@noy-db/hub 0.3.0-pre.1 → 0.3.0-pre.11

package/dist/chunk-MCEKIAO4.js

@@ -0,0 +1,367 @@
+import {
+  loadVaultPolicy,
+  saveVaultPolicy
+} from "./chunk-DIRRS7WP.js";
+import {
+  PolicyDeniedError,
+  ValidationError
+} from "./chunk-FH542DDY.js";
+
+// src/with-party/policy/presets.ts
+var PERSONAL_POLICY = Object.freeze({
+  passphrase: {
+    minWords: 6,
+    minWordLength: 3,
+    rejectRepeatedAdjacent: true
+  },
+  gates: {
+    "rotate-passphrase": {
+      minTier: 1,
+      // Any second factor satisfies the gate — off-device kinds (TOTP,
+      // email-OTP, paper recovery, roaming WebAuthn) are the strongest;
+      // platform-bound kinds (platform WebAuthn, password, PIN) are
+      // accepted because requiring "something off-device" is overkill
+      // for personal/SMB threat models. Consumers needing the off-device
+      // guarantee should use STRICT_POLICY or override this gate.
+      factors: [{
+        anyOf: [
+          "totp",
+          "email-otp",
+          "recovery",
+          "webauthn-roaming",
+          "webauthn-platform",
+          "password",
+          "pin"
+        ]
+      }]
+    },
+    "recover-passphrase": {
+      minTier: 1,
+      enabled: true
+    },
+    // rotate-recovery: deliberate paper-sheet regeneration
+    // when the user remembers their passphrase. PERSONAL allows tier-1 —
+    // knowing the passphrase is enough.
+    "rotate-recovery": { minTier: 1 },
+    "enroll-authenticator": { minTier: 1 },
+    "remove-authenticator": { minTier: 1 },
+    // update-authenticator: meta-only mutation (slot rename, label
+    // changes). Symmetric with enroll/remove under PERSONAL — tier-1
+    // unlock alone. The structural anti-slot-swap guard inside the
+    // implementation enforces wrap-material/id/method immutability
+    // regardless of this gate's settings.
+    "update-authenticator": { minTier: 1 },
+    "rotate-unlock": { minTier: 2 },
+    "enroll-user": { minTier: 1 },
+    "revoke-user": { minTier: 1 },
+    // Peer-recovery is a high-trust intentional op — co-owners
+    // recovering each other should not need an off-device factor in
+    // the personal/SMB threat model (the partner is already vetted by
+    // virtue of being a co-owner). Tier-1 unlock is the floor; the
+    // STRICT preset adds a recovery/email-OTP requirement.
+    "peer-recover-user": { minTier: 1 },
+    // update-user: post-grant identity mutation (role/displayName/
+    // permissions). PERSONAL_POLICY treats this on par with enroll-user
+    // / revoke-user — tier-1 unlock alone. The role-elevation guard
+    // inside the implementation is the structural backstop that this
+    // gate's settings cannot weaken.
+    "update-user": { minTier: 1 },
+    "export-bundle": { minTier: 1 },
+    "export-plaintext": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    "view-user-auth": {
+      minTier: 1,
+      enabled: false
+    },
+    // ─── User envelope gates ──────────────────────────────────────────
+    // edit-own-profile: tier 3 floor — any active session can edit their
+    //   own profile/preferences. Tightening to require a TOTP for
+    //   profile changes is a one-line override.
+    // view-team-profiles: tier 2 floor — an authenticated session can
+    //   read teammates' profiles (display names, avatars, locales).
+    //   Setting `enabled: false` makes vault.user.list() return only
+    //   self (privacy-strict opt-out).
+    "edit-own-profile": { minTier: 3 },
+    "view-team-profiles": { minTier: 2 },
+    // client-unilateral-withdraw: a non-owner's self-service DESTRUCTIVE
+    // withdrawal (export-and-delete/freeze). Fail-closed by default —
+    // the firm opts in per jurisdiction/contract (e.g. GDPR Art. 17).
+    // Listed explicitly (not just relying on the built-in default) so it is
+    // discoverable in describeGate / policy dumps.
+    "client-unilateral-withdraw": { minTier: 1, enabled: false },
+    // Two-party withdrawal: filing a request is non-destructive
+    // (tier-1, enabled so a read-only client can ask); deciding it is the
+    // destructive step (tier-2 floor + owner/admin role, enforced in code).
+    "user-request-withdrawal": { minTier: 1 },
+    "approve-user-withdrawal": { minTier: 2 }
+  }
+});
+var STRICT_POLICY = Object.freeze({
+  passphrase: {
+    minWords: 8,
+    minWordLength: 3,
+    rejectRepeatedAdjacent: true
+  },
+  gates: {
+    "rotate-passphrase": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp", "recovery"], count: 2 }]
+    },
+    "recover-passphrase": {
+      minTier: 1,
+      enabled: true
+    },
+    // rotate-recovery: STRICT requires an off-device factor —
+    // rotating recovery is an off-site-trust event; a stolen unlocked
+    // laptop must not be able to silently mint a new sheet for the
+    // attacker. Matches the `peer-recover-user` STRICT default.
+    "rotate-recovery": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp", "webauthn-roaming"] }]
+    },
+    "enroll-authenticator": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    "remove-authenticator": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    // STRICT update-authenticator: same factor floor as enroll/remove.
+    // Even though meta changes don't touch wrap material, a malicious
+    // rename could mislead the user about which device a slot
+    // corresponds to ("MacBook Touch ID" → "iPhone Touch ID" on a
+    // shared workstation). STRICT requires a fresh factor proof.
+    "update-authenticator": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    "rotate-unlock": { minTier: 1 },
+    "enroll-user": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    "revoke-user": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    // STRICT peer-recovery: the issuer must present a recovery code
+    // OR a fresh off-device second factor at the moment of recovery.
+    // This binds the high-trust operation to a verifiable proof
+    // (recovery sheet photographed by an attacker won't suffice —
+    // they'd also need tier-1 unlock first; this gate is the freshness
+    // binding on top). Roaming WebAuthn (YubiKey-class hardware key)
+    // accepted; platform-bound kinds (Touch ID, password, PIN)
+    // intentionally excluded under STRICT because they don't survive
+    // device theft — the off-device requirement is the whole point.
+    "peer-recover-user": {
+      minTier: 1,
+      factors: [{ anyOf: ["recovery", "totp", "email-otp", "webauthn-roaming"] }]
+    },
+    // STRICT update-user: matches the enroll-user / revoke-user shape
+    // (off-device factor required). Update-user is admin-shaped — it
+    // mutates someone else's role/permissions; STRICT requires a fresh
+    // off-device factor proof so the operator affirmatively re-asserts
+    // identity at the moment of mutation. Platform-bound factors
+    // (Touch ID / password / PIN) intentionally excluded: same logic as
+    // peer-recover-user — the off-device requirement is the whole
+    // point under STRICT.
+    "update-user": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    "export-bundle": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"] }],
+      warn: { sharedDevice: "block" }
+    },
+    "export-plaintext": {
+      minTier: 1,
+      factors: [{ anyOf: ["totp", "email-otp"], count: 2 }],
+      warn: { sharedDevice: "block" }
+    },
+    "view-user-auth": {
+      minTier: 1,
+      enabled: false
+    },
+    // ─── User envelope gates ──────────────────────────────────────────
+    // STRICT: profile edits require a TOTP/email-OTP factor (typical
+    // shared-workstation hardening — your name/avatar shouldn't change
+    // without a fresh second-factor proof).
+    "edit-own-profile": {
+      minTier: 2,
+      factors: [{ anyOf: ["totp", "email-otp"] }]
+    },
+    "view-team-profiles": { minTier: 2 },
+    // STRICT: still fail-closed, but if a regulated firm flips enabled:true
+    // they inherit a two-factor proof + shared-device block for the
+    // destructive withdrawal (mirrors export-plaintext's hardening).
+    "client-unilateral-withdraw": {
+      minTier: 1,
+      enabled: false,
+      factors: [{ anyOf: ["totp", "email-otp"], count: 2 }],
+      warn: { sharedDevice: "block" }
+    },
+    // STRICT: filing stays tier-1; the destructive APPROVE demands an
+    // off-device factor + shared-device block (mirrors export-bundle).
+    "user-request-withdrawal": { minTier: 1 },
+    "approve-user-withdrawal": {
+      minTier: 2,
+      factors: [{ anyOf: ["totp", "email-otp"] }],
+      warn: { sharedDevice: "block" }
+    }
+  }
+});
+function mergePolicy(base, override) {
+  if (!override) return base;
+  const passphrase = override.passphrase ?? base.passphrase;
+  return {
+    ...passphrase !== void 0 ? { passphrase } : {},
+    gates: {
+      ...base.gates,
+      ...override.gates ?? {}
+    }
+  };
+}
+
+// src/with-party/policy/engine.ts
+var DEFAULT_FRESHNESS_MS = 5 * 60 * 1e3;
+async function checkGate(policy, gate, context) {
+  const configured = policy.gates[gate];
+  if (!configured) {
+    if (gate.startsWith("app:")) {
+      return;
+    }
+    throw deny(gate, "disabled", { minTier: 1, enabled: false });
+  }
+  if (configured.enabled === false) {
+    throw deny(gate, "disabled", configured);
+  }
+  if (context.activeTier > configured.minTier) {
+    throw deny(gate, "insufficient-tier", configured);
+  }
+  if (configured.factors && configured.factors.length > 0) {
+    const presented = context.factors ?? [];
+    const now = context.now ?? Date.now();
+    for (const requirement of configured.factors) {
+      const matches = countMatchingFactors(presented, requirement, now);
+      const need = requirement.count ?? 1;
+      if (matches.fresh < need) {
+        if (matches.totalKindMatches < need) {
+          throw deny(gate, "missing-factor", configured);
+        }
+        throw deny(gate, "stale-proof", configured);
+      }
+    }
+  }
+  if (configured.warn?.sharedDevice === "block" && context.sharedDevice === true) {
+    throw deny(gate, "shared-device-blocked", configured);
+  }
+}
+async function describeGate(policy, gate, context) {
+  try {
+    await checkGate(policy, gate, context);
+    return { ok: true };
+  } catch (err) {
+    if (err instanceof PolicyDeniedError) {
+      return { ok: false, reason: err.reason, required: err.required };
+    }
+    throw err;
+  }
+}
+function countMatchingFactors(presented, requirement, now) {
+  const freshnessMs = requirement.freshnessMs ?? DEFAULT_FRESHNESS_MS;
+  let totalKindMatches = 0;
+  let fresh = 0;
+  for (const proof of presented) {
+    if (!requirement.anyOf.includes(proof.kind)) continue;
+    totalKindMatches += 1;
+    const minted = proof.mintedAt ? Date.parse(proof.mintedAt) : now;
+    if (Number.isFinite(minted) && now - minted <= freshnessMs) {
+      fresh += 1;
+    }
+  }
+  return { totalKindMatches, fresh };
+}
+function deny(gate, reason, required) {
+  return new PolicyDeniedError(gate, reason, required);
+}
+
+// src/with-party/policy/noydb-facade.ts
+var NoydbPolicy = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  /**
+   * Touch the policy enforcer for a vault (records activity, resets
+   * idle timer). Also touches the legacy session timer. No-op if no enforcer.
+   */
+  touchPolicy(vault) {
+    this.deps.resetSessionTimer();
+    if (vault) {
+      this.deps.policyEnforcers.get(vault)?.touch();
+    }
+  }
+  /**
+   * Check that a policy-guarded operation is permitted.
+   * Throws `SessionPolicyError` if re-auth is required.
+   */
+  checkPolicyOperation(vault, op) {
+    this.deps.policyEnforcers.get(vault)?.checkOperation(op);
+  }
+  /**
+   * Read the active policy for a vault. Loads from `_meta/policy` on
+   * first call; subsequent calls hit the in-memory cache. Throws
+   * `ValidationError` if the vault has not been opened.
+   */
+  async getPolicy(vault) {
+    if (this.deps.isClosed()) throw new ValidationError("Instance is closed");
+    const cached = this.deps.policyCache.get(vault);
+    if (cached) return cached;
+    await this.bootstrapPolicy(vault);
+    return this.deps.policyCache.get(vault) ?? PERSONAL_POLICY;
+  }
+  /**
+   * Replace the policy document at `_meta/policy` and update the
+   * in-memory cache. Gated by the `enroll-user` policy (a policy
+   * change is fundamentally a privilege-management action).
+   */
+  async updatePolicy(vault, override) {
+    if (this.deps.isClosed()) throw new ValidationError("Instance is closed");
+    const current = await this.getPolicy(vault);
+    const merged = mergePolicy(current, override);
+    if (this.deps.encrypted) {
+      await saveVaultPolicy(this.deps.store, vault, merged);
+    }
+    this.deps.policyCache.set(vault, merged);
+    return merged;
+  }
+  /** Read or persist the vault policy at `_meta/policy` on first open. */
+  async bootstrapPolicy(vault, opts) {
+    const onDisk = await loadVaultPolicy(this.deps.store, vault);
+    if (onDisk) {
+      this.deps.policyCache.set(vault, onDisk);
+      await this.deps.assertRecoveryEnrolled(vault, onDisk, opts);
+      return;
+    }
+    const initial = this.deps.policyOption ? mergePolicy(PERSONAL_POLICY, this.deps.policyOption) : PERSONAL_POLICY;
+    await saveVaultPolicy(this.deps.store, vault, initial);
+    this.deps.policyCache.set(vault, initial);
+    await this.deps.assertRecoveryEnrolled(vault, initial, opts);
+  }
+};
+var createNoydbPolicy = (deps) => new NoydbPolicy(deps);
+
+export {
+  PERSONAL_POLICY,
+  STRICT_POLICY,
+  mergePolicy,
+  DEFAULT_FRESHNESS_MS,
+  checkGate,
+  describeGate,
+  createNoydbPolicy
+};
+//# sourceMappingURL=chunk-MCEKIAO4.js.map

package/dist/chunk-MELR46EF.js

@@ -0,0 +1,280 @@
+import {
+  isTombstone
+} from "./chunk-FQQF23MC.js";
+import {
+  decrypt
+} from "./chunk-HUS3J5WM.js";
+import {
+  NOYDB_FORMAT_VERSION
+} from "./chunk-CKZW6P5V.js";
+import {
+  ReadOnlyAtInstantError
+} from "./chunk-FH542DDY.js";
+
+// src/with-commit/history/history.ts
+var HISTORY_COLLECTION = "_history";
+var VERSION_PAD = 10;
+function historyId(collection, recordId, version) {
+  return `${collection}:${recordId}:${String(version).padStart(VERSION_PAD, "0")}`;
+}
+function matchesPrefix(id, collection, recordId) {
+  if (recordId) {
+    return id.startsWith(`${collection}:${recordId}:`);
+  }
+  return id.startsWith(`${collection}:`);
+}
+async function saveHistory(adapter, vault, collection, recordId, envelope) {
+  const id = historyId(collection, recordId, envelope._v);
+  await adapter.put(vault, HISTORY_COLLECTION, id, envelope);
+}
+async function getHistory(adapter, vault, collection, recordId, options) {
+  const allIds = await adapter.list(vault, HISTORY_COLLECTION);
+  const matchingIds = allIds.filter((id) => matchesPrefix(id, collection, recordId)).sort().reverse();
+  const entries = [];
+  for (const id of matchingIds) {
+    const envelope = await adapter.get(vault, HISTORY_COLLECTION, id);
+    if (!envelope) continue;
+    if (options?.from && envelope._ts < options.from) continue;
+    if (options?.to && envelope._ts > options.to) continue;
+    entries.push(envelope);
+    if (options?.limit && entries.length >= options.limit) break;
+  }
+  return entries;
+}
+async function getVersionEnvelope(adapter, vault, collection, recordId, version) {
+  const id = historyId(collection, recordId, version);
+  return adapter.get(vault, HISTORY_COLLECTION, id);
+}
+async function pruneHistory(adapter, vault, collection, recordId, options) {
+  const allIds = await adapter.list(vault, HISTORY_COLLECTION);
+  const matchingIds = allIds.filter((id) => recordId ? matchesPrefix(id, collection, recordId) : matchesPrefix(id, collection)).sort();
+  let toDelete = [];
+  if (options.keepVersions !== void 0) {
+    const keep = options.keepVersions;
+    if (matchingIds.length > keep) {
+      toDelete = matchingIds.slice(0, matchingIds.length - keep);
+    }
+  }
+  if (options.beforeDate) {
+    for (const id of matchingIds) {
+      if (toDelete.includes(id)) continue;
+      const envelope = await adapter.get(vault, HISTORY_COLLECTION, id);
+      if (envelope && envelope._ts < options.beforeDate) {
+        toDelete.push(id);
+      }
+    }
+  }
+  const uniqueDeletes = [...new Set(toDelete)];
+  for (const id of uniqueDeletes) {
+    await adapter.delete(vault, HISTORY_COLLECTION, id);
+  }
+  return uniqueDeletes.length;
+}
+async function clearHistory(adapter, vault, collection, recordId) {
+  const allIds = await adapter.list(vault, HISTORY_COLLECTION);
+  let toDelete;
+  if (collection && recordId) {
+    toDelete = allIds.filter((id) => matchesPrefix(id, collection, recordId));
+  } else if (collection) {
+    toDelete = allIds.filter((id) => matchesPrefix(id, collection));
+  } else {
+    toDelete = allIds;
+  }
+  for (const id of toDelete) {
+    await adapter.delete(vault, HISTORY_COLLECTION, id);
+  }
+  return toDelete.length;
+}
+async function tombstoneHistory(adapter, vault, collection, recordId, actor, encrypted) {
+  const allIds = await adapter.list(vault, HISTORY_COLLECTION);
+  const matchingIds = allIds.filter((id) => matchesPrefix(id, collection, recordId));
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  let count = 0;
+  for (const id of matchingIds) {
+    const env = await adapter.get(vault, HISTORY_COLLECTION, id);
+    if (!env) continue;
+    if (isTombstone(env, encrypted)) continue;
+    const tombstone = {
+      _noydb: NOYDB_FORMAT_VERSION,
+      _v: env._v,
+      _ts: now,
+      _iv: "",
+      _data: "",
+      ...actor ? { _by: actor } : {}
+    };
+    await adapter.put(vault, HISTORY_COLLECTION, id, tombstone);
+    count++;
+  }
+  return count;
+}
+
+// src/with-commit/history/time-machine.ts
+var VaultInstant = class {
+  constructor(engine, timestamp) {
+    this.engine = engine;
+    this.timestamp = timestamp;
+  }
+  engine;
+  timestamp;
+  /** Get a point-in-time view of a collection. */
+  collection(name) {
+    return new CollectionInstant(this.engine, this.timestamp, name);
+  }
+};
+var CollectionInstant = class {
+  constructor(engine, targetTs, name) {
+    this.engine = engine;
+    this.targetTs = targetTs;
+    this.name = name;
+  }
+  engine;
+  targetTs;
+  name;
+  /**
+   * Return the record as it existed at the target timestamp, or
+   * `null` if the record had not been created yet or had already been
+   * deleted by then.
+   */
+  async get(id) {
+    const envelope = await this.resolveEnvelope(id);
+    if (!envelope) return null;
+    const plaintext = this.engine.encrypted ? await decrypt(envelope._iv, envelope._data, await this.engine.getDEK(this.name)) : envelope._data;
+    return JSON.parse(plaintext);
+  }
+  /**
+   * IDs of records that existed (had at least one `put` and were not
+   * subsequently deleted) at the target timestamp.
+   *
+   * Implemented as a linear scan over history + ledger. Performance
+   * is bounded by total history size (not live-vault size), so the
+   * memory-first vault-scale cap (1K–50K records × average history
+   * depth) still applies.
+   */
+  async list() {
+    const historyIds = await collectHistoryIds(this.engine.adapter, this.engine.name, this.name);
+    const liveIds = await this.engine.adapter.list(this.engine.name, this.name);
+    const candidateIds = /* @__PURE__ */ new Set([...historyIds, ...liveIds]);
+    const alive = [];
+    for (const id of candidateIds) {
+      const env = await this.resolveEnvelope(id);
+      if (env) alive.push(id);
+    }
+    return alive.sort();
+  }
+  // ── write guards ───────────────────────────────────────────────────
+  async put(_id, _record) {
+    throw new ReadOnlyAtInstantError("put", this.targetTs);
+  }
+  async delete(_id) {
+    throw new ReadOnlyAtInstantError("delete", this.targetTs);
+  }
+  async update(_id, _patch) {
+    throw new ReadOnlyAtInstantError("update", this.targetTs);
+  }
+  // ── internals ─────────────────────────────────────────────────────
+  /**
+   * Return the envelope that represents the record's state at
+   * `targetTs`, accounting for deletes. `null` if the record didn't
+   * exist at that instant.
+   *
+   * ## Why we use the ledger as the authoritative timeline
+   *
+   * The per-version history snapshots saved by `saveHistory()` do
+   * carry a `_ts` field, but that timestamp is the moment the
+   * snapshot was *captured* (i.e. the instant right before the
+   * subsequent overwrite), not the original write time. The ledger,
+   * by contrast, records `ts` at the moment of each `put` / `delete`
+   * — it's the only source that tracks the real timeline. So:
+   *
+   *   1. Walk the ledger; find the latest entry for `(collection, id)`
+   *      with `ts ≤ targetTs`.
+   *   2. If that entry is a `delete`, the record was gone at the
+   *      target instant — return null.
+   *   3. Otherwise it's a `put` with a specific `version`. Load the
+   *      envelope for that version from history, falling back to the
+   *      live collection for the most recent version.
+   *
+   * ## Fallback when the ledger is disabled
+   *
+   * If the vault has history disabled, `getLedger()` returns null and
+   * we fall back to comparing envelope `_ts` fields. This is
+   * approximate and gets the *last write* right but may confuse the
+   * intermediate versions; adopters needing accurate time-machine
+   * reads should leave history enabled.
+   */
+  async resolveEnvelope(id) {
+    const ledger = this.engine.getLedger();
+    if (ledger) {
+      return this.resolveViaLedger(id, ledger);
+    }
+    return this.resolveViaEnvelopeTs(id);
+  }
+  async resolveViaLedger(id, ledger) {
+    const entries = await ledger.entries();
+    let latest = null;
+    for (const e of entries) {
+      if (e.collection !== this.name || e.id !== id) continue;
+      if (e.ts > this.targetTs) break;
+      if (e.op === "amendment" || e.op === "lifecycle" || e.op === "forget") continue;
+      latest = { op: e.op === "migration" ? "put" : e.op, version: e.version };
+    }
+    if (!latest) return null;
+    if (latest.op === "delete") return null;
+    return this.loadVersion(id, latest.version);
+  }
+  async resolveViaEnvelopeTs(id) {
+    const history = await getHistory(
+      this.engine.adapter,
+      this.engine.name,
+      this.name,
+      id
+    );
+    const live = await this.engine.adapter.get(this.engine.name, this.name, id);
+    const byVersion = /* @__PURE__ */ new Map();
+    for (const e of history) byVersion.set(e._v, e);
+    if (live) byVersion.set(live._v, live);
+    const sorted = [...byVersion.values()].sort(
+      (a, b) => a._ts < b._ts ? 1 : a._ts > b._ts ? -1 : 0
+    );
+    return sorted.find((e) => e._ts <= this.targetTs) ?? null;
+  }
+  /**
+   * Fetch the envelope for a specific version. The live record (most
+   * recent put) lives in the main collection; prior versions live in
+   * `_history`. We check live first because the common case after a
+   * delete is that we're trying to load the last-live version from
+   * history, and skipping live for the current-version case avoids a
+   * redundant lookup.
+   */
+  async loadVersion(id, version) {
+    const live = await this.engine.adapter.get(this.engine.name, this.name, id);
+    if (live && live._v === version) return live;
+    const historyId2 = `${this.name}:${id}:${String(version).padStart(10, "0")}`;
+    return await this.engine.adapter.get(this.engine.name, "_history", historyId2);
+  }
+};
+async function collectHistoryIds(adapter, vault, collection) {
+  const all = await adapter.list(vault, "_history");
+  const prefix = `${collection}:`;
+  const seen = /* @__PURE__ */ new Set();
+  for (const key of all) {
+    if (!key.startsWith(prefix)) continue;
+    const lastColon = key.lastIndexOf(":");
+    if (lastColon <= prefix.length) continue;
+    const middle = key.slice(prefix.length, lastColon);
+    seen.add(middle);
+  }
+  return [...seen];
+}
+
+export {
+  saveHistory,
+  getHistory,
+  getVersionEnvelope,
+  pruneHistory,
+  clearHistory,
+  tombstoneHistory,
+  VaultInstant,
+  CollectionInstant
+};
+//# sourceMappingURL=chunk-MELR46EF.js.map