@murphai/murph 1.3.0 → 1.3.2

package/node_modules/@murphai/device-syncd/dist/service.js

@@ -1,16 +1,30 @@
-import { createImporters } from "@murphai/importers";
+import { resolveJunctionTimeseriesResourcePolicy } from "@murphai/contracts";
+import { createDeviceProviderSnapshotImportSession, createImporters, JunctionSparseCalendarRepairNormalizationError, normalizeKnownJunctionSourceProviderSlug, } from "@murphai/importers";
+import { JunctionWorkoutStreamTimestampCardinalityError } from "@murphai/importers/device-providers/junction";
+import { normalizeJunctionCanonicalCoverageBoundary } from "@murphai/importers/device-providers/junction-resources";
 import { normalizeConfiguredDeviceSyncJobInput, normalizeConfiguredDeviceSyncJobRecord, } from "./provider-job-definitions.js";
 import { buildDeviceSyncTokenCipherOptions, createSecretCodec } from "./local-secret-codec.js";
 import { deviceSyncError, isDeviceSyncError } from "./errors.js";
-import { isJunctionCompanionHrvRmssdJob, JUNCTION_COMPANION_HRV_OBSERVATION_INVALID_CODE, } from "./junction-resources.js";
-import { sanitizeHostedRuntimeDiagnosticText, sanitizeHostedRuntimeErrorText, } from "./hosted-runtime.js";
+import { JunctionTimeseriesProgressError } from "./junction-timeseries-progress.js";
+import { isJunctionCompanionHrvRmssdJob, isJunctionSparseCalendarRefreshJob, isJunctionSparseCalendarRefreshPayloadValid, isJunctionSparseCalendarRefreshTerminalFailureCode, JUNCTION_CALENDAR_REFRESH_JOB_INVALID_CODE, JUNCTION_COMPANION_HRV_OBSERVATION_INVALID_CODE, } from "./junction-resources.js";
+import { buildJunctionProviderSourceInstanceKey } from "./config/junction-connect-sources.js";
+import { HOSTED_EXECUTION_DEVICE_SYNC_PASS_JOB_LIMIT, sanitizeHostedRuntimeDiagnosticText, sanitizeHostedRuntimeErrorText, } from "./hosted-runtime.js";
 import { createDeviceSyncPublicIngress, DeviceSyncPublicIngress } from "./public-ingress.js";
-import { toRedactedPublicDeviceSyncAccount } from "./public-account.js";
+import { isDeviceSyncConnectionSetupPending, isDeviceSyncSourceDisconnectFenced, toRedactedPublicDeviceSyncAccount, } from "./public-account.js";
 import { createDeviceSyncRegistry } from "./registry.js";
 import { addMilliseconds, computeRetryDelayMs, defaultStateDatabasePath, generatePrefixedId, normalizeString, normalizeOriginList, normalizePublicBaseUrl, sha256Text, stringifyJson, toIsoTimestamp, } from "./shared.js";
 import { SqliteDeviceSyncStore } from "./store.js";
-import { DEVICE_SYNC_WEBHOOK_TRACE_COMPLETED, } from "./types.js";
+import { DEVICE_SYNC_CANONICAL_IMPORT_RECEIPT_LIMIT, DEVICE_SYNC_WEBHOOK_TRACE_COMPLETED, } from "./types.js";
 export { SqliteDeviceSyncStore } from "./store.js";
+export function resolveDeviceSyncStoreNextJobWakeAt(input) {
+    const store = new SqliteDeviceSyncStore(input.stateDatabasePath ?? defaultStateDatabasePath(input.vaultRoot));
+    try {
+        return store.readNextJobWakeAt();
+    }
+    finally {
+        store.close();
+    }
+}
 export function resolveDeviceSyncStoreNextWakeAt(input) {
     const store = new SqliteDeviceSyncStore(input.stateDatabasePath ?? defaultStateDatabasePath(input.vaultRoot));
     try {
@@ -23,11 +37,38 @@ export function resolveDeviceSyncStoreNextWakeAt(input) {
 const DEVICE_SYNC_VALIDATION_ISSUE_LIMIT = 10;
 const DEVICE_SYNC_VALIDATION_CAUSE_DEPTH_LIMIT = 4;
 const DEVICE_SYNC_JOB_YIELD_POLL_MS = 100;
+// Never retain fewer diagnostics than one hosted pass can produce, and never
+// regress below the established 100-attempt observability window.
+export const DEVICE_SYNC_JOB_FAILURE_DIAGNOSTIC_LIMIT = Math.max(100, HOSTED_EXECUTION_DEVICE_SYNC_PASS_JOB_LIMIT);
+export const DEVICE_SYNC_JOB_TIMING_DIAGNOSTIC_LIMIT = Math.max(100, HOSTED_EXECUTION_DEVICE_SYNC_PASS_JOB_LIMIT);
 const DEVICE_SYNC_CONNECTION_MUTATION_MAX_PENDING = 1;
 const DEVICE_SYNC_CONNECTION_MUTATION_WAIT_TIMEOUT_MS = 15_000;
 const DEFAULT_PROVIDER_JOB_BATCH_MAX_JOBS = 50;
 const DEFAULT_PROVIDER_JOB_BATCH_MAX_ESTIMATED_BYTES = 2 * 1024 * 1024;
 const DEFAULT_PROVIDER_JOB_BATCH_CANDIDATE_SCAN_LIMIT = 200;
+const JUNCTION_WORKOUT_STREAM_CANDIDATE_DIAGNOSTIC_LIMIT = resolveJunctionTimeseriesResourcePolicy("workout_stream")?.maxRecordsPerWindow ?? 0;
+const JUNCTION_ECG_DIAGNOSTIC_COUNT_LIMIT = (resolveJunctionTimeseriesResourcePolicy("electrocardiogram_voltage")?.maxSamplesPerWindow ?? 0) + 1;
+const JUNCTION_ECG_BINDING_REASONS = new Set([
+    "collection_source_ambiguous",
+    "feature_cardinality_mismatch",
+    "group_ambiguous",
+    "group_collection_invalid",
+    "group_envelope_invalid",
+    "group_identity_conflict",
+    "group_invalid",
+    "recording_limit_exceeded",
+    "sample_count_mismatch",
+    "sample_identity_conflict",
+    "sample_invalid",
+    "sample_limit_exceeded",
+    "sample_normalization_invalid",
+    "sample_outside_summary_window",
+    "summary_identity_conflict",
+    "summary_identity_incomplete",
+    "summary_source_inconsistent",
+    "summary_window_invalid",
+    "summary_windows_ambiguous",
+]);
 const DEVICE_SYNC_VALIDATION_SENSITIVE_FIELD_PATTERN = /(?:authorization|bearer|cookie|password|secret|token|api[-_]?key|client[-_]?secret|access[-_]?token|refresh[-_]?token|id[-_]?token|email|phone|address|user(?:name)?|owner|account(?:id)?|external(?:id)?)/iu;
 const DEVICE_SYNC_VALIDATION_METADATA_FIELDS = Object.freeze([
     "expected",
@@ -82,6 +123,7 @@ class DeviceSyncServiceController {
     registry;
     logger;
     importer;
+    listConnectionSourcesForJob;
     store;
     publicIngress;
     codec;
@@ -99,6 +141,7 @@ class DeviceSyncServiceController {
     workerTimer = null;
     schedulerTimer = null;
     jobFailureDiagnostics = [];
+    jobTimingDiagnostics = [];
     connectionMutationStates = new Map();
     constructor(input) {
         this.vaultRoot = input.config.vaultRoot;
@@ -106,6 +149,7 @@ class DeviceSyncServiceController {
         this.allowedReturnOrigins = normalizeOriginList(input.config.allowedReturnOrigins);
         this.registry = input.registry ?? createDeviceSyncRegistry(input.providers ?? []);
         this.importer = input.importer ?? createDefaultImporterPort();
+        this.listConnectionSourcesForJob = input.listConnectionSourcesForJob;
         this.logger = input.config.log ?? console;
         this.clock = input.clock ?? defaultDeviceSyncClock;
         this.schedulerMutex = input.schedulerMutex ?? createDeviceSyncTickMutex();
@@ -132,6 +176,8 @@ class DeviceSyncServiceController {
                 deleteExpiredOAuthStates: (now) => this.store.deleteExpiredOAuthStates(now),
                 createOAuthState: (record) => this.store.createOAuthState(record),
                 consumeOAuthState: (state, now, expectedProvider, expectedOwnerId) => this.store.consumeOAuthState(state, now, expectedProvider, expectedOwnerId),
+                discardUnconsumedOAuthState: (state, now, expectedProvider, expectedOwnerId) => this.store.discardUnconsumedOAuthState(state, now, expectedProvider, expectedOwnerId),
+                resolveOAuthStateWithoutProviderAuthority: (claim) => this.store.resolveOAuthStateWithoutProviderAuthority(claim),
                 upsertConnection: (record) => this.toPublicAccount(this.store.upsertAccount({
                     provider: record.provider,
                     externalAccountId: record.externalAccountId,
@@ -146,16 +192,33 @@ class DeviceSyncServiceController {
                     }, record.credential, record.tokens),
                     metadata: record.metadata,
                     existingAccountGuard: record.existingAccountGuard ?? null,
+                    existingAccountPolicy: record.existingAccountPolicy,
                     connectedAt: record.connectedAt,
                     nextReconcileAt: record.nextReconcileAt ?? null,
+                    oauthClaim: record.oauthClaim,
                 })),
                 markConnectionSetupFailed: (record) => {
-                    const result = this.store.markConnectionSetupFailed(record.accountId, record.expectedConnectedAt, record.now, record.code, record.message);
+                    const result = this.store.markConnectionSetupFailed(record.accountId, record.expectedConnectedAt, record.now, record.code, record.message, record.oauthClaim);
                     return {
                         account: result.account ? this.toPublicAccount(result.account) : null,
                         applied: result.applied,
+                        blockedByRefreshLease: result.blockedByRefreshLease,
+                        oauthTokenVersion: result.oauthTokenVersion,
                     };
                 },
+                clearOAuthCredentialAfterConfirmedRevoke: (record) => this.store.clearOAuthCredentialAfterConfirmedRevoke(record.accountId, record.expectedConnectedAt, record.expectedTokenVersion, record.now),
+                getOAuthCleanupAccount: (record) => {
+                    const account = this.store.getAccountById(record.accountId);
+                    if (!account
+                        || account.connectedAt !== record.expectedConnectedAt
+                        || account.localTokenRevision !== record.expectedTokenVersion
+                        || account.status !== "reauthorization_required"
+                        || account.setupPhase !== "failed"
+                        || account.credential.kind !== "oauth_tokens") {
+                        return null;
+                    }
+                    return this.toDecryptedAccount(account);
+                },
                 getConnectionById: (accountId) => {
                     const account = this.store.getAccountById(accountId);
                     return account ? this.toPublicAccount(account) : null;
@@ -164,6 +227,33 @@ class DeviceSyncServiceController {
                     const account = this.store.getAccountByExternalAccount(provider, externalAccountId);
                     return account ? this.toPublicAccount(account) : null;
                 },
+                getWebhookConnectionByExternalAccount: (provider, externalAccountId) => {
+                    const account = this.store.getAccountByExternalAccount(provider, externalAccountId);
+                    return account
+                        ? {
+                            account: this.toPublicAccount(account),
+                            connectionOwnerId: null,
+                        }
+                        : null;
+                },
+                upsertConnectionSource: (input, options) => this.store.upsertConnectionSource(input, options),
+                listConnectionSources: (input) => this.store.listConnectionSources(input),
+                resolveConnectionSourceAdmissionCandidate: (input) => this.store.listConnectionSources(input)
+                    .sort((left, right) => {
+                    const leftExact = input.sourceInstanceKey !== undefined
+                        && left.sourceInstanceKey === input.sourceInstanceKey;
+                    const rightExact = input.sourceInstanceKey !== undefined
+                        && right.sourceInstanceKey === input.sourceInstanceKey;
+                    const leftAdmitted = left.status === "connected"
+                        && !isDeviceSyncSourceDisconnectFenced(left);
+                    const rightAdmitted = right.status === "connected"
+                        && !isDeviceSyncSourceDisconnectFenced(right);
+                    return Number(rightExact) - Number(leftExact)
+                        || Number(rightAdmitted) - Number(leftAdmitted)
+                        || Date.parse(right.lastSeenAt) - Date.parse(left.lastSeenAt)
+                        || left.sourceInstanceKey.localeCompare(right.sourceInstanceKey)
+                        || left.id.localeCompare(right.id);
+                })[0] ?? null,
                 claimWebhookTrace: (record) => this.store.claimWebhookTrace(record),
                 completeWebhookTrace: (provider, traceId, claimToken) => this.store.completeWebhookTrace(provider, traceId, claimToken),
                 releaseWebhookTrace: (provider, traceId, claimToken) => this.store.releaseWebhookTrace(provider, traceId, claimToken),
@@ -172,9 +262,41 @@ class DeviceSyncServiceController {
             },
             hooks: {
                 runConnectionMutation: ({ provider }, operation) => this.runProviderConnectionMutation(provider, operation),
-                onConnectionEstablished: async ({ account, connection, provider }) => {
-                    this.enqueueJobs(account, connection.initialJobs ?? []);
+                onConnectionEstablished: async ({ account, connection, connectionStartedAt, now, provider, sourceProviderSlug, }) => {
+                    const sourceInstanceKey = provider.provider === "junction" && sourceProviderSlug
+                        ? buildJunctionProviderSourceInstanceKey({
+                            connectionId: account.id,
+                            sourceProviderSlug,
+                        })
+                        : null;
+                    const committed = this.store.commitConnectionEstablished({
+                        accountId: account.id,
+                        expectedSourceLastSeenAt: connectionStartedAt,
+                        jobs: this.normalizeJobsForEnqueue(account, connection.initialJobs ?? []),
+                        provider: account.provider,
+                        source: sourceInstanceKey && sourceProviderSlug
+                            ? {
+                                connectionId: account.id,
+                                sourceInstanceKey,
+                                sourceProviderSlug,
+                                status: "connected",
+                                firstSeenAt: now,
+                                lastSeenAt: now,
+                            }
+                            : null,
+                    });
+                    if (sourceInstanceKey && committed === null) {
+                        throw deviceSyncError({
+                            code: "CONNECTION_SOURCE_START_STALE",
+                            message: "Device source state changed while its connection link was starting. Start again.",
+                            retryable: false,
+                            httpStatus: 409,
+                        });
+                    }
                     await this.ensureWebhookAdminUpkeepAfterConnectionEstablished(provider);
+                    return {
+                        sourceAdmissionCommitted: true,
+                    };
                 },
                 onWebhookAccepted: async ({ account, claimToken, traceId, webhook }) => {
                     this.store.enqueueJobsAndCompleteWebhookTrace({
@@ -260,6 +382,9 @@ class DeviceSyncServiceController {
             details: { ...entry.details },
         }));
     }
+    listJobTimingDiagnostics() {
+        return this.jobTimingDiagnostics.map((entry) => ({ ...entry }));
+    }
     start() {
         if (!this.workerTimer) {
             void this.runWorkerBatchOnce();
@@ -304,6 +429,15 @@ class DeviceSyncServiceController {
     }
     queueManualReconcile(accountId) {
         const account = this.requireStoredAccount(accountId);
+        if (account.status === "active"
+            && isDeviceSyncConnectionSetupPending(account)) {
+            throw deviceSyncError({
+                code: "CONNECTION_SETUP_PENDING",
+                message: "Finish device sync setup before reconciling this account.",
+                retryable: false,
+                httpStatus: 409,
+            });
+        }
         if (account.status === "disconnected") {
             throw deviceSyncError({
                 code: "ACCOUNT_DISCONNECTED",
@@ -322,7 +456,13 @@ class DeviceSyncServiceController {
         }
         const provider = this.requireProvider(account.provider);
         const now = this.nowIso();
-        const scheduledJobs = resolveProviderJobExecutor(provider)?.createScheduledJobs?.(account, now).jobs ?? [];
+        const scheduledJobs = resolveProviderJobExecutor(provider)?.createScheduledJobs?.(account, now, {
+            findActiveDedupeKeys: (dedupeKeys) => this.store.findActiveJobDedupeKeys({
+                accountId: account.id,
+                dedupeKeys,
+                provider: account.provider,
+            }),
+        }).jobs ?? [];
         const jobs = scheduledJobs.length > 0 ? scheduledJobs : [{ kind: "reconcile", priority: 80 }];
         const queuedJobs = this.enqueueJobs(account, jobs.map((job) => ({
             ...job,
@@ -396,12 +536,20 @@ class DeviceSyncServiceController {
         }
         return nextWakeAt;
     }
-    async runSchedulerOnce() {
-        await this.schedulerMutex.runIfIdle(async () => {
+    getNextJobWakeAt() {
+        return this.store.readNextJobWakeAt();
+    }
+    async runSchedulerOnce(accountId) {
+        return await this.schedulerMutex.runIfIdle(async () => {
             const now = this.nowIso();
+            const queuedJobs = [];
             try {
                 for (const account of this.store.listAccounts()) {
-                    if (account.status !== "active" || !account.nextReconcileAt || Date.parse(account.nextReconcileAt) > Date.parse(now)) {
+                    if ((accountId !== undefined && account.id !== accountId)
+                        || account.status !== "active"
+                        || isDeviceSyncConnectionSetupPending(account)
+                        || !account.nextReconcileAt
+                        || Date.parse(account.nextReconcileAt) > Date.parse(now)) {
                         continue;
                     }
                     const provider = this.registry.get(account.provider);
@@ -409,8 +557,14 @@ class DeviceSyncServiceController {
                     if (!jobExecutor?.createScheduledJobs) {
                         continue;
                     }
-                    const schedule = jobExecutor.createScheduledJobs(account, now);
-                    this.enqueueJobs(account, schedule.jobs);
+                    const schedule = jobExecutor.createScheduledJobs(account, now, {
+                        findActiveDedupeKeys: (dedupeKeys) => this.store.findActiveJobDedupeKeys({
+                            accountId: account.id,
+                            dedupeKeys,
+                            provider: account.provider,
+                        }),
+                    });
+                    queuedJobs.push(...this.enqueueJobs(account, schedule.jobs));
                     this.store.patchAccount(account.id, {
                         nextReconcileAt: schedule.nextReconcileAt ?? null,
                     });
@@ -422,10 +576,13 @@ class DeviceSyncServiceController {
                     error: summarizeError(error),
                 });
             }
-        });
+            return queuedJobs;
+        }) ?? [];
     }
-    async runWorkerOnce() {
+    async runWorkerOnce(accountId) {
         const result = await this.runWorkerPassOnce({
+            accountId,
+            importSession: createDeviceProviderSnapshotImportSession(),
             maxJobRows: Number.POSITIVE_INFINITY,
         });
         return result?.job ?? null;
@@ -439,27 +596,85 @@ class DeviceSyncServiceController {
             return null;
         }
         const now = this.nowIso();
-        const job = this.store.claimDueJob(this.workerId, now, this.workerLeaseMs);
+        const job = this.store.claimDueJob(this.workerId, now, this.workerLeaseMs, input.accountId);
         const currentNow = () => this.nowIso();
         if (!job) {
             return null;
         }
         let activeJobs = [job];
-        const finishPass = () => ({
-            job,
-            processedJobRows: Math.max(1, activeJobs.length),
-        });
+        let connectionSourceReadCount = 0;
+        let connectionSourceReadElapsedMs = 0;
+        let credentialRefreshCount = 0;
+        let credentialRefreshElapsedMs = 0;
+        let durableProgressCommitted = false;
+        let outcome = "cancelled";
+        let providerExecutionElapsedMs = null;
+        let providerInventoryRequestCount = 0;
+        let providerInventoryRequestElapsedMs = 0;
+        let providerResourceRequestCount = 0;
+        let providerResourceRequestElapsedMs = 0;
+        let snapshotImportCount = 0;
+        let snapshotImportElapsedMs = 0;
+        let snapshotCanonicalCoreElapsedMs = 0;
+        let snapshotCanonicalWriteElapsedMs = 0;
+        let snapshotEventIdentityIndexCacheHitCount = 0;
+        let snapshotEventIdentityIndexElapsedMs = 0;
+        let snapshotNormalizationElapsedMs = 0;
+        const finishPass = () => {
+            const finishedAt = currentNow();
+            const resource = readSafeDiagnosticToken(job.payload.resource);
+            this.recordJobTimingDiagnostic({
+                at: finishedAt,
+                attempts: job.attempts,
+                connectionSourceReadCount,
+                connectionSourceReadElapsedMs,
+                credentialRefreshCount,
+                credentialRefreshElapsedMs,
+                durableProgressCommitted,
+                elapsedMs: nonnegativeDeviceSyncDurationMs(now, finishedAt),
+                jobCount: Math.max(1, activeJobs.length),
+                jobKind: job.kind,
+                outcome,
+                provider: job.provider,
+                providerExecutionElapsedMs,
+                providerInventoryRequestCount,
+                providerInventoryRequestElapsedMs,
+                providerResourceRequestCount,
+                providerResourceRequestElapsedMs,
+                providerUnattributedElapsedMs: providerExecutionElapsedMs === null
+                    ? null
+                    : Math.max(0, providerExecutionElapsedMs
+                        - connectionSourceReadElapsedMs
+                        - credentialRefreshElapsedMs
+                        - providerInventoryRequestElapsedMs
+                        - providerResourceRequestElapsedMs
+                        - snapshotImportElapsedMs),
+                ...(resource ? { resource } : {}),
+                snapshotImportCount,
+                snapshotImportElapsedMs,
+                snapshotCanonicalCoreElapsedMs,
+                snapshotCanonicalWriteElapsedMs,
+                snapshotEventIdentityIndexCacheHitCount,
+                snapshotEventIdentityIndexElapsedMs,
+                snapshotNormalizationElapsedMs,
+            });
+            return {
+                job,
+                processedJobRows: Math.max(1, activeJobs.length),
+            };
+        };
         const failClaimedJob = (code, message, retryAt, retryable) => {
             const failedAt = currentNow();
-            const failed = this.store.failJobIfOwned(job.id, this.workerId, failedAt, code, message, retryAt, retryable);
-            if (!failed) {
+            const failureTransition = this.store.failJobIfOwned(job.id, this.workerId, failedAt, code, message, retryAt, retryable);
+            if (!failureTransition) {
                 this.logger.debug?.("Device sync job side effects skipped because execution was cancelled.", {
                     provider: job.provider,
                     accountId: job.accountId,
                     jobId: job.id,
                 });
-                return failed;
+                return false;
             }
+            outcome = "failed";
             // No summary here: these repo-authored messages can embed the local
             // account id, and the failure code already names the cause.
             const failedJobResource = readSafeDiagnosticToken(job.payload.resource);
@@ -467,15 +682,18 @@ class DeviceSyncServiceController {
                 accountId: job.accountId,
                 accountStatus: null,
                 at: failedAt,
-                attempts: job.attempts,
+                attempts: failureTransition.attempts,
                 code,
                 details: {},
+                jobDisposition: failureTransition.disposition,
                 jobKind: job.kind,
+                maxAttempts: failureTransition.maxAttempts,
                 provider: job.provider,
+                remainingAttempts: failureTransition.remainingAttempts,
                 ...(failedJobResource ? { resource: failedJobResource } : {}),
                 retryable,
             });
-            return failed;
+            return true;
         };
         const provider = this.registry.get(job.provider);
         if (!provider) {
@@ -488,6 +706,34 @@ class DeviceSyncServiceController {
             return finishPass();
         }
         const preservesAcceptedCompanionHrv = isJunctionCompanionHrvRmssdJob(job);
+        const retainsAcceptedCalendarRefresh = isJunctionSparseCalendarRefreshJob(job);
+        const retainsAcceptedWork = preservesAcceptedCompanionHrv || retainsAcceptedCalendarRefresh;
+        const delayRetainedJobUntilAuthorityReturns = (code, message) => {
+            const delayedAt = currentNow();
+            const transition = this.store.failJobIfOwned(job.id, this.workerId, delayedAt, code, message, addMilliseconds(delayedAt, computeRetryDelayMs(job.attempts)), true, true);
+            outcome = transition ? "deferred" : "cancelled";
+        };
+        if (retainsAcceptedCalendarRefresh
+            && !isJunctionSparseCalendarRefreshPayloadValid(job.payload)) {
+            failClaimedJob(JUNCTION_CALENDAR_REFRESH_JOB_INVALID_CODE, "Junction calendar refresh job payload was invalid.", null, false);
+            return finishPass();
+        }
+        if (storedAccount.status === "active"
+            && isDeviceSyncConnectionSetupPending(storedAccount)
+            && !retainsAcceptedWork) {
+            failClaimedJob("CONNECTION_SETUP_PENDING", "Device sync setup must finish before queued jobs can run.", null, false);
+            return finishPass();
+        }
+        if (storedAccount.status === "active"
+            && isDeviceSyncConnectionSetupPending(storedAccount)
+            && retainsAcceptedCalendarRefresh) {
+            delayRetainedJobUntilAuthorityReturns("CONNECTION_SETUP_PENDING", "Device sync setup must finish before retained calendar work can run.");
+            return finishPass();
+        }
+        if (storedAccount.status === "disconnected" && retainsAcceptedCalendarRefresh) {
+            delayRetainedJobUntilAuthorityReturns("ACCOUNT_DISCONNECTED", "Device sync account must reconnect before retained calendar work can run.");
+            return finishPass();
+        }
         if (storedAccount.status === "disconnected" && !preservesAcceptedCompanionHrv) {
             const completed = this.store.completeJobIfOwned(job.id, this.workerId, currentNow());
             if (!completed) {
@@ -497,6 +743,14 @@ class DeviceSyncServiceController {
                     jobId: job.id,
                 });
             }
+            else {
+                outcome = "completed";
+                durableProgressCommitted = true;
+            }
+            return finishPass();
+        }
+        if (storedAccount.status === "reauthorization_required" && retainsAcceptedCalendarRefresh) {
+            delayRetainedJobUntilAuthorityReturns("ACCOUNT_REAUTHORIZATION_REQUIRED", "Device sync account must reauthorize before retained calendar work can run.");
             return finishPass();
         }
         if (storedAccount.status === "reauthorization_required" && !preservesAcceptedCompanionHrv) {
@@ -549,6 +803,7 @@ class DeviceSyncServiceController {
         const releaseActiveJobsIfCurrentAccountActive = (releaseNow) => {
             const currentStoredAccount = this.store.getAccountById(storedAccount.id);
             if (!currentStoredAccount || (!preservesAcceptedCompanionHrv
+                && !retainsAcceptedCalendarRefresh
                 && (currentStoredAccount.status !== "active"
                     || currentStoredAccount.disconnectGeneration !== disconnectGeneration))) {
                 return 0;
@@ -590,7 +845,7 @@ class DeviceSyncServiceController {
             ensureExecutionActive();
             currentAccount = this.toDecryptedAccount(storedAccount);
             const normalizedJob = normalizeConfiguredDeviceSyncJobRecord(provider.provider, job, "execution");
-            activeJobs = preservesAcceptedCompanionHrv
+            activeJobs = preservesAcceptedCompanionHrv || retainsAcceptedCalendarRefresh
                 ? [normalizedJob]
                 : this.claimProviderJobBatch({
                     accountId: storedAccount.id,
@@ -603,40 +858,131 @@ class DeviceSyncServiceController {
             const normalizedJobs = activeJobs.map((activeJob) => activeJob.id === normalizedJob.id
                 ? normalizedJob
                 : normalizeConfiguredDeviceSyncJobRecord(provider.provider, activeJob, "execution"));
+            let vaultTimeZone;
+            if (provider.provider === "junction"
+                && this.importer.resolveDeviceProviderSnapshotDefaultTimeZone) {
+                try {
+                    vaultTimeZone = await this.importer.resolveDeviceProviderSnapshotDefaultTimeZone({
+                        vaultRoot: this.vaultRoot,
+                    });
+                }
+                catch {
+                    // Timezone-dependent authority fails closed; ordinary provider
+                    // ingestion remains available when vault metadata cannot be read.
+                    vaultTimeZone = undefined;
+                }
+            }
+            ensureExecutionActive();
+            const canonicalImportReceipts = new Map();
             const jobContext = {
                 account: currentAccount,
                 now,
+                ...(vaultTimeZone ? { vaultTimeZone } : {}),
                 signal: jobAbortController.signal,
+                connectionSourceAdmissionMode: this.listConnectionSourcesForJob
+                    ? "listed_only"
+                    : "discover_unlisted",
                 ...(this.shouldYieldJobExecution
                     ? { shouldYield: this.shouldYieldJobExecution }
                     : {}),
                 throwIfAborted: assertJobExecutionNotYielded,
-                importSnapshot: async (snapshot) => {
+                recordProviderRequestTiming: (category, elapsedMs) => {
+                    if (!Number.isFinite(elapsedMs) || elapsedMs < 0) {
+                        return;
+                    }
+                    if (category === "inventory") {
+                        providerInventoryRequestCount += 1;
+                        providerInventoryRequestElapsedMs += elapsedMs;
+                    }
+                    else {
+                        providerResourceRequestCount += 1;
+                        providerResourceRequestElapsedMs += elapsedMs;
+                    }
+                },
+                importSnapshot: async (snapshot, options) => {
                     ensureExecutionActive();
-                    const importResult = await this.importer.importDeviceProviderSnapshot({
-                        provider: provider.provider,
-                        snapshot,
-                        vaultRoot: this.vaultRoot,
-                    });
+                    const importStartedAt = currentNow();
+                    snapshotImportCount += 1;
+                    let importResult;
+                    try {
+                        importResult = await this.importer.importDeviceProviderSnapshot({
+                            provider: provider.provider,
+                            snapshot,
+                            vaultRoot: this.vaultRoot,
+                            ...options,
+                        }, { importSession: input.importSession });
+                    }
+                    finally {
+                        snapshotImportElapsedMs += nonnegativeDeviceSyncDurationMs(importStartedAt, currentNow());
+                    }
+                    const importTiming = readDeviceProviderSnapshotImportTiming(importResult);
+                    if (importTiming) {
+                        snapshotCanonicalCoreElapsedMs += importTiming.canonicalCoreElapsedMs;
+                        snapshotCanonicalWriteElapsedMs += importTiming.canonicalWriteElapsedMs;
+                        snapshotEventIdentityIndexCacheHitCount += importTiming.eventIdentityIndexCacheHit
+                            ? 1
+                            : 0;
+                        snapshotEventIdentityIndexElapsedMs += importTiming.eventIdentityIndexElapsedMs;
+                        snapshotNormalizationElapsedMs += importTiming.normalizationElapsedMs;
+                    }
+                    const canonicalEventCount = readCanonicalDeviceImportEventCount(importResult);
+                    const junctionCanonicalCoverage = readCanonicalDeviceImportJunctionCoverage(importResult);
+                    if (junctionCanonicalCoverage && junctionCanonicalCoverage.length > 0) {
+                        const importCompletedAt = currentNow();
+                        for (const evidence of junctionCanonicalCoverage) {
+                            const key = `${evidence.sourceProviderSlug}\u0000${evidence.resource}`;
+                            if (canonicalImportReceipts.has(key)
+                                || canonicalImportReceipts.size < DEVICE_SYNC_CANONICAL_IMPORT_RECEIPT_LIMIT) {
+                                canonicalImportReceipts.set(key, {
+                                    importCompletedAt,
+                                    resource: evidence.resource,
+                                    sourceProviderSlug: evidence.sourceProviderSlug,
+                                });
+                            }
+                        }
+                    }
+                    const canonicalSparseCalendarTargets = readCanonicalDeviceImportSparseCalendarTargets(importResult);
                     const receipt = {
-                        canonicalEventCount: readCanonicalDeviceImportEventCount(importResult),
+                        canonicalEventCount,
+                        canonicalEventDayKeys: readCanonicalDeviceImportEventDayKeys(importResult),
+                        canonicalEventExternalRefResourceIds: readCanonicalDeviceImportEventExternalRefResourceIds(importResult),
+                        ...(canonicalSparseCalendarTargets.length > 0
+                            ? { canonicalSparseCalendarTargets }
+                            : {}),
                         durableDeliveryAccepted: true,
+                        ...(junctionCanonicalCoverage === undefined
+                            ? {}
+                            : { junctionCanonicalCoverage }),
                     };
                     return receipt;
                 },
                 upsertConnectionSource: (input) => {
                     ensureExecutionActive();
-                    return this.store.upsertConnectionSource({
-                        ...input,
-                        connectionId: currentAccount.id,
-                    });
+                    return this.store.upsertConnectionSource({ ...input, connectionId: currentAccount.id }, { preserveDisconnected: provider.provider === "junction" });
                 },
-                listConnectionSources: (input = {}) => {
+                listConnectionSources: async (input = {}) => {
                     ensureExecutionActive();
-                    return this.store.listConnectionSources({
-                        ...input,
-                        connectionId: currentAccount.id,
-                    });
+                    const sourceReadStartedAt = currentNow();
+                    connectionSourceReadCount += 1;
+                    let sources;
+                    try {
+                        sources = this.listConnectionSourcesForJob
+                            ? await this.listConnectionSourcesForJob({
+                                accountId: currentAccount.id,
+                                provider: currentAccount.provider,
+                                signal: jobAbortController.signal,
+                                ...input,
+                            })
+                            : this.store.listConnectionSources({
+                                ...input,
+                                connectionId: currentAccount.id,
+                            });
+                    }
+                    finally {
+                        connectionSourceReadElapsedMs += nonnegativeDeviceSyncDurationMs(sourceReadStartedAt, currentNow());
+                    }
+                    ensureExecutionActive();
+                    return sources;
                 },
                 refreshAccountTokens: async () => {
                     ensureExecutionActive();
@@ -657,7 +1003,15 @@ class DeviceSyncServiceController {
                             httpStatus: 409,
                         });
                     }
-                    const refreshed = await refreshTokens(currentAccount);
+                    const credentialRefreshStartedAt = currentNow();
+                    credentialRefreshCount += 1;
+                    let refreshed;
+                    try {
+                        refreshed = await refreshTokens(currentAccount);
+                    }
+                    finally {
+                        credentialRefreshElapsedMs += nonnegativeDeviceSyncDurationMs(credentialRefreshStartedAt, currentNow());
+                    }
                     ensureJobLeasesOwned();
                     ensureAccountActive();
                     const updated = this.store.updateAccountTokens(currentAccount.id, this.encryptTokens(currentAccount, refreshed), disconnectGeneration);
@@ -685,18 +1039,35 @@ class DeviceSyncServiceController {
                 },
                 logger: this.logger,
             };
-            const result = normalizedJobs.length > 1 && jobExecutor.batch
-                ? await jobExecutor.batch.execute(jobContext, normalizedJobs)
-                : await jobExecutor.executeJob(jobContext, normalizedJob);
+            const providerExecutionStartedAt = currentNow();
+            let result;
+            try {
+                result = normalizedJobs.length > 1 && jobExecutor.batch
+                    ? await jobExecutor.batch.execute(jobContext, normalizedJobs)
+                    : await jobExecutor.executeJob(jobContext, normalizedJob);
+            }
+            finally {
+                providerExecutionElapsedMs = nonnegativeDeviceSyncDurationMs(providerExecutionStartedAt, currentNow());
+            }
             ensureJobLeasesOwned();
             ensureAccountActive();
             if (preservesAcceptedCompanionHrv && !isOriginalActiveAccountExecutionCurrent()) {
-                this.store.completeJobsIfOwned(activeJobs.map((activeJob) => activeJob.id), this.workerId, currentNow());
+                const completed = this.store.completeJobsIfOwned(activeJobs.map((activeJob) => activeJob.id), this.workerId, currentNow());
+                outcome = completed ? "completed" : "cancelled";
+                durableProgressCommitted = completed;
                 return finishPass();
             }
             const successOptions = {
                 localConnectionRevision,
             };
+            if (provider.provider === "junction"
+                && shouldPreserveJunctionLastSyncCompletedAt({
+                    activeJobs,
+                    scheduledJobs: result.scheduledJobs ?? [],
+                    syncSucceededAt: now,
+                })) {
+                successOptions.preserveLastSyncCompletedAt = true;
+            }
             if (Object.prototype.hasOwnProperty.call(result, "metadataPatch")) {
                 successOptions.metadataPatch = result.metadataPatch;
             }
@@ -706,6 +1077,8 @@ class DeviceSyncServiceController {
             const scheduledJobs = this.normalizeJobsForEnqueue(storedAccount, result.scheduledJobs ?? []);
             const completed = this.store.completeJobsMarkSyncSucceededAndEnqueueJobs({
                 accountId: storedAccount.id,
+                canonicalImportReceipts: [...canonicalImportReceipts.values()].sort((left, right) => left.sourceProviderSlug.localeCompare(right.sourceProviderSlug)
+                    || left.resource.localeCompare(right.resource)),
                 completedAt: currentNow(),
                 disconnectGeneration,
                 jobIds: activeJobs.map((activeJob) => activeJob.id),
@@ -719,6 +1092,8 @@ class DeviceSyncServiceController {
                 releaseActiveJobsIfCurrentAccountActive(currentNow());
                 return finishPass();
             }
+            outcome = "completed";
+            durableProgressCommitted = true;
             return finishPass();
         }
         catch (error) {
@@ -731,6 +1106,7 @@ class DeviceSyncServiceController {
                     jobCount: activeJobs.length,
                     released,
                 });
+                outcome = "yielded";
                 return finishPass();
             }
             if (error instanceof DeviceSyncJobExecutionCancelledError) {
@@ -742,12 +1118,33 @@ class DeviceSyncServiceController {
                     jobId: job.id,
                     ...(released > 0 ? { released } : {}),
                 });
+                outcome = "cancelled";
                 return finishPass();
             }
-            const failure = normalizeExecutionError(error);
+            const timeseriesProgress = error instanceof JunctionTimeseriesProgressError
+                ? error
+                : null;
+            const failure = normalizeExecutionError(timeseriesProgress?.failure ?? error);
+            const replacementPayload = timeseriesProgress
+                ? normalizeConfiguredDeviceSyncJobRecord(provider.provider, {
+                    ...job,
+                    payload: {
+                        ...job.payload,
+                        windowStart: timeseriesProgress.windowStart,
+                        workoutStreamEmptySeen: timeseriesProgress.workoutStreamEmptySeen || undefined,
+                        workoutStreamCursor: timeseriesProgress.workoutStreamCursor ?? undefined,
+                    },
+                }, "retry progress").payload
+                : undefined;
             const retainsAcceptedCompanionHrvUntilSuccess = preservesAcceptedCompanionHrv
                 && failure.code !== JUNCTION_COMPANION_HRV_OBSERVATION_INVALID_CODE;
-            const retainedFailureRetryable = failure.retryable || retainsAcceptedCompanionHrvUntilSuccess;
+            const retainsAcceptedCalendarRefreshUntilSuccess = retainsAcceptedCalendarRefresh
+                && !isJunctionSparseCalendarRefreshTerminalFailureCode(failure.code);
+            const retainsAcceptedWorkUntilSuccess = retainsAcceptedCompanionHrvUntilSuccess
+                || retainsAcceptedCalendarRefreshUntilSuccess;
+            const retainedFailureRetryable = failure.retryable
+                || retainsAcceptedCompanionHrvUntilSuccess
+                || retainsAcceptedCalendarRefreshUntilSuccess;
             const failureNow = currentNow();
             if (!isAccountExecutionCurrent()) {
                 const released = releaseActiveJobsIfCurrentAccountActive(failureNow);
@@ -760,27 +1157,36 @@ class DeviceSyncServiceController {
                 });
                 return finishPass();
             }
-            const failed = activeJobs
-                .map((activeJob) => {
+            const failureTransitions = activeJobs.flatMap((activeJob) => {
                 const retryAt = retainedFailureRetryable
                     ? addMilliseconds(failureNow, computeRetryDelayMs(activeJob.attempts))
                     : null;
-                return this.store.failJobIfOwned(activeJob.id, this.workerId, failureNow, failure.code, failure.message, retryAt, retainedFailureRetryable, retainsAcceptedCompanionHrvUntilSuccess);
-            })
-                .some(Boolean);
-            if (!failed) {
+                const transition = this.store.failJobIfOwned(activeJob.id, this.workerId, failureNow, failure.code, failure.message, retryAt, retainedFailureRetryable, retainsAcceptedWorkUntilSuccess, activeJob.id === job.id ? replacementPayload : undefined);
+                return transition ? [{ activeJob, transition }] : [];
+            });
+            if (failureTransitions.length === 0) {
                 return finishPass();
             }
-            const failedJobResource = readSafeDiagnosticToken(job.payload.resource);
+            outcome = "failed";
+            durableProgressCommitted = timeseriesProgress !== null;
+            const diagnosticTransition = failureTransitions.find(({ activeJob }) => activeJob.id === job.id)
+                ?? failureTransitions[0];
+            if (!diagnosticTransition) {
+                return finishPass();
+            }
+            const failedJobResource = readSafeDiagnosticToken(diagnosticTransition.activeJob.payload.resource);
             this.recordJobFailureDiagnostic({
                 accountId: storedAccount.id,
                 accountStatus: failure.accountStatus ?? null,
                 at: failureNow,
-                attempts: job.attempts,
+                attempts: diagnosticTransition.transition.attempts,
                 code: failure.code,
                 details: failure.details,
-                jobKind: job.kind,
+                jobDisposition: diagnosticTransition.transition.disposition,
+                jobKind: diagnosticTransition.activeJob.kind,
+                maxAttempts: diagnosticTransition.transition.maxAttempts,
                 provider: provider.provider,
+                remainingAttempts: diagnosticTransition.transition.remainingAttempts,
                 ...(failedJobResource ? { resource: failedJobResource } : {}),
                 retryable: retainedFailureRetryable,
                 summary: failure.message,
@@ -827,17 +1233,21 @@ class DeviceSyncServiceController {
             stopYieldPolling();
         }
     }
-    async drainWorker(limit = this.workerBatchSize) {
+    async drainWorker(limit = this.workerBatchSize, accountId, options = {}) {
         const maxJobRows = normalizeProviderJobBatchLimit(limit, this.workerBatchSize);
         let processedJobRows = 0;
+        const importSession = createDeviceProviderSnapshotImportSession();
         while (processedJobRows < maxJobRows) {
             const result = await this.runWorkerPassOnce({
+                accountId,
+                importSession,
                 maxJobRows: maxJobRows - processedJobRows,
             });
             if (!result) {
                 break;
             }
             processedJobRows += result.processedJobRows;
+            options.onProcessedJobRows?.(processedJobRows);
         }
         return processedJobRows;
     }
@@ -946,8 +1356,14 @@ class DeviceSyncServiceController {
             ...entry,
             details: { ...entry.details },
         });
-        if (this.jobFailureDiagnostics.length > 50) {
-            this.jobFailureDiagnostics.splice(0, this.jobFailureDiagnostics.length - 50);
+        if (this.jobFailureDiagnostics.length > DEVICE_SYNC_JOB_FAILURE_DIAGNOSTIC_LIMIT) {
+            this.jobFailureDiagnostics.splice(0, this.jobFailureDiagnostics.length - DEVICE_SYNC_JOB_FAILURE_DIAGNOSTIC_LIMIT);
+        }
+    }
+    recordJobTimingDiagnostic(entry) {
+        this.jobTimingDiagnostics.push({ ...entry });
+        if (this.jobTimingDiagnostics.length > DEVICE_SYNC_JOB_TIMING_DIAGNOSTIC_LIMIT) {
+            this.jobTimingDiagnostics.splice(0, this.jobTimingDiagnostics.length - DEVICE_SYNC_JOB_TIMING_DIAGNOSTIC_LIMIT);
         }
     }
     requireStoredAccount(accountId) {
@@ -1102,8 +1518,11 @@ class DeviceSyncServiceController {
 export function createDefaultImporterPort() {
     const importers = createImporters();
     return {
-        importDeviceProviderSnapshot(input) {
-            return importers.importDeviceProviderSnapshot(input);
+        importDeviceProviderSnapshot(input, options) {
+            return importers.importDeviceProviderSnapshot(input, options);
+        },
+        resolveDeviceProviderSnapshotDefaultTimeZone(input) {
+            return importers.resolveDeviceProviderSnapshotDefaultTimeZone(input);
         },
     };
 }
@@ -1120,6 +1539,7 @@ export function createDeviceSyncService(input) {
         listAccounts: (input) => controller.listAccounts(input),
         getAccount: (accountId) => controller.getAccount(accountId),
         listJobFailureDiagnostics: () => controller.listJobFailureDiagnostics(),
+        listJobTimingDiagnostics: () => controller.listJobTimingDiagnostics(),
         start: () => controller.start(),
         stop: () => controller.stop(),
         close: () => controller.close(),
@@ -1129,13 +1549,22 @@ export function createDeviceSyncService(input) {
         handleWebhook: (providerName, headers, rawBody) => controller.handleWebhook(providerName, headers, rawBody),
         queueManualReconcile: (accountId) => controller.queueManualReconcile(accountId),
         disconnectAccount: (accountId, expectedConnectedAt) => controller.disconnectAccount(accountId, expectedConnectedAt),
+        getNextJobWakeAt: () => controller.getNextJobWakeAt(),
         getNextWakeAt: (now) => controller.getNextWakeAt(now),
-        runSchedulerOnce: () => controller.runSchedulerOnce(),
-        runWorkerOnce: () => controller.runWorkerOnce(),
-        drainWorker: (limit) => controller.drainWorker(limit),
+        runSchedulerOnce: (accountId) => controller.runSchedulerOnce(accountId),
+        runWorkerOnce: (accountId) => controller.runWorkerOnce(accountId),
+        drainWorker: (limit, accountId, options) => controller.drainWorker(limit, accountId, options),
     });
     return service;
 }
+function nonnegativeDeviceSyncDurationMs(startAt, endAt) {
+    const startMs = Date.parse(startAt);
+    const endMs = Date.parse(endAt);
+    if (!Number.isFinite(startMs) || !Number.isFinite(endMs) || endMs < startMs) {
+        return 0;
+    }
+    return endMs - startMs;
+}
 function earliestIsoTimestamp(...values) {
     return values
         .filter((value) => typeof value === "string" && value.length > 0)
@@ -1235,6 +1664,33 @@ function connectionChangedDuringDisconnectError() {
     });
 }
 function normalizeExecutionError(error) {
+    if (error instanceof JunctionWorkoutStreamTimestampCardinalityError) {
+        return {
+            code: "SYNC_JOB_FAILED",
+            details: compactFailureDiagnostics({
+                failureErrorName: readSafeDiagnosticToken(error.name),
+                junctionWorkoutStreamMaxTimestampCount: error.diagnostic.maxTimestampCount,
+                junctionWorkoutStreamTimestampCardinalityKind: readSafeDiagnosticToken(error.diagnostic.kind),
+                junctionWorkoutStreamTimestampCount: error.diagnostic.timestampCount,
+            }),
+            message: summarizeExecutionErrorMessage(error),
+            retryable: false,
+        };
+    }
+    if (error instanceof JunctionSparseCalendarRepairNormalizationError) {
+        return {
+            code: error.code,
+            details: compactFailureDiagnostics({
+                normalizationFailureReason: readSafeDiagnosticToken(error.diagnostic.reason),
+                normalizationRowOrdinal: error.diagnostic.rowOrdinal,
+                normalizationSourceProvider: readSafeDiagnosticToken(normalizeKnownJunctionSourceProviderSlug(error.diagnostic.sourceProvider)),
+                normalizationTimestampKind: readSafeDiagnosticToken(error.diagnostic.timestampKind),
+                normalizationTimestampSemantics: readSafeDiagnosticToken(error.diagnostic.timestampSemantics),
+            }),
+            message: error.message,
+            retryable: true,
+        };
+    }
     if (isDeviceSyncError(error)) {
         return {
             code: error.code,
@@ -1270,6 +1726,9 @@ function summarizeDeviceSyncErrorMessage(error) {
 }
 function buildDeviceSyncErrorFailureDiagnostics(error) {
     const cause = toPlainRecord(error.cause);
+    const providerRequestEndpointKind = readSafeDiagnosticToken(error.details?.requestEndpointKind);
+    const workoutCandidateContext = readSafeWorkoutCandidateFailureContext(error, providerRequestEndpointKind);
+    const junctionEcgContext = readSafeJunctionEcgFailureContext(error);
     return compactFailureDiagnostics({
         failureCauseCode: readSafeDiagnosticToken(cause?.code),
         failureCauseName: readSafeDiagnosticToken(cause?.name),
@@ -1281,9 +1740,11 @@ function buildDeviceSyncErrorFailureDiagnostics(error) {
         providerRequestBodyFieldCount: readSafeDiagnosticNumber(error.details?.requestBodyFieldCount),
         providerRequestBodyFieldNames: readSafeDiagnosticToken(error.details?.requestBodyFieldNames),
         providerRequestBodyKind: readSafeDiagnosticToken(error.details?.requestBodyKind),
+        ...junctionEcgContext,
+        ...workoutCandidateContext,
         providerRequestContentType: readSafeDiagnosticToken(error.details?.requestContentType),
         providerRequestCredentialPresent: readSafeDiagnosticBoolean(error.details?.requestCredentialPresent),
-        providerRequestEndpointKind: readSafeDiagnosticToken(error.details?.requestEndpointKind),
+        providerRequestEndpointKind,
         providerRequestMethod: readSafeDiagnosticToken(error.details?.requestMethod),
         providerRequestQueryParameterCount: readSafeDiagnosticNumber(error.details?.requestQueryParameterCount),
         providerRequestQueryParameterNames: readSafeDiagnosticToken(error.details?.requestQueryParameterNames),
@@ -1349,6 +1810,68 @@ function readSafeDiagnosticToken(value) {
 function readSafeDiagnosticBoolean(value) {
     return typeof value === "boolean" ? value : null;
 }
+function readSafeWorkoutCandidateFailureContext(error, providerRequestEndpointKind) {
+    if (error.code !== "JUNCTION_API_REQUEST_FAILED"
+        || providerRequestEndpointKind !== "junction_workout_stream") {
+        return {};
+    }
+    const aliasSource = readSafeWorkoutCandidateAliasSource(error.details?.requestCandidateAliasSource);
+    const candidateCount = readSafeWorkoutCandidateBoundedNumber(error.details?.requestCandidateCount);
+    const candidateOrdinal = readSafeWorkoutCandidateBoundedNumber(error.details?.requestCandidateOrdinal);
+    if (!aliasSource
+        || candidateCount === null
+        || candidateOrdinal === null
+        || candidateOrdinal > candidateCount) {
+        return {};
+    }
+    return {
+        providerRequestCandidateAliasSource: aliasSource,
+        providerRequestCandidateCount: candidateCount,
+        providerRequestCandidateOrdinal: candidateOrdinal,
+    };
+}
+function readSafeJunctionEcgFailureContext(error) {
+    if (error.code !== "JUNCTION_ECG_RECORDING_BINDING_INCOMPLETE") {
+        return {};
+    }
+    const reason = readSafeDiagnosticToken(error.details?.reason);
+    if (!reason || !JUNCTION_ECG_BINDING_REASONS.has(reason)) {
+        return {};
+    }
+    return compactFailureDiagnostics({
+        junctionEcgActualRecordingCount: readSafeJunctionEcgDiagnosticCount(error.details?.actualRecordingCount),
+        junctionEcgActualSampleCount: readSafeJunctionEcgDiagnosticCount(error.details?.actualSampleCount),
+        junctionEcgBindingReason: reason,
+        junctionEcgExpectedRecordingCount: readSafeJunctionEcgDiagnosticCount(error.details?.expectedRecordingCount),
+        junctionEcgExpectedSampleCount: readSafeJunctionEcgDiagnosticCount(error.details?.expectedSampleCount),
+        junctionEcgMaxRecordingCount: readSafeJunctionEcgDiagnosticCount(error.details?.maxRecordingCount),
+        junctionEcgMaxSampleCount: readSafeJunctionEcgDiagnosticCount(error.details?.maxSampleCount),
+    });
+}
+function readSafeJunctionEcgDiagnosticCount(value) {
+    return typeof value === "number"
+        && Number.isSafeInteger(value)
+        && value >= 0
+        && value <= JUNCTION_ECG_DIAGNOSTIC_COUNT_LIMIT
+        ? value
+        : null;
+}
+function readSafeWorkoutCandidateAliasSource(value) {
+    return value === "id"
+        || value === "multiple_equal"
+        || value === "workoutId"
+        || value === "workout_id"
+        ? value
+        : null;
+}
+function readSafeWorkoutCandidateBoundedNumber(value) {
+    return typeof value === "number"
+        && Number.isSafeInteger(value)
+        && value >= 1
+        && value <= JUNCTION_WORKOUT_STREAM_CANDIDATE_DIAGNOSTIC_LIMIT
+        ? value
+        : null;
+}
 function readSafeDiagnosticNumber(value) {
     return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
@@ -1452,10 +1975,147 @@ function toPlainRecord(value) {
     }
     return value;
 }
+function readDeviceProviderSnapshotImportTiming(value) {
+    const timing = toPlainRecord(toPlainRecord(value)?.deviceProviderSnapshotImportTiming);
+    if (!timing || typeof timing.eventIdentityIndexCacheHit !== "boolean") {
+        return null;
+    }
+    const readDuration = (field) => {
+        const duration = timing[field];
+        return typeof duration === "number" && Number.isFinite(duration) && duration >= 0
+            ? duration
+            : null;
+    };
+    const canonicalCoreElapsedMs = readDuration("canonicalCoreElapsedMs");
+    const canonicalWriteElapsedMs = readDuration("canonicalWriteElapsedMs");
+    const eventIdentityIndexElapsedMs = readDuration("eventIdentityIndexElapsedMs");
+    const normalizationElapsedMs = readDuration("normalizationElapsedMs");
+    if (canonicalCoreElapsedMs === null
+        || canonicalWriteElapsedMs === null
+        || eventIdentityIndexElapsedMs === null
+        || normalizationElapsedMs === null) {
+        return null;
+    }
+    return {
+        canonicalCoreElapsedMs,
+        canonicalWriteElapsedMs,
+        eventIdentityIndexCacheHit: timing.eventIdentityIndexCacheHit,
+        eventIdentityIndexElapsedMs,
+        normalizationElapsedMs,
+    };
+}
 function readCanonicalDeviceImportEventCount(value) {
     const record = toPlainRecord(value);
     return record && Array.isArray(record.events) ? record.events.length : 0;
 }
+function readCanonicalDeviceImportEventDayKeys(value) {
+    const record = toPlainRecord(value);
+    if (!record || !Array.isArray(record.events)) {
+        return [];
+    }
+    return [...new Set([
+            ...record.events.flatMap((event) => {
+                const dayKey = toPlainRecord(event)?.dayKey;
+                return typeof dayKey === "string" ? [dayKey] : [];
+            }),
+            ...readStringArray(record.affectedEventDayKeys),
+        ].filter((dayKey) => /^\d{4}-\d{2}-\d{2}$/u.test(dayKey)))].sort();
+}
+function shouldPreserveJunctionLastSyncCompletedAt(input) {
+    if (input.scheduledJobs.some(isFullDeviceSyncJob)) {
+        return true;
+    }
+    const currentClosedDayEnd = floorUtcDayTimestampIfValid(input.syncSucceededAt);
+    if (!currentClosedDayEnd) {
+        return true;
+    }
+    return !input.activeJobs.some((job) => isFullDeviceSyncJob(job)
+        && normalizeIsoTimestamp(job.payload.windowEnd) === currentClosedDayEnd);
+}
+function isFullDeviceSyncJob(job) {
+    return job.kind === "backfill" || job.kind === "reconcile";
+}
+function floorUtcDayTimestampIfValid(value) {
+    const normalized = normalizeIsoTimestamp(value);
+    return normalized ? `${normalized.slice(0, 10)}T00:00:00.000Z` : null;
+}
+function normalizeIsoTimestamp(value) {
+    if (typeof value !== "string") {
+        return null;
+    }
+    const timestamp = Date.parse(value);
+    return Number.isFinite(timestamp) ? new Date(timestamp).toISOString() : null;
+}
+function readCanonicalDeviceImportEventExternalRefResourceIds(value) {
+    const record = toPlainRecord(value);
+    if (!record || !Array.isArray(record.events)) {
+        return [];
+    }
+    return record.events.flatMap((event) => {
+        const externalRef = toPlainRecord(toPlainRecord(event)?.externalRef);
+        return typeof externalRef?.resourceId === "string"
+            ? [externalRef.resourceId]
+            : [];
+    });
+}
+function readCanonicalDeviceImportJunctionCoverage(value) {
+    const result = toPlainRecord(value);
+    if (!result || !Array.isArray(result.junctionCanonicalCoverage)) {
+        return undefined;
+    }
+    return result.junctionCanonicalCoverage.flatMap((entry) => {
+        const evidence = toPlainRecord(entry);
+        const resource = typeof evidence?.resource === "string" ? evidence.resource : "";
+        const coverageBoundary = normalizeJunctionCanonicalCoverageBoundary(resource, evidence?.coverageBoundary);
+        if (!evidence
+            || !coverageBoundary
+            || !resource
+            || typeof evidence.sourceProviderSlug !== "string") {
+            return [];
+        }
+        const coverageFinalizedAt = typeof evidence.coverageFinalizedAt === "string"
+            && Number.isFinite(Date.parse(evidence.coverageFinalizedAt))
+            && new Date(Date.parse(evidence.coverageFinalizedAt)).toISOString()
+                === evidence.coverageFinalizedAt
+            ? evidence.coverageFinalizedAt
+            : null;
+        return [{
+                coverageBoundary,
+                ...(coverageFinalizedAt
+                    ? { coverageFinalizedAt }
+                    : {}),
+                resource,
+                sourceProviderSlug: evidence.sourceProviderSlug,
+            }];
+    });
+}
+function readCanonicalDeviceImportSparseCalendarTargets(value) {
+    const record = toPlainRecord(value);
+    if (!record || !Array.isArray(record.affectedSparseCalendarTargets)) {
+        return [];
+    }
+    return record.affectedSparseCalendarTargets.flatMap((value) => {
+        const target = toPlainRecord(value);
+        const dayKey = target?.dayKey;
+        const sourceProviderSlug = target?.sourceProviderSlug;
+        if (typeof dayKey !== "string"
+            || !/^\d{4}-\d{2}-\d{2}$/u.test(dayKey)
+            || typeof sourceProviderSlug !== "string"
+            || !sourceProviderSlug) {
+            return [];
+        }
+        const sourceInstanceId = target.sourceInstanceId;
+        const sourceType = target.sourceType;
+        return [{
+                dayKey,
+                ...(typeof sourceInstanceId === "string" || sourceInstanceId === null
+                    ? { sourceInstanceId }
+                    : {}),
+                sourceProviderSlug,
+                ...(typeof sourceType === "string" ? { sourceType } : {}),
+            }];
+    });
+}
 function formatValidationPath(value) {
     if (!Array.isArray(value) || value.length === 0) {
         return "$";