@degenerate/sharedata 0.2.6 → 0.3.1

package/dist/persistence/deserialize-share-data.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deserializeShareData = void 0;
+const generic_1 = require("@degenerate/generic");
+const verify_transaction_proposal_proof_1 = require("../share-data/proofs/verification/verify-transaction-proposal-proof");
+const block_factory_registry_1 = require("./block-factory-registry");
+// Reconstructs a ShareData from its persisted snapshot. This is the trust
+// gate: the snapshot's `expected*` values are NEVER taken as source of truth.
+// The block is rebuilt from scratch by replaying construction (which
+// re-verifies the structural-proof chain) and replaying the transaction log,
+// then the independently rebuilt result is cross-checked against the
+// snapshot's `expected*` fields. Any tampering — a flipped proof, a doctored
+// final state — surfaces as a thrown error rather than a silently trusted load.
+/**
+ * Replays a {@link PersistedShareData} snapshot back into a live, executable
+ * ShareData. The rebuilt block re-binds real function closures (via the
+ * registered builder for its block type), so it accepts new proposals just
+ * like a freshly-created block.
+ *
+ * Throws:
+ *   - {@link ShareDataPersistenceError} for an unsupported schema version, an
+ *     unregistered block type, or a transaction referencing an unknown
+ *     `functionId`.
+ *   - {@link ShareDataStructuralProofFailedError} (from the replayed factory)
+ *     if the structural-proof chain does not verify.
+ *   - {@link ShareDataIntegrityError} if the replayed block diverges from the
+ *     snapshot's `expected*` cross-checks.
+ */
+const deserializeShareData = (snapshot) => {
+    // Read id + schemaVersion defensively *before* full validation so an
+    // unsupported version yields a precise persistence error (naming the id)
+    // rather than a raw Zod failure on the `schemaVersion` literal.
+    const rawId = typeof snapshot?.id === 'string'
+        ? snapshot.id
+        : 'unknown';
+    const rawVersion = snapshot?.schemaVersion;
+    if (rawVersion !== generic_1.PERSISTED_SHARE_DATA_SCHEMA_VERSION) {
+        throw new generic_1.ShareDataPersistenceError(rawId, `unsupported schema version ${String(rawVersion)} ` +
+            `(this build understands version ${generic_1.PERSISTED_SHARE_DATA_SCHEMA_VERSION})`);
+    }
+    const parsed = generic_1.PersistedShareDataSchema.parse(snapshot);
+    // `ShareBlockTypeSchema` infers a string-literal union, while the registry
+    // keys on the `ShareBlockType` enum. The two carry identical runtime
+    // values, so this reconstitutes the validated wire string into the domain
+    // enum at the parse boundary.
+    const blockType = parsed.blockType;
+    const builder = (0, block_factory_registry_1.getShareBlockBuilder)(blockType);
+    if (!builder) {
+        throw new generic_1.ShareDataPersistenceError(parsed.id, `no block builder registered for block type "${parsed.blockType}"`);
+    }
+    // Replay construction. The factory re-runs addFunction/addRule, each of
+    // which re-verifies the matching structural proof against the rebuilt
+    // state; a tampered proof or initialCrypto throws here.
+    const block = builder({
+        creationConfig: parsed.creationConfig,
+        initialCrypto: parsed.initialCrypto,
+        structuralProofs: parsed.structuralProofs,
+    });
+    // Replay the transaction log in recorded order.
+    for (const entry of parsed.transactionLog) {
+        const transactionFunction = block.functions.find((fn) => fn.id === entry.functionId);
+        if (!transactionFunction) {
+            throw new generic_1.ShareDataPersistenceError(parsed.id, `transaction log references unknown functionId "${entry.functionId}"`);
+        }
+        // Re-authorize the signer before re-verifying the signature. A tampered
+        // snapshot could swap in a proof validly signed by a *different* key
+        // over the same proposed state — that would pass signature
+        // verification, so the proposer-identity gate (the same one
+        // addTransaction enforces live) must run on replay too. Checked first
+        // so a swapped key fails as a not-authorized error rather than a
+        // signature mismatch.
+        if (entry.proof.publicKey !== block.creationPublicKey) {
+            throw new generic_1.ShareDataTransactionNotAuthorizedError(parsed.id, entry.proof.publicKey);
+        }
+        // Re-verify the transaction proof against the block at its pre-entry
+        // state (where it now sits, having replayed every earlier entry) and
+        // the proposed state about to be applied. This is the runtime arm of
+        // the trust gate: a snapshot whose proposed state or proof was edited
+        // throws ShareDataTransactionProofFailedError here rather than being
+        // loaded. Verifying before the apply keeps the recomputed current hash
+        // aligned with what the signer signed over.
+        (0, verify_transaction_proposal_proof_1.verifyTransactionProposalProof)(entry.proof, block, entry.proposedState, block.signingCurve);
+        // addTransactionAlreadyValidated derives its accept/reject outcome
+        // from (proposedResult && currentResult). Setting both to the stored
+        // boolean replays the original outcome exactly: currentState is
+        // replaced only when the recorded transaction was accepted.
+        const rulesEvaluation = {
+            ruleId: '',
+            currentResult: entry.ruleOutcome,
+            currentConditionFailure: [],
+            proposedResult: entry.ruleOutcome,
+            proposedConditionFailure: [],
+        };
+        // Pass the proof so the rebuilt history entry matches the live one;
+        // the canonical hash folds history in, so a later transaction's proof
+        // verifies only if earlier entries reproduce their proofs.
+        block.addTransactionAlreadyValidated(entry.proposedState, rulesEvaluation, transactionFunction, entry.transactionTime, entry.proof);
+    }
+    // Locking only gates future addFunction/addRule, so applying it after
+    // transaction replay reproduces the snapshot's lock state without
+    // affecting the rebuilt data.
+    if (parsed.expectedIsLocked) {
+        block.initialize();
+    }
+    assertIntegrity(block, parsed);
+    return block;
+};
+exports.deserializeShareData = deserializeShareData;
+/**
+ * Cross-checks the independently rebuilt block against the snapshot's
+ * `expected*` integrity values. A divergence means the snapshot was altered
+ * after signing (or the build that wrote it disagrees with this one), so we
+ * refuse the load with {@link ShareDataIntegrityError}.
+ */
+const assertIntegrity = (block, parsed) => {
+    const mismatch = block.creationHash !== parsed.expectedCreationHash ||
+        block.creationSignature !== parsed.expectedCreationSignature ||
+        block.isLocked !== parsed.expectedIsLocked ||
+        block.version !== parsed.expectedVersion ||
+        canonicalize(block.currentState) !== canonicalize(parsed.expectedCurrentState);
+    if (mismatch) {
+        throw new generic_1.ShareDataIntegrityError(parsed.id);
+    }
+};
+/**
+ * Order-independent JSON canonicalization so `currentState` equality does not
+ * hinge on object key insertion order.
+ */
+const canonicalize = (value) => JSON.stringify(sortKeys(value));
+const sortKeys = (value) => {
+    if (Array.isArray(value)) {
+        return value.map(sortKeys);
+    }
+    if (value && typeof value === 'object') {
+        const source = value;
+        return Object.keys(source)
+            .sort()
+            .reduce((acc, key) => {
+            acc[key] = sortKeys(source[key]);
+            return acc;
+        }, {});
+    }
+    return value;
+};

package/dist/persistence/file-share-data-repository.d.ts

@@ -0,0 +1,30 @@
+import { PersistedShareData } from '@degenerate/generic';
+import { ShareData } from '../share-data/share-data';
+import { ShareDataRepository } from './share-data-repository';
+/**
+ * Persists each ShareData snapshot as a pretty-printed JSON file named after
+ * its id. Writes are atomic (temp file + rename) so a crash mid-write can
+ * never leave a half-written, unverifiable snapshot behind. Loads route
+ * through {@link deserializeShareData}, so a file edited on disk fails
+ * verification instead of loading silently.
+ */
+export declare class FileShareDataRepository implements ShareDataRepository {
+    private readonly directory;
+    constructor(directory: string);
+    save(snapshot: PersistedShareData): Promise<void>;
+    load(id: string): Promise<ShareData | undefined>;
+    loadAll(): Promise<ShareData[]>;
+    loadAllSnapshots(): Promise<PersistedShareData[]>;
+    remove(id: string): Promise<void>;
+    /**
+     * Maps a block id to its on-disk path, guarding against path traversal.
+     * A block id can originate from an untrusted client — the HTTP create
+     * route takes `metadata.shareBlockId` straight from the request body — so
+     * an id like `../../etc/cron.d/x` must never escape the storage directory.
+     * `encodeURIComponent` neutralizes path separators (`/`, `\`) and any `..`
+     * collapses to a literal filename segment; the resolved path is then
+     * re-asserted to be a direct child of the directory as defense in depth.
+     */
+    private resolveFilePath;
+}
+//# sourceMappingURL=file-share-data-repository.d.ts.map

package/dist/persistence/file-share-data-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-share-data-repository.d.ts","sourceRoot":"","sources":["../../src/persistence/file-share-data-repository.ts"],"names":[],"mappings":"AAGA,OAAO,EACH,kBAAkB,EAGrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAS9D;;;;;;GAMG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM;IAExC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBjD,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAchD,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAK/B,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAuBjD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYvC;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;CAY1B"}

package/dist/persistence/file-share-data-repository.js

@@ -0,0 +1,147 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileShareDataRepository = void 0;
+const fs_1 = require("fs");
+const path = __importStar(require("path"));
+const generic_1 = require("@degenerate/generic");
+const deserialize_share_data_1 = require("./deserialize-share-data");
+// File/JSON implementation of {@link ShareDataRepository}: one snapshot per
+// `<directory>/<id>.json` file. The first of the three planned stores — chosen
+// first because it needs no external service yet exercises the full
+// serialize → durable bytes → reload-and-re-verify path, including survival
+// across a process restart (a fresh instance pointed at the same directory
+// reloads everything).
+/**
+ * Persists each ShareData snapshot as a pretty-printed JSON file named after
+ * its id. Writes are atomic (temp file + rename) so a crash mid-write can
+ * never leave a half-written, unverifiable snapshot behind. Loads route
+ * through {@link deserializeShareData}, so a file edited on disk fails
+ * verification instead of loading silently.
+ */
+class FileShareDataRepository {
+    constructor(directory) {
+        this.directory = directory;
+    }
+    async save(snapshot) {
+        await fs_1.promises.mkdir(this.directory, { recursive: true });
+        const filePath = this.resolveFilePath(snapshot.id);
+        // Write to a unique temp file, then rename into place. rename(2) is
+        // atomic within a directory, so a reader (or `loadAll`) never observes
+        // a partially-written file, and a crash leaves either the old snapshot
+        // or the new one — never a corrupt blend.
+        const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+        await fs_1.promises.writeFile(tmpPath, JSON.stringify(snapshot, null, 2), 'utf8');
+        try {
+            await fs_1.promises.rename(tmpPath, filePath);
+        }
+        catch (err) {
+            await fs_1.promises.rm(tmpPath, { force: true });
+            throw err;
+        }
+    }
+    async load(id) {
+        const filePath = this.resolveFilePath(id);
+        let raw;
+        try {
+            raw = await fs_1.promises.readFile(filePath, 'utf8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT') {
+                return undefined;
+            }
+            throw err;
+        }
+        return (0, deserialize_share_data_1.deserializeShareData)(JSON.parse(raw));
+    }
+    async loadAll() {
+        const snapshots = await this.loadAllSnapshots();
+        return snapshots.map((snapshot) => (0, deserialize_share_data_1.deserializeShareData)(snapshot));
+    }
+    async loadAllSnapshots() {
+        let entries;
+        try {
+            entries = await fs_1.promises.readdir(this.directory);
+        }
+        catch (err) {
+            if (err.code === 'ENOENT') {
+                return [];
+            }
+            throw err;
+        }
+        // Only finished snapshots end in `.json`; in-flight `.tmp` writes are
+        // skipped. Sorted for a deterministic load order.
+        const files = entries.filter((file) => file.endsWith('.json')).sort();
+        const snapshots = [];
+        for (const file of files) {
+            const raw = await fs_1.promises.readFile(path.join(this.directory, file), 'utf8');
+            // Schema-validate (not trust-verify) so callers receive a well-typed
+            // snapshot; `deserializeShareData` re-runs the full trust gate.
+            snapshots.push(generic_1.PersistedShareDataSchema.parse(JSON.parse(raw)));
+        }
+        return snapshots;
+    }
+    async remove(id) {
+        const filePath = this.resolveFilePath(id);
+        try {
+            await fs_1.promises.unlink(filePath);
+        }
+        catch (err) {
+            if (err.code === 'ENOENT') {
+                return;
+            }
+            throw err;
+        }
+    }
+    /**
+     * Maps a block id to its on-disk path, guarding against path traversal.
+     * A block id can originate from an untrusted client — the HTTP create
+     * route takes `metadata.shareBlockId` straight from the request body — so
+     * an id like `../../etc/cron.d/x` must never escape the storage directory.
+     * `encodeURIComponent` neutralizes path separators (`/`, `\`) and any `..`
+     * collapses to a literal filename segment; the resolved path is then
+     * re-asserted to be a direct child of the directory as defense in depth.
+     */
+    resolveFilePath(id) {
+        const directory = path.resolve(this.directory);
+        const fileName = `${encodeURIComponent(id)}.json`;
+        const resolved = path.resolve(directory, fileName);
+        if (path.dirname(resolved) !== directory) {
+            throw new generic_1.ShareDataPersistenceError(id, 'refusing to resolve a snapshot path outside the storage directory');
+        }
+        return resolved;
+    }
+}
+exports.FileShareDataRepository = FileShareDataRepository;

package/dist/persistence/firestore-share-data-repository.d.ts

@@ -0,0 +1,38 @@
+import type { firestore } from 'firebase-admin';
+import { PersistedShareData } from '@degenerate/generic';
+import { ShareData } from '../share-data/share-data';
+import { ShareDataRepository } from './share-data-repository';
+/**
+ * Persists each ShareData snapshot as a Firestore document named after its id,
+ * in {@link DatabaseSettingsFirestore.ShareData.Collection} by default. `save`
+ * round-trips the snapshot through JSON to strip `undefined` (Firestore
+ * rejects `undefined` field values) — parity with the file store, which writes
+ * `JSON.stringify`. Loads route through {@link deserializeShareData}, so a
+ * document edited out-of-band fails verification instead of loading silently.
+ */
+export declare class FirestoreShareDataRepository implements ShareDataRepository {
+    private readonly firestore;
+    private readonly collectionName;
+    constructor(firestore: firestore.Firestore, collectionName?: string);
+    save(snapshot: PersistedShareData): Promise<void>;
+    load(id: string): Promise<ShareData | undefined>;
+    loadAll(): Promise<ShareData[]>;
+    loadAllSnapshots(): Promise<PersistedShareData[]>;
+    remove(id: string): Promise<void>;
+    private docRef;
+    /**
+     * Strip `undefined` field values, which Firestore rejects, by round-tripping
+     * through JSON. Matches the file store's `JSON.stringify` semantics so both
+     * stores persist byte-identical snapshots.
+     */
+    private toFirestoreData;
+    /**
+     * Validate a block id against Firestore's document-id rules before it is
+     * used as a path segment. A block id can originate from an untrusted client
+     * (the HTTP create route reads `metadata.shareBlockId` from the request
+     * body), so an id containing `/` — or one Firestore reserves — must be
+     * rejected rather than silently writing to an unexpected document or path.
+     */
+    private docId;
+}
+//# sourceMappingURL=firestore-share-data-repository.d.ts.map

package/dist/persistence/firestore-share-data-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firestore-share-data-repository.d.ts","sourceRoot":"","sources":["../../src/persistence/firestore-share-data-repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAEH,kBAAkB,EAGrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAU9D;;;;;;;GAOG;AACH,qBAAa,4BAA6B,YAAW,mBAAmB;IAEhE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,SAAS,EAAE,SAAS,CAAC,SAAS,EAC9B,cAAc,GAAE,MAAuD;IAGtF,IAAI,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAQhD,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAK/B,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAOjD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,OAAO,CAAC,MAAM;IAId;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAIvB;;;;;;OAMG;IACH,OAAO,CAAC,KAAK;CAYhB"}

package/dist/persistence/firestore-share-data-repository.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FirestoreShareDataRepository = void 0;
+const generic_1 = require("@degenerate/generic");
+const deserialize_share_data_1 = require("./deserialize-share-data");
+// Firestore implementation of {@link ShareDataRepository}: one snapshot per
+// document, keyed by block id, in a single collection. The second of the three
+// planned stores. `firebase-admin` is referenced by TYPE ONLY — the live
+// `Firestore` instance is injected by the caller — so `@degenerate/sharedata`
+// takes no runtime dependency on firebase-admin and never initializes an app
+// itself. A host that wants Firestore-backed persistence constructs its own
+// `admin.firestore()` (or `getFirestore(app)`) and hands it in.
+/**
+ * Persists each ShareData snapshot as a Firestore document named after its id,
+ * in {@link DatabaseSettingsFirestore.ShareData.Collection} by default. `save`
+ * round-trips the snapshot through JSON to strip `undefined` (Firestore
+ * rejects `undefined` field values) — parity with the file store, which writes
+ * `JSON.stringify`. Loads route through {@link deserializeShareData}, so a
+ * document edited out-of-band fails verification instead of loading silently.
+ */
+class FirestoreShareDataRepository {
+    constructor(firestore, collectionName = generic_1.DatabaseSettingsFirestore.ShareData.Collection) {
+        this.firestore = firestore;
+        this.collectionName = collectionName;
+    }
+    async save(snapshot) {
+        await this.docRef(snapshot.id).set(this.toFirestoreData(snapshot));
+    }
+    async load(id) {
+        const doc = await this.docRef(id).get();
+        if (!doc.exists) {
+            return undefined;
+        }
+        return (0, deserialize_share_data_1.deserializeShareData)(generic_1.PersistedShareDataSchema.parse(doc.data()));
+    }
+    async loadAll() {
+        const snapshots = await this.loadAllSnapshots();
+        return snapshots.map((snapshot) => (0, deserialize_share_data_1.deserializeShareData)(snapshot));
+    }
+    async loadAllSnapshots() {
+        const query = await this.firestore.collection(this.collectionName).get();
+        // Schema-validate (not trust-verify) so callers receive well-typed
+        // snapshots; `deserializeShareData` re-runs the full trust gate.
+        return query.docs.map((doc) => generic_1.PersistedShareDataSchema.parse(doc.data()));
+    }
+    async remove(id) {
+        await this.docRef(id).delete();
+    }
+    docRef(id) {
+        return this.firestore.collection(this.collectionName).doc(this.docId(id));
+    }
+    /**
+     * Strip `undefined` field values, which Firestore rejects, by round-tripping
+     * through JSON. Matches the file store's `JSON.stringify` semantics so both
+     * stores persist byte-identical snapshots.
+     */
+    toFirestoreData(snapshot) {
+        return JSON.parse(JSON.stringify(snapshot));
+    }
+    /**
+     * Validate a block id against Firestore's document-id rules before it is
+     * used as a path segment. A block id can originate from an untrusted client
+     * (the HTTP create route reads `metadata.shareBlockId` from the request
+     * body), so an id containing `/` — or one Firestore reserves — must be
+     * rejected rather than silently writing to an unexpected document or path.
+     */
+    docId(id) {
+        if (id.length === 0 ||
+            id.includes('/') ||
+            id === '.' ||
+            id === '..' ||
+            /^__.*__$/.test(id)) {
+            throw new generic_1.ShareDataPersistenceError(id, 'invalid Firestore document id');
+        }
+        return id;
+    }
+}
+exports.FirestoreShareDataRepository = FirestoreShareDataRepository;

package/dist/persistence/in-memory-share-data-repository.d.ts

@@ -0,0 +1,19 @@
+import { PersistedShareData } from '@degenerate/generic';
+import { ShareData } from '../share-data/share-data';
+import { ShareDataRepository } from './share-data-repository';
+/**
+ * Keeps each ShareData snapshot in an in-process `Map`, keyed by block id. To
+ * mirror a durable store faithfully — and to avoid handing out a reference a
+ * caller could mutate behind the manager's back — `save` deep-clones the
+ * snapshot via JSON round-trip on the way in, and `load`/`loadAll` re-verify
+ * through {@link deserializeShareData} on the way out.
+ */
+export declare class InMemoryShareDataRepository implements ShareDataRepository {
+    private readonly snapshots;
+    save(snapshot: PersistedShareData): Promise<void>;
+    load(id: string): Promise<ShareData | undefined>;
+    loadAll(): Promise<ShareData[]>;
+    loadAllSnapshots(): Promise<PersistedShareData[]>;
+    remove(id: string): Promise<void>;
+}
+//# sourceMappingURL=in-memory-share-data-repository.d.ts.map

package/dist/persistence/in-memory-share-data-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-share-data-repository.d.ts","sourceRoot":"","sources":["../../src/persistence/in-memory-share-data-repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA4B,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAU9D;;;;;;GAMG;AACH,qBAAa,2BAA4B,YAAW,mBAAmB;IACnE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyC;IAE7D,IAAI,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAOjD,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAQhD,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAK/B,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAMjD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG1C"}

package/dist/persistence/in-memory-share-data-repository.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryShareDataRepository = void 0;
+const generic_1 = require("@degenerate/generic");
+const deserialize_share_data_1 = require("./deserialize-share-data");
+// In-memory implementation of {@link ShareDataRepository}: snapshots live in a
+// `Map`, nothing touches disk or the network. The third of the three planned
+// stores. Useful for tests and for a process that wants the manager's
+// hydrate/write-through plumbing without durable storage. It still round-trips
+// through serialize/deserialize, so it exercises the same trust gate as the
+// durable stores — a snapshot is re-verified on load, never handed back as the
+// live object that was saved.
+/**
+ * Keeps each ShareData snapshot in an in-process `Map`, keyed by block id. To
+ * mirror a durable store faithfully — and to avoid handing out a reference a
+ * caller could mutate behind the manager's back — `save` deep-clones the
+ * snapshot via JSON round-trip on the way in, and `load`/`loadAll` re-verify
+ * through {@link deserializeShareData} on the way out.
+ */
+class InMemoryShareDataRepository {
+    constructor() {
+        this.snapshots = new Map();
+    }
+    async save(snapshot) {
+        // Clone so a later mutation of the caller's object cannot reach into
+        // stored state — the durable stores serialize to bytes, so this keeps
+        // behavior identical.
+        this.snapshots.set(snapshot.id, JSON.parse(JSON.stringify(snapshot)));
+    }
+    async load(id) {
+        const snapshot = this.snapshots.get(id);
+        if (!snapshot) {
+            return undefined;
+        }
+        return (0, deserialize_share_data_1.deserializeShareData)(generic_1.PersistedShareDataSchema.parse(snapshot));
+    }
+    async loadAll() {
+        const snapshots = await this.loadAllSnapshots();
+        return snapshots.map((snapshot) => (0, deserialize_share_data_1.deserializeShareData)(snapshot));
+    }
+    async loadAllSnapshots() {
+        return [...this.snapshots.values()].map((snapshot) => generic_1.PersistedShareDataSchema.parse(snapshot));
+    }
+    async remove(id) {
+        this.snapshots.delete(id);
+    }
+}
+exports.InMemoryShareDataRepository = InMemoryShareDataRepository;

package/dist/persistence/serialize-share-data.d.ts

@@ -0,0 +1,22 @@
+import { PersistedCreationConfig, PersistedShareData, PersistedTransaction, ShareBlockType } from '@degenerate/generic';
+import { ShareData } from '../share-data/share-data';
+/**
+ * Serializes a constructed ShareData into a {@link PersistedShareData}
+ * snapshot.
+ *
+ * @param blockType       which factory built the block — drives builder
+ *                        resolution on reload.
+ * @param creationConfig  the factory options minus `proofFor`
+ *                        (`metadata`, `creationPublicKey`, `initialState`),
+ *                        captured at creation time.
+ * @param block           the live, fully-constructed block.
+ * @param transactionLog  post-creation transactions captured at apply time,
+ *                        in the order they were applied.
+ *
+ * The `expected*` fields snapshot the block's finished state. They are NOT
+ * trusted on reload — `deserializeShareData` cross-checks them against an
+ * independently replayed block, so a snapshot whose state was edited without
+ * re-signing fails loudly.
+ */
+export declare const serializeShareData: (blockType: ShareBlockType, creationConfig: PersistedCreationConfig, block: ShareData, transactionLog: PersistedTransaction[]) => PersistedShareData;
+//# sourceMappingURL=serialize-share-data.d.ts.map

package/dist/persistence/serialize-share-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize-share-data.d.ts","sourceRoot":"","sources":["../../src/persistence/serialize-share-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EAEjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAUrD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,GAC3B,WAAW,cAAc,EACzB,gBAAgB,uBAAuB,EACvC,OAAO,SAAS,EAChB,gBAAgB,oBAAoB,EAAE,KACvC,kBAgCF,CAAC"}

package/dist/persistence/serialize-share-data.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serializeShareData = void 0;
+const generic_1 = require("@degenerate/generic");
+// Produces the durable wire-format snapshot of a live ShareData. The snapshot
+// is event-sourced: it captures the *creation recipe* (block type + creation
+// config + structural proofs) plus an ordered transaction log, NOT a field
+// dump of the finished object. The live block cannot supply the original
+// partial `initialState` or per-transaction inputs/proposed-states (the class
+// does not retain them), so those are passed in by the caller, which holds
+// them at creation/apply time. See `deserializeShareData` for the inverse.
+/**
+ * Serializes a constructed ShareData into a {@link PersistedShareData}
+ * snapshot.
+ *
+ * @param blockType       which factory built the block — drives builder
+ *                        resolution on reload.
+ * @param creationConfig  the factory options minus `proofFor`
+ *                        (`metadata`, `creationPublicKey`, `initialState`),
+ *                        captured at creation time.
+ * @param block           the live, fully-constructed block.
+ * @param transactionLog  post-creation transactions captured at apply time,
+ *                        in the order they were applied.
+ *
+ * The `expected*` fields snapshot the block's finished state. They are NOT
+ * trusted on reload — `deserializeShareData` cross-checks them against an
+ * independently replayed block, so a snapshot whose state was edited without
+ * re-signing fails loudly.
+ */
+const serializeShareData = (blockType, creationConfig, block, transactionLog) => {
+    // Re-key the structural proofs by `purpose` to match the wire format the
+    // lookup-based `proofFor` consumes on reload. The live block stores them
+    // as an ordered array; one proof per addFunction/addRule call.
+    const structuralProofs = {};
+    for (const proof of block.structuralProofs) {
+        structuralProofs[proof.purpose] = proof;
+    }
+    return {
+        schemaVersion: generic_1.PERSISTED_SHARE_DATA_SCHEMA_VERSION,
+        id: block.id,
+        blockType,
+        signingCurve: block.signingCurve,
+        // `lastUpdated` is only ever set by `initializeCrypto`, so it still
+        // holds the creation timestamp — exactly the `timestamp` the client's
+        // initial-crypto payload carried.
+        initialCrypto: {
+            publicKey: block.creationPublicKey,
+            shareDataHash: block.creationHash,
+            shareDataSignature: block.creationSignature,
+            timestamp: block.lastUpdated,
+        },
+        creationConfig,
+        structuralProofs,
+        transactionLog,
+        expectedCurrentState: block.currentState,
+        expectedCreationHash: block.creationHash,
+        expectedCreationSignature: block.creationSignature,
+        expectedIsLocked: block.isLocked,
+        expectedVersion: block.version,
+    };
+};
+exports.serializeShareData = serializeShareData;

package/dist/persistence/share-data-repository.d.ts

@@ -0,0 +1,49 @@
+import { PersistedShareData } from '@degenerate/generic';
+import { ShareData } from '../share-data/share-data';
+/**
+ * Storage abstraction for persisted ShareData snapshots.
+ *
+ * `save` takes a fully-built {@link PersistedShareData} rather than a live
+ * `ShareData`, because a constructed block does NOT retain the two pieces
+ * `serializeShareData` needs — the factory's original creation config and the
+ * per-transaction inputs/proposed-states. The caller (the `ShareDataManager`,
+ * which holds those at create/apply time) is responsible for serializing
+ * before it persists.
+ *
+ * `load` / `loadAll` are a TRUST GATE, not a passthrough: every reconstructed
+ * block is re-verified by {@link deserializeShareData} (creation signature +
+ * the full structural-proof chain + integrity cross-check against the stored
+ * `expected*` values). A snapshot that was edited on disk without re-signing
+ * throws rather than loading silently. Reconstruction requires the relevant
+ * block-type builders to be registered first (see `registerShareBlockFactories`
+ * in `@degenerate/shareblock`).
+ */
+export interface ShareDataRepository {
+    /** Durably store a snapshot, replacing any existing one with the same id. */
+    save(snapshot: PersistedShareData): Promise<void>;
+    /**
+     * Reconstruct and re-verify the block stored under `id`, or resolve to
+     * `undefined` if none is stored. Throws if the stored snapshot fails
+     * verification.
+     */
+    load(id: string): Promise<ShareData | undefined>;
+    /**
+     * Reconstruct and re-verify every stored block. Throws on the first
+     * snapshot that fails verification — a corrupt store is surfaced, never
+     * partially trusted.
+     */
+    loadAll(): Promise<ShareData[]>;
+    /**
+     * Read every stored snapshot in its raw `PersistedShareData` form, schema-
+     * validated but NOT trust-verified. The trust gate (`deserializeShareData`)
+     * runs over the snapshot, not over a hand-built object, so a caller that
+     * needs to keep appending durable transactions — the `ShareDataManager`
+     * during `hydrate()` — gets both the verifiable snapshot and, from it, the
+     * creation recipe + existing transaction log a live block does not retain.
+     * Callers that only need executable blocks should use {@link loadAll}.
+     */
+    loadAllSnapshots(): Promise<PersistedShareData[]>;
+    /** Remove the snapshot stored under `id`. A no-op if none is stored. */
+    remove(id: string): Promise<void>;
+}
+//# sourceMappingURL=share-data-repository.d.ts.map