@noy-db/hub 0.3.0-pre.7 → 0.3.0-pre.8

package/dist/adapter/index.d.ts

@@ -1,4 +1,4 @@
-export { dq as BundleVersionConflictError, f0 as ConflictError, cV as EncryptedEnvelope, gy as ListPageResult, h5 as NetworkError, hb as NoydbBundleStore, cT as NoydbStore, iX as StoreCapabilities, iY as StoreCapabilityError, iZ as StoreTime, jn as TxOp, jC as VaultSnapshot } from '../index-BJ3L-XcV.js';
+export { dy as BundleVersionConflictError, f8 as ConflictError, d1 as EncryptedEnvelope, gG as ListPageResult, hd as NetworkError, hj as NoydbBundleStore, c$ as NoydbStore, j3 as StoreCapabilities, j4 as StoreCapabilityError, j5 as StoreTime, jv as TxOp, jK as VaultSnapshot } from '../index-Dn5GzPg_.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';

package/dist/aggregate/index.d.ts

@@ -1,5 +1,5 @@
-import { aO as AggregateStrategy } from '../index-BJ3L-XcV.js';
-export { aP as AggregateResult, aQ as AggregateSpec, aR as Aggregation, aS as AggregationUpstream, aT as GROUPBY_MAX_CARDINALITY, aU as GROUPBY_WARN_CARDINALITY, aV as GroupedAggregation, aW as GroupedQuery, aX as GroupedQueryN, aY as GroupedRow, aZ as GroupedRowN, a_ as LiveAggregation, a$ as Reducer, b0 as ReducerBuilder, b1 as ReducerOptions, b2 as avg, b3 as buildLiveAggregation, b4 as count, b5 as groupAndReduce, b6 as max, b7 as min, b8 as moneyMax, b9 as moneyMin, ba as moneySum, bb as reduceRecords, bc as reducerBuilder, bd as resetGroupByWarnings, be as sum } from '../index-BJ3L-XcV.js';
+import { aO as AggregateStrategy } from '../index-Dn5GzPg_.js';
+export { aP as AggregateResult, aQ as AggregateSpec, aR as Aggregation, aS as AggregationUpstream, aT as GROUPBY_MAX_CARDINALITY, aU as GROUPBY_WARN_CARDINALITY, aV as GroupedAggregation, aW as GroupedQuery, aX as GroupedQueryN, aY as GroupedRow, aZ as GroupedRowN, a_ as LiveAggregation, a$ as Reducer, b0 as ReducerBuilder, b1 as ReducerOptions, b2 as avg, b3 as buildLiveAggregation, b4 as count, b5 as groupAndReduce, b6 as max, b7 as min, b8 as moneyMax, b9 as moneyMin, ba as moneySum, bb as reduceRecords, bc as reducerBuilder, bd as resetGroupByWarnings, be as sum } from '../index-Dn5GzPg_.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';

package/dist/{api-Z66JMGOU.js → api-JDWL67WL.js}

@@ -1,13 +1,13 @@
 import {
   UserApi,
   createUserApi
-} from "./chunk-VFG5YXWM.js";
-import "./chunk-3CHNKEFI.js";
-import "./chunk-JIW3Q5JN.js";
-import "./chunk-HGQ6UNHE.js";
+} from "./chunk-GDOOG5YQ.js";
+import "./chunk-FZK3JJJK.js";
+import "./chunk-7TAV3BFQ.js";
+import "./chunk-PVC2FBCQ.js";
 import "./chunk-5UOPIPZC.js";
 import "./chunk-UWZ7O4NR.js";
-import "./chunk-HCK2DFEK.js";
+import "./chunk-REWTMYSF.js";
 import "./chunk-VFQOE76I.js";
 import "./chunk-LP7BEXCT.js";
 import "./chunk-5HZULLHE.js";
@@ -17,4 +17,4 @@ export {
   UserApi,
   createUserApi
 };
-//# sourceMappingURL=api-Z66JMGOU.js.map
+//# sourceMappingURL=api-JDWL67WL.js.map

package/dist/as/index.d.ts

@@ -1,6 +1,6 @@
-export { V as VaultDiff, d as diffVault } from '../vault-diff-DmBBatkx.js';
-export { N as NoydbPodHeader, W as WritePodOptions, r as readPod, a as readPodHeader, w as writePod } from '../bundle-BN_VSq5L.js';
-export { V as Vault } from '../index-BJ3L-XcV.js';
+export { V as VaultDiff, d as diffVault } from '../vault-diff-_LSIcOMv.js';
+export { N as NoydbPodHeader, W as WritePodOptions, r as readPod, a as readPodHeader, w as writePod } from '../bundle-DzWtVw7w.js';
+export { V as Vault } from '../index-Dn5GzPg_.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';

package/dist/as/index.js

@@ -7,15 +7,15 @@ import {
   readPod,
   readPodHeader,
   writePod
-} from "../chunk-CND5WQLO.js";
-import "../chunk-T4NQMPBN.js";
+} from "../chunk-BJ2XF2RC.js";
+import "../chunk-GLVXQU3E.js";
 import "../chunk-ZJADGNYF.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-JIW3Q5JN.js";
-import "../chunk-HGQ6UNHE.js";
+import "../chunk-7TAV3BFQ.js";
+import "../chunk-PVC2FBCQ.js";
 import "../chunk-5UOPIPZC.js";
 import "../chunk-UWZ7O4NR.js";
-import "../chunk-HCK2DFEK.js";
+import "../chunk-REWTMYSF.js";
 import "../chunk-VFQOE76I.js";
 import "../chunk-LP7BEXCT.js";
 import "../chunk-5HZULLHE.js";

package/dist/at/index.d.ts

@@ -1,4 +1,4 @@
-export { dg as SealingKeyProvider } from '../index-BJ3L-XcV.js';
+export { dp as SealingKeyProvider } from '../index-Dn5GzPg_.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';

package/dist/attestation/index.d.ts

@@ -1,5 +1,5 @@
-import { dy as AttestationStrategy } from '../index-BJ3L-XcV.js';
-export { dz as AttestationError, dA as AttestationNotEnabledError, dB as IssueArgs, dC as IssueContext, dD as IssueResult, dE as NO_ATTESTATION, dF as RevokeContext, dG as getRevokedDocIdsCore, dH as issueAttestationCore, dI as publishRevocationListCore, dJ as revokeDocCore, dK as unrevokeDocCore } from '../index-BJ3L-XcV.js';
+import { dG as AttestationStrategy } from '../index-Dn5GzPg_.js';
+export { dH as AttestationError, dI as AttestationNotEnabledError, dJ as IssueArgs, dK as IssueContext, dL as IssueResult, dM as NO_ATTESTATION, dN as RevokeContext, dO as getRevokedDocIdsCore, dP as issueAttestationCore, dQ as publishRevocationListCore, dR as revokeDocCore, dS as unrevokeDocCore } from '../index-Dn5GzPg_.js';
 export { AttestationFieldSchema, QrPayload, RevocationList, VerifyInput, VerifyResult, decodeQr, isRevoked, signRevocationList, verifyAttestation, verifyRevocationList } from '@noy-db/attestation';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';

package/dist/attestation/index.js

@@ -1,24 +1,24 @@
 import {
   issueAttestationCore
-} from "../chunk-RHB7BOEO.js";
+} from "../chunk-I6URUNTD.js";
 import {
   getRevokedDocIdsCore,
   publishRevocationListCore,
   revokeDocCore,
   unrevokeDocCore
-} from "../chunk-7L6EH6S7.js";
+} from "../chunk-M3OYTM5Z.js";
 import {
   ATTESTATIONS_COLLECTION
-} from "../chunk-JT4A6OAJ.js";
+} from "../chunk-X5QZAJDB.js";
 import {
   NO_ATTESTATION
 } from "../chunk-LFGJG4XZ.js";
 import "../chunk-ZJADGNYF.js";
-import "../chunk-JIW3Q5JN.js";
-import "../chunk-HGQ6UNHE.js";
+import "../chunk-7TAV3BFQ.js";
+import "../chunk-PVC2FBCQ.js";
 import "../chunk-5UOPIPZC.js";
 import "../chunk-UWZ7O4NR.js";
-import "../chunk-HCK2DFEK.js";
+import "../chunk-REWTMYSF.js";
 import "../chunk-VFQOE76I.js";
 import "../chunk-LP7BEXCT.js";
 import "../chunk-5HZULLHE.js";
@@ -32,11 +32,11 @@ import "../chunk-PZ5AY32C.js";
 function withAttestation() {
   return {
     async issueAttestation(ctx, args) {
-      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-FJE2IHUI.js");
+      const { issueAttestationCore: issueAttestationCore2 } = await import("../issue-AEOL6RXA.js");
       return issueAttestationCore2(ctx, args);
     },
     async getDocumentSigningPublicKey(deps) {
-      const { loadSigner, loadOrCreateSigner } = await import("../signer-IVU3B6DP.js");
+      const { loadSigner, loadOrCreateSigner } = await import("../signer-GAIMQQ2J.js");
       const existing = await loadSigner(deps.adapter, deps.vault, deps.getDEK);
       if (existing) return { keyId: existing.keyId, publicKeyB64: existing.publicKeyB64 };
       if (deps.role !== "owner") {
@@ -46,19 +46,19 @@ function withAttestation() {
       return { keyId: signer.keyId, publicKeyB64: signer.publicKeyB64 };
     },
     async revokeAttestation(ctx, docId) {
-      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-VELFCK7S.js");
+      const { revokeDocCore: revokeDocCore2 } = await import("../revoke-ZFETCLYV.js");
       return revokeDocCore2(ctx, docId);
     },
     async unrevokeAttestation(ctx, docId) {
-      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-VELFCK7S.js");
+      const { unrevokeDocCore: unrevokeDocCore2 } = await import("../revoke-ZFETCLYV.js");
       return unrevokeDocCore2(ctx, docId);
     },
     async getRevokedDocIds(ctx) {
-      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-VELFCK7S.js");
+      const { getRevokedDocIdsCore: getRevokedDocIdsCore2 } = await import("../revoke-ZFETCLYV.js");
       return getRevokedDocIdsCore2(ctx);
     },
     async publishRevocationList(ctx) {
-      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-VELFCK7S.js");
+      const { publishRevocationListCore: publishRevocationListCore2 } = await import("../revoke-ZFETCLYV.js");
       return publishRevocationListCore2(ctx);
     }
   };

package/dist/{backup-7PX6NDKT.js → backup-WRGNTGJF.js}

@@ -1,20 +1,20 @@
 import {
   SEQUENCE_COLLECTION
-} from "./chunk-IEKK2XI4.js";
+} from "./chunk-5HRJQSKN.js";
 import {
   SCHEMAS_COLLECTION
-} from "./chunk-7F2P2NHX.js";
+} from "./chunk-J7OH6R4K.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
 } from "./chunk-I7FD46FF.js";
-import "./chunk-JIW3Q5JN.js";
-import "./chunk-HGQ6UNHE.js";
+import "./chunk-7TAV3BFQ.js";
+import "./chunk-PVC2FBCQ.js";
 import "./chunk-5UOPIPZC.js";
 import "./chunk-UWZ7O4NR.js";
 import {
   NOYDB_BACKUP_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-REWTMYSF.js";
 import "./chunk-VFQOE76I.js";
 import "./chunk-LP7BEXCT.js";
 import "./chunk-5HZULLHE.js";
@@ -222,4 +222,4 @@ export {
   loadVault,
   verifyBackupIntegrity
 };
-//# sourceMappingURL=backup-7PX6NDKT.js.map
+//# sourceMappingURL=backup-WRGNTGJF.js.map

package/dist/blobs/index.d.ts

@@ -1,6 +1,6 @@
-import { X as BlobStrategy } from '../index-BJ3L-XcV.js';
-export { Y as BLOB_CHUNKS_COLLECTION, Z as BLOB_COLLECTION, _ as BLOB_EVICTION_AUDIT_COLLECTION, $ as BLOB_INDEX_COLLECTION, a0 as BLOB_SLOTS_PREFIX, a1 as BLOB_VERSIONS_PREFIX, a2 as BlobEvictionEntry, a3 as BlobFieldPolicy, a4 as BlobFieldsConfig, a5 as BlobObject, a6 as BlobPutOptions, a7 as BlobResponseOptions, a8 as BlobSet, a9 as BlobStrategyOpenArgs, aa as CompactRunOptions, ab as CompactionContext, ac as CompactionResult, ad as DEFAULT_CHUNK_SIZE, ae as EXPORT_AUDIT_COLLECTION, af as ExportBlobsAbortedError, ag as ExportBlobsAuditEntry, ah as ExportBlobsHandle, ai as ExportBlobsOptions, aj as ExportedBlob, ak as ObjectListEntry, al as ObjectMeta, am as ObjectProjection, an as ObjectUrlOptions, ao as PutObjectOptions, ap as PutUrlOptions, aq as SlotInfo, ar as SlotRecord, as as VersionRecord, at as createExportBlobsHandle, au as memoryObjectProjection, av as runCompaction } from '../index-BJ3L-XcV.js';
-export { I as ImportExternalOptions, a as ImportExternalResult, b as ImportableCollection, d as detectMagic, c as detectMimeType, i as importExternalObjects, e as isPreCompressed } from '../mime-magic-BlE9fzn2.js';
+import { X as BlobStrategy } from '../index-Dn5GzPg_.js';
+export { Y as BLOB_CHUNKS_COLLECTION, Z as BLOB_COLLECTION, _ as BLOB_EVICTION_AUDIT_COLLECTION, $ as BLOB_INDEX_COLLECTION, a0 as BLOB_SLOTS_PREFIX, a1 as BLOB_VERSIONS_PREFIX, a2 as BlobEvictionEntry, a3 as BlobFieldPolicy, a4 as BlobFieldsConfig, a5 as BlobObject, a6 as BlobPutOptions, a7 as BlobResponseOptions, a8 as BlobSet, a9 as BlobStrategyOpenArgs, aa as CompactRunOptions, ab as CompactionContext, ac as CompactionResult, ad as DEFAULT_CHUNK_SIZE, ae as EXPORT_AUDIT_COLLECTION, af as ExportBlobsAbortedError, ag as ExportBlobsAuditEntry, ah as ExportBlobsHandle, ai as ExportBlobsOptions, aj as ExportedBlob, ak as ObjectListEntry, al as ObjectMeta, am as ObjectProjection, an as ObjectUrlOptions, ao as PutObjectOptions, ap as PutUrlOptions, aq as SlotInfo, ar as SlotRecord, as as VersionRecord, at as createExportBlobsHandle, au as memoryObjectProjection, av as runCompaction } from '../index-Dn5GzPg_.js';
+export { I as ImportExternalOptions, a as ImportExternalResult, b as ImportableCollection, d as detectMagic, c as detectMimeType, i as importExternalObjects, e as isPreCompressed } from '../mime-magic-CYbFNQ4h.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';
 import '../index-B9QdHytu.js';

package/dist/blobs/index.js

@@ -8,7 +8,7 @@ import {
   ExportBlobsAbortedError,
   createExportBlobsHandle,
   runCompaction
-} from "../chunk-I6Q7YECW.js";
+} from "../chunk-PPPZIBKY.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -20,12 +20,12 @@ import {
   detectMagic,
   detectMimeType,
   isPreCompressed
-} from "../chunk-QAVFI23O.js";
-import "../chunk-JIW3Q5JN.js";
-import "../chunk-HGQ6UNHE.js";
+} from "../chunk-WPNP3NF5.js";
+import "../chunk-7TAV3BFQ.js";
+import "../chunk-PVC2FBCQ.js";
 import "../chunk-5UOPIPZC.js";
 import "../chunk-UWZ7O4NR.js";
-import "../chunk-HCK2DFEK.js";
+import "../chunk-REWTMYSF.js";
 import "../chunk-VFQOE76I.js";
 import "../chunk-LP7BEXCT.js";
 import "../chunk-5HZULLHE.js";

package/dist/bundle/index.d.ts

@@ -1,8 +1,8 @@
-import { T as TransferSealPayload } from '../bundle-BN_VSq5L.js';
-export { C as COMPRESSION_BROTLI, b as COMPRESSION_GZIP, c as COMPRESSION_NONE, d as CompressionAlgo, F as FLAG_COMPRESSED, e as FLAG_HAS_INTEGRITY_HASH, f as NOYDB_BUNDLE_FORMAT_VERSION, g as NOYDB_BUNDLE_MAGIC, h as NOYDB_BUNDLE_PREFIX_BYTES, i as NoydbBundleHeader, j as NoydbBundleReadResult, N as NoydbPodHeader, R as ReadNoydbBundleOptions, k as WriteNoydbBundleOptions, W as WritePodOptions, l as encodeBundleHeader, m as readNoydbBundle, n as readNoydbBundleHeader, r as readPod, a as readPodHeader, o as resetBrotliSupportCache, v as validateBundleHeader, p as writeNoydbBundle, w as writePod } from '../bundle-BN_VSq5L.js';
+import { T as TransferSealPayload } from '../bundle-DzWtVw7w.js';
+export { C as COMPRESSION_BROTLI, b as COMPRESSION_GZIP, c as COMPRESSION_NONE, d as CompressionAlgo, F as FLAG_COMPRESSED, e as FLAG_HAS_INTEGRITY_HASH, f as NOYDB_BUNDLE_FORMAT_VERSION, g as NOYDB_BUNDLE_MAGIC, h as NOYDB_BUNDLE_PREFIX_BYTES, i as NoydbBundleHeader, j as NoydbBundleReadResult, N as NoydbPodHeader, R as ReadNoydbBundleOptions, k as WriteNoydbBundleOptions, W as WritePodOptions, l as encodeBundleHeader, m as readNoydbBundle, n as readNoydbBundleHeader, r as readPod, a as readPodHeader, o as resetBrotliSupportCache, v as validateBundleHeader, p as writeNoydbBundle, w as writePod } from '../bundle-DzWtVw7w.js';
 export { g as generateULID, i as isULID } from '../ulid-DRH25k3y.js';
-import { V as Vault, df as WalkClosureOptions, cT as NoydbStore, dg as SealingKeyProvider, dh as RecoveryEnrollmentInput, di as ShamirRecoveryProvider, dj as EnclaveKey } from '../index-BJ3L-XcV.js';
-export { dk as AdoptionStateError, dl as BackupCorruptedError, dm as BackupLedgerError, dn as BundleIntegrityError, dp as BundleSealMismatchError, dq as BundleVersionConflictError, dr as ClosureResult, ds as ExtractPartitionResult, dt as PartitionExtractionError, du as PodVersionConflictError, dv as TransferSealError, dw as extractPartition, dx as walkClosure } from '../index-BJ3L-XcV.js';
+import { V as Vault, dn as WalkClosureOptions, c$ as NoydbStore, dp as SealingKeyProvider, dq as RecoveryEnrollmentInput, dr as ShamirRecoveryProvider, ds as EnclaveKey } from '../index-Dn5GzPg_.js';
+export { dt as AdoptionStateError, du as BackupCorruptedError, dv as BackupLedgerError, dw as BundleIntegrityError, dx as BundleSealMismatchError, dy as BundleVersionConflictError, dz as ClosureResult, dA as ExtractPartitionResult, dB as PartitionExtractionError, dC as PodVersionConflictError, dD as TransferSealError, dE as extractPartition, dF as walkClosure } from '../index-Dn5GzPg_.js';
 export { D as DecryptedRecord, d as decryptExtractedPartition } from '../decrypt-partition-IHtxEnTi.js';
 import '../subject-index-O75wKshW.js';
 import '../describe-C6iHNlqJ.js';

package/dist/bundle/index.js

@@ -1,17 +1,17 @@
 import {
   extractPartition,
   walkClosure
-} from "../chunk-J5YDMJHG.js";
+} from "../chunk-P6TZ3IVN.js";
 import "../chunk-CHFZDSE4.js";
 import {
   adoptPartition,
   createOwnerOnAdoptedPartition,
   decryptExtractedPartition,
   unsealDeks
-} from "../chunk-2L7PPF2C.js";
-import "../chunk-7F2P2NHX.js";
-import "../chunk-H7WQMGXH.js";
-import "../chunk-QAVFI23O.js";
+} from "../chunk-25G7PUTA.js";
+import "../chunk-J7OH6R4K.js";
+import "../chunk-P2PEPSPK.js";
+import "../chunk-WPNP3NF5.js";
 import "../chunk-CHK5VVMI.js";
 import {
   COMPRESSION_BROTLI,
@@ -31,22 +31,22 @@ import {
   validateBundleHeader,
   writeNoydbBundle,
   writePod
-} from "../chunk-CND5WQLO.js";
-import "../chunk-T4NQMPBN.js";
-import "../chunk-GMZFHDSG.js";
-import "../chunk-3CHNKEFI.js";
+} from "../chunk-BJ2XF2RC.js";
+import "../chunk-GLVXQU3E.js";
+import "../chunk-TUL5YQWF.js";
+import "../chunk-FZK3JJJK.js";
 import {
   generateULID,
   isULID
 } from "../chunk-ZJADGNYF.js";
-import "../chunk-62TTFKU4.js";
+import "../chunk-3YKBGS3I.js";
 import "../chunk-I7FD46FF.js";
-import "../chunk-G5CFMITA.js";
-import "../chunk-JIW3Q5JN.js";
-import "../chunk-HGQ6UNHE.js";
+import "../chunk-UMH35AQV.js";
+import "../chunk-7TAV3BFQ.js";
+import "../chunk-PVC2FBCQ.js";
 import "../chunk-5UOPIPZC.js";
 import "../chunk-UWZ7O4NR.js";
-import "../chunk-HCK2DFEK.js";
+import "../chunk-REWTMYSF.js";
 import "../chunk-VFQOE76I.js";
 import "../chunk-LP7BEXCT.js";
 import "../chunk-5HZULLHE.js";

package/dist/{bundle-BN_VSq5L.d.ts → bundle-DzWtVw7w.d.ts}

@@ -1,4 +1,4 @@
-import { e0 as PublicEnvelope, dg as SealingKeyProvider, e1 as BundleRecipient, e2 as RecipientSealer, e3 as RecipientHint, V as Vault } from './index-BJ3L-XcV.js';
+import { e8 as PublicEnvelope, dp as SealingKeyProvider, e9 as BundleRecipient, ea as RecipientSealer, eb as RecipientHint, V as Vault } from './index-Dn5GzPg_.js';
 
 /**
  * `.noydb` container format — byte layout, header schema, validators.

package/dist/cargo/index.d.ts

@@ -1,9 +1,9 @@
-export { eD as AccessibleVault, aP as AggregateResult, aQ as AggregateSpec, eO as CargoNotEnabledError, eP as CargoStrategy, eQ as ChangeEvent, ci as Collection, lk as CrossShardJoinError, f6 as CustodyApi, fe as DataResidencyError, fX as GrantCustodianOptions, aB as IndexDef, gf as JoinStrategy, gq as LiberateOptions, gr as LiberateResult, a_ as LiveAggregation, gA as LiveQuery, h0 as NO_CARGO, h7 as NoAccessError, ha as Noydb, hg as Operator, e7 as Query, ic as ReservedVaultNameError, ie as RetrieveHit, ig as RetrieveOptions, dg as SealingKeyProvider, iP as ShardProvisioningError, jq as UnknownShardError, eu as Unsubscribe, jy as ValidationError, V as Vault, jD as VaultTemplateNotFoundError, jK as WriteConflict, jL as WriteQueue, b5 as groupAndReduce, kp as liberateVault, kH as readPath, bb as reduceRecords, ll as sha256Hex } from '../index-BJ3L-XcV.js';
+export { eL as AccessibleVault, aP as AggregateResult, aQ as AggregateSpec, eW as CargoNotEnabledError, eX as CargoStrategy, eY as ChangeEvent, cq as Collection, ls as CrossShardJoinError, fe as CustodyApi, fm as DataResidencyError, g3 as GrantCustodianOptions, aB as IndexDef, gn as JoinStrategy, gy as LiberateOptions, gz as LiberateResult, a_ as LiveAggregation, gI as LiveQuery, h8 as NO_CARGO, hf as NoAccessError, hi as Noydb, ho as Operator, ef as Query, il as ReservedVaultNameError, io as RetrieveHit, ip as RetrieveOptions, dp as SealingKeyProvider, iX as ShardProvisioningError, jy as UnknownShardError, eC as Unsubscribe, jG as ValidationError, V as Vault, jL as VaultTemplateNotFoundError, jS as WriteConflict, jT as WriteQueue, b5 as groupAndReduce, kx as liberateVault, kP as readPath, bb as reduceRecords, lt as sha256Hex } from '../index-Dn5GzPg_.js';
 export { g as generateULID } from '../ulid-DRH25k3y.js';
 export { C as CoordinationProvider, D as DrainBarrierOptions, F as FenceState, a as WriteHook, c as WriterPresence, i as isQuorum, r as runDrainBarrier } from '../index-B9QdHytu.js';
 export { FuseOptions, fuseRetrieval } from '../kernel/index.js';
 export { a as CollectionMeta, V as VaultMeta } from '../describe-C6iHNlqJ.js';
-export { a as DeedMarker, S as STATE_VAULT_NAME, c as createDeedOwner, i as isDeedVault, l as loadDeedMarker, w as withCargo } from '../index-CLucFLeN.js';
-export { d as diffVault } from '../vault-diff-DmBBatkx.js';
+export { a as DeedMarker, S as STATE_VAULT_NAME, c as createDeedOwner, i as isDeedVault, l as loadDeedMarker, w as withCargo } from '../index-CTvUp94-.js';
+export { d as diffVault } from '../vault-diff-_LSIcOMv.js';
 import '../subject-index-O75wKshW.js';
 import '@noy-db/attestation';

package/dist/cargo/index.js

@@ -1,21 +1,21 @@
 import {
   withCargo
-} from "../chunk-K6WHZBCO.js";
+} from "../chunk-IARAK3PK.js";
 import {
   CustodyApi,
   NO_CARGO
-} from "../chunk-RUWEHFRB.js";
+} from "../chunk-723XB5NX.js";
 import {
   createDeedOwner,
   isDeedVault,
   liberateVault,
   loadDeedMarker
-} from "../chunk-PE25C4QL.js";
-import "../chunk-DJ4TNF4N.js";
+} from "../chunk-5YBUFCFF.js";
+import "../chunk-3KBK5LU4.js";
 import {
   diffVault
 } from "../chunk-LB7FD65R.js";
-import "../chunk-DKGZIX6S.js";
+import "../chunk-DCVVCJVB.js";
 import "../chunk-BGIZAFY7.js";
 import {
   fuseRetrieval
@@ -24,20 +24,20 @@ import {
   isQuorum,
   runDrainBarrier
 } from "../chunk-EU7HDMT3.js";
-import "../chunk-H7WQMGXH.js";
-import "../chunk-CND5WQLO.js";
-import "../chunk-T4NQMPBN.js";
-import "../chunk-GMZFHDSG.js";
-import "../chunk-3CHNKEFI.js";
+import "../chunk-P2PEPSPK.js";
+import "../chunk-BJ2XF2RC.js";
+import "../chunk-GLVXQU3E.js";
+import "../chunk-TUL5YQWF.js";
+import "../chunk-FZK3JJJK.js";
 import {
   generateULID
 } from "../chunk-ZJADGNYF.js";
 import "../chunk-SVLR4POP.js";
-import "../chunk-JIW3Q5JN.js";
-import "../chunk-HGQ6UNHE.js";
+import "../chunk-7TAV3BFQ.js";
+import "../chunk-PVC2FBCQ.js";
 import "../chunk-5UOPIPZC.js";
 import "../chunk-UWZ7O4NR.js";
-import "../chunk-HCK2DFEK.js";
+import "../chunk-REWTMYSF.js";
 import "../chunk-VFQOE76I.js";
 import "../chunk-LP7BEXCT.js";
 import {

package/dist/{chunk-2L7PPF2C.js → chunk-25G7PUTA.js}

@@ -1,23 +1,23 @@
 import {
   resolveManagedSecret
-} from "./chunk-H7WQMGXH.js";
+} from "./chunk-P2PEPSPK.js";
 import {
   parseExtractedPartitionBody,
   readPod,
   readPodHeader
-} from "./chunk-CND5WQLO.js";
+} from "./chunk-BJ2XF2RC.js";
 import {
   createOwnerKeyring
-} from "./chunk-GMZFHDSG.js";
+} from "./chunk-TUL5YQWF.js";
 import {
   LedgerStore
-} from "./chunk-62TTFKU4.js";
+} from "./chunk-3YKBGS3I.js";
 import {
   LEDGER_COLLECTION
 } from "./chunk-I7FD46FF.js";
 import {
   openEnvelopeJson
-} from "./chunk-JIW3Q5JN.js";
+} from "./chunk-7TAV3BFQ.js";
 import {
   base64ToBuffer,
   wrapKey
@@ -179,7 +179,7 @@ async function createOwnerOnAdoptedPartition(store, vaultName, opts) {
     }
   }
   if (isManaged(opts)) {
-    const { createNoydb } = await import("./noydb-4ZASGII5.js");
+    const { createNoydb } = await import("./noydb-POVTIVQ6.js");
     const db = await createNoydb({
       store,
       user: userId,
@@ -232,4 +232,4 @@ export {
   createOwnerOnAdoptedPartition,
   decryptExtractedPartition
 };
-//# sourceMappingURL=chunk-2L7PPF2C.js.map
+//# sourceMappingURL=chunk-25G7PUTA.js.map

package/dist/{chunk-7AERMJP6.js → chunk-2PJB6H3H.js}

@@ -5,7 +5,7 @@ import {
 import {
   loadPersistedSchemaEntry,
   savePersistedSchema
-} from "./chunk-7F2P2NHX.js";
+} from "./chunk-J7OH6R4K.js";
 import {
   ConflictError
 } from "./chunk-OJ64XMPJ.js";
@@ -164,4 +164,4 @@ export {
   persistClassifiedMarker,
   persistSatelliteMarker
 };
-//# sourceMappingURL=chunk-7AERMJP6.js.map
+//# sourceMappingURL=chunk-2PJB6H3H.js.map

package/dist/{chunk-YSU2E4GZ.js → chunk-37JZR7CY.js}

@@ -1,7 +1,7 @@
 import {
   canonicalJson,
   sha256Hex
-} from "./chunk-G5CFMITA.js";
+} from "./chunk-UMH35AQV.js";
 import {
   PeriodClosedError,
   ValidationError
@@ -9,6 +9,15 @@ import {
 
 // src/with-audit/periods/periods.ts
 var PERIODS_COLLECTION = "_periods";
+var PERIOD_FREEZES_COLLECTION = "_period_freezes";
+var PERIOD_ARCHIVES_COLLECTION = "_period_archives";
+var PERIOD_TARGET_PURGES_COLLECTION = "_period_target_purges";
+function periodExclusiveUpperBound(endDate) {
+  const ms = Date.parse(endDate);
+  if (Number.isNaN(ms)) throw new ValidationError(`freezePeriod: unparseable period endDate "${endDate}".`);
+  const dateOnly = /^\d{4}-\d{2}-\d{2}$/.test(endDate);
+  return new Date(ms + (dateOnly ? 864e5 : 1)).toISOString();
+}
 async function loadPeriods(adapter, vault, decrypt) {
   const ids = await adapter.list(vault, PERIODS_COLLECTION);
   const records = [];
@@ -54,12 +63,12 @@ function validatePeriodName(name, existing) {
     throw new ValidationError(`Period "${name}" already exists.`);
   }
 }
-async function appendPeriodLedgerEntry(ledger, actor, envelope, name) {
+async function appendPeriodLedgerEntry(ledger, actor, envelope, name, collection = PERIODS_COLLECTION) {
   if (!ledger) return;
-  const { envelopePayloadHash } = await import("./ledger-EMDHRJJN.js");
+  const { envelopePayloadHash } = await import("./ledger-3LR3YO2W.js");
   await ledger.append({
     op: "put",
-    collection: PERIODS_COLLECTION,
+    collection,
     id: name,
     version: envelope._v,
     actor,
@@ -69,10 +78,14 @@ async function appendPeriodLedgerEntry(ledger, actor, envelope, name) {
 
 export {
   PERIODS_COLLECTION,
+  PERIOD_FREEZES_COLLECTION,
+  PERIOD_ARCHIVES_COLLECTION,
+  PERIOD_TARGET_PURGES_COLLECTION,
+  periodExclusiveUpperBound,
   loadPeriods,
   chainAnchor,
   assertTsWritable,
   validatePeriodName,
   appendPeriodLedgerEntry
 };
-//# sourceMappingURL=chunk-YSU2E4GZ.js.map
+//# sourceMappingURL=chunk-37JZR7CY.js.map

package/dist/chunk-37JZR7CY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/periods/periods.ts"],"sourcesContent":["/**\n * Accounting-period closure + opening.\n *\n * A closed period seals every record whose envelope `_ts` is at or\n * before the period's `endDate`: further writes (`put` / `delete`)\n * against such records throw {@link PeriodClosedError}. The period\n * itself is stored as a record in the reserved `_periods` collection\n * and written through the normal ledger-instrumented path, so every\n * closure appends a tamper-evident entry to the vault's hash chain.\n *\n * ## Closure model\n *\n * ```\n * vault.closePeriod({ name: 'FY2026-Q1', endDate: '2026-03-31' })\n *   └─► PeriodRecord written to _periods/<name>\n *         ├─ priorPeriodName / priorPeriodHash — chain to last close\n *         ├─ closedAt / closedBy — provenance\n *         └─ normal ledger append fires (LedgerStore.append)\n * ```\n *\n * Enforcement (`assertTsWritable`) is vault-local: the Vault caches\n * the list of closed periods on first read and consults that cache in\n * the `Collection.put` / `.delete` path via the `periodGuard` hook.\n *\n * ## Opening model\n *\n * ```\n * vault.openPeriod({\n *   name: 'FY2026-Q2',\n *   startDate: '2026-04-01',\n *   fromPeriod: 'FY2026-Q1',\n *   carryForward: async (priorView) => Record<string, Record<string, unknown>>,\n * })\n * ```\n *\n * `carryForward` receives a read-only `VaultInstant` anchored at the\n * prior period's `endDate` (built via `vault.at(endDate)`) so the\n * callback can compute closing aggregates from the sealed state. The\n * returned `{ [collectionName]: { [id]: record } }` map is written\n * before the new `PeriodRecord` lands — opening balances materialise\n * as normal records with fresh timestamps that fall outside every\n * closed period.\n *\n * ## Freeze\n *\n * ```\n * vault.freezePeriod('FY2026-Q1')\n *   └─► physically purges delete markers whose write-time falls inside\n *       the closed period's window (via the #589 `_purgeDeleteMarkers`\n *       seam), then records the fact:\n *         ├─ PeriodFreezeRecord written to _period_freezes/<name>\n *         └─ normal ledger append fires (LedgerStore.append)\n * ```\n *\n * The chained `_periods/<name>` record is never mutated — `frozenAt` /\n * `frozenBy` / `purgedMarkerCount` are merged onto the returned\n * `PeriodRecord` at read time from the companion, so a tamper with the\n * freeze can never break the inter-period hash chain. Freezing is\n * terminal (a closed period, once frozen, stays frozen) and idempotent\n * (a second call is a no-op that returns the same merged record without\n * re-purging or re-appending a ledger entry). Freeze does NOT purge\n * forget-tombstones (GDPR crypto-shred erasure evidence), `_history`\n * versions, or live records — the delete-markers-only seam leaves all\n * three untouched by construction.\n *\n * Freeze purges the LOCAL adapter only. On a synced vault, markers already\n * pushed to sync targets survive there, and a later pull re-imports them\n * (benign — they still read deleted, but the space isn't reclaimed). A\n * re-imported marker keeps its original `_ts` (inside the already-frozen\n * period's window), so — like any late-booked delete — it is reclaimed by\n * the NEXT period's freeze, whose window covers it; freeze stays terminal\n * and does NOT re-purge an already-frozen period (#611). Sweeping the sync\n * targets themselves is a cross-target-purge concern deferred to the\n * cold-archival spec. Purging re-opens the #589 resurrection window for a\n * peer offline since before the cutoff, which is why the closed period is\n * the operator-asserted safe-point that gates the call.\n *\n * A period whose purge window has not fully elapsed cannot be frozen —\n * `freezePeriod` throws rather than purge markers for deletes that may not\n * have converged yet (#610).\n *\n * ## Archive\n *\n * ```\n * vault.archivePeriod('FY2026-Q1')\n *   └─► relocates the closed period's in-window records (those with\n *       `_ts < periodExclusiveUpperBound(endDate)`) from the hot store to\n *       the configured cold tier (routeStore's `cold` route), then records:\n *         ├─ PeriodArchiveRecord written to _period_archives/<name>\n *         └─ a ledger entry attributed to _period_archives\n * ```\n *\n * Archival is NON-DESTRUCTIVE: routeStore reads fall through to the cold\n * tier on a hot miss, so an archived record still reads normally. It is\n * therefore gated only on `closed` (not `frozen`) — it does not re-open the\n * #589 resurrection window and needs no convergence safe-point. Freeze\n * (purge markers) and archive (relocate records) are independent and compose\n * in either order. Like freeze, archival keeps the chained `_periods/<name>`\n * record byte-immutable (state lives in the companion) and is idempotent.\n *\n * Bounds by write-time `_ts`, NOT business date: the store tier sees only\n * encrypted envelopes. A record with an in-period business date but a later\n * `_ts` (late-booked) archives at the NEXT period's archive — the same rule\n * freeze uses for late-booked delete markers. Requires a `routeStore` with a\n * cold route (`age: { cold }`); throws otherwise.\n *\n * Read cost: with `withLazy()` (per-id reads) archived records are truly\n * cold — fetched from cold only on access. In the default hydrated mode,\n * `loadAll` merges the cold store, so archived records still load into RAM\n * on vault open (hot-tier STORAGE is reclaimed; RAM is not). Summaries\n * (`_`-prefixed) always stay hot.\n *\n * ## Target-purge\n *\n * ```\n * vault.purgePeriodTargets('FY2026-Q1')\n *   └─► sweeps delete markers (`_ts < periodExclusiveUpperBound(endDate)`) off\n *       the vault's PUSH-ONLY sync targets (backup/archive roles), then records:\n *         ├─ PeriodTargetPurgeRecord written to _period_target_purges/<name>\n *         └─ a ledger entry attributed to _period_target_purges\n * ```\n *\n * Extends freeze's local marker purge to the vault's own remote sinks.\n * `sync-peer` (bidirectional) targets are SKIPPED: purging a marker there\n * re-opens the #589 resurrection window for a client offline before the\n * cutoff, an assertion no single vault can verify. Backup/archive targets are\n * push-only — never pulled from into convergence — so sweeping their markers\n * is safe. Requires the period be frozen first (closed → frozen →\n * target-purged) so the local safe-point is already established. Idempotent\n * once run; a vault with no push-only targets writes no companion and is\n * re-runnable (so a target added later is still swept). Single-vault only —\n * fleet-wide purge across sovereign vaults is klum's concern over\n * `@noy-db/hub/cargo`.\n *\n * ## Not covered\n *\n * - Partial re-opening of a closed period. If an auditor needs to\n *   make a correction inside a sealed period, the sanctioned path is\n *   a compensating entry in the NEW period, not an unlock of the\n *   old one.\n * - Automatic period rollover. `closePeriod` / `openPeriod` are\n *   deliberately explicit operator calls so the caller decides when\n *   the boundary lands.\n *\n * @module\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { LedgerStore } from '../../with-commit/history/ledger/index.js'\nimport { sha256Hex, canonicalJson } from '../../with-commit/history/ledger/index.js'\nimport { PeriodClosedError, ValidationError } from '../../kernel/errors.js'\n\n/** The reserved collection name holding closed-period metadata. */\nexport const PERIODS_COLLECTION = '_periods'\n\n/** Sibling of {@link PERIODS_COLLECTION} holding freeze companions (#604). */\nexport const PERIOD_FREEZES_COLLECTION = '_period_freezes'\n\n/** Sibling of {@link PERIODS_COLLECTION} holding archive companions (#613). */\nexport const PERIOD_ARCHIVES_COLLECTION = '_period_archives'\n\n/** Sibling of {@link PERIODS_COLLECTION} holding target-purge companions (#615). */\nexport const PERIOD_TARGET_PURGES_COLLECTION = '_period_target_purges'\n\n/**\n * Companion record recording that a closed period was frozen (its delete\n * markers physically purged). Stored in {@link PERIOD_FREEZES_COLLECTION},\n * keyed by period name — kept OFF the hash-chained `_periods/<name>` record so\n * freeze never alters the inter-period chain.\n */\nexport interface PeriodFreezeRecord {\n  readonly period: string\n  readonly frozenAt: string\n  readonly frozenBy: string\n  readonly purgedMarkerCount: number\n}\n\n/**\n * Companion record noting that a closed period was cold-archived (its\n * in-window records physically relocated hot → cold). Stored in\n * {@link PERIOD_ARCHIVES_COLLECTION}, keyed by period name — kept OFF the\n * hash-chained `_periods/<name>` record so archive never alters the chain.\n */\nexport interface PeriodArchiveRecord {\n  readonly period: string\n  readonly archivedAt: string\n  readonly archivedBy: string\n  readonly archivedRecordCount: number\n}\n\n/** Per-target count of delete markers purged off one push-only sync target (#615). */\nexport interface TargetPurgeCount {\n  readonly label?: string\n  readonly role: 'backup' | 'archive'\n  readonly purgedCount: number\n}\n\n/**\n * Companion record noting that a closed+frozen period's delete markers were\n * swept off the vault's push-only sync targets (#615). Stored in\n * {@link PERIOD_TARGET_PURGES_COLLECTION}, keyed by period name — kept OFF the\n * hash-chained `_periods/<name>` record so target-purge never alters the chain.\n */\nexport interface PeriodTargetPurgeRecord {\n  readonly period: string\n  readonly purgedAt: string\n  readonly purgedBy: string\n  readonly targets: readonly TargetPurgeCount[]\n}\n\n/**\n * Exclusive upper bound for a period's delete-marker purge window (#604).\n * Markers carry no business date (empty body), only write-time `_ts`, so freeze\n * purges markers with `_ts < bound`, `bound` being the instant just after the\n * period's inclusive `endDate`: a date-only `endDate` seals through end-of-day\n * → next midnight; a full-timestamp `endDate` seals through that instant → +1ms.\n */\nexport function periodExclusiveUpperBound(endDate: string): string {\n  const ms = Date.parse(endDate)\n  if (Number.isNaN(ms)) throw new ValidationError(`freezePeriod: unparseable period endDate \"${endDate}\".`)\n  const dateOnly = /^\\d{4}-\\d{2}-\\d{2}$/.test(endDate)\n  return new Date(ms + (dateOnly ? 86_400_000 : 1)).toISOString()\n}\n\n/**\n * Stored record for one closed or opened accounting period. One entry\n * per period, keyed by `name` in the reserved `_periods` collection.\n *\n * The hash chain between periods is computed at read time by\n * `loadPeriods()` — each record carries the name + hash of its\n * predecessor so a tamper with any period's record breaks the chain\n * into the next one, the same way the ledger's `prevHash` works.\n */\nexport interface PeriodRecord {\n  /** Human-readable name (e.g., `'FY2026-Q1'`). Unique per vault. */\n  readonly name: string\n  /**\n   * Role discriminator. A period is `'closed'` from the moment its\n   * `closedAt` is recorded; `'opened'` marks a period whose opening\n   * entries have been carried forward via {@link openPeriod}. Many\n   * workflows will produce one opened period per closed period (the\n   * opened one is the SUCCESSOR — its `startDate` equals the prior\n   * `endDate + 1 day`).\n   */\n  readonly kind: 'closed' | 'opened'\n  /** ISO date — inclusive upper bound for records belonging to this period. */\n  readonly endDate: string\n  /** ISO date — lower bound (present on opened periods only). */\n  readonly startDate?: string\n  /**\n   * Record field carrying the business date (e.g. `'date'` on an\n   * invoice, `'paidAt'` on a payment). The guard compares\n   * `record[dateField]` against `endDate` — NOT the envelope `_ts`.\n   * Accounting entries booked late (business date `2026-01-15`,\n   * write-time `2026-04-22`) still get sealed when Q1 closes at\n   * `2026-03-31` because the comparison uses the business date.\n   *\n   * Optional for backwards compat. When absent, the guard falls back\n   * to envelope `_ts` — that's a write-time seal, appropriate for\n   * content that doesn't carry a logical business date (e.g. system\n   * settings) but almost never right for accounting ledgers.\n   */\n  readonly dateField?: string\n  /** ISO timestamp recorded at `closePeriod()` / `openPeriod()` call time. */\n  readonly closedAt: string\n  /** userId of the keyring that invoked the close/open. */\n  readonly closedBy: string\n  /** Name of the prior period this one chains to, if any. */\n  readonly priorPeriodName?: string\n  /** sha256(canonicalJson(priorPeriod)) — empty for the first period. */\n  readonly priorPeriodHash: string\n  /**\n   * Opened periods only — the names of the collections whose\n   * carry-forward aggregates were written by {@link openPeriod}.\n   * Recorded for auditability so a future `verifyPeriodChain()` can\n   * cross-check the opening balances against the closing snapshot.\n   */\n  readonly openingCollections?: readonly string[]\n  /** #604 return-only — merged from the `_period_freezes/<name>` companion on\n   *  read; NEVER written into the stored `_periods/<name>` record (would break\n   *  the hash chain). Absent = not yet frozen. */\n  readonly frozenAt?: string\n  readonly frozenBy?: string\n  readonly purgedMarkerCount?: number\n  /** #613 return-only — merged from the `_period_archives/<name>` companion on\n   *  read; NEVER written into the stored `_periods/<name>` record. Absent = not\n   *  yet archived. */\n  readonly archivedAt?: string\n  readonly archivedBy?: string\n  readonly archivedRecordCount?: number\n  /** #615 return-only — merged from the `_period_target_purges/<name>` companion\n   *  on read; NEVER written into the stored `_periods/<name>` record. Absent =\n   *  target-purge not yet run (or the vault has no push-only targets). */\n  readonly targetsPurgedAt?: string\n  readonly targetsPurgedBy?: string\n  readonly targetsPurged?: readonly TargetPurgeCount[]\n}\n\n/** Options for `vault.closePeriod()`. */\nexport interface ClosePeriodOptions {\n  /** Human-readable name. Must not collide with an existing period. */\n  readonly name: string\n  /**\n   * Inclusive upper cutoff. A record is sealed when its\n   * `record[dateField]` (or, if absent, the envelope `_ts`) is at or\n   * before this ISO timestamp.\n   */\n  readonly endDate: string\n  /**\n   * Record field carrying the business date used for period\n   * membership. Recommended for accounting workflows — e.g. an\n   * invoice booked late (write-time after close) is still sealed\n   * when its `invoice.date` falls inside the closed period.\n   *\n   * Omit to use envelope `_ts` (write-time seal). This fallback\n   * rarely matches real-world accounting semantics; prefer passing\n   * an explicit `dateField`.\n   */\n  readonly dateField?: string\n}\n\n/** Options for `vault.openPeriod()`. */\nexport interface OpenPeriodOptions<TCollections = Record<string, Record<string, unknown>>> {\n  /** Human-readable name for the new period. Must be unique. */\n  readonly name: string\n  /** ISO lower bound of the new period (usually prior `endDate + 1 day`). */\n  readonly startDate: string\n  /**\n   * Name of the prior CLOSED period this one chains from. The prior\n   * period's record is verified to exist and to be `kind: 'closed'`;\n   * its `endDate` is made available to the `carryForward` callback.\n   */\n  readonly fromPeriod: string\n  /**\n   * Receives a read-only facade over the vault's CURRENT state,\n   * plus the prior period's `endDate`. Accounting semantics: after\n   * a period closes, records with `record[dateField] <= endDate`\n   * are frozen — current state equals closing state, so a caller\n   * can compute closing balances by querying the live collection\n   * with a `where('date', '<=', priorEndDate)` filter.\n   *\n   * Returns opening-balance records keyed by collection name.\n   * Example:\n   *\n   * ```ts\n   * carryForward: async (ctx) => {\n   *   const closing = await ctx.collection<Journal>('journal')\n   *     .query().where('date', '<=', ctx.priorEndDate).toArray()\n   *   const opening: Record<string, Journal> = {}\n   *   for (const entry of closing) {\n   *     opening[`OB-${entry.id}`] = { ...entry, date: '2026-04-01' }\n   *   }\n   *   return { journal: opening }\n   * }\n   * ```\n   */\n  readonly carryForward: (\n    ctx: CarryForwardContext,\n  ) => Promise<TCollections> | TCollections\n}\n\n/**\n * Context passed to `OpenPeriodOptions.carryForward`. Exposes a\n * read-only subset of the live vault (`collection(name).get/list`)\n * plus the prior period's `endDate` so business-date filters can\n * be built by the caller.\n *\n * Writes go via the return value, not via the facade — the\n * `collection()` here is deliberately restricted to reads.\n */\nexport interface CarryForwardContext {\n  /** The prior period's `endDate` — the boundary of the closing snapshot. */\n  readonly priorEndDate: string\n  /** Read-only collection facade over current vault state. */\n  collection<T = unknown>(name: string): ReadOnlyCollection<T>\n}\n\n/** Minimum read surface exposed to `carryForward`. */\nexport interface ReadOnlyCollection<T> {\n  get(id: string): Promise<T | null>\n  list(): Promise<T[]>\n}\n\n/**\n * Load every period record currently stored on the adapter.\n * Decrypting is the caller's responsibility (we return plain records\n * so the vault can use its own `_periods` DEK).\n *\n * @internal — called by Vault methods that need the closed-period\n * cache. Not part of the public API surface.\n */\nexport async function loadPeriods(\n  adapter: NoydbStore,\n  vault: string,\n  decrypt: (envelope: EncryptedEnvelope) => Promise<PeriodRecord>,\n): Promise<PeriodRecord[]> {\n  const ids = await adapter.list(vault, PERIODS_COLLECTION)\n  const records: PeriodRecord[] = []\n  for (const id of ids) {\n    const env = await adapter.get(vault, PERIODS_COLLECTION, id)\n    if (env) records.push(await decrypt(env))\n  }\n  // Stable order by closedAt so chain verification is reproducible.\n  records.sort((a, b) => a.closedAt.localeCompare(b.closedAt))\n  return records\n}\n\n/**\n * Given the current ordered period list, pick the last entry that\n * belongs to the hash chain — used as the `priorPeriodHash` anchor\n * for the next closure/opening.\n *\n * @internal\n */\nexport async function chainAnchor(\n  records: readonly PeriodRecord[],\n): Promise<{ priorPeriodName?: string; priorPeriodHash: string }> {\n  const last = records[records.length - 1]\n  if (!last) return { priorPeriodHash: '' }\n  const hash = await sha256Hex(canonicalJson(last as unknown as Record<string, unknown>))\n  return { priorPeriodName: last.name, priorPeriodHash: hash }\n}\n\n/**\n * Throw `PeriodClosedError` if the record being touched falls within\n * any closed period.\n *\n * Three signals, evaluated per period:\n *\n *  1. If the period declares a `dateField`, the guard reads\n *     `record[dateField]` on BOTH the existing (prior) record AND the\n *     incoming (new) record. Either comparing `<= endDate` triggers\n *     the error — callers cannot slide a record into a closed period\n *     by editing its date field.\n *  2. If the period has no `dateField`, the guard falls back to the\n *     envelope `_ts` of the existing record. Fresh inserts (no\n *     existing envelope) pass.\n *  3. For a delete, only the existing side is checked.\n *\n * @internal\n */\nexport function assertTsWritable(\n  existing: { ts: string | null; record: Record<string, unknown> | null } | null,\n  incomingRecord: Record<string, unknown> | null,\n  closedPeriods: readonly PeriodRecord[],\n): void {\n  for (const p of closedPeriods) {\n    if (p.kind !== 'closed') continue\n    if (p.dateField) {\n      const checkRecord = (label: string, r: Record<string, unknown> | null): void => {\n        if (!r) return\n        const v = r[p.dateField!]\n        if (typeof v === 'string' && v <= p.endDate) {\n          throw new PeriodClosedError(p.name, p.endDate, `${label}[${p.dateField}]=${v}`)\n        }\n      }\n      checkRecord('existing', existing?.record ?? null)\n      checkRecord('incoming', incomingRecord)\n      continue\n    }\n    // Fallback: write-time seal via envelope _ts.\n    const existingTs = existing?.ts ?? null\n    if (existingTs !== null && existingTs <= p.endDate) {\n      throw new PeriodClosedError(p.name, p.endDate, existingTs)\n    }\n  }\n}\n\n/**\n * Sanity-check a proposed period name + endDate against existing\n * records. Shared by closePeriod / openPeriod so the two pathways\n * produce identical diagnostics.\n *\n * @internal\n */\nexport function validatePeriodName(\n  name: string,\n  existing: readonly PeriodRecord[],\n): void {\n  if (name.length === 0) {\n    throw new ValidationError('Period name cannot be empty.')\n  }\n  if (existing.some((p) => p.name === name)) {\n    throw new ValidationError(`Period \"${name}\" already exists.`)\n  }\n}\n\n/**\n * Wire a reserved-collection ledger append for a period record. The\n * period itself is stored via the adapter as an encrypted envelope;\n * the ledger entry is a normal `put` with the period's payloadHash,\n * so period closures inherit the chain's tamper-evidence.\n *\n * @internal\n */\nexport async function appendPeriodLedgerEntry(\n  ledger: LedgerStore | null,\n  actor: string,\n  envelope: EncryptedEnvelope,\n  name: string,\n  collection: string = PERIODS_COLLECTION,\n): Promise<void> {\n  if (!ledger) return\n  const { envelopePayloadHash } = await import('../../with-commit/history/ledger/index.js')\n  await ledger.append({\n    op: 'put',\n    collection,\n    id: name,\n    version: envelope._v,\n    actor,\n    payloadHash: await envelopePayloadHash(envelope),\n  })\n}\n"],"mappings":";;;;;;;;;;AAyJO,IAAM,qBAAqB;AAG3B,IAAM,4BAA4B;AAGlC,IAAM,6BAA6B;AAGnC,IAAM,kCAAkC;AAuDxC,SAAS,0BAA0B,SAAyB;AACjE,QAAM,KAAK,KAAK,MAAM,OAAO;AAC7B,MAAI,OAAO,MAAM,EAAE,EAAG,OAAM,IAAI,gBAAgB,6CAA6C,OAAO,IAAI;AACxG,QAAM,WAAW,sBAAsB,KAAK,OAAO;AACnD,SAAO,IAAI,KAAK,MAAM,WAAW,QAAa,EAAE,EAAE,YAAY;AAChE;AAyKA,eAAsB,YACpB,SACA,OACA,SACyB;AACzB,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AACxD,QAAM,UAA0B,CAAC;AACjC,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAC3D,QAAI,IAAK,SAAQ,KAAK,MAAM,QAAQ,GAAG,CAAC;AAAA,EAC1C;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AAC3D,SAAO;AACT;AASA,eAAsB,YACpB,SACgE;AAChE,QAAM,OAAO,QAAQ,QAAQ,SAAS,CAAC;AACvC,MAAI,CAAC,KAAM,QAAO,EAAE,iBAAiB,GAAG;AACxC,QAAM,OAAO,MAAM,UAAU,cAAc,IAA0C,CAAC;AACtF,SAAO,EAAE,iBAAiB,KAAK,MAAM,iBAAiB,KAAK;AAC7D;AAoBO,SAAS,iBACd,UACA,gBACA,eACM;AACN,aAAW,KAAK,eAAe;AAC7B,QAAI,EAAE,SAAS,SAAU;AACzB,QAAI,EAAE,WAAW;AACf,YAAM,cAAc,CAAC,OAAe,MAA4C;AAC9E,YAAI,CAAC,EAAG;AACR,cAAM,IAAI,EAAE,EAAE,SAAU;AACxB,YAAI,OAAO,MAAM,YAAY,KAAK,EAAE,SAAS;AAC3C,gBAAM,IAAI,kBAAkB,EAAE,MAAM,EAAE,SAAS,GAAG,KAAK,IAAI,EAAE,SAAS,KAAK,CAAC,EAAE;AAAA,QAChF;AAAA,MACF;AACA,kBAAY,YAAY,UAAU,UAAU,IAAI;AAChD,kBAAY,YAAY,cAAc;AACtC;AAAA,IACF;AAEA,UAAM,aAAa,UAAU,MAAM;AACnC,QAAI,eAAe,QAAQ,cAAc,EAAE,SAAS;AAClD,YAAM,IAAI,kBAAkB,EAAE,MAAM,EAAE,SAAS,UAAU;AAAA,IAC3D;AAAA,EACF;AACF;AASO,SAAS,mBACd,MACA,UACM;AACN,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,gBAAgB,8BAA8B;AAAA,EAC1D;AACA,MAAI,SAAS,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI,GAAG;AACzC,UAAM,IAAI,gBAAgB,WAAW,IAAI,mBAAmB;AAAA,EAC9D;AACF;AAUA,eAAsB,wBACpB,QACA,OACA,UACA,MACA,aAAqB,oBACN;AACf,MAAI,CAAC,OAAQ;AACb,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,sBAA2C;AACxF,QAAM,OAAO,OAAO;AAAA,IAClB,IAAI;AAAA,IACJ;AAAA,IACA,IAAI;AAAA,IACJ,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,aAAa,MAAM,oBAAoB,QAAQ;AAAA,EACjD,CAAC;AACH;","names":[]}

package/dist/{chunk-DJ4TNF4N.js → chunk-3KBK5LU4.js}

@@ -1,10 +1,10 @@
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-DKGZIX6S.js";
+} from "./chunk-DCVVCJVB.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-REWTMYSF.js";
 import {
   sha256Hex
 } from "./chunk-5HZULLHE.js";
@@ -114,4 +114,4 @@ export {
   freezeAndDeleteClosure,
   withdrawAccessibleData
 };
-//# sourceMappingURL=chunk-DJ4TNF4N.js.map
+//# sourceMappingURL=chunk-3KBK5LU4.js.map

package/dist/{chunk-62TTFKU4.js → chunk-3YKBGS3I.js}

@@ -7,13 +7,13 @@ import {
   hashEntry,
   paddedIndex,
   sha256Hex
-} from "./chunk-G5CFMITA.js";
+} from "./chunk-UMH35AQV.js";
 import {
   openEnvelopeJson
-} from "./chunk-JIW3Q5JN.js";
+} from "./chunk-7TAV3BFQ.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-REWTMYSF.js";
 import {
   encrypt
 } from "./chunk-5HZULLHE.js";
@@ -683,4 +683,4 @@ export {
   applyPatch,
   LedgerStore
 };
-//# sourceMappingURL=chunk-62TTFKU4.js.map
+//# sourceMappingURL=chunk-3YKBGS3I.js.map

package/dist/{chunk-YSJG4L4A.js → chunk-44DV37ZV.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-ZJADGNYF.js";
 import {
   openEnvelopeJson
-} from "./chunk-JIW3Q5JN.js";
+} from "./chunk-7TAV3BFQ.js";
 import {
   encrypt
 } from "./chunk-5HZULLHE.js";
@@ -72,4 +72,4 @@ export {
   writeConsentEntry,
   loadConsentEntries
 };
-//# sourceMappingURL=chunk-YSJG4L4A.js.map
+//# sourceMappingURL=chunk-44DV37ZV.js.map