@cueloop/daemon 0.1.0-alpha.63 → 0.1.0-alpha.65

package/src/server.ts

@@ -16,19 +16,28 @@ import {
 } from "node:fs";
 import { DaemonCore, type DaemonEvent } from "./api";
 import { DaemonError } from "./errors";
-import { roleAllowsMethod, type DaemonRole } from "./capabilities";
+import { DEFAULT_ROLE, roleAllowsMethod, type DaemonRole } from "./capabilities";
 import { isKnownMethod, parseParams, type MethodName } from "./validate";
-import { BackpressureWriter, LineBuffer, type Request } from "./protocol";
-import { cueloopHome, lockPath, pidPath, socketPath } from "./paths";
+import {
+  BackpressureWriter,
+  LineBuffer,
+  parseRequestFrame,
+  type Request,
+  type Response,
+} from "./protocol";
+import { cueloopHome, lockPath, ownerTokenPath, pidPath, socketPath } from "./paths";
+import { randomBytes } from "node:crypto";
 
 interface Connection {
+  /** The author a non-owner connection acts as, bound in the handshake. */
+  author?: string;
   write(data: string): void;
   subscribed: boolean;
   /** Capability role for this connection; the owner until a daemon.hello caps it. */
   role: DaemonRole;
 }
 
-type MethodHandler = (connection: Connection, request: Request) => unknown;
+type MethodHandler = (connection: Connection, request: Request) => Response["result"];
 
 export interface DaemonOptions {
   home?: string;
@@ -51,6 +60,8 @@ export class DaemonServer {
   private server: ReturnType<typeof Bun.listen> | null = null;
   private idleTimer: ReturnType<typeof setTimeout> | null = null;
   private lockFd: number | null = null;
+  /** The secret that proves ownership; minted per daemon run, readable by the home's user only. */
+  private ownerToken = "";
   private readonly idleExitMs: number;
   private readonly onIdleExit: () => void;
 
@@ -139,6 +150,11 @@ export class DaemonServer {
     // safe now: holding the lock means no live daemon owns this home, so any
     // socket file left behind is stale
     if (existsSync(path)) rmSync(path, { force: true });
+    // the token exists before the socket does: the first client to connect
+    // must be able to prove ownership
+    this.ownerToken = randomBytes(32).toString("hex");
+    writeFileSync(ownerTokenPath(this.home), this.ownerToken, { mode: 0o600 });
+    chmodSync(ownerTokenPath(this.home), 0o600);
     this.server = Bun.listen<{
       buffer: LineBuffer;
       connection: Connection;
@@ -151,7 +167,7 @@ export class DaemonServer {
           const connection: Connection = {
             write: (data) => writer.write(data),
             subscribed: false,
-            role: "owner",
+            role: DEFAULT_ROLE,
           };
 
           socket.data = { buffer: new LineBuffer(), connection, writer };
@@ -188,6 +204,7 @@ export class DaemonServer {
     this.server = null;
     rmSync(socketPath(this.home), { force: true });
     rmSync(pidPath(this.home), { force: true });
+    rmSync(ownerTokenPath(this.home), { force: true });
     if (this.idleTimer) clearTimeout(this.idleTimer);
     this.releaseLock();
   }
@@ -217,7 +234,7 @@ export class DaemonServer {
     let request: Request;
 
     try {
-      request = JSON.parse(line) as Request;
+      request = parseRequestFrame(line);
     } catch {
       connection.write(
         JSON.stringify({ id: -1, error: { code: "bad_json", message: "unparseable request" } }) +
@@ -241,7 +258,16 @@ export class DaemonServer {
   private readonly handlers: Record<MethodName, MethodHandler> = {
     "daemon.ping": () => ({ pid: process.pid }),
     "daemon.hello": (connection, request) => {
-      connection.role = parseParams("daemon.hello", request.params).role;
+      const params = parseParams("daemon.hello", request.params);
+
+      // ownership is proven, never declared: the token lives in the home
+      // directory the daemon serves, readable by its user alone
+      if (params.role === "owner" && params.token !== this.ownerToken) {
+        throw new DaemonError("forbidden", "owner token required");
+      }
+      connection.role = params.role;
+      // identity is bound once, here; a non-owner never names it per call
+      if (params.role !== "owner" && params.author !== undefined) connection.author = params.author;
 
       return {};
     },
@@ -277,16 +303,78 @@ export class DaemonServer {
 
       return this.core.sessionAnnotate(params.id, params.annotation, params.authorName);
     },
-    "session.removeAnnotation": (_connection, request) => {
+    "session.removeAnnotation": (connection, request) => {
       const params = parseParams("session.removeAnnotation", request.params);
 
-      return this.core.sessionRemoveAnnotation(params.id, params.annotationId);
+      // the owner removes any comment; a non-owner only the ones of the author it is bound to
+      if (connection.role !== "owner" && connection.author === undefined) {
+        throw new DaemonError(
+          "forbidden",
+          "a non-owner connection removes comments as its bound author",
+        );
+      }
+
+      return this.core.sessionRemoveAnnotation(
+        params.id,
+        params.annotationId,
+        connection.role === "owner" ? undefined : connection.author,
+      );
+    },
+    "session.setParticipantName": (connection, request) => {
+      const params = parseParams("session.setParticipantName", request.params);
+
+      // the owner names anyone; a non-owner names only the author it is bound to
+      if (connection.role !== "owner" && params.author !== connection.author) {
+        throw new DaemonError("forbidden", "a non-owner connection names only its bound author");
+      }
+
+      return this.core.sessionSetParticipantName(params.id, params.author, params.name);
     },
     "session.setWorkingCopy": (_connection, request) => {
       const params = parseParams("session.setWorkingCopy", request.params);
 
       return this.core.sessionSetWorkingCopy(params.id, params.workingCopy);
     },
+    "session.cutBlock": (_connection, request) => {
+      const params = parseParams("session.cutBlock", request.params);
+
+      return this.core.sessionCutBlock(params.id, params.blockIndex);
+    },
+    "session.navigate": (_connection, request) => {
+      const params = parseParams("session.navigate", request.params);
+
+      return this.core.sessionNavigate(params.id, params.entryId, params.summary, params.branch);
+    },
+    "session.branch": (_connection, request) => {
+      const params = parseParams("session.branch", request.params);
+
+      return this.core.sessionBranch(params.id, params.name);
+    },
+    "session.switch": (_connection, request) => {
+      const params = parseParams("session.switch", request.params);
+
+      return this.core.sessionSwitch(params.id, params.branch);
+    },
+    "session.label": (_connection, request) => {
+      const params = parseParams("session.label", request.params);
+
+      return this.core.sessionLabel(params.id, params.label);
+    },
+    "session.fork": (_connection, request) => {
+      const params = parseParams("session.fork", request.params);
+
+      return this.core.sessionFork(params.id);
+    },
+    "session.restoreBlock": (_connection, request) => {
+      const params = parseParams("session.restoreBlock", request.params);
+
+      return this.core.sessionRestoreBlock(params.id, params.baseBlockIndex, params.line);
+    },
+    "session.curate": (_connection, request) => {
+      const params = parseParams("session.curate", request.params);
+
+      return this.core.sessionCurate(params.id, params.rejections);
+    },
     "session.setViewed": (_connection, request) => {
       const params = parseParams("session.setViewed", request.params);
 
@@ -313,6 +401,7 @@ export class DaemonServer {
       return this.core.sessionMergeShared(params.id, {
         annotations: params.annotations,
         participants: params.participants,
+        removals: params.removals,
       });
     },
     "session.resolve": (_connection, request) => {
@@ -340,13 +429,13 @@ export class DaemonServer {
     },
   };
 
-  private async dispatch(connection: Connection, request: Request): Promise<unknown> {
+  private async dispatch(connection: Connection, request: Request): Promise<Response["result"]> {
     // The wire is untrusted JSON: validate before DaemonCore sees anything.
-    if (typeof request.method !== "string" || !isKnownMethod(request.method)) {
-      throw new DaemonError("unknown_method", `unknown method ${String(request.method)}`);
+    if (!isKnownMethod(request.method)) {
+      throw new DaemonError("unknown_method", `unknown method ${request.method}`);
     }
     // Capability gate: a capped role (a review-side agent) cannot escalate past
-    // read + annotate, whatever verb it sends.
+    // read + annotate, whatever primitive it sends.
     if (!roleAllowsMethod(connection.role, request.method)) {
       throw new DaemonError("forbidden", `role ${connection.role} cannot call ${request.method}`);
     }

package/src/share-blob.test.ts

@@ -3,7 +3,7 @@ import { gzipSync } from "node:zlib";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import type { Artifact, WorkspaceKey } from "@cueloop/schema";
+import { viewFollowing, type Artifact, type WorkspaceKey } from "@cueloop/schema";
 import { DaemonCore } from "./api";
 import { MAX_BLOB_BYTES, packSessionBlob, unpackSessionBlob } from "./share-blob";
 
@@ -38,6 +38,56 @@ describe("share blob roundtrip", () => {
   });
 });
 
+describe("the payload cap against a long review", () => {
+  test("a plan the size of the examples with a long discussion and its history stays far under the cap", () => {
+    // Arrange: the largest example plan, 200 rounds of comment + reply, 20 reviewer edits, 10 removals
+    const paragraph =
+      "Review sessions currently live only in daemon memory. If the daemon crashes mid-review, every pending annotation is lost. This plan makes sessions durable without changing the daemon's socket protocol.\n\n";
+    const content = `# Implementation Plan: Session Persistence\n\n## Context\n\n${paragraph.repeat(8)}`;
+    const session = core.sessionCreate({
+      workspace: WS,
+      artifact: { type: "plan", content, meta: {} },
+    });
+
+    for (let round = 0; round < 200; round++) {
+      core.sessionAnnotate(session.id, {
+        id: `a_${round}`,
+        kind: "comment",
+        anchor: { quote: "daemon memory", prefix: "live only in ", suffix: ". If the" },
+        body: `Round ${round}: what happens when the store directory is read-only at startup?`,
+        author: "SHA256:collaborator-fingerprint-0123456789abcdef",
+      });
+      core.sessionAnnotate(session.id, {
+        id: `r_${round}`,
+        kind: "comment",
+        anchor: { quote: "daemon memory", prefix: "live only in ", suffix: ". If the" },
+        body: "Fail fast with a readable error; the review never opens on a store that cannot write.",
+        replyTo: `a_${round}`,
+      });
+      if (round % 10 === 0)
+        core.sessionSetWorkingCopy(session.id, `${content}\n\nEdit ${round}.\n`);
+      if (round % 20 === 0) core.sessionRemoveAnnotation(session.id, `r_${round}`);
+    }
+    const shared = viewFollowing(core.sessionGet(session.id));
+
+    // Act
+    const decompressed = Buffer.byteLength(JSON.stringify(shared), "utf8");
+    const packed = packSessionBlob(shared).byteLength;
+
+    // Assert: a quarter of the cap decompressed, and the packed blob a small
+    // fraction of it; the round-trip holds
+    expect(shared.history!.entries.length).toBeGreaterThan(400);
+    expect(decompressed).toBeLessThan(MAX_BLOB_BYTES / 4);
+    expect(packed).toBeLessThan(decompressed);
+    expect(unpackSessionBlob(packSessionBlob(shared)).history!.entries.length).toBe(
+      shared.history!.entries.length,
+    );
+    console.info(
+      `share payload: ${shared.history!.entries.length} entries, ${decompressed} bytes decompressed, ${packed} bytes packed, cap ${MAX_BLOB_BYTES}`,
+    );
+  });
+});
+
 describe("unpack rejects bad input", () => {
   test("caps the decompressed size, so a compression bomb throws", () => {
     // Arrange: tiny gzip, huge inflation - the decompression-bomb shape

package/src/share-blob.ts

@@ -51,5 +51,5 @@ export function unpackSessionBlob(bytes: Uint8Array): ReviewSession {
 
   if (!parsed.ok) throw new Error(`blob is not a valid session: ${parsed.error}`);
 
-  return parsed.value as ReviewSession;
+  return parsed.value;
 }

package/src/store.conformance.test.ts

@@ -0,0 +1,41 @@
+import { mkdtempSync, writeFileSync } from "node:fs";
+import * as v from "valibot";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { MemorySessionStore, SessionStore, type SessionRepository } from "./store";
+import { sessionsDir } from "./paths";
+import { runSessionStoreConformance } from "./testing/store-conformance";
+
+const homes = new WeakMap<SessionRepository, string>();
+
+runSessionStoreConformance("file store", {
+  open: (records) => {
+    const home = mkdtempSync(join(tmpdir(), "cueloop-store-"));
+    const store = new SessionStore(home);
+
+    // records land on disk the way an earlier daemon would have written them;
+    // the file name comes from the record's id when it has one
+    records.forEach((record, index) => {
+      const named = v.safeParse(v.object({ id: v.string() }), record);
+      const id = named.success ? named.output.id : `bad_${index}`;
+
+      writeFileSync(join(sessionsDir(home), `${id}.json`), JSON.stringify(record));
+    });
+    homes.set(store, home);
+
+    return store;
+  },
+  restart: (store) => {
+    const reopened = new SessionStore(homes.get(store)!);
+
+    homes.set(reopened, homes.get(store)!);
+
+    return reopened;
+  },
+});
+
+runSessionStoreConformance("memory store", {
+  open: (records) => new MemorySessionStore(records),
+  // nothing persists past the instance: a restart recovers what it was seeded with
+  restart: (store) => new MemorySessionStore(store.list()),
+});

package/src/store.ts

@@ -1,22 +1,55 @@
 /**
- * Session persistence: one JSON document per session, every write
- * through a temp file + atomic rename so a crash mid-write can never leave
- * a corrupt record. Recovery is a read-only scan; records that fail to
- * parse are skipped and reported, never deleted.
+ * Session persistence: one JSON record per session, written whole through a
+ * temp file and an atomic rename so a crash never leaves a torn file. Recovery
+ * is a read-only scan of the state directory; records that fail to parse are
+ * skipped and reported, never deleted, and records from before histories
+ * existed are given one on read.
+ *
+ * `SessionRepository` is the contract every adapter satisfies; the conformance
+ * suite in ./testing/store-conformance.ts pins it for the file store and the
+ * in-memory store alike.
  */
 
 import { mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import type { ReviewSession } from "@cueloop/schema";
-import { validateSessionRecord } from "./validate";
+import { historyFromLinear, type ReviewSession } from "@cueloop/schema";
 import { sessionsDir } from "./paths";
+import { validateSessionRecord } from "./validate";
 
 export interface RecoveryReport {
   recovered: string[];
   skipped: { file: string; error: string }[];
 }
 
-export class SessionStore {
+/** What the daemon needs from session storage. */
+export interface SessionRepository {
+  /** Load what is stored; called once on boot. */
+  recover(): RecoveryReport;
+  get(id: string): ReviewSession | undefined;
+  /** Every session, oldest first. */
+  list(): ReviewSession[];
+  upsert(session: ReviewSession): void;
+  /** True when a session was removed. */
+  delete(id: string): boolean;
+}
+
+/**
+ * A record as it is read: a history is derived for records written without
+ * one. A record with no revision has no head to derive from and keeps
+ * reading without a history - migration never loses a record.
+ */
+export function withHistory(session: ReviewSession): ReviewSession {
+  if (session.history || session.revisions.length === 0) return session;
+
+  return { ...session, history: historyFromLinear(session) };
+}
+
+/** Records in the order `list()` promises: oldest first. */
+function oldestFirst(sessions: Iterable<ReviewSession>): ReviewSession[] {
+  return [...sessions].sort((left, right) => left.createdAt.localeCompare(right.createdAt));
+}
+
+export class SessionStore implements SessionRepository {
   private sessions = new Map<string, ReviewSession>();
   private readonly dir: string;
 
@@ -25,7 +58,6 @@ export class SessionStore {
     mkdirSync(this.dir, { recursive: true });
   }
 
-  /** Read-only scan of the state directory; called once on boot. */
   recover(): RecoveryReport {
     const report: RecoveryReport = { recovered: [], skipped: [] };
 
@@ -36,7 +68,7 @@ export class SessionStore {
         const parsed = validateSessionRecord(JSON.parse(raw));
 
         if (!parsed.ok) throw new Error(`invalid record - ${parsed.error}`);
-        const session = parsed.value as ReviewSession;
+        const session = withHistory(parsed.value);
 
         this.sessions.set(session.id, session);
         report.recovered.push(session.id);
@@ -53,9 +85,7 @@ export class SessionStore {
   }
 
   list(): ReviewSession[] {
-    return [...this.sessions.values()].sort((left, right) =>
-      left.createdAt.localeCompare(right.createdAt),
-    );
+    return oldestFirst(this.sessions.values());
   }
 
   upsert(session: ReviewSession): void {
@@ -74,3 +104,50 @@ export class SessionStore {
     return true;
   }
 }
+
+/**
+ * The in-memory adapter: the same contract with nothing on disk. `seed` stands
+ * in for what a file store finds on recovery, so validation and migration are
+ * exercised the same way.
+ */
+export class MemorySessionStore implements SessionRepository {
+  private sessions = new Map<string, ReviewSession>();
+
+  constructor(private readonly seed: unknown[] = []) {}
+
+  recover(): RecoveryReport {
+    const report: RecoveryReport = { recovered: [], skipped: [] };
+
+    this.seed.forEach((record, index) => {
+      const parsed = validateSessionRecord(record);
+
+      if (!parsed.ok) {
+        report.skipped.push({ file: `seed[${index}]`, error: `invalid record - ${parsed.error}` });
+
+        return;
+      }
+      const session = withHistory(parsed.value);
+
+      this.sessions.set(session.id, session);
+      report.recovered.push(session.id);
+    });
+
+    return report;
+  }
+
+  get(id: string): ReviewSession | undefined {
+    return this.sessions.get(id);
+  }
+
+  list(): ReviewSession[] {
+    return oldestFirst(this.sessions.values());
+  }
+
+  upsert(session: ReviewSession): void {
+    this.sessions.set(session.id, session);
+  }
+
+  delete(id: string): boolean {
+    return this.sessions.delete(id);
+  }
+}

package/src/testing/store-conformance.ts

@@ -0,0 +1,194 @@
+/**
+ * The session repository contract as executable cases. Every adapter runs the
+ * same suite: what a store returns, in which order, what survives a restart,
+ * what a bad record does, and how a record without a history reads.
+ *
+ * `restart` gives back a fresh adapter over the same persisted state (or the
+ * same seed) so recovery is tested through the contract, never past it.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { SCHEMA_VERSION, type ReviewSession } from "@cueloop/schema";
+import type { SessionRepository } from "../store";
+
+export interface StoreHarness {
+  /** A fresh, empty adapter that will recover `records` on `recover()`. */
+  open: (records: unknown[]) => SessionRepository;
+  /** A new adapter over whatever `store` persisted, as after a daemon restart. */
+  restart: (store: SessionRepository) => SessionRepository;
+}
+
+export function createTestSessionRecord(
+  id: string,
+  createdAt: string,
+  overrides: Partial<ReviewSession> = {},
+): ReviewSession {
+  return {
+    schemaVersion: SCHEMA_VERSION,
+    id,
+    workspace: { repoRoot: "/repo", branch: "main" },
+    artifact: { type: "plan", content: `# ${id}`, meta: {} },
+    revisions: [{ revision: 1, content: `# ${id}`, submittedAt: createdAt }],
+    annotations: [],
+    verdict: null,
+    status: "pending",
+    createdAt,
+    ...overrides,
+  };
+}
+
+export function runSessionStoreConformance(name: string, harness: StoreHarness): void {
+  describe(`${name} - session repository contract`, () => {
+    test("a stored session reads back whole and lists oldest first", () => {
+      // Arrange
+      const store = harness.open([]);
+
+      store.recover();
+      const newer = createTestSessionRecord("ses_b", "2026-09-02T00:00:00.000Z");
+      const older = createTestSessionRecord("ses_a", "2026-09-01T00:00:00.000Z");
+
+      // Act
+      store.upsert(newer);
+      store.upsert(older);
+
+      // Assert
+      expect(store.get("ses_a")).toEqual(older);
+      expect(store.list().map((session) => session.id)).toEqual(["ses_a", "ses_b"]);
+      expect(store.get("ses_zzz")).toBeUndefined();
+    });
+
+    test("upsert replaces by id and delete reports whether anything was removed", () => {
+      // Arrange
+      const store = harness.open([]);
+
+      store.recover();
+      store.upsert(createTestSessionRecord("ses_a", "2026-09-01T00:00:00.000Z"));
+
+      // Act
+      store.upsert(
+        createTestSessionRecord("ses_a", "2026-09-01T00:00:00.000Z", { status: "resolved" }),
+      );
+
+      // Assert
+      expect(store.list()).toHaveLength(1);
+      expect(store.get("ses_a")?.status).toBe("resolved");
+      expect(store.delete("ses_a")).toBe(true);
+      expect(store.delete("ses_a")).toBe(false);
+      expect(store.list()).toEqual([]);
+    });
+
+    test("what was upserted survives a restart, deletions included", () => {
+      // Arrange
+      const store = harness.open([]);
+
+      store.recover();
+      store.upsert(createTestSessionRecord("ses_keep", "2026-09-01T00:00:00.000Z"));
+      store.upsert(createTestSessionRecord("ses_gone", "2026-09-02T00:00:00.000Z"));
+      store.delete("ses_gone");
+
+      // Act
+      const reopened = harness.restart(store);
+      const report = reopened.recover();
+
+      // Assert
+      expect(report.recovered).toEqual(["ses_keep"]);
+      expect(reopened.get("ses_keep")?.artifact.content).toBe("# ses_keep");
+      expect(reopened.get("ses_gone")).toBeUndefined();
+    });
+
+    test("a record without a history reads as a one-branch tree whose head is the artifact", () => {
+      // Arrange: written before histories existed, with two revisions and a comment
+      const legacy = createTestSessionRecord("ses_old", "2026-09-01T00:00:00.000Z", {
+        artifact: { type: "plan", content: "v2", meta: {} },
+        revisions: [
+          { revision: 1, content: "v1", submittedAt: "2026-09-01T00:00:00.000Z" },
+          { revision: 2, content: "v2", submittedAt: "2026-09-01T02:00:00.000Z" },
+        ],
+        annotations: [
+          {
+            id: "a1",
+            kind: "comment",
+            anchor: { quote: "v1", prefix: "", suffix: "" },
+            body: "why",
+            createdAt: "2026-09-01T01:00:00.000Z",
+          },
+        ],
+      });
+      const store = harness.open([legacy]);
+
+      // Act
+      const report = store.recover();
+      const history = store.get("ses_old")?.history;
+
+      // Assert
+      expect(report.recovered).toEqual(["ses_old"]);
+      expect(history?.branch).toBe("main");
+      expect(history?.entries.map((entry) => entry.type)).toEqual([
+        "revision",
+        "comment",
+        "revision",
+      ]);
+      expect(history?.entries.at(-1)).toMatchObject({ type: "revision", content: "v2" });
+      expect(history?.tips.main).toBe(history?.entries.at(-1)?.id);
+    });
+
+    test("a record with no revision still recovers, without a history", () => {
+      // Arrange
+      const store = harness.open([
+        createTestSessionRecord("ses_empty", "2026-09-01T00:00:00.000Z", { revisions: [] }),
+      ]);
+
+      // Act
+      const report = store.recover();
+
+      // Assert
+      expect(report.recovered).toEqual(["ses_empty"]);
+      expect(store.get("ses_empty")?.history).toBeUndefined();
+    });
+
+    test("a record that already carries a history keeps it untouched", () => {
+      // Arrange
+      const withTree = createTestSessionRecord("ses_tree", "2026-09-01T00:00:00.000Z", {
+        history: {
+          entries: [
+            {
+              id: "root",
+              parentId: null,
+              type: "revision",
+              by: "agent",
+              content: "# ses_tree",
+              createdAt: "2026-09-01T00:00:00.000Z",
+            },
+          ],
+          tips: { main: "root", ramble: "root" },
+          branch: "ramble",
+          labels: { root: "start" },
+        },
+      });
+      const store = harness.open([withTree]);
+
+      // Act
+      store.recover();
+
+      // Assert
+      expect(store.get("ses_tree")?.history).toEqual(withTree.history);
+    });
+
+    test("a record that fails validation is skipped and reported, never dropped from the report", () => {
+      // Arrange
+      const store = harness.open([
+        createTestSessionRecord("ses_good", "2026-09-01T00:00:00.000Z"),
+        { schemaVersion: SCHEMA_VERSION, id: "ses_bad" },
+      ]);
+
+      // Act
+      const report = store.recover();
+
+      // Assert
+      expect(report.recovered).toEqual(["ses_good"]);
+      expect(report.skipped).toHaveLength(1);
+      expect(report.skipped[0]!.error).toContain("invalid record");
+      expect(store.get("ses_bad")).toBeUndefined();
+    });
+  });
+}