@aigne/afs-did-space 1.12.0-beta.5

package/dist/local.mjs

@@ -0,0 +1,427 @@
+import { normalizeId, validateId } from "./did-utils.mjs";
+import { SqliteUploadSessionStore } from "./upload-session-store.mjs";
+import { attachMetadataContext } from "./afs-metadata-context.mjs";
+import { CachingObjectStore, CidByteCache } from "./cid-byte-cache.mjs";
+import { PrefixedTreeIndex } from "./prefixed-tree-index.mjs";
+import { referencedAnywhereLibsql } from "./reference-check.mjs";
+import { DIDSpaceResolver } from "./resolve.mjs";
+import { runGc } from "./run-gc.mjs";
+import { deriveScope } from "./scope-id.mjs";
+import { SqliteGcQueue } from "./sqlite-gc-queue.mjs";
+import { SqliteResolveStore } from "./sqlite-resolve-store.mjs";
+import { SQLiteTreeIndex } from "./sqlite-tree-index.mjs";
+import { DIDSpaceProvider } from "./index.mjs";
+import { FsObjectStore } from "./fs-object-store.mjs";
+import { MetadataDB } from "./metadata-db.mjs";
+import { reconcile } from "./reconcile.mjs";
+import { migrateNodeMetadataDb, migrateNodeSpaces } from "./scope-migration-node.mjs";
+import { AFS } from "@aigne/afs";
+import { mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { AFSFS } from "@aigne/afs-fs";
+
+//#region src/local.ts
+/**
+* DIDSpace — local (Node) backend for DID-scoped storage.
+*
+* Phase 3 (mobile-didspace-transport): unified onto the single
+* `DIDSpaceProvider`, exactly like the Cloudflare backend — only the injected
+* storage primitives differ (Node: `FsObjectStore` + `SQLiteTreeIndex`; CF: R2
+* + `D1TreeIndex`). This makes the backend runtime-agnostic per CLAUDE.md and
+* gives Node the content-addressed `.objects/{cid}`, `.changelog`, `maxDepth:-1`
+* manifest, device-aware writes, and ifMatch that the bare `AFSFS` mount lacked.
+*
+* Layout (relative to `userDir`, all under `entries.scope = <storage scope>` —
+* the derived scope when de-id is on, else the plaintext DID; `userDir` itself
+* is `{rootPath}/{storage scope}`):
+*   role:"system" → PrefixedTreeIndex `blocklets/{i}/system/`   (mounted at `/`)
+*   role:"user"   → PrefixedTreeIndex `blocklets/{i}/user/`     (mounted at `/`)
+*   space root    → no-prefix SQLiteTreeIndex (whole space; CLI manifest)
+*   config        → AFSFS `blocklets/{i}/config/`               (blob fragment)
+* Content blobs live once at `{userDir}/objects/{cid}` (FsObjectStore); the
+* index (`_metadata.db`) is the source of truth. The old eventual-mirror
+* subscriber + `desktop:default` deviceId hardcode are gone — the provider's
+* `put` writes entries + changelog atomically.
+*
+* Usage:
+*   const space = new DIDSpace({ rootPath: "~/.afs/spaces", userDid: "did:abt:z1..." });
+*   const afs = await space.getInstanceSpace({ instanceDid: "z1app", role: "system" });
+*   await afs.write("/hello.txt", { content: "hello" });
+*/
+/** Local desktop device label written into changelog rows for local writes. */
+const LOCAL_DEVICE_ID = "desktop:default";
+var DIDSpace = class DIDSpace {
+	rootPath;
+	/** Real normalizeId(DID) — identity, returned to callers (NOT a storage key). */
+	userDid;
+	/**
+	* Storage scope — `deriveScope(userDid, secret)` when de-id is on, else the
+	* plaintext `userDid`. Drives the directory name (`userDir`), every
+	* SQLiteTreeIndex scope, and `_shares.db` owner_did. Named `_scope` to mirror
+	* the CF backend (cloudflare.ts).
+	*/
+	_scope;
+	userDir;
+	instanceSpaces = /* @__PURE__ */ new Map();
+	_resolver;
+	/** Backing store for {@link resolver}; closed in {@link close}. */
+	_resolveStore;
+	/** User-level MetadataDB; lazy-opened on first getInstanceSpace/getUserSpace */
+	metadataDb = null;
+	/** Shared content-addressed object store (one objects/ dir per user space). */
+	objectStore = null;
+	/**
+	* `objectStore` wrapped with a content-addressed byte cache (#674 perf). Keyed
+	* by cid (immutable) → no staleness, no TTL; bounded LRU keeps memory flat.
+	* Persists for this DID-Space's lifetime (the Node daemon reuses it per user).
+	*/
+	cachingStore = null;
+	objectByteCache = new CidByteCache();
+	/** GC queue over `_metadata.db` (deferred object cleanup); lazy, ensureTable once. */
+	gcQueue = null;
+	/**
+	* Share-out Phase 3: builds the ShareResolver for getUserSpace providers.
+	* Read lazily at provider-construction time, so a late {@link
+	* setShareResolverFactory} (installer space) still covers providers built
+	* after the call. Undefined → no share-out (back-compat: dark-wired off).
+	*/
+	_shareResolverFactory;
+	/** upload-limits Phase 5 per-scope byte quota (0 = off, the opt-in default). */
+	maxBytesPerScope;
+	constructor(options) {
+		validateId(options.userDid);
+		this.rootPath = options.rootPath;
+		this.maxBytesPerScope = options.maxBytesPerScope ?? 0;
+		this.userDid = normalizeId(options.userDid);
+		this._scope = options.scopeHmacSecret ? deriveScope(this.userDid, options.scopeHmacSecret) : this.userDid;
+		this.userDir = join(this.rootPath, this._scope);
+		this._shareResolverFactory = options.shareResolverFactory;
+	}
+	/**
+	* Storage scope — mirrors `CloudflareDIDSpace.scope` (cloudflare.ts:443).
+	* De-id on → derived HMAC hash; de-id off → plaintext `userDid`.
+	* Used by consumers (e.g. the Node daemon `/user/index` mount) that need
+	* the same de-identified partition key used for physical storage.
+	*/
+	get scope() {
+		return this._scope;
+	}
+	/**
+	* Construct a SQLiteTreeIndex for this scope with the per-scope byte quota
+	* (upload-limits Phase 5) always injected — so every write path enforces it
+	* without each call site threading it. 0 = quota off (the opt-in default).
+	*/
+	sqliteTreeIndex(metadataDb, opts) {
+		return new SQLiteTreeIndex(metadataDb, this._scope, {
+			...opts,
+			maxBytesPerScope: this.maxBytesPerScope
+		});
+	}
+	/**
+	* Open a space DIRECTLY by its storage scope, WITHOUT deriving (README §5.6
+	* `/spaces` naming contract). For `/spaces/{X}` inspection where `X` is already
+	* the storage scope (a base32 hash under de-id, or a plaintext DID otherwise):
+	* the directory `{rootPath}/{storageScope}` is opened verbatim, `did` returns
+	* the opaque `storageScope`, and NO `deriveScope` runs (re-deriving would point
+	* at a non-existent `{rootPath}/{derive(storageScope)}`). Constructing with no
+	* secret guarantees `_scope === storageScope`. Callers mount it readonly.
+	*/
+	static openStorageScope(opts) {
+		return new DIDSpace({
+			rootPath: opts.rootPath,
+			userDid: opts.storageScope
+		});
+	}
+	/**
+	* Late-inject the share-resolver factory (share-out Phase 3). Used for the
+	* installer space, which `resolveLocalDIDSpace()` builds BEFORE the
+	* daemon-global share store exists. Lazy provider construction means this
+	* covers every getUserSpace provider built after the call.
+	*/
+	setShareResolverFactory(factory) {
+		this._shareResolverFactory = factory;
+	}
+	/** Expose constructor options for daemon integration (rootPath, userDid). */
+	get config() {
+		return {
+			rootPath: this.rootPath,
+			userDid: this.userDid
+		};
+	}
+	/**
+	* Lazily open (or reuse) the user-level `_metadata.db`.
+	* Creates `userDir` if missing. Only one instance per DIDSpace.
+	*/
+	async getMetadataDb() {
+		if (this.metadataDb) return this.metadataDb;
+		mkdirSync(this.userDir, { recursive: true });
+		this.metadataDb = await MetadataDB.open(this.userDir);
+		return this.metadataDb;
+	}
+	/**
+	* Upload-plane deps for the user-facing provider (design §7 / §15 decision 8).
+	* Node is FALLBACK-ONLY: it implements the actions + SQLite session table
+	* (protocol parity) but injects NO signer, so `prepare-upload` returns
+	* `grant: null` and the native client falls back to batchWrite.
+	*/
+	uploadDeps(metadataDb) {
+		return {
+			uploadSessionStore: new SqliteUploadSessionStore(metadataDb.rawClient),
+			uploadScope: this._scope
+		};
+	}
+	/**
+	* Lazily create the shared FsObjectStore rooted at `{userDir}/objects`, wrapped
+	* with the content-addressed byte cache. Returns the caching wrapper so every
+	* provider read benefits; the raw {@link objectStore} field is kept only so
+	* {@link close} can drop it.
+	*/
+	getObjectStore() {
+		if (!this.cachingStore) {
+			mkdirSync(this.userDir, { recursive: true });
+			this.objectStore = new FsObjectStore(this.userDir);
+			this.cachingStore = new CachingObjectStore(this.objectStore, this.objectByteCache);
+		}
+		return this.cachingStore;
+	}
+	/**
+	* Lazily create the `SqliteGcQueue` over the user-level `_metadata.db`
+	* (via the `MetadataDB.rawClient` getter — never reaches into private fields).
+	* One queue per DIDSpace; injected into every DIDSpaceProvider so overwrites/
+	* deletes enqueue the orphaned oldCid for the deferred sweep.
+	*/
+	async getGcQueue() {
+		if (!this.gcQueue) {
+			const queue = new SqliteGcQueue((await this.getMetadataDb()).rawClient);
+			await queue.ensureTable();
+			this.gcQueue = queue;
+		}
+		return this.gcQueue;
+	}
+	/**
+	* Run one object-GC sweep over this space's single owner scope (design §4.6).
+	* Scope-agnostic: `referencedAnywhere` is scope-blind over the one
+	* `_metadata.db`, so one sweep covers the whole daemon. Used by both the
+	* `arc space gc` CLI and the daemon's scheduled GC task (AFSScheduler, #742 S3).
+	*/
+	async runGc(opts) {
+		const metadataDb = await this.getMetadataDb();
+		const stats = await runGc({
+			queue: await this.getGcQueue(),
+			referencedAnywhere: (cid, nowMs) => referencedAnywhereLibsql(metadataDb.rawClient, cid, nowMs),
+			objectStore: this.getObjectStore(),
+			graceMs: opts?.graceMs,
+			limit: opts?.limit,
+			log: opts?.log
+		});
+		await new SqliteUploadSessionStore(metadataDb.rawClient).sweepExpired(Date.now());
+		return stats;
+	}
+	/**
+	* Back-compat no-op: the eventual-mirror subscriber is gone (the provider now
+	* writes entries + changelog atomically), so there is no in-flight work to
+	* drain. Kept so existing test/daemon call sites don't break.
+	*/
+	async drainSubscribers() {}
+	/**
+	* Get an isolated AFS instance for a blocklet instance under this DID Space,
+	* scoped by role (system = installer-side data, user = caller-side data).
+	*
+	* Mounts a single `DIDSpaceProvider` whose treeIndex is a `PrefixedTreeIndex`
+	* over the user-scoped `SQLiteTreeIndex` at `blocklets/{i}/{role}/`. The
+	* prefix is MANDATORY — without it the role root would degrade to the whole
+	* space root (data越界). Blobs share the user-level `FsObjectStore`.
+	*
+	* `userDid` is @deprecated for role:"user" — per-user isolation comes from
+	* WHICH space backs the call (the space is already the caller's), so it never
+	* enters the path; validated only as defense if supplied.
+	*/
+	async getInstanceSpace(opts) {
+		validateId(opts.instanceDid);
+		if (opts.role !== "system" && opts.role !== "user") throw new Error(`getInstanceSpace: invalid role "${opts.role}"`);
+		if (opts.role === "user" && opts.userDid != null) validateId(opts.userDid);
+		const bareInstanceId = normalizeId(opts.instanceDid);
+		const cacheKey = opts.role === "system" ? `system:${bareInstanceId}` : `user:${bareInstanceId}`;
+		const existing = this.instanceSpaces.get(cacheKey);
+		if (existing) return existing;
+		const prefix = `blocklets/${bareInstanceId}/${opts.role}/`;
+		const accessMode = opts.accessMode ?? "readwrite";
+		const metadataDb = await this.getMetadataDb();
+		const treeIndex = new PrefixedTreeIndex(this.sqliteTreeIndex(metadataDb, { inlineCache: "on" }), prefix);
+		const gcQueue = await this.getGcQueue();
+		const shareResolver = opts.role === "user" ? this._shareResolverFactory?.(this.sqliteTreeIndex(metadataDb, { inlineCache: "on" })) : void 0;
+		const afs = new AFS();
+		await afs.mount(new DIDSpaceProvider({
+			did: bareInstanceId,
+			objectStore: this.getObjectStore(),
+			treeIndex,
+			name: "content",
+			accessMode,
+			deviceId: LOCAL_DEVICE_ID,
+			gcQueue,
+			...opts.role === "user" ? {
+				shareTreePrefix: prefix,
+				...shareResolver ? {
+					shareResolver,
+					shareOwnerDid: this._scope
+				} : {},
+				blockletResolver: this.resolver,
+				blockletOwnerDid: this.userDid
+			} : {},
+			...opts.role === "user" ? this.uploadDeps(metadataDb) : {}
+		}), "/");
+		this.instanceSpaces.set(cacheKey, afs);
+		return afs;
+	}
+	/**
+	* Source-side dirty queue for an instance's `/user` fragment
+	* (index-follower-dirty-path §7, §9.2). Returns a `PrefixedTreeIndex` over the
+	* user-level `_metadata.db` (where `ds_changelog` + `ds_dirty_path` live), so
+	* the daemon can drain the merged dirty projection instead of replaying
+	* `/.changelog`. This is a RUNTIME-INTERNAL capability held directly by the
+	* daemon's follower — it is NEVER exposed as a public `/user` AFS action
+	* (ack/fail mutate scheduling state). Node has no D1 replica, so a single
+	* primary `_metadata.db` read is already read-your-write. The index writes stay
+	* in the separate `user-index.db`; only source/dirty rows are read here.
+	*/
+	async getInstanceDirtyQueue(opts) {
+		validateId(opts.instanceDid);
+		const prefix = `blocklets/${normalizeId(opts.instanceDid)}/${opts.role}/`;
+		const metadataDb = await this.getMetadataDb();
+		return new PrefixedTreeIndex(this.sqliteTreeIndex(metadataDb), prefix);
+	}
+	/**
+	* Config fragment for an instance — a sibling of the role content tree at
+	* `blocklets/<i>/config/`, mounted at `/`. Runtime-internal (mount overrides
+	* etc.); NOT part of `/instance`. Stays a plain `AFSFS` blob fragment: config
+	* is opaque machine state, not content-addressed sync data (design §2.F/T3.9).
+	*/
+	async getConfigSpace(instanceDid) {
+		validateId(instanceDid);
+		const bareInstanceId = normalizeId(instanceDid);
+		const configDir = join(this.userDir, "blocklets", bareInstanceId, "config");
+		mkdirSync(configDir, { recursive: true });
+		const afs = new AFS();
+		await afs.mount(new AFSFS({
+			localPath: configDir,
+			name: "config",
+			accessMode: "readwrite"
+		}), "/");
+		return afs;
+	}
+	/**
+	* List all instance DIDs that have storage in this user's DID space.
+	*
+	* Enumerated from the index (the source of truth) rather than `readdir` of
+	* the physical tree — the physical layout is now `objects/{cid}` + index, so
+	* there is no per-instance directory to walk. Direct children of the
+	* `blocklets/` prefix are the instance ids (trailing-slash dir rows).
+	*/
+	async listApps() {
+		const metadataDb = await this.getMetadataDb();
+		const result = await this.sqliteTreeIndex(metadataDb).listChildren("blocklets/");
+		const ids = /* @__PURE__ */ new Set();
+		for (const entry of result.entries) {
+			const rel = entry.path.slice(10).replace(/\/$/, "");
+			if (rel) ids.add(rel);
+		}
+		return [...ids];
+	}
+	/**
+	* Resolve table — persistent + DAEMON-GLOBAL (`{rootPath}/_resolve.db`, NOT
+	* the per-space `_metadata.db`): `blocklet/<id> → owner` / `domain/<host> → …`
+	* are caller-less reverse lookups that need ONE shared registry, exactly like
+	* `_shares.db` and CF's single shared D1. Backed by `SqliteResolveStore` so
+	* entries survive across DID-Space instances and daemon restarts — symmetric
+	* with `CloudflareDIDSpace.resolver` (D1ResolveStore). Closed in {@link close}.
+	*/
+	get resolver() {
+		if (!this._resolver) {
+			this._resolveStore = new SqliteResolveStore(join(this.rootPath, "_resolve.db"));
+			this._resolver = new DIDSpaceResolver(this._resolveStore);
+		}
+		return this._resolver;
+	}
+	/**
+	* Whole-space root (contract alias `getSpaceRoot`; legacy name `getUserSpace`)
+	* — a `DIDSpaceProvider` over the NO-PREFIX user-scoped `SQLiteTreeIndex`, so
+	* it sees every instance fragment in the space. Used by `arc space`
+	* export/import/diff (CLI manifest source) and observability. Mobile sync does
+	* NOT use it (mobile goes through the aside `/user` fragment).
+	*/
+	async getSpaceRoot(options) {
+		return this.getUserSpace(options);
+	}
+	async getUserSpace(options) {
+		const metadataDb = await this.getMetadataDb();
+		const gcQueue = await this.getGcQueue();
+		const afs = new AFS();
+		const scopeTreeIndex = this.sqliteTreeIndex(metadataDb, { inlineCache: "on" });
+		await afs.mount(new DIDSpaceProvider({
+			did: this.userDid,
+			objectStore: this.getObjectStore(),
+			treeIndex: scopeTreeIndex,
+			name: "did-space-user",
+			accessMode: options?.accessMode ?? "readonly",
+			deviceId: LOCAL_DEVICE_ID,
+			gcQueue,
+			shareResolver: this._shareResolverFactory?.(scopeTreeIndex),
+			blockletResolver: this.resolver,
+			blockletOwnerDid: this.userDid,
+			...this.uploadDeps(metadataDb)
+		}), "/");
+		attachMetadataContext(afs, {
+			metadataDb,
+			userDir: this.userDir,
+			scope: this._scope
+		});
+		return afs;
+	}
+	/**
+	* Share-out Phase 4: a READONLY AFS for public `/s/{slug}` serving, scoped by
+	* `prefix` (with trailing slash, e.g. `docs/`) or — when undefined — the whole
+	* owner tree (root share + sidecar). Reuses THIS space's metadataDb +
+	* objectStore (no second libsql client on `_metadata.db`, which would race).
+	* No shareResolver injected: serving is read-only, never reconciles.
+	*/
+	async getShareServeAFS(prefix) {
+		const metadataDb = await this.getMetadataDb();
+		const base = this.sqliteTreeIndex(metadataDb, { inlineCache: "on" });
+		const treeIndex = prefix ? new PrefixedTreeIndex(base, prefix) : base;
+		const afs = new AFS();
+		await afs.mount(new DIDSpaceProvider({
+			did: this.userDid,
+			objectStore: this.getObjectStore(),
+			treeIndex,
+			name: "did-space-share-serve",
+			accessMode: "readonly",
+			deviceId: LOCAL_DEVICE_ID
+		}), "/");
+		return afs;
+	}
+	/**
+	* Clean up resources. Closes the user-level MetadataDB and clears the
+	* instance-space cache. No event subscriptions to tear down anymore.
+	*/
+	close() {
+		if (this.metadataDb) {
+			try {
+				this.metadataDb.close();
+			} catch {}
+			this.metadataDb = null;
+		}
+		if (this._resolveStore) {
+			this._resolveStore.close();
+			this._resolveStore = void 0;
+			this._resolver = void 0;
+		}
+		this.gcQueue = null;
+		this.objectStore = null;
+		this.cachingStore = null;
+		this.instanceSpaces.clear();
+	}
+};
+
+//#endregion
+export { DIDSpace, FsObjectStore, MetadataDB, SQLiteTreeIndex, migrateNodeMetadataDb, migrateNodeSpaces, normalizeId, reconcile, validateId };
+//# sourceMappingURL=local.mjs.map

package/dist/local.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.mjs","names":[],"sources":["../src/local.ts"],"sourcesContent":["/**\n * DIDSpace — local (Node) backend for DID-scoped storage.\n *\n * Phase 3 (mobile-didspace-transport): unified onto the single\n * `DIDSpaceProvider`, exactly like the Cloudflare backend — only the injected\n * storage primitives differ (Node: `FsObjectStore` + `SQLiteTreeIndex`; CF: R2\n * + `D1TreeIndex`). This makes the backend runtime-agnostic per CLAUDE.md and\n * gives Node the content-addressed `.objects/{cid}`, `.changelog`, `maxDepth:-1`\n * manifest, device-aware writes, and ifMatch that the bare `AFSFS` mount lacked.\n *\n * Layout (relative to `userDir`, all under `entries.scope = <storage scope>` —\n * the derived scope when de-id is on, else the plaintext DID; `userDir` itself\n * is `{rootPath}/{storage scope}`):\n *   role:\"system\" → PrefixedTreeIndex `blocklets/{i}/system/`   (mounted at `/`)\n *   role:\"user\"   → PrefixedTreeIndex `blocklets/{i}/user/`     (mounted at `/`)\n *   space root    → no-prefix SQLiteTreeIndex (whole space; CLI manifest)\n *   config        → AFSFS `blocklets/{i}/config/`               (blob fragment)\n * Content blobs live once at `{userDir}/objects/{cid}` (FsObjectStore); the\n * index (`_metadata.db`) is the source of truth. The old eventual-mirror\n * subscriber + `desktop:default` deviceId hardcode are gone — the provider's\n * `put` writes entries + changelog atomically.\n *\n * Usage:\n *   const space = new DIDSpace({ rootPath: \"~/.afs/spaces\", userDid: \"did:abt:z1...\" });\n *   const afs = await space.getInstanceSpace({ instanceDid: \"z1app\", role: \"system\" });\n *   await afs.write(\"/hello.txt\", { content: \"hello\" });\n */\n\n// biome-ignore lint/style/noRestrictedImports: provider internal — DIDSpace manages physical directories\nimport { mkdirSync } from \"node:fs\";\n// biome-ignore lint/style/noRestrictedImports: provider internal — path joins for directory layout\nimport { join } from \"node:path\";\nimport { AFS, type AFSAccessMode } from \"@aigne/afs\";\nimport { AFSFS } from \"@aigne/afs-fs\";\nimport type { ObjectStore } from \"@aigne/afs-r2\";\nimport { attachMetadataContext } from \"./afs-metadata-context.js\";\nimport { CachingObjectStore, CidByteCache } from \"./cid-byte-cache.js\";\nimport type { DIDSpaceLike, InstanceSpaceOptions } from \"./did-space-like.js\";\nimport { normalizeId, validateId } from \"./did-utils.js\";\nimport { FsObjectStore } from \"./fs-object-store.js\";\nimport { DIDSpaceProvider } from \"./index.js\";\nimport { MetadataDB } from \"./metadata-db.js\";\nimport { PrefixedTreeIndex } from \"./prefixed-tree-index.js\";\nimport { referencedAnywhereLibsql } from \"./reference-check.js\";\nimport { DIDSpaceResolver } from \"./resolve.js\";\nimport { type GcStats, runGc } from \"./run-gc.js\";\nimport { deriveScope } from \"./scope-id.js\";\nimport type { ShareResolver } from \"./share-resolve.js\";\nimport { SqliteGcQueue } from \"./sqlite-gc-queue.js\";\nimport { SqliteResolveStore } from \"./sqlite-resolve-store.js\";\nimport { SQLiteTreeIndex } from \"./sqlite-tree-index.js\";\nimport type { TreeIndex } from \"./tree-index.js\";\nimport { SqliteUploadSessionStore } from \"./upload-session-store.js\";\n\n/**\n * Builds a {@link ShareResolver} for a user/owner space (share-out Phase 3).\n * The daemon-global share store is captured in the factory's closure (one\n * `_shares.db` across all owners); `scopeTreeIndex` is the per-space tree index\n * (WHOLE user tree, no prefix) the resolver uses for sidecar/.web pre-io checks.\n * Injected into `getUserSpace` (whole-space) AND `getInstanceSpace(role:\"user\")`\n * (the caller's own per-user blocklet fragment — `/user` mount + mobile-sync\n * target); the fragment provider remaps owner→userDid + restores the full decl\n * path. role:\"system\" instance spaces are NEVER shared (installer data).\n */\nexport type ShareResolverFactory = (scopeTreeIndex: TreeIndex) => ShareResolver;\n\nexport { normalizeId, validateId } from \"./did-utils.js\";\nexport { FsObjectStore } from \"./fs-object-store.js\";\nexport type { CidCacheRow, EntryRow } from \"./metadata-db.js\";\nexport { MetadataDB } from \"./metadata-db.js\";\nexport type { ReconcileOptions, ReconcileStats } from \"./reconcile.js\";\nexport { reconcile } from \"./reconcile.js\";\n// Node scope de-id migration (uses node:fs) — lives behind ./local, NOT index,\n// so it never reaches the CF worker bundle's node:fs stub (README §5.4).\nexport {\n  migrateNodeMetadataDb,\n  migrateNodeSpaces,\n  type NodeScopeMigrationOptions,\n  type NodeScopeMigrationReport,\n} from \"./scope-migration-node.js\";\nexport { SQLiteTreeIndex } from \"./sqlite-tree-index.js\";\n\n/** Local desktop device label written into changelog rows for local writes. */\nconst LOCAL_DEVICE_ID = \"desktop:default\";\n\nexport interface DIDSpaceOptions {\n  /** Root directory for all DID spaces (e.g., ~/.afs/spaces) */\n  rootPath: string;\n  /** Owner DID of this space */\n  userDid: string;\n  /**\n   * Per-deployment HMAC secret for scope de-identification (README §5.3). When\n   * set, the storage scope — the directory name `{rootPath}/{scope}`, the\n   * `_metadata.db` scope columns, and the `_shares.db` owner_did — becomes\n   * `deriveScope(userDid, secret)`. When absent, scope stays the plaintext DID\n   * (de-id off, back-compat). Each deployment has its own secret (§5.5).\n   */\n  scopeHmacSecret?: Uint8Array;\n  /**\n   * Share-out Phase 3: optional factory that builds a ShareResolver for this\n   * space's `getUserSpace` provider (closure over the daemon-global share\n   * store). Can also be late-injected via {@link DIDSpace.setShareResolverFactory}\n   * for spaces constructed before the store exists (installer space).\n   */\n  shareResolverFactory?: ShareResolverFactory;\n  /**\n   * upload-limits Phase 5 per-scope byte quota (bytes). 0 / unset = OFF (the\n   * opt-in default). Threaded into every SQLiteTreeIndex this space builds.\n   * The Node daemon resolves it from `resolveUploadLimits(process.env)`.\n   */\n  maxBytesPerScope?: number;\n}\n\nexport type { InstanceSpaceOptions } from \"./did-space-like.js\";\n\nexport class DIDSpace implements DIDSpaceLike {\n  private readonly rootPath: string;\n  /** Real normalizeId(DID) — identity, returned to callers (NOT a storage key). */\n  private readonly userDid: string;\n  /**\n   * Storage scope — `deriveScope(userDid, secret)` when de-id is on, else the\n   * plaintext `userDid`. Drives the directory name (`userDir`), every\n   * SQLiteTreeIndex scope, and `_shares.db` owner_did. Named `_scope` to mirror\n   * the CF backend (cloudflare.ts).\n   */\n  private readonly _scope: string;\n  readonly userDir: string;\n  private readonly instanceSpaces = new Map<string, AFS>();\n  private _resolver?: DIDSpaceResolver;\n  /** Backing store for {@link resolver}; closed in {@link close}. */\n  private _resolveStore?: SqliteResolveStore;\n\n  /** User-level MetadataDB; lazy-opened on first getInstanceSpace/getUserSpace */\n  private metadataDb: MetadataDB | null = null;\n  /** Shared content-addressed object store (one objects/ dir per user space). */\n  private objectStore: FsObjectStore | null = null;\n  /**\n   * `objectStore` wrapped with a content-addressed byte cache (#674 perf). Keyed\n   * by cid (immutable) → no staleness, no TTL; bounded LRU keeps memory flat.\n   * Persists for this DID-Space's lifetime (the Node daemon reuses it per user).\n   */\n  private cachingStore: ObjectStore | null = null;\n  private readonly objectByteCache = new CidByteCache();\n  /** GC queue over `_metadata.db` (deferred object cleanup); lazy, ensureTable once. */\n  private gcQueue: SqliteGcQueue | null = null;\n  /**\n   * Share-out Phase 3: builds the ShareResolver for getUserSpace providers.\n   * Read lazily at provider-construction time, so a late {@link\n   * setShareResolverFactory} (installer space) still covers providers built\n   * after the call. Undefined → no share-out (back-compat: dark-wired off).\n   */\n  private _shareResolverFactory?: ShareResolverFactory;\n  /** upload-limits Phase 5 per-scope byte quota (0 = off, the opt-in default). */\n  private readonly maxBytesPerScope: number;\n\n  constructor(options: DIDSpaceOptions) {\n    validateId(options.userDid);\n    this.rootPath = options.rootPath;\n    this.maxBytesPerScope = options.maxBytesPerScope ?? 0;\n    this.userDid = normalizeId(options.userDid);\n    // de-id opt-in (README §5.3): derive an opaque storage scope only when a\n    // secret is provided; otherwise keep the plaintext DID (back-compat). The\n    // directory name + all DB scope keys use `_scope`; identity uses `userDid`.\n    this._scope = options.scopeHmacSecret\n      ? deriveScope(this.userDid, options.scopeHmacSecret)\n      : this.userDid;\n    this.userDir = join(this.rootPath, this._scope);\n    this._shareResolverFactory = options.shareResolverFactory;\n  }\n\n  /**\n   * Storage scope — mirrors `CloudflareDIDSpace.scope` (cloudflare.ts:443).\n   * De-id on → derived HMAC hash; de-id off → plaintext `userDid`.\n   * Used by consumers (e.g. the Node daemon `/user/index` mount) that need\n   * the same de-identified partition key used for physical storage.\n   */\n  get scope(): string {\n    return this._scope;\n  }\n\n  /**\n   * Construct a SQLiteTreeIndex for this scope with the per-scope byte quota\n   * (upload-limits Phase 5) always injected — so every write path enforces it\n   * without each call site threading it. 0 = quota off (the opt-in default).\n   */\n  private sqliteTreeIndex(metadataDb: MetadataDB, opts?: { inlineCache?: \"on\" }): SQLiteTreeIndex {\n    return new SQLiteTreeIndex(metadataDb, this._scope, {\n      ...opts,\n      maxBytesPerScope: this.maxBytesPerScope,\n    });\n  }\n\n  /**\n   * Open a space DIRECTLY by its storage scope, WITHOUT deriving (README §5.6\n   * `/spaces` naming contract). For `/spaces/{X}` inspection where `X` is already\n   * the storage scope (a base32 hash under de-id, or a plaintext DID otherwise):\n   * the directory `{rootPath}/{storageScope}` is opened verbatim, `did` returns\n   * the opaque `storageScope`, and NO `deriveScope` runs (re-deriving would point\n   * at a non-existent `{rootPath}/{derive(storageScope)}`). Constructing with no\n   * secret guarantees `_scope === storageScope`. Callers mount it readonly.\n   */\n  static openStorageScope(opts: { rootPath: string; storageScope: string }): DIDSpace {\n    return new DIDSpace({ rootPath: opts.rootPath, userDid: opts.storageScope });\n  }\n\n  /**\n   * Late-inject the share-resolver factory (share-out Phase 3). Used for the\n   * installer space, which `resolveLocalDIDSpace()` builds BEFORE the\n   * daemon-global share store exists. Lazy provider construction means this\n   * covers every getUserSpace provider built after the call.\n   */\n  setShareResolverFactory(factory: ShareResolverFactory): void {\n    this._shareResolverFactory = factory;\n  }\n\n  /** Expose constructor options for daemon integration (rootPath, userDid). */\n  get config(): Readonly<DIDSpaceOptions> {\n    return { rootPath: this.rootPath, userDid: this.userDid };\n  }\n\n  /**\n   * Lazily open (or reuse) the user-level `_metadata.db`.\n   * Creates `userDir` if missing. Only one instance per DIDSpace.\n   */\n  async getMetadataDb(): Promise<MetadataDB> {\n    if (this.metadataDb) return this.metadataDb;\n    mkdirSync(this.userDir, { recursive: true });\n    this.metadataDb = await MetadataDB.open(this.userDir);\n    return this.metadataDb;\n  }\n\n  /**\n   * Upload-plane deps for the user-facing provider (design §7 / §15 decision 8).\n   * Node is FALLBACK-ONLY: it implements the actions + SQLite session table\n   * (protocol parity) but injects NO signer, so `prepare-upload` returns\n   * `grant: null` and the native client falls back to batchWrite.\n   */\n  private uploadDeps(metadataDb: MetadataDB) {\n    return {\n      uploadSessionStore: new SqliteUploadSessionStore(metadataDb.rawClient),\n      uploadScope: this._scope,\n    };\n  }\n\n  /**\n   * Lazily create the shared FsObjectStore rooted at `{userDir}/objects`, wrapped\n   * with the content-addressed byte cache. Returns the caching wrapper so every\n   * provider read benefits; the raw {@link objectStore} field is kept only so\n   * {@link close} can drop it.\n   */\n  private getObjectStore(): ObjectStore {\n    if (!this.cachingStore) {\n      mkdirSync(this.userDir, { recursive: true });\n      this.objectStore = new FsObjectStore(this.userDir);\n      this.cachingStore = new CachingObjectStore(this.objectStore, this.objectByteCache);\n    }\n    return this.cachingStore;\n  }\n\n  /**\n   * Lazily create the `SqliteGcQueue` over the user-level `_metadata.db`\n   * (via the `MetadataDB.rawClient` getter — never reaches into private fields).\n   * One queue per DIDSpace; injected into every DIDSpaceProvider so overwrites/\n   * deletes enqueue the orphaned oldCid for the deferred sweep.\n   */\n  private async getGcQueue(): Promise<SqliteGcQueue> {\n    if (!this.gcQueue) {\n      const metadataDb = await this.getMetadataDb();\n      const queue = new SqliteGcQueue(metadataDb.rawClient);\n      await queue.ensureTable();\n      this.gcQueue = queue;\n    }\n    return this.gcQueue;\n  }\n\n  /**\n   * Run one object-GC sweep over this space's single owner scope (design §4.6).\n   * Scope-agnostic: `referencedAnywhere` is scope-blind over the one\n   * `_metadata.db`, so one sweep covers the whole daemon. Used by both the\n   * `arc space gc` CLI and the daemon's scheduled GC task (AFSScheduler, #742 S3).\n   */\n  async runGc(opts?: {\n    graceMs?: number;\n    limit?: number;\n    log?: (line: string) => void;\n  }): Promise<GcStats> {\n    const metadataDb = await this.getMetadataDb();\n    const queue = await this.getGcQueue();\n    const stats = await runGc({\n      queue,\n      referencedAnywhere: (cid, nowMs) =>\n        referencedAnywhereLibsql(metadataDb.rawClient, cid, nowMs),\n      objectStore: this.getObjectStore(),\n      graceMs: opts?.graceMs,\n      limit: opts?.limit,\n      log: opts?.log,\n    });\n    // Sweep terminal upload sessions (committed, aborted, expired-prepared) once\n    // GC finishes. Their expires_at is the 2-hour window from session creation;\n    // past that, the records serve no purpose (GC in-flight protection already\n    // requires expires_at > nowMs, so expired sessions never blocked GC anyway).\n    await new SqliteUploadSessionStore(metadataDb.rawClient).sweepExpired(Date.now());\n    return stats;\n  }\n\n  /**\n   * Back-compat no-op: the eventual-mirror subscriber is gone (the provider now\n   * writes entries + changelog atomically), so there is no in-flight work to\n   * drain. Kept so existing test/daemon call sites don't break.\n   */\n  async drainSubscribers(): Promise<void> {\n    return;\n  }\n\n  /**\n   * Get an isolated AFS instance for a blocklet instance under this DID Space,\n   * scoped by role (system = installer-side data, user = caller-side data).\n   *\n   * Mounts a single `DIDSpaceProvider` whose treeIndex is a `PrefixedTreeIndex`\n   * over the user-scoped `SQLiteTreeIndex` at `blocklets/{i}/{role}/`. The\n   * prefix is MANDATORY — without it the role root would degrade to the whole\n   * space root (data越界). Blobs share the user-level `FsObjectStore`.\n   *\n   * `userDid` is @deprecated for role:\"user\" — per-user isolation comes from\n   * WHICH space backs the call (the space is already the caller's), so it never\n   * enters the path; validated only as defense if supplied.\n   */\n  async getInstanceSpace(opts: InstanceSpaceOptions): Promise<AFS> {\n    validateId(opts.instanceDid);\n    if (opts.role !== \"system\" && opts.role !== \"user\") {\n      throw new Error(`getInstanceSpace: invalid role \"${opts.role}\"`);\n    }\n    if (opts.role === \"user\" && opts.userDid != null) {\n      validateId(opts.userDid);\n    }\n\n    const bareInstanceId = normalizeId(opts.instanceDid);\n    const cacheKey = opts.role === \"system\" ? `system:${bareInstanceId}` : `user:${bareInstanceId}`;\n    const existing = this.instanceSpaces.get(cacheKey);\n    if (existing) return existing;\n\n    const prefix = `blocklets/${bareInstanceId}/${opts.role}/`;\n    const accessMode: AFSAccessMode = opts.accessMode ?? \"readwrite\";\n\n    const metadataDb = await this.getMetadataDb();\n    // inlineCache \"on\" = write-through (settings-layering 1d): text content\n    // ≤ threshold rides the index row as a cid-verified read-acceleration\n    // copy. The `objects/{cid}` blob is ALWAYS written regardless\n    // (cas-blob-always-written) — sync/GC semantics are untouched.\n    const treeIndex = new PrefixedTreeIndex(\n      this.sqliteTreeIndex(metadataDb, { inlineCache: \"on\" }),\n      prefix,\n    );\n    const gcQueue = await this.getGcQueue();\n\n    // Share-out (symmetric with CloudflareDIDSpace.getInstanceSpace): a `.share`\n    // written into the caller's OWN per-user fragment (role:\"user\" — the `/user`\n    // session mount + the mobile-sync target) reconciles into the shares index.\n    // The resolver is built over a NO-PREFIX whole-user-tree index (NOT the\n    // prefixed `treeIndex` above) so sidecar/.web checks see full paths; the\n    // provider remaps owner→userDid + restores the full decl path via the\n    // prefix. role:\"system\" stays excluded (installer data is never public).\n    const shareResolver =\n      opts.role === \"user\"\n        ? this._shareResolverFactory?.(this.sqliteTreeIndex(metadataDb, { inlineCache: \"on\" }))\n        : undefined;\n\n    const afs = new AFS();\n    await afs.mount(\n      new DIDSpaceProvider({\n        did: bareInstanceId,\n        objectStore: this.getObjectStore(),\n        treeIndex,\n        name: \"content\",\n        accessMode,\n        deviceId: LOCAL_DEVICE_ID,\n        gcQueue,\n        // Share-out + blocklet publish (#674) on the caller's own `/user`\n        // fragment. shareTreePrefix restores the whole-tree physical path for\n        // BOTH hooks; set for all role:\"user\" fragments so the blocklet hook\n        // captures the full path even when shares are off. blocklet owner =\n        // PLAINTEXT userDid (the instance `did` would be wrong — serve re-derives\n        // the scope from it).\n        ...(opts.role === \"user\"\n          ? {\n              shareTreePrefix: prefix,\n              ...(shareResolver ? { shareResolver, shareOwnerDid: this._scope } : {}),\n              blockletResolver: this.resolver,\n              blockletOwnerDid: this.userDid,\n            }\n          : {}),\n        // Upload plane only on the caller's own `/user` fragment (fallback-only\n        // on Node: no signer). role:\"system\" (installer) never gets it.\n        ...(opts.role === \"user\" ? this.uploadDeps(metadataDb) : {}),\n      }),\n      \"/\",\n    );\n\n    this.instanceSpaces.set(cacheKey, afs);\n    return afs;\n  }\n\n  /**\n   * Source-side dirty queue for an instance's `/user` fragment\n   * (index-follower-dirty-path §7, §9.2). Returns a `PrefixedTreeIndex` over the\n   * user-level `_metadata.db` (where `ds_changelog` + `ds_dirty_path` live), so\n   * the daemon can drain the merged dirty projection instead of replaying\n   * `/.changelog`. This is a RUNTIME-INTERNAL capability held directly by the\n   * daemon's follower — it is NEVER exposed as a public `/user` AFS action\n   * (ack/fail mutate scheduling state). Node has no D1 replica, so a single\n   * primary `_metadata.db` read is already read-your-write. The index writes stay\n   * in the separate `user-index.db`; only source/dirty rows are read here.\n   */\n  async getInstanceDirtyQueue(opts: {\n    instanceDid: string;\n    role: \"user\";\n  }): Promise<PrefixedTreeIndex> {\n    validateId(opts.instanceDid);\n    const bareInstanceId = normalizeId(opts.instanceDid);\n    const prefix = `blocklets/${bareInstanceId}/${opts.role}/`;\n    const metadataDb = await this.getMetadataDb();\n    return new PrefixedTreeIndex(this.sqliteTreeIndex(metadataDb), prefix);\n  }\n\n  /**\n   * Config fragment for an instance — a sibling of the role content tree at\n   * `blocklets/<i>/config/`, mounted at `/`. Runtime-internal (mount overrides\n   * etc.); NOT part of `/instance`. Stays a plain `AFSFS` blob fragment: config\n   * is opaque machine state, not content-addressed sync data (design §2.F/T3.9).\n   */\n  async getConfigSpace(instanceDid: string): Promise<AFS> {\n    validateId(instanceDid);\n    const bareInstanceId = normalizeId(instanceDid);\n    const configDir = join(this.userDir, \"blocklets\", bareInstanceId, \"config\");\n    mkdirSync(configDir, { recursive: true });\n    const afs = new AFS();\n    await afs.mount(\n      new AFSFS({ localPath: configDir, name: \"config\", accessMode: \"readwrite\" }),\n      \"/\",\n    );\n    return afs;\n  }\n\n  /**\n   * List all instance DIDs that have storage in this user's DID space.\n   *\n   * Enumerated from the index (the source of truth) rather than `readdir` of\n   * the physical tree — the physical layout is now `objects/{cid}` + index, so\n   * there is no per-instance directory to walk. Direct children of the\n   * `blocklets/` prefix are the instance ids (trailing-slash dir rows).\n   */\n  async listApps(): Promise<string[]> {\n    const metadataDb = await this.getMetadataDb();\n    const index = this.sqliteTreeIndex(metadataDb);\n    const result = await index.listChildren(\"blocklets/\");\n    // Children come back as \"blocklets/<i>/\" (dir) — strip prefix + trailing /.\n    const ids = new Set<string>();\n    for (const entry of result.entries) {\n      const rel = entry.path.slice(\"blocklets/\".length).replace(/\\/$/, \"\");\n      if (rel) ids.add(rel);\n    }\n    return [...ids];\n  }\n\n  /**\n   * Resolve table — persistent + DAEMON-GLOBAL (`{rootPath}/_resolve.db`, NOT\n   * the per-space `_metadata.db`): `blocklet/<id> → owner` / `domain/<host> → …`\n   * are caller-less reverse lookups that need ONE shared registry, exactly like\n   * `_shares.db` and CF's single shared D1. Backed by `SqliteResolveStore` so\n   * entries survive across DID-Space instances and daemon restarts — symmetric\n   * with `CloudflareDIDSpace.resolver` (D1ResolveStore). Closed in {@link close}.\n   */\n  get resolver(): DIDSpaceResolver {\n    if (!this._resolver) {\n      this._resolveStore = new SqliteResolveStore(join(this.rootPath, \"_resolve.db\"));\n      this._resolver = new DIDSpaceResolver(this._resolveStore);\n    }\n    return this._resolver;\n  }\n\n  /**\n   * Whole-space root (contract alias `getSpaceRoot`; legacy name `getUserSpace`)\n   * — a `DIDSpaceProvider` over the NO-PREFIX user-scoped `SQLiteTreeIndex`, so\n   * it sees every instance fragment in the space. Used by `arc space`\n   * export/import/diff (CLI manifest source) and observability. Mobile sync does\n   * NOT use it (mobile goes through the aside `/user` fragment).\n   */\n  async getSpaceRoot(options?: { accessMode?: AFSAccessMode }): Promise<AFS> {\n    return this.getUserSpace(options);\n  }\n\n  async getUserSpace(options?: { accessMode?: AFSAccessMode }): Promise<AFS> {\n    const metadataDb = await this.getMetadataDb();\n    const gcQueue = await this.getGcQueue();\n    const afs = new AFS();\n    // Write-through on (1d) — see getInstanceSpace.\n    const scopeTreeIndex = this.sqliteTreeIndex(metadataDb, { inlineCache: \"on\" });\n    await afs.mount(\n      new DIDSpaceProvider({\n        did: this.userDid,\n        objectStore: this.getObjectStore(),\n        treeIndex: scopeTreeIndex,\n        name: \"did-space-user\",\n        accessMode: options?.accessMode ?? \"readonly\",\n        deviceId: LOCAL_DEVICE_ID,\n        gcQueue,\n        // Share-out Phase 3: the whole-space provider gets a ShareResolver\n        // (write hook + `.shares/` virtual view). The per-user instance fragment\n        // (getInstanceSpace role:\"user\") ALSO reconciles `.share` writes — see\n        // there — but role:\"system\" never does. Read the factory lazily so a\n        // late setShareResolverFactory still applies.\n        shareResolver: this._shareResolverFactory?.(scopeTreeIndex),\n        // #674: blocklet publish/resolve on whole-space writes (e.g.\n        // `arc deploy --publish` local → `/blocklets/<id>/blocklet.yaml`).\n        // owner = plaintext userDid (== this.did here, whole-space provider).\n        blockletResolver: this.resolver,\n        blockletOwnerDid: this.userDid,\n        ...this.uploadDeps(metadataDb),\n      }),\n      \"/\",\n    );\n\n    // buildManifestFromDB reads the index (SoT) directly; the context just\n    // hands it the metadataDb + scope (no FS reconcile anymore — see rsync.ts).\n    attachMetadataContext(afs, {\n      metadataDb,\n      userDir: this.userDir,\n      scope: this._scope,\n    });\n    return afs;\n  }\n\n  /**\n   * Share-out Phase 4: a READONLY AFS for public `/s/{slug}` serving, scoped by\n   * `prefix` (with trailing slash, e.g. `docs/`) or — when undefined — the whole\n   * owner tree (root share + sidecar). Reuses THIS space's metadataDb +\n   * objectStore (no second libsql client on `_metadata.db`, which would race).\n   * No shareResolver injected: serving is read-only, never reconciles.\n   */\n  async getShareServeAFS(prefix?: string): Promise<AFS> {\n    const metadataDb = await this.getMetadataDb();\n    const base = this.sqliteTreeIndex(metadataDb, { inlineCache: \"on\" });\n    const treeIndex = prefix ? new PrefixedTreeIndex(base, prefix) : base;\n    const afs = new AFS();\n    await afs.mount(\n      new DIDSpaceProvider({\n        did: this.userDid,\n        objectStore: this.getObjectStore(),\n        treeIndex,\n        name: \"did-space-share-serve\",\n        accessMode: \"readonly\",\n        deviceId: LOCAL_DEVICE_ID,\n      }),\n      \"/\",\n    );\n    return afs;\n  }\n\n  /**\n   * Clean up resources. Closes the user-level MetadataDB and clears the\n   * instance-space cache. No event subscriptions to tear down anymore.\n   */\n  close(): void {\n    if (this.metadataDb) {\n      try {\n        this.metadataDb.close();\n      } catch {\n        // best effort — DB may already be closed\n      }\n      this.metadataDb = null;\n    }\n    if (this._resolveStore) {\n      // async close (libsql client) — fire-and-forget; nothing awaits teardown.\n      void this._resolveStore.close();\n      this._resolveStore = undefined;\n      this._resolver = undefined;\n    }\n    this.gcQueue = null;\n    this.objectStore = null;\n    this.cachingStore = null;\n    this.instanceSpaces.clear();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmFA,MAAM,kBAAkB;AAgCxB,IAAa,WAAb,MAAa,SAAiC;CAC5C,AAAiB;;CAEjB,AAAiB;;;;;;;CAOjB,AAAiB;CACjB,AAAS;CACT,AAAiB,iCAAiB,IAAI,KAAkB;CACxD,AAAQ;;CAER,AAAQ;;CAGR,AAAQ,aAAgC;;CAExC,AAAQ,cAAoC;;;;;;CAM5C,AAAQ,eAAmC;CAC3C,AAAiB,kBAAkB,IAAI,cAAc;;CAErD,AAAQ,UAAgC;;;;;;;CAOxC,AAAQ;;CAER,AAAiB;CAEjB,YAAY,SAA0B;AACpC,aAAW,QAAQ,QAAQ;AAC3B,OAAK,WAAW,QAAQ;AACxB,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,UAAU,YAAY,QAAQ,QAAQ;AAI3C,OAAK,SAAS,QAAQ,kBAClB,YAAY,KAAK,SAAS,QAAQ,gBAAgB,GAClD,KAAK;AACT,OAAK,UAAU,KAAK,KAAK,UAAU,KAAK,OAAO;AAC/C,OAAK,wBAAwB,QAAQ;;;;;;;;CASvC,IAAI,QAAgB;AAClB,SAAO,KAAK;;;;;;;CAQd,AAAQ,gBAAgB,YAAwB,MAAgD;AAC9F,SAAO,IAAI,gBAAgB,YAAY,KAAK,QAAQ;GAClD,GAAG;GACH,kBAAkB,KAAK;GACxB,CAAC;;;;;;;;;;;CAYJ,OAAO,iBAAiB,MAA4D;AAClF,SAAO,IAAI,SAAS;GAAE,UAAU,KAAK;GAAU,SAAS,KAAK;GAAc,CAAC;;;;;;;;CAS9E,wBAAwB,SAAqC;AAC3D,OAAK,wBAAwB;;;CAI/B,IAAI,SAAoC;AACtC,SAAO;GAAE,UAAU,KAAK;GAAU,SAAS,KAAK;GAAS;;;;;;CAO3D,MAAM,gBAAqC;AACzC,MAAI,KAAK,WAAY,QAAO,KAAK;AACjC,YAAU,KAAK,SAAS,EAAE,WAAW,MAAM,CAAC;AAC5C,OAAK,aAAa,MAAM,WAAW,KAAK,KAAK,QAAQ;AACrD,SAAO,KAAK;;;;;;;;CASd,AAAQ,WAAW,YAAwB;AACzC,SAAO;GACL,oBAAoB,IAAI,yBAAyB,WAAW,UAAU;GACtE,aAAa,KAAK;GACnB;;;;;;;;CASH,AAAQ,iBAA8B;AACpC,MAAI,CAAC,KAAK,cAAc;AACtB,aAAU,KAAK,SAAS,EAAE,WAAW,MAAM,CAAC;AAC5C,QAAK,cAAc,IAAI,cAAc,KAAK,QAAQ;AAClD,QAAK,eAAe,IAAI,mBAAmB,KAAK,aAAa,KAAK,gBAAgB;;AAEpF,SAAO,KAAK;;;;;;;;CASd,MAAc,aAAqC;AACjD,MAAI,CAAC,KAAK,SAAS;GAEjB,MAAM,QAAQ,IAAI,eADC,MAAM,KAAK,eAAe,EACF,UAAU;AACrD,SAAM,MAAM,aAAa;AACzB,QAAK,UAAU;;AAEjB,SAAO,KAAK;;;;;;;;CASd,MAAM,MAAM,MAIS;EACnB,MAAM,aAAa,MAAM,KAAK,eAAe;EAE7C,MAAM,QAAQ,MAAM,MAAM;GACxB,OAFY,MAAM,KAAK,YAAY;GAGnC,qBAAqB,KAAK,UACxB,yBAAyB,WAAW,WAAW,KAAK,MAAM;GAC5D,aAAa,KAAK,gBAAgB;GAClC,SAAS,MAAM;GACf,OAAO,MAAM;GACb,KAAK,MAAM;GACZ,CAAC;AAKF,QAAM,IAAI,yBAAyB,WAAW,UAAU,CAAC,aAAa,KAAK,KAAK,CAAC;AACjF,SAAO;;;;;;;CAQT,MAAM,mBAAkC;;;;;;;;;;;;;;CAiBxC,MAAM,iBAAiB,MAA0C;AAC/D,aAAW,KAAK,YAAY;AAC5B,MAAI,KAAK,SAAS,YAAY,KAAK,SAAS,OAC1C,OAAM,IAAI,MAAM,mCAAmC,KAAK,KAAK,GAAG;AAElE,MAAI,KAAK,SAAS,UAAU,KAAK,WAAW,KAC1C,YAAW,KAAK,QAAQ;EAG1B,MAAM,iBAAiB,YAAY,KAAK,YAAY;EACpD,MAAM,WAAW,KAAK,SAAS,WAAW,UAAU,mBAAmB,QAAQ;EAC/E,MAAM,WAAW,KAAK,eAAe,IAAI,SAAS;AAClD,MAAI,SAAU,QAAO;EAErB,MAAM,SAAS,aAAa,eAAe,GAAG,KAAK,KAAK;EACxD,MAAM,aAA4B,KAAK,cAAc;EAErD,MAAM,aAAa,MAAM,KAAK,eAAe;EAK7C,MAAM,YAAY,IAAI,kBACpB,KAAK,gBAAgB,YAAY,EAAE,aAAa,MAAM,CAAC,EACvD,OACD;EACD,MAAM,UAAU,MAAM,KAAK,YAAY;EASvC,MAAM,gBACJ,KAAK,SAAS,SACV,KAAK,wBAAwB,KAAK,gBAAgB,YAAY,EAAE,aAAa,MAAM,CAAC,CAAC,GACrF;EAEN,MAAM,MAAM,IAAI,KAAK;AACrB,QAAM,IAAI,MACR,IAAI,iBAAiB;GACnB,KAAK;GACL,aAAa,KAAK,gBAAgB;GAClC;GACA,MAAM;GACN;GACA,UAAU;GACV;GAOA,GAAI,KAAK,SAAS,SACd;IACE,iBAAiB;IACjB,GAAI,gBAAgB;KAAE;KAAe,eAAe,KAAK;KAAQ,GAAG,EAAE;IACtE,kBAAkB,KAAK;IACvB,kBAAkB,KAAK;IACxB,GACD,EAAE;GAGN,GAAI,KAAK,SAAS,SAAS,KAAK,WAAW,WAAW,GAAG,EAAE;GAC5D,CAAC,EACF,IACD;AAED,OAAK,eAAe,IAAI,UAAU,IAAI;AACtC,SAAO;;;;;;;;;;;;;CAcT,MAAM,sBAAsB,MAGG;AAC7B,aAAW,KAAK,YAAY;EAE5B,MAAM,SAAS,aADQ,YAAY,KAAK,YAAY,CACT,GAAG,KAAK,KAAK;EACxD,MAAM,aAAa,MAAM,KAAK,eAAe;AAC7C,SAAO,IAAI,kBAAkB,KAAK,gBAAgB,WAAW,EAAE,OAAO;;;;;;;;CASxE,MAAM,eAAe,aAAmC;AACtD,aAAW,YAAY;EACvB,MAAM,iBAAiB,YAAY,YAAY;EAC/C,MAAM,YAAY,KAAK,KAAK,SAAS,aAAa,gBAAgB,SAAS;AAC3E,YAAU,WAAW,EAAE,WAAW,MAAM,CAAC;EACzC,MAAM,MAAM,IAAI,KAAK;AACrB,QAAM,IAAI,MACR,IAAI,MAAM;GAAE,WAAW;GAAW,MAAM;GAAU,YAAY;GAAa,CAAC,EAC5E,IACD;AACD,SAAO;;;;;;;;;;CAWT,MAAM,WAA8B;EAClC,MAAM,aAAa,MAAM,KAAK,eAAe;EAE7C,MAAM,SAAS,MADD,KAAK,gBAAgB,WAAW,CACnB,aAAa,aAAa;EAErD,MAAM,sBAAM,IAAI,KAAa;AAC7B,OAAK,MAAM,SAAS,OAAO,SAAS;GAClC,MAAM,MAAM,MAAM,KAAK,MAAM,GAAoB,CAAC,QAAQ,OAAO,GAAG;AACpE,OAAI,IAAK,KAAI,IAAI,IAAI;;AAEvB,SAAO,CAAC,GAAG,IAAI;;;;;;;;;;CAWjB,IAAI,WAA6B;AAC/B,MAAI,CAAC,KAAK,WAAW;AACnB,QAAK,gBAAgB,IAAI,mBAAmB,KAAK,KAAK,UAAU,cAAc,CAAC;AAC/E,QAAK,YAAY,IAAI,iBAAiB,KAAK,cAAc;;AAE3D,SAAO,KAAK;;;;;;;;;CAUd,MAAM,aAAa,SAAwD;AACzE,SAAO,KAAK,aAAa,QAAQ;;CAGnC,MAAM,aAAa,SAAwD;EACzE,MAAM,aAAa,MAAM,KAAK,eAAe;EAC7C,MAAM,UAAU,MAAM,KAAK,YAAY;EACvC,MAAM,MAAM,IAAI,KAAK;EAErB,MAAM,iBAAiB,KAAK,gBAAgB,YAAY,EAAE,aAAa,MAAM,CAAC;AAC9E,QAAM,IAAI,MACR,IAAI,iBAAiB;GACnB,KAAK,KAAK;GACV,aAAa,KAAK,gBAAgB;GAClC,WAAW;GACX,MAAM;GACN,YAAY,SAAS,cAAc;GACnC,UAAU;GACV;GAMA,eAAe,KAAK,wBAAwB,eAAe;GAI3D,kBAAkB,KAAK;GACvB,kBAAkB,KAAK;GACvB,GAAG,KAAK,WAAW,WAAW;GAC/B,CAAC,EACF,IACD;AAID,wBAAsB,KAAK;GACzB;GACA,SAAS,KAAK;GACd,OAAO,KAAK;GACb,CAAC;AACF,SAAO;;;;;;;;;CAUT,MAAM,iBAAiB,QAA+B;EACpD,MAAM,aAAa,MAAM,KAAK,eAAe;EAC7C,MAAM,OAAO,KAAK,gBAAgB,YAAY,EAAE,aAAa,MAAM,CAAC;EACpE,MAAM,YAAY,SAAS,IAAI,kBAAkB,MAAM,OAAO,GAAG;EACjE,MAAM,MAAM,IAAI,KAAK;AACrB,QAAM,IAAI,MACR,IAAI,iBAAiB;GACnB,KAAK,KAAK;GACV,aAAa,KAAK,gBAAgB;GAClC;GACA,MAAM;GACN,YAAY;GACZ,UAAU;GACX,CAAC,EACF,IACD;AACD,SAAO;;;;;;CAOT,QAAc;AACZ,MAAI,KAAK,YAAY;AACnB,OAAI;AACF,SAAK,WAAW,OAAO;WACjB;AAGR,QAAK,aAAa;;AAEpB,MAAI,KAAK,eAAe;AAEtB,GAAK,KAAK,cAAc,OAAO;AAC/B,QAAK,gBAAgB;AACrB,QAAK,YAAY;;AAEnB,OAAK,UAAU;AACf,OAAK,cAAc;AACnB,OAAK,eAAe;AACpB,OAAK,eAAe,OAAO"}

package/dist/memory-gc-queue.cjs

@@ -0,0 +1,36 @@
+
+//#region src/memory-gc-queue.ts
+/** Matches `D1GCQueue` / `SqliteGcQueue` (2h) for cross-impl parity. */
+const DEFAULT_GRACE_MS = 7200 * 1e3;
+var MemoryGcQueue = class {
+	/** cid → queued_at (epoch ms). A Map gives idempotent enqueue for free. */
+	rows = /* @__PURE__ */ new Map();
+	async ensureTable() {}
+	async enqueue(cids) {
+		await this.enqueueAt(cids, Date.now());
+	}
+	/**
+	* Enqueue with an explicit `queued_at` — used by the conformance suite to
+	* exercise the grace boundary deterministically. Not part of `GcQueue`.
+	* Idempotent: an existing cid keeps its original `queued_at`.
+	*/
+	async enqueueAt(cids, queuedAt) {
+		for (const cid of cids) if (!this.rows.has(cid)) this.rows.set(cid, queuedAt);
+	}
+	async fetchCandidates(limit = 500, graceMs = DEFAULT_GRACE_MS) {
+		if (limit === 0) return [];
+		const cutoff = Date.now() - graceMs;
+		const out = [];
+		for (const [cid, queuedAt] of this.rows) if (queuedAt <= cutoff) {
+			out.push({ cid });
+			if (out.length >= limit) break;
+		}
+		return out;
+	}
+	async remove(cid) {
+		this.rows.delete(cid);
+	}
+};
+
+//#endregion
+exports.MemoryGcQueue = MemoryGcQueue;

package/dist/memory-gc-queue.d.cts

@@ -0,0 +1,22 @@
+import { GcQueue } from "./gc-queue.cjs";
+
+//#region src/memory-gc-queue.d.ts
+declare class MemoryGcQueue implements GcQueue {
+  /** cid → queued_at (epoch ms). A Map gives idempotent enqueue for free. */
+  private readonly rows;
+  ensureTable(): Promise<void>;
+  enqueue(cids: string[]): Promise<void>;
+  /**
+   * Enqueue with an explicit `queued_at` — used by the conformance suite to
+   * exercise the grace boundary deterministically. Not part of `GcQueue`.
+   * Idempotent: an existing cid keeps its original `queued_at`.
+   */
+  enqueueAt(cids: string[], queuedAt: number): Promise<void>;
+  fetchCandidates(limit?: number, graceMs?: number): Promise<Array<{
+    cid: string;
+  }>>;
+  remove(cid: string): Promise<void>;
+}
+//#endregion
+export { MemoryGcQueue };
+//# sourceMappingURL=memory-gc-queue.d.cts.map

package/dist/memory-gc-queue.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-gc-queue.d.cts","names":[],"sources":["../src/memory-gc-queue.ts"],"mappings":";;;cAaa,aAAA,YAAyB,OAAA;EAuBoC;EAAA,iBArBvD,IAAA;EAEX,WAAA,CAAA,GAAe,OAAA;EAIf,OAAA,CAAQ,IAAA,aAAiB,OAAA;EARY;;;;;EAiBrC,SAAA,CAAU,IAAA,YAAgB,QAAA,WAAmB,OAAA;EAM7C,eAAA,CAAgB,KAAA,WAAa,OAAA,YAA6B,OAAA,CAAQ,KAAA;IAAQ,GAAA;EAAA;EAa1E,MAAA,CAAO,GAAA,WAAc,OAAA;AAAA"}

package/dist/memory-gc-queue.d.mts

@@ -0,0 +1,22 @@
+import { GcQueue } from "./gc-queue.mjs";
+
+//#region src/memory-gc-queue.d.ts
+declare class MemoryGcQueue implements GcQueue {
+  /** cid → queued_at (epoch ms). A Map gives idempotent enqueue for free. */
+  private readonly rows;
+  ensureTable(): Promise<void>;
+  enqueue(cids: string[]): Promise<void>;
+  /**
+   * Enqueue with an explicit `queued_at` — used by the conformance suite to
+   * exercise the grace boundary deterministically. Not part of `GcQueue`.
+   * Idempotent: an existing cid keeps its original `queued_at`.
+   */
+  enqueueAt(cids: string[], queuedAt: number): Promise<void>;
+  fetchCandidates(limit?: number, graceMs?: number): Promise<Array<{
+    cid: string;
+  }>>;
+  remove(cid: string): Promise<void>;
+}
+//#endregion
+export { MemoryGcQueue };
+//# sourceMappingURL=memory-gc-queue.d.mts.map

package/dist/memory-gc-queue.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-gc-queue.d.mts","names":[],"sources":["../src/memory-gc-queue.ts"],"mappings":";;;cAaa,aAAA,YAAyB,OAAA;EAuBoC;EAAA,iBArBvD,IAAA;EAEX,WAAA,CAAA,GAAe,OAAA;EAIf,OAAA,CAAQ,IAAA,aAAiB,OAAA;EARY;;;;;EAiBrC,SAAA,CAAU,IAAA,YAAgB,QAAA,WAAmB,OAAA;EAM7C,eAAA,CAAgB,KAAA,WAAa,OAAA,YAA6B,OAAA,CAAQ,KAAA;IAAQ,GAAA;EAAA;EAa1E,MAAA,CAAO,GAAA,WAAc,OAAA;AAAA"}

package/dist/memory-gc-queue.mjs

@@ -0,0 +1,36 @@
+//#region src/memory-gc-queue.ts
+/** Matches `D1GCQueue` / `SqliteGcQueue` (2h) for cross-impl parity. */
+const DEFAULT_GRACE_MS = 7200 * 1e3;
+var MemoryGcQueue = class {
+	/** cid → queued_at (epoch ms). A Map gives idempotent enqueue for free. */
+	rows = /* @__PURE__ */ new Map();
+	async ensureTable() {}
+	async enqueue(cids) {
+		await this.enqueueAt(cids, Date.now());
+	}
+	/**
+	* Enqueue with an explicit `queued_at` — used by the conformance suite to
+	* exercise the grace boundary deterministically. Not part of `GcQueue`.
+	* Idempotent: an existing cid keeps its original `queued_at`.
+	*/
+	async enqueueAt(cids, queuedAt) {
+		for (const cid of cids) if (!this.rows.has(cid)) this.rows.set(cid, queuedAt);
+	}
+	async fetchCandidates(limit = 500, graceMs = DEFAULT_GRACE_MS) {
+		if (limit === 0) return [];
+		const cutoff = Date.now() - graceMs;
+		const out = [];
+		for (const [cid, queuedAt] of this.rows) if (queuedAt <= cutoff) {
+			out.push({ cid });
+			if (out.length >= limit) break;
+		}
+		return out;
+	}
+	async remove(cid) {
+		this.rows.delete(cid);
+	}
+};
+
+//#endregion
+export { MemoryGcQueue };
+//# sourceMappingURL=memory-gc-queue.mjs.map

package/dist/memory-gc-queue.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-gc-queue.mjs","names":[],"sources":["../src/memory-gc-queue.ts"],"sourcesContent":["/**\n * MemoryGcQueue — in-memory `GcQueue` for unit tests.\n *\n * Pairs with `MemoryObjectStore` (`@aigne/afs-r2`) and `MemoryTreeIndex` so the\n * shared `runGc` can be exercised with zero I/O. Pure storage — no reference\n * method (design §4.4).\n */\n\nimport type { GcQueue } from \"./gc-queue.js\";\n\n/** Matches `D1GCQueue` / `SqliteGcQueue` (2h) for cross-impl parity. */\nconst DEFAULT_GRACE_MS = 2 * 60 * 60 * 1000;\n\nexport class MemoryGcQueue implements GcQueue {\n  /** cid → queued_at (epoch ms). A Map gives idempotent enqueue for free. */\n  private readonly rows = new Map<string, number>();\n\n  async ensureTable(): Promise<void> {\n    // no-op — the Map is the table.\n  }\n\n  async enqueue(cids: string[]): Promise<void> {\n    await this.enqueueAt(cids, Date.now());\n  }\n\n  /**\n   * Enqueue with an explicit `queued_at` — used by the conformance suite to\n   * exercise the grace boundary deterministically. Not part of `GcQueue`.\n   * Idempotent: an existing cid keeps its original `queued_at`.\n   */\n  async enqueueAt(cids: string[], queuedAt: number): Promise<void> {\n    for (const cid of cids) {\n      if (!this.rows.has(cid)) this.rows.set(cid, queuedAt);\n    }\n  }\n\n  async fetchCandidates(limit = 500, graceMs = DEFAULT_GRACE_MS): Promise<Array<{ cid: string }>> {\n    if (limit === 0) return [];\n    const cutoff = Date.now() - graceMs;\n    const out: Array<{ cid: string }> = [];\n    for (const [cid, queuedAt] of this.rows) {\n      if (queuedAt <= cutoff) {\n        out.push({ cid });\n        if (out.length >= limit) break;\n      }\n    }\n    return out;\n  }\n\n  async remove(cid: string): Promise<void> {\n    this.rows.delete(cid);\n  }\n}\n"],"mappings":";;AAWA,MAAM,mBAAmB,OAAc;AAEvC,IAAa,gBAAb,MAA8C;;CAE5C,AAAiB,uBAAO,IAAI,KAAqB;CAEjD,MAAM,cAA6B;CAInC,MAAM,QAAQ,MAA+B;AAC3C,QAAM,KAAK,UAAU,MAAM,KAAK,KAAK,CAAC;;;;;;;CAQxC,MAAM,UAAU,MAAgB,UAAiC;AAC/D,OAAK,MAAM,OAAO,KAChB,KAAI,CAAC,KAAK,KAAK,IAAI,IAAI,CAAE,MAAK,KAAK,IAAI,KAAK,SAAS;;CAIzD,MAAM,gBAAgB,QAAQ,KAAK,UAAU,kBAAmD;AAC9F,MAAI,UAAU,EAAG,QAAO,EAAE;EAC1B,MAAM,SAAS,KAAK,KAAK,GAAG;EAC5B,MAAM,MAA8B,EAAE;AACtC,OAAK,MAAM,CAAC,KAAK,aAAa,KAAK,KACjC,KAAI,YAAY,QAAQ;AACtB,OAAI,KAAK,EAAE,KAAK,CAAC;AACjB,OAAI,IAAI,UAAU,MAAO;;AAG7B,SAAO;;CAGT,MAAM,OAAO,KAA4B;AACvC,OAAK,KAAK,OAAO,IAAI"}