@artenx/dshb 0.1.18 → 0.1.19

package/lib/session-sync-EdfwUON5.js

@@ -0,0 +1,2177 @@
+import { compareSyncRevision } from "./core/sync/revision.js";
+import { isNonNegativeSafeInteger, isRecord as isRecord$1, syncRecordKey, syncWorkspaceKey } from "./core/sync/model.js";
+import "./core/workspace-instructions.js";
+import { i as deepFreeze, r as brandString } from "./lib-gdtU_WKT.js";
+import { SyncSessionJournalStore } from "./core/sync/session-journal.js";
+import { MAX_SYNC_TRANSFER_BYTES } from "./core/sync/protocol.js";
+import { tmpdir } from "node:os";
+import { constants, mkdirSync } from "node:fs";
+import { basename, dirname, join, normalize, posix, resolve } from "node:path";
+import { createHash } from "node:crypto";
+import "@deepseek-ai/cordis";
+import { lstat, mkdir, open, realpath, unlink } from "node:fs/promises";
+//#region ../../node_modules/@deepseek-ai/dsh-session/lib/index.js
+/**
+* Brand a string as a {@link SessionId}.
+* @param id - the raw session id string.
+* @returns the same string with the session-id brand.
+*/
+function SessionId(id) {
+	return brandString(id);
+}
+/**
+* GENERATED by `scripts/gen-persistence-catalog.ts` — do not edit by hand; run
+* `pnpm run gen-persistence-catalog` to regenerate (verified fresh by
+* `pnpm run verify-persistence-catalog`, part of `doc-sync`).
+* @module @deepseek-ai/dsh-session/known-event-types
+*/
+/**
+* Every `SessionEventMap` member declared in this repository — the event
+* vocabulary this build understands. The persistence read path refuses to
+* interpret a log containing a type outside this set unless the event
+* carries the envelope's `ignorable` marker (see `SessionEvent.ignorable`
+* in `./types.ts`): such a log was likely written by a newer harness, and
+* silently skipping a required event would reconstruct a wrong session.
+* Downstream (out-of-repo) plugin events are outside this list by
+* construction. The persisted `SessionEvent.ignorable` marker is the
+* compatibility mechanism; event-name registration was rejected because
+* it does not classify omission safety and would make reads
+* composition-dependent. The rationale is in
+* `.agents/notes/implemented/architecture/2026-08-30-retain-ignorable-external-session-events.md`.
+*/
+const KNOWN_SESSION_EVENT_TYPES = /* @__PURE__ */ new Set([
+	"agent-preset/selected",
+	"agent/inbox/spliced",
+	"approval/asked",
+	"approval/decided",
+	"approval/policy",
+	"assistant/attempt",
+	"assistant/message",
+	"command/done",
+	"command/run",
+	"compaction/end",
+	"compaction/prune",
+	"compaction/start",
+	"compaction/summary",
+	"deliverables/presented",
+	"developer/message",
+	"feedback/message-delete",
+	"feedback/message-put",
+	"feedback/record",
+	"goal/change",
+	"hook/invoked",
+	"hook/result",
+	"image/offload",
+	"job/registered",
+	"job/settled",
+	"llm/retry",
+	"llm/retry-started",
+	"model/selection",
+	"permission/preset",
+	"plan/mode",
+	"request/context",
+	"request/header",
+	"sandbox/mode",
+	"schedule/change",
+	"session-log-deepseek/delivery-accepted",
+	"session/end-seed",
+	"session/title",
+	"session/title-llm-request",
+	"step/end",
+	"step/start",
+	"subagent/catalog",
+	"subagent/descriptor",
+	"subagent/model-selection-policy",
+	"system/message",
+	"team/member",
+	"team/message/delivered",
+	"team/message/queued",
+	"team/task",
+	"todo/write",
+	"tool-workflow/agent-end",
+	"tool-workflow/agent-start",
+	"tool-workflow/run-end",
+	"tool-workflow/run-start",
+	"tool/call",
+	"tool/ptc-dispatch",
+	"tool/ptc-dispatch-start",
+	"tool/result",
+	"turn/end",
+	"turn/start",
+	"user/message",
+	"web/deepseek-search-llm-request",
+	"working-directory/change",
+	"workspace/changes"
+]);
+/**
+* Surface layer on top of the session event log: an ordered view of events
+* that produce LLM messages. The append-only log remains the source of truth.
+*
+* Browser-safe: web clients consume this subpath export, so it must stay free
+* of `node:` imports (they break the vite bundle).
+*
+* @module @deepseek-ai/dsh-session/surface
+*/
+/** Runtime counterpart of the message-producing event union. */
+const SURFACE_EVENT_TYPES = /* @__PURE__ */ new Set([
+	"system/message",
+	"developer/message",
+	"user/message",
+	"assistant/message",
+	"tool/result"
+]);
+/**
+* Whether an event type can join the model-visible surface.
+* @param type - event type to test.
+* @returns true for one of the message-producing event types.
+*/
+function isSurfaceEligibleType(type) {
+	return SURFACE_EVENT_TYPES.has(type);
+}
+/** Whether a payload field is a JSON object rather than an array or scalar. */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Reject noncanonical request-header fields, developer roles/content, and contradictory tool failure metadata.
+* This does not validate complete event payloads or embedded provider streams.
+* @param event - event whose locally related payload fields are inspected.
+* @param subject - event location to include in validation errors.
+* @throws when request-header fields, developer roles/content, or tool failure metadata are invalid.
+*/
+function validateSessionEventData(event, subject) {
+	const data = event.data;
+	if (SURFACE_EVENT_TYPES.has(event.type) && isRecord(data)) {
+		const message = event.type === "user/message" ? data : data["message"];
+		if (isRecord(message)) {
+			if (event.type === "developer/message" !== (message["role"] === "developer")) throw new Error(`${subject} developer/message and developer role must occur together`);
+			if (message["role"] !== "developer" && Array.isArray(message["content"]) && message["content"].some((block) => isRecord(block) && (block["type"] === "tool-addition" || block["type"] === "tool-removal"))) throw new Error(`${subject} tool-change blocks require developer role`);
+			if (event.type === "developer/message" && Array.isArray(message["content"])) {
+				let hasAdditions = false;
+				for (const block of message["content"]) {
+					if (!isRecord(block) || block["type"] !== "tool-addition" && block["type"] !== "tool-removal") continue;
+					if (typeof block["toolName"] !== "string" || block["toolName"].length === 0) throw new Error(`${subject} ${block["type"]} requires a nonempty toolName`);
+					if (block["type"] === "tool-addition") {
+						hasAdditions = true;
+						if (Object.hasOwn(block, "tool")) throw new Error(`${subject} tool-addition must omit inline tool definitions`);
+					}
+				}
+				if (hasAdditions ? !isEventSeq(data["headerSeq"]) : Object.hasOwn(data, "headerSeq")) throw new Error(`${subject} requires headerSeq exactly when tool additions are present`);
+			}
+		}
+	}
+	if (event.type === "request/header") {
+		if (!isRecord(data)) throw new Error(`${subject} data must be an object`);
+		const header = data["header"];
+		if (!isRecord(header)) throw new Error(`${subject} header must be an object`);
+		if (Object.hasOwn(header, "system")) throw new Error(`${subject} must omit header.system; use system/message`);
+		if (Array.isArray(header["tools"]) && header["tools"].length === 0) throw new Error(`${subject} must omit empty tools`);
+		const defaults = header["adapterDefaults"];
+		if (isRecord(defaults) && Object.keys(defaults).length === 0) throw new Error(`${subject} must omit empty adapterDefaults`);
+	} else if (event.type === "tool/result") {
+		if (!isRecord(data)) throw new Error(`${subject} data must be an object`);
+		if (data["error"] === void 0) return;
+		const message = data["message"];
+		if (!isRecord(message) || message["isError"] !== true) throw new Error(`${subject} error requires message.isError === true`);
+	}
+}
+/** Whether a runtime value is a non-negative safe event sequence. */
+function isEventSeq(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);
+}
+/** Whether a runtime value is the exact positional-replacement shape. */
+function isReplaceOp(value) {
+	const op = value;
+	return Object.keys(op).length === 3 && Object.hasOwn(op, "op") && Object.hasOwn(op, "startSeq") && Object.hasOwn(op, "endSeq") && op["op"] === "replace" && isEventSeq(op["startSeq"]) && isEventSeq(op["endSeq"]);
+}
+/** Validate event-local surface eligibility and return its operation. */
+function surfaceOpOf(event) {
+	const raw = event;
+	if (!isSurfaceEligibleType(event.type)) {
+		if (!KNOWN_SESSION_EVENT_TYPES.has(event.type) && event.ignorable === true) return;
+		if (raw.surfaceOp !== void 0) throw new Error(`session event "${event.type}" is not surface-eligible and cannot carry surfaceOp`);
+		if (raw.sourceEventSeqs !== void 0) throw new Error(`session event "${event.type}" is not surface-eligible and cannot carry sourceEventSeqs`);
+		return;
+	}
+	const op = raw.surfaceOp;
+	if (op === void 0) throw new Error(`session event "${event.type}" is surface-eligible and requires a surfaceOp marker`);
+	if (op === "append") return op;
+	if (op === null || typeof op !== "object" || Array.isArray(op)) throw new Error(`session event "${event.type}" carries an invalid surfaceOp`);
+	if (!isReplaceOp(op)) throw new Error(`session event "${event.type}" carries an invalid replace surfaceOp`);
+	return op;
+}
+/** Validate cited source-event seqs against prior log entries and the replacement range. */
+function assertSourceEventReferences(event, shadowedSeqs) {
+	const raw = event.sourceEventSeqs;
+	if (event.type === "assistant/message" && raw !== void 0) throw new Error("assistant/message embeds its source stream and cannot carry sourceEventSeqs");
+	const sources = /* @__PURE__ */ new Set();
+	if (raw !== void 0) {
+		if (!Array.isArray(raw)) throw new Error(`sourceEventSeqs on event at seq ${event.seq} must be an array when present`);
+		if (raw.length === 0) throw new Error("sourceEventSeqs must not be empty");
+		let nonEarlierSource;
+		for (const source of raw) {
+			if (!isEventSeq(source)) throw new Error(`session event "${event.type}" sourceEventSeqs must densely contain non-negative safe integers`);
+			sources.add(source);
+			if (nonEarlierSource === void 0 && source >= event.seq) nonEarlierSource = source;
+		}
+		if (sources.size !== raw.length) throw new Error("sourceEventSeqs must not contain duplicates");
+		if (nonEarlierSource !== void 0) throw new Error(`sourceEventSeqs must reference earlier events: ${nonEarlierSource} >= current seq ${event.seq}`);
+	}
+	const missing = shadowedSeqs.filter((seq) => !sources.has(seq));
+	if (missing.length > 0) throw new Error(`surface replace: sourceEventSeqs must include every shadowed surface node; missing ${missing.join(", ")}`);
+}
+/**
+* Validate one event's surface metadata without checking membership in a log or surface.
+* @param event - event whose marker and source sequence values are inspected.
+* Unknown ignorable records retain opaque metadata and never change the surface.
+* @returns the validated operation, or undefined for a log-only or unknown ignorable event.
+* @throws when metadata violates event-local eligibility, marker, or source-sequence rules.
+*/
+function validateSurfaceMetadata(event) {
+	const op = surfaceOpOf(event);
+	if (op !== void 0 && op !== "append" && (op.startSeq >= event.seq || op.endSeq >= event.seq)) throw new Error(`surface replace at seq ${event.seq}: startSeq and endSeq must reference earlier events`);
+	if (op !== void 0) assertSourceEventReferences(event, []);
+	return op;
+}
+/**
+* Validate an exclusively owned event and deeply freeze its identified message
+* without copying the event. The caller transfers an object graph that no
+* producer retains and that shares no mutable children with another event.
+* Use {@link snapshotSessionEvent} when exclusive ownership is not guaranteed.
+* @param event - exclusively owned event imported across a trusted boundary.
+* @returns the same event object with a validated, deeply frozen message.
+* @throws when event-local surface metadata, request-header fields, or message invariants are invalid; history relations are not checked.
+*/
+function adoptSessionEvent(event) {
+	validateSessionEventData(event, `session event at seq ${event.seq}`);
+	validateSurfaceMetadata(event);
+	assertMessageEventShape(event, `session event at seq ${event.seq}`);
+	switch (event.type) {
+		case "user/message":
+			deepFreeze(event.data);
+			break;
+		case "developer/message":
+		case "system/message":
+		case "assistant/message":
+		case "tool/result": deepFreeze(event.data.message);
+	}
+	return event;
+}
+/**
+* Detach one event while preserving deep immutability for its identified message.
+* @param event - event imported across a query or persistence boundary.
+* @returns a detached event snapshot with a validated, deeply frozen message.
+*/
+function snapshotSessionEvent(event) {
+	return adoptSessionEvent(structuredClone(event));
+}
+/** The surface event types whose payload carries an identified message. */
+function isMessageEventType(type) {
+	return type === "developer/message" || type === "system/message" || type === "user/message" || type === "assistant/message" || type === "tool/result";
+}
+const MESSAGE_ROLE_BY_TYPE = {
+	"system/message": "system",
+	"developer/message": "developer",
+	"user/message": "user",
+	"assistant/message": "assistant",
+	"tool/result": "tool"
+};
+/** Validate only the event-specific invariants needed to safely replay a message. */
+function assertMessageEventShape(event, subject) {
+	const type = event["type"];
+	if (!isMessageEventType(type)) return;
+	const data = event["data"];
+	const record = typeof data === "object" && data !== null ? data : void 0;
+	const message = type === "user/message" ? record : record?.["message"];
+	if (typeof message !== "object" || message === null || typeof message["id"] !== "string" || message["id"] === "") throw new Error(`${subject} lacks an identified message`);
+	const messageRecord = message;
+	const expectedRole = MESSAGE_ROLE_BY_TYPE[type];
+	if (messageRecord["role"] !== expectedRole) throw new Error(`${subject} message must have role "${expectedRole}"`);
+	const source = messageRecord["source"];
+	if (typeof source !== "object" || source === null || typeof source["kind"] !== "string" || source["kind"] === "") throw new Error(`${subject} message has invalid source`);
+	if (!Array.isArray(messageRecord["content"])) throw new Error(`${subject} message has invalid content`);
+	const sourceRecord = source;
+	if (type === "system/message") {
+		if (sourceRecord["kind"] !== "system-prompt") throw new Error(`${subject} message must have system-prompt source`);
+		return;
+	}
+	if (type === "assistant/message") {
+		if (sourceRecord["kind"] !== "model" || !hasProviderModel(sourceRecord)) throw new Error(`${subject} message must have model source`);
+		return;
+	}
+	if (type !== "tool/result") return;
+	if (sourceRecord["kind"] !== "tool" || typeof sourceRecord["callId"] !== "string" || sourceRecord["callId"] === "") throw new Error(`${subject} message must have tool source`);
+	if (messageRecord["toolCallId"] !== sourceRecord["callId"]) throw new Error(`${subject} message has mismatched tool call ids`);
+}
+/** Whether an unknown value carries the current provider/model pair. */
+function hasProviderModel(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const pair = value;
+	return typeof pair["provider"] === "string" && pair["provider"].length > 0 && typeof pair["model"] === "string" && pair["model"].length > 0;
+}
+//#endregion
+//#region ../../node_modules/@deepseek-ai/dsh-session-persistence/lib/index.js
+/** Durable session contents failed validation after a successful backend read. */
+var SessionPersistenceCorruptionError = class extends Error {
+	/**
+	* @param message - stable corruption context.
+	* @param options - original validation failure.
+	*/
+	constructor(message, options) {
+		super(message, options);
+		this.name = "SessionPersistenceCorruptionError";
+	}
+};
+/**
+* The stored log is intact but this runtime cannot faithfully interpret it:
+* the header carries an unsupported format version, or an event's type is
+* unknown to this build. Distinct from {@link SessionPersistenceCorruptionError}
+* — nothing is damaged; the raw log remains readable at {@link location} when
+* the backend keeps one artifact per session.
+*/
+var SessionFormatUnsupportedError = class extends Error {
+	location;
+	/**
+	* @param message - stable reason the log cannot be interpreted, already
+	*   including the raw-log path when one exists.
+	* @param location - the backend's artifact location, when one exists.
+	*/
+	constructor(message, location) {
+		super(message);
+		this.location = location;
+		this.name = "SessionFormatUnsupportedError";
+	}
+};
+/**
+* Backend-shared storage validation: the version gate, the fail-closed event
+* vocabulary, append-batch materialization, and contiguity — one place so
+* every backend refuses the same inputs identically.
+* @module @deepseek-ai/dsh-session-persistence/storage-contract
+*/
+/** Build a format refusal that points at the raw artifact when the backend has one. */
+function unsupported(reason, location) {
+	return new SessionFormatUnsupportedError(location === void 0 ? reason : `${reason} (raw log: ${location.path})`, location);
+}
+/**
+* Validate one exclusively owned stored event array in place: adopt each
+* record (validating and freezing it) and refuse any event type this build
+* does not know, unless its writer marked it `ignorable: true` — silently
+* skipping an unknown required event could reconstruct a wrong session (the
+* envelope contract on `SessionEvent.ignorable`). Unknown required types and
+* retired pre-release shapes refuse here; this validator performs no migration.
+* @param meta - the stored header the events belong to.
+* @param events - exclusively owned decoded events; validated in place.
+* @param location - the backend's artifact location for refusals, when one exists.
+* @returns the same array, validated and frozen.
+* @throws {SessionFormatUnsupportedError} for unknown event types.
+* @throws {SessionPersistenceCorruptionError} for records that fail validation.
+*/
+function validateStoredEvents(meta, events, location) {
+	for (const event of events) {
+		if (!KNOWN_SESSION_EVENT_TYPES.has(event.type) && event.ignorable !== true) throw unsupported(`session "${meta.id}" contains event type "${event.type}" (seq ${event.seq}) unknown to this harness and not marked ignorable; refusing to interpret the log — it was likely written by a newer harness`, location);
+		if (event.type === "request/header") {
+			const data = event.data;
+			if (typeof data === "object" && data !== null && data["reason"] === "fallback") throw unsupported(`session "${meta.id}" contains a request/header event (seq ${event.seq}) with the unsupported legacy reason "fallback"; refusing to interpret the log — it was written by a retired pre-release harness`, location);
+		}
+	}
+	try {
+		for (const [index, event] of events.entries()) events[index] = adoptSessionEvent(event);
+	} catch (error) {
+		if (error instanceof SessionFormatUnsupportedError) throw error;
+		throw new SessionPersistenceCorruptionError(`stored session "${meta.id}" failed validation: ${String(error)}`, { cause: error });
+	}
+	return events;
+}
+/**
+* Refuse a batch that does not contiguously continue the stored log.
+* @param id - the session the batch belongs to.
+* @param events - the batch, in seq order.
+* @param cursor - the stored next-seq.
+*/
+function assertContiguous(id, events, cursor) {
+	for (const [index, event] of events.entries()) if (event.seq !== cursor + index) throw new Error(`append seq mismatch for "${id}": expected ${cursor + index} at index ${index}, got ${event.seq}`);
+}
+//#endregion
+//#region src/core/sync/session-sync.ts
+const SESSION_READ_PAGE_SIZE = 256;
+const MAX_SYNC_SESSIONS = 1e4;
+const SPILL_META_VERSION = 1;
+const SPILL_ARTIFACT_META_KEY = "@deepseek-ai/dsh-spill";
+const LEGACY_LOCAL_SPILL_HINT = "Use read with offset/limit, or grep this path to search within it.";
+const LEGACY_LOCAL_SPILL_MARKER = "Full formatted result stored at: ";
+const LEGACY_LOCAL_SPILL_SUFFIX = `. ${LEGACY_LOCAL_SPILL_HINT})`;
+var SyncSessionError = class extends Error {
+	code;
+	constructor(code, message, cause) {
+		super(message, cause === void 0 ? void 0 : { cause });
+		this.code = code;
+		this.name = "SyncSessionError";
+	}
+};
+function spillSessionDirectoryName(sessionId) {
+	return `session-${createHash("sha256").update(sessionId).digest("hex").slice(0, 12)}`;
+}
+function spillTransferReferenceError(cause) {
+	return new SyncSessionError("spill-integrity", "spill artifact could not be safely transferred", cause);
+}
+async function* readLocalSpillFile(configuredRoot, reference) {
+	const filePath = resolve(reference.ref.locator);
+	const sessionDirectory = dirname(filePath);
+	const root = dirname(sessionDirectory);
+	const expectedSessionDirectory = spillSessionDirectoryName(reference.owner.sessionId);
+	const leaf = basename(filePath);
+	if (filePath !== reference.ref.locator || basename(sessionDirectory) !== expectedSessionDirectory || !/^(?:[a-f0-9]{12}-.+|transfer-[a-f0-9]{64})$/.test(leaf)) throw spillTransferReferenceError();
+	const normalizedRoot = resolve(root);
+	if (normalizedRoot !== (configuredRoot === void 0 ? void 0 : resolve(configuredRoot))) {
+		const tempRoot = resolve(tmpdir());
+		if (dirname(normalizedRoot) !== tempRoot || !basename(normalizedRoot).startsWith("dsh-spill-")) throw spillTransferReferenceError();
+	}
+	let handle;
+	try {
+		const rootPath = await realpath(normalizedRoot);
+		const expectedDirectory = join(rootPath, expectedSessionDirectory);
+		if (await realpath(sessionDirectory) !== expectedDirectory) throw spillTransferReferenceError();
+		const directoryStat = await lstat(sessionDirectory);
+		const entryStat = await lstat(filePath);
+		const expectedBytes = reference.ref.bytes ?? entryStat.size;
+		if (directoryStat.isSymbolicLink() || !directoryStat.isDirectory() || entryStat.isSymbolicLink() || !entryStat.isFile() || entryStat.size !== expectedBytes || !Number.isSafeInteger(expectedBytes) || expectedBytes < 0 || process.platform !== "win32" && ((directoryStat.mode & 63) !== 0 || (entryStat.mode & 63) !== 0)) throw spillTransferReferenceError();
+		const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
+		handle = await open(filePath, constants.O_RDONLY | noFollow);
+		const openedStat = await handle.stat();
+		if (!openedStat.isFile() || openedStat.size !== expectedBytes || entryStat.ino !== 0 && openedStat.ino !== 0 && entryStat.ino !== openedStat.ino || entryStat.dev !== 0 && openedStat.dev !== 0 && entryStat.dev !== openedStat.dev) throw spillTransferReferenceError();
+		let bytes = 0;
+		for (;;) {
+			const buffer = Buffer.allocUnsafe(65536);
+			const { bytesRead } = await handle.read(buffer, 0, buffer.byteLength, null);
+			if (bytesRead === 0) break;
+			bytes += bytesRead;
+			if (bytes > expectedBytes) throw spillTransferReferenceError();
+			yield buffer.subarray(0, bytesRead);
+		}
+		const finalStat = await handle.stat();
+		if (bytes !== expectedBytes || finalStat.size !== expectedBytes || finalStat.mtimeMs !== openedStat.mtimeMs) throw spillTransferReferenceError();
+	} catch (error) {
+		if (error instanceof SyncSessionError) throw error;
+		throw spillTransferReferenceError(error);
+	} finally {
+		if (handle) await handle.close();
+	}
+}
+function isUnownedSpillRead(error) {
+	return error instanceof Error && error.name === "SpillReadError" && "code" in error && error.code === "not-owned";
+}
+async function* readSpillStream(store, reference) {
+	if (store.readTextStream) try {
+		yield* store.readTextStream({
+			owner: { sessionId: SessionId(reference.owner.sessionId) },
+			ref: reference.ref
+		});
+		return;
+	} catch (error) {
+		if (!isUnownedSpillRead(error)) throw error;
+	}
+	yield* readLocalSpillFile(store.root, reference);
+}
+async function writeLocalSpillTransfer(root, input) {
+	if (!input.transferId || input.transferId.length > 4096 || input.bytes !== input.data.byteLength || sha256(input.data) !== input.digest) throw new SyncSessionError("spill-integrity", "spill transfer metadata is invalid");
+	try {
+		new TextDecoder("utf-8", { fatal: true }).decode(input.data);
+	} catch (error) {
+		throw new SyncSessionError("spill-integrity", "spill content is not valid UTF-8", error);
+	}
+	let rootPath;
+	let directory;
+	let filePath;
+	const sessionId = String(input.owner.sessionId);
+	try {
+		await mkdir(resolve(root), {
+			recursive: true,
+			mode: 448
+		});
+		rootPath = await realpath(resolve(root));
+		directory = join(rootPath, spillSessionDirectoryName(sessionId));
+		await mkdir(directory, {
+			recursive: true,
+			mode: 448
+		});
+		if (await realpath(directory) !== directory) throw spillTransferReferenceError();
+		const directoryStat = await lstat(directory);
+		if (directoryStat.isSymbolicLink() || !directoryStat.isDirectory() || process.platform !== "win32" && (directoryStat.mode & 63) !== 0) throw spillTransferReferenceError();
+		filePath = join(directory, `transfer-${createHash("sha256").update(input.transferId).digest("hex")}`);
+	} catch (error) {
+		if (error instanceof SyncSessionError) throw error;
+		throw spillTransferReferenceError(error);
+	}
+	const ref = {
+		locator: filePath,
+		bytes: input.bytes,
+		retrievalHint: LEGACY_LOCAL_SPILL_HINT
+	};
+	let handle;
+	try {
+		handle = await open(filePath, "wx", 384);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "EEXIST") {
+			const existing = await collectBytes(readLocalSpillFile(rootPath, {
+				owner: { sessionId },
+				source: {
+					toolName: "sync",
+					callId: input.transferId,
+					label: "spill"
+				},
+				suggestedName: "spill.txt",
+				ref
+			}));
+			if (existing.byteLength === input.bytes && sha256(existing) === input.digest) return ref;
+			throw new SyncSessionError("spill-transfer-conflict", "spill transfer key already contains different content", error);
+		}
+		throw spillTransferReferenceError(error);
+	}
+	try {
+		let offset = 0;
+		while (offset < input.data.byteLength) {
+			const { bytesWritten } = await handle.write(input.data, offset, input.data.byteLength - offset, null);
+			if (bytesWritten === 0) throw spillTransferReferenceError();
+			offset += bytesWritten;
+		}
+		await handle.sync();
+		const stat = await handle.stat();
+		if (!stat.isFile() || stat.size !== input.bytes || process.platform !== "win32" && (stat.mode & 63) !== 0) throw spillTransferReferenceError();
+	} catch (error) {
+		await handle.close();
+		handle = void 0;
+		try {
+			await unlink(filePath);
+		} catch {}
+		if (error instanceof SyncSessionError) throw error;
+		throw spillTransferReferenceError(error);
+	} finally {
+		if (handle) await handle.close();
+	}
+	return ref;
+}
+async function saveSpillTransfer(store, input) {
+	if (store.saveTextStream) return store.saveTextStream({
+		owner: input.owner,
+		source: input.source,
+		suggestedName: input.suggestedName,
+		transferId: input.transferId,
+		bytes: input.bytes,
+		digest: input.digest,
+		content: oneChunk(input.data)
+	});
+	if (typeof store.root === "string") return writeLocalSpillTransfer(store.root, input);
+	throw new SyncSessionError("spill-transfer-unavailable", "目标实例的 spill provider 不支持安全写入");
+}
+function canonicalJson(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value);
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	const object = value;
+	return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`).join(",")}}`;
+}
+function sha256(value) {
+	return `sha256:${createHash("sha256").update(value).digest("hex")}`;
+}
+function objectKey(kind, id) {
+	return JSON.stringify([kind, id]);
+}
+function attachmentKey(kind, ref) {
+	return objectKey(kind, `${ref.attachmentId}\0${ref.name ?? ""}`);
+}
+function spillKey(reference) {
+	return objectKey("spill", `${reference.owner.sessionId}\0${reference.ref.locator}`);
+}
+function sessionOriginKey(metadata) {
+	return syncRecordKey("session", metadata);
+}
+function isImageRef(value) {
+	return isRecord$1(value) && typeof value.attachmentId === "string" && typeof value.mediaType === "string" && isNonNegativeSafeInteger(value.bytes) && isNonNegativeSafeInteger(value.width) && isNonNegativeSafeInteger(value.height);
+}
+function isFileRef(value) {
+	return isRecord$1(value) && typeof value.attachmentId === "string" && typeof value.name === "string" && isNonNegativeSafeInteger(value.bytes) && value.mediaType === void 0;
+}
+function spillReferences(value) {
+	const output = [];
+	const visit = (current) => {
+		if (Array.isArray(current)) {
+			for (const entry of current) visit(entry);
+			return;
+		}
+		if (!isRecord$1(current)) return;
+		const spillMeta = current[SPILL_ARTIFACT_META_KEY];
+		if (spillMeta !== void 0) {
+			if (!isRecord$1(spillMeta) || spillMeta.version !== SPILL_META_VERSION || !Array.isArray(spillMeta.references)) throw new SyncSessionError("spill-metadata-invalid", "spill references are invalid");
+			for (const reference of spillMeta.references) {
+				if (!isRecord$1(reference) || !isRecord$1(reference.owner) || typeof reference.owner.sessionId !== "string" || !isRecord$1(reference.source) || typeof reference.source.toolName !== "string" || typeof reference.source.callId !== "string" || typeof reference.source.label !== "string" || typeof reference.suggestedName !== "string" || !isRecord$1(reference.ref) || typeof reference.ref.locator !== "string" || reference.ref.bytes !== void 0 && !isNonNegativeSafeInteger(reference.ref.bytes) || typeof reference.ref.retrievalHint !== "string") throw new SyncSessionError("spill-metadata-invalid", "spill reference fields are invalid");
+				output.push(reference);
+			}
+		}
+		for (const child of Object.values(current)) visit(child);
+	};
+	visit(value);
+	return output;
+}
+function legacySpillReferences(events, sessionId) {
+	const toolNames = /* @__PURE__ */ new Map();
+	for (const event of events) {
+		if (event.type !== "tool/call") continue;
+		const data = isRecord$1(event.data) ? event.data : {};
+		if (typeof data.callId === "string" && typeof data.name === "string") toolNames.set(data.callId, data.name);
+	}
+	const found = /* @__PURE__ */ new Map();
+	const scan = (value, source) => {
+		if (Array.isArray(value)) {
+			for (const child of value) scan(child, source);
+			return;
+		}
+		if (!isRecord$1(value)) return;
+		if (value.type === "text" && typeof value.text === "string") {
+			let start = value.text.indexOf(LEGACY_LOCAL_SPILL_MARKER);
+			while (start >= 0) {
+				const locatorStart = start + 33;
+				const end = value.text.indexOf(LEGACY_LOCAL_SPILL_SUFFIX, locatorStart);
+				if (end < 0) throw new SyncSessionError("spill-format-unsupported", "旧 spill 通知格式无法安全识别");
+				const locator = value.text.slice(locatorStart, end);
+				if (!locator || locator.length > 4096 || /[\u0000-\u001f\u007f]/.test(locator)) throw new SyncSessionError("spill-format-unsupported", "旧 spill locator 无效");
+				const reference = {
+					owner: { sessionId },
+					source,
+					suggestedName: `${source.toolName}.txt`,
+					ref: {
+						locator,
+						retrievalHint: LEGACY_LOCAL_SPILL_HINT
+					}
+				};
+				found.set(spillKey(reference), reference);
+				start = value.text.indexOf(LEGACY_LOCAL_SPILL_MARKER, end + LEGACY_LOCAL_SPILL_SUFFIX.length);
+			}
+		}
+		for (const child of Object.values(value)) scan(child, source);
+	};
+	for (const event of events) if (event.type === "tool/result") {
+		const data = isRecord$1(event.data) ? event.data : {};
+		const message = isRecord$1(data.message) ? data.message : {};
+		const callId = message.source?.callId;
+		if (typeof callId === "string") scan(message.content, {
+			toolName: toolNames.get(callId) ?? "unknown",
+			callId,
+			label: "result"
+		});
+	} else if (event.type === "tool/code-dispatch") {
+		const data = isRecord$1(event.data) ? event.data : {};
+		if (typeof data.name === "string" && typeof data.subCallId === "string") scan(data.content, {
+			toolName: data.name,
+			callId: data.subCallId,
+			label: "dispatch"
+		});
+	}
+	return [...found.values()];
+}
+function attachmentReferences(events) {
+	const images = /* @__PURE__ */ new Map();
+	const files = /* @__PURE__ */ new Map();
+	const visit = (value) => {
+		if (Array.isArray(value)) {
+			for (const child of value) visit(child);
+			return;
+		}
+		if (!isRecord$1(value)) return;
+		if (value.type === "image" && isImageRef(value.attachment)) images.set(attachmentKey("image", value.attachment), value.attachment);
+		if (value.type === "file" && isFileRef(value.attachment)) files.set(attachmentKey("file", value.attachment), value.attachment);
+		for (const child of Object.values(value)) visit(child);
+	};
+	for (const event of events) visit(event);
+	return {
+		images: [...images.values()],
+		files: [...files.values()]
+	};
+}
+function sessionEventDigest(header, inheritedEventCount, events, workspace, instructionSnapshot, objects, parentOrigin) {
+	const imageDigests = /* @__PURE__ */ new Map();
+	const fileDigests = /* @__PURE__ */ new Map();
+	const spillDigests = /* @__PURE__ */ new Map();
+	for (const object of objects) if (object.kind === "image") imageDigests.set(attachmentKey("image", object.ref), object);
+	else if (object.kind === "file") fileDigests.set(attachmentKey("file", object.ref), object);
+	else spillDigests.set(spillKey(object.reference), object);
+	const normalize = (value) => {
+		if (Array.isArray(value)) return value.map(normalize);
+		if (!isRecord$1(value)) return value;
+		if (value.type === "image" && isImageRef(value.attachment)) {
+			const object = imageDigests.get(attachmentKey("image", value.attachment));
+			return object ? {
+				type: "image",
+				digest: object.digest,
+				...value.attachment.name ? { name: value.attachment.name } : {}
+			} : {
+				type: "image",
+				missing: value.attachment.attachmentId
+			};
+		}
+		if (value.type === "file" && isFileRef(value.attachment)) {
+			const object = fileDigests.get(attachmentKey("file", value.attachment));
+			return object ? {
+				type: "file",
+				digest: object.digest,
+				name: value.attachment.name
+			} : {
+				type: "file",
+				missing: value.attachment.attachmentId
+			};
+		}
+		const output = {};
+		for (const [key, child] of Object.entries(value)) if (key === SPILL_ARTIFACT_META_KEY && isRecord$1(child) && Array.isArray(child.references)) output[key] = {
+			version: child.version,
+			references: child.references.map((reference) => {
+				if (!isRecord$1(reference) || !isRecord$1(reference.ref)) return reference;
+				const spill = spillDigests.get(spillKey(reference));
+				return spill ? {
+					source: reference.source,
+					suggestedName: reference.suggestedName,
+					digest: spill.digest,
+					bytes: spill.bytes
+				} : {
+					source: reference.source,
+					suggestedName: reference.suggestedName,
+					missing: reference.ref.locator
+				};
+			})
+		};
+		else if (key === "text" && typeof child === "string") {
+			let text = child;
+			for (const object of objects) {
+				if (object.kind !== "spill") continue;
+				const ref = object.reference.ref;
+				text = text.replaceAll(`Full formatted result stored at: ${ref.locator}. ${ref.retrievalHint}`, `Full formatted result stored at: ${object.digest}.`);
+			}
+			output[key] = text;
+		} else output[key] = normalize(child);
+		return output;
+	};
+	const { id: _id, cwd: _cwd, parentSession: _parent, ...stableHeader } = header;
+	return sha256(canonicalJson({
+		header: stableHeader,
+		inheritedEventCount,
+		events: events.map(normalize),
+		workspace: {
+			originInstanceId: workspace.originInstanceId,
+			originWorkspaceId: workspace.originWorkspaceId,
+			nodeOrigin: workspace.nodeOrigin,
+			remotePath: workspace.remotePath
+		},
+		parentOrigin,
+		instructionSnapshot: instructionSnapshot ? {
+			text: instructionSnapshot.text,
+			capturedAt: instructionSnapshot.capturedAt,
+			workspaceOrigin: instructionSnapshot.workspaceOrigin,
+			workspaceRemotePath: instructionSnapshot.workspaceRemotePath,
+			workspaceRevision: instructionSnapshot.workspaceRevision,
+			digest: instructionSnapshot.digest,
+			inheritedFromOrigin: instructionSnapshot.inheritedFromOrigin
+		} : void 0
+	}));
+}
+function sessionStateDigest(workspace, workspacePosition, archived, pinned) {
+	return sha256(canonicalJson({
+		workspace: {
+			originInstanceId: workspace.originInstanceId,
+			originWorkspaceId: workspace.originWorkspaceId,
+			nodeOrigin: workspace.nodeOrigin,
+			remotePath: workspace.remotePath,
+			title: workspace.title,
+			revision: workspace.revision,
+			contentDigest: workspace.contentDigest
+		},
+		workspacePosition,
+		archived,
+		pinned
+	}));
+}
+function planSessionTransfers(direction, localEntries, remoteEntries) {
+	const toLocal = [];
+	const toRemote = [];
+	const keyOf = (entry) => entry.branchId ?? sessionOriginKey(entry.metadata);
+	const localByKey = new Map(localEntries.map((entry) => [keyOf(entry), entry]));
+	const remoteByKey = new Map(remoteEntries.map((entry) => [keyOf(entry), entry]));
+	if (direction === "pull") {
+		let skipped = 0;
+		for (const [key, remote] of remoteByKey) {
+			const local = localByKey.get(key);
+			if (!local) {
+				toLocal.push(remote);
+				continue;
+			}
+			const comparison = compareSyncRevision(local.metadata.revision, remote.metadata.revision);
+			if (comparison < 0) toLocal.push(remote);
+			else if (comparison === 0) {
+				if (local.metadata.contentDigest !== remote.metadata.contentDigest || local.metadata.stateDigest !== remote.metadata.stateDigest || Boolean(local.metadata.deleted) !== Boolean(remote.metadata.deleted)) throw new SyncSessionError("revision-conflict", "Equal session revisions contain different content");
+				skipped += 1;
+			} else skipped += 1;
+		}
+		return {
+			toLocal,
+			toRemote,
+			skipped
+		};
+	}
+	const keys = /* @__PURE__ */ new Set([...localByKey.keys(), ...remoteByKey.keys()]);
+	let skipped = 0;
+	for (const key of keys) {
+		const local = localByKey.get(key);
+		const remote = remoteByKey.get(key);
+		if (!local) {
+			toLocal.push(remote);
+			continue;
+		}
+		if (!remote) {
+			toRemote.push(local);
+			continue;
+		}
+		const comparison = compareSyncRevision(local.metadata.revision, remote.metadata.revision);
+		if (comparison > 0) toRemote.push(local);
+		else if (comparison < 0) toLocal.push(remote);
+		else if (local.metadata.contentDigest === remote.metadata.contentDigest && local.metadata.stateDigest === remote.metadata.stateDigest && Boolean(local.metadata.deleted) === Boolean(remote.metadata.deleted)) skipped += 1;
+		else throw new SyncSessionError("revision-conflict", "Equal session revisions contain different content");
+	}
+	return {
+		toLocal,
+		toRemote,
+		skipped
+	};
+}
+async function collectBytes(stream, maxBytes = MAX_SYNC_TRANSFER_BYTES) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of stream) {
+		if (!(chunk instanceof Uint8Array)) throw new SyncSessionError("object-invalid", "session object stream contains a non-byte chunk");
+		size += chunk.byteLength;
+		if (size > maxBytes) throw new SyncSessionError("bundle-too-large", "session object exceeds the transfer limit");
+		chunks.push(Buffer.from(chunk));
+	}
+	return Buffer.concat(chunks, size);
+}
+async function* oneChunk(data) {
+	yield data;
+}
+function findSessionRecordByLocalId(state, localSessionId) {
+	return Object.values(state.records).filter((metadata) => metadata.kind === "session" && metadata.localEntityId === localSessionId).sort((a, b) => compareSyncRevision(b.revision, a.revision))[0];
+}
+function findSessionOriginByLocalId(state, localSessionId) {
+	const metadata = findSessionRecordByLocalId(state, localSessionId);
+	return metadata ? {
+		originInstanceId: metadata.originInstanceId,
+		originEntityId: metadata.originEntityId
+	} : void 0;
+}
+function workspaceDigest(workspace) {
+	return sha256(canonicalJson(workspace));
+}
+function workspaceCandidateKey(workspace) {
+	return normalize(workspace.path);
+}
+function validateObjectPayload(object) {
+	if (!isRecord$1(object) || typeof object.id !== "string" || !object.id || typeof object.digest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(object.digest) || !isNonNegativeSafeInteger(object.bytes) || typeof object.data !== "string") throw new SyncSessionError("object-invalid", "session object metadata is invalid");
+	if (!(object.kind === "spill" && object.unavailable === true && object.bytes === 0 && object.data === "")) {
+		const bytes = Buffer.from(object.data, "base64");
+		if (bytes.toString("base64") !== object.data || bytes.byteLength !== object.bytes || sha256(bytes) !== object.digest) throw new SyncSessionError("object-invalid", "session object encoding or digest is invalid");
+	}
+	if (object.kind === "image" && isImageRef(object.ref) && object.id === attachmentKey("image", object.ref)) return object;
+	if (object.kind === "file" && isFileRef(object.ref) && object.id === attachmentKey("file", object.ref)) return object;
+	if (object.kind === "spill" && isRecord$1(object.reference) && isRecord$1(object.reference.owner) && typeof object.reference.owner.sessionId === "string" && isRecord$1(object.reference.ref) && typeof object.reference.ref.locator === "string" && object.id === spillKey(object.reference)) return object;
+	throw new SyncSessionError("object-invalid", "session object kind or reference is invalid");
+}
+function validateEntry(entry) {
+	if (!isRecord$1(entry) || !isRecord$1(entry.metadata) || entry.metadata.kind !== "session") throw new SyncSessionError("manifest-invalid", "session entry metadata is invalid");
+	const metadata = entry.metadata;
+	if (typeof metadata.originInstanceId !== "string" || !metadata.originInstanceId || metadata.originInstanceId.length > 512 || /[\u0000-\u001f\u007f]/.test(metadata.originInstanceId) || typeof metadata.originEntityId !== "string" || !metadata.originEntityId || metadata.originEntityId.length > 512 || /[\u0000-\u001f\u007f]/.test(metadata.originEntityId) || typeof metadata.localEntityId !== "string" || !metadata.localEntityId || metadata.localEntityId.length > 512 || /[\u0000-\u001f\u007f]/.test(metadata.localEntityId) || typeof metadata.contentDigest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(metadata.contentDigest) || !metadata.revision || !isNonNegativeSafeInteger(metadata.revision.physicalTimeMs) || !isNonNegativeSafeInteger(metadata.revision.logicalCounter) || typeof metadata.revision.writerInstanceId !== "string" || !metadata.revision.writerInstanceId || /[\u0000-\u001f\u007f]/.test(metadata.revision.writerInstanceId)) throw new SyncSessionError("manifest-invalid", "session entry metadata fields are invalid");
+	if (metadata.stateDigest !== void 0 && !/^sha256:[a-f0-9]{64}$/.test(metadata.stateDigest)) throw new SyncSessionError("manifest-invalid", "session state digest is invalid");
+	if (entry.branchId !== void 0 && (typeof entry.branchId !== "string" || !/^b-[a-f0-9]{32}$/.test(entry.branchId))) throw new SyncSessionError("manifest-invalid", "session branch ID is invalid");
+	if (metadata.workspaceOrigin !== void 0) validateOrigin(metadata.workspaceOrigin);
+	if (metadata.deleted) {
+		if (metadata.contentDigest !== sessionTombstoneDigest(metadata)) throw new SyncSessionError("manifest-invalid", "session tombstone digest is invalid");
+		return {
+			metadata,
+			...entry.branchId ? { branchId: entry.branchId } : {}
+		};
+	}
+	const workspace = isRecord$1(entry.workspace) ? entry.workspace : void 0;
+	const workspaceRevision = workspace && isRecord$1(workspace.revision) ? workspace.revision : void 0;
+	if (typeof entry.sourceLocalSessionId !== "string" || !isRecord$1(entry.header) || typeof entry.inheritedEventCount !== "number" || !Number.isSafeInteger(entry.inheritedEventCount) || entry.inheritedEventCount < 0 || !Array.isArray(entry.events) || !workspace || !Array.isArray(entry.objects) || typeof workspace.originInstanceId !== "string" || typeof workspace.originWorkspaceId !== "string" || !isRecord$1(workspace.nodeOrigin) || typeof workspace.nodeOrigin.originInstanceId !== "string" || typeof workspace.nodeOrigin.originEntityId !== "string" || typeof workspace.remotePath !== "string" || !posix.isAbsolute(workspace.remotePath) || posix.normalize(workspace.remotePath) !== workspace.remotePath || typeof workspace.title !== "string" || typeof workspace.contentDigest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(workspace.contentDigest) || !workspaceRevision || !isNonNegativeSafeInteger(workspaceRevision.physicalTimeMs) || !isNonNegativeSafeInteger(workspaceRevision.logicalCounter) || typeof workspaceRevision.writerInstanceId !== "string" || typeof entry.workspacePosition !== "number" || !Number.isSafeInteger(entry.workspacePosition) || entry.workspacePosition < 0 || typeof entry.archived !== "boolean" || typeof entry.pinned !== "boolean") throw new SyncSessionError("manifest-invalid", "active session entry fields are invalid");
+	if (entry.events.length > MAX_SYNC_SESSIONS * 100) throw new SyncSessionError("manifest-invalid", "session event count exceeds limit");
+	const header = entry.header;
+	if (header.version !== 4 || header.id !== entry.sourceLocalSessionId) throw new SyncSessionError("session-format", "session header format or id is invalid");
+	const events = validateStoredEvents(header, structuredClone(entry.events));
+	assertContiguous(header.id, events, 0);
+	const objects = entry.objects.map(validateObjectPayload);
+	if (new Set(objects.map((object) => object.id)).size !== objects.length) throw new SyncSessionError("manifest-invalid", "session entry contains duplicate objects");
+	const workspaceValue = workspace;
+	if (workspaceDigest({
+		originInstanceId: workspaceValue.originInstanceId,
+		originWorkspaceId: workspaceValue.originWorkspaceId,
+		nodeOrigin: workspaceValue.nodeOrigin,
+		remotePath: workspaceValue.remotePath,
+		title: workspaceValue.title
+	}) !== workspaceValue.contentDigest) throw new SyncSessionError("manifest-invalid", "workspace content digest is invalid");
+	const instructionSnapshot = entry.instructionSnapshot === void 0 ? void 0 : validateInstructionSnapshot(entry.instructionSnapshot);
+	const referencedObjects = /* @__PURE__ */ new Set();
+	const attachments = attachmentReferences(events);
+	for (const ref of attachments.images) referencedObjects.add(attachmentKey("image", ref));
+	for (const ref of attachments.files) referencedObjects.add(attachmentKey("file", ref));
+	for (const reference of [...spillReferences(events), ...legacySpillReferences(events, String(header.id))]) referencedObjects.add(spillKey(reference));
+	const objectIds = new Set(objects.map((object) => object.id));
+	if ([...referencedObjects].some((id) => !objectIds.has(id)) || [...objectIds].some((id) => !referencedObjects.has(id))) throw new SyncSessionError("manifest-invalid", "session object references and payloads do not match");
+	const parentOrigin = entry.parentOrigin === void 0 ? void 0 : validateOrigin(entry.parentOrigin);
+	if (sessionEventDigest(header, entry.inheritedEventCount, events, workspaceValue, instructionSnapshot, objects, parentOrigin) !== metadata.contentDigest) throw new SyncSessionError("manifest-invalid", "session content digest is invalid");
+	if (metadata.stateDigest !== sessionStateDigest(workspaceValue, entry.workspacePosition, entry.archived, entry.pinned)) throw new SyncSessionError("manifest-invalid", "session state digest is invalid");
+	return {
+		metadata,
+		...entry.branchId ? { branchId: entry.branchId } : {},
+		sourceLocalSessionId: entry.sourceLocalSessionId,
+		header,
+		inheritedEventCount: entry.inheritedEventCount,
+		...parentOrigin ? { parentOrigin } : {},
+		workspace: workspaceValue,
+		workspacePosition: entry.workspacePosition,
+		archived: entry.archived,
+		pinned: entry.pinned,
+		...instructionSnapshot ? { instructionSnapshot } : {},
+		events,
+		objects
+	};
+}
+function bundleDigest(bundle) {
+	const manifest = bundle.entries.map((entry) => ({
+		key: entry.branchId ?? sessionOriginKey(entry.metadata),
+		revision: entry.metadata.revision,
+		contentDigest: entry.metadata.contentDigest,
+		stateDigest: entry.metadata.stateDigest,
+		deleted: Boolean(entry.metadata.deleted),
+		objects: (entry.objects ?? []).map((object) => ({
+			id: object.id,
+			digest: object.digest,
+			bytes: object.bytes
+		})).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0)
+	})).sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+	const skipped = bundle.skipped.map((entry) => ({
+		sessionId: entry.sessionId,
+		reason: entry.reason
+	})).sort((a, b) => a.sessionId < b.sessionId ? -1 : a.sessionId > b.sessionId ? 1 : 0);
+	return sha256(canonicalJson({
+		instanceId: bundle.instanceId,
+		entries: manifest,
+		skipped
+	}));
+}
+function validateSyncSessionBundle(value) {
+	if (!isRecord$1(value) || value.protocolVersion !== 1 || typeof value.instanceId !== "string" || !/^i-[a-f0-9]{32}$/.test(value.instanceId) || !Array.isArray(value.entries) || typeof value.digest !== "string") throw new SyncSessionError("manifest-invalid", "session bundle header is invalid");
+	const skipped = value.skipped === void 0 ? [] : value.skipped;
+	if (!Array.isArray(skipped) || skipped.some((item) => !isRecord$1(item) || typeof item.sessionId !== "string" || typeof item.reason !== "string")) throw new SyncSessionError("manifest-invalid", "session bundle skip report is invalid");
+	if (value.entries.length > MAX_SYNC_SESSIONS) throw new SyncSessionError("manifest-invalid", "session bundle contains too many records");
+	const entries = value.entries.map(validateEntry);
+	const keys = entries.map((entry) => entry.branchId ?? sessionOriginKey(entry.metadata));
+	if (new Set(keys).size !== keys.length) throw new SyncSessionError("manifest-invalid", "session bundle contains duplicate records");
+	const bundle = {
+		protocolVersion: 1,
+		instanceId: value.instanceId,
+		entries,
+		skipped,
+		digest: value.digest
+	};
+	if (bundleDigest(bundle) !== bundle.digest) throw new SyncSessionError("manifest-digest", "session bundle digest does not match");
+	if (Buffer.byteLength(JSON.stringify(bundle), "utf8") > 107374182400) throw new SyncSessionError("bundle-too-large", "session bundle exceeds the transfer limit");
+	return bundle;
+}
+function makeSyncSessionBundle(instanceId, entries, skipped = []) {
+	const bundle = {
+		protocolVersion: 1,
+		instanceId,
+		entries,
+		skipped,
+		digest: ""
+	};
+	bundle.digest = bundleDigest(bundle);
+	if (Buffer.byteLength(JSON.stringify(bundle), "utf8") > 107374182400) throw new SyncSessionError("bundle-too-large", "session bundle exceeds the transfer limit");
+	return bundle;
+}
+function emptyApplyResult() {
+	return {
+		created: 0,
+		updated: 0,
+		archived: 0,
+		deleted: 0,
+		skipped: 0,
+		unmapped: 0
+	};
+}
+function isNodeRemoteType(type) {
+	return type === "remote-ssh" || type === "remote-docker";
+}
+function branchIdFor(metadata) {
+	return `b-${createHash("sha256").update(canonicalJson({
+		originInstanceId: metadata.originInstanceId,
+		originEntityId: metadata.originEntityId,
+		contentDigest: metadata.contentDigest
+	})).digest("hex").slice(0, 32)}`;
+}
+function sessionTombstoneDigest(metadata) {
+	return sha256(canonicalJson({
+		kind: "session",
+		originInstanceId: metadata.originInstanceId,
+		originEntityId: metadata.originEntityId,
+		deleted: true
+	}));
+}
+function validateOrigin(value) {
+	if (!isRecord$1(value) || typeof value.originInstanceId !== "string" || !value.originInstanceId || typeof value.originEntityId !== "string" || !value.originEntityId || value.originInstanceId.length > 512 || value.originEntityId.length > 512 || /[\u0000-\u001f\u007f]/.test(value.originInstanceId) || /[\u0000-\u001f\u007f]/.test(value.originEntityId)) throw new SyncSessionError("manifest-invalid", "session origin reference is invalid");
+	return {
+		originInstanceId: value.originInstanceId,
+		originEntityId: value.originEntityId
+	};
+}
+function validateInstructionSnapshot(value) {
+	if (!isRecord$1(value) || typeof value.text !== "string" || Buffer.byteLength(value.text, "utf8") > 32768 || typeof value.capturedAt !== "string" || value.capturedAt.length > 64) throw new SyncSessionError("manifest-invalid", "session instruction snapshot is invalid");
+	if (value.workspaceRevision !== void 0 && !isNonNegativeSafeInteger(value.workspaceRevision)) throw new SyncSessionError("manifest-invalid", "instruction workspace revision is invalid");
+	if (value.digest !== void 0 && (typeof value.digest !== "string" || !/^[a-f0-9]{64}$/.test(value.digest))) throw new SyncSessionError("manifest-invalid", "instruction digest is invalid");
+	if (value.workspaceRemotePath !== void 0 && (typeof value.workspaceRemotePath !== "string" || !posix.isAbsolute(value.workspaceRemotePath) || posix.normalize(value.workspaceRemotePath) !== value.workspaceRemotePath)) throw new SyncSessionError("manifest-invalid", "instruction workspace path is invalid");
+	return {
+		text: value.text,
+		capturedAt: value.capturedAt,
+		...value.workspaceOrigin === void 0 ? {} : { workspaceOrigin: validateOrigin(value.workspaceOrigin) },
+		...value.workspaceRemotePath === void 0 ? {} : { workspaceRemotePath: value.workspaceRemotePath },
+		...value.workspaceRevision === void 0 ? {} : { workspaceRevision: value.workspaceRevision },
+		...value.digest === void 0 ? {} : { digest: value.digest },
+		...value.inheritedFromOrigin === void 0 ? {} : { inheritedFromOrigin: validateOrigin(value.inheritedFromOrigin) }
+	};
+}
+function importedSessionId(metadata) {
+	const identity = canonicalJson({
+		originInstanceId: metadata.originInstanceId,
+		originEntityId: metadata.originEntityId,
+		contentDigest: metadata.contentDigest
+	});
+	return SessionId(`session-sync-${createHash("sha256").update(identity).digest("hex").slice(0, 32)}`);
+}
+function archivedSessionId(branchId) {
+	return SessionId(`session-archive-${createHash("sha256").update(branchId).digest("hex").slice(0, 32)}`);
+}
+function tombstoneDigest(metadata) {
+	return sha256(canonicalJson({
+		kind: "session",
+		originInstanceId: metadata.originInstanceId,
+		originEntityId: metadata.originEntityId,
+		deleted: true
+	}));
+}
+function arrayBuffer(data) {
+	const value = Buffer.from(data, "base64");
+	if (value.toString("base64") !== data) throw new SyncSessionError("object-invalid", "session object is not canonical base64");
+	return value;
+}
+function instructionsForSession(store, sessionId, state, preferredWorkspaceOrigin) {
+	const snapshot = store.get(sessionId);
+	if (!snapshot) return void 0;
+	const workspaceMappings = snapshot.workspaceId ? Object.values(state.workspaces).filter((mapping) => mapping.localWorkspaceId === snapshot.workspaceId) : [];
+	const workspaceMapping = preferredWorkspaceOrigin ? workspaceMappings.find((mapping) => mapping.originInstanceId === preferredWorkspaceOrigin.originInstanceId && mapping.originWorkspaceId === preferredWorkspaceOrigin.originEntityId) ?? (workspaceMappings.length === 1 ? workspaceMappings[0] : void 0) : workspaceMappings.length === 1 ? workspaceMappings[0] : void 0;
+	const inheritedFromOrigin = snapshot.inheritedFromSessionId ? findSessionOriginByLocalId(state, snapshot.inheritedFromSessionId) : void 0;
+	return {
+		text: snapshot.text,
+		capturedAt: snapshot.capturedAt,
+		...workspaceMapping ? {
+			workspaceOrigin: {
+				originInstanceId: workspaceMapping.originInstanceId,
+				originEntityId: workspaceMapping.originWorkspaceId
+			},
+			workspaceRemotePath: workspaceMapping.remotePath
+		} : {},
+		...snapshot.workspaceRevision === void 0 ? {} : { workspaceRevision: snapshot.workspaceRevision },
+		...snapshot.digest === void 0 ? {} : { digest: snapshot.digest },
+		...inheritedFromOrigin ? { inheritedFromOrigin } : {}
+	};
+}
+var SyncSessionService = class {
+	state;
+	nodes;
+	registry;
+	bindings;
+	getWorkspaces;
+	getPersistence;
+	getAttachments;
+	getSpills;
+	instructions;
+	journal;
+	now;
+	operationTail = Promise.resolve();
+	constructor(state, nodes, registry, bindings, getWorkspaces, getPersistence, getAttachments, getSpills, instructions, journal = new SyncSessionJournalStore(), now = Date.now) {
+		this.state = state;
+		this.nodes = nodes;
+		this.registry = registry;
+		this.bindings = bindings;
+		this.getWorkspaces = getWorkspaces;
+		this.getPersistence = getPersistence;
+		this.getAttachments = getAttachments;
+		this.getSpills = getSpills;
+		this.instructions = instructions;
+		this.journal = journal;
+		this.now = now;
+	}
+	exportBundle() {
+		return this.serializeMutation(() => this.exportBundleNow());
+	}
+	applyBundle(value, sourceName, peerId = "p-000000000000000000000000", options = {}) {
+		return this.serializeMutation(() => this.applyBundleNow(value, sourceName, peerId, options));
+	}
+	preflightBundle(value, options = {}) {
+		const bundle = validateSyncSessionBundle(value);
+		if (bundle.instanceId === this.state.instanceId() && !options.allowSameInstance) throw new SyncSessionError("same-instance", "cannot import sessions from this instance");
+		const state = this.state.read();
+		for (const entry of bundle.entries) {
+			if (entry.metadata.deleted) {
+				const current = state.records[sessionOriginKey(entry.metadata)];
+				if (!current) continue;
+				if (compareSyncRevision(entry.metadata.revision, current.revision) === 0 && (entry.metadata.contentDigest !== current.contentDigest || !current.deleted)) throw new SyncSessionError("revision-conflict", "Equal session revisions contain different tombstone state");
+				continue;
+			}
+			if (entry.branchId) {
+				const current = state.archives[entry.branchId];
+				if (!current) continue;
+				const comparison = compareSyncRevision(entry.metadata.revision, current.revision);
+				if (comparison === 0 && (entry.metadata.contentDigest !== current.contentDigest || entry.metadata.stateDigest !== current.stateDigest)) throw new SyncSessionError("revision-conflict", "Equal archive revisions contain different content");
+				if (comparison > 0 && entry.metadata.contentDigest !== current.contentDigest) throw new SyncSessionError("archive-conflict", "A session archive ID was reused for different content");
+				continue;
+			}
+			const current = state.records[sessionOriginKey(entry.metadata)];
+			if (!current || current.deleted) continue;
+			if (compareSyncRevision(entry.metadata.revision, current.revision) === 0 && (entry.metadata.contentDigest !== current.contentDigest || entry.metadata.stateDigest !== current.stateDigest)) throw new SyncSessionError("revision-conflict", "Equal session revisions contain different content");
+		}
+	}
+	pendingPeerIds() {
+		return this.journal.pendingPeerIds();
+	}
+	async recoverPending() {
+		const failures = [];
+		for (const batch of this.journal.pendingBatches()) try {
+			const bundle = this.journal.readBundle(batch.batchId);
+			if (bundle === void 0) throw new SyncSessionError("journal-missing-bundle", "未完成的会话 journal 缺少 bundle");
+			if (validateSyncSessionBundle(bundle).digest !== batch.bundleDigest) throw new SyncSessionError("journal-bundle-mismatch", "会话 journal bundle 摘要不匹配");
+			await this.serializeMutation(() => this.applyBundleNow(bundle, batch.sourceName, batch.peerId, {
+				importedVia: batch.importedVia,
+				allowSameInstance: batch.allowSameInstance
+			}, batch));
+		} catch (error) {
+			failures.push(error);
+		}
+		if (failures.length > 0) throw new AggregateError(failures, "One or more sync session batches remain pending");
+	}
+	cleanupOrphanedStaging() {
+		this.journal.cleanupOrphanedStaging();
+	}
+	listArchives() {
+		return Object.values(this.state.read().archives).sort((a, b) => a.archivedAt.localeCompare(b.archivedAt));
+	}
+	restoreArchive(branchId) {
+		return this.serializeMutation(() => this.restoreArchiveNow(branchId));
+	}
+	async exportBundleNow() {
+		const persistence = this.requirePersistence();
+		const workspaceRegistry = this.getWorkspaces();
+		if (!workspaceRegistry) throw new SyncSessionError("workspace-unavailable", "工作区注册表不可用");
+		await persistence.flush();
+		const instanceId = this.state.instanceId();
+		const bindings = this.bindings.list();
+		const workspaces = workspaceRegistry.list();
+		const archivedIds = new Set(workspaceRegistry.archivedSessionIds.map(String));
+		const pinnedIds = new Set((workspaceRegistry.pinnedSessionIds ?? []).map(String));
+		const entries = [];
+		const skipped = [];
+		const eligibleLocalIds = /* @__PURE__ */ new Set();
+		const workspaceById = /* @__PURE__ */ new Map();
+		const archivedBranchSessionIds = new Set(Object.values(this.state.read().archives).map((archive) => archive.localSessionId));
+		for (const workspace of workspaces) {
+			workspaceById.set(String(workspace.id), workspace);
+			const binding = bindings.find((candidate) => normalize(candidate.mirrorPath) === workspaceCandidateKey(workspace));
+			if (!binding) continue;
+			const node = this.registry.get(binding.nodeId);
+			if (!node || !isNodeRemoteType(node.type)) continue;
+			const nodeOrigin = this.nodes.originForLocalNode(node.id);
+			if (!nodeOrigin) continue;
+			for (let position = 0; position < workspace.sessionIds.length; position += 1) {
+				const sessionId = String(workspace.sessionIds[position]);
+				if (archivedBranchSessionIds.has(sessionId)) continue;
+				const currentSession = findSessionRecordByLocalId(this.state.read(), sessionId);
+				if (currentSession?.deleted) continue;
+				const descriptor = this.workspaceDescriptor(workspace, binding, nodeOrigin, currentSession?.workspaceOrigin);
+				const snapshot = await persistence.stat(SessionId(sessionId));
+				if (!snapshot) continue;
+				if (snapshot.formatStatus === "migration-required") throw new SyncSessionError("session-format", "会话格式需要由当前 DSH 版本迁移");
+				const entry = await this.exportSessionEntry(persistence, workspace, descriptor, position, SessionId(sessionId), snapshot, archivedIds.has(sessionId), pinnedIds.has(sessionId));
+				if (entry) {
+					entries.push(entry);
+					eligibleLocalIds.add(sessionId);
+				} else skipped.push({
+					sessionId,
+					reason: "workspace-cwd-mismatch"
+				});
+			}
+		}
+		const initial = this.state.read();
+		for (const metadata of Object.values(initial.records)) {
+			if (metadata.kind !== "session" || archivedBranchSessionIds.has(metadata.localEntityId)) continue;
+			if (metadata.deleted) {
+				entries.push({ metadata });
+				continue;
+			}
+			if (eligibleLocalIds.has(metadata.localEntityId)) continue;
+			const tombstone = {
+				...metadata,
+				revision: this.state.nextRevision(this.now()),
+				contentDigest: tombstoneDigest(metadata),
+				deleted: true
+			};
+			this.state.update((state) => {
+				state.records[sessionOriginKey(metadata)] = tombstone;
+			});
+			entries.push({ metadata: tombstone });
+		}
+		for (const archive of this.listArchives()) {
+			const workspace = archive.workspaceId ? workspaceById.get(archive.workspaceId) : void 0;
+			if (!workspace) continue;
+			const binding = bindings.find((candidate) => normalize(candidate.mirrorPath) === workspaceCandidateKey(workspace));
+			const node = binding ? this.registry.get(binding.nodeId) : void 0;
+			if (!binding || !node || !isNodeRemoteType(node.type)) continue;
+			const nodeOrigin = this.nodes.originForLocalNode(node.id);
+			if (!nodeOrigin) continue;
+			const archivedMetadata = Object.values(this.state.read().archives).find((item) => item.localSessionId === archive.localSessionId);
+			const descriptor = this.workspaceDescriptor(workspace, binding, nodeOrigin, archivedMetadata?.workspaceOrigin);
+			const snapshot = await persistence.stat(SessionId(archive.localSessionId));
+			if (!snapshot) continue;
+			const entry = await this.exportSessionEntry(persistence, workspace, descriptor, archive.workspacePosition, SessionId(archive.localSessionId), snapshot, true, false, archive);
+			if (entry) entries.push(entry);
+			else skipped.push({
+				sessionId: archive.localSessionId,
+				reason: "archive-workspace-cwd-mismatch"
+			});
+		}
+		return makeSyncSessionBundle(instanceId, entries, skipped);
+	}
+	async applyBundleNow(value, sourceName, peerId, options, recoveryBatch) {
+		const bundle = validateSyncSessionBundle(value);
+		const pendingBatch = recoveryBatch ?? this.journal.findBatch(peerId, bundle.digest);
+		if (pendingBatch && (pendingBatch.bundleDigest !== bundle.digest || pendingBatch.peerId !== peerId)) throw new SyncSessionError("journal-bundle-mismatch", "会话 journal batch 与 bundle 不匹配");
+		const importedVia = pendingBatch?.importedVia ?? options.importedVia ?? "peer";
+		const allowSameInstance = pendingBatch?.allowSameInstance ?? options.allowSameInstance ?? false;
+		const localInstanceId = this.state.instanceId();
+		if (bundle.instanceId === localInstanceId && !allowSameInstance) throw new SyncSessionError("same-instance", "cannot import sessions from this instance");
+		if (!pendingBatch) await this.exportBundleNow();
+		this.preflightBundle(bundle, {
+			importedVia,
+			allowSameInstance
+		});
+		const safeSourceName = (pendingBatch?.sourceName ?? sourceName).replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, 128) || "sync peer";
+		const recordKeys = bundle.entries.map((entry) => entry.branchId ?? sessionOriginKey(entry.metadata));
+		const batchId = pendingBatch?.batchId ?? this.journal.beginWithBundle(peerId, safeSourceName, bundle.digest, recordKeys, bundle, new Date(this.now()).toISOString(), importedVia, allowSameInstance);
+		const result = emptyApplyResult();
+		result.skipped += bundle.skipped.length;
+		result.unmapped += bundle.skipped.length;
+		const workspaceOrders = /* @__PURE__ */ new Map();
+		const plannedSessionIds = /* @__PURE__ */ new Map();
+		for (const entry of bundle.entries) if (!entry.metadata.deleted && !entry.branchId) {
+			const current = this.state.read().records[sessionOriginKey(entry.metadata)];
+			const localId = current && !current.deleted && current.contentDigest === entry.metadata.contentDigest ? SessionId(current.localEntityId) : importedSessionId(entry.metadata);
+			plannedSessionIds.set(sessionOriginKey(entry.metadata), localId);
+		}
+		const workspaceResolutions = /* @__PURE__ */ new Map();
+		const resolveWorkspace = (entry) => {
+			const descriptor = entry.workspace;
+			if (!descriptor) return Promise.resolve(void 0);
+			const workspaceKey = syncWorkspaceKey(descriptor.originInstanceId, descriptor.originWorkspaceId, descriptor.remotePath);
+			let resolution = workspaceResolutions.get(workspaceKey);
+			if (!resolution) {
+				resolution = this.ensureWorkspace(descriptor).catch((error) => {
+					if (error instanceof SyncSessionError && error.code === "workspace-unmapped") return void 0;
+					throw error;
+				});
+				workspaceResolutions.set(workspaceKey, resolution);
+			}
+			return resolution;
+		};
+		try {
+			const queueWorkspaceOrder = (workspaceId, id, position) => {
+				const order = workspaceOrders.get(workspaceId) ?? [];
+				order.push({
+					id,
+					position
+				});
+				workspaceOrders.set(workspaceId, order);
+			};
+			const entries = [...bundle.entries].sort((a, b) => {
+				if (a.branchId || b.branchId) return (a.branchId ?? "").localeCompare(b.branchId ?? "");
+				if (a.workspace?.originWorkspaceId !== b.workspace?.originWorkspaceId) return (a.workspace?.originWorkspaceId ?? "").localeCompare(b.workspace?.originWorkspaceId ?? "");
+				return (b.workspacePosition ?? 0) - (a.workspacePosition ?? 0);
+			});
+			for (const entry of entries) {
+				const key = entry.branchId ?? sessionOriginKey(entry.metadata);
+				if (entry.metadata.deleted) {
+					if (await this.applyTombstone(entry.metadata)) result.deleted += 1;
+					else result.skipped += 1;
+					continue;
+				}
+				const entryWorkspace = await resolveWorkspace(entry);
+				if (!entryWorkspace) {
+					result.skipped += 1;
+					result.unmapped += 1;
+					continue;
+				}
+				const currentState = this.state.read();
+				const currentArchive = entry.branchId ? currentState.archives[entry.branchId] : void 0;
+				if (entry.branchId && currentArchive) {
+					const comparison = compareSyncRevision(entry.metadata.revision, currentArchive.revision);
+					if (comparison < 0) {
+						result.skipped += 1;
+						continue;
+					}
+					if (comparison === 0) {
+						if (entry.metadata.contentDigest !== currentArchive.contentDigest || entry.metadata.stateDigest !== currentArchive.stateDigest) throw new SyncSessionError("revision-conflict", "Equal archive revisions contain different content");
+						const sessionId = SessionId(currentArchive.localSessionId);
+						const snapshot = await this.requirePersistence().stat(sessionId);
+						if (snapshot && normalize(snapshot.header.cwd ?? "") === normalize(entryWorkspace.path)) {
+							await entryWorkspace.attachSession(sessionId);
+							queueWorkspaceOrder(entryWorkspace.id, sessionId, entry.workspacePosition ?? currentArchive.workspacePosition);
+						}
+						result.skipped += 1;
+						continue;
+					}
+					if (entry.metadata.contentDigest !== currentArchive.contentDigest) throw new SyncSessionError("archive-conflict", "A session archive ID was reused for different content");
+					await this.applyArchiveStateOnly(entry, currentArchive, entryWorkspace);
+					result.updated += 1;
+					queueWorkspaceOrder(entryWorkspace.id, SessionId(currentArchive.localSessionId), entry.workspacePosition ?? 0);
+					continue;
+				}
+				const current = entry.branchId ? void 0 : currentState.records[sessionOriginKey(entry.metadata)];
+				if (current) {
+					const comparison = compareSyncRevision(entry.metadata.revision, current.revision);
+					if (comparison < 0) {
+						result.skipped += 1;
+						continue;
+					}
+					if (comparison === 0) {
+						if (current.deleted || entry.metadata.contentDigest !== current.contentDigest || entry.metadata.stateDigest !== current.stateDigest) throw new SyncSessionError("revision-conflict", "Equal session revisions contain different content");
+						const sessionId = SessionId(current.localEntityId);
+						const snapshot = await this.requirePersistence().stat(sessionId);
+						if (snapshot && normalize(snapshot.header.cwd ?? "") === normalize(entryWorkspace.path)) {
+							await entryWorkspace.attachSession(sessionId);
+							queueWorkspaceOrder(entryWorkspace.id, sessionId, entry.workspacePosition ?? 0);
+						}
+						result.skipped += 1;
+						continue;
+					}
+					if (!current.deleted && entry.metadata.contentDigest === current.contentDigest && await this.requirePersistence().stat(SessionId(current.localEntityId))) {
+						await this.applyMembershipOnly(entry, current, safeSourceName, entryWorkspace, importedVia);
+						result.updated += 1;
+						queueWorkspaceOrder(entryWorkspace.id, SessionId(current.localEntityId), entry.workspacePosition ?? 0);
+						continue;
+					}
+				}
+				let preparedValue = this.journal.readPrepared(batchId, key);
+				let prepared;
+				if (preparedValue === void 0) {
+					try {
+						prepared = await this.prepareEntry(entry, safeSourceName, plannedSessionIds, entryWorkspace, importedVia);
+					} catch (error) {
+						if (error instanceof SyncSessionError && error.code === "workspace-unmapped") {
+							result.skipped += 1;
+							result.unmapped += 1;
+							continue;
+						}
+						throw error;
+					}
+					this.journal.writePrepared(batchId, key, prepared);
+					preparedValue = prepared;
+				}
+				prepared = this.validatePrepared(preparedValue);
+				if (current && !current.deleted && current.localEntityId !== prepared.localSessionId) {
+					if (await this.archiveCurrent(current)) result.archived += 1;
+				}
+				const existed = await this.requirePersistence().stat(prepared.localSessionId) !== void 0;
+				await this.applyPrepared(prepared);
+				if (prepared.branchId) result.archived += 1;
+				else if (existed) result.updated += 1;
+				else result.created += 1;
+				queueWorkspaceOrder(prepared.workspaceId, prepared.localSessionId, prepared.workspacePosition);
+			}
+			await this.orderWorkspaceSessions(workspaceOrders);
+			this.journal.complete(batchId);
+			return result;
+		} catch (error) {
+			if (error instanceof SyncSessionError) throw error;
+			throw new SyncSessionError("session-apply-failed", "会话同步应用失败", error);
+		}
+	}
+	async prepareEntry(entry, sourceName, plannedSessionIds, workspace, importedVia) {
+		if (!entry.header || !entry.events || !entry.workspace || !entry.objects) throw new SyncSessionError("manifest-invalid", "active session entry is incomplete");
+		const sessionId = entry.branchId ? archivedSessionId(entry.branchId) : importedSessionId(entry.metadata);
+		const sourceHeader = entry.header;
+		const headerWithoutLocalFields = { ...sourceHeader };
+		delete headerWithoutLocalFields.id;
+		delete headerWithoutLocalFields.cwd;
+		delete headerWithoutLocalFields.parentSession;
+		const parentSession = (entry.parentOrigin ? plannedSessionIds.get(syncRecordKey("session", entry.parentOrigin)) ?? this.localSessionIdForOrigin(entry.parentOrigin) : void 0) ?? sourceHeader.parentSession;
+		const header = {
+			...headerWithoutLocalFields,
+			id: sessionId,
+			cwd: workspace.path,
+			...parentSession ? { parentSession } : {}
+		};
+		const inheritedEventCount = entry.inheritedEventCount ?? 0;
+		const persistence = this.requirePersistence();
+		if (await persistence.stat(sessionId)) {
+			const handle = await persistence.open(sessionId, "read");
+			try {
+				if (canonicalJson(handle.header) !== canonicalJson(header) || handle.inheritedEventCount !== inheritedEventCount) throw new SyncSessionError("session-id-conflict", "目标 session ID 已被其他 header 占用");
+			} finally {
+				await handle.close();
+			}
+		}
+		const objectMap = await this.importObjects(entry.objects, sessionId);
+		const validatedEvents = validateStoredEvents(header, this.rewriteEvents(entry.events, entry.objects, objectMap, sessionId, String(entry.header.id)));
+		assertContiguous(sessionId, validatedEvents, 0);
+		const instructionWorkspaceId = entry.instructionSnapshot?.workspaceOrigin ? this.localWorkspaceIdForOrigin(entry.instructionSnapshot.workspaceOrigin, entry.instructionSnapshot.workspaceRemotePath) : void 0;
+		const instructionSnapshot = entry.instructionSnapshot ? {
+			sessionId,
+			...instructionWorkspaceId ? { workspaceId: instructionWorkspaceId } : {},
+			...entry.instructionSnapshot.workspaceRevision === void 0 ? {} : { workspaceRevision: entry.instructionSnapshot.workspaceRevision },
+			...entry.instructionSnapshot.digest === void 0 ? {} : { digest: entry.instructionSnapshot.digest },
+			text: entry.instructionSnapshot.text,
+			capturedAt: entry.instructionSnapshot.capturedAt,
+			...parentSession ? { inheritedFromSessionId: parentSession } : {}
+		} : void 0;
+		return {
+			metadata: entry.metadata,
+			...entry.branchId ? { branchId: entry.branchId } : {},
+			localSessionId: sessionId,
+			header,
+			inheritedEventCount,
+			events: [...validatedEvents],
+			workspaceId: workspace.id,
+			workspacePath: workspace.path,
+			workspace: entry.workspace,
+			workspacePosition: entry.workspacePosition ?? 0,
+			archived: Boolean(entry.archived || entry.branchId),
+			pinned: Boolean(entry.pinned && !entry.archived && !entry.branchId),
+			sourceName,
+			importedVia,
+			...instructionSnapshot ? { instructionSnapshot } : {}
+		};
+	}
+	async ensureWorkspace(descriptor) {
+		const workspaceRegistry = this.getWorkspaces();
+		if (!workspaceRegistry) throw new SyncSessionError("workspace-unavailable", "工作区注册表不可用");
+		const key = syncWorkspaceKey(descriptor.originInstanceId, descriptor.originWorkspaceId, descriptor.remotePath);
+		const committedWorkspace = await this.nodes.withAvailableRemoteNode(descriptor.nodeOrigin, async (activeNodeId) => {
+			const node = this.registry.get(activeNodeId);
+			if (!node || !isNodeRemoteType(node.type)) return void 0;
+			const latest = this.state.read().workspaces[key];
+			const latestComparison = latest ? compareSyncRevision(descriptor.revision, latest.revision) : 1;
+			if (latest && latestComparison === 0 && latest.contentDigest !== descriptor.contentDigest) throw new SyncSessionError("workspace-conflict", "Equal workspace revisions contain different content");
+			const latestTitle = latest && latestComparison < 0 ? latest.title : descriptor.title;
+			let binding = this.bindings.list().find((item) => item.nodeId === activeNodeId && posix.normalize(item.remotePath) === descriptor.remotePath);
+			let workspace = latest ? workspaceRegistry.get(latest.localWorkspaceId) : void 0;
+			if (!workspace && binding) workspace = workspaceRegistry.list().find((item) => normalize(item.path) === normalize(binding.mirrorPath));
+			if (!workspace) {
+				const mirrorPath = latest?.localPath ?? binding?.mirrorPath ?? this.bindings.mirrorRoot(activeNodeId, `sync-${createHash("sha256").update(key).digest("hex").slice(0, 20)}`);
+				mkdirSync(mirrorPath, {
+					recursive: true,
+					mode: 448
+				});
+				workspace = await workspaceRegistry.create(mirrorPath, latestTitle);
+			}
+			if (workspace.title !== latestTitle) await workspace.setTitle(latestTitle);
+			let activeBinding = binding ?? this.bindings.list().find((item) => normalize(item.mirrorPath) === normalize(workspace.path));
+			if (!activeBinding || activeBinding.nodeId !== activeNodeId || posix.normalize(activeBinding.remotePath) !== descriptor.remotePath) {
+				activeBinding = {
+					mirrorPath: workspace.path,
+					nodeId: activeNodeId,
+					remotePath: descriptor.remotePath,
+					workspaceId: workspace.id
+				};
+				this.bindings.add(activeBinding);
+			}
+			const localMappingChanged = !latest || latest.localWorkspaceId !== workspace.id || latest.localPath !== workspace.path || latest.localNodeId !== activeNodeId;
+			if (!latest || latestComparison > 0 || localMappingChanged) {
+				const mapping = {
+					...descriptor,
+					title: latestTitle,
+					...latest && latestComparison < 0 ? {
+						revision: latest.revision,
+						contentDigest: latest.contentDigest
+					} : {},
+					localWorkspaceId: workspace.id,
+					localPath: workspace.path,
+					localNodeId: activeNodeId
+				};
+				this.state.update((state) => {
+					state.workspaces[key] = mapping;
+				});
+			}
+			return workspace;
+		});
+		if (!committedWorkspace) throw new SyncSessionError("workspace-unmapped", "目标实例没有对应的可用远程节点");
+		return committedWorkspace;
+	}
+	async importObjects(objects, sessionId) {
+		const attachments = objects.some((object) => object.kind === "image" || object.kind === "file") ? this.getAttachments() : void 0;
+		const spills = objects.some((object) => object.kind === "spill" && !object.unavailable) ? this.getSpills() : void 0;
+		if (objects.some((object) => object.kind === "image" || object.kind === "file") && !attachments) throw new SyncSessionError("attachments-unavailable", "目标实例的附件存储服务不可用");
+		if (objects.some((object) => object.kind === "spill" && !object.unavailable) && !spills) throw new SyncSessionError("spill-transfer-unavailable", "目标实例没有 owner-scoped spill transfer API");
+		const output = /* @__PURE__ */ new Map();
+		for (const object of objects) {
+			if (object.kind === "spill" && object.unavailable) continue;
+			const data = arrayBuffer(object.data);
+			if (data.byteLength !== object.bytes || sha256(data) !== object.digest) throw new SyncSessionError("object-integrity", "session object failed digest validation");
+			if (object.kind === "image") {
+				const ref = await attachments.saveImage({
+					data,
+					mediaType: object.ref.mediaType,
+					...object.ref.name === void 0 ? {} : { name: object.ref.name }
+				});
+				output.set(object.id, ref);
+			} else if (object.kind === "file") {
+				const ref = await attachments.saveFileStream({
+					data: oneChunk(data),
+					name: object.ref.name
+				});
+				output.set(object.id, ref);
+			} else {
+				const ref = await saveSpillTransfer(spills, {
+					owner: { sessionId },
+					source: object.reference.source,
+					suggestedName: object.reference.suggestedName,
+					transferId: object.id,
+					bytes: object.bytes,
+					digest: object.digest,
+					data
+				});
+				output.set(object.id, ref);
+			}
+		}
+		return output;
+	}
+	rewriteEvents(events, objects, importedRefs, sessionId, sourceSessionId) {
+		const spillReferencesByLocator = /* @__PURE__ */ new Map();
+		for (const object of objects) {
+			if (object.kind !== "spill") continue;
+			if (object.unavailable) {
+				spillReferencesByLocator.set(object.reference.ref.locator, { source: object.reference });
+				continue;
+			}
+			const target = importedRefs.get(object.id);
+			if (!target || !("locator" in target)) throw new SyncSessionError("spill-reference-missing", "目标 spill reference 未创建");
+			spillReferencesByLocator.set(object.reference.ref.locator, {
+				source: object.reference,
+				target
+			});
+		}
+		const rewrite = (value) => {
+			if (Array.isArray(value)) return value.map(rewrite);
+			if (!isRecord$1(value)) return value;
+			if (value.type === "image" && isImageRef(value.attachment)) {
+				const target = importedRefs.get(attachmentKey("image", value.attachment));
+				if (!target || !("mediaType" in target)) throw new SyncSessionError("attachment-reference-missing", "目标图片附件未创建");
+				return {
+					...value,
+					attachment: target
+				};
+			}
+			if (value.type === "file" && isFileRef(value.attachment)) {
+				const target = importedRefs.get(attachmentKey("file", value.attachment));
+				if (!target || !("name" in target)) throw new SyncSessionError("attachment-reference-missing", "目标文件附件未创建");
+				return {
+					...value,
+					attachment: target
+				};
+			}
+			if (value.type === "session-log-deepseek/delivery-accepted" && isRecord$1(value.data) && value.data.sessionId === sourceSessionId) return {
+				...value,
+				data: {
+					...value.data,
+					sessionId
+				}
+			};
+			const output = {};
+			for (const [key, child] of Object.entries(value)) if (key === SPILL_ARTIFACT_META_KEY && isRecord$1(child) && Array.isArray(child.references)) {
+				const filteredReferences = child.references.filter((entry) => {
+					if (!isRecord$1(entry) || !isRecord$1(entry.owner) || !isRecord$1(entry.ref)) return false;
+					const reference = entry;
+					return spillReferencesByLocator.get(reference.ref.locator)?.target !== void 0;
+				});
+				if (filteredReferences.length === 0) continue;
+				output[key] = {
+					version: child.version,
+					references: filteredReferences.map((entry) => {
+						const reference = entry;
+						const mapped = spillReferencesByLocator.get(reference.ref.locator);
+						if (!mapped?.target) throw new SyncSessionError("spill-reference-missing", "目标 spill reference 未创建");
+						return {
+							...reference,
+							owner: { sessionId },
+							ref: mapped.target
+						};
+					})
+				};
+			} else if (key === "text" && typeof child === "string") {
+				let text = child;
+				for (const { source, target } of spillReferencesByLocator.values()) {
+					if (!target) continue;
+					text = text.replaceAll(`Full formatted result stored at: ${source.ref.locator}. ${source.ref.retrievalHint}`, `Full formatted result stored at: ${target.locator}. ${target.retrievalHint}`);
+				}
+				output[key] = text;
+			} else output[key] = rewrite(child);
+			return output;
+		};
+		return events.map((event) => snapshotSessionEvent(rewrite(structuredClone(event))));
+	}
+	validatePrepared(value) {
+		if (!isRecord$1(value) || !isRecord$1(value.metadata) || value.metadata.kind !== "session" || typeof value.localSessionId !== "string" || !isRecord$1(value.header) || value.header.id !== value.localSessionId || typeof value.workspaceId !== "string" || typeof value.workspacePath !== "string" || !Array.isArray(value.events) || typeof value.workspacePosition !== "number" || typeof value.archived !== "boolean" || typeof value.pinned !== "boolean" || typeof value.sourceName !== "string" || value.importedVia !== "peer" && value.importedVia !== "offline") throw new SyncSessionError("journal-invalid", "prepared session record is invalid");
+		const header = value.header;
+		if (header.version !== 4) throw new SyncSessionError("session-format", "prepared session format is unsupported");
+		const events = validateStoredEvents(header, structuredClone(value.events));
+		assertContiguous(header.id, events, 0);
+		if (!Number.isSafeInteger(value.workspacePosition) || value.workspacePosition < 0 || typeof value.inheritedEventCount !== "number" || !Number.isSafeInteger(value.inheritedEventCount) || value.inheritedEventCount < 0 || !isRecord$1(value.workspace)) throw new SyncSessionError("journal-invalid", "prepared session metadata is invalid");
+		return {
+			metadata: value.metadata,
+			...typeof value.branchId === "string" ? { branchId: value.branchId } : {},
+			localSessionId: SessionId(value.localSessionId),
+			header,
+			inheritedEventCount: value.inheritedEventCount,
+			events: [...events],
+			workspaceId: value.workspaceId,
+			workspacePath: value.workspacePath,
+			workspace: value.workspace,
+			workspacePosition: value.workspacePosition,
+			archived: value.archived,
+			pinned: value.pinned,
+			sourceName: value.sourceName,
+			importedVia: value.importedVia,
+			...isRecord$1(value.instructionSnapshot) ? { instructionSnapshot: value.instructionSnapshot } : {}
+		};
+	}
+	async applyPrepared(prepared) {
+		const sessionId = prepared.localSessionId;
+		const existed = await this.writeSession(prepared);
+		if (prepared.instructionSnapshot) this.instructions.restore(prepared.instructionSnapshot);
+		const registry = this.getWorkspaces();
+		const workspace = registry?.get(prepared.workspaceId);
+		if (!registry || !workspace || normalize(workspace.path) !== normalize(prepared.workspacePath)) throw new SyncSessionError("workspace-unmapped", "导入 session 的目标工作区不可用");
+		await workspace.attachSession(sessionId);
+		if (prepared.archived) await registry.archiveSession(sessionId, { stopActivity: true });
+		else await registry.unarchiveSession(sessionId);
+		if (prepared.pinned && !prepared.archived) await registry.pinSession?.(sessionId);
+		else await registry.unpinSession?.(sessionId);
+		this.state.observeRevision(prepared.metadata.revision, this.now());
+		const binding = this.bindings.list().find((item) => normalize(item.mirrorPath) === normalize(prepared.workspacePath));
+		if (!binding) throw new SyncSessionError("workspace-unmapped", "导入 session 的节点绑定不可用");
+		const activeMetadata = {
+			...prepared.metadata,
+			localEntityId: String(sessionId),
+			importedVia: prepared.importedVia,
+			sourceName: prepared.sourceName,
+			stateDigest: prepared.metadata.stateDigest ?? sessionStateDigest(prepared.workspace, prepared.workspacePosition, prepared.archived, prepared.pinned),
+			workspaceOrigin: {
+				originInstanceId: prepared.workspace.originInstanceId,
+				originEntityId: prepared.workspace.originWorkspaceId
+			},
+			deleted: false,
+			pendingRemoval: false
+		};
+		const key = sessionOriginKey(prepared.metadata);
+		this.state.update((state) => {
+			const mappingKey = syncWorkspaceKey(prepared.workspace.originInstanceId, prepared.workspace.originWorkspaceId, prepared.workspace.remotePath);
+			state.workspaces[mappingKey] = {
+				...prepared.workspace,
+				localWorkspaceId: prepared.workspaceId,
+				localPath: prepared.workspacePath,
+				localNodeId: binding.nodeId
+			};
+			if (prepared.branchId) state.archives[prepared.branchId] = {
+				branchId: prepared.branchId,
+				originInstanceId: prepared.metadata.originInstanceId,
+				originSessionId: prepared.metadata.originEntityId,
+				localSessionId: String(sessionId),
+				revision: prepared.metadata.revision,
+				contentDigest: prepared.metadata.contentDigest,
+				stateDigest: prepared.metadata.stateDigest ?? sessionStateDigest(prepared.workspace, prepared.workspacePosition, true, false),
+				workspacePosition: prepared.workspacePosition,
+				workspaceId: prepared.workspaceId,
+				workspaceOrigin: {
+					originInstanceId: prepared.workspace.originInstanceId,
+					originEntityId: prepared.workspace.originWorkspaceId
+				},
+				archivedAt: new Date(this.now()).toISOString()
+			};
+			else state.records[key] = activeMetadata;
+		});
+		return existed;
+	}
+	async applyMembershipOnly(entry, current, sourceName, workspace, importedVia) {
+		const descriptor = entry.workspace;
+		const stateDigest = entry.metadata.stateDigest;
+		if (!descriptor || !stateDigest) throw new SyncSessionError("manifest-invalid", "session state entry is incomplete");
+		const registry = this.getWorkspaces();
+		if (!registry) throw new SyncSessionError("workspace-unavailable", "工作区注册表不可用");
+		const sessionId = SessionId(current.localEntityId);
+		const snapshot = await this.requirePersistence().stat(sessionId);
+		if (!snapshot || normalize(snapshot.header.cwd ?? "") !== normalize(workspace.path)) throw new SyncSessionError("session-workspace-mismatch", "既有 session 的本地 cwd 与目标 workspace 不一致");
+		await workspace.attachSession(sessionId);
+		if (entry.archived) await registry.archiveSession(sessionId, { stopActivity: true });
+		else await registry.unarchiveSession(sessionId);
+		if (entry.pinned && !entry.archived) await registry.pinSession?.(sessionId);
+		else await registry.unpinSession?.(sessionId);
+		if (entry.instructionSnapshot) {
+			const inheritedFromSessionId = entry.parentOrigin ? this.localSessionIdForOrigin(entry.parentOrigin) : void 0;
+			const instructionWorkspaceId = entry.instructionSnapshot.workspaceOrigin ? this.localWorkspaceIdForOrigin(entry.instructionSnapshot.workspaceOrigin, entry.instructionSnapshot.workspaceRemotePath) : void 0;
+			const snapshot = {
+				sessionId,
+				...instructionWorkspaceId ? { workspaceId: instructionWorkspaceId } : {},
+				...entry.instructionSnapshot.workspaceRevision === void 0 ? {} : { workspaceRevision: entry.instructionSnapshot.workspaceRevision },
+				...entry.instructionSnapshot.digest === void 0 ? {} : { digest: entry.instructionSnapshot.digest },
+				text: entry.instructionSnapshot.text,
+				capturedAt: entry.instructionSnapshot.capturedAt,
+				...inheritedFromSessionId ? { inheritedFromSessionId } : {}
+			};
+			this.instructions.restore(snapshot);
+		}
+		this.state.observeRevision(entry.metadata.revision, this.now());
+		const metadata = {
+			...entry.metadata,
+			localEntityId: current.localEntityId,
+			importedVia,
+			sourceName,
+			stateDigest,
+			deleted: false,
+			pendingRemoval: false,
+			workspaceOrigin: {
+				originInstanceId: descriptor.originInstanceId,
+				originEntityId: descriptor.originWorkspaceId
+			}
+		};
+		this.state.update((state) => {
+			state.records[sessionOriginKey(metadata)] = metadata;
+		});
+	}
+	async applyArchiveStateOnly(entry, current, workspace) {
+		const branchId = entry.branchId;
+		const descriptor = entry.workspace;
+		const stateDigest = entry.metadata.stateDigest;
+		if (!branchId || !descriptor || !stateDigest) throw new SyncSessionError("manifest-invalid", "archive state entry is incomplete");
+		const registry = this.getWorkspaces();
+		if (!registry) throw new SyncSessionError("workspace-unavailable", "工作区注册表不可用");
+		const sessionId = SessionId(current.localSessionId);
+		const snapshot = await this.requirePersistence().stat(sessionId);
+		if (!snapshot || normalize(snapshot.header.cwd ?? "") !== normalize(workspace.path)) throw new SyncSessionError("session-workspace-mismatch", "归档 session 的本地 cwd 与目标 workspace 不一致");
+		await workspace.attachSession(sessionId);
+		await registry.archiveSession(sessionId, { stopActivity: true });
+		await registry.unpinSession?.(sessionId);
+		this.state.observeRevision(entry.metadata.revision, this.now());
+		this.state.update((state) => {
+			state.archives[branchId] = {
+				...current,
+				revision: entry.metadata.revision,
+				stateDigest,
+				workspacePosition: entry.workspacePosition ?? current.workspacePosition,
+				workspaceId: workspace.id,
+				workspaceOrigin: {
+					originInstanceId: descriptor.originInstanceId,
+					originEntityId: descriptor.originWorkspaceId
+				}
+			};
+		});
+	}
+	async archiveCurrent(metadata) {
+		if (metadata.deleted || metadata.kind !== "session") return void 0;
+		const branchId = branchIdFor(metadata);
+		if (this.state.read().archives[branchId]) return branchId;
+		const sessionId = SessionId(metadata.localEntityId);
+		const persistence = this.requirePersistence();
+		if (!await persistence.stat(sessionId)) return void 0;
+		await persistence.flush();
+		const registry = this.getWorkspaces();
+		if (!registry) throw new SyncSessionError("workspace-unavailable", "工作区注册表不可用");
+		const workspace = registry?.list().find((candidate) => candidate.sessionIds.some((id) => String(id) === String(sessionId)));
+		const binding = workspace ? this.bindings.list().find((item) => normalize(item.mirrorPath) === normalize(workspace.path)) : void 0;
+		const nodeOrigin = binding ? this.nodes.originForLocalNode(binding.nodeId) : void 0;
+		const descriptor = workspace && binding && nodeOrigin ? this.workspaceDescriptor(workspace, binding, nodeOrigin, metadata.workspaceOrigin) : void 0;
+		const workspacePosition = workspace?.sessionIds.findIndex((id) => String(id) === String(sessionId)) ?? 0;
+		await registry.archiveSession(sessionId, { stopActivity: true });
+		await persistence.flush();
+		this.state.update((draft) => {
+			draft.archives[branchId] = {
+				branchId,
+				originInstanceId: metadata.originInstanceId,
+				originSessionId: metadata.originEntityId,
+				localSessionId: String(sessionId),
+				revision: metadata.revision,
+				contentDigest: metadata.contentDigest,
+				stateDigest: descriptor ? sessionStateDigest(descriptor, Math.max(0, workspacePosition), true, false) : metadata.stateDigest ?? metadata.contentDigest,
+				workspacePosition: Math.max(0, workspacePosition),
+				...workspace ? { workspaceId: workspace.id } : {},
+				...descriptor ? { workspaceOrigin: {
+					originInstanceId: descriptor.originInstanceId,
+					originEntityId: descriptor.originWorkspaceId
+				} } : metadata.workspaceOrigin ? { workspaceOrigin: metadata.workspaceOrigin } : {},
+				archivedAt: new Date(this.now()).toISOString()
+			};
+		});
+		return branchId;
+	}
+	async applyTombstone(metadata) {
+		const key = sessionOriginKey(metadata);
+		const current = this.state.read().records[key];
+		if (current) {
+			const comparison = compareSyncRevision(metadata.revision, current.revision);
+			if (comparison < 0) return false;
+			if (comparison === 0) {
+				if (metadata.contentDigest !== current.contentDigest || !current.deleted) throw new SyncSessionError("revision-conflict", "Equal session revisions contain different tombstone state");
+				return false;
+			}
+			if (!current.deleted) await this.archiveCurrent(current);
+		}
+		const localEntityId = current?.localEntityId ?? String(importedSessionId(metadata));
+		const tombstone = {
+			...metadata,
+			kind: "session",
+			localEntityId,
+			deleted: true
+		};
+		this.state.observeRevision(metadata.revision, this.now());
+		this.state.update((state) => {
+			state.records[key] = tombstone;
+		});
+		return true;
+	}
+	async restoreArchiveNow(branchId) {
+		if (!/^b-[a-f0-9]{32}$/.test(branchId)) throw new SyncSessionError("archive-not-found", "会话归档不存在");
+		const archive = this.state.read().archives[branchId];
+		if (!archive) throw new SyncSessionError("archive-not-found", "会话归档不存在");
+		const registry = this.getWorkspaces();
+		const sessionId = SessionId(archive.localSessionId);
+		const session = await this.requirePersistence().stat(sessionId);
+		if (!registry || !session) throw new SyncSessionError("archive-not-found", "会话归档日志不存在");
+		const key = syncRecordKey("session", {
+			originInstanceId: archive.originInstanceId,
+			originEntityId: archive.originSessionId
+		});
+		const current = this.state.read().records[key];
+		if (current && !current.deleted && current.localEntityId !== archive.localSessionId) await this.archiveCurrent(current);
+		await registry.unarchiveSession(sessionId);
+		const revision = this.state.nextRevision(this.now());
+		const restored = {
+			kind: "session",
+			originInstanceId: archive.originInstanceId,
+			originEntityId: archive.originSessionId,
+			localEntityId: archive.localSessionId,
+			revision,
+			contentDigest: archive.contentDigest,
+			stateDigest: archive.stateDigest,
+			importedVia: "peer",
+			...archive.workspaceOrigin ? { workspaceOrigin: archive.workspaceOrigin } : {}
+		};
+		this.state.update((state) => {
+			delete state.archives[branchId];
+			state.records[key] = restored;
+		});
+		return sessionId;
+	}
+	async orderWorkspaceSessions(orders) {
+		const registry = this.getWorkspaces();
+		if (!registry) return;
+		for (const [workspaceId, incoming] of orders) {
+			const workspace = registry.get(workspaceId);
+			if (!workspace) continue;
+			const current = [...workspace.sessionIds];
+			const incomingIds = new Set(incoming.map((item) => String(item.id)));
+			const target = [...[...incoming].sort((a, b) => a.position - b.position || String(a.id).localeCompare(String(b.id))).map((item) => item.id).filter((id, index, all) => current.some((existing) => String(existing) === String(id)) && all.findIndex((candidate) => String(candidate) === String(id)) === index), ...current.filter((id) => !incomingIds.has(String(id)))];
+			if (target.length === current.length && target.every((id, index) => String(id) === String(current[index]))) continue;
+			let before;
+			for (const id of target.reverse()) {
+				await workspace.insertSessionBefore(id, before);
+				before = id;
+			}
+		}
+	}
+	localSessionIdForOrigin(origin) {
+		const state = this.state.read();
+		const active = state.records[syncRecordKey("session", origin)];
+		if (active && !active.deleted) return SessionId(active.localEntityId);
+		const archive = Object.values(state.archives).filter((entry) => entry.originInstanceId === origin.originInstanceId && entry.originSessionId === origin.originEntityId).sort((a, b) => compareSyncRevision(b.revision, a.revision))[0];
+		return archive ? SessionId(archive.localSessionId) : void 0;
+	}
+	localWorkspaceIdForOrigin(origin, remotePath) {
+		const mappings = Object.values(this.state.read().workspaces).filter((mapping) => mapping.originInstanceId === origin.originInstanceId && mapping.originWorkspaceId === origin.originEntityId && (remotePath === void 0 || mapping.remotePath === remotePath));
+		return mappings.length === 1 ? mappings[0]?.localWorkspaceId : void 0;
+	}
+	async writeSession(prepared) {
+		const persistence = this.requirePersistence();
+		const existed = await persistence.stat(prepared.localSessionId);
+		const handle = existed ? await persistence.open(prepared.localSessionId, "write") : await persistence.create(prepared.header, prepared.header.isSeeded ? { inheritedEventCount: prepared.inheritedEventCount } : void 0);
+		try {
+			if (canonicalJson(handle.header) !== canonicalJson(prepared.header) || handle.inheritedEventCount !== prepared.inheritedEventCount) throw new SyncSessionError("session-id-conflict", "目标 session ID 已被其他 header 占用");
+			const existing = [];
+			for (let offset = 0;;) {
+				const page = await handle.read(offset, SESSION_READ_PAGE_SIZE);
+				if (page.events.length === 0) break;
+				existing.push(...page.events);
+				offset += page.events.length;
+				if (page.events.length < SESSION_READ_PAGE_SIZE) break;
+			}
+			if (existing.length > prepared.events.length) throw new SyncSessionError("session-prefix-conflict", `目标 session ${prepared.localSessionId} 前缀比导入记录更长（本地 ${existing.length}，导入 ${prepared.events.length}）`);
+			for (let index = 0; index < existing.length; index += 1) if (canonicalJson(existing[index]) !== canonicalJson(prepared.events[index])) throw new SyncSessionError("session-prefix-conflict", `目标 session ${prepared.localSessionId} 的已提交事件与导入前缀不同（首个差异位置 seq=${existing[index]?.seq}，本地 ${existing.length} 事件，导入 ${prepared.events.length} 事件）`);
+			for (let offset = existing.length; offset < prepared.events.length; offset += SESSION_READ_PAGE_SIZE) await handle.append(prepared.events.slice(offset, Math.min(offset + SESSION_READ_PAGE_SIZE, prepared.events.length)));
+			await handle.flush();
+		} finally {
+			await handle.close();
+		}
+		return existed !== void 0;
+	}
+	workspaceDescriptor(workspace, binding, nodeOrigin, preferredOrigin) {
+		const state = this.state.read();
+		const matchingMappings = Object.values(state.workspaces).filter((mapping) => mapping.localWorkspaceId === workspace.id && mapping.localNodeId === binding.nodeId && posix.normalize(mapping.remotePath) === posix.normalize(binding.remotePath));
+		const prior = (preferredOrigin ? Object.values(state.workspaces).find((mapping) => mapping.originInstanceId === preferredOrigin.originInstanceId && mapping.originWorkspaceId === preferredOrigin.originEntityId && mapping.localWorkspaceId === workspace.id && mapping.localNodeId === binding.nodeId) : void 0) ?? (matchingMappings.length === 1 ? matchingMappings[0] : void 0);
+		const originInstanceId = preferredOrigin?.originInstanceId ?? prior?.originInstanceId ?? this.state.instanceId();
+		const originWorkspaceId = preferredOrigin?.originEntityId ?? prior?.originWorkspaceId ?? workspace.id;
+		const base = {
+			originInstanceId,
+			originWorkspaceId,
+			nodeOrigin,
+			remotePath: posix.normalize(binding.remotePath),
+			title: workspace.title
+		};
+		const digest = workspaceDigest(base);
+		const key = syncWorkspaceKey(originInstanceId, originWorkspaceId, base.remotePath);
+		const current = state.workspaces[key];
+		const revision = current && current.contentDigest === digest ? current.revision : this.state.nextRevision(this.now());
+		const mapping = {
+			...base,
+			localWorkspaceId: workspace.id,
+			localPath: workspace.path,
+			localNodeId: binding.nodeId,
+			revision,
+			contentDigest: digest
+		};
+		this.state.update((draft) => {
+			draft.workspaces[key] = mapping;
+		});
+		return {
+			...base,
+			revision,
+			contentDigest: digest
+		};
+	}
+	async exportSessionEntry(persistence, workspace, descriptor, workspacePosition, sessionId, firstSnapshot, archived, pinned, archive) {
+		const { header, inheritedEventCount, events } = await this.readStableSession(persistence, sessionId, firstSnapshot);
+		if (!header.cwd || posix.normalize(header.cwd) !== posix.normalize(workspace.path)) return void 0;
+		const localSessionId = String(sessionId);
+		const state = this.state.read();
+		const parentOrigin = header.parentSession ? findSessionOriginByLocalId(state, String(header.parentSession)) : void 0;
+		const syncInstructions = instructionsForSession(this.instructions, String(sessionId), state, {
+			originInstanceId: descriptor.originInstanceId,
+			originEntityId: descriptor.originWorkspaceId
+		});
+		const objects = await this.exportObjects(events, localSessionId);
+		const digest = sessionEventDigest(header, inheritedEventCount, events, descriptor, syncInstructions, objects, parentOrigin);
+		const current = archive ? void 0 : findSessionRecordByLocalId(state, localSessionId) ?? state.records[syncRecordKey("session", {
+			originInstanceId: this.state.instanceId(),
+			originEntityId: localSessionId
+		})];
+		const originInstanceId = archive?.originInstanceId ?? current?.originInstanceId ?? this.state.instanceId();
+		const originEntityId = archive?.originSessionId ?? current?.originEntityId ?? localSessionId;
+		const workspaceOrigin = {
+			originInstanceId: descriptor.originInstanceId,
+			originEntityId: descriptor.originWorkspaceId
+		};
+		const workspaceOriginChanged = Boolean(current?.workspaceOrigin && (current.workspaceOrigin.originInstanceId !== workspaceOrigin.originInstanceId || current.workspaceOrigin.originEntityId !== workspaceOrigin.originEntityId));
+		const stateDigest = sessionStateDigest(descriptor, workspacePosition, archived, pinned);
+		const sessionStateChanged = Boolean(current && current.stateDigest !== stateDigest);
+		let revision = archive?.revision ?? current?.revision;
+		let contentDigest = digest;
+		let outputBranchId = archive?.branchId;
+		if (archive) {
+			if (archive.contentDigest !== digest || archive.stateDigest !== stateDigest || archive.workspacePosition !== workspacePosition) {
+				const nextRevision = this.state.nextRevision(this.now());
+				revision = nextRevision;
+				const branchId = archive.contentDigest !== digest ? branchIdFor({
+					originInstanceId,
+					originEntityId,
+					revision: nextRevision,
+					contentDigest: digest
+				}) : archive.branchId;
+				const updatedArchive = {
+					...archive,
+					branchId,
+					revision: nextRevision,
+					contentDigest: digest,
+					stateDigest,
+					workspacePosition,
+					workspaceOrigin
+				};
+				this.state.update((draft) => {
+					delete draft.archives[archive.branchId];
+					draft.archives[branchId] = updatedArchive;
+				});
+				outputBranchId = branchId;
+			} else contentDigest = archive.contentDigest;
+		} else if (!current || current.contentDigest !== digest || current.deleted || workspaceOriginChanged || !current.workspaceOrigin || sessionStateChanged) revision = this.state.nextRevision(this.now());
+		const metadata = {
+			kind: "session",
+			originInstanceId,
+			originEntityId,
+			localEntityId: localSessionId,
+			revision: revision ?? this.state.nextRevision(this.now()),
+			contentDigest,
+			stateDigest,
+			workspaceOrigin,
+			...archive ? {} : current?.importedVia ? { importedVia: current.importedVia } : {},
+			...archive ? {} : current?.sourceName ? { sourceName: current.sourceName } : {}
+		};
+		if (!archive && (!current || current.contentDigest !== digest || current.deleted || workspaceOriginChanged || !current.workspaceOrigin || sessionStateChanged)) this.state.update((draft) => {
+			draft.records[sessionOriginKey(metadata)] = metadata;
+		});
+		return {
+			metadata,
+			...outputBranchId ? { branchId: outputBranchId } : {},
+			sourceLocalSessionId: localSessionId,
+			header,
+			inheritedEventCount,
+			...parentOrigin ? { parentOrigin } : {},
+			workspace: descriptor,
+			workspacePosition,
+			archived,
+			pinned,
+			...syncInstructions ? { instructionSnapshot: syncInstructions } : {},
+			events: [...events],
+			objects
+		};
+	}
+	async readStableSession(persistence, sessionId, firstSnapshot) {
+		let snapshot = firstSnapshot;
+		for (let attempt = 0; attempt < 2; attempt += 1) {
+			if (snapshot.formatStatus === "migration-required") throw new SyncSessionError("session-format", "会话格式需要由当前 DSH 版本迁移");
+			const handle = await persistence.open(sessionId, "read");
+			try {
+				const events = [];
+				let offset = 0;
+				for (;;) {
+					const page = await handle.read(offset, SESSION_READ_PAGE_SIZE);
+					if (page.events.length === 0) break;
+					events.push(...structuredClone(page.events));
+					offset += page.events.length;
+					if (events.length > MAX_SYNC_SESSIONS * 100) throw new SyncSessionError("session-too-large", "会话事件数超过限制");
+					if (page.events.length < SESSION_READ_PAGE_SIZE) break;
+				}
+				const validated = validateStoredEvents(handle.header, events);
+				assertContiguous(sessionId, validated, 0);
+				const after = await persistence.stat(sessionId);
+				if (!after) throw new SyncSessionError("session-missing", "会话在导出期间消失");
+				if (JSON.stringify(snapshot.revision) === JSON.stringify(after.revision)) return {
+					header: handle.header,
+					inheritedEventCount: Number(handle.inheritedEventCount),
+					events: [...validated]
+				};
+				snapshot = after;
+			} finally {
+				await handle.close();
+			}
+		}
+		throw new SyncSessionError("session-changing", "会话在导出期间持续变化，请稍后重试");
+	}
+	async exportObjects(events, sessionId) {
+		const attachments = attachmentReferences(events);
+		const spills = spillReferences(events);
+		const structuredSpills = new Set(spills.map(spillKey));
+		for (const reference of legacySpillReferences(events, sessionId)) if (!structuredSpills.has(spillKey(reference))) spills.push(reference);
+		const payloads = /* @__PURE__ */ new Map();
+		const attachmentStore = attachments.images.length + attachments.files.length > 0 ? this.getAttachments() : void 0;
+		if (attachments.images.length + attachments.files.length > 0 && !attachmentStore) throw new SyncSessionError("attachments-unavailable", "附件存储服务不可用");
+		for (const ref of attachments.images) {
+			const stored = await attachmentStore.readImage(ref);
+			const digest = sha256(stored.data);
+			payloads.set(attachmentKey("image", ref), {
+				id: attachmentKey("image", ref),
+				kind: "image",
+				ref: stored.ref,
+				bytes: stored.data.byteLength,
+				digest,
+				data: Buffer.from(stored.data).toString("base64")
+			});
+		}
+		for (const ref of attachments.files) {
+			const data = await collectBytes(attachmentStore.readFileStream(ref));
+			payloads.set(attachmentKey("file", ref), {
+				id: attachmentKey("file", ref),
+				kind: "file",
+				ref,
+				bytes: data.byteLength,
+				digest: sha256(data),
+				data: data.toString("base64")
+			});
+		}
+		if (spills.length > 0) {
+			const store = this.getSpills();
+			const untransferred = [];
+			for (const reference of spills) {
+				if (!store) {
+					untransferred.push(reference);
+					continue;
+				}
+				try {
+					const data = await collectBytes(readSpillStream(store, reference));
+					if (reference.ref.bytes !== void 0 && data.byteLength !== reference.ref.bytes) {
+						untransferred.push(reference);
+						continue;
+					}
+					try {
+						new TextDecoder("utf-8", { fatal: true }).decode(data);
+					} catch {
+						untransferred.push(reference);
+						continue;
+					}
+					const key = spillKey(reference);
+					payloads.set(key, {
+						id: key,
+						kind: "spill",
+						reference,
+						bytes: data.byteLength,
+						digest: sha256(data),
+						data: data.toString("base64")
+					});
+				} catch {
+					untransferred.push(reference);
+				}
+			}
+			for (const reference of untransferred) {
+				const key = spillKey(reference);
+				payloads.set(key, {
+					id: key,
+					kind: "spill",
+					reference,
+					bytes: 0,
+					digest: sha256(Buffer.alloc(0)),
+					data: "",
+					unavailable: true
+				});
+			}
+		}
+		return [...payloads.values()];
+	}
+	requirePersistence() {
+		const persistence = this.getPersistence();
+		if (!persistence) throw new SyncSessionError("session-persistence-unavailable", "会话持久化服务不可用");
+		return persistence;
+	}
+	serializeMutation(operation) {
+		const result = this.operationTail.then(operation);
+		this.operationTail = result.then(() => void 0, () => void 0);
+		return result;
+	}
+};
+//#endregion
+export { validateSyncSessionBundle as a, planSessionTransfers as i, SyncSessionService as n, makeSyncSessionBundle as r, SyncSessionError as t };
+
+//# sourceMappingURL=session-sync-EdfwUON5.js.map