@askdkc/kiokuko 0.1.17 → 0.1.19

package/dist/memory/revisions.js

@@ -1,16 +1,272 @@
 import { KiokukoError } from '../errors.js';
-import { canonicalContentHash, canonicalJson, requireWorkspace, validateRecordInput, } from '../serialization/validate.js';
-function parseObject(value, field) {
+import { canonicalContentHash, canonicalEntryRevisionContentHash, canonicalJson, ENTRY_STATUSES, requireWorkspace, TRUST_LEVELS, validateRecordInput, } from '../serialization/validate.js';
+import { buildStructuredScope, } from './structured-memory.js';
+const SQLITE_CONSTRAINT_PRIMARY_KEY = 1_555;
+const SQLITE_CONSTRAINT_UNIQUE = 2_067;
+const REVISION_UNIQUENESS_FAILURES = new Set([
+    'UNIQUE constraint failed: entry_revisions.entry_id, entry_revisions.revision',
+    'UNIQUE constraint failed: entry_revisions.workspace, entry_revisions.content_hash',
+]);
+function isExpectedRevisionConflict(error) {
+    if (!(error instanceof Error))
+        return false;
+    const failure = error;
+    return failure.code === 'ERR_SQLITE_ERROR'
+        && (failure.errcode === SQLITE_CONSTRAINT_PRIMARY_KEY || failure.errcode === SQLITE_CONSTRAINT_UNIQUE)
+        && REVISION_UNIQUENESS_FAILURES.has(failure.message);
+}
+function storedIntegrity() {
+    throw new KiokukoError('INTEGRITY_ERROR', 'Stored entry or revision is invalid');
+}
+function isPlainObject(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function hasOwn(value, field) {
+    return Object.prototype.hasOwnProperty.call(value, field);
+}
+function storedNonEmptyString(value) {
+    if (typeof value !== 'string' || value.trim().length === 0)
+        storedIntegrity();
+    return value;
+}
+function canonicalTimestamp(value) {
+    if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u.test(value))
+        return false;
+    const milliseconds = Date.parse(value);
+    return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === value;
+}
+function parseStoredObject(value) {
+    if (typeof value !== 'string')
+        storedIntegrity();
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch (error) {
+        if (error instanceof SyntaxError)
+            storedIntegrity();
+        throw error;
+    }
+    if (!isPlainObject(parsed))
+        storedIntegrity();
+    try {
+        if (canonicalJson(parsed) !== value)
+            storedIntegrity();
+    }
+    catch (error) {
+        if (error instanceof KiokukoError && error.code === 'VALIDATION_ERROR')
+            storedIntegrity();
+        throw error;
+    }
+    return parsed;
+}
+function exactLegacyFrameworkOrder(scope, normalized) {
+    if (!isPlainObject(scope.applicability) || !isPlainObject(normalized.applicability))
+        return false;
+    const storedFrameworks = scope.applicability.frameworks;
+    const normalizedFrameworks = normalized.applicability.frameworks;
+    if (!Array.isArray(storedFrameworks) || !Array.isArray(normalizedFrameworks)
+        || storedFrameworks.length !== normalizedFrameworks.length)
+        return false;
+    let storedMembers;
+    let normalizedMembers;
+    try {
+        storedMembers = storedFrameworks.map((framework) => canonicalJson(framework));
+        normalizedMembers = normalizedFrameworks.map((framework) => canonicalJson(framework));
+    }
+    catch (error) {
+        if (error instanceof KiokukoError && error.code === 'VALIDATION_ERROR')
+            return false;
+        throw error;
+    }
+    const sortedStoredMembers = [...storedMembers].sort();
+    const sortedNormalizedMembers = [...normalizedMembers].sort();
+    if (new Set(storedMembers).size !== storedMembers.length
+        || new Set(normalizedMembers).size !== normalizedMembers.length
+        || sortedStoredMembers.some((member, index) => member !== sortedNormalizedMembers[index]))
+        return false;
+    const reconstructed = {
+        ...normalized,
+        applicability: { ...normalized.applicability, frameworks: storedFrameworks },
+    };
+    return canonicalJson(reconstructed) === canonicalJson(scope);
+}
+/** Normalize caller-supplied structured scope before it is persisted. */
+export function normalizeStructuredScopeInput(scope) {
+    if (!hasOwn(scope, 'schemaVersion')) {
+        return scope;
+    }
+    const allowed = new Set([
+        'schemaVersion', 'visibility', 'retrievalScope', 'repositoryId', 'memoryClass',
+        'applicability', 'signals', 'portableReason',
+    ]);
+    if (Object.keys(scope).some((field) => !allowed.has(field))) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Structured memory scope contains an unknown field');
+    }
+    if (scope.schemaVersion !== 2 && scope.schemaVersion !== 3) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Structured memory scope schemaVersion is unsupported');
+    }
+    const schemaVersion = scope.schemaVersion;
+    if (schemaVersion === 2 && hasOwn(scope, 'retrievalScope')) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Structured memory scope schemaVersion 2 cannot contain retrievalScope');
+    }
+    let normalized = buildStructuredScope({
+        visibility: scope.visibility,
+        ...(schemaVersion === 3 && hasOwn(scope, 'retrievalScope') ? { retrievalScope: scope.retrievalScope } : {}),
+        ...(hasOwn(scope, 'repositoryId') ? { repositoryId: scope.repositoryId } : {}),
+        ...(hasOwn(scope, 'memoryClass') ? { memoryClass: scope.memoryClass } : {}),
+        ...(hasOwn(scope, 'applicability') ? { applicability: scope.applicability } : {}),
+        ...(hasOwn(scope, 'signals') ? { signals: scope.signals } : {}),
+        ...(hasOwn(scope, 'portableReason') ? { portableReason: scope.portableReason } : {}),
+    });
+    if (schemaVersion === 2)
+        normalized = { ...normalized, schemaVersion: 2 };
+    return normalized;
+}
+function normalizeStoredStructuredScope(scope, required) {
+    if (required && scope.schemaVersion !== 3)
+        storedIntegrity();
     try {
-        const parsed = JSON.parse(value);
-        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
-            throw new Error('not object');
-        return parsed;
+        return normalizeStructuredScopeInput(scope);
     }
-    catch {
-        throw new KiokukoError('INTEGRITY_ERROR', `Stored ${field} is not valid JSON`);
+    catch (error) {
+        if (error instanceof KiokukoError && (error.code === 'VALIDATION_ERROR' || error.code === 'SECURITY_REJECTION'))
+            storedIntegrity();
+        throw error;
     }
 }
+/** Decode only the canonical persisted structured-scope representation. */
+export function decodeStoredStructuredScope(scope, required = false) {
+    const normalized = normalizeStoredStructuredScope(scope, required);
+    if (canonicalJson(normalized) !== canonicalJson(scope))
+        storedIntegrity();
+    return { scope: normalized, canonicalScope: normalized };
+}
+function decodeMigratableStoredStructuredScope(scope) {
+    const normalized = normalizeStoredStructuredScope(scope, false);
+    if (canonicalJson(normalized) !== canonicalJson(scope) && !exactLegacyFrameworkOrder(scope, normalized))
+        storedIntegrity();
+    return { scope: normalized, canonicalScope: normalized, persistedScope: scope };
+}
+function normalizedStoredRecord(input, tags, options) {
+    const entryId = storedNonEmptyString(input.entryId);
+    const createdBy = storedNonEmptyString(input.createdBy);
+    const createdAt = storedNonEmptyString(input.createdAt);
+    if (!canonicalTimestamp(createdAt)
+        || !Number.isSafeInteger(input.revision) || Number(input.revision) < 1
+        || input.summary !== null && typeof input.summary !== 'string'
+        || !Array.isArray(tags))
+        storedIntegrity();
+    const decodedScope = decodeStoredStructuredScope(parseStoredObject(input.scopeJson), options.requireStructuredScope === true);
+    const scope = decodedScope.canonicalScope;
+    const provenance = parseStoredObject(input.provenanceJson);
+    let validated;
+    try {
+        validated = validateRecordInput({
+            workspace: input.workspace,
+            kind: input.kind,
+            status: 'candidate',
+            title: input.title,
+            body: input.body,
+            summary: input.summary,
+            scope,
+            provenance,
+            trustLevel: 'user_asserted',
+            confidence: 1,
+            tags,
+            createdBy,
+            actor: createdBy,
+        });
+    }
+    catch (error) {
+        if (error instanceof KiokukoError && (error.code === 'VALIDATION_ERROR' || error.code === 'SECURITY_REJECTION'))
+            storedIntegrity();
+        throw error;
+    }
+    if (validated.tags.length !== tags.length)
+        storedIntegrity();
+    const hashInput = {
+        kind: validated.kind,
+        title: validated.title,
+        body: validated.body,
+        summary: validated.summary,
+        scope: validated.scope,
+        provenance: validated.provenance,
+        tags: validated.tags,
+    };
+    const contentHash = canonicalEntryRevisionContentHash(hashInput);
+    if (input.contentHash !== contentHash)
+        storedIntegrity();
+    return {
+        entryId,
+        workspace: validated.workspace,
+        revision: Number(input.revision),
+        kind: validated.kind,
+        title: validated.title,
+        body: validated.body,
+        summary: validated.summary,
+        scope: decodedScope.canonicalScope,
+        provenance: validated.provenance,
+        tags: validated.tags,
+        contentHash,
+        createdBy,
+        createdAt,
+    };
+}
+function decodedStoredEntry(input, revision) {
+    const id = storedNonEmptyString(input.id);
+    const workspace = storedNonEmptyString(input.workspace);
+    const createdBy = storedNonEmptyString(input.createdBy);
+    const createdAt = storedNonEmptyString(input.createdAt);
+    const updatedAt = storedNonEmptyString(input.updatedAt);
+    if (id !== revision.entryId || workspace !== revision.workspace
+        || !Number.isSafeInteger(input.currentRevision) || input.currentRevision !== revision.revision
+        || input.minRevision !== 1
+        || !Number.isSafeInteger(input.maxRevision) || input.currentRevision !== input.maxRevision
+        || !Number.isSafeInteger(input.revisionCount) || input.revisionCount !== input.maxRevision
+        || input.invalidRevisionCount !== 0
+        || typeof input.status !== 'string' || !ENTRY_STATUSES.includes(input.status)
+        || typeof input.trustLevel !== 'string' || !TRUST_LEVELS.includes(input.trustLevel)
+        || typeof input.confidence !== 'number' || !Number.isFinite(input.confidence) || input.confidence < 0 || input.confidence > 1
+        || input.supersededBy !== null && (typeof input.supersededBy !== 'string' || input.supersededBy.trim().length === 0)
+        || input.verifiedAt !== null && (typeof input.verifiedAt !== 'string' || input.verifiedAt.trim().length === 0))
+        storedIntegrity();
+    const status = input.status;
+    const supersededBy = input.supersededBy;
+    const verifiedAt = input.verifiedAt;
+    if ((status === 'superseded') !== (supersededBy !== null)
+        || status === 'candidate' && verifiedAt !== null
+        || status === 'verified' && verifiedAt === null
+        || !canonicalTimestamp(createdAt) || !canonicalTimestamp(updatedAt)
+        || verifiedAt !== null && !canonicalTimestamp(verifiedAt)
+        || createdAt > revision.createdAt || revision.createdAt > updatedAt
+        || createdAt > updatedAt
+        || verifiedAt !== null && (verifiedAt < createdAt || verifiedAt > updatedAt))
+        storedIntegrity();
+    return {
+        id,
+        workspace,
+        status,
+        trustLevel: input.trustLevel,
+        confidence: input.confidence,
+        currentRevision: input.currentRevision,
+        supersededBy,
+        createdBy,
+        createdAt,
+        updatedAt,
+        verifiedAt,
+    };
+}
+/** Decode persisted entry/revision data without trusting TypeScript row casts. */
+export function decodeStoredMemoryRow(input) {
+    const revision = normalizedStoredRecord(input.revision, input.tags, input.options ?? {});
+    if (input.entry === undefined)
+        return { revision };
+    return { revision, entry: decodedStoredEntry(input.entry, revision) };
+}
 function revisionKey(input) {
     if (typeof input.entryId !== 'string' || input.entryId.length === 0) {
         throw new KiokukoError('VALIDATION_ERROR', 'entryId must be a non-empty string');
@@ -20,37 +276,267 @@ function revisionKey(input) {
         throw new KiokukoError('VALIDATION_ERROR', 'revision must be a positive integer');
     }
 }
+function completeRevisionChain(row) {
+    return Number.isSafeInteger(row.current_revision)
+        && row.min_revision === 1
+        && Number.isSafeInteger(row.max_revision)
+        && row.current_revision === row.max_revision
+        && Number.isSafeInteger(row.revision_count)
+        && row.revision_count === row.max_revision
+        && row.invalid_revision_count === 0;
+}
+function ownerRevisionChain(database, entryId) {
+    return database.prepare(`
+    SELECT e.workspace, e.current_revision,
+           MIN(r.revision) AS min_revision,
+           MAX(r.revision) AS max_revision,
+           COUNT(r.revision) AS revision_count,
+           COUNT(CASE
+             WHEN r.revision IS NOT NULL
+              AND (typeof(r.revision) <> 'integer' OR r.revision < 1)
+             THEN 1
+           END) AS invalid_revision_count
+      FROM entries AS e
+      LEFT JOIN entry_revisions AS r ON r.entry_id = e.id
+     WHERE e.id = ?
+     GROUP BY e.id
+  `).get(entryId);
+}
+const REVISION_HASH_ALGORITHM = 'canonical-json-utf16-tags-v1';
+const REVISION_IMMUTABILITY_TRIGGER_SQL = `CREATE TRIGGER entry_revisions_immutable_update
+BEFORE UPDATE ON entry_revisions
+BEGIN
+    SELECT RAISE(ABORT, 'entry_revisions are immutable');
+END`;
+function migratableRevision(database, row) {
+    const entryId = storedNonEmptyString(row.entry_id);
+    const createdBy = storedNonEmptyString(row.created_by);
+    const createdAt = storedNonEmptyString(row.created_at);
+    if (!canonicalTimestamp(createdAt)
+        || !Number.isSafeInteger(row.revision) || Number(row.revision) < 1
+        || row.summary !== null && typeof row.summary !== 'string')
+        storedIntegrity();
+    const revision = Number(row.revision);
+    const owner = ownerRevisionChain(database, entryId);
+    if (owner === undefined || owner.workspace !== row.workspace || !completeRevisionChain(owner))
+        storedIntegrity();
+    const persistedScope = parseStoredObject(row.scope_json);
+    const decodedScope = decodeMigratableStoredStructuredScope(persistedScope);
+    const provenance = parseStoredObject(row.provenance_json);
+    const persistedTags = database
+        .prepare('SELECT tag FROM entry_revision_tags WHERE entry_id = ? AND revision = ? ORDER BY rowid ASC')
+        .all(entryId, revision)
+        .map((tag) => tag.tag);
+    let validated;
+    try {
+        validated = validateRecordInput({
+            workspace: row.workspace,
+            kind: row.kind,
+            status: 'candidate',
+            title: row.title,
+            body: row.body,
+            summary: row.summary,
+            scope: decodedScope.canonicalScope,
+            provenance,
+            trustLevel: 'user_asserted',
+            confidence: 1,
+            tags: persistedTags,
+            createdBy,
+            actor: createdBy,
+        });
+    }
+    catch (error) {
+        if (error instanceof KiokukoError && (error.code === 'VALIDATION_ERROR' || error.code === 'SECURITY_REJECTION'))
+            storedIntegrity();
+        throw error;
+    }
+    if (validated.tags.length !== persistedTags.length
+        || persistedTags.some((tag) => typeof tag !== 'string'))
+        storedIntegrity();
+    const hashInput = {
+        kind: validated.kind,
+        title: validated.title,
+        body: validated.body,
+        summary: validated.summary,
+        scope: validated.scope,
+        provenance: validated.provenance,
+        tags: validated.tags,
+    };
+    const canonicalHash = canonicalEntryRevisionContentHash(hashInput);
+    const previousHash = row.content_hash;
+    if (typeof previousHash !== 'string' || !/^[0-9a-f]{64}$/u.test(previousHash))
+        storedIntegrity();
+    if (previousHash !== canonicalHash) {
+        const legacyPayload = {
+            kind: hashInput.kind,
+            title: hashInput.title,
+            body: hashInput.body,
+            summary: hashInput.summary,
+            provenance: hashInput.provenance,
+            tags: persistedTags,
+        };
+        const canonicalScopeLegacyHash = canonicalContentHash({
+            ...legacyPayload,
+            scope: hashInput.scope,
+        });
+        const persistedScopeLegacyHash = canonicalContentHash({
+            ...legacyPayload,
+            scope: decodedScope.persistedScope,
+        });
+        if (previousHash !== canonicalScopeLegacyHash && previousHash !== persistedScopeLegacyHash)
+            storedIntegrity();
+    }
+    return {
+        entryId,
+        workspace: validated.workspace,
+        revision,
+        previousScopeJson: row.scope_json,
+        previousHash,
+        canonicalScopeJson: canonicalJson(validated.scope),
+        canonicalHash,
+    };
+}
+/**
+ * One-time migration operation for migration 009. This is the only place that
+ * recognizes the released locale-dependent hash preimage. The caller must own
+ * the migration transaction; any invalid preimage or canonical collision
+ * aborts the whole schema upgrade.
+ */
+export function canonicalizeEntryRevisionHashesInMigration(database) {
+    const formatTable = database.prepare(`
+    SELECT type
+      FROM sqlite_schema
+     WHERE name = 'entry_revision_hash_format'
+  `).get();
+    const existingFormat = formatTable?.type === 'table'
+        ? database.prepare('SELECT singleton, algorithm FROM entry_revision_hash_format').all()
+        : [];
+    if (formatTable?.type !== 'table' || existingFormat.length !== 0)
+        storedIntegrity();
+    const trigger = database.prepare(`
+    SELECT sql
+      FROM sqlite_schema
+     WHERE type = 'trigger' AND name = 'entry_revisions_immutable_update'
+  `).get();
+    if (trigger?.sql !== REVISION_IMMUTABILITY_TRIGGER_SQL)
+        storedIntegrity();
+    const rows = database.prepare(`
+    SELECT entry_id, workspace, revision, kind, title, body, summary,
+           scope_json, provenance_json, content_hash, created_by, created_at
+      FROM entry_revisions
+     ORDER BY entry_id, revision
+  `).all();
+    const entries = database.prepare('SELECT id, workspace FROM entries ORDER BY id')
+        .all();
+    for (const entry of entries) {
+        const entryId = storedNonEmptyString(entry.id);
+        const workspace = storedNonEmptyString(entry.workspace);
+        const owner = ownerRevisionChain(database, entryId);
+        if (owner === undefined || owner.workspace !== workspace || !completeRevisionChain(owner))
+            storedIntegrity();
+    }
+    const updates = rows.map((row) => migratableRevision(database, row));
+    const canonicalIdentities = new Set();
+    for (const update of updates) {
+        const identity = `${update.workspace}\u0000${update.canonicalHash}`;
+        if (canonicalIdentities.has(identity)) {
+            throw new KiokukoError('INTEGRITY_ERROR', 'Stored revisions collide under the canonical revision hash');
+        }
+        canonicalIdentities.add(identity);
+    }
+    const changed = updates.filter((update) => update.previousHash !== update.canonicalHash
+        || update.previousScopeJson !== update.canonicalScopeJson);
+    if (changed.length > 0) {
+        database.exec('DROP TRIGGER entry_revisions_immutable_update');
+        const park = database.prepare(`
+      UPDATE entry_revisions
+         SET content_hash = ?
+       WHERE entry_id = ? AND revision = ? AND scope_json = ? AND content_hash = ?
+    `);
+        const install = database.prepare(`
+      UPDATE entry_revisions
+         SET scope_json = ?, content_hash = ?
+       WHERE entry_id = ? AND revision = ? AND content_hash = ?
+    `);
+        for (const [index, update] of changed.entries()) {
+            const temporaryHash = `migration-009:${index}`;
+            park.run(temporaryHash, update.entryId, update.revision, update.previousScopeJson, update.previousHash);
+            if (database.prepare('SELECT changes() AS changes').get()?.changes !== 1)
+                storedIntegrity();
+        }
+        for (const [index, update] of changed.entries()) {
+            install.run(update.canonicalScopeJson, update.canonicalHash, update.entryId, update.revision, `migration-009:${index}`);
+            if (database.prepare('SELECT changes() AS changes').get()?.changes !== 1)
+                storedIntegrity();
+        }
+        database.exec(REVISION_IMMUTABILITY_TRIGGER_SQL);
+    }
+    database.prepare('INSERT INTO entry_revision_hash_format (singleton, algorithm) VALUES (1, ?)')
+        .run(REVISION_HASH_ALGORITHM);
+    return { inspected: updates.length, rewritten: changed.length };
+}
 function tagsFor(database, entryId, revision) {
     return database
         .prepare('SELECT tag FROM entry_revision_tags WHERE entry_id = ? AND revision = ? ORDER BY tag ASC')
         .all(entryId, revision)
         .map((row) => row.tag);
 }
-function rowToRevision(database, row) {
-    return {
-        entryId: row.entry_id,
-        workspace: row.workspace,
-        revision: Number(row.revision),
-        kind: row.kind,
-        title: row.title,
-        body: row.body,
-        summary: row.summary,
-        scope: parseObject(row.scope_json, 'scope'),
-        provenance: parseObject(row.provenance_json, 'provenance'),
-        tags: tagsFor(database, row.entry_id, Number(row.revision)),
-        contentHash: row.content_hash,
-        createdBy: row.created_by,
-        createdAt: row.created_at,
-    };
+function rowToRevision(database, row, checkOwnerChronology = true) {
+    const entryId = storedNonEmptyString(row.entry_id);
+    if (!Number.isSafeInteger(row.revision))
+        storedIntegrity();
+    const tags = tagsFor(database, entryId, Number(row.revision));
+    const decoded = decodeStoredMemoryRow({
+        revision: {
+            entryId,
+            workspace: row.workspace,
+            revision: row.revision,
+            kind: row.kind,
+            title: row.title,
+            body: row.body,
+            summary: row.summary,
+            scopeJson: row.scope_json,
+            provenanceJson: row.provenance_json,
+            contentHash: row.content_hash,
+            createdBy: row.created_by,
+            createdAt: row.created_at,
+        },
+        tags,
+    }).revision;
+    if (checkOwnerChronology) {
+        const owner = database.prepare(`
+      SELECT e.created_at, e.updated_at, e.current_revision,
+             (SELECT MIN(all_revisions.revision)
+                FROM entry_revisions AS all_revisions
+               WHERE all_revisions.entry_id = e.id) AS min_revision,
+             (SELECT MAX(all_revisions.revision)
+                FROM entry_revisions AS all_revisions
+               WHERE all_revisions.entry_id = e.id) AS max_revision,
+             (SELECT COUNT(all_revisions.revision)
+                FROM entry_revisions AS all_revisions
+               WHERE all_revisions.entry_id = e.id) AS revision_count,
+             (SELECT COUNT(*)
+                FROM entry_revisions AS all_revisions
+               WHERE all_revisions.entry_id = e.id
+                 AND (typeof(all_revisions.revision) <> 'integer' OR all_revisions.revision < 1)) AS invalid_revision_count
+        FROM entries AS e
+       WHERE e.id = ? AND e.workspace = ?
+    `).get(decoded.entryId, decoded.workspace);
+        if (owner === undefined || !canonicalTimestamp(owner.created_at) || !canonicalTimestamp(owner.updated_at)
+            || !completeRevisionChain({ workspace: decoded.workspace, ...owner })
+            || owner.created_at > decoded.createdAt || decoded.createdAt > owner.updated_at)
+            storedIntegrity();
+    }
+    return decoded;
 }
-function selectRevision(database, input) {
+function selectRevision(database, input, checkOwnerChronology = true) {
     const row = database.prepare(`
     SELECT entry_id, workspace, revision, kind, title, body, summary,
            scope_json, provenance_json, content_hash, created_by, created_at
       FROM entry_revisions
      WHERE entry_id = ? AND workspace = ? AND revision = ?
   `).get(input.entryId, input.workspace, input.revision);
-    return row === undefined ? undefined : rowToRevision(database, row);
+    return row === undefined ? undefined : rowToRevision(database, row, checkOwnerChronology);
 }
 export function readEntryRevision(database, input) {
     revisionKey(input);
@@ -68,11 +554,28 @@ export function insertEntryRevisionInTransaction(database, input) {
     if (typeof input.createdBy !== 'string' || input.createdBy.length === 0 || typeof input.createdAt !== 'string' || input.createdAt.length === 0) {
         throw new KiokukoError('VALIDATION_ERROR', 'Revision creator and timestamp are required');
     }
-    const owner = database.prepare('SELECT workspace FROM entries WHERE id = ?').get(input.entryId);
+    const owner = ownerRevisionChain(database, input.entryId);
     if (owner === undefined)
         throw new KiokukoError('NOT_FOUND', 'Entry not found');
     if (owner.workspace !== input.workspace)
         throw new KiokukoError('NOT_FOUND', 'Entry does not belong to workspace');
+    let nextRevision;
+    if (owner.revision_count === 0) {
+        if (owner.min_revision !== null || owner.max_revision !== null || owner.current_revision !== 1)
+            storedIntegrity();
+        nextRevision = 1;
+    }
+    else {
+        if (!completeRevisionChain(owner))
+            storedIntegrity();
+        nextRevision = Number(owner.max_revision) + 1;
+    }
+    if (input.revision !== nextRevision) {
+        throw new KiokukoError('CONFLICT', 'Entry revision must be the exact next revision', {
+            expectedRevision: nextRevision,
+            actualRevision: input.revision,
+        });
+    }
     const validated = validateRecordInput({
         workspace: input.workspace,
         kind: input.kind,
@@ -85,12 +588,13 @@ export function insertEntryRevisionInTransaction(database, input) {
         createdBy: input.createdBy,
         actor: input.createdBy,
     });
-    const contentHash = canonicalContentHash({
+    const canonicalScope = normalizeStructuredScopeInput(validated.scope);
+    const contentHash = canonicalEntryRevisionContentHash({
         kind: validated.kind,
         title: validated.title,
         body: validated.body,
         summary: validated.summary,
-        scope: validated.scope,
+        scope: canonicalScope,
         provenance: validated.provenance,
         tags: validated.tags,
     });
@@ -103,18 +607,18 @@ export function insertEntryRevisionInTransaction(database, input) {
         entry_id, workspace, revision, kind, title, body, summary, scope_json,
         provenance_json, content_hash, created_by, created_at
       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(input.entryId, input.workspace, input.revision, validated.kind, validated.title, validated.body, validated.summary, canonicalJson(validated.scope), canonicalJson(validated.provenance), contentHash, input.createdBy, input.createdAt);
-        for (const tag of validated.tags) {
-            database.prepare('INSERT INTO entry_revision_tags (entry_id, revision, tag) VALUES (?, ?, ?)').run(input.entryId, input.revision, tag);
-        }
+    `).run(input.entryId, input.workspace, input.revision, validated.kind, validated.title, validated.body, validated.summary, canonicalJson(canonicalScope), canonicalJson(validated.provenance), contentHash, input.createdBy, input.createdAt);
     }
     catch (error) {
-        if (error instanceof Error && /UNIQUE|constraint/i.test(error.message)) {
+        if (isExpectedRevisionConflict(error)) {
             throw new KiokukoError('CONFLICT', 'Entry revision or content already exists');
         }
         throw error;
     }
-    const result = selectRevision(database, input);
+    for (const tag of validated.tags) {
+        database.prepare('INSERT INTO entry_revision_tags (entry_id, revision, tag) VALUES (?, ?, ?)').run(input.entryId, input.revision, tag);
+    }
+    const result = selectRevision(database, input, false);
     if (result === undefined)
         throw new KiokukoError('INTEGRITY_ERROR', 'Inserted entry revision could not be read back');
     return result;