@noy-db/hub 0.3.0-pre.7 → 0.3.0-pre.8

package/dist/{chunk-5K7KZMXG.js → chunk-56JB2BGI.js}

@@ -1,6 +1,6 @@
 import {
   loadVaultPolicy
-} from "./chunk-NO53W6O5.js";
+} from "./chunk-BTFTHF6Q.js";
 import {
   jsonSchemaToFields
 } from "./chunk-TQ3REHVF.js";
@@ -9,7 +9,7 @@ import {
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-IEKK2XI4.js";
+} from "./chunk-5HRJQSKN.js";
 import {
   LinkIntegrityError,
   isLinkCollectionName,
@@ -22,14 +22,14 @@ import {
 } from "./chunk-5JQMX2EH.js";
 import {
   loadFence
-} from "./chunk-WRLPV6SI.js";
+} from "./chunk-L6Q5NA22.js";
 import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH,
   VectorSet,
   buildPersistedIndexCallbacks
-} from "./chunk-CP3GUIAN.js";
+} from "./chunk-XBPUVQDO.js";
 import {
   derivePersistedSchema,
   isZod4Schema
@@ -42,7 +42,7 @@ import {
   CustodyApi,
   NO_CARGO,
   NO_CUSTODY
-} from "./chunk-RUWEHFRB.js";
+} from "./chunk-723XB5NX.js";
 import {
   ServiceBus,
   WriteHookRegistry,
@@ -50,7 +50,7 @@ import {
   assertCanImport,
   canExport,
   canImport
-} from "./chunk-HBVEGUON.js";
+} from "./chunk-QABECTNN.js";
 import {
   NO_ATTESTATION
 } from "./chunk-LFGJG4XZ.js";
@@ -62,7 +62,7 @@ import {
 import {
   NO_TIERS,
   classifySealedShred
-} from "./chunk-E3LURVGQ.js";
+} from "./chunk-4VDFUBTS.js";
 import {
   NO_PORTABILITY
 } from "./chunk-II6DLDZM.js";
@@ -70,8 +70,12 @@ import {
   runDrainBarrier
 } from "./chunk-EU7HDMT3.js";
 import {
-  PERIODS_COLLECTION
-} from "./chunk-YSU2E4GZ.js";
+  PERIODS_COLLECTION,
+  PERIOD_ARCHIVES_COLLECTION,
+  PERIOD_FREEZES_COLLECTION,
+  PERIOD_TARGET_PURGES_COLLECTION,
+  periodExclusiveUpperBound
+} from "./chunk-37JZR7CY.js";
 import {
   TxContext,
   revertExecuted
@@ -83,7 +87,7 @@ import {
   EXPORT_AUDIT_COLLECTION,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-I6Q7YECW.js";
+} from "./chunk-PPPZIBKY.js";
 import {
   LazyQuery,
   decodeIdxId,
@@ -97,11 +101,11 @@ import {
 import {
   resolveManagedSecret,
   saveSealedPassphrase
-} from "./chunk-H7WQMGXH.js";
+} from "./chunk-P2PEPSPK.js";
 import {
   isDictCollectionName,
   isStaticDictDescriptor
-} from "./chunk-WFBZRXS5.js";
+} from "./chunk-PMMV5SQC.js";
 import {
   NO_TEAM,
   enrollAuthenticator,
@@ -112,7 +116,7 @@ import {
   rotatePassphrase,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-WGH3YV6Y.js";
+} from "./chunk-NTPWQH4S.js";
 import {
   hasRecoveryEnrolled,
   hasStrongRecoveryEnrolled,
@@ -122,7 +126,7 @@ import {
   mintShamirRecoveryEntry,
   savePaperRecoveryEntries,
   saveShamirRecoveryEntries
-} from "./chunk-VUHXLL32.js";
+} from "./chunk-FWART3VA.js";
 import {
   INDEXED_STORE_POLICY
 } from "./chunk-VQNJ7UZL.js";
@@ -138,17 +142,17 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-GMZFHDSG.js";
+} from "./chunk-TUL5YQWF.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-3CHNKEFI.js";
+} from "./chunk-FZK3JJJK.js";
 import {
   generateULID
 } from "./chunk-ZJADGNYF.js";
 import {
   sha256Hex
-} from "./chunk-G5CFMITA.js";
+} from "./chunk-UMH35AQV.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -157,7 +161,7 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-VMRXI3IF.js";
+} from "./chunk-VVLOWY74.js";
 import {
   NO_SEALED_RECORD
 } from "./chunk-XW5LZYV4.js";
@@ -170,16 +174,16 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-JIW3Q5JN.js";
+} from "./chunk-7TAV3BFQ.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-HGQ6UNHE.js";
+} from "./chunk-PVC2FBCQ.js";
 import {
   NOYDB_FORMAT_VERSION
-} from "./chunk-HCK2DFEK.js";
+} from "./chunk-REWTMYSF.js";
 import {
   encrypt
 } from "./chunk-5HZULLHE.js";
@@ -242,7 +246,7 @@ import {
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-F5N5ASDF.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-NJDDZ264.js");
   return new StoreCoordinationProvider(store);
 }
 
@@ -2375,7 +2379,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-DP66HFT3.js");
+      const { resolveStaleMVOnRead } = await import("./stale-77LP2EEF.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     let record;
@@ -2943,7 +2947,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-6LHOV7MN.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-MHUM2VZK.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -2952,7 +2956,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-DP66HFT3.js");
+          staleHelpers = await import("./stale-77LP2EEF.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -3156,7 +3160,7 @@ var Collection = class {
           const outputCollection = this.derivationSource.getCollection(outSpec.collection);
           const txCtx = this.derivationSource.getActiveTxContext();
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-BDKLP5GG.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-NBDKKCHT.js");
             const prior = await loadFanoutSidecar(this.adapter, this.vault, spec.source, run.runId, key, this.getDEK, this.storeCiphertext);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -3518,7 +3522,7 @@ var Collection = class {
       for (const [outputKey, outSpec] of Object.entries(spec.outputs)) {
         if (outSpec.shape !== "array") continue;
         if (helpers === null) {
-          helpers = await import("./fanout-sidecar-BDKLP5GG.js");
+          helpers = await import("./fanout-sidecar-NBDKKCHT.js");
         }
         const sidecar = await helpers.loadFanoutSidecar(this.adapter, this.vault, spec.source, id, outputKey, this.getDEK, this.storeCiphertext);
         if (!sidecar) continue;
@@ -3552,7 +3556,7 @@ var Collection = class {
       if (mode === "eager") {
         if (executor === null) {
           ;
-          ({ MaterializedViewExecutor: executor } = await import("./executor-6LHOV7MN.js"));
+          ({ MaterializedViewExecutor: executor } = await import("./executor-MHUM2VZK.js"));
         }
         await executor.refresh(reg, {
           getCollection: (name) => this.materializedViewSource.getCollection(name),
@@ -3561,7 +3565,7 @@ var Collection = class {
         });
       } else if (mode === "lazy") {
         if (staleHelpers === null) {
-          staleHelpers = await import("./stale-DP66HFT3.js");
+          staleHelpers = await import("./stale-77LP2EEF.js");
         }
         staleHelpers.markMVStale(registry, reg.spec.name);
       }
@@ -3584,7 +3588,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-DP66HFT3.js");
+      const { resolveStaleMVOnRead } = await import("./stale-77LP2EEF.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name);
     }
     await this.ensureHydrated();
@@ -4738,14 +4742,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./config-drift-LRKCC3VZ.js");
+    const { persistClassifiedMarkerForFields } = await import("./config-drift-RFEVGBKR.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./config-drift-LRKCC3VZ.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./config-drift-RFEVGBKR.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -5224,7 +5228,7 @@ var VaultPeriods = class {
       ...anchor.priorPeriodName !== void 0 && { priorPeriodName: anchor.priorPeriodName },
       ...options.dateField !== void 0 && { dateField: options.dateField }
     };
-    const envelope = await this.writePeriodRecord(record);
+    const envelope = await this.writeReserved(PERIODS_COLLECTION, record.name, record);
     await this.deps.strategy.appendPeriodLedgerEntry(this.deps.getLedgerOrNull(), this.deps.userId(), envelope, record.name);
     existing.push(record);
     this.periodCache = existing;
@@ -5279,20 +5283,208 @@ var VaultPeriods = class {
       priorPeriodName: anchor.priorPeriodName ?? prior.name,
       ...openingCollections.length > 0 && { openingCollections }
     };
-    const envelope = await this.writePeriodRecord(record);
+    const envelope = await this.writeReserved(PERIODS_COLLECTION, record.name, record);
     await this.deps.strategy.appendPeriodLedgerEntry(this.deps.getLedgerOrNull(), this.deps.userId(), envelope, record.name);
     existing.push(record);
     this.periodCache = existing;
     return record;
   }
-  /** Return every closed / opened period in `closedAt` order. */
+  /**
+   * Freeze a closed period: physically purges delete markers whose `_ts`
+   * falls inside the period's window (#604) and records the fact in a
+   * companion `_period_freezes/<name>` record. NEVER mutates the
+   * hash-chained `_periods/<name>` record's stored bytes — `frozenAt` /
+   * `frozenBy` / `purgedMarkerCount` are merged into `PeriodRecord`s on
+   * read only. Idempotent: a second call is a no-op that returns the
+   * same merged record without re-purging or re-appending a ledger entry.
+   */
+  async freezePeriod(name) {
+    const existing = await this.loadPeriodsCache();
+    const period = existing.find((p) => p.name === name);
+    if (!period) throw new ValidationError(`freezePeriod: no period named "${name}".`);
+    if (period.kind !== "closed") {
+      throw new ValidationError(
+        `freezePeriod: period "${name}" is "${period.kind}"; only a closed period can be frozen.`
+      );
+    }
+    const before = periodExclusiveUpperBound(period.endDate);
+    if (Date.parse(before) > Date.now()) {
+      throw new ValidationError(
+        `freezePeriod: period "${name}" purge window ends at ${before}, in the future; only a period whose window is fully in the past can be frozen (recent delete markers may not have converged).`
+      );
+    }
+    const prior = await this.readReserved(PERIOD_FREEZES_COLLECTION, name);
+    if (prior) return this.mergeFreeze(period, prior);
+    const purgedMarkerCount = await this.deps.purgeDeleteMarkers(before);
+    const freeze = {
+      period: name,
+      frozenAt: (/* @__PURE__ */ new Date()).toISOString(),
+      frozenBy: this.deps.userId(),
+      purgedMarkerCount
+    };
+    const envelope = await this.writeReserved(PERIOD_FREEZES_COLLECTION, name, freeze);
+    await this.deps.strategy.appendPeriodLedgerEntry(
+      this.deps.getLedgerOrNull(),
+      this.deps.userId(),
+      envelope,
+      name,
+      PERIOD_FREEZES_COLLECTION
+    );
+    return this.mergeFreeze(period, freeze);
+  }
+  /**
+   * Archive a closed period (#613): physically relocates its in-window
+   * records (those with `_ts < periodExclusiveUpperBound(endDate)`) from the
+   * hot store to the configured cold tier via `archiveRecords`, and records
+   * the fact in a companion `_period_archives/<name>` record. NEVER mutates
+   * the hash-chained `_periods/<name>` record. Non-destructive (reads fall
+   * through to cold) and idempotent: a second call is a no-op returning the
+   * same merged record.
+   */
+  async archivePeriod(name) {
+    const existing = await this.loadPeriodsCache();
+    const period = existing.find((p) => p.name === name);
+    if (!period) throw new ValidationError(`archivePeriod: no period named "${name}".`);
+    if (period.kind !== "closed") {
+      throw new ValidationError(
+        `archivePeriod: period "${name}" is "${period.kind}"; only a closed period can be archived.`
+      );
+    }
+    const prior = await this.readReserved(PERIOD_ARCHIVES_COLLECTION, name);
+    if (prior) return this.mergeArchive(period, prior);
+    const before = periodExclusiveUpperBound(period.endDate);
+    const archivedRecordCount = await this.deps.archiveRecords(before);
+    const archive = {
+      period: name,
+      archivedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      archivedBy: this.deps.userId(),
+      archivedRecordCount
+    };
+    const envelope = await this.writeReserved(PERIOD_ARCHIVES_COLLECTION, name, archive);
+    await this.deps.strategy.appendPeriodLedgerEntry(
+      this.deps.getLedgerOrNull(),
+      this.deps.userId(),
+      envelope,
+      name,
+      PERIOD_ARCHIVES_COLLECTION
+    );
+    return this.mergeArchive(period, archive);
+  }
+  /**
+   * Target-purge a closed period (#615): sweeps delete markers off the vault's
+   * PUSH-ONLY sync targets (`backup`/`archive`) via `purgeTargets`, recording a
+   * companion `_period_target_purges/<name>` record. `sync-peer` targets are
+   * skipped (resurrection risk). NEVER mutates the chained `_periods/<name>`
+   * record. Requires the period be frozen first (closed → frozen → target-purged).
+   * Idempotent once run; with no push-only targets it writes no companion and
+   * is re-runnable.
+   */
+  async purgePeriodTargets(name) {
+    const existing = await this.loadPeriodsCache();
+    const period = existing.find((p) => p.name === name);
+    if (!period) throw new ValidationError(`purgePeriodTargets: no period named "${name}".`);
+    if (period.kind !== "closed") {
+      throw new ValidationError(
+        `purgePeriodTargets: period "${name}" is "${period.kind}"; only a closed period can be target-purged.`
+      );
+    }
+    const frozen = await this.readReserved(PERIOD_FREEZES_COLLECTION, name);
+    if (!frozen) {
+      throw new ValidationError(
+        `purgePeriodTargets: period "${name}" must be frozen first (closed \u2192 frozen \u2192 target-purged).`
+      );
+    }
+    const prior = await this.readReserved(PERIOD_TARGET_PURGES_COLLECTION, name);
+    if (prior) return this.mergeTargetPurge(period, prior);
+    const before = periodExclusiveUpperBound(period.endDate);
+    const targets = await this.deps.purgeTargets(before);
+    if (targets.length === 0) return period;
+    const record = {
+      period: name,
+      purgedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      purgedBy: this.deps.userId(),
+      targets
+    };
+    const envelope = await this.writeReserved(PERIOD_TARGET_PURGES_COLLECTION, name, record);
+    await this.deps.strategy.appendPeriodLedgerEntry(
+      this.deps.getLedgerOrNull(),
+      this.deps.userId(),
+      envelope,
+      name,
+      PERIOD_TARGET_PURGES_COLLECTION
+    );
+    return this.mergeTargetPurge(period, record);
+  }
+  /** Merge target-purge companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
+  mergeTargetPurge(period, record) {
+    return {
+      ...period,
+      targetsPurgedAt: record.purgedAt,
+      targetsPurgedBy: record.purgedBy,
+      targetsPurged: record.targets
+    };
+  }
+  /** Merge archive companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
+  mergeArchive(period, archive) {
+    return {
+      ...period,
+      archivedAt: archive.archivedAt,
+      archivedBy: archive.archivedBy,
+      archivedRecordCount: archive.archivedRecordCount
+    };
+  }
+  /** Merge freeze companion fields into a fresh `PeriodRecord` copy — never mutates `periodCache`. */
+  mergeFreeze(period, freeze) {
+    return {
+      ...period,
+      frozenAt: freeze.frozenAt,
+      frozenBy: freeze.frozenBy,
+      purgedMarkerCount: freeze.purgedMarkerCount
+    };
+  }
+  /** Return every closed / opened period in `closedAt` order, merged with any freeze + archive companions. */
   async listPeriods() {
-    return [...await this.loadPeriodsCache()];
+    const all = await this.loadPeriodsCache();
+    const freezeIds = await this.deps.adapter.list(this.deps.vault, PERIOD_FREEZES_COLLECTION);
+    const freezes = /* @__PURE__ */ new Map();
+    for (const id of freezeIds) {
+      const f = await this.readReserved(PERIOD_FREEZES_COLLECTION, id);
+      if (f) freezes.set(f.period, f);
+    }
+    const archiveIds = await this.deps.adapter.list(this.deps.vault, PERIOD_ARCHIVES_COLLECTION);
+    const archives = /* @__PURE__ */ new Map();
+    for (const id of archiveIds) {
+      const a = await this.readReserved(PERIOD_ARCHIVES_COLLECTION, id);
+      if (a) archives.set(a.period, a);
+    }
+    const targetPurgeIds = await this.deps.adapter.list(this.deps.vault, PERIOD_TARGET_PURGES_COLLECTION);
+    const targetPurges = /* @__PURE__ */ new Map();
+    for (const id of targetPurgeIds) {
+      const tp = await this.readReserved(PERIOD_TARGET_PURGES_COLLECTION, id);
+      if (tp) targetPurges.set(tp.period, tp);
+    }
+    return all.map((p) => {
+      const f = freezes.get(p.name);
+      let merged = f ? this.mergeFreeze(p, f) : p;
+      const a = archives.get(p.name);
+      if (a) merged = this.mergeArchive(merged, a);
+      const tp = targetPurges.get(p.name);
+      if (tp) merged = this.mergeTargetPurge(merged, tp);
+      return merged;
+    });
   }
-  /** Look up a single period by name. Returns `null` if not found. */
+  /** Look up a single period by name, merged with its freeze + archive + target-purge companions if any. Returns `null` if not found. */
   async getPeriod(name) {
     const all = await this.loadPeriodsCache();
-    return all.find((p) => p.name === name) ?? null;
+    const period = all.find((p) => p.name === name);
+    if (!period) return null;
+    const freeze = await this.readReserved(PERIOD_FREEZES_COLLECTION, name);
+    const archive = await this.readReserved(PERIOD_ARCHIVES_COLLECTION, name);
+    let merged = freeze ? this.mergeFreeze(period, freeze) : period;
+    if (archive) merged = this.mergeArchive(merged, archive);
+    const targetPurge = await this.readReserved(PERIOD_TARGET_PURGES_COLLECTION, name);
+    if (targetPurge) merged = this.mergeTargetPurge(merged, targetPurge);
+    return merged;
   }
   /** Called by the gate bus before put/delete. */
   async assertTsWritable(existing, incoming) {
@@ -5317,11 +5509,12 @@ var VaultPeriods = class {
     this.periodCache = loaded;
     return loaded;
   }
-  async writePeriodRecord(record) {
-    const json = JSON.stringify(record);
+  /** Generic reserved-collection writer — serves `_periods` and `_period_freezes` alike. */
+  async writeReserved(collection, key, value) {
+    const json = JSON.stringify(value);
     let envelope;
     if (this.deps.encrypted) {
-      const dek = await this.deps.getDEK(PERIODS_COLLECTION);
+      const dek = await this.deps.getDEK(collection);
       const { iv, data } = await encrypt(json, dek);
       envelope = {
         _noydb: NOYDB_FORMAT_VERSION,
@@ -5341,9 +5534,16 @@ var VaultPeriods = class {
         _by: this.deps.userId()
       };
     }
-    await this.deps.adapter.put(this.deps.vault, PERIODS_COLLECTION, record.name, envelope);
+    await this.deps.adapter.put(this.deps.vault, collection, key, envelope);
     return envelope;
   }
+  /** Generic reserved-collection reader — serves `_period_freezes` companion reads. */
+  async readReserved(collection, key) {
+    const env = await this.deps.adapter.get(this.deps.vault, collection, key);
+    if (!env) return null;
+    const json = this.deps.encrypted ? await openEnvelopeJson(env, await this.deps.getDEK(collection)) : env._data;
+    return JSON.parse(json);
+  }
   async decryptPeriodRecord(envelope) {
     let json;
     if (this.deps.encrypted) {
@@ -5792,7 +5992,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-62Y36TOG.js").then(
+  const load = () => engine ??= import("./link-set-NSUIX6BR.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -5916,7 +6116,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-DCJ2SRVG.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-KOFRTCDD.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -6447,6 +6647,7 @@ var Vault = class {
   onDirty;
   onRegisterConflictResolver;
   syncAdapter;
+  getPurgeableTargets;
   historyConfig;
   /**
    * tree-shake seam for the optional blob service. Undefined
@@ -6712,6 +6913,7 @@ var Vault = class {
     this.onDirty = opts.onDirty;
     this.onRegisterConflictResolver = opts.onRegisterConflictResolver;
     this.syncAdapter = opts.syncAdapter;
+    this.getPurgeableTargets = opts.getPurgeableTargets ?? (() => []);
     this.blobStrategy = opts.blobStrategy;
     this.objectStore = opts.objectStore;
     this.archiveStrategy = opts.archiveStrategy;
@@ -6734,7 +6936,10 @@ var Vault = class {
       userId: () => this.keyring.userId,
       getDEK: (collection) => this.getDEK(collection),
       getLedgerOrNull: () => this.getLedgerOrNull(),
-      collection: (name) => this.collection(name)
+      collection: (name) => this.collection(name),
+      purgeDeleteMarkers: (before) => this._purgeDeleteMarkers(before),
+      archiveRecords: (before) => this._archiveClosedPeriod(before),
+      purgeTargets: (before) => this._purgePeriodTargets(before)
     });
     this.linksEnforcer = new VaultLinks({
       refRegistry: this.refRegistry,
@@ -6937,7 +7142,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-5NRE7HBZ.js");
+          const { persistSchemaIfNeeded } = await import("./register-3D6R2MKN.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -7116,7 +7321,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-5NRE7HBZ.js")).persistSchemaIfNeeded({
+            await (await import("./register-3D6R2MKN.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -7209,27 +7414,65 @@ var Vault = class {
    * ONLY; #604's period-close lifecycle is what earns that assertion. Do not call
    * it on live/unsettled data.
    *
-   * Emits no ledger/event yet — #604's period-close, the only intended caller, owns
-   * the audit record.
+   * Emits no ledger/event itself — its callers (#604's `freezePeriod`, #615's
+   * `purgePeriodTargets`) own the audit record. The sweep body is shared via
+   * {@link _purgeMarkersOn}, which #615 also aims at push-only sync targets.
    *
-   * Purges the local adapter only; the operator must purge every sync target too, or
-   * the next pull re-imports the markers (benign — they still read deleted — but no
-   * space is reclaimed). #604 owns cross-target purge.
+   * Purges the local adapter only. Markers already pushed to the vault's
+   * push-only (`backup`/`archive`) sync targets are reclaimed by #615's
+   * `vault.purgePeriodTargets`; `sync-peer` targets are left untouched (purging
+   * them would re-open the resurrection window — the deferred half of #611).
    */
   async _purgeDeleteMarkers(before, collections) {
-    const snapshot = await this.adapter.loadAll(this.name);
+    return this._purgeMarkersOn(this.adapter, before, collections);
+  }
+  /**
+   * @internal #615. Sweep delete markers with `_ts < before` off ANY store
+   * (local adapter or a push-only sync target). Returns the count removed.
+   */
+  async _purgeMarkersOn(store, before, collections) {
+    const snapshot = await store.loadAll(this.name);
     let removed = 0;
     for (const [coll, records] of Object.entries(snapshot)) {
       if (collections && !collections.includes(coll)) continue;
       for (const [id, env] of Object.entries(records)) {
         if (isDeleteMarker(env) && env._ts < before) {
-          await this.adapter.delete(this.name, coll, id);
+          await store.delete(this.name, coll, id);
           removed++;
         }
       }
     }
     return removed;
   }
+  /**
+   * @internal #613. Relocate this closed period's in-window records (those
+   * with `_ts < before`) from the hot store to the configured cold tier,
+   * via the routeStore's `compact({ before })`. Returns the count moved.
+   * Requires a `routeStore` with a cold route (the `coldArchival`
+   * capability); throws a clear error otherwise. Non-destructive — reads
+   * fall through to cold, so this does NOT re-open the #589 window.
+   */
+  async _archiveClosedPeriod(before) {
+    const store = this.adapter;
+    if (store.capabilities?.coldArchival !== true || typeof store.compact !== "function") {
+      throw new ValidationError("archivePeriod: cold archival requires a routeStore with a cold route.");
+    }
+    return store.compact(this.name, { before });
+  }
+  /**
+   * @internal #615. Sweep delete markers with `_ts < before` off each of the
+   * vault's push-only sync targets, returning a per-target count. Skips
+   * `sync-peer` targets by construction (getPurgeableTargets yields only
+   * backup/archive). Never touches the local adapter.
+   */
+  async _purgePeriodTargets(before) {
+    const out = [];
+    for (const t of this.getPurgeableTargets()) {
+      const purgedCount = await this._purgeMarkersOn(t.store, before);
+      out.push({ ...t.label !== void 0 ? { label: t.label } : {}, role: t.role, purgedCount });
+    }
+    return out;
+  }
   /**
    * For a detected conflict: capture this tab's clobbered record,
    * read the common ancestor from history, converge the cache to the store's
@@ -8269,7 +8512,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-5QLETK3Q.js"),
+      import("./registry-WIX6QCV5.js"),
       import("./read-only-facade-5ADRJVTM.js")
     ]);
     const registry = new DerivationRegistry();
@@ -8300,7 +8543,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-DYTNLOJC.js");
+    const { MaterializedViewRegistry } = await import("./registry-AI4E46PD.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -8371,13 +8614,13 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-6LHOV7MN.js");
+    const { MaterializedViewExecutor } = await import("./executor-MHUM2VZK.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this
     });
-    const { clearMVStale } = await import("./stale-DP66HFT3.js");
+    const { clearMVStale } = await import("./stale-77LP2EEF.js");
     clearMVStale(registry, name);
     return result;
   }
@@ -8418,7 +8661,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-BDKLP5GG.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-NBDKKCHT.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -8640,7 +8883,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-FDOXXHNG.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-IHXOASHV.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (passphrase) first."
@@ -8662,7 +8905,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-FDOXXHNG.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-IHXOASHV.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -8849,6 +9092,38 @@ var Vault = class {
   async getPeriod(name) {
     return this.periods.getPeriod(name);
   }
+  /**
+   * Freeze a closed period (#604): purges in-window delete markers and
+   * records a `_period_freezes` companion, never mutating the chained
+   * `_periods` record. Idempotent. Purges the LOCAL adapter only — a
+   * synced target's markers survive there and re-import on pull (benign),
+   * and purging re-opens the #589 resurrection window for a peer offline
+   * since before the cutoff (see periods.ts's "Freeze" section).
+   */
+  async freezePeriod(name) {
+    return this.periods.freezePeriod(name);
+  }
+  /**
+   * Archive a closed period (#613): relocates its in-window records from the
+   * hot store to the configured cold tier (via the routeStore's cold route),
+   * recording a `_period_archives` companion + ledger entry, never mutating
+   * the chained `_periods` record. Non-destructive (reads fall through to
+   * cold) and idempotent. Requires a routeStore with a cold route.
+   */
+  async archivePeriod(name) {
+    return this.periods.archivePeriod(name);
+  }
+  /**
+   * Target-purge a closed+frozen period (#615): sweeps delete markers off the
+   * vault's push-only sync targets (`backup`/`archive`), recording a
+   * `_period_target_purges` companion + ledger entry, never mutating the chained
+   * `_periods` record. `sync-peer` targets are skipped. Requires the period be
+   * frozen first. Idempotent; a vault with no push-only targets writes no
+   * companion and is re-runnable.
+   */
+  async purgePeriodTargets(name) {
+    return this.periods.purgePeriodTargets(name);
+  }
   /** @internal — called by the gate bus before put/delete. */
   async _assertTsWritable(existing, incoming) {
     return this.periods.assertTsWritable(existing, incoming);
@@ -8878,7 +9153,7 @@ var Vault = class {
    * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-3SB25HF2.js");
+    const { dumpVaultSchema } = await import("./walk-SMAE4IEI.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -9013,7 +9288,7 @@ var Vault = class {
    * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/public-envelope.md
    */
   async getPublicEnvelope(opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-CBRIJORQ.js");
+    const { readPublicEnvelope } = await import("./public-envelope-NC7SPNMV.js");
     return readPublicEnvelope(this.adapter, this.name, opts);
   }
   /**
@@ -9028,7 +9303,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-7PX6NDKT.js");
+    const { dumpVault } = await import("./backup-WRGNTGJF.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -9080,7 +9355,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-7PX6NDKT.js");
+    const { loadVault } = await import("./backup-WRGNTGJF.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -9112,7 +9387,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-7PX6NDKT.js");
+    const { verifyBackupIntegrity } = await import("./backup-WRGNTGJF.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -9330,7 +9605,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-7PX6NDKT.js");
+    const { exportVaultJSON } = await import("./backup-WRGNTGJF.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -10958,6 +11233,7 @@ function createPlaintextKeyring(userId, debugPlaintext = false) {
     ...debugPlaintext ? { debugPlaintext } : {}
   };
 }
+var emptyPullResult = () => ({ pulled: 0, conflicts: [], errors: [] });
 var Noydb = class {
   options;
   emitter = new NoydbEventEmitter();
@@ -11374,6 +11650,7 @@ var Noydb = class {
       } : void 0,
       onRegisterConflictResolver: syncEngine ? (resolverName, resolver) => syncEngine.registerConflictResolver(resolverName, resolver) : void 0,
       syncAdapter: targets.length > 0 ? targets[0].store : void 0,
+      getPurgeableTargets: () => targets.filter((t) => t.role === "backup" || t.role === "archive").map((t) => ({ store: t.store, role: t.role, ...t.label !== void 0 ? { label: t.label } : {} })),
       historyConfig: this.options.history,
       ...this.options.blobStrategy !== void 0 ? { blobStrategy: this.options.blobStrategy } : {},
       ...this.options.objectStore !== void 0 ? { objectStore: this.options.objectStore } : {},
@@ -11894,9 +12171,13 @@ var Noydb = class {
     const engine = this.getSyncEngine(vault);
     return engine.push(options);
   }
-  /** Pull remote changes to local for a vault. */
+  /**
+   * Pull remote changes to local for a vault. A `backup`/`archive` primary is a
+   * push-only sink and is never pulled from (#616) — returns an empty result.
+   */
   async pull(vault, options) {
     const engine = this.getSyncEngine(vault);
+    if (engine.role !== "sync-peer") return emptyPullResult();
     return engine.pull(options);
   }
   /**
@@ -11905,7 +12186,7 @@ var Noydb = class {
    */
   async sync(vault, options) {
     const primary = this.getSyncEngine(vault);
-    const result = await primary.sync(options);
+    const result = primary.role === "sync-peer" ? await primary.sync(options) : { pull: emptyPullResult(), push: await primary.push(options?.push) };
     for (const [key, engine] of this.syncEngines) {
       if (key === vault) continue;
       if (!key.startsWith(`${vault}::`)) continue;
@@ -12462,7 +12743,7 @@ var Noydb = class {
         "setPublicEnvelope: the public-envelope feature is not enabled. Pass `publicEnvelope: true` (or a schema object) to `createNoydb`."
       );
     }
-    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-CBRIJORQ.js");
+    const { loadPublicEnvelope, savePublicEnvelope, resolveSchema, validatePublicEnvelopeInput } = await import("./public-envelope-NC7SPNMV.js");
     const schema = resolveSchema(this.options.publicEnvelope);
     validatePublicEnvelopeInput(input, schema);
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -12491,7 +12772,7 @@ var Noydb = class {
    * regardless).
    */
   async getPublicEnvelope(vault, opts = {}) {
-    const { readPublicEnvelope } = await import("./public-envelope-CBRIJORQ.js");
+    const { readPublicEnvelope } = await import("./public-envelope-NC7SPNMV.js");
     return readPublicEnvelope(this.options.store, vault, opts);
   }
   // ─── Auth introspection ─────────────────────────────────────────
@@ -12682,9 +12963,9 @@ async function createNoydb(options) {
     throw new ValidationError("A secret (passphrase) or getKeyring callback is required when encryption is enabled");
   }
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-Z66JMGOU.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-JDWL67WL.js")).createUserApi };
   if (!options.policyFactory) {
-    const policyModule = await import("./policy-SXPLTQS4.js");
+    const policyModule = await import("./policy-Y7HL2KGA.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
   }
   return new Noydb(options);
@@ -12719,4 +13000,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-5K7KZMXG.js.map
+//# sourceMappingURL=chunk-56JB2BGI.js.map