@noy-db/hub 0.3.0-pre.6 → 0.3.0-pre.8

package/dist/{chunk-D6ADQ4QL.js → chunk-56JB2BGI.js}

@@ -1,6 +1,6 @@
 import {
   loadVaultPolicy
-} from "./chunk-T45LAT2Y.js";
+} from "./chunk-BTFTHF6Q.js";
 import {
   jsonSchemaToFields
 } from "./chunk-TQ3REHVF.js";
@@ -9,7 +9,7 @@ import {
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-4I4UNXHM.js";
+} from "./chunk-5HRJQSKN.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
@@ -22,14 +22,14 @@ import {
 } from "./chunk-5JQMX2EH.js";
 import {
   loadFence
-} from "./chunk-YFF2RP3X.js";
+} from "./chunk-L6Q5NA22.js";
 import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH,
   VectorSet,
   buildPersistedIndexCallbacks
-} from "./chunk-CYWF3JJE.js";
+} from "./chunk-XBPUVQDO.js";
 import {
   derivePersistedSchema,
   isZod4Schema
@@ -42,7 +42,7 @@ import {
   CustodyApi,
   NO_CARGO,
   NO_CUSTODY
-} from "./chunk-GGFT2XFF.js";
+} from "./chunk-723XB5NX.js";
 import {
   ServiceBus,
   WriteHookRegistry,
@@ -50,7 +50,7 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "./chunk-NL4HVTNO.js";
+} from "./chunk-QABECTNN.js";
 import {
   NO_ATTESTATION
 } from "./chunk-LFGJG4XZ.js";
@@ -62,7 +62,7 @@ import {
 import {
   NO_TIERS,
   classifySealedShred
-} from "./chunk-7A7LTSJR.js";
+} from "./chunk-4VDFUBTS.js";
 import {
   NO_PORTABILITY
 } from "./chunk-II6DLDZM.js";
@@ -70,8 +70,12 @@ import {
   runDrainBarrier
 } from "./chunk-EU7HDMT3.js";
 import {
-  PERIODS_COLLECTION
-} from "./chunk-OCVO2V63.js";
+  PERIODS_COLLECTION,
+  PERIOD_ARCHIVES_COLLECTION,
+  PERIOD_FREEZES_COLLECTION,
+  PERIOD_TARGET_PURGES_COLLECTION,
+  periodExclusiveUpperBound
+} from "./chunk-37JZR7CY.js";
 import {
   TxContext,
   revertExecuted
@@ -83,7 +87,7 @@ import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-PLQCXH75.js";
+} from "./chunk-PPPZIBKY.js";
 import {
   LazyQuery,
   decodeIdxId,
@@ -97,11 +101,11 @@ import {
 import {
   resolveManagedSecret,
   saveSealedPassphrase
-} from "./chunk-VWGCJUTV.js";
+} from "./chunk-P2PEPSPK.js";
 import {
   isDictCollectionName,
   isStaticDictDescriptor
-} from "./chunk-WQAT24C2.js";
+} from "./chunk-PMMV5SQC.js";
 import {
   NO_TEAM,
   enrollAuthenticator,
@@ -112,7 +116,7 @@ import {
   rotatePassphrase,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-UZZFV3O3.js";
+} from "./chunk-NTPWQH4S.js";
 import {
   hasRecoveryEnrolled,
   hasStrongRecoveryEnrolled,
@@ -122,7 +126,7 @@ import {
   mintShamirRecoveryEntry,
   savePaperRecoveryEntries,
   saveShamirRecoveryEntries
-} from "./chunk-3UUXDQPM.js";
+} from "./chunk-FWART3VA.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-VQNJ7UZL.js";
@@ -138,17 +142,17 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-WAL4MRBK.js";
+} from "./chunk-TUL5YQWF.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-C6A2DPRE.js";
+} from "./chunk-FZK3JJJK.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
   sha256Hex
-} from "./chunk-TWJVOYU2.js";
+} from "./chunk-UMH35AQV.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -157,7 +161,7 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-SXLMLECV.js";
+} from "./chunk-VVLOWY74.js";
 import {
   NO_SEALED_RECORD
 } from "./chunk-XW5LZYV4.js";
@@ -170,14 +174,16 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-7AGLCOYE.js";
+} from "./chunk-7TAV3BFQ.js";
 import {
+  buildDeleteMarker,
   buildTombstone,
+  isDeleteMarker,
   isTombstone
-} from "./chunk-QKVILR7N.js";
+} from "./chunk-PVC2FBCQ.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-LN22XH4B.js";
+} from "./chunk-REWTMYSF.js";
 import {
   encrypt
 } from "./chunk-5HZULLHE.js";
@@ -240,7 +246,7 @@ import {
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-JJCEMTAE.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-NJDDZ264.js");
   return new StoreCoordinationProvider(store);
 }
 
@@ -2373,7 +2379,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-COBBJORL.js");
+      const { resolveStaleMVOnRead } = await import("./stale-77LP2EEF.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     let record;
@@ -2384,7 +2390,7 @@ var Collection = class {
       } else {
         const envelope = await this.adapter.get(this.vault, this.name, id);
         if (!envelope) return null;
-        if (isTombstone(envelope, this.storeCiphertext)) return null;
+        if (isTombstone(envelope, this.storeCiphertext) || isDeleteMarker(envelope)) return null;
         record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
         if (record === null) return null;
         this.lru.set(id, { record, version: envelope._v }, estimateRecordBytes(record));
@@ -2834,14 +2840,15 @@ var Collection = class {
       return;
     }
     let existing;
+    let priorRaw = null;
     if (this.lazy && this.lru) {
       existing = this.lru.get(id);
       if (!existing) {
-        const previousEnvelope = await this.adapter.get(this.vault, this.name, id);
-        if (previousEnvelope) {
-          const previousRecord = await this.codec.decryptRecord(previousEnvelope);
+        priorRaw = await this.adapter.get(this.vault, this.name, id);
+        if (priorRaw) {
+          const previousRecord = await this.codec.decryptRecord(priorRaw);
           if (previousRecord !== null) {
-            existing = { record: previousRecord, version: previousEnvelope._v };
+            existing = { record: previousRecord, version: priorRaw._v };
           }
         }
       }
@@ -2849,7 +2856,11 @@ var Collection = class {
       await this.ensureHydrated();
       existing = await this.resolvePriorValues(id);
     }
-    const version = existing ? existing.version + 1 : 1;
+    let version = existing ? existing.version + 1 : 1;
+    if (!existing && this.onDirty) {
+      if (priorRaw === null) priorRaw = await this.adapter.get(this.vault, this.name, id);
+      if (priorRaw && isDeleteMarker(priorRaw)) version = priorRaw._v + 1;
+    }
     this.uniqueConstraints?.check(id, record);
     const cek = this.perRecordCek ? await this.resolveRecordCek(id) : void 0;
     const vdigCtx = this.vdigFields !== null ? { id, prev: await this.adapter.get(this.vault, this.name, id) } : void 0;
@@ -2936,7 +2947,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-XWPD5PIM.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-MHUM2VZK.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -2945,7 +2956,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-COBBJORL.js");
+          staleHelpers = await import("./stale-77LP2EEF.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -2975,7 +2986,7 @@ var Collection = class {
       if (this.sensitiveFields.size > 0) {
         const cached = this.lru.get(id);
         const env = await this.adapter.get(this.vault, this.name, id);
-        if (!env || isTombstone(env, this.storeCiphertext)) return null;
+        if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) return null;
         raw = await this.codec.decryptRecord(env, { id });
         if (raw === null) return null;
         if (!cached) {
@@ -2986,7 +2997,7 @@ var Collection = class {
         if (cached) raw = cached.record;
         else {
           const env = await this.adapter.get(this.vault, this.name, id);
-          if (!env || isTombstone(env, this.storeCiphertext)) return null;
+          if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) return null;
           raw = await this.codec.decryptRecord(env, { id });
           if (raw === null) return null;
           this.lru.set(id, { record: raw, version: env._v }, estimateRecordBytes(raw));
@@ -3149,7 +3160,7 @@ var Collection = class {
           const outputCollection = this.derivationSource.getCollection(outSpec.collection);
           const txCtx = this.derivationSource.getActiveTxContext();
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-SSEW7BQB.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-NBDKKCHT.js");
             const prior = await loadFanoutSidecar(this.adapter, this.vault, spec.source, run.runId, key, this.getDEK, this.storeCiphertext);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -3269,7 +3280,7 @@ var Collection = class {
     let count = 0;
     for (const id of ids) {
       const env = await this.adapter.get(this.vault, this.name, id);
-      if (!env || isTombstone(env, this.storeCiphertext)) continue;
+      if (!env || isTombstone(env, this.storeCiphertext) || isDeleteMarker(env)) continue;
       const decoded = await this.codec.decryptRecord(env, { skipValidation: true, id });
       if (decoded === null) continue;
       const record = decoded;
@@ -3398,7 +3409,15 @@ var Collection = class {
     }
     const previousEnvelope = await this.adapter.get(this.vault, this.name, id);
     const previousPayloadHash = await this.historyStrategy.envelopePayloadHash(previousEnvelope);
-    await this.adapter.delete(this.vault, this.name, id);
+    let markerVersion;
+    if (this.onDirty) {
+      const live = previousEnvelope;
+      if (!live || isTombstone(live, this.storeCiphertext) || isDeleteMarker(live)) return;
+      markerVersion = live._v + 1;
+      await this.adapter.put(this.vault, this.name, id, buildDeleteMarker(markerVersion, this.keyring.userId));
+    } else {
+      await this.adapter.delete(this.vault, this.name, id);
+    }
     if (this.ledger) {
       await this.ledger.append({
         op: "delete",
@@ -3421,7 +3440,7 @@ var Collection = class {
         this.uniqueConstraints?.remove(id, existing.record);
       }
     }
-    await this.onDirty?.(this.name, id, "delete", existing?.version ?? 0);
+    await this.onDirty?.(this.name, id, "put", markerVersion ?? (existing?.version ?? 0) + 1);
     this.emitter.emit("change", {
       vault: this.vault,
       collection: this.name,
@@ -3473,11 +3492,12 @@ var Collection = class {
   }
   async _writeTombstone(id, actor) {
     const live = await this.adapter.get(this.vault, this.name, id);
-    if (!live || isTombstone(live, this.storeCiphertext)) return null;
+    if (!live || isTombstone(live, this.storeCiphertext) || isDeleteMarker(live)) return null;
     await this.adapter.put(this.vault, this.name, id, buildTombstone(live._v, actor));
     this.cache.delete(id);
     this.lru?.remove(id);
     this.cekCache?.remove(id);
+    await this.onDirty?.(this.name, id, "put", live._v);
     return { previousVersion: live._v };
   }
   /**
@@ -3502,7 +3522,7 @@ var Collection = class {
       for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
         if (outSpec.shape !== "array") continue;
         if (helpers === null) {
-          helpers = await import("./fanout-sidecar-SSEW7BQB.js");
+          helpers = await import("./fanout-sidecar-NBDKKCHT.js");
         }
         const sidecar = await helpers.loadFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey, this.getDEK, this.storeCiphertext);
         if (!sidecar) continue;
@@ -3536,7 +3556,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-XWPD5PIM.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-MHUM2VZK.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -3545,7 +3565,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-COBBJORL.js");
+          staleHelpers = await import("./stale-77LP2EEF.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -3568,7 +3588,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-COBBJORL.js");
+      const { resolveStaleMVOnRead } = await import("./stale-77LP2EEF.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     await this.ensureHydrated();
@@ -4261,7 +4281,7 @@ var Collection = class {
     const ids = await this.adapter.list(this.vault, this.name);
     for (const id of ids) {
       const envelope = await this.adapter.get(this.vault, this.name, id);
-      if (envelope && !isTombstone(envelope, this.storeCiphertext)) {
+      if (envelope && !isTombstone(envelope, this.storeCiphertext) && !isDeleteMarker(envelope)) {
         const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
         if (record === null) continue;
         this.cache.set(id, { record, version: envelope._v });
@@ -4274,7 +4294,7 @@ var Collection = class {
   /** Hydrate from a pre-loaded snapshot (used by Vault). */
   async hydrateFromSnapshot(records) {
     for (const [id, envelope] of Object.entries(records)) {
-      if (isTombstone(envelope, this.storeCiphertext)) continue;
+      if (isTombstone(envelope, this.storeCiphertext) || isDeleteMarker(envelope)) continue;
       const record = await this.codec.decryptRecord(envelope, { id, sealedAsHandles: true });
       if (record === null) continue;
       this.cache.set(id, { record, version: envelope._v });
@@ -4722,14 +4742,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./config-drift-SWZNEH5H.js");
+    const { persistClassifiedMarkerForFields } = await import("./config-drift-RFEVGBKR.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./config-drift-SWZNEH5H.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./config-drift-RFEVGBKR.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5208,7 +5228,7 @@ var VaultPeriods = class {
       ...anchor.priorPeriodName !== void 0 && { priorPeriodName: anchor.priorPeriodName },
       ...options.dateField !== void 0 && { dateField: options.dateField }
     };
-    const envelope = await this.writePeriodRecord(record);
+    const envelope = await this.writeReserved(PERIODS_COLLECTION, record.name, record);
     await this.deps.strategy.appendPeriodLedgerEntry(this.deps.getLedgerOrNull(), this.deps.userId(), envelope, record.name);
     existing.push(record);
     this.periodCache = existing;
@@ -5263,20 +5283,208 @@ var VaultPeriods = class {
       priorPeriodName: anchor.priorPeriodName ?? prior.name,
       ...openingCollections.length > 0 && { openingCollections }
     };
-    const envelope = await this.writePeriodRecord(record);
+    const envelope = await this.writeReserved(PERIODS_COLLECTION, record.name, record);
     await this.deps.strategy.appendPeriodLedgerEntry(this.deps.getLedgerOrNull(), this.deps.userId(), envelope, record.name);
     existing.push(record);
     this.periodCache = existing;
     return record;
   }
-  /** Return every closed / opened period in `closedAt` order. */
+  /**
+   * Freeze a closed period: physically purges delete markers whose `_ts`
+   * falls inside the period's window (#604) and records the fact in a
+   * companion `_period_freezes/<name>` record. NEVER mutates the
+   * hash-chained `_periods/<name>` record's stored bytes — `frozenAt` /
+   * `frozenBy` / `purgedMarkerCount` are merged into `PeriodRecord`s on
+   * read only. Idempotent: a second call is a no-op that returns the
+   * same merged record without re-purging or re-appending a ledger entry.
+   */
+  async freezePeriod(name) {
+    const existing = await this.loadPeriodsCache();
+    const period = existing.find((p) => p.name === name);
+    if (!period) throw new ValidationError(`freezePeriod: no period named "${name}".`);
+    if (period.kind !== "closed") {
+      throw new ValidationError(
+        `freezePeriod: period "${name}" is "${period.kind}"; only a closed period can be frozen.`
+      );
+    }
+    const before = periodExclusiveUpperBound(period.endDate);
+    if (Date.parse(before) > Date.now()) {
+      throw new ValidationError(
+        `freezePeriod: period "${name}" purge window ends at ${before}, in the future; only a period whose window is fully in the past can be frozen (recent delete markers may not have converged).`
+      );
+    }
+    const prior = await this.readReserved(PERIOD_FREEZES_COLLECTION, name);
+    if (prior) return this.mergeFreeze(period, prior);
+    const purgedMarkerCount = await this.deps.purgeDeleteMarkers(before);
+    const freeze = {
+      period: name,
+      frozenAt: (/* @__PURE__ */ new Date()).toISOString(),
+      frozenBy: this.deps.userId(),
+      purgedMarkerCount
+    };
+    const envelope = await this.writeReserved(PERIOD_FREEZES_COLLECTION, name, freeze);
+    await this.deps.strategy.appendPeriodLedgerEntry(
+      this.deps.getLedgerOrNull(),
+      this.deps.userId(),
+      envelope,
+      name,
+      PERIOD_FREEZES_COLLECTION
+    );
+    return this.mergeFreeze(period, freeze);
+  }
+  /**
+   * Archive a closed period (#613): physically relocates its in-window
+   * records (those with `_ts < periodExclusiveUpperBound(endDate)`) from the
+   * hot store to the configured cold tier via `archiveRecords`, and records
+   * the fact in a companion `_period_archives/<name>` record. NEVER mutates
+   * the hash-chained `_periods/<name>` record. Non-destructive (reads fall
+   * through to cold) and idempotent: a second call is a no-op returning the
+   * same merged record.
+   */
+  async archivePeriod(name) {
+    const existing = await this.loadPeriodsCache();
+    const period = existing.find((p) => p.name === name);
+    if (!period) throw new ValidationError(`archivePeriod: no period named "${name}".`);
+    if (period.kind !== "closed") {
+      throw new ValidationError(
+        `archivePeriod: period "${name}" is "${period.kind}"; only a closed period can be archived.`
+      );
+    }
+    const prior = await this.readReserved(PERIOD_ARCHIVES_COLLECTION, name);
+    if (prior) return this.mergeArchive(period, prior);
+    const before = periodExclusiveUpperBound(period.endDate);
+    const archivedRecordCount = await this.deps.archiveRecords(before);
+    const archive = {
+      period: name,
+      archivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      archivedBy: this.deps.userId(),
+      archivedRecordCount
+    };
+    const envelope = await this.writeReserved(PERIOD_ARCHIVES_COLLECTION, name, archive);
+    await this.deps.strategy.appendPeriodLedgerEntry(
+      this.deps.getLedgerOrNull(),
+      this.deps.userId(),
+      envelope,
+      name,
+      PERIOD_ARCHIVES_COLLECTION
+    );
+    return this.mergeArchive(period, archive);
+  }
+  /**
+   * Target-purge a closed period (#615): sweeps delete markers off the vault's
+   * PUSH-ONLY sync targets (`backup`/`archive`) via `purgeTargets`, recording a
+   * companion `_period_target_purges/<name>` record. `sync-peer` targets are
+   * skipped (resurrection risk). NEVER mutates the chained `_periods/<name>`
+   * record. Requires the period be frozen first (closed → frozen → target-purged).
+   * Idempotent once run; with no push-only targets it writes no companion and
+   * is re-runnable.
+   */
+  async purgePeriodTargets(name) {
+    const existing = await this.loadPeriodsCache();
+    const period = existing.find((p) => p.name === name);
+    if (!period) throw new ValidationError(`purgePeriodTargets: no period named "${name}".`);
+    if (period.kind !== "closed") {
+      throw new ValidationError(
+        `purgePeriodTargets: period "${name}" is "${period.kind}"; only a closed period can be target-purged.`
+      );
+    }
+    const frozen = await this.readReserved(PERIOD_FREEZES_COLLECTION, name);
+    if (!frozen) {
+      throw new ValidationError(
+        `purgePeriodTargets: period "${name}" must be frozen first (closed \u2192 frozen \u2192 target-purged).`
+      );
+    }
+    const prior = await this.readReserved(PERIOD_TARGET_PURGES_COLLECTION, name);
+    if (prior) return this.mergeTargetPurge(period, prior);
+    const before = periodExclusiveUpperBound(period.endDate);
+    const targets = await this.deps.purgeTargets(before);
+    if (targets.length === 0) return period;
+    const record = {
+      period: name,
+      purgedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      purgedBy: this.deps.userId(),
+      targets
+    };
+    const envelope = await this.writeReserved(PERIOD_TARGET_PURGES_COLLECTION, name, record);
+    await this.deps.strategy.appendPeriodLedgerEntry(
+      this.deps.getLedgerOrNull(),
+      this.deps.userId(),
+      envelope,
+      name,
+      PERIOD_TARGET_PURGES_COLLECTION
+    );
+    return this.mergeTargetPurge(period, record);
+  }
+  /** Merge target-purge companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
+  mergeTargetPurge(period, record) {
+    return {
+      ...period,
+      targetsPurgedAt: record.purgedAt,
+      targetsPurgedBy: record.purgedBy,
+      targetsPurged: record.targets
+    };
+  }
+  /** Merge archive companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
+  mergeArchive(period, archive) {
+    return {
+      ...period,
+      archivedAt: archive.archivedAt,
+      archivedBy: archive.archivedBy,
+      archivedRecordCount: archive.archivedRecordCount
+    };
+  }
+  /** Merge freeze companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
+  mergeFreeze(period, freeze) {
+    return {
+      ...period,
+      frozenAt: freeze.frozenAt,
+      frozenBy: freeze.frozenBy,
+      purgedMarkerCount: freeze.purgedMarkerCount
+    };
+  }
+  /** Return every closed / opened period in `closedAt` order, merged with any freeze + archive companions. */
   async listPeriods() {
-    return [...await this.loadPeriodsCache()];
+    const all = await this.loadPeriodsCache();
+    const freezeIds = await this.deps.adapter.list(this.deps.vault, PERIOD_FREEZES_COLLECTION);
+    const freezes = /* @__PURE__ */ new Map();
+    for (const id of freezeIds) {
+      const f = await this.readReserved(PERIOD_FREEZES_COLLECTION, id);
+      if (f) freezes.set(f.period, f);
+    }
+    const archiveIds = await this.deps.adapter.list(this.deps.vault, PERIOD_ARCHIVES_COLLECTION);
+    const archives = /* @__PURE__ */ new Map();
+    for (const id of archiveIds) {
+      const a = await this.readReserved(PERIOD_ARCHIVES_COLLECTION, id);
+      if (a) archives.set(a.period, a);
+    }
+    const targetPurgeIds = await this.deps.adapter.list(this.deps.vault, PERIOD_TARGET_PURGES_COLLECTION);
+    const targetPurges = /* @__PURE__ */ new Map();
+    for (const id of targetPurgeIds) {
+      const tp = await this.readReserved(PERIOD_TARGET_PURGES_COLLECTION, id);
+      if (tp) targetPurges.set(tp.period, tp);
+    }
+    return all.map((p) => {
+      const f = freezes.get(p.name);
+      let merged = f ? this.mergeFreeze(p, f) : p;
+      const a = archives.get(p.name);
+      if (a) merged = this.mergeArchive(merged, a);
+      const tp = targetPurges.get(p.name);
+      if (tp) merged = this.mergeTargetPurge(merged, tp);
+      return merged;
+    });
   }
-  /** Look up a single period by name. Returns `null` if not found. */
+  /** Look up a single period by name, merged with its freeze + archive + target-purge companions if any. Returns `null` if not found. */
   async getPeriod(name) {
     const all = await this.loadPeriodsCache();
-    return all.find((p) => p.name === name) ?? null;
+    const period = all.find((p) => p.name === name);
+    if (!period) return null;
+    const freeze = await this.readReserved(PERIOD_FREEZES_COLLECTION, name);
+    const archive = await this.readReserved(PERIOD_ARCHIVES_COLLECTION, name);
+    let merged = freeze ? this.mergeFreeze(period, freeze) : period;
+    if (archive) merged = this.mergeArchive(merged, archive);
+    const targetPurge = await this.readReserved(PERIOD_TARGET_PURGES_COLLECTION, name);
+    if (targetPurge) merged = this.mergeTargetPurge(merged, targetPurge);
+    return merged;
   }
   /** Called by the gate bus before put/delete. */
   async assertTsWritable(existing, incoming) {
@@ -5301,11 +5509,12 @@ var VaultPeriods = class {
     this.periodCache = loaded;
     return loaded;
   }
-  async writePeriodRecord(record) {
-    const json = JSON.stringify(record);
+  /** Generic reserved-collection writer — serves `_periods` and `_period_freezes` alike. */
+  async writeReserved(collection, key, value) {
+    const json = JSON.stringify(value);
     let envelope;
     if (this.deps.encrypted) {
-      const dek = await this.deps.getDEK(PERIODS_COLLECTION);
+      const dek = await this.deps.getDEK(collection);
       const { iv, data } = await encrypt(json, dek);
       envelope = {
         _noydb: NOYDB_FORMAT_VERSION,
@@ -5325,9 +5534,16 @@ var VaultPeriods = class {
         _by: this.deps.userId()
       };
     }
-    await this.deps.adapter.put(this.deps.vault, PERIODS_COLLECTION, record.name, envelope);
+    await this.deps.adapter.put(this.deps.vault, collection, key, envelope);
     return envelope;
   }
+  /** Generic reserved-collection reader — serves `_period_freezes` companion reads. */
+  async readReserved(collection, key) {
+    const env = await this.deps.adapter.get(this.deps.vault, collection, key);
+    if (!env) return null;
+    const json = this.deps.encrypted ? await openEnvelopeJson(env, await this.deps.getDEK(collection)) : env._data;
+    return JSON.parse(json);
+  }
   async decryptPeriodRecord(envelope) {
     let json;
     if (this.deps.encrypted) {
@@ -5776,7 +5992,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-HJOC7GB7.js").then(
+  const load = () => engine ??= import("./link-set-NSUIX6BR.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -5900,7 +6116,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-BIXGCZ2M.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-KOFRTCDD.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -6431,6 +6647,7 @@ var Vault = class {
   onDirty;
   onRegisterConflictResolver;
   syncAdapter;
+  getPurgeableTargets;
   historyConfig;
   /**
    * tree-shake seam for the optional blob service. Undefined
@@ -6696,6 +6913,7 @@ var Vault = class {
     this.onDirty = opts.onDirty;
     this.onRegisterConflictResolver = opts.onRegisterConflictResolver;
     this.syncAdapter = opts.syncAdapter;
+    this.getPurgeableTargets = opts.getPurgeableTargets ?? (() => []);
     this.blobStrategy = opts.blobStrategy;
     this.objectStore = opts.objectStore;
     this.archiveStrategy = opts.archiveStrategy;
@@ -6718,7 +6936,10 @@ var Vault = class {
       userId: () => this.keyring.userId,
       getDEK: (collection) => this.getDEK(collection),
       getLedgerOrNull: () => this.getLedgerOrNull(),
-      collection: (name) => this.collection(name)
+      collection: (name) => this.collection(name),
+      purgeDeleteMarkers: (before) => this._purgeDeleteMarkers(before),
+      archiveRecords: (before) => this._archiveClosedPeriod(before),
+      purgeTargets: (before) => this._purgePeriodTargets(before)
     });
     this.linksEnforcer = new VaultLinks({
       refRegistry: this.refRegistry,
@@ -6921,7 +7142,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-OVONZ2MJ.js");
+          const { persistSchemaIfNeeded } = await import("./register-3D6R2MKN.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -7100,7 +7321,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-OVONZ2MJ.js")).persistSchemaIfNeeded({
+            await (await import("./register-3D6R2MKN.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -7175,6 +7396,83 @@ var Vault = class {
     if (!coll) return;
     await coll._applyRemoteChange(docId, action);
   }
+  /** @internal #598: refresh cache entries a sync-applied write rewrote underneath us. No-op if not loaded this session. */
+  async _invalidateSyncApplied(collection, id) {
+    const coll = this.collectionCache.get(collection);
+    if (!coll) return;
+    coll._invalidateCekCacheEntry(id);
+    await coll._invalidateCacheEntry(id);
+  }
+  /**
+   * @internal #589 → #604. Physically remove delete markers with `_ts` strictly
+   * older than `before` (ISO timestamp), across `collections` (or all data
+   * collections). Returns the count removed.
+   *
+   * SAFETY: purging a marker RE-OPENS the #589 resurrection window for any peer
+   * offline since before the cutoff — never-GC is safe precisely because the marker
+   * is always present to win convergence. This is an operator-asserted safe-point
+   * ONLY; #604's period-close lifecycle is what earns that assertion. Do not call
+   * it on live/unsettled data.
+   *
+   * Emits no ledger/event itself — its callers (#604's `freezePeriod`, #615's
+   * `purgePeriodTargets`) own the audit record. The sweep body is shared via
+   * {@link _purgeMarkersOn}, which #615 also aims at push-only sync targets.
+   *
+   * Purges the local adapter only. Markers already pushed to the vault's
+   * push-only (`backup`/`archive`) sync targets are reclaimed by #615's
+   * `vault.purgePeriodTargets`; `sync-peer` targets are left untouched (purging
+   * them would re-open the resurrection window — the deferred half of #611).
+   */
+  async _purgeDeleteMarkers(before, collections) {
+    return this._purgeMarkersOn(this.adapter, before, collections);
+  }
+  /**
+   * @internal #615. Sweep delete markers with `_ts < before` off ANY store
+   * (local adapter or a push-only sync target). Returns the count removed.
+   */
+  async _purgeMarkersOn(store, before, collections) {
+    const snapshot = await store.loadAll(this.name);
+    let removed = 0;
+    for (const [coll, records] of Object.entries(snapshot)) {
+      if (collections && !collections.includes(coll)) continue;
+      for (const [id, env] of Object.entries(records)) {
+        if (isDeleteMarker(env) && env._ts < before) {
+          await store.delete(this.name, coll, id);
+          removed++;
+        }
+      }
+    }
+    return removed;
+  }
+  /**
+   * @internal #613. Relocate this closed period's in-window records (those
+   * with `_ts < before`) from the hot store to the configured cold tier,
+   * via the routeStore's `compact({ before })`. Returns the count moved.
+   * Requires a `routeStore` with a cold route (the `coldArchival`
+   * capability); throws a clear error otherwise. Non-destructive — reads
+   * fall through to cold, so this does NOT re-open the #589 window.
+   */
+  async _archiveClosedPeriod(before) {
+    const store = this.adapter;
+    if (store.capabilities?.coldArchival !== true || typeof store.compact !== "function") {
+      throw new ValidationError("archivePeriod: cold archival requires a routeStore with a cold route.");
+    }
+    return store.compact(this.name, { before });
+  }
+  /**
+   * @internal #615. Sweep delete markers with `_ts < before` off each of the
+   * vault's push-only sync targets, returning a per-target count. Skips
+   * `sync-peer` targets by construction (getPurgeableTargets yields only
+   * backup/archive). Never touches the local adapter.
+   */
+  async _purgePeriodTargets(before) {
+    const out = [];
+    for (const t of this.getPurgeableTargets()) {
+      const purgedCount = await this._purgeMarkersOn(t.store, before);
+      out.push({ ...t.label !== void 0 ? { label: t.label } : {}, role: t.role, purgedCount });
+    }
+    return out;
+  }
   /**
    * For a detected conflict: capture this tab's clobbered record,
    * read the common ancestor from history, converge the cache to the store's
@@ -8214,7 +8512,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-D5J7SVJ2.js"),
+      import("./registry-WIX6QCV5.js"),
       import("./read-only-facade-5ADRJVTM.js")
     ]);
     const registry = new DerivationRegistry();
@@ -8245,7 +8543,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-AIEYUOSG.js");
+    const { MaterializedViewRegistry } = await import("./registry-AI4E46PD.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -8316,13 +8614,13 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-XWPD5PIM.js");
+    const { MaterializedViewExecutor } = await import("./executor-MHUM2VZK.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this
     });
-    const { clearMVStale } = await import("./stale-COBBJORL.js");
+    const { clearMVStale } = await import("./stale-77LP2EEF.js");
     clearMVStale(registry, name);
     return result;
   }
@@ -8363,7 +8661,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-SSEW7BQB.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-NBDKKCHT.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -8585,7 +8883,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-AUY42TGU.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-IHXOASHV.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
@@ -8607,7 +8905,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-AUY42TGU.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-IHXOASHV.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -8794,6 +9092,38 @@ var Vault = class {
   async getPeriod(name) {
     return this.periods.getPeriod(name);
   }
+  /**
+   * Freeze a closed period (#604): purges in-window delete markers and
+   * records a `_period_freezes` companion, never mutating the chained
+   * `_periods` record. Idempotent. Purges the LOCAL adapter only — a
+   * synced target's markers survive there and re-import on pull (benign),
+   * and purging re-opens the #589 resurrection window for a peer offline
+   * since before the cutoff (see periods.ts's "Freeze" section).
+   */
+  async freezePeriod(name) {
+    return this.periods.freezePeriod(name);
+  }
+  /**
+   * Archive a closed period (#613): relocates its in-window records from the
+   * hot store to the configured cold tier (via the routeStore's cold route),
+   * recording a `_period_archives` companion + ledger entry, never mutating
+   * the chained `_periods` record. Non-destructive (reads fall through to
+   * cold) and idempotent. Requires a routeStore with a cold route.
+   */
+  async archivePeriod(name) {
+    return this.periods.archivePeriod(name);
+  }
+  /**
+   * Target-purge a closed+frozen period (#615): sweeps delete markers off the
+   * vault's push-only sync targets (`backup`/`archive`), recording a
+   * `_period_target_purges` companion + ledger entry, never mutating the chained
+   * `_periods` record. `sync-peer` targets are skipped. Requires the period be
+   * frozen first. Idempotent; a vault with no push-only targets writes no
+   * companion and is re-runnable.
+   */
+  async purgePeriodTargets(name) {
+    return this.periods.purgePeriodTargets(name);
+  }
   /** @internal — called by the gate bus before put/delete. */
   async _assertTsWritable(existing, incoming) {
     return this.periods.assertTsWritable(existing, incoming);
@@ -8823,7 +9153,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-CVNXFUEF.js");
+    const { dumpVaultSchema } = await import("./walk-SMAE4IEI.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -8958,7 +9288,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getPublicEnvelope(opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-6UBQ4IUY.js");
+    const { readPublicEnvelope } = await import("./public-envelope-NC7SPNMV.js");
     return readPublicEnvelope(this.adapter, this.name, opts);
   }
   /**
@@ -8973,7 +9303,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-Y3RMFGVX.js");
+    const { dumpVault } = await import("./backup-WRGNTGJF.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -9025,7 +9355,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-Y3RMFGVX.js");
+    const { loadVault } = await import("./backup-WRGNTGJF.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -9057,7 +9387,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-Y3RMFGVX.js");
+    const { verifyBackupIntegrity } = await import("./backup-WRGNTGJF.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -9275,7 +9605,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-Y3RMFGVX.js");
+    const { exportVaultJSON } = await import("./backup-WRGNTGJF.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -10903,6 +11233,7 @@ function createPlaintextKeyring(userId, debugPlaintext = false) {
     ...debugPlaintext ? { debugPlaintext } : {}
   };
 }
+var emptyPullResult = () => ({ pulled: 0, conflicts: [], errors: [] });
 var Noydb = class {
   options;
   emitter = new NoydbEventEmitter();
@@ -11319,6 +11650,7 @@ var Noydb = class {
       } : void 0,
       onRegisterConflictResolver: syncEngine ? (resolverName, resolver) => syncEngine.registerConflictResolver(resolverName, resolver) : void 0,
       syncAdapter: targets.length > 0 ? targets[0].store : void 0,
+      getPurgeableTargets: () => targets.filter((t) => t.role === "backup" || t.role === "archive").map((t) => ({ store: t.store, role: t.role, ...t.label !== void 0 ? { label: t.label } : {} })),
       historyConfig: this.options.history,
       ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
       ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
@@ -11365,6 +11697,9 @@ var Noydb = class {
         return refreshed;
       } : void 0
     });
+    this._forEachSyncEngine(name, (engine) => {
+      engine.setCacheInvalidator((collection, id) => comp._invalidateSyncApplied(collection, id));
+    });
     await comp._initGuards(this.options.guardStrategies ?? []);
     await comp._initDerivations(this.options.derivationStrategies ?? []);
     await comp._initMaterializedViews(this.options.materializedViewStrategies ?? []);
@@ -11836,9 +12171,13 @@ var Noydb = class {
     const engine = this.getSyncEngine(vault);
     return engine.push(options);
   }
-  /** Pull remote changes to local for a vault. */
+  /**
+   * Pull remote changes to local for a vault. A `backup`/`archive` primary is a
+   * push-only sink and is never pulled from (#616) — returns an empty result.
+   */
   async pull(vault, options) {
     const engine = this.getSyncEngine(vault);
+    if (engine.role !== "sync-peer") return emptyPullResult();
     return engine.pull(options);
   }
   /**
@@ -11847,7 +12186,7 @@ var Noydb = class {
    */
   async sync(vault, options) {
     const primary = this.getSyncEngine(vault);
-    const result = await primary.sync(options);
+    const result = primary.role === "sync-peer" ? await primary.sync(options) : { pull: emptyPullResult(), push: await primary.push(options?.push) };
     for (const [key, engine] of this.syncEngines) {
       if (key === vault) continue;
       if (!key.startsWith(`${vault}::`)) continue;
@@ -12404,7 +12743,7 @@ var Noydb = class {
         "setPublicEnvelope: the public-envelope feature is not enabled. Pass `publicEnvelope: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-6UBQ4IUY.js");
+    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-NC7SPNMV.js");
     const schema = resolveSchema(this.options.publicEnvelope);
     validatePublicEnvelopeInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -12433,7 +12772,7 @@ var Noydb = class {
    * regardless).
    */
   async getPublicEnvelope(vault, opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-6UBQ4IUY.js");
+    const { readPublicEnvelope } = await import("./public-envelope-NC7SPNMV.js");
     return readPublicEnvelope(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
@@ -12624,9 +12963,9 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-OQ65LUSK.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-JDWL67WL.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-3ZKSGSRK.js");
+    const policyModule = await import("./policy-Y7HL2KGA.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -12661,4 +13000,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-D6ADQ4QL.js.map
+//# sourceMappingURL=chunk-56JB2BGI.js.map