: Date;
     /**
-     * The date the space was submitted, if it was. Its presence IS the lock.
+     * The date the CURRENT submission was made, if the space is submitted. Its presence IS the lock.
+     *
+     * Cleared by a reopen, which is what hands the space back as an editable draft, so it always describes
+     * the submission in force NOW rather than the history. `fsat` is what remembers the first one.
      *
      * @dbxModelVariable submittedAt
      */
     sat?: Maybe<Date>;
+    /**
+     * The date the space was FIRST submitted, if it ever was.
+     *
+     * Never cleared. Since a reopen clears `sat`, without this the fact that the space was submitted at all —
+     * and when — would be destroyed by the first reopen. It is also the anchor
+     * {@link resolveFormSpaceLocksAt} measures the type's `reopenableUntil` from, which is what stops a
+     * reopen/resubmit round from walking the lock deadline forward.
+     *
+     * @dbxModelVariable firstSubmittedAt
+     */
+    fsat?: Maybe<Date>;
     /**
      * The date processing of the submission concluded, if it has.
      *
@@ -316,6 +332,54 @@ export interface FormSpace<T extends FormSpaceData = FormSpaceData> {
      * @dbxModelVariable expiresAt
      */
     eat?: Maybe<Date>;
+    /**
+     * The date reopening stops being possible — the instant the submission becomes FULLY LOCKED.
+     *
+     * Written once, on the first submit, as `fsat + reopenableUntil`, and never moved afterwards; an explicit
+     * lock sets it to that moment instead. Absent means there is no CEILING, not that the space is locked:
+     * the type's `reopenableFor` is the master switch, and a type declaring neither is simply never
+     * reopenable. The same "an absent field is an absent gate" convention `eat` uses.
+     *
+     * Stored as an ISO8601 string like every other date here, which means `firestore.rules` CANNOT compare it
+     * against `request.time` — rules convert only bool/int/float/null to a string, never a timestamp. A
+     * downstream app that needs the lock predicate inside its OWN rules has to denormalize a unix-seconds
+     * mirror onto its own model and compare that. Reading this field over a callable, or over the `get` the
+     * rules already grant, needs no mirror at all.
+     *
+     * @dbxModelVariable locksAt
+     */
+    lat?: Maybe<Date>;
+    /**
+     * The user who locked the submission early, when a caller did rather than the deadline passing.
+     *
+     * @dbxModelVariable lockedBy
+     */
+    lby?: Maybe<FirebaseAuthUserId>;
+    /**
+     * Monotonic count of times this space has been REOPENED after a submission.
+     *
+     * Doubles as the submission-attempt generation. The submission task is keyed by it, so a resubmit gets a
+     * fresh task instead of colliding with the finished one, and a task still carrying a stale count is
+     * fenced off rather than clobbering the attempt in force.
+     *
+     * Monotonic for the same reason `uc` is: it counts rounds that happened, and a counter something can
+     * rewind is not a bound. Capped by the type's `maxReopens`.
+     *
+     * @dbxModelVariable reopenCount
+     */
+    rc: number;
+    /**
+     * The date the space was last reopened, if it ever was.
+     *
+     * @dbxModelVariable reopenedAt
+     */
+    rat?: Maybe<Date>;
+    /**
+     * The user who last reopened the space.
+     *
+     * @dbxModelVariable reopenedBy
+     */
+    rby?: Maybe<FirebaseAuthUserId>;
 }
 /**
  * Permission roles for FormSpace operations.
@@ -334,8 +398,15 @@ export interface FormSpace<T extends FormSpaceData = FormSpaceData> {
  * context to build a role map from — so `uploadFile` is the DECLARATION of who may contribute, and
  * `FormSpaceUploadAuthorizationDelegate` is where the same app policy is actually applied. Grant them
  * together, to the same people.
+ *
+ * `reopen` and `lock` are the two halves of undoing that door, and are separate from each other as much as
+ * from `submit`. `reopen` returns a submitted space to DRAFT; WHETHER it may be reopened at all is the
+ * type's own policy, re-asserted inside the action's transaction, so the role only says who is allowed to
+ * ask. `lock` goes the other way and ends the reopen window early — in a two-party flow that is a
+ * privilege the party who submitted should not automatically hold over the party reviewing, which is
+ * exactly why it is not folded into `reopen`.
  */
-export type FormSpaceRoles = GrantedReadRole | GrantedUpdateRole | GrantedDeleteRole | 'submit' | 'uploadFile' | 'removeFile';
+export type FormSpaceRoles = GrantedReadRole | GrantedUpdateRole | GrantedDeleteRole | 'submit' | 'uploadFile' | 'removeFile' | 'reopen' | 'lock';
 /**
  * Firestore document wrapper for a {@link FormSpace}.
  *

package/src/lib/model/formspace/formspace.task.d.ts

@@ -1,7 +1,7 @@
 import { type Maybe } from '@dereekb/util';
 import { type CreateNotificationTaskTemplate } from '../notification/notification.create.task';
 import { type NotificationTaskSubtaskCheckpointString, type NotificationTaskSubtaskData, type NotificationTaskSubtaskMetadata } from '../notification/notification.task.subtask';
-import { type NotificationTaskType } from '../notification/notification.id';
+import { type NotificationTaskType, type NotificationTaskUniqueId } from '../notification/notification.id';
 import { type FormSpaceDocument } from './formspace';
 import { type FormSpaceId, type FormSpaceType } from './formspace.id';
 /**
@@ -12,6 +12,14 @@ import { type FormSpaceId, type FormSpaceType } from './formspace.id';
  * ONE task type for every form type. The task's SUBTASK TARGET is the {@link FormSpaceType}, so a new form
  * type registers a processor rather than a task type — the same specialization
  * `StorageFileProcessingNotificationTask` already does by purpose.
+ *
+ * ONE task per SUBMISSION ATTEMPT, not per space. A unique task's document id is derived and permanent, and
+ * a completed task is only marked done (`d`) — it lingers until the cleanup sweep collects it. So a space
+ * that is reopened and resubmitted would re-derive the id of its own finished task, and
+ * `createOrRunUniqueNotificationDocument` would find it already there and do nothing at all: the space
+ * would sit in QUEUED_FOR_PROCESSING pointing at a dead document forever. Keying the id by the space's
+ * reopen count is what keeps each attempt a document of its own, and the first attempt keeps the exact id
+ * it has always had.
  */
 /**
  * NotificationTask type identifier for FormSpace submission processing.
@@ -43,26 +51,79 @@ export interface FormSpaceSubmissionNotificationTaskData<M extends FormSpaceSubm
      * so subsequent runs do not re-read the document only to learn which processor to dispatch to.
      */
     readonly t?: Maybe<FormSpaceType>;
+    /**
+     * The space's reopen count when this task was created — the submission ATTEMPT this task belongs to.
+     *
+     * The handler compares it against the space's current count and terminates when they differ. Without
+     * that fence a task left over from a superseded attempt would process the reopened space's new content
+     * and its cleanup would write `ps`/`cpat`/`pn` over the attempt actually in force. Absent on a task
+     * created before attempt-keying existed, which is read as "do not fence".
+     */
+    readonly rc?: Maybe<number>;
 }
 /**
  * Input for {@link formSpaceSubmissionNotificationTaskTemplate}.
  */
-export interface FormSpaceSubmissionNotificationTaskInput<M extends FormSpaceSubmissionSubtaskMetadata = FormSpaceSubmissionSubtaskMetadata> extends Omit<FormSpaceSubmissionNotificationTaskData<M>, 'formSpace' | 't' | 'sfps'> {
+export interface FormSpaceSubmissionNotificationTaskInput<M extends FormSpaceSubmissionSubtaskMetadata = FormSpaceSubmissionSubtaskMetadata> extends Omit<FormSpaceSubmissionNotificationTaskData<M>, 'formSpace' | 't' | 'sfps' | 'rc'> {
     readonly formSpaceDocument: FormSpaceDocument;
+    /**
+     * The space's current reopen count — the attempt this task is for. Defaults to 0, the first submission.
+     */
+    readonly reopenCount?: Maybe<number>;
     readonly overrideExistingTask?: Maybe<boolean>;
 }
+/**
+ * Input for {@link formSpaceSubmissionNotificationTaskUniqueId}.
+ */
+export interface FormSpaceSubmissionNotificationTaskUniqueIdInput {
+    readonly formSpaceId: FormSpaceId;
+    /**
+     * The attempt's reopen count. Defaults to 0, the first submission.
+     */
+    readonly reopenCount?: Maybe<number>;
+}
+/**
+ * Returns the unique NotificationTask document id processing one SUBMISSION ATTEMPT of a FormSpace.
+ *
+ * The first attempt is the bare {@link notificationTaskUniqueId}, unsuffixed, so a space submitted before
+ * reopening existed keeps the exact document it already has. Every attempt after a reopen appends its
+ * count, which is what stops a resubmit from colliding with the finished task of the attempt before it.
+ *
+ * The `r` between the separators keeps the suffix from ever being able to produce a `__` run, whatever a
+ * FormSpace id happens to contain — Firestore reserves ids wrapped in double underscores, and staying well
+ * clear of them costs one character.
+ *
+ * Exported so a caller that has to LOCATE an attempt's task — a test asserting which document a resubmit
+ * created, or tooling inspecting a stuck submission — derives the id the same way the template does. The
+ * reopen action deliberately does not need it: the superseded attempt's task is left alone, either already
+ * done and awaiting the cleanup sweep or still queued and about to fence itself off.
+ *
+ * @param input - The FormSpace id and the attempt's reopen count.
+ * @returns The unique notification task id.
+ *
+ * @example
+ * ```ts
+ * formSpaceSubmissionNotificationTaskUniqueId({ formSpaceId: 'abc' }); // 'abc_FSPS'
+ * formSpaceSubmissionNotificationTaskUniqueId({ formSpaceId: 'abc', reopenCount: 2 }); // 'abc_FSPS_r2'
+ * ```
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function formSpaceSubmissionNotificationTaskUniqueId(input: FormSpaceSubmissionNotificationTaskUniqueIdInput): NotificationTaskUniqueId;
 /**
  * Creates a {@link CreateNotificationTaskTemplate} for a FormSpace submission task.
  *
- * The task is UNIQUE to the FormSpace: a space submits once, and a second template for the same space must
- * resolve to the same document rather than racing a second processor against the first.
+ * The task is UNIQUE to one submission ATTEMPT of the FormSpace. Within an attempt that uniqueness is what
+ * makes a second template resolve to the same document rather than racing a second processor against the
+ * first; across attempts, {@link formSpaceSubmissionNotificationTaskUniqueId} keys them apart so a resubmit
+ * after a reopen gets a document — and a checkpoint flow — of its own.
  *
- * @param input - The target FormSpaceDocument and optional subtask data.
+ * @param input - The target FormSpaceDocument, its reopen count, and optional subtask data.
  * @returns A CreateNotificationTaskTemplate for the submission task.
  *
  * @example
  * ```ts
- * const template = formSpaceSubmissionNotificationTaskTemplate({ formSpaceDocument: doc });
+ * const template = formSpaceSubmissionNotificationTaskTemplate({ formSpaceDocument: doc, reopenCount: formSpace.rc });
  * ```
  */
 export declare function formSpaceSubmissionNotificationTaskTemplate(input: FormSpaceSubmissionNotificationTaskInput): CreateNotificationTaskTemplate;

package/src/lib/model/formspace/formspace.type.d.ts

@@ -153,6 +153,39 @@ export interface FormSpaceTypeConfig {
      * the sweep's inequality query.
      */
     readonly expiresIn?: Maybe<Milliseconds>;
+    /**
+     * How long after EACH submission a space of this type may be reopened, returning it to an editable draft.
+     *
+     * THE MASTER SWITCH. When absent the type is never reopenable and submission stays the one-way door it
+     * has always been — which is what makes the whole reopen feature opt-in, and why no existing type can
+     * acquire resubmit semantics by accident.
+     *
+     * Distinct from {@link expiresIn}, which bounds the lifetime of the DRAFT. This bounds the lifetime of
+     * the SUBMISSION's mutability.
+     *
+     * Rolling by default: absent {@link reopenableUntil}, every submission grants a fresh window measured
+     * from its own `sat`.
+     */
+    readonly reopenableFor?: Maybe<Milliseconds>;
+    /**
+     * A hard ceiling on reopening, measured from the FIRST submission rather than the current one.
+     *
+     * Materialized onto the space as `lat` on its first submit and never moved, so repeated reopen/resubmit
+     * rounds cannot walk the deadline forward the way a purely rolling {@link reopenableFor} lets them. Use
+     * it when "this submission is final N hours after it was first made" has to be a wall-clock guarantee.
+     *
+     * Absent leaves {@link reopenableFor} rolling. Meaningless on its own: {@link reopenableFor} is what
+     * permits a reopen at all, and this only narrows it.
+     */
+    readonly reopenableUntil?: Maybe<Milliseconds>;
+    /**
+     * How many times a space of this type may be reopened. Counted against the space's monotonic `rc`.
+     *
+     * Absent leaves the count unbounded and the windows above the only limit — which is fine for a
+     * {@link reopenableUntil} ceiling, and worth setting deliberately for a purely rolling window, where a
+     * resubmit keeps earning a new one.
+     */
+    readonly maxReopens?: Maybe<number>;
 }
 /**
  * Default for {@link FormSpaceTypeConfig.maxUploads}.

package/src/lib/model/formspace/formspace.util.d.ts

@@ -89,18 +89,61 @@ export interface FormSpaceTemplateInput<T extends FormSpaceData = FormSpaceData>
  * @__NO_SIDE_EFFECTS__
  */
 export declare function formSpaceTemplate<T extends FormSpaceData = FormSpaceData>(input: FormSpaceTemplateInput<T>): FormSpace<T>;
+/**
+ * Input for {@link submitFormSpaceTemplate}.
+ */
+export interface SubmitFormSpaceTemplateInput {
+    /**
+     * The space being submitted. Read to tell a FIRST submission from a resubmission after a reopen.
+     */
+    readonly formSpace: Pick<FormSpace, 'fsat'>;
+    readonly config: FormSpaceTypeConfig;
+    /**
+     * The submission instant. Defaults to now.
+     */
+    readonly now?: Maybe<Date>;
+}
 /**
  * Builds the update template that submits a FormSpace.
  *
  * Clearing `eat` is not tidiness: a submitted space that kept its expiration instant would still match the
  * expiration sweep and be retired out from under the processing task.
  *
- * @param now - The submission instant. Defaults to now.
+ * `fsat` and the lock deadline `lat` are written ONLY on the first submission and are left untouched by a
+ * resubmission. That asymmetry is the whole first-submit anchor: recomputing `lat` here would let a
+ * reopen/resubmit round walk the deadline forward indefinitely, which is precisely what
+ * {@link FormSpaceTypeConfig.reopenableUntil} exists to prevent.
+ *
+ * @param input - The space, its type config, and the submission instant.
  * @returns The update template.
  *
  * @__NO_SIDE_EFFECTS__
  */
-export declare function submitFormSpaceTemplate(now?: Maybe<Date>): Partial<FormSpace>;
+export declare function submitFormSpaceTemplate(input: SubmitFormSpaceTemplateInput): Partial<FormSpace>;
+/**
+ * Input for {@link resolveFormSpaceLocksAt}.
+ */
+export interface ResolveFormSpaceLocksAtInput {
+    readonly config: FormSpaceTypeConfig;
+    /**
+     * The instant the space was first submitted — the anchor the ceiling is measured from.
+     */
+    readonly firstSubmittedAt: Date;
+}
+/**
+ * Returns the instant a submitted FormSpace of the given type becomes permanently locked, or null when its
+ * type declares no ceiling.
+ *
+ * The mirror of {@link resolveFormSpaceExpiresAt}, and null is meaningful in the same way: it is what
+ * leaves `lat` unwritten, and an unwritten `lat` is what leaves the type's `reopenableFor` rolling from
+ * each submission rather than capped.
+ *
+ * @param input - The type config and the first-submission instant.
+ * @returns The lock instant, or null when the type declares no ceiling.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function resolveFormSpaceLocksAt(input: ResolveFormSpaceLocksAtInput): Maybe<Date>;
 /**
  * Builds the update template that expires a FormSpace.
  *
@@ -132,6 +175,129 @@ export interface IsFormSpaceEditableInput {
  * @__NO_SIDE_EFFECTS__
  */
 export declare function isFormSpaceEditable(input: IsFormSpaceEditableInput): boolean;
+/**
+ * Input for {@link isFormSpaceReopenable}.
+ */
+export interface IsFormSpaceReopenableInput {
+    readonly formSpace: Pick<FormSpace, 's' | 'sat' | 'lat' | 'rc'>;
+    readonly config: FormSpaceTypeConfig;
+    /**
+     * The instant to judge against. Defaults to now.
+     */
+    readonly now?: Maybe<Date>;
+}
+/**
+ * Returns true when a submitted FormSpace may still be reopened into an editable draft.
+ *
+ * POLICY ONLY. It answers "does the type still allow this", not "is right now a safe moment" — a space
+ * whose processor is mid-run is reopenable by this predicate and refused by the action, because
+ * `ps === PROCESSING` is transient and telling a user their space is permanently locked while a task
+ * finishes would be a lie. The action owns that check; this owns the window.
+ *
+ * Requires SUBMITTED, which is what keeps EXPIRED and ARCHIVED terminal for free.
+ *
+ * @param input - The space, its type config, and the instant to judge against.
+ * @returns True when the space may be reopened.
+ *
+ * @example
+ * ```ts
+ * const canReopen = isFormSpaceReopenable({ formSpace, config });
+ * ```
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function isFormSpaceReopenable(input: IsFormSpaceReopenableInput): boolean;
+/**
+ * Input for {@link isFormSpaceFullyLocked}.
+ */
+export interface IsFormSpaceFullyLockedInput {
+    readonly formSpace: Pick<FormSpace, 's' | 'sat' | 'eat' | 'lat' | 'rc'>;
+    readonly config: FormSpaceTypeConfig;
+    /**
+     * The instant to judge against. Defaults to now.
+     */
+    readonly now?: Maybe<Date>;
+}
+/**
+ * Returns true when nothing further can be done to a FormSpace: it is neither editable nor reopenable.
+ *
+ * Derived from the other two predicates rather than testing the fields itself, so the three answers can
+ * never disagree about one space. There is deliberately no FULLY_LOCKED {@link FormSpaceState} — a new
+ * enum member would fork every `s === SUBMITTED` check in the framework and downstream, to express
+ * something both existing predicates already know.
+ *
+ * @param input - The space, its type config, and the instant to judge against.
+ * @returns True when the space is fully locked.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function isFormSpaceFullyLocked(input: IsFormSpaceFullyLockedInput): boolean;
+/**
+ * Input for {@link reopenFormSpaceTemplate}.
+ */
+export interface ReopenFormSpaceTemplateInput {
+    readonly formSpace: Pick<FormSpace, 'rc' | 'lat'>;
+    readonly config: FormSpaceTypeConfig;
+    /**
+     * The user reopening the space, recorded on `rby`.
+     */
+    readonly uid?: Maybe<FirebaseAuthUserId>;
+    /**
+     * The reopen instant. Defaults to now.
+     */
+    readonly now?: Maybe<Date>;
+}
+/**
+ * Builds the update template that reopens a submitted FormSpace into an editable draft.
+ *
+ * It has to undo all THREE of {@link isFormSpaceEditable}'s conditions rather than just the state: a
+ * template that moved `s` back to DRAFT while leaving `sat` set, or leaving `eat` at the null submit wrote,
+ * produces a "draft" that either nothing can edit or nothing can ever retire.
+ *
+ * `eat` is re-armed to the EARLIER of a fresh `expiresIn` window and the space's own lock deadline, so the
+ * reopened draft can never outlive the window it was reopened inside. When the type declares neither, `eat`
+ * stays absent and the draft does not expire — the same bargain a type with no `expiresIn` already makes
+ * for a freshly created space.
+ *
+ * `uc` and `fi` are deliberately NOT rewound. `uc` bounds uploads ACCEPTED over the space's lifetime, so
+ * refunding it here would turn `maxUploads` into a bound on files retained that a reopen loop could evade;
+ * `fi` must never hand out an index twice. A type that expects replacement uploads has to budget
+ * `maxUploads` for them. `fsat` is likewise preserved — it is the record a reopen exists to not destroy.
+ *
+ * @param input - The space, its type config, the acting user, and the reopen instant.
+ * @returns The update template.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function reopenFormSpaceTemplate(input: ReopenFormSpaceTemplateInput): Partial<FormSpace>;
+/**
+ * Input for {@link lockFormSpaceTemplate}.
+ */
+export interface LockFormSpaceTemplateInput {
+    /**
+     * The user locking the space, recorded on `lby`.
+     */
+    readonly uid?: Maybe<FirebaseAuthUserId>;
+    /**
+     * The lock instant. Defaults to now.
+     */
+    readonly now?: Maybe<Date>;
+}
+/**
+ * Builds the update template that locks a submitted FormSpace's submission immediately.
+ *
+ * Only `lat` moves. The lock is not a state transition — the space stays SUBMITTED and its processing is
+ * untouched — it is the end of the reopen window, brought forward from whatever the type's
+ * `reopenableUntil` would have made it. Writing `lat` in the past is what makes every reopen predicate
+ * answer false from this instant on, including for a type whose window was purely rolling and so never
+ * had a `lat` at all.
+ *
+ * @param input - The acting user and the lock instant.
+ * @returns The update template.
+ *
+ * @__NO_SIDE_EFFECTS__
+ */
+export declare function lockFormSpaceTemplate(input: LockFormSpaceTemplateInput): Partial<FormSpace>;
 /**
  * Returns the slot config a type declares for the given slot, or null when it declares none.
  *

package/src/lib/model/notification/notification.task.d.ts

@@ -12,7 +12,9 @@
  * 2. Server picks it up via the send queue and routes to the registered handler
  * 3. Handler returns a result indicating completion, partial progress, delay, or failure
  * 4. Server updates the notification document accordingly and re-queues if not done
- * 5. On completion (`true`), the notification document is deleted
+ * 5. On completion (`true`), the notification document is marked done (`d`) — NOT deleted. It stops
+ *    matching the send queue immediately, but the document itself lingers until the cleanup sweep collects
+ *    it, so a caller re-deriving a unique task's id can still find the finished one sitting there.
  */
 import { type NotificationItem, type NotificationItemMetadata } from './notification.item';
 import { type NotificationTaskType } from './notification.id';