@noy-db/hub 0.8.0-pre.0 → 0.8.0

package/dist/{chunk-MKXXMNJH.js → chunk-4V3Q35WG.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-LGNDFRYC.js";
 import {
   readPath
-} from "./chunk-HLEK5VAN.js";
+} from "./chunk-5WWDGFOS.js";
 
 // src/kernel/query/relate/join-on.ts
 var RANGE_OPS = /* @__PURE__ */ new Set(["<", "<=", ">", ">=", "between"]);
@@ -201,4 +201,4 @@ export {
   joinOnDispatch,
   matchDeclaredJoin
 };
-//# sourceMappingURL=chunk-MKXXMNJH.js.map
+//# sourceMappingURL=chunk-4V3Q35WG.js.map

package/dist/{chunk-A6IJU4TK.js → chunk-52MGURXO.js}

@@ -1,6 +1,6 @@
 import {
   CargoNotEnabledError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-cargo/strategy.ts
 var NO_CARGO = {
@@ -12,4 +12,4 @@ var NO_CARGO = {
 export {
   NO_CARGO
 };
-//# sourceMappingURL=chunk-A6IJU4TK.js.map
+//# sourceMappingURL=chunk-52MGURXO.js.map

package/dist/{chunk-IUWCVHQ7.js → chunk-5A4345TG.js}

@@ -1,9 +1,9 @@
 import {
   buildRecordEnvelope
-} from "./chunk-SEE332EV.js";
+} from "./chunk-EZGV6F47.js";
 import {
   ValidationError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-party/directory/cover/custom.ts
 var CUSTOM_KEY_PATTERN = /^[a-z0-9]+([.-][a-z0-9]+)+$/i;
@@ -179,7 +179,7 @@ async function loadCover(store, vault) {
   const envelope = await store.get(vault, "_meta", COVER_RECORD_ID);
   if (!envelope) return void 0;
   try {
-    const parsed = JSON.parse(envelope._data);
+    const parsed = JSON.parse(envelope._data ?? "");
     if (!isCover(parsed)) return void 0;
     return parsed;
   } catch {
@@ -230,4 +230,4 @@ export {
   resolveLocale,
   pickLocale
 };
-//# sourceMappingURL=chunk-IUWCVHQ7.js.map
+//# sourceMappingURL=chunk-5A4345TG.js.map

package/dist/{chunk-IUWCVHQ7.js.map → chunk-5A4345TG.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/with-party/directory/cover/custom.ts","../src/with-party/directory/cover/schema.ts","../src/with-party/directory/cover/storage.ts"],"sourcesContent":["/**\n * The cover's namespaced `custom` extension slot (#800) — input\n * validation, the namespace-level patch merge, and the post-merge\n * size caps.\n *\n * Like everything on the cover, `custom` is plaintext, public by\n * design, and unauthenticated — payloads are hints (display defaults,\n * routing suggestions, registry pointers), never an input to\n * security, authorization, or data-integrity decisions.\n *\n * @see https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md\n *\n * @module\n */\nimport { ValidationError } from '../../../kernel/errors.js'\nimport type { Cover, JsonValue, ResolvedCoverSchema } from './types.js'\n\n/**\n * Namespace keys must be reverse-DNS or package-style identifiers —\n * at least one dot/dash-separated segment (`noydb.viewer`,\n * `com.acme.registry` pass; a bare `config` fails), so two frameworks\n * can't collide on a bare word.\n */\nconst CUSTOM_KEY_PATTERN = /^[a-z0-9]+([.-][a-z0-9]+)+$/i\n\n/** Maximum nesting depth of a namespace payload (containers, not leaves). */\nconst MAX_CUSTOM_DEPTH = 8\n\n/**\n * Validate the owner-supplied `custom` input: the field must be a\n * plain object, every key must match {@link CUSTOM_KEY_PATTERN}, and\n * every value must be JSON-serializable (no functions, `undefined`,\n * symbols, bigints, or cycles) within the depth cap. `null` is\n * accepted — it is the delete-this-namespace directive and never\n * persists. Throws `ValidationError` on the first violation.\n */\nexport function validateCustomInput(custom: Record<string, JsonValue>): void {\n  if (custom === null || typeof custom !== 'object' || Array.isArray(custom)) {\n    throw new ValidationError(\n      `setCover: custom must be a { [namespace]: value } object, got ${\n        Array.isArray(custom) ? 'array' : typeof custom\n      }.`,\n    )\n  }\n  for (const [ns, value] of Object.entries(custom)) {\n    if (!CUSTOM_KEY_PATTERN.test(ns)) {\n      throw new ValidationError(\n        `setCover: custom namespace \"${ns}\" is invalid. Keys must be ` +\n          'reverse-DNS or package-style identifiers with at least one ' +\n          'dot/dash-separated segment (e.g. \"noydb.viewer\", \"com.acme.registry\").',\n      )\n    }\n    assertJsonValue(value, ns, 1, new Set())\n  }\n}\n\nfunction assertJsonValue(\n  value: unknown,\n  ns: string,\n  depth: number,\n  seen: Set<object>,\n): void {\n  if (value === null) return\n  const t = typeof value\n  if (t === 'string' || t === 'number' || t === 'boolean') return\n  if (t !== 'object') {\n    throw new ValidationError(\n      `setCover: custom[\"${ns}\"] contains a non-JSON value (${t}). ` +\n        'Only strings, numbers, booleans, null, arrays, and plain objects are allowed.',\n    )\n  }\n  const container = value as object\n  if (seen.has(container)) {\n    throw new ValidationError(\n      `setCover: custom[\"${ns}\"] contains a circular reference.`,\n    )\n  }\n  if (depth > MAX_CUSTOM_DEPTH) {\n    throw new ValidationError(\n      `setCover: custom[\"${ns}\"] nests deeper than the ${MAX_CUSTOM_DEPTH}-level cap.`,\n    )\n  }\n  seen.add(container)\n  const children = Array.isArray(container) ? container : Object.values(container)\n  for (const child of children) {\n    assertJsonValue(child, ns, depth + 1, seen)\n  }\n  seen.delete(container)\n}\n\n/**\n * Namespace-level patch merge for `setCover`: provided namespaces\n * replace their previous value, absent namespaces are preserved, and\n * an explicit `null` deletes that namespace (so `null` never persists\n * as a namespace value). A whole-`custom`-absent patch preserves the\n * previous custom, consistent with the other cover fields. Rationale:\n * framework A must never need read-modify-write of framework B's data.\n *\n * Returns a spreadable fragment — `{ custom }` when the merge leaves\n * at least one namespace, `{}` when it leaves none (the field is\n * dropped from the persisted document rather than stored empty).\n */\nexport function mergeCustom(\n  existing: Record<string, JsonValue> | undefined,\n  patch: Record<string, JsonValue> | undefined,\n): { custom: Record<string, JsonValue> } | Record<string, never> {\n  if (patch === undefined) {\n    return existing !== undefined ? { custom: existing } : {}\n  }\n  const merged: Record<string, JsonValue> = { ...existing }\n  for (const [ns, value] of Object.entries(patch)) {\n    if (value === null) {\n      delete merged[ns]\n    } else {\n      merged[ns] = value\n    }\n  }\n  return Object.keys(merged).length > 0 ? { custom: merged } : {}\n}\n\n/**\n * Post-merge size caps — validates the WOULD-BE-PERSISTED document\n * (after the namespace merge), so a small patch can't tip the stored\n * cover over a cap unnoticed. `maxCoverBytes` bounds the entire\n * serialized document, which also closes the unbounded locale-map\n * key-count hole for `name` / `description`. Sizes are measured as\n * `JSON.stringify` length. Throws `ValidationError` on violation.\n */\nexport function validateCoverSize(\n  cover: Cover,\n  schema: ResolvedCoverSchema,\n): void {\n  if (cover.custom !== undefined) {\n    const customSize = JSON.stringify(cover.custom).length\n    if (customSize > schema.maxCustomBytes) {\n      throw new ValidationError(\n        `setCover: custom exceeds the ${schema.maxCustomBytes}-byte cap ` +\n          `(got ${customSize} bytes serialized, after merging with the stored namespaces).`,\n      )\n    }\n  }\n  const totalSize = JSON.stringify(cover).length\n  if (totalSize > schema.maxCoverBytes) {\n    throw new ValidationError(\n      `setCover: the cover document exceeds the ${schema.maxCoverBytes}-byte cap ` +\n        `(got ${totalSize} bytes serialized).`,\n    )\n  }\n}\n","/**\n * Validate-on-write for the cover. Runs at every `setCover` call;\n * the developer's schema decides which fields are allowed and the\n * size caps that apply.\n *\n * @module\n */\nimport { ValidationError } from '../../../kernel/errors.js'\nimport { validateCustomInput } from './custom.js'\nimport type {\n  Cover,\n  CoverText,\n  JsonValue,\n  ResolvedCoverSchema,\n  CoverField,\n} from './types.js'\n\n/** Owner-supplied input — the subset of {@link Cover} the owner can set. */\nexport interface SetCoverInput {\n  readonly name?: CoverText\n  readonly description?: CoverText\n  readonly icon?: string\n  readonly defaultLocale?: string\n  /**\n   * Namespace-level patch for the cover's `custom` slot (#800):\n   * provided namespaces replace their previous value, absent\n   * namespaces are preserved, an explicit `null` deletes that\n   * namespace. Requires `'custom'` in the schema's `fields` list —\n   * the `cover: true` shorthand does NOT enable it.\n   */\n  readonly custom?: Record<string, JsonValue>\n}\n\nconst DATA_URL_PREFIX = /^data:([a-zA-Z0-9.+-]+\\/[a-zA-Z0-9.+-]+);base64,/\n\n/**\n * Validate an owner-supplied cover input against the developer's\n * resolved schema. Throws `ValidationError` on the first violation;\n * returns void on success.\n *\n * The validator is deliberately strict: every fail mode is a hard\n * error rather than a silent drop, so the owner finds out immediately\n * which field they oversized rather than discovering a truncated\n * label months later.\n */\nexport function validateCoverInput(\n  input: SetCoverInput,\n  schema: ResolvedCoverSchema,\n): void {\n  const allowed = new Set<CoverField>(schema.fields)\n\n  // Reject any key not in the schema's allowed-field list.\n  for (const key of Object.keys(input)) {\n    const known: CoverField | undefined =\n      key === 'name' || key === 'description' || key === 'icon' || key === 'defaultLocale' || key === 'custom'\n        ? key\n        : undefined\n    if (!known) {\n      throw new ValidationError(\n        `setCover: unknown field \"${key}\". ` +\n          `Allowed fields: ${[...allowed].join(', ')}.`,\n      )\n    }\n    if (!allowed.has(known)) {\n      throw new ValidationError(\n        `setCover: field \"${known}\" is not enabled in this vault's schema. ` +\n          `Allowed fields: ${[...allowed].join(', ')}.`,\n      )\n    }\n  }\n\n  if (input.name !== undefined) {\n    validateText(input.name, 'name', schema.maxStringChars)\n  }\n  if (input.description !== undefined) {\n    validateText(input.description, 'description', schema.maxStringChars)\n  }\n  if (input.icon !== undefined) {\n    validateIcon(input.icon, schema)\n  }\n  if (input.defaultLocale !== undefined && typeof input.defaultLocale !== 'string') {\n    throw new ValidationError(\n      `setCover: defaultLocale must be a string (BCP-47), got ${typeof input.defaultLocale}.`,\n    )\n  }\n  if (input.custom !== undefined) {\n    validateCustomInput(input.custom)\n  }\n}\n\nfunction validateText(\n  value: CoverText,\n  field: string,\n  maxChars: number,\n): void {\n  if (typeof value === 'string') {\n    if (value.length > maxChars) {\n      throw new ValidationError(\n        `setCover: ${field} exceeds the ${maxChars}-character cap (got ${value.length}).`,\n      )\n    }\n    return\n  }\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n    throw new ValidationError(\n      `setCover: ${field} must be a string or { [locale]: string } map, got ${typeof value}.`,\n    )\n  }\n  // Locale map. Each value must be a non-empty string within the cap.\n  for (const [locale, str] of Object.entries(value)) {\n    if (typeof str !== 'string') {\n      throw new ValidationError(\n        `setCover: ${field}[${locale}] must be a string, got ${typeof str}.`,\n      )\n    }\n    if (str.length > maxChars) {\n      throw new ValidationError(\n        `setCover: ${field}[${locale}] exceeds the ${maxChars}-character cap (got ${str.length}).`,\n      )\n    }\n  }\n}\n\nfunction validateIcon(icon: string, schema: ResolvedCoverSchema): void {\n  if (typeof icon !== 'string') {\n    throw new ValidationError(\n      `setCover: icon must be a data: URL string, got ${typeof icon}.`,\n    )\n  }\n  if (icon.length > schema.maxIconBytes) {\n    throw new ValidationError(\n      `setCover: icon exceeds the ${schema.maxIconBytes}-byte cap (got ${icon.length}).`,\n    )\n  }\n  const m = DATA_URL_PREFIX.exec(icon)\n  if (!m) {\n    throw new ValidationError(\n      'setCover: icon must be a base64 data URL ' +\n        '(`data:image/png;base64,…` or `data:image/svg+xml;base64,…`). ' +\n        'External URLs are not supported in v1.',\n    )\n  }\n  const mime = m[1]!\n  if (!schema.iconMimeTypes.includes(mime)) {\n    throw new ValidationError(\n      `setCover: icon MIME type \"${mime}\" is not allowed. ` +\n        `Permitted types: ${schema.iconMimeTypes.join(', ')}.`,\n    )\n  }\n}\n\n/**\n * Lightweight runtime predicate — used by the bundle header\n * validator to recognise a cover without requiring it. (The wire\n * discriminator keeps its frozen name: `_noydb_public: 1`.)\n */\nexport function isCover(x: unknown): x is Cover {\n  if (x === null || typeof x !== 'object' || Array.isArray(x)) return false\n  const obj = x as Record<string, unknown>\n  return obj['_noydb_public'] === 1 && typeof obj['version'] === 'number'\n}\n","/**\n * Persistence helpers for `_meta/public-envelope` — the cover's\n * frozen wire location. Mirrors the bypass-AES pattern used by\n * `_meta/handle` and `_meta/policy` — the document is plaintext\n * JSON, the envelope's `_iv` field is left empty.\n *\n * @module\n */\nimport { buildRecordEnvelope } from '../../../kernel/enclave/index.js'\nimport type { NoydbStore } from '../../../kernel/types.js'\nimport type { Cover } from './types.js'\nimport { isCover } from './schema.js'\n\n/**\n * Reserved id for the vault-level cover record. The VALUE is frozen\n * wire format — the record predates the #799 rename and stays at\n * `_meta/public-envelope` so existing vaults need no migration.\n */\nexport const COVER_RECORD_ID = 'public-envelope'\n\n/**\n * Read the cover from `_meta/public-envelope`. Returns `undefined`\n * when no cover has been persisted (fresh vault, or a vault written\n * before the feature was enabled). Tolerates corrupted documents —\n * a JSON parse failure surfaces as `undefined`, not a thrown error,\n * mirroring `_meta/handle`'s contract.\n */\nexport async function loadCover(\n  store: NoydbStore,\n  vault: string,\n): Promise<Cover | undefined> {\n  const envelope = await store.get(vault, '_meta', COVER_RECORD_ID)\n  if (!envelope) return undefined\n  try {\n    const parsed = JSON.parse(envelope._data) as unknown\n    if (!isCover(parsed)) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/** Persist the cover. Idempotent — overwrites any prior write. */\nexport async function saveCover(\n  store: NoydbStore,\n  vault: string,\n  cover: Cover,\n): Promise<void> {\n  const wireEnvelope = buildRecordEnvelope(\n    { collection: '_meta', id: COVER_RECORD_ID, version: 1 },\n    { iv: '', data: JSON.stringify(cover) },\n  )\n  await store.put(vault, '_meta', COVER_RECORD_ID, wireEnvelope)\n}\n\n/**\n * Public, no-key reader. Plain function, not a method on `Noydb` —\n * the whole point is it works without an authenticated session, so\n * a UI can show \"Acme 2026 Tax Records\" before unlocking.\n *\n * Resolves any `name` / `description` locale map through the supplied\n * `locale` (when provided). Omitting `locale` returns the raw\n * cover, which a multilingual picker can render as it pleases.\n */\nexport async function readCover(\n  store: NoydbStore,\n  vault: string,\n  opts: { readonly locale?: string } = {},\n): Promise<Cover | undefined> {\n  const raw = await loadCover(store, vault)\n  if (!raw) return undefined\n  if (opts.locale === undefined) return raw\n  return resolveLocale(raw, opts.locale)\n}\n\n/**\n * Resolve the locale-map fields (`name`, `description`) of a cover\n * to plain strings for the requested locale, falling back through\n * `defaultLocale` and then any available translation.\n *\n * @internal\n */\nexport function resolveLocale(\n  cover: Cover,\n  locale: string,\n): Cover {\n  return {\n    ...cover,\n    ...(cover.name !== undefined ? { name: pickLocale(cover.name, locale, cover.defaultLocale) } : {}),\n    ...(cover.description !== undefined ? { description: pickLocale(cover.description, locale, cover.defaultLocale) } : {}),\n  }\n}\n\n/**\n * Resolve a `string | { [locale]: string }` value to a string for a\n * given locale. Exported so the bundle reader can reuse it without\n * duplicating the fallback chain.\n *\n * **Looser than `resolveI18nText`** — the hub's record-field resolver\n * throws `LocaleNotSpecifiedError` when no translation matches, but\n * label semantics deliberately prefer \"show *something*\" over\n * throwing. The fallback chain is:\n *   1. Exact `locale` match.\n *   2. `defaultLocale` (when supplied on the cover).\n *   3. First non-empty value in the map.\n *   4. Empty string (only if every translation is empty — pathological).\n *\n * This deviation is documented in `https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md`.\n */\nexport function pickLocale(\n  value: string | Record<string, string>,\n  locale: string,\n  defaultLocale: string | undefined,\n): string {\n  if (typeof value === 'string') return value\n  if (value[locale] !== undefined && value[locale] !== '') return value[locale]\n  if (defaultLocale && value[defaultLocale] !== undefined && value[defaultLocale] !== '') {\n    return value[defaultLocale]\n  }\n  for (const v of Object.values(value)) {\n    if (v !== '') return v\n  }\n  return ''\n}\n"],"mappings":";;;;;;;;AAuBA,IAAM,qBAAqB;AAG3B,IAAM,mBAAmB;AAUlB,SAAS,oBAAoB,QAAyC;AAC3E,MAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR,iEACE,MAAM,QAAQ,MAAM,IAAI,UAAU,OAAO,MAC3C;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,IAAI,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAChD,QAAI,CAAC,mBAAmB,KAAK,EAAE,GAAG;AAChC,YAAM,IAAI;AAAA,QACR,+BAA+B,EAAE;AAAA,MAGnC;AAAA,IACF;AACA,oBAAgB,OAAO,IAAI,GAAG,oBAAI,IAAI,CAAC;AAAA,EACzC;AACF;AAEA,SAAS,gBACP,OACA,IACA,OACA,MACM;AACN,MAAI,UAAU,KAAM;AACpB,QAAM,IAAI,OAAO;AACjB,MAAI,MAAM,YAAY,MAAM,YAAY,MAAM,UAAW;AACzD,MAAI,MAAM,UAAU;AAClB,UAAM,IAAI;AAAA,MACR,qBAAqB,EAAE,iCAAiC,CAAC;AAAA,IAE3D;AAAA,EACF;AACA,QAAM,YAAY;AAClB,MAAI,KAAK,IAAI,SAAS,GAAG;AACvB,UAAM,IAAI;AAAA,MACR,qBAAqB,EAAE;AAAA,IACzB;AAAA,EACF;AACA,MAAI,QAAQ,kBAAkB;AAC5B,UAAM,IAAI;AAAA,MACR,qBAAqB,EAAE,4BAA4B,gBAAgB;AAAA,IACrE;AAAA,EACF;AACA,OAAK,IAAI,SAAS;AAClB,QAAM,WAAW,MAAM,QAAQ,SAAS,IAAI,YAAY,OAAO,OAAO,SAAS;AAC/E,aAAW,SAAS,UAAU;AAC5B,oBAAgB,OAAO,IAAI,QAAQ,GAAG,IAAI;AAAA,EAC5C;AACA,OAAK,OAAO,SAAS;AACvB;AAcO,SAAS,YACd,UACA,OAC+D;AAC/D,MAAI,UAAU,QAAW;AACvB,WAAO,aAAa,SAAY,EAAE,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC1D;AACA,QAAM,SAAoC,EAAE,GAAG,SAAS;AACxD,aAAW,CAAC,IAAI,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC/C,QAAI,UAAU,MAAM;AAClB,aAAO,OAAO,EAAE;AAAA,IAClB,OAAO;AACL,aAAO,EAAE,IAAI;AAAA,IACf;AAAA,EACF;AACA,SAAO,OAAO,KAAK,MAAM,EAAE,SAAS,IAAI,EAAE,QAAQ,OAAO,IAAI,CAAC;AAChE;AAUO,SAAS,kBACd,OACA,QACM;AACN,MAAI,MAAM,WAAW,QAAW;AAC9B,UAAM,aAAa,KAAK,UAAU,MAAM,MAAM,EAAE;AAChD,QAAI,aAAa,OAAO,gBAAgB;AACtC,YAAM,IAAI;AAAA,QACR,gCAAgC,OAAO,cAAc,kBAC3C,UAAU;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,KAAK,UAAU,KAAK,EAAE;AACxC,MAAI,YAAY,OAAO,eAAe;AACpC,UAAM,IAAI;AAAA,MACR,4CAA4C,OAAO,aAAa,kBACtD,SAAS;AAAA,IACrB;AAAA,EACF;AACF;;;ACnHA,IAAM,kBAAkB;AAYjB,SAAS,mBACd,OACA,QACM;AACN,QAAM,UAAU,IAAI,IAAgB,OAAO,MAAM;AAGjD,aAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAM,QACJ,QAAQ,UAAU,QAAQ,iBAAiB,QAAQ,UAAU,QAAQ,mBAAmB,QAAQ,WAC5F,MACA;AACN,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,4BAA4B,GAAG,sBACV,CAAC,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MAC9C;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,IAAI,KAAK,GAAG;AACvB,YAAM,IAAI;AAAA,QACR,oBAAoB,KAAK,4DACJ,CAAC,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AAEA,MAAI,MAAM,SAAS,QAAW;AAC5B,iBAAa,MAAM,MAAM,QAAQ,OAAO,cAAc;AAAA,EACxD;AACA,MAAI,MAAM,gBAAgB,QAAW;AACnC,iBAAa,MAAM,aAAa,eAAe,OAAO,cAAc;AAAA,EACtE;AACA,MAAI,MAAM,SAAS,QAAW;AAC5B,iBAAa,MAAM,MAAM,MAAM;AAAA,EACjC;AACA,MAAI,MAAM,kBAAkB,UAAa,OAAO,MAAM,kBAAkB,UAAU;AAChF,UAAM,IAAI;AAAA,MACR,0DAA0D,OAAO,MAAM,aAAa;AAAA,IACtF;AAAA,EACF;AACA,MAAI,MAAM,WAAW,QAAW;AAC9B,wBAAoB,MAAM,MAAM;AAAA,EAClC;AACF;AAEA,SAAS,aACP,OACA,OACA,UACM;AACN,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,MAAM,SAAS,UAAU;AAC3B,YAAM,IAAI;AAAA,QACR,aAAa,KAAK,gBAAgB,QAAQ,uBAAuB,MAAM,MAAM;AAAA,MAC/E;AAAA,IACF;AACA;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI;AAAA,MACR,aAAa,KAAK,sDAAsD,OAAO,KAAK;AAAA,IACtF;AAAA,EACF;AAEA,aAAW,CAAC,QAAQ,GAAG,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,QAAI,OAAO,QAAQ,UAAU;AAC3B,YAAM,IAAI;AAAA,QACR,aAAa,KAAK,IAAI,MAAM,2BAA2B,OAAO,GAAG;AAAA,MACnE;AAAA,IACF;AACA,QAAI,IAAI,SAAS,UAAU;AACzB,YAAM,IAAI;AAAA,QACR,aAAa,KAAK,IAAI,MAAM,iBAAiB,QAAQ,uBAAuB,IAAI,MAAM;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAc,QAAmC;AACrE,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAM,IAAI;AAAA,MACR,kDAAkD,OAAO,IAAI;AAAA,IAC/D;AAAA,EACF;AACA,MAAI,KAAK,SAAS,OAAO,cAAc;AACrC,UAAM,IAAI;AAAA,MACR,8BAA8B,OAAO,YAAY,kBAAkB,KAAK,MAAM;AAAA,IAChF;AAAA,EACF;AACA,QAAM,IAAI,gBAAgB,KAAK,IAAI;AACnC,MAAI,CAAC,GAAG;AACN,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,QAAM,OAAO,EAAE,CAAC;AAChB,MAAI,CAAC,OAAO,cAAc,SAAS,IAAI,GAAG;AACxC,UAAM,IAAI;AAAA,MACR,6BAA6B,IAAI,sCACX,OAAO,cAAc,KAAK,IAAI,CAAC;AAAA,IACvD;AAAA,EACF;AACF;AAOO,SAAS,QAAQ,GAAwB;AAC9C,MAAI,MAAM,QAAQ,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,EAAG,QAAO;AACpE,QAAM,MAAM;AACZ,SAAO,IAAI,eAAe,MAAM,KAAK,OAAO,IAAI,SAAS,MAAM;AACjE;;;AC9IO,IAAM,kBAAkB;AAS/B,eAAsB,UACpB,OACA,OAC4B;AAC5B,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,eAAe;AAChE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,QAAI,CAAC,QAAQ,MAAM,EAAG,QAAO;AAC7B,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,UACpB,OACA,OACA,OACe;AACf,QAAM,eAAe;AAAA,IACnB,EAAE,YAAY,SAAS,IAAI,iBAAiB,SAAS,EAAE;AAAA,IACvD,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,KAAK,EAAE;AAAA,EACxC;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,iBAAiB,YAAY;AAC/D;AAWA,eAAsB,UACpB,OACA,OACA,OAAqC,CAAC,GACV;AAC5B,QAAM,MAAM,MAAM,UAAU,OAAO,KAAK;AACxC,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,KAAK,WAAW,OAAW,QAAO;AACtC,SAAO,cAAc,KAAK,KAAK,MAAM;AACvC;AASO,SAAS,cACd,OACA,QACO;AACP,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,WAAW,MAAM,MAAM,QAAQ,MAAM,aAAa,EAAE,IAAI,CAAC;AAAA,IAChG,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,WAAW,MAAM,aAAa,QAAQ,MAAM,aAAa,EAAE,IAAI,CAAC;AAAA,EACvH;AACF;AAkBO,SAAS,WACd,OACA,QACA,eACQ;AACR,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,MAAM,MAAM,UAAa,MAAM,MAAM,MAAM,GAAI,QAAO,MAAM,MAAM;AAC5E,MAAI,iBAAiB,MAAM,aAAa,MAAM,UAAa,MAAM,aAAa,MAAM,IAAI;AACtF,WAAO,MAAM,aAAa;AAAA,EAC5B;AACA,aAAW,KAAK,OAAO,OAAO,KAAK,GAAG;AACpC,QAAI,MAAM,GAAI,QAAO;AAAA,EACvB;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/with-party/directory/cover/custom.ts","../src/with-party/directory/cover/schema.ts","../src/with-party/directory/cover/storage.ts"],"sourcesContent":["/**\n * The cover's namespaced `custom` extension slot (#800) — input\n * validation, the namespace-level patch merge, and the post-merge\n * size caps.\n *\n * Like everything on the cover, `custom` is plaintext, public by\n * design, and unauthenticated — payloads are hints (display defaults,\n * routing suggestions, registry pointers), never an input to\n * security, authorization, or data-integrity decisions.\n *\n * @see https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md\n *\n * @module\n */\nimport { ValidationError } from '../../../kernel/errors.js'\nimport type { Cover, JsonValue, ResolvedCoverSchema } from './types.js'\n\n/**\n * Namespace keys must be reverse-DNS or package-style identifiers —\n * at least one dot/dash-separated segment (`noydb.viewer`,\n * `com.acme.registry` pass; a bare `config` fails), so two frameworks\n * can't collide on a bare word.\n */\nconst CUSTOM_KEY_PATTERN = /^[a-z0-9]+([.-][a-z0-9]+)+$/i\n\n/** Maximum nesting depth of a namespace payload (containers, not leaves). */\nconst MAX_CUSTOM_DEPTH = 8\n\n/**\n * Validate the owner-supplied `custom` input: the field must be a\n * plain object, every key must match {@link CUSTOM_KEY_PATTERN}, and\n * every value must be JSON-serializable (no functions, `undefined`,\n * symbols, bigints, or cycles) within the depth cap. `null` is\n * accepted — it is the delete-this-namespace directive and never\n * persists. Throws `ValidationError` on the first violation.\n */\nexport function validateCustomInput(custom: Record<string, JsonValue>): void {\n  if (custom === null || typeof custom !== 'object' || Array.isArray(custom)) {\n    throw new ValidationError(\n      `setCover: custom must be a { [namespace]: value } object, got ${\n        Array.isArray(custom) ? 'array' : typeof custom\n      }.`,\n    )\n  }\n  for (const [ns, value] of Object.entries(custom)) {\n    if (!CUSTOM_KEY_PATTERN.test(ns)) {\n      throw new ValidationError(\n        `setCover: custom namespace \"${ns}\" is invalid. Keys must be ` +\n          'reverse-DNS or package-style identifiers with at least one ' +\n          'dot/dash-separated segment (e.g. \"noydb.viewer\", \"com.acme.registry\").',\n      )\n    }\n    assertJsonValue(value, ns, 1, new Set())\n  }\n}\n\nfunction assertJsonValue(\n  value: unknown,\n  ns: string,\n  depth: number,\n  seen: Set<object>,\n): void {\n  if (value === null) return\n  const t = typeof value\n  if (t === 'string' || t === 'number' || t === 'boolean') return\n  if (t !== 'object') {\n    throw new ValidationError(\n      `setCover: custom[\"${ns}\"] contains a non-JSON value (${t}). ` +\n        'Only strings, numbers, booleans, null, arrays, and plain objects are allowed.',\n    )\n  }\n  const container = value as object\n  if (seen.has(container)) {\n    throw new ValidationError(\n      `setCover: custom[\"${ns}\"] contains a circular reference.`,\n    )\n  }\n  if (depth > MAX_CUSTOM_DEPTH) {\n    throw new ValidationError(\n      `setCover: custom[\"${ns}\"] nests deeper than the ${MAX_CUSTOM_DEPTH}-level cap.`,\n    )\n  }\n  seen.add(container)\n  const children = Array.isArray(container) ? container : Object.values(container)\n  for (const child of children) {\n    assertJsonValue(child, ns, depth + 1, seen)\n  }\n  seen.delete(container)\n}\n\n/**\n * Namespace-level patch merge for `setCover`: provided namespaces\n * replace their previous value, absent namespaces are preserved, and\n * an explicit `null` deletes that namespace (so `null` never persists\n * as a namespace value). A whole-`custom`-absent patch preserves the\n * previous custom, consistent with the other cover fields. Rationale:\n * framework A must never need read-modify-write of framework B's data.\n *\n * Returns a spreadable fragment — `{ custom }` when the merge leaves\n * at least one namespace, `{}` when it leaves none (the field is\n * dropped from the persisted document rather than stored empty).\n */\nexport function mergeCustom(\n  existing: Record<string, JsonValue> | undefined,\n  patch: Record<string, JsonValue> | undefined,\n): { custom: Record<string, JsonValue> } | Record<string, never> {\n  if (patch === undefined) {\n    return existing !== undefined ? { custom: existing } : {}\n  }\n  const merged: Record<string, JsonValue> = { ...existing }\n  for (const [ns, value] of Object.entries(patch)) {\n    if (value === null) {\n      delete merged[ns]\n    } else {\n      merged[ns] = value\n    }\n  }\n  return Object.keys(merged).length > 0 ? { custom: merged } : {}\n}\n\n/**\n * Post-merge size caps — validates the WOULD-BE-PERSISTED document\n * (after the namespace merge), so a small patch can't tip the stored\n * cover over a cap unnoticed. `maxCoverBytes` bounds the entire\n * serialized document, which also closes the unbounded locale-map\n * key-count hole for `name` / `description`. Sizes are measured as\n * `JSON.stringify` length. Throws `ValidationError` on violation.\n */\nexport function validateCoverSize(\n  cover: Cover,\n  schema: ResolvedCoverSchema,\n): void {\n  if (cover.custom !== undefined) {\n    const customSize = JSON.stringify(cover.custom).length\n    if (customSize > schema.maxCustomBytes) {\n      throw new ValidationError(\n        `setCover: custom exceeds the ${schema.maxCustomBytes}-byte cap ` +\n          `(got ${customSize} bytes serialized, after merging with the stored namespaces).`,\n      )\n    }\n  }\n  const totalSize = JSON.stringify(cover).length\n  if (totalSize > schema.maxCoverBytes) {\n    throw new ValidationError(\n      `setCover: the cover document exceeds the ${schema.maxCoverBytes}-byte cap ` +\n        `(got ${totalSize} bytes serialized).`,\n    )\n  }\n}\n","/**\n * Validate-on-write for the cover. Runs at every `setCover` call;\n * the developer's schema decides which fields are allowed and the\n * size caps that apply.\n *\n * @module\n */\nimport { ValidationError } from '../../../kernel/errors.js'\nimport { validateCustomInput } from './custom.js'\nimport type {\n  Cover,\n  CoverText,\n  JsonValue,\n  ResolvedCoverSchema,\n  CoverField,\n} from './types.js'\n\n/** Owner-supplied input — the subset of {@link Cover} the owner can set. */\nexport interface SetCoverInput {\n  readonly name?: CoverText\n  readonly description?: CoverText\n  readonly icon?: string\n  readonly defaultLocale?: string\n  /**\n   * Namespace-level patch for the cover's `custom` slot (#800):\n   * provided namespaces replace their previous value, absent\n   * namespaces are preserved, an explicit `null` deletes that\n   * namespace. Requires `'custom'` in the schema's `fields` list —\n   * the `cover: true` shorthand does NOT enable it.\n   */\n  readonly custom?: Record<string, JsonValue>\n}\n\nconst DATA_URL_PREFIX = /^data:([a-zA-Z0-9.+-]+\\/[a-zA-Z0-9.+-]+);base64,/\n\n/**\n * Validate an owner-supplied cover input against the developer's\n * resolved schema. Throws `ValidationError` on the first violation;\n * returns void on success.\n *\n * The validator is deliberately strict: every fail mode is a hard\n * error rather than a silent drop, so the owner finds out immediately\n * which field they oversized rather than discovering a truncated\n * label months later.\n */\nexport function validateCoverInput(\n  input: SetCoverInput,\n  schema: ResolvedCoverSchema,\n): void {\n  const allowed = new Set<CoverField>(schema.fields)\n\n  // Reject any key not in the schema's allowed-field list.\n  for (const key of Object.keys(input)) {\n    const known: CoverField | undefined =\n      key === 'name' || key === 'description' || key === 'icon' || key === 'defaultLocale' || key === 'custom'\n        ? key\n        : undefined\n    if (!known) {\n      throw new ValidationError(\n        `setCover: unknown field \"${key}\". ` +\n          `Allowed fields: ${[...allowed].join(', ')}.`,\n      )\n    }\n    if (!allowed.has(known)) {\n      throw new ValidationError(\n        `setCover: field \"${known}\" is not enabled in this vault's schema. ` +\n          `Allowed fields: ${[...allowed].join(', ')}.`,\n      )\n    }\n  }\n\n  if (input.name !== undefined) {\n    validateText(input.name, 'name', schema.maxStringChars)\n  }\n  if (input.description !== undefined) {\n    validateText(input.description, 'description', schema.maxStringChars)\n  }\n  if (input.icon !== undefined) {\n    validateIcon(input.icon, schema)\n  }\n  if (input.defaultLocale !== undefined && typeof input.defaultLocale !== 'string') {\n    throw new ValidationError(\n      `setCover: defaultLocale must be a string (BCP-47), got ${typeof input.defaultLocale}.`,\n    )\n  }\n  if (input.custom !== undefined) {\n    validateCustomInput(input.custom)\n  }\n}\n\nfunction validateText(\n  value: CoverText,\n  field: string,\n  maxChars: number,\n): void {\n  if (typeof value === 'string') {\n    if (value.length > maxChars) {\n      throw new ValidationError(\n        `setCover: ${field} exceeds the ${maxChars}-character cap (got ${value.length}).`,\n      )\n    }\n    return\n  }\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n    throw new ValidationError(\n      `setCover: ${field} must be a string or { [locale]: string } map, got ${typeof value}.`,\n    )\n  }\n  // Locale map. Each value must be a non-empty string within the cap.\n  for (const [locale, str] of Object.entries(value)) {\n    if (typeof str !== 'string') {\n      throw new ValidationError(\n        `setCover: ${field}[${locale}] must be a string, got ${typeof str}.`,\n      )\n    }\n    if (str.length > maxChars) {\n      throw new ValidationError(\n        `setCover: ${field}[${locale}] exceeds the ${maxChars}-character cap (got ${str.length}).`,\n      )\n    }\n  }\n}\n\nfunction validateIcon(icon: string, schema: ResolvedCoverSchema): void {\n  if (typeof icon !== 'string') {\n    throw new ValidationError(\n      `setCover: icon must be a data: URL string, got ${typeof icon}.`,\n    )\n  }\n  if (icon.length > schema.maxIconBytes) {\n    throw new ValidationError(\n      `setCover: icon exceeds the ${schema.maxIconBytes}-byte cap (got ${icon.length}).`,\n    )\n  }\n  const m = DATA_URL_PREFIX.exec(icon)\n  if (!m) {\n    throw new ValidationError(\n      'setCover: icon must be a base64 data URL ' +\n        '(`data:image/png;base64,…` or `data:image/svg+xml;base64,…`). ' +\n        'External URLs are not supported in v1.',\n    )\n  }\n  const mime = m[1]!\n  if (!schema.iconMimeTypes.includes(mime)) {\n    throw new ValidationError(\n      `setCover: icon MIME type \"${mime}\" is not allowed. ` +\n        `Permitted types: ${schema.iconMimeTypes.join(', ')}.`,\n    )\n  }\n}\n\n/**\n * Lightweight runtime predicate — used by the bundle header\n * validator to recognise a cover without requiring it. (The wire\n * discriminator keeps its frozen name: `_noydb_public: 1`.)\n */\nexport function isCover(x: unknown): x is Cover {\n  if (x === null || typeof x !== 'object' || Array.isArray(x)) return false\n  const obj = x as Record<string, unknown>\n  return obj['_noydb_public'] === 1 && typeof obj['version'] === 'number'\n}\n","/**\n * Persistence helpers for `_meta/public-envelope` — the cover's\n * frozen wire location. Mirrors the bypass-AES pattern used by\n * `_meta/handle` and `_meta/policy` — the document is plaintext\n * JSON, the envelope's `_iv` field is left empty.\n *\n * @module\n */\nimport { buildRecordEnvelope } from '../../../capsule/index.js'\nimport type { NoydbStore } from '../../../kernel/types.js'\nimport type { Cover } from './types.js'\nimport { isCover } from './schema.js'\n\n/**\n * Reserved id for the vault-level cover record. The VALUE is frozen\n * wire format — the record predates the #799 rename and stays at\n * `_meta/public-envelope` so existing vaults need no migration.\n */\nexport const COVER_RECORD_ID = 'public-envelope'\n\n/**\n * Read the cover from `_meta/public-envelope`. Returns `undefined`\n * when no cover has been persisted (fresh vault, or a vault written\n * before the feature was enabled). Tolerates corrupted documents —\n * a JSON parse failure surfaces as `undefined`, not a thrown error,\n * mirroring `_meta/handle`'s contract.\n */\nexport async function loadCover(\n  store: NoydbStore,\n  vault: string,\n): Promise<Cover | undefined> {\n  const envelope = await store.get(vault, '_meta', COVER_RECORD_ID)\n  if (!envelope) return undefined\n  try {\n    const parsed = JSON.parse(envelope._data ?? '') as unknown\n    if (!isCover(parsed)) return undefined\n    return parsed\n  } catch {\n    return undefined\n  }\n}\n\n/** Persist the cover. Idempotent — overwrites any prior write. */\nexport async function saveCover(\n  store: NoydbStore,\n  vault: string,\n  cover: Cover,\n): Promise<void> {\n  const wireEnvelope = buildRecordEnvelope(\n    { collection: '_meta', id: COVER_RECORD_ID, version: 1 },\n    { iv: '', data: JSON.stringify(cover) },\n  )\n  await store.put(vault, '_meta', COVER_RECORD_ID, wireEnvelope)\n}\n\n/**\n * Public, no-key reader. Plain function, not a method on `Noydb` —\n * the whole point is it works without an authenticated session, so\n * a UI can show \"Acme 2026 Tax Records\" before unlocking.\n *\n * Resolves any `name` / `description` locale map through the supplied\n * `locale` (when provided). Omitting `locale` returns the raw\n * cover, which a multilingual picker can render as it pleases.\n */\nexport async function readCover(\n  store: NoydbStore,\n  vault: string,\n  opts: { readonly locale?: string } = {},\n): Promise<Cover | undefined> {\n  const raw = await loadCover(store, vault)\n  if (!raw) return undefined\n  if (opts.locale === undefined) return raw\n  return resolveLocale(raw, opts.locale)\n}\n\n/**\n * Resolve the locale-map fields (`name`, `description`) of a cover\n * to plain strings for the requested locale, falling back through\n * `defaultLocale` and then any available translation.\n *\n * @internal\n */\nexport function resolveLocale(\n  cover: Cover,\n  locale: string,\n): Cover {\n  return {\n    ...cover,\n    ...(cover.name !== undefined ? { name: pickLocale(cover.name, locale, cover.defaultLocale) } : {}),\n    ...(cover.description !== undefined ? { description: pickLocale(cover.description, locale, cover.defaultLocale) } : {}),\n  }\n}\n\n/**\n * Resolve a `string | { [locale]: string }` value to a string for a\n * given locale. Exported so the bundle reader can reuse it without\n * duplicating the fallback chain.\n *\n * **Looser than `resolveI18nText`** — the hub's record-field resolver\n * throws `LocaleNotSpecifiedError` when no translation matches, but\n * label semantics deliberately prefer \"show *something*\" over\n * throwing. The fallback chain is:\n *   1. Exact `locale` match.\n *   2. `defaultLocale` (when supplied on the cover).\n *   3. First non-empty value in the map.\n *   4. Empty string (only if every translation is empty — pathological).\n *\n * This deviation is documented in `https://github.com/noy-db/docs/blob/main/content/docs/services/public-envelope.md`.\n */\nexport function pickLocale(\n  value: string | Record<string, string>,\n  locale: string,\n  defaultLocale: string | undefined,\n): string {\n  if (typeof value === 'string') return value\n  if (value[locale] !== undefined && value[locale] !== '') return value[locale]\n  if (defaultLocale && value[defaultLocale] !== undefined && value[defaultLocale] !== '') {\n    return value[defaultLocale]\n  }\n  for (const v of Object.values(value)) {\n    if (v !== '') return v\n  }\n  return ''\n}\n"],"mappings":";;;;;;;;AAuBA,IAAM,qBAAqB;AAG3B,IAAM,mBAAmB;AAUlB,SAAS,oBAAoB,QAAyC;AAC3E,MAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR,iEACE,MAAM,QAAQ,MAAM,IAAI,UAAU,OAAO,MAC3C;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,IAAI,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAChD,QAAI,CAAC,mBAAmB,KAAK,EAAE,GAAG;AAChC,YAAM,IAAI;AAAA,QACR,+BAA+B,EAAE;AAAA,MAGnC;AAAA,IACF;AACA,oBAAgB,OAAO,IAAI,GAAG,oBAAI,IAAI,CAAC;AAAA,EACzC;AACF;AAEA,SAAS,gBACP,OACA,IACA,OACA,MACM;AACN,MAAI,UAAU,KAAM;AACpB,QAAM,IAAI,OAAO;AACjB,MAAI,MAAM,YAAY,MAAM,YAAY,MAAM,UAAW;AACzD,MAAI,MAAM,UAAU;AAClB,UAAM,IAAI;AAAA,MACR,qBAAqB,EAAE,iCAAiC,CAAC;AAAA,IAE3D;AAAA,EACF;AACA,QAAM,YAAY;AAClB,MAAI,KAAK,IAAI,SAAS,GAAG;AACvB,UAAM,IAAI;AAAA,MACR,qBAAqB,EAAE;AAAA,IACzB;AAAA,EACF;AACA,MAAI,QAAQ,kBAAkB;AAC5B,UAAM,IAAI;AAAA,MACR,qBAAqB,EAAE,4BAA4B,gBAAgB;AAAA,IACrE;AAAA,EACF;AACA,OAAK,IAAI,SAAS;AAClB,QAAM,WAAW,MAAM,QAAQ,SAAS,IAAI,YAAY,OAAO,OAAO,SAAS;AAC/E,aAAW,SAAS,UAAU;AAC5B,oBAAgB,OAAO,IAAI,QAAQ,GAAG,IAAI;AAAA,EAC5C;AACA,OAAK,OAAO,SAAS;AACvB;AAcO,SAAS,YACd,UACA,OAC+D;AAC/D,MAAI,UAAU,QAAW;AACvB,WAAO,aAAa,SAAY,EAAE,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC1D;AACA,QAAM,SAAoC,EAAE,GAAG,SAAS;AACxD,aAAW,CAAC,IAAI,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC/C,QAAI,UAAU,MAAM;AAClB,aAAO,OAAO,EAAE;AAAA,IAClB,OAAO;AACL,aAAO,EAAE,IAAI;AAAA,IACf;AAAA,EACF;AACA,SAAO,OAAO,KAAK,MAAM,EAAE,SAAS,IAAI,EAAE,QAAQ,OAAO,IAAI,CAAC;AAChE;AAUO,SAAS,kBACd,OACA,QACM;AACN,MAAI,MAAM,WAAW,QAAW;AAC9B,UAAM,aAAa,KAAK,UAAU,MAAM,MAAM,EAAE;AAChD,QAAI,aAAa,OAAO,gBAAgB;AACtC,YAAM,IAAI;AAAA,QACR,gCAAgC,OAAO,cAAc,kBAC3C,UAAU;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,KAAK,UAAU,KAAK,EAAE;AACxC,MAAI,YAAY,OAAO,eAAe;AACpC,UAAM,IAAI;AAAA,MACR,4CAA4C,OAAO,aAAa,kBACtD,SAAS;AAAA,IACrB;AAAA,EACF;AACF;;;ACnHA,IAAM,kBAAkB;AAYjB,SAAS,mBACd,OACA,QACM;AACN,QAAM,UAAU,IAAI,IAAgB,OAAO,MAAM;AAGjD,aAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAM,QACJ,QAAQ,UAAU,QAAQ,iBAAiB,QAAQ,UAAU,QAAQ,mBAAmB,QAAQ,WAC5F,MACA;AACN,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,4BAA4B,GAAG,sBACV,CAAC,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MAC9C;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,IAAI,KAAK,GAAG;AACvB,YAAM,IAAI;AAAA,QACR,oBAAoB,KAAK,4DACJ,CAAC,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AAEA,MAAI,MAAM,SAAS,QAAW;AAC5B,iBAAa,MAAM,MAAM,QAAQ,OAAO,cAAc;AAAA,EACxD;AACA,MAAI,MAAM,gBAAgB,QAAW;AACnC,iBAAa,MAAM,aAAa,eAAe,OAAO,cAAc;AAAA,EACtE;AACA,MAAI,MAAM,SAAS,QAAW;AAC5B,iBAAa,MAAM,MAAM,MAAM;AAAA,EACjC;AACA,MAAI,MAAM,kBAAkB,UAAa,OAAO,MAAM,kBAAkB,UAAU;AAChF,UAAM,IAAI;AAAA,MACR,0DAA0D,OAAO,MAAM,aAAa;AAAA,IACtF;AAAA,EACF;AACA,MAAI,MAAM,WAAW,QAAW;AAC9B,wBAAoB,MAAM,MAAM;AAAA,EAClC;AACF;AAEA,SAAS,aACP,OACA,OACA,UACM;AACN,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,MAAM,SAAS,UAAU;AAC3B,YAAM,IAAI;AAAA,QACR,aAAa,KAAK,gBAAgB,QAAQ,uBAAuB,MAAM,MAAM;AAAA,MAC/E;AAAA,IACF;AACA;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI;AAAA,MACR,aAAa,KAAK,sDAAsD,OAAO,KAAK;AAAA,IACtF;AAAA,EACF;AAEA,aAAW,CAAC,QAAQ,GAAG,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,QAAI,OAAO,QAAQ,UAAU;AAC3B,YAAM,IAAI;AAAA,QACR,aAAa,KAAK,IAAI,MAAM,2BAA2B,OAAO,GAAG;AAAA,MACnE;AAAA,IACF;AACA,QAAI,IAAI,SAAS,UAAU;AACzB,YAAM,IAAI;AAAA,QACR,aAAa,KAAK,IAAI,MAAM,iBAAiB,QAAQ,uBAAuB,IAAI,MAAM;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAc,QAAmC;AACrE,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAM,IAAI;AAAA,MACR,kDAAkD,OAAO,IAAI;AAAA,IAC/D;AAAA,EACF;AACA,MAAI,KAAK,SAAS,OAAO,cAAc;AACrC,UAAM,IAAI;AAAA,MACR,8BAA8B,OAAO,YAAY,kBAAkB,KAAK,MAAM;AAAA,IAChF;AAAA,EACF;AACA,QAAM,IAAI,gBAAgB,KAAK,IAAI;AACnC,MAAI,CAAC,GAAG;AACN,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,QAAM,OAAO,EAAE,CAAC;AAChB,MAAI,CAAC,OAAO,cAAc,SAAS,IAAI,GAAG;AACxC,UAAM,IAAI;AAAA,MACR,6BAA6B,IAAI,sCACX,OAAO,cAAc,KAAK,IAAI,CAAC;AAAA,IACvD;AAAA,EACF;AACF;AAOO,SAAS,QAAQ,GAAwB;AAC9C,MAAI,MAAM,QAAQ,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,EAAG,QAAO;AACpE,QAAM,MAAM;AACZ,SAAO,IAAI,eAAe,MAAM,KAAK,OAAO,IAAI,SAAS,MAAM;AACjE;;;AC9IO,IAAM,kBAAkB;AAS/B,eAAsB,UACpB,OACA,OAC4B;AAC5B,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,SAAS,eAAe;AAChE,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS,SAAS,EAAE;AAC9C,QAAI,CAAC,QAAQ,MAAM,EAAG,QAAO;AAC7B,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,UACpB,OACA,OACA,OACe;AACf,QAAM,eAAe;AAAA,IACnB,EAAE,YAAY,SAAS,IAAI,iBAAiB,SAAS,EAAE;AAAA,IACvD,EAAE,IAAI,IAAI,MAAM,KAAK,UAAU,KAAK,EAAE;AAAA,EACxC;AACA,QAAM,MAAM,IAAI,OAAO,SAAS,iBAAiB,YAAY;AAC/D;AAWA,eAAsB,UACpB,OACA,OACA,OAAqC,CAAC,GACV;AAC5B,QAAM,MAAM,MAAM,UAAU,OAAO,KAAK;AACxC,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,KAAK,WAAW,OAAW,QAAO;AACtC,SAAO,cAAc,KAAK,KAAK,MAAM;AACvC;AASO,SAAS,cACd,OACA,QACO;AACP,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,WAAW,MAAM,MAAM,QAAQ,MAAM,aAAa,EAAE,IAAI,CAAC;AAAA,IAChG,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,WAAW,MAAM,aAAa,QAAQ,MAAM,aAAa,EAAE,IAAI,CAAC;AAAA,EACvH;AACF;AAkBO,SAAS,WACd,OACA,QACA,eACQ;AACR,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,MAAM,MAAM,UAAa,MAAM,MAAM,MAAM,GAAI,QAAO,MAAM,MAAM;AAC5E,MAAI,iBAAiB,MAAM,aAAa,MAAM,UAAa,MAAM,aAAa,MAAM,IAAI;AACtF,WAAO,MAAM,aAAa;AAAA,EAC5B;AACA,aAAW,KAAK,OAAO,OAAO,KAAK,GAAG;AACpC,QAAI,MAAM,GAAI,QAAO;AAAA,EACvB;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-ISZQJBML.js → chunk-5FE75J4S.js}

@@ -1,16 +1,16 @@
 import {
   getHistory,
   historyIdentity
-} from "./chunk-QWGU66MP.js";
+} from "./chunk-LNSVGRHO.js";
 import {
   liveRecordIsElevated
-} from "./chunk-JCN44NCY.js";
+} from "./chunk-FLPCETP6.js";
 import {
   openEnvelopeJson
-} from "./chunk-KJFW62P4.js";
+} from "./chunk-EZGV6F47.js";
 import {
   ReadOnlyAtInstantError
-} from "./chunk-244VXYPG.js";
+} from "./chunk-37EPTBBR.js";
 
 // src/with-commit/history/time-machine.ts
 var VaultInstant = class {
@@ -52,7 +52,7 @@ var CollectionInstant = class {
   async get(id) {
     const found = await this.resolveVisibleEnvelope(id);
     if (!found) return null;
-    const plaintext = this.engine.encrypted ? await openEnvelopeJson(found.ref, found.envelope, await this.engine.getDEK(this.name)) : found.envelope._data;
+    const plaintext = this.engine.encrypted ? await openEnvelopeJson(found.ref, found.envelope, await this.engine.getDEK(this.name)) : found.envelope._data ?? "";
     return JSON.parse(plaintext);
   }
   /**
@@ -208,4 +208,4 @@ export {
   VaultInstant,
   CollectionInstant
 };
-//# sourceMappingURL=chunk-ISZQJBML.js.map
+//# sourceMappingURL=chunk-5FE75J4S.js.map

package/dist/chunk-5FE75J4S.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/with-commit/history/time-machine.ts"],"sourcesContent":["/**\n * Time-machine queries — point-in-time reads reconstructed from the\n * existing history + ledger infrastructure.\n *\n * ## Usage\n *\n * ```ts\n * const vault = await db.openVault('acme', { secret })\n * const q1End = vault.at('2026-03-31T23:59:59Z')\n * const invoice = await q1End.collection<Invoice>('invoices').get('inv-001')\n * // → the record as it stood at the close of Q1 2026\n * ```\n *\n * ## How it works\n *\n * Every write path already fans out into two persistence lanes:\n *\n * 1. `saveHistory(...)` persists a **full encrypted envelope snapshot**\n *    per version under the `_history` collection (one envelope per\n *    version, keyed by `{collection}:{id}:{paddedVersion}`). Each\n *    envelope carries its own `_ts` (the write timestamp).\n * 2. `ledger.append(...)` appends a hash-chained audit entry that\n *    records the `op` (put / delete), `version`, and `ts`.\n *\n * Reconstruction at a target timestamp T is therefore:\n *\n * - Find the newest history envelope for `(collection, id)` whose\n *   `_ts ≤ T` — that's the state the record was in at T.\n * - Check the ledger for any `op: 'delete'` entry for the same\n *   `(collection, id)` with `entry.ts` in `(latestEnvelope._ts, T]` —\n *   if present, the record was deleted before T, so return `null`.\n * - Decrypt the surviving envelope with the current collection DEK\n *   (DEKs are per-collection but stable across versions — the same\n *   key encrypts v1 and v15 of a record).\n *\n * No delta replay. The existing `history.ts` module already stores\n * complete snapshots; we just pick the right one.\n *\n * ## Read-only contract\n *\n * Every write method on `CollectionInstant` throws\n * {@link ReadOnlyAtInstantError}. A historical view is a *read*\n * surface — mutating the past would require either a branch/shadow\n * mechanism (tracked under shadow vaults) or a rewrite of\n * history, which breaks the ledger's tamper-evidence guarantee.\n *\n * @module\n */\nimport type { EncryptedEnvelope, NoydbStore } from '../../kernel/types.js'\nimport type { LedgerStore } from './ledger/store.js'\nimport { getHistory, historyIdentity } from './history.js'\n\n/**\n * An envelope together with **the address it was fetched from**.\n *\n * The time machine resolves a record's state at an instant from two different\n * places — the live collection, or a `_history` snapshot — and those are sealed\n * against different identities (#1041). Returning the envelope alone discards\n * the one fact the reader needs to open it, which is precisely the read-side\n * data-flow gap that binding identity exposes.\n */\ninterface ResolvedEnvelope {\n  readonly envelope: EncryptedEnvelope\n  readonly ref: { readonly collection: string; readonly id: string }\n}\nimport { openEnvelopeJson, type EnclaveKey } from '../../capsule/index.js'\nimport { ReadOnlyAtInstantError } from '../../kernel/errors.js'\nimport { liveRecordIsElevated } from '../../kernel/tier-visibility.js'\n\n/**\n * Narrow view of a {@link Vault}'s internals that\n * {@link VaultInstant} needs. Passed in by `Vault.at()` rather than\n * constructed here so all crypto + adapter access stays inside the\n * Vault class.\n *\n * Not exported from the public barrel — consumers should get a\n * `VaultInstant` via `vault.at(ts)`, never by constructing one\n * directly.\n */\nexport interface VaultEngine {\n  readonly adapter: NoydbStore\n  /** Vault name (the compartment). */\n  readonly name: string\n  /**\n   * `true` when the vault was opened with a secret (the normal\n   * case). `false` in plaintext-mode vaults (`encrypt: false`) — in\n   * that case `envelope._data` is raw JSON and we skip the DEK lookup.\n   */\n  readonly encrypted: boolean\n  /**\n   * Resolves the DEK used to decrypt a given collection's envelopes.\n   * Not called when `encrypted` is false.\n   */\n  getDEK(collection: string): Promise<EnclaveKey>\n  /**\n   * Lazily-initialised ledger. We consult it to detect deletes that\n   * happened between the latest history snapshot and the target\n   * timestamp. `null` when history is disabled for this vault — in\n   * that case time-machine reads fall back to history-only\n   * reconstruction (which may miss deletes).\n   */\n  getLedger(): LedgerStore | null\n}\n\n/**\n * A vault at a fixed instant. Produced by `vault.at(timestamp)`.\n * Carries no session state of its own — every read is a fresh\n * lookup through the vault's adapter.\n *\n * Cheap to construct; safe to throw away. Create one per query.\n */\nexport class VaultInstant {\n  constructor(\n    private readonly engine: VaultEngine,\n    /** Fully-resolved target timestamp (ISO-8601 UTC). */\n    public readonly timestamp: string,\n  ) {}\n\n  /** Get a point-in-time view of a collection. */\n  collection<T = unknown>(name: string): CollectionInstant<T> {\n    return new CollectionInstant<T>(this.engine, this.timestamp, name)\n  }\n}\n\n/**\n * A read-only collection view anchored to a past instant.\n *\n * Every write method throws {@link ReadOnlyAtInstantError} — see the\n * module docstring for why. The read surface is intentionally smaller\n * than the live {@link Collection}: `get` and `list` cover the\n * \"what did the books look like on date X\" use case without pulling\n * in the full query DSL / joins / aggregates at this stage. Follow-up\n * work tracked under.\n */\nexport class CollectionInstant<T = unknown> {\n  constructor(\n    private readonly engine: VaultEngine,\n    private readonly targetTs: string,\n    public readonly name: string,\n  ) {}\n\n  /**\n   * Return the record as it existed at the target timestamp, or\n   * `null` if the record had not been created yet or had already been\n   * deleted by then.\n   *\n   * Gated on the LIVE record's current tier — #730, mirroring the #712\n   * read-gate `history()`/`getVersion()` already apply: an elevated record\n   * is invisible through the whole time-machine surface, not just a\n   * decrypt failure. See {@link resolveVisibleEnvelope}.\n   *\n   * Decrypts through {@link openEnvelopeJson}, the `_cek`-aware envelope\n   * body opener — a snapshot from a `perRecordKeys` collection is encrypted\n   * under its own per-record CEK (wrapped in `_cek`), not the collection\n   * DEK directly.\n   */\n  async get(id: string): Promise<T | null> {\n    const found = await this.resolveVisibleEnvelope(id)\n    if (!found) return null\n    // The envelope may be the LIVE record or a `_history` snapshot, and the two\n    // are sealed against different identities (#1041). `resolveEnvelope` carries\n    // the address down with the bytes precisely so this read can name it.\n    const plaintext = this.engine.encrypted\n      ? await openEnvelopeJson(found.ref, found.envelope, await this.engine.getDEK(this.name))\n      : (found.envelope._data ?? '')\n    return JSON.parse(plaintext) as T\n  }\n\n  /**\n   * IDs of records that existed (had at least one `put` and were not\n   * subsequently deleted) at the target timestamp.\n   *\n   * Implemented as a linear scan over history + ledger. Performance\n   * is bounded by total history size (not live-vault size), so the\n   * memory-first vault-scale cap (1K–50K records × average history\n   * depth) still applies.\n   */\n  async list(): Promise<string[]> {\n    const historyIds = await collectHistoryIds(this.engine.adapter, this.engine.name, this.name)\n    const liveIds = await this.engine.adapter.list(this.engine.name, this.name)\n    const candidateIds = new Set<string>([...historyIds, ...liveIds])\n    const alive: string[] = []\n    for (const id of candidateIds) {\n      const env = await this.resolveVisibleEnvelope(id)\n      if (env) alive.push(id)\n    }\n    return alive.sort()\n  }\n\n  // ── write guards ───────────────────────────────────────────────────\n\n  async put(_id: string, _record: T): Promise<never> {\n    throw new ReadOnlyAtInstantError('put', this.targetTs)\n  }\n  async delete(_id: string): Promise<never> {\n    throw new ReadOnlyAtInstantError('delete', this.targetTs)\n  }\n  async update(_id: string, _patch: Partial<T>): Promise<never> {\n    throw new ReadOnlyAtInstantError('update', this.targetTs)\n  }\n\n  // ── internals ─────────────────────────────────────────────────────\n\n  /**\n   * {@link resolveEnvelope}, additionally gated on the record's LIVE\n   * (current, not historical) tier — #730. Mirrors the #712 read-gate\n   * `history()`/`getVersion()` apply: history snapshots keep their\n   * tier-0-wrapped CEKs and carry no `_tier` of their own, so an elevated\n   * record's prior versions would otherwise stay tier-0-decryptable here.\n   * `null` for a resolved envelope carrying its own `_tier > 0` (a\n   * tier-aware snapshot reached some other way) or whose LIVE record is\n   * currently elevated — both `get()` and `list()` route through this so\n   * the invisibility law holds on the whole time-machine read surface, not\n   * just a decrypt failure.\n   */\n  private async resolveVisibleEnvelope(id: string): Promise<ResolvedEnvelope | null> {\n    const found = await this.resolveEnvelope(id)\n    if (!found || (found.envelope._tier ?? 0) > 0) return null\n    if (await liveRecordIsElevated(this.engine.adapter, this.engine.name, this.name, id)) return null\n    return found\n  }\n\n  /**\n   * Return the envelope that represents the record's state at\n   * `targetTs`, accounting for deletes. `null` if the record didn't\n   * exist at that instant.\n   *\n   * ## Why we use the ledger as the authoritative timeline\n   *\n   * The per-version history snapshots saved by `saveHistory()` do\n   * carry a `_ts` field, but that timestamp is the moment the\n   * snapshot was *captured* (i.e. the instant right before the\n   * subsequent overwrite), not the original write time. The ledger,\n   * by contrast, records `ts` at the moment of each `put` / `delete`\n   * — it's the only source that tracks the real timeline. So:\n   *\n   *   1. Walk the ledger; find the latest entry for `(collection, id)`\n   *      with `ts ≤ targetTs`.\n   *   2. If that entry is a `delete`, the record was gone at the\n   *      target instant — return null.\n   *   3. Otherwise it's a `put` with a specific `version`. Load the\n   *      envelope for that version from history, falling back to the\n   *      live collection for the most recent version.\n   *\n   * ## Fallback when the ledger is disabled\n   *\n   * If the vault has history disabled, `getLedger()` returns null and\n   * we fall back to comparing envelope `_ts` fields. This is\n   * approximate and gets the *last write* right but may confuse the\n   * intermediate versions; adopters needing accurate time-machine\n   * reads should leave history enabled.\n   */\n  private async resolveEnvelope(id: string): Promise<ResolvedEnvelope | null> {\n    const ledger = this.engine.getLedger()\n    if (ledger) {\n      return this.resolveViaLedger(id, ledger)\n    }\n    return this.resolveViaEnvelopeTs(id)\n  }\n\n  private async resolveViaLedger(id: string, ledger: LedgerStore): Promise<ResolvedEnvelope | null> {\n    const entries = await ledger.entries()\n    // Entries are already ordered by index which is the mutation order.\n    let latest: { op: 'put' | 'delete'; version: number } | null = null\n    for (const e of entries) {\n      if (e.collection !== this.name || e.id !== id) continue\n      if (e.ts > this.targetTs) break   // entries are time-ordered by index\n      // `amendment` + `lifecycle` entries are audit-only summaries — they\n      // carry no (collection, id) tuple of their own and would never match\n      // the filter above. The narrow here is a type guard, not a runtime\n      // skip.\n      // `forget` is a subject-erasure summary with empty (collection, id) —\n      // never matches the filter above; the narrow is a type guard.\n      if (e.op === 'amendment' || e.op === 'lifecycle' || e.op === 'forget') continue\n      // `migration` is a record rewrite (cutover) — resolve it like a put.\n      latest = { op: e.op === 'migration' ? 'put' : e.op, version: e.version }\n    }\n    if (!latest) return null\n    if (latest.op === 'delete') return null\n    return this.loadVersion(id, latest.version)\n  }\n\n  private async resolveViaEnvelopeTs(id: string): Promise<ResolvedEnvelope | null> {\n    const history = await getHistory(\n      this.engine.adapter, this.engine.name, this.name, id,\n    )\n    const live = await this.engine.adapter.get(this.engine.name, this.name, id)\n    // Each candidate keeps the address it came from — a snapshot and the live\n    // record are sealed against different identities, and this map is exactly\n    // where that provenance used to be discarded (#1041).\n    const byVersion = new Map<number, ResolvedEnvelope>()\n    for (const e of history) {\n      byVersion.set(e._v, { envelope: e, ref: historyIdentity(this.name, id, e._v) })\n    }\n    if (live) byVersion.set(live._v, { envelope: live, ref: { collection: this.name, id } })\n    const sorted = [...byVersion.values()].sort((a, b) =>\n      a.envelope._ts < b.envelope._ts ? 1 : a.envelope._ts > b.envelope._ts ? -1 : 0,\n    )\n    return sorted.find((e) => e.envelope._ts <= this.targetTs) ?? null\n  }\n\n  /**\n   * Fetch the envelope for a specific version. The live record (most\n   * recent put) lives in the main collection; prior versions live in\n   * `_history`. We check live first because the common case after a\n   * delete is that we're trying to load the last-live version from\n   * history, and skipping live for the current-version case avoids a\n   * redundant lookup.\n   */\n  private async loadVersion(id: string, version: number): Promise<ResolvedEnvelope | null> {\n    const live = await this.engine.adapter.get(this.engine.name, this.name, id)\n    if (live && live._v === version) {\n      return { envelope: live, ref: { collection: this.name, id } }\n    }\n\n    // Direct lookup by (collection, id, version) — avoids scanning all history.\n    //\n    // This used to rebuild the key inline as\n    // `${name}:${id}:${padStart(10,'0')}` — a SECOND definition of the history\n    // layout, free to drift from `historyId`'s. It now goes through\n    // `historyIdentity`, the same function `saveHistory` writes with, so the\n    // read address and the write address cannot disagree (#1041).\n    const ref = historyIdentity(this.name, id, version)\n    const envelope = await this.engine.adapter.get(this.engine.name, ref.collection, ref.id)\n    return envelope ? { envelope, ref } : null\n  }\n}\n\n/**\n * Scan the `_history` collection once and collect every distinct\n * `recordId` for the given collection. History keys follow the\n * shape `<collection>:<recordId>:<paddedVersion>`; we split on the\n * last two colons (delimiter-safe because `paddedVersion` is\n * exactly 10 digits).\n */\nasync function collectHistoryIds(\n  adapter: NoydbStore,\n  vault: string,\n  collection: string,\n): Promise<string[]> {\n  const all = await adapter.list(vault, '_history')\n  const prefix = `${collection}:`\n  const seen = new Set<string>()\n  for (const key of all) {\n    if (!key.startsWith(prefix)) continue\n    const lastColon = key.lastIndexOf(':')\n    if (lastColon <= prefix.length) continue\n    const middle = key.slice(prefix.length, lastColon)\n    seen.add(middle)\n  }\n  return [...seen]\n}\n"],"mappings":";;;;;;;;;;;;;;;AA+GO,IAAM,eAAN,MAAmB;AAAA,EACxB,YACmB,QAED,WAChB;AAHiB;AAED;AAAA,EACf;AAAA,EAHgB;AAAA,EAED;AAAA;AAAA,EAIlB,WAAwB,MAAoC;AAC1D,WAAO,IAAI,kBAAqB,KAAK,QAAQ,KAAK,WAAW,IAAI;AAAA,EACnE;AACF;AAYO,IAAM,oBAAN,MAAqC;AAAA,EAC1C,YACmB,QACA,UACD,MAChB;AAHiB;AACA;AACD;AAAA,EACf;AAAA,EAHgB;AAAA,EACA;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBlB,MAAM,IAAI,IAA+B;AACvC,UAAM,QAAQ,MAAM,KAAK,uBAAuB,EAAE;AAClD,QAAI,CAAC,MAAO,QAAO;AAInB,UAAM,YAAY,KAAK,OAAO,YAC1B,MAAM,iBAAiB,MAAM,KAAK,MAAM,UAAU,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,CAAC,IACpF,MAAM,SAAS,SAAS;AAC7B,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,OAA0B;AAC9B,UAAM,aAAa,MAAM,kBAAkB,KAAK,OAAO,SAAS,KAAK,OAAO,MAAM,KAAK,IAAI;AAC3F,UAAM,UAAU,MAAM,KAAK,OAAO,QAAQ,KAAK,KAAK,OAAO,MAAM,KAAK,IAAI;AAC1E,UAAM,eAAe,oBAAI,IAAY,CAAC,GAAG,YAAY,GAAG,OAAO,CAAC;AAChE,UAAM,QAAkB,CAAC;AACzB,eAAW,MAAM,cAAc;AAC7B,YAAM,MAAM,MAAM,KAAK,uBAAuB,EAAE;AAChD,UAAI,IAAK,OAAM,KAAK,EAAE;AAAA,IACxB;AACA,WAAO,MAAM,KAAK;AAAA,EACpB;AAAA;AAAA,EAIA,MAAM,IAAI,KAAa,SAA4B;AACjD,UAAM,IAAI,uBAAuB,OAAO,KAAK,QAAQ;AAAA,EACvD;AAAA,EACA,MAAM,OAAO,KAA6B;AACxC,UAAM,IAAI,uBAAuB,UAAU,KAAK,QAAQ;AAAA,EAC1D;AAAA,EACA,MAAM,OAAO,KAAa,QAAoC;AAC5D,UAAM,IAAI,uBAAuB,UAAU,KAAK,QAAQ;AAAA,EAC1D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAc,uBAAuB,IAA8C;AACjF,UAAM,QAAQ,MAAM,KAAK,gBAAgB,EAAE;AAC3C,QAAI,CAAC,UAAU,MAAM,SAAS,SAAS,KAAK,EAAG,QAAO;AACtD,QAAI,MAAM,qBAAqB,KAAK,OAAO,SAAS,KAAK,OAAO,MAAM,KAAK,MAAM,EAAE,EAAG,QAAO;AAC7F,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgCA,MAAc,gBAAgB,IAA8C;AAC1E,UAAM,SAAS,KAAK,OAAO,UAAU;AACrC,QAAI,QAAQ;AACV,aAAO,KAAK,iBAAiB,IAAI,MAAM;AAAA,IACzC;AACA,WAAO,KAAK,qBAAqB,EAAE;AAAA,EACrC;AAAA,EAEA,MAAc,iBAAiB,IAAY,QAAuD;AAChG,UAAM,UAAU,MAAM,OAAO,QAAQ;AAErC,QAAI,SAA2D;AAC/D,eAAW,KAAK,SAAS;AACvB,UAAI,EAAE,eAAe,KAAK,QAAQ,EAAE,OAAO,GAAI;AAC/C,UAAI,EAAE,KAAK,KAAK,SAAU;AAO1B,UAAI,EAAE,OAAO,eAAe,EAAE,OAAO,eAAe,EAAE,OAAO,SAAU;AAEvE,eAAS,EAAE,IAAI,EAAE,OAAO,cAAc,QAAQ,EAAE,IAAI,SAAS,EAAE,QAAQ;AAAA,IACzE;AACA,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,OAAO,OAAO,SAAU,QAAO;AACnC,WAAO,KAAK,YAAY,IAAI,OAAO,OAAO;AAAA,EAC5C;AAAA,EAEA,MAAc,qBAAqB,IAA8C;AAC/E,UAAM,UAAU,MAAM;AAAA,MACpB,KAAK,OAAO;AAAA,MAAS,KAAK,OAAO;AAAA,MAAM,KAAK;AAAA,MAAM;AAAA,IACpD;AACA,UAAM,OAAO,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,MAAM,KAAK,MAAM,EAAE;AAI1E,UAAM,YAAY,oBAAI,IAA8B;AACpD,eAAW,KAAK,SAAS;AACvB,gBAAU,IAAI,EAAE,IAAI,EAAE,UAAU,GAAG,KAAK,gBAAgB,KAAK,MAAM,IAAI,EAAE,EAAE,EAAE,CAAC;AAAA,IAChF;AACA,QAAI,KAAM,WAAU,IAAI,KAAK,IAAI,EAAE,UAAU,MAAM,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,EAAE,CAAC;AACvF,UAAM,SAAS,CAAC,GAAG,UAAU,OAAO,CAAC,EAAE;AAAA,MAAK,CAAC,GAAG,MAC9C,EAAE,SAAS,MAAM,EAAE,SAAS,MAAM,IAAI,EAAE,SAAS,MAAM,EAAE,SAAS,MAAM,KAAK;AAAA,IAC/E;AACA,WAAO,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,OAAO,KAAK,QAAQ,KAAK;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,YAAY,IAAY,SAAmD;AACvF,UAAM,OAAO,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,MAAM,KAAK,MAAM,EAAE;AAC1E,QAAI,QAAQ,KAAK,OAAO,SAAS;AAC/B,aAAO,EAAE,UAAU,MAAM,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,EAAE;AAAA,IAC9D;AASA,UAAM,MAAM,gBAAgB,KAAK,MAAM,IAAI,OAAO;AAClD,UAAM,WAAW,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,OAAO,MAAM,IAAI,YAAY,IAAI,EAAE;AACvF,WAAO,WAAW,EAAE,UAAU,IAAI,IAAI;AAAA,EACxC;AACF;AASA,eAAe,kBACb,SACA,OACA,YACmB;AACnB,QAAM,MAAM,MAAM,QAAQ,KAAK,OAAO,UAAU;AAChD,QAAM,SAAS,GAAG,UAAU;AAC5B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,OAAO,KAAK;AACrB,QAAI,CAAC,IAAI,WAAW,MAAM,EAAG;AAC7B,UAAM,YAAY,IAAI,YAAY,GAAG;AACrC,QAAI,aAAa,OAAO,OAAQ;AAChC,UAAM,SAAS,IAAI,MAAM,OAAO,QAAQ,SAAS;AACjD,SAAK,IAAI,MAAM;AAAA,EACjB;AACA,SAAO,CAAC,GAAG,IAAI;AACjB;","names":[]}