@noy-db/hub 0.6.0-pre.2 → 0.6.0-pre.21

package/dist/kernel/merge-authority.d.ts

@@ -0,0 +1,25 @@
+import type { MergeAuthority } from '../port/with/merge-authority.js';
+import type { EnclaveKey } from './enclave/index.js';
+/**
+ * ⚠️ **A client cannot verify what it cannot decrypt** — and that boundary is
+ * stated here rather than hidden.
+ *
+ * A record at a tier this caller holds no key for is accepted **unverified**.
+ * Rejecting it would break replication of data the peer legitimately holds but
+ * this client is not cleared to read, converting a confidentiality boundary
+ * into a replication failure. The residue is narrow: envelopes whose key the
+ * client lacks are pass-through, exactly as every envelope was before #1042.
+ *
+ * Closing that residue needs the vault head (#1044), which can detect absence
+ * and substitution without holding the key.
+ */
+export declare function buildMergeAuthority(
+/**
+ * Just the DEK map, not the whole keyring. `port-layering` refused a type
+ * import of `UnlockedKeyring` from `with-party` — correctly, and the narrower
+ * shape is better anyway: this needs to look up keys, not to know what a
+ * keyring is.
+ */
+keyring: {
+    readonly deks: ReadonlyMap<string, EnclaveKey>;
+}): MergeAuthority;

package/dist/kernel/noydb.d.ts

@@ -1,5 +1,5 @@
-import type { RotateResult } from '../with-party/team/keyring.js';
-import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, PushOptions, PullOptions, SyncStatus, SyncTargetInfo, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy } from './types.js';
+import type { RotateResult, RosterVerifyResult, QuarantineResult } from '../with-party/team/keyring.js';
+import type { NoydbOptions, NoydbEventMap, GrantOptions, RevokeOptions, UpdateUserOptions, UserInfo, PushResult, PullResult, PushOptions, PullOptions, SyncStatus, SyncTargetInfo, SyncTargetStatus, NoydbStore, AccessibleVault, ListAccessibleVaultsOptions, QueryAcrossOptions, QueryAcrossResult, TranslatorAuditEntry, WriteConflict, UserApiFactory, ActiveTier, FactorProofBundle, GateName, VaultPolicy } from './types.js';
 import type { SecretPolicy } from './validation.js';
 import { type CoordinationProvider } from '../port/by/default-provider.js';
 import type { Cover } from '../with-party/directory/cover/types.js';
@@ -282,8 +282,8 @@ export declare class Noydb {
      * collection) pair that was dropped. Re-run `grant()` for those pairs, or
      * they stay locked out.
      *
-     * Unlike `revoke({ rotateKeys: true })`, this call does not REMOVE any
-     * user from the vault — they keep membership and their other collections.
+     * Unlike `revoke()`, this call does not REMOVE any user from the vault —
+     * they keep membership and their other collections.
      * This is the "just rotate" path; "revoke and rotate" lives in `revoke()`.
      *
      * Exposed on Noydb (rather than only on the lower-level keyring
@@ -292,6 +292,23 @@ export declare class Noydb {
      * Opt-in (#267): throws {@link TeamNotEnabledError} without `withTeam()`.
      */
     rotate(vault: string, collections: string[]): Promise<RotateResult>;
+    /**
+     * Verify every `_keyring` file in the vault. Read-only (#1121).
+     *
+     * Names each failing file and why, so the bad one need not be found by trial.
+     * Reports `checked` too: "nothing unverified" is equally true of a sweep that
+     * examined nothing.
+     */
+    verifyRoster(vault: string): Promise<RosterVerifyResult>;
+    /**
+     * Remove a `_keyring` file that cannot be authenticated, and re-key behind it
+     * (#1121). Owner-only; refuses a file that verifies (use {@link revoke}).
+     *
+     * `revoke` consults the target's own `role`, so it cannot act on a file it
+     * will not trust. This ignores every claim the file makes — which is exactly
+     * why it is restricted to files that already fail authentication.
+     */
+    quarantineKeyring(vault: string, userId: string, factors?: FactorProofBundle): Promise<QuarantineResult>;
     /** List all users with access to a vault. */
     listUsers(vault: string): Promise<UserInfo[]>;
     /**
@@ -549,6 +566,12 @@ export declare class Noydb {
     _clearActiveTxContext(ctx: TxContext): void;
     /** Get sync status for a vault. */
     syncStatus(vault: string): SyncStatus;
+    /**
+     * Per-target sync state for `vault` (#1034) — `syncStatus()` reads only the
+     * primary engine, so it cannot express "the LAN store is behind, the cloud
+     * is current". Registration order, primary first. See {@link SyncTargetStatus}.
+     */
+    syncTargetStatus(vault: string): SyncTargetStatus[];
     /**
      * Enumerate the sync targets wired for `vault` (#948) — the primary engine
      * (keyed by vault name) plus any additional targets (keyed `vault::label`

package/dist/kernel/query/builder.d.ts

@@ -309,6 +309,12 @@ export declare class Query<T, S extends keyof T = never, Q extends keyof T & str
     toArray(opts?: {
         locale?: string;
     }): T[];
+    /**
+     * Joins need a `JoinContext`. Unreachable in practice — `.join()` throws
+     * when one is missing — but belt-and-braces for a plan built through the
+     * raw `Query` constructor with joins pre-populated.
+     */
+    private requireJoinContext;
     /**
      * Decode this source's Via-covered fields on read (e.g. money: stored
      * scaled-int → canonical decimal), so `query().toArray()` agrees with
@@ -330,12 +336,19 @@ export declare class Query<T, S extends keyof T = never, Q extends keyof T & str
     }): T | null;
     /**
      * Return the number of matching records (after where/filter,
-     * before limit). **Joins are NOT applied** — count() reports the
-     * left-side cardinality, because joins in are projection-only
+     * before limit). **Joins are normally NOT applied** — count() reports the
+     * left-side cardinality, because joins are projection-only
      * (they attach an aliased field; they never filter). Running joins
      * here just to discard the aliases would be wasteful, and in strict
      * mode it could throw `DanglingReferenceError` for a call whose
      * intent is purely to count.
+     *
+     * The exception (#1030) is a `where` clause addressing a join alias. Then
+     * the legs must run, because the predicate is part of what is being
+     * counted — skipping them would report the unfiltered left cardinality.
+     * A strict-mode `DanglingReferenceError` becomes reachable from `count()`
+     * in exactly that case, which is acceptable: the caller asked to filter on
+     * the joined side, so they asked for the join.
      */
     count(): number;
     /**

package/dist/kernel/query/join.d.ts

@@ -45,6 +45,7 @@
  * including joined reads.
  */
 import type { RefDescriptor, RefMode } from '../refs.js';
+import type { Clause } from './predicate.js';
 /** Planner strategy for a single join leg. Auto-selected unless overridden. */
 export type JoinStrategy = 'hash' | 'nested';
 /** Default per-side row ceiling before `.join()` throws `JoinTooLargeError`. */
@@ -168,6 +169,32 @@ export interface JoinContext {
      */
     resolveDictSource?(field: string): JoinableSource | null;
 }
+/**
+ * Split a plan's clauses into those evaluable before the join legs run and
+ * those that need the joined shape (#1030).
+ *
+ * Join legs attach after `where` so the left set can be narrowed (and
+ * index-driven) first. That is the right default, but it silently broke any
+ * predicate addressing a joined alias: the field did not exist yet, so
+ * `readPath` returned `undefined`, nothing matched, and the query returned an
+ * empty result with no error.
+ *
+ * The split is deliberately narrow. When no clause addresses an alias — every
+ * query written against the previous behaviour — `postJoin` is empty and the
+ * caller takes its original path unchanged. The reordered pipeline therefore
+ * only ever runs for queries that match nothing today.
+ *
+ * KNOWN RESIDUAL: `.filter(r => r.client?.name === 'Ann')` cannot be
+ * classified (the predicate is a closure), so it still runs pre-join and still
+ * sees no alias. Prefer `.where()` for anything addressing a joined field.
+ *
+ * Shared by the eager `Query` and the streaming `ScanBuilder` so the two
+ * cannot drift on which side a clause belongs to.
+ */
+export declare function splitAroundJoins(clauses: readonly Clause[], joins: readonly JoinLeg[]): {
+    readonly preJoin: readonly Clause[];
+    readonly postJoin: readonly Clause[];
+};
 /**
  * Apply every join leg in the plan against a base set of left-side
  * rows. Called by the query executor after `where` / `orderBy` /

package/dist/kernel/sync-policy.d.ts

@@ -119,8 +119,6 @@ export interface SyncPolicy {
 export declare const INDEXED_STORE_POLICY: SyncPolicy;
 /** Default for bundle stores (Drive, WebDAV, Git). */
 export declare const POD_STORE_POLICY: SyncPolicy;
-/** @deprecated Use `POD_STORE_POLICY`. */
-export declare const BUNDLE_STORE_POLICY: SyncPolicy;
 /**
  * Current operational state of the `SyncScheduler`.
  *

package/dist/kernel/tier-visibility.d.ts

@@ -52,3 +52,18 @@ export declare function assertTierWritable(adapter: NoydbStore, vault: string, n
  * explicit for concurrent writes generally.
  */
 export declare function assertCutoverTierSafe(adapter: NoydbStore, vault: string, name: string, tiersEnabled: boolean): Promise<void>;
+/**
+ * The key a collection's DEK is stored under in `UnlockedKeyring.deks` for a
+ * given tier: `collection` at tier 0, `collection#N` above it.
+ *
+ * Lives in the kernel because the `deks` map is a kernel type and the kernel
+ * reads it — `noydb.ts` needs this to resolve the right DEK when verifying a
+ * pulled envelope (#1042). `with-party/team/tiers.ts` re-exports it, so every
+ * existing importer is unchanged; the definition simply moved to the layer that
+ * owns the map rather than one that happens to use it.
+ *
+ * This move was forced by `port-layering`, and rightly: the alternative was the
+ * kernel spine statically importing a `with-*` service, or duplicating the
+ * naming convention in two places where it could drift.
+ */
+export declare function dekKey(collection: string, tier: number): string;

package/dist/kernel/types.d.ts

@@ -34,6 +34,7 @@ import type { PeriodsStrategy } from '../with-audit/periods/strategy.js';
 import type { ShadowStrategy } from '../with-fork/shadow/strategy.js';
 import type { TransactionsStrategy } from '../with-commit/tx/strategy.js';
 import type { HistoryStrategy } from '../with-commit/history/strategy.js';
+import type { VaultHeadStrategy } from '../with-commit/vault-head/strategy.js';
 import type { ForgetStrategy } from '../with-audit/forget/strategy.js';
 import type { SnapshotsStrategy } from '../with-fork/snapshots/strategy.js';
 import type { DerivationSkippedFrozen } from './via/dispatch.js';
@@ -908,6 +909,21 @@ export interface KeyringFile {
     readonly role: Role;
     readonly permissions: Permissions;
     readonly deks: Record<string, string>;
+    /**
+     * DEKs for a rotation that has STARTED but not committed (#1074).
+     *
+     * `rotateKeys` persists the new DEK here *before* rewriting any record, so an
+     * interruption can never strand records under a key that was only ever in
+     * memory. On commit these move into `deks` and this is cleared.
+     *
+     * Present on disk ⇒ a rotation was interrupted and the collection may hold
+     * records on both sides of the migration. Re-running `rotateKeys` resumes
+     * with this key rather than minting a fresh one.
+     *
+     * Optional: absent on every keyring written before this existed, and absent
+     * in the normal committed state.
+     */
+    readonly pending_deks?: Record<string, string>;
     readonly salt: string;
     readonly created_at: string;
     readonly granted_by: string;
@@ -915,17 +931,31 @@ export interface KeyringFile {
      * Secret canary — base64 AES-KW-wrapped form of a known constant
      * 256-bit value, wrapped under the keyring's KEK.
      *
-     * Optional: older keyrings load with no canary and fall back to
-     * the multi-DEK corruption heuristic. Newer keyrings
-     * carry one and let `loadKeyring` distinguish wrong-secret
-     * from corruption even when ALL DEKs (including a single-DEK keyring's
-     * sole DEK) are corrupted.
+     * Lets `loadKeyring` distinguish wrong-secret from corruption even when
+     * ALL DEKs (including a single-DEK keyring's sole DEK) are corrupted: the
+     * canary unwrapping proves the KEK correct independent of any DEK byte.
      *
      * AES-KW is deterministic — every write site mints fresh on each
      * persist; same KEK + same constant input always produces the same
      * ciphertext, so this round-trips without state.
+     *
+     * REQUIRED as of #1096 (no-legacy policy): the pre-canary fallback
+     * heuristic is deleted, so an absent canary is not an old file, it is a
+     * store that stripped the field — `KeyringTamperedError('canary-missing')`.
      */
-    readonly canary?: string;
+    readonly canary: string;
+    /**
+     * #1096 — AES-GCM({iv,data}) of the canonical authority fields
+     * (user_id, role, permissions, granted_by, expires_at, capabilities)
+     * under the vault roster key (carried as `deks[ROSTER_KEY_ID]`).
+     * Required: a valid canary with a missing or mismatching tag is refused
+     * as KeyringTamperedError — absence must itself be an error, or a store
+     * opts out of verification by deleting a plaintext field.
+     */
+    readonly roster_tag: {
+        readonly iv: string;
+        readonly data: string;
+    };
     /**
      * Tier-2 authenticator slots (multi-slot keyring extension).
      * Optional / append-only: keyring files written before the
@@ -956,7 +986,7 @@ export interface KeyringFile {
      * "this slot works for 30 days then becomes opaque to its holder."
      *
      * Absent on live keyrings written via `db.grant()` — the field is
-     * meaningful for `BundleRecipient` slots produced by
+     * meaningful for `PodRecipient` slots produced by
      * `writePod({ recipients: [...] })`. Setting it on a live
      * keyring is allowed but unusual.
      */
@@ -1284,9 +1314,38 @@ export interface SyncTransactionResult {
 }
 export interface SyncStatus {
     readonly dirty: number;
+    /**
+     * ISO 8601 timestamp of the last push that completed with **no errors**, or
+     * `null` if none ever has (#1036). A failed attempt does not advance it — so
+     * this answers "when did my data last reach the remote?", which is the reading
+     * the name invites and the one the field previously did not honour.
+     */
     readonly lastPush: string | null;
+    /** As {@link SyncStatus.lastPush}, for pulls: last pull that had no errors. */
     readonly lastPull: string | null;
+    /**
+     * Whether the **browser** reports network connectivity — driven solely by the
+     * global `online`/`offline` events (#1034). It is NOT target reachability: an
+     * unreachable store never flips it, and losing Wi-Fi flips it for every target
+     * at once. To detect a failing target, read {@link SyncStatus.lastError}.
+     */
     readonly online: boolean;
+    /**
+     * The failure that ended the most recent push/pull, cleared by the next
+     * success (#1036). **Absent** when nothing has failed since the last success —
+     * so `lastPush: null` with no `lastError` means "never synced", while
+     * `lastPush` set plus a `lastError` means "synced then, failing since".
+     *
+     * Live state, not persisted: a reload cannot know whether the target still
+     * fails, so it starts absent until the next attempt says otherwise.
+     */
+    readonly lastError?: {
+        /** ISO 8601 timestamp of the failed attempt. */
+        readonly at: string;
+        readonly op: 'push' | 'pull';
+        /** Message of the first error the attempt collected. */
+        readonly message: string;
+    };
     /**
      * Per-collection readiness under a `'phased'` pull policy (#809). **Absent**
      * for every other policy, and a collection the sequence never names is absent
@@ -1329,6 +1388,41 @@ export interface SyncTarget {
  * (#948). Deliberately omits any preset *name* — a resolved `SyncPolicy` doesn't
  * retain which preset (if any) it came from, so only its push/pull mode is surfaced.
  */
+/**
+ * Per-target sync state (#1034). `syncStatus()` answers for the vault as a
+ * whole; this answers per target, which is what a redundant topology needs in
+ * order to say "the LAN store is unavailable — syncing via the cloud" rather
+ * than just "something is wrong".
+ *
+ * Deliberately carries **no `online` flag.** `SyncStatus.online` reflects the
+ * *browser's* global connectivity — it is set only by the `online`/`offline`
+ * window events and no store outcome ever changes it, so every engine flips at
+ * once for the same reason. Exposing it per target would make a global signal
+ * look per-target: a status list would appear to update row by row while every
+ * row actually moved together. Per-target *reachability* derived from real
+ * store outcomes is a separate, still-unbuilt thing.
+ */
+export interface SyncTargetStatus {
+    /** As registered. `undefined` when the target was declared without one. */
+    readonly label: string | undefined;
+    readonly role: SyncTargetRole;
+    /** Pending local writes for this target. */
+    readonly dirty: number;
+    /** Last push that completed with no errors, or `null`. See {@link SyncStatus.lastPush}. */
+    readonly lastPush: string | null;
+    /** Last pull that completed with no errors, or `null`. */
+    readonly lastPull: string | null;
+    /**
+     * Nothing queued for this target — `dirty === 0`.
+     *
+     * Well-defined for every role: for a `sync-peer` it means the two sides
+     * agree as of the last exchange; for a push-only `backup` it means every
+     * local write has reached it. It is a statement about the *outbound* queue
+     * only, and says nothing about whether the target holds data this client has
+     * not pulled.
+     */
+    readonly caughtUp: boolean;
+}
 export interface SyncTargetInfo {
     readonly label: string | undefined;
     readonly role: SyncTargetRole;
@@ -1544,7 +1638,6 @@ export interface UpdateUserOptions {
 }
 export interface RevokeOptions {
     readonly userId: string;
-    readonly rotateKeys?: boolean;
     /**
      * Cascade behavior when the revoked user is an admin who has granted
      * other admins.
@@ -1868,10 +1961,10 @@ export interface CrdtStrategy {
  * that operate on whole-vault bundles rather than per-record KV.
  *
  * Implement `readBundle` / `writeBundle` instead of the six-method KV
- * contract. Use `wrapBundleStore()` from `@noy-db/hub` to convert to a
+ * contract. Use `wrapPodStore()` from `@noy-db/hub` to convert to a
  * `NoydbStore` that the rest of the API consumes transparently.
  *
- * Named `NoydbPodStore` (not `NoydbBundleAdapter`) for consistency
+ * Named `NoydbPodStore` for consistency
  * with the hub / to-* / in-* rename. Concrete implementations ship
  * in `@noy-db/to-*` packages starting in.
  */
@@ -1907,8 +2000,6 @@ export interface NoydbPodStore {
         size: number;
     }>>;
 }
-/** @deprecated Use `NoydbPodStore`. */
-export type NoydbBundleStore = NoydbPodStore;
 /**
  * Content-addressed blob object stored in the vault-level blob index.
  * Identified by HMAC-SHA-256(blobDEK, plaintext) — opaque to the store.
@@ -2354,6 +2445,13 @@ export interface NoydbOptions {
      * @internal
      */
     readonly historyStrategy?: HistoryStrategy;
+    /**
+     * #1044 — opt in to the vault head, which detects a store that WITHHOLDS.
+     * `withVaultHead()` from `@noy-db/hub/vault-head`. Costs one small write per
+     * commit; on a single-device offline vault it defends against nothing, which
+     * is why it is opt-in while AAD is not.
+     */
+    readonly vaultHeadStrategy?: VaultHeadStrategy;
     /**
      * GDPR right-to-erasure. Pass `withForget({ subjects })`
      * from `@noy-db/hub/forget` to declare which collections carry erasable
@@ -2516,6 +2614,41 @@ export interface NoydbOptions {
      * without a gated source instance and stay ungated.
      */
     readonly cargoStrategy?: CargoStrategy;
+    /**
+     * @deprecated renamed to `blobsStrategy` (#873).
+     *
+     * Declared as `never` on purpose — see the block note below.
+     */
+    readonly blobStrategy?: never;
+    /**
+     * @deprecated renamed to `indexingStrategy` (#873).
+     *
+     * Declared as `never` on purpose — see the block note below.
+     */
+    readonly indexStrategy?: never;
+    /**
+     * @deprecated renamed to `transactionsStrategy` (#873).
+     *
+     * Declared as `never` on purpose — see the block note below.
+     */
+    readonly txStrategy?: never;
+    /**
+     * @deprecated renamed to `reduceStrategy` (#873).
+     *
+     * The four keys above are the `#873` strategy-key renames, carried as
+     * unusable `never` slots rather than simply deleted (#993).
+     *
+     * An ABSENT key is answered by TypeScript's excess-property check with the
+     * nearest known key by edit distance, so `txStrategy` was reported as "Did
+     * you mean to write `crdtStrategy`?" — a suggestion that silently enables a
+     * CRDT strategy for a caller who trusts it. A DECLARED `never` key matches
+     * exactly, so the compiler surfaces the `@deprecated` line naming the real
+     * replacement instead of guessing.
+     *
+     * One release of carry; drop with the rest of the 0.4.0-pre compatibility
+     * surface.
+     */
+    readonly aggregateStrategy?: never;
     /**
      * Optional guard strategies — collection-level write guards. Each
      * handle is the output of `withGuard()` from `@noy-db/hub/guards`.

package/dist/kernel/vault.d.ts

@@ -6,7 +6,7 @@ import type { IssueDelegationOptions, DelegationToken } from '../with-party/team
 import { Collection } from './collection.js';
 import type { JoinableSource } from './query/index.js';
 import type { OnDirtyCallback } from './collection.js';
-import type { UnlockedKeyring, BundleRecipient } from '../with-party/team/keyring.js';
+import type { UnlockedKeyring, PodRecipient } from '../with-party/team/keyring.js';
 import type { MaterializedViewRegistry } from '../with-formula/materialized-views/registry.js';
 import type { MaterializedViewStrategy } from '../with-formula/materialized-views/types.js';
 import type { OverlayedViewRegistry } from '../with-formula/overlay-views/registry.js';
@@ -29,6 +29,7 @@ import { type ForgetResult } from '../with-audit/forget/strategy.js';
 import { type SubjectRef } from '../with-audit/forget/subject-index.js';
 import type { VaultFrame } from '../with-fork/shadow/vault-frame.js';
 import type { ConsentContext, ConsentAuditEntry, ConsentAuditFilter, ConsentOp } from '../with-audit/consent/consent.js';
+import { type PeriodScope, type PeriodGuardPrior, type ReopenPeriodOptions, type PeriodScopeWithReason } from '../with-audit/periods/vault-facade.js';
 import { type RefDescriptor, type RefViolation } from './refs.js';
 import type { DictionaryHandle, DictionaryOptions } from '../port/with/i18n-strategy.js';
 import { type LinkSpec, type LinkSetHandle } from '../with-shape/links/names.js';
@@ -41,7 +42,7 @@ import type { DerivationRegistry } from '../with-formula/derivations/registry.js
 import type { DerivationStrategy } from '../with-formula/derivations/types.js';
 import { type BehaviorSummary } from '../with-shape/introspection/behaviors.js';
 import type { JoinedHandle } from '../with-shape/satellites/types.js';
-import { type PeriodRecord, type ClosePeriodOptions, type OpenPeriodOptions } from '../with-audit/periods/index.js';
+import { type PeriodRecord, type PeriodReopenEvent, type ClosePeriodOptions, type OpenPeriodOptions } from '../with-audit/periods/index.js';
 import { type EnclaveKey } from './enclave/index.js';
 import type { RecipientSealer } from '../with-party/team/managed-secret.js';
 import { type ExportBlobsOptions, type ExportBlobsHandle } from '../with-shape/blobs/export-blobs.js';
@@ -335,7 +336,7 @@ export declare class Vault {
      * unblocks R-S7 when a base gains forget coverage after its satellite was
      * already declared without `perRecordKeys`. Call BEFORE re-declaring with
      * `{ satelliteOf, perRecordKeys: true }` AND before this collection serves
-     * writes (unfenced walk — see {@link migrateSatelliteCek}); resumable.
+     * writes (unfenced walk — see `with-shape/satellites/migrate-cek.ts`); resumable.
      */
     migrateSatellitePerRecordKeys(satelliteName: string): Promise<{
         migrated: number;
@@ -573,7 +574,7 @@ export declare class Vault {
      *
      * @public
      */
-    buildBundleRecipientKeyrings(recipients: readonly BundleRecipient[]): Promise<Record<string, KeyringFile>>;
+    buildBundleRecipientKeyrings(recipients: readonly PodRecipient[]): Promise<Record<string, KeyringFile>>;
     /**
      * Authorize an `@noy-db/as-*` export against the current keyring's
      * `exportCapability`. Throws `ExportCapabilityError` if
@@ -744,7 +745,7 @@ export declare class Vault {
      *
      * @internal
      */
-    _decryptEnvelopeForBundleFilter(env: EncryptedEnvelope, collectionName: string): Promise<unknown>;
+    _decryptEnvelopeForBundleFilter(env: EncryptedEnvelope, collectionName: string, recordId: string): Promise<unknown>;
     /**
      * Read-only accessor for the invoking keyring's import capability
      * (issue ). UI affordance — returns false in every default-closed
@@ -1236,10 +1237,10 @@ export declare class Vault {
      * both closed and opened entries in `closedAt` order.
      */
     openPeriod<TCollections extends Record<string, Record<string, unknown>>>(options: OpenPeriodOptions<TCollections>): Promise<PeriodRecord>;
-    /** Return every closed / opened period in `closedAt` order. */
-    listPeriods(): Promise<readonly PeriodRecord[]>;
-    /** Look up a single period by name. Returns `null` if not found. */
-    getPeriod(name: string): Promise<PeriodRecord | null>;
+    /** Every closed / opened period in `closedAt` order; ALL timelines unless `{ partition }` scopes it (#1005). */
+    listPeriods(options?: PeriodScope): Promise<readonly PeriodRecord[]>;
+    /** One period by name within a timeline (vault-wide unless `{ partition }`). `null` if not found. */
+    getPeriod(name: string, options?: PeriodScope): Promise<PeriodRecord | null>;
     /**
      * Freeze a closed period (#604): purges in-window delete markers and
      * records a `_period_freezes` companion, never mutating the chained
@@ -1248,7 +1249,7 @@ export declare class Vault {
      * and purging re-opens the #589 resurrection window for a peer offline
      * since before the cutoff (see periods.ts's "Freeze" section).
      */
-    freezePeriod(name: string): Promise<PeriodRecord>;
+    freezePeriod(name: string, options?: PeriodScope): Promise<PeriodRecord>;
     /**
      * Archive a closed period (#613): relocates its in-window records from the
      * hot store to the configured cold tier (via the routeStore's cold route),
@@ -1256,7 +1257,7 @@ export declare class Vault {
      * the chained `_periods` record. Non-destructive (reads fall through to
      * cold) and idempotent. Requires a routeStore with a cold route.
      */
-    archivePeriod(name: string): Promise<PeriodRecord>;
+    archivePeriod(name: string, options?: PeriodScope): Promise<PeriodRecord>;
     /**
      * Target-purge a closed+frozen period (#615): sweeps delete markers off the
      * vault's push-only sync targets (`backup`/`archive`), recording a
@@ -1265,12 +1266,15 @@ export declare class Vault {
      * frozen first. Idempotent; a vault with no push-only targets writes no
      * companion and is re-runnable.
      */
-    purgePeriodTargets(name: string): Promise<PeriodRecord>;
+    purgePeriodTargets(name: string, options?: PeriodScope): Promise<PeriodRecord>;
+    /** Return a closed period to writable (#1022); logged append-only, close chain untouched. */
+    reopenPeriod(name: string, options?: ReopenPeriodOptions): Promise<PeriodRecord>;
+    /** Seal a reopened period again (#1022) rather than waiting for its `until` to lapse. */
+    reclosePeriod(name: string, options?: PeriodScopeWithReason): Promise<PeriodRecord>;
+    /** The append-only reopen/reclose log for one period (#1022), in order. */
+    listPeriodReopens(name: string, options?: PeriodScope): Promise<readonly PeriodReopenEvent[]>;
     /** @internal — called by the gate bus before put/delete. */
-    _assertTsWritable(existing: {
-        ts: string | null;
-        record: Record<string, unknown> | null;
-    } | null, incoming: Record<string, unknown> | null): Promise<void>;
+    _assertTsWritable(existing: PeriodGuardPrior | null, incoming: Record<string, unknown> | null, collection?: string): Promise<void>;
     /** List all collection names in this vault. */
     collections(): Promise<string[]>;
     /**
@@ -1344,12 +1348,12 @@ export declare class Vault {
      * distinct handles, which is the right behavior — they're
      * separate vault instances now.
      */
-    getBundleHandle(): Promise<string>;
+    getPodHandle(): Promise<string>;
     /**
      * Read the owner-curated cover for this vault (or `undefined` if
      * none is persisted). The cover lives in `_meta/public-envelope`
      * (the frozen wire name) as plaintext — readable without any KEK
-     * — so `getBundleHandle`-style callers can label a vault before
+     * — so `getPodHandle`-style callers can label a vault before
      * unlock.
      *
      * Mirrors `Noydb.getCover(vault, opts)` but scoped to a

package/dist/kernel/via/index.d.ts

@@ -47,8 +47,17 @@ export interface ViaCryptoCtx {
         delete(field: string): Promise<void>;
     };
     reservedEnvelopes(prefix: string): {
-        encrypt(collection: string, json: string, v: number): Promise<EncryptedEnvelope>;
-        decrypt(collection: string, env: EncryptedEnvelope): Promise<string>;
+        /**
+         * `id` is the record id the envelope will be stored under. Required
+         * (#1051) because this function holds the DEK, so it is where record-identity
+         * AAD is applied — a caller that cannot name the id cannot be bound.
+         */
+        encrypt(identity: {
+            readonly collection: string;
+            readonly id: string;
+            readonly by?: string;
+        }, json: string, v: number): Promise<EncryptedEnvelope>;
+        decrypt(collection: string, id: string, env: EncryptedEnvelope): Promise<string>;
     };
 }
 /** Per-call erase context — `forget()`'s per-ref participation door (phase C). */

package/dist/{ledger-4WJL66BW.js → ledger-MVPNG5OS.js}

@@ -3,7 +3,7 @@ import {
   LedgerStore,
   applyPatch,
   computePatch
-} from "./chunk-NIVEDYJZ.js";
+} from "./chunk-4A34KWOU.js";
 import {
   LEDGER_COLLECTION,
   LEDGER_DELTAS_COLLECTION
@@ -15,16 +15,16 @@ import {
   paddedIndex,
   parseIndex,
   sha256Hex
-} from "./chunk-VW6ZZGCG.js";
-import "./chunk-VN45YLWM.js";
-import "./chunk-NWCGDAV6.js";
-import "./chunk-HXGUIPQB.js";
-import "./chunk-AR2JDFAE.js";
-import "./chunk-747LRSOO.js";
+} from "./chunk-ZLHHE5XZ.js";
+import "./chunk-OHOKBMTM.js";
+import "./chunk-PENPHA45.js";
+import "./chunk-GQXFOAYZ.js";
+import "./chunk-KV6JM2IA.js";
+import "./chunk-TMBSPLUG.js";
 import "./chunk-LP7BEXCT.js";
-import "./chunk-VCETL77O.js";
-import "./chunk-W5W6KHN2.js";
-import "./chunk-HNGSV2YC.js";
+import "./chunk-AU3AUJIZ.js";
+import "./chunk-IGNJOJEP.js";
+import "./chunk-CWM4GQD2.js";
 import "./chunk-PZ5AY32C.js";
 export {
   LEDGER_COLLECTION,
@@ -39,4 +39,4 @@ export {
   parseIndex,
   sha256Hex
 };
-//# sourceMappingURL=ledger-4WJL66BW.js.map
+//# sourceMappingURL=ledger-MVPNG5OS.js.map

package/dist/liberate-4LOJOLDT.js

@@ -0,0 +1,24 @@
+import {
+  liberateVault
+} from "./chunk-HQSPF5IY.js";
+import "./chunk-5Q7AJ7DN.js";
+import "./chunk-GBBDFE6C.js";
+import "./chunk-OTHHO3KI.js";
+import "./chunk-QSIEL6TL.js";
+import "./chunk-S56VYR4Q.js";
+import "./chunk-CAGI4LLJ.js";
+import "./chunk-LX46B56Q.js";
+import "./chunk-OHOKBMTM.js";
+import "./chunk-PENPHA45.js";
+import "./chunk-GQXFOAYZ.js";
+import "./chunk-KV6JM2IA.js";
+import "./chunk-TMBSPLUG.js";
+import "./chunk-LP7BEXCT.js";
+import "./chunk-AU3AUJIZ.js";
+import "./chunk-IGNJOJEP.js";
+import "./chunk-CWM4GQD2.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  liberateVault
+};
+//# sourceMappingURL=liberate-4LOJOLDT.js.map