@noy-db/hub 0.6.0-pre.8 → 0.6.0

package/dist/chunk-5ATC6UT4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/periods/periods.ts","../src/with-audit/periods/active.ts","../src/with-audit/periods/strategy.ts"],"sourcesContent":["/**\n * Accounting-period closure + opening.\n *\n * A closed period seals every record whose envelope `_ts` is at or\n * before the period's `endDate`: further writes (`put` / `delete`)\n * against such records throw {@link PeriodClosedError}. The period\n * itself is stored as a record in the reserved `_periods` collection\n * and written through the normal ledger-instrumented path, so every\n * closure appends a tamper-evident entry to the vault's hash chain.\n *\n * ## Closure model\n *\n * ```\n * vault.closePeriod({ name: 'FY2026-Q1', endDate: '2026-03-31' })\n *   └─► PeriodRecord written to _periods/<name>\n *         ├─ priorPeriodName / priorPeriodHash — chain to last close\n *         ├─ closedAt / closedBy — provenance\n *         └─ normal ledger append fires (LedgerStore.append)\n * ```\n *\n * Enforcement (`assertTsWritable`) is vault-local: the Vault caches\n * the list of closed periods on first read and consults that cache in\n * the `Collection.put` / `.delete` path via the `periodGuard` hook.\n *\n * ## Opening model\n *\n * ```\n * vault.openPeriod({\n *   name: 'FY2026-Q2',\n *   startDate: '2026-04-01',\n *   fromPeriod: 'FY2026-Q1',\n *   carryForward: async (priorView) => Record<string, Record<string, unknown>>,\n * })\n * ```\n *\n * `carryForward` receives a read-only `VaultInstant` anchored at the\n * prior period's `endDate` (built via `vault.at(endDate)`) so the\n * callback can compute closing aggregates from the sealed state. The\n * returned `{ [collectionName]: { [id]: record } }` map is written\n * before the new `PeriodRecord` lands — opening balances materialise\n * as normal records with fresh timestamps that fall outside every\n * closed period.\n *\n * ## Freeze\n *\n * ```\n * vault.freezePeriod('FY2026-Q1')\n *   └─► physically purges delete markers whose write-time falls inside\n *       the closed period's window (via the #589 `_purgeDeleteMarkers`\n *       seam), then records the fact:\n *         ├─ PeriodFreezeRecord written to _period_freezes/<name>\n *         └─ normal ledger append fires (LedgerStore.append)\n * ```\n *\n * The chained `_periods/<name>` record is never mutated — `frozenAt` /\n * `frozenBy` / `purgedMarkerCount` are merged onto the returned\n * `PeriodRecord` at read time from the companion, so a tamper with the\n * freeze can never break the inter-period hash chain. Freezing is\n * terminal (a closed period, once frozen, stays frozen) and idempotent\n * (a second call is a no-op that returns the same merged record without\n * re-purging or re-appending a ledger entry). Freeze does NOT purge\n * forget-tombstones (GDPR crypto-shred erasure evidence), `_history`\n * versions, or live records — the delete-markers-only seam leaves all\n * three untouched by construction.\n *\n * Freeze purges the LOCAL adapter only. On a synced vault, markers already\n * pushed to sync targets survive there, and a later pull re-imports them\n * (benign — they still read deleted, but the space isn't reclaimed). A\n * re-imported marker keeps its original `_ts` (inside the already-frozen\n * period's window), so — like any late-booked delete — it is reclaimed by\n * the NEXT period's freeze, whose window covers it; freeze stays terminal\n * and does NOT re-purge an already-frozen period (#611). Sweeping the sync\n * targets themselves is a cross-target-purge concern deferred to the\n * cold-archival spec. Purging re-opens the #589 resurrection window for a\n * peer offline since before the cutoff, which is why the closed period is\n * the operator-asserted safe-point that gates the call.\n *\n * A period whose purge window has not fully elapsed cannot be frozen —\n * `freezePeriod` throws rather than purge markers for deletes that may not\n * have converged yet (#610).\n *\n * ## Archive\n *\n * ```\n * vault.archivePeriod('FY2026-Q1')\n *   └─► relocates the closed period's in-window records (those with\n *       `_ts < periodExclusiveUpperBound(endDate)`) from the hot store to\n *       the configured cold tier (routeStore's `cold` route), then records:\n *         ├─ PeriodArchiveRecord written to _period_archives/<name>\n *         └─ a ledger entry attributed to _period_archives\n * ```\n *\n * Archival is NON-DESTRUCTIVE: routeStore reads fall through to the cold\n * tier on a hot miss, so an archived record still reads normally. It is\n * therefore gated only on `closed` (not `frozen`) — it does not re-open the\n * #589 resurrection window and needs no convergence safe-point. Freeze\n * (purge markers) and archive (relocate records) are independent and compose\n * in either order. Like freeze, archival keeps the chained `_periods/<name>`\n * record byte-immutable (state lives in the companion) and is idempotent.\n *\n * Bounds by write-time `_ts`, NOT business date: the store tier sees only\n * encrypted envelopes. A record with an in-period business date but a later\n * `_ts` (late-booked) archives at the NEXT period's archive — the same rule\n * freeze uses for late-booked delete markers. Requires a `routeStore` with a\n * cold route (`age: { cold }`); throws otherwise.\n *\n * Read cost: with `withLazy()` (per-id reads) archived records are truly\n * cold — fetched from cold only on access. In the default hydrated mode,\n * `loadAll` merges the cold store, so archived records still load into RAM\n * on vault open (hot-tier STORAGE is reclaimed; RAM is not). Summaries\n * (`_`-prefixed) always stay hot.\n *\n * ## Target-purge\n *\n * ```\n * vault.purgePeriodTargets('FY2026-Q1')\n *   └─► sweeps delete markers (`_ts < periodExclusiveUpperBound(endDate)`) off\n *       the vault's PUSH-ONLY sync targets (backup/archive roles), then records:\n *         ├─ PeriodTargetPurgeRecord written to _period_target_purges/<name>\n *         └─ a ledger entry attributed to _period_target_purges\n * ```\n *\n * Extends freeze's local marker purge to the vault's own remote sinks.\n * `sync-peer` (bidirectional) targets are SKIPPED: purging a marker there\n * re-opens the #589 resurrection window for a client offline before the\n * cutoff, an assertion no single vault can verify. Backup/archive targets are\n * push-only — never pulled from into convergence — so sweeping their markers\n * is safe. Requires the period be frozen first (closed → frozen →\n * target-purged) so the local safe-point is already established. Idempotent\n * once run; a vault with no push-only targets writes no companion and is\n * re-runnable (so a target added later is still swept). Single-vault only —\n * fleet-wide purge across sovereign vaults is klum's concern over\n * `@noy-db/hub/cargo`.\n *\n * ## Not covered\n *\n * - Partial re-opening of a closed period. If an auditor needs to\n *   make a correction inside a sealed period, the sanctioned path is\n *   a compensating entry in the NEW period, not an unlock of the\n *   old one.\n * - Automatic period rollover. `closePeriod` / `openPeriod` are\n *   deliberately explicit operator calls so the caller decides when\n *   the boundary lands.\n *\n * @module\n */\n\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { LedgerStore } from '../../with-commit/history/ledger/index.js'\nimport { sha256Hex, canonicalJson } from '../../with-commit/history/ledger/index.js'\nimport { isDeleteMarker } from '../../kernel/enclave/index.js'\nimport { PeriodClosedError, ValidationError } from '../../kernel/errors.js'\n\n// The reserved collection names + `periodExclusiveUpperBound` moved to the\n// dependency-light `window.ts` so the sync engine's period-scoped pull (#807)\n// can import them without this module's ledger imports; re-exported here so\n// every existing import path keeps working.\nexport {\n  PERIODS_COLLECTION,\n  PERIOD_FREEZES_COLLECTION,\n  PERIOD_ARCHIVES_COLLECTION,\n  PERIOD_TARGET_PURGES_COLLECTION,\n  PERIOD_REOPENS_COLLECTION,\n  periodExclusiveUpperBound,\n} from './window.js'\nimport { PERIODS_COLLECTION } from './window.js'\n\n/**\n * Companion record recording that a closed period was frozen (its delete\n * markers physically purged). Stored in {@link PERIOD_FREEZES_COLLECTION},\n * keyed by period name — kept OFF the hash-chained `_periods/<name>` record so\n * freeze never alters the inter-period chain.\n */\nexport interface PeriodFreezeRecord {\n  readonly period: string\n  readonly frozenAt: string\n  readonly frozenBy: string\n  readonly purgedMarkerCount: number\n}\n\n/**\n * Companion record noting that a closed period was cold-archived (its\n * in-window records physically relocated hot → cold). Stored in\n * {@link PERIOD_ARCHIVES_COLLECTION}, keyed by period name — kept OFF the\n * hash-chained `_periods/<name>` record so archive never alters the chain.\n */\nexport interface PeriodArchiveRecord {\n  readonly period: string\n  readonly archivedAt: string\n  readonly archivedBy: string\n  readonly archivedRecordCount: number\n}\n\n/** Per-target count of delete markers purged off one push-only sync target (#615). */\nexport interface TargetPurgeCount {\n  readonly label?: string\n  readonly role: 'backup' | 'archive'\n  readonly purgedCount: number\n}\n\n/**\n * One entry in a period's append-only reopen/reclose log (#1022).\n *\n * Real accounting close is a three-state lifecycle — open / closed / reopened\n * — not a one-way door. A month gets closed, a missing invoice arrives or a\n * filing is rejected, the month is reopened, corrected, and reclosed. The audit\n * value is not the ability to write again; it is the chain being able to say\n * *closed at T1, reopened at T2 by U, reclosed at T3*.\n */\nexport interface PeriodReopenEvent {\n  readonly op: 'reopen' | 'reclose'\n  /** ISO timestamp the event was recorded. */\n  readonly at: string\n  /** userId of the keyring that performed it. */\n  readonly by: string\n  /**\n   * `reopen` only — ISO instant after which the period re-seals on its own,\n   * with nobody acting. Absent means the window stays open until an explicit\n   * `reclosePeriod`.\n   */\n  readonly until?: string\n  /** Free-text justification, carried verbatim into the audit trail. */\n  readonly reason?: string\n}\n\n/**\n * Companion holding a period's reopen/reclose history (#1022). Stored in\n * {@link PERIOD_REOPENS_COLLECTION}, keyed by the period's storage key — kept\n * OFF the hash-chained `_periods/<name>` record for the same reason freeze and\n * archive are: reopening must never rewrite the close, or the chain that proves\n * the close happened is the very thing the reopen destroys.\n *\n * `events` is APPEND-ONLY. Where the other companions are single-shot and\n * idempotent, this one accumulates, because the cycle repeats.\n */\nexport interface PeriodReopenRecord {\n  readonly period: string\n  readonly partition?: PeriodPartition\n  readonly events: readonly PeriodReopenEvent[]\n}\n\n/**\n * Collapse an append-only reopen log into the return-only fields merged onto a\n * {@link PeriodRecord} on read.\n *\n * Expiry is deliberately NOT resolved here: `reopenedUntil` is carried through\n * verbatim and compared against the clock at write-guard time, so a bounded\n * window re-seals on its own without anything having to run.\n *\n * @internal\n */\nexport function resolveReopenState(events: readonly PeriodReopenEvent[]): {\n  reopenedAt?: string\n  reopenedBy?: string\n  reopenedUntil?: string\n  reopenReason?: string\n  reclosedAt?: string\n  reopenCount: number\n} {\n  let lastReopen: PeriodReopenEvent | undefined\n  let reclosedAfter: string | undefined\n  let reopenCount = 0\n  for (const e of events) {\n    if (e.op === 'reopen') {\n      lastReopen = e\n      reclosedAfter = undefined\n      reopenCount++\n    } else if (lastReopen !== undefined) {\n      reclosedAfter = e.at\n    }\n  }\n  if (!lastReopen) return { reopenCount }\n  return {\n    reopenedAt: lastReopen.at,\n    reopenedBy: lastReopen.by,\n    ...(lastReopen.until !== undefined && { reopenedUntil: lastReopen.until }),\n    ...(lastReopen.reason !== undefined && { reopenReason: lastReopen.reason }),\n    ...(reclosedAfter !== undefined && { reclosedAt: reclosedAfter }),\n    reopenCount,\n  }\n}\n\n/**\n * Is this period writable right now on account of a reopen? (#1022)\n *\n * Three ways to be sealed again: never reopened, explicitly reclosed after the\n * last reopen, or a bounded window that has elapsed. The clock is read by the\n * caller and passed in, so the guard and any diagnostic agree on one instant.\n *\n * @internal\n */\nexport function isEffectivelyReopened(period: PeriodRecord, nowIso: string): boolean {\n  if (period.reopenedAt === undefined) return false\n  if (period.reclosedAt !== undefined && period.reclosedAt >= period.reopenedAt) return false\n  if (period.reopenedUntil !== undefined && nowIso > period.reopenedUntil) return false\n  return true\n}\n\n/**\n * Companion record noting that a closed+frozen period's delete markers were\n * swept off the vault's push-only sync targets (#615). Stored in\n * {@link PERIOD_TARGET_PURGES_COLLECTION}, keyed by period name — kept OFF the\n * hash-chained `_periods/<name>` record so target-purge never alters the chain.\n */\nexport interface PeriodTargetPurgeRecord {\n  readonly period: string\n  readonly purgedAt: string\n  readonly purgedBy: string\n  readonly targets: readonly TargetPurgeCount[]\n}\n\n/**\n * Scope tuple for a period timeline (#1005).\n *\n * Identical in shape and semantics to `SequenceOptions.partition`: a\n * partitioned timeline is always disjoint from any unpartitioned one, and from\n * every other tuple. `['acme', 'vat']` and `['acme', 'wht']` are two\n * independent close calendars for the same subject — which is the whole point,\n * since sub-ledgers for one legal entity and one month routinely close on\n * different statutory deadlines.\n */\nexport type PeriodPartition = readonly (string | number)[]\n\n/**\n * Resolve the `_periods` storage key for a (name, partition) pair.\n *\n * Deliberately the same encoding as `resolveSequenceKey`: `name` verbatim when\n * unpartitioned, else `${name}\\x00${parts}` with each component\n * `encodeURIComponent`d and `'/'`-joined. The null-byte separator cannot occur\n * in a period name, so a partitioned key never collides with an unpartitioned\n * one; URI-encoding keeps `['a/b']` distinct from `['a','b']`.\n *\n * @throws {ValidationError} on an empty component or a non-finite number.\n * @internal\n */\nexport function resolvePeriodKey(name: string, partition?: PeriodPartition): string {\n  if (!partition || partition.length === 0) return name\n  const parts = partition.map((p) => {\n    if (typeof p === 'number' && !Number.isFinite(p)) {\n      throw new ValidationError(`period partition component must be a finite number, got ${p}`)\n    }\n    const s = String(p)\n    if (s === '') {\n      throw new ValidationError('period partition component must not be empty')\n    }\n    return encodeURIComponent(s)\n  })\n  return `${name}\\x00${parts.join('/')}`\n}\n\n/**\n * Do two partitions denote the same timeline? Absent and empty both mean \"the\n * unpartitioned timeline\", so they compare equal.\n *\n * @internal\n */\nexport function samePartition(a?: PeriodPartition, b?: PeriodPartition): boolean {\n  const x = a ?? []\n  const y = b ?? []\n  if (x.length !== y.length) return false\n  return x.every((v, i) => String(v) === String(y[i]))\n}\n\n/**\n * Resolves a record to the timeline that governs it. Supplied by\n * `withPeriods({ subjects })`; returns `undefined` for any collection with no\n * mapping, which is what keeps an unconfigured vault on the single vault-wide\n * timeline it has always had.\n *\n * @internal\n */\nexport type PartitionResolver = (\n  collection: string,\n  record: Record<string, unknown>,\n) => PeriodPartition | undefined\n\n/**\n * Stored record for one closed or opened accounting period. One entry\n * per period, keyed by `name` in the reserved `_periods` collection.\n *\n * The hash chain between periods is computed at read time by\n * `loadPeriods()` — each record carries the name + hash of its\n * predecessor so a tamper with any period's record breaks the chain\n * into the next one, the same way the ledger's `prevHash` works.\n */\nexport interface PeriodRecord {\n  /**\n   * Human-readable name (e.g., `'FY2026-Q1'`). Unique per PARTITION — two\n   * timelines may each carry a `'2026-06'`, which is the normal case when one\n   * vault serves several subjects (#1005). Unique per vault when unpartitioned.\n   */\n  readonly name: string\n  /**\n   * The timeline this period belongs to. Absent = the vault-wide timeline.\n   * Two periods with the same `name` and different `partition` are unrelated:\n   * separate hash chains, separate close state, and the write guard applies\n   * each only to records that resolve to its own tuple.\n   */\n  readonly partition?: PeriodPartition\n  /**\n   * Role discriminator. A period is `'closed'` from the moment its\n   * `closedAt` is recorded; `'opened'` marks a period whose opening\n   * entries have been carried forward via {@link openPeriod}. Many\n   * workflows will produce one opened period per closed period (the\n   * opened one is the SUCCESSOR — its `startDate` equals the prior\n   * `endDate + 1 day`).\n   */\n  readonly kind: 'closed' | 'opened'\n  /** ISO date — inclusive upper bound for records belonging to this period. */\n  readonly endDate: string\n  /** ISO date — lower bound (present on opened periods only). */\n  readonly startDate?: string\n  /**\n   * Record field carrying the business date (e.g. `'date'` on an\n   * invoice, `'paidAt'` on a payment). The guard compares\n   * `record[dateField]` against `endDate` — NOT the envelope `_ts`.\n   * Accounting entries booked late (business date `2026-01-15`,\n   * write-time `2026-04-22`) still get sealed when Q1 closes at\n   * `2026-03-31` because the comparison uses the business date.\n   *\n   * Optional for backwards compat. When absent, the guard falls back\n   * to envelope `_ts` — that's a write-time seal, appropriate for\n   * content that doesn't carry a logical business date (e.g. system\n   * settings) but almost never right for accounting ledgers.\n   */\n  readonly dateField?: string\n  /** ISO timestamp recorded at `closePeriod()` / `openPeriod()` call time. */\n  readonly closedAt: string\n  /** userId of the keyring that invoked the close/open. */\n  readonly closedBy: string\n  /** Name of the prior period this one chains to, if any. */\n  readonly priorPeriodName?: string\n  /** sha256(canonicalJson(priorPeriod)) — empty for the first period. */\n  readonly priorPeriodHash: string\n  /**\n   * Opened periods only — the names of the collections whose\n   * carry-forward aggregates were written by {@link openPeriod}.\n   * Recorded for auditability so a future `verifyPeriodChain()` can\n   * cross-check the opening balances against the closing snapshot.\n   */\n  readonly openingCollections?: readonly string[]\n  /** #604 return-only — merged from the `_period_freezes/<name>` companion on\n   *  read; NEVER written into the stored `_periods/<name>` record (would break\n   *  the hash chain). Absent = not yet frozen. */\n  readonly frozenAt?: string\n  readonly frozenBy?: string\n  readonly purgedMarkerCount?: number\n  /** #613 return-only — merged from the `_period_archives/<name>` companion on\n   *  read; NEVER written into the stored `_periods/<name>` record. Absent = not\n   *  yet archived. */\n  readonly archivedAt?: string\n  readonly archivedBy?: string\n  readonly archivedRecordCount?: number\n  /** #615 return-only — merged from the `_period_target_purges/<name>` companion\n   *  on read; NEVER written into the stored `_periods/<name>` record. Absent =\n   *  target-purge not yet run (or the vault has no push-only targets). */\n  readonly targetsPurgedAt?: string\n  readonly targetsPurgedBy?: string\n  readonly targetsPurged?: readonly TargetPurgeCount[]\n  /** #1022 return-only — collapsed from the `_period_reopens/<key>` append-only\n   *  log on read; NEVER written into the stored `_periods/<name>` record, so a\n   *  reopen cannot disturb the inter-period hash chain. Absent = never reopened.\n   *  `reclosedAt` present (and >= `reopenedAt`) means the window was closed\n   *  again explicitly; `reopenedUntil` in the past means it lapsed on its own.\n   *  Use {@link isEffectivelyReopened} rather than reading these directly. */\n  readonly reopenedAt?: string\n  readonly reopenedBy?: string\n  readonly reopenedUntil?: string\n  readonly reopenReason?: string\n  readonly reclosedAt?: string\n  /** How many times this period has been reopened, ever. */\n  readonly reopenCount?: number\n}\n\n/** Options for `vault.closePeriod()`. */\nexport interface ClosePeriodOptions {\n  /** Human-readable name. Must not collide with an existing period. */\n  readonly name: string\n  /**\n   * Inclusive upper cutoff. A record is sealed when its\n   * `record[dateField]` (or, if absent, the envelope `_ts`) is at or\n   * before this ISO timestamp.\n   */\n  readonly endDate: string\n  /**\n   * Record field carrying the business date used for period\n   * membership. Recommended for accounting workflows — e.g. an\n   * invoice booked late (write-time after close) is still sealed\n   * when its `invoice.date` falls inside the closed period.\n   *\n   * Omit to use envelope `_ts` (write-time seal). This fallback\n   * rarely matches real-world accounting semantics; prefer passing\n   * an explicit `dateField`.\n   */\n  readonly dateField?: string\n  /**\n   * Close only this timeline (#1005). Omit for the vault-wide timeline.\n   *\n   * ```ts\n   * vault.closePeriod({\n   *   name: '2026-06', endDate: '2026-06-30', dateField: 'issuedAt',\n   *   partition: [clientId, 'vat'],\n   * })\n   * ```\n   *\n   * Which records the resulting seal applies to is decided by the\n   * `subjects` map passed to `withPeriods()` — without one, no record ever\n   * resolves to a partition and a partitioned close seals nothing.\n   */\n  readonly partition?: PeriodPartition\n}\n\n/** Options for `vault.openPeriod()`. */\nexport interface OpenPeriodOptions<TCollections = Record<string, Record<string, unknown>>> {\n  /** Human-readable name for the new period. Must be unique. */\n  readonly name: string\n  /**\n   * The timeline to open in. Must match the partition of `fromPeriod` — a\n   * period cannot chain across timelines, since each carries its own hash\n   * chain (#1005).\n   */\n  readonly partition?: PeriodPartition\n  /** ISO lower bound of the new period (usually prior `endDate + 1 day`). */\n  readonly startDate: string\n  /**\n   * Name of the prior CLOSED period this one chains from. The prior\n   * period's record is verified to exist and to be `kind: 'closed'`;\n   * its `endDate` is made available to the `carryForward` callback.\n   */\n  readonly fromPeriod: string\n  /**\n   * Receives a read-only facade over the vault's CURRENT state,\n   * plus the prior period's `endDate`. Accounting semantics: after\n   * a period closes, records with `record[dateField] <= endDate`\n   * are frozen — current state equals closing state, so a caller\n   * can compute closing balances by querying the live collection\n   * with a `where('date', '<=', priorEndDate)` filter.\n   *\n   * Returns opening-balance records keyed by collection name.\n   * Example:\n   *\n   * ```ts\n   * carryForward: async (ctx) => {\n   *   const closing = await ctx.collection<Journal>('journal')\n   *     .query().where('date', '<=', ctx.priorEndDate).toArray()\n   *   const opening: Record<string, Journal> = {}\n   *   for (const entry of closing) {\n   *     opening[`OB-${entry.id}`] = { ...entry, date: '2026-04-01' }\n   *   }\n   *   return { journal: opening }\n   * }\n   * ```\n   */\n  readonly carryForward: (\n    ctx: CarryForwardContext,\n  ) => Promise<TCollections> | TCollections\n}\n\n/**\n * Context passed to `OpenPeriodOptions.carryForward`. Exposes a\n * read-only subset of the live vault (`collection(name).get/list`)\n * plus the prior period's `endDate` so business-date filters can\n * be built by the caller.\n *\n * Writes go via the return value, not via the facade — the\n * `collection()` here is deliberately restricted to reads.\n */\nexport interface CarryForwardContext {\n  /** The prior period's `endDate` — the boundary of the closing snapshot. */\n  readonly priorEndDate: string\n  /** Read-only collection facade over current vault state. */\n  collection<T = unknown>(name: string): ReadOnlyCollection<T>\n}\n\n/** Minimum read surface exposed to `carryForward`. */\nexport interface ReadOnlyCollection<T> {\n  get(id: string): Promise<T | null>\n  list(): Promise<T[]>\n}\n\n/**\n * Load every period record currently stored on the adapter.\n * Decrypting is the caller's responsibility (we return plain records\n * so the vault can use its own `_periods` DEK).\n *\n * @internal — called by Vault methods that need the closed-period\n * cache. Not part of the public API surface.\n */\nexport async function loadPeriods(\n  adapter: NoydbStore,\n  vault: string,\n  decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>,\n): Promise<PeriodRecord[]> {\n  const ids = await adapter.list(vault, PERIODS_COLLECTION)\n  const records: PeriodRecord[] = []\n  for (const id of ids) {\n    const env = await adapter.get(vault, PERIODS_COLLECTION, id)\n    if (env) records.push(await decrypt(id, env))\n  }\n  // Stable order by closedAt so chain verification is reproducible.\n  records.sort((a, b) => a.closedAt.localeCompare(b.closedAt))\n  return records\n}\n\n/**\n * Given the current ordered period list, pick the last entry that\n * belongs to the hash chain — used as the `priorPeriodHash` anchor\n * for the next closure/opening.\n *\n * @internal\n */\nexport async function chainAnchor(\n  records: readonly PeriodRecord[],\n  partition?: PeriodPartition,\n): Promise<{ priorPeriodName?: string; priorPeriodHash: string }> {\n  // #1005 — each timeline carries its OWN chain. Anchoring a partitioned close\n  // to whatever happened to be written last vault-wide would interleave\n  // unrelated subjects into one chain, so verifying client A's June would\n  // depend on client B never having closed in between.\n  const inTimeline = records.filter((p) => samePartition(p.partition, partition))\n  const last = inTimeline[inTimeline.length - 1]\n  if (!last) return { priorPeriodHash: '' }\n  const hash = await sha256Hex(canonicalJson(last as unknown as Record<string, unknown>))\n  return { priorPeriodName: last.name, priorPeriodHash: hash }\n}\n\n/**\n * Throw `PeriodClosedError` if the record being touched falls within\n * any closed period.\n *\n * Three signals, evaluated per period:\n *\n *  1. If the period declares a `dateField`, the guard reads\n *     `record[dateField]` on BOTH the existing (prior) record AND the\n *     incoming (new) record. Either comparing `<= endDate` triggers\n *     the error — callers cannot slide a record into a closed period\n *     by editing its date field.\n *  2. If the period has no `dateField`, the guard falls back to the\n *     envelope `_ts` of the existing record. Fresh inserts (no\n *     existing envelope) pass.\n *  3. For a delete, only the existing side is checked.\n *\n * @internal\n */\nexport function assertTsWritable(\n  existing: { ts: string | null; record: Record<string, unknown> | null } | null,\n  incomingRecord: Record<string, unknown> | null,\n  closedPeriods: readonly PeriodRecord[],\n  scope?: { collection: string; resolve?: PartitionResolver },\n): void {\n  // #1005 — a period only governs records that resolve to ITS timeline. With no\n  // resolver (the default `withPeriods()`), nothing resolves to a partition, so\n  // every record sits on the vault-wide timeline exactly as before and a\n  // partitioned period governs nothing.\n  const partitionOf = (r: Record<string, unknown> | null): PeriodPartition | undefined => {\n    if (!r || !scope?.resolve) return undefined\n    return scope.resolve(scope.collection, r)\n  }\n  const existingRecord = existing?.record ?? null\n  const existingPartition = partitionOf(existingRecord)\n  const incomingPartition = partitionOf(incomingRecord)\n  // One instant for the whole check, so a bounded reopen window cannot expire\n  // between two periods in the same loop and seal a write half-way.\n  const now = new Date().toISOString()\n\n  for (const p of closedPeriods) {\n    if (p.kind !== 'closed') continue\n    // #1022 — a reopened period is writable again. This is the ONLY thing a\n    // reopen does: it withdraws the period's veto. It cannot grant a write that\n    // some other gate forbids, because the guard bus ANDs every handler and\n    // record-level guards are registered ahead of this one.\n    if (isEffectivelyReopened(p, now)) continue\n    if (p.dateField) {\n      const checkRecord = (\n        label: string,\n        r: Record<string, unknown> | null,\n        recordPartition: PeriodPartition | undefined,\n      ): void => {\n        if (!r) return\n        // Both sides are checked under their OWN partition, which is what stops\n        // a write from sliding a record either INTO or OUT OF a sealed\n        // timeline by rewriting the fields the subject mapping reads.\n        if (!samePartition(recordPartition, p.partition)) return\n        const v = r[p.dateField!]\n        if (typeof v === 'string' && v <= p.endDate) {\n          throw new PeriodClosedError(p.name, p.endDate, `${label}[${p.dateField}]=${v}`)\n        }\n      }\n      checkRecord('existing', existingRecord, existingPartition)\n      checkRecord('incoming', incomingRecord, incomingPartition)\n      continue\n    }\n    // Fallback: write-time seal via envelope _ts. Scoped by the EXISTING\n    // record's partition — `_ts` belongs to the stored envelope, so the\n    // incoming side has no write-time of its own to compare.\n    if (!samePartition(existingPartition, p.partition)) continue\n    const existingTs = existing?.ts ?? null\n    if (existingTs !== null && existingTs <= p.endDate) {\n      throw new PeriodClosedError(p.name, p.endDate, existingTs)\n    }\n  }\n}\n\n/**\n * Sanity-check a proposed period name + endDate against existing\n * records. Shared by closePeriod / openPeriod so the two pathways\n * produce identical diagnostics.\n *\n * @internal\n */\nexport function validatePeriodName(\n  name: string,\n  existing: readonly PeriodRecord[],\n  partition?: PeriodPartition,\n): void {\n  if (name.length === 0) {\n    throw new ValidationError('Period name cannot be empty.')\n  }\n  // Validates the components as a side effect — an empty or non-finite\n  // component must be rejected at the call, not encoded into a storage key.\n  resolvePeriodKey(name, partition)\n  // #1005 — uniqueness is per TIMELINE. `'2026-06'` in `['A','vat']` does not\n  // collide with `'2026-06'` in `['B','vat']`.\n  if (existing.some((p) => p.name === name && samePartition(p.partition, partition))) {\n    const where = partition && partition.length > 0\n      ? ` in partition [${partition.join(', ')}]`\n      : ''\n    throw new ValidationError(`Period \"${name}\" already exists${where}.`)\n  }\n}\n\n/**\n * Wire a reserved-collection ledger append for a period record. The\n * period itself is stored via the adapter as an encrypted envelope;\n * the ledger entry is a normal `put` with the period's payloadHash,\n * so period closures inherit the chain's tamper-evidence.\n *\n * @internal\n */\nexport async function appendPeriodLedgerEntry(\n  ledger: LedgerStore | null,\n  actor: string,\n  envelope: EncryptedEnvelope,\n  name: string,\n  collection: string = PERIODS_COLLECTION,\n): Promise<void> {\n  if (!ledger) return\n  const { envelopePayloadHash } = await import('../../with-commit/history/ledger/index.js')\n  await ledger.append({\n    op: 'put',\n    collection,\n    id: name,\n    version: envelope._v,\n    actor,\n    payloadHash: await envelopePayloadHash(envelope),\n  })\n}\n\n/**\n * @internal #615. Sweep delete markers with `_ts < before` off ANY store\n * (the vault's local adapter, or a push-only sync target). Returns the count\n * removed. Shared by `vault._purgeDeleteMarkers` (local) and\n * `vault._purgePeriodTargets` (push-only targets).\n */\nexport async function purgeMarkersOn(\n  store: NoydbStore,\n  vault: string,\n  before: string,\n  collections?: string[],\n): Promise<number> {\n  const snapshot = await store.loadAll(vault)\n  let removed = 0\n  for (const [coll, records] of Object.entries(snapshot)) {\n    if (collections && !collections.includes(coll)) continue\n    for (const [id, env] of Object.entries(records)) {\n      if (isDeleteMarker(env) && env._ts < before) {\n        await store.delete(vault, coll, id)\n        removed++\n      }\n    }\n  }\n  return removed\n}\n","/**\n * Active periods strategy factory. Only reachable through the\n * `@noy-db/hub/periods` subpath.\n */\n\nimport {\n  loadPeriods,\n  chainAnchor,\n  assertTsWritable,\n  validatePeriodName,\n  appendPeriodLedgerEntry,\n} from './periods.js'\nimport type { PeriodPartition, PartitionResolver } from './periods.js'\nimport type { PeriodsStrategy } from './strategy.js'\n\n/** Options for {@link withPeriods}. */\nexport interface WithPeriodsOptions {\n  /**\n   * Maps a collection to the timeline each of its records belongs to (#1005) —\n   * the answer to \"which close calendar governs THIS record\".\n   *\n   * ```ts\n   * withPeriods({\n   *   subjects: { receipts: (r) => [r.clientId, layerOf(r)] },\n   * })\n   * ```\n   *\n   * Same shape as `withForget({ subjects })`, which answers the same question\n   * for erasure. A collection with no entry — and every collection when\n   * `subjects` is omitted entirely — stays on the vault-wide timeline, so an\n   * existing vault behaves exactly as it did before partitions existed.\n   *\n   * Return `undefined` from a mapper to put an individual record back on the\n   * vault-wide timeline (e.g. a record that predates the field the mapping\n   * reads).\n   */\n  readonly subjects?: Readonly<\n    Record<string, (record: Record<string, unknown>) => PeriodPartition | undefined>\n  >\n}\n\n/**\n * Build the default periods strategy. Pass into\n * `createNoydb({ periodsStrategy: withPeriods() })` to enable\n * `vault.closePeriod()` / `vault.openPeriod()` / write-guards.\n *\n * Pass `subjects` to run more than one close calendar in a single vault — see\n * {@link WithPeriodsOptions.subjects}.\n */\nexport function withPeriods(options?: WithPeriodsOptions): PeriodsStrategy {\n  const subjects = options?.subjects\n  const partitionOf: PartitionResolver | undefined = subjects\n    ? (collection, record) => subjects[collection]?.(record)\n    : undefined\n\n  return {\n    loadPeriods,\n    chainAnchor,\n    assertTsWritable,\n    validatePeriodName,\n    appendPeriodLedgerEntry,\n    ...(partitionOf !== undefined && { partitionOf }),\n  }\n}\n","/**\n * Strategy seam for the optional accounting-periods service. Core\n * imports `PeriodsStrategy` type-only + `NO_PERIODS` stub; the real\n * `loadPeriods` / `chainAnchor` / `assertTsWritable` /\n * `validatePeriodName` / `appendPeriodLedgerEntry` functions are\n * only reachable via `withPeriods()` in `./active.ts`.\n *\n * Applications that never call `vault.closePeriod()` /\n * `vault.openPeriod()` ship none of the ~363 LOC.\n *\n * @internal\n */\n\nimport type { EncryptedEnvelope, NoydbStore } from '../../kernel/types.js'\nimport type { LedgerStore } from '../../with-commit/history/ledger/store.js'\nimport type { PeriodRecord, PeriodPartition, PartitionResolver } from './periods.js'\n\n/**\n * @internal\n */\nexport interface PeriodsStrategy {\n  loadPeriods(\n    adapter: NoydbStore,\n    vault: string,\n    decrypt: (id: string, envelope: EncryptedEnvelope) => Promise<PeriodRecord>,\n  ): Promise<PeriodRecord[]>\n  chainAnchor(records: readonly PeriodRecord[], partition?: PeriodPartition): Promise<{\n    priorPeriodName?: string\n    priorPeriodHash: string\n  }>\n  assertTsWritable(\n    existing: { ts: string | null; record: Record<string, unknown> | null } | null,\n    incoming: Record<string, unknown> | null,\n    periods: readonly PeriodRecord[],\n    scope?: { collection: string; resolve?: PartitionResolver },\n  ): void\n  validatePeriodName(\n    name: string,\n    existing: readonly PeriodRecord[],\n    partition?: PeriodPartition,\n  ): void\n  /**\n   * Record → timeline resolver built from `withPeriods({ subjects })` (#1005).\n   * `undefined` when the caller configured no subjects, which keeps every\n   * record on the vault-wide timeline.\n   */\n  readonly partitionOf?: PartitionResolver\n  appendPeriodLedgerEntry(\n    ledger: LedgerStore | null,\n    actor: string,\n    envelope: EncryptedEnvelope,\n    periodName: string,\n    collection?: string,\n  ): Promise<void>\n}\n\n/**\n * No-periods stub. `loadPeriods` returns `[]`; the write-guards do\n * nothing (vaults without closed periods never reject writes);\n * `validatePeriodName` / `appendPeriodLedgerEntry` throw because\n * those paths are only reached when the user explicitly called\n * `closePeriod()` / `openPeriod()` — if they did that without the\n * strategy, they need to wire it.\n *\n * @internal\n */\nconst NOT_ENABLED = new Error(\n  'Accounting periods require the periods strategy. Import ' +\n  '`{ withPeriods }` from \"@noy-db/hub/periods\" and pass it to ' +\n  '`createNoydb({ periodsStrategy: withPeriods() })`.',\n)\n\nexport const NO_PERIODS: PeriodsStrategy = {\n  async loadPeriods() { return [] },\n  async chainAnchor() { return { priorPeriodHash: '' } },\n  assertTsWritable() {},\n  validatePeriodName() { throw NOT_ENABLED },\n  async appendPeriodLedgerEntry() { throw NOT_ENABLED },\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA2PO,SAAS,mBAAmB,QAOjC;AACA,MAAI;AACJ,MAAI;AACJ,MAAI,cAAc;AAClB,aAAW,KAAK,QAAQ;AACtB,QAAI,EAAE,OAAO,UAAU;AACrB,mBAAa;AACb,sBAAgB;AAChB;AAAA,IACF,WAAW,eAAe,QAAW;AACnC,sBAAgB,EAAE;AAAA,IACpB;AAAA,EACF;AACA,MAAI,CAAC,WAAY,QAAO,EAAE,YAAY;AACtC,SAAO;AAAA,IACL,YAAY,WAAW;AAAA,IACvB,YAAY,WAAW;AAAA,IACvB,GAAI,WAAW,UAAU,UAAa,EAAE,eAAe,WAAW,MAAM;AAAA,IACxE,GAAI,WAAW,WAAW,UAAa,EAAE,cAAc,WAAW,OAAO;AAAA,IACzE,GAAI,kBAAkB,UAAa,EAAE,YAAY,cAAc;AAAA,IAC/D;AAAA,EACF;AACF;AAWO,SAAS,sBAAsB,QAAsB,QAAyB;AACnF,MAAI,OAAO,eAAe,OAAW,QAAO;AAC5C,MAAI,OAAO,eAAe,UAAa,OAAO,cAAc,OAAO,WAAY,QAAO;AACtF,MAAI,OAAO,kBAAkB,UAAa,SAAS,OAAO,cAAe,QAAO;AAChF,SAAO;AACT;AAuCO,SAAS,iBAAiB,MAAc,WAAqC;AAClF,MAAI,CAAC,aAAa,UAAU,WAAW,EAAG,QAAO;AACjD,QAAM,QAAQ,UAAU,IAAI,CAAC,MAAM;AACjC,QAAI,OAAO,MAAM,YAAY,CAAC,OAAO,SAAS,CAAC,GAAG;AAChD,YAAM,IAAI,gBAAgB,2DAA2D,CAAC,EAAE;AAAA,IAC1F;AACA,UAAM,IAAI,OAAO,CAAC;AAClB,QAAI,MAAM,IAAI;AACZ,YAAM,IAAI,gBAAgB,8CAA8C;AAAA,IAC1E;AACA,WAAO,mBAAmB,CAAC;AAAA,EAC7B,CAAC;AACD,SAAO,GAAG,IAAI,KAAO,MAAM,KAAK,GAAG,CAAC;AACtC;AAQO,SAAS,cAAc,GAAqB,GAA8B;AAC/E,QAAM,IAAI,KAAK,CAAC;AAChB,QAAM,IAAI,KAAK,CAAC;AAChB,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,SAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC;AACrD;AAmOA,eAAsB,YACpB,SACA,OACA,SACyB;AACzB,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,kBAAkB;AACxD,QAAM,UAA0B,CAAC;AACjC,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,QAAQ,IAAI,OAAO,oBAAoB,EAAE;AAC3D,QAAI,IAAK,SAAQ,KAAK,MAAM,QAAQ,IAAI,GAAG,CAAC;AAAA,EAC9C;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AAC3D,SAAO;AACT;AASA,eAAsB,YACpB,SACA,WACgE;AAKhE,QAAM,aAAa,QAAQ,OAAO,CAAC,MAAM,cAAc,EAAE,WAAW,SAAS,CAAC;AAC9E,QAAM,OAAO,WAAW,WAAW,SAAS,CAAC;AAC7C,MAAI,CAAC,KAAM,QAAO,EAAE,iBAAiB,GAAG;AACxC,QAAM,OAAO,MAAM,UAAU,cAAc,IAA0C,CAAC;AACtF,SAAO,EAAE,iBAAiB,KAAK,MAAM,iBAAiB,KAAK;AAC7D;AAoBO,SAAS,iBACd,UACA,gBACA,eACA,OACM;AAKN,QAAM,cAAc,CAAC,MAAmE;AACtF,QAAI,CAAC,KAAK,CAAC,OAAO,QAAS,QAAO;AAClC,WAAO,MAAM,QAAQ,MAAM,YAAY,CAAC;AAAA,EAC1C;AACA,QAAM,iBAAiB,UAAU,UAAU;AAC3C,QAAM,oBAAoB,YAAY,cAAc;AACpD,QAAM,oBAAoB,YAAY,cAAc;AAGpD,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AAEnC,aAAW,KAAK,eAAe;AAC7B,QAAI,EAAE,SAAS,SAAU;AAKzB,QAAI,sBAAsB,GAAG,GAAG,EAAG;AACnC,QAAI,EAAE,WAAW;AACf,YAAM,cAAc,CAClB,OACA,GACA,oBACS;AACT,YAAI,CAAC,EAAG;AAIR,YAAI,CAAC,cAAc,iBAAiB,EAAE,SAAS,EAAG;AAClD,cAAM,IAAI,EAAE,EAAE,SAAU;AACxB,YAAI,OAAO,MAAM,YAAY,KAAK,EAAE,SAAS;AAC3C,gBAAM,IAAI,kBAAkB,EAAE,MAAM,EAAE,SAAS,GAAG,KAAK,IAAI,EAAE,SAAS,KAAK,CAAC,EAAE;AAAA,QAChF;AAAA,MACF;AACA,kBAAY,YAAY,gBAAgB,iBAAiB;AACzD,kBAAY,YAAY,gBAAgB,iBAAiB;AACzD;AAAA,IACF;AAIA,QAAI,CAAC,cAAc,mBAAmB,EAAE,SAAS,EAAG;AACpD,UAAM,aAAa,UAAU,MAAM;AACnC,QAAI,eAAe,QAAQ,cAAc,EAAE,SAAS;AAClD,YAAM,IAAI,kBAAkB,EAAE,MAAM,EAAE,SAAS,UAAU;AAAA,IAC3D;AAAA,EACF;AACF;AASO,SAAS,mBACd,MACA,UACA,WACM;AACN,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,IAAI,gBAAgB,8BAA8B;AAAA,EAC1D;AAGA,mBAAiB,MAAM,SAAS;AAGhC,MAAI,SAAS,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ,cAAc,EAAE,WAAW,SAAS,CAAC,GAAG;AAClF,UAAM,QAAQ,aAAa,UAAU,SAAS,IAC1C,kBAAkB,UAAU,KAAK,IAAI,CAAC,MACtC;AACJ,UAAM,IAAI,gBAAgB,WAAW,IAAI,mBAAmB,KAAK,GAAG;AAAA,EACtE;AACF;AAUA,eAAsB,wBACpB,QACA,OACA,UACA,MACA,aAAqB,oBACN;AACf,MAAI,CAAC,OAAQ;AACb,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,sBAA2C;AACxF,QAAM,OAAO,OAAO;AAAA,IAClB,IAAI;AAAA,IACJ;AAAA,IACA,IAAI;AAAA,IACJ,SAAS,SAAS;AAAA,IAClB;AAAA,IACA,aAAa,MAAM,oBAAoB,QAAQ;AAAA,EACjD,CAAC;AACH;AAQA,eAAsB,eACpB,OACA,OACA,QACA,aACiB;AACjB,QAAM,WAAW,MAAM,MAAM,QAAQ,KAAK;AAC1C,MAAI,UAAU;AACd,aAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACtD,QAAI,eAAe,CAAC,YAAY,SAAS,IAAI,EAAG;AAChD,eAAW,CAAC,IAAI,GAAG,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC/C,UAAI,eAAe,GAAG,KAAK,IAAI,MAAM,QAAQ;AAC3C,cAAM,MAAM,OAAO,OAAO,MAAM,EAAE;AAClC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;;;AC7tBO,SAAS,YAAY,SAA+C;AACzE,QAAM,WAAW,SAAS;AAC1B,QAAM,cAA6C,WAC/C,CAAC,YAAY,WAAW,SAAS,UAAU,IAAI,MAAM,IACrD;AAEJ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,gBAAgB,UAAa,EAAE,YAAY;AAAA,EACjD;AACF;;;ACGA,IAAM,cAAc,IAAI;AAAA,EACtB;AAGF;AAEO,IAAM,aAA8B;AAAA,EACzC,MAAM,cAAc;AAAE,WAAO,CAAC;AAAA,EAAE;AAAA,EAChC,MAAM,cAAc;AAAE,WAAO,EAAE,iBAAiB,GAAG;AAAA,EAAE;AAAA,EACrD,mBAAmB;AAAA,EAAC;AAAA,EACpB,qBAAqB;AAAE,UAAM;AAAA,EAAY;AAAA,EACzC,MAAM,0BAA0B;AAAE,UAAM;AAAA,EAAY;AACtD;","names":[]}

package/dist/{chunk-4GZ6XOVW.js → chunk-5F7BZAGV.js}

@@ -1,3 +1,10 @@
+import {
+  SCHEMAS_COLLECTION
+} from "./chunk-KM6ZXG7U.js";
+import {
+  assemblePodContainer,
+  buildExtractedPartitionWrapper
+} from "./chunk-GCU42IG7.js";
 import {
   BLOB_CHUNKS_COLLECTION,
   BLOB_COLLECTION,
@@ -5,17 +12,10 @@ import {
   BLOB_INTENT_COLLECTION,
   BLOB_SLOTS_PREFIX,
   BLOB_VERSIONS_PREFIX
-} from "./chunk-PL2GHSCM.js";
-import {
-  SCHEMAS_COLLECTION
-} from "./chunk-CDB2HVQW.js";
-import {
-  assembleBundleContainer,
-  buildExtractedPartitionWrapper
-} from "./chunk-4VUPLMZ6.js";
+} from "./chunk-JMJSCI7U.js";
 import {
   generateULID
-} from "./chunk-ZJADGNYF.js";
+} from "./chunk-4AOERLTV.js";
 import {
   LEDGER_COLLECTION
 } from "./chunk-I7FD46FF.js";
@@ -23,11 +23,16 @@ import {
   canonicalJson,
   envelopePayloadHash,
   hashEntry
-} from "./chunk-6SAFL5YE.js";
+} from "./chunk-BZ3WMOYX.js";
 import {
+  buildRecordAad,
   openEnvelopeJson,
+  recordAadFor,
   writeEnvelopeBody
-} from "./chunk-3URQC7EH.js";
+} from "./chunk-CXPOG3ZY.js";
+import {
+  buildRecordEnvelope
+} from "./chunk-FX3UIDCS.js";
 import {
   bufferToBase64,
   decrypt,
@@ -37,14 +42,13 @@ import {
   generateDEK,
   unwrapCek,
   wrapCek
-} from "./chunk-VCETL77O.js";
+} from "./chunk-ONPVHX2Y.js";
 import {
-  NOYDB_BACKUP_VERSION,
-  NOYDB_FORMAT_VERSION
-} from "./chunk-YPYHVOXP.js";
+  NOYDB_BACKUP_VERSION
+} from "./chunk-UJ4Z67UQ.js";
 import {
   PartitionExtractionError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-Z3BZXPRO.js";
 
 // src/with-cargo/walk-closure.ts
 async function walkClosure(vault, opts) {
@@ -185,15 +189,16 @@ async function reKeyClosure(vault, closure, fieldProjection) {
         );
       }
       if (env._cek !== void 0) {
+        const aad = recordAadFor({ collection: collectionName, id }, env);
         const cek = await unwrapCek(env._cek, srcDek);
-        const plaintext2 = await decrypt(env._iv, env._data, cek);
-        const { iv: iv2, data: data2 } = await encrypt(project(plaintext2), cek);
+        const plaintext2 = await decrypt(env._iv, env._data, cek, aad);
+        const { iv: iv2, data: data2 } = await encrypt(project(plaintext2), cek, aad);
         const wrapped = await wrapCek(cek, destDek);
         out[id] = { ...env, _iv: iv2, _data: data2, _cek: wrapped };
         continue;
       }
-      const plaintext = await openEnvelopeJson(env, srcDek);
-      const { iv, data } = await encrypt(project(plaintext), destDek);
+      const plaintext = await openEnvelopeJson({ collection: collectionName, id }, env, srcDek);
+      const { iv, data } = await encrypt(project(plaintext), destDek, recordAadFor({ collection: collectionName, id }, env));
       out[id] = { ...env, _iv: iv, _data: data };
     }
     collections[collectionName] = out;
@@ -210,8 +215,8 @@ async function reKeySchemas(vault, closure, destDeks, fieldProjection) {
     const destDek = destDeks.get(collectionName);
     if (!destDek) continue;
     const srcDek = await getDEK(collectionName);
-    const plaintext = await openEnvelopeJson(env, srcDek);
-    const { iv, data } = await encrypt(plaintext, destDek);
+    const plaintext = await openEnvelopeJson({ collection: SCHEMAS_COLLECTION, id: collectionName }, env, srcDek);
+    const { iv, data } = await encrypt(plaintext, destDek, recordAadFor({ collection: SCHEMAS_COLLECTION, id: collectionName }, env));
     out[collectionName] = { ...env, _iv: iv, _data: data };
   }
   return out;
@@ -225,7 +230,7 @@ async function reKeyLedger(vault, closure, reKeyedCollections, ledgerDek) {
   for (const id of ids) {
     const env = await adapter.get(vaultName, LEDGER_COLLECTION, id);
     if (!env) continue;
-    srcEntries.push(JSON.parse(await openEnvelopeJson(env, srcLedgerDek)));
+    srcEntries.push(JSON.parse(await openEnvelopeJson({ collection: LEDGER_COLLECTION, id }, env, srcLedgerDek)));
   }
   const kept = srcEntries.filter(
     (e) => (e.op === "put" || e.op === "delete") && (closure.get(e.collection)?.has(e.id) ?? false)
@@ -258,15 +263,12 @@ async function reKeyLedger(vault, closure, reKeyedCollections, ledgerDek) {
       payloadHash,
       ...src.reason !== void 0 ? { reason: src.reason } : {}
     };
-    const { iv, data } = await encrypt(canonicalJson(entry), ledgerDek);
-    entries[paddedIndex(i)] = {
-      _noydb: NOYDB_FORMAT_VERSION,
-      _v: i + 1,
-      _ts: entry.ts,
-      _iv: iv,
-      _data: data,
-      _by: entry.actor
-    };
+    const ledgerIdentity = { collection: LEDGER_COLLECTION, id: paddedIndex(i), version: i + 1 };
+    const { iv, data } = await encrypt(canonicalJson(entry), ledgerDek, buildRecordAad(ledgerIdentity));
+    entries[paddedIndex(i)] = buildRecordEnvelope(
+      ledgerIdentity,
+      { ts: entry.ts, iv, data }
+    );
     prevHash = await hashEntry(entry);
     last = entry;
   }
@@ -305,8 +307,8 @@ async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
       const intentId = `${collectionName}::${id}`;
       const intentEnv = await adapter.get(vaultName, BLOB_INTENT_COLLECTION, intentId);
       if (intentEnv) {
-        const intentPlain = await openEnvelopeJson(intentEnv, srcDek);
-        const intentBody = await writeEnvelopeBody(intentPlain, destDek);
+        const intentPlain = await openEnvelopeJson({ collection: BLOB_INTENT_COLLECTION, id: intentId }, intentEnv, srcDek);
+        const intentBody = await writeEnvelopeBody({ collection: BLOB_INTENT_COLLECTION, id: intentId, version: intentEnv._v }, intentPlain, destDek);
         place(BLOB_INTENT_COLLECTION, intentId, { ...intentEnv, ...intentBody });
       }
       const env = await adapter.get(vaultName, slotsCollection, id);
@@ -316,7 +318,7 @@ async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
           `#748: reKeyBlobs fetched an elevated slot-map envelope (collection="${slotsCollection}" id="${id}" _tier=${env._tier}) \u2014 this is unreachable by construction. Refusing to carry it into a partition.`
         );
       }
-      const slots = JSON.parse(await openEnvelopeJson(env, srcDek));
+      const slots = JSON.parse(await openEnvelopeJson({ collection: slotsCollection, id }, env, srcDek));
       const kept = {};
       for (const [slotName, slot] of Object.entries(slots)) {
         if (proj && !proj.has(slotName)) continue;
@@ -326,7 +328,7 @@ async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
         addRef(slot.eTag);
       }
       if (Object.keys(kept).length === 0) continue;
-      const { iv, data } = await encrypt(JSON.stringify(kept), destDek);
+      const { iv, data } = await encrypt(JSON.stringify(kept), destDek, recordAadFor({ collection: slotsCollection, id }, env));
       place(slotsCollection, id, { ...env, _iv: iv, _data: data });
     }
     const versionsCollection = `${BLOB_VERSIONS_PREFIX}${collectionName}`;
@@ -342,9 +344,9 @@ async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
           `#748: reKeyBlobs fetched an elevated version-record envelope (collection="${versionsCollection}" key="${key}" _tier=${env._tier}) \u2014 this is unreachable by construction. Refusing to carry it into a partition.`
         );
       }
-      const record = JSON.parse(await openEnvelopeJson(env, srcDek));
+      const record = JSON.parse(await openEnvelopeJson({ collection: versionsCollection, id: key }, env, srcDek));
       addRef(record.eTag);
-      const { iv, data } = await encrypt(JSON.stringify(record), destDek);
+      const { iv, data } = await encrypt(JSON.stringify(record), destDek, recordAadFor({ collection: versionsCollection, id: key }, env));
       place(versionsCollection, key, { ...env, _iv: iv, _data: data });
     }
   }
@@ -354,7 +356,7 @@ async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
   for (const [eTag, refCount] of carriedRefs) {
     const idxEnv = await adapter.get(vaultName, BLOB_INDEX_COLLECTION, eTag);
     if (!idxEnv) continue;
-    const blob = JSON.parse(await openEnvelopeJson(idxEnv, srcBlobDek));
+    const blob = JSON.parse(await openEnvelopeJson({ collection: BLOB_INDEX_COLLECTION, id: eTag }, idxEnv, srcBlobDek));
     let contentCek;
     let chunksPassthrough;
     if (blob._cek !== void 0) {
@@ -384,7 +386,7 @@ async function reKeyBlobs(vault, closure, destDeks, fieldProjection) {
     const { _cekPending, ...rest } = blob;
     void _cekPending;
     const carried = { ...rest, refCount, _cek: await wrapCek(contentCek, transferBlobDek) };
-    const { iv, data } = await encrypt(JSON.stringify(carried), transferBlobDek);
+    const { iv, data } = await encrypt(JSON.stringify(carried), transferBlobDek, recordAadFor({ collection: BLOB_INDEX_COLLECTION, id: eTag }, idxEnv));
     place(BLOB_INDEX_COLLECTION, eTag, { ...idxEnv, _iv: iv, _data: data });
   }
   return { internal, blobDek: transferBlobDek };
@@ -469,7 +471,7 @@ async function extractPartitionCore(vault, opts) {
   };
   const bodyJsonStr = JSON.stringify(buildExtractedPartitionWrapper(JSON.stringify(backup), seal));
   const handle = generateULID();
-  const bundleBytes = await assembleBundleContainer({
+  const bundleBytes = await assemblePodContainer({
     handle,
     bodyJsonStr,
     compression: opts.compression,
@@ -492,4 +494,4 @@ export {
   extractPartition,
   extractPartitionCore
 };
-//# sourceMappingURL=chunk-4GZ6XOVW.js.map
+//# sourceMappingURL=chunk-5F7BZAGV.js.map

package/dist/chunk-5F7BZAGV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-cargo/walk-closure.ts","../src/with-cargo/extract-partition.ts"],"sourcesContent":["/**\n * Transitive-closure FK walker. Computes the set of\n * (collection, id) tuples reachable from seed predicates, so a\n * partition extraction ships a referentially-complete subset.\n *\n * Two-phase, plaintext, read-only (runs inside the unlocked vault\n * session — see foundation §13.4 / spec invariant 7):\n *   1. INBOUND expansion: from selected records, pull every record\n *      that references them (children travel with parents), to a\n *      fixed point.\n *   2. OUTBOUND completion: pull every VISIBLE parent the selected set\n *      references, transitively, WITHOUT re-expanding inbound from those\n *      parents (bounds the closure). A tier-elevated (or missing) parent is\n *      excluded rather than admitted — see `danglingRefs` on the result.\n *\n * The FK graph is auto-derived from the vault's existing RefRegistry\n * (the `ref('target')` declarations on collections) — no hand-written\n * edge list.\n *\n * @module\n */\nimport type { Vault } from '../kernel/vault.js'\nimport { PartitionExtractionError } from '../kernel/errors.js'\n\n/** Seed predicate per collection. Records that return true become roots. */\nexport interface WalkClosureOptions {\n  readonly seeds: Record<\n    string,\n    (record: Record<string, unknown>) => boolean | Promise<boolean>\n  >\n  /** Max fixed-point iterations before throwing. Default 16. */\n  readonly maxDepth?: number\n}\n\n/**\n * #759: an outbound FK edge whose referenced parent was excluded from the\n * closure — either because it doesn't exist, or because it is tier-elevated\n * and therefore invisible (same \"elevated ≡ missing\" semantics as root\n * selection / inbound expansion). The child keeps its FK value; the parent\n * does not travel. Callers (extract-partition) surface this as a residue\n * notice rather than silently dropping it.\n */\nexport interface DanglingRefNotice {\n  /** Collection of the child record that holds the dangling FK. */\n  readonly collection: string\n  /** Id of the child record. */\n  readonly id: string\n  /** FK field on the child that references the missing/elevated parent. */\n  readonly field: string\n  /** Target collection the FK points at. */\n  readonly target: string\n  /** Id of the missing/elevated parent. */\n  readonly targetId: string\n  /**\n   * #772: distinguishes an intentional tier boundary (`'elevated'` — the\n   * parent exists but is above the caller's readable tier) from a genuine\n   * data-integrity gap (`'missing'` — no envelope for `targetId` at all).\n   */\n  readonly reason: 'missing' | 'elevated'\n}\n\nexport interface ClosureResult {\n  /** collection → set of record ids that travel together. */\n  readonly closure: Map<string, Set<string>>\n  readonly graph: {\n    /** Fixed-point iterations the walk needed to converge. */\n    readonly depth: number\n    /** True if an edge pointed back to an already-selected node. */\n    readonly cyclesDetected: boolean\n  }\n  /** #759: outbound FK edges whose parent was excluded (missing or elevated). */\n  readonly danglingRefs: ReadonlyArray<DanglingRefNotice>\n}\n\nexport async function walkClosure(\n  vault: Vault,\n  opts: WalkClosureOptions,\n): Promise<ClosureResult> {\n  const closure = new Map<string, Set<string>>()\n\n  // Records carry a string `id` by construction (Collection.put(id: string)).\n  // A non-string id during the walk means a malformed record — fail loud\n  // rather than silently dropping it from the closure (which would leave a\n  // dangling FK or a missing child in the extracted bundle).\n  const requireStringId = (collection: string, record: Record<string, unknown>): string => {\n    const id = record['id']\n    if (typeof id !== 'string') {\n      throw new PartitionExtractionError(\n        `walkClosure: record in collection \"${collection}\" has a non-string ` +\n          `id (${typeof id}); cannot include it in the partition closure.`,\n      )\n    }\n    return id\n  }\n\n  const add = (collection: string, id: string): boolean => {\n    let set = closure.get(collection)\n    if (!set) {\n      set = new Set<string>()\n      closure.set(collection, set)\n    }\n    if (set.has(id)) return false\n    set.add(id)\n    return true\n  }\n\n  // Phase 0: evaluate seed predicates.\n  for (const [collectionName, predicate] of Object.entries(opts.seeds)) {\n    const coll = vault.collection<Record<string, unknown>>(collectionName)\n    const records = await coll.list()\n    for (const record of records) {\n      if (await predicate(record)) {\n        add(collectionName, requireStringId(collectionName, record))\n      }\n    }\n  }\n\n  const { refRegistry, adapter, name: vaultName } = vault._introspectState()\n  const maxDepth = opts.maxDepth ?? 16\n  let cyclesDetected = false\n\n  // `depth` counts PRODUCTIVE expansion generations (rounds that added at\n  // least one new record), taken as the max over the two phases — i.e. the\n  // FK hop-distance the closure needed, not the raw loop-iteration count.\n  // The terminal draining pass that adds nothing does not count.\n  let inboundDepth = 0\n  let outboundDepth = 0\n\n  // Phase 1 — INBOUND expansion. Worklist of newly-added (collection,id)\n  // whose children we still need to pull.\n  let frontier: Array<[string, string]> = []\n  for (const [c, ids] of closure) for (const id of ids) frontier.push([c, id])\n\n  while (frontier.length > 0) {\n    const next: Array<[string, string]> = []\n    for (const [collectionName, id] of frontier) {\n      // Which collections reference THIS collection, and via which field?\n      for (const inbound of refRegistry.getInbound(collectionName)) {\n        const childColl = vault.collection<Record<string, unknown>>(inbound.collection)\n        // TODO(perf): re-scans the full inbound collection on every frontier\n        // element. O(frontier · inboundCollections · records) per depth. Fine\n        // at consumer-firm scale (foundation §13.4); revisit with an index or\n        // pagination if extraction over very large vaults gets slow.\n        const childRecords = await childColl.list()\n        for (const child of childRecords) {\n          const fk = child[inbound.field]\n          // Only scalar FK values can match an id; skip null/objects\n          // (mirrors checkIntegrity's scalar guard, vault.ts).\n          if (typeof fk !== 'string' && typeof fk !== 'number') continue\n          if (String(fk) !== id) continue\n          const childId = requireStringId(inbound.collection, child)\n          if (add(inbound.collection, childId)) {\n            next.push([inbound.collection, childId])\n          } else {\n            cyclesDetected = true\n          }\n        }\n      }\n    }\n    if (next.length > 0 && ++inboundDepth > maxDepth) {\n      throw new PartitionExtractionError(\n        `walkClosure exceeded maxDepth=${maxDepth}; the FK graph may be ` +\n          `unexpectedly deep or cyclic. Raise maxDepth or narrow the seeds.`,\n      )\n    }\n    frontier = next\n  }\n\n  // Phase 2 — OUTBOUND completion. Pull referenced parents so no FK\n  // dangles. Transitive over outbound edges only; parents are NOT\n  // inbound-expanded (that would drag in unrelated siblings).\n  let outboundFrontier: Array<[string, string]> = []\n  for (const [c, ids] of closure) for (const id of ids) outboundFrontier.push([c, id])\n\n  const danglingRefs: DanglingRefNotice[] = []\n\n  while (outboundFrontier.length > 0) {\n    const next: Array<[string, string]> = []\n    for (const [collectionName, id] of outboundFrontier) {\n      const outbound = refRegistry.getOutbound(collectionName)\n      if (Object.keys(outbound).length === 0) continue\n      const coll = vault.collection<Record<string, unknown>>(collectionName)\n      const record = await coll.get(id)\n      if (!record) continue\n      for (const [field, descriptor] of Object.entries(outbound)) {\n        const rawId = record[field]\n        // Only scalar FK values reference a parent id; skip null/objects.\n        if (typeof rawId !== 'string' && typeof rawId !== 'number') continue\n        const parentId = String(rawId)\n        // #759: verify the referenced parent is visible through the SAME\n        // tier-gated primitive root selection / inbound expansion use\n        // (`Collection.get()` → `#getRaw`, which returns null for both a\n        // missing record and a tier-elevated one). An elevated parent must\n        // be excluded exactly like an elevated root or inbound target —\n        // \"elevated ≡ invisible\" — rather than admitted into the closure,\n        // where `reKeyClosure`'s raw adapter read would later hit it and\n        // fail loud (the #748 canary). Record the resulting dangling FK\n        // instead of silently dropping it.\n        const parentColl = vault.collection<Record<string, unknown>>(descriptor.target)\n        const parentRecord = await parentColl.get(parentId)\n        if (!parentRecord) {\n          // #772: a raw (tier-unaware) read distinguishes the two cases the\n          // tier-gated `Collection.get()` above collapses to the same null —\n          // an envelope present with `_tier > 0` is an intentional tier\n          // boundary; no envelope at all is a genuine data-integrity gap.\n          const rawParentEnv = await adapter.get(vaultName, descriptor.target, parentId)\n          const reason: 'missing' | 'elevated' =\n            rawParentEnv && (rawParentEnv._tier ?? 0) > 0 ? 'elevated' : 'missing'\n          danglingRefs.push({\n            collection: collectionName, id, field, target: descriptor.target, targetId: parentId, reason,\n          })\n          continue\n        }\n        // Reaching an already-selected parent here is normal DAG\n        // convergence (a child referencing its in-scope parent), not a\n        // cycle — so do NOT flag cyclesDetected in the outbound phase.\n        if (add(descriptor.target, parentId)) {\n          next.push([descriptor.target, parentId])\n        }\n      }\n    }\n    if (next.length > 0 && ++outboundDepth > maxDepth) {\n      throw new PartitionExtractionError(\n        `walkClosure exceeded maxDepth=${maxDepth} during outbound completion.`,\n      )\n    }\n    outboundFrontier = next\n  }\n\n  const depth = Math.max(inboundDepth, outboundDepth)\n\n  return { closure, graph: { depth, cyclesDetected }, danglingRefs }\n}\n","/**\n * Partition extraction. Walks the FK closure, re-encrypts\n * the selected records under fresh per-collection DEKs, seals those DEKs\n * under a one-time transfer key, and serializes an unowned\n * `extracted-partition` bundle.\n *\n * @module\n */\nimport type { Vault } from '../kernel/vault.js'\nimport type { EncryptedEnvelope, BlobObject, SlotRecord, VersionRecord } from '../kernel/types.js'\nimport { NOYDB_BACKUP_VERSION } from '../kernel/types.js'\nimport { buildRecordAad, recordAadFor,\n  decrypt,\n  encrypt,\n  openEnvelopeJson,\n  writeEnvelopeBody,\n  generateDEK,\n  bufferToBase64,\n  encryptBytesWithAAD,\n  decryptBytesWithAAD,\n  unwrapCek,\n  wrapCek,\n  type EnclaveKey,\n} from '../kernel/enclave/index.js'\nimport {\n  BLOB_COLLECTION,\n  BLOB_INDEX_COLLECTION,\n  BLOB_CHUNKS_COLLECTION,\n  BLOB_SLOTS_PREFIX,\n  BLOB_VERSIONS_PREFIX,\n} from '../with-shape/blobs/blob-set.js'\nimport { BLOB_INTENT_COLLECTION } from '../with-shape/blobs/blob-intent.js'\nimport { PartitionExtractionError } from '../kernel/errors.js'\nimport { walkClosure, type WalkClosureOptions, type DanglingRefNotice } from './walk-closure.js'\nimport { generateULID } from '../with-pod/ulid.js'\nimport { SCHEMAS_COLLECTION } from '../with-shape/persisted-schemas/storage.js'\nimport { LEDGER_COLLECTION } from '../with-commit/history/ledger/constants.js'\nimport { canonicalJson, hashEntry } from '../with-commit/history/ledger/entry.js'\nimport type { LedgerEntry } from '../with-commit/history/ledger/entry.js'\nimport { envelopePayloadHash } from '../with-commit/history/ledger/hash.js'\nimport { buildRecordEnvelope } from '../kernel/enclave/index.js'\nimport {\n  assemblePodContainer,\n  buildExtractedPartitionWrapper,\n  type TransferSealPayload,\n} from '../with-pod/pod.js'\n\n/** Re-keyed collections snapshot + the fresh DEKs used. */\nexport interface ReKeyResult {\n  readonly collections: Record<string, Record<string, EncryptedEnvelope>>\n  readonly deks: Map<string, EnclaveKey>\n}\n\n/**\n * Re-encrypt every record in `closure` under a fresh per-collection DEK.\n * Reads raw source envelopes, decrypts under the source DEK, re-encrypts\n * under the new DEK. Plaintext-pipeline: requires an unlocked vault.\n */\nexport async function reKeyClosure(\n  vault: Vault,\n  closure: Map<string, Set<string>>,\n  fieldProjection?: Record<string, readonly string[]>,\n): Promise<ReKeyResult> {\n  const { name: vaultName, adapter, getDEK } = vault._introspectState()\n  const collections: Record<string, Record<string, EncryptedEnvelope>> = {}\n  const deks = new Map<string, EnclaveKey>()\n\n  for (const [collectionName, ids] of closure) {\n    const srcDek = await getDEK(collectionName)\n    const destDek = await generateDEK()\n    deks.set(collectionName, destDek)\n    const out: Record<string, EncryptedEnvelope> = {}\n    // FR-7 structural field projection: when this collection has a projection,\n    // narrow the plaintext body to `id` (always) + the listed fields BEFORE\n    // re-encryption, so excluded fields never travel in the bundle. Applied\n    // identically in both re-key branches; only the body changes — the `_cek`\n    // re-wrap order is untouched. Absent/empty projection → byte-identical to\n    // the un-projected path (`proj` is undefined and `project` is a no-op).\n    const projList = fieldProjection?.[collectionName]\n    const proj = projList ? new Set(projList) : undefined\n    const project = (plaintext: string): string => {\n      if (!proj) return plaintext\n      const rec = JSON.parse(plaintext) as Record<string, unknown>\n      const kept: Record<string, unknown> = {}\n      if ('id' in rec) kept['id'] = rec['id'] // id ALWAYS preserved\n      for (const f of proj) if (f in rec) kept[f] = rec[f]\n      return JSON.stringify(kept)\n    }\n\n    for (const id of ids) {\n      const env = await adapter.get(vaultName, collectionName, id)\n      if (!env) continue\n      // #748 defense-in-depth canary: `closure` is built exclusively through\n      // tier-gated `Collection.list()`/`get()` (collection.ts `ensureHydrated`\n      // / `#getRaw` both skip `_tier > 0` envelopes), so an elevated record\n      // can never reach this raw `adapter.get` fetch — this should be\n      // unreachable by construction. Not a user-facing guard; a cheap tripwire\n      // in case that invariant ever regresses.\n      if ((env._tier ?? 0) > 0) {\n        throw new PartitionExtractionError(\n          `#748: reKeyClosure fetched an elevated envelope (collection=\"${collectionName}\" id=\"${id}\" `\n          + `_tier=${env._tier}) — this is unreachable by construction (walkClosure only ever adds ids `\n          + `reachable through tier-gated Collection reads). Refusing to carry it into a partition.`,\n        )\n      }\n      if (env._cek !== undefined) {\n        // Per-record CEK: a naive `{ ...env }` spread would carry a\n        // SOURCE-DEK-wrapped CEK into a bundle re-keyed under a different\n        // destination DEK — silently undecryptable for the recipient.\n        // Re-wrap: unwrap the CEK under the source DEK, re-encrypt the body\n        // under the SAME CEK (decision 2 — CEK reused on re-key, preserving\n        // the history-chain identity), then wrap the CEK under the fresh\n        // destination DEK. The recipient gains access transitively once they\n        // re-wrap the collection DEK under their KEK on adopt.\n        // Identity is UNCHANGED by extraction — collection/id/_tier/_by all\n        // travel with the record, and `vault` is deliberately unbound (the ADR's\n        // constraint (c) exists precisely so adoption can re-home a partition).\n        // So the same AAD opens the source and seals the destination (#1041).\n        const aad = recordAadFor({ collection: collectionName, id }, env)\n        const cek = await unwrapCek(env._cek, srcDek)\n        const plaintext = await decrypt(env._iv, env._data, cek, aad)\n        const { iv, data } = await encrypt(project(plaintext), cek, aad)\n        const wrapped = await wrapCek(cek, destDek)\n        out[id] = { ...env, _iv: iv, _data: data, _cek: wrapped }\n        continue\n      }\n      const plaintext = await openEnvelopeJson({ collection: collectionName, id }, env, srcDek)\n      const { iv, data } = await encrypt(project(plaintext), destDek, recordAadFor({ collection: collectionName, id }, env))\n      out[id] = { ...env, _iv: iv, _data: data }\n    }\n    collections[collectionName] = out\n  }\n\n  return { collections, deks }\n}\n\n/**\n * Re-key the persisted JSON Schemas (`_schemas/<collection>`) for the\n * closure collections under the destination DEKs. Returns a\n * `{ collection: envelope }` map for the carried collections that actually\n * have a schema; collections without one are omitted.\n */\nexport async function reKeySchemas(\n  vault: Vault,\n  closure: Map<string, Set<string>>,\n  destDeks: Map<string, EnclaveKey>,\n  fieldProjection?: Record<string, readonly string[]>,\n): Promise<Record<string, EncryptedEnvelope>> {\n  const { name: vaultName, adapter, getDEK } = vault._introspectState()\n  const out: Record<string, EncryptedEnvelope> = {}\n\n  for (const collectionName of closure.keys()) {\n    // FR-7: skip a projected collection's schema — the narrowed shape no\n    // longer matches the stored JSON Schema, so carrying it would assert a\n    // contract the projected records violate (missing required fields).\n    if (fieldProjection?.[collectionName]) continue\n    const env = await adapter.get(vaultName, SCHEMAS_COLLECTION, collectionName)\n    if (!env) continue // collection has no persisted schema — skip\n    const destDek = destDeks.get(collectionName)\n    if (!destDek) continue\n    const srcDek = await getDEK(collectionName)\n    const plaintext = await openEnvelopeJson({ collection: SCHEMAS_COLLECTION, id: collectionName }, env, srcDek)\n    const { iv, data } = await encrypt(plaintext, destDek, recordAadFor({ collection: SCHEMAS_COLLECTION, id: collectionName }, env))\n    out[collectionName] = { ...env, _iv: iv, _data: data }\n  }\n  return out\n}\n\nconst paddedIndex = (n: number): string => String(n).padStart(10, '0')\n\nexport interface ReKeyLedgerResult {\n  /** { paddedIndex: re-encrypted entry envelope } for backup._internal._ledger. */\n  readonly entries: Record<string, EncryptedEnvelope>\n  /** Recomputed ledgerHead for the carried chain (index -1 when empty). */\n  readonly head: { hash: string; index: number; ts: string }\n}\n\n/**\n * Build the carried `_ledger` chain for an extracted partition.\n * Filters source entries to the closure, RE-CHAINS them (fresh index + prevHash),\n * and re-encrypts under `ledgerDek`. The `payloadHash` is recomputed against the\n * re-keyed envelope ONLY for the latest `put` per (collection,id) — the entry\n * `verifyBackupIntegrity` cross-checks; earlier puts + deletes keep their source\n * `payloadHash` verbatim (recomputing an intermediate put would assert a false\n * hash for an older version). Amendments + out-of-closure entries are dropped;\n * `_ledger_deltas`/`_history` are deferred to slice 2.\n */\nexport async function reKeyLedger(\n  vault: Vault,\n  closure: Map<string, Set<string>>,\n  reKeyedCollections: Record<string, Record<string, EncryptedEnvelope>>,\n  ledgerDek: EnclaveKey,\n): Promise<ReKeyLedgerResult> {\n  const { name: vaultName, adapter, getDEK } = vault._introspectState()\n  const srcLedgerDek = await getDEK(LEDGER_COLLECTION)\n\n  // 1. Load + decrypt source entries in index order.\n  const ids = (await adapter.list(vaultName, LEDGER_COLLECTION)).sort()\n  const srcEntries: LedgerEntry[] = []\n  for (const id of ids) {\n    const env = await adapter.get(vaultName, LEDGER_COLLECTION, id)\n    if (!env) continue\n    srcEntries.push(JSON.parse(await openEnvelopeJson({ collection: LEDGER_COLLECTION, id }, env, srcLedgerDek)) as LedgerEntry)\n  }\n\n  // 2. Keep closure put/delete entries (drop amendments + out-of-closure).\n  const kept = srcEntries.filter(\n    (e) => (e.op === 'put' || e.op === 'delete') && (closure.get(e.collection)?.has(e.id) ?? false),\n  )\n\n  // 3a. Reverse pass: index of the LATEST put per (collection,id).\n  const latestPutIndex = new Map<string, number>()\n  for (let i = kept.length - 1; i >= 0; i--) {\n    const e = kept[i]!\n    if (e.op !== 'put') continue\n    const key = `${e.collection}/${e.id}`\n    if (!latestPutIndex.has(key)) latestPutIndex.set(key, i)\n  }\n\n  // 3b. Forward re-chain + re-encrypt.\n  const entries: Record<string, EncryptedEnvelope> = {}\n  let prevHash = ''\n  let last: LedgerEntry | undefined\n  for (let i = 0; i < kept.length; i++) {\n    const src = kept[i]!\n    const key = `${src.collection}/${src.id}`\n    const isLatestPut = src.op === 'put' && latestPutIndex.get(key) === i\n    const reKeyedEnv = reKeyedCollections[src.collection]?.[src.id]\n    const payloadHash = isLatestPut && reKeyedEnv\n      ? await envelopePayloadHash(reKeyedEnv)\n      : src.payloadHash\n    const entry: LedgerEntry = {\n      index: i,\n      prevHash,\n      op: src.op,\n      collection: src.collection,\n      id: src.id,\n      version: src.version,\n      ts: src.ts,\n      actor: src.actor,\n      payloadHash,\n      ...(src.reason !== undefined ? { reason: src.reason } : {}),\n    }\n    const ledgerIdentity = { collection: LEDGER_COLLECTION, id: paddedIndex(i), version: i + 1 }\n    const { iv, data } = await encrypt(canonicalJson(entry), ledgerDek, buildRecordAad(ledgerIdentity))\n    entries[paddedIndex(i)] = buildRecordEnvelope(\n      ledgerIdentity,\n      { ts: entry.ts, iv, data},\n    )\n    prevHash = await hashEntry(entry)\n    last = entry\n  }\n\n  return {\n    entries,\n    head: last ? { hash: prevHash, index: last.index, ts: last.ts } : { hash: '', index: -1, ts: '' },\n  }\n}\n\n/** Build the AAD binding for chunk integrity: \"{eTag}:{chunkIndex}:{chunkCount}\".\n * Mirrors `chunkAAD` in blob-set.ts — the eTag is preserved verbatim across\n * the transfer (see `reKeyBlobs`), so the same AAD that bound a chunk in the\n * source keeps binding it in the bundle. */\nfunction chunkAAD(eTag: string, chunkIndex: number, chunkCount: number): Uint8Array {\n  return new TextEncoder().encode(`${eTag}:${chunkIndex}:${chunkCount}`)\n}\n\n/** Carried blob internals + the fresh transfer `_blob` DEK (present only when\n * the closure references at least one chunk-based blob). */\nexport interface ReKeyBlobsResult {\n  /** `_blob_slots_<C>` / `_blob_versions_<C>` / `_blob_index` / `_blob_chunks`\n   * envelopes for the bundle's `_internal` map. */\n  readonly internal: Record<string, Record<string, EncryptedEnvelope>>\n  /** Fresh transfer `_blob` DEK — seal it so owner-creation wraps it under the\n   * recipient KEK. Undefined when no blob travels (source keyring untouched). */\n  readonly blobDek?: EnclaveKey\n}\n\n/**\n * Carry the FK-closed slice's blobs — HARDENED key handling (no master-key leak).\n *\n * The source vault's shared `_blob` DEK decrypts (or unwraps the content CEK of)\n * EVERY blob in the source. Sealing it into the transfer would hand the recipient\n * a key to blobs far outside their slice. Instead we mint a **fresh transfer\n * `_blob` DEK** and arrange every carried blob into per-blob-CEK mode under it:\n *\n *  - **erasable blob** (`_cek` present): unwrap the per-blob content CEK under the\n *    SOURCE `_blob` DEK, re-wrap it under the FRESH transfer DEK. Chunks travel\n *    **verbatim** (still ciphertext under that same content CEK — passthrough).\n *  - **legacy blob** (no `_cek`, chunks under the shared `_blob` DEK): promote it\n *    IN-BUNDLE — mint a fresh content CEK, decrypt each chunk under the source\n *    `_blob` DEK and re-encrypt under the content CEK (same AAD, so the eTag-bound\n *    integrity holds), then wrap the content CEK under the transfer DEK. The\n *    SOURCE is never mutated (non-destructive), and the bundle never holds\n *    plaintext blob bytes (zero-knowledge preserved).\n *\n * **eTag identity is preserved** (not re-HMAC'd). eTags are HMAC-keyed off the\n * `_blob` DEK, but they are stored as OPAQUE keys (`_blob_index/<eTag>`,\n * `_blob_chunks/<eTag>_<i>`) and never recomputed on read — only on a `put()`\n * for dedup. Keeping them verbatim keeps every slot/version/index/chunk key and\n * the chunk AAD coherent with zero chunk-key churn. The only consequence: a\n * future `put()` of identical bytes in the adopted vault computes a different\n * eTag (HMAC under the fresh DEK) and will NOT dedup against the carried blob —\n * an accepted, documented trade for hardened key isolation.\n *\n * Slots/versions are re-keyed under their parent collection's destination DEK\n * (honoring `fieldProjection` — projected-out blob fields' slots never travel);\n * `BlobObject.refCount` is recomputed from carried references only.\n *\n * `external` slots reference an unencrypted shared-bucket object that is not in\n * the bundle — their slot metadata travels (so the catalog entry survives) but\n * the bytes do not (a documented v1 limitation; their eTag is `''`).\n */\nexport async function reKeyBlobs(\n  vault: Vault,\n  closure: Map<string, Set<string>>,\n  destDeks: Map<string, EnclaveKey>,\n  fieldProjection?: Record<string, readonly string[]>,\n): Promise<ReKeyBlobsResult> {\n  const { name: vaultName, adapter, getDEK } = vault._introspectState()\n  const internal: Record<string, Record<string, EncryptedEnvelope>> = {}\n\n  // travel set: eTag → number of carried references (slots + versions) within\n  // the closure. Recomputed refCount, NOT the source's (which may count\n  // out-of-slice referrers, leaving the adopted blob un-GC-able).\n  const carriedRefs = new Map<string, number>()\n  const addRef = (eTag: string): void => {\n    if (!eTag) return // external slot — no chunk-based blob to carry\n    carriedRefs.set(eTag, (carriedRefs.get(eTag) ?? 0) + 1)\n  }\n\n  const place = (collection: string, id: string, env: EncryptedEnvelope): void => {\n    let bucket = internal[collection]\n    if (!bucket) { bucket = {}; internal[collection] = bucket }\n    bucket[id] = env\n  }\n\n  // ── Slots + versions (parent-collection-DEK keyed) ─────────────────\n  for (const [collectionName, ids] of closure) {\n    const destDek = destDeks.get(collectionName)\n    if (!destDek) continue\n    const srcDek = await getDEK(collectionName)\n    const projList = fieldProjection?.[collectionName]\n    const proj = projList ? new Set(projList) : undefined\n\n    // Slots: one envelope per record, a `{ slotName: SlotRecord }` map.\n    const slotsCollection = `${BLOB_SLOTS_PREFIX}${collectionName}`\n    for (const id of ids) {\n      // #767: carry any in-flight `_blob_intent` marker for this record,\n      // re-keyed under the SAME destination DEK as its owning collection\n      // (mirrors `dumpVault`'s backup allowlist, which carries `_blob_intent`\n      // for the identical crash-recovery reason — a partition extracted\n      // mid-shred/mid-rehome must carry the marker so resume-on-touch heals\n      // it post-restore). Checked independently of the slot-map fetch below:\n      // a marker can be present even when the slot map has already been\n      // touched or removed by the in-flight operation.\n      const intentId = `${collectionName}::${id}`\n      const intentEnv = await adapter.get(vaultName, BLOB_INTENT_COLLECTION, intentId)\n      if (intentEnv) {\n        const intentPlain = await openEnvelopeJson({ collection: BLOB_INTENT_COLLECTION, id: intentId }, intentEnv, srcDek)\n        const intentBody = await writeEnvelopeBody({ collection: BLOB_INTENT_COLLECTION, id: intentId, version: intentEnv._v }, intentPlain, destDek)\n        place(BLOB_INTENT_COLLECTION, intentId, { ...intentEnv, ...intentBody })\n      }\n\n      const env = await adapter.get(vaultName, slotsCollection, id)\n      if (!env) continue\n      // #748 defense-in-depth canary — see the matching one in `reKeyClosure`:\n      // `ids` comes from the same tier-gated `closure`, so an elevated\n      // record's slot map should never be reachable here. Unreachable by\n      // construction; a cheap tripwire, not a user-facing guard.\n      if ((env._tier ?? 0) > 0) {\n        throw new PartitionExtractionError(\n          `#748: reKeyBlobs fetched an elevated slot-map envelope (collection=\"${slotsCollection}\" `\n          + `id=\"${id}\" _tier=${env._tier}) — this is unreachable by construction. Refusing to carry it into a partition.`,\n        )\n      }\n      const slots = JSON.parse(await openEnvelopeJson({ collection: slotsCollection, id }, env, srcDek)) as Record<string, SlotRecord>\n      // FR-7: drop projected-out blob fields' slots (slot names are blob field\n      // names) — their eTags then never enter the travel set.\n      const kept: Record<string, SlotRecord> = {}\n      for (const [slotName, slot] of Object.entries(slots)) {\n        if (proj && !proj.has(slotName)) continue\n        // #769: strip the internal `pendingRelease` resume breadcrumb before\n        // it travels. It is a SOURCE-VAULT-LOCAL rehome marker (see\n        // `SlotRecord.pendingRelease`'s doc comment) pointing at an old eTag\n        // awaiting release — meaningless, and potentially misleading, once\n        // detached from the source vault (the eTag it names may be absent\n        // from the destination). Unlike `_blob_intent` above (carried, so\n        // resume-on-touch heals it post-restore), this breadcrumb must NOT\n        // travel into a cross-vault partition.\n        const { pendingRelease, ...strippedSlot } = slot\n        void pendingRelease\n        kept[slotName] = strippedSlot\n        addRef(slot.eTag)\n      }\n      if (Object.keys(kept).length === 0) continue\n      const { iv, data } = await encrypt(JSON.stringify(kept), destDek, recordAadFor({ collection: slotsCollection, id }, env))\n      place(slotsCollection, id, { ...env, _iv: iv, _data: data })\n    }\n\n    // Versions: key = `${recordId}::${slotName}::${label}`; each an independent\n    // refCount hold on its eTag.\n    const versionsCollection = `${BLOB_VERSIONS_PREFIX}${collectionName}`\n    const versionKeys = await adapter.list(vaultName, versionsCollection)\n    for (const key of versionKeys) {\n      const [recordId, slotName] = key.split('::')\n      if (recordId === undefined || !ids.has(recordId)) continue\n      if (proj && slotName !== undefined && !proj.has(slotName)) continue\n      const env = await adapter.get(vaultName, versionsCollection, key)\n      if (!env) continue\n      // #748 defense-in-depth canary — see `reKeyClosure`'s. Unreachable by\n      // construction; a cheap tripwire, not a user-facing guard.\n      if ((env._tier ?? 0) > 0) {\n        throw new PartitionExtractionError(\n          `#748: reKeyBlobs fetched an elevated version-record envelope (collection=\"${versionsCollection}\" `\n          + `key=\"${key}\" _tier=${env._tier}) — this is unreachable by construction. Refusing to carry it into a partition.`,\n        )\n      }\n      const record = JSON.parse(await openEnvelopeJson({ collection: versionsCollection, id: key }, env, srcDek)) as VersionRecord\n      addRef(record.eTag)\n      const { iv, data } = await encrypt(JSON.stringify(record), destDek, recordAadFor({ collection: versionsCollection, id: key }, env))\n      place(versionsCollection, key, { ...env, _iv: iv, _data: data })\n    }\n  }\n\n  // No chunk-based blob in the closure → carry nothing, mint nothing. Guarded\n  // so `getDEK('_blob')` does not auto-mint + persist a phantom DEK on the\n  // source keyring (mirrors the carryLedger non-destructive guard).\n  if (carriedRefs.size === 0) return { internal }\n\n  // ── Index + chunks (re-keyed under a FRESH transfer `_blob` DEK) ────\n  const srcBlobDek = await getDEK(BLOB_COLLECTION)\n  const transferBlobDek = await generateDEK()\n\n  for (const [eTag, refCount] of carriedRefs) {\n    const idxEnv = await adapter.get(vaultName, BLOB_INDEX_COLLECTION, eTag)\n    if (!idxEnv) continue // dangling slot reference — nothing to carry\n    const blob = JSON.parse(await openEnvelopeJson({ collection: BLOB_INDEX_COLLECTION, id: eTag }, idxEnv, srcBlobDek)) as BlobObject\n\n    // Resolve the per-blob content CEK; passthrough vs. in-bundle promotion.\n    let contentCek: EnclaveKey\n    let chunksPassthrough: boolean\n    if (blob._cek !== undefined) {\n      contentCek = await unwrapCek(blob._cek, srcBlobDek)\n      chunksPassthrough = true\n    } else {\n      // Legacy: promote to per-blob-CEK for the bundle (source untouched).\n      contentCek = await generateDEK()\n      chunksPassthrough = false\n    }\n\n    // Chunks: verbatim for an already-erasable blob; decrypt-then-re-encrypt\n    // under the fresh content CEK for a legacy blob (same eTag-bound AAD).\n    for (let i = 0; i < blob.chunkCount; i++) {\n      const chunkId = `${eTag}_${i}`\n      const chunkEnv = await adapter.get(vaultName, BLOB_CHUNKS_COLLECTION, chunkId)\n      if (!chunkEnv) {\n        throw new PartitionExtractionError(\n          `reKeyBlobs: blob chunk ${i}/${blob.chunkCount} missing for eTag \"${eTag}\"; `\n          + `cannot carry an incomplete blob into the partition.`,\n        )\n      }\n      if (chunksPassthrough) {\n        place(BLOB_CHUNKS_COLLECTION, chunkId, chunkEnv)\n      } else {\n        const aad = chunkAAD(eTag, i, blob.chunkCount)\n        const plain = await decryptBytesWithAAD(chunkEnv._iv, chunkEnv._data, srcBlobDek, aad)\n        const { iv, data } = await encryptBytesWithAAD(plain, contentCek, aad)\n        place(BLOB_CHUNKS_COLLECTION, chunkId, { ...chunkEnv, _iv: iv, _data: data })\n      }\n    }\n\n    // Index: per-blob-CEK mode under the transfer DEK, refCount corrected.\n    // Drop any transient `_cekPending` (never set on a settled blob — possible\n    // only if the source is mid-migration; we set a fresh settled `_cek`).\n    const { _cekPending, ...rest } = blob\n    void _cekPending\n    const carried: BlobObject = { ...rest, refCount, _cek: await wrapCek(contentCek, transferBlobDek) }\n    const { iv, data } = await encrypt(JSON.stringify(carried), transferBlobDek, recordAadFor({ collection: BLOB_INDEX_COLLECTION, id: eTag }, idxEnv))\n    place(BLOB_INDEX_COLLECTION, eTag, { ...idxEnv, _iv: iv, _data: data })\n  }\n\n  return { internal, blobDek: transferBlobDek }\n}\n\n/** A minted transfer key (raw 32 bytes) + the seal carrying the DEK set. */\nexport interface SealResult {\n  readonly seal: TransferSealPayload\n  readonly transferKey: Uint8Array\n}\n\n/**\n * Mint a random 32-byte transfer key, export each DEK to raw bytes, and\n * AES-256-GCM-seal the `{ collection: base64(rawDEK) }` map under the\n * transfer key. The transfer key is returned to the caller out-of-band;\n * only the sealed bytes travel in the bundle. Layout: iv(12) ‖ ct ‖ tag.\n */\nexport async function sealDeks(deks: Map<string, EnclaveKey>): Promise<SealResult> {\n  const dekMap: Record<string, string> = {}\n  for (const [collection, dek] of deks) {\n    const raw = await crypto.subtle.exportKey('raw', dek)\n    dekMap[collection] = bufferToBase64(raw)\n  }\n\n  const transferKey = crypto.getRandomValues(new Uint8Array(32))\n  const key = await crypto.subtle.importKey('raw', transferKey, 'AES-GCM', false, ['encrypt'])\n  const iv = crypto.getRandomValues(new Uint8Array(12))\n  const plaintext = new TextEncoder().encode(JSON.stringify(dekMap))\n  const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, plaintext)\n\n  const combined = new Uint8Array(iv.byteLength + ct.byteLength)\n  combined.set(iv, 0)\n  combined.set(new Uint8Array(ct), iv.byteLength)\n\n  const sealId = bufferToBase64(crypto.getRandomValues(new Uint8Array(12)))\n  return {\n    seal: { v: 1, alg: 'aes-256-gcm-pre-shared', sealId, payload: bufferToBase64(combined) },\n    transferKey,\n  }\n}\n\nexport interface ExtractPartitionResult {\n  readonly bundleBytes: Uint8Array\n  /** Raw 32-byte transfer key — deliver out-of-band; required to adopt. */\n  readonly transferKey: Uint8Array\n  readonly sealId: string\n  /**\n   * #759: outbound FK edges whose referenced parent was excluded from the\n   * partition (missing, or tier-elevated and therefore invisible). The\n   * child record still carries its FK value; the parent did not travel —\n   * callers should surface this to the operator rather than assume\n   * referential completeness.\n   */\n  readonly danglingRefs: ReadonlyArray<DanglingRefNotice>\n}\n\n/**\n * Extract a re-keyed, transfer-sealed partition. Owner-only\n * (invariant 5): producing a standalone re-keyed vault is an\n * ownership operation. Non-destructive on the source.\n */\nexport type ExtractPartitionOptions = WalkClosureOptions & {\n  readonly compression?: 'auto' | 'brotli' | 'gzip' | 'none'\n  readonly carrySchemas?: boolean\n  readonly carryLedger?: boolean\n  /**\n   * FR-7 structural field projection: per-collection allow-list of fields\n   * to keep. Non-listed fields are dropped from each record BEFORE\n   * re-encryption (so they never travel in the bundle); `id` is always\n   * preserved. A projected collection's persisted schema is NOT carried.\n   * Absent/empty → un-projected behavior (byte-identical to today).\n   */\n  readonly fieldProjection?: Record<string, readonly string[]>\n}\n\n/**\n * Public extract-partition entry — gated behind `cargoStrategy: withCargo()`\n * (S4). Routes through the source vault's cargo strategy so an un-opted-in\n * caller hits `NO_CARGO`'s throw; `withCargo()` dynamically imports and runs\n * {@link extractPartitionCore} (the crypto engine, kept out of the floor).\n */\nexport async function extractPartition(\n  vault: Vault,\n  opts: ExtractPartitionOptions,\n): Promise<ExtractPartitionResult> {\n  return vault.cargoStrategy.extractPartition(vault, opts)\n}\n\n/**\n * The extract-partition crypto engine — reached only when `withCargo()` is\n * opted in (via the lazy `with-cargo/active.ts` chunk). Body unchanged from the\n * hardened implementation; only the public gate wraps it.\n */\nexport async function extractPartitionCore(\n  vault: Vault,\n  opts: ExtractPartitionOptions,\n): Promise<ExtractPartitionResult> {\n  // FR-6: extract-and-sever is the inalienability-floor half — owner-only. A\n  // custodian operates fully but must NEVER produce a standalone re-keyed\n  // partition (that would let it sever a copy out from under the sealed owner).\n  // Explicit assertion so the security boundary is auditable at this site.\n  if (vault.role === 'custodian') {\n    throw new PartitionExtractionError(\n      'extractPartition is owner-only; a custodian cannot extract-and-sever '\n      + '(FR-6: producing a re-keyed standalone partition is an ownership operation; use the Deed owner).',\n    )\n  }\n  if (vault.role !== 'owner') {\n    throw new PartitionExtractionError(\n      `extractPartition requires the 'owner' role on the source vault; caller is '${vault.role}'. `\n      + `Producing a re-keyed standalone partition is an ownership operation.`,\n    )\n  }\n\n  // Persisted-schema writes (collection({ persistJsonSchema: true })) are fire-\n  // and-forget queued onto vault._pendingSchemaWrites — a caller that does\n  // `collection() → put() → extractPartition({ carrySchemas: true })` in quick\n  // succession can hit a window where _schemas/<col> is not yet on disk and\n  // reKeySchemas silently drops the row. Drain BEFORE reKeySchemas reads.\n  if (opts.carrySchemas) await vault._drainPendingSchemaWrites()\n\n  const { closure, danglingRefs } = await walkClosure(vault, opts)\n  const { collections, deks } = await reKeyClosure(vault, closure, opts.fieldProjection)\n\n  // carryLedger: mint a fresh _ledger DEK, build the carried chain, and\n  // SEAL the ledger DEK alongside the data DEKs so owner-creation wraps it into the\n  // recipient keyring (lets them decrypt + verify the chain). Must run BEFORE\n  // sealDeks.\n  let ledgerHead: { hash: string; index: number; ts: string } | undefined\n  let ledgerEntries: Record<string, EncryptedEnvelope> | undefined\n  if (opts.carryLedger && vault._getLedgerOrNull() !== null) {\n    // Skip when the source vault has no history strategy: reKeyLedger's first\n    // `getDEK(LEDGER_COLLECTION)` would auto-mint and persist a phantom\n    // _ledger DEK on the source keyring (contradicting \"non-destructive on\n    // the source\"), and there's nothing to carry anyway. Mirrors the same\n    // null-guard the source audit-append uses below.\n    const ledgerDek = await generateDEK()\n    const built = await reKeyLedger(vault, closure, collections, ledgerDek)\n    if (built.head.index >= 0) {\n      ledgerEntries = built.entries\n      ledgerHead = built.head\n      deks.set(LEDGER_COLLECTION, ledgerDek)\n    }\n  }\n\n  // Carry the slice's blobs — re-keyed under a FRESH transfer `_blob` DEK\n  // (HARDENED: never carries the source's shared blob DEK). Runs BEFORE\n  // sealDeks so the fresh DEK is sealed alongside the data DEKs; non-destructive\n  // on the source (mints + reads `_blob` only when the closure has blobs).\n  const blobs = await reKeyBlobs(vault, closure, deks, opts.fieldProjection)\n  if (blobs.blobDek) deks.set(BLOB_COLLECTION, blobs.blobDek)\n\n  // Build _internal (schemas + ledger + blobs). reKeySchemas reads data-\n  // collection DEKs only, so it is unaffected by the _ledger DEK added above.\n  const internalSchemas = opts.carrySchemas ? await reKeySchemas(vault, closure, deks, opts.fieldProjection) : {}\n  const internal: Record<string, Record<string, EncryptedEnvelope>> = {}\n  if (Object.keys(internalSchemas).length > 0) internal[SCHEMAS_COLLECTION] = internalSchemas\n  if (ledgerEntries) internal[LEDGER_COLLECTION] = ledgerEntries\n  for (const [collection, records] of Object.entries(blobs.internal)) internal[collection] = records\n  const hasInternal = Object.keys(internal).length > 0\n\n  const { seal, transferKey } = await sealDeks(deks)\n\n  // Source-side audit: record that a partition\n  // was handed over. Non-destructive — an audit append, no record touched.\n  // No-op when the source vault has no history strategy. append() fills\n  // index/prevHash/ts and (since actor is '') the ledger's configured actor.\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle',\n    collection: '',\n    id: '',\n    version: 0,\n    actor: '',\n    payloadHash: '',\n    reason: `partition-handed-over:${seal.sealId}`,\n  })\n\n  // Build the dump JSON: unowned (empty keyrings), empty ledger (default),\n  // re-keyed collections only.\n  const { name: vaultName } = vault._introspectState()\n  const backup = {\n    _noydb_backup: NOYDB_BACKUP_VERSION,\n    _compartment: vaultName,\n    _exported_at: new Date().toISOString(),\n    _exported_by: '', // unowned — no source user travels\n    keyrings: {},\n    collections,\n    ...(hasInternal ? { _internal: internal } : {}),\n    ...(ledgerHead ? { ledgerHead: { hash: ledgerHead.hash, index: ledgerHead.index, ts: ledgerHead.ts } } : {}),\n  }\n  const bodyJsonStr = JSON.stringify(buildExtractedPartitionWrapper(JSON.stringify(backup), seal))\n\n  // An extracted partition is a NEW vault, not a re-export of the source —\n  // mint a fresh handle rather than reusing the source's stable ULID\n  // (which would collide if a recipient imports both source + partition).\n  const handle = generateULID()\n  const bundleBytes = await assemblePodContainer({\n    handle,\n    bodyJsonStr,\n    compression: opts.compression,\n    headerExtras: {\n      bundleKind: 'extracted-partition',\n      transferSeal: { v: seal.v, alg: seal.alg, sealId: seal.sealId }, // indicator only\n    },\n  })\n\n  return { bundleBytes, transferKey, sealId: seal.sealId, danglingRefs }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0EA,eAAsB,YACpB,OACA,MACwB;AACxB,QAAM,UAAU,oBAAI,IAAyB;AAM7C,QAAM,kBAAkB,CAAC,YAAoB,WAA4C;AACvF,UAAM,KAAK,OAAO,IAAI;AACtB,QAAI,OAAO,OAAO,UAAU;AAC1B,YAAM,IAAI;AAAA,QACR,sCAAsC,UAAU,0BACvC,OAAO,EAAE;AAAA,MACpB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,CAAC,YAAoB,OAAwB;AACvD,QAAI,MAAM,QAAQ,IAAI,UAAU;AAChC,QAAI,CAAC,KAAK;AACR,YAAM,oBAAI,IAAY;AACtB,cAAQ,IAAI,YAAY,GAAG;AAAA,IAC7B;AACA,QAAI,IAAI,IAAI,EAAE,EAAG,QAAO;AACxB,QAAI,IAAI,EAAE;AACV,WAAO;AAAA,EACT;AAGA,aAAW,CAAC,gBAAgB,SAAS,KAAK,OAAO,QAAQ,KAAK,KAAK,GAAG;AACpE,UAAM,OAAO,MAAM,WAAoC,cAAc;AACrE,UAAM,UAAU,MAAM,KAAK,KAAK;AAChC,eAAW,UAAU,SAAS;AAC5B,UAAI,MAAM,UAAU,MAAM,GAAG;AAC3B,YAAI,gBAAgB,gBAAgB,gBAAgB,MAAM,CAAC;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAEA,QAAM,EAAE,aAAa,SAAS,MAAM,UAAU,IAAI,MAAM,iBAAiB;AACzE,QAAM,WAAW,KAAK,YAAY;AAClC,MAAI,iBAAiB;AAMrB,MAAI,eAAe;AACnB,MAAI,gBAAgB;AAIpB,MAAI,WAAoC,CAAC;AACzC,aAAW,CAAC,GAAG,GAAG,KAAK,QAAS,YAAW,MAAM,IAAK,UAAS,KAAK,CAAC,GAAG,EAAE,CAAC;AAE3E,SAAO,SAAS,SAAS,GAAG;AAC1B,UAAM,OAAgC,CAAC;AACvC,eAAW,CAAC,gBAAgB,EAAE,KAAK,UAAU;AAE3C,iBAAW,WAAW,YAAY,WAAW,cAAc,GAAG;AAC5D,cAAM,YAAY,MAAM,WAAoC,QAAQ,UAAU;AAK9E,cAAM,eAAe,MAAM,UAAU,KAAK;AAC1C,mBAAW,SAAS,cAAc;AAChC,gBAAM,KAAK,MAAM,QAAQ,KAAK;AAG9B,cAAI,OAAO,OAAO,YAAY,OAAO,OAAO,SAAU;AACtD,cAAI,OAAO,EAAE,MAAM,GAAI;AACvB,gBAAM,UAAU,gBAAgB,QAAQ,YAAY,KAAK;AACzD,cAAI,IAAI,QAAQ,YAAY,OAAO,GAAG;AACpC,iBAAK,KAAK,CAAC,QAAQ,YAAY,OAAO,CAAC;AAAA,UACzC,OAAO;AACL,6BAAiB;AAAA,UACnB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,SAAS,KAAK,EAAE,eAAe,UAAU;AAChD,YAAM,IAAI;AAAA,QACR,iCAAiC,QAAQ;AAAA,MAE3C;AAAA,IACF;AACA,eAAW;AAAA,EACb;AAKA,MAAI,mBAA4C,CAAC;AACjD,aAAW,CAAC,GAAG,GAAG,KAAK,QAAS,YAAW,MAAM,IAAK,kBAAiB,KAAK,CAAC,GAAG,EAAE,CAAC;AAEnF,QAAM,eAAoC,CAAC;AAE3C,SAAO,iBAAiB,SAAS,GAAG;AAClC,UAAM,OAAgC,CAAC;AACvC,eAAW,CAAC,gBAAgB,EAAE,KAAK,kBAAkB;AACnD,YAAM,WAAW,YAAY,YAAY,cAAc;AACvD,UAAI,OAAO,KAAK,QAAQ,EAAE,WAAW,EAAG;AACxC,YAAM,OAAO,MAAM,WAAoC,cAAc;AACrE,YAAM,SAAS,MAAM,KAAK,IAAI,EAAE;AAChC,UAAI,CAAC,OAAQ;AACb,iBAAW,CAAC,OAAO,UAAU,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAC1D,cAAM,QAAQ,OAAO,KAAK;AAE1B,YAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU;AAC5D,cAAM,WAAW,OAAO,KAAK;AAU7B,cAAM,aAAa,MAAM,WAAoC,WAAW,MAAM;AAC9E,cAAM,eAAe,MAAM,WAAW,IAAI,QAAQ;AAClD,YAAI,CAAC,cAAc;AAKjB,gBAAM,eAAe,MAAM,QAAQ,IAAI,WAAW,WAAW,QAAQ,QAAQ;AAC7E,gBAAM,SACJ,iBAAiB,aAAa,SAAS,KAAK,IAAI,aAAa;AAC/D,uBAAa,KAAK;AAAA,YAChB,YAAY;AAAA,YAAgB;AAAA,YAAI;AAAA,YAAO,QAAQ,WAAW;AAAA,YAAQ,UAAU;AAAA,YAAU;AAAA,UACxF,CAAC;AACD;AAAA,QACF;AAIA,YAAI,IAAI,WAAW,QAAQ,QAAQ,GAAG;AACpC,eAAK,KAAK,CAAC,WAAW,QAAQ,QAAQ,CAAC;AAAA,QACzC;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK,SAAS,KAAK,EAAE,gBAAgB,UAAU;AACjD,YAAM,IAAI;AAAA,QACR,iCAAiC,QAAQ;AAAA,MAC3C;AAAA,IACF;AACA,uBAAmB;AAAA,EACrB;AAEA,QAAM,QAAQ,KAAK,IAAI,cAAc,aAAa;AAElD,SAAO,EAAE,SAAS,OAAO,EAAE,OAAO,eAAe,GAAG,aAAa;AACnE;;;AC9KA,eAAsB,aACpB,OACA,SACA,iBACsB;AACtB,QAAM,EAAE,MAAM,WAAW,SAAS,OAAO,IAAI,MAAM,iBAAiB;AACpE,QAAM,cAAiE,CAAC;AACxE,QAAM,OAAO,oBAAI,IAAwB;AAEzC,aAAW,CAAC,gBAAgB,GAAG,KAAK,SAAS;AAC3C,UAAM,SAAS,MAAM,OAAO,cAAc;AAC1C,UAAM,UAAU,MAAM,YAAY;AAClC,SAAK,IAAI,gBAAgB,OAAO;AAChC,UAAM,MAAyC,CAAC;AAOhD,UAAM,WAAW,kBAAkB,cAAc;AACjD,UAAM,OAAO,WAAW,IAAI,IAAI,QAAQ,IAAI;AAC5C,UAAM,UAAU,CAAC,cAA8B;AAC7C,UAAI,CAAC,KAAM,QAAO;AAClB,YAAM,MAAM,KAAK,MAAM,SAAS;AAChC,YAAM,OAAgC,CAAC;AACvC,UAAI,QAAQ,IAAK,MAAK,IAAI,IAAI,IAAI,IAAI;AACtC,iBAAW,KAAK,KAAM,KAAI,KAAK,IAAK,MAAK,CAAC,IAAI,IAAI,CAAC;AACnD,aAAO,KAAK,UAAU,IAAI;AAAA,IAC5B;AAEA,eAAW,MAAM,KAAK;AACpB,YAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gBAAgB,EAAE;AAC3D,UAAI,CAAC,IAAK;AAOV,WAAK,IAAI,SAAS,KAAK,GAAG;AACxB,cAAM,IAAI;AAAA,UACR,gEAAgE,cAAc,SAAS,EAAE,WAC9E,IAAI,KAAK;AAAA,QAEtB;AAAA,MACF;AACA,UAAI,IAAI,SAAS,QAAW;AAa1B,cAAM,MAAM,aAAa,EAAE,YAAY,gBAAgB,GAAG,GAAG,GAAG;AAChE,cAAM,MAAM,MAAM,UAAU,IAAI,MAAM,MAAM;AAC5C,cAAMA,aAAY,MAAM,QAAQ,IAAI,KAAK,IAAI,OAAO,KAAK,GAAG;AAC5D,cAAM,EAAE,IAAAC,KAAI,MAAAC,MAAK,IAAI,MAAM,QAAQ,QAAQF,UAAS,GAAG,KAAK,GAAG;AAC/D,cAAM,UAAU,MAAM,QAAQ,KAAK,OAAO;AAC1C,YAAI,EAAE,IAAI,EAAE,GAAG,KAAK,KAAKC,KAAI,OAAOC,OAAM,MAAM,QAAQ;AACxD;AAAA,MACF;AACA,YAAM,YAAY,MAAM,iBAAiB,EAAE,YAAY,gBAAgB,GAAG,GAAG,KAAK,MAAM;AACxF,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,QAAQ,SAAS,GAAG,SAAS,aAAa,EAAE,YAAY,gBAAgB,GAAG,GAAG,GAAG,CAAC;AACrH,UAAI,EAAE,IAAI,EAAE,GAAG,KAAK,KAAK,IAAI,OAAO,KAAK;AAAA,IAC3C;AACA,gBAAY,cAAc,IAAI;AAAA,EAChC;AAEA,SAAO,EAAE,aAAa,KAAK;AAC7B;AAQA,eAAsB,aACpB,OACA,SACA,UACA,iBAC4C;AAC5C,QAAM,EAAE,MAAM,WAAW,SAAS,OAAO,IAAI,MAAM,iBAAiB;AACpE,QAAM,MAAyC,CAAC;AAEhD,aAAW,kBAAkB,QAAQ,KAAK,GAAG;AAI3C,QAAI,kBAAkB,cAAc,EAAG;AACvC,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,oBAAoB,cAAc;AAC3E,QAAI,CAAC,IAAK;AACV,UAAM,UAAU,SAAS,IAAI,cAAc;AAC3C,QAAI,CAAC,QAAS;AACd,UAAM,SAAS,MAAM,OAAO,cAAc;AAC1C,UAAM,YAAY,MAAM,iBAAiB,EAAE,YAAY,oBAAoB,IAAI,eAAe,GAAG,KAAK,MAAM;AAC5G,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,SAAS,aAAa,EAAE,YAAY,oBAAoB,IAAI,eAAe,GAAG,GAAG,CAAC;AAChI,QAAI,cAAc,IAAI,EAAE,GAAG,KAAK,KAAK,IAAI,OAAO,KAAK;AAAA,EACvD;AACA,SAAO;AACT;AAEA,IAAM,cAAc,CAAC,MAAsB,OAAO,CAAC,EAAE,SAAS,IAAI,GAAG;AAmBrE,eAAsB,YACpB,OACA,SACA,oBACA,WAC4B;AAC5B,QAAM,EAAE,MAAM,WAAW,SAAS,OAAO,IAAI,MAAM,iBAAiB;AACpE,QAAM,eAAe,MAAM,OAAO,iBAAiB;AAGnD,QAAM,OAAO,MAAM,QAAQ,KAAK,WAAW,iBAAiB,GAAG,KAAK;AACpE,QAAM,aAA4B,CAAC;AACnC,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,mBAAmB,EAAE;AAC9D,QAAI,CAAC,IAAK;AACV,eAAW,KAAK,KAAK,MAAM,MAAM,iBAAiB,EAAE,YAAY,mBAAmB,GAAG,GAAG,KAAK,YAAY,CAAC,CAAgB;AAAA,EAC7H;AAGA,QAAM,OAAO,WAAW;AAAA,IACtB,CAAC,OAAO,EAAE,OAAO,SAAS,EAAE,OAAO,cAAc,QAAQ,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,EAAE,KAAK;AAAA,EAC3F;AAGA,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,WAAS,IAAI,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK;AACzC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,EAAE,OAAO,MAAO;AACpB,UAAM,MAAM,GAAG,EAAE,UAAU,IAAI,EAAE,EAAE;AACnC,QAAI,CAAC,eAAe,IAAI,GAAG,EAAG,gBAAe,IAAI,KAAK,CAAC;AAAA,EACzD;AAGA,QAAM,UAA6C,CAAC;AACpD,MAAI,WAAW;AACf,MAAI;AACJ,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,UAAM,MAAM,GAAG,IAAI,UAAU,IAAI,IAAI,EAAE;AACvC,UAAM,cAAc,IAAI,OAAO,SAAS,eAAe,IAAI,GAAG,MAAM;AACpE,UAAM,aAAa,mBAAmB,IAAI,UAAU,IAAI,IAAI,EAAE;AAC9D,UAAM,cAAc,eAAe,aAC/B,MAAM,oBAAoB,UAAU,IACpC,IAAI;AACR,UAAM,QAAqB;AAAA,MACzB,OAAO;AAAA,MACP;AAAA,MACA,IAAI,IAAI;AAAA,MACR,YAAY,IAAI;AAAA,MAChB,IAAI,IAAI;AAAA,MACR,SAAS,IAAI;AAAA,MACb,IAAI,IAAI;AAAA,MACR,OAAO,IAAI;AAAA,MACX;AAAA,MACA,GAAI,IAAI,WAAW,SAAY,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC;AAAA,IAC3D;AACA,UAAM,iBAAiB,EAAE,YAAY,mBAAmB,IAAI,YAAY,CAAC,GAAG,SAAS,IAAI,EAAE;AAC3F,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,cAAc,KAAK,GAAG,WAAW,eAAe,cAAc,CAAC;AAClG,YAAQ,YAAY,CAAC,CAAC,IAAI;AAAA,MACxB;AAAA,MACA,EAAE,IAAI,MAAM,IAAI,IAAI,KAAI;AAAA,IAC1B;AACA,eAAW,MAAM,UAAU,KAAK;AAChC,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,OAAO,EAAE,MAAM,UAAU,OAAO,KAAK,OAAO,IAAI,KAAK,GAAG,IAAI,EAAE,MAAM,IAAI,OAAO,IAAI,IAAI,GAAG;AAAA,EAClG;AACF;AAMA,SAAS,SAAS,MAAc,YAAoB,YAAgC;AAClF,SAAO,IAAI,YAAY,EAAE,OAAO,GAAG,IAAI,IAAI,UAAU,IAAI,UAAU,EAAE;AACvE;AAgDA,eAAsB,WACpB,OACA,SACA,UACA,iBAC2B;AAC3B,QAAM,EAAE,MAAM,WAAW,SAAS,OAAO,IAAI,MAAM,iBAAiB;AACpE,QAAM,WAA8D,CAAC;AAKrE,QAAM,cAAc,oBAAI,IAAoB;AAC5C,QAAM,SAAS,CAAC,SAAuB;AACrC,QAAI,CAAC,KAAM;AACX,gBAAY,IAAI,OAAO,YAAY,IAAI,IAAI,KAAK,KAAK,CAAC;AAAA,EACxD;AAEA,QAAM,QAAQ,CAAC,YAAoB,IAAY,QAAiC;AAC9E,QAAI,SAAS,SAAS,UAAU;AAChC,QAAI,CAAC,QAAQ;AAAE,eAAS,CAAC;AAAG,eAAS,UAAU,IAAI;AAAA,IAAO;AAC1D,WAAO,EAAE,IAAI;AAAA,EACf;AAGA,aAAW,CAAC,gBAAgB,GAAG,KAAK,SAAS;AAC3C,UAAM,UAAU,SAAS,IAAI,cAAc;AAC3C,QAAI,CAAC,QAAS;AACd,UAAM,SAAS,MAAM,OAAO,cAAc;AAC1C,UAAM,WAAW,kBAAkB,cAAc;AACjD,UAAM,OAAO,WAAW,IAAI,IAAI,QAAQ,IAAI;AAG5C,UAAM,kBAAkB,GAAG,iBAAiB,GAAG,cAAc;AAC7D,eAAW,MAAM,KAAK;AASpB,YAAM,WAAW,GAAG,cAAc,KAAK,EAAE;AACzC,YAAM,YAAY,MAAM,QAAQ,IAAI,WAAW,wBAAwB,QAAQ;AAC/E,UAAI,WAAW;AACb,cAAM,cAAc,MAAM,iBAAiB,EAAE,YAAY,wBAAwB,IAAI,SAAS,GAAG,WAAW,MAAM;AAClH,cAAM,aAAa,MAAM,kBAAkB,EAAE,YAAY,wBAAwB,IAAI,UAAU,SAAS,UAAU,GAAG,GAAG,aAAa,OAAO;AAC5I,cAAM,wBAAwB,UAAU,EAAE,GAAG,WAAW,GAAG,WAAW,CAAC;AAAA,MACzE;AAEA,YAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,iBAAiB,EAAE;AAC5D,UAAI,CAAC,IAAK;AAKV,WAAK,IAAI,SAAS,KAAK,GAAG;AACxB,cAAM,IAAI;AAAA,UACR,uEAAuE,eAAe,SAC7E,EAAE,WAAW,IAAI,KAAK;AAAA,QACjC;AAAA,MACF;AACA,YAAM,QAAQ,KAAK,MAAM,MAAM,iBAAiB,EAAE,YAAY,iBAAiB,GAAG,GAAG,KAAK,MAAM,CAAC;AAGjG,YAAM,OAAmC,CAAC;AAC1C,iBAAW,CAAC,UAAU,IAAI,KAAK,OAAO,QAAQ,KAAK,GAAG;AACpD,YAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,EAAG;AASjC,cAAM,EAAE,gBAAgB,GAAG,aAAa,IAAI;AAC5C,aAAK;AACL,aAAK,QAAQ,IAAI;AACjB,eAAO,KAAK,IAAI;AAAA,MAClB;AACA,UAAI,OAAO,KAAK,IAAI,EAAE,WAAW,EAAG;AACpC,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,IAAI,GAAG,SAAS,aAAa,EAAE,YAAY,iBAAiB,GAAG,GAAG,GAAG,CAAC;AACxH,YAAM,iBAAiB,IAAI,EAAE,GAAG,KAAK,KAAK,IAAI,OAAO,KAAK,CAAC;AAAA,IAC7D;AAIA,UAAM,qBAAqB,GAAG,oBAAoB,GAAG,cAAc;AACnE,UAAM,cAAc,MAAM,QAAQ,KAAK,WAAW,kBAAkB;AACpE,eAAW,OAAO,aAAa;AAC7B,YAAM,CAAC,UAAU,QAAQ,IAAI,IAAI,MAAM,IAAI;AAC3C,UAAI,aAAa,UAAa,CAAC,IAAI,IAAI,QAAQ,EAAG;AAClD,UAAI,QAAQ,aAAa,UAAa,CAAC,KAAK,IAAI,QAAQ,EAAG;AAC3D,YAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,oBAAoB,GAAG;AAChE,UAAI,CAAC,IAAK;AAGV,WAAK,IAAI,SAAS,KAAK,GAAG;AACxB,cAAM,IAAI;AAAA,UACR,6EAA6E,kBAAkB,UACrF,GAAG,WAAW,IAAI,KAAK;AAAA,QACnC;AAAA,MACF;AACA,YAAM,SAAS,KAAK,MAAM,MAAM,iBAAiB,EAAE,YAAY,oBAAoB,IAAI,IAAI,GAAG,KAAK,MAAM,CAAC;AAC1G,aAAO,OAAO,IAAI;AAClB,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,MAAM,GAAG,SAAS,aAAa,EAAE,YAAY,oBAAoB,IAAI,IAAI,GAAG,GAAG,CAAC;AAClI,YAAM,oBAAoB,KAAK,EAAE,GAAG,KAAK,KAAK,IAAI,OAAO,KAAK,CAAC;AAAA,IACjE;AAAA,EACF;AAKA,MAAI,YAAY,SAAS,EAAG,QAAO,EAAE,SAAS;AAG9C,QAAM,aAAa,MAAM,OAAO,eAAe;AAC/C,QAAM,kBAAkB,MAAM,YAAY;AAE1C,aAAW,CAAC,MAAM,QAAQ,KAAK,aAAa;AAC1C,UAAM,SAAS,MAAM,QAAQ,IAAI,WAAW,uBAAuB,IAAI;AACvE,QAAI,CAAC,OAAQ;AACb,UAAM,OAAO,KAAK,MAAM,MAAM,iBAAiB,EAAE,YAAY,uBAAuB,IAAI,KAAK,GAAG,QAAQ,UAAU,CAAC;AAGnH,QAAI;AACJ,QAAI;AACJ,QAAI,KAAK,SAAS,QAAW;AAC3B,mBAAa,MAAM,UAAU,KAAK,MAAM,UAAU;AAClD,0BAAoB;AAAA,IACtB,OAAO;AAEL,mBAAa,MAAM,YAAY;AAC/B,0BAAoB;AAAA,IACtB;AAIA,aAAS,IAAI,GAAG,IAAI,KAAK,YAAY,KAAK;AACxC,YAAM,UAAU,GAAG,IAAI,IAAI,CAAC;AAC5B,YAAM,WAAW,MAAM,QAAQ,IAAI,WAAW,wBAAwB,OAAO;AAC7E,UAAI,CAAC,UAAU;AACb,cAAM,IAAI;AAAA,UACR,0BAA0B,CAAC,IAAI,KAAK,UAAU,sBAAsB,IAAI;AAAA,QAE1E;AAAA,MACF;AACA,UAAI,mBAAmB;AACrB,cAAM,wBAAwB,SAAS,QAAQ;AAAA,MACjD,OAAO;AACL,cAAM,MAAM,SAAS,MAAM,GAAG,KAAK,UAAU;AAC7C,cAAM,QAAQ,MAAM,oBAAoB,SAAS,KAAK,SAAS,OAAO,YAAY,GAAG;AACrF,cAAM,EAAE,IAAAD,KAAI,MAAAC,MAAK,IAAI,MAAM,oBAAoB,OAAO,YAAY,GAAG;AACrE,cAAM,wBAAwB,SAAS,EAAE,GAAG,UAAU,KAAKD,KAAI,OAAOC,MAAK,CAAC;AAAA,MAC9E;AAAA,IACF;AAKA,UAAM,EAAE,aAAa,GAAG,KAAK,IAAI;AACjC,SAAK;AACL,UAAM,UAAsB,EAAE,GAAG,MAAM,UAAU,MAAM,MAAM,QAAQ,YAAY,eAAe,EAAE;AAClG,UAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,KAAK,UAAU,OAAO,GAAG,iBAAiB,aAAa,EAAE,YAAY,uBAAuB,IAAI,KAAK,GAAG,MAAM,CAAC;AAClJ,UAAM,uBAAuB,MAAM,EAAE,GAAG,QAAQ,KAAK,IAAI,OAAO,KAAK,CAAC;AAAA,EACxE;AAEA,SAAO,EAAE,UAAU,SAAS,gBAAgB;AAC9C;AAcA,eAAsB,SAAS,MAAoD;AACjF,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,YAAY,GAAG,KAAK,MAAM;AACpC,UAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,GAAG;AACpD,WAAO,UAAU,IAAI,eAAe,GAAG;AAAA,EACzC;AAEA,QAAM,cAAc,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC7D,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,aAAa,WAAW,OAAO,CAAC,SAAS,CAAC;AAC3F,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACpD,QAAM,YAAY,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,MAAM,CAAC;AACjE,QAAM,KAAK,MAAM,OAAO,OAAO,QAAQ,EAAE,MAAM,WAAW,GAAG,GAAG,KAAK,SAAS;AAE9E,QAAM,WAAW,IAAI,WAAW,GAAG,aAAa,GAAG,UAAU;AAC7D,WAAS,IAAI,IAAI,CAAC;AAClB,WAAS,IAAI,IAAI,WAAW,EAAE,GAAG,GAAG,UAAU;AAE9C,QAAM,SAAS,eAAe,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;AACxE,SAAO;AAAA,IACL,MAAM,EAAE,GAAG,GAAG,KAAK,0BAA0B,QAAQ,SAAS,eAAe,QAAQ,EAAE;AAAA,IACvF;AAAA,EACF;AACF;AA0CA,eAAsB,iBACpB,OACA,MACiC;AACjC,SAAO,MAAM,cAAc,iBAAiB,OAAO,IAAI;AACzD;AAOA,eAAsB,qBACpB,OACA,MACiC;AAKjC,MAAI,MAAM,SAAS,aAAa;AAC9B,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,MAAI,MAAM,SAAS,SAAS;AAC1B,UAAM,IAAI;AAAA,MACR,8EAA8E,MAAM,IAAI;AAAA,IAE1F;AAAA,EACF;AAOA,MAAI,KAAK,aAAc,OAAM,MAAM,0BAA0B;AAE7D,QAAM,EAAE,SAAS,aAAa,IAAI,MAAM,YAAY,OAAO,IAAI;AAC/D,QAAM,EAAE,aAAa,KAAK,IAAI,MAAM,aAAa,OAAO,SAAS,KAAK,eAAe;AAMrF,MAAI;AACJ,MAAI;AACJ,MAAI,KAAK,eAAe,MAAM,iBAAiB,MAAM,MAAM;AAMzD,UAAM,YAAY,MAAM,YAAY;AACpC,UAAM,QAAQ,MAAM,YAAY,OAAO,SAAS,aAAa,SAAS;AACtE,QAAI,MAAM,KAAK,SAAS,GAAG;AACzB,sBAAgB,MAAM;AACtB,mBAAa,MAAM;AACnB,WAAK,IAAI,mBAAmB,SAAS;AAAA,IACvC;AAAA,EACF;AAMA,QAAM,QAAQ,MAAM,WAAW,OAAO,SAAS,MAAM,KAAK,eAAe;AACzE,MAAI,MAAM,QAAS,MAAK,IAAI,iBAAiB,MAAM,OAAO;AAI1D,QAAM,kBAAkB,KAAK,eAAe,MAAM,aAAa,OAAO,SAAS,MAAM,KAAK,eAAe,IAAI,CAAC;AAC9G,QAAM,WAA8D,CAAC;AACrE,MAAI,OAAO,KAAK,eAAe,EAAE,SAAS,EAAG,UAAS,kBAAkB,IAAI;AAC5E,MAAI,cAAe,UAAS,iBAAiB,IAAI;AACjD,aAAW,CAAC,YAAY,OAAO,KAAK,OAAO,QAAQ,MAAM,QAAQ,EAAG,UAAS,UAAU,IAAI;AAC3F,QAAM,cAAc,OAAO,KAAK,QAAQ,EAAE,SAAS;AAEnD,QAAM,EAAE,MAAM,YAAY,IAAI,MAAM,SAAS,IAAI;AAMjD,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IACJ,YAAY;AAAA,IACZ,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,OAAO;AAAA,IACP,aAAa;AAAA,IACb,QAAQ,yBAAyB,KAAK,MAAM;AAAA,EAC9C,CAAC;AAID,QAAM,EAAE,MAAM,UAAU,IAAI,MAAM,iBAAiB;AACnD,QAAM,SAAS;AAAA,IACb,eAAe;AAAA,IACf,cAAc;AAAA,IACd,eAAc,oBAAI,KAAK,GAAE,YAAY;AAAA,IACrC,cAAc;AAAA;AAAA,IACd,UAAU,CAAC;AAAA,IACX;AAAA,IACA,GAAI,cAAc,EAAE,WAAW,SAAS,IAAI,CAAC;AAAA,IAC7C,GAAI,aAAa,EAAE,YAAY,EAAE,MAAM,WAAW,MAAM,OAAO,WAAW,OAAO,IAAI,WAAW,GAAG,EAAE,IAAI,CAAC;AAAA,EAC5G;AACA,QAAM,cAAc,KAAK,UAAU,+BAA+B,KAAK,UAAU,MAAM,GAAG,IAAI,CAAC;AAK/F,QAAM,SAAS,aAAa;AAC5B,QAAM,cAAc,MAAM,qBAAqB;AAAA,IAC7C;AAAA,IACA;AAAA,IACA,aAAa,KAAK;AAAA,IAClB,cAAc;AAAA,MACZ,YAAY;AAAA,MACZ,cAAc,EAAE,GAAG,KAAK,GAAG,KAAK,KAAK,KAAK,QAAQ,KAAK,OAAO;AAAA;AAAA,IAChE;AAAA,EACF,CAAC;AAED,SAAO,EAAE,aAAa,aAAa,QAAQ,KAAK,QAAQ,aAAa;AACvE;","names":["plaintext","iv","data"]}

package/dist/{chunk-FNSMZQS4.js → chunk-5IHGJHWC.js}

@@ -2,7 +2,7 @@ import {
   OverlayBaseIsVirtualError,
   OverlayCollectionUnavailableError,
   OverlayNameCollisionError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-Z3BZXPRO.js";
 
 // src/with-formula/overlay-views/registry.ts
 var OverlayedViewRegistry = class {
@@ -68,4 +68,4 @@ var OverlayedViewRegistry = class {
 export {
   OverlayedViewRegistry
 };
-//# sourceMappingURL=chunk-FNSMZQS4.js.map
+//# sourceMappingURL=chunk-5IHGJHWC.js.map

package/dist/{chunk-4I72F5DF.js → chunk-5LZZQMIC.js}

@@ -1,17 +1,17 @@
 import {
   freezeAndDeleteClosure,
   randomId
-} from "./chunk-FZ6NYJ7L.js";
+} from "./chunk-QQRRKO7W.js";
 import {
   buildAccessibleBundle,
   resolveAccessibleCollections
-} from "./chunk-FFDNKRCY.js";
+} from "./chunk-S6PJ6ZKE.js";
 import {
-  NOYDB_FORMAT_VERSION
-} from "./chunk-YPYHVOXP.js";
+  buildRecordEnvelope
+} from "./chunk-FX3UIDCS.js";
 import {
   NoydbError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-Z3BZXPRO.js";
 
 // src/with-audit/portability/request-withdrawal.ts
 var WITHDRAWAL_REQUESTS_COLLECTION = "_user_withdrawal_requests";
@@ -24,14 +24,11 @@ var WithdrawalRequestError = class extends NoydbError {
 function writeRequest(vault, req, expectedVersion) {
   const { name: vaultName, adapter } = vault._introspectState();
   const body = JSON.stringify(req);
-  const env = {
-    _noydb: NOYDB_FORMAT_VERSION,
-    _v: expectedVersion + 1,
-    _ts: req.decidedAt ?? req.requestedAt,
-    _iv: "",
-    _data: body,
-    _by: req.decidedBy ?? req.requester
-  };
+  const actor = req.decidedBy ?? req.requester;
+  const env = buildRecordEnvelope(
+    { collection: WITHDRAWAL_REQUESTS_COLLECTION, id: req.requestId, by: actor, version: expectedVersion + 1 },
+    { ts: req.decidedAt ?? req.requestedAt, iv: "", data: body }
+  );
   return adapter.put(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, req.requestId, env, expectedVersion);
 }
 async function readRequest(vault, requestId) {
@@ -161,4 +158,4 @@ export {
   approveWithdrawal,
   rejectWithdrawal
 };
-//# sourceMappingURL=chunk-4I72F5DF.js.map
+//# sourceMappingURL=chunk-5LZZQMIC.js.map

package/dist/chunk-5LZZQMIC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/portability/request-withdrawal.ts"],"sourcesContent":["/**\n * Two-party withdrawal ceremony.\n *\n * The conservative counterpart to `unilateralWithdrawal`: a non-owner —\n * including a read-only `client`/`viewer` who cannot self-serve a deletion —\n * files a durable REQUEST; an owner/admin reviews it and either APPROVES\n * (extract-and-dispose under firm authority) or REJECTS it. Every step is\n * audited in the tamper-evident ledger.\n *\n *   requester:  vault.user.requestWithdrawal({ scope, disposition?, legalBasis? })\n *   owner:      vault.user.listWithdrawalRequests()\n *               vault.user.approveWithdrawal(requestId, { reKey })  → { bundle, snapshot? }\n *               vault.user.rejectWithdrawal(requestId, { reason })\n *\n * Requests live in the reserved `_user_withdrawal_requests` namespace. The\n * record body is plaintext metadata (collection names + disposition + legal\n * basis — none secret in this trust model; the owner sees the data anyway) and\n * carries NO secret: the re-key secret is supplied by the approver at\n * approval time and conveyed to the requester out-of-band, so no secret is\n * stored at rest.\n */\nimport type { Vault } from '../../kernel/vault.js'\nimport { buildRecordEnvelope } from '../../kernel/enclave/index.js'\nimport { NoydbError } from '../../kernel/errors.js'\nimport { resolveAccessibleCollections, buildAccessibleBundle } from './export-accessible.js'\nimport { freezeAndDeleteClosure, randomId, type FrozenSnapshotRef, type WithdrawResult } from './withdraw-accessible.js'\n\nexport const WITHDRAWAL_REQUESTS_COLLECTION = '_user_withdrawal_requests'\n\n/** Raised when a request is missing, already decided, or expired. */\nexport class WithdrawalRequestError extends NoydbError {\n  constructor(message: string) {\n    super('WITHDRAWAL_REQUEST', message)\n    this.name = 'WithdrawalRequestError'\n  }\n}\n\nexport type WithdrawalRequestStatus = 'pending' | 'approved' | 'rejected'\n\nexport interface WithdrawalRequest {\n  readonly requestId: string\n  readonly requester: string\n  readonly collections: readonly string[]\n  readonly disposition: 'delete' | 'freeze'\n  readonly legalBasis?: string\n  readonly status: WithdrawalRequestStatus\n  readonly requestedAt: string\n  readonly expiresAt?: string\n  readonly decidedAt?: string\n  readonly decidedBy?: string\n  readonly rejectReason?: string\n  readonly snapshotSha256?: string\n}\n\nexport interface RequestWithdrawalOptions {\n  readonly scope?: { readonly collections?: readonly string[] }\n  readonly disposition?: 'delete' | 'freeze'\n  readonly legalBasis?: string\n  /** Time-to-live in ms; after this the request can no longer be approved. */\n  readonly expiresInMs?: number\n}\n\nexport interface RequestWithdrawalResult {\n  readonly requestId: string\n  readonly status: WithdrawalRequestStatus\n  readonly expiresAt?: string\n}\n\nfunction writeRequest(vault: Vault, req: WithdrawalRequest, expectedVersion: number): Promise<void> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const body = JSON.stringify(req)\n  const actor = req.decidedBy ?? req.requester\n  const env = buildRecordEnvelope(\n    { collection: WITHDRAWAL_REQUESTS_COLLECTION, id: req.requestId, by: actor, version: expectedVersion + 1 },\n    { ts: req.decidedAt ?? req.requestedAt, iv: '', data: body},\n  )\n  return adapter.put(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, req.requestId, env, expectedVersion)\n}\n\nasync function readRequest(vault: Vault, requestId: string): Promise<{ req: WithdrawalRequest; version: number }> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, requestId)\n  if (!env) throw new WithdrawalRequestError(`withdrawal request \"${requestId}\" not found`)\n  return { req: JSON.parse(env._data) as WithdrawalRequest, version: env._v }\n}\n\n/**\n * Requester side. Files a durable request for the caller's accessible scope.\n * Gated by `user-request-withdrawal` (checked in the UserApi wrapper).\n */\nexport async function requestWithdrawal(\n  vault: Vault,\n  opts: RequestWithdrawalOptions = {},\n): Promise<RequestWithdrawalResult> {\n  const { keyring } = vault._introspectState()\n  // Resolve the requester's accessible collections (read access defines \"theirs\";\n  // the owner — who can delete anything — executes the disposition on approval).\n  const collections = resolveAccessibleCollections(keyring, opts.scope, false)\n  if (!collections || collections.length === 0) {\n    throw new WithdrawalRequestError(\n      'requestWithdrawal needs a concrete scope.collections (the caller has all-collection access — name the collections to withdraw)',\n    )\n  }\n  const requestId = `wr-${randomId()}`\n  const requestedAt = new Date().toISOString()\n  const req: WithdrawalRequest = {\n    requestId, requester: keyring.userId, collections, disposition: opts.disposition ?? 'delete',\n    status: 'pending', requestedAt,\n    ...(opts.legalBasis ? { legalBasis: opts.legalBasis } : {}),\n    ...(opts.expiresInMs ? { expiresAt: new Date(Date.parse(requestedAt) + opts.expiresInMs).toISOString() } : {}),\n  }\n  await writeRequest(vault, req, 0) // create-only\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: keyring.userId, payloadHash: '',\n    reason: `user-withdrawal-request:${requestId}:${keyring.userId}`,\n  })\n  return { requestId, status: 'pending', ...(req.expiresAt ? { expiresAt: req.expiresAt } : {}) }\n}\n\n/** Owner side. List filed requests (optionally by status). */\nexport async function listWithdrawalRequests(\n  vault: Vault,\n  opts: { status?: WithdrawalRequestStatus } = {},\n): Promise<WithdrawalRequest[]> {\n  const { name: vaultName, adapter } = vault._introspectState()\n  const ids = await adapter.list(vaultName, WITHDRAWAL_REQUESTS_COLLECTION)\n  const out: WithdrawalRequest[] = []\n  for (const id of ids) {\n    const env = await adapter.get(vaultName, WITHDRAWAL_REQUESTS_COLLECTION, id)\n    if (!env) continue\n    const req = JSON.parse(env._data) as WithdrawalRequest\n    if (!opts.status || req.status === opts.status) out.push(req)\n  }\n  return out\n}\n\nfunction assertApprover(vault: Vault): string {\n  const { keyring } = vault._introspectState()\n  // FR-6: custodian is INTENTIONALLY excluded (SAFER default — review flag).\n  // Approving a two-party withdrawal is a destructive extract-and-dispose\n  // exercised under FIRM authority — a governance act adjacent to grant/revoke,\n  // which a non-owning custodian cannot do. It stays owner/admin-only.\n  if (keyring.role !== 'owner' && keyring.role !== 'admin') {\n    throw new WithdrawalRequestError('approveWithdrawal / rejectWithdrawal require an owner or admin')\n  }\n  return keyring.userId\n}\n\nfunction assertPending(req: WithdrawalRequest): void {\n  if (req.status !== 'pending') {\n    throw new WithdrawalRequestError(`withdrawal request \"${req.requestId}\" is already ${req.status}`)\n  }\n  if (req.expiresAt && Date.now() > Date.parse(req.expiresAt)) {\n    throw new WithdrawalRequestError(`withdrawal request \"${req.requestId}\" expired at ${req.expiresAt}`)\n  }\n}\n\nexport interface ApproveWithdrawalOptions {\n  /** Re-key the handed-back bundle to a secret the requester will use. */\n  readonly reKey?: { readonly secret: string }\n}\n\n/**\n * Owner side. Extract the requester's recorded scope under firm authority,\n * dispose of the source per the request's disposition, mark the request\n * approved, and return the re-keyed bundle to hand back. Gated by\n * `approve-user-withdrawal` (checked in the UserApi wrapper) + owner/admin role.\n */\nexport async function approveWithdrawal(\n  vault: Vault,\n  requestId: string,\n  opts: ApproveWithdrawalOptions = {},\n): Promise<WithdrawResult> {\n  const approver = assertApprover(vault)\n  const { req, version } = await readRequest(vault, requestId)\n  assertPending(req)\n\n  // 1. Produce the requester's re-keyed portable copy FIRST (owner authority\n  //    holds every DEK, so the recorded collections are all readable).\n  const bundle = await buildAccessibleBundle(vault, [...req.collections], opts.reKey)\n\n  // 2. + 3. dispose of the source (freeze snapshot, optional → delete-closure).\n  const snapshot: FrozenSnapshotRef | undefined = await freezeAndDeleteClosure(vault, req.collections, {\n    disposition: req.disposition, actorUserId: approver, withdrawalId: `wd-${requestId}`,\n  })\n\n  // 4. mark approved + audit (OCC against the version we read).\n  const decidedAt = new Date().toISOString()\n  await writeRequest(vault, {\n    ...req, status: 'approved', decidedAt, decidedBy: approver,\n    ...(snapshot ? { snapshotSha256: snapshot.sha256 } : {}),\n  }, version)\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: approver, payloadHash: '',\n    reason: `user-withdrawal-approved:${requestId}:${req.requester}:${req.disposition}`,\n  })\n\n  return snapshot ? { bundle, snapshot } : { bundle }\n}\n\nexport interface RejectWithdrawalOptions {\n  readonly reason?: string\n}\n\n/** Owner side. Decline a pending request (no data is touched). */\nexport async function rejectWithdrawal(\n  vault: Vault,\n  requestId: string,\n  opts: RejectWithdrawalOptions = {},\n): Promise<WithdrawalRequest> {\n  const approver = assertApprover(vault)\n  const { req, version } = await readRequest(vault, requestId)\n  assertPending(req)\n  const decidedAt = new Date().toISOString()\n  const updated: WithdrawalRequest = {\n    ...req, status: 'rejected', decidedAt, decidedBy: approver,\n    ...(opts.reason ? { rejectReason: opts.reason } : {}),\n  }\n  await writeRequest(vault, updated, version)\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: approver, payloadHash: '',\n    reason: `user-withdrawal-rejected:${requestId}:${req.requester}`,\n  })\n  return updated\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA2BO,IAAM,iCAAiC;AAGvC,IAAM,yBAAN,cAAqC,WAAW;AAAA,EACrD,YAAY,SAAiB;AAC3B,UAAM,sBAAsB,OAAO;AACnC,SAAK,OAAO;AAAA,EACd;AACF;AAiCA,SAAS,aAAa,OAAc,KAAwB,iBAAwC;AAClG,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,OAAO,KAAK,UAAU,GAAG;AAC/B,QAAM,QAAQ,IAAI,aAAa,IAAI;AACnC,QAAM,MAAM;AAAA,IACV,EAAE,YAAY,gCAAgC,IAAI,IAAI,WAAW,IAAI,OAAO,SAAS,kBAAkB,EAAE;AAAA,IACzG,EAAE,IAAI,IAAI,aAAa,IAAI,aAAa,IAAI,IAAI,MAAM,KAAI;AAAA,EAC5D;AACA,SAAO,QAAQ,IAAI,WAAW,gCAAgC,IAAI,WAAW,KAAK,eAAe;AACnG;AAEA,eAAe,YAAY,OAAc,WAAyE;AAChH,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gCAAgC,SAAS;AAClF,MAAI,CAAC,IAAK,OAAM,IAAI,uBAAuB,uBAAuB,SAAS,aAAa;AACxF,SAAO,EAAE,KAAK,KAAK,MAAM,IAAI,KAAK,GAAwB,SAAS,IAAI,GAAG;AAC5E;AAMA,eAAsB,kBACpB,OACA,OAAiC,CAAC,GACA;AAClC,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAG3C,QAAM,cAAc,6BAA6B,SAAS,KAAK,OAAO,KAAK;AAC3E,MAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,MAAM,SAAS,CAAC;AAClC,QAAM,eAAc,oBAAI,KAAK,GAAE,YAAY;AAC3C,QAAM,MAAyB;AAAA,IAC7B;AAAA,IAAW,WAAW,QAAQ;AAAA,IAAQ;AAAA,IAAa,aAAa,KAAK,eAAe;AAAA,IACpF,QAAQ;AAAA,IAAW;AAAA,IACnB,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IACzD,GAAI,KAAK,cAAc,EAAE,WAAW,IAAI,KAAK,KAAK,MAAM,WAAW,IAAI,KAAK,WAAW,EAAE,YAAY,EAAE,IAAI,CAAC;AAAA,EAC9G;AACA,QAAM,aAAa,OAAO,KAAK,CAAC;AAChC,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,QAAQ;AAAA,IAAQ,aAAa;AAAA,IACzF,QAAQ,2BAA2B,SAAS,IAAI,QAAQ,MAAM;AAAA,EAChE,CAAC;AACD,SAAO,EAAE,WAAW,QAAQ,WAAW,GAAI,IAAI,YAAY,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC,EAAG;AAChG;AAGA,eAAsB,uBACpB,OACA,OAA6C,CAAC,GAChB;AAC9B,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,QAAM,MAAM,MAAM,QAAQ,KAAK,WAAW,8BAA8B;AACxE,QAAM,MAA2B,CAAC;AAClC,aAAW,MAAM,KAAK;AACpB,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,gCAAgC,EAAE;AAC3E,QAAI,CAAC,IAAK;AACV,UAAM,MAAM,KAAK,MAAM,IAAI,KAAK;AAChC,QAAI,CAAC,KAAK,UAAU,IAAI,WAAW,KAAK,OAAQ,KAAI,KAAK,GAAG;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAsB;AAC5C,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAK3C,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI,uBAAuB,gEAAgE;AAAA,EACnG;AACA,SAAO,QAAQ;AACjB;AAEA,SAAS,cAAc,KAA8B;AACnD,MAAI,IAAI,WAAW,WAAW;AAC5B,UAAM,IAAI,uBAAuB,uBAAuB,IAAI,SAAS,gBAAgB,IAAI,MAAM,EAAE;AAAA,EACnG;AACA,MAAI,IAAI,aAAa,KAAK,IAAI,IAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC3D,UAAM,IAAI,uBAAuB,uBAAuB,IAAI,SAAS,gBAAgB,IAAI,SAAS,EAAE;AAAA,EACtG;AACF;AAaA,eAAsB,kBACpB,OACA,WACA,OAAiC,CAAC,GACT;AACzB,QAAM,WAAW,eAAe,KAAK;AACrC,QAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,YAAY,OAAO,SAAS;AAC3D,gBAAc,GAAG;AAIjB,QAAM,SAAS,MAAM,sBAAsB,OAAO,CAAC,GAAG,IAAI,WAAW,GAAG,KAAK,KAAK;AAGlF,QAAM,WAA0C,MAAM,uBAAuB,OAAO,IAAI,aAAa;AAAA,IACnG,aAAa,IAAI;AAAA,IAAa,aAAa;AAAA,IAAU,cAAc,MAAM,SAAS;AAAA,EACpF,CAAC;AAGD,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,aAAa,OAAO;AAAA,IACxB,GAAG;AAAA,IAAK,QAAQ;AAAA,IAAY;AAAA,IAAW,WAAW;AAAA,IAClD,GAAI,WAAW,EAAE,gBAAgB,SAAS,OAAO,IAAI,CAAC;AAAA,EACxD,GAAG,OAAO;AACV,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO;AAAA,IAAU,aAAa;AAAA,IACnF,QAAQ,4BAA4B,SAAS,IAAI,IAAI,SAAS,IAAI,IAAI,WAAW;AAAA,EACnF,CAAC;AAED,SAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,EAAE,OAAO;AACpD;AAOA,eAAsB,iBACpB,OACA,WACA,OAAgC,CAAC,GACL;AAC5B,QAAM,WAAW,eAAe,KAAK;AACrC,QAAM,EAAE,KAAK,QAAQ,IAAI,MAAM,YAAY,OAAO,SAAS;AAC3D,gBAAc,GAAG;AACjB,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,UAA6B;AAAA,IACjC,GAAG;AAAA,IAAK,QAAQ;AAAA,IAAY;AAAA,IAAW,WAAW;AAAA,IAClD,GAAI,KAAK,SAAS,EAAE,cAAc,KAAK,OAAO,IAAI,CAAC;AAAA,EACrD;AACA,QAAM,aAAa,OAAO,SAAS,OAAO;AAC1C,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO;AAAA,IAAU,aAAa;AAAA,IACnF,QAAQ,4BAA4B,SAAS,IAAI,IAAI,SAAS;AAAA,EAChE,CAAC;AACD,SAAO;AACT;","names":[]}

package/dist/{chunk-JXIDGFKS.js → chunk-5O5ZSW7N.js}

@@ -1,12 +1,13 @@
 import {
   ValidationError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-Z3BZXPRO.js";
 
 // src/with-audit/periods/window.ts
 var PERIODS_COLLECTION = "_periods";
 var PERIOD_FREEZES_COLLECTION = "_period_freezes";
 var PERIOD_ARCHIVES_COLLECTION = "_period_archives";
 var PERIOD_TARGET_PURGES_COLLECTION = "_period_target_purges";
+var PERIOD_REOPENS_COLLECTION = "_period_reopens";
 function periodExclusiveUpperBound(endDate) {
   const ms = Date.parse(endDate);
   if (Number.isNaN(ms)) throw new ValidationError(`freezePeriod: unparseable period endDate "${endDate}".`);
@@ -19,6 +20,7 @@ export {
   PERIOD_FREEZES_COLLECTION,
   PERIOD_ARCHIVES_COLLECTION,
   PERIOD_TARGET_PURGES_COLLECTION,
+  PERIOD_REOPENS_COLLECTION,
   periodExclusiveUpperBound
 };
-//# sourceMappingURL=chunk-JXIDGFKS.js.map
+//# sourceMappingURL=chunk-5O5ZSW7N.js.map

package/dist/chunk-5O5ZSW7N.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-audit/periods/window.ts"],"sourcesContent":["/**\n * Pure period-window primitives — the reserved collection names and the\n * exclusive-upper-bound computation shared by freeze (#604), archive (#613),\n * target-purge (#615) and the period-scoped sync pull (#807).\n *\n * Deliberately dependency-light (kernel errors only): the sync engine\n * (`with-sync/period-scope.ts`) imports THIS module, not\n * `periods.ts`, so a period-scoped pull never drags the ledger hash-chain\n * machinery (`sha256Hex`/`canonicalJson`) into a bundle that opted out of\n * the periods service.\n */\nimport { ValidationError } from '../../kernel/errors.js'\n\n/** The reserved collection name holding closed-period metadata. */\nexport const PERIODS_COLLECTION = '_periods'\n\n/** Sibling of {@link PERIODS_COLLECTION} holding freeze companions (#604). */\nexport const PERIOD_FREEZES_COLLECTION = '_period_freezes'\n\n/** Sibling of {@link PERIODS_COLLECTION} holding archive companions (#613). */\nexport const PERIOD_ARCHIVES_COLLECTION = '_period_archives'\n\n/** Sibling of {@link PERIODS_COLLECTION} holding target-purge companions (#615). */\nexport const PERIOD_TARGET_PURGES_COLLECTION = '_period_target_purges'\n\n/**\n * Sibling of {@link PERIODS_COLLECTION} holding reopen/reclose companions (#1022).\n *\n * Unlike the freeze / archive / target-purge companions — each a single,\n * idempotent, once-only record — this one holds an APPEND-ONLY EVENT LIST,\n * because reopening is a repeating cycle: a month can be closed, reopened,\n * reclosed, and reopened again. The audit value is the sequence, not the\n * latest state.\n */\nexport const PERIOD_REOPENS_COLLECTION = '_period_reopens'\n\n/**\n * Exclusive upper bound for a period's delete-marker purge window (#604).\n * Markers carry no business date (empty body), only write-time `_ts`, so freeze\n * purges markers with `_ts < bound`, `bound` being the instant just after the\n * period's inclusive `endDate`: a date-only `endDate` seals through end-of-day\n * → next midnight; a full-timestamp `endDate` seals through that instant → +1ms.\n */\nexport function periodExclusiveUpperBound(endDate: string): string {\n  const ms = Date.parse(endDate)\n  if (Number.isNaN(ms)) throw new ValidationError(`freezePeriod: unparseable period endDate \"${endDate}\".`)\n  const dateOnly = /^\\d{4}-\\d{2}-\\d{2}$/.test(endDate)\n  return new Date(ms + (dateOnly ? 86_400_000 : 1)).toISOString()\n}\n"],"mappings":";;;;;AAcO,IAAM,qBAAqB;AAG3B,IAAM,4BAA4B;AAGlC,IAAM,6BAA6B;AAGnC,IAAM,kCAAkC;AAWxC,IAAM,4BAA4B;AASlC,SAAS,0BAA0B,SAAyB;AACjE,QAAM,KAAK,KAAK,MAAM,OAAO;AAC7B,MAAI,OAAO,MAAM,EAAE,EAAG,OAAM,IAAI,gBAAgB,6CAA6C,OAAO,IAAI;AACxG,QAAM,WAAW,sBAAsB,KAAK,OAAO;AACnD,SAAO,IAAI,KAAK,MAAM,WAAW,QAAa,EAAE,EAAE,YAAY;AAChE;","names":[]}

package/dist/{chunk-CEJWMBXO.js → chunk-5OT4G5N5.js}

@@ -1,7 +1,10 @@
+import {
+  validateProjectionLegs
+} from "./chunk-GANFIM2M.js";
 import {
   MaterializedViewConfigError,
   ValidationError
-} from "./chunk-HNGSV2YC.js";
+} from "./chunk-Z3BZXPRO.js";
 
 // src/with-formula/materialized-views/with-materialized-view.ts
 function withMaterializedView(spec) {
@@ -134,6 +137,7 @@ function withMaterializedView(spec) {
       }
       seenAs.add(l.as);
     }
+    validateProjectionLegs(spec.name, spec.projection);
     if (Array.isArray(spec.groupBy) && spec.groupBy.length === 0) {
       throw new MaterializedViewConfigError(
         `withMaterializedView "${spec.name}": groupBy must not be an empty array \u2014 omit it or provide at least one field name`
@@ -177,4 +181,4 @@ function withMaterializedView(spec) {
 export {
   withMaterializedView
 };
-//# sourceMappingURL=chunk-CEJWMBXO.js.map
+//# sourceMappingURL=chunk-5OT4G5N5.js.map