@cleocode/core 2026.10.6 → 2026.10.7

package/dist/store/sync/push.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Push one stream's journal (journal spec §2.8 "Persist before push",
+ * "Upload", §2.9, §1.3 "Local clock ahead"; T12343 S4-2).
+ *
+ * {@link pushStream} runs, in order:
+ * 1. the preconditions: `sync.push` on, the stream cut and its genesis
+ *    checkpoint stored (`genesis_pending` clear), so no segment ever
+ *    precedes the checkpoint it extends;
+ * 2. the local-clock check: the server's date is recorded for the sealer's
+ *    clamp (`sync.server_clock`, read by `sealWallCeiling`); when this
+ *    device's clock runs more than `MAX_DRIFT` ahead of it, push pauses
+ *    (persisted as `sync.clock_ahead` for `cleo doctor`), so future-stamped
+ *    HLCs do not spread; local writes are never refused;
+ * 3. the rollback check: when the server already holds a later segment from
+ *    this replica than the store has persisted, the store is behind (a
+ *    restore or a copy) and must rebind (§1.5, §2.9); nothing is sent;
+ * 4. seal everything pending, then pack and persist segments
+ *    ({@link buildSegment}), advancing the device registry's high-water mark
+ *    after each persist (the store ahead of the registry is the safe
+ *    direction);
+ * 5. upload the persisted segments, lowest `replicaSeq` first, one at a time,
+ *    always the exact persisted bytes; a duplicate counts as stored.
+ *
+ * The upload goes through a {@link SegmentUploader} port: the journal client
+ * in production (`cloud/nexus-vault.ts`), a fake in tests.
+ *
+ * @task T12343
+ * @module store/sync/push
+ */
+import type { DatabaseSync } from 'node:sqlite';
+import type { TableScope } from '@cleocode/contracts';
+import type { ReplicaRegistry } from './replica-registry.js';
+import { type BuildSegmentOptions, type PersistedSegment, type SegmentSealer } from './segments.js';
+/** `MAX_DRIFT` (§1.3, Q6): how far this device's clock may run ahead of the server's. */
+export declare const MAX_DRIFT_MS: number;
+/** `_sync_meta` key set while push is paused for a clock ahead of the server's (`cleo doctor`). */
+export declare const CLOCK_AHEAD_KEY = "sync.clock_ahead";
+/** Uploads one persisted segment; resolves with the server's seq, `duplicate` when it was stored already. */
+export type SegmentUploader = (segment: PersistedSegment) => Promise<{
+    readonly seq: number;
+    readonly duplicate: boolean;
+}>;
+/** Options for {@link pushStream}. */
+export interface PushStreamOptions {
+    readonly scope: TableScope;
+    readonly stream: string;
+    /** This store's bound replica (the stream knows it by the same id). */
+    readonly replica: string;
+    /** The merge key's project, or null on a home stream. */
+    readonly project: string | null;
+    readonly sealer: SegmentSealer;
+    /** Signs each packed transaction for the stream ({@link BuildSegmentOptions.signTxn}). */
+    readonly signTxn: BuildSegmentOptions['signTxn'];
+    readonly upload: SegmentUploader;
+    /**
+     * The server's clock minus this device's, measured when its latest response
+     * arrived (negative: this device runs ahead), or null when unknown.
+     */
+    readonly serverOffsetMs: number | null;
+    /** The server's last stored `replicaSeq` for this replica on the stream, or null when unknown or none. */
+    readonly serverLastReplicaSeq: number | null;
+    /** The device registry, whose high-water mark advances after each persist. */
+    readonly registry?: ReplicaRegistry;
+    /** Wall clock. @defaultValue Date.now */
+    readonly now?: () => number;
+    readonly env?: NodeJS.ProcessEnv;
+    /** Seal and push although the flags are unreleased (tests and staging only). Never set from user input. */
+    readonly allowUnreleased?: boolean;
+    /** Override {@link MAX_DRIFT_MS} (tests). */
+    readonly maxDriftMs?: number;
+}
+/**
+ * Why {@link pushStream} sent nothing, as a kind callers branch on (the
+ * message in `refused` is for people and may be reworded):
+ * - `schema-missing`: the sync schema is not installed;
+ * - `push-off`: `sync.push` is off;
+ * - `no-genesis`: this store has no genesis cut on the stream;
+ * - `genesis-pending`: the genesis checkpoint is not stored yet;
+ * - `store-behind`: the server holds a later segment of this replica.
+ */
+export type PushRefusal = 'schema-missing' | 'push-off' | 'no-genesis' | 'genesis-pending' | 'store-behind';
+/** What {@link pushStream} did. */
+export interface PushStreamReport {
+    readonly stream: string;
+    /** Why nothing was sent, or null. */
+    readonly refused: string | null;
+    /** The kind of `refused`, or null when nothing was refused. */
+    readonly refusedKind: PushRefusal | null;
+    /** Push paused because this device's clock is ahead of the server's. */
+    readonly clockAhead: boolean;
+    /** Transactions sealed, segments packed and persisted, segments the server stored (`duplicates` of them retries). */
+    readonly sealed: number;
+    readonly built: number;
+    readonly pushed: number;
+    readonly duplicates: number;
+    /** The server seq of the last segment stored, or null. */
+    readonly lastServerSeq: number | null;
+}
+/**
+ * Seal, persist and upload one stream's pending journal (module docs).
+ * Must run outside a transaction. An upload failure propagates after the
+ * segments before it were recorded; the next run resends from the lowest
+ * unpushed `replicaSeq`, with the same bytes.
+ *
+ * @param db - The store.
+ * @param o - {@link PushStreamOptions}.
+ * @returns What was sealed, persisted and stored, or why nothing was sent.
+ */
+export declare function pushStream(db: DatabaseSync, o: PushStreamOptions): Promise<PushStreamReport>;
+//# sourceMappingURL=push.d.ts.map

package/dist/store/sync/push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../../src/store/sync/push.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAKtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,EACL,KAAK,mBAAmB,EAGxB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAEnB,MAAM,eAAe,CAAC;AAEvB,yFAAyF;AACzF,eAAO,MAAM,YAAY,QAAgB,CAAC;AAK1C,mGAAmG;AACnG,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAElD,6GAA6G;AAC7G,MAAM,MAAM,eAAe,GAAG,CAC5B,OAAO,EAAE,gBAAgB,KACtB,OAAO,CAAC;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAEpE,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,0GAA0G;IAC1G,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,yCAAyC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,2GAA2G;IAC3G,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,6CAA6C;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GACnB,gBAAgB,GAChB,UAAU,GACV,YAAY,GACZ,iBAAiB,GACjB,cAAc,CAAC;AAEnB,mCAAmC;AACnC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IACzC,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,qHAAqH;IACrH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,YAAY,EAChB,CAAC,EAAE,iBAAiB,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAmG3B"}

package/dist/store/sync/push.js

@@ -0,0 +1,172 @@
+/**
+ * Push one stream's journal (journal spec §2.8 "Persist before push",
+ * "Upload", §2.9, §1.3 "Local clock ahead"; T12343 S4-2).
+ *
+ * {@link pushStream} runs, in order:
+ * 1. the preconditions: `sync.push` on, the stream cut and its genesis
+ *    checkpoint stored (`genesis_pending` clear), so no segment ever
+ *    precedes the checkpoint it extends;
+ * 2. the local-clock check: the server's date is recorded for the sealer's
+ *    clamp (`sync.server_clock`, read by `sealWallCeiling`); when this
+ *    device's clock runs more than `MAX_DRIFT` ahead of it, push pauses
+ *    (persisted as `sync.clock_ahead` for `cleo doctor`), so future-stamped
+ *    HLCs do not spread; local writes are never refused;
+ * 3. the rollback check: when the server already holds a later segment from
+ *    this replica than the store has persisted, the store is behind (a
+ *    restore or a copy) and must rebind (§1.5, §2.9); nothing is sent;
+ * 4. seal everything pending, then pack and persist segments
+ *    ({@link buildSegment}), advancing the device registry's high-water mark
+ *    after each persist (the store ahead of the registry is the safe
+ *    direction);
+ * 5. upload the persisted segments, lowest `replicaSeq` first, one at a time,
+ *    always the exact persisted bytes; a duplicate counts as stored.
+ *
+ * The upload goes through a {@link SegmentUploader} port: the journal client
+ * in production (`cloud/nexus-vault.ts`), a fake in tests.
+ *
+ * @task T12343
+ * @module store/sync/push
+ */
+import { SERVER_CLOCK_KEY } from './clock-store.js';
+import { isSyncFlagOn } from './flags.js';
+import { genesisCutOf, genesisPending } from './genesis.js';
+import { storeHwm } from './replica.js';
+import { hasTable } from './schema.js';
+import { sealPending } from './sealer.js';
+import { buildSegment, markSegmentPushed, unpushedSegments, } from './segments.js';
+/** `MAX_DRIFT` (§1.3, Q6): how far this device's clock may run ahead of the server's. */
+export const MAX_DRIFT_MS = 5 * 60 * 1000;
+/** Sealing passes per push before it sends what is persisted (the rest waits for the next run). */
+const SEAL_PASSES = 8;
+/** `_sync_meta` key set while push is paused for a clock ahead of the server's (`cleo doctor`). */
+export const CLOCK_AHEAD_KEY = 'sync.clock_ahead';
+const empty = (stream, fields) => ({
+    stream,
+    refused: null,
+    refusedKind: null,
+    clockAhead: false,
+    sealed: 0,
+    built: 0,
+    pushed: 0,
+    duplicates: 0,
+    lastServerSeq: null,
+    ...fields,
+});
+/** Set or clear {@link CLOCK_AHEAD_KEY}. */
+/** Set (or, with null, clear) one of push's `_sync_meta` keys. */
+function setPushMeta(db, key, value, atIso) {
+    if (value === null) {
+        db.prepare('DELETE FROM _sync_meta WHERE key = ?').run(key);
+        return;
+    }
+    db.prepare('INSERT INTO _sync_meta (key, value, updated_at) VALUES (?, ?, ?) ' +
+        'ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at').run(key, value, atIso);
+}
+/**
+ * Seal, persist and upload one stream's pending journal (module docs).
+ * Must run outside a transaction. An upload failure propagates after the
+ * segments before it were recorded; the next run resends from the lowest
+ * unpushed `replicaSeq`, with the same bytes.
+ *
+ * @param db - The store.
+ * @param o - {@link PushStreamOptions}.
+ * @returns What was sealed, persisted and stored, or why nothing was sent.
+ */
+export async function pushStream(db, o) {
+    const env = o.env ?? process.env;
+    const now = o.now ?? Date.now;
+    if (!hasTable(db, '_sync_segment'))
+        return empty(o.stream, {
+            refused: 'sync schema not installed',
+            refusedKind: 'schema-missing',
+        });
+    if (!isSyncFlagOn(db, 'sync.push', env))
+        return empty(o.stream, { refused: 'sync.push is off', refusedKind: 'push-off' });
+    if (genesisCutOf(db, o.stream) === undefined) {
+        return empty(o.stream, {
+            refused: `${o.stream} has no genesis cut on this store: run \`cleo sync enable push\``,
+            refusedKind: 'no-genesis',
+        });
+    }
+    if (genesisPending(db, o.stream)) {
+        return empty(o.stream, {
+            refused: `${o.stream}'s genesis checkpoint is not stored yet: run \`cleo sync enable push\` again`,
+            refusedKind: 'genesis-pending',
+        });
+    }
+    const nowMs = now();
+    const atIso = new Date(nowMs).toISOString();
+    // §1.3: the observed server date bounds what the sealer stamps
+    // (sealWallCeiling), and a clock running ahead of it pauses push, never writes.
+    if (o.serverOffsetMs !== null) {
+        setPushMeta(db, SERVER_CLOCK_KEY, JSON.stringify({ offsetMs: o.serverOffsetMs, atMs: nowMs }), atIso);
+    }
+    const drift = o.serverOffsetMs === null ? 0 : -o.serverOffsetMs;
+    if (drift > (o.maxDriftMs ?? MAX_DRIFT_MS)) {
+        setPushMeta(db, CLOCK_AHEAD_KEY, JSON.stringify({ driftMs: drift }), atIso);
+        return empty(o.stream, { clockAhead: true });
+    }
+    setPushMeta(db, CLOCK_AHEAD_KEY, null, atIso);
+    // §1.5 / §2.9: the server is authoritative. A later segment there than this
+    // store ever persisted means the store was restored or copied behind it.
+    const local = storeHwm(db, o.replica)[o.stream] ?? null;
+    if (o.serverLastReplicaSeq !== null && (local === null || o.serverLastReplicaSeq > local)) {
+        return empty(o.stream, {
+            refused: `the server holds replicaSeq ${o.serverLastReplicaSeq} of replica ${o.replica} on ${o.stream}, but this store persisted only ${local ?? 'none'}: the store is behind (restored or copied) and must rebind to a new replica (T12753)`,
+            refusedKind: 'store-behind',
+        });
+    }
+    let sealed = 0;
+    // Bounded: steady concurrent writers never keep the push from sending; the
+    // next run seals the rest.
+    for (let pass = 0; pass < SEAL_PASSES; pass++) {
+        const r = sealPending(db, {
+            scope: o.scope,
+            replica: o.replica,
+            now,
+            env,
+            ...(o.allowUnreleased ? { allowUnreleased: true } : {}),
+        });
+        sealed += r.txns;
+        if (r.refused !== null || r.captures === 0 || r.pending.length > 0)
+            break;
+    }
+    let built = 0;
+    for (;;) {
+        const seg = buildSegment(db, {
+            stream: o.stream,
+            replica: o.replica,
+            scope: o.scope,
+            project: o.project,
+            sealer: o.sealer,
+            signTxn: o.signTxn,
+            nowIso: new Date(now()).toISOString(),
+        });
+        if (seg === null)
+            break;
+        built += 1;
+        // §2.8: the registry follows the store; a crash before this leaves the
+        // store ahead of it, the safe direction.
+        if (o.registry?.get(o.replica))
+            o.registry.advanceHwm(o.replica, o.stream, seg.replicaSeq);
+    }
+    let pushed = 0;
+    let duplicates = 0;
+    let lastServerSeq = null;
+    for (const seg of unpushedSegments(db, o.stream, o.replica)) {
+        const stored = await o.upload(seg);
+        markSegmentPushed(db, {
+            stream: o.stream,
+            replica: o.replica,
+            replicaSeq: seg.replicaSeq,
+            serverSeq: stored.seq,
+            nowIso: new Date(now()).toISOString(),
+        });
+        pushed += 1;
+        if (stored.duplicate)
+            duplicates += 1;
+        lastServerSeq = stored.seq;
+    }
+    return empty(o.stream, { sealed, built, pushed, duplicates, lastServerSeq });
+}
+//# sourceMappingURL=push.js.map

package/dist/store/sync/push.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push.js","sourceRoot":"","sources":["../../../src/store/sync/push.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAEL,YAAY,EACZ,iBAAiB,EAGjB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAEvB,yFAAyF;AACzF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C,mGAAmG;AACnG,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB,mGAAmG;AACnG,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAuElD,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,MAAiC,EAAoB,EAAE,CAAC,CAAC;IACtF,MAAM;IACN,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,UAAU,EAAE,CAAC;IACb,aAAa,EAAE,IAAI;IACnB,GAAG,MAAM;CACV,CAAC,CAAC;AAEH,4CAA4C;AAC5C,kEAAkE;AAClE,SAAS,WAAW,CAAC,EAAgB,EAAE,GAAW,EAAE,KAAoB,EAAE,KAAa;IACrF,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,EAAE,CAAC,OAAO,CACR,mEAAmE;QACjE,yFAAyF,CAC5F,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAgB,EAChB,CAAoB;IAEpB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAC;QAChC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE;YACrB,OAAO,EAAE,2BAA2B;YACpC,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CAAC;IACL,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC;QACrC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IACnF,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE;YACrB,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,kEAAkE;YACtF,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE;YACrB,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,8EAA8E;YAClG,WAAW,EAAE,iBAAiB;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;IACpB,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,+DAA+D;IAC/D,gFAAgF;IAChF,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QAC9B,WAAW,CACT,EAAE,EACF,gBAAgB,EAChB,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAC3D,KAAK,CACN,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IAChE,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,YAAY,CAAC,EAAE,CAAC;QAC3C,WAAW,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,WAAW,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACxD,IAAI,CAAC,CAAC,oBAAoB,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,oBAAoB,GAAG,KAAK,CAAC,EAAE,CAAC;QAC1F,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE;YACrB,OAAO,EAAE,+BAA+B,CAAC,CAAC,oBAAoB,eAAe,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,mCAAmC,KAAK,IAAI,MAAM,sFAAsF;YAC7O,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,2EAA2E;IAC3E,2BAA2B;IAC3B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,EAAE;YACxB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,GAAG;YACH,GAAG;YACH,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC;QACjB,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM;IAC5E,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE;YAC3B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM;QACxB,KAAK,IAAI,CAAC,CAAC;QACX,uEAAuE;QACvE,yCAAyC;QACzC,IAAI,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,iBAAiB,CAAC,EAAE,EAAE;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,SAAS,EAAE,MAAM,CAAC,GAAG;YACrB,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,CAAC;QACZ,IAAI,MAAM,CAAC,SAAS;YAAE,UAAU,IAAI,CAAC,CAAC;QACtC,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;AAC/E,CAAC"}

package/dist/store/sync/replay-pin.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The replay pin of a checkpoint (journal spec §2.11 §7; NEW-9, R5-8,
+ * T12797): what an endorsing device must replay under to recompute the
+ * checkpoint's tallies.
+ *
+ * - `journal`: sha256 over the store's WHOLE ordered migration journal,
+ *   `(created_at, name, hash)` per applied migration, in drizzle's order
+ *   `(created_at, name)`. A single head is not enough: stamped and drifted
+ *   stores differ below it.
+ * - `triggerSetHash`: sha256 over the normalized DDL of the store's OWNED
+ *   triggers ({@link OWNED_TRIGGERS}: the guard and side-effect triggers a
+ *   replay runs under), sorted by name. Device-local maintenance triggers
+ *   (the twin-collapse docs freeze, whose message names the build that froze
+ *   that store, and the legacy track triggers) never touch a replayed table,
+ *   so they stay out: two devices with the same replay semantics agree
+ *   (T13298). Normalization is literal-safe ({@link normalizeTriggerDdl}).
+ * - `transitions`: the schema rise points inside the checkpoint's window;
+ *   the caller computes them from the segments it replayed (empty for a
+ *   genesis checkpoint, which has no window to replay).
+ *
+ * The server cannot check the two hashes; another device recomputes them
+ * from its own store and requires a match before it endorses.
+ *
+ * @task T12343
+ * @module store/sync/replay-pin
+ */
+import type { DatabaseSync } from 'node:sqlite';
+import type { ReplayPin } from '@cleocode/contracts/cloud';
+/**
+ * Normalize trigger DDL for hashing, literal-safely (§2.11 §7): comments are
+ * dropped; outside string literals and quoted identifiers, whitespace runs
+ * collapse to one space (and vanish next to punctuation) and words are
+ * lower-cased; a string literal is kept byte for byte (`'Done'` stays
+ * `'Done'`); every quoted identifier (`"x"`, `` `x` ``, `[x]`) is written
+ * `"x"`, and a bare identifier stays bare (SQLite treats both alike for the
+ * names a trigger uses, so the two spellings of one trigger hash alike only
+ * when quoting is unified this way).
+ *
+ * @param sql - The trigger's `CREATE TRIGGER` text.
+ * @returns The normalized text.
+ */
+export declare function normalizeTriggerDdl(sql: string): string;
+/**
+ * sha256 of the store's whole ordered migration journal (§2.11 §7): every
+ * `__drizzle_migrations` row as `[created_at, name, hash]`, ordered by
+ * `(created_at, name)`. A store without the journal hashes an empty list.
+ *
+ * @param db - The store.
+ * @returns The hex digest.
+ */
+export declare function migrationJournalHash(db: DatabaseSync): string;
+/**
+ * sha256 over the normalized DDL of every owned trigger present in the store
+ * ({@link OWNED_TRIGGERS}), sorted by name (§2.11 §7; T13298). Capture
+ * triggers (generated per build) and device-local maintenance triggers are
+ * excluded: they never run in a replay.
+ *
+ * @param db - The store.
+ * @returns The hex digest.
+ */
+export declare function triggerSetHash(db: DatabaseSync): string;
+/**
+ * A checkpoint's replay pin, from the store it snapshots (§2.11 §7).
+ *
+ * @param db - The store (or the snapshot of it the checkpoint carries).
+ * @param transitions - The window's schema rise points (empty for genesis).
+ * @returns The pin.
+ */
+export declare function replayPinOf(db: DatabaseSync, transitions?: ReplayPin['transitions']): ReplayPin;
+//# sourceMappingURL=replay-pin.d.ts.map

package/dist/store/sync/replay-pin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-pin.d.ts","sourceRoot":"","sources":["../../../src/store/sync/replay-pin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAO3D;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,YAAY,GAAG,MAAM,CAa7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,YAAY,GAAG,MAAM,CAOvD;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,YAAY,EAChB,WAAW,GAAE,SAAS,CAAC,aAAa,CAAM,GACzC,SAAS,CAMX"}

package/dist/store/sync/replay-pin.js

@@ -0,0 +1,172 @@
+/**
+ * The replay pin of a checkpoint (journal spec §2.11 §7; NEW-9, R5-8,
+ * T12797): what an endorsing device must replay under to recompute the
+ * checkpoint's tallies.
+ *
+ * - `journal`: sha256 over the store's WHOLE ordered migration journal,
+ *   `(created_at, name, hash)` per applied migration, in drizzle's order
+ *   `(created_at, name)`. A single head is not enough: stamped and drifted
+ *   stores differ below it.
+ * - `triggerSetHash`: sha256 over the normalized DDL of the store's OWNED
+ *   triggers ({@link OWNED_TRIGGERS}: the guard and side-effect triggers a
+ *   replay runs under), sorted by name. Device-local maintenance triggers
+ *   (the twin-collapse docs freeze, whose message names the build that froze
+ *   that store, and the legacy track triggers) never touch a replayed table,
+ *   so they stay out: two devices with the same replay semantics agree
+ *   (T13298). Normalization is literal-safe ({@link normalizeTriggerDdl}).
+ * - `transitions`: the schema rise points inside the checkpoint's window;
+ *   the caller computes them from the segments it replayed (empty for a
+ *   genesis checkpoint, which has no window to replay).
+ *
+ * The server cannot check the two hashes; another device recomputes them
+ * from its own store and requires a match before it endorses.
+ *
+ * @task T12343
+ * @module store/sync/replay-pin
+ */
+import { createHash } from 'node:crypto';
+import { hasTable } from './schema.js';
+import { canonicalJson } from './sealer-values.js';
+import { OWNED_TRIGGERS } from './trigger-classes.js';
+const sha256Hex = (s) => createHash('sha256').update(s, 'utf8').digest('hex');
+/**
+ * Normalize trigger DDL for hashing, literal-safely (§2.11 §7): comments are
+ * dropped; outside string literals and quoted identifiers, whitespace runs
+ * collapse to one space (and vanish next to punctuation) and words are
+ * lower-cased; a string literal is kept byte for byte (`'Done'` stays
+ * `'Done'`); every quoted identifier (`"x"`, `` `x` ``, `[x]`) is written
+ * `"x"`, and a bare identifier stays bare (SQLite treats both alike for the
+ * names a trigger uses, so the two spellings of one trigger hash alike only
+ * when quoting is unified this way).
+ *
+ * @param sql - The trigger's `CREATE TRIGGER` text.
+ * @returns The normalized text.
+ */
+export function normalizeTriggerDdl(sql) {
+    const out = [];
+    let i = 0;
+    let space = false;
+    const push = (tok, word) => {
+        const prev = out[out.length - 1];
+        // One space between two word-like tokens; none around punctuation.
+        if (space && prev !== undefined && word && /[\w"'\]`]$/.test(prev))
+            out.push(' ');
+        out.push(tok);
+        space = false;
+    };
+    while (i < sql.length) {
+        const c = sql[i];
+        if (/\s/.test(c)) {
+            space = true;
+            i += 1;
+        }
+        else if (sql.startsWith('--', i)) {
+            const end = sql.indexOf('\n', i);
+            i = end === -1 ? sql.length : end;
+            space = true;
+        }
+        else if (sql.startsWith('/*', i)) {
+            const end = sql.indexOf('*/', i + 2);
+            i = end === -1 ? sql.length : end + 2;
+            space = true;
+        }
+        else if (c === "'") {
+            let j = i + 1;
+            for (;;) {
+                if (j >= sql.length)
+                    break;
+                if (sql[j] === "'") {
+                    if (sql[j + 1] === "'")
+                        j += 2;
+                    else
+                        break;
+                }
+                else
+                    j += 1;
+            }
+            push(sql.slice(i, j + 1), true);
+            i = j + 1;
+        }
+        else if (c === '"' || c === '`' || c === '[') {
+            const close = c === '[' ? ']' : c;
+            let j = i + 1;
+            let name = '';
+            for (;;) {
+                if (j >= sql.length)
+                    break;
+                if (sql[j] === close) {
+                    if (close !== ']' && sql[j + 1] === close) {
+                        name += close;
+                        j += 2;
+                    }
+                    else
+                        break;
+                }
+                else {
+                    name += sql[j];
+                    j += 1;
+                }
+            }
+            push(`"${name.replaceAll('"', '""')}"`, true);
+            i = j + 1;
+        }
+        else if (/[\w$]/.test(c)) {
+            let j = i;
+            while (j < sql.length && /[\w$]/.test(sql[j]))
+                j += 1;
+            push(sql.slice(i, j).toLowerCase(), true);
+            i = j;
+        }
+        else {
+            push(c, false);
+            i += 1;
+        }
+    }
+    return out.join('').replace(/;$/, '');
+}
+/**
+ * sha256 of the store's whole ordered migration journal (§2.11 §7): every
+ * `__drizzle_migrations` row as `[created_at, name, hash]`, ordered by
+ * `(created_at, name)`. A store without the journal hashes an empty list.
+ *
+ * @param db - The store.
+ * @returns The hex digest.
+ */
+export function migrationJournalHash(db) {
+    const rows = hasTable(db, '__drizzle_migrations')
+        ? db
+            .prepare('SELECT created_at, name, hash FROM main."__drizzle_migrations" ORDER BY created_at, name')
+            .all()
+        : [];
+    return sha256Hex(canonicalJson(rows.map((r) => [r.created_at === null ? null : Number(r.created_at), r.name, r.hash])));
+}
+/**
+ * sha256 over the normalized DDL of every owned trigger present in the store
+ * ({@link OWNED_TRIGGERS}), sorted by name (§2.11 §7; T13298). Capture
+ * triggers (generated per build) and device-local maintenance triggers are
+ * excluded: they never run in a replay.
+ *
+ * @param db - The store.
+ * @returns The hex digest.
+ */
+export function triggerSetHash(db) {
+    const rows = db
+        .prepare("SELECT name, sql FROM main.sqlite_master WHERE type = 'trigger' ORDER BY name")
+        .all().filter((r) => Object.hasOwn(OWNED_TRIGGERS, r.name) && r.sql !== null);
+    return sha256Hex(canonicalJson(rows.map((r) => [r.name, normalizeTriggerDdl(r.sql)])));
+}
+/**
+ * A checkpoint's replay pin, from the store it snapshots (§2.11 §7).
+ *
+ * @param db - The store (or the snapshot of it the checkpoint carries).
+ * @param transitions - The window's schema rise points (empty for genesis).
+ * @returns The pin.
+ */
+export function replayPinOf(db, transitions = []) {
+    return {
+        journal: migrationJournalHash(db),
+        triggerSetHash: triggerSetHash(db),
+        transitions: [...transitions],
+    };
+}
+//# sourceMappingURL=replay-pin.js.map

package/dist/store/sync/replay-pin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-pin.js","sourceRoot":"","sources":["../../../src/store/sync/replay-pin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE9F;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,IAAa,EAAQ,EAAE;QAChD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjC,mEAAmE;QACnE,IAAI,KAAK,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClF,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,KAAK,GAAG,KAAK,CAAC;IAChB,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAW,CAAC;QAC3B,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,KAAK,GAAG,IAAI,CAAC;YACb,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACjC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;YACtC,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,SAAS,CAAC;gBACR,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM;oBAAE,MAAM;gBAC3B,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACnB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;wBAAE,CAAC,IAAI,CAAC,CAAC;;wBAC1B,MAAM;gBACb,CAAC;;oBAAM,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,SAAS,CAAC;gBACR,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM;oBAAE,MAAM;gBAC3B,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACrB,IAAI,KAAK,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;wBAC1C,IAAI,IAAI,KAAK,CAAC;wBACd,CAAC,IAAI,CAAC,CAAC;oBACT,CAAC;;wBAAM,MAAM;gBACf,CAAC;qBAAM,CAAC;oBACN,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;oBACf,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;YACH,CAAC;YACD,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAW,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YAChE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;YAC1C,CAAC,GAAG,CAAC,CAAC;QACR,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACf,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAgB;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,sBAAsB,CAAC;QAC/C,CAAC,CAAE,EAAE;aACA,OAAO,CACN,0FAA0F,CAC3F;aACA,GAAG,EAAuF;QAC/F,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,SAAS,CACd,aAAa,CACX,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CACvF,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,EAAgB;IAC7C,MAAM,IAAI,GACR,EAAE;SACC,OAAO,CAAC,+EAA+E,CAAC;SACxF,GAAG,EACP,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IACzE,OAAO,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,EAAgB,EAChB,cAAwC,EAAE;IAE1C,OAAO;QACL,OAAO,EAAE,oBAAoB,CAAC,EAAE,CAAC;QACjC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;QAClC,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;KAC9B,CAAC;AACJ,CAAC"}

package/dist/store/sync/sealer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sealer.d.ts","sourceRoot":"","sources":["../../../src/store/sync/sealer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAItD,OAAO,EACL,KAAK,eAAe,EAMrB,MAAM,cAAc,CAAC;AAsBtB,OAAO,EAA4B,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAK9E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAM9E,6EAA6E;AAC7E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAClC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACxC;AAED,uCAAuC;AACvC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxF,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;QAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC,CAAC;IACH,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAoCD,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAydD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CACtB,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,IAAI,CAEf;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACxD,uFAAuF;IACvF,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACzD,6CAA6C;IAC7C,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC5D,0FAA0F;IAC1F,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC7D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,aAAa,CAShF;AAkCD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,YAAY,EAChB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,eAAe,UAAQ,GACtB,MAAM,GAAG,IAAI,CAgBf;AAED,oEAAoE;AACpE,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAU3E;AAoID,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAkJzD;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,GACZ,WAAW,CAAC,MAAM,CAAC,CAMrB;AAiaD,qGAAqG;AACrG,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AAErD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,CAgB1E;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wCAAwC;AACxC,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;CAClC;AAkBD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,aAAa,CA+BxF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,aAAa,GACtB,eAAe,CA6CjB"}
+{"version":3,"file":"sealer.d.ts","sourceRoot":"","sources":["../../../src/store/sync/sealer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAItD,OAAO,EACL,KAAK,eAAe,EAMrB,MAAM,cAAc,CAAC;AAsBtB,OAAO,EAA4B,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAK9E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAM9E,6EAA6E;AAC7E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAClC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACxC;AAED,uCAAuC;AACvC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxF,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;QAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC,CAAC;IACH,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAoCD,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAydD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CACtB,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,IAAI,CAEf;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACxD,uFAAuF;IACvF,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACzD,6CAA6C;IAC7C,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC5D,0FAA0F;IAC1F,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC7D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,aAAa,CAShF;AAkCD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,YAAY,EAChB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,eAAe,UAAQ,GACtB,MAAM,GAAG,IAAI,CAgBf;AAED,oEAAoE;AACpE,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAU3E;AAoID,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAkJzD;;;;;;;;;;;;GAYG;AACH,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,GACZ,WAAW,CAAC,MAAM,CAAC,CAMrB;AAqaD,qGAAqG;AACrG,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AAErD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,CAgB1E;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wCAAwC;AACxC,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;CAClC;AAkBD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,GAAG,aAAa,CA+BxF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,YAAY,EAChB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,aAAa,GACtB,eAAe,CA6CjB"}

package/dist/store/sync/sealer.js

@@ -50,7 +50,7 @@ import { naturalRowUid } from '../row-identity.js';
 import { BIRTH_FP_COLUMN, rowIdentitySpec, UID_COLUMN } from '../row-identity-registry.js';
 import { loadFrameIntents, subtractApplyIntents } from './apply-intent.js';
 import { captureTableDef, chunkedObject, enc, SECRET_MARKER, syncSetTables, } from './capture.js';
-import { tickClock, withImmediateTransaction } from './clock-store.js';
+import { sealWallCeiling, tickClock, withImmediateTransaction } from './clock-store.js';
 import { actorOpOf, clearFieldLeaves, localFrontierUpdates, localLeaves, recordFieldLeaves, setFieldFrontiers, } from './field-leave.js';
 import { isSyncFlagOn, legacyStrandRemedy, legacyStrandsCached, UNRELEASED_FLAGS, } from './flags.js';
 import { mergeGroupsOf } from './merge/rules.js';
@@ -887,6 +887,10 @@ function sealInTransaction(db, opts, budget, now) {
     const started = performance.now();
     const maxMs = opts.maxMs ?? 200;
     const replica = opts.replica;
+    // §1.3: a capture stamped while this clock ran ahead seals no later than
+    // the server's date plus MAX_DRIFT, once a recent server date is known.
+    const ceiling = sealWallCeiling(db, now());
+    const wall = (ms) => (ceiling === null ? ms : Math.min(ms, ceiling));
     // 1. Read a batch. A frame cut by the budget is completed only when it is
     //    the batch's first group (it must seal whole); otherwise it is left for
     //    the next batch, so the extension stays bounded (T13032).
@@ -1118,7 +1122,7 @@ function sealInTransaction(db, opts, budget, now) {
                 ...rest,
                 seq,
                 last,
-                h: tickClock(db, replica, at(op)?.at_ms ?? now()),
+                h: tickClock(db, replica, wall(at(op)?.at_ms ?? now())),
             };
         });
         const txnHlc = sealedOps.reduce((m, o) => (o.h > m ? o.h : m), sealedOps[0]?.h ?? '');