@opendatalabs/personal-server-ts-core 0.0.1-canary.00328bf

package/dist/sync/pdpp-import.js

@@ -0,0 +1,422 @@
+/**
+ * Import qualifying synced DataPipe envelopes into the PDPP record store.
+ *
+ * The production path already existed end to end: Unity's OwnerDataClient
+ * writes an encrypted `DataFileEnvelope` and registers it with the Gateway,
+ * and `sync/workers/download.ts` downloads, decrypts and indexes it. What was
+ * missing was the last hop — that decrypted envelope reaching the PDPP record
+ * store, so a grant-bound client can read it. This module is that hop, and
+ * nothing else: it does not fetch, does not decrypt, and does not open a
+ * second ingestion surface. There is no web HTTP ingest here by design; the
+ * encrypted owner-data transport stays the only way data arrives.
+ *
+ * Why the metadata lives in `data.$pdpp`
+ * -------------------------------------
+ * The SDK's `DataFileEnvelopeSchema` accepts only `$schema`, `version`,
+ * `scope`, `schemaId`, `collectedAt` and `data`, and STRIPS unknown top-level
+ * keys. A `$pdpp` sibling of `scope` would therefore be silently deleted in
+ * transit — not rejected, deleted — so the producer nests it inside `data`,
+ * the one field whose interior the transport preserves verbatim. That is a
+ * transport constraint, not a preference.
+ *
+ * The consequence this module owns: `$pdpp` is import metadata that arrived
+ * inside the payload, so it must be removed before the record is stored.
+ * Otherwise every PDPP read would serve back a `$pdpp` blob that is not part
+ * of the source's declared schema, and a field projection computed from the
+ * declaration would not cover it.
+ *
+ * What is verified before anything is written
+ * -------------------------------------------
+ * Every check below is a fail-closed rejection, because the alternative is
+ * importing a record whose identity or authority we could not confirm:
+ *
+ *   1. `$pdpp.version === 1`. An unknown metadata version is refused rather
+ *      than interpreted under this version's assumptions.
+ *   2. The declaration digest is recomputed over the EXACT retained
+ *      declaration document this deployment booted with, and must equal the
+ *      digest the producer claims. This is the check that makes the rest
+ *      meaningful: without it the producer would be asserting its own
+ *      authority over the stream shape it is being validated against.
+ *   3. `scope`, `stream.name` and `primaryKey` must agree with that same
+ *      declaration, and `record.key` must agree with the payload's actual
+ *      primary-key values.
+ *
+ * Only then is `$pdpp` stripped and the record handed to the store.
+ *
+ * Instance derivation is PS-owned
+ * -------------------------------
+ * The producer supplies no instance id and must not: an instance handle is a
+ * statement about this deployment's connection inventory, which the producer
+ * cannot observe. The importer derives it through the same function the
+ * authorization and resource servers use, so an imported record is readable
+ * under a grant issued for the same source. An id that cannot be derived is a
+ * rejection, never an invention.
+ */
+import { computeRecordKeyFromData } from "../storage/pdpp-records/record-key.js";
+/** The reserved key carrying PDPP import metadata inside `data`. */
+export const PDPP_METADATA_KEY = "$pdpp";
+/** The only `$pdpp.version` this importer understands. */
+export const SUPPORTED_PDPP_METADATA_VERSION = 1;
+/**
+ * Rejection codes that describe the ENVELOPE rather than this deployment's
+ * current state. They are permanent verdicts: the same bytes re-read on a
+ * later cycle produce the same answer, so retrying them is work that can
+ * never succeed.
+ *
+ * `unknown_source` and `no_instance` are deliberately NOT here. Both depend
+ * on what this deployment has mounted — a declaration that is not retained
+ * yet, or an instance inventory that is not populated yet — and both start
+ * working once boot completes or an operator provisions the declaration.
+ * Treating them as permanent is exactly how an envelope gets stranded.
+ * `store_rejected` is likewise excluded: the store is infrastructure, and a
+ * write it refuses today may be accepted once it is healthy.
+ */
+const PERMANENT_REJECTION_CODES = new Set([
+    "malformed_metadata",
+    "unsupported_metadata_version",
+    "digest_mismatch",
+    "declaration_version_mismatch",
+    "scope_mismatch",
+    "unknown_stream",
+    "primary_key_mismatch",
+    "semantics_mismatch",
+    "record_key_mismatch",
+]);
+/**
+ * Whether a rejection is a settled verdict about the envelope itself.
+ *
+ * Callers use this to decide whether re-offering the same envelope later
+ * could ever change the answer. Fail-closed by construction: an unrecognized
+ * code is treated as transient, so a new failure mode is retried (visibly,
+ * with a logged outcome) rather than silently abandoned.
+ */
+export function isPermanentRejection(rejection) {
+    return PERMANENT_REJECTION_CODES.has(rejection.code);
+}
+function reject(code, message) {
+    return { status: "rejected", rejection: { code, message } };
+}
+/**
+ * Normalize a claimed digest to bare lowercase hex.
+ *
+ * The producer contract writes `sha256:<hex>`; this repo's
+ * `computeDeclarationDigest` returns bare hex with no prefix. Accepting both
+ * spellings of the same SHA-256 value keeps the two sides interoperable
+ * without either silently coercing the other. Any OTHER algorithm prefix
+ * returns null and fails the import: treating `md5:...` as if it were the
+ * SHA-256 we computed would turn the digest check into decoration.
+ */
+export function normalizeDigest(claimed) {
+    const trimmed = claimed.trim().toLowerCase();
+    const colon = trimmed.indexOf(":");
+    if (colon === -1)
+        return /^[0-9a-f]{64}$/.test(trimmed) ? trimmed : null;
+    if (trimmed.slice(0, colon) !== "sha256")
+        return null;
+    const hex = trimmed.slice(colon + 1);
+    return /^[0-9a-f]{64}$/.test(hex) ? hex : null;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Read `data.$pdpp` into a typed shape, or explain why it is not usable.
+ *
+ * Returns `null` for "no metadata present", which is the ordinary legacy
+ * case and must stay distinguishable from a malformed `$pdpp` — a producer
+ * that writes broken metadata should be visible, not silently treated as a
+ * legacy write.
+ */
+function readMetadata(data) {
+    if (!isRecord(data))
+        return null;
+    const raw = data[PDPP_METADATA_KEY];
+    if (raw === undefined)
+        return null;
+    if (!isRecord(raw))
+        return { ok: false, reason: "$pdpp is not an object" };
+    if (typeof raw.version !== "number") {
+        return { ok: false, reason: "$pdpp.version is missing or not a number" };
+    }
+    if (typeof raw.sourceId !== "string" || raw.sourceId.length === 0) {
+        return { ok: false, reason: "$pdpp.sourceId is missing" };
+    }
+    const declaration = raw.declaration;
+    if (!isRecord(declaration)) {
+        return { ok: false, reason: "$pdpp.declaration is missing" };
+    }
+    if (typeof declaration.digest !== "string" ||
+        declaration.digest.length === 0) {
+        return { ok: false, reason: "$pdpp.declaration.digest is missing" };
+    }
+    if (typeof declaration.version !== "string") {
+        return { ok: false, reason: "$pdpp.declaration.version is missing" };
+    }
+    const stream = raw.stream;
+    if (!isRecord(stream))
+        return { ok: false, reason: "$pdpp.stream is missing" };
+    if (typeof stream.name !== "string" || stream.name.length === 0) {
+        return { ok: false, reason: "$pdpp.stream.name is missing" };
+    }
+    if (typeof stream.scope !== "string" || stream.scope.length === 0) {
+        return { ok: false, reason: "$pdpp.stream.scope is missing" };
+    }
+    if (!Array.isArray(stream.primaryKey) ||
+        stream.primaryKey.length === 0 ||
+        !stream.primaryKey.every((f) => typeof f === "string")) {
+        return { ok: false, reason: "$pdpp.stream.primaryKey is missing" };
+    }
+    const record = raw.record;
+    if (!isRecord(record))
+        return { ok: false, reason: "$pdpp.record is missing" };
+    if (!isRecord(record.key)) {
+        return { ok: false, reason: "$pdpp.record.key is missing" };
+    }
+    const op = record.op ?? "upsert";
+    if (op !== "upsert" && op !== "delete") {
+        return {
+            ok: false,
+            reason: `$pdpp.record.op '${String(op)}' is not valid`,
+        };
+    }
+    return {
+        ok: true,
+        meta: {
+            version: raw.version,
+            sourceId: raw.sourceId,
+            declaration: {
+                source: typeof declaration.source === "string" ? declaration.source : "",
+                version: declaration.version,
+                upstreamCommit: typeof declaration.upstreamCommit === "string"
+                    ? declaration.upstreamCommit
+                    : null,
+                digest: declaration.digest,
+            },
+            stream: {
+                name: stream.name,
+                scope: stream.scope,
+                semantics: typeof stream.semantics === "string" ? stream.semantics : "",
+                primaryKey: stream.primaryKey,
+            },
+            record: { key: record.key, op },
+            ...(isRecord(raw.run) && {
+                run: {
+                    ...(typeof raw.run.id === "string" && { id: raw.run.id }),
+                    ...(typeof raw.run.source === "string" && { source: raw.run.source }),
+                },
+            }),
+        },
+    };
+}
+/** Remove `$pdpp` without mutating the caller's object. */
+function stripMetadata(data) {
+    const { [PDPP_METADATA_KEY]: _dropped, ...rest } = data;
+    return rest;
+}
+function sameArray(a, b) {
+    return a.length === b.length && a.every((v, i) => v === b[i]);
+}
+/**
+ * Deep structural equality over JSON-shaped values.
+ *
+ * Used only to decide "did this record actually change?". Key order must not
+ * count as a change: the producer re-serializes the payload on every run, so
+ * an order-sensitive comparison would report every re-sync as a new version
+ * and fill `changes_since` with records that are byte-identical to what a
+ * client already read.
+ */
+function jsonEqual(a, b) {
+    if (a === b)
+        return true;
+    if (typeof a !== typeof b)
+        return false;
+    if (a === null || b === null)
+        return false;
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) {
+            return false;
+        }
+        return a.every((item, i) => jsonEqual(item, b[i]));
+    }
+    if (typeof a !== "object")
+        return false;
+    const ao = a;
+    const bo = b;
+    const aKeys = Object.keys(ao).sort();
+    const bKeys = Object.keys(bo).sort();
+    if (!sameArray(aKeys, bKeys))
+        return false;
+    return aKeys.every((k) => jsonEqual(ao[k], bo[k]));
+}
+export function createPdppImporter(deps) {
+    const { store, logger } = deps;
+    const bySourceId = new Map();
+    for (const declaration of deps.declarations) {
+        bySourceId.set(declaration.sourceId, declaration);
+    }
+    /**
+     * Versions whose import outcome cannot change on a later offer. Bounded by
+     * the number of distinct (scope, collectedAt) pairs this process sees, and
+     * holding only a short key per entry.
+     */
+    const settled = new Set();
+    const versionKey = (scope, collectedAt) => `${scope}@${collectedAt}`;
+    function needsRetry(scope, collectedAt) {
+        return !settled.has(versionKey(scope, collectedAt));
+    }
+    /**
+     * Record whether this version is done with, so the retry path can stop
+     * reading it back off disk every cycle.
+     *
+     * Only a transient rejection stays unsettled — that is the one outcome a
+     * later cycle can genuinely improve on.
+     */
+    function importAndSettle(envelope) {
+        const outcome = importEnvelope(envelope);
+        const retryable = outcome.status === "rejected" && !isPermanentRejection(outcome.rejection);
+        if (!retryable) {
+            settled.add(versionKey(envelope.scope, envelope.collectedAt));
+        }
+        return outcome;
+    }
+    function importEnvelope(envelope) {
+        const read = readMetadata(envelope.data);
+        if (read === null)
+            return { status: "skipped" };
+        if (!read.ok)
+            return reject("malformed_metadata", read.reason);
+        const meta = read.meta;
+        if (meta.version !== SUPPORTED_PDPP_METADATA_VERSION) {
+            return reject("unsupported_metadata_version", `$pdpp.version ${meta.version} is not supported (expected ${SUPPORTED_PDPP_METADATA_VERSION})`);
+        }
+        const retained = bySourceId.get(meta.sourceId);
+        if (!retained) {
+            return reject("unknown_source", `no retained declaration for source '${meta.sourceId}'`);
+        }
+        // The digest gate. Everything after this point is validated against a
+        // document we have confirmed is the one the producer claims to have read.
+        const claimed = normalizeDigest(meta.declaration.digest);
+        if (claimed === null) {
+            return reject("digest_mismatch", `declaration digest '${meta.declaration.digest}' is not a recognized sha256 digest`);
+        }
+        if (claimed !== retained.documentDigest.trim().toLowerCase()) {
+            return reject("digest_mismatch", `declaration digest does not match the retained declaration for '${meta.sourceId}'`);
+        }
+        if (meta.declaration.version !== retained.version) {
+            return reject("declaration_version_mismatch", `declaration version '${meta.declaration.version}' does not match retained version '${retained.version}'`);
+        }
+        // The scope the envelope was transported under must be the scope the
+        // metadata claims. Without this, metadata for one scope could ride on a
+        // blob decrypted under another scope's key.
+        if (meta.stream.scope !== envelope.scope) {
+            return reject("scope_mismatch", `$pdpp.stream.scope '${meta.stream.scope}' does not match envelope scope '${envelope.scope}'`);
+        }
+        const declaredStream = retained.streams.find((s) => s.name === meta.stream.name);
+        if (!declaredStream) {
+            return reject("unknown_stream", `stream '${meta.stream.name}' is not declared by the retained declaration for '${meta.sourceId}'`);
+        }
+        if (!sameArray(meta.stream.primaryKey, declaredStream.primaryKey)) {
+            return reject("primary_key_mismatch", `stream '${meta.stream.name}' declares primary key [${declaredStream.primaryKey.join(", ")}] but the envelope claims [${meta.stream.primaryKey.join(", ")}]`);
+        }
+        if (meta.stream.semantics.length > 0 &&
+            meta.stream.semantics !== declaredStream.semantics) {
+            return reject("semantics_mismatch", `stream '${meta.stream.name}' is ${declaredStream.semantics} here but the envelope claims '${meta.stream.semantics}'`);
+        }
+        const instance = deps.instanceFor(meta.sourceId);
+        if (!instance) {
+            return reject("no_instance", `no instance handle could be derived for source '${meta.sourceId}'`);
+        }
+        if (!isRecord(envelope.data)) {
+            return reject("malformed_metadata", "envelope data is not an object");
+        }
+        const payload = stripMetadata(envelope.data);
+        // `record.key` is the producer's claim about identity; the payload is the
+        // record. They must agree, or the record would be stored under a key that
+        // does not describe it — and a grant naming that key would authorize the
+        // wrong row.
+        let keyFromData;
+        let keyFromClaim;
+        try {
+            keyFromData = computeRecordKeyFromData(payload, declaredStream.primaryKey);
+            keyFromClaim = computeRecordKeyFromData(meta.record.key, declaredStream.primaryKey);
+        }
+        catch (err) {
+            return reject("record_key_mismatch", err.message);
+        }
+        if (keyFromData !== keyFromClaim) {
+            return reject("record_key_mismatch", "$pdpp.record.key does not match the payload's primary key values");
+        }
+        // Idempotency. `ingestBatch` allocates a NEW version on every accepted
+        // mutable_state upsert, so an unconditional re-ingest would bump the
+        // version and publish a `changes_since` entry every time the sync worker
+        // re-downloads an unchanged record — which it does on any full reconcile
+        // or retry. Comparing against the stored row first is what makes a repeat
+        // sync a no-op rather than a fabricated change.
+        // `getRecord` returns undefined for a deleted row as well as an absent
+        // one, which is exactly the distinction both branches below need.
+        const existing = store.getRecord(instance, meta.stream.name, keyFromData);
+        const unchanged = {
+            status: "unchanged",
+            instance,
+            stream: meta.stream.name,
+            recordKey: keyFromData,
+        };
+        if (meta.record.op === "delete") {
+            // A delete for a record we do not currently hold changes nothing.
+            // Ingesting it would write a tombstone announcing the removal of
+            // something this store never served — a fabricated change.
+            if (!existing)
+                return unchanged;
+        }
+        else if (existing &&
+            jsonEqual(existing.data, payload) &&
+            existing.emittedAt === envelope.collectedAt) {
+            return unchanged;
+        }
+        // A single-field key must stay a bare string. `encodeRecordKey` treats an
+        // array as a COMPOUND key and JSON-encodes it, so wrapping a lone value
+        // in an array would produce `["235680975"]` where the data yields
+        // `235680975` — a key/data mismatch the store rejects, on every record of
+        // every single-key stream.
+        const components = declaredStream.primaryKey.map((f) => String(payload[f]));
+        const input = {
+            instance,
+            stream: meta.stream.name,
+            key: components.length === 1 ? components[0] : components,
+            data: meta.record.op === "delete" ? null : payload,
+            emitted_at: envelope.collectedAt,
+            op: meta.record.op,
+        };
+        // One envelope per call, but through the batch API so the store's own
+        // transaction wraps the write: a failure rolls back rather than leaving
+        // a row without its history entry.
+        const result = store.ingestBatch([input], () => declaredStream.semantics, () => declaredStream.primaryKey);
+        if (result.rejected.length > 0) {
+            return reject("store_rejected", result.rejected[0].reason);
+        }
+        if (result.accepted === 0) {
+            // append_only duplicate: the store treats it as a no-op, and so do we.
+            return {
+                status: "unchanged",
+                instance,
+                stream: meta.stream.name,
+                recordKey: keyFromData,
+            };
+        }
+        logger.info({
+            instance,
+            stream: meta.stream.name,
+            sourceId: meta.sourceId,
+            op: meta.record.op,
+            ...(meta.run?.id && { runId: meta.run.id }),
+        }, "Imported synced DataPipe record into the PDPP record store");
+        return {
+            status: "imported",
+            instance,
+            stream: meta.stream.name,
+            recordKey: keyFromData,
+        };
+    }
+    return { importEnvelope: importAndSettle, needsRetry };
+}
+//# sourceMappingURL=pdpp-import.js.map

package/dist/sync/pdpp-import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-import.js","sourceRoot":"","sources":["../../src/sync/pdpp-import.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAOH,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAGjF,oEAAoE;AACpE,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AA+DjD;;;;;;;;;;;;;GAaG;AACH,MAAM,yBAAyB,GAAyC,IAAI,GAAG,CAC7E;IACE,oBAAoB;IACpB,8BAA8B;IAC9B,iBAAiB;IACjB,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,oBAAoB;IACpB,qBAAqB;CACtB,CACF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA8B;IACjE,OAAO,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AA6ED,SAAS,MAAM,CACb,IAA6B,EAC7B,OAAe;IAEf,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CACnB,IAAa;IAEb,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAE3E,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACpC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;IACD,IACE,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ;QACtC,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAChE,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QACjC,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC9B,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EACtD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC;IACjC,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oBAAoB,MAAM,CAAC,EAAE,CAAC,gBAAgB;SACvD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE;YACJ,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,WAAW,EAAE;gBACX,MAAM,EACJ,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBAClE,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,cAAc,EACZ,OAAO,WAAW,CAAC,cAAc,KAAK,QAAQ;oBAC5C,CAAC,CAAC,WAAW,CAAC,cAAc;oBAC5B,CAAC,CAAC,IAAI;gBACV,MAAM,EAAE,WAAW,CAAC,MAAM;aAC3B;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;gBACvE,UAAU,EAAE,MAAM,CAAC,UAAsB;aAC1C;YACD,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE;YAC/B,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI;gBACvB,GAAG,EAAE;oBACH,GAAG,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACzD,GAAG,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;iBACtE;aACF,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,SAAS,aAAa,CAAC,IAA6B;IAClD,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,CAAW,EAAE,CAAW;IACzC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,OAAO,CAAC,KAAK,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,EAAE,GAAG,CAA4B,CAAC;IACxC,MAAM,EAAE,GAAG,CAA4B,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC1D,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAE,EAAE,CACxD,GAAG,KAAK,IAAI,WAAW,EAAE,CAAC;IAE5B,SAAS,UAAU,CAAC,KAAa,EAAE,WAAmB;QACpD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,SAAS,eAAe,CAAC,QAA4B;QACnD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,SAAS,GACb,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,SAAS,cAAc,CAAC,QAA4B;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,IAAI,IAAI,CAAC,OAAO,KAAK,+BAA+B,EAAE,CAAC;YACrD,OAAO,MAAM,CACX,8BAA8B,EAC9B,iBAAiB,IAAI,CAAC,OAAO,+BAA+B,+BAA+B,GAAG,CAC/F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,MAAM,CACX,gBAAgB,EAChB,uCAAuC,IAAI,CAAC,QAAQ,GAAG,CACxD,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,MAAM,CACX,iBAAiB,EACjB,uBAAuB,IAAI,CAAC,WAAW,CAAC,MAAM,qCAAqC,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAC7D,OAAO,MAAM,CACX,iBAAiB,EACjB,mEAAmE,IAAI,CAAC,QAAQ,GAAG,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAClD,OAAO,MAAM,CACX,8BAA8B,EAC9B,wBAAwB,IAAI,CAAC,WAAW,CAAC,OAAO,sCAAsC,QAAQ,CAAC,OAAO,GAAG,CAC1G,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,wEAAwE;QACxE,4CAA4C;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;YACzC,OAAO,MAAM,CACX,gBAAgB,EAChB,uBAAuB,IAAI,CAAC,MAAM,CAAC,KAAK,oCAAoC,QAAQ,CAAC,KAAK,GAAG,CAC9F,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,CAAC;QACF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,MAAM,CACX,gBAAgB,EAChB,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,sDAAsD,IAAI,CAAC,QAAQ,GAAG,CAClG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,OAAO,MAAM,CACX,sBAAsB,EACtB,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,2BAA2B,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7J,CAAC;QACJ,CAAC;QACD,IACE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,SAAS,EAClD,CAAC;YACD,OAAO,MAAM,CACX,oBAAoB,EACpB,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,cAAc,CAAC,SAAS,kCAAkC,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,CACtH,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,MAAM,CACX,aAAa,EACb,mDAAmD,IAAI,CAAC,QAAQ,GAAG,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,oBAAoB,EAAE,gCAAgC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE7C,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,aAAa;QACb,IAAI,WAAmB,CAAC;QACxB,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,WAAW,GAAG,wBAAwB,CACpC,OAAO,EACP,cAAc,CAAC,UAAU,CAC1B,CAAC;YACF,YAAY,GAAG,wBAAwB,CACrC,IAAI,CAAC,MAAM,CAAC,GAAG,EACf,cAAc,CAAC,UAAU,CAC1B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,MAAM,CAAC,qBAAqB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,MAAM,CACX,qBAAqB,EACrB,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,gDAAgD;QAChD,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG;YAChB,MAAM,EAAE,WAAoB;YAC5B,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,SAAS,EAAE,WAAW;SACvB,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChC,kEAAkE;YAClE,iEAAiE;YACjE,2DAA2D;YAC3D,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;QAClC,CAAC;aAAM,IACL,QAAQ;YACR,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;YACjC,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,WAAW,EAC3C,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,kEAAkE;QAClE,0EAA0E;QAC1E,2BAA2B;QAC3B,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAA4B;YACrC,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,GAAG,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU;YACzD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;YAClD,UAAU,EAAE,QAAQ,CAAC,WAAW;YAChC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACnB,CAAC;QAEF,sEAAsE;QACtE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAC9B,CAAC,KAAK,CAAC,EACP,GAAG,EAAE,CAAC,cAAc,CAAC,SAAS,EAC9B,GAAG,EAAE,CAAC,cAAc,CAAC,UAAU,CAChC,CAAC;QACF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,uEAAuE;YACvE,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,QAAQ;gBACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBACxB,SAAS,EAAE,WAAW;aACvB,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,IAAI,CACT;YACE,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YAClB,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;SAC5C,EACD,4DAA4D,CAC7D,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,SAAS,EAAE,WAAW;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AACzD,CAAC"}

package/dist/sync/pending-blob-deletions.d.ts

@@ -0,0 +1,29 @@
+import type { PendingBlobDeletion, PendingBlobDeletionStore } from "../ports/index.js";
+/**
+ * Minimal persistence seam for the pending-blob-deletion markers. Hosts
+ * supply the storage (a JSON file on Node, IndexedDB state in the browser);
+ * the store keeps the set semantics, de-duplication and mutation ordering in
+ * one place. `write` must replace the whole value atomically (tmp + rename on
+ * disk, a single IndexedDB put in the browser) so a crash mid-write cannot
+ * leave a torn marker file.
+ */
+export interface PendingBlobDeletionKv {
+    read(): Promise<PendingBlobDeletion[] | null>;
+    write(keys: PendingBlobDeletion[]): Promise<void>;
+}
+/**
+ * Accept the stored value from either marker generation: exact keys
+ * (`{ scope, version }`) or the pre-key format that recorded whole scopes,
+ * which maps to a version-less marker the retry expands into exact keys.
+ */
+export declare function normalizePendingBlobDeletions(stored: unknown): PendingBlobDeletion[];
+/**
+ * Every operation is a read-modify-write of the whole marker set, so the
+ * store serialises them: a delete recording keys while a sync cycle's retry
+ * clears others must not lose either update. Ordering is FIFO, and a failed
+ * operation never blocks the ones queued behind it.
+ */
+export declare function createPendingBlobDeletionStore(kv: PendingBlobDeletionKv): PendingBlobDeletionStore;
+/** Non-durable store: markers survive only for the process lifetime. */
+export declare function createMemoryPendingBlobDeletionStore(): PendingBlobDeletionStore;
+//# sourceMappingURL=pending-blob-deletions.d.ts.map

package/dist/sync/pending-blob-deletions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-blob-deletions.d.ts","sourceRoot":"","sources":["../../src/sync/pending-blob-deletions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,wBAAwB,EACzB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,IAAI,OAAO,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAwBD;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,OAAO,GACd,mBAAmB,EAAE,CAwBvB;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,qBAAqB,GACxB,wBAAwB,CAgD1B;AAED,wEAAwE;AACxE,wBAAgB,oCAAoC,IAAI,wBAAwB,CAU/E"}

package/dist/sync/pending-blob-deletions.js

@@ -0,0 +1,116 @@
+function markerId(key) {
+    const range = key.range ? `${key.range.from}-${key.range.to}` : "";
+    return `${key.scope}\u0000${key.version ?? ""}\u0000${range}`;
+}
+function normalizeRange(value) {
+    if (typeof value !== "object" || value === null)
+        return undefined;
+    const { from, to } = value;
+    if (typeof from !== "string" ||
+        typeof to !== "string" ||
+        !/^\d+$/.test(from) ||
+        !/^\d+$/.test(to) ||
+        BigInt(from) > BigInt(to)) {
+        return undefined;
+    }
+    return { from, to };
+}
+/**
+ * Accept the stored value from either marker generation: exact keys
+ * (`{ scope, version }`) or the pre-key format that recorded whole scopes,
+ * which maps to a version-less marker the retry expands into exact keys.
+ */
+export function normalizePendingBlobDeletions(stored) {
+    if (!Array.isArray(stored))
+        return [];
+    const keys = [];
+    for (const item of stored) {
+        if (typeof item === "string") {
+            keys.push({ scope: item, version: null });
+        }
+        else if (typeof item === "object" &&
+            item !== null &&
+            typeof item.scope === "string") {
+            const version = item.version;
+            const range = typeof version === "string"
+                ? undefined
+                : normalizeRange(item.range);
+            keys.push({
+                scope: item.scope,
+                version: typeof version === "string" ? version : null,
+                ...(range ? { range } : {}),
+            });
+        }
+    }
+    return keys;
+}
+/**
+ * Every operation is a read-modify-write of the whole marker set, so the
+ * store serialises them: a delete recording keys while a sync cycle's retry
+ * clears others must not lose either update. Ordering is FIFO, and a failed
+ * operation never blocks the ones queued behind it.
+ */
+export function createPendingBlobDeletionStore(kv) {
+    let queue = Promise.resolve();
+    function serialized(operation) {
+        const run = queue.then(operation, operation);
+        queue = run.catch(() => undefined);
+        return run;
+    }
+    async function current() {
+        return normalizePendingBlobDeletions(await kv.read());
+    }
+    return {
+        list() {
+            return serialized(current);
+        },
+        add(keys) {
+            return serialized(async () => {
+                if (keys.length === 0)
+                    return;
+                const existing = await current();
+                const known = new Set(existing.map(markerId));
+                const next = [...existing];
+                for (const key of keys) {
+                    const id = markerId(key);
+                    if (known.has(id))
+                        continue;
+                    known.add(id);
+                    next.push({
+                        scope: key.scope,
+                        version: key.version,
+                        ...(key.range ? { range: { ...key.range } } : {}),
+                    });
+                }
+                if (next.length === existing.length)
+                    return;
+                await kv.write(next);
+            });
+        },
+        remove(keys) {
+            return serialized(async () => {
+                if (keys.length === 0)
+                    return;
+                const existing = await current();
+                const gone = new Set(keys.map(markerId));
+                const next = existing.filter((key) => !gone.has(markerId(key)));
+                if (next.length === existing.length)
+                    return;
+                await kv.write(next);
+            });
+        },
+    };
+}
+/** Non-durable store: markers survive only for the process lifetime. */
+export function createMemoryPendingBlobDeletionStore() {
+    let keys = [];
+    return createPendingBlobDeletionStore({
+        async read() {
+            return keys;
+        },
+        async write(next) {
+            keys = next.map((key) => ({ ...key }));
+        },
+    });
+}
+//# sourceMappingURL=pending-blob-deletions.js.map

package/dist/sync/pending-blob-deletions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-blob-deletions.js","sourceRoot":"","sources":["../../src/sync/pending-blob-deletions.ts"],"names":[],"mappings":"AAkBA,SAAS,QAAQ,CAAC,GAAwB;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,OAAO,GAAG,GAAG,CAAC,KAAK,SAAS,GAAG,CAAC,OAAO,IAAI,EAAE,SAAS,KAAK,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CACrB,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,KAAyC,CAAC;IAC/D,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,OAAO,EAAE,KAAK,QAAQ;QACtB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,EACzB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAe;IAEf,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,IAAI,GAA0B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;aAAM,IACL,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,KAAK,IAAI;YACb,OAAQ,IAA4B,CAAC,KAAK,KAAK,QAAQ,EACvD,CAAC;YACD,MAAM,OAAO,GAAI,IAA8B,CAAC,OAAO,CAAC;YACxD,MAAM,KAAK,GACT,OAAO,OAAO,KAAK,QAAQ;gBACzB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,cAAc,CAAE,IAA4B,CAAC,KAAK,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC;gBACR,KAAK,EAAG,IAA0B,CAAC,KAAK;gBACxC,OAAO,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;gBACrD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,EAAyB;IAEzB,IAAI,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEhD,SAAS,UAAU,CAAI,SAA2B;QAChD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7C,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,UAAU,OAAO;QACpB,OAAO,6BAA6B,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,OAAO;QACL,IAAI;YACF,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,GAAG,CAAC,IAAI;YACN,OAAO,UAAU,CAAC,KAAK,IAAI,EAAE;gBAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO;gBAC9B,MAAM,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC9C,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;gBAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;oBACzB,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;wBAAE,SAAS;oBAC5B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACd,IAAI,CAAC,IAAI,CAAC;wBACR,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAClD,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;oBAAE,OAAO;gBAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,IAAI;YACT,OAAO,UAAU,CAAC,KAAK,IAAI,EAAE;gBAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO;gBAC9B,MAAM,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAChE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;oBAAE,OAAO;gBAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oCAAoC;IAClD,IAAI,IAAI,GAA0B,EAAE,CAAC;IACrC,OAAO,8BAA8B,CAAC;QACpC,KAAK,CAAC,IAAI;YACR,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI;YACd,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACzC,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/sync/retry-memory.d.ts

@@ -0,0 +1,33 @@
+export type DownloadAttemptDecision = "attempt" | "backoff" | "give-up";
+export interface DownloadRetryMemoryOptions {
+    /** Attempt cap for retryable failures (default 5). */
+    maxTransientAttempts?: number;
+    /** Base backoff, doubled per failed attempt (default 30s). */
+    backoffBaseMs?: number;
+    /** Clock override for tests. */
+    now?: () => number;
+}
+export declare const DEFAULT_MAX_TRANSIENT_ATTEMPTS = 5;
+export declare const DEFAULT_BACKOFF_BASE_MS = 30000;
+export interface DownloadRetryMemory {
+    /** Whether the next download of `key` should run, wait, or never happen. */
+    decide(key: string): DownloadAttemptDecision;
+    /** Record a failed attempt; `retryable` follows the issue classification. */
+    recordFailure(key: string, retryable: boolean): void;
+    /** Clear the failure history after a successful download. */
+    recordSuccess(key: string): void;
+    /**
+     * The listing restarted from the beginning (repair pass / full
+     * reconcile) — give transient failures a fresh attempt budget so the
+     * reset can actually re-fetch what it re-lists. Deterministic (404)
+     * entries stay dead: re-listing doesn't make missing bytes appear.
+     */
+    onListingReset(): void;
+}
+/** Retry-memory key for a data-point record: id + version. */
+export declare function downloadRetryKey(record: {
+    id: string;
+    expectedVersion: string;
+}): string;
+export declare function createDownloadRetryMemory(options?: DownloadRetryMemoryOptions): DownloadRetryMemory;
+//# sourceMappingURL=retry-memory.d.ts.map

package/dist/sync/retry-memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry-memory.d.ts","sourceRoot":"","sources":["../../src/sync/retry-memory.ts"],"names":[],"mappings":"AAqBA,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAExE,MAAM,WAAW,0BAA0B;IACzC,sDAAsD;IACtD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,8DAA8D;IAC9D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAChD,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,MAAM,WAAW,mBAAmB;IAClC,4EAA4E;IAC5E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,uBAAuB,CAAC;IAC7C,6EAA6E;IAC7E,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IACrD,6DAA6D;IAC7D,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;;OAKG;IACH,cAAc,IAAI,IAAI,CAAC;CACxB;AAED,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;CACzB,GAAG,MAAM,CAET;AAQD,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,0BAA+B,GACvC,mBAAmB,CA4CrB"}