@noy-db/hub 0.6.0-pre.0 → 0.6.0-pre.10

package/dist/{chunk-3CLZY46Y.js → chunk-N3BI6P3J.js}

@@ -21,13 +21,13 @@ import {
 } from "./chunk-GYGLAVCX.js";
 import {
   loadFence
-} from "./chunk-MVOWXQHN.js";
+} from "./chunk-6BU3L4UE.js";
 import {
   VectorSet,
   buildPersistedIndexCallbacks,
   encodeVecId,
   syncTierSearch
-} from "./chunk-ZGGVOADG.js";
+} from "./chunk-G6S5VVHP.js";
 import {
   SchemaUpdateGate
 } from "./chunk-6LJY7X5A.js";
@@ -35,12 +35,12 @@ import {
   NO_CLASSIFIED,
   guardClassifiedCompat,
   resolveClassifiedFields
-} from "./chunk-GS5RT2KK.js";
+} from "./chunk-QULVCV3M.js";
 import {
   NO_TIERS,
   classifySealedShred,
   syncDerivedOutputs
-} from "./chunk-PGAPBZEK.js";
+} from "./chunk-6NVPFKN3.js";
 import {
   NO_PORTABILITY
 } from "./chunk-FUHKW252.js";
@@ -50,7 +50,7 @@ import {
 } from "./chunk-DG27IUVI.js";
 import {
   saveSealedSecret
-} from "./chunk-MC2LFTQM.js";
+} from "./chunk-XWX7GL56.js";
 import {
   fallbackDerivationName,
   jsonSchemaToFields
@@ -58,18 +58,18 @@ import {
 import {
   derivePersistedSchema,
   isZod4Schema
-} from "./chunk-2LGDCNFJ.js";
+} from "./chunk-Z45YRGFO.js";
 import {
   loadPersistedSchema
-} from "./chunk-V5C5NNBR.js";
+} from "./chunk-CDB2HVQW.js";
 import {
   CustodyApi,
   NO_CUSTODY
-} from "./chunk-TLNNHG3A.js";
+} from "./chunk-ADW22QSB.js";
 import {
   DEFAULT_POSTURE,
   ViaGraph
-} from "./chunk-T4GPR2IR.js";
+} from "./chunk-7TSYBD3E.js";
 import {
   buildLookupAltIndex,
   buildLookupSnapshotRows,
@@ -93,7 +93,7 @@ import {
   selfWriteFieldEqual,
   touchFor,
   updateReferencingRecords
-} from "./chunk-ZXJXDHNK.js";
+} from "./chunk-5ZKS6ZE2.js";
 import {
   OverlayedCollection
 } from "./chunk-OF3L2SD6.js";
@@ -109,15 +109,20 @@ import {
 } from "./chunk-PEOZ34EM.js";
 import {
   NO_PERIODS,
-  purgeMarkersOn
-} from "./chunk-LTU4FLHG.js";
+  isEffectivelyReopened,
+  purgeMarkersOn,
+  resolvePeriodKey,
+  resolveReopenState,
+  samePartition
+} from "./chunk-5O5HRRTV.js";
 import {
   PERIODS_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_FREEZES_COLLECTION,
+  PERIOD_REOPENS_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
   periodExclusiveUpperBound
-} from "./chunk-JXIDGFKS.js";
+} from "./chunk-HPLWFNG4.js";
 import {
   NO_SHADOW
 } from "./chunk-SMY5X46Z.js";
@@ -135,13 +140,13 @@ import {
   InvertedIndex,
   MemoryIndexStore,
   NO_SEARCH
-} from "./chunk-XBLKM73C.js";
+} from "./chunk-3JVXVJ7L.js";
 import {
   NO_SEQUENCE,
   SEQUENCE_COLLECTION,
   compileSequenceFormat,
   resolveSequenceKey
-} from "./chunk-NQCNSVGI.js";
+} from "./chunk-7MNBICB5.js";
 import {
   Query,
   ScanBuilder
@@ -151,7 +156,7 @@ import {
   NO_BLOBS,
   createExportBlobsHandle,
   runCompaction
-} from "./chunk-P7NGLLUF.js";
+} from "./chunk-WASHZV34.js";
 import {
   LazyQuery,
   NO_INDEXING,
@@ -180,7 +185,7 @@ import {
 } from "./chunk-PVEWA2DU.js";
 import {
   dictCollectionName
-} from "./chunk-XB7LUDKM.js";
+} from "./chunk-WFUIE565.js";
 import {
   NO_I18N,
   getAtPath,
@@ -215,7 +220,7 @@ import {
   saveShamirRecoveryEntries,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "./chunk-DPJTDNUF.js";
+} from "./chunk-O2ERS4UJ.js";
 import {
   assertKeyringOpenAllowed,
   buildRecipientKeyringFile,
@@ -230,11 +235,11 @@ import {
   listUsers,
   loadKeyring,
   updateKeyringIdentity
-} from "./chunk-RLWY6Z44.js";
+} from "./chunk-JRKZTEZZ.js";
 import {
   persistDirectoryConfig,
   readDirectoryConfig
-} from "./chunk-27TCYH6G.js";
+} from "./chunk-5JY5TSVY.js";
 import {
   NO_BROKER,
   buildCredentialBrokerHandle
@@ -255,7 +260,7 @@ import {
 } from "./chunk-3FSX6LDG.js";
 import {
   sha256Hex
-} from "./chunk-24UICKTB.js";
+} from "./chunk-6SAFL5YE.js";
 import {
   NO_FORGET,
   addSubjectRef,
@@ -264,7 +269,7 @@ import {
   readDottedPath,
   rebuildSubjectIndex,
   removeSubjectRef
-} from "./chunk-RPXL6KSX.js";
+} from "./chunk-WLZ47GSL.js";
 import {
   NO_SEALED_RECORD
 } from "./chunk-FAXZQ5UF.js";
@@ -278,20 +283,20 @@ import {
   queryByDet,
   resolveStableCek,
   validateSchemaInput
-} from "./chunk-FY343IZR.js";
+} from "./chunk-3URQC7EH.js";
 import {
   buildDeleteMarker,
   buildTombstone,
   isDeleteMarker,
   isTombstone
-} from "./chunk-NQRJ5AJO.js";
+} from "./chunk-7H73RIE3.js";
 import {
   encrypt
 } from "./chunk-VCETL77O.js";
 import {
   NOYDB_FORMAT_VERSION,
   SealedHandle
-} from "./chunk-24ZLWWEO.js";
+} from "./chunk-YPYHVOXP.js";
 import {
   AlreadyElevatedError,
   AttestationError,
@@ -464,7 +469,7 @@ function validateSecretModeOptions(options) {
 }
 async function resolveEffectiveSecret(options, store, vault) {
   if (options.secretMode === "managed") {
-    const { resolveManagedSecret } = await import("./managed-secret-EAOYWRYF.js");
+    const { resolveManagedSecret } = await import("./managed-secret-CWQ6PND5.js");
     return resolveManagedSecret(store, vault, options.sealingKey);
   }
   return options.secret;
@@ -482,7 +487,7 @@ function ownerKeyringOptions(options, secret) {
 
 // src/port/by/default-provider.ts
 async function createDefaultCoordinationProvider(store) {
-  const { StoreCoordinationProvider } = await import("./store-coordination-provider-4SKLSFUG.js");
+  const { StoreCoordinationProvider } = await import("./store-coordination-provider-GFCUOBR6.js");
   return new StoreCoordinationProvider(store);
 }
 
@@ -3404,7 +3409,7 @@ var Collection = class {
       }
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-K734VACF.js");
+      const { resolveStaleMVOnRead } = await import("./stale-ARHFVL5U.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     let record;
@@ -3934,7 +3939,7 @@ var Collection = class {
    */
   async dispatchMaterializedViews(id, record, wave) {
     if (this.materializedViewSource === void 0) return;
-    const { dispatchMaterializedViews } = await import("./dispatch-4XIJSFTT.js");
+    const { dispatchMaterializedViews } = await import("./dispatch-FZEAWKVM.js");
     return dispatchMaterializedViews(this.#mvDispatchCtx(this.materializedViewSource), id, record, wave);
   }
   /**
@@ -4107,7 +4112,7 @@ var Collection = class {
    *  dispatch wave's per-target dedup; `undefined` on the local-write path (byte-identical). */
   async dispatchDerivations(id, record, version, wave) {
     if (this.derivationSource === void 0) return;
-    const { dispatchDerivations } = await import("./dispatch-N5HGVUGU.js");
+    const { dispatchDerivations } = await import("./dispatch-MJ6SHB3Y.js");
     return dispatchDerivations({
       ...this.#derivationDeleteCtx(this.derivationSource),
       via: this.via,
@@ -4422,7 +4427,7 @@ var Collection = class {
    */
   async dispatchArrayDerivationsOnDelete(id, eraseRecordShapeToo = false) {
     if (this.derivationSource === void 0) return 0;
-    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-N5HGVUGU.js");
+    const { dispatchArrayDerivationsOnDelete } = await import("./dispatch-MJ6SHB3Y.js");
     return dispatchArrayDerivationsOnDelete(this.#derivationDeleteCtx(this.derivationSource), id, eraseRecordShapeToo);
   }
   /**
@@ -4436,7 +4441,7 @@ var Collection = class {
    */
   async dispatchMaterializedViewsOnDelete(id) {
     if (this.materializedViewSource === void 0) return { deleted: 0, residueUndecodable: [], residueDeclined: [] };
-    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-4XIJSFTT.js");
+    const { dispatchMaterializedViewsOnDelete } = await import("./dispatch-FZEAWKVM.js");
     return dispatchMaterializedViewsOnDelete(this.#mvDispatchCtx(this.materializedViewSource), id);
   }
   /**
@@ -4456,7 +4461,7 @@ var Collection = class {
       );
     }
     if (this.materializedViewSource !== void 0) {
-      const { resolveStaleMVOnRead } = await import("./stale-K734VACF.js");
+      const { resolveStaleMVOnRead } = await import("./stale-ARHFVL5U.js");
       await resolveStaleMVOnRead(this.materializedViewSource, this.name, this.#dispatchCtx({ collection: this.name, id: "resolve-on-read" }));
     }
     await this.ensureHydrated();
@@ -5566,14 +5571,14 @@ var Collection = class {
   /** C-A/R10: persist the classified marker once per classified handle (store I/O in config-drift.ts). */
   async _ensureClassifiedMarker() {
     if (this._markerPersisted || this.vdigFields === null) return;
-    const { persistClassifiedMarkerForFields } = await import("./classified-marker-MH3ON5OL.js");
+    const { persistClassifiedMarkerForFields } = await import("./classified-marker-2KJAXRRO.js");
     await persistClassifiedMarkerForFields(this.adapter, this.vault, this.name, this.vdigFields, await this.getDEK(this.name));
     this._markerPersisted = true;
   }
   /** C-A/R10 drift signal — the marker's declared digest-only set, memoized to one store read per handle (see config-drift.ts). */
   async _classifiedMarkerDigestOnly() {
     if (this._markerDigestOnlyCache !== void 0) return this._markerDigestOnlyCache;
-    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-MH3ON5OL.js");
+    const { readClassifiedMarkerDigestOnly } = await import("./classified-marker-2KJAXRRO.js");
     this._markerDigestOnlyCache = await readClassifiedMarkerDigestOnly(this.adapter, this.vault, this.name, await this.getDEK(this.name));
     return this._markerDigestOnlyCache;
   }
@@ -6120,6 +6125,18 @@ var DeferredNumberingStore = class {
 };
 
 // src/with-audit/periods/vault-facade.ts
+function hasPartition(partition) {
+  return partition !== void 0 && partition.length > 0;
+}
+function scopeSuffix(options) {
+  return hasPartition(options?.partition) ? ` in partition [${options.partition.join(", ")}]` : "";
+}
+function assertVaultWide(op, period, why) {
+  if (!hasPartition(period.partition)) return;
+  throw new ValidationError(
+    `${op}: period "${period.name}" is partitioned ([${period.partition.join(", ")}]), and ${op} ${why} \u2014 it cannot be scoped to one timeline, because the store sees only ciphertext and cannot tell which partition a stored record belongs to. Close partitioned periods for their sealing semantics; run ${op} against an unpartitioned period covering the same window.`
+  );
+}
 var VaultPeriods = class {
   constructor(deps) {
     this.deps = deps;
@@ -6134,11 +6151,11 @@ var VaultPeriods = class {
   periodCache = null;
   async closePeriod(options) {
     const existing = await this.loadPeriodsCache();
-    this.deps.strategy.validatePeriodName(options.name, existing);
+    this.deps.strategy.validatePeriodName(options.name, existing, options.partition);
     if (typeof options.endDate !== "string" || options.endDate.length === 0) {
       throw new ValidationError("closePeriod: endDate must be a non-empty ISO string.");
     }
-    const anchor = await this.deps.strategy.chainAnchor(existing);
+    const anchor = await this.deps.strategy.chainAnchor(existing, options.partition);
     const record = {
       name: options.name,
       kind: "closed",
@@ -6147,21 +6164,26 @@ var VaultPeriods = class {
       closedBy: this.deps.userId(),
       priorPeriodHash: anchor.priorPeriodHash,
       ...anchor.priorPeriodName !== void 0 && { priorPeriodName: anchor.priorPeriodName },
-      ...options.dateField !== void 0 && { dateField: options.dateField }
+      ...options.dateField !== void 0 && { dateField: options.dateField },
+      ...hasPartition(options.partition) && { partition: options.partition }
     };
-    const envelope = await this.writeReserved(PERIODS_COLLECTION, record.name, record);
-    await this.deps.strategy.appendPeriodLedgerEntry(this.deps.getLedgerOrNull(), this.deps.userId(), envelope, record.name);
+    const storageKey = resolvePeriodKey(record.name, record.partition);
+    const envelope = await this.writeReserved(PERIODS_COLLECTION, storageKey, record);
+    await this.deps.strategy.appendPeriodLedgerEntry(this.deps.getLedgerOrNull(), this.deps.userId(), envelope, storageKey);
     existing.push(record);
     this.periodCache = existing;
     return record;
   }
   async openPeriod(options) {
     const existing = await this.loadPeriodsCache();
-    this.deps.strategy.validatePeriodName(options.name, existing);
-    const prior = existing.find((p) => p.name === options.fromPeriod);
+    this.deps.strategy.validatePeriodName(options.name, existing, options.partition);
+    const prior = existing.find(
+      (p) => p.name === options.fromPeriod && samePartition(p.partition, options.partition)
+    );
     if (!prior) {
+      const where = hasPartition(options.partition) ? ` in partition [${options.partition.join(", ")}]` : "";
       throw new ValidationError(
-        `openPeriod: fromPeriod "${options.fromPeriod}" does not exist in this vault.`
+        `openPeriod: fromPeriod "${options.fromPeriod}" does not exist in this vault${where}.`
       );
     }
     if (prior.kind !== "closed") {
@@ -6191,7 +6213,7 @@ var VaultPeriods = class {
       }
       openingCollections.push(collName);
     }
-    const anchor = await this.deps.strategy.chainAnchor(existing);
+    const anchor = await this.deps.strategy.chainAnchor(existing, options.partition);
     const record = {
       name: options.name,
       kind: "opened",
@@ -6202,10 +6224,12 @@ var VaultPeriods = class {
       closedBy: this.deps.userId(),
       priorPeriodHash: anchor.priorPeriodHash,
       priorPeriodName: anchor.priorPeriodName ?? prior.name,
-      ...openingCollections.length > 0 && { openingCollections }
+      ...openingCollections.length > 0 && { openingCollections },
+      ...hasPartition(options.partition) && { partition: options.partition }
     };
-    const envelope = await this.writeReserved(PERIODS_COLLECTION, record.name, record);
-    await this.deps.strategy.appendPeriodLedgerEntry(this.deps.getLedgerOrNull(), this.deps.userId(), envelope, record.name);
+    const storageKey = resolvePeriodKey(record.name, record.partition);
+    const envelope = await this.writeReserved(PERIODS_COLLECTION, storageKey, record);
+    await this.deps.strategy.appendPeriodLedgerEntry(this.deps.getLedgerOrNull(), this.deps.userId(), envelope, storageKey);
     existing.push(record);
     this.periodCache = existing;
     return record;
@@ -6219,10 +6243,11 @@ var VaultPeriods = class {
    * read only. Idempotent: a second call is a no-op that returns the
    * same merged record without re-purging or re-appending a ledger entry.
    */
-  async freezePeriod(name) {
+  async freezePeriod(name, options) {
     const existing = await this.loadPeriodsCache();
-    const period = existing.find((p) => p.name === name);
-    if (!period) throw new ValidationError(`freezePeriod: no period named "${name}".`);
+    const period = this.findPeriod(existing, name, options);
+    if (!period) throw new ValidationError(`freezePeriod: no period named "${name}"${scopeSuffix(options)}.`);
+    assertVaultWide("freezePeriod", period, "purges delete markers by write-time across the whole store");
     if (period.kind !== "closed") {
       throw new ValidationError(
         `freezePeriod: period "${name}" is "${period.kind}"; only a closed period can be frozen.`
@@ -6262,10 +6287,11 @@ var VaultPeriods = class {
    * through to cold) and idempotent: a second call is a no-op returning the
    * same merged record.
    */
-  async archivePeriod(name) {
+  async archivePeriod(name, options) {
     const existing = await this.loadPeriodsCache();
-    const period = existing.find((p) => p.name === name);
-    if (!period) throw new ValidationError(`archivePeriod: no period named "${name}".`);
+    const period = this.findPeriod(existing, name, options);
+    if (!period) throw new ValidationError(`archivePeriod: no period named "${name}"${scopeSuffix(options)}.`);
+    assertVaultWide("archivePeriod", period, "relocates records by write-time across the whole store");
     if (period.kind !== "closed") {
       throw new ValidationError(
         `archivePeriod: period "${name}" is "${period.kind}"; only a closed period can be archived.`
@@ -6300,10 +6326,11 @@ var VaultPeriods = class {
    * Idempotent once run; with no push-only targets it writes no companion and
    * is re-runnable.
    */
-  async purgePeriodTargets(name) {
+  async purgePeriodTargets(name, options) {
     const existing = await this.loadPeriodsCache();
-    const period = existing.find((p) => p.name === name);
-    if (!period) throw new ValidationError(`purgePeriodTargets: no period named "${name}".`);
+    const period = this.findPeriod(existing, name, options);
+    if (!period) throw new ValidationError(`purgePeriodTargets: no period named "${name}"${scopeSuffix(options)}.`);
+    assertVaultWide("purgePeriodTargets", period, "sweeps delete markers by write-time off whole sync targets");
     if (period.kind !== "closed") {
       throw new ValidationError(
         `purgePeriodTargets: period "${name}" is "${period.kind}"; only a closed period can be target-purged.`
@@ -6363,8 +6390,15 @@ var VaultPeriods = class {
       purgedMarkerCount: freeze.purgedMarkerCount
     };
   }
-  /** Return every closed / opened period in `closedAt` order, merged with any freeze + archive companions. */
-  async listPeriods() {
+  /**
+   * Return every closed / opened period in `closedAt` order, merged with any
+   * freeze + archive companions.
+   *
+   * With no argument this spans EVERY timeline — the pre-#1005 behaviour, and
+   * the right default for an audit sweep. Pass `{ partition }` to scope to one
+   * timeline; `{ partition: [] }` (or omitting it) means the vault-wide one.
+   */
+  async listPeriods(options) {
     this.periodCache = null;
     const all = await this.loadPeriodsCache();
     const freezeIds = await this.deps.adapter.list(this.deps.vault, PERIOD_FREEZES_COLLECTION);
@@ -6385,7 +6419,9 @@ var VaultPeriods = class {
       const tp = await this.readReserved(PERIOD_TARGET_PURGES_COLLECTION, id);
       if (tp) targetPurges.set(tp.period, tp);
     }
-    return all.map((p) => {
+    const scoped = options === void 0 ? all : all.filter((p) => samePartition(p.partition, options.partition));
+    const withReopen = await this.mergeReopenState(scoped);
+    return withReopen.map((p) => {
       const f = freezes.get(p.name);
       let merged = f ? this.mergeFreeze(p, f) : p;
       const a = archives.get(p.name);
@@ -6395,31 +6431,161 @@ var VaultPeriods = class {
       return merged;
     });
   }
-  /** Look up a single period by name, merged with its freeze + archive + target-purge companions if any. Returns `null` if not found. */
-  async getPeriod(name) {
+  /**
+   * Look up a single period by name within one timeline, merged with its
+   * freeze + archive + target-purge companions if any. Returns `null` if not
+   * found.
+   *
+   * Names are only unique per partition (#1005), so this resolves against the
+   * VAULT-WIDE timeline unless `{ partition }` says otherwise — matching how
+   * every pre-partition period is stored.
+   */
+  async getPeriod(name, options) {
     const all = await this.loadPeriodsCache();
-    const period = all.find((p) => p.name === name);
+    const period = this.findPeriod(all, name, options);
     if (!period) return null;
-    const freeze = await this.readReserved(PERIOD_FREEZES_COLLECTION, name);
-    const archive = await this.readReserved(PERIOD_ARCHIVES_COLLECTION, name);
+    const key = resolvePeriodKey(name, options?.partition);
+    const freeze = await this.readReserved(PERIOD_FREEZES_COLLECTION, key);
+    const archive = await this.readReserved(PERIOD_ARCHIVES_COLLECTION, key);
     let merged = freeze ? this.mergeFreeze(period, freeze) : period;
     if (archive) merged = this.mergeArchive(merged, archive);
-    const targetPurge = await this.readReserved(PERIOD_TARGET_PURGES_COLLECTION, name);
+    const targetPurge = await this.readReserved(PERIOD_TARGET_PURGES_COLLECTION, key);
     if (targetPurge) merged = this.mergeTargetPurge(merged, targetPurge);
+    const reopenLog = await this.readReserved(PERIOD_REOPENS_COLLECTION, key);
+    if (reopenLog) merged = { ...merged, ...resolveReopenState(reopenLog.events) };
     return merged;
   }
-  /** Called by the gate bus before put/delete. */
-  async assertTsWritable(existing, incoming) {
+  /**
+   * The full append-only reopen/reclose log for one period (#1022) — the record
+   * an audit actually asks for, in order. `[]` when never reopened.
+   */
+  async listPeriodReopens(name, options) {
+    const key = resolvePeriodKey(name, options?.partition);
+    const log = await this.readReserved(PERIOD_REOPENS_COLLECTION, key);
+    return log?.events ?? [];
+  }
+  /**
+   * Return a closed period to a writable state (#1022).
+   *
+   * Close is a three-state lifecycle in practice — open / closed / reopened —
+   * because a month gets closed and then a missing invoice arrives, or a filing
+   * is rejected and must be amended. That is routine, and it is supposed to
+   * leave a trail.
+   *
+   * The `_periods/<key>` record is NOT touched: the reopen is appended to a
+   * companion log, so the inter-period hash chain that proves the close
+   * happened survives the reopen intact. The chain reads *closed at T1,
+   * reopened at T2 by U, reclosed at T3*.
+   *
+   * A reopen withdraws the PERIOD's veto and nothing else. Record-level rules —
+   * an `immutableGuard` on a sent receipt, a frozen field — are separate gate
+   * handlers registered ahead of the period gate, so a reopened month cannot
+   * resurrect a document that is independently locked. Period state can only
+   * ever widen what the record-level rule already permits.
+   *
+   * Reopening an already-open window is allowed and appends another event: that
+   * is how a window gets extended, and the log keeps both.
+   */
+  async reopenPeriod(name, options) {
+    const existing = await this.loadPeriodsCache();
+    const period = this.findPeriod(existing, name, options);
+    if (!period) throw new ValidationError(`reopenPeriod: no period named "${name}"${scopeSuffix(options)}.`);
+    if (period.kind !== "closed") {
+      throw new ValidationError(
+        `reopenPeriod: period "${name}" is "${period.kind}"; only a closed period can be reopened.`
+      );
+    }
+    if (options?.until !== void 0 && Number.isNaN(Date.parse(options.until))) {
+      throw new ValidationError(`reopenPeriod: unparseable \`until\` "${options.until}".`);
+    }
+    return this.appendReopenEvent(period, options, {
+      op: "reopen",
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      by: this.deps.userId(),
+      ...options?.until !== void 0 && { until: options.until },
+      ...options?.reason !== void 0 && { reason: options.reason }
+    });
+  }
+  /**
+   * Seal a reopened period again (#1022), ending the window explicitly rather
+   * than waiting for an `until` to lapse. Appends to the same log, so the
+   * close → reopen → reclose sequence is recoverable in order.
+   */
+  async reclosePeriod(name, options) {
+    const existing = await this.loadPeriodsCache();
+    const period = this.findPeriod(existing, name, options);
+    if (!period) throw new ValidationError(`reclosePeriod: no period named "${name}"${scopeSuffix(options)}.`);
+    const merged = await this.mergeReopenState([period]);
+    if (!isEffectivelyReopened(merged[0], (/* @__PURE__ */ new Date()).toISOString())) {
+      throw new ValidationError(
+        `reclosePeriod: period "${name}"${scopeSuffix(options)} is not currently reopened \u2014 nothing to reclose. A period whose \`until\` has already lapsed re-sealed on its own.`
+      );
+    }
+    return this.appendReopenEvent(period, options, {
+      op: "reclose",
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      by: this.deps.userId(),
+      ...options?.reason !== void 0 && { reason: options.reason }
+    });
+  }
+  /** Append one entry to a period's reopen log, ledger it, and invalidate the guard's view. */
+  async appendReopenEvent(period, scope, event) {
+    const key = resolvePeriodKey(period.name, period.partition);
+    const prior = await this.readReserved(PERIOD_REOPENS_COLLECTION, key);
+    const record = {
+      period: period.name,
+      ...hasPartition(period.partition) && { partition: period.partition },
+      events: [...prior?.events ?? [], event]
+    };
+    const envelope = await this.writeReserved(PERIOD_REOPENS_COLLECTION, key, record);
+    await this.deps.strategy.appendPeriodLedgerEntry(
+      this.deps.getLedgerOrNull(),
+      this.deps.userId(),
+      envelope,
+      key,
+      PERIOD_REOPENS_COLLECTION
+    );
+    this.periodCache = null;
+    void scope;
+    return { ...period, ...resolveReopenState(record.events) };
+  }
+  /** Merge each period's reopen log onto it. One adapter listing, not one per period. */
+  async mergeReopenState(periods) {
+    if (periods.length === 0) return [];
+    const ids = await this.deps.adapter.list(this.deps.vault, PERIOD_REOPENS_COLLECTION);
+    if (ids.length === 0) return [...periods];
+    const byKey = /* @__PURE__ */ new Map();
+    for (const id of ids) {
+      const r = await this.readReserved(PERIOD_REOPENS_COLLECTION, id);
+      if (r) byKey.set(id, r);
+    }
+    return periods.map((p) => {
+      const log = byKey.get(resolvePeriodKey(p.name, p.partition));
+      return log ? { ...p, ...resolveReopenState(log.events) } : p;
+    });
+  }
+  /** Resolve one period within the timeline named by `options` (vault-wide when absent). */
+  findPeriod(all, name, options) {
+    return all.find((p) => p.name === name && samePartition(p.partition, options?.partition));
+  }
+  /** Called by the gate bus before put/delete. `collection` selects the subject mapping (#1005). */
+  async assertTsWritable(existing, incoming, collection) {
     if (existing === null && incoming === null) return;
     if (this.periodCache === null) {
-      this.periodCache = await this.deps.strategy.loadPeriods(
+      const loaded = await this.deps.strategy.loadPeriods(
         this.deps.adapter,
         this.deps.vault,
         (env) => this.decryptPeriodRecord(env)
       );
+      this.periodCache = await this.mergeReopenState(loaded);
     }
     if (this.periodCache.length === 0) return;
-    this.deps.strategy.assertTsWritable(existing, incoming, this.periodCache);
+    this.deps.strategy.assertTsWritable(
+      existing,
+      incoming,
+      this.periodCache,
+      collection !== void 0 ? { collection, ...this.deps.strategy.partitionOf !== void 0 && { resolve: this.deps.strategy.partitionOf } } : void 0
+    );
   }
   async loadPeriodsCache() {
     if (this.periodCache !== null) return this.periodCache;
@@ -7048,7 +7214,7 @@ var VaultLinks = class {
 // src/with-shape/links/lazy-handle.ts
 function makeLazyLinkSetHandle(d) {
   let engine = null;
-  const load = () => engine ??= import("./link-set-2TTP4VLO.js").then(
+  const load = () => engine ??= import("./link-set-E5HNY67I.js").then(
     ({ LinkSet }) => new LinkSet(d.adapter, d.vault, d.name, d.spec, d.encrypted, d.getDEK, d.actor, d.emitter, d.endpointExists)
   );
   return {
@@ -7695,7 +7861,7 @@ function declareSatellite(ctx, collectionName, options, existingRegistry) {
   ctx.forEachSyncEngine((e) => e.remirrorPairResolvers([spec.base, spec.satellite]));
   const registry = reg;
   const baseSchema = ctx.getBaseSchema(spec.base);
-  void import("./post-register-ORQOQJCS.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
+  void import("./post-register-2XSSMGEQ.js").then((m) => m.postRegister(ctx.adapter, ctx.vaultName, spec, ctx.getDEK, baseSchema, registry)).catch(() => {
   });
   return reg;
 }
@@ -8327,7 +8493,7 @@ var Vault = class {
    *   envelopes, subject to the `view-team-profiles` policy gate.
    * - Reactive: `subscribe(id, cb)`, `live(id)` — fire on local writes.
    *
-   * @see docs/superpowers/specs/2026-05-05-user-envelope-design.md
+   * @see design-history/2026-05-05-user-envelope-design.md
    */
   user;
   /**
@@ -8339,7 +8505,7 @@ var Vault = class {
    * - `liberate(opts)` — custodian-only: the audited claim of ownership over a
    *   sealed-owner (Deed) vault (mints a DISTINCT new owner; ledger-audited).
    *
-   * @see docs/superpowers/specs/2026-06-17-fr6-deed-custodian-liberate-design.md
+   * @see design-history/2026-06-17-fr6-deed-custodian-liberate-design.md
    */
   custody;
   /** Re-derives an UnlockedKeyring from the adapter using the active user's secret; called by
@@ -8678,7 +8844,7 @@ var Vault = class {
         const strategies = options.schemaUpdate ?? [];
         const work = (async () => {
           const dek = await this.getDEK(collectionName);
-          const { persistSchemaIfNeeded } = await import("./register-LHETZRJM.js");
+          const { persistSchemaIfNeeded } = await import("./register-4EFJCVYD.js");
           const result = await persistSchemaIfNeeded({
             store: this.adapter,
             vault: this.name,
@@ -8828,7 +8994,7 @@ var Vault = class {
         const work = (async () => {
           try {
             const dek = await this.getDEK(collectionName);
-            await (await import("./register-LHETZRJM.js")).persistSchemaIfNeeded({
+            await (await import("./register-4EFJCVYD.js")).persistSchemaIfNeeded({
               store: this.adapter,
               vault: this.name,
               collectionName,
@@ -9504,7 +9670,7 @@ var Vault = class {
    */
   // eslint-disable-next-line @typescript-eslint/consistent-type-imports
   async _loadPodSigner() {
-    const { loadSigner } = await import("./signer-7KHD4OL2.js");
+    const { loadSigner } = await import("./signer-TA55QB6R.js");
     return loadSigner(this.adapter, this.name, this.getDEK);
   }
   async writeExportAudit(entry) {
@@ -10015,7 +10181,7 @@ var Vault = class {
   async _initDerivations(handles) {
     if (handles.length === 0) return;
     const [{ DerivationRegistry }, { ReadOnlyVaultFacade }] = await Promise.all([
-      import("./registry-JRIN447B.js"),
+      import("./registry-4SDHHOJ7.js"),
       import("./read-only-facade-CHCKSEPD.js")
     ]);
     const registry = new DerivationRegistry();
@@ -10047,7 +10213,7 @@ var Vault = class {
    */
   async _initMaterializedViews(handles) {
     if (handles.length === 0) return;
-    const { MaterializedViewRegistry } = await import("./registry-AMAZ6QRZ.js");
+    const { MaterializedViewRegistry } = await import("./registry-OYTFGWVK.js");
     const registry = new MaterializedViewRegistry();
     this.materializedViewRegistry = registry;
     const db = this;
@@ -10134,14 +10300,14 @@ var Vault = class {
     if (!reg) {
       throw new Error(`refreshView: no MV registered with name "${name}"`);
     }
-    const { MaterializedViewExecutor } = await import("./executor-3JZ4POTW.js");
+    const { MaterializedViewExecutor } = await import("./executor-YIQB2S6N.js");
     const result = await MaterializedViewExecutor.refresh(reg, {
       getCollection: (n) => this.collection(n),
       getActiveTxContext: () => this.noydb._activeTxContextOrNull,
       getQueryContext: () => this,
       dispatchCtx: this._dispatchCtx({ collection: name, id: "refreshView" })
     });
-    const { clearMVStaleFully } = await import("./stale-K734VACF.js");
+    const { clearMVStaleFully } = await import("./stale-ARHFVL5U.js");
     await clearMVStaleFully(this.adapter, this.name, registry, name);
     return result;
   }
@@ -10181,7 +10347,7 @@ var Vault = class {
           if (!outSpec) continue;
           const outputColl = this.collection(outSpec.collection);
           if (out.kind === "array") {
-            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-T2ZGLQFE.js");
+            const { loadFanoutSidecar, saveFanoutSidecar } = await import("./fanout-sidecar-NNAJQXMX.js");
             const prior = await loadFanoutSidecar(this.adapter, this.name, spec.source, id, key, this.getDEK, this.encrypted);
             const prevKeys = new Set(prior?.keys ?? []);
             const newKeysList = out.entries.map((e) => e.key);
@@ -10408,7 +10574,7 @@ var Vault = class {
    * collection.
    */
   async delegate(opts) {
-    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-PDYL6RWT.js");
+    const { issueDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-MO7YZYJS.js");
     if (!this.keyring.kek) {
       throw new ValidationError(
         "issueDelegation: keyring.kek is null \u2014 issuing a delegation requires a tier-1 unlock. Re-authenticate at tier 1 (secret) first."
@@ -10430,7 +10596,7 @@ var Vault = class {
    * if the id does not exist.
    */
   async revokeDelegation(id) {
-    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-PDYL6RWT.js");
+    const { revokeDelegation, DELEGATIONS_COLLECTION } = await import("./delegation-MO7YZYJS.js");
     await revokeDelegation(this.adapter, this.name, id);
     void DELEGATIONS_COLLECTION;
   }
@@ -10609,13 +10775,13 @@ var Vault = class {
   async openPeriod(options) {
     return this.periods.openPeriod(options);
   }
-  /** Return every closed / opened period in `closedAt` order. */
-  async listPeriods() {
-    return this.periods.listPeriods();
+  /** Every closed / opened period in `closedAt` order; ALL timelines unless `{ partition }` scopes it (#1005). */
+  async listPeriods(options) {
+    return this.periods.listPeriods(options);
   }
-  /** Look up a single period by name. Returns `null` if not found. */
-  async getPeriod(name) {
-    return this.periods.getPeriod(name);
+  /** One period by name within a timeline (vault-wide unless `{ partition }`). `null` if not found. */
+  async getPeriod(name, options) {
+    return this.periods.getPeriod(name, options);
   }
   /**
    * Freeze a closed period (#604): purges in-window delete markers and
@@ -10625,8 +10791,8 @@ var Vault = class {
    * and purging re-opens the #589 resurrection window for a peer offline
    * since before the cutoff (see periods.ts's "Freeze" section).
    */
-  async freezePeriod(name) {
-    return this.periods.freezePeriod(name);
+  async freezePeriod(name, options) {
+    return this.periods.freezePeriod(name, options);
   }
   /**
    * Archive a closed period (#613): relocates its in-window records from the
@@ -10635,8 +10801,8 @@ var Vault = class {
    * the chained `_periods` record. Non-destructive (reads fall through to
    * cold) and idempotent. Requires a routeStore with a cold route.
    */
-  async archivePeriod(name) {
-    return this.periods.archivePeriod(name);
+  async archivePeriod(name, options) {
+    return this.periods.archivePeriod(name, options);
   }
   /**
    * Target-purge a closed+frozen period (#615): sweeps delete markers off the
@@ -10646,12 +10812,24 @@ var Vault = class {
    * frozen first. Idempotent; a vault with no push-only targets writes no
    * companion and is re-runnable.
    */
-  async purgePeriodTargets(name) {
-    return this.periods.purgePeriodTargets(name);
+  async purgePeriodTargets(name, options) {
+    return this.periods.purgePeriodTargets(name, options);
+  }
+  /** Return a closed period to writable (#1022); logged append-only, close chain untouched. */
+  async reopenPeriod(name, options) {
+    return this.periods.reopenPeriod(name, options);
+  }
+  /** Seal a reopened period again (#1022) rather than waiting for its `until` to lapse. */
+  async reclosePeriod(name, options) {
+    return this.periods.reclosePeriod(name, options);
+  }
+  /** The append-only reopen/reclose log for one period (#1022), in order. */
+  async listPeriodReopens(name, options) {
+    return this.periods.listPeriodReopens(name, options);
   }
   /** @internal — called by the gate bus before put/delete. */
-  async _assertTsWritable(existing, incoming) {
-    return this.periods.assertTsWritable(existing, incoming);
+  async _assertTsWritable(existing, incoming, collection) {
+    return this.periods.assertTsWritable(existing, incoming, collection);
   }
   /** List all collection names in this vault. */
   async collections() {
@@ -10675,10 +10853,10 @@ var Vault = class {
    *   - `sampled`: inferred from decrypted records (deferred to a follow-up)
    *   - `unknown`: no schema info available
    *
-   * @see docs/superpowers/specs/2026-05-22-schema-dump-design.md
+   * @see design-history/2026-05-22-schema-dump-design.md
    */
   async dumpSchema(opts = {}) {
-    const { dumpVaultSchema } = await import("./walk-MQHYNDLZ.js");
+    const { dumpVaultSchema } = await import("./walk-3ZECBFDA.js");
     return dumpVaultSchema(this, opts);
   }
   /**
@@ -10774,7 +10952,7 @@ var Vault = class {
    * separate vault instances now.
    */
   async getBundleHandle() {
-    const { buildBundleHandle } = await import("./bundle-handle-5OUAI7CV.js");
+    const { buildBundleHandle } = await import("./bundle-handle-GFNHT52M.js");
     return buildBundleHandle(this.adapter, this.name);
   }
   /**
@@ -10806,7 +10984,7 @@ var Vault = class {
    * both modes round-trip cleanly.
    */
   async dump() {
-    const { dumpVault } = await import("./backup-GAYWQAFN.js");
+    const { dumpVault } = await import("./backup-AVAGHAJE.js");
     return dumpVault(this.backupContext());
   }
   /**
@@ -10858,7 +11036,7 @@ var Vault = class {
    * — there's no chain to verify against.
    */
   async load(backupJson) {
-    const { loadVault } = await import("./backup-GAYWQAFN.js");
+    const { loadVault } = await import("./backup-AVAGHAJE.js");
     return loadVault(this.backupContext(), backupJson);
   }
   /**
@@ -10890,7 +11068,7 @@ var Vault = class {
    * way to detect tampering of an in-place vault.
    */
   async verifyBackupIntegrity() {
-    const { verifyBackupIntegrity } = await import("./backup-GAYWQAFN.js");
+    const { verifyBackupIntegrity } = await import("./backup-AVAGHAJE.js");
     return verifyBackupIntegrity(this.backupContext());
   }
   /**
@@ -11108,7 +11286,7 @@ var Vault = class {
    * is the live validator object, not a serialization of it).
    */
   async exportJSON(opts = {}) {
-    const { exportVaultJSON } = await import("./backup-GAYWQAFN.js");
+    const { exportVaultJSON } = await import("./backup-AVAGHAJE.js");
     return exportVaultJSON(this.backupContext(), opts);
   }
 };
@@ -13051,7 +13229,7 @@ var Noydb = class {
       const v = this.vaultCache.get(e.vault);
       if (!v) return;
       const existing = e.op === "create" ? null : { ts: e.existingTs ?? null, record: e.existing ?? null };
-      await v._assertTsWritable(existing, e.incoming);
+      await v._assertTsWritable(existing, e.incoming, e.collection);
     });
     this.subsystemBus.registerGate("beforeDelete", async (e) => {
       if (e.internal) return;
@@ -13059,7 +13237,8 @@ var Noydb = class {
       if (!v) return;
       await v._assertTsWritable(
         { ts: e.existingTs ?? null, record: e.existing ?? null },
-        null
+        null,
+        e.collection
       );
     });
   }
@@ -13805,7 +13984,14 @@ var Noydb = class {
   getSyncEngine(vault) {
     const engine = this.syncEngines.get(vault);
     if (!engine) {
-      throw new ValidationError("No sync adapter configured. Pass a `sync` adapter to createNoydb().");
+      if (this.syncEngines.size === 0) {
+        throw new ValidationError(
+          "No sync adapter configured. Pass a `sync` adapter to createNoydb() \u2014 a NoydbStore, a SyncTarget (`{ store, role }`), or an array of them \u2014 and `syncStrategy: withSync()` to enable the engine."
+        );
+      }
+      throw new ValidationError(
+        `No sync engine for vault "${String(vault)}". Sync is configured, but for [${[...this.syncEngines.keys()].map((k) => `"${k}"`).join(", ")}] \u2014 an engine is built per vault when it is opened, so open this vault first. Note the vault name is a REQUIRED argument: \`db.pull(vaultName)\`, not \`db.pull()\`.`
+      );
     }
     return engine;
   }
@@ -14328,7 +14514,7 @@ async function createNoydb(options) {
   if (!options.store) options = { ...options, store: memoryStore() };
   validateSecretModeOptions(options);
   if (!options.coordinationStrategy) options = { ...options, coordinationStrategy: await createDefaultCoordinationProvider(options.store) };
-  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-67SBPMMH.js")).createUserApi };
+  if (!options.userApiFactory) options = { ...options, userApiFactory: (await import("./api-RXUMEKT3.js")).createUserApi };
   if (!options.policyFactory) {
     const policyModule = await import("./policy/index.js");
     options = { ...options, policyFactory: policyModule.createNoydbPolicy, policyCheckGateFn: policyModule.checkGate };
@@ -14363,4 +14549,4 @@ export {
   Noydb,
   createNoydb
 };
-//# sourceMappingURL=chunk-3CLZY46Y.js.map
+//# sourceMappingURL=chunk-N3BI6P3J.js.map