@noy-db/hub 0.6.0-pre.1 → 0.6.0-pre.11

package/dist/team/index.js

@@ -2,7 +2,7 @@ import {
   MemoryDeviceSealProvider,
   beginEchoUnlock,
   withTeam
-} from "../chunk-46V67XP5.js";
+} from "../chunk-YJ6IONGA.js";
 import {
   NO_TEAM,
   burnPaperRecoveryEntry,
@@ -31,8 +31,8 @@ import {
   unwrapMagicLinkGrant,
   updateAuthenticator,
   writeMagicLinkGrant
-} from "../chunk-DPJTDNUF.js";
-import "../chunk-NVU7ZMPN.js";
+} from "../chunk-O2ERS4UJ.js";
+import "../chunk-3IXIU6FP.js";
 import {
   buildEchoBlock,
   buildRecipientKeyringFile,
@@ -53,17 +53,17 @@ import {
   updateKeyringIdentity,
   verifyPrompt,
   verifyTypedEcho
-} from "../chunk-RLWY6Z44.js";
-import "../chunk-27TCYH6G.js";
+} from "../chunk-JRKZTEZZ.js";
+import "../chunk-5JY5TSVY.js";
 import "../chunk-AHLJSVRL.js";
-import "../chunk-FY343IZR.js";
-import "../chunk-NQRJ5AJO.js";
+import "../chunk-3URQC7EH.js";
+import "../chunk-7H73RIE3.js";
 import "../chunk-HXGUIPQB.js";
 import "../chunk-AR2JDFAE.js";
 import "../chunk-747LRSOO.js";
 import "../chunk-LP7BEXCT.js";
 import "../chunk-VCETL77O.js";
-import "../chunk-24ZLWWEO.js";
+import "../chunk-YPYHVOXP.js";
 import {
   TeamNotEnabledError
 } from "../chunk-HNGSV2YC.js";

package/dist/tiers/index.js

@@ -11,16 +11,16 @@ import {
   putAtTier,
   syncDerivedOutputs,
   withTiers
-} from "../chunk-PGAPBZEK.js";
+} from "../chunk-6NVPFKN3.js";
 import "../chunk-AHLJSVRL.js";
-import "../chunk-FY343IZR.js";
-import "../chunk-NQRJ5AJO.js";
+import "../chunk-3URQC7EH.js";
+import "../chunk-7H73RIE3.js";
 import "../chunk-HXGUIPQB.js";
 import "../chunk-AR2JDFAE.js";
 import "../chunk-747LRSOO.js";
 import "../chunk-LP7BEXCT.js";
 import "../chunk-VCETL77O.js";
-import "../chunk-24ZLWWEO.js";
+import "../chunk-YPYHVOXP.js";
 import {
   TiersNotEnabledError
 } from "../chunk-HNGSV2YC.js";

package/dist/to/index.js

@@ -10,8 +10,18 @@ import {
 import "../chunk-PZ5AY32C.js";
 
 // src/port/to/locator.ts
+function isPodStore(store) {
+  return store.kind === "bundle";
+}
 function createStoreLocator() {
   const factories = /* @__PURE__ */ new Map();
+  function lookup(kind) {
+    const factory = factories.get(kind);
+    if (!factory) {
+      throw new UnknownStoreKindError(kind, [...factories.keys()].sort());
+    }
+    return factory;
+  }
   return {
     register(kind, factory) {
       if (factories.has(kind)) {
@@ -20,11 +30,10 @@ function createStoreLocator() {
       factories.set(kind, factory);
     },
     resolve(descriptor, opts = {}) {
-      const factory = factories.get(descriptor.kind);
-      if (!factory) {
-        throw new UnknownStoreKindError(descriptor.kind, [...factories.keys()].sort());
-      }
-      return factory(descriptor, opts);
+      return lookup(descriptor.kind)(descriptor, opts);
+    },
+    resolveAny(descriptor, opts = {}) {
+      return lookup(descriptor.kind)(descriptor, opts);
     }
   };
 }
@@ -36,6 +45,7 @@ export {
   PodVersionConflictError,
   StoreCapabilityError,
   UnknownStoreKindError,
-  createStoreLocator
+  createStoreLocator,
+  isPodStore
 };
 //# sourceMappingURL=index.js.map

package/dist/to/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/port/to/locator.ts"],"sourcesContent":["/**\n * The Locator seam (#945 Task 1): a serializable, CREDENTIALLESS store\n * descriptor plus a factory registry that reconstructs a `NoydbStore` from\n * data.\n *\n * A `StoreDescriptor` is the pod-portable \"what store and where\" — kind,\n * broad topology class, and a kind-specific serializable address/options\n * bag. It is deliberately dumb data: no field on it is ever typed as a\n * function, a `StoreCredentialSource`, or a `StoreCredentials` value, so a\n * descriptor can be written into a pod / manifest / sync payload without an\n * audit for leaked secrets. Anything that must resolve device-side or\n * user-side — a short-lived credential, a device-local directory override,\n * a mounted drive handle — travels out-of-band via `resolve()`'s `opts`,\n * never through the descriptor itself.\n *\n * This module is pure TypeScript: no imports beyond the kernel's own types\n * and errors, no Node built-ins, no crypto. It adds zero runtime\n * dependencies to `@noy-db/hub/to`.\n */\nimport type { NoydbStore, StoreCredentialSource } from '../../kernel/types.js'\nimport { DuplicateStoreKindError, UnknownStoreKindError } from '../../kernel/errors.js'\n\n/**\n * The broad topology bucket a store descriptor's kind falls into —\n * used by callers/UI to group or filter descriptors without knowing every\n * concrete `kind` string.\n */\nexport type StoreClass = 'local' | 'browser' | 'lan' | 'cloud'\n\n/**\n * A serializable, CREDENTIALLESS description of a store instance: enough\n * data to reconstruct a `NoydbStore` via a registered `StoreFactory`, and\n * safe to persist or transmit as-is.\n *\n * CREDENTIALLESS BY CONSTRUCTION: no field here may be typed as a function,\n * a `StoreCredentialSource`, or a `StoreCredentials` value. Credentials\n * NEVER ride the descriptor — they are supplied separately (as a\n * `StoreCredentialSource`) to `StoreLocator.resolve()` at resolve time.\n */\nexport interface StoreDescriptor {\n  /** The registered factory key (e.g. `'file'`, `'aws-s3'`, `'webdav'`). */\n  readonly kind: string\n  /** The broad topology bucket this kind falls into. */\n  readonly class: StoreClass\n  /** Kind-specific serializable location (e.g. `{ dir }`, `{ bucket, region }`). */\n  readonly address: unknown\n  /** Kind-specific serializable tuning options. */\n  readonly options?: unknown\n}\n\n/**\n * A kind-specific, device-local supplement to a `StoreDescriptor` — a\n * directory override, a mount point, a drive handle — that is resolved\n * device-side and never carried inside a pod alongside the descriptor.\n */\nexport type StoreBinding = unknown\n\n/**\n * Reconstructs a live `NoydbStore` from a `StoreDescriptor`. Registered\n * against a `StoreLocator` under the descriptor's `kind`.\n */\nexport type StoreFactory = (\n  descriptor: StoreDescriptor,\n  opts: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n) => NoydbStore | Promise<NoydbStore>\n\n/** A registry of `StoreFactory`s, keyed by `StoreDescriptor.kind`. */\nexport interface StoreLocator {\n  /** Register a factory for `kind`. Throws if `kind` is already registered. */\n  register(kind: string, factory: StoreFactory): void\n  /** Resolve `descriptor` to a live store via its kind's registered factory. */\n  resolve(\n    descriptor: StoreDescriptor,\n    opts?: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n  ): NoydbStore | Promise<NoydbStore>\n}\n\n/**\n * Creates a fresh, empty `StoreLocator`.\n *\n * DUPLICATE REGISTRATION: `register()` throws if `kind` is already\n * registered, rather than silently overwriting it (last-wins). A\n * composition root that registers the same kind twice is almost always a\n * mistake — a copy-pasted setup block, two satellite packages fighting\n * over the same kind string — and last-wins would hide it behind whichever\n * registration happened to run last. This mirrors the\n * `DuplicateBehaviorNameError` philosophy (#947): fail loudly at the\n * mistake's source instead of silently at some unrelated `resolve()` call\n * later.\n */\nexport function createStoreLocator(): StoreLocator {\n  const factories = new Map<string, StoreFactory>()\n\n  return {\n    register(kind, factory) {\n      if (factories.has(kind)) {\n        throw new DuplicateStoreKindError(kind)\n      }\n      factories.set(kind, factory)\n    },\n    resolve(descriptor, opts = {}) {\n      const factory = factories.get(descriptor.kind)\n      if (!factory) {\n        throw new UnknownStoreKindError(descriptor.kind, [...factories.keys()].sort())\n      }\n      return factory(descriptor, opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;AA0FO,SAAS,qBAAmC;AACjD,QAAM,YAAY,oBAAI,IAA0B;AAEhD,SAAO;AAAA,IACL,SAAS,MAAM,SAAS;AACtB,UAAI,UAAU,IAAI,IAAI,GAAG;AACvB,cAAM,IAAI,wBAAwB,IAAI;AAAA,MACxC;AACA,gBAAU,IAAI,MAAM,OAAO;AAAA,IAC7B;AAAA,IACA,QAAQ,YAAY,OAAO,CAAC,GAAG;AAC7B,YAAM,UAAU,UAAU,IAAI,WAAW,IAAI;AAC7C,UAAI,CAAC,SAAS;AACZ,cAAM,IAAI,sBAAsB,WAAW,MAAM,CAAC,GAAG,UAAU,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,MAC/E;AACA,aAAO,QAAQ,YAAY,IAAI;AAAA,IACjC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/port/to/locator.ts"],"sourcesContent":["/**\n * The Locator seam (#945 Task 1): a serializable, CREDENTIALLESS store\n * descriptor plus a factory registry that reconstructs a `NoydbStore` from\n * data.\n *\n * A `StoreDescriptor` is the pod-portable \"what store and where\" — kind,\n * broad topology class, and a kind-specific serializable address/options\n * bag. It is deliberately dumb data: no field on it is ever typed as a\n * function, a `StoreCredentialSource`, or a `StoreCredentials` value, so a\n * descriptor can be written into a pod / manifest / sync payload without an\n * audit for leaked secrets. Anything that must resolve device-side or\n * user-side — a short-lived credential, a device-local directory override,\n * a mounted drive handle — travels out-of-band via `resolve()`'s `opts`,\n * never through the descriptor itself.\n *\n * This module is pure TypeScript: no imports beyond the kernel's own types\n * and errors, no Node built-ins, no crypto. It adds zero runtime\n * dependencies to `@noy-db/hub/to`.\n */\nimport type { NoydbStore, NoydbPodStore, StoreCredentialSource } from '../../kernel/types.js'\nimport { DuplicateStoreKindError, UnknownStoreKindError } from '../../kernel/errors.js'\n\n/**\n * The broad topology bucket a store descriptor's kind falls into —\n * used by callers/UI to group or filter descriptors without knowing every\n * concrete `kind` string.\n */\nexport type StoreClass = 'local' | 'browser' | 'lan' | 'cloud'\n\n/**\n * A serializable, CREDENTIALLESS description of a store instance: enough\n * data to reconstruct a `NoydbStore` via a registered `StoreFactory`, and\n * safe to persist or transmit as-is.\n *\n * CREDENTIALLESS BY CONSTRUCTION: no field here may be typed as a function,\n * a `StoreCredentialSource`, or a `StoreCredentials` value. Credentials\n * NEVER ride the descriptor — they are supplied separately (as a\n * `StoreCredentialSource`) to `StoreLocator.resolve()` at resolve time.\n */\nexport interface StoreDescriptor {\n  /** The registered factory key (e.g. `'file'`, `'aws-s3'`, `'webdav'`). */\n  readonly kind: string\n  /** The broad topology bucket this kind falls into. */\n  readonly class: StoreClass\n  /** Kind-specific serializable location (e.g. `{ dir }`, `{ bucket, region }`). */\n  readonly address: unknown\n  /** Kind-specific serializable tuning options. */\n  readonly options?: unknown\n}\n\n/**\n * A kind-specific, device-local supplement to a `StoreDescriptor` — a\n * directory override, a mount point, a drive handle — that is resolved\n * device-side and never carried inside a pod alongside the descriptor.\n */\nexport type StoreBinding = unknown\n\n/**\n * Either store shape a factory may produce: the 6-method KV `NoydbStore`, or\n * the whole-vault `NoydbPodStore` implemented by `to-drive` / `to-icloud`.\n *\n * The two are DISJOINT, not sub/supertypes — a pod store has none of the six\n * KV methods — which is why moving between them needs a double cast and why\n * `isPodStore()` exists to narrow instead.\n */\nexport type AnyNoydbStore = NoydbStore | NoydbPodStore\n\n/**\n * Narrow an `AnyNoydbStore` to the pod shape. Discriminates on the\n * `kind: 'bundle'` tag `NoydbPodStore` carries for exactly this purpose; a\n * `NoydbStore` has no `kind` field at all.\n *\n * Use this at a `resolve()` boundary instead of casting — a store resolved\n * from a descriptor read out of a pod is only known to be one of the two\n * shapes at runtime.\n */\nexport function isPodStore(store: AnyNoydbStore): store is NoydbPodStore {\n  return (store as NoydbPodStore).kind === 'bundle'\n}\n\n/**\n * Reconstructs a live store from a `StoreDescriptor`. Registered against a\n * `StoreLocator` under the descriptor's `kind`.\n *\n * The type parameter says WHICH shape this factory builds. It defaults to\n * `NoydbStore`, so a bare `StoreFactory` means exactly what it always has;\n * a pod-store factory declares `StoreFactory<NoydbPodStore>` and registers\n * without a cast (#988).\n */\nexport type StoreFactory<S extends AnyNoydbStore = NoydbStore> = (\n  descriptor: StoreDescriptor,\n  opts: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n) => S | Promise<S>\n\n/** A registry of `StoreFactory`s, keyed by `StoreDescriptor.kind`. */\nexport interface StoreLocator {\n  /**\n   * Register a factory for `kind`. Throws if `kind` is already registered.\n   *\n   * Accepts a factory building EITHER store shape — `S` is inferred from the\n   * factory's own return type, so a `NoydbPodStore` factory needs no cast.\n   */\n  register<S extends AnyNoydbStore>(kind: string, factory: StoreFactory<S>): void\n  /**\n   * Resolve `descriptor` to a live store via its kind's registered factory.\n   *\n   * Returns `NoydbStore`. If the `kind` was registered with a pod-store\n   * factory, the resolved value is really a `NoydbPodStore`: this signature\n   * is the seam's remaining unsoundness, kept because widening it to\n   * `AnyNoydbStore` would break every existing caller. Where the descriptor's\n   * kind is not statically known, prefer `resolveAny()` and `isPodStore()`.\n   */\n  resolve(\n    descriptor: StoreDescriptor,\n    opts?: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n  ): NoydbStore | Promise<NoydbStore>\n  /**\n   * As `resolve()`, but typed honestly: the registry is keyed by a runtime\n   * `kind` string, so which of the two shapes comes back is not knowable\n   * statically. Narrow the result with `isPodStore()`.\n   */\n  resolveAny(\n    descriptor: StoreDescriptor,\n    opts?: { binding?: StoreBinding; credentials?: StoreCredentialSource },\n  ): AnyNoydbStore | Promise<AnyNoydbStore>\n}\n\n/**\n * Creates a fresh, empty `StoreLocator`.\n *\n * DUPLICATE REGISTRATION: `register()` throws if `kind` is already\n * registered, rather than silently overwriting it (last-wins). A\n * composition root that registers the same kind twice is almost always a\n * mistake — a copy-pasted setup block, two satellite packages fighting\n * over the same kind string — and last-wins would hide it behind whichever\n * registration happened to run last. This mirrors the\n * `DuplicateBehaviorNameError` philosophy (#947): fail loudly at the\n * mistake's source instead of silently at some unrelated `resolve()` call\n * later.\n */\nexport function createStoreLocator(): StoreLocator {\n  const factories = new Map<string, StoreFactory<AnyNoydbStore>>()\n\n  function lookup(kind: string): StoreFactory<AnyNoydbStore> {\n    const factory = factories.get(kind)\n    if (!factory) {\n      throw new UnknownStoreKindError(kind, [...factories.keys()].sort())\n    }\n    return factory\n  }\n\n  return {\n    register(kind, factory) {\n      if (factories.has(kind)) {\n        throw new DuplicateStoreKindError(kind)\n      }\n      factories.set(kind, factory)\n    },\n    resolve(descriptor, opts = {}) {\n      // The one place the seam's `resolve(): NoydbStore` signature is paid\n      // for. A pod-store `kind` really returns a `NoydbPodStore`; the registry\n      // is keyed by a runtime string so nothing here can prove otherwise.\n      // Concentrated in the module that owns the invariant rather than\n      // duplicated as `as unknown as StoreFactory` in every pod-store package\n      // (#988). `resolveAny()` is the honest signature over the same call.\n      return lookup(descriptor.kind)(descriptor, opts) as NoydbStore | Promise<NoydbStore>\n    },\n    resolveAny(descriptor, opts = {}) {\n      return lookup(descriptor.kind)(descriptor, opts)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;AA4EO,SAAS,WAAW,OAA8C;AACvE,SAAQ,MAAwB,SAAS;AAC3C;AA8DO,SAAS,qBAAmC;AACjD,QAAM,YAAY,oBAAI,IAAyC;AAE/D,WAAS,OAAO,MAA2C;AACzD,UAAM,UAAU,UAAU,IAAI,IAAI;AAClC,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,sBAAsB,MAAM,CAAC,GAAG,UAAU,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,SAAS,MAAM,SAAS;AACtB,UAAI,UAAU,IAAI,IAAI,GAAG;AACvB,cAAM,IAAI,wBAAwB,IAAI;AAAA,MACxC;AACA,gBAAU,IAAI,MAAM,OAAO;AAAA,IAC7B;AAAA,IACA,QAAQ,YAAY,OAAO,CAAC,GAAG;AAO7B,aAAO,OAAO,WAAW,IAAI,EAAE,YAAY,IAAI;AAAA,IACjD;AAAA,IACA,WAAW,YAAY,OAAO,CAAC,GAAG;AAChC,aAAO,OAAO,WAAW,IAAI,EAAE,YAAY,IAAI;AAAA,IACjD;AAAA,EACF;AACF;","names":[]}

package/dist/via/classified/descriptor.d.ts

@@ -1,6 +1,6 @@
 /**
  * Classified fields — behavioral sensitive-field descriptors (stage 1).
- * Design: docs/superpowers/specs/2026-07-04-classified-fields-design.md
+ * Design: design-history/2026-07-04-classified-fields-design.md
  * Law: open on write, declarative on read — read-side behavior is this
  * closed vocabulary; there are no read-side callbacks.
  * @module

package/dist/via/money/exact.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Exact decimal arithmetic for post-aggregate row math (#1007).
+ *
+ * Money leaves a reducer as a `MoneyString` — a decimal string, exact by
+ * construction. Doing `Number(a) - Number(b)` on two of those re-introduces
+ * binary floating point at the one step the money type exists to protect:
+ * `10.05 - 0.10` becomes `9.950000000000001`, which `quantizeMoneyFields`
+ * then correctly REFUSES rather than silently storing drift.
+ *
+ * So `derive` is handed these instead. Everything runs in scaled BigInt at the
+ * widest scale of its inputs and formats back to a decimal string, which means
+ * no operation here can introduce a representation error. Deliberately just
+ * the additive set — `add` / `sub` / `neg` / `min` / `max` / `cmp`. Anything
+ * needing multiplication or division needs a rounding policy, and a rounding
+ * policy is a decision the caller must make explicitly, not one this module
+ * should guess.
+ *
+ * @module
+ */
+/** A value these helpers accept: a decimal string, a number, or a bigint of whole units. */
+export type ExactOperand = string | number | bigint;
+/**
+ * Exact decimal helpers handed to an MV `derive` as its second argument.
+ *
+ * Every result is a decimal string, so results compose without ever passing
+ * through a float. Declare the derived field in the MV's `moneyFields` and the
+ * final value is quantised to that descriptor's scale on the way to storage.
+ */
+export interface ExactMath {
+    /** `a + b`, exact. */
+    add(a: ExactOperand, b: ExactOperand): string;
+    /** `a - b`, exact. */
+    sub(a: ExactOperand, b: ExactOperand): string;
+    /** `-a`, exact. */
+    neg(a: ExactOperand): string;
+    /** The larger of `a` and `b`. */
+    max(a: ExactOperand, b: ExactOperand): string;
+    /** The smaller of `a` and `b`. */
+    min(a: ExactOperand, b: ExactOperand): string;
+    /** `-1` when `a < b`, `0` when equal, `1` when `a > b`. */
+    cmp(a: ExactOperand, b: ExactOperand): -1 | 0 | 1;
+}
+/** The singleton passed to `derive` — stateless, so there is nothing to construct per row. */
+export declare const exactMath: ExactMath;

package/dist/via/money/index.d.ts

@@ -13,3 +13,5 @@ export { mulRate, allocate } from './arith.js';
 export type { MulRateOptions, AllocateOptions } from './arith.js';
 export { asMoney, isMoneyString, moneyNumber } from './branded.js';
 export type { MoneyString } from './branded.js';
+export { exactMath } from './exact.js';
+export type { ExactMath, ExactOperand } from './exact.js';

package/dist/via/money/normalize.d.ts

@@ -40,6 +40,26 @@ export declare function canonicalizeStoredMoney(record: unknown, moneyFields: Re
  * `MoneyPrecisionError`/`TypeError`.
  */
 export declare function canonicalizeIncomingMoney(record: unknown, moneyFields: Record<string, MoneyDescriptor> | undefined): unknown;
+/**
+ * Canonicalize money values for a MATERIALIZED-VIEW row (#1018).
+ *
+ * A money field in an MV row is NOT in the scaled-integer storage form a
+ * collection uses — the money-aware reducers emit `formatScaledInt(...)`, an
+ * exact decimal string, and that is what lands in the output collection. So a
+ * derived money field has to be canonicalized into the same shape as the
+ * aggregated ones beside it.
+ *
+ * Quantizing it into storage form instead is what #1018 reported: `toPay` came
+ * back as `"1000000"` where `netTotal` in the SAME row read `"10000.00"` —
+ * 100× the true value, and a string that looks like a plausible amount rather
+ * than an obvious error.
+ *
+ * Precision handling is identical to {@link quantizeMoneyFields} — the same
+ * `parseToScaledInt` and the same `MoneyPrecisionError` — so a value that
+ * cannot be represented at the declared scale is still refused rather than
+ * silently rounded. Only the OUTPUT shape differs: decimal, not scaled.
+ */
+export declare function canonicalizeMoneyFieldsAsDecimal<T extends Record<string, unknown>>(record: T, moneyFields: Record<string, MoneyDescriptor>): T;
 /**
  * Convert money fields in `record` from user input to their canonical
  * stored form. Returns a shallow clone (deep along declared nested

package/dist/{walk-MQHYNDLZ.js → walk-3ZECBFDA.js}

@@ -1,21 +1,21 @@
 import {
   dumpVaultSchema
-} from "./chunk-MJWCLSQL.js";
+} from "./chunk-X56RTUK3.js";
 import "./chunk-KHKKD62N.js";
-import "./chunk-2LGDCNFJ.js";
+import "./chunk-Z45YRGFO.js";
 import "./chunk-Y2NBBT6K.js";
-import "./chunk-V5C5NNBR.js";
-import "./chunk-FY343IZR.js";
-import "./chunk-NQRJ5AJO.js";
+import "./chunk-CDB2HVQW.js";
+import "./chunk-3URQC7EH.js";
+import "./chunk-7H73RIE3.js";
 import "./chunk-HXGUIPQB.js";
 import "./chunk-AR2JDFAE.js";
 import "./chunk-747LRSOO.js";
 import "./chunk-LP7BEXCT.js";
 import "./chunk-VCETL77O.js";
-import "./chunk-24ZLWWEO.js";
+import "./chunk-YPYHVOXP.js";
 import "./chunk-HNGSV2YC.js";
 import "./chunk-PZ5AY32C.js";
 export {
   dumpVaultSchema
 };
-//# sourceMappingURL=walk-MQHYNDLZ.js.map
+//# sourceMappingURL=walk-3ZECBFDA.js.map

package/dist/with-audit/attestation/index.d.ts

@@ -2,7 +2,7 @@
  * @category capability
  * Document attestation — issue side. Mint a signed, per-field commitment
  * for a record and emit a QR credential verifiable offline via
- * `@noy-db/attestation`. See docs/superpowers/specs/2026-05-29-attestation-core-and-issue-design.md.
+ * `@noy-db/attestation`. See design-history/2026-05-29-attestation-core-and-issue-design.md.
  */
 export { withAttestation } from './active.js';
 export { NO_ATTESTATION, type AttestationStrategy } from './strategy.js';

package/dist/with-audit/guards/immutable-guard.d.ts

@@ -29,6 +29,20 @@ import type { GuardStrategy, GuardContext, GuardChange } from './types.js';
 export interface ImmutableGuardConfig<T extends Record<string, unknown>> {
     /** The collection to make WORM. */
     collection: string;
+    /**
+     * Optional stable per-vault identifier, forwarded verbatim to the
+     * underlying {@link GuardSpec.name} — `immutableGuard` is a wrapper
+     * around `withGuard` and grants the same identity affordance (#1006).
+     *
+     * Omit and `vault.listBehaviors()` falls back to a POSITIONAL
+     * `${collection}#${occurrence}` key, which renumbers when another
+     * guard on the same collection is registered ahead of this one. Pass
+     * a name whenever something joins to the behavior manifest by key —
+     * a generated rulebook, a diff between two vault versions, an audit
+     * report — so the identifier tracks the rule rather than its
+     * registration order.
+     */
+    readonly name?: string;
     /**
      * A record becomes immutable once this predicate holds. Evaluated on
      * the *existing* (already-persisted) record, so the write that first

package/dist/with-audit/guards/with-guard.d.ts

@@ -10,6 +10,6 @@ import type { GuardSpec, GuardStrategy } from './types.js';
  *
  * Pass the returned handle to `createNoydb({ strategies: [...] })`.
  *
- * @see docs/superpowers/specs/2026-05-18-guards-design.md
+ * @see design-history/2026-05-18-guards-design.md
  */
 export declare function withGuard<T extends Record<string, unknown>>(strategy: GuardSpec<T>): GuardStrategy<T>;

package/dist/with-audit/periods/active.d.ts

@@ -2,10 +2,37 @@
  * Active periods strategy factory. Only reachable through the
  * `@noy-db/hub/periods` subpath.
  */
+import type { PeriodPartition } from './periods.js';
 import type { PeriodsStrategy } from './strategy.js';
+/** Options for {@link withPeriods}. */
+export interface WithPeriodsOptions {
+    /**
+     * Maps a collection to the timeline each of its records belongs to (#1005) —
+     * the answer to "which close calendar governs THIS record".
+     *
+     * ```ts
+     * withPeriods({
+     *   subjects: { receipts: (r) => [r.clientId, layerOf(r)] },
+     * })
+     * ```
+     *
+     * Same shape as `withForget({ subjects })`, which answers the same question
+     * for erasure. A collection with no entry — and every collection when
+     * `subjects` is omitted entirely — stays on the vault-wide timeline, so an
+     * existing vault behaves exactly as it did before partitions existed.
+     *
+     * Return `undefined` from a mapper to put an individual record back on the
+     * vault-wide timeline (e.g. a record that predates the field the mapping
+     * reads).
+     */
+    readonly subjects?: Readonly<Record<string, (record: Record<string, unknown>) => PeriodPartition | undefined>>;
+}
 /**
  * Build the default periods strategy. Pass into
  * `createNoydb({ periodsStrategy: withPeriods() })` to enable
  * `vault.closePeriod()` / `vault.openPeriod()` / write-guards.
+ *
+ * Pass `subjects` to run more than one close calendar in a single vault — see
+ * {@link WithPeriodsOptions.subjects}.
  */
-export declare function withPeriods(): PeriodsStrategy;
+export declare function withPeriods(options?: WithPeriodsOptions): PeriodsStrategy;

package/dist/with-audit/periods/index.d.ts

@@ -13,8 +13,10 @@
  * Vault can call them without TypeScript barrel gymnastics.
  */
 export { withPeriods } from './active.js';
+export type { WithPeriodsOptions } from './active.js';
 export type { PeriodsStrategy } from './strategy.js';
-export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, periodExclusiveUpperBound, loadPeriods, chainAnchor, assertTsWritable, validatePeriodName, appendPeriodLedgerEntry, purgeMarkersOn, } from './periods.js';
-export type { PeriodRecord, PeriodFreezeRecord, PeriodArchiveRecord, PeriodTargetPurgeRecord, TargetPurgeCount, ClosePeriodOptions, OpenPeriodOptions, CarryForwardContext, ReadOnlyCollection, } from './periods.js';
+export type { PeriodScope, PeriodScopeWithReason, ReopenPeriodOptions } from './vault-facade.js';
+export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, PERIOD_REOPENS_COLLECTION, periodExclusiveUpperBound, resolvePeriodKey, samePartition, resolveReopenState, isEffectivelyReopened, loadPeriods, chainAnchor, assertTsWritable, validatePeriodName, appendPeriodLedgerEntry, purgeMarkersOn, } from './periods.js';
+export type { PeriodPartition, PartitionResolver, PeriodReopenEvent, PeriodReopenRecord, PeriodRecord, PeriodFreezeRecord, PeriodArchiveRecord, PeriodTargetPurgeRecord, TargetPurgeCount, ClosePeriodOptions, OpenPeriodOptions, CarryForwardContext, ReadOnlyCollection, } from './periods.js';
 /** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
 export { NO_PERIODS } from './strategy.js';

package/dist/with-audit/periods/periods.d.ts

@@ -146,7 +146,7 @@
  */
 import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
 import type { LedgerStore } from '../../with-commit/history/ledger/index.js';
-export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, periodExclusiveUpperBound, } from './window.js';
+export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, PERIOD_REOPENS_COLLECTION, periodExclusiveUpperBound, } from './window.js';
 /**
  * Companion record recording that a closed period was frozen (its delete
  * markers physically purged). Stored in {@link PERIOD_FREEZES_COLLECTION},
@@ -177,6 +177,73 @@ export interface TargetPurgeCount {
     readonly role: 'backup' | 'archive';
     readonly purgedCount: number;
 }
+/**
+ * One entry in a period's append-only reopen/reclose log (#1022).
+ *
+ * Real accounting close is a three-state lifecycle — open / closed / reopened
+ * — not a one-way door. A month gets closed, a missing invoice arrives or a
+ * filing is rejected, the month is reopened, corrected, and reclosed. The audit
+ * value is not the ability to write again; it is the chain being able to say
+ * *closed at T1, reopened at T2 by U, reclosed at T3*.
+ */
+export interface PeriodReopenEvent {
+    readonly op: 'reopen' | 'reclose';
+    /** ISO timestamp the event was recorded. */
+    readonly at: string;
+    /** userId of the keyring that performed it. */
+    readonly by: string;
+    /**
+     * `reopen` only — ISO instant after which the period re-seals on its own,
+     * with nobody acting. Absent means the window stays open until an explicit
+     * `reclosePeriod`.
+     */
+    readonly until?: string;
+    /** Free-text justification, carried verbatim into the audit trail. */
+    readonly reason?: string;
+}
+/**
+ * Companion holding a period's reopen/reclose history (#1022). Stored in
+ * {@link PERIOD_REOPENS_COLLECTION}, keyed by the period's storage key — kept
+ * OFF the hash-chained `_periods/<name>` record for the same reason freeze and
+ * archive are: reopening must never rewrite the close, or the chain that proves
+ * the close happened is the very thing the reopen destroys.
+ *
+ * `events` is APPEND-ONLY. Where the other companions are single-shot and
+ * idempotent, this one accumulates, because the cycle repeats.
+ */
+export interface PeriodReopenRecord {
+    readonly period: string;
+    readonly partition?: PeriodPartition;
+    readonly events: readonly PeriodReopenEvent[];
+}
+/**
+ * Collapse an append-only reopen log into the return-only fields merged onto a
+ * {@link PeriodRecord} on read.
+ *
+ * Expiry is deliberately NOT resolved here: `reopenedUntil` is carried through
+ * verbatim and compared against the clock at write-guard time, so a bounded
+ * window re-seals on its own without anything having to run.
+ *
+ * @internal
+ */
+export declare function resolveReopenState(events: readonly PeriodReopenEvent[]): {
+    reopenedAt?: string;
+    reopenedBy?: string;
+    reopenedUntil?: string;
+    reopenReason?: string;
+    reclosedAt?: string;
+    reopenCount: number;
+};
+/**
+ * Is this period writable right now on account of a reopen? (#1022)
+ *
+ * Three ways to be sealed again: never reopened, explicitly reclosed after the
+ * last reopen, or a bounded window that has elapsed. The clock is read by the
+ * caller and passed in, so the guard and any diagnostic agree on one instant.
+ *
+ * @internal
+ */
+export declare function isEffectivelyReopened(period: PeriodRecord, nowIso: string): boolean;
 /**
  * Companion record noting that a closed+frozen period's delete markers were
  * swept off the vault's push-only sync targets (#615). Stored in
@@ -189,6 +256,46 @@ export interface PeriodTargetPurgeRecord {
     readonly purgedBy: string;
     readonly targets: readonly TargetPurgeCount[];
 }
+/**
+ * Scope tuple for a period timeline (#1005).
+ *
+ * Identical in shape and semantics to `SequenceOptions.partition`: a
+ * partitioned timeline is always disjoint from any unpartitioned one, and from
+ * every other tuple. `['acme', 'vat']` and `['acme', 'wht']` are two
+ * independent close calendars for the same subject — which is the whole point,
+ * since sub-ledgers for one legal entity and one month routinely close on
+ * different statutory deadlines.
+ */
+export type PeriodPartition = readonly (string | number)[];
+/**
+ * Resolve the `_periods` storage key for a (name, partition) pair.
+ *
+ * Deliberately the same encoding as `resolveSequenceKey`: `name` verbatim when
+ * unpartitioned, else `${name}\x00${parts}` with each component
+ * `encodeURIComponent`d and `'/'`-joined. The null-byte separator cannot occur
+ * in a period name, so a partitioned key never collides with an unpartitioned
+ * one; URI-encoding keeps `['a/b']` distinct from `['a','b']`.
+ *
+ * @throws {ValidationError} on an empty component or a non-finite number.
+ * @internal
+ */
+export declare function resolvePeriodKey(name: string, partition?: PeriodPartition): string;
+/**
+ * Do two partitions denote the same timeline? Absent and empty both mean "the
+ * unpartitioned timeline", so they compare equal.
+ *
+ * @internal
+ */
+export declare function samePartition(a?: PeriodPartition, b?: PeriodPartition): boolean;
+/**
+ * Resolves a record to the timeline that governs it. Supplied by
+ * `withPeriods({ subjects })`; returns `undefined` for any collection with no
+ * mapping, which is what keeps an unconfigured vault on the single vault-wide
+ * timeline it has always had.
+ *
+ * @internal
+ */
+export type PartitionResolver = (collection: string, record: Record<string, unknown>) => PeriodPartition | undefined;
 /**
  * Stored record for one closed or opened accounting period. One entry
  * per period, keyed by `name` in the reserved `_periods` collection.
@@ -199,8 +306,19 @@ export interface PeriodTargetPurgeRecord {
  * into the next one, the same way the ledger's `prevHash` works.
  */
 export interface PeriodRecord {
-    /** Human-readable name (e.g., `'FY2026-Q1'`). Unique per vault. */
+    /**
+     * Human-readable name (e.g., `'FY2026-Q1'`). Unique per PARTITION — two
+     * timelines may each carry a `'2026-06'`, which is the normal case when one
+     * vault serves several subjects (#1005). Unique per vault when unpartitioned.
+     */
     readonly name: string;
+    /**
+     * The timeline this period belongs to. Absent = the vault-wide timeline.
+     * Two periods with the same `name` and different `partition` are unrelated:
+     * separate hash chains, separate close state, and the write guard applies
+     * each only to records that resolve to its own tuple.
+     */
+    readonly partition?: PeriodPartition;
     /**
      * Role discriminator. A period is `'closed'` from the moment its
      * `closedAt` is recorded; `'opened'` marks a period whose opening
@@ -261,6 +379,19 @@ export interface PeriodRecord {
     readonly targetsPurgedAt?: string;
     readonly targetsPurgedBy?: string;
     readonly targetsPurged?: readonly TargetPurgeCount[];
+    /** #1022 return-only — collapsed from the `_period_reopens/<key>` append-only
+     *  log on read; NEVER written into the stored `_periods/<name>` record, so a
+     *  reopen cannot disturb the inter-period hash chain. Absent = never reopened.
+     *  `reclosedAt` present (and >= `reopenedAt`) means the window was closed
+     *  again explicitly; `reopenedUntil` in the past means it lapsed on its own.
+     *  Use {@link isEffectivelyReopened} rather than reading these directly. */
+    readonly reopenedAt?: string;
+    readonly reopenedBy?: string;
+    readonly reopenedUntil?: string;
+    readonly reopenReason?: string;
+    readonly reclosedAt?: string;
+    /** How many times this period has been reopened, ever. */
+    readonly reopenCount?: number;
 }
 /** Options for `vault.closePeriod()`. */
 export interface ClosePeriodOptions {
@@ -283,11 +414,32 @@ export interface ClosePeriodOptions {
      * an explicit `dateField`.
      */
     readonly dateField?: string;
+    /**
+     * Close only this timeline (#1005). Omit for the vault-wide timeline.
+     *
+     * ```ts
+     * vault.closePeriod({
+     *   name: '2026-06', endDate: '2026-06-30', dateField: 'issuedAt',
+     *   partition: [clientId, 'vat'],
+     * })
+     * ```
+     *
+     * Which records the resulting seal applies to is decided by the
+     * `subjects` map passed to `withPeriods()` — without one, no record ever
+     * resolves to a partition and a partitioned close seals nothing.
+     */
+    readonly partition?: PeriodPartition;
 }
 /** Options for `vault.openPeriod()`. */
 export interface OpenPeriodOptions<TCollections = Record<string, Record<string, unknown>>> {
     /** Human-readable name for the new period. Must be unique. */
     readonly name: string;
+    /**
+     * The timeline to open in. Must match the partition of `fromPeriod` — a
+     * period cannot chain across timelines, since each carries its own hash
+     * chain (#1005).
+     */
+    readonly partition?: PeriodPartition;
     /** ISO lower bound of the new period (usually prior `endDate + 1 day`). */
     readonly startDate: string;
     /**
@@ -357,7 +509,7 @@ export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt:
  *
  * @internal
  */
-export declare function chainAnchor(records: readonly PeriodRecord[]): Promise<{
+export declare function chainAnchor(records: readonly PeriodRecord[], partition?: PeriodPartition): Promise<{
     priorPeriodName?: string;
     priorPeriodHash: string;
 }>;
@@ -382,7 +534,10 @@ export declare function chainAnchor(records: readonly PeriodRecord[]): Promise<{
 export declare function assertTsWritable(existing: {
     ts: string | null;
     record: Record<string, unknown> | null;
-} | null, incomingRecord: Record<string, unknown> | null, closedPeriods: readonly PeriodRecord[]): void;
+} | null, incomingRecord: Record<string, unknown> | null, closedPeriods: readonly PeriodRecord[], scope?: {
+    collection: string;
+    resolve?: PartitionResolver;
+}): void;
 /**
  * Sanity-check a proposed period name + endDate against existing
  * records. Shared by closePeriod / openPeriod so the two pathways
@@ -390,7 +545,7 @@ export declare function assertTsWritable(existing: {
  *
  * @internal
  */
-export declare function validatePeriodName(name: string, existing: readonly PeriodRecord[]): void;
+export declare function validatePeriodName(name: string, existing: readonly PeriodRecord[], partition?: PeriodPartition): void;
 /**
  * Wire a reserved-collection ledger append for a period record. The
  * period itself is stored via the adapter as an encrypted envelope;

package/dist/with-audit/periods/strategy.d.ts

@@ -12,21 +12,30 @@
  */
 import type { EncryptedEnvelope, NoydbStore } from '../../kernel/types.js';
 import type { LedgerStore } from '../../with-commit/history/ledger/store.js';
-import type { PeriodRecord } from './periods.js';
+import type { PeriodRecord, PeriodPartition, PartitionResolver } from './periods.js';
 /**
  * @internal
  */
 export interface PeriodsStrategy {
     loadPeriods(adapter: NoydbStore, vault: string, decrypt: (envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
-    chainAnchor(records: readonly PeriodRecord[]): Promise<{
+    chainAnchor(records: readonly PeriodRecord[], partition?: PeriodPartition): Promise<{
         priorPeriodName?: string;
         priorPeriodHash: string;
     }>;
     assertTsWritable(existing: {
         ts: string | null;
         record: Record<string, unknown> | null;
-    } | null, incoming: Record<string, unknown> | null, periods: readonly PeriodRecord[]): void;
-    validatePeriodName(name: string, existing: readonly PeriodRecord[]): void;
+    } | null, incoming: Record<string, unknown> | null, periods: readonly PeriodRecord[], scope?: {
+        collection: string;
+        resolve?: PartitionResolver;
+    }): void;
+    validatePeriodName(name: string, existing: readonly PeriodRecord[], partition?: PeriodPartition): void;
+    /**
+     * Record → timeline resolver built from `withPeriods({ subjects })` (#1005).
+     * `undefined` when the caller configured no subjects, which keeps every
+     * record on the vault-wide timeline.
+     */
+    readonly partitionOf?: PartitionResolver;
     appendPeriodLedgerEntry(ledger: LedgerStore | null, actor: string, envelope: EncryptedEnvelope, periodName: string, collection?: string): Promise<void>;
 }
 export declare const NO_PERIODS: PeriodsStrategy;