@interop/wallet-core 0.89.0 → 0.91.0

package/dist/sync/remint.js

@@ -19,65 +19,70 @@
  * create won. At the next sync, provisioning adopts the winner's descriptor
  * (the create is compare-and-swap, never clobbering), leaving the pending
  * envelopes sealed under an epoch the published descriptor does not carry;
- * pushing them would land feed entries no other replica can route. The
- * remedy is {@link remintPendingEnvelopes}, run after adoption and before
- * the next push: each pending row the adopted cipher cannot route is
- * decrypted through the caller's stale-capable seam and re-encrypted under
- * the adopted descriptor's current epoch. This is legal exactly because a
- * pending row (dirty, never server-acked) has no feed existence -- envelope
- * immutability bites only once an envelope is ON the feed -- and the
- * re-encryption may therefore re-key the row (a content-derived id hashes
- * the ciphertext, so a re-mint mints a new id).
+ * pushing them would land feed entries no other replica can route. The remedy
+ * is {@link remintPendingEnvelopes}, run after adoption and before the next
+ * push: each pending resource replica the adopted cipher cannot route is
+ * decrypted through the caller's stale-capable seam and re-encrypted under the
+ * adopted descriptor's current epoch. This is legal exactly because a pending
+ * resource replica (dirty, never server-acked) has no feed existence --
+ * envelope immutability bites only once an envelope is ON the feed -- and the
+ * re-encryption may therefore re-key the resource replica (a content-derived id
+ * hashes the ciphertext, so a re-mint mints a new id).
  */
 import { isIntegrityError, isUnknownEpochError } from '@interop/was-client/sync';
 import { log } from '../log.js';
 /**
- * How many full re-mint passes are attempted before giving up. A pass that
- * ends with skipped rows (a local write bumped a row's revision between the
- * snapshot and the replace) re-snapshots and retries only what is still
- * unroutable; the bound keeps a hot-writing row from livelocking the pass.
+ * How many full re-mint passes are attempted before giving up. A pass that ends
+ * with skipped resource replicas (a local write bumped a resource replica's
+ * revision between the snapshot and the replace) re-snapshots and retries only
+ * what is still unroutable; the bound keeps a hot-writing resource replica from
+ * livelocking the pass.
  */
 const MAX_REMINT_ATTEMPTS = 5;
 /**
- * Re-mints every pending (dirty, never-acked, live) row whose envelope the
- * given cipher cannot route to an epoch it knows -- the create-loss path for
- * an eager minter, run after adopting a published descriptor this client did
- * not install itself (`ensureWalletSpaceEpochs` returning an adopted
- * descriptor for a collection it had already minted against; the envelope, not
- * the `installed` flag, decides per row) and before the next push.
+ * Re-mints every pending (dirty, never-acked, live) resource replica whose
+ * envelope the given cipher cannot route to an epoch it knows -- the
+ * create-loss path for an eager minter, run after adopting a published
+ * descriptor this client did not install itself (`ensureWalletSpaceEpochs`
+ * returning an adopted descriptor for a collection it had already minted
+ * against; the envelope, not the `installed` flag, decides per resource
+ * replica) and before the next push.
  *
- * Each such row is decrypted through `decryptStale` (the pre-adoption cipher,
- * or a plaintext-projection read keyed by the row id), re-encrypted with
- * `cipher` (built from the adopted descriptor, so under its current epoch),
- * and handed to {@link SyncStore.replacePending} -- which may re-key the row,
- * since the re-mint is a fresh encryption. Rows already readable under the
- * adopted descriptor, acked rows (`version > 0` -- they HAVE feed existence
- * and are never re-minted), and tombstones are left untouched.
+ * Each such resource replica is decrypted through `decryptStale` (the
+ * pre-adoption cipher, or a plaintext-projection read keyed by the resource
+ * replica id), re-encrypted with `cipher` (built from the adopted descriptor,
+ * so under its current epoch), and handed to {@link SyncStore.replacePending}
+ * -- which may re-key the resource replica, since the re-mint is a fresh
+ * encryption. Resource replicas already readable under the adopted descriptor,
+ * acked resource replicas (`version > 0` -- they HAVE feed existence and are
+ * never re-minted), and tombstones are left untouched.
  *
  * Two decrypt failures are told apart. An unknown epoch is the create-loss
- * shape this helper exists for, and the row is re-minted. An addressing
- * refusal (was-client's `IntegrityError`: the envelope is sealed for some
- * other resource id, the shape a row minted by a pre-addressed writer has) is
- * left where it is, logged once, and the pass moves to the next row -- the
- * row is not this helper's to settle, and aborting the pass over it would
- * strand every other pending row under the losing epoch and block the
- * adoption from ever completing. Any other decrypt failure still propagates.
+ * shape this helper exists for, and the resource replica is re-minted. An
+ * addressing refusal (was-client's `IntegrityError`: the envelope is sealed for
+ * some other resource id, the shape a resource replica minted by a
+ * pre-addressed writer has) is left where it is, logged once, and the pass
+ * moves to the next resource replica -- the resource replica is not this
+ * helper's to settle, and aborting the pass over it would strand every other
+ * pending resource replica under the losing epoch and block the adoption from
+ * ever completing. Any other decrypt failure still propagates.
  *
  * A replace the store SKIPS (`{ applied: false }` -- a local write bumped the
- * row's revision between the snapshot and the replace, so the row now holds a
- * body this pass never saw) is not counted as re-minted: the whole pass
- * re-snapshots and re-probes, settling the row under its fresh revision. Only
- * rows still unroutable are re-processed; the retry is bounded by
- * {@link MAX_REMINT_ATTEMPTS}, and a pass that exhausts the bound throws
- * rather than returning -- a row left sealed under the losing epoch MUST NOT
- * be pushed, since it would land on the feed as a permanently unroutable
- * entry.
+ * resource replica's revision between the snapshot and the replace, so the
+ * resource replica now holds a body this pass never saw) is not counted as
+ * re-minted: the whole pass re-snapshots and re-probes, settling the resource
+ * replica under its fresh revision. Only resource replicas still unroutable are
+ * re-processed; the retry is bounded by {@link MAX_REMINT_ATTEMPTS}, and a pass
+ * that exhausts the bound throws rather than returning -- a resource replica
+ * left sealed under the losing epoch MUST NOT be pushed, since it would land on
+ * the feed as a permanently unroutable entry.
  *
  * The store parameter is narrowed to one that implements `replacePending`
  * (optional on {@link SyncStore} itself, since a lazy-minting consumer never
  * re-mints): the requirement is a compile-time one, not a runtime throw.
  *
- * Idempotent: a re-run finds the re-minted rows readable and does nothing.
+ * Idempotent: a re-run finds the re-minted resource replicas readable and does
+ * nothing.
  *
  * @param options {object}
  * @param options.store {SyncStore}   must implement `replacePending`
@@ -85,45 +90,46 @@ const MAX_REMINT_ATTEMPTS = 5;
  *   descriptor
  * @param options.decryptStale {function}   opens envelopes minted before the
  *   adoption; receives `{ id, envelope }` so a projection-backed caller can
- *   look the plaintext up by row id instead of decrypting
- * @param [options.signal] {AbortSignal}   checked between rows
+ *   look the plaintext up by resource replica id instead of decrypting
+ * @param [options.signal] {AbortSignal}   checked between resource replicas
  * @returns {Promise<{ pending: number; reminted: number }>}   pending live
- *   rows the first pass scanned, and how many rows were re-minted (applied
- *   replaces only, across all passes)
+ *   resource replicas the first pass scanned, and how many were re-minted
+ *   (applied replaces only, across all passes)
  */
 export async function remintPendingEnvelopes({ store, cipher, decryptStale, signal }) {
     let pending;
     let reminted = 0;
     let skipped = [];
-    // Rows the cipher refused as sealed for another resource id. The refusal is
-    // deterministic over the same envelope, so a later attempt's pass skips such
-    // a row instead of paying for the decrypt (and warning) again.
+    // Resource replicas the cipher refused as sealed for another resource id. The
+    // refusal is deterministic over the same envelope, so a later attempt's pass
+    // skips such a resource replica instead of paying for the decrypt (and
+    // warning) again.
     const misaddressed = new Set();
     for (let attempt = 0; attempt < MAX_REMINT_ATTEMPTS; attempt += 1) {
         if (signal?.aborted) {
             break;
         }
-        const rows = await store.getDirtyRows();
-        const pendingRows = rows.filter(row => !row.deleted && row.version === 0 && row.data !== null);
-        pending ??= pendingRows.length;
+        const replicas = await store.getDirtyResourceReplicas();
+        const pendingReplicas = replicas.filter(replica => !replica.deleted && replica.version === 0 && replica.data !== null);
+        pending ??= pendingReplicas.length;
         skipped = [];
-        for (const row of pendingRows) {
+        for (const replica of pendingReplicas) {
             if (signal?.aborted) {
                 break;
             }
-            if (misaddressed.has(row.id)) {
+            if (misaddressed.has(replica.id)) {
                 continue;
             }
-            const envelope = row.data;
+            const envelope = replica.data;
             try {
-                await cipher.decrypt({ id: row.id, envelope });
+                await cipher.decrypt({ id: replica.id, envelope });
                 continue;
             }
             catch (err) {
                 if (isIntegrityError(err)) {
-                    misaddressed.add(row.id);
-                    log.warn('Leaving a pending row sealed for another resource id', {
-                        id: row.id,
+                    misaddressed.add(replica.id);
+                    log.warn('Leaving a pending resource replica sealed for another resource id', {
+                        id: replica.id,
                         err
                     });
                     continue;
@@ -132,21 +138,21 @@ export async function remintPendingEnvelopes({ store, cipher, decryptStale, sign
                     throw err;
                 }
             }
-            const payload = await decryptStale({ id: row.id, envelope });
+            const payload = await decryptStale({ id: replica.id, envelope });
             const { id: newId, envelope: remintedEnvelope } = await cipher.encrypt({
                 data: payload
             });
             const { applied } = await store.replacePending({
-                id: row.id,
+                id: replica.id,
                 newId,
                 envelope: remintedEnvelope,
-                ...(row.revision !== undefined && { revision: row.revision })
+                ...(replica.revision !== undefined && { revision: replica.revision })
             });
             if (applied) {
                 reminted += 1;
             }
             else {
-                skipped.push(row.id);
+                skipped.push(replica.id);
             }
         }
         if (skipped.length === 0 || signal?.aborted) {
@@ -155,7 +161,7 @@ export async function remintPendingEnvelopes({ store, cipher, decryptStale, sign
     }
     if (skipped.length > 0 && !signal?.aborted) {
         throw new Error(`Re-mint gave up after ${MAX_REMINT_ATTEMPTS} attempts: pending ` +
-            `row(s) ${skipped.join(', ')} kept being rewritten locally and are ` +
+            `resource replica(s) ${skipped.join(', ')} kept being rewritten locally and are ` +
             'still sealed under an epoch the adopted descriptor does not carry. ' +
             'They must not be pushed; re-run the re-mint once local writes settle.');
     }

package/dist/sync/remint.js.map

@@ -1 +1 @@
-{"version":3,"file":"remint.js","sourceRoot":"","sources":["../../src/sync/remint.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEhF,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAG/B;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAA;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,KAAK,EACL,MAAM,EACN,YAAY,EACZ,MAAM,EAQP;IACC,IAAI,OAA2B,CAAA;IAC/B,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAa,EAAE,CAAA;IAC1B,4EAA4E;IAC5E,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IAEtC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,mBAAmB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAClE,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAK;QACP,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAA;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAC7B,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAC9D,CAAA;QACD,OAAO,KAAK,WAAW,CAAC,MAAM,CAAA;QAC9B,OAAO,GAAG,EAAE,CAAA;QAEZ,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAK;YACP,CAAC;YACD,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7B,SAAQ;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAY,CAAA;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;gBAC9C,SAAQ;YACV,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;oBACxB,GAAG,CAAC,IAAI,CAAC,sDAAsD,EAAE;wBAC/D,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,GAAG;qBACJ,CAAC,CAAA;oBACF,SAAQ;gBACV,CAAC;gBACD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC5D,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;gBACrE,IAAI,EAAE,OAAO;aACd,CAAC,CAAA;YACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC;gBAC7C,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK;gBACL,QAAQ,EAAE,gBAAgB;gBAC1B,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;aAC9D,CAAC,CAAA;YACF,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,IAAI,CAAC,CAAA;YACf,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5C,MAAK;QACP,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,yBAAyB,mBAAmB,qBAAqB;YAC/D,UAAU,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;YACpE,qEAAqE;YACrE,uEAAuE,CAC1E,CAAA;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAA;AAC5C,CAAC"}
+{"version":3,"file":"remint.js","sourceRoot":"","sources":["../../src/sync/remint.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAEhF,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAG/B;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAA;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,KAAK,EACL,MAAM,EACN,YAAY,EACZ,MAAM,EAQP;IACC,IAAI,OAA2B,CAAA;IAC/B,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAa,EAAE,CAAA;IAC1B,8EAA8E;IAC9E,6EAA6E;IAC7E,uEAAuE;IACvE,kBAAkB;IAClB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IAEtC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,mBAAmB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAClE,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAK;QACP,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,wBAAwB,EAAE,CAAA;QACvD,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CACrC,OAAO,CAAC,EAAE,CACR,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CACrE,CAAA;QACD,OAAO,KAAK,eAAe,CAAC,MAAM,CAAA;QAClC,OAAO,GAAG,EAAE,CAAA;QAEZ,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAK;YACP,CAAC;YACD,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;gBACjC,SAAQ;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAY,CAAA;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;gBAClD,SAAQ;YACV,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;oBAC5B,GAAG,CAAC,IAAI,CACN,mEAAmE,EACnE;wBACE,EAAE,EAAE,OAAO,CAAC,EAAE;wBACd,GAAG;qBACJ,CACF,CAAA;oBACD,SAAQ;gBACV,CAAC;gBACD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9B,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;YAChE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;gBACrE,IAAI,EAAE,OAAO;aACd,CAAC,CAAA;YACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC;gBAC7C,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK;gBACL,QAAQ,EAAE,gBAAgB;gBAC1B,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;aACtE,CAAC,CAAA;YACF,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,IAAI,CAAC,CAAA;YACf,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YAC5C,MAAK;QACP,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,yBAAyB,mBAAmB,qBAAqB;YAC/D,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;YACjF,qEAAqE;YACrE,uEAAuE,CAC1E,CAAA;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAA;AAC5C,CAAC"}

package/dist/sync/types.d.ts

@@ -10,21 +10,21 @@
  * signals) come from `@interop/was-client/sync` and are re-exported here so a
  * single import gives a consumer both the wire types and the replica-side
  * seams. The predicates that CLASSIFY those signals ship from
- * `@interop/was-client/sync` too, beside the classes that assign the names
- * they match; `push.ts` and `remint.ts` import them from there.
+ * `@interop/was-client/sync` too, beside the classes that assign the names they
+ * match; `push.ts` and `remint.ts` import them from there.
  *
- * The server's `ETag` is opaque (it embeds a per-record generation marker
- * ahead of the content `version`, so it can no longer be rebuilt from a bare
- * revision number). `MasterState.etag` / `WireDoc.etag` / `WriteAck.etag`
- * carry it verbatim; a store that persists synced rows MUST keep the string
+ * The server's `ETag` is opaque (it embeds a per-record generation marker ahead
+ * of the content `version`, so it can no longer be rebuilt from a bare revision
+ * number). `MasterState.etag` / `WireDoc.etag` / `WriteAck.etag` carry it
+ * verbatim; a store that persists resource replicas MUST keep the string
  * alongside `version` and echo it back as a later write's `ifMatch`.
  *
- * The local-persistence seam (`SyncStore`, `SyncedRow`, `ProjectionAction`,
- * `ResolveConflict`) is the replica's side of the contract: it stands in for a
- * concrete store (an RxDB collection, a SQLite `synced_docs` / `sync_checkpoints`
- * table pair, or an in-memory test double). The engine owns the `DocCipher` and
- * decrypts OUTSIDE the store transaction, so these methods never see key
- * material.
+ * The local-persistence seam (`SyncStore`, `SyncedResourceReplica`,
+ * `ProjectionAction`, `ResolveConflict`) is the replica's side of the contract:
+ * it stands in for a concrete store (an RxDB collection, a SQLite `synced_docs`
+ * / `sync_checkpoints` table pair, or an in-memory test double). The engine
+ * owns the `DocCipher` and decrypts OUTSIDE the store transaction, so these
+ * methods never see key material.
  *
  * This module (and `pull.ts` / `push.ts` / `engine.ts`) has no runtime imports
  * beyond the wire contract, so the engine runs anywhere: browser, Node, or React
@@ -34,23 +34,25 @@ export { UnknownEpochError, WasSyncConflictError, WasSyncNotFoundError } from '@
 export type { Json, SyncCheckpoint, WireDoc, MasterState, WriteAck, WasSyncPort, DocCipher } from '@interop/was-client/sync';
 import type { Json, MasterState, SyncCheckpoint, WireDoc } from '@interop/was-client/sync';
 /**
- * A dirty local synced-docs row awaiting push. `data` is the stored body (the
- * EDV envelope on an encrypted collection, or the plaintext JSON on a plaintext
- * one), `null` for a tombstone. `version` is the last server-acked content
- * revision (`0` = never acked, so a create); `etag` is the opaque `ETag`
- * validator that revision was acked (or pulled) under, echoed back verbatim as
- * a later write's `ifMatch` -- absent when the row has never been acked, or
- * against a backend that does not version resources.
+ * A dirty resource replica awaiting push: the replica's local copy of one WAS
+ * Resource. `data` is the stored body (the EDV envelope on an encrypted
+ * collection, or the plaintext JSON on a plaintext one), `null` for a
+ * tombstone. `version` is the last server-acked content revision (`0` = never
+ * acked, so a create); `etag` is the opaque `ETag` validator that revision was
+ * acked (or pulled) under, echoed back verbatim as a later write's `ifMatch` --
+ * absent when the resource replica has never been acked, or against a backend
+ * that does not version resources.
  *
- * `revision` is the store's own local revision token for the row: any opaque
- * value the store bumps on EVERY local write (a counter, a hash of the stored
- * body, an RxDB `_rev`). The push loop carries it back through
+ * `revision` is the store's own local revision token for the resource replica:
+ * any opaque value the store bumps on EVERY local write (a counter, a hash of
+ * the stored body, an RxDB `_rev`). The push loop carries it back through
  * {@link SyncStore.markPushed} / {@link SyncStore.markDeletedPushed} so the ack
  * can be made conditional -- a local write that lands while the HTTP write is
- * in flight leaves a different token behind and keeps the row dirty. A store
- * that omits it opts out of that protection and is acked unconditionally.
+ * in flight leaves a different token behind and keeps the resource replica
+ * dirty. A store that omits it opts out of that protection and is acked
+ * unconditionally.
  */
-export interface SyncedRow {
+export interface SyncedResourceReplica {
     id: string;
     version: number;
     etag?: string;
@@ -78,15 +80,17 @@ export type ProjectionAction = {
     kind: 'none';
 };
 /**
- * The per-row 412-conflict policy for a mutable (last-write-wins) collection,
- * injected into the push loop. Insert-only content-addressed collections leave
+ * The per-resource 412-conflict policy for a mutable (last-write-wins)
+ * collection, injected into the push loop. Insert-only content-addressed collections leave
  * it undefined: their settlement rules -- identical-envelope adoption and
  * tombstone-wins -- already cover every 412. For a mutable head document the
  * resolver re-reads the master, decides the winner deterministically, and either
  * applies the remote payload or re-encrypts the local one for the next push.
- * Bound to a profile's cipher + store by the caller; opaque to the push loop.
+ * `local` is the conflicting local resource replica; the resolver reads the
+ * remote side itself. Bound to a profile's cipher + store by the caller;
+ * opaque to the push loop.
  */
-export type ResolveConflict = (row: {
+export type ResolveConflict = (local: {
     id: string;
     version: number;
     data: Json | null;
@@ -104,17 +108,17 @@ export interface SyncStore {
      */
     getCheckpoint(): Promise<SyncCheckpoint | undefined>;
     /**
-     * All rows awaiting push (dirty).
+     * All resource replicas awaiting push (dirty).
      */
-    getDirtyRows(): Promise<SyncedRow[]>;
+    getDirtyResourceReplicas(): Promise<SyncedResourceReplica[]>;
     /**
      * Applies one pulled page in a single exclusive transaction: reconcile each
-     * document against the local row (per the pull-apply conflict table), write
-     * the matching projection action, and advance the checkpoint. `projections`
-     * is keyed by document id. Each document's `etag` (and `metaEtag`, on a
-     * collection that syncs metadata) MUST be recorded onto its row alongside
-     * `version` -- it is the validator a later local write echoes back as
-     * `ifMatch`.
+     * document against its local resource replica (per the pull-apply conflict
+     * table), write the matching projection action, and advance the checkpoint.
+     * `projections` is keyed by document id. Each document's `etag` (and
+     * `metaEtag`, on a collection that syncs metadata) MUST be recorded onto its
+     * resource replica alongside `version` -- it is the validator a later local
+     * write echoes back as `ifMatch`.
      */
     applyPulledPage(options: {
         documents: WireDoc[];
@@ -124,13 +128,13 @@ export interface SyncStore {
     /**
      * Marks a pushed create/update as acked: record the server `version` and the
      * opaque `etag` validator it lives behind (the write's {@link WriteAck}) when
-     * provided, and clear dirty -- but ONLY if the row's current
-     * {@link SyncedRow.revision} still equals the `revision` that was pushed. A
-     * local write that landed while the write was in flight leaves a newer token,
-     * and that row MUST stay dirty (with the acked `version` / `etag` still
-     * recorded, so the re-push's `ifMatch` is current) so the rerun cycle pushes
-     * it. When `revision` is `undefined` -- a store that does not track a
-     * revision token -- dirty is cleared unconditionally.
+     * provided, and clear dirty -- but ONLY if the resource replica's current
+     * {@link SyncedResourceReplica.revision} still equals the `revision` that was
+     * pushed. A local write that landed while the write was in flight leaves a
+     * newer token, and that resource replica MUST stay dirty (with the acked
+     * `version` / `etag` still recorded, so the re-push's `ifMatch` is current)
+     * so the rerun cycle pushes it. When `revision` is `undefined` -- a store
+     * that does not track a revision token -- dirty is cleared unconditionally.
      */
     markPushed(options: {
         id: string;
@@ -141,9 +145,9 @@ export interface SyncStore {
     /**
      * Marks a pushed delete as settled: keep the tombstone, record the server
      * `version` / `etag` when provided, and clear dirty under the same revision
-     * condition as {@link SyncStore.markPushed} -- a row rewritten locally
-     * mid-flight stays dirty and keeps its local state rather than being forced
-     * to a clean tombstone.
+     * condition as {@link SyncStore.markPushed} -- a resource replica rewritten
+     * locally mid-flight stays dirty and keeps its local state rather than being
+     * forced to a clean tombstone.
      */
     markDeletedPushed(options: {
         id: string;
@@ -153,12 +157,13 @@ export interface SyncStore {
     }): Promise<void>;
     /**
      * Adopts the server's latest state (its {@link MasterState}, in the wire
-     * contract's RxDB-derived naming) for a row whose push hit a `412`, applying
-     * `projection` in the same transaction. `latest === null` means the server
-     * has a tombstone (or the resource is absent): record the tombstone and
-     * delete the projection. A non-null `latest` carries its own `etag`, which
-     * the store MUST record onto the row alongside `version` -- it is the
-     * validator the row's next push echoes back as `ifMatch`.
+     * contract's RxDB-derived naming) for a resource replica whose push hit a
+     * `412`, applying `projection` in the same transaction. `latest === null`
+     * means the server has a tombstone (or the resource is absent): record the
+     * tombstone and delete the projection. A non-null `latest` carries its own
+     * `etag`, which the store MUST record onto the resource replica alongside
+     * `version` -- it is the validator the resource replica's next push echoes
+     * back as `ifMatch`.
      */
     adoptLatest(options: {
         id: string;
@@ -167,16 +172,16 @@ export interface SyncStore {
     }): Promise<void>;
     /**
      * Which of these feed revisions does the replica already hold? Answers with
-     * the ids whose local row records exactly that `etag` as its validator (the
-     * one a push ack or an earlier pull recorded). The pull loop asks it only
-     * about live feed documents carrying the engine's own `writerId`, and skips
-     * the decrypt of each confirmed one, applying it with a `none` projection
-     * (see `pull.ts`). The label is host-visible plaintext, so the skip also
-     * requires the `etag` match. That match limits the skip to a revision the
-     * replica already records. It does not authenticate the label or the
-     * envelope, since the `etag` is host-supplied too. A host that replays an
-     * older envelope under the current `etag` gets the local projection left
-     * as it was, where a decrypt would have rolled it back.
+     * the ids whose local resource replica records exactly that `etag` as its
+     * validator (the one a push ack or an earlier pull recorded). The pull loop
+     * asks it only about live feed documents carrying the engine's own
+     * `writerId`, and skips the decrypt of each confirmed one, applying it with a
+     * `none` projection (see `pull.ts`). The label is host-visible plaintext, so
+     * the skip also requires the `etag` match. That match limits the skip to a
+     * revision the replica already records. It does not authenticate the label or
+     * the envelope, since the `etag` is host-supplied too. A host that replays an
+     * older envelope under the current `etag` gets the local projection left as
+     * it was, where a decrypt would have rolled it back.
      *
      * Optional: a store that omits it turns echo suppression off, and every
      * echo is decrypted as before.
@@ -188,30 +193,30 @@ export interface SyncStore {
         }[];
     }): Promise<Set<string>>;
     /**
-     * Replaces the body of a pending row (dirty, never-acked, live -- no feed
-     * existence) with a re-minted envelope, re-keying the row from `id` to
+     * Replaces the body of a pending resource replica (dirty, never-acked, live
+     * -- no feed existence) with a re-minted envelope, re-keying it from `id` to
      * `newId` when the fresh encryption minted a different resource id, all in
-     * ONE transaction: the row keeps `version 0` and stays dirty, and whatever
-     * links the plaintext projection / app row to the synced row moves to
-     * `newId` with it. Under the same revision condition as
-     * {@link SyncStore.markPushed}: when `revision` is provided and the row's
-     * current token differs (a local write landed mid-re-mint), the replace is
-     * skipped -- the newer state stays as-is for the next pass.
+     * ONE transaction: the resource replica keeps `version 0` and stays dirty,
+     * and whatever links the plaintext projection / app row to the resource
+     * replica moves to `newId` with it. Under the same revision condition as
+     * {@link SyncStore.markPushed}: when `revision` is provided and the resource
+     * replica's current token differs (a local write landed mid-re-mint), the
+     * replace is skipped -- the newer state stays as-is for the next pass.
      *
      * The outcome MUST be reported: resolve with `{ applied: true }` when the
-     * row's body was replaced, and `{ applied: false }` when the revision
-     * condition skipped it. A skip is not a failure, but it leaves a row still
-     * sealed under an epoch the published descriptor does not carry, and the
-     * caller (`remintPendingEnvelopes`) re-probes and retries it rather than
-     * counting it as re-minted -- a silently skipped row would otherwise be
-     * pushed to the feed as a permanently unroutable entry. A store that does
-     * not track a revision token replaces unconditionally and always reports
-     * `{ applied: true }`.
+     * resource replica's body was replaced, and `{ applied: false }` when the
+     * revision condition skipped it. A skip is not a failure, but it leaves a
+     * resource replica still sealed under an epoch the published descriptor does
+     * not carry, and the caller (`remintPendingEnvelopes`) re-probes and retries
+     * it rather than counting it as re-minted -- a silently skipped resource
+     * replica would otherwise be pushed to the feed as a permanently unroutable
+     * entry. A store that does not track a revision token replaces
+     * unconditionally and always reports `{ applied: true }`.
      *
-     * Optional: only an eager-minting replica (one that mints envelopes at
-     * local write time against a cached descriptor) needs it, for the
-     * create-loss re-mint (`remintPendingEnvelopes`). A replica that mints
-     * lazily in the engine's migration sweep never re-mints and may omit it.
+     * Optional: only an eager-minting replica (one that mints envelopes at local
+     * write time against a cached descriptor) needs it, for the create-loss
+     * re-mint (`remintPendingEnvelopes`). A replica that mints lazily in the
+     * engine's migration sweep never re-mints and may omit it.
      */
     replacePending?(options: {
         id: string;

package/dist/sync/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,QAAQ,EACR,WAAW,EACX,SAAS,EACV,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EACV,IAAI,EACJ,WAAW,EACX,cAAc,EACd,OAAO,EACR,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAC1B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,aAAa,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAEpD;;OAEG;IACH,YAAY,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAEpC;;;;;;;;OAQG;IACH,eAAe,CAAC,OAAO,EAAE;QACvB,SAAS,EAAE,OAAO,EAAE,CAAA;QACpB,UAAU,EAAE,cAAc,CAAA;QAC1B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;KAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,OAAO,EAAE;QAClB,EAAE,EAAE,MAAM,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;OAMG;IACH,iBAAiB,CAAC,OAAO,EAAE;QACzB,EAAE,EAAE,MAAM,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;;OAQG;IACH,WAAW,CAAC,OAAO,EAAE;QACnB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;QAC1B,UAAU,EAAE,gBAAgB,CAAA;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,CAAC,OAAO,EAAE;QACtB,SAAS,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAC1C,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAExB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,cAAc,CAAC,CAAC,OAAO,EAAE;QACvB,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,IAAI,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAClC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,QAAQ,EACR,WAAW,EACX,SAAS,EACV,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EACV,IAAI,EACJ,WAAW,EACX,cAAc,EACd,OAAO,EACR,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAC1B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3E;;;;;;;;;;GAUG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,aAAa,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAEpD;;OAEG;IACH,wBAAwB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAA;IAE5D;;;;;;;;OAQG;IACH,eAAe,CAAC,OAAO,EAAE;QACvB,SAAS,EAAE,OAAO,EAAE,CAAA;QACpB,UAAU,EAAE,cAAc,CAAA;QAC1B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;KAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,OAAO,EAAE;QAClB,EAAE,EAAE,MAAM,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;OAMG;IACH,iBAAiB,CAAC,OAAO,EAAE;QACzB,EAAE,EAAE,MAAM,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;;;OASG;IACH,WAAW,CAAC,OAAO,EAAE;QACnB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;QAC1B,UAAU,EAAE,gBAAgB,CAAA;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,CAAC,OAAO,EAAE;QACtB,SAAS,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAC1C,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAExB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,cAAc,CAAC,CAAC,OAAO,EAAE;QACvB,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,IAAI,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAC3B,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAClC"}

package/dist/sync/types.js

@@ -10,21 +10,21 @@
  * signals) come from `@interop/was-client/sync` and are re-exported here so a
  * single import gives a consumer both the wire types and the replica-side
  * seams. The predicates that CLASSIFY those signals ship from
- * `@interop/was-client/sync` too, beside the classes that assign the names
- * they match; `push.ts` and `remint.ts` import them from there.
+ * `@interop/was-client/sync` too, beside the classes that assign the names they
+ * match; `push.ts` and `remint.ts` import them from there.
  *
- * The server's `ETag` is opaque (it embeds a per-record generation marker
- * ahead of the content `version`, so it can no longer be rebuilt from a bare
- * revision number). `MasterState.etag` / `WireDoc.etag` / `WriteAck.etag`
- * carry it verbatim; a store that persists synced rows MUST keep the string
+ * The server's `ETag` is opaque (it embeds a per-record generation marker ahead
+ * of the content `version`, so it can no longer be rebuilt from a bare revision
+ * number). `MasterState.etag` / `WireDoc.etag` / `WriteAck.etag` carry it
+ * verbatim; a store that persists resource replicas MUST keep the string
  * alongside `version` and echo it back as a later write's `ifMatch`.
  *
- * The local-persistence seam (`SyncStore`, `SyncedRow`, `ProjectionAction`,
- * `ResolveConflict`) is the replica's side of the contract: it stands in for a
- * concrete store (an RxDB collection, a SQLite `synced_docs` / `sync_checkpoints`
- * table pair, or an in-memory test double). The engine owns the `DocCipher` and
- * decrypts OUTSIDE the store transaction, so these methods never see key
- * material.
+ * The local-persistence seam (`SyncStore`, `SyncedResourceReplica`,
+ * `ProjectionAction`, `ResolveConflict`) is the replica's side of the contract:
+ * it stands in for a concrete store (an RxDB collection, a SQLite `synced_docs`
+ * / `sync_checkpoints` table pair, or an in-memory test double). The engine
+ * owns the `DocCipher` and decrypts OUTSIDE the store transaction, so these
+ * methods never see key material.
  *
  * This module (and `pull.ts` / `push.ts` / `engine.ts`) has no runtime imports
  * beyond the wire contract, so the engine runs anywhere: browser, Node, or React

package/dist/unlock/standingWebvh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standingWebvh.d.ts","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AASlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAIhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAMxD,OAAO,EAML,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAA;AAEjC;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,YAAY,EACZ,kBAAkB,GAAG,eAAe,GAAG,KAAK,CAC7C,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,KAAK,GAAG,WAAW,CAAA;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAA;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;gBAExB,EACV,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EACnB,EAAE;QACD,oBAAoB,EAAE,MAAM,EAAE,CAAA;QAC9B,uBAAuB,EAAE,OAAO,CAAA;QAChC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B;CAmBF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GACvC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,6BAA6B,CAAA;IAC3C,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,GAAG,EACH,GAAG,EACH,UAAU,EACV,UAAU,EACX,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAyEnC;AAyFD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,eAAe,CAAC,EACpC,GAAG,EACH,GAAG,EACH,SAAS,EACT,UAAU,EACX,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,uBAAuB,CAAA;IAClC,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+B1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,GAAG,EACH,GAAG,EACH,cAAc,EACd,KAAK,EACL,kBAAkB,EACnB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,mCAAmC,CAAC,EACxD,OAAO,EACP,UAAU,EACV,UAAU,EACV,WAAW,EACX,cAA2E,EAC5E,EAAE;IACD,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,KAAK,CAAC,CAAA;IACvD,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CACT,qBAAqB,GAAG;IAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CACpE,CAmCA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,4BAA4B,GAAG,kBAAkB,GAAG;IAC9D,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,CAAA;CACzB,GAAG,CAAC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EACZ,gBAAgB,EACjB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;IAC3C,gBAAgB,EAAE,MAAM,CAAA;CACzB,GAAG,4BAA4B,CAkB/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,EAAE,UAAU,GAAG,IAAI,CAAA;IAC7B,IAAI,CAAC,EAAE,mBAAmB,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,qBAAqB,CAAA;CAChC,CAAC,CAID"}
+{"version":3,"file":"standingWebvh.d.ts","sourceRoot":"","sources":["../../src/unlock/standingWebvh.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EACV,MAAM,EACN,MAAM,EACN,kBAAkB,EACnB,MAAM,2BAA2B,CAAA;AASlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAIhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAMxD,OAAO,EAML,KAAK,uBAAuB,EAC7B,MAAM,0BAA0B,CAAA;AAEjC;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,YAAY,EACZ,kBAAkB,GAAG,eAAe,GAAG,KAAK,CAC7C,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,KAAK,GAAG,WAAW,CAAA;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAA;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;gBAExB,EACV,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EACnB,EAAE;QACD,oBAAoB,EAAE,MAAM,EAAE,CAAA;QAC9B,uBAAuB,EAAE,OAAO,CAAA;QAChC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B;CAmBF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GACvC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,6BAA6B,CAAA;IAC3C,kBAAkB,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;CAC5C,GAAG,MAAM,CAMT;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,wBAAsB,8BAA8B,CAAC,EACnD,GAAG,EACH,GAAG,EACH,UAAU,EACV,UAAU,EACX,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAyEnC;AA2FD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,eAAe,CAAC,EACpC,GAAG,EACH,GAAG,EACH,SAAS,EACT,UAAU,EACX,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,uBAAuB,CAAA;IAClC,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,GAAG,OAAO,CAAC;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+B1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,GAAG,EACH,GAAG,EACH,cAAc,EACd,KAAK,EACL,kBAAkB,EACnB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,mCAAmC,CAAC,EACxD,OAAO,EACP,UAAU,EACV,UAAU,EACV,WAAW,EACX,cAA2E,EAC5E,EAAE;IACD,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,KAAK,CAAC,CAAA;IACvD,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CACT,qBAAqB,GAAG;IAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CACpE,CAmCA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,4BAA4B,GAAG,kBAAkB,GAAG;IAC9D,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,CAAA;CACzB,GAAG,CAAC;IAAE,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,GAAG,EACH,YAAY,EACZ,gBAAgB,EACjB,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,6BAA6B,CAAA;IAC3C,gBAAgB,EAAE,MAAM,CAAA;CACzB,GAAG,4BAA4B,CAkB/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,EAAE,UAAU,GAAG,IAAI,CAAA;IAC7B,IAAI,CAAC,EAAE,mBAAmB,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAIrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,eAAe,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,GAAG,eAAe,CAAC,CAAA;IAC1E,UAAU,EAAE,kBAAkB,CAAA;IAC9B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,qBAAqB,CAAA;CAChC,CAAC,CAID"}

package/dist/unlock/standingWebvh.js

@@ -264,7 +264,9 @@ export async function attributeUnlockLadderInventory({ log, did, unlockKeys, lad
  * that ambiguity; the other two are held to the protection over what it
  * could attribute and otherwise proceed, since such a client is a
  * legitimate torn-enrollment residue (an add entry that revealed the
- * approving rung and the new client's key together) and refusing every
+ * approving rung and the new client's key together, which only a log
+ * written before the ladder-arm approval revealed a committed rung in an
+ * entry of its own can carry) and refusing every
  * retirement on the account for it would leave no way out.
  *
  * @param options {object}