@harperfast/harper 5.3.0-beta.1 → 5.3.0-beta.2

package/dataLayer/restoreMarker.ts

@@ -8,6 +8,7 @@ import {
 	openSync,
 	readdirSync,
 	readFileSync,
+	renameSync,
 	unlinkSync,
 	writeSync,
 } from 'node:fs';
@@ -39,11 +40,17 @@ import { tryFileLock, fileLockRelease } from '@harperfast/rocksdb-js';
  *   duration of a restore, and briefly by `dropDatabase` so the two serialize on the same primitive.
  *   Known limitation: the lock is owned by the process, so if the restore job's worker *thread*
  *   dies without the process exiting, the lock stays held (restores 409) until Harper restarts.
- * - `<meta-dir>/<key>.restoring` — the completion marker. Written (and fsynced) after the lock is
- *   acquired and before the destructive restore begins; deleted only after the restore completes
- *   successfully, while still holding the lock. Its *existence* means "a restore started and has
- *   not finished successfully". Its first line records the database directory name so the startup
- *   scan can map a marker back to the database it blocks without decoding the hashed key.
+ * - `<meta-dir>/<key>.restoring` — the completion marker. Published (temp → fsync → rename → parent
+ *   fsync) after the lock is acquired and before the destructive restore begins; deleted only after
+ *   the restore completes successfully, while still holding the lock. Its *existence* means "a
+ *   restore started and has not finished successfully". Its first line records the database
+ *   directory name as a fallback so the startup scan can map a marker whose database directory is
+ *   missing without decoding the hashed key.
+ *
+ *   The rename is what makes the marker trustworthy: the marker path only ever holds the previous
+ *   content or the complete new content, so a torn write can never replace a valid marker with one
+ *   the scan reads as empty (and therefore honors as no block). An intact marker is also never
+ *   rewritten at all — see `beginRestore`.
  */
 
 // The backtick makes this an illegal database name (schemaRegex rejects `/` and backtick only), so
@@ -51,6 +58,9 @@ import { tryFileLock, fileLockRelease } from '@harperfast/rocksdb-js';
 export const RESTORE_META_DIR = '`restore`';
 export const RESTORE_LOCK_SUFFIX = '.lock';
 export const RESTORING_MARKER_SUFFIX = '.restoring';
+// Deliberately not a `.restoring` suffix: `scanBlockedRestores` selects markers by that suffix, and
+// a half-written temp must never be mistaken for one.
+const MARKER_TEMP_SUFFIX = '.tmp';
 
 /**
  * Directory holding the restore metadata for a database — the reserved `` `restore` `` sibling of
@@ -180,17 +190,29 @@ export function releaseRestoreLock(lock: RestoreLock): void {
 }
 
 /**
- * Acquire the per-database restore lock and write the restoring marker. Call before any
- * destructive step. Returns the lock (with `preexisting` set when a marker was already present, so
- * a failed recovery attempt knows not to clear it). Throws (statusCode 409) if another restore
- * already holds the lock.
+ * Whether a marker on disk still blocks the database it belongs to. `scanBlockedRestores` maps a
+ * marker to a database by its first line, so the line has to be the whole name: a torn write that
+ * left a prefix of it ("ord" for "orders") is non-empty and reads as valid, but blocks a database
+ * that does not exist while the real one loads.
  */
-export function beginRestore(dbPath: string): RestoreLock {
-	const markerPath = restoringMarkerPath(dbPath);
-	const preexisting = existsSync(markerPath);
-	const lock = acquireRestoreLock(dbPath);
+function markerIsIntact(markerPath: string, dbPath: string): boolean {
+	try {
+		return readFileSync(markerPath, 'utf8').split('\n', 1)[0] === basename(dbPath);
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * Publish the restoring marker atomically. The caller must already hold the restore lock, which is
+ * what makes the fixed temp name safe: only one writer per database can exist at a time, so a temp
+ * left by an earlier crash is this database's own debris and is simply overwritten.
+ */
+function publishRestoringMarker(dbPath: string): void {
+	const metaDir = restoreMetaDir(dbPath);
+	const tempPath = join(metaDir, restoreMetaKey(dbPath) + MARKER_TEMP_SUFFIX);
 	try {
-		const fd = openSync(markerPath, 'w');
+		const fd = openSync(tempPath, 'w');
 		try {
 			// first line is the database directory name so the startup scan can map this marker back to
 			// the database it blocks without reversing the hashed key
@@ -199,9 +221,44 @@ export function beginRestore(dbPath: string): RestoreLock {
 		} finally {
 			closeSync(fd);
 		}
-		// fsync the metadata directory so the marker's directory entry is durable — without this a
-		// power loss can lose the entry, and a half-purged database would load as healthy
-		fsyncDir(restoreMetaDir(dbPath));
+		renameSync(tempPath, restoringMarkerPath(dbPath));
+	} catch (error) {
+		try {
+			unlinkSync(tempPath);
+		} catch {
+			// debris either way; the write failure is the error worth reporting
+		}
+		throw error;
+	}
+	// fsync the metadata directory so the marker's directory entry is durable — without this a
+	// power loss can lose the entry, and a half-purged database would load as healthy
+	fsyncDir(metaDir);
+}
+
+/**
+ * Acquire the per-database restore lock and ensure the restoring marker is in place. Call before any
+ * destructive step. Returns the lock (with `preexisting` set when a marker was already present, so
+ * a failed recovery attempt knows not to clear it). Throws (statusCode 409) if another restore
+ * already holds the lock.
+ *
+ * An intact marker is left exactly as it is. A recovery attempt runs over a directory an earlier
+ * restore may have half-purged, so the marker it finds is the only thing keeping that directory
+ * from loading as healthy; rewriting it buys nothing (the content it would write is the content
+ * already there) and risks everything.
+ */
+export function beginRestore(dbPath: string): RestoreLock {
+	const markerPath = restoringMarkerPath(dbPath);
+	const lock = acquireRestoreLock(dbPath);
+	// Sampled while holding the lock, not before it: a restore that waited out an earlier one would
+	// otherwise carry the earlier run's "no marker" reading, and on its own pre-destruction failure
+	// clear the marker protecting a directory that run had already half-purged.
+	const preexisting = existsSync(markerPath);
+	try {
+		if (!preexisting || !markerIsIntact(markerPath, dbPath)) publishRestoringMarker(dbPath);
+		// An intact marker is kept, but its durability is not assumed: the publisher that wrote it may
+		// have been interrupted between the rename and this flush, which would leave the directory
+		// entry — the thing the startup scan reads — still only in the page cache.
+		else fsyncDir(restoreMetaDir(dbPath));
 	} catch (error) {
 		fileLockRelease(lock.token);
 		throw error;
@@ -251,24 +308,34 @@ export function clearRestoreMarker(lock: RestoreLock): void {
 }
 
 /**
- * Scan a databases root's reserved `` `restore` `` metadata directory and report every database currently blocked from
- * loading, mapping each surviving marker back to its database name via the marker's first line.
+ * Scan a databases root's reserved `` `restore` `` metadata directory and report every database
+ * currently blocked from loading. Existing database entries are mapped to markers by their hashed
+ * keys, so corrupt marker contents cannot unblock them; the first line remains the fallback for a
+ * marker whose database directory is missing.
  * Returns `[dbName, state]` pairs for markers whose state is `in-progress` or `incomplete`
  * (a `clear` result means the marker was removed concurrently and the database is loadable).
  */
 export function scanBlockedRestores(databasesRoot: string): Array<[string, RestoreState]> {
 	const metaDir = join(databasesRoot, RESTORE_META_DIR);
 	if (!existsSync(metaDir)) return [];
+	const databaseNamesByMarker = new Map(
+		readdirSync(databasesRoot, { withFileTypes: true })
+			.filter((entry) => entry.name !== RESTORE_META_DIR)
+			.map((entry) => [restoreMetaKey(join(databasesRoot, entry.name)) + RESTORING_MARKER_SUFFIX, entry.name])
+	);
 	const blocked: Array<[string, RestoreState]> = [];
 	for (const entry of readdirSync(metaDir, { withFileTypes: true })) {
 		if (!entry.isFile() || !entry.name.endsWith(RESTORING_MARKER_SUFFIX)) continue;
-		let dbName: string;
-		try {
-			dbName = readFileSync(join(metaDir, entry.name), 'utf8').split('\n', 1)[0];
-		} catch {
-			continue; // marker removed concurrently
+		const markerPath = join(metaDir, entry.name);
+		let dbName = databaseNamesByMarker.get(entry.name);
+		if (!dbName) {
+			try {
+				dbName = readFileSync(markerPath, 'utf8').split('\n', 1)[0];
+			} catch {
+				continue; // marker removed concurrently
+			}
+			if (!dbName || restoringMarkerPath(join(databasesRoot, dbName)) !== markerPath) continue;
 		}
-		if (!dbName) continue;
 		const state = checkRestoreState(join(databasesRoot, dbName));
 		if (state !== 'clear') blocked.push([dbName, state]);
 	}

package/dist/components/mcp/audit.d.ts

@@ -16,7 +16,8 @@ export interface AuditEntry {
  * a credential buried below the depth limit cannot leak. Returns a shallow
  * clone — the caller's payload is never mutated.
  */
-export declare function redactArgs(value: unknown, depth?: number, redactExactFields?: boolean): unknown;
+export declare function redactArgs(value: unknown, depth?: number, redactionFields?: ReadonlySet<string>): unknown;
+export declare function redactArgsForTool(value: unknown, tool: string): unknown;
 /** Mask a session id for logging — first 8 chars, suffix elided. */
 export declare function maskSessionId(id: string): string;
 /**

package/dist/components/mcp/audit.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.redactArgs = redactArgs;
+exports.redactArgsForTool = redactArgsForTool;
 exports.maskSessionId = maskSessionId;
 exports.emitAuditEntry = emitAuditEntry;
 /**
@@ -14,23 +15,23 @@ exports.emitAuditEntry = emitAuditEntry;
  * (session id, profile, tool name).
  *
  * Argument summarization runs through a redaction step that drops anything
- * that looks like a credential (key/secret/password). Operators who need
+ * that looks like a credential (secret/password/token). Operators who need
  * stricter PII handling configure `mcp.audit.argumentRedactor` to a custom
  * function via a future component-author hook (v1.1).
  */
 const harper_logger_ts_1 = __importDefault(require("../../utility/logging/harper_logger.js"));
 const REDACTION_PATTERN = /(secret|password|token|api[-_]?key|credentials?|auth)/i;
-// Exact field names that carry secret material without a credential-looking name: `value`/`values`
-// (set_secret plaintext, set_env_value .env secrets) and `envelope` (set_secret ciphertext). These
-// mirror the fields processLocalTransaction strips from the REST operations log — the MCP audit
-// path must not become a bypass. Exact-match so e.g. `search_value` stays auditable.
-const REDACTION_EXACT_FIELDS = /^(value|values|envelope)$/i;
-// ...but only for the operations that actually put secrets in those generically-named fields.
-// `value`/`values` are common, non-secret params on many other operations (record data, config
-// values), so blanket-redacting them would gut the audit trail for unrelated tools. The global
-// REDACTION_PATTERN still applies to every tool; this just narrows the exact-field masking to the
-// secret-bearing ops. NOTE: extend this set if a new op ever carries a secret in a plain field.
-const EXACT_FIELD_TOOLS = new Set(['set_secret', 'set_env_value']);
+// Both secret tools carry all three fields, not just the ones each declares: MCP forwards arguments
+// as-is and audits them after the handler, so a field the tool rejects is still logged. Mirrors what
+// the REST operations log strips unconditionally (UNLOGGABLE_OPERATION_FIELDS).
+const SECRET_VALUE_FIELDS = new Set(['value', 'values', 'envelope']);
+// Per tool, not global: `value`/`values` are ordinary params on many other operations.
+const REDACTION_FIELDS_BY_TOOL = new Map([
+    ['set_secret', SECRET_VALUE_FIELDS],
+    ['set_env_value', SECRET_VALUE_FIELDS],
+    ['add_ssh_key', new Set(['key'])],
+    ['update_ssh_key', new Set(['key'])],
+]);
 const REDACTION_PLACEHOLDER = '[redacted]';
 const MAX_REDACTION_DEPTH = 10;
 /**
@@ -40,25 +41,28 @@ const MAX_REDACTION_DEPTH = 10;
  * a credential buried below the depth limit cannot leak. Returns a shallow
  * clone — the caller's payload is never mutated.
  */
-function redactArgs(value, depth = 0, redactExactFields = false) {
+function redactArgs(value, depth = 0, redactionFields) {
     if (value === null || typeof value !== 'object')
         return value;
     if (depth > MAX_REDACTION_DEPTH)
         return REDACTION_PLACEHOLDER;
     if (Array.isArray(value)) {
-        return value.map((v) => redactArgs(v, depth + 1, redactExactFields));
+        return value.map((v) => redactArgs(v, depth + 1, redactionFields));
     }
     const out = {};
     for (const [k, v] of Object.entries(value)) {
-        if (REDACTION_PATTERN.test(k) || (redactExactFields && REDACTION_EXACT_FIELDS.test(k))) {
+        if (REDACTION_PATTERN.test(k) || redactionFields?.has(k.toLowerCase())) {
             out[k] = REDACTION_PLACEHOLDER;
         }
         else {
-            out[k] = redactArgs(v, depth + 1, redactExactFields);
+            out[k] = redactArgs(v, depth + 1, redactionFields);
         }
     }
     return out;
 }
+function redactArgsForTool(value, tool) {
+    return redactArgs(value, 0, REDACTION_FIELDS_BY_TOOL.get(tool));
+}
 /** Mask a session id for logging — first 8 chars, suffix elided. */
 function maskSessionId(id) {
     if (typeof id !== 'string' || id.length <= 8)
@@ -75,7 +79,7 @@ function emitAuditEntry(entry) {
         const masked = {
             ...entry,
             sessionId: maskSessionId(entry.sessionId),
-            args: redactArgs(entry.args, 0, EXACT_FIELD_TOOLS.has(entry.tool)),
+            args: redactArgsForTool(entry.args, entry.tool),
         };
         harper_logger_ts_1.default.info({ category: 'mcp.audit', ...masked });
     }

package/dist/components/mcp/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../components/mcp/audit.ts"],"names":[],"mappings":";;;;;AAgDA,gCAeC;AAGD,sCAGC;AAOD,wCAaC;AAzFD;;;;;;;;;;;GAWG;AACH,8FAAkE;AAclE,MAAM,iBAAiB,GAAG,wDAAwD,CAAC;AACnF,mGAAmG;AACnG,mGAAmG;AACnG,gGAAgG;AAChG,qFAAqF;AACrF,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAC5D,8FAA8F;AAC9F,+FAA+F;AAC/F,+FAA+F;AAC/F,kGAAkG;AAClG,gGAAgG;AAChG,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;AACnE,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAC3C,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;;GAMG;AACH,SAAgB,UAAU,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC,EAAE,iBAAiB,GAAG,KAAK;IAC9E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,GAAG,mBAAmB;QAAE,OAAO,qBAAqB,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,CAAC,CAAC,GAAG,qBAAqB,CAAC;QAChC,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACtD,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,oEAAoE;AACpE,SAAgB,aAAa,CAAC,EAAU;IACvC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACxD,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,KAAiB;IAC/C,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG;YACd,GAAG,KAAK;YACR,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;YACzC,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAClE,CAAC;QACF,0BAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,uEAAuE;QACvE,0EAA0E;QAC1E,0BAAY,CAAC,KAAK,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;AACF,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../components/mcp/audit.ts"],"names":[],"mappings":";;;;;AAgDA,gCAeC;AAED,8CAEC;AAGD,sCAGC;AAOD,wCAaC;AA7FD;;;;;;;;;;;GAWG;AACH,8FAAkE;AAclE,MAAM,iBAAiB,GAAG,wDAAwD,CAAC;AACnF,oGAAoG;AACpG,qGAAqG;AACrG,gFAAgF;AAChF,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAC1F,uFAAuF;AACvF,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAA8B;IACrE,CAAC,YAAY,EAAE,mBAAmB,CAAC;IACnC,CAAC,eAAe,EAAE,mBAAmB,CAAC;IACtC,CAAC,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,CAAC,gBAAgB,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;CACpC,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAC3C,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;;GAMG;AACH,SAAgB,UAAU,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC,EAAE,eAAqC;IAC1F,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,GAAG,mBAAmB;QAAE,OAAO,qBAAqB,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,CAAC,CAAC,GAAG,qBAAqB,CAAC;QAChC,CAAC;aAAM,CAAC;YACP,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;QACpD,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAc,EAAE,IAAY;IAC7D,OAAO,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,oEAAoE;AACpE,SAAgB,aAAa,CAAC,EAAU;IACvC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACxD,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,KAAiB;IAC/C,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG;YACd,GAAG,KAAK;YACR,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;YACzC,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;SAC/C,CAAC;QACF,0BAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,uEAAuE;QACvE,0EAA0E;QAC1E,0BAAY,CAAC,KAAK,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;AACF,CAAC"}

package/dist/dataLayer/restoreMarker.d.ts

@@ -22,11 +22,17 @@
  *   duration of a restore, and briefly by `dropDatabase` so the two serialize on the same primitive.
  *   Known limitation: the lock is owned by the process, so if the restore job's worker *thread*
  *   dies without the process exiting, the lock stays held (restores 409) until Harper restarts.
- * - `<meta-dir>/<key>.restoring` — the completion marker. Written (and fsynced) after the lock is
- *   acquired and before the destructive restore begins; deleted only after the restore completes
- *   successfully, while still holding the lock. Its *existence* means "a restore started and has
- *   not finished successfully". Its first line records the database directory name so the startup
- *   scan can map a marker back to the database it blocks without decoding the hashed key.
+ * - `<meta-dir>/<key>.restoring` — the completion marker. Published (temp → fsync → rename → parent
+ *   fsync) after the lock is acquired and before the destructive restore begins; deleted only after
+ *   the restore completes successfully, while still holding the lock. Its *existence* means "a
+ *   restore started and has not finished successfully". Its first line records the database
+ *   directory name as a fallback so the startup scan can map a marker whose database directory is
+ *   missing without decoding the hashed key.
+ *
+ *   The rename is what makes the marker trustworthy: the marker path only ever holds the previous
+ *   content or the complete new content, so a torn write can never replace a valid marker with one
+ *   the scan reads as empty (and therefore honors as no block). An intact marker is also never
+ *   rewritten at all — see `beginRestore`.
  */
 export declare const RESTORE_META_DIR = "`restore`";
 export declare const RESTORE_LOCK_SUFFIX = ".lock";
@@ -91,10 +97,15 @@ export declare function acquireRestoreLock(dbPath: string): RestoreLock;
  */
 export declare function releaseRestoreLock(lock: RestoreLock): void;
 /**
- * Acquire the per-database restore lock and write the restoring marker. Call before any
+ * Acquire the per-database restore lock and ensure the restoring marker is in place. Call before any
  * destructive step. Returns the lock (with `preexisting` set when a marker was already present, so
  * a failed recovery attempt knows not to clear it). Throws (statusCode 409) if another restore
  * already holds the lock.
+ *
+ * An intact marker is left exactly as it is. A recovery attempt runs over a directory an earlier
+ * restore may have half-purged, so the marker it finds is the only thing keeping that directory
+ * from loading as healthy; rewriting it buys nothing (the content it would write is the content
+ * already there) and risks everything.
  */
 export declare function beginRestore(dbPath: string): RestoreLock;
 /**
@@ -114,8 +125,10 @@ export declare function abandonRestore(lock: RestoreLock): void;
  */
 export declare function clearRestoreMarker(lock: RestoreLock): void;
 /**
- * Scan a databases root's reserved `` `restore` `` metadata directory and report every database currently blocked from
- * loading, mapping each surviving marker back to its database name via the marker's first line.
+ * Scan a databases root's reserved `` `restore` `` metadata directory and report every database
+ * currently blocked from loading. Existing database entries are mapped to markers by their hashed
+ * keys, so corrupt marker contents cannot unblock them; the first line remains the fallback for a
+ * marker whose database directory is missing.
  * Returns `[dbName, state]` pairs for markers whose state is `in-progress` or `incomplete`
  * (a `clear` result means the marker was removed concurrently and the database is loadable).
  */

package/dist/dataLayer/restoreMarker.js

@@ -41,17 +41,26 @@ const rocksdb_js_1 = require("@harperfast/rocksdb-js");
  *   duration of a restore, and briefly by `dropDatabase` so the two serialize on the same primitive.
  *   Known limitation: the lock is owned by the process, so if the restore job's worker *thread*
  *   dies without the process exiting, the lock stays held (restores 409) until Harper restarts.
- * - `<meta-dir>/<key>.restoring` — the completion marker. Written (and fsynced) after the lock is
- *   acquired and before the destructive restore begins; deleted only after the restore completes
- *   successfully, while still holding the lock. Its *existence* means "a restore started and has
- *   not finished successfully". Its first line records the database directory name so the startup
- *   scan can map a marker back to the database it blocks without decoding the hashed key.
+ * - `<meta-dir>/<key>.restoring` — the completion marker. Published (temp → fsync → rename → parent
+ *   fsync) after the lock is acquired and before the destructive restore begins; deleted only after
+ *   the restore completes successfully, while still holding the lock. Its *existence* means "a
+ *   restore started and has not finished successfully". Its first line records the database
+ *   directory name as a fallback so the startup scan can map a marker whose database directory is
+ *   missing without decoding the hashed key.
+ *
+ *   The rename is what makes the marker trustworthy: the marker path only ever holds the previous
+ *   content or the complete new content, so a torn write can never replace a valid marker with one
+ *   the scan reads as empty (and therefore honors as no block). An intact marker is also never
+ *   rewritten at all — see `beginRestore`.
  */
 // The backtick makes this an illegal database name (schemaRegex rejects `/` and backtick only), so
 // it can never collide with a real database directory — see the module header.
 exports.RESTORE_META_DIR = '`restore`';
 exports.RESTORE_LOCK_SUFFIX = '.lock';
 exports.RESTORING_MARKER_SUFFIX = '.restoring';
+// Deliberately not a `.restoring` suffix: `scanBlockedRestores` selects markers by that suffix, and
+// a half-written temp must never be mistaken for one.
+const MARKER_TEMP_SUFFIX = '.tmp';
 /**
  * Directory holding the restore metadata for a database — the reserved `` `restore` `` sibling of
  * the database directory (see the module header for why the name contains a backtick). Shared by
@@ -159,17 +168,29 @@ function releaseRestoreLock(lock) {
     (0, rocksdb_js_1.fileLockRelease)(lock.token);
 }
 /**
- * Acquire the per-database restore lock and write the restoring marker. Call before any
- * destructive step. Returns the lock (with `preexisting` set when a marker was already present, so
- * a failed recovery attempt knows not to clear it). Throws (statusCode 409) if another restore
- * already holds the lock.
+ * Whether a marker on disk still blocks the database it belongs to. `scanBlockedRestores` maps a
+ * marker to a database by its first line, so the line has to be the whole name: a torn write that
+ * left a prefix of it ("ord" for "orders") is non-empty and reads as valid, but blocks a database
+ * that does not exist while the real one loads.
  */
-function beginRestore(dbPath) {
-    const markerPath = restoringMarkerPath(dbPath);
-    const preexisting = (0, node_fs_1.existsSync)(markerPath);
-    const lock = acquireRestoreLock(dbPath);
+function markerIsIntact(markerPath, dbPath) {
     try {
-        const fd = (0, node_fs_1.openSync)(markerPath, 'w');
+        return (0, node_fs_1.readFileSync)(markerPath, 'utf8').split('\n', 1)[0] === (0, node_path_1.basename)(dbPath);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Publish the restoring marker atomically. The caller must already hold the restore lock, which is
+ * what makes the fixed temp name safe: only one writer per database can exist at a time, so a temp
+ * left by an earlier crash is this database's own debris and is simply overwritten.
+ */
+function publishRestoringMarker(dbPath) {
+    const metaDir = restoreMetaDir(dbPath);
+    const tempPath = (0, node_path_1.join)(metaDir, restoreMetaKey(dbPath) + MARKER_TEMP_SUFFIX);
+    try {
+        const fd = (0, node_fs_1.openSync)(tempPath, 'w');
         try {
             // first line is the database directory name so the startup scan can map this marker back to
             // the database it blocks without reversing the hashed key
@@ -179,9 +200,47 @@ function beginRestore(dbPath) {
         finally {
             (0, node_fs_1.closeSync)(fd);
         }
-        // fsync the metadata directory so the marker's directory entry is durable — without this a
-        // power loss can lose the entry, and a half-purged database would load as healthy
-        fsyncDir(restoreMetaDir(dbPath));
+        (0, node_fs_1.renameSync)(tempPath, restoringMarkerPath(dbPath));
+    }
+    catch (error) {
+        try {
+            (0, node_fs_1.unlinkSync)(tempPath);
+        }
+        catch {
+            // debris either way; the write failure is the error worth reporting
+        }
+        throw error;
+    }
+    // fsync the metadata directory so the marker's directory entry is durable — without this a
+    // power loss can lose the entry, and a half-purged database would load as healthy
+    fsyncDir(metaDir);
+}
+/**
+ * Acquire the per-database restore lock and ensure the restoring marker is in place. Call before any
+ * destructive step. Returns the lock (with `preexisting` set when a marker was already present, so
+ * a failed recovery attempt knows not to clear it). Throws (statusCode 409) if another restore
+ * already holds the lock.
+ *
+ * An intact marker is left exactly as it is. A recovery attempt runs over a directory an earlier
+ * restore may have half-purged, so the marker it finds is the only thing keeping that directory
+ * from loading as healthy; rewriting it buys nothing (the content it would write is the content
+ * already there) and risks everything.
+ */
+function beginRestore(dbPath) {
+    const markerPath = restoringMarkerPath(dbPath);
+    const lock = acquireRestoreLock(dbPath);
+    // Sampled while holding the lock, not before it: a restore that waited out an earlier one would
+    // otherwise carry the earlier run's "no marker" reading, and on its own pre-destruction failure
+    // clear the marker protecting a directory that run had already half-purged.
+    const preexisting = (0, node_fs_1.existsSync)(markerPath);
+    try {
+        if (!preexisting || !markerIsIntact(markerPath, dbPath))
+            publishRestoringMarker(dbPath);
+        // An intact marker is kept, but its durability is not assumed: the publisher that wrote it may
+        // have been interrupted between the rename and this flush, which would leave the directory
+        // entry — the thing the startup scan reads — still only in the page cache.
+        else
+            fsyncDir(restoreMetaDir(dbPath));
     }
     catch (error) {
         (0, rocksdb_js_1.fileLockRelease)(lock.token);
@@ -230,8 +289,10 @@ function clearRestoreMarker(lock) {
     }
 }
 /**
- * Scan a databases root's reserved `` `restore` `` metadata directory and report every database currently blocked from
- * loading, mapping each surviving marker back to its database name via the marker's first line.
+ * Scan a databases root's reserved `` `restore` `` metadata directory and report every database
+ * currently blocked from loading. Existing database entries are mapped to markers by their hashed
+ * keys, so corrupt marker contents cannot unblock them; the first line remains the fallback for a
+ * marker whose database directory is missing.
  * Returns `[dbName, state]` pairs for markers whose state is `in-progress` or `incomplete`
  * (a `clear` result means the marker was removed concurrently and the database is loadable).
  */
@@ -239,19 +300,25 @@ function scanBlockedRestores(databasesRoot) {
     const metaDir = (0, node_path_1.join)(databasesRoot, exports.RESTORE_META_DIR);
     if (!(0, node_fs_1.existsSync)(metaDir))
         return [];
+    const databaseNamesByMarker = new Map((0, node_fs_1.readdirSync)(databasesRoot, { withFileTypes: true })
+        .filter((entry) => entry.name !== exports.RESTORE_META_DIR)
+        .map((entry) => [restoreMetaKey((0, node_path_1.join)(databasesRoot, entry.name)) + exports.RESTORING_MARKER_SUFFIX, entry.name]));
     const blocked = [];
     for (const entry of (0, node_fs_1.readdirSync)(metaDir, { withFileTypes: true })) {
         if (!entry.isFile() || !entry.name.endsWith(exports.RESTORING_MARKER_SUFFIX))
             continue;
-        let dbName;
-        try {
-            dbName = (0, node_fs_1.readFileSync)((0, node_path_1.join)(metaDir, entry.name), 'utf8').split('\n', 1)[0];
-        }
-        catch {
-            continue; // marker removed concurrently
+        const markerPath = (0, node_path_1.join)(metaDir, entry.name);
+        let dbName = databaseNamesByMarker.get(entry.name);
+        if (!dbName) {
+            try {
+                dbName = (0, node_fs_1.readFileSync)(markerPath, 'utf8').split('\n', 1)[0];
+            }
+            catch {
+                continue; // marker removed concurrently
+            }
+            if (!dbName || restoringMarkerPath((0, node_path_1.join)(databasesRoot, dbName)) !== markerPath)
+                continue;
         }
-        if (!dbName)
-            continue;
         const state = checkRestoreState((0, node_path_1.join)(databasesRoot, dbName));
         if (state !== 'clear')
             blocked.push([dbName, state]);

package/dist/dataLayer/restoreMarker.js.map

@@ -1 +1 @@
-{"version":3,"file":"restoreMarker.js","sourceRoot":"","sources":["../../dataLayer/restoreMarker.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;AA4Db,wCAEC;AAaD,0CAEC;AAED,kDAEC;AAWD,oDAEC;AAiCD,8CASC;AA2BD,gDASC;AAKD,gDAEC;AAQD,oCAsBC;AAMD,0CAUC;AAMD,wCAEC;AAOD,gDAUC;AAQD,kDAiBC;AAjRD,qCAUiB;AACjB,yCAAoD;AACpD,6CAAyC;AACzC,uDAAsE;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,mGAAmG;AACnG,+EAA+E;AAClE,QAAA,gBAAgB,GAAG,WAAW,CAAC;AAC/B,QAAA,mBAAmB,GAAG,OAAO,CAAC;AAC9B,QAAA,uBAAuB,GAAG,YAAY,CAAC;AAEpD;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,MAAc;IAC5C,OAAO,IAAA,gBAAI,EAAC,IAAA,mBAAO,EAAC,MAAM,CAAC,EAAE,wBAAgB,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,MAAc;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAA,oBAAQ,EAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAgB,eAAe,CAAC,MAAc;IAC7C,OAAO,IAAA,gBAAI,EAAC,cAAc,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,2BAAmB,CAAC,CAAC;AACnF,CAAC;AAED,SAAgB,mBAAmB,CAAC,MAAc;IACjD,OAAO,IAAA,gBAAI,EAAC,cAAc,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,+BAAuB,CAAC,CAAC;AACvF,CAAC;AAID;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,MAAc;IAClD,OAAO,IAAA,oBAAU,EAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,iBAAiB,CAAC,MAAc;IAC/C,IAAI,CAAC,IAAA,oBAAU,EAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAA,wBAAW,EAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,aAAa,CAAC;QACtC,IAAA,4BAAe,EAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC5B,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACJ,KAAK,GAAG,IAAA,kBAAQ,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACrB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO;QAC1F,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACJ,IAAA,mBAAS,EAAC,KAAK,CAAC,CAAC;IAClB,CAAC;YAAS,CAAC;QACV,IAAA,mBAAS,EAAC,KAAK,CAAC,CAAC;IAClB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAChD,IAAA,mBAAS,EAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAA,wBAAW,EAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,KAAK,GAAQ,IAAI,KAAK,CAAC,+CAA+C,MAAM,EAAE,CAAC,CAAC;QACtF,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;QACvB,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,IAAiB;IACnD,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,MAAc;IAC1C,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,IAAA,kBAAQ,EAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC;YACJ,4FAA4F;YAC5F,0DAA0D;YAC1D,IAAA,mBAAS,EAAC,EAAE,EAAE,GAAG,IAAA,oBAAQ,EAAC,MAAM,CAAC,qBAAqB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACpF,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QACf,CAAC;QACD,2FAA2F;QAC3F,kFAAkF;QAClF,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,IAAiB;IAChD,IAAI,CAAC;QACJ,IAAA,oBAAU,EAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,yFAAyF;QACzF,wFAAwF;QACxF,2EAA2E;QAC3E,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACV,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,IAAiB;IAC/C,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,IAAiB;IACnD,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,IAAA,oBAAU,EAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC;YACvB,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,CAAC;IACF,CAAC;YAAS,CAAC;QACV,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,aAAqB;IACxD,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,aAAa,EAAE,wBAAgB,CAAC,CAAC;IACtD,IAAI,CAAC,IAAA,oBAAU,EAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,OAAO,GAAkC,EAAE,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,IAAA,qBAAW,EAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,+BAAuB,CAAC;YAAE,SAAS;QAC/E,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACR,SAAS,CAAC,8BAA8B;QACzC,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAA,gBAAI,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK,KAAK,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}
+{"version":3,"file":"restoreMarker.js","sourceRoot":"","sources":["../../dataLayer/restoreMarker.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;AAsEb,wCAEC;AAaD,0CAEC;AAED,kDAEC;AAWD,oDAEC;AAiCD,8CASC;AA2BD,gDASC;AAKD,gDAEC;AA2DD,oCAkBC;AAMD,0CAUC;AAMD,wCAEC;AAOD,gDAUC;AAUD,kDAyBC;AApVD,qCAWiB;AACjB,yCAAoD;AACpD,6CAAyC;AACzC,uDAAsE;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,mGAAmG;AACnG,+EAA+E;AAClE,QAAA,gBAAgB,GAAG,WAAW,CAAC;AAC/B,QAAA,mBAAmB,GAAG,OAAO,CAAC;AAC9B,QAAA,uBAAuB,GAAG,YAAY,CAAC;AACpD,oGAAoG;AACpG,sDAAsD;AACtD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,MAAc;IAC5C,OAAO,IAAA,gBAAI,EAAC,IAAA,mBAAO,EAAC,MAAM,CAAC,EAAE,wBAAgB,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,MAAc;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAA,oBAAQ,EAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAgB,eAAe,CAAC,MAAc;IAC7C,OAAO,IAAA,gBAAI,EAAC,cAAc,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,2BAAmB,CAAC,CAAC;AACnF,CAAC;AAED,SAAgB,mBAAmB,CAAC,MAAc;IACjD,OAAO,IAAA,gBAAI,EAAC,cAAc,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,+BAAuB,CAAC,CAAC;AACvF,CAAC;AAID;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,MAAc;IAClD,OAAO,IAAA,oBAAU,EAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,iBAAiB,CAAC,MAAc;IAC/C,IAAI,CAAC,IAAA,oBAAU,EAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,IAAA,oBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAA,wBAAW,EAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,aAAa,CAAC;QACtC,IAAA,4BAAe,EAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC5B,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACJ,KAAK,GAAG,IAAA,kBAAQ,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACrB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO;QAC1F,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACJ,IAAA,mBAAS,EAAC,KAAK,CAAC,CAAC;IAClB,CAAC;YAAS,CAAC;QACV,IAAA,mBAAS,EAAC,KAAK,CAAC,CAAC;IAClB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,MAAc;IAChD,IAAA,mBAAS,EAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAA,wBAAW,EAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,KAAK,GAAQ,IAAI,KAAK,CAAC,+CAA+C,MAAM,EAAE,CAAC,CAAC;QACtF,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;QACvB,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,IAAiB;IACnD,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,UAAkB,EAAE,MAAc;IACzD,IAAI,CAAC;QACJ,OAAO,IAAA,sBAAY,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAA,oBAAQ,EAAC,MAAM,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,MAAc;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC;IAC5E,IAAI,CAAC;QACJ,MAAM,EAAE,GAAG,IAAA,kBAAQ,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC;YACJ,4FAA4F;YAC5F,0DAA0D;YAC1D,IAAA,mBAAS,EAAC,EAAE,EAAE,GAAG,IAAA,oBAAQ,EAAC,MAAM,CAAC,qBAAqB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACpF,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAA,mBAAS,EAAC,EAAE,CAAC,CAAC;QACf,CAAC;QACD,IAAA,oBAAU,EAAC,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC;YACJ,IAAA,oBAAU,EAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;QACrE,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,2FAA2F;IAC3F,kFAAkF;IAClF,QAAQ,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,YAAY,CAAC,MAAc;IAC1C,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACxC,gGAAgG;IAChG,gGAAgG;IAChG,4EAA4E;IAC5E,MAAM,WAAW,GAAG,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC;QACJ,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC;YAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACxF,+FAA+F;QAC/F,2FAA2F;QAC3F,2EAA2E;;YACtE,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,IAAiB;IAChD,IAAI,CAAC;QACJ,IAAA,oBAAU,EAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,yFAAyF;QACzF,wFAAwF;QACxF,2EAA2E;QAC3E,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACV,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,IAAiB;IAC/C,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,IAAiB;IACnD,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,IAAA,oBAAU,EAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC;YACvB,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,CAAC;IACF,CAAC;YAAS,CAAC;QACV,IAAA,4BAAe,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,aAAqB;IACxD,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,aAAa,EAAE,wBAAgB,CAAC,CAAC;IACtD,IAAI,CAAC,IAAA,oBAAU,EAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CACpC,IAAA,qBAAW,EAAC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACjD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,wBAAgB,CAAC;SAClD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAA,gBAAI,EAAC,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,+BAAuB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CACzG,CAAC;IACF,MAAM,OAAO,GAAkC,EAAE,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,IAAA,qBAAW,EAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,+BAAuB,CAAC;YAAE,SAAS;QAC/E,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,MAAM,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACR,SAAS,CAAC,8BAA8B;YACzC,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,IAAA,gBAAI,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC,KAAK,UAAU;gBAAE,SAAS;QAC1F,CAAC;QACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAA,gBAAI,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK,KAAK,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export { RequestTarget } from './resources/RequestTarget.ts';
 export { flushDatabases } from './resources/databases.ts';
 export { registerReplicatedApplyFailureListener, unregisterReplicatedApplyFailureListener, type ReplicatedApplyFailure, type ReplicatedApplyFailureListener, } from './resources/replicatedApplyFailure.ts';
 export { getContext, getResponse, getUser } from './security/jsLoader.ts';
+export { markCredentialRejection, credentialRejectionError } from './security/credentialRejection.ts';
 export { defineTable, types } from './resources/defineTable.ts';
 export { defineResource, t, schemaOf, projectTableFragment } from './resources/defineResource.ts';
 export type { Query, Context, Session, SourceContext, SubscriptionRequest, RecordLockOptions, RequestTargetOrId, ResourceInterface, WritableRecord, } from './resources/ResourceInterface.ts';

package/dist/index.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.projectTableFragment = exports.schemaOf = exports.t = exports.defineResource = exports.types = exports.defineTable = exports.getUser = exports.getResponse = exports.getContext = exports.unregisterReplicatedApplyFailureListener = exports.registerReplicatedApplyFailureListener = exports.flushDatabases = exports.RequestTarget = void 0;
+exports.projectTableFragment = exports.schemaOf = exports.t = exports.defineResource = exports.types = exports.defineTable = exports.credentialRejectionError = exports.markCredentialRejection = exports.getUser = exports.getResponse = exports.getContext = exports.unregisterReplicatedApplyFailureListener = exports.registerReplicatedApplyFailureListener = exports.flushDatabases = exports.RequestTarget = void 0;
 // Prevents server from starting in worker threads if this was directly imported from a non-server user thread
 const node_worker_threads_1 = __importDefault(require("node:worker_threads"));
 if (!node_worker_threads_1.default.isMainThread) {
@@ -24,6 +24,11 @@ var jsLoader_ts_1 = require("./security/jsLoader.js");
 Object.defineProperty(exports, "getContext", { enumerable: true, get: function () { return jsLoader_ts_1.getContext; } });
 Object.defineProperty(exports, "getResponse", { enumerable: true, get: function () { return jsLoader_ts_1.getResponse; } });
 Object.defineProperty(exports, "getUser", { enumerable: true, get: function () { return jsLoader_ts_1.getUser; } });
+// An untagged error from a `server.getUser` override is treated as an internal fault; these tag one
+// as a rejected credential, which authentication defers to the route owner instead (#2703).
+var credentialRejection_ts_1 = require("./security/credentialRejection.js");
+Object.defineProperty(exports, "markCredentialRejection", { enumerable: true, get: function () { return credentialRejection_ts_1.markCredentialRejection; } });
+Object.defineProperty(exports, "credentialRejectionError", { enumerable: true, get: function () { return credentialRejection_ts_1.credentialRejectionError; } });
 // Code-first schema authoring: declare a table as a TypeScript value; the returned
 // handle is the live, registered table class with per-verb shapes inferred from the definition.
 var defineTable_ts_1 = require("./resources/defineTable.js");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":";;;;;;AAAA,8GAA8G;AAC9G,8EAAgD;AAChD,IAAI,CAAC,6BAAa,CAAC,YAAY,EAAE,CAAC;IACjC,4GAA4G;IAC5G,IAAI,CAAC,6BAAa,CAAC,UAAU;QAAE,6BAAa,CAAC,UAAU,GAAG,EAAE,CAAC;IAC7D,6BAAa,CAAC,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC;AAC/C,CAAC;AAED,oGAAoG;AACpG,iEAA6D;AAApD,iHAAA,aAAa,OAAA;AACtB,yDAA0D;AAAjD,8GAAA,cAAc,OAAA;AACvB,mFAK+C;AAJ9C,mJAAA,sCAAsC,OAAA;AACtC,qJAAA,wCAAwC,OAAA;AAIzC,sDAA0E;AAAjE,yGAAA,UAAU,OAAA;AAAE,0GAAA,WAAW,OAAA;AAAE,sGAAA,OAAO,OAAA;AACzC,mFAAmF;AACnF,gGAAgG;AAChG,6DAAgE;AAAvD,6GAAA,WAAW,OAAA;AAAE,uGAAA,KAAK,OAAA;AAE3B,+EAA+E;AAC/E,qGAAqG;AACrG,2FAA2F;AAC3F,mEAAkG;AAAzF,mHAAA,cAAc,OAAA;AAAE,sGAAA,CAAC,OAAA;AAAE,6GAAA,QAAQ,OAAA;AAAE,yHAAA,oBAAoB,OAAA;AAyJ1D,oEAAoE;AACpE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;AAC5B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;AAC/B,OAAO,CAAC,SAAS,GAAG,EAAE,CAAC;AACvB,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AACpB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;AAC3B,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;AAC9B,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;AAC7B,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;AAC5B,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AACpB,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AACpB,OAAO,CAAC,OAAO,GAAG,EAAE,CAAC;AACrB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;AAEhC,yCAAyC;AACzC,gGAAgG;AAChG,oDAAoD;AACpD,sEAA2D;AAE3D,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,yBAAO,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":";;;;;;AAAA,8GAA8G;AAC9G,8EAAgD;AAChD,IAAI,CAAC,6BAAa,CAAC,YAAY,EAAE,CAAC;IACjC,4GAA4G;IAC5G,IAAI,CAAC,6BAAa,CAAC,UAAU;QAAE,6BAAa,CAAC,UAAU,GAAG,EAAE,CAAC;IAC7D,6BAAa,CAAC,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC;AAC/C,CAAC;AAED,oGAAoG;AACpG,iEAA6D;AAApD,iHAAA,aAAa,OAAA;AACtB,yDAA0D;AAAjD,8GAAA,cAAc,OAAA;AACvB,mFAK+C;AAJ9C,mJAAA,sCAAsC,OAAA;AACtC,qJAAA,wCAAwC,OAAA;AAIzC,sDAA0E;AAAjE,yGAAA,UAAU,OAAA;AAAE,0GAAA,WAAW,OAAA;AAAE,sGAAA,OAAO,OAAA;AACzC,oGAAoG;AACpG,4FAA4F;AAC5F,4EAAsG;AAA7F,iIAAA,uBAAuB,OAAA;AAAE,kIAAA,wBAAwB,OAAA;AAC1D,mFAAmF;AACnF,gGAAgG;AAChG,6DAAgE;AAAvD,6GAAA,WAAW,OAAA;AAAE,uGAAA,KAAK,OAAA;AAE3B,+EAA+E;AAC/E,qGAAqG;AACrG,2FAA2F;AAC3F,mEAAkG;AAAzF,mHAAA,cAAc,OAAA;AAAE,sGAAA,CAAC,OAAA;AAAE,6GAAA,QAAQ,OAAA;AAAE,yHAAA,oBAAoB,OAAA;AAyJ1D,oEAAoE;AACpE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;AAC5B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;AAC/B,OAAO,CAAC,SAAS,GAAG,EAAE,CAAC;AACvB,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AACpB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;AAC3B,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;AAC9B,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;AAC7B,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;AAC5B,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AACpB,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AACpB,OAAO,CAAC,OAAO,GAAG,EAAE,CAAC;AACrB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;AAEhC,yCAAyC;AACzC,gGAAgG;AAChG,oDAAoD;AACpD,sEAA2D;AAE3D,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,yBAAO,CAAC,CAAC"}