@bitcobblers/wod-wiki-storage 0.39.2142 → 0.40.2144

package/dist/sql/index.d.cts

@@ -1,6 +1,8 @@
 import { S as SqlConnection, D as Database } from '../connection-DxuCLpRc.cjs';
 export { L as LibsqlClient, a as SqlRow, b as SqlStatement, c as SqlValue, l as libsqlDatabase } from '../connection-DxuCLpRc.cjs';
-import { a as StoreDef, R as RangeDTO, K as KeyDTO, e as DomainQueryResult, T as TxOp, I as IStorage, S as StoreName, b as IReadOnlyStore, c as StoreType, d as IReadWriteStore, D as DomainQuery, f as IStorageTransaction } from '../wire-CKJDK_Nq.cjs';
+import { e as StoreDef, R as RangeDTO, K as KeyDTO, f as DomainQueryResult, T as TxOp, I as IStorage, S as StoreName, a as IReadOnlyStore, b as StoreType, c as IReadWriteStore, D as DomainQuery, d as IStorageTransaction } from '../wire-DGYxXt3I.cjs';
+import { b as StoredSyncOp, S as SyncMutation } from '../sync-DG4Z-szj.cjs';
+export { A as ApplySyncBatchOptions, R as RawSyncOp, c as SYNC_OPS_TABLE, d as SYNC_STATE_TABLE, a as SyncEntry, e as SyncTargetKind, f as applySyncBatch, g as fetchSyncOps, i as initSyncTarget, p as probeSyncTarget, r as readLegacyRows, h as readRawSyncOps } from '../sync-DG4Z-szj.cjs';
 import '@libsql/client';
 import '@bitcobblers/wod-wiki-core';
 import '@bitcobblers/wod-wiki-lang';
@@ -157,148 +159,78 @@ declare class BrowserTursoStorage extends SqlStorage {
 }
 
 /**
- * Turso backup/sync protocol — the local-first sync tables layered on top of
- * any libsql database. The browser data plane is always IndexedDB; a saved
- * Turso target is a backup/sync destination, never the read/write provider.
+ * Native-copy verification + migration finalize — the pure-SQL seam the CLI
+ * `wod db backup/restore/migrate` commands run over any libsql Database.
  *
- * Design: the remote holds ONE op log (`_wodwiki_sync_ops`) plus a state row
- * (`_wodwiki_sync_state`) carrying {schema, rev}. Every committed local
- * transaction group appends one idempotent op-group (uuid op_id,
- * INSERT-or-ignore per op); `rev` is assigned monotonically per NEWLY applied
- * group — a retried group is recognized by its first op id, consumes no rev
- * and appends nothing. Pulls replay ops with rev > cursor in deterministic
- * (rev, idx) order. Tombstones (delete/clear/wipe) are ordinary ops —
- * deletions propagate.
+ *  - databaseFingerprint: canonical sha-256 over EVERY user table (schema
+ *    SQL + sorted typed-cell rows + the sync state row), so a Turso native
+ *    seed-copy can be proven row- and binary-identical (BLOB bytes are hex
+ *    encoded — JSON.stringify(ArrayBuffer) would collapse to {}) before any
+ *    credential is minted or paired. Rows are encoded as typed cells inside
+ *    JSON arrays and SORTED, so framing is unambiguous and rowid/physical
+ *    order differences after a native copy cannot produce a false mismatch.
+ *  - assertDatabaseCopyMatches: interrupted-copy AND concurrent-source
+ *    refusal — the source must be unchanged since the copy started and the
+ *    copy must match that exact snapshot.
+ *  - finalizeMigrationTarget: CAS that flips a migration target from the
+ *    non-legitimate "constructing" marker (state schema 0, unpairable by
+ *    engine refusal and by `wod db pair`) to the live schema in ONE
+ *    transaction, only after full replay/pin/binary validation passed.
  *
- * Fetch atomicity: a pull window is a set of WHOLE revision groups. The rev
- * boundary is chosen with a bounded subquery, then every row of those revs is
- * returned — a group is never split, so the cursor never skips the rest of
- * a group (one pathologically large group can exceed the nominal row bound;
- * that is the unavoidable atomicity ceiling).
- *
- * ponytail: op-log replay pulls — a fresh browser replays the whole log
- * (O(history)) instead of reading per-store current-state tables. Upgrade
- * path: add per-store state tables rev-indexed by primary key and collapse
- * the log into them periodically; the wire format (op_id, rev, mutation)
- * stays unchanged.
- *
- * Never-downgrade rule: the state row's `schema` is the managing client's
- * DB_VERSION at init time. Uploads verify `schema` INSIDE the write
- * transaction (a stale probe must not append current payloads to an old or
- * newer remote); an older remote log is migrated forward by the caller
- * (transform payloads, never just rewrite the marker), a newer remote is
- * never rewritten — the client refuses and keeps working locally.
+ * No source is ever mutated by these helpers (reads + one guarded state-row
+ * UPDATE on the target). Fingerprint reads run inside one transaction so the
+ * enumeration and the rows come from one consistent snapshot.
  */
 
-declare const SYNC_OPS_TABLE = "_wodwiki_sync_ops";
-declare const SYNC_STATE_TABLE = "_wodwiki_sync_state";
-/** Pre-migration op log copies live here — the recoverable old source,
- *  retained after a schema migration replaces the active log. */
-declare const SYNC_ARCHIVE_TABLE = "_wodwiki_sync_ops_archive";
-/** One committed local transaction group, as journaled in IndexedDB. */
-type SyncMutation = {
-    op: 'put';
-    store: StoreName;
-    key: KeyDTO;
-    value: unknown;
-} | {
-    op: 'delete';
-    store: StoreName;
-    key: KeyDTO;
-} | {
-    op: 'clear';
-    store: StoreName;
-} | {
-    op: 'wipe';
-};
-interface SyncEntry {
-    /** Idempotency key — one uuid per committed local transaction group. */
-    id: string;
-    at: number;
-    ops: SyncMutation[];
-}
-interface StoredSyncOp {
-    opId: string;
-    rev: number;
-    idx: number;
-    at: number;
-    mutation: SyncMutation;
-}
-type SyncTargetKind = 
-/** No tables at all (beyond libsql internals): fresh database. */
-'empty'
-/** Tables exist but neither sync state nor a legacy schema guard — not
- *  ours; initializing over unknown data is refused by the caller. */
- | {
-    kind: 'unknown';
-}
-/** Legacy direct-Turso SqlStorage layout (`_wodwiki_schema` guard). */
- | {
-    kind: 'legacy';
-    schemaVersion: number;
-}
-/** This sync protocol's layout; payload = state row. */
- | {
-    kind: 'current';
-    schemaVersion: number;
-    rev: number;
-};
-/** Classify the sync target WITHOUT mutating it. */
-declare function probeSyncTarget(db: Database): Promise<SyncTargetKind>;
-/** Create the sync tables + state row. Only for empty targets; existing
- *  state (current, legacy or unknown) is never overwritten by init. */
-declare function initSyncTarget(db: Database, schemaVersion: number): Promise<void>;
-interface ApplySyncBatchOptions {
-    /** Schema the caller verified at probe time — rechecked INSIDE the write
-     *  transaction so a schema change between probe and append aborts. */
-    expectSchema?: number;
-    /** Bump the state schema version in the SAME transaction (remote-schema
-     *  migrations append converted payloads + move the marker atomically). */
-    toSchemaVersion?: number;
+interface DatabaseFingerprint {
+    tables: number;
+    rows: number;
+    /** sha-256 hex over the canonical whole-database rendering. */
+    digest: string;
+    /** The sync protocol state row when this database carries that layout. */
+    sync: {
+        schema: number;
+        rev: number;
+    } | undefined;
 }
 /**
- * Append op-groups to the log in ONE SQL transaction, idempotently by
- * group: a group whose first op id already exists is skipped entirely and
- * consumes no rev (retries never duplicate, never allocate revisions).
- * Returns the number of NEW groups committed — ack semantics for the
- * uploader's watermark.
+ * Canonical fingerprint of every user table (sqlite_% / libsql_% internal
+ * tables excluded): per table the CREATE statement text plus its rows as
+ * typed-cell JSON arrays, SORTED so physical row order cannot influence the
+ * digest. Reads run inside one transaction for a consistent snapshot.
  */
-declare function applySyncBatch(db: Database, entries: SyncEntry[], opts?: ApplySyncBatchOptions): Promise<number>;
+declare function databaseFingerprint(db: Database): Promise<DatabaseFingerprint>;
 /**
- * Replay window: ops with rev > afterRev, in deterministic commit order.
- * The window covers WHOLE revision groups: up to `limit` distinct revs are
- * chosen (bounded subquery), then every row of those revs is returned, so a
- * cursor advanced to the last returned rev never splits a group. A single
- * group larger than `limit` is returned whole — the atomicity ceiling.
+ * Prove a native copy: the copy must equal the exact source snapshot the
+ * caller fingerprinted BEFORE starting the copy (`before`), and the source
+ * must not have advanced meanwhile (writers were supposed to be retired).
+ * Returns the re-read source fingerprint.
  */
-declare function fetchSyncOps(db: Database, afterRev: number, limit: number): Promise<StoredSyncOp[]>;
+declare function assertDatabaseCopyMatches(source: Database, copy: Database, before: DatabaseFingerprint): Promise<DatabaseFingerprint>;
 /**
- * Schema-migration replacement for the active op log, in ONE transaction:
- * every previous op is copied into the archive table (the recoverable old
- * source — nothing is destroyed), the active log is cleared, and the
- * converted snapshot groups become the entire replayable history at
- * rev 1..n with the schema marker moved forward atomically. Fresh browsers
- * replay converted payloads only, so pulls never touch legacy row shapes.
+ * CAS-finalize a migration target constructed at the non-legitimate marker
+ * schema 0: requires the state row to be exactly {schema: 0, rev:
+ * expectRev}, then publishes the live schema in the same transaction. A
+ * target that never reaches this call stays schema 0 — probes report
+ * current/0, which no client accepts and `wod db pair` refuses.
  */
-declare function replaceSyncLog(db: Database, entries: SyncEntry[], toSchemaVersion: number): Promise<void>;
-/** Migration-only raw replay: parsed op payloads WITHOUT store/key validation
- *  (old logs reference era store names like `segments`). Only
- *  migrateRemoteToCurrent consumes this — pulls use fetchSyncOps, which
- *  validates every row against the current schema. Binary cells revive. */
-interface RawSyncOp {
-    op: string;
-    store: string;
-    key: unknown;
-    value?: unknown;
-}
-declare function readRawSyncOps(db: Database): Promise<RawSyncOp[]>;
+declare function finalizeMigrationTarget(db: Database, toSchema: number, expectRev: number): Promise<void>;
+/**
+ * Policy snapshot validation shared by `wod db migrate` (pre-write) and
+ * `wod db pair` (over the full replayed remote log): a user-scope snapshot
+ * is policy-compliant PUTS ONLY — any delete/clear/wipe means non-user
+ * policy operations leaked into the copy — and every session pin and note
+ * block pin must have its immutable block_revisions row present (missing
+ * pins fail the copy, they are never silently dropped).
+ */
+declare function assertPolicySnapshot(ops: readonly SyncMutation[]): void;
 /**
- * Import rows from a legacy direct-Turso (SqlStorage) database into op-
- * groups. Reads the per-store JSON `data` columns directly — the legacy
- * schema guard may hold an older version SqlStorage refuses to open, so the
- * rows are lifted raw, never through SqlStorage. Missing tables contribute
- * no rows; nothing is written or deleted remotely.
+ * Pin closure over a LIVE op log (pair verification): unlike a conversion
+ * snapshot, an operational log legitimately contains delete/clear/wipe
+ * tombstones, so the CURRENT row set is replayed first and only live
+ * sessions/notes must find their immutable revisions. Anything deleted is
+ * not required to have one.
  */
-declare function readLegacyRows(db: Database, table: string): Promise<unknown[]>;
+declare function assertLogPinClosure(ops: readonly StoredSyncOp[]): void;
 
-export { type ApplySyncBatchOptions, BrowserTursoStorage, Database, MAX_BODY, type RawSyncOp, SCHEMA_TABLE, SYNC_ARCHIVE_TABLE, SYNC_OPS_TABLE, SYNC_STATE_TABLE, SqlConnection, SqlStorage, type SqlStorageOptions, StorageError, type StoredSyncOp, type SyncEntry, type SyncMutation, type SyncTargetKind, type TursoSettings, applySyncBatch, clearRows, countRows, decodeRowJson, deleteRows, encodeRowJson, fetchSyncOps, getRow, getRows, handleDomainQuery, initSyncTarget, initializeDomain, initializeStore, listRows, listRowsFromIndexMany, probeSyncTarget, putRow, putRows, readLegacyRows, readRawSyncOps, rebuildProjections, refreshDomain, replaceSyncLog, storeDefinition, validateTursoUrl, verifyReadiness, wipeDomain, wipeRows };
+export { BrowserTursoStorage, Database, type DatabaseFingerprint, MAX_BODY, SCHEMA_TABLE, SqlConnection, SqlStorage, type SqlStorageOptions, StorageError, StoredSyncOp, SyncMutation, type TursoSettings, assertDatabaseCopyMatches, assertLogPinClosure, assertPolicySnapshot, clearRows, countRows, databaseFingerprint, decodeRowJson, deleteRows, encodeRowJson, finalizeMigrationTarget, getRow, getRows, handleDomainQuery, initializeDomain, initializeStore, listRows, listRowsFromIndexMany, putRow, putRows, rebuildProjections, refreshDomain, storeDefinition, validateTursoUrl, verifyReadiness, wipeDomain, wipeRows };

package/dist/sql/index.d.ts

@@ -1,6 +1,8 @@
 import { S as SqlConnection, D as Database } from '../connection-DxuCLpRc.js';
 export { L as LibsqlClient, a as SqlRow, b as SqlStatement, c as SqlValue, l as libsqlDatabase } from '../connection-DxuCLpRc.js';
-import { a as StoreDef, R as RangeDTO, K as KeyDTO, e as DomainQueryResult, T as TxOp, I as IStorage, S as StoreName, b as IReadOnlyStore, c as StoreType, d as IReadWriteStore, D as DomainQuery, f as IStorageTransaction } from '../wire-CKJDK_Nq.js';
+import { e as StoreDef, R as RangeDTO, K as KeyDTO, f as DomainQueryResult, T as TxOp, I as IStorage, S as StoreName, a as IReadOnlyStore, b as StoreType, c as IReadWriteStore, D as DomainQuery, d as IStorageTransaction } from '../wire-DGYxXt3I.js';
+import { b as StoredSyncOp, S as SyncMutation } from '../sync-Bjj_c1ea.js';
+export { A as ApplySyncBatchOptions, R as RawSyncOp, c as SYNC_OPS_TABLE, d as SYNC_STATE_TABLE, a as SyncEntry, e as SyncTargetKind, f as applySyncBatch, g as fetchSyncOps, i as initSyncTarget, p as probeSyncTarget, r as readLegacyRows, h as readRawSyncOps } from '../sync-Bjj_c1ea.js';
 import '@libsql/client';
 import '@bitcobblers/wod-wiki-core';
 import '@bitcobblers/wod-wiki-lang';
@@ -157,148 +159,78 @@ declare class BrowserTursoStorage extends SqlStorage {
 }
 
 /**
- * Turso backup/sync protocol — the local-first sync tables layered on top of
- * any libsql database. The browser data plane is always IndexedDB; a saved
- * Turso target is a backup/sync destination, never the read/write provider.
+ * Native-copy verification + migration finalize — the pure-SQL seam the CLI
+ * `wod db backup/restore/migrate` commands run over any libsql Database.
  *
- * Design: the remote holds ONE op log (`_wodwiki_sync_ops`) plus a state row
- * (`_wodwiki_sync_state`) carrying {schema, rev}. Every committed local
- * transaction group appends one idempotent op-group (uuid op_id,
- * INSERT-or-ignore per op); `rev` is assigned monotonically per NEWLY applied
- * group — a retried group is recognized by its first op id, consumes no rev
- * and appends nothing. Pulls replay ops with rev > cursor in deterministic
- * (rev, idx) order. Tombstones (delete/clear/wipe) are ordinary ops —
- * deletions propagate.
+ *  - databaseFingerprint: canonical sha-256 over EVERY user table (schema
+ *    SQL + sorted typed-cell rows + the sync state row), so a Turso native
+ *    seed-copy can be proven row- and binary-identical (BLOB bytes are hex
+ *    encoded — JSON.stringify(ArrayBuffer) would collapse to {}) before any
+ *    credential is minted or paired. Rows are encoded as typed cells inside
+ *    JSON arrays and SORTED, so framing is unambiguous and rowid/physical
+ *    order differences after a native copy cannot produce a false mismatch.
+ *  - assertDatabaseCopyMatches: interrupted-copy AND concurrent-source
+ *    refusal — the source must be unchanged since the copy started and the
+ *    copy must match that exact snapshot.
+ *  - finalizeMigrationTarget: CAS that flips a migration target from the
+ *    non-legitimate "constructing" marker (state schema 0, unpairable by
+ *    engine refusal and by `wod db pair`) to the live schema in ONE
+ *    transaction, only after full replay/pin/binary validation passed.
  *
- * Fetch atomicity: a pull window is a set of WHOLE revision groups. The rev
- * boundary is chosen with a bounded subquery, then every row of those revs is
- * returned — a group is never split, so the cursor never skips the rest of
- * a group (one pathologically large group can exceed the nominal row bound;
- * that is the unavoidable atomicity ceiling).
- *
- * ponytail: op-log replay pulls — a fresh browser replays the whole log
- * (O(history)) instead of reading per-store current-state tables. Upgrade
- * path: add per-store state tables rev-indexed by primary key and collapse
- * the log into them periodically; the wire format (op_id, rev, mutation)
- * stays unchanged.
- *
- * Never-downgrade rule: the state row's `schema` is the managing client's
- * DB_VERSION at init time. Uploads verify `schema` INSIDE the write
- * transaction (a stale probe must not append current payloads to an old or
- * newer remote); an older remote log is migrated forward by the caller
- * (transform payloads, never just rewrite the marker), a newer remote is
- * never rewritten — the client refuses and keeps working locally.
+ * No source is ever mutated by these helpers (reads + one guarded state-row
+ * UPDATE on the target). Fingerprint reads run inside one transaction so the
+ * enumeration and the rows come from one consistent snapshot.
  */
 
-declare const SYNC_OPS_TABLE = "_wodwiki_sync_ops";
-declare const SYNC_STATE_TABLE = "_wodwiki_sync_state";
-/** Pre-migration op log copies live here — the recoverable old source,
- *  retained after a schema migration replaces the active log. */
-declare const SYNC_ARCHIVE_TABLE = "_wodwiki_sync_ops_archive";
-/** One committed local transaction group, as journaled in IndexedDB. */
-type SyncMutation = {
-    op: 'put';
-    store: StoreName;
-    key: KeyDTO;
-    value: unknown;
-} | {
-    op: 'delete';
-    store: StoreName;
-    key: KeyDTO;
-} | {
-    op: 'clear';
-    store: StoreName;
-} | {
-    op: 'wipe';
-};
-interface SyncEntry {
-    /** Idempotency key — one uuid per committed local transaction group. */
-    id: string;
-    at: number;
-    ops: SyncMutation[];
-}
-interface StoredSyncOp {
-    opId: string;
-    rev: number;
-    idx: number;
-    at: number;
-    mutation: SyncMutation;
-}
-type SyncTargetKind = 
-/** No tables at all (beyond libsql internals): fresh database. */
-'empty'
-/** Tables exist but neither sync state nor a legacy schema guard — not
- *  ours; initializing over unknown data is refused by the caller. */
- | {
-    kind: 'unknown';
-}
-/** Legacy direct-Turso SqlStorage layout (`_wodwiki_schema` guard). */
- | {
-    kind: 'legacy';
-    schemaVersion: number;
-}
-/** This sync protocol's layout; payload = state row. */
- | {
-    kind: 'current';
-    schemaVersion: number;
-    rev: number;
-};
-/** Classify the sync target WITHOUT mutating it. */
-declare function probeSyncTarget(db: Database): Promise<SyncTargetKind>;
-/** Create the sync tables + state row. Only for empty targets; existing
- *  state (current, legacy or unknown) is never overwritten by init. */
-declare function initSyncTarget(db: Database, schemaVersion: number): Promise<void>;
-interface ApplySyncBatchOptions {
-    /** Schema the caller verified at probe time — rechecked INSIDE the write
-     *  transaction so a schema change between probe and append aborts. */
-    expectSchema?: number;
-    /** Bump the state schema version in the SAME transaction (remote-schema
-     *  migrations append converted payloads + move the marker atomically). */
-    toSchemaVersion?: number;
+interface DatabaseFingerprint {
+    tables: number;
+    rows: number;
+    /** sha-256 hex over the canonical whole-database rendering. */
+    digest: string;
+    /** The sync protocol state row when this database carries that layout. */
+    sync: {
+        schema: number;
+        rev: number;
+    } | undefined;
 }
 /**
- * Append op-groups to the log in ONE SQL transaction, idempotently by
- * group: a group whose first op id already exists is skipped entirely and
- * consumes no rev (retries never duplicate, never allocate revisions).
- * Returns the number of NEW groups committed — ack semantics for the
- * uploader's watermark.
+ * Canonical fingerprint of every user table (sqlite_% / libsql_% internal
+ * tables excluded): per table the CREATE statement text plus its rows as
+ * typed-cell JSON arrays, SORTED so physical row order cannot influence the
+ * digest. Reads run inside one transaction for a consistent snapshot.
  */
-declare function applySyncBatch(db: Database, entries: SyncEntry[], opts?: ApplySyncBatchOptions): Promise<number>;
+declare function databaseFingerprint(db: Database): Promise<DatabaseFingerprint>;
 /**
- * Replay window: ops with rev > afterRev, in deterministic commit order.
- * The window covers WHOLE revision groups: up to `limit` distinct revs are
- * chosen (bounded subquery), then every row of those revs is returned, so a
- * cursor advanced to the last returned rev never splits a group. A single
- * group larger than `limit` is returned whole — the atomicity ceiling.
+ * Prove a native copy: the copy must equal the exact source snapshot the
+ * caller fingerprinted BEFORE starting the copy (`before`), and the source
+ * must not have advanced meanwhile (writers were supposed to be retired).
+ * Returns the re-read source fingerprint.
  */
-declare function fetchSyncOps(db: Database, afterRev: number, limit: number): Promise<StoredSyncOp[]>;
+declare function assertDatabaseCopyMatches(source: Database, copy: Database, before: DatabaseFingerprint): Promise<DatabaseFingerprint>;
 /**
- * Schema-migration replacement for the active op log, in ONE transaction:
- * every previous op is copied into the archive table (the recoverable old
- * source — nothing is destroyed), the active log is cleared, and the
- * converted snapshot groups become the entire replayable history at
- * rev 1..n with the schema marker moved forward atomically. Fresh browsers
- * replay converted payloads only, so pulls never touch legacy row shapes.
+ * CAS-finalize a migration target constructed at the non-legitimate marker
+ * schema 0: requires the state row to be exactly {schema: 0, rev:
+ * expectRev}, then publishes the live schema in the same transaction. A
+ * target that never reaches this call stays schema 0 — probes report
+ * current/0, which no client accepts and `wod db pair` refuses.
  */
-declare function replaceSyncLog(db: Database, entries: SyncEntry[], toSchemaVersion: number): Promise<void>;
-/** Migration-only raw replay: parsed op payloads WITHOUT store/key validation
- *  (old logs reference era store names like `segments`). Only
- *  migrateRemoteToCurrent consumes this — pulls use fetchSyncOps, which
- *  validates every row against the current schema. Binary cells revive. */
-interface RawSyncOp {
-    op: string;
-    store: string;
-    key: unknown;
-    value?: unknown;
-}
-declare function readRawSyncOps(db: Database): Promise<RawSyncOp[]>;
+declare function finalizeMigrationTarget(db: Database, toSchema: number, expectRev: number): Promise<void>;
+/**
+ * Policy snapshot validation shared by `wod db migrate` (pre-write) and
+ * `wod db pair` (over the full replayed remote log): a user-scope snapshot
+ * is policy-compliant PUTS ONLY — any delete/clear/wipe means non-user
+ * policy operations leaked into the copy — and every session pin and note
+ * block pin must have its immutable block_revisions row present (missing
+ * pins fail the copy, they are never silently dropped).
+ */
+declare function assertPolicySnapshot(ops: readonly SyncMutation[]): void;
 /**
- * Import rows from a legacy direct-Turso (SqlStorage) database into op-
- * groups. Reads the per-store JSON `data` columns directly — the legacy
- * schema guard may hold an older version SqlStorage refuses to open, so the
- * rows are lifted raw, never through SqlStorage. Missing tables contribute
- * no rows; nothing is written or deleted remotely.
+ * Pin closure over a LIVE op log (pair verification): unlike a conversion
+ * snapshot, an operational log legitimately contains delete/clear/wipe
+ * tombstones, so the CURRENT row set is replayed first and only live
+ * sessions/notes must find their immutable revisions. Anything deleted is
+ * not required to have one.
  */
-declare function readLegacyRows(db: Database, table: string): Promise<unknown[]>;
+declare function assertLogPinClosure(ops: readonly StoredSyncOp[]): void;
 
-export { type ApplySyncBatchOptions, BrowserTursoStorage, Database, MAX_BODY, type RawSyncOp, SCHEMA_TABLE, SYNC_ARCHIVE_TABLE, SYNC_OPS_TABLE, SYNC_STATE_TABLE, SqlConnection, SqlStorage, type SqlStorageOptions, StorageError, type StoredSyncOp, type SyncEntry, type SyncMutation, type SyncTargetKind, type TursoSettings, applySyncBatch, clearRows, countRows, decodeRowJson, deleteRows, encodeRowJson, fetchSyncOps, getRow, getRows, handleDomainQuery, initSyncTarget, initializeDomain, initializeStore, listRows, listRowsFromIndexMany, probeSyncTarget, putRow, putRows, readLegacyRows, readRawSyncOps, rebuildProjections, refreshDomain, replaceSyncLog, storeDefinition, validateTursoUrl, verifyReadiness, wipeDomain, wipeRows };
+export { BrowserTursoStorage, Database, type DatabaseFingerprint, MAX_BODY, SCHEMA_TABLE, SqlConnection, SqlStorage, type SqlStorageOptions, StorageError, StoredSyncOp, SyncMutation, type TursoSettings, assertDatabaseCopyMatches, assertLogPinClosure, assertPolicySnapshot, clearRows, countRows, databaseFingerprint, decodeRowJson, deleteRows, encodeRowJson, finalizeMigrationTarget, getRow, getRows, handleDomainQuery, initializeDomain, initializeStore, listRows, listRowsFromIndexMany, putRow, putRows, rebuildProjections, refreshDomain, storeDefinition, validateTursoUrl, verifyReadiness, wipeDomain, wipeRows };