@evolu/common 8.12.0 → 8.14.0

package/src/local-first/Evolu.ts

@@ -31,7 +31,9 @@ import {
 import { createMicrotaskBatch } from "../Microtask.ts";
 import {
   createMutableRecord,
+  isPlainObject,
   objectToEntries,
+  shareStructure,
   type ReadonlyRecord,
 } from "../Object.ts";
 import type { FlushSyncDep, ReloadAppDep } from "../Platform.ts";
@@ -75,7 +77,9 @@ import { createOwnerWebSocketTransport } from "./Owner.ts";
 import {
   encodeDbChange,
   type ProtocolError,
+  type ProtocolInvalidDataError,
   type ProtocolQuotaError,
+  type ProtocolTimestampMismatchError,
   type ProtocolVersionError,
 } from "./Protocol.ts";
 import type {
@@ -102,12 +106,15 @@ import type {
   EvoluInput,
   EvoluOutput,
   OtherBuildRunningError,
+  OwnerSyncStatus,
+  PendingSyncRoute,
   SharedWorkerDep,
   SyncState,
-  syncStateToOwnerSyncStates,
+  syncStateToOwnerSyncStatus,
+  syncStateToRelaySyncStates,
 } from "./Shared.ts";
 import { consoleEntryOrErrorBroadcastChannelName } from "./Shared.ts";
-import { DbChange, type StorageQuotaError } from "./Storage.ts";
+import { DbChange } from "./Storage.ts";
 import { createTimestamp, type Timestamp } from "./Timestamp.ts";
 
 /**
@@ -378,6 +385,37 @@ export interface Evolu<
   /** {@link AppOwner}. */
   readonly appOwner: AppOwner;
 
+  /**
+   * Whether this device keeps the database, resolved once the shared worker
+   * serves it, or `Unknown` if this instance is disposed first.
+   *
+   * Apps tell the user when it is `NotPersisted`, because then data that has
+   * not synced is lost when the database closes. Apps must not tell the user
+   * that data is saved on the device when it is `Unknown`.
+   *
+   * ### Example
+   *
+   * ```ts
+   * import { assertEqual } from "@evolu/common";
+   * import type { DevicePersistence } from "@evolu/common/local-first";
+   *
+   * // The notice for `await evolu.devicePersistence`, or null for none.
+   * const persistenceNotice = (
+   *   devicePersistence: DevicePersistence,
+   * ): string | null =>
+   *   devicePersistence === "NotPersisted"
+   *     ? "Your data isn't kept on this device. Changes that haven't synced are lost when you close this tab."
+   *     : null;
+   *
+   * assertEqual(persistenceNotice("Unknown"), null);
+   * assertEqual(
+   *   persistenceNotice("NotPersisted"),
+   *   "Your data isn't kept on this device. Changes that haven't synced are lost when you close this tab.",
+   * );
+   * ```
+   */
+  readonly devicePersistence: Promise<DevicePersistence>;
+
   /**
    * Inserts a row and returns the generated {@link Id}.
    *
@@ -388,8 +426,10 @@ export interface Evolu<
    *
    * Pass `onComplete` when follow-up work must wait until the mutation is
    * stored and subscribed queries reflect it. It never runs when the database
-   * is unavailable; see {@link Evolu.loadQuery}. A stored change is not always
-   * visible; see {@link MutationOptions.onComplete}.
+   * is unavailable; see {@link Evolu.loadQuery}. It also never runs when the
+   * mutation could not be stored, which {@link EvoluErrorDep.evoluError}
+   * reports. A stored change is not always visible; see
+   * {@link MutationOptions.onComplete}.
    *
    * ### Example
    *
@@ -707,6 +747,9 @@ export interface Evolu<
   /**
    * Exports the SQLite database file.
    *
+   * The exported file is not encrypted, even when the local database is. Any
+   * SQLite tool can read all local data from it, so treat it as plaintext.
+   *
    * Exports are sequential: concurrent calls share one pending export instead
    * of starting parallel exports.
    *
@@ -818,9 +861,12 @@ export interface Evolu<
    *
    * Reconciles locally stored changes, including writes previously rejected
    * with {@link ProtocolQuotaError}, through the owner's active transports. Call
-   * this after the relay provider confirms additional quota is available.
-   * Existing connections and {@link Evolu.useOwner} registrations are retained,
-   * including registrations shared by multiple instances or tabs.
+   * this after the relay provider confirms additional quota is available. It
+   * also checks again the changes this database skipped from the owner's
+   * relays, and sends such a relay the changes received from other relays,
+   * which otherwise wait for its next sync, such as after a reconnect. Existing
+   * connections and {@link Evolu.useOwner} registrations are retained, including
+   * registrations shared by multiple instances or tabs.
    *
    * The owner must have an active writable registration in this database.
    * Unregistered or read-only owners are ignored. Requests are skipped while
@@ -828,8 +874,9 @@ export interface Evolu<
    * reopen. Disposal drops locally buffered requests. Calling a disposed
    * instance throws, like other Evolu operations.
    *
-   * Returns immediately, without waiting for synchronization to complete.
-   * Errors are reported through {@link EvoluErrorDep.evoluError}.
+   * Returns immediately, without waiting for synchronization to complete. The
+   * owner's routes in sync state show a failure, such as a quota rejection, as
+   * `failure`, and a skipped change as `skippedError`.
    *
    * ### Example
    *
@@ -858,9 +905,33 @@ export interface Evolu<
 export type UnuseOwner = () => void;
 
 /**
- * Represents errors that can occur in {@link Evolu}.
+ * Whether this device keeps an {@link Evolu} database, stating only what Evolu
+ * knows for sure.
  *
- * Apps show them from {@link EvoluErrorDep.evoluError}.
+ * - `Persisted`: the platform stores it in the app's own file, as React Native
+ *   does.
+ * - `NotPersisted`: it is kept in memory, because {@link EvoluConfig.memoryOnly}
+ *   asks for that or the platform offers no persistent storage, as a browser
+ *   does in Safari's Private Browsing or a Firefox private window. Data that
+ *   has not synced is lost when the database closes.
+ * - `Unknown`: it is stored, but the platform may delete it. A browser can keep
+ *   storage only for a private session, as Chrome's incognito does without
+ *   telling the app, delete it after a while or when disk space runs low, and
+ *   let the user clear it.
+ *
+ * See [Will my data stay on the
+ * device?](https://www.evolu.dev/docs/faq#will-my-data-stay-on-the-device).
+ *
+ * @group Core
+ */
+export type DevicePersistence = "Persisted" | "NotPersisted" | "Unknown";
+
+/**
+ * Represents app-level errors that can occur in {@link Evolu}.
+ *
+ * Apps show them from {@link EvoluErrorDep.evoluError}. Problems a relay causes
+ * while syncing an owner are not EvoluErrors; see below. An unexpected failure
+ * while syncing is an {@link UnknownError}.
  *
  * An error that leaves the app unusable deserves a modal dialog, which moves
  * focus into itself and restores it when closed. Any other error is a status
@@ -874,31 +945,46 @@ export type UnuseOwner = () => void;
  * - {@link OtherBuildRunningError} blocks the app while it lasts: another version
  *   of the app holds the local data. Ask the user to close the app's other
  *   tabs. It clears when the wait ends.
- * - {@link ProtocolError} does not block the app: sync with a relay failed for an
- *   owner, because the relay rejected or failed a request, or sent data that
- *   could not be decoded or verified; sync state shows the affected routes. A
- *   {@link ProtocolQuotaError} needs more relay quota, then
- *   {@link Evolu.requestSync}; a {@link ProtocolVersionError} needs an app or
- *   relay update.
- * - {@link StorageQuotaError} does not block the app: a storage or billing quota
- *   was exceeded, so a batch of an owner's changes was not stored. The built-in
- *   client storage does not report it yet; a relay's quota arrives as
- *   {@link ProtocolQuotaError}.
- * - {@link DecryptWithXChaCha20Poly1305Error} does not block the app: changes
- *   received for an owner could not be decrypted, so none of their batch was
- *   stored.
  * - {@link UnknownError} does not block the app: Evolu logged an unexpected
- *   failure. Show a generic message.
+ *   failure, such as a mutation that could not be stored. Show a generic
+ *   message.
+ *
+ * A problem syncing an owner through a relay belongs to that relay and often
+ * repeats in every round, so sync state shows it on the relay's route, as its
+ * {@link PendingSyncRoute.failure} with its details, and apps show it as the
+ * owner's `Error` {@link OwnerSyncStatus}. When the relay rejected or failed a
+ * request, or sent a frame that could not be decoded, the route shows a
+ * {@link ProtocolError}. A {@link ProtocolQuotaError} needs more relay quota,
+ * then {@link Evolu.requestSync}, and a {@link ProtocolVersionError} needs an app
+ * or relay update.
+ *
+ * A received change that was not created with the owner's encryption key, was
+ * altered afterwards, or cannot be decoded by this app version is skipped,
+ * while everything else still syncs. The relay offers it again in every round,
+ * so the route shows it as its `skippedError`: the
+ * {@link DecryptWithXChaCha20Poly1305Error},
+ * {@link ProtocolTimestampMismatchError}, or {@link ProtocolInvalidDataError} of
+ * the first change skipped in a reply, with its details. The owner's status is
+ * `Error` with it too, unless a relay has a failure. Once this database stores
+ * a valid change with that timestamp, for example from another relay, the relay
+ * no longer offers its copy, and the route completes with its next sync, such
+ * as after a reconnect or {@link Evolu.requestSync}, during which no changes
+ * arrive from other relays. If you don't trust that relay, stop using it for
+ * the owner. For owners that use the default transports, such as
+ * {@link Evolu.appOwner} when {@link EvoluConfig.transports} is not empty,
+ * replace the relay there; an empty list stops syncing the app owner and makes
+ * {@link Evolu.useOwner} require explicit transports. For an owner you passed
+ * explicit transports to {@link Evolu.useOwner}, call its {@link UnuseOwner} and
+ * use it again without that relay. Do this wherever the owner is used, such as
+ * in every tab, because the owner syncs through every transport any of its uses
+ * claims. If every route of the owner shows
+ * {@link DecryptWithXChaCha20Poly1305Error} and your code creates or shares the
+ * owner, check the owner's keys.
  *
  * @group Core
  */
 export type EvoluError =
-  | DecryptWithXChaCha20Poly1305Error
-  | OtherBuildRunningError
-  | ProtocolError
-  | StorageQuotaError
-  | UnknownError
-  | UnsupportedDbVersionError;
+  OtherBuildRunningError | UnknownError | UnsupportedDbVersionError;
 
 /**
  * The largest {@link Mutation}, in bytes.
@@ -975,6 +1061,13 @@ export interface EvoluErrorDep {
    * instead; see {@link UnsupportedDbVersionError}. Show that blocking message
    * outside any query-loading boundary, so pending queries do not hide it.
    *
+   * An {@link UnknownError} leaves Evolu in an unknown state, so the app can
+   * only ask the user to close the tab. A failed shared worker closes itself,
+   * so the app opened again starts a new one. Some errors reach every tab, such
+   * as an unexpected failure of the shared worker. An app that forwards this
+   * store to an error tracker from each tab then reports such an error once per
+   * tab.
+   *
    * ### Example
    *
    * ```ts
@@ -988,14 +1081,13 @@ export interface EvoluErrorDep {
    * // The message for the current error, or null for none.
    * const errorMessage = (error: EvoluError | null): string | null => {
    *   if (!error) return null;
-   *   // oxlint-disable-next-line typescript/switch-exhaustiveness-check -- The default handles every other EvoluError.
    *   switch (error.type) {
    *     case "UnsupportedDbVersionError":
    *       return "Your data requires a newer version of this app. Please update it.";
    *     case "OtherBuildRunningError":
    *       return "This app is open in another tab with a different version. Close that tab to continue.";
-   *     default:
-   *       return "Something went wrong. Please try again.";
+   *     case "UnknownError":
+   *       return "Something went wrong. Please close this tab and open the app again.";
    *   }
    * };
    *
@@ -1031,8 +1123,15 @@ export interface SyncStateDep {
   /**
    * {@link ReadonlyStore} of the latest {@link SyncState} shared by all
    * {@link Evolu} instances, or null before the shared worker sends its first
-   * snapshot. Derive what to show from it, such as one indicator per relay, or
-   * use {@link syncStateToOwnerSyncStates} for one state per owner.
+   * snapshot. It lists every database the shared worker serves, including other
+   * tabs', so an app finds its own by {@link Evolu.name}. Apps show users an
+   * owner's {@link OwnerSyncStatus}, from {@link syncStateToOwnerSyncStatus} or a
+   * framework binding's `useOwnerSyncStatus`; views of each relay use
+   * {@link syncStateToRelaySyncStates}.
+   *
+   * Each snapshot keeps the previous snapshot's object for every part that did
+   * not change, and a snapshot equal to the previous one leaves the store
+   * unchanged, so parts and derived statuses can be compared with `===`.
    *
    * ### Example
    *
@@ -1041,6 +1140,7 @@ export interface SyncStateDep {
    *   assertEqual,
    *   createId,
    *   createStore,
+   *   Millis,
    *   testCreateDeps,
    * } from "@evolu/common";
    * import type {
@@ -1050,7 +1150,7 @@ export interface SyncStateDep {
    *
    * const openRelayLabels = (deps: SyncStateDep): ReadonlyArray<string> =>
    *   (deps.syncState.get()?.transports ?? [])
-   *     .filter(({ readyState }) => readyState === "open")
+   *     .filter(({ connection }) => connection.type === "Open")
    *     .map(({ label }) => label);
    *
    * using syncState = createStore<SyncState | null>(null);
@@ -1060,12 +1160,14 @@ export interface SyncStateDep {
    * syncState.set({
    *   transports: [
    *     {
+   *       type: "WebSocket",
    *       id: createId<"SyncTransport">(deps),
    *       label: "wss://relay.example",
-   *       readyState: "open",
-   *       openedAt: null,
-   *       closedAt: null,
-   *       error: null,
+   *       connection: {
+   *         type: "Open",
+   *         openedAt: Millis.orThrow(1000),
+   *         error: null,
+   *       },
    *     },
    *   ],
    *   tenants: [],
@@ -1076,6 +1178,20 @@ export interface SyncStateDep {
   readonly syncState: ReadonlyStore<SyncState | null>;
 }
 
+/**
+ * Asks the platform to keep stored databases until the user deletes them.
+ *
+ * Only unsynced local changes exist nowhere else, so each {@link Evolu} instance
+ * calls it after its first local mutation, when its
+ * {@link Evolu.devicePersistence} is `Unknown`. A platform provides it when its
+ * storage can be deleted without the user, as a browser's can.
+ *
+ * @group Construction
+ */
+export interface RequestPersistentStorageDep {
+  readonly requestPersistentStorage: () => void;
+}
+
 /**
  * Shared platform dependencies for creating {@link Evolu} instances.
  *
@@ -1094,7 +1210,7 @@ export type EvoluDeps = EvoluPlatformDeps &
  * Platform-specific dependencies required to create {@link EvoluDeps}.
  *
  * Provides worker and channel adapters plus optional platform integrations for
- * logging and synchronous UI flush.
+ * logging, synchronous UI flush, and persistent storage requests.
  *
  * @group Construction
  */
@@ -1105,7 +1221,8 @@ export type EvoluPlatformDeps = CreateDbWorkerDep &
   ReloadAppDep &
   SharedWorkerDep &
   Partial<ConsoleDep> &
-  Partial<FlushSyncDep>;
+  Partial<FlushSyncDep> &
+  Partial<RequestPersistentStorageDep>;
 
 /**
  * Creates shared dependencies used by all {@link createEvolu} instances on a
@@ -1155,11 +1272,15 @@ export const createEvoluDeps = (deps: EvoluPlatformDeps): EvoluDeps => {
         }
         break;
 
-      case "Error":
-        setEvoluError(message.error);
+      case "Error": {
+        // Every build shares this channel, so another build's worker can post
+        // an error type this build does not post, such as an older build's
+        // sync error. That build's own tabs show it, so this tab only logs it.
+        if (message.error.type === "UnknownError") setEvoluError(message.error);
         // Keep typed errors visible in logs as operational failures.
         console.error(message.error);
         break;
+      }
 
       default:
         exhaustiveCheck(message);
@@ -1173,16 +1294,15 @@ export const createEvoluDeps = (deps: EvoluPlatformDeps): EvoluDeps => {
         break;
 
       case "Error":
-        // Sent to this tab only: its database refused startup, or its worker
-        // still waits for another build.
+        // Sent to this tab only: its database refused startup, a mutation it
+        // made could not be stored, or its worker still waits for another
+        // build.
         setEvoluError(message.error);
         console.error(message.error);
         break;
 
       case "Waiting":
-      case "StorageUnavailable":
-        // Platform adapters act on these; see Builds and Storage in the Shared
-        // module.
+        // Platform adapters act on it; see Builds in the Shared module.
         break;
 
       case "Connected": {
@@ -1197,7 +1317,15 @@ export const createEvoluDeps = (deps: EvoluPlatformDeps): EvoluDeps => {
           message.syncStateChannelName,
         );
         syncStateBroadcastChannel.onMessage = (state) => {
-          syncState.set(state);
+          // Every snapshot arrives as a new structured clone, so its unchanged
+          // parts get the previous snapshot's objects back, and an unchanged
+          // snapshot leaves the store as it is.
+          const previous = syncState.get();
+          syncState.set(
+            previous
+              ? shareStructure(previous, state, syncStateItemToKey)
+              : state,
+          );
         };
         // Asking only after listening misses no snapshot.
         sharedWorker.port.postMessage({ type: "RequestSyncState" });
@@ -1235,6 +1363,14 @@ export const createEvoluDeps = (deps: EvoluPlatformDeps): EvoluDeps => {
   );
 };
 
+// Transports, tenants, owners, and routes come and go, so each is compared
+// with its previous self by its ID: a transport's id, a tenant's name, an
+// owner's ownerId, or a route's transportId. A wrong key only loses sharing.
+const syncStateItemToKey = (item: unknown): unknown =>
+  isPlainObject(item)
+    ? (item.id ?? item.name ?? item.ownerId ?? item.transportId)
+    : undefined;
+
 /**
  * Creates an {@link Evolu} instance from {@link EvoluSchema} and
  * {@link EvoluConfig}.
@@ -1353,6 +1489,13 @@ export const createEvolu =
       exportDatabasePending = null;
     });
 
+    const devicePersistence = Promise.withResolvers<DevicePersistence>();
+    // A disposed instance never hears from its tenant, so awaiters settle.
+    disposer.defer(() => {
+      devicePersistence.resolve("Unknown");
+    });
+    let isPersistentStorageRequested = false;
+
     let postMessage: (input: EvoluInput) => void;
 
     // Scope worker/channel wiring and keep only postMessage outside.
@@ -1434,6 +1577,18 @@ export const createEvolu =
             break;
           }
 
+          case "OnMutateFailed": {
+            // The tab reports the failure, and these callbacks never run.
+            for (const onCompleteId of message.onCompleteIds) {
+              onMutateCompleteCallbacks.unregister(onCompleteId);
+            }
+            break;
+          }
+
+          case "OnDevicePersistence":
+            devicePersistence.resolve(message.devicePersistence);
+            break;
+
           default:
             exhaustiveCheck(message);
         }
@@ -1561,6 +1716,18 @@ export const createEvolu =
           );
         }
 
+        // Only unsynced local changes exist nowhere else, so the first one is
+        // when asking the platform to keep them starts to matter. Asking on
+        // load would show Firefox's permission prompt to every visitor.
+        if (!isPersistentStorageRequested) {
+          isPersistentStorageRequested = true;
+          void devicePersistence.promise.then((persistence) => {
+            if (persistence === "Unknown" && !disposed) {
+              run.deps.requestPersistentStorage?.();
+            }
+          });
+        }
+
         mutateBatch.push({
           change: { ...dbChange, ownerId: options?.ownerId ?? appOwner.id },
           onComplete: options?.onComplete,
@@ -1644,6 +1811,7 @@ export const createEvolu =
         {
           name,
           appOwner,
+          devicePersistence: devicePersistence.promise,
 
           insert: createMutation("insert"),
           update: createMutation("update"),

package/src/local-first/Owner.ts

@@ -28,6 +28,15 @@
  * - {@link OwnerEncryptionKey}: the symmetric key that protects the data.
  * - {@link OwnerWriteKey}: the rotatable token that authorizes writes.
  *
+ * Only holders of the encryption key can create an owner's changes. Each change
+ * is encrypted and authenticated together with its timestamp, so a relay, or
+ * anyone who can write to a relay for the owner, can store bytes for the owner
+ * but cannot forge or move a change. A client stores only the changes it can
+ * decrypt, verify, and decode, and syncs only what it stored. It skips any
+ * other change, which sync state shows on the route of the relay that holds it,
+ * and the relay offers it again on each sync until the client stores a valid
+ * change with that timestamp.
+ *
  * @module
  */
 

package/src/local-first/Protocol.test.ts

@@ -950,7 +950,7 @@ describe("E2E errors", () => {
     );
   });
 
-  it("rejected relay writes report quota and other causes distinctly", async () => {
+  it("reports a rejected relay write as a quota and a thrown one as a write failure", async () => {
     const deps = testCreateDeps();
     const initiatorMessage = createProtocolMessageFromCrdtMessages(deps)(
       testAppOwner,
@@ -961,50 +961,48 @@ describe("E2E errors", () => {
         },
       ],
     );
-    /** Returns the relay's response and what it logged for the rejection. */
-    const relayResponseFor = async (error: StorageWriteMessagesError) => {
+    /** Returns the relay's response and what it logged for the write. */
+    const relayResponseFor = async (
+      writeMessages: StorageDep["storage"]["writeMessages"],
+    ) => {
       await using run = testCreateRun({
         storage: {
           ...shouldNotBeCalledStorageDep.storage,
           validateWriteKey: () => true,
-          writeMessages: () => () => err(error),
+          writeMessages,
         },
       } satisfies StorageDep);
       const { message } = await run.orThrow(
         applyProtocolMessageAsRelay(initiatorMessage),
       );
-      return {
-        message,
-        logged: run.deps.console
-          .getEntriesSnapshot()
-          .map(({ method, args }) => ({ method, args })),
-      };
+      return { message, logged: run.deps.console.getEntriesSnapshot() };
     };
 
     await using run = testCreateRun(shouldNotBeCalledStorageDep);
     // A quota rejection is expected, so the relay does not log it.
-    const quota = await relayResponseFor({
-      type: "StorageQuotaError",
-      ownerId: testAppOwner.id,
-    });
+    const quota = await relayResponseFor(
+      () => () => err({ type: "StorageQuotaError", ownerId: testAppOwner.id }),
+    );
     assertEqual(
       await run(applyProtocolMessageAsClient(quota.message)),
       err({ type: "ProtocolQuotaError", ownerId: testAppOwner.id }),
     );
     assertEqual(quota.logged, []);
-    // Any other storage rejection is a relay write failure, not a quota, and
-    // the relay logs its cause.
-    const mismatch: StorageWriteMessagesError = {
-      type: "ProtocolTimestampMismatchError",
-      expected: timestampBytesToTimestamp(testTimestampsAsc[0]),
-      timestamp: timestampBytesToTimestamp(testTimestampsAsc[1]),
-    };
-    const other = await relayResponseFor(mismatch);
+    // A thrown write is a relay write failure, not a quota, and the relay
+    // logs it.
+    const failure = new Error("write failed");
+    const thrown = await relayResponseFor(() => {
+      throw failure;
+    });
     assertEqual(
-      await run(applyProtocolMessageAsClient(other.message)),
+      await run(applyProtocolMessageAsClient(thrown.message)),
       err({ type: "ProtocolWriteError", ownerId: testAppOwner.id }),
     );
-    assertEqual(other.logged, [{ method: "error", args: [mismatch] }]);
+    assertEqual(
+      thrown.logged.map(({ method }) => method),
+      ["error"],
+    );
+    assertSame(thrown.logged[0]?.args[0], failure);
   });
 });
 
@@ -1239,7 +1237,7 @@ describe("applyProtocolMessageAsClient results", () => {
     assertOk(result, { type: "Readonly" });
   });
 
-  it("preserves expected storage write rejection causes", async () => {
+  it("preserves a storage write rejection", async () => {
     const deps = testCreateDeps();
     const input = createResponse();
     input.addMessage(
@@ -1250,42 +1248,26 @@ describe("applyProtocolMessageAsClient results", () => {
     );
     const message = input.unwrap();
 
-    const errors: ReadonlyArray<StorageWriteMessagesError> = [
-      {
-        type: "DecryptWithXChaCha20Poly1305Error",
-        error: new Error("decryption failed"),
-      },
-      {
-        type: "ProtocolInvalidDataError",
-        data: Uint8Array.of(255),
-        error: new Error("decoding failed"),
-      },
-      {
-        type: "ProtocolTimestampMismatchError",
-        expected: timestampBytesToTimestamp(testTimestampsAsc[0]),
-        timestamp: timestampBytesToTimestamp(testTimestampsAsc[1]),
+    const error: StorageWriteMessagesError = {
+      type: "StorageQuotaError",
+      ownerId: testAppOwner.id,
+    };
+    await using run = testCreateRun({
+      storage: {
+        ...shouldNotBeCalledStorageDep.storage,
+        writeMessages: () => () => err(error),
       },
-      { type: "StorageQuotaError", ownerId: testAppOwner.id },
-    ];
-
-    for (const error of errors) {
-      await using run = testCreateRun({
-        storage: {
-          ...shouldNotBeCalledStorageDep.storage,
-          writeMessages: () => () => err(error),
-        },
-      } satisfies StorageDep);
-      const task = applyProtocolMessageAsClient(message, {
-        writeKey: testAppOwner.writeKey,
-      });
-      assertType<
-        InferTaskErr<typeof task>,
-        ProtocolError | StorageWriteMessagesError
-      >();
-      const result = await run(task);
-      assertErr(result);
-      assertSame(result.error, error);
-    }
+    } satisfies StorageDep);
+    const task = applyProtocolMessageAsClient(message, {
+      writeKey: testAppOwner.writeKey,
+    });
+    assertType<
+      InferTaskErr<typeof task>,
+      ProtocolError | StorageWriteMessagesError
+    >();
+    const result = await run(task);
+    assertErr(result);
+    assertSame(result.error, error);
   });
 
   it("reports a thrown write as failed", async () => {