@korajs/store 1.0.0-beta.13 → 1.0.0-beta.14

package/dist/index.cjs

@@ -31,7 +31,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/errors.ts
-var import_core, QueryError, RecordNotFoundError, OptimisticLockError, AdapterError, StorageDurabilityError, SchemaVersionAheadError, StoreNotOpenError, WorkerInitError, WorkerTimeoutError, NoLeaderError, LeaderUnresponsiveError, BridgeTerminatedError, RequestAbortedError, StorageInUseError, UnsyncedDataError, StorageBackendMismatchError, PersistenceError;
+var import_core, QueryError, RecordNotFoundError, OptimisticLockError, AdapterError, StorageDurabilityError, SchemaVersionAheadError, StoreNotOpenError, WorkerInitError, WorkerTimeoutError, NoLeaderError, LeaderUnresponsiveError, BridgeTerminatedError, RequestAbortedError, StorageInUseError, UnsyncedDataError, StorageBackendMismatchError, PersistenceError, NodeOwnedByAnotherUserError;
 var init_errors = __esm({
   "src/errors.ts"() {
     "use strict";
@@ -188,6 +188,16 @@ var init_errors = __esm({
         this.name = "PersistenceError";
       }
     };
+    NodeOwnedByAnotherUserError = class extends import_core.KoraError {
+      constructor(nodeId, principal) {
+        super(
+          "This device belongs to another account, so changes made while this account is signed in here cannot be saved: they would be uploaded as the device owner's. Sign in as the device's owner, or use this account on its own device.",
+          "NODE_OWNED_BY_ANOTHER_USER",
+          { nodeId, principal }
+        );
+        this.name = "NodeOwnedByAnotherUserError";
+      }
+    };
   }
 });
 
@@ -3628,6 +3638,7 @@ async function writeDeleteInTx(env, scope, collection, id, options = {}) {
   };
 }
 async function buildLocalOperation(env, scope, input) {
+  env.assertLocalWriteAllowed?.();
   const sequenceNumber = await scope.sequence.take();
   const causalDeps = scope.causal.depsFor(input.collection, input.extraCausalDeps);
   const operation = await (0, import_core17.createOperation)(
@@ -3762,7 +3773,7 @@ var init_collection = __esm({
     init_execute_update();
     init_serializer();
     Collection = class {
-      constructor(name, definition, schema, adapter, clock, nodeId, onMutation, relationEnforcer, mutationHandler, causalTracker, secretKeyProvider, onStorageError, fold, maxOperationBytes) {
+      constructor(name, definition, schema, adapter, clock, nodeId, onMutation, relationEnforcer, mutationHandler, causalTracker, secretKeyProvider, onStorageError, fold, maxOperationBytes, assertLocalWriteAllowed) {
         this.name = name;
         this.definition = definition;
         this.schema = schema;
@@ -3777,6 +3788,7 @@ var init_collection = __esm({
         this.onStorageError = onStorageError;
         this.fold = fold;
         this.maxOperationBytes = maxOperationBytes;
+        this.assertLocalWriteAllowed = assertLocalWriteAllowed;
       }
       name;
       definition;
@@ -3792,6 +3804,7 @@ var init_collection = __esm({
       onStorageError;
       fold;
       maxOperationBytes;
+      assertLocalWriteAllowed;
       /**
        * Point this collection at the store's new device identity after a node-id
        * rotation (RT-21). Internal: called by the owning Store only.
@@ -3819,7 +3832,8 @@ var init_collection = __esm({
           causalTracker: this.causalTracker,
           ...this.secretKeyProvider ? { secretKeyProvider: this.secretKeyProvider } : {},
           ...this.onStorageError ? { onStorageError: this.onStorageError } : {},
-          ...this.maxOperationBytes !== void 0 ? { maxOperationBytes: this.maxOperationBytes } : {}
+          ...this.maxOperationBytes !== void 0 ? { maxOperationBytes: this.maxOperationBytes } : {},
+          ...this.assertLocalWriteAllowed ? { assertLocalWriteAllowed: this.assertLocalWriteAllowed } : {}
         };
       }
       async insert(data) {
@@ -5938,7 +5952,8 @@ var init_rebase_unsynced_operations = __esm({
 });
 
 // src/sync/rotate-node-id.ts
-async function rotateUnsyncedOperationsInLog(adapter, schema, unsyncedOpIds, oldNodeId, newNodeId) {
+async function rotateUnsyncedOperationsInLog(adapter, schema, unsyncedOpIds, oldNodeId, newNodeId, options = {}) {
+  const moveDatabaseNode = options.moveDatabaseNode !== false;
   const rotateIds = new Set(unsyncedOpIds);
   const idMapping = {};
   const rewritten = [];
@@ -6008,10 +6023,12 @@ async function rotateUnsyncedOperationsInLog(adapter, schema, unsyncedOpIds, old
         );
       }
     }
-    await tx.execute("INSERT OR REPLACE INTO _kora_meta (key, value) VALUES ('node_id', ?)", [
-      newNodeId
-    ]);
-    await tx.execute("DELETE FROM _kora_meta WHERE key = ?", [NODE_TOKEN_META_KEY]);
+    if (moveDatabaseNode) {
+      await tx.execute("INSERT OR REPLACE INTO _kora_meta (key, value) VALUES ('node_id', ?)", [
+        newNodeId
+      ]);
+      await tx.execute("DELETE FROM _kora_meta WHERE key = ?", [NODE_TOKEN_META_KEY]);
+    }
     if (rewritten.length > 0) {
       await tx.execute(
         `INSERT INTO _kora_version_vector (node_id, sequence_number) VALUES (?, ?)
@@ -6173,7 +6190,9 @@ var init_transaction_context = __esm({
           ...this.config.secretKeyProvider ? { secretKeyProvider: this.config.secretKeyProvider } : {},
           ...this.mutationName !== void 0 ? { mutationName: this.mutationName } : {},
           ...this.config.beforeLocalDelete ? { beforeLocalDelete: this.config.beforeLocalDelete } : {},
-          ...this.config.fold ? { fold: this.config.fold } : {}
+          ...this.config.fold ? { fold: this.config.fold } : {},
+          ...this.config.maxOperationBytes !== void 0 ? { maxOperationBytes: this.config.maxOperationBytes } : {},
+          ...this.config.assertLocalWriteAllowed ? { assertLocalWriteAllowed: this.config.assertLocalWriteAllowed } : {}
         };
       }
       ensureActive() {
@@ -7214,6 +7233,12 @@ var init_store = __esm({
       schema;
       adapter;
       configNodeId;
+      /** The owner of the pinned node while it belongs to another user than the signed-in one (F9). */
+      pinnedNodeOwnedBy = null;
+      /** The sync server refused the pinned node as another user's (F9). */
+      pinnedNodeRefusedByServer = false;
+      /** The user of the last {@link bindPrincipal}. */
+      signedInPrincipal = null;
       dbName;
       isolation;
       emitter;
@@ -7288,8 +7313,10 @@ var init_store = __esm({
         this.foldActive = false;
         await relaxValueDomainConstraints(this.adapter, this.schema);
         await dropLegacyIndexes(this.adapter, this.schema);
+        const persistedNodeId = await this.readPersistedNodeId();
         this.nodeId = await this.loadOrGenerateNodeId();
         await registerLocalNode(this.adapter, this.nodeId);
+        await this.registerUnregisteredAuthors(persistedNodeId);
         await this.scanLog("quick");
         await repairSequenceUniqueness(this.adapter, this.schema, this.nodeId);
         await seedTerminalRejectionsOnce(this.adapter);
@@ -7333,7 +7360,8 @@ var init_store = __esm({
             this.secretKeyProvider,
             (error) => this.reportStorageError(error),
             () => this.activeFold(),
-            this.maxOperationBytes
+            this.maxOperationBytes,
+            () => this.assertLocalWriteAllowed()
           );
           this.collections.set(name, col);
         }
@@ -8625,6 +8653,7 @@ var init_store = __esm({
           ...options?.extraCausalDeps ? { extraCausalDeps: options.extraCausalDeps } : {},
           ...this.secretKeyProvider ? { secretKeyProvider: this.secretKeyProvider } : {},
           ...this.maxOperationBytes !== void 0 ? { maxOperationBytes: this.maxOperationBytes } : {},
+          assertLocalWriteAllowed: () => this.assertLocalWriteAllowed(),
           ...beforeLocalDelete ? { beforeLocalDelete: beforeLocalDelete.bind(this.localMutationHandler) } : {},
           onStorageError: (error) => this.reportStorageError(error)
         };
@@ -8894,6 +8923,46 @@ var init_store = __esm({
         await this.refoldRecordsOf(result.operations.map((op) => op.id));
         return result;
       }
+      /**
+       * Re-author another local node's never-acknowledged operations under a fresh node id
+       * bound to `principal` (the user they belong to). Used when the sync server refuses an
+       * adopted node whose writes belong to the signed-in user (the app assigned them, or
+       * the node was created for them) but which no claims-aware server ever accepted: a
+       * beta.12 database's node with history the server recorded no owner for. The store's
+       * own node id, clock and counters are untouched; the fresh node is registered, so the
+       * sync engine adopts it like any other local node.
+       *
+       * @param fromNodeId - The refused local node (never the store's own)
+       * @param unsyncedOpIds - Ids of its operations the server never acknowledged
+       * @param principal - The user the writes belong to (the fresh node's binding)
+       * @returns The fresh node id and the rewritten operations (for the outbound queue)
+       * @throws {KoraError} `NODE_ID_UNKNOWN` when `fromNodeId` is the store's own node or
+       *   not a local node
+       */
+      async reauthorLocalNode(fromNodeId, unsyncedOpIds, principal) {
+        this.ensureOpen();
+        const from = (await listLocalNodes(this.adapter)).find((node) => node.nodeId === fromNodeId);
+        if (fromNodeId === this.nodeId || !from) {
+          throw new import_core37.KoraError(
+            `Node id "${fromNodeId}" is not another local node of this database, so its writes cannot be re-authored.`,
+            "NODE_ID_UNKNOWN",
+            { nodeId: fromNodeId, storeNodeId: this.nodeId }
+          );
+        }
+        const result = await rotateUnsyncedOperationsInLog(
+          this.adapter,
+          this.schema,
+          unsyncedOpIds,
+          fromNodeId,
+          (0, import_core37.generateUUIDv7)(),
+          { moveDatabaseNode: false }
+        );
+        await registerLocalNode(this.adapter, result.nodeId);
+        await setLocalNodePrincipal(this.adapter, result.nodeId, principal, "fresh");
+        this.versionVector = await this.loadVersionVector();
+        await this.refoldRecordsOf(result.operations.map((op) => op.id));
+        return result;
+      }
       /**
        * Move this database back to a node id it authored under before (RT-38): after the
        * sync server refused the current node, the device tries a node a returning user
@@ -8973,6 +9042,31 @@ var init_store = __esm({
        * @returns The node now in use and whether it changed
        */
       async bindPrincipal(principal) {
+        const binding = await this.bindPrincipalToNode(principal);
+        if (principal !== this.signedInPrincipal) this.pinnedNodeRefusedByServer = false;
+        this.pinnedNodeOwnedBy = binding.conflict ? (await listLocalNodes(this.adapter)).find((node) => node.nodeId === this.nodeId)?.principal ?? null : null;
+        this.signedInPrincipal = principal;
+        return binding;
+      }
+      /**
+       * The sync server refused this store's pinned node id because another user owns it
+       * (`owned: true`), or later accepted it (`false`). A pinned node cannot move to a fresh
+       * id, so writes made under it could only ever upload as its owner: while the server
+       * says so, local writes are refused (F9). A no-op for a store whose node is not pinned
+       * (it moves to a fresh node instead).
+       *
+       * @param owned - Whether the server reported the node owned by another user
+       */
+      setPinnedNodeOwnedElsewhere(owned) {
+        if (!this.configNodeId) return;
+        this.pinnedNodeRefusedByServer = owned;
+      }
+      /** Refuse a local write while the pinned node belongs to another user (F9). */
+      assertLocalWriteAllowed() {
+        if (this.pinnedNodeOwnedBy === null && !this.pinnedNodeRefusedByServer) return;
+        throw new NodeOwnedByAnotherUserError(this.nodeId, this.signedInPrincipal);
+      }
+      async bindPrincipalToNode(principal) {
         this.ensureOpen();
         const previousNodeId = this.nodeId;
         const nodes = await listLocalNodes(this.adapter);
@@ -9352,6 +9446,8 @@ var init_store = __esm({
         const beforeLocalDelete = this.localMutationHandler?.beforeLocalDelete;
         const fold = this.activeFold();
         return new TransactionContext({
+          ...this.maxOperationBytes !== void 0 ? { maxOperationBytes: this.maxOperationBytes } : {},
+          assertLocalWriteAllowed: () => this.assertLocalWriteAllowed(),
           ...fold ? { fold } : {},
           schema: this.schema,
           adapter: this.adapter,
@@ -9411,8 +9507,9 @@ var init_store = __esm({
        *   move backwards, and unsynced own writes are kept (see
        *   `RestoreOptions.keepUnsyncedWrites`). Then {@link reloadFromDisk} runs.
        *
-       * A version-1 file is refused (`errorCode: 'BACKUP_FORMAT_OUTDATED'`); convert it with
-       * `convertBackupV1`.
+       * A version-1 file (Kora 1.0.0-beta.12 and earlier) is converted first, exactly as
+       * `convertBackupV1` does (`result.convertedFromVersion: 1`); one holding an operation
+       * whose timestamp cannot be recovered is refused (`BACKUP_OPERATION_INVALID`).
        *
        * @param data - The backup data
        * @param options - Restore options (merge, collections, keepUnsyncedWrites, onProgress)
@@ -9425,13 +9522,19 @@ var init_store = __esm({
         const started = Date.now();
         const onProgress = options?.onProgress ?? (() => {
         });
-        const { BackupFormatError: BackupFormatError2, parseBackup: parseBackup2 } = await Promise.resolve().then(() => (init_backup(), backup_exports));
+        const { BackupFormatError: BackupFormatError2, convertBackupV1: convertBackupV12, parseBackup: parseBackup2, readBackupManifest: readBackupManifest2 } = await Promise.resolve().then(() => (init_backup(), backup_exports));
         const { restoreMerge: restoreMerge2, restoreReplace: restoreReplace2 } = await Promise.resolve().then(() => (init_restore(), restore_exports));
         onProgress({ phase: "verifying", progress: 0, message: "Verifying backup" });
         let parsed;
+        let convertedFromVersion;
         try {
+          let bytes = data;
+          if (readBackupManifest2(data).version === 1) {
+            bytes = await convertBackupV12(data);
+            convertedFromVersion = 1;
+          }
           parsed = await parseBackup2(
-            data,
+            bytes,
             options?.collections ? { collections: options.collections } : void 0
           );
         } catch (error) {
@@ -9483,6 +9586,7 @@ var init_store = __esm({
           recordsRestored: counts.recordsRestored,
           ...options?.merge ? {} : { unsyncedWritesKept: counts.unsyncedWritesKept },
           ...counts.serverOperationsSkipped ? { serverOperationsSkipped: counts.serverOperationsSkipped } : {},
+          ...convertedFromVersion ? { convertedFromVersion } : {},
           success: true,
           duration: Date.now() - started
         };
@@ -9645,6 +9749,42 @@ var init_store = __esm({
           onOperation: (operation) => this.publishLocalOperation(operation.collection, operation)
         });
       }
+      /** The node id the database persisted before this open, if any. */
+      async readPersistedNodeId() {
+        const rows = await this.adapter.query(
+          "SELECT value FROM _kora_meta WHERE key = 'node_id'"
+        );
+        return rows[0]?.value ?? null;
+      }
+      /**
+       * Register node ids this database authored under that the registry does not know
+       * yet: the node id a pinned `nodeId` (the auth device id) just replaced, and the
+       * authors of queued operations. A beta.12 database had no registry, and a template
+       * app created before its user signed in authored under a random node; once the
+       * store is pinned to the device id, that node's queued writes would otherwise sit in
+       * the queue forever, neither uploaded nor reported. Registered, they are adopted or
+       * held (`status.heldNodes`) like any other local node's writes. Only the outbound
+       * queue is read: received operations never enter it.
+       */
+      async registerUnregisteredAuthors(persistedNodeId) {
+        const authors = /* @__PURE__ */ new Set();
+        if (persistedNodeId !== null && persistedNodeId !== this.nodeId) authors.add(persistedNodeId);
+        const queued = await this.adapter.query(
+          "SELECT payload FROM _kora_sync_queue"
+        );
+        for (const row of queued) {
+          try {
+            const nodeId = JSON.parse(row.payload).node_id;
+            if (typeof nodeId === "string" && nodeId.length > 0) authors.add(nodeId);
+          } catch {
+          }
+        }
+        authors.delete(this.nodeId);
+        for (const nodeId of authors) {
+          if ((0, import_core37.isReservedNodeId)(nodeId)) continue;
+          await registerLocalNode(this.adapter, nodeId);
+        }
+      }
       async loadOrGenerateNodeId() {
         if (this.configNodeId && (0, import_core37.isReservedNodeId)(this.configNodeId)) {
           throw new ReservedNodeIdError(this.configNodeId, "StoreConfig.nodeId");
@@ -9717,6 +9857,7 @@ __export(index_exports, {
   LeaderUnresponsiveError: () => LeaderUnresponsiveError,
   MemoryBlobStore: () => MemoryBlobStore,
   NoLeaderError: () => NoLeaderError,
+  NodeOwnedByAnotherUserError: () => NodeOwnedByAnotherUserError,
   OpfsBlobStore: () => OpfsBlobStore,
   OptimisticLockError: () => OptimisticLockError,
   PersistenceError: () => PersistenceError,
@@ -10087,7 +10228,6 @@ var LOAD_ORIGIN = "kora-load";
 var REMOTE_ORIGIN = "kora-remote";
 var DOC_CHANNEL_ORIGIN = "kora-doc-channel";
 var TEXT_KEY2 = "content";
-var COMPACT_AFTER_DELTAS = 20;
 var PERSIST_DEBOUNCE_MS = 400;
 function createRichTextController(options) {
   const {
@@ -10109,16 +10249,19 @@ function createRichTextController(options) {
   let canUndo = false;
   let canRedo = false;
   let cursors = [];
+  let editGeneration = 0;
+  let savedGeneration = 0;
+  let saving = null;
+  let saveAgain = false;
   const listeners = /* @__PURE__ */ new Set();
   let snapshot = {
     ready: false,
     error: null,
     canUndo: false,
     canRedo: false,
-    cursors: []
+    cursors: [],
+    hasUnsavedChanges: false
   };
-  const baseUpdateRef = { current: null };
-  const pendingDeltasRef = { current: [] };
   const docChannelActiveRef = { current: false };
   let persistTimer = null;
   let recordUnsubscribe = null;
@@ -10130,7 +10273,8 @@ function createRichTextController(options) {
       error,
       canUndo,
       canRedo,
-      cursors: [...cursors]
+      cursors: [...cursors],
+      hasUnsavedChanges: editGeneration > savedGeneration
     };
   };
   const notify = () => {
@@ -10201,26 +10345,38 @@ function createRichTextController(options) {
       return;
     }
     Y3.applyUpdate(doc, encoded, REMOTE_ORIGIN);
-    baseUpdateRef.current = encoded;
-    pendingDeltasRef.current = [];
     syncHistoryState();
   };
-  const flushPersist = async () => {
-    const snapshot2 = composeRichtextSnapshot(baseUpdateRef.current, pendingDeltasRef.current);
-    if (pendingDeltasRef.current.length >= COMPACT_AFTER_DELTAS) {
-      baseUpdateRef.current = snapshot2;
-      pendingDeltasRef.current = [];
-    }
+  const persistOnce = async () => {
+    const generation = editGeneration;
+    const state = Y3.encodeStateAsUpdate(doc);
     try {
       await collection.update(recordId, {
-        [fieldName]: snapshot2
+        [fieldName]: state
       });
+      if (generation > savedGeneration) savedGeneration = generation;
+      error = null;
     } catch (cause) {
-      if (!disposed) {
-        error = cause instanceof Error ? cause : new Error(String(cause));
-        notify();
-      }
+      error = cause instanceof Error ? cause : new Error(String(cause));
     }
+    if (!disposed) notify();
+  };
+  const flushPersist = () => {
+    if (saving) {
+      saveAgain = true;
+      return saving;
+    }
+    const run = (async () => {
+      do {
+        saveAgain = false;
+        await persistOnce();
+      } while (saveAgain);
+    })();
+    saving = run;
+    void run.finally(() => {
+      if (saving === run) saving = null;
+    });
+    return run;
   };
   const schedulePersist = () => {
     if (persistTimer) {
@@ -10236,7 +10392,7 @@ function createRichTextController(options) {
     if (origin === LOAD_ORIGIN || origin === REMOTE_ORIGIN || origin === DOC_CHANNEL_ORIGIN) {
       return;
     }
-    pendingDeltasRef.current.push(update);
+    editGeneration += 1;
     if (docChannelActiveRef.current && syncEngine) {
       syncEngine.getRichtextDocChannel?.().send(collectionName, recordId, fieldName, update);
       schedulePersist();
@@ -10320,8 +10476,6 @@ function createRichTextController(options) {
         target.delete(0, target.length);
       }, LOAD_ORIGIN);
       const encoded = encodeRichtextInput(record?.[fieldName]);
-      baseUpdateRef.current = encoded;
-      pendingDeltasRef.current = [];
       if (encoded) {
         Y3.applyUpdate(doc, encoded, LOAD_ORIGIN);
       }
@@ -10364,6 +10518,16 @@ function createRichTextController(options) {
     setUser(nextUser) {
       user = nextUser;
     },
+    retrySave() {
+      if (persistTimer) {
+        clearTimeout(persistTimer);
+        persistTimer = null;
+      }
+      return flushPersist();
+    },
+    getUnsavedState() {
+      return editGeneration > savedGeneration ? Y3.encodeStateAsUpdate(doc) : null;
+    },
     destroy() {
       if (disposed) {
         return;
@@ -10373,14 +10537,15 @@ function createRichTextController(options) {
         clearTimeout(persistTimer);
         persistTimer = null;
       }
+      if (editGeneration > savedGeneration) {
+        void flushPersist();
+      }
       doc.off("update", onDocUpdate);
       recordUnsubscribe?.();
       docChannelUnsubscribe?.();
       awarenessUnsubscribe?.();
       clearCursor();
       undoManager.destroy();
-      baseUpdateRef.current = null;
-      pendingDeltasRef.current = [];
       docChannelActiveRef.current = false;
       listeners.clear();
     }
@@ -10401,16 +10566,6 @@ function encodeRichtextInput(value) {
     throw new Error("Richtext record value must be a string, Uint8Array, ArrayBuffer, or null.");
   }
 }
-function composeRichtextSnapshot(base, deltas) {
-  const mergedDoc = new Y3.Doc();
-  if (base) {
-    Y3.applyUpdate(mergedDoc, base);
-  }
-  for (const delta of deltas) {
-    Y3.applyUpdate(mergedDoc, delta);
-  }
-  return Y3.encodeStateAsUpdate(mergedDoc);
-}
 function updatesEqual(left, right) {
   if (left.length !== right.length) {
     return false;
@@ -11039,6 +11194,7 @@ function createChunkPortPair() {
   LeaderUnresponsiveError,
   MemoryBlobStore,
   NoLeaderError,
+  NodeOwnedByAnotherUserError,
   OpfsBlobStore,
   OptimisticLockError,
   PersistenceError,