@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.20

package/dist/{ulid-PTAIMDG4.js → ulid-VQW6ERQN.js}

@@ -1,10 +1,10 @@
 import {
   generateULID,
   isULID
-} from "./chunk-ZJADGNYF.js";
+} from "./chunk-4AOERLTV.js";
 import "./chunk-PZ5AY32C.js";
 export {
   generateULID,
   isULID
 };
-//# sourceMappingURL=ulid-PTAIMDG4.js.map
+//# sourceMappingURL=ulid-VQW6ERQN.js.map

package/dist/util/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-PY4KJPYU.js";
 import {
   FilenameSanitizationError
-} from "../chunk-HNGSV2YC.js";
+} from "../chunk-P7L3OQLL.js";
 import "../chunk-PZ5AY32C.js";
 
 // src/kernel/util/sanitize-filename.ts

package/dist/vault-head/index.js

@@ -0,0 +1,115 @@
+import {
+  DEFAULT_HEAD_BUCKETS,
+  NO_VAULT_HEAD,
+  VAULT_HEAD_COLLECTION
+} from "../chunk-HK67PX4J.js";
+import {
+  buildRecordAad,
+  openEnvelopeJson
+} from "../chunk-D5UDZANO.js";
+import {
+  buildRecordEnvelope
+} from "../chunk-ZVAFJQZB.js";
+import "../chunk-OQLYMBJI.js";
+import "../chunk-DJ23QZIN.js";
+import "../chunk-SFD2LL7G.js";
+import "../chunk-LP7BEXCT.js";
+import {
+  encrypt
+} from "../chunk-VJ4B3ZXY.js";
+import "../chunk-3Y4OFWQJ.js";
+import "../chunk-P7L3OQLL.js";
+import "../chunk-PZ5AY32C.js";
+
+// src/with-commit/vault-head/head.ts
+function bucketIndex(collection, id, buckets) {
+  let h = 2166136261;
+  const s = `${collection}/${id}`;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return h % buckets;
+}
+function bucketId(collection, id, buckets) {
+  return `${collection}::${String(bucketIndex(collection, id, buckets))}`;
+}
+async function readBucket(store, vault, dek, bucket) {
+  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket);
+  if (!env) return { body: {}, version: 0 };
+  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek);
+  return { body: JSON.parse(json), version: env._v };
+}
+async function writeBucket(store, vault, dek, bucket, body, expectedVersion) {
+  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 };
+  const json = JSON.stringify(body);
+  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity));
+  const env = buildRecordEnvelope(identity, { iv, data });
+  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || void 0);
+}
+
+// src/with-commit/vault-head/active.ts
+function withVaultHead(opts = {}) {
+  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS;
+  const dekFor = (getDEK) => getDEK(VAULT_HEAD_COLLECTION);
+  return {
+    enabled: true,
+    bucketFor: (collection, id) => bucketId(collection, id, buckets),
+    async note(store, vault, getDEK, entry) {
+      const dek = await dekFor(getDEK);
+      const bucket = bucketId(entry.collection, entry.id, buckets);
+      const { body, version } = await readBucket(store, vault, dek, bucket);
+      const key = `${entry.collection}/${entry.id}`;
+      if ((body[key] ?? -1) >= entry.version) return;
+      body[key] = entry.version;
+      await writeBucket(store, vault, dek, bucket, body, version);
+    },
+    async expected(store, vault, getDEK, collection, id) {
+      const dek = await dekFor(getDEK);
+      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets));
+      return body[`${collection}/${id}`] ?? null;
+    },
+    async knownIn(store, vault, getDEK, collection) {
+      const dek = await dekFor(getDEK);
+      const out = /* @__PURE__ */ new Map();
+      const prefix = `${collection}/`;
+      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {
+        if (!bucket.startsWith(`${collection}::`)) continue;
+        const { body } = await readBucket(store, vault, dek, bucket);
+        for (const [k, v] of Object.entries(body)) {
+          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v);
+        }
+      }
+      return out;
+    }
+  };
+}
+
+// src/with-commit/vault-head/verify.ts
+async function verifyVaultHead(head, store, vault, getDEK, collection) {
+  const known = await head.knownIn(store, vault, getDEK, collection);
+  const discrepancies = [];
+  const because = [];
+  if (known.size === 0) because.push("no-expectations");
+  if (store.capabilities?.casAtomic !== true) because.push("store-cannot-cas");
+  for (const [id, expected] of known) {
+    const env = await store.get(vault, collection, id);
+    if (env === null) {
+      discrepancies.push({ collection, id, expected, actual: null, kind: "withheld" });
+      continue;
+    }
+    if (env._v < expected) {
+      discrepancies.push({ collection, id, expected, actual: env._v, kind: "rolled-back" });
+    }
+  }
+  const verdict = discrepancies.length > 0 ? "tampered" : because.length > 0 ? "unverifiable" : "verified";
+  return { verdict, checked: known.size, discrepancies, because };
+}
+export {
+  DEFAULT_HEAD_BUCKETS,
+  NO_VAULT_HEAD,
+  VAULT_HEAD_COLLECTION,
+  verifyVaultHead,
+  withVaultHead
+};
+//# sourceMappingURL=index.js.map

package/dist/vault-head/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/with-commit/vault-head/head.ts","../../src/with-commit/vault-head/active.ts","../../src/with-commit/vault-head/verify.ts"],"sourcesContent":["/**\n * The vault head's storage layer (#1044).\n *\n * A bucket is an ordinary encrypted record at `_head/<collection>::<n>`, so it\n * inherits #1041's identity binding for free: the store cannot relocate a\n * bucket, re-author it, or serve one bucket's bytes as another's. What it can\n * still do is serve an OLD bucket, which is why {@link readBucket} enforces\n * monotonicity against the caller's own record of what it last wrote.\n *\n * @packageDocumentation\n */\nimport { encrypt, buildRecordAad, openEnvelopeJson, buildRecordEnvelope, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../kernel/types.js'\nimport { VAULT_HEAD_COLLECTION } from './strategy.js'\n\n/** `{ recordId → version }` for one bucket. */\nexport type BucketBody = Record<string, number>\n\n/**\n * FNV-1a over `collection/id`. A hash, not a cipher: the bucket a record lands\n * in is not secret — the store already sees which bucket was written, and it\n * already saw the record's own address. Choosing something stronger would buy\n * nothing and cost every write.\n */\nexport function bucketIndex(collection: string, id: string, buckets: number): number {\n  let h = 0x811c9dc5\n  const s = `${collection}/${id}`\n  for (let i = 0; i < s.length; i++) {\n    h ^= s.charCodeAt(i)\n    h = Math.imul(h, 0x01000193) >>> 0\n  }\n  return h % buckets\n}\n\nexport function bucketId(collection: string, id: string, buckets: number): string {\n  return `${collection}::${String(bucketIndex(collection, id, buckets))}`\n}\n\nexport async function readBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n): Promise<{ body: BucketBody; version: number }> {\n  const env = await store.get(vault, VAULT_HEAD_COLLECTION, bucket)\n  if (!env) return { body: {}, version: 0 }\n  const json = await openEnvelopeJson({ collection: VAULT_HEAD_COLLECTION, id: bucket }, env, dek)\n  return { body: JSON.parse(json) as BucketBody, version: env._v }\n}\n\nexport async function writeBucket(\n  store: NoydbStore,\n  vault: string,\n  dek: EnclaveKey,\n  bucket: string,\n  body: BucketBody,\n  expectedVersion: number,\n): Promise<void> {\n  const identity = { collection: VAULT_HEAD_COLLECTION, id: bucket, version: expectedVersion + 1 }\n  const json = JSON.stringify(body)\n  const { iv, data } = await encrypt(json, dek, buildRecordAad(identity))\n  const env = buildRecordEnvelope(identity, { iv, data })\n  // CAS: two writers racing on one bucket must not silently lose an entry.\n  // A lost head entry is a record the sweep stops expecting — a false clean.\n  await store.put(vault, VAULT_HEAD_COLLECTION, bucket, env, expectedVersion || undefined)\n}\n","/**\n * The real {@link VaultHeadStrategy} (#1044).\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport {\n  DEFAULT_HEAD_BUCKETS,\n  VAULT_HEAD_COLLECTION,\n  type HeadEntry,\n  type VaultHeadStrategy,\n  type WithVaultHeadOptions,\n} from './strategy.js'\nimport { bucketId, readBucket, writeBucket } from './head.js'\n\nexport function withVaultHead(opts: WithVaultHeadOptions = {}): VaultHeadStrategy {\n  const buckets = opts.buckets ?? DEFAULT_HEAD_BUCKETS\n\n  const dekFor = (getDEK: (c: string) => Promise<EnclaveKey>) => getDEK(VAULT_HEAD_COLLECTION)\n\n  return {\n    enabled: true,\n    bucketFor: (collection, id) => bucketId(collection, id, buckets),\n\n    async note(store: NoydbStore, vault, getDEK, entry: HeadEntry) {\n      const dek = await dekFor(getDEK)\n      const bucket = bucketId(entry.collection, entry.id, buckets)\n      const { body, version } = await readBucket(store, vault, dek, bucket)\n      const key = `${entry.collection}/${entry.id}`\n      // Monotonic: a head entry never moves BACKWARD. A write that would lower\n      // it is either a stale retry or a rollback being laundered through the\n      // client's own head, and neither should be recorded.\n      if ((body[key] ?? -1) >= entry.version) return\n      body[key] = entry.version\n      await writeBucket(store, vault, dek, bucket, body, version)\n    },\n\n    async expected(store, vault, getDEK, collection, id) {\n      const dek = await dekFor(getDEK)\n      const { body } = await readBucket(store, vault, dek, bucketId(collection, id, buckets))\n      return body[`${collection}/${id}`] ?? null\n    },\n\n    async knownIn(store, vault, getDEK, collection) {\n      const dek = await dekFor(getDEK)\n      const out = new Map<string, number>()\n      const prefix = `${collection}/`\n      // Sweep every bucket: a record's bucket is a function of its id, so the\n      // set for one collection is spread across all of them.\n      for (const bucket of await store.list(vault, VAULT_HEAD_COLLECTION)) {\n        if (!bucket.startsWith(`${collection}::`)) continue\n        const { body } = await readBucket(store, vault, dek, bucket)\n        for (const [k, v] of Object.entries(body)) {\n          if (k.startsWith(prefix)) out.set(k.slice(prefix.length), v)\n        }\n      }\n      return out\n    },\n  }\n}\n","/**\n * The sweep — comparing what the head expects against what the store serves (#1044).\n *\n * This is the only place absence becomes visible. #1041 and #1042 can reject a\n * record that lies about itself; neither can notice one that never arrived, or\n * one served at an older version than the client wrote. Both are indistinguishable\n * from the truth without an independent record of what should be there.\n *\n * @packageDocumentation\n */\nimport type { NoydbStore } from '../../kernel/types.js'\nimport type { EnclaveKey } from '../../kernel/enclave/index.js'\nimport type { VaultHeadStrategy } from './strategy.js'\n\n/** One record the store is not serving faithfully. */\nexport interface HeadDiscrepancy {\n  readonly collection: string\n  readonly id: string\n  /** What the client last committed. */\n  readonly expected: number\n  /**\n   * What the store serves now — or `null` when it serves nothing.\n   *\n   * The two are different attacks wearing the same result. `null` is\n   * **suppression**: the record is gone. A lower number is **rollback**: an\n   * authentic older version served in place of the current one, which is the\n   * case no amount of per-envelope authentication can see.\n   */\n  readonly actual: number | null\n  readonly kind: 'withheld' | 'rolled-back'\n}\n\n/**\n * Why a sweep could not reach a conclusion.\n *\n * - `'no-expectations'` — the head holds nothing for this collection. A fresh\n *   vault, a head switched on after the fact, or a **restore from a snapshot**:\n *   `_head` is `_`-prefixed, so `loadAll` excludes it and a restored vault has\n *   no head to compare against.\n * - `'store-cannot-cas'` — the store does not advertise `capabilities.casAtomic`,\n *   so two writers racing on one bucket can silently lose an entry. A lost entry\n *   is a record the sweep stops expecting, which is a false clean.\n */\nexport type HeadUnverifiableReason = 'no-expectations' | 'store-cannot-cas'\n\n/**\n * ## Three-way, deliberately (#1101)\n *\n * - `'verified'` — the head held expectations, every one was met, and the store\n *   can serialize head writes.\n * - `'unverifiable'` — the sweep could not conclude. See `because`.\n * - `'tampered'` — at least one discrepancy. Positive evidence, so it wins over\n *   any `unverifiable` reason present at the same time.\n *\n * **The middle value is the point, and collapsing it is wrong in a different\n * direction each way:** folded into \"clean\" it hides withholding, which is the\n * one thing this service exists to catch; folded into \"tampered\" it cries wolf\n * on a vault that is merely unexamined.\n *\n * That is not hypothetical. #1044's own first bug was a head that recorded\n * nothing and swept **perfectly clean** — the degraded state rendered\n * identically to a healthy one, which is why its test asserts `checked` before\n * anything else. A two-way verdict makes that state a supported outcome.\n */\nexport type HeadVerdict = 'verified' | 'unverifiable' | 'tampered'\n\nexport interface HeadVerifyResult {\n  readonly verdict: HeadVerdict\n  readonly checked: number\n  readonly discrepancies: readonly HeadDiscrepancy[]\n  /**\n   * Non-empty only when `verdict === 'unverifiable'`.\n   *\n   * There is deliberately no `clean: boolean`. It could not distinguish \"no\n   * expectations\" from \"all expectations met\" — both rendered `true` — and that\n   * indistinguishability *was* the defect. Replacing it rather than keeping it\n   * alongside forces every caller to face the three-way.\n   */\n  readonly because: readonly HeadUnverifiableReason[]\n}\n\n/**\n * Sweep one collection.\n *\n * **A record the store serves that the head does NOT know is not reported.**\n * That is not an oversight: the head can be enabled on an existing vault, and\n * every pre-existing record would otherwise read as an anomaly. The head's\n * claim is one-directional — *what I wrote must still be there* — and an\n * unknown record simply falls outside it.\n *\n * **A HIGHER version than expected is also not reported**, for the same reason:\n * another device legitimately advanced it. The head detects going backwards, not\n * moving forwards.\n */\nexport async function verifyVaultHead(\n  head: VaultHeadStrategy,\n  store: NoydbStore,\n  vault: string,\n  getDEK: (collection: string) => Promise<EnclaveKey>,\n  collection: string,\n): Promise<HeadVerifyResult> {\n  const known = await head.knownIn(store, vault, getDEK, collection)\n  const discrepancies: HeadDiscrepancy[] = []\n\n  const because: HeadUnverifiableReason[] = []\n  if (known.size === 0) because.push('no-expectations')\n  // Read the store's OWN declared capability rather than probing: a store that\n  // cannot serialize head writes may have silently dropped an entry, and a\n  // dropped entry is invisible by construction — there is nothing left to find.\n  if (store.capabilities?.casAtomic !== true) because.push('store-cannot-cas')\n\n  for (const [id, expected] of known) {\n    const env = await store.get(vault, collection, id)\n    if (env === null) {\n      discrepancies.push({ collection, id, expected, actual: null, kind: 'withheld' })\n      continue\n    }\n    if (env._v < expected) {\n      discrepancies.push({ collection, id, expected, actual: env._v, kind: 'rolled-back' })\n    }\n  }\n\n  // A discrepancy is positive evidence, so it outranks any reason the sweep was\n  // also incomplete: a rolled-back record found by a head that may be missing\n  // OTHER entries is still a rolled-back record.\n  const verdict: HeadVerdict = discrepancies.length > 0\n    ? 'tampered'\n    : because.length > 0 ? 'unverifiable' : 'verified'\n\n  return { verdict, checked: known.size, discrepancies, because }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBO,SAAS,YAAY,YAAoB,IAAY,SAAyB;AACnF,MAAI,IAAI;AACR,QAAM,IAAI,GAAG,UAAU,IAAI,EAAE;AAC7B,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,SAAK,EAAE,WAAW,CAAC;AACnB,QAAI,KAAK,KAAK,GAAG,QAAU,MAAM;AAAA,EACnC;AACA,SAAO,IAAI;AACb;AAEO,SAAS,SAAS,YAAoB,IAAY,SAAyB;AAChF,SAAO,GAAG,UAAU,KAAK,OAAO,YAAY,YAAY,IAAI,OAAO,CAAC,CAAC;AACvE;AAEA,eAAsB,WACpB,OACA,OACA,KACA,QACgD;AAChD,QAAM,MAAM,MAAM,MAAM,IAAI,OAAO,uBAAuB,MAAM;AAChE,MAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE;AACxC,QAAM,OAAO,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,OAAO,GAAG,KAAK,GAAG;AAC/F,SAAO,EAAE,MAAM,KAAK,MAAM,IAAI,GAAiB,SAAS,IAAI,GAAG;AACjE;AAEA,eAAsB,YACpB,OACA,OACA,KACA,QACA,MACA,iBACe;AACf,QAAM,WAAW,EAAE,YAAY,uBAAuB,IAAI,QAAQ,SAAS,kBAAkB,EAAE;AAC/F,QAAM,OAAO,KAAK,UAAU,IAAI;AAChC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,KAAK,eAAe,QAAQ,CAAC;AACtE,QAAM,MAAM,oBAAoB,UAAU,EAAE,IAAI,KAAK,CAAC;AAGtD,QAAM,MAAM,IAAI,OAAO,uBAAuB,QAAQ,KAAK,mBAAmB,MAAS;AACzF;;;ACjDO,SAAS,cAAc,OAA6B,CAAC,GAAsB;AAChF,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,SAAS,CAAC,WAA+C,OAAO,qBAAqB;AAE3F,SAAO;AAAA,IACL,SAAS;AAAA,IACT,WAAW,CAAC,YAAY,OAAO,SAAS,YAAY,IAAI,OAAO;AAAA,IAE/D,MAAM,KAAK,OAAmB,OAAO,QAAQ,OAAkB;AAC7D,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,SAAS,SAAS,MAAM,YAAY,MAAM,IAAI,OAAO;AAC3D,YAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AACpE,YAAM,MAAM,GAAG,MAAM,UAAU,IAAI,MAAM,EAAE;AAI3C,WAAK,KAAK,GAAG,KAAK,OAAO,MAAM,QAAS;AACxC,WAAK,GAAG,IAAI,MAAM;AAClB,YAAM,YAAY,OAAO,OAAO,KAAK,QAAQ,MAAM,OAAO;AAAA,IAC5D;AAAA,IAEA,MAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,IAAI;AACnD,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,SAAS,YAAY,IAAI,OAAO,CAAC;AACtF,aAAO,KAAK,GAAG,UAAU,IAAI,EAAE,EAAE,KAAK;AAAA,IACxC;AAAA,IAEA,MAAM,QAAQ,OAAO,OAAO,QAAQ,YAAY;AAC9C,YAAM,MAAM,MAAM,OAAO,MAAM;AAC/B,YAAM,MAAM,oBAAI,IAAoB;AACpC,YAAM,SAAS,GAAG,UAAU;AAG5B,iBAAW,UAAU,MAAM,MAAM,KAAK,OAAO,qBAAqB,GAAG;AACnE,YAAI,CAAC,OAAO,WAAW,GAAG,UAAU,IAAI,EAAG;AAC3C,cAAM,EAAE,KAAK,IAAI,MAAM,WAAW,OAAO,OAAO,KAAK,MAAM;AAC3D,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,cAAI,EAAE,WAAW,MAAM,EAAG,KAAI,IAAI,EAAE,MAAM,OAAO,MAAM,GAAG,CAAC;AAAA,QAC7D;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACkCA,eAAsB,gBACpB,MACA,OACA,OACA,QACA,YAC2B;AAC3B,QAAM,QAAQ,MAAM,KAAK,QAAQ,OAAO,OAAO,QAAQ,UAAU;AACjE,QAAM,gBAAmC,CAAC;AAE1C,QAAM,UAAoC,CAAC;AAC3C,MAAI,MAAM,SAAS,EAAG,SAAQ,KAAK,iBAAiB;AAIpD,MAAI,MAAM,cAAc,cAAc,KAAM,SAAQ,KAAK,kBAAkB;AAE3E,aAAW,CAAC,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAM,MAAM,MAAM,MAAM,IAAI,OAAO,YAAY,EAAE;AACjD,QAAI,QAAQ,MAAM;AAChB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,MAAM,MAAM,WAAW,CAAC;AAC/E;AAAA,IACF;AACA,QAAI,IAAI,KAAK,UAAU;AACrB,oBAAc,KAAK,EAAE,YAAY,IAAI,UAAU,QAAQ,IAAI,IAAI,MAAM,cAAc,CAAC;AAAA,IACtF;AAAA,EACF;AAKA,QAAM,UAAuB,cAAc,SAAS,IAChD,aACA,QAAQ,SAAS,IAAI,iBAAiB;AAE1C,SAAO,EAAE,SAAS,SAAS,MAAM,MAAM,eAAe,QAAQ;AAChE;","names":[]}

package/dist/{verify-RO5RTZOJ.js → verify-J6DEOXP3.js}

@@ -2,10 +2,10 @@ import {
   blindedEqual,
   evaluateKofN,
   openVdigPayload
-} from "./chunk-HXGUIPQB.js";
+} from "./chunk-OQLYMBJI.js";
 import {
   dualReadSealedSlot
-} from "./chunk-AR2JDFAE.js";
+} from "./chunk-DJ23QZIN.js";
 import {
   VDIG_ITERATIONS,
   normalizeForVerify,
@@ -14,11 +14,11 @@ import {
 import {
   base64ToBuffer,
   generateSalt
-} from "./chunk-VCETL77O.js";
+} from "./chunk-VJ4B3ZXY.js";
 import {
   ClassifiedConfigError,
   ClassifiedVerifyError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-P7L3OQLL.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/kernel/enclave/classify/verify.ts
@@ -137,4 +137,4 @@ export {
   verifyDigestField,
   verifyTextField
 };
-//# sourceMappingURL=verify-RO5RTZOJ.js.map
+//# sourceMappingURL=verify-J6DEOXP3.js.map

package/dist/via/lookup/handle.d.ts

@@ -132,7 +132,10 @@ export declare class LookupHandle<Keys extends string = string> {
      * `enclave-body-only` / Check 15 `via-enclave-isolation`) — the Vault binds the real
      * `kernel/enclave` function at construction time, same pattern as `reservedEnvelopes` above.
      */
-    buildDeleteMarker: (version: number, actor: string) => EncryptedEnvelope, 
+    buildDeleteMarker: (identity: {
+        collection: string;
+        id: string;
+    }, version: number, actor: string) => EncryptedEnvelope, 
     /** #650 Task 4 (#647) — dirty-log participation hook (origin `local-write`), threaded from `BuildLookupHandleOptions`. */
     onDirty?: ((collection: string, id: string, action: "put" | "delete", version: number) => Promise<void>) | undefined, 
     /** #650 Task 4 — thin `graphDispatch.collect`-equivalent; opens/collects/flushes a one-shot wave for this touch. */

package/dist/via/money/exact.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Exact decimal arithmetic for post-aggregate row math (#1007).
+ *
+ * Money leaves a reducer as a `MoneyString` — a decimal string, exact by
+ * construction. Doing `Number(a) - Number(b)` on two of those re-introduces
+ * binary floating point at the one step the money type exists to protect:
+ * `10.05 - 0.10` becomes `9.950000000000001`, which `quantizeMoneyFields`
+ * then correctly REFUSES rather than silently storing drift.
+ *
+ * So `derive` is handed these instead. Everything runs in scaled BigInt at the
+ * widest scale of its inputs and formats back to a decimal string, which means
+ * no operation here can introduce a representation error. Deliberately just
+ * the additive set — `add` / `sub` / `neg` / `min` / `max` / `cmp`. Anything
+ * needing multiplication or division needs a rounding policy, and a rounding
+ * policy is a decision the caller must make explicitly, not one this module
+ * should guess.
+ *
+ * @module
+ */
+/** A value these helpers accept: a decimal string, a number, or a bigint of whole units. */
+export type ExactOperand = string | number | bigint;
+/**
+ * Exact decimal helpers handed to an MV `derive` as its second argument.
+ *
+ * Every result is a decimal string, so results compose without ever passing
+ * through a float. Declare the derived field in the MV's `moneyFields` and the
+ * final value is quantised to that descriptor's scale on the way to storage.
+ */
+export interface ExactMath {
+    /** `a + b`, exact. */
+    add(a: ExactOperand, b: ExactOperand): string;
+    /** `a - b`, exact. */
+    sub(a: ExactOperand, b: ExactOperand): string;
+    /** `-a`, exact. */
+    neg(a: ExactOperand): string;
+    /** The larger of `a` and `b`. */
+    max(a: ExactOperand, b: ExactOperand): string;
+    /** The smaller of `a` and `b`. */
+    min(a: ExactOperand, b: ExactOperand): string;
+    /** `-1` when `a < b`, `0` when equal, `1` when `a > b`. */
+    cmp(a: ExactOperand, b: ExactOperand): -1 | 0 | 1;
+}
+/** The singleton passed to `derive` — stateless, so there is nothing to construct per row. */
+export declare const exactMath: ExactMath;

package/dist/via/money/index.d.ts

@@ -13,3 +13,5 @@ export { mulRate, allocate } from './arith.js';
 export type { MulRateOptions, AllocateOptions } from './arith.js';
 export { asMoney, isMoneyString, moneyNumber } from './branded.js';
 export type { MoneyString } from './branded.js';
+export { exactMath } from './exact.js';
+export type { ExactMath, ExactOperand } from './exact.js';

package/dist/via/money/normalize.d.ts

@@ -40,6 +40,26 @@ export declare function canonicalizeStoredMoney(record: unknown, moneyFields: Re
  * `MoneyPrecisionError`/`TypeError`.
  */
 export declare function canonicalizeIncomingMoney(record: unknown, moneyFields: Record<string, MoneyDescriptor> | undefined): unknown;
+/**
+ * Canonicalize money values for a MATERIALIZED-VIEW row (#1018).
+ *
+ * A money field in an MV row is NOT in the scaled-integer storage form a
+ * collection uses — the money-aware reducers emit `formatScaledInt(...)`, an
+ * exact decimal string, and that is what lands in the output collection. So a
+ * derived money field has to be canonicalized into the same shape as the
+ * aggregated ones beside it.
+ *
+ * Quantizing it into storage form instead is what #1018 reported: `toPay` came
+ * back as `"1000000"` where `netTotal` in the SAME row read `"10000.00"` —
+ * 100× the true value, and a string that looks like a plausible amount rather
+ * than an obvious error.
+ *
+ * Precision handling is identical to {@link quantizeMoneyFields} — the same
+ * `parseToScaledInt` and the same `MoneyPrecisionError` — so a value that
+ * cannot be represented at the declared scale is still refused rather than
+ * silently rounded. Only the OUTPUT shape differs: decimal, not scaled.
+ */
+export declare function canonicalizeMoneyFieldsAsDecimal<T extends Record<string, unknown>>(record: T, moneyFields: Record<string, MoneyDescriptor>): T;
 /**
  * Convert money fields in `record` from user input to their canonical
  * stored form. Returns a shallow clone (deep along declared nested

package/dist/walk-BX4NSB5L.js

@@ -0,0 +1,21 @@
+import {
+  dumpVaultSchema
+} from "./chunk-SG3OQCRG.js";
+import "./chunk-KHKKD62N.js";
+import "./chunk-N7YAQKAO.js";
+import "./chunk-Y2NBBT6K.js";
+import "./chunk-YVTADFTC.js";
+import "./chunk-D5UDZANO.js";
+import "./chunk-ZVAFJQZB.js";
+import "./chunk-OQLYMBJI.js";
+import "./chunk-DJ23QZIN.js";
+import "./chunk-SFD2LL7G.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-VJ4B3ZXY.js";
+import "./chunk-3Y4OFWQJ.js";
+import "./chunk-P7L3OQLL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  dumpVaultSchema
+};
+//# sourceMappingURL=walk-BX4NSB5L.js.map

package/dist/with-audit/guards/immutable-guard.d.ts

@@ -29,6 +29,20 @@ import type { GuardStrategy, GuardContext, GuardChange } from './types.js';
 export interface ImmutableGuardConfig<T extends Record<string, unknown>> {
     /** The collection to make WORM. */
     collection: string;
+    /**
+     * Optional stable per-vault identifier, forwarded verbatim to the
+     * underlying {@link GuardSpec.name} — `immutableGuard` is a wrapper
+     * around `withGuard` and grants the same identity affordance (#1006).
+     *
+     * Omit and `vault.listBehaviors()` falls back to a POSITIONAL
+     * `${collection}#${occurrence}` key, which renumbers when another
+     * guard on the same collection is registered ahead of this one. Pass
+     * a name whenever something joins to the behavior manifest by key —
+     * a generated rulebook, a diff between two vault versions, an audit
+     * report — so the identifier tracks the rule rather than its
+     * registration order.
+     */
+    readonly name?: string;
     /**
      * A record becomes immutable once this predicate holds. Evaluated on
      * the *existing* (already-persisted) record, so the write that first

package/dist/with-audit/periods/active.d.ts

@@ -2,10 +2,37 @@
  * Active periods strategy factory. Only reachable through the
  * `@noy-db/hub/periods` subpath.
  */
+import type { PeriodPartition } from './periods.js';
 import type { PeriodsStrategy } from './strategy.js';
+/** Options for {@link withPeriods}. */
+export interface WithPeriodsOptions {
+    /**
+     * Maps a collection to the timeline each of its records belongs to (#1005) —
+     * the answer to "which close calendar governs THIS record".
+     *
+     * ```ts
+     * withPeriods({
+     *   subjects: { receipts: (r) => [r.clientId, layerOf(r)] },
+     * })
+     * ```
+     *
+     * Same shape as `withForget({ subjects })`, which answers the same question
+     * for erasure. A collection with no entry — and every collection when
+     * `subjects` is omitted entirely — stays on the vault-wide timeline, so an
+     * existing vault behaves exactly as it did before partitions existed.
+     *
+     * Return `undefined` from a mapper to put an individual record back on the
+     * vault-wide timeline (e.g. a record that predates the field the mapping
+     * reads).
+     */
+    readonly subjects?: Readonly<Record<string, (record: Record<string, unknown>) => PeriodPartition | undefined>>;
+}
 /**
  * Build the default periods strategy. Pass into
  * `createNoydb({ periodsStrategy: withPeriods() })` to enable
  * `vault.closePeriod()` / `vault.openPeriod()` / write-guards.
+ *
+ * Pass `subjects` to run more than one close calendar in a single vault — see
+ * {@link WithPeriodsOptions.subjects}.
  */
-export declare function withPeriods(): PeriodsStrategy;
+export declare function withPeriods(options?: WithPeriodsOptions): PeriodsStrategy;

package/dist/with-audit/periods/index.d.ts

@@ -13,8 +13,10 @@
  * Vault can call them without TypeScript barrel gymnastics.
  */
 export { withPeriods } from './active.js';
+export type { WithPeriodsOptions } from './active.js';
 export type { PeriodsStrategy } from './strategy.js';
-export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, periodExclusiveUpperBound, loadPeriods, chainAnchor, assertTsWritable, validatePeriodName, appendPeriodLedgerEntry, purgeMarkersOn, } from './periods.js';
-export type { PeriodRecord, PeriodFreezeRecord, PeriodArchiveRecord, PeriodTargetPurgeRecord, TargetPurgeCount, ClosePeriodOptions, OpenPeriodOptions, CarryForwardContext, ReadOnlyCollection, } from './periods.js';
+export type { PeriodScope, PeriodScopeWithReason, ReopenPeriodOptions } from './vault-facade.js';
+export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, PERIOD_REOPENS_COLLECTION, periodExclusiveUpperBound, resolvePeriodKey, samePartition, resolveReopenState, isEffectivelyReopened, loadPeriods, chainAnchor, assertTsWritable, validatePeriodName, appendPeriodLedgerEntry, purgeMarkersOn, } from './periods.js';
+export type { PeriodPartition, PartitionResolver, PeriodReopenEvent, PeriodReopenRecord, PeriodRecord, PeriodFreezeRecord, PeriodArchiveRecord, PeriodTargetPurgeRecord, TargetPurgeCount, ClosePeriodOptions, OpenPeriodOptions, CarryForwardContext, ReadOnlyCollection, } from './periods.js';
 /** The un-opted-in stub for this service — exported so callers can compare against it (#844). */
 export { NO_PERIODS } from './strategy.js';

package/dist/with-audit/periods/periods.d.ts

@@ -146,7 +146,7 @@
  */
 import type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js';
 import type { LedgerStore } from '../../with-commit/history/ledger/index.js';
-export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, periodExclusiveUpperBound, } from './window.js';
+export { PERIODS_COLLECTION, PERIOD_FREEZES_COLLECTION, PERIOD_ARCHIVES_COLLECTION, PERIOD_TARGET_PURGES_COLLECTION, PERIOD_REOPENS_COLLECTION, periodExclusiveUpperBound, } from './window.js';
 /**
  * Companion record recording that a closed period was frozen (its delete
  * markers physically purged). Stored in {@link PERIOD_FREEZES_COLLECTION},
@@ -177,6 +177,73 @@ export interface TargetPurgeCount {
     readonly role: 'backup' | 'archive';
     readonly purgedCount: number;
 }
+/**
+ * One entry in a period's append-only reopen/reclose log (#1022).
+ *
+ * Real accounting close is a three-state lifecycle — open / closed / reopened
+ * — not a one-way door. A month gets closed, a missing invoice arrives or a
+ * filing is rejected, the month is reopened, corrected, and reclosed. The audit
+ * value is not the ability to write again; it is the chain being able to say
+ * *closed at T1, reopened at T2 by U, reclosed at T3*.
+ */
+export interface PeriodReopenEvent {
+    readonly op: 'reopen' | 'reclose';
+    /** ISO timestamp the event was recorded. */
+    readonly at: string;
+    /** userId of the keyring that performed it. */
+    readonly by: string;
+    /**
+     * `reopen` only — ISO instant after which the period re-seals on its own,
+     * with nobody acting. Absent means the window stays open until an explicit
+     * `reclosePeriod`.
+     */
+    readonly until?: string;
+    /** Free-text justification, carried verbatim into the audit trail. */
+    readonly reason?: string;
+}
+/**
+ * Companion holding a period's reopen/reclose history (#1022). Stored in
+ * {@link PERIOD_REOPENS_COLLECTION}, keyed by the period's storage key — kept
+ * OFF the hash-chained `_periods/<name>` record for the same reason freeze and
+ * archive are: reopening must never rewrite the close, or the chain that proves
+ * the close happened is the very thing the reopen destroys.
+ *
+ * `events` is APPEND-ONLY. Where the other companions are single-shot and
+ * idempotent, this one accumulates, because the cycle repeats.
+ */
+export interface PeriodReopenRecord {
+    readonly period: string;
+    readonly partition?: PeriodPartition;
+    readonly events: readonly PeriodReopenEvent[];
+}
+/**
+ * Collapse an append-only reopen log into the return-only fields merged onto a
+ * {@link PeriodRecord} on read.
+ *
+ * Expiry is deliberately NOT resolved here: `reopenedUntil` is carried through
+ * verbatim and compared against the clock at write-guard time, so a bounded
+ * window re-seals on its own without anything having to run.
+ *
+ * @internal
+ */
+export declare function resolveReopenState(events: readonly PeriodReopenEvent[]): {
+    reopenedAt?: string;
+    reopenedBy?: string;
+    reopenedUntil?: string;
+    reopenReason?: string;
+    reclosedAt?: string;
+    reopenCount: number;
+};
+/**
+ * Is this period writable right now on account of a reopen? (#1022)
+ *
+ * Three ways to be sealed again: never reopened, explicitly reclosed after the
+ * last reopen, or a bounded window that has elapsed. The clock is read by the
+ * caller and passed in, so the guard and any diagnostic agree on one instant.
+ *
+ * @internal
+ */
+export declare function isEffectivelyReopened(period: PeriodRecord, nowIso: string): boolean;
 /**
  * Companion record noting that a closed+frozen period's delete markers were
  * swept off the vault's push-only sync targets (#615). Stored in
@@ -189,6 +256,46 @@ export interface PeriodTargetPurgeRecord {
     readonly purgedBy: string;
     readonly targets: readonly TargetPurgeCount[];
 }
+/**
+ * Scope tuple for a period timeline (#1005).
+ *
+ * Identical in shape and semantics to `SequenceOptions.partition`: a
+ * partitioned timeline is always disjoint from any unpartitioned one, and from
+ * every other tuple. `['acme', 'vat']` and `['acme', 'wht']` are two
+ * independent close calendars for the same subject — which is the whole point,
+ * since sub-ledgers for one legal entity and one month routinely close on
+ * different statutory deadlines.
+ */
+export type PeriodPartition = readonly (string | number)[];
+/**
+ * Resolve the `_periods` storage key for a (name, partition) pair.
+ *
+ * Deliberately the same encoding as `resolveSequenceKey`: `name` verbatim when
+ * unpartitioned, else `${name}\x00${parts}` with each component
+ * `encodeURIComponent`d and `'/'`-joined. The null-byte separator cannot occur
+ * in a period name, so a partitioned key never collides with an unpartitioned
+ * one; URI-encoding keeps `['a/b']` distinct from `['a','b']`.
+ *
+ * @throws {ValidationError} on an empty component or a non-finite number.
+ * @internal
+ */
+export declare function resolvePeriodKey(name: string, partition?: PeriodPartition): string;
+/**
+ * Do two partitions denote the same timeline? Absent and empty both mean "the
+ * unpartitioned timeline", so they compare equal.
+ *
+ * @internal
+ */
+export declare function samePartition(a?: PeriodPartition, b?: PeriodPartition): boolean;
+/**
+ * Resolves a record to the timeline that governs it. Supplied by
+ * `withPeriods({ subjects })`; returns `undefined` for any collection with no
+ * mapping, which is what keeps an unconfigured vault on the single vault-wide
+ * timeline it has always had.
+ *
+ * @internal
+ */
+export type PartitionResolver = (collection: string, record: Record<string, unknown>) => PeriodPartition | undefined;
 /**
  * Stored record for one closed or opened accounting period. One entry
  * per period, keyed by `name` in the reserved `_periods` collection.
@@ -199,8 +306,19 @@ export interface PeriodTargetPurgeRecord {
  * into the next one, the same way the ledger's `prevHash` works.
  */
 export interface PeriodRecord {
-    /** Human-readable name (e.g., `'FY2026-Q1'`). Unique per vault. */
+    /**
+     * Human-readable name (e.g., `'FY2026-Q1'`). Unique per PARTITION — two
+     * timelines may each carry a `'2026-06'`, which is the normal case when one
+     * vault serves several subjects (#1005). Unique per vault when unpartitioned.
+     */
     readonly name: string;
+    /**
+     * The timeline this period belongs to. Absent = the vault-wide timeline.
+     * Two periods with the same `name` and different `partition` are unrelated:
+     * separate hash chains, separate close state, and the write guard applies
+     * each only to records that resolve to its own tuple.
+     */
+    readonly partition?: PeriodPartition;
     /**
      * Role discriminator. A period is `'closed'` from the moment its
      * `closedAt` is recorded; `'opened'` marks a period whose opening
@@ -261,6 +379,19 @@ export interface PeriodRecord {
     readonly targetsPurgedAt?: string;
     readonly targetsPurgedBy?: string;
     readonly targetsPurged?: readonly TargetPurgeCount[];
+    /** #1022 return-only — collapsed from the `_period_reopens/<key>` append-only
+     *  log on read; NEVER written into the stored `_periods/<name>` record, so a
+     *  reopen cannot disturb the inter-period hash chain. Absent = never reopened.
+     *  `reclosedAt` present (and >= `reopenedAt`) means the window was closed
+     *  again explicitly; `reopenedUntil` in the past means it lapsed on its own.
+     *  Use {@link isEffectivelyReopened} rather than reading these directly. */
+    readonly reopenedAt?: string;
+    readonly reopenedBy?: string;
+    readonly reopenedUntil?: string;
+    readonly reopenReason?: string;
+    readonly reclosedAt?: string;
+    /** How many times this period has been reopened, ever. */
+    readonly reopenCount?: number;
 }
 /** Options for `vault.closePeriod()`. */
 export interface ClosePeriodOptions {
@@ -283,11 +414,32 @@ export interface ClosePeriodOptions {
      * an explicit `dateField`.
      */
     readonly dateField?: string;
+    /**
+     * Close only this timeline (#1005). Omit for the vault-wide timeline.
+     *
+     * ```ts
+     * vault.closePeriod({
+     *   name: '2026-06', endDate: '2026-06-30', dateField: 'issuedAt',
+     *   partition: [clientId, 'vat'],
+     * })
+     * ```
+     *
+     * Which records the resulting seal applies to is decided by the
+     * `subjects` map passed to `withPeriods()` — without one, no record ever
+     * resolves to a partition and a partitioned close seals nothing.
+     */
+    readonly partition?: PeriodPartition;
 }
 /** Options for `vault.openPeriod()`. */
 export interface OpenPeriodOptions<TCollections = Record<string, Record<string, unknown>>> {
     /** Human-readable name for the new period. Must be unique. */
     readonly name: string;
+    /**
+     * The timeline to open in. Must match the partition of `fromPeriod` — a
+     * period cannot chain across timelines, since each carries its own hash
+     * chain (#1005).
+     */
+    readonly partition?: PeriodPartition;
     /** ISO lower bound of the new period (usually prior `endDate + 1 day`). */
     readonly startDate: string;
     /**
@@ -349,7 +501,7 @@ export interface ReadOnlyCollection<T> {
  * @internal — called by Vault methods that need the closed-period
  * cache. Not part of the public API surface.
  */
-export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt: (envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
+export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>): Promise<PeriodRecord[]>;
 /**
  * Given the current ordered period list, pick the last entry that
  * belongs to the hash chain — used as the `priorPeriodHash` anchor
@@ -357,7 +509,7 @@ export declare function loadPeriods(adapter: NoydbStore, vault: string, decrypt:
  *
  * @internal
  */
-export declare function chainAnchor(records: readonly PeriodRecord[]): Promise<{
+export declare function chainAnchor(records: readonly PeriodRecord[], partition?: PeriodPartition): Promise<{
     priorPeriodName?: string;
     priorPeriodHash: string;
 }>;
@@ -382,7 +534,10 @@ export declare function chainAnchor(records: readonly PeriodRecord[]): Promise<{
 export declare function assertTsWritable(existing: {
     ts: string | null;
     record: Record<string, unknown> | null;
-} | null, incomingRecord: Record<string, unknown> | null, closedPeriods: readonly PeriodRecord[]): void;
+} | null, incomingRecord: Record<string, unknown> | null, closedPeriods: readonly PeriodRecord[], scope?: {
+    collection: string;
+    resolve?: PartitionResolver;
+}): void;
 /**
  * Sanity-check a proposed period name + endDate against existing
  * records. Shared by closePeriod / openPeriod so the two pathways
@@ -390,7 +545,7 @@ export declare function assertTsWritable(existing: {
  *
  * @internal
  */
-export declare function validatePeriodName(name: string, existing: readonly PeriodRecord[]): void;
+export declare function validatePeriodName(name: string, existing: readonly PeriodRecord[], partition?: PeriodPartition): void;
 /**
  * Wire a reserved-collection ledger append for a period record. The
  * period itself is stored via the adapter as an encrypted envelope;